@profullstack/threatcrush 0.11.1 → 0.11.2

package/dist/index.js

@@ -3891,14 +3891,52 @@ var init_paths = __esm({
   }
 });
 
+// src/daemon/control-token.ts
+function issueControlToken() {
+  const token = (0, import_node_crypto.randomBytes)(32).toString("hex");
+  (0, import_node_fs2.writeFileSync)(CONTROL_TOKEN_FILE, token, { mode: 384 });
+  try {
+    (0, import_node_fs2.chmodSync)(CONTROL_TOKEN_FILE, 384);
+  } catch {
+  }
+  return token;
+}
+function readControlToken() {
+  if (!(0, import_node_fs2.existsSync)(CONTROL_TOKEN_FILE)) return null;
+  try {
+    const token = (0, import_node_fs2.readFileSync)(CONTROL_TOKEN_FILE, "utf-8").trim();
+    return token || null;
+  } catch {
+    return null;
+  }
+}
+function tokensMatch(expected, provided) {
+  if (typeof provided !== "string" || !provided) return false;
+  const a = Buffer.from(expected);
+  const b = Buffer.from(provided);
+  return a.length === b.length && (0, import_node_crypto.timingSafeEqual)(a, b);
+}
+var import_node_crypto, import_node_fs2, import_node_path2, CONTROL_TOKEN_FILE;
+var init_control_token = __esm({
+  "src/daemon/control-token.ts"() {
+    "use strict";
+    import_node_crypto = require("crypto");
+    import_node_fs2 = require("fs");
+    import_node_path2 = require("path");
+    init_paths();
+    CONTROL_TOKEN_FILE = (0, import_node_path2.join)(PATHS.runDir, "control.token");
+  }
+});
+
 // src/core/ipc-client.ts
-var import_node_net, import_node_fs2, IpcClient;
+var import_node_net, import_node_fs3, IpcClient;
 var init_ipc_client = __esm({
   "src/core/ipc-client.ts"() {
     "use strict";
     import_node_net = require("net");
-    import_node_fs2 = require("fs");
+    import_node_fs3 = require("fs");
     init_paths();
+    init_control_token();
     IpcClient = class {
       constructor(opts = {}) {
         this.opts = opts;
@@ -3911,10 +3949,10 @@ var init_ipc_client = __esm({
       pending = /* @__PURE__ */ new Map();
       socketPath;
       static isDaemonRunning(socketPath = resolveClientSocket()) {
-        return (0, import_node_fs2.existsSync)(socketPath);
+        return (0, import_node_fs3.existsSync)(socketPath);
       }
       async connect(timeoutMs = 2e3) {
-        if (!(0, import_node_fs2.existsSync)(this.socketPath)) {
+        if (!(0, import_node_fs3.existsSync)(this.socketPath)) {
           throw new Error(`threatcrushd socket not found at ${this.socketPath}`);
         }
         return new Promise((resolve5, reject) => {
@@ -3975,7 +4013,7 @@ var init_ipc_client = __esm({
         await this.request("subscribe", { channels });
       }
       async shutdown() {
-        await this.request("shutdown");
+        await this.request("shutdown", { token: readControlToken() });
       }
       onData(chunk) {
         this.buffer += chunk;
@@ -4018,17 +4056,17 @@ var init_ipc_client = __esm({
 // src/daemon/pidfile.ts
 function writePidFile() {
   ensureRuntimeDirs();
-  (0, import_node_fs3.writeFileSync)(PATHS.pidFile, String(process.pid), "utf-8");
+  (0, import_node_fs4.writeFileSync)(PATHS.pidFile, String(process.pid), "utf-8");
 }
 function readPidFile() {
-  if (!(0, import_node_fs3.existsSync)(PATHS.pidFile)) return null;
-  const raw = (0, import_node_fs3.readFileSync)(PATHS.pidFile, "utf-8").trim();
+  if (!(0, import_node_fs4.existsSync)(PATHS.pidFile)) return null;
+  const raw = (0, import_node_fs4.readFileSync)(PATHS.pidFile, "utf-8").trim();
   const pid = parseInt(raw, 10);
   return Number.isFinite(pid) ? pid : null;
 }
 function removePidFile() {
   try {
-    if ((0, import_node_fs3.existsSync)(PATHS.pidFile)) (0, import_node_fs3.unlinkSync)(PATHS.pidFile);
+    if ((0, import_node_fs4.existsSync)(PATHS.pidFile)) (0, import_node_fs4.unlinkSync)(PATHS.pidFile);
   } catch {
   }
 }
@@ -4047,11 +4085,11 @@ function findRunningDaemon() {
   if (pid) removePidFile();
   return null;
 }
-var import_node_fs3;
+var import_node_fs4;
 var init_pidfile = __esm({
   "src/daemon/pidfile.ts"() {
     "use strict";
-    import_node_fs3 = require("fs");
+    import_node_fs4 = require("fs");
     init_paths();
   }
 });
@@ -8260,12 +8298,12 @@ var source_default = chalk;
 // src/index.ts
 var import_readline = __toESM(require("readline"));
 var import_node_child_process10 = require("child_process");
-var import_node_fs29 = require("fs");
-var import_node_path19 = require("path");
+var import_node_fs31 = require("fs");
+var import_node_path21 = require("path");
 var import_node_os8 = require("os");
 
 // src/commands/monitor.ts
-var import_node_fs4 = require("fs");
+var import_node_fs5 = require("fs");
 var import_node_readline = require("readline");
 
 // src/core/logger.ts
@@ -8473,9 +8511,9 @@ async function monitorCommand(options) {
   const unreadable = [];
   for (const s of LOG_SOURCES) {
     if (moduleFilter && !moduleFilter.includes(s.name)) continue;
-    if (!(0, import_node_fs4.existsSync)(s.path)) continue;
+    if (!(0, import_node_fs5.existsSync)(s.path)) continue;
     try {
-      (0, import_node_fs4.accessSync)(s.path, import_node_fs4.constants.R_OK);
+      (0, import_node_fs5.accessSync)(s.path, import_node_fs5.constants.R_OK);
       availableSources.push(s);
     } catch {
       unreadable.push(s);
@@ -8492,11 +8530,11 @@ async function monitorCommand(options) {
     logger.warn("No readable log files found to monitor.");
     logger.info("Available log paths checked:");
     for (const s of LOG_SOURCES) {
-      const exists = (0, import_node_fs4.existsSync)(s.path);
+      const exists = (0, import_node_fs5.existsSync)(s.path);
       let readable = false;
       if (exists) {
         try {
-          (0, import_node_fs4.accessSync)(s.path, import_node_fs4.constants.R_OK);
+          (0, import_node_fs5.accessSync)(s.path, import_node_fs5.constants.R_OK);
           readable = true;
         } catch {
           readable = false;
@@ -8528,16 +8566,16 @@ async function monitorCommand(options) {
 }
 function tailLog(source) {
   const { path, name, category } = source;
-  const stat = (0, import_node_fs4.statSync)(path);
+  const stat = (0, import_node_fs5.statSync)(path);
   let position = stat.size;
   const checkForNewData = () => {
     try {
-      const currentStat = (0, import_node_fs4.statSync)(path);
+      const currentStat = (0, import_node_fs5.statSync)(path);
       if (currentStat.size <= position) {
         if (currentStat.size < position) position = 0;
         return;
       }
-      const stream = (0, import_node_fs4.createReadStream)(path, { start: position, encoding: "utf-8" });
+      const stream = (0, import_node_fs5.createReadStream)(path, { start: position, encoding: "utf-8" });
       stream.on("error", (err) => {
         logger.warn(`stopped tailing ${path}: ${err.code || err.message}`);
         position = currentStat.size;
@@ -8639,8 +8677,8 @@ async function runDemoMode() {
 }
 
 // src/commands/scan.ts
-var import_node_fs7 = require("fs");
-var import_node_path5 = require("path");
+var import_node_fs8 = require("fs");
+var import_node_path6 = require("path");
 
 // ../../node_modules/.pnpm/ora@8.2.0/node_modules/ora/index.js
 var import_node_process7 = __toESM(require("process"), 1);
@@ -9797,7 +9835,17 @@ var NODE_RULES = [
     // arrangement of nearby lines that makes an echoed origin safe — except a
     // membership test on the value, which is what the guard looks for.
     inherent: true,
-    guard: ORIGIN_ALLOWLIST_GUARD
+    guard: ORIGIN_ALLOWLIST_GUARD,
+    /**
+     * Logging the origin is not reflecting it.
+     *
+     * `origin: request.headers.origin` is the CORS mistake *and* the ordinary
+     * way to record who called — the two are character-for-character
+     * identical, and only what encloses them differs. A response header goes
+     * out to the browser; a log line goes to stdout, where it grants nobody
+     * anything.
+     */
+    enclosingCallGuard: /(?:^|\.)(?:log|debug|info|warn|error|trace|verbose|fatal)$/
   },
   // ── Server-side request forgery ──────────────────────────────────────────
   {
@@ -10046,7 +10094,8 @@ var CODE_RULES = [
     cwe: "CWE-78",
     severity: "critical",
     languages: ["javascript", "typescript"],
-    pattern: /\b(?:exec|execSync|spawn|spawnSync)\s*\(\s*(?:`[^`]*\$\{|['"][^'"]*['"]\s*\+|[a-zA-Z_$][\w$]*\s*\+)/
+    pattern: /\b(?:exec|execSync|spawn|spawnSync)\s*\(\s*(?:`[^`]*\$\{|['"][^'"]*['"]\s*\+|[a-zA-Z_$][\w$]*\s*\+)/,
+    constantInterpolationGuard: true
   },
   {
     id: "py-shell-command-string",
@@ -10945,7 +10994,26 @@ var CODE_RULES = [
     cwe: "CWE-346",
     severity: "high",
     languages: ["javascript", "typescript"],
-    pattern: /\$\{[^}\n]*\breq(?:uest)?\s*\.\s*(?:headers\s*\.\s*host|hostname|host)\b|['"`]\s*\+\s*req(?:uest)?\s*\.\s*(?:headers\s*\.\s*host|hostname)\b/
+    pattern: /\$\{[^}\n]*\breq(?:uest)?\s*\.\s*(?:headers\s*\.\s*host|hostname|host)\b|['"`]\s*\+\s*req(?:uest)?\s*\.\s*(?:headers\s*\.\s*host|hostname)\b/,
+    /**
+     * Parsing the request's own URL is not building a link from the Host
+     * header, even though it is spelled with one.
+     *
+     *     const url = new URL(request.url, `http://${request.headers.host}`);
+     *     const token = url.searchParams.get('token');
+     *
+     * `request.url` on a Node server is a path — `/ws?token=…` — and `new URL`
+     * refuses a relative input without a base. The base exists to satisfy the
+     * parser and is thrown away; only the path and query are ever read. Every
+     * Node HTTP handler that wants a query parameter is written this way, so
+     * the rule fired on the framework idiom rather than on the defect.
+     *
+     * Narrow on purpose: the first argument must be `req.url` itself. The
+     * dangerous shape passes a *path* the application chose —
+     * `new URL('/reset?t=…', `https://${req.headers.host}`)` — and that is what
+     * produces an attacker-controlled link. It does not match this guard.
+     */
+    lineGuard: /\bnew\s+URL\s*\(\s*(?:req|request|ctx)(?:uest)?\s*\.\s*url\b\s*,/
   },
   // A recursive-merge prototype-pollution rule (`target[key] = source[key]`
   // with no `__proto__` guard) was built and dropped. The bare copy-by-key is
@@ -11013,6 +11081,55 @@ function fileTextOf(lines) {
 function withoutSingleQuoted(text) {
   return text.replace(/'[^'\n]*'/g, "''");
 }
+function calleeEndingAt(text, open) {
+  let end = open;
+  while (end > 0 && (text[end - 1] === " " || text[end - 1] === "	")) end -= 1;
+  let start = end;
+  while (start > 0 && /[\w$.]/.test(text[start - 1])) start -= 1;
+  return text.slice(start, end);
+}
+function enclosingCallees(lines, index, back) {
+  const before = lines.slice(Math.max(0, index - back), index).join("\n");
+  const stack = [];
+  let quote = null;
+  for (let i = 0; i < before.length; i += 1) {
+    const ch = before[i];
+    if (quote) {
+      if (ch === "\\") i += 1;
+      else if (ch === quote) quote = null;
+      continue;
+    }
+    if (ch === '"' || ch === "'" || ch === "`") quote = ch;
+    else if (ch === "(") stack.push(calleeEndingAt(before, i));
+    else if (ch === ")") stack.pop();
+  }
+  return stack;
+}
+function interpolations(line) {
+  const found = [];
+  for (let i = 0; ; ) {
+    const start = line.indexOf("${", i);
+    if (start === -1) break;
+    const end = line.indexOf("}", start + 2);
+    if (end === -1) return null;
+    found.push(line.slice(start + 2, end).trim());
+    i = end + 1;
+  }
+  return found.length > 0 ? found : null;
+}
+function isConstantString(name, fileText) {
+  const escaped = name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  return new RegExp(
+    `\\bconst\\s+${escaped}\\s*(?::[^=\\n]+)?=\\s*(?:'[^'\\n]*'|"[^"\\n]*"|\`[^\`$\\n]*\`)`
+  ).test(fileText);
+}
+function interpolationsAreConstant(line, fileText) {
+  const found = interpolations(line);
+  if (!found) return false;
+  return found.every(
+    (expr) => /^[A-Za-z_$][\w$]*$/.test(expr) && isConstantString(expr, fileText)
+  );
+}
 function evaluateRule(rule, ctx) {
   if (rule.languages && !rule.languages.includes(ctx.language)) return null;
   const line = ctx.lines[ctx.index] ?? "";
@@ -11024,6 +11141,13 @@ function evaluateRule(rule, ctx) {
   const context = windowText(ctx.lines, ctx.index, back, forward, ctx.prose);
   if (rule.requires && !rule.requires.test(context)) return null;
   if (rule.lineGuard?.test(line)) return null;
+  if (rule.enclosingCallGuard) {
+    const callees = enclosingCallees(ctx.lines, ctx.index, back);
+    if (callees.some((callee) => rule.enclosingCallGuard.test(callee))) return null;
+  }
+  if (rule.constantInterpolationGuard && interpolationsAreConstant(line, fileTextOf(ctx.lines))) {
+    return null;
+  }
   const guard = rule.guard === void 0 ? GENERIC_GUARD : rule.guard;
   if (guard && (guard.test(line) || guard.test(context))) return null;
   const untrusted = untrustedPatternFor(ctx.language);
@@ -11606,7 +11730,8 @@ var SECRET_RULES = [
     pattern: /\beyJ[A-Za-z0-9_-]{8,}\.eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_.+/=-]*/,
     severity: "medium",
     cwe: "CWE-798",
-    consequence: "Session or service identity until it expires \u2014 and committed tokens are usually long-lived."
+    consequence: "Session or service identity until it expires \u2014 and committed tokens are usually long-lived.",
+    keywordShaped: true
   },
   {
     id: "secret-generic-api-key",
@@ -11617,7 +11742,8 @@ var SECRET_RULES = [
     pattern: /(?:api[_-]?key|apikey|access[_-]?token|auth[_-]?token)\s*[=:]\s*['"]([A-Za-z0-9\-_.]{20,})['"]/i,
     severity: "high",
     cwe: "CWE-798",
-    consequence: "Whatever the third-party service lets the key do, for as long as it stays valid."
+    consequence: "Whatever the third-party service lets the key do, for as long as it stays valid.",
+    keywordShaped: true
   },
   {
     id: "secret-generic-credential",
@@ -11625,7 +11751,8 @@ var SECRET_RULES = [
     pattern: /(?:secret|password|passwd|pwd|token)\s*[=:]\s*['"]([^'"\s]{8,})['"]/i,
     severity: "high",
     cwe: "CWE-798",
-    consequence: "A password in source is a password in every clone, fork and CI cache of that source."
+    consequence: "A password in source is a password in every clone, fork and CI cache of that source.",
+    keywordShaped: true
   },
   {
     id: "secret-hex-token",
@@ -11633,7 +11760,8 @@ var SECRET_RULES = [
     pattern: /(?:token|key|secret|auth|signing)\w*\s*[=:]\s*['"]?([0-9a-f]{32,})['"]?/i,
     severity: "medium",
     cwe: "CWE-798",
-    consequence: "Signing secrets and session keys are usually hex; a leaked one forges anything they sign."
+    consequence: "Signing secrets and session keys are usually hex; a leaked one forges anything they sign.",
+    keywordShaped: true
   }
 ];
 var KNOWN_PLACEHOLDERS = [
@@ -11664,6 +11792,54 @@ var KNOWN_PLACEHOLDERS = [
 function isKnownPlaceholder(text) {
   return KNOWN_PLACEHOLDERS.some((pattern) => pattern.test(text));
 }
+function isVariableReference(value) {
+  const trimmed = value.trim();
+  const braced = /^\$\{\s*([A-Za-z_][\w.]*)\s*(?::?[-=+?]([\s\S]*))?\}$/.exec(trimmed);
+  if (braced) {
+    const fallback2 = braced[2];
+    if (fallback2 === void 0 || fallback2.trim() === "") return true;
+    return /^\$\{?[A-Za-z_][\w.]*\}?$/.test(fallback2.trim());
+  }
+  return /^\$[A-Za-z_]\w*$/.test(trimmed) || // $VAR
+  /^\$\([\s\S]*\)$/.test(trimmed) || // $(command substitution)
+  /^%[A-Za-z_]\w*%$/.test(trimmed) || // %VAR% on Windows
+  /^\{\{[\s\S]*\}\}$/.test(trimmed) || // {{ template }}
+  /^#\{[\s\S]*\}$/.test(trimmed) || // #{ruby}
+  /^<%=?[\s\S]*%>$/.test(trimmed);
+}
+var FIXTURE_STEMS = [
+  "test",
+  "mock",
+  "fake",
+  "dummy",
+  "stub",
+  "sample",
+  "example",
+  "placeholder",
+  "fixture",
+  "invalid",
+  "expired",
+  "forged",
+  "bogus",
+  "notreal",
+  "nonexistent",
+  "changeme",
+  "foobar",
+  "lorem"
+];
+var KEY_NOISE = /* @__PURE__ */ new Set(["const", "this", "return", "await", "async", "expect", "value"]);
+function words(text) {
+  return text.replace(/([a-z0-9])([A-Z])/g, "$1 $2").replace(/[^A-Za-z]+/g, " ").toLowerCase().split(" ").filter(Boolean);
+}
+function isTestFixtureValue(line, value) {
+  const valueWords = words(value);
+  if (valueWords.some((word) => FIXTURE_STEMS.some((stem) => word.startsWith(stem)))) return true;
+  if (value.length > 48) return false;
+  const valueAt = line.lastIndexOf(value);
+  const key = valueAt === -1 ? line : line.slice(0, valueAt);
+  const flattened = valueWords.join("");
+  return words(key).filter((word) => word.length >= 4 && !KEY_NOISE.has(word)).some((word) => flattened.includes(word));
+}
 function redactSecret(line) {
   return line.replace(/([A-Za-z0-9+/=_.-]{12,})/g, (match) => {
     if (match.length <= 12) return match;
@@ -11882,6 +12058,9 @@ function scanText(relativePath, text, language = languageOf(relativePath)) {
       if (!match) continue;
       if (isKnownPlaceholder(match[0])) continue;
       if (isSuppressed(suppressions, index, rule.id)) continue;
+      const value = match[1] ?? match[0];
+      if (isVariableReference(value)) continue;
+      if (inTests && rule.keywordShaped && isTestFixtureValue(line, value)) continue;
       const marked = foreignCredentialMark(line);
       findings.push({
         ruleId: rule.id,
@@ -11965,8 +12144,8 @@ function meetsFailThreshold(findings, threshold) {
 }
 
 // ../../packages/scan/src/node/walk.ts
-var import_node_fs5 = require("fs");
-var import_node_path2 = require("path");
+var import_node_fs6 = require("fs");
+var import_node_path3 = require("path");
 function compileExcludes(patterns) {
   const matchers = patterns.map((p) => p.trim()).filter((p) => p.length > 0 && !p.startsWith("#")).map(compilePattern);
   if (matchers.length === 0) return () => false;
@@ -12037,7 +12216,7 @@ function matchPrefix(parts, segs) {
 }
 function readIgnoreFile(root) {
   try {
-    return (0, import_node_fs5.readFileSync)((0, import_node_path2.join)(root, ".threatcrushignore"), "utf-8").split("\n");
+    return (0, import_node_fs6.readFileSync)((0, import_node_path3.join)(root, ".threatcrushignore"), "utf-8").split("\n");
   } catch {
     return [];
   }
@@ -12053,16 +12232,16 @@ function scanPath(targetPath, options = {}) {
   let excluded = 0;
   const rootIsDirectory = (() => {
     try {
-      return (0, import_node_fs5.statSync)(targetPath).isDirectory();
+      return (0, import_node_fs6.statSync)(targetPath).isDirectory();
     } catch {
       return true;
     }
   })();
-  const walkRoot = rootIsDirectory ? targetPath : (0, import_node_path2.dirname)(targetPath);
+  const walkRoot = rootIsDirectory ? targetPath : (0, import_node_path3.dirname)(targetPath);
   const isExcluded = compileExcludes([...options.exclude ?? [], ...readIgnoreFile(walkRoot)]);
   const scanFile = (fullPath, filename) => {
     const relativePath = toRelative(walkRoot, fullPath);
-    const extension = (0, import_node_path2.extname)(filename).toLowerCase();
+    const extension = (0, import_node_path3.extname)(filename).toLowerCase();
     const isManifest = filename === "package.json" || filename === "requirements.txt";
     const scannable = SCAN_EXTENSIONS.has(extension) || filename.startsWith(".env");
     const mayDeclareInterpreter = !scannable && !isManifest && extension === "";
@@ -12074,26 +12253,26 @@ function scanPath(targetPath, options = {}) {
     let handle;
     let declared = null;
     try {
-      handle = (0, import_node_fs5.openSync)(fullPath, "r");
+      handle = (0, import_node_fs6.openSync)(fullPath, "r");
     } catch {
       unreadable.push(relativePath);
       return;
     }
     try {
-      if ((0, import_node_fs5.fstatSync)(handle).size > maxFileBytes) return;
+      if ((0, import_node_fs6.fstatSync)(handle).size > maxFileBytes) return;
       if (mayDeclareInterpreter) {
         const prefix = Buffer.alloc(128);
-        const read = (0, import_node_fs5.readSync)(handle, prefix, 0, prefix.length, 0);
+        const read = (0, import_node_fs6.readSync)(handle, prefix, 0, prefix.length, 0);
         declared = languageOfShebang(prefix.subarray(0, read).toString("utf-8").split("\n", 1)[0] ?? "");
         if (!declared) return;
       }
-      text = (0, import_node_fs5.readFileSync)(handle, "utf-8");
+      text = (0, import_node_fs6.readFileSync)(handle, "utf-8");
     } catch {
       unreadable.push(relativePath);
       return;
     } finally {
       try {
-        (0, import_node_fs5.closeSync)(handle);
+        (0, import_node_fs6.closeSync)(handle);
       } catch {
       }
     }
@@ -12111,13 +12290,13 @@ function scanPath(targetPath, options = {}) {
   const walk = (currentPath) => {
     let entries;
     try {
-      entries = (0, import_node_fs5.readdirSync)(currentPath, { withFileTypes: true });
+      entries = (0, import_node_fs6.readdirSync)(currentPath, { withFileTypes: true });
     } catch {
       unreadable.push(toRelative(walkRoot, currentPath));
       return;
     }
     for (const entry of entries) {
-      const fullPath = (0, import_node_path2.join)(currentPath, entry.name);
+      const fullPath = (0, import_node_path3.join)(currentPath, entry.name);
       const relativePath = toRelative(walkRoot, fullPath);
       if (entry.isDirectory()) {
         if (SKIP_DIRS.has(entry.name)) continue;
@@ -12141,7 +12320,7 @@ function scanPath(targetPath, options = {}) {
   } else if (isExcluded(toRelative(walkRoot, targetPath))) {
     excluded += 1;
   } else {
-    scanFile(targetPath, (0, import_node_path2.basename)(targetPath));
+    scanFile(targetPath, (0, import_node_path3.basename)(targetPath));
   }
   if (options.missingControls) findings.push(...controls.findings());
   const filtered = allowed ? findings.filter((f) => allowed.has(f.category)) : findings;
@@ -12173,32 +12352,37 @@ function recordSensitiveFile(filename, relativePath, sink, fileFindings) {
   }
 }
 function toRelative(base, target) {
-  const rel = (0, import_node_path2.relative)(base, target);
-  return (rel === "" ? target : rel).split(import_node_path2.sep).join("/");
+  const rel = (0, import_node_path3.relative)(base, target);
+  return (rel === "" ? target : rel).split(import_node_path3.sep).join("/");
 }
 
 // ../../packages/scan/src/node/dependencies.ts
-var import_node_fs6 = require("fs");
-var import_node_path3 = require("path");
-var LOCKFILES = [
-  { file: "package-lock.json", ecosystem: "npm" },
-  { file: "pnpm-lock.yaml", ecosystem: "npm" },
-  { file: "yarn.lock", ecosystem: "npm" },
-  { file: "requirements.txt", ecosystem: "PyPI" },
-  { file: "Pipfile.lock", ecosystem: "PyPI" }
-];
+var import_node_fs7 = require("fs");
+var import_node_path4 = require("path");
 var MAX_DEPS_PER_LOCKFILE = 50;
 async function scanDependencies(targetPath) {
   const findings = [];
-  for (const { file, ecosystem } of LOCKFILES) {
-    const lockPath = (0, import_node_path3.join)(targetPath, file);
-    if (!(0, import_node_fs6.existsSync)(lockPath)) continue;
+  for (const { file, ecosystem, parse } of LOCKFILES) {
+    const lockPath = (0, import_node_path4.join)(targetPath, file);
+    if (!(0, import_node_fs7.existsSync)(lockPath)) continue;
     let deps;
     try {
-      deps = parseDependencies(lockPath, file);
+      deps = dedupe(parse((0, import_node_fs7.readFileSync)(lockPath, "utf-8")));
     } catch {
       continue;
     }
+    if (deps.length === 0) {
+      findings.push(incompleteFinding(file, "No dependencies could be read from this lockfile."));
+      continue;
+    }
+    if (deps.length > MAX_DEPS_PER_LOCKFILE) {
+      findings.push(
+        incompleteFinding(
+          file,
+          `Only the first ${MAX_DEPS_PER_LOCKFILE} of ${deps.length} locked packages were checked against OSV.`
+        )
+      );
+    }
     for (const dep of deps.slice(0, MAX_DEPS_PER_LOCKFILE)) {
       let vulns;
       try {
@@ -12225,6 +12409,20 @@ async function scanDependencies(targetPath) {
   }
   return findings;
 }
+function incompleteFinding(file, message) {
+  return {
+    ruleId: "dependency-scan-incomplete",
+    title: "Dependency scan incomplete",
+    file,
+    line: 1,
+    severity: "low",
+    confidence: "evidence",
+    message,
+    consequence: "Advisories affecting the unchecked packages would not appear in this report.",
+    excerpt: file,
+    category: "dependency"
+  };
+}
 function severityFromCvss(score) {
   if (!score) return "medium";
   const value = Number.parseFloat(score);
@@ -12234,26 +12432,131 @@ function severityFromCvss(score) {
   if (value >= 4) return "medium";
   return "low";
 }
-function parseDependencies(lockPath, filename) {
+function dedupe(deps) {
+  const seen = /* @__PURE__ */ new Set();
+  const unique = [];
+  for (const dep of deps) {
+    const key = `${dep.name}@${dep.version}`;
+    if (seen.has(key)) continue;
+    seen.add(key);
+    unique.push(dep);
+  }
+  return unique;
+}
+function splitNameVersion(spec) {
+  const at = spec.lastIndexOf("@");
+  if (at <= 0) return null;
+  const name = spec.slice(0, at);
+  const version = spec.slice(at + 1);
+  if (!name || !version) return null;
+  return { name, version };
+}
+function exactVersion(raw) {
+  const version = raw.trim().replace(/^[=v]+/, "");
+  return /^[0-9][0-9a-zA-Z.+-]*$/.test(version) ? version : null;
+}
+function parsePackageLock(content) {
+  const lock = JSON.parse(content);
+  const packages = lock.packages ?? lock.dependencies ?? {};
+  const deps = [];
+  for (const [key, value] of Object.entries(packages)) {
+    const name = key.replace(/^.*node_modules\//, "");
+    const version = value?.version;
+    if (name && version && !name.startsWith(".")) deps.push({ name, version });
+  }
+  return deps;
+}
+function parsePnpmLock(content) {
+  const deps = [];
+  let inPackages = false;
+  for (const line of content.split("\n")) {
+    if (/^[a-zA-Z]/.test(line)) {
+      inPackages = line.startsWith("packages:");
+      continue;
+    }
+    if (!inPackages) continue;
+    const match = /^ {2}(?! )(.+):\s*$/.exec(line);
+    if (!match?.[1]) continue;
+    let key = match[1].trim().replace(/^['"]|['"]$/g, "");
+    key = key.replace(/^\//, "");
+    key = key.replace(/\(.*$/, "");
+    let name;
+    let rawVersion;
+    const slashed = /^(@?[^@]+)\/([0-9][^/]*)$/.exec(key);
+    if (slashed?.[1] && slashed[2]) {
+      name = slashed[1];
+      rawVersion = slashed[2];
+    } else {
+      const dep = splitNameVersion(key);
+      if (!dep) continue;
+      name = dep.name;
+      rawVersion = dep.version;
+    }
+    const version = exactVersion(rawVersion.replace(/_.*$/, ""));
+    if (version) deps.push({ name, version });
+  }
+  return deps;
+}
+function parseYarnLock(content) {
   const deps = [];
-  if (filename === "package-lock.json") {
-    const lock = JSON.parse((0, import_node_fs6.readFileSync)(lockPath, "utf-8"));
-    const packages = lock.packages ?? lock.dependencies ?? {};
-    for (const [key, value] of Object.entries(packages)) {
-      const name = key.replace(/^node_modules\//, "");
-      const version = value?.version;
-      if (name && version && !name.startsWith(".")) deps.push({ name, version });
+  let pendingName = null;
+  for (const line of content.split("\n")) {
+    if (line.startsWith("#") || line.trim() === "") continue;
+    if (!/^\s/.test(line)) {
+      pendingName = null;
+      const header = line.replace(/:\s*$/, "");
+      const first = header.split(",")[0]?.trim().replace(/^['"]|['"]$/g, "");
+      if (!first) continue;
+      if (!first.includes("@") || first === "__metadata") continue;
+      if (/@(?:workspace|file|link|portal|exec|patch):/.test(first)) continue;
+      const dep = splitNameVersion(first.replace(/@npm:/, "@"));
+      if (dep) pendingName = dep.name;
+      continue;
     }
-    return deps;
+    if (!pendingName) continue;
+    const version = /^\s+version:?\s+["']?([^"'\s]+)["']?\s*$/.exec(line);
+    if (!version?.[1]) continue;
+    const exact = exactVersion(version[1]);
+    if (exact) deps.push({ name: pendingName, version: exact });
+    pendingName = null;
   }
-  if (filename === "requirements.txt") {
-    for (const line of (0, import_node_fs6.readFileSync)(lockPath, "utf-8").split("\n")) {
-      const match = /^([a-zA-Z0-9_.-]+)==([0-9.]+)/.exec(line);
-      if (match?.[1] && match[2]) deps.push({ name: match[1], version: match[2] });
+  return deps;
+}
+function parsePipfileLock(content) {
+  const lock = JSON.parse(content);
+  const deps = [];
+  for (const section of ["default", "develop"]) {
+    const packages = lock[section];
+    if (!packages || typeof packages !== "object") continue;
+    for (const [name, value] of Object.entries(packages)) {
+      const version = exactVersion(String(value?.version ?? "").replace(/^==/, ""));
+      if (name && version) deps.push({ name, version });
     }
   }
   return deps;
 }
+function parseRequirementsTxt(content) {
+  const deps = [];
+  for (const raw of content.split("\n")) {
+    const line = raw.split("#")[0]?.split(";")[0]?.trim();
+    if (!line || line.startsWith("-")) continue;
+    const match = /^([a-zA-Z0-9._-]+)\s*(?:\[[^\]]*\])?\s*==\s*([^\s,]+)/.exec(line);
+    if (!match?.[1] || !match[2]) continue;
+    const version = exactVersion(match[2]);
+    if (version) deps.push({ name: match[1], version });
+  }
+  return deps;
+}
+var LOCKFILES = [
+  { file: "package-lock.json", ecosystem: "npm", parse: parsePackageLock },
+  { file: "pnpm-lock.yaml", ecosystem: "npm", parse: parsePnpmLock },
+  { file: "yarn.lock", ecosystem: "npm", parse: parseYarnLock },
+  { file: "requirements.txt", ecosystem: "PyPI", parse: parseRequirementsTxt },
+  { file: "Pipfile.lock", ecosystem: "PyPI", parse: parsePipfileLock }
+];
+var LOCKFILE_PARSERS = Object.fromEntries(
+  LOCKFILES.map((entry) => [entry.file, entry.parse])
+);
 function isValidPackageName(name) {
   return /^[@a-zA-Z0-9_.\-/]{1,214}$/.test(name);
 }
@@ -12278,12 +12581,12 @@ async function queryOsv(name, version, ecosystem) {
 }
 
 // ../../packages/scan/src/node/sarif.ts
-var import_node_crypto = require("crypto");
-var import_node_path4 = require("path");
+var import_node_crypto2 = require("crypto");
+var import_node_path5 = require("path");
 var FINGERPRINT_KEY = "threatcrush/contentHash/v1";
 function fingerprintOf(finding) {
   const content = finding.excerpt.replace(/\s+/g, " ").trim();
-  return (0, import_node_crypto.createHash)("sha256").update(`${finding.ruleId}
+  return (0, import_node_crypto2.createHash)("sha256").update(`${finding.ruleId}
 ${finding.file}
 ${content}`).digest("hex").slice(0, 32);
 }
@@ -12317,11 +12620,11 @@ function securitySeverity(severity) {
   }
 }
 function toArtifactUri(filePath, base, prefix = "", root = base) {
-  const absolute = (0, import_node_path4.isAbsolute)(filePath) ? filePath : (0, import_node_path4.resolve)(root, filePath);
-  const relativePath = (0, import_node_path4.relative)(base, absolute);
+  const absolute = (0, import_node_path5.isAbsolute)(filePath) ? filePath : (0, import_node_path5.resolve)(root, filePath);
+  const relativePath = (0, import_node_path5.relative)(base, absolute);
   const escapedOut = relativePath.startsWith("..") || relativePath === "";
   const chosen = escapedOut ? absolute : relativePath;
-  const posix = chosen.split(import_node_path4.sep).join("/").replace(/^\.\//, "");
+  const posix = chosen.split(import_node_path5.sep).join("/").replace(/^\.\//, "");
   if (!prefix || escapedOut) return posix;
   const trimmed = prefix.replace(/^\/+|\/+$/g, "");
   return trimmed ? `${trimmed}/${posix}` : posix;
@@ -12411,11 +12714,11 @@ ${finding.consequence}` : `**${finding.title}**`
 // src/commands/scan.ts
 function readVersion() {
   for (const candidate of [
-    (0, import_node_path5.join)(__dirname, "..", "package.json"),
-    (0, import_node_path5.join)(__dirname, "..", "..", "package.json")
+    (0, import_node_path6.join)(__dirname, "..", "package.json"),
+    (0, import_node_path6.join)(__dirname, "..", "..", "package.json")
   ]) {
     try {
-      return JSON.parse((0, import_node_fs7.readFileSync)(candidate, "utf-8")).version ?? "0.0.0";
+      return JSON.parse((0, import_node_fs8.readFileSync)(candidate, "utf-8")).version ?? "0.0.0";
     } catch {
     }
   }
@@ -12482,7 +12785,7 @@ async function scanCommand(targetPath, options = {}) {
   const say = machineReadable ? (line) => process.stderr.write(`${line}
 `) : (line) => process.stdout.write(`${line}
 `);
-  if (!(0, import_node_fs7.existsSync)(targetPath)) {
+  if (!(0, import_node_fs8.existsSync)(targetPath)) {
     say(source_default.red(`Scan target does not exist: ${targetPath}`));
     process.exitCode = 2;
     return failedResult(targetPath, `no such path: ${targetPath}`);
@@ -12578,7 +12881,7 @@ function emitMachineReadable(format, outcome, targetPath, options, say) {
     // and it fails silently. `--path-prefix` covers the remaining case:
     // a scan run from inside the subdirectory it is scanning.
     base: process.cwd(),
-    root: (0, import_node_path5.resolve)(outcome.root)
+    root: (0, import_node_path6.resolve)(outcome.root)
   }) : {
     tool: "threatcrush",
     version: PKG_VERSION,
@@ -12592,8 +12895,8 @@ function emitMachineReadable(format, outcome, targetPath, options, say) {
   const serialized = `${JSON.stringify(payload, null, 2)}
 `;
   if (options.output) {
-    (0, import_node_fs7.mkdirSync)((0, import_node_path5.dirname)((0, import_node_path5.resolve)(options.output)), { recursive: true });
-    (0, import_node_fs7.writeFileSync)(options.output, serialized, "utf-8");
+    (0, import_node_fs8.mkdirSync)((0, import_node_path6.dirname)((0, import_node_path6.resolve)(options.output)), { recursive: true });
+    (0, import_node_fs8.writeFileSync)(options.output, serialized, "utf-8");
     say(
       source_default.gray(
         `  ${format.toUpperCase()} written to ${options.output} (${outcome.findings.length} finding(s))`
@@ -12645,13 +12948,13 @@ function printHuman(outcome) {
 }
 
 // src/commands/init.ts
-var import_node_fs10 = require("fs");
+var import_node_fs11 = require("fs");
 var import_node_child_process = require("child_process");
 var import_node_readline3 = __toESM(require("readline"));
 
 // src/core/config.ts
-var import_node_fs8 = require("fs");
-var import_node_path6 = require("path");
+var import_node_fs9 = require("fs");
+var import_node_path7 = require("path");
 var import_toml = __toESM(require_toml());
 var DEFAULT_CONFIG_PATH = "/etc/threatcrush/threatcrushd.conf";
 var DEFAULT_CONFDIR = "/etc/threatcrush/threatcrushd.conf.d";
@@ -12677,11 +12980,11 @@ var DEFAULT_CONFIG = {
 };
 function loadConfig(configPath) {
   const path = configPath || DEFAULT_CONFIG_PATH;
-  if (!(0, import_node_fs8.existsSync)(path)) {
+  if (!(0, import_node_fs9.existsSync)(path)) {
     return { ...DEFAULT_CONFIG };
   }
   try {
-    const raw = (0, import_node_fs8.readFileSync)(path, "utf-8");
+    const raw = (0, import_node_fs9.readFileSync)(path, "utf-8");
     const parsed = import_toml.default.parse(raw);
     return {
       daemon: { ...DEFAULT_CONFIG.daemon, ...parsed.daemon },
@@ -12697,13 +13000,13 @@ function loadConfig(configPath) {
 function loadModuleConfigs(confDir) {
   const dir = confDir || DEFAULT_CONFDIR;
   const configs = /* @__PURE__ */ new Map();
-  if (!(0, import_node_fs8.existsSync)(dir)) {
+  if (!(0, import_node_fs9.existsSync)(dir)) {
     return configs;
   }
-  const files = (0, import_node_fs8.readdirSync)(dir).filter((f) => f.endsWith(".conf"));
+  const files = (0, import_node_fs9.readdirSync)(dir).filter((f) => f.endsWith(".conf"));
   for (const file of files) {
     try {
-      const raw = (0, import_node_fs8.readFileSync)((0, import_node_path6.join)(dir, file), "utf-8");
+      const raw = (0, import_node_fs9.readFileSync)((0, import_node_path7.join)(dir, file), "utf-8");
       const parsed = import_toml.default.parse(raw);
       for (const [name, config] of Object.entries(parsed)) {
         configs.set(name, config);
@@ -12732,23 +13035,23 @@ function generateModuleConfig(moduleName, defaults = {}) {
 }
 
 // src/core/cli-config.ts
-var import_node_fs9 = require("fs");
-var import_node_path7 = require("path");
+var import_node_fs10 = require("fs");
+var import_node_path8 = require("path");
 var import_node_os4 = require("os");
-var CLI_CONFIG_DIR = (0, import_node_path7.join)((0, import_node_os4.homedir)(), ".threatcrush");
-var CLI_CONFIG_PATH = (0, import_node_path7.join)(CLI_CONFIG_DIR, "config.json");
+var CLI_CONFIG_DIR = (0, import_node_path8.join)((0, import_node_os4.homedir)(), ".threatcrush");
+var CLI_CONFIG_PATH = (0, import_node_path8.join)(CLI_CONFIG_DIR, "config.json");
 function readCliConfig() {
   try {
-    return JSON.parse((0, import_node_fs9.readFileSync)(CLI_CONFIG_PATH, "utf-8"));
+    return JSON.parse((0, import_node_fs10.readFileSync)(CLI_CONFIG_PATH, "utf-8"));
   } catch {
     return {};
   }
 }
 function writeCliConfig(config) {
-  if (!(0, import_node_fs9.existsSync)(CLI_CONFIG_DIR)) (0, import_node_fs9.mkdirSync)(CLI_CONFIG_DIR, { recursive: true });
-  (0, import_node_fs9.writeFileSync)(CLI_CONFIG_PATH, JSON.stringify(config, null, 2), "utf-8");
+  if (!(0, import_node_fs10.existsSync)(CLI_CONFIG_DIR)) (0, import_node_fs10.mkdirSync)(CLI_CONFIG_DIR, { recursive: true });
+  (0, import_node_fs10.writeFileSync)(CLI_CONFIG_PATH, JSON.stringify(config, null, 2), "utf-8");
   try {
-    (0, import_node_fs9.chmodSync)(CLI_CONFIG_PATH, 384);
+    (0, import_node_fs10.chmodSync)(CLI_CONFIG_PATH, 384);
   } catch {
   }
 }
@@ -12993,7 +13296,7 @@ function binaryExists(name) {
   }
 }
 function findLogPath(paths) {
-  return paths.find((p) => (0, import_node_fs10.existsSync)(p));
+  return paths.find((p) => (0, import_node_fs11.existsSync)(p));
 }
 async function promptYesNo(question, fallback2) {
   const rl = import_node_readline3.default.createInterface({ input: process.stdin, output: process.stdout });
@@ -13109,11 +13412,11 @@ async function initCommand() {
     }
   } else {
     const spinner2 = ora({ text: "Writing configuration files...", color: "green" }).start();
-    (0, import_node_fs10.mkdirSync)(confDDir, { recursive: true });
-    (0, import_node_fs10.mkdirSync)("/var/log/threatcrush", { recursive: true });
-    (0, import_node_fs10.mkdirSync)("/var/lib/threatcrush", { recursive: true });
+    (0, import_node_fs11.mkdirSync)(confDDir, { recursive: true });
+    (0, import_node_fs11.mkdirSync)("/var/log/threatcrush", { recursive: true });
+    (0, import_node_fs11.mkdirSync)("/var/lib/threatcrush", { recursive: true });
     const mainConfig = generateDefaultConfig(detected.map((d) => d.name));
-    (0, import_node_fs10.writeFileSync)(`${configDir}/threatcrushd.conf`, mainConfig);
+    (0, import_node_fs11.writeFileSync)(`${configDir}/threatcrushd.conf`, mainConfig);
     for (const svc of detected) {
       const svcDef = SERVICES_TO_DETECT.find((s) => s.name === svc.name);
       if (!svcDef) continue;
@@ -13122,7 +13425,7 @@ async function initCommand() {
         ...svcDef.moduleConfig,
         log_path: svc.logPath || svcDef.logPaths[0]
       });
-      (0, import_node_fs10.writeFileSync)(`${confDDir}/${modName}.conf`, modConfig);
+      (0, import_node_fs11.writeFileSync)(`${confDDir}/${modName}.conf`, modConfig);
     }
     spinner2.succeed("Configuration written successfully");
     console.log();
@@ -13140,8 +13443,8 @@ async function initCommand() {
 }
 function checkWriteAccess(dir) {
   try {
-    if (!(0, import_node_fs10.existsSync)(dir)) {
-      (0, import_node_fs10.mkdirSync)(dir, { recursive: true });
+    if (!(0, import_node_fs11.existsSync)(dir)) {
+      (0, import_node_fs11.mkdirSync)(dir, { recursive: true });
     }
     return true;
   } catch {
@@ -13150,8 +13453,8 @@ function checkWriteAccess(dir) {
 }
 
 // src/core/module-loader.ts
-var import_node_fs11 = require("fs");
-var import_node_path8 = require("path");
+var import_node_fs12 = require("fs");
+var import_node_path9 = require("path");
 var import_toml2 = __toESM(require_toml());
 init_paths();
 function discoverModules(moduleDir, confDir) {
@@ -13159,22 +13462,22 @@ function discoverModules(moduleDir, confDir) {
   const configs = loadModuleConfigs(confDir || PATHS.confD);
   const searchPaths = [
     moduleDir || PATHS.moduleDir,
-    (0, import_node_path8.resolve)(process.cwd(), "modules")
+    (0, import_node_path9.resolve)(process.cwd(), "modules")
   ];
-  const builtinDir = (0, import_node_path8.resolve)(__dirname || ".", "..", "modules");
-  if ((0, import_node_fs11.existsSync)(builtinDir)) {
+  const builtinDir = (0, import_node_path9.resolve)(__dirname || ".", "..", "modules");
+  if ((0, import_node_fs12.existsSync)(builtinDir)) {
     searchPaths.push(builtinDir);
   }
   for (const basePath of searchPaths) {
-    if (!(0, import_node_fs11.existsSync)(basePath)) continue;
-    const entries = (0, import_node_fs11.readdirSync)(basePath, { withFileTypes: true });
+    if (!(0, import_node_fs12.existsSync)(basePath)) continue;
+    const entries = (0, import_node_fs12.readdirSync)(basePath, { withFileTypes: true });
     for (const entry of entries) {
       if (!entry.isDirectory()) continue;
-      const modPath = (0, import_node_path8.join)(basePath, entry.name);
-      const manifestPath = (0, import_node_path8.join)(modPath, "mod.toml");
-      if (!(0, import_node_fs11.existsSync)(manifestPath)) continue;
+      const modPath = (0, import_node_path9.join)(basePath, entry.name);
+      const manifestPath = (0, import_node_path9.join)(modPath, "mod.toml");
+      if (!(0, import_node_fs12.existsSync)(manifestPath)) continue;
       try {
-        const raw = (0, import_node_fs11.readFileSync)(manifestPath, "utf-8");
+        const raw = (0, import_node_fs12.readFileSync)(manifestPath, "utf-8");
         const manifest = import_toml2.default.parse(raw);
         const config = configs.get(manifest.module.name) || { enabled: true };
         modules.push({
@@ -13293,11 +13596,163 @@ function formatUptime(seconds) {
 
 // src/commands/modules.ts
 var import_node_child_process2 = require("child_process");
-var import_node_fs12 = require("fs");
-var import_node_path9 = require("path");
+var import_node_fs14 = require("fs");
+var import_node_path11 = require("path");
 var import_toml3 = __toESM(require_toml());
 init_paths();
 init_pidfile();
+
+// src/daemon/module-trust.ts
+var import_node_crypto3 = require("crypto");
+var import_node_fs13 = require("fs");
+var import_node_path10 = require("path");
+init_paths();
+var TRUST_FILE = (0, import_node_path10.join)(PATHS.configDir, "trusted-modules.json");
+var PUBLISHER_KEYS_FILE = (0, import_node_path10.join)(PATHS.configDir, "publisher-keys.json");
+var DIGEST_EXCLUDED_DIRS = /* @__PURE__ */ new Set([".git"]);
+function collectFiles(root, dir = root, out = []) {
+  for (const entry of (0, import_node_fs13.readdirSync)(dir, { withFileTypes: true }).sort(
+    (a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0
+  )) {
+    const full = (0, import_node_path10.join)(dir, entry.name);
+    if (entry.isSymbolicLink()) {
+      out.push({ path: full, isSymlink: true });
+    } else if (entry.isDirectory()) {
+      if (DIGEST_EXCLUDED_DIRS.has(entry.name)) continue;
+      collectFiles(root, full, out);
+    } else if (entry.isFile()) {
+      out.push({ path: full, isSymlink: false });
+    }
+  }
+  return out;
+}
+function computeModuleDigest(modulePath) {
+  const hash = (0, import_node_crypto3.createHash)("sha256");
+  for (const entry of collectFiles(modulePath)) {
+    const relPath = (0, import_node_path10.relative)(modulePath, entry.path).split(import_node_path10.sep).join("/");
+    hash.update(relPath);
+    hash.update("\0");
+    if (entry.isSymlink) {
+      hash.update("symlink:");
+      hash.update((0, import_node_fs13.readlinkSync)(entry.path));
+    } else {
+      hash.update("file:");
+      hash.update((0, import_node_fs13.readFileSync)(entry.path));
+    }
+    hash.update("\0");
+  }
+  return hash.digest("hex");
+}
+function readTrustFile() {
+  if (!(0, import_node_fs13.existsSync)(TRUST_FILE)) return { version: 1, modules: {} };
+  try {
+    const parsed = JSON.parse((0, import_node_fs13.readFileSync)(TRUST_FILE, "utf-8"));
+    if (parsed.version !== 1 || typeof parsed.modules !== "object" || !parsed.modules) {
+      return { version: 1, modules: {} };
+    }
+    return { version: 1, modules: parsed.modules };
+  } catch {
+    return { version: 1, modules: {} };
+  }
+}
+function writeTrustFile(file) {
+  (0, import_node_fs13.writeFileSync)(TRUST_FILE, JSON.stringify(file, null, 2) + "\n", { mode: 384 });
+  try {
+    (0, import_node_fs13.chmodSync)(TRUST_FILE, 384);
+  } catch {
+  }
+}
+function trustModule(name, modulePath, source) {
+  const file = readTrustFile();
+  const record = {
+    digest: computeModuleDigest(modulePath),
+    trustedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    source
+  };
+  file.modules[name] = record;
+  writeTrustFile(file);
+  return record;
+}
+function untrustModule(name) {
+  const file = readTrustFile();
+  if (!file.modules[name]) return false;
+  delete file.modules[name];
+  writeTrustFile(file);
+  return true;
+}
+function listTrustedModules() {
+  return readTrustFile().modules;
+}
+function readPublisherKeys() {
+  if (!(0, import_node_fs13.existsSync)(PUBLISHER_KEYS_FILE)) return {};
+  try {
+    const parsed = JSON.parse((0, import_node_fs13.readFileSync)(PUBLISHER_KEYS_FILE, "utf-8"));
+    return parsed && typeof parsed === "object" ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+function verifyModuleSignature(modulePath, digest) {
+  const keys = readPublisherKeys();
+  const pinnedKeyIds = Object.keys(keys);
+  const sigPath = (0, import_node_path10.join)(modulePath, "mod.sig");
+  if (pinnedKeyIds.length === 0) {
+    return { ok: true };
+  }
+  if (!(0, import_node_fs13.existsSync)(sigPath)) {
+    return { ok: false, reason: "publisher keys are pinned but the module ships no mod.sig" };
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse((0, import_node_fs13.readFileSync)(sigPath, "utf-8"));
+  } catch {
+    return { ok: false, reason: "mod.sig is not valid JSON" };
+  }
+  if (!parsed.keyId || !parsed.signature) {
+    return { ok: false, reason: "mod.sig is missing keyId or signature" };
+  }
+  const publicKey = keys[parsed.keyId];
+  if (!publicKey) {
+    return { ok: false, reason: `mod.sig references unpinned key "${parsed.keyId}"` };
+  }
+  try {
+    const valid = (0, import_node_crypto3.verify)(
+      null,
+      Buffer.from(digest, "hex"),
+      publicKey,
+      Buffer.from(parsed.signature, "base64")
+    );
+    return valid ? { ok: true } : { ok: false, reason: "mod.sig signature does not match" };
+  } catch (err) {
+    return { ok: false, reason: `signature check failed: ${String(err.message || err)}` };
+  }
+}
+function verifyModuleTrust(name, modulePath) {
+  let digest;
+  try {
+    digest = computeModuleDigest(modulePath);
+  } catch (err) {
+    return { ok: false, reason: `could not hash module: ${String(err.message || err)}` };
+  }
+  const signature = verifyModuleSignature(modulePath, digest);
+  if (!signature.ok) return signature;
+  const record = readTrustFile().modules[name];
+  if (!record) {
+    return {
+      ok: false,
+      reason: `not trusted \u2014 review it, then run: threatcrush modules trust ${name}`
+    };
+  }
+  if (record.digest !== digest) {
+    return {
+      ok: false,
+      reason: `contents changed since it was trusted on ${record.trustedAt} \u2014 re-review it, then run: threatcrush modules trust ${name}`
+    };
+  }
+  return { ok: true };
+}
+
+// src/commands/modules.ts
 var API_URL2 = process.env.THREATCRUSH_API_URL || "https://threatcrush.com";
 function modulesDir() {
   ensureRuntimeDirs();
@@ -13310,7 +13765,7 @@ function safeModuleDirName(name, label = "module name") {
   return name;
 }
 function moduleDestination(dir, name, label) {
-  return (0, import_node_path9.join)(dir, safeModuleDirName(name, label));
+  return (0, import_node_path11.join)(dir, safeModuleDirName(name, label));
 }
 function assertSafeTarballEntries(tarPath) {
   const listing = (0, import_node_child_process2.execFileSync)("tar", ["-tzf", tarPath], { encoding: "utf-8" });
@@ -13323,12 +13778,12 @@ function assertSafeTarballEntries(tarPath) {
   }
 }
 function validateManifest(modPath) {
-  const manifestPath = (0, import_node_path9.join)(modPath, "mod.toml");
-  if (!(0, import_node_fs12.existsSync)(manifestPath)) {
+  const manifestPath = (0, import_node_path11.join)(modPath, "mod.toml");
+  if (!(0, import_node_fs14.existsSync)(manifestPath)) {
     return { ok: false, error: `mod.toml not found at ${manifestPath}` };
   }
   try {
-    const raw = (0, import_node_fs12.readFileSync)(manifestPath, "utf-8");
+    const raw = (0, import_node_fs14.readFileSync)(manifestPath, "utf-8");
     const parsed = import_toml3.default.parse(raw);
     const name = parsed.module?.name;
     const version = parsed.module?.version;
@@ -13339,6 +13794,12 @@ function validateManifest(modPath) {
     return { ok: false, error: `Invalid mod.toml: ${err.message}` };
   }
 }
+function printTrustRequired(name) {
+  console.log();
+  console.log(source_default.yellow(`  ! ${name} is installed but NOT trusted, so threatcrushd will not load it.`));
+  console.log(source_default.dim("    Review the module source, then run:"));
+  console.log(source_default.dim(`      ${source_default.white(`threatcrush modules trust ${name}`)}`));
+}
 function notifyDaemonIfRunning() {
   if (!findRunningDaemon()) return;
   console.log(source_default.dim(`  \u2139 threatcrushd is running \u2014 restart it to load/unload modules:`));
@@ -13382,8 +13843,8 @@ async function modulesInstallCommand(source) {
   console.log();
   const dir = modulesDir();
   if (source.startsWith("./") || source.startsWith("/") || source.startsWith("~")) {
-    const absPath = (0, import_node_path9.resolve)(source.startsWith("~") ? source.replace("~", process.env.HOME || "") : source);
-    if (!(0, import_node_fs12.existsSync)(absPath)) {
+    const absPath = (0, import_node_path11.resolve)(source.startsWith("~") ? source.replace("~", process.env.HOME || "") : source);
+    if (!(0, import_node_fs14.existsSync)(absPath)) {
       console.log(source_default.red(`  \u2717 Path not found: ${absPath}
 `));
       return;
@@ -13402,7 +13863,7 @@ async function modulesInstallCommand(source) {
 `));
       return;
     }
-    if ((0, import_node_fs12.existsSync)(dest2)) {
+    if ((0, import_node_fs14.existsSync)(dest2)) {
       console.log(source_default.yellow(`  ! ${check.name} is already installed at ${dest2}`));
       console.log(source_default.dim(`    Run ${source_default.white(`threatcrush modules remove ${check.name}`)} first.
 `));
@@ -13410,12 +13871,13 @@ async function modulesInstallCommand(source) {
     }
     const spinner2 = ora({ text: `Copying module files...`, color: "green" }).start();
     try {
-      (0, import_node_fs12.cpSync)(absPath, dest2, { recursive: true, dereference: true });
+      (0, import_node_fs14.cpSync)(absPath, dest2, { recursive: true, dereference: true });
       spinner2.succeed(`Installed ${source_default.white(check.name)} v${check.version} \u2192 ${dest2}`);
     } catch (err) {
       spinner2.fail(`Copy failed: ${err.message}`);
       return;
     }
+    printTrustRequired(check.name);
     notifyDaemonIfRunning();
     console.log();
     return;
@@ -13425,14 +13887,14 @@ async function modulesInstallCommand(source) {
     let name;
     let dest2;
     try {
-      name = safeModuleDirName((0, import_node_path9.basename)(gitUrl.replace(/\.git$/, "")), "repository name");
+      name = safeModuleDirName((0, import_node_path11.basename)(gitUrl.replace(/\.git$/, "")), "repository name");
       dest2 = moduleDestination(dir, name);
     } catch (err) {
       console.log(source_default.red(`  x ${err.message}
 `));
       return;
     }
-    if ((0, import_node_fs12.existsSync)(dest2)) {
+    if ((0, import_node_fs14.existsSync)(dest2)) {
       console.log(source_default.yellow(`  ! ${name} is already installed at ${dest2}`));
       console.log(source_default.dim(`    Run ${source_default.white(`threatcrush modules remove ${name}`)} first.
 `));
@@ -13449,12 +13911,13 @@ async function modulesInstallCommand(source) {
     if (!check.ok) {
       spinner2.fail(check.error);
       try {
-        (0, import_node_fs12.rmSync)(dest2, { recursive: true, force: true });
+        (0, import_node_fs14.rmSync)(dest2, { recursive: true, force: true });
       } catch {
       }
       return;
     }
     spinner2.succeed(`Installed ${source_default.white(check.name)} v${check.version} \u2192 ${dest2}`);
+    printTrustRequired(check.name);
     notifyDaemonIfRunning();
     console.log();
     return;
@@ -13494,7 +13957,7 @@ async function modulesInstallCommand(source) {
 `));
     return;
   }
-  if ((0, import_node_fs12.existsSync)(dest)) {
+  if ((0, import_node_fs14.existsSync)(dest)) {
     console.log(source_default.yellow(`  ! ${mod.slug} is already installed at ${dest}
 `));
     return;
@@ -13520,7 +13983,7 @@ async function modulesInstallCommand(source) {
     if (!check.ok) {
       cloneSpinner.fail(check.error);
       try {
-        (0, import_node_fs12.rmSync)(dest, { recursive: true, force: true });
+        (0, import_node_fs14.rmSync)(dest, { recursive: true, force: true });
       } catch {
       }
       return;
@@ -13534,11 +13997,11 @@ async function modulesInstallCommand(source) {
         dlSpinner.fail(`HTTP ${res.status}`);
         return;
       }
-      const tar = (0, import_node_path9.join)(dir, `${mod.slug}.tar.gz`);
-      (0, import_node_fs12.writeFileSync)(tar, Buffer.from(await res.arrayBuffer()));
+      const tar = (0, import_node_path11.join)(dir, `${mod.slug}.tar.gz`);
+      (0, import_node_fs14.writeFileSync)(tar, Buffer.from(await res.arrayBuffer()));
       assertSafeTarballEntries(tar);
       (0, import_node_child_process2.execFileSync)("tar", ["-xzf", tar, "-C", dir], { stdio: "pipe" });
-      (0, import_node_fs12.rmSync)(tar, { force: true });
+      (0, import_node_fs14.rmSync)(tar, { force: true });
       const check = validateManifest(dest);
       if (!check.ok) {
         dlSpinner.fail(check.error);
@@ -13553,6 +14016,7 @@ async function modulesInstallCommand(source) {
     logger.info("No installable artifact provided for this module.");
     return;
   }
+  printTrustRequired(mod.slug);
   notifyDaemonIfRunning();
   console.log();
 }
@@ -13569,7 +14033,7 @@ async function modulesRemoveCommand(name) {
 `));
     return;
   }
-  if (!(0, import_node_fs12.existsSync)(target)) {
+  if (!(0, import_node_fs14.existsSync)(target)) {
     console.log(source_default.yellow(`  ! No module named "${name}" in ${dir}
 `));
     return;
@@ -13579,7 +14043,8 @@ async function modulesRemoveCommand(name) {
     console.log(source_default.yellow(`  ! Directory name "${name}" does not match manifest name "${check.name}"`));
   }
   try {
-    (0, import_node_fs12.rmSync)(target, { recursive: true, force: true });
+    (0, import_node_fs14.rmSync)(target, { recursive: true, force: true });
+    untrustModule(name);
     console.log(source_default.green(`  \u2713 Removed ${name} from ${dir}
 `));
   } catch (err) {
@@ -13589,6 +14054,72 @@ async function modulesRemoveCommand(name) {
   }
   notifyDaemonIfRunning();
 }
+async function modulesTrustCommand(name) {
+  banner();
+  console.log(source_default.green.bold("  Trust Module"));
+  console.log(source_default.gray("  " + "\u2500".repeat(50)));
+  console.log();
+  const dir = modulesDir();
+  let target;
+  try {
+    target = moduleDestination(dir, name);
+  } catch (err) {
+    console.log(source_default.red(`  x ${err.message}
+`));
+    return;
+  }
+  if (!(0, import_node_fs14.existsSync)(target)) {
+    console.log(source_default.yellow(`  ! No module named "${name}" in ${dir}
+`));
+    return;
+  }
+  const check = validateManifest(target);
+  if (!check.ok) {
+    console.log(source_default.red(`  \u2717 ${check.error}
+`));
+    return;
+  }
+  const record = trustModule(name, target, target);
+  console.log(source_default.green(`  \u2713 Trusted ${source_default.white(name)} v${check.version}`));
+  console.log(source_default.dim(`    digest ${record.digest.slice(0, 16)}\u2026`));
+  console.log(
+    source_default.dim("    threatcrushd will refuse to load it again if its contents change.\n")
+  );
+  notifyDaemonIfRunning();
+}
+async function modulesUntrustCommand(name) {
+  banner();
+  console.log(source_default.green.bold("  Revoke Module Trust"));
+  console.log(source_default.gray("  " + "\u2500".repeat(50)));
+  console.log();
+  if (untrustModule(name)) {
+    console.log(source_default.green(`  \u2713 Revoked trust for ${source_default.white(name)}
+`));
+    notifyDaemonIfRunning();
+  } else {
+    console.log(source_default.yellow(`  ! ${name} was not trusted
+`));
+  }
+}
+async function modulesTrustedCommand() {
+  banner();
+  console.log(source_default.green.bold("  Trusted Modules"));
+  console.log(source_default.gray("  " + "\u2500".repeat(50)));
+  console.log();
+  const trusted = Object.entries(listTrustedModules());
+  if (trusted.length === 0) {
+    console.log(source_default.yellow("  No modules are trusted."));
+    console.log(source_default.dim("  Installed modules stay dormant until you run:"));
+    console.log(source_default.dim(`    ${source_default.white("threatcrush modules trust <name>")}
+`));
+    return;
+  }
+  for (const [name, record] of trusted) {
+    console.log(`  ${source_default.white(name)}  ${source_default.dim(record.digest.slice(0, 16) + "\u2026")}`);
+    console.log(source_default.dim(`    trusted ${record.trustedAt}`));
+  }
+  console.log();
+}
 async function modulesCommand(opts) {
   const action = opts.action || "list";
   switch (action) {
@@ -13622,10 +14153,31 @@ async function modulesCommand(opts) {
       }
       await modulesRemoveCommand(opts.name);
       break;
+    case "trust":
+      if (!opts.name) {
+        banner();
+        console.log(source_default.red("  Module name required."));
+        console.log(source_default.gray("  Usage: threatcrush modules trust <name>\n"));
+        return;
+      }
+      await modulesTrustCommand(opts.name);
+      break;
+    case "untrust":
+      if (!opts.name) {
+        banner();
+        console.log(source_default.red("  Module name required."));
+        console.log(source_default.gray("  Usage: threatcrush modules untrust <name>\n"));
+        return;
+      }
+      await modulesUntrustCommand(opts.name);
+      break;
+    case "trusted":
+      await modulesTrustedCommand();
+      break;
     default:
       banner();
       console.log(source_default.yellow(`  Unknown action: ${action}`));
-      console.log(source_default.gray("  Available actions: list, install, remove\n"));
+      console.log(source_default.gray("  Available actions: list, install, remove, trust, untrust, trusted\n"));
       await modulesListCommand();
       break;
   }
@@ -13952,21 +14504,21 @@ async function pentestCommand(targetUrl) {
 
 // src/commands/orgs.ts
 var import_node_os5 = require("os");
-var import_node_fs13 = require("fs");
-var import_node_path10 = require("path");
+var import_node_fs15 = require("fs");
+var import_node_path12 = require("path");
 var API_URL3 = process.env.THREATCRUSH_API_URL || "https://threatcrush.com";
-var CONFIG_PATH = (0, import_node_path10.join)((0, import_node_os5.homedir)(), ".threatcrush", "config.json");
+var CONFIG_PATH = (0, import_node_path12.join)((0, import_node_os5.homedir)(), ".threatcrush", "config.json");
 function readConfig() {
   try {
-    return JSON.parse((0, import_node_fs13.readFileSync)(CONFIG_PATH, "utf-8"));
+    return JSON.parse((0, import_node_fs15.readFileSync)(CONFIG_PATH, "utf-8"));
   } catch {
     return {};
   }
 }
 function writeConfig(config) {
-  const dir = (0, import_node_path10.join)((0, import_node_os5.homedir)(), ".threatcrush");
-  if (!(0, import_node_fs13.existsSync)(dir)) (0, import_node_fs13.mkdirSync)(dir, { recursive: true });
-  (0, import_node_fs13.writeFileSync)(CONFIG_PATH, JSON.stringify(config, null, 2));
+  const dir = (0, import_node_path12.join)((0, import_node_os5.homedir)(), ".threatcrush");
+  if (!(0, import_node_fs15.existsSync)(dir)) (0, import_node_fs15.mkdirSync)(dir, { recursive: true });
+  (0, import_node_fs15.writeFileSync)(CONFIG_PATH, JSON.stringify(config, null, 2));
 }
 function getAuthHeaders() {
   const config = readConfig();
@@ -14102,13 +14654,13 @@ async function useOrganization(slug) {
 
 // src/commands/servers.ts
 var import_node_os6 = require("os");
-var import_node_fs14 = require("fs");
-var import_node_path11 = require("path");
+var import_node_fs16 = require("fs");
+var import_node_path13 = require("path");
 var API_URL4 = process.env.THREATCRUSH_API_URL || "https://threatcrush.com";
-var CONFIG_PATH2 = (0, import_node_path11.join)((0, import_node_os6.homedir)(), ".threatcrush", "config.json");
+var CONFIG_PATH2 = (0, import_node_path13.join)((0, import_node_os6.homedir)(), ".threatcrush", "config.json");
 function readConfig2() {
   try {
-    return JSON.parse((0, import_node_fs14.readFileSync)(CONFIG_PATH2, "utf-8"));
+    return JSON.parse((0, import_node_fs16.readFileSync)(CONFIG_PATH2, "utf-8"));
   } catch {
     return {};
   }
@@ -14211,14 +14763,14 @@ function timeAgo(dateStr) {
 
 // src/commands/connect.ts
 var import_node_os7 = require("os");
-var import_node_fs15 = require("fs");
-var import_node_path12 = require("path");
+var import_node_fs17 = require("fs");
+var import_node_path14 = require("path");
 var import_node_child_process3 = require("child_process");
 var API_URL5 = process.env.THREATCRUSH_API_URL || "https://threatcrush.com";
-var CONFIG_PATH3 = (0, import_node_path12.join)((0, import_node_os7.homedir)(), ".threatcrush", "config.json");
+var CONFIG_PATH3 = (0, import_node_path14.join)((0, import_node_os7.homedir)(), ".threatcrush", "config.json");
 function readConfig3() {
   try {
-    return JSON.parse((0, import_node_fs15.readFileSync)(CONFIG_PATH3, "utf-8"));
+    return JSON.parse((0, import_node_fs17.readFileSync)(CONFIG_PATH3, "utf-8"));
   } catch {
     return {};
   }
@@ -14373,20 +14925,21 @@ async function sshConnect(options) {
 
 // src/commands/daemon.ts
 var import_node_child_process7 = require("child_process");
-var import_node_fs24 = require("fs");
-var import_node_path16 = require("path");
-var import_node_fs25 = require("fs");
+var import_node_fs26 = require("fs");
+var import_node_path18 = require("path");
+var import_node_fs27 = require("fs");
 
 // src/daemon/index.ts
-var import_node_fs23 = require("fs");
-var import_node_path15 = require("path");
+var import_node_fs25 = require("fs");
+var import_node_path17 = require("path");
 init_paths();
 init_pidfile();
 
 // src/daemon/ipc-server.ts
 var import_node_net2 = require("net");
-var import_node_fs16 = require("fs");
+var import_node_fs18 = require("fs");
 init_paths();
+init_control_token();
 
 // src/daemon/event-bus.ts
 var import_node_events = require("events");
@@ -14431,10 +14984,12 @@ var IpcServer = class {
   nextClientId = 1;
   startedAt = /* @__PURE__ */ new Date();
   counters = { events: 0, threats: 0, alerts: 0 };
+  controlToken = "";
   async start() {
-    if ((0, import_node_fs16.existsSync)(PATHS.socket)) {
+    this.controlToken = issueControlToken();
+    if ((0, import_node_fs18.existsSync)(PATHS.socket)) {
       try {
-        (0, import_node_fs16.unlinkSync)(PATHS.socket);
+        (0, import_node_fs18.unlinkSync)(PATHS.socket);
       } catch {
       }
     }
@@ -14470,14 +15025,14 @@ var IpcServer = class {
     return new Promise((resolve5) => {
       if (!this.server) {
         try {
-          if ((0, import_node_fs16.existsSync)(PATHS.socket)) (0, import_node_fs16.unlinkSync)(PATHS.socket);
+          if ((0, import_node_fs18.existsSync)(PATHS.socket)) (0, import_node_fs18.unlinkSync)(PATHS.socket);
         } catch {
         }
         return resolve5();
       }
       this.server.close(() => {
         try {
-          if ((0, import_node_fs16.existsSync)(PATHS.socket)) (0, import_node_fs16.unlinkSync)(PATHS.socket);
+          if ((0, import_node_fs18.existsSync)(PATHS.socket)) (0, import_node_fs18.unlinkSync)(PATHS.socket);
         } catch {
         }
         resolve5();
@@ -14563,6 +15118,13 @@ var IpcServer = class {
         for (const ch of req.params.channels) client.subscriptions.add(ch);
         return this.send(client, { id: req.id, ok: true, result: { subscribed: [...client.subscriptions] } });
       case "shutdown":
+        if (!tokensMatch(this.controlToken, req.params?.token)) {
+          return this.send(client, {
+            id: req.id,
+            ok: false,
+            error: "shutdown requires the daemon control token (run as root, or use systemctl)"
+          });
+        }
         this.send(client, { id: req.id, ok: true, result: "shutting down" });
         setTimeout(() => process.emit("SIGTERM"), 50);
         return;
@@ -14583,14 +15145,14 @@ var IpcServer = class {
 };
 
 // src/daemon/module-host.ts
-var import_node_fs20 = require("fs");
-var import_node_path13 = require("path");
+var import_node_fs22 = require("fs");
+var import_node_path15 = require("path");
 var import_node_url = require("url");
 var import_toml4 = __toESM(require_toml());
 init_paths();
 
 // src/daemon/watchers/log-watcher.ts
-var import_node_fs17 = require("fs");
+var import_node_fs19 = require("fs");
 var import_node_readline4 = require("readline");
 init_state();
 var DEFAULT_SOURCES = [
@@ -14612,9 +15174,9 @@ var LogWatcher = class {
   start() {
     const started = [];
     for (const src of this.sources) {
-      if (!(0, import_node_fs17.existsSync)(src.path)) continue;
+      if (!(0, import_node_fs19.existsSync)(src.path)) continue;
       try {
-        (0, import_node_fs17.accessSync)(src.path, import_node_fs17.constants.R_OK);
+        (0, import_node_fs19.accessSync)(src.path, import_node_fs19.constants.R_OK);
       } catch {
         continue;
       }
@@ -14634,7 +15196,7 @@ var LogWatcher = class {
   }
   tail(src) {
     try {
-      this.positions.set(src.path, (0, import_node_fs17.statSync)(src.path).size);
+      this.positions.set(src.path, (0, import_node_fs19.statSync)(src.path).size);
     } catch {
       this.positions.set(src.path, 0);
     }
@@ -14645,7 +15207,7 @@ var LogWatcher = class {
   poll(src) {
     let stat;
     try {
-      stat = (0, import_node_fs17.statSync)(src.path);
+      stat = (0, import_node_fs19.statSync)(src.path);
     } catch {
       return;
     }
@@ -14655,7 +15217,7 @@ var LogWatcher = class {
       return;
     }
     if (stat.size === prev) return;
-    const stream = (0, import_node_fs17.createReadStream)(src.path, { start: prev, encoding: "utf-8" });
+    const stream = (0, import_node_fs19.createReadStream)(src.path, { start: prev, encoding: "utf-8" });
     stream.on("error", () => this.positions.set(src.path, stat.size));
     const rl = (0, import_node_readline4.createInterface)({ input: stream });
     rl.on("error", () => {
@@ -14848,7 +15410,7 @@ function realtimeToDate(rt) {
 
 // src/modules/network-monitor/index.ts
 var import_node_child_process5 = require("child_process");
-var import_node_fs18 = require("fs");
+var import_node_fs20 = require("fs");
 init_state();
 var NetworkMonitor = class {
   constructor(bus2) {
@@ -14887,7 +15449,7 @@ var NetworkMonitor = class {
   hasConntrackOrSs() {
     const ss = (0, import_node_child_process5.spawnSync)("ss", ["--version"], { stdio: "pipe" });
     if (ss.status === 0) return true;
-    return (0, import_node_fs18.existsSync)("/proc/net/tcp");
+    return (0, import_node_fs20.existsSync)("/proc/net/tcp");
   }
   poll() {
     try {
@@ -15026,7 +15588,7 @@ var NetworkMonitor = class {
 };
 
 // src/modules/dns-monitor/index.ts
-var import_node_fs19 = require("fs");
+var import_node_fs21 = require("fs");
 var import_node_readline5 = require("readline");
 init_state();
 var DNS_LOG_SOURCES = [
@@ -15061,9 +15623,9 @@ var DnsMonitor = class {
   entropyThreshold = 3.5;
   start() {
     const sources = DNS_LOG_SOURCES.filter((p) => {
-      if (!(0, import_node_fs19.existsSync)(p)) return false;
+      if (!(0, import_node_fs21.existsSync)(p)) return false;
       try {
-        (0, import_node_fs19.accessSync)(p, import_node_fs19.constants.R_OK);
+        (0, import_node_fs21.accessSync)(p, import_node_fs21.constants.R_OK);
         return true;
       } catch {
         return false;
@@ -15087,7 +15649,7 @@ var DnsMonitor = class {
   }
   tailLog(path) {
     try {
-      this.positions.set(path, (0, import_node_fs19.statSync)(path).size);
+      this.positions.set(path, (0, import_node_fs21.statSync)(path).size);
     } catch {
       this.positions.set(path, 0);
     }
@@ -15097,7 +15659,7 @@ var DnsMonitor = class {
   pollLog(path) {
     let stat;
     try {
-      stat = (0, import_node_fs19.statSync)(path);
+      stat = (0, import_node_fs21.statSync)(path);
     } catch {
       return;
     }
@@ -15107,7 +15669,7 @@ var DnsMonitor = class {
       return;
     }
     if (stat.size === prev) return;
-    const stream = (0, import_node_fs19.createReadStream)(path, { start: prev, encoding: "utf-8" });
+    const stream = (0, import_node_fs21.createReadStream)(path, { start: prev, encoding: "utf-8" });
     stream.on("error", () => this.positions.set(path, stat.size));
     const rl = (0, import_node_readline5.createInterface)({ input: stream });
     rl.on("line", (line) => this.parseDnsLine(line));
@@ -15339,15 +15901,15 @@ var ModuleHost = class {
     for (const m of builtins) this.modules.set(m.name, m);
   }
   async discoverAndStartInstalled() {
-    if (!(0, import_node_fs20.existsSync)(PATHS.moduleDir)) return;
+    if (!(0, import_node_fs22.existsSync)(PATHS.moduleDir)) return;
     const configs = loadModuleConfigs(PATHS.confD);
-    const entries = (0, import_node_fs20.readdirSync)(PATHS.moduleDir, { withFileTypes: true });
+    const entries = (0, import_node_fs22.readdirSync)(PATHS.moduleDir, { withFileTypes: true });
     for (const entry of entries) {
       if (!entry.isDirectory()) continue;
-      const manifestPath = (0, import_node_path13.join)(PATHS.moduleDir, entry.name, "mod.toml");
-      if (!(0, import_node_fs20.existsSync)(manifestPath)) continue;
+      const manifestPath = (0, import_node_path15.join)(PATHS.moduleDir, entry.name, "mod.toml");
+      if (!(0, import_node_fs22.existsSync)(manifestPath)) continue;
       try {
-        const manifest = import_toml4.default.parse((0, import_node_fs20.readFileSync)(manifestPath, "utf-8"));
+        const manifest = import_toml4.default.parse((0, import_node_fs22.readFileSync)(manifestPath, "utf-8"));
         const name = manifest.module?.name || entry.name;
         const defaults = manifest.module?.config?.defaults || {};
         const config = {
@@ -15361,7 +15923,7 @@ var ModuleHost = class {
           source: "installed",
           status: config.enabled === false ? "disabled" : "loaded",
           events: 0,
-          path: (0, import_node_path13.join)(PATHS.moduleDir, entry.name),
+          path: (0, import_node_path15.join)(PATHS.moduleDir, entry.name),
           config
         };
         this.modules.set(name, hosted);
@@ -15376,7 +15938,7 @@ var ModuleHost = class {
           status: "error",
           events: 0,
           detail: `manifest load failed: ${String(err.message || err)}`,
-          path: (0, import_node_path13.join)(PATHS.moduleDir, entry.name)
+          path: (0, import_node_path15.join)(PATHS.moduleDir, entry.name)
         });
       }
     }
@@ -15388,6 +15950,13 @@ var ModuleHost = class {
       hosted.detail = "no built entrypoint found; run npm install && npm run build in the module directory";
       return;
     }
+    const trust = verifyModuleTrust(hosted.name, hosted.path);
+    if (!trust.ok) {
+      hosted.status = "error";
+      hosted.detail = `refusing to load: ${trust.reason}`;
+      this.bus.announceModule(hosted.name, "error", hosted.detail);
+      return;
+    }
     try {
       const imported = await import((0, import_node_url.pathToFileURL)(entrypoint).href);
       const exported = imported.default || imported.module || imported;
@@ -15408,17 +15977,17 @@ var ModuleHost = class {
     }
   }
   installedEntrypoint(modulePath) {
-    const packageJson = (0, import_node_path13.join)(modulePath, "package.json");
+    const packageJson = (0, import_node_path15.join)(modulePath, "package.json");
     const candidates = [];
-    if ((0, import_node_fs20.existsSync)(packageJson)) {
+    if ((0, import_node_fs22.existsSync)(packageJson)) {
       try {
-        const pkg = JSON.parse((0, import_node_fs20.readFileSync)(packageJson, "utf-8"));
-        if (pkg.main) candidates.push((0, import_node_path13.join)(modulePath, pkg.main));
+        const pkg = JSON.parse((0, import_node_fs22.readFileSync)(packageJson, "utf-8"));
+        if (pkg.main) candidates.push((0, import_node_path15.join)(modulePath, pkg.main));
       } catch {
       }
     }
-    candidates.push((0, import_node_path13.join)(modulePath, "dist", "index.js"), (0, import_node_path13.join)(modulePath, "index.js"));
-    return candidates.find((candidate) => (0, import_node_fs20.existsSync)(candidate)) || null;
+    candidates.push((0, import_node_path15.join)(modulePath, "dist", "index.js"), (0, import_node_path15.join)(modulePath, "index.js"));
+    return candidates.find((candidate) => (0, import_node_fs22.existsSync)(candidate)) || null;
   }
   isThreatCrushModule(value) {
     return Boolean(
@@ -15939,8 +16508,8 @@ var RuleEngine = class {
 };
 
 // src/daemon/rules/loader.ts
-var import_node_fs21 = require("fs");
-var import_node_path14 = require("path");
+var import_node_fs23 = require("fs");
+var import_node_path16 = require("path");
 
 // src/daemon/rules/default-rules.ts
 var DEFAULT_RULES = [
@@ -16224,11 +16793,11 @@ var RULES_DIR = "/etc/threatcrush/rules.d";
 function loadAllRules(customDir) {
   const rules = [...DEFAULT_RULES];
   const dir = customDir || RULES_DIR;
-  if ((0, import_node_fs21.existsSync)(dir)) {
-    const files = (0, import_node_fs21.readdirSync)(dir).filter((f) => f.endsWith(".json"));
+  if ((0, import_node_fs23.existsSync)(dir)) {
+    const files = (0, import_node_fs23.readdirSync)(dir).filter((f) => f.endsWith(".json"));
     for (const file of files) {
       try {
-        const raw = (0, import_node_fs21.readFileSync)((0, import_node_path14.join)(dir, file), "utf-8");
+        const raw = (0, import_node_fs23.readFileSync)((0, import_node_path16.join)(dir, file), "utf-8");
         const parsed = JSON.parse(raw);
         const customRules = Array.isArray(parsed) ? parsed : [parsed];
         for (const rule of customRules) {
@@ -16391,7 +16960,7 @@ function detectFirewallAdapter() {
 }
 
 // src/daemon/firewall/remediation.ts
-var import_node_fs22 = require("fs");
+var import_node_fs24 = require("fs");
 init_state();
 init_paths();
 var DEFAULT_CONFIG2 = {
@@ -16548,7 +17117,7 @@ var RemediationManager = class {
   }
   logLine(line) {
     try {
-      (0, import_node_fs22.appendFileSync)(PATHS.logFile, `${(/* @__PURE__ */ new Date()).toISOString()} ${line}
+      (0, import_node_fs24.appendFileSync)(PATHS.logFile, `${(/* @__PURE__ */ new Date()).toISOString()} ${line}
 `);
     } catch {
     }
@@ -16607,7 +17176,7 @@ async function flushTelemetry(timeoutMs = 2e3) {
 // src/daemon/index.ts
 function readVersion2() {
   try {
-    const pkg = JSON.parse((0, import_node_fs23.readFileSync)((0, import_node_path15.join)(__dirname, "..", "package.json"), "utf-8"));
+    const pkg = JSON.parse((0, import_node_fs25.readFileSync)((0, import_node_path17.join)(__dirname, "..", "package.json"), "utf-8"));
     return pkg.version || "0.0.0";
   } catch {
     return "0.0.0";
@@ -16615,7 +17184,7 @@ function readVersion2() {
 }
 function logLine(line) {
   try {
-    (0, import_node_fs23.appendFileSync)(PATHS.logFile, `${(/* @__PURE__ */ new Date()).toISOString()} ${line}
+    (0, import_node_fs25.appendFileSync)(PATHS.logFile, `${(/* @__PURE__ */ new Date()).toISOString()} ${line}
 `);
   } catch {
   }
@@ -16643,7 +17212,7 @@ async function runDaemon() {
   } catch (err) {
     logLine(`[daemon] state db unavailable: ${err.message}`);
   }
-  const config = loadConfig((0, import_node_fs23.existsSync)(PATHS.configFile) ? PATHS.configFile : void 0);
+  const config = loadConfig((0, import_node_fs25.existsSync)(PATHS.configFile) ? PATHS.configFile : void 0);
   bus.on("event", (event) => {
     logLine(`[event] ${event.severity} ${event.module} ${event.message}`);
   });
@@ -16735,7 +17304,7 @@ async function runDaemon() {
 init_paths();
 init_pidfile();
 init_ipc_client();
-var DAEMON_ENTRY = (0, import_node_path16.join)(__dirname, "daemon.js");
+var DAEMON_ENTRY = (0, import_node_path18.join)(__dirname, "daemon.js");
 async function daemonForeground() {
   await runDaemon();
 }
@@ -16746,7 +17315,7 @@ async function daemonStart() {
     return;
   }
   ensureRuntimeDirs();
-  if (!(0, import_node_fs24.existsSync)(DAEMON_ENTRY)) {
+  if (!(0, import_node_fs26.existsSync)(DAEMON_ENTRY)) {
     console.log(source_default.red(`  Daemon entry not found at ${DAEMON_ENTRY}.`));
     console.log(source_default.dim("  Reinstall with `threatcrush update` or `pnpm run build` in the cli package."));
     return;
@@ -16754,8 +17323,8 @@ async function daemonStart() {
   let out;
   let err;
   try {
-    out = (0, import_node_fs25.openSync)(PATHS.logFile, "a");
-    err = (0, import_node_fs25.openSync)(PATHS.logFile, "a");
+    out = (0, import_node_fs27.openSync)(PATHS.logFile, "a");
+    err = (0, import_node_fs27.openSync)(PATHS.logFile, "a");
   } catch (e) {
     const code = e.code;
     console.log(source_default.red(`  \u2717 Cannot write daemon log at ${PATHS.logFile} (${code ?? "error"}).`));
@@ -16834,19 +17403,19 @@ async function daemonStop() {
 
 // src/commands/service.ts
 var import_node_child_process8 = require("child_process");
-var import_node_fs26 = require("fs");
-var import_node_path17 = require("path");
+var import_node_fs28 = require("fs");
+var import_node_path19 = require("path");
 var UNIT_PATH = "/etc/systemd/system/threatcrushd.service";
 function resolveTemplate() {
-  const templatePath = (0, import_node_path17.join)(__dirname, "systemd", "threatcrushd.service");
-  if (!(0, import_node_fs26.existsSync)(templatePath)) {
+  const templatePath = (0, import_node_path19.join)(__dirname, "systemd", "threatcrushd.service");
+  if (!(0, import_node_fs28.existsSync)(templatePath)) {
     throw new Error(`systemd unit template not found at ${templatePath}`);
   }
-  return (0, import_node_fs26.readFileSync)(templatePath, "utf-8");
+  return (0, import_node_fs28.readFileSync)(templatePath, "utf-8");
 }
 function resolveBinPath() {
   const arg = process.argv[1];
-  if (arg && (0, import_node_fs26.existsSync)(arg)) return arg;
+  if (arg && (0, import_node_fs28.existsSync)(arg)) return arg;
   try {
     return (0, import_node_child_process8.execSync)("command -v threatcrush", { encoding: "utf-8" }).trim();
   } catch {
@@ -16867,7 +17436,7 @@ async function installServiceCommand() {
     return;
   }
   const unit = resolveTemplate().replace("{{BIN_PATH}}", resolveBinPath());
-  (0, import_node_fs26.writeFileSync)(UNIT_PATH, unit, { mode: 420 });
+  (0, import_node_fs28.writeFileSync)(UNIT_PATH, unit, { mode: 420 });
   console.log(source_default.green(`  \u2713 Installed unit file: ${UNIT_PATH}`));
   ensureSystemDirs();
   try {
@@ -16882,29 +17451,31 @@ async function installServiceCommand() {
 }
 function ensureSystemDirs() {
   const dirs = [
-    { path: "/etc/threatcrush" },
-    { path: "/etc/threatcrush/modules", sticky: true },
-    { path: "/etc/threatcrush/threatcrushd.conf.d" },
-    { path: "/var/log/threatcrush" },
-    { path: "/var/lib/threatcrush" },
-    { path: "/var/run/threatcrush" }
+    { path: "/etc/threatcrush", groupWritable: true },
+    { path: "/etc/threatcrush/modules", groupWritable: true, sticky: true },
+    { path: "/etc/threatcrush/threatcrushd.conf.d", groupWritable: true },
+    { path: "/var/log/threatcrush", groupWritable: false },
+    { path: "/var/lib/threatcrush", groupWritable: false },
+    { path: "/var/run/threatcrush", groupWritable: false }
   ];
   let admGid = null;
   try {
-    admGid = (0, import_node_fs26.statSync)("/var/log/auth.log").gid;
+    admGid = (0, import_node_fs28.statSync)("/var/log/auth.log").gid;
   } catch {
   }
-  for (const { path, sticky } of dirs) {
+  for (const { path, groupWritable, sticky } of dirs) {
     try {
-      (0, import_node_fs26.mkdirSync)(path, { recursive: true });
+      (0, import_node_fs28.mkdirSync)(path, { recursive: true });
     } catch {
     }
-    if (admGid !== null) {
-      try {
-        (0, import_node_fs26.chmodSync)(path, sticky ? 1533 : 509);
+    try {
+      if (groupWritable && admGid !== null) {
+        (0, import_node_fs28.chmodSync)(path, sticky ? 1533 : 509);
         (0, import_node_child_process8.execSync)(`chgrp adm ${path}`, { stdio: "ignore" });
-      } catch {
+      } else {
+        (0, import_node_fs28.chmodSync)(path, 493);
       }
+    } catch {
     }
   }
   console.log(source_default.green("  \u2713 Runtime dirs prepared (group `adm` may install modules / edit config without sudo)."));
@@ -16928,7 +17499,7 @@ async function uninstallServiceCommand() {
   } catch {
   }
   try {
-    if ((0, import_node_fs26.existsSync)(UNIT_PATH)) {
+    if ((0, import_node_fs28.existsSync)(UNIT_PATH)) {
       (0, import_node_child_process8.execSync)(`rm -f ${UNIT_PATH}`);
       console.log(source_default.green(`  \u2713 Removed unit file: ${UNIT_PATH}`));
     }
@@ -17027,8 +17598,8 @@ function welcomeCommand() {
 }
 
 // src/commands/properties.ts
-var import_node_fs27 = require("fs");
-var import_node_path18 = require("path");
+var import_node_fs29 = require("fs");
+var import_node_path20 = require("path");
 var import_node_readline6 = __toESM(require("readline"));
 var API_URL7 = process.env.THREATCRUSH_API_URL || "https://threatcrush.com";
 var KINDS = ["url", "api", "domain", "ip", "repo"];
@@ -17357,8 +17928,8 @@ async function propertiesRunsCommand(opts) {
   }
 }
 function parseImportFile(path) {
-  const ext = (0, import_node_path18.extname)(path).toLowerCase();
-  const raw = (0, import_node_fs27.readFileSync)(path, "utf-8");
+  const ext = (0, import_node_path20.extname)(path).toLowerCase();
+  const raw = (0, import_node_fs29.readFileSync)(path, "utf-8");
   if (ext === ".json") {
     const parsed = JSON.parse(raw);
     if (!Array.isArray(parsed)) throw new Error("JSON must be an array of objects");
@@ -17548,7 +18119,7 @@ async function rulesCommand(opts) {
 }
 
 // src/commands/harden.ts
-var import_node_fs28 = require("fs");
+var import_node_fs30 = require("fs");
 var import_node_child_process9 = require("child_process");
 function tryExec(cmd) {
   try {
@@ -17559,7 +18130,7 @@ function tryExec(cmd) {
 }
 function tryRead(path) {
   try {
-    return (0, import_node_fs28.readFileSync)(path, "utf-8");
+    return (0, import_node_fs30.readFileSync)(path, "utf-8");
   } catch {
     return null;
   }
@@ -17663,8 +18234,8 @@ function checkSshWeakConfig() {
   };
 }
 function checkAutoUpdates() {
-  const unattended = (0, import_node_fs28.existsSync)("/etc/apt/apt.conf.d/20auto-upgrades") || (0, import_node_fs28.existsSync)("/etc/apt/apt.conf.d/50unattended-upgrades");
-  const dnfAuto = (0, import_node_fs28.existsSync)("/etc/dnf/automatic.conf");
+  const unattended = (0, import_node_fs30.existsSync)("/etc/apt/apt.conf.d/20auto-upgrades") || (0, import_node_fs30.existsSync)("/etc/apt/apt.conf.d/50unattended-upgrades");
+  const dnfAuto = (0, import_node_fs30.existsSync)("/etc/dnf/automatic.conf");
   if (unattended || dnfAuto) {
     return {
       key: "auto-updates",
@@ -17790,7 +18361,7 @@ function checkFail2ban() {
       explanation: "fail2ban is installed and running."
     };
   }
-  if ((0, import_node_fs28.existsSync)("/etc/fail2ban/fail2ban.conf")) {
+  if ((0, import_node_fs30.existsSync)("/etc/fail2ban/fail2ban.conf")) {
     return {
       key: checkKey,
       status: "warn",
@@ -18021,7 +18592,7 @@ async function allowlistCommand(opts) {
 init_paths();
 var PKG_VERSION2 = "0.1.8";
 try {
-  const pkg = JSON.parse((0, import_node_fs29.readFileSync)((0, import_node_path19.join)(__dirname, "..", "package.json"), "utf-8"));
+  const pkg = JSON.parse((0, import_node_fs31.readFileSync)((0, import_node_path21.join)(__dirname, "..", "package.json"), "utf-8"));
   PKG_VERSION2 = pkg.version;
 } catch {
 }
@@ -18037,7 +18608,7 @@ ${source_default.dim("                    C R U S H")}
 var API_URL8 = process.env.THREATCRUSH_API_URL || "https://threatcrush.com";
 var PKG_NAME = "@profullstack/threatcrush";
 var DESKTOP_PKG_NAME = "@profullstack/threatcrush-desktop";
-var INSTALL_CONFIG_PATH = (0, import_node_path19.join)((0, import_node_os8.homedir)(), ".threatcrush", "install.json");
+var INSTALL_CONFIG_PATH = (0, import_node_path21.join)((0, import_node_os8.homedir)(), ".threatcrush", "install.json");
 function detectPackageManager() {
   try {
     const npmGlobal = (0, import_node_child_process10.execSync)("npm ls -g --depth=0 --json 2>/dev/null", { encoding: "utf-8" });
@@ -18063,7 +18634,7 @@ function detectPackageManager() {
 }
 function readInstallConfig() {
   try {
-    return JSON.parse((0, import_node_fs29.readFileSync)(INSTALL_CONFIG_PATH, "utf-8"));
+    return JSON.parse((0, import_node_fs31.readFileSync)(INSTALL_CONFIG_PATH, "utf-8"));
   } catch {
     return {};
   }
@@ -18248,7 +18819,7 @@ program2.command("uninstall-service").description("Remove the threatcrushd syste
 program2.command("logs").description("Tail daemon logs").action(async () => {
   console.log(LOGO2);
   const logPath = PATHS.logFile;
-  if (!(0, import_node_fs29.existsSync)(logPath)) {
+  if (!(0, import_node_fs31.existsSync)(logPath)) {
     console.log(source_default.yellow(`  No log file found at ${logPath}`));
     console.log(source_default.dim("  Start the daemon first with `threatcrush start`\n"));
     return;
@@ -18453,10 +19024,10 @@ storeCmd.command("search <query>").description("Search for modules in the store"
 });
 storeCmd.command("publish <url>").description("Publish a module from a git URL or web URL").action(async (url) => {
   console.log(LOGO2);
-  const configPath = (0, import_node_path19.join)((0, import_node_os8.homedir)(), ".threatcrush", "config.json");
+  const configPath = (0, import_node_path21.join)((0, import_node_os8.homedir)(), ".threatcrush", "config.json");
   let email = "";
   try {
-    const config = JSON.parse((0, import_node_fs29.readFileSync)(configPath, "utf-8"));
+    const config = JSON.parse((0, import_node_fs31.readFileSync)(configPath, "utf-8"));
     email = config.email || "";
   } catch {
   }
@@ -18473,9 +19044,9 @@ storeCmd.command("publish <url>").description("Publish a module from a git URL o
       return;
     }
     try {
-      const dir = (0, import_node_path19.join)((0, import_node_os8.homedir)(), ".threatcrush");
-      if (!(0, import_node_fs29.existsSync)(dir)) (0, import_node_fs29.mkdirSync)(dir, { recursive: true });
-      (0, import_node_fs29.writeFileSync)(configPath, JSON.stringify({ email }, null, 2));
+      const dir = (0, import_node_path21.join)((0, import_node_os8.homedir)(), ".threatcrush");
+      if (!(0, import_node_fs31.existsSync)(dir)) (0, import_node_fs31.mkdirSync)(dir, { recursive: true });
+      (0, import_node_fs31.writeFileSync)(configPath, JSON.stringify({ email }, null, 2));
       console.log(source_default.dim(`  Saved email to ${configPath}`));
     } catch {
     }