@node9/proxy 1.19.2 → 1.19.3

package/dist/cli.js

@@ -4739,19 +4739,16 @@ function isDaemonRunning() {
       }
       return false;
     }
-    const r = (0, import_child_process.spawnSync)("ss", ["-Htnp", `sport = :${DAEMON_PORT}`], {
-      encoding: "utf8",
-      timeout: 300
-    });
-    if (r.status === 0 && (r.stdout ?? "").includes(`:${DAEMON_PORT}`)) return true;
-    return false;
+    return true;
   }
+  return false;
+}
+async function isDaemonReachable(timeoutMs = 500) {
   try {
-    const r = (0, import_child_process.spawnSync)("ss", ["-Htnp", `sport = :${DAEMON_PORT}`], {
-      encoding: "utf8",
-      timeout: 300
+    const res = await fetch(`http://${DAEMON_HOST}:${DAEMON_PORT}/settings`, {
+      signal: AbortSignal.timeout(timeoutMs)
     });
-    return r.status === 0 && (r.stdout ?? "").includes(`:${DAEMON_PORT}`);
+    return res.ok;
   } catch {
     return false;
   }
@@ -4890,7 +4887,7 @@ async function resolveViaDaemon(id, decision, internalToken, source) {
     signal: AbortSignal.timeout(3e3)
   });
 }
-var import_fs9, import_net, import_path9, import_os8, import_child_process, ACTIVITY_SOCKET_PATH, DAEMON_PORT, DAEMON_HOST;
+var import_fs9, import_net, import_path9, import_os8, ACTIVITY_SOCKET_PATH, DAEMON_PORT, DAEMON_HOST;
 var init_daemon = __esm({
   "src/auth/daemon.ts"() {
     "use strict";
@@ -4898,7 +4895,6 @@ var init_daemon = __esm({
     import_net = __toESM(require("net"));
     import_path9 = __toESM(require("path"));
     import_os8 = __toESM(require("os"));
-    import_child_process = require("child_process");
     ACTIVITY_SOCKET_PATH = process.platform === "win32" ? "\\\\.\\pipe\\node9-activity" : import_path9.default.join(import_os8.default.tmpdir(), "node9-activity.sock");
     DAEMON_PORT = 7391;
     DAEMON_HOST = "127.0.0.1";
@@ -5098,9 +5094,9 @@ function sendDesktopNotification(title, body) {
     if (process.platform === "darwin") {
       const esc = (s) => s.replace(/\\/g, "\\\\").replace(/"/g, '\\"');
       const script = `display notification "${esc(body)}" with title "${esc(title)}"`;
-      (0, import_child_process2.spawn)("osascript", ["-e", script], { detached: true, stdio: "ignore" }).unref();
+      (0, import_child_process.spawn)("osascript", ["-e", script], { detached: true, stdio: "ignore" }).unref();
     } else if (process.platform === "linux") {
-      (0, import_child_process2.spawn)("notify-send", [title, body, "--icon=dialog-warning"], {
+      (0, import_child_process.spawn)("notify-send", [title, body, "--icon=dialog-warning"], {
         detached: true,
         stdio: "ignore"
       }).unref();
@@ -5195,7 +5191,7 @@ activate
 display dialog (item 1 of argv) with title (item 2 of argv) ${buttons}
 end tell
 end run`;
-        childProcess = (0, import_child_process2.spawn)("osascript", ["-e", script, "--", message, title]);
+        childProcess = (0, import_child_process.spawn)("osascript", ["-e", script, "--", message, title]);
       } else if (process.platform === "linux") {
         const pangoMessage = buildPangoMessage(
           toolName,
@@ -5221,12 +5217,12 @@ end run`;
           argsList.push("--cancel-label", "Block  \u238B");
           argsList.push("--extra-button", "Always Allow");
         }
-        childProcess = (0, import_child_process2.spawn)("zenity", argsList);
+        childProcess = (0, import_child_process.spawn)("zenity", argsList);
       } else if (process.platform === "win32") {
         const b64Msg = Buffer.from(message).toString("base64");
         const b64Title = Buffer.from(title).toString("base64");
         const ps = `Add-Type -AssemblyName PresentationFramework; $msg = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String("${b64Msg}")); $title = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String("${b64Title}")); $res = [System.Windows.MessageBox]::Show($msg, $title, "${locked ? "OK" : "YesNo"}", "Warning", "Button2", "DefaultDesktopOnly"); if ($res -eq "Yes") { exit 0 } else { exit 1 }`;
-        childProcess = (0, import_child_process2.spawn)("powershell", ["-Command", ps]);
+        childProcess = (0, import_child_process.spawn)("powershell", ["-Command", ps]);
       }
       let output = "";
       childProcess?.stdout?.on("data", (d) => output += d.toString());
@@ -5242,11 +5238,11 @@ end run`;
     }
   });
 }
-var import_child_process2, import_path11, isTestEnv;
+var import_child_process, import_path11, isTestEnv;
 var init_native = __esm({
   "src/ui/native.ts"() {
     "use strict";
-    import_child_process2 = require("child_process");
+    import_child_process = require("child_process");
     import_path11 = __toESM(require("path"));
     init_context_sniper();
     isTestEnv = () => {
@@ -12664,13 +12660,26 @@ data: ${JSON.stringify(item.data)}
       }).then((res) => {
         if (res.ok) {
           try {
-            const r = (0, import_child_process3.spawnSync)("ss", ["-Htnp", `sport = :${DAEMON_PORT}`], {
+            let orphanPid = null;
+            const ss = (0, import_child_process2.spawnSync)("ss", ["-Htnp", `sport = :${DAEMON_PORT}`], {
               encoding: "utf8",
               timeout: 1e3
             });
-            const match = r.stdout?.match(/pid=(\d+)/);
-            if (match) {
-              const orphanPid = parseInt(match[1], 10);
+            if (!ss.error && ss.status === 0) {
+              const m = ss.stdout?.match(/pid=(\d+)/);
+              if (m) orphanPid = parseInt(m[1], 10);
+            } else if (ss.error?.code === "ENOENT" || ss.status === null) {
+              const lsof = (0, import_child_process2.spawnSync)(
+                "lsof",
+                ["-nP", `-iTCP:${DAEMON_PORT}`, "-sTCP:LISTEN", "-t"],
+                { encoding: "utf8", timeout: 1e3 }
+              );
+              if (!lsof.error && lsof.status === 0) {
+                const first = (lsof.stdout ?? "").split("\n")[0].trim();
+                if (/^\d+$/.test(first)) orphanPid = parseInt(first, 10);
+              }
+            }
+            if (orphanPid !== null) {
               process.kill(orphanPid, 0);
               atomicWriteSync2(
                 DAEMON_PID_FILE,
@@ -12705,14 +12714,14 @@ data: ${JSON.stringify(item.data)}
       JSON.stringify({ pid: process.pid, port: DAEMON_PORT, internalToken, autoStarted }),
       { mode: 384 }
     );
-    console.error(import_chalk6.default.green(`\u{1F6E1}\uFE0F  Node9 Guard LIVE: http://127.0.0.1:${DAEMON_PORT}`));
+    console.error(import_chalk6.default.green(`\u{1F6E1}\uFE0F  Node9 Guard LIVE on 127.0.0.1:${DAEMON_PORT}`));
   });
   if (watchMode) {
     console.error(import_chalk6.default.cyan("\u{1F6F0}\uFE0F  Flight Recorder active \u2014 daemon will not idle-timeout"));
   }
   startActivitySocket();
 }
-var import_http, import_fs25, import_path27, import_os23, import_crypto7, import_child_process3, import_chalk6;
+var import_http, import_fs25, import_path27, import_os23, import_crypto7, import_child_process2, import_chalk6;
 var init_server = __esm({
   "src/daemon/server.ts"() {
     "use strict";
@@ -12721,7 +12730,7 @@ var init_server = __esm({
     import_path27 = __toESM(require("path"));
     import_os23 = __toESM(require("os"));
     import_crypto7 = require("crypto");
-    import_child_process3 = require("child_process");
+    import_child_process2 = require("child_process");
     import_chalk6 = __toESM(require("chalk"));
     init_core();
     init_scan();
@@ -12746,7 +12755,7 @@ function resolveNode9Binary() {
   }
   try {
     const cmd = process.platform === "win32" ? "where" : "which";
-    const r = (0, import_child_process4.spawnSync)(cmd, ["node9"], { encoding: "utf8", timeout: 3e3 });
+    const r = (0, import_child_process3.spawnSync)(cmd, ["node9"], { encoding: "utf8", timeout: 3e3 });
     if (r.status === 0 && r.stdout.trim()) {
       return r.stdout.trim().split("\n")[0].trim();
     }
@@ -12798,8 +12807,8 @@ function installLaunchd(binaryPath) {
   const dir = import_path28.default.dirname(LAUNCHD_PLIST);
   if (!import_fs26.default.existsSync(dir)) import_fs26.default.mkdirSync(dir, { recursive: true });
   import_fs26.default.writeFileSync(LAUNCHD_PLIST, launchdPlist(binaryPath), "utf-8");
-  (0, import_child_process4.spawnSync)("launchctl", ["unload", LAUNCHD_PLIST], { encoding: "utf8" });
-  const r = (0, import_child_process4.spawnSync)("launchctl", ["load", "-w", LAUNCHD_PLIST], {
+  (0, import_child_process3.spawnSync)("launchctl", ["unload", LAUNCHD_PLIST], { encoding: "utf8" });
+  const r = (0, import_child_process3.spawnSync)("launchctl", ["load", "-w", LAUNCHD_PLIST], {
     encoding: "utf8",
     timeout: 5e3
   });
@@ -12809,7 +12818,7 @@ function installLaunchd(binaryPath) {
 }
 function uninstallLaunchd() {
   if (import_fs26.default.existsSync(LAUNCHD_PLIST)) {
-    (0, import_child_process4.spawnSync)("launchctl", ["unload", "-w", LAUNCHD_PLIST], { encoding: "utf8", timeout: 5e3 });
+    (0, import_child_process3.spawnSync)("launchctl", ["unload", "-w", LAUNCHD_PLIST], { encoding: "utf8", timeout: 5e3 });
     import_fs26.default.unlinkSync(LAUNCHD_PLIST);
   }
 }
@@ -12838,18 +12847,18 @@ function installSystemd(binaryPath) {
   }
   import_fs26.default.writeFileSync(SYSTEMD_UNIT, systemdUnit(binaryPath), "utf-8");
   try {
-    (0, import_child_process4.execFileSync)("loginctl", ["enable-linger", import_os24.default.userInfo().username], { timeout: 3e3 });
+    (0, import_child_process3.execFileSync)("loginctl", ["enable-linger", import_os24.default.userInfo().username], { timeout: 3e3 });
   } catch {
   }
-  const reload = (0, import_child_process4.spawnSync)("systemctl", ["--user", "daemon-reload"], {
+  const reload = (0, import_child_process3.spawnSync)("systemctl", ["--user", "daemon-reload"], {
     encoding: "utf8",
     timeout: 5e3
   });
   if (reload.status !== 0) {
     throw new Error(`systemctl daemon-reload failed: ${reload.stderr}`);
   }
-  (0, import_child_process4.spawnSync)("systemctl", ["--user", "stop", "node9-daemon"], { encoding: "utf8", timeout: 3e3 });
-  const enable = (0, import_child_process4.spawnSync)("systemctl", ["--user", "enable", "--now", "node9-daemon"], {
+  (0, import_child_process3.spawnSync)("systemctl", ["--user", "stop", "node9-daemon"], { encoding: "utf8", timeout: 3e3 });
+  const enable = (0, import_child_process3.spawnSync)("systemctl", ["--user", "enable", "--now", "node9-daemon"], {
     encoding: "utf8",
     timeout: 5e3
   });
@@ -12859,11 +12868,11 @@ function installSystemd(binaryPath) {
 }
 function uninstallSystemd() {
   if (import_fs26.default.existsSync(SYSTEMD_UNIT)) {
-    (0, import_child_process4.spawnSync)("systemctl", ["--user", "disable", "--now", "node9-daemon"], {
+    (0, import_child_process3.spawnSync)("systemctl", ["--user", "disable", "--now", "node9-daemon"], {
       encoding: "utf8",
       timeout: 5e3
     });
-    (0, import_child_process4.spawnSync)("systemctl", ["--user", "daemon-reload"], { encoding: "utf8", timeout: 5e3 });
+    (0, import_child_process3.spawnSync)("systemctl", ["--user", "daemon-reload"], { encoding: "utf8", timeout: 5e3 });
     import_fs26.default.unlinkSync(SYSTEMD_UNIT);
   }
 }
@@ -12881,7 +12890,7 @@ function stopRunningDaemon() {
       try {
         process.kill(pid, "SIGTERM");
         const deadline = Date.now() + 3e3;
-        const pollStop = (0, import_child_process4.spawnSync)(
+        const pollStop = (0, import_child_process3.spawnSync)(
           "sh",
           ["-c", `while kill -0 ${pid} 2>/dev/null; do sleep 0.1; done`],
           {
@@ -12913,7 +12922,7 @@ function installDaemonService() {
       return { ok: true, platform: "launchd", alreadyInstalled };
     }
     if (process.platform === "linux") {
-      const check = (0, import_child_process4.spawnSync)("systemctl", ["--user", "--version"], {
+      const check = (0, import_child_process3.spawnSync)("systemctl", ["--user", "--version"], {
         encoding: "utf8",
         timeout: 2e3
       });
@@ -12964,14 +12973,14 @@ function isDaemonServiceInstalled() {
   if (process.platform === "linux") return isSystemdInstalled();
   return false;
 }
-var import_fs26, import_path28, import_os24, import_child_process4, LAUNCHD_LABEL, LAUNCHD_PLIST, SYSTEMD_UNIT_DIR, SYSTEMD_UNIT;
+var import_fs26, import_path28, import_os24, import_child_process3, LAUNCHD_LABEL, LAUNCHD_PLIST, SYSTEMD_UNIT_DIR, SYSTEMD_UNIT;
 var init_service = __esm({
   "src/daemon/service.ts"() {
     "use strict";
     import_fs26 = __toESM(require("fs"));
     import_path28 = __toESM(require("path"));
     import_os24 = __toESM(require("os"));
-    import_child_process4 = require("child_process");
+    import_child_process3 = require("child_process");
     LAUNCHD_LABEL = "ai.node9.daemon";
     LAUNCHD_PLIST = import_path28.default.join(import_os24.default.homedir(), "Library", "LaunchAgents", `${LAUNCHD_LABEL}.plist`);
     SYSTEMD_UNIT_DIR = import_path28.default.join(import_os24.default.homedir(), ".config", "systemd", "user");
@@ -13021,28 +13030,19 @@ function daemonStatus() {
       processStatus = import_chalk7.default.yellow("not running (stale PID file)");
     }
   } else {
-    const r = (0, import_child_process5.spawnSync)("ss", ["-Htnp", `sport = :${DAEMON_PORT}`], {
-      encoding: "utf8",
-      timeout: 500
-    });
-    if (r.status === 0 && (r.stdout ?? "").includes(`:${DAEMON_PORT}`)) {
-      processStatus = import_chalk7.default.yellow(`running (orphaned \u2014 no PID file)`);
-    } else {
-      processStatus = import_chalk7.default.yellow("not running");
-    }
+    processStatus = import_chalk7.default.yellow("not running");
   }
   console.log(`
   Process : ${processStatus}`);
   console.log(`  Service : ${serviceLabel}
 `);
 }
-var import_fs27, import_chalk7, import_child_process5, MAX_PID;
+var import_fs27, import_chalk7, MAX_PID;
 var init_daemon2 = __esm({
   "src/daemon/index.ts"() {
     "use strict";
     import_fs27 = __toESM(require("fs"));
     import_chalk7 = __toESM(require("chalk"));
-    import_child_process5 = require("child_process");
     init_server();
     init_state2();
     init_service();
@@ -13219,7 +13219,7 @@ async function ensureDaemon() {
   } catch {
   }
   console.log(import_chalk30.default.dim("\u{1F6E1}\uFE0F  Starting Node9 daemon..."));
-  const child = (0, import_child_process15.spawn)(process.execPath, [process.argv[1], "daemon"], {
+  const child = (0, import_child_process13.spawn)(process.execPath, [process.argv[1], "daemon"], {
     detached: true,
     stdio: "ignore",
     env: { ...process.env, NODE9_AUTO_STARTED: "1" }
@@ -13849,7 +13849,7 @@ async function startTail(options = {}) {
     process.exit(1);
   });
 }
-var import_http2, import_chalk30, import_fs45, import_os41, import_path47, import_readline6, import_child_process15, PID_FILE, ICONS, MODEL_CONTEXT_LIMITS, RESET2, BOLD2, RED, YELLOW, CYAN, GRAY, GREEN, HIDE_CURSOR, SHOW_CURSOR, ERASE_DOWN, pendingShownForId, pendingWrappedLines, DIVIDER;
+var import_http2, import_chalk30, import_fs45, import_os41, import_path47, import_readline6, import_child_process13, PID_FILE, ICONS, MODEL_CONTEXT_LIMITS, RESET2, BOLD2, RED, YELLOW, CYAN, GRAY, GREEN, HIDE_CURSOR, SHOW_CURSOR, ERASE_DOWN, pendingShownForId, pendingWrappedLines, DIVIDER;
 var init_tail = __esm({
   "src/tui/tail.ts"() {
     "use strict";
@@ -13859,7 +13859,7 @@ var init_tail = __esm({
     import_os41 = __toESM(require("os"));
     import_path47 = __toESM(require("path"));
     import_readline6 = __toESM(require("readline"));
-    import_child_process15 = require("child_process");
+    import_child_process13 = require("child_process");
     init_daemon2();
     init_daemon();
     PID_FILE = import_path47.default.join(import_os41.default.homedir(), ".node9", "daemon.pid");
@@ -14315,7 +14315,7 @@ function parseDuration(str) {
 // src/proxy/index.ts
 var import_readline2 = __toESM(require("readline"));
 var import_chalk8 = __toESM(require("chalk"));
-var import_child_process6 = require("child_process");
+var import_child_process4 = require("child_process");
 var import_execa = require("execa");
 var import_execa2 = require("execa");
 init_orchestrator();
@@ -14403,11 +14403,11 @@ async function runProxy(targetCommand) {
   }
   console.error(import_chalk8.default.green(`\u{1F680} Node9 Proxy Active: Monitoring [${targetCommand}]`));
   const spawnEnv = { ...process.env, FORCE_COLOR: "1" };
-  const child = useShell ? (0, import_child_process6.spawn)("/bin/bash", ["-c", targetCommand], {
+  const child = useShell ? (0, import_child_process4.spawn)("/bin/bash", ["-c", targetCommand], {
     stdio: ["pipe", "pipe", "inherit"],
     shell: false,
     env: spawnEnv
-  }) : (0, import_child_process6.spawn)(executable, args, { stdio: ["pipe", "pipe", "inherit"], shell: false, env: spawnEnv });
+  }) : (0, import_child_process4.spawn)(executable, args, { stdio: ["pipe", "pipe", "inherit"], shell: false, env: spawnEnv });
   const agentIn = import_readline2.default.createInterface({ input: process.stdin, terminal: false });
   agentIn.on("line", async (line) => {
     let message;
@@ -14471,7 +14471,7 @@ async function runProxy(targetCommand) {
 }
 
 // src/cli/daemon-starter.ts
-var import_child_process7 = require("child_process");
+var import_child_process5 = require("child_process");
 var import_path29 = __toESM(require("path"));
 var import_fs28 = __toESM(require("fs"));
 init_daemon();
@@ -14489,7 +14489,7 @@ async function autoStartDaemonAndWait() {
   }
   if (!resolvedArgv1.endsWith(".js")) return false;
   try {
-    const child = (0, import_child_process7.spawn)(process.execPath, [resolvedArgv1, "daemon"], {
+    const child = (0, import_child_process5.spawn)(process.execPath, [resolvedArgv1, "daemon"], {
       detached: true,
       stdio: "ignore",
       env: {
@@ -14501,13 +14501,7 @@ async function autoStartDaemonAndWait() {
     for (let i = 0; i < 20; i++) {
       await new Promise((r) => setTimeout(r, 250));
       if (!isDaemonRunning()) continue;
-      try {
-        const res = await fetch(`http://${DAEMON_HOST}:${DAEMON_PORT}/settings`, {
-          signal: AbortSignal.timeout(500)
-        });
-        if (res.ok) return true;
-      } catch {
-      }
+      if (await isDaemonReachable()) return true;
     }
   } catch {
   }
@@ -14517,7 +14511,7 @@ async function autoStartDaemonAndWait() {
 // src/cli/commands/check.ts
 var import_chalk9 = __toESM(require("chalk"));
 var import_fs31 = __toESM(require("fs"));
-var import_child_process9 = require("child_process");
+var import_child_process7 = require("child_process");
 var import_path32 = __toESM(require("path"));
 var import_os27 = __toESM(require("os"));
 init_orchestrator();
@@ -14526,7 +14520,7 @@ init_config();
 init_policy();
 
 // src/undo.ts
-var import_child_process8 = require("child_process");
+var import_child_process6 = require("child_process");
 var import_crypto8 = __toESM(require("crypto"));
 var import_fs29 = __toESM(require("fs"));
 var import_net3 = __toESM(require("net"));
@@ -14639,7 +14633,7 @@ function ensureShadowRepo(shadowDir, cwd) {
   cleanOrphanedIndexFiles(shadowDir);
   const normalizedCwd = normalizeCwdForHash(cwd);
   const shadowEnvBase = { ...process.env, GIT_DIR: shadowDir, GIT_WORK_TREE: cwd };
-  const check = (0, import_child_process8.spawnSync)("git", ["rev-parse", "--git-dir"], {
+  const check = (0, import_child_process6.spawnSync)("git", ["rev-parse", "--git-dir"], {
     env: shadowEnvBase,
     timeout: 3e3
   });
@@ -14665,17 +14659,17 @@ function ensureShadowRepo(shadowDir, cwd) {
     import_fs29.default.mkdirSync(shadowDir, { recursive: true });
   } catch {
   }
-  const init = (0, import_child_process8.spawnSync)("git", ["init", "--bare", shadowDir], { timeout: 5e3 });
+  const init = (0, import_child_process6.spawnSync)("git", ["init", "--bare", shadowDir], { timeout: 5e3 });
   if (init.status !== 0 || init.error) {
     const reason = init.error ? init.error.message : init.stderr?.toString();
     if (process.env.NODE9_DEBUG === "1") console.error("[Node9] git init --bare failed:", reason);
     return false;
   }
   const configFile = import_path30.default.join(shadowDir, "config");
-  (0, import_child_process8.spawnSync)("git", ["config", "--file", configFile, "core.untrackedCache", "true"], {
+  (0, import_child_process6.spawnSync)("git", ["config", "--file", configFile, "core.untrackedCache", "true"], {
     timeout: 3e3
   });
-  (0, import_child_process8.spawnSync)("git", ["config", "--file", configFile, "core.fsmonitor", "true"], {
+  (0, import_child_process6.spawnSync)("git", ["config", "--file", configFile, "core.fsmonitor", "true"], {
     timeout: 3e3
   });
   try {
@@ -14686,14 +14680,17 @@ function ensureShadowRepo(shadowDir, cwd) {
 }
 function buildGitEnv(cwd) {
   const shadowDir = getShadowRepoDir(cwd);
-  const check = (0, import_child_process8.spawnSync)("git", ["rev-parse", "--git-dir"], {
+  const check = (0, import_child_process6.spawnSync)("git", ["rev-parse", "--git-dir"], {
     env: { ...process.env, GIT_DIR: shadowDir, GIT_WORK_TREE: cwd },
     timeout: 2e3
   });
   if (check.status === 0) {
     return { ...process.env, GIT_DIR: shadowDir, GIT_WORK_TREE: cwd };
   }
-  return { ...process.env };
+  const env = { ...process.env };
+  delete env.GIT_DIR;
+  delete env.GIT_WORK_TREE;
+  return env;
 }
 async function createShadowSnapshot(tool = "unknown", args = {}, ignorePaths = []) {
   let indexFile = null;
@@ -14711,11 +14708,11 @@ async function createShadowSnapshot(tool = "unknown", args = {}, ignorePaths = [
       GIT_WORK_TREE: cwd,
       GIT_INDEX_FILE: indexFile
     };
-    (0, import_child_process8.spawnSync)("git", ["add", "-A"], { env: shadowEnv, timeout: GIT_TIMEOUT });
-    const treeRes = (0, import_child_process8.spawnSync)("git", ["write-tree"], { env: shadowEnv, timeout: GIT_TIMEOUT });
+    (0, import_child_process6.spawnSync)("git", ["add", "-A"], { env: shadowEnv, timeout: GIT_TIMEOUT });
+    const treeRes = (0, import_child_process6.spawnSync)("git", ["write-tree"], { env: shadowEnv, timeout: GIT_TIMEOUT });
     const treeHash = treeRes.stdout?.toString().trim();
     if (!treeHash || treeRes.status !== 0) return null;
-    const commitRes = (0, import_child_process8.spawnSync)(
+    const commitRes = (0, import_child_process6.spawnSync)(
       "git",
       ["commit-tree", treeHash, "-m", `Node9 AI Snapshot: ${(/* @__PURE__ */ new Date()).toISOString()}`],
       { env: shadowEnv, timeout: GIT_TIMEOUT }
@@ -14727,7 +14724,7 @@ async function createShadowSnapshot(tool = "unknown", args = {}, ignorePaths = [
     let capturedFiles = [];
     let capturedDiff = null;
     if (prevEntry) {
-      const filesRes = (0, import_child_process8.spawnSync)("git", ["diff", "--name-only", prevEntry.hash, commitHash], {
+      const filesRes = (0, import_child_process6.spawnSync)("git", ["diff", "--name-only", prevEntry.hash, commitHash], {
         env: shadowEnv,
         timeout: GIT_TIMEOUT
       });
@@ -14737,7 +14734,7 @@ async function createShadowSnapshot(tool = "unknown", args = {}, ignorePaths = [
       if (capturedFiles.length === 0) {
         return prevEntry.hash;
       }
-      const diffRes = (0, import_child_process8.spawnSync)("git", ["diff", prevEntry.hash, commitHash], {
+      const diffRes = (0, import_child_process6.spawnSync)("git", ["diff", prevEntry.hash, commitHash], {
         env: shadowEnv,
         timeout: GIT_TIMEOUT
       });
@@ -14745,7 +14742,7 @@ async function createShadowSnapshot(tool = "unknown", args = {}, ignorePaths = [
         capturedDiff = diffRes.stdout?.toString() || null;
       }
     } else {
-      const filesRes = (0, import_child_process8.spawnSync)("git", ["ls-tree", "-r", "--name-only", commitHash], {
+      const filesRes = (0, import_child_process6.spawnSync)("git", ["ls-tree", "-r", "--name-only", commitHash], {
         env: shadowEnv,
         timeout: GIT_TIMEOUT
       });
@@ -14778,7 +14775,7 @@ async function createShadowSnapshot(tool = "unknown", args = {}, ignorePaths = [
     notifySnapshotTaken(commitHash.slice(0, 7), tool, entry.argsSummary, capturedFiles.length);
     import_fs29.default.writeFileSync(UNDO_LATEST_PATH, commitHash);
     if (shouldGc) {
-      (0, import_child_process8.spawn)("git", ["gc", "--auto"], { env: shadowEnv, detached: true, stdio: "ignore" }).unref();
+      (0, import_child_process6.spawn)("git", ["gc", "--auto"], { env: shadowEnv, detached: true, stdio: "ignore" }).unref();
     }
     return commitHash;
   } catch (err2) {
@@ -14799,14 +14796,14 @@ function getSnapshotHistory() {
 function computeUndoDiff(hash, cwd) {
   try {
     const env = buildGitEnv(cwd);
-    const statRes = (0, import_child_process8.spawnSync)("git", ["diff", hash, "--stat", "--", "."], {
+    const statRes = (0, import_child_process6.spawnSync)("git", ["diff", hash, "--stat", "--", "."], {
       cwd,
       env,
       timeout: GIT_TIMEOUT
     });
     const stat = statRes.stdout?.toString().trim();
     if (!stat || statRes.status !== 0) return null;
-    const diffRes = (0, import_child_process8.spawnSync)("git", ["diff", hash, "--", "."], {
+    const diffRes = (0, import_child_process6.spawnSync)("git", ["diff", hash, "--", "."], {
       cwd,
       env,
       timeout: GIT_TIMEOUT
@@ -14825,7 +14822,7 @@ function applyUndo(hash, cwd) {
   try {
     const dir = cwd ?? process.cwd();
     const env = buildGitEnv(dir);
-    const restore = (0, import_child_process8.spawnSync)("git", ["restore", "--source", hash, "--staged", "--worktree", "."], {
+    const restore = (0, import_child_process6.spawnSync)("git", ["restore", "--source", hash, "--staged", "--worktree", "."], {
       cwd: dir,
       env,
       timeout: GIT_TIMEOUT
@@ -14837,7 +14834,7 @@ function applyUndo(hash, cwd) {
       }
       return false;
     }
-    const lsTree = (0, import_child_process8.spawnSync)("git", ["ls-tree", "-r", "--name-only", hash], {
+    const lsTree = (0, import_child_process6.spawnSync)("git", ["ls-tree", "-r", "--name-only", hash], {
       cwd: dir,
       env,
       timeout: GIT_TIMEOUT
@@ -14856,8 +14853,8 @@ function applyUndo(hash, cwd) {
 `);
       return false;
     }
-    const tracked = (0, import_child_process8.spawnSync)("git", ["ls-files"], { cwd: dir, env, timeout: GIT_TIMEOUT }).stdout?.toString().trim().split("\n").filter(Boolean) ?? [];
-    const untracked = (0, import_child_process8.spawnSync)("git", ["ls-files", "--others", "--exclude-standard"], {
+    const tracked = (0, import_child_process6.spawnSync)("git", ["ls-files"], { cwd: dir, env, timeout: GIT_TIMEOUT }).stdout?.toString().trim().split("\n").filter(Boolean) ?? [];
+    const untracked = (0, import_child_process6.spawnSync)("git", ["ls-files", "--others", "--exclude-standard"], {
       cwd: dir,
       env,
       timeout: GIT_TIMEOUT
@@ -15128,7 +15125,7 @@ RAW: ${raw}
             ]) {
               delete safeEnv[key];
             }
-            const d = (0, import_child_process9.spawn)(process.execPath, [scriptPath, "daemon"], {
+            const d = (0, import_child_process7.spawn)(process.execPath, [scriptPath, "daemon"], {
               detached: true,
               stdio: "ignore",
               env: { ...safeEnv, NODE9_AUTO_STARTED: "1" }
@@ -15961,7 +15958,7 @@ var import_chalk11 = __toESM(require("chalk"));
 var import_fs33 = __toESM(require("fs"));
 var import_path34 = __toESM(require("path"));
 var import_os29 = __toESM(require("os"));
-var import_child_process10 = require("child_process");
+var import_child_process8 = require("child_process");
 init_daemon();
 function registerDoctorCommand(program2, version2) {
   program2.command("doctor").description("Check that Node9 is installed and configured correctly").action(() => {
@@ -15987,7 +15984,7 @@ function registerDoctorCommand(program2, version2) {
 `));
     section("Binary");
     try {
-      const which = (0, import_child_process10.execSync)("which node9", { encoding: "utf-8", timeout: 3e3 }).trim();
+      const which = (0, import_child_process8.execSync)("which node9", { encoding: "utf-8", timeout: 3e3 }).trim();
       pass(`node9 found at ${which}`);
     } catch {
       warn(
@@ -16005,7 +16002,7 @@ function registerDoctorCommand(program2, version2) {
       );
     }
     try {
-      const gitVersion = (0, import_child_process10.execSync)("git --version", { encoding: "utf-8", timeout: 3e3 }).trim();
+      const gitVersion = (0, import_child_process8.execSync)("git --version", { encoding: "utf-8", timeout: 3e3 }).trim();
       pass(gitVersion);
     } catch {
       warn(
@@ -16106,10 +16103,12 @@ function registerDoctorCommand(program2, version2) {
     }
     section("Daemon (optional)");
     if (isDaemonRunning()) {
-      pass(`Browser dashboard running \u2192 http://${DAEMON_HOST}:${DAEMON_PORT}/`);
+      pass(
+        `Daemon running on ${DAEMON_HOST}:${DAEMON_PORT} \u2014 terminal & native approvals enabled`
+      );
     } else {
       warn(
-        "Daemon not running \u2014 browser approvals unavailable",
+        "Daemon not running \u2014 terminal & native approvals unavailable",
         "Run: node9 daemon --background"
       );
     }
@@ -16981,7 +16980,7 @@ function registerReportCommand(program2) {
 
 // src/cli/commands/daemon-cmd.ts
 var import_chalk14 = __toESM(require("chalk"));
-var import_child_process11 = require("child_process");
+var import_child_process9 = require("child_process");
 init_daemon2();
 var VALID_ACTIONS = "start | stop | restart | status | install | uninstall";
 function registerDaemonCommand(program2) {
@@ -17020,7 +17019,7 @@ function registerDaemonCommand(program2) {
       if (cmd === "restart") {
         stopDaemon();
         await new Promise((r) => setTimeout(r, 500));
-        const child = (0, import_child_process11.spawn)(process.execPath, [process.argv[1], "daemon"], {
+        const child = (0, import_child_process9.spawn)(process.execPath, [process.argv[1], "daemon"], {
           detached: true,
           stdio: "ignore",
           env: { ...process.env, NODE9_AUTO_STARTED: "1" }
@@ -17050,7 +17049,7 @@ function registerDaemonCommand(program2) {
         return;
       }
       if (options.background) {
-        const child = (0, import_child_process11.spawn)(process.execPath, [process.argv[1], "daemon"], {
+        const child = (0, import_child_process9.spawn)(process.execPath, [process.argv[1], "daemon"], {
           detached: true,
           stdio: "ignore"
         });
@@ -17708,7 +17707,7 @@ function registerUndoCommand(program2) {
 
 // src/cli/commands/watch.ts
 var import_chalk19 = __toESM(require("chalk"));
-var import_child_process12 = require("child_process");
+var import_child_process10 = require("child_process");
 init_daemon();
 function registerWatchCommand(program2) {
   program2.command("watch").description("Run a command under Node9 watch mode (daemon stays alive for the session)").argument("<command>", "Command to run").argument("[args...]", "Arguments for the command").action(async (cmd, args) => {
@@ -17725,7 +17724,7 @@ function registerWatchCommand(program2) {
       }
     } catch {
       console.error(import_chalk19.default.dim("\u{1F6E1}\uFE0F  Starting Node9 daemon (watch mode)..."));
-      const child = (0, import_child_process12.spawn)(process.execPath, [process.argv[1], "daemon"], {
+      const child = (0, import_child_process10.spawn)(process.execPath, [process.argv[1], "daemon"], {
         detached: true,
         stdio: "ignore",
         env: { ...process.env, NODE9_AUTO_STARTED: "1", NODE9_WATCH_MODE: "1" }
@@ -17755,7 +17754,7 @@ function registerWatchCommand(program2) {
         "\n   Tip: run `node9 tail` in another terminal to review and approve AI actions.\n"
       )
     );
-    const result = (0, import_child_process12.spawnSync)(cmd, args, {
+    const result = (0, import_child_process10.spawnSync)(cmd, args, {
       stdio: "inherit",
       env: { ...process.env, NODE9_WATCH_MODE: "1" }
     });
@@ -17770,7 +17769,7 @@ function registerWatchCommand(program2) {
 // src/mcp-gateway/index.ts
 var import_readline4 = __toESM(require("readline"));
 var import_chalk20 = __toESM(require("chalk"));
-var import_child_process13 = require("child_process");
+var import_child_process11 = require("child_process");
 var import_execa3 = require("execa");
 init_orchestrator();
 init_provenance();
@@ -17956,7 +17955,7 @@ async function runMcpGateway(upstreamCommand) {
   const safeEnv = Object.fromEntries(
     Object.entries(process.env).filter(([k]) => !UPSTREAM_INJECTOR_VARS.has(k))
   );
-  const child = (0, import_child_process13.spawn)(executable, cmdArgs, {
+  const child = (0, import_child_process11.spawn)(executable, cmdArgs, {
     stdio: ["pipe", "pipe", "inherit"],
     // control stdin/stdout; inherit stderr
     shell: false,
@@ -18302,7 +18301,7 @@ var import_readline5 = __toESM(require("readline"));
 var import_fs39 = __toESM(require("fs"));
 var import_os35 = __toESM(require("os"));
 var import_path41 = __toESM(require("path"));
-var import_child_process14 = require("child_process");
+var import_child_process12 = require("child_process");
 init_core();
 init_daemon();
 init_shields();
@@ -18776,7 +18775,7 @@ function handleRuleAdd(args) {
   return `Rule "${name}" added to ~/.node9/config.json \u2014 verdict: ${verdict} when ${field} matches "${pattern}"`;
 }
 function runCliCommand(subArgs) {
-  const result = (0, import_child_process14.spawnSync)(process.execPath, [process.argv[1], ...subArgs], {
+  const result = (0, import_child_process12.spawnSync)(process.execPath, [process.argv[1], ...subArgs], {
     encoding: "utf-8",
     timeout: 6e4,
     // Disable colors — stdout is piped (not a TTY), chalk auto-detects, but be explicit

package/dist/cli.mjs

@@ -4651,7 +4651,6 @@ import fs9 from "fs";
 import net from "net";
 import path9 from "path";
 import os8 from "os";
-import { spawnSync } from "child_process";
 function notifyActivitySocket(data) {
   return new Promise((resolve) => {
     try {
@@ -4721,19 +4720,16 @@ function isDaemonRunning() {
       }
       return false;
     }
-    const r = spawnSync("ss", ["-Htnp", `sport = :${DAEMON_PORT}`], {
-      encoding: "utf8",
-      timeout: 300
-    });
-    if (r.status === 0 && (r.stdout ?? "").includes(`:${DAEMON_PORT}`)) return true;
-    return false;
+    return true;
   }
+  return false;
+}
+async function isDaemonReachable(timeoutMs = 500) {
   try {
-    const r = spawnSync("ss", ["-Htnp", `sport = :${DAEMON_PORT}`], {
-      encoding: "utf8",
-      timeout: 300
+    const res = await fetch(`http://${DAEMON_HOST}:${DAEMON_PORT}/settings`, {
+      signal: AbortSignal.timeout(timeoutMs)
     });
-    return r.status === 0 && (r.stdout ?? "").includes(`:${DAEMON_PORT}`);
+    return res.ok;
   } catch {
     return false;
   }
@@ -11834,7 +11830,7 @@ import fs25 from "fs";
 import path27 from "path";
 import os23 from "os";
 import { randomUUID as randomUUID4 } from "crypto";
-import { spawnSync as spawnSync2 } from "child_process";
+import { spawnSync } from "child_process";
 import chalk6 from "chalk";
 function startDaemon() {
   startCostSync();
@@ -12644,13 +12640,26 @@ data: ${JSON.stringify(item.data)}
       }).then((res) => {
         if (res.ok) {
           try {
-            const r = spawnSync2("ss", ["-Htnp", `sport = :${DAEMON_PORT}`], {
+            let orphanPid = null;
+            const ss = spawnSync("ss", ["-Htnp", `sport = :${DAEMON_PORT}`], {
               encoding: "utf8",
               timeout: 1e3
             });
-            const match = r.stdout?.match(/pid=(\d+)/);
-            if (match) {
-              const orphanPid = parseInt(match[1], 10);
+            if (!ss.error && ss.status === 0) {
+              const m = ss.stdout?.match(/pid=(\d+)/);
+              if (m) orphanPid = parseInt(m[1], 10);
+            } else if (ss.error?.code === "ENOENT" || ss.status === null) {
+              const lsof = spawnSync(
+                "lsof",
+                ["-nP", `-iTCP:${DAEMON_PORT}`, "-sTCP:LISTEN", "-t"],
+                { encoding: "utf8", timeout: 1e3 }
+              );
+              if (!lsof.error && lsof.status === 0) {
+                const first = (lsof.stdout ?? "").split("\n")[0].trim();
+                if (/^\d+$/.test(first)) orphanPid = parseInt(first, 10);
+              }
+            }
+            if (orphanPid !== null) {
               process.kill(orphanPid, 0);
               atomicWriteSync2(
                 DAEMON_PID_FILE,
@@ -12685,7 +12694,7 @@ data: ${JSON.stringify(item.data)}
       JSON.stringify({ pid: process.pid, port: DAEMON_PORT, internalToken, autoStarted }),
       { mode: 384 }
     );
-    console.error(chalk6.green(`\u{1F6E1}\uFE0F  Node9 Guard LIVE: http://127.0.0.1:${DAEMON_PORT}`));
+    console.error(chalk6.green(`\u{1F6E1}\uFE0F  Node9 Guard LIVE on 127.0.0.1:${DAEMON_PORT}`));
   });
   if (watchMode) {
     console.error(chalk6.cyan("\u{1F6F0}\uFE0F  Flight Recorder active \u2014 daemon will not idle-timeout"));
@@ -12711,7 +12720,7 @@ var init_server = __esm({
 import fs26 from "fs";
 import path28 from "path";
 import os24 from "os";
-import { spawnSync as spawnSync3, execFileSync } from "child_process";
+import { spawnSync as spawnSync2, execFileSync } from "child_process";
 function resolveNode9Binary() {
   try {
     const script = process.argv[1];
@@ -12722,7 +12731,7 @@ function resolveNode9Binary() {
   }
   try {
     const cmd = process.platform === "win32" ? "where" : "which";
-    const r = spawnSync3(cmd, ["node9"], { encoding: "utf8", timeout: 3e3 });
+    const r = spawnSync2(cmd, ["node9"], { encoding: "utf8", timeout: 3e3 });
     if (r.status === 0 && r.stdout.trim()) {
       return r.stdout.trim().split("\n")[0].trim();
     }
@@ -12774,8 +12783,8 @@ function installLaunchd(binaryPath) {
   const dir = path28.dirname(LAUNCHD_PLIST);
   if (!fs26.existsSync(dir)) fs26.mkdirSync(dir, { recursive: true });
   fs26.writeFileSync(LAUNCHD_PLIST, launchdPlist(binaryPath), "utf-8");
-  spawnSync3("launchctl", ["unload", LAUNCHD_PLIST], { encoding: "utf8" });
-  const r = spawnSync3("launchctl", ["load", "-w", LAUNCHD_PLIST], {
+  spawnSync2("launchctl", ["unload", LAUNCHD_PLIST], { encoding: "utf8" });
+  const r = spawnSync2("launchctl", ["load", "-w", LAUNCHD_PLIST], {
     encoding: "utf8",
     timeout: 5e3
   });
@@ -12785,7 +12794,7 @@ function installLaunchd(binaryPath) {
 }
 function uninstallLaunchd() {
   if (fs26.existsSync(LAUNCHD_PLIST)) {
-    spawnSync3("launchctl", ["unload", "-w", LAUNCHD_PLIST], { encoding: "utf8", timeout: 5e3 });
+    spawnSync2("launchctl", ["unload", "-w", LAUNCHD_PLIST], { encoding: "utf8", timeout: 5e3 });
     fs26.unlinkSync(LAUNCHD_PLIST);
   }
 }
@@ -12817,15 +12826,15 @@ function installSystemd(binaryPath) {
     execFileSync("loginctl", ["enable-linger", os24.userInfo().username], { timeout: 3e3 });
   } catch {
   }
-  const reload = spawnSync3("systemctl", ["--user", "daemon-reload"], {
+  const reload = spawnSync2("systemctl", ["--user", "daemon-reload"], {
     encoding: "utf8",
     timeout: 5e3
   });
   if (reload.status !== 0) {
     throw new Error(`systemctl daemon-reload failed: ${reload.stderr}`);
   }
-  spawnSync3("systemctl", ["--user", "stop", "node9-daemon"], { encoding: "utf8", timeout: 3e3 });
-  const enable = spawnSync3("systemctl", ["--user", "enable", "--now", "node9-daemon"], {
+  spawnSync2("systemctl", ["--user", "stop", "node9-daemon"], { encoding: "utf8", timeout: 3e3 });
+  const enable = spawnSync2("systemctl", ["--user", "enable", "--now", "node9-daemon"], {
     encoding: "utf8",
     timeout: 5e3
   });
@@ -12835,11 +12844,11 @@ function installSystemd(binaryPath) {
 }
 function uninstallSystemd() {
   if (fs26.existsSync(SYSTEMD_UNIT)) {
-    spawnSync3("systemctl", ["--user", "disable", "--now", "node9-daemon"], {
+    spawnSync2("systemctl", ["--user", "disable", "--now", "node9-daemon"], {
       encoding: "utf8",
       timeout: 5e3
     });
-    spawnSync3("systemctl", ["--user", "daemon-reload"], { encoding: "utf8", timeout: 5e3 });
+    spawnSync2("systemctl", ["--user", "daemon-reload"], { encoding: "utf8", timeout: 5e3 });
     fs26.unlinkSync(SYSTEMD_UNIT);
   }
 }
@@ -12857,7 +12866,7 @@ function stopRunningDaemon() {
       try {
         process.kill(pid, "SIGTERM");
         const deadline = Date.now() + 3e3;
-        const pollStop = spawnSync3(
+        const pollStop = spawnSync2(
           "sh",
           ["-c", `while kill -0 ${pid} 2>/dev/null; do sleep 0.1; done`],
           {
@@ -12889,7 +12898,7 @@ function installDaemonService() {
       return { ok: true, platform: "launchd", alreadyInstalled };
     }
     if (process.platform === "linux") {
-      const check = spawnSync3("systemctl", ["--user", "--version"], {
+      const check = spawnSync2("systemctl", ["--user", "--version"], {
         encoding: "utf8",
         timeout: 2e3
       });
@@ -12954,7 +12963,6 @@ var init_service = __esm({
 // src/daemon/index.ts
 import fs27 from "fs";
 import chalk7 from "chalk";
-import { spawnSync as spawnSync4 } from "child_process";
 function stopDaemon() {
   if (!fs27.existsSync(DAEMON_PID_FILE)) return console.log(chalk7.yellow("Not running."));
   try {
@@ -12996,15 +13004,7 @@ function daemonStatus() {
       processStatus = chalk7.yellow("not running (stale PID file)");
     }
   } else {
-    const r = spawnSync4("ss", ["-Htnp", `sport = :${DAEMON_PORT}`], {
-      encoding: "utf8",
-      timeout: 500
-    });
-    if (r.status === 0 && (r.stdout ?? "").includes(`:${DAEMON_PORT}`)) {
-      processStatus = chalk7.yellow(`running (orphaned \u2014 no PID file)`);
-    } else {
-      processStatus = chalk7.yellow("not running");
-    }
+    processStatus = chalk7.yellow("not running");
   }
   console.log(`
   Process : ${processStatus}`);
@@ -14473,13 +14473,7 @@ async function autoStartDaemonAndWait() {
     for (let i = 0; i < 20; i++) {
       await new Promise((r) => setTimeout(r, 250));
       if (!isDaemonRunning()) continue;
-      try {
-        const res = await fetch(`http://${DAEMON_HOST}:${DAEMON_PORT}/settings`, {
-          signal: AbortSignal.timeout(500)
-        });
-        if (res.ok) return true;
-      } catch {
-      }
+      if (await isDaemonReachable()) return true;
     }
   } catch {
   }
@@ -14498,7 +14492,7 @@ import path32 from "path";
 import os27 from "os";
 
 // src/undo.ts
-import { spawnSync as spawnSync5, spawn as spawn4 } from "child_process";
+import { spawnSync as spawnSync3, spawn as spawn4 } from "child_process";
 import crypto3 from "crypto";
 import fs29 from "fs";
 import net3 from "net";
@@ -14611,7 +14605,7 @@ function ensureShadowRepo(shadowDir, cwd) {
   cleanOrphanedIndexFiles(shadowDir);
   const normalizedCwd = normalizeCwdForHash(cwd);
   const shadowEnvBase = { ...process.env, GIT_DIR: shadowDir, GIT_WORK_TREE: cwd };
-  const check = spawnSync5("git", ["rev-parse", "--git-dir"], {
+  const check = spawnSync3("git", ["rev-parse", "--git-dir"], {
     env: shadowEnvBase,
     timeout: 3e3
   });
@@ -14637,17 +14631,17 @@ function ensureShadowRepo(shadowDir, cwd) {
     fs29.mkdirSync(shadowDir, { recursive: true });
   } catch {
   }
-  const init = spawnSync5("git", ["init", "--bare", shadowDir], { timeout: 5e3 });
+  const init = spawnSync3("git", ["init", "--bare", shadowDir], { timeout: 5e3 });
   if (init.status !== 0 || init.error) {
     const reason = init.error ? init.error.message : init.stderr?.toString();
     if (process.env.NODE9_DEBUG === "1") console.error("[Node9] git init --bare failed:", reason);
     return false;
   }
   const configFile = path30.join(shadowDir, "config");
-  spawnSync5("git", ["config", "--file", configFile, "core.untrackedCache", "true"], {
+  spawnSync3("git", ["config", "--file", configFile, "core.untrackedCache", "true"], {
     timeout: 3e3
   });
-  spawnSync5("git", ["config", "--file", configFile, "core.fsmonitor", "true"], {
+  spawnSync3("git", ["config", "--file", configFile, "core.fsmonitor", "true"], {
     timeout: 3e3
   });
   try {
@@ -14658,14 +14652,17 @@ function ensureShadowRepo(shadowDir, cwd) {
 }
 function buildGitEnv(cwd) {
   const shadowDir = getShadowRepoDir(cwd);
-  const check = spawnSync5("git", ["rev-parse", "--git-dir"], {
+  const check = spawnSync3("git", ["rev-parse", "--git-dir"], {
     env: { ...process.env, GIT_DIR: shadowDir, GIT_WORK_TREE: cwd },
     timeout: 2e3
   });
   if (check.status === 0) {
     return { ...process.env, GIT_DIR: shadowDir, GIT_WORK_TREE: cwd };
   }
-  return { ...process.env };
+  const env = { ...process.env };
+  delete env.GIT_DIR;
+  delete env.GIT_WORK_TREE;
+  return env;
 }
 async function createShadowSnapshot(tool = "unknown", args = {}, ignorePaths = []) {
   let indexFile = null;
@@ -14683,11 +14680,11 @@ async function createShadowSnapshot(tool = "unknown", args = {}, ignorePaths = [
       GIT_WORK_TREE: cwd,
       GIT_INDEX_FILE: indexFile
     };
-    spawnSync5("git", ["add", "-A"], { env: shadowEnv, timeout: GIT_TIMEOUT });
-    const treeRes = spawnSync5("git", ["write-tree"], { env: shadowEnv, timeout: GIT_TIMEOUT });
+    spawnSync3("git", ["add", "-A"], { env: shadowEnv, timeout: GIT_TIMEOUT });
+    const treeRes = spawnSync3("git", ["write-tree"], { env: shadowEnv, timeout: GIT_TIMEOUT });
     const treeHash = treeRes.stdout?.toString().trim();
     if (!treeHash || treeRes.status !== 0) return null;
-    const commitRes = spawnSync5(
+    const commitRes = spawnSync3(
       "git",
       ["commit-tree", treeHash, "-m", `Node9 AI Snapshot: ${(/* @__PURE__ */ new Date()).toISOString()}`],
       { env: shadowEnv, timeout: GIT_TIMEOUT }
@@ -14699,7 +14696,7 @@ async function createShadowSnapshot(tool = "unknown", args = {}, ignorePaths = [
     let capturedFiles = [];
     let capturedDiff = null;
     if (prevEntry) {
-      const filesRes = spawnSync5("git", ["diff", "--name-only", prevEntry.hash, commitHash], {
+      const filesRes = spawnSync3("git", ["diff", "--name-only", prevEntry.hash, commitHash], {
         env: shadowEnv,
         timeout: GIT_TIMEOUT
       });
@@ -14709,7 +14706,7 @@ async function createShadowSnapshot(tool = "unknown", args = {}, ignorePaths = [
       if (capturedFiles.length === 0) {
         return prevEntry.hash;
       }
-      const diffRes = spawnSync5("git", ["diff", prevEntry.hash, commitHash], {
+      const diffRes = spawnSync3("git", ["diff", prevEntry.hash, commitHash], {
         env: shadowEnv,
         timeout: GIT_TIMEOUT
       });
@@ -14717,7 +14714,7 @@ async function createShadowSnapshot(tool = "unknown", args = {}, ignorePaths = [
         capturedDiff = diffRes.stdout?.toString() || null;
       }
     } else {
-      const filesRes = spawnSync5("git", ["ls-tree", "-r", "--name-only", commitHash], {
+      const filesRes = spawnSync3("git", ["ls-tree", "-r", "--name-only", commitHash], {
         env: shadowEnv,
         timeout: GIT_TIMEOUT
       });
@@ -14771,14 +14768,14 @@ function getSnapshotHistory() {
 function computeUndoDiff(hash, cwd) {
   try {
     const env = buildGitEnv(cwd);
-    const statRes = spawnSync5("git", ["diff", hash, "--stat", "--", "."], {
+    const statRes = spawnSync3("git", ["diff", hash, "--stat", "--", "."], {
       cwd,
       env,
       timeout: GIT_TIMEOUT
     });
     const stat = statRes.stdout?.toString().trim();
     if (!stat || statRes.status !== 0) return null;
-    const diffRes = spawnSync5("git", ["diff", hash, "--", "."], {
+    const diffRes = spawnSync3("git", ["diff", hash, "--", "."], {
       cwd,
       env,
       timeout: GIT_TIMEOUT
@@ -14797,7 +14794,7 @@ function applyUndo(hash, cwd) {
   try {
     const dir = cwd ?? process.cwd();
     const env = buildGitEnv(dir);
-    const restore = spawnSync5("git", ["restore", "--source", hash, "--staged", "--worktree", "."], {
+    const restore = spawnSync3("git", ["restore", "--source", hash, "--staged", "--worktree", "."], {
       cwd: dir,
       env,
       timeout: GIT_TIMEOUT
@@ -14809,7 +14806,7 @@ function applyUndo(hash, cwd) {
       }
       return false;
     }
-    const lsTree = spawnSync5("git", ["ls-tree", "-r", "--name-only", hash], {
+    const lsTree = spawnSync3("git", ["ls-tree", "-r", "--name-only", hash], {
       cwd: dir,
       env,
       timeout: GIT_TIMEOUT
@@ -14828,8 +14825,8 @@ function applyUndo(hash, cwd) {
 `);
       return false;
     }
-    const tracked = spawnSync5("git", ["ls-files"], { cwd: dir, env, timeout: GIT_TIMEOUT }).stdout?.toString().trim().split("\n").filter(Boolean) ?? [];
-    const untracked = spawnSync5("git", ["ls-files", "--others", "--exclude-standard"], {
+    const tracked = spawnSync3("git", ["ls-files"], { cwd: dir, env, timeout: GIT_TIMEOUT }).stdout?.toString().trim().split("\n").filter(Boolean) ?? [];
+    const untracked = spawnSync3("git", ["ls-files", "--others", "--exclude-standard"], {
       cwd: dir,
       env,
       timeout: GIT_TIMEOUT
@@ -16078,10 +16075,12 @@ function registerDoctorCommand(program2, version2) {
     }
     section("Daemon (optional)");
     if (isDaemonRunning()) {
-      pass(`Browser dashboard running \u2192 http://${DAEMON_HOST}:${DAEMON_PORT}/`);
+      pass(
+        `Daemon running on ${DAEMON_HOST}:${DAEMON_PORT} \u2014 terminal & native approvals enabled`
+      );
     } else {
       warn(
-        "Daemon not running \u2014 browser approvals unavailable",
+        "Daemon not running \u2014 terminal & native approvals unavailable",
         "Run: node9 daemon --background"
       );
     }
@@ -17681,7 +17680,7 @@ function registerUndoCommand(program2) {
 // src/cli/commands/watch.ts
 init_daemon();
 import chalk19 from "chalk";
-import { spawn as spawn7, spawnSync as spawnSync6 } from "child_process";
+import { spawn as spawn7, spawnSync as spawnSync4 } from "child_process";
 function registerWatchCommand(program2) {
   program2.command("watch").description("Run a command under Node9 watch mode (daemon stays alive for the session)").argument("<command>", "Command to run").argument("[args...]", "Arguments for the command").action(async (cmd, args) => {
     let port = DAEMON_PORT;
@@ -17727,7 +17726,7 @@ function registerWatchCommand(program2) {
         "\n   Tip: run `node9 tail` in another terminal to review and approve AI actions.\n"
       )
     );
-    const result = spawnSync6(cmd, args, {
+    const result = spawnSync4(cmd, args, {
       stdio: "inherit",
       env: { ...process.env, NODE9_WATCH_MODE: "1" }
     });
@@ -18274,7 +18273,7 @@ import readline5 from "readline";
 import fs39 from "fs";
 import os35 from "os";
 import path41 from "path";
-import { spawnSync as spawnSync7 } from "child_process";
+import { spawnSync as spawnSync5 } from "child_process";
 init_core();
 init_daemon();
 init_shields();
@@ -18748,7 +18747,7 @@ function handleRuleAdd(args) {
   return `Rule "${name}" added to ~/.node9/config.json \u2014 verdict: ${verdict} when ${field} matches "${pattern}"`;
 }
 function runCliCommand(subArgs) {
-  const result = spawnSync7(process.execPath, [process.argv[1], ...subArgs], {
+  const result = spawnSync5(process.execPath, [process.argv[1], ...subArgs], {
     encoding: "utf-8",
     timeout: 6e4,
     // Disable colors — stdout is piped (not a TTY), chalk auto-detects, but be explicit

package/dist/index.js

@@ -3601,7 +3601,6 @@ var import_fs8 = __toESM(require("fs"));
 var import_net = __toESM(require("net"));
 var import_path8 = __toESM(require("path"));
 var import_os7 = __toESM(require("os"));
-var import_child_process = require("child_process");
 var ACTIVITY_SOCKET_PATH = process.platform === "win32" ? "\\\\.\\pipe\\node9-activity" : import_path8.default.join(import_os7.default.tmpdir(), "node9-activity.sock");
 function notifyActivitySocket(data) {
   return new Promise((resolve) => {
@@ -3674,22 +3673,9 @@ function isDaemonRunning() {
       }
       return false;
     }
-    const r = (0, import_child_process.spawnSync)("ss", ["-Htnp", `sport = :${DAEMON_PORT}`], {
-      encoding: "utf8",
-      timeout: 300
-    });
-    if (r.status === 0 && (r.stdout ?? "").includes(`:${DAEMON_PORT}`)) return true;
-    return false;
-  }
-  try {
-    const r = (0, import_child_process.spawnSync)("ss", ["-Htnp", `sport = :${DAEMON_PORT}`], {
-      encoding: "utf8",
-      timeout: 300
-    });
-    return r.status === 0 && (r.stdout ?? "").includes(`:${DAEMON_PORT}`);
-  } catch {
-    return false;
+    return true;
   }
+  return false;
 }
 async function registerDaemonEntry(toolName, args, meta, riskMetadata, activityId, cwd, recoveryCommand, skipBackgroundAuth, viewOnly, localSmartRuleMatched, socketActivitySent) {
   const base = `http://${DAEMON_HOST}:${DAEMON_PORT}`;
@@ -3817,7 +3803,7 @@ async function resolveViaDaemon(id, decision, internalToken, source) {
 var import_crypto3 = require("crypto");
 
 // src/ui/native.ts
-var import_child_process2 = require("child_process");
+var import_child_process = require("child_process");
 var import_path10 = __toESM(require("path"));
 
 // src/context-sniper.ts
@@ -4091,7 +4077,7 @@ activate
 display dialog (item 1 of argv) with title (item 2 of argv) ${buttons}
 end tell
 end run`;
-        childProcess = (0, import_child_process2.spawn)("osascript", ["-e", script, "--", message, title]);
+        childProcess = (0, import_child_process.spawn)("osascript", ["-e", script, "--", message, title]);
       } else if (process.platform === "linux") {
         const pangoMessage = buildPangoMessage(
           toolName,
@@ -4117,12 +4103,12 @@ end run`;
           argsList.push("--cancel-label", "Block  \u238B");
           argsList.push("--extra-button", "Always Allow");
         }
-        childProcess = (0, import_child_process2.spawn)("zenity", argsList);
+        childProcess = (0, import_child_process.spawn)("zenity", argsList);
       } else if (process.platform === "win32") {
         const b64Msg = Buffer.from(message).toString("base64");
         const b64Title = Buffer.from(title).toString("base64");
         const ps = `Add-Type -AssemblyName PresentationFramework; $msg = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String("${b64Msg}")); $title = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String("${b64Title}")); $res = [System.Windows.MessageBox]::Show($msg, $title, "${locked ? "OK" : "YesNo"}", "Warning", "Button2", "DefaultDesktopOnly"); if ($res -eq "Yes") { exit 0 } else { exit 1 }`;
-        childProcess = (0, import_child_process2.spawn)("powershell", ["-Command", ps]);
+        childProcess = (0, import_child_process.spawn)("powershell", ["-Command", ps]);
       }
       let output = "";
       childProcess?.stdout?.on("data", (d) => output += d.toString());

package/dist/index.mjs

@@ -3571,7 +3571,6 @@ import fs8 from "fs";
 import net from "net";
 import path8 from "path";
 import os7 from "os";
-import { spawnSync } from "child_process";
 var ACTIVITY_SOCKET_PATH = process.platform === "win32" ? "\\\\.\\pipe\\node9-activity" : path8.join(os7.tmpdir(), "node9-activity.sock");
 function notifyActivitySocket(data) {
   return new Promise((resolve) => {
@@ -3644,22 +3643,9 @@ function isDaemonRunning() {
       }
       return false;
     }
-    const r = spawnSync("ss", ["-Htnp", `sport = :${DAEMON_PORT}`], {
-      encoding: "utf8",
-      timeout: 300
-    });
-    if (r.status === 0 && (r.stdout ?? "").includes(`:${DAEMON_PORT}`)) return true;
-    return false;
-  }
-  try {
-    const r = spawnSync("ss", ["-Htnp", `sport = :${DAEMON_PORT}`], {
-      encoding: "utf8",
-      timeout: 300
-    });
-    return r.status === 0 && (r.stdout ?? "").includes(`:${DAEMON_PORT}`);
-  } catch {
-    return false;
+    return true;
   }
+  return false;
 }
 async function registerDaemonEntry(toolName, args, meta, riskMetadata, activityId, cwd, recoveryCommand, skipBackgroundAuth, viewOnly, localSmartRuleMatched, socketActivitySent) {
   const base = `http://${DAEMON_HOST}:${DAEMON_PORT}`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@node9/proxy",
-  "version": "1.19.2",
+  "version": "1.19.3",
   "description": "The Sudo Command for AI Agents. Execution Security for Claude Code & MCP.",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",