@solongate/proxy 0.58.0 → 0.59.0

package/hooks/guard.mjs

@@ -1,1604 +1,1626 @@
-#!/usr/bin/env node
-/**
- * SolonGate Cloud Policy Guard Hook (PreToolUse) — GLOBAL system-wide enforcement.
- *
- * This is the cloud twin of the air-gapped guard hook. Identical decision engine
- * (OPA WASM, NIST SP 800-207 PDP, fail-closed), but the policy + compiled WASM
- * are fetched from SolonGate Cloud and authenticated with the project API key.
- * Installed globally (~/.claude/settings.json) it intercepts EVERY tool call from
- * EVERY Claude Code session on the machine — exactly like the air-gapped product,
- * just sourced from the cloud instead of a local docker API.
- *
- * Cloud differences vs. air-gap guard.mjs:
- *   - API_KEY (sg_live_…/sg_test_…) from env/.env, attached to every API call.
- *   - API_URL defaults to https://api.solongate.com.
- *   - Enforcement is gated on the API key (the key identifies the project +
- *     its active policy), NOT on SOLONGATE_AGENT_ID.
- *   - No AI Judge and NO gray route: cloud routing is binary, WHITE (allow) /
- *     BLACK (block). The OPA policy alone decides; nothing is escalated.
- *
- * Exit code 2 = BLOCK, exit code 0 = ALLOW.
- * Logs DENY decisions to SolonGate Cloud. ALLOWs are logged by audit.mjs.
- * Auto-installed by: npx @solongate/proxy init --global
- */
-import { readFileSync, existsSync, statSync, writeFileSync, mkdirSync, chmodSync, renameSync, appendFileSync } from 'node:fs';
-import { resolve, join, dirname } from 'node:path';
-import { homedir } from 'node:os';
-import { gunzipSync } from 'node:zlib';
-import { createHash } from 'node:crypto';
-
-// Bump on every guard.mjs change. The cloud serves the newest bundle + version;
-// the installed hook self-updates when the cloud version is higher (see
-// maybeSelfUpdate). This is what makes guard fixes propagate without a manual
-// reinstall — the same trust model as the OPA WASM this hook already runs.
-const HOOK_VERSION = 30;
-
-// True when local log storage is ON. In that mode logs are kept LOCAL ONLY and
-// nothing is sent to the cloud audit log.
-function localLogsOnly(security) {
-  const l = security && security.localLogs;
-  return !!(l && l.enabled && typeof l.path === 'string' && l.path.trim());
-}
-
-// Local log storage (opt-in): write solongate-audit.jsonl inside the user's
-// chosen FOLDER. The audit hook does the ALLOW path; the guard does DENY (a
-// blocked call never reaches PostToolUse). `security` is the resolved config.
-function writeLocalLog(security, entry) {
-  try {
-    const l = security && security.localLogs;
-    if (!l || !l.enabled || typeof l.path !== 'string' || !l.path.trim()) return;
-    const dir = l.path.trim().replace(/[\\/]+$/, '');
-    try { mkdirSync(dir, { recursive: true }); } catch { /* ignore */ }
-    appendFileSync(join(dir, 'solongate-audit.jsonl'), JSON.stringify(entry) + '\n');
-  } catch { /* best-effort */ }
-}
-
-// Safe file read with size limit (1MB max) to prevent DoS via large files
-const MAX_FILE_READ = 1024 * 1024; // 1MB
-function safeReadFileSync(filePath, encoding = 'utf-8') {
-  try {
-    const stat = statSync(filePath);
-    if (stat.size > MAX_FILE_READ) return '';
-    return readFileSync(filePath, encoding);
-  } catch { return ''; }
-}
-
-// ── Load .env file (Claude Code doesn't load .env into process.env) ──
-function loadEnvKey(dir) {
-  try {
-    const envPath = resolve(dir, '.env');
-    if (!existsSync(envPath)) return {};
-    const lines = readFileSync(envPath, 'utf-8').split('\n');
-    const env = {};
-    for (const line of lines) {
-      const m = line.match(/^([A-Z_]+)=(.*)$/);
-      if (m) env[m[1]] = m[2].replace(/^["']|["']$/g, '').trim();
-    }
-    return env;
-  } catch { return {}; }
-}
-
-// ── Global cloud config (~/.solongate/cloud-guard.json) ──
-// A GLOBAL hook runs from an arbitrary cwd every session, so a project-local
-// .env can't be relied on to carry the API key. The global installer writes the
-// key + URL here once; this absolute path is read regardless of cwd. Shape:
-//   { "apiKey": "sg_live_…", "apiUrl": "https://api.solongate.com" }
-function loadGlobalCloudConfig() {
-  try {
-    const p = resolve(homedir(), '.solongate', 'cloud-guard.json');
-    if (!existsSync(p)) return {};
-    const cfg = JSON.parse(readFileSync(p, 'utf-8'));
-    return (cfg && typeof cfg === 'object') ? cfg : {};
-  } catch { return {}; }
-}
-
-// A real cloud key is `sg_live_`/`sg_test_` followed by hex (see generateApiKey:
-// 24 random bytes → 48 hex chars). Template/placeholder values shipped in sample
-// .env files (e.g. `sg_live_your_key_here`) pass a naive truthiness check but are
-// bogus — and because resolution prefers a project .env over the global login
-// credential, a stray placeholder .env would shadow a valid login and 401 every
-// API call, making the guard fail closed on EVERYTHING. Filter to real keys so a
-// placeholder is skipped and the next real candidate (usually the login cred in
-// cloud-guard.json) is used instead.
-function isRealKey(k) {
-  if (typeof k !== 'string') return false;
-  const v = k.trim();
-  if (!/^sg_(live|test)_/.test(v)) return false;
-  const body = v.replace(/^sg_(live|test)_/, '');
-  if (/your_key_here|placeholder|example|^x+$/i.test(body)) return false;
-  return /^[a-f0-9]{16,}$/i.test(body);
-}
-
-function guessPermission(toolName) {
-  const name = (toolName || '').toLowerCase();
-  if (name.includes('exec') || name.includes('shell') || name.includes('run') || name.includes('eval') || name === 'bash') return 'EXECUTE';
-  if (name.includes('fetch') || name.includes('http') || name.includes('request') || name.includes('curl') || name.includes('network') || name.includes('download') || name.includes('upload') || name === 'websearch') return 'NETWORK';
-  if (name.includes('write') || name.includes('create') || name.includes('delete') || name.includes('update') || name.includes('set') || name.includes('edit') || name.includes('remove') || name.includes('insert')) return 'WRITE';
-  return 'READ';
-}
-
-const hookCwdEarly = process.cwd();
-const dotenv = loadEnvKey(hookCwdEarly);
-const globalCfg = loadGlobalCloudConfig();
-// Resolution order: process env → project-local .env → global ~/.solongate
-// config. The global config is what makes a system-wide install self-sufficient.
-const API_URL = process.env.SOLONGATE_API_URL || dotenv.SOLONGATE_API_URL || globalCfg.apiUrl || 'https://api.solongate.com';
-// Cloud API key (sg_live_… / sg_test_…). The key identifies the project AND
-// authenticates every API call (active policy, compiled WASM, audit logs). When
-// absent, this hook does nothing — a machine with no key is intentionally
-// unenforced (the cloud has no policy to apply). Each candidate is filtered
-// through isRealKey() so a placeholder .env (sg_live_your_key_here) can't shadow
-// the real login credential and force a fail-closed on every call.
-const API_KEY = [process.env.SOLONGATE_API_KEY, dotenv.SOLONGATE_API_KEY, globalCfg.apiKey].find(isRealKey) || '';
-// Auth headers attached to every cloud API request. Cloud accepts either the
-// Authorization: Bearer form or X-API-Key; we send both for robustness.
-const AUTH_HEADERS = API_KEY ? { 'Authorization': 'Bearer ' + API_KEY, 'X-API-Key': API_KEY } : {};
-
-// ── Self-update (best-effort, throttled, integrity-checked) ──
-// Once per ~6h the hook asks the cloud for the latest guard bundle. If the cloud
-// version is higher AND the sha256 verifies AND the payload looks like this guard
-// hook, it atomically replaces its own file. Any failure is swallowed so a bad
-// update can never break enforcement — the current code simply keeps running.
-// Fetch one hook bundle from the cloud and atomically replace the installed file
-// if the served version is newer AND the sha256 verifies AND it looks like the
-// right hook. Any failure is swallowed.
-async function fetchAndInstallHook(endpoint, fileName, currentVersion, marker, minLen) {
-  try {
-    const res = await fetch(API_URL + '/api/v1/hooks/' + endpoint, { headers: AUTH_HEADERS, signal: AbortSignal.timeout(5000) });
-    if (!res.ok) return;
-    const data = await res.json();
-    if (!data || typeof data.version !== 'number' || data.version <= currentVersion) return;
-    if (typeof data.content !== 'string' || typeof data.sha256 !== 'string') return;
-    const buf = Buffer.from(data.content, 'base64');
-    if (createHash('sha256').update(buf).digest('hex') !== data.sha256) return;
-    const text = buf.toString('utf-8');
-    if (!text.startsWith('#!/usr/bin/env node') || text.length < minLen || !text.includes(marker)) return;
-    const hooksDir = join(resolve(homedir(), '.solongate'), 'hooks');
-    const tmp = join(hooksDir, '.' + fileName + '.tmp');
-    writeFileSync(tmp, text);
-    try { chmodSync(join(hooksDir, fileName), 0o644); } catch { /* may be locked read-only */ }
-    renameSync(tmp, join(hooksDir, fileName)); // atomic swap, takes effect next call
-  } catch { /* never break enforcement on update failure */ }
-}
-
-// Read the HOOK_VERSION baked into an installed sibling hook (0 if absent/old).
-function installedHookVersion(fileName) {
-  try {
-    const f = join(resolve(homedir(), '.solongate'), 'hooks', fileName);
-    const m = (safeReadFileSync(f) || '').match(/HOOK_VERSION\s*=\s*(\d+)/);
-    return m ? parseInt(m[1], 10) : 0;
-  } catch { return 0; }
-}
-
-// Latest hook versions the cloud reports on /policies/active (hook_versions).
-// Captured during the policy fetch of THIS run (or its short-lived cache); lets
-// maybeSelfUpdate() know it is behind and bypass the 6h stamp entirely.
-let CLOUD_HOOK_VERSIONS = null;
-
-function hooksBehindCloud() {
-  const v = CLOUD_HOOK_VERSIONS;
-  if (!v || typeof v !== 'object') return false;
-  if (Number(v.guard) > HOOK_VERSION) return true;
-  if (Number(v.audit) > installedHookVersion('audit.mjs')) return true;
-  if (Number(v.shield) > installedHookVersion('shield.mjs')) return true;
-  return false;
-}
-
-// Once per ~6h: update the guard itself AND its sibling hooks (audit, shield).
-// The guard is the only hook that self-updates from the cloud, so it carries the
-// others — that's why a new audit/shield reaches every device with NO re-login:
-// the guard fetches and installs them on its next run.
-//
-// The 6h stamp only rate-limits the BLIND check. When the policy response says
-// the cloud serves a NEWER hook (hook_versions), we update immediately — so a
-// fresh release lands on the next executed command, and a stamp refreshed by an
-// earlier run (e.g. before the release finished deploying) can't delay it.
-async function maybeSelfUpdate() {
-  if (!API_KEY) return;
-  try {
-    const sgDir = resolve(homedir(), '.solongate');
-    const stamp = join(sgDir, '.hook-update-check');
-    if (!hooksBehindCloud()) {
-      const last = parseInt(safeReadFileSync(stamp) || '0', 10);
-      if (Number.isFinite(last) && Date.now() - last < 6 * 3600 * 1000) return;
-    }
-    try { writeFileSync(stamp, String(Date.now())); } catch { /* ignore */ }
-    // Guard compares to its OWN running version; siblings to their installed file.
-    await fetchAndInstallHook('guard', 'guard.mjs', HOOK_VERSION, 'SolonGate Cloud Policy Guard', 50000);
-    await fetchAndInstallHook('audit', 'audit.mjs', installedHookVersion('audit.mjs'), 'SolonGate Audit Hook', 1500);
-    await fetchAndInstallHook('shield', 'shield.mjs', installedHookVersion('shield.mjs'), 'SolonGate Shield', 1500);
-  } catch { /* never break enforcement on update failure */ }
-}
-
-// Two distinct identities, deliberately kept separate:
-//
-//   AGENT_TYPE — the real AI client running this hook (claude-code /
-//   gemini-cli / openclaw). Baked into the hook registration by the installer
-//   as argv[2] (e.g. `node guard.mjs claude-code`). Decides the response
-//   format AND whether a selected policy actually applies to this client.
-//
-//   POLICY_SELECTOR — set per-terminal via SOLONGATE_AGENT_ID (a policy id
-//   from the dashboard "Use in terminal" button, or an agent name). Decides
-//   WHICH policy to load. When unset, no policy is enforced — a plain launch
-//   is intentionally unrestricted.
-const AGENT_TYPE = process.argv[2] || 'claude-code';
-const POLICY_SELECTOR = process.env.SOLONGATE_AGENT_ID || '';
-const AGENT_ID = POLICY_SELECTOR || AGENT_TYPE;
-const AGENT_NAME = process.env.SOLONGATE_AGENT_NAME || process.argv[3] || AGENT_TYPE;
-
-// ── Per-tool block/allow output ──
-// Response format depends on the agent:
-// Claude Code:  exit 2 + stderr = BLOCK, exit 0 = ALLOW
-// Gemini CLI:   {"decision": "deny/allow", "reason": "..."}
-
-function blockTool(reason) {
-  if (AGENT_TYPE === 'gemini-cli') {
-    process.stdout.write(JSON.stringify({
-      decision: 'deny',
-      reason: `[SolonGate] ${reason}`,
-    }));
-    process.exit(0);
-  } else {
-    // Claude Code — exit code 2
-    process.stderr.write(reason);
-    process.exit(2);
-  }
-}
-
-function allowTool() {
-  if (AGENT_TYPE === 'gemini-cli') {
-    process.stdout.write(JSON.stringify({ decision: 'allow' }));
-  }
-  process.exit(0);
-}
-
-// Allow the tool but REPLACE its input (Claude Code `updatedInput`). Used by the
-// ghost layer to rewrite a listing command so hidden entries are filtered out of
-// its output — the agent never sees them. Claude Code only.
-function rewriteTool(updatedInput) {
-  process.stdout.write(JSON.stringify({
-    hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'allow', updatedInput },
-  }));
-  process.exit(0);
-}
-
-// Write flag file so stop.mjs knows a tool call (DENY) happened and doesn't log extra ALLOW
-function writeDenyFlag(toolName) {
-  try {
-    const flagDir = resolve('.solongate');
-    mkdirSync(flagDir, { recursive: true });
-    writeFileSync(join(flagDir, '.last-tool-call'), Date.now().toString());
-    // Write deny-specific flag so audit.mjs can detect and skip duplicate ALLOW logging
-    writeFileSync(join(flagDir, '.last-deny'), JSON.stringify({ tool: toolName, ts: Date.now() }));
-  } catch {}
-}
-
-// ── Prompt Injection Detection (Stage 1: Rule-Based) ──
-const PI_CATEGORIES = [
-  {
-    name: 'delimiter_injection', weight: 0.95,
-    patterns: [
-      /<\/system>/i, /<\|im_end\|>/i, /<\|im_start\|>/i, /<\|endoftext\|>/i,
-      /\[INST\]/i, /\[\/INST\]/i, /<<SYS>>/i, /<<\/SYS>>/i,
-      /###\s*(Human|Assistant|System)\s*:/i, /<\|user\|>/i, /<\|assistant\|>/i,
-      /---\s*END\s*SYSTEM\s*PROMPT\s*---/i,
-    ],
-  },
-  {
-    name: 'instruction_override', weight: 0.9,
-    patterns: [
-      /\bignore\s+(all\s+)?(previous|prior|above|earlier)\s+(instructions?|prompts?|rules?|directives?)\b/i,
-      /\bdisregard\s+(all\s+)?(previous|prior|above|earlier|your)\s+(instructions?|prompts?|rules?|guidelines?)\b/i,
-      /\bforget\s+(all\s+|everything\s+)?(your|the|previous|prior|above|earlier)\b/i,
-      /\boverride\s+(the\s+)?(system|previous|current)\s+(prompt|instructions?|rules?|settings?)\b/i,
-      /\bdo\s+not\s+follow\s+(your|the|any)\s+(instructions?|rules?|guidelines?)\b/i,
-      /\bcancel\s+(all\s+)?(prior|previous)\s+(directives?|instructions?)\b/i,
-      /\bnew\s+instructions?\s+supersede\b/i,
-      /\byour\s+(previous\s+)?instructions?\s+are\s+(now\s+)?void\b/i,
-    ],
-  },
-  {
-    name: 'role_hijacking', weight: 0.85,
-    patterns: [
-      /\b(pretend|act|behave)\s+(you\s+are|as\s+if\s+you|like\s+you|to\s+be)\b/i,
-      /\byou\s+are\s+now\s+(a|an|the|my|DAN)\b/i,
-      /\bsimulate\s+being\b/i, /\bassume\s+the\s+role\s+of\b/i,
-      /\benter\s+(developer|admin|debug|god|sudo|unrestricted)\s+mode\b/i,
-      /\bswitch\s+to\s+(unrestricted|unfiltered)\s+mode\b/i,
-      /\byou\s+are\s+no\s+longer\s+bound\b/i,
-      /\bno\s+(safety\s+)?restrictions?\s+(apply|anymore|now)\b/i,
-    ],
-  },
-  {
-    name: 'jailbreak_keywords', weight: 0.8,
-    patterns: [
-      /\bjailbreak\b/i, /\bDAN\s+mode\b/i,
-      /\b(system\s+override|admin\s+mode|debug\s+mode|developer\s+mode|maintenance\s+mode)\b/i,
-      /\bmaster\s+key\b/i, /\bbackdoor\s+access\b/i,
-      /\bsudo\s+mode\b/i, /\bgod\s+mode\b/i,
-      /\bsafety\s+filters?\s+(off|disabled?|removed?)\b/i,
-    ],
-  },
-  {
-    name: 'encoding_evasion', weight: 0.75,
-    patterns: [
-      /\b(decode|translate)\s+(this|the\s+following)\s+(base64|rot13|hex)\b/i,
-      /\b(base64|rot13)\s*:\s*[A-Za-z0-9+/=]{10,}/i,
-      /\bexecute\s+the\s+(reverse|decoded)\b/i,
-      /\breverse\s+of\s*:\s*\w{10,}/i,
-    ],
-  },
-  {
-    name: 'separator_injection', weight: 0.7,
-    patterns: [
-      /[-=]{3,}\s*\n\s*(new\s+instructions?|system|instructions?)\s*:/i,
-      /```\s*\n\s*<\/?system>/i,
-      /\bEND\s+(SYSTEM\s+)?(PROMPT|INSTRUCTIONS?)\b.*\bNEW\s+(SYSTEM\s+)?(PROMPT|INSTRUCTIONS?)\b/is,
-    ],
-  },
-  {
-    name: 'multi_language', weight: 0.7,
-    patterns: [
-      /ignor(iere|a|e[zs]?)\s+(alle|todas?|toutes?|tüm|все)/iu,
-      /игнорируйте/iu, /yoksay/iu,
-      /vorherigen?\s+Anweisungen/iu, /instrucciones\s+anteriores/iu,
-      /instructions?\s+pr[eé]c[eé]dentes?/iu, /önceki\s+talimatlar/iu,
-    ],
-  },
-];
-
-function detectPromptInjection(text, customCategories = [], threshold = 0.5) {
-  const matched = [];
-  let maxWeight = 0;
-  const allCategories = [...PI_CATEGORIES, ...customCategories];
-  for (const cat of allCategories) {
-    for (const pat of cat.patterns) {
-      if (pat.test(text)) {
-        matched.push(cat.name);
-        if (cat.weight > maxWeight) maxWeight = cat.weight;
-        break;
-      }
-    }
-  }
-  if (matched.length === 0) return null;
-  const score = Math.min(1.0, maxWeight + 0.05 * (matched.length - 1));
-  const trustScore = 1.0 - score;
-  const blocked = Math.round(trustScore * 1000) < Math.round(threshold * 1000);
-  return { score, trustScore, categories: matched, blocked };
-}
-
-// ── Glob Matching ──
-function matchGlob(str, pattern) {
-  if (pattern === '*') return true;
-  const s = str.toLowerCase();
-  const p = pattern.toLowerCase();
-  if (s === p) return true;
-  const startsW = p.startsWith('*');
-  const endsW = p.endsWith('*');
-  if (startsW && endsW) { const infix = p.slice(1, -1); return infix.length > 0 && s.includes(infix); }
-  if (startsW) return s.endsWith(p.slice(1));
-  if (endsW) return s.startsWith(p.slice(0, -1));
-  const idx = p.indexOf('*');
-  if (idx !== -1) {
-    const pre = p.slice(0, idx);
-    const suf = p.slice(idx + 1);
-    return s.startsWith(pre) && s.endsWith(suf) && s.length >= pre.length + suf.length;
-  }
-  return false;
-}
-
-// ── Path Glob (supports **) ──
-function matchPathGlob(path, pattern) {
-  const p = path.replace(/\\/g, '/').toLowerCase();
-  const g = pattern.replace(/\\/g, '/').toLowerCase();
-  if (p === g) return true;
-  if (g.includes('**')) {
-    const parts = g.split('**').filter(s => s.length > 0);
-    if (parts.length === 0) return true;
-    return parts.every(segment => p.includes(segment));
-  }
-  return matchGlob(p, g);
-}
-
-// ── Safe Webhook URL Validation (prevent SSRF) ──
-function isSafeWebhookUrl(urlStr) {
-  try {
-    const u = new URL(urlStr);
-    if (u.protocol !== 'https:') return false;
-    const host = u.hostname.toLowerCase();
-    // Block private/reserved IPs and metadata endpoints
-    if (host === 'localhost' || host === '127.0.0.1' || host === '0.0.0.0' || host === '::1') return false;
-    if (host.startsWith('10.') || host.startsWith('192.168.') || host.startsWith('172.')) return false;
-    if (host === '169.254.169.254' || host === 'metadata.google.internal') return false;
-    if (host.endsWith('.internal') || host.endsWith('.local')) return false;
-    return true;
-  } catch { return false; }
-}
-
-// ── Safe Regex Validation (prevent ReDoS from cloud-supplied patterns) ──
-function isSafeRegex(pattern) {
-  if (typeof pattern !== 'string' || pattern.length > 512) return false;
-  // Block nested quantifiers: (a+)+, (a*)+, (a{1,})+, etc.
-  if (/(\+|\*|\{[^}]+\})\s*(\+|\*|\{[^}]+\})/.test(pattern)) return false;
-  if (/\([^)]*(\+|\*|\{[^}]+\})[^)]*\)\s*(\+|\*|\{[^}]+\})/.test(pattern)) return false;
-  // Block excessive alternation groups (>10 alternatives)
-  if ((pattern.match(/\|/g) || []).length > 10) return false;
-  try { new RegExp(pattern); return true; } catch { return false; }
-}
-
-// ── Extract Functions (deep scan all string values) ──
-function scanStrings(obj) {
-  const strings = [];
-  function walk(v) {
-    if (typeof v === 'string' && v.trim()) strings.push(v.trim());
-    else if (Array.isArray(v)) v.forEach(walk);
-    else if (v && typeof v === 'object') Object.values(v).forEach(walk);
-  }
-  walk(obj);
-  return strings;
-}
-
-function looksLikeFilename(s) {
-  if (s.startsWith('.')) return true;
-  if (/\.\w+$/.test(s)) return true;
-  const known = ['id_rsa','id_dsa','id_ecdsa','id_ed25519','authorized_keys','known_hosts','makefile','dockerfile'];
-  return known.includes(s.toLowerCase());
-}
-
-// Deterministic shell normalizer — handles the common bypass tricks BEFORE
-// any semantic check, so OPA's literal matcher sees the canonical command.
-// Specifically: variable assignment + interpolation, quote concatenation
-// (.e""nv, ."env"). Doesn't try to be a full shell — just enough to defeat
-// the obfuscation patterns AI judges keep getting wrong non-deterministically.
-function normalizeShellCommand(cmd) {
-  if (typeof cmd !== 'string' || !cmd) return cmd;
-  const vars = {};
-  const out = [];
-  // Split on statement separators (; && ||) but NOT pipes (|).
-  for (const rawPart of cmd.split(/\s*(?:;|&&|\|\|)\s*/)) {
-    let part = rawPart;
-    // Detect var assignment: NAME=value | NAME="value" | NAME='value'
-    const m = part.match(/^(\w+)=(?:"([^"]*)"|'([^']*)'|([^\s;&|]*))\s*$/);
-    if (m) {
-      vars[m[1]] = m[2] ?? m[3] ?? m[4] ?? '';
-      continue;
-    }
-    // Substitute ${var} then $var.
-    part = part.replace(/\$\{(\w+)\}/g, (_, n) => vars[n] !== undefined ? vars[n] : '${' + n + '}');
-    part = part.replace(/\$(\w+)/g, (_, n) => vars[n] !== undefined ? vars[n] : '$' + n);
-    // Collapse quote-concat: a"b"c → abc, .e""nv → .env, ."env" → .env
-    part = part.replace(/"([^"]*)"/g, '$1').replace(/'([^']*)'/g, '$1');
-    out.push(part);
-  }
-  return out.join('; ');
-}
-
-// Normalize all shell-command-valued fields of an args object before tokenizing.
-function normalizeArgs(args) {
-  if (!args || typeof args !== 'object') return args;
-  const fields = ['command', 'cmd', 'function', 'script', 'shell'];
-  const copy = { ...args };
-  for (const [k, v] of Object.entries(copy)) {
-    if (fields.includes(k.toLowerCase()) && typeof v === 'string') {
-      copy[k] = normalizeShellCommand(v);
-    }
-  }
-  return copy;
-}
-
-function extractFilenames(args) {
-  args = normalizeArgs(args);
-  const names = new Set();
-  // Strip surrounding/trailing quotes — `"…/secret.env"` must reduce to
-  // `secret.env`, not `secret.env"` (a trailing quote breaks the *.env glob).
-  const dequote = (t) => t.replace(/^["'`]+/, '').replace(/["'`]+$/, '');
-  for (const s of scanStrings(args)) {
-    if (/^https?:\/\//i.test(s)) continue;
-    // Process EVERY whitespace-separated token, not just the last `/` segment of
-    // the whole string. Multi-file commands (`rm a b c`) must check all of them.
-    const tokens = s.includes(' ') ? s.split(/\s+/) : [s];
-    const single = tokens.length === 1;
-    for (let tok of tokens) {
-      tok = dequote(tok);
-      if (!tok || /^https?:\/\//i.test(tok)) continue;
-      if (tok.includes('/') || tok.includes('\\')) {
-        const b = dequote(tok.replace(/\\/g, '/').split('/').pop() || '');
-        if (b && (single || looksLikeFilename(b))) names.add(b);
-      } else if (looksLikeFilename(tok)) {
-        names.add(tok);
-      }
-    }
-  }
-  return [...names];
-}
-
-function extractUrls(args) {
-  const urls = new Set();
-  for (const s of scanStrings(args)) {
-    if (/^https?:\/\//i.test(s)) { urls.add(s); continue; }
-    if (s.includes(' ')) {
-      for (const tok of s.split(/\s+/)) {
-        if (/^https?:\/\//i.test(tok)) urls.add(tok);
-      }
-    }
-  }
-  return [...urls];
-}
-
-function extractCommands(args) {
-  args = normalizeArgs(args);
-  const cmds = [];
-  const fields = ['command', 'cmd', 'function', 'script', 'shell'];
-  if (typeof args === 'object' && args) {
-    for (const [k, v] of Object.entries(args)) {
-      if (fields.includes(k.toLowerCase()) && typeof v === 'string') {
-        for (const part of v.split(/\s*(?:&&|\|\||;|\|)\s*/)) {
-          const trimmed = part.trim();
-          if (trimmed) cmds.push(trimmed);
-        }
-      }
-    }
-  }
-  return cmds;
-}
-
-function extractPaths(args, isExec) {
-  const paths = [];
-  const add = (t) => {
-    if (!t || /^https?:\/\//i.test(t)) return;
-    // Normalize Windows backslashes to forward slashes so paths match the
-    // compiled Rego patterns (which are also normalized to "/"). OPA glob.match
-    // does no separator translation, so raw "C:\..." never matched "/" patterns.
-    if (t.includes('/') || t.includes('\\') || t.startsWith('.')) paths.push(t.replace(/\\/g, '/'));
-  };
-  for (const s of scanStrings(args)) {
-    if (/^https?:\/\//i.test(s)) continue;
-    if (isExec && /\s/.test(s)) {
-      // A command line (exec tool): pull out individual path-like tokens instead
-      // of treating the whole command as one path. Otherwise `node src/app.js`
-      // becomes the path "node src/app.js", which no path glob can match — so a
-      // path-scoped EXECUTE rule would never fire. Tokenizing yields "src/app.js".
-      for (const tok of s.split(/[\s;|&><()`'"]+/)) add(tok);
-    } else {
-      add(s);
-    }
-  }
-  return paths;
-}
-
-// ── Hardcoded Tamper Protection ──
-// Runs BEFORE policy evaluation. Cannot be disabled by editing policies.
-// Even if all policy rules are removed, these stay enforced.
-const TAMPER_GUARD_TOOLS_WRITE = new Set([
-  'write', 'edit', 'multiedit', 'notebookedit',
-  'create', 'update', 'delete', 'remove', 'move', 'rename', 'copy',
-  'filesystem', 'fs_write', 'fs_edit', 'str_replace_editor',
-]);
-const TAMPER_GUARD_TOOLS_EXEC = new Set([
-  'bash', 'powershell', 'shell', 'exec', 'run', 'eval', 'cmd',
-]);
-const TAMPER_HOME = resolve(homedir()).replace(/\\/g, '/').toLowerCase();
-const TAMPER_SG = '/.solongate';
-const TAMPER_CC = '/.claude';
-const TAMPER_PROTECTED_ABS = [
-  TAMPER_HOME + TAMPER_CC + '/settings.json',
-  TAMPER_HOME + TAMPER_CC + '/settings.local.json',
-  TAMPER_HOME + TAMPER_SG + '/hooks',
-  TAMPER_HOME + TAMPER_SG + '/policy.json',
-  TAMPER_HOME + TAMPER_SG + '/.policy-cache.json',
-  // The cloud credential (contains the API key) — never readable via a tool.
-  TAMPER_HOME + TAMPER_SG + '/cloud-guard.json',
-];
-const TAMPER_INSTALL = '/solongate';
-const TAMPER_PROTECTED_GLOBS = [
-  '**' + TAMPER_CC + '/settings.json',
-  '**' + TAMPER_CC + '/settings.local.json',
-  '**' + TAMPER_SG + '/hooks/**',
-  '**' + TAMPER_SG + '/policy.json',
-  '**' + TAMPER_SG + '/.policy-cache.json',
-  '**' + TAMPER_SG + '/.policy-cache-*.json',
-  '**' + TAMPER_SG + '/.pi-config-cache.json',
-  '**' + TAMPER_SG + '/cloud-guard.json',
-  '**' + TAMPER_SG + '/.opa-wasm-*.json',
-  '**' + TAMPER_SG + '/.ratelimit-*.json',
-  // Persistent host data (DB + audit JSONL) at ~/.solongate/data
-  '**' + TAMPER_SG + '/data/**',
-  // Customer install layout (zip extracted as solongate/)
-  '**' + TAMPER_INSTALL + '/compose/**',
-  '**' + TAMPER_INSTALL + '/data/**',
-  '**' + TAMPER_INSTALL + '/images/**',
-  '**' + TAMPER_INSTALL + '/helm/**',
-  '**' + TAMPER_INSTALL + '/solongate.exe',
-  '**' + TAMPER_INSTALL + '/setup.sh',
-];
-const TAMPER_BASENAMES = [
-  'guard.mjs', 'audit.mjs', 'stop.mjs',
-  'policy.json', '.policy-cache.json',
-  '.pi-config-cache.json', 'cloud-guard.json',
-  // Customer install: DB and wizard exe
-  'solongate.db', 'solongate.exe',
-];
-const TAMPER_PATH_FIELDS = new Set([
-  'file_path', 'path', 'target_file', 'notebook_path',
-  'dest', 'destination', 'source', 'src', 'from', 'to',
-  'directory', 'dir', 'folder',
-]);
-
-function normTamperPath(p) {
-  return String(p || '').replace(/\\/g, '/').toLowerCase();
-}
-
-function isProtectedPath(p) {
-  if (!p) return false;
-  const np = normTamperPath(p);
-  for (const abs of TAMPER_PROTECTED_ABS) {
-    if (np === abs || np.startsWith(abs + '/')) return abs;
-  }
-  for (const g of TAMPER_PROTECTED_GLOBS) {
-    if (matchPathGlob(np, g)) return g;
-  }
-  if (/\/\.claude\/settings(\.local)?\.json$/.test(np)) return 'settings.json';
-  if (/\/\.solongate\/hooks(\/|$)/.test(np)) return 'solongate-hooks';
-  return false;
-}
-
-function commandTargetsProtected(cmd) {
-  const c = String(cmd || '').toLowerCase();
-  if (!c) return false;
-  for (const b of TAMPER_BASENAMES) {
-    if (c.includes(b.toLowerCase())) return b;
-  }
-  if (/\.claude[\\/]+settings(\.local)?\.json/.test(c)) return 'settings.json';
-  if (/\.solongate[\\/]+hooks/.test(c)) return 'solongate-hooks';
-  // Customer install dirs
-  if (/[\\/]solongate[\\/]+(compose|data|images|helm)[\\/]/.test(c)) return 'solongate-install';
-  // Mutating API calls against policies / audit-logs endpoints
-  const mutating = /\b(post|put|delete|patch)\b/.test(c) ||
-                   /(-x|--request|-method)\s+(post|put|delete|patch)\b/.test(c);
-  if (mutating && /api\/v1\/(policies|audit-logs)/.test(c)) return 'api-policies-mutation';
-  return false;
-}
-
-function extractTargetPaths(args) {
-  const out = [];
-  if (typeof args !== 'object' || !args) return out;
-  for (const [k, v] of Object.entries(args)) {
-    const lk = k.toLowerCase();
-    if (TAMPER_PATH_FIELDS.has(lk) && typeof v === 'string') out.push(v);
-    if (Array.isArray(v)) {
-      for (const item of v) {
-        if (item && typeof item === 'object') {
-          for (const [k2, v2] of Object.entries(item)) {
-            if (TAMPER_PATH_FIELDS.has(k2.toLowerCase()) && typeof v2 === 'string') out.push(v2);
-          }
-        }
-      }
-    }
-  }
-  return out;
-}
-
-function tamperCheck(toolName, args) {
-  const tn = String(toolName || '').toLowerCase();
-  const isExec = TAMPER_GUARD_TOOLS_EXEC.has(tn) || /bash|shell|exec|powershell|cmd|run|eval/.test(tn);
-  // ANY tool that targets a protected path is blocked — READ as well as write.
-  // An AI must not even read SolonGate's own protection files. This is enforced
-  // at the tool boundary; the hooks themselves are run by node directly (not via
-  // a Claude Code tool), so node still loads/executes them normally.
-  // Check the tool's TARGET PATH fields only (file_path, path, …) — never the
-  // free-form content/body, which would false-positive on any file that merely
-  // mentions a protected path in its text.
-  for (const p of extractTargetPaths(args)) {
-    const hit = isProtectedPath(p);
-    if (hit) return 'Tamper protection: access to "' + p + '" is blocked (protected: ' + hit + ')';
-  }
-  if (isExec) {
-    for (const cmd of extractCommands(args)) {
-      const hit = commandTargetsProtected(cmd);
-      if (hit) return 'Tamper protection: command references protected resource "' + hit + '" — blocked';
-    }
-  }
-  return null;
-}
-
-// ── Extra security layers (rate limit, egress allowlist, DLP block) ──
-// These are configured per-project in the dashboard and delivered to the guard
-// via /policies/active (security). All fail OPEN: any error here returns null
-// (allow) so a config glitch never bricks the agent. Tamper protection and
-// policy are unaffected and still run.
-
-// DLP patterns mirror the server's set (apps/api/src/lib/security-layers.ts).
-// Mirrors apps/api/src/lib/security-layers.ts DLP_PATTERNS. Provider-specific
-// rules plus generic Bearer / secret-assignment catch-alls for the long tail.
-const DLP_PATTERNS = [
-  { name: 'AWS access key', re: /AKIA[0-9A-Z]{16}/ },
-  { name: 'private key block', re: /-----BEGIN [A-Z ]*PRIVATE KEY-----/ },
-  { name: 'Anthropic key', re: /sk-ant-[A-Za-z0-9_-]{20,}/ },
-  { name: 'OpenAI key', re: /sk-(proj-)?[A-Za-z0-9_-]{20,}/ },
-  { name: 'GitHub token', re: /gh[pousr]_[A-Za-z0-9]{20,}/ },
-  { name: 'GitHub fine-grained PAT', re: /github_pat_[A-Za-z0-9_]{20,}/ },
-  { name: 'GitLab token', re: /glpat-[A-Za-z0-9_-]{20,}/ },
-  { name: 'Slack token', re: /xox[baprs]-[A-Za-z0-9-]{10,}/ },
-  { name: 'Stripe key', re: /[sr]k_(live|test)_[A-Za-z0-9]{20,}/ },
-  { name: 'SendGrid key', re: /SG\.[A-Za-z0-9_-]{16,}\.[A-Za-z0-9_-]{16,}/ },
-  { name: 'Twilio key', re: /SK[0-9a-fA-F]{32}/ },
-  { name: 'npm token', re: /npm_[A-Za-z0-9]{36}/ },
-  { name: 'JWT', re: /eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/ },
-  { name: 'Bearer token', re: /bearer\s+[A-Za-z0-9._-]{20,}/i },
-];
-
-// Custom patterns are GLOBs: `*` = any run of non-whitespace, same wildcard
-// mechanic as policy/ghost.
-function dlpGlobToRe(glob) {
-  let re = '';
-  for (const ch of String(glob || '')) {
-    if (ch === '*') re += '[^\\s]*';
-    else if ('.+?^${}()|[]\\'.indexOf(ch) !== -1) re += '\\' + ch;
-    else re += ch;
-  }
-  return new RegExp(re);
-}
-// Scan args against the enabled built-in patterns + any user custom patterns.
-// `cfg` = { patterns: string[], custom: {name,re}[] }.
-function dlpScan(args, cfg) {
-  if (!cfg) return null;
-  let text = '';
-  try { text = JSON.stringify(args || {}); } catch { return null; }
-  const allow = new Set(Array.isArray(cfg.patterns) ? cfg.patterns : []);
-  for (const p of DLP_PATTERNS) {
-    if (allow.has(p.name) && p.re.test(text)) return p.name;
-  }
-  for (const c of Array.isArray(cfg.custom) ? cfg.custom : []) {
-    try { if (dlpGlobToRe(c.re).test(text)) return c.name || 'custom pattern'; } catch { /* skip invalid */ }
-  }
-  return null;
-}
-
-// ── Ghost paths ──
-// Files/dirs matching a ghost glob are INVISIBLE to the agent. This module is
-// mirrored verbatim in audit.mjs (the PostToolUse twin that strips them from
-// output). Keep the two copies in sync.
-//
-// Split of responsibility:
-//   - PreToolUse (here): block MUTATIONS (write/edit/delete/move) targeting a
-//     ghost path, returning a plain "No such file or directory" — never a
-//     SolonGate/policy message — so the path looks like it simply doesn't exist.
-//   - PostToolUse (audit.mjs): strip ghost entries from listings and rewrite
-//     direct reads to not-found. Reads are NOT blocked here so the agent gets a
-//     natural "missing file" rather than a visible hook block.
-function ghostGlobToRegExp(glob) {
-  let re = '';
-  for (let i = 0; i < glob.length; i++) {
-    const c = glob[i];
-    if (c === '*') {
-      if (glob[i + 1] === '*') { re += '.*'; i++; }
-      else re += '[^/]*';
-    } else if (c === '?') re += '[^/]';
-    else if ('\\^$.|+()[]{}'.indexOf(c) !== -1) re += '\\' + c;
-    else re += c;
-  }
-  try { return new RegExp('^' + re + '$'); } catch { return null; }
-}
-
-// True if `targetPath` is ghosted by any pattern. A bare name (`.data`) matches
-// that entry anywhere in the path; a trailing `/` (`secrets/`) ghosts a whole
-// directory subtree; a pattern with `/` is matched against the full path.
-function ghostMatch(targetPath, patterns) {
-  if (!targetPath || !Array.isArray(patterns) || patterns.length === 0) return false;
-  const norm = String(targetPath).replace(/\\/g, '/').replace(/\/+$/, '');
-  if (!norm) return false;
-  const segments = norm.split('/').filter(Boolean);
-  const base = segments.length ? segments[segments.length - 1] : norm;
-  for (let pat of patterns) {
-    pat = String(pat || '').trim();
-    if (!pat) continue;
-    let dirOnly = false;
-    if (pat.endsWith('/')) { dirOnly = true; pat = pat.slice(0, -1); }
-    if (!pat) continue;
-    const hasSlash = pat.indexOf('/') !== -1;
-    const hasWild = /[*?]/.test(pat);
-    const re = ghostGlobToRegExp(pat);
-    if (!re) continue;
-    if (dirOnly) {
-      // Directory: ghost the dir itself and everything under it.
-      if (!hasSlash && !hasWild) { if (segments.indexOf(pat) !== -1) return true; continue; }
-      let acc = '';
-      for (const s of segments) { acc = acc ? acc + '/' + s : s; if (re.test(acc) || re.test(s)) return true; }
-      continue;
-    }
-    if (!hasSlash) {
-      // Name glob: match basename or any single path segment.
-      if (re.test(base)) return true;
-      if (segments.some((s) => re.test(s))) return true;
-      continue;
-    }
-    // Path glob (contains '/'): match the full normalized path.
-    if (re.test(norm)) return true;
-  }
-  return false;
-}
-
-// Strip shell decoration from a token so it can be tested as a path:
-// surrounding quotes, redirection operators, trailing punctuation.
-function ghostCleanToken(tok) {
-  let t = String(tok || '').trim();
-  t = t.replace(/^[<>|;&(]+/, '').replace(/[);&|]+$/, '');
-  t = t.replace(/^['"]+/, '').replace(/['"]+$/, '');
-  t = t.replace(/^\d*>>?/, ''); // strip leading redirection like 2>
-  return t.trim();
-}
-
-// Returns a plain not-found message if a tool DIRECTLY targets a ghost path —
-// read OR write — else null. Reads are sealed too: a hidden file must be
-// inaccessible, not merely unlisted, so `cat A/Y/.data` looks as absent as
-// `rm A/Y`. Listing a PARENT dir that only CONTAINS a ghost child is NOT a
-// direct hit (no token equals the ghost) and falls through to the listing
-// rewrite. Never returns a branded/policy string.
-function ghostBlock(toolName, args, ghostCfg) {
-  if (!ghostCfg || !Array.isArray(ghostCfg.patterns) || ghostCfg.patterns.length === 0) return null;
-  const pats = ghostCfg.patterns;
-  const name = (toolName || '');
-  const notFound = (p) => p + ': No such file or directory';
-  try {
-    // Tools that carry an explicit path argument.
-    if (name === 'Write' || name === 'Edit' || name === 'MultiEdit' || name === 'NotebookEdit' ||
-        name === 'Read' || name === 'NotebookRead' || name === 'LS') {
-      const p = args?.file_path || args?.notebook_path || args?.path || '';
-      if (p && ghostMatch(p, pats)) return notFound(p);
-      return null;
-    }
-    if (name === 'Glob' || name === 'Grep') {
-      const p = args?.path || '';
-      const pat = args?.pattern || args?.glob || '';
-      if (p && ghostMatch(p, pats)) return notFound(p);
-      if (pat && ghostMatch(pat, pats)) return notFound(String(pat));
-      return null;
-    }
-    // Bash & other exec: deny if any token directly names a ghost path. Seals
-    // direct reads (cat/head/less/…) and mutations (rm/mv/…) alike. A listing of
-    // a parent dir has no ghost token and falls through to the rewrite.
-    if (name === 'Bash' || name === 'BashOutput' || guessPermission(name) === 'EXECUTE') {
-      const cmd = String(args?.command || '');
-      if (!cmd) return null;
-      for (const raw of cmd.split(/\s+/)) {
-        const tok = ghostCleanToken(raw);
-        if (tok && tok.indexOf('-') !== 0 && ghostMatch(tok, pats)) return notFound(tok);
-      }
-    }
-  } catch { /* fail open */ }
-  return null;
-}
-
-// Shell single-quote a string.
-function ghostShq(s) { return "'" + String(s).replace(/'/g, "'\\''") + "'"; }
-
-// If `args.command` is a simple directory listing, return a rewritten command
-// that pipes its output through a filter dropping the ghost entries — so the
-// agent never sees them. Returns null when there's nothing to rewrite. Only
-// touches bare `ls` listings (no pipe/redirect/compound) to stay safe; richer
-// output formats are handled by the PostToolUse filter on clients that honor it.
-function ghostListingRewrite(args, ghostCfg) {
-  if (!ghostCfg || !Array.isArray(ghostCfg.patterns) || ghostCfg.patterns.length === 0) return null;
-  const cmd = String(args?.command || '');
-  if (!cmd) return null;
-  if (/[|>;&\n`]/.test(cmd)) return null;                            // no shell composition
-  if (!/^\s*(ls|ll|dir|find|tree|exa|lsd|fd)(\s|$)/.test(cmd)) return null;
-  // Translate each hidden glob to an ERE alternative, then match it as a whole
-  // path component, the whole line, or the trailing token — covers `ls`,
-  // `ls -la`, `find` and `tree`. A trailing slash (dir) is dropped.
-  const alts = [];
-  for (let p of ghostCfg.patterns) {
-    p = String(p).replace(/\/$/, '');
-    if (!p) continue;
-    let re = '';
-    for (let i = 0; i < p.length; i++) {
-      const c = p[i];
-      if (c === '*') { if (p[i + 1] === '*') { re += '.*'; i++; } else re += '[^/]*'; }
-      else if (c === '?') re += '[^/]';
-      else if ('.^$+(){}[]|\\/'.indexOf(c) >= 0) re += '\\' + c;
-      else re += c;
-    }
-    alts.push(re);
-  }
-  if (alts.length === 0) return null;
-  // grep -vE drops any line where a hidden name appears as a path component, the
-  // whole line, or the final token. Single-quoted so the shell leaves it intact.
-  const ere = '(^|/| )(' + alts.join('|') + ')(/|$)';
-  return cmd + " | grep -vE '" + ere.replace(/'/g, "'\\''") + "'";
-}
-
-// Multi-window sliding rate limit, persisted under ~/.solongate (tamper-protected
-// from the agent, writable by the guard). One timestamps file per agent, pruned
-// to the last 24h and capped for performance; counts this agent's calls within
-// each enabled window (minute/hour/day). Returns the exceeded window or null.
-const RL_WINDOWS = [
-  { key: 'perDay', ms: 86400000, label: 'day' },
-  { key: 'perHour', ms: 3600000, label: 'hour' },
-  { key: 'perMinute', ms: 60000, label: 'minute' },
-];
-function rateLimitCheck(agentKey, limits) {
-  try {
-    const file = join(resolve(homedir(), '.solongate'), '.ratelimit-' + agentKey + '.json');
-    const now = Date.now();
-    let stamps = [];
-    if (existsSync(file)) {
-      try { stamps = JSON.parse(readFileSync(file, 'utf-8')); } catch { stamps = []; }
-    }
-    if (!Array.isArray(stamps)) stamps = [];
-    // Prune to the longest window (24h) and cap size to bound work/IO.
-    stamps = stamps.filter((t) => typeof t === 'number' && now - t < 86400000);
-    if (stamps.length > 50000) stamps = stamps.slice(-50000);
-    // Check each enabled window against the current count (before adding now).
-    for (const w of RL_WINDOWS) {
-      const limit = limits[w.key];
-      if (limit > 0) {
-        const count = stamps.reduce((n, t) => (now - t < w.ms ? n + 1 : n), 0);
-        if (count >= limit) return { window: w.label, limit };
-      }
-    }
-    stamps.push(now);
-    try { writeFileSync(file, JSON.stringify(stamps)); } catch {}
-    return null;
-  } catch {
-    return null; // fail open
-  }
-}
-
-// Runs all enabled enforcement layers; returns a deny reason or null (allow).
-function securityLayerCheck(toolName, args, cfg, agentKey) {
-  if (!cfg) return null;
-  try {
-    if (cfg.dlpBlock) {
-      const hit = dlpScan(args, cfg.dlpBlock);
-      if (hit) return 'Security layer (DLP): blocked - arguments contain a ' + hit +
-        '. Blocked by SolonGate - check your dashboard for details.';
-    }
-    if (cfg.rateLimit) {
-      const hit = rateLimitCheck(agentKey, cfg.rateLimit);
-      if (hit) {
-        return 'Security layer (rate limit): exceeded ' + hit.limit + ' calls/' + hit.window +
-          ' for this agent. Blocked by SolonGate - check your dashboard to review or adjust the limit.';
-      }
-    }
-  } catch { /* fail open */ }
-  return null;
-}
-
-// ── Policy Evaluation ──
-
-// Permission filter: a rule with rule.permission set only applies to tool
-// calls whose guessed permission category is in that list. Empty/missing =
-// applies to all categories.
-function permissionApplies(rule, toolName) {
-  if (!rule.permission) return true;
-  const perms = Array.isArray(rule.permission) ? rule.permission : [rule.permission];
-  if (perms.length === 0) return true;
-  const guessed = guessPermission(toolName);
-  return perms.includes(guessed);
-}
-
-// Returns the first pattern that any of the rule's constraints matches against
-// the args, or null if nothing matches. Used for both DENY (engine blocks on
-// match) and ALLOW (whitelist mode requires at least one match).
-// Each constraint may store its pattern list in either `denied` or `allowed`
-// depending on which effect the rule was created with in the dashboard. The
-// hook treats both as the same "pattern list" — the rule's effect determines
-// whether a match means block (DENY) or pass (ALLOW in whitelist mode).
-function patternsOf(constraint) {
-  if (!constraint) return null;
-  const list = constraint.denied || constraint.allowed;
-  return Array.isArray(list) && list.length > 0 ? list : null;
-}
-
-function ruleMatches(rule, args, isExec) {
-  const fnPats = patternsOf(rule.filenameConstraints);
-  if (fnPats) {
-    const filenames = extractFilenames(args);
-    for (const fn of filenames) {
-      for (const pat of fnPats) {
-        if (matchGlob(fn, pat)) return { kind: 'filename', value: fn, pattern: pat };
-      }
-    }
-  }
-  const urlPats = patternsOf(rule.urlConstraints);
-  if (urlPats) {
-    const urls = extractUrls(args);
-    for (const url of urls) {
-      for (const pat of urlPats) {
-        if (matchGlob(url, pat)) return { kind: 'URL', value: url, pattern: pat };
-      }
-    }
-  }
-  const cmdPats = patternsOf(rule.commandConstraints);
-  if (cmdPats) {
-    const cmds = extractCommands(args);
-    for (const cmd of cmds) {
-      for (const pat of cmdPats) {
-        if (matchGlob(cmd, pat)) return { kind: 'command', value: cmd.slice(0, 60), pattern: pat };
-      }
-    }
-  }
-  const pathPats = patternsOf(rule.pathConstraints);
-  if (pathPats) {
-    const paths = extractPaths(args, isExec);
-    for (const p of paths) {
-      for (const pat of pathPats) {
-        if (matchPathGlob(p, pat)) return { kind: 'path', value: p, pattern: pat };
-      }
-    }
-  }
-  return null;
-}
-
-// Evaluate policy. Two modes:
-//   denylist (default): default ALLOW. Any DENY rule that matches → block.
-//   whitelist (strict): default DENY. Must match at least one ALLOW rule to
-//                       pass. DENY rules still override on top.
-function evaluate(policy, args, toolName) {
-  if (!policy || !policy.rules) return null;
-  const enabledRules = policy.rules.filter(r => r.enabled !== false);
-  const mode = policy.mode === 'whitelist' ? 'whitelist' : 'denylist';
-  const isExec = /bash|shell|exec|powershell|cmd|run|eval/.test((toolName || '').toLowerCase());
-
-  // DENY pass — runs in both modes. DENY wins over ALLOW.
-  const denyRules = enabledRules
-    .filter(r => r.effect === 'DENY' && permissionApplies(r, toolName))
-    .sort((a, b) => (a.priority || 100) - (b.priority || 100));
-  for (const rule of denyRules) {
-    const m = ruleMatches(rule, args, isExec);
-    if (m) return 'Blocked by policy: ' + m.kind + ' "' + m.value + '" matches "' + m.pattern + '"';
-  }
-
-  // Whitelist pass — only in strict mode. Must match at least one ALLOW rule.
-  if (mode === 'whitelist') {
-    const allowRules = enabledRules.filter(r => r.effect === 'ALLOW' && permissionApplies(r, toolName));
-    if (allowRules.length === 0) {
-      return 'Blocked by policy: strict whitelist mode is on and no ALLOW rule applies to ' + (toolName || 'this tool');
-    }
-    let matched = false;
-    for (const rule of allowRules) {
-      if (ruleMatches(rule, args, isExec)) { matched = true; break; }
-    }
-    if (!matched) {
-      return 'Blocked by policy: strict whitelist mode — request does not match any ALLOW rule';
-    }
-  }
-
-  return null;
-}
-
-// ── OPA WASM Evaluation (NIST SP 800-207 PDP) ──
-//
-// When the API has compiled this policy to an OPA WASM bundle AND the
-// @open-policy-agent/opa-wasm runtime is resolvable, we evaluate through OPA
-// instead of the hand-written evaluate() above. This is the same decision
-// engine the MCP proxy uses (packages/policy-engine/src/opa).
-//
-// Graceful degradation is the contract: any missing piece (no bundle, no
-// runtime, fetch/parse/eval error) makes evaluateWithOpa() return `undefined`,
-// and the caller falls back to the legacy JS evaluate() — so air-gapped
-// installs without OPA see ZERO behavior change.
-
-// Cheap, dependency-free djb2 fingerprint to detect policy changes for caching.
-function djb2(str) {
-  let h = 5381;
-  for (let i = 0; i < str.length; i++) h = ((h << 5) + h + str.charCodeAt(i)) | 0;
-  return (h >>> 0).toString(36);
-}
-
-// Extracts /policy.wasm from an OPA bundle. Mirrors
-// packages/policy-engine/src/opa/opa-evaluator.ts extractWasmFromBundle().
-// The bundle may be a gzipped tar (.tar.gz from `opa build -t wasm`) or raw WASM.
-function extractWasmFromBundle(buf) {
-  if (buf[0] === 0x1f && buf[1] === 0x8b) {
-    const tar = gunzipSync(buf);
-    let offset = 0;
-    while (offset < tar.length - 512) {
-      const nameEnd = tar.indexOf(0, offset);
-      const name = tar.subarray(offset, Math.min(nameEnd, offset + 100)).toString('utf-8');
-      if (!name || name.length === 0) break;
-      const sizeStr = tar.subarray(offset + 124, offset + 136).toString('utf-8').trim();
-      const size = parseInt(sizeStr, 8) || 0;
-      offset += 512;
-      if (name === 'policy.wasm' || name === './policy.wasm' || name.endsWith('/policy.wasm')) {
-        return Buffer.from(tar.subarray(offset, offset + size));
-      }
-      offset += Math.ceil(size / 512) * 512;
-    }
-    throw new Error('policy.wasm not found in OPA bundle');
-  }
-  if (buf[0] === 0x00 && buf[1] === 0x61 && buf[2] === 0x73 && buf[3] === 0x6d) {
-    return buf; // already raw WASM
-  }
-  throw new Error('Unknown OPA bundle format');
-}
-
-// Fetches the compiled WASM for this policy from the API, with a local cache
-// keyed by a fingerprint of the policy so updates propagate. Returns the raw
-// policy.wasm bytes (Uint8Array) or null when unavailable.
-const OPA_WASM_TTL_MS = 30_000;
-async function getOpaWasmBytes(policy) {
-  if (!policy || !policy.id) return null;
-  const fp = djb2(JSON.stringify(policy.rules || []) + '|' + (policy.mode || ''));
-  const agentKey = (AGENT_ID || 'default').replace(/[^a-zA-Z0-9_-]/g, '_');
-  const cacheFile = join(resolve(homedir(), '.solongate'), '.opa-wasm-' + agentKey + '.json');
-
-  // Read any cached bundle. A "fresh" hit (same policy fingerprint, within TTL)
-  // is returned immediately; otherwise we keep it as `stale` to fall back on if
-  // the API is momentarily unreachable — so transient downtime never drops OPA.
-  let stale = null;
-  try {
-    if (existsSync(cacheFile)) {
-      const c = JSON.parse(readFileSync(cacheFile, 'utf-8'));
-      if (c && c.wasm) {
-        stale = new Uint8Array(Buffer.from(c.wasm, 'base64'));
-        if (c.fp === fp && c._ts && Date.now() - c._ts < OPA_WASM_TTL_MS) {
-          return stale;
-        }
-      }
-    }
-  } catch {}
-
-  // Fetch the compiled bundle from the API (route already exists).
-  try {
-    const res = await fetch(
-      API_URL + '/api/v1/policies/' + encodeURIComponent(policy.id) + '/wasm',
-      { headers: AUTH_HEADERS, signal: AbortSignal.timeout(8000) },
-    );
-    if (!res.ok) return stale; // API has no compiled WASM right now → last known good
-    const bundle = Buffer.from(await res.arrayBuffer());
-    const wasm = extractWasmFromBundle(bundle);
-    try {
-      mkdirSync(resolve(homedir(), '.solongate'), { recursive: true });
-      writeFileSync(cacheFile, JSON.stringify({ _ts: Date.now(), fp, wasm: Buffer.from(wasm).toString('base64') }));
-    } catch {}
-    return new Uint8Array(wasm);
-  } catch {
-    return stale; // transient network failure → last known good
-  }
-}
-
-// Lazily load the opa-wasm runtime. Returns the loadPolicy fn or null if the
-// package isn't installed in this environment (typical for air-gapped hooks).
-let _loadPolicyFn = null;
-let _loadPolicyTried = false;
-async function getLoadPolicy() {
-  if (_loadPolicyTried) return _loadPolicyFn;
-  _loadPolicyTried = true;
-  try {
-    const mod = await import('@open-policy-agent/opa-wasm');
-    _loadPolicyFn = mod.loadPolicy || (mod.default && mod.default.loadPolicy) || null;
-  } catch {
-    _loadPolicyFn = null;
-  }
-  return _loadPolicyFn;
-}
-
-// Evaluates the policy through OPA WASM. Returns:
-//   - a reason string  → DENY
-//   - null             → ALLOW (OPA decided, no violation)
-//   - undefined        → OPA unavailable, caller must fall back to evaluate()
-async function evaluateWithOpa(policy, args, toolName, cwd) {
-  if (!policy || !policy.rules) return undefined;
-  try {
-    const loadPolicy = await getLoadPolicy();
-    if (!loadPolicy) return undefined;
-    const wasmBytes = await getOpaWasmBytes(policy);
-    if (!wasmBytes) return undefined;
-
-    const opaPolicy = await loadPolicy(wasmBytes, { initial: 5 });
-    // trust_level is fixed to 'TRUSTED' to preserve legacy guard.mjs behavior,
-    // which never evaluated minimumTrustLevel constraints.
-    // If the tool call references files (bash X.sh, source X, etc.), inline
-    // their contents so the SAME deterministic extractors see hidden commands.
-    // The hook reads files itself; OPA gets a flat, expanded view — no LLM
-    // needed for hidden-in-file detection at this layer.
-    // Inline referenced-file CONTENT only for tools that EXECUTE a script
-    // (`bash X.sh` → X.sh would run, so its contents matter). For read/write
-    // tools the file is data, not code — inlining its content there causes false
-    // positives (e.g. reading a file that merely mentions ".env" tripping an
-    // *.env rule, or reading a script that documents `rm -rf`).
-    const isExecTool = /bash|shell|exec|powershell|cmd|run|eval/.test((toolName || '').toLowerCase());
-    const refFiles = (isExecTool && typeof readReferencedFiles === 'function')
-      ? readReferencedFiles(args, cwd || process.cwd())
-      : {};
-    const expandedArgs = { ...((args && typeof args === 'object') ? args : {}) };
-    for (const [, content] of Object.entries(refFiles)) {
-      const lines = String(content).split('\n')
-        .map(l => l.trim())
-        .filter(l => l && !l.startsWith('#'));
-      if (lines.length > 0) {
-        const extra = lines.join('; ');
-        if (typeof expandedArgs.command === 'string') {
-          expandedArgs.command = expandedArgs.command + '; ' + extra;
-        } else {
-          expandedArgs.command = extra;
-        }
-      }
-    }
-    // Matching a filename/URL/path that appears in a tool BODY (content,
-    // new_string, text, …) only makes sense for EXEC tools, where that text would
-    // RUN. For read/write tools the body is data, not access — writing a doc that
-    // merely mentions a secret-file pattern is not accessing one. So strip body
-    // fields before extracting access targets; the command fields (what actually
-    // executes) are always scanned via extractCommands.
-    // (isExecTool already computed above for the referenced-file inlining gate.)
-    // For NON-exec tools, only the explicit path/target fields are an "access" —
-    // arbitrary text fields (a question, a description, a file body) are data, not
-    // access, and must not be matched against filename/path/url rules. So scan an
-    // ALLOWLIST of target fields only. Exec tools scan the full command instead.
-    // Includes network/url-bearing fields (url, uri, …) so non-exec network
-    // tools (Fetch/WebFetch) keep their access target — otherwise the url field
-    // is stripped here, input.urls comes out empty, and urlConstraints DENY
-    // rules never match (a fetch to a blocked host slips through).
-    const ACCESS_FIELDS = new Set(['file_path', 'path', 'target_file', 'notebook_path', 'filename', 'dest', 'destination', 'source', 'src', 'from', 'to', 'directory', 'dir', 'folder', 'url', 'urls', 'uri', 'href', 'link', 'endpoint']);
-    let accessArgs = expandedArgs;
-    if (!isExecTool && expandedArgs && typeof expandedArgs === 'object') {
-      accessArgs = {};
-      for (const [k, v] of Object.entries(expandedArgs)) {
-        if (ACCESS_FIELDS.has(k.toLowerCase())) accessArgs[k] = v;
-      }
-    }
-    const input = {
-      tool_name: toolName || '',
-      permission: guessPermission(toolName),
-      trust_level: 'TRUSTED',
-      arguments: expandedArgs,
-      paths: extractPaths(accessArgs, isExecTool),
-      commands: extractCommands(expandedArgs),
-      urls: extractUrls(accessArgs),
-      filenames: extractFilenames(accessArgs),
-    };
-    if (process.env.SOLONGATE_DEBUG) {
-    }
-    const results = opaPolicy.evaluate(input);
-    const decision = results && results[0] && results[0].result;
-    if (!decision || !decision.effect) return null;
-
-    // The generated Rego always has `default decision := DENY` (whitelist
-    // semantics). We must re-apply the policy mode here so denylist policies
-    // keep their default-ALLOW behavior, matching legacy evaluate():
-    //   - denylist: default-allow → block ONLY when a DENY rule actually
-    //     matched (matched_rule != null). Default DENY means "no rule matched".
-    //   - whitelist: default-deny → block on any DENY (default or matched).
-    // Routing per policy mode semantics:
-    //
-    //   DENYLIST (default-allow):
-    //     DENY match  → BLACK (block)
-    //     no match    → WHITE (default-allow, skip AI Judge — this IS the
-    //                   semantics of denylist: "block these, allow the rest")
-    //     REVIEW match → GRAY (only this explicit effect calls AI Judge)
-    //
-    //   WHITELIST (default-deny):
-    //     ALLOW match → WHITE (skip AI Judge)
-    //     DENY match  → BLACK
-    //     REVIEW match → GRAY
-    //     no match    → BLACK (default-deny)
-    //
-    // AI Judge runs ONLY when a rule explicitly says "this needs semantic
-    // review" — never as a fallback for "I'm not sure". That keeps token cost
-    // proportional to actual ambiguity and avoids running the model on every
-    // routine call.
-    const mode = policy.mode === 'whitelist' ? 'whitelist' : 'denylist';
-    const matched = decision.matched_rule != null;
-    const eff = decision.effect;
-    if (mode === 'denylist') {
-      if (eff === 'DENY' && matched) return '[SolonGate OPA] ' + (decision.reason || 'Blocked by policy');
-      if (eff === 'REVIEW' && matched) return { white: false, reason: decision.reason, ruleId: decision.matched_rule };
-      return { white: true, ruleId: matched ? decision.matched_rule : null };
-    }
-    // whitelist
-    if (eff === 'DENY' && matched) return '[SolonGate OPA] ' + (decision.reason || 'Blocked by policy');
-    if (eff === 'REVIEW' && matched) return { white: false, reason: decision.reason, ruleId: decision.matched_rule };
-    if (eff === 'ALLOW' && matched) return { white: true, ruleId: decision.matched_rule };
-    return '[SolonGate OPA] ' + (decision.reason || 'Blocked by policy: no ALLOW rule matched');
-  } catch {
-    return undefined; // any failure → fall back to legacy evaluator
-  }
-}
-
-// ── Main ──
-let input = '';
-// Read the contents of files a tool call references, so the AI Judge can see a
-// command HIDDEN inside a script/file (e.g. `bash deploy.sh`). Bounded: at most
-// a few small text files. Returns { name: content }.
-function readReferencedFiles(args, cwd) {
-  const out = {};
-  const MAX_FILES = 3, MAX_BYTES = 65536;
-  const cands = new Set();
-  // Only inline a file that is actually EXECUTED by an interpreter — `bash x.sh`,
-  // `python x.py`, `source x`, `. x`. A file that is merely an argument (rm/cp/cat
-  // x, or a read/write target) is NOT run, so its content must NOT be scanned —
-  // otherwise deleting a file whose text mentions a blocked name would false-block.
-  const INTERP = /^(?:bash|sh|zsh|ksh|dash|ash|python3?|node|deno|bun|ruby|perl|php|pwsh|powershell|source|\.)$/i;
-  if (args && typeof args === 'object') {
-    for (const f of ['command', 'cmd', 'script', 'shell', 'code']) {
-      const v = args[f];
-      if (typeof v !== 'string') continue;
-      const toks = v.split(/[\s'"();|&<>]+/).filter(Boolean);
-      for (let i = 0; i < toks.length - 1; i++) {
-        if (!INTERP.test(toks[i])) continue;
-        // The first non-flag token after the interpreter is the script it runs.
-        let j = i + 1;
-        while (j < toks.length && toks[j].startsWith('-')) j++;
-        if (j < toks.length) cands.add(toks[j]);
-      }
-    }
-  }
-  let n = 0;
-  for (const c of cands) {
-    if (n >= MAX_FILES) break;
-    try {
-      const p = resolve(cwd || process.cwd(), c);
-      if (!existsSync(p)) continue;
-      const st = statSync(p);
-      if (!st.isFile() || st.size > MAX_BYTES) continue;
-      out[c] = readFileSync(p, 'utf-8').slice(0, MAX_BYTES);
-      n++;
-    } catch {}
-  }
-  return out;
-}
-
-process.stdin.on('data', c => input += c);
-process.stdin.on('end', async () => {
-  // No policy selected => no enforcement. A plain launch (no SOLONGATE_AGENT_ID)
-  // is intentionally unrestricted.
-  if (process.env.SOLONGATE_DEBUG) {
-  }
-  // Cloud gate: the API key IS the policy selector — it identifies the project
-  // and its active policy. No key → nothing to enforce → allow. (Air-gap gated
-  // on SOLONGATE_AGENT_ID instead; here the key does that job.)
-  if (!API_KEY) {
-    allowTool();
-    return;
-  }
-  const _evalStart = Date.now();
-  try {
-    const raw = JSON.parse(input);
-
-    // Debug: append guard invocation to a cwd-local log. Opt-in only — set
-    // SOLONGATE_DEBUG=1 to enable. Off by default so it doesn't litter every
-    // working directory with .solongate/.debug-guard-log.
-    if (process.env.SOLONGATE_DEBUG) {
-      try {
-        const { appendFileSync: afs, mkdirSync: mds } = await import('node:fs');
-        mds(resolve('.solongate'), { recursive: true });
-        const debugLine = JSON.stringify({ ts: new Date().toISOString(), hook: 'guard', argv: process.argv.slice(2), tool_name: raw.tool_name || raw.toolName || raw.command, agent_id: AGENT_ID }) + '\n';
-        afs(resolve('.solongate', '.debug-guard-log'), debugLine);
-      } catch {}
-    }
-
-    let mappedToolName = raw.tool_name || raw.toolName || '';
-    let mappedToolInput = raw.tool_input || raw.toolInput || raw.params || {};
-
-    // Normalize field names across tools
-    const data = {
-      ...raw,
-      tool_name: mappedToolName,
-      tool_input: mappedToolInput,
-      tool_response: raw.tool_response || raw.toolResponse || {},
-      cwd: raw.cwd || process.cwd(),
-      session_id: raw.session_id || raw.sessionId || raw.conversation_id || '',
-    };
-    const args = data.tool_input;
-    const toolName = data.tool_name || '';
-
-    // (self-protection + PI hook layers removed per project decision)
-
-    // Load policy. Priority:
-    //   1. Dashboard-managed policy (GET /api/v1/policies/active, cached 10s)
-    //   2. Local policy.json next to cwd
-    // The dashboard is the source of truth — local policy.json is only a
-    // fallback for when the API is unreachable.
-    const hookCwd = data.cwd || process.cwd();
-    let policy;
-    // Self-protection (tamper guard) defaults ON. The cloud per-project setting
-    // can turn it off; delivered via /policies/active and cached alongside the
-    // policy. Any failure to read it leaves protection ON (fail safe).
-    let selfProtectEnabled = true;
-    // Extra security layers (rate limit, egress, DLP block) delivered by the
-    // cloud. Null = none configured. Fail open if unread.
-    let securityCfg = null;
-    // Cache keyed by agent_id so different agents in different terminals
-    // don't share a stale cached policy.
-    const agentKey = (AGENT_ID || 'default').replace(/[^a-zA-Z0-9_-]/g, '_');
-    const policyCacheFile = join(resolve(homedir(), '.solongate'), '.policy-cache-' + agentKey + '.json');
-    const POLICY_TTL_MS = 3_000;
-    try {
-      let dashboardPolicy = null;
-      // Try cache first
-      try {
-        if (existsSync(policyCacheFile)) {
-          const cached = JSON.parse(readFileSync(policyCacheFile, 'utf-8'));
-          if (cached && cached._ts && Date.now() - cached._ts < POLICY_TTL_MS) {
-            if (cached.policy) dashboardPolicy = cached.policy;
-            if (typeof cached.selfProtect === 'boolean') selfProtectEnabled = cached.selfProtect;
-            if (cached.security !== undefined) securityCfg = cached.security;
-            if (cached.hookVersions) CLOUD_HOOK_VERSIONS = cached.hookVersions;
-          }
-        }
-      } catch {}
-      // Refresh from API if cache expired
-      if (!dashboardPolicy) {
-        try {
-          // Report our installed version (hv) so the dashboard can show whether
-          // this guard is on the latest build.
-          const res = await fetch(API_URL + '/api/v1/policies/active?agent_id=' + encodeURIComponent(AGENT_ID || '') + '&hv=' + HOOK_VERSION, { headers: AUTH_HEADERS, signal: AbortSignal.timeout(8000) });
-          if (res.ok) {
-            const body = await res.json();
-            // Capture the self-protection flag even when no cloud policy is set.
-            if (typeof body?.self_protection_enabled === 'boolean') selfProtectEnabled = body.self_protection_enabled;
-            if (body?.security !== undefined) securityCfg = body.security;
-            if (body?.hook_versions && typeof body.hook_versions === 'object') CLOUD_HOOK_VERSIONS = body.hook_versions;
-            if (body && body.policy) dashboardPolicy = body.policy;
-            try { writeFileSync(policyCacheFile, JSON.stringify({ _ts: Date.now(), policy: dashboardPolicy || null, selfProtect: selfProtectEnabled, security: securityCfg, hookVersions: CLOUD_HOOK_VERSIONS })); } catch {}
-          }
-        } catch {}
-      }
-
-      if (process.env.SOLONGATE_DEBUG) {
-      }
-      if (dashboardPolicy) {
-        policy = dashboardPolicy;
-      } else {
-        // Fall back to ~/.solongate/policy.json (where the wizard writes the
-        // default), then a per-project policy.json next to cwd.
-        const candidates = [
-          join(resolve(homedir(), '.solongate'), 'policy.json'),
-          resolve(hookCwd, 'policy.json'),
-        ];
-        for (const p of candidates) {
-          if (existsSync(p)) {
-            try { policy = JSON.parse(readFileSync(p, 'utf-8')); break; } catch {}
-          }
-        }
-      }
-    } catch {
-      // Couldn't load any policy — leave policy undefined; evaluate() returns null.
-    }
-
-    if (process.env.SOLONGATE_DEBUG) {
-    }
-    // Agent scoping
-    {
-      const scope = (policy && Array.isArray(policy.agents) && policy.agents.length > 0)
-        ? policy.agents
-        : ['*'];
-      if (!scope.includes('*') && !scope.includes(AGENT_TYPE)) {
-    allowTool();
-        return;
-      }
-    }
-
-    if (process.env.SOLONGATE_DEBUG) {
-    }
-    // Tamper / self-protection — runs before policy eval. ON by default; the
-    // per-project cloud setting can disable it (fail safe: stays on if unread).
-    let reason = selfProtectEnabled ? tamperCheck(toolName, args) : null;
-    // Ghost paths — handled BEFORE the other layers and emitted as a STEALTH
-    // block: a mutating op on a hidden path is denied with a bare OS-style
-    // "No such file or directory" and NOTHING else (no ROUTE line, no SolonGate
-    // wording), so the agent can't tell the path is protected — it just looks
-    // absent. (Reads/listings aren't blocked; the PostToolUse hook strips them.)
-    if (!reason && securityCfg && securityCfg.ghost) {
-      const ghostHit = ghostBlock(toolName, args, securityCfg.ghost);
-      if (ghostHit) {
-        try { writeDenyFlag(toolName); } catch {}
-        writeLocalLog(securityCfg, { ts: new Date().toISOString(), tool: toolName, arguments: args, decision: 'DENY', reason: 'ghost path (hidden from agent)', permission: guessPermission(toolName), source: `${AGENT_TYPE}-guard`, agent_id: AGENT_TYPE, agent_name: AGENT_NAME, session_id: data.session_id || '', evaluation_time_ms: Date.now() - _evalStart });
-        try {
-          if (!localLogsOnly(securityCfg)) await fetch(API_URL + '/api/v1/audit-logs', {
-            method: 'POST',
-            headers: { 'Content-Type': 'application/json', ...AUTH_HEADERS },
-            body: JSON.stringify({
-              tool: toolName, arguments: args, decision: 'DENY',
-              reason: 'ghost path (hidden from agent)',
-              permission: guessPermission(toolName),
-              source: `${AGENT_TYPE}-guard`, agent_id: AGENT_TYPE, agent_name: AGENT_NAME,
-              session_id: data.session_id || '',
-              evaluation_time_ms: Date.now() - _evalStart,
-            }),
-            signal: AbortSignal.timeout(3000),
-          });
-        } catch {}
-        await maybeSelfUpdate();
-        if (AGENT_TYPE === 'gemini-cli') { process.stdout.write(JSON.stringify({ decision: 'deny', reason: ghostHit })); process.exit(0); }
-        process.stderr.write(ghostHit);
-        process.exit(2);
-      }
-      // No direct hit: if this is a listing command, rewrite it so hidden
-      // entries are filtered out of its output (Claude Code only).
-      if (AGENT_TYPE !== 'gemini-cli' && toolName === 'Bash') {
-        const rw = ghostListingRewrite(args, securityCfg.ghost);
-        if (rw) { await maybeSelfUpdate(); rewriteTool({ command: rw }); }
-      }
-    }
-    // Extra security layers run after tamper, before policy. Block reason wins
-    // immediately (BLACK). Fail-open by design.
-    if (!reason) reason = securityLayerCheck(toolName, args, securityCfg, agentKey);
-    if (process.env.SOLONGATE_DEBUG) {
-    }
-    // OPA WASM is the SOLE policy engine. With no policy configured for this
-    // agent we skip evaluation entirely (allow). With a policy present,
-    // evaluateWithOpa returns a reason (DENY), null (ALLOW), or undefined when
-    // the WASM bundle could not be obtained at all — in which case we fall back
-    // to the policy mode's default (whitelist → fail closed, denylist → fail
-    // open); see the branch below. (The legacy JS evaluate() below is retained
-    // but no longer on the decision path — OPA decides everything.)
-    // Cloud routing is BINARY — WHITE (allow) / BLACK (block). There is NO AI
-    // Judge in the cloud (that is an air-gap-only feature), so there is no GRAY
-    // "send to the judge" lane: the OPA policy alone decides. Tamper protection
-    // and any DENY (incl. fail-closed) → BLACK; everything else → WHITE. A REVIEW
-    // rule with no judge to escalate to is treated as allow under denylist.
-    let opaRoute = 'white';
-    if (reason) {
-      opaRoute = 'black'; // hardcoded tamper protection blocked it
-    } else if (policy && policy.rules) {
-      const opaResult = await evaluateWithOpa(policy, args, toolName, hookCwd);
-      if (opaResult === undefined) {
-        // OPA produced no decision (no WASM bundle yet, runtime missing, fetch
-        // error). This happens on COLD START — the first call(s) in a session
-        // before the policy + WASM are cached. Don't leave an enforcement gap:
-        // run the deterministic, WASM-free JS evaluator so DENY rules (e.g.
-        // secret-file protection) and whitelist defaults apply IMMEDIATELY, from
-        // the very first call. evaluate() implements both modes:
-        //   - returns a deny reason  → block (DENY match, or whitelist no-match)
-        //   - returns null           → allow (denylist default / whitelist match)
-        // This closes the "worked, but late" window where a denylist policy used
-        // to fail OPEN until WASM warmed up.
-        const legacy = evaluate(policy, args, toolName);
-        if (typeof legacy === 'string') {
-          reason = legacy;
-          opaRoute = 'black';
-        } else {
-          opaRoute = 'white';
-        }
-      } else if (typeof opaResult === 'string') {
-        reason = opaResult; // explicit DENY
-        opaRoute = 'black';
-      } else {
-        opaRoute = 'white'; // allow (rule match, default-allow, or review w/o judge)
-      }
-    }
-
-    process.stderr.write(`[SolonGate ROUTE] ${opaRoute.toUpperCase()} (${reason ? 'block' : 'allow'})\n`);
-
-    // Hand the measured policy-eval time to the audit hook: PostToolUse logs the
-    // ALLOW path and can't time the guard itself, so it reads this file back.
-    // Keyed by tool + session so the audit hook can match THIS invocation even
-    // when the tool itself runs for minutes (a bare timestamp TTL lost those).
-    try { const _fd = resolve('.solongate'); mkdirSync(_fd, { recursive: true }); writeFileSync(join(_fd, '.last-eval'), JSON.stringify({ ms: Date.now() - _evalStart, ts: Date.now(), tool: toolName, session: data.session_id || '' })); } catch {}
-
-    // Only log DENY decisions from guard hook.
-    // ALLOW decisions are logged by the audit hook (PostToolUse) to avoid double-counting.
-    if (reason) {
-      if (true) {
-        try {
-          const logEntry = {
-            tool: toolName, arguments: args,
-            decision: 'DENY', reason,
-            permission: guessPermission(toolName),
-            source: `${AGENT_TYPE}-guard`,
-            agent_id: AGENT_TYPE, agent_name: AGENT_NAME,
-            session_id: data.session_id || '',
-            evaluation_time_ms: Date.now() - _evalStart,
-          };
-          writeLocalLog(securityCfg, { ts: new Date().toISOString(), ...logEntry });
-          // PI hook layer removed — piResult fields no longer attached.
-          // Local-only mode: keep the log on the user's machine, skip the cloud.
-          if (!localLogsOnly(securityCfg)) await fetch(API_URL + '/api/v1/audit-logs', {
-            method: 'POST',
-            headers: { 'Content-Type': 'application/json', ...AUTH_HEADERS },
-            body: JSON.stringify(logEntry),
-            signal: AbortSignal.timeout(3000),
-          });
-        } catch {}
-      }
-      writeDenyFlag(toolName);
-      await maybeSelfUpdate();
-      blockTool(reason);
-    }
-  } catch {}
-  await maybeSelfUpdate();
-  allowTool();
-});
+#!/usr/bin/env node
+/**
+ * SolonGate Cloud Policy Guard Hook (PreToolUse) — GLOBAL system-wide enforcement.
+ *
+ * This is the cloud twin of the air-gapped guard hook. Identical decision engine
+ * (OPA WASM, NIST SP 800-207 PDP, fail-closed), but the policy + compiled WASM
+ * are fetched from SolonGate Cloud and authenticated with the project API key.
+ * Installed globally (~/.claude/settings.json) it intercepts EVERY tool call from
+ * EVERY Claude Code session on the machine — exactly like the air-gapped product,
+ * just sourced from the cloud instead of a local docker API.
+ *
+ * Cloud differences vs. air-gap guard.mjs:
+ *   - API_KEY (sg_live_…/sg_test_…) from env/.env, attached to every API call.
+ *   - API_URL defaults to https://api.solongate.com.
+ *   - Enforcement is gated on the API key (the key identifies the project +
+ *     its active policy), NOT on SOLONGATE_AGENT_ID.
+ *   - No AI Judge and NO gray route: cloud routing is binary, WHITE (allow) /
+ *     BLACK (block). The OPA policy alone decides; nothing is escalated.
+ *
+ * Exit code 2 = BLOCK, exit code 0 = ALLOW.
+ * Logs DENY decisions to SolonGate Cloud. ALLOWs are logged by audit.mjs.
+ * Auto-installed by: npx @solongate/proxy init --global
+ */
+import { readFileSync, existsSync, statSync, writeFileSync, mkdirSync, chmodSync, renameSync, appendFileSync } from 'node:fs';
+import { resolve, join, dirname, isAbsolute } from 'node:path';
+import { homedir } from 'node:os';
+import { gunzipSync } from 'node:zlib';
+import { createHash } from 'node:crypto';
+
+// Bump on every guard.mjs change. The cloud serves the newest bundle + version;
+// the installed hook self-updates when the cloud version is higher (see
+// maybeSelfUpdate). This is what makes guard fixes propagate without a manual
+// reinstall — the same trust model as the OPA WASM this hook already runs.
+const HOOK_VERSION = 30;
+
+// True when local log storage is ON. In that mode logs are kept LOCAL ONLY and
+// nothing is sent to the cloud audit log.
+function localLogsOnly(security) {
+  const l = security && security.localLogs;
+  return !!(l && l.enabled && typeof l.path === 'string' && l.path.trim());
+}
+
+// Resolve the FOLDER local logs may be written into. It MUST be absolute on
+// THIS machine. A relative path — e.g. a Windows "C:/Users/…" path evaluated on
+// Linux, where Node treats it as relative — would be created under the agent's
+// current working directory and pollute whatever project it happens to run in
+// (that's how stray "…/C:/Users/HP/solongate-logs" folders appear inside repos).
+// When the configured path isn't absolute here, fall back to a fixed home folder
+// so entries are never lost and never leak into a project, and record the bad
+// path so the dashboard/user can be told their path isn't valid on this device.
+function resolveLocalLogDir(rawPath) {
+  const dir = String(rawPath || '').trim().replace(/[\\/]+$/, '');
+  if (!dir) return null;
+  if (isAbsolute(dir)) return dir;
+  const fallback = resolve(homedir(), '.solongate', 'local-logs');
+  try {
+    mkdirSync(resolve(homedir(), '.solongate'), { recursive: true });
+    writeFileSync(resolve(homedir(), '.solongate', '.local-logs-invalid-path'),
+      JSON.stringify({ configured: dir, fallback, ts: Date.now() }));
+  } catch { /* ignore */ }
+  return fallback;
+}
+
+// Local log storage (opt-in): write solongate-audit.jsonl inside the user's
+// chosen FOLDER. The audit hook does the ALLOW path; the guard does DENY (a
+// blocked call never reaches PostToolUse). `security` is the resolved config.
+function writeLocalLog(security, entry) {
+  try {
+    const l = security && security.localLogs;
+    if (!l || !l.enabled || typeof l.path !== 'string' || !l.path.trim()) return;
+    const dir = resolveLocalLogDir(l.path);
+    if (!dir) return;
+    try { mkdirSync(dir, { recursive: true }); } catch { /* ignore */ }
+    appendFileSync(join(dir, 'solongate-audit.jsonl'), JSON.stringify(entry) + '\n');
+  } catch { /* best-effort */ }
+}
+
+// Safe file read with size limit (1MB max) to prevent DoS via large files
+const MAX_FILE_READ = 1024 * 1024; // 1MB
+function safeReadFileSync(filePath, encoding = 'utf-8') {
+  try {
+    const stat = statSync(filePath);
+    if (stat.size > MAX_FILE_READ) return '';
+    return readFileSync(filePath, encoding);
+  } catch { return ''; }
+}
+
+// ── Load .env file (Claude Code doesn't load .env into process.env) ──
+function loadEnvKey(dir) {
+  try {
+    const envPath = resolve(dir, '.env');
+    if (!existsSync(envPath)) return {};
+    const lines = readFileSync(envPath, 'utf-8').split('\n');
+    const env = {};
+    for (const line of lines) {
+      const m = line.match(/^([A-Z_]+)=(.*)$/);
+      if (m) env[m[1]] = m[2].replace(/^["']|["']$/g, '').trim();
+    }
+    return env;
+  } catch { return {}; }
+}
+
+// ── Global cloud config (~/.solongate/cloud-guard.json) ──
+// A GLOBAL hook runs from an arbitrary cwd every session, so a project-local
+// .env can't be relied on to carry the API key. The global installer writes the
+// key + URL here once; this absolute path is read regardless of cwd. Shape:
+//   { "apiKey": "sg_live_…", "apiUrl": "https://api.solongate.com" }
+function loadGlobalCloudConfig() {
+  try {
+    const p = resolve(homedir(), '.solongate', 'cloud-guard.json');
+    if (!existsSync(p)) return {};
+    const cfg = JSON.parse(readFileSync(p, 'utf-8'));
+    return (cfg && typeof cfg === 'object') ? cfg : {};
+  } catch { return {}; }
+}
+
+// A real cloud key is `sg_live_`/`sg_test_` followed by hex (see generateApiKey:
+// 24 random bytes → 48 hex chars). Template/placeholder values shipped in sample
+// .env files (e.g. `sg_live_your_key_here`) pass a naive truthiness check but are
+// bogus — and because resolution prefers a project .env over the global login
+// credential, a stray placeholder .env would shadow a valid login and 401 every
+// API call, making the guard fail closed on EVERYTHING. Filter to real keys so a
+// placeholder is skipped and the next real candidate (usually the login cred in
+// cloud-guard.json) is used instead.
+function isRealKey(k) {
+  if (typeof k !== 'string') return false;
+  const v = k.trim();
+  if (!/^sg_(live|test)_/.test(v)) return false;
+  const body = v.replace(/^sg_(live|test)_/, '');
+  if (/your_key_here|placeholder|example|^x+$/i.test(body)) return false;
+  return /^[a-f0-9]{16,}$/i.test(body);
+}
+
+function guessPermission(toolName) {
+  const name = (toolName || '').toLowerCase();
+  if (name.includes('exec') || name.includes('shell') || name.includes('run') || name.includes('eval') || name === 'bash') return 'EXECUTE';
+  if (name.includes('fetch') || name.includes('http') || name.includes('request') || name.includes('curl') || name.includes('network') || name.includes('download') || name.includes('upload') || name === 'websearch') return 'NETWORK';
+  if (name.includes('write') || name.includes('create') || name.includes('delete') || name.includes('update') || name.includes('set') || name.includes('edit') || name.includes('remove') || name.includes('insert')) return 'WRITE';
+  return 'READ';
+}
+
+const hookCwdEarly = process.cwd();
+const dotenv = loadEnvKey(hookCwdEarly);
+const globalCfg = loadGlobalCloudConfig();
+// Resolution order: process env → project-local .env → global ~/.solongate
+// config. The global config is what makes a system-wide install self-sufficient.
+const API_URL = process.env.SOLONGATE_API_URL || dotenv.SOLONGATE_API_URL || globalCfg.apiUrl || 'https://api.solongate.com';
+// Cloud API key (sg_live_… / sg_test_…). The key identifies the project AND
+// authenticates every API call (active policy, compiled WASM, audit logs). When
+// absent, this hook does nothing — a machine with no key is intentionally
+// unenforced (the cloud has no policy to apply). Each candidate is filtered
+// through isRealKey() so a placeholder .env (sg_live_your_key_here) can't shadow
+// the real login credential and force a fail-closed on every call.
+const API_KEY = [process.env.SOLONGATE_API_KEY, dotenv.SOLONGATE_API_KEY, globalCfg.apiKey].find(isRealKey) || '';
+// Auth headers attached to every cloud API request. Cloud accepts either the
+// Authorization: Bearer form or X-API-Key; we send both for robustness.
+const AUTH_HEADERS = API_KEY ? { 'Authorization': 'Bearer ' + API_KEY, 'X-API-Key': API_KEY } : {};
+
+// ── Self-update (best-effort, throttled, integrity-checked) ──
+// Once per ~6h the hook asks the cloud for the latest guard bundle. If the cloud
+// version is higher AND the sha256 verifies AND the payload looks like this guard
+// hook, it atomically replaces its own file. Any failure is swallowed so a bad
+// update can never break enforcement — the current code simply keeps running.
+// Fetch one hook bundle from the cloud and atomically replace the installed file
+// if the served version is newer AND the sha256 verifies AND it looks like the
+// right hook. Any failure is swallowed.
+async function fetchAndInstallHook(endpoint, fileName, currentVersion, marker, minLen) {
+  try {
+    const res = await fetch(API_URL + '/api/v1/hooks/' + endpoint, { headers: AUTH_HEADERS, signal: AbortSignal.timeout(5000) });
+    if (!res.ok) return;
+    const data = await res.json();
+    if (!data || typeof data.version !== 'number' || data.version <= currentVersion) return;
+    if (typeof data.content !== 'string' || typeof data.sha256 !== 'string') return;
+    const buf = Buffer.from(data.content, 'base64');
+    if (createHash('sha256').update(buf).digest('hex') !== data.sha256) return;
+    const text = buf.toString('utf-8');
+    if (!text.startsWith('#!/usr/bin/env node') || text.length < minLen || !text.includes(marker)) return;
+    const hooksDir = join(resolve(homedir(), '.solongate'), 'hooks');
+    const tmp = join(hooksDir, '.' + fileName + '.tmp');
+    writeFileSync(tmp, text);
+    try { chmodSync(join(hooksDir, fileName), 0o644); } catch { /* may be locked read-only */ }
+    renameSync(tmp, join(hooksDir, fileName)); // atomic swap, takes effect next call
+  } catch { /* never break enforcement on update failure */ }
+}
+
+// Read the HOOK_VERSION baked into an installed sibling hook (0 if absent/old).
+function installedHookVersion(fileName) {
+  try {
+    const f = join(resolve(homedir(), '.solongate'), 'hooks', fileName);
+    const m = (safeReadFileSync(f) || '').match(/HOOK_VERSION\s*=\s*(\d+)/);
+    return m ? parseInt(m[1], 10) : 0;
+  } catch { return 0; }
+}
+
+// Latest hook versions the cloud reports on /policies/active (hook_versions).
+// Captured during the policy fetch of THIS run (or its short-lived cache); lets
+// maybeSelfUpdate() know it is behind and bypass the 6h stamp entirely.
+let CLOUD_HOOK_VERSIONS = null;
+
+function hooksBehindCloud() {
+  const v = CLOUD_HOOK_VERSIONS;
+  if (!v || typeof v !== 'object') return false;
+  if (Number(v.guard) > HOOK_VERSION) return true;
+  if (Number(v.audit) > installedHookVersion('audit.mjs')) return true;
+  if (Number(v.shield) > installedHookVersion('shield.mjs')) return true;
+  return false;
+}
+
+// Once per ~6h: update the guard itself AND its sibling hooks (audit, shield).
+// The guard is the only hook that self-updates from the cloud, so it carries the
+// others — that's why a new audit/shield reaches every device with NO re-login:
+// the guard fetches and installs them on its next run.
+//
+// The 6h stamp only rate-limits the BLIND check. When the policy response says
+// the cloud serves a NEWER hook (hook_versions), we update immediately — so a
+// fresh release lands on the next executed command, and a stamp refreshed by an
+// earlier run (e.g. before the release finished deploying) can't delay it.
+async function maybeSelfUpdate() {
+  if (!API_KEY) return;
+  try {
+    const sgDir = resolve(homedir(), '.solongate');
+    const stamp = join(sgDir, '.hook-update-check');
+    if (!hooksBehindCloud()) {
+      const last = parseInt(safeReadFileSync(stamp) || '0', 10);
+      if (Number.isFinite(last) && Date.now() - last < 6 * 3600 * 1000) return;
+    }
+    try { writeFileSync(stamp, String(Date.now())); } catch { /* ignore */ }
+    // Guard compares to its OWN running version; siblings to their installed file.
+    await fetchAndInstallHook('guard', 'guard.mjs', HOOK_VERSION, 'SolonGate Cloud Policy Guard', 50000);
+    await fetchAndInstallHook('audit', 'audit.mjs', installedHookVersion('audit.mjs'), 'SolonGate Audit Hook', 1500);
+    await fetchAndInstallHook('shield', 'shield.mjs', installedHookVersion('shield.mjs'), 'SolonGate Shield', 1500);
+  } catch { /* never break enforcement on update failure */ }
+}
+
+// Two distinct identities, deliberately kept separate:
+//
+//   AGENT_TYPE — the real AI client running this hook (claude-code /
+//   gemini-cli / openclaw). Baked into the hook registration by the installer
+//   as argv[2] (e.g. `node guard.mjs claude-code`). Decides the response
+//   format AND whether a selected policy actually applies to this client.
+//
+//   POLICY_SELECTOR — set per-terminal via SOLONGATE_AGENT_ID (a policy id
+//   from the dashboard "Use in terminal" button, or an agent name). Decides
+//   WHICH policy to load. When unset, no policy is enforced — a plain launch
+//   is intentionally unrestricted.
+const AGENT_TYPE = process.argv[2] || 'claude-code';
+const POLICY_SELECTOR = process.env.SOLONGATE_AGENT_ID || '';
+const AGENT_ID = POLICY_SELECTOR || AGENT_TYPE;
+const AGENT_NAME = process.env.SOLONGATE_AGENT_NAME || process.argv[3] || AGENT_TYPE;
+
+// ── Per-tool block/allow output ──
+// Response format depends on the agent:
+// Claude Code:  exit 2 + stderr = BLOCK, exit 0 = ALLOW
+// Gemini CLI:   {"decision": "deny/allow", "reason": "..."}
+
+function blockTool(reason) {
+  if (AGENT_TYPE === 'gemini-cli') {
+    process.stdout.write(JSON.stringify({
+      decision: 'deny',
+      reason: `[SolonGate] ${reason}`,
+    }));
+    process.exit(0);
+  } else {
+    // Claude Code — exit code 2
+    process.stderr.write(reason);
+    process.exit(2);
+  }
+}
+
+function allowTool() {
+  if (AGENT_TYPE === 'gemini-cli') {
+    process.stdout.write(JSON.stringify({ decision: 'allow' }));
+  }
+  process.exit(0);
+}
+
+// Allow the tool but REPLACE its input (Claude Code `updatedInput`). Used by the
+// ghost layer to rewrite a listing command so hidden entries are filtered out of
+// its output — the agent never sees them. Claude Code only.
+function rewriteTool(updatedInput) {
+  process.stdout.write(JSON.stringify({
+    hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'allow', updatedInput },
+  }));
+  process.exit(0);
+}
+
+// Write flag file so stop.mjs knows a tool call (DENY) happened and doesn't log extra ALLOW
+function writeDenyFlag(toolName) {
+  try {
+    const flagDir = resolve('.solongate');
+    mkdirSync(flagDir, { recursive: true });
+    writeFileSync(join(flagDir, '.last-tool-call'), Date.now().toString());
+    // Write deny-specific flag so audit.mjs can detect and skip duplicate ALLOW logging
+    writeFileSync(join(flagDir, '.last-deny'), JSON.stringify({ tool: toolName, ts: Date.now() }));
+  } catch {}
+}
+
+// ── Prompt Injection Detection (Stage 1: Rule-Based) ──
+const PI_CATEGORIES = [
+  {
+    name: 'delimiter_injection', weight: 0.95,
+    patterns: [
+      /<\/system>/i, /<\|im_end\|>/i, /<\|im_start\|>/i, /<\|endoftext\|>/i,
+      /\[INST\]/i, /\[\/INST\]/i, /<<SYS>>/i, /<<\/SYS>>/i,
+      /###\s*(Human|Assistant|System)\s*:/i, /<\|user\|>/i, /<\|assistant\|>/i,
+      /---\s*END\s*SYSTEM\s*PROMPT\s*---/i,
+    ],
+  },
+  {
+    name: 'instruction_override', weight: 0.9,
+    patterns: [
+      /\bignore\s+(all\s+)?(previous|prior|above|earlier)\s+(instructions?|prompts?|rules?|directives?)\b/i,
+      /\bdisregard\s+(all\s+)?(previous|prior|above|earlier|your)\s+(instructions?|prompts?|rules?|guidelines?)\b/i,
+      /\bforget\s+(all\s+|everything\s+)?(your|the|previous|prior|above|earlier)\b/i,
+      /\boverride\s+(the\s+)?(system|previous|current)\s+(prompt|instructions?|rules?|settings?)\b/i,
+      /\bdo\s+not\s+follow\s+(your|the|any)\s+(instructions?|rules?|guidelines?)\b/i,
+      /\bcancel\s+(all\s+)?(prior|previous)\s+(directives?|instructions?)\b/i,
+      /\bnew\s+instructions?\s+supersede\b/i,
+      /\byour\s+(previous\s+)?instructions?\s+are\s+(now\s+)?void\b/i,
+    ],
+  },
+  {
+    name: 'role_hijacking', weight: 0.85,
+    patterns: [
+      /\b(pretend|act|behave)\s+(you\s+are|as\s+if\s+you|like\s+you|to\s+be)\b/i,
+      /\byou\s+are\s+now\s+(a|an|the|my|DAN)\b/i,
+      /\bsimulate\s+being\b/i, /\bassume\s+the\s+role\s+of\b/i,
+      /\benter\s+(developer|admin|debug|god|sudo|unrestricted)\s+mode\b/i,
+      /\bswitch\s+to\s+(unrestricted|unfiltered)\s+mode\b/i,
+      /\byou\s+are\s+no\s+longer\s+bound\b/i,
+      /\bno\s+(safety\s+)?restrictions?\s+(apply|anymore|now)\b/i,
+    ],
+  },
+  {
+    name: 'jailbreak_keywords', weight: 0.8,
+    patterns: [
+      /\bjailbreak\b/i, /\bDAN\s+mode\b/i,
+      /\b(system\s+override|admin\s+mode|debug\s+mode|developer\s+mode|maintenance\s+mode)\b/i,
+      /\bmaster\s+key\b/i, /\bbackdoor\s+access\b/i,
+      /\bsudo\s+mode\b/i, /\bgod\s+mode\b/i,
+      /\bsafety\s+filters?\s+(off|disabled?|removed?)\b/i,
+    ],
+  },
+  {
+    name: 'encoding_evasion', weight: 0.75,
+    patterns: [
+      /\b(decode|translate)\s+(this|the\s+following)\s+(base64|rot13|hex)\b/i,
+      /\b(base64|rot13)\s*:\s*[A-Za-z0-9+/=]{10,}/i,
+      /\bexecute\s+the\s+(reverse|decoded)\b/i,
+      /\breverse\s+of\s*:\s*\w{10,}/i,
+    ],
+  },
+  {
+    name: 'separator_injection', weight: 0.7,
+    patterns: [
+      /[-=]{3,}\s*\n\s*(new\s+instructions?|system|instructions?)\s*:/i,
+      /```\s*\n\s*<\/?system>/i,
+      /\bEND\s+(SYSTEM\s+)?(PROMPT|INSTRUCTIONS?)\b.*\bNEW\s+(SYSTEM\s+)?(PROMPT|INSTRUCTIONS?)\b/is,
+    ],
+  },
+  {
+    name: 'multi_language', weight: 0.7,
+    patterns: [
+      /ignor(iere|a|e[zs]?)\s+(alle|todas?|toutes?|tüm|все)/iu,
+      /игнорируйте/iu, /yoksay/iu,
+      /vorherigen?\s+Anweisungen/iu, /instrucciones\s+anteriores/iu,
+      /instructions?\s+pr[eé]c[eé]dentes?/iu, /önceki\s+talimatlar/iu,
+    ],
+  },
+];
+
+function detectPromptInjection(text, customCategories = [], threshold = 0.5) {
+  const matched = [];
+  let maxWeight = 0;
+  const allCategories = [...PI_CATEGORIES, ...customCategories];
+  for (const cat of allCategories) {
+    for (const pat of cat.patterns) {
+      if (pat.test(text)) {
+        matched.push(cat.name);
+        if (cat.weight > maxWeight) maxWeight = cat.weight;
+        break;
+      }
+    }
+  }
+  if (matched.length === 0) return null;
+  const score = Math.min(1.0, maxWeight + 0.05 * (matched.length - 1));
+  const trustScore = 1.0 - score;
+  const blocked = Math.round(trustScore * 1000) < Math.round(threshold * 1000);
+  return { score, trustScore, categories: matched, blocked };
+}
+
+// ── Glob Matching ──
+function matchGlob(str, pattern) {
+  if (pattern === '*') return true;
+  const s = str.toLowerCase();
+  const p = pattern.toLowerCase();
+  if (s === p) return true;
+  const startsW = p.startsWith('*');
+  const endsW = p.endsWith('*');
+  if (startsW && endsW) { const infix = p.slice(1, -1); return infix.length > 0 && s.includes(infix); }
+  if (startsW) return s.endsWith(p.slice(1));
+  if (endsW) return s.startsWith(p.slice(0, -1));
+  const idx = p.indexOf('*');
+  if (idx !== -1) {
+    const pre = p.slice(0, idx);
+    const suf = p.slice(idx + 1);
+    return s.startsWith(pre) && s.endsWith(suf) && s.length >= pre.length + suf.length;
+  }
+  return false;
+}
+
+// ── Path Glob (supports **) ──
+function matchPathGlob(path, pattern) {
+  const p = path.replace(/\\/g, '/').toLowerCase();
+  const g = pattern.replace(/\\/g, '/').toLowerCase();
+  if (p === g) return true;
+  if (g.includes('**')) {
+    const parts = g.split('**').filter(s => s.length > 0);
+    if (parts.length === 0) return true;
+    return parts.every(segment => p.includes(segment));
+  }
+  return matchGlob(p, g);
+}
+
+// ── Safe Webhook URL Validation (prevent SSRF) ──
+function isSafeWebhookUrl(urlStr) {
+  try {
+    const u = new URL(urlStr);
+    if (u.protocol !== 'https:') return false;
+    const host = u.hostname.toLowerCase();
+    // Block private/reserved IPs and metadata endpoints
+    if (host === 'localhost' || host === '127.0.0.1' || host === '0.0.0.0' || host === '::1') return false;
+    if (host.startsWith('10.') || host.startsWith('192.168.') || host.startsWith('172.')) return false;
+    if (host === '169.254.169.254' || host === 'metadata.google.internal') return false;
+    if (host.endsWith('.internal') || host.endsWith('.local')) return false;
+    return true;
+  } catch { return false; }
+}
+
+// ── Safe Regex Validation (prevent ReDoS from cloud-supplied patterns) ──
+function isSafeRegex(pattern) {
+  if (typeof pattern !== 'string' || pattern.length > 512) return false;
+  // Block nested quantifiers: (a+)+, (a*)+, (a{1,})+, etc.
+  if (/(\+|\*|\{[^}]+\})\s*(\+|\*|\{[^}]+\})/.test(pattern)) return false;
+  if (/\([^)]*(\+|\*|\{[^}]+\})[^)]*\)\s*(\+|\*|\{[^}]+\})/.test(pattern)) return false;
+  // Block excessive alternation groups (>10 alternatives)
+  if ((pattern.match(/\|/g) || []).length > 10) return false;
+  try { new RegExp(pattern); return true; } catch { return false; }
+}
+
+// ── Extract Functions (deep scan all string values) ──
+function scanStrings(obj) {
+  const strings = [];
+  function walk(v) {
+    if (typeof v === 'string' && v.trim()) strings.push(v.trim());
+    else if (Array.isArray(v)) v.forEach(walk);
+    else if (v && typeof v === 'object') Object.values(v).forEach(walk);
+  }
+  walk(obj);
+  return strings;
+}
+
+function looksLikeFilename(s) {
+  if (s.startsWith('.')) return true;
+  if (/\.\w+$/.test(s)) return true;
+  const known = ['id_rsa','id_dsa','id_ecdsa','id_ed25519','authorized_keys','known_hosts','makefile','dockerfile'];
+  return known.includes(s.toLowerCase());
+}
+
+// Deterministic shell normalizer — handles the common bypass tricks BEFORE
+// any semantic check, so OPA's literal matcher sees the canonical command.
+// Specifically: variable assignment + interpolation, quote concatenation
+// (.e""nv, ."env"). Doesn't try to be a full shell — just enough to defeat
+// the obfuscation patterns AI judges keep getting wrong non-deterministically.
+function normalizeShellCommand(cmd) {
+  if (typeof cmd !== 'string' || !cmd) return cmd;
+  const vars = {};
+  const out = [];
+  // Split on statement separators (; && ||) but NOT pipes (|).
+  for (const rawPart of cmd.split(/\s*(?:;|&&|\|\|)\s*/)) {
+    let part = rawPart;
+    // Detect var assignment: NAME=value | NAME="value" | NAME='value'
+    const m = part.match(/^(\w+)=(?:"([^"]*)"|'([^']*)'|([^\s;&|]*))\s*$/);
+    if (m) {
+      vars[m[1]] = m[2] ?? m[3] ?? m[4] ?? '';
+      continue;
+    }
+    // Substitute ${var} then $var.
+    part = part.replace(/\$\{(\w+)\}/g, (_, n) => vars[n] !== undefined ? vars[n] : '${' + n + '}');
+    part = part.replace(/\$(\w+)/g, (_, n) => vars[n] !== undefined ? vars[n] : '$' + n);
+    // Collapse quote-concat: a"b"c → abc, .e""nv → .env, ."env" → .env
+    part = part.replace(/"([^"]*)"/g, '$1').replace(/'([^']*)'/g, '$1');
+    out.push(part);
+  }
+  return out.join('; ');
+}
+
+// Normalize all shell-command-valued fields of an args object before tokenizing.
+function normalizeArgs(args) {
+  if (!args || typeof args !== 'object') return args;
+  const fields = ['command', 'cmd', 'function', 'script', 'shell'];
+  const copy = { ...args };
+  for (const [k, v] of Object.entries(copy)) {
+    if (fields.includes(k.toLowerCase()) && typeof v === 'string') {
+      copy[k] = normalizeShellCommand(v);
+    }
+  }
+  return copy;
+}
+
+function extractFilenames(args) {
+  args = normalizeArgs(args);
+  const names = new Set();
+  // Strip surrounding/trailing quotes — `"…/secret.env"` must reduce to
+  // `secret.env`, not `secret.env"` (a trailing quote breaks the *.env glob).
+  const dequote = (t) => t.replace(/^["'`]+/, '').replace(/["'`]+$/, '');
+  for (const s of scanStrings(args)) {
+    if (/^https?:\/\//i.test(s)) continue;
+    // Process EVERY whitespace-separated token, not just the last `/` segment of
+    // the whole string. Multi-file commands (`rm a b c`) must check all of them.
+    const tokens = s.includes(' ') ? s.split(/\s+/) : [s];
+    const single = tokens.length === 1;
+    for (let tok of tokens) {
+      tok = dequote(tok);
+      if (!tok || /^https?:\/\//i.test(tok)) continue;
+      if (tok.includes('/') || tok.includes('\\')) {
+        const b = dequote(tok.replace(/\\/g, '/').split('/').pop() || '');
+        if (b && (single || looksLikeFilename(b))) names.add(b);
+      } else if (looksLikeFilename(tok)) {
+        names.add(tok);
+      }
+    }
+  }
+  return [...names];
+}
+
+function extractUrls(args) {
+  const urls = new Set();
+  for (const s of scanStrings(args)) {
+    if (/^https?:\/\//i.test(s)) { urls.add(s); continue; }
+    if (s.includes(' ')) {
+      for (const tok of s.split(/\s+/)) {
+        if (/^https?:\/\//i.test(tok)) urls.add(tok);
+      }
+    }
+  }
+  return [...urls];
+}
+
+function extractCommands(args) {
+  args = normalizeArgs(args);
+  const cmds = [];
+  const fields = ['command', 'cmd', 'function', 'script', 'shell'];
+  if (typeof args === 'object' && args) {
+    for (const [k, v] of Object.entries(args)) {
+      if (fields.includes(k.toLowerCase()) && typeof v === 'string') {
+        for (const part of v.split(/\s*(?:&&|\|\||;|\|)\s*/)) {
+          const trimmed = part.trim();
+          if (trimmed) cmds.push(trimmed);
+        }
+      }
+    }
+  }
+  return cmds;
+}
+
+function extractPaths(args, isExec) {
+  const paths = [];
+  const add = (t) => {
+    if (!t || /^https?:\/\//i.test(t)) return;
+    // Normalize Windows backslashes to forward slashes so paths match the
+    // compiled Rego patterns (which are also normalized to "/"). OPA glob.match
+    // does no separator translation, so raw "C:\..." never matched "/" patterns.
+    if (t.includes('/') || t.includes('\\') || t.startsWith('.')) paths.push(t.replace(/\\/g, '/'));
+  };
+  for (const s of scanStrings(args)) {
+    if (/^https?:\/\//i.test(s)) continue;
+    if (isExec && /\s/.test(s)) {
+      // A command line (exec tool): pull out individual path-like tokens instead
+      // of treating the whole command as one path. Otherwise `node src/app.js`
+      // becomes the path "node src/app.js", which no path glob can match — so a
+      // path-scoped EXECUTE rule would never fire. Tokenizing yields "src/app.js".
+      for (const tok of s.split(/[\s;|&><()`'"]+/)) add(tok);
+    } else {
+      add(s);
+    }
+  }
+  return paths;
+}
+
+// ── Hardcoded Tamper Protection ──
+// Runs BEFORE policy evaluation. Cannot be disabled by editing policies.
+// Even if all policy rules are removed, these stay enforced.
+const TAMPER_GUARD_TOOLS_WRITE = new Set([
+  'write', 'edit', 'multiedit', 'notebookedit',
+  'create', 'update', 'delete', 'remove', 'move', 'rename', 'copy',
+  'filesystem', 'fs_write', 'fs_edit', 'str_replace_editor',
+]);
+const TAMPER_GUARD_TOOLS_EXEC = new Set([
+  'bash', 'powershell', 'shell', 'exec', 'run', 'eval', 'cmd',
+]);
+const TAMPER_HOME = resolve(homedir()).replace(/\\/g, '/').toLowerCase();
+const TAMPER_SG = '/.solongate';
+const TAMPER_CC = '/.claude';
+const TAMPER_PROTECTED_ABS = [
+  TAMPER_HOME + TAMPER_CC + '/settings.json',
+  TAMPER_HOME + TAMPER_CC + '/settings.local.json',
+  TAMPER_HOME + TAMPER_SG + '/hooks',
+  TAMPER_HOME + TAMPER_SG + '/policy.json',
+  TAMPER_HOME + TAMPER_SG + '/.policy-cache.json',
+  // The cloud credential (contains the API key) — never readable via a tool.
+  TAMPER_HOME + TAMPER_SG + '/cloud-guard.json',
+];
+const TAMPER_INSTALL = '/solongate';
+const TAMPER_PROTECTED_GLOBS = [
+  '**' + TAMPER_CC + '/settings.json',
+  '**' + TAMPER_CC + '/settings.local.json',
+  '**' + TAMPER_SG + '/hooks/**',
+  '**' + TAMPER_SG + '/policy.json',
+  '**' + TAMPER_SG + '/.policy-cache.json',
+  '**' + TAMPER_SG + '/.policy-cache-*.json',
+  '**' + TAMPER_SG + '/.pi-config-cache.json',
+  '**' + TAMPER_SG + '/cloud-guard.json',
+  '**' + TAMPER_SG + '/.opa-wasm-*.json',
+  '**' + TAMPER_SG + '/.ratelimit-*.json',
+  // Persistent host data (DB + audit JSONL) at ~/.solongate/data
+  '**' + TAMPER_SG + '/data/**',
+  // Customer install layout (zip extracted as solongate/)
+  '**' + TAMPER_INSTALL + '/compose/**',
+  '**' + TAMPER_INSTALL + '/data/**',
+  '**' + TAMPER_INSTALL + '/images/**',
+  '**' + TAMPER_INSTALL + '/helm/**',
+  '**' + TAMPER_INSTALL + '/solongate.exe',
+  '**' + TAMPER_INSTALL + '/setup.sh',
+];
+const TAMPER_BASENAMES = [
+  'guard.mjs', 'audit.mjs', 'stop.mjs',
+  'policy.json', '.policy-cache.json',
+  '.pi-config-cache.json', 'cloud-guard.json',
+  // Customer install: DB and wizard exe
+  'solongate.db', 'solongate.exe',
+];
+const TAMPER_PATH_FIELDS = new Set([
+  'file_path', 'path', 'target_file', 'notebook_path',
+  'dest', 'destination', 'source', 'src', 'from', 'to',
+  'directory', 'dir', 'folder',
+]);
+
+function normTamperPath(p) {
+  return String(p || '').replace(/\\/g, '/').toLowerCase();
+}
+
+function isProtectedPath(p) {
+  if (!p) return false;
+  const np = normTamperPath(p);
+  for (const abs of TAMPER_PROTECTED_ABS) {
+    if (np === abs || np.startsWith(abs + '/')) return abs;
+  }
+  for (const g of TAMPER_PROTECTED_GLOBS) {
+    if (matchPathGlob(np, g)) return g;
+  }
+  if (/\/\.claude\/settings(\.local)?\.json$/.test(np)) return 'settings.json';
+  if (/\/\.solongate\/hooks(\/|$)/.test(np)) return 'solongate-hooks';
+  return false;
+}
+
+function commandTargetsProtected(cmd) {
+  const c = String(cmd || '').toLowerCase();
+  if (!c) return false;
+  for (const b of TAMPER_BASENAMES) {
+    if (c.includes(b.toLowerCase())) return b;
+  }
+  if (/\.claude[\\/]+settings(\.local)?\.json/.test(c)) return 'settings.json';
+  if (/\.solongate[\\/]+hooks/.test(c)) return 'solongate-hooks';
+  // Customer install dirs
+  if (/[\\/]solongate[\\/]+(compose|data|images|helm)[\\/]/.test(c)) return 'solongate-install';
+  // Mutating API calls against policies / audit-logs endpoints
+  const mutating = /\b(post|put|delete|patch)\b/.test(c) ||
+                   /(-x|--request|-method)\s+(post|put|delete|patch)\b/.test(c);
+  if (mutating && /api\/v1\/(policies|audit-logs)/.test(c)) return 'api-policies-mutation';
+  return false;
+}
+
+function extractTargetPaths(args) {
+  const out = [];
+  if (typeof args !== 'object' || !args) return out;
+  for (const [k, v] of Object.entries(args)) {
+    const lk = k.toLowerCase();
+    if (TAMPER_PATH_FIELDS.has(lk) && typeof v === 'string') out.push(v);
+    if (Array.isArray(v)) {
+      for (const item of v) {
+        if (item && typeof item === 'object') {
+          for (const [k2, v2] of Object.entries(item)) {
+            if (TAMPER_PATH_FIELDS.has(k2.toLowerCase()) && typeof v2 === 'string') out.push(v2);
+          }
+        }
+      }
+    }
+  }
+  return out;
+}
+
+function tamperCheck(toolName, args) {
+  const tn = String(toolName || '').toLowerCase();
+  const isExec = TAMPER_GUARD_TOOLS_EXEC.has(tn) || /bash|shell|exec|powershell|cmd|run|eval/.test(tn);
+  // ANY tool that targets a protected path is blocked — READ as well as write.
+  // An AI must not even read SolonGate's own protection files. This is enforced
+  // at the tool boundary; the hooks themselves are run by node directly (not via
+  // a Claude Code tool), so node still loads/executes them normally.
+  // Check the tool's TARGET PATH fields only (file_path, path, …) — never the
+  // free-form content/body, which would false-positive on any file that merely
+  // mentions a protected path in its text.
+  for (const p of extractTargetPaths(args)) {
+    const hit = isProtectedPath(p);
+    if (hit) return 'Tamper protection: access to "' + p + '" is blocked (protected: ' + hit + ')';
+  }
+  if (isExec) {
+    for (const cmd of extractCommands(args)) {
+      const hit = commandTargetsProtected(cmd);
+      if (hit) return 'Tamper protection: command references protected resource "' + hit + '" — blocked';
+    }
+  }
+  return null;
+}
+
+// ── Extra security layers (rate limit, egress allowlist, DLP block) ──
+// These are configured per-project in the dashboard and delivered to the guard
+// via /policies/active (security). All fail OPEN: any error here returns null
+// (allow) so a config glitch never bricks the agent. Tamper protection and
+// policy are unaffected and still run.
+
+// DLP patterns mirror the server's set (apps/api/src/lib/security-layers.ts).
+// Mirrors apps/api/src/lib/security-layers.ts DLP_PATTERNS. Provider-specific
+// rules plus generic Bearer / secret-assignment catch-alls for the long tail.
+const DLP_PATTERNS = [
+  { name: 'AWS access key', re: /AKIA[0-9A-Z]{16}/ },
+  { name: 'private key block', re: /-----BEGIN [A-Z ]*PRIVATE KEY-----/ },
+  { name: 'Anthropic key', re: /sk-ant-[A-Za-z0-9_-]{20,}/ },
+  { name: 'OpenAI key', re: /sk-(proj-)?[A-Za-z0-9_-]{20,}/ },
+  { name: 'GitHub token', re: /gh[pousr]_[A-Za-z0-9]{20,}/ },
+  { name: 'GitHub fine-grained PAT', re: /github_pat_[A-Za-z0-9_]{20,}/ },
+  { name: 'GitLab token', re: /glpat-[A-Za-z0-9_-]{20,}/ },
+  { name: 'Slack token', re: /xox[baprs]-[A-Za-z0-9-]{10,}/ },
+  { name: 'Stripe key', re: /[sr]k_(live|test)_[A-Za-z0-9]{20,}/ },
+  { name: 'SendGrid key', re: /SG\.[A-Za-z0-9_-]{16,}\.[A-Za-z0-9_-]{16,}/ },
+  { name: 'Twilio key', re: /SK[0-9a-fA-F]{32}/ },
+  { name: 'npm token', re: /npm_[A-Za-z0-9]{36}/ },
+  { name: 'JWT', re: /eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/ },
+  { name: 'Bearer token', re: /bearer\s+[A-Za-z0-9._-]{20,}/i },
+];
+
+// Custom patterns are GLOBs: `*` = any run of non-whitespace, same wildcard
+// mechanic as policy/ghost.
+function dlpGlobToRe(glob) {
+  let re = '';
+  for (const ch of String(glob || '')) {
+    if (ch === '*') re += '[^\\s]*';
+    else if ('.+?^${}()|[]\\'.indexOf(ch) !== -1) re += '\\' + ch;
+    else re += ch;
+  }
+  return new RegExp(re);
+}
+// Scan args against the enabled built-in patterns + any user custom patterns.
+// `cfg` = { patterns: string[], custom: {name,re}[] }.
+function dlpScan(args, cfg) {
+  if (!cfg) return null;
+  let text = '';
+  try { text = JSON.stringify(args || {}); } catch { return null; }
+  const allow = new Set(Array.isArray(cfg.patterns) ? cfg.patterns : []);
+  for (const p of DLP_PATTERNS) {
+    if (allow.has(p.name) && p.re.test(text)) return p.name;
+  }
+  for (const c of Array.isArray(cfg.custom) ? cfg.custom : []) {
+    try { if (dlpGlobToRe(c.re).test(text)) return c.name || 'custom pattern'; } catch { /* skip invalid */ }
+  }
+  return null;
+}
+
+// ── Ghost paths ──
+// Files/dirs matching a ghost glob are INVISIBLE to the agent. This module is
+// mirrored verbatim in audit.mjs (the PostToolUse twin that strips them from
+// output). Keep the two copies in sync.
+//
+// Split of responsibility:
+//   - PreToolUse (here): block MUTATIONS (write/edit/delete/move) targeting a
+//     ghost path, returning a plain "No such file or directory" — never a
+//     SolonGate/policy message — so the path looks like it simply doesn't exist.
+//   - PostToolUse (audit.mjs): strip ghost entries from listings and rewrite
+//     direct reads to not-found. Reads are NOT blocked here so the agent gets a
+//     natural "missing file" rather than a visible hook block.
+function ghostGlobToRegExp(glob) {
+  let re = '';
+  for (let i = 0; i < glob.length; i++) {
+    const c = glob[i];
+    if (c === '*') {
+      if (glob[i + 1] === '*') { re += '.*'; i++; }
+      else re += '[^/]*';
+    } else if (c === '?') re += '[^/]';
+    else if ('\\^$.|+()[]{}'.indexOf(c) !== -1) re += '\\' + c;
+    else re += c;
+  }
+  try { return new RegExp('^' + re + '$'); } catch { return null; }
+}
+
+// True if `targetPath` is ghosted by any pattern. A bare name (`.data`) matches
+// that entry anywhere in the path; a trailing `/` (`secrets/`) ghosts a whole
+// directory subtree; a pattern with `/` is matched against the full path.
+function ghostMatch(targetPath, patterns) {
+  if (!targetPath || !Array.isArray(patterns) || patterns.length === 0) return false;
+  const norm = String(targetPath).replace(/\\/g, '/').replace(/\/+$/, '');
+  if (!norm) return false;
+  const segments = norm.split('/').filter(Boolean);
+  const base = segments.length ? segments[segments.length - 1] : norm;
+  for (let pat of patterns) {
+    pat = String(pat || '').trim();
+    if (!pat) continue;
+    let dirOnly = false;
+    if (pat.endsWith('/')) { dirOnly = true; pat = pat.slice(0, -1); }
+    if (!pat) continue;
+    const hasSlash = pat.indexOf('/') !== -1;
+    const hasWild = /[*?]/.test(pat);
+    const re = ghostGlobToRegExp(pat);
+    if (!re) continue;
+    if (dirOnly) {
+      // Directory: ghost the dir itself and everything under it.
+      if (!hasSlash && !hasWild) { if (segments.indexOf(pat) !== -1) return true; continue; }
+      let acc = '';
+      for (const s of segments) { acc = acc ? acc + '/' + s : s; if (re.test(acc) || re.test(s)) return true; }
+      continue;
+    }
+    if (!hasSlash) {
+      // Name glob: match basename or any single path segment.
+      if (re.test(base)) return true;
+      if (segments.some((s) => re.test(s))) return true;
+      continue;
+    }
+    // Path glob (contains '/'): match the full normalized path.
+    if (re.test(norm)) return true;
+  }
+  return false;
+}
+
+// Strip shell decoration from a token so it can be tested as a path:
+// surrounding quotes, redirection operators, trailing punctuation.
+function ghostCleanToken(tok) {
+  let t = String(tok || '').trim();
+  t = t.replace(/^[<>|;&(]+/, '').replace(/[);&|]+$/, '');
+  t = t.replace(/^['"]+/, '').replace(/['"]+$/, '');
+  t = t.replace(/^\d*>>?/, ''); // strip leading redirection like 2>
+  return t.trim();
+}
+
+// Returns a plain not-found message if a tool DIRECTLY targets a ghost path —
+// read OR write — else null. Reads are sealed too: a hidden file must be
+// inaccessible, not merely unlisted, so `cat A/Y/.data` looks as absent as
+// `rm A/Y`. Listing a PARENT dir that only CONTAINS a ghost child is NOT a
+// direct hit (no token equals the ghost) and falls through to the listing
+// rewrite. Never returns a branded/policy string.
+function ghostBlock(toolName, args, ghostCfg) {
+  if (!ghostCfg || !Array.isArray(ghostCfg.patterns) || ghostCfg.patterns.length === 0) return null;
+  const pats = ghostCfg.patterns;
+  const name = (toolName || '');
+  const notFound = (p) => p + ': No such file or directory';
+  try {
+    // Tools that carry an explicit path argument.
+    if (name === 'Write' || name === 'Edit' || name === 'MultiEdit' || name === 'NotebookEdit' ||
+        name === 'Read' || name === 'NotebookRead' || name === 'LS') {
+      const p = args?.file_path || args?.notebook_path || args?.path || '';
+      if (p && ghostMatch(p, pats)) return notFound(p);
+      return null;
+    }
+    if (name === 'Glob' || name === 'Grep') {
+      const p = args?.path || '';
+      const pat = args?.pattern || args?.glob || '';
+      if (p && ghostMatch(p, pats)) return notFound(p);
+      if (pat && ghostMatch(pat, pats)) return notFound(String(pat));
+      return null;
+    }
+    // Bash & other exec: deny if any token directly names a ghost path. Seals
+    // direct reads (cat/head/less/…) and mutations (rm/mv/…) alike. A listing of
+    // a parent dir has no ghost token and falls through to the rewrite.
+    if (name === 'Bash' || name === 'BashOutput' || guessPermission(name) === 'EXECUTE') {
+      const cmd = String(args?.command || '');
+      if (!cmd) return null;
+      for (const raw of cmd.split(/\s+/)) {
+        const tok = ghostCleanToken(raw);
+        if (tok && tok.indexOf('-') !== 0 && ghostMatch(tok, pats)) return notFound(tok);
+      }
+    }
+  } catch { /* fail open */ }
+  return null;
+}
+
+// Shell single-quote a string.
+function ghostShq(s) { return "'" + String(s).replace(/'/g, "'\\''") + "'"; }
+
+// If `args.command` is a simple directory listing, return a rewritten command
+// that pipes its output through a filter dropping the ghost entries — so the
+// agent never sees them. Returns null when there's nothing to rewrite. Only
+// touches bare `ls` listings (no pipe/redirect/compound) to stay safe; richer
+// output formats are handled by the PostToolUse filter on clients that honor it.
+function ghostListingRewrite(args, ghostCfg) {
+  if (!ghostCfg || !Array.isArray(ghostCfg.patterns) || ghostCfg.patterns.length === 0) return null;
+  const cmd = String(args?.command || '');
+  if (!cmd) return null;
+  if (/[|>;&\n`]/.test(cmd)) return null;                            // no shell composition
+  if (!/^\s*(ls|ll|dir|find|tree|exa|lsd|fd)(\s|$)/.test(cmd)) return null;
+  // Translate each hidden glob to an ERE alternative, then match it as a whole
+  // path component, the whole line, or the trailing token — covers `ls`,
+  // `ls -la`, `find` and `tree`. A trailing slash (dir) is dropped.
+  const alts = [];
+  for (let p of ghostCfg.patterns) {
+    p = String(p).replace(/\/$/, '');
+    if (!p) continue;
+    let re = '';
+    for (let i = 0; i < p.length; i++) {
+      const c = p[i];
+      if (c === '*') { if (p[i + 1] === '*') { re += '.*'; i++; } else re += '[^/]*'; }
+      else if (c === '?') re += '[^/]';
+      else if ('.^$+(){}[]|\\/'.indexOf(c) >= 0) re += '\\' + c;
+      else re += c;
+    }
+    alts.push(re);
+  }
+  if (alts.length === 0) return null;
+  // grep -vE drops any line where a hidden name appears as a path component, the
+  // whole line, or the final token. Single-quoted so the shell leaves it intact.
+  const ere = '(^|/| )(' + alts.join('|') + ')(/|$)';
+  return cmd + " | grep -vE '" + ere.replace(/'/g, "'\\''") + "'";
+}
+
+// Multi-window sliding rate limit, persisted under ~/.solongate (tamper-protected
+// from the agent, writable by the guard). One timestamps file per agent, pruned
+// to the last 24h and capped for performance; counts this agent's calls within
+// each enabled window (minute/hour/day). Returns the exceeded window or null.
+const RL_WINDOWS = [
+  { key: 'perDay', ms: 86400000, label: 'day' },
+  { key: 'perHour', ms: 3600000, label: 'hour' },
+  { key: 'perMinute', ms: 60000, label: 'minute' },
+];
+function rateLimitCheck(agentKey, limits) {
+  try {
+    const file = join(resolve(homedir(), '.solongate'), '.ratelimit-' + agentKey + '.json');
+    const now = Date.now();
+    let stamps = [];
+    if (existsSync(file)) {
+      try { stamps = JSON.parse(readFileSync(file, 'utf-8')); } catch { stamps = []; }
+    }
+    if (!Array.isArray(stamps)) stamps = [];
+    // Prune to the longest window (24h) and cap size to bound work/IO.
+    stamps = stamps.filter((t) => typeof t === 'number' && now - t < 86400000);
+    if (stamps.length > 50000) stamps = stamps.slice(-50000);
+    // Check each enabled window against the current count (before adding now).
+    for (const w of RL_WINDOWS) {
+      const limit = limits[w.key];
+      if (limit > 0) {
+        const count = stamps.reduce((n, t) => (now - t < w.ms ? n + 1 : n), 0);
+        if (count >= limit) return { window: w.label, limit };
+      }
+    }
+    stamps.push(now);
+    try { writeFileSync(file, JSON.stringify(stamps)); } catch {}
+    return null;
+  } catch {
+    return null; // fail open
+  }
+}
+
+// Runs all enabled enforcement layers; returns a deny reason or null (allow).
+function securityLayerCheck(toolName, args, cfg, agentKey) {
+  if (!cfg) return null;
+  try {
+    if (cfg.dlpBlock) {
+      const hit = dlpScan(args, cfg.dlpBlock);
+      if (hit) return 'Security layer (DLP): blocked - arguments contain a ' + hit +
+        '. Blocked by SolonGate - check your dashboard for details.';
+    }
+    if (cfg.rateLimit) {
+      const hit = rateLimitCheck(agentKey, cfg.rateLimit);
+      if (hit) {
+        return 'Security layer (rate limit): exceeded ' + hit.limit + ' calls/' + hit.window +
+          ' for this agent. Blocked by SolonGate - check your dashboard to review or adjust the limit.';
+      }
+    }
+  } catch { /* fail open */ }
+  return null;
+}
+
+// ── Policy Evaluation ──
+
+// Permission filter: a rule with rule.permission set only applies to tool
+// calls whose guessed permission category is in that list. Empty/missing =
+// applies to all categories.
+function permissionApplies(rule, toolName) {
+  if (!rule.permission) return true;
+  const perms = Array.isArray(rule.permission) ? rule.permission : [rule.permission];
+  if (perms.length === 0) return true;
+  const guessed = guessPermission(toolName);
+  return perms.includes(guessed);
+}
+
+// Returns the first pattern that any of the rule's constraints matches against
+// the args, or null if nothing matches. Used for both DENY (engine blocks on
+// match) and ALLOW (whitelist mode requires at least one match).
+// Each constraint may store its pattern list in either `denied` or `allowed`
+// depending on which effect the rule was created with in the dashboard. The
+// hook treats both as the same "pattern list" — the rule's effect determines
+// whether a match means block (DENY) or pass (ALLOW in whitelist mode).
+function patternsOf(constraint) {
+  if (!constraint) return null;
+  const list = constraint.denied || constraint.allowed;
+  return Array.isArray(list) && list.length > 0 ? list : null;
+}
+
+function ruleMatches(rule, args, isExec) {
+  const fnPats = patternsOf(rule.filenameConstraints);
+  if (fnPats) {
+    const filenames = extractFilenames(args);
+    for (const fn of filenames) {
+      for (const pat of fnPats) {
+        if (matchGlob(fn, pat)) return { kind: 'filename', value: fn, pattern: pat };
+      }
+    }
+  }
+  const urlPats = patternsOf(rule.urlConstraints);
+  if (urlPats) {
+    const urls = extractUrls(args);
+    for (const url of urls) {
+      for (const pat of urlPats) {
+        if (matchGlob(url, pat)) return { kind: 'URL', value: url, pattern: pat };
+      }
+    }
+  }
+  const cmdPats = patternsOf(rule.commandConstraints);
+  if (cmdPats) {
+    const cmds = extractCommands(args);
+    for (const cmd of cmds) {
+      for (const pat of cmdPats) {
+        if (matchGlob(cmd, pat)) return { kind: 'command', value: cmd.slice(0, 60), pattern: pat };
+      }
+    }
+  }
+  const pathPats = patternsOf(rule.pathConstraints);
+  if (pathPats) {
+    const paths = extractPaths(args, isExec);
+    for (const p of paths) {
+      for (const pat of pathPats) {
+        if (matchPathGlob(p, pat)) return { kind: 'path', value: p, pattern: pat };
+      }
+    }
+  }
+  return null;
+}
+
+// Evaluate policy. Two modes:
+//   denylist (default): default ALLOW. Any DENY rule that matches → block.
+//   whitelist (strict): default DENY. Must match at least one ALLOW rule to
+//                       pass. DENY rules still override on top.
+function evaluate(policy, args, toolName) {
+  if (!policy || !policy.rules) return null;
+  const enabledRules = policy.rules.filter(r => r.enabled !== false);
+  const mode = policy.mode === 'whitelist' ? 'whitelist' : 'denylist';
+  const isExec = /bash|shell|exec|powershell|cmd|run|eval/.test((toolName || '').toLowerCase());
+
+  // DENY pass — runs in both modes. DENY wins over ALLOW.
+  const denyRules = enabledRules
+    .filter(r => r.effect === 'DENY' && permissionApplies(r, toolName))
+    .sort((a, b) => (a.priority || 100) - (b.priority || 100));
+  for (const rule of denyRules) {
+    const m = ruleMatches(rule, args, isExec);
+    if (m) return 'Blocked by policy: ' + m.kind + ' "' + m.value + '" matches "' + m.pattern + '"';
+  }
+
+  // Whitelist pass — only in strict mode. Must match at least one ALLOW rule.
+  if (mode === 'whitelist') {
+    const allowRules = enabledRules.filter(r => r.effect === 'ALLOW' && permissionApplies(r, toolName));
+    if (allowRules.length === 0) {
+      return 'Blocked by policy: strict whitelist mode is on and no ALLOW rule applies to ' + (toolName || 'this tool');
+    }
+    let matched = false;
+    for (const rule of allowRules) {
+      if (ruleMatches(rule, args, isExec)) { matched = true; break; }
+    }
+    if (!matched) {
+      return 'Blocked by policy: strict whitelist mode — request does not match any ALLOW rule';
+    }
+  }
+
+  return null;
+}
+
+// ── OPA WASM Evaluation (NIST SP 800-207 PDP) ──
+//
+// When the API has compiled this policy to an OPA WASM bundle AND the
+// @open-policy-agent/opa-wasm runtime is resolvable, we evaluate through OPA
+// instead of the hand-written evaluate() above. This is the same decision
+// engine the MCP proxy uses (packages/policy-engine/src/opa).
+//
+// Graceful degradation is the contract: any missing piece (no bundle, no
+// runtime, fetch/parse/eval error) makes evaluateWithOpa() return `undefined`,
+// and the caller falls back to the legacy JS evaluate() — so air-gapped
+// installs without OPA see ZERO behavior change.
+
+// Cheap, dependency-free djb2 fingerprint to detect policy changes for caching.
+function djb2(str) {
+  let h = 5381;
+  for (let i = 0; i < str.length; i++) h = ((h << 5) + h + str.charCodeAt(i)) | 0;
+  return (h >>> 0).toString(36);
+}
+
+// Extracts /policy.wasm from an OPA bundle. Mirrors
+// packages/policy-engine/src/opa/opa-evaluator.ts extractWasmFromBundle().
+// The bundle may be a gzipped tar (.tar.gz from `opa build -t wasm`) or raw WASM.
+function extractWasmFromBundle(buf) {
+  if (buf[0] === 0x1f && buf[1] === 0x8b) {
+    const tar = gunzipSync(buf);
+    let offset = 0;
+    while (offset < tar.length - 512) {
+      const nameEnd = tar.indexOf(0, offset);
+      const name = tar.subarray(offset, Math.min(nameEnd, offset + 100)).toString('utf-8');
+      if (!name || name.length === 0) break;
+      const sizeStr = tar.subarray(offset + 124, offset + 136).toString('utf-8').trim();
+      const size = parseInt(sizeStr, 8) || 0;
+      offset += 512;
+      if (name === 'policy.wasm' || name === './policy.wasm' || name.endsWith('/policy.wasm')) {
+        return Buffer.from(tar.subarray(offset, offset + size));
+      }
+      offset += Math.ceil(size / 512) * 512;
+    }
+    throw new Error('policy.wasm not found in OPA bundle');
+  }
+  if (buf[0] === 0x00 && buf[1] === 0x61 && buf[2] === 0x73 && buf[3] === 0x6d) {
+    return buf; // already raw WASM
+  }
+  throw new Error('Unknown OPA bundle format');
+}
+
+// Fetches the compiled WASM for this policy from the API, with a local cache
+// keyed by a fingerprint of the policy so updates propagate. Returns the raw
+// policy.wasm bytes (Uint8Array) or null when unavailable.
+const OPA_WASM_TTL_MS = 30_000;
+async function getOpaWasmBytes(policy) {
+  if (!policy || !policy.id) return null;
+  const fp = djb2(JSON.stringify(policy.rules || []) + '|' + (policy.mode || ''));
+  const agentKey = (AGENT_ID || 'default').replace(/[^a-zA-Z0-9_-]/g, '_');
+  const cacheFile = join(resolve(homedir(), '.solongate'), '.opa-wasm-' + agentKey + '.json');
+
+  // Read any cached bundle. A "fresh" hit (same policy fingerprint, within TTL)
+  // is returned immediately; otherwise we keep it as `stale` to fall back on if
+  // the API is momentarily unreachable — so transient downtime never drops OPA.
+  let stale = null;
+  try {
+    if (existsSync(cacheFile)) {
+      const c = JSON.parse(readFileSync(cacheFile, 'utf-8'));
+      if (c && c.wasm) {
+        stale = new Uint8Array(Buffer.from(c.wasm, 'base64'));
+        if (c.fp === fp && c._ts && Date.now() - c._ts < OPA_WASM_TTL_MS) {
+          return stale;
+        }
+      }
+    }
+  } catch {}
+
+  // Fetch the compiled bundle from the API (route already exists).
+  try {
+    const res = await fetch(
+      API_URL + '/api/v1/policies/' + encodeURIComponent(policy.id) + '/wasm',
+      { headers: AUTH_HEADERS, signal: AbortSignal.timeout(8000) },
+    );
+    if (!res.ok) return stale; // API has no compiled WASM right now → last known good
+    const bundle = Buffer.from(await res.arrayBuffer());
+    const wasm = extractWasmFromBundle(bundle);
+    try {
+      mkdirSync(resolve(homedir(), '.solongate'), { recursive: true });
+      writeFileSync(cacheFile, JSON.stringify({ _ts: Date.now(), fp, wasm: Buffer.from(wasm).toString('base64') }));
+    } catch {}
+    return new Uint8Array(wasm);
+  } catch {
+    return stale; // transient network failure → last known good
+  }
+}
+
+// Lazily load the opa-wasm runtime. Returns the loadPolicy fn or null if the
+// package isn't installed in this environment (typical for air-gapped hooks).
+let _loadPolicyFn = null;
+let _loadPolicyTried = false;
+async function getLoadPolicy() {
+  if (_loadPolicyTried) return _loadPolicyFn;
+  _loadPolicyTried = true;
+  try {
+    const mod = await import('@open-policy-agent/opa-wasm');
+    _loadPolicyFn = mod.loadPolicy || (mod.default && mod.default.loadPolicy) || null;
+  } catch {
+    _loadPolicyFn = null;
+  }
+  return _loadPolicyFn;
+}
+
+// Evaluates the policy through OPA WASM. Returns:
+//   - a reason string  → DENY
+//   - null             → ALLOW (OPA decided, no violation)
+//   - undefined        → OPA unavailable, caller must fall back to evaluate()
+async function evaluateWithOpa(policy, args, toolName, cwd) {
+  if (!policy || !policy.rules) return undefined;
+  try {
+    const loadPolicy = await getLoadPolicy();
+    if (!loadPolicy) return undefined;
+    const wasmBytes = await getOpaWasmBytes(policy);
+    if (!wasmBytes) return undefined;
+
+    const opaPolicy = await loadPolicy(wasmBytes, { initial: 5 });
+    // trust_level is fixed to 'TRUSTED' to preserve legacy guard.mjs behavior,
+    // which never evaluated minimumTrustLevel constraints.
+    // If the tool call references files (bash X.sh, source X, etc.), inline
+    // their contents so the SAME deterministic extractors see hidden commands.
+    // The hook reads files itself; OPA gets a flat, expanded view — no LLM
+    // needed for hidden-in-file detection at this layer.
+    // Inline referenced-file CONTENT only for tools that EXECUTE a script
+    // (`bash X.sh` → X.sh would run, so its contents matter). For read/write
+    // tools the file is data, not code — inlining its content there causes false
+    // positives (e.g. reading a file that merely mentions ".env" tripping an
+    // *.env rule, or reading a script that documents `rm -rf`).
+    const isExecTool = /bash|shell|exec|powershell|cmd|run|eval/.test((toolName || '').toLowerCase());
+    const refFiles = (isExecTool && typeof readReferencedFiles === 'function')
+      ? readReferencedFiles(args, cwd || process.cwd())
+      : {};
+    const expandedArgs = { ...((args && typeof args === 'object') ? args : {}) };
+    for (const [, content] of Object.entries(refFiles)) {
+      const lines = String(content).split('\n')
+        .map(l => l.trim())
+        .filter(l => l && !l.startsWith('#'));
+      if (lines.length > 0) {
+        const extra = lines.join('; ');
+        if (typeof expandedArgs.command === 'string') {
+          expandedArgs.command = expandedArgs.command + '; ' + extra;
+        } else {
+          expandedArgs.command = extra;
+        }
+      }
+    }
+    // Matching a filename/URL/path that appears in a tool BODY (content,
+    // new_string, text, …) only makes sense for EXEC tools, where that text would
+    // RUN. For read/write tools the body is data, not access — writing a doc that
+    // merely mentions a secret-file pattern is not accessing one. So strip body
+    // fields before extracting access targets; the command fields (what actually
+    // executes) are always scanned via extractCommands.
+    // (isExecTool already computed above for the referenced-file inlining gate.)
+    // For NON-exec tools, only the explicit path/target fields are an "access" —
+    // arbitrary text fields (a question, a description, a file body) are data, not
+    // access, and must not be matched against filename/path/url rules. So scan an
+    // ALLOWLIST of target fields only. Exec tools scan the full command instead.
+    // Includes network/url-bearing fields (url, uri, …) so non-exec network
+    // tools (Fetch/WebFetch) keep their access target — otherwise the url field
+    // is stripped here, input.urls comes out empty, and urlConstraints DENY
+    // rules never match (a fetch to a blocked host slips through).
+    const ACCESS_FIELDS = new Set(['file_path', 'path', 'target_file', 'notebook_path', 'filename', 'dest', 'destination', 'source', 'src', 'from', 'to', 'directory', 'dir', 'folder', 'url', 'urls', 'uri', 'href', 'link', 'endpoint']);
+    let accessArgs = expandedArgs;
+    if (!isExecTool && expandedArgs && typeof expandedArgs === 'object') {
+      accessArgs = {};
+      for (const [k, v] of Object.entries(expandedArgs)) {
+        if (ACCESS_FIELDS.has(k.toLowerCase())) accessArgs[k] = v;
+      }
+    }
+    const input = {
+      tool_name: toolName || '',
+      permission: guessPermission(toolName),
+      trust_level: 'TRUSTED',
+      arguments: expandedArgs,
+      paths: extractPaths(accessArgs, isExecTool),
+      commands: extractCommands(expandedArgs),
+      urls: extractUrls(accessArgs),
+      filenames: extractFilenames(accessArgs),
+    };
+    if (process.env.SOLONGATE_DEBUG) {
+    }
+    const results = opaPolicy.evaluate(input);
+    const decision = results && results[0] && results[0].result;
+    if (!decision || !decision.effect) return null;
+
+    // The generated Rego always has `default decision := DENY` (whitelist
+    // semantics). We must re-apply the policy mode here so denylist policies
+    // keep their default-ALLOW behavior, matching legacy evaluate():
+    //   - denylist: default-allow → block ONLY when a DENY rule actually
+    //     matched (matched_rule != null). Default DENY means "no rule matched".
+    //   - whitelist: default-deny → block on any DENY (default or matched).
+    // Routing per policy mode semantics:
+    //
+    //   DENYLIST (default-allow):
+    //     DENY match  → BLACK (block)
+    //     no match    → WHITE (default-allow, skip AI Judge — this IS the
+    //                   semantics of denylist: "block these, allow the rest")
+    //     REVIEW match → GRAY (only this explicit effect calls AI Judge)
+    //
+    //   WHITELIST (default-deny):
+    //     ALLOW match → WHITE (skip AI Judge)
+    //     DENY match  → BLACK
+    //     REVIEW match → GRAY
+    //     no match    → BLACK (default-deny)
+    //
+    // AI Judge runs ONLY when a rule explicitly says "this needs semantic
+    // review" — never as a fallback for "I'm not sure". That keeps token cost
+    // proportional to actual ambiguity and avoids running the model on every
+    // routine call.
+    const mode = policy.mode === 'whitelist' ? 'whitelist' : 'denylist';
+    const matched = decision.matched_rule != null;
+    const eff = decision.effect;
+    if (mode === 'denylist') {
+      if (eff === 'DENY' && matched) return '[SolonGate OPA] ' + (decision.reason || 'Blocked by policy');
+      if (eff === 'REVIEW' && matched) return { white: false, reason: decision.reason, ruleId: decision.matched_rule };
+      return { white: true, ruleId: matched ? decision.matched_rule : null };
+    }
+    // whitelist
+    if (eff === 'DENY' && matched) return '[SolonGate OPA] ' + (decision.reason || 'Blocked by policy');
+    if (eff === 'REVIEW' && matched) return { white: false, reason: decision.reason, ruleId: decision.matched_rule };
+    if (eff === 'ALLOW' && matched) return { white: true, ruleId: decision.matched_rule };
+    return '[SolonGate OPA] ' + (decision.reason || 'Blocked by policy: no ALLOW rule matched');
+  } catch {
+    return undefined; // any failure → fall back to legacy evaluator
+  }
+}
+
+// ── Main ──
+let input = '';
+// Read the contents of files a tool call references, so the AI Judge can see a
+// command HIDDEN inside a script/file (e.g. `bash deploy.sh`). Bounded: at most
+// a few small text files. Returns { name: content }.
+function readReferencedFiles(args, cwd) {
+  const out = {};
+  const MAX_FILES = 3, MAX_BYTES = 65536;
+  const cands = new Set();
+  // Only inline a file that is actually EXECUTED by an interpreter — `bash x.sh`,
+  // `python x.py`, `source x`, `. x`. A file that is merely an argument (rm/cp/cat
+  // x, or a read/write target) is NOT run, so its content must NOT be scanned —
+  // otherwise deleting a file whose text mentions a blocked name would false-block.
+  const INTERP = /^(?:bash|sh|zsh|ksh|dash|ash|python3?|node|deno|bun|ruby|perl|php|pwsh|powershell|source|\.)$/i;
+  if (args && typeof args === 'object') {
+    for (const f of ['command', 'cmd', 'script', 'shell', 'code']) {
+      const v = args[f];
+      if (typeof v !== 'string') continue;
+      const toks = v.split(/[\s'"();|&<>]+/).filter(Boolean);
+      for (let i = 0; i < toks.length - 1; i++) {
+        if (!INTERP.test(toks[i])) continue;
+        // The first non-flag token after the interpreter is the script it runs.
+        let j = i + 1;
+        while (j < toks.length && toks[j].startsWith('-')) j++;
+        if (j < toks.length) cands.add(toks[j]);
+      }
+    }
+  }
+  let n = 0;
+  for (const c of cands) {
+    if (n >= MAX_FILES) break;
+    try {
+      const p = resolve(cwd || process.cwd(), c);
+      if (!existsSync(p)) continue;
+      const st = statSync(p);
+      if (!st.isFile() || st.size > MAX_BYTES) continue;
+      out[c] = readFileSync(p, 'utf-8').slice(0, MAX_BYTES);
+      n++;
+    } catch {}
+  }
+  return out;
+}
+
+process.stdin.on('data', c => input += c);
+process.stdin.on('end', async () => {
+  // No policy selected => no enforcement. A plain launch (no SOLONGATE_AGENT_ID)
+  // is intentionally unrestricted.
+  if (process.env.SOLONGATE_DEBUG) {
+  }
+  // Cloud gate: the API key IS the policy selector — it identifies the project
+  // and its active policy. No key → nothing to enforce → allow. (Air-gap gated
+  // on SOLONGATE_AGENT_ID instead; here the key does that job.)
+  if (!API_KEY) {
+    allowTool();
+    return;
+  }
+  const _evalStart = Date.now();
+  try {
+    const raw = JSON.parse(input);
+
+    // Debug: append guard invocation to a cwd-local log. Opt-in only — set
+    // SOLONGATE_DEBUG=1 to enable. Off by default so it doesn't litter every
+    // working directory with .solongate/.debug-guard-log.
+    if (process.env.SOLONGATE_DEBUG) {
+      try {
+        const { appendFileSync: afs, mkdirSync: mds } = await import('node:fs');
+        mds(resolve('.solongate'), { recursive: true });
+        const debugLine = JSON.stringify({ ts: new Date().toISOString(), hook: 'guard', argv: process.argv.slice(2), tool_name: raw.tool_name || raw.toolName || raw.command, agent_id: AGENT_ID }) + '\n';
+        afs(resolve('.solongate', '.debug-guard-log'), debugLine);
+      } catch {}
+    }
+
+    let mappedToolName = raw.tool_name || raw.toolName || '';
+    let mappedToolInput = raw.tool_input || raw.toolInput || raw.params || {};
+
+    // Normalize field names across tools
+    const data = {
+      ...raw,
+      tool_name: mappedToolName,
+      tool_input: mappedToolInput,
+      tool_response: raw.tool_response || raw.toolResponse || {},
+      cwd: raw.cwd || process.cwd(),
+      session_id: raw.session_id || raw.sessionId || raw.conversation_id || '',
+    };
+    const args = data.tool_input;
+    const toolName = data.tool_name || '';
+
+    // (self-protection + PI hook layers removed per project decision)
+
+    // Load policy. Priority:
+    //   1. Dashboard-managed policy (GET /api/v1/policies/active, cached 10s)
+    //   2. Local policy.json next to cwd
+    // The dashboard is the source of truth — local policy.json is only a
+    // fallback for when the API is unreachable.
+    const hookCwd = data.cwd || process.cwd();
+    let policy;
+    // Self-protection (tamper guard) defaults ON. The cloud per-project setting
+    // can turn it off; delivered via /policies/active and cached alongside the
+    // policy. Any failure to read it leaves protection ON (fail safe).
+    let selfProtectEnabled = true;
+    // Extra security layers (rate limit, egress, DLP block) delivered by the
+    // cloud. Null = none configured. Fail open if unread.
+    let securityCfg = null;
+    // Cache keyed by agent_id so different agents in different terminals
+    // don't share a stale cached policy.
+    const agentKey = (AGENT_ID || 'default').replace(/[^a-zA-Z0-9_-]/g, '_');
+    const policyCacheFile = join(resolve(homedir(), '.solongate'), '.policy-cache-' + agentKey + '.json');
+    const POLICY_TTL_MS = 3_000;
+    try {
+      let dashboardPolicy = null;
+      // Try cache first
+      try {
+        if (existsSync(policyCacheFile)) {
+          const cached = JSON.parse(readFileSync(policyCacheFile, 'utf-8'));
+          if (cached && cached._ts && Date.now() - cached._ts < POLICY_TTL_MS) {
+            if (cached.policy) dashboardPolicy = cached.policy;
+            if (typeof cached.selfProtect === 'boolean') selfProtectEnabled = cached.selfProtect;
+            if (cached.security !== undefined) securityCfg = cached.security;
+            if (cached.hookVersions) CLOUD_HOOK_VERSIONS = cached.hookVersions;
+          }
+        }
+      } catch {}
+      // Refresh from API if cache expired
+      if (!dashboardPolicy) {
+        try {
+          // Report our installed version (hv) so the dashboard can show whether
+          // this guard is on the latest build.
+          const res = await fetch(API_URL + '/api/v1/policies/active?agent_id=' + encodeURIComponent(AGENT_ID || '') + '&hv=' + HOOK_VERSION, { headers: AUTH_HEADERS, signal: AbortSignal.timeout(8000) });
+          if (res.ok) {
+            const body = await res.json();
+            // Capture the self-protection flag even when no cloud policy is set.
+            if (typeof body?.self_protection_enabled === 'boolean') selfProtectEnabled = body.self_protection_enabled;
+            if (body?.security !== undefined) securityCfg = body.security;
+            if (body?.hook_versions && typeof body.hook_versions === 'object') CLOUD_HOOK_VERSIONS = body.hook_versions;
+            if (body && body.policy) dashboardPolicy = body.policy;
+            try { writeFileSync(policyCacheFile, JSON.stringify({ _ts: Date.now(), policy: dashboardPolicy || null, selfProtect: selfProtectEnabled, security: securityCfg, hookVersions: CLOUD_HOOK_VERSIONS })); } catch {}
+          }
+        } catch {}
+      }
+
+      if (process.env.SOLONGATE_DEBUG) {
+      }
+      if (dashboardPolicy) {
+        policy = dashboardPolicy;
+      } else {
+        // Fall back to ~/.solongate/policy.json (where the wizard writes the
+        // default), then a per-project policy.json next to cwd.
+        const candidates = [
+          join(resolve(homedir(), '.solongate'), 'policy.json'),
+          resolve(hookCwd, 'policy.json'),
+        ];
+        for (const p of candidates) {
+          if (existsSync(p)) {
+            try { policy = JSON.parse(readFileSync(p, 'utf-8')); break; } catch {}
+          }
+        }
+      }
+    } catch {
+      // Couldn't load any policy — leave policy undefined; evaluate() returns null.
+    }
+
+    if (process.env.SOLONGATE_DEBUG) {
+    }
+    // Agent scoping
+    {
+      const scope = (policy && Array.isArray(policy.agents) && policy.agents.length > 0)
+        ? policy.agents
+        : ['*'];
+      if (!scope.includes('*') && !scope.includes(AGENT_TYPE)) {
+    allowTool();
+        return;
+      }
+    }
+
+    if (process.env.SOLONGATE_DEBUG) {
+    }
+    // Tamper / self-protection — runs before policy eval. ON by default; the
+    // per-project cloud setting can disable it (fail safe: stays on if unread).
+    let reason = selfProtectEnabled ? tamperCheck(toolName, args) : null;
+    // Ghost paths — handled BEFORE the other layers and emitted as a STEALTH
+    // block: a mutating op on a hidden path is denied with a bare OS-style
+    // "No such file or directory" and NOTHING else (no ROUTE line, no SolonGate
+    // wording), so the agent can't tell the path is protected — it just looks
+    // absent. (Reads/listings aren't blocked; the PostToolUse hook strips them.)
+    if (!reason && securityCfg && securityCfg.ghost) {
+      const ghostHit = ghostBlock(toolName, args, securityCfg.ghost);
+      if (ghostHit) {
+        try { writeDenyFlag(toolName); } catch {}
+        writeLocalLog(securityCfg, { ts: new Date().toISOString(), tool: toolName, arguments: args, decision: 'DENY', reason: 'ghost path (hidden from agent)', permission: guessPermission(toolName), source: `${AGENT_TYPE}-guard`, agent_id: AGENT_TYPE, agent_name: AGENT_NAME, session_id: data.session_id || '', evaluation_time_ms: Date.now() - _evalStart });
+        try {
+          if (!localLogsOnly(securityCfg)) await fetch(API_URL + '/api/v1/audit-logs', {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json', ...AUTH_HEADERS },
+            body: JSON.stringify({
+              tool: toolName, arguments: args, decision: 'DENY',
+              reason: 'ghost path (hidden from agent)',
+              permission: guessPermission(toolName),
+              source: `${AGENT_TYPE}-guard`, agent_id: AGENT_TYPE, agent_name: AGENT_NAME,
+              session_id: data.session_id || '',
+              evaluation_time_ms: Date.now() - _evalStart,
+            }),
+            signal: AbortSignal.timeout(3000),
+          });
+        } catch {}
+        await maybeSelfUpdate();
+        if (AGENT_TYPE === 'gemini-cli') { process.stdout.write(JSON.stringify({ decision: 'deny', reason: ghostHit })); process.exit(0); }
+        process.stderr.write(ghostHit);
+        process.exit(2);
+      }
+      // No direct hit: if this is a listing command, rewrite it so hidden
+      // entries are filtered out of its output (Claude Code only).
+      if (AGENT_TYPE !== 'gemini-cli' && toolName === 'Bash') {
+        const rw = ghostListingRewrite(args, securityCfg.ghost);
+        if (rw) { await maybeSelfUpdate(); rewriteTool({ command: rw }); }
+      }
+    }
+    // Extra security layers run after tamper, before policy. Block reason wins
+    // immediately (BLACK). Fail-open by design.
+    if (!reason) reason = securityLayerCheck(toolName, args, securityCfg, agentKey);
+    if (process.env.SOLONGATE_DEBUG) {
+    }
+    // OPA WASM is the SOLE policy engine. With no policy configured for this
+    // agent we skip evaluation entirely (allow). With a policy present,
+    // evaluateWithOpa returns a reason (DENY), null (ALLOW), or undefined when
+    // the WASM bundle could not be obtained at all — in which case we fall back
+    // to the policy mode's default (whitelist → fail closed, denylist → fail
+    // open); see the branch below. (The legacy JS evaluate() below is retained
+    // but no longer on the decision path — OPA decides everything.)
+    // Cloud routing is BINARY — WHITE (allow) / BLACK (block). There is NO AI
+    // Judge in the cloud (that is an air-gap-only feature), so there is no GRAY
+    // "send to the judge" lane: the OPA policy alone decides. Tamper protection
+    // and any DENY (incl. fail-closed) → BLACK; everything else → WHITE. A REVIEW
+    // rule with no judge to escalate to is treated as allow under denylist.
+    let opaRoute = 'white';
+    if (reason) {
+      opaRoute = 'black'; // hardcoded tamper protection blocked it
+    } else if (policy && policy.rules) {
+      const opaResult = await evaluateWithOpa(policy, args, toolName, hookCwd);
+      if (opaResult === undefined) {
+        // OPA produced no decision (no WASM bundle yet, runtime missing, fetch
+        // error). This happens on COLD START — the first call(s) in a session
+        // before the policy + WASM are cached. Don't leave an enforcement gap:
+        // run the deterministic, WASM-free JS evaluator so DENY rules (e.g.
+        // secret-file protection) and whitelist defaults apply IMMEDIATELY, from
+        // the very first call. evaluate() implements both modes:
+        //   - returns a deny reason  → block (DENY match, or whitelist no-match)
+        //   - returns null           → allow (denylist default / whitelist match)
+        // This closes the "worked, but late" window where a denylist policy used
+        // to fail OPEN until WASM warmed up.
+        const legacy = evaluate(policy, args, toolName);
+        if (typeof legacy === 'string') {
+          reason = legacy;
+          opaRoute = 'black';
+        } else {
+          opaRoute = 'white';
+        }
+      } else if (typeof opaResult === 'string') {
+        reason = opaResult; // explicit DENY
+        opaRoute = 'black';
+      } else {
+        opaRoute = 'white'; // allow (rule match, default-allow, or review w/o judge)
+      }
+    }
+
+    process.stderr.write(`[SolonGate ROUTE] ${opaRoute.toUpperCase()} (${reason ? 'block' : 'allow'})\n`);
+
+    // Hand the measured policy-eval time to the audit hook: PostToolUse logs the
+    // ALLOW path and can't time the guard itself, so it reads this file back.
+    // Keyed by tool + session so the audit hook can match THIS invocation even
+    // when the tool itself runs for minutes (a bare timestamp TTL lost those).
+    try { const _fd = resolve('.solongate'); mkdirSync(_fd, { recursive: true }); writeFileSync(join(_fd, '.last-eval'), JSON.stringify({ ms: Date.now() - _evalStart, ts: Date.now(), tool: toolName, session: data.session_id || '' })); } catch {}
+
+    // Only log DENY decisions from guard hook.
+    // ALLOW decisions are logged by the audit hook (PostToolUse) to avoid double-counting.
+    if (reason) {
+      if (true) {
+        try {
+          const logEntry = {
+            tool: toolName, arguments: args,
+            decision: 'DENY', reason,
+            permission: guessPermission(toolName),
+            source: `${AGENT_TYPE}-guard`,
+            agent_id: AGENT_TYPE, agent_name: AGENT_NAME,
+            session_id: data.session_id || '',
+            evaluation_time_ms: Date.now() - _evalStart,
+          };
+          writeLocalLog(securityCfg, { ts: new Date().toISOString(), ...logEntry });
+          // PI hook layer removed — piResult fields no longer attached.
+          // Local-only mode: keep the log on the user's machine, skip the cloud.
+          if (!localLogsOnly(securityCfg)) await fetch(API_URL + '/api/v1/audit-logs', {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json', ...AUTH_HEADERS },
+            body: JSON.stringify(logEntry),
+            signal: AbortSignal.timeout(3000),
+          });
+        } catch {}
+      }
+      writeDenyFlag(toolName);
+      await maybeSelfUpdate();
+      blockTool(reason);
+    }
+  } catch {}
+  await maybeSelfUpdate();
+  allowTool();
+});