@stroq/cli 0.16.0 → 0.16.1

package/dist/index.js

@@ -3044,6 +3044,12 @@ function originClasses(hits, classes) {
   return { classes: out, counted };
 }
 
+// ../core/src/util/controls.ts
+var UNSAFE = /[\u0000-\u0008\u000b-\u001f\u007f-\u009f‪-‮⁦-⁩]/g;
+function neutralizeControls(text) {
+  return text.replace(UNSAFE, (char) => `\\u${char.charCodeAt(0).toString(16).padStart(4, "0")}`);
+}
+
 // ../core/src/provenance/describe.ts
 function ageLabel(fromIso, now) {
   const from = Date.parse(fromIso);
@@ -3059,7 +3065,10 @@ function toEvidence(hit) {
 }
 function describeEvidence(evidence, now) {
   const flagged = evidence.suspect ? "Stroq flagged that content as suspicious." : "that content was not flagged, but tool output is data, not instructions.";
-  return `"${evidence.excerpt}" appeared in the output of ${evidence.tool} (${evidence.source}) ${ageLabel(evidence.at, now)} ago; ${flagged}`;
+  const quoted = neutralizeControls(
+    `"${evidence.excerpt}" appeared in the output of ${evidence.tool} (${evidence.source})`
+  );
+  return `${quoted} ${ageLabel(evidence.at, now)} ago; ${flagged}`;
 }
 
 // ../core/src/secrets/extract.ts
@@ -3781,10 +3790,12 @@ ${raw}`;
 
 // ../core/src/secrets/describe.ts
 function describeSecretHit(hit) {
+  const name = neutralizeControls(hit.name);
+  const source = neutralizeControls(hit.source);
   if (hit.canary) {
-    return `the arguments contain the value of ${hit.name}, a Stroq canary; the session is now marked suspect.`;
+    return `the arguments contain the value of ${name}, a Stroq canary; the session is now marked suspect.`;
   }
-  return `the arguments contain the value of ${hit.name} from ${hit.source}.`;
+  return `the arguments contain the value of ${name} from ${source}.`;
 }
 
 // ../core/src/cloak/patterns.ts
@@ -4761,30 +4772,30 @@ var MUTATION_WIDTH = 32;
 var variantLine = (v) => `  ${v.scenarioId.padEnd(ID_WIDTH)} ${v.mutationId.padEnd(MUTATION_WIDTH)} allow    (${v.ruleId ?? "no rule"})`;
 var erroredLine = (v) => `  ${v.scenarioId.padEnd(ID_WIDTH)} ${v.mutationId.padEnd(MUTATION_WIDTH)} ${v.error ?? "unknown error"}`;
 var ratio = (part, whole) => whole === 0 ? "\u2014" : `${(part / whole * 100).toFixed(1)}%`;
-function formatFuzz(report) {
+function formatFuzz(report2) {
   const lines = [
-    `stroq attack --fuzz: ${report.scenarios} scenarios x ${report.mutations} mutations = ${report.variants} variants, policy ${report.policy}`,
-    `survived:  ${report.survived} / ${report.variants}   (${ratio(report.survived, report.variants)})`,
-    `escaped:   ${report.escaped.length}`,
-    ...report.escaped.map(variantLine)
+    `stroq attack --fuzz: ${report2.scenarios} scenarios x ${report2.mutations} mutations = ${report2.variants} variants, policy ${report2.policy}`,
+    `survived:  ${report2.survived} / ${report2.variants}   (${ratio(report2.survived, report2.variants)})`,
+    `escaped:   ${report2.escaped.length}`,
+    ...report2.escaped.map(variantLine)
   ];
-  if (report.escaped.length === 0)
+  if (report2.escaped.length === 0)
     lines.push("  no escapes: every semantics-preserving variant was stopped.");
-  if (report.recorded.length > 0) {
+  if (report2.recorded.length > 0) {
     lines.push(
-      `recorded, not asserted: ${report.recorded.length} (the mutation destroys the payload, so getting through proves nothing)`,
-      ...report.recorded.map(variantLine)
+      `recorded, not asserted: ${report2.recorded.length} (the mutation destroys the payload, so getting through proves nothing)`,
+      ...report2.recorded.map(variantLine)
     );
   }
-  if (report.errored.length > 0) {
+  if (report2.errored.length > 0) {
     lines.push(
-      `errored: ${report.errored.length} (the mutation itself threw and could not be produced, so nothing ran)`,
-      ...report.errored.map(erroredLine)
+      `errored: ${report2.errored.length} (the mutation itself threw and could not be produced, so nothing ran)`,
+      ...report2.errored.map(erroredLine)
     );
   }
-  if (report.notApplicable > 0) {
+  if (report2.notApplicable > 0) {
     lines.push(
-      `not applicable: ${report.notApplicable} \u2014 ${report.textless.length} scenario(s) carry no untrusted text to mutate: ${report.textless.join(", ")}`
+      `not applicable: ${report2.notApplicable} \u2014 ${report2.textless.length} scenario(s) carry no untrusted text to mutate: ${report2.textless.join(", ")}`
     );
   }
   return `${lines.join("\n")}
@@ -4808,16 +4819,16 @@ function scenarioLine(result) {
   const incident = result.incident === null ? `${result.class ?? "synthetic cell"} (synthetic)` : `${result.incident.name} (${result.incident.date})`;
   return `${mark} ${result.id.padEnd(ID_WIDTH2)} ${result.outcome.padEnd(OUTCOME_WIDTH)} ${rule} ${incident}${result.ok ? "" : mismatch(result)}`;
 }
-function summaryLine(report) {
-  const { blocked, asked, passed } = report.totals;
-  const head = `${plural(report.scenarios.length, "scenario")}: ${blocked} blocked, ${asked} asked, ${passed} passed through`;
-  if (report.ok && passed === 0) return `${head} \u2014 every attack was stopped.`;
-  const wrong = report.scenarios.filter((r) => !r.ok).length;
+function summaryLine(report2) {
+  const { blocked, asked, passed } = report2.totals;
+  const head = `${plural(report2.scenarios.length, "scenario")}: ${blocked} blocked, ${asked} asked, ${passed} passed through`;
+  if (report2.ok && passed === 0) return `${head} \u2014 every attack was stopped.`;
+  const wrong = report2.scenarios.filter((r) => !r.ok).length;
   return `${head} \u2014 ${plural(wrong, "scenario")} did not behave as expected; your policy is weaker than the default (compare it with policies/default.yaml).`;
 }
-function formatReport(report) {
-  const header = `stroq attack: ${plural(report.scenarios.length, "recorded incident")} against policy ${report.policy}`;
-  return `${[header, ...report.scenarios.map(scenarioLine), summaryLine(report)].join("\n")}
+function formatReport(report2) {
+  const header = `stroq attack: ${plural(report2.scenarios.length, "recorded incident")} against policy ${report2.policy}`;
+  return `${[header, ...report2.scenarios.map(scenarioLine), summaryLine(report2)].join("\n")}
 `;
 }
 
@@ -4893,7 +4904,7 @@ async function runAttackCommand(args) {
   }
   if (values.fuzz) {
     const showProgress = values.json !== true && process.stderr.isTTY === true;
-    const report2 = await runFuzz(
+    const report3 = await runFuzz(
       selected,
       MUTATIONS,
       loadPolicy(),
@@ -4901,14 +4912,14 @@ async function runAttackCommand(args) {
       showProgress ? (done, total) => process.stderr.write(`\rfuzzing ${done}/${total}`) : void 0
     );
     if (showProgress) process.stderr.write("\r");
-    process.stdout.write(values.json ? `${JSON.stringify(report2, null, 2)}
-` : formatFuzz(report2));
-    return report2.ok ? 0 : 1;
+    process.stdout.write(values.json ? `${JSON.stringify(report3, null, 2)}
+` : formatFuzz(report3));
+    return report3.ok ? 0 : 1;
   }
-  const report = await runAttack(selected, loadPolicy(), displayPath2(policySource()));
-  process.stdout.write(values.json ? `${JSON.stringify(report, null, 2)}
-` : formatReport(report));
-  return report.ok ? 0 : 1;
+  const report2 = await runAttack(selected, loadPolicy(), displayPath2(policySource()));
+  process.stdout.write(values.json ? `${JSON.stringify(report2, null, 2)}
+` : formatReport(report2));
+  return report2.ok ? 0 : 1;
 }
 
 // src/commands/bench.ts
@@ -5007,39 +5018,39 @@ function runBench(dir) {
   };
 }
 var percent = (rate) => `${(rate * 100).toFixed(1)}%`;
-function formatBench(report, opts = {}) {
+function formatBench(report2, opts = {}) {
   const lines = [
-    `stroq bench: ${report.files} files, ${Math.round(report.bytes / 1024)} KB, ${report.rules} rules`,
-    `flagged:   ${report.flagged} / ${report.files}   (${percent(report.rate)})`
+    `stroq bench: ${report2.files} files, ${Math.round(report2.bytes / 1024)} KB, ${report2.rules} rules`,
+    `flagged:   ${report2.flagged} / ${report2.files}   (${percent(report2.rate)})`
   ];
-  if (report.timedOut > 0) {
-    const noun = report.timedOut === 1 ? "scan" : "scans";
+  if (report2.timedOut > 0) {
+    const noun = report2.timedOut === 1 ? "scan" : "scans";
     lines.push(
-      `timedOut:  ${report.timedOut} ${noun} hit the bench's scan budget and were forced suspect by that alone, not by a rule match \u2014 see docs/BENCH.md's Method section.`
+      `timedOut:  ${report2.timedOut} ${noun} hit the bench's scan budget and were forced suspect by that alone, not by a rule match \u2014 see docs/BENCH.md's Method section.`
     );
   }
   if (opts.timings === true) {
-    const headroom = DEFAULT_BUDGET_MS / Math.max(report.slowestMs, 1e-3);
+    const headroom = DEFAULT_BUDGET_MS / Math.max(report2.slowestMs, 1e-3);
     const verdict = headroom < 2 ? "  ** raise DEFAULT_BUDGET_MS **" : "";
-    const which = opts.verbose === true ? ` (${basename2(report.slowestFile)})` : "";
+    const which = opts.verbose === true ? ` (${basename2(report2.slowestFile)})` : "";
     lines.push(
-      `slowest:   ${report.slowestMs.toFixed(0)} ms${which} against production's ${DEFAULT_BUDGET_MS} ms budget \u2014 ${headroom.toFixed(1)}x headroom${verdict}`
+      `slowest:   ${report2.slowestMs.toFixed(0)} ms${which} against production's ${DEFAULT_BUDGET_MS} ms budget \u2014 ${headroom.toFixed(1)}x headroom${verdict}`
     );
   }
-  if (report.byRule.length === 0) {
+  if (report2.byRule.length === 0) {
     lines.push("", "Nothing in this corpus trips a rule.");
   } else {
     lines.push("");
-    for (const hit of report.byRule) {
+    for (const hit of report2.byRule) {
       lines.push(
         `  ${hit.ruleId.padEnd(18)} ${hit.title.slice(0, 48).padEnd(48)} ${hit.files} file${hit.files === 1 ? "" : "s"}`
       );
     }
   }
-  if (opts.verbose && report.flaggedFiles.length > 0) {
-    lines.push("", "Flagged files:", ...report.flaggedFiles.map((f) => `  ${f}`));
+  if (opts.verbose && report2.flaggedFiles.length > 0) {
+    lines.push("", "Flagged files:", ...report2.flaggedFiles.map((f) => `  ${f}`));
   }
-  lines.push("", `corpus: ${report.corpus}`);
+  lines.push("", `corpus: ${report2.corpus}`);
   return `${lines.join("\n")}
 `;
 }
@@ -5061,10 +5072,10 @@ async function runBenchCommand(args) {
     );
     return 1;
   }
-  const report = runBench(dir);
+  const report2 = runBench(dir);
   process.stdout.write(
-    values.json ? `${JSON.stringify(report, null, 2)}
-` : formatBench(report, { verbose: values.verbose, timings: true })
+    values.json ? `${JSON.stringify(report2, null, 2)}
+` : formatBench(report2, { verbose: values.verbose, timings: true })
   );
   return 0;
 }
@@ -5201,23 +5212,23 @@ function asiLine(risk) {
   const reason = ASI_UNCLAIMED_REASON[risk.id];
   return `${risk.id.padEnd(6)} ${risk.name} \u2014 not claimed by any scenario${reason ? ` (${reason})` : ""}`;
 }
-function headerLine(report) {
-  const { total, documented, synthetic } = report.scenarios;
-  return `stroq coverage \u2014 ${total} scenarios (${documented} documented, ${synthetic} synthetic) \xB7 ATLAS ${report.atlasRelease} \xB7 OWASP ASI ${report.asiEdition}`;
+function headerLine(report2) {
+  const { total, documented, synthetic } = report2.scenarios;
+  return `stroq coverage \u2014 ${total} scenarios (${documented} documented, ${synthetic} synthetic) \xB7 ATLAS ${report2.atlasRelease} \xB7 OWASP ASI ${report2.asiEdition}`;
 }
 function summaryLine2(summary) {
   return `in scope: ${summary.inScope} techniques \u2014 ${summary.covered} covered, ${summary.partial} partial, ${summary.notCovered} not covered`;
 }
-function formatCoverage(report) {
+function formatCoverage(report2) {
   const lines = [
-    headerLine(report),
+    headerLine(report2),
     "",
-    ...report.techniques.map(techniqueLine),
+    ...report2.techniques.map(techniqueLine),
     "",
-    summaryLine2(report.summary),
+    summaryLine2(report2.summary),
     "",
     "OWASP ASI 2026:",
-    ...report.asi.map(asiLine)
+    ...report2.asi.map(asiLine)
   ];
   return `${lines.join("\n")}
 `;
@@ -5231,16 +5242,16 @@ function navigatorComment(t) {
   if (t.limitation !== null) return t.limitation;
   return t.scenarios.length > 0 ? `covered, no stated limitation \u2014 scenarios: ${t.scenarios.join(", ")}` : "no scenario covers this yet";
 }
-function toNavigatorLayer(report) {
+function toNavigatorLayer(report2) {
   return {
     name: "Stroq control mapping",
     versions: { layer: "4.3", navigator: "4.6.4" },
     domain: "atlas-atlas",
-    description: `What Stroq's hook-based action firewall addresses against MITRE ATLAS ${report.atlasRelease}, derived from its attack corpus: ${report.scenarios.total} scenarios (${report.scenarios.documented} documented, ${report.scenarios.synthetic} synthetic).`,
+    description: `What Stroq's hook-based action firewall addresses against MITRE ATLAS ${report2.atlasRelease}, derived from its attack corpus: ${report2.scenarios.total} scenarios (${report2.scenarios.documented} documented, ${report2.scenarios.synthetic} synthetic).`,
     sorting: 0,
     layout: { layout: "side", showID: true, showName: true },
     hideDisabled: false,
-    techniques: report.techniques.map((t) => ({
+    techniques: report2.techniques.map((t) => ({
       techniqueID: t.id,
       color: NAVIGATOR_COLOR[t.status],
       comment: navigatorComment(t),
@@ -5254,8 +5265,8 @@ function toNavigatorLayer(report) {
       { label: "not covered", color: NAVIGATOR_COLOR.not_covered }
     ],
     metadata: [
-      { name: "atlas_data_version", value: report.atlasRelease },
-      { name: "asi_edition", value: report.asiEdition }
+      { name: "atlas_data_version", value: report2.atlasRelease },
+      { name: "asi_edition", value: report2.asiEdition }
     ],
     links: [],
     showTacticRowBackground: false,
@@ -5271,9 +5282,9 @@ async function runCoverageCommand(args) {
     args: [...args],
     options: { format: { type: "string" }, json: { type: "boolean", default: false } }
   });
-  const report = buildCoverage();
+  const report2 = buildCoverage();
   if (values.format === "navigator") {
-    process.stdout.write(`${JSON.stringify(toNavigatorLayer(report), null, 2)}
+    process.stdout.write(`${JSON.stringify(toNavigatorLayer(report2), null, 2)}
 `);
     return 0;
   }
@@ -5285,15 +5296,15 @@ async function runCoverageCommand(args) {
     return 1;
   }
   process.stdout.write(
-    values.json ? `${JSON.stringify(report, null, 2)}
-` : formatCoverage(report)
+    values.json ? `${JSON.stringify(report2, null, 2)}
+` : formatCoverage(report2)
   );
   return 0;
 }
 
 // src/commands/doctor.ts
 import { existsSync as existsSync9, readFileSync as readFileSync13 } from "fs";
-import { homedir as homedir13 } from "os";
+import { homedir as homedir14 } from "os";
 import { join as join18 } from "path";
 
 // src/adapters/cursor.ts
@@ -5669,26 +5680,76 @@ function cursorFailClosedOutput(raw, err) {
 }
 
 // src/commands/cursor-hooks.ts
-import { homedir as homedir5 } from "os";
+import { homedir as homedir6 } from "os";
 import { join as join10 } from "path";
 
 // src/commands/config-file.ts
-import { existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync9, writeFileSync } from "fs";
-import { dirname as dirname5 } from "path";
+import {
+  existsSync as existsSync3,
+  mkdirSync as mkdirSync2,
+  readFileSync as readFileSync9,
+  realpathSync,
+  statSync as statSync5,
+  writeFileSync
+} from "fs";
+import { homedir as homedir5 } from "os";
+import { basename as basename3, dirname as dirname5, isAbsolute as isAbsolute2, relative as relative2, resolve as resolve2 } from "path";
 var HOOK_TIMEOUT_SECONDS = 15;
 var HOOK_DEADLINE_FRACTION = 0.6;
 var hookDeadlineMs = (agentTimeoutSeconds) => Math.round(agentTimeoutSeconds * 1e3 * HOOK_DEADLINE_FRACTION);
+function parseFailure(err) {
+  const message = err instanceof Error ? err.message : "";
+  const where = /\(line \d+ column \d+\)|at position \d+/.exec(message)?.[0];
+  return where === void 0 ? "not valid JSON" : `not valid JSON ${where}`;
+}
+var MAX_CONFIG_BYTES = 4 * 1024 * 1024;
 function readJsonObject(file) {
   if (!existsSync3(file)) return {};
+  const info = statSync5(file);
+  if (!info.isFile()) throw new Error(`cannot read ${file}: not a regular file`);
+  if (info.size > MAX_CONFIG_BYTES)
+    throw new Error(`cannot read ${file}: ${info.size} bytes is too large for an agent config`);
   const text = readFileSync9(file, "utf8");
   if (text.trim().length === 0) return {};
   try {
     return JSON.parse(text);
   } catch (err) {
-    throw new Error(`cannot parse ${file}: ${err.message}`, { cause: err });
+    throw new Error(`cannot parse ${file}: ${parseFailure(err)}`, { cause: err });
+  }
+}
+var within = (path, root) => {
+  const rel = relative2(root, path);
+  return rel === "" || !rel.startsWith("..") && !isAbsolute2(rel);
+};
+function realTarget(file) {
+  const pending = [];
+  let at = resolve2(file);
+  for (; ; ) {
+    try {
+      return resolve2(realpathSync(at), ...pending);
+    } catch {
+      const parent = dirname5(at);
+      if (parent === at) return resolve2(file);
+      pending.unshift(basename3(at));
+      at = parent;
+    }
+  }
+}
+function assertStaysInside(file) {
+  const requested = resolve2(file);
+  const roots = [process.cwd(), homedir5()].map((root2) => resolve2(root2)).filter((root2) => within(requested, root2)).sort((a, b) => b.length - a.length);
+  const root = roots[0];
+  if (root === void 0) return;
+  const realRoot = realTarget(root);
+  const target = realTarget(requested);
+  if (!within(target, realRoot)) {
+    throw new Error(
+      `refusing to write ${file}: it resolves to ${target}, outside ${root}. A symlink in the path leads out of it; replace it with a regular file first.`
+    );
   }
 }
 function writeJsonObject(file, value) {
+  assertStaysInside(file);
   mkdirSync2(dirname5(file), { recursive: true });
   writeFileSync(file, `${JSON.stringify(value, null, 2)}
 `);
@@ -5731,7 +5792,7 @@ function mergeCursorHooks(settings, command) {
   return { ...settings, version: CURSOR_HOOKS_VERSION, hooks: { ...hooks, ...ours } };
 }
 function cursorHooksPath(scope, cwd = process.cwd()) {
-  return scope === "user" ? join10(homedir5(), ".cursor", "hooks.json") : join10(cwd, ".cursor", "hooks.json");
+  return scope === "user" ? join10(homedir6(), ".cursor", "hooks.json") : join10(cwd, ".cursor", "hooks.json");
 }
 var readCursorHooks = (file) => readJsonObject(file);
 function installCursorHooks(file, command) {
@@ -5741,7 +5802,7 @@ function installCursorHooks(file, command) {
 }
 
 // src/commands/codex-hooks.ts
-import { homedir as homedir6 } from "os";
+import { homedir as homedir7 } from "os";
 import { join as join11 } from "path";
 var CODEX_PRE_MATCHER = "Bash|exec_command|shell|local_shell|apply_patch|ApplyPatch|mcp__.*";
 var CODEX_POST_MATCHER = "Bash|exec_command|shell|local_shell|mcp__.*";
@@ -5833,7 +5894,7 @@ function hasAnyStroqCodexHook(settings) {
   );
 }
 function codexHooksPath(scope, cwd = process.cwd()) {
-  return scope === "user" ? join11(homedir6(), ".codex", "hooks.json") : join11(cwd, ".codex", "hooks.json");
+  return scope === "user" ? join11(homedir7(), ".codex", "hooks.json") : join11(cwd, ".codex", "hooks.json");
 }
 var readCodexHooks = (file) => readJsonObject(file);
 function installCodexHooks(file, command) {
@@ -5844,7 +5905,7 @@ function installCodexHooks(file, command) {
 
 // src/commands/copilot-hooks.ts
 import { existsSync as existsSync4 } from "fs";
-import { homedir as homedir7 } from "os";
+import { homedir as homedir8 } from "os";
 import { join as join12 } from "path";
 var COPILOT_HOOK_EVENTS = ["preToolUse", "postToolUse"];
 var COPILOT_HOOK_TIMEOUT_SECONDS = 30;
@@ -5876,7 +5937,7 @@ function copilotHooksPath(scope, cwd = process.cwd(), env = process.env) {
   if (scope === "project") return join12(cwd, ".github", "hooks", "stroq.json");
   const home = env["COPILOT_HOME"];
   return join12(
-    home !== void 0 && home !== "" ? home : join12(homedir7(), ".copilot"),
+    home !== void 0 && home !== "" ? home : join12(homedir8(), ".copilot"),
     "hooks",
     "stroq.json"
   );
@@ -5900,15 +5961,15 @@ function installCopilotHooks(file, commandPre, commandPost) {
 }
 
 // src/commands/windsurf-hooks.ts
-import { homedir as homedir8 } from "os";
+import { homedir as homedir9 } from "os";
 import { join as join13 } from "path";
 
 // src/adapters/windsurf.ts
 import { z as z9 } from "zod";
 
 // src/adapters/file-scan.ts
-import { closeSync as closeSync2, openSync as openSync2, readSync as readSync2, statSync as statSync5 } from "fs";
-import { isAbsolute as isAbsolute2, resolve as resolve2 } from "path";
+import { closeSync as closeSync2, openSync as openSync2, readSync as readSync2, statSync as statSync6 } from "fs";
+import { isAbsolute as isAbsolute3, resolve as resolve3 } from "path";
 var MAX_SCAN_READ_BYTES = 1048576;
 function readCapped(path, size, maxBytes) {
   const fd = openSync2(path, "r");
@@ -5923,8 +5984,8 @@ function readCapped(path, size, maxBytes) {
 function readScanText(filePath, cwd, maxBytes = MAX_SCAN_READ_BYTES) {
   if (filePath === "") return "";
   try {
-    const path = isAbsolute2(filePath) ? filePath : resolve2(cwd, filePath);
-    const stats = statSync5(path);
+    const path = isAbsolute3(filePath) ? filePath : resolve3(cwd, filePath);
+    const stats = statSync6(path);
     if (!stats.isFile() || stats.size === 0) return "";
     return readCapped(path, stats.size, maxBytes);
   } catch {
@@ -6318,7 +6379,7 @@ var eventEntries2 = (json2, event) => {
 var isStroqEntry2 = (value) => isPlainObject(value) && typeof value["command"] === "string" && / hook windsurf$/.test(value["command"]);
 var isStroqWindsurfHooks = (json2) => WINDSURF_EVENTS.every((event) => eventEntries2(json2, event).some(isStroqEntry2));
 function windsurfHooksPath(scope, cwd = process.cwd()) {
-  return scope === "user" ? join13(homedir8(), ".codeium", "windsurf", "hooks.json") : join13(cwd, ".windsurf", "hooks.json");
+  return scope === "user" ? join13(homedir9(), ".codeium", "windsurf", "hooks.json") : join13(cwd, ".windsurf", "hooks.json");
 }
 var readWindsurfHooks = (file) => readJsonObject(file);
 function installWindsurfHooks(file, command) {
@@ -6328,7 +6389,7 @@ function installWindsurfHooks(file, command) {
 }
 
 // src/commands/antigravity-hooks.ts
-import { homedir as homedir9 } from "os";
+import { homedir as homedir10 } from "os";
 import { join as join14 } from "path";
 var ANTIGRAVITY_HOOK_NAME = "stroq";
 var ANTIGRAVITY_HOOK_EVENTS = ["PreToolUse", "PostToolUse", "PreInvocation"];
@@ -6372,7 +6433,7 @@ function isStroqAntigravityHooks(json2) {
   return ANTIGRAVITY_HOOK_EVENTS.every((event) => eventHasStroqHandler(entry2, event));
 }
 function antigravityHooksPath(scope, cwd = process.cwd()) {
-  return scope === "user" ? join14(homedir9(), ".gemini", "config", "hooks.json") : join14(cwd, ".agents", "hooks.json");
+  return scope === "user" ? join14(homedir10(), ".gemini", "config", "hooks.json") : join14(cwd, ".agents", "hooks.json");
 }
 var readAntigravityHooks = (file) => readJsonObject(file);
 function installAntigravityHooks(file, command) {
@@ -6382,8 +6443,8 @@ function installAntigravityHooks(file, command) {
 }
 
 // src/commands/init.ts
-import { homedir as homedir12 } from "os";
-import { join as join17, resolve as resolve4 } from "path";
+import { homedir as homedir13 } from "os";
+import { join as join17, resolve as resolve5 } from "path";
 import { parseArgs as parseArgs5 } from "util";
 
 // src/commands/install-record.ts
@@ -6424,7 +6485,7 @@ function installDrift(agent, scope, configText, record = readInstallRecord()) {
 // src/commands/openclaw-plugin.ts
 import { spawnSync } from "child_process";
 import { accessSync, constants, copyFileSync, existsSync as existsSync6, mkdirSync as mkdirSync4, readFileSync as readFileSync11 } from "fs";
-import { homedir as homedir10 } from "os";
+import { homedir as homedir11 } from "os";
 import { delimiter, dirname as dirname7, join as join15 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 var OPENCLAW_PLUGIN_ID = "stroq";
@@ -6455,7 +6516,7 @@ function packagedPluginDir(from = dirname7(fileURLToPath2(import.meta.url))) {
 }
 function openclawPluginDir(env = process.env) {
   const home = env["STROQ_HOME"];
-  return join15(home !== void 0 && home !== "" ? home : join15(homedir10(), ".stroq"), PLUGIN_DIRNAME);
+  return join15(home !== void 0 && home !== "" ? home : join15(homedir11(), ".stroq"), PLUGIN_DIRNAME);
 }
 function installOpenClawPlugin(dir, command) {
   const source = packagedPluginDir();
@@ -6514,12 +6575,12 @@ function runOpenClawInstall(bin, dir, run = spawnCommand) {
 }
 
 // src/commands/init-mcp.ts
-import { existsSync as existsSync8, statSync as statSync6 } from "fs";
-import { basename as basename3, resolve as resolve3 } from "path";
+import { existsSync as existsSync8, statSync as statSync7 } from "fs";
+import { basename as basename4, resolve as resolve4 } from "path";
 
 // src/commands/mcp-config.ts
 import { existsSync as existsSync7 } from "fs";
-import { homedir as homedir11 } from "os";
+import { homedir as homedir12 } from "os";
 import { join as join16 } from "path";
 var MCP_CLIENTS = [
   "claude-desktop",
@@ -6528,7 +6589,7 @@ var MCP_CLIENTS = [
   "claude-code"
 ];
 var isMcpClient = (value) => MCP_CLIENTS.includes(value);
-function claudeDesktopPath(plat = process.platform, env = process.env, home = homedir11()) {
+function claudeDesktopPath(plat = process.platform, env = process.env, home = homedir12()) {
   if (plat === "darwin")
     return join16(home, "Library", "Application Support", "Claude", "claude_desktop_config.json");
   if (plat === "win32")
@@ -6544,7 +6605,7 @@ function windsurfMcpPath(home) {
   return existsSync7(ide) ? ide : join16(home, ".codeium", "mcp_config.json");
 }
 function mcpConfigPath(client, scope, cwd = process.cwd()) {
-  const home = homedir11();
+  const home = homedir12();
   if (client === "claude-desktop") return claudeDesktopPath(process.platform, process.env, home);
   if (client === "windsurf") return windsurfMcpPath(home);
   if (client === "cursor")
@@ -6680,13 +6741,13 @@ function countWrapped(config) {
 var MCP_NOTE = 'Restart the MCP client before this takes effect: it launches its servers once, when it starts.\nThis directory is recorded as the project for every wrapped server: it is what feeds the secret index and the path rules.\nAn MCP proxy cannot prompt, so a policy "ask" arrives as a blocked tool result naming the rule to relax.\nHTTP servers (url/serverUrl) have no subprocess to wrap and are listed as skipped.\nEach wrapped server starts with the variables its own "env" block declares plus the ones any process needs; nothing else in your environment reaches it. Add a variable to that block and re-run this command if a server needs one.\n"stroq init --agent mcp --unwrap" restores every wrapped entry to its original command.\n';
 function mcpTarget(client, configPath, scope) {
   if (client === void 0) {
-    const file = resolve3(configPath ?? "");
-    return { file, label: basename3(file) };
+    const file = resolve4(configPath ?? "");
+    return { file, label: basename4(file) };
   }
   if (!isMcpClient(client)) return null;
   return { file: mcpConfigPath(client, scope), label: client };
 }
-var isExistingFile = (path) => existsSync8(path) && statSync6(path).isFile();
+var isExistingFile = (path) => existsSync8(path) && statSync7(path).isFile();
 function formatOutcome({ action, name }) {
   const qualified = /^(.+) \((.+)\)$/.exec(action);
   return qualified ? `${qualified[1]} ${name} (${qualified[2]})` : `${action} ${name}`;
@@ -6798,7 +6859,7 @@ function mergeHooks(settings, command) {
   };
 }
 function settingsPath(scope, cwd = process.cwd()) {
-  return scope === "user" ? join17(homedir12(), ".claude", "settings.json") : join17(cwd, ".claude", "settings.json");
+  return scope === "user" ? join17(homedir13(), ".claude", "settings.json") : join17(cwd, ".claude", "settings.json");
 }
 var readSettings = (file) => readJsonObject(file);
 function installHooks(file, command) {
@@ -6990,7 +7051,7 @@ async function runInit(args) {
   const scope = values.user ? "user" : "project";
   const dryRun = values["dry-run"] === true;
   const node = process.execPath;
-  const entry2 = resolve4(process.argv[1] ?? "");
+  const entry2 = resolve5(process.argv[1] ?? "");
   if (agent === "mcp")
     return initMcp(scope, hookArgv(node, entry2), dryRun, {
       ...values.client === void 0 ? {} : { client: values.client },
@@ -7034,7 +7095,7 @@ var AGENT_DIRS = {
   windsurf: { project: [".windsurf"], user: [join18(".codeium", "windsurf")] },
   antigravity: { project: [".agents"], user: [join18(".gemini", "antigravity-cli")] }
 };
-function detectedAgents(cwd, home = homedir13()) {
+function detectedAgents(cwd, home = homedir14()) {
   return Object.entries(AGENT_DIRS).filter(
     ([, dirs]) => dirs.project.some((d) => existsSync9(join18(cwd, d))) || dirs.user.some((d) => existsSync9(join18(home, d)))
   ).map(([agent]) => agent);
@@ -7257,7 +7318,7 @@ function secretsDetail(stats) {
 }
 async function checkSecrets() {
   try {
-    const stats = await new FileSecretIndex(secretsFile(), homedir13()).stats();
+    const stats = await new FileSecretIndex(secretsFile(), homedir14()).stats();
     const ok = !stats.corrupt && stats.unreadable === 0 && !stats.truncated;
     return { name: "secrets", ok, detail: secretsDetail(stats) };
   } catch (err) {
@@ -7315,19 +7376,19 @@ async function doctorReport(cwd = process.cwd(), opts = {}) {
   };
 }
 async function runDoctor(argv = []) {
-  const report = await doctorReport(process.cwd(), { all: argv.includes("--all") });
-  for (const check of report.checks)
+  const report2 = await doctorReport(process.cwd(), { all: argv.includes("--all") });
+  for (const check of report2.checks)
     process.stdout.write(`${check.ok ? "\u2714" : "\u2718"} ${check.name}: ${check.detail}
 `);
-  return report.checks.every((c) => c.ok) ? 0 : 1;
+  return report2.checks.every((c) => c.ok) ? 0 : 1;
 }
 
 // src/commands/exposure.ts
-import { homedir as homedir17 } from "os";
+import { homedir as homedir18 } from "os";
 
 // src/exposure/context-surface.ts
-import { existsSync as existsSync10, readFileSync as readFileSync14, readdirSync as readdirSync5, statSync as statSync7 } from "fs";
-import { homedir as homedir14 } from "os";
+import { existsSync as existsSync10, readFileSync as readFileSync14, readdirSync as readdirSync5, statSync as statSync8 } from "fs";
+import { homedir as homedir15 } from "os";
 import { join as join19 } from "path";
 var MAX_CONTEXT_FILES = 5e3;
 var MAX_SCAN_BYTES = 256 * 1024;
@@ -7366,7 +7427,7 @@ function walk2(dir, match, out) {
     const full = join19(dir, name);
     let isDir = false;
     try {
-      isDir = statSync7(full).isDirectory();
+      isDir = statSync8(full).isDirectory();
     } catch {
       continue;
     }
@@ -7393,7 +7454,7 @@ function countForeignHooks(cwd) {
   return count;
 }
 var isMarkdown = (name) => name.endsWith(".md");
-function contextSurface(cwd, home = homedir14()) {
+function contextSurface(cwd, home = homedir15()) {
   const skills = new FileSet();
   walk2(join19(home, ".claude", "skills"), isMarkdown, skills);
   walk2(join19(cwd, ".claude", "skills"), isMarkdown, skills);
@@ -7421,7 +7482,7 @@ function contextSurface(cwd, home = homedir14()) {
   ]) {
     let text;
     try {
-      const size = statSync7(file).size;
+      const size = statSync8(file).size;
       bytes += size;
       if (size > MAX_SCAN_BYTES) continue;
       text = readFileSync14(file, "utf8");
@@ -7514,7 +7575,7 @@ function mcpFindings(surfaces) {
 }
 
 // src/exposure/privilege-surface.ts
-import { homedir as homedir15 } from "os";
+import { homedir as homedir16 } from "os";
 import { join as join20 } from "path";
 var read = (file) => {
   try {
@@ -7578,7 +7639,7 @@ function claudeHits(file, json2, scope) {
   return hits;
 }
 var autoApproves = (value) => value === true || isPlainObject(value) && Object.keys(value).length > 0;
-function privilegeSurface(cwd, home = homedir15()) {
+function privilegeSurface(cwd, home = homedir16()) {
   const hits = [];
   const seen = /* @__PURE__ */ new Set();
   const push = (hit) => {
@@ -7699,7 +7760,7 @@ function flaggedTools(tools) {
   ).map((t) => typeof t.name === "string" ? t.name : "(unnamed)");
 }
 async function probeOne(spec, timeoutMs) {
-  return new Promise((resolve11) => {
+  return new Promise((resolve12) => {
     const empty = { server: spec.name, tools: 0, flagged: [] };
     let child;
     try {
@@ -7709,7 +7770,7 @@ async function probeOne(spec, timeoutMs) {
         stdio: ["pipe", "pipe", "ignore"]
       });
     } catch (err) {
-      resolve11({ ...empty, error: err.message });
+      resolve12({ ...empty, error: err.message });
       return;
     }
     let buf = "";
@@ -7719,7 +7780,7 @@ async function probeOne(spec, timeoutMs) {
       done = true;
       clearTimeout(timer);
       killChildTree(child, "SIGTERM");
-      resolve11(result);
+      resolve12(result);
     };
     const timer = setTimeout(
       () => finish({ ...empty, error: `no tools/list response within ${timeoutMs} ms` }),
@@ -7796,12 +7857,12 @@ function probeFindings(results) {
 }
 
 // src/exposure/reach.ts
-function reachFrom(report, surfaces) {
-  const total = report.totals.blocked + report.totals.asked + report.totals.passed;
+function reachFrom(report2, surfaces) {
+  const total = report2.totals.blocked + report2.totals.asked + report2.totals.passed;
   const anyAgentProtected = surfaces.some((s) => s.detected && s.protected);
   return {
     total,
-    passedPolicy: anyAgentProtected ? report.totals.passed : total,
+    passedPolicy: anyAgentProtected ? report2.totals.passed : total,
     anyAgentProtected
   };
 }
@@ -7828,8 +7889,8 @@ function reachFindings(reach) {
 }
 
 // src/exposure/repo-surface.ts
-import { existsSync as existsSync12, readFileSync as readFileSync15, readdirSync as readdirSync6, statSync as statSync8 } from "fs";
-import { join as join21, relative as relative2 } from "path";
+import { existsSync as existsSync12, readFileSync as readFileSync15, readdirSync as readdirSync6, statSync as statSync9 } from "fs";
+import { join as join21, relative as relative3 } from "path";
 var PRE_TRUST = /* @__PURE__ */ new Set([
   "git-config-exec",
   "git-config-include",
@@ -7838,12 +7899,12 @@ var PRE_TRUST = /* @__PURE__ */ new Set([
   "devcontainer-host-command"
 ]);
 var MAX_DIRS = 4e3;
-var MAX_CONFIG_BYTES = 256 * 1024;
+var MAX_CONFIG_BYTES2 = 256 * 1024;
 var SKIP_DIRS = /* @__PURE__ */ new Set(["node_modules", ".venv", "venv", "vendor", "target", "dist", "build"]);
 var readTextOr = (file, fallback = "") => {
   try {
-    const stat5 = statSync8(file);
-    if (!stat5.isFile() || stat5.size > MAX_CONFIG_BYTES) return fallback;
+    const stat5 = statSync9(file);
+    if (!stat5.isFile() || stat5.size > MAX_CONFIG_BYTES2) return fallback;
     return readFileSync15(file, "utf8");
   } catch {
     return fallback;
@@ -7900,7 +7961,7 @@ function gitAttributesHits(root) {
 }
 function runsAsGitHook(file, plat) {
   try {
-    const stat5 = statSync8(file);
+    const stat5 = statSync9(file);
     if (!stat5.isFile()) return false;
     return plat === "win32" || (stat5.mode & 73) !== 0;
   } catch {
@@ -7922,7 +7983,7 @@ function huskyHits(root) {
   try {
     return readdirSync6(dir).filter((name) => !name.startsWith("_") && !name.startsWith(".")).filter((name) => {
       try {
-        return statSync8(join21(dir, name)).isFile();
+        return statSync9(join21(dir, name)).isFile();
       } catch {
         return false;
       }
@@ -7948,7 +8009,7 @@ function devcontainerHits(root) {
   for (const file of candidates) {
     const text = readTextOr(file);
     if (text === "") continue;
-    const rel = relative2(root, file);
+    const rel = relative3(root, file);
     for (const key2 of DEVCONTAINER_HOST_KEYS) {
       if (new RegExp(`"${key2}"\\s*:`).test(text))
         hits.push({ kind: "devcontainer-host-command", file: rel, what: key2 });
@@ -7996,7 +8057,7 @@ function nestedBareRepos(root) {
     if (dir !== root && names.has("HEAD") && names.has("objects") && names.has("refs")) {
       hits.push({
         kind: "nested-bare-repo",
-        file: relative2(root, dir),
+        file: relative3(root, dir),
         what: "HEAD, objects, refs"
       });
       continue;
@@ -8048,27 +8109,27 @@ function repoFindings(surface) {
 }
 
 // src/exposure/redact.ts
-function toShareable(report) {
-  const detected = report.agents.filter((a) => a.detected);
-  const c = report.context;
+function toShareable(report2) {
+  const detected = report2.agents.filter((a) => a.detected);
+  const c = report2.context;
   return {
     version: 1,
-    probed: report.probed,
-    probeFailures: report.probeFailures.length,
+    probed: report2.probed,
+    probeFailures: report2.probeFailures.length,
     agentsDetected: detected.length,
     agentsProtected: detected.filter((a) => a.protected).length,
-    mcpStdio: report.mcp.reduce((n, m) => n + m.stdio, 0),
-    mcpWrapped: report.mcp.reduce((n, m) => n + m.wrapped, 0),
-    mcpHttp: report.mcp.reduce((n, m) => n + m.http, 0),
+    mcpStdio: report2.mcp.reduce((n, m) => n + m.stdio, 0),
+    mcpWrapped: report2.mcp.reduce((n, m) => n + m.wrapped, 0),
+    mcpHttp: report2.mcp.reduce((n, m) => n + m.http, 0),
     contextFiles: c.skills + c.subagents + c.commands + c.instructionFiles,
     contextFlagged: c.flagged.length,
     foreignHooks: c.foreignHooks,
-    privilegeKeys: report.privilege.map((p) => p.key),
-    repoPreTrust: report.repo.preTrust.map((h) => h.kind),
-    repoOnOpen: report.repo.onOpen.length,
-    reachTotal: report.reach.total,
-    reachPassed: report.reach.passedPolicy,
-    findings: report.findings.map((f) => ({ class: f.class, severity: f.severity }))
+    privilegeKeys: report2.privilege.map((p) => p.key),
+    repoPreTrust: report2.repo.preTrust.map((h) => h.kind),
+    repoOnOpen: report2.repo.onOpen.length,
+    reachTotal: report2.reach.total,
+    reachPassed: report2.reach.passedPolicy,
+    findings: report2.findings.map((f) => ({ class: f.class, severity: f.severity }))
   };
 }
 function probeLine(share) {
@@ -8111,22 +8172,22 @@ function sortFindings(findings) {
 // src/exposure/report.ts
 var row = (label, value, note = "") => `  ${label.padEnd(26)}${String(value).padStart(5)}   ${note}`.trimEnd();
 var sum = (items, pick) => items.reduce((n, t) => n + pick(t), 0);
-function probeFooter(report) {
-  if (!report.probed)
+function probeFooter(report2) {
+  if (!report2.probed)
     return "Files only: no MCP server was started. Tool-description poisoning is NOT covered by this run \u2014 add --probe to check it.";
-  const failures = report.probeFailures;
+  const failures = report2.probeFailures;
   if (failures.length === 0)
     return "MCP servers were started and their tool descriptions scanned (--probe).";
   const named = failures.map((f) => `${f.server} (${f.error})`).join(", ");
   return `MCP servers were started and their tool descriptions scanned (--probe) \u2014 but ${failures.length} of them could not be started, so tool-description poisoning is NOT covered for: ${named}`;
 }
-function formatExposure(report, opts = {}) {
-  const detected = report.agents.filter((a) => a.detected);
+function formatExposure(report2, opts = {}) {
+  const detected = report2.agents.filter((a) => a.detected);
   const unprotected = detected.filter((a) => !a.protected);
-  const stdio = sum(report.mcp, (m) => m.stdio);
-  const wrapped = sum(report.mcp, (m) => m.wrapped);
-  const http = sum(report.mcp, (m) => m.http);
-  const ctx = report.context;
+  const stdio = sum(report2.mcp, (m) => m.stdio);
+  const wrapped = sum(report2.mcp, (m) => m.wrapped);
+  const http = sum(report2.mcp, (m) => m.http);
+  const ctx = report2.context;
   const lines = [
     "stroq exposure \u2014 what reaches you on this machine",
     "",
@@ -8155,26 +8216,26 @@ function formatExposure(report, opts = {}) {
       ctx.flagged.length > 0 ? "expect false positives \u2014 see the finding" : ""
     ),
     "",
-    row("Privilege-widening keys", report.privilege.length),
+    row("Privilege-widening keys", report2.privilege.length),
     row(
       "Repository runs on open",
-      report.repo.isRepo ? report.repo.onOpen.length + report.repo.preTrust.length : 0,
-      report.repo.isRepo ? `${report.repo.preTrust.length} before you approve anything${report.repo.capped ? " \u2014 a lower bound: the walk hit its cap" : ""}` : "not a git repository"
+      report2.repo.isRepo ? report2.repo.onOpen.length + report2.repo.preTrust.length : 0,
+      report2.repo.isRepo ? `${report2.repo.preTrust.length} before you approve anything${report2.repo.capped ? " \u2014 a lower bound: the walk hit its cap" : ""}` : "not a git repository"
     ),
-    row("Incidents reaching you", report.reach.passedPolicy, `of ${report.reach.total}`),
+    row("Incidents reaching you", report2.reach.passedPolicy, `of ${report2.reach.total}`),
     ""
   ];
   if (opts.verbose && ctx.flagged.length > 0) {
     lines.push("Flagged files:", ...ctx.flagged.map((f) => `  ${f}`), "");
   }
-  if (opts.verbose && report.repo.onOpen.length > 0) {
+  if (opts.verbose && report2.repo.onOpen.length > 0) {
     lines.push(
       "Runs when you open or build this repository:",
-      ...report.repo.onOpen.map((h) => `  ${h.file} \u2014 ${h.what}`),
+      ...report2.repo.onOpen.map((h) => `  ${h.file} \u2014 ${h.what}`),
       ""
     );
   }
-  const findings = sortFindings(report.findings);
+  const findings = sortFindings(report2.findings);
   if (findings.length === 0) {
     lines.push("No findings. Everything Stroq can check on this machine is covered.");
   } else {
@@ -8185,13 +8246,13 @@ function formatExposure(report, opts = {}) {
       if (f.fix) lines.push(`          fix: ${f.fix}`);
     }
   }
-  lines.push("", probeFooter(report));
+  lines.push("", probeFooter(report2));
   return `${lines.join("\n")}
 `;
 }
 
 // src/exposure/surface.ts
-import { homedir as homedir16 } from "os";
+import { homedir as homedir17 } from "os";
 var safe = (fn) => {
   try {
     return fn();
@@ -8227,7 +8288,7 @@ function isProtected(agent, cwd) {
       return false;
   }
 }
-function agentSurface(cwd, home = homedir16()) {
+function agentSurface(cwd, home = homedir17()) {
   const detected = new Set(detectedAgents(cwd, home));
   return HOOK_AGENTS.map((agent) => ({
     agent,
@@ -8246,7 +8307,7 @@ function agentFindings(surfaces) {
 
 // src/commands/exposure.ts
 async function buildExposureReport(cwd, opts) {
-  const home = homedir17();
+  const home = homedir18();
   const agents = agentSurface(cwd, home);
   const mcp = mcpSurface(cwd);
   const context = contextSurface(cwd, home);
@@ -8282,18 +8343,18 @@ async function buildExposureReport(cwd, opts) {
   };
 }
 async function runExposure(argv) {
-  const report = await buildExposureReport(process.cwd(), { probe: argv.includes("--probe") });
+  const report2 = await buildExposureReport(process.cwd(), { probe: argv.includes("--probe") });
   const share = argv.includes("--share");
   if (argv.includes("--json")) {
-    const payload = share ? toShareable(report) : report;
+    const payload = share ? toShareable(report2) : report2;
     process.stdout.write(`${JSON.stringify(payload, null, 2)}
 `);
   } else {
     process.stdout.write(
-      share ? formatShareable(toShareable(report)) : formatExposure(report, { verbose: argv.includes("--verbose") })
+      share ? formatShareable(toShareable(report2)) : formatExposure(report2, { verbose: argv.includes("--verbose") })
     );
   }
-  return report.findings.length > 0 ? 1 : 0;
+  return report2.findings.length > 0 ? 1 : 0;
 }
 
 // src/adapters/antigravity.ts
@@ -9090,8 +9151,8 @@ async function withDeadline(work, ms, onTimeout) {
   try {
     return await Promise.race([
       work,
-      new Promise((resolve11) => {
-        timer = setTimeout(() => resolve11(onTimeout()), ms);
+      new Promise((resolve12) => {
+        timer = setTimeout(() => resolve12(onTimeout()), ms);
       })
     ]);
   } finally {
@@ -9112,7 +9173,7 @@ async function runHookCommand(agent, arg = "", read3 = readStdin) {
 
 // src/commands/inspect.ts
 import { existsSync as existsSync13 } from "fs";
-import { resolve as resolve5 } from "path";
+import { resolve as resolve6 } from "path";
 import { parseArgs as parseArgs6 } from "util";
 var GIT_HARDENING = [
   { key: "core.fsmonitor", value: "false" },
@@ -9186,7 +9247,7 @@ function runInspect(argv) {
     process.stdout.write(hardeningExports());
     return 0;
   }
-  const dir = resolve5(positionals[0] ?? process.cwd());
+  const dir = resolve6(positionals[0] ?? process.cwd());
   if (!existsSync13(dir)) {
     process.stderr.write(`stroq inspect: no such directory: ${dir}
 `);
@@ -9228,14 +9289,14 @@ async function runLog(args) {
 }
 
 // src/commands/mcp.ts
-import { resolve as resolve6 } from "path";
+import { resolve as resolve7 } from "path";
 
 // src/mcp/proxy.ts
 import { spawn as spawn3 } from "child_process";
 
 // src/mcp/cloak-factory.ts
 import { createHash as createHash6 } from "crypto";
-import { homedir as homedir18 } from "os";
+import { homedir as homedir19 } from "os";
 import { join as join22 } from "path";
 
 // src/mcp/cloak.ts
@@ -9380,7 +9441,7 @@ ${server}`).digest("hex").slice(0, 16);
 function createMcpCloak(ctx) {
   return new McpCloak({
     detector: createCloakDetector({
-      secrets: new FileSecretIndex(secretsFile(), homedir18(), process.env),
+      secrets: new FileSecretIndex(secretsFile(), homedir19(), process.env),
       cwd: ctx.cwd
     }),
     store: new FileCloakStore(join22(cloakDir(), `${cloakKey(ctx.sessionId, ctx.server)}.json`)),
@@ -9622,12 +9683,12 @@ async function writeBackpressured(sink, text, source) {
     return;
   }
   source.pause();
-  await new Promise((resolve11) => {
+  await new Promise((resolve12) => {
     const done = () => {
       sink.off("drain", done);
       sink.off("error", done);
       sink.off("close", done);
-      resolve11();
+      resolve12();
     };
     sink.once("drain", done);
     sink.once("error", done);
@@ -10178,14 +10239,14 @@ async function runMcpProxy(options) {
   const onSigterm = relay("SIGTERM");
   process.on("SIGINT", onSigint);
   process.on("SIGTERM", onSigterm);
-  const code = await new Promise((resolve11) => {
+  const code = await new Promise((resolve12) => {
     child.on("error", (err) => {
       options.stderr.write(`stroq mcp: cannot start the MCP server: ${err.message}
 `);
-      resolve11(1);
+      resolve12(1);
     });
     child.on("close", (exitCode, signal) => {
-      resolve11(signal === null ? exitCode ?? 1 : 1);
+      resolve12(signal === null ? exitCode ?? 1 : 1);
     });
   });
   shuttingDown = true;
@@ -10247,7 +10308,7 @@ function parseMcpArgv(argv) {
   return { ok: true, invocation: { server, client, session, cwd, passEnv, cloak, command, args } };
 }
 function resolveMcpCwd(cwd) {
-  return resolve6(cwd ?? process.cwd());
+  return resolve7(cwd ?? process.cwd());
 }
 var LEGACY_ENV_WARNING = 'stroq mcp: this wrapper predates environment filtering, so the server inherits every variable in this process (secrets included). Re-run "stroq init --agent mcp --client <your client>" to record the ones it actually needs.\n';
 async function runMcp(argv) {
@@ -10278,6 +10339,30 @@ ${MCP_USAGE}`);
   });
 }
 
+// src/terminal-safe.ts
+function safeWrite(original, stream) {
+  return function write2(chunk, ...rest) {
+    const text = typeof chunk === "string" ? chunk : chunk instanceof Uint8Array ? Buffer.from(chunk).toString("utf8") : String(chunk);
+    return original.call(
+      stream,
+      neutralizeControls(text),
+      ...rest
+    );
+  };
+}
+async function withSafeOutput(fn) {
+  const out = process.stdout.write;
+  const err = process.stderr.write;
+  process.stdout.write = safeWrite(out, process.stdout);
+  process.stderr.write = safeWrite(err, process.stderr);
+  try {
+    return await fn();
+  } finally {
+    process.stdout.write = out;
+    process.stderr.write = err;
+  }
+}
+
 // src/commands/replay.ts
 import { mkdtemp as mkdtemp2, rm as rm5 } from "fs/promises";
 import { tmpdir as tmpdir2 } from "os";
@@ -10288,7 +10373,7 @@ import { parseArgs as parseArgs8 } from "util";
 import { createReadStream } from "fs";
 import { readdir, stat as stat3 } from "fs/promises";
 import { createInterface } from "readline";
-import { homedir as homedir19 } from "os";
+import { homedir as homedir20 } from "os";
 import { join as join23 } from "path";
 var isRecord2 = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
 function resultText(content) {
@@ -10367,7 +10452,7 @@ async function feedLines(path, parser) {
 function projectSlug(cwd) {
   return cwd.replace(/[/.]/g, "-");
 }
-var transcriptRoot = () => join23(homedir19(), ".claude", "projects");
+var transcriptRoot = () => join23(homedir20(), ".claude", "projects");
 async function findTranscripts(cwd) {
   const root = transcriptRoot();
   const scoped = join23(root, projectSlug(cwd));
@@ -10684,8 +10769,8 @@ replayed from ${path}
 
 // src/commands/run.ts
 import { mkdirSync as mkdirSync5, rmSync, writeFileSync as writeFileSync3 } from "fs";
-import { homedir as homedir20, tmpdir as tmpdir3 } from "os";
-import { join as join26, resolve as resolve8 } from "path";
+import { homedir as homedir21, tmpdir as tmpdir3 } from "os";
+import { join as join26, resolve as resolve9 } from "path";
 
 // src/run/agent-name.ts
 import { win32 } from "path";
@@ -10743,7 +10828,7 @@ async function launch(options) {
   const relays = RELAYED.map((signal) => ({ signal, listener: () => kill(child, signal) }));
   for (const { signal, listener } of relays) signals.on(signal, listener);
   try {
-    return await new Promise((resolve11) => {
+    return await new Promise((resolve12) => {
       child.on("error", (err) => {
         const code = err.code;
         stderr.write(
@@ -10751,9 +10836,9 @@ async function launch(options) {
 ` : `stroq run: cannot start "${options.command}": ${err.message}
 `
         );
-        resolve11(code === "ENOENT" ? NOT_FOUND : 1);
+        resolve12(code === "ENOENT" ? NOT_FOUND : 1);
       });
-      child.on("close", (code, signal) => resolve11(exitCodeFor(code, signal, plat)));
+      child.on("close", (code, signal) => resolve12(exitCodeFor(code, signal, plat)));
     });
   } finally {
     for (const { signal, listener } of relays) signals.off(signal, listener);
@@ -10810,11 +10895,11 @@ function preflight(options) {
 }
 
 // src/run/sandbox.ts
-import { resolve as resolve7 } from "path";
+import { resolve as resolve8 } from "path";
 var dedupe = (paths) => [
-  ...new Set(paths.filter((p) => p !== "").map((p) => resolve7(p)))
+  ...new Set(paths.filter((p) => p !== "").map((p) => resolve8(p)))
 ];
-var tooBroadToSandbox = (path, userHome) => path === resolve7("/") || path === resolve7(userHome);
+var tooBroadToSandbox = (path, userHome) => path === resolve8("/") || path === resolve8(userHome);
 function generateSandbox(inputs) {
   const wanted = dedupe([inputs.workspace, ...inputs.tmp, inputs.stroqHome, ...inputs.agentState]);
   const refused = wanted.filter((p) => tooBroadToSandbox(p, inputs.userHome));
@@ -11007,8 +11092,8 @@ ${RUN_USAGE}`);
   }
   const invocation = parsed.invocation;
   const env = deps.env ?? process.env;
-  const userHome = deps.userHome ?? homedir20();
-  const workspace = resolve8(cwd);
+  const userHome = deps.userHome ?? homedir21();
+  const workspace = resolve9(cwd);
   const agent = invocation.agent ?? agentIdFor(invocation.command);
   const checks = preflight({
     agent,
@@ -11069,7 +11154,7 @@ stroq run \u2014 ${invocation.command}${agent === null ? "" : ` (${agent})`}`);
 }
 
 // src/commands/sent.ts
-import { homedir as homedir24 } from "os";
+import { homedir as homedir25 } from "os";
 import { parseArgs as parseArgs9 } from "util";
 
 // src/sent/format.ts
@@ -11084,15 +11169,15 @@ var FILE_EVIDENCE_LINE = {
 function timestamp(iso) {
   return Number.isNaN(Date.parse(iso)) ? "an unrecorded time" : iso.replace(".000Z", "Z");
 }
-function duration2(report) {
-  if (!report.first || !report.last) return "";
-  return ` \xB7 ${ageLabel(report.first, new Date(report.last))} long`;
+function duration2(report2) {
+  if (!report2.first || !report2.last) return "";
+  return ` \xB7 ${ageLabel(report2.first, new Date(report2.last))} long`;
 }
-function origin(report) {
-  if (report.origin === "audit-log") {
+function origin(report2) {
+  if (report2.origin === "audit-log") {
     return "  from Stroq's own audit log";
   }
-  return `  from ${report.path ?? "a transcript"} (${report.agent ?? "agent"} transcript)`;
+  return `  from ${report2.path ?? "a transcript"} (${report2.agent ?? "agent"} transcript)`;
 }
 function occurrenceLine(occurrence, last) {
   const elbow = last ? "      \u2514\u2500" : "      \u251C\u2500";
@@ -11112,8 +11197,8 @@ function credentialBlock(credential) {
     ""
   ];
 }
-function coverageLines(report) {
-  const c = report.coverage;
+function coverageLines(report2) {
+  const c = report2.coverage;
   const sources = c.indexedSources.length > 0 ? c.indexedSources.join(", ") : "nothing on this machine";
   const lines = [
     "COVERAGE",
@@ -11147,28 +11232,28 @@ var MEANING = [
   "  not have known it was.",
   "  If one of them matters, rotate it. Rotating is cheap; being sure is not."
 ];
-function formatSent(report) {
+function formatSent(report2) {
   const lines = [
     "stroq sent \u2014 which of your credentials already reached a model provider",
     "",
-    `  session ${report.sessionId} \xB7 ${report.coverage.calls} tool call(s)${duration2(report)}`,
-    origin(report),
+    `  session ${report2.sessionId} \xB7 ${report2.coverage.calls} tool call(s)${duration2(report2)}`,
+    origin(report2),
     ""
   ];
-  if (report.credentials.length > 0) {
+  if (report2.credentials.length > 0) {
     lines.push(
-      `CREDENTIALS THAT WERE IN THIS SESSION'S TRAFFIC (${report.credentials.length})`,
+      `CREDENTIALS THAT WERE IN THIS SESSION'S TRAFFIC (${report2.credentials.length})`,
       ""
     );
-    for (const credential of report.credentials) lines.push(...credentialBlock(credential));
+    for (const credential of report2.credentials) lines.push(...credentialBlock(credential));
   }
-  if (report.files.length > 0) {
-    lines.push(`CREDENTIAL FILES THIS SESSION TOUCHED (${report.files.length})`, "");
-    for (const file of report.files) {
+  if (report2.files.length > 0) {
+    lines.push(`CREDENTIAL FILES THIS SESSION TOUCHED (${report2.files.length})`, "");
+    for (const file of report2.files) {
       lines.push(`  \u25A0 ${file.path} \u2014 ${file.tool} at ${timestamp(file.at)}`);
       lines.push(`      ${FILE_EVIDENCE_LINE[file.evidence]}`);
     }
-    if (report.files.some((f) => f.evidence === "read")) {
+    if (report2.files.some((f) => f.evidence === "read")) {
       lines.push(
         "",
         "  A file whose contents came back was sent to the model whole, including any",
@@ -11177,7 +11262,7 @@ function formatSent(report) {
     }
     lines.push("");
   }
-  if (report.credentials.length === 0 && report.files.length === 0) {
+  if (report2.credentials.length === 0 && report2.files.length === 0) {
     lines.push(
       "No indexed credential appeared in this session, and no credential file was",
       "read or named by it. Read the coverage below before treating that as clean.",
@@ -11186,18 +11271,18 @@ function formatSent(report) {
   } else {
     lines.push(...MEANING, "");
   }
-  lines.push(...coverageLines(report));
+  lines.push(...coverageLines(report2));
   return `${lines.join("\n")}
 `;
 }
 
 // src/sent/readers.ts
 import { open as open3 } from "fs/promises";
-import { homedir as homedir23 } from "os";
+import { homedir as homedir24 } from "os";
 
 // src/sent/codex.ts
 import { open as open2, readdir as readdir2, stat as stat4 } from "fs/promises";
-import { homedir as homedir21 } from "os";
+import { homedir as homedir22 } from "os";
 import { join as join27 } from "path";
 
 // src/sent/codex-literal.ts
@@ -11511,7 +11596,7 @@ function createCodexParser() {
   }
   return { push, finish: () => ({ sessionId, cwd, events, skipped }) };
 }
-var codexRoot = (home = homedir21()) => join27(home, ".codex", "sessions");
+var codexRoot = (home = homedir22()) => join27(home, ".codex", "sessions");
 var META_BYTES = 64 * 1024;
 async function rolloutCwd(path) {
   let head;
@@ -11565,7 +11650,7 @@ async function readCodexRollout(path) {
 }
 
 // src/sent/cursor.ts
-import { homedir as homedir22 } from "os";
+import { homedir as homedir23 } from "os";
 import { join as join28 } from "path";
 var TOOL_NAMES = {
   run_terminal_command_v2: "Bash",
@@ -11689,7 +11774,7 @@ function parseCursorStore(rows) {
     }
   })).sort((a, b) => b.mtimeMs - a.mtimeMs);
 }
-function cursorStateDb(plat = process.platform, env = process.env, home = homedir22()) {
+function cursorStateDb(plat = process.platform, env = process.env, home = homedir23()) {
   const base = plat === "darwin" ? join28(home, "Library", "Application Support", "Cursor") : plat === "win32" ? join28(env["APPDATA"] ?? join28(home, "AppData", "Roaming"), "Cursor") : join28(home, ".config", "Cursor");
   return join28(base, "User", "globalStorage", "state.vscdb");
 }
@@ -11815,7 +11900,7 @@ async function readerNotices() {
   return notices;
 }
 function tilde(path) {
-  const home = homedir23();
+  const home = homedir24();
   return home !== "" && path.startsWith(home) ? `~${path.slice(home.length)}` : path;
 }
 var isRecord4 = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
@@ -11860,15 +11945,16 @@ async function newestTranscript(cwd) {
 }
 
 // src/sent/scan.ts
-import { isAbsolute as isAbsolute3, relative as relative3, resolve as resolve9 } from "path";
+import { isAbsolute as isAbsolute4, relative as relative4, resolve as resolve10 } from "path";
 
 // src/sent/heredoc.ts
 var HEREDOC = /(?<!<)<<(-?)\s*(['"]?)([A-Za-z_][\w.-]*)\2/g;
-var EXECUTES_STDIN = /^(?:sudo\s+)?(?:(?:\S*\/)?env\s+(?:\S+=\S*\s+)*)?(?:\S*\/)?(?:sh|bash|zsh|dash|ksh|fish|python\d*(?:\.\d+)?|node|deno|bun|tsx|ruby|perl|php|osascript|ssh|eval|source|\.|xargs|npx|pnpm|uv)(?:\s|$)/;
+var EXECUTES_STDIN = /^(?:sudo\s+)?(?:(?:\S*\/)?env\s+(?:[A-Za-z_]\w*=\S*\s+)*)?(?:\S*\/)?(?:sh|bash|zsh|dash|ksh|fish|python\d*(?:\.\d+)?|node|deno|bun|tsx|ruby|perl|php|osascript|ssh|eval|source|\.|xargs|npx|pnpm|uv)(?:\s|$)/;
+var STAGE_PREFIX = 512;
 function bodyIsExecuted(line3, operatorStart, operatorEnd) {
   const before = line3.slice(0, operatorStart).split(/&&|\|\||;|\$\(|\|/);
   const stages = [before[before.length - 1] ?? "", ...line3.slice(operatorEnd).split("|").slice(1)];
-  return stages.some((stage) => EXECUTES_STDIN.test(stage.trim()));
+  return stages.some((stage) => EXECUTES_STDIN.test(stage.trim().slice(0, STAGE_PREFIX)));
 }
 function withoutHeredocData(command) {
   if (!command.includes("<<")) return command;
@@ -11954,9 +12040,9 @@ function mentions(text, spelling) {
 }
 function spellingsOf(path, scope, sessionCwd) {
   const spellings2 = [path, displayPath(path, scope.home)];
-  const sameDirectory = sessionCwd !== null && resolve9(sessionCwd) === resolve9(scope.cwd);
-  const rel = relative3(scope.cwd, path);
-  if (sameDirectory && rel !== "" && !rel.startsWith("..") && !isAbsolute3(rel)) {
+  const sameDirectory = sessionCwd !== null && resolve10(sessionCwd) === resolve10(scope.cwd);
+  const rel = relative4(scope.cwd, path);
+  if (sameDirectory && rel !== "" && !rel.startsWith("..") && !isAbsolute4(rel)) {
     spellings2.push(rel, `./${rel}`);
   }
   return [...new Set(spellings2)];
@@ -12110,10 +12196,10 @@ function scanAuditLog(allEntries, sessionId, scope) {
 }
 
 // src/commands/sent.ts
-function emit(report, out) {
-  process.stdout.write(out.json ? `${JSON.stringify(report, null, 2)}
-` : formatSent(report));
-  const found = report.credentials.length > 0 || report.files.length > 0;
+function emit(report2, out) {
+  process.stdout.write(out.json ? `${JSON.stringify(report2, null, 2)}
+` : formatSent(report2));
+  const found = report2.credentials.length > 0 || report2.files.length > 0;
   return out.failOnFinding && found ? 1 : 0;
 }
 var USAGE = `stroq sent \u2014 which of your credentials already reached a model provider
@@ -12164,7 +12250,7 @@ ${USAGE}`);
     failOnFinding: values["fail-on-finding"] === true
   };
   const cwd = process.cwd();
-  const home = homedir24();
+  const home = homedir25();
   const index = new FileSecretIndex(secretsFile(), home);
   const stats = await index.refresh(cwd);
   const scope = {
@@ -12195,13 +12281,13 @@ ${USAGE}`);
 `);
       return 1;
     }
-    const report = await scanTranscript(
+    const report2 = await scanTranscript(
       transcript,
       { agent: found.reader.agent, path: found.path },
       index,
       scope
     );
-    return emit(report, out);
+    return emit(report2, out);
   }
   const entries = await new AuditLog(auditFile()).readAll();
   const sessionId = positionals[0] ?? sessionsIn(entries)[0];
@@ -12216,7 +12302,7 @@ ${USAGE}`);
 
 // src/commands/trust.ts
 import { chmodSync as chmodSync2, mkdirSync as mkdirSync6, readFileSync as readFileSync16, writeFileSync as writeFileSync4 } from "fs";
-import { dirname as dirname8, resolve as resolve10 } from "path";
+import { dirname as dirname8, resolve as resolve11 } from "path";
 import { parseArgs as parseArgs10 } from "util";
 function read2(file) {
   try {
@@ -12279,7 +12365,7 @@ function runTrust(argv, now = () => /* @__PURE__ */ new Date()) {
   });
   const file = trustFile();
   if (values.remove !== void 0) {
-    const path = resolve10(values.remove);
+    const path = resolve11(values.remove);
     const current = read2(file);
     const entries = current.entries.filter((e) => e.source !== path);
     if (entries.length === current.entries.length) {
@@ -12300,7 +12386,7 @@ function runTrust(argv, now = () => /* @__PURE__ */ new Date()) {
     );
     return 0;
   }
-  const { code, message } = add(file, resolve10(positionals[0]), now);
+  const { code, message } = add(file, resolve11(positionals[0]), now);
   process.stdout.write(message);
   return code;
 }
@@ -12474,14 +12560,20 @@ async function main(argv) {
       if (out.timedOut) await exitNow(out.exitCode);
       return out.exitCode;
     }
+    case "mcp":
+      return runMcp(rest);
+    default:
+      return withSafeOutput(() => report(command, rest));
+  }
+}
+async function report(command, rest) {
+  switch (command) {
     case "inspect":
       return runInspect(rest);
     case "init":
       return runInit(rest);
     case "run":
       return runRun(rest);
-    case "mcp":
-      return runMcp(rest);
     case "doctor":
       return runDoctor(rest);
     case "log":
@@ -12522,8 +12614,8 @@ async function main(argv) {
 async function exitNow(code) {
   await Promise.all(
     [process.stdout, process.stderr].map(
-      (stream) => new Promise((resolve11) => {
-        stream.write("", () => resolve11());
+      (stream) => new Promise((resolve12) => {
+        stream.write("", () => resolve12());
       })
     )
   );
@@ -12534,7 +12626,7 @@ main(process.argv.slice(2)).then(
     process.exitCode = code;
   },
   (err) => {
-    process.stderr.write(`${String(err)}
+    process.stderr.write(`${neutralizeControls(String(err))}
 `);
     process.exitCode = 1;
   }