@node9/proxy 1.35.1 → 1.35.2

package/dist/cli.js

@@ -8154,7 +8154,7 @@ function binaryInPath(binary) {
   return false;
 }
 function detectAgents(homeDir2 = import_os12.default.homedir()) {
-  const exists = (p) => {
+  const exists2 = (p) => {
     try {
       return import_fs13.default.existsSync(p);
     } catch (err2) {
@@ -8168,7 +8168,7 @@ function detectAgents(homeDir2 = import_os12.default.homedir()) {
   };
   const desktopPath = claudeDesktopConfigPath(homeDir2);
   return {
-    claude: exists(import_path15.default.join(homeDir2, ".claude")) || exists(import_path15.default.join(homeDir2, ".claude.json")),
+    claude: exists2(import_path15.default.join(homeDir2, ".claude")) || exists2(import_path15.default.join(homeDir2, ".claude.json")),
     // Antigravity (agy) shares the ~/.gemini root, so a bare
     // `exists(~/.gemini)` would report the (EOL'd) Gemini CLI as
     // installed on every agy machine — and `node9 init` would then
@@ -8178,35 +8178,35 @@ function detectAgents(homeDir2 = import_os12.default.homedir()) {
     // creates ~/.gemini/settings.json on first run; agy does not touch
     // it (it uses antigravity-cli/settings.json) — that file is the
     // legacy-CLI discriminator.
-    gemini: exists(import_path15.default.join(homeDir2, ".gemini", "settings.json")) || binaryInPath("gemini"),
+    gemini: exists2(import_path15.default.join(homeDir2, ".gemini", "settings.json")) || binaryInPath("gemini"),
     // agy creates ~/.gemini/antigravity-cli/ on first launch; the IDE
     // creates antigravity-ide/. PATH fallback covers installed-but-
     // never-launched (same class as opencode #186).
-    antigravity: exists(import_path15.default.join(homeDir2, ".gemini", "antigravity-cli")) || exists(import_path15.default.join(homeDir2, ".gemini", "antigravity-ide")) || binaryInPath("agy"),
+    antigravity: exists2(import_path15.default.join(homeDir2, ".gemini", "antigravity-cli")) || exists2(import_path15.default.join(homeDir2, ".gemini", "antigravity-ide")) || binaryInPath("agy"),
     // GitHub Copilot CLI creates ~/.copilot on first launch; PATH
     // fallback covers installed-but-never-launched (same as opencode #186).
-    copilot: exists(import_path15.default.join(homeDir2, ".copilot")) || binaryInPath("copilot"),
-    cursor: exists(import_path15.default.join(homeDir2, ".cursor")),
-    codex: exists(import_path15.default.join(homeDir2, ".codex")),
-    windsurf: exists(import_path15.default.join(homeDir2, ".codeium", "windsurf")),
-    vscode: exists(import_path15.default.join(homeDir2, ".vscode")),
-    claudeDesktop: desktopPath !== null && exists(import_path15.default.dirname(desktopPath)),
+    copilot: exists2(import_path15.default.join(homeDir2, ".copilot")) || binaryInPath("copilot"),
+    cursor: exists2(import_path15.default.join(homeDir2, ".cursor")),
+    codex: exists2(import_path15.default.join(homeDir2, ".codex")),
+    windsurf: exists2(import_path15.default.join(homeDir2, ".codeium", "windsurf")),
+    vscode: exists2(import_path15.default.join(homeDir2, ".vscode")),
+    claudeDesktop: desktopPath !== null && exists2(import_path15.default.dirname(desktopPath)),
     // Opencode creates ~/.config/opencode lazily on first launch — fall back
     // to a PATH lookup so installed-but-never-launched CLIs are still wired.
-    opencode: exists(import_path15.default.join(homeDir2, ".config", "opencode")) || binaryInPath("opencode"),
+    opencode: exists2(import_path15.default.join(homeDir2, ".config", "opencode")) || binaryInPath("opencode"),
     // Pi (https://pi.dev): config dir is ~/.pi/agent (CONFIG_DIR_NAME=".pi"
     // + agentDir, verified against opensources/pi-main/packages/coding-agent/
     // src/config.ts:449,475). The Bun-compiled binary path may create this
     // dir lazily on first launch — same class of bug as opencode's #186
     // (design R6) — so fall back to PATH lookup for installed-but-never-
     // launched pi.
-    pi: exists(import_path15.default.join(homeDir2, ".pi", "agent")) || binaryInPath("pi"),
+    pi: exists2(import_path15.default.join(homeDir2, ".pi", "agent")) || binaryInPath("pi"),
     // Hermes Agent (https://github.com/NousResearch/hermes-agent): home dir
     // is $HERMES_HOME (default ~/.hermes) per hermes_constants.py:30. config.yaml
     // appears after `hermes setup` has run; the directory alone exists from
     // install time. PATH fallback covers the rare case where the user blew
     // away ~/.hermes but kept the binary.
-    hermes: exists(hermesHomeDir(homeDir2)) || binaryInPath("hermes")
+    hermes: exists2(hermesHomeDir(homeDir2)) || binaryInPath("hermes")
   };
 }
 async function setupCursor() {
@@ -19983,118 +19983,151 @@ function matchersHaveNode9Hook(matchers) {
 function flatHaveNode9Hook(entries) {
   return (Array.isArray(entries) ? entries : []).some((h) => isNode9Hook(h.command));
 }
-function jsonWire(filePath, read) {
-  const parsed = readJson2(filePath);
-  if (parsed === null) return "absent";
-  if (parsed === "invalid") return "invalid";
-  return read(parsed) ? "wired" : "unwired";
-}
-function hermesWire(home) {
-  const configPath = hermesConfigPath(home);
-  if (!import_fs38.default.existsSync(configPath)) return "absent";
+function readHookRoot(filePath, format) {
+  if (!import_fs38.default.existsSync(filePath)) return "absent";
   let raw;
   try {
-    raw = import_fs38.default.readFileSync(configPath, "utf-8");
+    raw = import_fs38.default.readFileSync(filePath, "utf-8");
   } catch {
     return "absent";
   }
   try {
-    const cfg = yaml2.parse(raw);
-    const pre = (cfg?.hooks?.pre_tool_call ?? []).some(
-      (e) => typeof e?.command === "string" && isNode9Hook(e.command)
-    );
-    return pre ? "wired" : "unwired";
+    const parsed = format === "yaml" ? yaml2.parse(raw) : JSON.parse(raw);
+    return parsed?.hooks ?? {};
   } catch {
     return "invalid";
   }
 }
+function eventWired(root, ev, format) {
+  const arr = root[ev.key];
+  if (format === "matcher") return matchersHaveNode9Hook(arr);
+  return flatHaveNode9Hook(arr);
+}
+function readMcp(filePath) {
+  const parsed = readJson2(filePath);
+  if (parsed === null || parsed === "invalid") return { wrapped: [], present: false };
+  const servers = parsed.mcpServers ?? {};
+  const entries = Object.entries(servers);
+  const present = entries.some(([, s]) => s?.command === "node9");
+  const wrapped = entries.filter(([, s]) => s?.command === "node9" && Array.isArray(s.args) && s.args.length > 0).map(([name, s]) => `${name} \u2192 ${s.args.join(" ")}`);
+  return { wrapped, present };
+}
+var exists = (p) => {
+  try {
+    return import_fs38.default.existsSync(p);
+  } catch {
+    return false;
+  }
+};
+var ck = (key) => ({ key, kind: "check" });
+var lg = (key) => ({ key, kind: "log" });
+var DEFAULT_LABEL_PAD = 11;
+var hookLabelOf = (ev, pad) => `${ev.key.padEnd(pad)} (node9 ${ev.kind})`;
 var AGENT_SPECS = [
   {
     id: "claude",
     label: "Claude Code",
-    hookLabel: "PreToolUse hook",
     setupCommand: "node9 setup claude",
-    settingsPath: (h) => import_path39.default.join(h, ".claude", "settings.json"),
-    wireState: (h) => jsonWire(
-      import_path39.default.join(h, ".claude", "settings.json"),
-      (p) => matchersHaveNode9Hook(p.hooks?.PreToolUse)
-    )
+    hookFile: (h) => import_path39.default.join(h, ".claude", "settings.json"),
+    hookFormat: "matcher",
+    hookEvents: [ck("PreToolUse"), lg("PostToolUse")],
+    mcpFile: (h) => import_path39.default.join(h, ".claude.json"),
+    present: (h) => exists(import_path39.default.join(h, ".claude", "settings.json")) || exists(import_path39.default.join(h, ".claude.json"))
   },
   {
     id: "gemini",
     label: "Gemini CLI",
-    hookLabel: "BeforeTool hook",
     setupCommand: "node9 setup gemini",
-    settingsPath: (h) => import_path39.default.join(h, ".gemini", "settings.json"),
-    wireState: (h) => jsonWire(
-      import_path39.default.join(h, ".gemini", "settings.json"),
-      (p) => matchersHaveNode9Hook(p.hooks?.BeforeTool)
-    )
+    hookFile: (h) => import_path39.default.join(h, ".gemini", "settings.json"),
+    hookFormat: "matcher",
+    hookEvents: [ck("BeforeTool"), lg("AfterTool")],
+    mcpFile: (h) => import_path39.default.join(h, ".gemini", "settings.json"),
+    present: (h) => exists(import_path39.default.join(h, ".gemini", "settings.json"))
   },
   {
     id: "codex",
     label: "Codex",
-    hookLabel: "PreToolUse hook",
     setupCommand: "node9 setup codex",
-    settingsPath: (h) => import_path39.default.join(h, ".codex", "hooks.json"),
-    wireState: (h) => jsonWire(
-      import_path39.default.join(h, ".codex", "hooks.json"),
-      (p) => matchersHaveNode9Hook(p.hooks?.PreToolUse)
-    )
+    hookFile: (h) => import_path39.default.join(h, ".codex", "hooks.json"),
+    hookFormat: "matcher",
+    hookEvents: [ck("PreToolUse"), ck("UserPromptSubmit")],
+    present: (h) => exists(import_path39.default.join(h, ".codex"))
   },
   {
     id: "antigravity",
     label: "Antigravity",
-    hookLabel: "PreToolUse hook",
     setupCommand: "node9 setup antigravity",
-    settingsPath: (h) => import_path39.default.join(h, ".gemini", "config", "hooks.json"),
-    wireState: (h) => jsonWire(
-      import_path39.default.join(h, ".gemini", "config", "hooks.json"),
-      (p) => matchersHaveNode9Hook(p.hooks?.PreToolUse)
-    )
+    hookFile: (h) => import_path39.default.join(h, ".gemini", "config", "hooks.json"),
+    hookFormat: "matcher",
+    hookEvents: [ck("PreToolUse"), lg("PostToolUse")],
+    mcpFile: (h) => import_path39.default.join(h, ".gemini", "config", "mcp_config.json"),
+    present: (h) => exists(import_path39.default.join(h, ".gemini", "config", "hooks.json")) || exists(import_path39.default.join(h, ".gemini", "antigravity-cli")) || exists(import_path39.default.join(h, ".gemini", "antigravity-ide"))
   },
   {
     id: "copilot",
     label: "GitHub Copilot",
-    hookLabel: "PreToolUse hook",
     setupCommand: "node9 setup copilot",
-    settingsPath: (h) => import_path39.default.join(h, ".copilot", "hooks", "node9.json"),
-    wireState: (h) => jsonWire(
-      import_path39.default.join(h, ".copilot", "hooks", "node9.json"),
-      (p) => flatHaveNode9Hook(p.hooks?.PreToolUse)
-    )
+    hookFile: (h) => import_path39.default.join(h, ".copilot", "hooks", "node9.json"),
+    hookFormat: "flat",
+    hookEvents: [ck("PreToolUse"), lg("PostToolUse"), ck("UserPromptSubmit")],
+    mcpFile: (h) => import_path39.default.join(h, ".copilot", "mcp-config.json"),
+    present: (h) => exists(import_path39.default.join(h, ".copilot"))
   },
   {
     id: "cursor",
     label: "Cursor",
-    hookLabel: "preToolUse hook",
     setupCommand: "node9 setup cursor",
-    settingsPath: (h) => import_path39.default.join(h, ".cursor", "hooks.json"),
-    wireState: (h) => jsonWire(
-      import_path39.default.join(h, ".cursor", "hooks.json"),
-      (p) => flatHaveNode9Hook(p.hooks?.preToolUse)
-    )
+    // MCP-only — no hook file (see note above).
+    hookFormat: "flat",
+    hookEvents: [],
+    mcpFile: (h) => import_path39.default.join(h, ".cursor", "mcp.json"),
+    present: (h) => exists(import_path39.default.join(h, ".cursor", "mcp.json"))
   },
   {
     id: "hermes",
     label: "Hermes Agent",
-    hookLabel: "pre_tool_call hook",
     setupCommand: "node9 setup hermes",
-    settingsPath: (h) => hermesConfigPath(h),
-    wireState: (h) => hermesWire(h)
+    hookFile: (h) => hermesConfigPath(h),
+    hookFormat: "yaml",
+    hookEvents: [ck("pre_tool_call"), lg("post_tool_call")],
+    labelPad: 14,
+    // 'post_tool_call' is wider than the default
+    present: (h) => exists(hermesConfigPath(h))
   }
 ];
 function getAgentWiring(home = import_os34.default.homedir()) {
   const detected = detectAgents(home);
-  return AGENT_SPECS.map((spec) => ({
-    id: spec.id,
-    label: spec.label,
-    hookLabel: spec.hookLabel,
-    setupCommand: spec.setupCommand,
-    settingsPath: spec.settingsPath(home),
-    installed: detected[spec.id],
-    wireState: spec.wireState(home)
-  }));
+  return AGENT_SPECS.map((spec) => {
+    const root = spec.hookFile ? readHookRoot(spec.hookFile(home), spec.hookFormat) : "absent";
+    const primary = spec.hookEvents[0];
+    const rootPresent = root !== "absent" && root !== "invalid";
+    const pad = spec.labelPad ?? DEFAULT_LABEL_PAD;
+    const hooks = spec.hookEvents.map((ev) => ({
+      label: hookLabelOf(ev, pad),
+      wired: rootPresent && eventWired(root, ev, spec.hookFormat)
+    }));
+    let wireState;
+    if (root === "absent") wireState = "absent";
+    else if (root === "invalid") wireState = "invalid";
+    else wireState = primary && eventWired(root, primary, spec.hookFormat) ? "wired" : "unwired";
+    const mcp = spec.mcpFile ? readMcp(spec.mcpFile(home)) : null;
+    const anyHookWired = hooks.some((h) => h.wired);
+    return {
+      id: spec.id,
+      label: spec.label,
+      setupCommand: spec.setupCommand,
+      installed: detected[spec.id],
+      present: spec.present(home),
+      hooks,
+      wireState,
+      hookLabel: primary ? `${primary.key} hook` : "MCP proxy",
+      settingsPath: spec.hookFile ? spec.hookFile(home) : spec.mcpFile ? spec.mcpFile(home) : "",
+      configFormat: spec.hookFormat === "yaml" ? "YAML" : "JSON",
+      mcpServers: mcp ? mcp.wrapped : null,
+      mcpProtected: mcp ? mcp.present : false,
+      isProtected: anyHookWired || (mcp?.present ?? false)
+    };
+  });
 }
 
 // src/cli/commands/doctor.ts
@@ -20184,12 +20217,13 @@ function registerDoctorCommand(program2, version2) {
     section("Agent Hooks");
     const notConfigured = [];
     for (const a of getAgentWiring(homeDir2)) {
-      if (a.wireState === "wired") {
-        pass(`${a.label} \u2014 ${a.hookLabel} active`);
-      } else if (a.wireState === "unwired") {
-        fail(`${a.label} \u2014 settings found but node9 hook missing`, `Run: ${a.setupCommand}`);
+      const anyHookWired = a.hooks.some((h) => h.wired);
+      if (a.isProtected) {
+        pass(`${a.label} \u2014 ${anyHookWired ? `${a.hookLabel} active` : "MCP proxy active"}`);
       } else if (a.wireState === "invalid") {
         fail(`${a.label} \u2014 settings file is invalid JSON`, a.settingsPath);
+      } else if (a.wireState === "unwired") {
+        fail(`${a.label} \u2014 settings found but node9 hook missing`, `Run: ${a.setupCommand}`);
       } else {
         notConfigured.push(a.label);
       }
@@ -21493,50 +21527,8 @@ var import_chalk15 = __toESM(require("chalk"));
 var import_fs42 = __toESM(require("fs"));
 var import_path43 = __toESM(require("path"));
 var import_os38 = __toESM(require("os"));
-var yaml3 = __toESM(require("yaml"));
 init_core();
 init_daemon();
-init_setup();
-function readHermesHooks(configPath) {
-  if (!import_fs42.default.existsSync(configPath)) return null;
-  let raw;
-  try {
-    raw = import_fs42.default.readFileSync(configPath, "utf-8");
-  } catch {
-    return null;
-  }
-  try {
-    const cfg = yaml3.parse(raw);
-    const has = (event) => (cfg?.hooks?.[event] ?? []).some(
-      (e) => typeof e?.command === "string" && isNode9Hook(e.command)
-    );
-    return { pre: has("pre_tool_call"), post: has("post_tool_call") };
-  } catch {
-    console.error(
-      import_chalk15.default.yellow(
-        `  \u26A0\uFE0F  Hermes config.yaml at ${configPath} is not valid YAML \u2014 showing as unwired.`
-      )
-    );
-    return { pre: false, post: false };
-  }
-}
-function readJson3(filePath) {
-  try {
-    if (import_fs42.default.existsSync(filePath)) return JSON.parse(import_fs42.default.readFileSync(filePath, "utf-8"));
-  } catch {
-  }
-  return null;
-}
-function matchersHaveNode9Hook2(matchers) {
-  return (matchers ?? []).some((m) => (m.hooks ?? []).some((h) => isNode9Hook(h.command)));
-}
-function flatHaveNode9Hook2(entries) {
-  return (Array.isArray(entries) ? entries : []).some((h) => isNode9Hook(h.command));
-}
-function wrappedMcpServers(servers) {
-  if (!servers) return [];
-  return Object.entries(servers).filter(([, s]) => s.command === "node9" && Array.isArray(s.args) && s.args.length > 0).map(([name, s]) => `${name} \u2192 ${s.args.join(" ")}`);
-}
 function printAgentSection(label, hookPairs, wrapped) {
   console.log(import_chalk15.default.bold(`  ${label}`));
   for (const { name, present } of hookPairs) {
@@ -21603,102 +21595,23 @@ function registerStatusCommand(program2) {
         `  Sandbox: ${import_chalk15.default.green(`${mergedConfig.policy.sandboxPaths.length} safe zones active`)}`
       );
     }
-    const homeDir2 = import_os38.default.homedir();
-    const claudeSettings = readJson3(
-      import_path43.default.join(homeDir2, ".claude", "settings.json")
-    );
-    const claudeConfig = readJson3(import_path43.default.join(homeDir2, ".claude.json"));
-    const geminiSettings = readJson3(
-      import_path43.default.join(homeDir2, ".gemini", "settings.json")
-    );
-    const cursorConfig = readJson3(import_path43.default.join(homeDir2, ".cursor", "mcp.json"));
-    const antigravityHooks = readJson3(
-      import_path43.default.join(homeDir2, ".gemini", "config", "hooks.json")
-    );
-    const antigravityMcp = readJson3(
-      import_path43.default.join(homeDir2, ".gemini", "config", "mcp_config.json")
-    );
-    const antigravityPresent = antigravityHooks !== null || import_fs42.default.existsSync(import_path43.default.join(homeDir2, ".gemini", "antigravity-cli")) || import_fs42.default.existsSync(import_path43.default.join(homeDir2, ".gemini", "antigravity-ide"));
-    const copilotHooks = readJson3(
-      import_path43.default.join(homeDir2, ".copilot", "hooks", "node9.json")
-    );
-    const copilotMcp = readJson3(
-      import_path43.default.join(homeDir2, ".copilot", "mcp-config.json")
-    );
-    const copilotPresent = import_fs42.default.existsSync(import_path43.default.join(homeDir2, ".copilot"));
-    const hermesHooks = readHermesHooks(hermesConfigPath(homeDir2));
-    const agentFound = claudeSettings || claudeConfig || geminiSettings || cursorConfig || antigravityPresent || copilotPresent || hermesHooks;
-    if (agentFound) {
+    const wiring = getAgentWiring(import_os38.default.homedir()).filter((a) => a.present);
+    if (wiring.length > 0) {
       console.log("");
       console.log(import_chalk15.default.bold("  Agent Wiring:"));
       console.log("");
-      if (claudeSettings || claudeConfig) {
-        const preHook = matchersHaveNode9Hook2(claudeSettings?.hooks?.PreToolUse);
-        const postHook = matchersHaveNode9Hook2(claudeSettings?.hooks?.PostToolUse);
-        printAgentSection(
-          "Claude Code",
-          [
-            { name: "PreToolUse  (node9 check)", present: preHook },
-            { name: "PostToolUse (node9 log)", present: postHook }
-          ],
-          wrappedMcpServers(claudeConfig?.mcpServers)
-        );
-        console.log("");
-      }
-      if (geminiSettings) {
-        const beforeHook = matchersHaveNode9Hook2(geminiSettings.hooks?.BeforeTool);
-        const afterHook = matchersHaveNode9Hook2(geminiSettings.hooks?.AfterTool);
-        printAgentSection(
-          "Gemini CLI",
-          [
-            { name: "BeforeTool  (node9 check)", present: beforeHook },
-            { name: "AfterTool   (node9 log)", present: afterHook }
-          ],
-          wrappedMcpServers(geminiSettings.mcpServers)
-        );
-        console.log("");
-      }
-      if (antigravityPresent) {
-        const preHook = matchersHaveNode9Hook2(antigravityHooks?.hooks?.PreToolUse);
-        const postHook = matchersHaveNode9Hook2(antigravityHooks?.hooks?.PostToolUse);
-        printAgentSection(
-          "Antigravity",
-          [
-            { name: "PreToolUse  (node9 check)", present: preHook },
-            { name: "PostToolUse (node9 log)", present: postHook }
-          ],
-          wrappedMcpServers(antigravityMcp?.mcpServers)
-        );
-        console.log("");
-      }
-      if (copilotPresent) {
-        const preHook = flatHaveNode9Hook2(copilotHooks?.hooks?.PreToolUse);
-        const postHook = flatHaveNode9Hook2(copilotHooks?.hooks?.PostToolUse);
-        const promptHook = flatHaveNode9Hook2(copilotHooks?.hooks?.UserPromptSubmit);
-        printAgentSection(
-          "GitHub Copilot",
-          [
-            { name: "PreToolUse  (node9 check)", present: preHook },
-            { name: "PostToolUse (node9 log)", present: postHook },
-            { name: "UserPromptSubmit (node9 check)", present: promptHook }
-          ],
-          wrappedMcpServers(copilotMcp?.mcpServers)
-        );
-        console.log("");
-      }
-      if (cursorConfig) {
-        printAgentSection("Cursor", [], wrappedMcpServers(cursorConfig.mcpServers));
-        console.log("");
-      }
-      if (hermesHooks) {
+      for (const a of wiring) {
+        if (a.wireState === "invalid") {
+          console.error(
+            import_chalk15.default.yellow(
+              `  \u26A0\uFE0F  ${a.label} config at ${a.settingsPath} is not valid ${a.configFormat} \u2014 showing as unwired.`
+            )
+          );
+        }
         printAgentSection(
-          "Hermes Agent",
-          [
-            { name: "pre_tool_call  (node9 check)", present: hermesHooks.pre },
-            { name: "post_tool_call (node9 log)", present: hermesHooks.post }
-          ],
-          null
-          // Hermes has no MCP surface
+          a.label,
+          a.hooks.map((h) => ({ name: h.label, present: h.wired })),
+          a.mcpServers
         );
         console.log("");
       }

package/dist/cli.mjs

@@ -8136,7 +8136,7 @@ function binaryInPath(binary) {
   return false;
 }
 function detectAgents(homeDir2 = os12.homedir()) {
-  const exists = (p) => {
+  const exists2 = (p) => {
     try {
       return fs13.existsSync(p);
     } catch (err2) {
@@ -8150,7 +8150,7 @@ function detectAgents(homeDir2 = os12.homedir()) {
   };
   const desktopPath = claudeDesktopConfigPath(homeDir2);
   return {
-    claude: exists(path15.join(homeDir2, ".claude")) || exists(path15.join(homeDir2, ".claude.json")),
+    claude: exists2(path15.join(homeDir2, ".claude")) || exists2(path15.join(homeDir2, ".claude.json")),
     // Antigravity (agy) shares the ~/.gemini root, so a bare
     // `exists(~/.gemini)` would report the (EOL'd) Gemini CLI as
     // installed on every agy machine — and `node9 init` would then
@@ -8160,35 +8160,35 @@ function detectAgents(homeDir2 = os12.homedir()) {
     // creates ~/.gemini/settings.json on first run; agy does not touch
     // it (it uses antigravity-cli/settings.json) — that file is the
     // legacy-CLI discriminator.
-    gemini: exists(path15.join(homeDir2, ".gemini", "settings.json")) || binaryInPath("gemini"),
+    gemini: exists2(path15.join(homeDir2, ".gemini", "settings.json")) || binaryInPath("gemini"),
     // agy creates ~/.gemini/antigravity-cli/ on first launch; the IDE
     // creates antigravity-ide/. PATH fallback covers installed-but-
     // never-launched (same class as opencode #186).
-    antigravity: exists(path15.join(homeDir2, ".gemini", "antigravity-cli")) || exists(path15.join(homeDir2, ".gemini", "antigravity-ide")) || binaryInPath("agy"),
+    antigravity: exists2(path15.join(homeDir2, ".gemini", "antigravity-cli")) || exists2(path15.join(homeDir2, ".gemini", "antigravity-ide")) || binaryInPath("agy"),
     // GitHub Copilot CLI creates ~/.copilot on first launch; PATH
     // fallback covers installed-but-never-launched (same as opencode #186).
-    copilot: exists(path15.join(homeDir2, ".copilot")) || binaryInPath("copilot"),
-    cursor: exists(path15.join(homeDir2, ".cursor")),
-    codex: exists(path15.join(homeDir2, ".codex")),
-    windsurf: exists(path15.join(homeDir2, ".codeium", "windsurf")),
-    vscode: exists(path15.join(homeDir2, ".vscode")),
-    claudeDesktop: desktopPath !== null && exists(path15.dirname(desktopPath)),
+    copilot: exists2(path15.join(homeDir2, ".copilot")) || binaryInPath("copilot"),
+    cursor: exists2(path15.join(homeDir2, ".cursor")),
+    codex: exists2(path15.join(homeDir2, ".codex")),
+    windsurf: exists2(path15.join(homeDir2, ".codeium", "windsurf")),
+    vscode: exists2(path15.join(homeDir2, ".vscode")),
+    claudeDesktop: desktopPath !== null && exists2(path15.dirname(desktopPath)),
     // Opencode creates ~/.config/opencode lazily on first launch — fall back
     // to a PATH lookup so installed-but-never-launched CLIs are still wired.
-    opencode: exists(path15.join(homeDir2, ".config", "opencode")) || binaryInPath("opencode"),
+    opencode: exists2(path15.join(homeDir2, ".config", "opencode")) || binaryInPath("opencode"),
     // Pi (https://pi.dev): config dir is ~/.pi/agent (CONFIG_DIR_NAME=".pi"
     // + agentDir, verified against opensources/pi-main/packages/coding-agent/
     // src/config.ts:449,475). The Bun-compiled binary path may create this
     // dir lazily on first launch — same class of bug as opencode's #186
     // (design R6) — so fall back to PATH lookup for installed-but-never-
     // launched pi.
-    pi: exists(path15.join(homeDir2, ".pi", "agent")) || binaryInPath("pi"),
+    pi: exists2(path15.join(homeDir2, ".pi", "agent")) || binaryInPath("pi"),
     // Hermes Agent (https://github.com/NousResearch/hermes-agent): home dir
     // is $HERMES_HOME (default ~/.hermes) per hermes_constants.py:30. config.yaml
     // appears after `hermes setup` has run; the directory alone exists from
     // install time. PATH fallback covers the rare case where the user blew
     // away ~/.hermes but kept the binary.
-    hermes: exists(hermesHomeDir(homeDir2)) || binaryInPath("hermes")
+    hermes: exists2(hermesHomeDir(homeDir2)) || binaryInPath("hermes")
   };
 }
 async function setupCursor() {
@@ -19955,118 +19955,151 @@ function matchersHaveNode9Hook(matchers) {
 function flatHaveNode9Hook(entries) {
   return (Array.isArray(entries) ? entries : []).some((h) => isNode9Hook(h.command));
 }
-function jsonWire(filePath, read) {
-  const parsed = readJson2(filePath);
-  if (parsed === null) return "absent";
-  if (parsed === "invalid") return "invalid";
-  return read(parsed) ? "wired" : "unwired";
-}
-function hermesWire(home) {
-  const configPath = hermesConfigPath(home);
-  if (!fs38.existsSync(configPath)) return "absent";
+function readHookRoot(filePath, format) {
+  if (!fs38.existsSync(filePath)) return "absent";
   let raw;
   try {
-    raw = fs38.readFileSync(configPath, "utf-8");
+    raw = fs38.readFileSync(filePath, "utf-8");
   } catch {
     return "absent";
   }
   try {
-    const cfg = yaml2.parse(raw);
-    const pre = (cfg?.hooks?.pre_tool_call ?? []).some(
-      (e) => typeof e?.command === "string" && isNode9Hook(e.command)
-    );
-    return pre ? "wired" : "unwired";
+    const parsed = format === "yaml" ? yaml2.parse(raw) : JSON.parse(raw);
+    return parsed?.hooks ?? {};
   } catch {
     return "invalid";
   }
 }
+function eventWired(root, ev, format) {
+  const arr = root[ev.key];
+  if (format === "matcher") return matchersHaveNode9Hook(arr);
+  return flatHaveNode9Hook(arr);
+}
+function readMcp(filePath) {
+  const parsed = readJson2(filePath);
+  if (parsed === null || parsed === "invalid") return { wrapped: [], present: false };
+  const servers = parsed.mcpServers ?? {};
+  const entries = Object.entries(servers);
+  const present = entries.some(([, s]) => s?.command === "node9");
+  const wrapped = entries.filter(([, s]) => s?.command === "node9" && Array.isArray(s.args) && s.args.length > 0).map(([name, s]) => `${name} \u2192 ${s.args.join(" ")}`);
+  return { wrapped, present };
+}
+var exists = (p) => {
+  try {
+    return fs38.existsSync(p);
+  } catch {
+    return false;
+  }
+};
+var ck = (key) => ({ key, kind: "check" });
+var lg = (key) => ({ key, kind: "log" });
+var DEFAULT_LABEL_PAD = 11;
+var hookLabelOf = (ev, pad) => `${ev.key.padEnd(pad)} (node9 ${ev.kind})`;
 var AGENT_SPECS = [
   {
     id: "claude",
     label: "Claude Code",
-    hookLabel: "PreToolUse hook",
     setupCommand: "node9 setup claude",
-    settingsPath: (h) => path39.join(h, ".claude", "settings.json"),
-    wireState: (h) => jsonWire(
-      path39.join(h, ".claude", "settings.json"),
-      (p) => matchersHaveNode9Hook(p.hooks?.PreToolUse)
-    )
+    hookFile: (h) => path39.join(h, ".claude", "settings.json"),
+    hookFormat: "matcher",
+    hookEvents: [ck("PreToolUse"), lg("PostToolUse")],
+    mcpFile: (h) => path39.join(h, ".claude.json"),
+    present: (h) => exists(path39.join(h, ".claude", "settings.json")) || exists(path39.join(h, ".claude.json"))
   },
   {
     id: "gemini",
     label: "Gemini CLI",
-    hookLabel: "BeforeTool hook",
     setupCommand: "node9 setup gemini",
-    settingsPath: (h) => path39.join(h, ".gemini", "settings.json"),
-    wireState: (h) => jsonWire(
-      path39.join(h, ".gemini", "settings.json"),
-      (p) => matchersHaveNode9Hook(p.hooks?.BeforeTool)
-    )
+    hookFile: (h) => path39.join(h, ".gemini", "settings.json"),
+    hookFormat: "matcher",
+    hookEvents: [ck("BeforeTool"), lg("AfterTool")],
+    mcpFile: (h) => path39.join(h, ".gemini", "settings.json"),
+    present: (h) => exists(path39.join(h, ".gemini", "settings.json"))
   },
   {
     id: "codex",
     label: "Codex",
-    hookLabel: "PreToolUse hook",
     setupCommand: "node9 setup codex",
-    settingsPath: (h) => path39.join(h, ".codex", "hooks.json"),
-    wireState: (h) => jsonWire(
-      path39.join(h, ".codex", "hooks.json"),
-      (p) => matchersHaveNode9Hook(p.hooks?.PreToolUse)
-    )
+    hookFile: (h) => path39.join(h, ".codex", "hooks.json"),
+    hookFormat: "matcher",
+    hookEvents: [ck("PreToolUse"), ck("UserPromptSubmit")],
+    present: (h) => exists(path39.join(h, ".codex"))
   },
   {
     id: "antigravity",
     label: "Antigravity",
-    hookLabel: "PreToolUse hook",
     setupCommand: "node9 setup antigravity",
-    settingsPath: (h) => path39.join(h, ".gemini", "config", "hooks.json"),
-    wireState: (h) => jsonWire(
-      path39.join(h, ".gemini", "config", "hooks.json"),
-      (p) => matchersHaveNode9Hook(p.hooks?.PreToolUse)
-    )
+    hookFile: (h) => path39.join(h, ".gemini", "config", "hooks.json"),
+    hookFormat: "matcher",
+    hookEvents: [ck("PreToolUse"), lg("PostToolUse")],
+    mcpFile: (h) => path39.join(h, ".gemini", "config", "mcp_config.json"),
+    present: (h) => exists(path39.join(h, ".gemini", "config", "hooks.json")) || exists(path39.join(h, ".gemini", "antigravity-cli")) || exists(path39.join(h, ".gemini", "antigravity-ide"))
   },
   {
     id: "copilot",
     label: "GitHub Copilot",
-    hookLabel: "PreToolUse hook",
     setupCommand: "node9 setup copilot",
-    settingsPath: (h) => path39.join(h, ".copilot", "hooks", "node9.json"),
-    wireState: (h) => jsonWire(
-      path39.join(h, ".copilot", "hooks", "node9.json"),
-      (p) => flatHaveNode9Hook(p.hooks?.PreToolUse)
-    )
+    hookFile: (h) => path39.join(h, ".copilot", "hooks", "node9.json"),
+    hookFormat: "flat",
+    hookEvents: [ck("PreToolUse"), lg("PostToolUse"), ck("UserPromptSubmit")],
+    mcpFile: (h) => path39.join(h, ".copilot", "mcp-config.json"),
+    present: (h) => exists(path39.join(h, ".copilot"))
   },
   {
     id: "cursor",
     label: "Cursor",
-    hookLabel: "preToolUse hook",
     setupCommand: "node9 setup cursor",
-    settingsPath: (h) => path39.join(h, ".cursor", "hooks.json"),
-    wireState: (h) => jsonWire(
-      path39.join(h, ".cursor", "hooks.json"),
-      (p) => flatHaveNode9Hook(p.hooks?.preToolUse)
-    )
+    // MCP-only — no hook file (see note above).
+    hookFormat: "flat",
+    hookEvents: [],
+    mcpFile: (h) => path39.join(h, ".cursor", "mcp.json"),
+    present: (h) => exists(path39.join(h, ".cursor", "mcp.json"))
   },
   {
     id: "hermes",
     label: "Hermes Agent",
-    hookLabel: "pre_tool_call hook",
     setupCommand: "node9 setup hermes",
-    settingsPath: (h) => hermesConfigPath(h),
-    wireState: (h) => hermesWire(h)
+    hookFile: (h) => hermesConfigPath(h),
+    hookFormat: "yaml",
+    hookEvents: [ck("pre_tool_call"), lg("post_tool_call")],
+    labelPad: 14,
+    // 'post_tool_call' is wider than the default
+    present: (h) => exists(hermesConfigPath(h))
   }
 ];
 function getAgentWiring(home = os34.homedir()) {
   const detected = detectAgents(home);
-  return AGENT_SPECS.map((spec) => ({
-    id: spec.id,
-    label: spec.label,
-    hookLabel: spec.hookLabel,
-    setupCommand: spec.setupCommand,
-    settingsPath: spec.settingsPath(home),
-    installed: detected[spec.id],
-    wireState: spec.wireState(home)
-  }));
+  return AGENT_SPECS.map((spec) => {
+    const root = spec.hookFile ? readHookRoot(spec.hookFile(home), spec.hookFormat) : "absent";
+    const primary = spec.hookEvents[0];
+    const rootPresent = root !== "absent" && root !== "invalid";
+    const pad = spec.labelPad ?? DEFAULT_LABEL_PAD;
+    const hooks = spec.hookEvents.map((ev) => ({
+      label: hookLabelOf(ev, pad),
+      wired: rootPresent && eventWired(root, ev, spec.hookFormat)
+    }));
+    let wireState;
+    if (root === "absent") wireState = "absent";
+    else if (root === "invalid") wireState = "invalid";
+    else wireState = primary && eventWired(root, primary, spec.hookFormat) ? "wired" : "unwired";
+    const mcp = spec.mcpFile ? readMcp(spec.mcpFile(home)) : null;
+    const anyHookWired = hooks.some((h) => h.wired);
+    return {
+      id: spec.id,
+      label: spec.label,
+      setupCommand: spec.setupCommand,
+      installed: detected[spec.id],
+      present: spec.present(home),
+      hooks,
+      wireState,
+      hookLabel: primary ? `${primary.key} hook` : "MCP proxy",
+      settingsPath: spec.hookFile ? spec.hookFile(home) : spec.mcpFile ? spec.mcpFile(home) : "",
+      configFormat: spec.hookFormat === "yaml" ? "YAML" : "JSON",
+      mcpServers: mcp ? mcp.wrapped : null,
+      mcpProtected: mcp ? mcp.present : false,
+      isProtected: anyHookWired || (mcp?.present ?? false)
+    };
+  });
 }
 
 // src/cli/commands/doctor.ts
@@ -20156,12 +20189,13 @@ function registerDoctorCommand(program2, version2) {
     section("Agent Hooks");
     const notConfigured = [];
     for (const a of getAgentWiring(homeDir2)) {
-      if (a.wireState === "wired") {
-        pass(`${a.label} \u2014 ${a.hookLabel} active`);
-      } else if (a.wireState === "unwired") {
-        fail(`${a.label} \u2014 settings found but node9 hook missing`, `Run: ${a.setupCommand}`);
+      const anyHookWired = a.hooks.some((h) => h.wired);
+      if (a.isProtected) {
+        pass(`${a.label} \u2014 ${anyHookWired ? `${a.hookLabel} active` : "MCP proxy active"}`);
       } else if (a.wireState === "invalid") {
         fail(`${a.label} \u2014 settings file is invalid JSON`, a.settingsPath);
+      } else if (a.wireState === "unwired") {
+        fail(`${a.label} \u2014 settings found but node9 hook missing`, `Run: ${a.setupCommand}`);
       } else {
         notConfigured.push(a.label);
       }
@@ -21463,52 +21497,10 @@ function registerDaemonCommand(program2) {
 // src/cli/commands/status.ts
 init_core();
 init_daemon();
-init_setup();
 import chalk15 from "chalk";
 import fs42 from "fs";
 import path43 from "path";
 import os38 from "os";
-import * as yaml3 from "yaml";
-function readHermesHooks(configPath) {
-  if (!fs42.existsSync(configPath)) return null;
-  let raw;
-  try {
-    raw = fs42.readFileSync(configPath, "utf-8");
-  } catch {
-    return null;
-  }
-  try {
-    const cfg = yaml3.parse(raw);
-    const has = (event) => (cfg?.hooks?.[event] ?? []).some(
-      (e) => typeof e?.command === "string" && isNode9Hook(e.command)
-    );
-    return { pre: has("pre_tool_call"), post: has("post_tool_call") };
-  } catch {
-    console.error(
-      chalk15.yellow(
-        `  \u26A0\uFE0F  Hermes config.yaml at ${configPath} is not valid YAML \u2014 showing as unwired.`
-      )
-    );
-    return { pre: false, post: false };
-  }
-}
-function readJson3(filePath) {
-  try {
-    if (fs42.existsSync(filePath)) return JSON.parse(fs42.readFileSync(filePath, "utf-8"));
-  } catch {
-  }
-  return null;
-}
-function matchersHaveNode9Hook2(matchers) {
-  return (matchers ?? []).some((m) => (m.hooks ?? []).some((h) => isNode9Hook(h.command)));
-}
-function flatHaveNode9Hook2(entries) {
-  return (Array.isArray(entries) ? entries : []).some((h) => isNode9Hook(h.command));
-}
-function wrappedMcpServers(servers) {
-  if (!servers) return [];
-  return Object.entries(servers).filter(([, s]) => s.command === "node9" && Array.isArray(s.args) && s.args.length > 0).map(([name, s]) => `${name} \u2192 ${s.args.join(" ")}`);
-}
 function printAgentSection(label, hookPairs, wrapped) {
   console.log(chalk15.bold(`  ${label}`));
   for (const { name, present } of hookPairs) {
@@ -21575,102 +21567,23 @@ function registerStatusCommand(program2) {
         `  Sandbox: ${chalk15.green(`${mergedConfig.policy.sandboxPaths.length} safe zones active`)}`
       );
     }
-    const homeDir2 = os38.homedir();
-    const claudeSettings = readJson3(
-      path43.join(homeDir2, ".claude", "settings.json")
-    );
-    const claudeConfig = readJson3(path43.join(homeDir2, ".claude.json"));
-    const geminiSettings = readJson3(
-      path43.join(homeDir2, ".gemini", "settings.json")
-    );
-    const cursorConfig = readJson3(path43.join(homeDir2, ".cursor", "mcp.json"));
-    const antigravityHooks = readJson3(
-      path43.join(homeDir2, ".gemini", "config", "hooks.json")
-    );
-    const antigravityMcp = readJson3(
-      path43.join(homeDir2, ".gemini", "config", "mcp_config.json")
-    );
-    const antigravityPresent = antigravityHooks !== null || fs42.existsSync(path43.join(homeDir2, ".gemini", "antigravity-cli")) || fs42.existsSync(path43.join(homeDir2, ".gemini", "antigravity-ide"));
-    const copilotHooks = readJson3(
-      path43.join(homeDir2, ".copilot", "hooks", "node9.json")
-    );
-    const copilotMcp = readJson3(
-      path43.join(homeDir2, ".copilot", "mcp-config.json")
-    );
-    const copilotPresent = fs42.existsSync(path43.join(homeDir2, ".copilot"));
-    const hermesHooks = readHermesHooks(hermesConfigPath(homeDir2));
-    const agentFound = claudeSettings || claudeConfig || geminiSettings || cursorConfig || antigravityPresent || copilotPresent || hermesHooks;
-    if (agentFound) {
+    const wiring = getAgentWiring(os38.homedir()).filter((a) => a.present);
+    if (wiring.length > 0) {
       console.log("");
       console.log(chalk15.bold("  Agent Wiring:"));
       console.log("");
-      if (claudeSettings || claudeConfig) {
-        const preHook = matchersHaveNode9Hook2(claudeSettings?.hooks?.PreToolUse);
-        const postHook = matchersHaveNode9Hook2(claudeSettings?.hooks?.PostToolUse);
-        printAgentSection(
-          "Claude Code",
-          [
-            { name: "PreToolUse  (node9 check)", present: preHook },
-            { name: "PostToolUse (node9 log)", present: postHook }
-          ],
-          wrappedMcpServers(claudeConfig?.mcpServers)
-        );
-        console.log("");
-      }
-      if (geminiSettings) {
-        const beforeHook = matchersHaveNode9Hook2(geminiSettings.hooks?.BeforeTool);
-        const afterHook = matchersHaveNode9Hook2(geminiSettings.hooks?.AfterTool);
-        printAgentSection(
-          "Gemini CLI",
-          [
-            { name: "BeforeTool  (node9 check)", present: beforeHook },
-            { name: "AfterTool   (node9 log)", present: afterHook }
-          ],
-          wrappedMcpServers(geminiSettings.mcpServers)
-        );
-        console.log("");
-      }
-      if (antigravityPresent) {
-        const preHook = matchersHaveNode9Hook2(antigravityHooks?.hooks?.PreToolUse);
-        const postHook = matchersHaveNode9Hook2(antigravityHooks?.hooks?.PostToolUse);
-        printAgentSection(
-          "Antigravity",
-          [
-            { name: "PreToolUse  (node9 check)", present: preHook },
-            { name: "PostToolUse (node9 log)", present: postHook }
-          ],
-          wrappedMcpServers(antigravityMcp?.mcpServers)
-        );
-        console.log("");
-      }
-      if (copilotPresent) {
-        const preHook = flatHaveNode9Hook2(copilotHooks?.hooks?.PreToolUse);
-        const postHook = flatHaveNode9Hook2(copilotHooks?.hooks?.PostToolUse);
-        const promptHook = flatHaveNode9Hook2(copilotHooks?.hooks?.UserPromptSubmit);
-        printAgentSection(
-          "GitHub Copilot",
-          [
-            { name: "PreToolUse  (node9 check)", present: preHook },
-            { name: "PostToolUse (node9 log)", present: postHook },
-            { name: "UserPromptSubmit (node9 check)", present: promptHook }
-          ],
-          wrappedMcpServers(copilotMcp?.mcpServers)
-        );
-        console.log("");
-      }
-      if (cursorConfig) {
-        printAgentSection("Cursor", [], wrappedMcpServers(cursorConfig.mcpServers));
-        console.log("");
-      }
-      if (hermesHooks) {
+      for (const a of wiring) {
+        if (a.wireState === "invalid") {
+          console.error(
+            chalk15.yellow(
+              `  \u26A0\uFE0F  ${a.label} config at ${a.settingsPath} is not valid ${a.configFormat} \u2014 showing as unwired.`
+            )
+          );
+        }
         printAgentSection(
-          "Hermes Agent",
-          [
-            { name: "pre_tool_call  (node9 check)", present: hermesHooks.pre },
-            { name: "post_tool_call (node9 log)", present: hermesHooks.post }
-          ],
-          null
-          // Hermes has no MCP surface
+          a.label,
+          a.hooks.map((h) => ({ name: h.label, present: h.wired })),
+          a.mcpServers
         );
         console.log("");
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@node9/proxy",
-  "version": "1.35.1",
+  "version": "1.35.2",
   "description": "The Sudo Command for AI Agents. Execution Security for Claude Code, Codex, Gemini, Cursor, Opencode, Pi, and any MCP server.",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",