@node9/proxy 1.10.0 → 1.10.2

package/dist/cli.js

@@ -168,8 +168,8 @@ function sanitizeConfig(raw) {
     }
   }
   const lines = result.error.issues.map((issue) => {
-    const path34 = issue.path.length > 0 ? issue.path.join(".") : "root";
-    return `  \u2022 ${path34}: ${issue.message}`;
+    const path35 = issue.path.length > 0 ? issue.path.join(".") : "root";
+    return `  \u2022 ${path35}: ${issue.message}`;
   });
   return {
     sanitized,
@@ -253,7 +253,8 @@ var init_config_schema = __esm({
         slackEnabled: import_zod.z.boolean().optional(),
         enableTrustSessions: import_zod.z.boolean().optional(),
         allowGlobalPause: import_zod.z.boolean().optional(),
-        auditHashArgs: import_zod.z.boolean().optional()
+        auditHashArgs: import_zod.z.boolean().optional(),
+        agentPolicy: import_zod.z.enum(["require_approval", "block_on_rules"]).optional()
       }).optional(),
       policy: import_zod.z.object({
         sandboxPaths: import_zod.z.array(import_zod.z.string()).optional(),
@@ -1726,9 +1727,9 @@ function matchesPattern(text, patterns) {
   const withoutDotSlash = text.replace(/^\.\//, "");
   return isMatch(withoutDotSlash) || isMatch(`./${withoutDotSlash}`);
 }
-function getNestedValue(obj, path34) {
+function getNestedValue(obj, path35) {
   if (!obj || typeof obj !== "object") return null;
-  return path34.split(".").reduce((prev, curr) => prev?.[curr], obj);
+  return path35.split(".").reduce((prev, curr) => prev?.[curr], obj);
 }
 function shouldSnapshot(toolName, args, config) {
   if (!config.settings.enableUndo) return false;
@@ -2456,19 +2457,44 @@ function getInternalToken() {
 function isDaemonRunning() {
   const pidFile = import_path10.default.join(import_os8.default.homedir(), ".node9", "daemon.pid");
   if (import_fs9.default.existsSync(pidFile)) {
+    let pid;
+    let port;
     try {
-      const { pid, port } = JSON.parse(import_fs9.default.readFileSync(pidFile, "utf-8"));
-      if (port !== DAEMON_PORT) return false;
-      process.kill(pid, 0);
-      return true;
+      const data = JSON.parse(import_fs9.default.readFileSync(pidFile, "utf-8"));
+      pid = data.pid;
+      port = data.port;
     } catch {
       return false;
     }
+    if (port !== DAEMON_PORT) {
+      return false;
+    }
+    const MAX_PID = 4194304;
+    if (typeof pid !== "number" || !Number.isInteger(pid) || pid <= 0 || pid > MAX_PID) {
+      return false;
+    }
+    try {
+      process.kill(pid, 0);
+    } catch (err2) {
+      if (err2 instanceof Error && "code" in err2 && err2.code === "ESRCH") {
+        try {
+          import_fs9.default.unlinkSync(pidFile);
+        } catch {
+        }
+      }
+      return false;
+    }
+    const r = (0, import_child_process.spawnSync)("ss", ["-Htnp", `sport = :${DAEMON_PORT}`], {
+      encoding: "utf8",
+      timeout: 300
+    });
+    if (r.status === 0 && (r.stdout ?? "").includes(`:${DAEMON_PORT}`)) return true;
+    return false;
   }
   try {
     const r = (0, import_child_process.spawnSync)("ss", ["-Htnp", `sport = :${DAEMON_PORT}`], {
       encoding: "utf8",
-      timeout: 500
+      timeout: 300
     });
     return r.status === 0 && (r.stdout ?? "").includes(`:${DAEMON_PORT}`);
   } catch {
@@ -2811,11 +2837,12 @@ ${smartTruncate(str, 500)}`
 function escapePango(text) {
   return text.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
 }
-function buildPlainMessage(toolName, formattedArgs, agent, explainableLabel, locked, allowCount = 1) {
+function buildPlainMessage(toolName, formattedArgs, agent, explainableLabel, locked, allowCount = 1, ruleDescription) {
   const lines = [];
   if (locked) lines.push("\u26A0\uFE0F  LOCKED BY ADMIN POLICY\n");
   lines.push(`\u{1F916} ${agent || "AI Agent"}  |  \u{1F527} ${toolName}`);
   lines.push(`\u{1F6E1}\uFE0F  ${explainableLabel || "Security Policy"}`);
+  if (ruleDescription) lines.push(`\u2139  ${ruleDescription}`);
   lines.push("");
   lines.push(formattedArgs);
   if (allowCount >= 3) {
@@ -2828,7 +2855,7 @@ function buildPlainMessage(toolName, formattedArgs, agent, explainableLabel, loc
   }
   return lines.join("\n");
 }
-function buildPangoMessage(toolName, formattedArgs, agent, explainableLabel, locked, allowCount = 1) {
+function buildPangoMessage(toolName, formattedArgs, agent, explainableLabel, locked, allowCount = 1, ruleDescription) {
   const lines = [];
   if (locked) {
     lines.push('<span foreground="red" weight="bold">\u26A0\uFE0F  LOCKED BY ADMIN POLICY</span>');
@@ -2838,6 +2865,7 @@ function buildPangoMessage(toolName, formattedArgs, agent, explainableLabel, loc
     `<b>\u{1F916} ${escapePango(agent || "AI Agent")}</b>  |  <b>\u{1F527} <tt>${escapePango(toolName)}</tt></b>`
   );
   lines.push(`<i>\u{1F6E1}\uFE0F  ${escapePango(explainableLabel || "Security Policy")}</i>`);
+  if (ruleDescription) lines.push(`<i>\u2139  ${escapePango(ruleDescription)}</i>`);
   lines.push("");
   lines.push(`<tt>${escapePango(formattedArgs)}</tt>`);
   if (allowCount >= 3) {
@@ -2854,7 +2882,7 @@ function buildPangoMessage(toolName, formattedArgs, agent, explainableLabel, loc
   }
   return lines.join("\n");
 }
-async function askNativePopup(toolName, args, agent, explainableLabel, locked = false, signal, matchedField, matchedWord, allowCount = 1) {
+async function askNativePopup(toolName, args, agent, explainableLabel, locked = false, signal, matchedField, matchedWord, allowCount = 1, ruleDescription) {
   if (isTestEnv()) return "deny";
   const { message: formattedArgs, intent } = formatArgs(args, matchedField, matchedWord);
   const intentLabel = intent === "EDIT" ? "Code Edit" : "Action Approval";
@@ -2865,7 +2893,8 @@ async function askNativePopup(toolName, args, agent, explainableLabel, locked =
     agent,
     explainableLabel,
     locked,
-    allowCount
+    allowCount,
+    ruleDescription
   );
   return new Promise((resolve) => {
     let childProcess = null;
@@ -2899,7 +2928,8 @@ end run`;
           agent,
           explainableLabel,
           locked,
-          allowCount
+          allowCount,
+          ruleDescription
         );
         const argsList = [
           locked ? "--info" : "--question",
@@ -2972,7 +3002,7 @@ function auditLocalAllow(toolName, args, checkedBy, creds, meta) {
   }).catch(() => {
   });
 }
-async function initNode9SaaS(toolName, args, creds, meta, riskMetadata) {
+async function initNode9SaaS(toolName, args, creds, meta, riskMetadata, agentPolicy, forceReview) {
   const controller = new AbortController();
   const timeout = setTimeout(() => controller.abort(), 1e4);
   if (!creds.apiKey) throw new Error("Node9 API Key is missing");
@@ -3017,7 +3047,9 @@ async function initNode9SaaS(toolName, args, creds, meta, riskMetadata) {
           platform: import_os9.default.platform()
         },
         ...riskMetadata && { riskMetadata },
-        ...ciContext && { ciContext }
+        ...ciContext && { ciContext },
+        ...agentPolicy && { policy: agentPolicy },
+        ...forceReview && { forceReview: true }
       }),
       signal: controller.signal
     });
@@ -3414,6 +3446,7 @@ async function _authorizeHeadlessCore(toolName, args, meta, options) {
       policyMatchedWord,
       policyResult.ruleName
     );
+    if (policyRuleDescription) riskMetadata.ruleDescription = policyRuleDescription.slice(0, 200);
     const persistent = policyResult.ruleName ? null : getPersistentDecision(toolName);
     if (persistent === "allow") {
       if (approvers.cloud && creds?.apiKey)
@@ -3448,9 +3481,18 @@ async function _authorizeHeadlessCore(toolName, args, meta, options) {
   }
   let cloudRequestId = null;
   const cloudEnforced = approvers.cloud && !!creds?.apiKey;
-  if (cloudEnforced && !localSmartRuleMatched && !options?.localSmartRuleMatched) {
+  const forceReview = localSmartRuleMatched === true || options?.localSmartRuleMatched === true || void 0;
+  if (cloudEnforced) {
     try {
-      const initResult = await initNode9SaaS(toolName, args, creds, meta, riskMetadata);
+      const initResult = await initNode9SaaS(
+        toolName,
+        args,
+        creds,
+        meta,
+        riskMetadata,
+        config.settings.agentPolicy,
+        forceReview
+      );
       if (!initResult.pending) {
         if (initResult.shadowMode) {
           return { approved: true, checkedBy: "cloud" };
@@ -3465,9 +3507,7 @@ async function _authorizeHeadlessCore(toolName, args, meta, options) {
           };
         }
       }
-      if (!localSmartRuleMatched && !options?.localSmartRuleMatched) {
-        cloudRequestId = initResult.requestId || null;
-      }
+      if (initResult.pending) cloudRequestId = initResult.requestId || null;
       if (!taintWarning) explainableLabel = "Organization Policy (SaaS)";
     } catch {
     }
@@ -3524,7 +3564,7 @@ async function _authorizeHeadlessCore(toolName, args, meta, options) {
       }
     }
   }
-  if (cloudEnforced && cloudRequestId && !localSmartRuleMatched && !options?.localSmartRuleMatched) {
+  if (cloudEnforced && cloudRequestId) {
     racePromises.push(
       (async () => {
         try {
@@ -3556,7 +3596,8 @@ async function _authorizeHeadlessCore(toolName, args, meta, options) {
           signal,
           policyMatchedField,
           policyMatchedWord,
-          daemonAllowCount
+          daemonAllowCount,
+          riskMetadata?.ruleDescription
         );
         if (decision === "always_allow") {
           writeTrustSession(toolName, 36e5);
@@ -6059,8 +6100,175 @@ var init_patch = __esm({
   }
 });
 
+// src/costSync.ts
+function normalizeModel(raw) {
+  return raw.replace(/-\d{8}$/, "");
+}
+function pricingFor(model) {
+  const norm = normalizeModel(model);
+  if (PRICING[norm]) return PRICING[norm];
+  let best = null;
+  for (const key of Object.keys(PRICING)) {
+    if (norm.startsWith(key) && (best === null || key.length > best.length)) best = key;
+  }
+  return best ? PRICING[best] : null;
+}
+function parseJSONLFile(filePath) {
+  let content;
+  try {
+    content = import_fs16.default.readFileSync(filePath, "utf8");
+  } catch {
+    return /* @__PURE__ */ new Map();
+  }
+  const daily = /* @__PURE__ */ new Map();
+  for (const line of content.split("\n")) {
+    if (!line.trim()) continue;
+    let row;
+    try {
+      row = JSON.parse(line);
+    } catch {
+      continue;
+    }
+    if (row["type"] !== "assistant") continue;
+    const msg = row["message"];
+    if (!msg?.["usage"] || typeof msg["model"] !== "string") continue;
+    const usage = msg["usage"];
+    const model = msg["model"];
+    const timestamp = row["timestamp"];
+    if (typeof timestamp !== "string" || timestamp.length < 10) continue;
+    const date = timestamp.slice(0, 10);
+    const p = pricingFor(model);
+    if (!p) continue;
+    const inp = Number(usage["input_tokens"] ?? 0);
+    const out = Number(usage["output_tokens"] ?? 0);
+    const cw = Number(usage["cache_creation_input_tokens"] ?? 0);
+    const cr = Number(usage["cache_read_input_tokens"] ?? 0);
+    const cost = inp * p[0] + out * p[1] + cw * p[2] + cr * p[3];
+    const norm = normalizeModel(model);
+    const key = `${date}::${norm}`;
+    const prev = daily.get(key);
+    if (prev) {
+      prev.costUSD += cost;
+      prev.inputTokens += inp;
+      prev.outputTokens += out;
+      prev.cacheWriteTokens += cw;
+      prev.cacheReadTokens += cr;
+    } else {
+      daily.set(key, {
+        date,
+        model: norm,
+        costUSD: cost,
+        inputTokens: inp,
+        outputTokens: out,
+        cacheWriteTokens: cw,
+        cacheReadTokens: cr
+      });
+    }
+  }
+  return daily;
+}
+function collectEntries() {
+  const projectsDir = import_path19.default.join(import_os14.default.homedir(), ".claude", "projects");
+  if (!import_fs16.default.existsSync(projectsDir)) return [];
+  const combined = /* @__PURE__ */ new Map();
+  let dirs;
+  try {
+    dirs = import_fs16.default.readdirSync(projectsDir);
+  } catch {
+    return [];
+  }
+  for (const dir of dirs) {
+    const dirPath = import_path19.default.join(projectsDir, dir);
+    try {
+      if (!import_fs16.default.statSync(dirPath).isDirectory()) continue;
+    } catch {
+      continue;
+    }
+    let files;
+    try {
+      files = import_fs16.default.readdirSync(dirPath).filter((f) => f.endsWith(".jsonl"));
+    } catch {
+      continue;
+    }
+    for (const file of files) {
+      const entries = parseJSONLFile(import_path19.default.join(dirPath, file));
+      for (const [key, e] of entries) {
+        const prev = combined.get(key);
+        if (prev) {
+          prev.costUSD += e.costUSD;
+          prev.inputTokens += e.inputTokens;
+          prev.outputTokens += e.outputTokens;
+          prev.cacheWriteTokens += e.cacheWriteTokens;
+          prev.cacheReadTokens += e.cacheReadTokens;
+        } else {
+          combined.set(key, { ...e });
+        }
+      }
+    }
+  }
+  return [...combined.values()];
+}
+async function syncCost() {
+  const creds = getCredentials();
+  if (!creds?.apiKey || !creds?.apiUrl) return;
+  const entries = collectEntries();
+  if (entries.length === 0) return;
+  let username = "unknown";
+  try {
+    username = import_os14.default.userInfo().username;
+  } catch {
+  }
+  const machineId = `${import_os14.default.hostname()}:${username}`;
+  try {
+    const res = await fetch(`${creds.apiUrl}/cost-sync`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json", Authorization: `Bearer ${creds.apiKey}` },
+      body: JSON.stringify({ machineId, entries }),
+      signal: AbortSignal.timeout(15e3)
+    });
+    if (!res.ok) {
+      import_fs16.default.appendFileSync(HOOK_DEBUG_LOG, `[cost-sync] HTTP ${res.status}
+`);
+    }
+  } catch (err2) {
+    import_fs16.default.appendFileSync(HOOK_DEBUG_LOG, `[cost-sync] ${err2.message}
+`);
+  }
+}
+function startCostSync() {
+  syncCost().catch(() => {
+  });
+  const timer = setInterval(() => {
+    syncCost().catch(() => {
+    });
+  }, SYNC_INTERVAL_MS);
+  timer.unref();
+}
+var import_fs16, import_path19, import_os14, SYNC_INTERVAL_MS, PRICING;
+var init_costSync = __esm({
+  "src/costSync.ts"() {
+    "use strict";
+    import_fs16 = __toESM(require("fs"));
+    import_path19 = __toESM(require("path"));
+    import_os14 = __toESM(require("os"));
+    init_config();
+    init_audit();
+    SYNC_INTERVAL_MS = 10 * 60 * 1e3;
+    PRICING = {
+      "claude-opus-4": [5e-6, 25e-6, 625e-8, 5e-7],
+      "claude-sonnet-4": [3e-6, 15e-6, 375e-8, 3e-7],
+      "claude-haiku-4": [8e-7, 4e-6, 1e-6, 8e-8],
+      "claude-3-7-sonnet": [3e-6, 15e-6, 375e-8, 3e-7],
+      "claude-3-5-sonnet": [3e-6, 15e-6, 375e-8, 3e-7],
+      "claude-3-5-haiku": [8e-7, 4e-6, 1e-6, 8e-8],
+      "claude-3-haiku": [25e-8, 125e-8, 3e-7, 3e-8]
+    };
+  }
+});
+
 // src/daemon/server.ts
 function startDaemon() {
+  startCostSync();
   loadInsightCounts();
   const csrfToken = (0, import_crypto7.randomUUID)();
   const internalToken = (0, import_crypto7.randomUUID)();
@@ -6076,7 +6284,7 @@ function startDaemon() {
     idleTimer = setTimeout(() => {
       if (autoStarted) {
         try {
-          import_fs16.default.unlinkSync(DAEMON_PID_FILE);
+          import_fs17.default.unlinkSync(DAEMON_PID_FILE);
         } catch {
         }
       }
@@ -6239,7 +6447,7 @@ data: ${JSON.stringify(item.data)}
             status: "pending"
           });
         }
-        const projectCwd = typeof cwd === "string" && import_path19.default.isAbsolute(cwd) ? cwd : void 0;
+        const projectCwd = typeof cwd === "string" && import_path20.default.isAbsolute(cwd) ? cwd : void 0;
         const projectConfig = getConfig(projectCwd);
         const browserEnabled = projectConfig.settings.approvers?.browser !== false;
         const terminalEnabled = projectConfig.settings.approvers?.terminal !== false;
@@ -6629,8 +6837,8 @@ data: ${JSON.stringify(item.data)}
         const body = await readBody(req);
         const data = body ? JSON.parse(body) : {};
         const configPath = data.configPath ?? GLOBAL_CONFIG_PATH;
-        const node9Dir = import_path19.default.dirname(GLOBAL_CONFIG_PATH);
-        if (!import_path19.default.resolve(configPath).startsWith(node9Dir + import_path19.default.sep)) {
+        const node9Dir = import_path20.default.dirname(GLOBAL_CONFIG_PATH);
+        if (!import_path20.default.resolve(configPath).startsWith(node9Dir + import_path20.default.sep)) {
           res.writeHead(400, { "Content-Type": "application/json" });
           return res.end(
             JSON.stringify({ error: "configPath must be within the node9 config directory" })
@@ -6741,14 +6949,14 @@ data: ${JSON.stringify(item.data)}
   server.on("error", (e) => {
     if (e.code === "EADDRINUSE") {
       try {
-        if (import_fs16.default.existsSync(DAEMON_PID_FILE)) {
-          const { pid } = JSON.parse(import_fs16.default.readFileSync(DAEMON_PID_FILE, "utf-8"));
+        if (import_fs17.default.existsSync(DAEMON_PID_FILE)) {
+          const { pid } = JSON.parse(import_fs17.default.readFileSync(DAEMON_PID_FILE, "utf-8"));
           process.kill(pid, 0);
           return process.exit(0);
         }
       } catch {
         try {
-          import_fs16.default.unlinkSync(DAEMON_PID_FILE);
+          import_fs17.default.unlinkSync(DAEMON_PID_FILE);
         } catch {
         }
         server.listen(DAEMON_PORT, DAEMON_HOST);
@@ -6807,13 +7015,13 @@ data: ${JSON.stringify(item.data)}
   }
   startActivitySocket();
 }
-var import_http, import_fs16, import_path19, import_crypto7, import_child_process4, import_chalk2;
+var import_http, import_fs17, import_path20, import_crypto7, import_child_process4, import_chalk2;
 var init_server = __esm({
   "src/daemon/server.ts"() {
     "use strict";
     import_http = __toESM(require("http"));
-    import_fs16 = __toESM(require("fs"));
-    import_path19 = __toESM(require("path"));
+    import_fs17 = __toESM(require("fs"));
+    import_path20 = __toESM(require("path"));
     import_crypto7 = require("crypto");
     import_child_process4 = require("child_process");
     import_chalk2 = __toESM(require("chalk"));
@@ -6823,29 +7031,30 @@ var init_server = __esm({
     init_state2();
     init_patch();
     init_config_schema();
+    init_costSync();
   }
 });
 
 // src/daemon/index.ts
 function stopDaemon() {
-  if (!import_fs17.default.existsSync(DAEMON_PID_FILE)) return console.log(import_chalk3.default.yellow("Not running."));
+  if (!import_fs18.default.existsSync(DAEMON_PID_FILE)) return console.log(import_chalk3.default.yellow("Not running."));
   try {
-    const { pid } = JSON.parse(import_fs17.default.readFileSync(DAEMON_PID_FILE, "utf-8"));
+    const { pid } = JSON.parse(import_fs18.default.readFileSync(DAEMON_PID_FILE, "utf-8"));
     process.kill(pid, "SIGTERM");
     console.log(import_chalk3.default.green("\u2705 Stopped."));
   } catch {
     console.log(import_chalk3.default.gray("Cleaned up stale PID file."));
   } finally {
     try {
-      import_fs17.default.unlinkSync(DAEMON_PID_FILE);
+      import_fs18.default.unlinkSync(DAEMON_PID_FILE);
     } catch {
     }
   }
 }
 function daemonStatus() {
-  if (import_fs17.default.existsSync(DAEMON_PID_FILE)) {
+  if (import_fs18.default.existsSync(DAEMON_PID_FILE)) {
     try {
-      const { pid } = JSON.parse(import_fs17.default.readFileSync(DAEMON_PID_FILE, "utf-8"));
+      const { pid } = JSON.parse(import_fs18.default.readFileSync(DAEMON_PID_FILE, "utf-8"));
       process.kill(pid, 0);
       console.log(import_chalk3.default.green("Node9 daemon: running"));
       return;
@@ -6864,11 +7073,11 @@ function daemonStatus() {
     console.log(import_chalk3.default.yellow("Node9 daemon: not running"));
   }
 }
-var import_fs17, import_chalk3, import_child_process5;
+var import_fs18, import_chalk3, import_child_process5;
 var init_daemon2 = __esm({
   "src/daemon/index.ts"() {
     "use strict";
-    import_fs17 = __toESM(require("fs"));
+    import_fs18 = __toESM(require("fs"));
     import_chalk3 = __toESM(require("chalk"));
     import_child_process5 = require("child_process");
     init_server();
@@ -6902,7 +7111,7 @@ function formatBase(activity) {
   const time = new Date(activity.ts).toLocaleTimeString([], { hour12: false });
   const icon = getIcon(activity.tool);
   const toolName = activity.tool.slice(0, 16).padEnd(16);
-  const argsStr = JSON.stringify(activity.args ?? {}).replace(/\s+/g, " ").replaceAll(import_os24.default.homedir(), "~");
+  const argsStr = JSON.stringify(activity.args ?? {}).replace(/\s+/g, " ").replaceAll(import_os25.default.homedir(), "~");
   const argsPreview = argsStr.length > 70 ? argsStr.slice(0, 70) + "\u2026" : argsStr;
   return `${import_chalk19.default.gray(time)} ${icon} ${import_chalk19.default.white.bold(toolName)} ${import_chalk19.default.dim(argsPreview)}`;
 }
@@ -6941,9 +7150,9 @@ function renderPending(activity) {
 }
 async function ensureDaemon() {
   let pidPort = null;
-  if (import_fs28.default.existsSync(PID_FILE)) {
+  if (import_fs29.default.existsSync(PID_FILE)) {
     try {
-      const { port } = JSON.parse(import_fs28.default.readFileSync(PID_FILE, "utf-8"));
+      const { port } = JSON.parse(import_fs29.default.readFileSync(PID_FILE, "utf-8"));
       pidPort = port;
     } catch {
       console.error(import_chalk19.default.dim("\u26A0\uFE0F  Could not read PID file; falling back to default port."));
@@ -7020,6 +7229,9 @@ function buildCardLines(req, localCount = 0) {
     `${CYAN}\u2551${RESET2} Tool:    ${BOLD2}${req.toolName}${RESET2}`,
     `${CYAN}\u2551${RESET2} Reason:  ${tierLabel} \u2014 ${blockedBy}${RESET2}`
   ];
+  if (req.riskMetadata?.ruleDescription) {
+    lines.push(`${CYAN}\u2551${RESET2} ${YELLOW}\u2139  ${req.riskMetadata.ruleDescription}${RESET2}`);
+  }
   if (req.riskMetadata?.ruleName && blockedBy.includes("Taint")) {
     lines.push(`${CYAN}\u2551${RESET2} ${YELLOW}\u26A0  ${req.riskMetadata.ruleName}${RESET2}`);
   }
@@ -7063,9 +7275,9 @@ function buildRecoveryCardLines(req) {
   ];
 }
 function readApproversFromDisk() {
-  const configPath = import_path31.default.join(import_os24.default.homedir(), ".node9", "config.json");
+  const configPath = import_path32.default.join(import_os25.default.homedir(), ".node9", "config.json");
   try {
-    const raw = JSON.parse(import_fs28.default.readFileSync(configPath, "utf-8"));
+    const raw = JSON.parse(import_fs29.default.readFileSync(configPath, "utf-8"));
     const settings = raw.settings ?? {};
     return settings.approvers ?? {};
   } catch {
@@ -7081,15 +7293,15 @@ function approverStatusLine() {
   return `${fmt("native", "native")}  ${fmt("browser", "browser")}  ${fmt("cloud", "cloud")}  ${fmt("terminal", "terminal")}`;
 }
 function toggleApprover(channel) {
-  const configPath = import_path31.default.join(import_os24.default.homedir(), ".node9", "config.json");
+  const configPath = import_path32.default.join(import_os25.default.homedir(), ".node9", "config.json");
   try {
-    const raw = JSON.parse(import_fs28.default.readFileSync(configPath, "utf-8"));
+    const raw = JSON.parse(import_fs29.default.readFileSync(configPath, "utf-8"));
     const settings = raw.settings ?? {};
     const approvers = settings.approvers ?? {};
     approvers[channel] = approvers[channel] === false;
     settings.approvers = approvers;
     raw.settings = settings;
-    import_fs28.default.writeFileSync(configPath, JSON.stringify(raw, null, 2) + "\n");
+    import_fs29.default.writeFileSync(configPath, JSON.stringify(raw, null, 2) + "\n");
   } catch (err2) {
     process.stderr.write(`[node9] toggleApprover failed: ${String(err2)}
 `);
@@ -7259,8 +7471,8 @@ async function startTail(options = {}) {
       }
       postDecisionHttp(req2.id, httpDecision, csrfToken, port, httpOpts).catch((err2) => {
         try {
-          import_fs28.default.appendFileSync(
-            import_path31.default.join(import_os24.default.homedir(), ".node9", "hook-debug.log"),
+          import_fs29.default.appendFileSync(
+            import_path32.default.join(import_os25.default.homedir(), ".node9", "hook-debug.log"),
             `[tail] POST /decision failed: ${String(err2)}
 `
           );
@@ -7513,21 +7725,21 @@ async function startTail(options = {}) {
     process.exit(1);
   });
 }
-var import_http2, import_chalk19, import_fs28, import_os24, import_path31, import_readline5, import_child_process14, PID_FILE, ICONS, RESET2, BOLD2, RED, YELLOW, CYAN, GRAY, GREEN, HIDE_CURSOR, SHOW_CURSOR, ERASE_DOWN, pendingShownForId, pendingWrappedLines, DIVIDER;
+var import_http2, import_chalk19, import_fs29, import_os25, import_path32, import_readline5, import_child_process14, PID_FILE, ICONS, RESET2, BOLD2, RED, YELLOW, CYAN, GRAY, GREEN, HIDE_CURSOR, SHOW_CURSOR, ERASE_DOWN, pendingShownForId, pendingWrappedLines, DIVIDER;
 var init_tail = __esm({
   "src/tui/tail.ts"() {
     "use strict";
     import_http2 = __toESM(require("http"));
     import_chalk19 = __toESM(require("chalk"));
-    import_fs28 = __toESM(require("fs"));
-    import_os24 = __toESM(require("os"));
-    import_path31 = __toESM(require("path"));
+    import_fs29 = __toESM(require("fs"));
+    import_os25 = __toESM(require("os"));
+    import_path32 = __toESM(require("path"));
     import_readline5 = __toESM(require("readline"));
     import_child_process14 = require("child_process");
     init_daemon2();
     init_daemon();
     init_core();
-    PID_FILE = import_path31.default.join(import_os24.default.homedir(), ".node9", "daemon.pid");
+    PID_FILE = import_path32.default.join(import_os25.default.homedir(), ".node9", "daemon.pid");
     ICONS = {
       bash: "\u{1F4BB}",
       shell: "\u{1F4BB}",
@@ -7642,9 +7854,9 @@ function formatTimeLeft(resetsAt) {
   return ` (${m}m left)`;
 }
 function safeReadJson(filePath) {
-  if (!import_fs29.default.existsSync(filePath)) return null;
+  if (!import_fs30.default.existsSync(filePath)) return null;
   try {
-    return JSON.parse(import_fs29.default.readFileSync(filePath, "utf-8"));
+    return JSON.parse(import_fs30.default.readFileSync(filePath, "utf-8"));
   } catch {
     return null;
   }
@@ -7665,12 +7877,12 @@ function countHooksInFile(filePath) {
   return Object.keys(cfg.hooks).length;
 }
 function countRulesInDir(rulesDir) {
-  if (!import_fs29.default.existsSync(rulesDir)) return 0;
+  if (!import_fs30.default.existsSync(rulesDir)) return 0;
   let count = 0;
   try {
-    for (const entry of import_fs29.default.readdirSync(rulesDir, { withFileTypes: true })) {
+    for (const entry of import_fs30.default.readdirSync(rulesDir, { withFileTypes: true })) {
       if (entry.isDirectory()) {
-        count += countRulesInDir(import_path32.default.join(rulesDir, entry.name));
+        count += countRulesInDir(import_path33.default.join(rulesDir, entry.name));
       } else if (entry.isFile() && entry.name.endsWith(".md")) {
         count++;
       }
@@ -7681,46 +7893,46 @@ function countRulesInDir(rulesDir) {
 }
 function isSamePath(a, b) {
   try {
-    return import_path32.default.resolve(a) === import_path32.default.resolve(b);
+    return import_path33.default.resolve(a) === import_path33.default.resolve(b);
   } catch {
     return false;
   }
 }
 function countConfigs(cwd) {
-  const homeDir2 = import_os25.default.homedir();
-  const claudeDir = import_path32.default.join(homeDir2, ".claude");
+  const homeDir2 = import_os26.default.homedir();
+  const claudeDir = import_path33.default.join(homeDir2, ".claude");
   let claudeMdCount = 0;
   let rulesCount = 0;
   let hooksCount = 0;
   const userMcpServers = /* @__PURE__ */ new Set();
   const projectMcpServers = /* @__PURE__ */ new Set();
-  if (import_fs29.default.existsSync(import_path32.default.join(claudeDir, "CLAUDE.md"))) claudeMdCount++;
-  rulesCount += countRulesInDir(import_path32.default.join(claudeDir, "rules"));
-  const userSettings = import_path32.default.join(claudeDir, "settings.json");
+  if (import_fs30.default.existsSync(import_path33.default.join(claudeDir, "CLAUDE.md"))) claudeMdCount++;
+  rulesCount += countRulesInDir(import_path33.default.join(claudeDir, "rules"));
+  const userSettings = import_path33.default.join(claudeDir, "settings.json");
   for (const name of getMcpServerNames(userSettings)) userMcpServers.add(name);
   hooksCount += countHooksInFile(userSettings);
-  const userClaudeJson = import_path32.default.join(homeDir2, ".claude.json");
+  const userClaudeJson = import_path33.default.join(homeDir2, ".claude.json");
   for (const name of getMcpServerNames(userClaudeJson)) userMcpServers.add(name);
   for (const name of getDisabledMcpServers(userClaudeJson, "disabledMcpServers")) {
     userMcpServers.delete(name);
   }
   if (cwd) {
-    if (import_fs29.default.existsSync(import_path32.default.join(cwd, "CLAUDE.md"))) claudeMdCount++;
-    if (import_fs29.default.existsSync(import_path32.default.join(cwd, "CLAUDE.local.md"))) claudeMdCount++;
-    const projectClaudeDir = import_path32.default.join(cwd, ".claude");
+    if (import_fs30.default.existsSync(import_path33.default.join(cwd, "CLAUDE.md"))) claudeMdCount++;
+    if (import_fs30.default.existsSync(import_path33.default.join(cwd, "CLAUDE.local.md"))) claudeMdCount++;
+    const projectClaudeDir = import_path33.default.join(cwd, ".claude");
     const overlapsUserScope = isSamePath(projectClaudeDir, claudeDir);
     if (!overlapsUserScope) {
-      if (import_fs29.default.existsSync(import_path32.default.join(projectClaudeDir, "CLAUDE.md"))) claudeMdCount++;
-      rulesCount += countRulesInDir(import_path32.default.join(projectClaudeDir, "rules"));
-      const projSettings = import_path32.default.join(projectClaudeDir, "settings.json");
+      if (import_fs30.default.existsSync(import_path33.default.join(projectClaudeDir, "CLAUDE.md"))) claudeMdCount++;
+      rulesCount += countRulesInDir(import_path33.default.join(projectClaudeDir, "rules"));
+      const projSettings = import_path33.default.join(projectClaudeDir, "settings.json");
       for (const name of getMcpServerNames(projSettings)) projectMcpServers.add(name);
       hooksCount += countHooksInFile(projSettings);
     }
-    if (import_fs29.default.existsSync(import_path32.default.join(projectClaudeDir, "CLAUDE.local.md"))) claudeMdCount++;
-    const localSettings = import_path32.default.join(projectClaudeDir, "settings.local.json");
+    if (import_fs30.default.existsSync(import_path33.default.join(projectClaudeDir, "CLAUDE.local.md"))) claudeMdCount++;
+    const localSettings = import_path33.default.join(projectClaudeDir, "settings.local.json");
     for (const name of getMcpServerNames(localSettings)) projectMcpServers.add(name);
     hooksCount += countHooksInFile(localSettings);
-    const mcpJsonServers = getMcpServerNames(import_path32.default.join(cwd, ".mcp.json"));
+    const mcpJsonServers = getMcpServerNames(import_path33.default.join(cwd, ".mcp.json"));
     const disabledMcpJson = getDisabledMcpServers(localSettings, "disabledMcpjsonServers");
     for (const name of disabledMcpJson) mcpJsonServers.delete(name);
     for (const name of mcpJsonServers) projectMcpServers.add(name);
@@ -7753,12 +7965,12 @@ function readActiveShieldsHud() {
     return shieldsCache.value;
   }
   try {
-    const shieldsPath = import_path32.default.join(import_os25.default.homedir(), ".node9", "shields.json");
-    if (!import_fs29.default.existsSync(shieldsPath)) {
+    const shieldsPath = import_path33.default.join(import_os26.default.homedir(), ".node9", "shields.json");
+    if (!import_fs30.default.existsSync(shieldsPath)) {
       shieldsCache = { value: [], ts: now };
       return [];
     }
-    const parsed = JSON.parse(import_fs29.default.readFileSync(shieldsPath, "utf-8"));
+    const parsed = JSON.parse(import_fs30.default.readFileSync(shieldsPath, "utf-8"));
     if (!Array.isArray(parsed.active)) {
       shieldsCache = { value: [], ts: now };
       return [];
@@ -7860,17 +8072,17 @@ function renderContextLine(stdin) {
 async function main() {
   try {
     const [stdin, daemonStatus2] = await Promise.all([readStdin(), queryDaemon()]);
-    if (import_fs29.default.existsSync(import_path32.default.join(import_os25.default.homedir(), ".node9", "hud-debug"))) {
+    if (import_fs30.default.existsSync(import_path33.default.join(import_os26.default.homedir(), ".node9", "hud-debug"))) {
       try {
-        const logPath = import_path32.default.join(import_os25.default.homedir(), ".node9", "hud-debug.log");
+        const logPath = import_path33.default.join(import_os26.default.homedir(), ".node9", "hud-debug.log");
         const MAX_LOG_SIZE = 10 * 1024 * 1024;
         let size = 0;
         try {
-          size = import_fs29.default.statSync(logPath).size;
+          size = import_fs30.default.statSync(logPath).size;
         } catch {
         }
         if (size < MAX_LOG_SIZE) {
-          import_fs29.default.appendFileSync(
+          import_fs30.default.appendFileSync(
             logPath,
             JSON.stringify({ ts: (/* @__PURE__ */ new Date()).toISOString(), stdin }) + "\n"
           );
@@ -7891,11 +8103,11 @@ async function main() {
       try {
         const cwd = stdin.cwd ?? process.cwd();
         for (const configPath of [
-          import_path32.default.join(cwd, "node9.config.json"),
-          import_path32.default.join(import_os25.default.homedir(), ".node9", "config.json")
+          import_path33.default.join(cwd, "node9.config.json"),
+          import_path33.default.join(import_os26.default.homedir(), ".node9", "config.json")
         ]) {
-          if (!import_fs29.default.existsSync(configPath)) continue;
-          const cfg = JSON.parse(import_fs29.default.readFileSync(configPath, "utf-8"));
+          if (!import_fs30.default.existsSync(configPath)) continue;
+          const cfg = JSON.parse(import_fs30.default.readFileSync(configPath, "utf-8"));
           const hud = cfg.settings?.hud;
           if (hud && "showEnvironmentCounts" in hud) return hud.showEnvironmentCounts !== false;
         }
@@ -7913,13 +8125,13 @@ async function main() {
     renderOffline();
   }
 }
-var import_fs29, import_path32, import_os25, import_http3, RESET3, BOLD3, DIM, RED2, GREEN2, YELLOW2, BLUE, MAGENTA, CYAN2, WHITE, BAR_FILLED, BAR_EMPTY, BAR_WIDTH, shieldsCache, SHIELDS_CACHE_TTL_MS;
+var import_fs30, import_path33, import_os26, import_http3, RESET3, BOLD3, DIM, RED2, GREEN2, YELLOW2, BLUE, MAGENTA, CYAN2, WHITE, BAR_FILLED, BAR_EMPTY, BAR_WIDTH, shieldsCache, SHIELDS_CACHE_TTL_MS;
 var init_hud = __esm({
   "src/cli/hud.ts"() {
     "use strict";
-    import_fs29 = __toESM(require("fs"));
-    import_path32 = __toESM(require("path"));
-    import_os25 = __toESM(require("os"));
+    import_fs30 = __toESM(require("fs"));
+    import_path33 = __toESM(require("path"));
+    import_os26 = __toESM(require("os"));
     import_http3 = __toESM(require("http"));
     init_daemon();
     RESET3 = "\x1B[0m";
@@ -8529,9 +8741,9 @@ function teardownHud() {
 // src/cli.ts
 init_daemon2();
 var import_chalk20 = __toESM(require("chalk"));
-var import_fs30 = __toESM(require("fs"));
-var import_path33 = __toESM(require("path"));
-var import_os26 = __toESM(require("os"));
+var import_fs31 = __toESM(require("fs"));
+var import_path34 = __toESM(require("path"));
+var import_os27 = __toESM(require("os"));
 var import_prompts2 = require("@inquirer/prompts");
 
 // src/utils/duration.ts
@@ -8756,10 +8968,10 @@ async function autoStartDaemonAndWait() {
 
 // src/cli/commands/check.ts
 var import_chalk5 = __toESM(require("chalk"));
-var import_fs19 = __toESM(require("fs"));
+var import_fs20 = __toESM(require("fs"));
 var import_child_process9 = require("child_process");
-var import_path21 = __toESM(require("path"));
-var import_os15 = __toESM(require("os"));
+var import_path22 = __toESM(require("path"));
+var import_os16 = __toESM(require("os"));
 init_orchestrator();
 init_daemon();
 init_config();
@@ -8768,11 +8980,11 @@ init_policy();
 // src/undo.ts
 var import_child_process8 = require("child_process");
 var import_crypto8 = __toESM(require("crypto"));
-var import_fs18 = __toESM(require("fs"));
+var import_fs19 = __toESM(require("fs"));
 var import_net3 = __toESM(require("net"));
-var import_path20 = __toESM(require("path"));
-var import_os14 = __toESM(require("os"));
-var ACTIVITY_SOCKET_PATH3 = process.platform === "win32" ? "\\\\.\\pipe\\node9-activity" : import_path20.default.join(import_os14.default.tmpdir(), "node9-activity.sock");
+var import_path21 = __toESM(require("path"));
+var import_os15 = __toESM(require("os"));
+var ACTIVITY_SOCKET_PATH3 = process.platform === "win32" ? "\\\\.\\pipe\\node9-activity" : import_path21.default.join(import_os15.default.tmpdir(), "node9-activity.sock");
 function notifySnapshotTaken(hash, tool, argsSummary, fileCount) {
   try {
     const payload = JSON.stringify({
@@ -8792,22 +9004,22 @@ function notifySnapshotTaken(hash, tool, argsSummary, fileCount) {
   } catch {
   }
 }
-var SNAPSHOT_STACK_PATH = import_path20.default.join(import_os14.default.homedir(), ".node9", "snapshots.json");
-var UNDO_LATEST_PATH = import_path20.default.join(import_os14.default.homedir(), ".node9", "undo_latest.txt");
+var SNAPSHOT_STACK_PATH = import_path21.default.join(import_os15.default.homedir(), ".node9", "snapshots.json");
+var UNDO_LATEST_PATH = import_path21.default.join(import_os15.default.homedir(), ".node9", "undo_latest.txt");
 var MAX_SNAPSHOTS = 10;
 var GIT_TIMEOUT = 15e3;
 function readStack() {
   try {
-    if (import_fs18.default.existsSync(SNAPSHOT_STACK_PATH))
-      return JSON.parse(import_fs18.default.readFileSync(SNAPSHOT_STACK_PATH, "utf-8"));
+    if (import_fs19.default.existsSync(SNAPSHOT_STACK_PATH))
+      return JSON.parse(import_fs19.default.readFileSync(SNAPSHOT_STACK_PATH, "utf-8"));
   } catch {
   }
   return [];
 }
 function writeStack(stack) {
-  const dir = import_path20.default.dirname(SNAPSHOT_STACK_PATH);
-  if (!import_fs18.default.existsSync(dir)) import_fs18.default.mkdirSync(dir, { recursive: true });
-  import_fs18.default.writeFileSync(SNAPSHOT_STACK_PATH, JSON.stringify(stack, null, 2));
+  const dir = import_path21.default.dirname(SNAPSHOT_STACK_PATH);
+  if (!import_fs19.default.existsSync(dir)) import_fs19.default.mkdirSync(dir, { recursive: true });
+  import_fs19.default.writeFileSync(SNAPSHOT_STACK_PATH, JSON.stringify(stack, null, 2));
 }
 function extractFilePath(args) {
   if (!args || typeof args !== "object") return null;
@@ -8827,12 +9039,12 @@ function buildArgsSummary(tool, args) {
   return "";
 }
 function findProjectRoot(filePath) {
-  let dir = import_path20.default.dirname(filePath);
+  let dir = import_path21.default.dirname(filePath);
   while (true) {
-    if (import_fs18.default.existsSync(import_path20.default.join(dir, ".git")) || import_fs18.default.existsSync(import_path20.default.join(dir, "package.json"))) {
+    if (import_fs19.default.existsSync(import_path21.default.join(dir, ".git")) || import_fs19.default.existsSync(import_path21.default.join(dir, "package.json"))) {
       return dir;
     }
-    const parent = import_path20.default.dirname(dir);
+    const parent = import_path21.default.dirname(dir);
     if (parent === dir) return process.cwd();
     dir = parent;
   }
@@ -8840,7 +9052,7 @@ function findProjectRoot(filePath) {
 function normalizeCwdForHash(cwd) {
   let normalized;
   try {
-    normalized = import_fs18.default.realpathSync(cwd);
+    normalized = import_fs19.default.realpathSync(cwd);
   } catch {
     normalized = cwd;
   }
@@ -8850,16 +9062,16 @@ function normalizeCwdForHash(cwd) {
 }
 function getShadowRepoDir(cwd) {
   const hash = import_crypto8.default.createHash("sha256").update(normalizeCwdForHash(cwd)).digest("hex").slice(0, 16);
-  return import_path20.default.join(import_os14.default.homedir(), ".node9", "snapshots", hash);
+  return import_path21.default.join(import_os15.default.homedir(), ".node9", "snapshots", hash);
 }
 function cleanOrphanedIndexFiles(shadowDir) {
   try {
     const cutoff = Date.now() - 6e4;
-    for (const f of import_fs18.default.readdirSync(shadowDir)) {
+    for (const f of import_fs19.default.readdirSync(shadowDir)) {
       if (f.startsWith("index_")) {
-        const fp = import_path20.default.join(shadowDir, f);
+        const fp = import_path21.default.join(shadowDir, f);
         try {
-          if (import_fs18.default.statSync(fp).mtimeMs < cutoff) import_fs18.default.unlinkSync(fp);
+          if (import_fs19.default.statSync(fp).mtimeMs < cutoff) import_fs19.default.unlinkSync(fp);
         } catch {
         }
       }
@@ -8871,7 +9083,7 @@ function writeShadowExcludes(shadowDir, ignorePaths) {
   const hardcoded = [".git", ".node9"];
   const lines = [...hardcoded, ...ignorePaths].join("\n");
   try {
-    import_fs18.default.writeFileSync(import_path20.default.join(shadowDir, "info", "exclude"), lines + "\n", "utf8");
+    import_fs19.default.writeFileSync(import_path21.default.join(shadowDir, "info", "exclude"), lines + "\n", "utf8");
   } catch {
   }
 }
@@ -8884,25 +9096,25 @@ function ensureShadowRepo(shadowDir, cwd) {
     timeout: 3e3
   });
   if (check.status === 0) {
-    const ptPath = import_path20.default.join(shadowDir, "project-path.txt");
+    const ptPath = import_path21.default.join(shadowDir, "project-path.txt");
     try {
-      const stored = import_fs18.default.readFileSync(ptPath, "utf8").trim();
+      const stored = import_fs19.default.readFileSync(ptPath, "utf8").trim();
       if (stored === normalizedCwd) return true;
       if (process.env.NODE9_DEBUG === "1")
         console.error(
           `[Node9] Shadow repo path mismatch: stored="${stored}" expected="${normalizedCwd}" \u2014 reinitializing`
         );
-      import_fs18.default.rmSync(shadowDir, { recursive: true, force: true });
+      import_fs19.default.rmSync(shadowDir, { recursive: true, force: true });
     } catch {
       try {
-        import_fs18.default.writeFileSync(ptPath, normalizedCwd, "utf8");
+        import_fs19.default.writeFileSync(ptPath, normalizedCwd, "utf8");
       } catch {
       }
       return true;
     }
   }
   try {
-    import_fs18.default.mkdirSync(shadowDir, { recursive: true });
+    import_fs19.default.mkdirSync(shadowDir, { recursive: true });
   } catch {
   }
   const init = (0, import_child_process8.spawnSync)("git", ["init", "--bare", shadowDir], { timeout: 5e3 });
@@ -8911,7 +9123,7 @@ function ensureShadowRepo(shadowDir, cwd) {
     if (process.env.NODE9_DEBUG === "1") console.error("[Node9] git init --bare failed:", reason);
     return false;
   }
-  const configFile = import_path20.default.join(shadowDir, "config");
+  const configFile = import_path21.default.join(shadowDir, "config");
   (0, import_child_process8.spawnSync)("git", ["config", "--file", configFile, "core.untrackedCache", "true"], {
     timeout: 3e3
   });
@@ -8919,7 +9131,7 @@ function ensureShadowRepo(shadowDir, cwd) {
     timeout: 3e3
   });
   try {
-    import_fs18.default.writeFileSync(import_path20.default.join(shadowDir, "project-path.txt"), normalizedCwd, "utf8");
+    import_fs19.default.writeFileSync(import_path21.default.join(shadowDir, "project-path.txt"), normalizedCwd, "utf8");
   } catch {
   }
   return true;
@@ -8939,12 +9151,12 @@ async function createShadowSnapshot(tool = "unknown", args = {}, ignorePaths = [
   let indexFile = null;
   try {
     const rawFilePath = extractFilePath(args);
-    const absFilePath = rawFilePath && import_path20.default.isAbsolute(rawFilePath) ? rawFilePath : null;
+    const absFilePath = rawFilePath && import_path21.default.isAbsolute(rawFilePath) ? rawFilePath : null;
     const cwd = absFilePath ? findProjectRoot(absFilePath) : process.cwd();
     const shadowDir = getShadowRepoDir(cwd);
     if (!ensureShadowRepo(shadowDir, cwd)) return null;
     writeShadowExcludes(shadowDir, ignorePaths);
-    indexFile = import_path20.default.join(shadowDir, `index_${process.pid}_${Date.now()}`);
+    indexFile = import_path21.default.join(shadowDir, `index_${process.pid}_${Date.now()}`);
     const shadowEnv = {
       ...process.env,
       GIT_DIR: shadowDir,
@@ -9016,7 +9228,7 @@ async function createShadowSnapshot(tool = "unknown", args = {}, ignorePaths = [
     writeStack(stack);
     const entry = stack[stack.length - 1];
     notifySnapshotTaken(commitHash.slice(0, 7), tool, entry.argsSummary, capturedFiles.length);
-    import_fs18.default.writeFileSync(UNDO_LATEST_PATH, commitHash);
+    import_fs19.default.writeFileSync(UNDO_LATEST_PATH, commitHash);
     if (shouldGc) {
       (0, import_child_process8.spawn)("git", ["gc", "--auto"], { env: shadowEnv, detached: true, stdio: "ignore" }).unref();
     }
@@ -9027,7 +9239,7 @@ async function createShadowSnapshot(tool = "unknown", args = {}, ignorePaths = [
   } finally {
     if (indexFile) {
       try {
-        import_fs18.default.unlinkSync(indexFile);
+        import_fs19.default.unlinkSync(indexFile);
       } catch {
       }
     }
@@ -9103,9 +9315,9 @@ function applyUndo(hash, cwd) {
       timeout: GIT_TIMEOUT
     }).stdout?.toString().trim().split("\n").filter(Boolean) ?? [];
     for (const file of [...tracked, ...untracked]) {
-      const fullPath = import_path20.default.join(dir, file);
-      if (!snapshotFiles.has(file) && import_fs18.default.existsSync(fullPath)) {
-        import_fs18.default.unlinkSync(fullPath);
+      const fullPath = import_path21.default.join(dir, file);
+      if (!snapshotFiles.has(file) && import_fs19.default.existsSync(fullPath)) {
+        import_fs19.default.unlinkSync(fullPath);
       }
     }
     return true;
@@ -9129,9 +9341,9 @@ function registerCheckCommand(program2) {
         } catch (err2) {
           const tempConfig = getConfig();
           if (process.env.NODE9_DEBUG === "1" || tempConfig.settings.enableHookLogDebug) {
-            const logPath = import_path21.default.join(import_os15.default.homedir(), ".node9", "hook-debug.log");
+            const logPath = import_path22.default.join(import_os16.default.homedir(), ".node9", "hook-debug.log");
             const errMsg = err2 instanceof Error ? err2.message : String(err2);
-            import_fs19.default.appendFileSync(
+            import_fs20.default.appendFileSync(
               logPath,
               `[${(/* @__PURE__ */ new Date()).toISOString()}] JSON_PARSE_ERROR: ${errMsg}
 RAW: ${raw}
@@ -9144,13 +9356,13 @@ RAW: ${raw}
         if (config.settings.autoStartDaemon && !isDaemonRunning() && !process.env.NODE9_NO_AUTO_DAEMON) {
           try {
             const scriptPath = process.argv[1];
-            if (typeof scriptPath !== "string" || !import_path21.default.isAbsolute(scriptPath))
+            if (typeof scriptPath !== "string" || !import_path22.default.isAbsolute(scriptPath))
               throw new Error("node9: argv[1] is not an absolute path");
-            const resolvedScript = import_fs19.default.realpathSync(scriptPath);
-            const expectedCli = import_fs19.default.realpathSync(import_path21.default.resolve(__dirname, "../../cli.js"));
-            if (resolvedScript !== expectedCli)
+            const resolvedScript = import_fs20.default.realpathSync(scriptPath);
+            const packageDist = import_fs20.default.realpathSync(import_path22.default.resolve(__dirname, "../.."));
+            if (!resolvedScript.startsWith(packageDist + import_path22.default.sep) && resolvedScript !== packageDist)
               throw new Error(
-                "node9: daemon spawn aborted \u2014 argv[1] does not resolve to the node9 CLI"
+                `node9: daemon spawn aborted \u2014 argv[1] (${resolvedScript}) is outside package dist (${packageDist})`
               );
             const safeEnv = { ...process.env };
             for (const key of [
@@ -9169,14 +9381,24 @@ RAW: ${raw}
               env: { ...safeEnv, NODE9_AUTO_STARTED: "1", NODE9_BROWSER_OPENED: "1" }
             });
             d.unref();
-          } catch {
+          } catch (spawnErr) {
+            const logPath = import_path22.default.join(import_os16.default.homedir(), ".node9", "hook-debug.log");
+            const msg = spawnErr instanceof Error ? spawnErr.message : String(spawnErr);
+            try {
+              import_fs20.default.appendFileSync(
+                logPath,
+                `[${(/* @__PURE__ */ new Date()).toISOString()}] daemon-autostart-failed: ${msg}
+`
+              );
+            } catch {
+            }
           }
         }
         if (process.env.NODE9_DEBUG === "1" || config.settings.enableHookLogDebug) {
-          const logPath = import_path21.default.join(import_os15.default.homedir(), ".node9", "hook-debug.log");
-          if (!import_fs19.default.existsSync(import_path21.default.dirname(logPath)))
-            import_fs19.default.mkdirSync(import_path21.default.dirname(logPath), { recursive: true });
-          import_fs19.default.appendFileSync(logPath, `[${(/* @__PURE__ */ new Date()).toISOString()}] STDIN: ${raw}
+          const logPath = import_path22.default.join(import_os16.default.homedir(), ".node9", "hook-debug.log");
+          if (!import_fs20.default.existsSync(import_path22.default.dirname(logPath)))
+            import_fs20.default.mkdirSync(import_path22.default.dirname(logPath), { recursive: true });
+          import_fs20.default.appendFileSync(logPath, `[${(/* @__PURE__ */ new Date()).toISOString()}] STDIN: ${raw}
 `);
         }
         const toolName = sanitize2(payload.tool_name ?? payload.name ?? "");
@@ -9189,8 +9411,8 @@ RAW: ${raw}
           const isHumanDecision = blockedByContext.toLowerCase().includes("user") || blockedByContext.toLowerCase().includes("daemon") || blockedByContext.toLowerCase().includes("decision");
           let ttyFd = null;
           try {
-            ttyFd = import_fs19.default.openSync("/dev/tty", "w");
-            const writeTty = (line) => import_fs19.default.writeSync(ttyFd, line + "\n");
+            ttyFd = import_fs20.default.openSync("/dev/tty", "w");
+            const writeTty = (line) => import_fs20.default.writeSync(ttyFd, line + "\n");
             if (blockedByContext.includes("DLP") || blockedByContext.includes("Secret Detected") || blockedByContext.includes("Credential Review")) {
               writeTty(import_chalk5.default.bgRed.white.bold(`
  \u{1F6A8} NODE9 DLP ALERT \u2014 CREDENTIAL DETECTED `));
@@ -9209,7 +9431,7 @@ RAW: ${raw}
           } finally {
             if (ttyFd !== null)
               try {
-                import_fs19.default.closeSync(ttyFd);
+                import_fs20.default.closeSync(ttyFd);
               } catch {
               }
           }
@@ -9241,7 +9463,7 @@ RAW: ${raw}
         if (shouldSnapshot(toolName, toolInput, config)) {
           await createShadowSnapshot(toolName, toolInput, config.policy.snapshot.ignorePaths);
         }
-        const safeCwdForAuth = typeof payload.cwd === "string" && import_path21.default.isAbsolute(payload.cwd) ? payload.cwd : void 0;
+        const safeCwdForAuth = typeof payload.cwd === "string" && import_path22.default.isAbsolute(payload.cwd) ? payload.cwd : void 0;
         const result = await authorizeHeadless(toolName, toolInput, meta, {
           cwd: safeCwdForAuth
         });
@@ -9253,12 +9475,12 @@ RAW: ${raw}
         }
         if (result.noApprovalMechanism && !isDaemonRunning() && !process.env.NODE9_NO_AUTO_DAEMON && !process.stdout.isTTY && config.settings.autoStartDaemon) {
           try {
-            const tty = import_fs19.default.openSync("/dev/tty", "w");
-            import_fs19.default.writeSync(
+            const tty = import_fs20.default.openSync("/dev/tty", "w");
+            import_fs20.default.writeSync(
               tty,
               import_chalk5.default.cyan("\n\u{1F6E1}\uFE0F  Node9: Starting approval daemon automatically...\n")
             );
-            import_fs19.default.closeSync(tty);
+            import_fs20.default.closeSync(tty);
           } catch {
           }
           const daemonReady = await autoStartDaemonAndWait();
@@ -9285,9 +9507,9 @@ RAW: ${raw}
         });
       } catch (err2) {
         if (process.env.NODE9_DEBUG === "1") {
-          const logPath = import_path21.default.join(import_os15.default.homedir(), ".node9", "hook-debug.log");
+          const logPath = import_path22.default.join(import_os16.default.homedir(), ".node9", "hook-debug.log");
           const errMsg = err2 instanceof Error ? err2.message : String(err2);
-          import_fs19.default.appendFileSync(logPath, `[${(/* @__PURE__ */ new Date()).toISOString()}] ERROR: ${errMsg}
+          import_fs20.default.appendFileSync(logPath, `[${(/* @__PURE__ */ new Date()).toISOString()}] ERROR: ${errMsg}
 `);
         }
         process.exit(0);
@@ -9321,9 +9543,9 @@ RAW: ${raw}
 }
 
 // src/cli/commands/log.ts
-var import_fs20 = __toESM(require("fs"));
-var import_path22 = __toESM(require("path"));
-var import_os16 = __toESM(require("os"));
+var import_fs21 = __toESM(require("fs"));
+var import_path23 = __toESM(require("path"));
+var import_os17 = __toESM(require("os"));
 init_audit();
 init_config();
 init_policy();
@@ -9399,10 +9621,10 @@ function registerLogCommand(program2) {
           decision: "allowed",
           source: "post-hook"
         };
-        const logPath = import_path22.default.join(import_os16.default.homedir(), ".node9", "audit.log");
-        if (!import_fs20.default.existsSync(import_path22.default.dirname(logPath)))
-          import_fs20.default.mkdirSync(import_path22.default.dirname(logPath), { recursive: true });
-        import_fs20.default.appendFileSync(logPath, JSON.stringify(entry) + "\n");
+        const logPath = import_path23.default.join(import_os17.default.homedir(), ".node9", "audit.log");
+        if (!import_fs21.default.existsSync(import_path23.default.dirname(logPath)))
+          import_fs21.default.mkdirSync(import_path23.default.dirname(logPath), { recursive: true });
+        import_fs21.default.appendFileSync(logPath, JSON.stringify(entry) + "\n");
         if ((tool === "Bash" || tool === "bash") && isDaemonRunning()) {
           const command = typeof rawInput === "object" && rawInput !== null && "command" in rawInput && typeof rawInput.command === "string" ? rawInput.command : null;
           if (command) {
@@ -9435,7 +9657,7 @@ function registerLogCommand(program2) {
             }
           }
         }
-        const safeCwd = typeof payload.cwd === "string" && import_path22.default.isAbsolute(payload.cwd) ? payload.cwd : void 0;
+        const safeCwd = typeof payload.cwd === "string" && import_path23.default.isAbsolute(payload.cwd) ? payload.cwd : void 0;
         const config = getConfig(safeCwd);
         if (shouldSnapshot(tool, {}, config)) {
           await createShadowSnapshot("unknown", {}, config.policy.snapshot.ignorePaths);
@@ -9444,9 +9666,9 @@ function registerLogCommand(program2) {
         const msg = err2 instanceof Error ? err2.message : String(err2);
         process.stderr.write(`[Node9] audit log error: ${msg}
 `);
-        const debugPath = import_path22.default.join(import_os16.default.homedir(), ".node9", "hook-debug.log");
+        const debugPath = import_path23.default.join(import_os17.default.homedir(), ".node9", "hook-debug.log");
         try {
-          import_fs20.default.appendFileSync(debugPath, `[${(/* @__PURE__ */ new Date()).toISOString()}] LOG_ERROR: ${msg}
+          import_fs21.default.appendFileSync(debugPath, `[${(/* @__PURE__ */ new Date()).toISOString()}] LOG_ERROR: ${msg}
 `);
         } catch {
         }
@@ -9846,14 +10068,14 @@ function registerConfigShowCommand(program2) {
 
 // src/cli/commands/doctor.ts
 var import_chalk7 = __toESM(require("chalk"));
-var import_fs21 = __toESM(require("fs"));
-var import_path23 = __toESM(require("path"));
-var import_os17 = __toESM(require("os"));
+var import_fs22 = __toESM(require("fs"));
+var import_path24 = __toESM(require("path"));
+var import_os18 = __toESM(require("os"));
 var import_child_process10 = require("child_process");
 init_daemon();
 function registerDoctorCommand(program2, version2) {
   program2.command("doctor").description("Check that Node9 is installed and configured correctly").action(() => {
-    const homeDir2 = import_os17.default.homedir();
+    const homeDir2 = import_os18.default.homedir();
     let failures = 0;
     function pass(msg) {
       console.log(import_chalk7.default.green("  \u2705 ") + msg);
@@ -9902,10 +10124,10 @@ function registerDoctorCommand(program2, version2) {
       );
     }
     section("Configuration");
-    const globalConfigPath = import_path23.default.join(homeDir2, ".node9", "config.json");
-    if (import_fs21.default.existsSync(globalConfigPath)) {
+    const globalConfigPath = import_path24.default.join(homeDir2, ".node9", "config.json");
+    if (import_fs22.default.existsSync(globalConfigPath)) {
       try {
-        JSON.parse(import_fs21.default.readFileSync(globalConfigPath, "utf-8"));
+        JSON.parse(import_fs22.default.readFileSync(globalConfigPath, "utf-8"));
         pass("~/.node9/config.json found and valid");
       } catch {
         fail("~/.node9/config.json is invalid JSON", "Run: node9 init --force");
@@ -9913,10 +10135,10 @@ function registerDoctorCommand(program2, version2) {
     } else {
       warn("~/.node9/config.json not found (using defaults)", "Run: node9 init");
     }
-    const projectConfigPath = import_path23.default.join(process.cwd(), "node9.config.json");
-    if (import_fs21.default.existsSync(projectConfigPath)) {
+    const projectConfigPath = import_path24.default.join(process.cwd(), "node9.config.json");
+    if (import_fs22.default.existsSync(projectConfigPath)) {
       try {
-        JSON.parse(import_fs21.default.readFileSync(projectConfigPath, "utf-8"));
+        JSON.parse(import_fs22.default.readFileSync(projectConfigPath, "utf-8"));
         pass("node9.config.json found and valid (project)");
       } catch {
         fail(
@@ -9925,8 +10147,8 @@ function registerDoctorCommand(program2, version2) {
         );
       }
     }
-    const credsPath = import_path23.default.join(homeDir2, ".node9", "credentials.json");
-    if (import_fs21.default.existsSync(credsPath)) {
+    const credsPath = import_path24.default.join(homeDir2, ".node9", "credentials.json");
+    if (import_fs22.default.existsSync(credsPath)) {
       pass("Cloud credentials found (~/.node9/credentials.json)");
     } else {
       warn(
@@ -9935,10 +10157,10 @@ function registerDoctorCommand(program2, version2) {
       );
     }
     section("Agent Hooks");
-    const claudeSettingsPath = import_path23.default.join(homeDir2, ".claude", "settings.json");
-    if (import_fs21.default.existsSync(claudeSettingsPath)) {
+    const claudeSettingsPath = import_path24.default.join(homeDir2, ".claude", "settings.json");
+    if (import_fs22.default.existsSync(claudeSettingsPath)) {
       try {
-        const cs = JSON.parse(import_fs21.default.readFileSync(claudeSettingsPath, "utf-8"));
+        const cs = JSON.parse(import_fs22.default.readFileSync(claudeSettingsPath, "utf-8"));
         const hasHook = cs.hooks?.PreToolUse?.some(
           (m) => m.hooks.some((h) => h.command?.includes("node9") || h.command?.includes("cli.js"))
         );
@@ -9954,10 +10176,10 @@ function registerDoctorCommand(program2, version2) {
     } else {
       warn("Claude Code \u2014 not configured", "Run: node9 setup claude");
     }
-    const geminiSettingsPath = import_path23.default.join(homeDir2, ".gemini", "settings.json");
-    if (import_fs21.default.existsSync(geminiSettingsPath)) {
+    const geminiSettingsPath = import_path24.default.join(homeDir2, ".gemini", "settings.json");
+    if (import_fs22.default.existsSync(geminiSettingsPath)) {
       try {
-        const gs = JSON.parse(import_fs21.default.readFileSync(geminiSettingsPath, "utf-8"));
+        const gs = JSON.parse(import_fs22.default.readFileSync(geminiSettingsPath, "utf-8"));
         const hasHook = gs.hooks?.BeforeTool?.some(
           (m) => m.hooks.some((h) => h.command?.includes("node9") || h.command?.includes("cli.js"))
         );
@@ -9973,10 +10195,10 @@ function registerDoctorCommand(program2, version2) {
     } else {
       warn("Gemini CLI  \u2014 not configured", "Run: node9 setup gemini  (skip if not using Gemini)");
     }
-    const cursorHooksPath = import_path23.default.join(homeDir2, ".cursor", "hooks.json");
-    if (import_fs21.default.existsSync(cursorHooksPath)) {
+    const cursorHooksPath = import_path24.default.join(homeDir2, ".cursor", "hooks.json");
+    if (import_fs22.default.existsSync(cursorHooksPath)) {
       try {
-        const cur = JSON.parse(import_fs21.default.readFileSync(cursorHooksPath, "utf-8"));
+        const cur = JSON.parse(import_fs22.default.readFileSync(cursorHooksPath, "utf-8"));
         const hasHook = cur.hooks?.preToolUse?.some(
           (h) => h.command?.includes("node9") || h.command?.includes("cli.js")
         );
@@ -10014,9 +10236,9 @@ function registerDoctorCommand(program2, version2) {
 
 // src/cli/commands/audit.ts
 var import_chalk8 = __toESM(require("chalk"));
-var import_fs22 = __toESM(require("fs"));
-var import_path24 = __toESM(require("path"));
-var import_os18 = __toESM(require("os"));
+var import_fs23 = __toESM(require("fs"));
+var import_path25 = __toESM(require("path"));
+var import_os19 = __toESM(require("os"));
 function formatRelativeTime(timestamp) {
   const diff = Date.now() - new Date(timestamp).getTime();
   const sec = Math.floor(diff / 1e3);
@@ -10029,14 +10251,14 @@ function formatRelativeTime(timestamp) {
 }
 function registerAuditCommand(program2) {
   program2.command("audit").description("View local execution audit log").option("--tail <n>", "Number of entries to show", "20").option("--tool <pattern>", "Filter by tool name (substring match)").option("--deny", "Show only denied actions").option("--json", "Output raw JSON").action((options) => {
-    const logPath = import_path24.default.join(import_os18.default.homedir(), ".node9", "audit.log");
-    if (!import_fs22.default.existsSync(logPath)) {
+    const logPath = import_path25.default.join(import_os19.default.homedir(), ".node9", "audit.log");
+    if (!import_fs23.default.existsSync(logPath)) {
       console.log(
         import_chalk8.default.yellow("No audit logs found. Run node9 with an agent to generate entries.")
       );
       return;
     }
-    const raw = import_fs22.default.readFileSync(logPath, "utf-8");
+    const raw = import_fs23.default.readFileSync(logPath, "utf-8");
     const lines = raw.split("\n").filter((l) => l.trim() !== "");
     let entries = lines.flatMap((line) => {
       try {
@@ -10090,9 +10312,9 @@ function registerAuditCommand(program2) {
 
 // src/cli/commands/report.ts
 var import_chalk9 = __toESM(require("chalk"));
-var import_fs23 = __toESM(require("fs"));
-var import_path25 = __toESM(require("path"));
-var import_os19 = __toESM(require("os"));
+var import_fs24 = __toESM(require("fs"));
+var import_path26 = __toESM(require("path"));
+var import_os20 = __toESM(require("os"));
 var TEST_COMMAND_RE3 = /(?:^|\s)(npm\s+(?:run\s+)?test|npx\s+(?:vitest|jest|mocha)|yarn\s+(?:run\s+)?test|pnpm\s+(?:run\s+)?test|vitest|jest|mocha|pytest|py\.test|cargo\s+test|go\s+test|bundle\s+exec\s+rspec|rspec|phpunit|dotnet\s+test)\b/i;
 function buildTestTimestamps(allEntries) {
   const testTs = /* @__PURE__ */ new Set();
@@ -10139,8 +10361,8 @@ function getDateRange(period) {
   }
 }
 function parseAuditLog(logPath) {
-  if (!import_fs23.default.existsSync(logPath)) return [];
-  const raw = import_fs23.default.readFileSync(logPath, "utf-8");
+  if (!import_fs24.default.existsSync(logPath)) return [];
+  const raw = import_fs24.default.readFileSync(logPath, "utf-8");
   return raw.split("\n").flatMap((line) => {
     if (!line.trim()) return [];
     try {
@@ -10202,29 +10424,39 @@ function claudeModelPrice(model) {
   return null;
 }
 function loadClaudeCost(start, end) {
-  const projectsDir = import_path25.default.join(import_os19.default.homedir(), ".claude", "projects");
-  if (!import_fs23.default.existsSync(projectsDir)) return { total: 0, byDay: /* @__PURE__ */ new Map() };
+  const empty = {
+    total: 0,
+    byDay: /* @__PURE__ */ new Map(),
+    byModel: /* @__PURE__ */ new Map(),
+    inputTokens: 0,
+    cacheReadTokens: 0
+  };
+  const projectsDir = import_path26.default.join(import_os20.default.homedir(), ".claude", "projects");
+  if (!import_fs24.default.existsSync(projectsDir)) return empty;
   let dirs;
   try {
-    dirs = import_fs23.default.readdirSync(projectsDir);
+    dirs = import_fs24.default.readdirSync(projectsDir);
   } catch {
-    return { total: 0, byDay: /* @__PURE__ */ new Map() };
+    return empty;
   }
   let total = 0;
+  let inputTokens = 0;
+  let cacheReadTokens = 0;
   const byDay = /* @__PURE__ */ new Map();
+  const byModel = /* @__PURE__ */ new Map();
   for (const proj of dirs) {
-    const projPath = import_path25.default.join(projectsDir, proj);
+    const projPath = import_path26.default.join(projectsDir, proj);
     let files;
     try {
-      const stat = import_fs23.default.statSync(projPath);
+      const stat = import_fs24.default.statSync(projPath);
       if (!stat.isDirectory()) continue;
-      files = import_fs23.default.readdirSync(projPath).filter((f) => f.endsWith(".jsonl") && !f.startsWith("agent-"));
+      files = import_fs24.default.readdirSync(projPath).filter((f) => f.endsWith(".jsonl") && !f.startsWith("agent-"));
     } catch {
       continue;
     }
     for (const file of files) {
       try {
-        const raw = import_fs23.default.readFileSync(import_path25.default.join(projPath, file), "utf-8");
+        const raw = import_fs24.default.readFileSync(import_path26.default.join(projPath, file), "utf-8");
         for (const line of raw.split("\n")) {
           if (!line.trim()) continue;
           let entry;
@@ -10242,24 +10474,32 @@ function loadClaudeCost(start, end) {
           if (!usage || !model) continue;
           const p = claudeModelPrice(model);
           if (!p) continue;
-          const cost = (usage.input_tokens ?? 0) * p.i + (usage.output_tokens ?? 0) * p.o + (usage.cache_creation_input_tokens ?? 0) * p.cw + (usage.cache_read_input_tokens ?? 0) * p.cr;
+          const inp = usage.input_tokens ?? 0;
+          const out = usage.output_tokens ?? 0;
+          const cw = usage.cache_creation_input_tokens ?? 0;
+          const cr = usage.cache_read_input_tokens ?? 0;
+          const cost = inp * p.i + out * p.o + cw * p.cw + cr * p.cr;
           total += cost;
+          inputTokens += inp;
+          cacheReadTokens += cr;
           const dateKey = entry.timestamp.slice(0, 10);
           byDay.set(dateKey, (byDay.get(dateKey) ?? 0) + cost);
+          const normModel = model.replace(/@.*$/, "").replace(/-\d{8}$/, "");
+          byModel.set(normModel, (byModel.get(normModel) ?? 0) + cost);
         }
       } catch {
         continue;
       }
     }
   }
-  return { total, byDay };
+  return { total, byDay, byModel, inputTokens, cacheReadTokens };
 }
 function registerReportCommand(program2) {
   program2.command("report").description("Activity and security report \u2014 what Claude did, what was blocked").option("--period <period>", "today | 7d | 30d | month", "7d").option("--no-tests", "exclude test runner calls (npm test, vitest, pytest\u2026) from stats").action((options) => {
     const period = ["today", "7d", "30d", "month"].includes(
       options.period
     ) ? options.period : "7d";
-    const logPath = import_path25.default.join(import_os19.default.homedir(), ".node9", "audit.log");
+    const logPath = import_path26.default.join(import_os20.default.homedir(), ".node9", "audit.log");
     const allEntries = parseAuditLog(logPath);
     if (allEntries.length === 0) {
       console.log(
@@ -10268,7 +10508,13 @@ function registerReportCommand(program2) {
       return;
     }
     const { start, end } = getDateRange(period);
-    const { total: costUSD, byDay: costByDay } = loadClaudeCost(start, end);
+    const {
+      total: costUSD,
+      byDay: costByDay,
+      byModel: costByModel,
+      inputTokens: costInputTokens,
+      cacheReadTokens: costCacheRead
+    } = loadClaudeCost(start, end);
     const periodMs = end.getTime() - start.getTime();
     const priorEnd = new Date(start.getTime() - 1);
     const priorStart = new Date(start.getTime() - periodMs);
@@ -10370,7 +10616,6 @@ function registerReportCommand(program2) {
     const blockLabel = blocked > 0 ? import_chalk9.default.red(`\u{1F6D1} ${num(blocked)} blocked`) : import_chalk9.default.dim("\u{1F6D1} 0 blocked");
     const dlpLabel = dlpHits > 0 ? import_chalk9.default.yellow(`\u{1F6A8} ${dlpHits} DLP hits`) : import_chalk9.default.dim("\u{1F6A8} 0 DLP hits");
     const loopLabel = loopHits > 0 ? import_chalk9.default.yellow(`\u{1F504} ${loopHits} loops`) : import_chalk9.default.dim("\u{1F504} 0 loops");
-    const costLabel = costUSD > 0 ? import_chalk9.default.magenta(`\u{1F4B0} ${fmtCost(costUSD)}`) : import_chalk9.default.dim("\u{1F4B0} \u2013");
     const currentRate = total > 0 ? blocked / total : 0;
     const trendLabel = (() => {
       if (priorBlockRate === null) return import_chalk9.default.dim(`${pct(blocked, total)} block rate`);
@@ -10383,7 +10628,7 @@ function registerReportCommand(program2) {
     const ratioLabel = reads > 0 ? import_chalk9.default.dim(`edit/read ${(edits / reads).toFixed(1)}`) : import_chalk9.default.dim("edit/read \u2013");
     const testLabel = testPasses + testFails > 0 ? import_chalk9.default.dim("tests ") + import_chalk9.default.green(`${testPasses}\u2713`) + (testFails > 0 ? " " + import_chalk9.default.red(`${testFails}\u2717`) : "") : import_chalk9.default.dim("tests \u2013");
     console.log(
-      "  " + import_chalk9.default.green(`\u2705 ${num(allowed)} allowed`) + "   " + blockLabel + "   " + dlpLabel + "   " + loopLabel + "   " + trendLabel + "   " + costLabel
+      "  " + import_chalk9.default.green(`\u2705 ${num(allowed)} allowed`) + "   " + blockLabel + "   " + dlpLabel + "   " + loopLabel + "   " + trendLabel
     );
     console.log("  " + ratioLabel + "   " + testLabel);
     console.log("");
@@ -10468,6 +10713,30 @@ function registerReportCommand(program2) {
         );
       }
     }
+    if (costUSD > 0) {
+      const periodDays = Math.max(1, Math.ceil((end.getTime() - start.getTime()) / 864e5));
+      const avgPerDay = costUSD / periodDays;
+      const cacheHitPct = costInputTokens + costCacheRead > 0 ? Math.round(costCacheRead / (costInputTokens + costCacheRead) * 100) : 0;
+      const costHeaderRight = [
+        import_chalk9.default.yellow(fmtCost(costUSD)),
+        import_chalk9.default.dim(`avg ${fmtCost(avgPerDay)}/day`),
+        cacheHitPct > 0 ? import_chalk9.default.dim(`${cacheHitPct}% cache hit`) : null
+      ].filter(Boolean).join(import_chalk9.default.dim("  \xB7  "));
+      console.log("");
+      console.log("  " + import_chalk9.default.bold("Cost") + "  " + costHeaderRight);
+      console.log("  " + import_chalk9.default.dim("\u2500".repeat(Math.min(50, W - 4))));
+      const modelList = [...costByModel.entries()].sort((a, b) => b[1] - a[1]);
+      const maxModelCost = Math.max(...modelList.map(([, v]) => v), 1e-9);
+      const MODEL_LABEL = 22;
+      const MODEL_BAR = Math.max(6, Math.min(20, W - MODEL_LABEL - 12));
+      for (const [model, cost] of modelList) {
+        const label = model.length > MODEL_LABEL - 1 ? model.slice(0, MODEL_LABEL - 2) + "\u2026" : model;
+        const b = colorBar(cost, maxModelCost, MODEL_BAR);
+        console.log(
+          "  " + import_chalk9.default.white(label.padEnd(MODEL_LABEL)) + b + "  " + import_chalk9.default.yellow(fmtCost(cost))
+        );
+      }
+    }
     console.log("");
     console.log(
       "  " + import_chalk9.default.dim("node9 audit --deny") + import_chalk9.default.dim("  \xB7  ") + import_chalk9.default.dim("node9 report --period today|7d|30d|month  --no-tests")
@@ -10542,14 +10811,14 @@ function registerDaemonCommand(program2) {
 
 // src/cli/commands/status.ts
 var import_chalk11 = __toESM(require("chalk"));
-var import_fs24 = __toESM(require("fs"));
-var import_path26 = __toESM(require("path"));
-var import_os20 = __toESM(require("os"));
+var import_fs25 = __toESM(require("fs"));
+var import_path27 = __toESM(require("path"));
+var import_os21 = __toESM(require("os"));
 init_core();
 init_daemon();
 function readJson2(filePath) {
   try {
-    if (import_fs24.default.existsSync(filePath)) return JSON.parse(import_fs24.default.readFileSync(filePath, "utf-8"));
+    if (import_fs25.default.existsSync(filePath)) return JSON.parse(import_fs25.default.readFileSync(filePath, "utf-8"));
   } catch {
   }
   return null;
@@ -10614,28 +10883,28 @@ function registerStatusCommand(program2) {
     console.log("");
     const modeLabel = settings.mode === "audit" ? import_chalk11.default.blue("audit") : settings.mode === "strict" ? import_chalk11.default.red("strict") : import_chalk11.default.white("standard");
     console.log(`  Mode:    ${modeLabel}`);
-    const projectConfig = import_path26.default.join(process.cwd(), "node9.config.json");
-    const globalConfig = import_path26.default.join(import_os20.default.homedir(), ".node9", "config.json");
+    const projectConfig = import_path27.default.join(process.cwd(), "node9.config.json");
+    const globalConfig = import_path27.default.join(import_os21.default.homedir(), ".node9", "config.json");
     console.log(
-      `  Local:   ${import_fs24.default.existsSync(projectConfig) ? import_chalk11.default.green("Active (node9.config.json)") : import_chalk11.default.gray("Not present")}`
+      `  Local:   ${import_fs25.default.existsSync(projectConfig) ? import_chalk11.default.green("Active (node9.config.json)") : import_chalk11.default.gray("Not present")}`
     );
     console.log(
-      `  Global:  ${import_fs24.default.existsSync(globalConfig) ? import_chalk11.default.green("Active (~/.node9/config.json)") : import_chalk11.default.gray("Not present")}`
+      `  Global:  ${import_fs25.default.existsSync(globalConfig) ? import_chalk11.default.green("Active (~/.node9/config.json)") : import_chalk11.default.gray("Not present")}`
     );
     if (mergedConfig.policy.sandboxPaths.length > 0) {
       console.log(
         `  Sandbox: ${import_chalk11.default.green(`${mergedConfig.policy.sandboxPaths.length} safe zones active`)}`
       );
     }
-    const homeDir2 = import_os20.default.homedir();
+    const homeDir2 = import_os21.default.homedir();
     const claudeSettings = readJson2(
-      import_path26.default.join(homeDir2, ".claude", "settings.json")
+      import_path27.default.join(homeDir2, ".claude", "settings.json")
     );
-    const claudeConfig = readJson2(import_path26.default.join(homeDir2, ".claude.json"));
+    const claudeConfig = readJson2(import_path27.default.join(homeDir2, ".claude.json"));
     const geminiSettings = readJson2(
-      import_path26.default.join(homeDir2, ".gemini", "settings.json")
+      import_path27.default.join(homeDir2, ".gemini", "settings.json")
     );
-    const cursorConfig = readJson2(import_path26.default.join(homeDir2, ".cursor", "mcp.json"));
+    const cursorConfig = readJson2(import_path27.default.join(homeDir2, ".cursor", "mcp.json"));
     const agentFound = claudeSettings || claudeConfig || geminiSettings || cursorConfig;
     if (agentFound) {
       console.log("");
@@ -10694,9 +10963,9 @@ function registerStatusCommand(program2) {
 
 // src/cli/commands/init.ts
 var import_chalk12 = __toESM(require("chalk"));
-var import_fs25 = __toESM(require("fs"));
-var import_path27 = __toESM(require("path"));
-var import_os21 = __toESM(require("os"));
+var import_fs26 = __toESM(require("fs"));
+var import_path28 = __toESM(require("path"));
+var import_os22 = __toESM(require("os"));
 var import_https2 = __toESM(require("https"));
 init_core();
 init_shields();
@@ -10756,15 +11025,15 @@ function registerInitCommand(program2) {
       }
       console.log("");
     }
-    const configPath = import_path27.default.join(import_os21.default.homedir(), ".node9", "config.json");
-    if (import_fs25.default.existsSync(configPath) && !options.force) {
+    const configPath = import_path28.default.join(import_os22.default.homedir(), ".node9", "config.json");
+    if (import_fs26.default.existsSync(configPath) && !options.force) {
       try {
-        const existing = JSON.parse(import_fs25.default.readFileSync(configPath, "utf-8"));
+        const existing = JSON.parse(import_fs26.default.readFileSync(configPath, "utf-8"));
         const settings = existing.settings ?? {};
         if (settings.mode !== chosenMode) {
           settings.mode = chosenMode;
           existing.settings = settings;
-          import_fs25.default.writeFileSync(configPath, JSON.stringify(existing, null, 2) + "\n");
+          import_fs26.default.writeFileSync(configPath, JSON.stringify(existing, null, 2) + "\n");
           console.log(import_chalk12.default.green(`\u2705 Mode updated: ${chosenMode}`));
         } else {
           console.log(import_chalk12.default.blue(`\u2139\uFE0F  Config already exists: ${configPath}`));
@@ -10777,9 +11046,9 @@ function registerInitCommand(program2) {
         ...DEFAULT_CONFIG,
         settings: { ...DEFAULT_CONFIG.settings, mode: chosenMode }
       };
-      const dir = import_path27.default.dirname(configPath);
-      if (!import_fs25.default.existsSync(dir)) import_fs25.default.mkdirSync(dir, { recursive: true });
-      import_fs25.default.writeFileSync(configPath, JSON.stringify(configToSave, null, 2) + "\n");
+      const dir = import_path28.default.dirname(configPath);
+      if (!import_fs26.default.existsSync(dir)) import_fs26.default.mkdirSync(dir, { recursive: true });
+      import_fs26.default.writeFileSync(configPath, JSON.stringify(configToSave, null, 2) + "\n");
       console.log(import_chalk12.default.green(`\u2705 Config created: ${configPath}`));
       console.log(import_chalk12.default.gray(`   Mode: ${chosenMode}`));
     }
@@ -10833,7 +11102,7 @@ function registerInitCommand(program2) {
 }
 
 // src/cli/commands/undo.ts
-var import_path28 = __toESM(require("path"));
+var import_path29 = __toESM(require("path"));
 var import_chalk14 = __toESM(require("chalk"));
 
 // src/tui/undo-navigator.ts
@@ -10992,7 +11261,7 @@ function findMatchingCwd(startDir, history) {
   let dir = startDir;
   while (true) {
     if (cwds.has(dir)) return dir;
-    const parent = import_path28.default.dirname(dir);
+    const parent = import_path29.default.dirname(dir);
     if (parent === dir) return null;
     dir = parent;
   }
@@ -11188,12 +11457,12 @@ init_orchestrator();
 init_provenance();
 
 // src/mcp-pin.ts
-var import_fs26 = __toESM(require("fs"));
-var import_path29 = __toESM(require("path"));
-var import_os22 = __toESM(require("os"));
+var import_fs27 = __toESM(require("fs"));
+var import_path30 = __toESM(require("path"));
+var import_os23 = __toESM(require("os"));
 var import_crypto9 = __toESM(require("crypto"));
 function getPinsFilePath() {
-  return import_path29.default.join(import_os22.default.homedir(), ".node9", "mcp-pins.json");
+  return import_path30.default.join(import_os23.default.homedir(), ".node9", "mcp-pins.json");
 }
 function hashToolDefinitions(tools) {
   const sorted = [...tools].sort((a, b) => {
@@ -11210,7 +11479,7 @@ function getServerKey(upstreamCommand) {
 function readMcpPinsSafe() {
   const filePath = getPinsFilePath();
   try {
-    const raw = import_fs26.default.readFileSync(filePath, "utf-8");
+    const raw = import_fs27.default.readFileSync(filePath, "utf-8");
     if (!raw.trim()) {
       return { ok: false, reason: "corrupt", detail: "empty file" };
     }
@@ -11234,10 +11503,10 @@ function readMcpPins() {
 }
 function writeMcpPins(data) {
   const filePath = getPinsFilePath();
-  import_fs26.default.mkdirSync(import_path29.default.dirname(filePath), { recursive: true });
+  import_fs27.default.mkdirSync(import_path30.default.dirname(filePath), { recursive: true });
   const tmp = `${filePath}.${import_crypto9.default.randomBytes(6).toString("hex")}.tmp`;
-  import_fs26.default.writeFileSync(tmp, JSON.stringify(data, null, 2), { mode: 384 });
-  import_fs26.default.renameSync(tmp, filePath);
+  import_fs27.default.writeFileSync(tmp, JSON.stringify(data, null, 2), { mode: 384 });
+  import_fs27.default.renameSync(tmp, filePath);
 }
 function checkPin(serverKey, currentHash) {
   const result = readMcpPinsSafe();
@@ -11609,9 +11878,9 @@ function registerMcpGatewayCommand(program2) {
 
 // src/mcp-server/index.ts
 var import_readline4 = __toESM(require("readline"));
-var import_fs27 = __toESM(require("fs"));
-var import_os23 = __toESM(require("os"));
-var import_path30 = __toESM(require("path"));
+var import_fs28 = __toESM(require("fs"));
+var import_os24 = __toESM(require("os"));
+var import_path31 = __toESM(require("path"));
 init_core();
 init_daemon();
 init_shields();
@@ -11786,13 +12055,13 @@ function handleStatus() {
   lines.push(`Active shields: ${activeShields.length > 0 ? activeShields.join(", ") : "none"}`);
   lines.push(`Smart rules: ${config.policy.smartRules.length} loaded`);
   lines.push(`DLP: ${config.policy.dlp?.enabled !== false ? "enabled" : "disabled"}`);
-  const projectConfig = import_path30.default.join(process.cwd(), "node9.config.json");
-  const globalConfig = import_path30.default.join(import_os23.default.homedir(), ".node9", "config.json");
+  const projectConfig = import_path31.default.join(process.cwd(), "node9.config.json");
+  const globalConfig = import_path31.default.join(import_os24.default.homedir(), ".node9", "config.json");
   lines.push(
-    `Project config (node9.config.json): ${import_fs27.default.existsSync(projectConfig) ? "present" : "not found"}`
+    `Project config (node9.config.json): ${import_fs28.default.existsSync(projectConfig) ? "present" : "not found"}`
   );
   lines.push(
-    `Global config (~/.node9/config.json): ${import_fs27.default.existsSync(globalConfig) ? "present" : "not found"}`
+    `Global config (~/.node9/config.json): ${import_fs28.default.existsSync(globalConfig) ? "present" : "not found"}`
   );
   return lines.join("\n");
 }
@@ -11866,21 +12135,21 @@ function handleShieldDisable(args) {
   writeActiveShields(active.filter((s) => s !== name));
   return `Shield "${name}" disabled.`;
 }
-var GLOBAL_CONFIG_PATH2 = import_path30.default.join(import_os23.default.homedir(), ".node9", "config.json");
+var GLOBAL_CONFIG_PATH2 = import_path31.default.join(import_os24.default.homedir(), ".node9", "config.json");
 var APPROVER_CHANNELS = ["native", "browser", "cloud", "terminal"];
 function readGlobalConfigRaw() {
   try {
-    if (import_fs27.default.existsSync(GLOBAL_CONFIG_PATH2)) {
-      return JSON.parse(import_fs27.default.readFileSync(GLOBAL_CONFIG_PATH2, "utf-8"));
+    if (import_fs28.default.existsSync(GLOBAL_CONFIG_PATH2)) {
+      return JSON.parse(import_fs28.default.readFileSync(GLOBAL_CONFIG_PATH2, "utf-8"));
     }
   } catch {
   }
   return {};
 }
 function writeGlobalConfigRaw(data) {
-  const dir = import_path30.default.dirname(GLOBAL_CONFIG_PATH2);
-  if (!import_fs27.default.existsSync(dir)) import_fs27.default.mkdirSync(dir, { recursive: true });
-  import_fs27.default.writeFileSync(GLOBAL_CONFIG_PATH2, JSON.stringify(data, null, 2) + "\n");
+  const dir = import_path31.default.dirname(GLOBAL_CONFIG_PATH2);
+  if (!import_fs28.default.existsSync(dir)) import_fs28.default.mkdirSync(dir, { recursive: true });
+  import_fs28.default.writeFileSync(GLOBAL_CONFIG_PATH2, JSON.stringify(data, null, 2) + "\n");
 }
 function handleApproverList() {
   const config = getConfig();
@@ -11923,9 +12192,9 @@ function handleApproverSet(args) {
 }
 function handleAuditGet(args) {
   const limit = Math.min(typeof args.limit === "number" ? args.limit : 20, 100);
-  const auditPath = import_path30.default.join(import_os23.default.homedir(), ".node9", "audit.log");
-  if (!import_fs27.default.existsSync(auditPath)) return "No audit log found.";
-  const lines = import_fs27.default.readFileSync(auditPath, "utf-8").trim().split("\n").filter(Boolean);
+  const auditPath = import_path31.default.join(import_os24.default.homedir(), ".node9", "audit.log");
+  if (!import_fs28.default.existsSync(auditPath)) return "No audit log found.";
+  const lines = import_fs28.default.readFileSync(auditPath, "utf-8").trim().split("\n").filter(Boolean);
   const recent = lines.slice(-limit);
   const entries = recent.map((line) => {
     try {
@@ -12245,20 +12514,20 @@ function registerMcpPinCommand(program2) {
 
 // src/cli.ts
 var { version } = JSON.parse(
-  import_fs30.default.readFileSync(import_path33.default.join(__dirname, "../package.json"), "utf-8")
+  import_fs31.default.readFileSync(import_path34.default.join(__dirname, "../package.json"), "utf-8")
 );
 var program = new import_commander.Command();
 program.name("node9").description("The Sudo Command for AI Agents").version(version);
 program.command("login").argument("<apiKey>").option("--local", "Save key for audit/logging only \u2014 local config still controls all decisions").option("--profile <name>", 'Save as a named profile (default: "default")').action((apiKey, options) => {
   const DEFAULT_API_URL = "https://api.node9.ai/api/v1/intercept";
-  const credPath = import_path33.default.join(import_os26.default.homedir(), ".node9", "credentials.json");
-  if (!import_fs30.default.existsSync(import_path33.default.dirname(credPath)))
-    import_fs30.default.mkdirSync(import_path33.default.dirname(credPath), { recursive: true });
+  const credPath = import_path34.default.join(import_os27.default.homedir(), ".node9", "credentials.json");
+  if (!import_fs31.default.existsSync(import_path34.default.dirname(credPath)))
+    import_fs31.default.mkdirSync(import_path34.default.dirname(credPath), { recursive: true });
   const profileName = options.profile || "default";
   let existingCreds = {};
   try {
-    if (import_fs30.default.existsSync(credPath)) {
-      const raw = JSON.parse(import_fs30.default.readFileSync(credPath, "utf-8"));
+    if (import_fs31.default.existsSync(credPath)) {
+      const raw = JSON.parse(import_fs31.default.readFileSync(credPath, "utf-8"));
       if (raw.apiKey) {
         existingCreds = {
           default: { apiKey: raw.apiKey, apiUrl: raw.apiUrl || DEFAULT_API_URL }
@@ -12270,13 +12539,13 @@ program.command("login").argument("<apiKey>").option("--local", "Save key for au
   } catch {
   }
   existingCreds[profileName] = { apiKey, apiUrl: DEFAULT_API_URL };
-  import_fs30.default.writeFileSync(credPath, JSON.stringify(existingCreds, null, 2), { mode: 384 });
+  import_fs31.default.writeFileSync(credPath, JSON.stringify(existingCreds, null, 2), { mode: 384 });
   if (profileName === "default") {
-    const configPath = import_path33.default.join(import_os26.default.homedir(), ".node9", "config.json");
+    const configPath = import_path34.default.join(import_os27.default.homedir(), ".node9", "config.json");
     let config = {};
     try {
-      if (import_fs30.default.existsSync(configPath))
-        config = JSON.parse(import_fs30.default.readFileSync(configPath, "utf-8"));
+      if (import_fs31.default.existsSync(configPath))
+        config = JSON.parse(import_fs31.default.readFileSync(configPath, "utf-8"));
     } catch {
     }
     if (!config.settings || typeof config.settings !== "object") config.settings = {};
@@ -12291,9 +12560,9 @@ program.command("login").argument("<apiKey>").option("--local", "Save key for au
       approvers.cloud = false;
     }
     s.approvers = approvers;
-    if (!import_fs30.default.existsSync(import_path33.default.dirname(configPath)))
-      import_fs30.default.mkdirSync(import_path33.default.dirname(configPath), { recursive: true });
-    import_fs30.default.writeFileSync(configPath, JSON.stringify(config, null, 2), { mode: 384 });
+    if (!import_fs31.default.existsSync(import_path34.default.dirname(configPath)))
+      import_fs31.default.mkdirSync(import_path34.default.dirname(configPath), { recursive: true });
+    import_fs31.default.writeFileSync(configPath, JSON.stringify(config, null, 2), { mode: 384 });
   }
   if (options.profile && profileName !== "default") {
     console.log(import_chalk20.default.green(`\u2705 Profile "${profileName}" saved`));
@@ -12387,15 +12656,15 @@ program.command("uninstall").description("Remove all Node9 hooks and optionally
     }
   }
   if (options.purge) {
-    const node9Dir = import_path33.default.join(import_os26.default.homedir(), ".node9");
-    if (import_fs30.default.existsSync(node9Dir)) {
+    const node9Dir = import_path34.default.join(import_os27.default.homedir(), ".node9");
+    if (import_fs31.default.existsSync(node9Dir)) {
       const confirmed = await (0, import_prompts2.confirm)({
         message: `Permanently delete ${node9Dir} (config, audit log, credentials)?`,
         default: false
       });
       if (confirmed) {
-        import_fs30.default.rmSync(node9Dir, { recursive: true });
-        if (import_fs30.default.existsSync(node9Dir)) {
+        import_fs31.default.rmSync(node9Dir, { recursive: true });
+        if (import_fs31.default.existsSync(node9Dir)) {
           console.error(
             import_chalk20.default.red("\n  \u26A0\uFE0F  ~/.node9/ could not be fully deleted \u2014 remove it manually.")
           );
@@ -12536,14 +12805,14 @@ Claude Code spawns this command every ~300ms and writes a JSON payload to stdin.
 Run "node9 addto claude" to register it as the statusLine.`
 ).argument("[subcommand]", 'Optional: "debug on" / "debug off" to toggle stdin logging').argument("[state]", 'on|off \u2014 used with "debug" subcommand').action(async (subcommand, state) => {
   if (subcommand === "debug") {
-    const flagFile = import_path33.default.join(import_os26.default.homedir(), ".node9", "hud-debug");
+    const flagFile = import_path34.default.join(import_os27.default.homedir(), ".node9", "hud-debug");
     if (state === "on") {
-      import_fs30.default.mkdirSync(import_path33.default.dirname(flagFile), { recursive: true });
-      import_fs30.default.writeFileSync(flagFile, "");
+      import_fs31.default.mkdirSync(import_path34.default.dirname(flagFile), { recursive: true });
+      import_fs31.default.writeFileSync(flagFile, "");
       console.log("HUD debug logging enabled \u2192 ~/.node9/hud-debug.log");
       console.log("Tail it with: tail -f ~/.node9/hud-debug.log");
     } else if (state === "off") {
-      if (import_fs30.default.existsSync(flagFile)) import_fs30.default.unlinkSync(flagFile);
+      if (import_fs31.default.existsSync(flagFile)) import_fs31.default.unlinkSync(flagFile);
       console.log("HUD debug logging disabled.");
     } else {
       console.error("Usage: node9 hud debug on|off");
@@ -12650,9 +12919,9 @@ if (process.argv[2] !== "daemon") {
     const isCheckHook = process.argv[2] === "check";
     if (isCheckHook) {
       if (process.env.NODE9_DEBUG === "1" || getConfig().settings.enableHookLogDebug) {
-        const logPath = import_path33.default.join(import_os26.default.homedir(), ".node9", "hook-debug.log");
+        const logPath = import_path34.default.join(import_os27.default.homedir(), ".node9", "hook-debug.log");
         const msg = reason instanceof Error ? reason.message : String(reason);
-        import_fs30.default.appendFileSync(logPath, `[${(/* @__PURE__ */ new Date()).toISOString()}] UNHANDLED: ${msg}
+        import_fs31.default.appendFileSync(logPath, `[${(/* @__PURE__ */ new Date()).toISOString()}] UNHANDLED: ${msg}
 `);
       }
       process.exit(0);