@node9/proxy 1.0.0 → 1.0.2

package/dist/index.mjs

@@ -1,5 +1,5 @@
 // src/core.ts
-import chalk from "chalk";
+import chalk2 from "chalk";
 import { confirm } from "@inquirer/prompts";
 import fs from "fs";
 import path from "path";
@@ -9,19 +9,69 @@ import { parse } from "sh-syntax";
 
 // src/ui/native.ts
 import { spawn } from "child_process";
+import chalk from "chalk";
 var isTestEnv = () => {
   return process.env.NODE_ENV === "test" || process.env.VITEST === "true" || !!process.env.VITEST || process.env.CI === "true" || !!process.env.CI || process.env.NODE9_TESTING === "1";
 };
+function smartTruncate(str, maxLen = 500) {
+  if (str.length <= maxLen) return str;
+  const edge = Math.floor(maxLen / 2) - 3;
+  return `${str.slice(0, edge)} ... ${str.slice(-edge)}`;
+}
+function formatArgs(args) {
+  if (args === null || args === void 0) return "(none)";
+  let parsed = args;
+  if (typeof args === "string") {
+    const trimmed = args.trim();
+    if (trimmed.startsWith("{") && trimmed.endsWith("}")) {
+      try {
+        parsed = JSON.parse(trimmed);
+      } catch {
+        parsed = args;
+      }
+    } else {
+      return smartTruncate(args, 600);
+    }
+  }
+  if (typeof parsed === "object" && !Array.isArray(parsed)) {
+    const obj = parsed;
+    const codeKeys = [
+      "command",
+      "cmd",
+      "shell_command",
+      "bash_command",
+      "script",
+      "code",
+      "input",
+      "sql",
+      "query",
+      "arguments",
+      "args",
+      "param",
+      "params",
+      "text"
+    ];
+    const foundKey = Object.keys(obj).find((k) => codeKeys.includes(k.toLowerCase()));
+    if (foundKey) {
+      const val = obj[foundKey];
+      const str = typeof val === "string" ? val : JSON.stringify(val);
+      return `[${foundKey.toUpperCase()}]:
+${smartTruncate(str, 500)}`;
+    }
+    return Object.entries(obj).slice(0, 5).map(
+      ([k, v]) => `  ${k}: ${smartTruncate(typeof v === "string" ? v : JSON.stringify(v), 300)}`
+    ).join("\n");
+  }
+  return smartTruncate(JSON.stringify(parsed), 200);
+}
 function sendDesktopNotification(title, body) {
   if (isTestEnv()) return;
   try {
-    const safeTitle = title.replace(/"/g, '\\"');
-    const safeBody = body.replace(/"/g, '\\"');
     if (process.platform === "darwin") {
-      const script = `display notification "${safeBody}" with title "${safeTitle}"`;
+      const script = `display notification "${body.replace(/"/g, '\\"')}" with title "${title.replace(/"/g, '\\"')}"`;
       spawn("osascript", ["-e", script], { detached: true, stdio: "ignore" }).unref();
     } else if (process.platform === "linux") {
-      spawn("notify-send", [safeTitle, safeBody, "--icon=dialog-warning"], {
+      spawn("notify-send", [title, body, "--icon=dialog-warning"], {
         detached: true,
         stdio: "ignore"
       }).unref();
@@ -29,69 +79,54 @@ function sendDesktopNotification(title, body) {
   } catch {
   }
 }
-function formatArgs(args) {
-  if (args === null || args === void 0) return "(none)";
-  if (typeof args !== "object" || Array.isArray(args)) {
-    const str = typeof args === "string" ? args : JSON.stringify(args);
-    return str.length > 200 ? str.slice(0, 200) + "\u2026" : str;
-  }
-  const entries = Object.entries(args).filter(
-    ([, v]) => v !== null && v !== void 0 && v !== ""
-  );
-  if (entries.length === 0) return "(none)";
-  const MAX_FIELDS = 5;
-  const MAX_VALUE_LEN = 120;
-  const lines = entries.slice(0, MAX_FIELDS).map(([key, val]) => {
-    const str = typeof val === "string" ? val : JSON.stringify(val);
-    const truncated = str.length > MAX_VALUE_LEN ? str.slice(0, MAX_VALUE_LEN) + "\u2026" : str;
-    return `  ${key}: ${truncated}`;
-  });
-  if (entries.length > MAX_FIELDS) {
-    lines.push(`  \u2026 and ${entries.length - MAX_FIELDS} more field(s)`);
+function escapePango(text) {
+  return text.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+}
+function buildPlainMessage(toolName, formattedArgs, agent, explainableLabel, locked) {
+  const lines = [];
+  if (locked) lines.push("\u26A0\uFE0F  LOCKED BY ADMIN POLICY\n");
+  lines.push(`\u{1F916} ${agent || "AI Agent"}  |  \u{1F527} ${toolName}`);
+  lines.push(`\u{1F6E1}\uFE0F  ${explainableLabel || "Security Policy"}`);
+  lines.push("");
+  lines.push(formattedArgs);
+  if (!locked) {
+    lines.push("");
+    lines.push('\u21B5 Enter = Allow \u21B5   |   \u238B Esc = Block \u238B   |   "Always Allow" = never ask again');
   }
   return lines.join("\n");
 }
-async function askNativePopup(toolName, args, agent, explainableLabel, locked = false, signal) {
-  if (isTestEnv()) return "deny";
-  if (process.env.NODE9_DEBUG === "1" || process.env.VITEST) {
-    console.log(`[DEBUG Native] askNativePopup called for: ${toolName}`);
-    console.log(`[DEBUG Native] isTestEnv check:`, {
-      VITEST: process.env.VITEST,
-      NODE_ENV: process.env.NODE_ENV,
-      CI: process.env.CI,
-      isTest: isTestEnv()
-    });
-  }
-  const title = locked ? `\u26A1 Node9 \u2014 Locked by Admin Policy` : `\u{1F6E1}\uFE0F Node9 \u2014 Action Requires Approval`;
-  let message = "";
+function buildPangoMessage(toolName, formattedArgs, agent, explainableLabel, locked) {
+  const lines = [];
   if (locked) {
-    message += `\u26A1 Awaiting remote approval via Slack. Local override is disabled.
-`;
-    message += `\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
-`;
-  }
-  message += `Tool:    ${toolName}
-`;
-  message += `Agent:   ${agent || "AI Agent"}
-`;
-  if (explainableLabel) {
-    message += `Reason:  ${explainableLabel}
-`;
+    lines.push('<span foreground="red" weight="bold">\u26A0\uFE0F  LOCKED BY ADMIN POLICY</span>');
+    lines.push("");
   }
-  message += `
-Arguments:
-${formatArgs(args)}`;
+  lines.push(
+    `<b>\u{1F916} ${escapePango(agent || "AI Agent")}</b>  |  <b>\u{1F527} <tt>${escapePango(toolName)}</tt></b>`
+  );
+  lines.push(`<i>\u{1F6E1}\uFE0F  ${escapePango(explainableLabel || "Security Policy")}</i>`);
+  lines.push("");
+  lines.push(`<tt>${escapePango(formattedArgs)}</tt>`);
   if (!locked) {
-    message += `
-
-Enter = Allow  |  Click "Block" to deny`;
+    lines.push("");
+    lines.push(
+      '<small>\u21B5 Enter = <b>Allow \u21B5</b>   |   \u238B Esc = <b>Block \u238B</b>   |   "Always Allow" = never ask again</small>'
+    );
   }
-  const safeMessage = message.replace(/\\/g, "\\\\").replace(/"/g, '\\"').replace(/`/g, "'");
-  const safeTitle = title.replace(/"/g, '\\"');
+  return lines.join("\n");
+}
+async function askNativePopup(toolName, args, agent, explainableLabel, locked = false, signal) {
+  if (isTestEnv()) return "deny";
+  const formattedArgs = formatArgs(args);
+  const title = locked ? `\u26A1 Node9 \u2014 Locked` : `\u{1F6E1}\uFE0F Node9 \u2014 Action Approval`;
+  const message = buildPlainMessage(toolName, formattedArgs, agent, explainableLabel, locked);
+  process.stderr.write(chalk.yellow(`
+\u{1F6E1}\uFE0F  Node9: Intercepted "${toolName}" \u2014 awaiting user...
+`));
   return new Promise((resolve) => {
     let childProcess = null;
     const onAbort = () => {
-      if (childProcess) {
+      if (childProcess && childProcess.pid) {
         try {
           process.kill(childProcess.pid, "SIGKILL");
         } catch {
@@ -103,83 +138,58 @@ Enter = Allow  |  Click "Block" to deny`;
       if (signal.aborted) return resolve("deny");
       signal.addEventListener("abort", onAbort);
     }
-    const cleanup = () => {
-      if (signal) signal.removeEventListener("abort", onAbort);
-    };
     try {
       if (process.platform === "darwin") {
-        const buttons = locked ? `buttons {"Waiting\u2026"} default button "Waiting\u2026"` : `buttons {"Block", "Always Allow", "Allow"} default button "Allow" cancel button "Block"`;
-        const script = `
-          tell application "System Events"
-            activate
-            display dialog "${safeMessage}" with title "${safeTitle}" ${buttons}
-          end tell`;
-        childProcess = spawn("osascript", ["-e", script]);
-        let output = "";
-        childProcess.stdout?.on("data", (d) => output += d.toString());
-        childProcess.on("close", (code) => {
-          cleanup();
-          if (locked) return resolve("deny");
-          if (code === 0) {
-            if (output.includes("Always Allow")) return resolve("always_allow");
-            if (output.includes("Allow")) return resolve("allow");
-          }
-          resolve("deny");
-        });
+        const buttons = locked ? `buttons {"Waiting\u2026"} default button "Waiting\u2026"` : `buttons {"Block \u238B", "Always Allow", "Allow \u21B5"} default button "Allow \u21B5" cancel button "Block \u238B"`;
+        const script = `on run argv
+tell application "System Events"
+activate
+display dialog (item 1 of argv) with title (item 2 of argv) ${buttons}
+end tell
+end run`;
+        childProcess = spawn("osascript", ["-e", script, "--", message, title]);
       } else if (process.platform === "linux") {
-        const argsList = locked ? [
-          "--info",
-          "--title",
-          title,
-          "--text",
-          safeMessage,
-          "--ok-label",
-          "Waiting for Slack\u2026",
-          "--timeout",
-          "300"
-        ] : [
-          "--question",
+        const pangoMessage = buildPangoMessage(
+          toolName,
+          formattedArgs,
+          agent,
+          explainableLabel,
+          locked
+        );
+        const argsList = [
+          locked ? "--info" : "--question",
+          "--modal",
+          "--width=480",
           "--title",
           title,
           "--text",
-          safeMessage,
+          pangoMessage,
           "--ok-label",
-          "Allow",
-          "--cancel-label",
-          "Block",
-          "--extra-button",
-          "Always Allow",
+          locked ? "Waiting..." : "Allow  \u21B5",
           "--timeout",
           "300"
         ];
+        if (!locked) {
+          argsList.push("--cancel-label", "Block  \u238B");
+          argsList.push("--extra-button", "Always Allow");
+        }
         childProcess = spawn("zenity", argsList);
-        let output = "";
-        childProcess.stdout?.on("data", (d) => output += d.toString());
-        childProcess.on("close", (code) => {
-          cleanup();
-          if (locked) return resolve("deny");
-          if (output.trim() === "Always Allow") return resolve("always_allow");
-          if (code === 0) return resolve("allow");
-          resolve("deny");
-        });
       } else if (process.platform === "win32") {
-        const buttonType = locked ? "OK" : "YesNo";
-        const ps = `
-          Add-Type -AssemblyName PresentationFramework;
-          $res = [System.Windows.MessageBox]::Show("${safeMessage}", "${safeTitle}", "${buttonType}", "Warning", "Button2", "DefaultDesktopOnly");
-          if ($res -eq "Yes") { exit 0 } else { exit 1 }`;
+        const b64Msg = Buffer.from(message).toString("base64");
+        const b64Title = Buffer.from(title).toString("base64");
+        const ps = `Add-Type -AssemblyName PresentationFramework; $msg = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String("${b64Msg}")); $title = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String("${b64Title}")); $res = [System.Windows.MessageBox]::Show($msg, $title, "${locked ? "OK" : "YesNo"}", "Warning", "Button2", "DefaultDesktopOnly"); if ($res -eq "Yes") { exit 0 } else { exit 1 }`;
         childProcess = spawn("powershell", ["-Command", ps]);
-        childProcess.on("close", (code) => {
-          cleanup();
-          if (locked) return resolve("deny");
-          resolve(code === 0 ? "allow" : "deny");
-        });
-      } else {
-        cleanup();
-        resolve("deny");
       }
+      let output = "";
+      childProcess?.stdout?.on("data", (d) => output += d.toString());
+      childProcess?.on("close", (code) => {
+        if (signal) signal.removeEventListener("abort", onAbort);
+        if (locked) return resolve("deny");
+        if (output.includes("Always Allow")) return resolve("always_allow");
+        if (code === 0) return resolve("allow");
+        resolve("deny");
+      });
     } catch {
-      cleanup();
       resolve("deny");
     }
   });
@@ -188,6 +198,8 @@ Enter = Allow  |  Click "Block" to deny`;
 // src/core.ts
 var PAUSED_FILE = path.join(os.homedir(), ".node9", "PAUSED");
 var TRUST_FILE = path.join(os.homedir(), ".node9", "trust.json");
+var LOCAL_AUDIT_LOG = path.join(os.homedir(), ".node9", "audit.log");
+var HOOK_DEBUG_LOG = path.join(os.homedir(), ".node9", "hook-debug.log");
 function checkPause() {
   try {
     if (!fs.existsSync(PAUSED_FILE)) return { paused: false };
@@ -244,36 +256,39 @@ function writeTrustSession(toolName, durationMs) {
     }
   }
 }
-function appendAuditModeEntry(toolName, args) {
+function appendToLog(logPath, entry) {
   try {
-    const entry = JSON.stringify({
-      ts: (/* @__PURE__ */ new Date()).toISOString(),
-      tool: toolName,
-      args,
-      decision: "would-have-blocked",
-      source: "audit-mode"
-    });
-    const logPath = path.join(os.homedir(), ".node9", "audit.log");
     const dir = path.dirname(logPath);
     if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true });
-    fs.appendFileSync(logPath, entry + "\n");
+    fs.appendFileSync(logPath, JSON.stringify(entry) + "\n");
   } catch {
   }
 }
-var DANGEROUS_WORDS = [
-  "delete",
-  "drop",
-  "remove",
-  "terminate",
-  "refund",
-  "write",
-  "update",
-  "destroy",
-  "rm",
-  "rmdir",
-  "purge",
-  "format"
-];
+function appendHookDebug(toolName, args, meta) {
+  const safeArgs = args ? JSON.parse(redactSecrets(JSON.stringify(args))) : {};
+  appendToLog(HOOK_DEBUG_LOG, {
+    ts: (/* @__PURE__ */ new Date()).toISOString(),
+    tool: toolName,
+    args: safeArgs,
+    agent: meta?.agent,
+    mcpServer: meta?.mcpServer,
+    hostname: os.hostname(),
+    cwd: process.cwd()
+  });
+}
+function appendLocalAudit(toolName, args, decision, checkedBy, meta) {
+  const safeArgs = args ? JSON.parse(redactSecrets(JSON.stringify(args))) : {};
+  appendToLog(LOCAL_AUDIT_LOG, {
+    ts: (/* @__PURE__ */ new Date()).toISOString(),
+    tool: toolName,
+    args: safeArgs,
+    decision,
+    checkedBy,
+    agent: meta?.agent,
+    mcpServer: meta?.mcpServer,
+    hostname: os.hostname()
+  });
+}
 function tokenize(toolName) {
   return toolName.toLowerCase().split(/[_.\-\s]+/).filter(Boolean);
 }
@@ -367,16 +382,41 @@ async function analyzeShellCommand(command) {
   }
   return { actions, paths, allTokens };
 }
+function redactSecrets(text) {
+  if (!text) return text;
+  let redacted = text;
+  redacted = redacted.replace(
+    /(authorization:\s*(?:bearer|basic)\s+)[a-zA-Z0-9._\-\/\\=]+/gi,
+    "$1********"
+  );
+  redacted = redacted.replace(
+    /(api[_-]?key|secret|password|token)([:=]\s*['"]?)[a-zA-Z0-9._\-]{8,}/gi,
+    "$1$2********"
+  );
+  return redacted;
+}
+var DANGEROUS_WORDS = [
+  "drop",
+  "truncate",
+  "purge",
+  "format",
+  "destroy",
+  "terminate",
+  "revoke",
+  "docker",
+  "psql"
+];
 var DEFAULT_CONFIG = {
   settings: {
     mode: "standard",
     autoStartDaemon: true,
-    enableUndo: false,
+    enableUndo: true,
+    // 🔥 ALWAYS TRUE BY DEFAULT for the safety net
     enableHookLogDebug: false,
     approvers: { native: true, browser: true, cloud: true, terminal: true }
   },
   policy: {
-    sandboxPaths: [],
+    sandboxPaths: ["/tmp/**", "**/sandbox/**", "**/test-results/**"],
     dangerousWords: DANGEROUS_WORDS,
     ignoredTools: [
       "list_*",
@@ -384,12 +424,44 @@ var DEFAULT_CONFIG = {
       "read_*",
       "describe_*",
       "read",
+      "glob",
       "grep",
       "ls",
-      "askuserquestion"
+      "notebookread",
+      "notebookedit",
+      "webfetch",
+      "websearch",
+      "exitplanmode",
+      "askuserquestion",
+      "agent",
+      "task*",
+      "toolsearch",
+      "mcp__ide__*",
+      "getDiagnostics"
     ],
-    toolInspection: { bash: "command", shell: "command" },
-    rules: [{ action: "rm", allowPaths: ["**/node_modules/**", "dist/**", ".DS_Store"] }]
+    toolInspection: {
+      bash: "command",
+      shell: "command",
+      run_shell_command: "command",
+      "terminal.execute": "command",
+      "postgres:query": "sql"
+    },
+    rules: [
+      {
+        action: "rm",
+        allowPaths: [
+          "**/node_modules/**",
+          "dist/**",
+          "build/**",
+          ".next/**",
+          "coverage/**",
+          ".cache/**",
+          "tmp/**",
+          "temp/**",
+          ".DS_Store"
+        ]
+      }
+    ]
   },
   environments: {}
 };
@@ -427,20 +499,15 @@ async function evaluatePolicy(toolName, args, agent) {
   }
   const isManual = agent === "Terminal";
   if (isManual) {
-    const NUCLEAR_COMMANDS = [
-      "drop",
-      "destroy",
-      "purge",
-      "rmdir",
-      "format",
-      "truncate",
-      "alter",
-      "grant",
-      "revoke",
-      "docker"
-    ];
-    const hasNuclear = allTokens.some((t) => NUCLEAR_COMMANDS.includes(t.toLowerCase()));
-    if (!hasNuclear) return { decision: "allow" };
+    const SYSTEM_DISASTER_COMMANDS = ["mkfs", "shred", "dd", "drop", "truncate", "purge"];
+    const hasSystemDisaster = allTokens.some(
+      (t) => SYSTEM_DISASTER_COMMANDS.includes(t.toLowerCase())
+    );
+    const isRootWipe = allTokens.includes("rm") && (allTokens.includes("/") || allTokens.includes("/*"));
+    if (hasSystemDisaster || isRootWipe) {
+      return { decision: "review", blockedByLabel: "Manual Nuclear Protection" };
+    }
+    return { decision: "allow" };
   }
   if (pathTokens.length > 0 && config.policy.sandboxPaths.length > 0) {
     const allInSandbox = pathTokens.every((p) => matchesPattern(p, config.policy.sandboxPaths));
@@ -454,27 +521,39 @@ async function evaluatePolicy(toolName, args, agent) {
       if (pathTokens.length > 0) {
         const anyBlocked = pathTokens.some((p) => matchesPattern(p, rule.blockPaths || []));
         if (anyBlocked)
-          return { decision: "review", blockedByLabel: "Project/Global Config (Rule Block)" };
+          return {
+            decision: "review",
+            blockedByLabel: `Project/Global Config \u2014 rule "${rule.action}" (path blocked)`
+          };
         const allAllowed = pathTokens.every((p) => matchesPattern(p, rule.allowPaths || []));
         if (allAllowed) return { decision: "allow" };
       }
-      return { decision: "review", blockedByLabel: "Project/Global Config (Rule Default Block)" };
+      return {
+        decision: "review",
+        blockedByLabel: `Project/Global Config \u2014 rule "${rule.action}" (default block)`
+      };
     }
   }
+  let matchedDangerousWord;
   const isDangerous = allTokens.some(
     (token) => config.policy.dangerousWords.some((word) => {
       const w = word.toLowerCase();
-      if (token === w) return true;
-      try {
-        return new RegExp(`\\b${w}\\b`, "i").test(token);
-      } catch {
-        return false;
-      }
+      const hit = token === w || (() => {
+        try {
+          return new RegExp(`\\b${w}\\b`, "i").test(token);
+        } catch {
+          return false;
+        }
+      })();
+      if (hit && !matchedDangerousWord) matchedDangerousWord = word;
+      return hit;
     })
   );
   if (isDangerous) {
-    const label = isManual ? "Manual Nuclear Protection" : "Project/Global Config (Dangerous Word)";
-    return { decision: "review", blockedByLabel: label };
+    return {
+      decision: "review",
+      blockedByLabel: `Project/Global Config \u2014 dangerous word: "${matchedDangerousWord}"`
+    };
   }
   if (config.settings.mode === "strict") {
     const envConfig = getActiveEnvironment(config);
@@ -589,13 +668,16 @@ async function authorizeHeadless(toolName, args, allowTerminalFallback = false,
     approvers.browser = false;
     approvers.terminal = false;
   }
+  if (config.settings.enableHookLogDebug && !isTestEnv2) {
+    appendHookDebug(toolName, args, meta);
+  }
   const isManual = meta?.agent === "Terminal";
   let explainableLabel = "Local Config";
   if (config.settings.mode === "audit") {
     if (!isIgnoredTool(toolName)) {
       const policyResult = await evaluatePolicy(toolName, args, meta?.agent);
       if (policyResult.decision === "review") {
-        appendAuditModeEntry(toolName, args);
+        appendLocalAudit(toolName, args, "allow", "audit-mode", meta);
         sendDesktopNotification(
           "Node9 Audit Mode",
           `Would have blocked "${toolName}" (${policyResult.blockedByLabel || "Local Config"}) \u2014 running in audit mode`
@@ -607,20 +689,24 @@ async function authorizeHeadless(toolName, args, allowTerminalFallback = false,
   if (!isIgnoredTool(toolName)) {
     if (getActiveTrustSession(toolName)) {
       if (creds?.apiKey) auditLocalAllow(toolName, args, "trust", creds, meta);
+      if (!isManual) appendLocalAudit(toolName, args, "allow", "trust", meta);
       return { approved: true, checkedBy: "trust" };
     }
     const policyResult = await evaluatePolicy(toolName, args, meta?.agent);
     if (policyResult.decision === "allow") {
       if (creds?.apiKey) auditLocalAllow(toolName, args, "local-policy", creds, meta);
+      if (!isManual) appendLocalAudit(toolName, args, "allow", "local-policy", meta);
       return { approved: true, checkedBy: "local-policy" };
     }
     explainableLabel = policyResult.blockedByLabel || "Local Config";
     const persistent = getPersistentDecision(toolName);
     if (persistent === "allow") {
       if (creds?.apiKey) auditLocalAllow(toolName, args, "persistent", creds, meta);
+      if (!isManual) appendLocalAudit(toolName, args, "allow", "persistent", meta);
       return { approved: true, checkedBy: "persistent" };
     }
     if (persistent === "deny") {
+      if (!isManual) appendLocalAudit(toolName, args, "deny", "persistent-deny", meta);
       return {
         approved: false,
         reason: `This tool ("${toolName}") is explicitly listed in your 'Always Deny' list.`,
@@ -630,6 +716,7 @@ async function authorizeHeadless(toolName, args, allowTerminalFallback = false,
     }
   } else {
     if (creds?.apiKey) auditLocalAllow(toolName, args, "ignoredTools", creds, meta);
+    if (!isManual) appendLocalAudit(toolName, args, "allow", "ignored", meta);
     return { approved: true };
   }
   let cloudRequestId = null;
@@ -657,8 +744,8 @@ async function authorizeHeadless(toolName, args, allowTerminalFallback = false,
       const isNetworkError = error.message.includes("fetch") || error.name === "AbortError" || error.message.includes("ECONNREFUSED");
       const reason = isAuthError ? "Invalid or missing API key. Run `node9 login` to generate a key (must start with n9_live_)." : isNetworkError ? "Could not reach the Node9 cloud. Check your network or API URL." : error.message;
       console.error(
-        chalk.yellow(`
-\u26A0\uFE0F  Node9: Cloud API Handshake failed \u2014 ${reason}`) + chalk.dim(`
+        chalk2.yellow(`
+\u26A0\uFE0F  Node9: Cloud API Handshake failed \u2014 ${reason}`) + chalk2.dim(`
    Falling back to local rules...
 `)
       );
@@ -666,13 +753,13 @@ async function authorizeHeadless(toolName, args, allowTerminalFallback = false,
   }
   if (cloudEnforced && cloudRequestId) {
     console.error(
-      chalk.yellow("\n\u{1F6E1}\uFE0F  Node9: Action suspended \u2014 waiting for Organization approval.")
+      chalk2.yellow("\n\u{1F6E1}\uFE0F  Node9: Action suspended \u2014 waiting for Organization approval.")
     );
-    console.error(chalk.cyan("   Dashboard  \u2192 ") + chalk.bold("Mission Control > Activity Feed\n"));
+    console.error(chalk2.cyan("   Dashboard  \u2192 ") + chalk2.bold("Mission Control > Activity Feed\n"));
   } else if (!cloudEnforced) {
     const cloudOffReason = !creds?.apiKey ? "no API key \u2014 run `node9 login` to connect" : "privacy mode (cloud disabled)";
     console.error(
-      chalk.dim(`
+      chalk2.dim(`
 \u{1F6E1}\uFE0F  Node9: intercepted "${toolName}" \u2014 cloud off (${cloudOffReason})
 `)
     );
@@ -737,9 +824,9 @@ async function authorizeHeadless(toolName, args, allowTerminalFallback = false,
         try {
           if (!approvers.native && !cloudEnforced) {
             console.error(
-              chalk.yellow("\n\u{1F6E1}\uFE0F  Node9: Action suspended \u2014 waiting for browser approval.")
+              chalk2.yellow("\n\u{1F6E1}\uFE0F  Node9: Action suspended \u2014 waiting for browser approval.")
             );
-            console.error(chalk.cyan(`   URL \u2192 http://${DAEMON_HOST}:${DAEMON_PORT}/
+            console.error(chalk2.cyan(`   URL \u2192 http://${DAEMON_HOST}:${DAEMON_PORT}/
 `));
           }
           const daemonDecision = await askDaemon(toolName, args, meta, signal);
@@ -762,11 +849,11 @@ async function authorizeHeadless(toolName, args, allowTerminalFallback = false,
     racePromises.push(
       (async () => {
         try {
-          console.log(chalk.bgRed.white.bold(` \u{1F6D1} NODE9 INTERCEPTOR `));
-          console.log(`${chalk.bold("Action:")} ${chalk.red(toolName)}`);
-          console.log(`${chalk.bold("Flagged By:")} ${chalk.yellow(explainableLabel)}`);
+          console.log(chalk2.bgRed.white.bold(` \u{1F6D1} NODE9 INTERCEPTOR `));
+          console.log(`${chalk2.bold("Action:")} ${chalk2.red(toolName)}`);
+          console.log(`${chalk2.bold("Flagged By:")} ${chalk2.yellow(explainableLabel)}`);
           if (isRemoteLocked) {
-            console.log(chalk.yellow(`\u26A1 LOCKED BY ADMIN POLICY: Waiting for Slack Approval...
+            console.log(chalk2.yellow(`\u26A1 LOCKED BY ADMIN POLICY: Waiting for Slack Approval...
 `));
             await new Promise((_, reject) => {
               signal.addEventListener("abort", () => reject(new Error("Aborted by SaaS")));
@@ -854,6 +941,15 @@ REASON: Action blocked because no approval channels are available. (Native/Brows
   if (cloudRequestId && creds && finalResult.checkedBy !== "cloud") {
     await resolveNode9SaaS(cloudRequestId, creds, finalResult.approved);
   }
+  if (!isManual) {
+    appendLocalAudit(
+      toolName,
+      args,
+      finalResult.approved ? "allow" : "deny",
+      finalResult.checkedBy || finalResult.blockedBy || "unknown",
+      meta
+    );
+  }
   return finalResult;
 }
 function getConfig() {
@@ -884,8 +980,8 @@ function getConfig() {
       mergedSettings.enableHookLogDebug = s.enableHookLogDebug;
     if (s.approvers) mergedSettings.approvers = { ...mergedSettings.approvers, ...s.approvers };
     if (p.sandboxPaths) mergedPolicy.sandboxPaths.push(...p.sandboxPaths);
-    if (p.dangerousWords) mergedPolicy.dangerousWords = [...p.dangerousWords];
     if (p.ignoredTools) mergedPolicy.ignoredTools.push(...p.ignoredTools);
+    if (p.dangerousWords) mergedPolicy.dangerousWords = [...p.dangerousWords];
     if (p.toolInspection)
       mergedPolicy.toolInspection = { ...mergedPolicy.toolInspection, ...p.toolInspection };
     if (p.rules) mergedPolicy.rules.push(...p.rules);
@@ -1017,11 +1113,11 @@ async function pollNode9SaaS(requestId, creds, signal) {
       if (!statusRes.ok) continue;
       const { status, reason } = await statusRes.json();
       if (status === "APPROVED") {
-        console.error(chalk.green("\u2705  Approved via Cloud.\n"));
+        console.error(chalk2.green("\u2705  Approved via Cloud.\n"));
         return { approved: true, reason };
       }
       if (status === "DENIED" || status === "AUTO_BLOCKED" || status === "TIMED_OUT") {
-        console.error(chalk.red("\u274C  Denied via Cloud.\n"));
+        console.error(chalk2.red("\u274C  Denied via Cloud.\n"));
         return { approved: false, reason };
       }
     } catch {