@profullstack/threatcrush 0.11.1 → 0.11.3

package/dist/index.js

@@ -3891,14 +3891,52 @@ var init_paths = __esm({
   }
 });
 
+// src/daemon/control-token.ts
+function issueControlToken() {
+  const token = (0, import_node_crypto.randomBytes)(32).toString("hex");
+  (0, import_node_fs2.writeFileSync)(CONTROL_TOKEN_FILE, token, { mode: 384 });
+  try {
+    (0, import_node_fs2.chmodSync)(CONTROL_TOKEN_FILE, 384);
+  } catch {
+  }
+  return token;
+}
+function readControlToken() {
+  if (!(0, import_node_fs2.existsSync)(CONTROL_TOKEN_FILE)) return null;
+  try {
+    const token = (0, import_node_fs2.readFileSync)(CONTROL_TOKEN_FILE, "utf-8").trim();
+    return token || null;
+  } catch {
+    return null;
+  }
+}
+function tokensMatch(expected, provided) {
+  if (typeof provided !== "string" || !provided) return false;
+  const a = Buffer.from(expected);
+  const b = Buffer.from(provided);
+  return a.length === b.length && (0, import_node_crypto.timingSafeEqual)(a, b);
+}
+var import_node_crypto, import_node_fs2, import_node_path2, CONTROL_TOKEN_FILE;
+var init_control_token = __esm({
+  "src/daemon/control-token.ts"() {
+    "use strict";
+    import_node_crypto = require("crypto");
+    import_node_fs2 = require("fs");
+    import_node_path2 = require("path");
+    init_paths();
+    CONTROL_TOKEN_FILE = (0, import_node_path2.join)(PATHS.runDir, "control.token");
+  }
+});
+
 // src/core/ipc-client.ts
-var import_node_net, import_node_fs2, IpcClient;
+var import_node_net, import_node_fs3, IpcClient;
 var init_ipc_client = __esm({
   "src/core/ipc-client.ts"() {
     "use strict";
     import_node_net = require("net");
-    import_node_fs2 = require("fs");
+    import_node_fs3 = require("fs");
     init_paths();
+    init_control_token();
     IpcClient = class {
       constructor(opts = {}) {
         this.opts = opts;
@@ -3911,10 +3949,10 @@ var init_ipc_client = __esm({
       pending = /* @__PURE__ */ new Map();
       socketPath;
       static isDaemonRunning(socketPath = resolveClientSocket()) {
-        return (0, import_node_fs2.existsSync)(socketPath);
+        return (0, import_node_fs3.existsSync)(socketPath);
       }
       async connect(timeoutMs = 2e3) {
-        if (!(0, import_node_fs2.existsSync)(this.socketPath)) {
+        if (!(0, import_node_fs3.existsSync)(this.socketPath)) {
           throw new Error(`threatcrushd socket not found at ${this.socketPath}`);
         }
         return new Promise((resolve5, reject) => {
@@ -3975,7 +4013,7 @@ var init_ipc_client = __esm({
         await this.request("subscribe", { channels });
       }
       async shutdown() {
-        await this.request("shutdown");
+        await this.request("shutdown", { token: readControlToken() });
       }
       onData(chunk) {
         this.buffer += chunk;
@@ -4018,17 +4056,17 @@ var init_ipc_client = __esm({
 // src/daemon/pidfile.ts
 function writePidFile() {
   ensureRuntimeDirs();
-  (0, import_node_fs3.writeFileSync)(PATHS.pidFile, String(process.pid), "utf-8");
+  (0, import_node_fs4.writeFileSync)(PATHS.pidFile, String(process.pid), "utf-8");
 }
 function readPidFile() {
-  if (!(0, import_node_fs3.existsSync)(PATHS.pidFile)) return null;
-  const raw = (0, import_node_fs3.readFileSync)(PATHS.pidFile, "utf-8").trim();
+  if (!(0, import_node_fs4.existsSync)(PATHS.pidFile)) return null;
+  const raw = (0, import_node_fs4.readFileSync)(PATHS.pidFile, "utf-8").trim();
   const pid = parseInt(raw, 10);
   return Number.isFinite(pid) ? pid : null;
 }
 function removePidFile() {
   try {
-    if ((0, import_node_fs3.existsSync)(PATHS.pidFile)) (0, import_node_fs3.unlinkSync)(PATHS.pidFile);
+    if ((0, import_node_fs4.existsSync)(PATHS.pidFile)) (0, import_node_fs4.unlinkSync)(PATHS.pidFile);
   } catch {
   }
 }
@@ -4047,11 +4085,11 @@ function findRunningDaemon() {
   if (pid) removePidFile();
   return null;
 }
-var import_node_fs3;
+var import_node_fs4;
 var init_pidfile = __esm({
   "src/daemon/pidfile.ts"() {
     "use strict";
-    import_node_fs3 = require("fs");
+    import_node_fs4 = require("fs");
     init_paths();
   }
 });
@@ -8260,12 +8298,12 @@ var source_default = chalk;
 // src/index.ts
 var import_readline = __toESM(require("readline"));
 var import_node_child_process10 = require("child_process");
-var import_node_fs29 = require("fs");
-var import_node_path19 = require("path");
+var import_node_fs31 = require("fs");
+var import_node_path21 = require("path");
 var import_node_os8 = require("os");
 
 // src/commands/monitor.ts
-var import_node_fs4 = require("fs");
+var import_node_fs5 = require("fs");
 var import_node_readline = require("readline");
 
 // src/core/logger.ts
@@ -8473,9 +8511,9 @@ async function monitorCommand(options) {
   const unreadable = [];
   for (const s of LOG_SOURCES) {
     if (moduleFilter && !moduleFilter.includes(s.name)) continue;
-    if (!(0, import_node_fs4.existsSync)(s.path)) continue;
+    if (!(0, import_node_fs5.existsSync)(s.path)) continue;
     try {
-      (0, import_node_fs4.accessSync)(s.path, import_node_fs4.constants.R_OK);
+      (0, import_node_fs5.accessSync)(s.path, import_node_fs5.constants.R_OK);
       availableSources.push(s);
     } catch {
       unreadable.push(s);
@@ -8492,11 +8530,11 @@ async function monitorCommand(options) {
     logger.warn("No readable log files found to monitor.");
     logger.info("Available log paths checked:");
     for (const s of LOG_SOURCES) {
-      const exists = (0, import_node_fs4.existsSync)(s.path);
+      const exists = (0, import_node_fs5.existsSync)(s.path);
       let readable = false;
       if (exists) {
         try {
-          (0, import_node_fs4.accessSync)(s.path, import_node_fs4.constants.R_OK);
+          (0, import_node_fs5.accessSync)(s.path, import_node_fs5.constants.R_OK);
           readable = true;
         } catch {
           readable = false;
@@ -8528,16 +8566,16 @@ async function monitorCommand(options) {
 }
 function tailLog(source) {
   const { path, name, category } = source;
-  const stat = (0, import_node_fs4.statSync)(path);
+  const stat = (0, import_node_fs5.statSync)(path);
   let position = stat.size;
   const checkForNewData = () => {
     try {
-      const currentStat = (0, import_node_fs4.statSync)(path);
+      const currentStat = (0, import_node_fs5.statSync)(path);
       if (currentStat.size <= position) {
         if (currentStat.size < position) position = 0;
         return;
       }
-      const stream = (0, import_node_fs4.createReadStream)(path, { start: position, encoding: "utf-8" });
+      const stream = (0, import_node_fs5.createReadStream)(path, { start: position, encoding: "utf-8" });
       stream.on("error", (err) => {
         logger.warn(`stopped tailing ${path}: ${err.code || err.message}`);
         position = currentStat.size;
@@ -8639,8 +8677,8 @@ async function runDemoMode() {
 }
 
 // src/commands/scan.ts
-var import_node_fs7 = require("fs");
-var import_node_path5 = require("path");
+var import_node_fs8 = require("fs");
+var import_node_path6 = require("path");
 
 // ../../node_modules/.pnpm/ora@8.2.0/node_modules/ora/index.js
 var import_node_process7 = __toESM(require("process"), 1);
@@ -9797,7 +9835,17 @@ var NODE_RULES = [
     // arrangement of nearby lines that makes an echoed origin safe — except a
     // membership test on the value, which is what the guard looks for.
     inherent: true,
-    guard: ORIGIN_ALLOWLIST_GUARD
+    guard: ORIGIN_ALLOWLIST_GUARD,
+    /**
+     * Logging the origin is not reflecting it.
+     *
+     * `origin: request.headers.origin` is the CORS mistake *and* the ordinary
+     * way to record who called — the two are character-for-character
+     * identical, and only what encloses them differs. A response header goes
+     * out to the browser; a log line goes to stdout, where it grants nobody
+     * anything.
+     */
+    enclosingCallGuard: /(?:^|\.)(?:log|debug|info|warn|error|trace|verbose|fatal)$/
   },
   // ── Server-side request forgery ──────────────────────────────────────────
   {
@@ -9891,7 +9939,11 @@ var NODE_RULES = [
     severity: "medium",
     languages: ["javascript", "typescript"],
     pattern: /\bBuffer\s*\.\s*allocUnsafe(?:Slow)?\s*\(|\bnew\s+Buffer\s*\(\s*(?![`'"])[a-zA-Z_$0-9]/,
-    inherent: true
+    inherent: true,
+    // Filling the buffer yourself is the whole reason to call `allocUnsafe`,
+    // so reporting every call reports correct code. What is left reported is
+    // an allocation whose bytes are never written before it escapes.
+    filledBeforeUseGuard: true
   },
   {
     id: "js-oversized-request-body-limit",
@@ -10001,8 +10053,19 @@ var CODE_RULES = [
     // The tail is what distinguishes assembly from parameterisation. A bound
     // query leaves a comma after the closing quote (`"… = $1", [id]`) and
     // matches none of these.
+    //
+    // The clause alternative anchors the keyword to the *start* of the
+    // concatenated fragment, because that is where a clause being appended
+    // actually sits: `sql + "WHERE id = " + id`, `sql + " ORDER BY " + col`.
+    //
+    // Allowing it anywhere in the fragment made the rule read English. `WHERE`
+    // and `SET` are ordinary words, and without a leading `\b` they were not
+    // even required to be whole ones — "any`where`" and "sub`set`" both
+    // matched. A help string reading "lists them anywhere" was reported as
+    // critical SQL injection, which is the kind of finding that teaches a team
+    // the scanner is not worth reading.
     pattern: new RegExp(
-      `${SQL_STRING}\\s*\\+|${SQL_STRING}\\s*%\\s*[\\w(]|${SQL_STRING}\\s*\\.\\s*format\\s*\\(|\\+\\s*(?:"[^"\\n]*|'[^'\\n]*)(?:WHERE|ORDER\\s+BY|VALUES|SET)\\b`,
+      `${SQL_STRING}\\s*\\+|${SQL_STRING}\\s*%\\s*[\\w(]|${SQL_STRING}\\s*\\.\\s*format\\s*\\(|\\+\\s*(?:"|')\\s*\\b(?:WHERE|ORDER\\s+BY|VALUES|SET)\\b`,
       "i"
     )
   },
@@ -10015,7 +10078,26 @@ var CODE_RULES = [
     pattern: new RegExp(
       `\`[^\`\\n]*(?:${SQL_KEYWORDS})\\b[^\`\\n]*\\$\\{|\\bf"[^"\\n]*(?:${SQL_KEYWORDS})\\b[^"\\n]*\\{|\\bf'[^'\\n]*(?:${SQL_KEYWORDS})\\b[^'\\n]*\\{`,
       "i"
-    )
+    ),
+    /**
+     * Interpolating a column list is not interpolating a value.
+     *
+     *     const COLS = `tld, user_id, owner_email, price_usd`;
+     *     get(`SELECT ${COLS} FROM moshpit_tlds WHERE tld = ?`, [tld]);
+     *
+     * That query *is* parameterised: every value the caller supplies rides a
+     * `?`, and the only thing spliced into the text is a constant written a
+     * few lines up. Naming the column list once instead of repeating it in
+     * fourteen queries is ordinary hygiene, and it is the shape this rule met
+     * most often in practice — one repository produced eighteen findings this
+     * way and not one of them could be injected into.
+     *
+     * The guard resolves the interpolations rather than trusting the shape, so
+     * the moment a query mixes a constant with anything else —
+     * `` `SELECT ${COLS} FROM t WHERE id = ${req.query.id}` `` — it is reported
+     * again. `interpolationsAreConstant` requires *every* `${…}` to resolve.
+     */
+    constantInterpolationGuard: true
   },
   {
     id: "sql-format-call",
@@ -10046,7 +10128,8 @@ var CODE_RULES = [
     cwe: "CWE-78",
     severity: "critical",
     languages: ["javascript", "typescript"],
-    pattern: /\b(?:exec|execSync|spawn|spawnSync)\s*\(\s*(?:`[^`]*\$\{|['"][^'"]*['"]\s*\+|[a-zA-Z_$][\w$]*\s*\+)/
+    pattern: /\b(?:exec|execSync|spawn|spawnSync)\s*\(\s*(?:`[^`]*\$\{|['"][^'"]*['"]\s*\+|[a-zA-Z_$][\w$]*\s*\+)/,
+    constantInterpolationGuard: true
   },
   {
     id: "py-shell-command-string",
@@ -10064,7 +10147,22 @@ var CODE_RULES = [
     cwe: "CWE-78",
     severity: "critical",
     languages: ["go"],
-    pattern: /\bexec\.Command(?:Context)?\s*\(\s*(?:ctx\s*,\s*)?"(?:\/bin\/)?(?:sh|bash|zsh|cmd|powershell)"\s*,\s*"(?:-c|\/c)"/
+    pattern: /\bexec\.Command(?:Context)?\s*\(\s*(?:ctx\s*,\s*)?"(?:\/bin\/)?(?:sh|bash|zsh|cmd|powershell)"\s*,\s*"(?:-c|\/c)"/,
+    // A call whose whole argv is string literals cannot be injected into.
+    // `exec.Command("cmd", "/c", "ver")` reads the Windows version; there is no
+    // value in it for an attacker to reach, and the consequence above — that a
+    // shell will interpret metacharacters — describes metacharacters nobody can
+    // supply. gosec's G204 draws the line in the same place, and this was the
+    // single finding a Go project got out of a whole scan before declining the
+    // offer, which is an expensive way to report nothing.
+    //
+    // The guard has to end at the closing paren, so a literal followed by
+    // anything else still reports: `"ls " + dir` leaves a `+` before the `)`,
+    // `fmt.Sprintf(…)` leaves an identifier, and a bare variable leaves a name.
+    // `(?:[^"\\]|\\.)*` rather than `[^"]*` so an escaped quote inside a
+    // literal — `"echo \"hi\""` — does not end the literal early and drop the
+    // guard on a line it should have covered.
+    lineGuard: /\bexec\.Command(?:Context)?\s*\(\s*(?:ctx\s*,\s*)?"(?:\/bin\/)?(?:sh|bash|zsh|cmd|powershell)"\s*,\s*"(?:-c|\/c)"\s*(?:,\s*"(?:[^"\\]|\\.)*")*\s*,?\s*\)/
   },
   {
     id: "rb-backtick-interpolation",
@@ -10133,17 +10231,43 @@ var CODE_RULES = [
     cwe: "CWE-79",
     severity: "high",
     languages: ["javascript", "typescript"],
-    pattern: /\bdangerouslySetInnerHTML\s*=|\.\s*(?:innerHTML|outerHTML)\s*=\s*(?!\s*['"`]\s*['"`]\s*;?\s*$)|\bdocument\s*\.\s*write(?:ln)?\s*\(|\.\s*insertAdjacentHTML\s*\(/,
     /**
+     * The assignment alternative carries its own exemption, as a lookahead, so
+     * that it is decided per assignment rather than per line.
+     *
      * A whole-statement assignment of a string with no interpolation and no
-     * concatenation carries no data, so it cannot carry attacker data. This
-     * was the single largest source of noise: a codebase that builds its UI
-     * with innerHTML reports every static heading and spinner as XSS, and a
-     * rule that flags 40 safe lines to catch one real one gets switched off.
+     * concatenation carries no data, so it cannot carry attacker data. This was
+     * the single largest source of noise: a codebase that builds its UI with
+     * innerHTML reports every static heading and spinner as XSS, and a rule
+     * that flags 40 safe lines to catch one real one gets switched off.
      *
-     * Line-scoped on purpose — see `lineGuard`.
+     * Two things this has to get right, and a `lineGuard` could get neither:
+     *
+     * A statement ends at its semicolon, not at the newline. Anchoring to `$`
+     * held the exemption for `el.innerHTML = '';` alone on a line and dropped
+     * it the moment anything followed:
+     *
+     *     function hide() { out.hidden = true; out.innerHTML = ''; rendered = null; }
+     *
+     * — the same assignment, clearing a node, reported as high-severity XSS
+     * because two neighbours shared its line.
+     *
+     * And an exemption must not become a line-wide amnesty. A guard is tested
+     * against the whole line, so one safe clear would exonerate a real sink
+     * beside it:
+     *
+     *     a.innerHTML = ''; b.innerHTML = userInput;
+     *
+     * As a lookahead the regex decides at each `=` it reaches, so the first
+     * assignment is exempt and the second is still reported.
+     *
+     * The whitespace after `=` is matched *inside* the lookahead rather than
+     * before it. Left outside, `\s*` backtracks to zero width, the lookahead
+     * then starts on the space instead of the quote, fails to see a literal,
+     * and the negative lookahead succeeds — reinstating every finding the
+     * exemption was written to remove.
      */
-    lineGuard: /(?:innerHTML|outerHTML)\s*=\s*(?:'[^'\\]*'|"[^"\\]*"|`[^`$\\]*`)\s*;?\s*$/
+    pattern: /\bdangerouslySetInnerHTML\s*=|\.\s*(?:innerHTML|outerHTML)\s*=(?!\s*(?:'[^'\\\n]*'|"[^"\\\n]*"|`[^`$\\\n]*`)\s*(?:;|$))|\bdocument\s*\.\s*write(?:ln)?\s*\(|\.\s*insertAdjacentHTML\s*\(/
   },
   {
     id: "java-html-writer-concatenation",
@@ -10945,7 +11069,26 @@ var CODE_RULES = [
     cwe: "CWE-346",
     severity: "high",
     languages: ["javascript", "typescript"],
-    pattern: /\$\{[^}\n]*\breq(?:uest)?\s*\.\s*(?:headers\s*\.\s*host|hostname|host)\b|['"`]\s*\+\s*req(?:uest)?\s*\.\s*(?:headers\s*\.\s*host|hostname)\b/
+    pattern: /\$\{[^}\n]*\breq(?:uest)?\s*\.\s*(?:headers\s*\.\s*host|hostname|host)\b|['"`]\s*\+\s*req(?:uest)?\s*\.\s*(?:headers\s*\.\s*host|hostname)\b/,
+    /**
+     * Parsing the request's own URL is not building a link from the Host
+     * header, even though it is spelled with one.
+     *
+     *     const url = new URL(request.url, `http://${request.headers.host}`);
+     *     const token = url.searchParams.get('token');
+     *
+     * `request.url` on a Node server is a path — `/ws?token=…` — and `new URL`
+     * refuses a relative input without a base. The base exists to satisfy the
+     * parser and is thrown away; only the path and query are ever read. Every
+     * Node HTTP handler that wants a query parameter is written this way, so
+     * the rule fired on the framework idiom rather than on the defect.
+     *
+     * Narrow on purpose: the first argument must be `req.url` itself. The
+     * dangerous shape passes a *path* the application chose —
+     * `new URL('/reset?t=…', `https://${req.headers.host}`)` — and that is what
+     * produces an attacker-controlled link. It does not match this guard.
+     */
+    lineGuard: /\bnew\s+URL\s*\(\s*(?:req|request|ctx)(?:uest)?\s*\.\s*url\b\s*,/
   },
   // A recursive-merge prototype-pollution rule (`target[key] = source[key]`
   // with no `__proto__` guard) was built and dropped. The bare copy-by-key is
@@ -11013,6 +11156,94 @@ function fileTextOf(lines) {
 function withoutSingleQuoted(text) {
   return text.replace(/'[^'\n]*'/g, "''");
 }
+function calleeEndingAt(text, open) {
+  let end = open;
+  while (end > 0 && (text[end - 1] === " " || text[end - 1] === "	")) end -= 1;
+  let start = end;
+  while (start > 0 && /[\w$.]/.test(text[start - 1])) start -= 1;
+  return text.slice(start, end);
+}
+function enclosingCallees(lines, index, back) {
+  const before = lines.slice(Math.max(0, index - back), index).join("\n");
+  const stack = [];
+  let quote = null;
+  for (let i = 0; i < before.length; i += 1) {
+    const ch = before[i];
+    if (quote) {
+      if (ch === "\\") i += 1;
+      else if (ch === quote) quote = null;
+      continue;
+    }
+    if (ch === '"' || ch === "'" || ch === "`") quote = ch;
+    else if (ch === "(") stack.push(calleeEndingAt(before, i));
+    else if (ch === ")") stack.pop();
+  }
+  return stack;
+}
+function interpolations(line) {
+  const found = [];
+  for (let i = 0; ; ) {
+    const start = line.indexOf("${", i);
+    if (start === -1) break;
+    const end = line.indexOf("}", start + 2);
+    if (end === -1) return null;
+    found.push(line.slice(start + 2, end).trim());
+    i = end + 1;
+  }
+  return found.length > 0 ? found : null;
+}
+function isConstantString(name, fileText) {
+  const escaped = name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  return new RegExp(
+    `\\bconst\\s+${escaped}\\s*(?::[^=\\n]+)?=\\s*(?:'[^'\\n]*'|"[^"\\n]*"|\`[^\`$\\n]*\`)`
+  ).test(fileText);
+}
+function interpolationsAreConstant(line, fileText) {
+  const found = interpolations(line);
+  if (!found) return false;
+  return found.every(
+    (expr) => /^[A-Za-z_$][\w$]*$/.test(expr) && isConstantString(expr, fileText)
+  );
+}
+var FILL_LOOKAHEAD = 16;
+var NAME = String.raw`(?<![\w$])([A-Za-z_$][\w$]*)`;
+var ALLOCATION_BINDING = new RegExp(
+  `${NAME}\\s*=\\s*(?:new\\s+Buffer\\s*\\(|Buffer\\s*\\.\\s*allocUnsafe(?:Slow)?\\s*\\()`
+);
+function allocationBinding(line) {
+  return ALLOCATION_BINDING.exec(line)?.[1] ?? null;
+}
+var WRITE_SHAPES = [
+  // `src.copy(name, …)` — name is the destination.
+  /\.\s*copy\s*\(\s*([A-Za-z_$][\w$]*)\s*[,)]/g,
+  // `name.fill(…)`, `name.write*(…)`, `name.set(…)`.
+  new RegExp(`${NAME}\\s*\\.\\s*(?:fill|set|write[A-Za-z0-9]*)\\s*\\(`, "g"),
+  // `name[i] = …`, but not `name[i] === …`.
+  new RegExp(`${NAME}\\s*\\[[^\\]\\n]*\\]\\s*=(?!=)`, "g")
+];
+function writesInto(text, name) {
+  for (const shape of WRITE_SHAPES) {
+    shape.lastIndex = 0;
+    for (let found = shape.exec(text); found !== null; found = shape.exec(text)) {
+      if (found[1] === name) return true;
+    }
+  }
+  return false;
+}
+function bufferFilledBeforeUse(ctx) {
+  const line = ctx.lines[ctx.index] ?? "";
+  if (/\ballocUnsafe(?:Slow)?\s*\([^)\n]*\)\s*\.\s*fill\s*\(/.test(line)) return true;
+  const name = allocationBinding(line);
+  if (!name) return false;
+  if (writesInto(line.slice(line.indexOf("=") + 1), name)) return true;
+  const last = Math.min(ctx.lines.length - 1, ctx.index + FILL_LOOKAHEAD);
+  for (let i = ctx.index + 1; i <= last; i += 1) {
+    const next = ctx.lines[i] ?? "";
+    if (skippable(next, i, ctx.prose)) continue;
+    if (writesInto(next, name)) return true;
+  }
+  return false;
+}
 function evaluateRule(rule, ctx) {
   if (rule.languages && !rule.languages.includes(ctx.language)) return null;
   const line = ctx.lines[ctx.index] ?? "";
@@ -11024,6 +11255,14 @@ function evaluateRule(rule, ctx) {
   const context = windowText(ctx.lines, ctx.index, back, forward, ctx.prose);
   if (rule.requires && !rule.requires.test(context)) return null;
   if (rule.lineGuard?.test(line)) return null;
+  if (rule.enclosingCallGuard) {
+    const callees = enclosingCallees(ctx.lines, ctx.index, back);
+    if (callees.some((callee) => rule.enclosingCallGuard.test(callee))) return null;
+  }
+  if (rule.constantInterpolationGuard && interpolationsAreConstant(line, fileTextOf(ctx.lines))) {
+    return null;
+  }
+  if (rule.filledBeforeUseGuard && bufferFilledBeforeUse(ctx)) return null;
   const guard = rule.guard === void 0 ? GENERIC_GUARD : rule.guard;
   if (guard && (guard.test(line) || guard.test(context))) return null;
   const untrusted = untrustedPatternFor(ctx.language);
@@ -11606,7 +11845,8 @@ var SECRET_RULES = [
     pattern: /\beyJ[A-Za-z0-9_-]{8,}\.eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_.+/=-]*/,
     severity: "medium",
     cwe: "CWE-798",
-    consequence: "Session or service identity until it expires \u2014 and committed tokens are usually long-lived."
+    consequence: "Session or service identity until it expires \u2014 and committed tokens are usually long-lived.",
+    keywordShaped: true
   },
   {
     id: "secret-generic-api-key",
@@ -11617,7 +11857,8 @@ var SECRET_RULES = [
     pattern: /(?:api[_-]?key|apikey|access[_-]?token|auth[_-]?token)\s*[=:]\s*['"]([A-Za-z0-9\-_.]{20,})['"]/i,
     severity: "high",
     cwe: "CWE-798",
-    consequence: "Whatever the third-party service lets the key do, for as long as it stays valid."
+    consequence: "Whatever the third-party service lets the key do, for as long as it stays valid.",
+    keywordShaped: true
   },
   {
     id: "secret-generic-credential",
@@ -11625,7 +11866,8 @@ var SECRET_RULES = [
     pattern: /(?:secret|password|passwd|pwd|token)\s*[=:]\s*['"]([^'"\s]{8,})['"]/i,
     severity: "high",
     cwe: "CWE-798",
-    consequence: "A password in source is a password in every clone, fork and CI cache of that source."
+    consequence: "A password in source is a password in every clone, fork and CI cache of that source.",
+    keywordShaped: true
   },
   {
     id: "secret-hex-token",
@@ -11633,7 +11875,8 @@ var SECRET_RULES = [
     pattern: /(?:token|key|secret|auth|signing)\w*\s*[=:]\s*['"]?([0-9a-f]{32,})['"]?/i,
     severity: "medium",
     cwe: "CWE-798",
-    consequence: "Signing secrets and session keys are usually hex; a leaked one forges anything they sign."
+    consequence: "Signing secrets and session keys are usually hex; a leaked one forges anything they sign.",
+    keywordShaped: true
   }
 ];
 var KNOWN_PLACEHOLDERS = [
@@ -11664,6 +11907,62 @@ var KNOWN_PLACEHOLDERS = [
 function isKnownPlaceholder(text) {
   return KNOWN_PLACEHOLDERS.some((pattern) => pattern.test(text));
 }
+function isPlaceholderAttribute(line, value) {
+  const at = line.lastIndexOf(value);
+  if (at === -1) return false;
+  return /(?:^|\s)(?:aria-)?placeholder\s*=\s*[{("'`]*$/i.test(line.slice(0, at));
+}
+function isVariableReference(value) {
+  const trimmed = value.trim();
+  const braced = /^\$\{\s*([A-Za-z_][\w.]*)\s*(?::?[-=+?]([\s\S]*))?\}$/.exec(trimmed);
+  if (braced) {
+    const fallback2 = braced[2];
+    if (fallback2 === void 0 || fallback2.trim() === "") return true;
+    return /^\$\{?[A-Za-z_][\w.]*\}?$/.test(fallback2.trim());
+  }
+  return /^\$[A-Za-z_]\w*$/.test(trimmed) || // $VAR
+  /^\$\([\s\S]*\)$/.test(trimmed) || // $(command substitution)
+  /^%[A-Za-z_]\w*%$/.test(trimmed) || // %VAR% on Windows
+  /^\{\{[\s\S]*\}\}$/.test(trimmed) || // {{ template }}
+  /^#\{[\s\S]*\}$/.test(trimmed) || // #{ruby}
+  /^<%=?[\s\S]*%>$/.test(trimmed);
+}
+var FIXTURE_STEMS = [
+  "test",
+  "mock",
+  "fake",
+  "dummy",
+  "stub",
+  "sample",
+  "example",
+  "placeholder",
+  "fixture",
+  "invalid",
+  "expired",
+  "forged",
+  "bogus",
+  "notreal",
+  "nonexistent",
+  "changeme",
+  "foobar",
+  "lorem"
+];
+var KEY_NOISE = /* @__PURE__ */ new Set(["const", "this", "return", "await", "async", "expect", "value"]);
+function words(text) {
+  return text.replace(/([a-z0-9])([A-Z])/g, "$1 $2").replace(/[^A-Za-z]+/g, " ").toLowerCase().split(" ").filter(Boolean);
+}
+function isTestFixtureValue(line, value) {
+  const valueWords = words(value);
+  if (valueWords.some((word) => FIXTURE_STEMS.some((stem) => word.startsWith(stem)))) return true;
+  return describesItsOwnKey(line, value);
+}
+function describesItsOwnKey(line, value) {
+  if (value.length > 48) return false;
+  const valueAt = line.lastIndexOf(value);
+  const key = valueAt === -1 ? line : line.slice(0, valueAt);
+  const flattened = words(value).join("");
+  return words(key).filter((word) => word.length >= 4 && !KEY_NOISE.has(word)).some((word) => flattened.includes(word));
+}
 function redactSecret(line) {
   return line.replace(/([A-Za-z0-9+/=_.-]{12,})/g, (match) => {
     if (match.length <= 12) return match;
@@ -11841,9 +12140,9 @@ function languageOfShebang(firstLine) {
 }
 var SUPPRESS_NEXT = /threatcrush-disable-next-line(?:\s+([\w-]+))?/;
 var SUPPRESS_LINE = /threatcrush-disable-line(?:\s+([\w-]+))?/;
-var FOREIGN_CREDENTIAL = /\b(?:nolint:[\w,]*gosec|nosec)\b[^\n]*\bG101\b|\bG101\b[^\n]*\b(?:nolint:[\w,]*gosec|nosec)\b/;
-function foreignCredentialMark(line) {
-  return FOREIGN_CREDENTIAL.test(line);
+var FOREIGN_SECURITY = /\b(?:nolint:[\w,]*gosec|nosec)\b/;
+function foreignSecurityMark(line) {
+  return FOREIGN_SECURITY.test(line);
 }
 function collectSuppressions(lines) {
   const byLine = /* @__PURE__ */ new Map();
@@ -11869,31 +12168,68 @@ function isSuppressed(suppressions, index, ruleId) {
 }
 function isTestPath(relativePath) {
   const p = relativePath.replace(/\\/g, "/");
-  return /(?:^|\/)(?:tests?|__tests__|__mocks__|spec|specs|fixtures?|mocks?|e2e|testdata)\//i.test(p) || /(?:^|\/)(?:test|conftest)_[^/]+$/i.test(p) || /[._-](?:test|spec)\.[a-z]+$/i.test(p) || /_test\.[a-z]+$/i.test(p);
+  return /(?:^|\/)(?:tests?|__tests__|__mocks__|spec|specs|fixtures?|mocks?|e2e|testdata|testutils?|harness)\//i.test(p) || /(?:^|\/)(?:test|conftest)_[^/]+$/i.test(p) || /[._-](?:test|spec)\.[a-z]+$/i.test(p) || /_test\.[a-z]+$/i.test(p);
+}
+function isDocPath(relativePath) {
+  const p = relativePath.replace(/\\/g, "/");
+  return /(?:^|\/)(?:docs?|examples?|samples?)\//i.test(p) || /\.(?:md|mdx|markdown|rst|adoc)$/i.test(p);
 }
+var SOFTENING_ORDER = [
+  "suppressed",
+  "placeholder",
+  "self-describing",
+  "test",
+  "docs"
+];
+function softening(reasons) {
+  return SOFTENING_ORDER.find((reason) => reasons[reason]) ?? null;
+}
+var SECRET_SOFTENING = {
+  test: "in a test file \u2014 usually a fixture, still worth confirming it is not a live credential",
+  docs: "in documentation \u2014 usually an illustrative example, still worth confirming it is not a live credential",
+  suppressed: "on a line already marked as a false positive for another linter's security rule",
+  placeholder: "in example text an empty input field shows, not in data",
+  "self-describing": "in a value that repeats the name of the field holding it \u2014 usually a description of a credential rather than one"
+};
+var CODE_SOFTENING = {
+  test: "in a test file, where the construct is ordinary",
+  docs: "in documentation or example code, which nothing runs",
+  suppressed: "on a line another linter's security suppression already covers",
+  placeholder: "in example text rather than in data",
+  "self-describing": "in a value that describes itself"
+};
 function scanText(relativePath, text, language = languageOf(relativePath)) {
   const findings = [];
   const lines = text.split("\n");
   const suppressions = collectSuppressions(lines);
   const inTests = isTestPath(relativePath);
+  const inDocs = isDocPath(relativePath);
   lines.forEach((line, index) => {
     for (const rule of SECRET_RULES) {
       const match = rule.pattern.exec(line);
       if (!match) continue;
       if (isKnownPlaceholder(match[0])) continue;
       if (isSuppressed(suppressions, index, rule.id)) continue;
-      const marked = foreignCredentialMark(line);
+      const value = match[1] ?? match[0];
+      if (isVariableReference(value)) continue;
+      if (inTests && rule.keywordShaped && isTestFixtureValue(line, value)) continue;
+      const soft = softening({
+        test: inTests,
+        suppressed: foreignSecurityMark(line),
+        placeholder: isPlaceholderAttribute(line, value),
+        "self-describing": rule.keywordShaped === true && describesItsOwnKey(line, value)
+      });
       findings.push({
         ruleId: rule.id,
         title: rule.name,
         file: relativePath,
         line: index + 1,
-        // Reported but not blocking in tests — see isTestPath. The same goes
-        // for a line another linter's credential rule was already told about.
-        severity: inTests || marked ? "low" : rule.severity,
+        // Reported but not blocking wherever context weakens the claim — see
+        // `softening`. Never dropped: the count is the same either way.
+        severity: soft ? "low" : rule.severity,
         // A matched credential format is the finding, not a proxy for one.
         confidence: "evidence",
-        message: inTests ? `Possible ${rule.name} detected in a test file \u2014 usually a fixture, still worth confirming it is not a live credential` : marked ? `Possible ${rule.name} detected on a line already marked as a false positive for another linter's credential rule` : `Possible ${rule.name} detected`,
+        message: soft ? `Possible ${rule.name} detected ${SECRET_SOFTENING[soft]}` : `Possible ${rule.name} detected`,
         consequence: rule.consequence,
         cwe: rule.cwe,
         excerpt: redactSecret(line.trim()).slice(0, 200),
@@ -11908,14 +12244,19 @@ function scanText(relativePath, text, language = languageOf(relativePath)) {
       if (isSuppressed(suppressions, index, rule.id)) continue;
       const match = evaluateRule(rule, { lines, index, language, prose });
       if (!match) continue;
+      const soft = softening({
+        test: inTests,
+        docs: inDocs,
+        suppressed: foreignSecurityMark(lines[index] ?? "")
+      });
       findings.push({
         ruleId: rule.id,
         title: rule.title,
         file: relativePath,
         line: index + 1,
-        severity: match.severity,
+        severity: soft ? "low" : match.severity,
         confidence: match.confidence,
-        message: `${rule.title} (${rule.cwe})`,
+        message: soft ? `${rule.title} (${rule.cwe}) \u2014 ${CODE_SOFTENING[soft]}` : `${rule.title} (${rule.cwe})`,
         consequence: rule.consequence,
         cwe: rule.cwe,
         excerpt: (lines[index] ?? "").trim().slice(0, 200),
@@ -11926,14 +12267,19 @@ function scanText(relativePath, text, language = languageOf(relativePath)) {
   for (const match of evaluateTemplateRules(extensionOf(relativePath), lines)) {
     const index = match.line - 1;
     if (isSuppressed(suppressions, index, match.rule.id)) continue;
+    const soft = softening({
+      test: inTests,
+      docs: inDocs,
+      suppressed: foreignSecurityMark(lines[index] ?? "")
+    });
     findings.push({
       ruleId: match.rule.id,
       title: match.rule.title,
       file: relativePath,
       line: match.line,
-      severity: match.severity,
+      severity: soft ? "low" : match.severity,
       confidence: "pattern",
-      message: `${match.rule.title} (${match.rule.cwe})`,
+      message: soft ? `${match.rule.title} (${match.rule.cwe}) \u2014 ${CODE_SOFTENING[soft]}` : `${match.rule.title} (${match.rule.cwe})`,
       consequence: match.rule.consequence,
       cwe: match.rule.cwe,
       excerpt: (lines[index] ?? "").trim().slice(0, 200),
@@ -11965,8 +12311,8 @@ function meetsFailThreshold(findings, threshold) {
 }
 
 // ../../packages/scan/src/node/walk.ts
-var import_node_fs5 = require("fs");
-var import_node_path2 = require("path");
+var import_node_fs6 = require("fs");
+var import_node_path3 = require("path");
 function compileExcludes(patterns) {
   const matchers = patterns.map((p) => p.trim()).filter((p) => p.length > 0 && !p.startsWith("#")).map(compilePattern);
   if (matchers.length === 0) return () => false;
@@ -12037,7 +12383,7 @@ function matchPrefix(parts, segs) {
 }
 function readIgnoreFile(root) {
   try {
-    return (0, import_node_fs5.readFileSync)((0, import_node_path2.join)(root, ".threatcrushignore"), "utf-8").split("\n");
+    return (0, import_node_fs6.readFileSync)((0, import_node_path3.join)(root, ".threatcrushignore"), "utf-8").split("\n");
   } catch {
     return [];
   }
@@ -12053,16 +12399,16 @@ function scanPath(targetPath, options = {}) {
   let excluded = 0;
   const rootIsDirectory = (() => {
     try {
-      return (0, import_node_fs5.statSync)(targetPath).isDirectory();
+      return (0, import_node_fs6.statSync)(targetPath).isDirectory();
     } catch {
       return true;
     }
   })();
-  const walkRoot = rootIsDirectory ? targetPath : (0, import_node_path2.dirname)(targetPath);
+  const walkRoot = rootIsDirectory ? targetPath : (0, import_node_path3.dirname)(targetPath);
   const isExcluded = compileExcludes([...options.exclude ?? [], ...readIgnoreFile(walkRoot)]);
   const scanFile = (fullPath, filename) => {
     const relativePath = toRelative(walkRoot, fullPath);
-    const extension = (0, import_node_path2.extname)(filename).toLowerCase();
+    const extension = (0, import_node_path3.extname)(filename).toLowerCase();
     const isManifest = filename === "package.json" || filename === "requirements.txt";
     const scannable = SCAN_EXTENSIONS.has(extension) || filename.startsWith(".env");
     const mayDeclareInterpreter = !scannable && !isManifest && extension === "";
@@ -12074,26 +12420,26 @@ function scanPath(targetPath, options = {}) {
     let handle;
     let declared = null;
     try {
-      handle = (0, import_node_fs5.openSync)(fullPath, "r");
+      handle = (0, import_node_fs6.openSync)(fullPath, "r");
     } catch {
       unreadable.push(relativePath);
       return;
     }
     try {
-      if ((0, import_node_fs5.fstatSync)(handle).size > maxFileBytes) return;
+      if ((0, import_node_fs6.fstatSync)(handle).size > maxFileBytes) return;
       if (mayDeclareInterpreter) {
         const prefix = Buffer.alloc(128);
-        const read = (0, import_node_fs5.readSync)(handle, prefix, 0, prefix.length, 0);
+        const read = (0, import_node_fs6.readSync)(handle, prefix, 0, prefix.length, 0);
         declared = languageOfShebang(prefix.subarray(0, read).toString("utf-8").split("\n", 1)[0] ?? "");
         if (!declared) return;
       }
-      text = (0, import_node_fs5.readFileSync)(handle, "utf-8");
+      text = (0, import_node_fs6.readFileSync)(handle, "utf-8");
     } catch {
       unreadable.push(relativePath);
       return;
     } finally {
       try {
-        (0, import_node_fs5.closeSync)(handle);
+        (0, import_node_fs6.closeSync)(handle);
       } catch {
       }
     }
@@ -12111,13 +12457,13 @@ function scanPath(targetPath, options = {}) {
   const walk = (currentPath) => {
     let entries;
     try {
-      entries = (0, import_node_fs5.readdirSync)(currentPath, { withFileTypes: true });
+      entries = (0, import_node_fs6.readdirSync)(currentPath, { withFileTypes: true });
     } catch {
       unreadable.push(toRelative(walkRoot, currentPath));
       return;
     }
     for (const entry of entries) {
-      const fullPath = (0, import_node_path2.join)(currentPath, entry.name);
+      const fullPath = (0, import_node_path3.join)(currentPath, entry.name);
       const relativePath = toRelative(walkRoot, fullPath);
       if (entry.isDirectory()) {
         if (SKIP_DIRS.has(entry.name)) continue;
@@ -12141,7 +12487,7 @@ function scanPath(targetPath, options = {}) {
   } else if (isExcluded(toRelative(walkRoot, targetPath))) {
     excluded += 1;
   } else {
-    scanFile(targetPath, (0, import_node_path2.basename)(targetPath));
+    scanFile(targetPath, (0, import_node_path3.basename)(targetPath));
   }
   if (options.missingControls) findings.push(...controls.findings());
   const filtered = allowed ? findings.filter((f) => allowed.has(f.category)) : findings;
@@ -12173,32 +12519,37 @@ function recordSensitiveFile(filename, relativePath, sink, fileFindings) {
   }
 }
 function toRelative(base, target) {
-  const rel = (0, import_node_path2.relative)(base, target);
-  return (rel === "" ? target : rel).split(import_node_path2.sep).join("/");
+  const rel = (0, import_node_path3.relative)(base, target);
+  return (rel === "" ? target : rel).split(import_node_path3.sep).join("/");
 }
 
 // ../../packages/scan/src/node/dependencies.ts
-var import_node_fs6 = require("fs");
-var import_node_path3 = require("path");
-var LOCKFILES = [
-  { file: "package-lock.json", ecosystem: "npm" },
-  { file: "pnpm-lock.yaml", ecosystem: "npm" },
-  { file: "yarn.lock", ecosystem: "npm" },
-  { file: "requirements.txt", ecosystem: "PyPI" },
-  { file: "Pipfile.lock", ecosystem: "PyPI" }
-];
+var import_node_fs7 = require("fs");
+var import_node_path4 = require("path");
 var MAX_DEPS_PER_LOCKFILE = 50;
 async function scanDependencies(targetPath) {
   const findings = [];
-  for (const { file, ecosystem } of LOCKFILES) {
-    const lockPath = (0, import_node_path3.join)(targetPath, file);
-    if (!(0, import_node_fs6.existsSync)(lockPath)) continue;
+  for (const { file, ecosystem, parse } of LOCKFILES) {
+    const lockPath = (0, import_node_path4.join)(targetPath, file);
+    if (!(0, import_node_fs7.existsSync)(lockPath)) continue;
     let deps;
     try {
-      deps = parseDependencies(lockPath, file);
+      deps = dedupe(parse((0, import_node_fs7.readFileSync)(lockPath, "utf-8")));
     } catch {
       continue;
     }
+    if (deps.length === 0) {
+      findings.push(incompleteFinding(file, "No dependencies could be read from this lockfile."));
+      continue;
+    }
+    if (deps.length > MAX_DEPS_PER_LOCKFILE) {
+      findings.push(
+        incompleteFinding(
+          file,
+          `Only the first ${MAX_DEPS_PER_LOCKFILE} of ${deps.length} locked packages were checked against OSV.`
+        )
+      );
+    }
     for (const dep of deps.slice(0, MAX_DEPS_PER_LOCKFILE)) {
       let vulns;
       try {
@@ -12225,6 +12576,20 @@ async function scanDependencies(targetPath) {
   }
   return findings;
 }
+function incompleteFinding(file, message) {
+  return {
+    ruleId: "dependency-scan-incomplete",
+    title: "Dependency scan incomplete",
+    file,
+    line: 1,
+    severity: "low",
+    confidence: "evidence",
+    message,
+    consequence: "Advisories affecting the unchecked packages would not appear in this report.",
+    excerpt: file,
+    category: "dependency"
+  };
+}
 function severityFromCvss(score) {
   if (!score) return "medium";
   const value = Number.parseFloat(score);
@@ -12234,26 +12599,131 @@ function severityFromCvss(score) {
   if (value >= 4) return "medium";
   return "low";
 }
-function parseDependencies(lockPath, filename) {
+function dedupe(deps) {
+  const seen = /* @__PURE__ */ new Set();
+  const unique = [];
+  for (const dep of deps) {
+    const key = `${dep.name}@${dep.version}`;
+    if (seen.has(key)) continue;
+    seen.add(key);
+    unique.push(dep);
+  }
+  return unique;
+}
+function splitNameVersion(spec) {
+  const at = spec.lastIndexOf("@");
+  if (at <= 0) return null;
+  const name = spec.slice(0, at);
+  const version = spec.slice(at + 1);
+  if (!name || !version) return null;
+  return { name, version };
+}
+function exactVersion(raw) {
+  const version = raw.trim().replace(/^[=v]+/, "");
+  return /^[0-9][0-9a-zA-Z.+-]*$/.test(version) ? version : null;
+}
+function parsePackageLock(content) {
+  const lock = JSON.parse(content);
+  const packages = lock.packages ?? lock.dependencies ?? {};
+  const deps = [];
+  for (const [key, value] of Object.entries(packages)) {
+    const name = key.replace(/^.*node_modules\//, "");
+    const version = value?.version;
+    if (name && version && !name.startsWith(".")) deps.push({ name, version });
+  }
+  return deps;
+}
+function parsePnpmLock(content) {
+  const deps = [];
+  let inPackages = false;
+  for (const line of content.split("\n")) {
+    if (/^[a-zA-Z]/.test(line)) {
+      inPackages = line.startsWith("packages:");
+      continue;
+    }
+    if (!inPackages) continue;
+    const match = /^ {2}(?! )(.+):\s*$/.exec(line);
+    if (!match?.[1]) continue;
+    let key = match[1].trim().replace(/^['"]|['"]$/g, "");
+    key = key.replace(/^\//, "");
+    key = key.replace(/\(.*$/, "");
+    let name;
+    let rawVersion;
+    const slashed = /^(@?[^@]+)\/([0-9][^/]*)$/.exec(key);
+    if (slashed?.[1] && slashed[2]) {
+      name = slashed[1];
+      rawVersion = slashed[2];
+    } else {
+      const dep = splitNameVersion(key);
+      if (!dep) continue;
+      name = dep.name;
+      rawVersion = dep.version;
+    }
+    const version = exactVersion(rawVersion.replace(/_.*$/, ""));
+    if (version) deps.push({ name, version });
+  }
+  return deps;
+}
+function parseYarnLock(content) {
   const deps = [];
-  if (filename === "package-lock.json") {
-    const lock = JSON.parse((0, import_node_fs6.readFileSync)(lockPath, "utf-8"));
-    const packages = lock.packages ?? lock.dependencies ?? {};
-    for (const [key, value] of Object.entries(packages)) {
-      const name = key.replace(/^node_modules\//, "");
-      const version = value?.version;
-      if (name && version && !name.startsWith(".")) deps.push({ name, version });
+  let pendingName = null;
+  for (const line of content.split("\n")) {
+    if (line.startsWith("#") || line.trim() === "") continue;
+    if (!/^\s/.test(line)) {
+      pendingName = null;
+      const header = line.replace(/:\s*$/, "");
+      const first = header.split(",")[0]?.trim().replace(/^['"]|['"]$/g, "");
+      if (!first) continue;
+      if (!first.includes("@") || first === "__metadata") continue;
+      if (/@(?:workspace|file|link|portal|exec|patch):/.test(first)) continue;
+      const dep = splitNameVersion(first.replace(/@npm:/, "@"));
+      if (dep) pendingName = dep.name;
+      continue;
     }
-    return deps;
+    if (!pendingName) continue;
+    const version = /^\s+version:?\s+["']?([^"'\s]+)["']?\s*$/.exec(line);
+    if (!version?.[1]) continue;
+    const exact = exactVersion(version[1]);
+    if (exact) deps.push({ name: pendingName, version: exact });
+    pendingName = null;
   }
-  if (filename === "requirements.txt") {
-    for (const line of (0, import_node_fs6.readFileSync)(lockPath, "utf-8").split("\n")) {
-      const match = /^([a-zA-Z0-9_.-]+)==([0-9.]+)/.exec(line);
-      if (match?.[1] && match[2]) deps.push({ name: match[1], version: match[2] });
+  return deps;
+}
+function parsePipfileLock(content) {
+  const lock = JSON.parse(content);
+  const deps = [];
+  for (const section of ["default", "develop"]) {
+    const packages = lock[section];
+    if (!packages || typeof packages !== "object") continue;
+    for (const [name, value] of Object.entries(packages)) {
+      const version = exactVersion(String(value?.version ?? "").replace(/^==/, ""));
+      if (name && version) deps.push({ name, version });
     }
   }
   return deps;
 }
+function parseRequirementsTxt(content) {
+  const deps = [];
+  for (const raw of content.split("\n")) {
+    const line = raw.split("#")[0]?.split(";")[0]?.trim();
+    if (!line || line.startsWith("-")) continue;
+    const match = /^([a-zA-Z0-9._-]+)\s*(?:\[[^\]]*\])?\s*==\s*([^\s,]+)/.exec(line);
+    if (!match?.[1] || !match[2]) continue;
+    const version = exactVersion(match[2]);
+    if (version) deps.push({ name: match[1], version });
+  }
+  return deps;
+}
+var LOCKFILES = [
+  { file: "package-lock.json", ecosystem: "npm", parse: parsePackageLock },
+  { file: "pnpm-lock.yaml", ecosystem: "npm", parse: parsePnpmLock },
+  { file: "yarn.lock", ecosystem: "npm", parse: parseYarnLock },
+  { file: "requirements.txt", ecosystem: "PyPI", parse: parseRequirementsTxt },
+  { file: "Pipfile.lock", ecosystem: "PyPI", parse: parsePipfileLock }
+];
+var LOCKFILE_PARSERS = Object.fromEntries(
+  LOCKFILES.map((entry) => [entry.file, entry.parse])
+);
 function isValidPackageName(name) {
   return /^[@a-zA-Z0-9_.\-/]{1,214}$/.test(name);
 }
@@ -12278,12 +12748,12 @@ async function queryOsv(name, version, ecosystem) {
 }
 
 // ../../packages/scan/src/node/sarif.ts
-var import_node_crypto = require("crypto");
-var import_node_path4 = require("path");
+var import_node_crypto2 = require("crypto");
+var import_node_path5 = require("path");
 var FINGERPRINT_KEY = "threatcrush/contentHash/v1";
 function fingerprintOf(finding) {
   const content = finding.excerpt.replace(/\s+/g, " ").trim();
-  return (0, import_node_crypto.createHash)("sha256").update(`${finding.ruleId}
+  return (0, import_node_crypto2.createHash)("sha256").update(`${finding.ruleId}
 ${finding.file}
 ${content}`).digest("hex").slice(0, 32);
 }
@@ -12317,11 +12787,11 @@ function securitySeverity(severity) {
   }
 }
 function toArtifactUri(filePath, base, prefix = "", root = base) {
-  const absolute = (0, import_node_path4.isAbsolute)(filePath) ? filePath : (0, import_node_path4.resolve)(root, filePath);
-  const relativePath = (0, import_node_path4.relative)(base, absolute);
+  const absolute = (0, import_node_path5.isAbsolute)(filePath) ? filePath : (0, import_node_path5.resolve)(root, filePath);
+  const relativePath = (0, import_node_path5.relative)(base, absolute);
   const escapedOut = relativePath.startsWith("..") || relativePath === "";
   const chosen = escapedOut ? absolute : relativePath;
-  const posix = chosen.split(import_node_path4.sep).join("/").replace(/^\.\//, "");
+  const posix = chosen.split(import_node_path5.sep).join("/").replace(/^\.\//, "");
   if (!prefix || escapedOut) return posix;
   const trimmed = prefix.replace(/^\/+|\/+$/g, "");
   return trimmed ? `${trimmed}/${posix}` : posix;
@@ -12411,11 +12881,11 @@ ${finding.consequence}` : `**${finding.title}**`
 // src/commands/scan.ts
 function readVersion() {
   for (const candidate of [
-    (0, import_node_path5.join)(__dirname, "..", "package.json"),
-    (0, import_node_path5.join)(__dirname, "..", "..", "package.json")
+    (0, import_node_path6.join)(__dirname, "..", "package.json"),
+    (0, import_node_path6.join)(__dirname, "..", "..", "package.json")
   ]) {
     try {
-      return JSON.parse((0, import_node_fs7.readFileSync)(candidate, "utf-8")).version ?? "0.0.0";
+      return JSON.parse((0, import_node_fs8.readFileSync)(candidate, "utf-8")).version ?? "0.0.0";
     } catch {
     }
   }
@@ -12482,7 +12952,7 @@ async function scanCommand(targetPath, options = {}) {
   const say = machineReadable ? (line) => process.stderr.write(`${line}
 `) : (line) => process.stdout.write(`${line}
 `);
-  if (!(0, import_node_fs7.existsSync)(targetPath)) {
+  if (!(0, import_node_fs8.existsSync)(targetPath)) {
     say(source_default.red(`Scan target does not exist: ${targetPath}`));
     process.exitCode = 2;
     return failedResult(targetPath, `no such path: ${targetPath}`);
@@ -12578,7 +13048,7 @@ function emitMachineReadable(format, outcome, targetPath, options, say) {
     // and it fails silently. `--path-prefix` covers the remaining case:
     // a scan run from inside the subdirectory it is scanning.
     base: process.cwd(),
-    root: (0, import_node_path5.resolve)(outcome.root)
+    root: (0, import_node_path6.resolve)(outcome.root)
   }) : {
     tool: "threatcrush",
     version: PKG_VERSION,
@@ -12592,8 +13062,8 @@ function emitMachineReadable(format, outcome, targetPath, options, say) {
   const serialized = `${JSON.stringify(payload, null, 2)}
 `;
   if (options.output) {
-    (0, import_node_fs7.mkdirSync)((0, import_node_path5.dirname)((0, import_node_path5.resolve)(options.output)), { recursive: true });
-    (0, import_node_fs7.writeFileSync)(options.output, serialized, "utf-8");
+    (0, import_node_fs8.mkdirSync)((0, import_node_path6.dirname)((0, import_node_path6.resolve)(options.output)), { recursive: true });
+    (0, import_node_fs8.writeFileSync)(options.output, serialized, "utf-8");
     say(
       source_default.gray(
         `  ${format.toUpperCase()} written to ${options.output} (${outcome.findings.length} finding(s))`
@@ -12645,13 +13115,13 @@ function printHuman(outcome) {
 }
 
 // src/commands/init.ts
-var import_node_fs10 = require("fs");
+var import_node_fs11 = require("fs");
 var import_node_child_process = require("child_process");
 var import_node_readline3 = __toESM(require("readline"));
 
 // src/core/config.ts
-var import_node_fs8 = require("fs");
-var import_node_path6 = require("path");
+var import_node_fs9 = require("fs");
+var import_node_path7 = require("path");
 var import_toml = __toESM(require_toml());
 var DEFAULT_CONFIG_PATH = "/etc/threatcrush/threatcrushd.conf";
 var DEFAULT_CONFDIR = "/etc/threatcrush/threatcrushd.conf.d";
@@ -12677,11 +13147,11 @@ var DEFAULT_CONFIG = {
 };
 function loadConfig(configPath) {
   const path = configPath || DEFAULT_CONFIG_PATH;
-  if (!(0, import_node_fs8.existsSync)(path)) {
+  if (!(0, import_node_fs9.existsSync)(path)) {
     return { ...DEFAULT_CONFIG };
   }
   try {
-    const raw = (0, import_node_fs8.readFileSync)(path, "utf-8");
+    const raw = (0, import_node_fs9.readFileSync)(path, "utf-8");
     const parsed = import_toml.default.parse(raw);
     return {
       daemon: { ...DEFAULT_CONFIG.daemon, ...parsed.daemon },
@@ -12697,13 +13167,13 @@ function loadConfig(configPath) {
 function loadModuleConfigs(confDir) {
   const dir = confDir || DEFAULT_CONFDIR;
   const configs = /* @__PURE__ */ new Map();
-  if (!(0, import_node_fs8.existsSync)(dir)) {
+  if (!(0, import_node_fs9.existsSync)(dir)) {
     return configs;
   }
-  const files = (0, import_node_fs8.readdirSync)(dir).filter((f) => f.endsWith(".conf"));
+  const files = (0, import_node_fs9.readdirSync)(dir).filter((f) => f.endsWith(".conf"));
   for (const file of files) {
     try {
-      const raw = (0, import_node_fs8.readFileSync)((0, import_node_path6.join)(dir, file), "utf-8");
+      const raw = (0, import_node_fs9.readFileSync)((0, import_node_path7.join)(dir, file), "utf-8");
       const parsed = import_toml.default.parse(raw);
       for (const [name, config] of Object.entries(parsed)) {
         configs.set(name, config);
@@ -12732,23 +13202,23 @@ function generateModuleConfig(moduleName, defaults = {}) {
 }
 
 // src/core/cli-config.ts
-var import_node_fs9 = require("fs");
-var import_node_path7 = require("path");
+var import_node_fs10 = require("fs");
+var import_node_path8 = require("path");
 var import_node_os4 = require("os");
-var CLI_CONFIG_DIR = (0, import_node_path7.join)((0, import_node_os4.homedir)(), ".threatcrush");
-var CLI_CONFIG_PATH = (0, import_node_path7.join)(CLI_CONFIG_DIR, "config.json");
+var CLI_CONFIG_DIR = (0, import_node_path8.join)((0, import_node_os4.homedir)(), ".threatcrush");
+var CLI_CONFIG_PATH = (0, import_node_path8.join)(CLI_CONFIG_DIR, "config.json");
 function readCliConfig() {
   try {
-    return JSON.parse((0, import_node_fs9.readFileSync)(CLI_CONFIG_PATH, "utf-8"));
+    return JSON.parse((0, import_node_fs10.readFileSync)(CLI_CONFIG_PATH, "utf-8"));
   } catch {
     return {};
   }
 }
 function writeCliConfig(config) {
-  if (!(0, import_node_fs9.existsSync)(CLI_CONFIG_DIR)) (0, import_node_fs9.mkdirSync)(CLI_CONFIG_DIR, { recursive: true });
-  (0, import_node_fs9.writeFileSync)(CLI_CONFIG_PATH, JSON.stringify(config, null, 2), "utf-8");
+  if (!(0, import_node_fs10.existsSync)(CLI_CONFIG_DIR)) (0, import_node_fs10.mkdirSync)(CLI_CONFIG_DIR, { recursive: true });
+  (0, import_node_fs10.writeFileSync)(CLI_CONFIG_PATH, JSON.stringify(config, null, 2), "utf-8");
   try {
-    (0, import_node_fs9.chmodSync)(CLI_CONFIG_PATH, 384);
+    (0, import_node_fs10.chmodSync)(CLI_CONFIG_PATH, 384);
   } catch {
   }
 }
@@ -12993,7 +13463,7 @@ function binaryExists(name) {
   }
 }
 function findLogPath(paths) {
-  return paths.find((p) => (0, import_node_fs10.existsSync)(p));
+  return paths.find((p) => (0, import_node_fs11.existsSync)(p));
 }
 async function promptYesNo(question, fallback2) {
   const rl = import_node_readline3.default.createInterface({ input: process.stdin, output: process.stdout });
@@ -13109,11 +13579,11 @@ async function initCommand() {
     }
   } else {
     const spinner2 = ora({ text: "Writing configuration files...", color: "green" }).start();
-    (0, import_node_fs10.mkdirSync)(confDDir, { recursive: true });
-    (0, import_node_fs10.mkdirSync)("/var/log/threatcrush", { recursive: true });
-    (0, import_node_fs10.mkdirSync)("/var/lib/threatcrush", { recursive: true });
+    (0, import_node_fs11.mkdirSync)(confDDir, { recursive: true });
+    (0, import_node_fs11.mkdirSync)("/var/log/threatcrush", { recursive: true });
+    (0, import_node_fs11.mkdirSync)("/var/lib/threatcrush", { recursive: true });
     const mainConfig = generateDefaultConfig(detected.map((d) => d.name));
-    (0, import_node_fs10.writeFileSync)(`${configDir}/threatcrushd.conf`, mainConfig);
+    (0, import_node_fs11.writeFileSync)(`${configDir}/threatcrushd.conf`, mainConfig);
     for (const svc of detected) {
       const svcDef = SERVICES_TO_DETECT.find((s) => s.name === svc.name);
       if (!svcDef) continue;
@@ -13122,7 +13592,7 @@ async function initCommand() {
         ...svcDef.moduleConfig,
         log_path: svc.logPath || svcDef.logPaths[0]
       });
-      (0, import_node_fs10.writeFileSync)(`${confDDir}/${modName}.conf`, modConfig);
+      (0, import_node_fs11.writeFileSync)(`${confDDir}/${modName}.conf`, modConfig);
     }
     spinner2.succeed("Configuration written successfully");
     console.log();
@@ -13140,8 +13610,8 @@ async function initCommand() {
 }
 function checkWriteAccess(dir) {
   try {
-    if (!(0, import_node_fs10.existsSync)(dir)) {
-      (0, import_node_fs10.mkdirSync)(dir, { recursive: true });
+    if (!(0, import_node_fs11.existsSync)(dir)) {
+      (0, import_node_fs11.mkdirSync)(dir, { recursive: true });
     }
     return true;
   } catch {
@@ -13150,8 +13620,8 @@ function checkWriteAccess(dir) {
 }
 
 // src/core/module-loader.ts
-var import_node_fs11 = require("fs");
-var import_node_path8 = require("path");
+var import_node_fs12 = require("fs");
+var import_node_path9 = require("path");
 var import_toml2 = __toESM(require_toml());
 init_paths();
 function discoverModules(moduleDir, confDir) {
@@ -13159,22 +13629,22 @@ function discoverModules(moduleDir, confDir) {
   const configs = loadModuleConfigs(confDir || PATHS.confD);
   const searchPaths = [
     moduleDir || PATHS.moduleDir,
-    (0, import_node_path8.resolve)(process.cwd(), "modules")
+    (0, import_node_path9.resolve)(process.cwd(), "modules")
   ];
-  const builtinDir = (0, import_node_path8.resolve)(__dirname || ".", "..", "modules");
-  if ((0, import_node_fs11.existsSync)(builtinDir)) {
+  const builtinDir = (0, import_node_path9.resolve)(__dirname || ".", "..", "modules");
+  if ((0, import_node_fs12.existsSync)(builtinDir)) {
     searchPaths.push(builtinDir);
   }
   for (const basePath of searchPaths) {
-    if (!(0, import_node_fs11.existsSync)(basePath)) continue;
-    const entries = (0, import_node_fs11.readdirSync)(basePath, { withFileTypes: true });
+    if (!(0, import_node_fs12.existsSync)(basePath)) continue;
+    const entries = (0, import_node_fs12.readdirSync)(basePath, { withFileTypes: true });
     for (const entry of entries) {
       if (!entry.isDirectory()) continue;
-      const modPath = (0, import_node_path8.join)(basePath, entry.name);
-      const manifestPath = (0, import_node_path8.join)(modPath, "mod.toml");
-      if (!(0, import_node_fs11.existsSync)(manifestPath)) continue;
+      const modPath = (0, import_node_path9.join)(basePath, entry.name);
+      const manifestPath = (0, import_node_path9.join)(modPath, "mod.toml");
+      if (!(0, import_node_fs12.existsSync)(manifestPath)) continue;
       try {
-        const raw = (0, import_node_fs11.readFileSync)(manifestPath, "utf-8");
+        const raw = (0, import_node_fs12.readFileSync)(manifestPath, "utf-8");
         const manifest = import_toml2.default.parse(raw);
         const config = configs.get(manifest.module.name) || { enabled: true };
         modules.push({
@@ -13293,11 +13763,163 @@ function formatUptime(seconds) {
 
 // src/commands/modules.ts
 var import_node_child_process2 = require("child_process");
-var import_node_fs12 = require("fs");
-var import_node_path9 = require("path");
+var import_node_fs14 = require("fs");
+var import_node_path11 = require("path");
 var import_toml3 = __toESM(require_toml());
 init_paths();
 init_pidfile();
+
+// src/daemon/module-trust.ts
+var import_node_crypto3 = require("crypto");
+var import_node_fs13 = require("fs");
+var import_node_path10 = require("path");
+init_paths();
+var TRUST_FILE = (0, import_node_path10.join)(PATHS.configDir, "trusted-modules.json");
+var PUBLISHER_KEYS_FILE = (0, import_node_path10.join)(PATHS.configDir, "publisher-keys.json");
+var DIGEST_EXCLUDED_DIRS = /* @__PURE__ */ new Set([".git"]);
+function collectFiles(root, dir = root, out = []) {
+  for (const entry of (0, import_node_fs13.readdirSync)(dir, { withFileTypes: true }).sort(
+    (a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0
+  )) {
+    const full = (0, import_node_path10.join)(dir, entry.name);
+    if (entry.isSymbolicLink()) {
+      out.push({ path: full, isSymlink: true });
+    } else if (entry.isDirectory()) {
+      if (DIGEST_EXCLUDED_DIRS.has(entry.name)) continue;
+      collectFiles(root, full, out);
+    } else if (entry.isFile()) {
+      out.push({ path: full, isSymlink: false });
+    }
+  }
+  return out;
+}
+function computeModuleDigest(modulePath) {
+  const hash = (0, import_node_crypto3.createHash)("sha256");
+  for (const entry of collectFiles(modulePath)) {
+    const relPath = (0, import_node_path10.relative)(modulePath, entry.path).split(import_node_path10.sep).join("/");
+    hash.update(relPath);
+    hash.update("\0");
+    if (entry.isSymlink) {
+      hash.update("symlink:");
+      hash.update((0, import_node_fs13.readlinkSync)(entry.path));
+    } else {
+      hash.update("file:");
+      hash.update((0, import_node_fs13.readFileSync)(entry.path));
+    }
+    hash.update("\0");
+  }
+  return hash.digest("hex");
+}
+function readTrustFile() {
+  if (!(0, import_node_fs13.existsSync)(TRUST_FILE)) return { version: 1, modules: {} };
+  try {
+    const parsed = JSON.parse((0, import_node_fs13.readFileSync)(TRUST_FILE, "utf-8"));
+    if (parsed.version !== 1 || typeof parsed.modules !== "object" || !parsed.modules) {
+      return { version: 1, modules: {} };
+    }
+    return { version: 1, modules: parsed.modules };
+  } catch {
+    return { version: 1, modules: {} };
+  }
+}
+function writeTrustFile(file) {
+  (0, import_node_fs13.writeFileSync)(TRUST_FILE, JSON.stringify(file, null, 2) + "\n", { mode: 384 });
+  try {
+    (0, import_node_fs13.chmodSync)(TRUST_FILE, 384);
+  } catch {
+  }
+}
+function trustModule(name, modulePath, source) {
+  const file = readTrustFile();
+  const record = {
+    digest: computeModuleDigest(modulePath),
+    trustedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    source
+  };
+  file.modules[name] = record;
+  writeTrustFile(file);
+  return record;
+}
+function untrustModule(name) {
+  const file = readTrustFile();
+  if (!file.modules[name]) return false;
+  delete file.modules[name];
+  writeTrustFile(file);
+  return true;
+}
+function listTrustedModules() {
+  return readTrustFile().modules;
+}
+function readPublisherKeys() {
+  if (!(0, import_node_fs13.existsSync)(PUBLISHER_KEYS_FILE)) return {};
+  try {
+    const parsed = JSON.parse((0, import_node_fs13.readFileSync)(PUBLISHER_KEYS_FILE, "utf-8"));
+    return parsed && typeof parsed === "object" ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+function verifyModuleSignature(modulePath, digest) {
+  const keys = readPublisherKeys();
+  const pinnedKeyIds = Object.keys(keys);
+  const sigPath = (0, import_node_path10.join)(modulePath, "mod.sig");
+  if (pinnedKeyIds.length === 0) {
+    return { ok: true };
+  }
+  if (!(0, import_node_fs13.existsSync)(sigPath)) {
+    return { ok: false, reason: "publisher keys are pinned but the module ships no mod.sig" };
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse((0, import_node_fs13.readFileSync)(sigPath, "utf-8"));
+  } catch {
+    return { ok: false, reason: "mod.sig is not valid JSON" };
+  }
+  if (!parsed.keyId || !parsed.signature) {
+    return { ok: false, reason: "mod.sig is missing keyId or signature" };
+  }
+  const publicKey = keys[parsed.keyId];
+  if (!publicKey) {
+    return { ok: false, reason: `mod.sig references unpinned key "${parsed.keyId}"` };
+  }
+  try {
+    const valid = (0, import_node_crypto3.verify)(
+      null,
+      Buffer.from(digest, "hex"),
+      publicKey,
+      Buffer.from(parsed.signature, "base64")
+    );
+    return valid ? { ok: true } : { ok: false, reason: "mod.sig signature does not match" };
+  } catch (err) {
+    return { ok: false, reason: `signature check failed: ${String(err.message || err)}` };
+  }
+}
+function verifyModuleTrust(name, modulePath) {
+  let digest;
+  try {
+    digest = computeModuleDigest(modulePath);
+  } catch (err) {
+    return { ok: false, reason: `could not hash module: ${String(err.message || err)}` };
+  }
+  const signature = verifyModuleSignature(modulePath, digest);
+  if (!signature.ok) return signature;
+  const record = readTrustFile().modules[name];
+  if (!record) {
+    return {
+      ok: false,
+      reason: `not trusted \u2014 review it, then run: threatcrush modules trust ${name}`
+    };
+  }
+  if (record.digest !== digest) {
+    return {
+      ok: false,
+      reason: `contents changed since it was trusted on ${record.trustedAt} \u2014 re-review it, then run: threatcrush modules trust ${name}`
+    };
+  }
+  return { ok: true };
+}
+
+// src/commands/modules.ts
 var API_URL2 = process.env.THREATCRUSH_API_URL || "https://threatcrush.com";
 function modulesDir() {
   ensureRuntimeDirs();
@@ -13310,7 +13932,7 @@ function safeModuleDirName(name, label = "module name") {
   return name;
 }
 function moduleDestination(dir, name, label) {
-  return (0, import_node_path9.join)(dir, safeModuleDirName(name, label));
+  return (0, import_node_path11.join)(dir, safeModuleDirName(name, label));
 }
 function assertSafeTarballEntries(tarPath) {
   const listing = (0, import_node_child_process2.execFileSync)("tar", ["-tzf", tarPath], { encoding: "utf-8" });
@@ -13323,12 +13945,12 @@ function assertSafeTarballEntries(tarPath) {
   }
 }
 function validateManifest(modPath) {
-  const manifestPath = (0, import_node_path9.join)(modPath, "mod.toml");
-  if (!(0, import_node_fs12.existsSync)(manifestPath)) {
+  const manifestPath = (0, import_node_path11.join)(modPath, "mod.toml");
+  if (!(0, import_node_fs14.existsSync)(manifestPath)) {
     return { ok: false, error: `mod.toml not found at ${manifestPath}` };
   }
   try {
-    const raw = (0, import_node_fs12.readFileSync)(manifestPath, "utf-8");
+    const raw = (0, import_node_fs14.readFileSync)(manifestPath, "utf-8");
     const parsed = import_toml3.default.parse(raw);
     const name = parsed.module?.name;
     const version = parsed.module?.version;
@@ -13339,6 +13961,12 @@ function validateManifest(modPath) {
     return { ok: false, error: `Invalid mod.toml: ${err.message}` };
   }
 }
+function printTrustRequired(name) {
+  console.log();
+  console.log(source_default.yellow(`  ! ${name} is installed but NOT trusted, so threatcrushd will not load it.`));
+  console.log(source_default.dim("    Review the module source, then run:"));
+  console.log(source_default.dim(`      ${source_default.white(`threatcrush modules trust ${name}`)}`));
+}
 function notifyDaemonIfRunning() {
   if (!findRunningDaemon()) return;
   console.log(source_default.dim(`  \u2139 threatcrushd is running \u2014 restart it to load/unload modules:`));
@@ -13382,8 +14010,8 @@ async function modulesInstallCommand(source) {
   console.log();
   const dir = modulesDir();
   if (source.startsWith("./") || source.startsWith("/") || source.startsWith("~")) {
-    const absPath = (0, import_node_path9.resolve)(source.startsWith("~") ? source.replace("~", process.env.HOME || "") : source);
-    if (!(0, import_node_fs12.existsSync)(absPath)) {
+    const absPath = (0, import_node_path11.resolve)(source.startsWith("~") ? source.replace("~", process.env.HOME || "") : source);
+    if (!(0, import_node_fs14.existsSync)(absPath)) {
       console.log(source_default.red(`  \u2717 Path not found: ${absPath}
 `));
       return;
@@ -13402,7 +14030,7 @@ async function modulesInstallCommand(source) {
 `));
       return;
     }
-    if ((0, import_node_fs12.existsSync)(dest2)) {
+    if ((0, import_node_fs14.existsSync)(dest2)) {
       console.log(source_default.yellow(`  ! ${check.name} is already installed at ${dest2}`));
       console.log(source_default.dim(`    Run ${source_default.white(`threatcrush modules remove ${check.name}`)} first.
 `));
@@ -13410,12 +14038,13 @@ async function modulesInstallCommand(source) {
     }
     const spinner2 = ora({ text: `Copying module files...`, color: "green" }).start();
     try {
-      (0, import_node_fs12.cpSync)(absPath, dest2, { recursive: true, dereference: true });
+      (0, import_node_fs14.cpSync)(absPath, dest2, { recursive: true, dereference: true });
       spinner2.succeed(`Installed ${source_default.white(check.name)} v${check.version} \u2192 ${dest2}`);
     } catch (err) {
       spinner2.fail(`Copy failed: ${err.message}`);
       return;
     }
+    printTrustRequired(check.name);
     notifyDaemonIfRunning();
     console.log();
     return;
@@ -13425,14 +14054,14 @@ async function modulesInstallCommand(source) {
     let name;
     let dest2;
     try {
-      name = safeModuleDirName((0, import_node_path9.basename)(gitUrl.replace(/\.git$/, "")), "repository name");
+      name = safeModuleDirName((0, import_node_path11.basename)(gitUrl.replace(/\.git$/, "")), "repository name");
       dest2 = moduleDestination(dir, name);
     } catch (err) {
       console.log(source_default.red(`  x ${err.message}
 `));
       return;
     }
-    if ((0, import_node_fs12.existsSync)(dest2)) {
+    if ((0, import_node_fs14.existsSync)(dest2)) {
       console.log(source_default.yellow(`  ! ${name} is already installed at ${dest2}`));
       console.log(source_default.dim(`    Run ${source_default.white(`threatcrush modules remove ${name}`)} first.
 `));
@@ -13449,12 +14078,13 @@ async function modulesInstallCommand(source) {
     if (!check.ok) {
       spinner2.fail(check.error);
       try {
-        (0, import_node_fs12.rmSync)(dest2, { recursive: true, force: true });
+        (0, import_node_fs14.rmSync)(dest2, { recursive: true, force: true });
       } catch {
       }
       return;
     }
     spinner2.succeed(`Installed ${source_default.white(check.name)} v${check.version} \u2192 ${dest2}`);
+    printTrustRequired(check.name);
     notifyDaemonIfRunning();
     console.log();
     return;
@@ -13494,7 +14124,7 @@ async function modulesInstallCommand(source) {
 `));
     return;
   }
-  if ((0, import_node_fs12.existsSync)(dest)) {
+  if ((0, import_node_fs14.existsSync)(dest)) {
     console.log(source_default.yellow(`  ! ${mod.slug} is already installed at ${dest}
 `));
     return;
@@ -13520,7 +14150,7 @@ async function modulesInstallCommand(source) {
     if (!check.ok) {
       cloneSpinner.fail(check.error);
       try {
-        (0, import_node_fs12.rmSync)(dest, { recursive: true, force: true });
+        (0, import_node_fs14.rmSync)(dest, { recursive: true, force: true });
       } catch {
       }
       return;
@@ -13534,11 +14164,11 @@ async function modulesInstallCommand(source) {
         dlSpinner.fail(`HTTP ${res.status}`);
         return;
       }
-      const tar = (0, import_node_path9.join)(dir, `${mod.slug}.tar.gz`);
-      (0, import_node_fs12.writeFileSync)(tar, Buffer.from(await res.arrayBuffer()));
+      const tar = (0, import_node_path11.join)(dir, `${mod.slug}.tar.gz`);
+      (0, import_node_fs14.writeFileSync)(tar, Buffer.from(await res.arrayBuffer()));
       assertSafeTarballEntries(tar);
       (0, import_node_child_process2.execFileSync)("tar", ["-xzf", tar, "-C", dir], { stdio: "pipe" });
-      (0, import_node_fs12.rmSync)(tar, { force: true });
+      (0, import_node_fs14.rmSync)(tar, { force: true });
       const check = validateManifest(dest);
       if (!check.ok) {
         dlSpinner.fail(check.error);
@@ -13553,6 +14183,7 @@ async function modulesInstallCommand(source) {
     logger.info("No installable artifact provided for this module.");
     return;
   }
+  printTrustRequired(mod.slug);
   notifyDaemonIfRunning();
   console.log();
 }
@@ -13569,7 +14200,7 @@ async function modulesRemoveCommand(name) {
 `));
     return;
   }
-  if (!(0, import_node_fs12.existsSync)(target)) {
+  if (!(0, import_node_fs14.existsSync)(target)) {
     console.log(source_default.yellow(`  ! No module named "${name}" in ${dir}
 `));
     return;
@@ -13579,7 +14210,8 @@ async function modulesRemoveCommand(name) {
     console.log(source_default.yellow(`  ! Directory name "${name}" does not match manifest name "${check.name}"`));
   }
   try {
-    (0, import_node_fs12.rmSync)(target, { recursive: true, force: true });
+    (0, import_node_fs14.rmSync)(target, { recursive: true, force: true });
+    untrustModule(name);
     console.log(source_default.green(`  \u2713 Removed ${name} from ${dir}
 `));
   } catch (err) {
@@ -13589,6 +14221,72 @@ async function modulesRemoveCommand(name) {
   }
   notifyDaemonIfRunning();
 }
+async function modulesTrustCommand(name) {
+  banner();
+  console.log(source_default.green.bold("  Trust Module"));
+  console.log(source_default.gray("  " + "\u2500".repeat(50)));
+  console.log();
+  const dir = modulesDir();
+  let target;
+  try {
+    target = moduleDestination(dir, name);
+  } catch (err) {
+    console.log(source_default.red(`  x ${err.message}
+`));
+    return;
+  }
+  if (!(0, import_node_fs14.existsSync)(target)) {
+    console.log(source_default.yellow(`  ! No module named "${name}" in ${dir}
+`));
+    return;
+  }
+  const check = validateManifest(target);
+  if (!check.ok) {
+    console.log(source_default.red(`  \u2717 ${check.error}
+`));
+    return;
+  }
+  const record = trustModule(name, target, target);
+  console.log(source_default.green(`  \u2713 Trusted ${source_default.white(name)} v${check.version}`));
+  console.log(source_default.dim(`    digest ${record.digest.slice(0, 16)}\u2026`));
+  console.log(
+    source_default.dim("    threatcrushd will refuse to load it again if its contents change.\n")
+  );
+  notifyDaemonIfRunning();
+}
+async function modulesUntrustCommand(name) {
+  banner();
+  console.log(source_default.green.bold("  Revoke Module Trust"));
+  console.log(source_default.gray("  " + "\u2500".repeat(50)));
+  console.log();
+  if (untrustModule(name)) {
+    console.log(source_default.green(`  \u2713 Revoked trust for ${source_default.white(name)}
+`));
+    notifyDaemonIfRunning();
+  } else {
+    console.log(source_default.yellow(`  ! ${name} was not trusted
+`));
+  }
+}
+async function modulesTrustedCommand() {
+  banner();
+  console.log(source_default.green.bold("  Trusted Modules"));
+  console.log(source_default.gray("  " + "\u2500".repeat(50)));
+  console.log();
+  const trusted = Object.entries(listTrustedModules());
+  if (trusted.length === 0) {
+    console.log(source_default.yellow("  No modules are trusted."));
+    console.log(source_default.dim("  Installed modules stay dormant until you run:"));
+    console.log(source_default.dim(`    ${source_default.white("threatcrush modules trust <name>")}
+`));
+    return;
+  }
+  for (const [name, record] of trusted) {
+    console.log(`  ${source_default.white(name)}  ${source_default.dim(record.digest.slice(0, 16) + "\u2026")}`);
+    console.log(source_default.dim(`    trusted ${record.trustedAt}`));
+  }
+  console.log();
+}
 async function modulesCommand(opts) {
   const action = opts.action || "list";
   switch (action) {
@@ -13622,10 +14320,31 @@ async function modulesCommand(opts) {
       }
       await modulesRemoveCommand(opts.name);
       break;
+    case "trust":
+      if (!opts.name) {
+        banner();
+        console.log(source_default.red("  Module name required."));
+        console.log(source_default.gray("  Usage: threatcrush modules trust <name>\n"));
+        return;
+      }
+      await modulesTrustCommand(opts.name);
+      break;
+    case "untrust":
+      if (!opts.name) {
+        banner();
+        console.log(source_default.red("  Module name required."));
+        console.log(source_default.gray("  Usage: threatcrush modules untrust <name>\n"));
+        return;
+      }
+      await modulesUntrustCommand(opts.name);
+      break;
+    case "trusted":
+      await modulesTrustedCommand();
+      break;
     default:
       banner();
       console.log(source_default.yellow(`  Unknown action: ${action}`));
-      console.log(source_default.gray("  Available actions: list, install, remove\n"));
+      console.log(source_default.gray("  Available actions: list, install, remove, trust, untrust, trusted\n"));
       await modulesListCommand();
       break;
   }
@@ -13952,21 +14671,21 @@ async function pentestCommand(targetUrl) {
 
 // src/commands/orgs.ts
 var import_node_os5 = require("os");
-var import_node_fs13 = require("fs");
-var import_node_path10 = require("path");
+var import_node_fs15 = require("fs");
+var import_node_path12 = require("path");
 var API_URL3 = process.env.THREATCRUSH_API_URL || "https://threatcrush.com";
-var CONFIG_PATH = (0, import_node_path10.join)((0, import_node_os5.homedir)(), ".threatcrush", "config.json");
+var CONFIG_PATH = (0, import_node_path12.join)((0, import_node_os5.homedir)(), ".threatcrush", "config.json");
 function readConfig() {
   try {
-    return JSON.parse((0, import_node_fs13.readFileSync)(CONFIG_PATH, "utf-8"));
+    return JSON.parse((0, import_node_fs15.readFileSync)(CONFIG_PATH, "utf-8"));
   } catch {
     return {};
   }
 }
 function writeConfig(config) {
-  const dir = (0, import_node_path10.join)((0, import_node_os5.homedir)(), ".threatcrush");
-  if (!(0, import_node_fs13.existsSync)(dir)) (0, import_node_fs13.mkdirSync)(dir, { recursive: true });
-  (0, import_node_fs13.writeFileSync)(CONFIG_PATH, JSON.stringify(config, null, 2));
+  const dir = (0, import_node_path12.join)((0, import_node_os5.homedir)(), ".threatcrush");
+  if (!(0, import_node_fs15.existsSync)(dir)) (0, import_node_fs15.mkdirSync)(dir, { recursive: true });
+  (0, import_node_fs15.writeFileSync)(CONFIG_PATH, JSON.stringify(config, null, 2));
 }
 function getAuthHeaders() {
   const config = readConfig();
@@ -14102,13 +14821,13 @@ async function useOrganization(slug) {
 
 // src/commands/servers.ts
 var import_node_os6 = require("os");
-var import_node_fs14 = require("fs");
-var import_node_path11 = require("path");
+var import_node_fs16 = require("fs");
+var import_node_path13 = require("path");
 var API_URL4 = process.env.THREATCRUSH_API_URL || "https://threatcrush.com";
-var CONFIG_PATH2 = (0, import_node_path11.join)((0, import_node_os6.homedir)(), ".threatcrush", "config.json");
+var CONFIG_PATH2 = (0, import_node_path13.join)((0, import_node_os6.homedir)(), ".threatcrush", "config.json");
 function readConfig2() {
   try {
-    return JSON.parse((0, import_node_fs14.readFileSync)(CONFIG_PATH2, "utf-8"));
+    return JSON.parse((0, import_node_fs16.readFileSync)(CONFIG_PATH2, "utf-8"));
   } catch {
     return {};
   }
@@ -14211,14 +14930,14 @@ function timeAgo(dateStr) {
 
 // src/commands/connect.ts
 var import_node_os7 = require("os");
-var import_node_fs15 = require("fs");
-var import_node_path12 = require("path");
+var import_node_fs17 = require("fs");
+var import_node_path14 = require("path");
 var import_node_child_process3 = require("child_process");
 var API_URL5 = process.env.THREATCRUSH_API_URL || "https://threatcrush.com";
-var CONFIG_PATH3 = (0, import_node_path12.join)((0, import_node_os7.homedir)(), ".threatcrush", "config.json");
+var CONFIG_PATH3 = (0, import_node_path14.join)((0, import_node_os7.homedir)(), ".threatcrush", "config.json");
 function readConfig3() {
   try {
-    return JSON.parse((0, import_node_fs15.readFileSync)(CONFIG_PATH3, "utf-8"));
+    return JSON.parse((0, import_node_fs17.readFileSync)(CONFIG_PATH3, "utf-8"));
   } catch {
     return {};
   }
@@ -14373,20 +15092,21 @@ async function sshConnect(options) {
 
 // src/commands/daemon.ts
 var import_node_child_process7 = require("child_process");
-var import_node_fs24 = require("fs");
-var import_node_path16 = require("path");
-var import_node_fs25 = require("fs");
+var import_node_fs26 = require("fs");
+var import_node_path18 = require("path");
+var import_node_fs27 = require("fs");
 
 // src/daemon/index.ts
-var import_node_fs23 = require("fs");
-var import_node_path15 = require("path");
+var import_node_fs25 = require("fs");
+var import_node_path17 = require("path");
 init_paths();
 init_pidfile();
 
 // src/daemon/ipc-server.ts
 var import_node_net2 = require("net");
-var import_node_fs16 = require("fs");
+var import_node_fs18 = require("fs");
 init_paths();
+init_control_token();
 
 // src/daemon/event-bus.ts
 var import_node_events = require("events");
@@ -14431,10 +15151,12 @@ var IpcServer = class {
   nextClientId = 1;
   startedAt = /* @__PURE__ */ new Date();
   counters = { events: 0, threats: 0, alerts: 0 };
+  controlToken = "";
   async start() {
-    if ((0, import_node_fs16.existsSync)(PATHS.socket)) {
+    this.controlToken = issueControlToken();
+    if ((0, import_node_fs18.existsSync)(PATHS.socket)) {
       try {
-        (0, import_node_fs16.unlinkSync)(PATHS.socket);
+        (0, import_node_fs18.unlinkSync)(PATHS.socket);
       } catch {
       }
     }
@@ -14470,14 +15192,14 @@ var IpcServer = class {
     return new Promise((resolve5) => {
       if (!this.server) {
         try {
-          if ((0, import_node_fs16.existsSync)(PATHS.socket)) (0, import_node_fs16.unlinkSync)(PATHS.socket);
+          if ((0, import_node_fs18.existsSync)(PATHS.socket)) (0, import_node_fs18.unlinkSync)(PATHS.socket);
         } catch {
         }
         return resolve5();
       }
       this.server.close(() => {
         try {
-          if ((0, import_node_fs16.existsSync)(PATHS.socket)) (0, import_node_fs16.unlinkSync)(PATHS.socket);
+          if ((0, import_node_fs18.existsSync)(PATHS.socket)) (0, import_node_fs18.unlinkSync)(PATHS.socket);
         } catch {
         }
         resolve5();
@@ -14563,6 +15285,13 @@ var IpcServer = class {
         for (const ch of req.params.channels) client.subscriptions.add(ch);
         return this.send(client, { id: req.id, ok: true, result: { subscribed: [...client.subscriptions] } });
       case "shutdown":
+        if (!tokensMatch(this.controlToken, req.params?.token)) {
+          return this.send(client, {
+            id: req.id,
+            ok: false,
+            error: "shutdown requires the daemon control token (run as root, or use systemctl)"
+          });
+        }
         this.send(client, { id: req.id, ok: true, result: "shutting down" });
         setTimeout(() => process.emit("SIGTERM"), 50);
         return;
@@ -14583,14 +15312,14 @@ var IpcServer = class {
 };
 
 // src/daemon/module-host.ts
-var import_node_fs20 = require("fs");
-var import_node_path13 = require("path");
+var import_node_fs22 = require("fs");
+var import_node_path15 = require("path");
 var import_node_url = require("url");
 var import_toml4 = __toESM(require_toml());
 init_paths();
 
 // src/daemon/watchers/log-watcher.ts
-var import_node_fs17 = require("fs");
+var import_node_fs19 = require("fs");
 var import_node_readline4 = require("readline");
 init_state();
 var DEFAULT_SOURCES = [
@@ -14612,9 +15341,9 @@ var LogWatcher = class {
   start() {
     const started = [];
     for (const src of this.sources) {
-      if (!(0, import_node_fs17.existsSync)(src.path)) continue;
+      if (!(0, import_node_fs19.existsSync)(src.path)) continue;
       try {
-        (0, import_node_fs17.accessSync)(src.path, import_node_fs17.constants.R_OK);
+        (0, import_node_fs19.accessSync)(src.path, import_node_fs19.constants.R_OK);
       } catch {
         continue;
       }
@@ -14634,7 +15363,7 @@ var LogWatcher = class {
   }
   tail(src) {
     try {
-      this.positions.set(src.path, (0, import_node_fs17.statSync)(src.path).size);
+      this.positions.set(src.path, (0, import_node_fs19.statSync)(src.path).size);
     } catch {
       this.positions.set(src.path, 0);
     }
@@ -14645,7 +15374,7 @@ var LogWatcher = class {
   poll(src) {
     let stat;
     try {
-      stat = (0, import_node_fs17.statSync)(src.path);
+      stat = (0, import_node_fs19.statSync)(src.path);
     } catch {
       return;
     }
@@ -14655,7 +15384,7 @@ var LogWatcher = class {
       return;
     }
     if (stat.size === prev) return;
-    const stream = (0, import_node_fs17.createReadStream)(src.path, { start: prev, encoding: "utf-8" });
+    const stream = (0, import_node_fs19.createReadStream)(src.path, { start: prev, encoding: "utf-8" });
     stream.on("error", () => this.positions.set(src.path, stat.size));
     const rl = (0, import_node_readline4.createInterface)({ input: stream });
     rl.on("error", () => {
@@ -14848,7 +15577,7 @@ function realtimeToDate(rt) {
 
 // src/modules/network-monitor/index.ts
 var import_node_child_process5 = require("child_process");
-var import_node_fs18 = require("fs");
+var import_node_fs20 = require("fs");
 init_state();
 var NetworkMonitor = class {
   constructor(bus2) {
@@ -14887,7 +15616,7 @@ var NetworkMonitor = class {
   hasConntrackOrSs() {
     const ss = (0, import_node_child_process5.spawnSync)("ss", ["--version"], { stdio: "pipe" });
     if (ss.status === 0) return true;
-    return (0, import_node_fs18.existsSync)("/proc/net/tcp");
+    return (0, import_node_fs20.existsSync)("/proc/net/tcp");
   }
   poll() {
     try {
@@ -15026,7 +15755,7 @@ var NetworkMonitor = class {
 };
 
 // src/modules/dns-monitor/index.ts
-var import_node_fs19 = require("fs");
+var import_node_fs21 = require("fs");
 var import_node_readline5 = require("readline");
 init_state();
 var DNS_LOG_SOURCES = [
@@ -15061,9 +15790,9 @@ var DnsMonitor = class {
   entropyThreshold = 3.5;
   start() {
     const sources = DNS_LOG_SOURCES.filter((p) => {
-      if (!(0, import_node_fs19.existsSync)(p)) return false;
+      if (!(0, import_node_fs21.existsSync)(p)) return false;
       try {
-        (0, import_node_fs19.accessSync)(p, import_node_fs19.constants.R_OK);
+        (0, import_node_fs21.accessSync)(p, import_node_fs21.constants.R_OK);
         return true;
       } catch {
         return false;
@@ -15087,7 +15816,7 @@ var DnsMonitor = class {
   }
   tailLog(path) {
     try {
-      this.positions.set(path, (0, import_node_fs19.statSync)(path).size);
+      this.positions.set(path, (0, import_node_fs21.statSync)(path).size);
     } catch {
       this.positions.set(path, 0);
     }
@@ -15097,7 +15826,7 @@ var DnsMonitor = class {
   pollLog(path) {
     let stat;
     try {
-      stat = (0, import_node_fs19.statSync)(path);
+      stat = (0, import_node_fs21.statSync)(path);
     } catch {
       return;
     }
@@ -15107,7 +15836,7 @@ var DnsMonitor = class {
       return;
     }
     if (stat.size === prev) return;
-    const stream = (0, import_node_fs19.createReadStream)(path, { start: prev, encoding: "utf-8" });
+    const stream = (0, import_node_fs21.createReadStream)(path, { start: prev, encoding: "utf-8" });
     stream.on("error", () => this.positions.set(path, stat.size));
     const rl = (0, import_node_readline5.createInterface)({ input: stream });
     rl.on("line", (line) => this.parseDnsLine(line));
@@ -15339,15 +16068,15 @@ var ModuleHost = class {
     for (const m of builtins) this.modules.set(m.name, m);
   }
   async discoverAndStartInstalled() {
-    if (!(0, import_node_fs20.existsSync)(PATHS.moduleDir)) return;
+    if (!(0, import_node_fs22.existsSync)(PATHS.moduleDir)) return;
     const configs = loadModuleConfigs(PATHS.confD);
-    const entries = (0, import_node_fs20.readdirSync)(PATHS.moduleDir, { withFileTypes: true });
+    const entries = (0, import_node_fs22.readdirSync)(PATHS.moduleDir, { withFileTypes: true });
     for (const entry of entries) {
       if (!entry.isDirectory()) continue;
-      const manifestPath = (0, import_node_path13.join)(PATHS.moduleDir, entry.name, "mod.toml");
-      if (!(0, import_node_fs20.existsSync)(manifestPath)) continue;
+      const manifestPath = (0, import_node_path15.join)(PATHS.moduleDir, entry.name, "mod.toml");
+      if (!(0, import_node_fs22.existsSync)(manifestPath)) continue;
       try {
-        const manifest = import_toml4.default.parse((0, import_node_fs20.readFileSync)(manifestPath, "utf-8"));
+        const manifest = import_toml4.default.parse((0, import_node_fs22.readFileSync)(manifestPath, "utf-8"));
         const name = manifest.module?.name || entry.name;
         const defaults = manifest.module?.config?.defaults || {};
         const config = {
@@ -15361,7 +16090,7 @@ var ModuleHost = class {
           source: "installed",
           status: config.enabled === false ? "disabled" : "loaded",
           events: 0,
-          path: (0, import_node_path13.join)(PATHS.moduleDir, entry.name),
+          path: (0, import_node_path15.join)(PATHS.moduleDir, entry.name),
           config
         };
         this.modules.set(name, hosted);
@@ -15376,7 +16105,7 @@ var ModuleHost = class {
           status: "error",
           events: 0,
           detail: `manifest load failed: ${String(err.message || err)}`,
-          path: (0, import_node_path13.join)(PATHS.moduleDir, entry.name)
+          path: (0, import_node_path15.join)(PATHS.moduleDir, entry.name)
         });
       }
     }
@@ -15388,6 +16117,13 @@ var ModuleHost = class {
       hosted.detail = "no built entrypoint found; run npm install && npm run build in the module directory";
       return;
     }
+    const trust = verifyModuleTrust(hosted.name, hosted.path);
+    if (!trust.ok) {
+      hosted.status = "error";
+      hosted.detail = `refusing to load: ${trust.reason}`;
+      this.bus.announceModule(hosted.name, "error", hosted.detail);
+      return;
+    }
     try {
       const imported = await import((0, import_node_url.pathToFileURL)(entrypoint).href);
       const exported = imported.default || imported.module || imported;
@@ -15408,17 +16144,17 @@ var ModuleHost = class {
     }
   }
   installedEntrypoint(modulePath) {
-    const packageJson = (0, import_node_path13.join)(modulePath, "package.json");
+    const packageJson = (0, import_node_path15.join)(modulePath, "package.json");
     const candidates = [];
-    if ((0, import_node_fs20.existsSync)(packageJson)) {
+    if ((0, import_node_fs22.existsSync)(packageJson)) {
       try {
-        const pkg = JSON.parse((0, import_node_fs20.readFileSync)(packageJson, "utf-8"));
-        if (pkg.main) candidates.push((0, import_node_path13.join)(modulePath, pkg.main));
+        const pkg = JSON.parse((0, import_node_fs22.readFileSync)(packageJson, "utf-8"));
+        if (pkg.main) candidates.push((0, import_node_path15.join)(modulePath, pkg.main));
       } catch {
       }
     }
-    candidates.push((0, import_node_path13.join)(modulePath, "dist", "index.js"), (0, import_node_path13.join)(modulePath, "index.js"));
-    return candidates.find((candidate) => (0, import_node_fs20.existsSync)(candidate)) || null;
+    candidates.push((0, import_node_path15.join)(modulePath, "dist", "index.js"), (0, import_node_path15.join)(modulePath, "index.js"));
+    return candidates.find((candidate) => (0, import_node_fs22.existsSync)(candidate)) || null;
   }
   isThreatCrushModule(value) {
     return Boolean(
@@ -15939,8 +16675,8 @@ var RuleEngine = class {
 };
 
 // src/daemon/rules/loader.ts
-var import_node_fs21 = require("fs");
-var import_node_path14 = require("path");
+var import_node_fs23 = require("fs");
+var import_node_path16 = require("path");
 
 // src/daemon/rules/default-rules.ts
 var DEFAULT_RULES = [
@@ -16224,11 +16960,11 @@ var RULES_DIR = "/etc/threatcrush/rules.d";
 function loadAllRules(customDir) {
   const rules = [...DEFAULT_RULES];
   const dir = customDir || RULES_DIR;
-  if ((0, import_node_fs21.existsSync)(dir)) {
-    const files = (0, import_node_fs21.readdirSync)(dir).filter((f) => f.endsWith(".json"));
+  if ((0, import_node_fs23.existsSync)(dir)) {
+    const files = (0, import_node_fs23.readdirSync)(dir).filter((f) => f.endsWith(".json"));
     for (const file of files) {
       try {
-        const raw = (0, import_node_fs21.readFileSync)((0, import_node_path14.join)(dir, file), "utf-8");
+        const raw = (0, import_node_fs23.readFileSync)((0, import_node_path16.join)(dir, file), "utf-8");
         const parsed = JSON.parse(raw);
         const customRules = Array.isArray(parsed) ? parsed : [parsed];
         for (const rule of customRules) {
@@ -16391,7 +17127,7 @@ function detectFirewallAdapter() {
 }
 
 // src/daemon/firewall/remediation.ts
-var import_node_fs22 = require("fs");
+var import_node_fs24 = require("fs");
 init_state();
 init_paths();
 var DEFAULT_CONFIG2 = {
@@ -16548,7 +17284,7 @@ var RemediationManager = class {
   }
   logLine(line) {
     try {
-      (0, import_node_fs22.appendFileSync)(PATHS.logFile, `${(/* @__PURE__ */ new Date()).toISOString()} ${line}
+      (0, import_node_fs24.appendFileSync)(PATHS.logFile, `${(/* @__PURE__ */ new Date()).toISOString()} ${line}
 `);
     } catch {
     }
@@ -16607,7 +17343,7 @@ async function flushTelemetry(timeoutMs = 2e3) {
 // src/daemon/index.ts
 function readVersion2() {
   try {
-    const pkg = JSON.parse((0, import_node_fs23.readFileSync)((0, import_node_path15.join)(__dirname, "..", "package.json"), "utf-8"));
+    const pkg = JSON.parse((0, import_node_fs25.readFileSync)((0, import_node_path17.join)(__dirname, "..", "package.json"), "utf-8"));
     return pkg.version || "0.0.0";
   } catch {
     return "0.0.0";
@@ -16615,7 +17351,7 @@ function readVersion2() {
 }
 function logLine(line) {
   try {
-    (0, import_node_fs23.appendFileSync)(PATHS.logFile, `${(/* @__PURE__ */ new Date()).toISOString()} ${line}
+    (0, import_node_fs25.appendFileSync)(PATHS.logFile, `${(/* @__PURE__ */ new Date()).toISOString()} ${line}
 `);
   } catch {
   }
@@ -16643,7 +17379,7 @@ async function runDaemon() {
   } catch (err) {
     logLine(`[daemon] state db unavailable: ${err.message}`);
   }
-  const config = loadConfig((0, import_node_fs23.existsSync)(PATHS.configFile) ? PATHS.configFile : void 0);
+  const config = loadConfig((0, import_node_fs25.existsSync)(PATHS.configFile) ? PATHS.configFile : void 0);
   bus.on("event", (event) => {
     logLine(`[event] ${event.severity} ${event.module} ${event.message}`);
   });
@@ -16735,7 +17471,7 @@ async function runDaemon() {
 init_paths();
 init_pidfile();
 init_ipc_client();
-var DAEMON_ENTRY = (0, import_node_path16.join)(__dirname, "daemon.js");
+var DAEMON_ENTRY = (0, import_node_path18.join)(__dirname, "daemon.js");
 async function daemonForeground() {
   await runDaemon();
 }
@@ -16746,7 +17482,7 @@ async function daemonStart() {
     return;
   }
   ensureRuntimeDirs();
-  if (!(0, import_node_fs24.existsSync)(DAEMON_ENTRY)) {
+  if (!(0, import_node_fs26.existsSync)(DAEMON_ENTRY)) {
     console.log(source_default.red(`  Daemon entry not found at ${DAEMON_ENTRY}.`));
     console.log(source_default.dim("  Reinstall with `threatcrush update` or `pnpm run build` in the cli package."));
     return;
@@ -16754,8 +17490,8 @@ async function daemonStart() {
   let out;
   let err;
   try {
-    out = (0, import_node_fs25.openSync)(PATHS.logFile, "a");
-    err = (0, import_node_fs25.openSync)(PATHS.logFile, "a");
+    out = (0, import_node_fs27.openSync)(PATHS.logFile, "a");
+    err = (0, import_node_fs27.openSync)(PATHS.logFile, "a");
   } catch (e) {
     const code = e.code;
     console.log(source_default.red(`  \u2717 Cannot write daemon log at ${PATHS.logFile} (${code ?? "error"}).`));
@@ -16834,19 +17570,19 @@ async function daemonStop() {
 
 // src/commands/service.ts
 var import_node_child_process8 = require("child_process");
-var import_node_fs26 = require("fs");
-var import_node_path17 = require("path");
+var import_node_fs28 = require("fs");
+var import_node_path19 = require("path");
 var UNIT_PATH = "/etc/systemd/system/threatcrushd.service";
 function resolveTemplate() {
-  const templatePath = (0, import_node_path17.join)(__dirname, "systemd", "threatcrushd.service");
-  if (!(0, import_node_fs26.existsSync)(templatePath)) {
+  const templatePath = (0, import_node_path19.join)(__dirname, "systemd", "threatcrushd.service");
+  if (!(0, import_node_fs28.existsSync)(templatePath)) {
     throw new Error(`systemd unit template not found at ${templatePath}`);
   }
-  return (0, import_node_fs26.readFileSync)(templatePath, "utf-8");
+  return (0, import_node_fs28.readFileSync)(templatePath, "utf-8");
 }
 function resolveBinPath() {
   const arg = process.argv[1];
-  if (arg && (0, import_node_fs26.existsSync)(arg)) return arg;
+  if (arg && (0, import_node_fs28.existsSync)(arg)) return arg;
   try {
     return (0, import_node_child_process8.execSync)("command -v threatcrush", { encoding: "utf-8" }).trim();
   } catch {
@@ -16867,7 +17603,7 @@ async function installServiceCommand() {
     return;
   }
   const unit = resolveTemplate().replace("{{BIN_PATH}}", resolveBinPath());
-  (0, import_node_fs26.writeFileSync)(UNIT_PATH, unit, { mode: 420 });
+  (0, import_node_fs28.writeFileSync)(UNIT_PATH, unit, { mode: 420 });
   console.log(source_default.green(`  \u2713 Installed unit file: ${UNIT_PATH}`));
   ensureSystemDirs();
   try {
@@ -16882,29 +17618,31 @@ async function installServiceCommand() {
 }
 function ensureSystemDirs() {
   const dirs = [
-    { path: "/etc/threatcrush" },
-    { path: "/etc/threatcrush/modules", sticky: true },
-    { path: "/etc/threatcrush/threatcrushd.conf.d" },
-    { path: "/var/log/threatcrush" },
-    { path: "/var/lib/threatcrush" },
-    { path: "/var/run/threatcrush" }
+    { path: "/etc/threatcrush", groupWritable: true },
+    { path: "/etc/threatcrush/modules", groupWritable: true, sticky: true },
+    { path: "/etc/threatcrush/threatcrushd.conf.d", groupWritable: true },
+    { path: "/var/log/threatcrush", groupWritable: false },
+    { path: "/var/lib/threatcrush", groupWritable: false },
+    { path: "/var/run/threatcrush", groupWritable: false }
   ];
   let admGid = null;
   try {
-    admGid = (0, import_node_fs26.statSync)("/var/log/auth.log").gid;
+    admGid = (0, import_node_fs28.statSync)("/var/log/auth.log").gid;
   } catch {
   }
-  for (const { path, sticky } of dirs) {
+  for (const { path, groupWritable, sticky } of dirs) {
     try {
-      (0, import_node_fs26.mkdirSync)(path, { recursive: true });
+      (0, import_node_fs28.mkdirSync)(path, { recursive: true });
     } catch {
     }
-    if (admGid !== null) {
-      try {
-        (0, import_node_fs26.chmodSync)(path, sticky ? 1533 : 509);
+    try {
+      if (groupWritable && admGid !== null) {
+        (0, import_node_fs28.chmodSync)(path, sticky ? 1533 : 509);
         (0, import_node_child_process8.execSync)(`chgrp adm ${path}`, { stdio: "ignore" });
-      } catch {
+      } else {
+        (0, import_node_fs28.chmodSync)(path, 493);
       }
+    } catch {
     }
   }
   console.log(source_default.green("  \u2713 Runtime dirs prepared (group `adm` may install modules / edit config without sudo)."));
@@ -16928,7 +17666,7 @@ async function uninstallServiceCommand() {
   } catch {
   }
   try {
-    if ((0, import_node_fs26.existsSync)(UNIT_PATH)) {
+    if ((0, import_node_fs28.existsSync)(UNIT_PATH)) {
       (0, import_node_child_process8.execSync)(`rm -f ${UNIT_PATH}`);
       console.log(source_default.green(`  \u2713 Removed unit file: ${UNIT_PATH}`));
     }
@@ -17027,8 +17765,8 @@ function welcomeCommand() {
 }
 
 // src/commands/properties.ts
-var import_node_fs27 = require("fs");
-var import_node_path18 = require("path");
+var import_node_fs29 = require("fs");
+var import_node_path20 = require("path");
 var import_node_readline6 = __toESM(require("readline"));
 var API_URL7 = process.env.THREATCRUSH_API_URL || "https://threatcrush.com";
 var KINDS = ["url", "api", "domain", "ip", "repo"];
@@ -17357,8 +18095,8 @@ async function propertiesRunsCommand(opts) {
   }
 }
 function parseImportFile(path) {
-  const ext = (0, import_node_path18.extname)(path).toLowerCase();
-  const raw = (0, import_node_fs27.readFileSync)(path, "utf-8");
+  const ext = (0, import_node_path20.extname)(path).toLowerCase();
+  const raw = (0, import_node_fs29.readFileSync)(path, "utf-8");
   if (ext === ".json") {
     const parsed = JSON.parse(raw);
     if (!Array.isArray(parsed)) throw new Error("JSON must be an array of objects");
@@ -17548,7 +18286,7 @@ async function rulesCommand(opts) {
 }
 
 // src/commands/harden.ts
-var import_node_fs28 = require("fs");
+var import_node_fs30 = require("fs");
 var import_node_child_process9 = require("child_process");
 function tryExec(cmd) {
   try {
@@ -17559,7 +18297,7 @@ function tryExec(cmd) {
 }
 function tryRead(path) {
   try {
-    return (0, import_node_fs28.readFileSync)(path, "utf-8");
+    return (0, import_node_fs30.readFileSync)(path, "utf-8");
   } catch {
     return null;
   }
@@ -17663,8 +18401,8 @@ function checkSshWeakConfig() {
   };
 }
 function checkAutoUpdates() {
-  const unattended = (0, import_node_fs28.existsSync)("/etc/apt/apt.conf.d/20auto-upgrades") || (0, import_node_fs28.existsSync)("/etc/apt/apt.conf.d/50unattended-upgrades");
-  const dnfAuto = (0, import_node_fs28.existsSync)("/etc/dnf/automatic.conf");
+  const unattended = (0, import_node_fs30.existsSync)("/etc/apt/apt.conf.d/20auto-upgrades") || (0, import_node_fs30.existsSync)("/etc/apt/apt.conf.d/50unattended-upgrades");
+  const dnfAuto = (0, import_node_fs30.existsSync)("/etc/dnf/automatic.conf");
   if (unattended || dnfAuto) {
     return {
       key: "auto-updates",
@@ -17790,7 +18528,7 @@ function checkFail2ban() {
       explanation: "fail2ban is installed and running."
     };
   }
-  if ((0, import_node_fs28.existsSync)("/etc/fail2ban/fail2ban.conf")) {
+  if ((0, import_node_fs30.existsSync)("/etc/fail2ban/fail2ban.conf")) {
     return {
       key: checkKey,
       status: "warn",
@@ -18021,7 +18759,7 @@ async function allowlistCommand(opts) {
 init_paths();
 var PKG_VERSION2 = "0.1.8";
 try {
-  const pkg = JSON.parse((0, import_node_fs29.readFileSync)((0, import_node_path19.join)(__dirname, "..", "package.json"), "utf-8"));
+  const pkg = JSON.parse((0, import_node_fs31.readFileSync)((0, import_node_path21.join)(__dirname, "..", "package.json"), "utf-8"));
   PKG_VERSION2 = pkg.version;
 } catch {
 }
@@ -18037,7 +18775,7 @@ ${source_default.dim("                    C R U S H")}
 var API_URL8 = process.env.THREATCRUSH_API_URL || "https://threatcrush.com";
 var PKG_NAME = "@profullstack/threatcrush";
 var DESKTOP_PKG_NAME = "@profullstack/threatcrush-desktop";
-var INSTALL_CONFIG_PATH = (0, import_node_path19.join)((0, import_node_os8.homedir)(), ".threatcrush", "install.json");
+var INSTALL_CONFIG_PATH = (0, import_node_path21.join)((0, import_node_os8.homedir)(), ".threatcrush", "install.json");
 function detectPackageManager() {
   try {
     const npmGlobal = (0, import_node_child_process10.execSync)("npm ls -g --depth=0 --json 2>/dev/null", { encoding: "utf-8" });
@@ -18063,7 +18801,7 @@ function detectPackageManager() {
 }
 function readInstallConfig() {
   try {
-    return JSON.parse((0, import_node_fs29.readFileSync)(INSTALL_CONFIG_PATH, "utf-8"));
+    return JSON.parse((0, import_node_fs31.readFileSync)(INSTALL_CONFIG_PATH, "utf-8"));
   } catch {
     return {};
   }
@@ -18248,7 +18986,7 @@ program2.command("uninstall-service").description("Remove the threatcrushd syste
 program2.command("logs").description("Tail daemon logs").action(async () => {
   console.log(LOGO2);
   const logPath = PATHS.logFile;
-  if (!(0, import_node_fs29.existsSync)(logPath)) {
+  if (!(0, import_node_fs31.existsSync)(logPath)) {
     console.log(source_default.yellow(`  No log file found at ${logPath}`));
     console.log(source_default.dim("  Start the daemon first with `threatcrush start`\n"));
     return;
@@ -18453,10 +19191,10 @@ storeCmd.command("search <query>").description("Search for modules in the store"
 });
 storeCmd.command("publish <url>").description("Publish a module from a git URL or web URL").action(async (url) => {
   console.log(LOGO2);
-  const configPath = (0, import_node_path19.join)((0, import_node_os8.homedir)(), ".threatcrush", "config.json");
+  const configPath = (0, import_node_path21.join)((0, import_node_os8.homedir)(), ".threatcrush", "config.json");
   let email = "";
   try {
-    const config = JSON.parse((0, import_node_fs29.readFileSync)(configPath, "utf-8"));
+    const config = JSON.parse((0, import_node_fs31.readFileSync)(configPath, "utf-8"));
     email = config.email || "";
   } catch {
   }
@@ -18473,9 +19211,9 @@ storeCmd.command("publish <url>").description("Publish a module from a git URL o
       return;
     }
     try {
-      const dir = (0, import_node_path19.join)((0, import_node_os8.homedir)(), ".threatcrush");
-      if (!(0, import_node_fs29.existsSync)(dir)) (0, import_node_fs29.mkdirSync)(dir, { recursive: true });
-      (0, import_node_fs29.writeFileSync)(configPath, JSON.stringify({ email }, null, 2));
+      const dir = (0, import_node_path21.join)((0, import_node_os8.homedir)(), ".threatcrush");
+      if (!(0, import_node_fs31.existsSync)(dir)) (0, import_node_fs31.mkdirSync)(dir, { recursive: true });
+      (0, import_node_fs31.writeFileSync)(configPath, JSON.stringify({ email }, null, 2));
       console.log(source_default.dim(`  Saved email to ${configPath}`));
     } catch {
     }