@node9/proxy 1.44.0 → 1.45.0

package/dist/cli.mjs

@@ -219,8 +219,8 @@ function sanitizeConfig(raw) {
     }
   }
   const lines = result.error.issues.map((issue) => {
-    const path62 = issue.path.length > 0 ? issue.path.join(".") : "root";
-    return `  \u2022 ${path62}: ${issue.message}`;
+    const path64 = issue.path.length > 0 ? issue.path.join(".") : "root";
+    return `  \u2022 ${path64}: ${issue.message}`;
   });
   return {
     sanitized,
@@ -1341,9 +1341,9 @@ function matchesPattern(text, patterns) {
   const withoutDotSlash = text.replace(/^\.\//, "");
   return isMatch(withoutDotSlash) || isMatch(`./${withoutDotSlash}`);
 }
-function getNestedValue(obj, path62) {
+function getNestedValue(obj, path64) {
   if (!obj || typeof obj !== "object") return null;
-  const segments = path62.split(".");
+  const segments = path64.split(".");
   for (const seg of segments) {
     if (FORBIDDEN_PATH_SEGMENTS.has(seg)) return null;
   }
@@ -4153,7 +4153,7 @@ function installShield(name, shieldJson) {
   fs2.writeFileSync(tmp, JSON.stringify(shieldJson, null, 2), { mode: 384 });
   fs2.renameSync(tmp, filePath);
 }
-var USER_SHIELDS_DIR, SHIELDS, SHIELDS_STATE_FILE, RULE_KEY_MIGRATIONS;
+var USER_SHIELDS_DIR, SHIELDS, SHIELDS_STATE_FILE, RULE_KEY_MIGRATIONS, USER_SHIELDS_DIR_PATH;
 var init_shields = __esm({
   "src/shields.ts"() {
     "use strict";
@@ -4170,6 +4170,7 @@ var init_shields = __esm({
       // around the review-read-credentials rule.
       ["shield:project-jail:review-read-env-any-tool", "shield:project-jail:block-read-env-any-tool"]
     ];
+    USER_SHIELDS_DIR_PATH = USER_SHIELDS_DIR;
   }
 });
 
@@ -5040,7 +5041,30 @@ function explainIsSqlTool(toolName, toolInspection) {
   const fieldName = toolInspection[matchingPattern];
   return fieldName === "sql" || fieldName === "query";
 }
-async function explainPolicy(toolName, args) {
+async function explainPolicy(toolName, args, agent = EXPLAIN_AGENT) {
+  const derived = await deriveExplainTrace(toolName, args);
+  const engine = await evaluatePolicy2(toolName, args, agent);
+  if (derived.decision === engine.decision) return derived;
+  if (process.env.NODE9_DEBUG) {
+    console.error(
+      `[node9 explain] decision drift: trace=${derived.decision} engine=${engine.decision} for ${toolName} \u2014 engine wins (${engine.blockedByLabel ?? "engine"}).`
+    );
+  }
+  const engineStep = {
+    name: "Engine verdict (authoritative)",
+    outcome: engine.decision,
+    detail: `${engine.blockedByLabel ?? "policy engine"}${engine.reason ? `: ${engine.reason}` : ""} \u2014 this is the verdict the live hook actually enforces. It differs from the preview trace above, which models the policy tiers separately and can drift; the engine is authoritative.`,
+    isFinal: true
+  };
+  return {
+    ...derived,
+    steps: [...derived.steps, engineStep],
+    decision: engine.decision,
+    blockedByLabel: engine.blockedByLabel ?? derived.blockedByLabel,
+    ruleDescription: engine.ruleDescription ?? derived.ruleDescription
+  };
+}
+async function deriveExplainTrace(toolName, args) {
   const steps = [];
   const globalPath = path7.join(os6.homedir(), ".node9", "config.json");
   const projectPath = path7.join(process.cwd(), "node9.config.json");
@@ -5322,7 +5346,7 @@ async function explainPolicy(toolName, args) {
   });
   return { tool: toolName, args, waterfall, steps, decision: "allow" };
 }
-var SQL_DML_KEYWORDS2;
+var SQL_DML_KEYWORDS2, EXPLAIN_AGENT;
 var init_policy = __esm({
   "src/policy/index.ts"() {
     "use strict";
@@ -5333,6 +5357,7 @@ var init_policy = __esm({
     init_dist();
     init_dist();
     SQL_DML_KEYWORDS2 = /* @__PURE__ */ new Set(["select", "insert", "update", "delete", "merge", "upsert"]);
+    EXPLAIN_AGENT = "agent";
   }
 });
 
@@ -8611,9 +8636,9 @@ function writeToml(filePath, data) {
 async function setupCodex() {
   seedMcpPinsIfMissing();
   const homeDir2 = os12.homedir();
-  const configPath2 = path15.join(homeDir2, ".codex", "config.toml");
+  const configPath = path15.join(homeDir2, ".codex", "config.toml");
   const hooksPath = path15.join(homeDir2, ".codex", "hooks.json");
-  const config = readToml(configPath2) ?? {};
+  const config = readToml(configPath) ?? {};
   const servers = config.mcp_servers ?? {};
   let anythingChanged = false;
   const hooksFile = readJson(hooksPath) ?? {};
@@ -8688,7 +8713,7 @@ async function setupCodex() {
   if (!hasNode9McpServer(servers)) {
     servers["node9"] = NODE9_MCP_SERVER_ENTRY;
     config.mcp_servers = servers;
-    writeToml(configPath2, config);
+    writeToml(configPath, config);
     console.log(chalk.green("  \u2705 node9 MCP server added   \u2192 node9 mcp-server"));
     anythingChanged = true;
   }
@@ -8700,7 +8725,7 @@ async function setupCodex() {
   }
   if (serversToWrap.length > 0) {
     console.log(chalk.bold("The following existing entries will be modified:\n"));
-    console.log(chalk.white(`  ${configPath2}`));
+    console.log(chalk.white(`  ${configPath}`));
     for (const { name, upstream } of serversToWrap) {
       console.log(chalk.gray(`    \u2022 ${name}: "${upstream}" \u2192 node9 mcp --upstream "${upstream}"`));
     }
@@ -8715,7 +8740,7 @@ async function setupCodex() {
         };
       }
       config.mcp_servers = servers;
-      writeToml(configPath2, config);
+      writeToml(configPath, config);
       console.log(chalk.green(`
   \u2705 ${serversToWrap.length} MCP server(s) wrapped`));
       anythingChanged = true;
@@ -8763,7 +8788,7 @@ async function setupCodex() {
 }
 function teardownCodex() {
   const homeDir2 = os12.homedir();
-  const configPath2 = path15.join(homeDir2, ".codex", "config.toml");
+  const configPath = path15.join(homeDir2, ".codex", "config.toml");
   const hooksPath = path15.join(homeDir2, ".codex", "hooks.json");
   const hooksFile = readJson(hooksPath);
   if (hooksFile?.hooks) {
@@ -8781,7 +8806,7 @@ function teardownCodex() {
       console.log(chalk.green("  \u2705 Removed Node9 hooks from ~/.codex/hooks.json"));
     }
   }
-  const config = readToml(configPath2);
+  const config = readToml(configPath);
   if (!config?.mcp_servers) {
     console.log(chalk.blue("  \u2139\uFE0F  ~/.codex/config.toml not found \u2014 nothing to remove"));
     return;
@@ -8804,7 +8829,7 @@ function teardownCodex() {
     }
   }
   if (changed) {
-    writeToml(configPath2, config);
+    writeToml(configPath, config);
     console.log(chalk.green("  \u2705 Unwrapped MCP servers in ~/.codex/config.toml"));
   } else {
     console.log(chalk.blue("  \u2139\uFE0F  No Node9-wrapped MCP servers found in ~/.codex/config.toml"));
@@ -9059,18 +9084,18 @@ function teardownVSCode() {
 }
 async function setupClaudeDesktop() {
   seedMcpPinsIfMissing();
-  const configPath2 = claudeDesktopConfigPath();
-  if (!configPath2) {
+  const configPath = claudeDesktopConfigPath();
+  if (!configPath) {
     console.log(chalk.yellow("  \u26A0\uFE0F  Claude Desktop is not supported on this platform."));
     return;
   }
-  const config = readJson(configPath2) ?? {};
+  const config = readJson(configPath) ?? {};
   const servers = config.mcpServers ?? {};
   let anythingChanged = false;
   if (!hasNode9McpServer(servers)) {
     servers["node9"] = NODE9_MCP_SERVER_ENTRY;
     config.mcpServers = servers;
-    writeJson(configPath2, config);
+    writeJson(configPath, config);
     console.log(chalk.green("  \u2705 node9 MCP server added   \u2192 node9 mcp-server"));
     anythingChanged = true;
   }
@@ -9081,7 +9106,7 @@ async function setupClaudeDesktop() {
   }
   if (serversToWrap.length > 0) {
     console.log(chalk.bold("The following existing entries will be modified:\n"));
-    console.log(chalk.white(`  ${configPath2}`));
+    console.log(chalk.white(`  ${configPath}`));
     for (const { name, upstream } of serversToWrap) {
       console.log(chalk.gray(`    \u2022 ${name}: "${upstream}" \u2192 node9 mcp --upstream "${upstream}"`));
     }
@@ -9096,7 +9121,7 @@ async function setupClaudeDesktop() {
         };
       }
       config.mcpServers = servers;
-      writeJson(configPath2, config);
+      writeJson(configPath, config);
       console.log(chalk.green(`
   \u2705 ${serversToWrap.length} MCP server(s) wrapped`));
       anythingChanged = true;
@@ -9123,12 +9148,12 @@ async function setupClaudeDesktop() {
   }
 }
 function teardownClaudeDesktop() {
-  const configPath2 = claudeDesktopConfigPath();
-  if (!configPath2) {
+  const configPath = claudeDesktopConfigPath();
+  if (!configPath) {
     console.log(chalk.yellow("  \u26A0\uFE0F  Claude Desktop is not supported on this platform."));
     return;
   }
-  const config = readJson(configPath2);
+  const config = readJson(configPath);
   if (!config?.mcpServers) {
     console.log(chalk.blue("  \u2139\uFE0F  Claude Desktop config not found \u2014 nothing to remove"));
     return;
@@ -9136,7 +9161,7 @@ function teardownClaudeDesktop() {
   let changed = false;
   if (removeNode9McpServer(config.mcpServers)) {
     changed = true;
-    console.log(chalk.green(`  \u2705 Removed node9 MCP server entry from ${configPath2}`));
+    console.log(chalk.green(`  \u2705 Removed node9 MCP server entry from ${configPath}`));
   }
   for (const [name, server] of Object.entries(config.mcpServers)) {
     const args = server.args;
@@ -9151,7 +9176,7 @@ function teardownClaudeDesktop() {
     }
   }
   if (changed) {
-    writeJson(configPath2, config);
+    writeJson(configPath, config);
     console.log(chalk.green("  \u2705 Unwrapped MCP servers in Claude Desktop config"));
   } else {
     console.log(chalk.blue("  \u2139\uFE0F  No Node9-wrapped MCP servers found in Claude Desktop config"));
@@ -9179,7 +9204,7 @@ async function setupOpencode() {
   const homeDir2 = os12.homedir();
   const configDir = path15.join(homeDir2, ".config", "opencode");
   const pluginsDir = path15.join(configDir, "plugins");
-  const configPath2 = path15.join(configDir, "opencode.json");
+  const configPath = path15.join(configDir, "opencode.json");
   const pluginPath = path15.join(pluginsDir, OPENCODE_PLUGIN_NAME);
   try {
     fs13.mkdirSync(pluginsDir, { recursive: true });
@@ -9213,7 +9238,7 @@ async function setupOpencode() {
       );
     }
   }
-  const config = readJson(configPath2) ?? {};
+  const config = readJson(configPath) ?? {};
   const mcp = config.mcp ?? {};
   let configChanged = false;
   const desiredCommand = [...node9ArgvForShim(), "mcp-server"];
@@ -9234,7 +9259,7 @@ async function setupOpencode() {
       console.log(chalk.green("  \u2705 node9 MCP server added   \u2192 node9 mcp-server"));
     }
   }
-  if (configChanged) writeJson(configPath2, config);
+  if (configChanged) writeJson(configPath, config);
   if (pluginChanged || configChanged) {
     console.log(chalk.green.bold("\u{1F6E1}\uFE0F  Node9 is now protecting Opencode!"));
     console.log(chalk.gray("    Restart Opencode for changes to take effect."));
@@ -9247,7 +9272,7 @@ function teardownOpencode() {
   const homeDir2 = os12.homedir();
   const configDir = path15.join(homeDir2, ".config", "opencode");
   const pluginsDir = path15.join(configDir, "plugins");
-  const configPath2 = path15.join(configDir, "opencode.json");
+  const configPath = path15.join(configDir, "opencode.json");
   const pluginPath = path15.join(pluginsDir, OPENCODE_PLUGIN_NAME);
   try {
     if (fs13.existsSync(pluginPath)) {
@@ -9257,7 +9282,7 @@ function teardownOpencode() {
   } catch (err2) {
     console.log(chalk.yellow(`  \u26A0\uFE0F  Could not remove ${pluginPath}: ${String(err2)}`));
   }
-  const config = readJson(configPath2);
+  const config = readJson(configPath);
   if (!config) {
     console.log(chalk.blue("  \u2139\uFE0F  ~/.config/opencode/opencode.json not found \u2014 nothing to remove"));
     return;
@@ -9273,7 +9298,7 @@ function teardownOpencode() {
   }
   if (changed) {
     config.mcp = mcp;
-    writeJson(configPath2, config);
+    writeJson(configPath, config);
   } else {
     console.log(chalk.blue("  \u2139\uFE0F  No node9 entries found in ~/.config/opencode/opencode.json"));
   }
@@ -9344,15 +9369,15 @@ function hermesAllowlistPath(homeDir2 = os12.homedir()) {
 }
 function setupHermes() {
   const homeDir2 = os12.homedir();
-  const configPath2 = hermesConfigPath(homeDir2);
+  const configPath = hermesConfigPath(homeDir2);
   const allowlistPath = hermesAllowlistPath(homeDir2);
-  if (!fs13.existsSync(configPath2)) {
-    console.log(chalk.yellow(`  \u26A0\uFE0F  Hermes config not found at ${configPath2}`));
+  if (!fs13.existsSync(configPath)) {
+    console.log(chalk.yellow(`  \u26A0\uFE0F  Hermes config not found at ${configPath}`));
     console.log(chalk.gray("     Run `hermes setup` first, then re-run node9 agents add hermes."));
     return;
   }
   let anythingChanged = false;
-  const raw = fs13.readFileSync(configPath2, "utf-8");
+  const raw = fs13.readFileSync(configPath, "utf-8");
   const doc = yaml.parseDocument(raw);
   if (doc.errors.length > 0) {
     console.log(chalk.yellow(`  \u26A0\uFE0F  Hermes config.yaml has YAML parse errors:`));
@@ -9392,7 +9417,7 @@ function setupHermes() {
     anythingChanged = true;
   }
   if (anythingChanged) {
-    fs13.writeFileSync(configPath2, doc.toString());
+    fs13.writeFileSync(configPath, doc.toString());
   }
   let allowlist = {};
   if (fs13.existsSync(allowlistPath)) {
@@ -9435,24 +9460,24 @@ function setupHermes() {
 }
 function teardownHermes() {
   const homeDir2 = os12.homedir();
-  const configPath2 = hermesConfigPath(homeDir2);
+  const configPath = hermesConfigPath(homeDir2);
   const allowlistPath = hermesAllowlistPath(homeDir2);
-  if (!fs13.existsSync(configPath2)) {
-    console.log(chalk.blue(`  \u2139\uFE0F  ${configPath2} not found \u2014 nothing to remove`));
+  if (!fs13.existsSync(configPath)) {
+    console.log(chalk.blue(`  \u2139\uFE0F  ${configPath} not found \u2014 nothing to remove`));
     return;
   }
-  const raw = fs13.readFileSync(configPath2, "utf-8");
+  const raw = fs13.readFileSync(configPath, "utf-8");
   const doc = yaml.parseDocument(raw);
   if (doc.errors.length > 0) {
     console.log(
-      chalk.yellow(`  \u26A0\uFE0F  Skipping ${configPath2} \u2014 file has YAML parse errors, fix it manually.`)
+      chalk.yellow(`  \u26A0\uFE0F  Skipping ${configPath} \u2014 file has YAML parse errors, fix it manually.`)
     );
   } else {
-    teardownHermesConfigDoc(doc, configPath2);
+    teardownHermesConfigDoc(doc, configPath);
   }
   teardownHermesAllowlist(allowlistPath);
 }
-function teardownHermesConfigDoc(doc, configPath2) {
+function teardownHermesConfigDoc(doc, configPath) {
   let anythingChanged = false;
   const current = doc.toJS() ?? {};
   for (const { event } of HERMES_HOOK_PLAN) {
@@ -9474,10 +9499,10 @@ function teardownHermesConfigDoc(doc, configPath2) {
     anythingChanged = true;
   }
   if (anythingChanged) {
-    fs13.writeFileSync(configPath2, doc.toString());
-    console.log(chalk.green(`  \u2705 Removed Node9 hooks from ${configPath2}`));
+    fs13.writeFileSync(configPath, doc.toString());
+    console.log(chalk.green(`  \u2705 Removed Node9 hooks from ${configPath}`));
   } else {
-    console.log(chalk.blue(`  \u2139\uFE0F  No Node9 hooks found in ${configPath2}`));
+    console.log(chalk.blue(`  \u2139\uFE0F  No Node9 hooks found in ${configPath}`));
   }
 }
 function teardownHermesAllowlist(allowlistPath) {
@@ -12089,8 +12114,8 @@ function countScanFiles() {
   const geminiDir = path25.join(os22.homedir(), ".gemini", "tmp");
   if (fs23.existsSync(geminiDir)) {
     try {
-      for (const slug of fs23.readdirSync(geminiDir)) {
-        const p = path25.join(geminiDir, slug);
+      for (const slug2 of fs23.readdirSync(geminiDir)) {
+        const p = path25.join(geminiDir, slug2);
         try {
           if (!fs23.statSync(p).isDirectory()) continue;
           const chatsDir = path25.join(p, "chats");
@@ -12487,14 +12512,14 @@ function scanGeminiHistory(startDate, onProgress, onLine) {
     return result;
   }
   const ruleSources = buildRuleSources();
-  for (const slug of slugDirs) {
-    const slugPath = path25.join(tmpDir, slug);
+  for (const slug2 of slugDirs) {
+    const slugPath = path25.join(tmpDir, slug2);
     try {
       if (!fs23.statSync(slugPath).isDirectory()) continue;
     } catch {
       continue;
     }
-    let projLabel = stripTerminalEscapes(slug).slice(0, 40);
+    let projLabel = stripTerminalEscapes(slug2).slice(0, 40);
     try {
       projLabel = stripTerminalEscapes(
         fs23.readFileSync(path25.join(slugPath, ".project_root"), "utf-8").trim()
@@ -13833,7 +13858,7 @@ function renderPanelScorecard(input, now = /* @__PURE__ */ new Date()) {
   const hitShieldSet = new Set(
     shieldImpacts.filter((i) => i.totalCatches > 0).map((i) => i.shieldName)
   );
-  const zeroHitBuiltins = Object.keys(SHIELDS).filter((name) => !hitShieldSet.has(name)).sort();
+  const zeroHitBuiltins = Object.keys(BUILTIN_SHIELDS).filter((name) => !hitShieldSet.has(name)).sort();
   if (zeroHitBuiltins.length > 0) {
     shieldLines.push(mkLine([""]));
     shieldLines.push(mkLine([zeroHitBuiltins.join(" \xB7 "), chalk5.dim]));
@@ -18696,10 +18721,10 @@ __export(tail_exports, {
   startTail: () => startTail
 });
 import http3 from "http";
-import chalk34 from "chalk";
-import fs61 from "fs";
-import os53 from "os";
-import path59 from "path";
+import chalk35 from "chalk";
+import fs64 from "fs";
+import os54 from "os";
+import path61 from "path";
 import readline6 from "readline";
 import { spawn as spawn8 } from "child_process";
 function shortenPathSummary(s) {
@@ -18723,20 +18748,20 @@ function getModelContextLimit(model) {
   return 2e5;
 }
 function readSessionUsage() {
-  const projectsDir = path59.join(os53.homedir(), ".claude", "projects");
-  if (!fs61.existsSync(projectsDir)) return null;
+  const projectsDir = path61.join(os54.homedir(), ".claude", "projects");
+  if (!fs64.existsSync(projectsDir)) return null;
   let latestFile = null;
   let latestMtime = 0;
   try {
-    for (const dir of fs61.readdirSync(projectsDir)) {
-      const dirPath = path59.join(projectsDir, dir);
+    for (const dir of fs64.readdirSync(projectsDir)) {
+      const dirPath = path61.join(projectsDir, dir);
       try {
-        if (!fs61.statSync(dirPath).isDirectory()) continue;
-        for (const file of fs61.readdirSync(dirPath)) {
+        if (!fs64.statSync(dirPath).isDirectory()) continue;
+        for (const file of fs64.readdirSync(dirPath)) {
           if (!file.endsWith(".jsonl") || file.startsWith("agent-")) continue;
-          const filePath = path59.join(dirPath, file);
+          const filePath = path61.join(dirPath, file);
           try {
-            const mtime = fs61.statSync(filePath).mtimeMs;
+            const mtime = fs64.statSync(filePath).mtimeMs;
             if (mtime > latestMtime) {
               latestMtime = mtime;
               latestFile = filePath;
@@ -18751,7 +18776,7 @@ function readSessionUsage() {
   }
   if (!latestFile) return null;
   try {
-    const lines = fs61.readFileSync(latestFile, "utf-8").split("\n");
+    const lines = fs64.readFileSync(latestFile, "utf-8").split("\n");
     let lastModel = "";
     let lastInput = 0;
     let lastOutput = 0;
@@ -18776,10 +18801,10 @@ function readSessionUsage() {
   }
 }
 function formatContextStat(stat) {
-  const pctColor = stat.fillPct >= 80 ? chalk34.red : stat.fillPct >= 50 ? chalk34.yellow : chalk34.cyan;
+  const pctColor = stat.fillPct >= 80 ? chalk35.red : stat.fillPct >= 50 ? chalk35.yellow : chalk35.cyan;
   const k = (n) => `${Math.round(n / 1e3)}k`;
   const modelShort = stat.model.replace(/@.*$/, "").replace(/-\d{8}$/, "").replace(/^claude-/, "");
-  return chalk34.dim("ctx: ") + pctColor(`${stat.fillPct}%`) + chalk34.dim(
+  return chalk35.dim("ctx: ") + pctColor(`${stat.fillPct}%`) + chalk35.dim(
     ` (${k(stat.inputTokens)}/${k(getModelContextLimit(stat.model))}  out ${k(stat.outputTokens)}  \xB7 ${modelShort})`
   );
 }
@@ -18802,32 +18827,32 @@ function agentLabel(agent, mcpServer, sessionId) {
   const tag = sessionTag(sessionId);
   const tagSuffix = tag ? `\xB7${tag}` : "";
   if (!agent || agent === "Terminal") {
-    return mcpServer ? chalk34.dim(`[\u2192 ${mcpServer}] `) : "";
+    return mcpServer ? chalk35.dim(`[\u2192 ${mcpServer}] `) : "";
   }
   const short = agent === "Claude Code" ? "Claude" : agent === "Gemini CLI" ? "Gemini" : agent === "Unknown Agent" ? "" : agent.split(" ")[0];
-  if (!short) return mcpServer ? chalk34.dim(`[\u2192 ${mcpServer}] `) : "";
-  return mcpServer ? chalk34.dim(`[${short}${tagSuffix} \u2192 ${mcpServer}] `) : chalk34.dim(`[${short}${tagSuffix}] `);
+  if (!short) return mcpServer ? chalk35.dim(`[\u2192 ${mcpServer}] `) : "";
+  return mcpServer ? chalk35.dim(`[${short}${tagSuffix} \u2192 ${mcpServer}] `) : chalk35.dim(`[${short}${tagSuffix}] `);
 }
 function formatBase(activity) {
   const time = new Date(activity.ts).toLocaleTimeString([], { hour12: false });
   const icon = getIcon(activity.tool);
   const toolName = activity.tool.slice(0, 16).padEnd(16);
-  const argsStr = JSON.stringify(activity.args ?? {}).replace(/\s+/g, " ").replaceAll(os53.homedir(), "~");
+  const argsStr = JSON.stringify(activity.args ?? {}).replace(/\s+/g, " ").replaceAll(os54.homedir(), "~");
   const argsPreview = argsStr.length > 70 ? argsStr.slice(0, 70) + "\u2026" : argsStr;
-  return `${chalk34.gray(time)} ${icon} ${agentLabel(activity.agent, activity.mcpServer, activity.sessionId)}${chalk34.white.bold(toolName)} ${chalk34.dim(argsPreview)}`;
+  return `${chalk35.gray(time)} ${icon} ${agentLabel(activity.agent, activity.mcpServer, activity.sessionId)}${chalk35.white.bold(toolName)} ${chalk35.dim(argsPreview)}`;
 }
 function renderResult(activity, result) {
   const base = formatBase(activity);
   let status;
   if (result.status === "allow") {
-    status = chalk34.green("\u2713 ALLOW");
+    status = chalk35.green("\u2713 ALLOW");
   } else if (result.status === "dlp") {
-    status = chalk34.bgRed.white.bold(" \u{1F6E1}\uFE0F  DLP ");
+    status = chalk35.bgRed.white.bold(" \u{1F6E1}\uFE0F  DLP ");
   } else {
-    status = chalk34.red("\u2717 BLOCK");
+    status = chalk35.red("\u2717 BLOCK");
   }
   const cost = result.costEstimate ?? activity.costEstimate;
-  const costSuffix = cost == null ? "" : chalk34.dim(`  ~$${cost >= 1e-3 ? cost.toFixed(3) : "0.000"}`);
+  const costSuffix = cost == null ? "" : chalk35.dim(`  ~$${cost >= 1e-3 ? cost.toFixed(3) : "0.000"}`);
   if (process.stdout.isTTY) {
     if (pendingShownForId === activity.id && pendingWrappedLines > 1) {
       readline6.moveCursor(process.stdout, 0, -(pendingWrappedLines - 1));
@@ -18844,19 +18869,19 @@ function renderResult(activity, result) {
 }
 function renderPending(activity) {
   if (!process.stdout.isTTY) return;
-  const line = `${formatBase(activity)}  ${chalk34.yellow("\u25CF \u2026")}`;
+  const line = `${formatBase(activity)}  ${chalk35.yellow("\u25CF \u2026")}`;
   pendingShownForId = activity.id;
   pendingWrappedLines = wrappedLineCount(line);
   process.stdout.write(`${line}\r`);
 }
 async function ensureDaemon() {
   let pidPort = null;
-  if (fs61.existsSync(PID_FILE)) {
+  if (fs64.existsSync(PID_FILE)) {
     try {
-      const { port } = JSON.parse(fs61.readFileSync(PID_FILE, "utf-8"));
+      const { port } = JSON.parse(fs64.readFileSync(PID_FILE, "utf-8"));
       pidPort = port;
     } catch {
-      console.error(chalk34.dim("\u26A0\uFE0F  Could not read PID file; falling back to default port."));
+      console.error(chalk35.dim("\u26A0\uFE0F  Could not read PID file; falling back to default port."));
     }
   }
   const checkPort = pidPort ?? DAEMON_PORT;
@@ -18867,7 +18892,7 @@ async function ensureDaemon() {
     if (res.ok) return checkPort;
   } catch {
   }
-  console.log(chalk34.dim("\u{1F6E1}\uFE0F  Starting Node9 daemon..."));
+  console.log(chalk35.dim("\u{1F6E1}\uFE0F  Starting Node9 daemon..."));
   const child = spawn8(process.execPath, [process.argv[1], "daemon"], {
     detached: true,
     stdio: "ignore",
@@ -18884,7 +18909,7 @@ async function ensureDaemon() {
     } catch {
     }
   }
-  console.error(chalk34.red("\u274C Daemon failed to start. Try: node9 daemon start"));
+  console.error(chalk35.red("\u274C Daemon failed to start. Try: node9 daemon start"));
   process.exit(1);
 }
 function postDecisionHttp(id, decision, authToken, port, opts) {
@@ -18953,7 +18978,7 @@ function buildCardLines(req, localCount = 0) {
   const severityIcon = isBlock ? `${RED}\u{1F6D1}` : `${YELLOW}\u26A0 `;
   const rawDesc = req.riskMetadata?.ruleDescription ?? "";
   const description = rawDesc ? cleanReason(rawDesc) : "";
-  const agentSuffix = req.agent && req.agent !== "Terminal" ? ` ${RESET2}${chalk34.dim(`(${req.agent})`)}` : "";
+  const agentSuffix = req.agent && req.agent !== "Terminal" ? ` ${RESET2}${chalk35.dim(`(${req.agent})`)}` : "";
   const lines = [
     ``,
     `${BOLD2}${CYAN}\u2554\u2550\u2550 Node9 Approval Required \u2550\u2550\u2557${RESET2}`,
@@ -19009,9 +19034,9 @@ function buildRecoveryCardLines(req) {
   ];
 }
 function readApproversFromDisk() {
-  const configPath2 = path59.join(os53.homedir(), ".node9", "config.json");
+  const configPath = path61.join(os54.homedir(), ".node9", "config.json");
   try {
-    const raw = JSON.parse(fs61.readFileSync(configPath2, "utf-8"));
+    const raw = JSON.parse(fs64.readFileSync(configPath, "utf-8"));
     const settings = raw.settings ?? {};
     return settings.approvers ?? {};
   } catch {
@@ -19022,20 +19047,20 @@ function approverStatusLine() {
   const a = readApproversFromDisk();
   const fmt = (label2, key) => {
     const on = a[key] !== false;
-    return `[${key[0]}]${label2.slice(1)} ${on ? chalk34.green("\u2713") : chalk34.dim("\u2717")}`;
+    return `[${key[0]}]${label2.slice(1)} ${on ? chalk35.green("\u2713") : chalk35.dim("\u2717")}`;
   };
   return `${fmt("native", "native")}  ${fmt("cloud", "cloud")}  ${fmt("terminal", "terminal")}`;
 }
 function toggleApprover(channel) {
-  const configPath2 = path59.join(os53.homedir(), ".node9", "config.json");
+  const configPath = path61.join(os54.homedir(), ".node9", "config.json");
   try {
-    const raw = JSON.parse(fs61.readFileSync(configPath2, "utf-8"));
+    const raw = JSON.parse(fs64.readFileSync(configPath, "utf-8"));
     const settings = raw.settings ?? {};
     const approvers = settings.approvers ?? {};
     approvers[channel] = approvers[channel] === false;
     settings.approvers = approvers;
     raw.settings = settings;
-    fs61.writeFileSync(configPath2, JSON.stringify(raw, null, 2) + "\n");
+    fs64.writeFileSync(configPath, JSON.stringify(raw, null, 2) + "\n");
   } catch (err2) {
     process.stderr.write(`[node9] toggleApprover failed: ${String(err2)}
 `);
@@ -19067,7 +19092,7 @@ async function startTail(options = {}) {
       req2.end();
     });
     if (result.ok) {
-      console.log(chalk34.green("\u2713 Flight Recorder buffer cleared."));
+      console.log(chalk35.green("\u2713 Flight Recorder buffer cleared."));
     } else if (result.code === "ECONNREFUSED") {
       throw new Error("Daemon is not running. Start it with: node9 daemon start");
     } else if (result.code === "ETIMEDOUT") {
@@ -19113,7 +19138,7 @@ async function startTail(options = {}) {
       const channel = name === "n" ? "native" : name === "c" ? "cloud" : name === "t" ? "terminal" : null;
       if (channel) {
         toggleApprover(channel);
-        console.log(chalk34.dim(`  Approvers: ${approverStatusLine()}`));
+        console.log(chalk35.dim(`  Approvers: ${approverStatusLine()}`));
       }
     };
     process.stdin.on("keypress", idleKeypressHandler);
@@ -19179,7 +19204,7 @@ async function startTail(options = {}) {
           localAllowCounts.get(req2.toolName) ?? 0
         )
       );
-      const decisionStamp = action === "always-allow" ? chalk34.yellow("\u2605 ALWAYS ALLOW") : action === "trust" ? chalk34.cyan("\u23F1 TRUST 30m") : action === "allow" ? chalk34.green("\u2713 ALLOWED") : action === "redirect" ? chalk34.yellow("\u21A9 REDIRECT AI") : chalk34.red("\u2717 DENIED");
+      const decisionStamp = action === "always-allow" ? chalk35.yellow("\u2605 ALWAYS ALLOW") : action === "trust" ? chalk35.cyan("\u23F1 TRUST 30m") : action === "allow" ? chalk35.green("\u2713 ALLOWED") : action === "redirect" ? chalk35.yellow("\u21A9 REDIRECT AI") : chalk35.red("\u2717 DENIED");
       stampedLines.push(`  ${BOLD2}\u2192${RESET2} ${decisionStamp} ${GRAY}(terminal)${RESET2}`, ``);
       for (const line of stampedLines) process.stdout.write(line + "\n");
       process.stdout.write(SHOW_CURSOR);
@@ -19207,8 +19232,8 @@ async function startTail(options = {}) {
       }
       postDecisionHttp(req2.id, httpDecision, authToken, port, httpOpts).catch((err2) => {
         try {
-          fs61.appendFileSync(
-            path59.join(os53.homedir(), ".node9", "hook-debug.log"),
+          fs64.appendFileSync(
+            path61.join(os54.homedir(), ".node9", "hook-debug.log"),
             `[tail] POST /decision failed: ${String(err2)}
 `
           );
@@ -19230,7 +19255,7 @@ async function startTail(options = {}) {
       );
       const stampedLines = buildCardLines(req2, priorCount);
       if (externalDecision) {
-        const source = externalDecision === "allow" ? chalk34.green("\u2713 ALLOWED") : chalk34.red("\u2717 DENIED");
+        const source = externalDecision === "allow" ? chalk35.green("\u2713 ALLOWED") : chalk35.red("\u2717 DENIED");
         stampedLines.push(`  ${BOLD2}\u2192${RESET2} ${source} ${GRAY}(external)${RESET2}`, ``);
       }
       for (const line of stampedLines) process.stdout.write(line + "\n");
@@ -19272,31 +19297,31 @@ async function startTail(options = {}) {
     };
     process.stdin.on("keypress", onKeypress);
   }
-  const auditLog = path59.join(os53.homedir(), ".node9", "audit.log");
+  const auditLog = path61.join(os54.homedir(), ".node9", "audit.log");
   try {
-    const unackedDlp = fs61.readFileSync(auditLog, "utf-8").split("\n").filter((l) => l.includes('"response-dlp"')).length;
+    const unackedDlp = fs64.readFileSync(auditLog, "utf-8").split("\n").filter((l) => l.includes('"response-dlp"')).length;
     if (unackedDlp > 0) {
       console.log("");
       console.log(
-        chalk34.bgRed.white.bold(
+        chalk35.bgRed.white.bold(
           ` \u26A0\uFE0F  DLP ALERT: ${unackedDlp} secret${unackedDlp !== 1 ? "s" : ""} found in Claude response text \u2014 run: node9 dlp `
         )
       );
     }
   } catch {
   }
-  console.log(chalk34.cyan.bold(`
+  console.log(chalk35.cyan.bold(`
 \u{1F6F0}\uFE0F  Node9 tail`));
   if (canApprove) {
-    console.log(chalk34.dim("Card: [\u21B5/y] Allow  [n] Deny  [a] Always  [t] Trust 30m"));
-    console.log(chalk34.dim(`Approvers (toggle): ${approverStatusLine()}  [q] quit`));
+    console.log(chalk35.dim("Card: [\u21B5/y] Allow  [n] Deny  [a] Always  [t] Trust 30m"));
+    console.log(chalk35.dim(`Approvers (toggle): ${approverStatusLine()}  [q] quit`));
   }
   const ctxStat = readSessionUsage();
   if (ctxStat) console.log("  " + formatContextStat(ctxStat));
   if (options.history) {
-    console.log(chalk34.dim("Showing history + live events.\n"));
+    console.log(chalk35.dim("Showing history + live events.\n"));
   } else {
-    console.log(chalk34.dim("Showing live events only. Use --history to include past.\n"));
+    console.log(chalk35.dim("Showing live events only. Use --history to include past.\n"));
   }
   process.on("SIGINT", () => {
     exitIdleMode();
@@ -19306,7 +19331,7 @@ async function startTail(options = {}) {
       readline6.clearLine(process.stdout, 0);
       readline6.cursorTo(process.stdout, 0);
     }
-    console.log(chalk34.dim("\n\u{1F6F0}\uFE0F  Disconnected."));
+    console.log(chalk35.dim("\n\u{1F6F0}\uFE0F  Disconnected."));
     process.exit(0);
   });
   const STALL_THRESHOLD_MS = 6e4;
@@ -19314,11 +19339,11 @@ async function startTail(options = {}) {
     if (stallWarned) return;
     if (Date.now() - lastActivityFromDaemon < STALL_THRESHOLD_MS) return;
     try {
-      const auditMtime = fs61.statSync(auditLog).mtimeMs;
+      const auditMtime = fs64.statSync(auditLog).mtimeMs;
       if (Date.now() - auditMtime >= STALL_THRESHOLD_MS) return;
       console.log("");
       console.log(
-        chalk34.yellow(
+        chalk35.yellow(
           "\u26A0\uFE0F  Tail appears stalled \u2014 hooks are firing but no events are arriving. Try: node9 daemon restart"
         )
       );
@@ -19335,7 +19360,7 @@ async function startTail(options = {}) {
     },
     (res) => {
       if (res.statusCode !== 200) {
-        console.error(chalk34.red(`Failed to connect: HTTP ${res.statusCode}`));
+        console.error(chalk35.red(`Failed to connect: HTTP ${res.statusCode}`));
         process.exit(1);
       }
       if (canApprove) enterIdleMode();
@@ -19366,7 +19391,7 @@ async function startTail(options = {}) {
           readline6.clearLine(process.stdout, 0);
           readline6.cursorTo(process.stdout, 0);
         }
-        console.log(chalk34.red("\n\u274C Daemon disconnected."));
+        console.log(chalk35.red("\n\u274C Daemon disconnected."));
         process.exit(1);
       });
     }
@@ -19379,7 +19404,7 @@ async function startTail(options = {}) {
         const parsed = JSON.parse(rawData);
         const msg = parsed.message ?? "Flight recorder is down \u2014 run: node9 daemon restart";
         console.log("");
-        console.log(chalk34.bgRed.white.bold(` \u26A0\uFE0F  ${msg} `));
+        console.log(chalk35.bgRed.white.bold(` \u26A0\uFE0F  ${msg} `));
       } catch {
       }
       return;
@@ -19464,9 +19489,9 @@ async function startTail(options = {}) {
       const rawSummary = data.argsSummary ?? data.tool;
       const summary = shortenPathSummary(rawSummary);
       const fileCount = data.fileCount ?? 0;
-      const files = fileCount > 0 ? chalk34.dim(` \xB7 ${fileCount} file${fileCount === 1 ? "" : "s"}`) : "";
+      const files = fileCount > 0 ? chalk35.dim(` \xB7 ${fileCount} file${fileCount === 1 ? "" : "s"}`) : "";
       process.stdout.write(
-        `${chalk34.dim(time)}  ${chalk34.cyan("\u{1F4F8} snapshot")}  ${chalk34.dim(hash)}  ${summary}${files}
+        `${chalk35.dim(time)}  ${chalk35.cyan("\u{1F4F8} snapshot")}  ${chalk35.dim(hash)}  ${summary}${files}
 `
       );
       return;
@@ -19483,18 +19508,18 @@ async function startTail(options = {}) {
     if (event === "execution-result") {
       const exec = data;
       const time = new Date(Date.now()).toLocaleTimeString([], { hour12: false });
-      const arrow = exec.isError ? chalk34.red("  \u21B3 \u2717") : chalk34.green("  \u21B3 \u2713");
+      const arrow = exec.isError ? chalk35.red("  \u21B3 \u2717") : chalk35.green("  \u21B3 \u2713");
       const label2 = agentLabel(exec.agent, exec.mcpServer);
       const tool = (exec.tool ?? "").slice(0, 16);
-      const duration = typeof exec.durationMs === "number" ? chalk34.dim(` (${exec.durationMs}ms)`) : "";
+      const duration = typeof exec.durationMs === "number" ? chalk35.dim(` (${exec.durationMs}ms)`) : "";
       console.log(
-        `${chalk34.gray(time)} ${arrow} ${label2}${chalk34.dim(tool)}${chalk34.dim(" completed")}${duration}`
+        `${chalk35.gray(time)} ${arrow} ${label2}${chalk35.dim(tool)}${chalk35.dim(" completed")}${duration}`
       );
     }
   }
   req.on("error", (err2) => {
     const msg = err2.code === "ECONNREFUSED" ? "Daemon is not running. Start it with: node9 daemon start" : err2.message;
-    console.error(chalk34.red(`
+    console.error(chalk35.red(`
 \u274C ${msg}`));
     process.exit(1);
   });
@@ -19505,7 +19530,7 @@ var init_tail = __esm({
     "use strict";
     init_daemon2();
     init_daemon();
-    PID_FILE = path59.join(os53.homedir(), ".node9", "daemon.pid");
+    PID_FILE = path61.join(os54.homedir(), ".node9", "daemon.pid");
     ICONS = {
       bash: "\u{1F4BB}",
       shell: "\u{1F4BB}",
@@ -19553,9 +19578,9 @@ __export(hud_exports, {
   main: () => main,
   renderEnvironmentLine: () => renderEnvironmentLine
 });
-import fs62 from "fs";
-import path60 from "path";
-import os54 from "os";
+import fs65 from "fs";
+import path62 from "path";
+import os55 from "os";
 import http4 from "http";
 async function readStdin() {
   const chunks = [];
@@ -19631,9 +19656,9 @@ function formatTimeLeft(resetsAt) {
   return ` (${m}m left)`;
 }
 function safeReadJson(filePath) {
-  if (!fs62.existsSync(filePath)) return null;
+  if (!fs65.existsSync(filePath)) return null;
   try {
-    return JSON.parse(fs62.readFileSync(filePath, "utf-8"));
+    return JSON.parse(fs65.readFileSync(filePath, "utf-8"));
   } catch {
     return null;
   }
@@ -19654,12 +19679,12 @@ function countHooksInFile(filePath) {
   return Object.keys(cfg.hooks).length;
 }
 function countRulesInDir(rulesDir) {
-  if (!fs62.existsSync(rulesDir)) return 0;
+  if (!fs65.existsSync(rulesDir)) return 0;
   let count = 0;
   try {
-    for (const entry of fs62.readdirSync(rulesDir, { withFileTypes: true })) {
+    for (const entry of fs65.readdirSync(rulesDir, { withFileTypes: true })) {
       if (entry.isDirectory()) {
-        count += countRulesInDir(path60.join(rulesDir, entry.name));
+        count += countRulesInDir(path62.join(rulesDir, entry.name));
       } else if (entry.isFile() && entry.name.endsWith(".md")) {
         count++;
       }
@@ -19670,46 +19695,46 @@ function countRulesInDir(rulesDir) {
 }
 function isSamePath(a, b) {
   try {
-    return path60.resolve(a) === path60.resolve(b);
+    return path62.resolve(a) === path62.resolve(b);
   } catch {
     return false;
   }
 }
 function countConfigs(cwd) {
-  const homeDir2 = os54.homedir();
-  const claudeDir = path60.join(homeDir2, ".claude");
+  const homeDir2 = os55.homedir();
+  const claudeDir = path62.join(homeDir2, ".claude");
   let claudeMdCount = 0;
   let rulesCount = 0;
   let hooksCount = 0;
   const userMcpServers = /* @__PURE__ */ new Set();
   const projectMcpServers = /* @__PURE__ */ new Set();
-  if (fs62.existsSync(path60.join(claudeDir, "CLAUDE.md"))) claudeMdCount++;
-  rulesCount += countRulesInDir(path60.join(claudeDir, "rules"));
-  const userSettings = path60.join(claudeDir, "settings.json");
+  if (fs65.existsSync(path62.join(claudeDir, "CLAUDE.md"))) claudeMdCount++;
+  rulesCount += countRulesInDir(path62.join(claudeDir, "rules"));
+  const userSettings = path62.join(claudeDir, "settings.json");
   for (const name of getMcpServerNames(userSettings)) userMcpServers.add(name);
   hooksCount += countHooksInFile(userSettings);
-  const userClaudeJson = path60.join(homeDir2, ".claude.json");
+  const userClaudeJson = path62.join(homeDir2, ".claude.json");
   for (const name of getMcpServerNames(userClaudeJson)) userMcpServers.add(name);
   for (const name of getDisabledMcpServers(userClaudeJson, "disabledMcpServers")) {
     userMcpServers.delete(name);
   }
   if (cwd) {
-    if (fs62.existsSync(path60.join(cwd, "CLAUDE.md"))) claudeMdCount++;
-    if (fs62.existsSync(path60.join(cwd, "CLAUDE.local.md"))) claudeMdCount++;
-    const projectClaudeDir = path60.join(cwd, ".claude");
+    if (fs65.existsSync(path62.join(cwd, "CLAUDE.md"))) claudeMdCount++;
+    if (fs65.existsSync(path62.join(cwd, "CLAUDE.local.md"))) claudeMdCount++;
+    const projectClaudeDir = path62.join(cwd, ".claude");
     const overlapsUserScope = isSamePath(projectClaudeDir, claudeDir);
     if (!overlapsUserScope) {
-      if (fs62.existsSync(path60.join(projectClaudeDir, "CLAUDE.md"))) claudeMdCount++;
-      rulesCount += countRulesInDir(path60.join(projectClaudeDir, "rules"));
-      const projSettings = path60.join(projectClaudeDir, "settings.json");
+      if (fs65.existsSync(path62.join(projectClaudeDir, "CLAUDE.md"))) claudeMdCount++;
+      rulesCount += countRulesInDir(path62.join(projectClaudeDir, "rules"));
+      const projSettings = path62.join(projectClaudeDir, "settings.json");
       for (const name of getMcpServerNames(projSettings)) projectMcpServers.add(name);
       hooksCount += countHooksInFile(projSettings);
     }
-    if (fs62.existsSync(path60.join(projectClaudeDir, "CLAUDE.local.md"))) claudeMdCount++;
-    const localSettings = path60.join(projectClaudeDir, "settings.local.json");
+    if (fs65.existsSync(path62.join(projectClaudeDir, "CLAUDE.local.md"))) claudeMdCount++;
+    const localSettings = path62.join(projectClaudeDir, "settings.local.json");
     for (const name of getMcpServerNames(localSettings)) projectMcpServers.add(name);
     hooksCount += countHooksInFile(localSettings);
-    const mcpJsonServers = getMcpServerNames(path60.join(cwd, ".mcp.json"));
+    const mcpJsonServers = getMcpServerNames(path62.join(cwd, ".mcp.json"));
     const disabledMcpJson = getDisabledMcpServers(localSettings, "disabledMcpjsonServers");
     for (const name of disabledMcpJson) mcpJsonServers.delete(name);
     for (const name of mcpJsonServers) projectMcpServers.add(name);
@@ -19742,12 +19767,12 @@ function readActiveShieldsHud() {
     return shieldsCache.value;
   }
   try {
-    const shieldsPath = path60.join(os54.homedir(), ".node9", "shields.json");
-    if (!fs62.existsSync(shieldsPath)) {
+    const shieldsPath = path62.join(os55.homedir(), ".node9", "shields.json");
+    if (!fs65.existsSync(shieldsPath)) {
       shieldsCache = { value: [], ts: now };
       return [];
     }
-    const parsed = JSON.parse(fs62.readFileSync(shieldsPath, "utf-8"));
+    const parsed = JSON.parse(fs65.readFileSync(shieldsPath, "utf-8"));
     if (!Array.isArray(parsed.active)) {
       shieldsCache = { value: [], ts: now };
       return [];
@@ -19849,17 +19874,17 @@ function renderContextLine(stdin) {
 async function main() {
   try {
     const [stdin, daemonStatus2] = await Promise.all([readStdin(), queryDaemon()]);
-    if (fs62.existsSync(path60.join(os54.homedir(), ".node9", "hud-debug"))) {
+    if (fs65.existsSync(path62.join(os55.homedir(), ".node9", "hud-debug"))) {
       try {
-        const logPath = path60.join(os54.homedir(), ".node9", "hud-debug.log");
+        const logPath = path62.join(os55.homedir(), ".node9", "hud-debug.log");
         const MAX_LOG_SIZE = 10 * 1024 * 1024;
         let size = 0;
         try {
-          size = fs62.statSync(logPath).size;
+          size = fs65.statSync(logPath).size;
         } catch {
         }
         if (size < MAX_LOG_SIZE) {
-          fs62.appendFileSync(
+          fs65.appendFileSync(
             logPath,
             JSON.stringify({ ts: (/* @__PURE__ */ new Date()).toISOString(), stdin }) + "\n"
           );
@@ -19879,12 +19904,12 @@ async function main() {
     const showEnvCounts = (() => {
       try {
         const cwd = stdin.cwd ?? process.cwd();
-        for (const configPath2 of [
-          path60.join(cwd, "node9.config.json"),
-          path60.join(os54.homedir(), ".node9", "config.json")
+        for (const configPath of [
+          path62.join(cwd, "node9.config.json"),
+          path62.join(os55.homedir(), ".node9", "config.json")
         ]) {
-          if (!fs62.existsSync(configPath2)) continue;
-          const cfg = JSON.parse(fs62.readFileSync(configPath2, "utf-8"));
+          if (!fs65.existsSync(configPath)) continue;
+          const cfg = JSON.parse(fs65.readFileSync(configPath, "utf-8"));
           const hud = cfg.settings?.hud;
           if (hud && "showEnvironmentCounts" in hud) return hud.showEnvironmentCounts !== false;
         }
@@ -19930,10 +19955,10 @@ init_core();
 init_setup();
 init_daemon2();
 import { Command } from "commander";
-import chalk35 from "chalk";
-import fs63 from "fs";
-import path61 from "path";
-import os55 from "os";
+import chalk36 from "chalk";
+import fs66 from "fs";
+import path63 from "path";
+import os56 from "os";
 import { spawn as spawn9 } from "child_process";
 import { confirm as confirm2 } from "@inquirer/prompts";
 
@@ -21562,9 +21587,135 @@ function registerLogCommand(program2) {
 
 // src/cli/commands/shield.ts
 init_shields();
+import chalk10 from "chalk";
+import fs46 from "fs";
+
+// src/shields/build.ts
+function escapeRegex(s) {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function slug(s) {
+  return s.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "") || "rule";
+}
+var B = "[\\s/\\\\]";
+var SEP = "[/\\\\]";
+function pathToRegexFragment(rawPath) {
+  const tail = rawPath.trim().replace(/^~[\\/]?/, "").replace(/^\$\{?HOME\}?[\\/]?/, "").replace(/^\/(?:home|Users)\/[^\\/]+[\\/]?/, "").replace(/^[\\/]+/, "").replace(/[\\/]+$/, "");
+  const segments = tail.split(/[\\/]+/).filter(Boolean).map(escapeRegex);
+  if (segments.length === 0) return "";
+  return `(^|${B})${segments.join(SEP)}(${B}|$)`;
+}
+function toolRule(tool, verdict, reason) {
+  return {
+    name: `${verdict}-${slug(tool)}`,
+    tool,
+    conditions: [],
+    verdict,
+    reason: reason ?? `${tool} is restricted by this shield`
+  };
+}
+function pathRules(rawPath, verdict, reason) {
+  const value = pathToRegexFragment(rawPath);
+  if (!value) return [];
+  const why = reason ?? `Accessing ${rawPath} is restricted by this shield`;
+  const s = slug(rawPath);
+  return [
+    {
+      name: `${verdict}-path-${s}-bash`,
+      tool: "bash",
+      conditions: [{ field: "command", op: "matches", value }],
+      verdict,
+      reason: why
+    },
+    {
+      name: `${verdict}-path-${s}-anytool`,
+      tool: "*",
+      conditions: [{ field: "file_path", op: "matches", value }],
+      verdict,
+      reason: why
+    }
+  ];
+}
+function buildShield(input) {
+  const smartRules = [
+    ...(input.blockTools ?? []).map((t) => toolRule(t, "block")),
+    ...(input.reviewTools ?? []).map((t) => toolRule(t, "review")),
+    ...(input.blockPaths ?? []).flatMap((p) => pathRules(p, "block")),
+    ...(input.reviewPaths ?? []).flatMap((p) => pathRules(p, "review"))
+  ];
+  return {
+    name: input.name,
+    description: input.description ?? `Custom shield "${input.name}" created with node9 shield create`,
+    aliases: input.aliases ?? [],
+    smartRules,
+    dangerousWords: []
+  };
+}
+
+// src/shields/create.ts
+init_dist();
+init_shields();
+init_audit();
+import fs45 from "fs";
+import path43 from "path";
+function builtinNames() {
+  const names = /* @__PURE__ */ new Set();
+  for (const def of Object.values(BUILTIN_SHIELDS)) {
+    names.add(def.name.toLowerCase());
+    for (const a of def.aliases ?? []) names.add(a.toLowerCase());
+  }
+  return names;
+}
+function createShield(def, opts = {}) {
+  const name = def.name;
+  if (builtinNames().has(name.toLowerCase())) {
+    return {
+      ok: false,
+      error: `"${name}" is a built-in shield \u2014 choose a different name (a user shield with this name would shadow the built-in).`
+    };
+  }
+  const filePath = path43.join(USER_SHIELDS_DIR_PATH, `${name}.json`);
+  if (!opts.overwrite && fs45.existsSync(filePath)) {
+    return {
+      ok: false,
+      error: `Shield "${name}" already exists at ${filePath}. Pass --overwrite to replace it.`
+    };
+  }
+  if (def.smartRules.length === 0) {
+    return {
+      ok: false,
+      error: "Shield has no rules \u2014 add at least one --block/--review tool or path."
+    };
+  }
+  if (opts.viaMcp && def.smartRules.some((r) => r.verdict === "allow")) {
+    return {
+      ok: false,
+      error: "allow-verdict rules are not permitted over MCP (they would weaken node9). Use the CLI."
+    };
+  }
+  const v = validateShieldDefinition(def);
+  if ("error" in v) {
+    return { ok: false, error: v.error };
+  }
+  installShield(name, def);
+  let enabled = false;
+  if (opts.enable) {
+    const active = readActiveShields();
+    if (!active.includes(name)) writeActiveShields([...active, name]);
+    enabled = true;
+  }
+  appendConfigAudit({
+    event: "shield-create",
+    shield: name,
+    via: opts.viaMcp ? "mcp" : "cli",
+    enabled
+  });
+  return { ok: true, path: filePath, enabled, ruleCount: def.smartRules.length };
+}
+
+// src/cli/commands/shield.ts
 init_audit();
 init_config();
-import chalk10 from "chalk";
 
 // src/utils/https-fetch.ts
 import https4 from "https";
@@ -21867,6 +22018,73 @@ function registerShieldCommand(program2) {
       process.exit(1);
     });
   });
+  const collect = (val, prev) => [...prev, val];
+  shieldCmd.command("create <name>").description("Author a new shield from block/review tools and paths").option("--desc <text>", "Shield description").option("--block-tool <tool>", "Block a tool entirely (repeatable)", collect, []).option("--review-tool <tool>", "Require approval for a tool (repeatable)", collect, []).option("--block-path <path>", "Block access to a path (repeatable)", collect, []).option("--review-path <path>", "Require approval to access a path (repeatable)", collect, []).option("--from-file <path>", "Build from a shield JSON file (overrides inline flags)").option("--enable", "Activate the shield immediately").option("--overwrite", "Replace an existing user shield of the same name").action(
+    (name, opts) => {
+      if (!/^[a-zA-Z0-9_-]+$/.test(name)) {
+        console.error(
+          chalk10.red(
+            `
+\u274C Invalid shield name: only alphanumeric characters, hyphens, and underscores are allowed
+`
+          )
+        );
+        process.exit(1);
+      }
+      let def;
+      if (opts.fromFile) {
+        let raw;
+        try {
+          raw = JSON.parse(fs46.readFileSync(opts.fromFile, "utf-8"));
+        } catch (err2) {
+          console.error(
+            chalk10.red(`
+\u274C Could not read/parse ${opts.fromFile}: ${String(err2)}
+`)
+          );
+          process.exit(1);
+          return;
+        }
+        def = { ...raw, name };
+      } else {
+        def = buildShield({
+          name,
+          description: opts.desc,
+          blockTools: opts.blockTool,
+          reviewTools: opts.reviewTool,
+          blockPaths: opts.blockPath,
+          reviewPaths: opts.reviewPath
+        });
+      }
+      const res = createShield(def, {
+        enable: opts.enable,
+        overwrite: opts.overwrite,
+        viaMcp: false
+      });
+      if (!res.ok) {
+        console.error(chalk10.red(`
+\u274C ${res.error}
+`));
+        process.exit(1);
+        return;
+      }
+      console.log(
+        chalk10.green(`
+\u2705 Shield "${name}" created`) + chalk10.gray(` \u2014 ${res.ruleCount} rule(s) \u2192 ${res.path}`)
+      );
+      if (res.enabled) {
+        console.log(chalk10.gray(`   Active now.`));
+      } else {
+        console.log(
+          chalk10.gray(`   Activate it with: ${chalk10.cyan(`node9 shield enable ${name}`)}`)
+        );
+      }
+      console.log(
+        chalk10.gray(`   Preview a call:   ${chalk10.cyan(`node9 explain bash "<command>"`)}
+`)
+      );
+    }
+  );
 }
 function registerConfigShowCommand(program2) {
   program2.command("config show").description(
@@ -21940,8 +22158,8 @@ init_daemon();
 init_config();
 init_agent_wiring();
 import chalk11 from "chalk";
-import fs45 from "fs";
-import path43 from "path";
+import fs47 from "fs";
+import path44 from "path";
 import os40 from "os";
 import { execSync } from "child_process";
 function registerDoctorCommand(program2, version2) {
@@ -21992,10 +22210,10 @@ function registerDoctorCommand(program2, version2) {
       );
     }
     section("Configuration");
-    const globalConfigPath = path43.join(homeDir2, ".node9", "config.json");
-    if (fs45.existsSync(globalConfigPath)) {
+    const globalConfigPath = path44.join(homeDir2, ".node9", "config.json");
+    if (fs47.existsSync(globalConfigPath)) {
       try {
-        JSON.parse(fs45.readFileSync(globalConfigPath, "utf-8"));
+        JSON.parse(fs47.readFileSync(globalConfigPath, "utf-8"));
         pass("~/.node9/config.json found and valid");
       } catch {
         fail("~/.node9/config.json is invalid JSON", "Run: node9 init --force");
@@ -22003,10 +22221,10 @@ function registerDoctorCommand(program2, version2) {
     } else {
       warn("~/.node9/config.json not found (using defaults)", "Run: node9 init");
     }
-    const projectConfigPath = path43.join(process.cwd(), "node9.config.json");
-    if (fs45.existsSync(projectConfigPath)) {
+    const projectConfigPath = path44.join(process.cwd(), "node9.config.json");
+    if (fs47.existsSync(projectConfigPath)) {
       try {
-        JSON.parse(fs45.readFileSync(projectConfigPath, "utf-8"));
+        JSON.parse(fs47.readFileSync(projectConfigPath, "utf-8"));
         pass("node9.config.json found and valid (project)");
       } catch {
         fail(
@@ -22015,8 +22233,8 @@ function registerDoctorCommand(program2, version2) {
         );
       }
     }
-    const credsPath = path43.join(homeDir2, ".node9", "credentials.json");
-    if (fs45.existsSync(credsPath)) {
+    const credsPath = path44.join(homeDir2, ".node9", "credentials.json");
+    if (fs47.existsSync(credsPath)) {
       pass("Cloud credentials found (~/.node9/credentials.json)");
     } else {
       warn(
@@ -22060,7 +22278,7 @@ function registerDoctorCommand(program2, version2) {
     try {
       const { shipLagBytes: shipLagBytes2, readWatermark: readWatermark2, AUDIT_SHIP_WATERMARK: AUDIT_SHIP_WATERMARK2 } = await Promise.resolve().then(() => (init_audit_shipper(), audit_shipper_exports));
       const cfg = getConfig();
-      const creds = fs45.existsSync(path43.join(os40.homedir(), ".node9", "credentials.json"));
+      const creds = fs47.existsSync(path44.join(os40.homedir(), ".node9", "credentials.json"));
       if (!creds) {
         warn("Not logged in \u2014 audit rows stay local", "Run: node9 login <api-key>");
       } else if (!cfg.settings.approvers.cloud) {
@@ -22110,8 +22328,8 @@ function registerDoctorCommand(program2, version2) {
 
 // src/cli/commands/audit.ts
 import chalk12 from "chalk";
-import fs46 from "fs";
-import path44 from "path";
+import fs48 from "fs";
+import path45 from "path";
 import os41 from "os";
 function formatRelativeTime(timestamp) {
   const diff = Date.now() - new Date(timestamp).getTime();
@@ -22125,14 +22343,14 @@ function formatRelativeTime(timestamp) {
 }
 function registerAuditCommand(program2) {
   program2.command("audit").description("View local execution audit log").option("--tail <n>", "Number of entries to show", "20").option("--tool <pattern>", "Filter by tool name (substring match)").option("--deny", "Show only denied actions").option("--json", "Output raw JSON").action((options) => {
-    const logPath = path44.join(os41.homedir(), ".node9", "audit.log");
-    if (!fs46.existsSync(logPath)) {
+    const logPath = path45.join(os41.homedir(), ".node9", "audit.log");
+    if (!fs48.existsSync(logPath)) {
       console.log(
         chalk12.yellow("No audit logs found. Run node9 with an agent to generate entries.")
       );
       return;
     }
-    const raw = fs46.readFileSync(logPath, "utf-8");
+    const raw = fs48.readFileSync(logPath, "utf-8");
     const lines = raw.split("\n").filter((l) => l.trim() !== "");
     let entries = lines.flatMap((line) => {
       try {
@@ -22191,9 +22409,9 @@ import chalk13 from "chalk";
 init_costSync();
 init_litellm();
 init_cost_codex();
-import fs47 from "fs";
+import fs49 from "fs";
 import os42 from "os";
-import path45 from "path";
+import path46 from "path";
 var TEST_COMMAND_RE3 = /(?:^|\s)(npm\s+(?:run\s+)?test|npx\s+(?:vitest|jest|mocha)|yarn\s+(?:run\s+)?test|pnpm\s+(?:run\s+)?test|vitest|jest|mocha|pytest|py\.test|cargo\s+test|go\s+test|bundle\s+exec\s+rspec|rspec|phpunit|dotnet\s+test)\b/i;
 function buildTestTimestamps(allEntries) {
   const testTs = /* @__PURE__ */ new Set();
@@ -22273,8 +22491,8 @@ function getDateRange(period, now) {
   }
 }
 function parseAuditLog(logPath) {
-  if (!fs47.existsSync(logPath)) return [];
-  const raw = fs47.readFileSync(logPath, "utf-8");
+  if (!fs49.existsSync(logPath)) return [];
+  const raw = fs49.readFileSync(logPath, "utf-8");
   return raw.split("\n").flatMap((line) => {
     if (!line.trim()) return [];
     try {
@@ -22321,25 +22539,25 @@ function freezeClaudeCost(acc) {
   };
 }
 function processClaudeCostProject(proj, projectsDir, start, end, acc) {
-  const projPath = path45.join(projectsDir, proj);
+  const projPath = path46.join(projectsDir, proj);
   let files;
   try {
-    const stat = fs47.statSync(projPath);
+    const stat = fs49.statSync(projPath);
     if (!stat.isDirectory()) return;
-    files = fs47.readdirSync(projPath).filter((f) => f.endsWith(".jsonl") && !f.startsWith("agent-"));
+    files = fs49.readdirSync(projPath).filter((f) => f.endsWith(".jsonl") && !f.startsWith("agent-"));
   } catch {
     return;
   }
   const startMs = start.getTime();
   for (const file of files) {
-    const filePath = path45.join(projPath, file);
+    const filePath = path46.join(projPath, file);
     try {
-      if (fs47.statSync(filePath).mtimeMs < startMs) continue;
+      if (fs49.statSync(filePath).mtimeMs < startMs) continue;
     } catch {
       continue;
     }
     try {
-      const raw = fs47.readFileSync(filePath, "utf-8");
+      const raw = fs49.readFileSync(filePath, "utf-8");
       for (const line of raw.split("\n")) {
         if (!line.trim()) continue;
         let entry;
@@ -22389,10 +22607,10 @@ function processClaudeCostProject(proj, projectsDir, start, end, acc) {
 }
 function loadClaudeCost(start, end, projectsDir) {
   const acc = emptyClaudeCostAccumulator();
-  if (!fs47.existsSync(projectsDir)) return freezeClaudeCost(acc);
+  if (!fs49.existsSync(projectsDir)) return freezeClaudeCost(acc);
   let dirs;
   try {
-    dirs = fs47.readdirSync(projectsDir);
+    dirs = fs49.readdirSync(projectsDir);
   } catch {
     return freezeClaudeCost(acc);
   }
@@ -22404,7 +22622,7 @@ function loadClaudeCost(start, end, projectsDir) {
 function processCodexCostFile(filePath, start, end, acc) {
   let lines;
   try {
-    lines = fs47.readFileSync(filePath, "utf-8").split("\n");
+    lines = fs49.readFileSync(filePath, "utf-8").split("\n");
   } catch {
     return;
   }
@@ -22459,31 +22677,31 @@ function processCodexCostFile(filePath, start, end, acc) {
 }
 function listCodexSessionFiles2(sessionsBase) {
   const jsonlFiles = [];
-  if (!fs47.existsSync(sessionsBase)) return jsonlFiles;
+  if (!fs49.existsSync(sessionsBase)) return jsonlFiles;
   try {
-    for (const year of fs47.readdirSync(sessionsBase)) {
-      const yearPath = path45.join(sessionsBase, year);
+    for (const year of fs49.readdirSync(sessionsBase)) {
+      const yearPath = path46.join(sessionsBase, year);
       try {
-        if (!fs47.statSync(yearPath).isDirectory()) continue;
+        if (!fs49.statSync(yearPath).isDirectory()) continue;
       } catch {
         continue;
       }
-      for (const month of fs47.readdirSync(yearPath)) {
-        const monthPath = path45.join(yearPath, month);
+      for (const month of fs49.readdirSync(yearPath)) {
+        const monthPath = path46.join(yearPath, month);
         try {
-          if (!fs47.statSync(monthPath).isDirectory()) continue;
+          if (!fs49.statSync(monthPath).isDirectory()) continue;
         } catch {
           continue;
         }
-        for (const day of fs47.readdirSync(monthPath)) {
-          const dayPath = path45.join(monthPath, day);
+        for (const day of fs49.readdirSync(monthPath)) {
+          const dayPath = path46.join(monthPath, day);
           try {
-            if (!fs47.statSync(dayPath).isDirectory()) continue;
+            if (!fs49.statSync(dayPath).isDirectory()) continue;
           } catch {
             continue;
           }
-          for (const file of fs47.readdirSync(dayPath)) {
-            if (file.endsWith(".jsonl")) jsonlFiles.push(path45.join(dayPath, file));
+          for (const file of fs49.readdirSync(dayPath)) {
+            if (file.endsWith(".jsonl")) jsonlFiles.push(path46.join(dayPath, file));
           }
         }
       }
@@ -22548,13 +22766,13 @@ function freezeGeminiCost(acc) {
 function processGeminiCostFile(filePath, projectKey, start, end, acc) {
   const startMs = start.getTime();
   try {
-    if (fs47.statSync(filePath).mtimeMs < startMs) return;
+    if (fs49.statSync(filePath).mtimeMs < startMs) return;
   } catch {
     return;
   }
   let raw;
   try {
-    raw = fs47.readFileSync(filePath, "utf-8");
+    raw = fs49.readFileSync(filePath, "utf-8");
   } catch {
     return;
   }
@@ -22603,30 +22821,30 @@ function listGeminiSessionFiles2(geminiTmpDir2) {
   const out = [];
   let dirs;
   try {
-    if (!fs47.statSync(geminiTmpDir2).isDirectory()) return out;
-    dirs = fs47.readdirSync(geminiTmpDir2);
+    if (!fs49.statSync(geminiTmpDir2).isDirectory()) return out;
+    dirs = fs49.readdirSync(geminiTmpDir2);
   } catch {
     return out;
   }
   for (const proj of dirs) {
-    const chatsDir = path45.join(geminiTmpDir2, proj, "chats");
+    const chatsDir = path46.join(geminiTmpDir2, proj, "chats");
     let files;
     try {
-      if (!fs47.statSync(chatsDir).isDirectory()) continue;
-      files = fs47.readdirSync(chatsDir);
+      if (!fs49.statSync(chatsDir).isDirectory()) continue;
+      files = fs49.readdirSync(chatsDir);
     } catch {
       continue;
     }
     for (const f of files) {
       if (!f.endsWith(".jsonl")) continue;
-      out.push({ projectKey: proj, file: path45.join(chatsDir, f) });
+      out.push({ projectKey: proj, file: path46.join(chatsDir, f) });
     }
   }
   return out;
 }
 function loadGeminiCost(start, end, geminiTmpDir2) {
   const acc = emptyGeminiAccumulator();
-  if (!fs47.existsSync(geminiTmpDir2)) return freezeGeminiCost(acc);
+  if (!fs49.existsSync(geminiTmpDir2)) return freezeGeminiCost(acc);
   for (const { projectKey, file } of listGeminiSessionFiles2(geminiTmpDir2)) {
     processGeminiCostFile(file, projectKey, start, end, acc);
   }
@@ -22634,11 +22852,11 @@ function loadGeminiCost(start, end, geminiTmpDir2) {
 }
 function aggregateReportFromAudit(period, opts = {}) {
   const now = opts.now ?? /* @__PURE__ */ new Date();
-  const auditLogPath = opts.auditLogPath ?? path45.join(os42.homedir(), ".node9", "audit.log");
-  const claudeProjectsDir = opts.claudeProjectsDir ?? path45.join(os42.homedir(), ".claude", "projects");
-  const codexSessionsDir2 = opts.codexSessionsDir ?? path45.join(os42.homedir(), ".codex", "sessions");
-  const geminiTmpDir2 = opts.geminiTmpDir ?? path45.join(os42.homedir(), ".gemini", "tmp");
-  const hasAuditFile = fs47.existsSync(auditLogPath);
+  const auditLogPath = opts.auditLogPath ?? path46.join(os42.homedir(), ".node9", "audit.log");
+  const claudeProjectsDir = opts.claudeProjectsDir ?? path46.join(os42.homedir(), ".claude", "projects");
+  const codexSessionsDir2 = opts.codexSessionsDir ?? path46.join(os42.homedir(), ".codex", "sessions");
+  const geminiTmpDir2 = opts.geminiTmpDir ?? path46.join(os42.homedir(), ".gemini", "tmp");
+  const hasAuditFile = fs49.existsSync(auditLogPath);
   const allEntries = opts.preloadedAuditEntries ?? parseAuditLog(auditLogPath);
   const unackedDlp = allEntries.filter((e) => e.source === "response-dlp");
   const { start, end } = getDateRange(period, now);
@@ -23337,8 +23555,8 @@ init_core();
 init_daemon();
 init_agent_wiring();
 import chalk15 from "chalk";
-import fs48 from "fs";
-import path46 from "path";
+import fs50 from "fs";
+import path47 from "path";
 import os43 from "os";
 function printAgentSection(label2, hookPairs, wrapped) {
   console.log(chalk15.bold(`  ${label2}`));
@@ -23393,13 +23611,13 @@ function registerStatusCommand(program2) {
     console.log("");
     const modeLabel = settings.mode === "audit" ? chalk15.blue("audit") : settings.mode === "strict" ? chalk15.red("strict") : chalk15.white("standard");
     console.log(`  Mode:    ${modeLabel}`);
-    const projectConfig = path46.join(process.cwd(), "node9.config.json");
-    const globalConfig = path46.join(os43.homedir(), ".node9", "config.json");
+    const projectConfig = path47.join(process.cwd(), "node9.config.json");
+    const globalConfig = path47.join(os43.homedir(), ".node9", "config.json");
     console.log(
-      `  Local:   ${fs48.existsSync(projectConfig) ? chalk15.green("Active (node9.config.json)") : chalk15.gray("Not present")}`
+      `  Local:   ${fs50.existsSync(projectConfig) ? chalk15.green("Active (node9.config.json)") : chalk15.gray("Not present")}`
     );
     console.log(
-      `  Global:  ${fs48.existsSync(globalConfig) ? chalk15.green("Active (~/.node9/config.json)") : chalk15.gray("Not present")}`
+      `  Global:  ${fs50.existsSync(globalConfig) ? chalk15.green("Active (~/.node9/config.json)") : chalk15.gray("Not present")}`
     );
     if (mergedConfig.policy.sandboxPaths.length > 0) {
       console.log(
@@ -23445,8 +23663,8 @@ init_setup();
 init_shields();
 init_service();
 import chalk16 from "chalk";
-import fs49 from "fs";
-import path47 from "path";
+import fs51 from "fs";
+import path48 from "path";
 import os44 from "os";
 import https5 from "https";
 var DEFAULT_SHIELDS = ["bash-safe", "filesystem", "project-jail"];
@@ -23533,32 +23751,32 @@ function registerInitCommand(program2) {
         }
         console.log("");
       }
-      const configPath2 = path47.join(os44.homedir(), ".node9", "config.json");
-      const isFirstInstall = !fs49.existsSync(configPath2);
-      if (fs49.existsSync(configPath2) && !options.force) {
+      const configPath = path48.join(os44.homedir(), ".node9", "config.json");
+      const isFirstInstall = !fs51.existsSync(configPath);
+      if (fs51.existsSync(configPath) && !options.force) {
         try {
-          const existing = JSON.parse(fs49.readFileSync(configPath2, "utf-8"));
+          const existing = JSON.parse(fs51.readFileSync(configPath, "utf-8"));
           const settings = existing.settings ?? {};
           if (settings.mode !== chosenMode) {
             settings.mode = chosenMode;
             existing.settings = settings;
-            fs49.writeFileSync(configPath2, JSON.stringify(existing, null, 2) + "\n");
+            fs51.writeFileSync(configPath, JSON.stringify(existing, null, 2) + "\n");
             console.log(chalk16.green(`\u2705 Mode updated: ${chosenMode}`));
           } else {
-            console.log(chalk16.blue(`\u2139\uFE0F  Config already exists: ${configPath2}`));
+            console.log(chalk16.blue(`\u2139\uFE0F  Config already exists: ${configPath}`));
           }
         } catch {
-          console.log(chalk16.blue(`\u2139\uFE0F  Config already exists: ${configPath2}`));
+          console.log(chalk16.blue(`\u2139\uFE0F  Config already exists: ${configPath}`));
         }
       } else {
         const configToSave = {
           ...DEFAULT_CONFIG,
           settings: { ...DEFAULT_CONFIG.settings, mode: chosenMode }
         };
-        const dir = path47.dirname(configPath2);
-        if (!fs49.existsSync(dir)) fs49.mkdirSync(dir, { recursive: true });
-        fs49.writeFileSync(configPath2, JSON.stringify(configToSave, null, 2) + "\n");
-        console.log(chalk16.green(`\u2705 Config created: ${configPath2}`));
+        const dir = path48.dirname(configPath);
+        if (!fs51.existsSync(dir)) fs51.mkdirSync(dir, { recursive: true });
+        fs51.writeFileSync(configPath, JSON.stringify(configToSave, null, 2) + "\n");
+        console.log(chalk16.green(`\u2705 Config created: ${configPath}`));
         console.log(chalk16.gray(`   Mode: ${chosenMode}`));
       }
       if (options.skipSetup) return;
@@ -23662,7 +23880,7 @@ function registerInitCommand(program2) {
 }
 
 // src/cli/commands/undo.ts
-import path48 from "path";
+import path49 from "path";
 import chalk18 from "chalk";
 
 // src/tui/undo-navigator.ts
@@ -23821,7 +24039,7 @@ function findMatchingCwd(startDir, history) {
   let dir = startDir;
   while (true) {
     if (cwds.has(dir)) return dir;
-    const parent = path48.dirname(dir);
+    const parent = path49.dirname(dir);
     if (parent === dir) return null;
     dir = parent;
   }
@@ -24456,13 +24674,83 @@ function registerMcpGatewayCommand(program2) {
 
 // src/mcp-server/index.ts
 import readline5 from "readline";
-import fs50 from "fs";
-import os45 from "os";
-import path49 from "path";
+import fs53 from "fs";
+import os46 from "os";
+import path51 from "path";
 import { spawnSync as spawnSync4 } from "child_process";
 init_core();
 init_daemon();
 init_shields();
+
+// src/auth/egress-config.ts
+import fs52 from "fs";
+import os45 from "os";
+import path50 from "path";
+var DEFAULT_EGRESS = {
+  enabled: false,
+  mode: "review",
+  allow: [],
+  deny: [],
+  allowPrivate: true
+};
+function egressConfigPath() {
+  return path50.join(os45.homedir(), ".node9", "config.json");
+}
+function readEgressRawConfig() {
+  let text;
+  try {
+    text = fs52.readFileSync(egressConfigPath(), "utf8");
+  } catch (err2) {
+    if (err2.code === "ENOENT") return {};
+    throw err2;
+  }
+  try {
+    return JSON.parse(text);
+  } catch {
+    throw new Error(
+      `${egressConfigPath()} is not valid JSON \u2014 fix it before changing egress (refusing to overwrite).`
+    );
+  }
+}
+function writeEgressRawConfig(config) {
+  const p = egressConfigPath();
+  fs52.mkdirSync(path50.dirname(p), { recursive: true });
+  fs52.writeFileSync(p, JSON.stringify(config, null, 2) + "\n", { mode: 384 });
+}
+function applyEgress(config, change) {
+  const policy = config.policy = config.policy ?? {};
+  const existing = policy.egress ?? {};
+  policy.egress = { ...DEFAULT_EGRESS, ...existing, ...change };
+  return config;
+}
+function getEgress() {
+  const raw = readEgressRawConfig();
+  const existing = raw.policy?.egress ?? {};
+  return { ...DEFAULT_EGRESS, ...existing };
+}
+function setEgress(change) {
+  const config = readEgressRawConfig();
+  applyEgress(config, change);
+  writeEgressRawConfig(config);
+}
+function addEgressHost(list, host) {
+  const config = readEgressRawConfig();
+  const existing = config.policy?.egress ?? {};
+  const current = { ...DEFAULT_EGRESS, ...existing };
+  const updated = current[list].includes(host) ? current[list] : [...current[list], host];
+  applyEgress(config, { [list]: updated });
+  writeEgressRawConfig(config);
+}
+function normalizeEgressHost(host) {
+  return host.trim().toLowerCase();
+}
+var EGRESS_HOST_RE = /^(\*\.)?[a-z0-9][a-z0-9.-]*\.[a-z]{2,}$/;
+function isValidEgressHost(host) {
+  return EGRESS_HOST_RE.test(host);
+}
+
+// src/mcp-server/index.ts
+init_dist();
 function ok(id, result) {
   return JSON.stringify({ jsonrpc: "2.0", id: id ?? null, result });
 }
@@ -24473,12 +24761,20 @@ var TOOL_CAPABILITY = {
   // weaken — gated over MCP
   node9_shield_disable: "weaken",
   node9_approver_set: "weaken",
+  // NOTE: egress LOOSENING (allow a host / turn egress off) is intentionally NOT
+  // exposed over MCP — it has no legitimate agent use case (it's exactly the
+  // exfil-exit the egress gate exists to prevent) and would be attack surface
+  // even gated. A human loosens egress at the CLI: `node9 egress allow|off`.
   // add / restorative — always allowed
   node9_shield_enable: "add",
   node9_rule_add: "add",
   // already block/review-only — handleRuleAdd rejects "allow"
   node9_undo_revert: "add",
   // restorative
+  node9_egress_protect: "add",
+  // enable/strengthen egress (monotonic — never reduces)
+  node9_egress_deny: "add",
+  // add a deny host (deny always wins)
   // readonly
   node9_status: "readonly",
   node9_config_get: "readonly",
@@ -24492,7 +24788,8 @@ var TOOL_CAPABILITY = {
   node9_shield_list: "readonly",
   node9_approver_list: "readonly",
   node9_undo_list: "readonly",
-  node9_undo_detail: "readonly"
+  node9_undo_detail: "readonly",
+  node9_egress_status: "readonly"
 };
 function capabilityOf(tool) {
   return TOOL_CAPABILITY[tool] ?? "readonly";
@@ -24748,7 +25045,41 @@ var TOOLS = [
       },
       required: ["name", "tool", "field", "pattern", "verdict", "reason"]
     }
+  },
+  {
+    name: "node9_egress_status",
+    description: "Show egress (outbound network) control: whether it is enabled, the mode (off / review / block), and your allow + deny host lists. Common dev/LLM hosts (github, npm, pypi, anthropic, \u2026) are always allowed by a built-in list. Read-only.",
+    inputSchema: { type: "object", properties: {}, required: [] }
+  },
+  {
+    name: "node9_egress_protect",
+    description: 'Turn on egress control (or strengthen it). mode="review" prompts on unknown hosts; mode="block" hard-blocks them. Monotonic \u2014 it only ever ADDS protection and never reduces it (a request for review will not downgrade an existing block). Only adds protection, so it is always allowed over MCP.',
+    inputSchema: {
+      type: "object",
+      properties: {
+        mode: {
+          type: "string",
+          enum: ["review", "block"],
+          description: 'Enforcement to apply. "review" = prompt, "block" = deny. Defaults to review.'
+        }
+      },
+      required: []
+    }
+  },
+  {
+    name: "node9_egress_deny",
+    description: "Add a host to the egress deny list (deny always wins over allow). Only adds protection, so it is always allowed over MCP. Host is an FQDN or wildcard glob (e.g. evil.com or *.evil.com).",
+    inputSchema: {
+      type: "object",
+      properties: {
+        host: { type: "string", description: "Host to deny (FQDN or *.glob)." }
+      },
+      required: ["host"]
+    }
   }
+  // Egress LOOSENING (allow a host / turn egress off) is deliberately CLI-only —
+  // see the note in TOOL_CAPABILITY. The agent can see and tighten egress over
+  // MCP, but never loosen it.
 ];
 function handleStatus() {
   const config = getConfig();
@@ -24769,13 +25100,13 @@ function handleStatus() {
   lines.push(`Active shields: ${activeShields.length > 0 ? activeShields.join(", ") : "none"}`);
   lines.push(`Smart rules: ${config.policy.smartRules.length} loaded`);
   lines.push(`DLP: ${config.policy.dlp?.enabled !== false ? "enabled" : "disabled"}`);
-  const projectConfig = path49.join(process.cwd(), "node9.config.json");
-  const globalConfig = path49.join(os45.homedir(), ".node9", "config.json");
+  const projectConfig = path51.join(process.cwd(), "node9.config.json");
+  const globalConfig = path51.join(os46.homedir(), ".node9", "config.json");
   lines.push(
-    `Project config (node9.config.json): ${fs50.existsSync(projectConfig) ? "present" : "not found"}`
+    `Project config (node9.config.json): ${fs53.existsSync(projectConfig) ? "present" : "not found"}`
   );
   lines.push(
-    `Global config (~/.node9/config.json): ${fs50.existsSync(globalConfig) ? "present" : "not found"}`
+    `Global config (~/.node9/config.json): ${fs53.existsSync(globalConfig) ? "present" : "not found"}`
   );
   return lines.join("\n");
 }
@@ -24849,21 +25180,53 @@ function handleShieldDisable(args) {
   writeActiveShields(active.filter((s) => s !== name));
   return `Shield "${name}" disabled.`;
 }
-var GLOBAL_CONFIG_PATH = path49.join(os45.homedir(), ".node9", "config.json");
+function handleEgressStatus() {
+  const e = getConfig().policy.egress;
+  const state = !e.enabled ? "OFF \u2014 the agent can reach any host" : e.mode === "block" ? "LOCKED (block) \u2014 unknown hosts are denied" : "WATCHING (review) \u2014 unknown hosts prompt for approval";
+  const lines = [
+    `Egress control: ${state}`,
+    `${DEFAULT_EGRESS_ALLOWLIST.length} common dev/LLM hosts are always allowed (github, npm, pypi, anthropic, \u2026).`,
+    `Your allow list: ${e.allow.length ? e.allow.join(", ") : "(none)"}`,
+    `Your deny list:  ${e.deny.length ? e.deny.join(", ") : "(none)"}`
+  ];
+  return lines.join("\n");
+}
+function handleEgressProtect(args) {
+  const rawMode = args.mode;
+  if (rawMode !== void 0 && rawMode !== "review" && rawMode !== "block") {
+    throw new Error('mode must be "review" or "block".');
+  }
+  const requested = rawMode ?? "review";
+  const current = getEgress();
+  const mode = current.enabled && current.mode === "block" ? "block" : requested;
+  setEgress({ enabled: true, mode });
+  return mode === "block" ? "Egress is now LOCKED (block) \u2014 unknown hosts are denied. Routine hosts stay allowed." : "Egress is now WATCHED (review) \u2014 unknown hosts prompt for approval.";
+}
+function handleEgressDeny(args) {
+  const host = typeof args.host === "string" ? normalizeEgressHost(args.host) : "";
+  if (!isValidEgressHost(host)) {
+    throw new Error(
+      `Invalid host: "${String(args.host)}". Use an FQDN or *.glob (e.g. *.evil.com).`
+    );
+  }
+  addEgressHost("deny", host);
+  return `Denied egress to ${host} (deny always wins over allow).`;
+}
+var GLOBAL_CONFIG_PATH = path51.join(os46.homedir(), ".node9", "config.json");
 var APPROVER_CHANNELS = ["native", "browser", "cloud", "terminal"];
 function readGlobalConfigRaw() {
   try {
-    if (fs50.existsSync(GLOBAL_CONFIG_PATH)) {
-      return JSON.parse(fs50.readFileSync(GLOBAL_CONFIG_PATH, "utf-8"));
+    if (fs53.existsSync(GLOBAL_CONFIG_PATH)) {
+      return JSON.parse(fs53.readFileSync(GLOBAL_CONFIG_PATH, "utf-8"));
     }
   } catch {
   }
   return {};
 }
 function writeGlobalConfigRaw(data) {
-  const dir = path49.dirname(GLOBAL_CONFIG_PATH);
-  if (!fs50.existsSync(dir)) fs50.mkdirSync(dir, { recursive: true });
-  fs50.writeFileSync(GLOBAL_CONFIG_PATH, JSON.stringify(data, null, 2) + "\n");
+  const dir = path51.dirname(GLOBAL_CONFIG_PATH);
+  if (!fs53.existsSync(dir)) fs53.mkdirSync(dir, { recursive: true });
+  fs53.writeFileSync(GLOBAL_CONFIG_PATH, JSON.stringify(data, null, 2) + "\n");
 }
 function handleApproverList() {
   const config = getConfig();
@@ -24907,9 +25270,9 @@ function handleApproverSet(args) {
 function handleAuditGet(args) {
   const limit = Math.min(typeof args.limit === "number" ? args.limit : 20, 100);
   const filter = typeof args.filter === "string" && args.filter !== "all" ? args.filter : null;
-  const auditPath = path49.join(os45.homedir(), ".node9", "audit.log");
-  if (!fs50.existsSync(auditPath)) return "No audit log found.";
-  const rawLines = fs50.readFileSync(auditPath, "utf-8").trim().split("\n").filter(Boolean);
+  const auditPath = path51.join(os46.homedir(), ".node9", "audit.log");
+  if (!fs53.existsSync(auditPath)) return "No audit log found.";
+  const rawLines = fs53.readFileSync(auditPath, "utf-8").trim().split("\n").filter(Boolean);
   const parsed = [];
   for (const line of rawLines) {
     try {
@@ -25187,6 +25550,12 @@ function runMcpServer() {
           text = handlePostureMcp(toolArgs);
         } else if (toolName === "node9_explain") {
           text = handleExplainMcp(toolArgs);
+        } else if (toolName === "node9_egress_status") {
+          text = handleEgressStatus();
+        } else if (toolName === "node9_egress_protect") {
+          text = handleEgressProtect(toolArgs);
+        } else if (toolName === "node9_egress_deny") {
+          text = handleEgressDeny(toolArgs);
         } else {
           process.stdout.write(err(id, -32601, `Unknown tool: ${toolName}`) + "\n");
           return;
@@ -25277,7 +25646,7 @@ function registerTrustCommand(program2) {
 // src/cli/commands/mcp-pin.ts
 init_mcp_pin();
 import chalk21 from "chalk";
-import fs51 from "fs";
+import fs54 from "fs";
 function registerMcpPinCommand(program2) {
   const pinCmd = program2.command("mcp").description("Manage MCP server tool definition pinning (rug pull defense)");
   const pinSubCmd = pinCmd.command("pin").description("Manage pinned MCP server tool definitions");
@@ -25288,7 +25657,7 @@ function registerMcpPinCommand(program2) {
     let repoCorrupt = false;
     if (found.source === "repo") {
       try {
-        const raw = fs51.readFileSync(found.path, "utf-8");
+        const raw = fs54.readFileSync(found.path, "utf-8");
         const parsed = JSON.parse(raw);
         repoEntries = parsed.servers ?? {};
       } catch {
@@ -25777,50 +26146,10 @@ function registerPostureCommand(program2) {
 init_config();
 init_dist();
 import chalk26 from "chalk";
-import fs52 from "fs";
-import os46 from "os";
-import path50 from "path";
-var DEFAULT_EGRESS = {
-  enabled: false,
-  mode: "review",
-  allow: [],
-  deny: [],
-  allowPrivate: true
-};
-function configPath() {
-  return path50.join(os46.homedir(), ".node9", "config.json");
-}
-function readRawConfig() {
-  let text;
-  try {
-    text = fs52.readFileSync(configPath(), "utf8");
-  } catch (err2) {
-    if (err2.code === "ENOENT") return {};
-    throw err2;
-  }
-  try {
-    return JSON.parse(text);
-  } catch {
-    throw new Error(
-      `${configPath()} is not valid JSON \u2014 fix it before changing egress (refusing to overwrite).`
-    );
-  }
-}
-function writeRawConfig(config) {
-  const p = configPath();
-  fs52.mkdirSync(path50.dirname(p), { recursive: true });
-  fs52.writeFileSync(p, JSON.stringify(config, null, 2) + "\n", { mode: 384 });
-}
-function applyEgress(config, change) {
-  const policy = config.policy = config.policy ?? {};
-  const existing = policy.egress ?? {};
-  policy.egress = { ...DEFAULT_EGRESS, ...existing, ...change };
-  return config;
-}
-function withConfig(fn) {
-  let config;
+function guard(fn) {
   try {
-    config = readRawConfig();
+    fn();
+    return true;
   } catch (err2) {
     console.error(chalk26.red(`
   \u2717 ${err2.message}
@@ -25828,20 +26157,12 @@ function withConfig(fn) {
     process.exitCode = 1;
     return false;
   }
-  fn(config);
-  writeRawConfig(config);
-  return true;
 }
 function mutate(change) {
-  return withConfig((config) => applyEgress(config, change));
+  return guard(() => setEgress(change));
 }
 function addHost(list, host) {
-  return withConfig((config) => {
-    const existing = config.policy?.egress ?? {};
-    const current = { ...DEFAULT_EGRESS, ...existing };
-    const updated = current[list].includes(host) ? current[list] : [...current[list], host];
-    applyEgress(config, { [list]: updated });
-  });
+  return guard(() => addEgressHost(list, host));
 }
 function showStatus() {
   const e = getConfig().policy.egress;
@@ -25900,16 +26221,191 @@ function registerEgressCommand(program2) {
   egress.action(showStatus);
 }
 
-// src/cli/commands/sandbox.ts
-init_config();
+// src/cli/commands/jail.ts
 import chalk27 from "chalk";
+
+// src/shields/jail.ts
 import fs55 from "fs";
-import path53 from "path";
+import os47 from "os";
+import path52 from "path";
+init_shields();
+var USER_JAIL_SHIELD = "user-jail";
+function jailStorePath() {
+  return path52.join(os47.homedir(), ".node9", "jail-paths.json");
+}
+function readJailPaths() {
+  let text;
+  try {
+    text = fs55.readFileSync(jailStorePath(), "utf8");
+  } catch (err2) {
+    if (err2.code === "ENOENT") return [];
+    throw err2;
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch {
+    throw new Error(`${jailStorePath()} is not valid JSON \u2014 fix it before changing the jail.`);
+  }
+  if (!Array.isArray(parsed.paths)) return [];
+  return parsed.paths.filter(
+    (p) => !!p && typeof p.path === "string" && (p.verdict === "block" || p.verdict === "review")
+  );
+}
+function writeJailPaths(paths) {
+  const p = jailStorePath();
+  fs55.mkdirSync(path52.dirname(p), { recursive: true });
+  fs55.writeFileSync(p, JSON.stringify({ paths }, null, 2) + "\n", { mode: 384 });
+}
+function addJailPath(rawPath, verdict) {
+  const norm = rawPath.trim();
+  if (!pathToRegexFragment(norm)) {
+    throw new Error(
+      `"${rawPath}" is too broad to jail \u2014 give a specific path (e.g. ~/.gmail-mcp), not a home or root directory.`
+    );
+  }
+  const next = [...readJailPaths().filter((p) => p.path !== norm), { path: norm, verdict }];
+  writeJailPaths(next);
+  return next;
+}
+function removeJailPath(rawPath) {
+  const norm = rawPath.trim();
+  const before = readJailPaths();
+  const after = before.filter((p) => p.path !== norm);
+  const removed = after.length !== before.length;
+  if (removed) writeJailPaths(after);
+  return { removed, paths: after };
+}
+function regenerateUserJail(paths) {
+  const file = path52.join(USER_SHIELDS_DIR_PATH, `${USER_JAIL_SHIELD}.json`);
+  if (paths.length === 0) {
+    const active2 = readActiveShields();
+    if (active2.includes(USER_JAIL_SHIELD)) {
+      writeActiveShields(active2.filter((s) => s !== USER_JAIL_SHIELD));
+    }
+    try {
+      fs55.rmSync(file, { force: true });
+    } catch {
+    }
+    return;
+  }
+  const def = buildShield({
+    name: USER_JAIL_SHIELD,
+    description: "User-added credential jail paths (node9 jail add)",
+    blockPaths: paths.filter((p) => p.verdict === "block").map((p) => p.path),
+    reviewPaths: paths.filter((p) => p.verdict === "review").map((p) => p.path)
+  });
+  installShield(USER_JAIL_SHIELD, def);
+  const active = readActiveShields();
+  if (!active.includes(USER_JAIL_SHIELD)) writeActiveShields([...active, USER_JAIL_SHIELD]);
+}
+
+// src/cli/commands/jail.ts
+init_audit();
+var BUILTIN_JAIL = [
+  "~/.ssh \u2014 SSH private keys",
+  "~/.aws \u2014 AWS credentials",
+  ".env files",
+  "credential files \u2014 credentials.json, .netrc, .npmrc, .docker, .kube, gcloud"
+];
+function registerJailCommand(program2) {
+  const jail = program2.command("jail").description("Grow the credential jail \u2014 block/review reads of your sensitive paths");
+  jail.command("add <path>").description("Add a path to the jail (default: block reads; --review to soften)").option("--review", "Require human approval instead of hard-blocking reads").action((p, opts) => {
+    const verdict = opts.review ? "review" : "block";
+    try {
+      const paths = addJailPath(p, verdict);
+      regenerateUserJail(paths);
+      appendConfigAudit({ event: "jail-add", path: p.trim(), verdict });
+    } catch (err2) {
+      console.error(chalk27.red(`
+\u274C ${err2.message}
+`));
+      process.exit(1);
+      return;
+    }
+    console.log(chalk27.green(`
+\u2705 Jailed ${p} (${verdict}).`));
+    console.log(
+      chalk27.gray(
+        `   AI reads of this path now ${verdict === "block" ? "BLOCK" : "require approval"}.`
+      )
+    );
+    console.log(chalk27.gray(`   Preview: ${chalk27.cyan(`node9 explain bash "cat ${p}"`)}
+`));
+  });
+  jail.command("remove <path>").description("Remove a user-added jail path (built-in paths are not removable)").action((p) => {
+    let result;
+    try {
+      result = removeJailPath(p);
+    } catch (err2) {
+      console.error(chalk27.red(`
+\u274C ${err2.message}
+`));
+      process.exit(1);
+      return;
+    }
+    if (!result.removed) {
+      console.error(chalk27.yellow(`
+\u2139\uFE0F  "${p}" is not a user-added jail path.
+`));
+      console.error(chalk27.gray(`   Run ${chalk27.cyan("node9 jail list")} to see your paths.
+`));
+      process.exit(1);
+      return;
+    }
+    try {
+      regenerateUserJail(result.paths);
+      appendConfigAudit({ event: "jail-remove", path: p.trim() });
+    } catch (err2) {
+      console.error(chalk27.red(`
+\u274C ${err2.message}
+`));
+      process.exit(1);
+      return;
+    }
+    console.log(chalk27.green(`
+\u2705 Removed ${p} from the jail.
+`));
+  });
+  jail.command("list").description("Show built-in + user-added jail paths").action(() => {
+    console.log(chalk27.bold("\n\u{1F512} Credential Jail\n"));
+    console.log(chalk27.gray("  Built-in (always on, not removable):"));
+    for (const b of BUILTIN_JAIL) console.log(`    ${chalk27.gray("\u2022")} ${b}`);
+    console.log("");
+    let user;
+    try {
+      user = readJailPaths();
+    } catch (err2) {
+      console.error(chalk27.red(`  \u2717 ${err2.message}
+`));
+      process.exit(1);
+      return;
+    }
+    if (user.length === 0) {
+      console.log(
+        chalk27.gray("  Your paths: (none) \u2014 add one with ") + chalk27.cyan("node9 jail add <path>")
+      );
+    } else {
+      console.log(chalk27.gray("  Your paths (removable):"));
+      for (const u of user) {
+        const v = u.verdict === "block" ? chalk27.red("block ") : chalk27.yellow("review");
+        console.log(`    ${v}  ${chalk27.cyan(u.path)}`);
+      }
+    }
+    console.log("");
+  });
+}
+
+// src/cli/commands/sandbox.ts
+init_config();
+import chalk28 from "chalk";
+import fs58 from "fs";
+import path55 from "path";
 import { spawnSync as spawnSync6 } from "child_process";
 
 // src/sandbox/config.ts
-import fs53 from "fs";
-import path51 from "path";
+import fs56 from "fs";
+import path53 from "path";
 import { parse as parseYaml, stringify as stringifyYaml } from "yaml";
 var SANDBOX_CONFIG_FILE = "node9.sandbox.yaml";
 var FORBIDDEN_ENV = /* @__PURE__ */ new Set(["NODE9_API_KEY", "NODE9_API_URL"]);
@@ -25982,16 +26478,16 @@ function scaffoldSandboxYaml(agent) {
   return header + stringifyYaml(defaultSandboxConfig(agent));
 }
 function sandboxConfigPath(cwd = process.cwd()) {
-  return path51.join(cwd, SANDBOX_CONFIG_FILE);
+  return path53.join(cwd, SANDBOX_CONFIG_FILE);
 }
 function loadSandboxConfig(cwd = process.cwd(), fallbackAgent = "claude") {
   const p = sandboxConfigPath(cwd);
-  if (!fs53.existsSync(p)) {
+  if (!fs56.existsSync(p)) {
     throw new Error(`sandbox: ${SANDBOX_CONFIG_FILE} not found \u2014 run \`node9 sandbox new\` first.`);
   }
   let raw;
   try {
-    raw = parseYaml(fs53.readFileSync(p, "utf-8"));
+    raw = parseYaml(fs56.readFileSync(p, "utf-8"));
   } catch (err2) {
     throw new Error(
       `sandbox: ${SANDBOX_CONFIG_FILE} is not valid YAML \u2014 ${err2.message}`
@@ -26050,13 +26546,13 @@ init_templates();
 
 // src/sandbox/runtime.ts
 init_templates();
-import fs54 from "fs";
-import os47 from "os";
-import path52 from "path";
+import fs57 from "fs";
+import os48 from "os";
+import path54 from "path";
 import crypto8 from "crypto";
 import { spawnSync as spawnSync5 } from "child_process";
 function sandboxDataDir(cwd = process.cwd()) {
-  return path52.join(cwd, ".node9", "sandbox", "data");
+  return path54.join(cwd, ".node9", "sandbox", "data");
 }
 function detectEngine(engine) {
   const r = spawnSync5(engine, ["--version"], { encoding: "utf-8" });
@@ -26067,7 +26563,7 @@ function detectEngine(engine) {
 }
 function agentCredentialsMount(agent) {
   const rel = agent === "codex" ? ".codex/auth.json" : ".claude/.credentials.json";
-  return { hostPath: path52.join(os47.homedir(), rel), target: `/home/${RUN_AS_USER}/${rel}` };
+  return { hostPath: path54.join(os48.homedir(), rel), target: `/home/${RUN_AS_USER}/${rel}` };
 }
 function buildRunArgs(opts) {
   const { config, workspaceHostPath, dataHostPath, allowlistHostPath, agentArgs } = opts;
@@ -26077,7 +26573,7 @@ function buildRunArgs(opts) {
   args.push("-v", `${allowlistHostPath}:${ALLOWED_DOMAINS_PATH}:ro`);
   if (config.node9.mountAgentCredentials) {
     const creds = agentCredentialsMount(config.agent);
-    if (fs54.existsSync(creds.hostPath)) {
+    if (fs57.existsSync(creds.hostPath)) {
       args.push("-v", `${creds.hostPath}:${creds.target}`);
     }
   }
@@ -26095,30 +26591,30 @@ function imageContentHash(dockerfile, entrypoint) {
   return crypto8.createHash("sha256").update(dockerfile).update("\0").update(entrypoint).digest("hex").slice(0, 16);
 }
 function sandboxBuildDir(cwd = process.cwd()) {
-  return path52.join(cwd, ".node9", "sandbox", "build");
+  return path54.join(cwd, ".node9", "sandbox", "build");
 }
 function writeBuildContext(cwd, dockerfile, entrypoint) {
   const dir = sandboxBuildDir(cwd);
-  fs54.mkdirSync(dir, { recursive: true });
-  fs54.writeFileSync(path52.join(dir, "Dockerfile"), dockerfile);
-  fs54.writeFileSync(path52.join(dir, "entrypoint.sh"), entrypoint);
+  fs57.mkdirSync(dir, { recursive: true });
+  fs57.writeFileSync(path54.join(dir, "Dockerfile"), dockerfile);
+  fs57.writeFileSync(path54.join(dir, "entrypoint.sh"), entrypoint);
   return dir;
 }
 function writeAllowlist(cwd, hosts) {
-  const dir = path52.join(cwd, ".node9", "sandbox");
-  fs54.mkdirSync(dir, { recursive: true });
-  const p = path52.join(dir, "allowed-domains.txt");
-  fs54.writeFileSync(p, hosts.join("\n") + "\n");
+  const dir = path54.join(cwd, ".node9", "sandbox");
+  fs57.mkdirSync(dir, { recursive: true });
+  const p = path54.join(dir, "allowed-domains.txt");
+  fs57.writeFileSync(p, hosts.join("\n") + "\n");
   return p;
 }
 function resolveHomePath(p) {
-  return p.startsWith("~") ? path52.join(os47.homedir(), p.slice(1)) : path52.resolve(p);
+  return p.startsWith("~") ? path54.join(os48.homedir(), p.slice(1)) : path54.resolve(p);
 }
 
 // src/cli/commands/sandbox.ts
 function seedDataDirConfig(dataDir, sandbox) {
-  fs55.mkdirSync(dataDir, { recursive: true });
-  const configPath2 = path53.join(dataDir, "config.json");
+  fs58.mkdirSync(dataDir, { recursive: true });
+  const configPath = path55.join(dataDir, "config.json");
   const seed = {
     settings: {
       approvers: {
@@ -26129,7 +26625,7 @@ function seedDataDirConfig(dataDir, sandbox) {
       }
     }
   };
-  fs55.writeFileSync(configPath2, JSON.stringify(seed, null, 2), { mode: 384 });
+  fs58.writeFileSync(configPath, JSON.stringify(seed, null, 2), { mode: 384 });
 }
 function registerSandboxCommand(program2, version2) {
   const node9Version2 = pinnedNode9Version(version2);
@@ -26137,18 +26633,18 @@ function registerSandboxCommand(program2, version2) {
   cmd.command("new").description(`Scaffold ${SANDBOX_CONFIG_FILE} in this project`).option("--agent <agent>", "claude (default) or codex", "claude").action((opts) => {
     const agent = opts.agent === "codex" ? "codex" : "claude";
     const p = sandboxConfigPath();
-    if (fs55.existsSync(p)) {
+    if (fs58.existsSync(p)) {
       console.log(
-        chalk27.yellow(`  ${SANDBOX_CONFIG_FILE} already exists \u2014 leaving it untouched.`)
+        chalk28.yellow(`  ${SANDBOX_CONFIG_FILE} already exists \u2014 leaving it untouched.`)
       );
       return;
     }
-    fs55.writeFileSync(p, scaffoldSandboxYaml(agent));
+    fs58.writeFileSync(p, scaffoldSandboxYaml(agent));
     console.log(
-      chalk27.green(`  \u2713 wrote ${SANDBOX_CONFIG_FILE}`) + chalk27.dim(` (agent: ${agent})`)
+      chalk28.green(`  \u2713 wrote ${SANDBOX_CONFIG_FILE}`) + chalk28.dim(` (agent: ${agent})`)
     );
     console.log(
-      chalk27.dim("  Edit it (mounts / allow / expose), then: ") + chalk27.cyan("node9 sandbox run")
+      chalk28.dim("  Edit it (mounts / allow / expose), then: ") + chalk28.cyan("node9 sandbox run")
     );
   });
   cmd.command("run [agent]").description("Build (if needed) + run the agent jailed. Extra args after -- go to the agent.").allowUnknownOption(true).allowExcessArguments(true).action((agentArg, _opts, command) => {
@@ -26158,7 +26654,7 @@ function registerSandboxCommand(program2, version2) {
     const engine = detectEngine(sandbox.runtime.engine);
     if (!engine.available) {
       console.error(
-        chalk27.red(`  ${sandbox.runtime.engine} not found.`) + chalk27.dim(` Install it first \u2014 node9 sandbox needs a container runtime.`)
+        chalk28.red(`  ${sandbox.runtime.engine} not found.`) + chalk28.dim(` Install it first \u2014 node9 sandbox needs a container runtime.`)
       );
       process.exit(1);
     }
@@ -26171,11 +26667,11 @@ function registerSandboxCommand(program2, version2) {
     });
     if (compiled.rejected.length) {
       console.log(
-        chalk27.yellow(`  \u26A0 ignoring invalid allow hosts: ${compiled.rejected.join(", ")}`)
+        chalk28.yellow(`  \u26A0 ignoring invalid allow hosts: ${compiled.rejected.join(", ")}`)
       );
     }
     if (compiled.denied.length) {
-      console.log(chalk27.dim(`  (denied: ${compiled.denied.join(", ")})`));
+      console.log(chalk28.dim(`  (denied: ${compiled.denied.join(", ")})`));
     }
     const allowlistPath = writeAllowlist(cwd, compiled.allow);
     const dockerfile = renderDockerfile(sandbox, node9Version2);
@@ -26183,20 +26679,20 @@ function registerSandboxCommand(program2, version2) {
     const buildDir = writeBuildContext(cwd, dockerfile, entrypoint);
     const hash = imageContentHash(dockerfile, entrypoint);
     const image = sandbox.runtime.image;
-    const hashFile = path53.join(sandboxBuildDir(cwd), ".image-hash");
-    const lastHash = fs55.existsSync(hashFile) ? fs55.readFileSync(hashFile, "utf-8").trim() : "";
+    const hashFile = path55.join(sandboxBuildDir(cwd), ".image-hash");
+    const lastHash = fs58.existsSync(hashFile) ? fs58.readFileSync(hashFile, "utf-8").trim() : "";
     const imageExists = spawnSync6(sandbox.runtime.engine, ["image", "inspect", image], { stdio: "ignore" }).status === 0;
     const needBuild = sandbox.runtime.rebuild === "always" || !imageExists || sandbox.runtime.rebuild !== "never" && lastHash !== hash;
     if (needBuild) {
-      console.log(chalk27.dim(`  building ${image} \u2026`));
+      console.log(chalk28.dim(`  building ${image} \u2026`));
       const b = spawnSync6(sandbox.runtime.engine, ["build", "-t", image, buildDir], {
         stdio: "inherit"
       });
       if (b.status !== 0) {
-        console.error(chalk27.red("  build failed."));
+        console.error(chalk28.red("  build failed."));
         process.exit(b.status ?? 1);
       }
-      fs55.writeFileSync(hashFile, hash);
+      fs58.writeFileSync(hashFile, hash);
     }
     const dataDir = sandboxDataDir(cwd);
     seedDataDirConfig(dataDir, sandbox);
@@ -26210,36 +26706,36 @@ function registerSandboxCommand(program2, version2) {
     });
     if (sandbox.node9.mountAgentCredentials) {
       const creds = agentCredentialsMount(sandbox.agent);
-      if (fs55.existsSync(creds.hostPath)) {
-        console.log(chalk27.dim(`  mounting ${creds.hostPath} (agent credentials, rw)`));
+      if (fs58.existsSync(creds.hostPath)) {
+        console.log(chalk28.dim(`  mounting ${creds.hostPath} (agent credentials, rw)`));
       } else {
         console.log(
-          chalk27.yellow(`  \u26A0 ${creds.hostPath} not found \u2014 `) + chalk27.dim(`the agent must auth via an env key in env.pass.`)
+          chalk28.yellow(`  \u26A0 ${creds.hostPath} not found \u2014 `) + chalk28.dim(`the agent must auth via an env key in env.pass.`)
         );
       }
     }
     console.log(
-      chalk27.green(`  \u{1F6E1}\uFE0F  ${sandbox.agent} jailed \u2014 ${compiled.allow.length} hosts allowed
+      chalk28.green(`  \u{1F6E1}\uFE0F  ${sandbox.agent} jailed \u2014 ${compiled.allow.length} hosts allowed
 `)
     );
     const r = spawnSync6(sandbox.runtime.engine, runArgs, { stdio: "inherit" });
     process.exit(r.status ?? 0);
   });
   cmd.command("tail").description("Stream the sandbox's audit log (host-side)").action(() => {
-    const auditPath = path53.join(sandboxDataDir(), "audit.log");
-    if (!fs55.existsSync(auditPath)) {
-      console.log(chalk27.dim("  no sandbox audit yet."));
+    const auditPath = path55.join(sandboxDataDir(), "audit.log");
+    if (!fs58.existsSync(auditPath)) {
+      console.log(chalk28.dim("  no sandbox audit yet."));
       return;
     }
     spawnSync6("tail", ["-f", auditPath], { stdio: "inherit" });
   });
   cmd.command("logs").description("Dump the sandbox's audit log").action(() => {
-    const auditPath = path53.join(sandboxDataDir(), "audit.log");
-    if (!fs55.existsSync(auditPath)) {
-      console.log(chalk27.dim("  no sandbox audit yet."));
+    const auditPath = path55.join(sandboxDataDir(), "audit.log");
+    if (!fs58.existsSync(auditPath)) {
+      console.log(chalk28.dim("  no sandbox audit yet."));
       return;
     }
-    process.stdout.write(fs55.readFileSync(auditPath, "utf-8"));
+    process.stdout.write(fs58.readFileSync(auditPath, "utf-8"));
   });
   cmd.command("clean").description("Remove the sandbox image, build context, and data").action(() => {
     const cwd = process.cwd();
@@ -26253,8 +26749,8 @@ function registerSandboxCommand(program2, version2) {
         stdio: "ignore"
       });
     }
-    fs55.rmSync(path53.join(cwd, ".node9", "sandbox"), { recursive: true, force: true });
-    console.log(chalk27.green("  \u2713 sandbox image + build + data removed."));
+    fs58.rmSync(path55.join(cwd, ".node9", "sandbox"), { recursive: true, force: true });
+    console.log(chalk28.green("  \u2713 sandbox image + build + data removed."));
   });
 }
 
@@ -26263,10 +26759,10 @@ init_scan_summary();
 init_litellm();
 init_cost_gemini();
 init_cost_codex();
-import chalk28 from "chalk";
-import fs56 from "fs";
-import path54 from "path";
-import os48 from "os";
+import chalk29 from "chalk";
+import fs59 from "fs";
+import path56 from "path";
+import os49 from "os";
 function modelPrice(model) {
   const t = pricingFor(model);
   if (!t) return null;
@@ -26283,10 +26779,10 @@ function encodeProjectPath(projectPath) {
 }
 function sessionJsonlPath(projectPath, sessionId) {
   const encoded = encodeProjectPath(projectPath);
-  return path54.join(os48.homedir(), ".claude", "projects", encoded, `${sessionId}.jsonl`);
+  return path56.join(os49.homedir(), ".claude", "projects", encoded, `${sessionId}.jsonl`);
 }
 function projectLabel(projectPath) {
-  return projectPath.replace(os48.homedir(), "~");
+  return projectPath.replace(os49.homedir(), "~");
 }
 function parseHistoryLines(lines) {
   const entries = [];
@@ -26355,10 +26851,10 @@ function parseSessionLines(lines) {
   return { toolCalls, costUSD, hasSnapshot, modifiedFiles };
 }
 function loadAuditEntries(auditPath) {
-  const aPath = auditPath ?? path54.join(os48.homedir(), ".node9", "audit.log");
+  const aPath = auditPath ?? path56.join(os49.homedir(), ".node9", "audit.log");
   let raw;
   try {
-    raw = fs56.readFileSync(aPath, "utf-8");
+    raw = fs59.readFileSync(aPath, "utf-8");
   } catch {
     return [];
   }
@@ -26394,8 +26890,8 @@ function auditEntriesInWindow(entries, windowStart, windowEnd) {
   return result;
 }
 function buildGeminiSessions(days, allAuditEntries) {
-  const tmpDir = path54.join(os48.homedir(), ".gemini", "tmp");
-  if (!fs56.existsSync(tmpDir)) return [];
+  const tmpDir = path56.join(os49.homedir(), ".gemini", "tmp");
+  if (!fs59.existsSync(tmpDir)) return [];
   const cutoff = days !== null ? (() => {
     const d = /* @__PURE__ */ new Date();
     d.setDate(d.getDate() - days);
@@ -26404,35 +26900,35 @@ function buildGeminiSessions(days, allAuditEntries) {
   })() : null;
   let slugDirs;
   try {
-    slugDirs = fs56.readdirSync(tmpDir);
+    slugDirs = fs59.readdirSync(tmpDir);
   } catch {
     return [];
   }
   const summaries = [];
-  for (const slug of slugDirs) {
-    const slugPath = path54.join(tmpDir, slug);
+  for (const slug2 of slugDirs) {
+    const slugPath = path56.join(tmpDir, slug2);
     try {
-      if (!fs56.statSync(slugPath).isDirectory()) continue;
+      if (!fs59.statSync(slugPath).isDirectory()) continue;
     } catch {
       continue;
     }
-    let projectRoot = path54.join(os48.homedir(), slug);
+    let projectRoot = path56.join(os49.homedir(), slug2);
     try {
-      projectRoot = fs56.readFileSync(path54.join(slugPath, ".project_root"), "utf-8").trim();
+      projectRoot = fs59.readFileSync(path56.join(slugPath, ".project_root"), "utf-8").trim();
     } catch {
     }
-    const chatsDir = path54.join(slugPath, "chats");
-    if (!fs56.existsSync(chatsDir)) continue;
+    const chatsDir = path56.join(slugPath, "chats");
+    if (!fs59.existsSync(chatsDir)) continue;
     let chatFiles;
     try {
-      chatFiles = fs56.readdirSync(chatsDir).filter((f) => f.endsWith(".json"));
+      chatFiles = fs59.readdirSync(chatsDir).filter((f) => f.endsWith(".json"));
     } catch {
       continue;
     }
     for (const chatFile of chatFiles) {
       let raw;
       try {
-        raw = fs56.readFileSync(path54.join(chatsDir, chatFile), "utf-8");
+        raw = fs59.readFileSync(path56.join(chatsDir, chatFile), "utf-8");
       } catch {
         continue;
       }
@@ -26512,8 +27008,8 @@ function buildGeminiSessions(days, allAuditEntries) {
   return summaries;
 }
 function buildCodexSessions(days, allAuditEntries) {
-  const sessionsBase = path54.join(os48.homedir(), ".codex", "sessions");
-  if (!fs56.existsSync(sessionsBase)) return [];
+  const sessionsBase = path56.join(os49.homedir(), ".codex", "sessions");
+  if (!fs59.existsSync(sessionsBase)) return [];
   const cutoff = days !== null ? (() => {
     const d = /* @__PURE__ */ new Date();
     d.setDate(d.getDate() - days);
@@ -26522,29 +27018,29 @@ function buildCodexSessions(days, allAuditEntries) {
   })() : null;
   const jsonlFiles = [];
   try {
-    for (const year of fs56.readdirSync(sessionsBase)) {
-      const yearPath = path54.join(sessionsBase, year);
+    for (const year of fs59.readdirSync(sessionsBase)) {
+      const yearPath = path56.join(sessionsBase, year);
       try {
-        if (!fs56.statSync(yearPath).isDirectory()) continue;
+        if (!fs59.statSync(yearPath).isDirectory()) continue;
       } catch {
         continue;
       }
-      for (const month of fs56.readdirSync(yearPath)) {
-        const monthPath = path54.join(yearPath, month);
+      for (const month of fs59.readdirSync(yearPath)) {
+        const monthPath = path56.join(yearPath, month);
         try {
-          if (!fs56.statSync(monthPath).isDirectory()) continue;
+          if (!fs59.statSync(monthPath).isDirectory()) continue;
         } catch {
           continue;
         }
-        for (const day of fs56.readdirSync(monthPath)) {
-          const dayPath = path54.join(monthPath, day);
+        for (const day of fs59.readdirSync(monthPath)) {
+          const dayPath = path56.join(monthPath, day);
           try {
-            if (!fs56.statSync(dayPath).isDirectory()) continue;
+            if (!fs59.statSync(dayPath).isDirectory()) continue;
           } catch {
             continue;
           }
-          for (const file of fs56.readdirSync(dayPath)) {
-            if (file.endsWith(".jsonl")) jsonlFiles.push(path54.join(dayPath, file));
+          for (const file of fs59.readdirSync(dayPath)) {
+            if (file.endsWith(".jsonl")) jsonlFiles.push(path56.join(dayPath, file));
           }
         }
       }
@@ -26556,7 +27052,7 @@ function buildCodexSessions(days, allAuditEntries) {
   for (const filePath of jsonlFiles) {
     let lines;
     try {
-      lines = fs56.readFileSync(filePath, "utf-8").split("\n");
+      lines = fs59.readFileSync(filePath, "utf-8").split("\n");
     } catch {
       continue;
     }
@@ -26642,10 +27138,10 @@ function buildCodexSessions(days, allAuditEntries) {
   return summaries;
 }
 function buildSessions(days, historyPath) {
-  const hPath = historyPath ?? path54.join(os48.homedir(), ".claude", "history.jsonl");
+  const hPath = historyPath ?? path56.join(os49.homedir(), ".claude", "history.jsonl");
   let historyRaw = "";
   try {
-    historyRaw = fs56.readFileSync(hPath, "utf-8");
+    historyRaw = fs59.readFileSync(hPath, "utf-8");
   } catch {
   }
   const cutoff = days !== null ? (() => {
@@ -26669,7 +27165,7 @@ function buildSessions(days, historyPath) {
     const jsonlFile = sessionJsonlPath(entry.project, entry.sessionId);
     let sessionLines = [];
     try {
-      sessionLines = fs56.readFileSync(jsonlFile, "utf-8").split("\n");
+      sessionLines = fs59.readFileSync(jsonlFile, "utf-8").split("\n");
     } catch {
     }
     const { toolCalls, costUSD, hasSnapshot, modifiedFiles } = parseSessionLines(sessionLines);
@@ -26755,11 +27251,11 @@ function toolInputSummary(tool, input) {
 }
 function toolColor(tool) {
   const t = tool.toLowerCase();
-  if (t === "bash" || t === "execute_bash") return chalk28.red;
-  if (t === "write") return chalk28.green;
-  if (t === "edit" || t === "notebookedit") return chalk28.yellow;
-  if (t === "read") return chalk28.cyan;
-  return chalk28.gray;
+  if (t === "bash" || t === "execute_bash") return chalk29.red;
+  if (t === "write") return chalk29.green;
+  if (t === "edit" || t === "notebookedit") return chalk29.yellow;
+  if (t === "read") return chalk29.cyan;
+  return chalk29.gray;
 }
 function barStr2(value, max, width) {
   if (max === 0 || width <= 0) return "\u2591".repeat(width);
@@ -26769,7 +27265,7 @@ function barStr2(value, max, width) {
 function colorBar2(value, max, width) {
   const s = barStr2(value, max, width);
   const filled = Math.max(1, Math.round(max > 0 ? value / max * width : 0));
-  return chalk28.cyan(s.slice(0, filled)) + chalk28.dim(s.slice(filled));
+  return chalk29.cyan(s.slice(0, filled)) + chalk29.dim(s.slice(filled));
 }
 function renderSummary(summaries) {
   const totalTools = summaries.reduce((n, s) => n + s.toolCalls.length, 0);
@@ -26799,45 +27295,45 @@ function renderSummary(summaries) {
   }
   const topProjects = [...projCosts.entries()].sort((a, b) => b[1] - a[1]).slice(0, 3);
   const W = 20;
-  console.log(chalk28.dim("  " + "\u2500".repeat(70)));
+  console.log(chalk29.dim("  " + "\u2500".repeat(70)));
   console.log(
-    "  " + chalk28.bold.white(String(summaries.length).padEnd(4)) + chalk28.dim("sessions    ") + chalk28.bold.yellow(fmtCost3(totalCost).padEnd(10)) + chalk28.dim("total    ") + chalk28.bold.white(String(totalTools).padEnd(6)) + chalk28.dim("tool calls    ") + chalk28.bold.white(String(totalFiles)) + chalk28.dim(" files modified") + (totalBlocked > 0 ? chalk28.dim("    ") + chalk28.red.bold(String(totalBlocked)) + chalk28.dim(" blocked by node9") : "")
+    "  " + chalk29.bold.white(String(summaries.length).padEnd(4)) + chalk29.dim("sessions    ") + chalk29.bold.yellow(fmtCost3(totalCost).padEnd(10)) + chalk29.dim("total    ") + chalk29.bold.white(String(totalTools).padEnd(6)) + chalk29.dim("tool calls    ") + chalk29.bold.white(String(totalFiles)) + chalk29.dim(" files modified") + (totalBlocked > 0 ? chalk29.dim("    ") + chalk29.red.bold(String(totalBlocked)) + chalk29.dim(" blocked by node9") : "")
   );
   console.log(
-    "  " + chalk28.dim("avg ") + chalk28.white(fmtCost3(avgCost).padEnd(10)) + chalk28.dim("/session    ") + chalk28.green(String(snapshots)) + chalk28.dim(` of ${summaries.length} sessions had snapshots`)
+    "  " + chalk29.dim("avg ") + chalk29.white(fmtCost3(avgCost).padEnd(10)) + chalk29.dim("/session    ") + chalk29.green(String(snapshots)) + chalk29.dim(` of ${summaries.length} sessions had snapshots`)
   );
   console.log("");
-  console.log("  " + chalk28.dim("Tool breakdown:"));
+  console.log("  " + chalk29.dim("Tool breakdown:"));
   const maxGroup = Math.max(...Object.values(groups));
   for (const [label2, count] of Object.entries(groups)) {
     if (count === 0) continue;
     const pct = totalTools > 0 ? Math.round(count / totalTools * 100) : 0;
     console.log(
-      "    " + label2.padEnd(6) + "  " + colorBar2(count, maxGroup, W) + "  " + chalk28.white(String(count).padStart(4)) + chalk28.dim(` (${String(pct)}%)`)
+      "    " + label2.padEnd(6) + "  " + colorBar2(count, maxGroup, W) + "  " + chalk29.white(String(count).padStart(4)) + chalk29.dim(` (${String(pct)}%)`)
     );
   }
   console.log("");
   if (topProjects.length > 1) {
-    console.log("  " + chalk28.dim("Cost by project:"));
+    console.log("  " + chalk29.dim("Cost by project:"));
     const maxProjCost = topProjects[0][1];
     for (const [proj, cost] of topProjects) {
       console.log(
-        "    " + proj.slice(0, 28).padEnd(28) + "  " + colorBar2(cost, maxProjCost, W) + "  " + chalk28.yellow(fmtCost3(cost))
+        "    " + proj.slice(0, 28).padEnd(28) + "  " + colorBar2(cost, maxProjCost, W) + "  " + chalk29.yellow(fmtCost3(cost))
       );
     }
     console.log("");
   }
-  console.log(chalk28.dim("  " + "\u2500".repeat(70)));
+  console.log(chalk29.dim("  " + "\u2500".repeat(70)));
   console.log("");
 }
 function renderList(summaries, totalCost) {
   if (summaries.length === 0) {
-    console.log(chalk28.yellow("  No sessions found in the requested range.\n"));
+    console.log(chalk29.yellow("  No sessions found in the requested range.\n"));
     return;
   }
-  const totalLabel = totalCost > 0 ? chalk28.dim("  ~" + fmtCost3(totalCost) + " total") : "";
+  const totalLabel = totalCost > 0 ? chalk29.dim("  ~" + fmtCost3(totalCost) + " total") : "";
   console.log(
-    "  " + chalk28.white(String(summaries.length)) + chalk28.dim(` session${summaries.length !== 1 ? "s" : ""}`) + totalLabel
+    "  " + chalk29.white(String(summaries.length)) + chalk29.dim(` session${summaries.length !== 1 ? "s" : ""}`) + totalLabel
   );
   console.log("");
   let lastGroup = "";
@@ -26845,51 +27341,51 @@ function renderList(summaries, totalCost) {
     const activeDate = fmtDate2(s.lastActiveTime);
     const group = activeDate + "  " + s.projectLabel;
     if (group !== lastGroup) {
-      console.log(chalk28.dim("  \u2500\u2500\u2500 ") + chalk28.bold(activeDate) + chalk28.dim("  " + s.projectLabel));
+      console.log(chalk29.dim("  \u2500\u2500\u2500 ") + chalk29.bold(activeDate) + chalk29.dim("  " + s.projectLabel));
       lastGroup = group;
     }
     const startDate = fmtDate2(s.startTime);
-    const dateRange = startDate !== activeDate ? chalk28.dim(" (" + startDate + " \u2192 " + activeDate + ")") : "";
-    const timeStr = chalk28.dim(fmtTime(s.startTime));
-    const prompt = chalk28.white(truncate(s.firstPrompt.replace(/\n/g, " "), 50).padEnd(50));
-    const tools = s.toolCalls.length > 0 ? chalk28.dim(String(s.toolCalls.length).padStart(3) + " tools") : chalk28.dim("  0 tools");
-    const cost = s.costUSD > 0 ? chalk28.dim("  " + fmtCost3(s.costUSD).padEnd(8)) : "          ";
-    const blocked = s.blockedCalls.length > 0 ? chalk28.red("  \u{1F6D1} " + String(s.blockedCalls.length)) : "";
-    const snap = s.hasSnapshot ? chalk28.green("  \u{1F4F8}") : "";
-    const agentBadge = chalk28[agentColorName(s.agent ?? "claude")](
+    const dateRange = startDate !== activeDate ? chalk29.dim(" (" + startDate + " \u2192 " + activeDate + ")") : "";
+    const timeStr = chalk29.dim(fmtTime(s.startTime));
+    const prompt = chalk29.white(truncate(s.firstPrompt.replace(/\n/g, " "), 50).padEnd(50));
+    const tools = s.toolCalls.length > 0 ? chalk29.dim(String(s.toolCalls.length).padStart(3) + " tools") : chalk29.dim("  0 tools");
+    const cost = s.costUSD > 0 ? chalk29.dim("  " + fmtCost3(s.costUSD).padEnd(8)) : "          ";
+    const blocked = s.blockedCalls.length > 0 ? chalk29.red("  \u{1F6D1} " + String(s.blockedCalls.length)) : "";
+    const snap = s.hasSnapshot ? chalk29.green("  \u{1F4F8}") : "";
+    const agentBadge = chalk29[agentColorName(s.agent ?? "claude")](
       "  " + agentBadgeText(s.agent ?? "claude", 0)
     );
-    const sid = chalk28.dim("  " + s.sessionId.slice(0, 8));
+    const sid = chalk29.dim("  " + s.sessionId.slice(0, 8));
     console.log(
       `  ${timeStr}  ${prompt}  ${tools}${cost}${blocked}${snap}${agentBadge}${sid}${dateRange}`
     );
   }
   console.log("");
   console.log(
-    chalk28.dim("  Run") + " " + chalk28.cyan("node9 sessions --detail <session-id>") + chalk28.dim(" for full tool trace.")
+    chalk29.dim("  Run") + " " + chalk29.cyan("node9 sessions --detail <session-id>") + chalk29.dim(" for full tool trace.")
   );
   console.log("");
 }
 function renderDetail(s) {
   console.log("");
-  console.log(chalk28.bold("  Session  ") + chalk28.dim(s.sessionId));
+  console.log(chalk29.bold("  Session  ") + chalk29.dim(s.sessionId));
   console.log(
-    chalk28.bold("  Prompt   ") + chalk28.white(s.firstPrompt.replace(/\n/g, " ").slice(0, 120))
+    chalk29.bold("  Prompt   ") + chalk29.white(s.firstPrompt.replace(/\n/g, " ").slice(0, 120))
   );
-  console.log(chalk28.bold("  Project  ") + chalk28.white(s.projectLabel));
+  console.log(chalk29.bold("  Project  ") + chalk29.white(s.projectLabel));
   if (s.agent) {
-    const agentLabel2 = chalk28[agentColorName(s.agent)](agentDisplayName(s.agent));
-    console.log(chalk28.bold("  Agent    ") + agentLabel2);
+    const agentLabel2 = chalk29[agentColorName(s.agent)](agentDisplayName(s.agent));
+    console.log(chalk29.bold("  Agent    ") + agentLabel2);
   }
-  console.log(chalk28.bold("  When     ") + chalk28.white(fmtDateTime(s.startTime)));
+  console.log(chalk29.bold("  When     ") + chalk29.white(fmtDateTime(s.startTime)));
   if (s.costUSD > 0)
-    console.log(chalk28.bold("  Cost     ") + chalk28.yellow("~" + fmtCost3(s.costUSD)));
+    console.log(chalk29.bold("  Cost     ") + chalk29.yellow("~" + fmtCost3(s.costUSD)));
   console.log(
-    chalk28.bold("  Snapshot ") + (s.hasSnapshot ? chalk28.green("\u2713 taken") : chalk28.dim("none"))
+    chalk29.bold("  Snapshot ") + (s.hasSnapshot ? chalk29.green("\u2713 taken") : chalk29.dim("none"))
   );
   console.log("");
   if (s.toolCalls.length === 0 && s.blockedCalls.length === 0) {
-    console.log(chalk28.dim("  No tool calls recorded.\n"));
+    console.log(chalk29.dim("  No tool calls recorded.\n"));
     return;
   }
   const timeline = [
@@ -26902,32 +27398,32 @@ function renderDetail(s) {
   });
   const headerParts = [`Tool calls (${s.toolCalls.length})`];
   if (s.blockedCalls.length > 0)
-    headerParts.push(chalk28.red(`${s.blockedCalls.length} blocked by node9`));
-  console.log(chalk28.bold("  " + headerParts.join("  \xB7  ")));
+    headerParts.push(chalk29.red(`${s.blockedCalls.length} blocked by node9`));
+  console.log(chalk29.bold("  " + headerParts.join("  \xB7  ")));
   console.log("");
   for (const entry of timeline) {
     if (entry.kind === "tool") {
       const tc = entry.tc;
       const colorFn = toolColor(tc.tool);
       const toolPad = colorFn(tc.tool.padEnd(16));
-      const detail = chalk28.gray(truncate(toolInputSummary(tc.tool, tc.input), 70));
-      const ts = tc.timestamp ? chalk28.dim(fmtTime(tc.timestamp) + "  ") : "       ";
+      const detail = chalk29.gray(truncate(toolInputSummary(tc.tool, tc.input), 70));
+      const ts = tc.timestamp ? chalk29.dim(fmtTime(tc.timestamp) + "  ") : "       ";
       console.log(`    ${ts}${toolPad}  ${detail}`);
     } else {
       const bc = entry.bc;
-      const ts = bc.timestamp ? chalk28.dim(fmtTime(bc.timestamp) + "  ") : "       ";
-      const label2 = chalk28.red("\u{1F6D1} BLOCKED".padEnd(16));
-      const toolName = chalk28.red(bc.tool.padEnd(10));
-      const argsSummary = bc.args ? chalk28.gray(truncate(toolInputSummary(bc.tool, bc.args), 40)) : chalk28.dim("[args not logged]");
-      const reason = bc.checkedBy ? chalk28.dim("  \u2190 " + bc.checkedBy) : "";
+      const ts = bc.timestamp ? chalk29.dim(fmtTime(bc.timestamp) + "  ") : "       ";
+      const label2 = chalk29.red("\u{1F6D1} BLOCKED".padEnd(16));
+      const toolName = chalk29.red(bc.tool.padEnd(10));
+      const argsSummary = bc.args ? chalk29.gray(truncate(toolInputSummary(bc.tool, bc.args), 40)) : chalk29.dim("[args not logged]");
+      const reason = bc.checkedBy ? chalk29.dim("  \u2190 " + bc.checkedBy) : "";
       console.log(`    ${ts}${label2}  ${toolName}  ${argsSummary}${reason}`);
     }
   }
   console.log("");
   if (s.modifiedFiles.length > 0) {
-    console.log(chalk28.bold(`  Files modified (${s.modifiedFiles.length}):`));
+    console.log(chalk29.bold(`  Files modified (${s.modifiedFiles.length}):`));
     for (const f of s.modifiedFiles) {
-      console.log("    " + chalk28.yellow(f));
+      console.log("    " + chalk29.yellow(f));
     }
     console.log("");
   }
@@ -26935,13 +27431,13 @@ function renderDetail(s) {
 function registerSessionsCommand(program2) {
   program2.command("sessions").description("Show what your AI agent did \u2014 sessions, tool calls, cost, and file changes").option("--all", "Show all sessions (default: last 7 days)").option("--days <n>", "Show last N days of sessions", "7").option("--detail <sessionId>", "Show full tool trace for a session").action((options) => {
     console.log("");
-    console.log(chalk28.cyan.bold("\u{1F4CB}  node9 sessions") + chalk28.dim("  \u2014 what your AI agent did"));
+    console.log(chalk29.cyan.bold("\u{1F4CB}  node9 sessions") + chalk29.dim("  \u2014 what your AI agent did"));
     console.log("");
     const days = options.detail || options.all ? null : Math.max(1, parseInt(options.days, 10) || 7);
     const rangeLabel = options.detail ? "all time" : options.all ? "all time" : `last ${String(days)} days`;
-    console.log(chalk28.dim("  " + rangeLabel));
+    console.log(chalk29.dim("  " + rangeLabel));
     console.log("");
-    process.stdout.write(chalk28.dim("  Loading\u2026"));
+    process.stdout.write(chalk29.dim("  Loading\u2026"));
     const summaries = buildSessions(days);
     if (process.stdout.isTTY) {
       process.stdout.clearLine(0);
@@ -26954,8 +27450,8 @@ function registerSessionsCommand(program2) {
         (s) => s.sessionId === options.detail || s.sessionId.startsWith(options.detail)
       );
       if (!target) {
-        console.log(chalk28.red(`  Session not found: ${options.detail}`));
-        console.log(chalk28.dim("  Run `node9 sessions` to list recent sessions.\n"));
+        console.log(chalk29.red(`  Session not found: ${options.detail}`));
+        console.log(chalk29.dim("  Run `node9 sessions` to list recent sessions.\n"));
         return;
       }
       renderDetail(target);
@@ -26969,7 +27465,7 @@ function registerSessionsCommand(program2) {
 
 // src/cli/commands/session-taint.ts
 init_daemon();
-import chalk29 from "chalk";
+import chalk30 from "chalk";
 function resolveSessionId(records, query) {
   const exact = records.find((r) => r.sessionId === query);
   if (exact) return { record: exact };
@@ -26995,22 +27491,22 @@ function registerSessionTaintCommand(program2) {
     const records = await listSessionTaints();
     console.log("");
     if (records.length === 0) {
-      console.log(chalk29.dim("  No tainted sessions."));
-      console.log(chalk29.dim("  (Taint lives in the daemon \u2014 a stopped daemon has none.)") + "\n");
+      console.log(chalk30.dim("  No tainted sessions."));
+      console.log(chalk30.dim("  (Taint lives in the daemon \u2014 a stopped daemon has none.)") + "\n");
       return;
     }
     console.log(
-      "  " + chalk29.bold(String(records.length)) + chalk29.dim(` tainted session${records.length !== 1 ? "s" : ""}`)
+      "  " + chalk30.bold(String(records.length)) + chalk30.dim(` tainted session${records.length !== 1 ? "s" : ""}`)
     );
     console.log("");
     for (const r of records) {
       console.log(
-        "  " + chalk29.yellow(r.sessionId.slice(0, 8).padEnd(10)) + chalk29.red(r.source) + sourceGap(r.source) + chalk29.dim("clears in " + fmtRemaining(r.expiresAt))
+        "  " + chalk30.yellow(r.sessionId.slice(0, 8).padEnd(10)) + chalk30.red(r.source) + sourceGap(r.source) + chalk30.dim("clears in " + fmtRemaining(r.expiresAt))
       );
     }
     console.log("");
     console.log(
-      chalk29.dim("  Run ") + chalk29.cyan("node9 session-taint clear <id>") + chalk29.dim(" to release one, or ") + chalk29.cyan("--all") + chalk29.dim(" for every session.") + "\n"
+      chalk30.dim("  Run ") + chalk30.cyan("node9 session-taint clear <id>") + chalk30.dim(" to release one, or ") + chalk30.cyan("--all") + chalk30.dim(" for every session.") + "\n"
     );
   });
   cmd.command("clear").description("Clear a session's taint so its next network/write action isn't held for review").argument("[sessionId]", "Session id to clear (the 8-char prefix from `list` is accepted)").option("--all", "Clear every session taint").action(async (sessionId, opts) => {
@@ -27018,32 +27514,32 @@ function registerSessionTaintCommand(program2) {
     if (opts.all) {
       const res2 = await clearSessionTaint({ all: true });
       if (res2.daemonUnavailable) {
-        console.log(chalk29.dim("  node9 daemon not running \u2014 no active taints to clear.") + "\n");
+        console.log(chalk30.dim("  node9 daemon not running \u2014 no active taints to clear.") + "\n");
         return;
       }
       console.log(
-        chalk29.green("  \u2713 ") + `Cleared ${chalk29.bold(String(res2.cleared))} session taint${res2.cleared !== 1 ? "s" : ""}.
+        chalk30.green("  \u2713 ") + `Cleared ${chalk30.bold(String(res2.cleared))} session taint${res2.cleared !== 1 ? "s" : ""}.
 `
       );
       return;
     }
     if (!sessionId) {
-      console.log(chalk29.red("  Provide a session id or --all."));
-      console.log(chalk29.dim("  Run `node9 session-taint list` to see tainted sessions.") + "\n");
+      console.log(chalk30.red("  Provide a session id or --all."));
+      console.log(chalk30.dim("  Run `node9 session-taint list` to see tainted sessions.") + "\n");
       return;
     }
     const records = await listSessionTaints();
     if (records.length === 0) {
-      console.log(chalk29.dim("  No tainted sessions \u2014 nothing to clear.") + "\n");
+      console.log(chalk30.dim("  No tainted sessions \u2014 nothing to clear.") + "\n");
       return;
     }
     const resolved = resolveSessionId(records, sessionId);
     if ("error" in resolved) {
       if (resolved.error === "not-found") {
-        console.log(chalk29.red(`  No tainted session matches "${sessionId}".`));
+        console.log(chalk30.red(`  No tainted session matches "${sessionId}".`));
       } else {
-        console.log(chalk29.red(`  "${sessionId}" is ambiguous \u2014 matches:`));
-        for (const m of resolved.matches) console.log(chalk29.dim("    " + m));
+        console.log(chalk30.red(`  "${sessionId}" is ambiguous \u2014 matches:`));
+        for (const m of resolved.matches) console.log(chalk30.dim("    " + m));
       }
       console.log("");
       return;
@@ -27051,24 +27547,24 @@ function registerSessionTaintCommand(program2) {
     const res = await clearSessionTaint({ sessionId: resolved.record.sessionId });
     if (res.cleared > 0) {
       console.log(
-        chalk29.green("  \u2713 ") + `Cleared taint for ${chalk29.yellow(resolved.record.sessionId.slice(0, 8))} ` + chalk29.dim(`(was flagged by ${resolved.record.source}).`) + "\n"
+        chalk30.green("  \u2713 ") + `Cleared taint for ${chalk30.yellow(resolved.record.sessionId.slice(0, 8))} ` + chalk30.dim(`(was flagged by ${resolved.record.source}).`) + "\n"
       );
     } else {
       console.log(
-        chalk29.dim(`  Session ${resolved.record.sessionId.slice(0, 8)} was already clear.`) + "\n"
+        chalk30.dim(`  Session ${resolved.record.sessionId.slice(0, 8)} was already clear.`) + "\n"
       );
     }
   });
 }
 
 // src/cli/commands/skill-pin.ts
-import chalk30 from "chalk";
-import fs57 from "fs";
-import os49 from "os";
-import path55 from "path";
+import chalk31 from "chalk";
+import fs60 from "fs";
+import os50 from "os";
+import path57 from "path";
 function wipeSkillSessions() {
   try {
-    fs57.rmSync(path55.join(os49.homedir(), ".node9", "skill-sessions"), {
+    fs60.rmSync(path57.join(os50.homedir(), ".node9", "skill-sessions"), {
       recursive: true,
       force: true
     });
@@ -27082,29 +27578,29 @@ function registerSkillPinCommand(program2) {
     const result = readSkillPinsSafe();
     if (!result.ok) {
       if (result.reason === "missing") {
-        console.log(chalk30.gray("\nNo skill roots are pinned yet."));
+        console.log(chalk31.gray("\nNo skill roots are pinned yet."));
         console.log(
-          chalk30.gray("Pins are created automatically on the first tool call of each session.\n")
+          chalk31.gray("Pins are created automatically on the first tool call of each session.\n")
         );
         return;
       }
-      console.error(chalk30.red(`
+      console.error(chalk31.red(`
 \u274C Pin file is corrupt: ${result.detail}`));
-      console.error(chalk30.yellow("   Run: node9 skill pin reset\n"));
+      console.error(chalk31.yellow("   Run: node9 skill pin reset\n"));
       process.exit(1);
     }
     const entries = Object.entries(result.pins.roots);
     if (entries.length === 0) {
-      console.log(chalk30.gray("\nNo skill roots are pinned yet.\n"));
+      console.log(chalk31.gray("\nNo skill roots are pinned yet.\n"));
       return;
     }
-    console.log(chalk30.bold("\n\u{1F512} Pinned Skill Roots\n"));
+    console.log(chalk31.bold("\n\u{1F512} Pinned Skill Roots\n"));
     for (const [key, entry] of entries) {
-      const missing = entry.exists ? "" : chalk30.yellow(" (not present at pin time)");
-      console.log(`  ${chalk30.cyan(key)}  ${chalk30.gray(entry.rootPath)}${missing}`);
+      const missing = entry.exists ? "" : chalk31.yellow(" (not present at pin time)");
+      console.log(`  ${chalk31.cyan(key)}  ${chalk31.gray(entry.rootPath)}${missing}`);
       console.log(`    Files (${entry.fileCount})`);
-      console.log(`    Hash:  ${chalk30.gray(entry.contentHash.slice(0, 16))}...`);
-      console.log(`    Pinned: ${chalk30.gray(entry.pinnedAt)}
+      console.log(`    Hash:  ${chalk31.gray(entry.contentHash.slice(0, 16))}...`);
+      console.log(`    Pinned: ${chalk31.gray(entry.pinnedAt)}
 `);
     }
   });
@@ -27113,52 +27609,52 @@ function registerSkillPinCommand(program2) {
     try {
       pins = readSkillPins();
     } catch {
-      console.error(chalk30.red("\n\u274C Pin file is corrupt."));
-      console.error(chalk30.yellow("   Run: node9 skill pin reset\n"));
+      console.error(chalk31.red("\n\u274C Pin file is corrupt."));
+      console.error(chalk31.yellow("   Run: node9 skill pin reset\n"));
       process.exit(1);
     }
     if (!pins.roots[rootKey]) {
-      console.error(chalk30.red(`
+      console.error(chalk31.red(`
 \u274C No pin found for root key "${rootKey}"
 `));
-      console.error(`Run ${chalk30.cyan("node9 skill pin list")} to see pinned roots.
+      console.error(`Run ${chalk31.cyan("node9 skill pin list")} to see pinned roots.
 `);
       process.exit(1);
     }
     const rootPath = pins.roots[rootKey].rootPath;
     removePin2(rootKey);
     wipeSkillSessions();
-    console.log(chalk30.green(`
-\u{1F513} Pin removed for ${chalk30.cyan(rootKey)}`));
-    console.log(chalk30.gray(`   ${rootPath}`));
-    console.log(chalk30.gray("   Next session will re-pin with current state.\n"));
+    console.log(chalk31.green(`
+\u{1F513} Pin removed for ${chalk31.cyan(rootKey)}`));
+    console.log(chalk31.gray(`   ${rootPath}`));
+    console.log(chalk31.gray("   Next session will re-pin with current state.\n"));
   });
   pinSubCmd.command("reset").description("Clear all skill pins and wipe session verification flags").action(() => {
     const result = readSkillPinsSafe();
     if (!result.ok && result.reason === "missing") {
       wipeSkillSessions();
-      console.log(chalk30.gray("\nNo pins to clear.\n"));
+      console.log(chalk31.gray("\nNo pins to clear.\n"));
       return;
     }
     const count = result.ok ? Object.keys(result.pins.roots).length : "?";
     clearAllPins2();
     wipeSkillSessions();
-    console.log(chalk30.green(`
+    console.log(chalk31.green(`
 \u{1F513} Cleared ${count} skill pin(s).`));
-    console.log(chalk30.gray("   Next session will re-pin with current state.\n"));
+    console.log(chalk31.gray("   Next session will re-pin with current state.\n"));
   });
 }
 
 // src/cli/commands/decisions.ts
-import fs58 from "fs";
-import os50 from "os";
-import path56 from "path";
-import chalk31 from "chalk";
-var DECISIONS_FILE2 = path56.join(os50.homedir(), ".node9", "decisions.json");
+import fs61 from "fs";
+import os51 from "os";
+import path58 from "path";
+import chalk32 from "chalk";
+var DECISIONS_FILE2 = path58.join(os51.homedir(), ".node9", "decisions.json");
 function readDecisions() {
   try {
-    if (!fs58.existsSync(DECISIONS_FILE2)) return {};
-    const raw = fs58.readFileSync(DECISIONS_FILE2, "utf-8");
+    if (!fs61.existsSync(DECISIONS_FILE2)) return {};
+    const raw = fs61.readFileSync(DECISIONS_FILE2, "utf-8");
     const parsed = JSON.parse(raw);
     const out = {};
     for (const [k, v] of Object.entries(parsed)) {
@@ -27170,11 +27666,11 @@ function readDecisions() {
   }
 }
 function writeDecisions(d) {
-  const dir = path56.dirname(DECISIONS_FILE2);
-  if (!fs58.existsSync(dir)) fs58.mkdirSync(dir, { recursive: true });
+  const dir = path58.dirname(DECISIONS_FILE2);
+  if (!fs61.existsSync(dir)) fs61.mkdirSync(dir, { recursive: true });
   const tmp = `${DECISIONS_FILE2}.${process.pid}.tmp`;
-  fs58.writeFileSync(tmp, JSON.stringify(d, null, 2));
-  fs58.renameSync(tmp, DECISIONS_FILE2);
+  fs61.writeFileSync(tmp, JSON.stringify(d, null, 2));
+  fs61.renameSync(tmp, DECISIONS_FILE2);
 }
 function registerDecisionsCommand(program2) {
   const cmd = program2.command("decisions").description('Manage persistent "Always Allow" / "Always Deny" tool decisions');
@@ -27182,67 +27678,67 @@ function registerDecisionsCommand(program2) {
     const decisions = readDecisions();
     const entries = Object.entries(decisions);
     if (entries.length === 0) {
-      console.log(chalk31.gray("  No persistent decisions stored."));
+      console.log(chalk32.gray("  No persistent decisions stored."));
       console.log(
-        chalk31.gray(`  File: ${DECISIONS_FILE2}
-`) + chalk31.gray('  Decisions are written when you click "Always Allow" or')
+        chalk32.gray(`  File: ${DECISIONS_FILE2}
+`) + chalk32.gray('  Decisions are written when you click "Always Allow" or')
       );
-      console.log(chalk31.gray('  "Always Deny" in node9 tail or the native popup.'));
+      console.log(chalk32.gray('  "Always Deny" in node9 tail or the native popup.'));
       return;
     }
-    console.log(chalk31.bold(`
+    console.log(chalk32.bold(`
 Persistent decisions  (${entries.length})
 `));
     const w = Math.max(...entries.map(([k]) => k.length));
     for (const [tool, verdict] of entries.sort()) {
-      const colored = verdict === "allow" ? chalk31.green(verdict) : chalk31.red(verdict);
+      const colored = verdict === "allow" ? chalk32.green(verdict) : chalk32.red(verdict);
       console.log(`  ${tool.padEnd(w)}  ${colored}`);
     }
     console.log(
-      chalk31.gray(`
+      chalk32.gray(`
   Stored in ${DECISIONS_FILE2}
-`) + chalk31.gray("  Run `node9 decisions clear <tool>` to remove an entry.")
+`) + chalk32.gray("  Run `node9 decisions clear <tool>` to remove an entry.")
     );
   });
   cmd.command("clear <toolName>").description("Remove a persistent decision for one tool").action((toolName) => {
     const decisions = readDecisions();
     if (!(toolName in decisions)) {
-      console.log(chalk31.yellow(`  No persistent decision for "${toolName}". Nothing to clear.`));
+      console.log(chalk32.yellow(`  No persistent decision for "${toolName}". Nothing to clear.`));
       process.exitCode = 1;
       return;
     }
     delete decisions[toolName];
     writeDecisions(decisions);
-    console.log(chalk31.green(`  \u2713 Cleared persistent decision for "${toolName}".`));
+    console.log(chalk32.green(`  \u2713 Cleared persistent decision for "${toolName}".`));
   });
   cmd.command("clear-all").description("Remove every persistent decision (irreversible)").action(() => {
     const decisions = readDecisions();
     const count = Object.keys(decisions).length;
     if (count === 0) {
-      console.log(chalk31.gray("  Nothing to clear \u2014 no persistent decisions stored."));
+      console.log(chalk32.gray("  Nothing to clear \u2014 no persistent decisions stored."));
       return;
     }
     writeDecisions({});
     console.log(
-      chalk31.green(`  \u2713 Cleared ${count} persistent decision${count === 1 ? "" : "s"}.`)
+      chalk32.green(`  \u2713 Cleared ${count} persistent decision${count === 1 ? "" : "s"}.`)
     );
   });
 }
 
 // src/cli/commands/dlp.ts
-import chalk32 from "chalk";
-import fs59 from "fs";
-import path57 from "path";
-import os51 from "os";
-var AUDIT_LOG = path57.join(os51.homedir(), ".node9", "audit.log");
-var RESOLVED_FILE = path57.join(os51.homedir(), ".node9", "dlp-resolved.json");
+import chalk33 from "chalk";
+import fs62 from "fs";
+import path59 from "path";
+import os52 from "os";
+var AUDIT_LOG = path59.join(os52.homedir(), ".node9", "audit.log");
+var RESOLVED_FILE = path59.join(os52.homedir(), ".node9", "dlp-resolved.json");
 var ANSI_RE = /\x1b(?:\[[0-9;?]*[a-zA-Z]|\][^\x07\x1b]*(?:\x07|\x1b\\)|[@-_])/g;
 function stripAnsi(s) {
   return s.replace(ANSI_RE, "");
 }
 function loadResolved() {
   try {
-    const raw = JSON.parse(fs59.readFileSync(RESOLVED_FILE, "utf-8"));
+    const raw = JSON.parse(fs62.readFileSync(RESOLVED_FILE, "utf-8"));
     return new Set(raw);
   } catch {
     return /* @__PURE__ */ new Set();
@@ -27250,13 +27746,13 @@ function loadResolved() {
 }
 function saveResolved(resolved) {
   try {
-    fs59.writeFileSync(RESOLVED_FILE, JSON.stringify([...resolved], null, 2), { mode: 384 });
+    fs62.writeFileSync(RESOLVED_FILE, JSON.stringify([...resolved], null, 2), { mode: 384 });
   } catch {
   }
 }
 function loadDlpFindings() {
-  if (!fs59.existsSync(AUDIT_LOG)) return [];
-  return fs59.readFileSync(AUDIT_LOG, "utf-8").split("\n").flatMap((line) => {
+  if (!fs62.existsSync(AUDIT_LOG)) return [];
+  return fs62.readFileSync(AUDIT_LOG, "utf-8").split("\n").flatMap((line) => {
     if (!line.trim()) return [];
     try {
       const e = JSON.parse(line);
@@ -27285,14 +27781,14 @@ function registerDlpCommand(program2) {
   cmd.command("resolve").description("Mark all current DLP findings as resolved").action(() => {
     const findings = loadDlpFindings();
     if (findings.length === 0) {
-      console.log(chalk32.green("\n  \u2705 No response-DLP findings to resolve.\n"));
+      console.log(chalk33.green("\n  \u2705 No response-DLP findings to resolve.\n"));
       return;
     }
     const resolved = loadResolved();
     for (const e of findings) resolved.add(entryKey2(e));
     saveResolved(resolved);
     console.log(
-      chalk32.green(
+      chalk33.green(
         `
   \u2705 ${findings.length} finding${findings.length !== 1 ? "s" : ""} marked as resolved.
 `
@@ -27306,47 +27802,47 @@ function registerDlpCommand(program2) {
     const resolvedCount = findings.length - open.length;
     console.log("");
     console.log(
-      chalk32.bold.cyan("\u{1F510}  node9 dlp") + chalk32.dim("  \u2014 secrets found in Claude response text")
+      chalk33.bold.cyan("\u{1F510}  node9 dlp") + chalk33.dim("  \u2014 secrets found in Claude response text")
     );
     console.log("");
     if (open.length === 0) {
       if (resolvedCount > 0) {
-        console.log(chalk32.green(`  \u2705 No open findings  \xB7  ${resolvedCount} previously resolved`));
+        console.log(chalk33.green(`  \u2705 No open findings  \xB7  ${resolvedCount} previously resolved`));
       } else {
         console.log(
-          chalk32.green("  \u2705 No findings \u2014 Claude has not leaked secrets in response text")
+          chalk33.green("  \u2705 No findings \u2014 Claude has not leaked secrets in response text")
         );
       }
       console.log("");
       return;
     }
     console.log(
-      chalk32.bgRed.white.bold(` \u26A0\uFE0F  ${open.length} open finding${open.length !== 1 ? "s" : ""} `) + chalk32.dim(resolvedCount > 0 ? `  (${resolvedCount} resolved)` : "")
+      chalk33.bgRed.white.bold(` \u26A0\uFE0F  ${open.length} open finding${open.length !== 1 ? "s" : ""} `) + chalk33.dim(resolvedCount > 0 ? `  (${resolvedCount} resolved)` : "")
     );
     console.log("");
     console.log(
-      chalk32.dim("  These secrets were included in Claude's response text \u2014 NOT blocked.")
+      chalk33.dim("  These secrets were included in Claude's response text \u2014 NOT blocked.")
     );
-    console.log(chalk32.dim("  Rotate each affected key immediately.\n"));
+    console.log(chalk33.dim("  Rotate each affected key immediately.\n"));
     for (const e of open) {
       console.log(
-        "  " + chalk32.red("\u25CF") + "  " + chalk32.white(e.dlpPattern ?? "Secret") + chalk32.dim("  " + fmtDate3(e.ts))
+        "  " + chalk33.red("\u25CF") + "  " + chalk33.white(e.dlpPattern ?? "Secret") + chalk33.dim("  " + fmtDate3(e.ts))
       );
       if (e.dlpSample) {
-        console.log("     " + chalk32.dim("Sample: ") + chalk32.yellow(stripAnsi(e.dlpSample)));
+        console.log("     " + chalk33.dim("Sample: ") + chalk33.yellow(stripAnsi(e.dlpSample)));
       }
       if (e.project) {
-        console.log("     " + chalk32.dim("Project: ") + chalk32.dim(stripAnsi(e.project)));
+        console.log("     " + chalk33.dim("Project: ") + chalk33.dim(stripAnsi(e.project)));
       }
       console.log("");
     }
-    console.log("  " + chalk32.bold("Next steps:"));
-    console.log("  " + chalk32.cyan("1.") + " Rotate any exposed keys shown above");
+    console.log("  " + chalk33.bold("Next steps:"));
+    console.log("  " + chalk33.cyan("1.") + " Rotate any exposed keys shown above");
     console.log(
-      "  " + chalk32.cyan("2.") + " Run " + chalk32.white("node9 dlp resolve") + " to acknowledge"
+      "  " + chalk33.cyan("2.") + " Run " + chalk33.white("node9 dlp resolve") + " to acknowledge"
     );
     console.log(
-      "  " + chalk32.cyan("3.") + " Run " + chalk32.white("node9 report") + " for full audit history"
+      "  " + chalk33.cyan("3.") + " Run " + chalk33.white("node9 report") + " for full audit history"
     );
     console.log("");
   });
@@ -27354,15 +27850,15 @@ function registerDlpCommand(program2) {
 
 // src/cli/commands/mask.ts
 init_dlp();
-import chalk33 from "chalk";
-import fs60 from "fs";
-import path58 from "path";
-import os52 from "os";
+import chalk34 from "chalk";
+import fs63 from "fs";
+import path60 from "path";
+import os53 from "os";
 function findJsonlFiles(dir) {
   const results = [];
-  if (!fs60.existsSync(dir)) return results;
-  for (const entry of fs60.readdirSync(dir, { withFileTypes: true })) {
-    const full = path58.join(dir, entry.name);
+  if (!fs63.existsSync(dir)) return results;
+  for (const entry of fs63.readdirSync(dir, { withFileTypes: true })) {
+    const full = path60.join(dir, entry.name);
     if (entry.isDirectory()) results.push(...findJsonlFiles(full));
     else if (entry.isFile() && entry.name.endsWith(".jsonl")) results.push(full);
   }
@@ -27405,7 +27901,7 @@ function redactJson(obj) {
 function processFile(filePath, dryRun) {
   let raw;
   try {
-    raw = fs60.readFileSync(filePath, "utf-8");
+    raw = fs63.readFileSync(filePath, "utf-8");
   } catch {
     return { redactedLines: 0, patterns: [] };
   }
@@ -27437,14 +27933,14 @@ function processFile(filePath, dryRun) {
     }
   }
   if (!dryRun && redactedLines > 0) {
-    fs60.writeFileSync(filePath, newLines.join("\n"), "utf-8");
+    fs63.writeFileSync(filePath, newLines.join("\n"), "utf-8");
   }
   return { redactedLines, patterns };
 }
 function processJsonFile(filePath, dryRun) {
   let raw;
   try {
-    raw = fs60.readFileSync(filePath, "utf-8");
+    raw = fs63.readFileSync(filePath, "utf-8");
   } catch {
     return { redactedLines: 0, patterns: [] };
   }
@@ -27457,15 +27953,15 @@ function processJsonFile(filePath, dryRun) {
   const { value, modified, found } = redactJson(parsed);
   if (!modified) return { redactedLines: 0, patterns: [] };
   if (!dryRun) {
-    fs60.writeFileSync(filePath, JSON.stringify(value, null, 2), "utf-8");
+    fs63.writeFileSync(filePath, JSON.stringify(value, null, 2), "utf-8");
   }
   return { redactedLines: 1, patterns: found };
 }
 function findJsonFiles(dir) {
   const results = [];
-  if (!fs60.existsSync(dir)) return results;
-  for (const entry of fs60.readdirSync(dir, { withFileTypes: true })) {
-    const full = path58.join(dir, entry.name);
+  if (!fs63.existsSync(dir)) return results;
+  for (const entry of fs63.readdirSync(dir, { withFileTypes: true })) {
+    const full = path60.join(dir, entry.name);
     if (entry.isDirectory()) results.push(...findJsonFiles(full));
     else if (entry.isFile() && entry.name.endsWith(".json")) results.push(full);
   }
@@ -27474,9 +27970,9 @@ function findJsonFiles(dir) {
 function registerMaskCommand(program2) {
   program2.command("mask").description("Redact plaintext secrets from local AI session history files").option("--dry-run", "show what would be redacted without making changes").option("--all", "scan all history (default: last 30 days)").action(async (options) => {
     const dryRun = !!options.dryRun;
-    const home = os52.homedir();
-    const claudeDir = path58.join(home, ".claude", "projects");
-    const geminiDir = path58.join(home, ".gemini", "tmp");
+    const home = os53.homedir();
+    const claudeDir = path60.join(home, ".claude", "projects");
+    const geminiDir = path60.join(home, ".gemini", "tmp");
     const allFiles = [
       ...findJsonlFiles(claudeDir).map((p) => ({ path: p, type: "jsonl" })),
       ...findJsonFiles(geminiDir).map((p) => ({ path: p, type: "json" }))
@@ -27484,18 +27980,18 @@ function registerMaskCommand(program2) {
     const cutoff = options.all ? null : new Date(Date.now() - 30 * 24 * 60 * 60 * 1e3);
     const filtered = cutoff ? allFiles.filter((f) => {
       try {
-        return fs60.statSync(f.path).mtime >= cutoff;
+        return fs63.statSync(f.path).mtime >= cutoff;
       } catch {
         return false;
       }
     }) : allFiles;
     if (filtered.length === 0) {
-      console.log(chalk33.yellow("  No session files found."));
+      console.log(chalk34.yellow("  No session files found."));
       return;
     }
     console.log("");
     if (dryRun) {
-      console.log(chalk33.dim("  Dry run \u2014 no files will be modified.\n"));
+      console.log(chalk34.dim("  Dry run \u2014 no files will be modified.\n"));
     }
     let totalFiles = 0;
     let totalLines = 0;
@@ -27511,23 +28007,23 @@ function registerMaskCommand(program2) {
         });
         const verb = dryRun ? "Would redact" : "Redacted";
         console.log(
-          "  " + chalk33.dim(shortPath.slice(0, 60).padEnd(62)) + chalk33.red(`${verb}: `) + chalk33.yellow(patterns.join(", ")) + chalk33.dim(` (${redactedLines} line${redactedLines !== 1 ? "s" : ""})`)
+          "  " + chalk34.dim(shortPath.slice(0, 60).padEnd(62)) + chalk34.red(`${verb}: `) + chalk34.yellow(patterns.join(", ")) + chalk34.dim(` (${redactedLines} line${redactedLines !== 1 ? "s" : ""})`)
         );
       }
     }
     console.log("");
     if (totalFiles === 0) {
-      console.log(chalk33.green("  No secrets found in session history."));
+      console.log(chalk34.green("  No secrets found in session history."));
     } else {
       const verb = dryRun ? "would be modified" : "modified";
       console.log(
-        chalk33.bold(`  ${totalFiles} file${totalFiles !== 1 ? "s" : ""} ${verb}`) + chalk33.dim(`, ${totalLines} line${totalLines !== 1 ? "s" : ""} redacted`)
+        chalk34.bold(`  ${totalFiles} file${totalFiles !== 1 ? "s" : ""} ${verb}`) + chalk34.dim(`, ${totalLines} line${totalLines !== 1 ? "s" : ""} redacted`)
       );
-      console.log("  Patterns: " + chalk33.yellow(totalPatterns.join(", ")));
+      console.log("  Patterns: " + chalk34.yellow(totalPatterns.join(", ")));
       if (!dryRun) {
         console.log("");
         console.log(
-          chalk33.dim(
+          chalk34.dim(
             "  Note: secrets were already sent to the AI provider during the active session.\n        This cleans your local disk only. Rotate any exposed keys."
           )
         );
@@ -27540,20 +28036,20 @@ function registerMaskCommand(program2) {
 // src/cli.ts
 init_blast();
 var { version } = JSON.parse(
-  fs63.readFileSync(path61.join(__dirname, "../package.json"), "utf-8")
+  fs66.readFileSync(path63.join(__dirname, "../package.json"), "utf-8")
 );
 var program = new Command();
 program.name("node9").description("The Sudo Command for AI Agents").version(version);
 program.command("login").argument("<apiKey>").option("--local", "Save key for audit/logging only \u2014 local config still controls all decisions").option("--profile <name>", 'Save as a named profile (default: "default")').action((apiKey, options) => {
   const DEFAULT_API_URL2 = "https://api.node9.ai/api/v1/intercept";
-  const credPath = path61.join(os55.homedir(), ".node9", "credentials.json");
-  if (!fs63.existsSync(path61.dirname(credPath)))
-    fs63.mkdirSync(path61.dirname(credPath), { recursive: true });
+  const credPath = path63.join(os56.homedir(), ".node9", "credentials.json");
+  if (!fs66.existsSync(path63.dirname(credPath)))
+    fs66.mkdirSync(path63.dirname(credPath), { recursive: true });
   const profileName = options.profile || "default";
   let existingCreds = {};
   try {
-    if (fs63.existsSync(credPath)) {
-      const raw = JSON.parse(fs63.readFileSync(credPath, "utf-8"));
+    if (fs66.existsSync(credPath)) {
+      const raw = JSON.parse(fs66.readFileSync(credPath, "utf-8"));
       if (raw.apiKey) {
         existingCreds = {
           default: { apiKey: raw.apiKey, apiUrl: raw.apiUrl || DEFAULT_API_URL2 }
@@ -27565,14 +28061,14 @@ program.command("login").argument("<apiKey>").option("--local", "Save key for au
   } catch {
   }
   existingCreds[profileName] = { apiKey, apiUrl: DEFAULT_API_URL2 };
-  fs63.writeFileSync(credPath, JSON.stringify(existingCreds, null, 2), { mode: 384 });
+  fs66.writeFileSync(credPath, JSON.stringify(existingCreds, null, 2), { mode: 384 });
   let effectiveCloud = null;
   if (profileName === "default") {
-    const configPath2 = path61.join(os55.homedir(), ".node9", "config.json");
+    const configPath = path63.join(os56.homedir(), ".node9", "config.json");
     let config = {};
     try {
-      if (fs63.existsSync(configPath2))
-        config = JSON.parse(fs63.readFileSync(configPath2, "utf-8"));
+      if (fs66.existsSync(configPath))
+        config = JSON.parse(fs66.readFileSync(configPath, "utf-8"));
     } catch {
     }
     if (!config.settings || typeof config.settings !== "object") config.settings = {};
@@ -27587,35 +28083,35 @@ program.command("login").argument("<apiKey>").option("--local", "Save key for au
       approvers.cloud = false;
     }
     s.approvers = approvers;
-    if (!fs63.existsSync(path61.dirname(configPath2)))
-      fs63.mkdirSync(path61.dirname(configPath2), { recursive: true });
-    fs63.writeFileSync(configPath2, JSON.stringify(config, null, 2), { mode: 384 });
+    if (!fs66.existsSync(path63.dirname(configPath)))
+      fs66.mkdirSync(path63.dirname(configPath), { recursive: true });
+    fs66.writeFileSync(configPath, JSON.stringify(config, null, 2), { mode: 384 });
     effectiveCloud = approvers.cloud === true;
   }
   if (options.profile && profileName !== "default") {
-    console.log(chalk35.green(`\u2705 Profile "${profileName}" saved`));
-    console.log(chalk35.gray(`   Switch to it per-session:  NODE9_PROFILE=${profileName} claude`));
+    console.log(chalk36.green(`\u2705 Profile "${profileName}" saved`));
+    console.log(chalk36.gray(`   Switch to it per-session:  NODE9_PROFILE=${profileName} claude`));
   } else if (options.local || effectiveCloud === false) {
-    console.log(chalk35.green(`\u2705 Key saved \u2014 Privacy mode \u{1F6E1}\uFE0F`));
-    console.log(chalk35.gray(`   All decisions stay on this machine. Nothing syncs to the cloud.`));
+    console.log(chalk36.green(`\u2705 Key saved \u2014 Privacy mode \u{1F6E1}\uFE0F`));
+    console.log(chalk36.gray(`   All decisions stay on this machine. Nothing syncs to the cloud.`));
     if (!options.local) {
       console.log(
-        chalk35.yellow(`   Your config has cloud approvals OFF (settings.approvers.cloud).`)
+        chalk36.yellow(`   Your config has cloud approvals OFF (settings.approvers.cloud).`)
       );
       console.log(
-        chalk35.gray(`   To enable team policy + dashboard sync: set it to true, or re-init.`)
+        chalk36.gray(`   To enable team policy + dashboard sync: set it to true, or re-init.`)
       );
     }
   } else {
-    console.log(chalk35.green(`\u2705 Logged in \u2014 agent mode`));
-    console.log(chalk35.gray(`   Team policy enforced for all calls via Node9 cloud.`));
+    console.log(chalk36.green(`\u2705 Logged in \u2014 agent mode`));
+    console.log(chalk36.gray(`   Team policy enforced for all calls via Node9 cloud.`));
   }
 });
 program.command("signup").description("Create your node9 account / open the dashboard in your browser").option("--login", "Open the login page instead of signup").action((options) => {
   const route = options.login ? "auth/login" : "auth/signup";
   const url = `https://node9.ai/${route}?ref=cli_cmd`;
   console.log("");
-  console.log("  " + chalk35.dim("Opening ") + chalk35.cyan.underline(url));
+  console.log("  " + chalk36.dim("Opening ") + chalk36.cyan.underline(url));
   const opener = process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open";
   try {
     const child = spawn9(opener, [url], {
@@ -27648,7 +28144,7 @@ program.command("addto", { hidden: true }).description("Integrate Node9 with an
   if (target === "hermes") return setupHermes();
   if (target === "hud") return setupHud();
   console.error(
-    chalk35.red(
+    chalk36.red(
       `Unknown target: "${target}". Supported: claude, antigravity, copilot, gemini, cursor, codex, windsurf, vscode, hermes, hud`
     )
   );
@@ -27662,20 +28158,20 @@ program.command("setup", { hidden: true }).description('Alias for "addto" \u2014
   "The agent to protect: claude | antigravity | copilot | gemini | cursor | codex | windsurf | vscode | hud"
 ).action(async (target) => {
   if (!target) {
-    console.log(chalk35.cyan("\n\u{1F6E1}\uFE0F  Node9 Setup \u2014 integrate with your AI agent\n"));
-    console.log("  Usage:  " + chalk35.white("node9 setup <target>") + "\n");
+    console.log(chalk36.cyan("\n\u{1F6E1}\uFE0F  Node9 Setup \u2014 integrate with your AI agent\n"));
+    console.log("  Usage:  " + chalk36.white("node9 setup <target>") + "\n");
     console.log("  Targets:");
-    console.log("    " + chalk35.green("claude") + "    \u2014 Claude Code (hook mode)");
-    console.log("    " + chalk35.green("gemini") + "    \u2014 Gemini CLI (hook mode)");
-    console.log("    " + chalk35.green("antigravity") + " \u2014 Antigravity / agy (hook mode)");
-    console.log("    " + chalk35.green("copilot") + "   \u2014 GitHub Copilot CLI (hook mode)");
-    console.log("    " + chalk35.green("cursor") + "    \u2014 Cursor (MCP proxy)");
-    console.log("    " + chalk35.green("codex") + "     \u2014 OpenAI Codex CLI (MCP proxy)");
-    console.log("    " + chalk35.green("windsurf") + "  \u2014 Windsurf (MCP proxy)");
-    console.log("    " + chalk35.green("vscode") + "    \u2014 VSCode / Copilot (MCP proxy)");
-    console.log("    " + chalk35.green("hermes") + "    \u2014 Hermes Agent (hook mode)");
+    console.log("    " + chalk36.green("claude") + "    \u2014 Claude Code (hook mode)");
+    console.log("    " + chalk36.green("gemini") + "    \u2014 Gemini CLI (hook mode)");
+    console.log("    " + chalk36.green("antigravity") + " \u2014 Antigravity / agy (hook mode)");
+    console.log("    " + chalk36.green("copilot") + "   \u2014 GitHub Copilot CLI (hook mode)");
+    console.log("    " + chalk36.green("cursor") + "    \u2014 Cursor (MCP proxy)");
+    console.log("    " + chalk36.green("codex") + "     \u2014 OpenAI Codex CLI (MCP proxy)");
+    console.log("    " + chalk36.green("windsurf") + "  \u2014 Windsurf (MCP proxy)");
+    console.log("    " + chalk36.green("vscode") + "    \u2014 VSCode / Copilot (MCP proxy)");
+    console.log("    " + chalk36.green("hermes") + "    \u2014 Hermes Agent (hook mode)");
     process.stdout.write(
-      "    " + chalk35.green("hud") + "       \u2014 Claude Code security statusline\n"
+      "    " + chalk36.green("hud") + "       \u2014 Claude Code security statusline\n"
     );
     console.log("");
     return;
@@ -27692,7 +28188,7 @@ program.command("setup", { hidden: true }).description('Alias for "addto" \u2014
   if (t === "hermes") return setupHermes();
   if (t === "hud") return setupHud();
   console.error(
-    chalk35.red(
+    chalk36.red(
       `Unknown target: "${target}". Supported: claude, antigravity, copilot, gemini, cursor, codex, windsurf, vscode, hermes, hud`
     )
   );
@@ -27718,33 +28214,33 @@ program.command("removefrom", { hidden: true }).description("Remove Node9 hooks
   else if (target === "hud") fn = teardownHud;
   else {
     console.error(
-      chalk35.red(
+      chalk36.red(
         `Unknown target: "${target}". Supported: claude, antigravity, copilot, gemini, cursor, codex, windsurf, vscode, hermes, hud`
       )
     );
     process.exit(1);
   }
-  console.log(chalk35.cyan(`
+  console.log(chalk36.cyan(`
 \u{1F6E1}\uFE0F  Node9: removing hooks from ${target}...
 `));
   try {
     fn();
   } catch (err2) {
-    console.error(chalk35.red(`  \u26A0\uFE0F  Failed: ${err2 instanceof Error ? err2.message : String(err2)}`));
+    console.error(chalk36.red(`  \u26A0\uFE0F  Failed: ${err2 instanceof Error ? err2.message : String(err2)}`));
     process.exit(1);
   }
-  console.log(chalk35.gray("\n  Restart the agent for changes to take effect."));
+  console.log(chalk36.gray("\n  Restart the agent for changes to take effect."));
 });
 program.command("uninstall").description("Remove all Node9 hooks and optionally delete config files").option("--purge", "Also delete ~/.node9/ directory (config, audit log, credentials)").action(async (options) => {
-  console.log(chalk35.cyan("\n\u{1F6E1}\uFE0F  Node9 Uninstall\n"));
-  console.log(chalk35.bold("Stopping daemon..."));
+  console.log(chalk36.cyan("\n\u{1F6E1}\uFE0F  Node9 Uninstall\n"));
+  console.log(chalk36.bold("Stopping daemon..."));
   try {
     stopDaemon();
-    console.log(chalk35.green("  \u2705 Daemon stopped"));
+    console.log(chalk36.green("  \u2705 Daemon stopped"));
   } catch {
-    console.log(chalk35.blue("  \u2139\uFE0F  Daemon was not running"));
+    console.log(chalk36.blue("  \u2139\uFE0F  Daemon was not running"));
   }
-  console.log(chalk35.bold("\nRemoving hooks..."));
+  console.log(chalk36.bold("\nRemoving hooks..."));
   let teardownFailed = false;
   for (const [label2, fn] of [
     ["Claude", teardownClaude],
@@ -27760,45 +28256,45 @@ program.command("uninstall").description("Remove all Node9 hooks and optionally
     } catch (err2) {
       teardownFailed = true;
       console.error(
-        chalk35.red(
+        chalk36.red(
           `  \u26A0\uFE0F  Failed to remove ${label2} hooks: ${err2 instanceof Error ? err2.message : String(err2)}`
         )
       );
     }
   }
   if (options.purge) {
-    const node9Dir = path61.join(os55.homedir(), ".node9");
-    if (fs63.existsSync(node9Dir)) {
+    const node9Dir = path63.join(os56.homedir(), ".node9");
+    if (fs66.existsSync(node9Dir)) {
       const confirmed = await confirm2({
         message: `Permanently delete ${node9Dir} (config, audit log, credentials)?`,
         default: false
       });
       if (confirmed) {
-        fs63.rmSync(node9Dir, { recursive: true });
-        if (fs63.existsSync(node9Dir)) {
+        fs66.rmSync(node9Dir, { recursive: true });
+        if (fs66.existsSync(node9Dir)) {
           console.error(
-            chalk35.red("\n  \u26A0\uFE0F  ~/.node9/ could not be fully deleted \u2014 remove it manually.")
+            chalk36.red("\n  \u26A0\uFE0F  ~/.node9/ could not be fully deleted \u2014 remove it manually.")
           );
         } else {
-          console.log(chalk35.green("\n  \u2705 Deleted ~/.node9/ (config, audit log, credentials)"));
+          console.log(chalk36.green("\n  \u2705 Deleted ~/.node9/ (config, audit log, credentials)"));
         }
       } else {
-        console.log(chalk35.yellow("\n  Skipped \u2014 ~/.node9/ was not deleted."));
+        console.log(chalk36.yellow("\n  Skipped \u2014 ~/.node9/ was not deleted."));
       }
     } else {
-      console.log(chalk35.blue("\n  \u2139\uFE0F  ~/.node9/ not found \u2014 nothing to delete"));
+      console.log(chalk36.blue("\n  \u2139\uFE0F  ~/.node9/ not found \u2014 nothing to delete"));
     }
   } else {
     console.log(
-      chalk35.gray("\n  ~/.node9/ kept \u2014 run with --purge to delete config and audit log")
+      chalk36.gray("\n  ~/.node9/ kept \u2014 run with --purge to delete config and audit log")
     );
   }
   if (teardownFailed) {
-    console.error(chalk35.red("\n  \u26A0\uFE0F  Some hooks could not be removed \u2014 see errors above."));
+    console.error(chalk36.red("\n  \u26A0\uFE0F  Some hooks could not be removed \u2014 see errors above."));
     process.exit(1);
   }
-  console.log(chalk35.green.bold("\n\u{1F6E1}\uFE0F  Node9 removed. Run: npm uninstall -g node9-ai"));
-  console.log(chalk35.gray("   Restart any open AI agent sessions for changes to take effect.\n"));
+  console.log(chalk36.green.bold("\n\u{1F6E1}\uFE0F  Node9 removed. Run: npm uninstall -g node9-ai"));
+  console.log(chalk36.gray("   Restart any open AI agent sessions for changes to take effect.\n"));
 });
 registerDoctorCommand(program, version);
 program.command("explain").description(
@@ -27811,7 +28307,7 @@ program.command("explain").description(
       try {
         args = JSON.parse(trimmed);
       } catch {
-        console.error(chalk35.red(`
+        console.error(chalk36.red(`
 \u274C Invalid JSON: ${trimmed}
 `));
         process.exit(1);
@@ -27822,54 +28318,62 @@ program.command("explain").description(
   }
   const result = await explainPolicy(tool, args);
   console.log("");
-  console.log(chalk35.cyan.bold("\u{1F6E1}\uFE0F  Node9 Explain"));
+  console.log(chalk36.cyan.bold("\u{1F6E1}\uFE0F  Node9 Explain"));
   console.log("");
-  console.log(`   ${chalk35.bold("Tool:")}    ${chalk35.white(result.tool)}`);
+  console.log(`   ${chalk36.bold("Tool:")}    ${chalk36.white(result.tool)}`);
   if (argsRaw) {
     const preview2 = argsRaw.length > 80 ? argsRaw.slice(0, 77) + "\u2026" : argsRaw;
-    console.log(`   ${chalk35.bold("Input:")}   ${chalk35.gray(preview2)}`);
+    console.log(`   ${chalk36.bold("Input:")}   ${chalk36.gray(preview2)}`);
   }
   console.log("");
-  console.log(chalk35.bold("Config Sources (Waterfall):"));
+  console.log(chalk36.bold("Config Sources (Waterfall):"));
   for (const tier of result.waterfall) {
-    const num3 = chalk35.gray(`  ${tier.tier}.`);
+    const num3 = chalk36.gray(`  ${tier.tier}.`);
     const label2 = tier.label.padEnd(16);
     let statusStr;
     if (tier.tier === 1) {
-      statusStr = chalk35.gray(tier.note ?? "");
+      statusStr = chalk36.gray(tier.note ?? "");
     } else if (tier.status === "active") {
-      const loc = tier.path ? chalk35.gray(tier.path) : "";
-      const note = tier.note ? chalk35.gray(`(${tier.note})`) : "";
-      statusStr = chalk35.green("\u2713 active") + (loc ? "  " + loc : "") + (note ? "  " + note : "");
+      const loc = tier.path ? chalk36.gray(tier.path) : "";
+      const note = tier.note ? chalk36.gray(`(${tier.note})`) : "";
+      statusStr = chalk36.green("\u2713 active") + (loc ? "  " + loc : "") + (note ? "  " + note : "");
     } else {
-      statusStr = chalk35.gray("\u25CB " + (tier.note ?? "not found"));
+      statusStr = chalk36.gray("\u25CB " + (tier.note ?? "not found"));
     }
-    console.log(`${num3} ${chalk35.white(label2)} ${statusStr}`);
+    console.log(`${num3} ${chalk36.white(label2)} ${statusStr}`);
   }
   console.log("");
-  console.log(chalk35.bold("Policy Evaluation:"));
+  console.log(chalk36.bold("Policy Evaluation:"));
   for (const step of result.steps) {
     const isFinal = step.isFinal;
     let icon;
-    if (step.outcome === "allow") icon = chalk35.green("  \u2705");
-    else if (step.outcome === "review") icon = chalk35.red("  \u{1F534}");
-    else if (step.outcome === "skip") icon = chalk35.gray("  \u2500 ");
-    else icon = chalk35.gray("  \u25CB ");
+    if (step.outcome === "allow") icon = chalk36.green("  \u2705");
+    else if (step.outcome === "block") icon = chalk36.red("  \u{1F6D1}");
+    else if (step.outcome === "review") icon = chalk36.red("  \u{1F534}");
+    else if (step.outcome === "skip") icon = chalk36.gray("  \u2500 ");
+    else icon = chalk36.gray("  \u25CB ");
     const name = step.name.padEnd(18);
-    const nameStr = isFinal ? chalk35.white.bold(name) : chalk35.white(name);
-    const detail = isFinal ? chalk35.white(step.detail) : chalk35.gray(step.detail);
-    const arrow = isFinal ? chalk35.yellow("  \u2190 STOP") : "";
+    const nameStr = isFinal ? chalk36.white.bold(name) : chalk36.white(name);
+    const detail = isFinal ? chalk36.white(step.detail) : chalk36.gray(step.detail);
+    const arrow = isFinal ? chalk36.yellow("  \u2190 STOP") : "";
     console.log(`${icon} ${nameStr} ${detail}${arrow}`);
   }
   console.log("");
   if (result.decision === "allow") {
-    console.log(chalk35.green.bold("  Decision: \u2705 ALLOW") + chalk35.gray("  \u2014 no approval needed"));
+    console.log(chalk36.green.bold("  Decision: \u2705 ALLOW") + chalk36.gray("  \u2014 no approval needed"));
+  } else if (result.decision === "block") {
+    console.log(
+      chalk36.red.bold("  Decision: \u{1F6D1} BLOCK") + chalk36.gray("  \u2014 this action is blocked")
+    );
+    if (result.blockedByLabel) {
+      console.log(chalk36.gray(`  Reason:   ${result.blockedByLabel}`));
+    }
   } else {
     console.log(
-      chalk35.red.bold("  Decision: \u{1F534} REVIEW") + chalk35.gray("  \u2014 human approval required")
+      chalk36.red.bold("  Decision: \u{1F534} REVIEW") + chalk36.gray("  \u2014 human approval required")
     );
     if (result.blockedByLabel) {
-      console.log(chalk35.gray(`  Reason:   ${result.blockedByLabel}`));
+      console.log(chalk36.gray(`  Reason:   ${result.blockedByLabel}`));
     }
   }
   console.log("");
@@ -27884,18 +28388,18 @@ program.command("tail").description("Stream live agent activity to the terminal"
   try {
     await startTail2(options);
   } catch (err2) {
-    console.error(chalk35.red(`\u274C ${err2 instanceof Error ? err2.message : String(err2)}`));
+    console.error(chalk36.red(`\u274C ${err2 instanceof Error ? err2.message : String(err2)}`));
     process.exit(1);
   }
 });
 program.command("monitor").description("Live interactive dashboard \u2014 activity feed, approvals, security signals").action(async () => {
   try {
-    const dashboardPath = path61.join(__dirname, "dashboard.mjs");
+    const dashboardPath = path63.join(__dirname, "dashboard.mjs");
     const dynamicImport = new Function("id", "return import(id)");
     const mod = await dynamicImport(`file://${dashboardPath}`);
     await mod.startMonitor();
   } catch (err2) {
-    console.error(chalk35.red(`\u274C ${err2 instanceof Error ? err2.message : String(err2)}`));
+    console.error(chalk36.red(`\u274C ${err2 instanceof Error ? err2.message : String(err2)}`));
     process.exit(1);
   }
 });
@@ -27928,14 +28432,14 @@ Claude Code spawns this command every ~300ms and writes a JSON payload to stdin.
 Run "node9 addto claude" to register it as the statusLine.`
 ).argument("[subcommand]", 'Optional: "debug on" / "debug off" to toggle stdin logging').argument("[state]", 'on|off \u2014 used with "debug" subcommand').action(async (subcommand, state) => {
   if (subcommand === "debug") {
-    const flagFile = path61.join(os55.homedir(), ".node9", "hud-debug");
+    const flagFile = path63.join(os56.homedir(), ".node9", "hud-debug");
     if (state === "on") {
-      fs63.mkdirSync(path61.dirname(flagFile), { recursive: true });
-      fs63.writeFileSync(flagFile, "");
+      fs66.mkdirSync(path63.dirname(flagFile), { recursive: true });
+      fs66.writeFileSync(flagFile, "");
       console.log("HUD debug logging enabled \u2192 ~/.node9/hud-debug.log");
       console.log("Tail it with: tail -f ~/.node9/hud-debug.log");
     } else if (state === "off") {
-      if (fs63.existsSync(flagFile)) fs63.unlinkSync(flagFile);
+      if (fs66.existsSync(flagFile)) fs66.unlinkSync(flagFile);
       console.log("HUD debug logging disabled.");
     } else {
       console.error("Usage: node9 hud debug on|off");
@@ -27950,7 +28454,7 @@ program.command("pause").description("Temporarily disable Node9 protection for a
   const ms = parseDuration(options.duration);
   if (ms === null) {
     console.error(
-      chalk35.red(`
+      chalk36.red(`
 \u274C  Invalid duration: "${options.duration}". Use format like 15m, 1h, 30s.
 `)
     );
@@ -27958,20 +28462,20 @@ program.command("pause").description("Temporarily disable Node9 protection for a
   }
   pauseNode9(ms, options.duration);
   const expiresAt = new Date(Date.now() + ms).toLocaleTimeString();
-  console.log(chalk35.yellow(`
+  console.log(chalk36.yellow(`
 \u23F8  Node9 paused until ${expiresAt}`));
-  console.log(chalk35.gray(`   All tool calls will be allowed without review.`));
-  console.log(chalk35.gray(`   Run "node9 resume" to re-enable early.
+  console.log(chalk36.gray(`   All tool calls will be allowed without review.`));
+  console.log(chalk36.gray(`   Run "node9 resume" to re-enable early.
 `));
 });
 program.command("resume").description("Re-enable Node9 protection immediately").action(() => {
   const { paused } = checkPause();
   if (!paused) {
-    console.log(chalk35.gray("\nNode9 is already active \u2014 nothing to resume.\n"));
+    console.log(chalk36.gray("\nNode9 is already active \u2014 nothing to resume.\n"));
     return;
   }
   resumeNode9();
-  console.log(chalk35.green("\n\u25B6  Node9 resumed \u2014 protection is active.\n"));
+  console.log(chalk36.green("\n\u25B6  Node9 resumed \u2014 protection is active.\n"));
 });
 var HOOK_BASED_AGENTS = {
   claude: "claude",
@@ -27987,15 +28491,15 @@ program.argument("[command...]", "The agent command to run (e.g., gemini)").acti
     if (HOOK_BASED_AGENTS[firstArg2] !== void 0) {
       const target = HOOK_BASED_AGENTS[firstArg2];
       console.error(
-        chalk35.yellow(`
+        chalk36.yellow(`
 \u26A0\uFE0F  Node9 proxy mode does not support "${target}" directly.`)
       );
-      console.error(chalk35.white(`
+      console.error(chalk36.white(`
    "${target}" uses its own hook system. Use:`));
       console.error(
-        chalk35.green(`     node9 addto ${target}   `) + chalk35.gray("# one-time setup")
+        chalk36.green(`     node9 addto ${target}   `) + chalk36.gray("# one-time setup")
       );
-      console.error(chalk35.green(`     ${target}              `) + chalk35.gray("# run normally"));
+      console.error(chalk36.green(`     ${target}              `) + chalk36.gray("# run normally"));
       process.exit(1);
     }
     const runArgs = firstArg2 === "shell" ? commandArgs.slice(1) : commandArgs;
@@ -28012,7 +28516,7 @@ program.argument("[command...]", "The agent command to run (e.g., gemini)").acti
       }
     );
     if (result.noApprovalMechanism && !isDaemonRunning() && !process.env.NODE9_NO_AUTO_DAEMON && getConfig().settings.autoStartDaemon) {
-      console.error(chalk35.cyan("\n\u{1F6E1}\uFE0F  Node9: Starting approval daemon automatically..."));
+      console.error(chalk36.cyan("\n\u{1F6E1}\uFE0F  Node9: Starting approval daemon automatically..."));
       const daemonReady = await autoStartDaemonAndWait();
       if (daemonReady) result = await authorizeHeadless("shell", { command: fullCommand });
     }
@@ -28025,12 +28529,12 @@ program.argument("[command...]", "The agent command to run (e.g., gemini)").acti
     }
     if (!result.approved) {
       console.error(
-        chalk35.red(`
+        chalk36.red(`
 \u274C Node9 Blocked: ${result.reason || "Dangerous command detected."}`)
       );
       process.exit(1);
     }
-    console.error(chalk35.green("\n\u2705 Approved \u2014 running command...\n"));
+    console.error(chalk36.green("\n\u2705 Approved \u2014 running command...\n"));
     await runProxy(fullCommand);
   } else {
     program.help();
@@ -28045,6 +28549,7 @@ registerAgentsCommand(program);
 registerScanCommand(program);
 registerPostureCommand(program);
 registerEgressCommand(program);
+registerJailCommand(program);
 registerSandboxCommand(program, version);
 registerSessionsCommand(program);
 registerSessionTaintCommand(program);
@@ -28056,9 +28561,9 @@ if (process.argv[2] !== "daemon") {
     const isCheckHook = process.argv[2] === "check";
     if (isCheckHook) {
       if (process.env.NODE9_DEBUG === "1" || getConfig().settings.enableHookLogDebug) {
-        const logPath = path61.join(os55.homedir(), ".node9", "hook-debug.log");
+        const logPath = path63.join(os56.homedir(), ".node9", "hook-debug.log");
         const msg = reason instanceof Error ? reason.message : String(reason);
-        fs63.appendFileSync(logPath, `[${(/* @__PURE__ */ new Date()).toISOString()}] UNHANDLED: ${msg}
+        fs66.appendFileSync(logPath, `[${(/* @__PURE__ */ new Date()).toISOString()}] UNHANDLED: ${msg}
 `);
       }
       process.exit(0);