@node9/proxy 0.2.1 → 1.0.0

package/dist/cli.mjs

@@ -11,6 +11,270 @@ import path from "path";
 import os from "os";
 import pm from "picomatch";
 import { parse } from "sh-syntax";
+
+// src/ui/native.ts
+import { spawn } from "child_process";
+var isTestEnv = () => {
+  return process.env.NODE_ENV === "test" || process.env.VITEST === "true" || !!process.env.VITEST || process.env.CI === "true" || !!process.env.CI || process.env.NODE9_TESTING === "1";
+};
+function sendDesktopNotification(title, body) {
+  if (isTestEnv()) return;
+  try {
+    const safeTitle = title.replace(/"/g, '\\"');
+    const safeBody = body.replace(/"/g, '\\"');
+    if (process.platform === "darwin") {
+      const script = `display notification "${safeBody}" with title "${safeTitle}"`;
+      spawn("osascript", ["-e", script], { detached: true, stdio: "ignore" }).unref();
+    } else if (process.platform === "linux") {
+      spawn("notify-send", [safeTitle, safeBody, "--icon=dialog-warning"], {
+        detached: true,
+        stdio: "ignore"
+      }).unref();
+    }
+  } catch {
+  }
+}
+function formatArgs(args) {
+  if (args === null || args === void 0) return "(none)";
+  if (typeof args !== "object" || Array.isArray(args)) {
+    const str = typeof args === "string" ? args : JSON.stringify(args);
+    return str.length > 200 ? str.slice(0, 200) + "\u2026" : str;
+  }
+  const entries = Object.entries(args).filter(
+    ([, v]) => v !== null && v !== void 0 && v !== ""
+  );
+  if (entries.length === 0) return "(none)";
+  const MAX_FIELDS = 5;
+  const MAX_VALUE_LEN = 120;
+  const lines = entries.slice(0, MAX_FIELDS).map(([key, val]) => {
+    const str = typeof val === "string" ? val : JSON.stringify(val);
+    const truncated = str.length > MAX_VALUE_LEN ? str.slice(0, MAX_VALUE_LEN) + "\u2026" : str;
+    return `  ${key}: ${truncated}`;
+  });
+  if (entries.length > MAX_FIELDS) {
+    lines.push(`  \u2026 and ${entries.length - MAX_FIELDS} more field(s)`);
+  }
+  return lines.join("\n");
+}
+async function askNativePopup(toolName, args, agent, explainableLabel, locked = false, signal) {
+  if (isTestEnv()) return "deny";
+  if (process.env.NODE9_DEBUG === "1" || process.env.VITEST) {
+    console.log(`[DEBUG Native] askNativePopup called for: ${toolName}`);
+    console.log(`[DEBUG Native] isTestEnv check:`, {
+      VITEST: process.env.VITEST,
+      NODE_ENV: process.env.NODE_ENV,
+      CI: process.env.CI,
+      isTest: isTestEnv()
+    });
+  }
+  const title = locked ? `\u26A1 Node9 \u2014 Locked by Admin Policy` : `\u{1F6E1}\uFE0F Node9 \u2014 Action Requires Approval`;
+  let message = "";
+  if (locked) {
+    message += `\u26A1 Awaiting remote approval via Slack. Local override is disabled.
+`;
+    message += `\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+`;
+  }
+  message += `Tool:    ${toolName}
+`;
+  message += `Agent:   ${agent || "AI Agent"}
+`;
+  if (explainableLabel) {
+    message += `Reason:  ${explainableLabel}
+`;
+  }
+  message += `
+Arguments:
+${formatArgs(args)}`;
+  if (!locked) {
+    message += `
+
+Enter = Allow  |  Click "Block" to deny`;
+  }
+  const safeMessage = message.replace(/\\/g, "\\\\").replace(/"/g, '\\"').replace(/`/g, "'");
+  const safeTitle = title.replace(/"/g, '\\"');
+  return new Promise((resolve) => {
+    let childProcess = null;
+    const onAbort = () => {
+      if (childProcess) {
+        try {
+          process.kill(childProcess.pid, "SIGKILL");
+        } catch {
+        }
+      }
+      resolve("deny");
+    };
+    if (signal) {
+      if (signal.aborted) return resolve("deny");
+      signal.addEventListener("abort", onAbort);
+    }
+    const cleanup = () => {
+      if (signal) signal.removeEventListener("abort", onAbort);
+    };
+    try {
+      if (process.platform === "darwin") {
+        const buttons = locked ? `buttons {"Waiting\u2026"} default button "Waiting\u2026"` : `buttons {"Block", "Always Allow", "Allow"} default button "Allow" cancel button "Block"`;
+        const script = `
+          tell application "System Events"
+            activate
+            display dialog "${safeMessage}" with title "${safeTitle}" ${buttons}
+          end tell`;
+        childProcess = spawn("osascript", ["-e", script]);
+        let output = "";
+        childProcess.stdout?.on("data", (d) => output += d.toString());
+        childProcess.on("close", (code) => {
+          cleanup();
+          if (locked) return resolve("deny");
+          if (code === 0) {
+            if (output.includes("Always Allow")) return resolve("always_allow");
+            if (output.includes("Allow")) return resolve("allow");
+          }
+          resolve("deny");
+        });
+      } else if (process.platform === "linux") {
+        const argsList = locked ? [
+          "--info",
+          "--title",
+          title,
+          "--text",
+          safeMessage,
+          "--ok-label",
+          "Waiting for Slack\u2026",
+          "--timeout",
+          "300"
+        ] : [
+          "--question",
+          "--title",
+          title,
+          "--text",
+          safeMessage,
+          "--ok-label",
+          "Allow",
+          "--cancel-label",
+          "Block",
+          "--extra-button",
+          "Always Allow",
+          "--timeout",
+          "300"
+        ];
+        childProcess = spawn("zenity", argsList);
+        let output = "";
+        childProcess.stdout?.on("data", (d) => output += d.toString());
+        childProcess.on("close", (code) => {
+          cleanup();
+          if (locked) return resolve("deny");
+          if (output.trim() === "Always Allow") return resolve("always_allow");
+          if (code === 0) return resolve("allow");
+          resolve("deny");
+        });
+      } else if (process.platform === "win32") {
+        const buttonType = locked ? "OK" : "YesNo";
+        const ps = `
+          Add-Type -AssemblyName PresentationFramework;
+          $res = [System.Windows.MessageBox]::Show("${safeMessage}", "${safeTitle}", "${buttonType}", "Warning", "Button2", "DefaultDesktopOnly");
+          if ($res -eq "Yes") { exit 0 } else { exit 1 }`;
+        childProcess = spawn("powershell", ["-Command", ps]);
+        childProcess.on("close", (code) => {
+          cleanup();
+          if (locked) return resolve("deny");
+          resolve(code === 0 ? "allow" : "deny");
+        });
+      } else {
+        cleanup();
+        resolve("deny");
+      }
+    } catch {
+      cleanup();
+      resolve("deny");
+    }
+  });
+}
+
+// src/core.ts
+var PAUSED_FILE = path.join(os.homedir(), ".node9", "PAUSED");
+var TRUST_FILE = path.join(os.homedir(), ".node9", "trust.json");
+function checkPause() {
+  try {
+    if (!fs.existsSync(PAUSED_FILE)) return { paused: false };
+    const state = JSON.parse(fs.readFileSync(PAUSED_FILE, "utf-8"));
+    if (state.expiry > 0 && Date.now() >= state.expiry) {
+      try {
+        fs.unlinkSync(PAUSED_FILE);
+      } catch {
+      }
+      return { paused: false };
+    }
+    return { paused: true, expiresAt: state.expiry, duration: state.duration };
+  } catch {
+    return { paused: false };
+  }
+}
+function atomicWriteSync(filePath, data, options) {
+  const dir = path.dirname(filePath);
+  if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true });
+  const tmpPath = `${filePath}.${os.hostname()}.${process.pid}.tmp`;
+  fs.writeFileSync(tmpPath, data, options);
+  fs.renameSync(tmpPath, filePath);
+}
+function pauseNode9(durationMs, durationStr) {
+  const state = { expiry: Date.now() + durationMs, duration: durationStr };
+  atomicWriteSync(PAUSED_FILE, JSON.stringify(state, null, 2));
+}
+function resumeNode9() {
+  try {
+    if (fs.existsSync(PAUSED_FILE)) fs.unlinkSync(PAUSED_FILE);
+  } catch {
+  }
+}
+function getActiveTrustSession(toolName) {
+  try {
+    if (!fs.existsSync(TRUST_FILE)) return false;
+    const trust = JSON.parse(fs.readFileSync(TRUST_FILE, "utf-8"));
+    const now = Date.now();
+    const active = trust.entries.filter((e) => e.expiry > now);
+    if (active.length !== trust.entries.length) {
+      fs.writeFileSync(TRUST_FILE, JSON.stringify({ entries: active }, null, 2));
+    }
+    return active.some((e) => e.tool === toolName || matchesPattern(toolName, e.tool));
+  } catch {
+    return false;
+  }
+}
+function writeTrustSession(toolName, durationMs) {
+  try {
+    let trust = { entries: [] };
+    try {
+      if (fs.existsSync(TRUST_FILE)) {
+        trust = JSON.parse(fs.readFileSync(TRUST_FILE, "utf-8"));
+      }
+    } catch {
+    }
+    const now = Date.now();
+    trust.entries = trust.entries.filter((e) => e.tool !== toolName && e.expiry > now);
+    trust.entries.push({ tool: toolName, expiry: now + durationMs });
+    atomicWriteSync(TRUST_FILE, JSON.stringify(trust, null, 2));
+  } catch (err) {
+    if (process.env.NODE9_DEBUG === "1") {
+      console.error("[Node9 Trust Error]:", err);
+    }
+  }
+}
+function appendAuditModeEntry(toolName, args) {
+  try {
+    const entry = JSON.stringify({
+      ts: (/* @__PURE__ */ new Date()).toISOString(),
+      tool: toolName,
+      args,
+      decision: "would-have-blocked",
+      source: "audit-mode"
+    });
+    const logPath = path.join(os.homedir(), ".node9", "audit.log");
+    const dir = path.dirname(logPath);
+    if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true });
+    fs.appendFileSync(logPath, entry + "\n");
+  } catch {
+  }
+}
 var DANGEROUS_WORDS = [
   "delete",
   "drop",
@@ -28,10 +292,6 @@ var DANGEROUS_WORDS = [
 function tokenize(toolName) {
   return toolName.toLowerCase().split(/[_.\-\s]+/).filter(Boolean);
 }
-function containsDangerousWord(toolName, dangerousWords) {
-  const tokens = tokenize(toolName);
-  return dangerousWords.some((word) => tokens.includes(word.toLowerCase()));
-}
 function matchesPattern(text, patterns) {
   const p = Array.isArray(patterns) ? patterns : [patterns];
   if (p.length === 0) return false;
@@ -42,9 +302,9 @@ function matchesPattern(text, patterns) {
   const withoutDotSlash = text.replace(/^\.\//, "");
   return isMatch(withoutDotSlash) || isMatch(`./${withoutDotSlash}`);
 }
-function getNestedValue(obj, path5) {
+function getNestedValue(obj, path6) {
   if (!obj || typeof obj !== "object") return null;
-  return path5.split(".").reduce((prev, curr) => prev?.[curr], obj);
+  return path6.split(".").reduce((prev, curr) => prev?.[curr], obj);
 }
 function extractShellCommand(toolName, args, toolInspection) {
   const patterns = Object.keys(toolInspection);
@@ -136,8 +396,15 @@ function redactSecrets(text) {
   return redacted;
 }
 var DEFAULT_CONFIG = {
-  settings: { mode: "standard" },
+  settings: {
+    mode: "standard",
+    autoStartDaemon: true,
+    enableUndo: false,
+    enableHookLogDebug: false,
+    approvers: { native: true, browser: true, cloud: true, terminal: true }
+  },
   policy: {
+    sandboxPaths: [],
     dangerousWords: DANGEROUS_WORDS,
     ignoredTools: [
       "list_*",
@@ -145,34 +412,19 @@ var DEFAULT_CONFIG = {
       "read_*",
       "describe_*",
       "read",
-      "write",
-      "edit",
-      "multiedit",
-      "glob",
       "grep",
       "ls",
-      "notebookread",
-      "notebookedit",
-      "todoread",
-      "todowrite",
-      "webfetch",
-      "websearch",
-      "exitplanmode",
       "askuserquestion"
     ],
-    toolInspection: {
-      bash: "command",
-      run_shell_command: "command",
-      shell: "command",
-      "terminal.execute": "command"
-    },
-    rules: [
-      { action: "rm", allowPaths: ["**/node_modules/**", "dist/**", "build/**", ".DS_Store"] }
-    ]
+    toolInspection: { bash: "command", shell: "command" },
+    rules: [{ action: "rm", allowPaths: ["**/node_modules/**", "dist/**", ".DS_Store"] }]
   },
   environments: {}
 };
 var cachedConfig = null;
+function _resetConfigCache() {
+  cachedConfig = null;
+}
 function getGlobalSettings() {
   try {
     const globalConfigPath = path.join(os.homedir(), ".node9", "config.json");
@@ -183,18 +435,19 @@ function getGlobalSettings() {
         mode: settings.mode || "standard",
         autoStartDaemon: settings.autoStartDaemon !== false,
         slackEnabled: settings.slackEnabled !== false,
-        // agentMode defaults to false — user must explicitly opt in via `node9 login`
-        agentMode: settings.agentMode === true
+        enableTrustSessions: settings.enableTrustSessions === true,
+        allowGlobalPause: settings.allowGlobalPause !== false
       };
     }
   } catch {
   }
-  return { mode: "standard", autoStartDaemon: true, slackEnabled: true, agentMode: false };
-}
-function hasSlack() {
-  const creds = getCredentials();
-  if (!creds?.apiKey) return false;
-  return getGlobalSettings().slackEnabled;
+  return {
+    mode: "standard",
+    autoStartDaemon: true,
+    slackEnabled: true,
+    enableTrustSessions: false,
+    allowGlobalPause: true
+  };
 }
 function getInternalToken() {
   try {
@@ -207,51 +460,83 @@ function getInternalToken() {
     return null;
   }
 }
-async function evaluatePolicy(toolName, args) {
+async function evaluatePolicy(toolName, args, agent) {
   const config = getConfig();
-  if (matchesPattern(toolName, config.policy.ignoredTools)) return "allow";
+  if (matchesPattern(toolName, config.policy.ignoredTools)) return { decision: "allow" };
+  let allTokens = [];
+  let actionTokens = [];
+  let pathTokens = [];
   const shellCommand = extractShellCommand(toolName, args, config.policy.toolInspection);
   if (shellCommand) {
-    const { actions, paths, allTokens } = await analyzeShellCommand(shellCommand);
+    const analyzed = await analyzeShellCommand(shellCommand);
+    allTokens = analyzed.allTokens;
+    actionTokens = analyzed.actions;
+    pathTokens = analyzed.paths;
     const INLINE_EXEC_PATTERN = /^(python3?|bash|sh|zsh|perl|ruby|node|php|lua)\s+(-c|-e|-eval)\s/i;
-    if (INLINE_EXEC_PATTERN.test(shellCommand.trim())) return "review";
-    for (const action of actions) {
-      const basename = action.includes("/") ? action.split("/").pop() : action;
-      const rule = config.policy.rules.find(
-        (r) => r.action === action || matchesPattern(action, r.action) || basename && (r.action === basename || matchesPattern(basename, r.action))
-      );
-      if (rule) {
-        if (paths.length > 0) {
-          const anyBlocked = paths.some((p) => matchesPattern(p, rule.blockPaths || []));
-          if (anyBlocked) return "review";
-          const allAllowed = paths.every((p) => matchesPattern(p, rule.allowPaths || []));
-          if (allAllowed) return "allow";
-        }
-        return "review";
-      }
+    if (INLINE_EXEC_PATTERN.test(shellCommand.trim())) {
+      return { decision: "review", blockedByLabel: "Node9 Standard (Inline Execution)" };
     }
-    const isDangerous2 = allTokens.some(
-      (token) => config.policy.dangerousWords.some((word) => {
-        const w = word.toLowerCase();
-        if (token === w) return true;
-        try {
-          return new RegExp(`\\b${w}\\b`, "i").test(token);
-        } catch {
-          return false;
-        }
-      })
+  } else {
+    allTokens = tokenize(toolName);
+    actionTokens = [toolName];
+  }
+  const isManual = agent === "Terminal";
+  if (isManual) {
+    const NUCLEAR_COMMANDS = [
+      "drop",
+      "destroy",
+      "purge",
+      "rmdir",
+      "format",
+      "truncate",
+      "alter",
+      "grant",
+      "revoke",
+      "docker"
+    ];
+    const hasNuclear = allTokens.some((t) => NUCLEAR_COMMANDS.includes(t.toLowerCase()));
+    if (!hasNuclear) return { decision: "allow" };
+  }
+  if (pathTokens.length > 0 && config.policy.sandboxPaths.length > 0) {
+    const allInSandbox = pathTokens.every((p) => matchesPattern(p, config.policy.sandboxPaths));
+    if (allInSandbox) return { decision: "allow" };
+  }
+  for (const action of actionTokens) {
+    const rule = config.policy.rules.find(
+      (r) => r.action === action || matchesPattern(action, r.action)
     );
-    if (isDangerous2) return "review";
-    if (config.settings.mode === "strict") return "review";
-    return "allow";
+    if (rule) {
+      if (pathTokens.length > 0) {
+        const anyBlocked = pathTokens.some((p) => matchesPattern(p, rule.blockPaths || []));
+        if (anyBlocked)
+          return { decision: "review", blockedByLabel: "Project/Global Config (Rule Block)" };
+        const allAllowed = pathTokens.every((p) => matchesPattern(p, rule.allowPaths || []));
+        if (allAllowed) return { decision: "allow" };
+      }
+      return { decision: "review", blockedByLabel: "Project/Global Config (Rule Default Block)" };
+    }
   }
-  const isDangerous = containsDangerousWord(toolName, config.policy.dangerousWords);
-  if (isDangerous || config.settings.mode === "strict") {
+  const isDangerous = allTokens.some(
+    (token) => config.policy.dangerousWords.some((word) => {
+      const w = word.toLowerCase();
+      if (token === w) return true;
+      try {
+        return new RegExp(`\\b${w}\\b`, "i").test(token);
+      } catch {
+        return false;
+      }
+    })
+  );
+  if (isDangerous) {
+    const label = isManual ? "Manual Nuclear Protection" : "Project/Global Config (Dangerous Word)";
+    return { decision: "review", blockedByLabel: label };
+  }
+  if (config.settings.mode === "strict") {
     const envConfig = getActiveEnvironment(config);
-    if (envConfig?.requireApproval === false) return "allow";
-    return "review";
+    if (envConfig?.requireApproval === false) return { decision: "allow" };
+    return { decision: "review", blockedByLabel: "Global Config (Strict Mode Active)" };
   }
-  return "allow";
+  return { decision: "allow" };
 }
 function isIgnoredTool(toolName) {
   const config = getConfig();
@@ -282,22 +567,40 @@ function getPersistentDecision(toolName) {
   }
   return null;
 }
-async function askDaemon(toolName, args, meta) {
+async function askDaemon(toolName, args, meta, signal) {
   const base = `http://${DAEMON_HOST}:${DAEMON_PORT}`;
-  const checkRes = await fetch(`${base}/check`, {
-    method: "POST",
-    headers: { "Content-Type": "application/json" },
-    body: JSON.stringify({ toolName, args, agent: meta?.agent, mcpServer: meta?.mcpServer }),
-    signal: AbortSignal.timeout(5e3)
-  });
-  if (!checkRes.ok) throw new Error("Daemon fail");
-  const { id } = await checkRes.json();
-  const waitRes = await fetch(`${base}/wait/${id}`, { signal: AbortSignal.timeout(12e4) });
-  if (!waitRes.ok) return "deny";
-  const { decision } = await waitRes.json();
-  if (decision === "allow") return "allow";
-  if (decision === "abandoned") return "abandoned";
-  return "deny";
+  const checkCtrl = new AbortController();
+  const checkTimer = setTimeout(() => checkCtrl.abort(), 5e3);
+  const onAbort = () => checkCtrl.abort();
+  if (signal) signal.addEventListener("abort", onAbort);
+  try {
+    const checkRes = await fetch(`${base}/check`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ toolName, args, agent: meta?.agent, mcpServer: meta?.mcpServer }),
+      signal: checkCtrl.signal
+    });
+    if (!checkRes.ok) throw new Error("Daemon fail");
+    const { id } = await checkRes.json();
+    const waitCtrl = new AbortController();
+    const waitTimer = setTimeout(() => waitCtrl.abort(), 12e4);
+    const onWaitAbort = () => waitCtrl.abort();
+    if (signal) signal.addEventListener("abort", onWaitAbort);
+    try {
+      const waitRes = await fetch(`${base}/wait/${id}`, { signal: waitCtrl.signal });
+      if (!waitRes.ok) return "deny";
+      const { decision } = await waitRes.json();
+      if (decision === "allow") return "allow";
+      if (decision === "abandoned") return "abandoned";
+      return "deny";
+    } finally {
+      clearTimeout(waitTimer);
+      if (signal) signal.removeEventListener("abort", onWaitAbort);
+    }
+  } finally {
+    clearTimeout(checkTimer);
+    if (signal) signal.removeEventListener("abort", onAbort);
+  }
 }
 async function notifyDaemonViewer(toolName, args, meta) {
   const base = `http://${DAEMON_HOST}:${DAEMON_PORT}`;
@@ -327,176 +630,353 @@ async function resolveViaDaemon(id, decision, internalToken) {
   });
 }
 async function authorizeHeadless(toolName, args, allowTerminalFallback = false, meta) {
-  const { agentMode } = getGlobalSettings();
-  const cloudEnforced = agentMode && hasSlack();
-  if (!cloudEnforced) {
-    if (isIgnoredTool(toolName)) return { approved: true };
-    const policyDecision = await evaluatePolicy(toolName, args);
-    if (policyDecision === "allow") return { approved: true, checkedBy: "local-policy" };
+  if (process.env.NODE9_PAUSED === "1") return { approved: true, checkedBy: "paused" };
+  const pauseState = checkPause();
+  if (pauseState.paused) return { approved: true, checkedBy: "paused" };
+  const creds = getCredentials();
+  const config = getConfig();
+  const isTestEnv2 = !!(process.env.VITEST || process.env.NODE_ENV === "test" || process.env.CI || process.env.NODE9_TESTING === "1");
+  const approvers = {
+    ...config.settings.approvers || { native: true, browser: true, cloud: true, terminal: true }
+  };
+  if (isTestEnv2) {
+    approvers.native = false;
+    approvers.browser = false;
+    approvers.terminal = false;
+  }
+  const isManual = meta?.agent === "Terminal";
+  let explainableLabel = "Local Config";
+  if (config.settings.mode === "audit") {
+    if (!isIgnoredTool(toolName)) {
+      const policyResult = await evaluatePolicy(toolName, args, meta?.agent);
+      if (policyResult.decision === "review") {
+        appendAuditModeEntry(toolName, args);
+        sendDesktopNotification(
+          "Node9 Audit Mode",
+          `Would have blocked "${toolName}" (${policyResult.blockedByLabel || "Local Config"}) \u2014 running in audit mode`
+        );
+      }
+    }
+    return { approved: true, checkedBy: "audit" };
+  }
+  if (!isIgnoredTool(toolName)) {
+    if (getActiveTrustSession(toolName)) {
+      if (creds?.apiKey) auditLocalAllow(toolName, args, "trust", creds, meta);
+      return { approved: true, checkedBy: "trust" };
+    }
+    const policyResult = await evaluatePolicy(toolName, args, meta?.agent);
+    if (policyResult.decision === "allow") {
+      if (creds?.apiKey) auditLocalAllow(toolName, args, "local-policy", creds, meta);
+      return { approved: true, checkedBy: "local-policy" };
+    }
+    explainableLabel = policyResult.blockedByLabel || "Local Config";
     const persistent = getPersistentDecision(toolName);
-    if (persistent === "allow") return { approved: true, checkedBy: "persistent" };
-    if (persistent === "deny")
+    if (persistent === "allow") {
+      if (creds?.apiKey) auditLocalAllow(toolName, args, "persistent", creds, meta);
+      return { approved: true, checkedBy: "persistent" };
+    }
+    if (persistent === "deny") {
       return {
         approved: false,
-        reason: `Node9: "${toolName}" is set to always deny.`,
+        reason: `This tool ("${toolName}") is explicitly listed in your 'Always Deny' list.`,
         blockedBy: "persistent-deny",
-        changeHint: `Open the daemon UI to manage decisions:  node9 daemon --openui`
+        blockedByLabel: "Persistent User Rule"
       };
-  }
-  if (cloudEnforced) {
-    const creds = getCredentials();
-    const envConfig = getActiveEnvironment(getConfig());
-    let viewerId = null;
-    const internalToken = getInternalToken();
-    if (isDaemonRunning() && internalToken) {
-      viewerId = await notifyDaemonViewer(toolName, args, meta).catch(() => null);
     }
-    const approved = await callNode9SaaS(toolName, args, creds, envConfig?.slackChannel, meta);
-    if (viewerId && internalToken) {
-      resolveViaDaemon(viewerId, approved ? "allow" : "deny", internalToken).catch(() => null);
-    }
-    return {
-      approved,
-      checkedBy: approved ? "cloud" : void 0,
-      blockedBy: approved ? void 0 : "team-policy",
-      changeHint: approved ? void 0 : `Visit your Node9 dashboard \u2192 Policy Studio to change this rule`
-    };
+  } else {
+    if (creds?.apiKey) auditLocalAllow(toolName, args, "ignoredTools", creds, meta);
+    return { approved: true };
   }
-  if (isDaemonRunning()) {
-    console.error(chalk.yellow("\n\u{1F6E1}\uFE0F  Node9: Action suspended \u2014 waiting for your approval."));
-    console.error(chalk.cyan(`   Browser UI \u2192 http://${DAEMON_HOST}:${DAEMON_PORT}/
-`));
+  let cloudRequestId = null;
+  let isRemoteLocked = false;
+  const cloudEnforced = approvers.cloud && !!creds?.apiKey;
+  if (cloudEnforced) {
     try {
-      const daemonDecision = await askDaemon(toolName, args, meta);
-      if (daemonDecision === "abandoned") {
-        console.error(chalk.yellow("\n\u26A0\uFE0F  Browser closed without a decision. Falling back..."));
-      } else {
+      const envConfig = getActiveEnvironment(getConfig());
+      const initResult = await initNode9SaaS(toolName, args, creds, envConfig?.slackChannel, meta);
+      if (!initResult.pending) {
         return {
-          approved: daemonDecision === "allow",
-          reason: daemonDecision === "deny" ? `Node9 blocked "${toolName}" \u2014 denied in browser.` : void 0,
-          checkedBy: daemonDecision === "allow" ? "daemon" : void 0,
-          blockedBy: daemonDecision === "deny" ? "local-decision" : void 0,
-          changeHint: daemonDecision === "deny" ? `Open the daemon UI to change:  node9 daemon --openui` : void 0
+          approved: !!initResult.approved,
+          reason: initResult.reason || (initResult.approved ? void 0 : "Action rejected by organization policy."),
+          checkedBy: initResult.approved ? "cloud" : void 0,
+          blockedBy: initResult.approved ? void 0 : "team-policy",
+          blockedByLabel: "Organization Policy (SaaS)"
         };
       }
-    } catch {
+      cloudRequestId = initResult.requestId || null;
+      isRemoteLocked = !!initResult.remoteApprovalOnly;
+      explainableLabel = "Organization Policy (SaaS)";
+    } catch (err) {
+      const error = err;
+      const isAuthError = error.message.includes("401") || error.message.includes("403");
+      const isNetworkError = error.message.includes("fetch") || error.name === "AbortError" || error.message.includes("ECONNREFUSED");
+      const reason = isAuthError ? "Invalid or missing API key. Run `node9 login` to generate a key (must start with n9_live_)." : isNetworkError ? "Could not reach the Node9 cloud. Check your network or API URL." : error.message;
+      console.error(
+        chalk.yellow(`
+\u26A0\uFE0F  Node9: Cloud API Handshake failed \u2014 ${reason}`) + chalk.dim(`
+   Falling back to local rules...
+`)
+      );
     }
   }
-  if (allowTerminalFallback && process.stdout.isTTY) {
-    console.log(chalk.bgRed.white.bold(` \u{1F6D1} NODE9 INTERCEPTOR `));
-    console.log(`${chalk.bold("Action:")} ${chalk.red(toolName)}`);
-    const argsPreview = JSON.stringify(args, null, 2);
-    console.log(
-      `${chalk.bold("Args:")}
-${chalk.gray(argsPreview.length > 500 ? argsPreview.slice(0, 500) + "..." : argsPreview)}`
+  if (cloudEnforced && cloudRequestId) {
+    console.error(
+      chalk.yellow("\n\u{1F6E1}\uFE0F  Node9: Action suspended \u2014 waiting for Organization approval.")
+    );
+    console.error(chalk.cyan("   Dashboard  \u2192 ") + chalk.bold("Mission Control > Activity Feed\n"));
+  } else if (!cloudEnforced) {
+    const cloudOffReason = !creds?.apiKey ? "no API key \u2014 run `node9 login` to connect" : "privacy mode (cloud disabled)";
+    console.error(
+      chalk.dim(`
+\u{1F6E1}\uFE0F  Node9: intercepted "${toolName}" \u2014 cloud off (${cloudOffReason})
+`)
     );
-    const controller = new AbortController();
-    const TIMEOUT_MS = 3e4;
-    const timer = setTimeout(() => controller.abort(), TIMEOUT_MS);
-    try {
-      const approved = await confirm(
-        { message: `Authorize? (auto-deny in ${TIMEOUT_MS / 1e3}s)`, default: false },
-        { signal: controller.signal }
-      );
-      clearTimeout(timer);
-      return { approved };
-    } catch {
-      clearTimeout(timer);
-      console.error(chalk.yellow("\n\u23F1  Prompt timed out \u2014 action denied by default."));
-      return { approved: false };
-    }
   }
-  return {
-    approved: false,
-    noApprovalMechanism: true,
-    reason: `Node9 blocked "${toolName}". No approval mechanism is active.`,
-    blockedBy: "no-approval-mechanism",
-    changeHint: `Start the approval daemon:  node9 daemon --background
-   Or connect to your team:   node9 login <apiKey>`
-  };
-}
-function listCredentialProfiles() {
-  try {
-    const credPath = path.join(os.homedir(), ".node9", "credentials.json");
-    if (!fs.existsSync(credPath)) return [];
-    const creds = JSON.parse(fs.readFileSync(credPath, "utf-8"));
-    if (!creds.apiKey) return Object.keys(creds).filter((k) => typeof creds[k] === "object");
-  } catch {
+  const abortController = new AbortController();
+  const { signal } = abortController;
+  const racePromises = [];
+  let viewerId = null;
+  const internalToken = getInternalToken();
+  if (cloudEnforced && cloudRequestId) {
+    racePromises.push(
+      (async () => {
+        try {
+          if (isDaemonRunning() && internalToken) {
+            viewerId = await notifyDaemonViewer(toolName, args, meta).catch(() => null);
+          }
+          const cloudResult = await pollNode9SaaS(cloudRequestId, creds, signal);
+          return {
+            approved: cloudResult.approved,
+            reason: cloudResult.approved ? void 0 : cloudResult.reason || "Action rejected by organization administrator via Slack.",
+            checkedBy: cloudResult.approved ? "cloud" : void 0,
+            blockedBy: cloudResult.approved ? void 0 : "team-policy",
+            blockedByLabel: "Organization Policy (SaaS)"
+          };
+        } catch (err) {
+          const error = err;
+          if (error.name === "AbortError" || error.message?.includes("Aborted")) throw err;
+          throw err;
+        }
+      })()
+    );
+  }
+  if (approvers.native && !isManual) {
+    racePromises.push(
+      (async () => {
+        const decision = await askNativePopup(
+          toolName,
+          args,
+          meta?.agent,
+          explainableLabel,
+          isRemoteLocked,
+          signal
+        );
+        if (decision === "always_allow") {
+          writeTrustSession(toolName, 36e5);
+          return { approved: true, checkedBy: "trust" };
+        }
+        const isApproved = decision === "allow";
+        return {
+          approved: isApproved,
+          reason: isApproved ? void 0 : "The human user clicked 'Block' on the system dialog window.",
+          checkedBy: isApproved ? "daemon" : void 0,
+          blockedBy: isApproved ? void 0 : "local-decision",
+          blockedByLabel: "User Decision (Native)"
+        };
+      })()
+    );
+  }
+  if (approvers.browser && isDaemonRunning()) {
+    racePromises.push(
+      (async () => {
+        try {
+          if (!approvers.native && !cloudEnforced) {
+            console.error(
+              chalk.yellow("\n\u{1F6E1}\uFE0F  Node9: Action suspended \u2014 waiting for browser approval.")
+            );
+            console.error(chalk.cyan(`   URL \u2192 http://${DAEMON_HOST}:${DAEMON_PORT}/
+`));
+          }
+          const daemonDecision = await askDaemon(toolName, args, meta, signal);
+          if (daemonDecision === "abandoned") throw new Error("Abandoned");
+          const isApproved = daemonDecision === "allow";
+          return {
+            approved: isApproved,
+            reason: isApproved ? void 0 : "The human user rejected this action via the Node9 Browser Dashboard.",
+            checkedBy: isApproved ? "daemon" : void 0,
+            blockedBy: isApproved ? void 0 : "local-decision",
+            blockedByLabel: "User Decision (Browser)"
+          };
+        } catch (err) {
+          throw err;
+        }
+      })()
+    );
+  }
+  if (approvers.terminal && allowTerminalFallback && process.stdout.isTTY) {
+    racePromises.push(
+      (async () => {
+        try {
+          console.log(chalk.bgRed.white.bold(` \u{1F6D1} NODE9 INTERCEPTOR `));
+          console.log(`${chalk.bold("Action:")} ${chalk.red(toolName)}`);
+          console.log(`${chalk.bold("Flagged By:")} ${chalk.yellow(explainableLabel)}`);
+          if (isRemoteLocked) {
+            console.log(chalk.yellow(`\u26A1 LOCKED BY ADMIN POLICY: Waiting for Slack Approval...
+`));
+            await new Promise((_, reject) => {
+              signal.addEventListener("abort", () => reject(new Error("Aborted by SaaS")));
+            });
+          }
+          const TIMEOUT_MS = 6e4;
+          let timer;
+          const result = await new Promise((resolve, reject) => {
+            timer = setTimeout(() => reject(new Error("Terminal Timeout")), TIMEOUT_MS);
+            confirm(
+              { message: `Authorize? (auto-deny in ${TIMEOUT_MS / 1e3}s)`, default: false },
+              { signal }
+            ).then(resolve).catch(reject);
+          });
+          clearTimeout(timer);
+          return {
+            approved: result,
+            reason: result ? void 0 : "The human user typed 'N' in the terminal to reject this action.",
+            checkedBy: result ? "terminal" : void 0,
+            blockedBy: result ? void 0 : "local-decision",
+            blockedByLabel: "User Decision (Terminal)"
+          };
+        } catch (err) {
+          const error = err;
+          if (error.name === "AbortError" || error.message?.includes("Prompt was canceled") || error.message?.includes("Aborted by SaaS"))
+            throw err;
+          if (error.message === "Terminal Timeout") {
+            return {
+              approved: false,
+              reason: "The terminal prompt timed out without a human response.",
+              blockedBy: "local-decision"
+            };
+          }
+          throw err;
+        }
+      })()
+    );
+  }
+  if (racePromises.length === 0) {
+    return {
+      approved: false,
+      noApprovalMechanism: true,
+      reason: `NODE9 SECURITY INTERVENTION: Action blocked by automated policy [${explainableLabel}].
+REASON: Action blocked because no approval channels are available. (Native/Browser UI is disabled in config, and this terminal is non-interactive).`,
+      blockedBy: "no-approval-mechanism",
+      blockedByLabel: explainableLabel
+    };
   }
-  return [];
+  const finalResult = await new Promise((resolve) => {
+    let resolved = false;
+    let failures = 0;
+    const total = racePromises.length;
+    const finish = (res) => {
+      if (!resolved) {
+        resolved = true;
+        abortController.abort();
+        if (viewerId && internalToken) {
+          resolveViaDaemon(viewerId, res.approved ? "allow" : "deny", internalToken).catch(
+            () => null
+          );
+        }
+        resolve(res);
+      }
+    };
+    for (const p of racePromises) {
+      p.then(finish).catch((err) => {
+        if (err.name === "AbortError" || err.message?.includes("canceled") || err.message?.includes("Aborted"))
+          return;
+        if (err.message === "Abandoned") {
+          finish({
+            approved: false,
+            reason: "Browser dashboard closed without making a decision.",
+            blockedBy: "local-decision",
+            blockedByLabel: "Browser Dashboard (Abandoned)"
+          });
+          return;
+        }
+        failures++;
+        if (failures === total && !resolved) {
+          finish({ approved: false, reason: "All approval channels failed or disconnected." });
+        }
+      });
+    }
+  });
+  if (cloudRequestId && creds && finalResult.checkedBy !== "cloud") {
+    await resolveNode9SaaS(cloudRequestId, creds, finalResult.approved);
+  }
+  return finalResult;
 }
 function getConfig() {
   if (cachedConfig) return cachedConfig;
-  const projectConfig = tryLoadConfig(path.join(process.cwd(), "node9.config.json"));
-  if (projectConfig) {
-    cachedConfig = buildConfig(projectConfig);
-    return cachedConfig;
-  }
-  const globalConfig = tryLoadConfig(path.join(os.homedir(), ".node9", "config.json"));
-  if (globalConfig) {
-    cachedConfig = buildConfig(globalConfig);
-    return cachedConfig;
-  }
-  cachedConfig = DEFAULT_CONFIG;
+  const globalPath = path.join(os.homedir(), ".node9", "config.json");
+  const projectPath = path.join(process.cwd(), "node9.config.json");
+  const globalConfig = tryLoadConfig(globalPath);
+  const projectConfig = tryLoadConfig(projectPath);
+  const mergedSettings = {
+    ...DEFAULT_CONFIG.settings,
+    approvers: { ...DEFAULT_CONFIG.settings.approvers }
+  };
+  const mergedPolicy = {
+    sandboxPaths: [...DEFAULT_CONFIG.policy.sandboxPaths],
+    dangerousWords: [...DEFAULT_CONFIG.policy.dangerousWords],
+    ignoredTools: [...DEFAULT_CONFIG.policy.ignoredTools],
+    toolInspection: { ...DEFAULT_CONFIG.policy.toolInspection },
+    rules: [...DEFAULT_CONFIG.policy.rules]
+  };
+  const applyLayer = (source) => {
+    if (!source) return;
+    const s = source.settings || {};
+    const p = source.policy || {};
+    if (s.mode !== void 0) mergedSettings.mode = s.mode;
+    if (s.autoStartDaemon !== void 0) mergedSettings.autoStartDaemon = s.autoStartDaemon;
+    if (s.enableUndo !== void 0) mergedSettings.enableUndo = s.enableUndo;
+    if (s.enableHookLogDebug !== void 0)
+      mergedSettings.enableHookLogDebug = s.enableHookLogDebug;
+    if (s.approvers) mergedSettings.approvers = { ...mergedSettings.approvers, ...s.approvers };
+    if (p.sandboxPaths) mergedPolicy.sandboxPaths.push(...p.sandboxPaths);
+    if (p.dangerousWords) mergedPolicy.dangerousWords = [...p.dangerousWords];
+    if (p.ignoredTools) mergedPolicy.ignoredTools.push(...p.ignoredTools);
+    if (p.toolInspection)
+      mergedPolicy.toolInspection = { ...mergedPolicy.toolInspection, ...p.toolInspection };
+    if (p.rules) mergedPolicy.rules.push(...p.rules);
+  };
+  applyLayer(globalConfig);
+  applyLayer(projectConfig);
+  if (process.env.NODE9_MODE) mergedSettings.mode = process.env.NODE9_MODE;
+  mergedPolicy.sandboxPaths = [...new Set(mergedPolicy.sandboxPaths)];
+  mergedPolicy.dangerousWords = [...new Set(mergedPolicy.dangerousWords)];
+  mergedPolicy.ignoredTools = [...new Set(mergedPolicy.ignoredTools)];
+  cachedConfig = {
+    settings: mergedSettings,
+    policy: mergedPolicy,
+    environments: {}
+  };
   return cachedConfig;
 }
 function tryLoadConfig(filePath) {
   if (!fs.existsSync(filePath)) return null;
   try {
-    const config = JSON.parse(fs.readFileSync(filePath, "utf-8"));
-    validateConfig(config, filePath);
-    return config;
+    return JSON.parse(fs.readFileSync(filePath, "utf-8"));
   } catch {
     return null;
   }
 }
-function validateConfig(config, path5) {
-  const allowedTopLevel = ["version", "settings", "policy", "environments", "apiKey", "apiUrl"];
-  Object.keys(config).forEach((key) => {
-    if (!allowedTopLevel.includes(key))
-      console.warn(chalk.yellow(`\u26A0\uFE0F  Node9: Unknown top-level key "${key}" in ${path5}`));
-  });
-}
-function buildConfig(parsed) {
-  const p = parsed.policy || {};
-  const s = parsed.settings || {};
-  return {
-    settings: {
-      mode: s.mode ?? DEFAULT_CONFIG.settings.mode,
-      autoStartDaemon: s.autoStartDaemon ?? DEFAULT_CONFIG.settings.autoStartDaemon
-    },
-    policy: {
-      dangerousWords: p.dangerousWords ?? DEFAULT_CONFIG.policy.dangerousWords,
-      ignoredTools: p.ignoredTools ?? DEFAULT_CONFIG.policy.ignoredTools,
-      toolInspection: p.toolInspection ?? DEFAULT_CONFIG.policy.toolInspection,
-      rules: p.rules ?? DEFAULT_CONFIG.policy.rules
-    },
-    environments: parsed.environments || {}
-  };
-}
 function getActiveEnvironment(config) {
   const env = process.env.NODE_ENV || "development";
   return config.environments[env] ?? null;
 }
 function getCredentials() {
   const DEFAULT_API_URL = "https://api.node9.ai/api/v1/intercept";
-  if (process.env.NODE9_API_KEY)
+  if (process.env.NODE9_API_KEY) {
     return {
       apiKey: process.env.NODE9_API_KEY,
       apiUrl: process.env.NODE9_API_URL || DEFAULT_API_URL
     };
-  try {
-    const projectConfigPath = path.join(process.cwd(), "node9.config.json");
-    if (fs.existsSync(projectConfigPath)) {
-      const projectConfig = JSON.parse(fs.readFileSync(projectConfigPath, "utf-8"));
-      if (typeof projectConfig.apiKey === "string" && projectConfig.apiKey) {
-        return {
-          apiKey: projectConfig.apiKey,
-          apiUrl: typeof projectConfig.apiUrl === "string" && projectConfig.apiUrl || DEFAULT_API_URL
-        };
-      }
-    }
-  } catch {
   }
   try {
     const credPath = path.join(os.homedir(), ".node9", "credentials.json");
@@ -521,14 +1001,32 @@ function getCredentials() {
   }
   return null;
 }
-async function authorizeAction(toolName, args) {
-  const result = await authorizeHeadless(toolName, args, true);
-  return result.approved;
+function auditLocalAllow(toolName, args, checkedBy, creds, meta) {
+  const controller = new AbortController();
+  setTimeout(() => controller.abort(), 5e3);
+  fetch(`${creds.apiUrl}/audit`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json", Authorization: `Bearer ${creds.apiKey}` },
+    body: JSON.stringify({
+      toolName,
+      args,
+      checkedBy,
+      context: {
+        agent: meta?.agent,
+        mcpServer: meta?.mcpServer,
+        hostname: os.hostname(),
+        cwd: process.cwd(),
+        platform: os.platform()
+      }
+    }),
+    signal: controller.signal
+  }).catch(() => {
+  });
 }
-async function callNode9SaaS(toolName, args, creds, slackChannel, meta) {
+async function initNode9SaaS(toolName, args, creds, slackChannel, meta) {
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), 1e4);
   try {
-    const controller = new AbortController();
-    const timeout = setTimeout(() => controller.abort(), 35e3);
     const response = await fetch(creds.apiUrl, {
       method: "POST",
       headers: { "Content-Type": "application/json", Authorization: `Bearer ${creds.apiKey}` },
@@ -546,46 +1044,55 @@ async function callNode9SaaS(toolName, args, creds, slackChannel, meta) {
       }),
       signal: controller.signal
     });
+    if (!response.ok) throw new Error(`HTTP ${response.status}`);
+    return await response.json();
+  } finally {
     clearTimeout(timeout);
-    if (!response.ok) throw new Error("API fail");
-    const data = await response.json();
-    if (!data.pending) return data.approved;
-    if (!data.requestId) return false;
-    const statusUrl = `${creds.apiUrl}/status/${data.requestId}`;
-    console.error(chalk.yellow("\n\u{1F6E1}\uFE0F  Node9: Action suspended \u2014 waiting for your approval."));
-    if (isDaemonRunning()) {
-      console.error(
-        chalk.cyan("   Browser UI \u2192 ") + chalk.bold(`http://${DAEMON_HOST}:${DAEMON_PORT}/`)
-      );
-    }
-    console.error(chalk.cyan("   Dashboard  \u2192 ") + chalk.bold("Mission Control > Flows"));
-    console.error(chalk.gray("   Agent is paused. Approve or deny to continue.\n"));
-    const POLL_INTERVAL_MS = 3e3;
-    const POLL_DEADLINE = Date.now() + 5 * 60 * 1e3;
-    while (Date.now() < POLL_DEADLINE) {
-      await new Promise((r) => setTimeout(r, POLL_INTERVAL_MS));
-      try {
-        const statusRes = await fetch(statusUrl, {
-          headers: { Authorization: `Bearer ${creds.apiKey}` },
-          signal: AbortSignal.timeout(5e3)
-        });
-        if (!statusRes.ok) continue;
-        const { status } = await statusRes.json();
-        if (status === "APPROVED") {
-          console.error(chalk.green("\u2705  Approved \u2014 continuing.\n"));
-          return true;
-        }
-        if (status === "DENIED" || status === "AUTO_BLOCKED" || status === "TIMED_OUT") {
-          console.error(chalk.red("\u274C  Denied \u2014 action blocked.\n"));
-          return false;
-        }
-      } catch {
+  }
+}
+async function pollNode9SaaS(requestId, creds, signal) {
+  const statusUrl = `${creds.apiUrl}/status/${requestId}`;
+  const POLL_INTERVAL_MS = 1e3;
+  const POLL_DEADLINE = Date.now() + 10 * 60 * 1e3;
+  while (Date.now() < POLL_DEADLINE) {
+    if (signal.aborted) throw new Error("Aborted");
+    await new Promise((r) => setTimeout(r, POLL_INTERVAL_MS));
+    try {
+      const pollCtrl = new AbortController();
+      const pollTimer = setTimeout(() => pollCtrl.abort(), 5e3);
+      const statusRes = await fetch(statusUrl, {
+        headers: { Authorization: `Bearer ${creds.apiKey}` },
+        signal: pollCtrl.signal
+      });
+      clearTimeout(pollTimer);
+      if (!statusRes.ok) continue;
+      const { status, reason } = await statusRes.json();
+      if (status === "APPROVED") {
+        console.error(chalk.green("\u2705  Approved via Cloud.\n"));
+        return { approved: true, reason };
+      }
+      if (status === "DENIED" || status === "AUTO_BLOCKED" || status === "TIMED_OUT") {
+        console.error(chalk.red("\u274C  Denied via Cloud.\n"));
+        return { approved: false, reason };
       }
+    } catch {
     }
-    console.error(chalk.yellow("\u23F1  Timed out waiting for approval \u2014 action blocked.\n"));
-    return false;
+  }
+  return { approved: false, reason: "Cloud approval timed out after 10 minutes." };
+}
+async function resolveNode9SaaS(requestId, creds, approved) {
+  try {
+    const resolveUrl = `${creds.apiUrl}/requests/${requestId}`;
+    const ctrl = new AbortController();
+    const timer = setTimeout(() => ctrl.abort(), 5e3);
+    await fetch(resolveUrl, {
+      method: "PATCH",
+      headers: { "Content-Type": "application/json", Authorization: `Bearer ${creds.apiKey}` },
+      body: JSON.stringify({ decision: approved ? "APPROVED" : "DENIED" }),
+      signal: ctrl.signal
+    });
+    clearTimeout(timer);
   } catch {
-    return false;
   }
 }
 
@@ -597,7 +1104,7 @@ import chalk2 from "chalk";
 import { confirm as confirm2 } from "@inquirer/prompts";
 function printDaemonTip() {
   console.log(
-    chalk2.cyan("\n   \u{1F4A1} Enable browser approvals (no API key needed):") + chalk2.green("  node9 daemon --background")
+    chalk2.cyan("\n   \u{1F4A1} Node9 will protect you automatically using Native OS popups.") + chalk2.white("\n      To view your history or manage persistent rules, run:") + chalk2.green("\n      node9 daemon --openui")
   );
 }
 function fullPathCommand(subcommand) {
@@ -648,7 +1155,7 @@ async function setupClaude() {
     if (!settings.hooks.PostToolUse) settings.hooks.PostToolUse = [];
     settings.hooks.PostToolUse.push({
       matcher: ".*",
-      hooks: [{ type: "command", command: fullPathCommand("log") }]
+      hooks: [{ type: "command", command: fullPathCommand("log"), timeout: 600 }]
     });
     console.log(chalk2.green("  \u2705 PostToolUse hook added \u2192 node9 log"));
     anythingChanged = true;
@@ -712,7 +1219,12 @@ async function setupGemini() {
     settings.hooks.BeforeTool.push({
       matcher: ".*",
       hooks: [
-        { name: "node9-check", type: "command", command: fullPathCommand("check"), timeout: 6e4 }
+        {
+          name: "node9-check",
+          type: "command",
+          command: fullPathCommand("check"),
+          timeout: 6e5
+        }
       ]
     });
     console.log(chalk2.green("  \u2705 BeforeTool hook added \u2192 node9 check"));
@@ -1109,6 +1621,27 @@ var ui_default = `<!doctype html>
         font-size: 12px;
         font-weight: 500;
       }
+      .btn-trust {
+        background: rgba(240, 136, 62, 0.1);
+        border: 1px solid rgba(240, 136, 62, 0.35);
+        color: var(--primary);
+        font-size: 12px;
+        font-weight: 600;
+      }
+      .btn-trust:hover:not(:disabled) {
+        background: rgba(240, 136, 62, 0.2);
+        filter: none;
+        transform: translateY(-1px);
+      }
+      .trust-row {
+        display: none;
+        grid-column: span 2;
+        grid-template-columns: 1fr 1fr;
+        gap: 8px;
+      }
+      .trust-row.show {
+        display: grid;
+      }
       button:hover:not(:disabled) {
         filter: brightness(1.15);
         transform: translateY(-1px);
@@ -1412,15 +1945,31 @@ var ui_default = `<!doctype html>
                 <span class="slider"></span>
               </label>
             </div>
+            <div class="setting-row">
+              <div class="setting-text">
+                <div class="setting-label">Trust Sessions</div>
+                <div class="setting-desc">
+                  Show "Trust 30m / 1h" buttons \u2014 allow a tool without interruption for a set time.
+                </div>
+              </div>
+              <label class="toggle">
+                <input
+                  type="checkbox"
+                  id="trustSessionsToggle"
+                  onchange="onTrustToggle(this.checked)"
+                />
+                <span class="slider"></span>
+              </label>
+            </div>
           </div>
 
           <div class="panel">
-            <div class="panel-title">\u{1F4AC} Slack Approvals</div>
+            <div class="panel-title">\u{1F4AC} Cloud Approvals</div>
             <div class="setting-row">
               <div class="setting-text">
-                <div class="setting-label">Enable Slack</div>
+                <div class="setting-label">Enable Cloud</div>
                 <div class="setting-desc">
-                  Use Slack as the approval authority when a key is saved.
+                  Use Cloud/Slack as the approval authority when a key is saved.
                 </div>
               </div>
               <label class="toggle">
@@ -1474,6 +2023,7 @@ var ui_default = `<!doctype html>
       const requests = new Set();
       let orgName = null;
       let autoDenyMs = 120000;
+      let trustEnabled = false;
 
       function highlightSyntax(code) {
         if (typeof code !== 'string') return esc(code);
@@ -1526,6 +2076,21 @@ var ui_default = `<!doctype html>
         }, 200);
       }
 
+      function sendTrust(id, duration) {
+        const card = document.getElementById('c-' + id);
+        if (card) card.style.opacity = '0.5';
+        fetch('/decision/' + id, {
+          method: 'POST',
+          headers: { 'Content-Type': 'application/json', 'X-Node9-Token': CSRF_TOKEN },
+          body: JSON.stringify({ decision: 'trust', trustDuration: duration }),
+        });
+        setTimeout(() => {
+          card?.remove();
+          requests.delete(id);
+          refresh();
+        }, 200);
+      }
+
       function addCard(req) {
         if (requests.has(req.id)) return;
         requests.add(req.id);
@@ -1545,6 +2110,7 @@ var ui_default = `<!doctype html>
         card.id = 'c-' + req.id;
         const agentLabel = req.agent ? esc(req.agent) : 'AI Agent';
         const mcpLabel = req.mcpServer ? esc(req.mcpServer) : null;
+        const dis = isSlack ? 'disabled' : '';
         card.innerHTML = \`
         <div class="source-row">
           <span class="agent-badge">\${agentLabel}</span>
@@ -1554,11 +2120,15 @@ var ui_default = `<!doctype html>
         \${isSlack ? '<div class="slack-indicator">\u26A1 Awaiting Slack approval \u2014 view only</div>' : ''}
         <span class="label">Input Payload</span>
         <pre>\${cmd}</pre>
-        <div class="actions">
-          <button class="btn-allow" onclick="sendDecision('\${req.id}','allow',false)" \${isSlack ? 'disabled' : ''}>Approve Execution</button>
-          <button class="btn-deny"  onclick="sendDecision('\${req.id}','deny',false)"  \${isSlack ? 'disabled' : ''}>Block Action</button>
-          <button class="btn-secondary" onclick="sendDecision('\${req.id}','allow',true)" \${isSlack ? 'disabled' : ''}>Always Allow</button>
-          <button class="btn-secondary" onclick="sendDecision('\${req.id}','deny',true)"  \${isSlack ? 'disabled' : ''}>Always Deny</button>
+        <div class="actions" id="act-\${req.id}">
+          <button class="btn-allow" onclick="sendDecision('\${req.id}','allow',false)" \${dis}>Approve Execution</button>
+          <button class="btn-deny"  onclick="sendDecision('\${req.id}','deny',false)"  \${dis}>Block Action</button>
+          <div class="trust-row\${trustEnabled ? ' show' : ''}" id="tr-\${req.id}">
+            <button class="btn-trust" onclick="sendTrust('\${req.id}','30m')" \${dis}>\u23F1 Trust 30m</button>
+            <button class="btn-trust" onclick="sendTrust('\${req.id}','1h')"  \${dis}>\u23F1 Trust 1h</button>
+          </div>
+          <button class="btn-secondary" onclick="sendDecision('\${req.id}','allow',true)" \${dis}>Always Allow</button>
+          <button class="btn-secondary" onclick="sendDecision('\${req.id}','deny',true)"  \${dis}>Always Deny</button>
         </div>
       \`;
         list.appendChild(card);
@@ -1590,8 +2160,10 @@ var ui_default = `<!doctype html>
           autoDenyMs = data.autoDenyMs;
           if (orgName) {
             const b = document.getElementById('cloudBadge');
-            b.innerText = orgName;
-            b.classList.add('online');
+            if (b) {
+              b.innerText = orgName;
+              b.classList.add('online');
+            }
           }
           data.requests.forEach(addCard);
         });
@@ -1621,6 +2193,14 @@ var ui_default = `<!doctype html>
         }).catch(() => {});
       }
 
+      function onTrustToggle(checked) {
+        trustEnabled = checked;
+        saveSetting('enableTrustSessions', checked);
+        document.querySelectorAll('[id^="tr-"]').forEach((el) => {
+          el.classList.toggle('show', checked);
+        });
+      }
+
       fetch('/settings')
         .then((r) => r.json())
         .then((s) => {
@@ -1633,6 +2213,13 @@ var ui_default = `<!doctype html>
           if (!s.autoStartDaemon && !s.autoStarted) {
             document.getElementById('warnBanner').classList.add('show');
           }
+          trustEnabled = !!s.enableTrustSessions;
+          const trustTog = document.getElementById('trustSessionsToggle');
+          if (trustTog) trustTog.checked = trustEnabled;
+          // Show/hide trust rows on any cards already rendered
+          document.querySelectorAll('[id^="tr-"]').forEach((el) => {
+            el.classList.toggle('show', trustEnabled);
+          });
         })
         .catch(() => {});
 
@@ -1742,7 +2329,7 @@ import http from "http";
 import fs3 from "fs";
 import path3 from "path";
 import os3 from "os";
-import { execSync } from "child_process";
+import { spawn as spawn2 } from "child_process";
 import { randomUUID } from "crypto";
 import chalk3 from "chalk";
 var DAEMON_PORT2 = 7391;
@@ -1753,6 +2340,33 @@ var DECISIONS_FILE = path3.join(homeDir, ".node9", "decisions.json");
 var GLOBAL_CONFIG_FILE = path3.join(homeDir, ".node9", "config.json");
 var CREDENTIALS_FILE = path3.join(homeDir, ".node9", "credentials.json");
 var AUDIT_LOG_FILE = path3.join(homeDir, ".node9", "audit.log");
+var TRUST_FILE2 = path3.join(homeDir, ".node9", "trust.json");
+function atomicWriteSync2(filePath, data, options) {
+  const dir = path3.dirname(filePath);
+  if (!fs3.existsSync(dir)) fs3.mkdirSync(dir, { recursive: true });
+  const tmpPath = `${filePath}.${randomUUID()}.tmp`;
+  fs3.writeFileSync(tmpPath, data, options);
+  fs3.renameSync(tmpPath, filePath);
+}
+function writeTrustEntry(toolName, durationMs) {
+  try {
+    let trust = { entries: [] };
+    try {
+      if (fs3.existsSync(TRUST_FILE2))
+        trust = JSON.parse(fs3.readFileSync(TRUST_FILE2, "utf-8"));
+    } catch {
+    }
+    trust.entries = trust.entries.filter((e) => e.tool !== toolName && e.expiry > Date.now());
+    trust.entries.push({ tool: toolName, expiry: Date.now() + durationMs });
+    atomicWriteSync2(TRUST_FILE2, JSON.stringify(trust, null, 2));
+  } catch {
+  }
+}
+var TRUST_DURATIONS = {
+  "30m": 30 * 6e4,
+  "1h": 60 * 6e4,
+  "2h": 2 * 60 * 6e4
+};
 var SECRET_KEY_RE = /password|secret|token|key|apikey|credential|auth/i;
 function redactArgs(value) {
   if (!value || typeof value !== "object") return value;
@@ -1765,10 +2379,16 @@ function redactArgs(value) {
 }
 function appendAuditLog(data) {
   try {
-    const entry = JSON.stringify({ ...data, args: redactArgs(data.args) }) + "\n";
+    const entry = {
+      ts: (/* @__PURE__ */ new Date()).toISOString(),
+      tool: data.toolName,
+      args: redactArgs(data.args),
+      decision: data.decision,
+      source: "daemon"
+    };
     const dir = path3.dirname(AUDIT_LOG_FILE);
     if (!fs3.existsSync(dir)) fs3.mkdirSync(dir, { recursive: true });
-    fs3.appendFileSync(AUDIT_LOG_FILE, entry);
+    fs3.appendFileSync(AUDIT_LOG_FILE, JSON.stringify(entry) + "\n");
   } catch {
   }
 }
@@ -1793,21 +2413,6 @@ function getOrgName() {
   return null;
 }
 var autoStarted = process.env.NODE9_AUTO_STARTED === "1";
-function readGlobalSettings() {
-  try {
-    if (fs3.existsSync(GLOBAL_CONFIG_FILE)) {
-      const config = JSON.parse(fs3.readFileSync(GLOBAL_CONFIG_FILE, "utf-8"));
-      const s = config?.settings ?? {};
-      return {
-        autoStartDaemon: s.autoStartDaemon !== false,
-        slackEnabled: s.slackEnabled !== false,
-        agentMode: s.agentMode === true
-      };
-    }
-  } catch {
-  }
-  return { autoStartDaemon: true, slackEnabled: true, agentMode: false };
-}
 function hasStoredSlackKey() {
   return fs3.existsSync(CREDENTIALS_FILE);
 }
@@ -1821,14 +2426,13 @@ function writeGlobalSetting(key, value) {
   }
   if (!config.settings || typeof config.settings !== "object") config.settings = {};
   config.settings[key] = value;
-  const dir = path3.dirname(GLOBAL_CONFIG_FILE);
-  if (!fs3.existsSync(dir)) fs3.mkdirSync(dir, { recursive: true });
-  fs3.writeFileSync(GLOBAL_CONFIG_FILE, JSON.stringify(config, null, 2), { mode: 384 });
+  atomicWriteSync2(GLOBAL_CONFIG_FILE, JSON.stringify(config, null, 2), { mode: 384 });
 }
 var pending = /* @__PURE__ */ new Map();
 var sseClients = /* @__PURE__ */ new Set();
 var abandonTimer = null;
 var daemonServer = null;
+var hadBrowserClient = false;
 function abandonPending() {
   abandonTimer = null;
   pending.forEach((entry, id) => {
@@ -1864,10 +2468,8 @@ data: ${JSON.stringify(data)}
 }
 function openBrowser(url) {
   try {
-    const opts = { stdio: "ignore" };
-    if (process.platform === "darwin") execSync(`open "${url}"`, opts);
-    else if (process.platform === "win32") execSync(`cmd /c start "" "${url}"`, opts);
-    else execSync(`xdg-open "${url}"`, opts);
+    const args = process.platform === "darwin" ? ["open", url] : process.platform === "win32" ? ["cmd", "/c", "start", "", url] : ["xdg-open", url];
+    spawn2(args[0], args.slice(1), { detached: true, stdio: "ignore" }).unref();
   } catch {
   }
 }
@@ -1889,11 +2491,9 @@ function readPersistentDecisions() {
 }
 function writePersistentDecision(toolName, decision) {
   try {
-    const dir = path3.dirname(DECISIONS_FILE);
-    if (!fs3.existsSync(dir)) fs3.mkdirSync(dir, { recursive: true });
     const decisions = readPersistentDecisions();
     decisions[toolName] = decision;
-    fs3.writeFileSync(DECISIONS_FILE, JSON.stringify(decisions, null, 2));
+    atomicWriteSync2(DECISIONS_FILE, JSON.stringify(decisions, null, 2));
     broadcast("decisions", decisions);
   } catch {
   }
@@ -1903,6 +2503,22 @@ function startDaemon() {
   const internalToken = randomUUID();
   const UI_HTML = UI_HTML_TEMPLATE.replace("{{CSRF_TOKEN}}", csrfToken);
   const validToken = (req) => req.headers["x-node9-token"] === csrfToken;
+  const IDLE_TIMEOUT_MS = 12 * 60 * 60 * 1e3;
+  let idleTimer;
+  function resetIdleTimer() {
+    if (idleTimer) clearTimeout(idleTimer);
+    idleTimer = setTimeout(() => {
+      if (autoStarted) {
+        try {
+          fs3.unlinkSync(DAEMON_PID_FILE);
+        } catch {
+        }
+      }
+      process.exit(0);
+    }, IDLE_TIMEOUT_MS);
+    idleTimer.unref();
+  }
+  resetIdleTimer();
   const server = http.createServer(async (req, res) => {
     const { pathname } = new URL(req.url || "/", `http://${req.headers.host}`);
     if (req.method === "GET" && pathname === "/") {
@@ -1919,6 +2535,7 @@ function startDaemon() {
         clearTimeout(abandonTimer);
         abandonTimer = null;
       }
+      hadBrowserClient = true;
       sseClients.add(res);
       res.write(
         `event: init
@@ -1945,12 +2562,13 @@ data: ${JSON.stringify(readPersistentDecisions())}
       return req.on("close", () => {
         sseClients.delete(res);
         if (sseClients.size === 0 && pending.size > 0) {
-          abandonTimer = setTimeout(abandonPending, 2e3);
+          abandonTimer = setTimeout(abandonPending, hadBrowserClient ? 1e4 : 15e3);
         }
       });
     }
     if (req.method === "POST" && pathname === "/check") {
       try {
+        resetIdleTimer();
         const body = await readBody(req);
         if (body.length > 65536) return res.writeHead(413).end();
         const { toolName, args, slackDelegated = false, agent, mcpServer } = JSON.parse(body);
@@ -1971,8 +2589,7 @@ data: ${JSON.stringify(readPersistentDecisions())}
               appendAuditLog({
                 toolName: e.toolName,
                 args: e.args,
-                decision: "auto-deny",
-                timestamp: Date.now()
+                decision: "auto-deny"
               });
               if (e.waiter) e.waiter("deny");
               else e.earlyDecision = "deny";
@@ -1990,7 +2607,7 @@ data: ${JSON.stringify(readPersistentDecisions())}
           agent: entry.agent,
           mcpServer: entry.mcpServer
         });
-        if (sseClients.size === 0) openBrowser(`http://127.0.0.1:${DAEMON_PORT2}/`);
+        if (sseClients.size === 0 && !autoStarted) openBrowser(`http://127.0.0.1:${DAEMON_PORT2}/`);
         res.writeHead(200, { "Content-Type": "application/json" });
         return res.end(JSON.stringify({ id }));
       } catch {
@@ -2017,17 +2634,33 @@ data: ${JSON.stringify(readPersistentDecisions())}
         const id = pathname.split("/").pop();
         const entry = pending.get(id);
         if (!entry) return res.writeHead(404).end();
-        const { decision, persist } = JSON.parse(await readBody(req));
-        if (persist) writePersistentDecision(entry.toolName, decision);
+        const { decision, persist, trustDuration } = JSON.parse(await readBody(req));
+        if (decision === "trust" && trustDuration) {
+          const ms = TRUST_DURATIONS[trustDuration] ?? 60 * 6e4;
+          writeTrustEntry(entry.toolName, ms);
+          appendAuditLog({
+            toolName: entry.toolName,
+            args: entry.args,
+            decision: `trust:${trustDuration}`
+          });
+          clearTimeout(entry.timer);
+          if (entry.waiter) entry.waiter("allow");
+          else entry.earlyDecision = "allow";
+          pending.delete(id);
+          broadcast("remove", { id });
+          res.writeHead(200);
+          return res.end(JSON.stringify({ ok: true }));
+        }
+        const resolvedDecision = decision === "allow" || decision === "deny" ? decision : "deny";
+        if (persist) writePersistentDecision(entry.toolName, resolvedDecision);
         appendAuditLog({
           toolName: entry.toolName,
           args: entry.args,
-          decision,
-          timestamp: Date.now()
+          decision: resolvedDecision
         });
         clearTimeout(entry.timer);
-        if (entry.waiter) entry.waiter(decision);
-        else entry.earlyDecision = decision;
+        if (entry.waiter) entry.waiter(resolvedDecision);
+        else entry.earlyDecision = resolvedDecision;
         pending.delete(id);
         broadcast("remove", { id });
         res.writeHead(200);
@@ -2037,7 +2670,7 @@ data: ${JSON.stringify(readPersistentDecisions())}
       }
     }
     if (req.method === "GET" && pathname === "/settings") {
-      const s = readGlobalSettings();
+      const s = getGlobalSettings();
       res.writeHead(200, { "Content-Type": "application/json" });
       return res.end(JSON.stringify({ ...s, autoStarted }));
     }
@@ -2049,7 +2682,12 @@ data: ${JSON.stringify(readPersistentDecisions())}
         if (data.autoStartDaemon !== void 0)
           writeGlobalSetting("autoStartDaemon", data.autoStartDaemon);
         if (data.slackEnabled !== void 0) writeGlobalSetting("slackEnabled", data.slackEnabled);
-        if (data.agentMode !== void 0) writeGlobalSetting("agentMode", data.agentMode);
+        if (data.enableTrustSessions !== void 0)
+          writeGlobalSetting("enableTrustSessions", data.enableTrustSessions);
+        if (data.enableUndo !== void 0) writeGlobalSetting("enableUndo", data.enableUndo);
+        if (data.enableHookLogDebug !== void 0)
+          writeGlobalSetting("enableHookLogDebug", data.enableHookLogDebug);
+        if (data.approvers !== void 0) writeGlobalSetting("approvers", data.approvers);
         res.writeHead(200);
         return res.end(JSON.stringify({ ok: true }));
       } catch {
@@ -2057,7 +2695,7 @@ data: ${JSON.stringify(readPersistentDecisions())}
       }
     }
     if (req.method === "GET" && pathname === "/slack-status") {
-      const s = readGlobalSettings();
+      const s = getGlobalSettings();
       res.writeHead(200, { "Content-Type": "application/json" });
       return res.end(JSON.stringify({ hasKey: hasStoredSlackKey(), enabled: s.slackEnabled }));
     }
@@ -2065,14 +2703,12 @@ data: ${JSON.stringify(readPersistentDecisions())}
       if (!validToken(req)) return res.writeHead(403).end();
       try {
         const { apiKey } = JSON.parse(await readBody(req));
-        if (!fs3.existsSync(path3.dirname(CREDENTIALS_FILE)))
-          fs3.mkdirSync(path3.dirname(CREDENTIALS_FILE), { recursive: true });
-        fs3.writeFileSync(
+        atomicWriteSync2(
           CREDENTIALS_FILE,
           JSON.stringify({ apiKey, apiUrl: "https://api.node9.ai/api/v1/intercept" }, null, 2),
           { mode: 384 }
         );
-        broadcast("slack-status", { hasKey: true, enabled: readGlobalSettings().slackEnabled });
+        broadcast("slack-status", { hasKey: true, enabled: getGlobalSettings().slackEnabled });
         res.writeHead(200);
         return res.end(JSON.stringify({ ok: true }));
       } catch {
@@ -2085,7 +2721,7 @@ data: ${JSON.stringify(readPersistentDecisions())}
         const toolName = decodeURIComponent(pathname.split("/").pop());
         const decisions = readPersistentDecisions();
         delete decisions[toolName];
-        fs3.writeFileSync(DECISIONS_FILE, JSON.stringify(decisions, null, 2));
+        atomicWriteSync2(DECISIONS_FILE, JSON.stringify(decisions, null, 2));
         broadcast("decisions", decisions);
         res.writeHead(200);
         return res.end(JSON.stringify({ ok: true }));
@@ -2104,8 +2740,7 @@ data: ${JSON.stringify(readPersistentDecisions())}
         appendAuditLog({
           toolName: entry.toolName,
           args: entry.args,
-          decision,
-          timestamp: Date.now()
+          decision
         });
         clearTimeout(entry.timer);
         if (entry.waiter) entry.waiter(decision);
@@ -2125,10 +2760,28 @@ data: ${JSON.stringify(readPersistentDecisions())}
     res.writeHead(404).end();
   });
   daemonServer = server;
+  server.on("error", (e) => {
+    if (e.code === "EADDRINUSE") {
+      try {
+        if (fs3.existsSync(DAEMON_PID_FILE)) {
+          const { pid } = JSON.parse(fs3.readFileSync(DAEMON_PID_FILE, "utf-8"));
+          process.kill(pid, 0);
+          return process.exit(0);
+        }
+      } catch {
+        try {
+          fs3.unlinkSync(DAEMON_PID_FILE);
+        } catch {
+        }
+        server.listen(DAEMON_PORT2, DAEMON_HOST2);
+        return;
+      }
+    }
+    console.error(chalk3.red("\n\u{1F6D1} Node9 Daemon Error:"), e.message);
+    process.exit(1);
+  });
   server.listen(DAEMON_PORT2, DAEMON_HOST2, () => {
-    if (!fs3.existsSync(path3.dirname(DAEMON_PID_FILE)))
-      fs3.mkdirSync(path3.dirname(DAEMON_PID_FILE), { recursive: true });
-    fs3.writeFileSync(
+    atomicWriteSync2(
       DAEMON_PID_FILE,
       JSON.stringify({ pid: process.pid, port: DAEMON_PORT2, internalToken, autoStarted }),
       { mode: 384 }
@@ -2164,17 +2817,97 @@ function daemonStatus() {
 }
 
 // src/cli.ts
-import { spawn, execSync as execSync2 } from "child_process";
+import { spawn as spawn3, execSync } from "child_process";
 import { parseCommandString } from "execa";
 import { execa } from "execa";
 import chalk4 from "chalk";
 import readline from "readline";
+import fs5 from "fs";
+import path5 from "path";
+import os5 from "os";
+
+// src/undo.ts
+import { spawnSync } from "child_process";
 import fs4 from "fs";
 import path4 from "path";
 import os4 from "os";
+var UNDO_LATEST_PATH = path4.join(os4.homedir(), ".node9", "undo_latest.txt");
+async function createShadowSnapshot() {
+  try {
+    const cwd = process.cwd();
+    if (!fs4.existsSync(path4.join(cwd, ".git"))) return null;
+    const tempIndex = path4.join(cwd, ".git", `node9_index_${Date.now()}`);
+    const env = { ...process.env, GIT_INDEX_FILE: tempIndex };
+    spawnSync("git", ["add", "-A"], { env });
+    const treeRes = spawnSync("git", ["write-tree"], { env });
+    const treeHash = treeRes.stdout.toString().trim();
+    if (fs4.existsSync(tempIndex)) fs4.unlinkSync(tempIndex);
+    if (!treeHash || treeRes.status !== 0) return null;
+    const commitRes = spawnSync("git", [
+      "commit-tree",
+      treeHash,
+      "-m",
+      `Node9 AI Snapshot: ${(/* @__PURE__ */ new Date()).toISOString()}`
+    ]);
+    const commitHash = commitRes.stdout.toString().trim();
+    if (commitHash && commitRes.status === 0) {
+      const dir = path4.dirname(UNDO_LATEST_PATH);
+      if (!fs4.existsSync(dir)) fs4.mkdirSync(dir, { recursive: true });
+      fs4.writeFileSync(UNDO_LATEST_PATH, commitHash);
+      return commitHash;
+    }
+  } catch (err) {
+    if (process.env.NODE9_DEBUG === "1") {
+      console.error("[Node9 Undo Engine Error]:", err);
+    }
+  }
+  return null;
+}
+function applyUndo(hash) {
+  try {
+    const restore = spawnSync("git", ["restore", "--source", hash, "--staged", "--worktree", "."]);
+    if (restore.status !== 0) return false;
+    const lsTree = spawnSync("git", ["ls-tree", "-r", "--name-only", hash]);
+    const snapshotFiles = new Set(lsTree.stdout.toString().trim().split("\n").filter(Boolean));
+    const tracked = spawnSync("git", ["ls-files"]).stdout.toString().trim().split("\n").filter(Boolean);
+    const untracked = spawnSync("git", ["ls-files", "--others", "--exclude-standard"]).stdout.toString().trim().split("\n").filter(Boolean);
+    for (const file of [...tracked, ...untracked]) {
+      if (!snapshotFiles.has(file) && fs4.existsSync(file)) {
+        fs4.unlinkSync(file);
+      }
+    }
+    return true;
+  } catch {
+    return false;
+  }
+}
+function getLatestSnapshotHash() {
+  if (!fs4.existsSync(UNDO_LATEST_PATH)) return null;
+  return fs4.readFileSync(UNDO_LATEST_PATH, "utf-8").trim();
+}
+
+// src/cli.ts
+import { confirm as confirm3 } from "@inquirer/prompts";
 var { version } = JSON.parse(
-  fs4.readFileSync(path4.join(__dirname, "../package.json"), "utf-8")
+  fs5.readFileSync(path5.join(__dirname, "../package.json"), "utf-8")
 );
+function parseDuration(str) {
+  const m = str.trim().match(/^(\d+(?:\.\d+)?)\s*(s|m|h|d)?$/i);
+  if (!m) return null;
+  const n = parseFloat(m[1]);
+  switch ((m[2] ?? "m").toLowerCase()) {
+    case "s":
+      return Math.round(n * 1e3);
+    case "m":
+      return Math.round(n * 6e4);
+    case "h":
+      return Math.round(n * 36e5);
+    case "d":
+      return Math.round(n * 864e5);
+    default:
+      return null;
+  }
+}
 function sanitize(value) {
   return value.replace(/[\x00-\x1F\x7F]/g, "");
 }
@@ -2182,23 +2915,33 @@ function openBrowserLocal() {
   const url = `http://${DAEMON_HOST2}:${DAEMON_PORT2}/`;
   try {
     const opts = { stdio: "ignore" };
-    if (process.platform === "darwin") execSync2(`open "${url}"`, opts);
-    else if (process.platform === "win32") execSync2(`cmd /c start "" "${url}"`, opts);
-    else execSync2(`xdg-open "${url}"`, opts);
+    if (process.platform === "darwin") execSync(`open "${url}"`, opts);
+    else if (process.platform === "win32") execSync(`cmd /c start "" "${url}"`, opts);
+    else execSync(`xdg-open "${url}"`, opts);
   } catch {
   }
 }
 async function autoStartDaemonAndWait() {
   try {
-    const child = spawn("node9", ["daemon"], {
+    const child = spawn3("node9", ["daemon"], {
       detached: true,
       stdio: "ignore",
       env: { ...process.env, NODE9_AUTO_STARTED: "1" }
     });
     child.unref();
-    for (let i = 0; i < 12; i++) {
+    for (let i = 0; i < 20; i++) {
       await new Promise((r) => setTimeout(r, 250));
-      if (isDaemonRunning()) return true;
+      if (!isDaemonRunning()) continue;
+      try {
+        const res = await fetch("http://127.0.0.1:7391/settings", {
+          signal: AbortSignal.timeout(500)
+        });
+        if (res.ok) {
+          openBrowserLocal();
+          return true;
+        }
+      } catch {
+      }
     }
   } catch {
   }
@@ -2217,47 +2960,71 @@ async function runProxy(targetCommand) {
   } catch {
   }
   console.log(chalk4.green(`\u{1F680} Node9 Proxy Active: Monitoring [${targetCommand}]`));
-  const child = spawn(executable, args, {
+  const child = spawn3(executable, args, {
     stdio: ["pipe", "pipe", "inherit"],
+    // We control STDIN and STDOUT
     shell: true,
-    env: { ...process.env, FORCE_COLOR: "1", TERM: process.env.TERM || "xterm-256color" }
+    env: { ...process.env, FORCE_COLOR: "1" }
   });
-  process.stdin.pipe(child.stdin);
-  const childOut = readline.createInterface({ input: child.stdout, terminal: false });
-  childOut.on("line", async (line) => {
+  const agentIn = readline.createInterface({ input: process.stdin, terminal: false });
+  agentIn.on("line", async (line) => {
+    let message;
     try {
-      const message = JSON.parse(line);
-      if (message.method === "call_tool" || message.method === "tools/call" || message.method === "use_tool") {
+      message = JSON.parse(line);
+    } catch {
+      child.stdin.write(line + "\n");
+      return;
+    }
+    if (message.method === "call_tool" || message.method === "tools/call" || message.method === "use_tool") {
+      agentIn.pause();
+      try {
         const name = message.params?.name || message.params?.tool_name || "unknown";
         const toolArgs = message.params?.arguments || message.params?.tool_input || {};
-        const approved = await authorizeAction(sanitize(name), toolArgs);
-        if (!approved) {
+        const result = await authorizeHeadless(sanitize(name), toolArgs, true, {
+          agent: "Proxy/MCP"
+        });
+        if (!result.approved) {
           const errorResponse = {
             jsonrpc: "2.0",
             id: message.id,
-            error: { code: -32e3, message: "Node9: Action denied." }
+            error: {
+              code: -32e3,
+              message: `Node9: Action denied. ${result.reason || ""}`
+            }
           };
-          child.stdin.write(JSON.stringify(errorResponse) + "\n");
+          process.stdout.write(JSON.stringify(errorResponse) + "\n");
           return;
         }
+      } catch {
+        const errorResponse = {
+          jsonrpc: "2.0",
+          id: message.id,
+          error: {
+            code: -32e3,
+            message: `Node9: Security engine encountered an error. Action blocked for safety.`
+          }
+        };
+        process.stdout.write(JSON.stringify(errorResponse) + "\n");
+        return;
+      } finally {
+        agentIn.resume();
       }
-      process.stdout.write(line + "\n");
-    } catch {
-      process.stdout.write(line + "\n");
     }
+    child.stdin.write(line + "\n");
   });
+  child.stdout.pipe(process.stdout);
   child.on("exit", (code) => process.exit(code || 0));
 }
 program.command("login").argument("<apiKey>").option("--local", "Save key for audit/logging only \u2014 local config still controls all decisions").option("--profile <name>", 'Save as a named profile (default: "default")').action((apiKey, options) => {
   const DEFAULT_API_URL = "https://api.node9.ai/api/v1/intercept";
-  const credPath = path4.join(os4.homedir(), ".node9", "credentials.json");
-  if (!fs4.existsSync(path4.dirname(credPath)))
-    fs4.mkdirSync(path4.dirname(credPath), { recursive: true });
+  const credPath = path5.join(os5.homedir(), ".node9", "credentials.json");
+  if (!fs5.existsSync(path5.dirname(credPath)))
+    fs5.mkdirSync(path5.dirname(credPath), { recursive: true });
   const profileName = options.profile || "default";
   let existingCreds = {};
   try {
-    if (fs4.existsSync(credPath)) {
-      const raw = JSON.parse(fs4.readFileSync(credPath, "utf-8"));
+    if (fs5.existsSync(credPath)) {
+      const raw = JSON.parse(fs5.readFileSync(credPath, "utf-8"));
       if (raw.apiKey) {
         existingCreds = {
           default: { apiKey: raw.apiKey, apiUrl: raw.apiUrl || DEFAULT_API_URL }
@@ -2269,40 +3036,38 @@ program.command("login").argument("<apiKey>").option("--local", "Save key for au
   } catch {
   }
   existingCreds[profileName] = { apiKey, apiUrl: DEFAULT_API_URL };
-  fs4.writeFileSync(credPath, JSON.stringify(existingCreds, null, 2), { mode: 384 });
+  fs5.writeFileSync(credPath, JSON.stringify(existingCreds, null, 2), { mode: 384 });
   if (profileName === "default") {
-    const configPath = path4.join(os4.homedir(), ".node9", "config.json");
+    const configPath = path5.join(os5.homedir(), ".node9", "config.json");
     let config = {};
     try {
-      if (fs4.existsSync(configPath))
-        config = JSON.parse(fs4.readFileSync(configPath, "utf-8"));
+      if (fs5.existsSync(configPath))
+        config = JSON.parse(fs5.readFileSync(configPath, "utf-8"));
     } catch {
     }
     if (!config.settings || typeof config.settings !== "object") config.settings = {};
-    config.settings.agentMode = !options.local;
-    if (!fs4.existsSync(path4.dirname(configPath)))
-      fs4.mkdirSync(path4.dirname(configPath), { recursive: true });
-    fs4.writeFileSync(configPath, JSON.stringify(config, null, 2), { mode: 384 });
+    const s = config.settings;
+    const approvers = s.approvers || {
+      native: true,
+      browser: true,
+      cloud: true,
+      terminal: true
+    };
+    approvers.cloud = !options.local;
+    s.approvers = approvers;
+    if (!fs5.existsSync(path5.dirname(configPath)))
+      fs5.mkdirSync(path5.dirname(configPath), { recursive: true });
+    fs5.writeFileSync(configPath, JSON.stringify(config, null, 2), { mode: 384 });
   }
   if (options.profile && profileName !== "default") {
     console.log(chalk4.green(`\u2705 Profile "${profileName}" saved`));
     console.log(chalk4.gray(`   Switch to it per-session:  NODE9_PROFILE=${profileName} claude`));
-    console.log(
-      chalk4.gray(
-        `   Or lock a project to it:   add "apiKey": "<your-api-key>" to node9.config.json`
-      )
-    );
   } else if (options.local) {
     console.log(chalk4.green(`\u2705 Privacy mode \u{1F6E1}\uFE0F`));
     console.log(chalk4.gray(`   All decisions stay on this machine.`));
-    console.log(
-      chalk4.gray(`   No data is sent to the cloud. Local config is the only authority.`)
-    );
-    console.log(chalk4.gray(`   To enable cloud enforcement: node9 login <apiKey>`));
   } else {
     console.log(chalk4.green(`\u2705 Logged in \u2014 agent mode`));
     console.log(chalk4.gray(`   Team policy enforced for all calls via Node9 cloud.`));
-    console.log(chalk4.gray(`   To keep local control only: node9 login <apiKey> --local`));
   }
 });
 program.command("addto").description("Integrate Node9 with an AI agent").addHelpText("after", "\n  Supported targets:  claude  gemini  cursor").argument("<target>", "The agent to protect: claude | gemini | cursor").action(async (target) => {
@@ -2313,16 +3078,23 @@ program.command("addto").description("Integrate Node9 with an AI agent").addHelp
   process.exit(1);
 });
 program.command("init").description("Create ~/.node9/config.json with default policy (safe to run multiple times)").option("--force", "Overwrite existing config").action((options) => {
-  const configPath = path4.join(os4.homedir(), ".node9", "config.json");
-  if (fs4.existsSync(configPath) && !options.force) {
+  const configPath = path5.join(os5.homedir(), ".node9", "config.json");
+  if (fs5.existsSync(configPath) && !options.force) {
     console.log(chalk4.yellow(`\u2139\uFE0F  Global config already exists: ${configPath}`));
     console.log(chalk4.gray(`   Run with --force to overwrite.`));
     return;
   }
   const defaultConfig = {
     version: "1.0",
-    settings: { mode: "standard" },
+    settings: {
+      mode: "standard",
+      autoStartDaemon: true,
+      enableUndo: true,
+      enableHookLogDebug: false,
+      approvers: { native: true, browser: true, cloud: true, terminal: true }
+    },
     policy: {
+      sandboxPaths: ["/tmp/**", "**/sandbox/**", "**/test-results/**"],
       dangerousWords: DANGEROUS_WORDS,
       ignoredTools: [
         "list_*",
@@ -2332,60 +3104,65 @@ program.command("init").description("Create ~/.node9/config.json with default po
         "read",
         "write",
         "edit",
-        "multiedit",
         "glob",
         "grep",
         "ls",
         "notebookread",
         "notebookedit",
-        "todoread",
-        "todowrite",
         "webfetch",
         "websearch",
         "exitplanmode",
-        "askuserquestion"
+        "askuserquestion",
+        "agent",
+        "task*"
       ],
       toolInspection: {
         bash: "command",
         shell: "command",
         run_shell_command: "command",
-        "terminal.execute": "command"
+        "terminal.execute": "command",
+        "postgres:query": "sql"
       },
       rules: [
         {
           action: "rm",
-          allowPaths: ["**/node_modules/**", "dist/**", "build/**", ".DS_Store"]
+          allowPaths: [
+            "**/node_modules/**",
+            "dist/**",
+            "build/**",
+            ".next/**",
+            "coverage/**",
+            ".cache/**",
+            "tmp/**",
+            "temp/**",
+            ".DS_Store"
+          ]
         }
       ]
     }
   };
-  if (!fs4.existsSync(path4.dirname(configPath)))
-    fs4.mkdirSync(path4.dirname(configPath), { recursive: true });
-  fs4.writeFileSync(configPath, JSON.stringify(defaultConfig, null, 2));
+  if (!fs5.existsSync(path5.dirname(configPath)))
+    fs5.mkdirSync(path5.dirname(configPath), { recursive: true });
+  fs5.writeFileSync(configPath, JSON.stringify(defaultConfig, null, 2));
   console.log(chalk4.green(`\u2705 Global config created: ${configPath}`));
   console.log(chalk4.gray(`   Edit this file to add custom tool inspection or security rules.`));
 });
 program.command("status").description("Show current Node9 mode, policy source, and persistent decisions").action(() => {
   const creds = getCredentials();
   const daemonRunning = isDaemonRunning();
-  const settings = getGlobalSettings();
+  const mergedConfig = getConfig();
+  const settings = mergedConfig.settings;
   console.log("");
-  if (creds && settings.agentMode) {
+  if (creds && settings.approvers.cloud) {
     console.log(chalk4.green("  \u25CF Agent mode") + chalk4.gray(" \u2014 cloud team policy enforced"));
-    console.log(chalk4.gray("    All calls \u2192 Node9 cloud \u2192 Policy Studio rules apply"));
-    console.log(chalk4.gray("    Switch to local control: node9 login <apiKey> --local"));
-  } else if (creds && !settings.agentMode) {
+  } else if (creds && !settings.approvers.cloud) {
     console.log(
       chalk4.blue("  \u25CF Privacy mode \u{1F6E1}\uFE0F") + chalk4.gray(" \u2014 all decisions stay on this machine")
     );
+  } else {
     console.log(
-      chalk4.gray("    No data is sent to the cloud. Local config is the only authority.")
+      chalk4.yellow("  \u25CB Privacy mode \u{1F6E1}\uFE0F") + chalk4.gray(" \u2014 no API key (Local rules only)")
     );
-    console.log(chalk4.gray("    Enable cloud enforcement: node9 login <apiKey>"));
-  } else {
-    console.log(chalk4.yellow("  \u25CB Privacy mode \u{1F6E1}\uFE0F") + chalk4.gray(" \u2014 no API key"));
-    console.log(chalk4.gray("    All decisions stay on this machine."));
-    console.log(chalk4.gray("    Connect to your team: node9 login <apiKey>"));
   }
   console.log("");
   if (daemonRunning) {
@@ -2394,64 +3171,39 @@ program.command("status").description("Show current Node9 mode, policy source, a
     );
   } else {
     console.log(chalk4.gray("  \u25CB Daemon stopped"));
-    console.log(chalk4.gray("    Start: node9 daemon --background"));
   }
-  console.log("");
-  console.log(`  Mode:    ${chalk4.white(settings.mode)}`);
-  const projectConfig = path4.join(process.cwd(), "node9.config.json");
-  const globalConfig = path4.join(os4.homedir(), ".node9", "config.json");
-  const configSource = fs4.existsSync(projectConfig) ? projectConfig : fs4.existsSync(globalConfig) ? globalConfig : chalk4.gray("none (built-in defaults)");
-  console.log(`  Config:  ${chalk4.gray(configSource)}`);
-  const profiles = listCredentialProfiles();
-  if (profiles.length > 1) {
-    const activeProfile = process.env.NODE9_PROFILE || "default";
-    console.log("");
-    console.log(`  Active profile:  ${chalk4.white(activeProfile)}`);
+  if (settings.enableUndo) {
     console.log(
-      `  All profiles:    ${profiles.map((p) => p === activeProfile ? chalk4.green(p) : chalk4.gray(p)).join(chalk4.gray(", "))}`
+      chalk4.magenta("  \u25CF Undo Engine") + chalk4.gray(`    \u2192 Auto-snapshotting Git repos on AI change`)
     );
-    console.log(chalk4.gray(`  Switch:  NODE9_PROFILE=<name> claude`));
-  }
-  const decisionsFile = path4.join(os4.homedir(), ".node9", "decisions.json");
-  let decisions = {};
-  try {
-    if (fs4.existsSync(decisionsFile))
-      decisions = JSON.parse(fs4.readFileSync(decisionsFile, "utf-8"));
-  } catch {
   }
-  const keys = Object.keys(decisions);
   console.log("");
-  if (keys.length > 0) {
-    console.log(`  Persistent decisions (${keys.length}):`);
-    keys.forEach((tool) => {
-      const d = decisions[tool];
-      const badge = d === "allow" ? chalk4.green("allow") : chalk4.red("deny");
-      console.log(`    ${chalk4.gray("\xB7")} ${tool.padEnd(35)} ${badge}`);
-    });
-    console.log(chalk4.gray("\n    Manage: node9 daemon --openui \u2192 Decisions tab"));
-  } else {
-    console.log(chalk4.gray("  No persistent decisions set"));
+  const modeLabel = settings.mode === "audit" ? chalk4.blue("audit") : settings.mode === "strict" ? chalk4.red("strict") : chalk4.white("standard");
+  console.log(`  Mode:    ${modeLabel}`);
+  const projectConfig = path5.join(process.cwd(), "node9.config.json");
+  const globalConfig = path5.join(os5.homedir(), ".node9", "config.json");
+  console.log(
+    `  Local:   ${fs5.existsSync(projectConfig) ? chalk4.green("Active (node9.config.json)") : chalk4.gray("Not present")}`
+  );
+  console.log(
+    `  Global:  ${fs5.existsSync(globalConfig) ? chalk4.green("Active (~/.node9/config.json)") : chalk4.gray("Not present")}`
+  );
+  if (mergedConfig.policy.sandboxPaths.length > 0) {
+    console.log(
+      `  Sandbox: ${chalk4.green(`${mergedConfig.policy.sandboxPaths.length} safe zones active`)}`
+    );
   }
-  const auditLogPath = path4.join(os4.homedir(), ".node9", "audit.log");
-  try {
-    if (fs4.existsSync(auditLogPath)) {
-      const lines = fs4.readFileSync(auditLogPath, "utf-8").split("\n").filter((l) => l.trim().length > 0);
-      console.log("");
-      console.log(
-        `  \u{1F4CB} Local Audit Log: ` + chalk4.white(`${lines.length} agent action${lines.length !== 1 ? "s" : ""} recorded`) + chalk4.gray(`  (cat ~/.node9/audit.log to view)`)
-      );
-    }
-  } catch {
+  const pauseState = checkPause();
+  if (pauseState.paused) {
+    const expiresAt = pauseState.expiresAt ? new Date(pauseState.expiresAt).toLocaleTimeString() : "indefinitely";
+    console.log("");
+    console.log(
+      chalk4.yellow(`  \u23F8  PAUSED until ${expiresAt}`) + chalk4.gray(" \u2014 all tool calls allowed")
+    );
   }
   console.log("");
 });
-program.command("daemon").description("Run the local approval server (browser HITL for free tier)").addHelpText(
-  "after",
-  "\n  Subcommands: start (default), stop, status\n  Options:\n    --background  (-b)  start detached, no second terminal needed\n    --openui      (-o)  start in background and open the browser (or just open if already running)\n  Example:     node9 daemon --background"
-).argument("[action]", "start | stop | status (default: start)").option("-b, --background", "Start the daemon in the background (detached)").option(
-  "-o, --openui",
-  "Start in background and open browser (or just open browser if already running)"
-).action(
+program.command("daemon").description("Run the local approval server").argument("[action]", "start | stop | status (default: start)").option("-b, --background", "Start the daemon in the background (detached)").option("-o, --openui", "Start in background and open browser").action(
   async (action, options) => {
     const cmd = (action ?? "start").toLowerCase();
     if (cmd === "stop") return stopDaemon();
@@ -2466,7 +3218,7 @@ program.command("daemon").description("Run the local approval server (browser HI
         console.log(chalk4.green(`\u{1F310}  Opened browser: http://${DAEMON_HOST2}:${DAEMON_PORT2}/`));
         process.exit(0);
       }
-      const child = spawn("node9", ["daemon"], { detached: true, stdio: "ignore" });
+      const child = spawn3("node9", ["daemon"], { detached: true, stdio: "ignore" });
       child.unref();
       for (let i = 0; i < 12; i++) {
         await new Promise((r) => setTimeout(r, 250));
@@ -2475,18 +3227,13 @@ program.command("daemon").description("Run the local approval server (browser HI
       openBrowserLocal();
       console.log(chalk4.green(`
 \u{1F6E1}\uFE0F  Node9 daemon started + browser opened`));
-      console.log(chalk4.gray(`   http://${DAEMON_HOST2}:${DAEMON_PORT2}/`));
       process.exit(0);
     }
     if (options.background) {
-      const child = spawn("node9", ["daemon"], { detached: true, stdio: "ignore" });
+      const child = spawn3("node9", ["daemon"], { detached: true, stdio: "ignore" });
       child.unref();
       console.log(chalk4.green(`
 \u{1F6E1}\uFE0F  Node9 daemon started in background  (PID ${child.pid})`));
-      console.log(chalk4.gray(`   http://${DAEMON_HOST2}:${DAEMON_PORT2}/`));
-      console.log(chalk4.gray(`   node9 daemon status  \u2014 check if running`));
-      console.log(chalk4.gray(`   node9 daemon stop    \u2014 stop it
-`));
       process.exit(0);
     }
     startDaemon();
@@ -2496,53 +3243,81 @@ program.command("check").description("Hook handler \u2014 evaluates a tool call
   const processPayload = async (raw) => {
     try {
       if (!raw || raw.trim() === "") process.exit(0);
-      if (process.env.NODE9_DEBUG === "1") {
-        const logPath = path4.join(os4.homedir(), ".node9", "hook-debug.log");
-        if (!fs4.existsSync(path4.dirname(logPath)))
-          fs4.mkdirSync(path4.dirname(logPath), { recursive: true });
-        fs4.appendFileSync(logPath, `[${(/* @__PURE__ */ new Date()).toISOString()}] STDIN: ${raw}
-`);
-        fs4.appendFileSync(
-          logPath,
-          `[${(/* @__PURE__ */ new Date()).toISOString()}] TTY: ${process.stdout.isTTY}
+      let payload = JSON.parse(raw);
+      try {
+        payload = JSON.parse(raw);
+      } catch (err) {
+        const tempConfig = getConfig();
+        if (process.env.NODE9_DEBUG === "1" || tempConfig.settings.enableHookLogDebug) {
+          const logPath = path5.join(os5.homedir(), ".node9", "hook-debug.log");
+          const errMsg = err instanceof Error ? err.message : String(err);
+          fs5.appendFileSync(
+            logPath,
+            `[${(/* @__PURE__ */ new Date()).toISOString()}] JSON_PARSE_ERROR: ${errMsg}
+RAW: ${raw}
 `
-        );
+          );
+        }
+        process.exit(0);
+        return;
+      }
+      if (payload.cwd) {
+        try {
+          process.chdir(payload.cwd);
+          _resetConfigCache();
+        } catch {
+        }
+      }
+      const config = getConfig();
+      if (process.env.NODE9_DEBUG === "1" || config.settings.enableHookLogDebug) {
+        const logPath = path5.join(os5.homedir(), ".node9", "hook-debug.log");
+        if (!fs5.existsSync(path5.dirname(logPath)))
+          fs5.mkdirSync(path5.dirname(logPath), { recursive: true });
+        fs5.appendFileSync(logPath, `[${(/* @__PURE__ */ new Date()).toISOString()}] STDIN: ${raw}
+`);
       }
-      const payload = JSON.parse(raw);
       const toolName = sanitize(payload.tool_name ?? payload.name ?? "");
       const toolInput = payload.tool_input ?? payload.args ?? {};
-      const agent = payload.tool_name !== void 0 ? "Claude Code" : payload.name !== void 0 ? "Gemini CLI" : "Terminal";
+      const agent = payload.hook_event_name === "PreToolUse" || payload.hook_event_name === "PostToolUse" || payload.tool_use_id !== void 0 || payload.permission_mode !== void 0 ? "Claude Code" : payload.hook_event_name === "BeforeTool" || payload.hook_event_name === "AfterTool" || payload.timestamp !== void 0 ? "Gemini CLI" : payload.tool_name !== void 0 || payload.name !== void 0 ? "Unknown Agent" : "Terminal";
       const mcpMatch = toolName.match(/^mcp__([^_](?:[^_]|_(?!_))*?)__/i);
       const mcpServer = mcpMatch?.[1];
       const sendBlock = (msg, result2) => {
-        const BLOCKED_BY_LABELS = {
-          "team-policy": "team policy (set by your admin)",
-          "persistent-deny": "you set this tool to always deny",
-          "local-config": "your local config (dangerousWords / rules)",
-          "local-decision": "you denied it in the browser",
-          "no-approval-mechanism": "no approval method is configured"
-        };
+        const blockedByContext = result2?.blockedByLabel || result2?.blockedBy || "Local Security Policy";
+        const isHumanDecision = blockedByContext.toLowerCase().includes("user") || blockedByContext.toLowerCase().includes("daemon") || blockedByContext.toLowerCase().includes("decision");
         console.error(chalk4.red(`
 \u{1F6D1} Node9 blocked "${toolName}"`));
-        if (result2?.blockedBy) {
-          console.error(
-            chalk4.gray(
-              `   Blocked by: ${BLOCKED_BY_LABELS[result2.blockedBy] ?? result2.blockedBy}`
-            )
-          );
-        }
-        if (result2?.changeHint) {
-          console.error(chalk4.cyan(`   To change:  ${result2.changeHint}`));
-        }
+        console.error(chalk4.gray(`   Triggered by: ${blockedByContext}`));
+        if (result2?.changeHint) console.error(chalk4.cyan(`   To change:  ${result2.changeHint}`));
         console.error("");
+        let aiFeedbackMessage = "";
+        if (isHumanDecision) {
+          aiFeedbackMessage = `NODE9 SECURITY INTERVENTION: The human user specifically REJECTED this action.
+        REASON: ${msg || "No specific reason provided by user."}
+
+        INSTRUCTIONS FOR AI AGENT:
+        - Do NOT retry this exact command immediately.
+        - Explain to the user that you understand they blocked the action.
+        - Ask the user if there is an alternative approach they would prefer, or if they intended to block this action entirely.
+        - If you believe this action is critical, explain your reasoning to the user and ask them to run 'node9 pause 15m' to allow you to proceed.`;
+        } else {
+          aiFeedbackMessage = `NODE9 SECURITY INTERVENTION: Action blocked by automated policy [${blockedByContext}].
+        REASON: ${msg}
+
+        INSTRUCTIONS FOR AI AGENT:
+        - This command violates the current security configuration.
+        - Do NOT attempt to bypass this rule with bash syntax tricks; it will be blocked again.
+        - Pivot to a non-destructive or read-only alternative.
+        - Inform the user which security rule was triggered.`;
+        }
         process.stdout.write(
           JSON.stringify({
             decision: "block",
-            reason: msg,
+            reason: aiFeedbackMessage,
+            // This is the core instruction
             hookSpecificOutput: {
               hookEventName: "PreToolUse",
               permissionDecision: "deny",
-              permissionDecisionReason: msg
+              permissionDecisionReason: aiFeedbackMessage
             }
           }) + "\n"
         );
@@ -2553,36 +3328,53 @@ program.command("check").description("Hook handler \u2014 evaluates a tool call
         return;
       }
       const meta = { agent, mcpServer };
+      const STATE_CHANGING_TOOLS_PRE = [
+        "bash",
+        "shell",
+        "write_file",
+        "edit_file",
+        "replace",
+        "terminal.execute",
+        "str_replace_based_edit_tool",
+        "create_file"
+      ];
+      if (config.settings.enableUndo && STATE_CHANGING_TOOLS_PRE.includes(toolName.toLowerCase())) {
+        await createShadowSnapshot();
+      }
       const result = await authorizeHeadless(toolName, toolInput, false, meta);
       if (result.approved) {
-        if (result.checkedBy) {
+        if (result.checkedBy)
           process.stderr.write(`\u2713 node9 [${result.checkedBy}]: "${toolName}" allowed
 `);
-        }
         process.exit(0);
       }
-      if (result.noApprovalMechanism && !isDaemonRunning() && !process.env.NODE9_NO_AUTO_DAEMON && !process.stdout.isTTY && getGlobalSettings().autoStartDaemon) {
+      if (result.noApprovalMechanism && !isDaemonRunning() && !process.env.NODE9_NO_AUTO_DAEMON && !process.stdout.isTTY && config.settings.autoStartDaemon) {
         console.error(chalk4.cyan("\n\u{1F6E1}\uFE0F  Node9: Starting approval daemon automatically..."));
         const daemonReady = await autoStartDaemonAndWait();
         if (daemonReady) {
           const retry = await authorizeHeadless(toolName, toolInput, false, meta);
           if (retry.approved) {
-            if (retry.checkedBy) {
+            if (retry.checkedBy)
               process.stderr.write(`\u2713 node9 [${retry.checkedBy}]: "${toolName}" allowed
 `);
-            }
             process.exit(0);
           }
-          sendBlock(retry.reason ?? `Node9 blocked "${toolName}".`, retry);
+          sendBlock(retry.reason ?? `Node9 blocked "${toolName}".`, {
+            ...retry,
+            blockedByLabel: retry.blockedByLabel
+          });
           return;
         }
       }
-      sendBlock(result.reason ?? `Node9 blocked "${toolName}".`, result);
+      sendBlock(result.reason ?? `Node9 blocked "${toolName}".`, {
+        ...result,
+        blockedByLabel: result.blockedByLabel
+      });
     } catch (err) {
       if (process.env.NODE9_DEBUG === "1") {
-        const logPath = path4.join(os4.homedir(), ".node9", "hook-debug.log");
+        const logPath = path5.join(os5.homedir(), ".node9", "hook-debug.log");
         const errMsg = err instanceof Error ? err.message : String(err);
-        fs4.appendFileSync(logPath, `[${(/* @__PURE__ */ new Date()).toISOString()}] ERROR: ${errMsg}
+        fs5.appendFileSync(logPath, `[${(/* @__PURE__ */ new Date()).toISOString()}] ERROR: ${errMsg}
 `);
       }
       process.exit(0);
@@ -2593,48 +3385,101 @@ program.command("check").description("Hook handler \u2014 evaluates a tool call
   } else {
     let raw = "";
     let processed = false;
+    let inactivityTimer = null;
     const done = async () => {
       if (processed) return;
       processed = true;
+      if (inactivityTimer) clearTimeout(inactivityTimer);
       if (!raw.trim()) return process.exit(0);
       await processPayload(raw);
     };
     process.stdin.setEncoding("utf-8");
-    process.stdin.on("data", (chunk) => raw += chunk);
-    process.stdin.on("end", () => void done());
-    setTimeout(() => void done(), 5e3);
+    process.stdin.on("data", (chunk) => {
+      raw += chunk;
+      if (inactivityTimer) clearTimeout(inactivityTimer);
+      inactivityTimer = setTimeout(() => void done(), 2e3);
+    });
+    process.stdin.on("end", () => {
+      void done();
+    });
+    inactivityTimer = setTimeout(() => void done(), 5e3);
   }
 });
 program.command("log").description("PostToolUse hook \u2014 records executed tool calls").argument("[data]", "JSON string of the tool call").action(async (data) => {
-  const logPayload = (raw) => {
+  const logPayload = async (raw) => {
     try {
       if (!raw || raw.trim() === "") process.exit(0);
       const payload = JSON.parse(raw);
+      const tool = sanitize(payload.tool_name ?? payload.name ?? "unknown");
+      const rawInput = payload.tool_input ?? payload.args ?? {};
       const entry = {
         ts: (/* @__PURE__ */ new Date()).toISOString(),
-        tool: sanitize(payload.tool_name ?? "unknown"),
-        input: JSON.parse(redactSecrets(JSON.stringify(payload.tool_input || {})))
+        tool,
+        args: JSON.parse(redactSecrets(JSON.stringify(rawInput))),
+        decision: "allowed",
+        source: "post-hook"
       };
-      const logPath = path4.join(os4.homedir(), ".node9", "audit.log");
-      if (!fs4.existsSync(path4.dirname(logPath)))
-        fs4.mkdirSync(path4.dirname(logPath), { recursive: true });
-      fs4.appendFileSync(logPath, JSON.stringify(entry) + "\n");
+      const logPath = path5.join(os5.homedir(), ".node9", "audit.log");
+      if (!fs5.existsSync(path5.dirname(logPath)))
+        fs5.mkdirSync(path5.dirname(logPath), { recursive: true });
+      fs5.appendFileSync(logPath, JSON.stringify(entry) + "\n");
+      const config = getConfig();
+      const STATE_CHANGING_TOOLS = [
+        "bash",
+        "shell",
+        "write_file",
+        "edit_file",
+        "replace",
+        "terminal.execute"
+      ];
+      if (config.settings.enableUndo && STATE_CHANGING_TOOLS.includes(tool.toLowerCase())) {
+        await createShadowSnapshot();
+      }
     } catch {
     }
     process.exit(0);
   };
   if (data) {
-    logPayload(data);
+    await logPayload(data);
   } else {
     let raw = "";
     process.stdin.setEncoding("utf-8");
     process.stdin.on("data", (chunk) => raw += chunk);
-    process.stdin.on("end", () => logPayload(raw));
+    process.stdin.on("end", () => {
+      void logPayload(raw);
+    });
     setTimeout(() => {
       if (!raw) process.exit(0);
     }, 500);
   }
 });
+program.command("pause").description("Temporarily disable Node9 protection for a set duration").option("-d, --duration <duration>", "How long to pause (e.g. 15m, 1h, 30s)", "15m").action((options) => {
+  const ms = parseDuration(options.duration);
+  if (ms === null) {
+    console.error(
+      chalk4.red(`
+\u274C  Invalid duration: "${options.duration}". Use format like 15m, 1h, 30s.
+`)
+    );
+    process.exit(1);
+  }
+  pauseNode9(ms, options.duration);
+  const expiresAt = new Date(Date.now() + ms).toLocaleTimeString();
+  console.log(chalk4.yellow(`
+\u23F8  Node9 paused until ${expiresAt}`));
+  console.log(chalk4.gray(`   All tool calls will be allowed without review.`));
+  console.log(chalk4.gray(`   Run "node9 resume" to re-enable early.
+`));
+});
+program.command("resume").description("Re-enable Node9 protection immediately").action(() => {
+  const { paused } = checkPause();
+  if (!paused) {
+    console.log(chalk4.gray("\nNode9 is already active \u2014 nothing to resume.\n"));
+    return;
+  }
+  resumeNode9();
+  console.log(chalk4.green("\n\u25B6  Node9 resumed \u2014 protection is active.\n"));
+});
 var HOOK_BASED_AGENTS = {
   claude: "claude",
   gemini: "gemini",
@@ -2649,35 +3494,17 @@ program.argument("[command...]", "The agent command to run (e.g., gemini)").acti
         chalk4.yellow(`
 \u26A0\uFE0F  Node9 proxy mode does not support "${target}" directly.`)
       );
-      console.error(
-        chalk4.white(`
-   "${target}" is an interactive terminal app \u2014 it needs a real`)
-      );
-      console.error(
-        chalk4.white(`   TTY and communicates via its own hook system, not JSON-RPC.
-`)
-      );
-      console.error(chalk4.bold(`   Use the hook-based integration instead:
-`));
-      console.error(
-        chalk4.green(`     node9 addto ${target}   `) + chalk4.gray("# one-time setup")
-      );
-      console.error(
-        chalk4.green(`     ${target}              `) + chalk4.gray("# run normally \u2014 Node9 hooks fire automatically")
-      );
       console.error(chalk4.white(`
-   For browser approval popups (no API key required):`));
+   "${target}" uses its own hook system. Use:`));
       console.error(
-        chalk4.green(`     node9 daemon --background`) + chalk4.gray("# start (no second terminal needed)")
-      );
-      console.error(
-        chalk4.green(`     ${target}              `) + chalk4.gray("# Node9 will open browser on dangerous actions\n")
+        chalk4.green(`     node9 addto ${target}   `) + chalk4.gray("# one-time setup")
       );
+      console.error(chalk4.green(`     ${target}              `) + chalk4.gray("# run normally"));
       process.exit(1);
     }
     const fullCommand = commandArgs.join(" ");
     let result = await authorizeHeadless("shell", { command: fullCommand });
-    if (result.noApprovalMechanism && !isDaemonRunning() && !process.env.NODE9_NO_AUTO_DAEMON && getGlobalSettings().autoStartDaemon) {
+    if (result.noApprovalMechanism && !isDaemonRunning() && !process.env.NODE9_NO_AUTO_DAEMON && getConfig().settings.autoStartDaemon) {
       console.error(chalk4.cyan("\n\u{1F6E1}\uFE0F  Node9: Starting approval daemon automatically..."));
       const daemonReady = await autoStartDaemonAndWait();
       if (daemonReady) result = await authorizeHeadless("shell", { command: fullCommand });
@@ -2690,21 +3517,6 @@ program.argument("[command...]", "The agent command to run (e.g., gemini)").acti
         chalk4.red(`
 \u274C Node9 Blocked: ${result.reason || "Dangerous command detected."}`)
       );
-      if (result.blockedBy) {
-        const BLOCKED_BY_LABELS = {
-          "team-policy": "Team policy (Node9 cloud)",
-          "persistent-deny": "Persistent deny rule",
-          "local-config": "Local config",
-          "local-decision": "Browser UI decision",
-          "no-approval-mechanism": "No approval mechanism available"
-        };
-        console.error(
-          chalk4.gray(`   Blocked by: ${BLOCKED_BY_LABELS[result.blockedBy] ?? result.blockedBy}`)
-        );
-      }
-      if (result.changeHint) {
-        console.error(chalk4.cyan(`   To change:  ${result.changeHint}`));
-      }
       process.exit(1);
     }
     console.error(chalk4.green("\n\u2705 Approved \u2014 running command...\n"));
@@ -2713,13 +3525,33 @@ program.argument("[command...]", "The agent command to run (e.g., gemini)").acti
     program.help();
   }
 });
+program.command("undo").description("Revert the project to the state before the last AI action").action(async () => {
+  const hash = getLatestSnapshotHash();
+  if (!hash) {
+    console.log(chalk4.yellow("\n\u2139\uFE0F  No Undo snapshot found for this machine.\n"));
+    return;
+  }
+  console.log(chalk4.magenta.bold("\n\u23EA NODE9 UNDO ENGINE"));
+  console.log(chalk4.white(`Target Snapshot: ${chalk4.gray(hash.slice(0, 7))}`));
+  const proceed = await confirm3({
+    message: "Revert all files to the state before the last AI action?",
+    default: false
+  });
+  if (proceed) {
+    if (applyUndo(hash)) {
+      console.log(chalk4.green("\u2705 Project reverted successfully.\n"));
+    } else {
+      console.error(chalk4.red("\u274C Undo failed. Ensure you are in a Git repository.\n"));
+    }
+  }
+});
 process.on("unhandledRejection", (reason) => {
   const isCheckHook = process.argv[2] === "check";
   if (isCheckHook) {
-    if (process.env.NODE9_DEBUG === "1") {
-      const logPath = path4.join(os4.homedir(), ".node9", "hook-debug.log");
+    if (process.env.NODE9_DEBUG === "1" || getConfig().settings.enableHookLogDebug) {
+      const logPath = path5.join(os5.homedir(), ".node9", "hook-debug.log");
       const msg = reason instanceof Error ? reason.message : String(reason);
-      fs4.appendFileSync(logPath, `[${(/* @__PURE__ */ new Date()).toISOString()}] UNHANDLED: ${msg}
+      fs5.appendFileSync(logPath, `[${(/* @__PURE__ */ new Date()).toISOString()}] UNHANDLED: ${msg}
 `);
     }
     process.exit(0);