@node9/proxy 1.0.0 → 1.0.2

package/dist/cli.mjs

@@ -4,7 +4,7 @@
 import { Command } from "commander";
 
 // src/core.ts
-import chalk from "chalk";
+import chalk2 from "chalk";
 import { confirm } from "@inquirer/prompts";
 import fs from "fs";
 import path from "path";
@@ -14,19 +14,69 @@ import { parse } from "sh-syntax";
 
 // src/ui/native.ts
 import { spawn } from "child_process";
+import chalk from "chalk";
 var isTestEnv = () => {
   return process.env.NODE_ENV === "test" || process.env.VITEST === "true" || !!process.env.VITEST || process.env.CI === "true" || !!process.env.CI || process.env.NODE9_TESTING === "1";
 };
+function smartTruncate(str, maxLen = 500) {
+  if (str.length <= maxLen) return str;
+  const edge = Math.floor(maxLen / 2) - 3;
+  return `${str.slice(0, edge)} ... ${str.slice(-edge)}`;
+}
+function formatArgs(args) {
+  if (args === null || args === void 0) return "(none)";
+  let parsed = args;
+  if (typeof args === "string") {
+    const trimmed = args.trim();
+    if (trimmed.startsWith("{") && trimmed.endsWith("}")) {
+      try {
+        parsed = JSON.parse(trimmed);
+      } catch {
+        parsed = args;
+      }
+    } else {
+      return smartTruncate(args, 600);
+    }
+  }
+  if (typeof parsed === "object" && !Array.isArray(parsed)) {
+    const obj = parsed;
+    const codeKeys = [
+      "command",
+      "cmd",
+      "shell_command",
+      "bash_command",
+      "script",
+      "code",
+      "input",
+      "sql",
+      "query",
+      "arguments",
+      "args",
+      "param",
+      "params",
+      "text"
+    ];
+    const foundKey = Object.keys(obj).find((k) => codeKeys.includes(k.toLowerCase()));
+    if (foundKey) {
+      const val = obj[foundKey];
+      const str = typeof val === "string" ? val : JSON.stringify(val);
+      return `[${foundKey.toUpperCase()}]:
+${smartTruncate(str, 500)}`;
+    }
+    return Object.entries(obj).slice(0, 5).map(
+      ([k, v]) => `  ${k}: ${smartTruncate(typeof v === "string" ? v : JSON.stringify(v), 300)}`
+    ).join("\n");
+  }
+  return smartTruncate(JSON.stringify(parsed), 200);
+}
 function sendDesktopNotification(title, body) {
   if (isTestEnv()) return;
   try {
-    const safeTitle = title.replace(/"/g, '\\"');
-    const safeBody = body.replace(/"/g, '\\"');
     if (process.platform === "darwin") {
-      const script = `display notification "${safeBody}" with title "${safeTitle}"`;
+      const script = `display notification "${body.replace(/"/g, '\\"')}" with title "${title.replace(/"/g, '\\"')}"`;
       spawn("osascript", ["-e", script], { detached: true, stdio: "ignore" }).unref();
     } else if (process.platform === "linux") {
-      spawn("notify-send", [safeTitle, safeBody, "--icon=dialog-warning"], {
+      spawn("notify-send", [title, body, "--icon=dialog-warning"], {
         detached: true,
         stdio: "ignore"
       }).unref();
@@ -34,69 +84,54 @@ function sendDesktopNotification(title, body) {
   } catch {
   }
 }
-function formatArgs(args) {
-  if (args === null || args === void 0) return "(none)";
-  if (typeof args !== "object" || Array.isArray(args)) {
-    const str = typeof args === "string" ? args : JSON.stringify(args);
-    return str.length > 200 ? str.slice(0, 200) + "\u2026" : str;
-  }
-  const entries = Object.entries(args).filter(
-    ([, v]) => v !== null && v !== void 0 && v !== ""
-  );
-  if (entries.length === 0) return "(none)";
-  const MAX_FIELDS = 5;
-  const MAX_VALUE_LEN = 120;
-  const lines = entries.slice(0, MAX_FIELDS).map(([key, val]) => {
-    const str = typeof val === "string" ? val : JSON.stringify(val);
-    const truncated = str.length > MAX_VALUE_LEN ? str.slice(0, MAX_VALUE_LEN) + "\u2026" : str;
-    return `  ${key}: ${truncated}`;
-  });
-  if (entries.length > MAX_FIELDS) {
-    lines.push(`  \u2026 and ${entries.length - MAX_FIELDS} more field(s)`);
+function escapePango(text) {
+  return text.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+}
+function buildPlainMessage(toolName, formattedArgs, agent, explainableLabel, locked) {
+  const lines = [];
+  if (locked) lines.push("\u26A0\uFE0F  LOCKED BY ADMIN POLICY\n");
+  lines.push(`\u{1F916} ${agent || "AI Agent"}  |  \u{1F527} ${toolName}`);
+  lines.push(`\u{1F6E1}\uFE0F  ${explainableLabel || "Security Policy"}`);
+  lines.push("");
+  lines.push(formattedArgs);
+  if (!locked) {
+    lines.push("");
+    lines.push('\u21B5 Enter = Allow \u21B5   |   \u238B Esc = Block \u238B   |   "Always Allow" = never ask again');
   }
   return lines.join("\n");
 }
-async function askNativePopup(toolName, args, agent, explainableLabel, locked = false, signal) {
-  if (isTestEnv()) return "deny";
-  if (process.env.NODE9_DEBUG === "1" || process.env.VITEST) {
-    console.log(`[DEBUG Native] askNativePopup called for: ${toolName}`);
-    console.log(`[DEBUG Native] isTestEnv check:`, {
-      VITEST: process.env.VITEST,
-      NODE_ENV: process.env.NODE_ENV,
-      CI: process.env.CI,
-      isTest: isTestEnv()
-    });
-  }
-  const title = locked ? `\u26A1 Node9 \u2014 Locked by Admin Policy` : `\u{1F6E1}\uFE0F Node9 \u2014 Action Requires Approval`;
-  let message = "";
+function buildPangoMessage(toolName, formattedArgs, agent, explainableLabel, locked) {
+  const lines = [];
   if (locked) {
-    message += `\u26A1 Awaiting remote approval via Slack. Local override is disabled.
-`;
-    message += `\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
-`;
-  }
-  message += `Tool:    ${toolName}
-`;
-  message += `Agent:   ${agent || "AI Agent"}
-`;
-  if (explainableLabel) {
-    message += `Reason:  ${explainableLabel}
-`;
+    lines.push('<span foreground="red" weight="bold">\u26A0\uFE0F  LOCKED BY ADMIN POLICY</span>');
+    lines.push("");
   }
-  message += `
-Arguments:
-${formatArgs(args)}`;
+  lines.push(
+    `<b>\u{1F916} ${escapePango(agent || "AI Agent")}</b>  |  <b>\u{1F527} <tt>${escapePango(toolName)}</tt></b>`
+  );
+  lines.push(`<i>\u{1F6E1}\uFE0F  ${escapePango(explainableLabel || "Security Policy")}</i>`);
+  lines.push("");
+  lines.push(`<tt>${escapePango(formattedArgs)}</tt>`);
   if (!locked) {
-    message += `
-
-Enter = Allow  |  Click "Block" to deny`;
+    lines.push("");
+    lines.push(
+      '<small>\u21B5 Enter = <b>Allow \u21B5</b>   |   \u238B Esc = <b>Block \u238B</b>   |   "Always Allow" = never ask again</small>'
+    );
   }
-  const safeMessage = message.replace(/\\/g, "\\\\").replace(/"/g, '\\"').replace(/`/g, "'");
-  const safeTitle = title.replace(/"/g, '\\"');
+  return lines.join("\n");
+}
+async function askNativePopup(toolName, args, agent, explainableLabel, locked = false, signal) {
+  if (isTestEnv()) return "deny";
+  const formattedArgs = formatArgs(args);
+  const title = locked ? `\u26A1 Node9 \u2014 Locked` : `\u{1F6E1}\uFE0F Node9 \u2014 Action Approval`;
+  const message = buildPlainMessage(toolName, formattedArgs, agent, explainableLabel, locked);
+  process.stderr.write(chalk.yellow(`
+\u{1F6E1}\uFE0F  Node9: Intercepted "${toolName}" \u2014 awaiting user...
+`));
   return new Promise((resolve) => {
     let childProcess = null;
     const onAbort = () => {
-      if (childProcess) {
+      if (childProcess && childProcess.pid) {
         try {
           process.kill(childProcess.pid, "SIGKILL");
         } catch {
@@ -108,83 +143,58 @@ Enter = Allow  |  Click "Block" to deny`;
       if (signal.aborted) return resolve("deny");
       signal.addEventListener("abort", onAbort);
     }
-    const cleanup = () => {
-      if (signal) signal.removeEventListener("abort", onAbort);
-    };
     try {
       if (process.platform === "darwin") {
-        const buttons = locked ? `buttons {"Waiting\u2026"} default button "Waiting\u2026"` : `buttons {"Block", "Always Allow", "Allow"} default button "Allow" cancel button "Block"`;
-        const script = `
-          tell application "System Events"
-            activate
-            display dialog "${safeMessage}" with title "${safeTitle}" ${buttons}
-          end tell`;
-        childProcess = spawn("osascript", ["-e", script]);
-        let output = "";
-        childProcess.stdout?.on("data", (d) => output += d.toString());
-        childProcess.on("close", (code) => {
-          cleanup();
-          if (locked) return resolve("deny");
-          if (code === 0) {
-            if (output.includes("Always Allow")) return resolve("always_allow");
-            if (output.includes("Allow")) return resolve("allow");
-          }
-          resolve("deny");
-        });
+        const buttons = locked ? `buttons {"Waiting\u2026"} default button "Waiting\u2026"` : `buttons {"Block \u238B", "Always Allow", "Allow \u21B5"} default button "Allow \u21B5" cancel button "Block \u238B"`;
+        const script = `on run argv
+tell application "System Events"
+activate
+display dialog (item 1 of argv) with title (item 2 of argv) ${buttons}
+end tell
+end run`;
+        childProcess = spawn("osascript", ["-e", script, "--", message, title]);
       } else if (process.platform === "linux") {
-        const argsList = locked ? [
-          "--info",
-          "--title",
-          title,
-          "--text",
-          safeMessage,
-          "--ok-label",
-          "Waiting for Slack\u2026",
-          "--timeout",
-          "300"
-        ] : [
-          "--question",
+        const pangoMessage = buildPangoMessage(
+          toolName,
+          formattedArgs,
+          agent,
+          explainableLabel,
+          locked
+        );
+        const argsList = [
+          locked ? "--info" : "--question",
+          "--modal",
+          "--width=480",
           "--title",
           title,
           "--text",
-          safeMessage,
+          pangoMessage,
           "--ok-label",
-          "Allow",
-          "--cancel-label",
-          "Block",
-          "--extra-button",
-          "Always Allow",
+          locked ? "Waiting..." : "Allow  \u21B5",
           "--timeout",
           "300"
         ];
+        if (!locked) {
+          argsList.push("--cancel-label", "Block  \u238B");
+          argsList.push("--extra-button", "Always Allow");
+        }
         childProcess = spawn("zenity", argsList);
-        let output = "";
-        childProcess.stdout?.on("data", (d) => output += d.toString());
-        childProcess.on("close", (code) => {
-          cleanup();
-          if (locked) return resolve("deny");
-          if (output.trim() === "Always Allow") return resolve("always_allow");
-          if (code === 0) return resolve("allow");
-          resolve("deny");
-        });
       } else if (process.platform === "win32") {
-        const buttonType = locked ? "OK" : "YesNo";
-        const ps = `
-          Add-Type -AssemblyName PresentationFramework;
-          $res = [System.Windows.MessageBox]::Show("${safeMessage}", "${safeTitle}", "${buttonType}", "Warning", "Button2", "DefaultDesktopOnly");
-          if ($res -eq "Yes") { exit 0 } else { exit 1 }`;
+        const b64Msg = Buffer.from(message).toString("base64");
+        const b64Title = Buffer.from(title).toString("base64");
+        const ps = `Add-Type -AssemblyName PresentationFramework; $msg = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String("${b64Msg}")); $title = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String("${b64Title}")); $res = [System.Windows.MessageBox]::Show($msg, $title, "${locked ? "OK" : "YesNo"}", "Warning", "Button2", "DefaultDesktopOnly"); if ($res -eq "Yes") { exit 0 } else { exit 1 }`;
         childProcess = spawn("powershell", ["-Command", ps]);
-        childProcess.on("close", (code) => {
-          cleanup();
-          if (locked) return resolve("deny");
-          resolve(code === 0 ? "allow" : "deny");
-        });
-      } else {
-        cleanup();
-        resolve("deny");
       }
+      let output = "";
+      childProcess?.stdout?.on("data", (d) => output += d.toString());
+      childProcess?.on("close", (code) => {
+        if (signal) signal.removeEventListener("abort", onAbort);
+        if (locked) return resolve("deny");
+        if (output.includes("Always Allow")) return resolve("always_allow");
+        if (code === 0) return resolve("allow");
+        resolve("deny");
+      });
     } catch {
-      cleanup();
       resolve("deny");
     }
   });
@@ -193,6 +203,8 @@ Enter = Allow  |  Click "Block" to deny`;
 // src/core.ts
 var PAUSED_FILE = path.join(os.homedir(), ".node9", "PAUSED");
 var TRUST_FILE = path.join(os.homedir(), ".node9", "trust.json");
+var LOCAL_AUDIT_LOG = path.join(os.homedir(), ".node9", "audit.log");
+var HOOK_DEBUG_LOG = path.join(os.homedir(), ".node9", "hook-debug.log");
 function checkPause() {
   try {
     if (!fs.existsSync(PAUSED_FILE)) return { paused: false };
@@ -259,36 +271,39 @@ function writeTrustSession(toolName, durationMs) {
     }
   }
 }
-function appendAuditModeEntry(toolName, args) {
+function appendToLog(logPath, entry) {
   try {
-    const entry = JSON.stringify({
-      ts: (/* @__PURE__ */ new Date()).toISOString(),
-      tool: toolName,
-      args,
-      decision: "would-have-blocked",
-      source: "audit-mode"
-    });
-    const logPath = path.join(os.homedir(), ".node9", "audit.log");
     const dir = path.dirname(logPath);
     if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true });
-    fs.appendFileSync(logPath, entry + "\n");
+    fs.appendFileSync(logPath, JSON.stringify(entry) + "\n");
   } catch {
   }
 }
-var DANGEROUS_WORDS = [
-  "delete",
-  "drop",
-  "remove",
-  "terminate",
-  "refund",
-  "write",
-  "update",
-  "destroy",
-  "rm",
-  "rmdir",
-  "purge",
-  "format"
-];
+function appendHookDebug(toolName, args, meta) {
+  const safeArgs = args ? JSON.parse(redactSecrets(JSON.stringify(args))) : {};
+  appendToLog(HOOK_DEBUG_LOG, {
+    ts: (/* @__PURE__ */ new Date()).toISOString(),
+    tool: toolName,
+    args: safeArgs,
+    agent: meta?.agent,
+    mcpServer: meta?.mcpServer,
+    hostname: os.hostname(),
+    cwd: process.cwd()
+  });
+}
+function appendLocalAudit(toolName, args, decision, checkedBy, meta) {
+  const safeArgs = args ? JSON.parse(redactSecrets(JSON.stringify(args))) : {};
+  appendToLog(LOCAL_AUDIT_LOG, {
+    ts: (/* @__PURE__ */ new Date()).toISOString(),
+    tool: toolName,
+    args: safeArgs,
+    decision,
+    checkedBy,
+    agent: meta?.agent,
+    mcpServer: meta?.mcpServer,
+    hostname: os.hostname()
+  });
+}
 function tokenize(toolName) {
   return toolName.toLowerCase().split(/[_.\-\s]+/).filter(Boolean);
 }
@@ -395,16 +410,28 @@ function redactSecrets(text) {
   );
   return redacted;
 }
+var DANGEROUS_WORDS = [
+  "drop",
+  "truncate",
+  "purge",
+  "format",
+  "destroy",
+  "terminate",
+  "revoke",
+  "docker",
+  "psql"
+];
 var DEFAULT_CONFIG = {
   settings: {
     mode: "standard",
     autoStartDaemon: true,
-    enableUndo: false,
+    enableUndo: true,
+    // 🔥 ALWAYS TRUE BY DEFAULT for the safety net
     enableHookLogDebug: false,
     approvers: { native: true, browser: true, cloud: true, terminal: true }
   },
   policy: {
-    sandboxPaths: [],
+    sandboxPaths: ["/tmp/**", "**/sandbox/**", "**/test-results/**"],
     dangerousWords: DANGEROUS_WORDS,
     ignoredTools: [
       "list_*",
@@ -412,12 +439,44 @@ var DEFAULT_CONFIG = {
       "read_*",
       "describe_*",
       "read",
+      "glob",
       "grep",
       "ls",
-      "askuserquestion"
+      "notebookread",
+      "notebookedit",
+      "webfetch",
+      "websearch",
+      "exitplanmode",
+      "askuserquestion",
+      "agent",
+      "task*",
+      "toolsearch",
+      "mcp__ide__*",
+      "getDiagnostics"
     ],
-    toolInspection: { bash: "command", shell: "command" },
-    rules: [{ action: "rm", allowPaths: ["**/node_modules/**", "dist/**", ".DS_Store"] }]
+    toolInspection: {
+      bash: "command",
+      shell: "command",
+      run_shell_command: "command",
+      "terminal.execute": "command",
+      "postgres:query": "sql"
+    },
+    rules: [
+      {
+        action: "rm",
+        allowPaths: [
+          "**/node_modules/**",
+          "dist/**",
+          "build/**",
+          ".next/**",
+          "coverage/**",
+          ".cache/**",
+          "tmp/**",
+          "temp/**",
+          ".DS_Store"
+        ]
+      }
+    ]
   },
   environments: {}
 };
@@ -482,20 +541,15 @@ async function evaluatePolicy(toolName, args, agent) {
   }
   const isManual = agent === "Terminal";
   if (isManual) {
-    const NUCLEAR_COMMANDS = [
-      "drop",
-      "destroy",
-      "purge",
-      "rmdir",
-      "format",
-      "truncate",
-      "alter",
-      "grant",
-      "revoke",
-      "docker"
-    ];
-    const hasNuclear = allTokens.some((t) => NUCLEAR_COMMANDS.includes(t.toLowerCase()));
-    if (!hasNuclear) return { decision: "allow" };
+    const SYSTEM_DISASTER_COMMANDS = ["mkfs", "shred", "dd", "drop", "truncate", "purge"];
+    const hasSystemDisaster = allTokens.some(
+      (t) => SYSTEM_DISASTER_COMMANDS.includes(t.toLowerCase())
+    );
+    const isRootWipe = allTokens.includes("rm") && (allTokens.includes("/") || allTokens.includes("/*"));
+    if (hasSystemDisaster || isRootWipe) {
+      return { decision: "review", blockedByLabel: "Manual Nuclear Protection" };
+    }
+    return { decision: "allow" };
   }
   if (pathTokens.length > 0 && config.policy.sandboxPaths.length > 0) {
     const allInSandbox = pathTokens.every((p) => matchesPattern(p, config.policy.sandboxPaths));
@@ -509,27 +563,39 @@ async function evaluatePolicy(toolName, args, agent) {
       if (pathTokens.length > 0) {
         const anyBlocked = pathTokens.some((p) => matchesPattern(p, rule.blockPaths || []));
         if (anyBlocked)
-          return { decision: "review", blockedByLabel: "Project/Global Config (Rule Block)" };
+          return {
+            decision: "review",
+            blockedByLabel: `Project/Global Config \u2014 rule "${rule.action}" (path blocked)`
+          };
         const allAllowed = pathTokens.every((p) => matchesPattern(p, rule.allowPaths || []));
         if (allAllowed) return { decision: "allow" };
       }
-      return { decision: "review", blockedByLabel: "Project/Global Config (Rule Default Block)" };
+      return {
+        decision: "review",
+        blockedByLabel: `Project/Global Config \u2014 rule "${rule.action}" (default block)`
+      };
     }
   }
+  let matchedDangerousWord;
   const isDangerous = allTokens.some(
     (token) => config.policy.dangerousWords.some((word) => {
       const w = word.toLowerCase();
-      if (token === w) return true;
-      try {
-        return new RegExp(`\\b${w}\\b`, "i").test(token);
-      } catch {
-        return false;
-      }
+      const hit = token === w || (() => {
+        try {
+          return new RegExp(`\\b${w}\\b`, "i").test(token);
+        } catch {
+          return false;
+        }
+      })();
+      if (hit && !matchedDangerousWord) matchedDangerousWord = word;
+      return hit;
     })
   );
   if (isDangerous) {
-    const label = isManual ? "Manual Nuclear Protection" : "Project/Global Config (Dangerous Word)";
-    return { decision: "review", blockedByLabel: label };
+    return {
+      decision: "review",
+      blockedByLabel: `Project/Global Config \u2014 dangerous word: "${matchedDangerousWord}"`
+    };
   }
   if (config.settings.mode === "strict") {
     const envConfig = getActiveEnvironment(config);
@@ -644,13 +710,16 @@ async function authorizeHeadless(toolName, args, allowTerminalFallback = false,
     approvers.browser = false;
     approvers.terminal = false;
   }
+  if (config.settings.enableHookLogDebug && !isTestEnv2) {
+    appendHookDebug(toolName, args, meta);
+  }
   const isManual = meta?.agent === "Terminal";
   let explainableLabel = "Local Config";
   if (config.settings.mode === "audit") {
     if (!isIgnoredTool(toolName)) {
       const policyResult = await evaluatePolicy(toolName, args, meta?.agent);
       if (policyResult.decision === "review") {
-        appendAuditModeEntry(toolName, args);
+        appendLocalAudit(toolName, args, "allow", "audit-mode", meta);
         sendDesktopNotification(
           "Node9 Audit Mode",
           `Would have blocked "${toolName}" (${policyResult.blockedByLabel || "Local Config"}) \u2014 running in audit mode`
@@ -662,20 +731,24 @@ async function authorizeHeadless(toolName, args, allowTerminalFallback = false,
   if (!isIgnoredTool(toolName)) {
     if (getActiveTrustSession(toolName)) {
       if (creds?.apiKey) auditLocalAllow(toolName, args, "trust", creds, meta);
+      if (!isManual) appendLocalAudit(toolName, args, "allow", "trust", meta);
       return { approved: true, checkedBy: "trust" };
     }
     const policyResult = await evaluatePolicy(toolName, args, meta?.agent);
     if (policyResult.decision === "allow") {
       if (creds?.apiKey) auditLocalAllow(toolName, args, "local-policy", creds, meta);
+      if (!isManual) appendLocalAudit(toolName, args, "allow", "local-policy", meta);
       return { approved: true, checkedBy: "local-policy" };
     }
     explainableLabel = policyResult.blockedByLabel || "Local Config";
     const persistent = getPersistentDecision(toolName);
     if (persistent === "allow") {
       if (creds?.apiKey) auditLocalAllow(toolName, args, "persistent", creds, meta);
+      if (!isManual) appendLocalAudit(toolName, args, "allow", "persistent", meta);
       return { approved: true, checkedBy: "persistent" };
     }
     if (persistent === "deny") {
+      if (!isManual) appendLocalAudit(toolName, args, "deny", "persistent-deny", meta);
       return {
         approved: false,
         reason: `This tool ("${toolName}") is explicitly listed in your 'Always Deny' list.`,
@@ -685,6 +758,7 @@ async function authorizeHeadless(toolName, args, allowTerminalFallback = false,
     }
   } else {
     if (creds?.apiKey) auditLocalAllow(toolName, args, "ignoredTools", creds, meta);
+    if (!isManual) appendLocalAudit(toolName, args, "allow", "ignored", meta);
     return { approved: true };
   }
   let cloudRequestId = null;
@@ -712,8 +786,8 @@ async function authorizeHeadless(toolName, args, allowTerminalFallback = false,
       const isNetworkError = error.message.includes("fetch") || error.name === "AbortError" || error.message.includes("ECONNREFUSED");
       const reason = isAuthError ? "Invalid or missing API key. Run `node9 login` to generate a key (must start with n9_live_)." : isNetworkError ? "Could not reach the Node9 cloud. Check your network or API URL." : error.message;
       console.error(
-        chalk.yellow(`
-\u26A0\uFE0F  Node9: Cloud API Handshake failed \u2014 ${reason}`) + chalk.dim(`
+        chalk2.yellow(`
+\u26A0\uFE0F  Node9: Cloud API Handshake failed \u2014 ${reason}`) + chalk2.dim(`
    Falling back to local rules...
 `)
       );
@@ -721,13 +795,13 @@ async function authorizeHeadless(toolName, args, allowTerminalFallback = false,
   }
   if (cloudEnforced && cloudRequestId) {
     console.error(
-      chalk.yellow("\n\u{1F6E1}\uFE0F  Node9: Action suspended \u2014 waiting for Organization approval.")
+      chalk2.yellow("\n\u{1F6E1}\uFE0F  Node9: Action suspended \u2014 waiting for Organization approval.")
     );
-    console.error(chalk.cyan("   Dashboard  \u2192 ") + chalk.bold("Mission Control > Activity Feed\n"));
+    console.error(chalk2.cyan("   Dashboard  \u2192 ") + chalk2.bold("Mission Control > Activity Feed\n"));
   } else if (!cloudEnforced) {
     const cloudOffReason = !creds?.apiKey ? "no API key \u2014 run `node9 login` to connect" : "privacy mode (cloud disabled)";
     console.error(
-      chalk.dim(`
+      chalk2.dim(`
 \u{1F6E1}\uFE0F  Node9: intercepted "${toolName}" \u2014 cloud off (${cloudOffReason})
 `)
     );
@@ -792,9 +866,9 @@ async function authorizeHeadless(toolName, args, allowTerminalFallback = false,
         try {
           if (!approvers.native && !cloudEnforced) {
             console.error(
-              chalk.yellow("\n\u{1F6E1}\uFE0F  Node9: Action suspended \u2014 waiting for browser approval.")
+              chalk2.yellow("\n\u{1F6E1}\uFE0F  Node9: Action suspended \u2014 waiting for browser approval.")
             );
-            console.error(chalk.cyan(`   URL \u2192 http://${DAEMON_HOST}:${DAEMON_PORT}/
+            console.error(chalk2.cyan(`   URL \u2192 http://${DAEMON_HOST}:${DAEMON_PORT}/
 `));
           }
           const daemonDecision = await askDaemon(toolName, args, meta, signal);
@@ -817,11 +891,11 @@ async function authorizeHeadless(toolName, args, allowTerminalFallback = false,
     racePromises.push(
       (async () => {
         try {
-          console.log(chalk.bgRed.white.bold(` \u{1F6D1} NODE9 INTERCEPTOR `));
-          console.log(`${chalk.bold("Action:")} ${chalk.red(toolName)}`);
-          console.log(`${chalk.bold("Flagged By:")} ${chalk.yellow(explainableLabel)}`);
+          console.log(chalk2.bgRed.white.bold(` \u{1F6D1} NODE9 INTERCEPTOR `));
+          console.log(`${chalk2.bold("Action:")} ${chalk2.red(toolName)}`);
+          console.log(`${chalk2.bold("Flagged By:")} ${chalk2.yellow(explainableLabel)}`);
           if (isRemoteLocked) {
-            console.log(chalk.yellow(`\u26A1 LOCKED BY ADMIN POLICY: Waiting for Slack Approval...
+            console.log(chalk2.yellow(`\u26A1 LOCKED BY ADMIN POLICY: Waiting for Slack Approval...
 `));
             await new Promise((_, reject) => {
               signal.addEventListener("abort", () => reject(new Error("Aborted by SaaS")));
@@ -909,6 +983,15 @@ REASON: Action blocked because no approval channels are available. (Native/Brows
   if (cloudRequestId && creds && finalResult.checkedBy !== "cloud") {
     await resolveNode9SaaS(cloudRequestId, creds, finalResult.approved);
   }
+  if (!isManual) {
+    appendLocalAudit(
+      toolName,
+      args,
+      finalResult.approved ? "allow" : "deny",
+      finalResult.checkedBy || finalResult.blockedBy || "unknown",
+      meta
+    );
+  }
   return finalResult;
 }
 function getConfig() {
@@ -939,8 +1022,8 @@ function getConfig() {
       mergedSettings.enableHookLogDebug = s.enableHookLogDebug;
     if (s.approvers) mergedSettings.approvers = { ...mergedSettings.approvers, ...s.approvers };
     if (p.sandboxPaths) mergedPolicy.sandboxPaths.push(...p.sandboxPaths);
-    if (p.dangerousWords) mergedPolicy.dangerousWords = [...p.dangerousWords];
     if (p.ignoredTools) mergedPolicy.ignoredTools.push(...p.ignoredTools);
+    if (p.dangerousWords) mergedPolicy.dangerousWords = [...p.dangerousWords];
     if (p.toolInspection)
       mergedPolicy.toolInspection = { ...mergedPolicy.toolInspection, ...p.toolInspection };
     if (p.rules) mergedPolicy.rules.push(...p.rules);
@@ -1068,11 +1151,11 @@ async function pollNode9SaaS(requestId, creds, signal) {
       if (!statusRes.ok) continue;
       const { status, reason } = await statusRes.json();
       if (status === "APPROVED") {
-        console.error(chalk.green("\u2705  Approved via Cloud.\n"));
+        console.error(chalk2.green("\u2705  Approved via Cloud.\n"));
         return { approved: true, reason };
       }
       if (status === "DENIED" || status === "AUTO_BLOCKED" || status === "TIMED_OUT") {
-        console.error(chalk.red("\u274C  Denied via Cloud.\n"));
+        console.error(chalk2.red("\u274C  Denied via Cloud.\n"));
         return { approved: false, reason };
       }
     } catch {
@@ -1100,11 +1183,11 @@ async function resolveNode9SaaS(requestId, creds, approved) {
 import fs2 from "fs";
 import path2 from "path";
 import os2 from "os";
-import chalk2 from "chalk";
+import chalk3 from "chalk";
 import { confirm as confirm2 } from "@inquirer/prompts";
 function printDaemonTip() {
   console.log(
-    chalk2.cyan("\n   \u{1F4A1} Node9 will protect you automatically using Native OS popups.") + chalk2.white("\n      To view your history or manage persistent rules, run:") + chalk2.green("\n      node9 daemon --openui")
+    chalk3.cyan("\n   \u{1F4A1} Node9 will protect you automatically using Native OS popups.") + chalk3.white("\n      To view your history or manage persistent rules, run:") + chalk3.green("\n      node9 daemon --openui")
   );
 }
 function fullPathCommand(subcommand) {
@@ -1145,7 +1228,7 @@ async function setupClaude() {
       matcher: ".*",
       hooks: [{ type: "command", command: fullPathCommand("check"), timeout: 60 }]
     });
-    console.log(chalk2.green("  \u2705 PreToolUse hook added  \u2192 node9 check"));
+    console.log(chalk3.green("  \u2705 PreToolUse hook added  \u2192 node9 check"));
     anythingChanged = true;
   }
   const hasPostHook = settings.hooks.PostToolUse?.some(
@@ -1157,7 +1240,7 @@ async function setupClaude() {
       matcher: ".*",
       hooks: [{ type: "command", command: fullPathCommand("log"), timeout: 600 }]
     });
-    console.log(chalk2.green("  \u2705 PostToolUse hook added \u2192 node9 log"));
+    console.log(chalk3.green("  \u2705 PostToolUse hook added \u2192 node9 log"));
     anythingChanged = true;
   }
   if (anythingChanged) {
@@ -1171,10 +1254,10 @@ async function setupClaude() {
     serversToWrap.push({ name, originalCmd: parts.join(" "), parts });
   }
   if (serversToWrap.length > 0) {
-    console.log(chalk2.bold("The following existing entries will be modified:\n"));
-    console.log(chalk2.white(`  ${mcpPath}`));
+    console.log(chalk3.bold("The following existing entries will be modified:\n"));
+    console.log(chalk3.white(`  ${mcpPath}`));
     for (const { name, originalCmd } of serversToWrap) {
-      console.log(chalk2.gray(`    \u2022 ${name}: "${originalCmd}" \u2192 node9 ${originalCmd}`));
+      console.log(chalk3.gray(`    \u2022 ${name}: "${originalCmd}" \u2192 node9 ${originalCmd}`));
     }
     console.log("");
     const proceed = await confirm2({ message: "Wrap these MCP servers?", default: true });
@@ -1184,22 +1267,22 @@ async function setupClaude() {
       }
       claudeConfig.mcpServers = servers;
       writeJson(mcpPath, claudeConfig);
-      console.log(chalk2.green(`
+      console.log(chalk3.green(`
   \u2705 ${serversToWrap.length} MCP server(s) wrapped`));
       anythingChanged = true;
     } else {
-      console.log(chalk2.yellow("  Skipped MCP server wrapping."));
+      console.log(chalk3.yellow("  Skipped MCP server wrapping."));
     }
     console.log("");
   }
   if (!anythingChanged && serversToWrap.length === 0) {
-    console.log(chalk2.blue("\u2139\uFE0F  Node9 is already fully configured for Claude Code."));
+    console.log(chalk3.blue("\u2139\uFE0F  Node9 is already fully configured for Claude Code."));
     printDaemonTip();
     return;
   }
   if (anythingChanged) {
-    console.log(chalk2.green.bold("\u{1F6E1}\uFE0F  Node9 is now protecting Claude Code!"));
-    console.log(chalk2.gray("    Restart Claude Code for changes to take effect."));
+    console.log(chalk3.green.bold("\u{1F6E1}\uFE0F  Node9 is now protecting Claude Code!"));
+    console.log(chalk3.gray("    Restart Claude Code for changes to take effect."));
     printDaemonTip();
   }
 }
@@ -1227,7 +1310,7 @@ async function setupGemini() {
         }
       ]
     });
-    console.log(chalk2.green("  \u2705 BeforeTool hook added \u2192 node9 check"));
+    console.log(chalk3.green("  \u2705 BeforeTool hook added \u2192 node9 check"));
     anythingChanged = true;
   }
   const hasAfterHook = Array.isArray(settings.hooks.AfterTool) && settings.hooks.AfterTool.some(
@@ -1240,7 +1323,7 @@ async function setupGemini() {
       matcher: ".*",
       hooks: [{ name: "node9-log", type: "command", command: fullPathCommand("log") }]
     });
-    console.log(chalk2.green("  \u2705 AfterTool hook added  \u2192 node9 log"));
+    console.log(chalk3.green("  \u2705 AfterTool hook added  \u2192 node9 log"));
     anythingChanged = true;
   }
   if (anythingChanged) {
@@ -1254,10 +1337,10 @@ async function setupGemini() {
     serversToWrap.push({ name, originalCmd: parts.join(" "), parts });
   }
   if (serversToWrap.length > 0) {
-    console.log(chalk2.bold("The following existing entries will be modified:\n"));
-    console.log(chalk2.white(`  ${settingsPath}  (mcpServers)`));
+    console.log(chalk3.bold("The following existing entries will be modified:\n"));
+    console.log(chalk3.white(`  ${settingsPath}  (mcpServers)`));
     for (const { name, originalCmd } of serversToWrap) {
-      console.log(chalk2.gray(`    \u2022 ${name}: "${originalCmd}" \u2192 node9 ${originalCmd}`));
+      console.log(chalk3.gray(`    \u2022 ${name}: "${originalCmd}" \u2192 node9 ${originalCmd}`));
     }
     console.log("");
     const proceed = await confirm2({ message: "Wrap these MCP servers?", default: true });
@@ -1267,22 +1350,22 @@ async function setupGemini() {
       }
       settings.mcpServers = servers;
       writeJson(settingsPath, settings);
-      console.log(chalk2.green(`
+      console.log(chalk3.green(`
   \u2705 ${serversToWrap.length} MCP server(s) wrapped`));
       anythingChanged = true;
     } else {
-      console.log(chalk2.yellow("  Skipped MCP server wrapping."));
+      console.log(chalk3.yellow("  Skipped MCP server wrapping."));
     }
     console.log("");
   }
   if (!anythingChanged && serversToWrap.length === 0) {
-    console.log(chalk2.blue("\u2139\uFE0F  Node9 is already fully configured for Gemini CLI."));
+    console.log(chalk3.blue("\u2139\uFE0F  Node9 is already fully configured for Gemini CLI."));
     printDaemonTip();
     return;
   }
   if (anythingChanged) {
-    console.log(chalk2.green.bold("\u{1F6E1}\uFE0F  Node9 is now protecting Gemini CLI!"));
-    console.log(chalk2.gray("    Restart Gemini CLI for changes to take effect."));
+    console.log(chalk3.green.bold("\u{1F6E1}\uFE0F  Node9 is now protecting Gemini CLI!"));
+    console.log(chalk3.gray("    Restart Gemini CLI for changes to take effect."));
     printDaemonTip();
   }
 }
@@ -1301,7 +1384,7 @@ async function setupCursor() {
   if (!hasPreHook) {
     if (!hooksFile.hooks.preToolUse) hooksFile.hooks.preToolUse = [];
     hooksFile.hooks.preToolUse.push({ command: fullPathCommand("check") });
-    console.log(chalk2.green("  \u2705 preToolUse hook added \u2192 node9 check"));
+    console.log(chalk3.green("  \u2705 preToolUse hook added \u2192 node9 check"));
     anythingChanged = true;
   }
   const hasPostHook = hooksFile.hooks.postToolUse?.some(
@@ -1310,7 +1393,7 @@ async function setupCursor() {
   if (!hasPostHook) {
     if (!hooksFile.hooks.postToolUse) hooksFile.hooks.postToolUse = [];
     hooksFile.hooks.postToolUse.push({ command: fullPathCommand("log") });
-    console.log(chalk2.green("  \u2705 postToolUse hook added \u2192 node9 log"));
+    console.log(chalk3.green("  \u2705 postToolUse hook added \u2192 node9 log"));
     anythingChanged = true;
   }
   if (anythingChanged) {
@@ -1324,10 +1407,10 @@ async function setupCursor() {
     serversToWrap.push({ name, originalCmd: parts.join(" "), parts });
   }
   if (serversToWrap.length > 0) {
-    console.log(chalk2.bold("The following existing entries will be modified:\n"));
-    console.log(chalk2.white(`  ${mcpPath}`));
+    console.log(chalk3.bold("The following existing entries will be modified:\n"));
+    console.log(chalk3.white(`  ${mcpPath}`));
     for (const { name, originalCmd } of serversToWrap) {
-      console.log(chalk2.gray(`    \u2022 ${name}: "${originalCmd}" \u2192 node9 ${originalCmd}`));
+      console.log(chalk3.gray(`    \u2022 ${name}: "${originalCmd}" \u2192 node9 ${originalCmd}`));
     }
     console.log("");
     const proceed = await confirm2({ message: "Wrap these MCP servers?", default: true });
@@ -1337,22 +1420,22 @@ async function setupCursor() {
       }
       mcpConfig.mcpServers = servers;
       writeJson(mcpPath, mcpConfig);
-      console.log(chalk2.green(`
+      console.log(chalk3.green(`
   \u2705 ${serversToWrap.length} MCP server(s) wrapped`));
       anythingChanged = true;
     } else {
-      console.log(chalk2.yellow("  Skipped MCP server wrapping."));
+      console.log(chalk3.yellow("  Skipped MCP server wrapping."));
     }
     console.log("");
   }
   if (!anythingChanged && serversToWrap.length === 0) {
-    console.log(chalk2.blue("\u2139\uFE0F  Node9 is already fully configured for Cursor."));
+    console.log(chalk3.blue("\u2139\uFE0F  Node9 is already fully configured for Cursor."));
     printDaemonTip();
     return;
   }
   if (anythingChanged) {
-    console.log(chalk2.green.bold("\u{1F6E1}\uFE0F  Node9 is now protecting Cursor!"));
-    console.log(chalk2.gray("    Restart Cursor for changes to take effect."));
+    console.log(chalk3.green.bold("\u{1F6E1}\uFE0F  Node9 is now protecting Cursor!"));
+    console.log(chalk3.gray("    Restart Cursor for changes to take effect."));
     printDaemonTip();
   }
 }
@@ -2331,7 +2414,7 @@ import path3 from "path";
 import os3 from "os";
 import { spawn as spawn2 } from "child_process";
 import { randomUUID } from "crypto";
-import chalk3 from "chalk";
+import chalk4 from "chalk";
 var DAEMON_PORT2 = 7391;
 var DAEMON_HOST2 = "127.0.0.1";
 var homeDir = os3.homedir();
@@ -2777,7 +2860,7 @@ data: ${JSON.stringify(readPersistentDecisions())}
         return;
       }
     }
-    console.error(chalk3.red("\n\u{1F6D1} Node9 Daemon Error:"), e.message);
+    console.error(chalk4.red("\n\u{1F6D1} Node9 Daemon Error:"), e.message);
     process.exit(1);
   });
   server.listen(DAEMON_PORT2, DAEMON_HOST2, () => {
@@ -2786,17 +2869,17 @@ data: ${JSON.stringify(readPersistentDecisions())}
       JSON.stringify({ pid: process.pid, port: DAEMON_PORT2, internalToken, autoStarted }),
       { mode: 384 }
     );
-    console.log(chalk3.green(`\u{1F6E1}\uFE0F  Node9 Guard LIVE: http://127.0.0.1:${DAEMON_PORT2}`));
+    console.log(chalk4.green(`\u{1F6E1}\uFE0F  Node9 Guard LIVE: http://127.0.0.1:${DAEMON_PORT2}`));
   });
 }
 function stopDaemon() {
-  if (!fs3.existsSync(DAEMON_PID_FILE)) return console.log(chalk3.yellow("Not running."));
+  if (!fs3.existsSync(DAEMON_PID_FILE)) return console.log(chalk4.yellow("Not running."));
   try {
     const { pid } = JSON.parse(fs3.readFileSync(DAEMON_PID_FILE, "utf-8"));
     process.kill(pid, "SIGTERM");
-    console.log(chalk3.green("\u2705 Stopped."));
+    console.log(chalk4.green("\u2705 Stopped."));
   } catch {
-    console.log(chalk3.gray("Cleaned up stale PID file."));
+    console.log(chalk4.gray("Cleaned up stale PID file."));
   } finally {
     try {
       fs3.unlinkSync(DAEMON_PID_FILE);
@@ -2806,13 +2889,13 @@ function stopDaemon() {
 }
 function daemonStatus() {
   if (!fs3.existsSync(DAEMON_PID_FILE))
-    return console.log(chalk3.yellow("Node9 daemon: not running"));
+    return console.log(chalk4.yellow("Node9 daemon: not running"));
   try {
     const { pid } = JSON.parse(fs3.readFileSync(DAEMON_PID_FILE, "utf-8"));
     process.kill(pid, 0);
-    console.log(chalk3.green("Node9 daemon: running"));
+    console.log(chalk4.green("Node9 daemon: running"));
   } catch {
-    console.log(chalk3.yellow("Node9 daemon: not running (stale PID)"));
+    console.log(chalk4.yellow("Node9 daemon: not running (stale PID)"));
   }
 }
 
@@ -2820,7 +2903,7 @@ function daemonStatus() {
 import { spawn as spawn3, execSync } from "child_process";
 import { parseCommandString } from "execa";
 import { execa } from "execa";
-import chalk4 from "chalk";
+import chalk5 from "chalk";
 import readline from "readline";
 import fs5 from "fs";
 import path5 from "path";
@@ -2959,7 +3042,7 @@ async function runProxy(targetCommand) {
     if (stdout) executable = stdout.trim();
   } catch {
   }
-  console.log(chalk4.green(`\u{1F680} Node9 Proxy Active: Monitoring [${targetCommand}]`));
+  console.log(chalk5.green(`\u{1F680} Node9 Proxy Active: Monitoring [${targetCommand}]`));
   const child = spawn3(executable, args, {
     stdio: ["pipe", "pipe", "inherit"],
     // We control STDIN and STDOUT
@@ -3060,92 +3143,47 @@ program.command("login").argument("<apiKey>").option("--local", "Save key for au
     fs5.writeFileSync(configPath, JSON.stringify(config, null, 2), { mode: 384 });
   }
   if (options.profile && profileName !== "default") {
-    console.log(chalk4.green(`\u2705 Profile "${profileName}" saved`));
-    console.log(chalk4.gray(`   Switch to it per-session:  NODE9_PROFILE=${profileName} claude`));
+    console.log(chalk5.green(`\u2705 Profile "${profileName}" saved`));
+    console.log(chalk5.gray(`   Switch to it per-session:  NODE9_PROFILE=${profileName} claude`));
   } else if (options.local) {
-    console.log(chalk4.green(`\u2705 Privacy mode \u{1F6E1}\uFE0F`));
-    console.log(chalk4.gray(`   All decisions stay on this machine.`));
+    console.log(chalk5.green(`\u2705 Privacy mode \u{1F6E1}\uFE0F`));
+    console.log(chalk5.gray(`   All decisions stay on this machine.`));
   } else {
-    console.log(chalk4.green(`\u2705 Logged in \u2014 agent mode`));
-    console.log(chalk4.gray(`   Team policy enforced for all calls via Node9 cloud.`));
+    console.log(chalk5.green(`\u2705 Logged in \u2014 agent mode`));
+    console.log(chalk5.gray(`   Team policy enforced for all calls via Node9 cloud.`));
   }
 });
 program.command("addto").description("Integrate Node9 with an AI agent").addHelpText("after", "\n  Supported targets:  claude  gemini  cursor").argument("<target>", "The agent to protect: claude | gemini | cursor").action(async (target) => {
   if (target === "gemini") return await setupGemini();
   if (target === "claude") return await setupClaude();
   if (target === "cursor") return await setupCursor();
-  console.error(chalk4.red(`Unknown target: "${target}". Supported: claude, gemini, cursor`));
+  console.error(chalk5.red(`Unknown target: "${target}". Supported: claude, gemini, cursor`));
   process.exit(1);
 });
-program.command("init").description("Create ~/.node9/config.json with default policy (safe to run multiple times)").option("--force", "Overwrite existing config").action((options) => {
+program.command("init").description("Create ~/.node9/config.json with default policy (safe to run multiple times)").option("--force", "Overwrite existing config").option("-m, --mode <mode>", "Set initial security mode (standard, strict, audit)", "standard").action((options) => {
   const configPath = path5.join(os5.homedir(), ".node9", "config.json");
   if (fs5.existsSync(configPath) && !options.force) {
-    console.log(chalk4.yellow(`\u2139\uFE0F  Global config already exists: ${configPath}`));
-    console.log(chalk4.gray(`   Run with --force to overwrite.`));
+    console.log(chalk5.yellow(`\u2139\uFE0F  Global config already exists: ${configPath}`));
+    console.log(chalk5.gray(`   Run with --force to overwrite.`));
     return;
   }
-  const defaultConfig = {
-    version: "1.0",
+  const requestedMode = options.mode.toLowerCase();
+  const safeMode = ["standard", "strict", "audit"].includes(requestedMode) ? requestedMode : DEFAULT_CONFIG.settings.mode;
+  const configToSave = {
+    ...DEFAULT_CONFIG,
     settings: {
-      mode: "standard",
-      autoStartDaemon: true,
-      enableUndo: true,
-      enableHookLogDebug: false,
-      approvers: { native: true, browser: true, cloud: true, terminal: true }
-    },
-    policy: {
-      sandboxPaths: ["/tmp/**", "**/sandbox/**", "**/test-results/**"],
-      dangerousWords: DANGEROUS_WORDS,
-      ignoredTools: [
-        "list_*",
-        "get_*",
-        "read_*",
-        "describe_*",
-        "read",
-        "write",
-        "edit",
-        "glob",
-        "grep",
-        "ls",
-        "notebookread",
-        "notebookedit",
-        "webfetch",
-        "websearch",
-        "exitplanmode",
-        "askuserquestion",
-        "agent",
-        "task*"
-      ],
-      toolInspection: {
-        bash: "command",
-        shell: "command",
-        run_shell_command: "command",
-        "terminal.execute": "command",
-        "postgres:query": "sql"
-      },
-      rules: [
-        {
-          action: "rm",
-          allowPaths: [
-            "**/node_modules/**",
-            "dist/**",
-            "build/**",
-            ".next/**",
-            "coverage/**",
-            ".cache/**",
-            "tmp/**",
-            "temp/**",
-            ".DS_Store"
-          ]
-        }
-      ]
+      ...DEFAULT_CONFIG.settings,
+      mode: safeMode
     }
   };
-  if (!fs5.existsSync(path5.dirname(configPath)))
-    fs5.mkdirSync(path5.dirname(configPath), { recursive: true });
-  fs5.writeFileSync(configPath, JSON.stringify(defaultConfig, null, 2));
-  console.log(chalk4.green(`\u2705 Global config created: ${configPath}`));
-  console.log(chalk4.gray(`   Edit this file to add custom tool inspection or security rules.`));
+  const dir = path5.dirname(configPath);
+  if (!fs5.existsSync(dir)) fs5.mkdirSync(dir, { recursive: true });
+  fs5.writeFileSync(configPath, JSON.stringify(configToSave, null, 2));
+  console.log(chalk5.green(`\u2705 Global config created: ${configPath}`));
+  console.log(chalk5.cyan(`   Mode set to: ${safeMode}`));
+  console.log(
+    chalk5.gray(`   Undo Engine is ENABLED by default. Use 'node9 undo' to revert AI changes.`)
+  );
 });
 program.command("status").description("Show current Node9 mode, policy source, and persistent decisions").action(() => {
   const creds = getCredentials();
@@ -3154,43 +3192,43 @@ program.command("status").description("Show current Node9 mode, policy source, a
   const settings = mergedConfig.settings;
   console.log("");
   if (creds && settings.approvers.cloud) {
-    console.log(chalk4.green("  \u25CF Agent mode") + chalk4.gray(" \u2014 cloud team policy enforced"));
+    console.log(chalk5.green("  \u25CF Agent mode") + chalk5.gray(" \u2014 cloud team policy enforced"));
   } else if (creds && !settings.approvers.cloud) {
     console.log(
-      chalk4.blue("  \u25CF Privacy mode \u{1F6E1}\uFE0F") + chalk4.gray(" \u2014 all decisions stay on this machine")
+      chalk5.blue("  \u25CF Privacy mode \u{1F6E1}\uFE0F") + chalk5.gray(" \u2014 all decisions stay on this machine")
     );
   } else {
     console.log(
-      chalk4.yellow("  \u25CB Privacy mode \u{1F6E1}\uFE0F") + chalk4.gray(" \u2014 no API key (Local rules only)")
+      chalk5.yellow("  \u25CB Privacy mode \u{1F6E1}\uFE0F") + chalk5.gray(" \u2014 no API key (Local rules only)")
     );
   }
   console.log("");
   if (daemonRunning) {
     console.log(
-      chalk4.green("  \u25CF Daemon running") + chalk4.gray(` \u2192 http://127.0.0.1:${DAEMON_PORT2}/`)
+      chalk5.green("  \u25CF Daemon running") + chalk5.gray(` \u2192 http://127.0.0.1:${DAEMON_PORT2}/`)
     );
   } else {
-    console.log(chalk4.gray("  \u25CB Daemon stopped"));
+    console.log(chalk5.gray("  \u25CB Daemon stopped"));
   }
   if (settings.enableUndo) {
     console.log(
-      chalk4.magenta("  \u25CF Undo Engine") + chalk4.gray(`    \u2192 Auto-snapshotting Git repos on AI change`)
+      chalk5.magenta("  \u25CF Undo Engine") + chalk5.gray(`    \u2192 Auto-snapshotting Git repos on AI change`)
     );
   }
   console.log("");
-  const modeLabel = settings.mode === "audit" ? chalk4.blue("audit") : settings.mode === "strict" ? chalk4.red("strict") : chalk4.white("standard");
+  const modeLabel = settings.mode === "audit" ? chalk5.blue("audit") : settings.mode === "strict" ? chalk5.red("strict") : chalk5.white("standard");
   console.log(`  Mode:    ${modeLabel}`);
   const projectConfig = path5.join(process.cwd(), "node9.config.json");
   const globalConfig = path5.join(os5.homedir(), ".node9", "config.json");
   console.log(
-    `  Local:   ${fs5.existsSync(projectConfig) ? chalk4.green("Active (node9.config.json)") : chalk4.gray("Not present")}`
+    `  Local:   ${fs5.existsSync(projectConfig) ? chalk5.green("Active (node9.config.json)") : chalk5.gray("Not present")}`
   );
   console.log(
-    `  Global:  ${fs5.existsSync(globalConfig) ? chalk4.green("Active (~/.node9/config.json)") : chalk4.gray("Not present")}`
+    `  Global:  ${fs5.existsSync(globalConfig) ? chalk5.green("Active (~/.node9/config.json)") : chalk5.gray("Not present")}`
   );
   if (mergedConfig.policy.sandboxPaths.length > 0) {
     console.log(
-      `  Sandbox: ${chalk4.green(`${mergedConfig.policy.sandboxPaths.length} safe zones active`)}`
+      `  Sandbox: ${chalk5.green(`${mergedConfig.policy.sandboxPaths.length} safe zones active`)}`
     );
   }
   const pauseState = checkPause();
@@ -3198,7 +3236,7 @@ program.command("status").description("Show current Node9 mode, policy source, a
     const expiresAt = pauseState.expiresAt ? new Date(pauseState.expiresAt).toLocaleTimeString() : "indefinitely";
     console.log("");
     console.log(
-      chalk4.yellow(`  \u23F8  PAUSED until ${expiresAt}`) + chalk4.gray(" \u2014 all tool calls allowed")
+      chalk5.yellow(`  \u23F8  PAUSED until ${expiresAt}`) + chalk5.gray(" \u2014 all tool calls allowed")
     );
   }
   console.log("");
@@ -3209,13 +3247,13 @@ program.command("daemon").description("Run the local approval server").argument(
     if (cmd === "stop") return stopDaemon();
     if (cmd === "status") return daemonStatus();
     if (cmd !== "start" && action !== void 0) {
-      console.error(chalk4.red(`Unknown daemon action: "${action}". Use: start | stop | status`));
+      console.error(chalk5.red(`Unknown daemon action: "${action}". Use: start | stop | status`));
       process.exit(1);
     }
     if (options.openui) {
       if (isDaemonRunning()) {
         openBrowserLocal();
-        console.log(chalk4.green(`\u{1F310}  Opened browser: http://${DAEMON_HOST2}:${DAEMON_PORT2}/`));
+        console.log(chalk5.green(`\u{1F310}  Opened browser: http://${DAEMON_HOST2}:${DAEMON_PORT2}/`));
         process.exit(0);
       }
       const child = spawn3("node9", ["daemon"], { detached: true, stdio: "ignore" });
@@ -3225,14 +3263,14 @@ program.command("daemon").description("Run the local approval server").argument(
         if (isDaemonRunning()) break;
       }
       openBrowserLocal();
-      console.log(chalk4.green(`
+      console.log(chalk5.green(`
 \u{1F6E1}\uFE0F  Node9 daemon started + browser opened`));
       process.exit(0);
     }
     if (options.background) {
       const child = spawn3("node9", ["daemon"], { detached: true, stdio: "ignore" });
       child.unref();
-      console.log(chalk4.green(`
+      console.log(chalk5.green(`
 \u{1F6E1}\uFE0F  Node9 daemon started in background  (PID ${child.pid})`));
       process.exit(0);
     }
@@ -3284,31 +3322,32 @@ RAW: ${raw}
       const sendBlock = (msg, result2) => {
         const blockedByContext = result2?.blockedByLabel || result2?.blockedBy || "Local Security Policy";
         const isHumanDecision = blockedByContext.toLowerCase().includes("user") || blockedByContext.toLowerCase().includes("daemon") || blockedByContext.toLowerCase().includes("decision");
-        console.error(chalk4.red(`
+        console.error(chalk5.red(`
 \u{1F6D1} Node9 blocked "${toolName}"`));
-        console.error(chalk4.gray(`   Triggered by: ${blockedByContext}`));
-        if (result2?.changeHint) console.error(chalk4.cyan(`   To change:  ${result2.changeHint}`));
+        console.error(chalk5.gray(`   Triggered by: ${blockedByContext}`));
+        if (result2?.changeHint) console.error(chalk5.cyan(`   To change:  ${result2.changeHint}`));
         console.error("");
         let aiFeedbackMessage = "";
         if (isHumanDecision) {
           aiFeedbackMessage = `NODE9 SECURITY INTERVENTION: The human user specifically REJECTED this action.
-        REASON: ${msg || "No specific reason provided by user."}
+REASON: ${msg || "No specific reason provided by user."}
 
-        INSTRUCTIONS FOR AI AGENT:
-        - Do NOT retry this exact command immediately.
-        - Explain to the user that you understand they blocked the action.
-        - Ask the user if there is an alternative approach they would prefer, or if they intended to block this action entirely.
-        - If you believe this action is critical, explain your reasoning to the user and ask them to run 'node9 pause 15m' to allow you to proceed.`;
+INSTRUCTIONS FOR AI AGENT:
+- Do NOT retry this exact command immediately.
+- Explain to the user that you understand they blocked the action.
+- Ask the user if there is an alternative approach they would prefer, or if they intended to block this action entirely.
+- If you believe this action is critical, explain your reasoning to the user and ask them to run 'node9 pause 15m' to allow you to proceed.`;
         } else {
           aiFeedbackMessage = `NODE9 SECURITY INTERVENTION: Action blocked by automated policy [${blockedByContext}].
-        REASON: ${msg}
+REASON: ${msg}
 
-        INSTRUCTIONS FOR AI AGENT:
-        - This command violates the current security configuration.
-        - Do NOT attempt to bypass this rule with bash syntax tricks; it will be blocked again.
-        - Pivot to a non-destructive or read-only alternative.
-        - Inform the user which security rule was triggered.`;
+INSTRUCTIONS FOR AI AGENT:
+- This command violates the current security configuration.
+- Do NOT attempt to bypass this rule with bash syntax tricks; it will be blocked again.
+- Pivot to a non-destructive or read-only alternative.
+- Inform the user which security rule was triggered.`;
         }
+        console.error(chalk5.dim(`   (Detailed instructions sent to AI agent)`));
         process.stdout.write(
           JSON.stringify({
             decision: "block",
@@ -3349,7 +3388,7 @@ RAW: ${raw}
         process.exit(0);
       }
       if (result.noApprovalMechanism && !isDaemonRunning() && !process.env.NODE9_NO_AUTO_DAEMON && !process.stdout.isTTY && config.settings.autoStartDaemon) {
-        console.error(chalk4.cyan("\n\u{1F6E1}\uFE0F  Node9: Starting approval daemon automatically..."));
+        console.error(chalk5.cyan("\n\u{1F6E1}\uFE0F  Node9: Starting approval daemon automatically..."));
         const daemonReady = await autoStartDaemonAndWait();
         if (daemonReady) {
           const retry = await authorizeHeadless(toolName, toolInput, false, meta);
@@ -3457,7 +3496,7 @@ program.command("pause").description("Temporarily disable Node9 protection for a
   const ms = parseDuration(options.duration);
   if (ms === null) {
     console.error(
-      chalk4.red(`
+      chalk5.red(`
 \u274C  Invalid duration: "${options.duration}". Use format like 15m, 1h, 30s.
 `)
     );
@@ -3465,20 +3504,20 @@ program.command("pause").description("Temporarily disable Node9 protection for a
   }
   pauseNode9(ms, options.duration);
   const expiresAt = new Date(Date.now() + ms).toLocaleTimeString();
-  console.log(chalk4.yellow(`
+  console.log(chalk5.yellow(`
 \u23F8  Node9 paused until ${expiresAt}`));
-  console.log(chalk4.gray(`   All tool calls will be allowed without review.`));
-  console.log(chalk4.gray(`   Run "node9 resume" to re-enable early.
+  console.log(chalk5.gray(`   All tool calls will be allowed without review.`));
+  console.log(chalk5.gray(`   Run "node9 resume" to re-enable early.
 `));
 });
 program.command("resume").description("Re-enable Node9 protection immediately").action(() => {
   const { paused } = checkPause();
   if (!paused) {
-    console.log(chalk4.gray("\nNode9 is already active \u2014 nothing to resume.\n"));
+    console.log(chalk5.gray("\nNode9 is already active \u2014 nothing to resume.\n"));
     return;
   }
   resumeNode9();
-  console.log(chalk4.green("\n\u25B6  Node9 resumed \u2014 protection is active.\n"));
+  console.log(chalk5.green("\n\u25B6  Node9 resumed \u2014 protection is active.\n"));
 });
 var HOOK_BASED_AGENTS = {
   claude: "claude",
@@ -3491,21 +3530,23 @@ program.argument("[command...]", "The agent command to run (e.g., gemini)").acti
     if (HOOK_BASED_AGENTS[firstArg] !== void 0) {
       const target = HOOK_BASED_AGENTS[firstArg];
       console.error(
-        chalk4.yellow(`
+        chalk5.yellow(`
 \u26A0\uFE0F  Node9 proxy mode does not support "${target}" directly.`)
       );
-      console.error(chalk4.white(`
+      console.error(chalk5.white(`
    "${target}" uses its own hook system. Use:`));
       console.error(
-        chalk4.green(`     node9 addto ${target}   `) + chalk4.gray("# one-time setup")
+        chalk5.green(`     node9 addto ${target}   `) + chalk5.gray("# one-time setup")
       );
-      console.error(chalk4.green(`     ${target}              `) + chalk4.gray("# run normally"));
+      console.error(chalk5.green(`     ${target}              `) + chalk5.gray("# run normally"));
       process.exit(1);
     }
     const fullCommand = commandArgs.join(" ");
-    let result = await authorizeHeadless("shell", { command: fullCommand });
+    let result = await authorizeHeadless("shell", { command: fullCommand }, true, {
+      agent: "Terminal"
+    });
     if (result.noApprovalMechanism && !isDaemonRunning() && !process.env.NODE9_NO_AUTO_DAEMON && getConfig().settings.autoStartDaemon) {
-      console.error(chalk4.cyan("\n\u{1F6E1}\uFE0F  Node9: Starting approval daemon automatically..."));
+      console.error(chalk5.cyan("\n\u{1F6E1}\uFE0F  Node9: Starting approval daemon automatically..."));
       const daemonReady = await autoStartDaemonAndWait();
       if (daemonReady) result = await authorizeHeadless("shell", { command: fullCommand });
     }
@@ -3514,12 +3555,12 @@ program.argument("[command...]", "The agent command to run (e.g., gemini)").acti
     }
     if (!result.approved) {
       console.error(
-        chalk4.red(`
+        chalk5.red(`
 \u274C Node9 Blocked: ${result.reason || "Dangerous command detected."}`)
       );
       process.exit(1);
     }
-    console.error(chalk4.green("\n\u2705 Approved \u2014 running command...\n"));
+    console.error(chalk5.green("\n\u2705 Approved \u2014 running command...\n"));
     await runProxy(fullCommand);
   } else {
     program.help();
@@ -3528,20 +3569,20 @@ program.argument("[command...]", "The agent command to run (e.g., gemini)").acti
 program.command("undo").description("Revert the project to the state before the last AI action").action(async () => {
   const hash = getLatestSnapshotHash();
   if (!hash) {
-    console.log(chalk4.yellow("\n\u2139\uFE0F  No Undo snapshot found for this machine.\n"));
+    console.log(chalk5.yellow("\n\u2139\uFE0F  No Undo snapshot found for this machine.\n"));
     return;
   }
-  console.log(chalk4.magenta.bold("\n\u23EA NODE9 UNDO ENGINE"));
-  console.log(chalk4.white(`Target Snapshot: ${chalk4.gray(hash.slice(0, 7))}`));
+  console.log(chalk5.magenta.bold("\n\u23EA NODE9 UNDO ENGINE"));
+  console.log(chalk5.white(`Target Snapshot: ${chalk5.gray(hash.slice(0, 7))}`));
   const proceed = await confirm3({
     message: "Revert all files to the state before the last AI action?",
     default: false
   });
   if (proceed) {
     if (applyUndo(hash)) {
-      console.log(chalk4.green("\u2705 Project reverted successfully.\n"));
+      console.log(chalk5.green("\u2705 Project reverted successfully.\n"));
     } else {
-      console.error(chalk4.red("\u274C Undo failed. Ensure you are in a Git repository.\n"));
+      console.error(chalk5.red("\u274C Undo failed. Ensure you are in a Git repository.\n"));
     }
   }
 });