@node9/proxy 1.5.0 → 1.5.1

package/dist/cli.mjs

@@ -9,7 +9,51 @@ var __export = (target, all) => {
     __defProp(target, name, { get: all[name], enumerable: true });
 };
 
+// src/audit/hasher.ts
+import { createHash } from "crypto";
+function canonicalise(value) {
+  return _canonicalise(value, /* @__PURE__ */ new WeakSet());
+}
+function _canonicalise(value, seen) {
+  if (value === null || typeof value !== "object") return value;
+  if (value instanceof Date) return value.toISOString();
+  if (value instanceof RegExp) return value.toString();
+  if (Buffer.isBuffer(value)) return value.toString("base64");
+  if (seen.has(value)) return "[Circular]";
+  seen.add(value);
+  let result;
+  if (Array.isArray(value)) {
+    result = value.map((v) => _canonicalise(v, seen));
+  } else {
+    const obj = value;
+    result = Object.fromEntries(
+      Object.keys(obj).sort().map((k) => [k, _canonicalise(obj[k], seen)])
+    );
+  }
+  seen.delete(value);
+  return result;
+}
+function hashArgs(args) {
+  const canonical = JSON.stringify(canonicalise(args) ?? null);
+  return createHash("sha256").update(canonical).digest("hex").slice(0, 32);
+}
+var init_hasher = __esm({
+  "src/audit/hasher.ts"() {
+    "use strict";
+  }
+});
+
 // src/audit/index.ts
+var audit_exports = {};
+__export(audit_exports, {
+  HOOK_DEBUG_LOG: () => HOOK_DEBUG_LOG,
+  LOCAL_AUDIT_LOG: () => LOCAL_AUDIT_LOG,
+  appendConfigAudit: () => appendConfigAudit,
+  appendHookDebug: () => appendHookDebug,
+  appendLocalAudit: () => appendLocalAudit,
+  appendToLog: () => appendToLog,
+  redactSecrets: () => redactSecrets
+});
 import fs from "fs";
 import path from "path";
 import os from "os";
@@ -34,24 +78,24 @@ function appendToLog(logPath, entry) {
   } catch {
   }
 }
-function appendHookDebug(toolName, args, meta) {
-  const safeArgs = args ? JSON.parse(redactSecrets(JSON.stringify(args))) : {};
+function appendHookDebug(toolName, args, meta, auditHashArgsEnabled) {
+  const argsField = auditHashArgsEnabled ? { argsHash: hashArgs(args) } : { args: args ? JSON.parse(redactSecrets(JSON.stringify(args))) : {} };
   appendToLog(HOOK_DEBUG_LOG, {
     ts: (/* @__PURE__ */ new Date()).toISOString(),
     tool: toolName,
-    args: safeArgs,
+    ...argsField,
     agent: meta?.agent,
     mcpServer: meta?.mcpServer,
     hostname: os.hostname(),
     cwd: process.cwd()
   });
 }
-function appendLocalAudit(toolName, args, decision, checkedBy, meta) {
-  const safeArgs = args ? JSON.parse(redactSecrets(JSON.stringify(args))) : {};
+function appendLocalAudit(toolName, args, decision, checkedBy, meta, auditHashArgsEnabled) {
+  const argsField = auditHashArgsEnabled ? { argsHash: hashArgs(args) } : { args: args ? JSON.parse(redactSecrets(JSON.stringify(args))) : {} };
   appendToLog(LOCAL_AUDIT_LOG, {
     ts: (/* @__PURE__ */ new Date()).toISOString(),
     tool: toolName,
-    args: safeArgs,
+    ...argsField,
     decision,
     checkedBy,
     agent: meta?.agent,
@@ -70,6 +114,7 @@ var LOCAL_AUDIT_LOG, HOOK_DEBUG_LOG;
 var init_audit = __esm({
   "src/audit/index.ts"() {
     "use strict";
+    init_hasher();
     LOCAL_AUDIT_LOG = path.join(os.homedir(), ".node9", "audit.log");
     HOOK_DEBUG_LOG = path.join(os.homedir(), ".node9", "hook-debug.log");
   }
@@ -94,8 +139,8 @@ function sanitizeConfig(raw) {
     }
   }
   const lines = result.error.issues.map((issue) => {
-    const path27 = issue.path.length > 0 ? issue.path.join(".") : "root";
-    return `  \u2022 ${path27}: ${issue.message}`;
+    const path28 = issue.path.length > 0 ? issue.path.join(".") : "root";
+    return `  \u2022 ${path28}: ${issue.message}`;
   });
   return {
     sanitized,
@@ -167,7 +212,8 @@ var init_config_schema = __esm({
         environment: z.string().optional(),
         slackEnabled: z.boolean().optional(),
         enableTrustSessions: z.boolean().optional(),
-        allowGlobalPause: z.boolean().optional()
+        allowGlobalPause: z.boolean().optional(),
+        auditHashArgs: z.boolean().optional()
       }).optional(),
       policy: z.object({
         sandboxPaths: z.array(z.string()).optional(),
@@ -725,6 +771,7 @@ var init_config = __esm({
         approvalTimeoutMs: 12e4,
         // 120-second auto-deny timeout
         flightRecorder: true,
+        auditHashArgs: true,
         approvers: { native: true, browser: true, cloud: false, terminal: true }
       },
       policy: {
@@ -1694,9 +1741,9 @@ function matchesPattern(text, patterns) {
   const withoutDotSlash = text.replace(/^\.\//, "");
   return isMatch(withoutDotSlash) || isMatch(`./${withoutDotSlash}`);
 }
-function getNestedValue(obj, path27) {
+function getNestedValue(obj, path28) {
   if (!obj || typeof obj !== "object") return null;
-  return path27.split(".").reduce((prev, curr) => prev?.[curr], obj);
+  return path28.split(".").reduce((prev, curr) => prev?.[curr], obj);
 }
 function shouldSnapshot(toolName, args, config) {
   if (!config.settings.enableUndo) return false;
@@ -2471,6 +2518,58 @@ async function notifyDaemonViewer(toolName, args, meta, riskMetadata) {
   const { id, allowCount } = await res.json();
   return { id, allowCount: allowCount ?? 1 };
 }
+async function notifyTaint(filePath, source) {
+  if (!isDaemonRunning()) return;
+  const base = `http://${DAEMON_HOST}:${DAEMON_PORT}`;
+  try {
+    await fetch(`${base}/taint`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ path: filePath, source }),
+      signal: AbortSignal.timeout(1e3)
+    });
+  } catch {
+  }
+}
+async function notifyTaintPropagate(src, dest, clearSource = false) {
+  if (!isDaemonRunning()) return;
+  const base = `http://${DAEMON_HOST}:${DAEMON_PORT}`;
+  try {
+    await fetch(`${base}/taint/propagate`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ src, dest, clearSource }),
+      signal: AbortSignal.timeout(1e3)
+    });
+  } catch {
+  }
+}
+async function checkTaint(paths) {
+  if (paths.length === 0) return { tainted: false };
+  if (!isDaemonRunning()) return { tainted: false, daemonUnavailable: true };
+  const base = `http://${DAEMON_HOST}:${DAEMON_PORT}`;
+  try {
+    const res = await fetch(`${base}/taint/check`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ paths }),
+      signal: AbortSignal.timeout(2e3)
+    });
+    return await res.json();
+  } catch (err) {
+    try {
+      const { appendToLog: appendToLog2, HOOK_DEBUG_LOG: HOOK_DEBUG_LOG2 } = await Promise.resolve().then(() => (init_audit(), audit_exports));
+      appendToLog2(HOOK_DEBUG_LOG2, {
+        ts: (/* @__PURE__ */ new Date()).toISOString(),
+        event: "checkTaint-error",
+        error: String(err),
+        paths
+      });
+    } catch {
+    }
+    return { tainted: false, daemonUnavailable: true };
+  }
+}
 async function resolveViaDaemon(id, decision, internalToken, source) {
   const base = `http://${DAEMON_HOST}:${DAEMON_PORT}`;
   await fetch(`${base}/resolve/${id}`, {
@@ -2941,6 +3040,40 @@ import net from "net";
 import path13 from "path";
 import os10 from "os";
 import { randomUUID } from "crypto";
+function isWriteTool(toolName) {
+  const t = toolName.toLowerCase().replace(/[^a-z_]/g, "_");
+  return WRITE_TOOLS.has(t);
+}
+function extractFilePaths(toolName, args) {
+  const paths = [];
+  if (!args || typeof args !== "object" || Array.isArray(args)) return paths;
+  const a = args;
+  for (const key of ["file_path", "path", "filename", "source", "src", "input"]) {
+    if (typeof a[key] === "string" && a[key]) paths.push(a[key]);
+  }
+  const cmd = typeof a.command === "string" ? a.command : typeof a.cmd === "string" ? a.cmd : "";
+  if (cmd) {
+    for (const m of cmd.matchAll(/(?:-T|--upload-file|--data(?:-binary)?)\s+@?(\S+)/g)) {
+      paths.push(m[1]);
+    }
+    for (const m of cmd.matchAll(/\b(?:scp|rsync)\s+(?:-\S+\s+)*(\S+)\s+\S+@/g)) {
+      paths.push(m[1]);
+    }
+    for (const m of cmd.matchAll(/<\s*(\S+)/g)) {
+      paths.push(m[1]);
+    }
+  }
+  return paths.filter(Boolean);
+}
+function isNetworkTool(toolName, args) {
+  const t = toolName.toLowerCase();
+  if (t === "bash" || t === "shell" || t === "run_shell_command" || t === "terminal.execute") {
+    const a = args;
+    const cmd = typeof a?.command === "string" ? a.command : typeof a?.cmd === "string" ? a.cmd : "";
+    return /\b(curl|wget|scp|rsync|nc|ncat|netcat|ssh)\b/.test(cmd);
+  }
+  return false;
+}
 function notifyActivity(data) {
   return new Promise((resolve) => {
     try {
@@ -2970,7 +3103,7 @@ async function authorizeHeadless(toolName, args, meta, options) {
         id: actId,
         tool: toolName,
         ts: actTs,
-        status: result.approved ? "allow" : result.blockedByLabel?.includes("DLP") ? "dlp" : "block",
+        status: result.approved ? "allow" : result.blockedByLabel?.includes("DLP") ? "dlp" : result.blockedByLabel?.includes("Taint") ? "taint" : "block",
         label: result.blockedByLabel
       });
     }
@@ -2984,6 +3117,7 @@ async function _authorizeHeadlessCore(toolName, args, meta, options) {
   if (pauseState.paused) return { approved: true, checkedBy: "paused" };
   const creds = getCredentials();
   const config = getConfig(options?.cwd);
+  const hashAuditArgs = config.settings.auditHashArgs === true;
   const isTestEnv2 = !!(process.env.VITEST || process.env.NODE_ENV === "test" || process.env.CI || process.env.NODE9_TESTING === "1");
   const approvers = {
     ...config.settings.approvers || { native: true, browser: true, cloud: true, terminal: true }
@@ -2994,13 +3128,26 @@ async function _authorizeHeadlessCore(toolName, args, meta, options) {
     approvers.terminal = false;
   }
   if (config.settings.enableHookLogDebug && !isTestEnv2) {
-    appendHookDebug(toolName, args, meta);
+    appendHookDebug(toolName, args, meta, hashAuditArgs);
   }
   const isManual = meta?.agent === "Terminal";
   let explainableLabel = "Local Config";
   let policyMatchedField;
   let policyMatchedWord;
   let riskMetadata;
+  let taintWarning = null;
+  if (isNetworkTool(toolName, args)) {
+    const filePaths = extractFilePaths(toolName, args);
+    if (filePaths.length > 0) {
+      const taintResult = await checkTaint(filePaths);
+      if (taintResult.tainted && taintResult.record) {
+        const { path: taintedPath, source: taintSource } = taintResult.record;
+        taintWarning = `\u26A0\uFE0F ${taintedPath} was flagged by ${taintSource} \u2014 this file may contain sensitive data`;
+      } else if (taintResult.daemonUnavailable) {
+        taintWarning = `\u26A0\uFE0F Taint service unavailable \u2014 cannot verify if ${filePaths.join(", ")} is clean`;
+      }
+    }
+  }
   if (config.policy.dlp.enabled && (!isIgnoredTool(toolName) || config.policy.dlp.scanIgnoredTools)) {
     const argsObj = args && typeof args === "object" && !Array.isArray(args) ? args : {};
     const filePath = String(argsObj.file_path ?? argsObj.path ?? argsObj.filename ?? "");
@@ -3008,7 +3155,10 @@ async function _authorizeHeadlessCore(toolName, args, meta, options) {
     if (dlpMatch) {
       const dlpReason = `\u{1F6A8} DATA LOSS PREVENTION: ${dlpMatch.patternName} detected in field "${dlpMatch.fieldPath}" (${dlpMatch.redactedSample})`;
       if (dlpMatch.severity === "block") {
-        if (!isManual) appendLocalAudit(toolName, args, "deny", "dlp-block", meta);
+        if (!isManual) appendLocalAudit(toolName, args, "deny", "dlp-block", meta, true);
+        if (isWriteTool(toolName) && filePath) {
+          await notifyTaint(filePath, `DLP:${dlpMatch.patternName}`);
+        }
         return {
           approved: false,
           reason: dlpReason,
@@ -3016,7 +3166,8 @@ async function _authorizeHeadlessCore(toolName, args, meta, options) {
           blockedByLabel: "\u{1F6A8} Node9 DLP (Secret Detected)"
         };
       }
-      if (!isManual) appendLocalAudit(toolName, args, "allow", "dlp-review-flagged", meta);
+      if (!isManual)
+        appendLocalAudit(toolName, args, "allow", "dlp-review-flagged", meta, hashAuditArgs);
       explainableLabel = "\u{1F6A8} Node9 DLP (Credential Review)";
     }
   }
@@ -3024,7 +3175,7 @@ async function _authorizeHeadlessCore(toolName, args, meta, options) {
     if (!isIgnoredTool(toolName)) {
       const policyResult = await evaluatePolicy(toolName, args, meta?.agent, options?.cwd);
       if (policyResult.decision === "review") {
-        appendLocalAudit(toolName, args, "allow", "audit-mode", meta);
+        appendLocalAudit(toolName, args, "allow", "audit-mode", meta, hashAuditArgs);
         if (approvers.cloud && creds?.apiKey) {
           await auditLocalAllow(toolName, args, "audit-mode", creds, meta);
         }
@@ -3032,22 +3183,23 @@ async function _authorizeHeadlessCore(toolName, args, meta, options) {
     }
     return { approved: true, checkedBy: "audit" };
   }
-  if (!isIgnoredTool(toolName)) {
+  if (!taintWarning && !isIgnoredTool(toolName)) {
     if (getActiveTrustSession(toolName)) {
       if (approvers.cloud && creds?.apiKey)
         await auditLocalAllow(toolName, args, "trust", creds, meta);
-      if (!isManual) appendLocalAudit(toolName, args, "allow", "trust", meta);
+      if (!isManual) appendLocalAudit(toolName, args, "allow", "trust", meta, hashAuditArgs);
       return { approved: true, checkedBy: "trust" };
     }
     const policyResult = await evaluatePolicy(toolName, args, meta?.agent);
     if (policyResult.decision === "allow") {
       if (approvers.cloud && creds?.apiKey)
         auditLocalAllow(toolName, args, "local-policy", creds, meta);
-      if (!isManual) appendLocalAudit(toolName, args, "allow", "local-policy", meta);
+      if (!isManual) appendLocalAudit(toolName, args, "allow", "local-policy", meta, hashAuditArgs);
       return { approved: true, checkedBy: "local-policy" };
     }
     if (policyResult.decision === "block") {
-      if (!isManual) appendLocalAudit(toolName, args, "deny", "smart-rule-block", meta);
+      if (!isManual)
+        appendLocalAudit(toolName, args, "deny", "smart-rule-block", meta, hashAuditArgs);
       return {
         approved: false,
         reason: policyResult.reason ?? "Action explicitly blocked by Smart Policy.",
@@ -3066,15 +3218,16 @@ async function _authorizeHeadlessCore(toolName, args, meta, options) {
       policyMatchedWord,
       policyResult.ruleName
     );
-    const persistent = getPersistentDecision(toolName);
+    const persistent = policyResult.ruleName ? null : getPersistentDecision(toolName);
     if (persistent === "allow") {
       if (approvers.cloud && creds?.apiKey)
         await auditLocalAllow(toolName, args, "persistent", creds, meta);
-      if (!isManual) appendLocalAudit(toolName, args, "allow", "persistent", meta);
+      if (!isManual) appendLocalAudit(toolName, args, "allow", "persistent", meta, hashAuditArgs);
       return { approved: true, checkedBy: "persistent" };
     }
     if (persistent === "deny") {
-      if (!isManual) appendLocalAudit(toolName, args, "deny", "persistent-deny", meta);
+      if (!isManual)
+        appendLocalAudit(toolName, args, "deny", "persistent-deny", meta, hashAuditArgs);
       return {
         approved: false,
         reason: `This tool ("${toolName}") is explicitly listed in your 'Always Deny' list.`,
@@ -3082,10 +3235,21 @@ async function _authorizeHeadlessCore(toolName, args, meta, options) {
         blockedByLabel: "Persistent User Rule"
       };
     }
-  } else {
-    if (!isManual) appendLocalAudit(toolName, args, "allow", "ignored", meta);
+  } else if (!taintWarning) {
+    if (!isManual) appendLocalAudit(toolName, args, "allow", "ignored", meta, hashAuditArgs);
     return { approved: true };
   }
+  if (taintWarning) {
+    explainableLabel = "\u{1F534} Node9 Taint (Exfiltration Prevention)";
+    riskMetadata = computeRiskMetadata(
+      args,
+      7,
+      explainableLabel,
+      void 0,
+      void 0,
+      taintWarning
+    );
+  }
   let cloudRequestId = null;
   const cloudEnforced = approvers.cloud && !!creds?.apiKey;
   if (cloudEnforced) {
@@ -3104,7 +3268,7 @@ async function _authorizeHeadlessCore(toolName, args, meta, options) {
         };
       }
       cloudRequestId = initResult.requestId || null;
-      explainableLabel = "Organization Policy (SaaS)";
+      if (!taintWarning) explainableLabel = "Organization Policy (SaaS)";
     } catch {
     }
   }
@@ -3291,12 +3455,13 @@ REASON: Action blocked because no approval channels are available. (Native/Brows
       args,
       finalResult.approved ? "allow" : "deny",
       finalResult.checkedBy || finalResult.blockedBy || "unknown",
-      meta
+      meta,
+      hashAuditArgs
     );
   }
   return finalResult;
 }
-var ACTIVITY_SOCKET_PATH;
+var WRITE_TOOLS, ACTIVITY_SOCKET_PATH;
 var init_orchestrator = __esm({
   "src/auth/orchestrator.ts"() {
     "use strict";
@@ -3309,6 +3474,17 @@ var init_orchestrator = __esm({
     init_state();
     init_daemon();
     init_cloud();
+    WRITE_TOOLS = /* @__PURE__ */ new Set([
+      "write",
+      "write_file",
+      "create_file",
+      "edit",
+      "multiedit",
+      "str_replace_based_edit_tool",
+      "replace",
+      "notebook_edit",
+      "notebookedit"
+    ]);
     ACTIVITY_SOCKET_PATH = process.platform === "win32" ? "\\\\.\\pipe\\node9-activity" : path13.join(os10.tmpdir(), "node9-activity.sock");
   }
 });
@@ -4493,12 +4669,15 @@ var init_ui = __esm({
         const badgeClass = isEdit ? 'sniper-badge-edit' : 'sniper-badge-exec';
         const badgeLabel = isEdit ? '\u{1F4DD} Code Edit' : '\u{1F6D1} Execution';
         const tierLabel = \`Tier \${rm.tier} \xB7 \${esc(rm.blockedByLabel)}\`;
+        const isTaint = rm.blockedByLabel?.includes('Taint');
         const fileLine =
-          isEdit && rm.editFilePath
-            ? \`<div class="sniper-filepath">\u{1F4C2} \${esc(rm.editFilePath)}</div>\`
-            : !isEdit && rm.matchedWord
-              ? \`<div class="sniper-match">Matched: <code>\${esc(rm.matchedWord)}</code>\${rm.matchedField ? \` in <code>\${esc(rm.matchedField)}</code>\` : ''}</div>\`
-              : '';
+          isTaint && rm.ruleName
+            ? \`<div class="sniper-match">\u26A0\uFE0F \${esc(rm.ruleName)}</div>\`
+            : isEdit && rm.editFilePath
+              ? \`<div class="sniper-filepath">\u{1F4C2} \${esc(rm.editFilePath)}</div>\`
+              : !isEdit && rm.matchedWord
+                ? \`<div class="sniper-match">Matched: <code>\${esc(rm.matchedWord)}</code>\${rm.matchedField ? \` in <code>\${esc(rm.matchedField)}</code>\` : ''}</div>\`
+                : '';
         const snippetHtml = rm.contextSnippet ? \`<pre>\${esc(rm.contextSnippet)}</pre>\` : '';
         return \`
           <div class="sniper-header">
@@ -5032,17 +5211,97 @@ var init_suggestion_tracker = __esm({
   }
 });
 
-// src/daemon/state.ts
-import net2 from "net";
+// src/daemon/taint-store.ts
 import fs12 from "fs";
 import path15 from "path";
+var DEFAULT_TTL_MS, TaintStore;
+var init_taint_store = __esm({
+  "src/daemon/taint-store.ts"() {
+    "use strict";
+    DEFAULT_TTL_MS = 60 * 60 * 1e3;
+    TaintStore = class {
+      records = /* @__PURE__ */ new Map();
+      /** Add or refresh taint on an absolute path. */
+      taint(filePath, source, ttlMs = DEFAULT_TTL_MS) {
+        const resolved = this._resolve(filePath);
+        const now = Date.now();
+        this.records.set(resolved, {
+          path: resolved,
+          source,
+          createdAt: now,
+          expiresAt: now + ttlMs
+        });
+      }
+      /**
+       * Check whether a path is currently tainted.
+       * Returns the TaintRecord if tainted (and not expired), null otherwise.
+       * Expired records are pruned on access.
+       */
+      check(filePath) {
+        const resolved = this._resolve(filePath);
+        const record = this.records.get(resolved);
+        if (!record) return null;
+        if (Date.now() > record.expiresAt) {
+          this.records.delete(resolved);
+          return null;
+        }
+        return record;
+      }
+      /**
+       * Propagate taint from sourcePath to destPath (e.g. cp, mv).
+       * For mv semantics (clearSource=true) the source taint is removed.
+       */
+      propagate(sourcePath, destPath, clearSource = false) {
+        const taintRecord = this.check(sourcePath);
+        if (!taintRecord) return;
+        const remainingMs = taintRecord.expiresAt - Date.now();
+        if (remainingMs > 0) {
+          const baseSource = taintRecord.source.replace(/^(propagated:)+/, "");
+          this.taint(destPath, `propagated:${baseSource}`, remainingMs);
+        }
+        if (clearSource) {
+          this.records.delete(this._resolve(sourcePath));
+        }
+      }
+      /** Remove all expired records. Called periodically by the daemon. */
+      prune() {
+        const now = Date.now();
+        for (const [key, record] of this.records) {
+          if (now > record.expiresAt) this.records.delete(key);
+        }
+      }
+      /** Return all non-expired taint records (for audit/debug). */
+      list() {
+        this.prune();
+        return [...this.records.values()];
+      }
+      /** Remove all taint records atomically. Used by tests to reset state between runs. */
+      clear() {
+        this.records.clear();
+      }
+      /** Resolve to absolute path, falling back to path.resolve if file doesn't exist yet. */
+      _resolve(filePath) {
+        try {
+          return fs12.realpathSync.native(path15.resolve(filePath));
+        } catch {
+          return path15.resolve(filePath);
+        }
+      }
+    };
+  }
+});
+
+// src/daemon/state.ts
+import net2 from "net";
+import fs13 from "fs";
+import path16 from "path";
 import os12 from "os";
 import { spawn as spawn2 } from "child_process";
 import { randomUUID as randomUUID3 } from "crypto";
 function loadInsightCounts() {
   try {
-    if (!fs12.existsSync(INSIGHT_COUNTS_FILE)) return;
-    const data = JSON.parse(fs12.readFileSync(INSIGHT_COUNTS_FILE, "utf-8"));
+    if (!fs13.existsSync(INSIGHT_COUNTS_FILE)) return;
+    const data = JSON.parse(fs13.readFileSync(INSIGHT_COUNTS_FILE, "utf-8"));
     for (const [tool, count] of Object.entries(data)) {
       if (typeof count === "number" && count > 0) insightCounts.set(tool, count);
     }
@@ -5081,23 +5340,23 @@ function markRejectionHandlerRegistered() {
   daemonRejectionHandlerRegistered = true;
 }
 function atomicWriteSync2(filePath, data, options) {
-  const dir = path15.dirname(filePath);
-  if (!fs12.existsSync(dir)) fs12.mkdirSync(dir, { recursive: true });
+  const dir = path16.dirname(filePath);
+  if (!fs13.existsSync(dir)) fs13.mkdirSync(dir, { recursive: true });
   const tmpPath = `${filePath}.${randomUUID3()}.tmp`;
   try {
-    fs12.writeFileSync(tmpPath, data, options);
+    fs13.writeFileSync(tmpPath, data, options);
   } catch (err) {
     try {
-      fs12.unlinkSync(tmpPath);
+      fs13.unlinkSync(tmpPath);
     } catch {
     }
     throw err;
   }
   try {
-    fs12.renameSync(tmpPath, filePath);
+    fs13.renameSync(tmpPath, filePath);
   } catch (err) {
     try {
-      fs12.unlinkSync(tmpPath);
+      fs13.unlinkSync(tmpPath);
     } catch {
     }
     throw err;
@@ -5121,16 +5380,16 @@ function appendAuditLog(data) {
       decision: data.decision,
       source: "daemon"
     };
-    const dir = path15.dirname(AUDIT_LOG_FILE);
-    if (!fs12.existsSync(dir)) fs12.mkdirSync(dir, { recursive: true });
-    fs12.appendFileSync(AUDIT_LOG_FILE, JSON.stringify(entry) + "\n");
+    const dir = path16.dirname(AUDIT_LOG_FILE);
+    if (!fs13.existsSync(dir)) fs13.mkdirSync(dir, { recursive: true });
+    fs13.appendFileSync(AUDIT_LOG_FILE, JSON.stringify(entry) + "\n");
   } catch {
   }
 }
 function getAuditHistory(limit = 20) {
   try {
-    if (!fs12.existsSync(AUDIT_LOG_FILE)) return [];
-    const lines = fs12.readFileSync(AUDIT_LOG_FILE, "utf-8").trim().split("\n");
+    if (!fs13.existsSync(AUDIT_LOG_FILE)) return [];
+    const lines = fs13.readFileSync(AUDIT_LOG_FILE, "utf-8").trim().split("\n");
     if (lines.length === 1 && lines[0] === "") return [];
     return lines.slice(-limit).map((l) => JSON.parse(l)).reverse();
   } catch {
@@ -5139,19 +5398,19 @@ function getAuditHistory(limit = 20) {
 }
 function getOrgName() {
   try {
-    if (fs12.existsSync(CREDENTIALS_FILE)) return "Node9 Cloud";
+    if (fs13.existsSync(CREDENTIALS_FILE)) return "Node9 Cloud";
   } catch {
   }
   return null;
 }
 function hasStoredSlackKey() {
-  return fs12.existsSync(CREDENTIALS_FILE);
+  return fs13.existsSync(CREDENTIALS_FILE);
 }
 function writeGlobalSetting(key, value) {
   let config = {};
   try {
-    if (fs12.existsSync(GLOBAL_CONFIG_FILE)) {
-      config = JSON.parse(fs12.readFileSync(GLOBAL_CONFIG_FILE, "utf-8"));
+    if (fs13.existsSync(GLOBAL_CONFIG_FILE)) {
+      config = JSON.parse(fs13.readFileSync(GLOBAL_CONFIG_FILE, "utf-8"));
     }
   } catch {
   }
@@ -5163,8 +5422,8 @@ function writeTrustEntry(toolName, durationMs) {
   try {
     let trust = { entries: [] };
     try {
-      if (fs12.existsSync(TRUST_FILE2))
-        trust = JSON.parse(fs12.readFileSync(TRUST_FILE2, "utf-8"));
+      if (fs13.existsSync(TRUST_FILE2))
+        trust = JSON.parse(fs13.readFileSync(TRUST_FILE2, "utf-8"));
     } catch {
     }
     trust.entries = trust.entries.filter((e) => e.tool !== toolName && e.expiry > Date.now());
@@ -5175,8 +5434,8 @@ function writeTrustEntry(toolName, durationMs) {
 }
 function readPersistentDecisions() {
   try {
-    if (fs12.existsSync(DECISIONS_FILE)) {
-      return JSON.parse(fs12.readFileSync(DECISIONS_FILE, "utf-8"));
+    if (fs13.existsSync(DECISIONS_FILE)) {
+      return JSON.parse(fs13.readFileSync(DECISIONS_FILE, "utf-8"));
     }
   } catch {
   }
@@ -5241,7 +5500,7 @@ function abandonPending() {
   });
   if (autoStarted) {
     try {
-      fs12.unlinkSync(DAEMON_PID_FILE);
+      fs13.unlinkSync(DAEMON_PID_FILE);
     } catch {
     }
     setTimeout(() => {
@@ -5252,7 +5511,7 @@ function abandonPending() {
 }
 function startActivitySocket() {
   try {
-    fs12.unlinkSync(ACTIVITY_SOCKET_PATH2);
+    fs13.unlinkSync(ACTIVITY_SOCKET_PATH2);
   } catch {
   }
   const ACTIVITY_MAX_BYTES = 1024 * 1024;
@@ -5294,29 +5553,31 @@ function startActivitySocket() {
   unixServer.listen(ACTIVITY_SOCKET_PATH2);
   process.on("exit", () => {
     try {
-      fs12.unlinkSync(ACTIVITY_SOCKET_PATH2);
+      fs13.unlinkSync(ACTIVITY_SOCKET_PATH2);
     } catch {
     }
   });
 }
-var homeDir, DAEMON_PID_FILE, DECISIONS_FILE, AUDIT_LOG_FILE, TRUST_FILE2, GLOBAL_CONFIG_FILE, CREDENTIALS_FILE, INSIGHT_COUNTS_FILE, pending, sseClients, suggestionTracker, suggestions, insightCounts, _abandonTimer, _hadBrowserClient, _daemonServer, daemonRejectionHandlerRegistered, AUTO_DENY_MS, TRUST_DURATIONS, autoStarted, ACTIVITY_SOCKET_PATH2, ACTIVITY_RING_SIZE, activityRing, SECRET_KEY_RE;
+var homeDir, DAEMON_PID_FILE, DECISIONS_FILE, AUDIT_LOG_FILE, TRUST_FILE2, GLOBAL_CONFIG_FILE, CREDENTIALS_FILE, INSIGHT_COUNTS_FILE, pending, sseClients, suggestionTracker, suggestions, taintStore, insightCounts, _abandonTimer, _hadBrowserClient, _daemonServer, daemonRejectionHandlerRegistered, AUTO_DENY_MS, TRUST_DURATIONS, autoStarted, ACTIVITY_SOCKET_PATH2, ACTIVITY_RING_SIZE, activityRing, SECRET_KEY_RE;
 var init_state2 = __esm({
   "src/daemon/state.ts"() {
     "use strict";
     init_daemon();
     init_suggestion_tracker();
+    init_taint_store();
     homeDir = os12.homedir();
-    DAEMON_PID_FILE = path15.join(homeDir, ".node9", "daemon.pid");
-    DECISIONS_FILE = path15.join(homeDir, ".node9", "decisions.json");
-    AUDIT_LOG_FILE = path15.join(homeDir, ".node9", "audit.log");
-    TRUST_FILE2 = path15.join(homeDir, ".node9", "trust.json");
-    GLOBAL_CONFIG_FILE = path15.join(homeDir, ".node9", "config.json");
-    CREDENTIALS_FILE = path15.join(homeDir, ".node9", "credentials.json");
-    INSIGHT_COUNTS_FILE = path15.join(homeDir, ".node9", "insight-counts.json");
+    DAEMON_PID_FILE = path16.join(homeDir, ".node9", "daemon.pid");
+    DECISIONS_FILE = path16.join(homeDir, ".node9", "decisions.json");
+    AUDIT_LOG_FILE = path16.join(homeDir, ".node9", "audit.log");
+    TRUST_FILE2 = path16.join(homeDir, ".node9", "trust.json");
+    GLOBAL_CONFIG_FILE = path16.join(homeDir, ".node9", "config.json");
+    CREDENTIALS_FILE = path16.join(homeDir, ".node9", "credentials.json");
+    INSIGHT_COUNTS_FILE = path16.join(homeDir, ".node9", "insight-counts.json");
     pending = /* @__PURE__ */ new Map();
     sseClients = /* @__PURE__ */ new Set();
     suggestionTracker = new SuggestionTracker(3);
     suggestions = /* @__PURE__ */ new Map();
+    taintStore = new TaintStore();
     insightCounts = /* @__PURE__ */ new Map();
     _abandonTimer = null;
     _hadBrowserClient = false;
@@ -5329,7 +5590,7 @@ var init_state2 = __esm({
       "2h": 2 * 60 * 6e4
     };
     autoStarted = process.env.NODE9_AUTO_STARTED === "1";
-    ACTIVITY_SOCKET_PATH2 = process.platform === "win32" ? "\\\\.\\pipe\\node9-activity" : path15.join(os12.tmpdir(), "node9-activity.sock");
+    ACTIVITY_SOCKET_PATH2 = process.platform === "win32" ? "\\\\.\\pipe\\node9-activity" : path16.join(os12.tmpdir(), "node9-activity.sock");
     ACTIVITY_RING_SIZE = 100;
     activityRing = [];
     SECRET_KEY_RE = /password|secret|token|key|apikey|credential|auth/i;
@@ -5337,14 +5598,14 @@ var init_state2 = __esm({
 });
 
 // src/config/patch.ts
-import fs13 from "fs";
-import path16 from "path";
+import fs14 from "fs";
+import path17 from "path";
 import os13 from "os";
 function patchConfig(configPath, patch) {
   let config = {};
   try {
-    if (fs13.existsSync(configPath)) {
-      config = JSON.parse(fs13.readFileSync(configPath, "utf8"));
+    if (fs14.existsSync(configPath)) {
+      config = JSON.parse(fs14.readFileSync(configPath, "utf8"));
     }
   } catch {
     throw new Error(`Cannot read config at ${configPath} \u2014 file may be corrupted`);
@@ -5363,23 +5624,23 @@ function patchConfig(configPath, patch) {
       ignored.push(patch.toolName);
     }
   }
-  const dir = path16.dirname(configPath);
-  fs13.mkdirSync(dir, { recursive: true });
+  const dir = path17.dirname(configPath);
+  fs14.mkdirSync(dir, { recursive: true });
   const tmp = configPath + ".node9-tmp";
   try {
-    fs13.writeFileSync(tmp, JSON.stringify(config, null, 2), { mode: 384 });
+    fs14.writeFileSync(tmp, JSON.stringify(config, null, 2), { mode: 384 });
   } catch (err) {
     try {
-      fs13.unlinkSync(tmp);
+      fs14.unlinkSync(tmp);
     } catch {
     }
     throw err;
   }
   try {
-    fs13.renameSync(tmp, configPath);
+    fs14.renameSync(tmp, configPath);
   } catch (err) {
     try {
-      fs13.unlinkSync(tmp);
+      fs14.unlinkSync(tmp);
     } catch {
     }
     throw err;
@@ -5389,14 +5650,14 @@ var GLOBAL_CONFIG_PATH;
 var init_patch = __esm({
   "src/config/patch.ts"() {
     "use strict";
-    GLOBAL_CONFIG_PATH = path16.join(os13.homedir(), ".node9", "config.json");
+    GLOBAL_CONFIG_PATH = path17.join(os13.homedir(), ".node9", "config.json");
   }
 });
 
 // src/daemon/server.ts
 import http from "http";
-import fs14 from "fs";
-import path17 from "path";
+import fs15 from "fs";
+import path18 from "path";
 import { randomUUID as randomUUID4 } from "crypto";
 import { spawnSync as spawnSync2 } from "child_process";
 import chalk2 from "chalk";
@@ -5416,7 +5677,7 @@ function startDaemon() {
     idleTimer = setTimeout(() => {
       if (autoStarted) {
         try {
-          fs14.unlinkSync(DAEMON_PID_FILE);
+          fs15.unlinkSync(DAEMON_PID_FILE);
         } catch {
         }
       }
@@ -5571,7 +5832,7 @@ data: ${JSON.stringify(item.data)}
             status: "pending"
           });
         }
-        const projectCwd = typeof cwd === "string" && path17.isAbsolute(cwd) ? cwd : void 0;
+        const projectCwd = typeof cwd === "string" && path18.isAbsolute(cwd) ? cwd : void 0;
         const projectConfig = getConfig(projectCwd);
         const browserEnabled = projectConfig.settings.approvers?.browser !== false;
         const terminalEnabled = projectConfig.settings.approvers?.terminal !== false;
@@ -5922,8 +6183,8 @@ data: ${JSON.stringify(item.data)}
         const body = await readBody(req);
         const data = body ? JSON.parse(body) : {};
         const configPath = data.configPath ?? GLOBAL_CONFIG_PATH;
-        const node9Dir = path17.dirname(GLOBAL_CONFIG_PATH);
-        if (!path17.resolve(configPath).startsWith(node9Dir + path17.sep)) {
+        const node9Dir = path18.dirname(GLOBAL_CONFIG_PATH);
+        if (!path18.resolve(configPath).startsWith(node9Dir + path18.sep)) {
           res.writeHead(400, { "Content-Type": "application/json" });
           return res.end(
             JSON.stringify({ error: "configPath must be within the node9 config directory" })
@@ -5971,20 +6232,77 @@ data: ${JSON.stringify(item.data)}
         res.writeHead(400).end();
       }
     }
+    if (req.method === "POST" && pathname === "/taint") {
+      try {
+        const body = JSON.parse(await readBody(req));
+        if (typeof body.path !== "string" || typeof body.source !== "string") {
+          res.writeHead(400, { "Content-Type": "application/json" });
+          return res.end(JSON.stringify({ error: "path and source are required strings" }));
+        }
+        const ttlMs = typeof body.ttlMs === "number" ? body.ttlMs : void 0;
+        taintStore.taint(body.path, body.source, ttlMs);
+        res.writeHead(200, { "Content-Type": "application/json" });
+        return res.end(JSON.stringify({ ok: true }));
+      } catch {
+        res.writeHead(400).end();
+        return;
+      }
+    }
+    if (req.method === "POST" && pathname === "/taint/check") {
+      try {
+        const body = JSON.parse(await readBody(req));
+        if (!Array.isArray(body.paths)) {
+          res.writeHead(400, { "Content-Type": "application/json" });
+          return res.end(JSON.stringify({ error: "paths must be an array" }));
+        }
+        if (body.paths.some((p) => typeof p !== "string")) {
+          res.writeHead(400, { "Content-Type": "application/json" });
+          return res.end(JSON.stringify({ error: "all paths must be strings" }));
+        }
+        for (const p of body.paths) {
+          const record = taintStore.check(p);
+          if (record) {
+            res.writeHead(200, { "Content-Type": "application/json" });
+            return res.end(JSON.stringify({ tainted: true, record }));
+          }
+        }
+        res.writeHead(200, { "Content-Type": "application/json" });
+        return res.end(JSON.stringify({ tainted: false }));
+      } catch {
+        res.writeHead(400).end();
+        return;
+      }
+    }
+    if (req.method === "POST" && pathname === "/taint/propagate") {
+      try {
+        const body = JSON.parse(await readBody(req));
+        if (typeof body.src !== "string" || typeof body.dest !== "string") {
+          res.writeHead(400, { "Content-Type": "application/json" });
+          return res.end(JSON.stringify({ error: "src and dest are required strings" }));
+        }
+        const clearSource = body.clearSource === true;
+        taintStore.propagate(body.src, body.dest, clearSource);
+        res.writeHead(200, { "Content-Type": "application/json" });
+        return res.end(JSON.stringify({ ok: true }));
+      } catch {
+        res.writeHead(400).end();
+        return;
+      }
+    }
     res.writeHead(404).end();
   });
   setDaemonServer(server);
   server.on("error", (e) => {
     if (e.code === "EADDRINUSE") {
       try {
-        if (fs14.existsSync(DAEMON_PID_FILE)) {
-          const { pid } = JSON.parse(fs14.readFileSync(DAEMON_PID_FILE, "utf-8"));
+        if (fs15.existsSync(DAEMON_PID_FILE)) {
+          const { pid } = JSON.parse(fs15.readFileSync(DAEMON_PID_FILE, "utf-8"));
           process.kill(pid, 0);
           return process.exit(0);
         }
       } catch {
         try {
-          fs14.unlinkSync(DAEMON_PID_FILE);
+          fs15.unlinkSync(DAEMON_PID_FILE);
         } catch {
         }
         server.listen(DAEMON_PORT, DAEMON_HOST);
@@ -6056,28 +6374,28 @@ var init_server = __esm({
 });
 
 // src/daemon/index.ts
-import fs15 from "fs";
+import fs16 from "fs";
 import chalk3 from "chalk";
 import { spawnSync as spawnSync3 } from "child_process";
 function stopDaemon() {
-  if (!fs15.existsSync(DAEMON_PID_FILE)) return console.log(chalk3.yellow("Not running."));
+  if (!fs16.existsSync(DAEMON_PID_FILE)) return console.log(chalk3.yellow("Not running."));
   try {
-    const { pid } = JSON.parse(fs15.readFileSync(DAEMON_PID_FILE, "utf-8"));
+    const { pid } = JSON.parse(fs16.readFileSync(DAEMON_PID_FILE, "utf-8"));
     process.kill(pid, "SIGTERM");
     console.log(chalk3.green("\u2705 Stopped."));
   } catch {
     console.log(chalk3.gray("Cleaned up stale PID file."));
   } finally {
     try {
-      fs15.unlinkSync(DAEMON_PID_FILE);
+      fs16.unlinkSync(DAEMON_PID_FILE);
     } catch {
     }
   }
 }
 function daemonStatus() {
-  if (fs15.existsSync(DAEMON_PID_FILE)) {
+  if (fs16.existsSync(DAEMON_PID_FILE)) {
     try {
-      const { pid } = JSON.parse(fs15.readFileSync(DAEMON_PID_FILE, "utf-8"));
+      const { pid } = JSON.parse(fs16.readFileSync(DAEMON_PID_FILE, "utf-8"));
       process.kill(pid, 0);
       console.log(chalk3.green("Node9 daemon: running"));
       return;
@@ -6112,9 +6430,9 @@ __export(tail_exports, {
 });
 import http2 from "http";
 import chalk16 from "chalk";
-import fs23 from "fs";
+import fs24 from "fs";
 import os21 from "os";
-import path25 from "path";
+import path26 from "path";
 import readline3 from "readline";
 import { spawn as spawn9, execSync as execSync3 } from "child_process";
 function getIcon(tool) {
@@ -6154,9 +6472,9 @@ function renderPending(activity) {
 }
 async function ensureDaemon() {
   let pidPort = null;
-  if (fs23.existsSync(PID_FILE)) {
+  if (fs24.existsSync(PID_FILE)) {
     try {
-      const { port } = JSON.parse(fs23.readFileSync(PID_FILE, "utf-8"));
+      const { port } = JSON.parse(fs24.readFileSync(PID_FILE, "utf-8"));
       pidPort = port;
     } catch {
       console.error(chalk16.dim("\u26A0\uFE0F  Could not read PID file; falling back to default port."));
@@ -6227,9 +6545,12 @@ function buildCardLines(req, localCount = 0) {
     ``,
     `${BOLD}${CYAN}\u2554\u2550\u2550 Node9 Approval Required \u2550\u2550\u2557${RESET}`,
     `${CYAN}\u2551${RESET} Tool:    ${BOLD}${req.toolName}${RESET}`,
-    `${CYAN}\u2551${RESET} Reason:  ${tierLabel} \u2014 ${blockedBy}${RESET}`,
-    `${CYAN}\u2551${RESET} Args:    ${GRAY}${argsPreview}${RESET}`
+    `${CYAN}\u2551${RESET} Reason:  ${tierLabel} \u2014 ${blockedBy}${RESET}`
   ];
+  if (req.riskMetadata?.ruleName && blockedBy.includes("Taint")) {
+    lines.push(`${CYAN}\u2551${RESET} ${YELLOW}\u26A0  ${req.riskMetadata.ruleName}${RESET}`);
+  }
+  lines.push(`${CYAN}\u2551${RESET} Args:    ${GRAY}${argsPreview}${RESET}`);
   if (localCount >= 2) {
     lines.push(
       `${CYAN}\u2551${RESET} ${YELLOW}\u{1F4A1}${RESET} Approved ${localCount}\xD7 before \u2014 ${BOLD}[a]${RESET}${YELLOW} creates a permanent rule${RESET}`
@@ -6291,12 +6612,13 @@ async function startTail(options = {}) {
   if (canApprove) readline3.emitKeypressEvents(process.stdin);
   function clearCard() {
     if (cardLineCount > 0) {
-      process.stdout.write(RESTORE_CURSOR + ERASE_DOWN);
+      readline3.moveCursor(process.stdout, 0, -cardLineCount);
+      process.stdout.write(ERASE_DOWN);
       cardLineCount = 0;
     }
   }
   function printCard(req2) {
-    process.stdout.write(HIDE_CURSOR + SAVE_CURSOR);
+    process.stdout.write(HIDE_CURSOR);
     const daemonPrior = req2.allowCount !== void 0 ? req2.allowCount - 1 : 0;
     const localPrior = localAllowCounts.get(req2.toolName) ?? 0;
     const priorCount = Math.max(daemonPrior, localPrior);
@@ -6332,7 +6654,7 @@ async function startTail(options = {}) {
       if (settled) return;
       settled = true;
       cleanup();
-      process.stdout.write(RESTORE_CURSOR + ERASE_DOWN);
+      clearCard();
       const stampedLines = buildCardLines(
         req2,
         Math.max(
@@ -6363,8 +6685,8 @@ async function startTail(options = {}) {
       }
       postDecisionHttp(req2.id, httpDecision, csrfToken, port, httpOpts).catch((err) => {
         try {
-          fs23.appendFileSync(
-            path25.join(os21.homedir(), ".node9", "hook-debug.log"),
+          fs24.appendFileSync(
+            path26.join(os21.homedir(), ".node9", "hook-debug.log"),
             `[tail] POST /decision failed: ${String(err)}
 `
           );
@@ -6379,7 +6701,7 @@ async function startTail(options = {}) {
       if (settled) return;
       settled = true;
       cleanup();
-      process.stdout.write(RESTORE_CURSOR + ERASE_DOWN);
+      clearCard();
       const priorCount = Math.max(
         req2.allowCount !== void 0 ? req2.allowCount - 1 : 0,
         localAllowCounts.get(req2.toolName) ?? 0
@@ -6576,14 +6898,14 @@ async function startTail(options = {}) {
     process.exit(1);
   });
 }
-var PID_FILE, ICONS, RESET, BOLD, RED, YELLOW, CYAN, GRAY, GREEN, HIDE_CURSOR, SHOW_CURSOR, ERASE_DOWN, SAVE_CURSOR, RESTORE_CURSOR;
+var PID_FILE, ICONS, RESET, BOLD, RED, YELLOW, CYAN, GRAY, GREEN, HIDE_CURSOR, SHOW_CURSOR, ERASE_DOWN;
 var init_tail = __esm({
   "src/tui/tail.ts"() {
     "use strict";
     init_daemon2();
     init_daemon();
     init_core();
-    PID_FILE = path25.join(os21.homedir(), ".node9", "daemon.pid");
+    PID_FILE = path26.join(os21.homedir(), ".node9", "daemon.pid");
     ICONS = {
       bash: "\u{1F4BB}",
       shell: "\u{1F4BB}",
@@ -6611,8 +6933,6 @@ var init_tail = __esm({
     HIDE_CURSOR = "\x1B[?25l";
     SHOW_CURSOR = "\x1B[?25h";
     ERASE_DOWN = "\x1B[J";
-    SAVE_CURSOR = "\x1B7";
-    RESTORE_CURSOR = "\x1B8";
   }
 });
 
@@ -7009,8 +7329,8 @@ async function setupCursor() {
 // src/cli.ts
 init_daemon2();
 import chalk17 from "chalk";
-import fs24 from "fs";
-import path26 from "path";
+import fs25 from "fs";
+import path27 from "path";
 import os22 from "os";
 import { confirm as confirm3 } from "@inquirer/prompts";
 
@@ -7236,32 +7556,32 @@ init_daemon();
 init_config();
 init_policy();
 import chalk5 from "chalk";
-import fs17 from "fs";
-import path19 from "path";
+import fs18 from "fs";
+import path20 from "path";
 import os15 from "os";
 
 // src/undo.ts
 import { spawnSync as spawnSync4, spawn as spawn5 } from "child_process";
 import crypto2 from "crypto";
-import fs16 from "fs";
-import path18 from "path";
+import fs17 from "fs";
+import path19 from "path";
 import os14 from "os";
-var SNAPSHOT_STACK_PATH = path18.join(os14.homedir(), ".node9", "snapshots.json");
-var UNDO_LATEST_PATH = path18.join(os14.homedir(), ".node9", "undo_latest.txt");
+var SNAPSHOT_STACK_PATH = path19.join(os14.homedir(), ".node9", "snapshots.json");
+var UNDO_LATEST_PATH = path19.join(os14.homedir(), ".node9", "undo_latest.txt");
 var MAX_SNAPSHOTS = 10;
 var GIT_TIMEOUT = 15e3;
 function readStack() {
   try {
-    if (fs16.existsSync(SNAPSHOT_STACK_PATH))
-      return JSON.parse(fs16.readFileSync(SNAPSHOT_STACK_PATH, "utf-8"));
+    if (fs17.existsSync(SNAPSHOT_STACK_PATH))
+      return JSON.parse(fs17.readFileSync(SNAPSHOT_STACK_PATH, "utf-8"));
   } catch {
   }
   return [];
 }
 function writeStack(stack) {
-  const dir = path18.dirname(SNAPSHOT_STACK_PATH);
-  if (!fs16.existsSync(dir)) fs16.mkdirSync(dir, { recursive: true });
-  fs16.writeFileSync(SNAPSHOT_STACK_PATH, JSON.stringify(stack, null, 2));
+  const dir = path19.dirname(SNAPSHOT_STACK_PATH);
+  if (!fs17.existsSync(dir)) fs17.mkdirSync(dir, { recursive: true });
+  fs17.writeFileSync(SNAPSHOT_STACK_PATH, JSON.stringify(stack, null, 2));
 }
 function buildArgsSummary(tool, args) {
   if (!args || typeof args !== "object") return "";
@@ -7277,7 +7597,7 @@ function buildArgsSummary(tool, args) {
 function normalizeCwdForHash(cwd) {
   let normalized;
   try {
-    normalized = fs16.realpathSync(cwd);
+    normalized = fs17.realpathSync(cwd);
   } catch {
     normalized = cwd;
   }
@@ -7287,16 +7607,16 @@ function normalizeCwdForHash(cwd) {
 }
 function getShadowRepoDir(cwd) {
   const hash = crypto2.createHash("sha256").update(normalizeCwdForHash(cwd)).digest("hex").slice(0, 16);
-  return path18.join(os14.homedir(), ".node9", "snapshots", hash);
+  return path19.join(os14.homedir(), ".node9", "snapshots", hash);
 }
 function cleanOrphanedIndexFiles(shadowDir) {
   try {
     const cutoff = Date.now() - 6e4;
-    for (const f of fs16.readdirSync(shadowDir)) {
+    for (const f of fs17.readdirSync(shadowDir)) {
       if (f.startsWith("index_")) {
-        const fp = path18.join(shadowDir, f);
+        const fp = path19.join(shadowDir, f);
         try {
-          if (fs16.statSync(fp).mtimeMs < cutoff) fs16.unlinkSync(fp);
+          if (fs17.statSync(fp).mtimeMs < cutoff) fs17.unlinkSync(fp);
         } catch {
         }
       }
@@ -7308,7 +7628,7 @@ function writeShadowExcludes(shadowDir, ignorePaths) {
   const hardcoded = [".git", ".node9"];
   const lines = [...hardcoded, ...ignorePaths].join("\n");
   try {
-    fs16.writeFileSync(path18.join(shadowDir, "info", "exclude"), lines + "\n", "utf8");
+    fs17.writeFileSync(path19.join(shadowDir, "info", "exclude"), lines + "\n", "utf8");
   } catch {
   }
 }
@@ -7321,25 +7641,25 @@ function ensureShadowRepo(shadowDir, cwd) {
     timeout: 3e3
   });
   if (check.status === 0) {
-    const ptPath = path18.join(shadowDir, "project-path.txt");
+    const ptPath = path19.join(shadowDir, "project-path.txt");
     try {
-      const stored = fs16.readFileSync(ptPath, "utf8").trim();
+      const stored = fs17.readFileSync(ptPath, "utf8").trim();
       if (stored === normalizedCwd) return true;
       if (process.env.NODE9_DEBUG === "1")
         console.error(
           `[Node9] Shadow repo path mismatch: stored="${stored}" expected="${normalizedCwd}" \u2014 reinitializing`
         );
-      fs16.rmSync(shadowDir, { recursive: true, force: true });
+      fs17.rmSync(shadowDir, { recursive: true, force: true });
     } catch {
       try {
-        fs16.writeFileSync(ptPath, normalizedCwd, "utf8");
+        fs17.writeFileSync(ptPath, normalizedCwd, "utf8");
       } catch {
       }
       return true;
     }
   }
   try {
-    fs16.mkdirSync(shadowDir, { recursive: true });
+    fs17.mkdirSync(shadowDir, { recursive: true });
   } catch {
   }
   const init = spawnSync4("git", ["init", "--bare", shadowDir], { timeout: 5e3 });
@@ -7348,7 +7668,7 @@ function ensureShadowRepo(shadowDir, cwd) {
       console.error("[Node9] git init --bare failed:", init.stderr?.toString());
     return false;
   }
-  const configFile = path18.join(shadowDir, "config");
+  const configFile = path19.join(shadowDir, "config");
   spawnSync4("git", ["config", "--file", configFile, "core.untrackedCache", "true"], {
     timeout: 3e3
   });
@@ -7356,7 +7676,7 @@ function ensureShadowRepo(shadowDir, cwd) {
     timeout: 3e3
   });
   try {
-    fs16.writeFileSync(path18.join(shadowDir, "project-path.txt"), normalizedCwd, "utf8");
+    fs17.writeFileSync(path19.join(shadowDir, "project-path.txt"), normalizedCwd, "utf8");
   } catch {
   }
   return true;
@@ -7379,7 +7699,7 @@ async function createShadowSnapshot(tool = "unknown", args = {}, ignorePaths = [
     const shadowDir = getShadowRepoDir(cwd);
     if (!ensureShadowRepo(shadowDir, cwd)) return null;
     writeShadowExcludes(shadowDir, ignorePaths);
-    indexFile = path18.join(shadowDir, `index_${process.pid}_${Date.now()}`);
+    indexFile = path19.join(shadowDir, `index_${process.pid}_${Date.now()}`);
     const shadowEnv = {
       ...process.env,
       GIT_DIR: shadowDir,
@@ -7408,7 +7728,7 @@ async function createShadowSnapshot(tool = "unknown", args = {}, ignorePaths = [
     const shouldGc = stack.length % 5 === 0;
     if (stack.length > MAX_SNAPSHOTS) stack.splice(0, stack.length - MAX_SNAPSHOTS);
     writeStack(stack);
-    fs16.writeFileSync(UNDO_LATEST_PATH, commitHash);
+    fs17.writeFileSync(UNDO_LATEST_PATH, commitHash);
     if (shouldGc) {
       spawn5("git", ["gc", "--auto"], { env: shadowEnv, detached: true, stdio: "ignore" }).unref();
     }
@@ -7419,7 +7739,7 @@ async function createShadowSnapshot(tool = "unknown", args = {}, ignorePaths = [
   } finally {
     if (indexFile) {
       try {
-        fs16.unlinkSync(indexFile);
+        fs17.unlinkSync(indexFile);
       } catch {
       }
     }
@@ -7488,9 +7808,9 @@ function applyUndo(hash, cwd) {
       timeout: GIT_TIMEOUT
     }).stdout?.toString().trim().split("\n").filter(Boolean) ?? [];
     for (const file of [...tracked, ...untracked]) {
-      const fullPath = path18.join(dir, file);
-      if (!snapshotFiles.has(file) && fs16.existsSync(fullPath)) {
-        fs16.unlinkSync(fullPath);
+      const fullPath = path19.join(dir, file);
+      if (!snapshotFiles.has(file) && fs17.existsSync(fullPath)) {
+        fs17.unlinkSync(fullPath);
       }
     }
     return true;
@@ -7514,9 +7834,9 @@ function registerCheckCommand(program2) {
         } catch (err) {
           const tempConfig = getConfig();
           if (process.env.NODE9_DEBUG === "1" || tempConfig.settings.enableHookLogDebug) {
-            const logPath = path19.join(os15.homedir(), ".node9", "hook-debug.log");
+            const logPath = path20.join(os15.homedir(), ".node9", "hook-debug.log");
             const errMsg = err instanceof Error ? err.message : String(err);
-            fs17.appendFileSync(
+            fs18.appendFileSync(
               logPath,
               `[${(/* @__PURE__ */ new Date()).toISOString()}] JSON_PARSE_ERROR: ${errMsg}
 RAW: ${raw}
@@ -7527,10 +7847,10 @@ RAW: ${raw}
         }
         const config = getConfig(payload.cwd || void 0);
         if (process.env.NODE9_DEBUG === "1" || config.settings.enableHookLogDebug) {
-          const logPath = path19.join(os15.homedir(), ".node9", "hook-debug.log");
-          if (!fs17.existsSync(path19.dirname(logPath)))
-            fs17.mkdirSync(path19.dirname(logPath), { recursive: true });
-          fs17.appendFileSync(logPath, `[${(/* @__PURE__ */ new Date()).toISOString()}] STDIN: ${raw}
+          const logPath = path20.join(os15.homedir(), ".node9", "hook-debug.log");
+          if (!fs18.existsSync(path20.dirname(logPath)))
+            fs18.mkdirSync(path20.dirname(logPath), { recursive: true });
+          fs18.appendFileSync(logPath, `[${(/* @__PURE__ */ new Date()).toISOString()}] STDIN: ${raw}
 `);
         }
         const toolName = sanitize2(payload.tool_name ?? payload.name ?? "");
@@ -7543,8 +7863,8 @@ RAW: ${raw}
           const isHumanDecision = blockedByContext.toLowerCase().includes("user") || blockedByContext.toLowerCase().includes("daemon") || blockedByContext.toLowerCase().includes("decision");
           let ttyFd = null;
           try {
-            ttyFd = fs17.openSync("/dev/tty", "w");
-            const writeTty = (line) => fs17.writeSync(ttyFd, line + "\n");
+            ttyFd = fs18.openSync("/dev/tty", "w");
+            const writeTty = (line) => fs18.writeSync(ttyFd, line + "\n");
             if (blockedByContext.includes("DLP") || blockedByContext.includes("Secret Detected") || blockedByContext.includes("Credential Review")) {
               writeTty(chalk5.bgRed.white.bold(`
  \u{1F6A8} NODE9 DLP ALERT \u2014 CREDENTIAL DETECTED `));
@@ -7560,7 +7880,7 @@ RAW: ${raw}
           } finally {
             if (ttyFd !== null)
               try {
-                fs17.closeSync(ttyFd);
+                fs18.closeSync(ttyFd);
               } catch {
               }
           }
@@ -7591,7 +7911,7 @@ RAW: ${raw}
         if (shouldSnapshot(toolName, toolInput, config)) {
           await createShadowSnapshot(toolName, toolInput, config.policy.snapshot.ignorePaths);
         }
-        const safeCwdForAuth = typeof payload.cwd === "string" && path19.isAbsolute(payload.cwd) ? payload.cwd : void 0;
+        const safeCwdForAuth = typeof payload.cwd === "string" && path20.isAbsolute(payload.cwd) ? payload.cwd : void 0;
         const result = await authorizeHeadless(toolName, toolInput, meta, {
           cwd: safeCwdForAuth
         });
@@ -7603,12 +7923,12 @@ RAW: ${raw}
         }
         if (result.noApprovalMechanism && !isDaemonRunning() && !process.env.NODE9_NO_AUTO_DAEMON && !process.stdout.isTTY && config.settings.autoStartDaemon) {
           try {
-            const tty = fs17.openSync("/dev/tty", "w");
-            fs17.writeSync(
+            const tty = fs18.openSync("/dev/tty", "w");
+            fs18.writeSync(
               tty,
               chalk5.cyan("\n\u{1F6E1}\uFE0F  Node9: Starting approval daemon automatically...\n")
             );
-            fs17.closeSync(tty);
+            fs18.closeSync(tty);
           } catch {
           }
           const daemonReady = await autoStartDaemonAndWait();
@@ -7635,9 +7955,9 @@ RAW: ${raw}
         });
       } catch (err) {
         if (process.env.NODE9_DEBUG === "1") {
-          const logPath = path19.join(os15.homedir(), ".node9", "hook-debug.log");
+          const logPath = path20.join(os15.homedir(), ".node9", "hook-debug.log");
           const errMsg = err instanceof Error ? err.message : String(err);
-          fs17.appendFileSync(logPath, `[${(/* @__PURE__ */ new Date()).toISOString()}] ERROR: ${errMsg}
+          fs18.appendFileSync(logPath, `[${(/* @__PURE__ */ new Date()).toISOString()}] ERROR: ${errMsg}
 `);
         }
         process.exit(0);
@@ -7674,9 +7994,49 @@ RAW: ${raw}
 init_audit();
 init_config();
 init_policy();
-import fs18 from "fs";
-import path20 from "path";
+import fs19 from "fs";
+import path21 from "path";
 import os16 from "os";
+init_daemon();
+
+// src/utils/cp-mv-parser.ts
+function parseCpMvOp(command) {
+  const trimmed = command.trim();
+  const tokens = trimmed.split(/\s+/);
+  if (tokens.length < 3) return null;
+  const [cmd, ...rest] = tokens;
+  const base = cmd.split("/").pop() ?? cmd;
+  if (base !== "cp" && base !== "mv") return null;
+  const args = [];
+  for (const tok of rest) {
+    if (tok === "--") {
+      args.push(...rest.slice(rest.indexOf("--") + 1));
+      break;
+    }
+    if (tok === "-t" || tok === "--target-directory") return null;
+    if (tok.startsWith("--target-directory=")) return null;
+    if (tok.startsWith("-") && !tok.startsWith("--")) {
+      if (tok.includes("t")) return null;
+      continue;
+    }
+    if (tok.startsWith("--")) {
+      continue;
+    }
+    args.push(tok);
+  }
+  if (args.length !== 2) return null;
+  const [src, dest] = args;
+  if (!src || !dest) return null;
+  if (containsShellMetachar(src) || containsShellMetachar(dest)) return null;
+  return { src, dest, clearSource: base === "mv" };
+}
+function containsShellMetachar(token) {
+  if (/[$`{;*?]/.test(token)) return true;
+  if (token.includes("\0")) return true;
+  return false;
+}
+
+// src/cli/commands/log.ts
 function sanitize3(value) {
   return value.replace(/[\x00-\x1F\x7F]/g, "");
 }
@@ -7695,11 +8055,20 @@ function registerLogCommand(program2) {
           decision: "allowed",
           source: "post-hook"
         };
-        const logPath = path20.join(os16.homedir(), ".node9", "audit.log");
-        if (!fs18.existsSync(path20.dirname(logPath)))
-          fs18.mkdirSync(path20.dirname(logPath), { recursive: true });
-        fs18.appendFileSync(logPath, JSON.stringify(entry) + "\n");
-        const safeCwd = typeof payload.cwd === "string" && path20.isAbsolute(payload.cwd) ? payload.cwd : void 0;
+        const logPath = path21.join(os16.homedir(), ".node9", "audit.log");
+        if (!fs19.existsSync(path21.dirname(logPath)))
+          fs19.mkdirSync(path21.dirname(logPath), { recursive: true });
+        fs19.appendFileSync(logPath, JSON.stringify(entry) + "\n");
+        if ((tool === "Bash" || tool === "bash") && isDaemonRunning()) {
+          const command = typeof rawInput === "object" && rawInput !== null && "command" in rawInput && typeof rawInput.command === "string" ? rawInput.command : null;
+          if (command) {
+            const op = parseCpMvOp(command);
+            if (op) {
+              await notifyTaintPropagate(op.src, op.dest, op.clearSource);
+            }
+          }
+        }
+        const safeCwd = typeof payload.cwd === "string" && path21.isAbsolute(payload.cwd) ? payload.cwd : void 0;
         const config = getConfig(safeCwd);
         if (shouldSnapshot(tool, {}, config)) {
           await createShadowSnapshot("unknown", {}, config.policy.snapshot.ignorePaths);
@@ -7708,9 +8077,9 @@ function registerLogCommand(program2) {
         const msg = err instanceof Error ? err.message : String(err);
         process.stderr.write(`[Node9] audit log error: ${msg}
 `);
-        const debugPath = path20.join(os16.homedir(), ".node9", "hook-debug.log");
+        const debugPath = path21.join(os16.homedir(), ".node9", "hook-debug.log");
         try {
-          fs18.appendFileSync(debugPath, `[${(/* @__PURE__ */ new Date()).toISOString()}] LOG_ERROR: ${msg}
+          fs19.appendFileSync(debugPath, `[${(/* @__PURE__ */ new Date()).toISOString()}] LOG_ERROR: ${msg}
 `);
         } catch {
         }
@@ -8015,8 +8384,8 @@ function registerConfigShowCommand(program2) {
 // src/cli/commands/doctor.ts
 init_daemon();
 import chalk7 from "chalk";
-import fs19 from "fs";
-import path21 from "path";
+import fs20 from "fs";
+import path22 from "path";
 import os17 from "os";
 import { execSync as execSync2 } from "child_process";
 function registerDoctorCommand(program2, version2) {
@@ -8070,10 +8439,10 @@ function registerDoctorCommand(program2, version2) {
       );
     }
     section("Configuration");
-    const globalConfigPath = path21.join(homeDir2, ".node9", "config.json");
-    if (fs19.existsSync(globalConfigPath)) {
+    const globalConfigPath = path22.join(homeDir2, ".node9", "config.json");
+    if (fs20.existsSync(globalConfigPath)) {
       try {
-        JSON.parse(fs19.readFileSync(globalConfigPath, "utf-8"));
+        JSON.parse(fs20.readFileSync(globalConfigPath, "utf-8"));
         pass("~/.node9/config.json found and valid");
       } catch {
         fail("~/.node9/config.json is invalid JSON", "Run: node9 init --force");
@@ -8081,10 +8450,10 @@ function registerDoctorCommand(program2, version2) {
     } else {
       warn("~/.node9/config.json not found (using defaults)", "Run: node9 init");
     }
-    const projectConfigPath = path21.join(process.cwd(), "node9.config.json");
-    if (fs19.existsSync(projectConfigPath)) {
+    const projectConfigPath = path22.join(process.cwd(), "node9.config.json");
+    if (fs20.existsSync(projectConfigPath)) {
       try {
-        JSON.parse(fs19.readFileSync(projectConfigPath, "utf-8"));
+        JSON.parse(fs20.readFileSync(projectConfigPath, "utf-8"));
         pass("node9.config.json found and valid (project)");
       } catch {
         fail(
@@ -8093,8 +8462,8 @@ function registerDoctorCommand(program2, version2) {
         );
       }
     }
-    const credsPath = path21.join(homeDir2, ".node9", "credentials.json");
-    if (fs19.existsSync(credsPath)) {
+    const credsPath = path22.join(homeDir2, ".node9", "credentials.json");
+    if (fs20.existsSync(credsPath)) {
       pass("Cloud credentials found (~/.node9/credentials.json)");
     } else {
       warn(
@@ -8103,10 +8472,10 @@ function registerDoctorCommand(program2, version2) {
       );
     }
     section("Agent Hooks");
-    const claudeSettingsPath = path21.join(homeDir2, ".claude", "settings.json");
-    if (fs19.existsSync(claudeSettingsPath)) {
+    const claudeSettingsPath = path22.join(homeDir2, ".claude", "settings.json");
+    if (fs20.existsSync(claudeSettingsPath)) {
       try {
-        const cs = JSON.parse(fs19.readFileSync(claudeSettingsPath, "utf-8"));
+        const cs = JSON.parse(fs20.readFileSync(claudeSettingsPath, "utf-8"));
         const hasHook = cs.hooks?.PreToolUse?.some(
           (m) => m.hooks.some((h) => h.command?.includes("node9") || h.command?.includes("cli.js"))
         );
@@ -8122,10 +8491,10 @@ function registerDoctorCommand(program2, version2) {
     } else {
       warn("Claude Code \u2014 not configured", "Run: node9 setup claude");
     }
-    const geminiSettingsPath = path21.join(homeDir2, ".gemini", "settings.json");
-    if (fs19.existsSync(geminiSettingsPath)) {
+    const geminiSettingsPath = path22.join(homeDir2, ".gemini", "settings.json");
+    if (fs20.existsSync(geminiSettingsPath)) {
       try {
-        const gs = JSON.parse(fs19.readFileSync(geminiSettingsPath, "utf-8"));
+        const gs = JSON.parse(fs20.readFileSync(geminiSettingsPath, "utf-8"));
         const hasHook = gs.hooks?.BeforeTool?.some(
           (m) => m.hooks.some((h) => h.command?.includes("node9") || h.command?.includes("cli.js"))
         );
@@ -8141,10 +8510,10 @@ function registerDoctorCommand(program2, version2) {
     } else {
       warn("Gemini CLI  \u2014 not configured", "Run: node9 setup gemini  (skip if not using Gemini)");
     }
-    const cursorHooksPath = path21.join(homeDir2, ".cursor", "hooks.json");
-    if (fs19.existsSync(cursorHooksPath)) {
+    const cursorHooksPath = path22.join(homeDir2, ".cursor", "hooks.json");
+    if (fs20.existsSync(cursorHooksPath)) {
       try {
-        const cur = JSON.parse(fs19.readFileSync(cursorHooksPath, "utf-8"));
+        const cur = JSON.parse(fs20.readFileSync(cursorHooksPath, "utf-8"));
         const hasHook = cur.hooks?.preToolUse?.some(
           (h) => h.command?.includes("node9") || h.command?.includes("cli.js")
         );
@@ -8182,8 +8551,8 @@ function registerDoctorCommand(program2, version2) {
 
 // src/cli/commands/audit.ts
 import chalk8 from "chalk";
-import fs20 from "fs";
-import path22 from "path";
+import fs21 from "fs";
+import path23 from "path";
 import os18 from "os";
 function formatRelativeTime(timestamp) {
   const diff = Date.now() - new Date(timestamp).getTime();
@@ -8197,14 +8566,14 @@ function formatRelativeTime(timestamp) {
 }
 function registerAuditCommand(program2) {
   program2.command("audit").description("View local execution audit log").option("--tail <n>", "Number of entries to show", "20").option("--tool <pattern>", "Filter by tool name (substring match)").option("--deny", "Show only denied actions").option("--json", "Output raw JSON").action((options) => {
-    const logPath = path22.join(os18.homedir(), ".node9", "audit.log");
-    if (!fs20.existsSync(logPath)) {
+    const logPath = path23.join(os18.homedir(), ".node9", "audit.log");
+    if (!fs21.existsSync(logPath)) {
       console.log(
         chalk8.yellow("No audit logs found. Run node9 with an agent to generate entries.")
       );
       return;
     }
-    const raw = fs20.readFileSync(logPath, "utf-8");
+    const raw = fs21.readFileSync(logPath, "utf-8");
     const lines = raw.split("\n").filter((l) => l.trim() !== "");
     let entries = lines.flatMap((line) => {
       try {
@@ -8324,12 +8693,12 @@ function registerDaemonCommand(program2) {
 init_core();
 init_daemon();
 import chalk10 from "chalk";
-import fs21 from "fs";
-import path23 from "path";
+import fs22 from "fs";
+import path24 from "path";
 import os19 from "os";
 function readJson2(filePath) {
   try {
-    if (fs21.existsSync(filePath)) return JSON.parse(fs21.readFileSync(filePath, "utf-8"));
+    if (fs22.existsSync(filePath)) return JSON.parse(fs22.readFileSync(filePath, "utf-8"));
   } catch {
   }
   return null;
@@ -8394,13 +8763,13 @@ function registerStatusCommand(program2) {
     console.log("");
     const modeLabel = settings.mode === "audit" ? chalk10.blue("audit") : settings.mode === "strict" ? chalk10.red("strict") : chalk10.white("standard");
     console.log(`  Mode:    ${modeLabel}`);
-    const projectConfig = path23.join(process.cwd(), "node9.config.json");
-    const globalConfig = path23.join(os19.homedir(), ".node9", "config.json");
+    const projectConfig = path24.join(process.cwd(), "node9.config.json");
+    const globalConfig = path24.join(os19.homedir(), ".node9", "config.json");
     console.log(
-      `  Local:   ${fs21.existsSync(projectConfig) ? chalk10.green("Active (node9.config.json)") : chalk10.gray("Not present")}`
+      `  Local:   ${fs22.existsSync(projectConfig) ? chalk10.green("Active (node9.config.json)") : chalk10.gray("Not present")}`
     );
     console.log(
-      `  Global:  ${fs21.existsSync(globalConfig) ? chalk10.green("Active (~/.node9/config.json)") : chalk10.gray("Not present")}`
+      `  Global:  ${fs22.existsSync(globalConfig) ? chalk10.green("Active (~/.node9/config.json)") : chalk10.gray("Not present")}`
     );
     if (mergedConfig.policy.sandboxPaths.length > 0) {
       console.log(
@@ -8409,13 +8778,13 @@ function registerStatusCommand(program2) {
     }
     const homeDir2 = os19.homedir();
     const claudeSettings = readJson2(
-      path23.join(homeDir2, ".claude", "settings.json")
+      path24.join(homeDir2, ".claude", "settings.json")
     );
-    const claudeConfig = readJson2(path23.join(homeDir2, ".claude.json"));
+    const claudeConfig = readJson2(path24.join(homeDir2, ".claude.json"));
     const geminiSettings = readJson2(
-      path23.join(homeDir2, ".gemini", "settings.json")
+      path24.join(homeDir2, ".gemini", "settings.json")
     );
-    const cursorConfig = readJson2(path23.join(homeDir2, ".cursor", "mcp.json"));
+    const cursorConfig = readJson2(path24.join(homeDir2, ".cursor", "mcp.json"));
     const agentFound = claudeSettings || claudeConfig || geminiSettings || cursorConfig;
     if (agentFound) {
       console.log("");
@@ -8475,14 +8844,14 @@ function registerStatusCommand(program2) {
 // src/cli/commands/init.ts
 init_core();
 import chalk11 from "chalk";
-import fs22 from "fs";
-import path24 from "path";
+import fs23 from "fs";
+import path25 from "path";
 import os20 from "os";
 function registerInitCommand(program2) {
   program2.command("init").description("Set up Node9: create config and wire all detected AI agents").option("--force", "Overwrite existing config").option("-m, --mode <mode>", "Set initial security mode (standard, strict, audit)", "standard").option("--skip-setup", "Only create config \u2014 do not wire AI agents").action(async (options) => {
     console.log(chalk11.cyan.bold("\n\u{1F6E1}\uFE0F  Node9 Init\n"));
-    const configPath = path24.join(os20.homedir(), ".node9", "config.json");
-    if (fs22.existsSync(configPath) && !options.force) {
+    const configPath = path25.join(os20.homedir(), ".node9", "config.json");
+    if (fs23.existsSync(configPath) && !options.force) {
       console.log(chalk11.blue(`\u2139\uFE0F  Config already exists: ${configPath}`));
     } else {
       const requestedMode = options.mode.toLowerCase();
@@ -8491,9 +8860,9 @@ function registerInitCommand(program2) {
         ...DEFAULT_CONFIG,
         settings: { ...DEFAULT_CONFIG.settings, mode: safeMode }
       };
-      const dir = path24.dirname(configPath);
-      if (!fs22.existsSync(dir)) fs22.mkdirSync(dir, { recursive: true });
-      fs22.writeFileSync(configPath, JSON.stringify(configToSave, null, 2));
+      const dir = path25.dirname(configPath);
+      if (!fs23.existsSync(dir)) fs23.mkdirSync(dir, { recursive: true });
+      fs23.writeFileSync(configPath, JSON.stringify(configToSave, null, 2));
       console.log(chalk11.green(`\u2705 Config created: ${configPath}`));
       console.log(chalk11.gray(`   Mode: ${safeMode}`));
     }
@@ -8949,20 +9318,20 @@ function registerTrustCommand(program2) {
 
 // src/cli.ts
 var { version } = JSON.parse(
-  fs24.readFileSync(path26.join(__dirname, "../package.json"), "utf-8")
+  fs25.readFileSync(path27.join(__dirname, "../package.json"), "utf-8")
 );
 var program = new Command();
 program.name("node9").description("The Sudo Command for AI Agents").version(version);
 program.command("login").argument("<apiKey>").option("--local", "Save key for audit/logging only \u2014 local config still controls all decisions").option("--profile <name>", 'Save as a named profile (default: "default")').action((apiKey, options) => {
   const DEFAULT_API_URL = "https://api.node9.ai/api/v1/intercept";
-  const credPath = path26.join(os22.homedir(), ".node9", "credentials.json");
-  if (!fs24.existsSync(path26.dirname(credPath)))
-    fs24.mkdirSync(path26.dirname(credPath), { recursive: true });
+  const credPath = path27.join(os22.homedir(), ".node9", "credentials.json");
+  if (!fs25.existsSync(path27.dirname(credPath)))
+    fs25.mkdirSync(path27.dirname(credPath), { recursive: true });
   const profileName = options.profile || "default";
   let existingCreds = {};
   try {
-    if (fs24.existsSync(credPath)) {
-      const raw = JSON.parse(fs24.readFileSync(credPath, "utf-8"));
+    if (fs25.existsSync(credPath)) {
+      const raw = JSON.parse(fs25.readFileSync(credPath, "utf-8"));
       if (raw.apiKey) {
         existingCreds = {
           default: { apiKey: raw.apiKey, apiUrl: raw.apiUrl || DEFAULT_API_URL }
@@ -8974,13 +9343,13 @@ program.command("login").argument("<apiKey>").option("--local", "Save key for au
   } catch {
   }
   existingCreds[profileName] = { apiKey, apiUrl: DEFAULT_API_URL };
-  fs24.writeFileSync(credPath, JSON.stringify(existingCreds, null, 2), { mode: 384 });
+  fs25.writeFileSync(credPath, JSON.stringify(existingCreds, null, 2), { mode: 384 });
   if (profileName === "default") {
-    const configPath = path26.join(os22.homedir(), ".node9", "config.json");
+    const configPath = path27.join(os22.homedir(), ".node9", "config.json");
     let config = {};
     try {
-      if (fs24.existsSync(configPath))
-        config = JSON.parse(fs24.readFileSync(configPath, "utf-8"));
+      if (fs25.existsSync(configPath))
+        config = JSON.parse(fs25.readFileSync(configPath, "utf-8"));
     } catch {
     }
     if (!config.settings || typeof config.settings !== "object") config.settings = {};
@@ -8995,9 +9364,9 @@ program.command("login").argument("<apiKey>").option("--local", "Save key for au
       approvers.cloud = false;
     }
     s.approvers = approvers;
-    if (!fs24.existsSync(path26.dirname(configPath)))
-      fs24.mkdirSync(path26.dirname(configPath), { recursive: true });
-    fs24.writeFileSync(configPath, JSON.stringify(config, null, 2), { mode: 384 });
+    if (!fs25.existsSync(path27.dirname(configPath)))
+      fs25.mkdirSync(path27.dirname(configPath), { recursive: true });
+    fs25.writeFileSync(configPath, JSON.stringify(config, null, 2), { mode: 384 });
   }
   if (options.profile && profileName !== "default") {
     console.log(chalk17.green(`\u2705 Profile "${profileName}" saved`));
@@ -9083,15 +9452,15 @@ program.command("uninstall").description("Remove all Node9 hooks and optionally
     }
   }
   if (options.purge) {
-    const node9Dir = path26.join(os22.homedir(), ".node9");
-    if (fs24.existsSync(node9Dir)) {
+    const node9Dir = path27.join(os22.homedir(), ".node9");
+    if (fs25.existsSync(node9Dir)) {
       const confirmed = await confirm3({
         message: `Permanently delete ${node9Dir} (config, audit log, credentials)?`,
         default: false
       });
       if (confirmed) {
-        fs24.rmSync(node9Dir, { recursive: true });
-        if (fs24.existsSync(node9Dir)) {
+        fs25.rmSync(node9Dir, { recursive: true });
+        if (fs25.existsSync(node9Dir)) {
           console.error(
             chalk17.red("\n  \u26A0\uFE0F  ~/.node9/ could not be fully deleted \u2014 remove it manually.")
           );
@@ -9303,9 +9672,9 @@ if (process.argv[2] !== "daemon") {
     const isCheckHook = process.argv[2] === "check";
     if (isCheckHook) {
       if (process.env.NODE9_DEBUG === "1" || getConfig().settings.enableHookLogDebug) {
-        const logPath = path26.join(os22.homedir(), ".node9", "hook-debug.log");
+        const logPath = path27.join(os22.homedir(), ".node9", "hook-debug.log");
         const msg = reason instanceof Error ? reason.message : String(reason);
-        fs24.appendFileSync(logPath, `[${(/* @__PURE__ */ new Date()).toISOString()}] UNHANDLED: ${msg}
+        fs25.appendFileSync(logPath, `[${(/* @__PURE__ */ new Date()).toISOString()}] UNHANDLED: ${msg}
 `);
       }
       process.exit(0);