@node9/proxy 1.0.14 → 1.0.16

package/dist/cli.mjs

@@ -1,21 +1,13 @@
 #!/usr/bin/env node
-
-// src/cli.ts
-import { Command } from "commander";
-
-// src/core.ts
-import chalk2 from "chalk";
-import { confirm } from "@inquirer/prompts";
-import fs2 from "fs";
-import path4 from "path";
-import os2 from "os";
-import pm from "picomatch";
-import { parse } from "sh-syntax";
-
-// src/ui/native.ts
-import { spawn } from "child_process";
-import path2 from "path";
-import chalk from "chalk";
+var __defProp = Object.defineProperty;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
 
 // src/context-sniper.ts
 import path from "path";
@@ -48,22 +40,6 @@ function extractContext(text, matchedWord) {
 ... [${lines.length - end} lines hidden] ...` : "";
   return { snippet: `${head}${snippet}${tail}`, lineIndex };
 }
-var CODE_KEYS = [
-  "command",
-  "cmd",
-  "shell_command",
-  "bash_command",
-  "script",
-  "code",
-  "input",
-  "sql",
-  "query",
-  "arguments",
-  "args",
-  "param",
-  "params",
-  "text"
-];
 function computeRiskMetadata(args, tier, blockedByLabel, matchedField, matchedWord, ruleName) {
   let intent = "EXEC";
   let contextSnippet;
@@ -118,11 +94,33 @@ function computeRiskMetadata(args, tier, blockedByLabel, matchedField, matchedWo
     ...ruleName && { ruleName }
   };
 }
+var CODE_KEYS;
+var init_context_sniper = __esm({
+  "src/context-sniper.ts"() {
+    "use strict";
+    CODE_KEYS = [
+      "command",
+      "cmd",
+      "shell_command",
+      "bash_command",
+      "script",
+      "code",
+      "input",
+      "sql",
+      "query",
+      "arguments",
+      "args",
+      "param",
+      "params",
+      "text"
+    ];
+  }
+});
 
 // src/ui/native.ts
-var isTestEnv = () => {
-  return process.env.NODE_ENV === "test" || process.env.VITEST === "true" || !!process.env.VITEST || process.env.CI === "true" || !!process.env.CI || process.env.NODE9_TESTING === "1";
-};
+import { spawn } from "child_process";
+import path2 from "path";
+import chalk from "chalk";
 function formatArgs(args, matchedField, matchedWord) {
   if (args === null || args === void 0) return { message: "(none)", intent: "EXEC" };
   let parsed = args;
@@ -332,81 +330,19 @@ end run`;
     }
   });
 }
+var isTestEnv;
+var init_native = __esm({
+  "src/ui/native.ts"() {
+    "use strict";
+    init_context_sniper();
+    isTestEnv = () => {
+      return process.env.NODE_ENV === "test" || process.env.VITEST === "true" || !!process.env.VITEST || process.env.CI === "true" || !!process.env.CI || process.env.NODE9_TESTING === "1";
+    };
+  }
+});
 
 // src/config-schema.ts
 import { z } from "zod";
-var noNewlines = z.string().refine((s) => !s.includes("\n") && !s.includes("\r"), {
-  message: "Value must not contain literal newline characters (use \\n instead)"
-});
-var SmartConditionSchema = z.object({
-  field: z.string().min(1, "Condition field must not be empty"),
-  op: z.enum(
-    [
-      "matches",
-      "notMatches",
-      "contains",
-      "notContains",
-      "exists",
-      "notExists",
-      "matchesGlob",
-      "notMatchesGlob"
-    ],
-    {
-      errorMap: () => ({
-        message: "op must be one of: matches, notMatches, contains, notContains, exists, notExists, matchesGlob, notMatchesGlob"
-      })
-    }
-  ),
-  value: z.string().optional(),
-  flags: z.string().optional()
-});
-var SmartRuleSchema = z.object({
-  name: z.string().optional(),
-  tool: z.string().min(1, "Smart rule tool must not be empty"),
-  conditions: z.array(SmartConditionSchema).min(1, "Smart rule must have at least one condition"),
-  conditionMode: z.enum(["all", "any"]).optional(),
-  verdict: z.enum(["allow", "review", "block"], {
-    errorMap: () => ({ message: "verdict must be one of: allow, review, block" })
-  }),
-  reason: z.string().optional()
-});
-var ConfigFileSchema = z.object({
-  version: z.string().optional(),
-  settings: z.object({
-    mode: z.enum(["standard", "strict", "audit"]).optional(),
-    autoStartDaemon: z.boolean().optional(),
-    enableUndo: z.boolean().optional(),
-    enableHookLogDebug: z.boolean().optional(),
-    approvalTimeoutMs: z.number().nonnegative().optional(),
-    approvers: z.object({
-      native: z.boolean().optional(),
-      browser: z.boolean().optional(),
-      cloud: z.boolean().optional(),
-      terminal: z.boolean().optional()
-    }).optional(),
-    environment: z.string().optional(),
-    slackEnabled: z.boolean().optional(),
-    enableTrustSessions: z.boolean().optional(),
-    allowGlobalPause: z.boolean().optional()
-  }).optional(),
-  policy: z.object({
-    sandboxPaths: z.array(z.string()).optional(),
-    dangerousWords: z.array(noNewlines).optional(),
-    ignoredTools: z.array(z.string()).optional(),
-    toolInspection: z.record(z.string()).optional(),
-    smartRules: z.array(SmartRuleSchema).optional(),
-    snapshot: z.object({
-      tools: z.array(z.string()).optional(),
-      onlyPaths: z.array(z.string()).optional(),
-      ignorePaths: z.array(z.string()).optional()
-    }).optional(),
-    dlp: z.object({
-      enabled: z.boolean().optional(),
-      scanIgnoredTools: z.boolean().optional()
-    }).optional()
-  }).optional(),
-  environments: z.record(z.object({ requireApproval: z.boolean().optional() })).optional()
-}).strict({ message: "Config contains unknown top-level keys" });
 function sanitizeConfig(raw) {
   const result = ConfigFileSchema.safeParse(raw);
   if (result.success) {
@@ -424,8 +360,8 @@ function sanitizeConfig(raw) {
     }
   }
   const lines = result.error.issues.map((issue) => {
-    const path9 = issue.path.length > 0 ? issue.path.join(".") : "root";
-    return `  \u2022 ${path9}: ${issue.message}`;
+    const path10 = issue.path.length > 0 ? issue.path.join(".") : "root";
+    return `  \u2022 ${path10}: ${issue.message}`;
   });
   return {
     sanitized,
@@ -433,179 +369,97 @@ function sanitizeConfig(raw) {
 ${lines.join("\n")}`
   };
 }
+var noNewlines, SmartConditionSchema, SmartRuleSchema, ConfigFileSchema;
+var init_config_schema = __esm({
+  "src/config-schema.ts"() {
+    "use strict";
+    noNewlines = z.string().refine((s) => !s.includes("\n") && !s.includes("\r"), {
+      message: "Value must not contain literal newline characters (use \\n instead)"
+    });
+    SmartConditionSchema = z.object({
+      field: z.string().min(1, "Condition field must not be empty"),
+      op: z.enum(
+        [
+          "matches",
+          "notMatches",
+          "contains",
+          "notContains",
+          "exists",
+          "notExists",
+          "matchesGlob",
+          "notMatchesGlob"
+        ],
+        {
+          errorMap: () => ({
+            message: "op must be one of: matches, notMatches, contains, notContains, exists, notExists, matchesGlob, notMatchesGlob"
+          })
+        }
+      ),
+      value: z.string().optional(),
+      flags: z.string().optional()
+    }).refine(
+      (c) => {
+        if (c.op === "matchesGlob" || c.op === "notMatchesGlob") return c.value !== void 0;
+        return true;
+      },
+      { message: "matchesGlob and notMatchesGlob conditions require a value field" }
+    );
+    SmartRuleSchema = z.object({
+      name: z.string().optional(),
+      tool: z.string().min(1, "Smart rule tool must not be empty"),
+      conditions: z.array(SmartConditionSchema).min(1, "Smart rule must have at least one condition"),
+      conditionMode: z.enum(["all", "any"]).optional(),
+      verdict: z.enum(["allow", "review", "block"], {
+        errorMap: () => ({ message: "verdict must be one of: allow, review, block" })
+      }),
+      reason: z.string().optional()
+    });
+    ConfigFileSchema = z.object({
+      version: z.string().optional(),
+      settings: z.object({
+        mode: z.enum(["standard", "strict", "audit"]).optional(),
+        autoStartDaemon: z.boolean().optional(),
+        enableUndo: z.boolean().optional(),
+        enableHookLogDebug: z.boolean().optional(),
+        approvalTimeoutMs: z.number().nonnegative().optional(),
+        flightRecorder: z.boolean().optional(),
+        approvers: z.object({
+          native: z.boolean().optional(),
+          browser: z.boolean().optional(),
+          cloud: z.boolean().optional(),
+          terminal: z.boolean().optional()
+        }).optional(),
+        environment: z.string().optional(),
+        slackEnabled: z.boolean().optional(),
+        enableTrustSessions: z.boolean().optional(),
+        allowGlobalPause: z.boolean().optional()
+      }).optional(),
+      policy: z.object({
+        sandboxPaths: z.array(z.string()).optional(),
+        dangerousWords: z.array(noNewlines).optional(),
+        ignoredTools: z.array(z.string()).optional(),
+        toolInspection: z.record(z.string()).optional(),
+        smartRules: z.array(SmartRuleSchema).optional(),
+        snapshot: z.object({
+          tools: z.array(z.string()).optional(),
+          onlyPaths: z.array(z.string()).optional(),
+          ignorePaths: z.array(z.string()).optional()
+        }).optional(),
+        dlp: z.object({
+          enabled: z.boolean().optional(),
+          scanIgnoredTools: z.boolean().optional()
+        }).optional()
+      }).optional(),
+      environments: z.record(z.object({ requireApproval: z.boolean().optional() })).optional()
+    }).strict({ message: "Config contains unknown top-level keys" });
+  }
+});
 
 // src/shields.ts
 import fs from "fs";
 import path3 from "path";
 import os from "os";
 import crypto from "crypto";
-var SHIELDS = {
-  postgres: {
-    name: "postgres",
-    description: "Protects PostgreSQL databases from destructive AI operations",
-    aliases: ["pg", "postgresql"],
-    smartRules: [
-      {
-        name: "shield:postgres:block-drop-table",
-        tool: "*",
-        conditions: [{ field: "sql", op: "matches", value: "DROP\\s+TABLE", flags: "i" }],
-        verdict: "block",
-        reason: "DROP TABLE is irreversible \u2014 blocked by Postgres shield"
-      },
-      {
-        name: "shield:postgres:block-truncate",
-        tool: "*",
-        conditions: [{ field: "sql", op: "matches", value: "TRUNCATE\\s+TABLE", flags: "i" }],
-        verdict: "block",
-        reason: "TRUNCATE is irreversible \u2014 blocked by Postgres shield"
-      },
-      {
-        name: "shield:postgres:block-drop-column",
-        tool: "*",
-        conditions: [
-          { field: "sql", op: "matches", value: "ALTER\\s+TABLE.*DROP\\s+COLUMN", flags: "i" }
-        ],
-        verdict: "block",
-        reason: "DROP COLUMN is irreversible \u2014 blocked by Postgres shield"
-      },
-      {
-        name: "shield:postgres:review-grant-revoke",
-        tool: "*",
-        conditions: [{ field: "sql", op: "matches", value: "\\b(GRANT|REVOKE)\\b", flags: "i" }],
-        verdict: "review",
-        reason: "Permission changes require human approval (Postgres shield)"
-      }
-    ],
-    dangerousWords: ["dropdb", "pg_dropcluster"]
-  },
-  github: {
-    name: "github",
-    description: "Protects GitHub repositories from destructive AI operations",
-    aliases: ["git"],
-    smartRules: [
-      {
-        // Note: git branch -d/-D is already caught by the built-in review-git-destructive rule.
-        // This rule adds coverage for `git push --delete` which the built-in does not match.
-        name: "shield:github:review-delete-branch-remote",
-        tool: "bash",
-        conditions: [
-          {
-            field: "command",
-            op: "matches",
-            value: "git\\s+push\\s+.*--delete",
-            flags: "i"
-          }
-        ],
-        verdict: "review",
-        reason: "Remote branch deletion requires human approval (GitHub shield)"
-      },
-      {
-        name: "shield:github:block-delete-repo",
-        tool: "*",
-        conditions: [
-          { field: "command", op: "matches", value: "gh\\s+repo\\s+delete", flags: "i" }
-        ],
-        verdict: "block",
-        reason: "Repository deletion is irreversible \u2014 blocked by GitHub shield"
-      }
-    ],
-    dangerousWords: []
-  },
-  aws: {
-    name: "aws",
-    description: "Protects AWS infrastructure from destructive AI operations",
-    aliases: ["amazon"],
-    smartRules: [
-      {
-        name: "shield:aws:block-delete-s3-bucket",
-        tool: "*",
-        conditions: [
-          {
-            field: "command",
-            op: "matches",
-            value: "aws\\s+s3.*rb\\s|aws\\s+s3api\\s+delete-bucket",
-            flags: "i"
-          }
-        ],
-        verdict: "block",
-        reason: "S3 bucket deletion is irreversible \u2014 blocked by AWS shield"
-      },
-      {
-        name: "shield:aws:review-iam-changes",
-        tool: "*",
-        conditions: [
-          {
-            field: "command",
-            op: "matches",
-            value: "aws\\s+iam\\s+(create|delete|attach|detach|put|remove)",
-            flags: "i"
-          }
-        ],
-        verdict: "review",
-        reason: "IAM changes require human approval (AWS shield)"
-      },
-      {
-        name: "shield:aws:block-ec2-terminate",
-        tool: "*",
-        conditions: [
-          {
-            field: "command",
-            op: "matches",
-            value: "aws\\s+ec2\\s+terminate-instances",
-            flags: "i"
-          }
-        ],
-        verdict: "block",
-        reason: "EC2 instance termination is irreversible \u2014 blocked by AWS shield"
-      },
-      {
-        name: "shield:aws:review-rds-delete",
-        tool: "*",
-        conditions: [
-          { field: "command", op: "matches", value: "aws\\s+rds\\s+delete-", flags: "i" }
-        ],
-        verdict: "review",
-        reason: "RDS deletion requires human approval (AWS shield)"
-      }
-    ],
-    dangerousWords: []
-  },
-  filesystem: {
-    name: "filesystem",
-    description: "Protects the local filesystem from dangerous AI operations",
-    aliases: ["fs"],
-    smartRules: [
-      {
-        name: "shield:filesystem:review-chmod-777",
-        tool: "bash",
-        conditions: [
-          { field: "command", op: "matches", value: "chmod\\s+(777|a\\+rwx)", flags: "i" }
-        ],
-        verdict: "review",
-        reason: "chmod 777 requires human approval (filesystem shield)"
-      },
-      {
-        name: "shield:filesystem:review-write-etc",
-        tool: "bash",
-        conditions: [
-          {
-            field: "command",
-            // Narrow to write-indicative operations to avoid approval fatigue on reads.
-            // Matches: tee /etc/*, cp .../etc/*, mv .../etc/*, > /etc/*, install .../etc/*
-            op: "matches",
-            value: "(tee|\\bcp\\b|\\bmv\\b|install|>+)\\s+.*\\/etc\\/"
-          }
-        ],
-        verdict: "review",
-        reason: "Writing to /etc requires human approval (filesystem shield)"
-      }
-    ],
-    // dd removed: too common as a legitimate tool (disk imaging, file ops).
-    // mkfs removed: already in the built-in DANGEROUS_WORDS baseline.
-    // wipefs retained: rarely legitimate in an agent context and not in built-ins.
-    dangerousWords: ["wipefs"]
-  }
-};
 function resolveShieldName(input) {
   const lower = input.toLowerCase();
   if (SHIELDS[lower]) return lower;
@@ -621,7 +475,6 @@ function getShield(name) {
 function listShields() {
   return Object.values(SHIELDS);
 }
-var SHIELDS_STATE_FILE = path3.join(os.homedir(), ".node9", "shields.json");
 function readActiveShields() {
   try {
     const raw = fs.readFileSync(SHIELDS_STATE_FILE, "utf-8");
@@ -646,21 +499,182 @@ function writeActiveShields(active) {
   fs.writeFileSync(tmp, JSON.stringify({ active }, null, 2), { mode: 384 });
   fs.renameSync(tmp, SHIELDS_STATE_FILE);
 }
+var SHIELDS, SHIELDS_STATE_FILE;
+var init_shields = __esm({
+  "src/shields.ts"() {
+    "use strict";
+    SHIELDS = {
+      postgres: {
+        name: "postgres",
+        description: "Protects PostgreSQL databases from destructive AI operations",
+        aliases: ["pg", "postgresql"],
+        smartRules: [
+          {
+            name: "shield:postgres:block-drop-table",
+            tool: "*",
+            conditions: [{ field: "sql", op: "matches", value: "DROP\\s+TABLE", flags: "i" }],
+            verdict: "block",
+            reason: "DROP TABLE is irreversible \u2014 blocked by Postgres shield"
+          },
+          {
+            name: "shield:postgres:block-truncate",
+            tool: "*",
+            conditions: [{ field: "sql", op: "matches", value: "TRUNCATE\\s+TABLE", flags: "i" }],
+            verdict: "block",
+            reason: "TRUNCATE is irreversible \u2014 blocked by Postgres shield"
+          },
+          {
+            name: "shield:postgres:block-drop-column",
+            tool: "*",
+            conditions: [
+              { field: "sql", op: "matches", value: "ALTER\\s+TABLE.*DROP\\s+COLUMN", flags: "i" }
+            ],
+            verdict: "block",
+            reason: "DROP COLUMN is irreversible \u2014 blocked by Postgres shield"
+          },
+          {
+            name: "shield:postgres:review-grant-revoke",
+            tool: "*",
+            conditions: [{ field: "sql", op: "matches", value: "\\b(GRANT|REVOKE)\\b", flags: "i" }],
+            verdict: "review",
+            reason: "Permission changes require human approval (Postgres shield)"
+          }
+        ],
+        dangerousWords: ["dropdb", "pg_dropcluster"]
+      },
+      github: {
+        name: "github",
+        description: "Protects GitHub repositories from destructive AI operations",
+        aliases: ["git"],
+        smartRules: [
+          {
+            // Note: git branch -d/-D is already caught by the built-in review-git-destructive rule.
+            // This rule adds coverage for `git push --delete` which the built-in does not match.
+            name: "shield:github:review-delete-branch-remote",
+            tool: "bash",
+            conditions: [
+              {
+                field: "command",
+                op: "matches",
+                value: "git\\s+push\\s+.*--delete",
+                flags: "i"
+              }
+            ],
+            verdict: "review",
+            reason: "Remote branch deletion requires human approval (GitHub shield)"
+          },
+          {
+            name: "shield:github:block-delete-repo",
+            tool: "*",
+            conditions: [
+              { field: "command", op: "matches", value: "gh\\s+repo\\s+delete", flags: "i" }
+            ],
+            verdict: "block",
+            reason: "Repository deletion is irreversible \u2014 blocked by GitHub shield"
+          }
+        ],
+        dangerousWords: []
+      },
+      aws: {
+        name: "aws",
+        description: "Protects AWS infrastructure from destructive AI operations",
+        aliases: ["amazon"],
+        smartRules: [
+          {
+            name: "shield:aws:block-delete-s3-bucket",
+            tool: "*",
+            conditions: [
+              {
+                field: "command",
+                op: "matches",
+                value: "aws\\s+s3.*rb\\s|aws\\s+s3api\\s+delete-bucket",
+                flags: "i"
+              }
+            ],
+            verdict: "block",
+            reason: "S3 bucket deletion is irreversible \u2014 blocked by AWS shield"
+          },
+          {
+            name: "shield:aws:review-iam-changes",
+            tool: "*",
+            conditions: [
+              {
+                field: "command",
+                op: "matches",
+                value: "aws\\s+iam\\s+(create|delete|attach|detach|put|remove)",
+                flags: "i"
+              }
+            ],
+            verdict: "review",
+            reason: "IAM changes require human approval (AWS shield)"
+          },
+          {
+            name: "shield:aws:block-ec2-terminate",
+            tool: "*",
+            conditions: [
+              {
+                field: "command",
+                op: "matches",
+                value: "aws\\s+ec2\\s+terminate-instances",
+                flags: "i"
+              }
+            ],
+            verdict: "block",
+            reason: "EC2 instance termination is irreversible \u2014 blocked by AWS shield"
+          },
+          {
+            name: "shield:aws:review-rds-delete",
+            tool: "*",
+            conditions: [
+              { field: "command", op: "matches", value: "aws\\s+rds\\s+delete-", flags: "i" }
+            ],
+            verdict: "review",
+            reason: "RDS deletion requires human approval (AWS shield)"
+          }
+        ],
+        dangerousWords: []
+      },
+      filesystem: {
+        name: "filesystem",
+        description: "Protects the local filesystem from dangerous AI operations",
+        aliases: ["fs"],
+        smartRules: [
+          {
+            name: "shield:filesystem:review-chmod-777",
+            tool: "bash",
+            conditions: [
+              { field: "command", op: "matches", value: "chmod\\s+(777|a\\+rwx)", flags: "i" }
+            ],
+            verdict: "review",
+            reason: "chmod 777 requires human approval (filesystem shield)"
+          },
+          {
+            name: "shield:filesystem:review-write-etc",
+            tool: "bash",
+            conditions: [
+              {
+                field: "command",
+                // Narrow to write-indicative operations to avoid approval fatigue on reads.
+                // Matches: tee /etc/*, cp .../etc/*, mv .../etc/*, > /etc/*, install .../etc/*
+                op: "matches",
+                value: "(tee|\\bcp\\b|\\bmv\\b|install|>+)\\s+.*\\/etc\\/"
+              }
+            ],
+            verdict: "review",
+            reason: "Writing to /etc requires human approval (filesystem shield)"
+          }
+        ],
+        // dd removed: too common as a legitimate tool (disk imaging, file ops).
+        // mkfs removed: already in the built-in DANGEROUS_WORDS baseline.
+        // wipefs retained: rarely legitimate in an agent context and not in built-ins.
+        dangerousWords: ["wipefs"]
+      }
+    };
+    SHIELDS_STATE_FILE = path3.join(os.homedir(), ".node9", "shields.json");
+  }
+});
 
 // src/dlp.ts
-var DLP_PATTERNS = [
-  { name: "AWS Access Key ID", regex: /\bAKIA[0-9A-Z]{16}\b/, severity: "block" },
-  { name: "GitHub Token", regex: /\bgh[pous]_[A-Za-z0-9]{36}\b/, severity: "block" },
-  { name: "Slack Bot Token", regex: /\bxoxb-[0-9A-Za-z-]+\b/, severity: "block" },
-  { name: "OpenAI API Key", regex: /\bsk-[a-zA-Z0-9_-]{20,}\b/, severity: "block" },
-  { name: "Stripe Secret Key", regex: /\bsk_(?:live|test)_[0-9a-zA-Z]{24}\b/, severity: "block" },
-  {
-    name: "Private Key (PEM)",
-    regex: /-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----/,
-    severity: "block"
-  },
-  { name: "Bearer Token", regex: /Bearer\s+[a-zA-Z0-9\-._~+/]+=*/i, severity: "review" }
-];
 function maskSecret(raw, pattern) {
   const match = raw.match(pattern);
   if (!match) return "****";
@@ -671,9 +685,6 @@ function maskSecret(raw, pattern) {
   const stars = "*".repeat(Math.min(secret.length - 8, 12));
   return `${prefix}${stars}${suffix}`;
 }
-var MAX_DEPTH = 5;
-var MAX_STRING_BYTES = 1e5;
-var MAX_JSON_PARSE_BYTES = 1e4;
 function scanArgs(args, depth = 0, fieldPath = "args") {
   if (depth > MAX_DEPTH || args === null || args === void 0) return null;
   if (Array.isArray(args)) {
@@ -716,12 +727,40 @@ function scanArgs(args, depth = 0, fieldPath = "args") {
   }
   return null;
 }
+var DLP_PATTERNS, MAX_DEPTH, MAX_STRING_BYTES, MAX_JSON_PARSE_BYTES;
+var init_dlp = __esm({
+  "src/dlp.ts"() {
+    "use strict";
+    DLP_PATTERNS = [
+      { name: "AWS Access Key ID", regex: /\bAKIA[0-9A-Z]{16}\b/, severity: "block" },
+      { name: "GitHub Token", regex: /\bgh[pous]_[A-Za-z0-9]{36}\b/, severity: "block" },
+      { name: "Slack Bot Token", regex: /\bxoxb-[0-9A-Za-z-]+\b/, severity: "block" },
+      { name: "OpenAI API Key", regex: /\bsk-[a-zA-Z0-9_-]{20,}\b/, severity: "block" },
+      { name: "Stripe Secret Key", regex: /\bsk_(?:live|test)_[0-9a-zA-Z]{24}\b/, severity: "block" },
+      {
+        name: "Private Key (PEM)",
+        regex: /-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----/,
+        severity: "block"
+      },
+      { name: "Bearer Token", regex: /Bearer\s+[a-zA-Z0-9\-._~+/]+=*/i, severity: "review" }
+    ];
+    MAX_DEPTH = 5;
+    MAX_STRING_BYTES = 1e5;
+    MAX_JSON_PARSE_BYTES = 1e4;
+  }
+});
 
 // src/core.ts
-var PAUSED_FILE = path4.join(os2.homedir(), ".node9", "PAUSED");
-var TRUST_FILE = path4.join(os2.homedir(), ".node9", "trust.json");
-var LOCAL_AUDIT_LOG = path4.join(os2.homedir(), ".node9", "audit.log");
-var HOOK_DEBUG_LOG = path4.join(os2.homedir(), ".node9", "hook-debug.log");
+import chalk2 from "chalk";
+import { confirm } from "@inquirer/prompts";
+import fs2 from "fs";
+import path4 from "path";
+import os2 from "os";
+import net from "net";
+import { randomUUID } from "crypto";
+import { spawnSync } from "child_process";
+import pm from "picomatch";
+import { parse } from "sh-syntax";
 function checkPause() {
   try {
     if (!fs2.existsSync(PAUSED_FILE)) return { paused: false };
@@ -834,9 +873,9 @@ function matchesPattern(text, patterns) {
   const withoutDotSlash = text.replace(/^\.\//, "");
   return isMatch(withoutDotSlash) || isMatch(`./${withoutDotSlash}`);
 }
-function getNestedValue(obj, path9) {
+function getNestedValue(obj, path10) {
   if (!obj || typeof obj !== "object") return null;
-  return path9.split(".").reduce((prev, curr) => prev?.[curr], obj);
+  return path10.split(".").reduce((prev, curr) => prev?.[curr], obj);
 }
 function shouldSnapshot(toolName, args, config) {
   if (!config.settings.enableUndo) return false;
@@ -884,7 +923,7 @@ function evaluateSmartConditions(args, rule) {
       case "matchesGlob":
         return val !== null && cond.value ? pm.isMatch(val, cond.value) : false;
       case "notMatchesGlob":
-        return val !== null && cond.value ? !pm.isMatch(val, cond.value) : true;
+        return val !== null && cond.value ? !pm.isMatch(val, cond.value) : false;
       default:
         return false;
     }
@@ -906,7 +945,6 @@ function isSqlTool(toolName, toolInspection) {
   const fieldName = toolInspection[matchingPattern];
   return fieldName === "sql" || fieldName === "query";
 }
-var SQL_DML_KEYWORDS = /* @__PURE__ */ new Set(["select", "insert", "update", "delete", "merge", "upsert"]);
 async function analyzeShellCommand(command) {
   const actions = [];
   const paths = [];
@@ -988,229 +1026,27 @@ function redactSecrets(text) {
   );
   return redacted;
 }
-var DANGEROUS_WORDS = [
-  "mkfs",
-  // formats/wipes a filesystem partition
-  "shred"
-  // permanently overwrites file contents (unrecoverable)
-];
-var DEFAULT_CONFIG = {
-  settings: {
-    mode: "standard",
-    autoStartDaemon: true,
-    enableUndo: true,
-    // 🔥 ALWAYS TRUE BY DEFAULT for the safety net
-    enableHookLogDebug: false,
-    approvalTimeoutMs: 0,
-    // 0 = disabled; set e.g. 30000 for 30-second auto-deny
-    approvers: { native: true, browser: true, cloud: true, terminal: true }
-  },
-  policy: {
-    sandboxPaths: ["/tmp/**", "**/sandbox/**", "**/test-results/**"],
-    dangerousWords: DANGEROUS_WORDS,
-    ignoredTools: [
-      "list_*",
-      "get_*",
-      "read_*",
-      "describe_*",
-      "read",
-      "glob",
-      "grep",
-      "ls",
-      "notebookread",
-      "notebookedit",
-      "webfetch",
-      "websearch",
-      "exitplanmode",
-      "askuserquestion",
-      "agent",
-      "task*",
-      "toolsearch",
-      "mcp__ide__*",
-      "getDiagnostics"
-    ],
-    toolInspection: {
-      bash: "command",
-      shell: "command",
-      run_shell_command: "command",
-      "terminal.execute": "command",
-      "postgres:query": "sql"
-    },
-    snapshot: {
-      tools: [
-        "str_replace_based_edit_tool",
-        "write_file",
-        "edit_file",
-        "create_file",
-        "edit",
-        "replace"
-      ],
-      onlyPaths: [],
-      ignorePaths: ["**/node_modules/**", "dist/**", "build/**", ".next/**", "**/*.log"]
-    },
-    smartRules: [
-      // ── rm safety (critical — always evaluated first) ──────────────────────
-      {
-        name: "block-rm-rf-home",
-        tool: "bash",
-        conditionMode: "all",
-        conditions: [
-          {
-            field: "command",
-            op: "matches",
-            value: "rm\\b.*(-[rRfF]*[rR][rRfF]*|--recursive)"
-          },
-          {
-            field: "command",
-            op: "matches",
-            value: "(~|\\/root(\\/|$)|\\$HOME|\\/home\\/)"
-          }
-        ],
-        verdict: "block",
-        reason: "Recursive delete of home directory is irreversible"
-      },
-      // ── SQL safety ────────────────────────────────────────────────────────
-      {
-        name: "no-delete-without-where",
-        tool: "*",
-        conditions: [
-          { field: "sql", op: "matches", value: "^(DELETE|UPDATE)\\s", flags: "i" },
-          { field: "sql", op: "notMatches", value: "\\bWHERE\\b", flags: "i" }
-        ],
-        conditionMode: "all",
-        verdict: "review",
-        reason: "DELETE/UPDATE without WHERE clause \u2014 would affect every row in the table"
-      },
-      {
-        name: "review-drop-truncate-shell",
-        tool: "bash",
-        conditions: [
-          {
-            field: "command",
-            op: "matches",
-            value: "\\b(DROP|TRUNCATE)\\s+(TABLE|DATABASE|SCHEMA|INDEX)",
-            flags: "i"
-          }
-        ],
-        conditionMode: "all",
-        verdict: "review",
-        reason: "SQL DDL destructive statement inside a shell command"
-      },
-      // ── Git safety ────────────────────────────────────────────────────────
-      {
-        name: "block-force-push",
-        tool: "bash",
-        conditions: [
-          {
-            field: "command",
-            op: "matches",
-            value: "git push.*(--force|--force-with-lease|-f\\b)",
-            flags: "i"
-          }
-        ],
-        conditionMode: "all",
-        verdict: "block",
-        reason: "Force push overwrites remote history and cannot be undone"
-      },
-      {
-        name: "review-git-push",
-        tool: "bash",
-        conditions: [{ field: "command", op: "matches", value: "^\\s*git\\s+push\\b", flags: "i" }],
-        conditionMode: "all",
-        verdict: "review",
-        reason: "git push sends changes to a shared remote"
-      },
-      {
-        name: "review-git-destructive",
-        tool: "bash",
-        conditions: [
-          {
-            field: "command",
-            op: "matches",
-            value: "git\\s+(reset\\s+--hard|clean\\s+-[fdxX]|rebase|tag\\s+-d|branch\\s+-[dD])",
-            flags: "i"
-          }
-        ],
-        conditionMode: "all",
-        verdict: "review",
-        reason: "Destructive git operation \u2014 discards history or working-tree changes"
-      },
-      // ── Shell safety ──────────────────────────────────────────────────────
-      {
-        name: "review-sudo",
-        tool: "bash",
-        conditions: [{ field: "command", op: "matches", value: "^\\s*sudo\\s", flags: "i" }],
-        conditionMode: "all",
-        verdict: "review",
-        reason: "Command requires elevated privileges"
-      },
-      {
-        name: "review-curl-pipe-shell",
-        tool: "bash",
-        conditions: [
-          {
-            field: "command",
-            op: "matches",
-            value: "(curl|wget)[^|]*\\|\\s*(ba|z|da|fi|c|k)?sh",
-            flags: "i"
-          }
-        ],
-        conditionMode: "all",
-        verdict: "block",
-        reason: "Piping remote script into a shell is a supply-chain attack vector"
-      }
-    ],
-    dlp: { enabled: true, scanIgnoredTools: true }
-  },
-  environments: {}
-};
-var ADVISORY_SMART_RULES = [
-  {
-    name: "allow-rm-safe-paths",
-    tool: "*",
-    conditionMode: "all",
-    conditions: [
-      { field: "command", op: "matches", value: "(^|&&|\\|\\||;)\\s*rm\\b" },
-      {
-        field: "command",
-        op: "matches",
-        // Matches known-safe build artifact paths in the command.
-        value: "(node_modules|\\bdist\\b|\\.next|\\bcoverage\\b|\\.cache|\\btmp\\b|\\btemp\\b|\\.DS_Store)(\\/|\\s|$)"
-      }
-    ],
-    verdict: "allow",
-    reason: "Deleting a known-safe build artifact path"
-  },
-  {
-    name: "review-rm",
-    tool: "*",
-    conditions: [{ field: "command", op: "matches", value: "(^|&&|\\|\\||;)\\s*rm\\b" }],
-    verdict: "review",
-    reason: "rm can permanently delete files \u2014 confirm the target path"
-  }
-];
-var cachedConfig = null;
-function _resetConfigCache() {
-  cachedConfig = null;
-}
-function getGlobalSettings() {
-  try {
-    const globalConfigPath = path4.join(os2.homedir(), ".node9", "config.json");
-    if (fs2.existsSync(globalConfigPath)) {
-      const parsed = JSON.parse(fs2.readFileSync(globalConfigPath, "utf-8"));
-      const settings = parsed.settings || {};
-      return {
-        mode: settings.mode || "standard",
-        autoStartDaemon: settings.autoStartDaemon !== false,
-        slackEnabled: settings.slackEnabled !== false,
-        enableTrustSessions: settings.enableTrustSessions === true,
-        allowGlobalPause: settings.allowGlobalPause !== false
-      };
-    }
-  } catch {
-  }
-  return {
-    mode: "standard",
+function _resetConfigCache() {
+  cachedConfig = null;
+}
+function getGlobalSettings() {
+  try {
+    const globalConfigPath = path4.join(os2.homedir(), ".node9", "config.json");
+    if (fs2.existsSync(globalConfigPath)) {
+      const parsed = JSON.parse(fs2.readFileSync(globalConfigPath, "utf-8"));
+      const settings = parsed.settings || {};
+      return {
+        mode: settings.mode || "audit",
+        autoStartDaemon: settings.autoStartDaemon !== false,
+        slackEnabled: settings.slackEnabled !== false,
+        enableTrustSessions: settings.enableTrustSessions === true,
+        allowGlobalPause: settings.allowGlobalPause !== false
+      };
+    }
+  } catch {
+  }
+  return {
+    mode: "audit",
     autoStartDaemon: true,
     slackEnabled: true,
     enableTrustSessions: false,
@@ -1596,16 +1432,24 @@ function isIgnoredTool(toolName) {
   const config = getConfig();
   return matchesPattern(toolName, config.policy.ignoredTools);
 }
-var DAEMON_PORT = 7391;
-var DAEMON_HOST = "127.0.0.1";
 function isDaemonRunning() {
+  const pidFile = path4.join(os2.homedir(), ".node9", "daemon.pid");
+  if (fs2.existsSync(pidFile)) {
+    try {
+      const { pid, port } = JSON.parse(fs2.readFileSync(pidFile, "utf-8"));
+      if (port !== DAEMON_PORT) return false;
+      process.kill(pid, 0);
+      return true;
+    } catch {
+      return false;
+    }
+  }
   try {
-    const pidFile = path4.join(os2.homedir(), ".node9", "daemon.pid");
-    if (!fs2.existsSync(pidFile)) return false;
-    const { pid, port } = JSON.parse(fs2.readFileSync(pidFile, "utf-8"));
-    if (port !== DAEMON_PORT) return false;
-    process.kill(pid, 0);
-    return true;
+    const r = spawnSync("ss", ["-Htnp", `sport = :${DAEMON_PORT}`], {
+      encoding: "utf8",
+      timeout: 500
+    });
+    return r.status === 0 && (r.stdout ?? "").includes(`:${DAEMON_PORT}`);
   } catch {
     return false;
   }
@@ -1621,7 +1465,7 @@ function getPersistentDecision(toolName) {
   }
   return null;
 }
-async function askDaemon(toolName, args, meta, signal, riskMetadata) {
+async function askDaemon(toolName, args, meta, signal, riskMetadata, activityId) {
   const base = `http://${DAEMON_HOST}:${DAEMON_PORT}`;
   const checkCtrl = new AbortController();
   const checkTimer = setTimeout(() => checkCtrl.abort(), 5e3);
@@ -1636,6 +1480,12 @@ async function askDaemon(toolName, args, meta, signal, riskMetadata) {
         args,
         agent: meta?.agent,
         mcpServer: meta?.mcpServer,
+        fromCLI: true,
+        // Pass the flight-recorder ID so the daemon uses the same UUID for
+        // activity-result as the CLI used for the pending activity event.
+        // Without this, the two UUIDs never match and tail.ts never resolves
+        // the pending item.
+        activityId,
         ...riskMetadata && { riskMetadata }
       }),
       signal: checkCtrl.signal
@@ -1690,7 +1540,44 @@ async function resolveViaDaemon(id, decision, internalToken) {
     signal: AbortSignal.timeout(3e3)
   });
 }
+function notifyActivity(data) {
+  return new Promise((resolve) => {
+    try {
+      const payload = JSON.stringify(data);
+      const sock = net.createConnection(ACTIVITY_SOCKET_PATH);
+      sock.on("connect", () => {
+        sock.on("close", resolve);
+        sock.end(payload);
+      });
+      sock.on("error", resolve);
+    } catch {
+      resolve();
+    }
+  });
+}
 async function authorizeHeadless(toolName, args, allowTerminalFallback = false, meta, options) {
+  if (!options?.calledFromDaemon) {
+    const actId = randomUUID();
+    const actTs = Date.now();
+    await notifyActivity({ id: actId, ts: actTs, tool: toolName, args, status: "pending" });
+    const result = await _authorizeHeadlessCore(toolName, args, allowTerminalFallback, meta, {
+      ...options,
+      activityId: actId
+    });
+    if (!result.noApprovalMechanism) {
+      await notifyActivity({
+        id: actId,
+        tool: toolName,
+        ts: actTs,
+        status: result.approved ? "allow" : result.blockedByLabel?.includes("DLP") ? "dlp" : "block",
+        label: result.blockedByLabel
+      });
+    }
+    return result;
+  }
+  return _authorizeHeadlessCore(toolName, args, allowTerminalFallback, meta, options);
+}
+async function _authorizeHeadlessCore(toolName, args, allowTerminalFallback = false, meta, options) {
   if (process.env.NODE9_PAUSED === "1") return { approved: true, checkedBy: "paused" };
   const pauseState = checkPause();
   if (pauseState.paused) return { approved: true, checkedBy: "paused" };
@@ -1726,6 +1613,7 @@ async function authorizeHeadless(toolName, args, allowTerminalFallback = false,
           blockedByLabel: "\u{1F6A8} Node9 DLP (Secret Detected)"
         };
       }
+      if (!isManual) appendLocalAudit(toolName, args, "allow", "dlp-review-flagged", meta);
       explainableLabel = "\u{1F6A8} Node9 DLP (Credential Review)";
     }
   }
@@ -1948,7 +1836,14 @@ async function authorizeHeadless(toolName, args, allowTerminalFallback = false,
             console.error(chalk2.cyan(`   URL \u2192 http://${DAEMON_HOST}:${DAEMON_PORT}/
 `));
           }
-          const daemonDecision = await askDaemon(toolName, args, meta, signal, riskMetadata);
+          const daemonDecision = await askDaemon(
+            toolName,
+            args,
+            meta,
+            signal,
+            riskMetadata,
+            options?.activityId
+          );
           if (daemonDecision === "abandoned") throw new Error("Abandoned");
           const isApproved = daemonDecision === "allow";
           return {
@@ -2152,7 +2047,10 @@ function getConfig() {
     for (const rule of shield.smartRules) {
       if (!existingRuleNames.has(rule.name)) mergedPolicy.smartRules.push(rule);
     }
-    for (const word of shield.dangerousWords) mergedPolicy.dangerousWords.push(word);
+    const existingWords = new Set(mergedPolicy.dangerousWords);
+    for (const word of shield.dangerousWords) {
+      if (!existingWords.has(word)) mergedPolicy.dangerousWords.push(word);
+    }
   }
   const existingAdvisoryNames = new Set(mergedPolicy.smartRules.map((r) => r.name));
   for (const rule of ADVISORY_SMART_RULES) {
@@ -2353,255 +2251,235 @@ async function resolveNode9SaaS(requestId, creds, approved) {
   } catch {
   }
 }
-
-// src/setup.ts
-import fs3 from "fs";
-import path5 from "path";
-import os3 from "os";
-import chalk3 from "chalk";
-import { confirm as confirm2 } from "@inquirer/prompts";
-function printDaemonTip() {
-  console.log(
-    chalk3.cyan("\n   \u{1F4A1} Node9 will protect you automatically using Native OS popups.") + chalk3.white("\n      To view your history or manage persistent rules, run:") + chalk3.green("\n      node9 daemon --openui")
-  );
-}
-function fullPathCommand(subcommand) {
-  if (process.env.NODE9_TESTING === "1") return `node9 ${subcommand}`;
-  const nodeExec = process.execPath;
-  const cliScript = process.argv[1];
-  return `${nodeExec} ${cliScript} ${subcommand}`;
-}
-function readJson(filePath) {
-  try {
-    if (fs3.existsSync(filePath)) {
-      return JSON.parse(fs3.readFileSync(filePath, "utf-8"));
-    }
-  } catch {
-  }
-  return null;
-}
-function writeJson(filePath, data) {
-  const dir = path5.dirname(filePath);
-  if (!fs3.existsSync(dir)) fs3.mkdirSync(dir, { recursive: true });
-  fs3.writeFileSync(filePath, JSON.stringify(data, null, 2) + "\n");
-}
-async function setupClaude() {
-  const homeDir2 = os3.homedir();
-  const mcpPath = path5.join(homeDir2, ".claude.json");
-  const hooksPath = path5.join(homeDir2, ".claude", "settings.json");
-  const claudeConfig = readJson(mcpPath) ?? {};
-  const settings = readJson(hooksPath) ?? {};
-  const servers = claudeConfig.mcpServers ?? {};
-  let anythingChanged = false;
-  if (!settings.hooks) settings.hooks = {};
-  const hasPreHook = settings.hooks.PreToolUse?.some(
-    (m) => m.hooks.some((h) => h.command?.includes("node9 check") || h.command?.includes("cli.js check"))
-  );
-  if (!hasPreHook) {
-    if (!settings.hooks.PreToolUse) settings.hooks.PreToolUse = [];
-    settings.hooks.PreToolUse.push({
-      matcher: ".*",
-      hooks: [{ type: "command", command: fullPathCommand("check"), timeout: 60 }]
-    });
-    console.log(chalk3.green("  \u2705 PreToolUse hook added  \u2192 node9 check"));
-    anythingChanged = true;
-  }
-  const hasPostHook = settings.hooks.PostToolUse?.some(
-    (m) => m.hooks.some((h) => h.command?.includes("node9 log") || h.command?.includes("cli.js log"))
-  );
-  if (!hasPostHook) {
-    if (!settings.hooks.PostToolUse) settings.hooks.PostToolUse = [];
-    settings.hooks.PostToolUse.push({
-      matcher: ".*",
-      hooks: [{ type: "command", command: fullPathCommand("log"), timeout: 600 }]
-    });
-    console.log(chalk3.green("  \u2705 PostToolUse hook added \u2192 node9 log"));
-    anythingChanged = true;
-  }
-  if (anythingChanged) {
-    writeJson(hooksPath, settings);
-    console.log("");
-  }
-  const serversToWrap = [];
-  for (const [name, server] of Object.entries(servers)) {
-    if (!server.command || server.command === "node9") continue;
-    const parts = [server.command, ...server.args ?? []];
-    serversToWrap.push({ name, originalCmd: parts.join(" "), parts });
-  }
-  if (serversToWrap.length > 0) {
-    console.log(chalk3.bold("The following existing entries will be modified:\n"));
-    console.log(chalk3.white(`  ${mcpPath}`));
-    for (const { name, originalCmd } of serversToWrap) {
-      console.log(chalk3.gray(`    \u2022 ${name}: "${originalCmd}" \u2192 node9 ${originalCmd}`));
-    }
-    console.log("");
-    const proceed = await confirm2({ message: "Wrap these MCP servers?", default: true });
-    if (proceed) {
-      for (const { name, parts } of serversToWrap) {
-        servers[name] = { ...servers[name], command: "node9", args: parts };
+var PAUSED_FILE, TRUST_FILE, LOCAL_AUDIT_LOG, HOOK_DEBUG_LOG, SQL_DML_KEYWORDS, DANGEROUS_WORDS, DEFAULT_CONFIG, ADVISORY_SMART_RULES, cachedConfig, DAEMON_PORT, DAEMON_HOST, ACTIVITY_SOCKET_PATH;
+var init_core = __esm({
+  "src/core.ts"() {
+    "use strict";
+    init_native();
+    init_context_sniper();
+    init_config_schema();
+    init_shields();
+    init_dlp();
+    PAUSED_FILE = path4.join(os2.homedir(), ".node9", "PAUSED");
+    TRUST_FILE = path4.join(os2.homedir(), ".node9", "trust.json");
+    LOCAL_AUDIT_LOG = path4.join(os2.homedir(), ".node9", "audit.log");
+    HOOK_DEBUG_LOG = path4.join(os2.homedir(), ".node9", "hook-debug.log");
+    SQL_DML_KEYWORDS = /* @__PURE__ */ new Set(["select", "insert", "update", "delete", "merge", "upsert"]);
+    DANGEROUS_WORDS = [
+      "mkfs",
+      // formats/wipes a filesystem partition
+      "shred"
+      // permanently overwrites file contents (unrecoverable)
+    ];
+    DEFAULT_CONFIG = {
+      version: "1.0",
+      settings: {
+        mode: "audit",
+        autoStartDaemon: true,
+        enableUndo: true,
+        // 🔥 ALWAYS TRUE BY DEFAULT for the safety net
+        enableHookLogDebug: true,
+        approvalTimeoutMs: 3e4,
+        // 30-second auto-deny timeout
+        flightRecorder: true,
+        approvers: { native: true, browser: true, cloud: false, terminal: true }
+      },
+      policy: {
+        sandboxPaths: ["/tmp/**", "**/sandbox/**", "**/test-results/**"],
+        dangerousWords: DANGEROUS_WORDS,
+        ignoredTools: [
+          "list_*",
+          "get_*",
+          "read_*",
+          "describe_*",
+          "read",
+          "glob",
+          "grep",
+          "ls",
+          "notebookread",
+          "notebookedit",
+          "webfetch",
+          "websearch",
+          "exitplanmode",
+          "askuserquestion",
+          "agent",
+          "task*",
+          "toolsearch",
+          "mcp__ide__*",
+          "getDiagnostics"
+        ],
+        toolInspection: {
+          bash: "command",
+          shell: "command",
+          run_shell_command: "command",
+          "terminal.execute": "command",
+          "postgres:query": "sql"
+        },
+        snapshot: {
+          tools: [
+            "str_replace_based_edit_tool",
+            "write_file",
+            "edit_file",
+            "create_file",
+            "edit",
+            "replace"
+          ],
+          onlyPaths: [],
+          ignorePaths: ["**/node_modules/**", "dist/**", "build/**", ".next/**", "**/*.log"]
+        },
+        smartRules: [
+          // ── rm safety (critical — always evaluated first) ──────────────────────
+          {
+            name: "block-rm-rf-home",
+            tool: "bash",
+            conditionMode: "all",
+            conditions: [
+              {
+                field: "command",
+                op: "matches",
+                value: "rm\\b.*(-[rRfF]*[rR][rRfF]*|--recursive)"
+              },
+              {
+                field: "command",
+                op: "matches",
+                value: "(~|\\/root(\\/|$)|\\$HOME|\\/home\\/)"
+              }
+            ],
+            verdict: "block",
+            reason: "Recursive delete of home directory is irreversible"
+          },
+          // ── SQL safety ────────────────────────────────────────────────────────
+          {
+            name: "no-delete-without-where",
+            tool: "*",
+            conditions: [
+              { field: "sql", op: "matches", value: "^(DELETE|UPDATE)\\s", flags: "i" },
+              { field: "sql", op: "notMatches", value: "\\bWHERE\\b", flags: "i" }
+            ],
+            conditionMode: "all",
+            verdict: "review",
+            reason: "DELETE/UPDATE without WHERE clause \u2014 would affect every row in the table"
+          },
+          {
+            name: "review-drop-truncate-shell",
+            tool: "bash",
+            conditions: [
+              {
+                field: "command",
+                op: "matches",
+                value: "\\b(DROP|TRUNCATE)\\s+(TABLE|DATABASE|SCHEMA|INDEX)",
+                flags: "i"
+              }
+            ],
+            conditionMode: "all",
+            verdict: "review",
+            reason: "SQL DDL destructive statement inside a shell command"
+          },
+          // ── Git safety ────────────────────────────────────────────────────────
+          {
+            name: "block-force-push",
+            tool: "bash",
+            conditions: [
+              {
+                field: "command",
+                op: "matches",
+                value: "git push.*(--force|--force-with-lease|-f\\b)",
+                flags: "i"
+              }
+            ],
+            conditionMode: "all",
+            verdict: "block",
+            reason: "Force push overwrites remote history and cannot be undone"
+          },
+          {
+            name: "review-git-push",
+            tool: "bash",
+            conditions: [{ field: "command", op: "matches", value: "^\\s*git\\s+push\\b", flags: "i" }],
+            conditionMode: "all",
+            verdict: "review",
+            reason: "git push sends changes to a shared remote"
+          },
+          {
+            name: "review-git-destructive",
+            tool: "bash",
+            conditions: [
+              {
+                field: "command",
+                op: "matches",
+                value: "git\\s+(reset\\s+--hard|clean\\s+-[fdxX]|rebase|tag\\s+-d|branch\\s+-[dD])",
+                flags: "i"
+              }
+            ],
+            conditionMode: "all",
+            verdict: "review",
+            reason: "Destructive git operation \u2014 discards history or working-tree changes"
+          },
+          // ── Shell safety ──────────────────────────────────────────────────────
+          {
+            name: "review-sudo",
+            tool: "bash",
+            conditions: [{ field: "command", op: "matches", value: "^\\s*sudo\\s", flags: "i" }],
+            conditionMode: "all",
+            verdict: "review",
+            reason: "Command requires elevated privileges"
+          },
+          {
+            name: "review-curl-pipe-shell",
+            tool: "bash",
+            conditions: [
+              {
+                field: "command",
+                op: "matches",
+                value: "(curl|wget)[^|]*\\|\\s*(ba|z|da|fi|c|k)?sh",
+                flags: "i"
+              }
+            ],
+            conditionMode: "all",
+            verdict: "block",
+            reason: "Piping remote script into a shell is a supply-chain attack vector"
+          }
+        ],
+        dlp: { enabled: true, scanIgnoredTools: true }
+      },
+      environments: {}
+    };
+    ADVISORY_SMART_RULES = [
+      {
+        name: "allow-rm-safe-paths",
+        tool: "*",
+        conditionMode: "all",
+        conditions: [
+          { field: "command", op: "matches", value: "(^|&&|\\|\\||;)\\s*rm\\b" },
+          {
+            field: "command",
+            op: "matches",
+            // Matches known-safe build artifact paths in the command.
+            value: "(node_modules|\\bdist\\b|\\.next|\\bcoverage\\b|\\.cache|\\btmp\\b|\\btemp\\b|\\.DS_Store)(\\/|\\s|$)"
+          }
+        ],
+        verdict: "allow",
+        reason: "Deleting a known-safe build artifact path"
+      },
+      {
+        name: "review-rm",
+        tool: "*",
+        conditions: [{ field: "command", op: "matches", value: "(^|&&|\\|\\||;)\\s*rm\\b" }],
+        verdict: "review",
+        reason: "rm can permanently delete files \u2014 confirm the target path"
       }
-      claudeConfig.mcpServers = servers;
-      writeJson(mcpPath, claudeConfig);
-      console.log(chalk3.green(`
-  \u2705 ${serversToWrap.length} MCP server(s) wrapped`));
-      anythingChanged = true;
-    } else {
-      console.log(chalk3.yellow("  Skipped MCP server wrapping."));
-    }
-    console.log("");
-  }
-  if (!anythingChanged && serversToWrap.length === 0) {
-    console.log(chalk3.blue("\u2139\uFE0F  Node9 is already fully configured for Claude Code."));
-    printDaemonTip();
-    return;
-  }
-  if (anythingChanged) {
-    console.log(chalk3.green.bold("\u{1F6E1}\uFE0F  Node9 is now protecting Claude Code!"));
-    console.log(chalk3.gray("    Restart Claude Code for changes to take effect."));
-    printDaemonTip();
-  }
-}
-async function setupGemini() {
-  const homeDir2 = os3.homedir();
-  const settingsPath = path5.join(homeDir2, ".gemini", "settings.json");
-  const settings = readJson(settingsPath) ?? {};
-  const servers = settings.mcpServers ?? {};
-  let anythingChanged = false;
-  if (!settings.hooks) settings.hooks = {};
-  const hasBeforeHook = Array.isArray(settings.hooks.BeforeTool) && settings.hooks.BeforeTool.some(
-    (m) => m.hooks.some((h) => h.command?.includes("node9 check") || h.command?.includes("cli.js check"))
-  );
-  if (!hasBeforeHook) {
-    if (!settings.hooks.BeforeTool) settings.hooks.BeforeTool = [];
-    if (!Array.isArray(settings.hooks.BeforeTool)) settings.hooks.BeforeTool = [];
-    settings.hooks.BeforeTool.push({
-      matcher: ".*",
-      hooks: [
-        {
-          name: "node9-check",
-          type: "command",
-          command: fullPathCommand("check"),
-          timeout: 6e5
-        }
-      ]
-    });
-    console.log(chalk3.green("  \u2705 BeforeTool hook added \u2192 node9 check"));
-    anythingChanged = true;
+    ];
+    cachedConfig = null;
+    DAEMON_PORT = 7391;
+    DAEMON_HOST = "127.0.0.1";
+    ACTIVITY_SOCKET_PATH = process.platform === "win32" ? "\\\\.\\pipe\\node9-activity" : path4.join(os2.tmpdir(), "node9-activity.sock");
   }
-  const hasAfterHook = Array.isArray(settings.hooks.AfterTool) && settings.hooks.AfterTool.some(
-    (m) => m.hooks.some((h) => h.command?.includes("node9 log") || h.command?.includes("cli.js log"))
-  );
-  if (!hasAfterHook) {
-    if (!settings.hooks.AfterTool) settings.hooks.AfterTool = [];
-    if (!Array.isArray(settings.hooks.AfterTool)) settings.hooks.AfterTool = [];
-    settings.hooks.AfterTool.push({
-      matcher: ".*",
-      hooks: [{ name: "node9-log", type: "command", command: fullPathCommand("log") }]
-    });
-    console.log(chalk3.green("  \u2705 AfterTool hook added  \u2192 node9 log"));
-    anythingChanged = true;
-  }
-  if (anythingChanged) {
-    writeJson(settingsPath, settings);
-    console.log("");
-  }
-  const serversToWrap = [];
-  for (const [name, server] of Object.entries(servers)) {
-    if (!server.command || server.command === "node9") continue;
-    const parts = [server.command, ...server.args ?? []];
-    serversToWrap.push({ name, originalCmd: parts.join(" "), parts });
-  }
-  if (serversToWrap.length > 0) {
-    console.log(chalk3.bold("The following existing entries will be modified:\n"));
-    console.log(chalk3.white(`  ${settingsPath}  (mcpServers)`));
-    for (const { name, originalCmd } of serversToWrap) {
-      console.log(chalk3.gray(`    \u2022 ${name}: "${originalCmd}" \u2192 node9 ${originalCmd}`));
-    }
-    console.log("");
-    const proceed = await confirm2({ message: "Wrap these MCP servers?", default: true });
-    if (proceed) {
-      for (const { name, parts } of serversToWrap) {
-        servers[name] = { ...servers[name], command: "node9", args: parts };
-      }
-      settings.mcpServers = servers;
-      writeJson(settingsPath, settings);
-      console.log(chalk3.green(`
-  \u2705 ${serversToWrap.length} MCP server(s) wrapped`));
-      anythingChanged = true;
-    } else {
-      console.log(chalk3.yellow("  Skipped MCP server wrapping."));
-    }
-    console.log("");
-  }
-  if (!anythingChanged && serversToWrap.length === 0) {
-    console.log(chalk3.blue("\u2139\uFE0F  Node9 is already fully configured for Gemini CLI."));
-    printDaemonTip();
-    return;
-  }
-  if (anythingChanged) {
-    console.log(chalk3.green.bold("\u{1F6E1}\uFE0F  Node9 is now protecting Gemini CLI!"));
-    console.log(chalk3.gray("    Restart Gemini CLI for changes to take effect."));
-    printDaemonTip();
-  }
-}
-async function setupCursor() {
-  const homeDir2 = os3.homedir();
-  const mcpPath = path5.join(homeDir2, ".cursor", "mcp.json");
-  const mcpConfig = readJson(mcpPath) ?? {};
-  const servers = mcpConfig.mcpServers ?? {};
-  let anythingChanged = false;
-  const serversToWrap = [];
-  for (const [name, server] of Object.entries(servers)) {
-    if (!server.command || server.command === "node9") continue;
-    const parts = [server.command, ...server.args ?? []];
-    serversToWrap.push({ name, originalCmd: parts.join(" "), parts });
-  }
-  if (serversToWrap.length > 0) {
-    console.log(chalk3.bold("The following existing entries will be modified:\n"));
-    console.log(chalk3.white(`  ${mcpPath}`));
-    for (const { name, originalCmd } of serversToWrap) {
-      console.log(chalk3.gray(`    \u2022 ${name}: "${originalCmd}" \u2192 node9 ${originalCmd}`));
-    }
-    console.log("");
-    const proceed = await confirm2({ message: "Wrap these MCP servers?", default: true });
-    if (proceed) {
-      for (const { name, parts } of serversToWrap) {
-        servers[name] = { ...servers[name], command: "node9", args: parts };
-      }
-      mcpConfig.mcpServers = servers;
-      writeJson(mcpPath, mcpConfig);
-      console.log(chalk3.green(`
-  \u2705 ${serversToWrap.length} MCP server(s) wrapped`));
-      anythingChanged = true;
-    } else {
-      console.log(chalk3.yellow("  Skipped MCP server wrapping."));
-    }
-    console.log("");
-  }
-  console.log(
-    chalk3.yellow(
-      "  \u26A0\uFE0F  Note: Cursor does not yet support native pre-execution hooks.\n     MCP proxy wrapping is the only supported protection mode for Cursor."
-    )
-  );
-  console.log("");
-  if (!anythingChanged && serversToWrap.length === 0) {
-    console.log(
-      chalk3.blue(
-        "\u2139\uFE0F  No MCP servers found to wrap. Add MCP servers to ~/.cursor/mcp.json and re-run."
-      )
-    );
-    printDaemonTip();
-    return;
-  }
-  if (anythingChanged) {
-    console.log(chalk3.green.bold("\u{1F6E1}\uFE0F  Node9 is now protecting Cursor via MCP proxy!"));
-    console.log(chalk3.gray("    Restart Cursor for changes to take effect."));
-    printDaemonTip();
-  }
-}
+});
 
 // src/daemon/ui.html
-var ui_default = `<!doctype html>
+var ui_default;
+var init_ui = __esm({
+  "src/daemon/ui.html"() {
+    ui_default = `<!doctype html>
 <html lang="en">
   <head>
     <meta charset="UTF-8" />
@@ -2627,6 +2505,11 @@ var ui_default = `<!doctype html>
         margin: 0;
         padding: 0;
       }
+      html,
+      body {
+        height: 100%;
+        overflow: hidden;
+      }
       body {
         background: var(--bg);
         color: var(--text);
@@ -2634,16 +2517,17 @@ var ui_default = `<!doctype html>
           'Inter',
           -apple-system,
           sans-serif;
-        min-height: 100vh;
       }
 
       .shell {
-        max-width: 1000px;
+        max-width: 1440px;
+        height: 100vh;
         margin: 0 auto;
-        padding: 32px 24px 48px;
+        padding: 16px 20px 16px;
         display: grid;
         grid-template-rows: auto 1fr;
-        gap: 24px;
+        gap: 16px;
+        overflow: hidden;
       }
       header {
         display: flex;
@@ -2680,9 +2564,10 @@ var ui_default = `<!doctype html>
 
       .body {
         display: grid;
-        grid-template-columns: 1fr 272px;
-        gap: 20px;
-        align-items: start;
+        grid-template-columns: 360px 1fr 270px;
+        gap: 16px;
+        min-height: 0;
+        overflow: hidden;
       }
 
       .warning-banner {
@@ -2702,6 +2587,10 @@ var ui_default = `<!doctype html>
 
       .main {
         min-width: 0;
+        min-height: 0;
+        overflow-y: auto;
+        scrollbar-width: thin;
+        scrollbar-color: var(--border) transparent;
       }
       .section-title {
         font-size: 11px;
@@ -2732,14 +2621,64 @@ var ui_default = `<!doctype html>
         background: var(--card);
         border: 1px solid var(--border);
         border-radius: 14px;
-        padding: 24px;
-        margin-bottom: 16px;
+        padding: 20px;
+        margin-bottom: 14px;
         box-shadow: 0 8px 24px rgba(0, 0, 0, 0.3);
         animation: pop 0.35s cubic-bezier(0.175, 0.885, 0.32, 1.275);
       }
       .card.slack-viewer {
         border-color: rgba(83, 155, 245, 0.3);
       }
+      .card-header {
+        display: flex;
+        align-items: center;
+        gap: 8px;
+        margin-bottom: 12px;
+        padding-bottom: 12px;
+        border-bottom: 1px solid var(--border);
+      }
+      .card-header-icon {
+        font-size: 16px;
+      }
+      .card-header-title {
+        font-size: 12px;
+        font-weight: 700;
+        color: var(--text-bright);
+        text-transform: uppercase;
+        letter-spacing: 0.5px;
+      }
+      .card-timer {
+        margin-left: auto;
+        font-size: 11px;
+        font-family: 'Fira Code', monospace;
+        color: var(--muted);
+        background: rgba(48, 54, 61, 0.6);
+        padding: 2px 8px;
+        border-radius: 5px;
+      }
+      .card-timer.urgent {
+        color: var(--danger);
+        background: rgba(201, 60, 55, 0.1);
+      }
+      .btn-allow {
+        background: var(--success);
+        color: #fff;
+        grid-column: span 2;
+        font-size: 14px;
+        padding: 13px 14px;
+      }
+      .btn-deny {
+        background: rgba(201, 60, 55, 0.15);
+        color: #e5534b;
+        border: 1px solid rgba(201, 60, 55, 0.3);
+        grid-column: span 2;
+      }
+      .btn-deny:hover:not(:disabled) {
+        background: var(--danger);
+        color: #fff;
+        border-color: transparent;
+        filter: none;
+      }
       @keyframes pop {
         from {
           opacity: 0;
@@ -2947,24 +2886,178 @@ var ui_default = `<!doctype html>
         cursor: not-allowed;
       }
 
+      .flight-col {
+        display: flex;
+        flex-direction: column;
+        min-height: 0;
+        overflow: hidden;
+      }
+      .flight-panel {
+        flex: 1;
+        min-height: 0;
+        display: flex;
+        flex-direction: column;
+        overflow: hidden;
+      }
       .sidebar {
         display: flex;
         flex-direction: column;
         gap: 12px;
-        position: sticky;
-        top: 24px;
+        min-height: 0;
+        overflow-y: auto;
+        scrollbar-width: thin;
+        scrollbar-color: var(--border) transparent;
       }
       .panel {
         background: var(--panel);
         border: 1px solid var(--border);
         border-radius: 12px;
-        padding: 16px;
+        padding: 14px;
+      }
+      /* \u2500\u2500 Flight Recorder \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 */
+      #activity-feed {
+        display: flex;
+        flex-direction: column;
+        gap: 4px;
+        margin-top: 4px;
+        flex: 1;
+        min-height: 0;
+        overflow-y: auto;
+        scrollbar-width: thin;
+        scrollbar-color: var(--border) transparent;
+      }
+      .feed-row {
+        display: grid;
+        grid-template-columns: 58px 20px 1fr 48px;
+        align-items: start;
+        gap: 6px;
+        background: rgba(22, 27, 34, 0.6);
+        border: 1px solid var(--border);
+        padding: 7px 10px;
+        border-radius: 7px;
+        font-size: 11px;
+        animation: frSlideIn 0.15s ease-out;
+        transition: background 0.1s;
+        cursor: default;
+      }
+      .feed-row:hover {
+        background: rgba(30, 38, 48, 0.9);
+        border-color: rgba(83, 155, 245, 0.2);
+      }
+      @keyframes frSlideIn {
+        from {
+          opacity: 0;
+          transform: translateX(-4px);
+        }
+        to {
+          opacity: 1;
+          transform: none;
+        }
+      }
+      .feed-ts {
+        color: var(--muted);
+        font-family: monospace;
+        font-size: 9px;
+      }
+      .feed-icon {
+        text-align: center;
+        font-size: 13px;
+      }
+      .feed-content {
+        min-width: 0;
+        color: var(--text-bright);
+        word-break: break-all;
+      }
+      .feed-args {
+        display: block;
+        color: var(--muted);
+        font-family: monospace;
+        margin-top: 2px;
+        font-size: 10px;
+        word-break: break-all;
+      }
+      .feed-badge {
+        text-align: right;
+        font-weight: 700;
+        font-size: 9px;
+        letter-spacing: 0.03em;
+      }
+      .fr-pending {
+        color: var(--muted);
+      }
+      .fr-allow {
+        color: #57ab5a;
+      }
+      .fr-block {
+        color: var(--danger);
+      }
+      .fr-dlp {
+        color: var(--primary);
+        animation: frBlink 1s infinite;
       }
+      @keyframes frBlink {
+        50% {
+          opacity: 0.4;
+        }
+      }
+      .fr-dlp-row {
+        border-color: var(--primary) !important;
+      }
+      .feed-clear-btn {
+        background: transparent;
+        border: none;
+        color: var(--muted);
+        font-size: 10px;
+        padding: 0;
+        cursor: pointer;
+        margin-left: auto;
+        font-family: inherit;
+        font-weight: 500;
+        transition: color 0.15s;
+      }
+      .feed-clear-btn:hover {
+        color: var(--text);
+        filter: none;
+        transform: none;
+      }
+      /* \u2500\u2500 Shields \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 */
+      .shield-row {
+        display: flex;
+        align-items: flex-start;
+        gap: 10px;
+        padding: 8px 0;
+        border-bottom: 1px solid var(--border);
+      }
+      .shield-row:last-child {
+        border-bottom: none;
+        padding-bottom: 0;
+      }
+      .shield-row:first-child {
+        padding-top: 0;
+      }
+      .shield-info {
+        flex: 1;
+        min-width: 0;
+      }
+      .shield-name {
+        font-size: 12px;
+        color: var(--text-bright);
+        font-weight: 600;
+        font-family: 'Fira Code', monospace;
+      }
+      .shield-desc {
+        font-size: 10px;
+        color: var(--muted);
+        margin-top: 2px;
+        line-height: 1.4;
+      }
+
       .panel-title {
         font-size: 12px;
         font-weight: 700;
         color: var(--text-bright);
         margin-bottom: 12px;
+        flex-shrink: 0;
         display: flex;
         align-items: center;
         gap: 6px;
@@ -2972,8 +3065,8 @@ var ui_default = `<!doctype html>
       .setting-row {
         display: flex;
         align-items: flex-start;
-        gap: 12px;
-        margin-bottom: 12px;
+        gap: 10px;
+        margin-bottom: 8px;
       }
       .setting-row:last-child {
         margin-bottom: 0;
@@ -2982,20 +3075,21 @@ var ui_default = `<!doctype html>
         flex: 1;
       }
       .setting-label {
-        font-size: 12px;
+        font-size: 11px;
         color: var(--text-bright);
-        margin-bottom: 3px;
+        margin-bottom: 2px;
+        font-weight: 600;
       }
       .setting-desc {
-        font-size: 11px;
+        font-size: 10px;
         color: var(--muted);
-        line-height: 1.5;
+        line-height: 1.4;
       }
       .toggle {
         position: relative;
         display: inline-block;
-        width: 40px;
-        height: 22px;
+        width: 34px;
+        height: 19px;
         flex-shrink: 0;
         margin-top: 1px;
       }
@@ -3015,8 +3109,8 @@ var ui_default = `<!doctype html>
       .slider:before {
         content: '';
         position: absolute;
-        width: 16px;
-        height: 16px;
+        width: 13px;
+        height: 13px;
         left: 3px;
         bottom: 3px;
         background: #fff;
@@ -3027,7 +3121,7 @@ var ui_default = `<!doctype html>
         background: var(--success);
       }
       input:checked + .slider:before {
-        transform: translateX(18px);
+        transform: translateX(15px);
       }
       input:disabled + .slider {
         opacity: 0.4;
@@ -3186,12 +3280,17 @@ var ui_default = `<!doctype html>
         border: 1px solid var(--border);
       }
 
-      @media (max-width: 680px) {
+      @media (max-width: 960px) {
         .body {
-          grid-template-columns: 1fr;
+          grid-template-columns: 1fr 220px;
+        }
+        .flight-col {
+          display: none;
         }
-        .sidebar {
-          position: static;
+      }
+      @media (max-width: 640px) {
+        .body {
+          grid-template-columns: 1fr;
         }
       }
     </style>
@@ -3205,6 +3304,19 @@ var ui_default = `<!doctype html>
       </header>
 
       <div class="body">
+        <div class="flight-col">
+          <div class="panel flight-panel">
+            <div class="panel-title">
+              \u{1F6F0}\uFE0F Flight Recorder
+              <span style="font-weight: 400; color: var(--muted); font-size: 11px">live</span>
+              <button class="feed-clear-btn" onclick="clearFeed()">clear</button>
+            </div>
+            <div id="activity-feed">
+              <span class="decisions-empty">Waiting for agent activity\u2026</span>
+            </div>
+          </div>
+        </div>
+
         <div class="main">
           <div id="warnBanner" class="warning-banner">
             \u26A0\uFE0F Auto-start is off \u2014 daemon started manually. Run "node9 daemon stop" to stop it, or
@@ -3285,6 +3397,11 @@ var ui_default = `<!doctype html>
             <div id="slackStatusLine" class="slack-status-line">No key saved</div>
           </div>
 
+          <div class="panel">
+            <div class="panel-title">\u{1F6E1}\uFE0F Active Shields</div>
+            <div id="shieldsList"><span class="decisions-empty">Loading\u2026</span></div>
+          </div>
+
           <div class="panel">
             <div class="panel-title">\u{1F4CB} Persistent Decisions</div>
             <div id="decisionsList"><span class="decisions-empty">None yet.</span></div>
@@ -3330,14 +3447,23 @@ var ui_default = `<!doctype html>
 
       function updateDenyButton(id, timestamp) {
         const btn = document.querySelector('#c-' + id + ' .btn-deny');
+        const timer = document.querySelector('#timer-' + id);
         if (!btn) return;
         const elapsed = Date.now() - timestamp;
         const remaining = Math.max(0, Math.ceil((autoDenyMs - elapsed) / 1000));
         if (remaining <= 0) {
-          btn.textContent = 'Auto-Denying...';
+          btn.textContent = '\u23F3 Auto-Denying\u2026';
           btn.disabled = true;
+          if (timer) {
+            timer.textContent = 'auto-deny';
+            timer.className = 'card-timer urgent';
+          }
         } else {
-          btn.textContent = 'Block Action (' + remaining + 's)';
+          btn.textContent = '\u{1F6AB} Block this Action';
+          if (timer) {
+            timer.textContent = remaining + 's';
+            timer.className = 'card-timer' + (remaining < 15 ? ' urgent' : '');
+          }
           setTimeout(() => updateDenyButton(id, timestamp), 1000);
         }
       }
@@ -3353,34 +3479,61 @@ var ui_default = `<!doctype html>
         empty.style.display = requests.size === 0 ? 'block' : 'none';
       }
 
-      function sendDecision(id, decision, persist) {
-        const card = document.getElementById('c-' + id);
-        if (card) card.style.opacity = '0.5';
-        fetch('/decision/' + id, {
-          method: 'POST',
-          headers: { 'Content-Type': 'application/json', 'X-Node9-Token': CSRF_TOKEN },
-          body: JSON.stringify({ decision, persist: !!persist }),
-        });
-        setTimeout(() => {
+      function setCardBusy(card, busy) {
+        if (!card) return;
+        card.querySelectorAll('button').forEach((b) => (b.disabled = busy));
+        card.style.opacity = busy ? '0.5' : '1';
+      }
+
+      function showCardError(card, msg) {
+        if (!card) return;
+        card.style.outline = '2px solid #f87171';
+        let err = card.querySelector('.card-error');
+        if (!err) {
+          err = document.createElement('p');
+          err.className = 'card-error';
+          err.style.cssText = 'color:#f87171;font-size:11px;margin:6px 0 0;';
+          card.appendChild(err);
+        }
+        err.textContent = '\u26A0 ' + msg + ' \u2014 please try again or refresh.';
+      }
+
+      async function sendDecision(id, decision, persist) {
+        const card = document.getElementById('c-' + id);
+        setCardBusy(card, true);
+        try {
+          const res = await fetch('/decision/' + id, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json', 'X-Node9-Token': CSRF_TOKEN },
+            body: JSON.stringify({ decision, persist: !!persist }),
+          });
+          if (!res.ok) throw new Error('Request failed (HTTP ' + res.status + ')');
           card?.remove();
           requests.delete(id);
           refresh();
-        }, 200);
+        } catch (err) {
+          setCardBusy(card, false);
+          showCardError(card, err.message || 'Network error');
+        }
       }
 
-      function sendTrust(id, duration) {
+      async function sendTrust(id, duration) {
         const card = document.getElementById('c-' + id);
-        if (card) card.style.opacity = '0.5';
-        fetch('/decision/' + id, {
-          method: 'POST',
-          headers: { 'Content-Type': 'application/json', 'X-Node9-Token': CSRF_TOKEN },
-          body: JSON.stringify({ decision: 'trust', trustDuration: duration }),
-        });
-        setTimeout(() => {
+        setCardBusy(card, true);
+        try {
+          const res = await fetch('/decision/' + id, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json', 'X-Node9-Token': CSRF_TOKEN },
+            body: JSON.stringify({ decision: 'trust', trustDuration: duration }),
+          });
+          if (!res.ok) throw new Error('Request failed (HTTP ' + res.status + ')');
           card?.remove();
           requests.delete(id);
           refresh();
-        }, 200);
+        } catch (err) {
+          setCardBusy(card, false);
+          showCardError(card, err.message || 'Network error');
+        }
       }
 
       function renderPayload(req) {
@@ -3431,16 +3584,21 @@ var ui_default = `<!doctype html>
         const mcpLabel = req.mcpServer ? esc(req.mcpServer) : null;
         const dis = isSlack ? 'disabled' : '';
         card.innerHTML = \`
+        <div class="card-header">
+          <span class="card-header-icon">\${isSlack ? '\u26A1' : '\u26A0\uFE0F'}</span>
+          <span class="card-header-title">\${isSlack ? 'Awaiting Cloud Approval' : 'Action Required'}</span>
+          <span class="card-timer" id="timer-\${req.id}">\${autoDenyMs > 0 ? Math.ceil(autoDenyMs / 1000) + 's' : ''}</span>
+        </div>
         <div class="source-row">
           <span class="agent-badge">\${agentLabel}</span>
           \${mcpLabel ? \`<span class="source-arrow">\u2192</span><span class="mcp-badge">mcp::\${mcpLabel}</span>\` : ''}
         </div>
         <div class="tool-chip">\${esc(req.toolName)}</div>
-        \${isSlack ? '<div class="slack-indicator">\u26A1 Awaiting Slack approval \u2014 view only</div>' : ''}
+        \${isSlack ? '<div class="slack-indicator">\u26A1 Awaiting Cloud approval \u2014 view only</div>' : ''}
         \${renderPayload(req)}
         <div class="actions" id="act-\${req.id}">
-          <button class="btn-allow" onclick="sendDecision('\${req.id}','allow',false)" \${dis}>Approve Execution</button>
-          <button class="btn-deny"  onclick="sendDecision('\${req.id}','deny',false)"  \${dis}>Block Action</button>
+          <button class="btn-allow" onclick="sendDecision('\${req.id}','allow',false)" \${dis}>\u2705 Allow this Action</button>
+          <button class="btn-deny"  onclick="sendDecision('\${req.id}','deny',false)"  \${dis}>\u{1F6AB} Block this Action</button>
           <div class="trust-row\${trustEnabled ? ' show' : ''}" id="tr-\${req.id}">
             <button class="btn-trust" onclick="sendTrust('\${req.id}','30m')" \${dis}>\u23F1 Trust 30m</button>
             <button class="btn-trust" onclick="sendTrust('\${req.id}','1h')"  \${dis}>\u23F1 Trust 1h</button>
@@ -3500,9 +3658,84 @@ var ui_default = `<!doctype html>
         ev.addEventListener('slack-status', (e) => {
           applySlackStatus(JSON.parse(e.data));
         });
+        ev.addEventListener('shields-status', (e) => {
+          renderShields(JSON.parse(e.data).shields);
+        });
+
+        // \u2500\u2500 Flight Recorder \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+        ev.addEventListener('activity', (e) => {
+          const data = JSON.parse(e.data);
+          const feed = document.getElementById('activity-feed');
+          // Remove placeholder on first item
+          const placeholder = feed.querySelector('.decisions-empty');
+          if (placeholder) placeholder.remove();
+
+          const time = new Date(data.ts).toLocaleTimeString([], {
+            hour12: false,
+            hour: '2-digit',
+            minute: '2-digit',
+            second: '2-digit',
+          });
+          const icon = frIcon(data.tool);
+          const argsStr = JSON.stringify(data.args ?? {});
+          const argsPreview = esc(argsStr.length > 120 ? argsStr.slice(0, 120) + '\u2026' : argsStr);
+
+          const row = document.createElement('div');
+          row.className = 'feed-row';
+          row.id = 'fr-' + data.id;
+          row.innerHTML = \`
+            <span class="feed-ts">\${time}</span>
+            <span class="feed-icon">\${icon}</span>
+            <span class="feed-content"><strong>\${esc(data.tool)}</strong><span class="feed-args">\${argsPreview}</span></span>
+            <span class="feed-badge fr-pending">\u25CF</span>
+          \`;
+          feed.prepend(row);
+          if (feed.children.length > 100) feed.lastChild.remove();
+        });
+
+        ev.addEventListener('activity-result', (e) => {
+          const { id, status, label } = JSON.parse(e.data);
+          const row = document.getElementById('fr-' + id);
+          if (!row) return;
+          const badge = row.querySelector('.feed-badge');
+          if (status === 'allow') {
+            badge.textContent = 'ALLOW';
+            badge.className = 'feed-badge fr-allow';
+          } else if (status === 'dlp') {
+            badge.textContent = '\u{1F6E1}\uFE0F DLP';
+            badge.className = 'feed-badge fr-dlp';
+            row.classList.add('fr-dlp-row');
+          } else {
+            badge.textContent = 'BLOCK';
+            badge.className = 'feed-badge fr-block';
+          }
+        });
       }
       connect();
 
+      const FR_ICONS = {
+        bash: '\u{1F4BB}',
+        read: '\u{1F4D6}',
+        edit: '\u270F\uFE0F',
+        write: '\u270F\uFE0F',
+        glob: '\u{1F4C2}',
+        grep: '\u{1F50D}',
+        agent: '\u{1F916}',
+        search: '\u{1F50D}',
+        sql: '\u{1F5C4}\uFE0F',
+        query: '\u{1F5C4}\uFE0F',
+        list: '\u{1F4C2}',
+        delete: '\u{1F5D1}\uFE0F',
+        web: '\u{1F310}',
+      };
+      function frIcon(tool) {
+        const t = (tool || '').toLowerCase();
+        for (const [k, v] of Object.entries(FR_ICONS)) {
+          if (t.includes(k)) return v;
+        }
+        return '\u{1F6E0}\uFE0F';
+      }
+
       function saveSetting(key, value) {
         fetch('/settings', {
           method: 'POST',
@@ -3592,6 +3825,49 @@ var ui_default = `<!doctype html>
         }
       }
 
+      function clearFeed() {
+        const feed = document.getElementById('activity-feed');
+        feed.innerHTML = '<span class="decisions-empty">Feed cleared.</span>';
+      }
+
+      function renderShields(shields) {
+        const list = document.getElementById('shieldsList');
+        if (!shields || shields.length === 0) {
+          list.innerHTML = '<span class="decisions-empty">No shields available.</span>';
+          return;
+        }
+        list.innerHTML = shields
+          .map(
+            (s) => \`
+          <div class="shield-row">
+            <div class="shield-info">
+              <div class="shield-name">\${esc(s.name)}</div>
+              <div class="shield-desc">\${esc(s.description)}</div>
+            </div>
+            <label class="toggle">
+              <input type="checkbox" \${s.active ? 'checked' : ''}
+                onchange="toggleShield('\${esc(s.name)}', this.checked)" />
+              <span class="slider"></span>
+            </label>
+          </div>
+        \`
+          )
+          .join('');
+      }
+
+      function toggleShield(name, active) {
+        fetch('/shields', {
+          method: 'POST',
+          headers: { 'Content-Type': 'application/json', 'X-Node9-Token': CSRF_TOKEN },
+          body: JSON.stringify({ name, active }),
+        }).catch(() => {});
+      }
+
+      fetch('/shields')
+        .then((r) => r.json())
+        .then(({ shields }) => renderShields(shields))
+        .catch(() => {});
+
       function renderDecisions(decisions) {
         const dl = document.getElementById('decisionsList');
         const entries = Object.entries(decisions);
@@ -3638,31 +3914,32 @@ var ui_default = `<!doctype html>
   </body>
 </html>
 `;
+  }
+});
 
 // src/daemon/ui.ts
-var UI_HTML_TEMPLATE = ui_default;
+var UI_HTML_TEMPLATE;
+var init_ui2 = __esm({
+  "src/daemon/ui.ts"() {
+    "use strict";
+    init_ui();
+    UI_HTML_TEMPLATE = ui_default;
+  }
+});
 
 // src/daemon/index.ts
 import http from "http";
+import net2 from "net";
 import fs4 from "fs";
 import path6 from "path";
 import os4 from "os";
-import { spawn as spawn2 } from "child_process";
-import { randomUUID } from "crypto";
+import { spawn as spawn2, spawnSync as spawnSync2 } from "child_process";
+import { randomUUID as randomUUID2 } from "crypto";
 import chalk4 from "chalk";
-var DAEMON_PORT2 = 7391;
-var DAEMON_HOST2 = "127.0.0.1";
-var homeDir = os4.homedir();
-var DAEMON_PID_FILE = path6.join(homeDir, ".node9", "daemon.pid");
-var DECISIONS_FILE = path6.join(homeDir, ".node9", "decisions.json");
-var GLOBAL_CONFIG_FILE = path6.join(homeDir, ".node9", "config.json");
-var CREDENTIALS_FILE = path6.join(homeDir, ".node9", "credentials.json");
-var AUDIT_LOG_FILE = path6.join(homeDir, ".node9", "audit.log");
-var TRUST_FILE2 = path6.join(homeDir, ".node9", "trust.json");
 function atomicWriteSync2(filePath, data, options) {
   const dir = path6.dirname(filePath);
   if (!fs4.existsSync(dir)) fs4.mkdirSync(dir, { recursive: true });
-  const tmpPath = `${filePath}.${randomUUID()}.tmp`;
+  const tmpPath = `${filePath}.${randomUUID2()}.tmp`;
   fs4.writeFileSync(tmpPath, data, options);
   fs4.renameSync(tmpPath, filePath);
 }
@@ -3680,12 +3957,6 @@ function writeTrustEntry(toolName, durationMs) {
   } catch {
   }
 }
-var TRUST_DURATIONS = {
-  "30m": 30 * 6e4,
-  "1h": 60 * 6e4,
-  "2h": 2 * 60 * 6e4
-};
-var SECRET_KEY_RE = /password|secret|token|key|apikey|credential|auth/i;
 function redactArgs(value) {
   if (!value || typeof value !== "object") return value;
   if (Array.isArray(value)) return value.map(redactArgs);
@@ -3720,7 +3991,6 @@ function getAuditHistory(limit = 20) {
     return [];
   }
 }
-var AUTO_DENY_MS = 12e4;
 function getOrgName() {
   try {
     if (fs4.existsSync(CREDENTIALS_FILE)) {
@@ -3730,7 +4000,6 @@ function getOrgName() {
   }
   return null;
 }
-var autoStarted = process.env.NODE9_AUTO_STARTED === "1";
 function hasStoredSlackKey() {
   return fs4.existsSync(CREDENTIALS_FILE);
 }
@@ -3746,11 +4015,6 @@ function writeGlobalSetting(key, value) {
   config.settings[key] = value;
   atomicWriteSync2(GLOBAL_CONFIG_FILE, JSON.stringify(config, null, 2), { mode: 384 });
 }
-var pending = /* @__PURE__ */ new Map();
-var sseClients = /* @__PURE__ */ new Set();
-var abandonTimer = null;
-var daemonServer = null;
-var hadBrowserClient = false;
 function abandonPending() {
   abandonTimer = null;
   pending.forEach((entry, id) => {
@@ -3772,6 +4036,18 @@ function abandonPending() {
   }
 }
 function broadcast(event, data) {
+  if (event === "activity") {
+    activityRing.push({ event, data });
+    if (activityRing.length > ACTIVITY_RING_SIZE) activityRing.shift();
+  } else if (event === "activity-result") {
+    const { id, status, label } = data;
+    for (let i = activityRing.length - 1; i >= 0; i--) {
+      if (activityRing[i].data.id === id) {
+        Object.assign(activityRing[i].data, { status, label });
+        break;
+      }
+    }
+  }
   const msg = `event: ${event}
 data: ${JSON.stringify(data)}
 
@@ -3817,13 +4093,15 @@ function writePersistentDecision(toolName, decision) {
   }
 }
 function startDaemon() {
-  const csrfToken = randomUUID();
-  const internalToken = randomUUID();
+  const csrfToken = randomUUID2();
+  const internalToken = randomUUID2();
   const UI_HTML = UI_HTML_TEMPLATE.replace("{{CSRF_TOKEN}}", csrfToken);
   const validToken = (req) => req.headers["x-node9-token"] === csrfToken;
   const IDLE_TIMEOUT_MS = 12 * 60 * 60 * 1e3;
+  const watchMode = process.env.NODE9_WATCH_MODE === "1";
   let idleTimer;
   function resetIdleTimer() {
+    if (watchMode) return;
     if (idleTimer) clearTimeout(idleTimer);
     idleTimer = setTimeout(() => {
       if (autoStarted) {
@@ -3878,6 +4156,12 @@ data: ${JSON.stringify({
 data: ${JSON.stringify(readPersistentDecisions())}
 
 `);
+      for (const item of activityRing) {
+        res.write(`event: ${item.event}
+data: ${JSON.stringify(item.data)}
+
+`);
+      }
       return req.on("close", () => {
         sseClients.delete(res);
         if (sseClients.size === 0 && pending.size > 0) {
@@ -3897,9 +4181,11 @@ data: ${JSON.stringify(readPersistentDecisions())}
           slackDelegated = false,
           agent,
           mcpServer,
-          riskMetadata
+          riskMetadata,
+          fromCLI = false,
+          activityId
         } = JSON.parse(body);
-        const id = randomUUID();
+        const id = fromCLI && typeof activityId === "string" && activityId || randomUUID2();
         const entry = {
           id,
           toolName,
@@ -3930,6 +4216,15 @@ data: ${JSON.stringify(readPersistentDecisions())}
           }, AUTO_DENY_MS)
         };
         pending.set(id, entry);
+        if (!fromCLI) {
+          broadcast("activity", {
+            id,
+            ts: entry.timestamp,
+            tool: toolName,
+            args: redactArgs(args),
+            status: "pending"
+          });
+        }
         const browserEnabled = getConfig().settings.approvers?.browser !== false;
         if (browserEnabled) {
           broadcast("add", {
@@ -3959,6 +4254,11 @@ data: ${JSON.stringify(readPersistentDecisions())}
           const e = pending.get(id);
           if (!e) return;
           if (result.noApprovalMechanism) return;
+          broadcast("activity-result", {
+            id,
+            status: result.approved ? "allow" : result.blockedByLabel?.includes("DLP") ? "dlp" : "block",
+            label: result.blockedByLabel
+          });
           clearTimeout(e.timer);
           const decision = result.approved ? "allow" : "deny";
           appendAuditLog({ toolName: e.toolName, args: e.args, decision });
@@ -3993,8 +4293,8 @@ data: ${JSON.stringify(readPersistentDecisions())}
       const entry = pending.get(id);
       if (!entry) return res.writeHead(404).end();
       if (entry.earlyDecision) {
+        clearTimeout(entry.timer);
         pending.delete(id);
-        broadcast("remove", { id });
         res.writeHead(200, { "Content-Type": "application/json" });
         const body = { decision: entry.earlyDecision };
         if (entry.earlyReason) body.reason = entry.earlyReason;
@@ -4024,10 +4324,15 @@ data: ${JSON.stringify(readPersistentDecisions())}
             decision: `trust:${trustDuration}`
           });
           clearTimeout(entry.timer);
-          if (entry.waiter) entry.waiter("allow");
-          else entry.earlyDecision = "allow";
-          pending.delete(id);
-          broadcast("remove", { id });
+          if (entry.waiter) {
+            entry.waiter("allow");
+            pending.delete(id);
+            broadcast("remove", { id });
+          } else {
+            entry.earlyDecision = "allow";
+            broadcast("remove", { id });
+            entry.timer = setTimeout(() => pending.delete(id), 3e4);
+          }
           res.writeHead(200);
           return res.end(JSON.stringify({ ok: true }));
         }
@@ -4039,13 +4344,16 @@ data: ${JSON.stringify(readPersistentDecisions())}
           decision: resolvedDecision
         });
         clearTimeout(entry.timer);
-        if (entry.waiter) entry.waiter(resolvedDecision, reason);
-        else {
+        if (entry.waiter) {
+          entry.waiter(resolvedDecision, reason);
+          pending.delete(id);
+          broadcast("remove", { id });
+        } else {
           entry.earlyDecision = resolvedDecision;
           entry.earlyReason = reason;
+          broadcast("remove", { id });
+          entry.timer = setTimeout(() => pending.delete(id), 3e4);
         }
-        pending.delete(id);
-        broadcast("remove", { id });
         res.writeHead(200);
         return res.end(JSON.stringify({ ok: true }));
       } catch {
@@ -4098,119 +4406,741 @@ data: ${JSON.stringify(readPersistentDecisions())}
         res.writeHead(400).end();
       }
     }
-    if (req.method === "DELETE" && pathname.startsWith("/decisions/")) {
-      if (!validToken(req)) return res.writeHead(403).end();
-      try {
-        const toolName = decodeURIComponent(pathname.split("/").pop());
-        const decisions = readPersistentDecisions();
-        delete decisions[toolName];
-        atomicWriteSync2(DECISIONS_FILE, JSON.stringify(decisions, null, 2));
-        broadcast("decisions", decisions);
-        res.writeHead(200);
-        return res.end(JSON.stringify({ ok: true }));
-      } catch {
-        res.writeHead(400).end();
+    if (req.method === "DELETE" && pathname.startsWith("/decisions/")) {
+      if (!validToken(req)) return res.writeHead(403).end();
+      try {
+        const toolName = decodeURIComponent(pathname.split("/").pop());
+        const decisions = readPersistentDecisions();
+        delete decisions[toolName];
+        atomicWriteSync2(DECISIONS_FILE, JSON.stringify(decisions, null, 2));
+        broadcast("decisions", decisions);
+        res.writeHead(200);
+        return res.end(JSON.stringify({ ok: true }));
+      } catch {
+        res.writeHead(400).end();
+      }
+    }
+    if (req.method === "POST" && pathname.startsWith("/resolve/")) {
+      const internalAuth = req.headers["x-node9-internal"];
+      if (internalAuth !== internalToken) return res.writeHead(403).end();
+      try {
+        const id = pathname.split("/").pop();
+        const entry = pending.get(id);
+        if (!entry) return res.writeHead(404).end();
+        const { decision } = JSON.parse(await readBody(req));
+        appendAuditLog({
+          toolName: entry.toolName,
+          args: entry.args,
+          decision
+        });
+        clearTimeout(entry.timer);
+        if (entry.waiter) entry.waiter(decision);
+        else entry.earlyDecision = decision;
+        pending.delete(id);
+        broadcast("remove", { id });
+        res.writeHead(200);
+        return res.end(JSON.stringify({ ok: true }));
+      } catch {
+        res.writeHead(400).end();
+      }
+    }
+    if (req.method === "POST" && pathname === "/events/clear") {
+      activityRing.length = 0;
+      res.writeHead(200, { "Content-Type": "application/json" });
+      return res.end(JSON.stringify({ ok: true }));
+    }
+    if (req.method === "GET" && pathname === "/audit") {
+      res.writeHead(200, { "Content-Type": "application/json" });
+      return res.end(JSON.stringify(getAuditHistory()));
+    }
+    if (req.method === "GET" && pathname === "/shields") {
+      if (!validToken(req)) return res.writeHead(403).end();
+      const active = readActiveShields();
+      const shields = Object.values(SHIELDS).map((s) => ({
+        name: s.name,
+        description: s.description,
+        active: active.includes(s.name)
+      }));
+      res.writeHead(200, { "Content-Type": "application/json" });
+      return res.end(JSON.stringify({ shields }));
+    }
+    if (req.method === "POST" && pathname === "/shields") {
+      if (!validToken(req)) return res.writeHead(403).end();
+      try {
+        const { name, active } = JSON.parse(await readBody(req));
+        if (!SHIELDS[name]) return res.writeHead(400).end();
+        const current = readActiveShields();
+        const updated = active ? [.../* @__PURE__ */ new Set([...current, name])] : current.filter((n) => n !== name);
+        writeActiveShields(updated);
+        _resetConfigCache();
+        const shieldsPayload = Object.values(SHIELDS).map((s) => ({
+          name: s.name,
+          description: s.description,
+          active: updated.includes(s.name)
+        }));
+        broadcast("shields-status", { shields: shieldsPayload });
+        res.writeHead(200);
+        return res.end(JSON.stringify({ ok: true }));
+      } catch {
+        res.writeHead(400).end();
+      }
+    }
+    res.writeHead(404).end();
+  });
+  daemonServer = server;
+  server.on("error", (e) => {
+    if (e.code === "EADDRINUSE") {
+      try {
+        if (fs4.existsSync(DAEMON_PID_FILE)) {
+          const { pid } = JSON.parse(fs4.readFileSync(DAEMON_PID_FILE, "utf-8"));
+          process.kill(pid, 0);
+          return process.exit(0);
+        }
+      } catch {
+        try {
+          fs4.unlinkSync(DAEMON_PID_FILE);
+        } catch {
+        }
+        server.listen(DAEMON_PORT2, DAEMON_HOST2);
+        return;
+      }
+      fetch(`http://${DAEMON_HOST2}:${DAEMON_PORT2}/settings`, {
+        signal: AbortSignal.timeout(1e3)
+      }).then((res) => {
+        if (res.ok) {
+          try {
+            const r = spawnSync2("ss", ["-Htnp", `sport = :${DAEMON_PORT2}`], {
+              encoding: "utf8",
+              timeout: 1e3
+            });
+            const match = r.stdout?.match(/pid=(\d+)/);
+            if (match) {
+              const orphanPid = parseInt(match[1], 10);
+              process.kill(orphanPid, 0);
+              atomicWriteSync2(
+                DAEMON_PID_FILE,
+                JSON.stringify({ pid: orphanPid, port: DAEMON_PORT2, internalToken, autoStarted }),
+                { mode: 384 }
+              );
+            }
+          } catch {
+          }
+          process.exit(0);
+        } else {
+          server.listen(DAEMON_PORT2, DAEMON_HOST2);
+        }
+      }).catch(() => {
+        server.listen(DAEMON_PORT2, DAEMON_HOST2);
+      });
+      return;
+    }
+    console.error(chalk4.red("\n\u{1F6D1} Node9 Daemon Error:"), e.message);
+    process.exit(1);
+  });
+  server.listen(DAEMON_PORT2, DAEMON_HOST2, () => {
+    atomicWriteSync2(
+      DAEMON_PID_FILE,
+      JSON.stringify({ pid: process.pid, port: DAEMON_PORT2, internalToken, autoStarted }),
+      { mode: 384 }
+    );
+    console.log(chalk4.green(`\u{1F6E1}\uFE0F  Node9 Guard LIVE: http://127.0.0.1:${DAEMON_PORT2}`));
+  });
+  if (watchMode) {
+    console.log(chalk4.cyan("\u{1F6F0}\uFE0F  Flight Recorder active \u2014 daemon will not idle-timeout"));
+  }
+  try {
+    fs4.unlinkSync(ACTIVITY_SOCKET_PATH2);
+  } catch {
+  }
+  const ACTIVITY_MAX_BYTES = 1024 * 1024;
+  const unixServer = net2.createServer((socket) => {
+    const chunks = [];
+    let bytesReceived = 0;
+    socket.on("data", (chunk) => {
+      bytesReceived += chunk.length;
+      if (bytesReceived > ACTIVITY_MAX_BYTES) {
+        socket.destroy();
+        return;
+      }
+      chunks.push(chunk);
+    });
+    socket.on("end", () => {
+      try {
+        const data = JSON.parse(Buffer.concat(chunks).toString());
+        if (data.status === "pending") {
+          broadcast("activity", {
+            id: data.id,
+            ts: data.ts,
+            tool: data.tool,
+            args: redactArgs(data.args),
+            status: "pending"
+          });
+        } else {
+          broadcast("activity-result", {
+            id: data.id,
+            status: data.status,
+            label: data.label
+          });
+        }
+      } catch {
+      }
+    });
+    socket.on("error", () => {
+    });
+  });
+  unixServer.listen(ACTIVITY_SOCKET_PATH2);
+  process.on("exit", () => {
+    try {
+      fs4.unlinkSync(ACTIVITY_SOCKET_PATH2);
+    } catch {
+    }
+  });
+}
+function stopDaemon() {
+  if (!fs4.existsSync(DAEMON_PID_FILE)) return console.log(chalk4.yellow("Not running."));
+  try {
+    const { pid } = JSON.parse(fs4.readFileSync(DAEMON_PID_FILE, "utf-8"));
+    process.kill(pid, "SIGTERM");
+    console.log(chalk4.green("\u2705 Stopped."));
+  } catch {
+    console.log(chalk4.gray("Cleaned up stale PID file."));
+  } finally {
+    try {
+      fs4.unlinkSync(DAEMON_PID_FILE);
+    } catch {
+    }
+  }
+}
+function daemonStatus() {
+  if (fs4.existsSync(DAEMON_PID_FILE)) {
+    try {
+      const { pid } = JSON.parse(fs4.readFileSync(DAEMON_PID_FILE, "utf-8"));
+      process.kill(pid, 0);
+      console.log(chalk4.green("Node9 daemon: running"));
+      return;
+    } catch {
+      console.log(chalk4.yellow("Node9 daemon: not running (stale PID)"));
+      return;
+    }
+  }
+  const r = spawnSync2("ss", ["-Htnp", `sport = :${DAEMON_PORT2}`], {
+    encoding: "utf8",
+    timeout: 500
+  });
+  if (r.status === 0 && (r.stdout ?? "").includes(`:${DAEMON_PORT2}`)) {
+    console.log(chalk4.yellow("Node9 daemon: running (no PID file \u2014 orphaned)"));
+  } else {
+    console.log(chalk4.yellow("Node9 daemon: not running"));
+  }
+}
+var ACTIVITY_SOCKET_PATH2, DAEMON_PORT2, DAEMON_HOST2, homeDir, DAEMON_PID_FILE, DECISIONS_FILE, GLOBAL_CONFIG_FILE, CREDENTIALS_FILE, AUDIT_LOG_FILE, TRUST_FILE2, TRUST_DURATIONS, SECRET_KEY_RE, AUTO_DENY_MS, autoStarted, pending, sseClients, abandonTimer, daemonServer, hadBrowserClient, ACTIVITY_RING_SIZE, activityRing;
+var init_daemon = __esm({
+  "src/daemon/index.ts"() {
+    "use strict";
+    init_ui2();
+    init_core();
+    init_shields();
+    ACTIVITY_SOCKET_PATH2 = process.platform === "win32" ? "\\\\.\\pipe\\node9-activity" : path6.join(os4.tmpdir(), "node9-activity.sock");
+    DAEMON_PORT2 = 7391;
+    DAEMON_HOST2 = "127.0.0.1";
+    homeDir = os4.homedir();
+    DAEMON_PID_FILE = path6.join(homeDir, ".node9", "daemon.pid");
+    DECISIONS_FILE = path6.join(homeDir, ".node9", "decisions.json");
+    GLOBAL_CONFIG_FILE = path6.join(homeDir, ".node9", "config.json");
+    CREDENTIALS_FILE = path6.join(homeDir, ".node9", "credentials.json");
+    AUDIT_LOG_FILE = path6.join(homeDir, ".node9", "audit.log");
+    TRUST_FILE2 = path6.join(homeDir, ".node9", "trust.json");
+    TRUST_DURATIONS = {
+      "30m": 30 * 6e4,
+      "1h": 60 * 6e4,
+      "2h": 2 * 60 * 6e4
+    };
+    SECRET_KEY_RE = /password|secret|token|key|apikey|credential|auth/i;
+    AUTO_DENY_MS = 12e4;
+    autoStarted = process.env.NODE9_AUTO_STARTED === "1";
+    pending = /* @__PURE__ */ new Map();
+    sseClients = /* @__PURE__ */ new Set();
+    abandonTimer = null;
+    daemonServer = null;
+    hadBrowserClient = false;
+    ACTIVITY_RING_SIZE = 100;
+    activityRing = [];
+  }
+});
+
+// src/tui/tail.ts
+var tail_exports = {};
+__export(tail_exports, {
+  startTail: () => startTail
+});
+import http2 from "http";
+import chalk5 from "chalk";
+import fs6 from "fs";
+import os6 from "os";
+import path8 from "path";
+import readline from "readline";
+import { spawn as spawn3 } from "child_process";
+function getIcon(tool) {
+  const t = tool.toLowerCase();
+  for (const [k, v] of Object.entries(ICONS)) {
+    if (t.includes(k)) return v;
+  }
+  return "\u{1F6E0}\uFE0F";
+}
+function formatBase(activity) {
+  const time = new Date(activity.ts).toLocaleTimeString([], { hour12: false });
+  const icon = getIcon(activity.tool);
+  const toolName = activity.tool.slice(0, 16).padEnd(16);
+  const argsStr = JSON.stringify(activity.args ?? {}).replace(/\s+/g, " ");
+  const argsPreview = argsStr.length > 70 ? argsStr.slice(0, 70) + "\u2026" : argsStr;
+  return `${chalk5.gray(time)} ${icon} ${chalk5.white.bold(toolName)} ${chalk5.dim(argsPreview)}`;
+}
+function renderResult(activity, result) {
+  const base = formatBase(activity);
+  let status;
+  if (result.status === "allow") {
+    status = chalk5.green("\u2713 ALLOW");
+  } else if (result.status === "dlp") {
+    status = chalk5.bgRed.white.bold(" \u{1F6E1}\uFE0F  DLP ");
+  } else {
+    status = chalk5.red("\u2717 BLOCK");
+  }
+  if (process.stdout.isTTY) {
+    readline.clearLine(process.stdout, 0);
+    readline.cursorTo(process.stdout, 0);
+  }
+  console.log(`${base}  ${status}`);
+}
+function renderPending(activity) {
+  if (!process.stdout.isTTY) return;
+  process.stdout.write(`${formatBase(activity)}  ${chalk5.yellow("\u25CF \u2026")}\r`);
+}
+async function ensureDaemon() {
+  if (fs6.existsSync(PID_FILE)) {
+    try {
+      const { port } = JSON.parse(fs6.readFileSync(PID_FILE, "utf-8"));
+      return port;
+    } catch {
+    }
+  }
+  try {
+    const res = await fetch(`http://127.0.0.1:${DAEMON_PORT2}/settings`, {
+      signal: AbortSignal.timeout(500)
+    });
+    if (res.ok) return DAEMON_PORT2;
+  } catch {
+  }
+  console.log(chalk5.dim("\u{1F6E1}\uFE0F  Starting Node9 daemon..."));
+  const child = spawn3(process.execPath, [process.argv[1], "daemon"], {
+    detached: true,
+    stdio: "ignore",
+    env: { ...process.env, NODE9_AUTO_STARTED: "1" }
+  });
+  child.unref();
+  for (let i = 0; i < 20; i++) {
+    await new Promise((r) => setTimeout(r, 250));
+    try {
+      const res = await fetch(`http://127.0.0.1:${DAEMON_PORT2}/settings`, {
+        signal: AbortSignal.timeout(500)
+      });
+      if (res.ok) return DAEMON_PORT2;
+    } catch {
+    }
+  }
+  console.error(chalk5.red("\u274C Daemon failed to start. Try: node9 daemon start"));
+  process.exit(1);
+}
+async function startTail(options = {}) {
+  const port = await ensureDaemon();
+  if (options.clear) {
+    await new Promise((resolve) => {
+      const req2 = http2.request(
+        { method: "POST", hostname: "127.0.0.1", port, path: "/events/clear" },
+        (res) => {
+          res.resume();
+          res.on("end", resolve);
+        }
+      );
+      req2.on("error", resolve);
+      req2.end();
+    });
+  }
+  const connectionTime = Date.now();
+  const pending2 = /* @__PURE__ */ new Map();
+  console.log(chalk5.cyan.bold(`
+\u{1F6F0}\uFE0F  Node9 tail  `) + chalk5.dim(`\u2192 localhost:${port}`));
+  if (options.clear) {
+    console.log(chalk5.dim("History cleared. Showing live events. Press Ctrl+C to exit.\n"));
+  } else if (options.history) {
+    console.log(chalk5.dim("Showing history + live events. Press Ctrl+C to exit.\n"));
+  } else {
+    console.log(
+      chalk5.dim("Showing live events only. Use --history to include past. Press Ctrl+C to exit.\n")
+    );
+  }
+  process.on("SIGINT", () => {
+    if (process.stdout.isTTY) {
+      readline.clearLine(process.stdout, 0);
+      readline.cursorTo(process.stdout, 0);
+    }
+    console.log(chalk5.dim("\n\u{1F6F0}\uFE0F  Disconnected."));
+    process.exit(0);
+  });
+  const req = http2.get(`http://127.0.0.1:${port}/events`, (res) => {
+    if (res.statusCode !== 200) {
+      console.error(chalk5.red(`Failed to connect: HTTP ${res.statusCode}`));
+      process.exit(1);
+    }
+    let currentEvent = "";
+    let currentData = "";
+    res.on("error", () => {
+    });
+    const rl = readline.createInterface({ input: res, crlfDelay: Infinity });
+    rl.on("error", () => {
+    });
+    rl.on("line", (line) => {
+      if (line.startsWith("event:")) {
+        currentEvent = line.slice(6).trim();
+      } else if (line.startsWith("data:")) {
+        currentData = line.slice(5).trim();
+      } else if (line === "") {
+        if (currentEvent && currentData) {
+          handleMessage(currentEvent, currentData);
+        }
+        currentEvent = "";
+        currentData = "";
+      }
+    });
+    rl.on("close", () => {
+      if (process.stdout.isTTY) {
+        readline.clearLine(process.stdout, 0);
+        readline.cursorTo(process.stdout, 0);
+      }
+      console.log(chalk5.red("\n\u274C Daemon disconnected."));
+      process.exit(1);
+    });
+  });
+  function handleMessage(event, rawData) {
+    let data;
+    try {
+      data = JSON.parse(rawData);
+    } catch {
+      return;
+    }
+    if (event === "activity") {
+      if (!options.history && data.ts > 0 && data.ts < connectionTime) return;
+      if (data.status && data.status !== "pending") {
+        renderResult(data, data);
+        return;
+      }
+      pending2.set(data.id, data);
+      const slowTool = /bash|shell|query|sql|agent/i.test(data.tool);
+      if (slowTool) renderPending(data);
+    }
+    if (event === "activity-result") {
+      const original = pending2.get(data.id);
+      if (original) {
+        renderResult(original, data);
+        pending2.delete(data.id);
+      }
+    }
+  }
+  req.on("error", (err) => {
+    const msg = err.code === "ECONNREFUSED" ? "Daemon is not running. Start it with: node9 daemon start" : err.message;
+    console.error(chalk5.red(`
+\u274C ${msg}`));
+    process.exit(1);
+  });
+}
+var PID_FILE, ICONS;
+var init_tail = __esm({
+  "src/tui/tail.ts"() {
+    "use strict";
+    init_daemon();
+    PID_FILE = path8.join(os6.homedir(), ".node9", "daemon.pid");
+    ICONS = {
+      bash: "\u{1F4BB}",
+      shell: "\u{1F4BB}",
+      terminal: "\u{1F4BB}",
+      read: "\u{1F4D6}",
+      edit: "\u270F\uFE0F",
+      write: "\u270F\uFE0F",
+      glob: "\u{1F4C2}",
+      grep: "\u{1F50D}",
+      agent: "\u{1F916}",
+      search: "\u{1F50D}",
+      sql: "\u{1F5C4}\uFE0F",
+      query: "\u{1F5C4}\uFE0F",
+      list: "\u{1F4C2}",
+      delete: "\u{1F5D1}\uFE0F",
+      web: "\u{1F310}"
+    };
+  }
+});
+
+// src/cli.ts
+init_core();
+import { Command } from "commander";
+
+// src/setup.ts
+import fs3 from "fs";
+import path5 from "path";
+import os3 from "os";
+import chalk3 from "chalk";
+import { confirm as confirm2 } from "@inquirer/prompts";
+function printDaemonTip() {
+  console.log(
+    chalk3.cyan("\n   \u{1F4A1} Node9 will protect you automatically using Native OS popups.") + chalk3.white("\n      To view your history or manage persistent rules, run:") + chalk3.green("\n      node9 daemon --openui")
+  );
+}
+function fullPathCommand(subcommand) {
+  if (process.env.NODE9_TESTING === "1") return `node9 ${subcommand}`;
+  const nodeExec = process.execPath;
+  const cliScript = process.argv[1];
+  return `${nodeExec} ${cliScript} ${subcommand}`;
+}
+function readJson(filePath) {
+  try {
+    if (fs3.existsSync(filePath)) {
+      return JSON.parse(fs3.readFileSync(filePath, "utf-8"));
+    }
+  } catch {
+  }
+  return null;
+}
+function writeJson(filePath, data) {
+  const dir = path5.dirname(filePath);
+  if (!fs3.existsSync(dir)) fs3.mkdirSync(dir, { recursive: true });
+  fs3.writeFileSync(filePath, JSON.stringify(data, null, 2) + "\n");
+}
+async function setupClaude() {
+  const homeDir2 = os3.homedir();
+  const mcpPath = path5.join(homeDir2, ".claude.json");
+  const hooksPath = path5.join(homeDir2, ".claude", "settings.json");
+  const claudeConfig = readJson(mcpPath) ?? {};
+  const settings = readJson(hooksPath) ?? {};
+  const servers = claudeConfig.mcpServers ?? {};
+  let anythingChanged = false;
+  if (!settings.hooks) settings.hooks = {};
+  const hasPreHook = settings.hooks.PreToolUse?.some(
+    (m) => m.hooks.some((h) => h.command?.includes("node9 check") || h.command?.includes("cli.js check"))
+  );
+  if (!hasPreHook) {
+    if (!settings.hooks.PreToolUse) settings.hooks.PreToolUse = [];
+    settings.hooks.PreToolUse.push({
+      matcher: ".*",
+      hooks: [{ type: "command", command: fullPathCommand("check"), timeout: 60 }]
+    });
+    console.log(chalk3.green("  \u2705 PreToolUse hook added  \u2192 node9 check"));
+    anythingChanged = true;
+  }
+  const hasPostHook = settings.hooks.PostToolUse?.some(
+    (m) => m.hooks.some((h) => h.command?.includes("node9 log") || h.command?.includes("cli.js log"))
+  );
+  if (!hasPostHook) {
+    if (!settings.hooks.PostToolUse) settings.hooks.PostToolUse = [];
+    settings.hooks.PostToolUse.push({
+      matcher: ".*",
+      hooks: [{ type: "command", command: fullPathCommand("log"), timeout: 600 }]
+    });
+    console.log(chalk3.green("  \u2705 PostToolUse hook added \u2192 node9 log"));
+    anythingChanged = true;
+  }
+  if (anythingChanged) {
+    writeJson(hooksPath, settings);
+    console.log("");
+  }
+  const serversToWrap = [];
+  for (const [name, server] of Object.entries(servers)) {
+    if (!server.command || server.command === "node9") continue;
+    const parts = [server.command, ...server.args ?? []];
+    serversToWrap.push({ name, originalCmd: parts.join(" "), parts });
+  }
+  if (serversToWrap.length > 0) {
+    console.log(chalk3.bold("The following existing entries will be modified:\n"));
+    console.log(chalk3.white(`  ${mcpPath}`));
+    for (const { name, originalCmd } of serversToWrap) {
+      console.log(chalk3.gray(`    \u2022 ${name}: "${originalCmd}" \u2192 node9 ${originalCmd}`));
+    }
+    console.log("");
+    const proceed = await confirm2({ message: "Wrap these MCP servers?", default: true });
+    if (proceed) {
+      for (const { name, parts } of serversToWrap) {
+        servers[name] = { ...servers[name], command: "node9", args: parts };
       }
+      claudeConfig.mcpServers = servers;
+      writeJson(mcpPath, claudeConfig);
+      console.log(chalk3.green(`
+  \u2705 ${serversToWrap.length} MCP server(s) wrapped`));
+      anythingChanged = true;
+    } else {
+      console.log(chalk3.yellow("  Skipped MCP server wrapping."));
     }
-    if (req.method === "POST" && pathname.startsWith("/resolve/")) {
-      const internalAuth = req.headers["x-node9-internal"];
-      if (internalAuth !== internalToken) return res.writeHead(403).end();
-      try {
-        const id = pathname.split("/").pop();
-        const entry = pending.get(id);
-        if (!entry) return res.writeHead(404).end();
-        const { decision } = JSON.parse(await readBody(req));
-        appendAuditLog({
-          toolName: entry.toolName,
-          args: entry.args,
-          decision
-        });
-        clearTimeout(entry.timer);
-        if (entry.waiter) entry.waiter(decision);
-        else entry.earlyDecision = decision;
-        pending.delete(id);
-        broadcast("remove", { id });
-        res.writeHead(200);
-        return res.end(JSON.stringify({ ok: true }));
-      } catch {
-        res.writeHead(400).end();
+    console.log("");
+  }
+  if (!anythingChanged && serversToWrap.length === 0) {
+    console.log(chalk3.blue("\u2139\uFE0F  Node9 is already fully configured for Claude Code."));
+    printDaemonTip();
+    return;
+  }
+  if (anythingChanged) {
+    console.log(chalk3.green.bold("\u{1F6E1}\uFE0F  Node9 is now protecting Claude Code!"));
+    console.log(chalk3.gray("    Restart Claude Code for changes to take effect."));
+    printDaemonTip();
+  }
+}
+async function setupGemini() {
+  const homeDir2 = os3.homedir();
+  const settingsPath = path5.join(homeDir2, ".gemini", "settings.json");
+  const settings = readJson(settingsPath) ?? {};
+  const servers = settings.mcpServers ?? {};
+  let anythingChanged = false;
+  if (!settings.hooks) settings.hooks = {};
+  const hasBeforeHook = Array.isArray(settings.hooks.BeforeTool) && settings.hooks.BeforeTool.some(
+    (m) => m.hooks.some((h) => h.command?.includes("node9 check") || h.command?.includes("cli.js check"))
+  );
+  if (!hasBeforeHook) {
+    if (!settings.hooks.BeforeTool) settings.hooks.BeforeTool = [];
+    if (!Array.isArray(settings.hooks.BeforeTool)) settings.hooks.BeforeTool = [];
+    settings.hooks.BeforeTool.push({
+      matcher: ".*",
+      hooks: [
+        {
+          name: "node9-check",
+          type: "command",
+          command: fullPathCommand("check"),
+          timeout: 6e5
+        }
+      ]
+    });
+    console.log(chalk3.green("  \u2705 BeforeTool hook added \u2192 node9 check"));
+    anythingChanged = true;
+  }
+  const hasAfterHook = Array.isArray(settings.hooks.AfterTool) && settings.hooks.AfterTool.some(
+    (m) => m.hooks.some((h) => h.command?.includes("node9 log") || h.command?.includes("cli.js log"))
+  );
+  if (!hasAfterHook) {
+    if (!settings.hooks.AfterTool) settings.hooks.AfterTool = [];
+    if (!Array.isArray(settings.hooks.AfterTool)) settings.hooks.AfterTool = [];
+    settings.hooks.AfterTool.push({
+      matcher: ".*",
+      hooks: [{ name: "node9-log", type: "command", command: fullPathCommand("log") }]
+    });
+    console.log(chalk3.green("  \u2705 AfterTool hook added  \u2192 node9 log"));
+    anythingChanged = true;
+  }
+  if (anythingChanged) {
+    writeJson(settingsPath, settings);
+    console.log("");
+  }
+  const serversToWrap = [];
+  for (const [name, server] of Object.entries(servers)) {
+    if (!server.command || server.command === "node9") continue;
+    const parts = [server.command, ...server.args ?? []];
+    serversToWrap.push({ name, originalCmd: parts.join(" "), parts });
+  }
+  if (serversToWrap.length > 0) {
+    console.log(chalk3.bold("The following existing entries will be modified:\n"));
+    console.log(chalk3.white(`  ${settingsPath}  (mcpServers)`));
+    for (const { name, originalCmd } of serversToWrap) {
+      console.log(chalk3.gray(`    \u2022 ${name}: "${originalCmd}" \u2192 node9 ${originalCmd}`));
+    }
+    console.log("");
+    const proceed = await confirm2({ message: "Wrap these MCP servers?", default: true });
+    if (proceed) {
+      for (const { name, parts } of serversToWrap) {
+        servers[name] = { ...servers[name], command: "node9", args: parts };
       }
+      settings.mcpServers = servers;
+      writeJson(settingsPath, settings);
+      console.log(chalk3.green(`
+  \u2705 ${serversToWrap.length} MCP server(s) wrapped`));
+      anythingChanged = true;
+    } else {
+      console.log(chalk3.yellow("  Skipped MCP server wrapping."));
     }
-    if (req.method === "GET" && pathname === "/audit") {
-      res.writeHead(200, { "Content-Type": "application/json" });
-      return res.end(JSON.stringify(getAuditHistory()));
+    console.log("");
+  }
+  if (!anythingChanged && serversToWrap.length === 0) {
+    console.log(chalk3.blue("\u2139\uFE0F  Node9 is already fully configured for Gemini CLI."));
+    printDaemonTip();
+    return;
+  }
+  if (anythingChanged) {
+    console.log(chalk3.green.bold("\u{1F6E1}\uFE0F  Node9 is now protecting Gemini CLI!"));
+    console.log(chalk3.gray("    Restart Gemini CLI for changes to take effect."));
+    printDaemonTip();
+  }
+}
+async function setupCursor() {
+  const homeDir2 = os3.homedir();
+  const mcpPath = path5.join(homeDir2, ".cursor", "mcp.json");
+  const mcpConfig = readJson(mcpPath) ?? {};
+  const servers = mcpConfig.mcpServers ?? {};
+  let anythingChanged = false;
+  const serversToWrap = [];
+  for (const [name, server] of Object.entries(servers)) {
+    if (!server.command || server.command === "node9") continue;
+    const parts = [server.command, ...server.args ?? []];
+    serversToWrap.push({ name, originalCmd: parts.join(" "), parts });
+  }
+  if (serversToWrap.length > 0) {
+    console.log(chalk3.bold("The following existing entries will be modified:\n"));
+    console.log(chalk3.white(`  ${mcpPath}`));
+    for (const { name, originalCmd } of serversToWrap) {
+      console.log(chalk3.gray(`    \u2022 ${name}: "${originalCmd}" \u2192 node9 ${originalCmd}`));
     }
-    res.writeHead(404).end();
-  });
-  daemonServer = server;
-  server.on("error", (e) => {
-    if (e.code === "EADDRINUSE") {
-      try {
-        if (fs4.existsSync(DAEMON_PID_FILE)) {
-          const { pid } = JSON.parse(fs4.readFileSync(DAEMON_PID_FILE, "utf-8"));
-          process.kill(pid, 0);
-          return process.exit(0);
-        }
-      } catch {
-        try {
-          fs4.unlinkSync(DAEMON_PID_FILE);
-        } catch {
-        }
-        server.listen(DAEMON_PORT2, DAEMON_HOST2);
-        return;
+    console.log("");
+    const proceed = await confirm2({ message: "Wrap these MCP servers?", default: true });
+    if (proceed) {
+      for (const { name, parts } of serversToWrap) {
+        servers[name] = { ...servers[name], command: "node9", args: parts };
       }
+      mcpConfig.mcpServers = servers;
+      writeJson(mcpPath, mcpConfig);
+      console.log(chalk3.green(`
+  \u2705 ${serversToWrap.length} MCP server(s) wrapped`));
+      anythingChanged = true;
+    } else {
+      console.log(chalk3.yellow("  Skipped MCP server wrapping."));
     }
-    console.error(chalk4.red("\n\u{1F6D1} Node9 Daemon Error:"), e.message);
-    process.exit(1);
-  });
-  server.listen(DAEMON_PORT2, DAEMON_HOST2, () => {
-    atomicWriteSync2(
-      DAEMON_PID_FILE,
-      JSON.stringify({ pid: process.pid, port: DAEMON_PORT2, internalToken, autoStarted }),
-      { mode: 384 }
+    console.log("");
+  }
+  console.log(
+    chalk3.yellow(
+      "  \u26A0\uFE0F  Note: Cursor does not yet support native pre-execution hooks.\n     MCP proxy wrapping is the only supported protection mode for Cursor."
+    )
+  );
+  console.log("");
+  if (!anythingChanged && serversToWrap.length === 0) {
+    console.log(
+      chalk3.blue(
+        "\u2139\uFE0F  No MCP servers found to wrap. Add MCP servers to ~/.cursor/mcp.json and re-run."
+      )
     );
-    console.log(chalk4.green(`\u{1F6E1}\uFE0F  Node9 Guard LIVE: http://127.0.0.1:${DAEMON_PORT2}`));
-  });
-}
-function stopDaemon() {
-  if (!fs4.existsSync(DAEMON_PID_FILE)) return console.log(chalk4.yellow("Not running."));
-  try {
-    const { pid } = JSON.parse(fs4.readFileSync(DAEMON_PID_FILE, "utf-8"));
-    process.kill(pid, "SIGTERM");
-    console.log(chalk4.green("\u2705 Stopped."));
-  } catch {
-    console.log(chalk4.gray("Cleaned up stale PID file."));
-  } finally {
-    try {
-      fs4.unlinkSync(DAEMON_PID_FILE);
-    } catch {
-    }
+    printDaemonTip();
+    return;
   }
-}
-function daemonStatus() {
-  if (!fs4.existsSync(DAEMON_PID_FILE))
-    return console.log(chalk4.yellow("Node9 daemon: not running"));
-  try {
-    const { pid } = JSON.parse(fs4.readFileSync(DAEMON_PID_FILE, "utf-8"));
-    process.kill(pid, 0);
-    console.log(chalk4.green("Node9 daemon: running"));
-  } catch {
-    console.log(chalk4.yellow("Node9 daemon: not running (stale PID)"));
+  if (anythingChanged) {
+    console.log(chalk3.green.bold("\u{1F6E1}\uFE0F  Node9 is now protecting Cursor via MCP proxy!"));
+    console.log(chalk3.gray("    Restart Cursor for changes to take effect."));
+    printDaemonTip();
   }
 }
 
 // src/cli.ts
-import { spawn as spawn3, execSync } from "child_process";
+init_daemon();
+import { spawn as spawn4, execSync } from "child_process";
 import { parseCommandString } from "execa";
 import { execa } from "execa";
-import chalk5 from "chalk";
-import readline from "readline";
-import fs6 from "fs";
-import path8 from "path";
-import os6 from "os";
+import chalk6 from "chalk";
+import readline2 from "readline";
+import fs7 from "fs";
+import path9 from "path";
+import os7 from "os";
 
 // src/undo.ts
-import { spawnSync } from "child_process";
+import { spawnSync as spawnSync3 } from "child_process";
 import fs5 from "fs";
 import path7 from "path";
 import os5 from "os";
@@ -4247,12 +5177,12 @@ async function createShadowSnapshot(tool = "unknown", args = {}) {
     if (!fs5.existsSync(path7.join(cwd, ".git"))) return null;
     const tempIndex = path7.join(cwd, ".git", `node9_index_${Date.now()}`);
     const env = { ...process.env, GIT_INDEX_FILE: tempIndex };
-    spawnSync("git", ["add", "-A"], { env });
-    const treeRes = spawnSync("git", ["write-tree"], { env });
+    spawnSync3("git", ["add", "-A"], { env });
+    const treeRes = spawnSync3("git", ["write-tree"], { env });
     const treeHash = treeRes.stdout.toString().trim();
     if (fs5.existsSync(tempIndex)) fs5.unlinkSync(tempIndex);
     if (!treeHash || treeRes.status !== 0) return null;
-    const commitRes = spawnSync("git", [
+    const commitRes = spawnSync3("git", [
       "commit-tree",
       treeHash,
       "-m",
@@ -4283,10 +5213,10 @@ function getSnapshotHistory() {
 }
 function computeUndoDiff(hash, cwd) {
   try {
-    const result = spawnSync("git", ["diff", hash, "--stat", "--", "."], { cwd });
+    const result = spawnSync3("git", ["diff", hash, "--stat", "--", "."], { cwd });
     const stat = result.stdout.toString().trim();
     if (!stat) return null;
-    const diff = spawnSync("git", ["diff", hash, "--", "."], { cwd });
+    const diff = spawnSync3("git", ["diff", hash, "--", "."], { cwd });
     const raw = diff.stdout.toString();
     if (!raw) return null;
     const lines = raw.split("\n").filter(
@@ -4300,14 +5230,14 @@ function computeUndoDiff(hash, cwd) {
 function applyUndo(hash, cwd) {
   try {
     const dir = cwd ?? process.cwd();
-    const restore = spawnSync("git", ["restore", "--source", hash, "--staged", "--worktree", "."], {
+    const restore = spawnSync3("git", ["restore", "--source", hash, "--staged", "--worktree", "."], {
       cwd: dir
     });
     if (restore.status !== 0) return false;
-    const lsTree = spawnSync("git", ["ls-tree", "-r", "--name-only", hash], { cwd: dir });
+    const lsTree = spawnSync3("git", ["ls-tree", "-r", "--name-only", hash], { cwd: dir });
     const snapshotFiles = new Set(lsTree.stdout.toString().trim().split("\n").filter(Boolean));
-    const tracked = spawnSync("git", ["ls-files"], { cwd: dir }).stdout.toString().trim().split("\n").filter(Boolean);
-    const untracked = spawnSync("git", ["ls-files", "--others", "--exclude-standard"], { cwd: dir }).stdout.toString().trim().split("\n").filter(Boolean);
+    const tracked = spawnSync3("git", ["ls-files"], { cwd: dir }).stdout.toString().trim().split("\n").filter(Boolean);
+    const untracked = spawnSync3("git", ["ls-files", "--others", "--exclude-standard"], { cwd: dir }).stdout.toString().trim().split("\n").filter(Boolean);
     for (const file of [...tracked, ...untracked]) {
       const fullPath = path7.join(dir, file);
       if (!snapshotFiles.has(file) && fs5.existsSync(fullPath)) {
@@ -4321,9 +5251,10 @@ function applyUndo(hash, cwd) {
 }
 
 // src/cli.ts
+init_shields();
 import { confirm as confirm3 } from "@inquirer/prompts";
 var { version } = JSON.parse(
-  fs6.readFileSync(path8.join(__dirname, "../package.json"), "utf-8")
+  fs7.readFileSync(path9.join(__dirname, "../package.json"), "utf-8")
 );
 function parseDuration(str) {
   const m = str.trim().match(/^(\d+(?:\.\d+)?)\s*(s|m|h|d)?$/i);
@@ -4419,7 +5350,7 @@ function openBrowserLocal() {
 }
 async function autoStartDaemonAndWait() {
   try {
-    const child = spawn3("node9", ["daemon"], {
+    const child = spawn4("node9", ["daemon"], {
       detached: true,
       stdio: "ignore",
       env: { ...process.env, NODE9_AUTO_STARTED: "1" }
@@ -4455,14 +5386,14 @@ async function runProxy(targetCommand) {
     if (stdout) executable = stdout.trim();
   } catch {
   }
-  console.log(chalk5.green(`\u{1F680} Node9 Proxy Active: Monitoring [${targetCommand}]`));
-  const child = spawn3(executable, args, {
+  console.log(chalk6.green(`\u{1F680} Node9 Proxy Active: Monitoring [${targetCommand}]`));
+  const child = spawn4(executable, args, {
     stdio: ["pipe", "pipe", "inherit"],
     // We control STDIN and STDOUT
     shell: false,
     env: { ...process.env, FORCE_COLOR: "1" }
   });
-  const agentIn = readline.createInterface({ input: process.stdin, terminal: false });
+  const agentIn = readline2.createInterface({ input: process.stdin, terminal: false });
   agentIn.on("line", async (line) => {
     let message;
     try {
@@ -4480,10 +5411,10 @@ async function runProxy(targetCommand) {
           agent: "Proxy/MCP"
         });
         if (!result.approved) {
-          console.error(chalk5.red(`
+          console.error(chalk6.red(`
 \u{1F6D1} Node9 Sudo: Action Blocked`));
-          console.error(chalk5.gray(`   Tool: ${name}`));
-          console.error(chalk5.gray(`   Reason: ${result.reason || "Security Policy"}
+          console.error(chalk6.gray(`   Tool: ${name}`));
+          console.error(chalk6.gray(`   Reason: ${result.reason || "Security Policy"}
 `));
           const blockedByLabel = result.blockedByLabel ?? result.reason ?? "Security Policy";
           const isHuman = blockedByLabel.toLowerCase().includes("user") || blockedByLabel.toLowerCase().includes("daemon") || blockedByLabel.toLowerCase().includes("decision");
@@ -4525,14 +5456,14 @@ async function runProxy(targetCommand) {
 }
 program.command("login").argument("<apiKey>").option("--local", "Save key for audit/logging only \u2014 local config still controls all decisions").option("--profile <name>", 'Save as a named profile (default: "default")').action((apiKey, options) => {
   const DEFAULT_API_URL = "https://api.node9.ai/api/v1/intercept";
-  const credPath = path8.join(os6.homedir(), ".node9", "credentials.json");
-  if (!fs6.existsSync(path8.dirname(credPath)))
-    fs6.mkdirSync(path8.dirname(credPath), { recursive: true });
+  const credPath = path9.join(os7.homedir(), ".node9", "credentials.json");
+  if (!fs7.existsSync(path9.dirname(credPath)))
+    fs7.mkdirSync(path9.dirname(credPath), { recursive: true });
   const profileName = options.profile || "default";
   let existingCreds = {};
   try {
-    if (fs6.existsSync(credPath)) {
-      const raw = JSON.parse(fs6.readFileSync(credPath, "utf-8"));
+    if (fs7.existsSync(credPath)) {
+      const raw = JSON.parse(fs7.readFileSync(credPath, "utf-8"));
       if (raw.apiKey) {
         existingCreds = {
           default: { apiKey: raw.apiKey, apiUrl: raw.apiUrl || DEFAULT_API_URL }
@@ -4544,13 +5475,13 @@ program.command("login").argument("<apiKey>").option("--local", "Save key for au
   } catch {
   }
   existingCreds[profileName] = { apiKey, apiUrl: DEFAULT_API_URL };
-  fs6.writeFileSync(credPath, JSON.stringify(existingCreds, null, 2), { mode: 384 });
+  fs7.writeFileSync(credPath, JSON.stringify(existingCreds, null, 2), { mode: 384 });
   if (profileName === "default") {
-    const configPath = path8.join(os6.homedir(), ".node9", "config.json");
+    const configPath = path9.join(os7.homedir(), ".node9", "config.json");
     let config = {};
     try {
-      if (fs6.existsSync(configPath))
-        config = JSON.parse(fs6.readFileSync(configPath, "utf-8"));
+      if (fs7.existsSync(configPath))
+        config = JSON.parse(fs7.readFileSync(configPath, "utf-8"));
     } catch {
     }
     if (!config.settings || typeof config.settings !== "object") config.settings = {};
@@ -4565,36 +5496,36 @@ program.command("login").argument("<apiKey>").option("--local", "Save key for au
       approvers.cloud = false;
     }
     s.approvers = approvers;
-    if (!fs6.existsSync(path8.dirname(configPath)))
-      fs6.mkdirSync(path8.dirname(configPath), { recursive: true });
-    fs6.writeFileSync(configPath, JSON.stringify(config, null, 2), { mode: 384 });
+    if (!fs7.existsSync(path9.dirname(configPath)))
+      fs7.mkdirSync(path9.dirname(configPath), { recursive: true });
+    fs7.writeFileSync(configPath, JSON.stringify(config, null, 2), { mode: 384 });
   }
   if (options.profile && profileName !== "default") {
-    console.log(chalk5.green(`\u2705 Profile "${profileName}" saved`));
-    console.log(chalk5.gray(`   Switch to it per-session:  NODE9_PROFILE=${profileName} claude`));
+    console.log(chalk6.green(`\u2705 Profile "${profileName}" saved`));
+    console.log(chalk6.gray(`   Switch to it per-session:  NODE9_PROFILE=${profileName} claude`));
   } else if (options.local) {
-    console.log(chalk5.green(`\u2705 Privacy mode \u{1F6E1}\uFE0F`));
-    console.log(chalk5.gray(`   All decisions stay on this machine.`));
+    console.log(chalk6.green(`\u2705 Privacy mode \u{1F6E1}\uFE0F`));
+    console.log(chalk6.gray(`   All decisions stay on this machine.`));
   } else {
-    console.log(chalk5.green(`\u2705 Logged in \u2014 agent mode`));
-    console.log(chalk5.gray(`   Team policy enforced for all calls via Node9 cloud.`));
+    console.log(chalk6.green(`\u2705 Logged in \u2014 agent mode`));
+    console.log(chalk6.gray(`   Team policy enforced for all calls via Node9 cloud.`));
   }
 });
 program.command("addto").description("Integrate Node9 with an AI agent").addHelpText("after", "\n  Supported targets:  claude  gemini  cursor").argument("<target>", "The agent to protect: claude | gemini | cursor").action(async (target) => {
   if (target === "gemini") return await setupGemini();
   if (target === "claude") return await setupClaude();
   if (target === "cursor") return await setupCursor();
-  console.error(chalk5.red(`Unknown target: "${target}". Supported: claude, gemini, cursor`));
+  console.error(chalk6.red(`Unknown target: "${target}". Supported: claude, gemini, cursor`));
   process.exit(1);
 });
 program.command("setup").description('Alias for "addto" \u2014 integrate Node9 with an AI agent').addHelpText("after", "\n  Supported targets:  claude  gemini  cursor").argument("[target]", "The agent to protect: claude | gemini | cursor").action(async (target) => {
   if (!target) {
-    console.log(chalk5.cyan("\n\u{1F6E1}\uFE0F  Node9 Setup \u2014 integrate with your AI agent\n"));
-    console.log("  Usage:  " + chalk5.white("node9 setup <target>") + "\n");
+    console.log(chalk6.cyan("\n\u{1F6E1}\uFE0F  Node9 Setup \u2014 integrate with your AI agent\n"));
+    console.log("  Usage:  " + chalk6.white("node9 setup <target>") + "\n");
     console.log("  Targets:");
-    console.log("    " + chalk5.green("claude") + "   \u2014 Claude Code (hook mode)");
-    console.log("    " + chalk5.green("gemini") + "   \u2014 Gemini CLI (hook mode)");
-    console.log("    " + chalk5.green("cursor") + "   \u2014 Cursor (hook mode)");
+    console.log("    " + chalk6.green("claude") + "   \u2014 Claude Code (hook mode)");
+    console.log("    " + chalk6.green("gemini") + "   \u2014 Gemini CLI (hook mode)");
+    console.log("    " + chalk6.green("cursor") + "   \u2014 Cursor (hook mode)");
     console.log("");
     return;
   }
@@ -4602,28 +5533,28 @@ program.command("setup").description('Alias for "addto" \u2014 integrate Node9 w
   if (t === "gemini") return await setupGemini();
   if (t === "claude") return await setupClaude();
   if (t === "cursor") return await setupCursor();
-  console.error(chalk5.red(`Unknown target: "${target}". Supported: claude, gemini, cursor`));
+  console.error(chalk6.red(`Unknown target: "${target}". Supported: claude, gemini, cursor`));
   process.exit(1);
 });
 program.command("doctor").description("Check that Node9 is installed and configured correctly").action(() => {
-  const homeDir2 = os6.homedir();
+  const homeDir2 = os7.homedir();
   let failures = 0;
   function pass(msg) {
-    console.log(chalk5.green("  \u2705 ") + msg);
+    console.log(chalk6.green("  \u2705 ") + msg);
   }
   function fail(msg, hint) {
-    console.log(chalk5.red("  \u274C ") + msg);
-    if (hint) console.log(chalk5.gray("       " + hint));
+    console.log(chalk6.red("  \u274C ") + msg);
+    if (hint) console.log(chalk6.gray("       " + hint));
     failures++;
   }
   function warn(msg, hint) {
-    console.log(chalk5.yellow("  \u26A0\uFE0F  ") + msg);
-    if (hint) console.log(chalk5.gray("       " + hint));
+    console.log(chalk6.yellow("  \u26A0\uFE0F  ") + msg);
+    if (hint) console.log(chalk6.gray("       " + hint));
   }
   function section(title) {
-    console.log("\n" + chalk5.bold(title));
+    console.log("\n" + chalk6.bold(title));
   }
-  console.log(chalk5.cyan.bold(`
+  console.log(chalk6.cyan.bold(`
 \u{1F6E1}\uFE0F  Node9 Doctor  v${version}
 `));
   section("Binary");
@@ -4652,10 +5583,10 @@ program.command("doctor").description("Check that Node9 is installed and configu
     );
   }
   section("Configuration");
-  const globalConfigPath = path8.join(homeDir2, ".node9", "config.json");
-  if (fs6.existsSync(globalConfigPath)) {
+  const globalConfigPath = path9.join(homeDir2, ".node9", "config.json");
+  if (fs7.existsSync(globalConfigPath)) {
     try {
-      JSON.parse(fs6.readFileSync(globalConfigPath, "utf-8"));
+      JSON.parse(fs7.readFileSync(globalConfigPath, "utf-8"));
       pass("~/.node9/config.json found and valid");
     } catch {
       fail("~/.node9/config.json is invalid JSON", "Run: node9 init --force");
@@ -4663,17 +5594,17 @@ program.command("doctor").description("Check that Node9 is installed and configu
   } else {
     warn("~/.node9/config.json not found (using defaults)", "Run: node9 init");
   }
-  const projectConfigPath = path8.join(process.cwd(), "node9.config.json");
-  if (fs6.existsSync(projectConfigPath)) {
+  const projectConfigPath = path9.join(process.cwd(), "node9.config.json");
+  if (fs7.existsSync(projectConfigPath)) {
     try {
-      JSON.parse(fs6.readFileSync(projectConfigPath, "utf-8"));
+      JSON.parse(fs7.readFileSync(projectConfigPath, "utf-8"));
       pass("node9.config.json found and valid (project)");
     } catch {
       fail("node9.config.json is invalid JSON", "Fix the JSON or delete it and run: node9 init");
     }
   }
-  const credsPath = path8.join(homeDir2, ".node9", "credentials.json");
-  if (fs6.existsSync(credsPath)) {
+  const credsPath = path9.join(homeDir2, ".node9", "credentials.json");
+  if (fs7.existsSync(credsPath)) {
     pass("Cloud credentials found (~/.node9/credentials.json)");
   } else {
     warn(
@@ -4682,10 +5613,10 @@ program.command("doctor").description("Check that Node9 is installed and configu
     );
   }
   section("Agent Hooks");
-  const claudeSettingsPath = path8.join(homeDir2, ".claude", "settings.json");
-  if (fs6.existsSync(claudeSettingsPath)) {
+  const claudeSettingsPath = path9.join(homeDir2, ".claude", "settings.json");
+  if (fs7.existsSync(claudeSettingsPath)) {
     try {
-      const cs = JSON.parse(fs6.readFileSync(claudeSettingsPath, "utf-8"));
+      const cs = JSON.parse(fs7.readFileSync(claudeSettingsPath, "utf-8"));
       const hasHook = cs.hooks?.PreToolUse?.some(
         (m) => m.hooks.some((h) => h.command?.includes("node9") || h.command?.includes("cli.js"))
       );
@@ -4698,10 +5629,10 @@ program.command("doctor").description("Check that Node9 is installed and configu
   } else {
     warn("Claude Code \u2014 not configured", "Run: node9 setup claude");
   }
-  const geminiSettingsPath = path8.join(homeDir2, ".gemini", "settings.json");
-  if (fs6.existsSync(geminiSettingsPath)) {
+  const geminiSettingsPath = path9.join(homeDir2, ".gemini", "settings.json");
+  if (fs7.existsSync(geminiSettingsPath)) {
     try {
-      const gs = JSON.parse(fs6.readFileSync(geminiSettingsPath, "utf-8"));
+      const gs = JSON.parse(fs7.readFileSync(geminiSettingsPath, "utf-8"));
       const hasHook = gs.hooks?.BeforeTool?.some(
         (m) => m.hooks.some((h) => h.command?.includes("node9") || h.command?.includes("cli.js"))
       );
@@ -4714,10 +5645,10 @@ program.command("doctor").description("Check that Node9 is installed and configu
   } else {
     warn("Gemini CLI  \u2014 not configured", "Run: node9 setup gemini  (skip if not using Gemini)");
   }
-  const cursorHooksPath = path8.join(homeDir2, ".cursor", "hooks.json");
-  if (fs6.existsSync(cursorHooksPath)) {
+  const cursorHooksPath = path9.join(homeDir2, ".cursor", "hooks.json");
+  if (fs7.existsSync(cursorHooksPath)) {
     try {
-      const cur = JSON.parse(fs6.readFileSync(cursorHooksPath, "utf-8"));
+      const cur = JSON.parse(fs7.readFileSync(cursorHooksPath, "utf-8"));
       const hasHook = cur.hooks?.preToolUse?.some(
         (h) => h.command?.includes("node9") || h.command?.includes("cli.js")
       );
@@ -4738,9 +5669,9 @@ program.command("doctor").description("Check that Node9 is installed and configu
   }
   console.log("");
   if (failures === 0) {
-    console.log(chalk5.green.bold("  All checks passed. Node9 is ready.\n"));
+    console.log(chalk6.green.bold("  All checks passed. Node9 is ready.\n"));
   } else {
-    console.log(chalk5.red.bold(`  ${failures} check(s) failed. See hints above.
+    console.log(chalk6.red.bold(`  ${failures} check(s) failed. See hints above.
 `));
     process.exit(1);
   }
@@ -4755,7 +5686,7 @@ program.command("explain").description(
       try {
         args = JSON.parse(trimmed);
       } catch {
-        console.error(chalk5.red(`
+        console.error(chalk6.red(`
 \u274C Invalid JSON: ${trimmed}
 `));
         process.exit(1);
@@ -4766,63 +5697,63 @@ program.command("explain").description(
   }
   const result = await explainPolicy(tool, args);
   console.log("");
-  console.log(chalk5.cyan.bold("\u{1F6E1}\uFE0F  Node9 Explain"));
+  console.log(chalk6.cyan.bold("\u{1F6E1}\uFE0F  Node9 Explain"));
   console.log("");
-  console.log(`   ${chalk5.bold("Tool:")}    ${chalk5.white(result.tool)}`);
+  console.log(`   ${chalk6.bold("Tool:")}    ${chalk6.white(result.tool)}`);
   if (argsRaw) {
     const preview = argsRaw.length > 80 ? argsRaw.slice(0, 77) + "\u2026" : argsRaw;
-    console.log(`   ${chalk5.bold("Input:")}   ${chalk5.gray(preview)}`);
+    console.log(`   ${chalk6.bold("Input:")}   ${chalk6.gray(preview)}`);
   }
   console.log("");
-  console.log(chalk5.bold("Config Sources (Waterfall):"));
+  console.log(chalk6.bold("Config Sources (Waterfall):"));
   for (const tier of result.waterfall) {
-    const num = chalk5.gray(`  ${tier.tier}.`);
+    const num = chalk6.gray(`  ${tier.tier}.`);
     const label = tier.label.padEnd(16);
     let statusStr;
     if (tier.tier === 1) {
-      statusStr = chalk5.gray(tier.note ?? "");
+      statusStr = chalk6.gray(tier.note ?? "");
     } else if (tier.status === "active") {
-      const loc = tier.path ? chalk5.gray(tier.path) : "";
-      const note = tier.note ? chalk5.gray(`(${tier.note})`) : "";
-      statusStr = chalk5.green("\u2713 active") + (loc ? "  " + loc : "") + (note ? "  " + note : "");
+      const loc = tier.path ? chalk6.gray(tier.path) : "";
+      const note = tier.note ? chalk6.gray(`(${tier.note})`) : "";
+      statusStr = chalk6.green("\u2713 active") + (loc ? "  " + loc : "") + (note ? "  " + note : "");
     } else {
-      statusStr = chalk5.gray("\u25CB " + (tier.note ?? "not found"));
+      statusStr = chalk6.gray("\u25CB " + (tier.note ?? "not found"));
     }
-    console.log(`${num} ${chalk5.white(label)} ${statusStr}`);
+    console.log(`${num} ${chalk6.white(label)} ${statusStr}`);
   }
   console.log("");
-  console.log(chalk5.bold("Policy Evaluation:"));
+  console.log(chalk6.bold("Policy Evaluation:"));
   for (const step of result.steps) {
     const isFinal = step.isFinal;
     let icon;
-    if (step.outcome === "allow") icon = chalk5.green("  \u2705");
-    else if (step.outcome === "review") icon = chalk5.red("  \u{1F534}");
-    else if (step.outcome === "skip") icon = chalk5.gray("  \u2500 ");
-    else icon = chalk5.gray("  \u25CB ");
+    if (step.outcome === "allow") icon = chalk6.green("  \u2705");
+    else if (step.outcome === "review") icon = chalk6.red("  \u{1F534}");
+    else if (step.outcome === "skip") icon = chalk6.gray("  \u2500 ");
+    else icon = chalk6.gray("  \u25CB ");
     const name = step.name.padEnd(18);
-    const nameStr = isFinal ? chalk5.white.bold(name) : chalk5.white(name);
-    const detail = isFinal ? chalk5.white(step.detail) : chalk5.gray(step.detail);
-    const arrow = isFinal ? chalk5.yellow("  \u2190 STOP") : "";
+    const nameStr = isFinal ? chalk6.white.bold(name) : chalk6.white(name);
+    const detail = isFinal ? chalk6.white(step.detail) : chalk6.gray(step.detail);
+    const arrow = isFinal ? chalk6.yellow("  \u2190 STOP") : "";
     console.log(`${icon} ${nameStr} ${detail}${arrow}`);
   }
   console.log("");
   if (result.decision === "allow") {
-    console.log(chalk5.green.bold("  Decision: \u2705 ALLOW") + chalk5.gray("  \u2014 no approval needed"));
+    console.log(chalk6.green.bold("  Decision: \u2705 ALLOW") + chalk6.gray("  \u2014 no approval needed"));
   } else {
     console.log(
-      chalk5.red.bold("  Decision: \u{1F534} REVIEW") + chalk5.gray("  \u2014 human approval required")
+      chalk6.red.bold("  Decision: \u{1F534} REVIEW") + chalk6.gray("  \u2014 human approval required")
     );
     if (result.blockedByLabel) {
-      console.log(chalk5.gray(`  Reason:   ${result.blockedByLabel}`));
+      console.log(chalk6.gray(`  Reason:   ${result.blockedByLabel}`));
     }
   }
   console.log("");
 });
 program.command("init").description("Create ~/.node9/config.json with default policy (safe to run multiple times)").option("--force", "Overwrite existing config").option("-m, --mode <mode>", "Set initial security mode (standard, strict, audit)", "standard").action((options) => {
-  const configPath = path8.join(os6.homedir(), ".node9", "config.json");
-  if (fs6.existsSync(configPath) && !options.force) {
-    console.log(chalk5.yellow(`\u2139\uFE0F  Global config already exists: ${configPath}`));
-    console.log(chalk5.gray(`   Run with --force to overwrite.`));
+  const configPath = path9.join(os7.homedir(), ".node9", "config.json");
+  if (fs7.existsSync(configPath) && !options.force) {
+    console.log(chalk6.yellow(`\u2139\uFE0F  Global config already exists: ${configPath}`));
+    console.log(chalk6.gray(`   Run with --force to overwrite.`));
     return;
   }
   const requestedMode = options.mode.toLowerCase();
@@ -4834,13 +5765,13 @@ program.command("init").description("Create ~/.node9/config.json with default po
       mode: safeMode
     }
   };
-  const dir = path8.dirname(configPath);
-  if (!fs6.existsSync(dir)) fs6.mkdirSync(dir, { recursive: true });
-  fs6.writeFileSync(configPath, JSON.stringify(configToSave, null, 2));
-  console.log(chalk5.green(`\u2705 Global config created: ${configPath}`));
-  console.log(chalk5.cyan(`   Mode set to: ${safeMode}`));
+  const dir = path9.dirname(configPath);
+  if (!fs7.existsSync(dir)) fs7.mkdirSync(dir, { recursive: true });
+  fs7.writeFileSync(configPath, JSON.stringify(configToSave, null, 2));
+  console.log(chalk6.green(`\u2705 Global config created: ${configPath}`));
+  console.log(chalk6.cyan(`   Mode set to: ${safeMode}`));
   console.log(
-    chalk5.gray(`   Undo Engine is ENABLED by default. Use 'node9 undo' to revert AI changes.`)
+    chalk6.gray(`   Undo Engine is ENABLED by default. Use 'node9 undo' to revert AI changes.`)
   );
 });
 function formatRelativeTime(timestamp) {
@@ -4854,14 +5785,14 @@ function formatRelativeTime(timestamp) {
   return new Date(timestamp).toLocaleDateString();
 }
 program.command("audit").description("View local execution audit log").option("--tail <n>", "Number of entries to show", "20").option("--tool <pattern>", "Filter by tool name (substring match)").option("--deny", "Show only denied actions").option("--json", "Output raw JSON").action((options) => {
-  const logPath = path8.join(os6.homedir(), ".node9", "audit.log");
-  if (!fs6.existsSync(logPath)) {
+  const logPath = path9.join(os7.homedir(), ".node9", "audit.log");
+  if (!fs7.existsSync(logPath)) {
     console.log(
-      chalk5.yellow("No audit logs found. Run node9 with an agent to generate entries.")
+      chalk6.yellow("No audit logs found. Run node9 with an agent to generate entries.")
     );
     return;
   }
-  const raw = fs6.readFileSync(logPath, "utf-8");
+  const raw = fs7.readFileSync(logPath, "utf-8");
   const lines = raw.split("\n").filter((l) => l.trim() !== "");
   let entries = lines.flatMap((line) => {
     try {
@@ -4883,31 +5814,31 @@ program.command("audit").description("View local execution audit log").option("-
     return;
   }
   if (entries.length === 0) {
-    console.log(chalk5.yellow("No matching audit entries."));
+    console.log(chalk6.yellow("No matching audit entries."));
     return;
   }
   console.log(
     `
-  ${chalk5.bold("Node9 Audit Log")}  ${chalk5.dim(`(${entries.length} entries)`)}`
+  ${chalk6.bold("Node9 Audit Log")}  ${chalk6.dim(`(${entries.length} entries)`)}`
   );
-  console.log(chalk5.dim("  " + "\u2500".repeat(65)));
+  console.log(chalk6.dim("  " + "\u2500".repeat(65)));
   console.log(
     `  ${"Time".padEnd(12)} ${"Tool".padEnd(18)} ${"Result".padEnd(10)} ${"By".padEnd(15)} Agent`
   );
-  console.log(chalk5.dim("  " + "\u2500".repeat(65)));
+  console.log(chalk6.dim("  " + "\u2500".repeat(65)));
   for (const e of entries) {
     const time = formatRelativeTime(String(e.ts)).padEnd(12);
     const tool = String(e.tool).slice(0, 17).padEnd(18);
-    const result = e.decision === "allow" ? chalk5.green("ALLOW".padEnd(10)) : chalk5.red("DENY".padEnd(10));
+    const result = e.decision === "allow" ? chalk6.green("ALLOW".padEnd(10)) : chalk6.red("DENY".padEnd(10));
     const checker = String(e.checkedBy || "unknown").slice(0, 14).padEnd(15);
     const agent = String(e.agent || "unknown");
     console.log(`  ${time} ${tool} ${result} ${checker} ${agent}`);
   }
   const allowed = entries.filter((e) => e.decision === "allow").length;
   const denied = entries.filter((e) => e.decision === "deny").length;
-  console.log(chalk5.dim("  " + "\u2500".repeat(65)));
+  console.log(chalk6.dim("  " + "\u2500".repeat(65)));
   console.log(
-    `  ${entries.length} entries  |  ${chalk5.green(allowed + " allowed")}  |  ${chalk5.red(denied + " denied")}
+    `  ${entries.length} entries  |  ${chalk6.green(allowed + " allowed")}  |  ${chalk6.red(denied + " denied")}
 `
   );
 });
@@ -4918,43 +5849,43 @@ program.command("status").description("Show current Node9 mode, policy source, a
   const settings = mergedConfig.settings;
   console.log("");
   if (creds && settings.approvers.cloud) {
-    console.log(chalk5.green("  \u25CF Agent mode") + chalk5.gray(" \u2014 cloud team policy enforced"));
+    console.log(chalk6.green("  \u25CF Agent mode") + chalk6.gray(" \u2014 cloud team policy enforced"));
   } else if (creds && !settings.approvers.cloud) {
     console.log(
-      chalk5.blue("  \u25CF Privacy mode \u{1F6E1}\uFE0F") + chalk5.gray(" \u2014 all decisions stay on this machine")
+      chalk6.blue("  \u25CF Privacy mode \u{1F6E1}\uFE0F") + chalk6.gray(" \u2014 all decisions stay on this machine")
     );
   } else {
     console.log(
-      chalk5.yellow("  \u25CB Privacy mode \u{1F6E1}\uFE0F") + chalk5.gray(" \u2014 no API key (Local rules only)")
+      chalk6.yellow("  \u25CB Privacy mode \u{1F6E1}\uFE0F") + chalk6.gray(" \u2014 no API key (Local rules only)")
     );
   }
   console.log("");
   if (daemonRunning) {
     console.log(
-      chalk5.green("  \u25CF Daemon running") + chalk5.gray(` \u2192 http://127.0.0.1:${DAEMON_PORT2}/`)
+      chalk6.green("  \u25CF Daemon running") + chalk6.gray(` \u2192 http://127.0.0.1:${DAEMON_PORT2}/`)
     );
   } else {
-    console.log(chalk5.gray("  \u25CB Daemon stopped"));
+    console.log(chalk6.gray("  \u25CB Daemon stopped"));
   }
   if (settings.enableUndo) {
     console.log(
-      chalk5.magenta("  \u25CF Undo Engine") + chalk5.gray(`    \u2192 Auto-snapshotting Git repos on AI change`)
+      chalk6.magenta("  \u25CF Undo Engine") + chalk6.gray(`    \u2192 Auto-snapshotting Git repos on AI change`)
     );
   }
   console.log("");
-  const modeLabel = settings.mode === "audit" ? chalk5.blue("audit") : settings.mode === "strict" ? chalk5.red("strict") : chalk5.white("standard");
+  const modeLabel = settings.mode === "audit" ? chalk6.blue("audit") : settings.mode === "strict" ? chalk6.red("strict") : chalk6.white("standard");
   console.log(`  Mode:    ${modeLabel}`);
-  const projectConfig = path8.join(process.cwd(), "node9.config.json");
-  const globalConfig = path8.join(os6.homedir(), ".node9", "config.json");
+  const projectConfig = path9.join(process.cwd(), "node9.config.json");
+  const globalConfig = path9.join(os7.homedir(), ".node9", "config.json");
   console.log(
-    `  Local:   ${fs6.existsSync(projectConfig) ? chalk5.green("Active (node9.config.json)") : chalk5.gray("Not present")}`
+    `  Local:   ${fs7.existsSync(projectConfig) ? chalk6.green("Active (node9.config.json)") : chalk6.gray("Not present")}`
   );
   console.log(
-    `  Global:  ${fs6.existsSync(globalConfig) ? chalk5.green("Active (~/.node9/config.json)") : chalk5.gray("Not present")}`
+    `  Global:  ${fs7.existsSync(globalConfig) ? chalk6.green("Active (~/.node9/config.json)") : chalk6.gray("Not present")}`
   );
   if (mergedConfig.policy.sandboxPaths.length > 0) {
     console.log(
-      `  Sandbox: ${chalk5.green(`${mergedConfig.policy.sandboxPaths.length} safe zones active`)}`
+      `  Sandbox: ${chalk6.green(`${mergedConfig.policy.sandboxPaths.length} safe zones active`)}`
     );
   }
   const pauseState = checkPause();
@@ -4962,47 +5893,63 @@ program.command("status").description("Show current Node9 mode, policy source, a
     const expiresAt = pauseState.expiresAt ? new Date(pauseState.expiresAt).toLocaleTimeString() : "indefinitely";
     console.log("");
     console.log(
-      chalk5.yellow(`  \u23F8  PAUSED until ${expiresAt}`) + chalk5.gray(" \u2014 all tool calls allowed")
+      chalk6.yellow(`  \u23F8  PAUSED until ${expiresAt}`) + chalk6.gray(" \u2014 all tool calls allowed")
     );
   }
   console.log("");
 });
-program.command("daemon").description("Run the local approval server").argument("[action]", "start | stop | status (default: start)").option("-b, --background", "Start the daemon in the background (detached)").option("-o, --openui", "Start in background and open browser").action(
+program.command("daemon").description("Run the local approval server").argument("[action]", "start | stop | status (default: start)").option("-b, --background", "Start the daemon in the background (detached)").option("-o, --openui", "Start in background and open browser").option(
+  "-w, --watch",
+  "Start daemon + open browser, stay alive permanently (Flight Recorder mode)"
+).action(
   async (action, options) => {
     const cmd = (action ?? "start").toLowerCase();
     if (cmd === "stop") return stopDaemon();
     if (cmd === "status") return daemonStatus();
     if (cmd !== "start" && action !== void 0) {
-      console.error(chalk5.red(`Unknown daemon action: "${action}". Use: start | stop | status`));
+      console.error(chalk6.red(`Unknown daemon action: "${action}". Use: start | stop | status`));
       process.exit(1);
     }
+    if (options.watch) {
+      process.env.NODE9_WATCH_MODE = "1";
+      setTimeout(() => {
+        openBrowserLocal();
+        console.log(chalk6.cyan(`\u{1F6F0}\uFE0F  Flight Recorder: http://${DAEMON_HOST2}:${DAEMON_PORT2}/`));
+      }, 600);
+      startDaemon();
+      return;
+    }
     if (options.openui) {
       if (isDaemonRunning()) {
         openBrowserLocal();
-        console.log(chalk5.green(`\u{1F310}  Opened browser: http://${DAEMON_HOST2}:${DAEMON_PORT2}/`));
+        console.log(chalk6.green(`\u{1F310}  Opened browser: http://${DAEMON_HOST2}:${DAEMON_PORT2}/`));
         process.exit(0);
       }
-      const child = spawn3("node9", ["daemon"], { detached: true, stdio: "ignore" });
+      const child = spawn4("node9", ["daemon"], { detached: true, stdio: "ignore" });
       child.unref();
       for (let i = 0; i < 12; i++) {
         await new Promise((r) => setTimeout(r, 250));
         if (isDaemonRunning()) break;
       }
       openBrowserLocal();
-      console.log(chalk5.green(`
+      console.log(chalk6.green(`
 \u{1F6E1}\uFE0F  Node9 daemon started + browser opened`));
       process.exit(0);
     }
     if (options.background) {
-      const child = spawn3("node9", ["daemon"], { detached: true, stdio: "ignore" });
+      const child = spawn4("node9", ["daemon"], { detached: true, stdio: "ignore" });
       child.unref();
-      console.log(chalk5.green(`
+      console.log(chalk6.green(`
 \u{1F6E1}\uFE0F  Node9 daemon started in background  (PID ${child.pid})`));
       process.exit(0);
     }
     startDaemon();
   }
 );
+program.command("tail").description("Stream live agent activity to the terminal").option("--history", "Include recent history on connect", false).option("--clear", "Clear history buffer and stream live events fresh", false).action(async (options) => {
+  const { startTail: startTail2 } = await Promise.resolve().then(() => (init_tail(), tail_exports));
+  await startTail2(options);
+});
 program.command("check").description("Hook handler \u2014 evaluates a tool call before execution").argument("[data]", "JSON string of the tool call").action(async (data) => {
   const processPayload = async (raw) => {
     try {
@@ -5013,9 +5960,9 @@ program.command("check").description("Hook handler \u2014 evaluates a tool call
       } catch (err) {
         const tempConfig = getConfig();
         if (process.env.NODE9_DEBUG === "1" || tempConfig.settings.enableHookLogDebug) {
-          const logPath = path8.join(os6.homedir(), ".node9", "hook-debug.log");
+          const logPath = path9.join(os7.homedir(), ".node9", "hook-debug.log");
           const errMsg = err instanceof Error ? err.message : String(err);
-          fs6.appendFileSync(
+          fs7.appendFileSync(
             logPath,
             `[${(/* @__PURE__ */ new Date()).toISOString()}] JSON_PARSE_ERROR: ${errMsg}
 RAW: ${raw}
@@ -5033,10 +5980,10 @@ RAW: ${raw}
       }
       const config = getConfig();
       if (process.env.NODE9_DEBUG === "1" || config.settings.enableHookLogDebug) {
-        const logPath = path8.join(os6.homedir(), ".node9", "hook-debug.log");
-        if (!fs6.existsSync(path8.dirname(logPath)))
-          fs6.mkdirSync(path8.dirname(logPath), { recursive: true });
-        fs6.appendFileSync(logPath, `[${(/* @__PURE__ */ new Date()).toISOString()}] STDIN: ${raw}
+        const logPath = path9.join(os7.homedir(), ".node9", "hook-debug.log");
+        if (!fs7.existsSync(path9.dirname(logPath)))
+          fs7.mkdirSync(path9.dirname(logPath), { recursive: true });
+        fs7.appendFileSync(logPath, `[${(/* @__PURE__ */ new Date()).toISOString()}] STDIN: ${raw}
 `);
       }
       const toolName = sanitize(payload.tool_name ?? payload.name ?? "");
@@ -5048,18 +5995,18 @@ RAW: ${raw}
         const blockedByContext = result2?.blockedByLabel || result2?.blockedBy || "Local Security Policy";
         const isHumanDecision = blockedByContext.toLowerCase().includes("user") || blockedByContext.toLowerCase().includes("daemon") || blockedByContext.toLowerCase().includes("decision");
         if (blockedByContext.includes("DLP") || blockedByContext.includes("Secret Detected") || blockedByContext.includes("Credential Review")) {
-          console.error(chalk5.bgRed.white.bold(`
+          console.error(chalk6.bgRed.white.bold(`
  \u{1F6A8} NODE9 DLP ALERT \u2014 CREDENTIAL DETECTED `));
-          console.error(chalk5.red.bold(`   A sensitive secret was found in the tool arguments!`));
+          console.error(chalk6.red.bold(`   A sensitive secret was found in the tool arguments!`));
         } else {
-          console.error(chalk5.red(`
+          console.error(chalk6.red(`
 \u{1F6D1} Node9 blocked "${toolName}"`));
         }
-        console.error(chalk5.gray(`   Triggered by: ${blockedByContext}`));
-        if (result2?.changeHint) console.error(chalk5.cyan(`   To change:  ${result2.changeHint}`));
+        console.error(chalk6.gray(`   Triggered by: ${blockedByContext}`));
+        if (result2?.changeHint) console.error(chalk6.cyan(`   To change:  ${result2.changeHint}`));
         console.error("");
         const aiFeedbackMessage = buildNegotiationMessage(blockedByContext, isHumanDecision, msg);
-        console.error(chalk5.dim(`   (Detailed instructions sent to AI agent)`));
+        console.error(chalk6.dim(`   (Detailed instructions sent to AI agent)`));
         process.stdout.write(
           JSON.stringify({
             decision: "block",
@@ -5090,7 +6037,7 @@ RAW: ${raw}
         process.exit(0);
       }
       if (result.noApprovalMechanism && !isDaemonRunning() && !process.env.NODE9_NO_AUTO_DAEMON && !process.stdout.isTTY && config.settings.autoStartDaemon) {
-        console.error(chalk5.cyan("\n\u{1F6E1}\uFE0F  Node9: Starting approval daemon automatically..."));
+        console.error(chalk6.cyan("\n\u{1F6E1}\uFE0F  Node9: Starting approval daemon automatically..."));
         const daemonReady = await autoStartDaemonAndWait();
         if (daemonReady) {
           const retry = await authorizeHeadless(toolName, toolInput, false, meta);
@@ -5113,9 +6060,9 @@ RAW: ${raw}
       });
     } catch (err) {
       if (process.env.NODE9_DEBUG === "1") {
-        const logPath = path8.join(os6.homedir(), ".node9", "hook-debug.log");
+        const logPath = path9.join(os7.homedir(), ".node9", "hook-debug.log");
         const errMsg = err instanceof Error ? err.message : String(err);
-        fs6.appendFileSync(logPath, `[${(/* @__PURE__ */ new Date()).toISOString()}] ERROR: ${errMsg}
+        fs7.appendFileSync(logPath, `[${(/* @__PURE__ */ new Date()).toISOString()}] ERROR: ${errMsg}
 `);
       }
       process.exit(0);
@@ -5160,10 +6107,10 @@ program.command("log").description("PostToolUse hook \u2014 records executed too
         decision: "allowed",
         source: "post-hook"
       };
-      const logPath = path8.join(os6.homedir(), ".node9", "audit.log");
-      if (!fs6.existsSync(path8.dirname(logPath)))
-        fs6.mkdirSync(path8.dirname(logPath), { recursive: true });
-      fs6.appendFileSync(logPath, JSON.stringify(entry) + "\n");
+      const logPath = path9.join(os7.homedir(), ".node9", "audit.log");
+      if (!fs7.existsSync(path9.dirname(logPath)))
+        fs7.mkdirSync(path9.dirname(logPath), { recursive: true });
+      fs7.appendFileSync(logPath, JSON.stringify(entry) + "\n");
       const config = getConfig();
       if (shouldSnapshot(tool, {}, config)) {
         await createShadowSnapshot();
@@ -5190,7 +6137,7 @@ program.command("pause").description("Temporarily disable Node9 protection for a
   const ms = parseDuration(options.duration);
   if (ms === null) {
     console.error(
-      chalk5.red(`
+      chalk6.red(`
 \u274C  Invalid duration: "${options.duration}". Use format like 15m, 1h, 30s.
 `)
     );
@@ -5198,20 +6145,20 @@ program.command("pause").description("Temporarily disable Node9 protection for a
   }
   pauseNode9(ms, options.duration);
   const expiresAt = new Date(Date.now() + ms).toLocaleTimeString();
-  console.log(chalk5.yellow(`
+  console.log(chalk6.yellow(`
 \u23F8  Node9 paused until ${expiresAt}`));
-  console.log(chalk5.gray(`   All tool calls will be allowed without review.`));
-  console.log(chalk5.gray(`   Run "node9 resume" to re-enable early.
+  console.log(chalk6.gray(`   All tool calls will be allowed without review.`));
+  console.log(chalk6.gray(`   Run "node9 resume" to re-enable early.
 `));
 });
 program.command("resume").description("Re-enable Node9 protection immediately").action(() => {
   const { paused } = checkPause();
   if (!paused) {
-    console.log(chalk5.gray("\nNode9 is already active \u2014 nothing to resume.\n"));
+    console.log(chalk6.gray("\nNode9 is already active \u2014 nothing to resume.\n"));
     return;
   }
   resumeNode9();
-  console.log(chalk5.green("\n\u25B6  Node9 resumed \u2014 protection is active.\n"));
+  console.log(chalk6.green("\n\u25B6  Node9 resumed \u2014 protection is active.\n"));
 });
 var HOOK_BASED_AGENTS = {
   claude: "claude",
@@ -5224,15 +6171,15 @@ program.argument("[command...]", "The agent command to run (e.g., gemini)").acti
     if (HOOK_BASED_AGENTS[firstArg] !== void 0) {
       const target = HOOK_BASED_AGENTS[firstArg];
       console.error(
-        chalk5.yellow(`
+        chalk6.yellow(`
 \u26A0\uFE0F  Node9 proxy mode does not support "${target}" directly.`)
       );
-      console.error(chalk5.white(`
+      console.error(chalk6.white(`
    "${target}" uses its own hook system. Use:`));
       console.error(
-        chalk5.green(`     node9 addto ${target}   `) + chalk5.gray("# one-time setup")
+        chalk6.green(`     node9 addto ${target}   `) + chalk6.gray("# one-time setup")
       );
-      console.error(chalk5.green(`     ${target}              `) + chalk5.gray("# run normally"));
+      console.error(chalk6.green(`     ${target}              `) + chalk6.gray("# run normally"));
       process.exit(1);
     }
     const fullCommand = commandArgs.join(" ");
@@ -5240,7 +6187,7 @@ program.argument("[command...]", "The agent command to run (e.g., gemini)").acti
       agent: "Terminal"
     });
     if (result.noApprovalMechanism && !isDaemonRunning() && !process.env.NODE9_NO_AUTO_DAEMON && getConfig().settings.autoStartDaemon) {
-      console.error(chalk5.cyan("\n\u{1F6E1}\uFE0F  Node9: Starting approval daemon automatically..."));
+      console.error(chalk6.cyan("\n\u{1F6E1}\uFE0F  Node9: Starting approval daemon automatically..."));
       const daemonReady = await autoStartDaemonAndWait();
       if (daemonReady) result = await authorizeHeadless("shell", { command: fullCommand });
     }
@@ -5249,12 +6196,12 @@ program.argument("[command...]", "The agent command to run (e.g., gemini)").acti
     }
     if (!result.approved) {
       console.error(
-        chalk5.red(`
+        chalk6.red(`
 \u274C Node9 Blocked: ${result.reason || "Dangerous command detected."}`)
       );
       process.exit(1);
     }
-    console.error(chalk5.green("\n\u2705 Approved \u2014 running command...\n"));
+    console.error(chalk6.green("\n\u2705 Approved \u2014 running command...\n"));
     await runProxy(fullCommand);
   } else {
     program.help();
@@ -5269,22 +6216,22 @@ program.command("undo").description(
   if (history.length === 0) {
     if (!options.all && allHistory.length > 0) {
       console.log(
-        chalk5.yellow(
+        chalk6.yellow(
           `
 \u2139\uFE0F  No snapshots found for the current directory (${process.cwd()}).
-    Run ${chalk5.cyan("node9 undo --all")} to see snapshots from all projects.
+    Run ${chalk6.cyan("node9 undo --all")} to see snapshots from all projects.
 `
         )
       );
     } else {
-      console.log(chalk5.yellow("\n\u2139\uFE0F  No undo snapshots found.\n"));
+      console.log(chalk6.yellow("\n\u2139\uFE0F  No undo snapshots found.\n"));
     }
     return;
   }
   const idx = history.length - steps;
   if (idx < 0) {
     console.log(
-      chalk5.yellow(
+      chalk6.yellow(
         `
 \u2139\uFE0F  Only ${history.length} snapshot(s) available, cannot go back ${steps}.
 `
@@ -5295,18 +6242,18 @@ program.command("undo").description(
   const snapshot = history[idx];
   const age = Math.round((Date.now() - snapshot.timestamp) / 1e3);
   const ageStr = age < 60 ? `${age}s ago` : age < 3600 ? `${Math.round(age / 60)}m ago` : `${Math.round(age / 3600)}h ago`;
-  console.log(chalk5.magenta.bold(`
+  console.log(chalk6.magenta.bold(`
 \u23EA  Node9 Undo${steps > 1 ? ` (${steps} steps back)` : ""}`));
   console.log(
-    chalk5.white(
-      `    Tool:  ${chalk5.cyan(snapshot.tool)}${snapshot.argsSummary ? chalk5.gray(" \u2192 " + snapshot.argsSummary) : ""}`
+    chalk6.white(
+      `    Tool:  ${chalk6.cyan(snapshot.tool)}${snapshot.argsSummary ? chalk6.gray(" \u2192 " + snapshot.argsSummary) : ""}`
     )
   );
-  console.log(chalk5.white(`    When:  ${chalk5.gray(ageStr)}`));
-  console.log(chalk5.white(`    Dir:   ${chalk5.gray(snapshot.cwd)}`));
+  console.log(chalk6.white(`    When:  ${chalk6.gray(ageStr)}`));
+  console.log(chalk6.white(`    Dir:   ${chalk6.gray(snapshot.cwd)}`));
   if (steps > 1)
     console.log(
-      chalk5.yellow(`    Note:  This will also undo the ${steps - 1} action(s) after it.`)
+      chalk6.yellow(`    Note:  This will also undo the ${steps - 1} action(s) after it.`)
     );
   console.log("");
   const diff = computeUndoDiff(snapshot.hash, snapshot.cwd);
@@ -5314,21 +6261,21 @@ program.command("undo").description(
     const lines = diff.split("\n");
     for (const line of lines) {
       if (line.startsWith("+++") || line.startsWith("---")) {
-        console.log(chalk5.bold(line));
+        console.log(chalk6.bold(line));
       } else if (line.startsWith("+")) {
-        console.log(chalk5.green(line));
+        console.log(chalk6.green(line));
       } else if (line.startsWith("-")) {
-        console.log(chalk5.red(line));
+        console.log(chalk6.red(line));
       } else if (line.startsWith("@@")) {
-        console.log(chalk5.cyan(line));
+        console.log(chalk6.cyan(line));
       } else {
-        console.log(chalk5.gray(line));
+        console.log(chalk6.gray(line));
       }
     }
     console.log("");
   } else {
     console.log(
-      chalk5.gray("    (no diff available \u2014 working tree may already match snapshot)\n")
+      chalk6.gray("    (no diff available \u2014 working tree may already match snapshot)\n")
     );
   }
   const proceed = await confirm3({
@@ -5337,42 +6284,42 @@ program.command("undo").description(
   });
   if (proceed) {
     if (applyUndo(snapshot.hash, snapshot.cwd)) {
-      console.log(chalk5.green("\n\u2705 Reverted successfully.\n"));
+      console.log(chalk6.green("\n\u2705 Reverted successfully.\n"));
     } else {
-      console.error(chalk5.red("\n\u274C Undo failed. Ensure you are in a Git repository.\n"));
+      console.error(chalk6.red("\n\u274C Undo failed. Ensure you are in a Git repository.\n"));
     }
   } else {
-    console.log(chalk5.gray("\nCancelled.\n"));
+    console.log(chalk6.gray("\nCancelled.\n"));
   }
 });
 var shieldCmd = program.command("shield").description("Manage pre-packaged security shield templates");
 shieldCmd.command("enable <service>").description("Enable a security shield for a specific service").action((service) => {
   const name = resolveShieldName(service);
   if (!name) {
-    console.error(chalk5.red(`
+    console.error(chalk6.red(`
 \u274C Unknown shield: "${service}"
 `));
-    console.log(`Run ${chalk5.cyan("node9 shield list")} to see available shields.
+    console.log(`Run ${chalk6.cyan("node9 shield list")} to see available shields.
 `);
     process.exit(1);
   }
   const shield = getShield(name);
   const active = readActiveShields();
   if (active.includes(name)) {
-    console.log(chalk5.yellow(`
+    console.log(chalk6.yellow(`
 \u2139\uFE0F  Shield "${name}" is already active.
 `));
     return;
   }
   writeActiveShields([...active, name]);
-  console.log(chalk5.green(`
+  console.log(chalk6.green(`
 \u{1F6E1}\uFE0F  Shield "${name}" enabled.`));
-  console.log(chalk5.gray(`   ${shield.smartRules.length} smart rules now active.`));
+  console.log(chalk6.gray(`   ${shield.smartRules.length} smart rules now active.`));
   if (shield.dangerousWords.length > 0)
-    console.log(chalk5.gray(`   ${shield.dangerousWords.length} dangerous words now active.`));
+    console.log(chalk6.gray(`   ${shield.dangerousWords.length} dangerous words now active.`));
   if (name === "filesystem") {
     console.log(
-      chalk5.yellow(
+      chalk6.yellow(
         `
    \u26A0\uFE0F  Note: filesystem rules cover common rm -rf patterns but not all variants.
       Tools like unlink, find -delete, or language-level file ops are not intercepted.`
@@ -5384,51 +6331,51 @@ shieldCmd.command("enable <service>").description("Enable a security shield for
 shieldCmd.command("disable <service>").description("Disable a security shield").action((service) => {
   const name = resolveShieldName(service);
   if (!name) {
-    console.error(chalk5.red(`
+    console.error(chalk6.red(`
 \u274C Unknown shield: "${service}"
 `));
-    console.log(`Run ${chalk5.cyan("node9 shield list")} to see available shields.
+    console.log(`Run ${chalk6.cyan("node9 shield list")} to see available shields.
 `);
     process.exit(1);
   }
   const active = readActiveShields();
   if (!active.includes(name)) {
-    console.log(chalk5.yellow(`
+    console.log(chalk6.yellow(`
 \u2139\uFE0F  Shield "${name}" is not active.
 `));
     return;
   }
   writeActiveShields(active.filter((s) => s !== name));
-  console.log(chalk5.green(`
+  console.log(chalk6.green(`
 \u{1F6E1}\uFE0F  Shield "${name}" disabled.
 `));
 });
 shieldCmd.command("list").description("Show all available shields").action(() => {
   const active = new Set(readActiveShields());
-  console.log(chalk5.bold("\n\u{1F6E1}\uFE0F  Available Shields\n"));
+  console.log(chalk6.bold("\n\u{1F6E1}\uFE0F  Available Shields\n"));
   for (const shield of listShields()) {
-    const status = active.has(shield.name) ? chalk5.green("\u25CF enabled") : chalk5.gray("\u25CB disabled");
-    console.log(`  ${status}  ${chalk5.cyan(shield.name.padEnd(12))} ${shield.description}`);
+    const status = active.has(shield.name) ? chalk6.green("\u25CF enabled") : chalk6.gray("\u25CB disabled");
+    console.log(`  ${status}  ${chalk6.cyan(shield.name.padEnd(12))} ${shield.description}`);
     if (shield.aliases.length > 0)
-      console.log(chalk5.gray(`              aliases: ${shield.aliases.join(", ")}`));
+      console.log(chalk6.gray(`              aliases: ${shield.aliases.join(", ")}`));
   }
   console.log("");
 });
 shieldCmd.command("status").description("Show which shields are currently active").action(() => {
   const active = readActiveShields();
   if (active.length === 0) {
-    console.log(chalk5.yellow("\n\u2139\uFE0F  No shields are active.\n"));
-    console.log(`Run ${chalk5.cyan("node9 shield list")} to see available shields.
+    console.log(chalk6.yellow("\n\u2139\uFE0F  No shields are active.\n"));
+    console.log(`Run ${chalk6.cyan("node9 shield list")} to see available shields.
 `);
     return;
   }
-  console.log(chalk5.bold("\n\u{1F6E1}\uFE0F  Active Shields\n"));
+  console.log(chalk6.bold("\n\u{1F6E1}\uFE0F  Active Shields\n"));
   for (const name of active) {
     const shield = getShield(name);
     if (!shield) continue;
-    console.log(`  ${chalk5.green("\u25CF")} ${chalk5.cyan(name)}`);
+    console.log(`  ${chalk6.green("\u25CF")} ${chalk6.cyan(name)}`);
     console.log(
-      chalk5.gray(
+      chalk6.gray(
         `    ${shield.smartRules.length} smart rules \xB7 ${shield.dangerousWords.length} dangerous words`
       )
     );
@@ -5439,9 +6386,9 @@ process.on("unhandledRejection", (reason) => {
   const isCheckHook = process.argv[2] === "check";
   if (isCheckHook) {
     if (process.env.NODE9_DEBUG === "1" || getConfig().settings.enableHookLogDebug) {
-      const logPath = path8.join(os6.homedir(), ".node9", "hook-debug.log");
+      const logPath = path9.join(os7.homedir(), ".node9", "hook-debug.log");
       const msg = reason instanceof Error ? reason.message : String(reason);
-      fs6.appendFileSync(logPath, `[${(/* @__PURE__ */ new Date()).toISOString()}] UNHANDLED: ${msg}
+      fs7.appendFileSync(logPath, `[${(/* @__PURE__ */ new Date()).toISOString()}] UNHANDLED: ${msg}
 `);
     }
     process.exit(0);