kifaru 1.0.194 → 1.0.196

package/kifaru-gateway.js

@@ -49488,6 +49488,752 @@ The report should be worthy of maximum payout.
   })(AtlantisDiversityEnforcer ||= {});
 });
 
+// ../core/src/entity-graph.ts
+class EngagementRegistry {
+  graphs = new Map;
+  register(graph) {
+    this.graphs.set(graph.engagement, graph);
+  }
+  get(engagement) {
+    if (!engagement)
+      return;
+    return this.graphs.get(engagement);
+  }
+  list() {
+    return [...this.graphs.keys()].sort();
+  }
+}
+function detectEntityMatches(input2) {
+  const hits = [];
+  const seen = new Set;
+  const consider = (field, value) => {
+    if (!value)
+      return;
+    const key = `${field}::${value.toLowerCase()}`;
+    if (seen.has(key))
+      return;
+    if (containsToken(input2.content, value)) {
+      hits.push({ token: value, field, engagement: input2.graph.engagement });
+      seen.add(key);
+    }
+  };
+  for (const value of input2.graph.domains ?? [])
+    consider("domains", value);
+  for (const value of input2.graph.cloud_accounts ?? [])
+    consider("cloud_accounts", value);
+  for (const value of input2.graph.repos ?? [])
+    consider("repos", value);
+  for (const value of input2.graph.team_names ?? [])
+    consider("team_names", value);
+  for (const value of input2.graph.employee_names ?? [])
+    consider("employee_names", value);
+  for (const value of input2.graph.build_jobs ?? [])
+    consider("build_jobs", value);
+  for (const cidr of input2.graph.cidrs ?? []) {
+    for (const ip of extractIPv4(input2.content)) {
+      if (ipInCidr(ip, cidr)) {
+        const key = `cidrs::${ip}::${cidr}`;
+        if (!seen.has(key)) {
+          hits.push({ token: ip, field: "cidrs", engagement: input2.graph.engagement });
+          seen.add(key);
+        }
+      }
+    }
+  }
+  return hits;
+}
+function containsToken(haystack, needle) {
+  if (!needle)
+    return false;
+  const escaped = needle.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  const boundary = "(?:^|[^A-Za-z0-9_-])";
+  const tail = "(?:[^A-Za-z0-9_-]|$)";
+  const re = new RegExp(`${boundary}${escaped}${tail}`, "i");
+  return re.test(haystack);
+}
+function extractIPv4(content) {
+  const matches = content.match(/\b(?:\d{1,3}\.){3}\d{1,3}\b/g) ?? [];
+  return [...new Set(matches)];
+}
+function ipInCidr(ip, cidr) {
+  const [base, prefixStr] = cidr.split("/");
+  if (!base || !prefixStr)
+    return false;
+  const prefix = Number.parseInt(prefixStr, 10);
+  if (!Number.isFinite(prefix) || prefix < 0 || prefix > 32)
+    return false;
+  const ipInt = ipToInt(ip);
+  const baseInt = ipToInt(base);
+  if (ipInt === null || baseInt === null)
+    return false;
+  if (prefix === 0)
+    return true;
+  const mask = prefix === 32 ? 4294967295 : ~0 << 32 - prefix >>> 0;
+  return (ipInt & mask) === (baseInt & mask);
+}
+function ipToInt(ip) {
+  const parts = ip.split(".");
+  if (parts.length !== 4)
+    return null;
+  let total = 0;
+  for (const part of parts) {
+    const n = Number.parseInt(part, 10);
+    if (!Number.isFinite(n) || n < 0 || n > 255 || String(n) !== part)
+      return null;
+    total = total << 8 | n;
+  }
+  return total >>> 0;
+}
+var init_entity_graph = () => {};
+
+// ../core/src/pii-detector.ts
+var PiiDetector;
+var init_pii_detector = __esm(() => {
+  ((PiiDetector) => {
+    function build() {
+      return (content) => {
+        return findMatches(content).length > 0 ? ["pii"] : [];
+      };
+    }
+    PiiDetector.build = build;
+    function findMatches(content) {
+      const matches = [];
+      const push = (value) => {
+        if (value)
+          matches.push({ value, label: "pii" });
+      };
+      for (const m of content.match(EMAIL_REGEX_G) ?? [])
+        push(m);
+      for (const re of PHONE_REGEXES_G) {
+        for (const m of content.match(re) ?? [])
+          push(m);
+      }
+      for (const m of validSsnMatches(content))
+        push(m);
+      for (const m of validCreditCardMatches(content))
+        push(m);
+      for (const m of validIbanMatches(content))
+        push(m);
+      for (const m of content.match(PASSPORT_REGEX_G) ?? [])
+        push(m);
+      for (const m of content.match(DOB_REGEX_G) ?? [])
+        push(m);
+      for (const m of content.match(NATIONAL_ID_REGEX_G) ?? [])
+        push(m);
+      return matches;
+    }
+    PiiDetector.findMatches = findMatches;
+    const EMAIL_REGEX_G = /\b[a-z0-9._%+-]+@[a-z0-9.-]+\.[a-z]{2,}\b/gi;
+    const PHONE_REGEXES_G = [
+      /(?<![\d-])\+\d{1,3}[\s.-]?\(?\d{1,4}\)?[\s.-]?\d{2,4}[\s.-]?\d{2,4}[\s.-]?\d{2,4}\b/g,
+      /\(\d{3}\)\s?\d{3}[-.\s]?\d{4}/g,
+      /\b\d{3}[-.\s]\d{3}[-.\s]\d{4}\b/g
+    ];
+    const SSN_REGEX = /\b(\d{3})-(\d{2})-(\d{4})\b/g;
+    const PASSPORT_REGEX_G = /\b(?:passport(?:\s*(?:no|number|#))?\s*[:#]?\s*[A-Z0-9]{6,9})\b/gi;
+    const DOB_REGEX_G = /\b(?:dob|birth(?:day|date)?)\s*[:#]?\s*\d{1,4}[-/.]\d{1,2}[-/.]\d{1,4}\b/gi;
+    const NATIONAL_ID_REGEX_G = /\b[A-Z]{2}\d{6}[A-Z]\b/g;
+    function validSsnMatches(content) {
+      SSN_REGEX.lastIndex = 0;
+      const out = [];
+      let match;
+      while ((match = SSN_REGEX.exec(content)) !== null) {
+        const [whole, area, group, serial] = match;
+        if (area === "000" || area === "666" || area && Number.parseInt(area, 10) >= 900)
+          continue;
+        if (group === "00")
+          continue;
+        if (serial === "0000")
+          continue;
+        out.push(whole);
+      }
+      return out;
+    }
+    function validCreditCardMatches(content) {
+      const candidates = content.match(/(?:\d[ .-]?){13,}/g) ?? [];
+      const out = [];
+      for (const candidate of candidates) {
+        const found = firstLuhnWindow(candidate);
+        if (found)
+          out.push(found);
+      }
+      return out;
+    }
+    function firstLuhnWindow(run) {
+      const digitPos = [];
+      for (let i = 0;i < run.length; i += 1) {
+        const c = run.charCodeAt(i);
+        if (c >= 48 && c <= 57)
+          digitPos.push(i);
+      }
+      const total = digitPos.length;
+      if (total < 13)
+        return;
+      const tryWindow = (start, len) => {
+        const from = digitPos[start];
+        const to = digitPos[start + len - 1];
+        const slice = run.slice(from, to + 1);
+        const digits = slice.replace(/[ .-]/g, "");
+        if (digits.length === len && luhnValid(digits))
+          return slice.trim();
+        return;
+      };
+      if (total >= 13 && total <= 19) {
+        const whole = tryWindow(0, total);
+        if (whole)
+          return whole;
+      }
+      const startsGroup = (idx) => {
+        const pos = digitPos[idx];
+        if (pos === 0)
+          return true;
+        const prev = run.charCodeAt(pos - 1);
+        return !(prev >= 48 && prev <= 57);
+      };
+      const endsGroup = (idx) => {
+        const pos = digitPos[idx];
+        if (pos === run.length - 1)
+          return true;
+        const nxt = run.charCodeAt(pos + 1);
+        return !(nxt >= 48 && nxt <= 57);
+      };
+      for (let len = Math.min(19, total);len >= 13; len -= 1) {
+        for (let start = 0;start + len <= total; start += 1) {
+          if (!startsGroup(start) || !endsGroup(start + len - 1))
+            continue;
+          const hit = tryWindow(start, len);
+          if (hit)
+            return hit;
+        }
+      }
+      return;
+    }
+    function luhnValid(digits) {
+      let sum = 0;
+      let alternate = false;
+      for (let i = digits.length - 1;i >= 0; i -= 1) {
+        const code = digits.charCodeAt(i) - 48;
+        if (code < 0 || code > 9)
+          return false;
+        let n = code;
+        if (alternate) {
+          n *= 2;
+          if (n > 9)
+            n -= 9;
+        }
+        sum += n;
+        alternate = !alternate;
+      }
+      return sum % 10 === 0;
+    }
+    function validIbanMatches(content) {
+      const candidates = content.match(/\b[A-Za-z]{2}\d{2}[A-Za-z0-9]{10,30}\b/g) ?? [];
+      const out = [];
+      for (const candidate of candidates) {
+        if (ibanMod97(candidate))
+          out.push(candidate);
+      }
+      return out;
+    }
+    function ibanMod97(rawIban) {
+      const iban = rawIban.toUpperCase();
+      const rearranged = iban.slice(4) + iban.slice(0, 4);
+      let numeric = "";
+      for (const ch2 of rearranged) {
+        const code = ch2.charCodeAt(0);
+        if (code >= 48 && code <= 57)
+          numeric += ch2;
+        else if (code >= 65 && code <= 90)
+          numeric += String(code - 55);
+        else
+          return false;
+      }
+      let remainder = 0;
+      for (let i = 0;i < numeric.length; i += 7) {
+        const chunk = String(remainder) + numeric.slice(i, i + 7);
+        remainder = Number.parseInt(chunk, 10) % 97;
+      }
+      return remainder === 1;
+    }
+    function attachTo(flowGateway) {
+      const detector = build();
+      flowGateway.registerDetector((content, ctx) => detector(content, ctx));
+    }
+    PiiDetector.attachTo = attachTo;
+  })(PiiDetector ||= {});
+});
+
+// ../core/src/privacy-gateway.ts
+import { createHash as createHash6 } from "crypto";
+import { appendFile, mkdir, writeFile as writeFile2 } from "fs/promises";
+import path7 from "path";
+var FlowGateway;
+var init_privacy_gateway = __esm(() => {
+  init_entity_graph();
+  init_pii_detector();
+  ((FlowGateway) => {
+    FlowGateway.ROLLOUT_MODES = [
+      "observe",
+      "sanitized_shadow",
+      "zone2_egress",
+      "tool_log",
+      "verifier",
+      "non_bypassable"
+    ];
+    FlowGateway.DEFAULT_POLICY = {
+      id: "kifaru.privacy.observe.v1",
+      rolloutMode: "observe"
+    };
+    function rolloutModeRank(mode) {
+      return FlowGateway.ROLLOUT_MODES.indexOf(mode);
+    }
+    FlowGateway.rolloutModeRank = rolloutModeRank;
+    function rolloutAtLeast(mode, gate) {
+      return rolloutModeRank(mode) >= rolloutModeRank(gate);
+    }
+    FlowGateway.rolloutAtLeast = rolloutAtLeast;
+    function shouldEnforce(decision, action, mode) {
+      if (mode === "observe" || mode === "sanitized_shadow")
+        return false;
+      if (decision.decision === "allow")
+        return true;
+      if (action === "model.call.before" || action === "model.call.after" || action === "model.fallback") {
+        return rolloutAtLeast(mode, "zone2_egress");
+      }
+      if (action === "report.export" || action === "report.finding") {
+        return rolloutAtLeast(mode, "zone2_egress");
+      }
+      if (action === "tool.call.before" || action === "tool.result.after" || action === "mcp.tool.call.before" || action === "mcp.tool.result.after" || action === "log.write" || action === "trace.write" || action === "memory.read" || action === "memory.write") {
+        return rolloutAtLeast(mode, "tool_log");
+      }
+      return rolloutAtLeast(mode, "non_bypassable");
+    }
+    FlowGateway.shouldEnforce = shouldEnforce;
+    function stableStringify(input2) {
+      if (input2 === undefined)
+        return "null";
+      if (input2 === null || typeof input2 !== "object")
+        return JSON.stringify(input2);
+      if (Array.isArray(input2))
+        return `[${input2.map((item) => stableStringify(item)).join(",")}]`;
+      const record3 = input2;
+      return `{${Object.keys(record3).sort().filter((key) => record3[key] !== undefined).map((key) => `${JSON.stringify(key)}:${stableStringify(record3[key])}`).join(",")}}`;
+    }
+    FlowGateway.stableStringify = stableStringify;
+    function stableHash(input2) {
+      return createHash6("sha256").update(stableStringify(input2)).digest("hex");
+    }
+    FlowGateway.stableHash = stableHash;
+    function contentHash(content) {
+      return createHash6("sha256").update(content).digest("hex");
+    }
+    FlowGateway.contentHash = contentHash;
+    let registry3 = [];
+    let engagementRegistry;
+    function bindEngagementRegistry(reg) {
+      engagementRegistry = reg;
+    }
+    FlowGateway.bindEngagementRegistry = bindEngagementRegistry;
+    function getEngagementRegistry() {
+      return engagementRegistry;
+    }
+    FlowGateway.getEngagementRegistry = getEngagementRegistry;
+    function getDetectorRegistry() {
+      return registry3;
+    }
+    FlowGateway.getDetectorRegistry = getDetectorRegistry;
+    function setDetectorRegistry(next) {
+      registry3 = [...next];
+    }
+    FlowGateway.setDetectorRegistry = setDetectorRegistry;
+    function registerDetector(detector) {
+      registry3.push(detector);
+    }
+    FlowGateway.registerDetector = registerDetector;
+    function resetDetectorRegistry() {
+      registry3 = [FlowGateway.regexDetector, FlowGateway.entityGraphDetector, FlowGateway.provenanceDetector, FlowGateway.piiDetector];
+    }
+    FlowGateway.resetDetectorRegistry = resetDetectorRegistry;
+    function secretPatterns() {
+      return [
+        /\b(?:sk|ghp|AKIA|ASIA|xox[baprs]|kf_secret)[A-Za-z0-9_\-]{6,}\b/g,
+        /\bGOCSPX-[A-Za-z0-9_\-]{6,}\b/g,
+        /\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/g,
+        /-----BEGIN [A-Z ]*PRIVATE KEY-----/g,
+        /\bAIza[0-9A-Za-z_-]{35}\b/g,
+        /(?:(?:password|passwd|secret|api[_-]?key|token|bearer|[A-Za-z0-9_-]{0,40}(?:key|secret|token|password))\s*[=:]\s*(?!\$\{)(?!([^\s"',;}\])])\1*(?![^\s"',;}\])]))(?!(?:true|false|verbose|none|null|changeme|example|your_token_here)(?![^\s"',;}\])]))(?=[^\s"',;}\])]*(?:\d|[^\sA-Za-z0-9"',;}\])])|[^\s"',;}\])]{20})[^\s"',;}\])]{6,})|(?:(?:password|passwd|secret|api[_-]?key|token|bearer|[A-Za-z0-9_-]{0,40}(?:key|secret|token|password))\s+(?!\$\{)(?!([^\s"',;}\])])\2*(?![^\s"',;}\])]))(?!(?:true|false|verbose|none|null|changeme|example|your_token_here)(?![^\s"',;}\])]))(?=[^\s"',;}\])]*(?:\d|[^\sA-Za-z0-9"',;}\])])|[^\s"',;}\])]{20})[^\s"',;}\])]{6,})|(?:Authorization\s*:\s*(?:Bearer\s+(?!\$\{)(?!([^\s"',;}\])])\3*(?![^\s"',;}\])]))(?!(?:true|false|verbose|none|null|changeme|example|your_token_here)(?![^\s"',;}\])]))(?=[^\s"',;}\])]*(?:\d|[^\sA-Za-z0-9"',;}\])])|[^\s"',;}\])]{20})|Basic\s+(?!\$\{)(?!([^\s"',;}\])])\4*(?![^\s"',;}\])]))(?!(?:true|false|verbose|none|null|changeme|example|your_token_here)(?![^\s"',;}\])])))[^\s"',;}\])]{6,})/gi
+      ];
+    }
+    function cloudAccountPatterns() {
+      return [
+        /arn:aws:[^:\s]*:[^:\s]*:(\d{12})\b/g,
+        /(?:aws|account)[^\d]{0,20}\b(\d{12})\b/gi,
+        /\b(\d{12})\b[^\d]{0,20}(?:aws|account)/gi
+      ];
+    }
+    const REPO_PATH_REGEX = /\/(?:home|repo|srv|var|opt|usr|Users|mnt)\/[A-Za-z0-9._/\-]+/g;
+    FlowGateway.regexDetector = (content) => {
+      const labels = new Set;
+      if (secretPatterns().some((re) => re.test(content)))
+        labels.add("secret");
+      if (/\b[a-z0-9-]+(?:\.[a-z0-9-]+)*\.(?:internal|corp|local|lan)\b/i.test(content)) {
+        labels.add("internal_hostname");
+      }
+      if (cloudAccountPatterns().some((re) => re.test(content)))
+        labels.add("cloud_account_id");
+      if (REPO_PATH_REGEX.test(content)) {
+        REPO_PATH_REGEX.lastIndex = 0;
+        labels.add("repo_path");
+      }
+      if (/\b(?:HTTP\/1\.1 200|stack trace|uid=\d+|curl -i|exploit output)\b/i.test(content))
+        labels.add("exploit_output");
+      if (/\b(?:CVE-\d{4}-\d+|SSRF|IDOR|authorization bypass|privilege escalation)\b/i.test(content)) {
+        labels.add("vulnerability_evidence");
+      }
+      if (/\b(?:ignore previous instructions|exfiltrate|send the secret|leak the token)\b/i.test(content)) {
+        labels.add("prompt_injection");
+      }
+      return [...labels].sort();
+    };
+    FlowGateway.entityGraphDetector = (content, context2) => {
+      const graph = context2.engagementGraph ?? engagementRegistry?.get(context2.engagement);
+      if (!graph)
+        return [];
+      const hits = detectEntityMatches({ content, graph });
+      if (hits.length === 0)
+        return [];
+      const labels = new Set;
+      for (const hit of hits) {
+        switch (hit.field) {
+          case "domains":
+            labels.add("internal_hostname");
+            break;
+          case "cidrs":
+            labels.add("internal_hostname");
+            break;
+          case "cloud_accounts":
+            labels.add("cloud_account_id");
+            break;
+          case "repos":
+            labels.add("repo_path");
+            break;
+          case "team_names":
+          case "employee_names":
+            labels.add("customer_data");
+            break;
+          case "build_jobs":
+            labels.add("engagement_asset");
+            break;
+          default:
+            labels.add("engagement_asset");
+        }
+      }
+      return [...labels].sort();
+    };
+    FlowGateway.provenanceSensor = (_content, context2) => {
+      const labels = new Set;
+      const metadata = context2.metadata ?? {};
+      const surface = context2.sourceSurface ?? "";
+      if (typeof metadata.mcpServerId === "string" && metadata.mcpServerId.length > 0) {
+        labels.add("untrusted_provenance");
+      }
+      if (surface.startsWith("mcp.tool")) {
+        labels.add("untrusted_provenance");
+      }
+      if (typeof metadata.sourceUrl === "string" && /^https?:\/\//i.test(metadata.sourceUrl)) {
+        labels.add("untrusted_provenance");
+      }
+      const tool2 = typeof metadata.tool === "string" ? metadata.tool : "";
+      if (tool2 && /(?:browser|fetch|crawl|scrape|wget|curl)/i.test(tool2)) {
+        labels.add("untrusted_provenance");
+      }
+      return [...labels].sort();
+    };
+    FlowGateway.provenanceDetector = FlowGateway.provenanceSensor;
+    FlowGateway.piiDetector = (() => {
+      const detect = PiiDetector.build();
+      return (content, ctx) => detect(content, ctx);
+    })();
+    registry3 = [FlowGateway.regexDetector, FlowGateway.entityGraphDetector, FlowGateway.provenanceDetector, FlowGateway.piiDetector];
+    function detectLabels(content, context2) {
+      const ctx = context2 ?? {};
+      const all = registry3.flatMap((detector) => {
+        try {
+          return detector(content, ctx);
+        } catch {
+          return [];
+        }
+      });
+      return [...new Set(all)].sort();
+    }
+    FlowGateway.detectLabels = detectLabels;
+    function createFlowEvent(input2) {
+      const detectContext = {
+        engagement: typeof input2.metadata?.engagement === "string" ? input2.metadata.engagement : undefined,
+        engagementGraph: input2.metadata?.engagementGraph,
+        metadata: input2.metadata,
+        sourceSurface: input2.sourceSurface
+      };
+      const labels = [...new Set([...input2.labels ?? [], ...detectLabels(input2.content, detectContext)])].sort();
+      const base = {
+        schemaVersion: "kifaru.flow-event.v1",
+        actor: input2.actor,
+        sessionId: input2.sessionId,
+        action: input2.action,
+        purpose: input2.purpose,
+        destination: input2.destination,
+        destinationTrustZone: input2.destinationTrustZone,
+        contentRef: input2.contentRef,
+        inputRefs: input2.inputRefs ?? [],
+        sourceSurface: input2.sourceSurface,
+        sourceTrustZone: input2.sourceTrustZone,
+        representation: input2.representation,
+        labels,
+        metadata: input2.metadata ?? {},
+        contentHash: contentHash(input2.content),
+        contentBytes: new TextEncoder().encode(input2.content).byteLength
+      };
+      return {
+        ...base,
+        eventId: stableHash(base)
+      };
+    }
+    FlowGateway.createFlowEvent = createFlowEvent;
+    function hasSensitiveLabel(labels) {
+      return labels.some((label) => [
+        "pii",
+        "secret",
+        "internal_hostname",
+        "cloud_account_id",
+        "repo_path",
+        "exploit_output",
+        "vulnerability_evidence",
+        "customer_data",
+        "unknown_sensitive",
+        "engagement_asset"
+      ].includes(label));
+    }
+    function hasUntrustedProvenance(labels) {
+      return labels.includes("untrusted_provenance");
+    }
+    function hasEvidenceIds(event) {
+      const evidenceIds = event.metadata?.evidenceIds;
+      return Array.isArray(evidenceIds) && evidenceIds.length > 0;
+    }
+    function decideFlow(event, policy = FlowGateway.DEFAULT_POLICY) {
+      const obligations = [];
+      const outputRefs = [];
+      let decision = "allow";
+      let representation = event.representation;
+      const sensitive = hasSensitiveLabel(event.labels);
+      const rawSensitive = sensitive && event.representation === "raw";
+      if (event.action === "model.fallback" && event.metadata?.previousRepresentation && event.metadata.previousRepresentation !== "raw" && event.representation === "raw") {
+        decision = "block";
+        obligations.push("fallback_must_not_downgrade_privacy");
+      } else if (event.action === "report.finding" && !hasEvidenceIds(event)) {
+        decision = "require_approval";
+        obligations.push("attach_evidence_ids_before_report");
+      } else if (event.action === "mcp.tool.result.after" && event.labels.includes("prompt_injection")) {
+        decision = "store_raw_return_ref";
+        representation = "reference";
+        obligations.push("vault_raw_mcp_result");
+        obligations.push("return_sanitized_preview");
+        outputRefs.push(`evidence:${event.contentHash.slice(0, 16)}`);
+      } else if (event.action === "mcp.tool.result.after" && hasUntrustedProvenance(event.labels) && event.representation === "raw") {
+        decision = "store_raw_return_ref";
+        representation = "reference";
+        obligations.push("vault_untrusted_mcp_result");
+        obligations.push("return_sanitized_preview");
+        outputRefs.push(`evidence:${event.contentHash.slice(0, 16)}`);
+      } else if (rawSensitive && (event.action === "tool.result.after" || event.action === "mcp.tool.result.after")) {
+        decision = "store_raw_return_ref";
+        representation = "reference";
+        obligations.push("vault_raw_tool_result");
+        obligations.push("return_sanitized_preview");
+        outputRefs.push(`evidence:${event.contentHash.slice(0, 16)}`);
+      } else if (rawSensitive && (event.destinationTrustZone === "zone_2_external" || event.action === "log.write" || event.action === "trace.write" || event.action === "memory.write" || event.action === "memory.read" || event.action === "report.export" || event.action === "agent.message")) {
+        decision = "transform";
+        representation = "sanitized_preview";
+        obligations.push("replace_raw_values_with_aliases");
+        obligations.push("preserve_typed_evidence_refs");
+      }
+      const base = {
+        schemaVersion: "kifaru.flow-decision.v1",
+        eventId: event.eventId,
+        eventHash: stableHash(event),
+        decision,
+        representation,
+        labels: event.labels,
+        policyId: policy.id,
+        obligations,
+        outputRefs
+      };
+      return {
+        ...base,
+        decisionId: stableHash(base)
+      };
+    }
+    FlowGateway.decideFlow = decideFlow;
+    function createAuditRecord(event, decision, generatedAt) {
+      const base = {
+        schemaVersion: "kifaru.flow-audit.v1",
+        generatedAt,
+        event,
+        decision
+      };
+      return {
+        ...base,
+        auditId: stableHash(base)
+      };
+    }
+    FlowGateway.createAuditRecord = createAuditRecord;
+
+    class AuditLedger {
+      records = [];
+      append(record3) {
+        this.records.push(record3);
+      }
+      list() {
+        return [...this.records];
+      }
+    }
+    FlowGateway.AuditLedger = AuditLedger;
+    async function appendAuditRecord(filepath, record3) {
+      await mkdir(path7.dirname(filepath), { recursive: true });
+      await appendFile(filepath, `${stableStringify(record3)}
+`, "utf8");
+    }
+    FlowGateway.appendAuditRecord = appendAuditRecord;
+    function aliasFor(input2) {
+      const prefix = {
+        internal_hostname: "HOST",
+        cloud_account_id: "CLOUD_ACCT",
+        repo_path: "REPO_PATH",
+        secret: "SECRET",
+        pii: "PII",
+        customer_data: "CUSTOMER",
+        exploit_output: "EXPLOIT",
+        vulnerability_evidence: "VULN",
+        prompt_injection: "INJECT",
+        unknown_sensitive: "SENSITIVE"
+      };
+      const tag2 = prefix[input2.label] ?? "EVIDENCE";
+      const seed = stableStringify({ engagement: input2.engagement ?? "default", label: input2.label, value: input2.value });
+      const digest2 = createHash6("sha256").update(seed).digest("hex");
+      const num = parseInt(digest2.slice(0, 10), 16) % 1e6;
+      return `${tag2}_${String(num).padStart(6, "0")}`;
+    }
+    FlowGateway.aliasFor = aliasFor;
+    function sanitize(input2) {
+      const aliases = {};
+      let sanitized = input2.content;
+      const tokenRules = [
+        ...secretPatterns().map((regex) => ({ regex, label: "secret" })),
+        {
+          regex: /\b[a-z0-9-]+(?:\.[a-z0-9-]+)*\.(?:internal|corp|local|lan)\b/gi,
+          label: "internal_hostname"
+        },
+        { regex: new RegExp(REPO_PATH_REGEX.source, "g"), label: "repo_path" }
+      ];
+      for (const rule of tokenRules) {
+        sanitized = sanitized.replace(rule.regex, (match) => {
+          const alias = aliasFor({ engagement: input2.engagement, label: rule.label, value: match });
+          aliases[alias] = match;
+          return alias;
+        });
+      }
+      for (const regex of cloudAccountPatterns()) {
+        sanitized = sanitized.replace(regex, (match, account) => {
+          if (!account)
+            return match;
+          const alias = aliasFor({ engagement: input2.engagement, label: "cloud_account_id", value: account });
+          aliases[alias] = account;
+          return match.replace(account, alias);
+        });
+      }
+      const piiMatches = [...PiiDetector.findMatches(sanitized)].sort((a, b) => b.value.length - a.value.length);
+      for (const hit of piiMatches) {
+        const alias = aliasFor({ engagement: input2.engagement, label: "pii", value: hit.value });
+        const escaped = hit.value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+        let replaced = false;
+        sanitized = sanitized.replace(new RegExp(escaped, "g"), () => {
+          replaced = true;
+          return alias;
+        });
+        if (replaced)
+          aliases[alias] = hit.value;
+      }
+      const graph = input2.engagementGraph ?? engagementRegistry?.get(input2.engagement);
+      if (graph) {
+        const hits = detectEntityMatches({ content: sanitized, graph });
+        const ranked = [...hits].sort((a, b) => b.token.length - a.token.length);
+        for (const hit of ranked) {
+          const label = entityFieldToLabel(hit.field);
+          const alias = aliasFor({ engagement: input2.engagement, label, value: hit.token });
+          aliases[alias] = hit.token;
+          const escaped = hit.token.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+          const re = new RegExp(`(^|[^A-Za-z0-9_-])${escaped}([^A-Za-z0-9_-]|$)`, "gi");
+          sanitized = sanitized.replace(re, (_match, before, after) => `${before}${alias}${after}`);
+        }
+      }
+      return {
+        sanitized,
+        aliases,
+        labels: detectLabels(input2.content, {
+          engagement: input2.engagement,
+          engagementGraph: graph
+        })
+      };
+    }
+    FlowGateway.sanitize = sanitize;
+    function entityFieldToLabel(field) {
+      switch (field) {
+        case "domains":
+        case "cidrs":
+          return "internal_hostname";
+        case "cloud_accounts":
+          return "cloud_account_id";
+        case "repos":
+          return "repo_path";
+        case "team_names":
+        case "employee_names":
+          return "customer_data";
+        case "build_jobs":
+          return "engagement_asset";
+        default:
+          return "engagement_asset";
+      }
+    }
+    async function vaultRaw(input2) {
+      const detectedLabels = [...new Set([...input2.labels ?? [], ...detectLabels(input2.content)])].sort();
+      const { sanitized, aliases } = sanitize({ engagement: input2.engagement, content: input2.content });
+      const hash4 = contentHash(input2.content);
+      const evidenceId = `EV-${hash4.slice(0, 16)}`;
+      const createdAt = new Date().toISOString();
+      const entry = {
+        evidenceId,
+        contentHash: hash4,
+        contentBytes: new TextEncoder().encode(input2.content).byteLength,
+        labels: detectedLabels,
+        aliases,
+        sanitizedPreview: sanitized,
+        trustZone: "zone_0_raw",
+        createdAt
+      };
+      await mkdir(input2.vaultDir, { recursive: true, mode: 448 });
+      const rawPath = path7.join(input2.vaultDir, `${evidenceId}.raw.txt`);
+      const metaPath = path7.join(input2.vaultDir, `${evidenceId}.json`);
+      await writeFile2(rawPath, input2.content, { encoding: "utf8", mode: 384 });
+      await writeFile2(metaPath, stableStringify({
+        ...entry,
+        sourceSurface: input2.sourceSurface ?? "unknown"
+      }), { encoding: "utf8", mode: 384 });
+      return entry;
+    }
+    FlowGateway.vaultRaw = vaultRaw;
+  })(FlowGateway ||= {});
+});
+
 // ../core/src/index.ts
 var init_src2 = __esm(() => {
   init_kifaru_model_router();
@@ -49503,6 +50249,9 @@ var init_src2 = __esm(() => {
   init_governed_skill_tool();
   init_embedded_skills();
   init_embedded_theme();
+  init_privacy_gateway();
+  init_entity_graph();
+  init_pii_detector();
 });
 
 // ../headless-runtime/src/policy-gate.ts
@@ -49711,13 +50460,13 @@ var init_event_sink = __esm(() => {
 
 // ../headless-runtime/src/sqlite-event-store.ts
 import fs7 from "fs";
-import path7 from "path";
+import path8 from "path";
 import { Database as Database2 } from "bun:sqlite";
 
 class SqliteEventStore {
   db;
   constructor(dbPath) {
-    fs7.mkdirSync(path7.dirname(dbPath), { recursive: true });
+    fs7.mkdirSync(path8.dirname(dbPath), { recursive: true });
     this.db = new Database2(dbPath, { create: true });
     this.initialize();
   }
@@ -50217,9 +50966,9 @@ var init_run_workflow = __esm(() => {
 
 // ../headless-runtime/src/report-files.ts
 import fs8 from "fs";
-import path8 from "path";
+import path9 from "path";
 function writeLocalReport(record3, outDir) {
-  const base = path8.join(outDir, record3.runId);
+  const base = path9.join(outDir, record3.runId);
   const files = {
     json: `${base}.json`,
     md: `${base}.md`,
@@ -50253,10 +51002,10 @@ var init_report_files = __esm(() => {
 
 // ../headless-runtime/src/workflow-skill-editor.ts
 import fs9 from "fs";
-import path9 from "path";
-import { createHash as createHash6, randomUUID as randomUUID3 } from "crypto";
+import path10 from "path";
+import { createHash as createHash7, randomUUID as randomUUID3 } from "crypto";
 function skillRoot() {
-  return path9.resolve(process.env.KIFARU_WORKFLOW_SKILLS_DIR ?? "data/headless-skill-overrides");
+  return path10.resolve(process.env.KIFARU_WORKFLOW_SKILLS_DIR ?? "data/headless-skill-overrides");
 }
 function builtIn(workflowKey) {
   const workflow = workflowByKey(workflowKey);
@@ -50270,7 +51019,7 @@ function builtIn(workflowKey) {
   return { skillName, source, pack };
 }
 function revision(markdown) {
-  return createHash6("sha256").update(markdown).digest("hex");
+  return createHash7("sha256").update(markdown).digest("hex");
 }
 function validateMarkdown(markdown) {
   const body = markdown.trim();
@@ -50281,7 +51030,7 @@ function validateMarkdown(markdown) {
 }
 function readWorkflowSkill(workflowKey) {
   const { skillName, pack } = builtIn(workflowKey);
-  const filename = path9.join(skillRoot(), `${workflowKey}.md`);
+  const filename = path10.join(skillRoot(), `${workflowKey}.md`);
   const customized = fs9.existsSync(filename);
   const markdown = customized ? validateMarkdown(fs9.readFileSync(filename, "utf8")) : pack.body;
   return { workflowKey, skillName, markdown, revision: revision(markdown), customized };
@@ -50294,8 +51043,8 @@ function saveWorkflowSkill(workflowKey, markdown, expectedRevision) {
   }
   const root = skillRoot();
   fs9.mkdirSync(root, { recursive: true });
-  const filename = path9.join(root, `${workflowKey}.md`);
-  const pending = path9.join(root, `${workflowKey}.${randomUUID3()}.pending`);
+  const filename = path10.join(root, `${workflowKey}.md`);
+  const pending = path10.join(root, `${workflowKey}.${randomUUID3()}.pending`);
   try {
     fs9.writeFileSync(pending, `${body}
 `, { flag: "wx" });
@@ -52891,7 +53640,7 @@ class HttpClient {
     this.request = async ({
       body,
       secure,
-      path: path11,
+      path: path12,
       type,
       query,
       format,
@@ -52904,7 +53653,7 @@ class HttpClient {
       const queryString = query && this.toQueryString(query);
       const payloadFormatter = this.contentFormatters[type || ContentType.Json];
       const responseFormat = format || requestParams.format;
-      return this.customFetch(`${baseUrl || this.baseUrl || ""}${path11}${queryString ? `?${queryString}` : ""}`, {
+      return this.customFetch(`${baseUrl || this.baseUrl || ""}${path12}${queryString ? `?${queryString}` : ""}`, {
         ...requestParams,
         headers: {
           ...requestParams.headers || {},
@@ -54207,7 +54956,7 @@ var init_lib2 = __esm(() => {
 });
 
 // src/index.ts
-import fs14 from "fs";
+import fs15 from "fs";
 
 // src/config.ts
 init_zod();
@@ -64316,10 +65065,10 @@ function escapeLike(value) {
 // src/platform/interactive-report.ts
 init_src();
 init_src3();
-import path10 from "path";
-import { createHash as createHash7 } from "crypto";
+import path11 from "path";
+import { createHash as createHash8 } from "crypto";
 function stableUuid(value) {
-  const bytes = createHash7("sha256").update(value).digest();
+  const bytes = createHash8("sha256").update(value).digest();
   bytes[6] = (bytes[6] ?? 0) & 15 | 64;
   bytes[8] = (bytes[8] ?? 0) & 63 | 128;
   const hex5 = bytes.subarray(0, 16).toString("hex");
@@ -64380,11 +65129,11 @@ function writeInteractiveRunReport(db, workspaceID, platformRunID, outDir) {
     evidence,
     version: 0
   });
-  return writeLocalReport(record3, path10.resolve(outDir));
+  return writeLocalReport(record3, path11.resolve(outDir));
 }
 
 // src/platform/repository.ts
-import { createHash as createHash8, randomUUID as randomUUID4 } from "crypto";
+import { createHash as createHash9, randomUUID as randomUUID4 } from "crypto";
 class PlatformRunNotFoundError extends Error {
   name = "PlatformRunNotFoundError";
 }
@@ -64823,7 +65572,7 @@ function createPlatformRepository(db) {
         insertJob.run(id, actor.workspaceID, input2.runID ?? null, input2.kind, input2.priority, JSON.stringify(input2.payload), input2.maxAttempts, input2.availableAt ?? now2, now2, now2, input2.idempotencyKey);
         const delivery2 = githubDelivery(input2.kind, input2.payload);
         if (delivery2) {
-          upsertWebhookDelivery.run(delivery2.deliveryID, actor.workspaceID, delivery2.eventName, delivery2.action, createHash8("sha256").update(JSON.stringify(input2.payload)).digest("hex"), input2.runID ?? null, now2);
+          upsertWebhookDelivery.run(delivery2.deliveryID, actor.workspaceID, delivery2.eventName, delivery2.action, createHash9("sha256").update(JSON.stringify(input2.payload)).digest("hex"), input2.runID ?? null, now2);
         }
         const created = findJobByID.get(actor.workspaceID, id);
         db.exec("COMMIT");
@@ -64905,7 +65654,7 @@ function createPlatformRepository(db) {
       try {
         for (const finding of inputs) {
           const existing = findFinding.get(workspaceID, finding.fingerprint);
-          const id = existing?.id ?? `finding_${createHash8("sha256").update(`${workspaceID}:${finding.fingerprint}`).digest("hex").slice(0, 24)}`;
+          const id = existing?.id ?? `finding_${createHash9("sha256").update(`${workspaceID}:${finding.fingerprint}`).digest("hex").slice(0, 24)}`;
           const description = finding.description ?? finding.title;
           const cwe = finding.cwe ?? (finding.ruleID.startsWith("CWE-") ? finding.ruleID : null);
           if (existing) {
@@ -65133,10 +65882,10 @@ function mapAgentSession(row) {
   };
 }
 function operationID(workspaceID, sessionID, toolCallID) {
-  return `operation_${createHash8("sha256").update(`${workspaceID}:${sessionID}:${toolCallID}`).digest("hex").slice(0, 24)}`;
+  return `operation_${createHash9("sha256").update(`${workspaceID}:${sessionID}:${toolCallID}`).digest("hex").slice(0, 24)}`;
 }
 function evidenceID(runID, fingerprint) {
-  return `evidence_${createHash8("sha256").update(`${runID}:${fingerprint}`).digest("hex").slice(0, 24)}`;
+  return `evidence_${createHash9("sha256").update(`${runID}:${fingerprint}`).digest("hex").slice(0, 24)}`;
 }
 function redactForStorage(value, depth = 0) {
   if (value === undefined || value === null || typeof value === "boolean" || typeof value === "number")
@@ -65197,11 +65946,11 @@ var getFilePath = (options) => {
   } else if (!filename.match(/\.[a-zA-Z0-9_-]+$/)) {
     filename = filename.concat("/" + defaultDocument);
   }
-  const path11 = getFilePathWithoutDefaultDocument({
+  const path12 = getFilePathWithoutDefaultDocument({
     root: options.root,
     filename
   });
-  return path11;
+  return path12;
 };
 var getFilePathWithoutDefaultDocument = (options) => {
   let root = options.root || "";
@@ -65212,12 +65961,12 @@ var getFilePathWithoutDefaultDocument = (options) => {
   filename = filename.replace(/^\.?[\/\\]/, "");
   filename = filename.replace(/\\/, "/");
   root = root.replace(/\/$/, "");
-  let path11 = root ? root + "/" + filename : filename;
-  path11 = path11.replace(/^\.?\//, "");
-  if (root[0] !== "/" && path11[0] === "/") {
+  let path12 = root ? root + "/" + filename : filename;
+  path12 = path12.replace(/^\.?\//, "");
+  if (root[0] !== "/" && path12[0] === "/") {
     return;
   }
-  return path11;
+  return path12;
 };
 
 // ../../node_modules/.bun/hono@4.7.10/node_modules/hono/dist/utils/mime.js
@@ -65300,7 +66049,7 @@ var ENCODINGS = {
 };
 var ENCODINGS_ORDERED_KEYS = Object.keys(ENCODINGS);
 var DEFAULT_DOCUMENT = "index.html";
-var defaultPathResolve = (path11) => path11;
+var defaultPathResolve = (path12) => path12;
 var serveStatic = (options) => {
   let isAbsoluteRoot = false;
   let root;
@@ -65328,21 +66077,21 @@ var serveStatic = (options) => {
         filename += "/";
       }
     }
-    let path11 = getFilePath({
+    let path12 = getFilePath({
       filename,
       root,
       defaultDocument: DEFAULT_DOCUMENT
     });
-    if (!path11) {
+    if (!path12) {
       return await next();
     }
     if (isAbsoluteRoot) {
-      path11 = "/" + path11;
+      path12 = "/" + path12;
     }
     const getContent = options.getContent;
     const pathResolve = options.pathResolve ?? defaultPathResolve;
-    path11 = pathResolve(path11);
-    let content = await getContent(path11, c);
+    path12 = pathResolve(path12);
+    let content = await getContent(path12, c);
     if (!content) {
       let pathWithoutDefaultDocument = getFilePathWithoutDefaultDocument({
         filename,
@@ -65352,10 +66101,10 @@ var serveStatic = (options) => {
         return await next();
       }
       pathWithoutDefaultDocument = pathResolve(pathWithoutDefaultDocument);
-      if (pathWithoutDefaultDocument !== path11) {
+      if (pathWithoutDefaultDocument !== path12) {
         content = await getContent(pathWithoutDefaultDocument, c);
         if (content) {
-          path11 = pathWithoutDefaultDocument;
+          path12 = pathWithoutDefaultDocument;
         }
       }
     }
@@ -65363,7 +66112,7 @@ var serveStatic = (options) => {
       return c.newResponse(content.body, content);
     }
     if (content) {
-      const mimeType = options.mimes && getMimeType(path11, options.mimes) || getMimeType(path11);
+      const mimeType = options.mimes && getMimeType(path12, options.mimes) || getMimeType(path12);
       c.header("Content-Type", mimeType || "application/octet-stream");
       if (options.precompressed && (!mimeType || COMPRESSIBLE_CONTENT_TYPE_REGEX.test(mimeType))) {
         const acceptEncodingSet = new Set(c.req.header("Accept-Encoding")?.split(",").map((encoding) => encoding.trim()));
@@ -65371,7 +66120,7 @@ var serveStatic = (options) => {
           if (!acceptEncodingSet.has(encoding)) {
             continue;
           }
-          const compressedContent = await getContent(path11 + ENCODINGS[encoding], c);
+          const compressedContent = await getContent(path12 + ENCODINGS[encoding], c);
           if (compressedContent) {
             content = compressedContent;
             c.header("Content-Encoding", encoding);
@@ -65380,10 +66129,10 @@ var serveStatic = (options) => {
           }
         }
       }
-      await options.onFound?.(path11, c);
+      await options.onFound?.(path12, c);
       return c.body(content);
     }
-    await options.onNotFound?.(path11, c);
+    await options.onNotFound?.(path12, c);
     await next();
     return;
   };
@@ -65392,18 +66141,18 @@ var serveStatic = (options) => {
 // ../../node_modules/.bun/hono@4.7.10/node_modules/hono/dist/adapter/bun/serve-static.js
 var serveStatic2 = (options) => {
   return async function serveStatic22(c, next) {
-    const getContent = async (path11) => {
-      path11 = path11.startsWith("/") ? path11 : `./${path11}`;
-      const file3 = Bun.file(path11);
+    const getContent = async (path12) => {
+      path12 = path12.startsWith("/") ? path12 : `./${path12}`;
+      const file3 = Bun.file(path12);
       return await file3.exists() ? file3 : null;
     };
-    const pathResolve = (path11) => {
-      return path11.startsWith("/") ? path11 : `./${path11}`;
+    const pathResolve = (path12) => {
+      return path12.startsWith("/") ? path12 : `./${path12}`;
     };
-    const isDir = async (path11) => {
+    const isDir = async (path12) => {
       let isDir2;
       try {
-        const stats = await stat(path11);
+        const stats = await stat(path12);
         isDir2 = stats.isDirectory();
       } catch {}
       return isDir2;
@@ -65459,7 +66208,7 @@ var WSContext = class {
 // src/app.ts
 init_zod();
 import fs11, { existsSync as existsSync2 } from "fs";
-import path11 from "path";
+import path12 from "path";
 
 // src/session-archive/contract.ts
 init_zod();
@@ -66018,7 +66767,7 @@ function escapeLike2(value) {
 
 // src/session-archive/writer.ts
 init_zod();
-import { createHash as createHash9 } from "crypto";
+import { createHash as createHash10 } from "crypto";
 var MAX_PREVIEW_LENGTH = 1000;
 
 class SessionArchiveInputError extends Error {
@@ -66403,7 +67152,7 @@ function logLineID(sessionID, sequence) {
   return `log_${hash4(`${sessionID}:${sequence}`)}`;
 }
 function hash4(value) {
-  return createHash9("sha256").update(value).digest("hex").slice(0, 24);
+  return createHash10("sha256").update(value).digest("hex").slice(0, 24);
 }
 
 // src/tracing.ts
@@ -67670,8 +68419,8 @@ Disallow: /
     const events = store.readEvents(runId);
     const job = store.getLocalRun(runId);
     let started = events.find((event) => event.eventType === "headless.run.started")?.payload;
-    const outDir = path11.resolve(process.env.KIFARU_LOCAL_RUNS_OUT ?? "data/headless-reports");
-    const reportPath = path11.join(outDir, `${runId}.md`);
+    const outDir = path12.resolve(process.env.KIFARU_LOCAL_RUNS_OUT ?? "data/headless-reports");
+    const reportPath = path12.join(outDir, `${runId}.md`);
     if (!started && job) {
       const workflow = workflowByKey(job.workflowKey);
       started = {
@@ -67682,9 +68431,9 @@ Disallow: /
         stages: workflow?.stages.map((stage2) => ({ key: stage2.key, name: stage2.name })) ?? []
       };
     }
-    if (!started && fs11.existsSync(path11.join(outDir, `${runId}.json`))) {
+    if (!started && fs11.existsSync(path12.join(outDir, `${runId}.json`))) {
       try {
-        const record3 = JSON.parse(fs11.readFileSync(path11.join(outDir, `${runId}.json`), "utf8"));
+        const record3 = JSON.parse(fs11.readFileSync(path12.join(outDir, `${runId}.json`), "utf8"));
         if (record3.runId === runId && typeof record3.workflowKey === "string" && typeof record3.target === "string") {
           const workflow = workflowByKey(record3.workflowKey);
           started = {
@@ -67765,7 +68514,7 @@ Disallow: /
     if (!localReportsEnabled(c) || context2.actor.role !== "admin")
       return c.json({ code: "local_runs_disabled" }, 403);
     const { SqliteEventStore: SqliteEventStore2 } = await Promise.resolve().then(() => (init_src3(), exports_src2));
-    const store = new SqliteEventStore2(path11.resolve(process.env.KIFARU_LOCAL_RUNS_DB ?? "data/headless-events.sqlite"));
+    const store = new SqliteEventStore2(path12.resolve(process.env.KIFARU_LOCAL_RUNS_DB ?? "data/headless-events.sqlite"));
     try {
       return c.json({ items: store.listLocalRunIds().flatMap((runId) => {
         const item = localRunStatus(store, runId);
@@ -67785,7 +68534,7 @@ Disallow: /
     if (!/^[0-9a-f-]{36}$/i.test(runId))
       return c.json({ code: "invalid_run_id" }, 400);
     const { SqliteEventStore: SqliteEventStore2 } = await Promise.resolve().then(() => (init_src3(), exports_src2));
-    const store = new SqliteEventStore2(path11.resolve(process.env.KIFARU_LOCAL_RUNS_DB ?? "data/headless-events.sqlite"));
+    const store = new SqliteEventStore2(path12.resolve(process.env.KIFARU_LOCAL_RUNS_DB ?? "data/headless-events.sqlite"));
     try {
       const item = localRunStatus(store, runId);
       return item ? c.json({ item }) : c.json({ code: "run_not_found" }, 404);
@@ -67808,8 +68557,8 @@ Disallow: /
     if (!workflow)
       return c.json({ code: "workflow_not_found", detail: "Workflow was not found." }, 404);
     const { SqliteEventStore: SqliteEventStore2 } = await Promise.resolve().then(() => (init_src3(), exports_src2));
-    const dbPath = path11.resolve(process.env.KIFARU_LOCAL_RUNS_DB ?? "data/headless-events.sqlite");
-    const outDir = path11.resolve(process.env.KIFARU_LOCAL_RUNS_OUT ?? "data/headless-reports");
+    const dbPath = path12.resolve(process.env.KIFARU_LOCAL_RUNS_DB ?? "data/headless-events.sqlite");
+    const outDir = path12.resolve(process.env.KIFARU_LOCAL_RUNS_OUT ?? "data/headless-reports");
     const runId = randomUUID6();
     const optional3 = new Set(workflow.stages.filter((s) => s.optional).map((s) => s.key));
     const selectedOptionalStageKeys = (selectedStageKeys ?? []).filter((key) => optional3.has(key));
@@ -67833,7 +68582,7 @@ Disallow: /
       permissionMode,
       status: "queued",
       dbPath,
-      reportPath: path11.join(outDir, `${runId}.md`)
+      reportPath: path12.join(outDir, `${runId}.md`)
     }, 202);
   });
   const localReportsEnabled = (c) => process.env.KIFARU_LOCAL_RUNS === "1" && (["127.0.0.1", "::1", "localhost"].includes(input2.config.host) || isLoopbackPeer(c));
@@ -67844,14 +68593,14 @@ Disallow: /
       return context2;
     if (!localReportsEnabled(c))
       return c.json({ code: "local_runs_disabled" }, 403);
-    const outDir = path11.resolve(process.env.KIFARU_LOCAL_RUNS_OUT ?? "data/headless-reports");
+    const outDir = path12.resolve(process.env.KIFARU_LOCAL_RUNS_OUT ?? "data/headless-reports");
     if (!fs11.existsSync(outDir))
       return c.json({ items: [] });
     const { ReportRecord: ReportRecord2 } = await Promise.resolve().then(() => (init_src(), exports_src));
     const permitted = context2.actor.role === "admin" ? null : workspaceReportIDs(context2.workspace.workspaceID);
     const items = fs11.readdirSync(outDir).filter((name21) => /^[0-9a-f-]{36}\.json$/i.test(name21)).flatMap((name21) => {
       try {
-        const record3 = ReportRecord2.parse(JSON.parse(fs11.readFileSync(path11.join(outDir, name21), "utf8")));
+        const record3 = ReportRecord2.parse(JSON.parse(fs11.readFileSync(path12.join(outDir, name21), "utf8")));
         if (record3.runId !== name21.slice(0, -5) || permitted && !permitted.has(record3.runId))
           return [];
         return [{
@@ -67881,12 +68630,12 @@ Disallow: /
     if (!/^[0-9a-f-]{36}$/i.test(runId) || !["json", "md", "xlsx", "pdf"].includes(ext)) {
       return c.json({ code: "invalid_report_path" }, 400);
     }
-    const outDir = path11.resolve(process.env.KIFARU_LOCAL_RUNS_OUT ?? "data/headless-reports");
-    const filename = path11.join(outDir, `${runId}.${ext}`);
+    const outDir = path12.resolve(process.env.KIFARU_LOCAL_RUNS_OUT ?? "data/headless-reports");
+    const filename = path12.join(outDir, `${runId}.${ext}`);
     if (!fs11.existsSync(filename))
       return c.json({ code: "report_not_found" }, 404);
     if (context2.actor.role !== "admin") {
-      const metadata = path11.join(outDir, `${runId}.json`);
+      const metadata = path12.join(outDir, `${runId}.json`);
       if (!fs11.existsSync(metadata) || !workspaceReportIDs(context2.workspace.workspaceID).has(runId)) {
         return c.json({ code: "report_not_found" }, 404);
       }
@@ -68431,7 +69180,7 @@ import {
   defineTool as defineTool3,
   getAgentDir as getAgentDir2
 } from "@earendil-works/pi-coding-agent";
-import path13 from "path";
+import path14 from "path";
 import fs13 from "fs";
 init_src();
 
@@ -68652,7 +69401,7 @@ import {
   createWriteToolDefinition
 } from "@earendil-works/pi-coding-agent";
 import fs12 from "fs";
-import path12 from "path";
+import path13 from "path";
 var APPROVAL_TIMEOUT_MS = 10 * 60000;
 var DESTRUCTIVE_COMMANDS = new Set([
   "dd",
@@ -68782,15 +69531,15 @@ Allow it?`,
   return null;
 }
 function pathConsentRequest(target, cwd) {
-  const resolved = path12.resolve(cwd, target);
+  const resolved = path13.resolve(cwd, target);
   let canonical = resolved;
   try {
     let probe = resolved;
     while (!fs12.existsSync(probe))
-      probe = path12.dirname(probe);
-    canonical = path12.join(fs12.realpathSync(probe), resolved.slice(probe.length));
+      probe = path13.dirname(probe);
+    canonical = path13.join(fs12.realpathSync(probe), resolved.slice(probe.length));
   } catch {}
-  const inside = canonical === cwd || canonical.startsWith(`${cwd}${path12.sep}`);
+  const inside = canonical === cwd || canonical.startsWith(`${cwd}${path13.sep}`);
   if (inside)
     return null;
   return {
@@ -73158,7 +73907,7 @@ class WorkbenchAgentService {
     fs13.mkdirSync(config3.workbenchCwd, { recursive: true });
     this.cwd = fs13.realpathSync(config3.workbenchCwd);
     this.skillsPath = materializeKifaruSkills();
-    this.registryPath = path13.join(getAgentDir2(), "workbench-conversations.json");
+    this.registryPath = path14.join(getAgentDir2(), "workbench-conversations.json");
     this.saved = fs13.existsSync(this.registryPath) ? JSON.parse(fs13.readFileSync(this.registryPath, "utf8")) : [];
     for (const saved of this.saved) {
       for (const status of ["queued", "running"]) {
@@ -73385,7 +74134,7 @@ class WorkbenchAgentService {
     this.persistRegistry();
   }
   persistRegistry() {
-    fs13.mkdirSync(path13.dirname(this.registryPath), { recursive: true });
+    fs13.mkdirSync(path14.dirname(this.registryPath), { recursive: true });
     const temporary = `${this.registryPath}.tmp`;
     fs13.writeFileSync(temporary, JSON.stringify(this.saved), { mode: 384 });
     fs13.renameSync(temporary, this.registryPath);
@@ -73988,8 +74737,8 @@ class WorkbenchAgentService {
 function isSharedSessionPath(sessionPath) {
   try {
     const resolved = fs13.realpathSync(sessionPath);
-    const root = fs13.realpathSync(path13.join(getAgentDir2(), "sessions"));
-    return resolved.endsWith(".jsonl") && resolved.startsWith(root + path13.sep) && fs13.statSync(resolved).isFile();
+    const root = fs13.realpathSync(path14.join(getAgentDir2(), "sessions"));
+    return resolved.endsWith(".jsonl") && resolved.startsWith(root + path14.sep) && fs13.statSync(resolved).isFile();
   } catch {
     return false;
   }
@@ -74295,13 +75044,66 @@ function workbenchSocketHandlers(service) {
   };
 }
 
+// src/local-run-supervisor.ts
+import { spawn } from "child_process";
+import fs14 from "fs";
+import path15 from "path";
+function localRunConcurrency(value = process.env.KIFARU_LOCAL_RUN_CONCURRENCY) {
+  const parsed = Number(value ?? "3");
+  return Number.isInteger(parsed) && parsed > 0 ? Math.min(parsed, 8) : 3;
+}
+function localRunWorkerEntry(fromDir = import.meta.dir) {
+  const bundled = path15.join(fromDir, "kifaru-local-run-worker.js");
+  if (fs14.existsSync(bundled))
+    return bundled;
+  const source = path15.join(fromDir, "local-run-worker.ts");
+  return fs14.existsSync(source) ? source : null;
+}
+function startLocalRunWorkers(options = {}) {
+  const env = options.env ?? process.env;
+  if (env.KIFARU_LOCAL_RUNS !== "1")
+    return () => {};
+  const entry = localRunWorkerEntry(options.fromDir);
+  if (!entry)
+    throw new Error("Local headless worker entry is missing from this Kifaru installation");
+  const children = new Set;
+  let stopping = false;
+  const count = localRunConcurrency(env.KIFARU_LOCAL_RUN_CONCURRENCY);
+  const launch = (slot) => {
+    if (stopping)
+      return;
+    const child = spawn(process.execPath, [entry], { env, stdio: "inherit" });
+    children.add(child);
+    child.on("exit", (code) => {
+      children.delete(child);
+      if (!stopping) {
+        if (code !== 0)
+          console.error(`[local-run] worker ${slot} exited (${code ?? "signal"}); restarting`);
+        setTimeout(() => launch(slot), code === 0 ? 100 : 1000);
+      }
+    });
+    child.on("error", (error92) => console.error(`[local-run] worker ${slot} failed:`, error92));
+  };
+  for (let slot = 1;slot <= count; slot++)
+    launch(slot);
+  console.log(`[local-run] ${count} worker slots ready`);
+  return () => {
+    stopping = true;
+    for (const child of children)
+      child.kill("SIGTERM");
+  };
+}
+
 // src/index.ts
 var config3 = loadConfig();
+if (process.env.KIFARU_LOCAL_RUNS === undefined && ["127.0.0.1", "::1", "localhost"].includes(config3.host)) {
+  process.env.KIFARU_LOCAL_RUNS = "1";
+}
 var catalog = loadModelCatalog(config3);
 var storage = createSqliteStorage(config3.sessionDbPath);
 var workbench = config3.workbenchCwd ? await createWorkbench() : undefined;
 async function createWorkbench() {
-  fs14.mkdirSync(config3.workbenchCwd, { recursive: true });
+  fs15.mkdirSync(config3.workbenchCwd, { recursive: true });
   try {
     const service = await WorkbenchAgentService.create(config3, catalog, createPlatformRepository(storage.db));
     console.log(`[session-gateway] live workspace enabled at ${config3.workbenchCwd}`);
@@ -74354,6 +75156,7 @@ var server = Bun.serve({
     return new Response("Internal server error", { status: 500 });
   }
 });
+var stopLocalRunWorkers = startLocalRunWorkers();
 console.log(`[session-gateway] listening on http://${server.hostname}:${server.port} with ${Object.keys(catalog.models).length} model(s)`);
 if (config3.hasOAuthProviders) {
   console.log(`[session-gateway] OAuth providers enabled: ${config3.oauthProviderIds.join(", ")}`);
@@ -74365,6 +75168,7 @@ if (config3.hasBootstrapToken) {
 }
 for (const signal of ["SIGINT", "SIGTERM"]) {
   process.on(signal, () => {
+    stopLocalRunWorkers();
     storage.close();
     server.stop(true);
     process.exit(0);