@node9/proxy 1.27.0 → 1.28.0

package/README.md

@@ -10,7 +10,7 @@
 
 Node9 sits between your AI agent and the tools it can use — **discover** what it's already been doing, **protect** against risky actions in real time, and **review** what happened over any time window.
 
-Works with **Claude Code · Codex CLI · Gemini CLI · Cursor · Windsurf · any MCP server**.
+Works with **Claude Code · Codex CLI · Gemini CLI · Cursor · Windsurf · VSCode · Claude Desktop · Opencode · Pi · Hermes Agent · any MCP server**.
 
 ## What Node9 does
 
@@ -66,7 +66,7 @@ npm install -g node9-ai
 ```
 
 ```bash
-node9 init       # auto-wires Claude Code, Gemini CLI, Cursor, Codex, MCP servers
+node9 init       # auto-wires all detected agents + MCP servers
 node9 doctor     # verify everything is wired correctly
 ```
 
@@ -195,7 +195,7 @@ def run_command(cmd: str) -> str:
 ## Under the hood
 
 - **Scan** reads raw agent history from `~/.claude/projects/`, `~/.gemini/tmp/`, `~/.codex/sessions/` — no API calls, fully offline
-- **Runtime** wires PreToolUse hooks into Claude Code, Gemini CLI, and Codex — hooks write to `~/.node9/audit.log` atomically
+- **Runtime** intercepts tool calls via pre-execution hooks (Claude Code, Codex, Gemini CLI, Opencode, Pi) or via the MCP gateway (Cursor, Windsurf, VSCode, Claude Desktop). All decisions land in `~/.node9/audit.log` atomically.
 - **MCP gateway** is a stdio proxy; intercepts `tools/list` + `tools/call` JSON-RPC, forwards the rest
 - **Policy engine** uses [mvdan-sh](https://github.com/mvdan/sh) for bash AST analysis — defeats obfuscation via backslash escaping, variable substitution, eval of remote download
 - **Shadow repo** for auto-undo lives at `~/.node9/snapshots/<hash16>/` — never touches your `.git`

package/dist/cli.js

@@ -119,9 +119,11 @@ function appendLocalAudit(toolName, args, decision, checkedBy, meta, auditHashAr
   const argsField = auditHashArgsEnabled ? { argsHash: hashArgs(args) } : { args: args ? JSON.parse(redactSecrets(JSON.stringify(args))) : {} };
   const testRun = isTestCall(toolName, args) || process.env.NODE9_TESTING === "1" ? { testRun: true } : {};
   const ruleNameField = meta?.ruleName ? { ruleName: meta.ruleName } : {};
+  const agentToolNameField = meta?.agentToolName ? { agentToolName: meta.agentToolName } : {};
   appendToLog(LOCAL_AUDIT_LOG, {
     ts: (/* @__PURE__ */ new Date()).toISOString(),
     tool: toolName,
+    ...agentToolNameField,
     ...argsField,
     decision,
     checkedBy,
@@ -3945,7 +3947,14 @@ var init_config = __esm({
             "edit_file",
             "create_file",
             "edit",
-            "replace"
+            "replace",
+            // Claude / canonicalised Hermes — shouldSnapshot lowercases the
+            // incoming name before set-membership, so we list the lowercase
+            // forms of `Bash`/`Write`/`Edit`/`MultiEdit`. Without these,
+            // post-canonicalisation Hermes `patch` / `write_file` (which now
+            // arrive as `Edit` / `Write`) silently skipped snapshotting.
+            "write",
+            "multiedit"
           ],
           onlyPaths: [],
           ignorePaths: ["**/node_modules/**", "dist/**", "build/**", ".next/**", "**/*.log"]
@@ -7340,7 +7349,13 @@ function detectAgents(homeDir2 = import_os12.default.homedir()) {
     // dir lazily on first launch — same class of bug as opencode's #186
     // (design R6) — so fall back to PATH lookup for installed-but-never-
     // launched pi.
-    pi: exists(import_path15.default.join(homeDir2, ".pi", "agent")) || binaryInPath("pi")
+    pi: exists(import_path15.default.join(homeDir2, ".pi", "agent")) || binaryInPath("pi"),
+    // Hermes Agent (https://github.com/NousResearch/hermes-agent): home dir
+    // is $HERMES_HOME (default ~/.hermes) per hermes_constants.py:30. config.yaml
+    // appears after `hermes setup` has run; the directory alone exists from
+    // install time. PATH fallback covers the rare case where the user blew
+    // away ~/.hermes but kept the binary.
+    hermes: exists(hermesHomeDir(homeDir2)) || binaryInPath("hermes")
   };
 }
 async function setupCursor() {
@@ -8147,6 +8162,169 @@ function teardownPi() {
     console.log(import_chalk.default.yellow(`  \u26A0\uFE0F  Could not remove ${extensionPath}: ${String(err2)}`));
   }
 }
+function hermesHomeDir(homeDir2 = import_os12.default.homedir()) {
+  const env = process.env.HERMES_HOME?.trim();
+  if (env && import_path15.default.isAbsolute(env)) return env;
+  return import_path15.default.join(homeDir2, ".hermes");
+}
+function hermesConfigPath(homeDir2 = import_os12.default.homedir()) {
+  return import_path15.default.join(hermesHomeDir(homeDir2), HERMES_CONFIG_FILENAME);
+}
+function hermesAllowlistPath(homeDir2 = import_os12.default.homedir()) {
+  return import_path15.default.join(hermesHomeDir(homeDir2), HERMES_ALLOWLIST_FILENAME);
+}
+function setupHermes() {
+  const homeDir2 = import_os12.default.homedir();
+  const configPath = hermesConfigPath(homeDir2);
+  const allowlistPath = hermesAllowlistPath(homeDir2);
+  if (!import_fs13.default.existsSync(configPath)) {
+    console.log(import_chalk.default.yellow(`  \u26A0\uFE0F  Hermes config not found at ${configPath}`));
+    console.log(import_chalk.default.gray("     Run `hermes setup` first, then re-run node9 setup hermes."));
+    return;
+  }
+  let anythingChanged = false;
+  const raw = import_fs13.default.readFileSync(configPath, "utf-8");
+  const doc = yaml.parseDocument(raw);
+  if (doc.errors.length > 0) {
+    console.log(import_chalk.default.yellow(`  \u26A0\uFE0F  Hermes config.yaml has YAML parse errors:`));
+    for (const err2 of doc.errors.slice(0, 3)) {
+      console.log(import_chalk.default.gray(`     \u2022 ${err2.message}`));
+    }
+    console.log(
+      import_chalk.default.gray("     Fix the file (or run `hermes config edit`), then re-run node9 setup hermes.")
+    );
+    return;
+  }
+  const current = doc.toJS() ?? {};
+  for (const { event, subcmd } of HERMES_HOOK_PLAN) {
+    const command = fullPathCommand(subcmd);
+    const existing = current.hooks?.[event] ?? [];
+    const node9Idx = existing.findIndex(
+      (e) => typeof e?.command === "string" && isNode9Hook(e.command)
+    );
+    if (node9Idx === -1) {
+      const newEntries = [...existing, { command, timeout: 10 }];
+      doc.setIn(["hooks", event], newEntries);
+      console.log(import_chalk.default.green(`  \u2705 Hermes ${event} hook added \u2192 node9 ${subcmd}`));
+      anythingChanged = true;
+    } else if (existing[node9Idx].command !== command || isStaleHookCommand(existing[node9Idx].command ?? "")) {
+      const newEntries = [...existing];
+      newEntries[node9Idx] = { ...newEntries[node9Idx], command };
+      doc.setIn(["hooks", event], newEntries);
+      console.log(import_chalk.default.yellow(`  \u{1F527} Hermes ${event} hook repaired (stale path \u2192 current binary)`));
+      anythingChanged = true;
+    }
+  }
+  if (current.hooks_auto_accept !== true) {
+    doc.set("hooks_auto_accept", true);
+    console.log(import_chalk.default.green("  \u2705 hooks_auto_accept set to true"));
+    anythingChanged = true;
+  }
+  if (anythingChanged) {
+    import_fs13.default.writeFileSync(configPath, doc.toString());
+  }
+  let allowlist = {};
+  if (import_fs13.default.existsSync(allowlistPath)) {
+    try {
+      allowlist = JSON.parse(import_fs13.default.readFileSync(allowlistPath, "utf-8"));
+    } catch {
+      allowlist = {};
+    }
+  }
+  if (!Array.isArray(allowlist.approvals)) allowlist.approvals = [];
+  const nowIso = (/* @__PURE__ */ new Date()).toISOString();
+  let allowlistChanged = false;
+  for (const { event, subcmd } of HERMES_HOOK_PLAN) {
+    const command = fullPathCommand(subcmd);
+    const existingIdx = allowlist.approvals.findIndex(
+      (e) => e?.event === event && typeof e?.command === "string" && isNode9Hook(e.command)
+    );
+    if (existingIdx === -1) {
+      allowlist.approvals.push({ event, command, approved_at: nowIso });
+      allowlistChanged = true;
+    } else if (allowlist.approvals[existingIdx].command !== command) {
+      allowlist.approvals[existingIdx] = { event, command, approved_at: nowIso };
+      allowlistChanged = true;
+    }
+  }
+  if (allowlistChanged) {
+    import_fs13.default.mkdirSync(import_path15.default.dirname(allowlistPath), { recursive: true });
+    import_fs13.default.writeFileSync(allowlistPath, JSON.stringify(allowlist, null, 2) + "\n");
+    console.log(import_chalk.default.green("  \u2705 Hermes shell-hooks allowlist populated"));
+    anythingChanged = true;
+  }
+  if (anythingChanged) {
+    console.log(import_chalk.default.green.bold("\u{1F6E1}\uFE0F  Node9 is now protecting Hermes Agent!"));
+    console.log(import_chalk.default.gray("    Restart Hermes for changes to take effect."));
+    printDaemonTip();
+  } else {
+    console.log(import_chalk.default.blue("\u2139\uFE0F  Node9 is already fully configured for Hermes Agent."));
+    printDaemonTip();
+  }
+}
+function teardownHermes() {
+  const homeDir2 = import_os12.default.homedir();
+  const configPath = hermesConfigPath(homeDir2);
+  const allowlistPath = hermesAllowlistPath(homeDir2);
+  if (!import_fs13.default.existsSync(configPath)) {
+    console.log(import_chalk.default.blue(`  \u2139\uFE0F  ${configPath} not found \u2014 nothing to remove`));
+    return;
+  }
+  const raw = import_fs13.default.readFileSync(configPath, "utf-8");
+  const doc = yaml.parseDocument(raw);
+  if (doc.errors.length > 0) {
+    console.log(
+      import_chalk.default.yellow(`  \u26A0\uFE0F  Skipping ${configPath} \u2014 file has YAML parse errors, fix it manually.`)
+    );
+  } else {
+    teardownHermesConfigDoc(doc, configPath);
+  }
+  teardownHermesAllowlist(allowlistPath);
+}
+function teardownHermesConfigDoc(doc, configPath) {
+  let anythingChanged = false;
+  const current = doc.toJS() ?? {};
+  for (const { event } of HERMES_HOOK_PLAN) {
+    const existing = current.hooks?.[event] ?? [];
+    const filtered = existing.filter(
+      (e) => !(typeof e?.command === "string" && isNode9Hook(e.command))
+    );
+    if (filtered.length === existing.length) continue;
+    if (filtered.length === 0) {
+      doc.deleteIn(["hooks", event]);
+    } else {
+      doc.setIn(["hooks", event], filtered);
+    }
+    anythingChanged = true;
+  }
+  const afterHooks = doc.toJS()?.hooks;
+  if (afterHooks && typeof afterHooks === "object" && Object.keys(afterHooks).length === 0) {
+    doc.delete("hooks");
+    anythingChanged = true;
+  }
+  if (anythingChanged) {
+    import_fs13.default.writeFileSync(configPath, doc.toString());
+    console.log(import_chalk.default.green(`  \u2705 Removed Node9 hooks from ${configPath}`));
+  } else {
+    console.log(import_chalk.default.blue(`  \u2139\uFE0F  No Node9 hooks found in ${configPath}`));
+  }
+}
+function teardownHermesAllowlist(allowlistPath) {
+  if (!import_fs13.default.existsSync(allowlistPath)) return;
+  try {
+    const raw = import_fs13.default.readFileSync(allowlistPath, "utf-8");
+    const allowlist = JSON.parse(raw);
+    if (!Array.isArray(allowlist.approvals)) return;
+    const before = allowlist.approvals.length;
+    allowlist.approvals = allowlist.approvals.filter(
+      (e) => !(typeof e?.command === "string" && isNode9Hook(e.command))
+    );
+    if (allowlist.approvals.length === before) return;
+    import_fs13.default.writeFileSync(allowlistPath, JSON.stringify(allowlist, null, 2) + "\n");
+    console.log(import_chalk.default.green(`  \u2705 Removed Node9 entries from ${allowlistPath}`));
+  } catch {
+  }
+}
 function getAgentsStatus(homeDir2 = import_os12.default.homedir()) {
   const detected = detectAgents(homeDir2);
   const claudeWired = (() => {
@@ -8258,10 +8436,29 @@ function getAgentsStatus(homeDir2 = import_os12.default.homedir()) {
       // simple existence check on the canonical install location.
       wired: import_fs13.default.existsSync(import_path15.default.join(homeDir2, ".pi", "agent", "extensions", PI_EXTENSION_NAME)),
       mode: detected.pi ? "hooks" : null
+    },
+    {
+      name: "hermes",
+      label: "Hermes Agent",
+      installed: detected.hermes,
+      // Wired = node9 hook entry exists in the parsed config.yaml.
+      // Reading the YAML cheaply via yaml.parse — we don't need the
+      // Document API for a boolean status check.
+      wired: (() => {
+        try {
+          const raw = import_fs13.default.readFileSync(hermesConfigPath(homeDir2), "utf-8");
+          const cfg = yaml.parse(raw);
+          const pre = cfg?.hooks?.["pre_tool_call"] ?? [];
+          return pre.some((e) => typeof e?.command === "string" && isNode9Hook(e.command));
+        } catch {
+          return false;
+        }
+      })(),
+      mode: detected.hermes ? "hooks" : null
     }
   ];
 }
-var import_fs13, import_path15, import_os12, import_chalk, import_prompts, import_smol_toml, NODE9_MCP_SERVER_ENTRY, CODEX_PRE_TOOL_MATCHERS, OPENCODE_PLUGIN_NAME, PI_EXTENSION_NAME;
+var import_fs13, import_path15, import_os12, import_chalk, import_prompts, import_smol_toml, yaml, NODE9_MCP_SERVER_ENTRY, CODEX_PRE_TOOL_MATCHERS, OPENCODE_PLUGIN_NAME, PI_EXTENSION_NAME, HERMES_CONFIG_FILENAME, HERMES_ALLOWLIST_FILENAME, HERMES_HOOK_PLAN;
 var init_setup = __esm({
   "src/setup.ts"() {
     "use strict";
@@ -8271,6 +8468,7 @@ var init_setup = __esm({
     import_chalk = __toESM(require("chalk"));
     import_prompts = require("@inquirer/prompts");
     import_smol_toml = require("smol-toml");
+    yaml = __toESM(require("yaml"));
     init_mcp_pin();
     init_setup_opencode_shim();
     init_setup_pi_shim();
@@ -8278,6 +8476,12 @@ var init_setup = __esm({
     CODEX_PRE_TOOL_MATCHERS = ["^Bash$", "^apply_patch$", "^mcp__.*"];
     OPENCODE_PLUGIN_NAME = "node9.js";
     PI_EXTENSION_NAME = "node9.js";
+    HERMES_CONFIG_FILENAME = "config.yaml";
+    HERMES_ALLOWLIST_FILENAME = "shell-hooks-allowlist.json";
+    HERMES_HOOK_PLAN = [
+      { event: "pre_tool_call", subcmd: "check" },
+      { event: "post_tool_call", subcmd: "log" }
+    ];
   }
 });
 
@@ -16575,6 +16779,33 @@ function resolveUserSkillRoot(entry, cwd) {
 // src/cli/commands/check.ts
 init_dlp();
 init_audit();
+
+// src/utils/hook-payload.ts
+function extractToolName(payload, defaultValue = "") {
+  return payload.tool_name ?? payload.name ?? defaultValue;
+}
+function extractToolInput(payload) {
+  return payload.tool_input ?? payload.args ?? {};
+}
+function canonicalToolName(name) {
+  switch (name) {
+    // Hermes Agent
+    case "terminal":
+      return "Bash";
+    case "write_file":
+      return "Write";
+    case "patch":
+      return "Edit";
+    case "read_file":
+      return "Read";
+    case "search_files":
+      return "Grep";
+    default:
+      return name;
+  }
+}
+
+// src/cli/commands/check.ts
 function sanitize2(value) {
   return value.replace(/[\x00-\x1F\x7F]/g, "");
 }
@@ -16593,9 +16824,15 @@ function detectAiAgent(payload) {
   if (payload.hook_event_name === "BeforeTool" || payload.hook_event_name === "AfterTool" || payload.timestamp !== void 0) {
     return "Gemini CLI";
   }
+  if (payload.hook_event_name === "pre_tool_call" || payload.hook_event_name === "post_tool_call") {
+    return "Hermes";
+  }
   if (process.env.CLAUDECODE === "1" || process.env.CLAUDE_CODE_SESSION_ID) {
     return "Claude Code";
   }
+  if (process.env.HERMES_SESSION_ID || process.env.HERMES_HOME || process.env.HERMES_INTERACTIVE) {
+    return "Hermes";
+  }
   if (process.env.GEMINI_CLI_VERSION || process.env.GEMINI_API_KEY) {
     return "Gemini CLI";
   }
@@ -16742,8 +16979,8 @@ RAW: ${raw}
           import_fs32.default.appendFileSync(logPath, `[${(/* @__PURE__ */ new Date()).toISOString()}] STDIN: ${raw}
 `);
         }
-        const toolName = sanitize2(payload.tool_name ?? payload.name ?? "");
-        const toolInput = payload.tool_input ?? payload.args ?? {};
+        const toolName = canonicalToolName(sanitize2(extractToolName(payload)));
+        const toolInput = extractToolInput(payload);
         const agent = detectAiAgent(payload);
         const mcpMatch = toolName.match(/^mcp__([^_](?:[^_]|_(?!_))*?)__/i);
         const mcpServer = mcpMatch?.[1];
@@ -17075,8 +17312,9 @@ function registerLogCommand(program2) {
       try {
         if (!raw || raw.trim() === "") process.exit(0);
         const payload = JSON.parse(raw);
-        const tool = sanitize3(payload.tool_name ?? payload.name ?? "unknown");
-        const rawInput = payload.tool_input ?? payload.args ?? {};
+        const rawToolName = sanitize3(extractToolName(payload, "unknown"));
+        const tool = canonicalToolName(rawToolName);
+        const rawInput = extractToolInput(payload);
         const metaTag = (() => {
           const m = payload.meta;
           if (m && typeof m === "object") {
@@ -17085,7 +17323,7 @@ function registerLogCommand(program2) {
           }
           return void 0;
         })();
-        const agent = metaTag !== void 0 ? metaTag : payload.turn_id !== void 0 ? "Codex" : payload.hook_event_name === "PreToolUse" || payload.hook_event_name === "PostToolUse" || payload.tool_use_id !== void 0 || payload.permission_mode !== void 0 ? "Claude Code" : payload.hook_event_name === "BeforeTool" || payload.hook_event_name === "AfterTool" || payload.timestamp !== void 0 ? "Gemini CLI" : void 0;
+        const agent = metaTag !== void 0 ? metaTag : payload.turn_id !== void 0 ? "Codex" : payload.hook_event_name === "pre_tool_call" || payload.hook_event_name === "post_tool_call" ? "Hermes" : payload.hook_event_name === "PreToolUse" || payload.hook_event_name === "PostToolUse" || payload.tool_use_id !== void 0 || payload.permission_mode !== void 0 ? "Claude Code" : payload.hook_event_name === "BeforeTool" || payload.hook_event_name === "AfterTool" || payload.timestamp !== void 0 ? "Gemini CLI" : process.env.HERMES_SESSION_ID || process.env.HERMES_HOME || process.env.HERMES_INTERACTIVE ? "Hermes" : void 0;
         const entry = {
           ts: (/* @__PURE__ */ new Date()).toISOString(),
           tool,
@@ -17094,6 +17332,7 @@ function registerLogCommand(program2) {
           source: "post-hook"
         };
         if (agent) entry.agent = agent;
+        if (rawToolName !== tool) entry.agentToolName = rawToolName;
         if (payload.session_id) entry.sessionId = payload.session_id;
         const logPath = import_path34.default.join(import_os29.default.homedir(), ".node9", "audit.log");
         if (!import_fs33.default.existsSync(import_path34.default.dirname(logPath)))
@@ -19219,11 +19458,13 @@ function registerInitCommand(program2) {
       if (found.length === 0) {
         console.log(
           import_chalk16.default.gray(
-            "No AI agents detected. Install Claude Code, Gemini CLI, Cursor, Windsurf, VSCode, or Codex"
+            "No AI agents detected. Install one of the supported agents (Claude Code, Codex, Gemini CLI, Cursor, Windsurf, VSCode, Claude Desktop, Opencode, Pi, or Hermes Agent)."
           )
         );
         console.log(
-          import_chalk16.default.gray("then run: node9 agents add <claude|gemini|cursor|windsurf|vscode|codex>")
+          import_chalk16.default.gray(
+            "then run: node9 agents add <claude|codex|gemini|cursor|windsurf|vscode|claudeDesktop|opencode|pi|hermes>"
+          )
         );
         return;
       }
@@ -19243,6 +19484,7 @@ function registerInitCommand(program2) {
         else if (agent === "claudeDesktop") await setupClaudeDesktop();
         else if (agent === "opencode") await setupOpencode();
         else if (agent === "pi") await setupPi();
+        else if (agent === "hermes") setupHermes();
         console.log("");
       }
       if ((process.platform === "darwin" || process.platform === "linux") && process.stdout.isTTY) {
@@ -21004,7 +21246,8 @@ var SETUP_FN = {
   vscode: setupVSCode,
   claudeDesktop: setupClaudeDesktop,
   opencode: setupOpencode,
-  pi: setupPi
+  pi: setupPi,
+  hermes: setupHermes
 };
 var TEARDOWN_FN = {
   claude: teardownClaude,
@@ -21015,7 +21258,8 @@ var TEARDOWN_FN = {
   vscode: teardownVSCode,
   claudeDesktop: teardownClaudeDesktop,
   opencode: teardownOpencode,
-  pi: teardownPi
+  pi: teardownPi,
+  hermes: teardownHermes
 };
 var AGENT_NAMES = Object.keys(SETUP_FN);
 function registerAgentsCommand(program2) {
@@ -22353,10 +22597,11 @@ program.command("addto", { hidden: true }).description("Integrate Node9 with an
   if (target === "codex") return await setupCodex();
   if (target === "windsurf") return await setupWindsurf();
   if (target === "vscode") return await setupVSCode();
+  if (target === "hermes") return setupHermes();
   if (target === "hud") return setupHud();
   console.error(
     import_chalk30.default.red(
-      `Unknown target: "${target}". Supported: claude, gemini, cursor, codex, windsurf, vscode, hud`
+      `Unknown target: "${target}". Supported: claude, gemini, cursor, codex, windsurf, vscode, hermes, hud`
     )
   );
   process.exit(1);
@@ -22378,6 +22623,7 @@ program.command("setup", { hidden: true }).description('Alias for "addto" \u2014
     console.log("    " + import_chalk30.default.green("codex") + "     \u2014 OpenAI Codex CLI (MCP proxy)");
     console.log("    " + import_chalk30.default.green("windsurf") + "  \u2014 Windsurf (MCP proxy)");
     console.log("    " + import_chalk30.default.green("vscode") + "    \u2014 VSCode / Copilot (MCP proxy)");
+    console.log("    " + import_chalk30.default.green("hermes") + "    \u2014 Hermes Agent (hook mode)");
     process.stdout.write(
       "    " + import_chalk30.default.green("hud") + "       \u2014 Claude Code security statusline\n"
     );
@@ -22391,10 +22637,11 @@ program.command("setup", { hidden: true }).description('Alias for "addto" \u2014
   if (t === "codex") return await setupCodex();
   if (t === "windsurf") return await setupWindsurf();
   if (t === "vscode") return await setupVSCode();
+  if (t === "hermes") return setupHermes();
   if (t === "hud") return setupHud();
   console.error(
     import_chalk30.default.red(
-      `Unknown target: "${target}". Supported: claude, gemini, cursor, codex, windsurf, vscode, hud`
+      `Unknown target: "${target}". Supported: claude, gemini, cursor, codex, windsurf, vscode, hermes, hud`
     )
   );
   process.exit(1);
@@ -22413,11 +22660,12 @@ program.command("removefrom", { hidden: true }).description("Remove Node9 hooks
   else if (target === "codex") fn = teardownCodex;
   else if (target === "windsurf") fn = teardownWindsurf;
   else if (target === "vscode") fn = teardownVSCode;
+  else if (target === "hermes") fn = teardownHermes;
   else if (target === "hud") fn = teardownHud;
   else {
     console.error(
       import_chalk30.default.red(
-        `Unknown target: "${target}". Supported: claude, gemini, cursor, codex, windsurf, vscode, hud`
+        `Unknown target: "${target}". Supported: claude, gemini, cursor, codex, windsurf, vscode, hermes, hud`
       )
     );
     process.exit(1);
@@ -22450,7 +22698,8 @@ program.command("uninstall").description("Remove all Node9 hooks and optionally
     ["Cursor", teardownCursor],
     ["Codex", teardownCodex],
     ["Windsurf", teardownWindsurf],
-    ["VSCode", teardownVSCode]
+    ["VSCode", teardownVSCode],
+    ["Hermes", teardownHermes]
   ]) {
     try {
       fn();

package/dist/cli.mjs

@@ -100,9 +100,11 @@ function appendLocalAudit(toolName, args, decision, checkedBy, meta, auditHashAr
   const argsField = auditHashArgsEnabled ? { argsHash: hashArgs(args) } : { args: args ? JSON.parse(redactSecrets(JSON.stringify(args))) : {} };
   const testRun = isTestCall(toolName, args) || process.env.NODE9_TESTING === "1" ? { testRun: true } : {};
   const ruleNameField = meta?.ruleName ? { ruleName: meta.ruleName } : {};
+  const agentToolNameField = meta?.agentToolName ? { agentToolName: meta.agentToolName } : {};
   appendToLog(LOCAL_AUDIT_LOG, {
     ts: (/* @__PURE__ */ new Date()).toISOString(),
     tool: toolName,
+    ...agentToolNameField,
     ...argsField,
     decision,
     checkedBy,
@@ -3923,7 +3925,14 @@ var init_config = __esm({
             "edit_file",
             "create_file",
             "edit",
-            "replace"
+            "replace",
+            // Claude / canonicalised Hermes — shouldSnapshot lowercases the
+            // incoming name before set-membership, so we list the lowercase
+            // forms of `Bash`/`Write`/`Edit`/`MultiEdit`. Without these,
+            // post-canonicalisation Hermes `patch` / `write_file` (which now
+            // arrive as `Edit` / `Write`) silently skipped snapshotting.
+            "write",
+            "multiedit"
           ],
           onlyPaths: [],
           ignorePaths: ["**/node_modules/**", "dist/**", "build/**", ".next/**", "**/*.log"]
@@ -6823,6 +6832,7 @@ import os12 from "os";
 import chalk from "chalk";
 import { confirm } from "@inquirer/prompts";
 import { parse as parseToml, stringify as stringifyToml } from "smol-toml";
+import * as yaml from "yaml";
 function hasNode9McpServer(servers) {
   const entry = servers["node9"];
   return !!entry && entry.command === "node9" && Array.isArray(entry.args) && entry.args[0] === "mcp-server";
@@ -7321,7 +7331,13 @@ function detectAgents(homeDir2 = os12.homedir()) {
     // dir lazily on first launch — same class of bug as opencode's #186
     // (design R6) — so fall back to PATH lookup for installed-but-never-
     // launched pi.
-    pi: exists(path15.join(homeDir2, ".pi", "agent")) || binaryInPath("pi")
+    pi: exists(path15.join(homeDir2, ".pi", "agent")) || binaryInPath("pi"),
+    // Hermes Agent (https://github.com/NousResearch/hermes-agent): home dir
+    // is $HERMES_HOME (default ~/.hermes) per hermes_constants.py:30. config.yaml
+    // appears after `hermes setup` has run; the directory alone exists from
+    // install time. PATH fallback covers the rare case where the user blew
+    // away ~/.hermes but kept the binary.
+    hermes: exists(hermesHomeDir(homeDir2)) || binaryInPath("hermes")
   };
 }
 async function setupCursor() {
@@ -8128,6 +8144,169 @@ function teardownPi() {
     console.log(chalk.yellow(`  \u26A0\uFE0F  Could not remove ${extensionPath}: ${String(err2)}`));
   }
 }
+function hermesHomeDir(homeDir2 = os12.homedir()) {
+  const env = process.env.HERMES_HOME?.trim();
+  if (env && path15.isAbsolute(env)) return env;
+  return path15.join(homeDir2, ".hermes");
+}
+function hermesConfigPath(homeDir2 = os12.homedir()) {
+  return path15.join(hermesHomeDir(homeDir2), HERMES_CONFIG_FILENAME);
+}
+function hermesAllowlistPath(homeDir2 = os12.homedir()) {
+  return path15.join(hermesHomeDir(homeDir2), HERMES_ALLOWLIST_FILENAME);
+}
+function setupHermes() {
+  const homeDir2 = os12.homedir();
+  const configPath = hermesConfigPath(homeDir2);
+  const allowlistPath = hermesAllowlistPath(homeDir2);
+  if (!fs13.existsSync(configPath)) {
+    console.log(chalk.yellow(`  \u26A0\uFE0F  Hermes config not found at ${configPath}`));
+    console.log(chalk.gray("     Run `hermes setup` first, then re-run node9 setup hermes."));
+    return;
+  }
+  let anythingChanged = false;
+  const raw = fs13.readFileSync(configPath, "utf-8");
+  const doc = yaml.parseDocument(raw);
+  if (doc.errors.length > 0) {
+    console.log(chalk.yellow(`  \u26A0\uFE0F  Hermes config.yaml has YAML parse errors:`));
+    for (const err2 of doc.errors.slice(0, 3)) {
+      console.log(chalk.gray(`     \u2022 ${err2.message}`));
+    }
+    console.log(
+      chalk.gray("     Fix the file (or run `hermes config edit`), then re-run node9 setup hermes.")
+    );
+    return;
+  }
+  const current = doc.toJS() ?? {};
+  for (const { event, subcmd } of HERMES_HOOK_PLAN) {
+    const command = fullPathCommand(subcmd);
+    const existing = current.hooks?.[event] ?? [];
+    const node9Idx = existing.findIndex(
+      (e) => typeof e?.command === "string" && isNode9Hook(e.command)
+    );
+    if (node9Idx === -1) {
+      const newEntries = [...existing, { command, timeout: 10 }];
+      doc.setIn(["hooks", event], newEntries);
+      console.log(chalk.green(`  \u2705 Hermes ${event} hook added \u2192 node9 ${subcmd}`));
+      anythingChanged = true;
+    } else if (existing[node9Idx].command !== command || isStaleHookCommand(existing[node9Idx].command ?? "")) {
+      const newEntries = [...existing];
+      newEntries[node9Idx] = { ...newEntries[node9Idx], command };
+      doc.setIn(["hooks", event], newEntries);
+      console.log(chalk.yellow(`  \u{1F527} Hermes ${event} hook repaired (stale path \u2192 current binary)`));
+      anythingChanged = true;
+    }
+  }
+  if (current.hooks_auto_accept !== true) {
+    doc.set("hooks_auto_accept", true);
+    console.log(chalk.green("  \u2705 hooks_auto_accept set to true"));
+    anythingChanged = true;
+  }
+  if (anythingChanged) {
+    fs13.writeFileSync(configPath, doc.toString());
+  }
+  let allowlist = {};
+  if (fs13.existsSync(allowlistPath)) {
+    try {
+      allowlist = JSON.parse(fs13.readFileSync(allowlistPath, "utf-8"));
+    } catch {
+      allowlist = {};
+    }
+  }
+  if (!Array.isArray(allowlist.approvals)) allowlist.approvals = [];
+  const nowIso = (/* @__PURE__ */ new Date()).toISOString();
+  let allowlistChanged = false;
+  for (const { event, subcmd } of HERMES_HOOK_PLAN) {
+    const command = fullPathCommand(subcmd);
+    const existingIdx = allowlist.approvals.findIndex(
+      (e) => e?.event === event && typeof e?.command === "string" && isNode9Hook(e.command)
+    );
+    if (existingIdx === -1) {
+      allowlist.approvals.push({ event, command, approved_at: nowIso });
+      allowlistChanged = true;
+    } else if (allowlist.approvals[existingIdx].command !== command) {
+      allowlist.approvals[existingIdx] = { event, command, approved_at: nowIso };
+      allowlistChanged = true;
+    }
+  }
+  if (allowlistChanged) {
+    fs13.mkdirSync(path15.dirname(allowlistPath), { recursive: true });
+    fs13.writeFileSync(allowlistPath, JSON.stringify(allowlist, null, 2) + "\n");
+    console.log(chalk.green("  \u2705 Hermes shell-hooks allowlist populated"));
+    anythingChanged = true;
+  }
+  if (anythingChanged) {
+    console.log(chalk.green.bold("\u{1F6E1}\uFE0F  Node9 is now protecting Hermes Agent!"));
+    console.log(chalk.gray("    Restart Hermes for changes to take effect."));
+    printDaemonTip();
+  } else {
+    console.log(chalk.blue("\u2139\uFE0F  Node9 is already fully configured for Hermes Agent."));
+    printDaemonTip();
+  }
+}
+function teardownHermes() {
+  const homeDir2 = os12.homedir();
+  const configPath = hermesConfigPath(homeDir2);
+  const allowlistPath = hermesAllowlistPath(homeDir2);
+  if (!fs13.existsSync(configPath)) {
+    console.log(chalk.blue(`  \u2139\uFE0F  ${configPath} not found \u2014 nothing to remove`));
+    return;
+  }
+  const raw = fs13.readFileSync(configPath, "utf-8");
+  const doc = yaml.parseDocument(raw);
+  if (doc.errors.length > 0) {
+    console.log(
+      chalk.yellow(`  \u26A0\uFE0F  Skipping ${configPath} \u2014 file has YAML parse errors, fix it manually.`)
+    );
+  } else {
+    teardownHermesConfigDoc(doc, configPath);
+  }
+  teardownHermesAllowlist(allowlistPath);
+}
+function teardownHermesConfigDoc(doc, configPath) {
+  let anythingChanged = false;
+  const current = doc.toJS() ?? {};
+  for (const { event } of HERMES_HOOK_PLAN) {
+    const existing = current.hooks?.[event] ?? [];
+    const filtered = existing.filter(
+      (e) => !(typeof e?.command === "string" && isNode9Hook(e.command))
+    );
+    if (filtered.length === existing.length) continue;
+    if (filtered.length === 0) {
+      doc.deleteIn(["hooks", event]);
+    } else {
+      doc.setIn(["hooks", event], filtered);
+    }
+    anythingChanged = true;
+  }
+  const afterHooks = doc.toJS()?.hooks;
+  if (afterHooks && typeof afterHooks === "object" && Object.keys(afterHooks).length === 0) {
+    doc.delete("hooks");
+    anythingChanged = true;
+  }
+  if (anythingChanged) {
+    fs13.writeFileSync(configPath, doc.toString());
+    console.log(chalk.green(`  \u2705 Removed Node9 hooks from ${configPath}`));
+  } else {
+    console.log(chalk.blue(`  \u2139\uFE0F  No Node9 hooks found in ${configPath}`));
+  }
+}
+function teardownHermesAllowlist(allowlistPath) {
+  if (!fs13.existsSync(allowlistPath)) return;
+  try {
+    const raw = fs13.readFileSync(allowlistPath, "utf-8");
+    const allowlist = JSON.parse(raw);
+    if (!Array.isArray(allowlist.approvals)) return;
+    const before = allowlist.approvals.length;
+    allowlist.approvals = allowlist.approvals.filter(
+      (e) => !(typeof e?.command === "string" && isNode9Hook(e.command))
+    );
+    if (allowlist.approvals.length === before) return;
+    fs13.writeFileSync(allowlistPath, JSON.stringify(allowlist, null, 2) + "\n");
+    console.log(chalk.green(`  \u2705 Removed Node9 entries from ${allowlistPath}`));
+  } catch {
+  }
+}
 function getAgentsStatus(homeDir2 = os12.homedir()) {
   const detected = detectAgents(homeDir2);
   const claudeWired = (() => {
@@ -8239,10 +8418,29 @@ function getAgentsStatus(homeDir2 = os12.homedir()) {
       // simple existence check on the canonical install location.
       wired: fs13.existsSync(path15.join(homeDir2, ".pi", "agent", "extensions", PI_EXTENSION_NAME)),
       mode: detected.pi ? "hooks" : null
+    },
+    {
+      name: "hermes",
+      label: "Hermes Agent",
+      installed: detected.hermes,
+      // Wired = node9 hook entry exists in the parsed config.yaml.
+      // Reading the YAML cheaply via yaml.parse — we don't need the
+      // Document API for a boolean status check.
+      wired: (() => {
+        try {
+          const raw = fs13.readFileSync(hermesConfigPath(homeDir2), "utf-8");
+          const cfg = yaml.parse(raw);
+          const pre = cfg?.hooks?.["pre_tool_call"] ?? [];
+          return pre.some((e) => typeof e?.command === "string" && isNode9Hook(e.command));
+        } catch {
+          return false;
+        }
+      })(),
+      mode: detected.hermes ? "hooks" : null
     }
   ];
 }
-var NODE9_MCP_SERVER_ENTRY, CODEX_PRE_TOOL_MATCHERS, OPENCODE_PLUGIN_NAME, PI_EXTENSION_NAME;
+var NODE9_MCP_SERVER_ENTRY, CODEX_PRE_TOOL_MATCHERS, OPENCODE_PLUGIN_NAME, PI_EXTENSION_NAME, HERMES_CONFIG_FILENAME, HERMES_ALLOWLIST_FILENAME, HERMES_HOOK_PLAN;
 var init_setup = __esm({
   "src/setup.ts"() {
     "use strict";
@@ -8253,6 +8451,12 @@ var init_setup = __esm({
     CODEX_PRE_TOOL_MATCHERS = ["^Bash$", "^apply_patch$", "^mcp__.*"];
     OPENCODE_PLUGIN_NAME = "node9.js";
     PI_EXTENSION_NAME = "node9.js";
+    HERMES_CONFIG_FILENAME = "config.yaml";
+    HERMES_ALLOWLIST_FILENAME = "shell-hooks-allowlist.json";
+    HERMES_HOOK_PLAN = [
+      { event: "pre_tool_call", subcmd: "check" },
+      { event: "post_tool_call", subcmd: "log" }
+    ];
   }
 });
 
@@ -16547,6 +16751,33 @@ function resolveUserSkillRoot(entry, cwd) {
 // src/cli/commands/check.ts
 init_dlp();
 init_audit();
+
+// src/utils/hook-payload.ts
+function extractToolName(payload, defaultValue = "") {
+  return payload.tool_name ?? payload.name ?? defaultValue;
+}
+function extractToolInput(payload) {
+  return payload.tool_input ?? payload.args ?? {};
+}
+function canonicalToolName(name) {
+  switch (name) {
+    // Hermes Agent
+    case "terminal":
+      return "Bash";
+    case "write_file":
+      return "Write";
+    case "patch":
+      return "Edit";
+    case "read_file":
+      return "Read";
+    case "search_files":
+      return "Grep";
+    default:
+      return name;
+  }
+}
+
+// src/cli/commands/check.ts
 function sanitize2(value) {
   return value.replace(/[\x00-\x1F\x7F]/g, "");
 }
@@ -16565,9 +16796,15 @@ function detectAiAgent(payload) {
   if (payload.hook_event_name === "BeforeTool" || payload.hook_event_name === "AfterTool" || payload.timestamp !== void 0) {
     return "Gemini CLI";
   }
+  if (payload.hook_event_name === "pre_tool_call" || payload.hook_event_name === "post_tool_call") {
+    return "Hermes";
+  }
   if (process.env.CLAUDECODE === "1" || process.env.CLAUDE_CODE_SESSION_ID) {
     return "Claude Code";
   }
+  if (process.env.HERMES_SESSION_ID || process.env.HERMES_HOME || process.env.HERMES_INTERACTIVE) {
+    return "Hermes";
+  }
   if (process.env.GEMINI_CLI_VERSION || process.env.GEMINI_API_KEY) {
     return "Gemini CLI";
   }
@@ -16714,8 +16951,8 @@ RAW: ${raw}
           fs32.appendFileSync(logPath, `[${(/* @__PURE__ */ new Date()).toISOString()}] STDIN: ${raw}
 `);
         }
-        const toolName = sanitize2(payload.tool_name ?? payload.name ?? "");
-        const toolInput = payload.tool_input ?? payload.args ?? {};
+        const toolName = canonicalToolName(sanitize2(extractToolName(payload)));
+        const toolInput = extractToolInput(payload);
         const agent = detectAiAgent(payload);
         const mcpMatch = toolName.match(/^mcp__([^_](?:[^_]|_(?!_))*?)__/i);
         const mcpServer = mcpMatch?.[1];
@@ -17047,8 +17284,9 @@ function registerLogCommand(program2) {
       try {
         if (!raw || raw.trim() === "") process.exit(0);
         const payload = JSON.parse(raw);
-        const tool = sanitize3(payload.tool_name ?? payload.name ?? "unknown");
-        const rawInput = payload.tool_input ?? payload.args ?? {};
+        const rawToolName = sanitize3(extractToolName(payload, "unknown"));
+        const tool = canonicalToolName(rawToolName);
+        const rawInput = extractToolInput(payload);
         const metaTag = (() => {
           const m = payload.meta;
           if (m && typeof m === "object") {
@@ -17057,7 +17295,7 @@ function registerLogCommand(program2) {
           }
           return void 0;
         })();
-        const agent = metaTag !== void 0 ? metaTag : payload.turn_id !== void 0 ? "Codex" : payload.hook_event_name === "PreToolUse" || payload.hook_event_name === "PostToolUse" || payload.tool_use_id !== void 0 || payload.permission_mode !== void 0 ? "Claude Code" : payload.hook_event_name === "BeforeTool" || payload.hook_event_name === "AfterTool" || payload.timestamp !== void 0 ? "Gemini CLI" : void 0;
+        const agent = metaTag !== void 0 ? metaTag : payload.turn_id !== void 0 ? "Codex" : payload.hook_event_name === "pre_tool_call" || payload.hook_event_name === "post_tool_call" ? "Hermes" : payload.hook_event_name === "PreToolUse" || payload.hook_event_name === "PostToolUse" || payload.tool_use_id !== void 0 || payload.permission_mode !== void 0 ? "Claude Code" : payload.hook_event_name === "BeforeTool" || payload.hook_event_name === "AfterTool" || payload.timestamp !== void 0 ? "Gemini CLI" : process.env.HERMES_SESSION_ID || process.env.HERMES_HOME || process.env.HERMES_INTERACTIVE ? "Hermes" : void 0;
         const entry = {
           ts: (/* @__PURE__ */ new Date()).toISOString(),
           tool,
@@ -17066,6 +17304,7 @@ function registerLogCommand(program2) {
           source: "post-hook"
         };
         if (agent) entry.agent = agent;
+        if (rawToolName !== tool) entry.agentToolName = rawToolName;
         if (payload.session_id) entry.sessionId = payload.session_id;
         const logPath = path34.join(os29.homedir(), ".node9", "audit.log");
         if (!fs33.existsSync(path34.dirname(logPath)))
@@ -19191,11 +19430,13 @@ function registerInitCommand(program2) {
       if (found.length === 0) {
         console.log(
           chalk16.gray(
-            "No AI agents detected. Install Claude Code, Gemini CLI, Cursor, Windsurf, VSCode, or Codex"
+            "No AI agents detected. Install one of the supported agents (Claude Code, Codex, Gemini CLI, Cursor, Windsurf, VSCode, Claude Desktop, Opencode, Pi, or Hermes Agent)."
           )
         );
         console.log(
-          chalk16.gray("then run: node9 agents add <claude|gemini|cursor|windsurf|vscode|codex>")
+          chalk16.gray(
+            "then run: node9 agents add <claude|codex|gemini|cursor|windsurf|vscode|claudeDesktop|opencode|pi|hermes>"
+          )
         );
         return;
       }
@@ -19215,6 +19456,7 @@ function registerInitCommand(program2) {
         else if (agent === "claudeDesktop") await setupClaudeDesktop();
         else if (agent === "opencode") await setupOpencode();
         else if (agent === "pi") await setupPi();
+        else if (agent === "hermes") setupHermes();
         console.log("");
       }
       if ((process.platform === "darwin" || process.platform === "linux") && process.stdout.isTTY) {
@@ -20976,7 +21218,8 @@ var SETUP_FN = {
   vscode: setupVSCode,
   claudeDesktop: setupClaudeDesktop,
   opencode: setupOpencode,
-  pi: setupPi
+  pi: setupPi,
+  hermes: setupHermes
 };
 var TEARDOWN_FN = {
   claude: teardownClaude,
@@ -20987,7 +21230,8 @@ var TEARDOWN_FN = {
   vscode: teardownVSCode,
   claudeDesktop: teardownClaudeDesktop,
   opencode: teardownOpencode,
-  pi: teardownPi
+  pi: teardownPi,
+  hermes: teardownHermes
 };
 var AGENT_NAMES = Object.keys(SETUP_FN);
 function registerAgentsCommand(program2) {
@@ -22325,10 +22569,11 @@ program.command("addto", { hidden: true }).description("Integrate Node9 with an
   if (target === "codex") return await setupCodex();
   if (target === "windsurf") return await setupWindsurf();
   if (target === "vscode") return await setupVSCode();
+  if (target === "hermes") return setupHermes();
   if (target === "hud") return setupHud();
   console.error(
     chalk30.red(
-      `Unknown target: "${target}". Supported: claude, gemini, cursor, codex, windsurf, vscode, hud`
+      `Unknown target: "${target}". Supported: claude, gemini, cursor, codex, windsurf, vscode, hermes, hud`
     )
   );
   process.exit(1);
@@ -22350,6 +22595,7 @@ program.command("setup", { hidden: true }).description('Alias for "addto" \u2014
     console.log("    " + chalk30.green("codex") + "     \u2014 OpenAI Codex CLI (MCP proxy)");
     console.log("    " + chalk30.green("windsurf") + "  \u2014 Windsurf (MCP proxy)");
     console.log("    " + chalk30.green("vscode") + "    \u2014 VSCode / Copilot (MCP proxy)");
+    console.log("    " + chalk30.green("hermes") + "    \u2014 Hermes Agent (hook mode)");
     process.stdout.write(
       "    " + chalk30.green("hud") + "       \u2014 Claude Code security statusline\n"
     );
@@ -22363,10 +22609,11 @@ program.command("setup", { hidden: true }).description('Alias for "addto" \u2014
   if (t === "codex") return await setupCodex();
   if (t === "windsurf") return await setupWindsurf();
   if (t === "vscode") return await setupVSCode();
+  if (t === "hermes") return setupHermes();
   if (t === "hud") return setupHud();
   console.error(
     chalk30.red(
-      `Unknown target: "${target}". Supported: claude, gemini, cursor, codex, windsurf, vscode, hud`
+      `Unknown target: "${target}". Supported: claude, gemini, cursor, codex, windsurf, vscode, hermes, hud`
     )
   );
   process.exit(1);
@@ -22385,11 +22632,12 @@ program.command("removefrom", { hidden: true }).description("Remove Node9 hooks
   else if (target === "codex") fn = teardownCodex;
   else if (target === "windsurf") fn = teardownWindsurf;
   else if (target === "vscode") fn = teardownVSCode;
+  else if (target === "hermes") fn = teardownHermes;
   else if (target === "hud") fn = teardownHud;
   else {
     console.error(
       chalk30.red(
-        `Unknown target: "${target}". Supported: claude, gemini, cursor, codex, windsurf, vscode, hud`
+        `Unknown target: "${target}". Supported: claude, gemini, cursor, codex, windsurf, vscode, hermes, hud`
       )
     );
     process.exit(1);
@@ -22422,7 +22670,8 @@ program.command("uninstall").description("Remove all Node9 hooks and optionally
     ["Cursor", teardownCursor],
     ["Codex", teardownCodex],
     ["Windsurf", teardownWindsurf],
-    ["VSCode", teardownVSCode]
+    ["VSCode", teardownVSCode],
+    ["Hermes", teardownHermes]
   ]) {
     try {
       fn();

package/dist/dashboard.mjs

@@ -2395,7 +2395,14 @@ var init_config = __esm({
             "edit_file",
             "create_file",
             "edit",
-            "replace"
+            "replace",
+            // Claude / canonicalised Hermes — shouldSnapshot lowercases the
+            // incoming name before set-membership, so we list the lowercase
+            // forms of `Bash`/`Write`/`Edit`/`MultiEdit`. Without these,
+            // post-canonicalisation Hermes `patch` / `write_file` (which now
+            // arrive as `Edit` / `Write`) silently skipped snapshotting.
+            "write",
+            "multiedit"
           ],
           onlyPaths: [],
           ignorePaths: ["**/node_modules/**", "dist/**", "build/**", ".next/**", "**/*.log"]
@@ -3394,6 +3401,7 @@ var init_setup_pi_shim = __esm({
 import chalk2 from "chalk";
 import { confirm } from "@inquirer/prompts";
 import { parse as parseToml, stringify as stringifyToml } from "smol-toml";
+import * as yaml from "yaml";
 var init_setup = __esm({
   "src/setup.ts"() {
     "use strict";

package/dist/index.js

@@ -119,9 +119,11 @@ function appendLocalAudit(toolName, args, decision, checkedBy, meta, auditHashAr
   const argsField = auditHashArgsEnabled ? { argsHash: hashArgs(args) } : { args: args ? JSON.parse(redactSecrets(JSON.stringify(args))) : {} };
   const testRun = isTestCall(toolName, args) || process.env.NODE9_TESTING === "1" ? { testRun: true } : {};
   const ruleNameField = meta?.ruleName ? { ruleName: meta.ruleName } : {};
+  const agentToolNameField = meta?.agentToolName ? { agentToolName: meta.agentToolName } : {};
   appendToLog(LOCAL_AUDIT_LOG, {
     ts: (/* @__PURE__ */ new Date()).toISOString(),
     tool: toolName,
+    ...agentToolNameField,
     ...argsField,
     decision,
     checkedBy,
@@ -2998,7 +3000,14 @@ var DEFAULT_CONFIG = {
         "edit_file",
         "create_file",
         "edit",
-        "replace"
+        "replace",
+        // Claude / canonicalised Hermes — shouldSnapshot lowercases the
+        // incoming name before set-membership, so we list the lowercase
+        // forms of `Bash`/`Write`/`Edit`/`MultiEdit`. Without these,
+        // post-canonicalisation Hermes `patch` / `write_file` (which now
+        // arrive as `Edit` / `Write`) silently skipped snapshotting.
+        "write",
+        "multiedit"
       ],
       onlyPaths: [],
       ignorePaths: ["**/node_modules/**", "dist/**", "build/**", ".next/**", "**/*.log"]

package/dist/index.mjs

@@ -99,9 +99,11 @@ function appendLocalAudit(toolName, args, decision, checkedBy, meta, auditHashAr
   const argsField = auditHashArgsEnabled ? { argsHash: hashArgs(args) } : { args: args ? JSON.parse(redactSecrets(JSON.stringify(args))) : {} };
   const testRun = isTestCall(toolName, args) || process.env.NODE9_TESTING === "1" ? { testRun: true } : {};
   const ruleNameField = meta?.ruleName ? { ruleName: meta.ruleName } : {};
+  const agentToolNameField = meta?.agentToolName ? { agentToolName: meta.agentToolName } : {};
   appendToLog(LOCAL_AUDIT_LOG, {
     ts: (/* @__PURE__ */ new Date()).toISOString(),
     tool: toolName,
+    ...agentToolNameField,
     ...argsField,
     decision,
     checkedBy,
@@ -2968,7 +2970,14 @@ var DEFAULT_CONFIG = {
         "edit_file",
         "create_file",
         "edit",
-        "replace"
+        "replace",
+        // Claude / canonicalised Hermes — shouldSnapshot lowercases the
+        // incoming name before set-membership, so we list the lowercase
+        // forms of `Bash`/`Write`/`Edit`/`MultiEdit`. Without these,
+        // post-canonicalisation Hermes `patch` / `write_file` (which now
+        // arrive as `Edit` / `Write`) silently skipped snapshotting.
+        "write",
+        "multiedit"
       ],
       onlyPaths: [],
       ignorePaths: ["**/node_modules/**", "dist/**", "build/**", ".next/**", "**/*.log"]

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@node9/proxy",
-  "version": "1.27.0",
-  "description": "The Sudo Command for AI Agents. Execution Security for Claude Code & MCP.",
+  "version": "1.28.0",
+  "description": "The Sudo Command for AI Agents. Execution Security for Claude Code, Codex, Gemini, Cursor, Opencode, Pi, and any MCP server.",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",
   "types": "./dist/index.d.ts",
@@ -31,13 +31,20 @@
   "homepage": "https://github.com/node9-ai/node9-proxy#readme",
   "keywords": [
     "ai-security",
+    "agent-security",
+    "agentic-ai",
     "mcp",
     "mcp-proxy",
     "claude-code",
+    "claude-desktop",
+    "codex",
     "gemini-cli",
     "cursor",
-    "agentic-ai",
-    "agent-security",
+    "windsurf",
+    "vscode",
+    "opencode",
+    "pi-agent",
+    "hermes-agent",
     "sudo",
     "security-proxy",
     "human-in-the-loop",
@@ -84,6 +91,7 @@
     "safe-regex2": "^5.1.0",
     "smol-toml": "^1.6.1",
     "string-width": "^4.2.3",
+    "yaml": "^2.9.0",
     "zod": "^3.25.76"
   },
   "bundleDependencies": [