@node9/proxy 2.22.0 → 2.23.0

package/dist/cli.js

@@ -995,6 +995,7 @@ function normalizeCommandForPolicyImpl(command) {
         const source = command.slice(s, e);
         if (resolved === source) continue;
         if (resolved === "" || /\s/.test(resolved)) continue;
+        if (/^[;&|()<>]+$/.test(resolved)) continue;
         rewrites.push([s, e, resolved]);
         const quoteOnly = source.replace(/['"]/g, "");
         if (quoteOnly !== source) quoteOnlyRewrites.push([s, e, quoteOnly]);
@@ -1344,23 +1345,147 @@ function extractLiteralArgs(callExpr) {
   const args = positionedArgs(words);
   return { name, flags, paths: args.map((a) => a.value), words, args };
 }
+function payloadKey(payload) {
+  if (!assignmentTable || assignmentTable.size === 0) return payload;
+  const bindings = [];
+  for (const [name, rec] of assignmentTable) {
+    if (rec.value !== null) bindings.push(`${name}=${rec.value}`);
+  }
+  return `${payload}\0${bindings.sort().join("
")}`;
+}
+function claimPayload(payload) {
+  if (!seenPayloads) return "ok";
+  const key = payloadKey(payload);
+  if (seenPayloads.has(key)) return "seen";
+  if (payloadBudget <= 0) return "exhausted";
+  payloadBudget--;
+  seenPayloads.add(key);
+  return "ok";
+}
+function recordTopLevelAssignments(f) {
+  const stmts = Array.isArray(f?.Stmts) ? f.Stmts : [];
+  for (const stmt of stmts) recordTopLevelStmt(stmt);
+}
+function probeBinOp(src) {
+  try {
+    const cmd = syntax.NewParser().Parse(src, "probe")?.Stmts?.[0]?.Cmd;
+    if (cmd && syntax.NodeType(cmd) === "BinaryCmd") return cmd.Op;
+  } catch {
+  }
+  return null;
+}
+function recordTopLevelStmt(stmt) {
+  if (!stmt || !stmt.Cmd) return false;
+  const t = syntax.NodeType(stmt.Cmd);
+  if (t === "BinaryCmd") {
+    if (!AND_OR_OPS.has(stmt.Cmd.Op)) return false;
+    if (!recordTopLevelStmt(stmt.Cmd.X)) return false;
+    if (stmt.Cmd.Op === AND_OP) return recordTopLevelStmt(stmt.Cmd.Y);
+    return true;
+  }
+  if (t !== "CallExpr" && t !== "DeclClause") return false;
+  let at = 0;
+  try {
+    at = stmt.Pos().Offset();
+  } catch {
+    at = 0;
+  }
+  recordAssignments(stmt.Cmd, at);
+  if (stmt.Negated) return false;
+  if (t === "DeclClause") return ASSIGNMENT_HEADS.has(stmt.Cmd.Variant?.Value ?? "");
+  return (stmt.Cmd.Args || []).length === 0 && (stmt.Cmd.Assigns || []).length > 0;
+}
+function recordAssignments(n, at) {
+  if (!assignmentTable) return;
+  const t = syntax.NodeType(n);
+  let assigns = [];
+  if (t === "CallExpr") {
+    if ((n.Args || []).length > 0) return;
+    assigns = n.Assigns || [];
+  } else if (t === "DeclClause") {
+    if (!ASSIGNMENT_HEADS.has(n.Variant?.Value ?? "")) return;
+    assigns = (n.Args || []).filter((a) => syntax.NodeType(a) === "Assign");
+  } else return;
+  for (const a of assigns) {
+    const name = a?.Name?.Value;
+    if (!name || !a.Value || a.Append) continue;
+    assignmentTable.set(name, { value: resolveWordLiteral(a.Value), at });
+  }
+}
+function resolveTrivialSubst(part) {
+  if (syntax.NodeType(part) !== "CmdSubst") return void 0;
+  const stmts = part.Stmts || [];
+  if (stmts.length !== 1) return void 0;
+  const st = stmts[0];
+  if ((st.Redirs || []).length > 0 || st.Negated || st.Background) return void 0;
+  const cmd = st.Cmd;
+  if (!cmd || syntax.NodeType(cmd) !== "CallExpr") return void 0;
+  if ((cmd.Assigns || []).length > 0) return void 0;
+  const words = (cmd.Args || []).map((a) => resolveWordLiteral(a));
+  if (words.length === 0 || words.some((w) => w === null)) return void 0;
+  const head = baseWord(words[0]);
+  const rest = words.slice(1);
+  if (head === "echo") {
+    let i = 0;
+    while (i < rest.length && /^-[neE]+$/.test(rest[i])) i++;
+    return rest.slice(i).join(" ");
+  }
+  if (head === "printf") {
+    if (rest.length !== 2) return void 0;
+    if (!/^%s(\\n)?$/.test(rest[0])) return void 0;
+    return rest[1];
+  }
+  return void 0;
+}
+function recordedExpansion(name) {
+  if (!assignmentTable || !name) return void 0;
+  const rec = assignmentTable.get(name);
+  if (rec === void 0 || rec.at >= currentStmtOffset) return void 0;
+  return rec.value;
+}
+function isPlainParam(p) {
+  if (syntax.NodeType(p) !== "ParamExp") return false;
+  return !(p.Excl || p.Length || p.Width || p.Index || p.Slice || p.Repl || p.Exp);
+}
+function expandPlainParam(p) {
+  if (!assignmentTable) return void 0;
+  if (!isPlainParam(p)) return void 0;
+  const recorded = recordedExpansion(p.Param?.Value);
+  if (recorded !== void 0) return recorded;
+  return HOME_VARIABLES.has(p.Param?.Value) ? "~" : void 0;
+}
 function resolveWordLiteral(w) {
   const parts = w?.Parts || [];
   let s = "";
   for (const p of parts) {
-    const t = syntax.NodeType(p);
-    if (t === "Lit") s += (p.Value ?? "").replace(/\\(.)/g, "$1");
-    else if (t === "SglQuoted") s += p.Value ?? "";
-    else if (t === "DblQuoted") {
-      const inner = p.Parts || [];
-      if (!inner.every((ip) => syntax.NodeType(ip) === "Lit")) return null;
-      s += inner.map((ip) => ip.Value ?? "").join("");
-    } else {
-      return null;
-    }
+    const piece = resolvePart(p, false);
+    if (piece === void 0 || piece === null) return null;
+    s += piece;
   }
   return s;
 }
+function resolvePart(p, inQuotes) {
+  const t = syntax.NodeType(p);
+  if (t === "Lit") {
+    const raw = p.Value ?? "";
+    if (!inQuotes) return raw.replace(/\\(.)/g, "$1");
+    return assignmentTable ? raw.replace(/\\([$`"\\])/g, "$1") : raw;
+  }
+  if (t === "SglQuoted") return p.Value ?? "";
+  if (t === "ParamExp") return expandPlainParam(p);
+  if (t === "CmdSubst") return assignmentTable ? resolveTrivialSubst(p) : void 0;
+  if (t === "DblQuoted" && !inQuotes) {
+    const inner = p.Parts || [];
+    let out = "";
+    for (const ip of inner) {
+      const piece = resolvePart(ip, true);
+      if (piece === void 0 || piece === null) return piece;
+      out += piece;
+    }
+    return out;
+  }
+  return void 0;
+}
 function parseDestHost(token) {
   if (!token) return null;
   let t = token.trim();
@@ -1415,6 +1540,7 @@ function destTokensForBinary(binary, args) {
     case "ssh":
       return positionals.slice(0, 1);
     case "scp":
+    case "rsync":
       return positionals.filter((p) => p.includes(":") || p.includes("@"));
     case "nc":
     case "ncat":
@@ -1604,17 +1730,35 @@ function analyzeFsOperationImpl(command, depth = 0) {
   const f = parseShared(command);
   if (f === PARSE_FAIL) return null;
   let result = null;
+  const outerTable = assignmentTable;
+  const outerOffset = currentStmtOffset;
+  const outerSeen = seenPayloads;
+  const outerBudget = payloadBudget;
+  if (depth === 0) {
+    seenPayloads = /* @__PURE__ */ new Set();
+    payloadBudget = PAYLOAD_BUDGET;
+  }
+  assignmentTable = new Map(
+    [...outerTable ?? []].map(([k, r]) => [k, { value: r.value, at: -1 }])
+  );
+  currentStmtOffset = Number.MAX_SAFE_INTEGER;
   try {
+    recordTopLevelAssignments(f);
     syntax.Walk(f, (node) => {
       if (!node || result?.verdict === "block") return false;
       const n = node;
       const nodeType = syntax.NodeType(n);
       if (nodeType === "Stmt") {
+        try {
+          currentStmtOffset = n.Pos().Offset();
+        } catch {
+          currentStmtOffset = Number.MAX_SAFE_INTEGER;
+        }
         result = stricter(result, jailedRedirectRead(n));
         return result?.verdict !== "block";
       }
       if (nodeType !== "CallExpr") return true;
-      const { name, flags, paths, words, args } = extractLiteralArgs(n);
+      const { name, flags, paths, words } = extractLiteralArgs(n);
       if (!name) return true;
       if (name === "rm") {
         const flagStr = flags.join("").toLowerCase();
@@ -1643,9 +1787,30 @@ function analyzeFsOperationImpl(command, depth = 0) {
           }
         }
       }
-      if (depth < 1) {
+      if (depth < 24 && name === "find") {
+        for (const action of findActions(words, 0)) {
+          const h = unwrapCommandHead(action);
+          const inner = literalShellPayload(action.slice(h), baseWord(action[h]));
+          if (inner === null) continue;
+          const claim = claimPayload(inner);
+          if (claim === "exhausted") {
+            result = stricter(result, UNANALYSABLE_NESTING);
+            continue;
+          }
+          if (claim === "seen") continue;
+          const v = analyzeFsOperationImpl(inner, depth + 1);
+          result = stricter(result, v);
+          if (result?.verdict === "block") return false;
+        }
+      }
+      if (depth < 24) {
         const payload = literalShellPayload(words, name);
-        if (payload !== null) {
+        const claim = payload === null ? "seen" : claimPayload(payload);
+        if (claim === "exhausted") {
+          result = stricter(result, UNANALYSABLE_NESTING);
+          return true;
+        }
+        if (payload !== null && claim === "ok") {
           const inner = analyzeFsOperationImpl(payload, depth + 1);
           if (inner) {
             result = inner;
@@ -1654,7 +1819,7 @@ function analyzeFsOperationImpl(command, depth = 0) {
           return true;
         }
       }
-      const readPaths = FS_READ_TOOLS.has(name) ? [...readTargets(name, args, flags, words, 1), ...flagOperandFiles(name, words, 1)] : wrappedReadPaths(words, name);
+      const readPaths = FS_READ_TOOLS.has(name) ? readerPaths(words, 0) : wrappedReadPaths(words, name);
       if (readPaths) {
         for (const p of readPaths) {
           result = stricter(result, matchSensitivePath2(p));
@@ -1669,6 +1834,11 @@ function analyzeFsOperationImpl(command, depth = 0) {
     return result;
   } catch {
     return null;
+  } finally {
+    assignmentTable = outerTable;
+    currentStmtOffset = outerOffset;
+    seenPayloads = outerSeen;
+    if (depth === 0) payloadBudget = outerBudget;
   }
 }
 function stricter(a, b) {
@@ -1725,6 +1895,18 @@ function resolveCopyShape(words, h) {
   }
   return null;
 }
+function findAction(words, k) {
+  const end = words.findIndex((w, i) => i > k && (w === ";" || w === "+"));
+  return words.slice(k + 1, end < 0 ? words.length : end);
+}
+function findActions(words, h) {
+  const out = [];
+  for (let i = h + 1; i < words.length; i++) {
+    const w = words[i];
+    if (w !== null && FIND_EXEC_FLAGS.has(w)) out.push(findAction(words, i));
+  }
+  return out;
+}
 function findStartPoints(words, h) {
   const k = words.findIndex((w, i) => i > h && w !== null && FIND_EXEC_FLAGS.has(w));
   if (k < 0) return { k, starts: [] };
@@ -1740,8 +1922,13 @@ function copySourcePaths(words) {
   if (fi >= 0) {
     const { k, starts } = findStartPoints(words, fi);
     if (k < 0) return [];
-    const action = unwrapCommandHead(words.slice(k + 1));
-    return resolveCopyShape(words.slice(k + 1), action) ? starts : [];
+    const out = [];
+    for (const action of findActions(words, fi)) {
+      const h2 = unwrapCommandHead(action);
+      if (!resolveCopyShape(action, h2)) continue;
+      out.push(...starts, ...copySourcePaths(action));
+    }
+    return out;
   }
   if (!COPY_VERB_HEADS.has(baseWord(words[h]))) return [];
   const r = resolveCopyShape(words, h);
@@ -1918,6 +2105,15 @@ function flagEffect(token, shape, known) {
   }
   return NONE;
 }
+function readerPaths(words, h) {
+  const head = baseWord(words[h]);
+  const from = h + 1;
+  const flags = words.slice(from).filter((w) => w !== null && w.startsWith("-"));
+  return [
+    ...readTargets(head, positionedArgs(words, from), flags, words, from),
+    ...flagOperandFiles(head, words, from)
+  ];
+}
 function readTargets(verb, args, flags, words = [], from = 1) {
   const shape = PATTERN_VERBS[verb];
   if (!shape) return args.map((a) => a.value);
@@ -1999,18 +2195,21 @@ function flagOperandFiles(verb, words, from) {
 function wrappedReadPaths(words, name) {
   if (name === "find") {
     const { k, starts } = findStartPoints(words, 0);
-    return k > 0 && isReaderWord(words[k + 1] ?? null) ? starts : null;
+    if (k < 0) return null;
+    const paths = [];
+    let reads = false;
+    for (const action of findActions(words, 0)) {
+      const h2 = unwrapCommandHead(action);
+      if (!isReaderWord(action[h2] ?? null)) continue;
+      reads = true;
+      paths.push(...readerPaths(action, h2));
+    }
+    return reads ? [...starts, ...paths] : paths;
   }
   if (!COMMAND_WRAPPERS.has(name) && !RUNNER_WRAPPERS.has(name)) return null;
   const h = unwrapCommandHead(words);
   if (h <= 0 || !isReaderWord(words[h] ?? null)) return null;
-  const head = baseWord(words[h]);
-  const rest = words.slice(h + 1);
-  const restFlags = rest.filter((w) => w !== null && w.startsWith("-"));
-  return [
-    ...readTargets(head, positionedArgs(words, h + 1), restFlags, words, h + 1),
-    ...flagOperandFiles(head, words, h + 1)
-  ];
+  return readerPaths(words, h);
 }
 function literalShellPayload(words, name) {
   const h = COMMAND_WRAPPERS.has(name) || RUNNER_WRAPPERS.has(name) ? unwrapCommandHead(words) : 0;
@@ -3773,7 +3972,7 @@ function* stringValues(obj, depth = 0) {
   }
   for (const v of Object.values(obj)) yield* stringValues(v, depth + 1);
 }
-var import_safe_regex2, import_crypto3, import_mvdan_sh, import_picomatch, import_safe_regex22, import_safe_regex23, import_crypto4, IBAN_LENGTH, B58, B58_INDEX, XPRV_VERSIONS, MAX, UNTRUSTED_TOOLS, SIGNALS, ASSIGNMENT_CONTEXT_RE, DLP_STOPWORDS, DLP_PATTERNS, DLP_PATTERNS_GLOBAL, SENSITIVE_PATH_PATTERNS, MAX_DEPTH, MAX_STRING_BYTES, MAX_JSON_PARSE_BYTES, DLP_SCAN_LIMITS, MAX_REGEX_LENGTH, REGEX_CACHE_MAX, regexCache, FORBIDDEN_PATH_SEGMENTS, syntax, sharedParser, MESSAGE_FLAGS, SHELL_INTERPRETERS, DOWNLOAD_CMDS, NORMALIZE_CACHE_MAX, normalizeCache, AST_CACHE_MAX, astCache, PARSE_FAIL, FS_READ_TOOLS, GREP_SHAPE, PATTERN_VERBS, PATTERN_VERB_NAMES, GREP_FILE_OPERANDS, READER_VALUE_LETTERS, FILE_OPERAND_FLAGS, SCP_VALUE_FLAGS, TAR_VALUE_LETTERS, ZIP_VALUE_LETTERS, RSYNC_VALUE_LETTERS, RSYNC_SKIP, CP_VALUE_LETTERS, INSTALL_VALUE_LETTERS, COPY_VERBS, TAR_MODE_WORD, COPY_VERB_HEADS, FS_OP_PRESCREEN_RE, HOME_CACHE_ALLOWLIST, SENSITIVE_PATH_RULES, BASH_TOOL_NAMES, AST_FS_REGEX_RULES, SQL_DB_CLIS, SQL_DDL_RE, CHMOD_OPEN_PERM_TOKENS, COMMAND_WRAPPERS, INLINE_INTERPRETER, RUNNER_WRAPPERS, _redirStdinOps, _listOps, WRAPPER_TAKES_TARGET, FIND_EXEC_FLAGS, INTERP_LEADING_TARGET, NET_BINARIES, VALUE_FLAGS, FS_OP_CACHE_MAX, fsOpCache, stripDotSlash, REDIR_TRUNCATE_OPS, REDIR_FILE_IN_OPS, REDIR_HEREDOC_OPS, FIND_OPTIONS, COPY_RULE_OF, isReaderWord, positionalAfter, NONE, UNKNOWN, SSRF_MAX_HOST, METADATA_ADDRESSES, STRICT_TIERS, METADATA_HOSTNAMES, v4Octets, TIER_REASON, DEFAULT_EGRESS_ALLOWLIST, PRIVATE_HOST_SUFFIXES, SOURCE_COMMANDS, SINK_COMMANDS, OBFUSCATORS, SENSITIVE_PATTERNS, FLAGS_WITH_VALUES, DESTINATION_ARGS, VERDICT_RANK, SQL_DML_KEYWORDS, TERMINAL_ESCAPE_RE, CONTROL_CHAR_RE, aws_default, bash_safe_default, docker_default, filesystem_default, github_default, k8s_default, mongodb_default, postgres_default, project_jail_default, redis_default, BUILTIN_SHIELDS, LOOP_MAX_RECORDS, FINDING_TO_SIGNAL, SCAN_SIGNAL_WEIGHTS, LOOP_THRESHOLD_FOR_WASTE, MAX_BLAST_PATH, DESTRUCTIVE_OP_RE, SENSITIVE_PATH_RE, FILE_TOOLS, PII_EMAIL_RE, PII_SSN_RE, PII_PHONE_RE, PII_CC16_RE, PII_CC15_RE, PII_IBAN_RE, REALTIME_PII_PATTERNS, MAX_PII_SCAN_BYTES, CANARY_MIN_LENGTH, MAX_TEXT, MAX_DEPTH2, MAX_JSON_PARSE, URL_DEPTH, B64_DEPTH, MIN_SEGMENT, SEPARATORS, stripSeparators, looksText, CANARY_DECODERS, VIEWS, LONG_OUTPUT_THRESHOLD_BYTES, CANONICAL_EXTRACTOR_VERSION, DEDUPE_PREVIEW_LEN, ENGINE_VERSION;
+var import_safe_regex2, import_crypto3, import_mvdan_sh, import_picomatch, import_safe_regex22, import_safe_regex23, import_crypto4, IBAN_LENGTH, B58, B58_INDEX, XPRV_VERSIONS, MAX, UNTRUSTED_TOOLS, SIGNALS, ASSIGNMENT_CONTEXT_RE, DLP_STOPWORDS, DLP_PATTERNS, DLP_PATTERNS_GLOBAL, SENSITIVE_PATH_PATTERNS, MAX_DEPTH, MAX_STRING_BYTES, MAX_JSON_PARSE_BYTES, DLP_SCAN_LIMITS, MAX_REGEX_LENGTH, REGEX_CACHE_MAX, regexCache, FORBIDDEN_PATH_SEGMENTS, syntax, sharedParser, MESSAGE_FLAGS, SHELL_INTERPRETERS, DOWNLOAD_CMDS, NORMALIZE_CACHE_MAX, normalizeCache, AST_CACHE_MAX, astCache, PARSE_FAIL, FS_READ_TOOLS, GREP_SHAPE, PATTERN_VERBS, PATTERN_VERB_NAMES, GREP_FILE_OPERANDS, READER_VALUE_LETTERS, FILE_OPERAND_FLAGS, SCP_VALUE_FLAGS, TAR_VALUE_LETTERS, ZIP_VALUE_LETTERS, RSYNC_VALUE_LETTERS, RSYNC_SKIP, CP_VALUE_LETTERS, INSTALL_VALUE_LETTERS, COPY_VERBS, TAR_MODE_WORD, COPY_VERB_HEADS, FS_OP_PRESCREEN_RE, HOME_CACHE_ALLOWLIST, SENSITIVE_PATH_RULES, BASH_TOOL_NAMES, AST_FS_REGEX_RULES, SQL_DB_CLIS, SQL_DDL_RE, CHMOD_OPEN_PERM_TOKENS, COMMAND_WRAPPERS, INLINE_INTERPRETER, RUNNER_WRAPPERS, _redirStdinOps, _listOps, WRAPPER_TAKES_TARGET, FIND_EXEC_FLAGS, INTERP_LEADING_TARGET, NET_BINARIES, VALUE_FLAGS, HOME_VARIABLES, assignmentTable, currentStmtOffset, PAYLOAD_BUDGET, payloadBudget, seenPayloads, UNANALYSABLE_NESTING, ASSIGNMENT_HEADS, AND_OP, OR_OP, AND_OR_OPS, FS_OP_CACHE_MAX, fsOpCache, stripDotSlash, REDIR_TRUNCATE_OPS, REDIR_FILE_IN_OPS, REDIR_HEREDOC_OPS, FIND_OPTIONS, COPY_RULE_OF, isReaderWord, positionalAfter, NONE, UNKNOWN, SSRF_MAX_HOST, METADATA_ADDRESSES, STRICT_TIERS, METADATA_HOSTNAMES, v4Octets, TIER_REASON, DEFAULT_EGRESS_ALLOWLIST, PRIVATE_HOST_SUFFIXES, SOURCE_COMMANDS, SINK_COMMANDS, OBFUSCATORS, SENSITIVE_PATTERNS, FLAGS_WITH_VALUES, DESTINATION_ARGS, VERDICT_RANK, SQL_DML_KEYWORDS, TERMINAL_ESCAPE_RE, CONTROL_CHAR_RE, aws_default, bash_safe_default, docker_default, filesystem_default, github_default, k8s_default, mongodb_default, postgres_default, project_jail_default, redis_default, BUILTIN_SHIELDS, LOOP_MAX_RECORDS, FINDING_TO_SIGNAL, SCAN_SIGNAL_WEIGHTS, LOOP_THRESHOLD_FOR_WASTE, MAX_BLAST_PATH, DESTRUCTIVE_OP_RE, SENSITIVE_PATH_RE, FILE_TOOLS, PII_EMAIL_RE, PII_SSN_RE, PII_PHONE_RE, PII_CC16_RE, PII_CC15_RE, PII_IBAN_RE, REALTIME_PII_PATTERNS, MAX_PII_SCAN_BYTES, CANARY_MIN_LENGTH, MAX_TEXT, MAX_DEPTH2, MAX_JSON_PARSE, URL_DEPTH, B64_DEPTH, MIN_SEGMENT, SEPARATORS, stripSeparators, looksText, CANARY_DECODERS, VIEWS, LONG_OUTPUT_THRESHOLD_BYTES, CANONICAL_EXTRACTOR_VERSION, DEDUPE_PREVIEW_LEN, ENGINE_VERSION;
 var init_dist = __esm({
   "packages/policy-engine/dist/index.mjs"() {
     "use strict";
@@ -5158,6 +5357,60 @@ var init_dist = __esm({
       "rsync"
     ]);
     VALUE_FLAGS = {
+      // rsync 3.2.7, its own --help: every flag whose operand could be mistaken for
+      // a host. `-e ssh` is the one that matters most (`ssh` is not the destination).
+      rsync: /* @__PURE__ */ new Set([
+        "-e",
+        "--rsh",
+        "-f",
+        "--filter",
+        "-T",
+        "--temp-dir",
+        "-B",
+        "--block-size",
+        "-M",
+        "--remote-option",
+        "--exclude",
+        "--exclude-from",
+        "--include",
+        "--include-from",
+        "--files-from",
+        "--compare-dest",
+        "--copy-dest",
+        "--link-dest",
+        "--partial-dir",
+        "--log-file",
+        "--password-file",
+        "--bwlimit",
+        "--timeout",
+        "--contimeout",
+        "--port",
+        "--sockopts",
+        "--address",
+        "--chmod",
+        "--chown",
+        "--max-size",
+        "--min-size",
+        "--modify-window",
+        "--out-format",
+        "--log-file-format",
+        "--backup-dir",
+        "--suffix",
+        "--iconv",
+        "--max-delete",
+        "--checksum-choice",
+        "--info",
+        "--debug",
+        "--stderr",
+        "--outbuf",
+        "--skip-compress",
+        "--usermap",
+        "--groupmap",
+        "--mkpath",
+        "--write-batch",
+        "--read-batch",
+        "--only-write-batch"
+      ]),
       curl: /* @__PURE__ */ new Set([
         "-d",
         "--data",
@@ -5241,6 +5494,22 @@ var init_dist = __esm({
       ]),
       nc: /* @__PURE__ */ new Set(["-p", "-s", "-w", "-X", "-x", "-e", "-g", "-G", "-i", "-O", "-T", "-q", "-m"])
     };
+    HOME_VARIABLES = /* @__PURE__ */ new Set(["HOME", "USERPROFILE"]);
+    assignmentTable = null;
+    currentStmtOffset = Number.MAX_SAFE_INTEGER;
+    PAYLOAD_BUDGET = 256;
+    payloadBudget = 0;
+    seenPayloads = null;
+    UNANALYSABLE_NESTING = {
+      ruleName: "review-unanalysable-nesting",
+      verdict: "review",
+      reason: "This command nests more wrapped shell payloads than the policy engine will unwrap, so some of what it runs was not read.",
+      path: ""
+    };
+    ASSIGNMENT_HEADS = /* @__PURE__ */ new Set(["export", "declare", "local", "readonly", "typeset"]);
+    AND_OP = probeBinOp("a && b");
+    OR_OP = probeBinOp("a || b");
+    AND_OR_OPS = new Set([AND_OP, OR_OP].filter((o) => o !== null));
     FS_OP_CACHE_MAX = 5e3;
     fsOpCache = /* @__PURE__ */ new Map();
     stripDotSlash = (p) => p.replace(/^\.\//, "");
@@ -6317,7 +6586,7 @@ var init_dist = __esm({
       { view: "separators-stripped", decoder: "separators", stripped: true }
     ];
     LONG_OUTPUT_THRESHOLD_BYTES = 100 * 1024;
-    CANONICAL_EXTRACTOR_VERSION = "canonical-v17";
+    CANONICAL_EXTRACTOR_VERSION = "canonical-v18";
     DEDUPE_PREVIEW_LEN = 120;
     ENGINE_VERSION = "1.4.0";
   }
@@ -10710,116 +10979,284 @@ var init_core = __esm({
   }
 });
 
-// src/utils/platform-shell.ts
-function locatorCommand() {
-  return process.platform === "win32" ? "where" : "which";
-}
-function shellInvocation(command) {
-  if (process.platform === "win32") {
-    return {
-      file: process.env.ComSpec || "cmd.exe",
-      args: ["/d", "/s", "/c", command]
-    };
-  }
-  return { file: "/bin/bash", args: ["-c", command] };
-}
-var init_platform_shell = __esm({
-  "src/utils/platform-shell.ts"() {
-    "use strict";
-  }
-});
-
-// src/codex-trust.ts
-function readTomlSafe(filePath) {
+// src/agent-wiring.ts
+function readJson(filePath) {
+  if (!import_fs16.default.existsSync(filePath)) return null;
   try {
-    return (0, import_smol_toml.parse)(import_fs16.default.readFileSync(filePath, "utf-8"));
+    return JSON.parse(import_fs16.default.readFileSync(filePath, "utf-8"));
   } catch {
-    return null;
+    return "invalid";
   }
 }
-function lastCodexAuditTs(auditLogPath) {
-  let text;
+function matchersHaveNode9Hook(matchers) {
+  return (matchers ?? []).some((m) => (m.hooks ?? []).some((h) => isNode9Hook(h.command)));
+}
+function flatHaveNode9Hook(entries) {
+  return (Array.isArray(entries) ? entries : []).some((h) => isNode9Hook(h.command));
+}
+function readHookRoot(filePath, format) {
+  if (!import_fs16.default.existsSync(filePath)) return "absent";
+  let raw;
   try {
-    text = import_fs16.default.readFileSync(auditLogPath, "utf-8");
+    raw = import_fs16.default.readFileSync(filePath, "utf-8");
   } catch {
-    return null;
+    return "absent";
   }
-  let newest = null;
-  for (const line of text.split("\n")) {
-    if (!line.includes('"Codex"')) continue;
-    try {
-      const row = JSON.parse(line);
-      if (row.agent !== "Codex" || typeof row.ts !== "string") continue;
-      if (newest === null || row.ts > newest) newest = row.ts;
-    } catch {
-    }
+  try {
+    const parsed = format === "yaml" ? yaml.parse(raw) : JSON.parse(raw);
+    return parsed?.hooks ?? {};
+  } catch {
+    return "invalid";
   }
-  return newest;
 }
-function assessCodexTrustFrom(input) {
-  const { hooksDisabled, trustEntries, hooksWrittenAt, lastCodexActivityAt } = input;
-  let state;
-  if (hooksDisabled) state = "disabled";
-  else if (trustEntries === 0) state = "never-trusted";
-  else if (hooksWrittenAt && lastCodexActivityAt && lastCodexActivityAt > hooksWrittenAt) {
-    state = "observed";
-  } else state = "unverified";
-  return { state, hooksWrittenAt, lastCodexActivityAt, trustEntries };
+function eventWired(root, ev, format) {
+  const arr = root[ev.key];
+  if (format === "matcher") return matchersHaveNode9Hook(arr);
+  return flatHaveNode9Hook(arr);
 }
-function assessCodexTrust(home = import_os13.default.homedir(), auditLogPath = import_path17.default.join(home, ".node9", "audit.log")) {
-  const hooksPath = import_path17.default.join(home, ".codex", "hooks.json");
-  const configPath = import_path17.default.join(home, ".codex", "config.toml");
-  let hooksWrittenAt = null;
+function detectMcp(servers) {
+  const entries = Object.entries(servers ?? {});
+  const present = entries.some(([, s]) => s?.command === "node9");
+  const wrapped = entries.filter(([, s]) => s?.command === "node9" && Array.isArray(s.args) && s.args.length > 0).map(([name, s]) => `${name} \u2192 ${s.args.join(" ")}`);
+  return { wrapped, present };
+}
+function readMcpServers(filePath, format) {
+  if (!import_fs16.default.existsSync(filePath)) return {};
   try {
-    hooksWrittenAt = import_fs16.default.statSync(hooksPath).mtime.toISOString();
+    if (format === "toml") {
+      const parsed2 = (0, import_smol_toml.parse)(import_fs16.default.readFileSync(filePath, "utf-8"));
+      return parsed2?.mcp_servers ?? {};
+    }
+    const parsed = readJson(filePath);
+    if (parsed === null || parsed === "invalid") return {};
+    return parsed.mcpServers ?? {};
   } catch {
-    hooksWrittenAt = null;
+    return {};
   }
-  const config = readTomlSafe(configPath);
-  const hooksDisabled = config?.features?.hooks === false || config?.codex_hooks === false;
-  const trustEntries = Object.keys(config?.hooks?.state ?? {}).length;
-  return assessCodexTrustFrom({
-    hooksDisabled,
-    trustEntries,
-    hooksWrittenAt,
-    lastCodexActivityAt: lastCodexAuditTs(auditLogPath)
-  });
 }
-function findCodexTui(env = process.env) {
+function readMcp(filePath, format) {
+  if (!import_fs16.default.existsSync(filePath)) return { wrapped: [], present: false };
   try {
-    const r = (0, import_child_process2.spawnSync)(locatorCommand(), ["codex"], { encoding: "utf-8", timeout: 3e3 });
-    const first = (r.stdout ?? "").split(/\r?\n/).find((l) => l.trim());
-    if (r.status === 0 && first) return "codex";
-  } catch {
-  }
-  if (process.platform === "win32" && env.LOCALAPPDATA) {
-    const binDir = import_path17.default.join(env.LOCALAPPDATA, "OpenAI", "Codex", "bin");
-    try {
-      for (const d of import_fs16.default.readdirSync(binDir)) {
-        const exe = import_path17.default.join(binDir, d, "codex.exe");
-        if (import_fs16.default.existsSync(exe)) return `"${exe}"`;
-      }
-    } catch {
+    if (format === "toml") {
+      const parsed2 = (0, import_smol_toml.parse)(import_fs16.default.readFileSync(filePath, "utf-8"));
+      return detectMcp(parsed2?.mcp_servers);
     }
+    const parsed = readJson(filePath);
+    if (parsed === null || parsed === "invalid") return { wrapped: [], present: false };
+    return detectMcp(parsed.mcpServers);
+  } catch {
+    return { wrapped: [], present: false };
   }
-  return null;
 }
-function codexTrustInstruction(tui = findCodexTui()) {
-  const where = tui ? `run ${tui} in a terminal` : "run the Codex CLI (`codex`) in a terminal \u2014 the desktop app has no hook review screen";
-  return `    \u279C  Codex must trust these hooks once: ${where},
-       then choose "Trust all and continue" when Codex asks to review them.
-       Until then Codex runs unprotected. Every rewrite of hooks.json needs this again.`;
+function getAgentWiring(home = import_os13.default.homedir()) {
+  const detected = detectAgents(home);
+  return AGENT_SPECS.map((spec) => {
+    const present = spec.present(home);
+    const pad = spec.labelPad ?? DEFAULT_LABEL_PAD;
+    let hooks;
+    let wireState;
+    let hookLabel;
+    let settingsPath;
+    if (spec.shimFile) {
+      const shimWired = exists(spec.shimFile(home));
+      hooks = [{ label: "node9 plugin (node9 check)", wired: shimWired }];
+      wireState = shimWired ? "wired" : present ? "unwired" : "absent";
+      hookLabel = "node9 plugin";
+      settingsPath = spec.shimFile(home);
+    } else {
+      const root = spec.hookFile ? readHookRoot(spec.hookFile(home), spec.hookFormat) : "absent";
+      const primary = spec.hookEvents[0];
+      const rootPresent = root !== "absent" && root !== "invalid";
+      hooks = spec.hookEvents.map((ev) => ({
+        label: hookLabelOf(ev, pad),
+        wired: rootPresent && eventWired(root, ev, spec.hookFormat)
+      }));
+      if (root === "absent") wireState = "absent";
+      else if (root === "invalid") wireState = "invalid";
+      else wireState = primary && eventWired(root, primary, spec.hookFormat) ? "wired" : "unwired";
+      hookLabel = primary ? `${primary.key} hook` : "MCP proxy";
+      settingsPath = spec.hookFile ? spec.hookFile(home) : spec.mcpFile ? spec.mcpFile(home) : "";
+    }
+    const mcp = spec.mcpFile ? readMcp(spec.mcpFile(home), spec.mcpFormat ?? "json") : null;
+    const anyHookWired = hooks.some((h) => h.wired);
+    return {
+      id: spec.id,
+      label: spec.label,
+      setupCommand: spec.setupCommand,
+      installed: detected[spec.id],
+      present,
+      hooks,
+      wireState,
+      hookLabel,
+      settingsPath,
+      configFormat: spec.hookFormat === "yaml" ? "YAML" : "JSON",
+      mcpServers: mcp ? mcp.wrapped : null,
+      mcpProtected: mcp ? mcp.present : false,
+      isProtected: anyHookWired || (mcp?.present ?? false)
+    };
+  });
 }
-var import_fs16, import_path17, import_os13, import_child_process2, import_smol_toml;
-var init_codex_trust = __esm({
-  "src/codex-trust.ts"() {
+var import_fs16, import_path17, import_os13, yaml, import_smol_toml, exists, ck, lg, DEFAULT_LABEL_PAD, hookLabelOf, AGENT_SPECS;
+var init_agent_wiring = __esm({
+  "src/agent-wiring.ts"() {
     "use strict";
     import_fs16 = __toESM(require("fs"));
     import_path17 = __toESM(require("path"));
     import_os13 = __toESM(require("os"));
-    import_child_process2 = require("child_process");
+    yaml = __toESM(require("yaml"));
     import_smol_toml = require("smol-toml");
-    init_platform_shell();
+    init_setup();
+    exists = (p) => {
+      try {
+        return import_fs16.default.existsSync(p);
+      } catch {
+        return false;
+      }
+    };
+    ck = (key) => ({ key, kind: "check" });
+    lg = (key) => ({ key, kind: "log" });
+    DEFAULT_LABEL_PAD = 11;
+    hookLabelOf = (ev, pad) => `${ev.key.padEnd(pad)} (node9 ${ev.kind})`;
+    AGENT_SPECS = [
+      {
+        id: "claude",
+        label: "Claude Code",
+        setupCommand: "node9 agents add claude",
+        hookFile: (h) => import_path17.default.join(h, ".claude", "settings.json"),
+        hookFormat: "matcher",
+        // UserPromptSubmit is prompt DLP. setup.ts has written it for Claude since
+        // that shipped; the spec must name it too, or status/doctor never show the
+        // row and heal (which repairs via setupAgent) has no signal it is missing.
+        hookEvents: [ck("PreToolUse"), lg("PostToolUse"), ck("UserPromptSubmit")],
+        mcpFile: (h) => import_path17.default.join(h, ".claude.json"),
+        present: (h) => exists(import_path17.default.join(h, ".claude", "settings.json")) || exists(import_path17.default.join(h, ".claude.json"))
+      },
+      {
+        id: "gemini",
+        label: "Gemini CLI",
+        setupCommand: "node9 agents add gemini",
+        hookFile: (h) => import_path17.default.join(h, ".gemini", "settings.json"),
+        hookFormat: "matcher",
+        hookEvents: [ck("BeforeTool"), lg("AfterTool")],
+        mcpFile: (h) => import_path17.default.join(h, ".gemini", "settings.json"),
+        present: (h) => exists(import_path17.default.join(h, ".gemini", "settings.json"))
+      },
+      {
+        id: "codex",
+        label: "Codex",
+        setupCommand: "node9 agents add codex",
+        hookFile: (h) => import_path17.default.join(h, ".codex", "hooks.json"),
+        hookFormat: "matcher",
+        hookEvents: [ck("PreToolUse"), ck("UserPromptSubmit")],
+        mcpFile: (h) => import_path17.default.join(h, ".codex", "config.toml"),
+        mcpFormat: "toml",
+        present: (h) => exists(import_path17.default.join(h, ".codex"))
+      },
+      {
+        id: "antigravity",
+        label: "Antigravity",
+        setupCommand: "node9 agents add antigravity",
+        hookFile: (h) => import_path17.default.join(h, ".gemini", "config", "hooks.json"),
+        hookFormat: "matcher",
+        hookEvents: [ck("PreToolUse"), lg("PostToolUse")],
+        mcpFile: (h) => import_path17.default.join(h, ".gemini", "config", "mcp_config.json"),
+        present: (h) => exists(import_path17.default.join(h, ".gemini", "config", "hooks.json")) || exists(import_path17.default.join(h, ".gemini", "antigravity-cli")) || exists(import_path17.default.join(h, ".gemini", "antigravity-ide"))
+      },
+      {
+        id: "copilot",
+        label: "GitHub Copilot",
+        setupCommand: "node9 agents add copilot",
+        hookFile: (h) => import_path17.default.join(h, ".copilot", "hooks", "node9.json"),
+        hookFormat: "flat",
+        hookEvents: [ck("PreToolUse"), lg("PostToolUse"), ck("UserPromptSubmit")],
+        mcpFile: (h) => import_path17.default.join(h, ".copilot", "mcp-config.json"),
+        present: (h) => exists(import_path17.default.join(h, ".copilot"))
+      },
+      {
+        id: "cursor",
+        label: "Cursor",
+        setupCommand: "node9 agents add cursor",
+        // MCP-only — no hook file (see note above).
+        hookFormat: "flat",
+        hookEvents: [],
+        mcpFile: (h) => import_path17.default.join(h, ".cursor", "mcp.json"),
+        present: (h) => exists(import_path17.default.join(h, ".cursor", "mcp.json"))
+      },
+      {
+        id: "hermes",
+        label: "Hermes Agent",
+        setupCommand: "node9 agents add hermes",
+        hookFile: (h) => hermesConfigPath(h),
+        hookFormat: "yaml",
+        hookEvents: [ck("pre_tool_call"), lg("post_tool_call")],
+        labelPad: 14,
+        // 'post_tool_call' is wider than the default
+        present: (h) => exists(hermesConfigPath(h))
+      },
+      {
+        // Plugin-shim agents — protected by a node9-authored plugin/extension file
+        // (no hooks, no MCP). hookFormat is unused for these (shimFile drives it).
+        id: "opencode",
+        label: "OpenCode",
+        setupCommand: "node9 agents add opencode",
+        hookFormat: "flat",
+        hookEvents: [],
+        shimFile: (h) => import_path17.default.join(opencodeConfigDir(h), "plugins", "node9.js"),
+        present: (h) => exists(opencodeConfigDir(h)) || exists(import_path17.default.join(opencodeConfigDir(h), "plugins", "node9.js"))
+      },
+      {
+        id: "pi",
+        label: "Pi",
+        setupCommand: "node9 agents add pi",
+        hookFormat: "flat",
+        hookEvents: [],
+        shimFile: (h) => import_path17.default.join(h, ".pi", "agent", "extensions", "node9.js"),
+        present: (h) => exists(import_path17.default.join(h, ".pi", "agent")) || exists(import_path17.default.join(h, ".pi", "agent", "extensions", "node9.js"))
+      }
+    ];
+  }
+});
+
+// src/mcp-cmd.ts
+function tokenize4(cmd) {
+  const tokens = [];
+  let current = "";
+  let inDouble = false;
+  let quoted = false;
+  let i = 0;
+  while (i < cmd.length) {
+    const ch = cmd[i];
+    if (inDouble) {
+      if (ch === '"') inDouble = false;
+      else if (ch === "\\" && i + 1 < cmd.length) current += cmd[++i];
+      else current += ch;
+    } else if (ch === '"') {
+      inDouble = true;
+      quoted = true;
+    } else if (ch === " " || ch === "	") {
+      if (current || quoted) {
+        tokens.push(current);
+        current = "";
+        quoted = false;
+      }
+    } else if (ch === "\\" && i + 1 < cmd.length) {
+      current += cmd[++i];
+    } else {
+      current += ch;
+    }
+    i++;
+  }
+  if (current || quoted && !inDouble) tokens.push(current);
+  return tokens;
+}
+function quoteArg(s) {
+  if (s === "") return '""';
+  if (/[\s"\\]/.test(s)) return `"${s.replace(/(["\\])/g, "\\$1")}"`;
+  return s;
+}
+var init_mcp_cmd = __esm({
+  "src/mcp-cmd.ts"() {
+    "use strict";
   }
 });
 
@@ -10981,10 +11418,252 @@ var init_mcp_pin = __esm({
   }
 });
 
+// src/mcp-wrap.ts
+function isNode9Command(command) {
+  return /(^|[\\/])node9(\.(exe|cmd|ps1|bat))?$/i.test(command ?? "");
+}
+function classifyMcp(s) {
+  if (isNode9Command(s.command)) {
+    return (s.args ?? [])[0] === "mcp-gateway" ? "gatewayed" : "node9-self";
+  }
+  if (typeof s.command !== "string" || s.command.trim() === "") return "remote";
+  return "ungoverned";
+}
+function mcpUpstreamString(s) {
+  return [s.command ?? "", ...s.args ?? []].map(quoteArg).join(" ");
+}
+function toGateway(s, configName) {
+  const upstream = mcpUpstreamString(s);
+  const nameArgs = configName && !configName.startsWith("-") ? ["--config-name", configName] : [];
+  return {
+    ...s,
+    command: "node9",
+    args: ["mcp-gateway", ...nameArgs, "--upstream", upstream]
+  };
+}
+function fromGateway(s) {
+  if (!isNode9Command(s.command) || (s.args ?? [])[0] !== "mcp-gateway") return null;
+  const args = s.args ?? [];
+  const i = args.indexOf("--upstream");
+  if (i < 0 || !args[i + 1]) return null;
+  const [command, ...rest] = tokenize4(args[i + 1]);
+  if (!command) return null;
+  return { ...s, command, args: rest };
+}
+function inventoryMcp(home = import_os15.default.homedir()) {
+  const out = [];
+  for (const spec of AGENT_SPECS) {
+    if (!spec.mcpFile) continue;
+    const mcpFile = spec.mcpFile(home);
+    const format = spec.mcpFormat ?? "json";
+    const servers = readMcpServers(mcpFile, format);
+    for (const [name, s] of Object.entries(servers)) {
+      if (!s || typeof s !== "object") continue;
+      out.push({
+        agent: String(spec.id),
+        agentLabel: spec.label,
+        mcpFile,
+        format,
+        name,
+        command: s.command ?? "",
+        args: Array.isArray(s.args) ? s.args : [],
+        state: classifyMcp(s),
+        raw: s
+      });
+    }
+  }
+  return out;
+}
+function isCorruptedUpstream(upstream) {
+  if (!upstream) return false;
+  if (upstream.includes("\\") || upstream.includes("/")) return false;
+  return /(^|\s)[A-Za-z]:[^\s]/.test(upstream);
+}
+function findCorruptedMcpWraps(home = import_os15.default.homedir()) {
+  const out = [];
+  for (const e of inventoryMcp(home)) {
+    if (e.state !== "gatewayed") continue;
+    const i = e.args.indexOf("--upstream");
+    const upstream = i >= 0 ? e.args[i + 1] ?? "" : "";
+    if (!isCorruptedUpstream(upstream)) continue;
+    out.push({
+      agent: e.agent,
+      agentLabel: e.agentLabel,
+      mcpFile: e.mcpFile,
+      name: e.name,
+      upstream
+    });
+  }
+  return out;
+}
+function inventoryServerKeys(inv) {
+  const keys = /* @__PURE__ */ new Set();
+  for (const e of inv) {
+    if (e.state === "gatewayed") {
+      const i = e.args.indexOf("--upstream");
+      if (i >= 0 && e.args[i + 1]) {
+        keys.add(getServerKey(e.args[i + 1]));
+      }
+    } else if (e.state === "ungoverned") {
+      const cmd = [e.command, ...e.args].map(quoteArg).join(" ");
+      keys.add(getServerKey(cmd));
+    }
+  }
+  return keys;
+}
+function writeMcpEntry(mcpFile, format, name, entry) {
+  const key = format === "toml" ? "mcp_servers" : "mcpServers";
+  let root = {};
+  if (import_fs18.default.existsSync(mcpFile)) {
+    const raw = import_fs18.default.readFileSync(mcpFile, "utf-8");
+    root = format === "toml" ? (0, import_smol_toml2.parse)(raw) : JSON.parse(raw);
+    const bak = `${mcpFile}.node9-bak`;
+    try {
+      import_fs18.default.writeFileSync(bak, raw, { mode: 384, flag: "wx" });
+    } catch (e) {
+      if (e.code !== "EEXIST") throw e;
+    }
+  }
+  const existing = root[key];
+  const servers = existing && typeof existing === "object" && !Array.isArray(existing) ? existing : {};
+  servers[name] = entry;
+  root[key] = servers;
+  const serialized = format === "toml" ? (0, import_smol_toml2.stringify)(root) : JSON.stringify(root, null, 2);
+  const tmp = `${mcpFile}.${process.pid}.tmp`;
+  import_fs18.default.writeFileSync(tmp, serialized, { mode: 384 });
+  import_fs18.default.renameSync(tmp, mcpFile);
+}
+var import_fs18, import_os15, import_smol_toml2;
+var init_mcp_wrap = __esm({
+  "src/mcp-wrap.ts"() {
+    "use strict";
+    import_fs18 = __toESM(require("fs"));
+    import_os15 = __toESM(require("os"));
+    import_smol_toml2 = require("smol-toml");
+    init_agent_wiring();
+    init_mcp_cmd();
+    init_mcp_pin();
+    init_mcp_cmd();
+  }
+});
+
+// src/utils/platform-shell.ts
+function locatorCommand() {
+  return process.platform === "win32" ? "where" : "which";
+}
+function shellInvocation(command) {
+  if (process.platform === "win32") {
+    return {
+      file: process.env.ComSpec || "cmd.exe",
+      args: ["/d", "/s", "/c", command]
+    };
+  }
+  return { file: "/bin/bash", args: ["-c", command] };
+}
+var init_platform_shell = __esm({
+  "src/utils/platform-shell.ts"() {
+    "use strict";
+  }
+});
+
+// src/codex-trust.ts
+function readTomlSafe(filePath) {
+  try {
+    return (0, import_smol_toml3.parse)(import_fs19.default.readFileSync(filePath, "utf-8"));
+  } catch {
+    return null;
+  }
+}
+function lastCodexAuditTs(auditLogPath) {
+  let text;
+  try {
+    text = import_fs19.default.readFileSync(auditLogPath, "utf-8");
+  } catch {
+    return null;
+  }
+  let newest = null;
+  for (const line of text.split("\n")) {
+    if (!line.includes('"Codex"')) continue;
+    try {
+      const row = JSON.parse(line);
+      if (row.agent !== "Codex" || typeof row.ts !== "string") continue;
+      if (newest === null || row.ts > newest) newest = row.ts;
+    } catch {
+    }
+  }
+  return newest;
+}
+function assessCodexTrustFrom(input) {
+  const { hooksDisabled, trustEntries, hooksWrittenAt, lastCodexActivityAt } = input;
+  let state;
+  if (hooksDisabled) state = "disabled";
+  else if (trustEntries === 0) state = "never-trusted";
+  else if (hooksWrittenAt && lastCodexActivityAt && lastCodexActivityAt > hooksWrittenAt) {
+    state = "observed";
+  } else state = "unverified";
+  return { state, hooksWrittenAt, lastCodexActivityAt, trustEntries };
+}
+function assessCodexTrust(home = import_os16.default.homedir(), auditLogPath = import_path19.default.join(home, ".node9", "audit.log")) {
+  const hooksPath = import_path19.default.join(home, ".codex", "hooks.json");
+  const configPath = import_path19.default.join(home, ".codex", "config.toml");
+  let hooksWrittenAt = null;
+  try {
+    hooksWrittenAt = import_fs19.default.statSync(hooksPath).mtime.toISOString();
+  } catch {
+    hooksWrittenAt = null;
+  }
+  const config = readTomlSafe(configPath);
+  const hooksDisabled = config?.features?.hooks === false || config?.codex_hooks === false;
+  const trustEntries = Object.keys(config?.hooks?.state ?? {}).length;
+  return assessCodexTrustFrom({
+    hooksDisabled,
+    trustEntries,
+    hooksWrittenAt,
+    lastCodexActivityAt: lastCodexAuditTs(auditLogPath)
+  });
+}
+function findCodexTui(env = process.env) {
+  try {
+    const r = (0, import_child_process2.spawnSync)(locatorCommand(), ["codex"], { encoding: "utf-8", timeout: 3e3 });
+    const first = (r.stdout ?? "").split(/\r?\n/).find((l) => l.trim());
+    if (r.status === 0 && first) return "codex";
+  } catch {
+  }
+  if (process.platform === "win32" && env.LOCALAPPDATA) {
+    const binDir = import_path19.default.join(env.LOCALAPPDATA, "OpenAI", "Codex", "bin");
+    try {
+      for (const d of import_fs19.default.readdirSync(binDir)) {
+        const exe = import_path19.default.join(binDir, d, "codex.exe");
+        if (import_fs19.default.existsSync(exe)) return `"${exe}"`;
+      }
+    } catch {
+    }
+  }
+  return null;
+}
+function codexTrustInstruction(tui = findCodexTui()) {
+  const where = tui ? `run ${tui} in a terminal` : "run the Codex CLI (`codex`) in a terminal \u2014 the desktop app has no hook review screen";
+  return `    \u279C  Codex must trust these hooks once: ${where},
+       then choose "Trust all and continue" when Codex asks to review them.
+       Until then Codex runs unprotected. Every rewrite of hooks.json needs this again.`;
+}
+var import_fs19, import_path19, import_os16, import_child_process2, import_smol_toml3;
+var init_codex_trust = __esm({
+  "src/codex-trust.ts"() {
+    "use strict";
+    import_fs19 = __toESM(require("fs"));
+    import_path19 = __toESM(require("path"));
+    import_os16 = __toESM(require("os"));
+    import_child_process2 = require("child_process");
+    import_smol_toml3 = require("smol-toml");
+    init_platform_shell();
+  }
+});
+
 // src/daemon/hook-baseline.ts
 function loadHookBaseline() {
   try {
-    const raw = JSON.parse(import_fs18.default.readFileSync(BASELINE_FILE, "utf-8"));
+    const raw = JSON.parse(import_fs20.default.readFileSync(BASELINE_FILE, "utf-8"));
     return raw && typeof raw === "object" && !Array.isArray(raw) ? raw : {};
   } catch {
     return {};
@@ -10992,9 +11671,9 @@ function loadHookBaseline() {
 }
 function saveHookBaseline(b) {
   try {
-    const dir = import_path19.default.dirname(BASELINE_FILE);
-    if (!import_fs18.default.existsSync(dir)) import_fs18.default.mkdirSync(dir, { recursive: true });
-    import_fs18.default.writeFileSync(BASELINE_FILE, JSON.stringify(b, null, 2), { mode: 384 });
+    const dir = import_path20.default.dirname(BASELINE_FILE);
+    if (!import_fs20.default.existsSync(dir)) import_fs20.default.mkdirSync(dir, { recursive: true });
+    import_fs20.default.writeFileSync(BASELINE_FILE, JSON.stringify(b, null, 2), { mode: 384 });
   } catch {
   }
 }
@@ -11016,14 +11695,14 @@ function seedHookBaselineIfEmpty(governedNow, now) {
 function clearHookBaseline() {
   for (const f of [BASELINE_FILE, NOTIFIED_FILE]) {
     try {
-      import_fs18.default.rmSync(f, { force: true });
+      import_fs20.default.rmSync(f, { force: true });
     } catch {
     }
   }
 }
 function loadNotified() {
   try {
-    const raw = JSON.parse(import_fs18.default.readFileSync(NOTIFIED_FILE, "utf-8"));
+    const raw = JSON.parse(import_fs20.default.readFileSync(NOTIFIED_FILE, "utf-8"));
     return new Set(Array.isArray(raw) ? raw : []);
   } catch {
     return /* @__PURE__ */ new Set();
@@ -11031,21 +11710,21 @@ function loadNotified() {
 }
 function saveNotified(s) {
   try {
-    const dir = import_path19.default.dirname(NOTIFIED_FILE);
-    if (!import_fs18.default.existsSync(dir)) import_fs18.default.mkdirSync(dir, { recursive: true });
-    import_fs18.default.writeFileSync(NOTIFIED_FILE, JSON.stringify([...s]), { mode: 384 });
+    const dir = import_path20.default.dirname(NOTIFIED_FILE);
+    if (!import_fs20.default.existsSync(dir)) import_fs20.default.mkdirSync(dir, { recursive: true });
+    import_fs20.default.writeFileSync(NOTIFIED_FILE, JSON.stringify([...s]), { mode: 384 });
   } catch {
   }
 }
-var import_fs18, import_path19, import_os15, BASELINE_FILE, NOTIFIED_FILE;
+var import_fs20, import_path20, import_os17, BASELINE_FILE, NOTIFIED_FILE;
 var init_hook_baseline = __esm({
   "src/daemon/hook-baseline.ts"() {
     "use strict";
-    import_fs18 = __toESM(require("fs"));
-    import_path19 = __toESM(require("path"));
-    import_os15 = __toESM(require("os"));
-    BASELINE_FILE = import_path19.default.join(import_os15.default.homedir(), ".node9", "hooks-baseline.json");
-    NOTIFIED_FILE = import_path19.default.join(import_os15.default.homedir(), ".node9", "hook-heal-notified.json");
+    import_fs20 = __toESM(require("fs"));
+    import_path20 = __toESM(require("path"));
+    import_os17 = __toESM(require("os"));
+    BASELINE_FILE = import_path20.default.join(import_os17.default.homedir(), ".node9", "hooks-baseline.json");
+    NOTIFIED_FILE = import_path20.default.join(import_os17.default.homedir(), ".node9", "hook-heal-notified.json");
   }
 });
 
@@ -11453,7 +12132,7 @@ function printInlineAskNotice() {
     )
   );
 }
-function fullPathCommand(subcommand, platform = process.platform, home = import_os16.default.homedir()) {
+function fullPathCommand(subcommand, platform = process.platform, home = import_os18.default.homedir()) {
   if (process.env.NODE9_TESTING === "1") return `node9 ${subcommand}`;
   const nodeExec = toForwardSlashes(process.execPath);
   const cliScript = toForwardSlashes(process.argv[1]);
@@ -11465,8 +12144,8 @@ function fullPathCommand(subcommand, platform = process.platform, home = import_
   ensureHookShim(home, nodeExec, cliScript);
   return `"${toForwardSlashes(hookShimPath(home))}" ${subcommand}`;
 }
-function hookShimPath(home = import_os16.default.homedir()) {
-  return import_path20.default.join(home, ".node9", "bin", "hook");
+function hookShimPath(home = import_os18.default.homedir()) {
+  return import_path21.default.join(home, ".node9", "bin", "hook");
 }
 function hookShimBody(nodeExec, cliScript) {
   return `#!/bin/sh
@@ -11480,12 +12159,12 @@ function ensureHookShim(home, nodeExec, cliScript) {
   const shim = hookShimPath(home);
   const body = hookShimBody(nodeExec, cliScript);
   try {
-    if (import_fs19.default.readFileSync(shim, "utf-8") === body) return false;
+    if (import_fs21.default.readFileSync(shim, "utf-8") === body) return false;
   } catch {
   }
-  import_fs19.default.mkdirSync(import_path20.default.dirname(shim), { recursive: true });
-  import_fs19.default.writeFileSync(shim, body, { mode: 493 });
-  import_fs19.default.chmodSync(shim, 493);
+  import_fs21.default.mkdirSync(import_path21.default.dirname(shim), { recursive: true });
+  import_fs21.default.writeFileSync(shim, body, { mode: 493 });
+  import_fs21.default.chmodSync(shim, 493);
   return true;
 }
 function toForwardSlashes(p) {
@@ -11504,7 +12183,7 @@ function isStaleHookCommand(command) {
   while ((m = re.exec(command)) !== null) tokens.push(m[1] ?? m[2] ?? "");
   for (const tok of tokens) {
     if (!tok.startsWith("/") && !/^[A-Za-z]:\//.test(tok)) continue;
-    if (!import_fs19.default.existsSync(tok)) return true;
+    if (!import_fs21.default.existsSync(tok)) return true;
   }
   return false;
 }
@@ -11524,19 +12203,19 @@ function isChurnProneHookForm(command, platform = process.platform) {
 function needsRewrite(command, platform = process.platform) {
   return isStaleHookCommand(command) || isLegacyHookFormat(command) || isWindowsQuoteBrokenHook(command, platform) || isChurnProneHookForm(command, platform);
 }
-function readJson(filePath) {
+function readJson2(filePath) {
   try {
-    if (import_fs19.default.existsSync(filePath)) {
-      return JSON.parse(import_fs19.default.readFileSync(filePath, "utf-8"));
+    if (import_fs21.default.existsSync(filePath)) {
+      return JSON.parse(import_fs21.default.readFileSync(filePath, "utf-8"));
     }
   } catch {
   }
   return null;
 }
 function writeJson(filePath, data) {
-  const dir = import_path20.default.dirname(filePath);
-  if (!import_fs19.default.existsSync(dir)) import_fs19.default.mkdirSync(dir, { recursive: true });
-  import_fs19.default.writeFileSync(filePath, JSON.stringify(data, null, 2) + "\n");
+  const dir = import_path21.default.dirname(filePath);
+  if (!import_fs21.default.existsSync(dir)) import_fs21.default.mkdirSync(dir, { recursive: true });
+  import_fs21.default.writeFileSync(filePath, JSON.stringify(data, null, 2) + "\n");
 }
 function mcpWrapArgs(upstream) {
   return [MCP_WRAP_SUBCOMMAND, "--upstream", upstream];
@@ -11556,6 +12235,14 @@ function repairLegacyMcpWraps(servers) {
   }
   return repaired;
 }
+function isCodexAppManagedServer(name, server) {
+  if (!server) return false;
+  const cmd = (server.command ?? "").replace(/\\/g, "/").toLowerCase();
+  if (cmd.includes("/openai/codex/runtimes/")) return true;
+  const envKeys = Object.keys(server.env ?? {});
+  if (envKeys.some((k) => k.startsWith("NODE_REPL_") || k === "CODEX_CLI_PATH")) return true;
+  return name === "node_repl";
+}
 function isNode9Hook(cmd) {
   if (!cmd) return false;
   return /(?:^|[\s/\\"])node9"? (?:check|log)/.test(cmd) || /(?:^|[\s/\\])cli\.js"? (?:check|log)/.test(cmd) || // The shim form: "<home>/.node9/bin/hook" check. Without this alternative a
@@ -11565,11 +12252,11 @@ function isNode9Hook(cmd) {
   /[/\\]\.node9[/\\]bin[/\\]hook"? (?:check|log)/.test(cmd);
 }
 function teardownClaude() {
-  const homeDir2 = import_os16.default.homedir();
-  const hooksPath = import_path20.default.join(homeDir2, ".claude", "settings.json");
-  const mcpPath = import_path20.default.join(homeDir2, ".claude", ".mcp.json");
+  const homeDir2 = import_os18.default.homedir();
+  const hooksPath = import_path21.default.join(homeDir2, ".claude", "settings.json");
+  const mcpPath = import_path21.default.join(homeDir2, ".claude", ".mcp.json");
   let changed = false;
-  const settings = readJson(hooksPath);
+  const settings = readJson2(hooksPath);
   if (settings?.hooks) {
     for (const event of ["PreToolUse", "PostToolUse", "UserPromptSubmit"]) {
       const before = settings.hooks[event]?.length ?? 0;
@@ -11588,7 +12275,7 @@ function teardownClaude() {
       console.log(import_chalk.default.blue("  \u2139\uFE0F  No Node9 hooks found in ~/.claude/settings.json"));
     }
   }
-  const claudeConfig = readJson(mcpPath);
+  const claudeConfig = readJson2(mcpPath);
   if (claudeConfig?.mcpServers) {
     let mcpChanged = false;
     if (removeNode9McpServer(claudeConfig.mcpServers)) {
@@ -11615,9 +12302,9 @@ function teardownClaude() {
   }
 }
 function teardownGemini() {
-  const homeDir2 = import_os16.default.homedir();
-  const settingsPath = import_path20.default.join(homeDir2, ".gemini", "settings.json");
-  const settings = readJson(settingsPath);
+  const homeDir2 = import_os18.default.homedir();
+  const settingsPath = import_path21.default.join(homeDir2, ".gemini", "settings.json");
+  const settings = readJson2(settingsPath);
   if (!settings) {
     console.log(import_chalk.default.blue("  \u2139\uFE0F  ~/.gemini/settings.json not found \u2014 nothing to remove"));
     return;
@@ -11659,9 +12346,9 @@ function teardownGemini() {
   }
 }
 function teardownCursor() {
-  const homeDir2 = import_os16.default.homedir();
-  const mcpPath = import_path20.default.join(homeDir2, ".cursor", "mcp.json");
-  const mcpConfig = readJson(mcpPath);
+  const homeDir2 = import_os18.default.homedir();
+  const mcpPath = import_path21.default.join(homeDir2, ".cursor", "mcp.json");
+  const mcpConfig = readJson2(mcpPath);
   if (!mcpConfig?.mcpServers) {
     console.log(import_chalk.default.blue("  \u2139\uFE0F  ~/.cursor/mcp.json not found \u2014 nothing to remove"));
     return;
@@ -11692,11 +12379,11 @@ function teardownCursor() {
 }
 async function setupClaude() {
   seedMcpPinsIfMissing();
-  const homeDir2 = import_os16.default.homedir();
-  const mcpPath = import_path20.default.join(homeDir2, ".claude", ".mcp.json");
-  const hooksPath = import_path20.default.join(homeDir2, ".claude", "settings.json");
-  const claudeConfig = readJson(mcpPath) ?? {};
-  const settings = readJson(hooksPath) ?? {};
+  const homeDir2 = import_os18.default.homedir();
+  const mcpPath = import_path21.default.join(homeDir2, ".claude", ".mcp.json");
+  const hooksPath = import_path21.default.join(homeDir2, ".claude", "settings.json");
+  const claudeConfig = readJson2(mcpPath) ?? {};
+  const settings = readJson2(hooksPath) ?? {};
   const servers = claudeConfig.mcpServers ?? {};
   let hooksChanged = false;
   let anythingChanged = false;
@@ -11817,7 +12504,7 @@ async function setupClaude() {
   const serversToWrap = [];
   for (const [name, server] of Object.entries(servers)) {
     if (!server.command || server.command === "node9") continue;
-    const upstream = [server.command, ...server.args ?? []].join(" ");
+    const upstream = mcpUpstreamString(server);
     serversToWrap.push({ name, upstream });
   }
   if (serversToWrap.length > 0) {
@@ -11870,9 +12557,9 @@ async function setupGemini() {
   );
   console.log("");
   seedMcpPinsIfMissing();
-  const homeDir2 = import_os16.default.homedir();
-  const settingsPath = import_path20.default.join(homeDir2, ".gemini", "settings.json");
-  const settings = readJson(settingsPath) ?? {};
+  const homeDir2 = import_os18.default.homedir();
+  const settingsPath = import_path21.default.join(homeDir2, ".gemini", "settings.json");
+  const settings = readJson2(settingsPath) ?? {};
   const servers = settings.mcpServers ?? {};
   let hooksChanged = false;
   let anythingChanged = false;
@@ -11939,7 +12626,7 @@ async function setupGemini() {
   const serversToWrap = [];
   for (const [name, server] of Object.entries(servers)) {
     if (!server.command || server.command === "node9") continue;
-    const upstream = [server.command, ...server.args ?? []].join(" ");
+    const upstream = mcpUpstreamString(server);
     serversToWrap.push({ name, upstream });
   }
   if (serversToWrap.length > 0) {
@@ -11985,11 +12672,11 @@ async function setupGemini() {
 }
 async function setupAntigravity() {
   seedMcpPinsIfMissing();
-  const homeDir2 = import_os16.default.homedir();
-  const hooksPath = import_path20.default.join(homeDir2, ".gemini", "config", "hooks.json");
-  const mcpPath = import_path20.default.join(homeDir2, ".gemini", "config", "mcp_config.json");
-  const hooksFile = readJson(hooksPath) ?? {};
-  const mcpConfig = readJson(mcpPath) ?? {};
+  const homeDir2 = import_os18.default.homedir();
+  const hooksPath = import_path21.default.join(homeDir2, ".gemini", "config", "hooks.json");
+  const mcpPath = import_path21.default.join(homeDir2, ".gemini", "config", "mcp_config.json");
+  const hooksFile = readJson2(hooksPath) ?? {};
+  const mcpConfig = readJson2(mcpPath) ?? {};
   const servers = mcpConfig.mcpServers ?? {};
   let hooksChanged = false;
   let anythingChanged = false;
@@ -12082,7 +12769,7 @@ async function setupAntigravity() {
     }
     anythingChanged = true;
   }
-  const legacySettings = readJson(import_path20.default.join(homeDir2, ".gemini", "settings.json"));
+  const legacySettings = readJson2(import_path21.default.join(homeDir2, ".gemini", "settings.json"));
   const legacyHasNode9 = ["BeforeTool", "AfterTool"].some(
     (ev) => legacySettings?.hooks?.[ev]?.some((m) => m.hooks.some((h) => isNode9Hook(h.command)))
   );
@@ -12153,11 +12840,11 @@ async function setupAntigravity() {
   }
 }
 function teardownAntigravity() {
-  const homeDir2 = import_os16.default.homedir();
-  const hooksPath = import_path20.default.join(homeDir2, ".gemini", "config", "hooks.json");
-  const mcpPath = import_path20.default.join(homeDir2, ".gemini", "config", "mcp_config.json");
+  const homeDir2 = import_os18.default.homedir();
+  const hooksPath = import_path21.default.join(homeDir2, ".gemini", "config", "hooks.json");
+  const mcpPath = import_path21.default.join(homeDir2, ".gemini", "config", "mcp_config.json");
   let changed = false;
-  const hooksFile = readJson(hooksPath);
+  const hooksFile = readJson2(hooksPath);
   if (hooksFile?.hooks) {
     for (const event of ["PreToolUse", "PostToolUse"]) {
       const before = hooksFile.hooks[event]?.length ?? 0;
@@ -12178,7 +12865,7 @@ function teardownAntigravity() {
   } else {
     console.log(import_chalk.default.blue("  \u2139\uFE0F  ~/.gemini/config/hooks.json not found \u2014 nothing to remove"));
   }
-  const mcpConfig = readJson(mcpPath);
+  const mcpConfig = readJson2(mcpPath);
   if (mcpConfig?.mcpServers) {
     let mcpChanged = false;
     if (removeNode9McpServer(mcpConfig.mcpServers)) {
@@ -12207,13 +12894,13 @@ function teardownAntigravity() {
 }
 async function setupCopilot() {
   seedMcpPinsIfMissing();
-  const homeDir2 = import_os16.default.homedir();
-  const hooksPath = import_path20.default.join(homeDir2, ".copilot", "hooks", "node9.json");
-  const mcpPath = import_path20.default.join(homeDir2, ".copilot", "mcp-config.json");
-  const hooksFile = readJson(hooksPath) ?? { version: 1 };
+  const homeDir2 = import_os18.default.homedir();
+  const hooksPath = import_path21.default.join(homeDir2, ".copilot", "hooks", "node9.json");
+  const mcpPath = import_path21.default.join(homeDir2, ".copilot", "mcp-config.json");
+  const hooksFile = readJson2(hooksPath) ?? { version: 1 };
   if (!hooksFile.version) hooksFile.version = 1;
   if (!hooksFile.hooks) hooksFile.hooks = {};
-  const mcpConfig = readJson(mcpPath) ?? {};
+  const mcpConfig = readJson2(mcpPath) ?? {};
   const servers = mcpConfig.mcpServers ?? {};
   let hooksChanged = false;
   let anythingChanged = false;
@@ -12310,10 +12997,10 @@ async function setupCopilot() {
   printInlineAskNotice();
 }
 function teardownCopilot() {
-  const homeDir2 = import_os16.default.homedir();
-  const hooksPath = import_path20.default.join(homeDir2, ".copilot", "hooks", "node9.json");
-  const mcpPath = import_path20.default.join(homeDir2, ".copilot", "mcp-config.json");
-  const hooksFile = readJson(hooksPath);
+  const homeDir2 = import_os18.default.homedir();
+  const hooksPath = import_path21.default.join(homeDir2, ".copilot", "hooks", "node9.json");
+  const mcpPath = import_path21.default.join(homeDir2, ".copilot", "mcp-config.json");
+  const hooksFile = readJson2(hooksPath);
   let changed = false;
   if (hooksFile?.hooks) {
     for (const event of ["PreToolUse", "PostToolUse", "UserPromptSubmit"]) {
@@ -12325,7 +13012,7 @@ function teardownCopilot() {
     if (changed) {
       if (Object.keys(hooksFile.hooks).length === 0) {
         try {
-          import_fs19.default.unlinkSync(hooksPath);
+          import_fs21.default.unlinkSync(hooksPath);
           console.log(import_chalk.default.green("  \u2705 Removed ~/.copilot/hooks/node9.json"));
         } catch {
           writeJson(hooksPath, hooksFile);
@@ -12340,7 +13027,7 @@ function teardownCopilot() {
   } else {
     console.log(import_chalk.default.blue("  \u2139\uFE0F  ~/.copilot/hooks/node9.json not found \u2014 nothing to remove"));
   }
-  const mcpConfig = readJson(mcpPath);
+  const mcpConfig = readJson2(mcpPath);
   if (mcpConfig?.mcpServers) {
     let mcpChanged = false;
     if (removeNode9McpServer(mcpConfig.mcpServers)) {
@@ -12367,9 +13054,9 @@ function teardownCopilot() {
     }
   }
 }
-function claudeDesktopConfigPath(homeDir2 = import_os16.default.homedir()) {
+function claudeDesktopConfigPath(homeDir2 = import_os18.default.homedir()) {
   if (process.platform === "darwin") {
-    return import_path20.default.join(
+    return import_path21.default.join(
       homeDir2,
       "Library",
       "Application Support",
@@ -12378,47 +13065,47 @@ function claudeDesktopConfigPath(homeDir2 = import_os16.default.homedir()) {
     );
   }
   if (process.platform === "linux") {
-    return import_path20.default.join(homeDir2, ".config", "Claude", "claude_desktop_config.json");
+    return import_path21.default.join(homeDir2, ".config", "Claude", "claude_desktop_config.json");
   }
   if (process.platform === "win32") {
-    const appData = process.env.APPDATA || import_path20.default.join(homeDir2, "AppData", "Roaming");
-    return import_path20.default.join(appData, "Claude", "claude_desktop_config.json");
+    const appData = process.env.APPDATA || import_path21.default.join(homeDir2, "AppData", "Roaming");
+    return import_path21.default.join(appData, "Claude", "claude_desktop_config.json");
   }
   return null;
 }
-function opencodeConfigDir(home = import_os16.default.homedir()) {
+function opencodeConfigDir(home = import_os18.default.homedir()) {
   const xdg = process.env.XDG_CONFIG_HOME;
-  const base = xdg && import_path20.default.isAbsolute(xdg) ? xdg : import_path20.default.join(home, ".config");
-  return import_path20.default.join(base, "opencode");
+  const base = xdg && import_path21.default.isAbsolute(xdg) ? xdg : import_path21.default.join(home, ".config");
+  return import_path21.default.join(base, "opencode");
 }
 function commonBinDirs(home) {
   return [
-    import_path20.default.join(home, ".local", "bin"),
-    import_path20.default.join(home, ".bun", "bin"),
-    import_path20.default.join(home, ".npm-global", "bin"),
+    import_path21.default.join(home, ".local", "bin"),
+    import_path21.default.join(home, ".bun", "bin"),
+    import_path21.default.join(home, ".npm-global", "bin"),
     "/usr/local/bin",
     "/opt/homebrew/bin"
   ];
 }
-function binaryInPath(binary, home = import_os16.default.homedir()) {
+function binaryInPath(binary, home = import_os18.default.homedir()) {
   const pathEnv = process.env.PATH ?? "";
-  const dirs = [...pathEnv.split(import_path20.default.delimiter), ...commonBinDirs(home)];
+  const dirs = [...pathEnv.split(import_path21.default.delimiter), ...commonBinDirs(home)];
   const seen = /* @__PURE__ */ new Set();
   for (const dir of dirs) {
     if (!dir || seen.has(dir)) continue;
     seen.add(dir);
     try {
-      import_fs19.default.accessSync(import_path20.default.join(dir, binary), import_fs19.default.constants.X_OK);
+      import_fs21.default.accessSync(import_path21.default.join(dir, binary), import_fs21.default.constants.X_OK);
       return true;
     } catch {
     }
   }
   return false;
 }
-function detectAgents(homeDir2 = import_os16.default.homedir()) {
+function detectAgents(homeDir2 = import_os18.default.homedir()) {
   const exists2 = (p) => {
     try {
-      return import_fs19.default.existsSync(p);
+      return import_fs21.default.existsSync(p);
     } catch (err2) {
       const code = err2.code;
       if (code !== "ENOENT") {
@@ -12430,7 +13117,7 @@ function detectAgents(homeDir2 = import_os16.default.homedir()) {
   };
   const desktopPath = claudeDesktopConfigPath(homeDir2);
   return {
-    claude: exists2(import_path20.default.join(homeDir2, ".claude")) || exists2(import_path20.default.join(homeDir2, ".claude.json")),
+    claude: exists2(import_path21.default.join(homeDir2, ".claude")) || exists2(import_path21.default.join(homeDir2, ".claude.json")),
     // Antigravity (agy) shares the ~/.gemini root, so a bare
     // `exists(~/.gemini)` would report the (EOL'd) Gemini CLI as
     // installed on every agy machine — and `node9 init` would then
@@ -12440,19 +13127,19 @@ function detectAgents(homeDir2 = import_os16.default.homedir()) {
     // creates ~/.gemini/settings.json on first run; agy does not touch
     // it (it uses antigravity-cli/settings.json) — that file is the
     // legacy-CLI discriminator.
-    gemini: exists2(import_path20.default.join(homeDir2, ".gemini", "settings.json")) || binaryInPath("gemini", homeDir2),
+    gemini: exists2(import_path21.default.join(homeDir2, ".gemini", "settings.json")) || binaryInPath("gemini", homeDir2),
     // agy creates ~/.gemini/antigravity-cli/ on first launch; the IDE
     // creates antigravity-ide/. PATH fallback covers installed-but-
     // never-launched (same class as opencode #186).
-    antigravity: exists2(import_path20.default.join(homeDir2, ".gemini", "antigravity-cli")) || exists2(import_path20.default.join(homeDir2, ".gemini", "antigravity-ide")) || binaryInPath("agy", homeDir2),
+    antigravity: exists2(import_path21.default.join(homeDir2, ".gemini", "antigravity-cli")) || exists2(import_path21.default.join(homeDir2, ".gemini", "antigravity-ide")) || binaryInPath("agy", homeDir2),
     // GitHub Copilot CLI creates ~/.copilot on first launch; PATH
     // fallback covers installed-but-never-launched (same as opencode #186).
-    copilot: exists2(import_path20.default.join(homeDir2, ".copilot")) || binaryInPath("copilot", homeDir2),
-    cursor: exists2(import_path20.default.join(homeDir2, ".cursor")),
-    codex: exists2(import_path20.default.join(homeDir2, ".codex")),
-    windsurf: exists2(import_path20.default.join(homeDir2, ".codeium", "windsurf")),
-    vscode: exists2(import_path20.default.join(homeDir2, ".vscode")),
-    claudeDesktop: desktopPath !== null && exists2(import_path20.default.dirname(desktopPath)),
+    copilot: exists2(import_path21.default.join(homeDir2, ".copilot")) || binaryInPath("copilot", homeDir2),
+    cursor: exists2(import_path21.default.join(homeDir2, ".cursor")),
+    codex: exists2(import_path21.default.join(homeDir2, ".codex")),
+    windsurf: exists2(import_path21.default.join(homeDir2, ".codeium", "windsurf")),
+    vscode: exists2(import_path21.default.join(homeDir2, ".vscode")),
+    claudeDesktop: desktopPath !== null && exists2(import_path21.default.dirname(desktopPath)),
     // Opencode creates its config dir lazily on first launch — fall back to a
     // PATH lookup so installed-but-never-launched CLIs are still wired. Config
     // dir honors $XDG_CONFIG_HOME via opencodeConfigDir (#186, custom-XDG).
@@ -12463,7 +13150,7 @@ function detectAgents(homeDir2 = import_os16.default.homedir()) {
     // dir lazily on first launch — same class of bug as opencode's #186
     // (design R6) — so fall back to PATH lookup for installed-but-never-
     // launched pi.
-    pi: exists2(import_path20.default.join(homeDir2, ".pi", "agent")) || binaryInPath("pi", homeDir2),
+    pi: exists2(import_path21.default.join(homeDir2, ".pi", "agent")) || binaryInPath("pi", homeDir2),
     // Hermes Agent (https://github.com/NousResearch/hermes-agent): home dir
     // is $HERMES_HOME (default ~/.hermes) per hermes_constants.py:30. config.yaml
     // appears after `hermes setup` has run; the directory alone exists from
@@ -12474,9 +13161,9 @@ function detectAgents(homeDir2 = import_os16.default.homedir()) {
 }
 async function setupCursor() {
   seedMcpPinsIfMissing();
-  const homeDir2 = import_os16.default.homedir();
-  const mcpPath = import_path20.default.join(homeDir2, ".cursor", "mcp.json");
-  const mcpConfig = readJson(mcpPath) ?? {};
+  const homeDir2 = import_os18.default.homedir();
+  const mcpPath = import_path21.default.join(homeDir2, ".cursor", "mcp.json");
+  const mcpConfig = readJson2(mcpPath) ?? {};
   const servers = mcpConfig.mcpServers ?? {};
   let anythingChanged = false;
   const repairedMcpWraps = repairLegacyMcpWraps(
@@ -12502,7 +13189,7 @@ async function setupCursor() {
   const serversToWrap = [];
   for (const [name, server] of Object.entries(servers)) {
     if (!server.command || server.command === "node9") continue;
-    const upstream = [server.command, ...server.args ?? []].join(" ");
+    const upstream = mcpUpstreamString(server);
     serversToWrap.push({ name, upstream });
   }
   if (serversToWrap.length > 0) {
@@ -12558,27 +13245,27 @@ async function setupCursor() {
 }
 function readToml(filePath) {
   try {
-    if (import_fs19.default.existsSync(filePath)) {
-      return (0, import_smol_toml2.parse)(import_fs19.default.readFileSync(filePath, "utf-8"));
+    if (import_fs21.default.existsSync(filePath)) {
+      return (0, import_smol_toml4.parse)(import_fs21.default.readFileSync(filePath, "utf-8"));
     }
   } catch {
   }
   return null;
 }
 function writeToml(filePath, data) {
-  const dir = import_path20.default.dirname(filePath);
-  if (!import_fs19.default.existsSync(dir)) import_fs19.default.mkdirSync(dir, { recursive: true });
-  import_fs19.default.writeFileSync(filePath, (0, import_smol_toml2.stringify)(data));
+  const dir = import_path21.default.dirname(filePath);
+  if (!import_fs21.default.existsSync(dir)) import_fs21.default.mkdirSync(dir, { recursive: true });
+  import_fs21.default.writeFileSync(filePath, (0, import_smol_toml4.stringify)(data));
 }
 async function setupCodex() {
   seedMcpPinsIfMissing();
-  const homeDir2 = import_os16.default.homedir();
-  const configPath = import_path20.default.join(homeDir2, ".codex", "config.toml");
-  const hooksPath = import_path20.default.join(homeDir2, ".codex", "hooks.json");
+  const homeDir2 = import_os18.default.homedir();
+  const configPath = import_path21.default.join(homeDir2, ".codex", "config.toml");
+  const hooksPath = import_path21.default.join(homeDir2, ".codex", "hooks.json");
   const config = readToml(configPath) ?? {};
   const servers = config.mcp_servers ?? {};
   let anythingChanged = false;
-  const hooksFile = readJson(hooksPath) ?? {};
+  const hooksFile = readJson2(hooksPath) ?? {};
   if (!hooksFile.hooks) hooksFile.hooks = {};
   let hooksChanged = false;
   if (!hooksFile.hooks.PreToolUse) hooksFile.hooks.PreToolUse = [];
@@ -12671,11 +13358,21 @@ async function setupCodex() {
     anythingChanged = true;
   }
   const serversToWrap = [];
+  const appManaged = [];
   for (const [name, server] of Object.entries(servers)) {
     if (!server.command || server.command === "node9") continue;
-    const upstream = [server.command, ...server.args ?? []].join(" ");
+    if (isCodexAppManagedServer(name, server)) {
+      appManaged.push(name);
+      continue;
+    }
+    const upstream = mcpUpstreamString(server);
     serversToWrap.push({ name, upstream });
   }
+  if (appManaged.length > 0) {
+    console.log(
+      import_chalk.default.gray(`  \u2139\uFE0F  Managed by the Codex app \u2014 not wrapped: ${appManaged.join(", ")}`)
+    );
+  }
   if (serversToWrap.length > 0) {
     console.log(import_chalk.default.bold("The following existing entries will be modified:\n"));
     console.log(import_chalk.default.white(`  ${configPath}`));
@@ -12740,10 +13437,10 @@ async function setupCodex() {
   }
 }
 function teardownCodex() {
-  const homeDir2 = import_os16.default.homedir();
-  const configPath = import_path20.default.join(homeDir2, ".codex", "config.toml");
-  const hooksPath = import_path20.default.join(homeDir2, ".codex", "hooks.json");
-  const hooksFile = readJson(hooksPath);
+  const homeDir2 = import_os18.default.homedir();
+  const configPath = import_path21.default.join(homeDir2, ".codex", "config.toml");
+  const hooksPath = import_path21.default.join(homeDir2, ".codex", "hooks.json");
+  const hooksFile = readJson2(hooksPath);
   if (hooksFile?.hooks) {
     let hooksChanged = false;
     for (const event of ["PreToolUse", "PostToolUse", "UserPromptSubmit"]) {
@@ -12789,9 +13486,9 @@ function teardownCodex() {
   }
 }
 function setupHud() {
-  const homeDir2 = import_os16.default.homedir();
-  const hooksPath = import_path20.default.join(homeDir2, ".claude", "settings.json");
-  const settings = readJson(hooksPath) ?? {};
+  const homeDir2 = import_os18.default.homedir();
+  const hooksPath = import_path21.default.join(homeDir2, ".claude", "settings.json");
+  const settings = readJson2(hooksPath) ?? {};
   const hudCommand = fullPathCommand("hud");
   const statusLineObj = { type: "command", command: hudCommand };
   const existing = settings.statusLine;
@@ -12818,9 +13515,9 @@ function setupHud() {
   console.log(import_chalk.default.gray("   Restart Claude Code to activate."));
 }
 function teardownHud() {
-  const homeDir2 = import_os16.default.homedir();
-  const hooksPath = import_path20.default.join(homeDir2, ".claude", "settings.json");
-  const settings = readJson(hooksPath);
+  const homeDir2 = import_os18.default.homedir();
+  const hooksPath = import_path21.default.join(homeDir2, ".claude", "settings.json");
+  const settings = readJson2(hooksPath);
   if (!settings) {
     console.log(import_chalk.default.blue("  \u2139\uFE0F  ~/.claude/settings.json not found \u2014 nothing to remove"));
     return;
@@ -12838,9 +13535,9 @@ function teardownHud() {
 }
 async function setupWindsurf() {
   seedMcpPinsIfMissing();
-  const homeDir2 = import_os16.default.homedir();
-  const mcpPath = import_path20.default.join(homeDir2, ".codeium", "windsurf", "mcp_config.json");
-  const mcpConfig = readJson(mcpPath) ?? {};
+  const homeDir2 = import_os18.default.homedir();
+  const mcpPath = import_path21.default.join(homeDir2, ".codeium", "windsurf", "mcp_config.json");
+  const mcpConfig = readJson2(mcpPath) ?? {};
   const servers = mcpConfig.mcpServers ?? {};
   let anythingChanged = false;
   const repairedMcpWraps = repairLegacyMcpWraps(
@@ -12916,9 +13613,9 @@ async function setupWindsurf() {
   }
 }
 function teardownWindsurf() {
-  const homeDir2 = import_os16.default.homedir();
-  const mcpPath = import_path20.default.join(homeDir2, ".codeium", "windsurf", "mcp_config.json");
-  const mcpConfig = readJson(mcpPath);
+  const homeDir2 = import_os18.default.homedir();
+  const mcpPath = import_path21.default.join(homeDir2, ".codeium", "windsurf", "mcp_config.json");
+  const mcpConfig = readJson2(mcpPath);
   if (!mcpConfig?.mcpServers) {
     console.log(
       import_chalk.default.blue("  \u2139\uFE0F  ~/.codeium/windsurf/mcp_config.json not found \u2014 nothing to remove")
@@ -12959,9 +13656,9 @@ function hasNode9McpServerVSCode(servers) {
 }
 async function setupVSCode() {
   seedMcpPinsIfMissing();
-  const homeDir2 = import_os16.default.homedir();
-  const mcpPath = import_path20.default.join(homeDir2, ".vscode", "mcp.json");
-  const mcpConfig = readJson(mcpPath) ?? {};
+  const homeDir2 = import_os18.default.homedir();
+  const mcpPath = import_path21.default.join(homeDir2, ".vscode", "mcp.json");
+  const mcpConfig = readJson2(mcpPath) ?? {};
   const servers = mcpConfig.servers ?? {};
   let anythingChanged = false;
   const repairedMcpWraps = repairLegacyMcpWraps(
@@ -13040,9 +13737,9 @@ async function setupVSCode() {
   }
 }
 function teardownVSCode() {
-  const homeDir2 = import_os16.default.homedir();
-  const mcpPath = import_path20.default.join(homeDir2, ".vscode", "mcp.json");
-  const mcpConfig = readJson(mcpPath);
+  const homeDir2 = import_os18.default.homedir();
+  const mcpPath = import_path21.default.join(homeDir2, ".vscode", "mcp.json");
+  const mcpConfig = readJson2(mcpPath);
   if (!mcpConfig?.servers) {
     console.log(import_chalk.default.blue("  \u2139\uFE0F  ~/.vscode/mcp.json not found \u2014 nothing to remove"));
     return;
@@ -13080,7 +13777,7 @@ async function setupClaudeDesktop() {
     console.log(import_chalk.default.yellow("  \u26A0\uFE0F  Claude Desktop is not supported on this platform."));
     return;
   }
-  const config = readJson(configPath) ?? {};
+  const config = readJson2(configPath) ?? {};
   const servers = config.mcpServers ?? {};
   let anythingChanged = false;
   const repairedMcpWraps = repairLegacyMcpWraps(
@@ -13161,7 +13858,7 @@ function teardownClaudeDesktop() {
     console.log(import_chalk.default.yellow("  \u26A0\uFE0F  Claude Desktop is not supported on this platform."));
     return;
   }
-  const config = readJson(configPath);
+  const config = readJson2(configPath);
   if (!config?.mcpServers) {
     console.log(import_chalk.default.blue("  \u2139\uFE0F  Claude Desktop config not found \u2014 nothing to remove"));
     return;
@@ -13200,7 +13897,7 @@ function node9ArgvForShim() {
 function node9Version() {
   try {
     const pkg = JSON.parse(
-      import_fs19.default.readFileSync(import_path20.default.join(__dirname, "..", "package.json"), "utf-8")
+      import_fs21.default.readFileSync(import_path21.default.join(__dirname, "..", "package.json"), "utf-8")
     );
     return pkg.version ?? "0.0.0";
   } catch {
@@ -13209,13 +13906,13 @@ function node9Version() {
 }
 async function setupOpencode() {
   seedMcpPinsIfMissing();
-  const homeDir2 = import_os16.default.homedir();
+  const homeDir2 = import_os18.default.homedir();
   const configDir = opencodeConfigDir(homeDir2);
-  const pluginsDir = import_path20.default.join(configDir, "plugins");
-  const configPath = import_path20.default.join(configDir, "opencode.json");
-  const pluginPath = import_path20.default.join(pluginsDir, OPENCODE_PLUGIN_NAME);
+  const pluginsDir = import_path21.default.join(configDir, "plugins");
+  const configPath = import_path21.default.join(configDir, "opencode.json");
+  const pluginPath = import_path21.default.join(pluginsDir, OPENCODE_PLUGIN_NAME);
   try {
-    import_fs19.default.mkdirSync(pluginsDir, { recursive: true });
+    import_fs21.default.mkdirSync(pluginsDir, { recursive: true });
   } catch (err2) {
     const code = err2.code;
     if (code !== "EEXIST") {
@@ -13230,13 +13927,13 @@ async function setupOpencode() {
   let pluginChanged = false;
   const existingShim = (() => {
     try {
-      return import_fs19.default.readFileSync(pluginPath, "utf-8");
+      return import_fs21.default.readFileSync(pluginPath, "utf-8");
     } catch {
       return null;
     }
   })();
   if (existingShim !== shimContent) {
-    import_fs19.default.writeFileSync(pluginPath, shimContent);
+    import_fs21.default.writeFileSync(pluginPath, shimContent);
     pluginChanged = true;
     if (existingShim) {
       console.log(import_chalk.default.yellow("  \u{1F527} Opencode plugin shim updated to current version"));
@@ -13246,7 +13943,7 @@ async function setupOpencode() {
       );
     }
   }
-  const config = readJson(configPath) ?? {};
+  const config = readJson2(configPath) ?? {};
   const mcp = config.mcp ?? {};
   let configChanged = false;
   const desiredCommand = [...node9ArgvForShim(), "mcp-server"];
@@ -13277,20 +13974,20 @@ async function setupOpencode() {
   }
 }
 function teardownOpencode() {
-  const homeDir2 = import_os16.default.homedir();
+  const homeDir2 = import_os18.default.homedir();
   const configDir = opencodeConfigDir(homeDir2);
-  const pluginsDir = import_path20.default.join(configDir, "plugins");
-  const configPath = import_path20.default.join(configDir, "opencode.json");
-  const pluginPath = import_path20.default.join(pluginsDir, OPENCODE_PLUGIN_NAME);
+  const pluginsDir = import_path21.default.join(configDir, "plugins");
+  const configPath = import_path21.default.join(configDir, "opencode.json");
+  const pluginPath = import_path21.default.join(pluginsDir, OPENCODE_PLUGIN_NAME);
   try {
-    if (import_fs19.default.existsSync(pluginPath)) {
-      import_fs19.default.unlinkSync(pluginPath);
+    if (import_fs21.default.existsSync(pluginPath)) {
+      import_fs21.default.unlinkSync(pluginPath);
       console.log(import_chalk.default.green("  \u2705 Removed node9 plugin from ~/.config/opencode/plugins/"));
     }
   } catch (err2) {
     console.log(import_chalk.default.yellow(`  \u26A0\uFE0F  Could not remove ${pluginPath}: ${String(err2)}`));
   }
-  const config = readJson(configPath);
+  const config = readJson2(configPath);
   if (!config) {
     console.log(import_chalk.default.blue("  \u2139\uFE0F  ~/.config/opencode/opencode.json not found \u2014 nothing to remove"));
     return;
@@ -13313,11 +14010,11 @@ function teardownOpencode() {
 }
 async function setupPi() {
   seedMcpPinsIfMissing();
-  const homeDir2 = import_os16.default.homedir();
-  const extensionsDir = import_path20.default.join(homeDir2, ".pi", "agent", "extensions");
-  const extensionPath = import_path20.default.join(extensionsDir, PI_EXTENSION_NAME);
+  const homeDir2 = import_os18.default.homedir();
+  const extensionsDir = import_path21.default.join(homeDir2, ".pi", "agent", "extensions");
+  const extensionPath = import_path21.default.join(extensionsDir, PI_EXTENSION_NAME);
   try {
-    import_fs19.default.mkdirSync(extensionsDir, { recursive: true });
+    import_fs21.default.mkdirSync(extensionsDir, { recursive: true });
   } catch (err2) {
     const code = err2.code;
     console.log(import_chalk.default.yellow(`  \u26A0\uFE0F  Could not create ${extensionsDir}: ${code ?? String(err2)}`));
@@ -13329,7 +14026,7 @@ async function setupPi() {
   });
   const existingShim = (() => {
     try {
-      return import_fs19.default.readFileSync(extensionPath, "utf-8");
+      return import_fs21.default.readFileSync(extensionPath, "utf-8");
     } catch {
       return null;
     }
@@ -13338,7 +14035,7 @@ async function setupPi() {
     console.log(import_chalk.default.blue("  \u2139\uFE0F  Node9 is already fully configured for Pi."));
     return;
   }
-  import_fs19.default.writeFileSync(extensionPath, shimContent);
+  import_fs21.default.writeFileSync(extensionPath, shimContent);
   if (existingShim) {
     console.log(import_chalk.default.yellow("  \u{1F527} Pi extension shim updated to current version"));
   } else {
@@ -13351,11 +14048,11 @@ async function setupPi() {
   printDaemonTip();
 }
 function teardownPi() {
-  const homeDir2 = import_os16.default.homedir();
-  const extensionPath = import_path20.default.join(homeDir2, ".pi", "agent", "extensions", PI_EXTENSION_NAME);
+  const homeDir2 = import_os18.default.homedir();
+  const extensionPath = import_path21.default.join(homeDir2, ".pi", "agent", "extensions", PI_EXTENSION_NAME);
   try {
-    if (import_fs19.default.existsSync(extensionPath)) {
-      import_fs19.default.unlinkSync(extensionPath);
+    if (import_fs21.default.existsSync(extensionPath)) {
+      import_fs21.default.unlinkSync(extensionPath);
       console.log(import_chalk.default.green("  \u2705 Removed node9 extension from ~/.pi/agent/extensions/"));
     } else {
       console.log(import_chalk.default.blue("  \u2139\uFE0F  No Pi extension installed \u2014 nothing to remove"));
@@ -13364,29 +14061,29 @@ function teardownPi() {
     console.log(import_chalk.default.yellow(`  \u26A0\uFE0F  Could not remove ${extensionPath}: ${String(err2)}`));
   }
 }
-function hermesHomeDir(homeDir2 = import_os16.default.homedir()) {
+function hermesHomeDir(homeDir2 = import_os18.default.homedir()) {
   const env = process.env.HERMES_HOME?.trim();
-  if (env && import_path20.default.isAbsolute(env)) return env;
-  return import_path20.default.join(homeDir2, ".hermes");
+  if (env && import_path21.default.isAbsolute(env)) return env;
+  return import_path21.default.join(homeDir2, ".hermes");
 }
-function hermesConfigPath(homeDir2 = import_os16.default.homedir()) {
-  return import_path20.default.join(hermesHomeDir(homeDir2), HERMES_CONFIG_FILENAME);
+function hermesConfigPath(homeDir2 = import_os18.default.homedir()) {
+  return import_path21.default.join(hermesHomeDir(homeDir2), HERMES_CONFIG_FILENAME);
 }
-function hermesAllowlistPath(homeDir2 = import_os16.default.homedir()) {
-  return import_path20.default.join(hermesHomeDir(homeDir2), HERMES_ALLOWLIST_FILENAME);
+function hermesAllowlistPath(homeDir2 = import_os18.default.homedir()) {
+  return import_path21.default.join(hermesHomeDir(homeDir2), HERMES_ALLOWLIST_FILENAME);
 }
 function setupHermes() {
-  const homeDir2 = import_os16.default.homedir();
+  const homeDir2 = import_os18.default.homedir();
   const configPath = hermesConfigPath(homeDir2);
   const allowlistPath = hermesAllowlistPath(homeDir2);
-  if (!import_fs19.default.existsSync(configPath)) {
+  if (!import_fs21.default.existsSync(configPath)) {
     console.log(import_chalk.default.yellow(`  \u26A0\uFE0F  Hermes config not found at ${configPath}`));
     console.log(import_chalk.default.gray("     Run `hermes setup` first, then re-run node9 agents add hermes."));
     return;
   }
   let anythingChanged = false;
-  const raw = import_fs19.default.readFileSync(configPath, "utf-8");
-  const doc = yaml.parseDocument(raw);
+  const raw = import_fs21.default.readFileSync(configPath, "utf-8");
+  const doc = yaml2.parseDocument(raw);
   if (doc.errors.length > 0) {
     console.log(import_chalk.default.yellow(`  \u26A0\uFE0F  Hermes config.yaml has YAML parse errors:`));
     for (const err2 of doc.errors.slice(0, 3)) {
@@ -13428,9 +14125,9 @@ function setupHermes() {
     atomicWriteSync(configPath, doc.toString());
   }
   let allowlist = {};
-  if (import_fs19.default.existsSync(allowlistPath)) {
+  if (import_fs21.default.existsSync(allowlistPath)) {
     try {
-      allowlist = JSON.parse(import_fs19.default.readFileSync(allowlistPath, "utf-8"));
+      allowlist = JSON.parse(import_fs21.default.readFileSync(allowlistPath, "utf-8"));
     } catch {
       allowlist = {};
     }
@@ -13466,15 +14163,15 @@ function setupHermes() {
   }
 }
 function teardownHermes() {
-  const homeDir2 = import_os16.default.homedir();
+  const homeDir2 = import_os18.default.homedir();
   const configPath = hermesConfigPath(homeDir2);
   const allowlistPath = hermesAllowlistPath(homeDir2);
-  if (!import_fs19.default.existsSync(configPath)) {
+  if (!import_fs21.default.existsSync(configPath)) {
     console.log(import_chalk.default.blue(`  \u2139\uFE0F  ${configPath} not found \u2014 nothing to remove`));
     return;
   }
-  const raw = import_fs19.default.readFileSync(configPath, "utf-8");
-  const doc = yaml.parseDocument(raw);
+  const raw = import_fs21.default.readFileSync(configPath, "utf-8");
+  const doc = yaml2.parseDocument(raw);
   if (doc.errors.length > 0) {
     console.log(
       import_chalk.default.yellow(`  \u26A0\uFE0F  Skipping ${configPath} \u2014 file has YAML parse errors, fix it manually.`)
@@ -13506,16 +14203,16 @@ function teardownHermesConfigDoc(doc, configPath) {
     anythingChanged = true;
   }
   if (anythingChanged) {
-    import_fs19.default.writeFileSync(configPath, doc.toString());
+    import_fs21.default.writeFileSync(configPath, doc.toString());
     console.log(import_chalk.default.green(`  \u2705 Removed Node9 hooks from ${configPath}`));
   } else {
     console.log(import_chalk.default.blue(`  \u2139\uFE0F  No Node9 hooks found in ${configPath}`));
   }
 }
 function teardownHermesAllowlist(allowlistPath) {
-  if (!import_fs19.default.existsSync(allowlistPath)) return;
+  if (!import_fs21.default.existsSync(allowlistPath)) return;
   try {
-    const raw = import_fs19.default.readFileSync(allowlistPath, "utf-8");
+    const raw = import_fs21.default.readFileSync(allowlistPath, "utf-8");
     const allowlist = JSON.parse(raw);
     if (!Array.isArray(allowlist.approvals)) return;
     const before = allowlist.approvals.length;
@@ -13528,44 +14225,44 @@ function teardownHermesAllowlist(allowlistPath) {
   } catch {
   }
 }
-function getAgentsStatus(homeDir2 = import_os16.default.homedir()) {
+function getAgentsStatus(homeDir2 = import_os18.default.homedir()) {
   const detected = detectAgents(homeDir2);
   const claudeWired = (() => {
-    const settings = readJson(import_path20.default.join(homeDir2, ".claude", "settings.json"));
+    const settings = readJson2(import_path21.default.join(homeDir2, ".claude", "settings.json"));
     return !!settings?.hooks?.PreToolUse?.some((m) => m.hooks.some((h) => isNode9Hook(h.command)));
   })();
   const geminiWired = (() => {
-    const settings = readJson(import_path20.default.join(homeDir2, ".gemini", "settings.json"));
+    const settings = readJson2(import_path21.default.join(homeDir2, ".gemini", "settings.json"));
     return !!settings?.hooks?.BeforeTool?.some((m) => m.hooks.some((h) => isNode9Hook(h.command)));
   })();
   const antigravityWired = (() => {
-    const hooksFile = readJson(
-      import_path20.default.join(homeDir2, ".gemini", "config", "hooks.json")
+    const hooksFile = readJson2(
+      import_path21.default.join(homeDir2, ".gemini", "config", "hooks.json")
     );
     return !!hooksFile?.hooks?.PreToolUse?.some((m) => m.hooks.some((h) => isNode9Hook(h.command)));
   })();
   const copilotWired = (() => {
-    const hooksFile = readJson(
-      import_path20.default.join(homeDir2, ".copilot", "hooks", "node9.json")
+    const hooksFile = readJson2(
+      import_path21.default.join(homeDir2, ".copilot", "hooks", "node9.json")
     );
     return !!hooksFile?.hooks?.PreToolUse?.some((h) => isNode9Hook(h.command));
   })();
   const cursorWired = (() => {
-    const cfg = readJson(import_path20.default.join(homeDir2, ".cursor", "mcp.json"));
+    const cfg = readJson2(import_path21.default.join(homeDir2, ".cursor", "mcp.json"));
     return !!(cfg?.mcpServers && hasNode9McpServer(cfg.mcpServers));
   })();
   const codexWired = (() => {
-    const cfg = readToml(import_path20.default.join(homeDir2, ".codex", "config.toml"));
+    const cfg = readToml(import_path21.default.join(homeDir2, ".codex", "config.toml"));
     return !!(cfg?.mcp_servers && hasNode9McpServer(cfg.mcp_servers));
   })();
   const windsurfWired = (() => {
-    const cfg = readJson(
-      import_path20.default.join(homeDir2, ".codeium", "windsurf", "mcp_config.json")
+    const cfg = readJson2(
+      import_path21.default.join(homeDir2, ".codeium", "windsurf", "mcp_config.json")
     );
     return !!(cfg?.mcpServers && hasNode9McpServer(cfg.mcpServers));
   })();
   const vscodeWired = (() => {
-    const cfg = readJson(import_path20.default.join(homeDir2, ".vscode", "mcp.json"));
+    const cfg = readJson2(import_path21.default.join(homeDir2, ".vscode", "mcp.json"));
     return !!(cfg?.servers && hasNode9McpServerVSCode(cfg.servers));
   })();
   return [
@@ -13632,7 +14329,7 @@ function getAgentsStatus(homeDir2 = import_os16.default.homedir()) {
       wired: (() => {
         const cfgPath = claudeDesktopConfigPath(homeDir2);
         if (!cfgPath) return false;
-        const cfg = readJson(cfgPath);
+        const cfg = readJson2(cfgPath);
         return !!(cfg?.mcpServers && hasNode9McpServer(cfg.mcpServers));
       })(),
       mode: detected.claudeDesktop ? "mcp" : null
@@ -13642,16 +14339,16 @@ function getAgentsStatus(homeDir2 = import_os16.default.homedir()) {
       label: "Opencode",
       installed: detected.opencode,
       wired: (() => {
-        const pluginPath = import_path20.default.join(
+        const pluginPath = import_path21.default.join(
           homeDir2,
           ".config",
           "opencode",
           "plugins",
           OPENCODE_PLUGIN_NAME
         );
-        if (import_fs19.default.existsSync(pluginPath)) return true;
-        const cfg = readJson(
-          import_path20.default.join(homeDir2, ".config", "opencode", "opencode.json")
+        if (import_fs21.default.existsSync(pluginPath)) return true;
+        const cfg = readJson2(
+          import_path21.default.join(homeDir2, ".config", "opencode", "opencode.json")
         );
         return !!cfg?.mcp?.["node9"];
       })(),
@@ -13663,7 +14360,7 @@ function getAgentsStatus(homeDir2 = import_os16.default.homedir()) {
       installed: detected.pi,
       // Pi has no MCP path — only the extension file. "wired" is a
       // simple existence check on the canonical install location.
-      wired: import_fs19.default.existsSync(import_path20.default.join(homeDir2, ".pi", "agent", "extensions", PI_EXTENSION_NAME)),
+      wired: import_fs21.default.existsSync(import_path21.default.join(homeDir2, ".pi", "agent", "extensions", PI_EXTENSION_NAME)),
       mode: detected.pi ? "hooks" : null
     },
     {
@@ -13675,8 +14372,8 @@ function getAgentsStatus(homeDir2 = import_os16.default.homedir()) {
       // Document API for a boolean status check.
       wired: (() => {
         try {
-          const raw = import_fs19.default.readFileSync(hermesConfigPath(homeDir2), "utf-8");
-          const cfg = yaml.parse(raw);
+          const raw = import_fs21.default.readFileSync(hermesConfigPath(homeDir2), "utf-8");
+          const cfg = yaml2.parse(raw);
           const pre = cfg?.hooks?.["pre_tool_call"] ?? [];
           return pre.some((e) => typeof e?.command === "string" && isNode9Hook(e.command));
         } catch {
@@ -13687,18 +14384,19 @@ function getAgentsStatus(homeDir2 = import_os16.default.homedir()) {
     }
   ];
 }
-var import_fs19, import_path20, import_os16, import_chalk, import_prompts, import_smol_toml2, yaml, NODE9_MCP_SERVER_ENTRY, MCP_WRAP_SUBCOMMAND, LEGACY_MCP_WRAP_SUBCOMMAND, CODEX_PRE_TOOL_MATCHERS, OPENCODE_PLUGIN_NAME, PI_EXTENSION_NAME, HERMES_CONFIG_FILENAME, HERMES_ALLOWLIST_FILENAME, HERMES_HOOK_PLAN;
+var import_fs21, import_path21, import_os18, import_chalk, import_prompts, import_smol_toml4, yaml2, NODE9_MCP_SERVER_ENTRY, MCP_WRAP_SUBCOMMAND, LEGACY_MCP_WRAP_SUBCOMMAND, CODEX_PRE_TOOL_MATCHERS, OPENCODE_PLUGIN_NAME, PI_EXTENSION_NAME, HERMES_CONFIG_FILENAME, HERMES_ALLOWLIST_FILENAME, HERMES_HOOK_PLAN;
 var init_setup = __esm({
   "src/setup.ts"() {
     "use strict";
-    import_fs19 = __toESM(require("fs"));
-    import_path20 = __toESM(require("path"));
-    import_os16 = __toESM(require("os"));
+    import_fs21 = __toESM(require("fs"));
+    import_path21 = __toESM(require("path"));
+    import_os18 = __toESM(require("os"));
     import_chalk = __toESM(require("chalk"));
     import_prompts = require("@inquirer/prompts");
-    import_smol_toml2 = require("smol-toml");
+    import_smol_toml4 = require("smol-toml");
+    init_mcp_wrap();
     init_codex_trust();
-    yaml = __toESM(require("yaml"));
+    yaml2 = __toESM(require("yaml"));
     init_mcp_pin();
     init_hook_baseline();
     init_setup_opencode_shim();
@@ -13719,244 +14417,6 @@ var init_setup = __esm({
   }
 });
 
-// src/agent-wiring.ts
-function readJson2(filePath) {
-  if (!import_fs20.default.existsSync(filePath)) return null;
-  try {
-    return JSON.parse(import_fs20.default.readFileSync(filePath, "utf-8"));
-  } catch {
-    return "invalid";
-  }
-}
-function matchersHaveNode9Hook(matchers) {
-  return (matchers ?? []).some((m) => (m.hooks ?? []).some((h) => isNode9Hook(h.command)));
-}
-function flatHaveNode9Hook(entries) {
-  return (Array.isArray(entries) ? entries : []).some((h) => isNode9Hook(h.command));
-}
-function readHookRoot(filePath, format) {
-  if (!import_fs20.default.existsSync(filePath)) return "absent";
-  let raw;
-  try {
-    raw = import_fs20.default.readFileSync(filePath, "utf-8");
-  } catch {
-    return "absent";
-  }
-  try {
-    const parsed = format === "yaml" ? yaml2.parse(raw) : JSON.parse(raw);
-    return parsed?.hooks ?? {};
-  } catch {
-    return "invalid";
-  }
-}
-function eventWired(root, ev, format) {
-  const arr = root[ev.key];
-  if (format === "matcher") return matchersHaveNode9Hook(arr);
-  return flatHaveNode9Hook(arr);
-}
-function detectMcp(servers) {
-  const entries = Object.entries(servers ?? {});
-  const present = entries.some(([, s]) => s?.command === "node9");
-  const wrapped = entries.filter(([, s]) => s?.command === "node9" && Array.isArray(s.args) && s.args.length > 0).map(([name, s]) => `${name} \u2192 ${s.args.join(" ")}`);
-  return { wrapped, present };
-}
-function readMcpServers(filePath, format) {
-  if (!import_fs20.default.existsSync(filePath)) return {};
-  try {
-    if (format === "toml") {
-      const parsed2 = (0, import_smol_toml3.parse)(import_fs20.default.readFileSync(filePath, "utf-8"));
-      return parsed2?.mcp_servers ?? {};
-    }
-    const parsed = readJson2(filePath);
-    if (parsed === null || parsed === "invalid") return {};
-    return parsed.mcpServers ?? {};
-  } catch {
-    return {};
-  }
-}
-function readMcp(filePath, format) {
-  if (!import_fs20.default.existsSync(filePath)) return { wrapped: [], present: false };
-  try {
-    if (format === "toml") {
-      const parsed2 = (0, import_smol_toml3.parse)(import_fs20.default.readFileSync(filePath, "utf-8"));
-      return detectMcp(parsed2?.mcp_servers);
-    }
-    const parsed = readJson2(filePath);
-    if (parsed === null || parsed === "invalid") return { wrapped: [], present: false };
-    return detectMcp(parsed.mcpServers);
-  } catch {
-    return { wrapped: [], present: false };
-  }
-}
-function getAgentWiring(home = import_os17.default.homedir()) {
-  const detected = detectAgents(home);
-  return AGENT_SPECS.map((spec) => {
-    const present = spec.present(home);
-    const pad = spec.labelPad ?? DEFAULT_LABEL_PAD;
-    let hooks;
-    let wireState;
-    let hookLabel;
-    let settingsPath;
-    if (spec.shimFile) {
-      const shimWired = exists(spec.shimFile(home));
-      hooks = [{ label: "node9 plugin (node9 check)", wired: shimWired }];
-      wireState = shimWired ? "wired" : present ? "unwired" : "absent";
-      hookLabel = "node9 plugin";
-      settingsPath = spec.shimFile(home);
-    } else {
-      const root = spec.hookFile ? readHookRoot(spec.hookFile(home), spec.hookFormat) : "absent";
-      const primary = spec.hookEvents[0];
-      const rootPresent = root !== "absent" && root !== "invalid";
-      hooks = spec.hookEvents.map((ev) => ({
-        label: hookLabelOf(ev, pad),
-        wired: rootPresent && eventWired(root, ev, spec.hookFormat)
-      }));
-      if (root === "absent") wireState = "absent";
-      else if (root === "invalid") wireState = "invalid";
-      else wireState = primary && eventWired(root, primary, spec.hookFormat) ? "wired" : "unwired";
-      hookLabel = primary ? `${primary.key} hook` : "MCP proxy";
-      settingsPath = spec.hookFile ? spec.hookFile(home) : spec.mcpFile ? spec.mcpFile(home) : "";
-    }
-    const mcp = spec.mcpFile ? readMcp(spec.mcpFile(home), spec.mcpFormat ?? "json") : null;
-    const anyHookWired = hooks.some((h) => h.wired);
-    return {
-      id: spec.id,
-      label: spec.label,
-      setupCommand: spec.setupCommand,
-      installed: detected[spec.id],
-      present,
-      hooks,
-      wireState,
-      hookLabel,
-      settingsPath,
-      configFormat: spec.hookFormat === "yaml" ? "YAML" : "JSON",
-      mcpServers: mcp ? mcp.wrapped : null,
-      mcpProtected: mcp ? mcp.present : false,
-      isProtected: anyHookWired || (mcp?.present ?? false)
-    };
-  });
-}
-var import_fs20, import_path21, import_os17, yaml2, import_smol_toml3, exists, ck, lg, DEFAULT_LABEL_PAD, hookLabelOf, AGENT_SPECS;
-var init_agent_wiring = __esm({
-  "src/agent-wiring.ts"() {
-    "use strict";
-    import_fs20 = __toESM(require("fs"));
-    import_path21 = __toESM(require("path"));
-    import_os17 = __toESM(require("os"));
-    yaml2 = __toESM(require("yaml"));
-    import_smol_toml3 = require("smol-toml");
-    init_setup();
-    exists = (p) => {
-      try {
-        return import_fs20.default.existsSync(p);
-      } catch {
-        return false;
-      }
-    };
-    ck = (key) => ({ key, kind: "check" });
-    lg = (key) => ({ key, kind: "log" });
-    DEFAULT_LABEL_PAD = 11;
-    hookLabelOf = (ev, pad) => `${ev.key.padEnd(pad)} (node9 ${ev.kind})`;
-    AGENT_SPECS = [
-      {
-        id: "claude",
-        label: "Claude Code",
-        setupCommand: "node9 agents add claude",
-        hookFile: (h) => import_path21.default.join(h, ".claude", "settings.json"),
-        hookFormat: "matcher",
-        // UserPromptSubmit is prompt DLP. setup.ts has written it for Claude since
-        // that shipped; the spec must name it too, or status/doctor never show the
-        // row and heal (which repairs via setupAgent) has no signal it is missing.
-        hookEvents: [ck("PreToolUse"), lg("PostToolUse"), ck("UserPromptSubmit")],
-        mcpFile: (h) => import_path21.default.join(h, ".claude.json"),
-        present: (h) => exists(import_path21.default.join(h, ".claude", "settings.json")) || exists(import_path21.default.join(h, ".claude.json"))
-      },
-      {
-        id: "gemini",
-        label: "Gemini CLI",
-        setupCommand: "node9 agents add gemini",
-        hookFile: (h) => import_path21.default.join(h, ".gemini", "settings.json"),
-        hookFormat: "matcher",
-        hookEvents: [ck("BeforeTool"), lg("AfterTool")],
-        mcpFile: (h) => import_path21.default.join(h, ".gemini", "settings.json"),
-        present: (h) => exists(import_path21.default.join(h, ".gemini", "settings.json"))
-      },
-      {
-        id: "codex",
-        label: "Codex",
-        setupCommand: "node9 agents add codex",
-        hookFile: (h) => import_path21.default.join(h, ".codex", "hooks.json"),
-        hookFormat: "matcher",
-        hookEvents: [ck("PreToolUse"), ck("UserPromptSubmit")],
-        mcpFile: (h) => import_path21.default.join(h, ".codex", "config.toml"),
-        mcpFormat: "toml",
-        present: (h) => exists(import_path21.default.join(h, ".codex"))
-      },
-      {
-        id: "antigravity",
-        label: "Antigravity",
-        setupCommand: "node9 agents add antigravity",
-        hookFile: (h) => import_path21.default.join(h, ".gemini", "config", "hooks.json"),
-        hookFormat: "matcher",
-        hookEvents: [ck("PreToolUse"), lg("PostToolUse")],
-        mcpFile: (h) => import_path21.default.join(h, ".gemini", "config", "mcp_config.json"),
-        present: (h) => exists(import_path21.default.join(h, ".gemini", "config", "hooks.json")) || exists(import_path21.default.join(h, ".gemini", "antigravity-cli")) || exists(import_path21.default.join(h, ".gemini", "antigravity-ide"))
-      },
-      {
-        id: "copilot",
-        label: "GitHub Copilot",
-        setupCommand: "node9 agents add copilot",
-        hookFile: (h) => import_path21.default.join(h, ".copilot", "hooks", "node9.json"),
-        hookFormat: "flat",
-        hookEvents: [ck("PreToolUse"), lg("PostToolUse"), ck("UserPromptSubmit")],
-        mcpFile: (h) => import_path21.default.join(h, ".copilot", "mcp-config.json"),
-        present: (h) => exists(import_path21.default.join(h, ".copilot"))
-      },
-      {
-        id: "cursor",
-        label: "Cursor",
-        setupCommand: "node9 agents add cursor",
-        // MCP-only — no hook file (see note above).
-        hookFormat: "flat",
-        hookEvents: [],
-        mcpFile: (h) => import_path21.default.join(h, ".cursor", "mcp.json"),
-        present: (h) => exists(import_path21.default.join(h, ".cursor", "mcp.json"))
-      },
-      {
-        id: "hermes",
-        label: "Hermes Agent",
-        setupCommand: "node9 agents add hermes",
-        hookFile: (h) => hermesConfigPath(h),
-        hookFormat: "yaml",
-        hookEvents: [ck("pre_tool_call"), lg("post_tool_call")],
-        labelPad: 14,
-        // 'post_tool_call' is wider than the default
-        present: (h) => exists(hermesConfigPath(h))
-      },
-      {
-        // Plugin-shim agents — protected by a node9-authored plugin/extension file
-        // (no hooks, no MCP). hookFormat is unused for these (shimFile drives it).
-        id: "opencode",
-        label: "OpenCode",
-        setupCommand: "node9 agents add opencode",
-        hookFormat: "flat",
-        hookEvents: [],
-        shimFile: (h) => import_path21.default.join(opencodeConfigDir(h), "plugins", "node9.js"),
-        present: (h) => exists(opencodeConfigDir(h)) || exists(import_path21.default.join(opencodeConfigDir(h), "plugins", "node9.js"))
-      },
-      {
-        id: "pi",
-        label: "Pi",
-        setupCommand: "node9 agents add pi",
-        hookFormat: "flat",
-        hookEvents: [],
-        shimFile: (h) => import_path21.default.join(h, ".pi", "agent", "extensions", "node9.js"),
-        present: (h) => exists(import_path21.default.join(h, ".pi", "agent")) || exists(import_path21.default.join(h, ".pi", "agent", "extensions", "node9.js"))
-      }
-    ];
-  }
-});
-
 // src/config/keyed-guard.ts
 function isKeyedForPolicy() {
   try {
@@ -13994,7 +14454,7 @@ function normalizeModel(raw) {
 }
 function readCache(opts) {
   try {
-    const raw = JSON.parse(import_fs21.default.readFileSync(CACHE_FILE(), "utf-8"));
+    const raw = JSON.parse(import_fs22.default.readFileSync(CACHE_FILE(), "utf-8"));
     if (typeof raw.fetchedAt !== "string" || typeof raw.prices !== "object" || raw.prices === null) {
       return null;
     }
@@ -14010,17 +14470,17 @@ function writeCache(prices) {
   try {
     const target = CACHE_FILE();
     const dir = import_path22.default.dirname(target);
-    if (!import_fs21.default.existsSync(dir)) import_fs21.default.mkdirSync(dir, { recursive: true });
+    if (!import_fs22.default.existsSync(dir)) import_fs22.default.mkdirSync(dir, { recursive: true });
     const tmp = target + ".tmp";
     const body = {
       fetchedAt: (/* @__PURE__ */ new Date()).toISOString(),
       prices
     };
-    import_fs21.default.writeFileSync(tmp, JSON.stringify(body) + "\n", "utf-8");
-    import_fs21.default.renameSync(tmp, target);
+    import_fs22.default.writeFileSync(tmp, JSON.stringify(body) + "\n", "utf-8");
+    import_fs22.default.renameSync(tmp, target);
   } catch (err2) {
     try {
-      import_fs21.default.appendFileSync(
+      import_fs22.default.appendFileSync(
         HOOK_DEBUG_LOG,
         `[pricing] cache write failed: ${err2.message}
 `
@@ -14123,13 +14583,13 @@ function pricingFor(model, options = {}) {
   lookupCache.set(lookupKey, resolved);
   return resolved;
 }
-var import_fs21, import_path22, import_os18, LITELLM_URL, BUNDLED_PRICING, CACHE_FILE, TTL_MS, memCache, memCacheAt, diskChecked, lookupCache;
+var import_fs22, import_path22, import_os19, LITELLM_URL, BUNDLED_PRICING, CACHE_FILE, TTL_MS, memCache, memCacheAt, diskChecked, lookupCache;
 var init_litellm = __esm({
   "src/pricing/litellm.ts"() {
     "use strict";
-    import_fs21 = __toESM(require("fs"));
+    import_fs22 = __toESM(require("fs"));
     import_path22 = __toESM(require("path"));
-    import_os18 = __toESM(require("os"));
+    import_os19 = __toESM(require("os"));
     init_audit();
     LITELLM_URL = "https://raw.githubusercontent.com/BerriAI/litellm/main/model_prices_and_context_window.json";
     BUNDLED_PRICING = {
@@ -14181,7 +14641,7 @@ var init_litellm = __esm({
       "gemini-2.0-flash": [75e-9, 3e-7, 0, 0],
       "gemini-1.5-pro": [125e-8, 5e-6, 0, 0]
     };
-    CACHE_FILE = () => import_path22.default.join(import_os18.default.homedir(), ".node9", "model-pricing.json");
+    CACHE_FILE = () => import_path22.default.join(import_os19.default.homedir(), ".node9", "model-pricing.json");
     TTL_MS = 24 * 60 * 60 * 1e3;
     memCache = null;
     memCacheAt = 0;
@@ -14192,7 +14652,7 @@ var init_litellm = __esm({
 
 // src/cost-gemini.ts
 function geminiTmpDir() {
-  return import_path23.default.join(import_os19.default.homedir(), ".gemini", "tmp");
+  return import_path23.default.join(import_os20.default.homedir(), ".gemini", "tmp");
 }
 function geminiPriceFor(model) {
   let tuple = pricingFor(model);
@@ -14207,14 +14667,14 @@ function geminiPriceFor(model) {
 }
 function safeReaddir(dir) {
   try {
-    return import_fs22.default.readdirSync(dir);
+    return import_fs23.default.readdirSync(dir);
   } catch {
     return [];
   }
 }
 function isDir(p) {
   try {
-    return import_fs22.default.statSync(p).isDirectory();
+    return import_fs23.default.statSync(p).isDirectory();
   } catch {
     return false;
   }
@@ -14283,12 +14743,12 @@ function parseGeminiSession(lines, project) {
   if (runId) for (const e of byKey.values()) e.runId = runId;
   return [...byKey.values()];
 }
-var import_fs22, import_os19, import_path23, GEMINI_FALLBACK_MODELS, geminiSource;
+var import_fs23, import_os20, import_path23, GEMINI_FALLBACK_MODELS, geminiSource;
 var init_cost_gemini = __esm({
   "src/cost-gemini.ts"() {
     "use strict";
-    import_fs22 = __toESM(require("fs"));
-    import_os19 = __toESM(require("os"));
+    import_fs23 = __toESM(require("fs"));
+    import_os20 = __toESM(require("os"));
     import_path23 = __toESM(require("path"));
     init_litellm();
     GEMINI_FALLBACK_MODELS = ["gemini-2.5-flash", "gemini-2.0-flash"];
@@ -14296,7 +14756,7 @@ var init_cost_gemini = __esm({
       id: "gemini",
       available() {
         try {
-          return import_fs22.default.existsSync(geminiTmpDir());
+          return import_fs23.default.existsSync(geminiTmpDir());
         } catch {
           return false;
         }
@@ -14305,13 +14765,13 @@ var init_cost_gemini = __esm({
         const combined = /* @__PURE__ */ new Map();
         for (const { file, project } of listGeminiSessionFiles(geminiTmpDir())) {
           try {
-            if (sinceMs !== void 0 && import_fs22.default.statSync(file).mtimeMs < sinceMs) continue;
+            if (sinceMs !== void 0 && import_fs23.default.statSync(file).mtimeMs < sinceMs) continue;
           } catch {
             continue;
           }
           let content;
           try {
-            content = import_fs22.default.readFileSync(file, "utf8");
+            content = import_fs23.default.readFileSync(file, "utf8");
           } catch {
             continue;
           }
@@ -14337,7 +14797,7 @@ var init_cost_gemini = __esm({
 
 // src/cost-codex.ts
 function codexSessionsDir() {
-  return import_path24.default.join(process.env.CODEX_HOME?.trim() || import_path24.default.join(import_os20.default.homedir(), ".codex"), "sessions");
+  return import_path24.default.join(process.env.CODEX_HOME?.trim() || import_path24.default.join(import_os21.default.homedir(), ".codex"), "sessions");
 }
 function codexPriceFor(model) {
   return pricingFor(codexModel(model), { exact: true }) ?? CODEX_FALLBACK;
@@ -14369,14 +14829,14 @@ function codexSessionCost(model, tokens, request2) {
 function statAndFirstLine(file) {
   const CAP = 4 * 1024 * 1024;
   const CHUNK = 64 * 1024;
-  const fd = import_fs23.default.openSync(file, "r");
+  const fd = import_fs24.default.openSync(file, "r");
   try {
-    const stat = import_fs23.default.fstatSync(fd);
+    const stat = import_fs24.default.fstatSync(fd);
     const limit = Math.min(stat.size, CAP);
     const parts = [];
     for (let pos = 0; pos < limit; pos += CHUNK) {
       const buf = Buffer.alloc(Math.min(CHUNK, limit - pos));
-      const read2 = import_fs23.default.readSync(fd, buf, 0, buf.length, pos);
+      const read2 = import_fs24.default.readSync(fd, buf, 0, buf.length, pos);
       if (read2 <= 0) break;
       const slice = buf.subarray(0, read2);
       const nl = slice.indexOf(10);
@@ -14385,14 +14845,14 @@ function statAndFirstLine(file) {
     }
     return { stat, first: Buffer.concat(parts).toString("utf8") };
   } finally {
-    import_fs23.default.closeSync(fd);
+    import_fs24.default.closeSync(fd);
   }
 }
 function listCodexSessionFiles(base = codexSessionsDir()) {
   const files = [];
   const walk = (dir) => {
     try {
-      for (const entry of import_fs23.default.readdirSync(dir, { withFileTypes: true })) {
+      for (const entry of import_fs24.default.readdirSync(dir, { withFileTypes: true })) {
         const file = import_path24.default.join(dir, entry.name);
         if (entry.isDirectory()) walk(file);
         else if (entry.isFile() && entry.name.endsWith(".jsonl")) files.push(file);
@@ -14591,24 +15051,24 @@ function parseCodexSession(lines) {
   }
   return [...rows.values()];
 }
-var import_fs23, import_os20, import_path24, CODEX_FALLBACK, codexSource;
+var import_fs24, import_os21, import_path24, CODEX_FALLBACK, codexSource;
 var init_cost_codex = __esm({
   "src/cost-codex.ts"() {
     "use strict";
-    import_fs23 = __toESM(require("fs"));
-    import_os20 = __toESM(require("os"));
+    import_fs24 = __toESM(require("fs"));
+    import_os21 = __toESM(require("os"));
     import_path24 = __toESM(require("path"));
     init_litellm();
     CODEX_FALLBACK = [5e-6, 15e-6, 0, 25e-7];
     codexSource = {
       id: "codex",
-      available: () => import_fs23.default.existsSync(codexSessionsDir()) || import_fs23.default.existsSync(import_path24.default.join(import_path24.default.dirname(codexSessionsDir()), "archived_sessions")),
+      available: () => import_fs24.default.existsSync(codexSessionsDir()) || import_fs24.default.existsSync(import_path24.default.join(import_path24.default.dirname(codexSessionsDir()), "archived_sessions")),
       collect(sinceMs) {
         const entries = [];
         for (const file of listCodexSessionFiles()) {
           try {
-            if (sinceMs !== void 0 && import_fs23.default.statSync(file).mtimeMs < sinceMs) continue;
-            entries.push(...parseCodexSession(import_fs23.default.readFileSync(file, "utf8").split("\n")));
+            if (sinceMs !== void 0 && import_fs24.default.statSync(file).mtimeMs < sinceMs) continue;
+            entries.push(...parseCodexSession(import_fs24.default.readFileSync(file, "utf8").split("\n")));
           } catch {
           }
         }
@@ -14620,11 +15080,11 @@ var init_cost_codex = __esm({
 
 // src/cost-copilot.ts
 function copilotSessionsDir() {
-  return import_path25.default.join(import_os21.default.homedir(), ".copilot", "session-state");
+  return import_path25.default.join(import_os22.default.homedir(), ".copilot", "session-state");
 }
 function safeReaddir2(dir) {
   try {
-    return import_fs24.default.readdirSync(dir);
+    return import_fs25.default.readdirSync(dir);
   } catch {
     return [];
   }
@@ -14691,19 +15151,19 @@ function parseCopilotSession(lines) {
   }
   return rows;
 }
-var import_fs24, import_os21, import_path25, copilotSource;
+var import_fs25, import_os22, import_path25, copilotSource;
 var init_cost_copilot = __esm({
   "src/cost-copilot.ts"() {
     "use strict";
-    import_fs24 = __toESM(require("fs"));
-    import_os21 = __toESM(require("os"));
+    import_fs25 = __toESM(require("fs"));
+    import_os22 = __toESM(require("os"));
     import_path25 = __toESM(require("path"));
     init_litellm();
     copilotSource = {
       id: "copilot",
       available() {
         try {
-          return import_fs24.default.existsSync(copilotSessionsDir());
+          return import_fs25.default.existsSync(copilotSessionsDir());
         } catch {
           return false;
         }
@@ -14714,13 +15174,13 @@ var init_cost_copilot = __esm({
         for (const sid of safeReaddir2(base)) {
           const file = import_path25.default.join(base, sid, "events.jsonl");
           try {
-            if (sinceMs !== void 0 && import_fs24.default.statSync(file).mtimeMs < sinceMs) continue;
+            if (sinceMs !== void 0 && import_fs25.default.statSync(file).mtimeMs < sinceMs) continue;
           } catch {
             continue;
           }
           let content;
           try {
-            content = import_fs24.default.readFileSync(file, "utf8");
+            content = import_fs25.default.readFileSync(file, "utf8");
           } catch {
             continue;
           }
@@ -15157,7 +15617,7 @@ function buildSensitivePaths(home, cwd) {
 }
 function isReadable(filePath) {
   try {
-    import_fs25.default.accessSync(filePath, import_fs25.default.constants.R_OK);
+    import_fs26.default.accessSync(filePath, import_fs26.default.constants.R_OK);
     return true;
   } catch {
     return false;
@@ -15170,13 +15630,13 @@ function scoreLabel(score) {
   return import_chalk3.default.red.bold(`${score}/100  Critical`);
 }
 function runBlast() {
-  const home = import_os22.default.homedir();
+  const home = import_os23.default.homedir();
   const cwd = process.cwd();
   const paths = buildSensitivePaths(home, cwd);
   let scoreDeduction = 0;
   const reachable = [];
   for (const p of paths) {
-    if (import_fs25.default.existsSync(p.full) && isReadable(p.full)) {
+    if (import_fs26.default.existsSync(p.full) && isReadable(p.full)) {
       reachable.push(p);
       scoreDeduction += p.score;
     }
@@ -15194,7 +15654,7 @@ function runBlast() {
 }
 function registerBlastCommand(program2) {
   program2.command("blast").description("Map what an AI agent can currently reach on this machine").action(() => {
-    const home = import_os22.default.homedir();
+    const home = import_os23.default.homedir();
     const cwd = process.cwd();
     const { reachable, envFindings, score } = runBlast();
     console.log("");
@@ -15241,14 +15701,14 @@ function registerBlastCommand(program2) {
     console.log("");
   });
 }
-var import_chalk3, import_fs25, import_path26, import_os22;
+var import_chalk3, import_fs26, import_path26, import_os23;
 var init_blast = __esm({
   "src/cli/commands/blast.ts"() {
     "use strict";
     import_chalk3 = __toESM(require("chalk"));
-    import_fs25 = __toESM(require("fs"));
+    import_fs26 = __toESM(require("fs"));
     import_path26 = __toESM(require("path"));
-    import_os22 = __toESM(require("os"));
+    import_os23 = __toESM(require("os"));
     init_dlp();
   }
 });
@@ -15394,7 +15854,7 @@ function listSessionFiles(dir, maxDepth = 6) {
     if (depth > maxDepth) return;
     let entries;
     try {
-      entries = fs27.readdirSync(d, { withFileTypes: true });
+      entries = fs28.readdirSync(d, { withFileTypes: true });
     } catch {
       return;
     }
@@ -15410,24 +15870,24 @@ function listSessionFiles(dir, maxDepth = 6) {
 function sessionIdOf(relPath) {
   return path28.basename(relPath).replace(/\.jsonl$/, "");
 }
-var fs27, path28;
+var fs28, path28;
 var init_session_files = __esm({
   "src/session-files.ts"() {
     "use strict";
-    fs27 = __toESM(require("fs"));
+    fs28 = __toESM(require("fs"));
     path28 = __toESM(require("path"));
   }
 });
 
 // src/cli/render/scan-history.ts
 function defaultHistoryPath() {
-  return import_path27.default.join(import_os23.default.homedir(), ".node9", "scan-history.json");
+  return import_path27.default.join(import_os24.default.homedir(), ".node9", "scan-history.json");
 }
 function readPreviousScan(opts = {}) {
   const filePath = opts.path ?? defaultHistoryPath();
   try {
-    if (!import_fs26.default.existsSync(filePath)) return null;
-    const raw = import_fs26.default.readFileSync(filePath, "utf8");
+    if (!import_fs27.default.existsSync(filePath)) return null;
+    const raw = import_fs27.default.readFileSync(filePath, "utf8");
     const parsed = JSON.parse(raw);
     if (!Array.isArray(parsed) || parsed.length === 0) return null;
     const last = parsed[parsed.length - 1];
@@ -15441,11 +15901,11 @@ function appendScanHistory(record2, opts = {}) {
   const filePath = opts.path ?? defaultHistoryPath();
   const cap = opts.cap ?? SCAN_HISTORY_CAP;
   try {
-    import_fs26.default.mkdirSync(import_path27.default.dirname(filePath), { recursive: true });
+    import_fs27.default.mkdirSync(import_path27.default.dirname(filePath), { recursive: true });
     let history = [];
-    if (import_fs26.default.existsSync(filePath)) {
+    if (import_fs27.default.existsSync(filePath)) {
       try {
-        const parsed = JSON.parse(import_fs26.default.readFileSync(filePath, "utf8"));
+        const parsed = JSON.parse(import_fs27.default.readFileSync(filePath, "utf8"));
         if (Array.isArray(parsed)) {
           history = parsed.filter(isValidRecord);
         }
@@ -15478,13 +15938,13 @@ function isValidRecord(x) {
   const r = x;
   return typeof r.timestamp === "string" && typeof r.score === "number" && typeof r.blocked === "number" && typeof r.review === "number" && typeof r.leaks === "number" && typeof r.loops === "number" && typeof r.totalCalls === "number";
 }
-var import_fs26, import_path27, import_os23, SCAN_HISTORY_CAP;
+var import_fs27, import_path27, import_os24, SCAN_HISTORY_CAP;
 var init_scan_history = __esm({
   "src/cli/render/scan-history.ts"() {
     "use strict";
-    import_fs26 = __toESM(require("fs"));
+    import_fs27 = __toESM(require("fs"));
     import_path27 = __toESM(require("path"));
-    import_os23 = __toESM(require("os"));
+    import_os24 = __toESM(require("os"));
     init_atomic_write();
     SCAN_HISTORY_CAP = 30;
   }
@@ -15498,7 +15958,7 @@ function parseJSONLFile(filePath, fallbackWorkingDir) {
   const runId = import_path28.default.basename(filePath, ".jsonl");
   let content;
   try {
-    content = import_fs27.default.readFileSync(filePath, "utf8");
+    content = import_fs28.default.readFileSync(filePath, "utf8");
   } catch {
     return /* @__PURE__ */ new Map();
   }
@@ -15598,7 +16058,7 @@ async function postCostBatches(apiUrl, apiKey, machineId, entries) {
         signal: AbortSignal.timeout(15e3)
       });
       if (!res.ok) {
-        import_fs27.default.appendFileSync(HOOK_DEBUG_LOG, `[cost-sync] HTTP ${res.status}
+        import_fs28.default.appendFileSync(HOOK_DEBUG_LOG, `[cost-sync] HTTP ${res.status}
 `);
       } else {
         let stored;
@@ -15608,7 +16068,7 @@ async function postCostBatches(apiUrl, apiKey, machineId, entries) {
         } catch {
         }
         if (typeof stored === "number" && stored < batch.length) {
-          import_fs27.default.appendFileSync(
+          import_fs28.default.appendFileSync(
             HOOK_DEBUG_LOG,
             `[cost-sync] dropped ${batch.length - stored} of ${batch.length} rows
 `
@@ -15616,7 +16076,7 @@ async function postCostBatches(apiUrl, apiKey, machineId, entries) {
         }
       }
     } catch (err2) {
-      import_fs27.default.appendFileSync(HOOK_DEBUG_LOG, `[cost-sync] ${safeMessage(err2)}
+      import_fs28.default.appendFileSync(HOOK_DEBUG_LOG, `[cost-sync] ${safeMessage(err2)}
 `);
     }
   }
@@ -15629,10 +16089,10 @@ async function syncCost() {
   if (entries.length === 0) return;
   let username = "unknown";
   try {
-    username = import_os24.default.userInfo().username;
+    username = import_os25.default.userInfo().username;
   } catch {
   }
-  const machineId = `${import_os24.default.hostname()}:${username}`;
+  const machineId = `${import_os25.default.hostname()}:${username}`;
   await postCostBatches(creds.apiUrl, creds.apiKey, machineId, entries);
 }
 function startCostSync() {
@@ -15644,13 +16104,13 @@ function startCostSync() {
   }, SYNC_INTERVAL_MS);
   timer.unref();
 }
-var import_fs27, import_path28, import_os24, SYNC_INTERVAL_MS, claudeSource, COST_SOURCES, COST_BATCH_SIZE;
+var import_fs28, import_path28, import_os25, SYNC_INTERVAL_MS, claudeSource, COST_SOURCES, COST_BATCH_SIZE;
 var init_costSync = __esm({
   "src/costSync.ts"() {
     "use strict";
-    import_fs27 = __toESM(require("fs"));
+    import_fs28 = __toESM(require("fs"));
     import_path28 = __toESM(require("path"));
-    import_os24 = __toESM(require("os"));
+    import_os25 = __toESM(require("os"));
     init_config();
     init_audit();
     init_litellm();
@@ -15663,22 +16123,22 @@ var init_costSync = __esm({
     claudeSource = {
       id: "claude",
       available() {
-        return import_fs27.default.existsSync(import_path28.default.join(import_os24.default.homedir(), ".claude", "projects"));
+        return import_fs28.default.existsSync(import_path28.default.join(import_os25.default.homedir(), ".claude", "projects"));
       },
       collect(sinceMs) {
-        const projectsDir = import_path28.default.join(import_os24.default.homedir(), ".claude", "projects");
-        if (!import_fs27.default.existsSync(projectsDir)) return [];
+        const projectsDir = import_path28.default.join(import_os25.default.homedir(), ".claude", "projects");
+        if (!import_fs28.default.existsSync(projectsDir)) return [];
         const combined = /* @__PURE__ */ new Map();
         let dirs;
         try {
-          dirs = import_fs27.default.readdirSync(projectsDir);
+          dirs = import_fs28.default.readdirSync(projectsDir);
         } catch {
           return [];
         }
         for (const dir of dirs) {
           const dirPath = import_path28.default.join(projectsDir, dir);
           try {
-            if (!import_fs27.default.statSync(dirPath).isDirectory()) continue;
+            if (!import_fs28.default.statSync(dirPath).isDirectory()) continue;
           } catch {
             continue;
           }
@@ -15693,7 +16153,7 @@ var init_costSync = __esm({
             const filePath = import_path28.default.join(dirPath, file);
             if (sinceMs !== void 0) {
               try {
-                if (import_fs27.default.statSync(filePath).mtimeMs < sinceMs) continue;
+                if (import_fs28.default.statSync(filePath).mtimeMs < sinceMs) continue;
               } catch {
                 continue;
               }
@@ -15744,7 +16204,7 @@ function freshWatermark() {
 function loadWatermark() {
   let raw;
   try {
-    raw = import_fs28.default.readFileSync(WATERMARK_FILE(), "utf-8");
+    raw = import_fs29.default.readFileSync(WATERMARK_FILE(), "utf-8");
   } catch {
     return { status: "fresh", wm: freshWatermark() };
   }
@@ -15797,21 +16257,21 @@ function saveWatermark(wm) {
   if (wm.schemaVersion > WATERMARK_SCHEMA_VERSION) return;
   const target = WATERMARK_FILE();
   const dir = import_path29.default.dirname(target);
-  if (!import_fs28.default.existsSync(dir)) import_fs28.default.mkdirSync(dir, { recursive: true });
+  if (!import_fs29.default.existsSync(dir)) import_fs29.default.mkdirSync(dir, { recursive: true });
   const tmp = target + ".tmp";
-  import_fs28.default.writeFileSync(tmp, JSON.stringify(wm, null, 2) + "\n", "utf-8");
-  import_fs28.default.renameSync(tmp, target);
+  import_fs29.default.writeFileSync(tmp, JSON.stringify(wm, null, 2) + "\n", "utf-8");
+  import_fs29.default.renameSync(tmp, target);
 }
 function listJsonlFiles() {
   const root = PROJECTS_DIR();
-  if (!import_fs28.default.existsSync(root)) return [];
+  if (!import_fs29.default.existsSync(root)) return [];
   const out = [];
-  for (const entry of import_fs28.default.readdirSync(root, { withFileTypes: true })) {
+  for (const entry of import_fs29.default.readdirSync(root, { withFileTypes: true })) {
     if (!entry.isDirectory()) continue;
     const projectDir = import_path29.default.join(root, entry.name);
     let inner;
     try {
-      inner = import_fs28.default.readdirSync(projectDir, { withFileTypes: true });
+      inner = import_fs29.default.readdirSync(projectDir, { withFileTypes: true });
     } catch {
       continue;
     }
@@ -15825,7 +16285,7 @@ function listJsonlFiles() {
 }
 function fileSize(p) {
   try {
-    return import_fs28.default.statSync(p).size;
+    return import_fs29.default.statSync(p).size;
   } catch {
     return 0;
   }
@@ -15835,7 +16295,7 @@ async function scanDelta(filePath, fromByte, onLine) {
   if (size <= fromByte) return fromByte;
   const lastNl = findLastNewline(filePath, fromByte, size);
   const endsWithNewline = lastNl === size - 1;
-  const stream = import_fs28.default.createReadStream(filePath, {
+  const stream = import_fs29.default.createReadStream(filePath, {
     start: fromByte,
     end: size - 1,
     highWaterMark: 64 * 1024
@@ -15864,7 +16324,7 @@ function findLastNewline(filePath, from, size) {
   const CHUNK = 64 * 1024;
   let fd;
   try {
-    fd = import_fs28.default.openSync(filePath, "r");
+    fd = import_fs29.default.openSync(filePath, "r");
   } catch {
     return -1;
   }
@@ -15873,7 +16333,7 @@ function findLastNewline(filePath, from, size) {
     let end = size;
     while (end > from) {
       const start = Math.max(from, end - CHUNK);
-      const n = import_fs28.default.readSync(fd, buf, 0, end - start, start);
+      const n = import_fs29.default.readSync(fd, buf, 0, end - start, start);
       const idx = buf.subarray(0, n).lastIndexOf(10);
       if (idx !== -1) return start + idx;
       end = start;
@@ -15882,7 +16342,7 @@ function findLastNewline(filePath, from, size) {
   } catch {
     return -1;
   } finally {
-    import_fs28.default.closeSync(fd);
+    import_fs29.default.closeSync(fd);
   }
 }
 function safeCanaryCtxValues() {
@@ -16047,7 +16507,7 @@ function emptyTick(uploadAs) {
 function readRawWatermarkPreservingOffsets() {
   let raw;
   try {
-    raw = import_fs28.default.readFileSync(WATERMARK_FILE(), "utf-8");
+    raw = import_fs29.default.readFileSync(WATERMARK_FILE(), "utf-8");
   } catch {
     return null;
   }
@@ -16082,7 +16542,7 @@ async function runActualTick(wm) {
     if (!known) {
       let mtimeMs = 0;
       try {
-        mtimeMs = import_fs28.default.statSync(filePath).mtime.getTime();
+        mtimeMs = import_fs29.default.statSync(filePath).mtime.getTime();
       } catch {
         continue;
       }
@@ -16133,20 +16593,20 @@ async function runActualTick(wm) {
   }
   return result;
 }
-var import_fs28, import_os25, import_path29, import_readline, PROJECTS_DIR, WATERMARK_FILE, MAX_LINE_BYTES, WATERMARK_SCHEMA_VERSION, LONG_OUTPUT_THRESHOLD_BYTES2;
+var import_fs29, import_os26, import_path29, import_readline, PROJECTS_DIR, WATERMARK_FILE, MAX_LINE_BYTES, WATERMARK_SCHEMA_VERSION, LONG_OUTPUT_THRESHOLD_BYTES2;
 var init_scan_watermark = __esm({
   "src/daemon/scan-watermark.ts"() {
     "use strict";
-    import_fs28 = __toESM(require("fs"));
-    import_os25 = __toESM(require("os"));
+    import_fs29 = __toESM(require("fs"));
+    import_os26 = __toESM(require("os"));
     import_path29 = __toESM(require("path"));
     import_readline = __toESM(require("readline"));
     init_dlp();
     init_registry();
     init_config();
     init_dist();
-    PROJECTS_DIR = () => import_path29.default.join(import_os25.default.homedir(), ".claude", "projects");
-    WATERMARK_FILE = () => import_path29.default.join(import_os25.default.homedir(), ".node9", "scan-watermark.json");
+    PROJECTS_DIR = () => import_path29.default.join(import_os26.default.homedir(), ".claude", "projects");
+    WATERMARK_FILE = () => import_path29.default.join(import_os26.default.homedir(), ".node9", "scan-watermark.json");
     MAX_LINE_BYTES = 2 * 1024 * 1024;
     WATERMARK_SCHEMA_VERSION = 2;
     LONG_OUTPUT_THRESHOLD_BYTES2 = LONG_OUTPUT_THRESHOLD_BYTES;
@@ -16195,10 +16655,10 @@ function parseSinceCutoff(raw, now = /* @__PURE__ */ new Date()) {
   return now.getTime() - 90 * 864e5;
 }
 function* iterateJsonlFiles(cutoffMs) {
-  const projectsDir = import_path30.default.join(import_os26.default.homedir(), ".claude", "projects");
+  const projectsDir = import_path30.default.join(import_os27.default.homedir(), ".claude", "projects");
   let dirs;
   try {
-    dirs = import_fs29.default.readdirSync(projectsDir);
+    dirs = import_fs30.default.readdirSync(projectsDir);
   } catch {
     return;
   }
@@ -16206,14 +16666,14 @@ function* iterateJsonlFiles(cutoffMs) {
     const dirPath = import_path30.default.join(projectsDir, dir);
     let stats;
     try {
-      stats = import_fs29.default.statSync(dirPath);
+      stats = import_fs30.default.statSync(dirPath);
     } catch {
       continue;
     }
     if (!stats.isDirectory()) continue;
     let files;
     try {
-      files = import_fs29.default.readdirSync(dirPath).filter((f) => f.endsWith(".jsonl"));
+      files = import_fs30.default.readdirSync(dirPath).filter((f) => f.endsWith(".jsonl"));
     } catch {
       continue;
     }
@@ -16221,7 +16681,7 @@ function* iterateJsonlFiles(cutoffMs) {
       const filePath = import_path30.default.join(dirPath, file);
       let mtime = 0;
       try {
-        mtime = import_fs29.default.statSync(filePath).mtimeMs;
+        mtime = import_fs30.default.statSync(filePath).mtimeMs;
       } catch {
         continue;
       }
@@ -16296,7 +16756,7 @@ async function runUploadHistory(opts) {
     filesScanned++;
     let content;
     try {
-      content = import_fs29.default.readFileSync(filePath, "utf8");
+      content = import_fs30.default.readFileSync(filePath, "utf8");
     } catch {
       continue;
     }
@@ -16370,10 +16830,10 @@ async function runUploadHistory(opts) {
     const costUrl = creds.apiUrl.endsWith("/policies/sync") ? creds.apiUrl.replace(/\/policies\/sync$/, "/cost-sync") : `${creds.apiUrl.replace(/\/$/, "")}/cost-sync`;
     let username = "unknown";
     try {
-      username = import_os26.default.userInfo().username;
+      username = import_os27.default.userInfo().username;
     } catch {
     }
-    const machineId = `${import_os26.default.hostname()}:${username}`;
+    const machineId = `${import_os27.default.hostname()}:${username}`;
     await postJson(costUrl, creds.apiKey, {
       machineId,
       entries: dailyEntries
@@ -16423,13 +16883,13 @@ async function postJson(url, apiKey, body) {
     req.end();
   });
 }
-var import_fs29, import_https, import_os26, import_path30, import_chalk5, FINDING_TO_SIGNAL2;
+var import_fs30, import_https, import_os27, import_path30, import_chalk5, FINDING_TO_SIGNAL2;
 var init_scan_upload_history = __esm({
   "src/scan-upload-history.ts"() {
     "use strict";
-    import_fs29 = __toESM(require("fs"));
+    import_fs30 = __toESM(require("fs"));
     import_https = __toESM(require("https"));
-    import_os26 = __toESM(require("os"));
+    import_os27 = __toESM(require("os"));
     import_path30 = __toESM(require("path"));
     import_chalk5 = __toESM(require("chalk"));
     init_dist();
@@ -16537,7 +16997,7 @@ function findingKey(ruleName, inputPreview, projLabel) {
   return `${ruleName ?? "<unnamed>"}|${inputPreview}|${projLabel}`;
 }
 function displayHome(p) {
-  const home = import_os27.default.homedir();
+  const home = import_os28.default.homedir();
   return p.startsWith(home) ? "~" + p.slice(home.length) : p;
 }
 function dlpKey(patternName, redactedSample, projLabel) {
@@ -16734,14 +17194,14 @@ function buildRuleSources() {
 }
 function countScanFiles() {
   let total = 0;
-  const claudeDir = import_path31.default.join(import_os27.default.homedir(), ".claude", "projects");
-  if (import_fs30.default.existsSync(claudeDir)) {
+  const claudeDir = import_path31.default.join(import_os28.default.homedir(), ".claude", "projects");
+  if (import_fs31.default.existsSync(claudeDir)) {
     try {
-      for (const proj of import_fs30.default.readdirSync(claudeDir)) {
+      for (const proj of import_fs31.default.readdirSync(claudeDir)) {
         const p = import_path31.default.join(claudeDir, proj);
         try {
-          if (!import_fs30.default.statSync(p).isDirectory()) continue;
-          total += import_fs30.default.readdirSync(p).filter((f) => f.endsWith(".jsonl") && !f.startsWith("agent-")).length;
+          if (!import_fs31.default.statSync(p).isDirectory()) continue;
+          total += import_fs31.default.readdirSync(p).filter((f) => f.endsWith(".jsonl") && !f.startsWith("agent-")).length;
         } catch {
           continue;
         }
@@ -16749,17 +17209,17 @@ function countScanFiles() {
     } catch {
     }
   }
-  const geminiDir = import_path31.default.join(import_os27.default.homedir(), ".gemini", "tmp");
-  if (import_fs30.default.existsSync(geminiDir)) {
+  const geminiDir = import_path31.default.join(import_os28.default.homedir(), ".gemini", "tmp");
+  if (import_fs31.default.existsSync(geminiDir)) {
     try {
-      for (const slug2 of import_fs30.default.readdirSync(geminiDir)) {
+      for (const slug2 of import_fs31.default.readdirSync(geminiDir)) {
         const p = import_path31.default.join(geminiDir, slug2);
         try {
-          if (!import_fs30.default.statSync(p).isDirectory()) continue;
+          if (!import_fs31.default.statSync(p).isDirectory()) continue;
           const chatsDir = import_path31.default.join(p, "chats");
-          if (import_fs30.default.existsSync(chatsDir)) {
+          if (import_fs31.default.existsSync(chatsDir)) {
             try {
-              total += import_fs30.default.readdirSync(chatsDir).filter((f) => f.endsWith(".json")).length;
+              total += import_fs31.default.readdirSync(chatsDir).filter((f) => f.endsWith(".json")).length;
             } catch {
             }
           }
@@ -16771,15 +17231,15 @@ function countScanFiles() {
     }
   }
   for (const surface of ["antigravity-cli", "antigravity-ide"]) {
-    const brainDir = import_path31.default.join(import_os27.default.homedir(), ".gemini", surface, "brain");
-    if (!import_fs30.default.existsSync(brainDir)) continue;
+    const brainDir = import_path31.default.join(import_os28.default.homedir(), ".gemini", surface, "brain");
+    if (!import_fs31.default.existsSync(brainDir)) continue;
     try {
-      for (const conv of import_fs30.default.readdirSync(brainDir)) {
+      for (const conv of import_fs31.default.readdirSync(brainDir)) {
         const convPath = import_path31.default.join(brainDir, conv);
         try {
-          if (!import_fs30.default.statSync(convPath).isDirectory()) continue;
+          if (!import_fs31.default.statSync(convPath).isDirectory()) continue;
           const logsDir = import_path31.default.join(convPath, ".system_generated", "logs");
-          if (import_fs30.default.existsSync(import_path31.default.join(logsDir, "transcript_full.jsonl")) || import_fs30.default.existsSync(import_path31.default.join(logsDir, "transcript.jsonl"))) {
+          if (import_fs31.default.existsSync(import_path31.default.join(logsDir, "transcript_full.jsonl")) || import_fs31.default.existsSync(import_path31.default.join(logsDir, "transcript.jsonl"))) {
             total += 1;
           }
         } catch {
@@ -16789,11 +17249,11 @@ function countScanFiles() {
     } catch {
     }
   }
-  const copilotDir = import_path31.default.join(import_os27.default.homedir(), ".copilot", "session-state");
-  if (import_fs30.default.existsSync(copilotDir)) {
+  const copilotDir = import_path31.default.join(import_os28.default.homedir(), ".copilot", "session-state");
+  if (import_fs31.default.existsSync(copilotDir)) {
     try {
-      for (const sid of import_fs30.default.readdirSync(copilotDir)) {
-        if (import_fs30.default.existsSync(import_path31.default.join(copilotDir, sid, "events.jsonl"))) total += 1;
+      for (const sid of import_fs31.default.readdirSync(copilotDir)) {
+        if (import_fs31.default.existsSync(import_path31.default.join(copilotDir, sid, "events.jsonl"))) total += 1;
       }
     } catch {
     }
@@ -16820,7 +17280,7 @@ function processClaudeFile(file, projPath, projLabel, ruleSources, startDate, re
   const session = { sessionId, costUSD: 0, toolCalls: 0 };
   let raw;
   try {
-    raw = import_fs30.default.readFileSync(import_path31.default.join(projPath, file), "utf-8");
+    raw = import_fs31.default.readFileSync(import_path31.default.join(projPath, file), "utf-8");
   } catch {
     return;
   }
@@ -17064,11 +17524,11 @@ function processClaudeFile(file, projPath, projLabel, ruleSources, startDate, re
 function processClaudeProject(proj, projectsDir, ruleSources, startDate, result, dedup, canaryVals, onProgress, onLine) {
   const projPath = import_path31.default.join(projectsDir, proj);
   try {
-    if (!import_fs30.default.statSync(projPath).isDirectory()) return;
+    if (!import_fs31.default.statSync(projPath).isDirectory()) return;
   } catch {
     return;
   }
-  const projLabel = stripTerminalEscapes(decodeURIComponent(proj).replace(import_os27.default.homedir(), "~")).slice(
+  const projLabel = stripTerminalEscapes(decodeURIComponent(proj).replace(import_os28.default.homedir(), "~")).slice(
     0,
     40
   );
@@ -17111,12 +17571,12 @@ function emptyClaudeScan() {
   };
 }
 function scanClaudeHistory(startDate, onProgress, onLine) {
-  const projectsDir = import_path31.default.join(import_os27.default.homedir(), ".claude", "projects");
+  const projectsDir = import_path31.default.join(import_os28.default.homedir(), ".claude", "projects");
   const result = emptyClaudeScan();
-  if (!import_fs30.default.existsSync(projectsDir)) return result;
+  if (!import_fs31.default.existsSync(projectsDir)) return result;
   let projDirs;
   try {
-    projDirs = import_fs30.default.readdirSync(projectsDir);
+    projDirs = import_fs31.default.readdirSync(projectsDir);
   } catch {
     return result;
   }
@@ -17140,7 +17600,7 @@ function scanClaudeHistory(startDate, onProgress, onLine) {
 }
 function scanGeminiHistory(startDate, onProgress, onLine) {
   const canaryVals = safeCanaryScanValues();
-  const tmpDir = import_path31.default.join(import_os27.default.homedir(), ".gemini", "tmp");
+  const tmpDir = import_path31.default.join(import_os28.default.homedir(), ".gemini", "tmp");
   const result = {
     filesScanned: 0,
     sessions: 0,
@@ -17157,10 +17617,10 @@ function scanGeminiHistory(startDate, onProgress, onLine) {
     perSession: []
   };
   const dedup = emptyScanDedup();
-  if (!import_fs30.default.existsSync(tmpDir)) return result;
+  if (!import_fs31.default.existsSync(tmpDir)) return result;
   let slugDirs;
   try {
-    slugDirs = import_fs30.default.readdirSync(tmpDir);
+    slugDirs = import_fs31.default.readdirSync(tmpDir);
   } catch {
     return result;
   }
@@ -17168,22 +17628,22 @@ function scanGeminiHistory(startDate, onProgress, onLine) {
   for (const slug2 of slugDirs) {
     const slugPath = import_path31.default.join(tmpDir, slug2);
     try {
-      if (!import_fs30.default.statSync(slugPath).isDirectory()) continue;
+      if (!import_fs31.default.statSync(slugPath).isDirectory()) continue;
     } catch {
       continue;
     }
     let projLabel = stripTerminalEscapes(slug2).slice(0, 40);
     try {
       projLabel = stripTerminalEscapes(
-        import_fs30.default.readFileSync(import_path31.default.join(slugPath, ".project_root"), "utf-8").trim()
-      ).replace(import_os27.default.homedir(), "~").slice(0, 40);
+        import_fs31.default.readFileSync(import_path31.default.join(slugPath, ".project_root"), "utf-8").trim()
+      ).replace(import_os28.default.homedir(), "~").slice(0, 40);
     } catch {
     }
     const chatsDir = import_path31.default.join(slugPath, "chats");
-    if (!import_fs30.default.existsSync(chatsDir)) continue;
+    if (!import_fs31.default.existsSync(chatsDir)) continue;
     let chatFiles;
     try {
-      chatFiles = import_fs30.default.readdirSync(chatsDir).filter((f) => f.endsWith(".json") || f.endsWith(".jsonl")).sort((a, b) => Number(b.endsWith(".jsonl")) - Number(a.endsWith(".jsonl")));
+      chatFiles = import_fs31.default.readdirSync(chatsDir).filter((f) => f.endsWith(".json") || f.endsWith(".jsonl")).sort((a, b) => Number(b.endsWith(".jsonl")) - Number(a.endsWith(".jsonl")));
     } catch {
       continue;
     }
@@ -17196,7 +17656,7 @@ function scanGeminiHistory(startDate, onProgress, onLine) {
       onProgress?.(result.filesScanned);
       let raw;
       try {
-        raw = import_fs30.default.readFileSync(import_path31.default.join(chatsDir, chatFile), "utf-8");
+        raw = import_fs31.default.readFileSync(import_path31.default.join(chatsDir, chatFile), "utf-8");
       } catch {
         continue;
       }
@@ -17391,13 +17851,13 @@ function scanGeminiHistory(startDate, onProgress, onLine) {
   return result;
 }
 function antigravityBrainDirs() {
-  return ["antigravity-cli", "antigravity-ide"].map((surface) => import_path31.default.join(import_os27.default.homedir(), ".gemini", surface, "brain")).filter((p) => import_fs30.default.existsSync(p));
+  return ["antigravity-cli", "antigravity-ide"].map((surface) => import_path31.default.join(import_os28.default.homedir(), ".gemini", surface, "brain")).filter((p) => import_fs31.default.existsSync(p));
 }
 function antigravityTranscriptPath(convPath) {
   const logsDir = import_path31.default.join(convPath, ".system_generated", "logs");
   for (const name of ["transcript_full.jsonl", "transcript.jsonl"]) {
     const p = import_path31.default.join(logsDir, name);
-    if (import_fs30.default.existsSync(p)) return p;
+    if (import_fs31.default.existsSync(p)) return p;
   }
   return null;
 }
@@ -17426,14 +17886,14 @@ function scanAntigravityHistory(startDate, onProgress, onLine) {
   for (const brainDir of brainDirs) {
     let convDirs;
     try {
-      convDirs = import_fs30.default.readdirSync(brainDir);
+      convDirs = import_fs31.default.readdirSync(brainDir);
     } catch {
       continue;
     }
     for (const conv of convDirs) {
       const convPath = import_path31.default.join(brainDir, conv);
       try {
-        if (!import_fs30.default.statSync(convPath).isDirectory()) continue;
+        if (!import_fs31.default.statSync(convPath).isDirectory()) continue;
       } catch {
         continue;
       }
@@ -17443,7 +17903,7 @@ function scanAntigravityHistory(startDate, onProgress, onLine) {
       onProgress?.(result.filesScanned);
       let raw;
       try {
-        raw = import_fs30.default.readFileSync(transcriptFile, "utf-8");
+        raw = import_fs31.default.readFileSync(transcriptFile, "utf-8");
       } catch {
         continue;
       }
@@ -17511,7 +17971,7 @@ function scanAntigravityHistory(startDate, onProgress, onLine) {
             result.bashCalls++;
             const cwd = String(input.cwd ?? "");
             if (cwd && projLabel === conv.slice(0, 8)) {
-              projLabel = stripTerminalEscapes(cwd).replace(import_os27.default.homedir(), "~").slice(0, 40);
+              projLabel = stripTerminalEscapes(cwd).replace(import_os28.default.homedir(), "~").slice(0, 40);
             }
           }
           const rawCmd = String(input.command ?? "").trimStart();
@@ -17623,7 +18083,7 @@ function scanAntigravityHistory(startDate, onProgress, onLine) {
 }
 function scanCopilotHistory(startDate, onProgress, onLine) {
   const canaryVals = safeCanaryScanValues();
-  const sessionDir = import_path31.default.join(import_os27.default.homedir(), ".copilot", "session-state");
+  const sessionDir = import_path31.default.join(import_os28.default.homedir(), ".copilot", "session-state");
   const result = {
     filesScanned: 0,
     sessions: 0,
@@ -17641,22 +18101,22 @@ function scanCopilotHistory(startDate, onProgress, onLine) {
     perSession: []
   };
   const dedup = emptyScanDedup();
-  if (!import_fs30.default.existsSync(sessionDir)) return result;
+  if (!import_fs31.default.existsSync(sessionDir)) return result;
   let sessionIds;
   try {
-    sessionIds = import_fs30.default.readdirSync(sessionDir);
+    sessionIds = import_fs31.default.readdirSync(sessionDir);
   } catch {
     return result;
   }
   const ruleSources = buildRuleSources();
   for (const sessionId of sessionIds) {
     const eventsPath = import_path31.default.join(sessionDir, sessionId, "events.jsonl");
-    if (!import_fs30.default.existsSync(eventsPath)) continue;
+    if (!import_fs31.default.existsSync(eventsPath)) continue;
     result.filesScanned++;
     onProgress?.(result.filesScanned);
     let raw;
     try {
-      raw = import_fs30.default.readFileSync(eventsPath, "utf-8");
+      raw = import_fs31.default.readFileSync(eventsPath, "utf-8");
     } catch {
       continue;
     }
@@ -17680,7 +18140,7 @@ function scanCopilotHistory(startDate, onProgress, onLine) {
       if (ev.type === "session.start") {
         const cwd = ev.data?.context?.cwd;
         if (typeof cwd === "string" && cwd) {
-          projLabel = stripTerminalEscapes(cwd).replace(import_os27.default.homedir(), "~").slice(0, 40);
+          projLabel = stripTerminalEscapes(cwd).replace(import_os28.default.homedir(), "~").slice(0, 40);
         }
         continue;
       }
@@ -17858,7 +18318,7 @@ function scanCodexHistory(startDate, onProgress, onLine) {
     onProgress?.(result.filesScanned);
     let lines;
     try {
-      lines = import_fs30.default.readFileSync(filePath, "utf-8").split("\n");
+      lines = import_fs31.default.readFileSync(filePath, "utf-8").split("\n");
     } catch {
       continue;
     }
@@ -17881,7 +18341,7 @@ function scanCodexHistory(startDate, onProgress, onLine) {
         sessionId = String(payload["id"] ?? filePath);
         startTime = String(payload["timestamp"] ?? "");
         const cwd = String(payload["cwd"] ?? "");
-        projLabel = stripTerminalEscapes(cwd.replace(import_os27.default.homedir(), "~")).slice(0, 40);
+        projLabel = stripTerminalEscapes(cwd.replace(import_os28.default.homedir(), "~")).slice(0, 40);
         continue;
       }
       if (entry.type === "event_msg" && payload["type"] === "user_message") {
@@ -18048,17 +18508,17 @@ function scanCodexHistory(startDate, onProgress, onLine) {
   return result;
 }
 function scanShellConfig() {
-  const home = import_os27.default.homedir();
+  const home = import_os28.default.homedir();
   const configFiles = [".zshrc", ".bashrc", ".bash_profile", ".profile"].map(
     (f) => import_path31.default.join(home, f)
   );
   const findings = [];
   const seen = /* @__PURE__ */ new Set();
   for (const filePath of configFiles) {
-    if (!import_fs30.default.existsSync(filePath)) continue;
+    if (!import_fs31.default.existsSync(filePath)) continue;
     let lines;
     try {
-      lines = import_fs30.default.readFileSync(filePath, "utf-8").split("\n");
+      lines = import_fs31.default.readFileSync(filePath, "utf-8").split("\n");
     } catch {
       continue;
     }
@@ -19203,15 +19663,15 @@ function registerScanCommand(program2) {
     }
   );
 }
-var import_chalk6, import_fs30, import_path31, import_os27, import_string_width2, toolInspectionMap, CODE_EXTENSIONS, SELF_OUTPUT_MARKERS, LOOP_TOOLS, LOOP_THRESHOLD, LOOP_TIMESPAN_THRESHOLD_MS, STUCK_TOOLS_MIN_WASTE, STUCK_TOOLS_LIMIT, RECURRING_SESSION_THRESHOLD, STALE_AGE_DAYS, classifyRuleSeverity2, narrativeRuleLabel2;
+var import_chalk6, import_fs31, import_path31, import_os28, import_string_width2, toolInspectionMap, CODE_EXTENSIONS, SELF_OUTPUT_MARKERS, LOOP_TOOLS, LOOP_THRESHOLD, LOOP_TIMESPAN_THRESHOLD_MS, STUCK_TOOLS_MIN_WASTE, STUCK_TOOLS_LIMIT, RECURRING_SESSION_THRESHOLD, STALE_AGE_DAYS, classifyRuleSeverity2, narrativeRuleLabel2;
 var init_scan = __esm({
   "src/cli/commands/scan.ts"() {
     "use strict";
     init_keyed_guard();
     import_chalk6 = __toESM(require("chalk"));
-    import_fs30 = __toESM(require("fs"));
+    import_fs31 = __toESM(require("fs"));
     import_path31 = __toESM(require("path"));
-    import_os27 = __toESM(require("os"));
+    import_os28 = __toESM(require("os"));
     init_shields();
     init_config();
     init_policy();
@@ -19296,7 +19756,7 @@ var init_scan = __esm({
 function readOwnVersion() {
   for (const rel of ["../package.json", "../../package.json"]) {
     try {
-      const raw = import_fs31.default.readFileSync(import_path32.default.join(__dirname, rel), "utf-8");
+      const raw = import_fs32.default.readFileSync(import_path32.default.join(__dirname, rel), "utf-8");
       const v = JSON.parse(raw).version;
       if (typeof v === "string" && v.length > 0) return v;
     } catch {
@@ -19307,7 +19767,7 @@ function readOwnVersion() {
 function computeBuildId(entry = process.argv[1] ?? "") {
   let mtimeMs = 0;
   try {
-    if (entry) mtimeMs = import_fs31.default.statSync(entry).mtimeMs;
+    if (entry) mtimeMs = import_fs32.default.statSync(entry).mtimeMs;
   } catch {
   }
   return { version: readOwnVersion(), mtimeMs };
@@ -19349,11 +19809,11 @@ function describeBuildDrift(running, installed) {
   const theirVersion = typeof running.version === "string" ? running.version : "unknown";
   return `running daemon is v${theirVersion} (build ${theirs}) but installed is v${installed.version} (build ${mine}) \u2014 it is enforcing a different build`;
 }
-var import_fs31, import_path32, CURRENT_BUILD;
+var import_fs32, import_path32, CURRENT_BUILD;
 var init_build_id = __esm({
   "src/daemon/build-id.ts"() {
     "use strict";
-    import_fs31 = __toESM(require("fs"));
+    import_fs32 = __toESM(require("fs"));
     import_path32 = __toESM(require("path"));
     CURRENT_BUILD = parseBuildId(process.env.NODE9_BUILD_ID_OVERRIDE) ?? computeBuildId();
   }
@@ -19450,11 +19910,11 @@ var init_suggestion_tracker = __esm({
 });
 
 // src/daemon/taint-store.ts
-var import_fs32, import_path33, DEFAULT_TTL_MS, TaintStore, SESSION_TAINT_TTL_MS, SessionTaintStore;
+var import_fs33, import_path33, DEFAULT_TTL_MS, TaintStore, SESSION_TAINT_TTL_MS, SessionTaintStore;
 var init_taint_store = __esm({
   "src/daemon/taint-store.ts"() {
     "use strict";
-    import_fs32 = __toESM(require("fs"));
+    import_fs33 = __toESM(require("fs"));
     import_path33 = __toESM(require("path"));
     DEFAULT_TTL_MS = 60 * 60 * 1e3;
     TaintStore = class {
@@ -19521,7 +19981,7 @@ var init_taint_store = __esm({
       /** Resolve to absolute path, falling back to path.resolve if file doesn't exist yet. */
       _resolve(filePath) {
         try {
-          return import_fs32.default.realpathSync.native(import_path33.default.resolve(filePath));
+          return import_fs33.default.realpathSync.native(import_path33.default.resolve(filePath));
         } catch {
           return import_path33.default.resolve(filePath);
         }
@@ -19689,8 +20149,8 @@ var init_session_history = __esm({
 // src/daemon/state.ts
 function loadInsightCounts() {
   try {
-    if (!import_fs33.default.existsSync(INSIGHT_COUNTS_FILE)) return;
-    const data = JSON.parse(import_fs33.default.readFileSync(INSIGHT_COUNTS_FILE, "utf-8"));
+    if (!import_fs34.default.existsSync(INSIGHT_COUNTS_FILE)) return;
+    const data = JSON.parse(import_fs34.default.readFileSync(INSIGHT_COUNTS_FILE, "utf-8"));
     for (const [tool, count] of Object.entries(data)) {
       if (typeof count === "number" && count > 0) insightCounts.set(tool, count);
     }
@@ -19747,15 +20207,15 @@ function appendAuditLog(data) {
       source: "daemon"
     };
     const dir = import_path34.default.dirname(AUDIT_LOG_FILE);
-    if (!import_fs33.default.existsSync(dir)) import_fs33.default.mkdirSync(dir, { recursive: true });
-    import_fs33.default.appendFileSync(AUDIT_LOG_FILE, JSON.stringify(entry) + "\n");
+    if (!import_fs34.default.existsSync(dir)) import_fs34.default.mkdirSync(dir, { recursive: true });
+    import_fs34.default.appendFileSync(AUDIT_LOG_FILE, JSON.stringify(entry) + "\n");
   } catch {
   }
 }
 function getAuditHistory(limit = 20) {
   try {
-    if (!import_fs33.default.existsSync(AUDIT_LOG_FILE)) return [];
-    const lines = import_fs33.default.readFileSync(AUDIT_LOG_FILE, "utf-8").trim().split("\n");
+    if (!import_fs34.default.existsSync(AUDIT_LOG_FILE)) return [];
+    const lines = import_fs34.default.readFileSync(AUDIT_LOG_FILE, "utf-8").trim().split("\n");
     if (lines.length === 1 && lines[0] === "") return [];
     return lines.slice(-limit).map((l) => JSON.parse(l)).reverse();
   } catch {
@@ -19764,7 +20224,7 @@ function getAuditHistory(limit = 20) {
 }
 function getOrgName() {
   try {
-    if (import_fs33.default.existsSync(CREDENTIALS_FILE)) return "Node9 Cloud";
+    if (import_fs34.default.existsSync(CREDENTIALS_FILE)) return "Node9 Cloud";
   } catch {
   }
   return null;
@@ -19772,8 +20232,8 @@ function getOrgName() {
 function writeGlobalSetting(key, value) {
   let config = {};
   try {
-    if (import_fs33.default.existsSync(GLOBAL_CONFIG_FILE)) {
-      config = JSON.parse(import_fs33.default.readFileSync(GLOBAL_CONFIG_FILE, "utf-8"));
+    if (import_fs34.default.existsSync(GLOBAL_CONFIG_FILE)) {
+      config = JSON.parse(import_fs34.default.readFileSync(GLOBAL_CONFIG_FILE, "utf-8"));
     }
   } catch {
   }
@@ -19785,8 +20245,8 @@ function writeTrustEntry(toolName, durationMs, commandPattern) {
   try {
     let trust = { entries: [] };
     try {
-      if (import_fs33.default.existsSync(TRUST_FILE2))
-        trust = JSON.parse(import_fs33.default.readFileSync(TRUST_FILE2, "utf-8"));
+      if (import_fs34.default.existsSync(TRUST_FILE2))
+        trust = JSON.parse(import_fs34.default.readFileSync(TRUST_FILE2, "utf-8"));
     } catch {
     }
     trust.entries = trust.entries.filter(
@@ -19803,8 +20263,8 @@ function writeTrustEntry(toolName, durationMs, commandPattern) {
 }
 function readPersistentDecisions() {
   try {
-    if (import_fs33.default.existsSync(DECISIONS_FILE)) {
-      return JSON.parse(import_fs33.default.readFileSync(DECISIONS_FILE, "utf-8"));
+    if (import_fs34.default.existsSync(DECISIONS_FILE)) {
+      return JSON.parse(import_fs34.default.readFileSync(DECISIONS_FILE, "utf-8"));
     }
   } catch {
   }
@@ -19832,7 +20292,7 @@ function estimateToolCost(tool, args) {
     const filePath = a.file_path ?? a.path;
     if (filePath) {
       try {
-        const bytes = import_fs33.default.statSync(filePath).size;
+        const bytes = import_fs34.default.statSync(filePath).size;
         return bytes / BYTES_PER_TOKEN / 1e6 * INPUT_PRICE_PER_1M;
       } catch {
       }
@@ -19906,7 +20366,7 @@ function abandonPending() {
   });
   if (autoStarted) {
     try {
-      import_fs33.default.unlinkSync(DAEMON_PID_FILE);
+      import_fs34.default.unlinkSync(DAEMON_PID_FILE);
     } catch {
     }
     setTimeout(() => {
@@ -19917,7 +20377,7 @@ function abandonPending() {
 }
 function logActivitySocket(msg) {
   try {
-    import_fs33.default.appendFileSync(
+    import_fs34.default.appendFileSync(
       import_path34.default.join(homeDir, ".node9", "hook-debug.log"),
       `[${(/* @__PURE__ */ new Date()).toISOString()}] [activity-socket] ${msg}
 `
@@ -19940,13 +20400,13 @@ function shouldRebind(now = Date.now()) {
 function startActivitySocket() {
   bindActivitySocket();
   activityHealthInterval = setInterval(() => {
-    if (!import_fs33.default.existsSync(ACTIVITY_SOCKET_PATH2)) attemptRebind("health-probe");
+    if (!import_fs34.default.existsSync(ACTIVITY_SOCKET_PATH2)) attemptRebind("health-probe");
   }, ACTIVITY_HEALTH_PROBE_MS);
   activityHealthInterval.unref();
   process.on("exit", () => {
     if (activityHealthInterval) clearInterval(activityHealthInterval);
     try {
-      import_fs33.default.unlinkSync(ACTIVITY_SOCKET_PATH2);
+      import_fs34.default.unlinkSync(ACTIVITY_SOCKET_PATH2);
     } catch {
     }
   });
@@ -19974,7 +20434,7 @@ function attemptRebind(reason) {
 }
 function bindActivitySocket() {
   try {
-    import_fs33.default.unlinkSync(ACTIVITY_SOCKET_PATH2);
+    import_fs34.default.unlinkSync(ACTIVITY_SOCKET_PATH2);
   } catch {
   }
   const ACTIVITY_MAX_BYTES = 1024 * 1024;
@@ -20068,14 +20528,14 @@ function bindActivitySocket() {
   });
   activitySocketServer = unixServer;
 }
-var import_net2, import_fs33, import_path34, import_os28, import_crypto11, homeDir, DAEMON_PID_FILE, DECISIONS_FILE, AUDIT_LOG_FILE, TRUST_FILE2, GLOBAL_CONFIG_FILE, CREDENTIALS_FILE, INSIGHT_COUNTS_FILE, pending, sseClients, suggestionTracker, taintStore, sessionTaintStore, insightCounts, _abandonTimer, _hadBrowserClient, _daemonServer, daemonRejectionHandlerRegistered, AUTO_DENY_MS, TRUST_DURATIONS, autoStarted, ACTIVITY_SOCKET_PATH2, ACTIVITY_RING_SIZE, activityRing, LARGE_RESPONSE_RING_SIZE, largeResponseRing, cachedScanResult, cachedScanTs, SCAN_CACHE_TTL_MS, SECRET_KEY_RE, INPUT_PRICE_PER_1M, OUTPUT_PRICE_PER_1M, BYTES_PER_TOKEN, CRITICAL_FORENSIC_CATEGORIES, WRITE_TOOL_NAMES, ACTIVITY_REBIND_MAX_ATTEMPTS, ACTIVITY_REBIND_WINDOW_MS, ACTIVITY_HEALTH_PROBE_MS, activitySocketServer, activityHealthInterval, activityRebindAttempts, activityCircuitTripped;
+var import_net2, import_fs34, import_path34, import_os29, import_crypto11, homeDir, DAEMON_PID_FILE, DECISIONS_FILE, AUDIT_LOG_FILE, TRUST_FILE2, GLOBAL_CONFIG_FILE, CREDENTIALS_FILE, INSIGHT_COUNTS_FILE, pending, sseClients, suggestionTracker, taintStore, sessionTaintStore, insightCounts, _abandonTimer, _hadBrowserClient, _daemonServer, daemonRejectionHandlerRegistered, AUTO_DENY_MS, TRUST_DURATIONS, autoStarted, ACTIVITY_SOCKET_PATH2, ACTIVITY_RING_SIZE, activityRing, LARGE_RESPONSE_RING_SIZE, largeResponseRing, cachedScanResult, cachedScanTs, SCAN_CACHE_TTL_MS, SECRET_KEY_RE, INPUT_PRICE_PER_1M, OUTPUT_PRICE_PER_1M, BYTES_PER_TOKEN, CRITICAL_FORENSIC_CATEGORIES, WRITE_TOOL_NAMES, ACTIVITY_REBIND_MAX_ATTEMPTS, ACTIVITY_REBIND_WINDOW_MS, ACTIVITY_HEALTH_PROBE_MS, activitySocketServer, activityHealthInterval, activityRebindAttempts, activityCircuitTripped;
 var init_state2 = __esm({
   "src/daemon/state.ts"() {
     "use strict";
     import_net2 = __toESM(require("net"));
-    import_fs33 = __toESM(require("fs"));
+    import_fs34 = __toESM(require("fs"));
     import_path34 = __toESM(require("path"));
-    import_os28 = __toESM(require("os"));
+    import_os29 = __toESM(require("os"));
     import_crypto11 = require("crypto");
     init_daemon();
     init_suggestion_tracker();
@@ -20083,7 +20543,7 @@ var init_state2 = __esm({
     init_session_counters();
     init_session_history();
     init_atomic_write();
-    homeDir = import_os28.default.homedir();
+    homeDir = import_os29.default.homedir();
     DAEMON_PID_FILE = import_path34.default.join(homeDir, ".node9", "daemon.pid");
     DECISIONS_FILE = import_path34.default.join(homeDir, ".node9", "decisions.json");
     AUDIT_LOG_FILE = import_path34.default.join(homeDir, ".node9", "audit.log");
@@ -20108,7 +20568,7 @@ var init_state2 = __esm({
       "2h": 2 * 60 * 6e4
     };
     autoStarted = process.env.NODE9_AUTO_STARTED === "1";
-    ACTIVITY_SOCKET_PATH2 = process.platform === "win32" ? "\\\\.\\pipe\\node9-activity" : import_path34.default.join(import_os28.default.tmpdir(), "node9-activity.sock");
+    ACTIVITY_SOCKET_PATH2 = process.platform === "win32" ? "\\\\.\\pipe\\node9-activity" : import_path34.default.join(import_os29.default.tmpdir(), "node9-activity.sock");
     ACTIVITY_RING_SIZE = 100;
     activityRing = [];
     LARGE_RESPONSE_RING_SIZE = 20;
@@ -20161,7 +20621,7 @@ function safeRead(file) {
 function candidateFiles(home, cwd) {
   const files = /* @__PURE__ */ new Set();
   try {
-    for (const name of import_fs34.default.readdirSync(cwd)) {
+    for (const name of import_fs35.default.readdirSync(cwd)) {
       if (name === ".env" || name.startsWith(".env.")) files.add(import_path35.default.join(cwd, name));
     }
   } catch {
@@ -20191,7 +20651,7 @@ function plantedDecoyPaths() {
   }
 }
 function checkSecrets(ctx) {
-  const home = ctx.home || import_os29.default.homedir();
+  const home = ctx.home || import_os30.default.homedir();
   const findings = [];
   const planted = plantedDecoyPaths();
   const plaintext = [];
@@ -20227,7 +20687,7 @@ function checkSecrets(ctx) {
   for (const file of credentialMaterial(home)) {
     if (planted.has(file)) continue;
     try {
-      if (import_fs34.default.statSync(file).isFile()) {
+      if (import_fs35.default.statSync(file).isFile()) {
         creds.push(displayPath(file, home));
         credPaths.push(file);
       }
@@ -20261,13 +20721,13 @@ function checkSecrets(ctx) {
   }
   return findings;
 }
-var import_fs34, import_path35, import_os29, MAX_FILE_BYTES;
+var import_fs35, import_path35, import_os30, MAX_FILE_BYTES;
 var init_secrets = __esm({
   "src/posture/secrets.ts"() {
     "use strict";
-    import_fs34 = __toESM(require("fs"));
+    import_fs35 = __toESM(require("fs"));
     import_path35 = __toESM(require("path"));
-    import_os29 = __toESM(require("os"));
+    import_os30 = __toESM(require("os"));
     init_dist();
     init_agent_wiring();
     init_registry();
@@ -20401,7 +20861,7 @@ var init_templates = __esm({
 // src/posture/egress.ts
 function sandboxEgressWallActive() {
   try {
-    return import_fs35.default.existsSync(ALLOWED_DOMAINS_PATH);
+    return import_fs36.default.existsSync(ALLOWED_DOMAINS_PATH);
   } catch {
     return false;
   }
@@ -20522,11 +20982,11 @@ function checkEgress(ctx) {
     })
   ];
 }
-var import_fs35;
+var import_fs36;
 var init_egress = __esm({
   "src/posture/egress.ts"() {
     "use strict";
-    import_fs35 = __toESM(require("fs"));
+    import_fs36 = __toESM(require("fs"));
     init_config();
     init_templates();
   }
@@ -20586,7 +21046,7 @@ function readServers(file, format, agent) {
     const capped = readCappedText(file, MAX_CONFIG_BYTES);
     if (!capped || capped.truncated) return [];
     const text = capped.text;
-    const map = format === "toml" ? (0, import_smol_toml4.parse)(text)?.mcp_servers : JSON.parse(text)?.mcpServers;
+    const map = format === "toml" ? (0, import_smol_toml5.parse)(text)?.mcp_servers : JSON.parse(text)?.mcpServers;
     if (!map || typeof map !== "object") return [];
     return Object.entries(map).map(([name, v]) => ({
       name,
@@ -20599,7 +21059,7 @@ function readServers(file, format, agent) {
   }
 }
 function checkSupplyChain(ctx) {
-  const home = ctx.home || import_os30.default.homedir();
+  const home = ctx.home || import_os31.default.homedir();
   const servers = [];
   for (const spec of AGENT_SPECS) {
     if (!spec.mcpFile) continue;
@@ -20639,13 +21099,13 @@ function checkSupplyChain(ctx) {
   }
   return findings;
 }
-var import_os30, import_path36, import_smol_toml4, PACKAGE_RUNNERS, MAX_CONFIG_BYTES;
+var import_os31, import_path36, import_smol_toml5, PACKAGE_RUNNERS, MAX_CONFIG_BYTES;
 var init_supply_chain = __esm({
   "src/posture/supply-chain.ts"() {
     "use strict";
-    import_os30 = __toESM(require("os"));
+    import_os31 = __toESM(require("os"));
     import_path36 = __toESM(require("path"));
-    import_smol_toml4 = require("smol-toml");
+    import_smol_toml5 = require("smol-toml");
     init_provenance();
     init_agent_wiring();
     init_read_capped();
@@ -20702,9 +21162,9 @@ var init_privilege = __esm({
 
 // src/posture/containment.ts
 function inContainer() {
-  if (import_fs36.default.existsSync("/.dockerenv") || import_fs36.default.existsSync("/run/.containerenv")) return true;
+  if (import_fs37.default.existsSync("/.dockerenv") || import_fs37.default.existsSync("/run/.containerenv")) return true;
   try {
-    const cgroup = import_fs36.default.readFileSync("/proc/1/cgroup", "utf8");
+    const cgroup = import_fs37.default.readFileSync("/proc/1/cgroup", "utf8");
     if (/docker|kubepods|containerd|lxc|libpod/.test(cgroup)) return true;
   } catch {
   }
@@ -20741,11 +21201,11 @@ Lighter \u2014 harden in place, keep full host access (about +${Math.round(
     }
   ];
 }
-var import_fs36, ISOLATION_WEIGHT;
+var import_fs37, ISOLATION_WEIGHT;
 var init_containment = __esm({
   "src/posture/containment.ts"() {
     "use strict";
-    import_fs36 = __toESM(require("fs"));
+    import_fs37 = __toESM(require("fs"));
     ISOLATION_WEIGHT = 12;
   }
 });
@@ -20808,7 +21268,7 @@ function collectListeners() {
   const byPort = /* @__PURE__ */ new Map();
   for (const file of ["/proc/net/tcp", "/proc/net/tcp6"]) {
     try {
-      for (const l of parseListeners(import_fs37.default.readFileSync(file, "utf8"))) {
+      for (const l of parseListeners(import_fs38.default.readFileSync(file, "utf8"))) {
         if (!byPort.has(l.port)) byPort.set(l.port, l);
       }
     } catch {
@@ -20820,11 +21280,11 @@ function readProc(pid) {
   let comm = "unknown";
   let cmdline = "";
   try {
-    comm = import_fs37.default.readFileSync(`/proc/${pid}/comm`, "utf8").trim().replace(/-MainThread$/, "") || "unknown";
+    comm = import_fs38.default.readFileSync(`/proc/${pid}/comm`, "utf8").trim().replace(/-MainThread$/, "") || "unknown";
   } catch {
   }
   try {
-    cmdline = import_fs37.default.readFileSync(`/proc/${pid}/cmdline`).toString().replace(/\0/g, " ").trim();
+    cmdline = import_fs38.default.readFileSync(`/proc/${pid}/cmdline`).toString().replace(/\0/g, " ").trim();
   } catch {
   }
   return { comm, cmdline };
@@ -20834,21 +21294,21 @@ function resolveProcesses(inodes) {
   if (inodes.size === 0) return map;
   let pids;
   try {
-    pids = import_fs37.default.readdirSync("/proc").filter((d) => /^\d+$/.test(d));
+    pids = import_fs38.default.readdirSync("/proc").filter((d) => /^\d+$/.test(d));
   } catch {
     return map;
   }
   for (const pid of pids) {
     let fds;
     try {
-      fds = import_fs37.default.readdirSync(`/proc/${pid}/fd`);
+      fds = import_fs38.default.readdirSync(`/proc/${pid}/fd`);
     } catch {
       continue;
     }
     for (const fd of fds) {
       let link;
       try {
-        link = import_fs37.default.readlinkSync(`/proc/${pid}/fd/${fd}`);
+        link = import_fs38.default.readlinkSync(`/proc/${pid}/fd/${fd}`);
       } catch {
         continue;
       }
@@ -20916,11 +21376,11 @@ function checkInbound(ctx) {
   }
   return findings;
 }
-var import_fs37, DB_EXPOSURE_WEIGHT, KNOWN_SERVICE_PORTS, KNOWN_SERVICE_COMMS, DB_LABEL, SHIELD_FOR_SERVICE;
+var import_fs38, DB_EXPOSURE_WEIGHT, KNOWN_SERVICE_PORTS, KNOWN_SERVICE_COMMS, DB_LABEL, SHIELD_FOR_SERVICE;
 var init_inbound = __esm({
   "src/posture/inbound.ts"() {
     "use strict";
-    import_fs37 = __toESM(require("fs"));
+    import_fs38 = __toESM(require("fs"));
     DB_EXPOSURE_WEIGHT = 4;
     KNOWN_SERVICE_PORTS = {
       5432: "PostgreSQL",
@@ -20955,7 +21415,7 @@ var init_inbound = __esm({
 
 // src/posture/coverage.ts
 function checkCoverage(ctx) {
-  const home = ctx.home || import_os31.default.homedir();
+  const home = ctx.home || import_os32.default.homedir();
   const findings = [];
   const protectedAgents = getAgentWiring(home).filter((r) => r.isProtected);
   if (protectedAgents.length === 0) {
@@ -20988,11 +21448,11 @@ function checkCoverage(ctx) {
   }
   return findings;
 }
-var import_os31;
+var import_os32;
 var init_coverage = __esm({
   "src/posture/coverage.ts"() {
     "use strict";
-    import_os31 = __toESM(require("os"));
+    import_os32 = __toESM(require("os"));
     init_config();
     init_agent_wiring();
   }
@@ -21344,7 +21804,7 @@ async function runChecks(checks, ctx) {
 }
 async function runPosture(opts = {}) {
   const ctx = {
-    home: opts.home ?? import_os32.default.homedir(),
+    home: opts.home ?? import_os33.default.homedir(),
     cwd: opts.cwd ?? process.cwd(),
     agent: opts.agent
   };
@@ -21370,11 +21830,11 @@ async function runPosture(opts = {}) {
     checksRun: POSTURE_CHECKS.length
   };
 }
-var import_os32, POSTURE_CHECKS;
+var import_os33, POSTURE_CHECKS;
 var init_posture = __esm({
   "src/posture/index.ts"() {
     "use strict";
-    import_os32 = __toESM(require("os"));
+    import_os33 = __toESM(require("os"));
     init_secrets();
     init_egress();
     init_gate();
@@ -21573,49 +22033,6 @@ var init_build2 = __esm({
   }
 });
 
-// src/mcp-cmd.ts
-function tokenize4(cmd) {
-  const tokens = [];
-  let current = "";
-  let inDouble = false;
-  let quoted = false;
-  let i = 0;
-  while (i < cmd.length) {
-    const ch = cmd[i];
-    if (inDouble) {
-      if (ch === '"') inDouble = false;
-      else if (ch === "\\" && i + 1 < cmd.length) current += cmd[++i];
-      else current += ch;
-    } else if (ch === '"') {
-      inDouble = true;
-      quoted = true;
-    } else if (ch === " " || ch === "	") {
-      if (current || quoted) {
-        tokens.push(current);
-        current = "";
-        quoted = false;
-      }
-    } else if (ch === "\\" && i + 1 < cmd.length) {
-      current += cmd[++i];
-    } else {
-      current += ch;
-    }
-    i++;
-  }
-  if (current || quoted && !inDouble) tokens.push(current);
-  return tokens;
-}
-function quoteArg(s) {
-  if (s === "") return '""';
-  if (/[\s"\\]/.test(s)) return `"${s.replace(/(["\\])/g, "\\$1")}"`;
-  return s;
-}
-var init_mcp_cmd = __esm({
-  "src/mcp-cmd.ts"() {
-    "use strict";
-  }
-});
-
 // src/daemon/mcp-tools.ts
 function deriveServerName(cmd) {
   if (!cmd || typeof cmd !== "string") return "MCP Server";
@@ -21642,13 +22059,13 @@ function deriveServerName(cmd) {
   return strip(base) || "MCP Server";
 }
 function getMcpToolsFile() {
-  return import_path38.default.join(import_os33.default.homedir(), ".node9", "mcp-tools.json");
+  return import_path38.default.join(import_os34.default.homedir(), ".node9", "mcp-tools.json");
 }
 function readMcpToolsConfig() {
   try {
     const file = getMcpToolsFile();
-    if (!import_fs38.default.existsSync(file)) return {};
-    const raw = import_fs38.default.readFileSync(file, "utf-8");
+    if (!import_fs39.default.existsSync(file)) return {};
+    const raw = import_fs39.default.readFileSync(file, "utf-8");
     return JSON.parse(raw);
   } catch {
     return {};
@@ -21658,10 +22075,10 @@ function writeMcpToolsConfig(config) {
   try {
     const file = getMcpToolsFile();
     const dir = import_path38.default.dirname(file);
-    if (!import_fs38.default.existsSync(dir)) import_fs38.default.mkdirSync(dir, { recursive: true });
-    const tmpPath = `${file}.${import_os33.default.hostname()}.${process.pid}.tmp`;
-    import_fs38.default.writeFileSync(tmpPath, JSON.stringify(config, null, 2));
-    import_fs38.default.renameSync(tmpPath, file);
+    if (!import_fs39.default.existsSync(dir)) import_fs39.default.mkdirSync(dir, { recursive: true });
+    const tmpPath = `${file}.${import_os34.default.hostname()}.${process.pid}.tmp`;
+    import_fs39.default.writeFileSync(tmpPath, JSON.stringify(config, null, 2));
+    import_fs39.default.renameSync(tmpPath, file);
   } catch (e) {
     console.error("Failed to write mcp-tools.json", e);
   }
@@ -21708,117 +22125,13 @@ function approveServer(serverKey, disabledTools) {
     writeMcpToolsConfig(config);
   }
 }
-var import_fs38, import_path38, import_os33;
+var import_fs39, import_path38, import_os34;
 var init_mcp_tools = __esm({
   "src/daemon/mcp-tools.ts"() {
-    "use strict";
-    import_fs38 = __toESM(require("fs"));
-    import_path38 = __toESM(require("path"));
-    import_os33 = __toESM(require("os"));
-    init_mcp_cmd();
-  }
-});
-
-// src/mcp-wrap.ts
-function isNode9Command(command) {
-  return /(^|[\\/])node9(\.(exe|cmd|ps1|bat))?$/i.test(command ?? "");
-}
-function classifyMcp(s) {
-  if (isNode9Command(s.command)) {
-    return (s.args ?? [])[0] === "mcp-gateway" ? "gatewayed" : "node9-self";
-  }
-  if (typeof s.command !== "string" || s.command.trim() === "") return "remote";
-  return "ungoverned";
-}
-function toGateway(s, configName) {
-  const upstream = [s.command ?? "", ...s.args ?? []].map(quoteArg).join(" ");
-  const nameArgs = configName && !configName.startsWith("-") ? ["--config-name", configName] : [];
-  return {
-    ...s,
-    command: "node9",
-    args: ["mcp-gateway", ...nameArgs, "--upstream", upstream]
-  };
-}
-function fromGateway(s) {
-  if (!isNode9Command(s.command) || (s.args ?? [])[0] !== "mcp-gateway") return null;
-  const args = s.args ?? [];
-  const i = args.indexOf("--upstream");
-  if (i < 0 || !args[i + 1]) return null;
-  const [command, ...rest] = tokenize4(args[i + 1]);
-  if (!command) return null;
-  return { ...s, command, args: rest };
-}
-function inventoryMcp(home = import_os34.default.homedir()) {
-  const out = [];
-  for (const spec of AGENT_SPECS) {
-    if (!spec.mcpFile) continue;
-    const mcpFile = spec.mcpFile(home);
-    const format = spec.mcpFormat ?? "json";
-    const servers = readMcpServers(mcpFile, format);
-    for (const [name, s] of Object.entries(servers)) {
-      if (!s || typeof s !== "object") continue;
-      out.push({
-        agent: String(spec.id),
-        agentLabel: spec.label,
-        mcpFile,
-        format,
-        name,
-        command: s.command ?? "",
-        args: Array.isArray(s.args) ? s.args : [],
-        state: classifyMcp(s),
-        raw: s
-      });
-    }
-  }
-  return out;
-}
-function inventoryServerKeys(inv) {
-  const keys = /* @__PURE__ */ new Set();
-  for (const e of inv) {
-    if (e.state === "gatewayed") {
-      const i = e.args.indexOf("--upstream");
-      if (i >= 0 && e.args[i + 1]) {
-        keys.add(getServerKey(e.args[i + 1]));
-      }
-    } else if (e.state === "ungoverned") {
-      const cmd = [e.command, ...e.args].map(quoteArg).join(" ");
-      keys.add(getServerKey(cmd));
-    }
-  }
-  return keys;
-}
-function writeMcpEntry(mcpFile, format, name, entry) {
-  const key = format === "toml" ? "mcp_servers" : "mcpServers";
-  let root = {};
-  if (import_fs39.default.existsSync(mcpFile)) {
-    const raw = import_fs39.default.readFileSync(mcpFile, "utf-8");
-    root = format === "toml" ? (0, import_smol_toml5.parse)(raw) : JSON.parse(raw);
-    const bak = `${mcpFile}.node9-bak`;
-    try {
-      import_fs39.default.writeFileSync(bak, raw, { mode: 384, flag: "wx" });
-    } catch (e) {
-      if (e.code !== "EEXIST") throw e;
-    }
-  }
-  const existing = root[key];
-  const servers = existing && typeof existing === "object" && !Array.isArray(existing) ? existing : {};
-  servers[name] = entry;
-  root[key] = servers;
-  const serialized = format === "toml" ? (0, import_smol_toml5.stringify)(root) : JSON.stringify(root, null, 2);
-  const tmp = `${mcpFile}.${process.pid}.tmp`;
-  import_fs39.default.writeFileSync(tmp, serialized, { mode: 384 });
-  import_fs39.default.renameSync(tmp, mcpFile);
-}
-var import_fs39, import_os34, import_smol_toml5;
-var init_mcp_wrap = __esm({
-  "src/mcp-wrap.ts"() {
     "use strict";
     import_fs39 = __toESM(require("fs"));
+    import_path38 = __toESM(require("path"));
     import_os34 = __toESM(require("os"));
-    import_smol_toml5 = require("smol-toml");
-    init_agent_wiring();
-    init_mcp_cmd();
-    init_mcp_pin();
     init_mcp_cmd();
   }
 });
@@ -52291,22 +52604,22 @@ init_hook_baseline();
 init_agent_wiring();
 
 // src/credentials.ts
-var fs21 = __toESM(require("fs"));
-var os18 = __toESM(require("os"));
+var fs22 = __toESM(require("fs"));
+var os19 = __toESM(require("os"));
 var path22 = __toESM(require("path"));
 init_config();
 init_api_url();
 function writeCredentialsAndConfig(apiKey, opts = {}) {
   const profileName = opts.profileName || "default";
-  const home = opts.homeDir ?? os18.homedir();
+  const home = opts.homeDir ?? os19.homedir();
   const credPath = path22.join(home, ".node9", "credentials.json");
-  if (!fs21.existsSync(path22.dirname(credPath))) {
-    fs21.mkdirSync(path22.dirname(credPath), { recursive: true });
+  if (!fs22.existsSync(path22.dirname(credPath))) {
+    fs22.mkdirSync(path22.dirname(credPath), { recursive: true });
   }
   let existingCreds = {};
   try {
-    if (fs21.existsSync(credPath)) {
-      const raw = JSON.parse(fs21.readFileSync(credPath, "utf-8"));
+    if (fs22.existsSync(credPath)) {
+      const raw = JSON.parse(fs22.readFileSync(credPath, "utf-8"));
       existingCreds = raw.apiKey ? { default: { apiKey: raw.apiKey, apiUrl: raw.apiUrl || DEFAULT_API_URL } } : raw;
     }
   } catch {
@@ -52316,7 +52629,7 @@ function writeCredentialsAndConfig(apiKey, opts = {}) {
     apiUrl: DEFAULT_API_URL,
     ...opts.isLocal ? { localOnly: true } : {}
   };
-  fs21.writeFileSync(credPath, JSON.stringify(existingCreds, null, 2), {
+  fs22.writeFileSync(credPath, JSON.stringify(existingCreds, null, 2), {
     mode: 384
   });
   let effectiveCloud = null;
@@ -52324,8 +52637,8 @@ function writeCredentialsAndConfig(apiKey, opts = {}) {
     const configPath = path22.join(home, ".node9", "config.json");
     let config = {};
     try {
-      if (fs21.existsSync(configPath)) {
-        config = JSON.parse(fs21.readFileSync(configPath, "utf-8"));
+      if (fs22.existsSync(configPath)) {
+        config = JSON.parse(fs22.readFileSync(configPath, "utf-8"));
       }
     } catch {
     }
@@ -52340,10 +52653,10 @@ function writeCredentialsAndConfig(apiKey, opts = {}) {
       terminal: typeof existing.terminal === "boolean" ? existing.terminal : d.terminal,
       cloud: !opts.isLocal
     };
-    if (!fs21.existsSync(path22.dirname(configPath))) {
-      fs21.mkdirSync(path22.dirname(configPath), { recursive: true });
+    if (!fs22.existsSync(path22.dirname(configPath))) {
+      fs22.mkdirSync(path22.dirname(configPath), { recursive: true });
     }
-    fs21.writeFileSync(configPath, JSON.stringify(config, null, 2), {
+    fs22.writeFileSync(configPath, JSON.stringify(config, null, 2), {
       mode: 384
     });
     effectiveCloud = !opts.isLocal;
@@ -56769,6 +57082,7 @@ function registerInitCommand(program2) {
 var import_chalk21 = __toESM(require("chalk"));
 var import_fs62 = __toESM(require("fs"));
 init_agent_wiring();
+init_mcp_wrap();
 init_setup();
 init_hook_baseline();
 var hasHookSurface = (a) => a.hooks.length > 0;
@@ -56778,8 +57092,28 @@ function backupForHeal(file) {
   } catch {
   }
 }
+function reportCorruptedMcpWraps() {
+  const corrupted = findCorruptedMcpWraps();
+  if (corrupted.length === 0) return;
+  console.log(
+    import_chalk21.default.yellow(
+      `  \u26A0\uFE0F  ${corrupted.length} MCP server(s) were corrupted by an older node9 and cannot start:`
+    )
+  );
+  for (const c of corrupted) {
+    console.log(import_chalk21.default.yellow(`     \u2022 ${c.name}  (${c.agentLabel})`));
+    console.log(import_chalk21.default.gray(`       ${c.mcpFile}`));
+    console.log(import_chalk21.default.gray(`       stored upstream: ${c.upstream}`));
+  }
+  console.log(
+    import_chalk21.default.gray(
+      "\n     The original command lost its path separators, so node9 cannot recover it.\n     Remove and re-add each server in the agent, then run `node9 init` to re-wrap.\n"
+    )
+  );
+}
 async function runHeal(name) {
   console.log(import_chalk21.default.cyan.bold("\n\u{1FA79} Node9 Heal\n"));
+  reportCorruptedMcpWraps();
   const baseline = loadHookBaseline();
   const wiring = getAgentWiring();
   let candidates2 = wiring.filter(
@@ -60546,7 +60880,7 @@ var COLOR = {
   medium: import_chalk32.default.yellow,
   advisory: import_chalk32.default.gray
 };
-var ACTION_URL = "https://github.com/marketplace/actions/node9-agent-security-check?ref=cli_scan_repo";
+var ACTION_URL = "https://github.com/marketplace/actions/node9-agent-security?ref=cli_scan_repo";
 function renderCta(res) {
   const L = [];
   L.push(import_chalk32.default.dim("   " + "\u2500".repeat(63)));