@node9/proxy 1.0.18 → 1.1.0

package/dist/cli.mjs

@@ -360,8 +360,8 @@ function sanitizeConfig(raw) {
     }
   }
   const lines = result.error.issues.map((issue) => {
-    const path10 = issue.path.length > 0 ? issue.path.join(".") : "root";
-    return `  \u2022 ${path10}: ${issue.message}`;
+    const path11 = issue.path.length > 0 ? issue.path.join(".") : "root";
+    return `  \u2022 ${path11}: ${issue.message}`;
   });
   return {
     sanitized,
@@ -675,6 +675,41 @@ var init_shields = __esm({
 });
 
 // src/dlp.ts
+import fs2 from "fs";
+import path4 from "path";
+function scanFilePath(filePath, cwd = process.cwd()) {
+  if (!filePath) return null;
+  let resolved;
+  try {
+    const absolute = path4.resolve(cwd, filePath);
+    resolved = fs2.realpathSync.native(absolute);
+  } catch (err) {
+    const code = err.code;
+    if (code === "ENOENT" || code === "ENOTDIR") {
+      resolved = path4.resolve(cwd, filePath);
+    } else {
+      return {
+        patternName: "Sensitive File Path",
+        fieldPath: "file_path",
+        redactedSample: filePath,
+        severity: "block"
+      };
+    }
+  }
+  const normalised = resolved.replace(/\\/g, "/");
+  for (const pattern of SENSITIVE_PATH_PATTERNS) {
+    if (pattern.test(normalised)) {
+      return {
+        patternName: "Sensitive File Path",
+        fieldPath: "file_path",
+        redactedSample: filePath,
+        // show original path in alert, not resolved
+        severity: "block"
+      };
+    }
+  }
+  return null;
+}
 function maskSecret(raw, pattern) {
   const match = raw.match(pattern);
   if (!match) return "****";
@@ -727,7 +762,7 @@ function scanArgs(args, depth = 0, fieldPath = "args") {
   }
   return null;
 }
-var DLP_PATTERNS, MAX_DEPTH, MAX_STRING_BYTES, MAX_JSON_PARSE_BYTES;
+var DLP_PATTERNS, SENSITIVE_PATH_PATTERNS, MAX_DEPTH, MAX_STRING_BYTES, MAX_JSON_PARSE_BYTES;
 var init_dlp = __esm({
   "src/dlp.ts"() {
     "use strict";
@@ -742,8 +777,43 @@ var init_dlp = __esm({
         regex: /-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----/,
         severity: "block"
       },
+      // GCP service account JSON (detects the type field that uniquely identifies it)
+      {
+        name: "GCP Service Account",
+        regex: /"type"\s*:\s*"service_account"/,
+        severity: "block"
+      },
+      // NPM auth token in .npmrc format
+      {
+        name: "NPM Auth Token",
+        regex: /_authToken\s*=\s*[A-Za-z0-9_\-]{20,}/,
+        severity: "block"
+      },
       { name: "Bearer Token", regex: /Bearer\s+[a-zA-Z0-9\-._~+/]+=*/i, severity: "review" }
     ];
+    SENSITIVE_PATH_PATTERNS = [
+      /[/\\]\.ssh[/\\]/i,
+      /[/\\]\.aws[/\\]/i,
+      /[/\\]\.config[/\\]gcloud[/\\]/i,
+      /[/\\]\.azure[/\\]/i,
+      /[/\\]\.kube[/\\]config$/i,
+      /[/\\]\.env($|\.)/i,
+      // .env, .env.local, .env.production — not .envoy
+      /[/\\]\.git-credentials$/i,
+      /[/\\]\.npmrc$/i,
+      /[/\\]\.docker[/\\]config\.json$/i,
+      /[/\\][^/\\]+\.pem$/i,
+      /[/\\][^/\\]+\.key$/i,
+      /[/\\][^/\\]+\.p12$/i,
+      /[/\\][^/\\]+\.pfx$/i,
+      /^\/etc\/passwd$/,
+      /^\/etc\/shadow$/,
+      /^\/etc\/sudoers$/,
+      /[/\\]credentials\.json$/i,
+      /[/\\]id_rsa$/i,
+      /[/\\]id_ed25519$/i,
+      /[/\\]id_ecdsa$/i
+    ];
     MAX_DEPTH = 5;
     MAX_STRING_BYTES = 1e5;
     MAX_JSON_PARSE_BYTES = 1e4;
@@ -753,21 +823,22 @@ var init_dlp = __esm({
 // src/core.ts
 import chalk2 from "chalk";
 import { confirm } from "@inquirer/prompts";
-import fs2 from "fs";
-import path4 from "path";
+import fs3 from "fs";
+import path5 from "path";
 import os2 from "os";
 import net from "net";
 import { randomUUID } from "crypto";
 import { spawnSync } from "child_process";
 import pm from "picomatch";
+import safeRegex from "safe-regex2";
 import { parse } from "sh-syntax";
 function checkPause() {
   try {
-    if (!fs2.existsSync(PAUSED_FILE)) return { paused: false };
-    const state = JSON.parse(fs2.readFileSync(PAUSED_FILE, "utf-8"));
+    if (!fs3.existsSync(PAUSED_FILE)) return { paused: false };
+    const state = JSON.parse(fs3.readFileSync(PAUSED_FILE, "utf-8"));
     if (state.expiry > 0 && Date.now() >= state.expiry) {
       try {
-        fs2.unlinkSync(PAUSED_FILE);
+        fs3.unlinkSync(PAUSED_FILE);
       } catch {
       }
       return { paused: false };
@@ -778,11 +849,11 @@ function checkPause() {
   }
 }
 function atomicWriteSync(filePath, data, options) {
-  const dir = path4.dirname(filePath);
-  if (!fs2.existsSync(dir)) fs2.mkdirSync(dir, { recursive: true });
+  const dir = path5.dirname(filePath);
+  if (!fs3.existsSync(dir)) fs3.mkdirSync(dir, { recursive: true });
   const tmpPath = `${filePath}.${os2.hostname()}.${process.pid}.tmp`;
-  fs2.writeFileSync(tmpPath, data, options);
-  fs2.renameSync(tmpPath, filePath);
+  fs3.writeFileSync(tmpPath, data, options);
+  fs3.renameSync(tmpPath, filePath);
 }
 function pauseNode9(durationMs, durationStr) {
   const state = { expiry: Date.now() + durationMs, duration: durationStr };
@@ -790,18 +861,88 @@ function pauseNode9(durationMs, durationStr) {
 }
 function resumeNode9() {
   try {
-    if (fs2.existsSync(PAUSED_FILE)) fs2.unlinkSync(PAUSED_FILE);
+    if (fs3.existsSync(PAUSED_FILE)) fs3.unlinkSync(PAUSED_FILE);
   } catch {
   }
 }
+function validateRegex(pattern) {
+  if (!pattern) return "Pattern is required";
+  if (pattern.length > MAX_REGEX_LENGTH) return `Pattern exceeds max length of ${MAX_REGEX_LENGTH}`;
+  let parens = 0, brackets = 0, isEscaped = false, inCharClass = false;
+  for (let i = 0; i < pattern.length; i++) {
+    const char = pattern[i];
+    if (isEscaped) {
+      isEscaped = false;
+      continue;
+    }
+    if (char === "\\") {
+      isEscaped = true;
+      continue;
+    }
+    if (char === "[" && !inCharClass) {
+      inCharClass = true;
+      brackets++;
+      continue;
+    }
+    if (char === "]" && inCharClass) {
+      inCharClass = false;
+      brackets--;
+      continue;
+    }
+    if (inCharClass) continue;
+    if (char === "(") parens++;
+    else if (char === ")") parens--;
+  }
+  if (parens !== 0) return "Unbalanced parentheses";
+  if (brackets !== 0) return "Unbalanced brackets";
+  if (/\\\d+[*+{]/.test(pattern)) return "Quantified backreferences are forbidden (ReDoS risk)";
+  if (!safeRegex(pattern)) return "Pattern rejected: potential ReDoS vulnerability detected";
+  try {
+    new RegExp(pattern);
+  } catch (e) {
+    return `Invalid regex syntax: ${e.message}`;
+  }
+  return null;
+}
+function getCompiledRegex(pattern, flags = "") {
+  if (flags && !/^[gimsuy]+$/.test(flags)) {
+    if (process.env.NODE9_DEBUG === "1") console.error(`[Node9] Invalid regex flags: "${flags}"`);
+    return null;
+  }
+  const key = `${pattern}\0${flags}`;
+  if (regexCache.has(key)) {
+    const cached = regexCache.get(key);
+    regexCache.delete(key);
+    regexCache.set(key, cached);
+    return cached;
+  }
+  const err = validateRegex(pattern);
+  if (err) {
+    if (process.env.NODE9_DEBUG === "1")
+      console.error(`[Node9] Regex blocked: ${err} \u2014 pattern: "${pattern}"`);
+    return null;
+  }
+  try {
+    const re = new RegExp(pattern, flags);
+    if (regexCache.size >= REGEX_CACHE_MAX) {
+      const oldest = regexCache.keys().next().value;
+      if (oldest) regexCache.delete(oldest);
+    }
+    regexCache.set(key, re);
+    return re;
+  } catch (e) {
+    if (process.env.NODE9_DEBUG === "1") console.error(`[Node9] Regex compile failed:`, e);
+    return null;
+  }
+}
 function getActiveTrustSession(toolName) {
   try {
-    if (!fs2.existsSync(TRUST_FILE)) return false;
-    const trust = JSON.parse(fs2.readFileSync(TRUST_FILE, "utf-8"));
+    if (!fs3.existsSync(TRUST_FILE)) return false;
+    const trust = JSON.parse(fs3.readFileSync(TRUST_FILE, "utf-8"));
     const now = Date.now();
     const active = trust.entries.filter((e) => e.expiry > now);
     if (active.length !== trust.entries.length) {
-      fs2.writeFileSync(TRUST_FILE, JSON.stringify({ entries: active }, null, 2));
+      fs3.writeFileSync(TRUST_FILE, JSON.stringify({ entries: active }, null, 2));
     }
     return active.some((e) => e.tool === toolName || matchesPattern(toolName, e.tool));
   } catch {
@@ -812,8 +953,8 @@ function writeTrustSession(toolName, durationMs) {
   try {
     let trust = { entries: [] };
     try {
-      if (fs2.existsSync(TRUST_FILE)) {
-        trust = JSON.parse(fs2.readFileSync(TRUST_FILE, "utf-8"));
+      if (fs3.existsSync(TRUST_FILE)) {
+        trust = JSON.parse(fs3.readFileSync(TRUST_FILE, "utf-8"));
       }
     } catch {
     }
@@ -829,9 +970,9 @@ function writeTrustSession(toolName, durationMs) {
 }
 function appendToLog(logPath, entry) {
   try {
-    const dir = path4.dirname(logPath);
-    if (!fs2.existsSync(dir)) fs2.mkdirSync(dir, { recursive: true });
-    fs2.appendFileSync(logPath, JSON.stringify(entry) + "\n");
+    const dir = path5.dirname(logPath);
+    if (!fs3.existsSync(dir)) fs3.mkdirSync(dir, { recursive: true });
+    fs3.appendFileSync(logPath, JSON.stringify(entry) + "\n");
   } catch {
   }
 }
@@ -873,9 +1014,9 @@ function matchesPattern(text, patterns) {
   const withoutDotSlash = text.replace(/^\.\//, "");
   return isMatch(withoutDotSlash) || isMatch(`./${withoutDotSlash}`);
 }
-function getNestedValue(obj, path10) {
+function getNestedValue(obj, path11) {
   if (!obj || typeof obj !== "object") return null;
-  return path10.split(".").reduce((prev, curr) => prev?.[curr], obj);
+  return path11.split(".").reduce((prev, curr) => prev?.[curr], obj);
 }
 function shouldSnapshot(toolName, args, config) {
   if (!config.settings.enableUndo) return false;
@@ -906,19 +1047,16 @@ function evaluateSmartConditions(args, rule) {
         return val !== null && cond.value ? !val.includes(cond.value) : true;
       case "matches": {
         if (val === null || !cond.value) return false;
-        try {
-          return new RegExp(cond.value, cond.flags ?? "").test(val);
-        } catch {
-          return false;
-        }
+        const reM = getCompiledRegex(cond.value, cond.flags ?? "");
+        if (!reM) return false;
+        return reM.test(val);
       }
       case "notMatches": {
-        if (val === null || !cond.value) return true;
-        try {
-          return !new RegExp(cond.value, cond.flags ?? "").test(val);
-        } catch {
-          return true;
-        }
+        if (!cond.value) return false;
+        if (val === null) return true;
+        const reN = getCompiledRegex(cond.value, cond.flags ?? "");
+        if (!reN) return false;
+        return !reN.test(val);
       }
       case "matchesGlob":
         return val !== null && cond.value ? pm.isMatch(val, cond.value) : false;
@@ -1031,9 +1169,9 @@ function _resetConfigCache() {
 }
 function getGlobalSettings() {
   try {
-    const globalConfigPath = path4.join(os2.homedir(), ".node9", "config.json");
-    if (fs2.existsSync(globalConfigPath)) {
-      const parsed = JSON.parse(fs2.readFileSync(globalConfigPath, "utf-8"));
+    const globalConfigPath = path5.join(os2.homedir(), ".node9", "config.json");
+    if (fs3.existsSync(globalConfigPath)) {
+      const parsed = JSON.parse(fs3.readFileSync(globalConfigPath, "utf-8"));
       const settings = parsed.settings || {};
       return {
         mode: settings.mode || "audit",
@@ -1055,9 +1193,9 @@ function getGlobalSettings() {
 }
 function getInternalToken() {
   try {
-    const pidFile = path4.join(os2.homedir(), ".node9", "daemon.pid");
-    if (!fs2.existsSync(pidFile)) return null;
-    const data = JSON.parse(fs2.readFileSync(pidFile, "utf-8"));
+    const pidFile = path5.join(os2.homedir(), ".node9", "daemon.pid");
+    if (!fs3.existsSync(pidFile)) return null;
+    const data = JSON.parse(fs3.readFileSync(pidFile, "utf-8"));
     process.kill(data.pid, 0);
     return data.internalToken ?? null;
   } catch {
@@ -1172,9 +1310,9 @@ async function evaluatePolicy(toolName, args, agent) {
 }
 async function explainPolicy(toolName, args) {
   const steps = [];
-  const globalPath = path4.join(os2.homedir(), ".node9", "config.json");
-  const projectPath = path4.join(process.cwd(), "node9.config.json");
-  const credsPath = path4.join(os2.homedir(), ".node9", "credentials.json");
+  const globalPath = path5.join(os2.homedir(), ".node9", "config.json");
+  const projectPath = path5.join(process.cwd(), "node9.config.json");
+  const credsPath = path5.join(os2.homedir(), ".node9", "credentials.json");
   const waterfall = [
     {
       tier: 1,
@@ -1185,19 +1323,19 @@ async function explainPolicy(toolName, args) {
     {
       tier: 2,
       label: "Cloud policy",
-      status: fs2.existsSync(credsPath) ? "active" : "missing",
-      note: fs2.existsSync(credsPath) ? "credentials found (not evaluated in explain mode)" : "not connected \u2014 run: node9 login"
+      status: fs3.existsSync(credsPath) ? "active" : "missing",
+      note: fs3.existsSync(credsPath) ? "credentials found (not evaluated in explain mode)" : "not connected \u2014 run: node9 login"
     },
     {
       tier: 3,
       label: "Project config",
-      status: fs2.existsSync(projectPath) ? "active" : "missing",
+      status: fs3.existsSync(projectPath) ? "active" : "missing",
       path: projectPath
     },
     {
       tier: 4,
       label: "Global config",
-      status: fs2.existsSync(globalPath) ? "active" : "missing",
+      status: fs3.existsSync(globalPath) ? "active" : "missing",
       path: globalPath
     },
     {
@@ -1210,7 +1348,9 @@ async function explainPolicy(toolName, args) {
   const config = getConfig();
   const wouldBeIgnored = matchesPattern(toolName, config.policy.ignoredTools);
   if (config.policy.dlp.enabled && (!wouldBeIgnored || config.policy.dlp.scanIgnoredTools)) {
-    const dlpMatch = args !== void 0 ? scanArgs(args) : null;
+    const argsObjE = args && typeof args === "object" && !Array.isArray(args) ? args : {};
+    const filePathE = String(argsObjE.file_path ?? argsObjE.path ?? argsObjE.filename ?? "");
+    const dlpMatch = (filePathE ? scanFilePath(filePathE) : null) ?? (args !== void 0 ? scanArgs(args) : null);
     if (dlpMatch) {
       steps.push({
         name: "DLP Content Scanner",
@@ -1433,10 +1573,10 @@ function isIgnoredTool(toolName) {
   return matchesPattern(toolName, config.policy.ignoredTools);
 }
 function isDaemonRunning() {
-  const pidFile = path4.join(os2.homedir(), ".node9", "daemon.pid");
-  if (fs2.existsSync(pidFile)) {
+  const pidFile = path5.join(os2.homedir(), ".node9", "daemon.pid");
+  if (fs3.existsSync(pidFile)) {
     try {
-      const { pid, port } = JSON.parse(fs2.readFileSync(pidFile, "utf-8"));
+      const { pid, port } = JSON.parse(fs3.readFileSync(pidFile, "utf-8"));
       if (port !== DAEMON_PORT) return false;
       process.kill(pid, 0);
       return true;
@@ -1456,9 +1596,9 @@ function isDaemonRunning() {
 }
 function getPersistentDecision(toolName) {
   try {
-    const file = path4.join(os2.homedir(), ".node9", "decisions.json");
-    if (!fs2.existsSync(file)) return null;
-    const decisions = JSON.parse(fs2.readFileSync(file, "utf-8"));
+    const file = path5.join(os2.homedir(), ".node9", "decisions.json");
+    if (!fs3.existsSync(file)) return null;
+    const decisions = JSON.parse(fs3.readFileSync(file, "utf-8"));
     const d = decisions[toolName];
     if (d === "allow" || d === "deny") return d;
   } catch {
@@ -1601,7 +1741,9 @@ async function _authorizeHeadlessCore(toolName, args, allowTerminalFallback = fa
   let policyMatchedWord;
   let riskMetadata;
   if (config.policy.dlp.enabled && (!isIgnoredTool(toolName) || config.policy.dlp.scanIgnoredTools)) {
-    const dlpMatch = scanArgs(args);
+    const argsObj = args && typeof args === "object" && !Array.isArray(args) ? args : {};
+    const filePath = String(argsObj.file_path ?? argsObj.path ?? argsObj.filename ?? "");
+    const dlpMatch = (filePath ? scanFilePath(filePath) : null) ?? scanArgs(args);
     if (dlpMatch) {
       const dlpReason = `\u{1F6A8} DATA LOSS PREVENTION: ${dlpMatch.patternName} detected in field "${dlpMatch.fieldPath}" (${dlpMatch.redactedSample})`;
       if (dlpMatch.severity === "block") {
@@ -1975,8 +2117,8 @@ REASON: Action blocked because no approval channels are available. (Native/Brows
 }
 function getConfig() {
   if (cachedConfig) return cachedConfig;
-  const globalPath = path4.join(os2.homedir(), ".node9", "config.json");
-  const projectPath = path4.join(process.cwd(), "node9.config.json");
+  const globalPath = path5.join(os2.homedir(), ".node9", "config.json");
+  const projectPath = path5.join(process.cwd(), "node9.config.json");
   const globalConfig = tryLoadConfig(globalPath);
   const projectConfig = tryLoadConfig(projectPath);
   const mergedSettings = {
@@ -2071,10 +2213,10 @@ function getConfig() {
   return cachedConfig;
 }
 function tryLoadConfig(filePath) {
-  if (!fs2.existsSync(filePath)) return null;
+  if (!fs3.existsSync(filePath)) return null;
   let raw;
   try {
-    raw = JSON.parse(fs2.readFileSync(filePath, "utf-8"));
+    raw = JSON.parse(fs3.readFileSync(filePath, "utf-8"));
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
     process.stderr.write(
@@ -2136,9 +2278,9 @@ function getCredentials() {
     };
   }
   try {
-    const credPath = path4.join(os2.homedir(), ".node9", "credentials.json");
-    if (fs2.existsSync(credPath)) {
-      const creds = JSON.parse(fs2.readFileSync(credPath, "utf-8"));
+    const credPath = path5.join(os2.homedir(), ".node9", "credentials.json");
+    if (fs3.existsSync(credPath)) {
+      const creds = JSON.parse(fs3.readFileSync(credPath, "utf-8"));
       const profileName = process.env.NODE9_PROFILE || "default";
       const profile = creds[profileName];
       if (profile?.apiKey) {
@@ -2251,7 +2393,7 @@ async function resolveNode9SaaS(requestId, creds, approved) {
   } catch {
   }
 }
-var PAUSED_FILE, TRUST_FILE, LOCAL_AUDIT_LOG, HOOK_DEBUG_LOG, SQL_DML_KEYWORDS, DANGEROUS_WORDS, DEFAULT_CONFIG, ADVISORY_SMART_RULES, cachedConfig, DAEMON_PORT, DAEMON_HOST, ACTIVITY_SOCKET_PATH;
+var PAUSED_FILE, TRUST_FILE, LOCAL_AUDIT_LOG, HOOK_DEBUG_LOG, MAX_REGEX_LENGTH, REGEX_CACHE_MAX, regexCache, SQL_DML_KEYWORDS, DANGEROUS_WORDS, DEFAULT_CONFIG, ADVISORY_SMART_RULES, cachedConfig, DAEMON_PORT, DAEMON_HOST, ACTIVITY_SOCKET_PATH;
 var init_core = __esm({
   "src/core.ts"() {
     "use strict";
@@ -2260,10 +2402,13 @@ var init_core = __esm({
     init_config_schema();
     init_shields();
     init_dlp();
-    PAUSED_FILE = path4.join(os2.homedir(), ".node9", "PAUSED");
-    TRUST_FILE = path4.join(os2.homedir(), ".node9", "trust.json");
-    LOCAL_AUDIT_LOG = path4.join(os2.homedir(), ".node9", "audit.log");
-    HOOK_DEBUG_LOG = path4.join(os2.homedir(), ".node9", "hook-debug.log");
+    PAUSED_FILE = path5.join(os2.homedir(), ".node9", "PAUSED");
+    TRUST_FILE = path5.join(os2.homedir(), ".node9", "trust.json");
+    LOCAL_AUDIT_LOG = path5.join(os2.homedir(), ".node9", "audit.log");
+    HOOK_DEBUG_LOG = path5.join(os2.homedir(), ".node9", "hook-debug.log");
+    MAX_REGEX_LENGTH = 100;
+    REGEX_CACHE_MAX = 500;
+    regexCache = /* @__PURE__ */ new Map();
     SQL_DML_KEYWORDS = /* @__PURE__ */ new Set(["select", "insert", "update", "delete", "merge", "upsert"]);
     DANGEROUS_WORDS = [
       "mkfs",
@@ -2383,7 +2528,7 @@ var init_core = __esm({
               {
                 field: "command",
                 op: "matches",
-                value: "git push.*(--force|--force-with-lease|-f\\b)",
+                value: "^\\s*git\\b.*\\bpush\\b.*(--force|--force-with-lease|-f\\b)",
                 flags: "i"
               }
             ],
@@ -2394,7 +2539,14 @@ var init_core = __esm({
           {
             name: "review-git-push",
             tool: "bash",
-            conditions: [{ field: "command", op: "matches", value: "^\\s*git\\s+push\\b", flags: "i" }],
+            conditions: [
+              {
+                field: "command",
+                op: "matches",
+                value: "^\\s*git\\b.*\\bpush\\b(?!.*(-f\\b|--force|--force-with-lease))",
+                flags: "i"
+              }
+            ],
             conditionMode: "all",
             verdict: "review",
             reason: "git push sends changes to a shared remote"
@@ -2406,7 +2558,7 @@ var init_core = __esm({
               {
                 field: "command",
                 op: "matches",
-                value: "git\\s+(reset\\s+--hard|clean\\s+-[fdxX]|rebase|tag\\s+-d|branch\\s+-[dD])",
+                value: "^\\s*git\\b.*(reset\\s+--hard|clean\\s+-[fdxX]|\\brebase\\b|tag\\s+-d|branch\\s+-[dD])",
                 flags: "i"
               }
             ],
@@ -2471,7 +2623,7 @@ var init_core = __esm({
     cachedConfig = null;
     DAEMON_PORT = 7391;
     DAEMON_HOST = "127.0.0.1";
-    ACTIVITY_SOCKET_PATH = process.platform === "win32" ? "\\\\.\\pipe\\node9-activity" : path4.join(os2.tmpdir(), "node9-activity.sock");
+    ACTIVITY_SOCKET_PATH = process.platform === "win32" ? "\\\\.\\pipe\\node9-activity" : path5.join(os2.tmpdir(), "node9-activity.sock");
   }
 });
 
@@ -3930,25 +4082,25 @@ var init_ui2 = __esm({
 // src/daemon/index.ts
 import http from "http";
 import net2 from "net";
-import fs4 from "fs";
-import path6 from "path";
+import fs5 from "fs";
+import path7 from "path";
 import os4 from "os";
 import { spawn as spawn2, spawnSync as spawnSync2 } from "child_process";
 import { randomUUID as randomUUID2 } from "crypto";
 import chalk4 from "chalk";
 function atomicWriteSync2(filePath, data, options) {
-  const dir = path6.dirname(filePath);
-  if (!fs4.existsSync(dir)) fs4.mkdirSync(dir, { recursive: true });
+  const dir = path7.dirname(filePath);
+  if (!fs5.existsSync(dir)) fs5.mkdirSync(dir, { recursive: true });
   const tmpPath = `${filePath}.${randomUUID2()}.tmp`;
-  fs4.writeFileSync(tmpPath, data, options);
-  fs4.renameSync(tmpPath, filePath);
+  fs5.writeFileSync(tmpPath, data, options);
+  fs5.renameSync(tmpPath, filePath);
 }
 function writeTrustEntry(toolName, durationMs) {
   try {
     let trust = { entries: [] };
     try {
-      if (fs4.existsSync(TRUST_FILE2))
-        trust = JSON.parse(fs4.readFileSync(TRUST_FILE2, "utf-8"));
+      if (fs5.existsSync(TRUST_FILE2))
+        trust = JSON.parse(fs5.readFileSync(TRUST_FILE2, "utf-8"));
     } catch {
     }
     trust.entries = trust.entries.filter((e) => e.tool !== toolName && e.expiry > Date.now());
@@ -3975,16 +4127,16 @@ function appendAuditLog(data) {
       decision: data.decision,
       source: "daemon"
     };
-    const dir = path6.dirname(AUDIT_LOG_FILE);
-    if (!fs4.existsSync(dir)) fs4.mkdirSync(dir, { recursive: true });
-    fs4.appendFileSync(AUDIT_LOG_FILE, JSON.stringify(entry) + "\n");
+    const dir = path7.dirname(AUDIT_LOG_FILE);
+    if (!fs5.existsSync(dir)) fs5.mkdirSync(dir, { recursive: true });
+    fs5.appendFileSync(AUDIT_LOG_FILE, JSON.stringify(entry) + "\n");
   } catch {
   }
 }
 function getAuditHistory(limit = 20) {
   try {
-    if (!fs4.existsSync(AUDIT_LOG_FILE)) return [];
-    const lines = fs4.readFileSync(AUDIT_LOG_FILE, "utf-8").trim().split("\n");
+    if (!fs5.existsSync(AUDIT_LOG_FILE)) return [];
+    const lines = fs5.readFileSync(AUDIT_LOG_FILE, "utf-8").trim().split("\n");
     if (lines.length === 1 && lines[0] === "") return [];
     return lines.slice(-limit).map((l) => JSON.parse(l)).reverse();
   } catch {
@@ -3993,7 +4145,7 @@ function getAuditHistory(limit = 20) {
 }
 function getOrgName() {
   try {
-    if (fs4.existsSync(CREDENTIALS_FILE)) {
+    if (fs5.existsSync(CREDENTIALS_FILE)) {
       return "Node9 Cloud";
     }
   } catch {
@@ -4001,13 +4153,13 @@ function getOrgName() {
   return null;
 }
 function hasStoredSlackKey() {
-  return fs4.existsSync(CREDENTIALS_FILE);
+  return fs5.existsSync(CREDENTIALS_FILE);
 }
 function writeGlobalSetting(key, value) {
   let config = {};
   try {
-    if (fs4.existsSync(GLOBAL_CONFIG_FILE)) {
-      config = JSON.parse(fs4.readFileSync(GLOBAL_CONFIG_FILE, "utf-8"));
+    if (fs5.existsSync(GLOBAL_CONFIG_FILE)) {
+      config = JSON.parse(fs5.readFileSync(GLOBAL_CONFIG_FILE, "utf-8"));
     }
   } catch {
   }
@@ -4026,7 +4178,7 @@ function abandonPending() {
   });
   if (autoStarted) {
     try {
-      fs4.unlinkSync(DAEMON_PID_FILE);
+      fs5.unlinkSync(DAEMON_PID_FILE);
     } catch {
     }
     setTimeout(() => {
@@ -4076,8 +4228,8 @@ function readBody(req) {
 }
 function readPersistentDecisions() {
   try {
-    if (fs4.existsSync(DECISIONS_FILE)) {
-      return JSON.parse(fs4.readFileSync(DECISIONS_FILE, "utf-8"));
+    if (fs5.existsSync(DECISIONS_FILE)) {
+      return JSON.parse(fs5.readFileSync(DECISIONS_FILE, "utf-8"));
     }
   } catch {
   }
@@ -4106,7 +4258,7 @@ function startDaemon() {
     idleTimer = setTimeout(() => {
       if (autoStarted) {
         try {
-          fs4.unlinkSync(DAEMON_PID_FILE);
+          fs5.unlinkSync(DAEMON_PID_FILE);
         } catch {
         }
       }
@@ -4491,14 +4643,14 @@ data: ${JSON.stringify(item.data)}
   server.on("error", (e) => {
     if (e.code === "EADDRINUSE") {
       try {
-        if (fs4.existsSync(DAEMON_PID_FILE)) {
-          const { pid } = JSON.parse(fs4.readFileSync(DAEMON_PID_FILE, "utf-8"));
+        if (fs5.existsSync(DAEMON_PID_FILE)) {
+          const { pid } = JSON.parse(fs5.readFileSync(DAEMON_PID_FILE, "utf-8"));
           process.kill(pid, 0);
           return process.exit(0);
         }
       } catch {
         try {
-          fs4.unlinkSync(DAEMON_PID_FILE);
+          fs5.unlinkSync(DAEMON_PID_FILE);
         } catch {
         }
         server.listen(DAEMON_PORT2, DAEMON_HOST2);
@@ -4549,7 +4701,7 @@ data: ${JSON.stringify(item.data)}
     console.log(chalk4.cyan("\u{1F6F0}\uFE0F  Flight Recorder active \u2014 daemon will not idle-timeout"));
   }
   try {
-    fs4.unlinkSync(ACTIVITY_SOCKET_PATH2);
+    fs5.unlinkSync(ACTIVITY_SOCKET_PATH2);
   } catch {
   }
   const ACTIVITY_MAX_BYTES = 1024 * 1024;
@@ -4591,30 +4743,30 @@ data: ${JSON.stringify(item.data)}
   unixServer.listen(ACTIVITY_SOCKET_PATH2);
   process.on("exit", () => {
     try {
-      fs4.unlinkSync(ACTIVITY_SOCKET_PATH2);
+      fs5.unlinkSync(ACTIVITY_SOCKET_PATH2);
     } catch {
     }
   });
 }
 function stopDaemon() {
-  if (!fs4.existsSync(DAEMON_PID_FILE)) return console.log(chalk4.yellow("Not running."));
+  if (!fs5.existsSync(DAEMON_PID_FILE)) return console.log(chalk4.yellow("Not running."));
   try {
-    const { pid } = JSON.parse(fs4.readFileSync(DAEMON_PID_FILE, "utf-8"));
+    const { pid } = JSON.parse(fs5.readFileSync(DAEMON_PID_FILE, "utf-8"));
     process.kill(pid, "SIGTERM");
     console.log(chalk4.green("\u2705 Stopped."));
   } catch {
     console.log(chalk4.gray("Cleaned up stale PID file."));
   } finally {
     try {
-      fs4.unlinkSync(DAEMON_PID_FILE);
+      fs5.unlinkSync(DAEMON_PID_FILE);
     } catch {
     }
   }
 }
 function daemonStatus() {
-  if (fs4.existsSync(DAEMON_PID_FILE)) {
+  if (fs5.existsSync(DAEMON_PID_FILE)) {
     try {
-      const { pid } = JSON.parse(fs4.readFileSync(DAEMON_PID_FILE, "utf-8"));
+      const { pid } = JSON.parse(fs5.readFileSync(DAEMON_PID_FILE, "utf-8"));
       process.kill(pid, 0);
       console.log(chalk4.green("Node9 daemon: running"));
       return;
@@ -4640,16 +4792,16 @@ var init_daemon = __esm({
     init_ui2();
     init_core();
     init_shields();
-    ACTIVITY_SOCKET_PATH2 = process.platform === "win32" ? "\\\\.\\pipe\\node9-activity" : path6.join(os4.tmpdir(), "node9-activity.sock");
+    ACTIVITY_SOCKET_PATH2 = process.platform === "win32" ? "\\\\.\\pipe\\node9-activity" : path7.join(os4.tmpdir(), "node9-activity.sock");
     DAEMON_PORT2 = 7391;
     DAEMON_HOST2 = "127.0.0.1";
     homeDir = os4.homedir();
-    DAEMON_PID_FILE = path6.join(homeDir, ".node9", "daemon.pid");
-    DECISIONS_FILE = path6.join(homeDir, ".node9", "decisions.json");
-    GLOBAL_CONFIG_FILE = path6.join(homeDir, ".node9", "config.json");
-    CREDENTIALS_FILE = path6.join(homeDir, ".node9", "credentials.json");
-    AUDIT_LOG_FILE = path6.join(homeDir, ".node9", "audit.log");
-    TRUST_FILE2 = path6.join(homeDir, ".node9", "trust.json");
+    DAEMON_PID_FILE = path7.join(homeDir, ".node9", "daemon.pid");
+    DECISIONS_FILE = path7.join(homeDir, ".node9", "decisions.json");
+    GLOBAL_CONFIG_FILE = path7.join(homeDir, ".node9", "config.json");
+    CREDENTIALS_FILE = path7.join(homeDir, ".node9", "credentials.json");
+    AUDIT_LOG_FILE = path7.join(homeDir, ".node9", "audit.log");
+    TRUST_FILE2 = path7.join(homeDir, ".node9", "trust.json");
     TRUST_DURATIONS = {
       "30m": 30 * 6e4,
       "1h": 60 * 6e4,
@@ -4675,11 +4827,11 @@ __export(tail_exports, {
 });
 import http2 from "http";
 import chalk5 from "chalk";
-import fs6 from "fs";
+import fs7 from "fs";
 import os6 from "os";
-import path8 from "path";
+import path9 from "path";
 import readline from "readline";
-import { spawn as spawn3 } from "child_process";
+import { spawn as spawn4 } from "child_process";
 function getIcon(tool) {
   const t = tool.toLowerCase();
   for (const [k, v] of Object.entries(ICONS)) {
@@ -4717,9 +4869,9 @@ function renderPending(activity) {
 }
 async function ensureDaemon() {
   let pidPort = null;
-  if (fs6.existsSync(PID_FILE)) {
+  if (fs7.existsSync(PID_FILE)) {
     try {
-      const { port } = JSON.parse(fs6.readFileSync(PID_FILE, "utf-8"));
+      const { port } = JSON.parse(fs7.readFileSync(PID_FILE, "utf-8"));
       pidPort = port;
     } catch {
       console.error(chalk5.dim("\u26A0\uFE0F  Could not read PID file; falling back to default port."));
@@ -4734,7 +4886,7 @@ async function ensureDaemon() {
   } catch {
   }
   console.log(chalk5.dim("\u{1F6E1}\uFE0F  Starting Node9 daemon..."));
-  const child = spawn3(process.execPath, [process.argv[1], "daemon"], {
+  const child = spawn4(process.execPath, [process.argv[1], "daemon"], {
     detached: true,
     stdio: "ignore",
     env: { ...process.env, NODE9_AUTO_STARTED: "1" }
@@ -4879,7 +5031,7 @@ var init_tail = __esm({
   "src/tui/tail.ts"() {
     "use strict";
     init_daemon();
-    PID_FILE = path8.join(os6.homedir(), ".node9", "daemon.pid");
+    PID_FILE = path9.join(os6.homedir(), ".node9", "daemon.pid");
     ICONS = {
       bash: "\u{1F4BB}",
       shell: "\u{1F4BB}",
@@ -4905,8 +5057,8 @@ init_core();
 import { Command } from "commander";
 
 // src/setup.ts
-import fs3 from "fs";
-import path5 from "path";
+import fs4 from "fs";
+import path6 from "path";
 import os3 from "os";
 import chalk3 from "chalk";
 import { confirm as confirm2 } from "@inquirer/prompts";
@@ -4924,17 +5076,17 @@ function fullPathCommand(subcommand) {
 }
 function readJson(filePath) {
   try {
-    if (fs3.existsSync(filePath)) {
-      return JSON.parse(fs3.readFileSync(filePath, "utf-8"));
+    if (fs4.existsSync(filePath)) {
+      return JSON.parse(fs4.readFileSync(filePath, "utf-8"));
     }
   } catch {
   }
   return null;
 }
 function writeJson(filePath, data) {
-  const dir = path5.dirname(filePath);
-  if (!fs3.existsSync(dir)) fs3.mkdirSync(dir, { recursive: true });
-  fs3.writeFileSync(filePath, JSON.stringify(data, null, 2) + "\n");
+  const dir = path6.dirname(filePath);
+  if (!fs4.existsSync(dir)) fs4.mkdirSync(dir, { recursive: true });
+  fs4.writeFileSync(filePath, JSON.stringify(data, null, 2) + "\n");
 }
 function isNode9Hook(cmd) {
   if (!cmd) return false;
@@ -4942,8 +5094,8 @@ function isNode9Hook(cmd) {
 }
 function teardownClaude() {
   const homeDir2 = os3.homedir();
-  const hooksPath = path5.join(homeDir2, ".claude", "settings.json");
-  const mcpPath = path5.join(homeDir2, ".claude.json");
+  const hooksPath = path6.join(homeDir2, ".claude", "settings.json");
+  const mcpPath = path6.join(homeDir2, ".claude.json");
   let changed = false;
   const settings = readJson(hooksPath);
   if (settings?.hooks) {
@@ -4992,7 +5144,7 @@ function teardownClaude() {
 }
 function teardownGemini() {
   const homeDir2 = os3.homedir();
-  const settingsPath = path5.join(homeDir2, ".gemini", "settings.json");
+  const settingsPath = path6.join(homeDir2, ".gemini", "settings.json");
   const settings = readJson(settingsPath);
   if (!settings) {
     console.log(chalk3.blue("  \u2139\uFE0F  ~/.gemini/settings.json not found \u2014 nothing to remove"));
@@ -5031,7 +5183,7 @@ function teardownGemini() {
 }
 function teardownCursor() {
   const homeDir2 = os3.homedir();
-  const mcpPath = path5.join(homeDir2, ".cursor", "mcp.json");
+  const mcpPath = path6.join(homeDir2, ".cursor", "mcp.json");
   const mcpConfig = readJson(mcpPath);
   if (!mcpConfig?.mcpServers) {
     console.log(chalk3.blue("  \u2139\uFE0F  ~/.cursor/mcp.json not found \u2014 nothing to remove"));
@@ -5058,8 +5210,8 @@ function teardownCursor() {
 }
 async function setupClaude() {
   const homeDir2 = os3.homedir();
-  const mcpPath = path5.join(homeDir2, ".claude.json");
-  const hooksPath = path5.join(homeDir2, ".claude", "settings.json");
+  const mcpPath = path6.join(homeDir2, ".claude.json");
+  const hooksPath = path6.join(homeDir2, ".claude", "settings.json");
   const claudeConfig = readJson(mcpPath) ?? {};
   const settings = readJson(hooksPath) ?? {};
   const servers = claudeConfig.mcpServers ?? {};
@@ -5134,7 +5286,7 @@ async function setupClaude() {
 }
 async function setupGemini() {
   const homeDir2 = os3.homedir();
-  const settingsPath = path5.join(homeDir2, ".gemini", "settings.json");
+  const settingsPath = path6.join(homeDir2, ".gemini", "settings.json");
   const settings = readJson(settingsPath) ?? {};
   const servers = settings.mcpServers ?? {};
   let anythingChanged = false;
@@ -5217,7 +5369,7 @@ async function setupGemini() {
 }
 async function setupCursor() {
   const homeDir2 = os3.homedir();
-  const mcpPath = path5.join(homeDir2, ".cursor", "mcp.json");
+  const mcpPath = path6.join(homeDir2, ".cursor", "mcp.json");
   const mcpConfig = readJson(mcpPath) ?? {};
   const servers = mcpConfig.mcpServers ?? {};
   let anythingChanged = false;
@@ -5273,35 +5425,37 @@ async function setupCursor() {
 
 // src/cli.ts
 init_daemon();
-import { spawn as spawn4, execSync } from "child_process";
+import { spawn as spawn5, execSync } from "child_process";
 import { parseCommandString } from "execa";
 import { execa } from "execa";
 import chalk6 from "chalk";
 import readline2 from "readline";
-import fs7 from "fs";
-import path9 from "path";
+import fs8 from "fs";
+import path10 from "path";
 import os7 from "os";
 
 // src/undo.ts
-import { spawnSync as spawnSync3 } from "child_process";
-import fs5 from "fs";
-import path7 from "path";
+import { spawnSync as spawnSync3, spawn as spawn3 } from "child_process";
+import crypto2 from "crypto";
+import fs6 from "fs";
+import path8 from "path";
 import os5 from "os";
-var SNAPSHOT_STACK_PATH = path7.join(os5.homedir(), ".node9", "snapshots.json");
-var UNDO_LATEST_PATH = path7.join(os5.homedir(), ".node9", "undo_latest.txt");
+var SNAPSHOT_STACK_PATH = path8.join(os5.homedir(), ".node9", "snapshots.json");
+var UNDO_LATEST_PATH = path8.join(os5.homedir(), ".node9", "undo_latest.txt");
 var MAX_SNAPSHOTS = 10;
+var GIT_TIMEOUT = 15e3;
 function readStack() {
   try {
-    if (fs5.existsSync(SNAPSHOT_STACK_PATH))
-      return JSON.parse(fs5.readFileSync(SNAPSHOT_STACK_PATH, "utf-8"));
+    if (fs6.existsSync(SNAPSHOT_STACK_PATH))
+      return JSON.parse(fs6.readFileSync(SNAPSHOT_STACK_PATH, "utf-8"));
   } catch {
   }
   return [];
 }
 function writeStack(stack) {
-  const dir = path7.dirname(SNAPSHOT_STACK_PATH);
-  if (!fs5.existsSync(dir)) fs5.mkdirSync(dir, { recursive: true });
-  fs5.writeFileSync(SNAPSHOT_STACK_PATH, JSON.stringify(stack, null, 2));
+  const dir = path8.dirname(SNAPSHOT_STACK_PATH);
+  if (!fs6.existsSync(dir)) fs6.mkdirSync(dir, { recursive: true });
+  fs6.writeFileSync(SNAPSHOT_STACK_PATH, JSON.stringify(stack, null, 2));
 }
 function buildArgsSummary(tool, args) {
   if (!args || typeof args !== "object") return "";
@@ -5314,54 +5468,177 @@ function buildArgsSummary(tool, args) {
   if (typeof sql === "string") return sql.slice(0, 80);
   return tool;
 }
-async function createShadowSnapshot(tool = "unknown", args = {}) {
+function normalizeCwdForHash(cwd) {
+  let normalized;
+  try {
+    normalized = fs6.realpathSync(cwd);
+  } catch {
+    normalized = cwd;
+  }
+  normalized = normalized.replace(/\\/g, "/");
+  if (process.platform === "win32") normalized = normalized.toLowerCase();
+  return normalized;
+}
+function getShadowRepoDir(cwd) {
+  const hash = crypto2.createHash("sha256").update(normalizeCwdForHash(cwd)).digest("hex").slice(0, 16);
+  return path8.join(os5.homedir(), ".node9", "snapshots", hash);
+}
+function cleanOrphanedIndexFiles(shadowDir) {
+  try {
+    const cutoff = Date.now() - 6e4;
+    for (const f of fs6.readdirSync(shadowDir)) {
+      if (f.startsWith("index_")) {
+        const fp = path8.join(shadowDir, f);
+        try {
+          if (fs6.statSync(fp).mtimeMs < cutoff) fs6.unlinkSync(fp);
+        } catch {
+        }
+      }
+    }
+  } catch {
+  }
+}
+function writeShadowExcludes(shadowDir, ignorePaths) {
+  const hardcoded = [".git", ".node9"];
+  const lines = [...hardcoded, ...ignorePaths].join("\n");
+  try {
+    fs6.writeFileSync(path8.join(shadowDir, "info", "exclude"), lines + "\n", "utf8");
+  } catch {
+  }
+}
+function ensureShadowRepo(shadowDir, cwd) {
+  cleanOrphanedIndexFiles(shadowDir);
+  const normalizedCwd = normalizeCwdForHash(cwd);
+  const shadowEnvBase = { ...process.env, GIT_DIR: shadowDir, GIT_WORK_TREE: cwd };
+  const check = spawnSync3("git", ["rev-parse", "--git-dir"], {
+    env: shadowEnvBase,
+    timeout: 3e3
+  });
+  if (check.status === 0) {
+    const ptPath = path8.join(shadowDir, "project-path.txt");
+    try {
+      const stored = fs6.readFileSync(ptPath, "utf8").trim();
+      if (stored === normalizedCwd) return true;
+      if (process.env.NODE9_DEBUG === "1")
+        console.error(
+          `[Node9] Shadow repo path mismatch: stored="${stored}" expected="${normalizedCwd}" \u2014 reinitializing`
+        );
+      fs6.rmSync(shadowDir, { recursive: true, force: true });
+    } catch {
+      try {
+        fs6.writeFileSync(ptPath, normalizedCwd, "utf8");
+      } catch {
+      }
+      return true;
+    }
+  }
+  try {
+    fs6.mkdirSync(shadowDir, { recursive: true });
+  } catch {
+  }
+  const init = spawnSync3("git", ["init", "--bare", shadowDir], { timeout: 5e3 });
+  if (init.status !== 0) {
+    if (process.env.NODE9_DEBUG === "1")
+      console.error("[Node9] git init --bare failed:", init.stderr?.toString());
+    return false;
+  }
+  const configFile = path8.join(shadowDir, "config");
+  spawnSync3("git", ["config", "--file", configFile, "core.untrackedCache", "true"], {
+    timeout: 3e3
+  });
+  spawnSync3("git", ["config", "--file", configFile, "core.fsmonitor", "true"], {
+    timeout: 3e3
+  });
+  try {
+    fs6.writeFileSync(path8.join(shadowDir, "project-path.txt"), normalizedCwd, "utf8");
+  } catch {
+  }
+  return true;
+}
+function buildGitEnv(cwd) {
+  const shadowDir = getShadowRepoDir(cwd);
+  const check = spawnSync3("git", ["rev-parse", "--git-dir"], {
+    env: { ...process.env, GIT_DIR: shadowDir, GIT_WORK_TREE: cwd },
+    timeout: 2e3
+  });
+  if (check.status === 0) {
+    return { ...process.env, GIT_DIR: shadowDir, GIT_WORK_TREE: cwd };
+  }
+  return { ...process.env };
+}
+async function createShadowSnapshot(tool = "unknown", args = {}, ignorePaths = []) {
+  let indexFile = null;
   try {
     const cwd = process.cwd();
-    if (!fs5.existsSync(path7.join(cwd, ".git"))) return null;
-    const tempIndex = path7.join(cwd, ".git", `node9_index_${Date.now()}`);
-    const env = { ...process.env, GIT_INDEX_FILE: tempIndex };
-    spawnSync3("git", ["add", "-A"], { env });
-    const treeRes = spawnSync3("git", ["write-tree"], { env });
-    const treeHash = treeRes.stdout.toString().trim();
-    if (fs5.existsSync(tempIndex)) fs5.unlinkSync(tempIndex);
+    const shadowDir = getShadowRepoDir(cwd);
+    if (!ensureShadowRepo(shadowDir, cwd)) return null;
+    writeShadowExcludes(shadowDir, ignorePaths);
+    indexFile = path8.join(shadowDir, `index_${process.pid}_${Date.now()}`);
+    const shadowEnv = {
+      ...process.env,
+      GIT_DIR: shadowDir,
+      GIT_WORK_TREE: cwd,
+      GIT_INDEX_FILE: indexFile
+    };
+    spawnSync3("git", ["add", "-A"], { env: shadowEnv, timeout: GIT_TIMEOUT });
+    const treeRes = spawnSync3("git", ["write-tree"], { env: shadowEnv, timeout: GIT_TIMEOUT });
+    const treeHash = treeRes.stdout?.toString().trim();
     if (!treeHash || treeRes.status !== 0) return null;
-    const commitRes = spawnSync3("git", [
-      "commit-tree",
-      treeHash,
-      "-m",
-      `Node9 AI Snapshot: ${(/* @__PURE__ */ new Date()).toISOString()}`
-    ]);
-    const commitHash = commitRes.stdout.toString().trim();
+    const commitRes = spawnSync3(
+      "git",
+      ["commit-tree", treeHash, "-m", `Node9 AI Snapshot: ${(/* @__PURE__ */ new Date()).toISOString()}`],
+      { env: shadowEnv, timeout: GIT_TIMEOUT }
+    );
+    const commitHash = commitRes.stdout?.toString().trim();
     if (!commitHash || commitRes.status !== 0) return null;
     const stack = readStack();
-    const entry = {
+    stack.push({
       hash: commitHash,
       tool,
       argsSummary: buildArgsSummary(tool, args),
       cwd,
       timestamp: Date.now()
-    };
-    stack.push(entry);
+    });
+    const shouldGc = stack.length % 5 === 0;
     if (stack.length > MAX_SNAPSHOTS) stack.splice(0, stack.length - MAX_SNAPSHOTS);
     writeStack(stack);
-    fs5.writeFileSync(UNDO_LATEST_PATH, commitHash);
+    fs6.writeFileSync(UNDO_LATEST_PATH, commitHash);
+    if (shouldGc) {
+      spawn3("git", ["gc", "--auto"], { env: shadowEnv, detached: true, stdio: "ignore" }).unref();
+    }
     return commitHash;
   } catch (err) {
     if (process.env.NODE9_DEBUG === "1") console.error("[Node9 Undo Engine Error]:", err);
+    return null;
+  } finally {
+    if (indexFile) {
+      try {
+        fs6.unlinkSync(indexFile);
+      } catch {
+      }
+    }
   }
-  return null;
 }
 function getSnapshotHistory() {
   return readStack();
 }
 function computeUndoDiff(hash, cwd) {
   try {
-    const result = spawnSync3("git", ["diff", hash, "--stat", "--", "."], { cwd });
-    const stat = result.stdout.toString().trim();
-    if (!stat) return null;
-    const diff = spawnSync3("git", ["diff", hash, "--", "."], { cwd });
-    const raw = diff.stdout.toString();
-    if (!raw) return null;
+    const env = buildGitEnv(cwd);
+    const statRes = spawnSync3("git", ["diff", hash, "--stat", "--", "."], {
+      cwd,
+      env,
+      timeout: GIT_TIMEOUT
+    });
+    const stat = statRes.stdout?.toString().trim();
+    if (!stat || statRes.status !== 0) return null;
+    const diffRes = spawnSync3("git", ["diff", hash, "--", "."], {
+      cwd,
+      env,
+      timeout: GIT_TIMEOUT
+    });
+    const raw = diffRes.stdout?.toString();
+    if (!raw || diffRes.status !== 0) return null;
     const lines = raw.split("\n").filter(
       (l) => !l.startsWith("diff --git") && !l.startsWith("index ") && !l.startsWith("Binary")
     );
@@ -5373,18 +5650,31 @@ function computeUndoDiff(hash, cwd) {
 function applyUndo(hash, cwd) {
   try {
     const dir = cwd ?? process.cwd();
+    const env = buildGitEnv(dir);
     const restore = spawnSync3("git", ["restore", "--source", hash, "--staged", "--worktree", "."], {
-      cwd: dir
+      cwd: dir,
+      env,
+      timeout: GIT_TIMEOUT
     });
     if (restore.status !== 0) return false;
-    const lsTree = spawnSync3("git", ["ls-tree", "-r", "--name-only", hash], { cwd: dir });
-    const snapshotFiles = new Set(lsTree.stdout.toString().trim().split("\n").filter(Boolean));
-    const tracked = spawnSync3("git", ["ls-files"], { cwd: dir }).stdout.toString().trim().split("\n").filter(Boolean);
-    const untracked = spawnSync3("git", ["ls-files", "--others", "--exclude-standard"], { cwd: dir }).stdout.toString().trim().split("\n").filter(Boolean);
+    const lsTree = spawnSync3("git", ["ls-tree", "-r", "--name-only", hash], {
+      cwd: dir,
+      env,
+      timeout: GIT_TIMEOUT
+    });
+    const snapshotFiles = new Set(
+      lsTree.stdout?.toString().trim().split("\n").filter(Boolean) ?? []
+    );
+    const tracked = spawnSync3("git", ["ls-files"], { cwd: dir, env, timeout: GIT_TIMEOUT }).stdout?.toString().trim().split("\n").filter(Boolean) ?? [];
+    const untracked = spawnSync3("git", ["ls-files", "--others", "--exclude-standard"], {
+      cwd: dir,
+      env,
+      timeout: GIT_TIMEOUT
+    }).stdout?.toString().trim().split("\n").filter(Boolean) ?? [];
     for (const file of [...tracked, ...untracked]) {
-      const fullPath = path7.join(dir, file);
-      if (!snapshotFiles.has(file) && fs5.existsSync(fullPath)) {
-        fs5.unlinkSync(fullPath);
+      const fullPath = path8.join(dir, file);
+      if (!snapshotFiles.has(file) && fs6.existsSync(fullPath)) {
+        fs6.unlinkSync(fullPath);
       }
     }
     return true;
@@ -5397,7 +5687,7 @@ function applyUndo(hash, cwd) {
 init_shields();
 import { confirm as confirm3 } from "@inquirer/prompts";
 var { version } = JSON.parse(
-  fs7.readFileSync(path9.join(__dirname, "../package.json"), "utf-8")
+  fs8.readFileSync(path10.join(__dirname, "../package.json"), "utf-8")
 );
 function parseDuration(str) {
   const m = str.trim().match(/^(\d+(?:\.\d+)?)\s*(s|m|h|d)?$/i);
@@ -5493,7 +5783,7 @@ function openBrowserLocal() {
 }
 async function autoStartDaemonAndWait() {
   try {
-    const child = spawn4("node9", ["daemon"], {
+    const child = spawn5("node9", ["daemon"], {
       detached: true,
       stdio: "ignore",
       env: { ...process.env, NODE9_AUTO_STARTED: "1" }
@@ -5530,7 +5820,7 @@ async function runProxy(targetCommand) {
   } catch {
   }
   console.log(chalk6.green(`\u{1F680} Node9 Proxy Active: Monitoring [${targetCommand}]`));
-  const child = spawn4(executable, args, {
+  const child = spawn5(executable, args, {
     stdio: ["pipe", "pipe", "inherit"],
     // We control STDIN and STDOUT
     shell: false,
@@ -5599,14 +5889,14 @@ async function runProxy(targetCommand) {
 }
 program.command("login").argument("<apiKey>").option("--local", "Save key for audit/logging only \u2014 local config still controls all decisions").option("--profile <name>", 'Save as a named profile (default: "default")').action((apiKey, options) => {
   const DEFAULT_API_URL = "https://api.node9.ai/api/v1/intercept";
-  const credPath = path9.join(os7.homedir(), ".node9", "credentials.json");
-  if (!fs7.existsSync(path9.dirname(credPath)))
-    fs7.mkdirSync(path9.dirname(credPath), { recursive: true });
+  const credPath = path10.join(os7.homedir(), ".node9", "credentials.json");
+  if (!fs8.existsSync(path10.dirname(credPath)))
+    fs8.mkdirSync(path10.dirname(credPath), { recursive: true });
   const profileName = options.profile || "default";
   let existingCreds = {};
   try {
-    if (fs7.existsSync(credPath)) {
-      const raw = JSON.parse(fs7.readFileSync(credPath, "utf-8"));
+    if (fs8.existsSync(credPath)) {
+      const raw = JSON.parse(fs8.readFileSync(credPath, "utf-8"));
       if (raw.apiKey) {
         existingCreds = {
           default: { apiKey: raw.apiKey, apiUrl: raw.apiUrl || DEFAULT_API_URL }
@@ -5618,13 +5908,13 @@ program.command("login").argument("<apiKey>").option("--local", "Save key for au
   } catch {
   }
   existingCreds[profileName] = { apiKey, apiUrl: DEFAULT_API_URL };
-  fs7.writeFileSync(credPath, JSON.stringify(existingCreds, null, 2), { mode: 384 });
+  fs8.writeFileSync(credPath, JSON.stringify(existingCreds, null, 2), { mode: 384 });
   if (profileName === "default") {
-    const configPath = path9.join(os7.homedir(), ".node9", "config.json");
+    const configPath = path10.join(os7.homedir(), ".node9", "config.json");
     let config = {};
     try {
-      if (fs7.existsSync(configPath))
-        config = JSON.parse(fs7.readFileSync(configPath, "utf-8"));
+      if (fs8.existsSync(configPath))
+        config = JSON.parse(fs8.readFileSync(configPath, "utf-8"));
     } catch {
     }
     if (!config.settings || typeof config.settings !== "object") config.settings = {};
@@ -5639,9 +5929,9 @@ program.command("login").argument("<apiKey>").option("--local", "Save key for au
       approvers.cloud = false;
     }
     s.approvers = approvers;
-    if (!fs7.existsSync(path9.dirname(configPath)))
-      fs7.mkdirSync(path9.dirname(configPath), { recursive: true });
-    fs7.writeFileSync(configPath, JSON.stringify(config, null, 2), { mode: 384 });
+    if (!fs8.existsSync(path10.dirname(configPath)))
+      fs8.mkdirSync(path10.dirname(configPath), { recursive: true });
+    fs8.writeFileSync(configPath, JSON.stringify(config, null, 2), { mode: 384 });
   }
   if (options.profile && profileName !== "default") {
     console.log(chalk6.green(`\u2705 Profile "${profileName}" saved`));
@@ -5727,15 +6017,15 @@ program.command("uninstall").description("Remove all Node9 hooks and optionally
     }
   }
   if (options.purge) {
-    const node9Dir = path9.join(os7.homedir(), ".node9");
-    if (fs7.existsSync(node9Dir)) {
+    const node9Dir = path10.join(os7.homedir(), ".node9");
+    if (fs8.existsSync(node9Dir)) {
       const confirmed = await confirm3({
         message: `Permanently delete ${node9Dir} (config, audit log, credentials)?`,
         default: false
       });
       if (confirmed) {
-        fs7.rmSync(node9Dir, { recursive: true });
-        if (fs7.existsSync(node9Dir)) {
+        fs8.rmSync(node9Dir, { recursive: true });
+        if (fs8.existsSync(node9Dir)) {
           console.error(
             chalk6.red("\n  \u26A0\uFE0F  ~/.node9/ could not be fully deleted \u2014 remove it manually.")
           );
@@ -5807,10 +6097,10 @@ program.command("doctor").description("Check that Node9 is installed and configu
     );
   }
   section("Configuration");
-  const globalConfigPath = path9.join(homeDir2, ".node9", "config.json");
-  if (fs7.existsSync(globalConfigPath)) {
+  const globalConfigPath = path10.join(homeDir2, ".node9", "config.json");
+  if (fs8.existsSync(globalConfigPath)) {
     try {
-      JSON.parse(fs7.readFileSync(globalConfigPath, "utf-8"));
+      JSON.parse(fs8.readFileSync(globalConfigPath, "utf-8"));
       pass("~/.node9/config.json found and valid");
     } catch {
       fail("~/.node9/config.json is invalid JSON", "Run: node9 init --force");
@@ -5818,17 +6108,17 @@ program.command("doctor").description("Check that Node9 is installed and configu
   } else {
     warn("~/.node9/config.json not found (using defaults)", "Run: node9 init");
   }
-  const projectConfigPath = path9.join(process.cwd(), "node9.config.json");
-  if (fs7.existsSync(projectConfigPath)) {
+  const projectConfigPath = path10.join(process.cwd(), "node9.config.json");
+  if (fs8.existsSync(projectConfigPath)) {
     try {
-      JSON.parse(fs7.readFileSync(projectConfigPath, "utf-8"));
+      JSON.parse(fs8.readFileSync(projectConfigPath, "utf-8"));
       pass("node9.config.json found and valid (project)");
     } catch {
       fail("node9.config.json is invalid JSON", "Fix the JSON or delete it and run: node9 init");
     }
   }
-  const credsPath = path9.join(homeDir2, ".node9", "credentials.json");
-  if (fs7.existsSync(credsPath)) {
+  const credsPath = path10.join(homeDir2, ".node9", "credentials.json");
+  if (fs8.existsSync(credsPath)) {
     pass("Cloud credentials found (~/.node9/credentials.json)");
   } else {
     warn(
@@ -5837,10 +6127,10 @@ program.command("doctor").description("Check that Node9 is installed and configu
     );
   }
   section("Agent Hooks");
-  const claudeSettingsPath = path9.join(homeDir2, ".claude", "settings.json");
-  if (fs7.existsSync(claudeSettingsPath)) {
+  const claudeSettingsPath = path10.join(homeDir2, ".claude", "settings.json");
+  if (fs8.existsSync(claudeSettingsPath)) {
     try {
-      const cs = JSON.parse(fs7.readFileSync(claudeSettingsPath, "utf-8"));
+      const cs = JSON.parse(fs8.readFileSync(claudeSettingsPath, "utf-8"));
       const hasHook = cs.hooks?.PreToolUse?.some(
         (m) => m.hooks.some((h) => h.command?.includes("node9") || h.command?.includes("cli.js"))
       );
@@ -5853,10 +6143,10 @@ program.command("doctor").description("Check that Node9 is installed and configu
   } else {
     warn("Claude Code \u2014 not configured", "Run: node9 setup claude");
   }
-  const geminiSettingsPath = path9.join(homeDir2, ".gemini", "settings.json");
-  if (fs7.existsSync(geminiSettingsPath)) {
+  const geminiSettingsPath = path10.join(homeDir2, ".gemini", "settings.json");
+  if (fs8.existsSync(geminiSettingsPath)) {
     try {
-      const gs = JSON.parse(fs7.readFileSync(geminiSettingsPath, "utf-8"));
+      const gs = JSON.parse(fs8.readFileSync(geminiSettingsPath, "utf-8"));
       const hasHook = gs.hooks?.BeforeTool?.some(
         (m) => m.hooks.some((h) => h.command?.includes("node9") || h.command?.includes("cli.js"))
       );
@@ -5869,10 +6159,10 @@ program.command("doctor").description("Check that Node9 is installed and configu
   } else {
     warn("Gemini CLI  \u2014 not configured", "Run: node9 setup gemini  (skip if not using Gemini)");
   }
-  const cursorHooksPath = path9.join(homeDir2, ".cursor", "hooks.json");
-  if (fs7.existsSync(cursorHooksPath)) {
+  const cursorHooksPath = path10.join(homeDir2, ".cursor", "hooks.json");
+  if (fs8.existsSync(cursorHooksPath)) {
     try {
-      const cur = JSON.parse(fs7.readFileSync(cursorHooksPath, "utf-8"));
+      const cur = JSON.parse(fs8.readFileSync(cursorHooksPath, "utf-8"));
       const hasHook = cur.hooks?.preToolUse?.some(
         (h) => h.command?.includes("node9") || h.command?.includes("cli.js")
       );
@@ -5974,8 +6264,8 @@ program.command("explain").description(
   console.log("");
 });
 program.command("init").description("Create ~/.node9/config.json with default policy (safe to run multiple times)").option("--force", "Overwrite existing config").option("-m, --mode <mode>", "Set initial security mode (standard, strict, audit)", "standard").action((options) => {
-  const configPath = path9.join(os7.homedir(), ".node9", "config.json");
-  if (fs7.existsSync(configPath) && !options.force) {
+  const configPath = path10.join(os7.homedir(), ".node9", "config.json");
+  if (fs8.existsSync(configPath) && !options.force) {
     console.log(chalk6.yellow(`\u2139\uFE0F  Global config already exists: ${configPath}`));
     console.log(chalk6.gray(`   Run with --force to overwrite.`));
     return;
@@ -5989,9 +6279,9 @@ program.command("init").description("Create ~/.node9/config.json with default po
       mode: safeMode
     }
   };
-  const dir = path9.dirname(configPath);
-  if (!fs7.existsSync(dir)) fs7.mkdirSync(dir, { recursive: true });
-  fs7.writeFileSync(configPath, JSON.stringify(configToSave, null, 2));
+  const dir = path10.dirname(configPath);
+  if (!fs8.existsSync(dir)) fs8.mkdirSync(dir, { recursive: true });
+  fs8.writeFileSync(configPath, JSON.stringify(configToSave, null, 2));
   console.log(chalk6.green(`\u2705 Global config created: ${configPath}`));
   console.log(chalk6.cyan(`   Mode set to: ${safeMode}`));
   console.log(
@@ -6009,14 +6299,14 @@ function formatRelativeTime(timestamp) {
   return new Date(timestamp).toLocaleDateString();
 }
 program.command("audit").description("View local execution audit log").option("--tail <n>", "Number of entries to show", "20").option("--tool <pattern>", "Filter by tool name (substring match)").option("--deny", "Show only denied actions").option("--json", "Output raw JSON").action((options) => {
-  const logPath = path9.join(os7.homedir(), ".node9", "audit.log");
-  if (!fs7.existsSync(logPath)) {
+  const logPath = path10.join(os7.homedir(), ".node9", "audit.log");
+  if (!fs8.existsSync(logPath)) {
     console.log(
       chalk6.yellow("No audit logs found. Run node9 with an agent to generate entries.")
     );
     return;
   }
-  const raw = fs7.readFileSync(logPath, "utf-8");
+  const raw = fs8.readFileSync(logPath, "utf-8");
   const lines = raw.split("\n").filter((l) => l.trim() !== "");
   let entries = lines.flatMap((line) => {
     try {
@@ -6099,13 +6389,13 @@ program.command("status").description("Show current Node9 mode, policy source, a
   console.log("");
   const modeLabel = settings.mode === "audit" ? chalk6.blue("audit") : settings.mode === "strict" ? chalk6.red("strict") : chalk6.white("standard");
   console.log(`  Mode:    ${modeLabel}`);
-  const projectConfig = path9.join(process.cwd(), "node9.config.json");
-  const globalConfig = path9.join(os7.homedir(), ".node9", "config.json");
+  const projectConfig = path10.join(process.cwd(), "node9.config.json");
+  const globalConfig = path10.join(os7.homedir(), ".node9", "config.json");
   console.log(
-    `  Local:   ${fs7.existsSync(projectConfig) ? chalk6.green("Active (node9.config.json)") : chalk6.gray("Not present")}`
+    `  Local:   ${fs8.existsSync(projectConfig) ? chalk6.green("Active (node9.config.json)") : chalk6.gray("Not present")}`
   );
   console.log(
-    `  Global:  ${fs7.existsSync(globalConfig) ? chalk6.green("Active (~/.node9/config.json)") : chalk6.gray("Not present")}`
+    `  Global:  ${fs8.existsSync(globalConfig) ? chalk6.green("Active (~/.node9/config.json)") : chalk6.gray("Not present")}`
   );
   if (mergedConfig.policy.sandboxPaths.length > 0) {
     console.log(
@@ -6149,7 +6439,7 @@ program.command("daemon").description("Run the local approval server").argument(
         console.log(chalk6.green(`\u{1F310}  Opened browser: http://${DAEMON_HOST2}:${DAEMON_PORT2}/`));
         process.exit(0);
       }
-      const child = spawn4("node9", ["daemon"], { detached: true, stdio: "ignore" });
+      const child = spawn5("node9", ["daemon"], { detached: true, stdio: "ignore" });
       child.unref();
       for (let i = 0; i < 12; i++) {
         await new Promise((r) => setTimeout(r, 250));
@@ -6161,7 +6451,7 @@ program.command("daemon").description("Run the local approval server").argument(
       process.exit(0);
     }
     if (options.background) {
-      const child = spawn4("node9", ["daemon"], { detached: true, stdio: "ignore" });
+      const child = spawn5("node9", ["daemon"], { detached: true, stdio: "ignore" });
       child.unref();
       console.log(chalk6.green(`
 \u{1F6E1}\uFE0F  Node9 daemon started in background  (PID ${child.pid})`));
@@ -6189,9 +6479,9 @@ program.command("check").description("Hook handler \u2014 evaluates a tool call
       } catch (err) {
         const tempConfig = getConfig();
         if (process.env.NODE9_DEBUG === "1" || tempConfig.settings.enableHookLogDebug) {
-          const logPath = path9.join(os7.homedir(), ".node9", "hook-debug.log");
+          const logPath = path10.join(os7.homedir(), ".node9", "hook-debug.log");
           const errMsg = err instanceof Error ? err.message : String(err);
-          fs7.appendFileSync(
+          fs8.appendFileSync(
             logPath,
             `[${(/* @__PURE__ */ new Date()).toISOString()}] JSON_PARSE_ERROR: ${errMsg}
 RAW: ${raw}
@@ -6209,10 +6499,10 @@ RAW: ${raw}
       }
       const config = getConfig();
       if (process.env.NODE9_DEBUG === "1" || config.settings.enableHookLogDebug) {
-        const logPath = path9.join(os7.homedir(), ".node9", "hook-debug.log");
-        if (!fs7.existsSync(path9.dirname(logPath)))
-          fs7.mkdirSync(path9.dirname(logPath), { recursive: true });
-        fs7.appendFileSync(logPath, `[${(/* @__PURE__ */ new Date()).toISOString()}] STDIN: ${raw}
+        const logPath = path10.join(os7.homedir(), ".node9", "hook-debug.log");
+        if (!fs8.existsSync(path10.dirname(logPath)))
+          fs8.mkdirSync(path10.dirname(logPath), { recursive: true });
+        fs8.appendFileSync(logPath, `[${(/* @__PURE__ */ new Date()).toISOString()}] STDIN: ${raw}
 `);
       }
       const toolName = sanitize(payload.tool_name ?? payload.name ?? "");
@@ -6256,7 +6546,7 @@ RAW: ${raw}
       }
       const meta = { agent, mcpServer };
       if (shouldSnapshot(toolName, toolInput, config)) {
-        await createShadowSnapshot(toolName, toolInput);
+        await createShadowSnapshot(toolName, toolInput, config.policy.snapshot.ignorePaths);
       }
       const result = await authorizeHeadless(toolName, toolInput, false, meta);
       if (result.approved) {
@@ -6289,9 +6579,9 @@ RAW: ${raw}
       });
     } catch (err) {
       if (process.env.NODE9_DEBUG === "1") {
-        const logPath = path9.join(os7.homedir(), ".node9", "hook-debug.log");
+        const logPath = path10.join(os7.homedir(), ".node9", "hook-debug.log");
         const errMsg = err instanceof Error ? err.message : String(err);
-        fs7.appendFileSync(logPath, `[${(/* @__PURE__ */ new Date()).toISOString()}] ERROR: ${errMsg}
+        fs8.appendFileSync(logPath, `[${(/* @__PURE__ */ new Date()).toISOString()}] ERROR: ${errMsg}
 `);
       }
       process.exit(0);
@@ -6336,13 +6626,13 @@ program.command("log").description("PostToolUse hook \u2014 records executed too
         decision: "allowed",
         source: "post-hook"
       };
-      const logPath = path9.join(os7.homedir(), ".node9", "audit.log");
-      if (!fs7.existsSync(path9.dirname(logPath)))
-        fs7.mkdirSync(path9.dirname(logPath), { recursive: true });
-      fs7.appendFileSync(logPath, JSON.stringify(entry) + "\n");
+      const logPath = path10.join(os7.homedir(), ".node9", "audit.log");
+      if (!fs8.existsSync(path10.dirname(logPath)))
+        fs8.mkdirSync(path10.dirname(logPath), { recursive: true });
+      fs8.appendFileSync(logPath, JSON.stringify(entry) + "\n");
       const config = getConfig();
       if (shouldSnapshot(tool, {}, config)) {
-        await createShadowSnapshot();
+        await createShadowSnapshot("unknown", {}, config.policy.snapshot.ignorePaths);
       }
     } catch {
     }
@@ -6615,9 +6905,9 @@ process.on("unhandledRejection", (reason) => {
   const isCheckHook = process.argv[2] === "check";
   if (isCheckHook) {
     if (process.env.NODE9_DEBUG === "1" || getConfig().settings.enableHookLogDebug) {
-      const logPath = path9.join(os7.homedir(), ".node9", "hook-debug.log");
+      const logPath = path10.join(os7.homedir(), ".node9", "hook-debug.log");
       const msg = reason instanceof Error ? reason.message : String(reason);
-      fs7.appendFileSync(logPath, `[${(/* @__PURE__ */ new Date()).toISOString()}] UNHANDLED: ${msg}
+      fs8.appendFileSync(logPath, `[${(/* @__PURE__ */ new Date()).toISOString()}] UNHANDLED: ${msg}
 `);
     }
     process.exit(0);