@node9/proxy 1.1.6 → 1.1.7

package/dist/cli.mjs

@@ -120,7 +120,6 @@ var init_context_sniper = __esm({
 // src/ui/native.ts
 import { spawn } from "child_process";
 import path2 from "path";
-import chalk from "chalk";
 function formatArgs(args, matchedField, matchedWord) {
   if (args === null || args === void 0) return { message: "(none)", intent: "EXEC" };
   let parsed = args;
@@ -199,21 +198,6 @@ ${smartTruncate(str, 500)}`
   }
   return { intent: "EXEC", message: smartTruncate(JSON.stringify(parsed), 200) };
 }
-function sendDesktopNotification(title, body) {
-  if (isTestEnv()) return;
-  try {
-    if (process.platform === "darwin") {
-      const script = `display notification "${body.replace(/"/g, '\\"')}" with title "${title.replace(/"/g, '\\"')}"`;
-      spawn("osascript", ["-e", script], { detached: true, stdio: "ignore" }).unref();
-    } else if (process.platform === "linux") {
-      spawn("notify-send", [title, body, "--icon=dialog-warning"], {
-        detached: true,
-        stdio: "ignore"
-      }).unref();
-    }
-  } catch {
-  }
-}
 function escapePango(text) {
   return text.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
 }
@@ -256,9 +240,6 @@ async function askNativePopup(toolName, args, agent, explainableLabel, locked =
   const intentLabel = intent === "EDIT" ? "Code Edit" : "Action Approval";
   const title = locked ? `\u26A1 Node9 \u2014 Locked` : `\u{1F6E1}\uFE0F Node9 \u2014 ${intentLabel}`;
   const message = buildPlainMessage(toolName, formattedArgs, agent, explainableLabel, locked);
-  process.stderr.write(chalk.yellow(`
-\u{1F6E1}\uFE0F  Node9: Intercepted "${toolName}" \u2014 awaiting user...
-`));
   return new Promise((resolve) => {
     let childProcess = null;
     const onAbort = () => {
@@ -422,6 +403,7 @@ var init_config_schema = __esm({
         enableUndo: z.boolean().optional(),
         enableHookLogDebug: z.boolean().optional(),
         approvalTimeoutMs: z.number().nonnegative().optional(),
+        approvalTimeoutSeconds: z.number().nonnegative().optional(),
         flightRecorder: z.boolean().optional(),
         approvers: z.object({
           native: z.boolean().optional(),
@@ -890,8 +872,6 @@ var init_dlp = __esm({
 });
 
 // src/core.ts
-import chalk2 from "chalk";
-import { confirm } from "@inquirer/prompts";
 import fs3 from "fs";
 import path5 from "path";
 import os2 from "os";
@@ -1654,14 +1634,12 @@ function getPersistentDecision(toolName) {
   }
   return null;
 }
-async function askDaemon(toolName, args, meta, signal, riskMetadata, activityId) {
+async function registerDaemonEntry(toolName, args, meta, riskMetadata, activityId, cwd) {
   const base = `http://${DAEMON_HOST}:${DAEMON_PORT}`;
-  const checkCtrl = new AbortController();
-  const checkTimer = setTimeout(() => checkCtrl.abort(), 5e3);
-  const onAbort = () => checkCtrl.abort();
-  if (signal) signal.addEventListener("abort", onAbort);
+  const ctrl = new AbortController();
+  const timer = setTimeout(() => ctrl.abort(), 5e3);
   try {
-    const checkRes = await fetch(`${base}/check`, {
+    const res = await fetch(`${base}/check`, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
       body: JSON.stringify({
@@ -1672,32 +1650,34 @@ async function askDaemon(toolName, args, meta, signal, riskMetadata, activityId)
         fromCLI: true,
         // Pass the flight-recorder ID so the daemon uses the same UUID for
         // activity-result as the CLI used for the pending activity event.
-        // Without this, the two UUIDs never match and tail.ts never resolves
-        // the pending item.
         activityId,
-        ...riskMetadata && { riskMetadata }
+        ...riskMetadata && { riskMetadata },
+        ...cwd && { cwd }
       }),
-      signal: checkCtrl.signal
+      signal: ctrl.signal
     });
-    if (!checkRes.ok) throw new Error("Daemon fail");
-    const { id } = await checkRes.json();
-    const waitCtrl = new AbortController();
-    const waitTimer = setTimeout(() => waitCtrl.abort(), 12e4);
-    const onWaitAbort = () => waitCtrl.abort();
-    if (signal) signal.addEventListener("abort", onWaitAbort);
-    try {
-      const waitRes = await fetch(`${base}/wait/${id}`, { signal: waitCtrl.signal });
-      if (!waitRes.ok) return "deny";
-      const { decision } = await waitRes.json();
-      if (decision === "allow") return "allow";
-      if (decision === "abandoned") return "abandoned";
-      return "deny";
-    } finally {
-      clearTimeout(waitTimer);
-      if (signal) signal.removeEventListener("abort", onWaitAbort);
-    }
+    if (!res.ok) throw new Error("Daemon fail");
+    const { id } = await res.json();
+    return id;
+  } finally {
+    clearTimeout(timer);
+  }
+}
+async function waitForDaemonDecision(id, signal) {
+  const base = `http://${DAEMON_HOST}:${DAEMON_PORT}`;
+  const waitCtrl = new AbortController();
+  const waitTimer = setTimeout(() => waitCtrl.abort(), 12e4);
+  const onAbort = () => waitCtrl.abort();
+  if (signal) signal.addEventListener("abort", onAbort);
+  try {
+    const waitRes = await fetch(`${base}/wait/${id}`, { signal: waitCtrl.signal });
+    if (!waitRes.ok) return { decision: "deny" };
+    const { decision, source } = await waitRes.json();
+    if (decision === "allow") return { decision: "allow", source };
+    if (decision === "abandoned") return { decision: "abandoned", source };
+    return { decision: "deny", source };
   } finally {
-    clearTimeout(checkTimer);
+    clearTimeout(waitTimer);
     if (signal) signal.removeEventListener("abort", onAbort);
   }
 }
@@ -1744,12 +1724,12 @@ function notifyActivity(data) {
     }
   });
 }
-async function authorizeHeadless(toolName, args, allowTerminalFallback = false, meta, options) {
+async function authorizeHeadless(toolName, args, meta, options) {
   if (!options?.calledFromDaemon) {
     const actId = randomUUID();
     const actTs = Date.now();
     await notifyActivity({ id: actId, ts: actTs, tool: toolName, args, status: "pending" });
-    const result = await _authorizeHeadlessCore(toolName, args, allowTerminalFallback, meta, {
+    const result = await _authorizeHeadlessCore(toolName, args, meta, {
       ...options,
       activityId: actId
     });
@@ -1764,14 +1744,14 @@ async function authorizeHeadless(toolName, args, allowTerminalFallback = false,
     }
     return result;
   }
-  return _authorizeHeadlessCore(toolName, args, allowTerminalFallback, meta, options);
+  return _authorizeHeadlessCore(toolName, args, meta, options);
 }
-async function _authorizeHeadlessCore(toolName, args, allowTerminalFallback = false, meta, options) {
+async function _authorizeHeadlessCore(toolName, args, meta, options) {
   if (process.env.NODE9_PAUSED === "1") return { approved: true, checkedBy: "paused" };
   const pauseState = checkPause();
   if (pauseState.paused) return { approved: true, checkedBy: "paused" };
   const creds = getCredentials();
-  const config = getConfig();
+  const config = getConfig(options?.cwd);
   const isTestEnv2 = !!(process.env.VITEST || process.env.NODE_ENV === "test" || process.env.CI || process.env.NODE9_TESTING === "1");
   const approvers = {
     ...config.settings.approvers || { native: true, browser: true, cloud: true, terminal: true }
@@ -1816,10 +1796,6 @@ async function _authorizeHeadlessCore(toolName, args, allowTerminalFallback = fa
         if (approvers.cloud && creds?.apiKey) {
           await auditLocalAllow(toolName, args, "audit-mode", creds, meta);
         }
-        sendDesktopNotification(
-          "Node9 Audit Mode",
-          `Would have blocked "${toolName}" (${policyResult.blockedByLabel || "Local Config"}) \u2014 running in audit mode`
-        );
       }
     }
     return { approved: true, checkedBy: "audit" };
@@ -1879,23 +1855,12 @@ async function _authorizeHeadlessCore(toolName, args, allowTerminalFallback = fa
     return { approved: true };
   }
   let cloudRequestId = null;
-  let isRemoteLocked = false;
   const cloudEnforced = approvers.cloud && !!creds?.apiKey;
   if (cloudEnforced) {
     try {
       const initResult = await initNode9SaaS(toolName, args, creds, meta, riskMetadata);
       if (!initResult.pending) {
         if (initResult.shadowMode) {
-          console.error(
-            chalk2.yellow(
-              `
-\u26A0\uFE0F  Node9 Shadow Mode: Action allowed, but would have been blocked by company policy.`
-            )
-          );
-          if (initResult.shadowReason) {
-            console.error(chalk2.dim(`   Reason: ${initResult.shadowReason}
-`));
-          }
           return { approved: true, checkedBy: "cloud" };
         }
         return {
@@ -1907,36 +1872,8 @@ async function _authorizeHeadlessCore(toolName, args, allowTerminalFallback = fa
         };
       }
       cloudRequestId = initResult.requestId || null;
-      isRemoteLocked = !!initResult.remoteApprovalOnly;
       explainableLabel = "Organization Policy (SaaS)";
-    } catch (err) {
-      const error = err;
-      const isAuthError = error.message.includes("401") || error.message.includes("403");
-      const isNetworkError = error.message.includes("fetch") || error.name === "AbortError" || error.message.includes("ECONNREFUSED");
-      const reason = isAuthError ? "Invalid or missing API key. Run `node9 login` to generate a key (must start with n9_live_)." : isNetworkError ? "Could not reach the Node9 cloud. Check your network or API URL." : error.message;
-      console.error(
-        chalk2.yellow(`
-\u26A0\uFE0F  Node9: Cloud API Handshake failed \u2014 ${reason}`) + chalk2.dim(`
-   Falling back to local rules...
-`)
-      );
-    }
-  }
-  if (!options?.calledFromDaemon) {
-    if (cloudEnforced && cloudRequestId) {
-      console.error(
-        chalk2.yellow("\n\u{1F6E1}\uFE0F  Node9: Action suspended \u2014 waiting for Organization approval.")
-      );
-      console.error(
-        chalk2.cyan("   Dashboard  \u2192 ") + chalk2.bold("Mission Control > Activity Feed\n")
-      );
-    } else if (!cloudEnforced) {
-      const cloudOffReason = !creds?.apiKey ? "no API key \u2014 run `node9 login` to connect" : "privacy mode (cloud disabled)";
-      console.error(
-        chalk2.dim(`
-\u{1F6E1}\uFE0F  Node9: intercepted "${toolName}" \u2014 cloud off (${cloudOffReason})
-`)
-      );
+    } catch {
     }
   }
   const abortController = new AbortController();
@@ -1963,15 +1900,29 @@ async function _authorizeHeadlessCore(toolName, args, allowTerminalFallback = fa
   }
   let viewerId = null;
   const internalToken = getInternalToken();
+  let daemonEntryId = null;
+  if ((approvers.browser || approvers.terminal) && isDaemonRunning() && !options?.calledFromDaemon) {
+    if (cloudEnforced && cloudRequestId) {
+      viewerId = await notifyDaemonViewer(toolName, args, meta, riskMetadata).catch(() => null);
+      daemonEntryId = viewerId;
+    } else {
+      try {
+        daemonEntryId = await registerDaemonEntry(
+          toolName,
+          args,
+          meta,
+          riskMetadata,
+          options?.activityId,
+          options?.cwd
+        );
+      } catch {
+      }
+    }
+  }
   if (cloudEnforced && cloudRequestId) {
     racePromises.push(
       (async () => {
         try {
-          if (isDaemonRunning() && internalToken && !options?.calledFromDaemon) {
-            viewerId = await notifyDaemonViewer(toolName, args, meta, riskMetadata).catch(
-              () => null
-            );
-          }
           const cloudResult = await pollNode9SaaS(cloudRequestId, creds, signal);
           return {
             approved: cloudResult.approved,
@@ -1996,7 +1947,7 @@ async function _authorizeHeadlessCore(toolName, args, allowTerminalFallback = fa
           args,
           meta?.agent,
           explainableLabel,
-          isRemoteLocked,
+          false,
           signal,
           policyMatchedField,
           policyMatchedWord
@@ -2011,96 +1962,31 @@ async function _authorizeHeadlessCore(toolName, args, allowTerminalFallback = fa
           reason: isApproved ? void 0 : "The human user clicked 'Block' on the system dialog window.",
           checkedBy: isApproved ? "daemon" : void 0,
           blockedBy: isApproved ? void 0 : "local-decision",
-          blockedByLabel: "User Decision (Native)"
+          blockedByLabel: "User Decision (Native)",
+          decisionSource: "native"
         };
       })()
     );
   }
-  if (approvers.browser && isDaemonRunning() && !options?.calledFromDaemon && !cloudEnforced) {
+  if (daemonEntryId && (approvers.browser || approvers.terminal)) {
     racePromises.push(
       (async () => {
-        try {
-          if (!approvers.native && !cloudEnforced) {
-            console.error(
-              chalk2.yellow("\n\u{1F6E1}\uFE0F  Node9: Action suspended \u2014 waiting for browser approval.")
-            );
-            console.error(chalk2.cyan(`   URL \u2192 http://${DAEMON_HOST}:${DAEMON_PORT}/
-`));
-          }
-          const daemonDecision = await askDaemon(
-            toolName,
-            args,
-            meta,
-            signal,
-            riskMetadata,
-            options?.activityId
-          );
-          if (daemonDecision === "abandoned") throw new Error("Abandoned");
-          const isApproved = daemonDecision === "allow";
-          return {
-            approved: isApproved,
-            reason: isApproved ? void 0 : "The human user rejected this action via the Node9 Browser Dashboard.",
-            checkedBy: isApproved ? "daemon" : void 0,
-            blockedBy: isApproved ? void 0 : "local-decision",
-            blockedByLabel: "User Decision (Browser)"
-          };
-        } catch (err) {
-          throw err;
-        }
-      })()
-    );
-  }
-  if (approvers.terminal && allowTerminalFallback && process.stdout.isTTY) {
-    racePromises.push(
-      (async () => {
-        try {
-          if (explainableLabel.includes("DLP")) {
-            console.log(chalk2.bgRed.white.bold(` \u{1F6A8} NODE9 DLP ALERT \u2014 CREDENTIAL DETECTED `));
-            console.log(
-              chalk2.red.bold(`   A sensitive secret was detected in the tool arguments!`)
-            );
-          } else {
-            console.log(chalk2.bgRed.white.bold(` \u{1F6D1} NODE9 INTERCEPTOR `));
-          }
-          console.log(`${chalk2.bold("Action:")} ${chalk2.red(toolName)}`);
-          console.log(`${chalk2.bold("Flagged By:")} ${chalk2.yellow(explainableLabel)}`);
-          if (isRemoteLocked) {
-            console.log(chalk2.yellow(`\u26A1 LOCKED BY ADMIN POLICY: Waiting for Slack Approval...
-`));
-            await new Promise((_, reject) => {
-              signal.addEventListener("abort", () => reject(new Error("Aborted by SaaS")));
-            });
-          }
-          const TIMEOUT_MS = 6e4;
-          let timer;
-          const result = await new Promise((resolve, reject) => {
-            timer = setTimeout(() => reject(new Error("Terminal Timeout")), TIMEOUT_MS);
-            confirm(
-              { message: `Authorize? (auto-deny in ${TIMEOUT_MS / 1e3}s)`, default: false },
-              { signal }
-            ).then(resolve).catch(reject);
-          });
-          clearTimeout(timer);
-          return {
-            approved: result,
-            reason: result ? void 0 : "The human user typed 'N' in the terminal to reject this action.",
-            checkedBy: result ? "terminal" : void 0,
-            blockedBy: result ? void 0 : "local-decision",
-            blockedByLabel: "User Decision (Terminal)"
-          };
-        } catch (err) {
-          const error = err;
-          if (error.name === "AbortError" || error.message?.includes("Prompt was canceled") || error.message?.includes("Aborted by SaaS"))
-            throw err;
-          if (error.message === "Terminal Timeout") {
-            return {
-              approved: false,
-              reason: "The terminal prompt timed out without a human response.",
-              blockedBy: "local-decision"
-            };
-          }
-          throw err;
-        }
+        const { decision: daemonDecision, source: decisionSource } = await waitForDaemonDecision(
+          daemonEntryId,
+          signal
+        );
+        if (daemonDecision === "abandoned") throw new Error("Abandoned");
+        const isApproved = daemonDecision === "allow";
+        const src = decisionSource === "terminal" || decisionSource === "browser" ? decisionSource : approvers.browser ? "browser" : "terminal";
+        const via = src === "terminal" ? "Terminal (node9 tail)" : "Browser Dashboard";
+        return {
+          approved: isApproved,
+          reason: isApproved ? void 0 : `The human user rejected this action via the Node9 ${via}.`,
+          checkedBy: isApproved ? "daemon" : void 0,
+          blockedBy: isApproved ? void 0 : "local-decision",
+          blockedByLabel: `User Decision (${via})`,
+          decisionSource: src
+        };
       })()
     );
   }
@@ -2151,7 +2037,12 @@ REASON: Action blocked because no approval channels are available. (Native/Brows
     }
   });
   if (cloudRequestId && creds && finalResult.checkedBy !== "cloud") {
-    await resolveNode9SaaS(cloudRequestId, creds, finalResult.approved);
+    await resolveNode9SaaS(
+      cloudRequestId,
+      creds,
+      finalResult.approved,
+      finalResult.decisionSource ?? finalResult.checkedBy ?? "local"
+    );
   }
   if (!isManual) {
     appendLocalAudit(
@@ -2199,6 +2090,8 @@ function getConfig(cwd) {
       mergedSettings.enableHookLogDebug = s.enableHookLogDebug;
     if (s.approvers) mergedSettings.approvers = { ...mergedSettings.approvers, ...s.approvers };
     if (s.approvalTimeoutMs !== void 0) mergedSettings.approvalTimeoutMs = s.approvalTimeoutMs;
+    if (s.approvalTimeoutSeconds !== void 0 && s.approvalTimeoutMs === void 0)
+      mergedSettings.approvalTimeoutMs = s.approvalTimeoutSeconds * 1e3;
     if (s.environment !== void 0) mergedSettings.environment = s.environment;
     if (p.sandboxPaths) mergedPolicy.sandboxPaths.push(...p.sandboxPaths);
     if (p.ignoredTools) mergedPolicy.ignoredTools.push(...p.ignoredTools);
@@ -2423,11 +2316,9 @@ async function pollNode9SaaS(requestId, creds, signal) {
       if (!statusRes.ok) continue;
       const { status, reason } = await statusRes.json();
       if (status === "APPROVED") {
-        console.error(chalk2.green("\u2705  Approved via Cloud.\n"));
         return { approved: true, reason };
       }
       if (status === "DENIED" || status === "AUTO_BLOCKED" || status === "TIMED_OUT") {
-        console.error(chalk2.red("\u274C  Denied via Cloud.\n"));
         return { approved: false, reason };
       }
     } catch {
@@ -2435,19 +2326,34 @@ async function pollNode9SaaS(requestId, creds, signal) {
   }
   return { approved: false, reason: "Cloud approval timed out after 10 minutes." };
 }
-async function resolveNode9SaaS(requestId, creds, approved) {
+async function resolveNode9SaaS(requestId, creds, approved, decidedBy) {
   try {
     const resolveUrl = `${creds.apiUrl}/requests/${requestId}`;
     const ctrl = new AbortController();
     const timer = setTimeout(() => ctrl.abort(), 5e3);
-    await fetch(resolveUrl, {
+    const res = await fetch(resolveUrl, {
       method: "PATCH",
       headers: { "Content-Type": "application/json", Authorization: `Bearer ${creds.apiKey}` },
-      body: JSON.stringify({ decision: approved ? "APPROVED" : "DENIED" }),
+      body: JSON.stringify({
+        decision: approved ? "APPROVED" : "DENIED",
+        ...decidedBy && { decidedBy }
+      }),
       signal: ctrl.signal
     });
     clearTimeout(timer);
-  } catch {
+    if (!res.ok) {
+      fs3.appendFileSync(
+        HOOK_DEBUG_LOG,
+        `[resolve-cloud] PATCH ${resolveUrl} \u2192 HTTP ${res.status}
+`
+      );
+    }
+  } catch (err) {
+    fs3.appendFileSync(
+      HOOK_DEBUG_LOG,
+      `[resolve-cloud] PATCH failed for ${requestId}: ${err.message}
+`
+    );
   }
 }
 var PAUSED_FILE, TRUST_FILE, LOCAL_AUDIT_LOG, HOOK_DEBUG_LOG, MAX_REGEX_LENGTH, REGEX_CACHE_MAX, regexCache, SQL_DML_KEYWORDS, DANGEROUS_WORDS, DEFAULT_CONFIG, ADVISORY_SMART_RULES, cachedConfig, DAEMON_PORT, DAEMON_HOST, ACTIVITY_SOCKET_PATH;
@@ -2481,8 +2387,8 @@ var init_core = __esm({
         enableUndo: true,
         // 🔥 ALWAYS TRUE BY DEFAULT for the safety net
         enableHookLogDebug: true,
-        approvalTimeoutMs: 3e4,
-        // 30-second auto-deny timeout
+        approvalTimeoutMs: 12e4,
+        // 120-second auto-deny timeout
         flightRecorder: true,
         approvers: { native: true, browser: true, cloud: false, terminal: true }
       },
@@ -3746,7 +3652,7 @@ var init_ui = __esm({
           const res = await fetch('/decision/' + id, {
             method: 'POST',
             headers: { 'Content-Type': 'application/json', 'X-Node9-Token': CSRF_TOKEN },
-            body: JSON.stringify({ decision, persist: !!persist }),
+            body: JSON.stringify({ decision, persist: !!persist, source: 'browser' }),
           });
           if (!res.ok) throw new Error('Request failed (HTTP ' + res.status + ')');
           card?.remove();
@@ -3765,7 +3671,7 @@ var init_ui = __esm({
           const res = await fetch('/decision/' + id, {
             method: 'POST',
             headers: { 'Content-Type': 'application/json', 'X-Node9-Token': CSRF_TOKEN },
-            body: JSON.stringify({ decision: 'trust', trustDuration: duration }),
+            body: JSON.stringify({ decision: 'trust', trustDuration: duration, source: 'browser' }),
           });
           if (!res.ok) throw new Error('Request failed (HTTP ' + res.status + ')');
           card?.remove();
@@ -4176,7 +4082,7 @@ import path7 from "path";
 import os4 from "os";
 import { spawn as spawn2, spawnSync as spawnSync2 } from "child_process";
 import { randomUUID as randomUUID2 } from "crypto";
-import chalk4 from "chalk";
+import chalk2 from "chalk";
 function atomicWriteSync2(filePath, data, options) {
   const dir = path7.dirname(filePath);
   if (!fs5.existsSync(dir)) fs5.mkdirSync(dir, { recursive: true });
@@ -4295,7 +4201,7 @@ data: ${JSON.stringify(data)}
 `;
   sseClients.forEach((client) => {
     try {
-      client.write(msg);
+      client.res.write(msg);
     } catch {
       sseClients.delete(client);
     }
@@ -4341,6 +4247,7 @@ function startDaemon() {
   const IDLE_TIMEOUT_MS = 12 * 60 * 60 * 1e3;
   const watchMode = process.env.NODE9_WATCH_MODE === "1";
   let idleTimer;
+  let browserOpened = false;
   function resetIdleTimer() {
     if (watchMode) return;
     if (idleTimer) clearTimeout(idleTimer);
@@ -4357,12 +4264,15 @@ function startDaemon() {
   }
   resetIdleTimer();
   const server = http.createServer(async (req, res) => {
-    const { pathname } = new URL(req.url || "/", `http://${req.headers.host}`);
+    const reqUrl = new URL(req.url || "/", `http://${req.headers.host}`);
+    const { pathname } = reqUrl;
     if (req.method === "GET" && pathname === "/") {
       res.writeHead(200, { "Content-Type": "text/html" });
       return res.end(UI_HTML);
     }
     if (req.method === "GET" && pathname === "/events") {
+      const capParam = reqUrl.searchParams.get("capabilities") ?? "";
+      const capabilities = capParam ? capParam.split(",").map((s) => s.trim()).filter(Boolean) : [];
       res.writeHead(200, {
         "Content-Type": "text/event-stream",
         "Cache-Control": "no-cache",
@@ -4373,7 +4283,8 @@ function startDaemon() {
         abandonTimer = null;
       }
       hadBrowserClient = true;
-      sseClients.add(res);
+      const sseClient = { res, capabilities };
+      sseClients.add(sseClient);
       res.write(
         `event: init
 data: ${JSON.stringify({
@@ -4388,7 +4299,7 @@ data: ${JSON.stringify({
             mcpServer: e.mcpServer
           })),
           orgName: getOrgName(),
-          autoDenyMs: AUTO_DENY_MS
+          autoDenyMs: getConfig().settings.approvalTimeoutMs ?? AUTO_DENY_MS
         })}
 
 `
@@ -4410,6 +4321,10 @@ data: ${JSON.stringify({
 
 `
       );
+      res.write(`event: csrf
+data: ${JSON.stringify({ token: csrfToken })}
+
+`);
       for (const item of activityRing) {
         res.write(`event: ${item.event}
 data: ${JSON.stringify(item.data)}
@@ -4417,7 +4332,7 @@ data: ${JSON.stringify(item.data)}
 `);
       }
       return req.on("close", () => {
-        sseClients.delete(res);
+        sseClients.delete(sseClient);
         if (sseClients.size === 0 && pending.size > 0) {
           abandonTimer = setTimeout(abandonPending, hadBrowserClient ? 1e4 : 15e3);
         }
@@ -4437,7 +4352,8 @@ data: ${JSON.stringify(item.data)}
           mcpServer,
           riskMetadata,
           fromCLI = false,
-          activityId
+          activityId,
+          cwd
         } = JSON.parse(body);
         const id = fromCLI && typeof activityId === "string" && activityId || randomUUID2();
         const entry = {
@@ -4467,7 +4383,7 @@ data: ${JSON.stringify(item.data)}
               pending.delete(id);
               broadcast("remove", { id });
             }
-          }, AUTO_DENY_MS)
+          }, getConfig().settings.approvalTimeoutMs ?? AUTO_DENY_MS)
         };
         pending.set(id, entry);
         if (!fromCLI) {
@@ -4479,8 +4395,11 @@ data: ${JSON.stringify(item.data)}
             status: "pending"
           });
         }
-        const browserEnabled = getConfig().settings.approvers?.browser !== false;
-        if (browserEnabled) {
+        const projectCwd = typeof cwd === "string" && path7.isAbsolute(cwd) ? cwd : void 0;
+        const projectConfig = getConfig(projectCwd);
+        const browserEnabled = projectConfig.settings.approvers?.browser !== false;
+        const terminalEnabled = projectConfig.settings.approvers?.terminal !== false;
+        if (browserEnabled || terminalEnabled) {
           broadcast("add", {
             id,
             toolName,
@@ -4488,17 +4407,21 @@ data: ${JSON.stringify(item.data)}
             riskMetadata: entry.riskMetadata,
             slackDelegated: entry.slackDelegated,
             agent: entry.agent,
-            mcpServer: entry.mcpServer
+            mcpServer: entry.mcpServer,
+            interactive: terminalEnabled
           });
-          if (sseClients.size === 0 && !autoStarted)
+          const browserAlreadyOpened = process.env.NODE9_BROWSER_OPENED === "1";
+          if (browserEnabled && !browserOpened && !browserAlreadyOpened) {
+            browserOpened = true;
             openBrowser(`http://127.0.0.1:${DAEMON_PORT2}/`);
+          }
         }
         res.writeHead(200, { "Content-Type": "application/json" });
         res.end(JSON.stringify({ id }));
+        if (slackDelegated) return;
         authorizeHeadless(
           toolName,
           args,
-          false,
           {
             agent: typeof agent === "string" ? agent : void 0,
             mcpServer: typeof mcpServer === "string" ? mcpServer : void 0
@@ -4508,6 +4431,8 @@ data: ${JSON.stringify(item.data)}
           const e = pending.get(id);
           if (!e) return;
           if (result.noApprovalMechanism) return;
+          if (result.checkedBy === "audit") return;
+          if (e.earlyDecision !== null) return;
           broadcast("activity-result", {
             id,
             status: result.approved ? "allow" : result.blockedByLabel?.includes("DLP") ? "dlp" : "block",
@@ -4548,18 +4473,31 @@ data: ${JSON.stringify(item.data)}
       if (!entry) return res.writeHead(404).end();
       if (entry.earlyDecision) {
         clearTimeout(entry.timer);
+        const source = entry.decisionSource;
         pending.delete(id);
         res.writeHead(200, { "Content-Type": "application/json" });
-        const body = { decision: entry.earlyDecision };
+        const body = {
+          decision: entry.earlyDecision
+        };
         if (entry.earlyReason) body.reason = entry.earlyReason;
+        if (source) body.source = source;
         return res.end(JSON.stringify(body));
       }
       entry.waiter = (d, reason) => {
         res.writeHead(200, { "Content-Type": "application/json" });
         const body = { decision: d };
         if (reason) body.reason = reason;
+        if (entry.decisionSource) body.source = entry.decisionSource;
         res.end(JSON.stringify(body));
       };
+      req.on("close", () => {
+        const e = pending.get(id);
+        if (e && e.waiter && e.earlyDecision === null) {
+          clearTimeout(e.timer);
+          pending.delete(id);
+          broadcast("remove", { id });
+        }
+      });
       return;
     }
     if (req.method === "POST" && pathname.startsWith("/decision/")) {
@@ -4568,7 +4506,13 @@ data: ${JSON.stringify(item.data)}
         const id = pathname.split("/").pop();
         const entry = pending.get(id);
         if (!entry) return res.writeHead(404).end();
-        const { decision, persist, trustDuration, reason } = JSON.parse(await readBody(req));
+        if (entry.earlyDecision !== null) {
+          res.writeHead(409, { "Content-Type": "application/json" });
+          return res.end(JSON.stringify({ conflict: true, decision: entry.earlyDecision }));
+        }
+        const { decision, persist, trustDuration, reason, source } = JSON.parse(
+          await readBody(req)
+        );
         if (decision === "trust" && trustDuration) {
           const ms = TRUST_DURATIONS[trustDuration] ?? 60 * 6e4;
           writeTrustEntry(entry.toolName, ms);
@@ -4598,6 +4542,8 @@ data: ${JSON.stringify(item.data)}
           decision: resolvedDecision
         });
         clearTimeout(entry.timer);
+        const VALID_SOURCES = /* @__PURE__ */ new Set(["terminal", "browser", "native"]);
+        if (source && VALID_SOURCES.has(source)) entry.decisionSource = source;
         if (entry.waiter) {
           entry.waiter(resolvedDecision, reason);
           pending.delete(id);
@@ -4620,7 +4566,7 @@ data: ${JSON.stringify(item.data)}
         res.writeHead(200, { "Content-Type": "application/json" });
         return res.end(JSON.stringify({ ...s, autoStarted }));
       } catch (err) {
-        console.error(chalk4.red("[node9 daemon] GET /settings failed:"), err);
+        console.error(chalk2.red("[node9 daemon] GET /settings failed:"), err);
         res.writeHead(500, { "Content-Type": "application/json" });
         return res.end(JSON.stringify({ error: "internal" }));
       }
@@ -4651,7 +4597,7 @@ data: ${JSON.stringify(item.data)}
         res.writeHead(200, { "Content-Type": "application/json" });
         return res.end(JSON.stringify({ hasKey: hasStoredSlackKey(), enabled: s.slackEnabled }));
       } catch (err) {
-        console.error(chalk4.red("[node9 daemon] GET /slack-status failed:"), err);
+        console.error(chalk2.red("[node9 daemon] GET /slack-status failed:"), err);
         res.writeHead(500, { "Content-Type": "application/json" });
         return res.end(JSON.stringify({ error: "internal" }));
       }
@@ -4800,14 +4746,14 @@ data: ${JSON.stringify(item.data)}
       });
       return;
     }
-    console.error(chalk4.red("\n\u{1F6D1} Node9 Daemon Error:"), e.message);
+    console.error(chalk2.red("\n\u{1F6D1} Node9 Daemon Error:"), e.message);
     process.exit(1);
   });
   if (!daemonRejectionHandlerRegistered) {
     daemonRejectionHandlerRegistered = true;
     process.on("unhandledRejection", (reason) => {
       const stack = reason instanceof Error ? reason.stack : String(reason);
-      console.error(chalk4.red("[node9 daemon] unhandled rejection \u2014 keeping daemon alive:"), stack);
+      console.error(chalk2.red("[node9 daemon] unhandled rejection \u2014 keeping daemon alive:"), stack);
     });
   }
   server.listen(DAEMON_PORT2, DAEMON_HOST2, () => {
@@ -4816,10 +4762,10 @@ data: ${JSON.stringify(item.data)}
       JSON.stringify({ pid: process.pid, port: DAEMON_PORT2, internalToken, autoStarted }),
       { mode: 384 }
     );
-    console.log(chalk4.green(`\u{1F6E1}\uFE0F  Node9 Guard LIVE: http://127.0.0.1:${DAEMON_PORT2}`));
+    console.log(chalk2.green(`\u{1F6E1}\uFE0F  Node9 Guard LIVE: http://127.0.0.1:${DAEMON_PORT2}`));
   });
   if (watchMode) {
-    console.log(chalk4.cyan("\u{1F6F0}\uFE0F  Flight Recorder active \u2014 daemon will not idle-timeout"));
+    console.log(chalk2.cyan("\u{1F6F0}\uFE0F  Flight Recorder active \u2014 daemon will not idle-timeout"));
   }
   try {
     fs5.unlinkSync(ACTIVITY_SOCKET_PATH2);
@@ -4870,13 +4816,13 @@ data: ${JSON.stringify(item.data)}
   });
 }
 function stopDaemon() {
-  if (!fs5.existsSync(DAEMON_PID_FILE)) return console.log(chalk4.yellow("Not running."));
+  if (!fs5.existsSync(DAEMON_PID_FILE)) return console.log(chalk2.yellow("Not running."));
   try {
     const { pid } = JSON.parse(fs5.readFileSync(DAEMON_PID_FILE, "utf-8"));
     process.kill(pid, "SIGTERM");
-    console.log(chalk4.green("\u2705 Stopped."));
+    console.log(chalk2.green("\u2705 Stopped."));
   } catch {
-    console.log(chalk4.gray("Cleaned up stale PID file."));
+    console.log(chalk2.gray("Cleaned up stale PID file."));
   } finally {
     try {
       fs5.unlinkSync(DAEMON_PID_FILE);
@@ -4889,10 +4835,10 @@ function daemonStatus() {
     try {
       const { pid } = JSON.parse(fs5.readFileSync(DAEMON_PID_FILE, "utf-8"));
       process.kill(pid, 0);
-      console.log(chalk4.green("Node9 daemon: running"));
+      console.log(chalk2.green("Node9 daemon: running"));
       return;
     } catch {
-      console.log(chalk4.yellow("Node9 daemon: not running (stale PID)"));
+      console.log(chalk2.yellow("Node9 daemon: not running (stale PID)"));
       return;
     }
   }
@@ -4901,9 +4847,9 @@ function daemonStatus() {
     timeout: 500
   });
   if (r.status === 0 && (r.stdout ?? "").includes(`:${DAEMON_PORT2}`)) {
-    console.log(chalk4.yellow("Node9 daemon: running (no PID file \u2014 orphaned)"));
+    console.log(chalk2.yellow("Node9 daemon: running (no PID file \u2014 orphaned)"));
   } else {
-    console.log(chalk4.yellow("Node9 daemon: not running"));
+    console.log(chalk2.yellow("Node9 daemon: not running"));
   }
 }
 var daemonRejectionHandlerRegistered, ACTIVITY_SOCKET_PATH2, DAEMON_PORT2, DAEMON_HOST2, homeDir, DAEMON_PID_FILE, DECISIONS_FILE, GLOBAL_CONFIG_FILE, CREDENTIALS_FILE, AUDIT_LOG_FILE, TRUST_FILE2, TRUST_DURATIONS, SECRET_KEY_RE, AUTO_DENY_MS, autoStarted, pending, sseClients, abandonTimer, daemonServer, hadBrowserClient, ACTIVITY_RING_SIZE, activityRing;
@@ -4948,12 +4894,12 @@ __export(tail_exports, {
   startTail: () => startTail
 });
 import http2 from "http";
-import chalk5 from "chalk";
+import chalk3 from "chalk";
 import fs7 from "fs";
 import os6 from "os";
 import path9 from "path";
 import readline from "readline";
-import { spawn as spawn4 } from "child_process";
+import { spawn as spawn4, execSync } from "child_process";
 function getIcon(tool) {
   const t = tool.toLowerCase();
   for (const [k, v] of Object.entries(ICONS)) {
@@ -4967,17 +4913,17 @@ function formatBase(activity) {
   const toolName = activity.tool.slice(0, 16).padEnd(16);
   const argsStr = JSON.stringify(activity.args ?? {}).replace(/\s+/g, " ");
   const argsPreview = argsStr.length > 70 ? argsStr.slice(0, 70) + "\u2026" : argsStr;
-  return `${chalk5.gray(time)} ${icon} ${chalk5.white.bold(toolName)} ${chalk5.dim(argsPreview)}`;
+  return `${chalk3.gray(time)} ${icon} ${chalk3.white.bold(toolName)} ${chalk3.dim(argsPreview)}`;
 }
 function renderResult(activity, result) {
   const base = formatBase(activity);
   let status;
   if (result.status === "allow") {
-    status = chalk5.green("\u2713 ALLOW");
+    status = chalk3.green("\u2713 ALLOW");
   } else if (result.status === "dlp") {
-    status = chalk5.bgRed.white.bold(" \u{1F6E1}\uFE0F  DLP ");
+    status = chalk3.bgRed.white.bold(" \u{1F6E1}\uFE0F  DLP ");
   } else {
-    status = chalk5.red("\u2717 BLOCK");
+    status = chalk3.red("\u2717 BLOCK");
   }
   if (process.stdout.isTTY) {
     readline.clearLine(process.stdout, 0);
@@ -4987,7 +4933,7 @@ function renderResult(activity, result) {
 }
 function renderPending(activity) {
   if (!process.stdout.isTTY) return;
-  process.stdout.write(`${formatBase(activity)}  ${chalk5.yellow("\u25CF \u2026")}\r`);
+  process.stdout.write(`${formatBase(activity)}  ${chalk3.yellow("\u25CF \u2026")}\r`);
 }
 async function ensureDaemon() {
   let pidPort = null;
@@ -4996,7 +4942,7 @@ async function ensureDaemon() {
       const { port } = JSON.parse(fs7.readFileSync(PID_FILE, "utf-8"));
       pidPort = port;
     } catch {
-      console.error(chalk5.dim("\u26A0\uFE0F  Could not read PID file; falling back to default port."));
+      console.error(chalk3.dim("\u26A0\uFE0F  Could not read PID file; falling back to default port."));
     }
   }
   const checkPort = pidPort ?? DAEMON_PORT2;
@@ -5007,7 +4953,7 @@ async function ensureDaemon() {
     if (res.ok) return checkPort;
   } catch {
   }
-  console.log(chalk5.dim("\u{1F6E1}\uFE0F  Starting Node9 daemon..."));
+  console.log(chalk3.dim("\u{1F6E1}\uFE0F  Starting Node9 daemon..."));
   const child = spawn4(process.execPath, [process.argv[1], "daemon"], {
     detached: true,
     stdio: "ignore",
@@ -5024,9 +4970,51 @@ async function ensureDaemon() {
     } catch {
     }
   }
-  console.error(chalk5.red("\u274C Daemon failed to start. Try: node9 daemon start"));
+  console.error(chalk3.red("\u274C Daemon failed to start. Try: node9 daemon start"));
   process.exit(1);
 }
+function postDecisionHttp(id, decision, csrfToken, port) {
+  return new Promise((resolve, reject) => {
+    const body = JSON.stringify({ decision, source: "terminal" });
+    const req = http2.request(
+      {
+        hostname: "127.0.0.1",
+        port,
+        path: `/decision/${id}`,
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          "Content-Length": Buffer.byteLength(body),
+          "X-Node9-Token": csrfToken
+        }
+      },
+      (res) => {
+        res.resume();
+        if (res.statusCode === 200 || res.statusCode === 409) resolve();
+        else reject(new Error(`POST /decision returned ${res.statusCode}`));
+      }
+    );
+    req.on("error", reject);
+    req.end(body);
+  });
+}
+function buildCardLines(req) {
+  const argsStr = JSON.stringify(req.args ?? {}).replace(/\s+/g, " ");
+  const argsPreview = argsStr.length > 60 ? argsStr.slice(0, 60) + "\u2026" : argsStr;
+  const tierLabel = req.riskMetadata?.tier != null ? req.riskMetadata.tier <= 2 ? `${YELLOW}\u26A0  Tier ${req.riskMetadata.tier}` : `${RED}\u{1F6D1} Tier ${req.riskMetadata.tier}` : `${YELLOW}\u26A0  Review`;
+  const blockedBy = req.riskMetadata?.blockedByLabel ?? "Policy rule";
+  return [
+    ``,
+    `${BOLD}${CYAN}\u2554\u2550\u2550 Node9 Approval Required \u2550\u2550\u2557${RESET}`,
+    `${CYAN}\u2551${RESET} Tool:    ${BOLD}${req.toolName}${RESET}`,
+    `${CYAN}\u2551${RESET} Reason:  ${tierLabel} \u2014 ${blockedBy}${RESET}`,
+    `${CYAN}\u2551${RESET} Args:    ${GRAY}${argsPreview}${RESET}`,
+    `${CYAN}\u255A${RESET}`,
+    ``,
+    `  ${BOLD}${GREEN}[A]${RESET} Allow   ${BOLD}${RED}[D]${RESET} Deny`,
+    ``
+  ];
+}
 async function startTail(options = {}) {
   const port = await ensureDaemon();
   if (options.clear) {
@@ -5053,7 +5041,7 @@ async function startTail(options = {}) {
       req2.end();
     });
     if (result.ok) {
-      console.log(chalk5.green("\u2713 Flight Recorder buffer cleared."));
+      console.log(chalk3.green("\u2713 Flight Recorder buffer cleared."));
     } else if (result.code === "ECONNREFUSED") {
       throw new Error("Daemon is not running. Start it with: node9 daemon start");
     } else if (result.code === "ETIMEDOUT") {
@@ -5064,27 +5052,130 @@ async function startTail(options = {}) {
     return;
   }
   const connectionTime = Date.now();
-  const pending2 = /* @__PURE__ */ new Map();
-  console.log(chalk5.cyan.bold(`
-\u{1F6F0}\uFE0F  Node9 tail  `) + chalk5.dim(`\u2192 localhost:${port}`));
+  const activityPending = /* @__PURE__ */ new Map();
+  let csrfToken = "";
+  const approvalQueue = [];
+  let cardActive = false;
+  let cardLineCount = 0;
+  let cancelActiveCard = null;
+  const canApprove = process.stdout.isTTY && process.stdin.isTTY;
+  if (canApprove) readline.emitKeypressEvents(process.stdin);
+  function clearCard() {
+    if (cardLineCount > 0) {
+      process.stdout.write(RESTORE_CURSOR + ERASE_DOWN);
+      cardLineCount = 0;
+    }
+  }
+  function printCard(req2) {
+    process.stdout.write(HIDE_CURSOR + SAVE_CURSOR);
+    const lines = buildCardLines(req2);
+    for (const line of lines) process.stdout.write(line + "\n");
+    cardLineCount = lines.length;
+  }
+  function showNextCard() {
+    if (cardActive || approvalQueue.length === 0 || !canApprove) return;
+    try {
+      process.stdin.setRawMode(true);
+    } catch {
+      cardActive = false;
+      return;
+    }
+    cardActive = true;
+    const req2 = approvalQueue[0];
+    printCard(req2);
+    let settled = false;
+    let onKeypress = null;
+    const cleanup = () => {
+      const handler = onKeypress;
+      onKeypress = null;
+      if (handler) process.stdin.removeListener("keypress", handler);
+      try {
+        process.stdin.setRawMode(false);
+      } catch {
+      }
+      process.stdin.pause();
+      cancelActiveCard = null;
+    };
+    const settle = (decision) => {
+      if (settled) return;
+      settled = true;
+      cleanup();
+      clearCard();
+      process.stdout.write(SHOW_CURSOR);
+      postDecisionHttp(req2.id, decision, csrfToken, port).catch((err) => {
+        try {
+          fs7.appendFileSync(
+            path9.join(os6.homedir(), ".node9", "hook-debug.log"),
+            `[tail] POST /decision failed: ${String(err)}
+`
+          );
+        } catch {
+        }
+      });
+      const decisionLabel = decision === "allow" ? chalk3.green("\u2713 ALLOWED (terminal)") : chalk3.red("\u2717 DENIED (terminal)");
+      console.log(`${chalk3.cyan("\u25C6")} ${chalk3.bold(req2.toolName.padEnd(16))}  ${decisionLabel}`);
+      approvalQueue.shift();
+      cardActive = false;
+      showNextCard();
+    };
+    cancelActiveCard = () => {
+      if (settled) return;
+      settled = true;
+      cleanup();
+      clearCard();
+      process.stdout.write(SHOW_CURSOR);
+      approvalQueue.shift();
+      cardActive = false;
+      showNextCard();
+    };
+    process.stdin.resume();
+    onKeypress = (_str, key) => {
+      const name = key?.name ?? "";
+      if (name === "a") {
+        settle("allow");
+      } else if (name === "d" || name === "return" || name === "enter" || key?.ctrl && name === "c") {
+        settle("deny");
+      }
+    };
+    process.stdin.on("keypress", onKeypress);
+  }
+  const dashboardUrl = `http://127.0.0.1:${port}/`;
+  try {
+    const browserEnabled = getConfig().settings.approvers?.browser !== false;
+    if (browserEnabled) {
+      if (process.platform === "darwin") execSync(`open "${dashboardUrl}"`, { stdio: "ignore" });
+      else if (process.platform === "win32")
+        execSync(`cmd /c start "" "${dashboardUrl}"`, { stdio: "ignore" });
+      else execSync(`xdg-open "${dashboardUrl}"`, { stdio: "ignore" });
+    }
+  } catch {
+  }
+  console.log(chalk3.cyan.bold(`
+\u{1F6F0}\uFE0F  Node9 tail  `) + chalk3.dim(`\u2192 ${dashboardUrl}`));
+  if (canApprove) {
+    console.log(chalk3.dim("Interactive approvals enabled. [A] Allow  [D] Deny"));
+  }
   if (options.history) {
-    console.log(chalk5.dim("Showing history + live events. Press Ctrl+C to exit.\n"));
+    console.log(chalk3.dim("Showing history + live events. Press Ctrl+C to exit.\n"));
   } else {
     console.log(
-      chalk5.dim("Showing live events only. Use --history to include past. Press Ctrl+C to exit.\n")
+      chalk3.dim("Showing live events only. Use --history to include past. Press Ctrl+C to exit.\n")
     );
   }
   process.on("SIGINT", () => {
+    clearCard();
+    process.stdout.write(SHOW_CURSOR);
     if (process.stdout.isTTY) {
       readline.clearLine(process.stdout, 0);
       readline.cursorTo(process.stdout, 0);
     }
-    console.log(chalk5.dim("\n\u{1F6F0}\uFE0F  Disconnected."));
+    console.log(chalk3.dim("\n\u{1F6F0}\uFE0F  Disconnected."));
     process.exit(0);
   });
-  const req = http2.get(`http://127.0.0.1:${port}/events`, (res) => {
+  const sseUrl = `http://127.0.0.1:${port}/events?capabilities=input`;
+  const req = http2.get(sseUrl, (res) => {
     if (res.statusCode !== 200) {
-      console.error(chalk5.red(`Failed to connect: HTTP ${res.statusCode}`));
+      console.error(chalk3.red(`Failed to connect: HTTP ${res.statusCode}`));
       process.exit(1);
     }
     let currentEvent = "";
@@ -5108,15 +5199,66 @@ async function startTail(options = {}) {
       }
     });
     rl.on("close", () => {
+      clearCard();
+      process.stdout.write(SHOW_CURSOR);
       if (process.stdout.isTTY) {
         readline.clearLine(process.stdout, 0);
         readline.cursorTo(process.stdout, 0);
       }
-      console.log(chalk5.red("\n\u274C Daemon disconnected."));
+      console.log(chalk3.red("\n\u274C Daemon disconnected."));
       process.exit(1);
     });
   });
   function handleMessage(event, rawData) {
+    if (event === "csrf") {
+      try {
+        const parsed = JSON.parse(rawData);
+        if (parsed.token) csrfToken = parsed.token;
+      } catch {
+      }
+      return;
+    }
+    if (event === "init") {
+      try {
+        const parsed = JSON.parse(rawData);
+        if (canApprove && Array.isArray(parsed.requests)) {
+          for (const r of parsed.requests) {
+            approvalQueue.push(r);
+          }
+          showNextCard();
+        }
+      } catch {
+      }
+      return;
+    }
+    if (event === "add") {
+      if (canApprove) {
+        try {
+          const parsed = JSON.parse(rawData);
+          if (parsed.interactive !== false) {
+            approvalQueue.push(parsed);
+            showNextCard();
+          }
+        } catch {
+        }
+      }
+      return;
+    }
+    if (event === "remove") {
+      try {
+        const { id } = JSON.parse(rawData);
+        const idx = approvalQueue.findIndex((r) => r.id === id);
+        if (idx !== -1) {
+          if (idx === 0 && cardActive && cancelActiveCard) {
+            cancelActiveCard();
+          } else {
+            approvalQueue.splice(idx, 1);
+          }
+        }
+      } catch {
+      }
+      return;
+    }
     let data;
     try {
       data = JSON.parse(rawData);
@@ -5129,30 +5271,31 @@ async function startTail(options = {}) {
         renderResult(data, data);
         return;
       }
-      pending2.set(data.id, data);
+      activityPending.set(data.id, data);
       const slowTool = /bash|shell|query|sql|agent/i.test(data.tool);
       if (slowTool) renderPending(data);
     }
     if (event === "activity-result") {
-      const original = pending2.get(data.id);
+      const original = activityPending.get(data.id);
       if (original) {
         renderResult(original, data);
-        pending2.delete(data.id);
+        activityPending.delete(data.id);
       }
     }
   }
   req.on("error", (err) => {
     const msg = err.code === "ECONNREFUSED" ? "Daemon is not running. Start it with: node9 daemon start" : err.message;
-    console.error(chalk5.red(`
+    console.error(chalk3.red(`
 \u274C ${msg}`));
     process.exit(1);
   });
 }
-var PID_FILE, ICONS;
+var PID_FILE, ICONS, RESET, BOLD, RED, YELLOW, CYAN, GRAY, GREEN, HIDE_CURSOR, SHOW_CURSOR, ERASE_DOWN, SAVE_CURSOR, RESTORE_CURSOR;
 var init_tail = __esm({
   "src/tui/tail.ts"() {
     "use strict";
     init_daemon();
+    init_core();
     PID_FILE = path9.join(os6.homedir(), ".node9", "daemon.pid");
     ICONS = {
       bash: "\u{1F4BB}",
@@ -5171,6 +5314,18 @@ var init_tail = __esm({
       delete: "\u{1F5D1}\uFE0F",
       web: "\u{1F310}"
     };
+    RESET = "\x1B[0m";
+    BOLD = "\x1B[1m";
+    RED = "\x1B[31m";
+    YELLOW = "\x1B[33m";
+    CYAN = "\x1B[36m";
+    GRAY = "\x1B[90m";
+    GREEN = "\x1B[32m";
+    HIDE_CURSOR = "\x1B[?25l";
+    SHOW_CURSOR = "\x1B[?25h";
+    ERASE_DOWN = "\x1B[J";
+    SAVE_CURSOR = "\x1B7";
+    RESTORE_CURSOR = "\x1B8";
   }
 });
 
@@ -5182,11 +5337,11 @@ import { Command } from "commander";
 import fs4 from "fs";
 import path6 from "path";
 import os3 from "os";
-import chalk3 from "chalk";
-import { confirm as confirm2 } from "@inquirer/prompts";
+import chalk from "chalk";
+import { confirm } from "@inquirer/prompts";
 function printDaemonTip() {
   console.log(
-    chalk3.cyan("\n   \u{1F4A1} Node9 will protect you automatically using Native OS popups.") + chalk3.white("\n      To view your history or manage persistent rules, run:") + chalk3.green("\n      node9 daemon --openui")
+    chalk.cyan("\n   \u{1F4A1} Node9 will protect you automatically using Native OS popups.") + chalk.white("\n      To view your history or manage persistent rules, run:") + chalk.green("\n      node9 daemon --openui")
   );
 }
 function fullPathCommand(subcommand) {
@@ -5232,10 +5387,10 @@ function teardownClaude() {
     if (changed) {
       writeJson(hooksPath, settings);
       console.log(
-        chalk3.green("  \u2705 Removed PreToolUse / PostToolUse hooks from ~/.claude/settings.json")
+        chalk.green("  \u2705 Removed PreToolUse / PostToolUse hooks from ~/.claude/settings.json")
       );
     } else {
-      console.log(chalk3.blue("  \u2139\uFE0F  No Node9 hooks found in ~/.claude/settings.json"));
+      console.log(chalk.blue("  \u2139\uFE0F  No Node9 hooks found in ~/.claude/settings.json"));
     }
   }
   const claudeConfig = readJson(mcpPath);
@@ -5252,7 +5407,7 @@ function teardownClaude() {
         mcpChanged = true;
       } else if (server.command === "node9") {
         console.warn(
-          chalk3.yellow(
+          chalk.yellow(
             `  \u26A0\uFE0F  Cannot unwrap MCP server "${name}" in ~/.claude.json \u2014 args is empty. Remove it manually.`
           )
         );
@@ -5260,7 +5415,7 @@ function teardownClaude() {
     }
     if (mcpChanged) {
       writeJson(mcpPath, claudeConfig);
-      console.log(chalk3.green("  \u2705 Unwrapped MCP servers in ~/.claude.json"));
+      console.log(chalk.green("  \u2705 Unwrapped MCP servers in ~/.claude.json"));
     }
   }
 }
@@ -5269,7 +5424,7 @@ function teardownGemini() {
   const settingsPath = path6.join(homeDir2, ".gemini", "settings.json");
   const settings = readJson(settingsPath);
   if (!settings) {
-    console.log(chalk3.blue("  \u2139\uFE0F  ~/.gemini/settings.json not found \u2014 nothing to remove"));
+    console.log(chalk.blue("  \u2139\uFE0F  ~/.gemini/settings.json not found \u2014 nothing to remove"));
     return;
   }
   let changed = false;
@@ -5298,9 +5453,9 @@ function teardownGemini() {
   }
   if (changed) {
     writeJson(settingsPath, settings);
-    console.log(chalk3.green("  \u2705 Removed Node9 hooks from ~/.gemini/settings.json"));
+    console.log(chalk.green("  \u2705 Removed Node9 hooks from ~/.gemini/settings.json"));
   } else {
-    console.log(chalk3.blue("  \u2139\uFE0F  No Node9 hooks found in ~/.gemini/settings.json"));
+    console.log(chalk.blue("  \u2139\uFE0F  No Node9 hooks found in ~/.gemini/settings.json"));
   }
 }
 function teardownCursor() {
@@ -5308,7 +5463,7 @@ function teardownCursor() {
   const mcpPath = path6.join(homeDir2, ".cursor", "mcp.json");
   const mcpConfig = readJson(mcpPath);
   if (!mcpConfig?.mcpServers) {
-    console.log(chalk3.blue("  \u2139\uFE0F  ~/.cursor/mcp.json not found \u2014 nothing to remove"));
+    console.log(chalk.blue("  \u2139\uFE0F  ~/.cursor/mcp.json not found \u2014 nothing to remove"));
     return;
   }
   let changed = false;
@@ -5325,9 +5480,9 @@ function teardownCursor() {
   }
   if (changed) {
     writeJson(mcpPath, mcpConfig);
-    console.log(chalk3.green("  \u2705 Unwrapped MCP servers in ~/.cursor/mcp.json"));
+    console.log(chalk.green("  \u2705 Unwrapped MCP servers in ~/.cursor/mcp.json"));
   } else {
-    console.log(chalk3.blue("  \u2139\uFE0F  No Node9-wrapped MCP servers found in ~/.cursor/mcp.json"));
+    console.log(chalk.blue("  \u2139\uFE0F  No Node9-wrapped MCP servers found in ~/.cursor/mcp.json"));
   }
 }
 async function setupClaude() {
@@ -5348,7 +5503,7 @@ async function setupClaude() {
       matcher: ".*",
       hooks: [{ type: "command", command: fullPathCommand("check"), timeout: 60 }]
     });
-    console.log(chalk3.green("  \u2705 PreToolUse hook added  \u2192 node9 check"));
+    console.log(chalk.green("  \u2705 PreToolUse hook added  \u2192 node9 check"));
     anythingChanged = true;
   }
   const hasPostHook = settings.hooks.PostToolUse?.some(
@@ -5360,7 +5515,7 @@ async function setupClaude() {
       matcher: ".*",
       hooks: [{ type: "command", command: fullPathCommand("log"), timeout: 600 }]
     });
-    console.log(chalk3.green("  \u2705 PostToolUse hook added \u2192 node9 log"));
+    console.log(chalk.green("  \u2705 PostToolUse hook added \u2192 node9 log"));
     anythingChanged = true;
   }
   if (anythingChanged) {
@@ -5374,35 +5529,35 @@ async function setupClaude() {
     serversToWrap.push({ name, originalCmd: parts.join(" "), parts });
   }
   if (serversToWrap.length > 0) {
-    console.log(chalk3.bold("The following existing entries will be modified:\n"));
-    console.log(chalk3.white(`  ${mcpPath}`));
+    console.log(chalk.bold("The following existing entries will be modified:\n"));
+    console.log(chalk.white(`  ${mcpPath}`));
     for (const { name, originalCmd } of serversToWrap) {
-      console.log(chalk3.gray(`    \u2022 ${name}: "${originalCmd}" \u2192 node9 ${originalCmd}`));
+      console.log(chalk.gray(`    \u2022 ${name}: "${originalCmd}" \u2192 node9 ${originalCmd}`));
     }
     console.log("");
-    const proceed = await confirm2({ message: "Wrap these MCP servers?", default: true });
+    const proceed = await confirm({ message: "Wrap these MCP servers?", default: true });
     if (proceed) {
       for (const { name, parts } of serversToWrap) {
         servers[name] = { ...servers[name], command: "node9", args: parts };
       }
       claudeConfig.mcpServers = servers;
       writeJson(mcpPath, claudeConfig);
-      console.log(chalk3.green(`
+      console.log(chalk.green(`
   \u2705 ${serversToWrap.length} MCP server(s) wrapped`));
       anythingChanged = true;
     } else {
-      console.log(chalk3.yellow("  Skipped MCP server wrapping."));
+      console.log(chalk.yellow("  Skipped MCP server wrapping."));
     }
     console.log("");
   }
   if (!anythingChanged && serversToWrap.length === 0) {
-    console.log(chalk3.blue("\u2139\uFE0F  Node9 is already fully configured for Claude Code."));
+    console.log(chalk.blue("\u2139\uFE0F  Node9 is already fully configured for Claude Code."));
     printDaemonTip();
     return;
   }
   if (anythingChanged) {
-    console.log(chalk3.green.bold("\u{1F6E1}\uFE0F  Node9 is now protecting Claude Code!"));
-    console.log(chalk3.gray("    Restart Claude Code for changes to take effect."));
+    console.log(chalk.green.bold("\u{1F6E1}\uFE0F  Node9 is now protecting Claude Code!"));
+    console.log(chalk.gray("    Restart Claude Code for changes to take effect."));
     printDaemonTip();
   }
 }
@@ -5430,7 +5585,7 @@ async function setupGemini() {
         }
       ]
     });
-    console.log(chalk3.green("  \u2705 BeforeTool hook added \u2192 node9 check"));
+    console.log(chalk.green("  \u2705 BeforeTool hook added \u2192 node9 check"));
     anythingChanged = true;
   }
   const hasAfterHook = Array.isArray(settings.hooks.AfterTool) && settings.hooks.AfterTool.some(
@@ -5443,7 +5598,7 @@ async function setupGemini() {
       matcher: ".*",
       hooks: [{ name: "node9-log", type: "command", command: fullPathCommand("log") }]
     });
-    console.log(chalk3.green("  \u2705 AfterTool hook added  \u2192 node9 log"));
+    console.log(chalk.green("  \u2705 AfterTool hook added  \u2192 node9 log"));
     anythingChanged = true;
   }
   if (anythingChanged) {
@@ -5457,35 +5612,35 @@ async function setupGemini() {
     serversToWrap.push({ name, originalCmd: parts.join(" "), parts });
   }
   if (serversToWrap.length > 0) {
-    console.log(chalk3.bold("The following existing entries will be modified:\n"));
-    console.log(chalk3.white(`  ${settingsPath}  (mcpServers)`));
+    console.log(chalk.bold("The following existing entries will be modified:\n"));
+    console.log(chalk.white(`  ${settingsPath}  (mcpServers)`));
     for (const { name, originalCmd } of serversToWrap) {
-      console.log(chalk3.gray(`    \u2022 ${name}: "${originalCmd}" \u2192 node9 ${originalCmd}`));
+      console.log(chalk.gray(`    \u2022 ${name}: "${originalCmd}" \u2192 node9 ${originalCmd}`));
     }
     console.log("");
-    const proceed = await confirm2({ message: "Wrap these MCP servers?", default: true });
+    const proceed = await confirm({ message: "Wrap these MCP servers?", default: true });
     if (proceed) {
       for (const { name, parts } of serversToWrap) {
         servers[name] = { ...servers[name], command: "node9", args: parts };
       }
       settings.mcpServers = servers;
       writeJson(settingsPath, settings);
-      console.log(chalk3.green(`
+      console.log(chalk.green(`
   \u2705 ${serversToWrap.length} MCP server(s) wrapped`));
       anythingChanged = true;
     } else {
-      console.log(chalk3.yellow("  Skipped MCP server wrapping."));
+      console.log(chalk.yellow("  Skipped MCP server wrapping."));
     }
     console.log("");
   }
   if (!anythingChanged && serversToWrap.length === 0) {
-    console.log(chalk3.blue("\u2139\uFE0F  Node9 is already fully configured for Gemini CLI."));
+    console.log(chalk.blue("\u2139\uFE0F  Node9 is already fully configured for Gemini CLI."));
     printDaemonTip();
     return;
   }
   if (anythingChanged) {
-    console.log(chalk3.green.bold("\u{1F6E1}\uFE0F  Node9 is now protecting Gemini CLI!"));
-    console.log(chalk3.gray("    Restart Gemini CLI for changes to take effect."));
+    console.log(chalk.green.bold("\u{1F6E1}\uFE0F  Node9 is now protecting Gemini CLI!"));
+    console.log(chalk.gray("    Restart Gemini CLI for changes to take effect."));
     printDaemonTip();
   }
 }
@@ -5502,36 +5657,36 @@ async function setupCursor() {
     serversToWrap.push({ name, originalCmd: parts.join(" "), parts });
   }
   if (serversToWrap.length > 0) {
-    console.log(chalk3.bold("The following existing entries will be modified:\n"));
-    console.log(chalk3.white(`  ${mcpPath}`));
+    console.log(chalk.bold("The following existing entries will be modified:\n"));
+    console.log(chalk.white(`  ${mcpPath}`));
     for (const { name, originalCmd } of serversToWrap) {
-      console.log(chalk3.gray(`    \u2022 ${name}: "${originalCmd}" \u2192 node9 ${originalCmd}`));
+      console.log(chalk.gray(`    \u2022 ${name}: "${originalCmd}" \u2192 node9 ${originalCmd}`));
     }
     console.log("");
-    const proceed = await confirm2({ message: "Wrap these MCP servers?", default: true });
+    const proceed = await confirm({ message: "Wrap these MCP servers?", default: true });
     if (proceed) {
       for (const { name, parts } of serversToWrap) {
         servers[name] = { ...servers[name], command: "node9", args: parts };
       }
       mcpConfig.mcpServers = servers;
       writeJson(mcpPath, mcpConfig);
-      console.log(chalk3.green(`
+      console.log(chalk.green(`
   \u2705 ${serversToWrap.length} MCP server(s) wrapped`));
       anythingChanged = true;
     } else {
-      console.log(chalk3.yellow("  Skipped MCP server wrapping."));
+      console.log(chalk.yellow("  Skipped MCP server wrapping."));
     }
     console.log("");
   }
   console.log(
-    chalk3.yellow(
+    chalk.yellow(
       "  \u26A0\uFE0F  Note: Cursor does not yet support native pre-execution hooks.\n     MCP proxy wrapping is the only supported protection mode for Cursor."
     )
   );
   console.log("");
   if (!anythingChanged && serversToWrap.length === 0) {
     console.log(
-      chalk3.blue(
+      chalk.blue(
         "\u2139\uFE0F  No MCP servers found to wrap. Add MCP servers to ~/.cursor/mcp.json and re-run."
       )
     );
@@ -5539,18 +5694,18 @@ async function setupCursor() {
     return;
   }
   if (anythingChanged) {
-    console.log(chalk3.green.bold("\u{1F6E1}\uFE0F  Node9 is now protecting Cursor via MCP proxy!"));
-    console.log(chalk3.gray("    Restart Cursor for changes to take effect."));
+    console.log(chalk.green.bold("\u{1F6E1}\uFE0F  Node9 is now protecting Cursor via MCP proxy!"));
+    console.log(chalk.gray("    Restart Cursor for changes to take effect."));
     printDaemonTip();
   }
 }
 
 // src/cli.ts
 init_daemon();
-import { spawn as spawn5, execSync } from "child_process";
+import { spawn as spawn5, execSync as execSync2, spawnSync as spawnSync4 } from "child_process";
 import { parseCommandString } from "execa";
 import { execa } from "execa";
-import chalk6 from "chalk";
+import chalk4 from "chalk";
 import readline2 from "readline";
 import fs8 from "fs";
 import path10 from "path";
@@ -5817,7 +5972,7 @@ function applyUndo(hash, cwd) {
 
 // src/cli.ts
 init_shields();
-import { confirm as confirm3 } from "@inquirer/prompts";
+import { confirm as confirm2 } from "@inquirer/prompts";
 var { version } = JSON.parse(
   fs8.readFileSync(path10.join(__dirname, "../package.json"), "utf-8")
 );
@@ -5907,9 +6062,9 @@ function openBrowserLocal() {
   const url = `http://${DAEMON_HOST2}:${DAEMON_PORT2}/`;
   try {
     const opts = { stdio: "ignore" };
-    if (process.platform === "darwin") execSync(`open "${url}"`, opts);
-    else if (process.platform === "win32") execSync(`cmd /c start "" "${url}"`, opts);
-    else execSync(`xdg-open "${url}"`, opts);
+    if (process.platform === "darwin") execSync2(`open "${url}"`, opts);
+    else if (process.platform === "win32") execSync2(`cmd /c start "" "${url}"`, opts);
+    else execSync2(`xdg-open "${url}"`, opts);
   } catch {
   }
 }
@@ -5918,7 +6073,9 @@ async function autoStartDaemonAndWait() {
     const child = spawn5(process.execPath, [process.argv[1], "daemon"], {
       detached: true,
       stdio: "ignore",
-      env: { ...process.env, NODE9_AUTO_STARTED: "1" }
+      // NODE9_BROWSER_OPENED=1 tells the daemon we will open the browser ourselves
+      // (openBrowserLocal below), so it must not open a duplicate tab on first approval.
+      env: { ...process.env, NODE9_AUTO_STARTED: "1", NODE9_BROWSER_OPENED: "1" }
     });
     child.unref();
     for (let i = 0; i < 20; i++) {
@@ -5951,7 +6108,7 @@ async function runProxy(targetCommand) {
     if (stdout) executable = stdout.trim();
   } catch {
   }
-  console.error(chalk6.green(`\u{1F680} Node9 Proxy Active: Monitoring [${targetCommand}]`));
+  console.error(chalk4.green(`\u{1F680} Node9 Proxy Active: Monitoring [${targetCommand}]`));
   const child = spawn5(executable, args, {
     stdio: ["pipe", "pipe", "inherit"],
     // We control STDIN and STDOUT
@@ -5972,14 +6129,14 @@ async function runProxy(targetCommand) {
       try {
         const name = message.params?.name || message.params?.tool_name || "unknown";
         const toolArgs = message.params?.arguments || message.params?.tool_input || {};
-        const result = await authorizeHeadless(sanitize(name), toolArgs, true, {
+        const result = await authorizeHeadless(sanitize(name), toolArgs, {
           agent: "Proxy/MCP"
         });
         if (!result.approved) {
-          console.error(chalk6.red(`
+          console.error(chalk4.red(`
 \u{1F6D1} Node9 Sudo: Action Blocked`));
-          console.error(chalk6.gray(`   Tool: ${name}`));
-          console.error(chalk6.gray(`   Reason: ${result.reason || "Security Policy"}
+          console.error(chalk4.gray(`   Tool: ${name}`));
+          console.error(chalk4.gray(`   Reason: ${result.reason || "Security Policy"}
 `));
           const blockedByLabel = result.blockedByLabel ?? result.reason ?? "Security Policy";
           const isHuman = blockedByLabel.toLowerCase().includes("user") || blockedByLabel.toLowerCase().includes("daemon") || blockedByLabel.toLowerCase().includes("decision");
@@ -6066,31 +6223,31 @@ program.command("login").argument("<apiKey>").option("--local", "Save key for au
     fs8.writeFileSync(configPath, JSON.stringify(config, null, 2), { mode: 384 });
   }
   if (options.profile && profileName !== "default") {
-    console.log(chalk6.green(`\u2705 Profile "${profileName}" saved`));
-    console.log(chalk6.gray(`   Switch to it per-session:  NODE9_PROFILE=${profileName} claude`));
+    console.log(chalk4.green(`\u2705 Profile "${profileName}" saved`));
+    console.log(chalk4.gray(`   Switch to it per-session:  NODE9_PROFILE=${profileName} claude`));
   } else if (options.local) {
-    console.log(chalk6.green(`\u2705 Privacy mode \u{1F6E1}\uFE0F`));
-    console.log(chalk6.gray(`   All decisions stay on this machine.`));
+    console.log(chalk4.green(`\u2705 Privacy mode \u{1F6E1}\uFE0F`));
+    console.log(chalk4.gray(`   All decisions stay on this machine.`));
   } else {
-    console.log(chalk6.green(`\u2705 Logged in \u2014 agent mode`));
-    console.log(chalk6.gray(`   Team policy enforced for all calls via Node9 cloud.`));
+    console.log(chalk4.green(`\u2705 Logged in \u2014 agent mode`));
+    console.log(chalk4.gray(`   Team policy enforced for all calls via Node9 cloud.`));
   }
 });
 program.command("addto").description("Integrate Node9 with an AI agent").addHelpText("after", "\n  Supported targets:  claude  gemini  cursor").argument("<target>", "The agent to protect: claude | gemini | cursor").action(async (target) => {
   if (target === "gemini") return await setupGemini();
   if (target === "claude") return await setupClaude();
   if (target === "cursor") return await setupCursor();
-  console.error(chalk6.red(`Unknown target: "${target}". Supported: claude, gemini, cursor`));
+  console.error(chalk4.red(`Unknown target: "${target}". Supported: claude, gemini, cursor`));
   process.exit(1);
 });
 program.command("setup").description('Alias for "addto" \u2014 integrate Node9 with an AI agent').addHelpText("after", "\n  Supported targets:  claude  gemini  cursor").argument("[target]", "The agent to protect: claude | gemini | cursor").action(async (target) => {
   if (!target) {
-    console.log(chalk6.cyan("\n\u{1F6E1}\uFE0F  Node9 Setup \u2014 integrate with your AI agent\n"));
-    console.log("  Usage:  " + chalk6.white("node9 setup <target>") + "\n");
+    console.log(chalk4.cyan("\n\u{1F6E1}\uFE0F  Node9 Setup \u2014 integrate with your AI agent\n"));
+    console.log("  Usage:  " + chalk4.white("node9 setup <target>") + "\n");
     console.log("  Targets:");
-    console.log("    " + chalk6.green("claude") + "   \u2014 Claude Code (hook mode)");
-    console.log("    " + chalk6.green("gemini") + "   \u2014 Gemini CLI (hook mode)");
-    console.log("    " + chalk6.green("cursor") + "   \u2014 Cursor (hook mode)");
+    console.log("    " + chalk4.green("claude") + "   \u2014 Claude Code (hook mode)");
+    console.log("    " + chalk4.green("gemini") + "   \u2014 Gemini CLI (hook mode)");
+    console.log("    " + chalk4.green("cursor") + "   \u2014 Cursor (hook mode)");
     console.log("");
     return;
   }
@@ -6098,7 +6255,7 @@ program.command("setup").description('Alias for "addto" \u2014 integrate Node9 w
   if (t === "gemini") return await setupGemini();
   if (t === "claude") return await setupClaude();
   if (t === "cursor") return await setupCursor();
-  console.error(chalk6.red(`Unknown target: "${target}". Supported: claude, gemini, cursor`));
+  console.error(chalk4.red(`Unknown target: "${target}". Supported: claude, gemini, cursor`));
   process.exit(1);
 });
 program.command("removefrom").description("Remove Node9 hooks from an AI agent configuration").addHelpText("after", "\n  Supported targets:  claude  gemini  cursor").argument("<target>", "The agent to remove from: claude | gemini | cursor").action((target) => {
@@ -6107,30 +6264,30 @@ program.command("removefrom").description("Remove Node9 hooks from an AI agent c
   else if (target === "gemini") fn = teardownGemini;
   else if (target === "cursor") fn = teardownCursor;
   else {
-    console.error(chalk6.red(`Unknown target: "${target}". Supported: claude, gemini, cursor`));
+    console.error(chalk4.red(`Unknown target: "${target}". Supported: claude, gemini, cursor`));
     process.exit(1);
   }
-  console.log(chalk6.cyan(`
+  console.log(chalk4.cyan(`
 \u{1F6E1}\uFE0F  Node9: removing hooks from ${target}...
 `));
   try {
     fn();
   } catch (err) {
-    console.error(chalk6.red(`  \u26A0\uFE0F  Failed: ${err instanceof Error ? err.message : String(err)}`));
+    console.error(chalk4.red(`  \u26A0\uFE0F  Failed: ${err instanceof Error ? err.message : String(err)}`));
     process.exit(1);
   }
-  console.log(chalk6.gray("\n  Restart the agent for changes to take effect."));
+  console.log(chalk4.gray("\n  Restart the agent for changes to take effect."));
 });
 program.command("uninstall").description("Remove all Node9 hooks and optionally delete config files").option("--purge", "Also delete ~/.node9/ directory (config, audit log, credentials)").action(async (options) => {
-  console.log(chalk6.cyan("\n\u{1F6E1}\uFE0F  Node9 Uninstall\n"));
-  console.log(chalk6.bold("Stopping daemon..."));
+  console.log(chalk4.cyan("\n\u{1F6E1}\uFE0F  Node9 Uninstall\n"));
+  console.log(chalk4.bold("Stopping daemon..."));
   try {
     stopDaemon();
-    console.log(chalk6.green("  \u2705 Daemon stopped"));
+    console.log(chalk4.green("  \u2705 Daemon stopped"));
   } catch {
-    console.log(chalk6.blue("  \u2139\uFE0F  Daemon was not running"));
+    console.log(chalk4.blue("  \u2139\uFE0F  Daemon was not running"));
   }
-  console.log(chalk6.bold("\nRemoving hooks..."));
+  console.log(chalk4.bold("\nRemoving hooks..."));
   let teardownFailed = false;
   for (const [label, fn] of [
     ["Claude", teardownClaude],
@@ -6142,7 +6299,7 @@ program.command("uninstall").description("Remove all Node9 hooks and optionally
     } catch (err) {
       teardownFailed = true;
       console.error(
-        chalk6.red(
+        chalk4.red(
           `  \u26A0\uFE0F  Failed to remove ${label} hooks: ${err instanceof Error ? err.message : String(err)}`
         )
       );
@@ -6151,7 +6308,7 @@ program.command("uninstall").description("Remove all Node9 hooks and optionally
   if (options.purge) {
     const node9Dir = path10.join(os7.homedir(), ".node9");
     if (fs8.existsSync(node9Dir)) {
-      const confirmed = await confirm3({
+      const confirmed = await confirm2({
         message: `Permanently delete ${node9Dir} (config, audit log, credentials)?`,
         default: false
       });
@@ -6159,53 +6316,53 @@ program.command("uninstall").description("Remove all Node9 hooks and optionally
         fs8.rmSync(node9Dir, { recursive: true });
         if (fs8.existsSync(node9Dir)) {
           console.error(
-            chalk6.red("\n  \u26A0\uFE0F  ~/.node9/ could not be fully deleted \u2014 remove it manually.")
+            chalk4.red("\n  \u26A0\uFE0F  ~/.node9/ could not be fully deleted \u2014 remove it manually.")
           );
         } else {
-          console.log(chalk6.green("\n  \u2705 Deleted ~/.node9/ (config, audit log, credentials)"));
+          console.log(chalk4.green("\n  \u2705 Deleted ~/.node9/ (config, audit log, credentials)"));
         }
       } else {
-        console.log(chalk6.yellow("\n  Skipped \u2014 ~/.node9/ was not deleted."));
+        console.log(chalk4.yellow("\n  Skipped \u2014 ~/.node9/ was not deleted."));
       }
     } else {
-      console.log(chalk6.blue("\n  \u2139\uFE0F  ~/.node9/ not found \u2014 nothing to delete"));
+      console.log(chalk4.blue("\n  \u2139\uFE0F  ~/.node9/ not found \u2014 nothing to delete"));
     }
   } else {
     console.log(
-      chalk6.gray("\n  ~/.node9/ kept \u2014 run with --purge to delete config and audit log")
+      chalk4.gray("\n  ~/.node9/ kept \u2014 run with --purge to delete config and audit log")
     );
   }
   if (teardownFailed) {
-    console.error(chalk6.red("\n  \u26A0\uFE0F  Some hooks could not be removed \u2014 see errors above."));
+    console.error(chalk4.red("\n  \u26A0\uFE0F  Some hooks could not be removed \u2014 see errors above."));
     process.exit(1);
   }
-  console.log(chalk6.green.bold("\n\u{1F6E1}\uFE0F  Node9 removed. Run: npm uninstall -g @node9/proxy"));
-  console.log(chalk6.gray("   Restart any open AI agent sessions for changes to take effect.\n"));
+  console.log(chalk4.green.bold("\n\u{1F6E1}\uFE0F  Node9 removed. Run: npm uninstall -g @node9/proxy"));
+  console.log(chalk4.gray("   Restart any open AI agent sessions for changes to take effect.\n"));
 });
 program.command("doctor").description("Check that Node9 is installed and configured correctly").action(() => {
   const homeDir2 = os7.homedir();
   let failures = 0;
   function pass(msg) {
-    console.log(chalk6.green("  \u2705 ") + msg);
+    console.log(chalk4.green("  \u2705 ") + msg);
   }
   function fail(msg, hint) {
-    console.log(chalk6.red("  \u274C ") + msg);
-    if (hint) console.log(chalk6.gray("       " + hint));
+    console.log(chalk4.red("  \u274C ") + msg);
+    if (hint) console.log(chalk4.gray("       " + hint));
     failures++;
   }
   function warn(msg, hint) {
-    console.log(chalk6.yellow("  \u26A0\uFE0F  ") + msg);
-    if (hint) console.log(chalk6.gray("       " + hint));
+    console.log(chalk4.yellow("  \u26A0\uFE0F  ") + msg);
+    if (hint) console.log(chalk4.gray("       " + hint));
   }
   function section(title) {
-    console.log("\n" + chalk6.bold(title));
+    console.log("\n" + chalk4.bold(title));
   }
-  console.log(chalk6.cyan.bold(`
+  console.log(chalk4.cyan.bold(`
 \u{1F6E1}\uFE0F  Node9 Doctor  v${version}
 `));
   section("Binary");
   try {
-    const which = execSync("which node9", { encoding: "utf-8" }).trim();
+    const which = execSync2("which node9", { encoding: "utf-8" }).trim();
     pass(`node9 found at ${which}`);
   } catch {
     warn("node9 not found in $PATH \u2014 hooks may not find it", "Run: npm install -g @node9/proxy");
@@ -6220,7 +6377,7 @@ program.command("doctor").description("Check that Node9 is installed and configu
     );
   }
   try {
-    const gitVersion = execSync("git --version", { encoding: "utf-8" }).trim();
+    const gitVersion = execSync2("git --version", { encoding: "utf-8" }).trim();
     pass(gitVersion);
   } catch {
     warn(
@@ -6315,9 +6472,9 @@ program.command("doctor").description("Check that Node9 is installed and configu
   }
   console.log("");
   if (failures === 0) {
-    console.log(chalk6.green.bold("  All checks passed. Node9 is ready.\n"));
+    console.log(chalk4.green.bold("  All checks passed. Node9 is ready.\n"));
   } else {
-    console.log(chalk6.red.bold(`  ${failures} check(s) failed. See hints above.
+    console.log(chalk4.red.bold(`  ${failures} check(s) failed. See hints above.
 `));
     process.exit(1);
   }
@@ -6332,7 +6489,7 @@ program.command("explain").description(
       try {
         args = JSON.parse(trimmed);
       } catch {
-        console.error(chalk6.red(`
+        console.error(chalk4.red(`
 \u274C Invalid JSON: ${trimmed}
 `));
         process.exit(1);
@@ -6343,54 +6500,54 @@ program.command("explain").description(
   }
   const result = await explainPolicy(tool, args);
   console.log("");
-  console.log(chalk6.cyan.bold("\u{1F6E1}\uFE0F  Node9 Explain"));
+  console.log(chalk4.cyan.bold("\u{1F6E1}\uFE0F  Node9 Explain"));
   console.log("");
-  console.log(`   ${chalk6.bold("Tool:")}    ${chalk6.white(result.tool)}`);
+  console.log(`   ${chalk4.bold("Tool:")}    ${chalk4.white(result.tool)}`);
   if (argsRaw) {
     const preview = argsRaw.length > 80 ? argsRaw.slice(0, 77) + "\u2026" : argsRaw;
-    console.log(`   ${chalk6.bold("Input:")}   ${chalk6.gray(preview)}`);
+    console.log(`   ${chalk4.bold("Input:")}   ${chalk4.gray(preview)}`);
   }
   console.log("");
-  console.log(chalk6.bold("Config Sources (Waterfall):"));
+  console.log(chalk4.bold("Config Sources (Waterfall):"));
   for (const tier of result.waterfall) {
-    const num = chalk6.gray(`  ${tier.tier}.`);
+    const num = chalk4.gray(`  ${tier.tier}.`);
     const label = tier.label.padEnd(16);
     let statusStr;
     if (tier.tier === 1) {
-      statusStr = chalk6.gray(tier.note ?? "");
+      statusStr = chalk4.gray(tier.note ?? "");
     } else if (tier.status === "active") {
-      const loc = tier.path ? chalk6.gray(tier.path) : "";
-      const note = tier.note ? chalk6.gray(`(${tier.note})`) : "";
-      statusStr = chalk6.green("\u2713 active") + (loc ? "  " + loc : "") + (note ? "  " + note : "");
+      const loc = tier.path ? chalk4.gray(tier.path) : "";
+      const note = tier.note ? chalk4.gray(`(${tier.note})`) : "";
+      statusStr = chalk4.green("\u2713 active") + (loc ? "  " + loc : "") + (note ? "  " + note : "");
     } else {
-      statusStr = chalk6.gray("\u25CB " + (tier.note ?? "not found"));
+      statusStr = chalk4.gray("\u25CB " + (tier.note ?? "not found"));
     }
-    console.log(`${num} ${chalk6.white(label)} ${statusStr}`);
+    console.log(`${num} ${chalk4.white(label)} ${statusStr}`);
   }
   console.log("");
-  console.log(chalk6.bold("Policy Evaluation:"));
+  console.log(chalk4.bold("Policy Evaluation:"));
   for (const step of result.steps) {
     const isFinal = step.isFinal;
     let icon;
-    if (step.outcome === "allow") icon = chalk6.green("  \u2705");
-    else if (step.outcome === "review") icon = chalk6.red("  \u{1F534}");
-    else if (step.outcome === "skip") icon = chalk6.gray("  \u2500 ");
-    else icon = chalk6.gray("  \u25CB ");
+    if (step.outcome === "allow") icon = chalk4.green("  \u2705");
+    else if (step.outcome === "review") icon = chalk4.red("  \u{1F534}");
+    else if (step.outcome === "skip") icon = chalk4.gray("  \u2500 ");
+    else icon = chalk4.gray("  \u25CB ");
     const name = step.name.padEnd(18);
-    const nameStr = isFinal ? chalk6.white.bold(name) : chalk6.white(name);
-    const detail = isFinal ? chalk6.white(step.detail) : chalk6.gray(step.detail);
-    const arrow = isFinal ? chalk6.yellow("  \u2190 STOP") : "";
+    const nameStr = isFinal ? chalk4.white.bold(name) : chalk4.white(name);
+    const detail = isFinal ? chalk4.white(step.detail) : chalk4.gray(step.detail);
+    const arrow = isFinal ? chalk4.yellow("  \u2190 STOP") : "";
     console.log(`${icon} ${nameStr} ${detail}${arrow}`);
   }
   console.log("");
   if (result.decision === "allow") {
-    console.log(chalk6.green.bold("  Decision: \u2705 ALLOW") + chalk6.gray("  \u2014 no approval needed"));
+    console.log(chalk4.green.bold("  Decision: \u2705 ALLOW") + chalk4.gray("  \u2014 no approval needed"));
   } else {
     console.log(
-      chalk6.red.bold("  Decision: \u{1F534} REVIEW") + chalk6.gray("  \u2014 human approval required")
+      chalk4.red.bold("  Decision: \u{1F534} REVIEW") + chalk4.gray("  \u2014 human approval required")
     );
     if (result.blockedByLabel) {
-      console.log(chalk6.gray(`  Reason:   ${result.blockedByLabel}`));
+      console.log(chalk4.gray(`  Reason:   ${result.blockedByLabel}`));
     }
   }
   console.log("");
@@ -6398,8 +6555,8 @@ program.command("explain").description(
 program.command("init").description("Create ~/.node9/config.json with default policy (safe to run multiple times)").option("--force", "Overwrite existing config").option("-m, --mode <mode>", "Set initial security mode (standard, strict, audit)", "standard").action((options) => {
   const configPath = path10.join(os7.homedir(), ".node9", "config.json");
   if (fs8.existsSync(configPath) && !options.force) {
-    console.log(chalk6.yellow(`\u2139\uFE0F  Global config already exists: ${configPath}`));
-    console.log(chalk6.gray(`   Run with --force to overwrite.`));
+    console.log(chalk4.yellow(`\u2139\uFE0F  Global config already exists: ${configPath}`));
+    console.log(chalk4.gray(`   Run with --force to overwrite.`));
     return;
   }
   const requestedMode = options.mode.toLowerCase();
@@ -6414,10 +6571,10 @@ program.command("init").description("Create ~/.node9/config.json with default po
   const dir = path10.dirname(configPath);
   if (!fs8.existsSync(dir)) fs8.mkdirSync(dir, { recursive: true });
   fs8.writeFileSync(configPath, JSON.stringify(configToSave, null, 2));
-  console.log(chalk6.green(`\u2705 Global config created: ${configPath}`));
-  console.log(chalk6.cyan(`   Mode set to: ${safeMode}`));
+  console.log(chalk4.green(`\u2705 Global config created: ${configPath}`));
+  console.log(chalk4.cyan(`   Mode set to: ${safeMode}`));
   console.log(
-    chalk6.gray(`   Undo Engine is ENABLED by default. Use 'node9 undo' to revert AI changes.`)
+    chalk4.gray(`   Undo Engine is ENABLED by default. Use 'node9 undo' to revert AI changes.`)
   );
 });
 function formatRelativeTime(timestamp) {
@@ -6434,7 +6591,7 @@ program.command("audit").description("View local execution audit log").option("-
   const logPath = path10.join(os7.homedir(), ".node9", "audit.log");
   if (!fs8.existsSync(logPath)) {
     console.log(
-      chalk6.yellow("No audit logs found. Run node9 with an agent to generate entries.")
+      chalk4.yellow("No audit logs found. Run node9 with an agent to generate entries.")
     );
     return;
   }
@@ -6460,31 +6617,31 @@ program.command("audit").description("View local execution audit log").option("-
     return;
   }
   if (entries.length === 0) {
-    console.log(chalk6.yellow("No matching audit entries."));
+    console.log(chalk4.yellow("No matching audit entries."));
     return;
   }
   console.log(
     `
-  ${chalk6.bold("Node9 Audit Log")}  ${chalk6.dim(`(${entries.length} entries)`)}`
+  ${chalk4.bold("Node9 Audit Log")}  ${chalk4.dim(`(${entries.length} entries)`)}`
   );
-  console.log(chalk6.dim("  " + "\u2500".repeat(65)));
+  console.log(chalk4.dim("  " + "\u2500".repeat(65)));
   console.log(
     `  ${"Time".padEnd(12)} ${"Tool".padEnd(18)} ${"Result".padEnd(10)} ${"By".padEnd(15)} Agent`
   );
-  console.log(chalk6.dim("  " + "\u2500".repeat(65)));
+  console.log(chalk4.dim("  " + "\u2500".repeat(65)));
   for (const e of entries) {
     const time = formatRelativeTime(String(e.ts)).padEnd(12);
     const tool = String(e.tool).slice(0, 17).padEnd(18);
-    const result = e.decision === "allow" ? chalk6.green("ALLOW".padEnd(10)) : chalk6.red("DENY".padEnd(10));
+    const result = e.decision === "allow" ? chalk4.green("ALLOW".padEnd(10)) : chalk4.red("DENY".padEnd(10));
     const checker = String(e.checkedBy || "unknown").slice(0, 14).padEnd(15);
     const agent = String(e.agent || "unknown");
     console.log(`  ${time} ${tool} ${result} ${checker} ${agent}`);
   }
   const allowed = entries.filter((e) => e.decision === "allow").length;
   const denied = entries.filter((e) => e.decision === "deny").length;
-  console.log(chalk6.dim("  " + "\u2500".repeat(65)));
+  console.log(chalk4.dim("  " + "\u2500".repeat(65)));
   console.log(
-    `  ${entries.length} entries  |  ${chalk6.green(allowed + " allowed")}  |  ${chalk6.red(denied + " denied")}
+    `  ${entries.length} entries  |  ${chalk4.green(allowed + " allowed")}  |  ${chalk4.red(denied + " denied")}
 `
   );
 });
@@ -6495,43 +6652,43 @@ program.command("status").description("Show current Node9 mode, policy source, a
   const settings = mergedConfig.settings;
   console.log("");
   if (creds && settings.approvers.cloud) {
-    console.log(chalk6.green("  \u25CF Agent mode") + chalk6.gray(" \u2014 cloud team policy enforced"));
+    console.log(chalk4.green("  \u25CF Agent mode") + chalk4.gray(" \u2014 cloud team policy enforced"));
   } else if (creds && !settings.approvers.cloud) {
     console.log(
-      chalk6.blue("  \u25CF Privacy mode \u{1F6E1}\uFE0F") + chalk6.gray(" \u2014 all decisions stay on this machine")
+      chalk4.blue("  \u25CF Privacy mode \u{1F6E1}\uFE0F") + chalk4.gray(" \u2014 all decisions stay on this machine")
     );
   } else {
     console.log(
-      chalk6.yellow("  \u25CB Privacy mode \u{1F6E1}\uFE0F") + chalk6.gray(" \u2014 no API key (Local rules only)")
+      chalk4.yellow("  \u25CB Privacy mode \u{1F6E1}\uFE0F") + chalk4.gray(" \u2014 no API key (Local rules only)")
     );
   }
   console.log("");
   if (daemonRunning) {
     console.log(
-      chalk6.green("  \u25CF Daemon running") + chalk6.gray(` \u2192 http://127.0.0.1:${DAEMON_PORT2}/`)
+      chalk4.green("  \u25CF Daemon running") + chalk4.gray(` \u2192 http://127.0.0.1:${DAEMON_PORT2}/`)
     );
   } else {
-    console.log(chalk6.gray("  \u25CB Daemon stopped"));
+    console.log(chalk4.gray("  \u25CB Daemon stopped"));
   }
   if (settings.enableUndo) {
     console.log(
-      chalk6.magenta("  \u25CF Undo Engine") + chalk6.gray(`    \u2192 Auto-snapshotting Git repos on AI change`)
+      chalk4.magenta("  \u25CF Undo Engine") + chalk4.gray(`    \u2192 Auto-snapshotting Git repos on AI change`)
     );
   }
   console.log("");
-  const modeLabel = settings.mode === "audit" ? chalk6.blue("audit") : settings.mode === "strict" ? chalk6.red("strict") : chalk6.white("standard");
+  const modeLabel = settings.mode === "audit" ? chalk4.blue("audit") : settings.mode === "strict" ? chalk4.red("strict") : chalk4.white("standard");
   console.log(`  Mode:    ${modeLabel}`);
   const projectConfig = path10.join(process.cwd(), "node9.config.json");
   const globalConfig = path10.join(os7.homedir(), ".node9", "config.json");
   console.log(
-    `  Local:   ${fs8.existsSync(projectConfig) ? chalk6.green("Active (node9.config.json)") : chalk6.gray("Not present")}`
+    `  Local:   ${fs8.existsSync(projectConfig) ? chalk4.green("Active (node9.config.json)") : chalk4.gray("Not present")}`
   );
   console.log(
-    `  Global:  ${fs8.existsSync(globalConfig) ? chalk6.green("Active (~/.node9/config.json)") : chalk6.gray("Not present")}`
+    `  Global:  ${fs8.existsSync(globalConfig) ? chalk4.green("Active (~/.node9/config.json)") : chalk4.gray("Not present")}`
   );
   if (mergedConfig.policy.sandboxPaths.length > 0) {
     console.log(
-      `  Sandbox: ${chalk6.green(`${mergedConfig.policy.sandboxPaths.length} safe zones active`)}`
+      `  Sandbox: ${chalk4.green(`${mergedConfig.policy.sandboxPaths.length} safe zones active`)}`
     );
   }
   const pauseState = checkPause();
@@ -6539,7 +6696,7 @@ program.command("status").description("Show current Node9 mode, policy source, a
     const expiresAt = pauseState.expiresAt ? new Date(pauseState.expiresAt).toLocaleTimeString() : "indefinitely";
     console.log("");
     console.log(
-      chalk6.yellow(`  \u23F8  PAUSED until ${expiresAt}`) + chalk6.gray(" \u2014 all tool calls allowed")
+      chalk4.yellow(`  \u23F8  PAUSED until ${expiresAt}`) + chalk4.gray(" \u2014 all tool calls allowed")
     );
   }
   console.log("");
@@ -6553,14 +6710,14 @@ program.command("daemon").description("Run the local approval server").argument(
     if (cmd === "stop") return stopDaemon();
     if (cmd === "status") return daemonStatus();
     if (cmd !== "start" && action !== void 0) {
-      console.error(chalk6.red(`Unknown daemon action: "${action}". Use: start | stop | status`));
+      console.error(chalk4.red(`Unknown daemon action: "${action}". Use: start | stop | status`));
       process.exit(1);
     }
     if (options.watch) {
       process.env.NODE9_WATCH_MODE = "1";
       setTimeout(() => {
         openBrowserLocal();
-        console.log(chalk6.cyan(`\u{1F6F0}\uFE0F  Flight Recorder: http://${DAEMON_HOST2}:${DAEMON_PORT2}/`));
+        console.log(chalk4.cyan(`\u{1F6F0}\uFE0F  Flight Recorder: http://${DAEMON_HOST2}:${DAEMON_PORT2}/`));
       }, 600);
       startDaemon();
       return;
@@ -6568,7 +6725,7 @@ program.command("daemon").description("Run the local approval server").argument(
     if (options.openui) {
       if (isDaemonRunning()) {
         openBrowserLocal();
-        console.log(chalk6.green(`\u{1F310}  Opened browser: http://${DAEMON_HOST2}:${DAEMON_PORT2}/`));
+        console.log(chalk4.green(`\u{1F310}  Opened browser: http://${DAEMON_HOST2}:${DAEMON_PORT2}/`));
         process.exit(0);
       }
       const child = spawn5(process.execPath, [process.argv[1], "daemon"], {
@@ -6581,7 +6738,7 @@ program.command("daemon").description("Run the local approval server").argument(
         if (isDaemonRunning()) break;
       }
       openBrowserLocal();
-      console.log(chalk6.green(`
+      console.log(chalk4.green(`
 \u{1F6E1}\uFE0F  Node9 daemon started + browser opened`));
       process.exit(0);
     }
@@ -6591,7 +6748,7 @@ program.command("daemon").description("Run the local approval server").argument(
         stdio: "ignore"
       });
       child.unref();
-      console.log(chalk6.green(`
+      console.log(chalk4.green(`
 \u{1F6E1}\uFE0F  Node9 daemon started in background  (PID ${child.pid})`));
       process.exit(0);
     }
@@ -6603,10 +6760,64 @@ program.command("tail").description("Stream live agent activity to the terminal"
   try {
     await startTail2(options);
   } catch (err) {
-    console.error(chalk6.red(`\u274C ${err instanceof Error ? err.message : String(err)}`));
+    console.error(chalk4.red(`\u274C ${err instanceof Error ? err.message : String(err)}`));
     process.exit(1);
   }
 });
+program.command("watch").description("Run a command under Node9 watch mode (daemon stays alive for the session)").argument("<command>", "Command to run").argument("[args...]", "Arguments for the command").action(async (cmd, args) => {
+  let port = DAEMON_PORT2;
+  try {
+    const res = await fetch(`http://127.0.0.1:${DAEMON_PORT2}/settings`, {
+      signal: AbortSignal.timeout(500)
+    });
+    if (res.ok) {
+      const data = await res.json();
+      if (typeof data.port === "number") port = data.port;
+    } else {
+      throw new Error("not running");
+    }
+  } catch {
+    console.error(chalk4.dim("\u{1F6E1}\uFE0F  Starting Node9 daemon (watch mode)..."));
+    const child = spawn5(process.execPath, [process.argv[1], "daemon"], {
+      detached: true,
+      stdio: "ignore",
+      env: { ...process.env, NODE9_AUTO_STARTED: "1", NODE9_WATCH_MODE: "1" }
+    });
+    child.unref();
+    let ready = false;
+    for (let i = 0; i < 20; i++) {
+      await new Promise((r) => setTimeout(r, 250));
+      try {
+        const r = await fetch(`http://127.0.0.1:${DAEMON_PORT2}/settings`, {
+          signal: AbortSignal.timeout(500)
+        });
+        if (r.ok) {
+          ready = true;
+          break;
+        }
+      } catch {
+      }
+    }
+    if (!ready) {
+      console.error(chalk4.red("\u274C Daemon failed to start. Try: node9 daemon start"));
+      process.exit(1);
+    }
+  }
+  console.error(
+    chalk4.cyan.bold("\u{1F6E1}\uFE0F  Node9 watch") + chalk4.dim(` \u2192 localhost:${port}`) + chalk4.dim(
+      "\n   Tip: run `node9 tail` in another terminal to review and approve AI actions.\n"
+    )
+  );
+  const result = spawnSync4(cmd, args, {
+    stdio: "inherit",
+    env: { ...process.env, NODE9_WATCH_MODE: "1" }
+  });
+  if (result.error) {
+    console.error(chalk4.red(`\u274C Failed to run command: ${result.error.message}`));
+    process.exit(1);
+  }
+  process.exit(result.status ?? 0);
+});
 program.command("check").description("Hook handler \u2014 evaluates a tool call before execution").argument("[data]", "JSON string of the tool call").action(async (data) => {
   const processPayload = async (raw) => {
     try {
@@ -6644,19 +6855,30 @@ RAW: ${raw}
       const sendBlock = (msg, result2) => {
         const blockedByContext = result2?.blockedByLabel || result2?.blockedBy || "Local Security Policy";
         const isHumanDecision = blockedByContext.toLowerCase().includes("user") || blockedByContext.toLowerCase().includes("daemon") || blockedByContext.toLowerCase().includes("decision");
-        if (blockedByContext.includes("DLP") || blockedByContext.includes("Secret Detected") || blockedByContext.includes("Credential Review")) {
-          console.error(chalk6.bgRed.white.bold(`
+        let ttyFd = null;
+        try {
+          ttyFd = fs8.openSync("/dev/tty", "w");
+          const writeTty = (line) => fs8.writeSync(ttyFd, line + "\n");
+          if (blockedByContext.includes("DLP") || blockedByContext.includes("Secret Detected") || blockedByContext.includes("Credential Review")) {
+            writeTty(chalk4.bgRed.white.bold(`
  \u{1F6A8} NODE9 DLP ALERT \u2014 CREDENTIAL DETECTED `));
-          console.error(chalk6.red.bold(`   A sensitive secret was found in the tool arguments!`));
-        } else {
-          console.error(chalk6.red(`
+            writeTty(chalk4.red.bold(`   A sensitive secret was found in the tool arguments!`));
+          } else {
+            writeTty(chalk4.red(`
 \u{1F6D1} Node9 blocked "${toolName}"`));
+          }
+          writeTty(chalk4.gray(`   Triggered by: ${blockedByContext}`));
+          if (result2?.changeHint) writeTty(chalk4.cyan(`   To change:  ${result2.changeHint}`));
+          writeTty("");
+        } catch {
+        } finally {
+          if (ttyFd !== null)
+            try {
+              fs8.closeSync(ttyFd);
+            } catch {
+            }
         }
-        console.error(chalk6.gray(`   Triggered by: ${blockedByContext}`));
-        if (result2?.changeHint) console.error(chalk6.cyan(`   To change:  ${result2.changeHint}`));
-        console.error("");
         const aiFeedbackMessage = buildNegotiationMessage(blockedByContext, isHumanDecision, msg);
-        console.error(chalk6.dim(`   (Detailed instructions sent to AI agent)`));
         process.stdout.write(
           JSON.stringify({
             decision: "block",
@@ -6679,7 +6901,10 @@ RAW: ${raw}
       if (shouldSnapshot(toolName, toolInput, config)) {
         await createShadowSnapshot(toolName, toolInput, config.policy.snapshot.ignorePaths);
       }
-      const result = await authorizeHeadless(toolName, toolInput, false, meta);
+      const safeCwdForAuth = typeof payload.cwd === "string" && path10.isAbsolute(payload.cwd) ? payload.cwd : void 0;
+      const result = await authorizeHeadless(toolName, toolInput, meta, {
+        cwd: safeCwdForAuth
+      });
       if (result.approved) {
         if (result.checkedBy && process.env.NODE9_DEBUG === "1")
           process.stderr.write(`\u2713 node9 [${result.checkedBy}]: "${toolName}" allowed
@@ -6687,10 +6912,20 @@ RAW: ${raw}
         process.exit(0);
       }
       if (result.noApprovalMechanism && !isDaemonRunning() && !process.env.NODE9_NO_AUTO_DAEMON && !process.stdout.isTTY && config.settings.autoStartDaemon) {
-        console.error(chalk6.cyan("\n\u{1F6E1}\uFE0F  Node9: Starting approval daemon automatically..."));
+        try {
+          const tty = fs8.openSync("/dev/tty", "w");
+          fs8.writeSync(
+            tty,
+            chalk4.cyan("\n\u{1F6E1}\uFE0F  Node9: Starting approval daemon automatically...\n")
+          );
+          fs8.closeSync(tty);
+        } catch {
+        }
         const daemonReady = await autoStartDaemonAndWait();
         if (daemonReady) {
-          const retry = await authorizeHeadless(toolName, toolInput, false, meta);
+          const retry = await authorizeHeadless(toolName, toolInput, meta, {
+            cwd: safeCwdForAuth
+          });
           if (retry.approved) {
             if (retry.checkedBy && process.env.NODE9_DEBUG === "1")
               process.stderr.write(`\u2713 node9 [${retry.checkedBy}]: "${toolName}" allowed
@@ -6797,7 +7032,7 @@ program.command("pause").description("Temporarily disable Node9 protection for a
   const ms = parseDuration(options.duration);
   if (ms === null) {
     console.error(
-      chalk6.red(`
+      chalk4.red(`
 \u274C  Invalid duration: "${options.duration}". Use format like 15m, 1h, 30s.
 `)
     );
@@ -6805,20 +7040,20 @@ program.command("pause").description("Temporarily disable Node9 protection for a
   }
   pauseNode9(ms, options.duration);
   const expiresAt = new Date(Date.now() + ms).toLocaleTimeString();
-  console.log(chalk6.yellow(`
+  console.log(chalk4.yellow(`
 \u23F8  Node9 paused until ${expiresAt}`));
-  console.log(chalk6.gray(`   All tool calls will be allowed without review.`));
-  console.log(chalk6.gray(`   Run "node9 resume" to re-enable early.
+  console.log(chalk4.gray(`   All tool calls will be allowed without review.`));
+  console.log(chalk4.gray(`   Run "node9 resume" to re-enable early.
 `));
 });
 program.command("resume").description("Re-enable Node9 protection immediately").action(() => {
   const { paused } = checkPause();
   if (!paused) {
-    console.log(chalk6.gray("\nNode9 is already active \u2014 nothing to resume.\n"));
+    console.log(chalk4.gray("\nNode9 is already active \u2014 nothing to resume.\n"));
     return;
   }
   resumeNode9();
-  console.log(chalk6.green("\n\u25B6  Node9 resumed \u2014 protection is active.\n"));
+  console.log(chalk4.green("\n\u25B6  Node9 resumed \u2014 protection is active.\n"));
 });
 var HOOK_BASED_AGENTS = {
   claude: "claude",
@@ -6831,37 +7066,50 @@ program.argument("[command...]", "The agent command to run (e.g., gemini)").acti
     if (HOOK_BASED_AGENTS[firstArg2] !== void 0) {
       const target = HOOK_BASED_AGENTS[firstArg2];
       console.error(
-        chalk6.yellow(`
+        chalk4.yellow(`
 \u26A0\uFE0F  Node9 proxy mode does not support "${target}" directly.`)
       );
-      console.error(chalk6.white(`
+      console.error(chalk4.white(`
    "${target}" uses its own hook system. Use:`));
       console.error(
-        chalk6.green(`     node9 addto ${target}   `) + chalk6.gray("# one-time setup")
+        chalk4.green(`     node9 addto ${target}   `) + chalk4.gray("# one-time setup")
       );
-      console.error(chalk6.green(`     ${target}              `) + chalk6.gray("# run normally"));
+      console.error(chalk4.green(`     ${target}              `) + chalk4.gray("# run normally"));
       process.exit(1);
     }
-    const fullCommand = commandArgs.join(" ");
-    let result = await authorizeHeadless("shell", { command: fullCommand }, true, {
-      agent: "Terminal"
-    });
+    const runArgs = firstArg2 === "shell" ? commandArgs.slice(1) : commandArgs;
+    if (runArgs.length === 0) {
+      program.help();
+      return;
+    }
+    const fullCommand = runArgs.join(" ");
+    let result = await authorizeHeadless(
+      "shell",
+      { command: fullCommand },
+      {
+        agent: "Terminal"
+      }
+    );
     if (result.noApprovalMechanism && !isDaemonRunning() && !process.env.NODE9_NO_AUTO_DAEMON && getConfig().settings.autoStartDaemon) {
-      console.error(chalk6.cyan("\n\u{1F6E1}\uFE0F  Node9: Starting approval daemon automatically..."));
+      console.error(chalk4.cyan("\n\u{1F6E1}\uFE0F  Node9: Starting approval daemon automatically..."));
       const daemonReady = await autoStartDaemonAndWait();
       if (daemonReady) result = await authorizeHeadless("shell", { command: fullCommand });
     }
     if (result.noApprovalMechanism && process.stdout.isTTY) {
-      result = await authorizeHeadless("shell", { command: fullCommand }, true);
+      const approved = await confirm2({
+        message: `\u{1F6E1}\uFE0F  Node9: Allow "${fullCommand}"?`,
+        default: false
+      });
+      result = { approved, reason: approved ? void 0 : "Denied by user at terminal." };
     }
     if (!result.approved) {
       console.error(
-        chalk6.red(`
+        chalk4.red(`
 \u274C Node9 Blocked: ${result.reason || "Dangerous command detected."}`)
       );
       process.exit(1);
     }
-    console.error(chalk6.green("\n\u2705 Approved \u2014 running command...\n"));
+    console.error(chalk4.green("\n\u2705 Approved \u2014 running command...\n"));
     await runProxy(fullCommand);
   } else {
     program.help();
@@ -6876,22 +7124,22 @@ program.command("undo").description(
   if (history.length === 0) {
     if (!options.all && allHistory.length > 0) {
       console.log(
-        chalk6.yellow(
+        chalk4.yellow(
           `
 \u2139\uFE0F  No snapshots found for the current directory (${process.cwd()}).
-    Run ${chalk6.cyan("node9 undo --all")} to see snapshots from all projects.
+    Run ${chalk4.cyan("node9 undo --all")} to see snapshots from all projects.
 `
         )
       );
     } else {
-      console.log(chalk6.yellow("\n\u2139\uFE0F  No undo snapshots found.\n"));
+      console.log(chalk4.yellow("\n\u2139\uFE0F  No undo snapshots found.\n"));
     }
     return;
   }
   const idx = history.length - steps;
   if (idx < 0) {
     console.log(
-      chalk6.yellow(
+      chalk4.yellow(
         `
 \u2139\uFE0F  Only ${history.length} snapshot(s) available, cannot go back ${steps}.
 `
@@ -6902,18 +7150,18 @@ program.command("undo").description(
   const snapshot = history[idx];
   const age = Math.round((Date.now() - snapshot.timestamp) / 1e3);
   const ageStr = age < 60 ? `${age}s ago` : age < 3600 ? `${Math.round(age / 60)}m ago` : `${Math.round(age / 3600)}h ago`;
-  console.log(chalk6.magenta.bold(`
+  console.log(chalk4.magenta.bold(`
 \u23EA  Node9 Undo${steps > 1 ? ` (${steps} steps back)` : ""}`));
   console.log(
-    chalk6.white(
-      `    Tool:  ${chalk6.cyan(snapshot.tool)}${snapshot.argsSummary ? chalk6.gray(" \u2192 " + snapshot.argsSummary) : ""}`
+    chalk4.white(
+      `    Tool:  ${chalk4.cyan(snapshot.tool)}${snapshot.argsSummary ? chalk4.gray(" \u2192 " + snapshot.argsSummary) : ""}`
     )
   );
-  console.log(chalk6.white(`    When:  ${chalk6.gray(ageStr)}`));
-  console.log(chalk6.white(`    Dir:   ${chalk6.gray(snapshot.cwd)}`));
+  console.log(chalk4.white(`    When:  ${chalk4.gray(ageStr)}`));
+  console.log(chalk4.white(`    Dir:   ${chalk4.gray(snapshot.cwd)}`));
   if (steps > 1)
     console.log(
-      chalk6.yellow(`    Note:  This will also undo the ${steps - 1} action(s) after it.`)
+      chalk4.yellow(`    Note:  This will also undo the ${steps - 1} action(s) after it.`)
     );
   console.log("");
   const diff = computeUndoDiff(snapshot.hash, snapshot.cwd);
@@ -6921,65 +7169,65 @@ program.command("undo").description(
     const lines = diff.split("\n");
     for (const line of lines) {
       if (line.startsWith("+++") || line.startsWith("---")) {
-        console.log(chalk6.bold(line));
+        console.log(chalk4.bold(line));
       } else if (line.startsWith("+")) {
-        console.log(chalk6.green(line));
+        console.log(chalk4.green(line));
       } else if (line.startsWith("-")) {
-        console.log(chalk6.red(line));
+        console.log(chalk4.red(line));
       } else if (line.startsWith("@@")) {
-        console.log(chalk6.cyan(line));
+        console.log(chalk4.cyan(line));
       } else {
-        console.log(chalk6.gray(line));
+        console.log(chalk4.gray(line));
       }
     }
     console.log("");
   } else {
     console.log(
-      chalk6.gray("    (no diff available \u2014 working tree may already match snapshot)\n")
+      chalk4.gray("    (no diff available \u2014 working tree may already match snapshot)\n")
     );
   }
-  const proceed = await confirm3({
+  const proceed = await confirm2({
     message: `Revert to this snapshot?`,
     default: false
   });
   if (proceed) {
     if (applyUndo(snapshot.hash, snapshot.cwd)) {
-      console.log(chalk6.green("\n\u2705 Reverted successfully.\n"));
+      console.log(chalk4.green("\n\u2705 Reverted successfully.\n"));
     } else {
-      console.error(chalk6.red("\n\u274C Undo failed. Ensure you are in a Git repository.\n"));
+      console.error(chalk4.red("\n\u274C Undo failed. Ensure you are in a Git repository.\n"));
     }
   } else {
-    console.log(chalk6.gray("\nCancelled.\n"));
+    console.log(chalk4.gray("\nCancelled.\n"));
   }
 });
 var shieldCmd = program.command("shield").description("Manage pre-packaged security shield templates");
 shieldCmd.command("enable <service>").description("Enable a security shield for a specific service").action((service) => {
   const name = resolveShieldName(service);
   if (!name) {
-    console.error(chalk6.red(`
+    console.error(chalk4.red(`
 \u274C Unknown shield: "${service}"
 `));
-    console.log(`Run ${chalk6.cyan("node9 shield list")} to see available shields.
+    console.log(`Run ${chalk4.cyan("node9 shield list")} to see available shields.
 `);
     process.exit(1);
   }
   const shield = getShield(name);
   const active = readActiveShields();
   if (active.includes(name)) {
-    console.log(chalk6.yellow(`
+    console.log(chalk4.yellow(`
 \u2139\uFE0F  Shield "${name}" is already active.
 `));
     return;
   }
   writeActiveShields([...active, name]);
-  console.log(chalk6.green(`
+  console.log(chalk4.green(`
 \u{1F6E1}\uFE0F  Shield "${name}" enabled.`));
-  console.log(chalk6.gray(`   ${shield.smartRules.length} smart rules now active.`));
+  console.log(chalk4.gray(`   ${shield.smartRules.length} smart rules now active.`));
   if (shield.dangerousWords.length > 0)
-    console.log(chalk6.gray(`   ${shield.dangerousWords.length} dangerous words now active.`));
+    console.log(chalk4.gray(`   ${shield.dangerousWords.length} dangerous words now active.`));
   if (name === "filesystem") {
     console.log(
-      chalk6.yellow(
+      chalk4.yellow(
         `
    \u26A0\uFE0F  Note: filesystem rules cover common rm -rf patterns but not all variants.
       Tools like unlink, find -delete, or language-level file ops are not intercepted.`
@@ -6991,70 +7239,70 @@ shieldCmd.command("enable <service>").description("Enable a security shield for
 shieldCmd.command("disable <service>").description("Disable a security shield").action((service) => {
   const name = resolveShieldName(service);
   if (!name) {
-    console.error(chalk6.red(`
+    console.error(chalk4.red(`
 \u274C Unknown shield: "${service}"
 `));
-    console.log(`Run ${chalk6.cyan("node9 shield list")} to see available shields.
+    console.log(`Run ${chalk4.cyan("node9 shield list")} to see available shields.
 `);
     process.exit(1);
   }
   const active = readActiveShields();
   if (!active.includes(name)) {
-    console.log(chalk6.yellow(`
+    console.log(chalk4.yellow(`
 \u2139\uFE0F  Shield "${name}" is not active.
 `));
     return;
   }
   writeActiveShields(active.filter((s) => s !== name));
-  console.log(chalk6.green(`
+  console.log(chalk4.green(`
 \u{1F6E1}\uFE0F  Shield "${name}" disabled.
 `));
 });
 shieldCmd.command("list").description("Show all available shields").action(() => {
   const active = new Set(readActiveShields());
-  console.log(chalk6.bold("\n\u{1F6E1}\uFE0F  Available Shields\n"));
+  console.log(chalk4.bold("\n\u{1F6E1}\uFE0F  Available Shields\n"));
   for (const shield of listShields()) {
-    const status = active.has(shield.name) ? chalk6.green("\u25CF enabled") : chalk6.gray("\u25CB disabled");
-    console.log(`  ${status}  ${chalk6.cyan(shield.name.padEnd(12))} ${shield.description}`);
+    const status = active.has(shield.name) ? chalk4.green("\u25CF enabled") : chalk4.gray("\u25CB disabled");
+    console.log(`  ${status}  ${chalk4.cyan(shield.name.padEnd(12))} ${shield.description}`);
     if (shield.aliases.length > 0)
-      console.log(chalk6.gray(`              aliases: ${shield.aliases.join(", ")}`));
+      console.log(chalk4.gray(`              aliases: ${shield.aliases.join(", ")}`));
   }
   console.log("");
 });
 shieldCmd.command("status").description("Show active shields and their individual rules with verdicts").action(() => {
   const active = readActiveShields();
   if (active.length === 0) {
-    console.error(chalk6.yellow("\n\u2139\uFE0F  No shields are active.\n"));
-    console.error(`Run ${chalk6.cyan("node9 shield list")} to see available shields.
+    console.error(chalk4.yellow("\n\u2139\uFE0F  No shields are active.\n"));
+    console.error(`Run ${chalk4.cyan("node9 shield list")} to see available shields.
 `);
     return;
   }
   const overrides = readShieldOverrides();
-  console.error(chalk6.bold("\n\u{1F6E1}\uFE0F  Active Shields\n"));
+  console.error(chalk4.bold("\n\u{1F6E1}\uFE0F  Active Shields\n"));
   for (const name of active) {
     const shield = getShield(name);
     if (!shield) continue;
-    console.error(`  ${chalk6.green("\u25CF")} ${chalk6.cyan(name)} \u2014 ${shield.description}`);
+    console.error(`  ${chalk4.green("\u25CF")} ${chalk4.cyan(name)} \u2014 ${shield.description}`);
     const ruleOverrides = overrides[name] ?? {};
     for (const rule of shield.smartRules) {
       const shortName = rule.name ? rule.name.replace(`shield:${name}:`, "") : "(unnamed)";
       const overrideVerdict = rule.name ? ruleOverrides[rule.name] : void 0;
       const effectiveVerdict = overrideVerdict ?? rule.verdict;
-      const verdictLabel = effectiveVerdict === "block" ? chalk6.red("block ") : effectiveVerdict === "review" ? chalk6.yellow("review") : chalk6.green("allow ");
-      const overrideNote = overrideVerdict ? chalk6.gray(` \u2190 overridden (was: ${rule.verdict})`) : "";
+      const verdictLabel = effectiveVerdict === "block" ? chalk4.red("block ") : effectiveVerdict === "review" ? chalk4.yellow("review") : chalk4.green("allow ");
+      const overrideNote = overrideVerdict ? chalk4.gray(` \u2190 overridden (was: ${rule.verdict})`) : "";
       console.error(
-        `    ${verdictLabel}  ${shortName.padEnd(24)} ${chalk6.gray(rule.reason ?? "")}${overrideNote}`
+        `    ${verdictLabel}  ${shortName.padEnd(24)} ${chalk4.gray(rule.reason ?? "")}${overrideNote}`
       );
     }
     if (shield.dangerousWords.length > 0) {
-      console.error(chalk6.gray(`    words: ${shield.dangerousWords.join(", ")}`));
+      console.error(chalk4.gray(`    words: ${shield.dangerousWords.join(", ")}`));
     }
     console.error("");
   }
   if (Object.keys(overrides).length > 0) {
     console.error(
-      chalk6.gray(
-        `  Tip: run ${chalk6.cyan("node9 shield unset <shield> <rule>")} to remove an override.
+      chalk4.gray(
+        `  Tip: run ${chalk4.cyan("node9 shield unset <shield> <rule>")} to remove an override.
 `
       )
     );
@@ -7063,35 +7311,35 @@ shieldCmd.command("status").description("Show active shields and their individua
 shieldCmd.command("set <service> <rule> <verdict>").description("Override the verdict for a specific shield rule (block, review, or allow)").option("--force", "Required when setting verdict to allow (silences a block rule)").action((service, rule, verdict, opts) => {
   const name = resolveShieldName(service);
   if (!name) {
-    console.error(chalk6.red(`
+    console.error(chalk4.red(`
 \u274C Unknown shield: "${service}"
 `));
-    console.error(`Run ${chalk6.cyan("node9 shield list")} to see available shields.
+    console.error(`Run ${chalk4.cyan("node9 shield list")} to see available shields.
 `);
     process.exit(1);
   }
   if (!readActiveShields().includes(name)) {
-    console.error(chalk6.red(`
+    console.error(chalk4.red(`
 \u274C Shield "${name}" is not active. Enable it first:
 `));
-    console.error(`  ${chalk6.cyan(`node9 shield enable ${name}`)}
+    console.error(`  ${chalk4.cyan(`node9 shield enable ${name}`)}
 `);
     process.exit(1);
   }
   if (!isShieldVerdict(verdict)) {
-    console.error(chalk6.red(`
+    console.error(chalk4.red(`
 \u274C Invalid verdict "${verdict}". Use: block, review, or allow
 `));
     process.exit(1);
   }
   if (verdict === "allow" && !opts.force) {
     console.error(
-      chalk6.red(`
+      chalk4.red(`
 \u26A0\uFE0F  Setting a verdict to "allow" silences the rule entirely.
-`) + chalk6.yellow(
+`) + chalk4.yellow(
         `   This disables a shield protection. If you are sure, re-run with --force:
 `
-      ) + chalk6.cyan(`
+      ) + chalk4.cyan(`
    node9 shield set ${service} ${rule} allow --force
 `)
     );
@@ -7100,13 +7348,13 @@ shieldCmd.command("set <service> <rule> <verdict>").description("Override the ve
   const ruleName = resolveShieldRule(name, rule);
   if (!ruleName) {
     const shield = getShield(name);
-    console.error(chalk6.red(`
+    console.error(chalk4.red(`
 \u274C Unknown rule "${rule}" for shield "${name}".
 `));
     console.error("  Available rules:");
     for (const r of shield?.smartRules ?? []) {
       const short = r.name ? r.name.replace(`shield:${name}:`, "") : "";
-      console.error(`    ${chalk6.cyan(short)}`);
+      console.error(`    ${chalk4.cyan(short)}`);
     }
     console.error("");
     process.exit(1);
@@ -7116,33 +7364,33 @@ shieldCmd.command("set <service> <rule> <verdict>").description("Override the ve
     appendConfigAudit({ event: "shield-override-allow", shield: name, rule: ruleName });
   }
   const shortName = ruleName.replace(`shield:${name}:`, "");
-  const verdictLabel = verdict === "block" ? chalk6.red("block") : verdict === "review" ? chalk6.yellow("review") : chalk6.green("allow");
+  const verdictLabel = verdict === "block" ? chalk4.red("block") : verdict === "review" ? chalk4.yellow("review") : chalk4.green("allow");
   if (verdict === "allow") {
     console.error(
-      chalk6.yellow(`
-\u26A0\uFE0F  ${name}/${shortName} \u2192 ${verdictLabel}`) + chalk6.gray(" (rule silenced \u2014 use `node9 shield unset` to restore)\n")
+      chalk4.yellow(`
+\u26A0\uFE0F  ${name}/${shortName} \u2192 ${verdictLabel}`) + chalk4.gray(" (rule silenced \u2014 use `node9 shield unset` to restore)\n")
     );
   } else {
-    console.error(chalk6.green(`
+    console.error(chalk4.green(`
 \u2705  ${name}/${shortName} \u2192 ${verdictLabel}
 `));
   }
   console.error(
-    chalk6.gray(`   Run ${chalk6.cyan("node9 shield status")} to see all active rules.
+    chalk4.gray(`   Run ${chalk4.cyan("node9 shield status")} to see all active rules.
 `)
   );
 });
 shieldCmd.command("unset <service> <rule>").description("Remove a verdict override, restoring the shield default").action((service, rule) => {
   const name = resolveShieldName(service);
   if (!name) {
-    console.error(chalk6.red(`
+    console.error(chalk4.red(`
 \u274C Unknown shield: "${service}"
 `));
     process.exit(1);
   }
   const ruleName = resolveShieldRule(name, rule);
   if (!ruleName) {
-    console.error(chalk6.red(`
+    console.error(chalk4.red(`
 \u274C Unknown rule "${rule}" for shield "${name}".
 `));
     process.exit(1);
@@ -7150,7 +7398,7 @@ shieldCmd.command("unset <service> <rule>").description("Remove a verdict overri
   clearShieldOverride(name, ruleName);
   const shortName = ruleName.replace(`shield:${name}:`, "");
   console.error(
-    chalk6.green(`
+    chalk4.green(`
 \u2705  Override removed \u2014 ${name}/${shortName} restored to default.
 `)
   );
@@ -7159,32 +7407,32 @@ program.command("config show").description("Show the full effective runtime conf
   const config = getConfig();
   const active = readActiveShields();
   const overrides = readShieldOverrides();
-  console.error(chalk6.bold("\n\u{1F50D}  Node9 Effective Configuration\n"));
-  const modeLabel = config.settings.mode === "audit" ? chalk6.blue("audit") : config.settings.mode === "strict" ? chalk6.red("strict") : chalk6.white("standard");
+  console.error(chalk4.bold("\n\u{1F50D}  Node9 Effective Configuration\n"));
+  const modeLabel = config.settings.mode === "audit" ? chalk4.blue("audit") : config.settings.mode === "strict" ? chalk4.red("strict") : chalk4.white("standard");
   console.error(`  Mode: ${modeLabel}
 `);
   if (active.length > 0) {
-    console.error(chalk6.bold("  \u2500\u2500 Active Shields \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
+    console.error(chalk4.bold("  \u2500\u2500 Active Shields \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
     for (const name of active) {
       const shield = getShield(name);
       if (!shield) continue;
       const ruleOverrides = overrides[name] ?? {};
       console.error(`
-  ${chalk6.green("\u25CF")} ${chalk6.cyan(name)}`);
+  ${chalk4.green("\u25CF")} ${chalk4.cyan(name)}`);
       for (const rule of shield.smartRules) {
         const shortName = rule.name ? rule.name.replace(`shield:${name}:`, "") : "(unnamed)";
         const overrideVerdict = rule.name ? ruleOverrides[rule.name] : void 0;
         const effectiveVerdict = overrideVerdict ?? rule.verdict;
-        const vLabel = effectiveVerdict === "block" ? chalk6.red("block ") : effectiveVerdict === "review" ? chalk6.yellow("review") : chalk6.green("allow ");
-        const note = overrideVerdict ? chalk6.gray(` \u2190 overridden`) : "";
+        const vLabel = effectiveVerdict === "block" ? chalk4.red("block ") : effectiveVerdict === "review" ? chalk4.yellow("review") : chalk4.green("allow ");
+        const note = overrideVerdict ? chalk4.gray(` \u2190 overridden`) : "";
         console.error(`    ${vLabel}  ${shortName}${note}`);
       }
     }
     console.error("");
   } else {
-    console.error(chalk6.gray("  No shields active. Run `node9 shield list` to see options.\n"));
+    console.error(chalk4.gray("  No shields active. Run `node9 shield list` to see options.\n"));
   }
-  console.error(chalk6.bold("  \u2500\u2500 Built-in Rules (always on) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
+  console.error(chalk4.bold("  \u2500\u2500 Built-in Rules (always on) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
   for (const rule of config.policy.smartRules) {
     const isShieldRule = rule.name?.startsWith("shield:");
     const isAdvisory = [
@@ -7195,11 +7443,11 @@ program.command("config show").description("Show the full effective runtime conf
       "review-drop-column-sql"
     ].includes(rule.name ?? "");
     if (isShieldRule || isAdvisory) continue;
-    const vLabel = rule.verdict === "block" ? chalk6.red("block ") : rule.verdict === "review" ? chalk6.yellow("review") : chalk6.green("allow ");
-    console.error(`    ${vLabel}  ${chalk6.gray(rule.name ?? rule.tool)}`);
+    const vLabel = rule.verdict === "block" ? chalk4.red("block ") : rule.verdict === "review" ? chalk4.yellow("review") : chalk4.green("allow ");
+    console.error(`    ${vLabel}  ${chalk4.gray(rule.name ?? rule.tool)}`);
   }
   console.error("");
-  console.error(chalk6.bold("  \u2500\u2500 Safe by Default (advisory, overridable) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
+  console.error(chalk4.bold("  \u2500\u2500 Safe by Default (advisory, overridable) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
   const advisoryNames = /* @__PURE__ */ new Set([
     "review-rm",
     "allow-rm-safe-paths",
@@ -7209,12 +7457,12 @@ program.command("config show").description("Show the full effective runtime conf
   ]);
   for (const rule of config.policy.smartRules) {
     if (!advisoryNames.has(rule.name ?? "")) continue;
-    const vLabel = rule.verdict === "block" ? chalk6.red("block ") : rule.verdict === "review" ? chalk6.yellow("review") : chalk6.green("allow ");
-    console.error(`    ${vLabel}  ${chalk6.gray(rule.name ?? rule.tool)}`);
+    const vLabel = rule.verdict === "block" ? chalk4.red("block ") : rule.verdict === "review" ? chalk4.yellow("review") : chalk4.green("allow ");
+    console.error(`    ${vLabel}  ${chalk4.gray(rule.name ?? rule.tool)}`);
   }
   console.error("");
-  console.error(chalk6.bold("  \u2500\u2500 Dangerous Words \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
-  console.error(`    ${chalk6.gray(config.policy.dangerousWords.join(", "))}
+  console.error(chalk4.bold("  \u2500\u2500 Dangerous Words \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
+  console.error(`    ${chalk4.gray(config.policy.dangerousWords.join(", "))}
 `);
 });
 if (process.argv[2] !== "daemon") {