@node9/proxy 1.20.1 → 1.21.1

package/dist/cli.js

@@ -10505,7 +10505,7 @@ function originForRule(ruleName, sections) {
   return "";
 }
 function registerScanCommand(program2) {
-  program2.command("scan").description("Forecast: scan agent history and show what node9 would catch if installed").option("--all", "Scan all history (default: last 90 days)").option("--days <n>", "Scan last N days of history", "90").option("--top <n>", "Max findings to show per rule (default: 5)", "5").option("--drill-down", "Show all findings with full commands and session IDs").option("--compact", "Compact one-screen scorecard \u2014 for screenshots and sharing").option("--narrative", "Severity-grouped report \u2014 for video / dramatic sharing").option(
+  program2.command("scan").description("Forecast: scan agent history and show what node9 would catch if installed").option("--all", "Scan all history (default: last 90 days)").option("--days <n>", "Scan last N days of history", "90").option("--top <n>", "Max findings to show per rule (default: 5)", "5").option("--drill-down", "Show all findings with full commands and session IDs").option("--compact", "Compact one-screen scorecard \u2014 for screenshots and sharing").option("--narrative", "Severity-grouped report \u2014 for video / dramatic sharing").option("--classic", "Original chalk-based scorecard layout (default: new Ink-rendered view)").option(
     "--json",
     "Emit machine-readable JSON to stdout (suppresses banner, progress, and renderer)"
   ).option(
@@ -10539,7 +10539,8 @@ function registerScanCommand(program2) {
       })();
       const isWired = getAgentsStatus().some((a) => a.wired);
       const screenshotMode = options.compact || options.narrative;
-      const quiet = screenshotMode || options.json;
+      const useInk = !options.classic && !drillDown;
+      const quiet = screenshotMode || options.json || useInk;
       if (!quiet) {
         console.log("");
         if (!isWired) {
@@ -10677,6 +10678,7 @@ function registerScanCommand(program2) {
         });
         return;
       }
+      const useInkForHero = !options.classic && !drillDown;
       if (totalFindings === 0 && scan.dlpFindings.length === 0) {
         console.log(import_chalk5.default.green("  \u2705 No risky operations found in your history."));
         console.log(
@@ -10696,9 +10698,11 @@ function registerScanCommand(program2) {
           const since = daysAgo === 0 ? "today" : daysAgo === 1 ? "yesterday" : `${daysAgo} days ago`;
           return import_chalk5.default.dim("  \xB7  ") + arrow + import_chalk5.default.dim(` since ${since}`);
         })();
-        console.log(
-          "  " + (score.band === "critical" ? import_chalk5.default.red.bold("\u26A0  ") : "") + import_chalk5.default.bold("Security Score ") + score.color.bold(`${blast.score}/100`) + "  " + severityDisplay + trendSuffix + import_chalk5.default.dim("  \xB7  ") + (totalRisky > 0 ? import_chalk5.default.red.bold(`${totalRisky} risky operation${totalRisky !== 1 ? "s" : ""}`) : import_chalk5.default.green("No risky operations"))
-        );
+        if (!useInkForHero) {
+          console.log(
+            "  " + (score.band === "critical" ? import_chalk5.default.red.bold("\u26A0  ") : "") + import_chalk5.default.bold("Security Score ") + score.color.bold(`${blast.score}/100`) + "  " + severityDisplay + trendSuffix + import_chalk5.default.dim("  \xB7  ") + (totalRisky > 0 ? import_chalk5.default.red.bold(`${totalRisky} risky operation${totalRisky !== 1 ? "s" : ""}`) : import_chalk5.default.green("No risky operations"))
+          );
+        }
         const cardParts = [];
         if (scan.dlpFindings.length > 0) {
           cardParts.push(
@@ -10727,10 +10731,10 @@ function registerScanCommand(program2) {
             import_chalk5.default.red("\u{1F52D} ") + import_chalk5.default.red.bold(String(blastExposures)) + import_chalk5.default.dim(" exposures")
           );
         }
-        if (cardParts.length > 0) {
+        if (cardParts.length > 0 && !useInkForHero) {
           console.log("  " + cardParts.join(import_chalk5.default.dim("   ")));
         }
-        if (scan.totalCostUSD > 0) {
+        if (scan.totalCostUSD > 0 && !useInkForHero) {
           console.log(
             "  " + import_chalk5.default.dim("AI spend  ") + import_chalk5.default.bold(fmtCost(scan.totalCostUSD)) + (summary.loopWastedUSD > 0 ? import_chalk5.default.dim("   \xB7   wasted on loops  ") + import_chalk5.default.yellow("~" + fmtCost(summary.loopWastedUSD)) : "")
           );
@@ -10742,16 +10746,38 @@ function registerScanCommand(program2) {
             )
           );
         }
-        console.log("");
+        if (!useInkForHero) {
+          console.log("");
+        }
         if (!drillDown) {
-          renderPanelScorecard({
-            scan,
-            summary,
-            blast,
-            blastExposures,
-            blockedCount,
-            reviewCount
-          });
+          const useInk2 = !options.classic;
+          if (useInk2) {
+            const scanInkPath = import_path21.default.join(__dirname, "scan-ink.mjs");
+            const dynamicImport = new Function("id", "return import(id)");
+            const mod = await dynamicImport(`file://${scanInkPath}`);
+            const rangeLabel2 = options.all ? "all time" : `last ${options.days ?? 90} days`;
+            mod.renderScanScorecardInk(
+              {
+                scan,
+                summary,
+                blast,
+                blastExposures,
+                blockedCount,
+                reviewCount
+              },
+              rangeLabel2
+            );
+            console.log("");
+          } else {
+            renderPanelScorecard({
+              scan,
+              summary,
+              blast,
+              blastExposures,
+              blockedCount,
+              reviewCount
+            });
+          }
           const cta = isWired ? "\u2705 node9 is active" : "\u2192 install node9 to enable protection";
           console.log("  " + import_chalk5.default.green(cta));
           console.log(
@@ -13702,10 +13728,10 @@ function readSessionUsage() {
   }
 }
 function formatContextStat(stat) {
-  const pctColor = stat.fillPct >= 80 ? import_chalk30.default.red : stat.fillPct >= 50 ? import_chalk30.default.yellow : import_chalk30.default.cyan;
+  const pctColor = stat.fillPct >= 80 ? import_chalk29.default.red : stat.fillPct >= 50 ? import_chalk29.default.yellow : import_chalk29.default.cyan;
   const k = (n) => `${Math.round(n / 1e3)}k`;
   const modelShort = stat.model.replace(/@.*$/, "").replace(/-\d{8}$/, "").replace(/^claude-/, "");
-  return import_chalk30.default.dim("ctx: ") + pctColor(`${stat.fillPct}%`) + import_chalk30.default.dim(
+  return import_chalk29.default.dim("ctx: ") + pctColor(`${stat.fillPct}%`) + import_chalk29.default.dim(
     ` (${k(stat.inputTokens)}/${k(getModelContextLimit(stat.model))}  out ${k(stat.outputTokens)}  \xB7 ${modelShort})`
   );
 }
@@ -13728,11 +13754,11 @@ function agentLabel(agent, mcpServer, sessionId) {
   const tag = sessionTag(sessionId);
   const tagSuffix = tag ? `\xB7${tag}` : "";
   if (!agent || agent === "Terminal") {
-    return mcpServer ? import_chalk30.default.dim(`[\u2192 ${mcpServer}] `) : "";
+    return mcpServer ? import_chalk29.default.dim(`[\u2192 ${mcpServer}] `) : "";
   }
   const short = agent === "Claude Code" ? "Claude" : agent === "Gemini CLI" ? "Gemini" : agent === "Unknown Agent" ? "" : agent.split(" ")[0];
-  if (!short) return mcpServer ? import_chalk30.default.dim(`[\u2192 ${mcpServer}] `) : "";
-  return mcpServer ? import_chalk30.default.dim(`[${short}${tagSuffix} \u2192 ${mcpServer}] `) : import_chalk30.default.dim(`[${short}${tagSuffix}] `);
+  if (!short) return mcpServer ? import_chalk29.default.dim(`[\u2192 ${mcpServer}] `) : "";
+  return mcpServer ? import_chalk29.default.dim(`[${short}${tagSuffix} \u2192 ${mcpServer}] `) : import_chalk29.default.dim(`[${short}${tagSuffix}] `);
 }
 function formatBase(activity) {
   const time = new Date(activity.ts).toLocaleTimeString([], { hour12: false });
@@ -13740,20 +13766,20 @@ function formatBase(activity) {
   const toolName = activity.tool.slice(0, 16).padEnd(16);
   const argsStr = JSON.stringify(activity.args ?? {}).replace(/\s+/g, " ").replaceAll(import_os41.default.homedir(), "~");
   const argsPreview = argsStr.length > 70 ? argsStr.slice(0, 70) + "\u2026" : argsStr;
-  return `${import_chalk30.default.gray(time)} ${icon} ${agentLabel(activity.agent, activity.mcpServer, activity.sessionId)}${import_chalk30.default.white.bold(toolName)} ${import_chalk30.default.dim(argsPreview)}`;
+  return `${import_chalk29.default.gray(time)} ${icon} ${agentLabel(activity.agent, activity.mcpServer, activity.sessionId)}${import_chalk29.default.white.bold(toolName)} ${import_chalk29.default.dim(argsPreview)}`;
 }
 function renderResult(activity, result) {
   const base = formatBase(activity);
   let status;
   if (result.status === "allow") {
-    status = import_chalk30.default.green("\u2713 ALLOW");
+    status = import_chalk29.default.green("\u2713 ALLOW");
   } else if (result.status === "dlp") {
-    status = import_chalk30.default.bgRed.white.bold(" \u{1F6E1}\uFE0F  DLP ");
+    status = import_chalk29.default.bgRed.white.bold(" \u{1F6E1}\uFE0F  DLP ");
   } else {
-    status = import_chalk30.default.red("\u2717 BLOCK");
+    status = import_chalk29.default.red("\u2717 BLOCK");
   }
   const cost = result.costEstimate ?? activity.costEstimate;
-  const costSuffix = cost == null ? "" : import_chalk30.default.dim(`  ~$${cost >= 1e-3 ? cost.toFixed(3) : "0.000"}`);
+  const costSuffix = cost == null ? "" : import_chalk29.default.dim(`  ~$${cost >= 1e-3 ? cost.toFixed(3) : "0.000"}`);
   if (process.stdout.isTTY) {
     if (pendingShownForId === activity.id && pendingWrappedLines > 1) {
       import_readline6.default.moveCursor(process.stdout, 0, -(pendingWrappedLines - 1));
@@ -13770,7 +13796,7 @@ function renderResult(activity, result) {
 }
 function renderPending(activity) {
   if (!process.stdout.isTTY) return;
-  const line = `${formatBase(activity)}  ${import_chalk30.default.yellow("\u25CF \u2026")}`;
+  const line = `${formatBase(activity)}  ${import_chalk29.default.yellow("\u25CF \u2026")}`;
   pendingShownForId = activity.id;
   pendingWrappedLines = wrappedLineCount(line);
   process.stdout.write(`${line}\r`);
@@ -13782,7 +13808,7 @@ async function ensureDaemon() {
       const { port } = JSON.parse(import_fs45.default.readFileSync(PID_FILE, "utf-8"));
       pidPort = port;
     } catch {
-      console.error(import_chalk30.default.dim("\u26A0\uFE0F  Could not read PID file; falling back to default port."));
+      console.error(import_chalk29.default.dim("\u26A0\uFE0F  Could not read PID file; falling back to default port."));
     }
   }
   const checkPort = pidPort ?? DAEMON_PORT;
@@ -13793,8 +13819,8 @@ async function ensureDaemon() {
     if (res.ok) return checkPort;
   } catch {
   }
-  console.log(import_chalk30.default.dim("\u{1F6E1}\uFE0F  Starting Node9 daemon..."));
-  const child = (0, import_child_process13.spawn)(process.execPath, [process.argv[1], "daemon"], {
+  console.log(import_chalk29.default.dim("\u{1F6E1}\uFE0F  Starting Node9 daemon..."));
+  const child = (0, import_child_process12.spawn)(process.execPath, [process.argv[1], "daemon"], {
     detached: true,
     stdio: "ignore",
     env: { ...process.env, NODE9_AUTO_STARTED: "1" }
@@ -13810,7 +13836,7 @@ async function ensureDaemon() {
     } catch {
     }
   }
-  console.error(import_chalk30.default.red("\u274C Daemon failed to start. Try: node9 daemon start"));
+  console.error(import_chalk29.default.red("\u274C Daemon failed to start. Try: node9 daemon start"));
   process.exit(1);
 }
 function postDecisionHttp(id, decision, authToken, port, opts) {
@@ -13879,7 +13905,7 @@ function buildCardLines(req, localCount = 0) {
   const severityIcon = isBlock ? `${RED}\u{1F6D1}` : `${YELLOW}\u26A0 `;
   const rawDesc = req.riskMetadata?.ruleDescription ?? "";
   const description = rawDesc ? cleanReason(rawDesc) : "";
-  const agentSuffix = req.agent && req.agent !== "Terminal" ? ` ${RESET2}${import_chalk30.default.dim(`(${req.agent})`)}` : "";
+  const agentSuffix = req.agent && req.agent !== "Terminal" ? ` ${RESET2}${import_chalk29.default.dim(`(${req.agent})`)}` : "";
   const lines = [
     ``,
     `${BOLD2}${CYAN}\u2554\u2550\u2550 Node9 Approval Required \u2550\u2550\u2557${RESET2}`,
@@ -13948,7 +13974,7 @@ function approverStatusLine() {
   const a = readApproversFromDisk();
   const fmt = (label, key) => {
     const on = a[key] !== false;
-    return `[${key[0]}]${label.slice(1)} ${on ? import_chalk30.default.green("\u2713") : import_chalk30.default.dim("\u2717")}`;
+    return `[${key[0]}]${label.slice(1)} ${on ? import_chalk29.default.green("\u2713") : import_chalk29.default.dim("\u2717")}`;
   };
   return `${fmt("native", "native")}  ${fmt("cloud", "cloud")}  ${fmt("terminal", "terminal")}`;
 }
@@ -13993,7 +14019,7 @@ async function startTail(options = {}) {
       req2.end();
     });
     if (result.ok) {
-      console.log(import_chalk30.default.green("\u2713 Flight Recorder buffer cleared."));
+      console.log(import_chalk29.default.green("\u2713 Flight Recorder buffer cleared."));
     } else if (result.code === "ECONNREFUSED") {
       throw new Error("Daemon is not running. Start it with: node9 daemon start");
     } else if (result.code === "ETIMEDOUT") {
@@ -14039,7 +14065,7 @@ async function startTail(options = {}) {
       const channel = name === "n" ? "native" : name === "c" ? "cloud" : name === "t" ? "terminal" : null;
       if (channel) {
         toggleApprover(channel);
-        console.log(import_chalk30.default.dim(`  Approvers: ${approverStatusLine()}`));
+        console.log(import_chalk29.default.dim(`  Approvers: ${approverStatusLine()}`));
       }
     };
     process.stdin.on("keypress", idleKeypressHandler);
@@ -14105,7 +14131,7 @@ async function startTail(options = {}) {
           localAllowCounts.get(req2.toolName) ?? 0
         )
       );
-      const decisionStamp = action === "always-allow" ? import_chalk30.default.yellow("\u2605 ALWAYS ALLOW") : action === "trust" ? import_chalk30.default.cyan("\u23F1 TRUST 30m") : action === "allow" ? import_chalk30.default.green("\u2713 ALLOWED") : action === "redirect" ? import_chalk30.default.yellow("\u21A9 REDIRECT AI") : import_chalk30.default.red("\u2717 DENIED");
+      const decisionStamp = action === "always-allow" ? import_chalk29.default.yellow("\u2605 ALWAYS ALLOW") : action === "trust" ? import_chalk29.default.cyan("\u23F1 TRUST 30m") : action === "allow" ? import_chalk29.default.green("\u2713 ALLOWED") : action === "redirect" ? import_chalk29.default.yellow("\u21A9 REDIRECT AI") : import_chalk29.default.red("\u2717 DENIED");
       stampedLines.push(`  ${BOLD2}\u2192${RESET2} ${decisionStamp} ${GRAY}(terminal)${RESET2}`, ``);
       for (const line of stampedLines) process.stdout.write(line + "\n");
       process.stdout.write(SHOW_CURSOR);
@@ -14156,7 +14182,7 @@ async function startTail(options = {}) {
       );
       const stampedLines = buildCardLines(req2, priorCount);
       if (externalDecision) {
-        const source = externalDecision === "allow" ? import_chalk30.default.green("\u2713 ALLOWED") : import_chalk30.default.red("\u2717 DENIED");
+        const source = externalDecision === "allow" ? import_chalk29.default.green("\u2713 ALLOWED") : import_chalk29.default.red("\u2717 DENIED");
         stampedLines.push(`  ${BOLD2}\u2192${RESET2} ${source} ${GRAY}(external)${RESET2}`, ``);
       }
       for (const line of stampedLines) process.stdout.write(line + "\n");
@@ -14204,25 +14230,25 @@ async function startTail(options = {}) {
     if (unackedDlp > 0) {
       console.log("");
       console.log(
-        import_chalk30.default.bgRed.white.bold(
+        import_chalk29.default.bgRed.white.bold(
           ` \u26A0\uFE0F  DLP ALERT: ${unackedDlp} secret${unackedDlp !== 1 ? "s" : ""} found in Claude response text \u2014 run: node9 dlp `
         )
       );
     }
   } catch {
   }
-  console.log(import_chalk30.default.cyan.bold(`
+  console.log(import_chalk29.default.cyan.bold(`
 \u{1F6F0}\uFE0F  Node9 tail`));
   if (canApprove) {
-    console.log(import_chalk30.default.dim("Card: [\u21B5/y] Allow  [n] Deny  [a] Always  [t] Trust 30m"));
-    console.log(import_chalk30.default.dim(`Approvers (toggle): ${approverStatusLine()}  [q] quit`));
+    console.log(import_chalk29.default.dim("Card: [\u21B5/y] Allow  [n] Deny  [a] Always  [t] Trust 30m"));
+    console.log(import_chalk29.default.dim(`Approvers (toggle): ${approverStatusLine()}  [q] quit`));
   }
   const ctxStat = readSessionUsage();
   if (ctxStat) console.log("  " + formatContextStat(ctxStat));
   if (options.history) {
-    console.log(import_chalk30.default.dim("Showing history + live events.\n"));
+    console.log(import_chalk29.default.dim("Showing history + live events.\n"));
   } else {
-    console.log(import_chalk30.default.dim("Showing live events only. Use --history to include past.\n"));
+    console.log(import_chalk29.default.dim("Showing live events only. Use --history to include past.\n"));
   }
   process.on("SIGINT", () => {
     exitIdleMode();
@@ -14232,7 +14258,7 @@ async function startTail(options = {}) {
       import_readline6.default.clearLine(process.stdout, 0);
       import_readline6.default.cursorTo(process.stdout, 0);
     }
-    console.log(import_chalk30.default.dim("\n\u{1F6F0}\uFE0F  Disconnected."));
+    console.log(import_chalk29.default.dim("\n\u{1F6F0}\uFE0F  Disconnected."));
     process.exit(0);
   });
   const STALL_THRESHOLD_MS = 6e4;
@@ -14244,7 +14270,7 @@ async function startTail(options = {}) {
       if (Date.now() - auditMtime >= STALL_THRESHOLD_MS) return;
       console.log("");
       console.log(
-        import_chalk30.default.yellow(
+        import_chalk29.default.yellow(
           "\u26A0\uFE0F  Tail appears stalled \u2014 hooks are firing but no events are arriving. Try: node9 daemon restart"
         )
       );
@@ -14261,7 +14287,7 @@ async function startTail(options = {}) {
     },
     (res) => {
       if (res.statusCode !== 200) {
-        console.error(import_chalk30.default.red(`Failed to connect: HTTP ${res.statusCode}`));
+        console.error(import_chalk29.default.red(`Failed to connect: HTTP ${res.statusCode}`));
         process.exit(1);
       }
       if (canApprove) enterIdleMode();
@@ -14292,7 +14318,7 @@ async function startTail(options = {}) {
           import_readline6.default.clearLine(process.stdout, 0);
           import_readline6.default.cursorTo(process.stdout, 0);
         }
-        console.log(import_chalk30.default.red("\n\u274C Daemon disconnected."));
+        console.log(import_chalk29.default.red("\n\u274C Daemon disconnected."));
         process.exit(1);
       });
     }
@@ -14305,7 +14331,7 @@ async function startTail(options = {}) {
         const parsed = JSON.parse(rawData);
         const msg = parsed.message ?? "Flight recorder is down \u2014 run: node9 daemon restart";
         console.log("");
-        console.log(import_chalk30.default.bgRed.white.bold(` \u26A0\uFE0F  ${msg} `));
+        console.log(import_chalk29.default.bgRed.white.bold(` \u26A0\uFE0F  ${msg} `));
       } catch {
       }
       return;
@@ -14390,9 +14416,9 @@ async function startTail(options = {}) {
       const rawSummary = data.argsSummary ?? data.tool;
       const summary = shortenPathSummary(rawSummary);
       const fileCount = data.fileCount ?? 0;
-      const files = fileCount > 0 ? import_chalk30.default.dim(` \xB7 ${fileCount} file${fileCount === 1 ? "" : "s"}`) : "";
+      const files = fileCount > 0 ? import_chalk29.default.dim(` \xB7 ${fileCount} file${fileCount === 1 ? "" : "s"}`) : "";
       process.stdout.write(
-        `${import_chalk30.default.dim(time)}  ${import_chalk30.default.cyan("\u{1F4F8} snapshot")}  ${import_chalk30.default.dim(hash)}  ${summary}${files}
+        `${import_chalk29.default.dim(time)}  ${import_chalk29.default.cyan("\u{1F4F8} snapshot")}  ${import_chalk29.default.dim(hash)}  ${summary}${files}
 `
       );
       return;
@@ -14409,33 +14435,33 @@ async function startTail(options = {}) {
     if (event === "execution-result") {
       const exec = data;
       const time = new Date(Date.now()).toLocaleTimeString([], { hour12: false });
-      const arrow = exec.isError ? import_chalk30.default.red("  \u21B3 \u2717") : import_chalk30.default.green("  \u21B3 \u2713");
+      const arrow = exec.isError ? import_chalk29.default.red("  \u21B3 \u2717") : import_chalk29.default.green("  \u21B3 \u2713");
       const label = agentLabel(exec.agent, exec.mcpServer);
       const tool = (exec.tool ?? "").slice(0, 16);
-      const duration = typeof exec.durationMs === "number" ? import_chalk30.default.dim(` (${exec.durationMs}ms)`) : "";
+      const duration = typeof exec.durationMs === "number" ? import_chalk29.default.dim(` (${exec.durationMs}ms)`) : "";
       console.log(
-        `${import_chalk30.default.gray(time)} ${arrow} ${label}${import_chalk30.default.dim(tool)}${import_chalk30.default.dim(" completed")}${duration}`
+        `${import_chalk29.default.gray(time)} ${arrow} ${label}${import_chalk29.default.dim(tool)}${import_chalk29.default.dim(" completed")}${duration}`
       );
     }
   }
   req.on("error", (err2) => {
     const msg = err2.code === "ECONNREFUSED" ? "Daemon is not running. Start it with: node9 daemon start" : err2.message;
-    console.error(import_chalk30.default.red(`
+    console.error(import_chalk29.default.red(`
 \u274C ${msg}`));
     process.exit(1);
   });
 }
-var import_http2, import_chalk30, import_fs45, import_os41, import_path47, import_readline6, import_child_process13, PID_FILE, ICONS, MODEL_CONTEXT_LIMITS, RESET2, BOLD2, RED, YELLOW, CYAN, GRAY, GREEN, HIDE_CURSOR, SHOW_CURSOR, ERASE_DOWN, pendingShownForId, pendingWrappedLines, DIVIDER;
+var import_http2, import_chalk29, import_fs45, import_os41, import_path47, import_readline6, import_child_process12, PID_FILE, ICONS, MODEL_CONTEXT_LIMITS, RESET2, BOLD2, RED, YELLOW, CYAN, GRAY, GREEN, HIDE_CURSOR, SHOW_CURSOR, ERASE_DOWN, pendingShownForId, pendingWrappedLines, DIVIDER;
 var init_tail = __esm({
   "src/tui/tail.ts"() {
     "use strict";
     import_http2 = __toESM(require("http"));
-    import_chalk30 = __toESM(require("chalk"));
+    import_chalk29 = __toESM(require("chalk"));
     import_fs45 = __toESM(require("fs"));
     import_os41 = __toESM(require("os"));
     import_path47 = __toESM(require("path"));
     import_readline6 = __toESM(require("readline"));
-    import_child_process13 = require("child_process");
+    import_child_process12 = require("child_process");
     init_daemon2();
     init_daemon();
     PID_FILE = import_path47.default.join(import_os41.default.homedir(), ".node9", "daemon.pid");
@@ -14863,7 +14889,7 @@ var import_commander = require("commander");
 init_core();
 init_setup();
 init_daemon2();
-var import_chalk31 = __toESM(require("chalk"));
+var import_chalk30 = __toESM(require("chalk"));
 var import_fs47 = __toESM(require("fs"));
 var import_path49 = __toESM(require("path"));
 var import_os43 = __toESM(require("os"));
@@ -15657,7 +15683,7 @@ function detectAiAgent(payload) {
   return "Terminal";
 }
 function registerCheckCommand(program2) {
-  program2.command("check").description("Hook handler \u2014 evaluates a tool call before execution").argument("[data]", "JSON string of the tool call").action(async (data) => {
+  program2.command("check", { hidden: true }).description("Hook handler \u2014 evaluates a tool call before execution").argument("[data]", "JSON string of the tool call").action(async (data) => {
     const processPayload = async (raw) => {
       try {
         if (!raw || raw.trim() === "") process.exit(0);
@@ -16055,7 +16081,7 @@ function sanitize3(value) {
   return value.replace(/[\x00-\x1F\x7F]/g, "");
 }
 function registerLogCommand(program2) {
-  program2.command("log").description("PostToolUse hook \u2014 records executed tool calls").argument("[data]", "JSON string of the tool call").action(async (data) => {
+  program2.command("log", { hidden: true }).description("PostToolUse hook \u2014 records executed tool calls").argument("[data]", "JSON string of the tool call").action(async (data) => {
     const logPayload = async (raw) => {
       try {
         if (!raw || raw.trim() === "") process.exit(0);
@@ -18221,7 +18247,7 @@ function registerInitCommand(program2) {
       const agentList = found.join(", ");
       console.log(import_chalk16.default.green.bold(`\u{1F6E1}\uFE0F  Node9 is protecting ${agentList}!`));
       console.log("");
-      console.log(import_chalk16.default.white("  Watch live:  ") + import_chalk16.default.cyan("node9 tail"));
+      console.log(import_chalk16.default.white("  Watch live:  ") + import_chalk16.default.cyan("node9 monitor"));
       console.log("");
       console.log(import_chalk16.default.gray("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
       console.log(
@@ -18518,71 +18544,10 @@ function registerUndoCommand(program2) {
   });
 }
 
-// src/cli/commands/watch.ts
-var import_chalk19 = __toESM(require("chalk"));
-var import_child_process10 = require("child_process");
-init_daemon();
-function registerWatchCommand(program2) {
-  program2.command("watch").description("Run a command under Node9 watch mode (daemon stays alive for the session)").argument("<command>", "Command to run").argument("[args...]", "Arguments for the command").action(async (cmd, args) => {
-    let port = DAEMON_PORT;
-    try {
-      const res = await fetch(`http://127.0.0.1:${DAEMON_PORT}/settings`, {
-        signal: AbortSignal.timeout(500)
-      });
-      if (res.ok) {
-        const data = await res.json();
-        if (typeof data.port === "number") port = data.port;
-      } else {
-        throw new Error("not running");
-      }
-    } catch {
-      console.error(import_chalk19.default.dim("\u{1F6E1}\uFE0F  Starting Node9 daemon (watch mode)..."));
-      const child = (0, import_child_process10.spawn)(process.execPath, [process.argv[1], "daemon"], {
-        detached: true,
-        stdio: "ignore",
-        env: { ...process.env, NODE9_AUTO_STARTED: "1", NODE9_WATCH_MODE: "1" }
-      });
-      child.unref();
-      let ready = false;
-      for (let i = 0; i < 20; i++) {
-        await new Promise((r) => setTimeout(r, 250));
-        try {
-          const r = await fetch(`http://127.0.0.1:${DAEMON_PORT}/settings`, {
-            signal: AbortSignal.timeout(500)
-          });
-          if (r.ok) {
-            ready = true;
-            break;
-          }
-        } catch {
-        }
-      }
-      if (!ready) {
-        console.error(import_chalk19.default.red("\u274C Daemon failed to start. Try: node9 daemon start"));
-        process.exit(1);
-      }
-    }
-    console.error(
-      import_chalk19.default.cyan.bold("\u{1F6E1}\uFE0F  Node9 watch") + import_chalk19.default.dim(` \u2192 localhost:${port}`) + import_chalk19.default.dim(
-        "\n   Tip: run `node9 tail` in another terminal to review and approve AI actions.\n"
-      )
-    );
-    const result = (0, import_child_process10.spawnSync)(cmd, args, {
-      stdio: "inherit",
-      env: { ...process.env, NODE9_WATCH_MODE: "1" }
-    });
-    if (result.error) {
-      console.error(import_chalk19.default.red(`\u274C Failed to run command: ${result.error.message}`));
-      process.exit(1);
-    }
-    process.exit(result.status ?? 0);
-  });
-}
-
 // src/mcp-gateway/index.ts
 var import_readline4 = __toESM(require("readline"));
-var import_chalk20 = __toESM(require("chalk"));
-var import_child_process11 = require("child_process");
+var import_chalk19 = __toESM(require("chalk"));
+var import_child_process10 = require("child_process");
 var import_execa3 = require("execa");
 init_orchestrator();
 init_provenance();
@@ -18743,13 +18708,13 @@ async function runMcpGateway(upstreamCommand) {
   const prov = checkProvenance(executable);
   if (prov.trustLevel === "suspect") {
     console.error(
-      import_chalk20.default.red(
+      import_chalk19.default.red(
         `\u26A0\uFE0F  Node9: Upstream MCP server binary is suspect \u2014 ${prov.reason} (${prov.resolvedPath})`
       )
     );
-    console.error(import_chalk20.default.red("   Verify this binary is trusted before proceeding."));
+    console.error(import_chalk19.default.red("   Verify this binary is trusted before proceeding."));
   }
-  console.error(import_chalk20.default.green(`\u{1F680} Node9 MCP Gateway: Monitoring [${upstreamCommand}]`));
+  console.error(import_chalk19.default.green(`\u{1F680} Node9 MCP Gateway: Monitoring [${upstreamCommand}]`));
   const UPSTREAM_INJECTOR_VARS = /* @__PURE__ */ new Set([
     "NODE_OPTIONS",
     "NODE_PATH",
@@ -18768,7 +18733,7 @@ async function runMcpGateway(upstreamCommand) {
   const safeEnv = Object.fromEntries(
     Object.entries(process.env).filter(([k]) => !UPSTREAM_INJECTOR_VARS.has(k))
   );
-  const child = (0, import_child_process11.spawn)(executable, cmdArgs, {
+  const child = (0, import_child_process10.spawn)(executable, cmdArgs, {
     stdio: ["pipe", "pipe", "inherit"],
     // control stdin/stdout; inherit stderr
     shell: false,
@@ -18862,10 +18827,10 @@ async function runMcpGateway(upstreamCommand) {
           mcpServer
         });
         if (!result.approved) {
-          console.error(import_chalk20.default.red(`
+          console.error(import_chalk19.default.red(`
 \u{1F6D1} Node9 MCP Gateway: Action Blocked`));
-          console.error(import_chalk20.default.gray(`   Tool: ${toolName}`));
-          console.error(import_chalk20.default.gray(`   Reason: ${result.reason ?? "Security Policy"}
+          console.error(import_chalk19.default.gray(`   Tool: ${toolName}`));
+          console.error(import_chalk19.default.gray(`   Reason: ${result.reason ?? "Security Policy"}
 `));
           const blockedByLabel = result.blockedByLabel ?? result.reason ?? "Security Policy";
           const isHumanDecision = blockedByLabel.toLowerCase().includes("user") || blockedByLabel.toLowerCase().includes("daemon") || blockedByLabel.toLowerCase().includes("decision");
@@ -18977,7 +18942,7 @@ async function runMcpGateway(upstreamCommand) {
           updatePin(serverKey, upstreamCommand, currentHash, toolNames);
           pinState = "validated";
           console.error(
-            import_chalk20.default.green(
+            import_chalk19.default.green(
               `\u{1F512} Node9: Pinned ${toolNames.length} tool definition(s) for this MCP server`
             )
           );
@@ -18990,11 +18955,11 @@ async function runMcpGateway(upstreamCommand) {
         } else if (pinStatus === "corrupt") {
           pinState = "quarantined";
           console.error(
-            import_chalk20.default.red("\n\u{1F6A8} Node9: MCP pin file is corrupt or unreadable \u2014 session quarantined!")
+            import_chalk19.default.red("\n\u{1F6A8} Node9: MCP pin file is corrupt or unreadable \u2014 session quarantined!")
           );
-          console.error(import_chalk20.default.red("   Tool calls are blocked until the pin file is repaired."));
+          console.error(import_chalk19.default.red("   Tool calls are blocked until the pin file is repaired."));
           console.error(
-            import_chalk20.default.yellow(`   Run: node9 mcp pin reset  (to clear and re-pin on next connect)
+            import_chalk19.default.yellow(`   Run: node9 mcp pin reset  (to clear and re-pin on next connect)
 `)
           );
           const errorResponse = {
@@ -19011,13 +18976,13 @@ async function runMcpGateway(upstreamCommand) {
         } else {
           pinState = "quarantined";
           console.error(
-            import_chalk20.default.red("\n\u{1F6A8} Node9: MCP tool definitions have changed since last verified!")
+            import_chalk19.default.red("\n\u{1F6A8} Node9: MCP tool definitions have changed since last verified!")
           );
           console.error(
-            import_chalk20.default.red("   This could indicate a supply chain attack (tool poisoning / rug pull).")
+            import_chalk19.default.red("   This could indicate a supply chain attack (tool poisoning / rug pull).")
           );
-          console.error(import_chalk20.default.red("   Session quarantined \u2014 all tool calls blocked."));
-          console.error(import_chalk20.default.yellow(`   Run: node9 mcp pin update ${serverKey}
+          console.error(import_chalk19.default.red("   Session quarantined \u2014 all tool calls blocked."));
+          console.error(import_chalk19.default.yellow(`   Run: node9 mcp pin update ${serverKey}
 `));
           const errorResponse = {
             jsonrpc: "2.0",
@@ -19060,7 +19025,7 @@ async function runMcpGateway(upstreamCommand) {
       const toolName = callId !== void 0 ? pendingCallNames.get(callId) ?? "unknown" : "unknown";
       if (callId !== void 0) pendingCallNames.delete(callId);
       console.error(
-        import_chalk20.default.yellow(
+        import_chalk19.default.yellow(
           `\u26A1 Node9: Large MCP response from '${toolName}' (${(line.length / 1024).toFixed(0)}KB) \u2014 context window enlarged`
         )
       );
@@ -19114,7 +19079,7 @@ var import_readline5 = __toESM(require("readline"));
 var import_fs39 = __toESM(require("fs"));
 var import_os35 = __toESM(require("os"));
 var import_path41 = __toESM(require("path"));
-var import_child_process12 = require("child_process");
+var import_child_process11 = require("child_process");
 init_core();
 init_daemon();
 init_shields();
@@ -19588,7 +19553,7 @@ function handleRuleAdd(args) {
   return `Rule "${name}" added to ~/.node9/config.json \u2014 verdict: ${verdict} when ${field} matches "${pattern}"`;
 }
 function runCliCommand(subArgs) {
-  const result = (0, import_child_process12.spawnSync)(process.execPath, [process.argv[1], ...subArgs], {
+  const result = (0, import_child_process11.spawnSync)(process.execPath, [process.argv[1], ...subArgs], {
     encoding: "utf-8",
     timeout: 6e4,
     // Disable colors — stdout is piped (not a TTY), chalk auto-detects, but be explicit
@@ -19782,7 +19747,7 @@ function registerMcpServerCommand(program2) {
 }
 
 // src/cli/commands/trust.ts
-var import_chalk21 = __toESM(require("chalk"));
+var import_chalk20 = __toESM(require("chalk"));
 init_trusted_hosts();
 function isValidHost(host) {
   return /^(\*\.)?[a-z0-9][a-z0-9.-]*\.[a-z]{2,}$/.test(host);
@@ -19793,51 +19758,51 @@ function registerTrustCommand(program2) {
     const normalized = normalizeHost(host.trim());
     if (!isValidHost(normalized)) {
       console.error(
-        import_chalk21.default.red(`
+        import_chalk20.default.red(`
 \u274C Invalid host: "${host}"
-`) + import_chalk21.default.gray("   Use an FQDN like api.mycompany.com or *.mycompany.com\n")
+`) + import_chalk20.default.gray("   Use an FQDN like api.mycompany.com or *.mycompany.com\n")
       );
       process.exit(1);
     }
     addTrustedHost(normalized);
-    console.log(import_chalk21.default.green(`
+    console.log(import_chalk20.default.green(`
 \u2705 ${normalized} added to trusted hosts.`));
     console.log(
-      import_chalk21.default.gray("   Pipe-chain blocks to this host: critical \u2192 review, high \u2192 allow\n")
+      import_chalk20.default.gray("   Pipe-chain blocks to this host: critical \u2192 review, high \u2192 allow\n")
     );
   });
   trustCmd.command("remove <host>").description("Remove a trusted host").action((host) => {
     const normalized = normalizeHost(host.trim());
     const removed = removeTrustedHost(normalized);
     if (!removed) {
-      console.error(import_chalk21.default.yellow(`
+      console.error(import_chalk20.default.yellow(`
 \u26A0\uFE0F  "${normalized}" is not in the trusted hosts list.
 `));
       process.exit(1);
     }
-    console.log(import_chalk21.default.green(`
+    console.log(import_chalk20.default.green(`
 \u2705 ${normalized} removed from trusted hosts.
 `));
   });
   trustCmd.command("list").description("Show all trusted hosts").action(() => {
     const hosts = readTrustedHosts();
     if (hosts.length === 0) {
-      console.log(import_chalk21.default.gray("\n  No trusted hosts configured.\n"));
-      console.log(`  Add one: ${import_chalk21.default.cyan("node9 trust add api.mycompany.com")}
+      console.log(import_chalk20.default.gray("\n  No trusted hosts configured.\n"));
+      console.log(`  Add one: ${import_chalk20.default.cyan("node9 trust add api.mycompany.com")}
 `);
       return;
     }
-    console.log(import_chalk21.default.bold("\n\u{1F513} Trusted Hosts\n"));
+    console.log(import_chalk20.default.bold("\n\u{1F513} Trusted Hosts\n"));
     for (const entry of hosts) {
       const date = new Date(entry.addedAt).toLocaleDateString();
-      console.log(`  ${import_chalk21.default.cyan(entry.host.padEnd(40))} ${import_chalk21.default.gray(`added ${date}`)}`);
+      console.log(`  ${import_chalk20.default.cyan(entry.host.padEnd(40))} ${import_chalk20.default.gray(`added ${date}`)}`);
     }
     console.log("");
   });
 }
 
 // src/cli/commands/mcp-pin.ts
-var import_chalk22 = __toESM(require("chalk"));
+var import_chalk21 = __toESM(require("chalk"));
 function registerMcpPinCommand(program2) {
   const pinCmd = program2.command("mcp").description("Manage MCP server tool definition pinning (rug pull defense)");
   const pinSubCmd = pinCmd.command("pin").description("Manage pinned MCP server tool definitions");
@@ -19845,31 +19810,31 @@ function registerMcpPinCommand(program2) {
     const result = readMcpPinsSafe();
     if (!result.ok) {
       if (result.reason === "missing") {
-        console.log(import_chalk22.default.gray("\nNo MCP servers are pinned yet."));
+        console.log(import_chalk21.default.gray("\nNo MCP servers are pinned yet."));
         console.log(
-          import_chalk22.default.gray("Pins are created automatically when the MCP gateway first connects.\n")
+          import_chalk21.default.gray("Pins are created automatically when the MCP gateway first connects.\n")
         );
         return;
       }
-      console.error(import_chalk22.default.red(`
+      console.error(import_chalk21.default.red(`
 \u274C Pin file is corrupt: ${result.detail}`));
-      console.error(import_chalk22.default.yellow("   Run: node9 mcp pin reset\n"));
+      console.error(import_chalk21.default.yellow("   Run: node9 mcp pin reset\n"));
       process.exit(1);
     }
     const entries = Object.entries(result.pins.servers);
     if (entries.length === 0) {
-      console.log(import_chalk22.default.gray("\nNo MCP servers are pinned yet."));
+      console.log(import_chalk21.default.gray("\nNo MCP servers are pinned yet."));
       console.log(
-        import_chalk22.default.gray("Pins are created automatically when the MCP gateway first connects.\n")
+        import_chalk21.default.gray("Pins are created automatically when the MCP gateway first connects.\n")
       );
       return;
     }
-    console.log(import_chalk22.default.bold("\n\u{1F512} Pinned MCP Servers\n"));
+    console.log(import_chalk21.default.bold("\n\u{1F512} Pinned MCP Servers\n"));
     for (const [key, entry] of entries) {
-      console.log(`  ${import_chalk22.default.cyan(key)}  ${import_chalk22.default.gray(entry.label)}`);
-      console.log(`    Tools (${entry.toolCount}): ${import_chalk22.default.white(entry.toolNames.join(", "))}`);
-      console.log(`    Hash:  ${import_chalk22.default.gray(entry.toolsHash.slice(0, 16))}...`);
-      console.log(`    Pinned: ${import_chalk22.default.gray(entry.pinnedAt)}`);
+      console.log(`  ${import_chalk21.default.cyan(key)}  ${import_chalk21.default.gray(entry.label)}`);
+      console.log(`    Tools (${entry.toolCount}): ${import_chalk21.default.white(entry.toolNames.join(", "))}`);
+      console.log(`    Hash:  ${import_chalk21.default.gray(entry.toolsHash.slice(0, 16))}...`);
+      console.log(`    Pinned: ${import_chalk21.default.gray(entry.pinnedAt)}`);
       console.log("");
     }
   });
@@ -19880,127 +19845,127 @@ function registerMcpPinCommand(program2) {
     try {
       pins = readMcpPins();
     } catch {
-      console.error(import_chalk22.default.red("\n\u274C Pin file is corrupt."));
-      console.error(import_chalk22.default.yellow("   Run: node9 mcp pin reset\n"));
+      console.error(import_chalk21.default.red("\n\u274C Pin file is corrupt."));
+      console.error(import_chalk21.default.yellow("   Run: node9 mcp pin reset\n"));
       process.exit(1);
     }
     if (!pins.servers[serverKey]) {
-      console.error(import_chalk22.default.red(`
+      console.error(import_chalk21.default.red(`
 \u274C No pin found for server key "${serverKey}"
 `));
-      console.error(`Run ${import_chalk22.default.cyan("node9 mcp pin list")} to see pinned servers.
+      console.error(`Run ${import_chalk21.default.cyan("node9 mcp pin list")} to see pinned servers.
 `);
       process.exit(1);
     }
     const label = pins.servers[serverKey].label;
     removePin2(serverKey);
-    console.log(import_chalk22.default.green(`
-\u{1F513} Pin removed for ${import_chalk22.default.cyan(serverKey)}`));
-    console.log(import_chalk22.default.gray(`   Server: ${label}`));
-    console.log(import_chalk22.default.gray("   Next connection will re-pin with current tool definitions.\n"));
+    console.log(import_chalk21.default.green(`
+\u{1F513} Pin removed for ${import_chalk21.default.cyan(serverKey)}`));
+    console.log(import_chalk21.default.gray(`   Server: ${label}`));
+    console.log(import_chalk21.default.gray("   Next connection will re-pin with current tool definitions.\n"));
   });
   pinSubCmd.command("reset").description("Clear all MCP pins (next connection to each server will re-pin)").action(() => {
     const result = readMcpPinsSafe();
     if (!result.ok && result.reason === "missing") {
-      console.log(import_chalk22.default.gray("\nNo pins to clear.\n"));
+      console.log(import_chalk21.default.gray("\nNo pins to clear.\n"));
       return;
     }
     const count = result.ok ? Object.keys(result.pins.servers).length : "?";
     clearAllPins2();
-    console.log(import_chalk22.default.green(`
+    console.log(import_chalk21.default.green(`
 \u{1F513} Cleared ${count} MCP pin(s).`));
-    console.log(import_chalk22.default.gray("   Next connection to each server will re-pin.\n"));
+    console.log(import_chalk21.default.gray("   Next connection to each server will re-pin.\n"));
   });
 }
 
 // src/cli/commands/sync.ts
-var import_chalk23 = __toESM(require("chalk"));
+var import_chalk22 = __toESM(require("chalk"));
 init_sync();
 function registerSyncCommand(program2) {
   const policy = program2.command("policy").description("Manage cloud policy rules");
   policy.command("sync").description("Sync cloud policy rules to local cache (~/.node9/rules-cache.json)").action(async () => {
-    process.stdout.write(import_chalk23.default.cyan("Syncing cloud policy rules\u2026"));
+    process.stdout.write(import_chalk22.default.cyan("Syncing cloud policy rules\u2026"));
     const result = await runCloudSync();
     process.stdout.write("\n");
     if (!result.ok) {
-      console.error(import_chalk23.default.red(`\u2717 ${result.reason}`));
+      console.error(import_chalk22.default.red(`\u2717 ${result.reason}`));
       process.exit(1);
     }
     if (result.unchanged) {
       console.log(
-        import_chalk23.default.green(
+        import_chalk22.default.green(
           `\u2713 Already up to date \u2014 ${result.rules} rule${result.rules === 1 ? "" : "s"} cached`
         )
       );
-      console.log(import_chalk23.default.gray(`  Cached at: ${result.fetchedAt}`));
-      console.log(import_chalk23.default.gray(`  Server returned 304 (no changes since last sync)`));
+      console.log(import_chalk22.default.gray(`  Cached at: ${result.fetchedAt}`));
+      console.log(import_chalk22.default.gray(`  Server returned 304 (no changes since last sync)`));
     } else {
       console.log(
-        import_chalk23.default.green(`\u2713 Synced ${result.rules} rule${result.rules === 1 ? "" : "s"} from cloud`)
+        import_chalk22.default.green(`\u2713 Synced ${result.rules} rule${result.rules === 1 ? "" : "s"} from cloud`)
       );
-      console.log(import_chalk23.default.gray(`  Cached at: ${result.fetchedAt}`));
-      console.log(import_chalk23.default.gray(`  File: ~/.node9/rules-cache.json`));
+      console.log(import_chalk22.default.gray(`  Cached at: ${result.fetchedAt}`));
+      console.log(import_chalk22.default.gray(`  File: ~/.node9/rules-cache.json`));
     }
   });
   policy.command("show").description("List all cloud policy rules in the local cache").action(() => {
     const status = getCloudSyncStatus();
     if (!status.cached) {
-      console.log(import_chalk23.default.yellow("\n  No cloud rules cached \u2014 run: node9 policy sync\n"));
+      console.log(import_chalk22.default.yellow("\n  No cloud rules cached \u2014 run: node9 policy sync\n"));
       return;
     }
     const rules = getCloudRules() ?? [];
     const age = Math.round((Date.now() - new Date(status.fetchedAt).getTime()) / 6e4);
     console.log(
-      import_chalk23.default.bold(`
-  Cloud policy rules`) + import_chalk23.default.gray(
+      import_chalk22.default.bold(`
+  Cloud policy rules`) + import_chalk22.default.gray(
         ` (${rules.length} rule${rules.length === 1 ? "" : "s"}, synced ${age}m ago)
 `
       )
     );
     if (rules.length === 0) {
-      console.log(import_chalk23.default.gray("  No rules defined in cloud policy.\n"));
+      console.log(import_chalk22.default.gray("  No rules defined in cloud policy.\n"));
       return;
     }
     for (const rule of rules) {
       const r = rule;
-      const verdictColor = r.verdict === "block" ? import_chalk23.default.red : r.verdict === "allow" ? import_chalk23.default.green : import_chalk23.default.yellow;
+      const verdictColor = r.verdict === "block" ? import_chalk22.default.red : r.verdict === "allow" ? import_chalk22.default.green : import_chalk22.default.yellow;
       console.log(
         `  ${verdictColor(
           String(r.verdict ?? "unknown").toUpperCase().padEnd(6)
-        )}  ${import_chalk23.default.white(String(r.name ?? "(unnamed)"))}`
+        )}  ${import_chalk22.default.white(String(r.name ?? "(unnamed)"))}`
       );
-      if (r.reason) console.log(import_chalk23.default.gray(`           ${String(r.reason)}`));
+      if (r.reason) console.log(import_chalk22.default.gray(`           ${String(r.reason)}`));
     }
     console.log("");
   });
   policy.command("status").description("Show current cloud policy cache status").action(() => {
     const s = getCloudSyncStatus();
     if (!s.cached) {
-      console.log(import_chalk23.default.yellow("\n  No cache yet \u2014 run: node9 policy sync\n"));
+      console.log(import_chalk22.default.yellow("\n  No cache yet \u2014 run: node9 policy sync\n"));
       return;
     }
     const age = Math.round((Date.now() - new Date(s.fetchedAt).getTime()) / 6e4);
     console.log(`
-  Rules   : ${import_chalk23.default.green(String(s.rules))} cloud rules loaded`);
+  Rules   : ${import_chalk22.default.green(String(s.rules))} cloud rules loaded`);
     console.log(
-      `  Synced  : ${import_chalk23.default.gray(`${age} minute${age === 1 ? "" : "s"} ago`)} (${s.fetchedAt})`
+      `  Synced  : ${import_chalk22.default.gray(`${age} minute${age === 1 ? "" : "s"} ago`)} (${s.fetchedAt})`
     );
     if (s.workspaceId) {
-      console.log(`  Workspace: ${import_chalk23.default.gray(s.workspaceId)}`);
+      console.log(`  Workspace: ${import_chalk22.default.gray(s.workspaceId)}`);
     }
     if (s.panicMode) {
       console.log(
-        `  ${import_chalk23.default.red.bold("\u{1F6A8} Panic mode  : ON")}  ` + import_chalk23.default.dim("(every review-verdict becomes block)")
+        `  ${import_chalk22.default.red.bold("\u{1F6A8} Panic mode  : ON")}  ` + import_chalk22.default.dim("(every review-verdict becomes block)")
       );
     }
     if (s.shadowMode) {
       console.log(
-        `  ${import_chalk23.default.yellow.bold("\u{1F441}  Shadow mode : ON")}  ` + import_chalk23.default.dim("(blocks become would-block log entries)")
+        `  ${import_chalk22.default.yellow.bold("\u{1F441}  Shadow mode : ON")}  ` + import_chalk22.default.dim("(blocks become would-block log entries)")
       );
     }
     if (s.syncIntervalHours) {
       console.log(
-        import_chalk23.default.gray(
+        import_chalk22.default.gray(
           `  Polling : every ${s.syncIntervalHours} hour${s.syncIntervalHours === 1 ? "" : "s"}`
         )
       );
@@ -20010,7 +19975,7 @@ function registerSyncCommand(program2) {
 }
 
 // src/cli/commands/agents.ts
-var import_chalk24 = __toESM(require("chalk"));
+var import_chalk23 = __toESM(require("chalk"));
 init_setup();
 var SETUP_FN = {
   claude: setupClaude,
@@ -20040,23 +20005,23 @@ function registerAgentsCommand(program2) {
     console.log(`  ${"Agent".padEnd(14)}${"Installed".padEnd(11)}${"Wired".padEnd(8)}Mode`);
     console.log("  " + "\u2500".repeat(44));
     for (const s of statuses) {
-      const installed = s.installed ? import_chalk24.default.green("\u2713") : import_chalk24.default.gray("\u2717");
-      const wired = !s.installed ? import_chalk24.default.gray("\u2014") : s.wired ? import_chalk24.default.green("\u2713") : import_chalk24.default.yellow("\u2717");
-      const mode = s.mode ? import_chalk24.default.gray(s.mode) : import_chalk24.default.gray("\u2014");
-      const hint = s.installed && !s.wired ? import_chalk24.default.gray(`  \u2190 node9 agents add ${s.name}`) : "";
+      const installed = s.installed ? import_chalk23.default.green("\u2713") : import_chalk23.default.gray("\u2717");
+      const wired = !s.installed ? import_chalk23.default.gray("\u2014") : s.wired ? import_chalk23.default.green("\u2713") : import_chalk23.default.yellow("\u2717");
+      const mode = s.mode ? import_chalk23.default.gray(s.mode) : import_chalk23.default.gray("\u2014");
+      const hint = s.installed && !s.wired ? import_chalk23.default.gray(`  \u2190 node9 agents add ${s.name}`) : "";
       console.log(`  ${s.label.padEnd(14)}${installed}          ${wired}       ${mode}${hint}`);
     }
     console.log("");
     if (!anyInstalled) {
       console.log(
-        import_chalk24.default.gray("  No AI agents detected. Install Claude Code, Gemini CLI, Cursor,\n") + import_chalk24.default.gray("  Windsurf, VSCode, or Codex then run: node9 agents list\n")
+        import_chalk23.default.gray("  No AI agents detected. Install Claude Code, Gemini CLI, Cursor,\n") + import_chalk23.default.gray("  Windsurf, VSCode, or Codex then run: node9 agents list\n")
       );
       return;
     }
     const unwired = statuses.filter((s) => s.installed && !s.wired);
     if (unwired.length > 0) {
       console.log(
-        import_chalk24.default.yellow(`  ${unwired.length} agent(s) not yet wired. Run: `) + import_chalk24.default.white(`node9 agents add ${unwired[0].name}`) + "\n"
+        import_chalk23.default.yellow(`  ${unwired.length} agent(s) not yet wired. Run: `) + import_chalk23.default.white(`node9 agents add ${unwired[0].name}`) + "\n"
       );
     }
   });
@@ -20064,7 +20029,7 @@ function registerAgentsCommand(program2) {
     const name = agent.toLowerCase();
     const fn = SETUP_FN[name];
     if (!fn) {
-      console.error(import_chalk24.default.red(`Unknown agent: "${agent}". Supported: ${AGENT_NAMES.join(", ")}`));
+      console.error(import_chalk23.default.red(`Unknown agent: "${agent}". Supported: ${AGENT_NAMES.join(", ")}`));
       process.exit(1);
     }
     await fn();
@@ -20073,14 +20038,14 @@ function registerAgentsCommand(program2) {
     const name = agent.toLowerCase();
     const fn = TEARDOWN_FN[name];
     if (!fn) {
-      console.error(import_chalk24.default.red(`Unknown agent: "${agent}". Supported: ${AGENT_NAMES.join(", ")}`));
+      console.error(import_chalk23.default.red(`Unknown agent: "${agent}". Supported: ${AGENT_NAMES.join(", ")}`));
       process.exit(1);
     }
-    console.log(import_chalk24.default.cyan(`
+    console.log(import_chalk23.default.cyan(`
 \u{1F6E1}\uFE0F  Node9: removing from ${name}...
 `));
     fn();
-    console.log(import_chalk24.default.gray("\n  Restart the agent for changes to take effect."));
+    console.log(import_chalk23.default.gray("\n  Restart the agent for changes to take effect."));
   });
 }
 
@@ -20088,7 +20053,7 @@ function registerAgentsCommand(program2) {
 init_scan();
 
 // src/cli/commands/sessions.ts
-var import_chalk25 = __toESM(require("chalk"));
+var import_chalk24 = __toESM(require("chalk"));
 var import_fs40 = __toESM(require("fs"));
 var import_path42 = __toESM(require("path"));
 var import_os36 = __toESM(require("os"));
@@ -20597,11 +20562,11 @@ function toolInputSummary(tool, input) {
 }
 function toolColor(tool) {
   const t = tool.toLowerCase();
-  if (t === "bash" || t === "execute_bash") return import_chalk25.default.red;
-  if (t === "write") return import_chalk25.default.green;
-  if (t === "edit" || t === "notebookedit") return import_chalk25.default.yellow;
-  if (t === "read") return import_chalk25.default.cyan;
-  return import_chalk25.default.gray;
+  if (t === "bash" || t === "execute_bash") return import_chalk24.default.red;
+  if (t === "write") return import_chalk24.default.green;
+  if (t === "edit" || t === "notebookedit") return import_chalk24.default.yellow;
+  if (t === "read") return import_chalk24.default.cyan;
+  return import_chalk24.default.gray;
 }
 function barStr2(value, max, width) {
   if (max === 0 || width <= 0) return "\u2591".repeat(width);
@@ -20611,7 +20576,7 @@ function barStr2(value, max, width) {
 function colorBar2(value, max, width) {
   const s = barStr2(value, max, width);
   const filled = Math.max(1, Math.round(max > 0 ? value / max * width : 0));
-  return import_chalk25.default.cyan(s.slice(0, filled)) + import_chalk25.default.dim(s.slice(filled));
+  return import_chalk24.default.cyan(s.slice(0, filled)) + import_chalk24.default.dim(s.slice(filled));
 }
 function renderSummary(summaries) {
   const totalTools = summaries.reduce((n, s) => n + s.toolCalls.length, 0);
@@ -20641,45 +20606,45 @@ function renderSummary(summaries) {
   }
   const topProjects = [...projCosts.entries()].sort((a, b) => b[1] - a[1]).slice(0, 3);
   const W = 20;
-  console.log(import_chalk25.default.dim("  " + "\u2500".repeat(70)));
+  console.log(import_chalk24.default.dim("  " + "\u2500".repeat(70)));
   console.log(
-    "  " + import_chalk25.default.bold.white(String(summaries.length).padEnd(4)) + import_chalk25.default.dim("sessions    ") + import_chalk25.default.bold.yellow(fmtCost3(totalCost).padEnd(10)) + import_chalk25.default.dim("total    ") + import_chalk25.default.bold.white(String(totalTools).padEnd(6)) + import_chalk25.default.dim("tool calls    ") + import_chalk25.default.bold.white(String(totalFiles)) + import_chalk25.default.dim(" files modified") + (totalBlocked > 0 ? import_chalk25.default.dim("    ") + import_chalk25.default.red.bold(String(totalBlocked)) + import_chalk25.default.dim(" blocked by node9") : "")
+    "  " + import_chalk24.default.bold.white(String(summaries.length).padEnd(4)) + import_chalk24.default.dim("sessions    ") + import_chalk24.default.bold.yellow(fmtCost3(totalCost).padEnd(10)) + import_chalk24.default.dim("total    ") + import_chalk24.default.bold.white(String(totalTools).padEnd(6)) + import_chalk24.default.dim("tool calls    ") + import_chalk24.default.bold.white(String(totalFiles)) + import_chalk24.default.dim(" files modified") + (totalBlocked > 0 ? import_chalk24.default.dim("    ") + import_chalk24.default.red.bold(String(totalBlocked)) + import_chalk24.default.dim(" blocked by node9") : "")
   );
   console.log(
-    "  " + import_chalk25.default.dim("avg ") + import_chalk25.default.white(fmtCost3(avgCost).padEnd(10)) + import_chalk25.default.dim("/session    ") + import_chalk25.default.green(String(snapshots)) + import_chalk25.default.dim(` of ${summaries.length} sessions had snapshots`)
+    "  " + import_chalk24.default.dim("avg ") + import_chalk24.default.white(fmtCost3(avgCost).padEnd(10)) + import_chalk24.default.dim("/session    ") + import_chalk24.default.green(String(snapshots)) + import_chalk24.default.dim(` of ${summaries.length} sessions had snapshots`)
   );
   console.log("");
-  console.log("  " + import_chalk25.default.dim("Tool breakdown:"));
+  console.log("  " + import_chalk24.default.dim("Tool breakdown:"));
   const maxGroup = Math.max(...Object.values(groups));
   for (const [label, count] of Object.entries(groups)) {
     if (count === 0) continue;
     const pct = totalTools > 0 ? Math.round(count / totalTools * 100) : 0;
     console.log(
-      "    " + label.padEnd(6) + "  " + colorBar2(count, maxGroup, W) + "  " + import_chalk25.default.white(String(count).padStart(4)) + import_chalk25.default.dim(` (${String(pct)}%)`)
+      "    " + label.padEnd(6) + "  " + colorBar2(count, maxGroup, W) + "  " + import_chalk24.default.white(String(count).padStart(4)) + import_chalk24.default.dim(` (${String(pct)}%)`)
     );
   }
   console.log("");
   if (topProjects.length > 1) {
-    console.log("  " + import_chalk25.default.dim("Cost by project:"));
+    console.log("  " + import_chalk24.default.dim("Cost by project:"));
     const maxProjCost = topProjects[0][1];
     for (const [proj, cost] of topProjects) {
       console.log(
-        "    " + proj.slice(0, 28).padEnd(28) + "  " + colorBar2(cost, maxProjCost, W) + "  " + import_chalk25.default.yellow(fmtCost3(cost))
+        "    " + proj.slice(0, 28).padEnd(28) + "  " + colorBar2(cost, maxProjCost, W) + "  " + import_chalk24.default.yellow(fmtCost3(cost))
       );
     }
     console.log("");
   }
-  console.log(import_chalk25.default.dim("  " + "\u2500".repeat(70)));
+  console.log(import_chalk24.default.dim("  " + "\u2500".repeat(70)));
   console.log("");
 }
 function renderList(summaries, totalCost) {
   if (summaries.length === 0) {
-    console.log(import_chalk25.default.yellow("  No sessions found in the requested range.\n"));
+    console.log(import_chalk24.default.yellow("  No sessions found in the requested range.\n"));
     return;
   }
-  const totalLabel = totalCost > 0 ? import_chalk25.default.dim("  ~" + fmtCost3(totalCost) + " total") : "";
+  const totalLabel = totalCost > 0 ? import_chalk24.default.dim("  ~" + fmtCost3(totalCost) + " total") : "";
   console.log(
-    "  " + import_chalk25.default.white(String(summaries.length)) + import_chalk25.default.dim(` session${summaries.length !== 1 ? "s" : ""}`) + totalLabel
+    "  " + import_chalk24.default.white(String(summaries.length)) + import_chalk24.default.dim(` session${summaries.length !== 1 ? "s" : ""}`) + totalLabel
   );
   console.log("");
   let lastGroup = "";
@@ -20687,49 +20652,49 @@ function renderList(summaries, totalCost) {
     const activeDate = fmtDate2(s.lastActiveTime);
     const group = activeDate + "  " + s.projectLabel;
     if (group !== lastGroup) {
-      console.log(import_chalk25.default.dim("  \u2500\u2500\u2500 ") + import_chalk25.default.bold(activeDate) + import_chalk25.default.dim("  " + s.projectLabel));
+      console.log(import_chalk24.default.dim("  \u2500\u2500\u2500 ") + import_chalk24.default.bold(activeDate) + import_chalk24.default.dim("  " + s.projectLabel));
       lastGroup = group;
     }
     const startDate = fmtDate2(s.startTime);
-    const dateRange = startDate !== activeDate ? import_chalk25.default.dim(" (" + startDate + " \u2192 " + activeDate + ")") : "";
-    const timeStr = import_chalk25.default.dim(fmtTime(s.startTime));
-    const prompt = import_chalk25.default.white(truncate(s.firstPrompt.replace(/\n/g, " "), 50).padEnd(50));
-    const tools = s.toolCalls.length > 0 ? import_chalk25.default.dim(String(s.toolCalls.length).padStart(3) + " tools") : import_chalk25.default.dim("  0 tools");
-    const cost = s.costUSD > 0 ? import_chalk25.default.dim("  " + fmtCost3(s.costUSD).padEnd(8)) : "          ";
-    const blocked = s.blockedCalls.length > 0 ? import_chalk25.default.red("  \u{1F6D1} " + String(s.blockedCalls.length)) : "";
-    const snap = s.hasSnapshot ? import_chalk25.default.green("  \u{1F4F8}") : "";
-    const agentBadge = s.agent === "gemini" ? import_chalk25.default.blue("  [Gemini]") : s.agent === "codex" ? import_chalk25.default.magenta("  [Codex]") : import_chalk25.default.cyan("  [Claude]");
-    const sid = import_chalk25.default.dim("  " + s.sessionId.slice(0, 8));
+    const dateRange = startDate !== activeDate ? import_chalk24.default.dim(" (" + startDate + " \u2192 " + activeDate + ")") : "";
+    const timeStr = import_chalk24.default.dim(fmtTime(s.startTime));
+    const prompt = import_chalk24.default.white(truncate(s.firstPrompt.replace(/\n/g, " "), 50).padEnd(50));
+    const tools = s.toolCalls.length > 0 ? import_chalk24.default.dim(String(s.toolCalls.length).padStart(3) + " tools") : import_chalk24.default.dim("  0 tools");
+    const cost = s.costUSD > 0 ? import_chalk24.default.dim("  " + fmtCost3(s.costUSD).padEnd(8)) : "          ";
+    const blocked = s.blockedCalls.length > 0 ? import_chalk24.default.red("  \u{1F6D1} " + String(s.blockedCalls.length)) : "";
+    const snap = s.hasSnapshot ? import_chalk24.default.green("  \u{1F4F8}") : "";
+    const agentBadge = s.agent === "gemini" ? import_chalk24.default.blue("  [Gemini]") : s.agent === "codex" ? import_chalk24.default.magenta("  [Codex]") : import_chalk24.default.cyan("  [Claude]");
+    const sid = import_chalk24.default.dim("  " + s.sessionId.slice(0, 8));
     console.log(
       `  ${timeStr}  ${prompt}  ${tools}${cost}${blocked}${snap}${agentBadge}${sid}${dateRange}`
     );
   }
   console.log("");
   console.log(
-    import_chalk25.default.dim("  Run") + " " + import_chalk25.default.cyan("node9 sessions --detail <session-id>") + import_chalk25.default.dim(" for full tool trace.")
+    import_chalk24.default.dim("  Run") + " " + import_chalk24.default.cyan("node9 sessions --detail <session-id>") + import_chalk24.default.dim(" for full tool trace.")
   );
   console.log("");
 }
 function renderDetail(s) {
   console.log("");
-  console.log(import_chalk25.default.bold("  Session  ") + import_chalk25.default.dim(s.sessionId));
+  console.log(import_chalk24.default.bold("  Session  ") + import_chalk24.default.dim(s.sessionId));
   console.log(
-    import_chalk25.default.bold("  Prompt   ") + import_chalk25.default.white(s.firstPrompt.replace(/\n/g, " ").slice(0, 120))
+    import_chalk24.default.bold("  Prompt   ") + import_chalk24.default.white(s.firstPrompt.replace(/\n/g, " ").slice(0, 120))
   );
-  console.log(import_chalk25.default.bold("  Project  ") + import_chalk25.default.white(s.projectLabel));
+  console.log(import_chalk24.default.bold("  Project  ") + import_chalk24.default.white(s.projectLabel));
   if (s.agent) {
-    const agentLabel2 = s.agent === "gemini" ? import_chalk25.default.blue("Gemini CLI") : s.agent === "codex" ? import_chalk25.default.magenta("Codex") : import_chalk25.default.cyan("Claude Code");
-    console.log(import_chalk25.default.bold("  Agent    ") + agentLabel2);
+    const agentLabel2 = s.agent === "gemini" ? import_chalk24.default.blue("Gemini CLI") : s.agent === "codex" ? import_chalk24.default.magenta("Codex") : import_chalk24.default.cyan("Claude Code");
+    console.log(import_chalk24.default.bold("  Agent    ") + agentLabel2);
   }
-  console.log(import_chalk25.default.bold("  When     ") + import_chalk25.default.white(fmtDateTime(s.startTime)));
+  console.log(import_chalk24.default.bold("  When     ") + import_chalk24.default.white(fmtDateTime(s.startTime)));
   if (s.costUSD > 0)
-    console.log(import_chalk25.default.bold("  Cost     ") + import_chalk25.default.yellow("~" + fmtCost3(s.costUSD)));
+    console.log(import_chalk24.default.bold("  Cost     ") + import_chalk24.default.yellow("~" + fmtCost3(s.costUSD)));
   console.log(
-    import_chalk25.default.bold("  Snapshot ") + (s.hasSnapshot ? import_chalk25.default.green("\u2713 taken") : import_chalk25.default.dim("none"))
+    import_chalk24.default.bold("  Snapshot ") + (s.hasSnapshot ? import_chalk24.default.green("\u2713 taken") : import_chalk24.default.dim("none"))
   );
   console.log("");
   if (s.toolCalls.length === 0 && s.blockedCalls.length === 0) {
-    console.log(import_chalk25.default.dim("  No tool calls recorded.\n"));
+    console.log(import_chalk24.default.dim("  No tool calls recorded.\n"));
     return;
   }
   const timeline = [
@@ -20742,32 +20707,32 @@ function renderDetail(s) {
   });
   const headerParts = [`Tool calls (${s.toolCalls.length})`];
   if (s.blockedCalls.length > 0)
-    headerParts.push(import_chalk25.default.red(`${s.blockedCalls.length} blocked by node9`));
-  console.log(import_chalk25.default.bold("  " + headerParts.join("  \xB7  ")));
+    headerParts.push(import_chalk24.default.red(`${s.blockedCalls.length} blocked by node9`));
+  console.log(import_chalk24.default.bold("  " + headerParts.join("  \xB7  ")));
   console.log("");
   for (const entry of timeline) {
     if (entry.kind === "tool") {
       const tc = entry.tc;
       const colorFn = toolColor(tc.tool);
       const toolPad = colorFn(tc.tool.padEnd(16));
-      const detail = import_chalk25.default.gray(truncate(toolInputSummary(tc.tool, tc.input), 70));
-      const ts = tc.timestamp ? import_chalk25.default.dim(fmtTime(tc.timestamp) + "  ") : "       ";
+      const detail = import_chalk24.default.gray(truncate(toolInputSummary(tc.tool, tc.input), 70));
+      const ts = tc.timestamp ? import_chalk24.default.dim(fmtTime(tc.timestamp) + "  ") : "       ";
       console.log(`    ${ts}${toolPad}  ${detail}`);
     } else {
       const bc = entry.bc;
-      const ts = bc.timestamp ? import_chalk25.default.dim(fmtTime(bc.timestamp) + "  ") : "       ";
-      const label = import_chalk25.default.red("\u{1F6D1} BLOCKED".padEnd(16));
-      const toolName = import_chalk25.default.red(bc.tool.padEnd(10));
-      const argsSummary = bc.args ? import_chalk25.default.gray(truncate(toolInputSummary(bc.tool, bc.args), 40)) : import_chalk25.default.dim("[args not logged]");
-      const reason = bc.checkedBy ? import_chalk25.default.dim("  \u2190 " + bc.checkedBy) : "";
+      const ts = bc.timestamp ? import_chalk24.default.dim(fmtTime(bc.timestamp) + "  ") : "       ";
+      const label = import_chalk24.default.red("\u{1F6D1} BLOCKED".padEnd(16));
+      const toolName = import_chalk24.default.red(bc.tool.padEnd(10));
+      const argsSummary = bc.args ? import_chalk24.default.gray(truncate(toolInputSummary(bc.tool, bc.args), 40)) : import_chalk24.default.dim("[args not logged]");
+      const reason = bc.checkedBy ? import_chalk24.default.dim("  \u2190 " + bc.checkedBy) : "";
       console.log(`    ${ts}${label}  ${toolName}  ${argsSummary}${reason}`);
     }
   }
   console.log("");
   if (s.modifiedFiles.length > 0) {
-    console.log(import_chalk25.default.bold(`  Files modified (${s.modifiedFiles.length}):`));
+    console.log(import_chalk24.default.bold(`  Files modified (${s.modifiedFiles.length}):`));
     for (const f of s.modifiedFiles) {
-      console.log("    " + import_chalk25.default.yellow(f));
+      console.log("    " + import_chalk24.default.yellow(f));
     }
     console.log("");
   }
@@ -20775,19 +20740,19 @@ function renderDetail(s) {
 function registerSessionsCommand(program2) {
   program2.command("sessions").description("Show what your AI agent did \u2014 sessions, tool calls, cost, and file changes").option("--all", "Show all sessions (default: last 7 days)").option("--days <n>", "Show last N days of sessions", "7").option("--detail <sessionId>", "Show full tool trace for a session").action((options) => {
     console.log("");
-    console.log(import_chalk25.default.cyan.bold("\u{1F4CB}  node9 sessions") + import_chalk25.default.dim("  \u2014 what your AI agent did"));
+    console.log(import_chalk24.default.cyan.bold("\u{1F4CB}  node9 sessions") + import_chalk24.default.dim("  \u2014 what your AI agent did"));
     console.log("");
     const historyPath = import_path42.default.join(import_os36.default.homedir(), ".claude", "history.jsonl");
     if (!import_fs40.default.existsSync(historyPath)) {
-      console.log(import_chalk25.default.yellow("  No Claude session history found at ~/.claude/history.jsonl"));
-      console.log(import_chalk25.default.gray("  Install Claude Code, run a few sessions, then try again.\n"));
+      console.log(import_chalk24.default.yellow("  No Claude session history found at ~/.claude/history.jsonl"));
+      console.log(import_chalk24.default.gray("  Install Claude Code, run a few sessions, then try again.\n"));
       return;
     }
     const days = options.detail || options.all ? null : Math.max(1, parseInt(options.days, 10) || 7);
     const rangeLabel = options.detail ? "all time" : options.all ? "all time" : `last ${String(days)} days`;
-    console.log(import_chalk25.default.dim("  " + rangeLabel));
+    console.log(import_chalk24.default.dim("  " + rangeLabel));
     console.log("");
-    process.stdout.write(import_chalk25.default.dim("  Loading\u2026"));
+    process.stdout.write(import_chalk24.default.dim("  Loading\u2026"));
     const summaries = buildSessions(days);
     if (process.stdout.isTTY) {
       process.stdout.clearLine(0);
@@ -20800,8 +20765,8 @@ function registerSessionsCommand(program2) {
         (s) => s.sessionId === options.detail || s.sessionId.startsWith(options.detail)
       );
       if (!target) {
-        console.log(import_chalk25.default.red(`  Session not found: ${options.detail}`));
-        console.log(import_chalk25.default.dim("  Run `node9 sessions` to list recent sessions.\n"));
+        console.log(import_chalk24.default.red(`  Session not found: ${options.detail}`));
+        console.log(import_chalk24.default.dim("  Run `node9 sessions` to list recent sessions.\n"));
         return;
       }
       renderDetail(target);
@@ -20814,7 +20779,7 @@ function registerSessionsCommand(program2) {
 }
 
 // src/cli/commands/skill-pin.ts
-var import_chalk26 = __toESM(require("chalk"));
+var import_chalk25 = __toESM(require("chalk"));
 var import_fs41 = __toESM(require("fs"));
 var import_os37 = __toESM(require("os"));
 var import_path43 = __toESM(require("path"));
@@ -20834,29 +20799,29 @@ function registerSkillPinCommand(program2) {
     const result = readSkillPinsSafe();
     if (!result.ok) {
       if (result.reason === "missing") {
-        console.log(import_chalk26.default.gray("\nNo skill roots are pinned yet."));
+        console.log(import_chalk25.default.gray("\nNo skill roots are pinned yet."));
         console.log(
-          import_chalk26.default.gray("Pins are created automatically on the first tool call of each session.\n")
+          import_chalk25.default.gray("Pins are created automatically on the first tool call of each session.\n")
         );
         return;
       }
-      console.error(import_chalk26.default.red(`
+      console.error(import_chalk25.default.red(`
 \u274C Pin file is corrupt: ${result.detail}`));
-      console.error(import_chalk26.default.yellow("   Run: node9 skill pin reset\n"));
+      console.error(import_chalk25.default.yellow("   Run: node9 skill pin reset\n"));
       process.exit(1);
     }
     const entries = Object.entries(result.pins.roots);
     if (entries.length === 0) {
-      console.log(import_chalk26.default.gray("\nNo skill roots are pinned yet.\n"));
+      console.log(import_chalk25.default.gray("\nNo skill roots are pinned yet.\n"));
       return;
     }
-    console.log(import_chalk26.default.bold("\n\u{1F512} Pinned Skill Roots\n"));
+    console.log(import_chalk25.default.bold("\n\u{1F512} Pinned Skill Roots\n"));
     for (const [key, entry] of entries) {
-      const missing = entry.exists ? "" : import_chalk26.default.yellow(" (not present at pin time)");
-      console.log(`  ${import_chalk26.default.cyan(key)}  ${import_chalk26.default.gray(entry.rootPath)}${missing}`);
+      const missing = entry.exists ? "" : import_chalk25.default.yellow(" (not present at pin time)");
+      console.log(`  ${import_chalk25.default.cyan(key)}  ${import_chalk25.default.gray(entry.rootPath)}${missing}`);
       console.log(`    Files (${entry.fileCount})`);
-      console.log(`    Hash:  ${import_chalk26.default.gray(entry.contentHash.slice(0, 16))}...`);
-      console.log(`    Pinned: ${import_chalk26.default.gray(entry.pinnedAt)}
+      console.log(`    Hash:  ${import_chalk25.default.gray(entry.contentHash.slice(0, 16))}...`);
+      console.log(`    Pinned: ${import_chalk25.default.gray(entry.pinnedAt)}
 `);
     }
   });
@@ -20865,39 +20830,39 @@ function registerSkillPinCommand(program2) {
     try {
       pins = readSkillPins();
     } catch {
-      console.error(import_chalk26.default.red("\n\u274C Pin file is corrupt."));
-      console.error(import_chalk26.default.yellow("   Run: node9 skill pin reset\n"));
+      console.error(import_chalk25.default.red("\n\u274C Pin file is corrupt."));
+      console.error(import_chalk25.default.yellow("   Run: node9 skill pin reset\n"));
       process.exit(1);
     }
     if (!pins.roots[rootKey]) {
-      console.error(import_chalk26.default.red(`
+      console.error(import_chalk25.default.red(`
 \u274C No pin found for root key "${rootKey}"
 `));
-      console.error(`Run ${import_chalk26.default.cyan("node9 skill pin list")} to see pinned roots.
+      console.error(`Run ${import_chalk25.default.cyan("node9 skill pin list")} to see pinned roots.
 `);
       process.exit(1);
     }
     const rootPath = pins.roots[rootKey].rootPath;
     removePin(rootKey);
     wipeSkillSessions();
-    console.log(import_chalk26.default.green(`
-\u{1F513} Pin removed for ${import_chalk26.default.cyan(rootKey)}`));
-    console.log(import_chalk26.default.gray(`   ${rootPath}`));
-    console.log(import_chalk26.default.gray("   Next session will re-pin with current state.\n"));
+    console.log(import_chalk25.default.green(`
+\u{1F513} Pin removed for ${import_chalk25.default.cyan(rootKey)}`));
+    console.log(import_chalk25.default.gray(`   ${rootPath}`));
+    console.log(import_chalk25.default.gray("   Next session will re-pin with current state.\n"));
   });
   pinSubCmd.command("reset").description("Clear all skill pins and wipe session verification flags").action(() => {
     const result = readSkillPinsSafe();
     if (!result.ok && result.reason === "missing") {
       wipeSkillSessions();
-      console.log(import_chalk26.default.gray("\nNo pins to clear.\n"));
+      console.log(import_chalk25.default.gray("\nNo pins to clear.\n"));
       return;
     }
     const count = result.ok ? Object.keys(result.pins.roots).length : "?";
     clearAllPins();
     wipeSkillSessions();
-    console.log(import_chalk26.default.green(`
+    console.log(import_chalk25.default.green(`
 \u{1F513} Cleared ${count} skill pin(s).`));
-    console.log(import_chalk26.default.gray("   Next session will re-pin with current state.\n"));
+    console.log(import_chalk25.default.gray("   Next session will re-pin with current state.\n"));
   });
 }
 
@@ -20905,7 +20870,7 @@ function registerSkillPinCommand(program2) {
 var import_fs42 = __toESM(require("fs"));
 var import_os38 = __toESM(require("os"));
 var import_path44 = __toESM(require("path"));
-var import_chalk27 = __toESM(require("chalk"));
+var import_chalk26 = __toESM(require("chalk"));
 var DECISIONS_FILE2 = import_path44.default.join(import_os38.default.homedir(), ".node9", "decisions.json");
 function readDecisions() {
   try {
@@ -20934,55 +20899,55 @@ function registerDecisionsCommand(program2) {
     const decisions = readDecisions();
     const entries = Object.entries(decisions);
     if (entries.length === 0) {
-      console.log(import_chalk27.default.gray("  No persistent decisions stored."));
+      console.log(import_chalk26.default.gray("  No persistent decisions stored."));
       console.log(
-        import_chalk27.default.gray(`  File: ${DECISIONS_FILE2}
-`) + import_chalk27.default.gray('  Decisions are written when you click "Always Allow" or')
+        import_chalk26.default.gray(`  File: ${DECISIONS_FILE2}
+`) + import_chalk26.default.gray('  Decisions are written when you click "Always Allow" or')
       );
-      console.log(import_chalk27.default.gray('  "Always Deny" in node9 tail or the native popup.'));
+      console.log(import_chalk26.default.gray('  "Always Deny" in node9 tail or the native popup.'));
       return;
     }
-    console.log(import_chalk27.default.bold(`
+    console.log(import_chalk26.default.bold(`
 Persistent decisions  (${entries.length})
 `));
     const w = Math.max(...entries.map(([k]) => k.length));
     for (const [tool, verdict] of entries.sort()) {
-      const colored = verdict === "allow" ? import_chalk27.default.green(verdict) : import_chalk27.default.red(verdict);
+      const colored = verdict === "allow" ? import_chalk26.default.green(verdict) : import_chalk26.default.red(verdict);
       console.log(`  ${tool.padEnd(w)}  ${colored}`);
     }
     console.log(
-      import_chalk27.default.gray(`
+      import_chalk26.default.gray(`
   Stored in ${DECISIONS_FILE2}
-`) + import_chalk27.default.gray("  Run `node9 decisions clear <tool>` to remove an entry.")
+`) + import_chalk26.default.gray("  Run `node9 decisions clear <tool>` to remove an entry.")
     );
   });
   cmd.command("clear <toolName>").description("Remove a persistent decision for one tool").action((toolName) => {
     const decisions = readDecisions();
     if (!(toolName in decisions)) {
-      console.log(import_chalk27.default.yellow(`  No persistent decision for "${toolName}". Nothing to clear.`));
+      console.log(import_chalk26.default.yellow(`  No persistent decision for "${toolName}". Nothing to clear.`));
       process.exitCode = 1;
       return;
     }
     delete decisions[toolName];
     writeDecisions(decisions);
-    console.log(import_chalk27.default.green(`  \u2713 Cleared persistent decision for "${toolName}".`));
+    console.log(import_chalk26.default.green(`  \u2713 Cleared persistent decision for "${toolName}".`));
   });
   cmd.command("clear-all").description("Remove every persistent decision (irreversible)").action(() => {
     const decisions = readDecisions();
     const count = Object.keys(decisions).length;
     if (count === 0) {
-      console.log(import_chalk27.default.gray("  Nothing to clear \u2014 no persistent decisions stored."));
+      console.log(import_chalk26.default.gray("  Nothing to clear \u2014 no persistent decisions stored."));
       return;
     }
     writeDecisions({});
     console.log(
-      import_chalk27.default.green(`  \u2713 Cleared ${count} persistent decision${count === 1 ? "" : "s"}.`)
+      import_chalk26.default.green(`  \u2713 Cleared ${count} persistent decision${count === 1 ? "" : "s"}.`)
     );
   });
 }
 
 // src/cli/commands/dlp.ts
-var import_chalk28 = __toESM(require("chalk"));
+var import_chalk27 = __toESM(require("chalk"));
 var import_fs43 = __toESM(require("fs"));
 var import_path45 = __toESM(require("path"));
 var import_os39 = __toESM(require("os"));
@@ -21037,14 +21002,14 @@ function registerDlpCommand(program2) {
   cmd.command("resolve").description("Mark all current DLP findings as resolved").action(() => {
     const findings = loadDlpFindings();
     if (findings.length === 0) {
-      console.log(import_chalk28.default.green("\n  \u2705 No response-DLP findings to resolve.\n"));
+      console.log(import_chalk27.default.green("\n  \u2705 No response-DLP findings to resolve.\n"));
       return;
     }
     const resolved = loadResolved();
     for (const e of findings) resolved.add(entryKey(e));
     saveResolved(resolved);
     console.log(
-      import_chalk28.default.green(
+      import_chalk27.default.green(
         `
   \u2705 ${findings.length} finding${findings.length !== 1 ? "s" : ""} marked as resolved.
 `
@@ -21058,54 +21023,54 @@ function registerDlpCommand(program2) {
     const resolvedCount = findings.length - open.length;
     console.log("");
     console.log(
-      import_chalk28.default.bold.cyan("\u{1F510}  node9 dlp") + import_chalk28.default.dim("  \u2014 secrets found in Claude response text")
+      import_chalk27.default.bold.cyan("\u{1F510}  node9 dlp") + import_chalk27.default.dim("  \u2014 secrets found in Claude response text")
     );
     console.log("");
     if (open.length === 0) {
       if (resolvedCount > 0) {
-        console.log(import_chalk28.default.green(`  \u2705 No open findings  \xB7  ${resolvedCount} previously resolved`));
+        console.log(import_chalk27.default.green(`  \u2705 No open findings  \xB7  ${resolvedCount} previously resolved`));
       } else {
         console.log(
-          import_chalk28.default.green("  \u2705 No findings \u2014 Claude has not leaked secrets in response text")
+          import_chalk27.default.green("  \u2705 No findings \u2014 Claude has not leaked secrets in response text")
         );
       }
       console.log("");
       return;
     }
     console.log(
-      import_chalk28.default.bgRed.white.bold(` \u26A0\uFE0F  ${open.length} open finding${open.length !== 1 ? "s" : ""} `) + import_chalk28.default.dim(resolvedCount > 0 ? `  (${resolvedCount} resolved)` : "")
+      import_chalk27.default.bgRed.white.bold(` \u26A0\uFE0F  ${open.length} open finding${open.length !== 1 ? "s" : ""} `) + import_chalk27.default.dim(resolvedCount > 0 ? `  (${resolvedCount} resolved)` : "")
     );
     console.log("");
     console.log(
-      import_chalk28.default.dim("  These secrets were included in Claude's response text \u2014 NOT blocked.")
+      import_chalk27.default.dim("  These secrets were included in Claude's response text \u2014 NOT blocked.")
     );
-    console.log(import_chalk28.default.dim("  Rotate each affected key immediately.\n"));
+    console.log(import_chalk27.default.dim("  Rotate each affected key immediately.\n"));
     for (const e of open) {
       console.log(
-        "  " + import_chalk28.default.red("\u25CF") + "  " + import_chalk28.default.white(e.dlpPattern ?? "Secret") + import_chalk28.default.dim("  " + fmtDate3(e.ts))
+        "  " + import_chalk27.default.red("\u25CF") + "  " + import_chalk27.default.white(e.dlpPattern ?? "Secret") + import_chalk27.default.dim("  " + fmtDate3(e.ts))
       );
       if (e.dlpSample) {
-        console.log("     " + import_chalk28.default.dim("Sample: ") + import_chalk28.default.yellow(stripAnsi(e.dlpSample)));
+        console.log("     " + import_chalk27.default.dim("Sample: ") + import_chalk27.default.yellow(stripAnsi(e.dlpSample)));
       }
       if (e.project) {
-        console.log("     " + import_chalk28.default.dim("Project: ") + import_chalk28.default.dim(stripAnsi(e.project)));
+        console.log("     " + import_chalk27.default.dim("Project: ") + import_chalk27.default.dim(stripAnsi(e.project)));
       }
       console.log("");
     }
-    console.log("  " + import_chalk28.default.bold("Next steps:"));
-    console.log("  " + import_chalk28.default.cyan("1.") + " Rotate any exposed keys shown above");
+    console.log("  " + import_chalk27.default.bold("Next steps:"));
+    console.log("  " + import_chalk27.default.cyan("1.") + " Rotate any exposed keys shown above");
     console.log(
-      "  " + import_chalk28.default.cyan("2.") + " Run " + import_chalk28.default.white("node9 dlp resolve") + " to acknowledge"
+      "  " + import_chalk27.default.cyan("2.") + " Run " + import_chalk27.default.white("node9 dlp resolve") + " to acknowledge"
     );
     console.log(
-      "  " + import_chalk28.default.cyan("3.") + " Run " + import_chalk28.default.white("node9 report") + " for full audit history"
+      "  " + import_chalk27.default.cyan("3.") + " Run " + import_chalk27.default.white("node9 report") + " for full audit history"
     );
     console.log("");
   });
 }
 
 // src/cli/commands/mask.ts
-var import_chalk29 = __toESM(require("chalk"));
+var import_chalk28 = __toESM(require("chalk"));
 var import_fs44 = __toESM(require("fs"));
 var import_path46 = __toESM(require("path"));
 var import_os40 = __toESM(require("os"));
@@ -21242,12 +21207,12 @@ function registerMaskCommand(program2) {
       }
     }) : allFiles;
     if (filtered.length === 0) {
-      console.log(import_chalk29.default.yellow("  No session files found."));
+      console.log(import_chalk28.default.yellow("  No session files found."));
       return;
     }
     console.log("");
     if (dryRun) {
-      console.log(import_chalk29.default.dim("  Dry run \u2014 no files will be modified.\n"));
+      console.log(import_chalk28.default.dim("  Dry run \u2014 no files will be modified.\n"));
     }
     let totalFiles = 0;
     let totalLines = 0;
@@ -21263,23 +21228,23 @@ function registerMaskCommand(program2) {
         });
         const verb = dryRun ? "Would redact" : "Redacted";
         console.log(
-          "  " + import_chalk29.default.dim(shortPath.slice(0, 60).padEnd(62)) + import_chalk29.default.red(`${verb}: `) + import_chalk29.default.yellow(patterns.join(", ")) + import_chalk29.default.dim(` (${redactedLines} line${redactedLines !== 1 ? "s" : ""})`)
+          "  " + import_chalk28.default.dim(shortPath.slice(0, 60).padEnd(62)) + import_chalk28.default.red(`${verb}: `) + import_chalk28.default.yellow(patterns.join(", ")) + import_chalk28.default.dim(` (${redactedLines} line${redactedLines !== 1 ? "s" : ""})`)
         );
       }
     }
     console.log("");
     if (totalFiles === 0) {
-      console.log(import_chalk29.default.green("  No secrets found in session history."));
+      console.log(import_chalk28.default.green("  No secrets found in session history."));
     } else {
       const verb = dryRun ? "would be modified" : "modified";
       console.log(
-        import_chalk29.default.bold(`  ${totalFiles} file${totalFiles !== 1 ? "s" : ""} ${verb}`) + import_chalk29.default.dim(`, ${totalLines} line${totalLines !== 1 ? "s" : ""} redacted`)
+        import_chalk28.default.bold(`  ${totalFiles} file${totalFiles !== 1 ? "s" : ""} ${verb}`) + import_chalk28.default.dim(`, ${totalLines} line${totalLines !== 1 ? "s" : ""} redacted`)
       );
-      console.log("  Patterns: " + import_chalk29.default.yellow(totalPatterns.join(", ")));
+      console.log("  Patterns: " + import_chalk28.default.yellow(totalPatterns.join(", ")));
       if (!dryRun) {
         console.log("");
         console.log(
-          import_chalk29.default.dim(
+          import_chalk28.default.dim(
             "  Note: secrets were already sent to the AI provider during the active session.\n        This cleans your local disk only. Rotate any exposed keys."
           )
         );
@@ -21343,17 +21308,17 @@ program.command("login").argument("<apiKey>").option("--local", "Save key for au
     import_fs47.default.writeFileSync(configPath, JSON.stringify(config, null, 2), { mode: 384 });
   }
   if (options.profile && profileName !== "default") {
-    console.log(import_chalk31.default.green(`\u2705 Profile "${profileName}" saved`));
-    console.log(import_chalk31.default.gray(`   Switch to it per-session:  NODE9_PROFILE=${profileName} claude`));
+    console.log(import_chalk30.default.green(`\u2705 Profile "${profileName}" saved`));
+    console.log(import_chalk30.default.gray(`   Switch to it per-session:  NODE9_PROFILE=${profileName} claude`));
   } else if (options.local) {
-    console.log(import_chalk31.default.green(`\u2705 Privacy mode \u{1F6E1}\uFE0F`));
-    console.log(import_chalk31.default.gray(`   All decisions stay on this machine.`));
+    console.log(import_chalk30.default.green(`\u2705 Privacy mode \u{1F6E1}\uFE0F`));
+    console.log(import_chalk30.default.gray(`   All decisions stay on this machine.`));
   } else {
-    console.log(import_chalk31.default.green(`\u2705 Logged in \u2014 agent mode`));
-    console.log(import_chalk31.default.gray(`   Team policy enforced for all calls via Node9 cloud.`));
+    console.log(import_chalk30.default.green(`\u2705 Logged in \u2014 agent mode`));
+    console.log(import_chalk30.default.gray(`   Team policy enforced for all calls via Node9 cloud.`));
   }
 });
-program.command("addto").description("Integrate Node9 with an AI agent").addHelpText(
+program.command("addto", { hidden: true }).description("Integrate Node9 with an AI agent").addHelpText(
   "after",
   "\n  Supported targets:  claude  gemini  cursor  codex  windsurf  vscode  hud"
 ).argument(
@@ -21368,13 +21333,13 @@ program.command("addto").description("Integrate Node9 with an AI agent").addHelp
   if (target === "vscode") return await setupVSCode();
   if (target === "hud") return setupHud();
   console.error(
-    import_chalk31.default.red(
+    import_chalk30.default.red(
       `Unknown target: "${target}". Supported: claude, gemini, cursor, codex, windsurf, vscode, hud`
     )
   );
   process.exit(1);
 });
-program.command("setup").description('Alias for "addto" \u2014 integrate Node9 with an AI agent').addHelpText(
+program.command("setup", { hidden: true }).description('Alias for "addto" \u2014 integrate Node9 with an AI agent').addHelpText(
   "after",
   "\n  Supported targets:  claude  gemini  cursor  codex  windsurf  vscode  hud"
 ).argument(
@@ -21382,17 +21347,17 @@ program.command("setup").description('Alias for "addto" \u2014 integrate Node9 w
   "The agent to protect: claude | gemini | cursor | codex | windsurf | vscode | hud"
 ).action(async (target) => {
   if (!target) {
-    console.log(import_chalk31.default.cyan("\n\u{1F6E1}\uFE0F  Node9 Setup \u2014 integrate with your AI agent\n"));
-    console.log("  Usage:  " + import_chalk31.default.white("node9 setup <target>") + "\n");
+    console.log(import_chalk30.default.cyan("\n\u{1F6E1}\uFE0F  Node9 Setup \u2014 integrate with your AI agent\n"));
+    console.log("  Usage:  " + import_chalk30.default.white("node9 setup <target>") + "\n");
     console.log("  Targets:");
-    console.log("    " + import_chalk31.default.green("claude") + "    \u2014 Claude Code (hook mode)");
-    console.log("    " + import_chalk31.default.green("gemini") + "    \u2014 Gemini CLI (hook mode)");
-    console.log("    " + import_chalk31.default.green("cursor") + "    \u2014 Cursor (MCP proxy)");
-    console.log("    " + import_chalk31.default.green("codex") + "     \u2014 OpenAI Codex CLI (MCP proxy)");
-    console.log("    " + import_chalk31.default.green("windsurf") + "  \u2014 Windsurf (MCP proxy)");
-    console.log("    " + import_chalk31.default.green("vscode") + "    \u2014 VSCode / Copilot (MCP proxy)");
+    console.log("    " + import_chalk30.default.green("claude") + "    \u2014 Claude Code (hook mode)");
+    console.log("    " + import_chalk30.default.green("gemini") + "    \u2014 Gemini CLI (hook mode)");
+    console.log("    " + import_chalk30.default.green("cursor") + "    \u2014 Cursor (MCP proxy)");
+    console.log("    " + import_chalk30.default.green("codex") + "     \u2014 OpenAI Codex CLI (MCP proxy)");
+    console.log("    " + import_chalk30.default.green("windsurf") + "  \u2014 Windsurf (MCP proxy)");
+    console.log("    " + import_chalk30.default.green("vscode") + "    \u2014 VSCode / Copilot (MCP proxy)");
     process.stdout.write(
-      "    " + import_chalk31.default.green("hud") + "       \u2014 Claude Code security statusline\n"
+      "    " + import_chalk30.default.green("hud") + "       \u2014 Claude Code security statusline\n"
     );
     console.log("");
     return;
@@ -21406,13 +21371,13 @@ program.command("setup").description('Alias for "addto" \u2014 integrate Node9 w
   if (t === "vscode") return await setupVSCode();
   if (t === "hud") return setupHud();
   console.error(
-    import_chalk31.default.red(
+    import_chalk30.default.red(
       `Unknown target: "${target}". Supported: claude, gemini, cursor, codex, windsurf, vscode, hud`
     )
   );
   process.exit(1);
 });
-program.command("removefrom").description("Remove Node9 hooks from an AI agent configuration").addHelpText(
+program.command("removefrom", { hidden: true }).description("Remove Node9 hooks from an AI agent configuration").addHelpText(
   "after",
   "\n  Supported targets:  claude  gemini  cursor  codex  windsurf  vscode  hud"
 ).argument(
@@ -21429,33 +21394,33 @@ program.command("removefrom").description("Remove Node9 hooks from an AI agent c
   else if (target === "hud") fn = teardownHud;
   else {
     console.error(
-      import_chalk31.default.red(
+      import_chalk30.default.red(
         `Unknown target: "${target}". Supported: claude, gemini, cursor, codex, windsurf, vscode, hud`
       )
     );
     process.exit(1);
   }
-  console.log(import_chalk31.default.cyan(`
+  console.log(import_chalk30.default.cyan(`
 \u{1F6E1}\uFE0F  Node9: removing hooks from ${target}...
 `));
   try {
     fn();
   } catch (err2) {
-    console.error(import_chalk31.default.red(`  \u26A0\uFE0F  Failed: ${err2 instanceof Error ? err2.message : String(err2)}`));
+    console.error(import_chalk30.default.red(`  \u26A0\uFE0F  Failed: ${err2 instanceof Error ? err2.message : String(err2)}`));
     process.exit(1);
   }
-  console.log(import_chalk31.default.gray("\n  Restart the agent for changes to take effect."));
+  console.log(import_chalk30.default.gray("\n  Restart the agent for changes to take effect."));
 });
 program.command("uninstall").description("Remove all Node9 hooks and optionally delete config files").option("--purge", "Also delete ~/.node9/ directory (config, audit log, credentials)").action(async (options) => {
-  console.log(import_chalk31.default.cyan("\n\u{1F6E1}\uFE0F  Node9 Uninstall\n"));
-  console.log(import_chalk31.default.bold("Stopping daemon..."));
+  console.log(import_chalk30.default.cyan("\n\u{1F6E1}\uFE0F  Node9 Uninstall\n"));
+  console.log(import_chalk30.default.bold("Stopping daemon..."));
   try {
     stopDaemon();
-    console.log(import_chalk31.default.green("  \u2705 Daemon stopped"));
+    console.log(import_chalk30.default.green("  \u2705 Daemon stopped"));
   } catch {
-    console.log(import_chalk31.default.blue("  \u2139\uFE0F  Daemon was not running"));
+    console.log(import_chalk30.default.blue("  \u2139\uFE0F  Daemon was not running"));
   }
-  console.log(import_chalk31.default.bold("\nRemoving hooks..."));
+  console.log(import_chalk30.default.bold("\nRemoving hooks..."));
   let teardownFailed = false;
   for (const [label, fn] of [
     ["Claude", teardownClaude],
@@ -21470,7 +21435,7 @@ program.command("uninstall").description("Remove all Node9 hooks and optionally
     } catch (err2) {
       teardownFailed = true;
       console.error(
-        import_chalk31.default.red(
+        import_chalk30.default.red(
           `  \u26A0\uFE0F  Failed to remove ${label} hooks: ${err2 instanceof Error ? err2.message : String(err2)}`
         )
       );
@@ -21487,28 +21452,28 @@ program.command("uninstall").description("Remove all Node9 hooks and optionally
         import_fs47.default.rmSync(node9Dir, { recursive: true });
         if (import_fs47.default.existsSync(node9Dir)) {
           console.error(
-            import_chalk31.default.red("\n  \u26A0\uFE0F  ~/.node9/ could not be fully deleted \u2014 remove it manually.")
+            import_chalk30.default.red("\n  \u26A0\uFE0F  ~/.node9/ could not be fully deleted \u2014 remove it manually.")
           );
         } else {
-          console.log(import_chalk31.default.green("\n  \u2705 Deleted ~/.node9/ (config, audit log, credentials)"));
+          console.log(import_chalk30.default.green("\n  \u2705 Deleted ~/.node9/ (config, audit log, credentials)"));
         }
       } else {
-        console.log(import_chalk31.default.yellow("\n  Skipped \u2014 ~/.node9/ was not deleted."));
+        console.log(import_chalk30.default.yellow("\n  Skipped \u2014 ~/.node9/ was not deleted."));
       }
     } else {
-      console.log(import_chalk31.default.blue("\n  \u2139\uFE0F  ~/.node9/ not found \u2014 nothing to delete"));
+      console.log(import_chalk30.default.blue("\n  \u2139\uFE0F  ~/.node9/ not found \u2014 nothing to delete"));
     }
   } else {
     console.log(
-      import_chalk31.default.gray("\n  ~/.node9/ kept \u2014 run with --purge to delete config and audit log")
+      import_chalk30.default.gray("\n  ~/.node9/ kept \u2014 run with --purge to delete config and audit log")
     );
   }
   if (teardownFailed) {
-    console.error(import_chalk31.default.red("\n  \u26A0\uFE0F  Some hooks could not be removed \u2014 see errors above."));
+    console.error(import_chalk30.default.red("\n  \u26A0\uFE0F  Some hooks could not be removed \u2014 see errors above."));
     process.exit(1);
   }
-  console.log(import_chalk31.default.green.bold("\n\u{1F6E1}\uFE0F  Node9 removed. Run: npm uninstall -g @node9/proxy"));
-  console.log(import_chalk31.default.gray("   Restart any open AI agent sessions for changes to take effect.\n"));
+  console.log(import_chalk30.default.green.bold("\n\u{1F6E1}\uFE0F  Node9 removed. Run: npm uninstall -g @node9/proxy"));
+  console.log(import_chalk30.default.gray("   Restart any open AI agent sessions for changes to take effect.\n"));
 });
 registerDoctorCommand(program, version);
 program.command("explain").description(
@@ -21521,7 +21486,7 @@ program.command("explain").description(
       try {
         args = JSON.parse(trimmed);
       } catch {
-        console.error(import_chalk31.default.red(`
+        console.error(import_chalk30.default.red(`
 \u274C Invalid JSON: ${trimmed}
 `));
         process.exit(1);
@@ -21532,54 +21497,54 @@ program.command("explain").description(
   }
   const result = await explainPolicy(tool, args);
   console.log("");
-  console.log(import_chalk31.default.cyan.bold("\u{1F6E1}\uFE0F  Node9 Explain"));
+  console.log(import_chalk30.default.cyan.bold("\u{1F6E1}\uFE0F  Node9 Explain"));
   console.log("");
-  console.log(`   ${import_chalk31.default.bold("Tool:")}    ${import_chalk31.default.white(result.tool)}`);
+  console.log(`   ${import_chalk30.default.bold("Tool:")}    ${import_chalk30.default.white(result.tool)}`);
   if (argsRaw) {
     const preview2 = argsRaw.length > 80 ? argsRaw.slice(0, 77) + "\u2026" : argsRaw;
-    console.log(`   ${import_chalk31.default.bold("Input:")}   ${import_chalk31.default.gray(preview2)}`);
+    console.log(`   ${import_chalk30.default.bold("Input:")}   ${import_chalk30.default.gray(preview2)}`);
   }
   console.log("");
-  console.log(import_chalk31.default.bold("Config Sources (Waterfall):"));
+  console.log(import_chalk30.default.bold("Config Sources (Waterfall):"));
   for (const tier of result.waterfall) {
-    const num3 = import_chalk31.default.gray(`  ${tier.tier}.`);
+    const num3 = import_chalk30.default.gray(`  ${tier.tier}.`);
     const label = tier.label.padEnd(16);
     let statusStr;
     if (tier.tier === 1) {
-      statusStr = import_chalk31.default.gray(tier.note ?? "");
+      statusStr = import_chalk30.default.gray(tier.note ?? "");
     } else if (tier.status === "active") {
-      const loc = tier.path ? import_chalk31.default.gray(tier.path) : "";
-      const note = tier.note ? import_chalk31.default.gray(`(${tier.note})`) : "";
-      statusStr = import_chalk31.default.green("\u2713 active") + (loc ? "  " + loc : "") + (note ? "  " + note : "");
+      const loc = tier.path ? import_chalk30.default.gray(tier.path) : "";
+      const note = tier.note ? import_chalk30.default.gray(`(${tier.note})`) : "";
+      statusStr = import_chalk30.default.green("\u2713 active") + (loc ? "  " + loc : "") + (note ? "  " + note : "");
     } else {
-      statusStr = import_chalk31.default.gray("\u25CB " + (tier.note ?? "not found"));
+      statusStr = import_chalk30.default.gray("\u25CB " + (tier.note ?? "not found"));
     }
-    console.log(`${num3} ${import_chalk31.default.white(label)} ${statusStr}`);
+    console.log(`${num3} ${import_chalk30.default.white(label)} ${statusStr}`);
   }
   console.log("");
-  console.log(import_chalk31.default.bold("Policy Evaluation:"));
+  console.log(import_chalk30.default.bold("Policy Evaluation:"));
   for (const step of result.steps) {
     const isFinal = step.isFinal;
     let icon;
-    if (step.outcome === "allow") icon = import_chalk31.default.green("  \u2705");
-    else if (step.outcome === "review") icon = import_chalk31.default.red("  \u{1F534}");
-    else if (step.outcome === "skip") icon = import_chalk31.default.gray("  \u2500 ");
-    else icon = import_chalk31.default.gray("  \u25CB ");
+    if (step.outcome === "allow") icon = import_chalk30.default.green("  \u2705");
+    else if (step.outcome === "review") icon = import_chalk30.default.red("  \u{1F534}");
+    else if (step.outcome === "skip") icon = import_chalk30.default.gray("  \u2500 ");
+    else icon = import_chalk30.default.gray("  \u25CB ");
     const name = step.name.padEnd(18);
-    const nameStr = isFinal ? import_chalk31.default.white.bold(name) : import_chalk31.default.white(name);
-    const detail = isFinal ? import_chalk31.default.white(step.detail) : import_chalk31.default.gray(step.detail);
-    const arrow = isFinal ? import_chalk31.default.yellow("  \u2190 STOP") : "";
+    const nameStr = isFinal ? import_chalk30.default.white.bold(name) : import_chalk30.default.white(name);
+    const detail = isFinal ? import_chalk30.default.white(step.detail) : import_chalk30.default.gray(step.detail);
+    const arrow = isFinal ? import_chalk30.default.yellow("  \u2190 STOP") : "";
     console.log(`${icon} ${nameStr} ${detail}${arrow}`);
   }
   console.log("");
   if (result.decision === "allow") {
-    console.log(import_chalk31.default.green.bold("  Decision: \u2705 ALLOW") + import_chalk31.default.gray("  \u2014 no approval needed"));
+    console.log(import_chalk30.default.green.bold("  Decision: \u2705 ALLOW") + import_chalk30.default.gray("  \u2014 no approval needed"));
   } else {
     console.log(
-      import_chalk31.default.red.bold("  Decision: \u{1F534} REVIEW") + import_chalk31.default.gray("  \u2014 human approval required")
+      import_chalk30.default.red.bold("  Decision: \u{1F534} REVIEW") + import_chalk30.default.gray("  \u2014 human approval required")
     );
     if (result.blockedByLabel) {
-      console.log(import_chalk31.default.gray(`  Reason:   ${result.blockedByLabel}`));
+      console.log(import_chalk30.default.gray(`  Reason:   ${result.blockedByLabel}`));
     }
   }
   console.log("");
@@ -21594,7 +21559,7 @@ program.command("tail").description("Stream live agent activity to the terminal"
   try {
     await startTail2(options);
   } catch (err2) {
-    console.error(import_chalk31.default.red(`\u274C ${err2 instanceof Error ? err2.message : String(err2)}`));
+    console.error(import_chalk30.default.red(`\u274C ${err2 instanceof Error ? err2.message : String(err2)}`));
     process.exit(1);
   }
 });
@@ -21605,11 +21570,10 @@ program.command("monitor").description("Live interactive dashboard \u2014 activi
     const mod = await dynamicImport(`file://${dashboardPath}`);
     await mod.startMonitor();
   } catch (err2) {
-    console.error(import_chalk31.default.red(`\u274C ${err2 instanceof Error ? err2.message : String(err2)}`));
+    console.error(import_chalk30.default.red(`\u274C ${err2 instanceof Error ? err2.message : String(err2)}`));
     process.exit(1);
   }
 });
-registerWatchCommand(program);
 registerMcpGatewayCommand(program);
 registerMcpServerCommand(program);
 registerMcpPinCommand(program);
@@ -21617,7 +21581,7 @@ registerSkillPinCommand(program);
 registerDecisionsCommand(program);
 registerCheckCommand(program);
 registerLogCommand(program);
-program.command("hud").description("Render node9 security statusline (spawned by Claude Code statusLine)").addHelpText(
+program.command("hud", { hidden: true }).description("Render node9 security statusline (spawned by Claude Code statusLine)").addHelpText(
   "after",
   `
 Outputs up to 3 lines to stdout, then exits:
@@ -21661,7 +21625,7 @@ program.command("pause").description("Temporarily disable Node9 protection for a
   const ms = parseDuration(options.duration);
   if (ms === null) {
     console.error(
-      import_chalk31.default.red(`
+      import_chalk30.default.red(`
 \u274C  Invalid duration: "${options.duration}". Use format like 15m, 1h, 30s.
 `)
     );
@@ -21669,20 +21633,20 @@ program.command("pause").description("Temporarily disable Node9 protection for a
   }
   pauseNode9(ms, options.duration);
   const expiresAt = new Date(Date.now() + ms).toLocaleTimeString();
-  console.log(import_chalk31.default.yellow(`
+  console.log(import_chalk30.default.yellow(`
 \u23F8  Node9 paused until ${expiresAt}`));
-  console.log(import_chalk31.default.gray(`   All tool calls will be allowed without review.`));
-  console.log(import_chalk31.default.gray(`   Run "node9 resume" to re-enable early.
+  console.log(import_chalk30.default.gray(`   All tool calls will be allowed without review.`));
+  console.log(import_chalk30.default.gray(`   Run "node9 resume" to re-enable early.
 `));
 });
 program.command("resume").description("Re-enable Node9 protection immediately").action(() => {
   const { paused } = checkPause();
   if (!paused) {
-    console.log(import_chalk31.default.gray("\nNode9 is already active \u2014 nothing to resume.\n"));
+    console.log(import_chalk30.default.gray("\nNode9 is already active \u2014 nothing to resume.\n"));
     return;
   }
   resumeNode9();
-  console.log(import_chalk31.default.green("\n\u25B6  Node9 resumed \u2014 protection is active.\n"));
+  console.log(import_chalk30.default.green("\n\u25B6  Node9 resumed \u2014 protection is active.\n"));
 });
 var HOOK_BASED_AGENTS = {
   claude: "claude",
@@ -21695,15 +21659,15 @@ program.argument("[command...]", "The agent command to run (e.g., gemini)").acti
     if (HOOK_BASED_AGENTS[firstArg2] !== void 0) {
       const target = HOOK_BASED_AGENTS[firstArg2];
       console.error(
-        import_chalk31.default.yellow(`
+        import_chalk30.default.yellow(`
 \u26A0\uFE0F  Node9 proxy mode does not support "${target}" directly.`)
       );
-      console.error(import_chalk31.default.white(`
+      console.error(import_chalk30.default.white(`
    "${target}" uses its own hook system. Use:`));
       console.error(
-        import_chalk31.default.green(`     node9 addto ${target}   `) + import_chalk31.default.gray("# one-time setup")
+        import_chalk30.default.green(`     node9 addto ${target}   `) + import_chalk30.default.gray("# one-time setup")
       );
-      console.error(import_chalk31.default.green(`     ${target}              `) + import_chalk31.default.gray("# run normally"));
+      console.error(import_chalk30.default.green(`     ${target}              `) + import_chalk30.default.gray("# run normally"));
       process.exit(1);
     }
     const runArgs = firstArg2 === "shell" ? commandArgs.slice(1) : commandArgs;
@@ -21720,7 +21684,7 @@ program.argument("[command...]", "The agent command to run (e.g., gemini)").acti
       }
     );
     if (result.noApprovalMechanism && !isDaemonRunning() && !process.env.NODE9_NO_AUTO_DAEMON && getConfig().settings.autoStartDaemon) {
-      console.error(import_chalk31.default.cyan("\n\u{1F6E1}\uFE0F  Node9: Starting approval daemon automatically..."));
+      console.error(import_chalk30.default.cyan("\n\u{1F6E1}\uFE0F  Node9: Starting approval daemon automatically..."));
       const daemonReady = await autoStartDaemonAndWait();
       if (daemonReady) result = await authorizeHeadless("shell", { command: fullCommand });
     }
@@ -21733,12 +21697,12 @@ program.argument("[command...]", "The agent command to run (e.g., gemini)").acti
     }
     if (!result.approved) {
       console.error(
-        import_chalk31.default.red(`
+        import_chalk30.default.red(`
 \u274C Node9 Blocked: ${result.reason || "Dangerous command detected."}`)
       );
       process.exit(1);
     }
-    console.error(import_chalk31.default.green("\n\u2705 Approved \u2014 running command...\n"));
+    console.error(import_chalk30.default.green("\n\u2705 Approved \u2014 running command...\n"));
     await runProxy(fullCommand);
   } else {
     program.help();