@node9/proxy 2.0.0 → 2.1.0

package/dist/cli.mjs

@@ -5422,11 +5422,13 @@ function getConfig(cwd) {
   }
   const shieldOverrides = readShieldOverrides();
   const activeShieldNames = [.../* @__PURE__ */ new Set([...readActiveShields(), ...cloudManagedShields])];
+  const appliedShields = [];
   const cloudManagedSet = new Set(cloudManagedShields);
   for (const shieldName of activeShieldNames) {
     const isCloudMandated = cloudManagedSet.has(shieldName);
     const shield = isCloudMandated ? BUILTIN_SHIELDS[shieldName] : getShield(shieldName);
     if (!shield) continue;
+    appliedShields.push(shieldName);
     const existingRuleNames = new Set(mergedPolicy.smartRules.map((r) => r.name));
     const ruleOverrides = isCloudMandated ? {} : shieldOverrides[shieldName] ?? {};
     for (const rule of shield.smartRules) {
@@ -5448,6 +5450,7 @@ function getConfig(cwd) {
       if (!existingWords.has(word)) mergedPolicy.dangerousWords.push(word);
     }
   }
+  mergedPolicy.appliedShields = appliedShields.sort();
   const existingAdvisoryNames = new Set(mergedPolicy.smartRules.map((r) => r.name));
   const cc = mergedPolicy.commandChecks ?? {};
   const advisoryKnobKey = (name) => {
@@ -12299,6 +12302,18 @@ function boxPanel(title, bodyLines, width = PANEL_WIDTH) {
   out.push(chalk3.dim("\u2570" + "\u2500".repeat(inner + 2) + "\u256F"));
   return out;
 }
+function originForRule(ruleName, sections, enabled) {
+  for (const section of sections) {
+    if (section.rules.some((r) => r.name === ruleName)) {
+      if (section.sourceType === "default") return "default";
+      if (section.sourceType === "shield") {
+        const key = section.shieldKey ?? section.id;
+        return enabled.has(key) ? `\u2713 shield:${key}` : `needs shield:${key}`;
+      }
+    }
+  }
+  return "";
+}
 function relativeDate(timestamp, now = /* @__PURE__ */ new Date()) {
   const t = new Date(timestamp).getTime();
   if (Number.isNaN(t)) return "?";
@@ -15080,9 +15095,12 @@ function renderCompactScorecard(input) {
     chalk5.bold("\u{1F6E1}  Node9 Scan") + chalk5.dim("  \xB7  ") + chalk5.white(num(scan.sessions)) + chalk5.dim(" sessions  \xB7  ") + chalk5.white(num(scan.totalToolCalls)) + chalk5.dim(" tool calls") + (dateRange ? chalk5.dim("  \xB7  " + dateRange) : "")
   );
   console.log("");
-  const score = classifyScore(blast.score);
+  const exposurePaths = blast.reachable.length;
+  const exposureEnvs = blast.envFindings.length;
   console.log(
-    chalk5.bold("Security Score: ") + score.color.bold(`${blast.score}/100`) + chalk5.dim("  \xB7  ") + score.color(score.label)
+    chalk5.bold("Exposure: ") + (exposurePaths > 0 ? chalk5.red.bold : chalk5.green.bold)(
+      `${exposurePaths} path${exposurePaths !== 1 ? "s" : ""}` + (exposureEnvs > 0 ? ` + ${exposureEnvs} env var${exposureEnvs !== 1 ? "s" : ""}` : "")
+    ) + chalk5.dim(" reachable by the agent")
   );
   if (scan.totalCostUSD > 0) {
     console.log(
@@ -15107,9 +15125,9 @@ function renderCompactScorecard(input) {
   const realLoops = scan.loopFindings.filter((l) => l.kind !== "long-iteration");
   const longIterations = scan.loopFindings.filter((l) => l.kind === "long-iteration");
   if (realLoops.length > 0) {
-    const { wastePct } = computeLoopWaste(realLoops, scan.totalToolCalls);
+    const { wastePct, wastedCalls } = computeLoopWaste(realLoops, scan.totalToolCalls);
     const wasteParts = [];
-    if (wastePct > 0) wasteParts.push(`${wastePct}% wasted`);
+    if (wastedCalls > 0) wasteParts.push(`${wastedCalls} wasted calls (${wastePct}% of all calls)`);
     if (summary.loopWastedUSD > 0) wasteParts.push("~" + fmtCost(summary.loopWastedUSD));
     const wasteSummary = wasteParts.length ? `(${wasteParts.join("  \xB7  ")})` : "";
     console.log(
@@ -15187,10 +15205,10 @@ function renderNarrativeScorecard(input) {
     });
   }
   if (scan.loopFindings.length > 0) {
-    const { wastePct } = computeLoopWaste(scan.loopFindings, scan.totalToolCalls);
+    const { wastePct, wastedCalls } = computeLoopWaste(scan.loopFindings, scan.totalToolCalls);
     const cost = summary.loopWastedUSD > 0 ? `, ~${fmtCost(summary.loopWastedUSD)} wasted` : "";
     medium.push({
-      label: `${scan.loopFindings.length} agent loops (${wastePct}% of calls${cost})`,
+      label: `${scan.loopFindings.length} agent loops (${wastedCalls} wasted calls, ${wastePct}% of calls${cost})`,
       count: scan.loopFindings.length
     });
   }
@@ -15206,9 +15224,12 @@ function renderNarrativeScorecard(input) {
     chalk5.bold("\u{1F6E1}  Node9 Scan") + chalk5.dim("  \xB7  ") + chalk5.white(num(scan.sessions)) + chalk5.dim(" sessions") + (scan.totalCostUSD > 0 ? chalk5.dim("  \xB7  ") + chalk5.bold(fmtCost(scan.totalCostUSD)) + chalk5.dim(" spend") : "") + (dateRange ? chalk5.dim("  \xB7  " + dateRange) : "")
   );
   console.log("");
-  const score = classifyScore(blast.score);
+  const nPaths = blast.reachable.length;
+  const nEnvs = blast.envFindings.length;
   console.log(
-    (score.band === "critical" ? chalk5.red.bold("\u26A0  ") : "") + chalk5.bold("Security Score: ") + score.color.bold(`${blast.score}/100`) + chalk5.dim("  \xB7  ") + score.color(score.label)
+    (nPaths > 0 ? chalk5.red.bold("\u26A0  ") : "") + chalk5.bold("Exposure: ") + (nPaths > 0 ? chalk5.red.bold : chalk5.green.bold)(
+      `${nPaths} path${nPaths !== 1 ? "s" : ""}` + (nEnvs > 0 ? ` + ${nEnvs} env var${nEnvs !== 1 ? "s" : ""}` : "")
+    ) + chalk5.dim(" reachable by the agent")
   );
   console.log("");
   if (criticalCount > 0) {
@@ -15272,6 +15293,7 @@ function shortRule(name, width) {
 }
 function renderPanelScorecard(input, now = /* @__PURE__ */ new Date()) {
   const { scan, summary, blast, blastExposures, blockedCount, reviewCount } = input;
+  const enabledSet = new Set(input.enabledShields ?? []);
   const topLines = [];
   if (scan.dlpFindings.length > 0) {
     const latest = scan.dlpFindings[0];
@@ -15298,13 +15320,13 @@ function renderPanelScorecard(input, now = /* @__PURE__ */ new Date()) {
     );
   }
   if (scan.loopFindings.length > 0) {
-    const { wastePct } = computeLoopWaste(scan.loopFindings, scan.totalToolCalls);
+    const { wastePct, wastedCalls } = computeLoopWaste(scan.loopFindings, scan.totalToolCalls);
     const byTool = /* @__PURE__ */ new Map();
     for (const f of scan.loopFindings) {
       byTool.set(f.toolName, (byTool.get(f.toolName) ?? 0) + Math.max(0, f.count - 1));
     }
     const top = [...byTool.entries()].sort((a, b) => b[1] - a[1])[0];
-    const wasteSuffix = wastePct > 0 ? `, ${wastePct}% wasted` : "";
+    const wasteSuffix = wastedCalls > 0 ? `, ${wastedCalls} wasted calls \xB7 ${wastePct}% of calls` : "";
     const detail = top ? `(${top[0]} dominates${wasteSuffix})` : "";
     topLines.push(
       mkLine(
@@ -15315,10 +15337,7 @@ function renderPanelScorecard(input, now = /* @__PURE__ */ new Date()) {
     );
   }
   if (blastExposures > 0) {
-    const exposed2 = Math.max(0, 100 - blast.score);
-    const pjDiscount = PROTECTIVE_SHIELD_DISCOUNTS["project-jail"] ?? 0;
-    const pjBonus = Math.round(exposed2 * pjDiscount);
-    const cta = pjBonus > 0 ? `  \u2192 enable project-jail (+${pjBonus} pts)` : "";
+    const cta = enabledSet.has("project-jail") ? "  \u2192 project-jail \u2713 enabled" : "  \u2192 enable project-jail";
     topLines.push(
       mkLine(
         ["\u{1F52D} ", chalk5.red],
@@ -15360,7 +15379,7 @@ function renderPanelScorecard(input, now = /* @__PURE__ */ new Date()) {
     const blockedLines = [];
     const ruleEntries = topRulesByVerdict(summary.sections, "block", 12);
     for (const r of ruleEntries) {
-      const origin = originForRule(r.name, summary.sections);
+      const origin = originForRule(r.name, summary.sections, enabledSet);
       blockedLines.push(
         mkLine(
           ["\u2717 ", chalk5.red],
@@ -15379,7 +15398,7 @@ function renderPanelScorecard(input, now = /* @__PURE__ */ new Date()) {
     const reviewLines = [];
     const ruleEntries = topRulesByVerdict(summary.sections, "review", 12);
     for (const r of ruleEntries) {
-      const origin = originForRule(r.name, summary.sections);
+      const origin = originForRule(r.name, summary.sections, enabledSet);
       reviewLines.push(
         mkLine(
           // VS-16 (U+FE0F) forces emoji-presentation so string-width
@@ -15399,7 +15418,7 @@ function renderPanelScorecard(input, now = /* @__PURE__ */ new Date()) {
     console.log("");
   }
   if (scan.loopFindings.length > 0) {
-    const { wastePct } = computeLoopWaste(scan.loopFindings, scan.totalToolCalls);
+    const { wastePct, wastedCalls } = computeLoopWaste(scan.loopFindings, scan.totalToolCalls);
     const byTool = /* @__PURE__ */ new Map();
     let totalRepeats = 0;
     for (const f of scan.loopFindings) {
@@ -15429,8 +15448,8 @@ function renderPanelScorecard(input, now = /* @__PURE__ */ new Date()) {
         loopLines.push(mkLine([`\xD7${num(f.count).padEnd(4)} `, chalk5.bold], [target, chalk5.dim]));
       }
     }
-    const wasteSuffix = wastePct > 0 ? `  \xB7  ${wastePct}% wasted` : "";
-    const title = `AGENT LOOPS  \xB7  ${scan.loopFindings.length} repeated patterns${wasteSuffix}`;
+    const wasteSuffix = wastedCalls > 0 ? `  \xB7  ${wastedCalls} wasted calls (${wastePct}% of all calls)` : "";
+    const title = `AGENT LOOPS  \xB7  ${scan.loopFindings.length} pattern${scan.loopFindings.length !== 1 ? "s" : ""}${wasteSuffix}`;
     for (const ln of boxPanel(title, loopLines)) console.log("  " + ln);
     console.log("");
   }
@@ -15456,7 +15475,6 @@ function renderPanelScorecard(input, now = /* @__PURE__ */ new Date()) {
     console.log("");
   }
   const shieldImpacts = rollupByShield(summary.sections);
-  const exposed = Math.max(0, 100 - blast.score);
   const shieldLines = [];
   const ranked = [...shieldImpacts].sort((a, b) => {
     const aDiscount = PROTECTIVE_SHIELD_DISCOUNTS[a.shieldName] ?? 0;
@@ -15467,16 +15485,16 @@ function renderPanelScorecard(input, now = /* @__PURE__ */ new Date()) {
   for (const impact of ranked) {
     if (impact.totalCatches === 0) continue;
     const discount = PROTECTIVE_SHIELD_DISCOUNTS[impact.shieldName] ?? 0;
-    const bonus = Math.round(exposed * discount);
+    const isOn = enabledSet.has(impact.shieldName);
     const icon = discount > 0 ? "\u{1F6E1}\uFE0F  " : "\u2610   ";
-    const wouldCatch = `would catch ${impact.totalCatches} op${impact.totalCatches !== 1 ? "s" : ""}`;
-    const deltaSuffix = bonus > 0 ? `  \u2192  +${bonus} pts  (${blast.score} \u2192 ${blast.score + bonus})` : "";
+    const wouldCatch = `catches ${impact.totalCatches} op${impact.totalCatches !== 1 ? "s" : ""}`;
+    const suffix = isOn ? "\u2713 enabled" : discount > 0 ? "\u2192 blocks these reads in-path" : "";
     shieldLines.push(
       mkLine(
         [icon, discount > 0 ? chalk5.cyan : chalk5.dim],
         [impact.shieldName.padEnd(14), chalk5.bold],
         [wouldCatch.padEnd(22), chalk5.dim],
-        [deltaSuffix, bonus > 0 ? chalk5.green.bold : chalk5.dim]
+        [suffix, isOn || discount > 0 ? chalk5.green.bold : chalk5.dim]
       )
     );
     if (impact.topRuleLabels.length > 0) {
@@ -15487,36 +15505,43 @@ function renderPanelScorecard(input, now = /* @__PURE__ */ new Date()) {
   const hitShieldSet = new Set(
     shieldImpacts.filter((i) => i.totalCatches > 0).map((i) => i.shieldName)
   );
-  const zeroHitBuiltins = Object.keys(BUILTIN_SHIELDS).filter((name) => !hitShieldSet.has(name)).sort();
+  const zeroHitAll = Object.keys(BUILTIN_SHIELDS).filter((name) => !hitShieldSet.has(name)).sort();
+  const zeroHitBuiltins = zeroHitAll.filter((name) => !enabledSet.has(name));
+  const zeroHitEnabled = zeroHitAll.filter((name) => enabledSet.has(name));
+  if (zeroHitEnabled.length > 0) {
+    shieldLines.push(mkLine([""]));
+    shieldLines.push(
+      mkLine([
+        `\u2713 active: ${zeroHitEnabled.join(" \xB7 ")}  (no hits in this history)`,
+        chalk5.green.dim
+      ])
+    );
+  }
   if (zeroHitBuiltins.length > 0) {
     shieldLines.push(mkLine([""]));
     shieldLines.push(mkLine([zeroHitBuiltins.join(" \xB7 "), chalk5.dim]));
     shieldLines.push(mkLine(["      no hits in your history \u2014 install proactively", chalk5.dim]));
   }
   const topRec = ranked.find(
-    (r) => r.totalCatches > 0 && (PROTECTIVE_SHIELD_DISCOUNTS[r.shieldName] ?? 0) > 0
+    (r) => r.totalCatches > 0 && (PROTECTIVE_SHIELD_DISCOUNTS[r.shieldName] ?? 0) > 0 && !enabledSet.has(r.shieldName)
+  );
+  const allCovered = !topRec && ranked.some(
+    (r) => r.totalCatches > 0 && (PROTECTIVE_SHIELD_DISCOUNTS[r.shieldName] ?? 0) > 0 && enabledSet.has(r.shieldName)
   );
   if (topRec) {
-    const bonus = Math.round(exposed * (PROTECTIVE_SHIELD_DISCOUNTS[topRec.shieldName] ?? 0));
-    const cta = `\u2192 node9 shield enable ${topRec.shieldName}   (start here \u2014 +${bonus} pts)`;
+    const cta = `\u2192 node9 shield enable ${topRec.shieldName}   (start here \u2014 widest coverage)`;
     shieldLines.push(mkLine([""]));
     shieldLines.push(mkLine([cta, chalk5.cyan]));
+  } else if (allCovered) {
+    shieldLines.push(mkLine([""]));
+    shieldLines.push(mkLine(["\u2713 recommended shields are enabled", chalk5.green.bold]));
   }
   if (shieldLines.length > 0) {
-    const title = "SHIELDS  \xB7  install node9 + enable these to catch what we found";
+    const title = enabledSet.size > 0 ? "SHIELDS  \xB7  your coverage vs what we found" : "SHIELDS  \xB7  install node9 + enable these to catch what we found";
     for (const ln of boxPanel(title, shieldLines)) console.log("  " + ln);
     console.log("");
   }
 }
-function originForRule(ruleName, sections) {
-  for (const section of sections) {
-    if (section.rules.some((r) => r.name === ruleName)) {
-      if (section.sourceType === "default") return "default";
-      if (section.sourceType === "shield") return `needs shield:${section.shieldKey ?? section.id}`;
-    }
-  }
-  return "";
-}
 function registerScanCommand(program2) {
   program2.command("scan").description("Forecast: scan agent history and show what node9 would catch if installed").option("--all", "Scan all history (default: last 90 days)").option("--days <n>", "Scan last N days of history", "90").option("--top <n>", "Max findings to show per rule (default: 5)", "5").option("--drill-down", "Show all findings with full commands and session IDs").option("--compact", "Compact one-screen scorecard \u2014 for screenshots and sharing").option("--narrative", "Severity-grouped report \u2014 for video / dramatic sharing").option("--classic", "Original chalk-based scorecard layout (default: new Ink-rendered view)").option(
     "--json",
@@ -15551,6 +15576,8 @@ function registerScanCommand(program2) {
         return d;
       })();
       const isWired = getAgentsStatus().some((a) => a.wired);
+      const enabledShields = getConfig().policy.appliedShields ?? [];
+      const enabledShieldSet = new Set(enabledShields);
       const screenshotMode = options.compact || options.narrative;
       const useInk = !options.classic && !drillDown;
       const quiet = screenshotMode || options.json || useInk;
@@ -15701,7 +15728,8 @@ function registerScanCommand(program2) {
           blast,
           blastExposures,
           blockedCount,
-          reviewCount
+          reviewCount,
+          enabledShields
         });
         return;
       }
@@ -15712,7 +15740,8 @@ function registerScanCommand(program2) {
           blast,
           blastExposures,
           blockedCount,
-          reviewCount
+          reviewCount,
+          enabledShields
         });
         return;
       }
@@ -15755,7 +15784,7 @@ function registerScanCommand(program2) {
         }
         if (scan.loopFindings.length > 0) {
           const { wastePct } = computeLoopWaste(scan.loopFindings, scan.totalToolCalls);
-          const wasteSuffix = wastePct > 0 ? chalk5.dim(` (${wastePct}% wasted)`) : "";
+          const wasteSuffix = wastePct > 0 ? chalk5.dim(` (${wastePct}% of calls)`) : "";
           cardParts.push(
             chalk5.yellow("\u{1F501} ") + chalk5.yellow.bold(String(scan.loopFindings.length)) + chalk5.dim(" loops") + wasteSuffix
           );
@@ -15802,7 +15831,8 @@ function registerScanCommand(program2) {
                 blast,
                 blastExposures,
                 blockedCount,
-                reviewCount
+                reviewCount,
+                enabledShields
               },
               rangeLabel2
             );
@@ -15814,7 +15844,8 @@ function registerScanCommand(program2) {
               blast,
               blastExposures,
               blockedCount,
-              reviewCount
+              reviewCount,
+              enabledShields
             });
           }
           const cta = isWired ? "\u2705 node9 is active" : "\u2192 install node9 to enable protection";
@@ -15924,7 +15955,7 @@ function registerScanCommand(program2) {
         for (const section of summary.sections) {
           const reviewRules = section.rules.filter((r) => r.verdict !== "block");
           if (reviewRules.length === 0) continue;
-          const enableHint = section.shieldKey ? chalk5.dim(`  \u2192  node9 shield enable ${section.shieldKey}`) : "";
+          const enableHint = section.shieldKey ? enabledShieldSet.has(section.shieldKey) ? chalk5.green(`  \u2713  ${section.shieldKey} enabled`) : chalk5.dim(`  \u2192  node9 shield enable ${section.shieldKey}`) : "";
           console.log("  " + chalk5.dim("\u2500".repeat(70)));
           console.log(
             "  " + chalk5.bold(section.label) + (section.subtitle ? chalk5.dim(`  \xB7  ${section.subtitle}`) : "") + "  " + chalk5.yellow(`${section.reviewCount} review`) + enableHint
@@ -15934,10 +15965,20 @@ function registerScanCommand(program2) {
           }
           console.log("");
         }
-        const activeShieldIds = new Set(
+        const hitShieldIds = new Set(
           summary.sections.filter((s) => s.sourceType === "shield" && s.shieldKey).map((s) => s.shieldKey)
         );
-        const emptyShields = Object.keys(SHIELDS).filter((n) => !activeShieldIds.has(n)).sort();
+        const noHitShields = Object.keys(SHIELDS).filter((n) => !hitShieldIds.has(n)).sort();
+        const quietEnabled = noHitShields.filter((n) => enabledShieldSet.has(n));
+        const emptyShields = noHitShields.filter((n) => !enabledShieldSet.has(n));
+        if (quietEnabled.length > 0) {
+          console.log("  " + chalk5.dim("\u2500".repeat(70)));
+          console.log(
+            "  " + chalk5.bold("\u{1F6E1}  Active Shields") + chalk5.dim("  \xB7  enabled, no hits in this history")
+          );
+          console.log("  " + chalk5.green("\u2713 ") + chalk5.dim(quietEnabled.join(" \xB7 ")));
+          console.log("");
+        }
         if (emptyShields.length > 0) {
           console.log("  " + chalk5.dim("\u2500".repeat(70)));
           console.log(
@@ -18064,6 +18105,9 @@ async function annotateCoverage(findings, ctx) {
       const verdicts = probe.paths.map((p) => scanFilePath(p)?.severity ?? null);
       if (verdicts.length === 0 || verdicts.some((v) => v === null)) {
         f.coverage = coverageFromVerdict("allow", env);
+        if ((config.policy.appliedShields ?? []).includes("project-jail") && f.fix?.includes("shield enable project-jail")) {
+          f.fix = "project-jail is already enabled but does not cover the file(s) listed here. Fix it now: run `node9 jail add <file>` for each file above.";
+        }
       } else {
         const worst = verdicts.some((v) => v === "review") ? "review" : "block";
         f.coverage = coverageFromVerdict(worst, env, "node9 DLP");
@@ -46549,7 +46593,7 @@ __export(tail_exports, {
   startTail: () => startTail
 });
 import http5 from "http";
-import chalk39 from "chalk";
+import chalk40 from "chalk";
 import fs73 from "fs";
 import os61 from "os";
 import path68 from "path";
@@ -46632,10 +46676,10 @@ function readSessionUsage() {
   }
 }
 function formatContextStat(stat) {
-  const pctColor = stat.fillPct >= 80 ? chalk39.red : stat.fillPct >= 50 ? chalk39.yellow : chalk39.cyan;
+  const pctColor = stat.fillPct >= 80 ? chalk40.red : stat.fillPct >= 50 ? chalk40.yellow : chalk40.cyan;
   const k = (n) => `${Math.round(n / 1e3)}k`;
   const modelShort = stat.model.replace(/@.*$/, "").replace(/-\d{8}$/, "").replace(/^claude-/, "");
-  return chalk39.dim("ctx: ") + pctColor(`${stat.fillPct}%`) + chalk39.dim(
+  return chalk40.dim("ctx: ") + pctColor(`${stat.fillPct}%`) + chalk40.dim(
     ` (${k(stat.inputTokens)}/${k(getModelContextLimit(stat.model))}  out ${k(stat.outputTokens)}  \xB7 ${modelShort})`
   );
 }
@@ -46658,11 +46702,11 @@ function agentLabel(agent, mcpServer, sessionId) {
   const tag = sessionTag(sessionId);
   const tagSuffix = tag ? `\xB7${tag}` : "";
   if (!agent || agent === "Terminal") {
-    return mcpServer ? chalk39.dim(`[\u2192 ${mcpServer}] `) : "";
+    return mcpServer ? chalk40.dim(`[\u2192 ${mcpServer}] `) : "";
   }
   const short = agent === "Claude Code" ? "Claude" : agent === "Gemini CLI" ? "Gemini" : agent === "Unknown Agent" ? "" : agent.split(" ")[0];
-  if (!short) return mcpServer ? chalk39.dim(`[\u2192 ${mcpServer}] `) : "";
-  return mcpServer ? chalk39.dim(`[${short}${tagSuffix} \u2192 ${mcpServer}] `) : chalk39.dim(`[${short}${tagSuffix}] `);
+  if (!short) return mcpServer ? chalk40.dim(`[\u2192 ${mcpServer}] `) : "";
+  return mcpServer ? chalk40.dim(`[${short}${tagSuffix} \u2192 ${mcpServer}] `) : chalk40.dim(`[${short}${tagSuffix}] `);
 }
 function formatBase(activity) {
   const time = new Date(activity.ts).toLocaleTimeString([], { hour12: false });
@@ -46670,20 +46714,20 @@ function formatBase(activity) {
   const toolName = activity.tool.slice(0, 16).padEnd(16);
   const argsStr = JSON.stringify(activity.args ?? {}).replace(/\s+/g, " ").replaceAll(os61.homedir(), "~");
   const argsPreview = argsStr.length > 70 ? argsStr.slice(0, 70) + "\u2026" : argsStr;
-  return `${chalk39.gray(time)} ${icon} ${agentLabel(activity.agent, activity.mcpServer, activity.sessionId)}${chalk39.white.bold(toolName)} ${chalk39.dim(argsPreview)}`;
+  return `${chalk40.gray(time)} ${icon} ${agentLabel(activity.agent, activity.mcpServer, activity.sessionId)}${chalk40.white.bold(toolName)} ${chalk40.dim(argsPreview)}`;
 }
 function renderResult(activity, result) {
   const base = formatBase(activity);
   let status;
   if (result.status === "allow") {
-    status = chalk39.green("\u2713 ALLOW");
+    status = chalk40.green("\u2713 ALLOW");
   } else if (result.status === "dlp") {
-    status = chalk39.bgRed.white.bold(" \u{1F6E1}\uFE0F  DLP ");
+    status = chalk40.bgRed.white.bold(" \u{1F6E1}\uFE0F  DLP ");
   } else {
-    status = chalk39.red("\u2717 BLOCK");
+    status = chalk40.red("\u2717 BLOCK");
   }
   const cost = result.costEstimate ?? activity.costEstimate;
-  const costSuffix = cost == null ? "" : chalk39.dim(`  ~$${cost >= 1e-3 ? cost.toFixed(3) : "0.000"}`);
+  const costSuffix = cost == null ? "" : chalk40.dim(`  ~$${cost >= 1e-3 ? cost.toFixed(3) : "0.000"}`);
   if (process.stdout.isTTY) {
     if (pendingShownForId === activity.id && pendingWrappedLines > 1) {
       readline5.moveCursor(process.stdout, 0, -(pendingWrappedLines - 1));
@@ -46700,7 +46744,7 @@ function renderResult(activity, result) {
 }
 function renderPending(activity) {
   if (!process.stdout.isTTY) return;
-  const line = `${formatBase(activity)}  ${chalk39.yellow("\u25CF \u2026")}`;
+  const line = `${formatBase(activity)}  ${chalk40.yellow("\u25CF \u2026")}`;
   pendingShownForId = activity.id;
   pendingWrappedLines = wrappedLineCount(line);
   process.stdout.write(`${line}\r`);
@@ -46712,7 +46756,7 @@ async function ensureDaemon() {
       const { port } = JSON.parse(fs73.readFileSync(PID_FILE, "utf-8"));
       pidPort = port;
     } catch {
-      console.error(chalk39.dim("\u26A0\uFE0F  Could not read PID file; falling back to default port."));
+      console.error(chalk40.dim("\u26A0\uFE0F  Could not read PID file; falling back to default port."));
     }
   }
   const checkPort = pidPort ?? DAEMON_PORT;
@@ -46723,7 +46767,7 @@ async function ensureDaemon() {
     if (res.ok) return checkPort;
   } catch {
   }
-  console.log(chalk39.dim("\u{1F6E1}\uFE0F  Starting Node9 daemon..."));
+  console.log(chalk40.dim("\u{1F6E1}\uFE0F  Starting Node9 daemon..."));
   const startupFd = openStartupLogFd();
   recordStartupState("starting");
   const child = spawn7(process.execPath, [process.argv[1], "daemon"], {
@@ -46749,7 +46793,7 @@ async function ensureDaemon() {
     } catch {
     }
   }
-  console.error(chalk39.red("\u274C Daemon failed to start. Try: node9 daemon start"));
+  console.error(chalk40.red("\u274C Daemon failed to start. Try: node9 daemon start"));
   process.exit(1);
 }
 function postDecisionHttp(id, decision, authToken, port, opts) {
@@ -46818,7 +46862,7 @@ function buildCardLines(req, localCount = 0) {
   const severityIcon = isBlock ? `${RED}\u{1F6D1}` : `${YELLOW}\u26A0 `;
   const rawDesc = req.riskMetadata?.ruleDescription ?? "";
   const description = rawDesc ? cleanReason(rawDesc) : "";
-  const agentSuffix = req.agent && req.agent !== "Terminal" ? ` ${RESET}${chalk39.dim(`(${req.agent})`)}` : "";
+  const agentSuffix = req.agent && req.agent !== "Terminal" ? ` ${RESET}${chalk40.dim(`(${req.agent})`)}` : "";
   const lines = [
     ``,
     `${BOLD}${CYAN}\u2554\u2550\u2550 Node9 Approval Required \u2550\u2550\u2557${RESET}`,
@@ -46887,7 +46931,7 @@ function approverStatusLine() {
   const a = readApproversFromDisk();
   const fmt = (label2, key) => {
     const on = a[key] !== false;
-    return `[${key[0]}]${label2.slice(1)} ${on ? chalk39.green("\u2713") : chalk39.dim("\u2717")}`;
+    return `[${key[0]}]${label2.slice(1)} ${on ? chalk40.green("\u2713") : chalk40.dim("\u2717")}`;
   };
   return `${fmt("native", "native")}  ${fmt("cloud", "cloud")}  ${fmt("terminal", "terminal")}`;
 }
@@ -46932,7 +46976,7 @@ async function startTail(options = {}) {
       req2.end();
     });
     if (result.ok) {
-      console.log(chalk39.green("\u2713 Flight Recorder buffer cleared."));
+      console.log(chalk40.green("\u2713 Flight Recorder buffer cleared."));
     } else if (result.code === "ECONNREFUSED") {
       throw new Error("Daemon is not running. Start it with: node9 daemon start");
     } else if (result.code === "ETIMEDOUT") {
@@ -46978,7 +47022,7 @@ async function startTail(options = {}) {
       const channel = name === "n" ? "native" : name === "c" ? "cloud" : name === "t" ? "terminal" : null;
       if (channel) {
         toggleApprover(channel);
-        console.log(chalk39.dim(`  Approvers: ${approverStatusLine()}`));
+        console.log(chalk40.dim(`  Approvers: ${approverStatusLine()}`));
       }
     };
     process.stdin.on("keypress", idleKeypressHandler);
@@ -47044,7 +47088,7 @@ async function startTail(options = {}) {
           localAllowCounts.get(req2.toolName) ?? 0
         )
       );
-      const decisionStamp = action === "always-allow" ? chalk39.yellow("\u2605 ALWAYS ALLOW") : action === "trust" ? chalk39.cyan("\u23F1 TRUST 30m") : action === "allow" ? chalk39.green("\u2713 ALLOWED") : action === "redirect" ? chalk39.yellow("\u21A9 REDIRECT AI") : chalk39.red("\u2717 DENIED");
+      const decisionStamp = action === "always-allow" ? chalk40.yellow("\u2605 ALWAYS ALLOW") : action === "trust" ? chalk40.cyan("\u23F1 TRUST 30m") : action === "allow" ? chalk40.green("\u2713 ALLOWED") : action === "redirect" ? chalk40.yellow("\u21A9 REDIRECT AI") : chalk40.red("\u2717 DENIED");
       stampedLines.push(`  ${BOLD}\u2192${RESET} ${decisionStamp} ${GRAY}(terminal)${RESET}`, ``);
       for (const line of stampedLines) process.stdout.write(line + "\n");
       process.stdout.write(SHOW_CURSOR);
@@ -47095,7 +47139,7 @@ async function startTail(options = {}) {
       );
       const stampedLines = buildCardLines(req2, priorCount);
       if (externalDecision) {
-        const source = externalDecision === "allow" ? chalk39.green("\u2713 ALLOWED") : chalk39.red("\u2717 DENIED");
+        const source = externalDecision === "allow" ? chalk40.green("\u2713 ALLOWED") : chalk40.red("\u2717 DENIED");
         stampedLines.push(`  ${BOLD}\u2192${RESET} ${source} ${GRAY}(external)${RESET}`, ``);
       }
       for (const line of stampedLines) process.stdout.write(line + "\n");
@@ -47143,25 +47187,25 @@ async function startTail(options = {}) {
     if (unackedDlp > 0) {
       console.log("");
       console.log(
-        chalk39.bgRed.white.bold(
+        chalk40.bgRed.white.bold(
           ` \u26A0\uFE0F  DLP ALERT: ${unackedDlp} secret${unackedDlp !== 1 ? "s" : ""} found in Claude response text \u2014 run: node9 dlp `
         )
       );
     }
   } catch {
   }
-  console.log(chalk39.cyan.bold(`
+  console.log(chalk40.cyan.bold(`
 \u{1F6F0}\uFE0F  Node9 tail`));
   if (canApprove) {
-    console.log(chalk39.dim("Card: [\u21B5/y] Allow  [n] Deny  [a] Always  [t] Trust 30m"));
-    console.log(chalk39.dim(`Approvers (toggle): ${approverStatusLine()}  [q] quit`));
+    console.log(chalk40.dim("Card: [\u21B5/y] Allow  [n] Deny  [a] Always  [t] Trust 30m"));
+    console.log(chalk40.dim(`Approvers (toggle): ${approverStatusLine()}  [q] quit`));
   }
   const ctxStat = readSessionUsage();
   if (ctxStat) console.log("  " + formatContextStat(ctxStat));
   if (options.history) {
-    console.log(chalk39.dim("Showing history + live events.\n"));
+    console.log(chalk40.dim("Showing history + live events.\n"));
   } else {
-    console.log(chalk39.dim("Showing live events only. Use --history to include past.\n"));
+    console.log(chalk40.dim("Showing live events only. Use --history to include past.\n"));
   }
   process.on("SIGINT", () => {
     exitIdleMode();
@@ -47171,7 +47215,7 @@ async function startTail(options = {}) {
       readline5.clearLine(process.stdout, 0);
       readline5.cursorTo(process.stdout, 0);
     }
-    console.log(chalk39.dim("\n\u{1F6F0}\uFE0F  Disconnected."));
+    console.log(chalk40.dim("\n\u{1F6F0}\uFE0F  Disconnected."));
     process.exit(0);
   });
   const STALL_THRESHOLD_MS = 6e4;
@@ -47183,7 +47227,7 @@ async function startTail(options = {}) {
       if (Date.now() - auditMtime >= STALL_THRESHOLD_MS) return;
       console.log("");
       console.log(
-        chalk39.yellow(
+        chalk40.yellow(
           "\u26A0\uFE0F  Tail appears stalled \u2014 hooks are firing but no events are arriving. Try: node9 daemon restart"
         )
       );
@@ -47200,7 +47244,7 @@ async function startTail(options = {}) {
     },
     (res) => {
       if (res.statusCode !== 200) {
-        console.error(chalk39.red(`Failed to connect: HTTP ${res.statusCode}`));
+        console.error(chalk40.red(`Failed to connect: HTTP ${res.statusCode}`));
         process.exit(1);
       }
       if (canApprove) enterIdleMode();
@@ -47231,7 +47275,7 @@ async function startTail(options = {}) {
           readline5.clearLine(process.stdout, 0);
           readline5.cursorTo(process.stdout, 0);
         }
-        console.log(chalk39.red("\n\u274C Daemon disconnected."));
+        console.log(chalk40.red("\n\u274C Daemon disconnected."));
         process.exit(1);
       });
     }
@@ -47244,7 +47288,7 @@ async function startTail(options = {}) {
         const parsed = JSON.parse(rawData);
         const msg = parsed.message ?? "Flight recorder is down \u2014 run: node9 daemon restart";
         console.log("");
-        console.log(chalk39.bgRed.white.bold(` \u26A0\uFE0F  ${msg} `));
+        console.log(chalk40.bgRed.white.bold(` \u26A0\uFE0F  ${msg} `));
       } catch {
       }
       return;
@@ -47335,18 +47379,18 @@ async function startTail(options = {}) {
     if (event === "execution-result") {
       const exec = data;
       const time = new Date(Date.now()).toLocaleTimeString([], { hour12: false });
-      const arrow = exec.isError ? chalk39.red("  \u21B3 \u2717") : chalk39.green("  \u21B3 \u2713");
+      const arrow = exec.isError ? chalk40.red("  \u21B3 \u2717") : chalk40.green("  \u21B3 \u2713");
       const label2 = agentLabel(exec.agent, exec.mcpServer);
       const tool = (exec.tool ?? "").slice(0, 16);
-      const duration = typeof exec.durationMs === "number" ? chalk39.dim(` (${exec.durationMs}ms)`) : "";
+      const duration = typeof exec.durationMs === "number" ? chalk40.dim(` (${exec.durationMs}ms)`) : "";
       console.log(
-        `${chalk39.gray(time)} ${arrow} ${label2}${chalk39.dim(tool)}${chalk39.dim(" completed")}${duration}`
+        `${chalk40.gray(time)} ${arrow} ${label2}${chalk40.dim(tool)}${chalk40.dim(" completed")}${duration}`
       );
     }
   }
   req.on("error", (err2) => {
     const msg = err2.code === "ECONNREFUSED" ? "Daemon is not running. Start it with: node9 daemon start" : err2.message;
-    console.error(chalk39.red(`
+    console.error(chalk40.red(`
 \u274C ${msg}`));
     process.exit(1);
   });
@@ -47818,6 +47862,7 @@ init_hook_baseline();
 init_agent_wiring();
 
 // src/credentials.ts
+init_config();
 import * as fs17 from "fs";
 import * as os16 from "os";
 import * as path19 from "path";
@@ -47855,30 +47900,27 @@ function writeCredentialsAndConfig(apiKey, opts = {}) {
       config.settings = {};
     }
     const s = config.settings;
-    const approvers = s.approvers || {
-      native: true,
-      browser: true,
-      cloud: true,
-      terminal: true
+    const existing = s.approvers && typeof s.approvers === "object" ? s.approvers : {};
+    const d = DEFAULT_CONFIG.settings.approvers;
+    s.approvers = {
+      native: typeof existing.native === "boolean" ? existing.native : d.native,
+      terminal: typeof existing.terminal === "boolean" ? existing.terminal : d.terminal,
+      cloud: !opts.isLocal
     };
-    if (opts.isLocal) {
-      approvers.cloud = false;
-    }
-    s.approvers = approvers;
     if (!fs17.existsSync(path19.dirname(configPath))) {
       fs17.mkdirSync(path19.dirname(configPath), { recursive: true });
     }
     fs17.writeFileSync(configPath, JSON.stringify(config, null, 2), {
       mode: 384
     });
-    effectiveCloud = approvers.cloud === true;
+    effectiveCloud = !opts.isLocal;
   }
   return { profileName, effectiveCloud };
 }
 
 // src/cli.ts
 init_daemon2();
-import chalk40 from "chalk";
+import chalk41 from "chalk";
 import fs75 from "fs";
 import path70 from "path";
 import os63 from "os";
@@ -48157,8 +48199,85 @@ async function autoStartDaemonAndWait() {
   return false;
 }
 
-// src/cli.ts
+// src/onboarding.ts
+import chalk9 from "chalk";
+init_setup();
+init_sync();
 init_service();
+init_daemon();
+init_config();
+async function onboardMachine(apiKey, opts = {}) {
+  const steps = [];
+  const wired = [];
+  const namedProfile = !!opts.profileName && opts.profileName !== "default";
+  try {
+    writeCredentialsAndConfig(apiKey, { profileName: opts.profileName });
+    steps.push({ name: "credentials", ok: true, detail: "saved to ~/.node9" });
+  } catch (e) {
+    steps.push({
+      name: "credentials",
+      ok: false,
+      detail: e instanceof Error ? e.message : String(e)
+    });
+    return { ok: false, steps, wired };
+  }
+  process.env.NODE9_NONINTERACTIVE = "1";
+  try {
+    wired.push(...await setupDetectedAgents());
+    steps.push({
+      name: "agents",
+      ok: true,
+      detail: wired.length ? `wired: ${wired.join(", ")}` : "none detected yet: run `node9 init` after installing one"
+    });
+  } catch (e) {
+    steps.push({ name: "agents", ok: false, detail: e instanceof Error ? e.message : String(e) });
+  }
+  if (namedProfile || isTestingMode()) {
+    const why = namedProfile ? "skipped (named profile)" : "skipped (testing mode)";
+    steps.push({ name: "policy-sync", ok: true, detail: why });
+    steps.push({ name: "register", ok: true, detail: why });
+  } else {
+    const sync = await runCloudSync();
+    steps.push(
+      sync.ok ? {
+        name: "policy-sync",
+        ok: true,
+        detail: `${sync.rules} cloud rule${sync.rules === 1 ? "" : "s"} active`
+      } : { name: "policy-sync", ok: false, detail: sync.reason }
+    );
+    const push = await runPolicyPush();
+    steps.push(
+      push.ok ? { name: "register", ok: true, detail: "machine visible in the dashboard" } : { name: "register", ok: false, detail: push.reason }
+    );
+    const healed = ensureAutostartHealthy(!!getConfig().settings.autoStartDaemon);
+    const detail = healed === "repaired" ? "autostart re-enabled (survives reboot)" : isDaemonRunning() ? "running" : healed === "unsupported" ? "no background service on this platform: starts on agent activity" : "starts on agent activity";
+    steps.push({ name: "daemon", ok: true, detail });
+  }
+  const required = ["credentials", "policy-sync", "register"];
+  const ok2 = steps.filter((s) => required.includes(s.name)).every((s) => s.ok);
+  return { ok: ok2, steps, wired };
+}
+var STEP_LABELS = {
+  credentials: "Credentials",
+  agents: "Agents",
+  "policy-sync": "Cloud policy",
+  register: "Registered",
+  daemon: "Daemon"
+};
+function renderOnboardOutcome(out, opts = {}) {
+  const suffix = opts.workspaceName ? ` to ${opts.workspaceName}` : "";
+  const lines = [
+    out.ok ? chalk9.green(`\u2705 Connected${suffix}`) : chalk9.red(`\u2717 Connection incomplete${suffix}`)
+  ];
+  for (const s of out.steps) {
+    const mark = s.ok ? chalk9.green("\u2713") : chalk9.red("\u2717");
+    lines.push(`   ${mark} ${STEP_LABELS[s.name]}: ${s.detail}`);
+  }
+  if (!out.ok) {
+    lines.push(chalk9.yellow("   Fix the failed step, then verify with: node9 sync"));
+  }
+  return lines.join("\n");
+}
 
 // src/cli/commands/check.ts
 init_orchestrator();
@@ -48166,7 +48285,7 @@ init_state();
 init_daemon();
 init_startup_log();
 init_config();
-import chalk9 from "chalk";
+import chalk10 from "chalk";
 import fs49 from "fs";
 import { spawn as spawn4 } from "child_process";
 import path47 from "path";
@@ -48569,11 +48688,11 @@ RAW: ${raw}
             const ttyFd = fs49.openSync("/dev/tty", "w");
             fs49.writeSync(
               ttyFd,
-              chalk9.bgRed.white.bold(`
+              chalk10.bgRed.white.bold(`
  \u{1F6A8} NODE9 DLP \u2014 PROMPT BLOCKED 
-`) + chalk9.red(`   ${dlpMatch.patternName} detected in your prompt.
-`) + chalk9.gray(`   Match: ${dlpMatch.redactedSample}
-`) + chalk9.cyan(`   Edit the prompt to remove the credential and resubmit.
+`) + chalk10.red(`   ${dlpMatch.patternName} detected in your prompt.
+`) + chalk10.gray(`   Match: ${dlpMatch.redactedSample}
+`) + chalk10.cyan(`   Edit the prompt to remove the credential and resubmit.
 
 `)
             );
@@ -48680,18 +48799,18 @@ RAW: ${raw}
             ttyFd = fs49.openSync("/dev/tty", "w");
             const writeTty = (line) => fs49.writeSync(ttyFd, line + "\n");
             if (blockedByContext.includes("DLP") || blockedByContext.includes("Secret Detected") || blockedByContext.includes("Credential Review")) {
-              writeTty(chalk9.bgRed.white.bold(`
+              writeTty(chalk10.bgRed.white.bold(`
  \u{1F6A8} NODE9 DLP ALERT \u2014 CREDENTIAL DETECTED `));
-              writeTty(chalk9.red.bold(`   A sensitive secret was found in the tool arguments!`));
+              writeTty(chalk10.red.bold(`   A sensitive secret was found in the tool arguments!`));
             } else {
-              writeTty(chalk9.red(`
+              writeTty(chalk10.red(`
 \u{1F6D1} Node9 blocked "${toolName}"`));
             }
-            if (result2?.ruleDescription) writeTty(chalk9.white(`   ${result2.ruleDescription}`));
-            writeTty(chalk9.gray(`   Triggered by: ${blockedByContext}`));
-            if (result2?.changeHint) writeTty(chalk9.cyan(`   To change:  ${result2.changeHint}`));
+            if (result2?.ruleDescription) writeTty(chalk10.white(`   ${result2.ruleDescription}`));
+            writeTty(chalk10.gray(`   Triggered by: ${blockedByContext}`));
+            if (result2?.changeHint) writeTty(chalk10.cyan(`   To change:  ${result2.changeHint}`));
             if (result2?.recoveryCommand)
-              writeTty(chalk9.green(`   \u{1F4A1} Run:      ${result2.recoveryCommand}`));
+              writeTty(chalk10.green(`   \u{1F4A1} Run:      ${result2.recoveryCommand}`));
             writeTty("");
           } catch {
           } finally {
@@ -48761,7 +48880,7 @@ RAW: ${raw}
             const ttyFd = fs49.openSync("/dev/tty", "w");
             fs49.writeSync(
               ttyFd,
-              chalk9.yellow(
+              chalk10.yellow(
                 `
 \u26A0\uFE0F  Node9: review requested for "${toolName}" \u2014 answer in the prompt.
 `
@@ -48822,15 +48941,15 @@ RAW: ${raw}
               try {
                 ttyFd = fs49.openSync("/dev/tty", "w");
                 const w = (line) => fs49.writeSync(ttyFd, line + "\n");
-                w(chalk9.yellow(`
+                w(chalk10.yellow(`
 \u26A0\uFE0F  Node9: installed skill drift detected`));
-                w(chalk9.gray(`   ${detail}`));
+                w(chalk10.gray(`   ${detail}`));
                 w(
-                  chalk9.gray(
+                  chalk10.gray(
                     `   If you updated a plugin, acknowledge the change to clear this warning.`
                   )
                 );
-                if (recoveryCmd) w(chalk9.green(`   \u{1F4A1} Run:  ${recoveryCmd}`));
+                if (recoveryCmd) w(chalk10.green(`   \u{1F4A1} Run:  ${recoveryCmd}`));
                 w("");
               } catch {
               } finally {
@@ -48943,7 +49062,7 @@ RAW: ${raw}
             const tty = fs49.openSync("/dev/tty", "w");
             fs49.writeSync(
               tty,
-              chalk9.cyan("\n\u{1F6E1}\uFE0F  Node9: Starting approval daemon automatically...\n")
+              chalk10.cyan("\n\u{1F6E1}\uFE0F  Node9: Starting approval daemon automatically...\n")
             );
             fs49.closeSync(tty);
           } catch {
@@ -49300,7 +49419,7 @@ function registerLogCommand(program2) {
 // src/cli/commands/shield.ts
 init_shields();
 init_build();
-import chalk10 from "chalk";
+import chalk11 from "chalk";
 import fs52 from "fs";
 import path50 from "path";
 import os46 from "os";
@@ -49411,30 +49530,30 @@ function registerShieldCommand(program2) {
   shieldCmd.command("enable <service>").description("Enable a security shield for a specific service").action((service) => {
     const name = resolveShieldName(service);
     if (!name) {
-      console.error(chalk10.red(`
+      console.error(chalk11.red(`
 \u274C Unknown shield: "${service}"
 `));
-      console.log(`Run ${chalk10.cyan("node9 shield list")} to see available shields.
+      console.log(`Run ${chalk11.cyan("node9 shield list")} to see available shields.
 `);
       process.exit(1);
     }
     const shield = getShield(name);
     const active = readActiveShields();
     if (active.includes(name)) {
-      console.log(chalk10.yellow(`
+      console.log(chalk11.yellow(`
 \u2139\uFE0F  Shield "${name}" is already active.
 `));
       return;
     }
     writeActiveShields([...active, name]);
-    console.log(chalk10.green(`
+    console.log(chalk11.green(`
 \u{1F6E1}\uFE0F  Shield "${name}" enabled.`));
-    console.log(chalk10.gray(`   ${shield.smartRules.length} smart rules now active.`));
+    console.log(chalk11.gray(`   ${shield.smartRules.length} smart rules now active.`));
     if (shield.dangerousWords.length > 0)
-      console.log(chalk10.gray(`   ${shield.dangerousWords.length} dangerous words now active.`));
+      console.log(chalk11.gray(`   ${shield.dangerousWords.length} dangerous words now active.`));
     if (name === "filesystem") {
       console.log(
-        chalk10.yellow(
+        chalk11.yellow(
           `
    \u26A0\uFE0F  Note: filesystem rules cover common rm -rf patterns but not all variants.
       Tools like unlink, find -delete, or language-level file ops are not intercepted.`
@@ -49446,45 +49565,45 @@ function registerShieldCommand(program2) {
   shieldCmd.command("disable <service>").description("Disable a security shield").action((service) => {
     const name = resolveShieldName(service);
     if (!name) {
-      console.error(chalk10.red(`
+      console.error(chalk11.red(`
 \u274C Unknown shield: "${service}"
 `));
-      console.log(`Run ${chalk10.cyan("node9 shield list")} to see available shields.
+      console.log(`Run ${chalk11.cyan("node9 shield list")} to see available shields.
 `);
       process.exit(1);
     }
     const active = readActiveShields();
     if (!active.includes(name)) {
-      console.log(chalk10.yellow(`
+      console.log(chalk11.yellow(`
 \u2139\uFE0F  Shield "${name}" is not active.
 `));
       return;
     }
     writeActiveShields(active.filter((s) => s !== name));
-    console.log(chalk10.green(`
+    console.log(chalk11.green(`
 \u{1F6E1}\uFE0F  Shield "${name}" disabled.
 `));
   });
   shieldCmd.command("list").description("Show available shields (add --community to browse the marketplace)").option("--community", "List shields available from the community marketplace").action((opts) => {
     if (opts.community) {
-      console.log(chalk10.bold("\n\u{1F6E1}\uFE0F  Community Shield Marketplace\n"));
-      console.log(chalk10.gray("  Fetching index\u2026\n"));
+      console.log(chalk11.bold("\n\u{1F6E1}\uFE0F  Community Shield Marketplace\n"));
+      console.log(chalk11.gray("  Fetching index\u2026\n"));
       httpsFetch(COMMUNITY_INDEX_URL).then((body) => {
         const entries = JSON.parse(body);
         const installed = new Set(listShields().map((s) => s.name));
         for (const e of entries) {
-          const tag = installed.has(e.name) ? chalk10.green("installed") : chalk10.gray("available");
+          const tag = installed.has(e.name) ? chalk11.green("installed") : chalk11.gray("available");
           console.log(
-            `  ${tag}  ${chalk10.cyan(e.name.padEnd(12))} ${e.description}  ${chalk10.gray(`by ${e.author}`)}`
+            `  ${tag}  ${chalk11.cyan(e.name.padEnd(12))} ${e.description}  ${chalk11.gray(`by ${e.author}`)}`
           );
         }
         console.log("");
         console.log(
-          chalk10.gray(`  Install a shield: ${chalk10.cyan("node9 shield install <name>")}
+          chalk11.gray(`  Install a shield: ${chalk11.cyan("node9 shield install <name>")}
 `)
         );
       }).catch((err2) => {
-        console.error(chalk10.red(`
+        console.error(chalk11.red(`
 \u274C Could not fetch community index: ${String(err2)}
 `));
         process.exit(1);
@@ -49493,59 +49612,59 @@ function registerShieldCommand(program2) {
     }
     const active = new Set(readActiveShields());
     const cloud = readCloudShields();
-    console.log(chalk10.bold("\n\u{1F6E1}\uFE0F  Available Shields\n"));
-    console.log(chalk10.gray("  \u25CF local \xB7 \u2601 cloud\n"));
+    console.log(chalk11.bold("\n\u{1F6E1}\uFE0F  Available Shields\n"));
+    console.log(chalk11.gray("  \u25CF local \xB7 \u2601 cloud\n"));
     for (const shield of listShields()) {
       const isLocal = active.has(shield.name);
       const isCloud = cloud.has(shield.name);
-      const status = isLocal && isCloud ? chalk10.green("\u25CF\u2601 enabled ") : isLocal ? chalk10.green("\u25CF  enabled ") : isCloud ? chalk10.cyan("\u2601  cloud   ") : chalk10.gray("\u25CB  disabled");
-      const via = isCloud && !isLocal ? chalk10.gray(" (via dashboard)") : "";
+      const status = isLocal && isCloud ? chalk11.green("\u25CF\u2601 enabled ") : isLocal ? chalk11.green("\u25CF  enabled ") : isCloud ? chalk11.cyan("\u2601  cloud   ") : chalk11.gray("\u25CB  disabled");
+      const via = isCloud && !isLocal ? chalk11.gray(" (via dashboard)") : "";
       console.log(
-        `  ${status} ${chalk10.cyan(shield.name.padEnd(12))} ${shield.description}${via}`
+        `  ${status} ${chalk11.cyan(shield.name.padEnd(12))} ${shield.description}${via}`
       );
       if (shield.aliases.length > 0)
-        console.log(chalk10.gray(`              aliases: ${shield.aliases.join(", ")}`));
+        console.log(chalk11.gray(`              aliases: ${shield.aliases.join(", ")}`));
     }
     console.log("");
     console.log(
-      chalk10.gray(`  Browse community shields: ${chalk10.cyan("node9 shield list --community")}
+      chalk11.gray(`  Browse community shields: ${chalk11.cyan("node9 shield list --community")}
 `)
     );
   });
   shieldCmd.command("status").description("Show active shields and their individual rules with verdicts").action(() => {
     const active = readActiveShields();
     if (active.length === 0) {
-      console.error(chalk10.yellow("\n\u2139\uFE0F  No shields are active.\n"));
-      console.error(`Run ${chalk10.cyan("node9 shield list")} to see available shields.
+      console.error(chalk11.yellow("\n\u2139\uFE0F  No shields are active.\n"));
+      console.error(`Run ${chalk11.cyan("node9 shield list")} to see available shields.
 `);
       return;
     }
     const overrides = readShieldOverrides();
-    console.error(chalk10.bold("\n\u{1F6E1}\uFE0F  Active Shields\n"));
+    console.error(chalk11.bold("\n\u{1F6E1}\uFE0F  Active Shields\n"));
     for (const name of active) {
       const shield = getShield(name);
       if (!shield) continue;
-      console.error(`  ${chalk10.green("\u25CF")} ${chalk10.cyan(name)} \u2014 ${shield.description}`);
+      console.error(`  ${chalk11.green("\u25CF")} ${chalk11.cyan(name)} \u2014 ${shield.description}`);
       const ruleOverrides = overrides[name] ?? {};
       for (const rule of shield.smartRules) {
         const shortName = rule.name ? rule.name.replace(`shield:${name}:`, "") : "(unnamed)";
         const overrideVerdict = rule.name ? ruleOverrides[rule.name] : void 0;
         const effectiveVerdict = overrideVerdict ?? rule.verdict;
-        const verdictLabel = effectiveVerdict === "block" ? chalk10.red("block ") : effectiveVerdict === "review" ? chalk10.yellow("review") : chalk10.green("allow ");
-        const overrideNote = overrideVerdict ? chalk10.gray(` \u2190 overridden (was: ${rule.verdict})`) : "";
+        const verdictLabel = effectiveVerdict === "block" ? chalk11.red("block ") : effectiveVerdict === "review" ? chalk11.yellow("review") : chalk11.green("allow ");
+        const overrideNote = overrideVerdict ? chalk11.gray(` \u2190 overridden (was: ${rule.verdict})`) : "";
         console.error(
-          `    ${verdictLabel}  ${shortName.padEnd(24)} ${chalk10.gray(rule.reason ?? "")}${overrideNote}`
+          `    ${verdictLabel}  ${shortName.padEnd(24)} ${chalk11.gray(rule.reason ?? "")}${overrideNote}`
         );
       }
       if (shield.dangerousWords.length > 0) {
-        console.error(chalk10.gray(`    words: ${shield.dangerousWords.join(", ")}`));
+        console.error(chalk11.gray(`    words: ${shield.dangerousWords.join(", ")}`));
       }
       console.error("");
     }
     if (Object.keys(overrides).length > 0) {
       console.error(
-        chalk10.gray(
-          `  Tip: run ${chalk10.cyan("node9 shield unset <shield> <rule>")} to remove an override.
+        chalk11.gray(
+          `  Tip: run ${chalk11.cyan("node9 shield unset <shield> <rule>")} to remove an override.
 `
         )
       );
@@ -49554,24 +49673,24 @@ function registerShieldCommand(program2) {
   shieldCmd.command("set <service> <rule> <verdict>").description("Override the verdict for a specific shield rule (block, review, or allow)").option("--force", "Required when setting verdict to allow (silences a block rule)").action((service, rule, verdict, opts) => {
     const name = resolveShieldName(service);
     if (!name) {
-      console.error(chalk10.red(`
+      console.error(chalk11.red(`
 \u274C Unknown shield: "${service}"
 `));
-      console.error(`Run ${chalk10.cyan("node9 shield list")} to see available shields.
+      console.error(`Run ${chalk11.cyan("node9 shield list")} to see available shields.
 `);
       process.exit(1);
     }
     if (!readActiveShields().includes(name)) {
-      console.error(chalk10.red(`
+      console.error(chalk11.red(`
 \u274C Shield "${name}" is not active. Enable it first:
 `));
-      console.error(`  ${chalk10.cyan(`node9 shield enable ${name}`)}
+      console.error(`  ${chalk11.cyan(`node9 shield enable ${name}`)}
 `);
       process.exit(1);
     }
     if (!isShieldVerdict(verdict)) {
       console.error(
-        chalk10.red(`
+        chalk11.red(`
 \u274C Invalid verdict "${verdict}". Use: block, review, or allow
 `)
       );
@@ -49579,12 +49698,12 @@ function registerShieldCommand(program2) {
     }
     if (verdict === "allow" && !opts.force) {
       console.error(
-        chalk10.red(`
+        chalk11.red(`
 \u26A0\uFE0F  Setting a verdict to "allow" silences the rule entirely.
-`) + chalk10.yellow(
+`) + chalk11.yellow(
           `   This disables a shield protection. If you are sure, re-run with --force:
 `
-        ) + chalk10.cyan(`
+        ) + chalk11.cyan(`
    node9 shield set ${service} ${rule} allow --force
 `)
       );
@@ -49593,13 +49712,13 @@ function registerShieldCommand(program2) {
     const ruleName = resolveShieldRule(name, rule);
     if (!ruleName) {
       const shield = getShield(name);
-      console.error(chalk10.red(`
+      console.error(chalk11.red(`
 \u274C Unknown rule "${rule}" for shield "${name}".
 `));
       console.error("  Available rules:");
       for (const r of shield?.smartRules ?? []) {
         const short = r.name ? r.name.replace(`shield:${name}:`, "") : "";
-        console.error(`    ${chalk10.cyan(short)}`);
+        console.error(`    ${chalk11.cyan(short)}`);
       }
       console.error("");
       process.exit(1);
@@ -49609,33 +49728,33 @@ function registerShieldCommand(program2) {
       appendConfigAudit({ event: "shield-override-allow", shield: name, rule: ruleName });
     }
     const shortName = ruleName.replace(`shield:${name}:`, "");
-    const verdictLabel = verdict === "block" ? chalk10.red("block") : verdict === "review" ? chalk10.yellow("review") : chalk10.green("allow");
+    const verdictLabel = verdict === "block" ? chalk11.red("block") : verdict === "review" ? chalk11.yellow("review") : chalk11.green("allow");
     if (verdict === "allow") {
       console.error(
-        chalk10.yellow(`
-\u26A0\uFE0F  ${name}/${shortName} \u2192 ${verdictLabel}`) + chalk10.gray(" (rule silenced \u2014 use `node9 shield unset` to restore)\n")
+        chalk11.yellow(`
+\u26A0\uFE0F  ${name}/${shortName} \u2192 ${verdictLabel}`) + chalk11.gray(" (rule silenced \u2014 use `node9 shield unset` to restore)\n")
       );
     } else {
-      console.error(chalk10.green(`
+      console.error(chalk11.green(`
 \u2705  ${name}/${shortName} \u2192 ${verdictLabel}
 `));
     }
     console.error(
-      chalk10.gray(`   Run ${chalk10.cyan("node9 shield status")} to see all active rules.
+      chalk11.gray(`   Run ${chalk11.cyan("node9 shield status")} to see all active rules.
 `)
     );
   });
   shieldCmd.command("unset <service> <rule>").description("Remove a verdict override, restoring the shield default").action((service, rule) => {
     const name = resolveShieldName(service);
     if (!name) {
-      console.error(chalk10.red(`
+      console.error(chalk11.red(`
 \u274C Unknown shield: "${service}"
 `));
       process.exit(1);
     }
     const ruleName = resolveShieldRule(name, rule);
     if (!ruleName) {
-      console.error(chalk10.red(`
+      console.error(chalk11.red(`
 \u274C Unknown rule "${rule}" for shield "${name}".
 `));
       process.exit(1);
@@ -49643,7 +49762,7 @@ function registerShieldCommand(program2) {
     clearShieldOverride(name, ruleName);
     const shortName = ruleName.replace(`shield:${name}:`, "");
     console.error(
-      chalk10.green(`
+      chalk11.green(`
 \u2705  Override removed \u2014 ${name}/${shortName} restored to default.
 `)
     );
@@ -49651,7 +49770,7 @@ function registerShieldCommand(program2) {
   shieldCmd.command("install <name>").description("Install a shield from the community marketplace into ~/.node9/shields/").action((name) => {
     if (!/^[a-zA-Z0-9_-]+$/.test(name)) {
       console.error(
-        chalk10.red(
+        chalk11.red(
           `
 \u274C Invalid shield name: only alphanumeric characters, hyphens, and underscores are allowed
 `
@@ -49659,16 +49778,16 @@ function registerShieldCommand(program2) {
       );
       process.exit(1);
     }
-    console.log(chalk10.bold(`
+    console.log(chalk11.bold(`
 \u{1F6E1}\uFE0F  Installing shield "${name}"\u2026
 `));
     httpsFetch(COMMUNITY_INDEX_URL).then((indexBody) => {
       const entries = JSON.parse(indexBody);
       const entry = entries.find((e) => e.name === name);
       if (!entry) {
-        const names = entries.map((e) => chalk10.cyan(e.name)).join(", ");
+        const names = entries.map((e) => chalk11.cyan(e.name)).join(", ");
         console.error(
-          chalk10.red(`\u274C Shield "${name}" not found in the community marketplace.
+          chalk11.red(`\u274C Shield "${name}" not found in the community marketplace.
 `)
         );
         console.error(`  Available: ${names}
@@ -49680,15 +49799,15 @@ function registerShieldCommand(program2) {
       const shieldJson = JSON.parse(shieldBody);
       installShield(name, shieldJson);
       console.log(
-        chalk10.green(`\u2705  Shield "${name}" installed to ~/.node9/shields/${name}.json`)
+        chalk11.green(`\u2705  Shield "${name}" installed to ~/.node9/shields/${name}.json`)
       );
       console.log(
-        chalk10.gray(`   Activate it with: ${chalk10.cyan(`node9 shield enable ${name}`)}
+        chalk11.gray(`   Activate it with: ${chalk11.cyan(`node9 shield enable ${name}`)}
 `)
       );
       appendConfigAudit({ event: "shield-install", shield: name });
     }).catch((err2) => {
-      console.error(chalk10.red(`
+      console.error(chalk11.red(`
 \u274C Install failed: ${String(err2)}
 `));
       process.exit(1);
@@ -49699,7 +49818,7 @@ function registerShieldCommand(program2) {
     (name, opts) => {
       if (!/^[a-zA-Z0-9_-]+$/.test(name)) {
         console.error(
-          chalk10.red(
+          chalk11.red(
             `
 \u274C Invalid shield name: only alphanumeric characters, hyphens, and underscores are allowed
 `
@@ -49714,7 +49833,7 @@ function registerShieldCommand(program2) {
           raw = JSON.parse(fs52.readFileSync(opts.fromFile, "utf-8"));
         } catch (err2) {
           console.error(
-            chalk10.red(`
+            chalk11.red(`
 \u274C Could not read/parse ${opts.fromFile}: ${String(err2)}
 `)
           );
@@ -49738,25 +49857,25 @@ function registerShieldCommand(program2) {
         viaMcp: false
       });
       if (!res.ok) {
-        console.error(chalk10.red(`
+        console.error(chalk11.red(`
 \u274C ${res.error}
 `));
         process.exit(1);
         return;
       }
       console.log(
-        chalk10.green(`
-\u2705 Shield "${name}" created`) + chalk10.gray(` \u2014 ${res.ruleCount} rule(s) \u2192 ${res.path}`)
+        chalk11.green(`
+\u2705 Shield "${name}" created`) + chalk11.gray(` \u2014 ${res.ruleCount} rule(s) \u2192 ${res.path}`)
       );
       if (res.enabled) {
-        console.log(chalk10.gray(`   Active now.`));
+        console.log(chalk11.gray(`   Active now.`));
       } else {
         console.log(
-          chalk10.gray(`   Activate it with: ${chalk10.cyan(`node9 shield enable ${name}`)}`)
+          chalk11.gray(`   Activate it with: ${chalk11.cyan(`node9 shield enable ${name}`)}`)
         );
       }
       console.log(
-        chalk10.gray(`   Preview a call:   ${chalk10.cyan(`node9 explain bash "<command>"`)}
+        chalk11.gray(`   Preview a call:   ${chalk11.cyan(`node9 explain bash "<command>"`)}
 `)
       );
     }
@@ -49769,32 +49888,32 @@ function registerConfigShowCommand(program2) {
     const config = getConfig();
     const active = readActiveShields();
     const overrides = readShieldOverrides();
-    console.error(chalk10.bold("\n\u{1F50D}  Node9 Effective Configuration\n"));
-    const modeLabel = config.settings.mode === "audit" ? chalk10.blue("audit") : config.settings.mode === "strict" ? chalk10.red("strict") : chalk10.white("standard");
+    console.error(chalk11.bold("\n\u{1F50D}  Node9 Effective Configuration\n"));
+    const modeLabel = config.settings.mode === "audit" ? chalk11.blue("audit") : config.settings.mode === "strict" ? chalk11.red("strict") : chalk11.white("standard");
     console.error(`  Mode: ${modeLabel}
 `);
     if (active.length > 0) {
-      console.error(chalk10.bold("  \u2500\u2500 Active Shields \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
+      console.error(chalk11.bold("  \u2500\u2500 Active Shields \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
       for (const name of active) {
         const shield = getShield(name);
         if (!shield) continue;
         const ruleOverrides = overrides[name] ?? {};
         console.error(`
-  ${chalk10.green("\u25CF")} ${chalk10.cyan(name)}`);
+  ${chalk11.green("\u25CF")} ${chalk11.cyan(name)}`);
         for (const rule of shield.smartRules) {
           const shortName = rule.name ? rule.name.replace(`shield:${name}:`, "") : "(unnamed)";
           const overrideVerdict = rule.name ? ruleOverrides[rule.name] : void 0;
           const effectiveVerdict = overrideVerdict ?? rule.verdict;
-          const vLabel = effectiveVerdict === "block" ? chalk10.red("block ") : effectiveVerdict === "review" ? chalk10.yellow("review") : chalk10.green("allow ");
-          const note = overrideVerdict ? chalk10.gray(` \u2190 overridden`) : "";
+          const vLabel = effectiveVerdict === "block" ? chalk11.red("block ") : effectiveVerdict === "review" ? chalk11.yellow("review") : chalk11.green("allow ");
+          const note = overrideVerdict ? chalk11.gray(` \u2190 overridden`) : "";
           console.error(`    ${vLabel}  ${shortName}${note}`);
         }
       }
       console.error("");
     } else {
-      console.error(chalk10.gray("  No shields active. Run `node9 shield list` to see options.\n"));
+      console.error(chalk11.gray("  No shields active. Run `node9 shield list` to see options.\n"));
     }
-    console.error(chalk10.bold("  \u2500\u2500 Built-in Rules (always on) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
+    console.error(chalk11.bold("  \u2500\u2500 Built-in Rules (always on) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
     for (const rule of config.policy.smartRules) {
       const isShieldRule = rule.name?.startsWith("shield:");
       const isAdvisory = [
@@ -49805,11 +49924,11 @@ function registerConfigShowCommand(program2) {
         "review-drop-column-sql"
       ].includes(rule.name ?? "");
       if (isShieldRule || isAdvisory) continue;
-      const vLabel = rule.verdict === "block" ? chalk10.red("block ") : rule.verdict === "review" ? chalk10.yellow("review") : chalk10.green("allow ");
-      console.error(`    ${vLabel}  ${chalk10.gray(rule.name ?? rule.tool)}`);
+      const vLabel = rule.verdict === "block" ? chalk11.red("block ") : rule.verdict === "review" ? chalk11.yellow("review") : chalk11.green("allow ");
+      console.error(`    ${vLabel}  ${chalk11.gray(rule.name ?? rule.tool)}`);
     }
     console.error("");
-    console.error(chalk10.bold("  \u2500\u2500 Safe by Default (advisory, overridable) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
+    console.error(chalk11.bold("  \u2500\u2500 Safe by Default (advisory, overridable) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
     const advisoryNames = /* @__PURE__ */ new Set([
       "review-rm",
       "allow-rm-safe-paths",
@@ -49819,12 +49938,12 @@ function registerConfigShowCommand(program2) {
     ]);
     for (const rule of config.policy.smartRules) {
       if (!advisoryNames.has(rule.name ?? "")) continue;
-      const vLabel = rule.verdict === "block" ? chalk10.red("block ") : rule.verdict === "review" ? chalk10.yellow("review") : chalk10.green("allow ");
-      console.error(`    ${vLabel}  ${chalk10.gray(rule.name ?? rule.tool)}`);
+      const vLabel = rule.verdict === "block" ? chalk11.red("block ") : rule.verdict === "review" ? chalk11.yellow("review") : chalk11.green("allow ");
+      console.error(`    ${vLabel}  ${chalk11.gray(rule.name ?? rule.tool)}`);
     }
     console.error("");
-    console.error(chalk10.bold("  \u2500\u2500 Dangerous Words \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
-    console.error(`    ${chalk10.gray(config.policy.dangerousWords.join(", "))}
+    console.error(chalk11.bold("  \u2500\u2500 Dangerous Words \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
+    console.error(`    ${chalk11.gray(config.policy.dangerousWords.join(", "))}
 `);
   });
 }
@@ -49836,7 +49955,7 @@ init_config();
 init_agent_wiring();
 init_sync();
 init_service();
-import chalk11 from "chalk";
+import chalk12 from "chalk";
 import fs54 from "fs";
 import path52 from "path";
 import os48 from "os";
@@ -49918,21 +50037,21 @@ function registerDoctorCommand(program2, version2) {
     const homeDir2 = os48.homedir();
     let failures = 0;
     function pass(msg) {
-      console.log(chalk11.green("  \u2705 ") + msg);
+      console.log(chalk12.green("  \u2705 ") + msg);
     }
     function fail(msg, hint) {
-      console.log(chalk11.red("  \u274C ") + msg);
-      if (hint) console.log(chalk11.gray("       " + hint));
+      console.log(chalk12.red("  \u274C ") + msg);
+      if (hint) console.log(chalk12.gray("       " + hint));
       failures++;
     }
     function warn(msg, hint) {
-      console.log(chalk11.yellow("  \u26A0\uFE0F  ") + msg);
-      if (hint) console.log(chalk11.gray("       " + hint));
+      console.log(chalk12.yellow("  \u26A0\uFE0F  ") + msg);
+      if (hint) console.log(chalk12.gray("       " + hint));
     }
     function section(title) {
-      console.log("\n" + chalk11.bold(title));
+      console.log("\n" + chalk12.bold(title));
     }
-    console.log(chalk11.cyan.bold(`
+    console.log(chalk12.cyan.bold(`
 \u{1F6E1}\uFE0F  Node9 Doctor  v${version2}
 `));
     section("Binary");
@@ -50013,7 +50132,7 @@ function registerDoctorCommand(program2, version2) {
     }
     if (notConfigured.length > 0) {
       console.log(
-        chalk11.gray(
+        chalk12.gray(
           `     \xB7 Not configured: ${notConfigured.join(", ")} \u2014 run \`node9 agents add <agent>\` if you use one`
         )
       );
@@ -50043,7 +50162,7 @@ function registerDoctorCommand(program2, version2) {
       if (cause) {
         const suffix = cause.detail ? ` \u2014 ${cause.detail}` : "";
         console.log(
-          chalk11.gray(
+          chalk12.gray(
             `       ${cause.label} ${agoLabel(cause.at.toISOString())}: ${cause.kind}${suffix}`
           )
         );
@@ -50112,9 +50231,9 @@ function registerDoctorCommand(program2, version2) {
     }
     console.log("");
     if (failures === 0) {
-      console.log(chalk11.green.bold("  All checks passed. Node9 is ready.\n"));
+      console.log(chalk12.green.bold("  All checks passed. Node9 is ready.\n"));
     } else {
-      console.log(chalk11.red.bold(`  ${failures} check(s) failed. See hints above.
+      console.log(chalk12.red.bold(`  ${failures} check(s) failed. See hints above.
 `));
       process.exit(1);
     }
@@ -50123,7 +50242,7 @@ function registerDoctorCommand(program2, version2) {
 
 // src/cli/commands/audit.ts
 init_decision();
-import chalk12 from "chalk";
+import chalk13 from "chalk";
 import fs55 from "fs";
 import path53 from "path";
 import os49 from "os";
@@ -50142,7 +50261,7 @@ function registerAuditCommand(program2) {
     const logPath = path53.join(os49.homedir(), ".node9", "audit.log");
     if (!fs55.existsSync(logPath)) {
       console.log(
-        chalk12.yellow("No audit logs found. Run node9 with an agent to generate entries.")
+        chalk13.yellow("No audit logs found. Run node9 with an agent to generate entries.")
       );
       return;
     }
@@ -50174,38 +50293,38 @@ function registerAuditCommand(program2) {
       return;
     }
     if (entries.length === 0) {
-      console.log(chalk12.yellow("No matching audit entries."));
+      console.log(chalk13.yellow("No matching audit entries."));
       return;
     }
     console.log(
       `
-  ${chalk12.bold("Node9 Audit Log")}  ${chalk12.dim(`(${entries.length} entries)`)}`
+  ${chalk13.bold("Node9 Audit Log")}  ${chalk13.dim(`(${entries.length} entries)`)}`
     );
-    console.log(chalk12.dim("  " + "\u2500".repeat(65)));
+    console.log(chalk13.dim("  " + "\u2500".repeat(65)));
     console.log(
       `  ${"Time".padEnd(12)} ${"Tool".padEnd(18)} ${"Result".padEnd(10)} ${"By".padEnd(15)} Agent`
     );
-    console.log(chalk12.dim("  " + "\u2500".repeat(65)));
+    console.log(chalk13.dim("  " + "\u2500".repeat(65)));
     for (const e of entries) {
       const time = formatRelativeTime(String(e.ts)).padEnd(12);
       const tool = String(e.tool).slice(0, 17).padEnd(18);
-      const result = e.view.outcome === "allow" ? chalk12.green(e.view.label.padEnd(14)) : e.view.outcome === "deny" ? chalk12.red(e.view.label.padEnd(14)) : e.view.outcome === "observe" ? chalk12.yellow(e.view.label.padEnd(14)) : chalk12.gray(e.view.label.padEnd(14));
+      const result = e.view.outcome === "allow" ? chalk13.green(e.view.label.padEnd(14)) : e.view.outcome === "deny" ? chalk13.red(e.view.label.padEnd(14)) : e.view.outcome === "observe" ? chalk13.yellow(e.view.label.padEnd(14)) : chalk13.gray(e.view.label.padEnd(14));
       const checker = String(e.checkedBy || "unknown").slice(0, 14).padEnd(15);
       const agent = String(e.agent || "unknown");
       console.log(`  ${time} ${tool} ${result} ${checker} ${agent}`);
     }
     const allowed = entries.filter((e) => e.view.outcome === "allow").length;
     const denied = entries.filter((e) => e.view.outcome === "deny").length;
-    console.log(chalk12.dim("  " + "\u2500".repeat(65)));
+    console.log(chalk13.dim("  " + "\u2500".repeat(65)));
     console.log(
-      `  ${entries.length} entries  |  ${chalk12.green(allowed + " allowed")}  |  ${chalk12.red(denied + " denied")}
+      `  ${entries.length} entries  |  ${chalk13.green(allowed + " allowed")}  |  ${chalk13.red(denied + " denied")}
 `
     );
   });
 }
 
 // src/cli/commands/report.ts
-import chalk13 from "chalk";
+import chalk14 from "chalk";
 
 // src/cli/aggregate/report-audit.ts
 init_costSync();
@@ -50982,7 +51101,7 @@ function barStr(value, max, width) {
 function colorBar(value, max, width) {
   const s = barStr(value, max, width);
   const filled = Math.max(1, Math.round(max > 0 ? value / max * width : 0));
-  return chalk13.cyan(s.slice(0, filled)) + chalk13.dim(s.slice(filled));
+  return chalk14.cyan(s.slice(0, filled)) + chalk14.dim(s.slice(filled));
 }
 function fmtDate(d) {
   const date = typeof d === "string" ? /* @__PURE__ */ new Date(d + "T12:00:00") : d;
@@ -51008,14 +51127,14 @@ function registerReportCommand(program2) {
     if (data.unackedDlp > 0 && !options.json) {
       console.log("");
       console.log(
-        chalk13.bgRed.white.bold(
+        chalk14.bgRed.white.bold(
           ` \u26A0\uFE0F  DLP ALERT: ${data.unackedDlp} secret${data.unackedDlp !== 1 ? "s" : ""} found in Claude response text `
-        ) + "  " + chalk13.yellow("\u2192 run: node9 dlp")
+        ) + "  " + chalk14.yellow("\u2192 run: node9 dlp")
       );
     }
     if (!hasAuditFile && !options.json) {
       console.log(
-        chalk13.yellow("\n  No audit data found. Run node9 with Claude Code to generate entries.\n")
+        chalk14.yellow("\n  No audit data found. Run node9 with Claude Code to generate entries.\n")
       );
       return;
     }
@@ -51025,7 +51144,7 @@ function registerReportCommand(program2) {
       return;
     }
     if (data.total === 0) {
-      console.log(chalk13.yellow(`
+      console.log(chalk14.yellow(`
   No activity for period "${period}".
 `));
       return;
@@ -51083,7 +51202,7 @@ function renderTerminalReport(data, responseDlpEntries, excludeTests) {
   const BAR = Math.max(6, Math.min(14, COL - LABEL - 8));
   const TOOL_COUNT_W = Math.max(...topTools.map(([, v]) => num2(v.calls).length), 1);
   const BLOCK_COUNT_W = Math.max(...topBlocks.map(([, v]) => num2(v).length), 1);
-  const line = chalk13.dim("\u2500".repeat(W - 2));
+  const line = chalk14.dim("\u2500".repeat(W - 2));
   const periodLabel = {
     today: "Today",
     "7d": "Last 7 Days",
@@ -51093,7 +51212,7 @@ function renderTerminalReport(data, responseDlpEntries, excludeTests) {
   };
   console.log("");
   console.log(
-    "  " + chalk13.bold.cyan("\u{1F6E1} node9 Report") + chalk13.dim("  \xB7  ") + chalk13.white(periodLabel[period]) + chalk13.dim(`  ${fmtDate(start)} \u2013 ${fmtDate(end)}`) + chalk13.dim(`  ${num2(total)} events`) + (excludeTests ? chalk13.dim(`  \u2013tests (\u2013${excludedTests})`) : "")
+    "  " + chalk14.bold.cyan("\u{1F6E1} node9 Report") + chalk14.dim("  \xB7  ") + chalk14.white(periodLabel[period]) + chalk14.dim(`  ${fmtDate(start)} \u2013 ${fmtDate(end)}`) + chalk14.dim(`  ${num2(total)} events`) + (excludeTests ? chalk14.dim(`  \u2013tests (\u2013${excludedTests})`) : "")
   );
   console.log("  " + line);
   const totalBlocked = timedOut + hardBlocked + dlpBlocked + loopHits + userDenied;
@@ -51102,73 +51221,73 @@ function renderTerminalReport(data, responseDlpEntries, excludeTests) {
     if (priorBlockRate === null) return "";
     const delta = Math.round((currentRate - priorBlockRate) * 100);
     if (delta === 0) return "";
-    return "  " + (delta > 0 ? chalk13.red(`\u25B2${delta}%`) : chalk13.green(`\u25BC${Math.abs(delta)}%`)) + chalk13.dim(" vs prior");
+    return "  " + (delta > 0 ? chalk14.red(`\u25B2${delta}%`) : chalk14.green(`\u25BC${Math.abs(delta)}%`)) + chalk14.dim(" vs prior");
   })();
   const reads = toolMap.get("Read")?.calls ?? 0;
   const edits = (toolMap.get("Edit")?.calls ?? 0) + (toolMap.get("Write")?.calls ?? 0);
-  const ratioLabel = reads > 0 ? chalk13.dim(`edit/read ${(edits / reads).toFixed(1)}`) : chalk13.dim("edit/read \u2013");
-  const testLabel = testPasses + testFails > 0 ? chalk13.dim("tests ") + chalk13.green(`${testPasses}\u2713`) + (testFails > 0 ? " " + chalk13.red(`${testFails}\u2717`) : "") : chalk13.dim("tests \u2013");
+  const ratioLabel = reads > 0 ? chalk14.dim(`edit/read ${(edits / reads).toFixed(1)}`) : chalk14.dim("edit/read \u2013");
+  const testLabel = testPasses + testFails > 0 ? chalk14.dim("tests ") + chalk14.green(`${testPasses}\u2713`) + (testFails > 0 ? " " + chalk14.red(`${testFails}\u2717`) : "") : chalk14.dim("tests \u2013");
   console.log("");
-  console.log("  " + chalk13.bold("Protection Summary"));
-  console.log("  " + chalk13.dim("\u2500".repeat(Math.min(50, W - 4))));
+  console.log("  " + chalk14.bold("Protection Summary"));
+  console.log("  " + chalk14.dim("\u2500".repeat(Math.min(50, W - 4))));
   console.log(
-    "  " + chalk13.dim("Intercepted") + "  " + chalk13.white(num2(total)) + chalk13.dim(" tool calls")
+    "  " + chalk14.dim("Intercepted") + "  " + chalk14.white(num2(total)) + chalk14.dim(" tool calls")
   );
   console.log("");
   const COL1 = 18;
   const summaryRow = (icon, label2, count, note, colorFn = (s) => s) => {
     const countStr = colorFn(num2(count));
-    const noteStr = note ? chalk13.dim("   " + note) : "";
-    console.log("    " + icon + "  " + chalk13.white(label2.padEnd(COL1)) + countStr + noteStr);
+    const noteStr = note ? chalk14.dim("   " + note) : "";
+    console.log("    " + icon + "  " + chalk14.white(label2.padEnd(COL1)) + countStr + noteStr);
   };
   summaryRow(
-    userApproved > 0 ? chalk13.green("\u2705") : chalk13.dim("\u2705"),
+    userApproved > 0 ? chalk14.green("\u2705") : chalk14.dim("\u2705"),
     "User approved",
     userApproved,
     userApproved === 0 ? "no popups this period" : void 0,
-    userApproved > 0 ? (s) => chalk13.green(s) : (s) => chalk13.dim(s)
+    userApproved > 0 ? (s) => chalk14.green(s) : (s) => chalk14.dim(s)
   );
   summaryRow(
-    userDenied > 0 ? chalk13.red("\u{1F6AB}") : chalk13.dim("\u{1F6AB}"),
+    userDenied > 0 ? chalk14.red("\u{1F6AB}") : chalk14.dim("\u{1F6AB}"),
     "User denied",
     userDenied,
     void 0,
-    userDenied > 0 ? (s) => chalk13.red(s) : (s) => chalk13.dim(s)
+    userDenied > 0 ? (s) => chalk14.red(s) : (s) => chalk14.dim(s)
   );
   summaryRow(
-    timedOut > 0 ? chalk13.yellow("\u23F1") : chalk13.dim("\u23F1"),
+    timedOut > 0 ? chalk14.yellow("\u23F1") : chalk14.dim("\u23F1"),
     "Timed out",
     timedOut,
     timedOut > 0 ? "no approval response" : void 0,
-    timedOut > 0 ? (s) => chalk13.yellow(s) : (s) => chalk13.dim(s)
+    timedOut > 0 ? (s) => chalk14.yellow(s) : (s) => chalk14.dim(s)
   );
   summaryRow(
-    hardBlocked > 0 ? chalk13.red("\u{1F6D1}") : chalk13.dim("\u{1F6D1}"),
+    hardBlocked > 0 ? chalk14.red("\u{1F6D1}") : chalk14.dim("\u{1F6D1}"),
     "Auto-blocked",
     hardBlocked,
     void 0,
-    hardBlocked > 0 ? (s) => chalk13.red(s) : (s) => chalk13.dim(s)
+    hardBlocked > 0 ? (s) => chalk14.red(s) : (s) => chalk14.dim(s)
   );
   summaryRow(
-    dlpBlocked > 0 ? chalk13.yellow("\u{1F6A8}") : chalk13.dim("\u{1F6A8}"),
+    dlpBlocked > 0 ? chalk14.yellow("\u{1F6A8}") : chalk14.dim("\u{1F6A8}"),
     "DLP blocked",
     dlpBlocked,
     void 0,
-    dlpBlocked > 0 ? (s) => chalk13.yellow(s) : (s) => chalk13.dim(s)
+    dlpBlocked > 0 ? (s) => chalk14.yellow(s) : (s) => chalk14.dim(s)
   );
   summaryRow(
-    observeDlp > 0 ? chalk13.blue("\u{1F441}") : chalk13.dim("\u{1F441}"),
+    observeDlp > 0 ? chalk14.blue("\u{1F441}") : chalk14.dim("\u{1F441}"),
     "DLP (observe)",
     observeDlp,
     observeDlp > 0 ? "would-block in strict mode" : void 0,
-    observeDlp > 0 ? (s) => chalk13.blue(s) : (s) => chalk13.dim(s)
+    observeDlp > 0 ? (s) => chalk14.blue(s) : (s) => chalk14.dim(s)
   );
   summaryRow(
-    loopHits > 0 ? chalk13.yellow("\u{1F504}") : chalk13.dim("\u{1F504}"),
+    loopHits > 0 ? chalk14.yellow("\u{1F504}") : chalk14.dim("\u{1F504}"),
     "Loops detected",
     loopHits,
     void 0,
-    loopHits > 0 ? (s) => chalk13.yellow(s) : (s) => chalk13.dim(s)
+    loopHits > 0 ? (s) => chalk14.yellow(s) : (s) => chalk14.dim(s)
   );
   if (trendLabel || ratioLabel || testPasses + testFails > 0) {
     console.log("");
@@ -51177,12 +51296,12 @@ function renderTerminalReport(data, responseDlpEntries, excludeTests) {
   console.log("");
   {
     const d = dimensions;
-    console.log("  " + chalk13.bold("By dimension") + chalk13.dim("   what fired, per governed area"));
-    console.log("  " + chalk13.dim("\u2500".repeat(Math.min(50, W - 4))));
+    console.log("  " + chalk14.bold("By dimension") + chalk14.dim("   what fired, per governed area"));
+    console.log("  " + chalk14.dim("\u2500".repeat(Math.min(50, W - 4))));
     const dimRow = (icon, label2, active, detail) => {
-      const l = active ? chalk13.white(label2.padEnd(14)) : chalk13.dim(label2.padEnd(14));
-      const v = active ? detail : chalk13.dim(detail);
-      console.log("    " + (active ? icon : chalk13.dim(icon)) + "  " + l + v);
+      const l = active ? chalk14.white(label2.padEnd(14)) : chalk14.dim(label2.padEnd(14));
+      const v = active ? detail : chalk14.dim(detail);
+      console.log("    " + (active ? icon : chalk14.dim(icon)) + "  " + l + v);
     };
     dimRow("\u{1F310}", "Network", d.network.blocked > 0, `${num2(d.network.blocked)} egress blocked`);
     dimRow(
@@ -51217,9 +51336,9 @@ function renderTerminalReport(data, responseDlpEntries, excludeTests) {
   const toolHeaderRaw = "Top Tools";
   const blockHeaderRaw = "Top Blocks";
   console.log(
-    "  " + chalk13.bold(toolHeaderRaw) + " ".repeat(COL - toolHeaderRaw.length) + "  " + chalk13.bold(blockHeaderRaw)
+    "  " + chalk14.bold(toolHeaderRaw) + " ".repeat(COL - toolHeaderRaw.length) + "  " + chalk14.bold(blockHeaderRaw)
   );
-  console.log("  " + chalk13.dim("\u2500".repeat(COL)) + "  " + chalk13.dim("\u2500".repeat(COL)));
+  console.log("  " + chalk14.dim("\u2500".repeat(COL)) + "  " + chalk14.dim("\u2500".repeat(COL)));
   const rows = Math.max(topTools.length, topBlocks.length, 1);
   for (let i = 0; i < rows; i++) {
     let leftStyled = " ".repeat(COL);
@@ -51230,7 +51349,7 @@ function renderTerminalReport(data, responseDlpEntries, excludeTests) {
       const b = colorBar(calls, maxTool, BAR);
       const rawLen = LABEL + BAR + 1 + TOOL_COUNT_W;
       const pad = Math.max(0, COL - rawLen);
-      leftStyled = chalk13.white(label2.padEnd(LABEL)) + b + " " + chalk13.white(countStr) + " ".repeat(pad);
+      leftStyled = chalk14.white(label2.padEnd(LABEL)) + b + " " + chalk14.white(countStr) + " ".repeat(pad);
     }
     let rightStyled = "";
     if (i < topBlocks.length) {
@@ -51239,33 +51358,33 @@ function renderTerminalReport(data, responseDlpEntries, excludeTests) {
       const label2 = readable.length > LABEL - 1 ? readable.slice(0, LABEL - 2) + "\u2026" : readable;
       const countStr = num2(count).padStart(BLOCK_COUNT_W);
       const b = colorBar(count, maxBlock, BAR);
-      rightStyled = chalk13.white(label2.padEnd(LABEL)) + b + " " + chalk13.red(countStr);
+      rightStyled = chalk14.white(label2.padEnd(LABEL)) + b + " " + chalk14.red(countStr);
     }
     console.log("  " + leftStyled + "  " + rightStyled);
   }
   if (topBlocks.length === 0) {
-    console.log("  " + " ".repeat(COL) + "  " + chalk13.dim("nothing blocked \u2713"));
+    console.log("  " + " ".repeat(COL) + "  " + chalk14.dim("nothing blocked \u2713"));
   }
   if (agentMap.size >= 1) {
     console.log("");
-    console.log("  " + chalk13.bold("Agents"));
-    console.log("  " + chalk13.dim("\u2500".repeat(Math.min(50, W - 4))));
+    console.log("  " + chalk14.bold("Agents"));
+    console.log("  " + chalk14.dim("\u2500".repeat(Math.min(50, W - 4))));
     const maxAgent = Math.max(...agentMap.values(), 1);
     for (const [agent, count] of [...agentMap.entries()].sort((a, b) => b[1] - a[1])) {
       const label2 = agent.slice(0, LABEL - 1);
       const b = colorBar(count, maxAgent, BAR);
-      console.log("  " + chalk13.white(label2.padEnd(LABEL)) + b + " " + chalk13.white(num2(count)));
+      console.log("  " + chalk14.white(label2.padEnd(LABEL)) + b + " " + chalk14.white(num2(count)));
     }
   }
   if (mcpMap.size > 0) {
     console.log("");
-    console.log("  " + chalk13.bold("MCP Servers"));
-    console.log("  " + chalk13.dim("\u2500".repeat(Math.min(50, W - 4))));
+    console.log("  " + chalk14.bold("MCP Servers"));
+    console.log("  " + chalk14.dim("\u2500".repeat(Math.min(50, W - 4))));
     const maxMcp = Math.max(...mcpMap.values(), 1);
     for (const [server, count] of [...mcpMap.entries()].sort((a, b) => b[1] - a[1])) {
       const label2 = server.slice(0, LABEL - 1).padEnd(LABEL);
       const b = colorBar(count, maxMcp, BAR);
-      console.log("  " + chalk13.white(label2) + b + " " + chalk13.white(num2(count)));
+      console.log("  " + chalk14.white(label2) + b + " " + chalk14.white(num2(count)));
     }
   }
   if (hourMap.size > 0) {
@@ -51276,23 +51395,23 @@ function renderTerminalReport(data, responseDlpEntries, excludeTests) {
       return BLOCKS[Math.round(v / maxHour * 8)];
     }).join("");
     console.log("");
-    console.log("  " + chalk13.bold("Hour of Day") + chalk13.dim("  (local, 0h \u2013 23h)"));
-    console.log("  " + chalk13.cyan(bar));
-    console.log("  " + chalk13.dim("0h" + " ".repeat(10) + "12h" + " ".repeat(7) + "23h"));
+    console.log("  " + chalk14.bold("Hour of Day") + chalk14.dim("  (local, 0h \u2013 23h)"));
+    console.log("  " + chalk14.cyan(bar));
+    console.log("  " + chalk14.dim("0h" + " ".repeat(10) + "12h" + " ".repeat(7) + "23h"));
   }
   if (dailyList.length > 1) {
     console.log("");
-    console.log("  " + chalk13.bold("Daily Activity"));
-    console.log("  " + chalk13.dim("\u2500".repeat(W - 2)));
+    console.log("  " + chalk14.bold("Daily Activity"));
+    console.log("  " + chalk14.dim("\u2500".repeat(W - 2)));
     const DAY_BAR = Math.max(8, Math.min(30, W - 36));
     for (const [dateKey, { calls, blocked: db }] of dailyList) {
       const label2 = fmtDate(dateKey).padEnd(10);
       const b = colorBar(calls, maxDaily, DAY_BAR);
       const dayCost = costByDay.get(dateKey);
-      const costNote = dayCost ? chalk13.magenta(`  ${fmtCost2(dayCost)}`) : "";
-      const blockNote = db > 0 ? chalk13.red(`  ${db} blocked`) : "";
+      const costNote = dayCost ? chalk14.magenta(`  ${fmtCost2(dayCost)}`) : "";
+      const blockNote = db > 0 ? chalk14.red(`  ${db} blocked`) : "";
       console.log(
-        "  " + chalk13.dim(label2) + "  " + b + "  " + chalk13.white(num2(calls)) + blockNote + costNote
+        "  " + chalk14.dim(label2) + "  " + b + "  " + chalk14.white(num2(calls)) + blockNote + costNote
       );
     }
   }
@@ -51300,26 +51419,26 @@ function renderTerminalReport(data, responseDlpEntries, excludeTests) {
   if (totalTokens > 0) {
     const cacheHitPct = costInputTokens + costCacheRead > 0 ? Math.round(costCacheRead / (costInputTokens + costCacheRead) * 100) : 0;
     console.log("");
-    console.log("  " + chalk13.bold("Tokens") + "  " + chalk13.dim(`${num2(totalTokens)} total`));
-    console.log("  " + chalk13.dim("\u2500".repeat(Math.min(50, W - 4))));
+    console.log("  " + chalk14.bold("Tokens") + "  " + chalk14.dim(`${num2(totalTokens)} total`));
+    console.log("  " + chalk14.dim("\u2500".repeat(Math.min(50, W - 4))));
     const TOK_BAR = Math.max(6, Math.min(20, W - 30));
     const TOK_LABEL = 14;
     const maxNonCache = Math.max(costInputTokens, costOutputTokens, costCacheWrite, 1);
     const nonCacheRows = [
-      ["Input", costInputTokens, chalk13.cyan(num2(costInputTokens))],
-      ["Output", costOutputTokens, chalk13.white(num2(costOutputTokens))],
-      ["Cache write", costCacheWrite, chalk13.yellow(num2(costCacheWrite))]
+      ["Input", costInputTokens, chalk14.cyan(num2(costInputTokens))],
+      ["Output", costOutputTokens, chalk14.white(num2(costOutputTokens))],
+      ["Cache write", costCacheWrite, chalk14.yellow(num2(costCacheWrite))]
     ];
     for (const [label2, count, colored] of nonCacheRows) {
       if (count === 0) continue;
       const b = colorBar(count, maxNonCache, TOK_BAR);
-      console.log("  " + chalk13.white(label2.padEnd(TOK_LABEL)) + b + "  " + colored);
+      console.log("  " + chalk14.white(label2.padEnd(TOK_LABEL)) + b + "  " + colored);
     }
     if (costCacheRead > 0) {
       const cacheBar = colorBar(costCacheRead, costCacheRead, TOK_BAR);
-      const pct = cacheHitPct > 0 ? chalk13.dim(`  ${cacheHitPct}% hit rate`) : "";
+      const pct = cacheHitPct > 0 ? chalk14.dim(`  ${cacheHitPct}% hit rate`) : "";
       console.log(
-        "  " + chalk13.white("Cache read".padEnd(TOK_LABEL)) + cacheBar + "  " + chalk13.green(num2(costCacheRead)) + pct
+        "  " + chalk14.white("Cache read".padEnd(TOK_LABEL)) + cacheBar + "  " + chalk14.green(num2(costCacheRead)) + pct
       );
     }
   }
@@ -51328,13 +51447,13 @@ function renderTerminalReport(data, responseDlpEntries, excludeTests) {
     const avgPerDay = costUSD / periodDays;
     const cacheHitPct = costInputTokens + costCacheRead > 0 ? Math.round(costCacheRead / (costInputTokens + costCacheRead) * 100) : 0;
     const costHeaderRight = [
-      chalk13.yellow(fmtCost2(costUSD)),
-      chalk13.dim(`avg ${fmtCost2(avgPerDay)}/day`),
-      cacheHitPct > 0 ? chalk13.dim(`${cacheHitPct}% cache hit`) : null
-    ].filter(Boolean).join(chalk13.dim("  \xB7  "));
+      chalk14.yellow(fmtCost2(costUSD)),
+      chalk14.dim(`avg ${fmtCost2(avgPerDay)}/day`),
+      cacheHitPct > 0 ? chalk14.dim(`${cacheHitPct}% cache hit`) : null
+    ].filter(Boolean).join(chalk14.dim("  \xB7  "));
     console.log("");
-    console.log("  " + chalk13.bold("Cost") + "  " + costHeaderRight);
-    console.log("  " + chalk13.dim("\u2500".repeat(Math.min(50, W - 4))));
+    console.log("  " + chalk14.bold("Cost") + "  " + costHeaderRight);
+    console.log("  " + chalk14.dim("\u2500".repeat(Math.min(50, W - 4))));
     if (codexUSD > 0)
       costByModel.set("codex (openai)", (costByModel.get("codex (openai)") ?? 0) + codexUSD);
     if (geminiUSD > 0)
@@ -51347,35 +51466,35 @@ function renderTerminalReport(data, responseDlpEntries, excludeTests) {
       const label2 = model.length > MODEL_LABEL - 1 ? model.slice(0, MODEL_LABEL - 2) + "\u2026" : model;
       const b = colorBar(cost, maxModelCost, MODEL_BAR);
       console.log(
-        "  " + chalk13.white(label2.padEnd(MODEL_LABEL)) + b + "  " + chalk13.yellow(fmtCost2(cost))
+        "  " + chalk14.white(label2.padEnd(MODEL_LABEL)) + b + "  " + chalk14.yellow(fmtCost2(cost))
       );
     }
   }
   if (responseDlpEntries.length > 0) {
     console.log("");
     console.log(
-      "  " + chalk13.red.bold("\u26A0\uFE0F  Response DLP") + chalk13.dim("  \xB7  ") + chalk13.red(
+      "  " + chalk14.red.bold("\u26A0\uFE0F  Response DLP") + chalk14.dim("  \xB7  ") + chalk14.red(
         `${responseDlpEntries.length} secret${responseDlpEntries.length !== 1 ? "s" : ""} found in Claude response text`
       )
     );
-    console.log("  " + chalk13.dim("\u2500".repeat(Math.min(60, W - 4))));
+    console.log("  " + chalk14.dim("\u2500".repeat(Math.min(60, W - 4))));
     console.log(
-      "  " + chalk13.yellow("These were NOT blocked \u2014 Claude included them in response prose.")
+      "  " + chalk14.yellow("These were NOT blocked \u2014 Claude included them in response prose.")
     );
-    console.log("  " + chalk13.yellow("Rotate affected keys immediately."));
+    console.log("  " + chalk14.yellow("Rotate affected keys immediately."));
     for (const e of responseDlpEntries.slice(0, 5)) {
-      const ts = chalk13.dim(fmtDate(e.ts) + "  ");
-      const pattern = chalk13.red(e.dlpPattern ?? "DLP");
-      const sample = chalk13.gray(e.dlpSample ?? "");
+      const ts = chalk14.dim(fmtDate(e.ts) + "  ");
+      const pattern = chalk14.red(e.dlpPattern ?? "DLP");
+      const sample = chalk14.gray(e.dlpSample ?? "");
       console.log(`    ${ts}${pattern}  ${sample}`);
     }
     if (responseDlpEntries.length > 5) {
-      console.log(chalk13.dim(`    \u2026 and ${responseDlpEntries.length - 5} more`));
+      console.log(chalk14.dim(`    \u2026 and ${responseDlpEntries.length - 5} more`));
     }
   }
   console.log("");
   console.log(
-    "  " + chalk13.dim("node9 audit --deny") + chalk13.dim("  \xB7  ") + chalk13.dim("node9 report --period today|7d|30d|month  --no-tests")
+    "  " + chalk14.dim("node9 audit --deny") + chalk14.dim("  \xB7  ") + chalk14.dim("node9 report --period today|7d|30d|month  --no-tests")
   );
   console.log("");
 }
@@ -51384,7 +51503,7 @@ function renderTerminalReport(data, responseDlpEntries, excludeTests) {
 init_daemon();
 init_startup_log();
 init_daemon2();
-import chalk14 from "chalk";
+import chalk15 from "chalk";
 import { spawn as spawn5 } from "child_process";
 import fs57 from "fs";
 var VALID_ACTIONS = "start | stop | restart | status | install | uninstall";
@@ -51398,26 +51517,26 @@ function registerDaemonCommand(program2) {
       if (cmd === "install") {
         const result = installDaemonService();
         if (!result.ok) {
-          console.error(chalk14.red(`\u2717 ${result.reason}`));
+          console.error(chalk15.red(`\u2717 ${result.reason}`));
           process.exit(1);
         }
         if (result.alreadyInstalled) {
-          console.log(chalk14.green(`\u2713 Daemon service reinstalled (${result.platform})`));
+          console.log(chalk15.green(`\u2713 Daemon service reinstalled (${result.platform})`));
         } else {
-          console.log(chalk14.green(`\u2713 Daemon installed as login service (${result.platform})`));
-          console.log(chalk14.gray("  The daemon will now start automatically on login."));
+          console.log(chalk15.green(`\u2713 Daemon installed as login service (${result.platform})`));
+          console.log(chalk15.gray("  The daemon will now start automatically on login."));
         }
         process.exit(0);
       }
       if (cmd === "uninstall") {
         const result = uninstallDaemonService();
         if (!result.ok) {
-          console.error(chalk14.red(`\u2717 ${result.reason}`));
+          console.error(chalk15.red(`\u2717 ${result.reason}`));
           process.exit(1);
         }
-        console.log(chalk14.green(`\u2713 Daemon service removed (${result.platform})`));
-        console.log(chalk14.gray("  The daemon will no longer start automatically on login."));
-        console.log(chalk14.gray("  To stop the running daemon: node9 daemon stop"));
+        console.log(chalk15.green(`\u2713 Daemon service removed (${result.platform})`));
+        console.log(chalk15.gray("  The daemon will no longer start automatically on login."));
+        console.log(chalk15.gray("  To stop the running daemon: node9 daemon stop"));
         process.exit(0);
       }
       if (cmd === "stop") return stopDaemon();
@@ -51446,24 +51565,24 @@ function registerDaemonCommand(program2) {
           }
         }
         if (child.pid) {
-          console.log(chalk14.green(`\u2713 Daemon relaunching (PID ${child.pid})`));
-          console.log(chalk14.gray("   Confirm with: node9 status"));
+          console.log(chalk15.green(`\u2713 Daemon relaunching (PID ${child.pid})`));
+          console.log(chalk15.gray("   Confirm with: node9 status"));
         } else {
-          console.error(chalk14.red("\u2717 Failed to restart daemon \u2014 spawn returned no PID"));
+          console.error(chalk15.red("\u2717 Failed to restart daemon \u2014 spawn returned no PID"));
           process.exit(1);
         }
         process.exit(0);
       }
       if (cmd === "status") return daemonStatus();
       if (cmd !== "start" && action !== void 0) {
-        console.error(chalk14.red(`Unknown daemon action: "${action}". Use: ${VALID_ACTIONS}`));
+        console.error(chalk15.red(`Unknown daemon action: "${action}". Use: ${VALID_ACTIONS}`));
         process.exit(1);
       }
       if (options.watch) {
         process.env.NODE9_WATCH_MODE = "1";
         setTimeout(() => {
           console.log(
-            chalk14.cyan(`\u{1F6F0}\uFE0F  Flight Recorder running. Open another terminal and run:`) + chalk14.bold(" node9 tail")
+            chalk15.cyan(`\u{1F6F0}\uFE0F  Flight Recorder running. Open another terminal and run:`) + chalk15.bold(" node9 tail")
           );
         }, 600);
         startDaemon();
@@ -51485,10 +51604,10 @@ function registerDaemonCommand(program2) {
           );
           child.unref();
           console.log(
-            chalk14.green(`
+            chalk15.green(`
 \u{1F6E1}\uFE0F  Node9 daemon launching in background  (PID ${child.pid})`)
           );
-          console.log(chalk14.gray("   Confirm with: node9 status"));
+          console.log(chalk15.gray("   Confirm with: node9 status"));
         } finally {
           if (startupFd !== void 0) {
             try {
@@ -51511,27 +51630,27 @@ init_build_id();
 init_agent_wiring();
 init_sync();
 init_service();
-import chalk15 from "chalk";
+import chalk16 from "chalk";
 import fs58 from "fs";
 import path55 from "path";
 import os51 from "os";
 function printAgentSection(label2, hookPairs, wrapped) {
-  console.log(chalk15.bold(`  ${label2}`));
+  console.log(chalk16.bold(`  ${label2}`));
   for (const { name, present } of hookPairs) {
     if (present) {
-      console.log(chalk15.green(`    \u2713 ${name}`));
+      console.log(chalk16.green(`    \u2713 ${name}`));
     } else {
-      console.log(chalk15.red(`    \u2717 ${name}`) + chalk15.gray(" (not wired)"));
+      console.log(chalk16.red(`    \u2717 ${name}`) + chalk16.gray(" (not wired)"));
     }
   }
   if (wrapped === null) return;
   if (wrapped.length > 0) {
-    console.log(chalk15.cyan(`    MCP proxied:`));
+    console.log(chalk16.cyan(`    MCP proxied:`));
     for (const entry of wrapped) {
-      console.log(chalk15.gray(`      \u2022 ${entry}`));
+      console.log(chalk16.gray(`      \u2022 ${entry}`));
     }
   } else {
-    console.log(chalk15.gray(`    MCP proxied: none`));
+    console.log(chalk16.gray(`    MCP proxied: none`));
   }
 }
 function registerStatusCommand(program2) {
@@ -51542,29 +51661,29 @@ function registerStatusCommand(program2) {
     const settings = mergedConfig.settings;
     console.log("");
     if (creds && settings.approvers.cloud) {
-      console.log(chalk15.green("  \u25CF Agent mode") + chalk15.gray(" \u2014 cloud team policy enforced"));
+      console.log(chalk16.green("  \u25CF Agent mode") + chalk16.gray(" \u2014 cloud team policy enforced"));
       const health = readSyncHealth();
       if (isPolicyStale(Date.now(), health)) {
         const when = health.lastCheckedAt ? `last synced ${agoLabel(health.lastCheckedAt)}` : "never synced";
         const fails = health.consecutiveFailures > 0 ? ` \xB7 ${health.consecutiveFailures} failed attempt${health.consecutiveFailures === 1 ? "" : "s"}${health.lastError ? ` (${health.lastError})` : ""}` : "";
-        console.log(chalk15.yellow("    \u26A0 Policy sync STALE") + chalk15.gray(` \u2014 ${when}${fails}`));
-        console.log(chalk15.gray("      the cached policy is still enforced \u2014 run: node9 doctor"));
+        console.log(chalk16.yellow("    \u26A0 Policy sync STALE") + chalk16.gray(` \u2014 ${when}${fails}`));
+        console.log(chalk16.gray("      the cached policy is still enforced \u2014 run: node9 doctor"));
       } else if (health.lastCheckedAt) {
-        console.log(chalk15.gray(`    \u21B3 policy synced ${agoLabel(health.lastCheckedAt)}`));
+        console.log(chalk16.gray(`    \u21B3 policy synced ${agoLabel(health.lastCheckedAt)}`));
       }
     } else if (creds && !settings.approvers.cloud) {
       console.log(
-        chalk15.blue("  \u25CF Privacy mode \u{1F6E1}\uFE0F") + chalk15.gray(" \u2014 all decisions stay on this machine")
+        chalk16.blue("  \u25CF Privacy mode \u{1F6E1}\uFE0F") + chalk16.gray(" \u2014 all decisions stay on this machine")
       );
     } else {
       console.log(
-        chalk15.yellow("  \u25CB Privacy mode \u{1F6E1}\uFE0F") + chalk15.gray(" \u2014 no API key (Local rules only)")
+        chalk16.yellow("  \u25CB Privacy mode \u{1F6E1}\uFE0F") + chalk16.gray(" \u2014 no API key (Local rules only)")
       );
     }
     console.log("");
     if (daemonRunning) {
       console.log(
-        chalk15.green("  \u25CF Daemon running") + chalk15.gray(` \u2192 http://127.0.0.1:${DAEMON_PORT}/`)
+        chalk16.green("  \u25CF Daemon running") + chalk16.gray(` \u2192 http://127.0.0.1:${DAEMON_PORT}/`)
       );
       const probe = await probeDaemonHealth();
       const drift = describeBuildDrift(
@@ -51572,10 +51691,10 @@ function registerStatusCommand(program2) {
         CURRENT_BUILD
       );
       if (drift) {
-        console.log(chalk15.yellow(`    \u26A0 ${drift}`) + chalk15.gray(" \u2014 run: node9 doctor"));
+        console.log(chalk16.yellow(`    \u26A0 ${drift}`) + chalk16.gray(" \u2014 run: node9 doctor"));
       }
     } else {
-      console.log(chalk15.gray("  \u25CB Daemon stopped"));
+      console.log(chalk16.gray("  \u25CB Daemon stopped"));
     }
     const autostart = autostartAdvice({
       installed: isDaemonServiceInstalled(),
@@ -51584,39 +51703,39 @@ function registerStatusCommand(program2) {
     });
     if (autostart) {
       console.log(
-        chalk15.yellow("    \u26A0 daemon autostart not active") + chalk15.gray(" \u2014 won't survive reboot; run: node9 doctor")
+        chalk16.yellow("    \u26A0 daemon autostart not active") + chalk16.gray(" \u2014 won't survive reboot; run: node9 doctor")
       );
     }
     if (undoLeftoverPaths().length > 0) {
       console.log(
-        chalk15.gray("  \u25CB Undo Engine") + chalk15.gray("    \u2192 removed \u2014 old snapshot files remain (node9 undo --purge)")
+        chalk16.gray("  \u25CB Undo Engine") + chalk16.gray("    \u2192 removed \u2014 old snapshot files remain (node9 undo --purge)")
       );
     }
     console.log("");
-    const modeLabel = settings.mode === "audit" ? chalk15.blue("audit") : settings.mode === "strict" ? chalk15.red("strict") : chalk15.white("standard");
+    const modeLabel = settings.mode === "audit" ? chalk16.blue("audit") : settings.mode === "strict" ? chalk16.red("strict") : chalk16.white("standard");
     console.log(`  Mode:    ${modeLabel}`);
     const projectConfig = path55.join(process.cwd(), "node9.config.json");
     const globalConfig = path55.join(os51.homedir(), ".node9", "config.json");
     console.log(
-      `  Local:   ${fs58.existsSync(projectConfig) ? chalk15.green("Active (node9.config.json)") : chalk15.gray("Not present")}`
+      `  Local:   ${fs58.existsSync(projectConfig) ? chalk16.green("Active (node9.config.json)") : chalk16.gray("Not present")}`
     );
     console.log(
-      `  Global:  ${fs58.existsSync(globalConfig) ? chalk15.green("Active (~/.node9/config.json)") : chalk15.gray("Not present")}`
+      `  Global:  ${fs58.existsSync(globalConfig) ? chalk16.green("Active (~/.node9/config.json)") : chalk16.gray("Not present")}`
     );
     if (mergedConfig.policy.sandboxPaths.length > 0) {
       console.log(
-        `  Sandbox: ${chalk15.green(`${mergedConfig.policy.sandboxPaths.length} safe zones active`)}`
+        `  Sandbox: ${chalk16.green(`${mergedConfig.policy.sandboxPaths.length} safe zones active`)}`
       );
     }
     const wiring = getAgentWiring(os51.homedir()).filter((a) => a.present);
     if (wiring.length > 0) {
       console.log("");
-      console.log(chalk15.bold("  Agent Wiring:"));
+      console.log(chalk16.bold("  Agent Wiring:"));
       console.log("");
       for (const a of wiring) {
         if (a.wireState === "invalid") {
           console.error(
-            chalk15.yellow(
+            chalk16.yellow(
               `  \u26A0\uFE0F  ${a.label} config at ${a.settingsPath} is not valid ${a.configFormat} \u2014 showing as unwired.`
             )
           );
@@ -51634,7 +51753,7 @@ function registerStatusCommand(program2) {
       const expiresAt = pauseState.expiresAt ? new Date(pauseState.expiresAt).toLocaleTimeString() : "indefinitely";
       console.log("");
       console.log(
-        chalk15.yellow(`  \u23F8  PAUSED until ${expiresAt}`) + chalk15.gray(" \u2014 all tool calls allowed")
+        chalk16.yellow(`  \u23F8  PAUSED until ${expiresAt}`) + chalk16.gray(" \u2014 all tool calls allowed")
       );
     }
     console.log("");
@@ -51647,7 +51766,7 @@ init_setup();
 init_shields();
 init_service();
 init_core();
-import chalk16 from "chalk";
+import chalk17 from "chalk";
 import fs59 from "fs";
 import path56 from "path";
 import os52 from "os";
@@ -51696,11 +51815,11 @@ function registerInitCommand(program2) {
     "Non-interactive: enable bash-safe + filesystem + project-jail shields without prompting"
   ).action(
     async (options) => {
-      console.log(chalk16.cyan.bold("\n\u{1F6E1}\uFE0F  Node9 Init\n"));
+      console.log(chalk17.cyan.bold("\n\u{1F6E1}\uFE0F  Node9 Init\n"));
       {
         const migrated = migrateRenamedRuleKeys();
         for (const m of migrated) {
-          console.log(chalk16.dim(`  \u{1F527} Rule renamed: ${m.oldKey} \u2192 ${m.newKey}`));
+          console.log(chalk17.dim(`  \u{1F527} Rule renamed: ${m.oldKey} \u2192 ${m.newKey}`));
         }
       }
       let chosenMode = options.mode.toLowerCase();
@@ -51712,7 +51831,7 @@ function registerInitCommand(program2) {
         if (options.recommended) {
           enableShields = true;
           console.log(
-            chalk16.dim(
+            chalk17.dim(
               "  Recommended mode: enabling bash-safe + filesystem + project-jail shields"
             )
           );
@@ -51731,7 +51850,7 @@ function registerInitCommand(program2) {
             const hasNewShields = DEFAULT_SHIELDS.some((s) => !current.includes(s));
             if (hasNewShields) writeActiveShields(merged);
           } catch (err2) {
-            console.log(chalk16.yellow(`  \u26A0\uFE0F  Could not update shields: ${String(err2)}`));
+            console.log(chalk17.yellow(`  \u26A0\uFE0F  Could not update shields: ${String(err2)}`));
           }
         }
         console.log("");
@@ -51746,12 +51865,12 @@ function registerInitCommand(program2) {
             settings.mode = chosenMode;
             existing.settings = settings;
             fs59.writeFileSync(configPath, JSON.stringify(existing, null, 2) + "\n");
-            console.log(chalk16.green(`\u2705 Mode updated: ${chosenMode}`));
+            console.log(chalk17.green(`\u2705 Mode updated: ${chosenMode}`));
           } else {
-            console.log(chalk16.blue(`\u2139\uFE0F  Config already exists: ${configPath}`));
+            console.log(chalk17.blue(`\u2139\uFE0F  Config already exists: ${configPath}`));
           }
         } catch {
-          console.log(chalk16.blue(`\u2139\uFE0F  Config already exists: ${configPath}`));
+          console.log(chalk17.blue(`\u2139\uFE0F  Config already exists: ${configPath}`));
         }
       } else {
         const configToSave = {
@@ -51761,8 +51880,8 @@ function registerInitCommand(program2) {
         const dir = path56.dirname(configPath);
         if (!fs59.existsSync(dir)) fs59.mkdirSync(dir, { recursive: true });
         fs59.writeFileSync(configPath, JSON.stringify(configToSave, null, 2) + "\n");
-        console.log(chalk16.green(`\u2705 Config created: ${configPath}`));
-        console.log(chalk16.gray(`   Mode: ${chosenMode}`));
+        console.log(chalk17.green(`\u2705 Config created: ${configPath}`));
+        console.log(chalk17.gray(`   Mode: ${chosenMode}`));
       }
       if (options.skipSetup) return;
       console.log("");
@@ -51772,24 +51891,24 @@ function registerInitCommand(program2) {
       );
       if (found.length === 0) {
         console.log(
-          chalk16.gray(
+          chalk17.gray(
             "No AI agents detected. Install one of the supported agents (Claude Code, Codex, Antigravity, Gemini CLI, GitHub Copilot CLI, Cursor, Windsurf, VSCode, Claude Desktop, Opencode, Pi, or Hermes Agent)."
           )
         );
         console.log(
-          chalk16.gray(
+          chalk17.gray(
             "then run: node9 agents add <claude|codex|antigravity|gemini|copilot|cursor|windsurf|vscode|claudeDesktop|opencode|pi|hermes>"
           )
         );
         return;
       }
-      console.log(chalk16.bold("Detected agents:"));
+      console.log(chalk17.bold("Detected agents:"));
       for (const agent of found) {
-        console.log(chalk16.green(`  \u2713 ${agent}`));
+        console.log(chalk17.green(`  \u2713 ${agent}`));
       }
       console.log("");
       for (const agent of found) {
-        console.log(chalk16.bold(`Wiring ${agent}...`));
+        console.log(chalk17.bold(`Wiring ${agent}...`));
         await setupAgent(agent);
         console.log("");
       }
@@ -51805,31 +51924,31 @@ function registerInitCommand(program2) {
             const result = installDaemonService();
             if (result.ok) {
               console.log(
-                chalk16.green(`  \u2713 Daemon installed as login service (${result.platform})`)
+                chalk17.green(`  \u2713 Daemon installed as login service (${result.platform})`)
               );
             } else {
-              console.log(chalk16.yellow(`  \u26A0\uFE0F  Could not install service: ${result.reason}`));
-              console.log(chalk16.gray("     You can try again later with: node9 daemon install"));
+              console.log(chalk17.yellow(`  \u26A0\uFE0F  Could not install service: ${result.reason}`));
+              console.log(chalk17.gray("     You can try again later with: node9 daemon install"));
             }
           }
         } else if (isDaemonServiceEnabled()) {
-          console.log(chalk16.green("  \u2713 Daemon login service already installed & enabled"));
+          console.log(chalk17.green("  \u2713 Daemon login service already installed & enabled"));
         } else {
           const healed = ensureAutostartHealthy(!!getConfig().settings.autoStartDaemon);
           console.log(
-            healed === "repaired" ? chalk16.green("  \u2713 Re-enabled daemon login service (was installed but disabled)") : chalk16.gray("  \xB7 Daemon login service is disabled (autostart off) \u2014 left as-is")
+            healed === "repaired" ? chalk17.green("  \u2713 Re-enabled daemon login service (was installed but disabled)") : chalk17.gray("  \xB7 Daemon login service is disabled (autostart off) \u2014 left as-is")
           );
         }
         if (!isTestingMode()) {
-          process.stdout.write(chalk16.dim("  Starting daemon..."));
+          process.stdout.write(chalk17.dim("  Starting daemon..."));
           const started = await autoStartDaemonAndWait();
           if (started) {
             process.stdout.write(
-              "\r" + chalk16.green("  \u2713 Daemon started \u2014 protection is active") + "\n"
+              "\r" + chalk17.green("  \u2713 Daemon started \u2014 protection is active") + "\n"
             );
           } else {
             process.stdout.write(
-              "\r" + chalk16.dim("  Daemon will start on next login         ") + "\n"
+              "\r" + chalk17.dim("  Daemon will start on next login         ") + "\n"
             );
           }
         }
@@ -51845,15 +51964,15 @@ function registerInitCommand(program2) {
         console.log("");
       }
       const agentList = found.join(", ");
-      console.log(chalk16.green.bold(`\u{1F6E1}\uFE0F  Node9 is protecting ${agentList}!`));
+      console.log(chalk17.green.bold(`\u{1F6E1}\uFE0F  Node9 is protecting ${agentList}!`));
       console.log("");
-      console.log(chalk16.white("  Watch live:  ") + chalk16.cyan("node9 monitor"));
+      console.log(chalk17.white("  Watch live:  ") + chalk17.cyan("node9 monitor"));
       console.log("");
-      console.log(chalk16.gray("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
+      console.log(chalk17.gray("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
       console.log(
-        chalk16.white("  Team dashboard + full audit trail \u2192 ") + chalk16.cyan.bold("https://node9.ai")
+        chalk17.white("  Team dashboard + full audit trail \u2192 ") + chalk17.cyan.bold("https://node9.ai")
       );
-      console.log(chalk16.gray("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
+      console.log(chalk17.gray("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
     }
   );
 }
@@ -51862,7 +51981,7 @@ function registerInitCommand(program2) {
 init_agent_wiring();
 init_setup();
 init_hook_baseline();
-import chalk17 from "chalk";
+import chalk18 from "chalk";
 import fs60 from "fs";
 var hasHookSurface = (a) => a.hooks.length > 0;
 function backupForHeal(file) {
@@ -51872,7 +51991,7 @@ function backupForHeal(file) {
   }
 }
 async function runHeal(name) {
-  console.log(chalk17.cyan.bold("\n\u{1FA79} Node9 Heal\n"));
+  console.log(chalk18.cyan.bold("\n\u{1FA79} Node9 Heal\n"));
   const baseline = loadHookBaseline();
   const wiring = getAgentWiring();
   let candidates2 = wiring.filter(
@@ -51885,7 +52004,7 @@ async function runHeal(name) {
     );
     if (candidates2.length === 0) {
       console.error(
-        chalk17.red(
+        chalk18.red(
           `Nothing to heal for "${name}" \u2014 it's either healthy, not governed by node9, or not installed.`
         )
       );
@@ -51894,13 +52013,13 @@ async function runHeal(name) {
     }
   }
   if (candidates2.length === 0) {
-    console.log(chalk17.green("  \u2713 All governed agents are healthy \u2014 nothing to heal."));
+    console.log(chalk18.green("  \u2713 All governed agents are healthy \u2014 nothing to heal."));
     const wireable = wiring.filter(
       (a) => !baseline[a.id] && a.installed && hasHookSurface(a) && a.wireState !== "wired"
     );
     if (wireable.length > 0) {
       console.log(
-        chalk17.gray(`  To govern ${wireable.map((a) => a.label).join(", ")}, run: `) + chalk17.bold("node9 init")
+        chalk18.gray(`  To govern ${wireable.map((a) => a.label).join(", ")}, run: `) + chalk18.bold("node9 init")
       );
     }
     return { healed: [] };
@@ -51916,15 +52035,15 @@ async function runHeal(name) {
       if (notified.delete(a.id)) notifiedChanged = true;
     } catch (err2) {
       const msg = err2 instanceof Error ? err2.message : String(err2);
-      console.error(chalk17.red(`  \u2717 failed to heal ${a.label}: ${msg}`));
+      console.error(chalk18.red(`  \u2717 failed to heal ${a.label}: ${msg}`));
       process.exitCode = 1;
     }
   }
   if (notifiedChanged) saveNotified(notified);
   if (healed.length > 0) {
-    console.log(chalk17.bold(`
+    console.log(chalk18.bold(`
 \u2713 Re-installed node9 hooks for ${healed.join(", ")}.`));
-    console.log(chalk17.gray(`  Restart ${healed.join(", ")} to activate the restored protection.`));
+    console.log(chalk18.gray(`  Restart ${healed.join(", ")} to activate the restored protection.`));
   }
   return { healed };
 }
@@ -51940,9 +52059,7 @@ function registerHealCommand(program2) {
 import http4 from "http";
 import https7 from "https";
 import { URL as URL4 } from "url";
-import chalk18 from "chalk";
-init_setup();
-init_sync();
+import chalk19 from "chalk";
 var DEFAULT_CONNECT_URL = "https://api.node9.ai/api/v1/cli/connect";
 function resolveConnectUrl(apiUrl) {
   if (apiUrl) return apiUrl;
@@ -52005,84 +52122,66 @@ function registerConnectCommand(program2) {
     try {
       resp = await postConnect(resolveConnectUrl(options.apiUrl), token);
     } catch (e) {
-      console.error(chalk18.red(`\u2717 ${e instanceof Error ? e.message : "Connect failed."}`));
+      console.error(chalk19.red(`\u2717 ${e instanceof Error ? e.message : "Connect failed."}`));
       process.exitCode = 1;
       return;
     }
-    writeCredentialsAndConfig(resp.apiKey, { profileName: options.profile });
-    process.env.NODE9_NONINTERACTIVE = "1";
-    let wired = [];
-    try {
-      wired = await setupDetectedAgents();
-    } catch {
-    }
-    if (!isTestingMode()) {
-      try {
-        await runCloudSync();
-      } catch {
-      }
-    }
-    console.log(chalk18.green(`\u2705 Connected to ${resp.workspaceName}`));
-    if (wired.length) {
-      console.log(chalk18.gray(`   Wired: ${wired.join(", ")}`));
-    } else {
-      console.log(
-        chalk18.gray("   No agents detected yet \u2014 run `node9 init` after installing one.")
-      );
-    }
+    const outcome = await onboardMachine(resp.apiKey, { profileName: options.profile });
+    console.log(renderOnboardOutcome(outcome, { workspaceName: resp.workspaceName }));
+    if (!outcome.ok) process.exitCode = 1;
   });
 }
 
 // src/cli/commands/undo.ts
-import chalk19 from "chalk";
+import chalk20 from "chalk";
 import { confirm as confirm2 } from "@inquirer/prompts";
 function removalNotice() {
-  return chalk19.yellow("\n\u2139\uFE0F  The undo feature has been removed.\n") + chalk19.gray(
+  return chalk20.yellow("\n\u2139\uFE0F  The undo feature has been removed.\n") + chalk20.gray(
     "    Its snapshot store had no size ceiling \u2014 it grew by roughly 19 MB per\n    minute of agent work and took one machine to 378 GB. Snapshots are no\n    longer taken, and no setting turns them back on.\n"
   );
 }
 function leftoverNotice(paths) {
   if (paths.length === 0) return "";
-  return chalk19.gray("\n    Files the feature left behind are still on disk:\n") + paths.map((p) => chalk19.gray(`      ${p}
-`)).join("") + chalk19.gray("\n    node9 does not delete them for you. To remove them:\n") + chalk19.cyan("      node9 undo --purge\n");
+  return chalk20.gray("\n    Files the feature left behind are still on disk:\n") + paths.map((p) => chalk20.gray(`      ${p}
+`)).join("") + chalk20.gray("\n    node9 does not delete them for you. To remove them:\n") + chalk20.cyan("      node9 undo --purge\n");
 }
 async function runPurge(assumeYes) {
   const paths = undoLeftoverPaths();
   if (paths.length === 0) {
-    console.log(chalk19.green("\n\u2705 Nothing to remove \u2014 the undo store is already gone.\n"));
+    console.log(chalk20.green("\n\u2705 Nothing to remove \u2014 the undo store is already gone.\n"));
     return;
   }
-  console.log(chalk19.yellow("\n\u26A0\uFE0F  This will permanently delete:\n"));
-  for (const p of paths) console.log(chalk19.gray(`      ${p}`));
+  console.log(chalk20.yellow("\n\u26A0\uFE0F  This will permanently delete:\n"));
+  for (const p of paths) console.log(chalk20.gray(`      ${p}`));
   console.log(
-    chalk19.gray(
+    chalk20.gray(
       "\n    These hold snapshots of your own source code. Nothing else in\n    ~/.node9 is touched (config, audit log and credentials stay).\n"
     )
   );
   if (!assumeYes) {
     if (!process.stdin.isTTY) {
       console.error(
-        chalk19.red("\n  Refusing to delete without confirmation.") + chalk19.gray("\n  No terminal is attached \u2014 re-run with --yes to confirm.\n")
+        chalk20.red("\n  Refusing to delete without confirmation.") + chalk20.gray("\n  No terminal is attached \u2014 re-run with --yes to confirm.\n")
       );
       process.exitCode = 1;
       return;
     }
     const ok2 = await confirm2({ message: "Delete these files?", default: false });
     if (!ok2) {
-      console.log(chalk19.gray("\n  Skipped \u2014 nothing was deleted.\n"));
+      console.log(chalk20.gray("\n  Skipped \u2014 nothing was deleted.\n"));
       return;
     }
   }
   const result = purgeUndoLeftovers();
-  for (const p of result.deleted) console.log(chalk19.green(`  \u2705 removed ${p}`));
+  for (const p of result.deleted) console.log(chalk20.green(`  \u2705 removed ${p}`));
   for (const s of result.skipped)
-    console.log(chalk19.yellow(`  \u26A0\uFE0F  skipped ${s.path} \u2014 ${s.reason}`));
-  for (const f of result.failed) console.error(chalk19.red(`  \u274C ${f.path} \u2014 ${f.reason}`));
+    console.log(chalk20.yellow(`  \u26A0\uFE0F  skipped ${s.path} \u2014 ${s.reason}`));
+  for (const f of result.failed) console.error(chalk20.red(`  \u274C ${f.path} \u2014 ${f.reason}`));
   if (result.skipped.length > 0 || result.failed.length > 0) {
-    console.error(chalk19.red("\n  Some files remain \u2014 see above.\n"));
+    console.error(chalk20.red("\n  Some files remain \u2014 see above.\n"));
     process.exitCode = 1;
   } else {
-    console.log(chalk19.green("\n  Done.\n"));
+    console.log(chalk20.green("\n  Done.\n"));
   }
 }
 function registerUndoCommand(program2) {
@@ -52101,7 +52200,7 @@ init_orchestrator();
 init_cloud();
 init_config();
 import readline3 from "readline";
-import chalk20 from "chalk";
+import chalk21 from "chalk";
 import { spawn as spawn6 } from "child_process";
 import { execa as execa2 } from "execa";
 init_provenance();
@@ -52206,13 +52305,13 @@ async function runMcpGateway(upstreamCommand, configName) {
   const prov = checkProvenance(executable);
   if (prov.trustLevel === "suspect") {
     console.error(
-      chalk20.red(
+      chalk21.red(
         `\u26A0\uFE0F  Node9: Upstream MCP server binary is suspect \u2014 ${prov.reason} (${prov.resolvedPath})`
       )
     );
-    console.error(chalk20.red("   Verify this binary is trusted before proceeding."));
+    console.error(chalk21.red("   Verify this binary is trusted before proceeding."));
   }
-  console.error(chalk20.green(`\u{1F680} Node9 MCP Gateway: Monitoring [${upstreamCommand}]`));
+  console.error(chalk21.green(`\u{1F680} Node9 MCP Gateway: Monitoring [${upstreamCommand}]`));
   const UPSTREAM_INJECTOR_VARS = /* @__PURE__ */ new Set([
     "NODE_OPTIONS",
     "NODE_PATH",
@@ -52328,10 +52427,10 @@ async function runMcpGateway(upstreamCommand, configName) {
           serverKey
         });
         if (!result.approved) {
-          console.error(chalk20.red(`
+          console.error(chalk21.red(`
 \u{1F6D1} Node9 MCP Gateway: Action Blocked`));
-          console.error(chalk20.gray(`   Tool: ${toolName}`));
-          console.error(chalk20.gray(`   Reason: ${result.reason ?? "Security Policy"}
+          console.error(chalk21.gray(`   Tool: ${toolName}`));
+          console.error(chalk21.gray(`   Reason: ${result.reason ?? "Security Policy"}
 `));
           const blockedByLabel = result.blockedByLabel ?? result.reason ?? "Security Policy";
           const isHumanDecision = blockedByLabel.toLowerCase().includes("user") || blockedByLabel.toLowerCase().includes("daemon") || blockedByLabel.toLowerCase().includes("decision");
@@ -52456,7 +52555,7 @@ async function runMcpGateway(upstreamCommand, configName) {
           updatePin(serverKey, upstreamCommand, currentHash, toolNames);
           pinState = "validated";
           console.error(
-            chalk20.green(
+            chalk21.green(
               `\u{1F512} Node9: Pinned ${toolNames.length} tool definition(s) for this MCP server`
             )
           );
@@ -52469,11 +52568,11 @@ async function runMcpGateway(upstreamCommand, configName) {
         } else if (pinStatus === "corrupt") {
           pinState = "quarantined";
           console.error(
-            chalk20.red("\n\u{1F6A8} Node9: MCP pin file is corrupt or unreadable \u2014 session quarantined!")
+            chalk21.red("\n\u{1F6A8} Node9: MCP pin file is corrupt or unreadable \u2014 session quarantined!")
           );
-          console.error(chalk20.red("   Tool calls are blocked until the pin file is repaired."));
+          console.error(chalk21.red("   Tool calls are blocked until the pin file is repaired."));
           console.error(
-            chalk20.yellow(`   Run: node9 mcp pin reset  (to clear and re-pin on next connect)
+            chalk21.yellow(`   Run: node9 mcp pin reset  (to clear and re-pin on next connect)
 `)
           );
           const errorResponse = {
@@ -52490,13 +52589,13 @@ async function runMcpGateway(upstreamCommand, configName) {
         } else {
           pinState = "quarantined";
           console.error(
-            chalk20.red("\n\u{1F6A8} Node9: MCP tool definitions have changed since last verified!")
+            chalk21.red("\n\u{1F6A8} Node9: MCP tool definitions have changed since last verified!")
           );
           console.error(
-            chalk20.red("   This could indicate a supply chain attack (tool poisoning / rug pull).")
+            chalk21.red("   This could indicate a supply chain attack (tool poisoning / rug pull).")
           );
-          console.error(chalk20.red("   Session quarantined \u2014 all tool calls blocked."));
-          console.error(chalk20.yellow(`   Run: node9 mcp pin update ${serverKey}
+          console.error(chalk21.red("   Session quarantined \u2014 all tool calls blocked."));
+          console.error(chalk21.yellow(`   Run: node9 mcp pin update ${serverKey}
 `));
           reportPinMismatchToCloud(
             serverKey,
@@ -52544,7 +52643,7 @@ async function runMcpGateway(upstreamCommand, configName) {
       const toolName = callId !== void 0 ? pendingCallNames.get(callId) ?? "unknown" : "unknown";
       if (callId !== void 0) pendingCallNames.delete(callId);
       console.error(
-        chalk20.yellow(
+        chalk21.yellow(
           `\u26A1 Node9: Large MCP response from '${toolName}' (${(line.length / 1024).toFixed(0)}KB) \u2014 context window enlarged`
         )
       );
@@ -53397,7 +53496,7 @@ function registerMcpServerCommand(program2) {
 
 // src/cli/commands/trust.ts
 init_trusted_hosts();
-import chalk21 from "chalk";
+import chalk22 from "chalk";
 function isValidHost(host) {
   return /^(\*\.)?[a-z0-9][a-z0-9.-]*\.[a-z]{2,}$/.test(host);
 }
@@ -53407,44 +53506,44 @@ function registerTrustCommand(program2) {
     const normalized = normalizeHost(host.trim());
     if (!isValidHost(normalized)) {
       console.error(
-        chalk21.red(`
+        chalk22.red(`
 \u274C Invalid host: "${host}"
-`) + chalk21.gray("   Use an FQDN like api.mycompany.com or *.mycompany.com\n")
+`) + chalk22.gray("   Use an FQDN like api.mycompany.com or *.mycompany.com\n")
       );
       process.exit(1);
     }
     addTrustedHost(normalized);
-    console.log(chalk21.green(`
+    console.log(chalk22.green(`
 \u2705 ${normalized} added to trusted hosts.`));
     console.log(
-      chalk21.gray("   Pipe-chain blocks to this host: critical \u2192 review, high \u2192 allow\n")
+      chalk22.gray("   Pipe-chain blocks to this host: critical \u2192 review, high \u2192 allow\n")
     );
   });
   trustCmd.command("remove <host>").description("Remove a trusted host").action((host) => {
     const normalized = normalizeHost(host.trim());
     const removed = removeTrustedHost(normalized);
     if (!removed) {
-      console.error(chalk21.yellow(`
+      console.error(chalk22.yellow(`
 \u26A0\uFE0F  "${normalized}" is not in the trusted hosts list.
 `));
       process.exit(1);
     }
-    console.log(chalk21.green(`
+    console.log(chalk22.green(`
 \u2705 ${normalized} removed from trusted hosts.
 `));
   });
   trustCmd.command("list").description("Show all trusted hosts").action(() => {
     const hosts = readTrustedHosts();
     if (hosts.length === 0) {
-      console.log(chalk21.gray("\n  No trusted hosts configured.\n"));
-      console.log(`  Add one: ${chalk21.cyan("node9 trust add api.mycompany.com")}
+      console.log(chalk22.gray("\n  No trusted hosts configured.\n"));
+      console.log(`  Add one: ${chalk22.cyan("node9 trust add api.mycompany.com")}
 `);
       return;
     }
-    console.log(chalk21.bold("\n\u{1F513} Trusted Hosts\n"));
+    console.log(chalk22.bold("\n\u{1F513} Trusted Hosts\n"));
     for (const entry of hosts) {
       const date = new Date(entry.addedAt).toLocaleDateString();
-      console.log(`  ${chalk21.cyan(entry.host.padEnd(40))} ${chalk21.gray(`added ${date}`)}`);
+      console.log(`  ${chalk22.cyan(entry.host.padEnd(40))} ${chalk22.gray(`added ${date}`)}`);
     }
     console.log("");
   });
@@ -53452,13 +53551,13 @@ function registerTrustCommand(program2) {
 
 // src/cli/commands/mcp-pin.ts
 init_mcp_pin();
-import chalk23 from "chalk";
+import chalk24 from "chalk";
 import fs63 from "fs";
 
 // src/cli/commands/mcp-gateway-cmd.ts
 init_mcp_wrap();
 init_mcp_status();
-import chalk22 from "chalk";
+import chalk23 from "chalk";
 var STATE_WORD = {
   gatewayed: "governed",
   "node9-self": "node9",
@@ -53467,10 +53566,10 @@ var STATE_WORD = {
 };
 function stateChip(state) {
   const w = STATE_WORD[state].padEnd(12);
-  if (state === "gatewayed") return chalk22.green(w);
-  if (state === "node9-self") return chalk22.gray(w);
-  if (state === "remote") return chalk22.gray(w);
-  return chalk22.yellow(w);
+  if (state === "gatewayed") return chalk23.green(w);
+  if (state === "node9-self") return chalk23.gray(w);
+  if (state === "remote") return chalk23.gray(w);
+  return chalk23.yellow(w);
 }
 function relativeAge(ms, now) {
   const s = Math.max(0, Math.round((now - ms) / 1e3));
@@ -53484,15 +53583,15 @@ function relativeAge(ms, now) {
 function connectionChip(e, now) {
   switch (e.connection) {
     case "connected":
-      return chalk22.green(
+      return chalk23.green(
         `\u2713 connected${e.lastSeenAt ? ` (${relativeAge(e.lastSeenAt, now)})` : ""}`
       );
     case "stale":
-      return chalk22.yellow(`\u26A0 stale${e.lastSeenAt ? ` (${relativeAge(e.lastSeenAt, now)})` : ""}`);
+      return chalk23.yellow(`\u26A0 stale${e.lastSeenAt ? ` (${relativeAge(e.lastSeenAt, now)})` : ""}`);
     case "pending-launch":
-      return chalk22.cyan(`\u2026 pending \u2014 restart ${e.agentLabel} to connect`);
+      return chalk23.cyan(`\u2026 pending \u2014 restart ${e.agentLabel} to connect`);
     case "unlaunchable":
-      return chalk22.red(
+      return chalk23.red(
         `\u2717 can't launch \u2014 ${(e.missingEnv ?? []).map((v) => `$${v}`).join(", ")} not set`
       );
     default:
@@ -53517,7 +53616,7 @@ function registerMcpGatewayCommand2(mcp) {
     const now = Date.now();
     const rows = resolveMcpStatus(void 0, process.env, now);
     if (rows.length === 0) {
-      console.error(chalk22.gray("No MCP servers found in any agent config."));
+      console.error(chalk23.gray("No MCP servers found in any agent config."));
       return;
     }
     for (const e of rows) {
@@ -53531,20 +53630,20 @@ function registerMcpGatewayCommand2(mcp) {
     const pending2 = rows.filter((e) => e.connection === "pending-launch").length;
     if (ungoverned > 0) {
       console.error(
-        chalk22.yellow(
+        chalk23.yellow(
           `
-${ungoverned} ungoverned \u2014 run ` + chalk22.bold("node9 mcp gateway --all") + " to govern."
+${ungoverned} ungoverned \u2014 run ` + chalk23.bold("node9 mcp gateway --all") + " to govern."
         )
       );
     }
     if (pending2 > 0) {
       console.error(
-        chalk22.cyan(`${pending2} governed but not yet connected \u2014 restart the agent to activate.`)
+        chalk23.cyan(`${pending2} governed but not yet connected \u2014 restart the agent to activate.`)
       );
     }
     if (unlaunchable > 0) {
       console.error(
-        chalk22.red(
+        chalk23.red(
           `${unlaunchable} can't launch \u2014 set the missing env var(s) where the agent starts (a restart alone won't fix it).`
         )
       );
@@ -53563,27 +53662,27 @@ ${ungoverned} ungoverned \u2014 run ` + chalk22.bold("node9 mcp gateway --all")
       } else if (name) {
         const matches = resolve(name, opts.agent);
         if (matches.length === 0) {
-          console.error(chalk22.red(`No MCP server named "${name}" found.`));
+          console.error(chalk23.red(`No MCP server named "${name}" found.`));
           process.exitCode = 1;
           return;
         }
         if (matches.length > 1) {
           console.error(
-            chalk22.red(`"${name}" exists in ${matches.length} agents \u2014 pass --agent <id> (`) + matches.map((m) => m.agent).join(", ") + ")."
+            chalk23.red(`"${name}" exists in ${matches.length} agents \u2014 pass --agent <id> (`) + matches.map((m) => m.agent).join(", ") + ")."
           );
           process.exitCode = 1;
           return;
         }
         targets = matches;
       } else {
-        console.error(chalk22.red("Pass a server name or --all. See `node9 mcp status`."));
+        console.error(chalk23.red("Pass a server name or --all. See `node9 mcp status`."));
         process.exitCode = 1;
         return;
       }
       const doable = targets.filter((e) => e.state === targetState);
       if (doable.length === 0) {
         console.error(
-          chalk22.gray(
+          chalk23.gray(
             opts.rewrap ? "Nothing to do \u2014 no governed servers to refresh." : "Nothing to do \u2014 already governed (or node9-self)."
           )
         );
@@ -53597,20 +53696,20 @@ ${ungoverned} ungoverned \u2014 run ` + chalk22.bold("node9 mcp gateway --all")
           else wrapEntry(e);
           agents.add(e.agentLabel);
           const verb = opts.rewrap ? "refreshed" : "governed";
-          console.error(chalk22.green(`\u2713 ${verb} ${e.name}`) + chalk22.gray(` (${e.agentLabel})`));
+          console.error(chalk23.green(`\u2713 ${verb} ${e.name}`) + chalk23.gray(` (${e.agentLabel})`));
         } catch (err2) {
           failed++;
           const msg = err2 instanceof Error ? err2.message : String(err2);
           console.error(
-            chalk22.red(`\u2717 failed ${e.name}`) + chalk22.gray(` (${e.agentLabel}): ${msg}`)
+            chalk23.red(`\u2717 failed ${e.name}`) + chalk23.gray(` (${e.agentLabel}): ${msg}`)
           );
         }
       }
       if (failed > 0) process.exitCode = 1;
       if (agents.size > 0) {
         console.error(
-          chalk22.bold(`
-Restart ${[...agents].join(", ")}`) + chalk22.gray(" to activate. Undo any server with ") + chalk22.cyan("node9 mcp ungateway <name>") + chalk22.gray(".")
+          chalk23.bold(`
+Restart ${[...agents].join(", ")}`) + chalk23.gray(" to activate. Undo any server with ") + chalk23.cyan("node9 mcp ungateway <name>") + chalk23.gray(".")
         );
       }
     }
@@ -53618,19 +53717,19 @@ Restart ${[...agents].join(", ")}`) + chalk22.gray(" to activate. Undo any serve
   mcp.command("ungateway <name>").description("Restore an MCP server to its original (un-route it from node9)").option("--agent <id>", "disambiguate a name in more than one agent").action((name, opts) => {
     const matches = resolve(name, opts.agent).filter((e2) => e2.state === "gatewayed");
     if (matches.length === 0) {
-      console.error(chalk22.red(`No governed MCP server named "${name}" found.`));
+      console.error(chalk23.red(`No governed MCP server named "${name}" found.`));
       process.exitCode = 1;
       return;
     }
     if (matches.length > 1) {
-      console.error(chalk22.red(`"${name}" is governed in multiple agents \u2014 pass --agent <id>.`));
+      console.error(chalk23.red(`"${name}" is governed in multiple agents \u2014 pass --agent <id>.`));
       process.exitCode = 1;
       return;
     }
     const e = matches[0];
     const orig = fromGateway(e.raw);
     if (!orig) {
-      console.error(chalk22.red(`Couldn't parse the original command for "${name}".`));
+      console.error(chalk23.red(`Couldn't parse the original command for "${name}".`));
       process.exitCode = 1;
       return;
     }
@@ -53638,12 +53737,12 @@ Restart ${[...agents].join(", ")}`) + chalk22.gray(" to activate. Undo any serve
       writeMcpEntry(e.mcpFile, e.format, e.name, orig);
     } catch (err2) {
       const msg = err2 instanceof Error ? err2.message : String(err2);
-      console.error(chalk22.red(`Failed to restore "${name}": ${msg}`));
+      console.error(chalk23.red(`Failed to restore "${name}": ${msg}`));
       process.exitCode = 1;
       return;
     }
     console.error(
-      chalk22.green(`\u2713 restored ${e.name}`) + chalk22.gray(` (${e.agentLabel}) \u2014 restart ${e.agentLabel} to apply.`)
+      chalk23.green(`\u2713 restored ${e.name}`) + chalk23.gray(` (${e.agentLabel}) \u2014 restart ${e.agentLabel} to apply.`)
     );
   });
 }
@@ -53669,14 +53768,14 @@ function registerMcpPinCommand(program2) {
       }
     }
     if (repoCorrupt) {
-      console.error(chalk23.red(`
+      console.error(chalk24.red(`
 \u274C Repo pin file at ${found.path} is corrupt or unreadable.`));
       process.exit(1);
     }
     if (!homeResult.ok && homeResult.reason === "corrupt") {
-      console.error(chalk23.red(`
+      console.error(chalk24.red(`
 \u274C Home pin file is corrupt: ${homeResult.detail}`));
-      console.error(chalk23.yellow("   Run: node9 mcp pin reset\n"));
+      console.error(chalk24.yellow("   Run: node9 mcp pin reset\n"));
       process.exit(1);
     }
     const homeEntries = homeResult.ok ? homeResult.pins.servers : {};
@@ -53688,25 +53787,25 @@ function registerMcpPinCommand(program2) {
       merged.set(key, { entry, source: "repo" });
     }
     if (merged.size === 0) {
-      console.log(chalk23.gray("\nNo MCP servers are pinned yet."));
+      console.log(chalk24.gray("\nNo MCP servers are pinned yet."));
       console.log(
-        chalk23.gray("Pins are created automatically when the MCP gateway first connects.\n")
+        chalk24.gray("Pins are created automatically when the MCP gateway first connects.\n")
       );
       return;
     }
-    console.log(chalk23.bold("\n\u{1F512} Pinned MCP Servers\n"));
+    console.log(chalk24.bold("\n\u{1F512} Pinned MCP Servers\n"));
     const showSource = found.source === "repo";
     for (const [key, { entry, source }] of merged) {
-      const tag = showSource ? ` ${chalk23.yellow(`[${source}]`)}` : "";
-      console.log(`  ${chalk23.cyan(key)}${tag}  ${chalk23.gray(entry.label)}`);
-      console.log(`    Tools (${entry.toolCount}): ${chalk23.white(entry.toolNames.join(", "))}`);
-      console.log(`    Hash:  ${chalk23.gray(entry.toolsHash.slice(0, 16))}...`);
-      console.log(`    Pinned: ${chalk23.gray(entry.pinnedAt)}`);
+      const tag = showSource ? ` ${chalk24.yellow(`[${source}]`)}` : "";
+      console.log(`  ${chalk24.cyan(key)}${tag}  ${chalk24.gray(entry.label)}`);
+      console.log(`    Tools (${entry.toolCount}): ${chalk24.white(entry.toolNames.join(", "))}`);
+      console.log(`    Hash:  ${chalk24.gray(entry.toolsHash.slice(0, 16))}...`);
+      console.log(`    Pinned: ${chalk24.gray(entry.pinnedAt)}`);
       console.log("");
     }
     if (showSource) {
-      console.log(chalk23.gray(`   [repo] entries come from ${found.path}`));
-      console.log(chalk23.gray("   [home] entries come from ~/.node9/mcp-pins.json\n"));
+      console.log(chalk24.gray(`   [repo] entries come from ${found.path}`));
+      console.log(chalk24.gray("   [home] entries come from ~/.node9/mcp-pins.json\n"));
     }
   });
   pinSubCmd.command("promote <serverKey>").description(
@@ -53716,22 +53815,22 @@ function registerMcpPinCommand(program2) {
       const { repoPath, created } = promotePin(serverKey, process.cwd());
       if (created) {
         console.log(
-          chalk23.green(
+          chalk24.green(
             `
-\u2705 Created ${repoPath} with the promoted pin for ${chalk23.cyan(serverKey)}.`
+\u2705 Created ${repoPath} with the promoted pin for ${chalk24.cyan(serverKey)}.`
           )
         );
       } else {
-        console.log(chalk23.green(`
-\u2705 Promoted ${chalk23.cyan(serverKey)} into ${repoPath}.`));
+        console.log(chalk24.green(`
+\u2705 Promoted ${chalk24.cyan(serverKey)} into ${repoPath}.`));
       }
-      console.log(chalk23.gray("   Review the change and commit it:"));
-      console.log(chalk23.cyan(`     git add ${repoPath}`));
-      console.log(chalk23.cyan(`     git commit -m "pin ${serverKey} (node9)"`));
+      console.log(chalk24.gray("   Review the change and commit it:"));
+      console.log(chalk24.cyan(`     git add ${repoPath}`));
+      console.log(chalk24.cyan(`     git commit -m "pin ${serverKey} (node9)"`));
       console.log("");
     } catch (err2) {
       const msg = err2 instanceof Error ? err2.message : String(err2);
-      console.error(chalk23.red(`
+      console.error(chalk24.red(`
 \u274C ${msg}
 `));
       process.exit(1);
@@ -53744,36 +53843,36 @@ function registerMcpPinCommand(program2) {
     try {
       pins = readMcpPins();
     } catch {
-      console.error(chalk23.red("\n\u274C Pin file is corrupt."));
-      console.error(chalk23.yellow("   Run: node9 mcp pin reset\n"));
+      console.error(chalk24.red("\n\u274C Pin file is corrupt."));
+      console.error(chalk24.yellow("   Run: node9 mcp pin reset\n"));
       process.exit(1);
     }
     if (!pins.servers[serverKey]) {
-      console.error(chalk23.red(`
+      console.error(chalk24.red(`
 \u274C No pin found for server key "${serverKey}"
 `));
-      console.error(`Run ${chalk23.cyan("node9 mcp pin list")} to see pinned servers.
+      console.error(`Run ${chalk24.cyan("node9 mcp pin list")} to see pinned servers.
 `);
       process.exit(1);
     }
     const label2 = pins.servers[serverKey].label;
     removePin(serverKey);
-    console.log(chalk23.green(`
-\u{1F513} Pin removed for ${chalk23.cyan(serverKey)}`));
-    console.log(chalk23.gray(`   Server: ${label2}`));
-    console.log(chalk23.gray("   Next connection will re-pin with current tool definitions.\n"));
+    console.log(chalk24.green(`
+\u{1F513} Pin removed for ${chalk24.cyan(serverKey)}`));
+    console.log(chalk24.gray(`   Server: ${label2}`));
+    console.log(chalk24.gray("   Next connection will re-pin with current tool definitions.\n"));
   });
   pinSubCmd.command("reset").description("Clear all MCP pins (next connection to each server will re-pin)").action(() => {
     const result = readMcpPinsSafe();
     if (!result.ok && result.reason === "missing") {
-      console.log(chalk23.gray("\nNo pins to clear.\n"));
+      console.log(chalk24.gray("\nNo pins to clear.\n"));
       return;
     }
     const count = result.ok ? Object.keys(result.pins.servers).length : "?";
     clearAllPins();
-    console.log(chalk23.green(`
+    console.log(chalk24.green(`
 \u{1F513} Cleared ${count} MCP pin(s).`));
-    console.log(chalk23.gray("   Next connection to each server will re-pin.\n"));
+    console.log(chalk24.gray("   Next connection to each server will re-pin.\n"));
   });
   pinCmd.command("forget [serverKey]").option("--stale", "Remove all stale (orphaned) servers at once").description("Remove a server pin that is no longer configured in any agent").action((serverKey, opts) => {
     if (opts.stale) {
@@ -53782,7 +53881,7 @@ function registerMcpPinCommand(program2) {
     }
     if (!serverKey) {
       console.error(
-        chalk23.red("\n\u274C Please provide a server key, or use --stale to remove all orphans.\n")
+        chalk24.red("\n\u274C Please provide a server key, or use --stale to remove all orphans.\n")
       );
       process.exit(1);
     }
@@ -53790,15 +53889,15 @@ function registerMcpPinCommand(program2) {
     try {
       pins = readMcpPins();
     } catch {
-      console.error(chalk23.red("\n\u274C Pin file is corrupt."));
-      console.error(chalk23.yellow("   Run: node9 mcp pin reset\n"));
+      console.error(chalk24.red("\n\u274C Pin file is corrupt."));
+      console.error(chalk24.yellow("   Run: node9 mcp pin reset\n"));
       process.exit(1);
     }
     if (!pins.servers[serverKey]) {
-      console.error(chalk23.red(`
+      console.error(chalk24.red(`
 \u274C No pin found for server key "${serverKey}"
 `));
-      console.error(`Run ${chalk23.cyan("node9 mcp pin list")} to see pinned servers.
+      console.error(`Run ${chalk24.cyan("node9 mcp pin list")} to see pinned servers.
 `);
       process.exit(1);
     }
@@ -53806,10 +53905,10 @@ function registerMcpPinCommand(program2) {
     const liveKeys = inventoryServerKeys(inv);
     if (liveKeys.has(serverKey)) {
       const agent = "an agent config";
-      console.error(chalk23.red(`
+      console.error(chalk24.red(`
 \u274C Server "${serverKey}" is still configured in ${agent}.`));
       console.error(
-        chalk23.yellow(
+        chalk24.yellow(
           `   Remove it from the agent config first, then run: node9 mcp forget ${serverKey}
 `
         )
@@ -53818,10 +53917,10 @@ function registerMcpPinCommand(program2) {
     }
     const label2 = pins.servers[serverKey].label;
     removePin(serverKey);
-    console.log(chalk23.green(`
-\u2713 Forgot server ${chalk23.cyan(serverKey)}`));
-    console.log(chalk23.gray(`   Was: ${label2}`));
-    console.log(chalk23.gray("   Pin removed \u2014 server will no longer appear in the dashboard.\n"));
+    console.log(chalk24.green(`
+\u2713 Forgot server ${chalk24.cyan(serverKey)}`));
+    console.log(chalk24.gray(`   Was: ${label2}`));
+    console.log(chalk24.gray("   Pin removed \u2014 server will no longer appear in the dashboard.\n"));
   });
 }
 function forgetAllStale() {
@@ -53829,16 +53928,16 @@ function forgetAllStale() {
   try {
     pins = readMcpPins();
   } catch {
-    console.error(chalk23.red("\n\u274C Pin file is corrupt."));
-    console.error(chalk23.yellow("   Run: node9 mcp pin reset\n"));
+    console.error(chalk24.red("\n\u274C Pin file is corrupt."));
+    console.error(chalk24.yellow("   Run: node9 mcp pin reset\n"));
     process.exit(1);
   }
   const inv = inventoryMcp();
   const liveKeys = inventoryServerKeys(inv);
   if (liveKeys.size === 0) {
-    console.error(chalk23.red("\n\u274C No live MCP servers detected \u2014 refusing to remove every pin."));
+    console.error(chalk24.red("\n\u274C No live MCP servers detected \u2014 refusing to remove every pin."));
     console.error(
-      chalk23.yellow(
+      chalk24.yellow(
         "   This usually means an agent config is missing or unreadable, not that\n   every server is gone. Check your agent configs, or remove one at a\n   time: node9 mcp forget <key>\n"
       )
     );
@@ -53846,118 +53945,118 @@ function forgetAllStale() {
   }
   const stale = Object.entries(pins.servers).filter(([sk]) => !liveKeys.has(sk));
   if (stale.length === 0) {
-    console.log(chalk23.gray("\nNo stale servers to remove.\n"));
+    console.log(chalk24.gray("\nNo stale servers to remove.\n"));
     return;
   }
   for (const [sk, pin] of stale) {
     delete pins.servers[sk];
-    console.log(chalk23.green(`  \u2713 ${chalk23.cyan(sk)}  ${chalk23.gray(pin.label)}`));
+    console.log(chalk24.green(`  \u2713 ${chalk24.cyan(sk)}  ${chalk24.gray(pin.label)}`));
   }
   writeMcpPins(pins);
-  console.log(chalk23.green(`
+  console.log(chalk24.green(`
 Removed ${stale.length} stale server(s).
 `));
 }
 
 // src/cli/commands/sync.ts
 init_sync();
-import chalk24 from "chalk";
+import chalk25 from "chalk";
 function registerSyncCommand(program2) {
   const policy = program2.command("policy").description("Manage cloud policy rules");
   policy.command("push").description("Push this machine's effective policy to the node9 dashboard").action(async () => {
-    process.stdout.write(chalk24.cyan("Pushing policy to the dashboard\u2026"));
+    process.stdout.write(chalk25.cyan("Pushing policy to the dashboard\u2026"));
     const result = await runPolicyPush();
     process.stdout.write("\n");
     if (!result.ok) {
-      console.error(chalk24.red(`\u2717 ${result.reason}`));
+      console.error(chalk25.red(`\u2717 ${result.reason}`));
       process.exit(1);
     }
-    console.log(chalk24.green("\u2713 Policy mirrored to the dashboard"));
-    console.log(chalk24.gray("  See it under Security Policy \u2192 Machines"));
+    console.log(chalk25.green("\u2713 Policy mirrored to the dashboard"));
+    console.log(chalk25.gray("  See it under Security Policy \u2192 Machines"));
   });
   policy.command("sync").description("Sync cloud policy rules to local cache (~/.node9/rules-cache.json)").action(async () => {
-    process.stdout.write(chalk24.cyan("Syncing cloud policy rules\u2026"));
+    process.stdout.write(chalk25.cyan("Syncing cloud policy rules\u2026"));
     const result = await runCloudSync();
     process.stdout.write("\n");
     if (!result.ok) {
-      console.error(chalk24.red(`\u2717 ${result.reason}`));
+      console.error(chalk25.red(`\u2717 ${result.reason}`));
       process.exit(1);
     }
     if (result.unchanged) {
       console.log(
-        chalk24.green(
+        chalk25.green(
           `\u2713 Already up to date \u2014 ${result.rules} rule${result.rules === 1 ? "" : "s"} cached`
         )
       );
-      console.log(chalk24.gray(`  Cached at: ${result.fetchedAt}`));
-      console.log(chalk24.gray(`  Server returned 304 (no changes since last sync)`));
+      console.log(chalk25.gray(`  Cached at: ${result.fetchedAt}`));
+      console.log(chalk25.gray(`  Server returned 304 (no changes since last sync)`));
     } else {
       console.log(
-        chalk24.green(`\u2713 Synced ${result.rules} rule${result.rules === 1 ? "" : "s"} from cloud`)
+        chalk25.green(`\u2713 Synced ${result.rules} rule${result.rules === 1 ? "" : "s"} from cloud`)
       );
-      console.log(chalk24.gray(`  Cached at: ${result.fetchedAt}`));
-      console.log(chalk24.gray(`  File: ~/.node9/rules-cache.json`));
+      console.log(chalk25.gray(`  Cached at: ${result.fetchedAt}`));
+      console.log(chalk25.gray(`  File: ~/.node9/rules-cache.json`));
     }
   });
   policy.command("show").description("List all cloud policy rules in the local cache").action(() => {
     const status = getCloudSyncStatus();
     if (!status.cached) {
-      console.log(chalk24.yellow("\n  No cloud rules cached \u2014 run: node9 policy sync\n"));
+      console.log(chalk25.yellow("\n  No cloud rules cached \u2014 run: node9 policy sync\n"));
       return;
     }
     const rules = getCloudRules() ?? [];
     const age = Math.round((Date.now() - new Date(status.fetchedAt).getTime()) / 6e4);
     console.log(
-      chalk24.bold(`
-  Cloud policy rules`) + chalk24.gray(
+      chalk25.bold(`
+  Cloud policy rules`) + chalk25.gray(
         ` (${rules.length} rule${rules.length === 1 ? "" : "s"}, synced ${age}m ago)
 `
       )
     );
     if (rules.length === 0) {
-      console.log(chalk24.gray("  No rules defined in cloud policy.\n"));
+      console.log(chalk25.gray("  No rules defined in cloud policy.\n"));
       return;
     }
     for (const rule of rules) {
       const r = rule;
-      const verdictColor = r.verdict === "block" ? chalk24.red : r.verdict === "allow" ? chalk24.green : chalk24.yellow;
+      const verdictColor = r.verdict === "block" ? chalk25.red : r.verdict === "allow" ? chalk25.green : chalk25.yellow;
       console.log(
         `  ${verdictColor(
           String(r.verdict ?? "unknown").toUpperCase().padEnd(6)
-        )}  ${chalk24.white(String(r.name ?? "(unnamed)"))}`
+        )}  ${chalk25.white(String(r.name ?? "(unnamed)"))}`
       );
-      if (r.reason) console.log(chalk24.gray(`           ${String(r.reason)}`));
+      if (r.reason) console.log(chalk25.gray(`           ${String(r.reason)}`));
     }
     console.log("");
   });
   policy.command("status").description("Show current cloud policy cache status").action(() => {
     const s = getCloudSyncStatus();
     if (!s.cached) {
-      console.log(chalk24.yellow("\n  No cache yet \u2014 run: node9 policy sync\n"));
+      console.log(chalk25.yellow("\n  No cache yet \u2014 run: node9 policy sync\n"));
       return;
     }
     const age = Math.round((Date.now() - new Date(s.fetchedAt).getTime()) / 6e4);
     console.log(`
-  Rules   : ${chalk24.green(String(s.rules))} cloud rules loaded`);
+  Rules   : ${chalk25.green(String(s.rules))} cloud rules loaded`);
     console.log(
-      `  Synced  : ${chalk24.gray(`${age} minute${age === 1 ? "" : "s"} ago`)} (${s.fetchedAt})`
+      `  Synced  : ${chalk25.gray(`${age} minute${age === 1 ? "" : "s"} ago`)} (${s.fetchedAt})`
     );
     if (s.workspaceId) {
-      console.log(`  Workspace: ${chalk24.gray(s.workspaceId)}`);
+      console.log(`  Workspace: ${chalk25.gray(s.workspaceId)}`);
     }
     if (s.panicMode) {
       console.log(
-        `  ${chalk24.red.bold("\u{1F6A8} Panic mode  : ON")}  ` + chalk24.dim("(every review-verdict becomes block)")
+        `  ${chalk25.red.bold("\u{1F6A8} Panic mode  : ON")}  ` + chalk25.dim("(every review-verdict becomes block)")
       );
     }
     if (s.shadowMode) {
       console.log(
-        `  ${chalk24.yellow.bold("\u{1F441}  Shadow mode : ON")}  ` + chalk24.dim("(blocks become would-block log entries)")
+        `  ${chalk25.yellow.bold("\u{1F441}  Shadow mode : ON")}  ` + chalk25.dim("(blocks become would-block log entries)")
       );
     }
     if (s.syncIntervalHours) {
       console.log(
-        chalk24.gray(
+        chalk25.gray(
           `  Polling : every ${s.syncIntervalHours} hour${s.syncIntervalHours === 1 ? "" : "s"}`
         )
       );
@@ -53968,7 +54067,7 @@ function registerSyncCommand(program2) {
 
 // src/cli/commands/agents.ts
 init_setup();
-import chalk25 from "chalk";
+import chalk26 from "chalk";
 var SETUP_FN = {
   claude: setupClaude,
   gemini: setupGemini,
@@ -54011,30 +54110,30 @@ function registerAgentsCommand(program2) {
     console.log(`  ${"Agent".padEnd(14)}${"Installed".padEnd(11)}${"Wired".padEnd(8)}Mode`);
     console.log("  " + "\u2500".repeat(44));
     for (const s of statuses) {
-      const installed = s.installed ? chalk25.green("\u2713") : chalk25.gray("\u2717");
-      const wired = !s.installed ? chalk25.gray("\u2014") : s.wired ? chalk25.green("\u2713") : chalk25.yellow("\u2717");
-      const mode = s.mode ? chalk25.gray(s.mode) : chalk25.gray("\u2014");
-      const hint = s.installed && !s.wired ? chalk25.gray(`  \u2190 node9 agents add ${s.name}`) : "";
+      const installed = s.installed ? chalk26.green("\u2713") : chalk26.gray("\u2717");
+      const wired = !s.installed ? chalk26.gray("\u2014") : s.wired ? chalk26.green("\u2713") : chalk26.yellow("\u2717");
+      const mode = s.mode ? chalk26.gray(s.mode) : chalk26.gray("\u2014");
+      const hint = s.installed && !s.wired ? chalk26.gray(`  \u2190 node9 agents add ${s.name}`) : "";
       console.log(`  ${s.label.padEnd(14)}${installed}          ${wired}       ${mode}${hint}`);
     }
     console.log("");
     if (!anyInstalled) {
       console.log(
-        chalk25.gray("  No AI agents detected. Install Claude Code, Gemini CLI, Cursor,\n") + chalk25.gray("  Windsurf, VSCode, or Codex then run: node9 agents list\n")
+        chalk26.gray("  No AI agents detected. Install Claude Code, Gemini CLI, Cursor,\n") + chalk26.gray("  Windsurf, VSCode, or Codex then run: node9 agents list\n")
       );
       return;
     }
     const unwired = statuses.filter((s) => s.installed && !s.wired);
     if (unwired.length > 0) {
       console.log(
-        chalk25.yellow(`  ${unwired.length} agent(s) not yet wired. Run: `) + chalk25.white(`node9 agents add ${unwired[0].name}`) + "\n"
+        chalk26.yellow(`  ${unwired.length} agent(s) not yet wired. Run: `) + chalk26.white(`node9 agents add ${unwired[0].name}`) + "\n"
       );
     }
     if (statuses.some((s) => s.name === "gemini" && s.installed)) {
       console.log(
-        chalk25.yellow(
+        chalk26.yellow(
           "  \u26A0\uFE0F  Gemini CLI stops serving AI Pro/Ultra and free tiers on 2026-06-18.\n"
-        ) + chalk25.gray("     Migrate to Antigravity: ") + chalk25.white("node9 agents add antigravity") + "\n"
+        ) + chalk26.gray("     Migrate to Antigravity: ") + chalk26.white("node9 agents add antigravity") + "\n"
       );
     }
   });
@@ -54042,7 +54141,7 @@ function registerAgentsCommand(program2) {
     const name = resolveAgentName(agent);
     const fn = SETUP_FN[name];
     if (!fn) {
-      console.error(chalk25.red(`Unknown agent: "${agent}". Supported: ${AGENT_NAMES.join(", ")}`));
+      console.error(chalk26.red(`Unknown agent: "${agent}". Supported: ${AGENT_NAMES.join(", ")}`));
       process.exit(1);
     }
     await fn();
@@ -54051,14 +54150,14 @@ function registerAgentsCommand(program2) {
     const name = resolveAgentName(agent);
     const fn = TEARDOWN_FN[name];
     if (!fn) {
-      console.error(chalk25.red(`Unknown agent: "${agent}". Supported: ${AGENT_NAMES.join(", ")}`));
+      console.error(chalk26.red(`Unknown agent: "${agent}". Supported: ${AGENT_NAMES.join(", ")}`));
       process.exit(1);
     }
-    console.log(chalk25.cyan(`
+    console.log(chalk26.cyan(`
 \u{1F6E1}\uFE0F  Node9: removing from ${name}...
 `));
     fn();
-    console.log(chalk25.gray("\n  Restart the agent for changes to take effect."));
+    console.log(chalk26.gray("\n  Restart the agent for changes to take effect."));
   });
 }
 
@@ -54067,21 +54166,21 @@ init_scan();
 
 // src/cli/commands/posture.ts
 init_posture();
-import chalk27 from "chalk";
+import chalk28 from "chalk";
 
 // src/posture/render.ts
 init_score();
-import chalk26 from "chalk";
+import chalk27 from "chalk";
 var ICON = {
-  critical: chalk26.red("\u274C"),
-  high: chalk26.red("\u274C"),
-  medium: chalk26.yellow("\u26A0\uFE0F "),
-  advisory: chalk26.gray("\u26A0\uFE0F ")
+  critical: chalk27.red("\u274C"),
+  high: chalk27.red("\u274C"),
+  medium: chalk27.yellow("\u26A0\uFE0F "),
+  advisory: chalk27.gray("\u26A0\uFE0F ")
 };
 var TIER_LABEL = {
-  good: chalk26.green("Good"),
-  "at-risk": chalk26.yellow("At risk"),
-  critical: chalk26.red("Critical")
+  good: chalk27.green("Good"),
+  "at-risk": chalk27.yellow("At risk"),
+  critical: chalk27.red("Critical")
 };
 function wrap(text, width) {
   const out = [];
@@ -54099,7 +54198,7 @@ function wrap(text, width) {
 }
 var LABEL_WIDTH = 14;
 function label(category) {
-  return chalk26.bold(category.padEnd(Math.max(LABEL_WIDTH, category.length + 1)));
+  return chalk27.bold(category.padEnd(Math.max(LABEL_WIDTH, category.length + 1)));
 }
 function guardedWhat(f) {
   if (f.detail.length === 0) return "this";
@@ -54109,31 +54208,31 @@ function guardedWhat(f) {
 }
 function renderFinding(f, showWeight = false, displayLabel = f.category) {
   const lines = [];
-  const wt = showWeight && f.scoreWeight ? chalk26.cyan.bold(`+${f.scoreWeight} `) : "";
+  const wt = showWeight && f.scoreWeight ? chalk27.cyan.bold(`+${f.scoreWeight} `) : "";
   lines.push(`  ${ICON[f.severity]} ${label(displayLabel)}${wt}${f.title}`);
   const indent = " ".repeat(2 + 3 + LABEL_WIDTH);
   const width = 80 - indent.length;
   for (const s of [f.what, f.why, f.who]) {
-    if (s) for (const l of wrap(s, width)) lines.push(indent + chalk26.gray(l));
+    if (s) for (const l of wrap(s, width)) lines.push(indent + chalk27.gray(l));
   }
-  for (const d of f.detail) lines.push(indent + chalk26.gray(d));
+  for (const d of f.detail) lines.push(indent + chalk27.gray(d));
   if (f.fix) {
     let first = true;
     for (const seg of f.fix.split("\n")) {
       for (const l of wrap(seg, width - 2)) {
-        lines.push(indent + chalk26.cyan(first ? "\u2192 " + l : "  " + l));
+        lines.push(indent + chalk27.cyan(first ? "\u2192 " + l : "  " + l));
         first = false;
       }
     }
   }
   const tradeoff = [
-    [f.gain, "gain: ", chalk26.green],
-    [f.cost, "cost: ", chalk26.yellow]
+    [f.gain, "gain: ", chalk27.green],
+    [f.cost, "cost: ", chalk27.yellow]
   ];
   for (const [text, lbl, color2] of tradeoff) {
     if (!text) continue;
     wrap(text, width - 6).forEach((l, i) => {
-      lines.push(indent + (i === 0 ? color2(lbl) : "      ") + chalk26.gray(l));
+      lines.push(indent + (i === 0 ? color2(lbl) : "      ") + chalk27.gray(l));
     });
   }
   return lines;
@@ -54143,7 +54242,7 @@ function renderPosture(result) {
   const tier = TIER_LABEL[result.tier];
   lines.push("");
   lines.push(
-    chalk26.cyan.bold(`\u{1F6E1}\uFE0F  Node9 Posture`) + chalk26.gray(` \u2014 ${result.agent}`) + `        ${chalk26.bold(`Score: ${result.score}/100`)}  (${tier})`
+    chalk27.cyan.bold(`\u{1F6E1}\uFE0F  Node9 Posture`) + chalk27.gray(` \u2014 ${result.agent}`) + `        ${chalk27.bold(`Score: ${result.score}/100`)}  (${tier})`
   );
   const headroom = openHeadroom(result.findings);
   if (headroom > 0) {
@@ -54151,15 +54250,15 @@ function renderPosture(result) {
       (f) => f.coverage?.state !== "covered" && f.coverage?.state !== "cant-fix" && !f.scoreWeight && f.severity !== "advisory"
     ).length;
     const note = openExposures > 0 ? `Of the gap to 100: ${headroom} pts is optional hardening you can choose to turn on (the \u{1F512} tier below, each at some cost to flexibility); the rest is the open findings \u2014 the flagged rows below. Fix those first.` : `${headroom} pts of headroom \u2014 optional hardening you can choose to turn on (the \u{1F512} tier below), each at some cost to flexibility.`;
-    for (const l of wrap(note, 76)) lines.push("  " + chalk26.gray(l));
+    for (const l of wrap(note, 76)) lines.push("  " + chalk27.gray(l));
   }
   lines.push("");
   if (result.headline) {
     const indent = "     ";
-    lines.push(`  ${chalk26.red.bold("\u{1F525} Biggest risk")}`);
-    for (const l of wrap(result.headline.risk, 74)) lines.push(indent + chalk26.white(l));
+    lines.push(`  ${chalk27.red.bold("\u{1F525} Biggest risk")}`);
+    for (const l of wrap(result.headline.risk, 74)) lines.push(indent + chalk27.white(l));
     const action = wrap(`Do this first: ${result.headline.action}`, 72);
-    action.forEach((l, i) => lines.push(indent + chalk26.cyan(i === 0 ? "\u2192 " + l : "  " + l)));
+    action.forEach((l, i) => lines.push(indent + chalk27.cyan(i === 0 ? "\u2192 " + l : "  " + l)));
     lines.push("");
   }
   const covered = result.findings.filter((f) => f.coverage?.state === "covered");
@@ -54169,13 +54268,13 @@ function renderPosture(result) {
   );
   const openLabel = (f) => collision.has(f.category) ? `${f.category} (exposed)` : f.category;
   if (covered.length > 0) {
-    lines.push("  " + chalk26.green("\u{1F7E2} ON NOW \u2014 node9 is enforcing these (your floor)"));
+    lines.push("  " + chalk27.green("\u{1F7E2} ON NOW \u2014 node9 is enforcing these (your floor)"));
     for (const f of covered) {
       const gated = f.coverage?.level === "review" ? "approval-gating" : "blocking";
       const via = f.coverage?.via ?? "node9";
       const lbl = collision.has(f.category) ? `${f.category} (guarded)` : f.category;
       lines.push(
-        `  ${chalk26.green("\u2705")} ${label(lbl)}${chalk26.gray(`${via} is ${gated} ${guardedWhat(f)}`)}`
+        `  ${chalk27.green("\u2705")} ${label(lbl)}${chalk27.gray(`${via} is ${gated} ${guardedWhat(f)}`)}`
       );
     }
     lines.push("");
@@ -54184,24 +54283,24 @@ function renderPosture(result) {
   const reduceOpen = open.filter((f) => f.owner !== "node9" && f.node9Reduces);
   const osOpen = open.filter((f) => f.owner !== "node9" && !f.node9Reduces);
   if (node9Open.length > 0) {
-    lines.push("  " + chalk26.cyan.bold("\u{1F527} node9 can fix these \u2014 run the command"));
+    lines.push("  " + chalk27.cyan.bold("\u{1F527} node9 can fix these \u2014 run the command"));
     for (const f of node9Open) lines.push(...renderFinding(f, true, openLabel(f)));
   }
   if (reduceOpen.length > 0) {
     if (node9Open.length > 0) lines.push("");
-    lines.push("  " + chalk26.yellow.bold("\u{1F512} AVAILABLE \u2014 turn on to harden (each has a tradeoff)"));
+    lines.push("  " + chalk27.yellow.bold("\u{1F512} AVAILABLE \u2014 turn on to harden (each has a tradeoff)"));
     for (const f of reduceOpen) lines.push(...renderFinding(f, true, openLabel(f)));
   }
   if (osOpen.length > 0) {
     if (node9Open.length > 0 || reduceOpen.length > 0) lines.push("");
-    lines.push("  " + chalk26.bold("\u{1F9F1} YOUR PART \u2014 node9 can't fix these (OS-level)"));
+    lines.push("  " + chalk27.bold("\u{1F9F1} YOUR PART \u2014 node9 can't fix these (OS-level)"));
     for (const f of osOpen) lines.push(...renderFinding(f, false, openLabel(f)));
   }
   for (const cat of result.passedCategories) {
-    lines.push(`  ${chalk26.green("\u2705")} ${label(cat)}${chalk26.gray("no issues found")}`);
+    lines.push(`  ${chalk27.green("\u2705")} ${label(cat)}${chalk27.gray("no issues found")}`);
   }
   for (const cat of result.erroredCategories) {
-    lines.push(`  ${chalk26.gray("\u2022")}  ${label(cat)}${chalk26.gray("could not be checked")}`);
+    lines.push(`  ${chalk27.gray("\u2022")}  ${label(cat)}${chalk27.gray("could not be checked")}`);
   }
   lines.push("");
   const crit = open.filter((f) => f.severity === "critical").length;
@@ -54209,16 +54308,16 @@ function renderPosture(result) {
   const med = open.filter((f) => f.severity === "medium").length;
   const adv = open.filter((f) => f.severity === "advisory").length;
   const parts = [];
-  if (crit) parts.push(chalk26.red(`${crit} critical`));
-  if (high) parts.push(chalk26.red(`${high} high`));
-  if (med) parts.push(chalk26.yellow(`${med} medium`));
-  if (adv) parts.push(chalk26.gray(`${adv} advisory`));
-  const summary = parts.length ? parts.join(" \xB7 ") : chalk26.green("no findings");
+  if (crit) parts.push(chalk27.red(`${crit} critical`));
+  if (high) parts.push(chalk27.red(`${high} high`));
+  if (med) parts.push(chalk27.yellow(`${med} medium`));
+  if (adv) parts.push(chalk27.gray(`${adv} advisory`));
+  const summary = parts.length ? parts.join(" \xB7 ") : chalk27.green("no findings");
   lines.push(`  ${summary}`);
   lines.push("");
-  lines.push("  " + chalk26.bold("Track this across your fleet & keep it green:"));
+  lines.push("  " + chalk27.bold("Track this across your fleet & keep it green:"));
   lines.push(
-    "  " + chalk26.dim("\u2192 ") + chalk26.cyan.underline("https://node9.ai/auth/signup?ref=cli_posture")
+    "  " + chalk27.dim("\u2192 ") + chalk27.cyan.underline("https://node9.ai/auth/signup?ref=cli_posture")
   );
   lines.push("");
   return lines.join("\n");
@@ -54238,11 +54337,11 @@ function registerPostureCommand(program2) {
     if (opts.ship) {
       const creds = readCredentials();
       if (!creds) {
-        console.error(chalk27.gray("  Run `node9 login` to ship this to your dashboard."));
+        console.error(chalk28.gray("  Run `node9 login` to ship this to your dashboard."));
       } else {
         const ok2 = await shipPosture(result, creds);
         console.error(
-          ok2 ? chalk27.gray("  \u2713 Shipped to your node9 dashboard.") : chalk27.gray("  Could not reach the dashboard \u2014 saved locally only.")
+          ok2 ? chalk28.gray("  \u2713 Shipped to your node9 dashboard.") : chalk28.gray("  Could not reach the dashboard \u2014 saved locally only.")
         );
       }
     }
@@ -54251,7 +54350,7 @@ function registerPostureCommand(program2) {
 }
 
 // src/cli/commands/scan-repo.ts
-import chalk29 from "chalk";
+import chalk30 from "chalk";
 
 // src/ci-check/fetch.ts
 var import_undici = __toESM(require_undici());
@@ -55394,7 +55493,7 @@ async function scanRepo(input, onProgress) {
 }
 
 // src/ci-check/render.ts
-import chalk28 from "chalk";
+import chalk29 from "chalk";
 var ICON2 = {
   critical: "\u{1F534}",
   high: "\u{1F534}",
@@ -55402,39 +55501,39 @@ var ICON2 = {
   advisory: "\u{1F7E2}"
 };
 var COLOR = {
-  critical: chalk28.red.bold,
-  high: chalk28.red,
-  medium: chalk28.yellow,
-  advisory: chalk28.gray
+  critical: chalk29.red.bold,
+  high: chalk29.red,
+  medium: chalk29.yellow,
+  advisory: chalk29.gray
 };
 var ACTION_URL = "https://github.com/marketplace/actions/node9-agent-security-check?ref=cli_scan_repo";
 function renderCta(res) {
   const L = [];
-  L.push(chalk28.dim("   " + "\u2500".repeat(63)));
+  L.push(chalk29.dim("   " + "\u2500".repeat(63)));
   if (res.worst === "critical" || res.worst === "high") {
     const n = res.findings.filter((f) => f.severity === "critical" || f.severity === "high").length;
     L.push(
-      "   " + chalk28.red.bold(
+      "   " + chalk29.red.bold(
         `\u{1F534} ${n} ${n === 1 ? "issue" : "issues"} to fix \u2014 then stop the next at the PR.`
       )
     );
     L.push("");
-    L.push("   " + chalk28.bold("Catch this class of issue on every PR, automatically:"));
+    L.push("   " + chalk29.bold("Catch this class of issue on every PR, automatically:"));
   } else if (res.worst) {
-    L.push("   " + chalk28.yellow("\u{1F7E1} Review the findings above, then keep it covered:"));
+    L.push("   " + chalk29.yellow("\u{1F7E1} Review the findings above, then keep it covered:"));
     L.push("");
-    L.push("   " + chalk28.bold("Check every PR for agent-CI risk:"));
+    L.push("   " + chalk29.bold("Check every PR for agent-CI risk:"));
   } else if (res.incomplete) {
-    L.push("   " + chalk28.yellow.bold("\u26A0\uFE0F  Incomplete \u2014 not a clean bill of health."));
+    L.push("   " + chalk29.yellow.bold("\u26A0\uFE0F  Incomplete \u2014 not a clean bill of health."));
     L.push("");
-    L.push("   " + chalk28.bold("Get a complete check on every PR (CI reads the tree directly):"));
+    L.push("   " + chalk29.bold("Get a complete check on every PR (CI reads the tree directly):"));
   } else {
-    L.push("   " + chalk28.green("\u2705 Agent CI is well-configured \u2014 0 unmitigated issues."));
+    L.push("   " + chalk29.green("\u2705 Agent CI is well-configured \u2014 0 unmitigated issues."));
     L.push("");
-    L.push("   " + chalk28.bold("Keep it green as you add agent workflows \u2014 check every PR:"));
+    L.push("   " + chalk29.bold("Keep it green as you add agent workflows \u2014 check every PR:"));
   }
-  L.push("   " + chalk28.dim("\u2192 ") + chalk28.cyan.underline(ACTION_URL));
-  L.push("   " + chalk28.gray("  zero setup \xB7 no token \xB7 runs in your CI"));
+  L.push("   " + chalk29.dim("\u2192 ") + chalk29.cyan.underline(ACTION_URL));
+  L.push("   " + chalk29.gray("  zero setup \xB7 no token \xB7 runs in your CI"));
   return L;
 }
 function ownedHint(source) {
@@ -55443,13 +55542,13 @@ function ownedHint(source) {
 function renderScan(res) {
   const L = [];
   const n = res.findings.length;
-  const head = res.worst === "critical" || res.worst === "high" ? chalk28.red.bold("\u26A0\uFE0F  agent-security risk found") : res.worst ? chalk28.yellow("agent-security notes") : res.incomplete ? chalk28.yellow.bold("\u26A0\uFE0F  INCOMPLETE \u2014 could not read all files") : chalk28.green("\u2705 agent-security: clean");
-  L.push(`\u{1F6E1}\uFE0F  ${chalk28.bold("node9 scan-repo")}  \xB7  ${res.source}  \xB7  ${head}`);
-  L.push(chalk28.gray(`   inspected ${res.inspected.length} config file(s), ${n} finding(s)`));
+  const head = res.worst === "critical" || res.worst === "high" ? chalk29.red.bold("\u26A0\uFE0F  agent-security risk found") : res.worst ? chalk29.yellow("agent-security notes") : res.incomplete ? chalk29.yellow.bold("\u26A0\uFE0F  INCOMPLETE \u2014 could not read all files") : chalk29.green("\u2705 agent-security: clean");
+  L.push(`\u{1F6E1}\uFE0F  ${chalk29.bold("node9 scan-repo")}  \xB7  ${res.source}  \xB7  ${head}`);
+  L.push(chalk29.gray(`   inspected ${res.inspected.length} config file(s), ${n} finding(s)`));
   if (res.incomplete) {
     const rateLimited = res.notes.some((nt) => /rate limit/i.test(nt));
     L.push(
-      chalk28.yellow.bold(
+      chalk29.yellow.bold(
         rateLimited ? "   \u26A0\uFE0F  Rate-limited \u2014 some files were unread. NOT a clean bill of health; set GITHUB_TOKEN (or run `gh auth login`) and re-run." : "   \u26A0\uFE0F  A network error left some files unread. NOT a clean bill of health; re-run."
       )
     );
@@ -55457,26 +55556,26 @@ function renderScan(res) {
   L.push("");
   for (const f of res.findings) {
     L.push(
-      `${ICON2[f.severity]} ${COLOR[f.severity](f.severity.toUpperCase())}  ${chalk28.bold(f.title)}`
+      `${ICON2[f.severity]} ${COLOR[f.severity](f.severity.toUpperCase())}  ${chalk29.bold(f.title)}`
     );
-    L.push(chalk28.gray(`   ${f.file}${f.line ? ":" + f.line : ""}  \xB7  ${f.check}`));
+    L.push(chalk29.gray(`   ${f.file}${f.line ? ":" + f.line : ""}  \xB7  ${f.check}`));
     for (const s of f.signals) L.push(`     \u2022 ${s}`);
-    if (f.mitigations?.length) L.push(chalk28.gray(`     \u2713 mitigated: ${f.mitigations.join("; ")}`));
-    L.push(chalk28.cyan(`     \u2192 ${f.fix}`));
+    if (f.mitigations?.length) L.push(chalk29.gray(`     \u2713 mitigated: ${f.mitigations.join("; ")}`));
+    L.push(chalk29.cyan(`     \u2192 ${f.fix}`));
     L.push("");
   }
   if (n === 0 && !res.incomplete) {
     L.push(
-      chalk28.gray("   No committed agent hooks, injectable workflows, or unpinned MCP servers.")
+      chalk29.gray("   No committed agent hooks, injectable workflows, or unpinned MCP servers.")
     );
     L.push("");
   }
-  for (const note of res.notes) L.push(chalk28.gray(`   note: ${note}`));
+  for (const note of res.notes) L.push(chalk29.gray(`   note: ${note}`));
   const hasHigh = res.findings.some((f) => f.severity === "critical" || f.severity === "high");
   if (hasHigh && !ownedHint(res.source)) {
     L.push("");
     L.push(
-      chalk28.yellow(
+      chalk29.yellow(
         "   \u26A0\uFE0F  This looks like a live issue on a repo you may not own. Disclose it privately\n       to the maintainers \u2014 do not publish it. (node9 never weaponizes findings.)"
       )
     );
@@ -55525,7 +55624,7 @@ function makeProgress(target, quiet) {
   let frame = 0;
   let last = `scanning ${target}\u2026`;
   const timer = setInterval(() => {
-    process.stderr.write(`\r${chalk29.cyan(SPIN[frame++ % SPIN.length])} ${last}   `);
+    process.stderr.write(`\r${chalk30.cyan(SPIN[frame++ % SPIN.length])} ${last}   `);
   }, 80);
   return {
     onProgress: (p) => {
@@ -55560,13 +55659,13 @@ function registerScanRepoCommand(program2) {
 // src/cli/commands/egress.ts
 init_config();
 init_dist();
-import chalk30 from "chalk";
+import chalk31 from "chalk";
 function guard(fn) {
   try {
     fn();
     return true;
   } catch (err2) {
-    console.error(chalk30.red(`
+    console.error(chalk31.red(`
   \u2717 ${err2.message}
 `));
     process.exitCode = 1;
@@ -55581,19 +55680,19 @@ function addHost(list, host) {
 }
 function showStatus() {
   const e = getConfig().policy.egress;
-  const state = !e.enabled ? chalk30.red("OFF \u2014 your agent can reach any host") : e.mode === "block" ? chalk30.green("LOCKED (block) \u2014 unknown hosts are denied") : chalk30.yellow("WATCHING (review) \u2014 unknown hosts prompt you");
-  console.log(chalk30.cyan.bold("\n\u{1F310} Egress control"));
+  const state = !e.enabled ? chalk31.red("OFF \u2014 your agent can reach any host") : e.mode === "block" ? chalk31.green("LOCKED (block) \u2014 unknown hosts are denied") : chalk31.yellow("WATCHING (review) \u2014 unknown hosts prompt you");
+  console.log(chalk31.cyan.bold("\n\u{1F310} Egress control"));
   console.log("  State: " + state);
   console.log(
-    chalk30.gray(
+    chalk31.gray(
       `  ${DEFAULT_EGRESS_ALLOWLIST.length} common dev/LLM hosts are always allowed (github, npm, pypi, anthropic, \u2026).`
     )
   );
   if (e.allow.length) console.log("  Your allow: " + e.allow.join(", "));
   if (e.deny.length) console.log("  Your deny:  " + e.deny.join(", "));
   if (!e.enabled) {
-    console.log(chalk30.gray("\n  Turn it on:  node9 egress watch   (prompt on unknown hosts)"));
-    console.log(chalk30.gray("               node9 egress lock    (hard-block unknown hosts)"));
+    console.log(chalk31.gray("\n  Turn it on:  node9 egress watch   (prompt on unknown hosts)"));
+    console.log(chalk31.gray("               node9 egress lock    (hard-block unknown hosts)"));
   }
   console.log("");
 }
@@ -55601,36 +55700,36 @@ function registerEgressCommand(program2) {
   const egress = program2.command("egress").description("Control where your agent can send data (egress allowlist)");
   egress.command("watch").description("Prompt before the agent reaches an unknown host (review mode)").action(() => {
     if (!mutate({ enabled: true, mode: "review" })) return;
-    console.log(chalk30.green("\n\u2713 Egress is now watched (review mode)."));
+    console.log(chalk31.green("\n\u2713 Egress is now watched (review mode)."));
     console.log(
-      chalk30.gray("  Routine hosts (LLM APIs, package registries, localhost) are allowed.")
+      chalk31.gray("  Routine hosts (LLM APIs, package registries, localhost) are allowed.")
     );
     console.log(
-      chalk30.gray("  An unknown host will prompt you \u2014 run `node9 egress lock` to hard-block.\n")
+      chalk31.gray("  An unknown host will prompt you \u2014 run `node9 egress lock` to hard-block.\n")
     );
   });
   egress.command("lock").description("Block the agent from reaching unknown hosts (block mode)").action(() => {
     if (!mutate({ enabled: true, mode: "block" })) return;
-    console.log(chalk30.green("\n\u2713 Egress is now locked (block mode)."));
-    console.log(chalk30.gray("  Routine hosts are still allowed; unknown hosts are denied."));
-    console.log(chalk30.gray("  Allow a specific host with `node9 egress allow <host>`.\n"));
+    console.log(chalk31.green("\n\u2713 Egress is now locked (block mode)."));
+    console.log(chalk31.gray("  Routine hosts are still allowed; unknown hosts are denied."));
+    console.log(chalk31.gray("  Allow a specific host with `node9 egress allow <host>`.\n"));
   });
   egress.command("allow <host>").description("Allow an extra host (glob, e.g. *.mycorp.com)").action((host) => {
     if (!addHost("allow", host)) return;
-    console.log(chalk30.green(`
+    console.log(chalk31.green(`
 \u2713 Allowed egress to ${host}.
 `));
   });
   egress.command("deny <host>").description("Block an extra host (deny always wins)").action((host) => {
     if (!addHost("deny", host)) return;
-    console.log(chalk30.green(`
+    console.log(chalk31.green(`
 \u2713 Denied egress to ${host}.
 `));
   });
   egress.command("off").description("Turn egress control off").action(() => {
     if (!mutate({ enabled: false })) return;
     console.log(
-      chalk30.yellow("\n\u2713 Egress control is off \u2014 the agent can reach any host again.\n")
+      chalk31.yellow("\n\u2713 Egress control is off \u2014 the agent can reach any host again.\n")
     );
   });
   egress.action(showStatus);
@@ -55639,7 +55738,7 @@ function registerEgressCommand(program2) {
 // src/cli/commands/jail.ts
 init_jail();
 init_audit();
-import chalk31 from "chalk";
+import chalk32 from "chalk";
 var BUILTIN_JAIL = [
   "~/.ssh \u2014 SSH private keys",
   "~/.aws \u2014 AWS credentials",
@@ -55655,20 +55754,20 @@ function registerJailCommand(program2) {
       regenerateUserJail(paths);
       appendConfigAudit({ event: "jail-add", path: p.trim(), verdict });
     } catch (err2) {
-      console.error(chalk31.red(`
+      console.error(chalk32.red(`
 \u274C ${err2.message}
 `));
       process.exit(1);
       return;
     }
-    console.log(chalk31.green(`
+    console.log(chalk32.green(`
 \u2705 Jailed ${p} (${verdict}).`));
     console.log(
-      chalk31.gray(
+      chalk32.gray(
         `   AI reads of this path now ${verdict === "block" ? "BLOCK" : "require approval"}.`
       )
     );
-    console.log(chalk31.gray(`   Preview: ${chalk31.cyan(`node9 explain bash "cat ${p}"`)}
+    console.log(chalk32.gray(`   Preview: ${chalk32.cyan(`node9 explain bash "cat ${p}"`)}
 `));
   });
   jail.command("remove <path>").description("Remove a user-added jail path (built-in paths are not removable)").action((p) => {
@@ -55676,17 +55775,17 @@ function registerJailCommand(program2) {
     try {
       result = removeJailPath(p);
     } catch (err2) {
-      console.error(chalk31.red(`
+      console.error(chalk32.red(`
 \u274C ${err2.message}
 `));
       process.exit(1);
       return;
     }
     if (!result.removed) {
-      console.error(chalk31.yellow(`
+      console.error(chalk32.yellow(`
 \u2139\uFE0F  "${p}" is not a user-added jail path.
 `));
-      console.error(chalk31.gray(`   Run ${chalk31.cyan("node9 jail list")} to see your paths.
+      console.error(chalk32.gray(`   Run ${chalk32.cyan("node9 jail list")} to see your paths.
 `));
       process.exit(1);
       return;
@@ -55695,39 +55794,39 @@ function registerJailCommand(program2) {
       regenerateUserJail(result.paths);
       appendConfigAudit({ event: "jail-remove", path: p.trim() });
     } catch (err2) {
-      console.error(chalk31.red(`
+      console.error(chalk32.red(`
 \u274C ${err2.message}
 `));
       process.exit(1);
       return;
     }
-    console.log(chalk31.green(`
+    console.log(chalk32.green(`
 \u2705 Removed ${p} from the jail.
 `));
   });
   jail.command("list").description("Show built-in + user-added jail paths").action(() => {
-    console.log(chalk31.bold("\n\u{1F512} Credential Jail\n"));
-    console.log(chalk31.gray("  Built-in (always on, not removable):"));
-    for (const b of BUILTIN_JAIL) console.log(`    ${chalk31.gray("\u2022")} ${b}`);
+    console.log(chalk32.bold("\n\u{1F512} Credential Jail\n"));
+    console.log(chalk32.gray("  Built-in (always on, not removable):"));
+    for (const b of BUILTIN_JAIL) console.log(`    ${chalk32.gray("\u2022")} ${b}`);
     console.log("");
     let user;
     try {
       user = readJailPaths();
     } catch (err2) {
-      console.error(chalk31.red(`  \u2717 ${err2.message}
+      console.error(chalk32.red(`  \u2717 ${err2.message}
 `));
       process.exit(1);
       return;
     }
     if (user.length === 0) {
       console.log(
-        chalk31.gray("  Your paths: (none) \u2014 add one with ") + chalk31.cyan("node9 jail add <path>")
+        chalk32.gray("  Your paths: (none) \u2014 add one with ") + chalk32.cyan("node9 jail add <path>")
       );
     } else {
-      console.log(chalk31.gray("  Your paths (removable):"));
+      console.log(chalk32.gray("  Your paths (removable):"));
       for (const u of user) {
-        const v = u.verdict === "block" ? chalk31.red("block ") : chalk31.yellow("review");
-        console.log(`    ${v}  ${chalk31.cyan(u.path)}`);
+        const v = u.verdict === "block" ? chalk32.red("block ") : chalk32.yellow("review");
+        console.log(`    ${v}  ${chalk32.cyan(u.path)}`);
       }
     }
     console.log("");
@@ -55736,7 +55835,7 @@ function registerJailCommand(program2) {
 
 // src/cli/commands/sandbox.ts
 init_config();
-import chalk32 from "chalk";
+import chalk33 from "chalk";
 import fs67 from "fs";
 import path62 from "path";
 import { spawnSync as spawnSync5 } from "child_process";
@@ -55973,16 +56072,16 @@ function registerSandboxCommand(program2, version2) {
     const p = sandboxConfigPath();
     if (fs67.existsSync(p)) {
       console.log(
-        chalk32.yellow(`  ${SANDBOX_CONFIG_FILE} already exists \u2014 leaving it untouched.`)
+        chalk33.yellow(`  ${SANDBOX_CONFIG_FILE} already exists \u2014 leaving it untouched.`)
       );
       return;
     }
     fs67.writeFileSync(p, scaffoldSandboxYaml(agent));
     console.log(
-      chalk32.green(`  \u2713 wrote ${SANDBOX_CONFIG_FILE}`) + chalk32.dim(` (agent: ${agent})`)
+      chalk33.green(`  \u2713 wrote ${SANDBOX_CONFIG_FILE}`) + chalk33.dim(` (agent: ${agent})`)
     );
     console.log(
-      chalk32.dim("  Edit it (mounts / allow / expose), then: ") + chalk32.cyan("node9 sandbox run")
+      chalk33.dim("  Edit it (mounts / allow / expose), then: ") + chalk33.cyan("node9 sandbox run")
     );
   });
   cmd.command("run [agent]").description("Build (if needed) + run the agent jailed. Extra args after -- go to the agent.").allowUnknownOption(true).allowExcessArguments(true).action((agentArg, _opts, command) => {
@@ -55992,7 +56091,7 @@ function registerSandboxCommand(program2, version2) {
     const engine = detectEngine(sandbox.runtime.engine);
     if (!engine.available) {
       console.error(
-        chalk32.red(`  ${sandbox.runtime.engine} not found.`) + chalk32.dim(` Install it first \u2014 node9 sandbox needs a container runtime.`)
+        chalk33.red(`  ${sandbox.runtime.engine} not found.`) + chalk33.dim(` Install it first \u2014 node9 sandbox needs a container runtime.`)
       );
       process.exit(1);
     }
@@ -56005,11 +56104,11 @@ function registerSandboxCommand(program2, version2) {
     });
     if (compiled.rejected.length) {
       console.log(
-        chalk32.yellow(`  \u26A0 ignoring invalid allow hosts: ${compiled.rejected.join(", ")}`)
+        chalk33.yellow(`  \u26A0 ignoring invalid allow hosts: ${compiled.rejected.join(", ")}`)
       );
     }
     if (compiled.denied.length) {
-      console.log(chalk32.dim(`  (denied: ${compiled.denied.join(", ")})`));
+      console.log(chalk33.dim(`  (denied: ${compiled.denied.join(", ")})`));
     }
     const allowlistPath = writeAllowlist(cwd, compiled.allow);
     const dockerfile = renderDockerfile(sandbox, node9Version2);
@@ -56022,12 +56121,12 @@ function registerSandboxCommand(program2, version2) {
     const imageExists = spawnSync5(sandbox.runtime.engine, ["image", "inspect", image], { stdio: "ignore" }).status === 0;
     const needBuild = sandbox.runtime.rebuild === "always" || !imageExists || sandbox.runtime.rebuild !== "never" && lastHash !== hash;
     if (needBuild) {
-      console.log(chalk32.dim(`  building ${image} \u2026`));
+      console.log(chalk33.dim(`  building ${image} \u2026`));
       const b = spawnSync5(sandbox.runtime.engine, ["build", "-t", image, buildDir], {
         stdio: "inherit"
       });
       if (b.status !== 0) {
-        console.error(chalk32.red("  build failed."));
+        console.error(chalk33.red("  build failed."));
         process.exit(b.status ?? 1);
       }
       fs67.writeFileSync(hashFile, hash);
@@ -56045,15 +56144,15 @@ function registerSandboxCommand(program2, version2) {
     if (sandbox.node9.mountAgentCredentials) {
       const creds = agentCredentialsMount(sandbox.agent);
       if (fs67.existsSync(creds.hostPath)) {
-        console.log(chalk32.dim(`  mounting ${creds.hostPath} (agent credentials, rw)`));
+        console.log(chalk33.dim(`  mounting ${creds.hostPath} (agent credentials, rw)`));
       } else {
         console.log(
-          chalk32.yellow(`  \u26A0 ${creds.hostPath} not found \u2014 `) + chalk32.dim(`the agent must auth via an env key in env.pass.`)
+          chalk33.yellow(`  \u26A0 ${creds.hostPath} not found \u2014 `) + chalk33.dim(`the agent must auth via an env key in env.pass.`)
         );
       }
     }
     console.log(
-      chalk32.green(`  \u{1F6E1}\uFE0F  ${sandbox.agent} jailed \u2014 ${compiled.allow.length} hosts allowed
+      chalk33.green(`  \u{1F6E1}\uFE0F  ${sandbox.agent} jailed \u2014 ${compiled.allow.length} hosts allowed
 `)
     );
     const r = spawnSync5(sandbox.runtime.engine, runArgs, { stdio: "inherit" });
@@ -56062,7 +56161,7 @@ function registerSandboxCommand(program2, version2) {
   cmd.command("tail").description("Stream the sandbox's audit log (host-side)").action(() => {
     const auditPath = path62.join(sandboxDataDir(), "audit.log");
     if (!fs67.existsSync(auditPath)) {
-      console.log(chalk32.dim("  no sandbox audit yet."));
+      console.log(chalk33.dim("  no sandbox audit yet."));
       return;
     }
     spawnSync5("tail", ["-f", auditPath], { stdio: "inherit" });
@@ -56070,7 +56169,7 @@ function registerSandboxCommand(program2, version2) {
   cmd.command("logs").description("Dump the sandbox's audit log").action(() => {
     const auditPath = path62.join(sandboxDataDir(), "audit.log");
     if (!fs67.existsSync(auditPath)) {
-      console.log(chalk32.dim("  no sandbox audit yet."));
+      console.log(chalk33.dim("  no sandbox audit yet."));
       return;
     }
     process.stdout.write(fs67.readFileSync(auditPath, "utf-8"));
@@ -56088,7 +56187,7 @@ function registerSandboxCommand(program2, version2) {
       });
     }
     fs67.rmSync(path62.join(cwd, ".node9", "sandbox"), { recursive: true, force: true });
-    console.log(chalk32.green("  \u2713 sandbox image + build + data removed."));
+    console.log(chalk33.green("  \u2713 sandbox image + build + data removed."));
   });
 }
 
@@ -56098,7 +56197,7 @@ init_scan_summary();
 init_litellm();
 init_cost_gemini();
 init_cost_codex();
-import chalk33 from "chalk";
+import chalk34 from "chalk";
 import fs68 from "fs";
 import path63 from "path";
 import os56 from "os";
@@ -56590,11 +56689,11 @@ function toolInputSummary(tool, input) {
 }
 function toolColor(tool) {
   const t = tool.toLowerCase();
-  if (t === "bash" || t === "execute_bash") return chalk33.red;
-  if (t === "write") return chalk33.green;
-  if (t === "edit" || t === "notebookedit") return chalk33.yellow;
-  if (t === "read") return chalk33.cyan;
-  return chalk33.gray;
+  if (t === "bash" || t === "execute_bash") return chalk34.red;
+  if (t === "write") return chalk34.green;
+  if (t === "edit" || t === "notebookedit") return chalk34.yellow;
+  if (t === "read") return chalk34.cyan;
+  return chalk34.gray;
 }
 function barStr2(value, max, width) {
   if (max === 0 || width <= 0) return "\u2591".repeat(width);
@@ -56604,7 +56703,7 @@ function barStr2(value, max, width) {
 function colorBar2(value, max, width) {
   const s = barStr2(value, max, width);
   const filled = Math.max(1, Math.round(max > 0 ? value / max * width : 0));
-  return chalk33.cyan(s.slice(0, filled)) + chalk33.dim(s.slice(filled));
+  return chalk34.cyan(s.slice(0, filled)) + chalk34.dim(s.slice(filled));
 }
 function renderSummary(summaries) {
   const totalTools = summaries.reduce((n, s) => n + s.toolCalls.length, 0);
@@ -56634,45 +56733,45 @@ function renderSummary(summaries) {
   }
   const topProjects = [...projCosts.entries()].sort((a, b) => b[1] - a[1]).slice(0, 3);
   const W = 20;
-  console.log(chalk33.dim("  " + "\u2500".repeat(70)));
+  console.log(chalk34.dim("  " + "\u2500".repeat(70)));
   console.log(
-    "  " + chalk33.bold.white(String(summaries.length).padEnd(4)) + chalk33.dim("sessions    ") + chalk33.bold.yellow(fmtCost3(totalCost).padEnd(10)) + chalk33.dim("total    ") + chalk33.bold.white(String(totalTools).padEnd(6)) + chalk33.dim("tool calls    ") + chalk33.bold.white(String(totalFiles)) + chalk33.dim(" files modified") + (totalBlocked > 0 ? chalk33.dim("    ") + chalk33.red.bold(String(totalBlocked)) + chalk33.dim(" blocked by node9") : "")
+    "  " + chalk34.bold.white(String(summaries.length).padEnd(4)) + chalk34.dim("sessions    ") + chalk34.bold.yellow(fmtCost3(totalCost).padEnd(10)) + chalk34.dim("total    ") + chalk34.bold.white(String(totalTools).padEnd(6)) + chalk34.dim("tool calls    ") + chalk34.bold.white(String(totalFiles)) + chalk34.dim(" files modified") + (totalBlocked > 0 ? chalk34.dim("    ") + chalk34.red.bold(String(totalBlocked)) + chalk34.dim(" blocked by node9") : "")
   );
   console.log(
-    "  " + chalk33.dim("avg ") + chalk33.white(fmtCost3(avgCost).padEnd(10)) + chalk33.dim("/session    ") + chalk33.green(String(snapshots)) + chalk33.dim(` of ${summaries.length} sessions had snapshots`)
+    "  " + chalk34.dim("avg ") + chalk34.white(fmtCost3(avgCost).padEnd(10)) + chalk34.dim("/session    ") + chalk34.green(String(snapshots)) + chalk34.dim(` of ${summaries.length} sessions had snapshots`)
   );
   console.log("");
-  console.log("  " + chalk33.dim("Tool breakdown:"));
+  console.log("  " + chalk34.dim("Tool breakdown:"));
   const maxGroup = Math.max(...Object.values(groups));
   for (const [label2, count] of Object.entries(groups)) {
     if (count === 0) continue;
     const pct = totalTools > 0 ? Math.round(count / totalTools * 100) : 0;
     console.log(
-      "    " + label2.padEnd(6) + "  " + colorBar2(count, maxGroup, W) + "  " + chalk33.white(String(count).padStart(4)) + chalk33.dim(` (${String(pct)}%)`)
+      "    " + label2.padEnd(6) + "  " + colorBar2(count, maxGroup, W) + "  " + chalk34.white(String(count).padStart(4)) + chalk34.dim(` (${String(pct)}%)`)
     );
   }
   console.log("");
   if (topProjects.length > 1) {
-    console.log("  " + chalk33.dim("Cost by project:"));
+    console.log("  " + chalk34.dim("Cost by project:"));
     const maxProjCost = topProjects[0][1];
     for (const [proj, cost] of topProjects) {
       console.log(
-        "    " + proj.slice(0, 28).padEnd(28) + "  " + colorBar2(cost, maxProjCost, W) + "  " + chalk33.yellow(fmtCost3(cost))
+        "    " + proj.slice(0, 28).padEnd(28) + "  " + colorBar2(cost, maxProjCost, W) + "  " + chalk34.yellow(fmtCost3(cost))
       );
     }
     console.log("");
   }
-  console.log(chalk33.dim("  " + "\u2500".repeat(70)));
+  console.log(chalk34.dim("  " + "\u2500".repeat(70)));
   console.log("");
 }
 function renderList(summaries, totalCost) {
   if (summaries.length === 0) {
-    console.log(chalk33.yellow("  No sessions found in the requested range.\n"));
+    console.log(chalk34.yellow("  No sessions found in the requested range.\n"));
     return;
   }
-  const totalLabel = totalCost > 0 ? chalk33.dim("  ~" + fmtCost3(totalCost) + " total") : "";
+  const totalLabel = totalCost > 0 ? chalk34.dim("  ~" + fmtCost3(totalCost) + " total") : "";
   console.log(
-    "  " + chalk33.white(String(summaries.length)) + chalk33.dim(` session${summaries.length !== 1 ? "s" : ""}`) + totalLabel
+    "  " + chalk34.white(String(summaries.length)) + chalk34.dim(` session${summaries.length !== 1 ? "s" : ""}`) + totalLabel
   );
   console.log("");
   let lastGroup = "";
@@ -56680,51 +56779,51 @@ function renderList(summaries, totalCost) {
     const activeDate = fmtDate2(s.lastActiveTime);
     const group = activeDate + "  " + s.projectLabel;
     if (group !== lastGroup) {
-      console.log(chalk33.dim("  \u2500\u2500\u2500 ") + chalk33.bold(activeDate) + chalk33.dim("  " + s.projectLabel));
+      console.log(chalk34.dim("  \u2500\u2500\u2500 ") + chalk34.bold(activeDate) + chalk34.dim("  " + s.projectLabel));
       lastGroup = group;
     }
     const startDate = fmtDate2(s.startTime);
-    const dateRange = startDate !== activeDate ? chalk33.dim(" (" + startDate + " \u2192 " + activeDate + ")") : "";
-    const timeStr = chalk33.dim(fmtTime(s.startTime));
-    const prompt = chalk33.white(truncate(s.firstPrompt.replace(/\n/g, " "), 50).padEnd(50));
-    const tools = s.toolCalls.length > 0 ? chalk33.dim(String(s.toolCalls.length).padStart(3) + " tools") : chalk33.dim("  0 tools");
-    const cost = s.costUSD > 0 ? chalk33.dim("  " + fmtCost3(s.costUSD).padEnd(8)) : "          ";
-    const blocked = s.blockedCalls.length > 0 ? chalk33.red("  \u{1F6D1} " + String(s.blockedCalls.length)) : "";
-    const snap = s.hasSnapshot ? chalk33.green("  \u{1F4F8}") : "";
-    const agentBadge = chalk33[agentColorName(s.agent ?? "claude")](
+    const dateRange = startDate !== activeDate ? chalk34.dim(" (" + startDate + " \u2192 " + activeDate + ")") : "";
+    const timeStr = chalk34.dim(fmtTime(s.startTime));
+    const prompt = chalk34.white(truncate(s.firstPrompt.replace(/\n/g, " "), 50).padEnd(50));
+    const tools = s.toolCalls.length > 0 ? chalk34.dim(String(s.toolCalls.length).padStart(3) + " tools") : chalk34.dim("  0 tools");
+    const cost = s.costUSD > 0 ? chalk34.dim("  " + fmtCost3(s.costUSD).padEnd(8)) : "          ";
+    const blocked = s.blockedCalls.length > 0 ? chalk34.red("  \u{1F6D1} " + String(s.blockedCalls.length)) : "";
+    const snap = s.hasSnapshot ? chalk34.green("  \u{1F4F8}") : "";
+    const agentBadge = chalk34[agentColorName(s.agent ?? "claude")](
       "  " + agentBadgeText(s.agent ?? "claude", 0)
     );
-    const sid = chalk33.dim("  " + s.sessionId.slice(0, 8));
+    const sid = chalk34.dim("  " + s.sessionId.slice(0, 8));
     console.log(
       `  ${timeStr}  ${prompt}  ${tools}${cost}${blocked}${snap}${agentBadge}${sid}${dateRange}`
     );
   }
   console.log("");
   console.log(
-    chalk33.dim("  Run") + " " + chalk33.cyan("node9 sessions --detail <session-id>") + chalk33.dim(" for full tool trace.")
+    chalk34.dim("  Run") + " " + chalk34.cyan("node9 sessions --detail <session-id>") + chalk34.dim(" for full tool trace.")
   );
   console.log("");
 }
 function renderDetail(s) {
   console.log("");
-  console.log(chalk33.bold("  Session  ") + chalk33.dim(s.sessionId));
+  console.log(chalk34.bold("  Session  ") + chalk34.dim(s.sessionId));
   console.log(
-    chalk33.bold("  Prompt   ") + chalk33.white(s.firstPrompt.replace(/\n/g, " ").slice(0, 120))
+    chalk34.bold("  Prompt   ") + chalk34.white(s.firstPrompt.replace(/\n/g, " ").slice(0, 120))
   );
-  console.log(chalk33.bold("  Project  ") + chalk33.white(s.projectLabel));
+  console.log(chalk34.bold("  Project  ") + chalk34.white(s.projectLabel));
   if (s.agent) {
-    const agentLabel2 = chalk33[agentColorName(s.agent)](agentDisplayName(s.agent));
-    console.log(chalk33.bold("  Agent    ") + agentLabel2);
+    const agentLabel2 = chalk34[agentColorName(s.agent)](agentDisplayName(s.agent));
+    console.log(chalk34.bold("  Agent    ") + agentLabel2);
   }
-  console.log(chalk33.bold("  When     ") + chalk33.white(fmtDateTime(s.startTime)));
+  console.log(chalk34.bold("  When     ") + chalk34.white(fmtDateTime(s.startTime)));
   if (s.costUSD > 0)
-    console.log(chalk33.bold("  Cost     ") + chalk33.yellow("~" + fmtCost3(s.costUSD)));
+    console.log(chalk34.bold("  Cost     ") + chalk34.yellow("~" + fmtCost3(s.costUSD)));
   console.log(
-    chalk33.bold("  Snapshot ") + (s.hasSnapshot ? chalk33.green("\u2713 taken") : chalk33.dim("none"))
+    chalk34.bold("  Snapshot ") + (s.hasSnapshot ? chalk34.green("\u2713 taken") : chalk34.dim("none"))
   );
   console.log("");
   if (s.toolCalls.length === 0 && s.blockedCalls.length === 0) {
-    console.log(chalk33.dim("  No tool calls recorded.\n"));
+    console.log(chalk34.dim("  No tool calls recorded.\n"));
     return;
   }
   const timeline = [
@@ -56737,32 +56836,32 @@ function renderDetail(s) {
   });
   const headerParts = [`Tool calls (${s.toolCalls.length})`];
   if (s.blockedCalls.length > 0)
-    headerParts.push(chalk33.red(`${s.blockedCalls.length} blocked by node9`));
-  console.log(chalk33.bold("  " + headerParts.join("  \xB7  ")));
+    headerParts.push(chalk34.red(`${s.blockedCalls.length} blocked by node9`));
+  console.log(chalk34.bold("  " + headerParts.join("  \xB7  ")));
   console.log("");
   for (const entry of timeline) {
     if (entry.kind === "tool") {
       const tc = entry.tc;
       const colorFn = toolColor(tc.tool);
       const toolPad = colorFn(tc.tool.padEnd(16));
-      const detail = chalk33.gray(truncate(toolInputSummary(tc.tool, tc.input), 70));
-      const ts = tc.timestamp ? chalk33.dim(fmtTime(tc.timestamp) + "  ") : "       ";
+      const detail = chalk34.gray(truncate(toolInputSummary(tc.tool, tc.input), 70));
+      const ts = tc.timestamp ? chalk34.dim(fmtTime(tc.timestamp) + "  ") : "       ";
       console.log(`    ${ts}${toolPad}  ${detail}`);
     } else {
       const bc = entry.bc;
-      const ts = bc.timestamp ? chalk33.dim(fmtTime(bc.timestamp) + "  ") : "       ";
-      const label2 = chalk33.red("\u{1F6D1} BLOCKED".padEnd(16));
-      const toolName = chalk33.red(bc.tool.padEnd(10));
-      const argsSummary = bc.args ? chalk33.gray(truncate(toolInputSummary(bc.tool, bc.args), 40)) : chalk33.dim("[args not logged]");
-      const reason = bc.checkedBy ? chalk33.dim("  \u2190 " + bc.checkedBy) : "";
+      const ts = bc.timestamp ? chalk34.dim(fmtTime(bc.timestamp) + "  ") : "       ";
+      const label2 = chalk34.red("\u{1F6D1} BLOCKED".padEnd(16));
+      const toolName = chalk34.red(bc.tool.padEnd(10));
+      const argsSummary = bc.args ? chalk34.gray(truncate(toolInputSummary(bc.tool, bc.args), 40)) : chalk34.dim("[args not logged]");
+      const reason = bc.checkedBy ? chalk34.dim("  \u2190 " + bc.checkedBy) : "";
       console.log(`    ${ts}${label2}  ${toolName}  ${argsSummary}${reason}`);
     }
   }
   console.log("");
   if (s.modifiedFiles.length > 0) {
-    console.log(chalk33.bold(`  Files modified (${s.modifiedFiles.length}):`));
+    console.log(chalk34.bold(`  Files modified (${s.modifiedFiles.length}):`));
     for (const f of s.modifiedFiles) {
-      console.log("    " + chalk33.yellow(f));
+      console.log("    " + chalk34.yellow(f));
     }
     console.log("");
   }
@@ -56770,13 +56869,13 @@ function renderDetail(s) {
 function registerSessionsCommand(program2) {
   program2.command("sessions").description("Show what your AI agent did \u2014 sessions, tool calls, cost, and file changes").option("--all", "Show all sessions (default: last 7 days)").option("--days <n>", "Show last N days of sessions", "7").option("--detail <sessionId>", "Show full tool trace for a session").action((options) => {
     console.log("");
-    console.log(chalk33.cyan.bold("\u{1F4CB}  node9 sessions") + chalk33.dim("  \u2014 what your AI agent did"));
+    console.log(chalk34.cyan.bold("\u{1F4CB}  node9 sessions") + chalk34.dim("  \u2014 what your AI agent did"));
     console.log("");
     const days = options.detail || options.all ? null : Math.max(1, parseInt(options.days, 10) || 7);
     const rangeLabel = options.detail ? "all time" : options.all ? "all time" : `last ${String(days)} days`;
-    console.log(chalk33.dim("  " + rangeLabel));
+    console.log(chalk34.dim("  " + rangeLabel));
     console.log("");
-    process.stdout.write(chalk33.dim("  Loading\u2026"));
+    process.stdout.write(chalk34.dim("  Loading\u2026"));
     const summaries = buildSessions(days);
     if (process.stdout.isTTY) {
       process.stdout.clearLine(0);
@@ -56789,8 +56888,8 @@ function registerSessionsCommand(program2) {
         (s) => s.sessionId === options.detail || s.sessionId.startsWith(options.detail)
       );
       if (!target) {
-        console.log(chalk33.red(`  Session not found: ${options.detail}`));
-        console.log(chalk33.dim("  Run `node9 sessions` to list recent sessions.\n"));
+        console.log(chalk34.red(`  Session not found: ${options.detail}`));
+        console.log(chalk34.dim("  Run `node9 sessions` to list recent sessions.\n"));
         return;
       }
       renderDetail(target);
@@ -56804,7 +56903,7 @@ function registerSessionsCommand(program2) {
 
 // src/cli/commands/session-taint.ts
 init_daemon();
-import chalk34 from "chalk";
+import chalk35 from "chalk";
 function resolveSessionId(records, query) {
   const exact = records.find((r) => r.sessionId === query);
   if (exact) return { record: exact };
@@ -56830,22 +56929,22 @@ function registerSessionTaintCommand(program2) {
     const records = await listSessionTaints();
     console.log("");
     if (records.length === 0) {
-      console.log(chalk34.dim("  No tainted sessions."));
-      console.log(chalk34.dim("  (Taint lives in the daemon \u2014 a stopped daemon has none.)") + "\n");
+      console.log(chalk35.dim("  No tainted sessions."));
+      console.log(chalk35.dim("  (Taint lives in the daemon \u2014 a stopped daemon has none.)") + "\n");
       return;
     }
     console.log(
-      "  " + chalk34.bold(String(records.length)) + chalk34.dim(` tainted session${records.length !== 1 ? "s" : ""}`)
+      "  " + chalk35.bold(String(records.length)) + chalk35.dim(` tainted session${records.length !== 1 ? "s" : ""}`)
     );
     console.log("");
     for (const r of records) {
       console.log(
-        "  " + chalk34.yellow(r.sessionId.slice(0, 8).padEnd(10)) + chalk34.red(r.source) + sourceGap(r.source) + chalk34.dim("clears in " + fmtRemaining(r.expiresAt))
+        "  " + chalk35.yellow(r.sessionId.slice(0, 8).padEnd(10)) + chalk35.red(r.source) + sourceGap(r.source) + chalk35.dim("clears in " + fmtRemaining(r.expiresAt))
       );
     }
     console.log("");
     console.log(
-      chalk34.dim("  Run ") + chalk34.cyan("node9 session-taint clear <id>") + chalk34.dim(" to release one, or ") + chalk34.cyan("--all") + chalk34.dim(" for every session.") + "\n"
+      chalk35.dim("  Run ") + chalk35.cyan("node9 session-taint clear <id>") + chalk35.dim(" to release one, or ") + chalk35.cyan("--all") + chalk35.dim(" for every session.") + "\n"
     );
   });
   cmd.command("clear").description("Clear a session's taint so its next network/write action isn't held for review").argument("[sessionId]", "Session id to clear (the 8-char prefix from `list` is accepted)").option("--all", "Clear every session taint").action(async (sessionId, opts) => {
@@ -56853,32 +56952,32 @@ function registerSessionTaintCommand(program2) {
     if (opts.all) {
       const res2 = await clearSessionTaint({ all: true });
       if (res2.daemonUnavailable) {
-        console.log(chalk34.dim("  node9 daemon not running \u2014 no active taints to clear.") + "\n");
+        console.log(chalk35.dim("  node9 daemon not running \u2014 no active taints to clear.") + "\n");
         return;
       }
       console.log(
-        chalk34.green("  \u2713 ") + `Cleared ${chalk34.bold(String(res2.cleared))} session taint${res2.cleared !== 1 ? "s" : ""}.
+        chalk35.green("  \u2713 ") + `Cleared ${chalk35.bold(String(res2.cleared))} session taint${res2.cleared !== 1 ? "s" : ""}.
 `
       );
       return;
     }
     if (!sessionId) {
-      console.log(chalk34.red("  Provide a session id or --all."));
-      console.log(chalk34.dim("  Run `node9 session-taint list` to see tainted sessions.") + "\n");
+      console.log(chalk35.red("  Provide a session id or --all."));
+      console.log(chalk35.dim("  Run `node9 session-taint list` to see tainted sessions.") + "\n");
       return;
     }
     const records = await listSessionTaints();
     if (records.length === 0) {
-      console.log(chalk34.dim("  No tainted sessions \u2014 nothing to clear.") + "\n");
+      console.log(chalk35.dim("  No tainted sessions \u2014 nothing to clear.") + "\n");
       return;
     }
     const resolved = resolveSessionId(records, sessionId);
     if ("error" in resolved) {
       if (resolved.error === "not-found") {
-        console.log(chalk34.red(`  No tainted session matches "${sessionId}".`));
+        console.log(chalk35.red(`  No tainted session matches "${sessionId}".`));
       } else {
-        console.log(chalk34.red(`  "${sessionId}" is ambiguous \u2014 matches:`));
-        for (const m of resolved.matches) console.log(chalk34.dim("    " + m));
+        console.log(chalk35.red(`  "${sessionId}" is ambiguous \u2014 matches:`));
+        for (const m of resolved.matches) console.log(chalk35.dim("    " + m));
       }
       console.log("");
       return;
@@ -56886,18 +56985,18 @@ function registerSessionTaintCommand(program2) {
     const res = await clearSessionTaint({ sessionId: resolved.record.sessionId });
     if (res.cleared > 0) {
       console.log(
-        chalk34.green("  \u2713 ") + `Cleared taint for ${chalk34.yellow(resolved.record.sessionId.slice(0, 8))} ` + chalk34.dim(`(was flagged by ${resolved.record.source}).`) + "\n"
+        chalk35.green("  \u2713 ") + `Cleared taint for ${chalk35.yellow(resolved.record.sessionId.slice(0, 8))} ` + chalk35.dim(`(was flagged by ${resolved.record.source}).`) + "\n"
       );
     } else {
       console.log(
-        chalk34.dim(`  Session ${resolved.record.sessionId.slice(0, 8)} was already clear.`) + "\n"
+        chalk35.dim(`  Session ${resolved.record.sessionId.slice(0, 8)} was already clear.`) + "\n"
       );
     }
   });
 }
 
 // src/cli/commands/skill-pin.ts
-import chalk35 from "chalk";
+import chalk36 from "chalk";
 import fs69 from "fs";
 import os57 from "os";
 import path64 from "path";
@@ -56917,29 +57016,29 @@ function registerSkillPinCommand(program2) {
     const result = readSkillPinsSafe();
     if (!result.ok) {
       if (result.reason === "missing") {
-        console.log(chalk35.gray("\nNo skill roots are pinned yet."));
+        console.log(chalk36.gray("\nNo skill roots are pinned yet."));
         console.log(
-          chalk35.gray("Pins are created automatically on the first tool call of each session.\n")
+          chalk36.gray("Pins are created automatically on the first tool call of each session.\n")
         );
         return;
       }
-      console.error(chalk35.red(`
+      console.error(chalk36.red(`
 \u274C Pin file is corrupt: ${result.detail}`));
-      console.error(chalk35.yellow("   Run: node9 skill pin reset\n"));
+      console.error(chalk36.yellow("   Run: node9 skill pin reset\n"));
       process.exit(1);
     }
     const entries = Object.entries(result.pins.roots);
     if (entries.length === 0) {
-      console.log(chalk35.gray("\nNo skill roots are pinned yet.\n"));
+      console.log(chalk36.gray("\nNo skill roots are pinned yet.\n"));
       return;
     }
-    console.log(chalk35.bold("\n\u{1F512} Pinned Skill Roots\n"));
+    console.log(chalk36.bold("\n\u{1F512} Pinned Skill Roots\n"));
     for (const [key, entry] of entries) {
-      const missing = entry.exists ? "" : chalk35.yellow(" (not present at pin time)");
-      console.log(`  ${chalk35.cyan(key)}  ${chalk35.gray(entry.rootPath)}${missing}`);
+      const missing = entry.exists ? "" : chalk36.yellow(" (not present at pin time)");
+      console.log(`  ${chalk36.cyan(key)}  ${chalk36.gray(entry.rootPath)}${missing}`);
       console.log(`    Files (${entry.fileCount})`);
-      console.log(`    Hash:  ${chalk35.gray(entry.contentHash.slice(0, 16))}...`);
-      console.log(`    Pinned: ${chalk35.gray(entry.pinnedAt)}
+      console.log(`    Hash:  ${chalk36.gray(entry.contentHash.slice(0, 16))}...`);
+      console.log(`    Pinned: ${chalk36.gray(entry.pinnedAt)}
 `);
     }
   });
@@ -56948,39 +57047,39 @@ function registerSkillPinCommand(program2) {
     try {
       pins = readSkillPins();
     } catch {
-      console.error(chalk35.red("\n\u274C Pin file is corrupt."));
-      console.error(chalk35.yellow("   Run: node9 skill pin reset\n"));
+      console.error(chalk36.red("\n\u274C Pin file is corrupt."));
+      console.error(chalk36.yellow("   Run: node9 skill pin reset\n"));
       process.exit(1);
     }
     if (!pins.roots[rootKey]) {
-      console.error(chalk35.red(`
+      console.error(chalk36.red(`
 \u274C No pin found for root key "${rootKey}"
 `));
-      console.error(`Run ${chalk35.cyan("node9 skill pin list")} to see pinned roots.
+      console.error(`Run ${chalk36.cyan("node9 skill pin list")} to see pinned roots.
 `);
       process.exit(1);
     }
     const rootPath = pins.roots[rootKey].rootPath;
     removePin2(rootKey);
     wipeSkillSessions();
-    console.log(chalk35.green(`
-\u{1F513} Pin removed for ${chalk35.cyan(rootKey)}`));
-    console.log(chalk35.gray(`   ${rootPath}`));
-    console.log(chalk35.gray("   Next session will re-pin with current state.\n"));
+    console.log(chalk36.green(`
+\u{1F513} Pin removed for ${chalk36.cyan(rootKey)}`));
+    console.log(chalk36.gray(`   ${rootPath}`));
+    console.log(chalk36.gray("   Next session will re-pin with current state.\n"));
   });
   pinSubCmd.command("reset").description("Clear all skill pins and wipe session verification flags").action(() => {
     const result = readSkillPinsSafe();
     if (!result.ok && result.reason === "missing") {
       wipeSkillSessions();
-      console.log(chalk35.gray("\nNo pins to clear.\n"));
+      console.log(chalk36.gray("\nNo pins to clear.\n"));
       return;
     }
     const count = result.ok ? Object.keys(result.pins.roots).length : "?";
     clearAllPins2();
     wipeSkillSessions();
-    console.log(chalk35.green(`
+    console.log(chalk36.green(`
 \u{1F513} Cleared ${count} skill pin(s).`));
-    console.log(chalk35.gray("   Next session will re-pin with current state.\n"));
+    console.log(chalk36.gray("   Next session will re-pin with current state.\n"));
   });
 }
 
@@ -56988,7 +57087,7 @@ function registerSkillPinCommand(program2) {
 import fs70 from "fs";
 import os58 from "os";
 import path65 from "path";
-import chalk36 from "chalk";
+import chalk37 from "chalk";
 var DECISIONS_FILE2 = path65.join(os58.homedir(), ".node9", "decisions.json");
 function readDecisions() {
   try {
@@ -57017,55 +57116,55 @@ function registerDecisionsCommand(program2) {
     const decisions = readDecisions();
     const entries = Object.entries(decisions);
     if (entries.length === 0) {
-      console.log(chalk36.gray("  No persistent decisions stored."));
+      console.log(chalk37.gray("  No persistent decisions stored."));
       console.log(
-        chalk36.gray(`  File: ${DECISIONS_FILE2}
-`) + chalk36.gray('  Decisions are written when you click "Always Allow" or')
+        chalk37.gray(`  File: ${DECISIONS_FILE2}
+`) + chalk37.gray('  Decisions are written when you click "Always Allow" or')
       );
-      console.log(chalk36.gray('  "Always Deny" in node9 tail or the native popup.'));
+      console.log(chalk37.gray('  "Always Deny" in node9 tail or the native popup.'));
       return;
     }
-    console.log(chalk36.bold(`
+    console.log(chalk37.bold(`
 Persistent decisions  (${entries.length})
 `));
     const w = Math.max(...entries.map(([k]) => k.length));
     for (const [tool, verdict] of entries.sort()) {
-      const colored = verdict === "allow" ? chalk36.green(verdict) : chalk36.red(verdict);
+      const colored = verdict === "allow" ? chalk37.green(verdict) : chalk37.red(verdict);
       console.log(`  ${tool.padEnd(w)}  ${colored}`);
     }
     console.log(
-      chalk36.gray(`
+      chalk37.gray(`
   Stored in ${DECISIONS_FILE2}
-`) + chalk36.gray("  Run `node9 decisions clear <tool>` to remove an entry.")
+`) + chalk37.gray("  Run `node9 decisions clear <tool>` to remove an entry.")
     );
   });
   cmd.command("clear <toolName>").description("Remove a persistent decision for one tool").action((toolName) => {
     const decisions = readDecisions();
     if (!(toolName in decisions)) {
-      console.log(chalk36.yellow(`  No persistent decision for "${toolName}". Nothing to clear.`));
+      console.log(chalk37.yellow(`  No persistent decision for "${toolName}". Nothing to clear.`));
       process.exitCode = 1;
       return;
     }
     delete decisions[toolName];
     writeDecisions(decisions);
-    console.log(chalk36.green(`  \u2713 Cleared persistent decision for "${toolName}".`));
+    console.log(chalk37.green(`  \u2713 Cleared persistent decision for "${toolName}".`));
   });
   cmd.command("clear-all").description("Remove every persistent decision (irreversible)").action(() => {
     const decisions = readDecisions();
     const count = Object.keys(decisions).length;
     if (count === 0) {
-      console.log(chalk36.gray("  Nothing to clear \u2014 no persistent decisions stored."));
+      console.log(chalk37.gray("  Nothing to clear \u2014 no persistent decisions stored."));
       return;
     }
     writeDecisions({});
     console.log(
-      chalk36.green(`  \u2713 Cleared ${count} persistent decision${count === 1 ? "" : "s"}.`)
+      chalk37.green(`  \u2713 Cleared ${count} persistent decision${count === 1 ? "" : "s"}.`)
     );
   });
 }
 
 // src/cli/commands/dlp.ts
-import chalk37 from "chalk";
+import chalk38 from "chalk";
 import fs71 from "fs";
 import path66 from "path";
 import os59 from "os";
@@ -57120,14 +57219,14 @@ function registerDlpCommand(program2) {
   cmd.command("resolve").description("Mark all current DLP findings as resolved").action(() => {
     const findings = loadDlpFindings();
     if (findings.length === 0) {
-      console.log(chalk37.green("\n  \u2705 No response-DLP findings to resolve.\n"));
+      console.log(chalk38.green("\n  \u2705 No response-DLP findings to resolve.\n"));
       return;
     }
     const resolved = loadResolved();
     for (const e of findings) resolved.add(entryKey2(e));
     saveResolved(resolved);
     console.log(
-      chalk37.green(
+      chalk38.green(
         `
   \u2705 ${findings.length} finding${findings.length !== 1 ? "s" : ""} marked as resolved.
 `
@@ -57141,47 +57240,47 @@ function registerDlpCommand(program2) {
     const resolvedCount = findings.length - open.length;
     console.log("");
     console.log(
-      chalk37.bold.cyan("\u{1F510}  node9 dlp") + chalk37.dim("  \u2014 secrets found in Claude response text")
+      chalk38.bold.cyan("\u{1F510}  node9 dlp") + chalk38.dim("  \u2014 secrets found in Claude response text")
     );
     console.log("");
     if (open.length === 0) {
       if (resolvedCount > 0) {
-        console.log(chalk37.green(`  \u2705 No open findings  \xB7  ${resolvedCount} previously resolved`));
+        console.log(chalk38.green(`  \u2705 No open findings  \xB7  ${resolvedCount} previously resolved`));
       } else {
         console.log(
-          chalk37.green("  \u2705 No findings \u2014 Claude has not leaked secrets in response text")
+          chalk38.green("  \u2705 No findings \u2014 Claude has not leaked secrets in response text")
         );
       }
       console.log("");
       return;
     }
     console.log(
-      chalk37.bgRed.white.bold(` \u26A0\uFE0F  ${open.length} open finding${open.length !== 1 ? "s" : ""} `) + chalk37.dim(resolvedCount > 0 ? `  (${resolvedCount} resolved)` : "")
+      chalk38.bgRed.white.bold(` \u26A0\uFE0F  ${open.length} open finding${open.length !== 1 ? "s" : ""} `) + chalk38.dim(resolvedCount > 0 ? `  (${resolvedCount} resolved)` : "")
     );
     console.log("");
     console.log(
-      chalk37.dim("  These secrets were included in Claude's response text \u2014 NOT blocked.")
+      chalk38.dim("  These secrets were included in Claude's response text \u2014 NOT blocked.")
     );
-    console.log(chalk37.dim("  Rotate each affected key immediately.\n"));
+    console.log(chalk38.dim("  Rotate each affected key immediately.\n"));
     for (const e of open) {
       console.log(
-        "  " + chalk37.red("\u25CF") + "  " + chalk37.white(e.dlpPattern ?? "Secret") + chalk37.dim("  " + fmtDate3(e.ts))
+        "  " + chalk38.red("\u25CF") + "  " + chalk38.white(e.dlpPattern ?? "Secret") + chalk38.dim("  " + fmtDate3(e.ts))
       );
       if (e.dlpSample) {
-        console.log("     " + chalk37.dim("Sample: ") + chalk37.yellow(stripAnsi(e.dlpSample)));
+        console.log("     " + chalk38.dim("Sample: ") + chalk38.yellow(stripAnsi(e.dlpSample)));
       }
       if (e.project) {
-        console.log("     " + chalk37.dim("Project: ") + chalk37.dim(stripAnsi(e.project)));
+        console.log("     " + chalk38.dim("Project: ") + chalk38.dim(stripAnsi(e.project)));
       }
       console.log("");
     }
-    console.log("  " + chalk37.bold("Next steps:"));
-    console.log("  " + chalk37.cyan("1.") + " Rotate any exposed keys shown above");
+    console.log("  " + chalk38.bold("Next steps:"));
+    console.log("  " + chalk38.cyan("1.") + " Rotate any exposed keys shown above");
     console.log(
-      "  " + chalk37.cyan("2.") + " Run " + chalk37.white("node9 dlp resolve") + " to acknowledge"
+      "  " + chalk38.cyan("2.") + " Run " + chalk38.white("node9 dlp resolve") + " to acknowledge"
     );
     console.log(
-      "  " + chalk37.cyan("3.") + " Run " + chalk37.white("node9 report") + " for full audit history"
+      "  " + chalk38.cyan("3.") + " Run " + chalk38.white("node9 report") + " for full audit history"
     );
     console.log("");
   });
@@ -57189,7 +57288,7 @@ function registerDlpCommand(program2) {
 
 // src/cli/commands/mask.ts
 init_dlp();
-import chalk38 from "chalk";
+import chalk39 from "chalk";
 import fs72 from "fs";
 import path67 from "path";
 import os60 from "os";
@@ -57325,12 +57424,12 @@ function registerMaskCommand(program2) {
       }
     }) : allFiles;
     if (filtered.length === 0) {
-      console.log(chalk38.yellow("  No session files found."));
+      console.log(chalk39.yellow("  No session files found."));
       return;
     }
     console.log("");
     if (dryRun) {
-      console.log(chalk38.dim("  Dry run \u2014 no files will be modified.\n"));
+      console.log(chalk39.dim("  Dry run \u2014 no files will be modified.\n"));
     }
     let totalFiles = 0;
     let totalLines = 0;
@@ -57346,23 +57445,23 @@ function registerMaskCommand(program2) {
         });
         const verb = dryRun ? "Would redact" : "Redacted";
         console.log(
-          "  " + chalk38.dim(shortPath.slice(0, 60).padEnd(62)) + chalk38.red(`${verb}: `) + chalk38.yellow(patterns.join(", ")) + chalk38.dim(` (${redactedLines} line${redactedLines !== 1 ? "s" : ""})`)
+          "  " + chalk39.dim(shortPath.slice(0, 60).padEnd(62)) + chalk39.red(`${verb}: `) + chalk39.yellow(patterns.join(", ")) + chalk39.dim(` (${redactedLines} line${redactedLines !== 1 ? "s" : ""})`)
         );
       }
     }
     console.log("");
     if (totalFiles === 0) {
-      console.log(chalk38.green("  No secrets found in session history."));
+      console.log(chalk39.green("  No secrets found in session history."));
     } else {
       const verb = dryRun ? "would be modified" : "modified";
       console.log(
-        chalk38.bold(`  ${totalFiles} file${totalFiles !== 1 ? "s" : ""} ${verb}`) + chalk38.dim(`, ${totalLines} line${totalLines !== 1 ? "s" : ""} redacted`)
+        chalk39.bold(`  ${totalFiles} file${totalFiles !== 1 ? "s" : ""} ${verb}`) + chalk39.dim(`, ${totalLines} line${totalLines !== 1 ? "s" : ""} redacted`)
       );
-      console.log("  Patterns: " + chalk38.yellow(totalPatterns.join(", ")));
+      console.log("  Patterns: " + chalk39.yellow(totalPatterns.join(", ")));
       if (!dryRun) {
         console.log("");
         console.log(
-          chalk38.dim(
+          chalk39.dim(
             "  Note: secrets were already sent to the AI provider during the active session.\n        This cleans your local disk only. Rotate any exposed keys."
           )
         );
@@ -57379,40 +57478,31 @@ var { version } = JSON.parse(
 );
 var program = new Command();
 program.name("node9").description("The Sudo Command for AI Agents").version(version);
-program.command("login").argument("<apiKey>").option("--local", "Save key for audit/logging only \u2014 local config still controls all decisions").option("--profile <name>", 'Save as a named profile (default: "default")').action((apiKey, options) => {
-  const { profileName, effectiveCloud } = writeCredentialsAndConfig(apiKey, {
-    profileName: options.profile,
-    isLocal: options.local
-  });
-  if (options.profile && profileName !== "default") {
-    console.log(chalk40.green(`\u2705 Profile "${profileName}" saved`));
-    console.log(chalk40.gray(`   Switch to it per-session:  NODE9_PROFILE=${profileName} claude`));
-  } else if (options.local || effectiveCloud === false) {
-    console.log(chalk40.green(`\u2705 Key saved \u2014 Privacy mode \u{1F6E1}\uFE0F`));
-    console.log(chalk40.gray(`   All decisions stay on this machine. Nothing syncs to the cloud.`));
-    if (!options.local) {
-      console.log(
-        chalk40.yellow(`   Your config has cloud approvals OFF (settings.approvers.cloud).`)
-      );
-      console.log(
-        chalk40.gray(`   To enable team policy + dashboard sync: set it to true, or re-init.`)
-      );
-    }
-  } else {
-    console.log(chalk40.green(`\u2705 Logged in \u2014 agent mode`));
-    console.log(chalk40.gray(`   Team policy enforced for all calls via Node9 cloud.`));
-    if (!isTestingMode()) {
-      const healed = ensureAutostartHealthy(!!getConfig().settings.autoStartDaemon);
-      if (healed === "repaired")
-        console.log(chalk40.green(`   \u2713 Re-enabled daemon autostart (survives reboot)`));
-    }
+program.command("login").argument("<apiKey>").option("--local", "Save key for audit/logging only \u2014 local config still controls all decisions").option("--profile <name>", 'Save as a named profile (default: "default")').action(async (apiKey, options) => {
+  if (options.profile && options.profile !== "default") {
+    const { profileName } = writeCredentialsAndConfig(apiKey, {
+      profileName: options.profile,
+      isLocal: options.local
+    });
+    console.log(chalk41.green(`\u2705 Profile "${profileName}" saved`));
+    console.log(chalk41.gray(`   Switch to it per-session:  NODE9_PROFILE=${profileName} claude`));
+    return;
+  }
+  if (options.local) {
+    writeCredentialsAndConfig(apiKey, { isLocal: true });
+    console.log(chalk41.green(`\u2705 Key saved \u2014 Privacy mode \u{1F6E1}\uFE0F`));
+    console.log(chalk41.gray(`   All decisions stay on this machine. Nothing syncs to the cloud.`));
+    return;
   }
+  const outcome = await onboardMachine(apiKey);
+  console.log(renderOnboardOutcome(outcome));
+  if (!outcome.ok) process.exitCode = 1;
 });
 program.command("signup").description("Create your node9 account / open the dashboard in your browser").option("--login", "Open the login page instead of signup").action((options) => {
   const route = options.login ? "auth/login" : "auth/signup";
   const url = `https://node9.ai/${route}?ref=cli_cmd`;
   console.log("");
-  console.log("  " + chalk40.dim("Opening ") + chalk40.cyan.underline(url));
+  console.log("  " + chalk41.dim("Opening ") + chalk41.cyan.underline(url));
   const opener = process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open";
   try {
     const child = spawn8(opener, [url], {
@@ -57445,7 +57535,7 @@ program.command("addto", { hidden: true }).description("Integrate Node9 with an
   if (target === "hermes") return setupHermes();
   if (target === "hud") return setupHud();
   console.error(
-    chalk40.red(
+    chalk41.red(
       `Unknown target: "${target}". Supported: claude, antigravity, copilot, gemini, cursor, codex, windsurf, vscode, hermes, hud`
     )
   );
@@ -57459,20 +57549,20 @@ program.command("setup", { hidden: true }).description('Alias for "addto" \u2014
   "The agent to protect: claude | antigravity | copilot | gemini | cursor | codex | windsurf | vscode | hud"
 ).action(async (target) => {
   if (!target) {
-    console.log(chalk40.cyan("\n\u{1F6E1}\uFE0F  Node9 Setup \u2014 integrate with your AI agent\n"));
-    console.log("  Usage:  " + chalk40.white("node9 setup <target>") + "\n");
+    console.log(chalk41.cyan("\n\u{1F6E1}\uFE0F  Node9 Setup \u2014 integrate with your AI agent\n"));
+    console.log("  Usage:  " + chalk41.white("node9 setup <target>") + "\n");
     console.log("  Targets:");
-    console.log("    " + chalk40.green("claude") + "    \u2014 Claude Code (hook mode)");
-    console.log("    " + chalk40.green("gemini") + "    \u2014 Gemini CLI (hook mode)");
-    console.log("    " + chalk40.green("antigravity") + " \u2014 Antigravity / agy (hook mode)");
-    console.log("    " + chalk40.green("copilot") + "   \u2014 GitHub Copilot CLI (hook mode)");
-    console.log("    " + chalk40.green("cursor") + "    \u2014 Cursor (MCP proxy)");
-    console.log("    " + chalk40.green("codex") + "     \u2014 OpenAI Codex CLI (MCP proxy)");
-    console.log("    " + chalk40.green("windsurf") + "  \u2014 Windsurf (MCP proxy)");
-    console.log("    " + chalk40.green("vscode") + "    \u2014 VSCode / Copilot (MCP proxy)");
-    console.log("    " + chalk40.green("hermes") + "    \u2014 Hermes Agent (hook mode)");
+    console.log("    " + chalk41.green("claude") + "    \u2014 Claude Code (hook mode)");
+    console.log("    " + chalk41.green("gemini") + "    \u2014 Gemini CLI (hook mode)");
+    console.log("    " + chalk41.green("antigravity") + " \u2014 Antigravity / agy (hook mode)");
+    console.log("    " + chalk41.green("copilot") + "   \u2014 GitHub Copilot CLI (hook mode)");
+    console.log("    " + chalk41.green("cursor") + "    \u2014 Cursor (MCP proxy)");
+    console.log("    " + chalk41.green("codex") + "     \u2014 OpenAI Codex CLI (MCP proxy)");
+    console.log("    " + chalk41.green("windsurf") + "  \u2014 Windsurf (MCP proxy)");
+    console.log("    " + chalk41.green("vscode") + "    \u2014 VSCode / Copilot (MCP proxy)");
+    console.log("    " + chalk41.green("hermes") + "    \u2014 Hermes Agent (hook mode)");
     process.stdout.write(
-      "    " + chalk40.green("hud") + "       \u2014 Claude Code security statusline\n"
+      "    " + chalk41.green("hud") + "       \u2014 Claude Code security statusline\n"
     );
     console.log("");
     return;
@@ -57489,7 +57579,7 @@ program.command("setup", { hidden: true }).description('Alias for "addto" \u2014
   if (t === "hermes") return setupHermes();
   if (t === "hud") return setupHud();
   console.error(
-    chalk40.red(
+    chalk41.red(
       `Unknown target: "${target}". Supported: claude, antigravity, copilot, gemini, cursor, codex, windsurf, vscode, hermes, hud`
     )
   );
@@ -57500,36 +57590,36 @@ program.command("removefrom", { hidden: true }).description("Remove Node9 hooks
   const agent = resolveAgentTeardown(target);
   if (!agent) {
     console.error(
-      chalk40.red(`Unknown target: "${target}". Supported: ${agentTeardownTargets().join(", ")}`)
+      chalk41.red(`Unknown target: "${target}". Supported: ${agentTeardownTargets().join(", ")}`)
     );
     process.exit(1);
     return;
   }
-  console.log(chalk40.cyan(`
+  console.log(chalk41.cyan(`
 \u{1F6E1}\uFE0F  Node9: removing hooks from ${agent.label}...
 `));
   try {
     agent.fn();
   } catch (err2) {
-    console.error(chalk40.red(`  \u26A0\uFE0F  Failed: ${err2 instanceof Error ? err2.message : String(err2)}`));
+    console.error(chalk41.red(`  \u26A0\uFE0F  Failed: ${err2 instanceof Error ? err2.message : String(err2)}`));
     process.exit(1);
   }
-  console.log(chalk40.gray("\n  Restart the agent for changes to take effect."));
+  console.log(chalk41.gray("\n  Restart the agent for changes to take effect."));
 });
 function undoLeftoverNote() {
   if (undoLeftoverPaths().length === 0) return "";
   return "\n  Snapshots from the removed undo feature also remain.\n  Remove them with: node9 undo --purge";
 }
 program.command("uninstall").description("Remove all Node9 hooks and optionally delete config files").option("--purge", "Also delete ~/.node9/ directory (config, audit log, credentials)").action(async (options) => {
-  console.log(chalk40.cyan("\n\u{1F6E1}\uFE0F  Node9 Uninstall\n"));
-  console.log(chalk40.bold("Stopping daemon..."));
+  console.log(chalk41.cyan("\n\u{1F6E1}\uFE0F  Node9 Uninstall\n"));
+  console.log(chalk41.bold("Stopping daemon..."));
   try {
     stopDaemon();
-    console.log(chalk40.green("  \u2705 Daemon stopped"));
+    console.log(chalk41.green("  \u2705 Daemon stopped"));
   } catch {
-    console.log(chalk40.blue("  \u2139\uFE0F  Daemon was not running"));
+    console.log(chalk41.blue("  \u2139\uFE0F  Daemon was not running"));
   }
-  console.log(chalk40.bold("\nRemoving hooks..."));
+  console.log(chalk41.bold("\nRemoving hooks..."));
   let teardownFailed = false;
   for (const { label: label2, fn } of AGENT_TEARDOWNS) {
     try {
@@ -57537,7 +57627,7 @@ program.command("uninstall").description("Remove all Node9 hooks and optionally
     } catch (err2) {
       teardownFailed = true;
       console.error(
-        chalk40.red(
+        chalk41.red(
           `  \u26A0\uFE0F  Failed to remove ${label2} hooks: ${err2 instanceof Error ? err2.message : String(err2)}`
         )
       );
@@ -57547,12 +57637,12 @@ program.command("uninstall").description("Remove all Node9 hooks and optionally
   try {
     const residual = getAgentWiring().filter((a) => a.wireState === "wired");
     if (residual.length === 0) {
-      console.log(chalk40.green("  \u2705 Verified \u2014 no node9 hooks or plugin shims remain"));
+      console.log(chalk41.green("  \u2705 Verified \u2014 no node9 hooks or plugin shims remain"));
     } else {
       teardownFailed = true;
-      console.error(chalk40.red("  \u26A0\uFE0F  Still wired after teardown:"));
+      console.error(chalk41.red("  \u26A0\uFE0F  Still wired after teardown:"));
       for (const a of residual) {
-        console.error(chalk40.red(`     \u2022 ${a.label} \u2014 ${a.settingsPath}`));
+        console.error(chalk41.red(`     \u2022 ${a.label} \u2014 ${a.settingsPath}`));
       }
     }
   } catch {
@@ -57569,11 +57659,11 @@ program.command("uninstall").description("Remove all Node9 hooks and optionally
         fs75.rmSync(node9Dir, { recursive: true });
         if (fs75.existsSync(node9Dir)) {
           console.error(
-            chalk40.red("\n  \u26A0\uFE0F  ~/.node9/ could not be fully deleted \u2014 remove it manually.")
+            chalk41.red("\n  \u26A0\uFE0F  ~/.node9/ could not be fully deleted \u2014 remove it manually.")
           );
         } else {
           console.log(
-            chalk40.green(
+            chalk41.green(
               `
   \u2705 Deleted ~/.node9/ (config, audit log, credentials${alsoSnapshots})`
             )
@@ -57581,27 +57671,27 @@ program.command("uninstall").description("Remove all Node9 hooks and optionally
         }
       } else {
         console.log(
-          chalk40.yellow(`
+          chalk41.yellow(`
   Skipped \u2014 ~/.node9/ was not deleted.${undoLeftoverNote()}`)
         );
       }
     } else {
-      console.log(chalk40.blue("\n  \u2139\uFE0F  ~/.node9/ not found \u2014 nothing to delete"));
+      console.log(chalk41.blue("\n  \u2139\uFE0F  ~/.node9/ not found \u2014 nothing to delete"));
     }
   } else {
     console.log(
-      chalk40.gray(
+      chalk41.gray(
         `
   ~/.node9/ kept \u2014 run with --purge to delete config and audit log${undoLeftoverNote()}`
       )
     );
   }
   if (teardownFailed) {
-    console.error(chalk40.red("\n  \u26A0\uFE0F  Some hooks could not be removed \u2014 see errors above."));
+    console.error(chalk41.red("\n  \u26A0\uFE0F  Some hooks could not be removed \u2014 see errors above."));
     process.exit(1);
   }
-  console.log(chalk40.green.bold("\n\u{1F6E1}\uFE0F  Node9 removed. Run: npm uninstall -g node9-ai"));
-  console.log(chalk40.gray("   Restart any open AI agent sessions for changes to take effect.\n"));
+  console.log(chalk41.green.bold("\n\u{1F6E1}\uFE0F  Node9 removed. Run: npm uninstall -g node9-ai"));
+  console.log(chalk41.gray("   Restart any open AI agent sessions for changes to take effect.\n"));
 });
 registerDoctorCommand(program, version);
 program.command("explain").description(
@@ -57614,7 +57704,7 @@ program.command("explain").description(
       try {
         args = JSON.parse(trimmed);
       } catch {
-        console.error(chalk40.red(`
+        console.error(chalk41.red(`
 \u274C Invalid JSON: ${trimmed}
 `));
         process.exit(1);
@@ -57625,62 +57715,62 @@ program.command("explain").description(
   }
   const result = await explainPolicy(tool, args);
   console.log("");
-  console.log(chalk40.cyan.bold("\u{1F6E1}\uFE0F  Node9 Explain"));
+  console.log(chalk41.cyan.bold("\u{1F6E1}\uFE0F  Node9 Explain"));
   console.log("");
-  console.log(`   ${chalk40.bold("Tool:")}    ${chalk40.white(result.tool)}`);
+  console.log(`   ${chalk41.bold("Tool:")}    ${chalk41.white(result.tool)}`);
   if (argsRaw) {
     const preview2 = argsRaw.length > 80 ? argsRaw.slice(0, 77) + "\u2026" : argsRaw;
-    console.log(`   ${chalk40.bold("Input:")}   ${chalk40.gray(preview2)}`);
+    console.log(`   ${chalk41.bold("Input:")}   ${chalk41.gray(preview2)}`);
   }
   console.log("");
-  console.log(chalk40.bold("Config Sources (Waterfall):"));
+  console.log(chalk41.bold("Config Sources (Waterfall):"));
   for (const tier of result.waterfall) {
-    const num3 = chalk40.gray(`  ${tier.tier}.`);
+    const num3 = chalk41.gray(`  ${tier.tier}.`);
     const label2 = tier.label.padEnd(16);
     let statusStr;
     if (tier.tier === 1) {
-      statusStr = chalk40.gray(tier.note ?? "");
+      statusStr = chalk41.gray(tier.note ?? "");
     } else if (tier.status === "active") {
-      const loc = tier.path ? chalk40.gray(tier.path) : "";
-      const note = tier.note ? chalk40.gray(`(${tier.note})`) : "";
-      statusStr = chalk40.green("\u2713 active") + (loc ? "  " + loc : "") + (note ? "  " + note : "");
+      const loc = tier.path ? chalk41.gray(tier.path) : "";
+      const note = tier.note ? chalk41.gray(`(${tier.note})`) : "";
+      statusStr = chalk41.green("\u2713 active") + (loc ? "  " + loc : "") + (note ? "  " + note : "");
     } else {
-      statusStr = chalk40.gray("\u25CB " + (tier.note ?? "not found"));
+      statusStr = chalk41.gray("\u25CB " + (tier.note ?? "not found"));
     }
-    console.log(`${num3} ${chalk40.white(label2)} ${statusStr}`);
+    console.log(`${num3} ${chalk41.white(label2)} ${statusStr}`);
   }
   console.log("");
-  console.log(chalk40.bold("Policy Evaluation:"));
+  console.log(chalk41.bold("Policy Evaluation:"));
   for (const step of result.steps) {
     const isFinal = step.isFinal;
     let icon;
-    if (step.outcome === "allow") icon = chalk40.green("  \u2705");
-    else if (step.outcome === "block") icon = chalk40.red("  \u{1F6D1}");
-    else if (step.outcome === "review") icon = chalk40.red("  \u{1F534}");
-    else if (step.outcome === "skip") icon = chalk40.gray("  \u2500 ");
-    else icon = chalk40.gray("  \u25CB ");
+    if (step.outcome === "allow") icon = chalk41.green("  \u2705");
+    else if (step.outcome === "block") icon = chalk41.red("  \u{1F6D1}");
+    else if (step.outcome === "review") icon = chalk41.red("  \u{1F534}");
+    else if (step.outcome === "skip") icon = chalk41.gray("  \u2500 ");
+    else icon = chalk41.gray("  \u25CB ");
     const name = step.name.padEnd(18);
-    const nameStr = isFinal ? chalk40.white.bold(name) : chalk40.white(name);
-    const detail = isFinal ? chalk40.white(step.detail) : chalk40.gray(step.detail);
-    const arrow = isFinal ? chalk40.yellow("  \u2190 STOP") : "";
+    const nameStr = isFinal ? chalk41.white.bold(name) : chalk41.white(name);
+    const detail = isFinal ? chalk41.white(step.detail) : chalk41.gray(step.detail);
+    const arrow = isFinal ? chalk41.yellow("  \u2190 STOP") : "";
     console.log(`${icon} ${nameStr} ${detail}${arrow}`);
   }
   console.log("");
   if (result.decision === "allow") {
-    console.log(chalk40.green.bold("  Decision: \u2705 ALLOW") + chalk40.gray("  \u2014 no approval needed"));
+    console.log(chalk41.green.bold("  Decision: \u2705 ALLOW") + chalk41.gray("  \u2014 no approval needed"));
   } else if (result.decision === "block") {
     console.log(
-      chalk40.red.bold("  Decision: \u{1F6D1} BLOCK") + chalk40.gray("  \u2014 this action is blocked")
+      chalk41.red.bold("  Decision: \u{1F6D1} BLOCK") + chalk41.gray("  \u2014 this action is blocked")
     );
     if (result.blockedByLabel) {
-      console.log(chalk40.gray(`  Reason:   ${result.blockedByLabel}`));
+      console.log(chalk41.gray(`  Reason:   ${result.blockedByLabel}`));
     }
   } else {
     console.log(
-      chalk40.red.bold("  Decision: \u{1F534} REVIEW") + chalk40.gray("  \u2014 human approval required")
+      chalk41.red.bold("  Decision: \u{1F534} REVIEW") + chalk41.gray("  \u2014 human approval required")
     );
     if (result.blockedByLabel) {
-      console.log(chalk40.gray(`  Reason:   ${result.blockedByLabel}`));
+      console.log(chalk41.gray(`  Reason:   ${result.blockedByLabel}`));
     }
   }
   console.log("");
@@ -57697,7 +57787,7 @@ program.command("tail").description("Stream live agent activity to the terminal"
   try {
     await startTail2(options);
   } catch (err2) {
-    console.error(chalk40.red(`\u274C ${err2 instanceof Error ? err2.message : String(err2)}`));
+    console.error(chalk41.red(`\u274C ${err2 instanceof Error ? err2.message : String(err2)}`));
     process.exit(1);
   }
 });
@@ -57708,7 +57798,7 @@ program.command("monitor").description("Live interactive dashboard \u2014 activi
     const mod = await dynamicImport(`file://${dashboardPath}`);
     await mod.startMonitor();
   } catch (err2) {
-    console.error(chalk40.red(`\u274C ${err2 instanceof Error ? err2.message : String(err2)}`));
+    console.error(chalk41.red(`\u274C ${err2 instanceof Error ? err2.message : String(err2)}`));
     process.exit(1);
   }
 });
@@ -57763,7 +57853,7 @@ program.command("pause").description("Temporarily disable Node9 protection for a
   const ms = parseDuration(options.duration);
   if (ms === null) {
     console.error(
-      chalk40.red(`
+      chalk41.red(`
 \u274C  Invalid duration: "${options.duration}". Use format like 15m, 1h, 30s.
 `)
     );
@@ -57771,20 +57861,20 @@ program.command("pause").description("Temporarily disable Node9 protection for a
   }
   pauseNode9(ms, options.duration);
   const expiresAt = new Date(Date.now() + ms).toLocaleTimeString();
-  console.log(chalk40.yellow(`
+  console.log(chalk41.yellow(`
 \u23F8  Node9 paused until ${expiresAt}`));
-  console.log(chalk40.gray(`   All tool calls will be allowed without review.`));
-  console.log(chalk40.gray(`   Run "node9 resume" to re-enable early.
+  console.log(chalk41.gray(`   All tool calls will be allowed without review.`));
+  console.log(chalk41.gray(`   Run "node9 resume" to re-enable early.
 `));
 });
 program.command("resume").description("Re-enable Node9 protection immediately").action(() => {
   const { paused } = checkPause();
   if (!paused) {
-    console.log(chalk40.gray("\nNode9 is already active \u2014 nothing to resume.\n"));
+    console.log(chalk41.gray("\nNode9 is already active \u2014 nothing to resume.\n"));
     return;
   }
   resumeNode9();
-  console.log(chalk40.green("\n\u25B6  Node9 resumed \u2014 protection is active.\n"));
+  console.log(chalk41.green("\n\u25B6  Node9 resumed \u2014 protection is active.\n"));
 });
 var HOOK_BASED_AGENTS = {
   claude: "claude",
@@ -57800,15 +57890,15 @@ program.argument("[command...]", "The agent command to run (e.g., gemini)").acti
     if (HOOK_BASED_AGENTS[firstArg2] !== void 0) {
       const target = HOOK_BASED_AGENTS[firstArg2];
       console.error(
-        chalk40.yellow(`
+        chalk41.yellow(`
 \u26A0\uFE0F  Node9 proxy mode does not support "${target}" directly.`)
       );
-      console.error(chalk40.white(`
+      console.error(chalk41.white(`
    "${target}" uses its own hook system. Use:`));
       console.error(
-        chalk40.green(`     node9 addto ${target}   `) + chalk40.gray("# one-time setup")
+        chalk41.green(`     node9 addto ${target}   `) + chalk41.gray("# one-time setup")
       );
-      console.error(chalk40.green(`     ${target}              `) + chalk40.gray("# run normally"));
+      console.error(chalk41.green(`     ${target}              `) + chalk41.gray("# run normally"));
       process.exit(1);
     }
     const runArgs = firstArg2 === "shell" ? commandArgs.slice(1) : commandArgs;
@@ -57825,7 +57915,7 @@ program.argument("[command...]", "The agent command to run (e.g., gemini)").acti
       }
     );
     if (result.noApprovalMechanism && !isDaemonRunning() && !process.env.NODE9_NO_AUTO_DAEMON && getConfig().settings.autoStartDaemon) {
-      console.error(chalk40.cyan("\n\u{1F6E1}\uFE0F  Node9: Starting approval daemon automatically..."));
+      console.error(chalk41.cyan("\n\u{1F6E1}\uFE0F  Node9: Starting approval daemon automatically..."));
       const daemonReady = await autoStartDaemonAndWait();
       if (daemonReady) result = await authorizeHeadless("shell", { command: fullCommand });
     }
@@ -57838,12 +57928,12 @@ program.argument("[command...]", "The agent command to run (e.g., gemini)").acti
     }
     if (!result.approved) {
       console.error(
-        chalk40.red(`
+        chalk41.red(`
 \u274C Node9 Blocked: ${result.reason || "Dangerous command detected."}`)
       );
       process.exit(1);
     }
-    console.error(chalk40.green("\n\u2705 Approved \u2014 running command...\n"));
+    console.error(chalk41.green("\n\u2705 Approved \u2014 running command...\n"));
     await runProxy(fullCommand);
   } else {
     program.help();