@node9/proxy 0.2.1 → 1.0.1

package/dist/index.mjs

@@ -1,11 +1,242 @@
 // src/core.ts
-import chalk from "chalk";
+import chalk2 from "chalk";
 import { confirm } from "@inquirer/prompts";
 import fs from "fs";
 import path from "path";
 import os from "os";
 import pm from "picomatch";
 import { parse } from "sh-syntax";
+
+// src/ui/native.ts
+import { spawn } from "child_process";
+import chalk from "chalk";
+var isTestEnv = () => {
+  return process.env.NODE_ENV === "test" || process.env.VITEST === "true" || !!process.env.VITEST || process.env.CI === "true" || !!process.env.CI || process.env.NODE9_TESTING === "1";
+};
+function smartTruncate(str, maxLen = 500) {
+  if (str.length <= maxLen) return str;
+  const edge = Math.floor(maxLen / 2) - 3;
+  return `${str.slice(0, edge)} ... ${str.slice(-edge)}`;
+}
+function formatArgs(args) {
+  if (args === null || args === void 0) return "(none)";
+  let parsed = args;
+  if (typeof args === "string") {
+    const trimmed = args.trim();
+    if (trimmed.startsWith("{") && trimmed.endsWith("}")) {
+      try {
+        parsed = JSON.parse(trimmed);
+      } catch {
+        parsed = args;
+      }
+    } else {
+      return smartTruncate(args, 600);
+    }
+  }
+  if (typeof parsed === "object" && !Array.isArray(parsed)) {
+    const obj = parsed;
+    const codeKeys = [
+      "command",
+      "cmd",
+      "shell_command",
+      "bash_command",
+      "script",
+      "code",
+      "input",
+      "sql",
+      "query",
+      "arguments",
+      "args",
+      "param",
+      "params",
+      "text"
+    ];
+    const foundKey = Object.keys(obj).find((k) => codeKeys.includes(k.toLowerCase()));
+    if (foundKey) {
+      const val = obj[foundKey];
+      const str = typeof val === "string" ? val : JSON.stringify(val);
+      return `[${foundKey.toUpperCase()}]:
+${smartTruncate(str, 500)}`;
+    }
+    return Object.entries(obj).slice(0, 5).map(
+      ([k, v]) => `  ${k}: ${smartTruncate(typeof v === "string" ? v : JSON.stringify(v), 300)}`
+    ).join("\n");
+  }
+  return smartTruncate(JSON.stringify(parsed), 200);
+}
+function sendDesktopNotification(title, body) {
+  if (isTestEnv()) return;
+  try {
+    if (process.platform === "darwin") {
+      const script = `display notification "${body.replace(/"/g, '\\"')}" with title "${title.replace(/"/g, '\\"')}"`;
+      spawn("osascript", ["-e", script], { detached: true, stdio: "ignore" }).unref();
+    } else if (process.platform === "linux") {
+      spawn("notify-send", [title, body, "--icon=dialog-warning"], {
+        detached: true,
+        stdio: "ignore"
+      }).unref();
+    }
+  } catch {
+  }
+}
+async function askNativePopup(toolName, args, agent, explainableLabel, locked = false, signal) {
+  if (isTestEnv()) return "deny";
+  const formattedArgs = formatArgs(args);
+  const title = locked ? `\u26A1 Node9 \u2014 Locked` : `\u{1F6E1}\uFE0F Node9 \u2014 Action Approval`;
+  let message = "";
+  if (locked) message += `\u26A0\uFE0F LOCKED BY ADMIN POLICY
+`;
+  message += `Tool:  ${toolName}
+`;
+  message += `Agent: ${agent || "AI Agent"}
+`;
+  message += `Rule:  ${explainableLabel || "Security Policy"}
+
+`;
+  message += `${formattedArgs}`;
+  process.stderr.write(chalk.yellow(`
+\u{1F6E1}\uFE0F  Node9: Intercepted "${toolName}" \u2014 awaiting user...
+`));
+  return new Promise((resolve) => {
+    let childProcess = null;
+    const onAbort = () => {
+      if (childProcess && childProcess.pid) {
+        try {
+          process.kill(childProcess.pid, "SIGKILL");
+        } catch {
+        }
+      }
+      resolve("deny");
+    };
+    if (signal) {
+      if (signal.aborted) return resolve("deny");
+      signal.addEventListener("abort", onAbort);
+    }
+    try {
+      if (process.platform === "darwin") {
+        const buttons = locked ? `buttons {"Waiting\u2026"} default button "Waiting\u2026"` : `buttons {"Block", "Always Allow", "Allow"} default button "Allow" cancel button "Block"`;
+        const script = `on run argv
+tell application "System Events"
+activate
+display dialog (item 1 of argv) with title (item 2 of argv) ${buttons}
+end tell
+end run`;
+        childProcess = spawn("osascript", ["-e", script, "--", message, title]);
+      } else if (process.platform === "linux") {
+        const argsList = [
+          locked ? "--info" : "--question",
+          "--modal",
+          "--width=450",
+          "--title",
+          title,
+          "--text",
+          message,
+          "--ok-label",
+          locked ? "Waiting..." : "Allow",
+          "--timeout",
+          "300"
+        ];
+        if (!locked) {
+          argsList.push("--cancel-label", "Block");
+          argsList.push("--extra-button", "Always Allow");
+        }
+        childProcess = spawn("zenity", argsList);
+      } else if (process.platform === "win32") {
+        const b64Msg = Buffer.from(message).toString("base64");
+        const b64Title = Buffer.from(title).toString("base64");
+        const ps = `Add-Type -AssemblyName PresentationFramework; $msg = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String("${b64Msg}")); $title = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String("${b64Title}")); $res = [System.Windows.MessageBox]::Show($msg, $title, "${locked ? "OK" : "YesNo"}", "Warning", "Button2", "DefaultDesktopOnly"); if ($res -eq "Yes") { exit 0 } else { exit 1 }`;
+        childProcess = spawn("powershell", ["-Command", ps]);
+      }
+      let output = "";
+      childProcess?.stdout?.on("data", (d) => output += d.toString());
+      childProcess?.on("close", (code) => {
+        if (signal) signal.removeEventListener("abort", onAbort);
+        if (locked) return resolve("deny");
+        if (output.includes("Always Allow")) return resolve("always_allow");
+        if (code === 0) return resolve("allow");
+        resolve("deny");
+      });
+    } catch {
+      resolve("deny");
+    }
+  });
+}
+
+// src/core.ts
+var PAUSED_FILE = path.join(os.homedir(), ".node9", "PAUSED");
+var TRUST_FILE = path.join(os.homedir(), ".node9", "trust.json");
+function checkPause() {
+  try {
+    if (!fs.existsSync(PAUSED_FILE)) return { paused: false };
+    const state = JSON.parse(fs.readFileSync(PAUSED_FILE, "utf-8"));
+    if (state.expiry > 0 && Date.now() >= state.expiry) {
+      try {
+        fs.unlinkSync(PAUSED_FILE);
+      } catch {
+      }
+      return { paused: false };
+    }
+    return { paused: true, expiresAt: state.expiry, duration: state.duration };
+  } catch {
+    return { paused: false };
+  }
+}
+function atomicWriteSync(filePath, data, options) {
+  const dir = path.dirname(filePath);
+  if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true });
+  const tmpPath = `${filePath}.${os.hostname()}.${process.pid}.tmp`;
+  fs.writeFileSync(tmpPath, data, options);
+  fs.renameSync(tmpPath, filePath);
+}
+function getActiveTrustSession(toolName) {
+  try {
+    if (!fs.existsSync(TRUST_FILE)) return false;
+    const trust = JSON.parse(fs.readFileSync(TRUST_FILE, "utf-8"));
+    const now = Date.now();
+    const active = trust.entries.filter((e) => e.expiry > now);
+    if (active.length !== trust.entries.length) {
+      fs.writeFileSync(TRUST_FILE, JSON.stringify({ entries: active }, null, 2));
+    }
+    return active.some((e) => e.tool === toolName || matchesPattern(toolName, e.tool));
+  } catch {
+    return false;
+  }
+}
+function writeTrustSession(toolName, durationMs) {
+  try {
+    let trust = { entries: [] };
+    try {
+      if (fs.existsSync(TRUST_FILE)) {
+        trust = JSON.parse(fs.readFileSync(TRUST_FILE, "utf-8"));
+      }
+    } catch {
+    }
+    const now = Date.now();
+    trust.entries = trust.entries.filter((e) => e.tool !== toolName && e.expiry > now);
+    trust.entries.push({ tool: toolName, expiry: now + durationMs });
+    atomicWriteSync(TRUST_FILE, JSON.stringify(trust, null, 2));
+  } catch (err) {
+    if (process.env.NODE9_DEBUG === "1") {
+      console.error("[Node9 Trust Error]:", err);
+    }
+  }
+}
+function appendAuditModeEntry(toolName, args) {
+  try {
+    const entry = JSON.stringify({
+      ts: (/* @__PURE__ */ new Date()).toISOString(),
+      tool: toolName,
+      args,
+      decision: "would-have-blocked",
+      source: "audit-mode"
+    });
+    const logPath = path.join(os.homedir(), ".node9", "audit.log");
+    const dir = path.dirname(logPath);
+    if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true });
+    fs.appendFileSync(logPath, entry + "\n");
+  } catch {
+  }
+}
 var DANGEROUS_WORDS = [
   "delete",
   "drop",
@@ -23,10 +254,6 @@ var DANGEROUS_WORDS = [
 function tokenize(toolName) {
   return toolName.toLowerCase().split(/[_.\-\s]+/).filter(Boolean);
 }
-function containsDangerousWord(toolName, dangerousWords) {
-  const tokens = tokenize(toolName);
-  return dangerousWords.some((word) => tokens.includes(word.toLowerCase()));
-}
 function matchesPattern(text, patterns) {
   const p = Array.isArray(patterns) ? patterns : [patterns];
   if (p.length === 0) return false;
@@ -118,8 +345,15 @@ async function analyzeShellCommand(command) {
   return { actions, paths, allTokens };
 }
 var DEFAULT_CONFIG = {
-  settings: { mode: "standard" },
+  settings: {
+    mode: "standard",
+    autoStartDaemon: true,
+    enableUndo: false,
+    enableHookLogDebug: false,
+    approvers: { native: true, browser: true, cloud: true, terminal: true }
+  },
   policy: {
+    sandboxPaths: [],
     dangerousWords: DANGEROUS_WORDS,
     ignoredTools: [
       "list_*",
@@ -127,57 +361,16 @@ var DEFAULT_CONFIG = {
       "read_*",
       "describe_*",
       "read",
-      "write",
-      "edit",
-      "multiedit",
-      "glob",
       "grep",
       "ls",
-      "notebookread",
-      "notebookedit",
-      "todoread",
-      "todowrite",
-      "webfetch",
-      "websearch",
-      "exitplanmode",
       "askuserquestion"
     ],
-    toolInspection: {
-      bash: "command",
-      run_shell_command: "command",
-      shell: "command",
-      "terminal.execute": "command"
-    },
-    rules: [
-      { action: "rm", allowPaths: ["**/node_modules/**", "dist/**", "build/**", ".DS_Store"] }
-    ]
+    toolInspection: { bash: "command", shell: "command" },
+    rules: [{ action: "rm", allowPaths: ["**/node_modules/**", "dist/**", ".DS_Store"] }]
   },
   environments: {}
 };
 var cachedConfig = null;
-function getGlobalSettings() {
-  try {
-    const globalConfigPath = path.join(os.homedir(), ".node9", "config.json");
-    if (fs.existsSync(globalConfigPath)) {
-      const parsed = JSON.parse(fs.readFileSync(globalConfigPath, "utf-8"));
-      const settings = parsed.settings || {};
-      return {
-        mode: settings.mode || "standard",
-        autoStartDaemon: settings.autoStartDaemon !== false,
-        slackEnabled: settings.slackEnabled !== false,
-        // agentMode defaults to false — user must explicitly opt in via `node9 login`
-        agentMode: settings.agentMode === true
-      };
-    }
-  } catch {
-  }
-  return { mode: "standard", autoStartDaemon: true, slackEnabled: true, agentMode: false };
-}
-function hasSlack() {
-  const creds = getCredentials();
-  if (!creds?.apiKey) return false;
-  return getGlobalSettings().slackEnabled;
-}
 function getInternalToken() {
   try {
     const pidFile = path.join(os.homedir(), ".node9", "daemon.pid");
@@ -189,51 +382,83 @@ function getInternalToken() {
     return null;
   }
 }
-async function evaluatePolicy(toolName, args) {
+async function evaluatePolicy(toolName, args, agent) {
   const config = getConfig();
-  if (matchesPattern(toolName, config.policy.ignoredTools)) return "allow";
+  if (matchesPattern(toolName, config.policy.ignoredTools)) return { decision: "allow" };
+  let allTokens = [];
+  let actionTokens = [];
+  let pathTokens = [];
   const shellCommand = extractShellCommand(toolName, args, config.policy.toolInspection);
   if (shellCommand) {
-    const { actions, paths, allTokens } = await analyzeShellCommand(shellCommand);
+    const analyzed = await analyzeShellCommand(shellCommand);
+    allTokens = analyzed.allTokens;
+    actionTokens = analyzed.actions;
+    pathTokens = analyzed.paths;
     const INLINE_EXEC_PATTERN = /^(python3?|bash|sh|zsh|perl|ruby|node|php|lua)\s+(-c|-e|-eval)\s/i;
-    if (INLINE_EXEC_PATTERN.test(shellCommand.trim())) return "review";
-    for (const action of actions) {
-      const basename = action.includes("/") ? action.split("/").pop() : action;
-      const rule = config.policy.rules.find(
-        (r) => r.action === action || matchesPattern(action, r.action) || basename && (r.action === basename || matchesPattern(basename, r.action))
-      );
-      if (rule) {
-        if (paths.length > 0) {
-          const anyBlocked = paths.some((p) => matchesPattern(p, rule.blockPaths || []));
-          if (anyBlocked) return "review";
-          const allAllowed = paths.every((p) => matchesPattern(p, rule.allowPaths || []));
-          if (allAllowed) return "allow";
-        }
-        return "review";
-      }
+    if (INLINE_EXEC_PATTERN.test(shellCommand.trim())) {
+      return { decision: "review", blockedByLabel: "Node9 Standard (Inline Execution)" };
     }
-    const isDangerous2 = allTokens.some(
-      (token) => config.policy.dangerousWords.some((word) => {
-        const w = word.toLowerCase();
-        if (token === w) return true;
-        try {
-          return new RegExp(`\\b${w}\\b`, "i").test(token);
-        } catch {
-          return false;
-        }
-      })
+  } else {
+    allTokens = tokenize(toolName);
+    actionTokens = [toolName];
+  }
+  const isManual = agent === "Terminal";
+  if (isManual) {
+    const NUCLEAR_COMMANDS = [
+      "drop",
+      "destroy",
+      "purge",
+      "rmdir",
+      "format",
+      "truncate",
+      "alter",
+      "grant",
+      "revoke",
+      "docker"
+    ];
+    const hasNuclear = allTokens.some((t) => NUCLEAR_COMMANDS.includes(t.toLowerCase()));
+    if (!hasNuclear) return { decision: "allow" };
+  }
+  if (pathTokens.length > 0 && config.policy.sandboxPaths.length > 0) {
+    const allInSandbox = pathTokens.every((p) => matchesPattern(p, config.policy.sandboxPaths));
+    if (allInSandbox) return { decision: "allow" };
+  }
+  for (const action of actionTokens) {
+    const rule = config.policy.rules.find(
+      (r) => r.action === action || matchesPattern(action, r.action)
     );
-    if (isDangerous2) return "review";
-    if (config.settings.mode === "strict") return "review";
-    return "allow";
+    if (rule) {
+      if (pathTokens.length > 0) {
+        const anyBlocked = pathTokens.some((p) => matchesPattern(p, rule.blockPaths || []));
+        if (anyBlocked)
+          return { decision: "review", blockedByLabel: "Project/Global Config (Rule Block)" };
+        const allAllowed = pathTokens.every((p) => matchesPattern(p, rule.allowPaths || []));
+        if (allAllowed) return { decision: "allow" };
+      }
+      return { decision: "review", blockedByLabel: "Project/Global Config (Rule Default Block)" };
+    }
+  }
+  const isDangerous = allTokens.some(
+    (token) => config.policy.dangerousWords.some((word) => {
+      const w = word.toLowerCase();
+      if (token === w) return true;
+      try {
+        return new RegExp(`\\b${w}\\b`, "i").test(token);
+      } catch {
+        return false;
+      }
+    })
+  );
+  if (isDangerous) {
+    const label = isManual ? "Manual Nuclear Protection" : "Project/Global Config (Dangerous Word)";
+    return { decision: "review", blockedByLabel: label };
   }
-  const isDangerous = containsDangerousWord(toolName, config.policy.dangerousWords);
-  if (isDangerous || config.settings.mode === "strict") {
+  if (config.settings.mode === "strict") {
     const envConfig = getActiveEnvironment(config);
-    if (envConfig?.requireApproval === false) return "allow";
-    return "review";
+    if (envConfig?.requireApproval === false) return { decision: "allow" };
+    return { decision: "review", blockedByLabel: "Global Config (Strict Mode Active)" };
   }
-  return "allow";
+  return { decision: "allow" };
 }
 function isIgnoredTool(toolName) {
   const config = getConfig();
@@ -264,22 +489,40 @@ function getPersistentDecision(toolName) {
   }
   return null;
 }
-async function askDaemon(toolName, args, meta) {
+async function askDaemon(toolName, args, meta, signal) {
   const base = `http://${DAEMON_HOST}:${DAEMON_PORT}`;
-  const checkRes = await fetch(`${base}/check`, {
-    method: "POST",
-    headers: { "Content-Type": "application/json" },
-    body: JSON.stringify({ toolName, args, agent: meta?.agent, mcpServer: meta?.mcpServer }),
-    signal: AbortSignal.timeout(5e3)
-  });
-  if (!checkRes.ok) throw new Error("Daemon fail");
-  const { id } = await checkRes.json();
-  const waitRes = await fetch(`${base}/wait/${id}`, { signal: AbortSignal.timeout(12e4) });
-  if (!waitRes.ok) return "deny";
-  const { decision } = await waitRes.json();
-  if (decision === "allow") return "allow";
-  if (decision === "abandoned") return "abandoned";
-  return "deny";
+  const checkCtrl = new AbortController();
+  const checkTimer = setTimeout(() => checkCtrl.abort(), 5e3);
+  const onAbort = () => checkCtrl.abort();
+  if (signal) signal.addEventListener("abort", onAbort);
+  try {
+    const checkRes = await fetch(`${base}/check`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ toolName, args, agent: meta?.agent, mcpServer: meta?.mcpServer }),
+      signal: checkCtrl.signal
+    });
+    if (!checkRes.ok) throw new Error("Daemon fail");
+    const { id } = await checkRes.json();
+    const waitCtrl = new AbortController();
+    const waitTimer = setTimeout(() => waitCtrl.abort(), 12e4);
+    const onWaitAbort = () => waitCtrl.abort();
+    if (signal) signal.addEventListener("abort", onWaitAbort);
+    try {
+      const waitRes = await fetch(`${base}/wait/${id}`, { signal: waitCtrl.signal });
+      if (!waitRes.ok) return "deny";
+      const { decision } = await waitRes.json();
+      if (decision === "allow") return "allow";
+      if (decision === "abandoned") return "abandoned";
+      return "deny";
+    } finally {
+      clearTimeout(waitTimer);
+      if (signal) signal.removeEventListener("abort", onWaitAbort);
+    }
+  } finally {
+    clearTimeout(checkTimer);
+    if (signal) signal.removeEventListener("abort", onAbort);
+  }
 }
 async function notifyDaemonViewer(toolName, args, meta) {
   const base = `http://${DAEMON_HOST}:${DAEMON_PORT}`;
@@ -309,166 +552,353 @@ async function resolveViaDaemon(id, decision, internalToken) {
   });
 }
 async function authorizeHeadless(toolName, args, allowTerminalFallback = false, meta) {
-  const { agentMode } = getGlobalSettings();
-  const cloudEnforced = agentMode && hasSlack();
-  if (!cloudEnforced) {
-    if (isIgnoredTool(toolName)) return { approved: true };
-    const policyDecision = await evaluatePolicy(toolName, args);
-    if (policyDecision === "allow") return { approved: true, checkedBy: "local-policy" };
+  if (process.env.NODE9_PAUSED === "1") return { approved: true, checkedBy: "paused" };
+  const pauseState = checkPause();
+  if (pauseState.paused) return { approved: true, checkedBy: "paused" };
+  const creds = getCredentials();
+  const config = getConfig();
+  const isTestEnv2 = !!(process.env.VITEST || process.env.NODE_ENV === "test" || process.env.CI || process.env.NODE9_TESTING === "1");
+  const approvers = {
+    ...config.settings.approvers || { native: true, browser: true, cloud: true, terminal: true }
+  };
+  if (isTestEnv2) {
+    approvers.native = false;
+    approvers.browser = false;
+    approvers.terminal = false;
+  }
+  const isManual = meta?.agent === "Terminal";
+  let explainableLabel = "Local Config";
+  if (config.settings.mode === "audit") {
+    if (!isIgnoredTool(toolName)) {
+      const policyResult = await evaluatePolicy(toolName, args, meta?.agent);
+      if (policyResult.decision === "review") {
+        appendAuditModeEntry(toolName, args);
+        sendDesktopNotification(
+          "Node9 Audit Mode",
+          `Would have blocked "${toolName}" (${policyResult.blockedByLabel || "Local Config"}) \u2014 running in audit mode`
+        );
+      }
+    }
+    return { approved: true, checkedBy: "audit" };
+  }
+  if (!isIgnoredTool(toolName)) {
+    if (getActiveTrustSession(toolName)) {
+      if (creds?.apiKey) auditLocalAllow(toolName, args, "trust", creds, meta);
+      return { approved: true, checkedBy: "trust" };
+    }
+    const policyResult = await evaluatePolicy(toolName, args, meta?.agent);
+    if (policyResult.decision === "allow") {
+      if (creds?.apiKey) auditLocalAllow(toolName, args, "local-policy", creds, meta);
+      return { approved: true, checkedBy: "local-policy" };
+    }
+    explainableLabel = policyResult.blockedByLabel || "Local Config";
     const persistent = getPersistentDecision(toolName);
-    if (persistent === "allow") return { approved: true, checkedBy: "persistent" };
-    if (persistent === "deny")
+    if (persistent === "allow") {
+      if (creds?.apiKey) auditLocalAllow(toolName, args, "persistent", creds, meta);
+      return { approved: true, checkedBy: "persistent" };
+    }
+    if (persistent === "deny") {
       return {
         approved: false,
-        reason: `Node9: "${toolName}" is set to always deny.`,
+        reason: `This tool ("${toolName}") is explicitly listed in your 'Always Deny' list.`,
         blockedBy: "persistent-deny",
-        changeHint: `Open the daemon UI to manage decisions:  node9 daemon --openui`
+        blockedByLabel: "Persistent User Rule"
       };
-  }
-  if (cloudEnforced) {
-    const creds = getCredentials();
-    const envConfig = getActiveEnvironment(getConfig());
-    let viewerId = null;
-    const internalToken = getInternalToken();
-    if (isDaemonRunning() && internalToken) {
-      viewerId = await notifyDaemonViewer(toolName, args, meta).catch(() => null);
-    }
-    const approved = await callNode9SaaS(toolName, args, creds, envConfig?.slackChannel, meta);
-    if (viewerId && internalToken) {
-      resolveViaDaemon(viewerId, approved ? "allow" : "deny", internalToken).catch(() => null);
     }
-    return {
-      approved,
-      checkedBy: approved ? "cloud" : void 0,
-      blockedBy: approved ? void 0 : "team-policy",
-      changeHint: approved ? void 0 : `Visit your Node9 dashboard \u2192 Policy Studio to change this rule`
-    };
+  } else {
+    if (creds?.apiKey) auditLocalAllow(toolName, args, "ignoredTools", creds, meta);
+    return { approved: true };
   }
-  if (isDaemonRunning()) {
-    console.error(chalk.yellow("\n\u{1F6E1}\uFE0F  Node9: Action suspended \u2014 waiting for your approval."));
-    console.error(chalk.cyan(`   Browser UI \u2192 http://${DAEMON_HOST}:${DAEMON_PORT}/
-`));
+  let cloudRequestId = null;
+  let isRemoteLocked = false;
+  const cloudEnforced = approvers.cloud && !!creds?.apiKey;
+  if (cloudEnforced) {
     try {
-      const daemonDecision = await askDaemon(toolName, args, meta);
-      if (daemonDecision === "abandoned") {
-        console.error(chalk.yellow("\n\u26A0\uFE0F  Browser closed without a decision. Falling back..."));
-      } else {
+      const envConfig = getActiveEnvironment(getConfig());
+      const initResult = await initNode9SaaS(toolName, args, creds, envConfig?.slackChannel, meta);
+      if (!initResult.pending) {
         return {
-          approved: daemonDecision === "allow",
-          reason: daemonDecision === "deny" ? `Node9 blocked "${toolName}" \u2014 denied in browser.` : void 0,
-          checkedBy: daemonDecision === "allow" ? "daemon" : void 0,
-          blockedBy: daemonDecision === "deny" ? "local-decision" : void 0,
-          changeHint: daemonDecision === "deny" ? `Open the daemon UI to change:  node9 daemon --openui` : void 0
+          approved: !!initResult.approved,
+          reason: initResult.reason || (initResult.approved ? void 0 : "Action rejected by organization policy."),
+          checkedBy: initResult.approved ? "cloud" : void 0,
+          blockedBy: initResult.approved ? void 0 : "team-policy",
+          blockedByLabel: "Organization Policy (SaaS)"
         };
       }
-    } catch {
+      cloudRequestId = initResult.requestId || null;
+      isRemoteLocked = !!initResult.remoteApprovalOnly;
+      explainableLabel = "Organization Policy (SaaS)";
+    } catch (err) {
+      const error = err;
+      const isAuthError = error.message.includes("401") || error.message.includes("403");
+      const isNetworkError = error.message.includes("fetch") || error.name === "AbortError" || error.message.includes("ECONNREFUSED");
+      const reason = isAuthError ? "Invalid or missing API key. Run `node9 login` to generate a key (must start with n9_live_)." : isNetworkError ? "Could not reach the Node9 cloud. Check your network or API URL." : error.message;
+      console.error(
+        chalk2.yellow(`
+\u26A0\uFE0F  Node9: Cloud API Handshake failed \u2014 ${reason}`) + chalk2.dim(`
+   Falling back to local rules...
+`)
+      );
     }
   }
-  if (allowTerminalFallback && process.stdout.isTTY) {
-    console.log(chalk.bgRed.white.bold(` \u{1F6D1} NODE9 INTERCEPTOR `));
-    console.log(`${chalk.bold("Action:")} ${chalk.red(toolName)}`);
-    const argsPreview = JSON.stringify(args, null, 2);
-    console.log(
-      `${chalk.bold("Args:")}
-${chalk.gray(argsPreview.length > 500 ? argsPreview.slice(0, 500) + "..." : argsPreview)}`
+  if (cloudEnforced && cloudRequestId) {
+    console.error(
+      chalk2.yellow("\n\u{1F6E1}\uFE0F  Node9: Action suspended \u2014 waiting for Organization approval.")
     );
-    const controller = new AbortController();
-    const TIMEOUT_MS = 3e4;
-    const timer = setTimeout(() => controller.abort(), TIMEOUT_MS);
-    try {
-      const approved = await confirm(
-        { message: `Authorize? (auto-deny in ${TIMEOUT_MS / 1e3}s)`, default: false },
-        { signal: controller.signal }
-      );
-      clearTimeout(timer);
-      return { approved };
-    } catch {
-      clearTimeout(timer);
-      console.error(chalk.yellow("\n\u23F1  Prompt timed out \u2014 action denied by default."));
-      return { approved: false };
+    console.error(chalk2.cyan("   Dashboard  \u2192 ") + chalk2.bold("Mission Control > Activity Feed\n"));
+  } else if (!cloudEnforced) {
+    const cloudOffReason = !creds?.apiKey ? "no API key \u2014 run `node9 login` to connect" : "privacy mode (cloud disabled)";
+    console.error(
+      chalk2.dim(`
+\u{1F6E1}\uFE0F  Node9: intercepted "${toolName}" \u2014 cloud off (${cloudOffReason})
+`)
+    );
+  }
+  const abortController = new AbortController();
+  const { signal } = abortController;
+  const racePromises = [];
+  let viewerId = null;
+  const internalToken = getInternalToken();
+  if (cloudEnforced && cloudRequestId) {
+    racePromises.push(
+      (async () => {
+        try {
+          if (isDaemonRunning() && internalToken) {
+            viewerId = await notifyDaemonViewer(toolName, args, meta).catch(() => null);
+          }
+          const cloudResult = await pollNode9SaaS(cloudRequestId, creds, signal);
+          return {
+            approved: cloudResult.approved,
+            reason: cloudResult.approved ? void 0 : cloudResult.reason || "Action rejected by organization administrator via Slack.",
+            checkedBy: cloudResult.approved ? "cloud" : void 0,
+            blockedBy: cloudResult.approved ? void 0 : "team-policy",
+            blockedByLabel: "Organization Policy (SaaS)"
+          };
+        } catch (err) {
+          const error = err;
+          if (error.name === "AbortError" || error.message?.includes("Aborted")) throw err;
+          throw err;
+        }
+      })()
+    );
+  }
+  if (approvers.native && !isManual) {
+    racePromises.push(
+      (async () => {
+        const decision = await askNativePopup(
+          toolName,
+          args,
+          meta?.agent,
+          explainableLabel,
+          isRemoteLocked,
+          signal
+        );
+        if (decision === "always_allow") {
+          writeTrustSession(toolName, 36e5);
+          return { approved: true, checkedBy: "trust" };
+        }
+        const isApproved = decision === "allow";
+        return {
+          approved: isApproved,
+          reason: isApproved ? void 0 : "The human user clicked 'Block' on the system dialog window.",
+          checkedBy: isApproved ? "daemon" : void 0,
+          blockedBy: isApproved ? void 0 : "local-decision",
+          blockedByLabel: "User Decision (Native)"
+        };
+      })()
+    );
+  }
+  if (approvers.browser && isDaemonRunning()) {
+    racePromises.push(
+      (async () => {
+        try {
+          if (!approvers.native && !cloudEnforced) {
+            console.error(
+              chalk2.yellow("\n\u{1F6E1}\uFE0F  Node9: Action suspended \u2014 waiting for browser approval.")
+            );
+            console.error(chalk2.cyan(`   URL \u2192 http://${DAEMON_HOST}:${DAEMON_PORT}/
+`));
+          }
+          const daemonDecision = await askDaemon(toolName, args, meta, signal);
+          if (daemonDecision === "abandoned") throw new Error("Abandoned");
+          const isApproved = daemonDecision === "allow";
+          return {
+            approved: isApproved,
+            reason: isApproved ? void 0 : "The human user rejected this action via the Node9 Browser Dashboard.",
+            checkedBy: isApproved ? "daemon" : void 0,
+            blockedBy: isApproved ? void 0 : "local-decision",
+            blockedByLabel: "User Decision (Browser)"
+          };
+        } catch (err) {
+          throw err;
+        }
+      })()
+    );
+  }
+  if (approvers.terminal && allowTerminalFallback && process.stdout.isTTY) {
+    racePromises.push(
+      (async () => {
+        try {
+          console.log(chalk2.bgRed.white.bold(` \u{1F6D1} NODE9 INTERCEPTOR `));
+          console.log(`${chalk2.bold("Action:")} ${chalk2.red(toolName)}`);
+          console.log(`${chalk2.bold("Flagged By:")} ${chalk2.yellow(explainableLabel)}`);
+          if (isRemoteLocked) {
+            console.log(chalk2.yellow(`\u26A1 LOCKED BY ADMIN POLICY: Waiting for Slack Approval...
+`));
+            await new Promise((_, reject) => {
+              signal.addEventListener("abort", () => reject(new Error("Aborted by SaaS")));
+            });
+          }
+          const TIMEOUT_MS = 6e4;
+          let timer;
+          const result = await new Promise((resolve, reject) => {
+            timer = setTimeout(() => reject(new Error("Terminal Timeout")), TIMEOUT_MS);
+            confirm(
+              { message: `Authorize? (auto-deny in ${TIMEOUT_MS / 1e3}s)`, default: false },
+              { signal }
+            ).then(resolve).catch(reject);
+          });
+          clearTimeout(timer);
+          return {
+            approved: result,
+            reason: result ? void 0 : "The human user typed 'N' in the terminal to reject this action.",
+            checkedBy: result ? "terminal" : void 0,
+            blockedBy: result ? void 0 : "local-decision",
+            blockedByLabel: "User Decision (Terminal)"
+          };
+        } catch (err) {
+          const error = err;
+          if (error.name === "AbortError" || error.message?.includes("Prompt was canceled") || error.message?.includes("Aborted by SaaS"))
+            throw err;
+          if (error.message === "Terminal Timeout") {
+            return {
+              approved: false,
+              reason: "The terminal prompt timed out without a human response.",
+              blockedBy: "local-decision"
+            };
+          }
+          throw err;
+        }
+      })()
+    );
+  }
+  if (racePromises.length === 0) {
+    return {
+      approved: false,
+      noApprovalMechanism: true,
+      reason: `NODE9 SECURITY INTERVENTION: Action blocked by automated policy [${explainableLabel}].
+REASON: Action blocked because no approval channels are available. (Native/Browser UI is disabled in config, and this terminal is non-interactive).`,
+      blockedBy: "no-approval-mechanism",
+      blockedByLabel: explainableLabel
+    };
+  }
+  const finalResult = await new Promise((resolve) => {
+    let resolved = false;
+    let failures = 0;
+    const total = racePromises.length;
+    const finish = (res) => {
+      if (!resolved) {
+        resolved = true;
+        abortController.abort();
+        if (viewerId && internalToken) {
+          resolveViaDaemon(viewerId, res.approved ? "allow" : "deny", internalToken).catch(
+            () => null
+          );
+        }
+        resolve(res);
+      }
+    };
+    for (const p of racePromises) {
+      p.then(finish).catch((err) => {
+        if (err.name === "AbortError" || err.message?.includes("canceled") || err.message?.includes("Aborted"))
+          return;
+        if (err.message === "Abandoned") {
+          finish({
+            approved: false,
+            reason: "Browser dashboard closed without making a decision.",
+            blockedBy: "local-decision",
+            blockedByLabel: "Browser Dashboard (Abandoned)"
+          });
+          return;
+        }
+        failures++;
+        if (failures === total && !resolved) {
+          finish({ approved: false, reason: "All approval channels failed or disconnected." });
+        }
+      });
     }
+  });
+  if (cloudRequestId && creds && finalResult.checkedBy !== "cloud") {
+    await resolveNode9SaaS(cloudRequestId, creds, finalResult.approved);
   }
-  return {
-    approved: false,
-    noApprovalMechanism: true,
-    reason: `Node9 blocked "${toolName}". No approval mechanism is active.`,
-    blockedBy: "no-approval-mechanism",
-    changeHint: `Start the approval daemon:  node9 daemon --background
-   Or connect to your team:   node9 login <apiKey>`
-  };
+  return finalResult;
 }
 function getConfig() {
   if (cachedConfig) return cachedConfig;
-  const projectConfig = tryLoadConfig(path.join(process.cwd(), "node9.config.json"));
-  if (projectConfig) {
-    cachedConfig = buildConfig(projectConfig);
-    return cachedConfig;
-  }
-  const globalConfig = tryLoadConfig(path.join(os.homedir(), ".node9", "config.json"));
-  if (globalConfig) {
-    cachedConfig = buildConfig(globalConfig);
-    return cachedConfig;
-  }
-  cachedConfig = DEFAULT_CONFIG;
+  const globalPath = path.join(os.homedir(), ".node9", "config.json");
+  const projectPath = path.join(process.cwd(), "node9.config.json");
+  const globalConfig = tryLoadConfig(globalPath);
+  const projectConfig = tryLoadConfig(projectPath);
+  const mergedSettings = {
+    ...DEFAULT_CONFIG.settings,
+    approvers: { ...DEFAULT_CONFIG.settings.approvers }
+  };
+  const mergedPolicy = {
+    sandboxPaths: [...DEFAULT_CONFIG.policy.sandboxPaths],
+    dangerousWords: [...DEFAULT_CONFIG.policy.dangerousWords],
+    ignoredTools: [...DEFAULT_CONFIG.policy.ignoredTools],
+    toolInspection: { ...DEFAULT_CONFIG.policy.toolInspection },
+    rules: [...DEFAULT_CONFIG.policy.rules]
+  };
+  const applyLayer = (source) => {
+    if (!source) return;
+    const s = source.settings || {};
+    const p = source.policy || {};
+    if (s.mode !== void 0) mergedSettings.mode = s.mode;
+    if (s.autoStartDaemon !== void 0) mergedSettings.autoStartDaemon = s.autoStartDaemon;
+    if (s.enableUndo !== void 0) mergedSettings.enableUndo = s.enableUndo;
+    if (s.enableHookLogDebug !== void 0)
+      mergedSettings.enableHookLogDebug = s.enableHookLogDebug;
+    if (s.approvers) mergedSettings.approvers = { ...mergedSettings.approvers, ...s.approvers };
+    if (p.sandboxPaths) mergedPolicy.sandboxPaths.push(...p.sandboxPaths);
+    if (p.dangerousWords) mergedPolicy.dangerousWords = [...p.dangerousWords];
+    if (p.ignoredTools) mergedPolicy.ignoredTools.push(...p.ignoredTools);
+    if (p.toolInspection)
+      mergedPolicy.toolInspection = { ...mergedPolicy.toolInspection, ...p.toolInspection };
+    if (p.rules) mergedPolicy.rules.push(...p.rules);
+  };
+  applyLayer(globalConfig);
+  applyLayer(projectConfig);
+  if (process.env.NODE9_MODE) mergedSettings.mode = process.env.NODE9_MODE;
+  mergedPolicy.sandboxPaths = [...new Set(mergedPolicy.sandboxPaths)];
+  mergedPolicy.dangerousWords = [...new Set(mergedPolicy.dangerousWords)];
+  mergedPolicy.ignoredTools = [...new Set(mergedPolicy.ignoredTools)];
+  cachedConfig = {
+    settings: mergedSettings,
+    policy: mergedPolicy,
+    environments: {}
+  };
   return cachedConfig;
 }
 function tryLoadConfig(filePath) {
   if (!fs.existsSync(filePath)) return null;
   try {
-    const config = JSON.parse(fs.readFileSync(filePath, "utf-8"));
-    validateConfig(config, filePath);
-    return config;
+    return JSON.parse(fs.readFileSync(filePath, "utf-8"));
   } catch {
     return null;
   }
 }
-function validateConfig(config, path2) {
-  const allowedTopLevel = ["version", "settings", "policy", "environments", "apiKey", "apiUrl"];
-  Object.keys(config).forEach((key) => {
-    if (!allowedTopLevel.includes(key))
-      console.warn(chalk.yellow(`\u26A0\uFE0F  Node9: Unknown top-level key "${key}" in ${path2}`));
-  });
-}
-function buildConfig(parsed) {
-  const p = parsed.policy || {};
-  const s = parsed.settings || {};
-  return {
-    settings: {
-      mode: s.mode ?? DEFAULT_CONFIG.settings.mode,
-      autoStartDaemon: s.autoStartDaemon ?? DEFAULT_CONFIG.settings.autoStartDaemon
-    },
-    policy: {
-      dangerousWords: p.dangerousWords ?? DEFAULT_CONFIG.policy.dangerousWords,
-      ignoredTools: p.ignoredTools ?? DEFAULT_CONFIG.policy.ignoredTools,
-      toolInspection: p.toolInspection ?? DEFAULT_CONFIG.policy.toolInspection,
-      rules: p.rules ?? DEFAULT_CONFIG.policy.rules
-    },
-    environments: parsed.environments || {}
-  };
-}
 function getActiveEnvironment(config) {
   const env = process.env.NODE_ENV || "development";
   return config.environments[env] ?? null;
 }
 function getCredentials() {
   const DEFAULT_API_URL = "https://api.node9.ai/api/v1/intercept";
-  if (process.env.NODE9_API_KEY)
+  if (process.env.NODE9_API_KEY) {
     return {
       apiKey: process.env.NODE9_API_KEY,
       apiUrl: process.env.NODE9_API_URL || DEFAULT_API_URL
     };
-  try {
-    const projectConfigPath = path.join(process.cwd(), "node9.config.json");
-    if (fs.existsSync(projectConfigPath)) {
-      const projectConfig = JSON.parse(fs.readFileSync(projectConfigPath, "utf-8"));
-      if (typeof projectConfig.apiKey === "string" && projectConfig.apiKey) {
-        return {
-          apiKey: projectConfig.apiKey,
-          apiUrl: typeof projectConfig.apiUrl === "string" && projectConfig.apiUrl || DEFAULT_API_URL
-        };
-      }
-    }
-  } catch {
   }
   try {
     const credPath = path.join(os.homedir(), ".node9", "credentials.json");
@@ -497,10 +927,32 @@ async function authorizeAction(toolName, args) {
   const result = await authorizeHeadless(toolName, args, true);
   return result.approved;
 }
-async function callNode9SaaS(toolName, args, creds, slackChannel, meta) {
+function auditLocalAllow(toolName, args, checkedBy, creds, meta) {
+  const controller = new AbortController();
+  setTimeout(() => controller.abort(), 5e3);
+  fetch(`${creds.apiUrl}/audit`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json", Authorization: `Bearer ${creds.apiKey}` },
+    body: JSON.stringify({
+      toolName,
+      args,
+      checkedBy,
+      context: {
+        agent: meta?.agent,
+        mcpServer: meta?.mcpServer,
+        hostname: os.hostname(),
+        cwd: process.cwd(),
+        platform: os.platform()
+      }
+    }),
+    signal: controller.signal
+  }).catch(() => {
+  });
+}
+async function initNode9SaaS(toolName, args, creds, slackChannel, meta) {
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), 1e4);
   try {
-    const controller = new AbortController();
-    const timeout = setTimeout(() => controller.abort(), 35e3);
     const response = await fetch(creds.apiUrl, {
       method: "POST",
       headers: { "Content-Type": "application/json", Authorization: `Bearer ${creds.apiKey}` },
@@ -518,46 +970,55 @@ async function callNode9SaaS(toolName, args, creds, slackChannel, meta) {
       }),
       signal: controller.signal
     });
+    if (!response.ok) throw new Error(`HTTP ${response.status}`);
+    return await response.json();
+  } finally {
     clearTimeout(timeout);
-    if (!response.ok) throw new Error("API fail");
-    const data = await response.json();
-    if (!data.pending) return data.approved;
-    if (!data.requestId) return false;
-    const statusUrl = `${creds.apiUrl}/status/${data.requestId}`;
-    console.error(chalk.yellow("\n\u{1F6E1}\uFE0F  Node9: Action suspended \u2014 waiting for your approval."));
-    if (isDaemonRunning()) {
-      console.error(
-        chalk.cyan("   Browser UI \u2192 ") + chalk.bold(`http://${DAEMON_HOST}:${DAEMON_PORT}/`)
-      );
-    }
-    console.error(chalk.cyan("   Dashboard  \u2192 ") + chalk.bold("Mission Control > Flows"));
-    console.error(chalk.gray("   Agent is paused. Approve or deny to continue.\n"));
-    const POLL_INTERVAL_MS = 3e3;
-    const POLL_DEADLINE = Date.now() + 5 * 60 * 1e3;
-    while (Date.now() < POLL_DEADLINE) {
-      await new Promise((r) => setTimeout(r, POLL_INTERVAL_MS));
-      try {
-        const statusRes = await fetch(statusUrl, {
-          headers: { Authorization: `Bearer ${creds.apiKey}` },
-          signal: AbortSignal.timeout(5e3)
-        });
-        if (!statusRes.ok) continue;
-        const { status } = await statusRes.json();
-        if (status === "APPROVED") {
-          console.error(chalk.green("\u2705  Approved \u2014 continuing.\n"));
-          return true;
-        }
-        if (status === "DENIED" || status === "AUTO_BLOCKED" || status === "TIMED_OUT") {
-          console.error(chalk.red("\u274C  Denied \u2014 action blocked.\n"));
-          return false;
-        }
-      } catch {
+  }
+}
+async function pollNode9SaaS(requestId, creds, signal) {
+  const statusUrl = `${creds.apiUrl}/status/${requestId}`;
+  const POLL_INTERVAL_MS = 1e3;
+  const POLL_DEADLINE = Date.now() + 10 * 60 * 1e3;
+  while (Date.now() < POLL_DEADLINE) {
+    if (signal.aborted) throw new Error("Aborted");
+    await new Promise((r) => setTimeout(r, POLL_INTERVAL_MS));
+    try {
+      const pollCtrl = new AbortController();
+      const pollTimer = setTimeout(() => pollCtrl.abort(), 5e3);
+      const statusRes = await fetch(statusUrl, {
+        headers: { Authorization: `Bearer ${creds.apiKey}` },
+        signal: pollCtrl.signal
+      });
+      clearTimeout(pollTimer);
+      if (!statusRes.ok) continue;
+      const { status, reason } = await statusRes.json();
+      if (status === "APPROVED") {
+        console.error(chalk2.green("\u2705  Approved via Cloud.\n"));
+        return { approved: true, reason };
       }
+      if (status === "DENIED" || status === "AUTO_BLOCKED" || status === "TIMED_OUT") {
+        console.error(chalk2.red("\u274C  Denied via Cloud.\n"));
+        return { approved: false, reason };
+      }
+    } catch {
     }
-    console.error(chalk.yellow("\u23F1  Timed out waiting for approval \u2014 action blocked.\n"));
-    return false;
+  }
+  return { approved: false, reason: "Cloud approval timed out after 10 minutes." };
+}
+async function resolveNode9SaaS(requestId, creds, approved) {
+  try {
+    const resolveUrl = `${creds.apiUrl}/requests/${requestId}`;
+    const ctrl = new AbortController();
+    const timer = setTimeout(() => ctrl.abort(), 5e3);
+    await fetch(resolveUrl, {
+      method: "PATCH",
+      headers: { "Content-Type": "application/json", Authorization: `Bearer ${creds.apiKey}` },
+      body: JSON.stringify({ decision: approved ? "APPROVED" : "DENIED" }),
+      signal: ctrl.signal
+    });
+    clearTimeout(timer);
   } catch {
-    return false;
   }
 }