@node9/proxy 2.22.0 → 2.23.0

package/dist/cli.mjs

@@ -1006,6 +1006,7 @@ function normalizeCommandForPolicyImpl(command) {
         const source = command.slice(s, e);
         if (resolved === source) continue;
         if (resolved === "" || /\s/.test(resolved)) continue;
+        if (/^[;&|()<>]+$/.test(resolved)) continue;
         rewrites.push([s, e, resolved]);
         const quoteOnly = source.replace(/['"]/g, "");
         if (quoteOnly !== source) quoteOnlyRewrites.push([s, e, quoteOnly]);
@@ -1355,23 +1356,147 @@ function extractLiteralArgs(callExpr) {
   const args = positionedArgs(words);
   return { name, flags, paths: args.map((a) => a.value), words, args };
 }
+function payloadKey(payload) {
+  if (!assignmentTable || assignmentTable.size === 0) return payload;
+  const bindings = [];
+  for (const [name, rec] of assignmentTable) {
+    if (rec.value !== null) bindings.push(`${name}=${rec.value}`);
+  }
+  return `${payload}\0${bindings.sort().join("
")}`;
+}
+function claimPayload(payload) {
+  if (!seenPayloads) return "ok";
+  const key = payloadKey(payload);
+  if (seenPayloads.has(key)) return "seen";
+  if (payloadBudget <= 0) return "exhausted";
+  payloadBudget--;
+  seenPayloads.add(key);
+  return "ok";
+}
+function recordTopLevelAssignments(f) {
+  const stmts = Array.isArray(f?.Stmts) ? f.Stmts : [];
+  for (const stmt of stmts) recordTopLevelStmt(stmt);
+}
+function probeBinOp(src) {
+  try {
+    const cmd = syntax.NewParser().Parse(src, "probe")?.Stmts?.[0]?.Cmd;
+    if (cmd && syntax.NodeType(cmd) === "BinaryCmd") return cmd.Op;
+  } catch {
+  }
+  return null;
+}
+function recordTopLevelStmt(stmt) {
+  if (!stmt || !stmt.Cmd) return false;
+  const t = syntax.NodeType(stmt.Cmd);
+  if (t === "BinaryCmd") {
+    if (!AND_OR_OPS.has(stmt.Cmd.Op)) return false;
+    if (!recordTopLevelStmt(stmt.Cmd.X)) return false;
+    if (stmt.Cmd.Op === AND_OP) return recordTopLevelStmt(stmt.Cmd.Y);
+    return true;
+  }
+  if (t !== "CallExpr" && t !== "DeclClause") return false;
+  let at = 0;
+  try {
+    at = stmt.Pos().Offset();
+  } catch {
+    at = 0;
+  }
+  recordAssignments(stmt.Cmd, at);
+  if (stmt.Negated) return false;
+  if (t === "DeclClause") return ASSIGNMENT_HEADS.has(stmt.Cmd.Variant?.Value ?? "");
+  return (stmt.Cmd.Args || []).length === 0 && (stmt.Cmd.Assigns || []).length > 0;
+}
+function recordAssignments(n, at) {
+  if (!assignmentTable) return;
+  const t = syntax.NodeType(n);
+  let assigns = [];
+  if (t === "CallExpr") {
+    if ((n.Args || []).length > 0) return;
+    assigns = n.Assigns || [];
+  } else if (t === "DeclClause") {
+    if (!ASSIGNMENT_HEADS.has(n.Variant?.Value ?? "")) return;
+    assigns = (n.Args || []).filter((a) => syntax.NodeType(a) === "Assign");
+  } else return;
+  for (const a of assigns) {
+    const name = a?.Name?.Value;
+    if (!name || !a.Value || a.Append) continue;
+    assignmentTable.set(name, { value: resolveWordLiteral(a.Value), at });
+  }
+}
+function resolveTrivialSubst(part) {
+  if (syntax.NodeType(part) !== "CmdSubst") return void 0;
+  const stmts = part.Stmts || [];
+  if (stmts.length !== 1) return void 0;
+  const st = stmts[0];
+  if ((st.Redirs || []).length > 0 || st.Negated || st.Background) return void 0;
+  const cmd = st.Cmd;
+  if (!cmd || syntax.NodeType(cmd) !== "CallExpr") return void 0;
+  if ((cmd.Assigns || []).length > 0) return void 0;
+  const words = (cmd.Args || []).map((a) => resolveWordLiteral(a));
+  if (words.length === 0 || words.some((w) => w === null)) return void 0;
+  const head = baseWord(words[0]);
+  const rest = words.slice(1);
+  if (head === "echo") {
+    let i = 0;
+    while (i < rest.length && /^-[neE]+$/.test(rest[i])) i++;
+    return rest.slice(i).join(" ");
+  }
+  if (head === "printf") {
+    if (rest.length !== 2) return void 0;
+    if (!/^%s(\\n)?$/.test(rest[0])) return void 0;
+    return rest[1];
+  }
+  return void 0;
+}
+function recordedExpansion(name) {
+  if (!assignmentTable || !name) return void 0;
+  const rec = assignmentTable.get(name);
+  if (rec === void 0 || rec.at >= currentStmtOffset) return void 0;
+  return rec.value;
+}
+function isPlainParam(p) {
+  if (syntax.NodeType(p) !== "ParamExp") return false;
+  return !(p.Excl || p.Length || p.Width || p.Index || p.Slice || p.Repl || p.Exp);
+}
+function expandPlainParam(p) {
+  if (!assignmentTable) return void 0;
+  if (!isPlainParam(p)) return void 0;
+  const recorded = recordedExpansion(p.Param?.Value);
+  if (recorded !== void 0) return recorded;
+  return HOME_VARIABLES.has(p.Param?.Value) ? "~" : void 0;
+}
 function resolveWordLiteral(w) {
   const parts = w?.Parts || [];
   let s = "";
   for (const p of parts) {
-    const t = syntax.NodeType(p);
-    if (t === "Lit") s += (p.Value ?? "").replace(/\\(.)/g, "$1");
-    else if (t === "SglQuoted") s += p.Value ?? "";
-    else if (t === "DblQuoted") {
-      const inner = p.Parts || [];
-      if (!inner.every((ip) => syntax.NodeType(ip) === "Lit")) return null;
-      s += inner.map((ip) => ip.Value ?? "").join("");
-    } else {
-      return null;
-    }
+    const piece = resolvePart(p, false);
+    if (piece === void 0 || piece === null) return null;
+    s += piece;
   }
   return s;
 }
+function resolvePart(p, inQuotes) {
+  const t = syntax.NodeType(p);
+  if (t === "Lit") {
+    const raw = p.Value ?? "";
+    if (!inQuotes) return raw.replace(/\\(.)/g, "$1");
+    return assignmentTable ? raw.replace(/\\([$`"\\])/g, "$1") : raw;
+  }
+  if (t === "SglQuoted") return p.Value ?? "";
+  if (t === "ParamExp") return expandPlainParam(p);
+  if (t === "CmdSubst") return assignmentTable ? resolveTrivialSubst(p) : void 0;
+  if (t === "DblQuoted" && !inQuotes) {
+    const inner = p.Parts || [];
+    let out = "";
+    for (const ip of inner) {
+      const piece = resolvePart(ip, true);
+      if (piece === void 0 || piece === null) return piece;
+      out += piece;
+    }
+    return out;
+  }
+  return void 0;
+}
 function parseDestHost(token) {
   if (!token) return null;
   let t = token.trim();
@@ -1426,6 +1551,7 @@ function destTokensForBinary(binary, args) {
     case "ssh":
       return positionals.slice(0, 1);
     case "scp":
+    case "rsync":
       return positionals.filter((p) => p.includes(":") || p.includes("@"));
     case "nc":
     case "ncat":
@@ -1615,17 +1741,35 @@ function analyzeFsOperationImpl(command, depth = 0) {
   const f = parseShared(command);
   if (f === PARSE_FAIL) return null;
   let result = null;
+  const outerTable = assignmentTable;
+  const outerOffset = currentStmtOffset;
+  const outerSeen = seenPayloads;
+  const outerBudget = payloadBudget;
+  if (depth === 0) {
+    seenPayloads = /* @__PURE__ */ new Set();
+    payloadBudget = PAYLOAD_BUDGET;
+  }
+  assignmentTable = new Map(
+    [...outerTable ?? []].map(([k, r]) => [k, { value: r.value, at: -1 }])
+  );
+  currentStmtOffset = Number.MAX_SAFE_INTEGER;
   try {
+    recordTopLevelAssignments(f);
     syntax.Walk(f, (node) => {
       if (!node || result?.verdict === "block") return false;
       const n = node;
       const nodeType = syntax.NodeType(n);
       if (nodeType === "Stmt") {
+        try {
+          currentStmtOffset = n.Pos().Offset();
+        } catch {
+          currentStmtOffset = Number.MAX_SAFE_INTEGER;
+        }
         result = stricter(result, jailedRedirectRead(n));
         return result?.verdict !== "block";
       }
       if (nodeType !== "CallExpr") return true;
-      const { name, flags, paths, words, args } = extractLiteralArgs(n);
+      const { name, flags, paths, words } = extractLiteralArgs(n);
       if (!name) return true;
       if (name === "rm") {
         const flagStr = flags.join("").toLowerCase();
@@ -1654,9 +1798,30 @@ function analyzeFsOperationImpl(command, depth = 0) {
           }
         }
       }
-      if (depth < 1) {
+      if (depth < 24 && name === "find") {
+        for (const action of findActions(words, 0)) {
+          const h = unwrapCommandHead(action);
+          const inner = literalShellPayload(action.slice(h), baseWord(action[h]));
+          if (inner === null) continue;
+          const claim = claimPayload(inner);
+          if (claim === "exhausted") {
+            result = stricter(result, UNANALYSABLE_NESTING);
+            continue;
+          }
+          if (claim === "seen") continue;
+          const v = analyzeFsOperationImpl(inner, depth + 1);
+          result = stricter(result, v);
+          if (result?.verdict === "block") return false;
+        }
+      }
+      if (depth < 24) {
         const payload = literalShellPayload(words, name);
-        if (payload !== null) {
+        const claim = payload === null ? "seen" : claimPayload(payload);
+        if (claim === "exhausted") {
+          result = stricter(result, UNANALYSABLE_NESTING);
+          return true;
+        }
+        if (payload !== null && claim === "ok") {
           const inner = analyzeFsOperationImpl(payload, depth + 1);
           if (inner) {
             result = inner;
@@ -1665,7 +1830,7 @@ function analyzeFsOperationImpl(command, depth = 0) {
           return true;
         }
       }
-      const readPaths = FS_READ_TOOLS.has(name) ? [...readTargets(name, args, flags, words, 1), ...flagOperandFiles(name, words, 1)] : wrappedReadPaths(words, name);
+      const readPaths = FS_READ_TOOLS.has(name) ? readerPaths(words, 0) : wrappedReadPaths(words, name);
       if (readPaths) {
         for (const p of readPaths) {
           result = stricter(result, matchSensitivePath2(p));
@@ -1680,6 +1845,11 @@ function analyzeFsOperationImpl(command, depth = 0) {
     return result;
   } catch {
     return null;
+  } finally {
+    assignmentTable = outerTable;
+    currentStmtOffset = outerOffset;
+    seenPayloads = outerSeen;
+    if (depth === 0) payloadBudget = outerBudget;
   }
 }
 function stricter(a, b) {
@@ -1736,6 +1906,18 @@ function resolveCopyShape(words, h) {
   }
   return null;
 }
+function findAction(words, k) {
+  const end = words.findIndex((w, i) => i > k && (w === ";" || w === "+"));
+  return words.slice(k + 1, end < 0 ? words.length : end);
+}
+function findActions(words, h) {
+  const out = [];
+  for (let i = h + 1; i < words.length; i++) {
+    const w = words[i];
+    if (w !== null && FIND_EXEC_FLAGS.has(w)) out.push(findAction(words, i));
+  }
+  return out;
+}
 function findStartPoints(words, h) {
   const k = words.findIndex((w, i) => i > h && w !== null && FIND_EXEC_FLAGS.has(w));
   if (k < 0) return { k, starts: [] };
@@ -1751,8 +1933,13 @@ function copySourcePaths(words) {
   if (fi >= 0) {
     const { k, starts } = findStartPoints(words, fi);
     if (k < 0) return [];
-    const action = unwrapCommandHead(words.slice(k + 1));
-    return resolveCopyShape(words.slice(k + 1), action) ? starts : [];
+    const out = [];
+    for (const action of findActions(words, fi)) {
+      const h2 = unwrapCommandHead(action);
+      if (!resolveCopyShape(action, h2)) continue;
+      out.push(...starts, ...copySourcePaths(action));
+    }
+    return out;
   }
   if (!COPY_VERB_HEADS.has(baseWord(words[h]))) return [];
   const r = resolveCopyShape(words, h);
@@ -1929,6 +2116,15 @@ function flagEffect(token, shape, known) {
   }
   return NONE;
 }
+function readerPaths(words, h) {
+  const head = baseWord(words[h]);
+  const from = h + 1;
+  const flags = words.slice(from).filter((w) => w !== null && w.startsWith("-"));
+  return [
+    ...readTargets(head, positionedArgs(words, from), flags, words, from),
+    ...flagOperandFiles(head, words, from)
+  ];
+}
 function readTargets(verb, args, flags, words = [], from = 1) {
   const shape = PATTERN_VERBS[verb];
   if (!shape) return args.map((a) => a.value);
@@ -2010,18 +2206,21 @@ function flagOperandFiles(verb, words, from) {
 function wrappedReadPaths(words, name) {
   if (name === "find") {
     const { k, starts } = findStartPoints(words, 0);
-    return k > 0 && isReaderWord(words[k + 1] ?? null) ? starts : null;
+    if (k < 0) return null;
+    const paths = [];
+    let reads = false;
+    for (const action of findActions(words, 0)) {
+      const h2 = unwrapCommandHead(action);
+      if (!isReaderWord(action[h2] ?? null)) continue;
+      reads = true;
+      paths.push(...readerPaths(action, h2));
+    }
+    return reads ? [...starts, ...paths] : paths;
   }
   if (!COMMAND_WRAPPERS.has(name) && !RUNNER_WRAPPERS.has(name)) return null;
   const h = unwrapCommandHead(words);
   if (h <= 0 || !isReaderWord(words[h] ?? null)) return null;
-  const head = baseWord(words[h]);
-  const rest = words.slice(h + 1);
-  const restFlags = rest.filter((w) => w !== null && w.startsWith("-"));
-  return [
-    ...readTargets(head, positionedArgs(words, h + 1), restFlags, words, h + 1),
-    ...flagOperandFiles(head, words, h + 1)
-  ];
+  return readerPaths(words, h);
 }
 function literalShellPayload(words, name) {
   const h = COMMAND_WRAPPERS.has(name) || RUNNER_WRAPPERS.has(name) ? unwrapCommandHead(words) : 0;
@@ -3784,7 +3983,7 @@ function* stringValues(obj, depth = 0) {
   }
   for (const v of Object.values(obj)) yield* stringValues(v, depth + 1);
 }
-var IBAN_LENGTH, B58, B58_INDEX, XPRV_VERSIONS, MAX, UNTRUSTED_TOOLS, SIGNALS, ASSIGNMENT_CONTEXT_RE, DLP_STOPWORDS, DLP_PATTERNS, DLP_PATTERNS_GLOBAL, SENSITIVE_PATH_PATTERNS, MAX_DEPTH, MAX_STRING_BYTES, MAX_JSON_PARSE_BYTES, DLP_SCAN_LIMITS, MAX_REGEX_LENGTH, REGEX_CACHE_MAX, regexCache, FORBIDDEN_PATH_SEGMENTS, syntax, sharedParser, MESSAGE_FLAGS, SHELL_INTERPRETERS, DOWNLOAD_CMDS, NORMALIZE_CACHE_MAX, normalizeCache, AST_CACHE_MAX, astCache, PARSE_FAIL, FS_READ_TOOLS, GREP_SHAPE, PATTERN_VERBS, PATTERN_VERB_NAMES, GREP_FILE_OPERANDS, READER_VALUE_LETTERS, FILE_OPERAND_FLAGS, SCP_VALUE_FLAGS, TAR_VALUE_LETTERS, ZIP_VALUE_LETTERS, RSYNC_VALUE_LETTERS, RSYNC_SKIP, CP_VALUE_LETTERS, INSTALL_VALUE_LETTERS, COPY_VERBS, TAR_MODE_WORD, COPY_VERB_HEADS, FS_OP_PRESCREEN_RE, HOME_CACHE_ALLOWLIST, SENSITIVE_PATH_RULES, BASH_TOOL_NAMES, AST_FS_REGEX_RULES, SQL_DB_CLIS, SQL_DDL_RE, CHMOD_OPEN_PERM_TOKENS, COMMAND_WRAPPERS, INLINE_INTERPRETER, RUNNER_WRAPPERS, _redirStdinOps, _listOps, WRAPPER_TAKES_TARGET, FIND_EXEC_FLAGS, INTERP_LEADING_TARGET, NET_BINARIES, VALUE_FLAGS, FS_OP_CACHE_MAX, fsOpCache, stripDotSlash, REDIR_TRUNCATE_OPS, REDIR_FILE_IN_OPS, REDIR_HEREDOC_OPS, FIND_OPTIONS, COPY_RULE_OF, isReaderWord, positionalAfter, NONE, UNKNOWN, SSRF_MAX_HOST, METADATA_ADDRESSES, STRICT_TIERS, METADATA_HOSTNAMES, v4Octets, TIER_REASON, DEFAULT_EGRESS_ALLOWLIST, PRIVATE_HOST_SUFFIXES, SOURCE_COMMANDS, SINK_COMMANDS, OBFUSCATORS, SENSITIVE_PATTERNS, FLAGS_WITH_VALUES, DESTINATION_ARGS, VERDICT_RANK, SQL_DML_KEYWORDS, TERMINAL_ESCAPE_RE, CONTROL_CHAR_RE, aws_default, bash_safe_default, docker_default, filesystem_default, github_default, k8s_default, mongodb_default, postgres_default, project_jail_default, redis_default, BUILTIN_SHIELDS, LOOP_MAX_RECORDS, FINDING_TO_SIGNAL, SCAN_SIGNAL_WEIGHTS, LOOP_THRESHOLD_FOR_WASTE, MAX_BLAST_PATH, DESTRUCTIVE_OP_RE, SENSITIVE_PATH_RE, FILE_TOOLS, PII_EMAIL_RE, PII_SSN_RE, PII_PHONE_RE, PII_CC16_RE, PII_CC15_RE, PII_IBAN_RE, REALTIME_PII_PATTERNS, MAX_PII_SCAN_BYTES, CANARY_MIN_LENGTH, MAX_TEXT, MAX_DEPTH2, MAX_JSON_PARSE, URL_DEPTH, B64_DEPTH, MIN_SEGMENT, SEPARATORS, stripSeparators, looksText, CANARY_DECODERS, VIEWS, LONG_OUTPUT_THRESHOLD_BYTES, CANONICAL_EXTRACTOR_VERSION, DEDUPE_PREVIEW_LEN, ENGINE_VERSION;
+var IBAN_LENGTH, B58, B58_INDEX, XPRV_VERSIONS, MAX, UNTRUSTED_TOOLS, SIGNALS, ASSIGNMENT_CONTEXT_RE, DLP_STOPWORDS, DLP_PATTERNS, DLP_PATTERNS_GLOBAL, SENSITIVE_PATH_PATTERNS, MAX_DEPTH, MAX_STRING_BYTES, MAX_JSON_PARSE_BYTES, DLP_SCAN_LIMITS, MAX_REGEX_LENGTH, REGEX_CACHE_MAX, regexCache, FORBIDDEN_PATH_SEGMENTS, syntax, sharedParser, MESSAGE_FLAGS, SHELL_INTERPRETERS, DOWNLOAD_CMDS, NORMALIZE_CACHE_MAX, normalizeCache, AST_CACHE_MAX, astCache, PARSE_FAIL, FS_READ_TOOLS, GREP_SHAPE, PATTERN_VERBS, PATTERN_VERB_NAMES, GREP_FILE_OPERANDS, READER_VALUE_LETTERS, FILE_OPERAND_FLAGS, SCP_VALUE_FLAGS, TAR_VALUE_LETTERS, ZIP_VALUE_LETTERS, RSYNC_VALUE_LETTERS, RSYNC_SKIP, CP_VALUE_LETTERS, INSTALL_VALUE_LETTERS, COPY_VERBS, TAR_MODE_WORD, COPY_VERB_HEADS, FS_OP_PRESCREEN_RE, HOME_CACHE_ALLOWLIST, SENSITIVE_PATH_RULES, BASH_TOOL_NAMES, AST_FS_REGEX_RULES, SQL_DB_CLIS, SQL_DDL_RE, CHMOD_OPEN_PERM_TOKENS, COMMAND_WRAPPERS, INLINE_INTERPRETER, RUNNER_WRAPPERS, _redirStdinOps, _listOps, WRAPPER_TAKES_TARGET, FIND_EXEC_FLAGS, INTERP_LEADING_TARGET, NET_BINARIES, VALUE_FLAGS, HOME_VARIABLES, assignmentTable, currentStmtOffset, PAYLOAD_BUDGET, payloadBudget, seenPayloads, UNANALYSABLE_NESTING, ASSIGNMENT_HEADS, AND_OP, OR_OP, AND_OR_OPS, FS_OP_CACHE_MAX, fsOpCache, stripDotSlash, REDIR_TRUNCATE_OPS, REDIR_FILE_IN_OPS, REDIR_HEREDOC_OPS, FIND_OPTIONS, COPY_RULE_OF, isReaderWord, positionalAfter, NONE, UNKNOWN, SSRF_MAX_HOST, METADATA_ADDRESSES, STRICT_TIERS, METADATA_HOSTNAMES, v4Octets, TIER_REASON, DEFAULT_EGRESS_ALLOWLIST, PRIVATE_HOST_SUFFIXES, SOURCE_COMMANDS, SINK_COMMANDS, OBFUSCATORS, SENSITIVE_PATTERNS, FLAGS_WITH_VALUES, DESTINATION_ARGS, VERDICT_RANK, SQL_DML_KEYWORDS, TERMINAL_ESCAPE_RE, CONTROL_CHAR_RE, aws_default, bash_safe_default, docker_default, filesystem_default, github_default, k8s_default, mongodb_default, postgres_default, project_jail_default, redis_default, BUILTIN_SHIELDS, LOOP_MAX_RECORDS, FINDING_TO_SIGNAL, SCAN_SIGNAL_WEIGHTS, LOOP_THRESHOLD_FOR_WASTE, MAX_BLAST_PATH, DESTRUCTIVE_OP_RE, SENSITIVE_PATH_RE, FILE_TOOLS, PII_EMAIL_RE, PII_SSN_RE, PII_PHONE_RE, PII_CC16_RE, PII_CC15_RE, PII_IBAN_RE, REALTIME_PII_PATTERNS, MAX_PII_SCAN_BYTES, CANARY_MIN_LENGTH, MAX_TEXT, MAX_DEPTH2, MAX_JSON_PARSE, URL_DEPTH, B64_DEPTH, MIN_SEGMENT, SEPARATORS, stripSeparators, looksText, CANARY_DECODERS, VIEWS, LONG_OUTPUT_THRESHOLD_BYTES, CANONICAL_EXTRACTOR_VERSION, DEDUPE_PREVIEW_LEN, ENGINE_VERSION;
 var init_dist = __esm({
   "packages/policy-engine/dist/index.mjs"() {
     "use strict";
@@ -5162,6 +5361,60 @@ var init_dist = __esm({
       "rsync"
     ]);
     VALUE_FLAGS = {
+      // rsync 3.2.7, its own --help: every flag whose operand could be mistaken for
+      // a host. `-e ssh` is the one that matters most (`ssh` is not the destination).
+      rsync: /* @__PURE__ */ new Set([
+        "-e",
+        "--rsh",
+        "-f",
+        "--filter",
+        "-T",
+        "--temp-dir",
+        "-B",
+        "--block-size",
+        "-M",
+        "--remote-option",
+        "--exclude",
+        "--exclude-from",
+        "--include",
+        "--include-from",
+        "--files-from",
+        "--compare-dest",
+        "--copy-dest",
+        "--link-dest",
+        "--partial-dir",
+        "--log-file",
+        "--password-file",
+        "--bwlimit",
+        "--timeout",
+        "--contimeout",
+        "--port",
+        "--sockopts",
+        "--address",
+        "--chmod",
+        "--chown",
+        "--max-size",
+        "--min-size",
+        "--modify-window",
+        "--out-format",
+        "--log-file-format",
+        "--backup-dir",
+        "--suffix",
+        "--iconv",
+        "--max-delete",
+        "--checksum-choice",
+        "--info",
+        "--debug",
+        "--stderr",
+        "--outbuf",
+        "--skip-compress",
+        "--usermap",
+        "--groupmap",
+        "--mkpath",
+        "--write-batch",
+        "--read-batch",
+        "--only-write-batch"
+      ]),
       curl: /* @__PURE__ */ new Set([
         "-d",
         "--data",
@@ -5245,6 +5498,22 @@ var init_dist = __esm({
       ]),
       nc: /* @__PURE__ */ new Set(["-p", "-s", "-w", "-X", "-x", "-e", "-g", "-G", "-i", "-O", "-T", "-q", "-m"])
     };
+    HOME_VARIABLES = /* @__PURE__ */ new Set(["HOME", "USERPROFILE"]);
+    assignmentTable = null;
+    currentStmtOffset = Number.MAX_SAFE_INTEGER;
+    PAYLOAD_BUDGET = 256;
+    payloadBudget = 0;
+    seenPayloads = null;
+    UNANALYSABLE_NESTING = {
+      ruleName: "review-unanalysable-nesting",
+      verdict: "review",
+      reason: "This command nests more wrapped shell payloads than the policy engine will unwrap, so some of what it runs was not read.",
+      path: ""
+    };
+    ASSIGNMENT_HEADS = /* @__PURE__ */ new Set(["export", "declare", "local", "readonly", "typeset"]);
+    AND_OP = probeBinOp("a && b");
+    OR_OP = probeBinOp("a || b");
+    AND_OR_OPS = new Set([AND_OP, OR_OP].filter((o) => o !== null));
     FS_OP_CACHE_MAX = 5e3;
     fsOpCache = /* @__PURE__ */ new Map();
     stripDotSlash = (p) => p.replace(/^\.\//, "");
@@ -6321,7 +6590,7 @@ var init_dist = __esm({
       { view: "separators-stripped", decoder: "separators", stripped: true }
     ];
     LONG_OUTPUT_THRESHOLD_BYTES = 100 * 1024;
-    CANONICAL_EXTRACTOR_VERSION = "canonical-v17";
+    CANONICAL_EXTRACTOR_VERSION = "canonical-v18";
     DEDUPE_PREVIEW_LEN = 120;
     ENGINE_VERSION = "1.4.0";
   }
@@ -10710,115 +10979,284 @@ var init_core = __esm({
   }
 });
 
-// src/utils/platform-shell.ts
-function locatorCommand() {
-  return process.platform === "win32" ? "where" : "which";
-}
-function shellInvocation(command) {
-  if (process.platform === "win32") {
-    return {
-      file: process.env.ComSpec || "cmd.exe",
-      args: ["/d", "/s", "/c", command]
-    };
-  }
-  return { file: "/bin/bash", args: ["-c", command] };
-}
-var init_platform_shell = __esm({
-  "src/utils/platform-shell.ts"() {
-    "use strict";
-  }
-});
-
-// src/codex-trust.ts
+// src/agent-wiring.ts
 import fs16 from "fs";
 import path17 from "path";
 import os13 from "os";
-import { spawnSync } from "child_process";
+import * as yaml from "yaml";
 import { parse as parseToml } from "smol-toml";
-function readTomlSafe(filePath) {
+function readJson(filePath) {
+  if (!fs16.existsSync(filePath)) return null;
   try {
-    return parseToml(fs16.readFileSync(filePath, "utf-8"));
+    return JSON.parse(fs16.readFileSync(filePath, "utf-8"));
   } catch {
-    return null;
+    return "invalid";
   }
 }
-function lastCodexAuditTs(auditLogPath) {
-  let text;
+function matchersHaveNode9Hook(matchers) {
+  return (matchers ?? []).some((m) => (m.hooks ?? []).some((h) => isNode9Hook(h.command)));
+}
+function flatHaveNode9Hook(entries) {
+  return (Array.isArray(entries) ? entries : []).some((h) => isNode9Hook(h.command));
+}
+function readHookRoot(filePath, format) {
+  if (!fs16.existsSync(filePath)) return "absent";
+  let raw;
   try {
-    text = fs16.readFileSync(auditLogPath, "utf-8");
+    raw = fs16.readFileSync(filePath, "utf-8");
   } catch {
-    return null;
+    return "absent";
   }
-  let newest = null;
-  for (const line of text.split("\n")) {
-    if (!line.includes('"Codex"')) continue;
-    try {
-      const row = JSON.parse(line);
-      if (row.agent !== "Codex" || typeof row.ts !== "string") continue;
-      if (newest === null || row.ts > newest) newest = row.ts;
-    } catch {
-    }
+  try {
+    const parsed = format === "yaml" ? yaml.parse(raw) : JSON.parse(raw);
+    return parsed?.hooks ?? {};
+  } catch {
+    return "invalid";
   }
-  return newest;
 }
-function assessCodexTrustFrom(input) {
-  const { hooksDisabled, trustEntries, hooksWrittenAt, lastCodexActivityAt } = input;
-  let state;
-  if (hooksDisabled) state = "disabled";
-  else if (trustEntries === 0) state = "never-trusted";
-  else if (hooksWrittenAt && lastCodexActivityAt && lastCodexActivityAt > hooksWrittenAt) {
-    state = "observed";
-  } else state = "unverified";
-  return { state, hooksWrittenAt, lastCodexActivityAt, trustEntries };
+function eventWired(root, ev, format) {
+  const arr = root[ev.key];
+  if (format === "matcher") return matchersHaveNode9Hook(arr);
+  return flatHaveNode9Hook(arr);
 }
-function assessCodexTrust(home = os13.homedir(), auditLogPath = path17.join(home, ".node9", "audit.log")) {
-  const hooksPath = path17.join(home, ".codex", "hooks.json");
-  const configPath = path17.join(home, ".codex", "config.toml");
-  let hooksWrittenAt = null;
+function detectMcp(servers) {
+  const entries = Object.entries(servers ?? {});
+  const present = entries.some(([, s]) => s?.command === "node9");
+  const wrapped = entries.filter(([, s]) => s?.command === "node9" && Array.isArray(s.args) && s.args.length > 0).map(([name, s]) => `${name} \u2192 ${s.args.join(" ")}`);
+  return { wrapped, present };
+}
+function readMcpServers(filePath, format) {
+  if (!fs16.existsSync(filePath)) return {};
   try {
-    hooksWrittenAt = fs16.statSync(hooksPath).mtime.toISOString();
+    if (format === "toml") {
+      const parsed2 = parseToml(fs16.readFileSync(filePath, "utf-8"));
+      return parsed2?.mcp_servers ?? {};
+    }
+    const parsed = readJson(filePath);
+    if (parsed === null || parsed === "invalid") return {};
+    return parsed.mcpServers ?? {};
   } catch {
-    hooksWrittenAt = null;
+    return {};
   }
-  const config = readTomlSafe(configPath);
-  const hooksDisabled = config?.features?.hooks === false || config?.codex_hooks === false;
-  const trustEntries = Object.keys(config?.hooks?.state ?? {}).length;
-  return assessCodexTrustFrom({
-    hooksDisabled,
-    trustEntries,
-    hooksWrittenAt,
-    lastCodexActivityAt: lastCodexAuditTs(auditLogPath)
-  });
 }
-function findCodexTui(env = process.env) {
+function readMcp(filePath, format) {
+  if (!fs16.existsSync(filePath)) return { wrapped: [], present: false };
   try {
-    const r = spawnSync(locatorCommand(), ["codex"], { encoding: "utf-8", timeout: 3e3 });
-    const first = (r.stdout ?? "").split(/\r?\n/).find((l) => l.trim());
-    if (r.status === 0 && first) return "codex";
+    if (format === "toml") {
+      const parsed2 = parseToml(fs16.readFileSync(filePath, "utf-8"));
+      return detectMcp(parsed2?.mcp_servers);
+    }
+    const parsed = readJson(filePath);
+    if (parsed === null || parsed === "invalid") return { wrapped: [], present: false };
+    return detectMcp(parsed.mcpServers);
   } catch {
+    return { wrapped: [], present: false };
   }
-  if (process.platform === "win32" && env.LOCALAPPDATA) {
-    const binDir = path17.join(env.LOCALAPPDATA, "OpenAI", "Codex", "bin");
-    try {
-      for (const d of fs16.readdirSync(binDir)) {
-        const exe = path17.join(binDir, d, "codex.exe");
-        if (fs16.existsSync(exe)) return `"${exe}"`;
+}
+function getAgentWiring(home = os13.homedir()) {
+  const detected = detectAgents(home);
+  return AGENT_SPECS.map((spec) => {
+    const present = spec.present(home);
+    const pad = spec.labelPad ?? DEFAULT_LABEL_PAD;
+    let hooks;
+    let wireState;
+    let hookLabel;
+    let settingsPath;
+    if (spec.shimFile) {
+      const shimWired = exists(spec.shimFile(home));
+      hooks = [{ label: "node9 plugin (node9 check)", wired: shimWired }];
+      wireState = shimWired ? "wired" : present ? "unwired" : "absent";
+      hookLabel = "node9 plugin";
+      settingsPath = spec.shimFile(home);
+    } else {
+      const root = spec.hookFile ? readHookRoot(spec.hookFile(home), spec.hookFormat) : "absent";
+      const primary = spec.hookEvents[0];
+      const rootPresent = root !== "absent" && root !== "invalid";
+      hooks = spec.hookEvents.map((ev) => ({
+        label: hookLabelOf(ev, pad),
+        wired: rootPresent && eventWired(root, ev, spec.hookFormat)
+      }));
+      if (root === "absent") wireState = "absent";
+      else if (root === "invalid") wireState = "invalid";
+      else wireState = primary && eventWired(root, primary, spec.hookFormat) ? "wired" : "unwired";
+      hookLabel = primary ? `${primary.key} hook` : "MCP proxy";
+      settingsPath = spec.hookFile ? spec.hookFile(home) : spec.mcpFile ? spec.mcpFile(home) : "";
+    }
+    const mcp = spec.mcpFile ? readMcp(spec.mcpFile(home), spec.mcpFormat ?? "json") : null;
+    const anyHookWired = hooks.some((h) => h.wired);
+    return {
+      id: spec.id,
+      label: spec.label,
+      setupCommand: spec.setupCommand,
+      installed: detected[spec.id],
+      present,
+      hooks,
+      wireState,
+      hookLabel,
+      settingsPath,
+      configFormat: spec.hookFormat === "yaml" ? "YAML" : "JSON",
+      mcpServers: mcp ? mcp.wrapped : null,
+      mcpProtected: mcp ? mcp.present : false,
+      isProtected: anyHookWired || (mcp?.present ?? false)
+    };
+  });
+}
+var exists, ck, lg, DEFAULT_LABEL_PAD, hookLabelOf, AGENT_SPECS;
+var init_agent_wiring = __esm({
+  "src/agent-wiring.ts"() {
+    "use strict";
+    init_setup();
+    exists = (p) => {
+      try {
+        return fs16.existsSync(p);
+      } catch {
+        return false;
       }
-    } catch {
+    };
+    ck = (key) => ({ key, kind: "check" });
+    lg = (key) => ({ key, kind: "log" });
+    DEFAULT_LABEL_PAD = 11;
+    hookLabelOf = (ev, pad) => `${ev.key.padEnd(pad)} (node9 ${ev.kind})`;
+    AGENT_SPECS = [
+      {
+        id: "claude",
+        label: "Claude Code",
+        setupCommand: "node9 agents add claude",
+        hookFile: (h) => path17.join(h, ".claude", "settings.json"),
+        hookFormat: "matcher",
+        // UserPromptSubmit is prompt DLP. setup.ts has written it for Claude since
+        // that shipped; the spec must name it too, or status/doctor never show the
+        // row and heal (which repairs via setupAgent) has no signal it is missing.
+        hookEvents: [ck("PreToolUse"), lg("PostToolUse"), ck("UserPromptSubmit")],
+        mcpFile: (h) => path17.join(h, ".claude.json"),
+        present: (h) => exists(path17.join(h, ".claude", "settings.json")) || exists(path17.join(h, ".claude.json"))
+      },
+      {
+        id: "gemini",
+        label: "Gemini CLI",
+        setupCommand: "node9 agents add gemini",
+        hookFile: (h) => path17.join(h, ".gemini", "settings.json"),
+        hookFormat: "matcher",
+        hookEvents: [ck("BeforeTool"), lg("AfterTool")],
+        mcpFile: (h) => path17.join(h, ".gemini", "settings.json"),
+        present: (h) => exists(path17.join(h, ".gemini", "settings.json"))
+      },
+      {
+        id: "codex",
+        label: "Codex",
+        setupCommand: "node9 agents add codex",
+        hookFile: (h) => path17.join(h, ".codex", "hooks.json"),
+        hookFormat: "matcher",
+        hookEvents: [ck("PreToolUse"), ck("UserPromptSubmit")],
+        mcpFile: (h) => path17.join(h, ".codex", "config.toml"),
+        mcpFormat: "toml",
+        present: (h) => exists(path17.join(h, ".codex"))
+      },
+      {
+        id: "antigravity",
+        label: "Antigravity",
+        setupCommand: "node9 agents add antigravity",
+        hookFile: (h) => path17.join(h, ".gemini", "config", "hooks.json"),
+        hookFormat: "matcher",
+        hookEvents: [ck("PreToolUse"), lg("PostToolUse")],
+        mcpFile: (h) => path17.join(h, ".gemini", "config", "mcp_config.json"),
+        present: (h) => exists(path17.join(h, ".gemini", "config", "hooks.json")) || exists(path17.join(h, ".gemini", "antigravity-cli")) || exists(path17.join(h, ".gemini", "antigravity-ide"))
+      },
+      {
+        id: "copilot",
+        label: "GitHub Copilot",
+        setupCommand: "node9 agents add copilot",
+        hookFile: (h) => path17.join(h, ".copilot", "hooks", "node9.json"),
+        hookFormat: "flat",
+        hookEvents: [ck("PreToolUse"), lg("PostToolUse"), ck("UserPromptSubmit")],
+        mcpFile: (h) => path17.join(h, ".copilot", "mcp-config.json"),
+        present: (h) => exists(path17.join(h, ".copilot"))
+      },
+      {
+        id: "cursor",
+        label: "Cursor",
+        setupCommand: "node9 agents add cursor",
+        // MCP-only — no hook file (see note above).
+        hookFormat: "flat",
+        hookEvents: [],
+        mcpFile: (h) => path17.join(h, ".cursor", "mcp.json"),
+        present: (h) => exists(path17.join(h, ".cursor", "mcp.json"))
+      },
+      {
+        id: "hermes",
+        label: "Hermes Agent",
+        setupCommand: "node9 agents add hermes",
+        hookFile: (h) => hermesConfigPath(h),
+        hookFormat: "yaml",
+        hookEvents: [ck("pre_tool_call"), lg("post_tool_call")],
+        labelPad: 14,
+        // 'post_tool_call' is wider than the default
+        present: (h) => exists(hermesConfigPath(h))
+      },
+      {
+        // Plugin-shim agents — protected by a node9-authored plugin/extension file
+        // (no hooks, no MCP). hookFormat is unused for these (shimFile drives it).
+        id: "opencode",
+        label: "OpenCode",
+        setupCommand: "node9 agents add opencode",
+        hookFormat: "flat",
+        hookEvents: [],
+        shimFile: (h) => path17.join(opencodeConfigDir(h), "plugins", "node9.js"),
+        present: (h) => exists(opencodeConfigDir(h)) || exists(path17.join(opencodeConfigDir(h), "plugins", "node9.js"))
+      },
+      {
+        id: "pi",
+        label: "Pi",
+        setupCommand: "node9 agents add pi",
+        hookFormat: "flat",
+        hookEvents: [],
+        shimFile: (h) => path17.join(h, ".pi", "agent", "extensions", "node9.js"),
+        present: (h) => exists(path17.join(h, ".pi", "agent")) || exists(path17.join(h, ".pi", "agent", "extensions", "node9.js"))
+      }
+    ];
+  }
+});
+
+// src/mcp-cmd.ts
+function tokenize4(cmd) {
+  const tokens = [];
+  let current = "";
+  let inDouble = false;
+  let quoted = false;
+  let i = 0;
+  while (i < cmd.length) {
+    const ch = cmd[i];
+    if (inDouble) {
+      if (ch === '"') inDouble = false;
+      else if (ch === "\\" && i + 1 < cmd.length) current += cmd[++i];
+      else current += ch;
+    } else if (ch === '"') {
+      inDouble = true;
+      quoted = true;
+    } else if (ch === " " || ch === "	") {
+      if (current || quoted) {
+        tokens.push(current);
+        current = "";
+        quoted = false;
+      }
+    } else if (ch === "\\" && i + 1 < cmd.length) {
+      current += cmd[++i];
+    } else {
+      current += ch;
     }
+    i++;
   }
-  return null;
+  if (current || quoted && !inDouble) tokens.push(current);
+  return tokens;
 }
-function codexTrustInstruction(tui = findCodexTui()) {
-  const where = tui ? `run ${tui} in a terminal` : "run the Codex CLI (`codex`) in a terminal \u2014 the desktop app has no hook review screen";
-  return `    \u279C  Codex must trust these hooks once: ${where},
-       then choose "Trust all and continue" when Codex asks to review them.
-       Until then Codex runs unprotected. Every rewrite of hooks.json needs this again.`;
+function quoteArg(s) {
+  if (s === "") return '""';
+  if (/[\s"\\]/.test(s)) return `"${s.replace(/(["\\])/g, "\\$1")}"`;
+  return s;
 }
-var init_codex_trust = __esm({
-  "src/codex-trust.ts"() {
+var init_mcp_cmd = __esm({
+  "src/mcp-cmd.ts"() {
     "use strict";
-    init_platform_shell();
   }
 });
 
@@ -10979,13 +11417,253 @@ var init_mcp_pin = __esm({
   }
 });
 
-// src/daemon/hook-baseline.ts
+// src/mcp-wrap.ts
 import fs18 from "fs";
-import path19 from "path";
 import os15 from "os";
+import { parse as parseToml2, stringify as stringifyToml } from "smol-toml";
+function isNode9Command(command) {
+  return /(^|[\\/])node9(\.(exe|cmd|ps1|bat))?$/i.test(command ?? "");
+}
+function classifyMcp(s) {
+  if (isNode9Command(s.command)) {
+    return (s.args ?? [])[0] === "mcp-gateway" ? "gatewayed" : "node9-self";
+  }
+  if (typeof s.command !== "string" || s.command.trim() === "") return "remote";
+  return "ungoverned";
+}
+function mcpUpstreamString(s) {
+  return [s.command ?? "", ...s.args ?? []].map(quoteArg).join(" ");
+}
+function toGateway(s, configName) {
+  const upstream = mcpUpstreamString(s);
+  const nameArgs = configName && !configName.startsWith("-") ? ["--config-name", configName] : [];
+  return {
+    ...s,
+    command: "node9",
+    args: ["mcp-gateway", ...nameArgs, "--upstream", upstream]
+  };
+}
+function fromGateway(s) {
+  if (!isNode9Command(s.command) || (s.args ?? [])[0] !== "mcp-gateway") return null;
+  const args = s.args ?? [];
+  const i = args.indexOf("--upstream");
+  if (i < 0 || !args[i + 1]) return null;
+  const [command, ...rest] = tokenize4(args[i + 1]);
+  if (!command) return null;
+  return { ...s, command, args: rest };
+}
+function inventoryMcp(home = os15.homedir()) {
+  const out = [];
+  for (const spec of AGENT_SPECS) {
+    if (!spec.mcpFile) continue;
+    const mcpFile = spec.mcpFile(home);
+    const format = spec.mcpFormat ?? "json";
+    const servers = readMcpServers(mcpFile, format);
+    for (const [name, s] of Object.entries(servers)) {
+      if (!s || typeof s !== "object") continue;
+      out.push({
+        agent: String(spec.id),
+        agentLabel: spec.label,
+        mcpFile,
+        format,
+        name,
+        command: s.command ?? "",
+        args: Array.isArray(s.args) ? s.args : [],
+        state: classifyMcp(s),
+        raw: s
+      });
+    }
+  }
+  return out;
+}
+function isCorruptedUpstream(upstream) {
+  if (!upstream) return false;
+  if (upstream.includes("\\") || upstream.includes("/")) return false;
+  return /(^|\s)[A-Za-z]:[^\s]/.test(upstream);
+}
+function findCorruptedMcpWraps(home = os15.homedir()) {
+  const out = [];
+  for (const e of inventoryMcp(home)) {
+    if (e.state !== "gatewayed") continue;
+    const i = e.args.indexOf("--upstream");
+    const upstream = i >= 0 ? e.args[i + 1] ?? "" : "";
+    if (!isCorruptedUpstream(upstream)) continue;
+    out.push({
+      agent: e.agent,
+      agentLabel: e.agentLabel,
+      mcpFile: e.mcpFile,
+      name: e.name,
+      upstream
+    });
+  }
+  return out;
+}
+function inventoryServerKeys(inv) {
+  const keys = /* @__PURE__ */ new Set();
+  for (const e of inv) {
+    if (e.state === "gatewayed") {
+      const i = e.args.indexOf("--upstream");
+      if (i >= 0 && e.args[i + 1]) {
+        keys.add(getServerKey(e.args[i + 1]));
+      }
+    } else if (e.state === "ungoverned") {
+      const cmd = [e.command, ...e.args].map(quoteArg).join(" ");
+      keys.add(getServerKey(cmd));
+    }
+  }
+  return keys;
+}
+function writeMcpEntry(mcpFile, format, name, entry) {
+  const key = format === "toml" ? "mcp_servers" : "mcpServers";
+  let root = {};
+  if (fs18.existsSync(mcpFile)) {
+    const raw = fs18.readFileSync(mcpFile, "utf-8");
+    root = format === "toml" ? parseToml2(raw) : JSON.parse(raw);
+    const bak = `${mcpFile}.node9-bak`;
+    try {
+      fs18.writeFileSync(bak, raw, { mode: 384, flag: "wx" });
+    } catch (e) {
+      if (e.code !== "EEXIST") throw e;
+    }
+  }
+  const existing = root[key];
+  const servers = existing && typeof existing === "object" && !Array.isArray(existing) ? existing : {};
+  servers[name] = entry;
+  root[key] = servers;
+  const serialized = format === "toml" ? stringifyToml(root) : JSON.stringify(root, null, 2);
+  const tmp = `${mcpFile}.${process.pid}.tmp`;
+  fs18.writeFileSync(tmp, serialized, { mode: 384 });
+  fs18.renameSync(tmp, mcpFile);
+}
+var init_mcp_wrap = __esm({
+  "src/mcp-wrap.ts"() {
+    "use strict";
+    init_agent_wiring();
+    init_mcp_cmd();
+    init_mcp_pin();
+    init_mcp_cmd();
+  }
+});
+
+// src/utils/platform-shell.ts
+function locatorCommand() {
+  return process.platform === "win32" ? "where" : "which";
+}
+function shellInvocation(command) {
+  if (process.platform === "win32") {
+    return {
+      file: process.env.ComSpec || "cmd.exe",
+      args: ["/d", "/s", "/c", command]
+    };
+  }
+  return { file: "/bin/bash", args: ["-c", command] };
+}
+var init_platform_shell = __esm({
+  "src/utils/platform-shell.ts"() {
+    "use strict";
+  }
+});
+
+// src/codex-trust.ts
+import fs19 from "fs";
+import path19 from "path";
+import os16 from "os";
+import { spawnSync } from "child_process";
+import { parse as parseToml3 } from "smol-toml";
+function readTomlSafe(filePath) {
+  try {
+    return parseToml3(fs19.readFileSync(filePath, "utf-8"));
+  } catch {
+    return null;
+  }
+}
+function lastCodexAuditTs(auditLogPath) {
+  let text;
+  try {
+    text = fs19.readFileSync(auditLogPath, "utf-8");
+  } catch {
+    return null;
+  }
+  let newest = null;
+  for (const line of text.split("\n")) {
+    if (!line.includes('"Codex"')) continue;
+    try {
+      const row = JSON.parse(line);
+      if (row.agent !== "Codex" || typeof row.ts !== "string") continue;
+      if (newest === null || row.ts > newest) newest = row.ts;
+    } catch {
+    }
+  }
+  return newest;
+}
+function assessCodexTrustFrom(input) {
+  const { hooksDisabled, trustEntries, hooksWrittenAt, lastCodexActivityAt } = input;
+  let state;
+  if (hooksDisabled) state = "disabled";
+  else if (trustEntries === 0) state = "never-trusted";
+  else if (hooksWrittenAt && lastCodexActivityAt && lastCodexActivityAt > hooksWrittenAt) {
+    state = "observed";
+  } else state = "unverified";
+  return { state, hooksWrittenAt, lastCodexActivityAt, trustEntries };
+}
+function assessCodexTrust(home = os16.homedir(), auditLogPath = path19.join(home, ".node9", "audit.log")) {
+  const hooksPath = path19.join(home, ".codex", "hooks.json");
+  const configPath = path19.join(home, ".codex", "config.toml");
+  let hooksWrittenAt = null;
+  try {
+    hooksWrittenAt = fs19.statSync(hooksPath).mtime.toISOString();
+  } catch {
+    hooksWrittenAt = null;
+  }
+  const config = readTomlSafe(configPath);
+  const hooksDisabled = config?.features?.hooks === false || config?.codex_hooks === false;
+  const trustEntries = Object.keys(config?.hooks?.state ?? {}).length;
+  return assessCodexTrustFrom({
+    hooksDisabled,
+    trustEntries,
+    hooksWrittenAt,
+    lastCodexActivityAt: lastCodexAuditTs(auditLogPath)
+  });
+}
+function findCodexTui(env = process.env) {
+  try {
+    const r = spawnSync(locatorCommand(), ["codex"], { encoding: "utf-8", timeout: 3e3 });
+    const first = (r.stdout ?? "").split(/\r?\n/).find((l) => l.trim());
+    if (r.status === 0 && first) return "codex";
+  } catch {
+  }
+  if (process.platform === "win32" && env.LOCALAPPDATA) {
+    const binDir = path19.join(env.LOCALAPPDATA, "OpenAI", "Codex", "bin");
+    try {
+      for (const d of fs19.readdirSync(binDir)) {
+        const exe = path19.join(binDir, d, "codex.exe");
+        if (fs19.existsSync(exe)) return `"${exe}"`;
+      }
+    } catch {
+    }
+  }
+  return null;
+}
+function codexTrustInstruction(tui = findCodexTui()) {
+  const where = tui ? `run ${tui} in a terminal` : "run the Codex CLI (`codex`) in a terminal \u2014 the desktop app has no hook review screen";
+  return `    \u279C  Codex must trust these hooks once: ${where},
+       then choose "Trust all and continue" when Codex asks to review them.
+       Until then Codex runs unprotected. Every rewrite of hooks.json needs this again.`;
+}
+var init_codex_trust = __esm({
+  "src/codex-trust.ts"() {
+    "use strict";
+    init_platform_shell();
+  }
+});
+
+// src/daemon/hook-baseline.ts
+import fs20 from "fs";
+import path20 from "path";
+import os17 from "os";
 function loadHookBaseline() {
   try {
-    const raw = JSON.parse(fs18.readFileSync(BASELINE_FILE, "utf-8"));
+    const raw = JSON.parse(fs20.readFileSync(BASELINE_FILE, "utf-8"));
     return raw && typeof raw === "object" && !Array.isArray(raw) ? raw : {};
   } catch {
     return {};
@@ -10993,9 +11671,9 @@ function loadHookBaseline() {
 }
 function saveHookBaseline(b) {
   try {
-    const dir = path19.dirname(BASELINE_FILE);
-    if (!fs18.existsSync(dir)) fs18.mkdirSync(dir, { recursive: true });
-    fs18.writeFileSync(BASELINE_FILE, JSON.stringify(b, null, 2), { mode: 384 });
+    const dir = path20.dirname(BASELINE_FILE);
+    if (!fs20.existsSync(dir)) fs20.mkdirSync(dir, { recursive: true });
+    fs20.writeFileSync(BASELINE_FILE, JSON.stringify(b, null, 2), { mode: 384 });
   } catch {
   }
 }
@@ -11017,14 +11695,14 @@ function seedHookBaselineIfEmpty(governedNow, now) {
 function clearHookBaseline() {
   for (const f of [BASELINE_FILE, NOTIFIED_FILE]) {
     try {
-      fs18.rmSync(f, { force: true });
+      fs20.rmSync(f, { force: true });
     } catch {
     }
   }
 }
 function loadNotified() {
   try {
-    const raw = JSON.parse(fs18.readFileSync(NOTIFIED_FILE, "utf-8"));
+    const raw = JSON.parse(fs20.readFileSync(NOTIFIED_FILE, "utf-8"));
     return new Set(Array.isArray(raw) ? raw : []);
   } catch {
     return /* @__PURE__ */ new Set();
@@ -11032,9 +11710,9 @@ function loadNotified() {
 }
 function saveNotified(s) {
   try {
-    const dir = path19.dirname(NOTIFIED_FILE);
-    if (!fs18.existsSync(dir)) fs18.mkdirSync(dir, { recursive: true });
-    fs18.writeFileSync(NOTIFIED_FILE, JSON.stringify([...s]), { mode: 384 });
+    const dir = path20.dirname(NOTIFIED_FILE);
+    if (!fs20.existsSync(dir)) fs20.mkdirSync(dir, { recursive: true });
+    fs20.writeFileSync(NOTIFIED_FILE, JSON.stringify([...s]), { mode: 384 });
   } catch {
   }
 }
@@ -11042,8 +11720,8 @@ var BASELINE_FILE, NOTIFIED_FILE;
 var init_hook_baseline = __esm({
   "src/daemon/hook-baseline.ts"() {
     "use strict";
-    BASELINE_FILE = path19.join(os15.homedir(), ".node9", "hooks-baseline.json");
-    NOTIFIED_FILE = path19.join(os15.homedir(), ".node9", "hook-heal-notified.json");
+    BASELINE_FILE = path20.join(os17.homedir(), ".node9", "hooks-baseline.json");
+    NOTIFIED_FILE = path20.join(os17.homedir(), ".node9", "hook-heal-notified.json");
   }
 });
 
@@ -11396,13 +12074,13 @@ var init_setup_pi_shim = __esm({
 });
 
 // src/setup.ts
-import fs19 from "fs";
-import path20 from "path";
-import os16 from "os";
+import fs21 from "fs";
+import path21 from "path";
+import os18 from "os";
 import chalk from "chalk";
 import { confirm as rawConfirm } from "@inquirer/prompts";
-import { parse as parseToml2, stringify as stringifyToml } from "smol-toml";
-import * as yaml from "yaml";
+import { parse as parseToml4, stringify as stringifyToml2 } from "smol-toml";
+import * as yaml2 from "yaml";
 function isNonInteractive() {
   return process.env.NODE9_NONINTERACTIVE === "1";
 }
@@ -11458,7 +12136,7 @@ function printInlineAskNotice() {
     )
   );
 }
-function fullPathCommand(subcommand, platform = process.platform, home = os16.homedir()) {
+function fullPathCommand(subcommand, platform = process.platform, home = os18.homedir()) {
   if (process.env.NODE9_TESTING === "1") return `node9 ${subcommand}`;
   const nodeExec = toForwardSlashes(process.execPath);
   const cliScript = toForwardSlashes(process.argv[1]);
@@ -11470,8 +12148,8 @@ function fullPathCommand(subcommand, platform = process.platform, home = os16.ho
   ensureHookShim(home, nodeExec, cliScript);
   return `"${toForwardSlashes(hookShimPath(home))}" ${subcommand}`;
 }
-function hookShimPath(home = os16.homedir()) {
-  return path20.join(home, ".node9", "bin", "hook");
+function hookShimPath(home = os18.homedir()) {
+  return path21.join(home, ".node9", "bin", "hook");
 }
 function hookShimBody(nodeExec, cliScript) {
   return `#!/bin/sh
@@ -11485,12 +12163,12 @@ function ensureHookShim(home, nodeExec, cliScript) {
   const shim = hookShimPath(home);
   const body = hookShimBody(nodeExec, cliScript);
   try {
-    if (fs19.readFileSync(shim, "utf-8") === body) return false;
+    if (fs21.readFileSync(shim, "utf-8") === body) return false;
   } catch {
   }
-  fs19.mkdirSync(path20.dirname(shim), { recursive: true });
-  fs19.writeFileSync(shim, body, { mode: 493 });
-  fs19.chmodSync(shim, 493);
+  fs21.mkdirSync(path21.dirname(shim), { recursive: true });
+  fs21.writeFileSync(shim, body, { mode: 493 });
+  fs21.chmodSync(shim, 493);
   return true;
 }
 function toForwardSlashes(p) {
@@ -11509,7 +12187,7 @@ function isStaleHookCommand(command) {
   while ((m = re.exec(command)) !== null) tokens.push(m[1] ?? m[2] ?? "");
   for (const tok of tokens) {
     if (!tok.startsWith("/") && !/^[A-Za-z]:\//.test(tok)) continue;
-    if (!fs19.existsSync(tok)) return true;
+    if (!fs21.existsSync(tok)) return true;
   }
   return false;
 }
@@ -11529,19 +12207,19 @@ function isChurnProneHookForm(command, platform = process.platform) {
 function needsRewrite(command, platform = process.platform) {
   return isStaleHookCommand(command) || isLegacyHookFormat(command) || isWindowsQuoteBrokenHook(command, platform) || isChurnProneHookForm(command, platform);
 }
-function readJson(filePath) {
+function readJson2(filePath) {
   try {
-    if (fs19.existsSync(filePath)) {
-      return JSON.parse(fs19.readFileSync(filePath, "utf-8"));
+    if (fs21.existsSync(filePath)) {
+      return JSON.parse(fs21.readFileSync(filePath, "utf-8"));
     }
   } catch {
   }
   return null;
 }
 function writeJson(filePath, data) {
-  const dir = path20.dirname(filePath);
-  if (!fs19.existsSync(dir)) fs19.mkdirSync(dir, { recursive: true });
-  fs19.writeFileSync(filePath, JSON.stringify(data, null, 2) + "\n");
+  const dir = path21.dirname(filePath);
+  if (!fs21.existsSync(dir)) fs21.mkdirSync(dir, { recursive: true });
+  fs21.writeFileSync(filePath, JSON.stringify(data, null, 2) + "\n");
 }
 function mcpWrapArgs(upstream) {
   return [MCP_WRAP_SUBCOMMAND, "--upstream", upstream];
@@ -11561,6 +12239,14 @@ function repairLegacyMcpWraps(servers) {
   }
   return repaired;
 }
+function isCodexAppManagedServer(name, server) {
+  if (!server) return false;
+  const cmd = (server.command ?? "").replace(/\\/g, "/").toLowerCase();
+  if (cmd.includes("/openai/codex/runtimes/")) return true;
+  const envKeys = Object.keys(server.env ?? {});
+  if (envKeys.some((k) => k.startsWith("NODE_REPL_") || k === "CODEX_CLI_PATH")) return true;
+  return name === "node_repl";
+}
 function isNode9Hook(cmd) {
   if (!cmd) return false;
   return /(?:^|[\s/\\"])node9"? (?:check|log)/.test(cmd) || /(?:^|[\s/\\])cli\.js"? (?:check|log)/.test(cmd) || // The shim form: "<home>/.node9/bin/hook" check. Without this alternative a
@@ -11570,11 +12256,11 @@ function isNode9Hook(cmd) {
   /[/\\]\.node9[/\\]bin[/\\]hook"? (?:check|log)/.test(cmd);
 }
 function teardownClaude() {
-  const homeDir2 = os16.homedir();
-  const hooksPath = path20.join(homeDir2, ".claude", "settings.json");
-  const mcpPath = path20.join(homeDir2, ".claude", ".mcp.json");
+  const homeDir2 = os18.homedir();
+  const hooksPath = path21.join(homeDir2, ".claude", "settings.json");
+  const mcpPath = path21.join(homeDir2, ".claude", ".mcp.json");
   let changed = false;
-  const settings = readJson(hooksPath);
+  const settings = readJson2(hooksPath);
   if (settings?.hooks) {
     for (const event of ["PreToolUse", "PostToolUse", "UserPromptSubmit"]) {
       const before = settings.hooks[event]?.length ?? 0;
@@ -11593,7 +12279,7 @@ function teardownClaude() {
       console.log(chalk.blue("  \u2139\uFE0F  No Node9 hooks found in ~/.claude/settings.json"));
     }
   }
-  const claudeConfig = readJson(mcpPath);
+  const claudeConfig = readJson2(mcpPath);
   if (claudeConfig?.mcpServers) {
     let mcpChanged = false;
     if (removeNode9McpServer(claudeConfig.mcpServers)) {
@@ -11620,9 +12306,9 @@ function teardownClaude() {
   }
 }
 function teardownGemini() {
-  const homeDir2 = os16.homedir();
-  const settingsPath = path20.join(homeDir2, ".gemini", "settings.json");
-  const settings = readJson(settingsPath);
+  const homeDir2 = os18.homedir();
+  const settingsPath = path21.join(homeDir2, ".gemini", "settings.json");
+  const settings = readJson2(settingsPath);
   if (!settings) {
     console.log(chalk.blue("  \u2139\uFE0F  ~/.gemini/settings.json not found \u2014 nothing to remove"));
     return;
@@ -11664,9 +12350,9 @@ function teardownGemini() {
   }
 }
 function teardownCursor() {
-  const homeDir2 = os16.homedir();
-  const mcpPath = path20.join(homeDir2, ".cursor", "mcp.json");
-  const mcpConfig = readJson(mcpPath);
+  const homeDir2 = os18.homedir();
+  const mcpPath = path21.join(homeDir2, ".cursor", "mcp.json");
+  const mcpConfig = readJson2(mcpPath);
   if (!mcpConfig?.mcpServers) {
     console.log(chalk.blue("  \u2139\uFE0F  ~/.cursor/mcp.json not found \u2014 nothing to remove"));
     return;
@@ -11697,11 +12383,11 @@ function teardownCursor() {
 }
 async function setupClaude() {
   seedMcpPinsIfMissing();
-  const homeDir2 = os16.homedir();
-  const mcpPath = path20.join(homeDir2, ".claude", ".mcp.json");
-  const hooksPath = path20.join(homeDir2, ".claude", "settings.json");
-  const claudeConfig = readJson(mcpPath) ?? {};
-  const settings = readJson(hooksPath) ?? {};
+  const homeDir2 = os18.homedir();
+  const mcpPath = path21.join(homeDir2, ".claude", ".mcp.json");
+  const hooksPath = path21.join(homeDir2, ".claude", "settings.json");
+  const claudeConfig = readJson2(mcpPath) ?? {};
+  const settings = readJson2(hooksPath) ?? {};
   const servers = claudeConfig.mcpServers ?? {};
   let hooksChanged = false;
   let anythingChanged = false;
@@ -11822,7 +12508,7 @@ async function setupClaude() {
   const serversToWrap = [];
   for (const [name, server] of Object.entries(servers)) {
     if (!server.command || server.command === "node9") continue;
-    const upstream = [server.command, ...server.args ?? []].join(" ");
+    const upstream = mcpUpstreamString(server);
     serversToWrap.push({ name, upstream });
   }
   if (serversToWrap.length > 0) {
@@ -11875,9 +12561,9 @@ async function setupGemini() {
   );
   console.log("");
   seedMcpPinsIfMissing();
-  const homeDir2 = os16.homedir();
-  const settingsPath = path20.join(homeDir2, ".gemini", "settings.json");
-  const settings = readJson(settingsPath) ?? {};
+  const homeDir2 = os18.homedir();
+  const settingsPath = path21.join(homeDir2, ".gemini", "settings.json");
+  const settings = readJson2(settingsPath) ?? {};
   const servers = settings.mcpServers ?? {};
   let hooksChanged = false;
   let anythingChanged = false;
@@ -11944,7 +12630,7 @@ async function setupGemini() {
   const serversToWrap = [];
   for (const [name, server] of Object.entries(servers)) {
     if (!server.command || server.command === "node9") continue;
-    const upstream = [server.command, ...server.args ?? []].join(" ");
+    const upstream = mcpUpstreamString(server);
     serversToWrap.push({ name, upstream });
   }
   if (serversToWrap.length > 0) {
@@ -11990,11 +12676,11 @@ async function setupGemini() {
 }
 async function setupAntigravity() {
   seedMcpPinsIfMissing();
-  const homeDir2 = os16.homedir();
-  const hooksPath = path20.join(homeDir2, ".gemini", "config", "hooks.json");
-  const mcpPath = path20.join(homeDir2, ".gemini", "config", "mcp_config.json");
-  const hooksFile = readJson(hooksPath) ?? {};
-  const mcpConfig = readJson(mcpPath) ?? {};
+  const homeDir2 = os18.homedir();
+  const hooksPath = path21.join(homeDir2, ".gemini", "config", "hooks.json");
+  const mcpPath = path21.join(homeDir2, ".gemini", "config", "mcp_config.json");
+  const hooksFile = readJson2(hooksPath) ?? {};
+  const mcpConfig = readJson2(mcpPath) ?? {};
   const servers = mcpConfig.mcpServers ?? {};
   let hooksChanged = false;
   let anythingChanged = false;
@@ -12087,7 +12773,7 @@ async function setupAntigravity() {
     }
     anythingChanged = true;
   }
-  const legacySettings = readJson(path20.join(homeDir2, ".gemini", "settings.json"));
+  const legacySettings = readJson2(path21.join(homeDir2, ".gemini", "settings.json"));
   const legacyHasNode9 = ["BeforeTool", "AfterTool"].some(
     (ev) => legacySettings?.hooks?.[ev]?.some((m) => m.hooks.some((h) => isNode9Hook(h.command)))
   );
@@ -12158,11 +12844,11 @@ async function setupAntigravity() {
   }
 }
 function teardownAntigravity() {
-  const homeDir2 = os16.homedir();
-  const hooksPath = path20.join(homeDir2, ".gemini", "config", "hooks.json");
-  const mcpPath = path20.join(homeDir2, ".gemini", "config", "mcp_config.json");
+  const homeDir2 = os18.homedir();
+  const hooksPath = path21.join(homeDir2, ".gemini", "config", "hooks.json");
+  const mcpPath = path21.join(homeDir2, ".gemini", "config", "mcp_config.json");
   let changed = false;
-  const hooksFile = readJson(hooksPath);
+  const hooksFile = readJson2(hooksPath);
   if (hooksFile?.hooks) {
     for (const event of ["PreToolUse", "PostToolUse"]) {
       const before = hooksFile.hooks[event]?.length ?? 0;
@@ -12183,7 +12869,7 @@ function teardownAntigravity() {
   } else {
     console.log(chalk.blue("  \u2139\uFE0F  ~/.gemini/config/hooks.json not found \u2014 nothing to remove"));
   }
-  const mcpConfig = readJson(mcpPath);
+  const mcpConfig = readJson2(mcpPath);
   if (mcpConfig?.mcpServers) {
     let mcpChanged = false;
     if (removeNode9McpServer(mcpConfig.mcpServers)) {
@@ -12212,13 +12898,13 @@ function teardownAntigravity() {
 }
 async function setupCopilot() {
   seedMcpPinsIfMissing();
-  const homeDir2 = os16.homedir();
-  const hooksPath = path20.join(homeDir2, ".copilot", "hooks", "node9.json");
-  const mcpPath = path20.join(homeDir2, ".copilot", "mcp-config.json");
-  const hooksFile = readJson(hooksPath) ?? { version: 1 };
+  const homeDir2 = os18.homedir();
+  const hooksPath = path21.join(homeDir2, ".copilot", "hooks", "node9.json");
+  const mcpPath = path21.join(homeDir2, ".copilot", "mcp-config.json");
+  const hooksFile = readJson2(hooksPath) ?? { version: 1 };
   if (!hooksFile.version) hooksFile.version = 1;
   if (!hooksFile.hooks) hooksFile.hooks = {};
-  const mcpConfig = readJson(mcpPath) ?? {};
+  const mcpConfig = readJson2(mcpPath) ?? {};
   const servers = mcpConfig.mcpServers ?? {};
   let hooksChanged = false;
   let anythingChanged = false;
@@ -12315,10 +13001,10 @@ async function setupCopilot() {
   printInlineAskNotice();
 }
 function teardownCopilot() {
-  const homeDir2 = os16.homedir();
-  const hooksPath = path20.join(homeDir2, ".copilot", "hooks", "node9.json");
-  const mcpPath = path20.join(homeDir2, ".copilot", "mcp-config.json");
-  const hooksFile = readJson(hooksPath);
+  const homeDir2 = os18.homedir();
+  const hooksPath = path21.join(homeDir2, ".copilot", "hooks", "node9.json");
+  const mcpPath = path21.join(homeDir2, ".copilot", "mcp-config.json");
+  const hooksFile = readJson2(hooksPath);
   let changed = false;
   if (hooksFile?.hooks) {
     for (const event of ["PreToolUse", "PostToolUse", "UserPromptSubmit"]) {
@@ -12330,7 +13016,7 @@ function teardownCopilot() {
     if (changed) {
       if (Object.keys(hooksFile.hooks).length === 0) {
         try {
-          fs19.unlinkSync(hooksPath);
+          fs21.unlinkSync(hooksPath);
           console.log(chalk.green("  \u2705 Removed ~/.copilot/hooks/node9.json"));
         } catch {
           writeJson(hooksPath, hooksFile);
@@ -12345,7 +13031,7 @@ function teardownCopilot() {
   } else {
     console.log(chalk.blue("  \u2139\uFE0F  ~/.copilot/hooks/node9.json not found \u2014 nothing to remove"));
   }
-  const mcpConfig = readJson(mcpPath);
+  const mcpConfig = readJson2(mcpPath);
   if (mcpConfig?.mcpServers) {
     let mcpChanged = false;
     if (removeNode9McpServer(mcpConfig.mcpServers)) {
@@ -12372,9 +13058,9 @@ function teardownCopilot() {
     }
   }
 }
-function claudeDesktopConfigPath(homeDir2 = os16.homedir()) {
+function claudeDesktopConfigPath(homeDir2 = os18.homedir()) {
   if (process.platform === "darwin") {
-    return path20.join(
+    return path21.join(
       homeDir2,
       "Library",
       "Application Support",
@@ -12383,47 +13069,47 @@ function claudeDesktopConfigPath(homeDir2 = os16.homedir()) {
     );
   }
   if (process.platform === "linux") {
-    return path20.join(homeDir2, ".config", "Claude", "claude_desktop_config.json");
+    return path21.join(homeDir2, ".config", "Claude", "claude_desktop_config.json");
   }
   if (process.platform === "win32") {
-    const appData = process.env.APPDATA || path20.join(homeDir2, "AppData", "Roaming");
-    return path20.join(appData, "Claude", "claude_desktop_config.json");
+    const appData = process.env.APPDATA || path21.join(homeDir2, "AppData", "Roaming");
+    return path21.join(appData, "Claude", "claude_desktop_config.json");
   }
   return null;
 }
-function opencodeConfigDir(home = os16.homedir()) {
+function opencodeConfigDir(home = os18.homedir()) {
   const xdg = process.env.XDG_CONFIG_HOME;
-  const base = xdg && path20.isAbsolute(xdg) ? xdg : path20.join(home, ".config");
-  return path20.join(base, "opencode");
+  const base = xdg && path21.isAbsolute(xdg) ? xdg : path21.join(home, ".config");
+  return path21.join(base, "opencode");
 }
 function commonBinDirs(home) {
   return [
-    path20.join(home, ".local", "bin"),
-    path20.join(home, ".bun", "bin"),
-    path20.join(home, ".npm-global", "bin"),
+    path21.join(home, ".local", "bin"),
+    path21.join(home, ".bun", "bin"),
+    path21.join(home, ".npm-global", "bin"),
     "/usr/local/bin",
     "/opt/homebrew/bin"
   ];
 }
-function binaryInPath(binary, home = os16.homedir()) {
+function binaryInPath(binary, home = os18.homedir()) {
   const pathEnv = process.env.PATH ?? "";
-  const dirs = [...pathEnv.split(path20.delimiter), ...commonBinDirs(home)];
+  const dirs = [...pathEnv.split(path21.delimiter), ...commonBinDirs(home)];
   const seen = /* @__PURE__ */ new Set();
   for (const dir of dirs) {
     if (!dir || seen.has(dir)) continue;
     seen.add(dir);
     try {
-      fs19.accessSync(path20.join(dir, binary), fs19.constants.X_OK);
+      fs21.accessSync(path21.join(dir, binary), fs21.constants.X_OK);
       return true;
     } catch {
     }
   }
   return false;
 }
-function detectAgents(homeDir2 = os16.homedir()) {
+function detectAgents(homeDir2 = os18.homedir()) {
   const exists2 = (p) => {
     try {
-      return fs19.existsSync(p);
+      return fs21.existsSync(p);
     } catch (err2) {
       const code = err2.code;
       if (code !== "ENOENT") {
@@ -12435,7 +13121,7 @@ function detectAgents(homeDir2 = os16.homedir()) {
   };
   const desktopPath = claudeDesktopConfigPath(homeDir2);
   return {
-    claude: exists2(path20.join(homeDir2, ".claude")) || exists2(path20.join(homeDir2, ".claude.json")),
+    claude: exists2(path21.join(homeDir2, ".claude")) || exists2(path21.join(homeDir2, ".claude.json")),
     // Antigravity (agy) shares the ~/.gemini root, so a bare
     // `exists(~/.gemini)` would report the (EOL'd) Gemini CLI as
     // installed on every agy machine — and `node9 init` would then
@@ -12445,19 +13131,19 @@ function detectAgents(homeDir2 = os16.homedir()) {
     // creates ~/.gemini/settings.json on first run; agy does not touch
     // it (it uses antigravity-cli/settings.json) — that file is the
     // legacy-CLI discriminator.
-    gemini: exists2(path20.join(homeDir2, ".gemini", "settings.json")) || binaryInPath("gemini", homeDir2),
+    gemini: exists2(path21.join(homeDir2, ".gemini", "settings.json")) || binaryInPath("gemini", homeDir2),
     // agy creates ~/.gemini/antigravity-cli/ on first launch; the IDE
     // creates antigravity-ide/. PATH fallback covers installed-but-
     // never-launched (same class as opencode #186).
-    antigravity: exists2(path20.join(homeDir2, ".gemini", "antigravity-cli")) || exists2(path20.join(homeDir2, ".gemini", "antigravity-ide")) || binaryInPath("agy", homeDir2),
+    antigravity: exists2(path21.join(homeDir2, ".gemini", "antigravity-cli")) || exists2(path21.join(homeDir2, ".gemini", "antigravity-ide")) || binaryInPath("agy", homeDir2),
     // GitHub Copilot CLI creates ~/.copilot on first launch; PATH
     // fallback covers installed-but-never-launched (same as opencode #186).
-    copilot: exists2(path20.join(homeDir2, ".copilot")) || binaryInPath("copilot", homeDir2),
-    cursor: exists2(path20.join(homeDir2, ".cursor")),
-    codex: exists2(path20.join(homeDir2, ".codex")),
-    windsurf: exists2(path20.join(homeDir2, ".codeium", "windsurf")),
-    vscode: exists2(path20.join(homeDir2, ".vscode")),
-    claudeDesktop: desktopPath !== null && exists2(path20.dirname(desktopPath)),
+    copilot: exists2(path21.join(homeDir2, ".copilot")) || binaryInPath("copilot", homeDir2),
+    cursor: exists2(path21.join(homeDir2, ".cursor")),
+    codex: exists2(path21.join(homeDir2, ".codex")),
+    windsurf: exists2(path21.join(homeDir2, ".codeium", "windsurf")),
+    vscode: exists2(path21.join(homeDir2, ".vscode")),
+    claudeDesktop: desktopPath !== null && exists2(path21.dirname(desktopPath)),
     // Opencode creates its config dir lazily on first launch — fall back to a
     // PATH lookup so installed-but-never-launched CLIs are still wired. Config
     // dir honors $XDG_CONFIG_HOME via opencodeConfigDir (#186, custom-XDG).
@@ -12468,7 +13154,7 @@ function detectAgents(homeDir2 = os16.homedir()) {
     // dir lazily on first launch — same class of bug as opencode's #186
     // (design R6) — so fall back to PATH lookup for installed-but-never-
     // launched pi.
-    pi: exists2(path20.join(homeDir2, ".pi", "agent")) || binaryInPath("pi", homeDir2),
+    pi: exists2(path21.join(homeDir2, ".pi", "agent")) || binaryInPath("pi", homeDir2),
     // Hermes Agent (https://github.com/NousResearch/hermes-agent): home dir
     // is $HERMES_HOME (default ~/.hermes) per hermes_constants.py:30. config.yaml
     // appears after `hermes setup` has run; the directory alone exists from
@@ -12479,9 +13165,9 @@ function detectAgents(homeDir2 = os16.homedir()) {
 }
 async function setupCursor() {
   seedMcpPinsIfMissing();
-  const homeDir2 = os16.homedir();
-  const mcpPath = path20.join(homeDir2, ".cursor", "mcp.json");
-  const mcpConfig = readJson(mcpPath) ?? {};
+  const homeDir2 = os18.homedir();
+  const mcpPath = path21.join(homeDir2, ".cursor", "mcp.json");
+  const mcpConfig = readJson2(mcpPath) ?? {};
   const servers = mcpConfig.mcpServers ?? {};
   let anythingChanged = false;
   const repairedMcpWraps = repairLegacyMcpWraps(
@@ -12507,7 +13193,7 @@ async function setupCursor() {
   const serversToWrap = [];
   for (const [name, server] of Object.entries(servers)) {
     if (!server.command || server.command === "node9") continue;
-    const upstream = [server.command, ...server.args ?? []].join(" ");
+    const upstream = mcpUpstreamString(server);
     serversToWrap.push({ name, upstream });
   }
   if (serversToWrap.length > 0) {
@@ -12563,27 +13249,27 @@ async function setupCursor() {
 }
 function readToml(filePath) {
   try {
-    if (fs19.existsSync(filePath)) {
-      return parseToml2(fs19.readFileSync(filePath, "utf-8"));
+    if (fs21.existsSync(filePath)) {
+      return parseToml4(fs21.readFileSync(filePath, "utf-8"));
     }
   } catch {
   }
   return null;
 }
 function writeToml(filePath, data) {
-  const dir = path20.dirname(filePath);
-  if (!fs19.existsSync(dir)) fs19.mkdirSync(dir, { recursive: true });
-  fs19.writeFileSync(filePath, stringifyToml(data));
+  const dir = path21.dirname(filePath);
+  if (!fs21.existsSync(dir)) fs21.mkdirSync(dir, { recursive: true });
+  fs21.writeFileSync(filePath, stringifyToml2(data));
 }
 async function setupCodex() {
   seedMcpPinsIfMissing();
-  const homeDir2 = os16.homedir();
-  const configPath = path20.join(homeDir2, ".codex", "config.toml");
-  const hooksPath = path20.join(homeDir2, ".codex", "hooks.json");
+  const homeDir2 = os18.homedir();
+  const configPath = path21.join(homeDir2, ".codex", "config.toml");
+  const hooksPath = path21.join(homeDir2, ".codex", "hooks.json");
   const config = readToml(configPath) ?? {};
   const servers = config.mcp_servers ?? {};
   let anythingChanged = false;
-  const hooksFile = readJson(hooksPath) ?? {};
+  const hooksFile = readJson2(hooksPath) ?? {};
   if (!hooksFile.hooks) hooksFile.hooks = {};
   let hooksChanged = false;
   if (!hooksFile.hooks.PreToolUse) hooksFile.hooks.PreToolUse = [];
@@ -12676,11 +13362,21 @@ async function setupCodex() {
     anythingChanged = true;
   }
   const serversToWrap = [];
+  const appManaged = [];
   for (const [name, server] of Object.entries(servers)) {
     if (!server.command || server.command === "node9") continue;
-    const upstream = [server.command, ...server.args ?? []].join(" ");
+    if (isCodexAppManagedServer(name, server)) {
+      appManaged.push(name);
+      continue;
+    }
+    const upstream = mcpUpstreamString(server);
     serversToWrap.push({ name, upstream });
   }
+  if (appManaged.length > 0) {
+    console.log(
+      chalk.gray(`  \u2139\uFE0F  Managed by the Codex app \u2014 not wrapped: ${appManaged.join(", ")}`)
+    );
+  }
   if (serversToWrap.length > 0) {
     console.log(chalk.bold("The following existing entries will be modified:\n"));
     console.log(chalk.white(`  ${configPath}`));
@@ -12745,10 +13441,10 @@ async function setupCodex() {
   }
 }
 function teardownCodex() {
-  const homeDir2 = os16.homedir();
-  const configPath = path20.join(homeDir2, ".codex", "config.toml");
-  const hooksPath = path20.join(homeDir2, ".codex", "hooks.json");
-  const hooksFile = readJson(hooksPath);
+  const homeDir2 = os18.homedir();
+  const configPath = path21.join(homeDir2, ".codex", "config.toml");
+  const hooksPath = path21.join(homeDir2, ".codex", "hooks.json");
+  const hooksFile = readJson2(hooksPath);
   if (hooksFile?.hooks) {
     let hooksChanged = false;
     for (const event of ["PreToolUse", "PostToolUse", "UserPromptSubmit"]) {
@@ -12794,9 +13490,9 @@ function teardownCodex() {
   }
 }
 function setupHud() {
-  const homeDir2 = os16.homedir();
-  const hooksPath = path20.join(homeDir2, ".claude", "settings.json");
-  const settings = readJson(hooksPath) ?? {};
+  const homeDir2 = os18.homedir();
+  const hooksPath = path21.join(homeDir2, ".claude", "settings.json");
+  const settings = readJson2(hooksPath) ?? {};
   const hudCommand = fullPathCommand("hud");
   const statusLineObj = { type: "command", command: hudCommand };
   const existing = settings.statusLine;
@@ -12823,9 +13519,9 @@ function setupHud() {
   console.log(chalk.gray("   Restart Claude Code to activate."));
 }
 function teardownHud() {
-  const homeDir2 = os16.homedir();
-  const hooksPath = path20.join(homeDir2, ".claude", "settings.json");
-  const settings = readJson(hooksPath);
+  const homeDir2 = os18.homedir();
+  const hooksPath = path21.join(homeDir2, ".claude", "settings.json");
+  const settings = readJson2(hooksPath);
   if (!settings) {
     console.log(chalk.blue("  \u2139\uFE0F  ~/.claude/settings.json not found \u2014 nothing to remove"));
     return;
@@ -12843,9 +13539,9 @@ function teardownHud() {
 }
 async function setupWindsurf() {
   seedMcpPinsIfMissing();
-  const homeDir2 = os16.homedir();
-  const mcpPath = path20.join(homeDir2, ".codeium", "windsurf", "mcp_config.json");
-  const mcpConfig = readJson(mcpPath) ?? {};
+  const homeDir2 = os18.homedir();
+  const mcpPath = path21.join(homeDir2, ".codeium", "windsurf", "mcp_config.json");
+  const mcpConfig = readJson2(mcpPath) ?? {};
   const servers = mcpConfig.mcpServers ?? {};
   let anythingChanged = false;
   const repairedMcpWraps = repairLegacyMcpWraps(
@@ -12921,9 +13617,9 @@ async function setupWindsurf() {
   }
 }
 function teardownWindsurf() {
-  const homeDir2 = os16.homedir();
-  const mcpPath = path20.join(homeDir2, ".codeium", "windsurf", "mcp_config.json");
-  const mcpConfig = readJson(mcpPath);
+  const homeDir2 = os18.homedir();
+  const mcpPath = path21.join(homeDir2, ".codeium", "windsurf", "mcp_config.json");
+  const mcpConfig = readJson2(mcpPath);
   if (!mcpConfig?.mcpServers) {
     console.log(
       chalk.blue("  \u2139\uFE0F  ~/.codeium/windsurf/mcp_config.json not found \u2014 nothing to remove")
@@ -12964,9 +13660,9 @@ function hasNode9McpServerVSCode(servers) {
 }
 async function setupVSCode() {
   seedMcpPinsIfMissing();
-  const homeDir2 = os16.homedir();
-  const mcpPath = path20.join(homeDir2, ".vscode", "mcp.json");
-  const mcpConfig = readJson(mcpPath) ?? {};
+  const homeDir2 = os18.homedir();
+  const mcpPath = path21.join(homeDir2, ".vscode", "mcp.json");
+  const mcpConfig = readJson2(mcpPath) ?? {};
   const servers = mcpConfig.servers ?? {};
   let anythingChanged = false;
   const repairedMcpWraps = repairLegacyMcpWraps(
@@ -13045,9 +13741,9 @@ async function setupVSCode() {
   }
 }
 function teardownVSCode() {
-  const homeDir2 = os16.homedir();
-  const mcpPath = path20.join(homeDir2, ".vscode", "mcp.json");
-  const mcpConfig = readJson(mcpPath);
+  const homeDir2 = os18.homedir();
+  const mcpPath = path21.join(homeDir2, ".vscode", "mcp.json");
+  const mcpConfig = readJson2(mcpPath);
   if (!mcpConfig?.servers) {
     console.log(chalk.blue("  \u2139\uFE0F  ~/.vscode/mcp.json not found \u2014 nothing to remove"));
     return;
@@ -13085,7 +13781,7 @@ async function setupClaudeDesktop() {
     console.log(chalk.yellow("  \u26A0\uFE0F  Claude Desktop is not supported on this platform."));
     return;
   }
-  const config = readJson(configPath) ?? {};
+  const config = readJson2(configPath) ?? {};
   const servers = config.mcpServers ?? {};
   let anythingChanged = false;
   const repairedMcpWraps = repairLegacyMcpWraps(
@@ -13166,7 +13862,7 @@ function teardownClaudeDesktop() {
     console.log(chalk.yellow("  \u26A0\uFE0F  Claude Desktop is not supported on this platform."));
     return;
   }
-  const config = readJson(configPath);
+  const config = readJson2(configPath);
   if (!config?.mcpServers) {
     console.log(chalk.blue("  \u2139\uFE0F  Claude Desktop config not found \u2014 nothing to remove"));
     return;
@@ -13205,7 +13901,7 @@ function node9ArgvForShim() {
 function node9Version() {
   try {
     const pkg = JSON.parse(
-      fs19.readFileSync(path20.join(__dirname, "..", "package.json"), "utf-8")
+      fs21.readFileSync(path21.join(__dirname, "..", "package.json"), "utf-8")
     );
     return pkg.version ?? "0.0.0";
   } catch {
@@ -13214,13 +13910,13 @@ function node9Version() {
 }
 async function setupOpencode() {
   seedMcpPinsIfMissing();
-  const homeDir2 = os16.homedir();
+  const homeDir2 = os18.homedir();
   const configDir = opencodeConfigDir(homeDir2);
-  const pluginsDir = path20.join(configDir, "plugins");
-  const configPath = path20.join(configDir, "opencode.json");
-  const pluginPath = path20.join(pluginsDir, OPENCODE_PLUGIN_NAME);
+  const pluginsDir = path21.join(configDir, "plugins");
+  const configPath = path21.join(configDir, "opencode.json");
+  const pluginPath = path21.join(pluginsDir, OPENCODE_PLUGIN_NAME);
   try {
-    fs19.mkdirSync(pluginsDir, { recursive: true });
+    fs21.mkdirSync(pluginsDir, { recursive: true });
   } catch (err2) {
     const code = err2.code;
     if (code !== "EEXIST") {
@@ -13235,13 +13931,13 @@ async function setupOpencode() {
   let pluginChanged = false;
   const existingShim = (() => {
     try {
-      return fs19.readFileSync(pluginPath, "utf-8");
+      return fs21.readFileSync(pluginPath, "utf-8");
     } catch {
       return null;
     }
   })();
   if (existingShim !== shimContent) {
-    fs19.writeFileSync(pluginPath, shimContent);
+    fs21.writeFileSync(pluginPath, shimContent);
     pluginChanged = true;
     if (existingShim) {
       console.log(chalk.yellow("  \u{1F527} Opencode plugin shim updated to current version"));
@@ -13251,7 +13947,7 @@ async function setupOpencode() {
       );
     }
   }
-  const config = readJson(configPath) ?? {};
+  const config = readJson2(configPath) ?? {};
   const mcp = config.mcp ?? {};
   let configChanged = false;
   const desiredCommand = [...node9ArgvForShim(), "mcp-server"];
@@ -13282,20 +13978,20 @@ async function setupOpencode() {
   }
 }
 function teardownOpencode() {
-  const homeDir2 = os16.homedir();
+  const homeDir2 = os18.homedir();
   const configDir = opencodeConfigDir(homeDir2);
-  const pluginsDir = path20.join(configDir, "plugins");
-  const configPath = path20.join(configDir, "opencode.json");
-  const pluginPath = path20.join(pluginsDir, OPENCODE_PLUGIN_NAME);
+  const pluginsDir = path21.join(configDir, "plugins");
+  const configPath = path21.join(configDir, "opencode.json");
+  const pluginPath = path21.join(pluginsDir, OPENCODE_PLUGIN_NAME);
   try {
-    if (fs19.existsSync(pluginPath)) {
-      fs19.unlinkSync(pluginPath);
+    if (fs21.existsSync(pluginPath)) {
+      fs21.unlinkSync(pluginPath);
       console.log(chalk.green("  \u2705 Removed node9 plugin from ~/.config/opencode/plugins/"));
     }
   } catch (err2) {
     console.log(chalk.yellow(`  \u26A0\uFE0F  Could not remove ${pluginPath}: ${String(err2)}`));
   }
-  const config = readJson(configPath);
+  const config = readJson2(configPath);
   if (!config) {
     console.log(chalk.blue("  \u2139\uFE0F  ~/.config/opencode/opencode.json not found \u2014 nothing to remove"));
     return;
@@ -13318,11 +14014,11 @@ function teardownOpencode() {
 }
 async function setupPi() {
   seedMcpPinsIfMissing();
-  const homeDir2 = os16.homedir();
-  const extensionsDir = path20.join(homeDir2, ".pi", "agent", "extensions");
-  const extensionPath = path20.join(extensionsDir, PI_EXTENSION_NAME);
+  const homeDir2 = os18.homedir();
+  const extensionsDir = path21.join(homeDir2, ".pi", "agent", "extensions");
+  const extensionPath = path21.join(extensionsDir, PI_EXTENSION_NAME);
   try {
-    fs19.mkdirSync(extensionsDir, { recursive: true });
+    fs21.mkdirSync(extensionsDir, { recursive: true });
   } catch (err2) {
     const code = err2.code;
     console.log(chalk.yellow(`  \u26A0\uFE0F  Could not create ${extensionsDir}: ${code ?? String(err2)}`));
@@ -13334,7 +14030,7 @@ async function setupPi() {
   });
   const existingShim = (() => {
     try {
-      return fs19.readFileSync(extensionPath, "utf-8");
+      return fs21.readFileSync(extensionPath, "utf-8");
     } catch {
       return null;
     }
@@ -13343,7 +14039,7 @@ async function setupPi() {
     console.log(chalk.blue("  \u2139\uFE0F  Node9 is already fully configured for Pi."));
     return;
   }
-  fs19.writeFileSync(extensionPath, shimContent);
+  fs21.writeFileSync(extensionPath, shimContent);
   if (existingShim) {
     console.log(chalk.yellow("  \u{1F527} Pi extension shim updated to current version"));
   } else {
@@ -13356,11 +14052,11 @@ async function setupPi() {
   printDaemonTip();
 }
 function teardownPi() {
-  const homeDir2 = os16.homedir();
-  const extensionPath = path20.join(homeDir2, ".pi", "agent", "extensions", PI_EXTENSION_NAME);
+  const homeDir2 = os18.homedir();
+  const extensionPath = path21.join(homeDir2, ".pi", "agent", "extensions", PI_EXTENSION_NAME);
   try {
-    if (fs19.existsSync(extensionPath)) {
-      fs19.unlinkSync(extensionPath);
+    if (fs21.existsSync(extensionPath)) {
+      fs21.unlinkSync(extensionPath);
       console.log(chalk.green("  \u2705 Removed node9 extension from ~/.pi/agent/extensions/"));
     } else {
       console.log(chalk.blue("  \u2139\uFE0F  No Pi extension installed \u2014 nothing to remove"));
@@ -13369,29 +14065,29 @@ function teardownPi() {
     console.log(chalk.yellow(`  \u26A0\uFE0F  Could not remove ${extensionPath}: ${String(err2)}`));
   }
 }
-function hermesHomeDir(homeDir2 = os16.homedir()) {
+function hermesHomeDir(homeDir2 = os18.homedir()) {
   const env = process.env.HERMES_HOME?.trim();
-  if (env && path20.isAbsolute(env)) return env;
-  return path20.join(homeDir2, ".hermes");
+  if (env && path21.isAbsolute(env)) return env;
+  return path21.join(homeDir2, ".hermes");
 }
-function hermesConfigPath(homeDir2 = os16.homedir()) {
-  return path20.join(hermesHomeDir(homeDir2), HERMES_CONFIG_FILENAME);
+function hermesConfigPath(homeDir2 = os18.homedir()) {
+  return path21.join(hermesHomeDir(homeDir2), HERMES_CONFIG_FILENAME);
 }
-function hermesAllowlistPath(homeDir2 = os16.homedir()) {
-  return path20.join(hermesHomeDir(homeDir2), HERMES_ALLOWLIST_FILENAME);
+function hermesAllowlistPath(homeDir2 = os18.homedir()) {
+  return path21.join(hermesHomeDir(homeDir2), HERMES_ALLOWLIST_FILENAME);
 }
 function setupHermes() {
-  const homeDir2 = os16.homedir();
+  const homeDir2 = os18.homedir();
   const configPath = hermesConfigPath(homeDir2);
   const allowlistPath = hermesAllowlistPath(homeDir2);
-  if (!fs19.existsSync(configPath)) {
+  if (!fs21.existsSync(configPath)) {
     console.log(chalk.yellow(`  \u26A0\uFE0F  Hermes config not found at ${configPath}`));
     console.log(chalk.gray("     Run `hermes setup` first, then re-run node9 agents add hermes."));
     return;
   }
   let anythingChanged = false;
-  const raw = fs19.readFileSync(configPath, "utf-8");
-  const doc = yaml.parseDocument(raw);
+  const raw = fs21.readFileSync(configPath, "utf-8");
+  const doc = yaml2.parseDocument(raw);
   if (doc.errors.length > 0) {
     console.log(chalk.yellow(`  \u26A0\uFE0F  Hermes config.yaml has YAML parse errors:`));
     for (const err2 of doc.errors.slice(0, 3)) {
@@ -13433,9 +14129,9 @@ function setupHermes() {
     atomicWriteSync(configPath, doc.toString());
   }
   let allowlist = {};
-  if (fs19.existsSync(allowlistPath)) {
+  if (fs21.existsSync(allowlistPath)) {
     try {
-      allowlist = JSON.parse(fs19.readFileSync(allowlistPath, "utf-8"));
+      allowlist = JSON.parse(fs21.readFileSync(allowlistPath, "utf-8"));
     } catch {
       allowlist = {};
     }
@@ -13471,15 +14167,15 @@ function setupHermes() {
   }
 }
 function teardownHermes() {
-  const homeDir2 = os16.homedir();
+  const homeDir2 = os18.homedir();
   const configPath = hermesConfigPath(homeDir2);
   const allowlistPath = hermesAllowlistPath(homeDir2);
-  if (!fs19.existsSync(configPath)) {
+  if (!fs21.existsSync(configPath)) {
     console.log(chalk.blue(`  \u2139\uFE0F  ${configPath} not found \u2014 nothing to remove`));
     return;
   }
-  const raw = fs19.readFileSync(configPath, "utf-8");
-  const doc = yaml.parseDocument(raw);
+  const raw = fs21.readFileSync(configPath, "utf-8");
+  const doc = yaml2.parseDocument(raw);
   if (doc.errors.length > 0) {
     console.log(
       chalk.yellow(`  \u26A0\uFE0F  Skipping ${configPath} \u2014 file has YAML parse errors, fix it manually.`)
@@ -13511,16 +14207,16 @@ function teardownHermesConfigDoc(doc, configPath) {
     anythingChanged = true;
   }
   if (anythingChanged) {
-    fs19.writeFileSync(configPath, doc.toString());
+    fs21.writeFileSync(configPath, doc.toString());
     console.log(chalk.green(`  \u2705 Removed Node9 hooks from ${configPath}`));
   } else {
     console.log(chalk.blue(`  \u2139\uFE0F  No Node9 hooks found in ${configPath}`));
   }
 }
 function teardownHermesAllowlist(allowlistPath) {
-  if (!fs19.existsSync(allowlistPath)) return;
+  if (!fs21.existsSync(allowlistPath)) return;
   try {
-    const raw = fs19.readFileSync(allowlistPath, "utf-8");
+    const raw = fs21.readFileSync(allowlistPath, "utf-8");
     const allowlist = JSON.parse(raw);
     if (!Array.isArray(allowlist.approvals)) return;
     const before = allowlist.approvals.length;
@@ -13533,44 +14229,44 @@ function teardownHermesAllowlist(allowlistPath) {
   } catch {
   }
 }
-function getAgentsStatus(homeDir2 = os16.homedir()) {
+function getAgentsStatus(homeDir2 = os18.homedir()) {
   const detected = detectAgents(homeDir2);
   const claudeWired = (() => {
-    const settings = readJson(path20.join(homeDir2, ".claude", "settings.json"));
+    const settings = readJson2(path21.join(homeDir2, ".claude", "settings.json"));
     return !!settings?.hooks?.PreToolUse?.some((m) => m.hooks.some((h) => isNode9Hook(h.command)));
   })();
   const geminiWired = (() => {
-    const settings = readJson(path20.join(homeDir2, ".gemini", "settings.json"));
+    const settings = readJson2(path21.join(homeDir2, ".gemini", "settings.json"));
     return !!settings?.hooks?.BeforeTool?.some((m) => m.hooks.some((h) => isNode9Hook(h.command)));
   })();
   const antigravityWired = (() => {
-    const hooksFile = readJson(
-      path20.join(homeDir2, ".gemini", "config", "hooks.json")
+    const hooksFile = readJson2(
+      path21.join(homeDir2, ".gemini", "config", "hooks.json")
     );
     return !!hooksFile?.hooks?.PreToolUse?.some((m) => m.hooks.some((h) => isNode9Hook(h.command)));
   })();
   const copilotWired = (() => {
-    const hooksFile = readJson(
-      path20.join(homeDir2, ".copilot", "hooks", "node9.json")
+    const hooksFile = readJson2(
+      path21.join(homeDir2, ".copilot", "hooks", "node9.json")
     );
     return !!hooksFile?.hooks?.PreToolUse?.some((h) => isNode9Hook(h.command));
   })();
   const cursorWired = (() => {
-    const cfg = readJson(path20.join(homeDir2, ".cursor", "mcp.json"));
+    const cfg = readJson2(path21.join(homeDir2, ".cursor", "mcp.json"));
     return !!(cfg?.mcpServers && hasNode9McpServer(cfg.mcpServers));
   })();
   const codexWired = (() => {
-    const cfg = readToml(path20.join(homeDir2, ".codex", "config.toml"));
+    const cfg = readToml(path21.join(homeDir2, ".codex", "config.toml"));
     return !!(cfg?.mcp_servers && hasNode9McpServer(cfg.mcp_servers));
   })();
   const windsurfWired = (() => {
-    const cfg = readJson(
-      path20.join(homeDir2, ".codeium", "windsurf", "mcp_config.json")
+    const cfg = readJson2(
+      path21.join(homeDir2, ".codeium", "windsurf", "mcp_config.json")
     );
     return !!(cfg?.mcpServers && hasNode9McpServer(cfg.mcpServers));
   })();
   const vscodeWired = (() => {
-    const cfg = readJson(path20.join(homeDir2, ".vscode", "mcp.json"));
+    const cfg = readJson2(path21.join(homeDir2, ".vscode", "mcp.json"));
     return !!(cfg?.servers && hasNode9McpServerVSCode(cfg.servers));
   })();
   return [
@@ -13637,7 +14333,7 @@ function getAgentsStatus(homeDir2 = os16.homedir()) {
       wired: (() => {
         const cfgPath = claudeDesktopConfigPath(homeDir2);
         if (!cfgPath) return false;
-        const cfg = readJson(cfgPath);
+        const cfg = readJson2(cfgPath);
         return !!(cfg?.mcpServers && hasNode9McpServer(cfg.mcpServers));
       })(),
       mode: detected.claudeDesktop ? "mcp" : null
@@ -13647,16 +14343,16 @@ function getAgentsStatus(homeDir2 = os16.homedir()) {
       label: "Opencode",
       installed: detected.opencode,
       wired: (() => {
-        const pluginPath = path20.join(
+        const pluginPath = path21.join(
           homeDir2,
           ".config",
           "opencode",
           "plugins",
           OPENCODE_PLUGIN_NAME
         );
-        if (fs19.existsSync(pluginPath)) return true;
-        const cfg = readJson(
-          path20.join(homeDir2, ".config", "opencode", "opencode.json")
+        if (fs21.existsSync(pluginPath)) return true;
+        const cfg = readJson2(
+          path21.join(homeDir2, ".config", "opencode", "opencode.json")
         );
         return !!cfg?.mcp?.["node9"];
       })(),
@@ -13668,7 +14364,7 @@ function getAgentsStatus(homeDir2 = os16.homedir()) {
       installed: detected.pi,
       // Pi has no MCP path — only the extension file. "wired" is a
       // simple existence check on the canonical install location.
-      wired: fs19.existsSync(path20.join(homeDir2, ".pi", "agent", "extensions", PI_EXTENSION_NAME)),
+      wired: fs21.existsSync(path21.join(homeDir2, ".pi", "agent", "extensions", PI_EXTENSION_NAME)),
       mode: detected.pi ? "hooks" : null
     },
     {
@@ -13680,8 +14376,8 @@ function getAgentsStatus(homeDir2 = os16.homedir()) {
       // Document API for a boolean status check.
       wired: (() => {
         try {
-          const raw = fs19.readFileSync(hermesConfigPath(homeDir2), "utf-8");
-          const cfg = yaml.parse(raw);
+          const raw = fs21.readFileSync(hermesConfigPath(homeDir2), "utf-8");
+          const cfg = yaml2.parse(raw);
           const pre = cfg?.hooks?.["pre_tool_call"] ?? [];
           return pre.some((e) => typeof e?.command === "string" && isNode9Hook(e.command));
         } catch {
@@ -13696,6 +14392,7 @@ var NODE9_MCP_SERVER_ENTRY, MCP_WRAP_SUBCOMMAND, LEGACY_MCP_WRAP_SUBCOMMAND, COD
 var init_setup = __esm({
   "src/setup.ts"() {
     "use strict";
+    init_mcp_wrap();
     init_codex_trust();
     init_mcp_pin();
     init_hook_baseline();
@@ -13717,244 +14414,6 @@ var init_setup = __esm({
   }
 });
 
-// src/agent-wiring.ts
-import fs20 from "fs";
-import path21 from "path";
-import os17 from "os";
-import * as yaml2 from "yaml";
-import { parse as parseToml3 } from "smol-toml";
-function readJson2(filePath) {
-  if (!fs20.existsSync(filePath)) return null;
-  try {
-    return JSON.parse(fs20.readFileSync(filePath, "utf-8"));
-  } catch {
-    return "invalid";
-  }
-}
-function matchersHaveNode9Hook(matchers) {
-  return (matchers ?? []).some((m) => (m.hooks ?? []).some((h) => isNode9Hook(h.command)));
-}
-function flatHaveNode9Hook(entries) {
-  return (Array.isArray(entries) ? entries : []).some((h) => isNode9Hook(h.command));
-}
-function readHookRoot(filePath, format) {
-  if (!fs20.existsSync(filePath)) return "absent";
-  let raw;
-  try {
-    raw = fs20.readFileSync(filePath, "utf-8");
-  } catch {
-    return "absent";
-  }
-  try {
-    const parsed = format === "yaml" ? yaml2.parse(raw) : JSON.parse(raw);
-    return parsed?.hooks ?? {};
-  } catch {
-    return "invalid";
-  }
-}
-function eventWired(root, ev, format) {
-  const arr = root[ev.key];
-  if (format === "matcher") return matchersHaveNode9Hook(arr);
-  return flatHaveNode9Hook(arr);
-}
-function detectMcp(servers) {
-  const entries = Object.entries(servers ?? {});
-  const present = entries.some(([, s]) => s?.command === "node9");
-  const wrapped = entries.filter(([, s]) => s?.command === "node9" && Array.isArray(s.args) && s.args.length > 0).map(([name, s]) => `${name} \u2192 ${s.args.join(" ")}`);
-  return { wrapped, present };
-}
-function readMcpServers(filePath, format) {
-  if (!fs20.existsSync(filePath)) return {};
-  try {
-    if (format === "toml") {
-      const parsed2 = parseToml3(fs20.readFileSync(filePath, "utf-8"));
-      return parsed2?.mcp_servers ?? {};
-    }
-    const parsed = readJson2(filePath);
-    if (parsed === null || parsed === "invalid") return {};
-    return parsed.mcpServers ?? {};
-  } catch {
-    return {};
-  }
-}
-function readMcp(filePath, format) {
-  if (!fs20.existsSync(filePath)) return { wrapped: [], present: false };
-  try {
-    if (format === "toml") {
-      const parsed2 = parseToml3(fs20.readFileSync(filePath, "utf-8"));
-      return detectMcp(parsed2?.mcp_servers);
-    }
-    const parsed = readJson2(filePath);
-    if (parsed === null || parsed === "invalid") return { wrapped: [], present: false };
-    return detectMcp(parsed.mcpServers);
-  } catch {
-    return { wrapped: [], present: false };
-  }
-}
-function getAgentWiring(home = os17.homedir()) {
-  const detected = detectAgents(home);
-  return AGENT_SPECS.map((spec) => {
-    const present = spec.present(home);
-    const pad = spec.labelPad ?? DEFAULT_LABEL_PAD;
-    let hooks;
-    let wireState;
-    let hookLabel;
-    let settingsPath;
-    if (spec.shimFile) {
-      const shimWired = exists(spec.shimFile(home));
-      hooks = [{ label: "node9 plugin (node9 check)", wired: shimWired }];
-      wireState = shimWired ? "wired" : present ? "unwired" : "absent";
-      hookLabel = "node9 plugin";
-      settingsPath = spec.shimFile(home);
-    } else {
-      const root = spec.hookFile ? readHookRoot(spec.hookFile(home), spec.hookFormat) : "absent";
-      const primary = spec.hookEvents[0];
-      const rootPresent = root !== "absent" && root !== "invalid";
-      hooks = spec.hookEvents.map((ev) => ({
-        label: hookLabelOf(ev, pad),
-        wired: rootPresent && eventWired(root, ev, spec.hookFormat)
-      }));
-      if (root === "absent") wireState = "absent";
-      else if (root === "invalid") wireState = "invalid";
-      else wireState = primary && eventWired(root, primary, spec.hookFormat) ? "wired" : "unwired";
-      hookLabel = primary ? `${primary.key} hook` : "MCP proxy";
-      settingsPath = spec.hookFile ? spec.hookFile(home) : spec.mcpFile ? spec.mcpFile(home) : "";
-    }
-    const mcp = spec.mcpFile ? readMcp(spec.mcpFile(home), spec.mcpFormat ?? "json") : null;
-    const anyHookWired = hooks.some((h) => h.wired);
-    return {
-      id: spec.id,
-      label: spec.label,
-      setupCommand: spec.setupCommand,
-      installed: detected[spec.id],
-      present,
-      hooks,
-      wireState,
-      hookLabel,
-      settingsPath,
-      configFormat: spec.hookFormat === "yaml" ? "YAML" : "JSON",
-      mcpServers: mcp ? mcp.wrapped : null,
-      mcpProtected: mcp ? mcp.present : false,
-      isProtected: anyHookWired || (mcp?.present ?? false)
-    };
-  });
-}
-var exists, ck, lg, DEFAULT_LABEL_PAD, hookLabelOf, AGENT_SPECS;
-var init_agent_wiring = __esm({
-  "src/agent-wiring.ts"() {
-    "use strict";
-    init_setup();
-    exists = (p) => {
-      try {
-        return fs20.existsSync(p);
-      } catch {
-        return false;
-      }
-    };
-    ck = (key) => ({ key, kind: "check" });
-    lg = (key) => ({ key, kind: "log" });
-    DEFAULT_LABEL_PAD = 11;
-    hookLabelOf = (ev, pad) => `${ev.key.padEnd(pad)} (node9 ${ev.kind})`;
-    AGENT_SPECS = [
-      {
-        id: "claude",
-        label: "Claude Code",
-        setupCommand: "node9 agents add claude",
-        hookFile: (h) => path21.join(h, ".claude", "settings.json"),
-        hookFormat: "matcher",
-        // UserPromptSubmit is prompt DLP. setup.ts has written it for Claude since
-        // that shipped; the spec must name it too, or status/doctor never show the
-        // row and heal (which repairs via setupAgent) has no signal it is missing.
-        hookEvents: [ck("PreToolUse"), lg("PostToolUse"), ck("UserPromptSubmit")],
-        mcpFile: (h) => path21.join(h, ".claude.json"),
-        present: (h) => exists(path21.join(h, ".claude", "settings.json")) || exists(path21.join(h, ".claude.json"))
-      },
-      {
-        id: "gemini",
-        label: "Gemini CLI",
-        setupCommand: "node9 agents add gemini",
-        hookFile: (h) => path21.join(h, ".gemini", "settings.json"),
-        hookFormat: "matcher",
-        hookEvents: [ck("BeforeTool"), lg("AfterTool")],
-        mcpFile: (h) => path21.join(h, ".gemini", "settings.json"),
-        present: (h) => exists(path21.join(h, ".gemini", "settings.json"))
-      },
-      {
-        id: "codex",
-        label: "Codex",
-        setupCommand: "node9 agents add codex",
-        hookFile: (h) => path21.join(h, ".codex", "hooks.json"),
-        hookFormat: "matcher",
-        hookEvents: [ck("PreToolUse"), ck("UserPromptSubmit")],
-        mcpFile: (h) => path21.join(h, ".codex", "config.toml"),
-        mcpFormat: "toml",
-        present: (h) => exists(path21.join(h, ".codex"))
-      },
-      {
-        id: "antigravity",
-        label: "Antigravity",
-        setupCommand: "node9 agents add antigravity",
-        hookFile: (h) => path21.join(h, ".gemini", "config", "hooks.json"),
-        hookFormat: "matcher",
-        hookEvents: [ck("PreToolUse"), lg("PostToolUse")],
-        mcpFile: (h) => path21.join(h, ".gemini", "config", "mcp_config.json"),
-        present: (h) => exists(path21.join(h, ".gemini", "config", "hooks.json")) || exists(path21.join(h, ".gemini", "antigravity-cli")) || exists(path21.join(h, ".gemini", "antigravity-ide"))
-      },
-      {
-        id: "copilot",
-        label: "GitHub Copilot",
-        setupCommand: "node9 agents add copilot",
-        hookFile: (h) => path21.join(h, ".copilot", "hooks", "node9.json"),
-        hookFormat: "flat",
-        hookEvents: [ck("PreToolUse"), lg("PostToolUse"), ck("UserPromptSubmit")],
-        mcpFile: (h) => path21.join(h, ".copilot", "mcp-config.json"),
-        present: (h) => exists(path21.join(h, ".copilot"))
-      },
-      {
-        id: "cursor",
-        label: "Cursor",
-        setupCommand: "node9 agents add cursor",
-        // MCP-only — no hook file (see note above).
-        hookFormat: "flat",
-        hookEvents: [],
-        mcpFile: (h) => path21.join(h, ".cursor", "mcp.json"),
-        present: (h) => exists(path21.join(h, ".cursor", "mcp.json"))
-      },
-      {
-        id: "hermes",
-        label: "Hermes Agent",
-        setupCommand: "node9 agents add hermes",
-        hookFile: (h) => hermesConfigPath(h),
-        hookFormat: "yaml",
-        hookEvents: [ck("pre_tool_call"), lg("post_tool_call")],
-        labelPad: 14,
-        // 'post_tool_call' is wider than the default
-        present: (h) => exists(hermesConfigPath(h))
-      },
-      {
-        // Plugin-shim agents — protected by a node9-authored plugin/extension file
-        // (no hooks, no MCP). hookFormat is unused for these (shimFile drives it).
-        id: "opencode",
-        label: "OpenCode",
-        setupCommand: "node9 agents add opencode",
-        hookFormat: "flat",
-        hookEvents: [],
-        shimFile: (h) => path21.join(opencodeConfigDir(h), "plugins", "node9.js"),
-        present: (h) => exists(opencodeConfigDir(h)) || exists(path21.join(opencodeConfigDir(h), "plugins", "node9.js"))
-      },
-      {
-        id: "pi",
-        label: "Pi",
-        setupCommand: "node9 agents add pi",
-        hookFormat: "flat",
-        hookEvents: [],
-        shimFile: (h) => path21.join(h, ".pi", "agent", "extensions", "node9.js"),
-        present: (h) => exists(path21.join(h, ".pi", "agent")) || exists(path21.join(h, ".pi", "agent", "extensions", "node9.js"))
-      }
-    ];
-  }
-});
-
 // src/config/keyed-guard.ts
 import chalk2 from "chalk";
 function isKeyedForPolicy() {
@@ -13987,15 +14446,15 @@ var init_keyed_guard = __esm({
 });
 
 // src/pricing/litellm.ts
-import fs22 from "fs";
+import fs23 from "fs";
 import path23 from "path";
-import os19 from "os";
+import os20 from "os";
 function normalizeModel(raw) {
   return raw.replace(/-\d{8}$/, "").toLowerCase();
 }
 function readCache(opts) {
   try {
-    const raw = JSON.parse(fs22.readFileSync(CACHE_FILE(), "utf-8"));
+    const raw = JSON.parse(fs23.readFileSync(CACHE_FILE(), "utf-8"));
     if (typeof raw.fetchedAt !== "string" || typeof raw.prices !== "object" || raw.prices === null) {
       return null;
     }
@@ -14011,17 +14470,17 @@ function writeCache(prices) {
   try {
     const target = CACHE_FILE();
     const dir = path23.dirname(target);
-    if (!fs22.existsSync(dir)) fs22.mkdirSync(dir, { recursive: true });
+    if (!fs23.existsSync(dir)) fs23.mkdirSync(dir, { recursive: true });
     const tmp = target + ".tmp";
     const body = {
       fetchedAt: (/* @__PURE__ */ new Date()).toISOString(),
       prices
     };
-    fs22.writeFileSync(tmp, JSON.stringify(body) + "\n", "utf-8");
-    fs22.renameSync(tmp, target);
+    fs23.writeFileSync(tmp, JSON.stringify(body) + "\n", "utf-8");
+    fs23.renameSync(tmp, target);
   } catch (err2) {
     try {
-      fs22.appendFileSync(
+      fs23.appendFileSync(
         HOOK_DEBUG_LOG,
         `[pricing] cache write failed: ${err2.message}
 `
@@ -14179,7 +14638,7 @@ var init_litellm = __esm({
       "gemini-2.0-flash": [75e-9, 3e-7, 0, 0],
       "gemini-1.5-pro": [125e-8, 5e-6, 0, 0]
     };
-    CACHE_FILE = () => path23.join(os19.homedir(), ".node9", "model-pricing.json");
+    CACHE_FILE = () => path23.join(os20.homedir(), ".node9", "model-pricing.json");
     TTL_MS = 24 * 60 * 60 * 1e3;
     memCache = null;
     memCacheAt = 0;
@@ -14189,11 +14648,11 @@ var init_litellm = __esm({
 });
 
 // src/cost-gemini.ts
-import fs23 from "fs";
-import os20 from "os";
+import fs24 from "fs";
+import os21 from "os";
 import path24 from "path";
 function geminiTmpDir() {
-  return path24.join(os20.homedir(), ".gemini", "tmp");
+  return path24.join(os21.homedir(), ".gemini", "tmp");
 }
 function geminiPriceFor(model) {
   let tuple = pricingFor(model);
@@ -14208,14 +14667,14 @@ function geminiPriceFor(model) {
 }
 function safeReaddir(dir) {
   try {
-    return fs23.readdirSync(dir);
+    return fs24.readdirSync(dir);
   } catch {
     return [];
   }
 }
 function isDir(p) {
   try {
-    return fs23.statSync(p).isDirectory();
+    return fs24.statSync(p).isDirectory();
   } catch {
     return false;
   }
@@ -14294,7 +14753,7 @@ var init_cost_gemini = __esm({
       id: "gemini",
       available() {
         try {
-          return fs23.existsSync(geminiTmpDir());
+          return fs24.existsSync(geminiTmpDir());
         } catch {
           return false;
         }
@@ -14303,13 +14762,13 @@ var init_cost_gemini = __esm({
         const combined = /* @__PURE__ */ new Map();
         for (const { file, project } of listGeminiSessionFiles(geminiTmpDir())) {
           try {
-            if (sinceMs !== void 0 && fs23.statSync(file).mtimeMs < sinceMs) continue;
+            if (sinceMs !== void 0 && fs24.statSync(file).mtimeMs < sinceMs) continue;
           } catch {
             continue;
           }
           let content;
           try {
-            content = fs23.readFileSync(file, "utf8");
+            content = fs24.readFileSync(file, "utf8");
           } catch {
             continue;
           }
@@ -14334,11 +14793,11 @@ var init_cost_gemini = __esm({
 });
 
 // src/cost-codex.ts
-import fs24 from "fs";
-import os21 from "os";
+import fs25 from "fs";
+import os22 from "os";
 import path25 from "path";
 function codexSessionsDir() {
-  return path25.join(process.env.CODEX_HOME?.trim() || path25.join(os21.homedir(), ".codex"), "sessions");
+  return path25.join(process.env.CODEX_HOME?.trim() || path25.join(os22.homedir(), ".codex"), "sessions");
 }
 function codexPriceFor(model) {
   return pricingFor(codexModel(model), { exact: true }) ?? CODEX_FALLBACK;
@@ -14370,14 +14829,14 @@ function codexSessionCost(model, tokens, request2) {
 function statAndFirstLine(file) {
   const CAP = 4 * 1024 * 1024;
   const CHUNK = 64 * 1024;
-  const fd = fs24.openSync(file, "r");
+  const fd = fs25.openSync(file, "r");
   try {
-    const stat = fs24.fstatSync(fd);
+    const stat = fs25.fstatSync(fd);
     const limit = Math.min(stat.size, CAP);
     const parts = [];
     for (let pos = 0; pos < limit; pos += CHUNK) {
       const buf = Buffer.alloc(Math.min(CHUNK, limit - pos));
-      const read2 = fs24.readSync(fd, buf, 0, buf.length, pos);
+      const read2 = fs25.readSync(fd, buf, 0, buf.length, pos);
       if (read2 <= 0) break;
       const slice = buf.subarray(0, read2);
       const nl = slice.indexOf(10);
@@ -14386,14 +14845,14 @@ function statAndFirstLine(file) {
     }
     return { stat, first: Buffer.concat(parts).toString("utf8") };
   } finally {
-    fs24.closeSync(fd);
+    fs25.closeSync(fd);
   }
 }
 function listCodexSessionFiles(base = codexSessionsDir()) {
   const files = [];
   const walk = (dir) => {
     try {
-      for (const entry of fs24.readdirSync(dir, { withFileTypes: true })) {
+      for (const entry of fs25.readdirSync(dir, { withFileTypes: true })) {
         const file = path25.join(dir, entry.name);
         if (entry.isDirectory()) walk(file);
         else if (entry.isFile() && entry.name.endsWith(".jsonl")) files.push(file);
@@ -14600,13 +15059,13 @@ var init_cost_codex = __esm({
     CODEX_FALLBACK = [5e-6, 15e-6, 0, 25e-7];
     codexSource = {
       id: "codex",
-      available: () => fs24.existsSync(codexSessionsDir()) || fs24.existsSync(path25.join(path25.dirname(codexSessionsDir()), "archived_sessions")),
+      available: () => fs25.existsSync(codexSessionsDir()) || fs25.existsSync(path25.join(path25.dirname(codexSessionsDir()), "archived_sessions")),
       collect(sinceMs) {
         const entries = [];
         for (const file of listCodexSessionFiles()) {
           try {
-            if (sinceMs !== void 0 && fs24.statSync(file).mtimeMs < sinceMs) continue;
-            entries.push(...parseCodexSession(fs24.readFileSync(file, "utf8").split("\n")));
+            if (sinceMs !== void 0 && fs25.statSync(file).mtimeMs < sinceMs) continue;
+            entries.push(...parseCodexSession(fs25.readFileSync(file, "utf8").split("\n")));
           } catch {
           }
         }
@@ -14617,15 +15076,15 @@ var init_cost_codex = __esm({
 });
 
 // src/cost-copilot.ts
-import fs25 from "fs";
-import os22 from "os";
+import fs26 from "fs";
+import os23 from "os";
 import path26 from "path";
 function copilotSessionsDir() {
-  return path26.join(os22.homedir(), ".copilot", "session-state");
+  return path26.join(os23.homedir(), ".copilot", "session-state");
 }
 function safeReaddir2(dir) {
   try {
-    return fs25.readdirSync(dir);
+    return fs26.readdirSync(dir);
   } catch {
     return [];
   }
@@ -14701,7 +15160,7 @@ var init_cost_copilot = __esm({
       id: "copilot",
       available() {
         try {
-          return fs25.existsSync(copilotSessionsDir());
+          return fs26.existsSync(copilotSessionsDir());
         } catch {
           return false;
         }
@@ -14712,13 +15171,13 @@ var init_cost_copilot = __esm({
         for (const sid of safeReaddir2(base)) {
           const file = path26.join(base, sid, "events.jsonl");
           try {
-            if (sinceMs !== void 0 && fs25.statSync(file).mtimeMs < sinceMs) continue;
+            if (sinceMs !== void 0 && fs26.statSync(file).mtimeMs < sinceMs) continue;
           } catch {
             continue;
           }
           let content;
           try {
-            content = fs25.readFileSync(file, "utf8");
+            content = fs26.readFileSync(file, "utf8");
           } catch {
             continue;
           }
@@ -15072,9 +15531,9 @@ var init_scan_summary = __esm({
 
 // src/cli/commands/blast.ts
 import chalk3 from "chalk";
-import fs26 from "fs";
+import fs27 from "fs";
 import path27 from "path";
-import os23 from "os";
+import os24 from "os";
 function buildSensitivePaths(home, cwd) {
   return [
     {
@@ -15159,7 +15618,7 @@ function buildSensitivePaths(home, cwd) {
 }
 function isReadable(filePath) {
   try {
-    fs26.accessSync(filePath, fs26.constants.R_OK);
+    fs27.accessSync(filePath, fs27.constants.R_OK);
     return true;
   } catch {
     return false;
@@ -15172,13 +15631,13 @@ function scoreLabel(score) {
   return chalk3.red.bold(`${score}/100  Critical`);
 }
 function runBlast() {
-  const home = os23.homedir();
+  const home = os24.homedir();
   const cwd = process.cwd();
   const paths = buildSensitivePaths(home, cwd);
   let scoreDeduction = 0;
   const reachable = [];
   for (const p of paths) {
-    if (fs26.existsSync(p.full) && isReadable(p.full)) {
+    if (fs27.existsSync(p.full) && isReadable(p.full)) {
       reachable.push(p);
       scoreDeduction += p.score;
     }
@@ -15196,7 +15655,7 @@ function runBlast() {
 }
 function registerBlastCommand(program2) {
   program2.command("blast").description("Map what an AI agent can currently reach on this machine").action(() => {
-    const home = os23.homedir();
+    const home = os24.homedir();
     const cwd = process.cwd();
     const { reachable, envFindings, score } = runBlast();
     console.log("");
@@ -15385,7 +15844,7 @@ var init_scan_json = __esm({
 });
 
 // src/session-files.ts
-import * as fs27 from "fs";
+import * as fs28 from "fs";
 import * as path28 from "path";
 function listSessionFiles(dir, maxDepth = 6) {
   const out = [];
@@ -15393,7 +15852,7 @@ function listSessionFiles(dir, maxDepth = 6) {
     if (depth > maxDepth) return;
     let entries;
     try {
-      entries = fs27.readdirSync(d, { withFileTypes: true });
+      entries = fs28.readdirSync(d, { withFileTypes: true });
     } catch {
       return;
     }
@@ -15416,17 +15875,17 @@ var init_session_files = __esm({
 });
 
 // src/cli/render/scan-history.ts
-import fs28 from "fs";
+import fs29 from "fs";
 import path29 from "path";
-import os24 from "os";
+import os25 from "os";
 function defaultHistoryPath() {
-  return path29.join(os24.homedir(), ".node9", "scan-history.json");
+  return path29.join(os25.homedir(), ".node9", "scan-history.json");
 }
 function readPreviousScan(opts = {}) {
   const filePath = opts.path ?? defaultHistoryPath();
   try {
-    if (!fs28.existsSync(filePath)) return null;
-    const raw = fs28.readFileSync(filePath, "utf8");
+    if (!fs29.existsSync(filePath)) return null;
+    const raw = fs29.readFileSync(filePath, "utf8");
     const parsed = JSON.parse(raw);
     if (!Array.isArray(parsed) || parsed.length === 0) return null;
     const last = parsed[parsed.length - 1];
@@ -15440,11 +15899,11 @@ function appendScanHistory(record2, opts = {}) {
   const filePath = opts.path ?? defaultHistoryPath();
   const cap = opts.cap ?? SCAN_HISTORY_CAP;
   try {
-    fs28.mkdirSync(path29.dirname(filePath), { recursive: true });
+    fs29.mkdirSync(path29.dirname(filePath), { recursive: true });
     let history = [];
-    if (fs28.existsSync(filePath)) {
+    if (fs29.existsSync(filePath)) {
       try {
-        const parsed = JSON.parse(fs28.readFileSync(filePath, "utf8"));
+        const parsed = JSON.parse(fs29.readFileSync(filePath, "utf8"));
         if (Array.isArray(parsed)) {
           history = parsed.filter(isValidRecord);
         }
@@ -15487,9 +15946,9 @@ var init_scan_history = __esm({
 });
 
 // src/costSync.ts
-import fs29 from "fs";
+import fs30 from "fs";
 import path30 from "path";
-import os25 from "os";
+import os26 from "os";
 function decodeProjectDirName(dirName) {
   return dirName.replace(/-/g, "/");
 }
@@ -15497,7 +15956,7 @@ function parseJSONLFile(filePath, fallbackWorkingDir) {
   const runId = path30.basename(filePath, ".jsonl");
   let content;
   try {
-    content = fs29.readFileSync(filePath, "utf8");
+    content = fs30.readFileSync(filePath, "utf8");
   } catch {
     return /* @__PURE__ */ new Map();
   }
@@ -15597,7 +16056,7 @@ async function postCostBatches(apiUrl, apiKey, machineId, entries) {
         signal: AbortSignal.timeout(15e3)
       });
       if (!res.ok) {
-        fs29.appendFileSync(HOOK_DEBUG_LOG, `[cost-sync] HTTP ${res.status}
+        fs30.appendFileSync(HOOK_DEBUG_LOG, `[cost-sync] HTTP ${res.status}
 `);
       } else {
         let stored;
@@ -15607,7 +16066,7 @@ async function postCostBatches(apiUrl, apiKey, machineId, entries) {
         } catch {
         }
         if (typeof stored === "number" && stored < batch.length) {
-          fs29.appendFileSync(
+          fs30.appendFileSync(
             HOOK_DEBUG_LOG,
             `[cost-sync] dropped ${batch.length - stored} of ${batch.length} rows
 `
@@ -15615,7 +16074,7 @@ async function postCostBatches(apiUrl, apiKey, machineId, entries) {
         }
       }
     } catch (err2) {
-      fs29.appendFileSync(HOOK_DEBUG_LOG, `[cost-sync] ${safeMessage(err2)}
+      fs30.appendFileSync(HOOK_DEBUG_LOG, `[cost-sync] ${safeMessage(err2)}
 `);
     }
   }
@@ -15628,10 +16087,10 @@ async function syncCost() {
   if (entries.length === 0) return;
   let username = "unknown";
   try {
-    username = os25.userInfo().username;
+    username = os26.userInfo().username;
   } catch {
   }
-  const machineId = `${os25.hostname()}:${username}`;
+  const machineId = `${os26.hostname()}:${username}`;
   await postCostBatches(creds.apiUrl, creds.apiKey, machineId, entries);
 }
 function startCostSync() {
@@ -15659,22 +16118,22 @@ var init_costSync = __esm({
     claudeSource = {
       id: "claude",
       available() {
-        return fs29.existsSync(path30.join(os25.homedir(), ".claude", "projects"));
+        return fs30.existsSync(path30.join(os26.homedir(), ".claude", "projects"));
       },
       collect(sinceMs) {
-        const projectsDir = path30.join(os25.homedir(), ".claude", "projects");
-        if (!fs29.existsSync(projectsDir)) return [];
+        const projectsDir = path30.join(os26.homedir(), ".claude", "projects");
+        if (!fs30.existsSync(projectsDir)) return [];
         const combined = /* @__PURE__ */ new Map();
         let dirs;
         try {
-          dirs = fs29.readdirSync(projectsDir);
+          dirs = fs30.readdirSync(projectsDir);
         } catch {
           return [];
         }
         for (const dir of dirs) {
           const dirPath = path30.join(projectsDir, dir);
           try {
-            if (!fs29.statSync(dirPath).isDirectory()) continue;
+            if (!fs30.statSync(dirPath).isDirectory()) continue;
           } catch {
             continue;
           }
@@ -15689,7 +16148,7 @@ var init_costSync = __esm({
             const filePath = path30.join(dirPath, file);
             if (sinceMs !== void 0) {
               try {
-                if (fs29.statSync(filePath).mtimeMs < sinceMs) continue;
+                if (fs30.statSync(filePath).mtimeMs < sinceMs) continue;
               } catch {
                 continue;
               }
@@ -15729,8 +16188,8 @@ __export(scan_watermark_exports, {
   tickForensicBroadcast: () => tickForensicBroadcast,
   tickScanWatcher: () => tickScanWatcher
 });
-import fs30 from "fs";
-import os26 from "os";
+import fs31 from "fs";
+import os27 from "os";
 import path31 from "path";
 import readline from "readline";
 function freshWatermark() {
@@ -15744,7 +16203,7 @@ function freshWatermark() {
 function loadWatermark() {
   let raw;
   try {
-    raw = fs30.readFileSync(WATERMARK_FILE(), "utf-8");
+    raw = fs31.readFileSync(WATERMARK_FILE(), "utf-8");
   } catch {
     return { status: "fresh", wm: freshWatermark() };
   }
@@ -15797,21 +16256,21 @@ function saveWatermark(wm) {
   if (wm.schemaVersion > WATERMARK_SCHEMA_VERSION) return;
   const target = WATERMARK_FILE();
   const dir = path31.dirname(target);
-  if (!fs30.existsSync(dir)) fs30.mkdirSync(dir, { recursive: true });
+  if (!fs31.existsSync(dir)) fs31.mkdirSync(dir, { recursive: true });
   const tmp = target + ".tmp";
-  fs30.writeFileSync(tmp, JSON.stringify(wm, null, 2) + "\n", "utf-8");
-  fs30.renameSync(tmp, target);
+  fs31.writeFileSync(tmp, JSON.stringify(wm, null, 2) + "\n", "utf-8");
+  fs31.renameSync(tmp, target);
 }
 function listJsonlFiles() {
   const root = PROJECTS_DIR();
-  if (!fs30.existsSync(root)) return [];
+  if (!fs31.existsSync(root)) return [];
   const out = [];
-  for (const entry of fs30.readdirSync(root, { withFileTypes: true })) {
+  for (const entry of fs31.readdirSync(root, { withFileTypes: true })) {
     if (!entry.isDirectory()) continue;
     const projectDir = path31.join(root, entry.name);
     let inner;
     try {
-      inner = fs30.readdirSync(projectDir, { withFileTypes: true });
+      inner = fs31.readdirSync(projectDir, { withFileTypes: true });
     } catch {
       continue;
     }
@@ -15825,7 +16284,7 @@ function listJsonlFiles() {
 }
 function fileSize(p) {
   try {
-    return fs30.statSync(p).size;
+    return fs31.statSync(p).size;
   } catch {
     return 0;
   }
@@ -15835,7 +16294,7 @@ async function scanDelta(filePath, fromByte, onLine) {
   if (size <= fromByte) return fromByte;
   const lastNl = findLastNewline(filePath, fromByte, size);
   const endsWithNewline = lastNl === size - 1;
-  const stream = fs30.createReadStream(filePath, {
+  const stream = fs31.createReadStream(filePath, {
     start: fromByte,
     end: size - 1,
     highWaterMark: 64 * 1024
@@ -15864,7 +16323,7 @@ function findLastNewline(filePath, from, size) {
   const CHUNK = 64 * 1024;
   let fd;
   try {
-    fd = fs30.openSync(filePath, "r");
+    fd = fs31.openSync(filePath, "r");
   } catch {
     return -1;
   }
@@ -15873,7 +16332,7 @@ function findLastNewline(filePath, from, size) {
     let end = size;
     while (end > from) {
       const start = Math.max(from, end - CHUNK);
-      const n = fs30.readSync(fd, buf, 0, end - start, start);
+      const n = fs31.readSync(fd, buf, 0, end - start, start);
       const idx = buf.subarray(0, n).lastIndexOf(10);
       if (idx !== -1) return start + idx;
       end = start;
@@ -15882,7 +16341,7 @@ function findLastNewline(filePath, from, size) {
   } catch {
     return -1;
   } finally {
-    fs30.closeSync(fd);
+    fs31.closeSync(fd);
   }
 }
 function safeCanaryCtxValues() {
@@ -16047,7 +16506,7 @@ function emptyTick(uploadAs) {
 function readRawWatermarkPreservingOffsets() {
   let raw;
   try {
-    raw = fs30.readFileSync(WATERMARK_FILE(), "utf-8");
+    raw = fs31.readFileSync(WATERMARK_FILE(), "utf-8");
   } catch {
     return null;
   }
@@ -16082,7 +16541,7 @@ async function runActualTick(wm) {
     if (!known) {
       let mtimeMs = 0;
       try {
-        mtimeMs = fs30.statSync(filePath).mtime.getTime();
+        mtimeMs = fs31.statSync(filePath).mtime.getTime();
       } catch {
         continue;
       }
@@ -16141,8 +16600,8 @@ var init_scan_watermark = __esm({
     init_registry();
     init_config();
     init_dist();
-    PROJECTS_DIR = () => path31.join(os26.homedir(), ".claude", "projects");
-    WATERMARK_FILE = () => path31.join(os26.homedir(), ".node9", "scan-watermark.json");
+    PROJECTS_DIR = () => path31.join(os27.homedir(), ".claude", "projects");
+    WATERMARK_FILE = () => path31.join(os27.homedir(), ".node9", "scan-watermark.json");
     MAX_LINE_BYTES = 2 * 1024 * 1024;
     WATERMARK_SCHEMA_VERSION = 2;
     LONG_OUTPUT_THRESHOLD_BYTES2 = LONG_OUTPUT_THRESHOLD_BYTES;
@@ -16158,9 +16617,9 @@ __export(scan_upload_history_exports, {
   parseSinceCutoff: () => parseSinceCutoff,
   runUploadHistory: () => runUploadHistory
 });
-import fs31 from "fs";
+import fs32 from "fs";
 import https from "https";
-import os27 from "os";
+import os28 from "os";
 import path32 from "path";
 import chalk5 from "chalk";
 function emptySignals2() {
@@ -16196,10 +16655,10 @@ function parseSinceCutoff(raw, now = /* @__PURE__ */ new Date()) {
   return now.getTime() - 90 * 864e5;
 }
 function* iterateJsonlFiles(cutoffMs) {
-  const projectsDir = path32.join(os27.homedir(), ".claude", "projects");
+  const projectsDir = path32.join(os28.homedir(), ".claude", "projects");
   let dirs;
   try {
-    dirs = fs31.readdirSync(projectsDir);
+    dirs = fs32.readdirSync(projectsDir);
   } catch {
     return;
   }
@@ -16207,14 +16666,14 @@ function* iterateJsonlFiles(cutoffMs) {
     const dirPath = path32.join(projectsDir, dir);
     let stats;
     try {
-      stats = fs31.statSync(dirPath);
+      stats = fs32.statSync(dirPath);
     } catch {
       continue;
     }
     if (!stats.isDirectory()) continue;
     let files;
     try {
-      files = fs31.readdirSync(dirPath).filter((f) => f.endsWith(".jsonl"));
+      files = fs32.readdirSync(dirPath).filter((f) => f.endsWith(".jsonl"));
     } catch {
       continue;
     }
@@ -16222,7 +16681,7 @@ function* iterateJsonlFiles(cutoffMs) {
       const filePath = path32.join(dirPath, file);
       let mtime = 0;
       try {
-        mtime = fs31.statSync(filePath).mtimeMs;
+        mtime = fs32.statSync(filePath).mtimeMs;
       } catch {
         continue;
       }
@@ -16297,7 +16756,7 @@ async function runUploadHistory(opts) {
     filesScanned++;
     let content;
     try {
-      content = fs31.readFileSync(filePath, "utf8");
+      content = fs32.readFileSync(filePath, "utf8");
     } catch {
       continue;
     }
@@ -16371,10 +16830,10 @@ async function runUploadHistory(opts) {
     const costUrl = creds.apiUrl.endsWith("/policies/sync") ? creds.apiUrl.replace(/\/policies\/sync$/, "/cost-sync") : `${creds.apiUrl.replace(/\/$/, "")}/cost-sync`;
     let username = "unknown";
     try {
-      username = os27.userInfo().username;
+      username = os28.userInfo().username;
     } catch {
     }
-    const machineId = `${os27.hostname()}:${username}`;
+    const machineId = `${os28.hostname()}:${username}`;
     await postJson(costUrl, creds.apiKey, {
       machineId,
       entries: dailyEntries
@@ -16448,9 +16907,9 @@ var init_scan_upload_history = __esm({
 
 // src/cli/commands/scan.ts
 import chalk6 from "chalk";
-import fs32 from "fs";
+import fs33 from "fs";
 import path33 from "path";
-import os28 from "os";
+import os29 from "os";
 import stringWidth2 from "string-width";
 function claudeModelPrice(model) {
   const t = pricingFor(model);
@@ -16538,7 +16997,7 @@ function findingKey(ruleName, inputPreview, projLabel) {
   return `${ruleName ?? "<unnamed>"}|${inputPreview}|${projLabel}`;
 }
 function displayHome(p) {
-  const home = os28.homedir();
+  const home = os29.homedir();
   return p.startsWith(home) ? "~" + p.slice(home.length) : p;
 }
 function dlpKey(patternName, redactedSample, projLabel) {
@@ -16735,14 +17194,14 @@ function buildRuleSources() {
 }
 function countScanFiles() {
   let total = 0;
-  const claudeDir = path33.join(os28.homedir(), ".claude", "projects");
-  if (fs32.existsSync(claudeDir)) {
+  const claudeDir = path33.join(os29.homedir(), ".claude", "projects");
+  if (fs33.existsSync(claudeDir)) {
     try {
-      for (const proj of fs32.readdirSync(claudeDir)) {
+      for (const proj of fs33.readdirSync(claudeDir)) {
         const p = path33.join(claudeDir, proj);
         try {
-          if (!fs32.statSync(p).isDirectory()) continue;
-          total += fs32.readdirSync(p).filter((f) => f.endsWith(".jsonl") && !f.startsWith("agent-")).length;
+          if (!fs33.statSync(p).isDirectory()) continue;
+          total += fs33.readdirSync(p).filter((f) => f.endsWith(".jsonl") && !f.startsWith("agent-")).length;
         } catch {
           continue;
         }
@@ -16750,17 +17209,17 @@ function countScanFiles() {
     } catch {
     }
   }
-  const geminiDir = path33.join(os28.homedir(), ".gemini", "tmp");
-  if (fs32.existsSync(geminiDir)) {
+  const geminiDir = path33.join(os29.homedir(), ".gemini", "tmp");
+  if (fs33.existsSync(geminiDir)) {
     try {
-      for (const slug2 of fs32.readdirSync(geminiDir)) {
+      for (const slug2 of fs33.readdirSync(geminiDir)) {
         const p = path33.join(geminiDir, slug2);
         try {
-          if (!fs32.statSync(p).isDirectory()) continue;
+          if (!fs33.statSync(p).isDirectory()) continue;
           const chatsDir = path33.join(p, "chats");
-          if (fs32.existsSync(chatsDir)) {
+          if (fs33.existsSync(chatsDir)) {
             try {
-              total += fs32.readdirSync(chatsDir).filter((f) => f.endsWith(".json")).length;
+              total += fs33.readdirSync(chatsDir).filter((f) => f.endsWith(".json")).length;
             } catch {
             }
           }
@@ -16772,15 +17231,15 @@ function countScanFiles() {
     }
   }
   for (const surface of ["antigravity-cli", "antigravity-ide"]) {
-    const brainDir = path33.join(os28.homedir(), ".gemini", surface, "brain");
-    if (!fs32.existsSync(brainDir)) continue;
+    const brainDir = path33.join(os29.homedir(), ".gemini", surface, "brain");
+    if (!fs33.existsSync(brainDir)) continue;
     try {
-      for (const conv of fs32.readdirSync(brainDir)) {
+      for (const conv of fs33.readdirSync(brainDir)) {
         const convPath = path33.join(brainDir, conv);
         try {
-          if (!fs32.statSync(convPath).isDirectory()) continue;
+          if (!fs33.statSync(convPath).isDirectory()) continue;
           const logsDir = path33.join(convPath, ".system_generated", "logs");
-          if (fs32.existsSync(path33.join(logsDir, "transcript_full.jsonl")) || fs32.existsSync(path33.join(logsDir, "transcript.jsonl"))) {
+          if (fs33.existsSync(path33.join(logsDir, "transcript_full.jsonl")) || fs33.existsSync(path33.join(logsDir, "transcript.jsonl"))) {
             total += 1;
           }
         } catch {
@@ -16790,11 +17249,11 @@ function countScanFiles() {
     } catch {
     }
   }
-  const copilotDir = path33.join(os28.homedir(), ".copilot", "session-state");
-  if (fs32.existsSync(copilotDir)) {
+  const copilotDir = path33.join(os29.homedir(), ".copilot", "session-state");
+  if (fs33.existsSync(copilotDir)) {
     try {
-      for (const sid of fs32.readdirSync(copilotDir)) {
-        if (fs32.existsSync(path33.join(copilotDir, sid, "events.jsonl"))) total += 1;
+      for (const sid of fs33.readdirSync(copilotDir)) {
+        if (fs33.existsSync(path33.join(copilotDir, sid, "events.jsonl"))) total += 1;
       }
     } catch {
     }
@@ -16821,7 +17280,7 @@ function processClaudeFile(file, projPath, projLabel, ruleSources, startDate, re
   const session = { sessionId, costUSD: 0, toolCalls: 0 };
   let raw;
   try {
-    raw = fs32.readFileSync(path33.join(projPath, file), "utf-8");
+    raw = fs33.readFileSync(path33.join(projPath, file), "utf-8");
   } catch {
     return;
   }
@@ -17065,11 +17524,11 @@ function processClaudeFile(file, projPath, projLabel, ruleSources, startDate, re
 function processClaudeProject(proj, projectsDir, ruleSources, startDate, result, dedup, canaryVals, onProgress, onLine) {
   const projPath = path33.join(projectsDir, proj);
   try {
-    if (!fs32.statSync(projPath).isDirectory()) return;
+    if (!fs33.statSync(projPath).isDirectory()) return;
   } catch {
     return;
   }
-  const projLabel = stripTerminalEscapes(decodeURIComponent(proj).replace(os28.homedir(), "~")).slice(
+  const projLabel = stripTerminalEscapes(decodeURIComponent(proj).replace(os29.homedir(), "~")).slice(
     0,
     40
   );
@@ -17112,12 +17571,12 @@ function emptyClaudeScan() {
   };
 }
 function scanClaudeHistory(startDate, onProgress, onLine) {
-  const projectsDir = path33.join(os28.homedir(), ".claude", "projects");
+  const projectsDir = path33.join(os29.homedir(), ".claude", "projects");
   const result = emptyClaudeScan();
-  if (!fs32.existsSync(projectsDir)) return result;
+  if (!fs33.existsSync(projectsDir)) return result;
   let projDirs;
   try {
-    projDirs = fs32.readdirSync(projectsDir);
+    projDirs = fs33.readdirSync(projectsDir);
   } catch {
     return result;
   }
@@ -17141,7 +17600,7 @@ function scanClaudeHistory(startDate, onProgress, onLine) {
 }
 function scanGeminiHistory(startDate, onProgress, onLine) {
   const canaryVals = safeCanaryScanValues();
-  const tmpDir = path33.join(os28.homedir(), ".gemini", "tmp");
+  const tmpDir = path33.join(os29.homedir(), ".gemini", "tmp");
   const result = {
     filesScanned: 0,
     sessions: 0,
@@ -17158,10 +17617,10 @@ function scanGeminiHistory(startDate, onProgress, onLine) {
     perSession: []
   };
   const dedup = emptyScanDedup();
-  if (!fs32.existsSync(tmpDir)) return result;
+  if (!fs33.existsSync(tmpDir)) return result;
   let slugDirs;
   try {
-    slugDirs = fs32.readdirSync(tmpDir);
+    slugDirs = fs33.readdirSync(tmpDir);
   } catch {
     return result;
   }
@@ -17169,22 +17628,22 @@ function scanGeminiHistory(startDate, onProgress, onLine) {
   for (const slug2 of slugDirs) {
     const slugPath = path33.join(tmpDir, slug2);
     try {
-      if (!fs32.statSync(slugPath).isDirectory()) continue;
+      if (!fs33.statSync(slugPath).isDirectory()) continue;
     } catch {
       continue;
     }
     let projLabel = stripTerminalEscapes(slug2).slice(0, 40);
     try {
       projLabel = stripTerminalEscapes(
-        fs32.readFileSync(path33.join(slugPath, ".project_root"), "utf-8").trim()
-      ).replace(os28.homedir(), "~").slice(0, 40);
+        fs33.readFileSync(path33.join(slugPath, ".project_root"), "utf-8").trim()
+      ).replace(os29.homedir(), "~").slice(0, 40);
     } catch {
     }
     const chatsDir = path33.join(slugPath, "chats");
-    if (!fs32.existsSync(chatsDir)) continue;
+    if (!fs33.existsSync(chatsDir)) continue;
     let chatFiles;
     try {
-      chatFiles = fs32.readdirSync(chatsDir).filter((f) => f.endsWith(".json") || f.endsWith(".jsonl")).sort((a, b) => Number(b.endsWith(".jsonl")) - Number(a.endsWith(".jsonl")));
+      chatFiles = fs33.readdirSync(chatsDir).filter((f) => f.endsWith(".json") || f.endsWith(".jsonl")).sort((a, b) => Number(b.endsWith(".jsonl")) - Number(a.endsWith(".jsonl")));
     } catch {
       continue;
     }
@@ -17197,7 +17656,7 @@ function scanGeminiHistory(startDate, onProgress, onLine) {
       onProgress?.(result.filesScanned);
       let raw;
       try {
-        raw = fs32.readFileSync(path33.join(chatsDir, chatFile), "utf-8");
+        raw = fs33.readFileSync(path33.join(chatsDir, chatFile), "utf-8");
       } catch {
         continue;
       }
@@ -17392,13 +17851,13 @@ function scanGeminiHistory(startDate, onProgress, onLine) {
   return result;
 }
 function antigravityBrainDirs() {
-  return ["antigravity-cli", "antigravity-ide"].map((surface) => path33.join(os28.homedir(), ".gemini", surface, "brain")).filter((p) => fs32.existsSync(p));
+  return ["antigravity-cli", "antigravity-ide"].map((surface) => path33.join(os29.homedir(), ".gemini", surface, "brain")).filter((p) => fs33.existsSync(p));
 }
 function antigravityTranscriptPath(convPath) {
   const logsDir = path33.join(convPath, ".system_generated", "logs");
   for (const name of ["transcript_full.jsonl", "transcript.jsonl"]) {
     const p = path33.join(logsDir, name);
-    if (fs32.existsSync(p)) return p;
+    if (fs33.existsSync(p)) return p;
   }
   return null;
 }
@@ -17427,14 +17886,14 @@ function scanAntigravityHistory(startDate, onProgress, onLine) {
   for (const brainDir of brainDirs) {
     let convDirs;
     try {
-      convDirs = fs32.readdirSync(brainDir);
+      convDirs = fs33.readdirSync(brainDir);
     } catch {
       continue;
     }
     for (const conv of convDirs) {
       const convPath = path33.join(brainDir, conv);
       try {
-        if (!fs32.statSync(convPath).isDirectory()) continue;
+        if (!fs33.statSync(convPath).isDirectory()) continue;
       } catch {
         continue;
       }
@@ -17444,7 +17903,7 @@ function scanAntigravityHistory(startDate, onProgress, onLine) {
       onProgress?.(result.filesScanned);
       let raw;
       try {
-        raw = fs32.readFileSync(transcriptFile, "utf-8");
+        raw = fs33.readFileSync(transcriptFile, "utf-8");
       } catch {
         continue;
       }
@@ -17512,7 +17971,7 @@ function scanAntigravityHistory(startDate, onProgress, onLine) {
             result.bashCalls++;
             const cwd = String(input.cwd ?? "");
             if (cwd && projLabel === conv.slice(0, 8)) {
-              projLabel = stripTerminalEscapes(cwd).replace(os28.homedir(), "~").slice(0, 40);
+              projLabel = stripTerminalEscapes(cwd).replace(os29.homedir(), "~").slice(0, 40);
             }
           }
           const rawCmd = String(input.command ?? "").trimStart();
@@ -17624,7 +18083,7 @@ function scanAntigravityHistory(startDate, onProgress, onLine) {
 }
 function scanCopilotHistory(startDate, onProgress, onLine) {
   const canaryVals = safeCanaryScanValues();
-  const sessionDir = path33.join(os28.homedir(), ".copilot", "session-state");
+  const sessionDir = path33.join(os29.homedir(), ".copilot", "session-state");
   const result = {
     filesScanned: 0,
     sessions: 0,
@@ -17642,22 +18101,22 @@ function scanCopilotHistory(startDate, onProgress, onLine) {
     perSession: []
   };
   const dedup = emptyScanDedup();
-  if (!fs32.existsSync(sessionDir)) return result;
+  if (!fs33.existsSync(sessionDir)) return result;
   let sessionIds;
   try {
-    sessionIds = fs32.readdirSync(sessionDir);
+    sessionIds = fs33.readdirSync(sessionDir);
   } catch {
     return result;
   }
   const ruleSources = buildRuleSources();
   for (const sessionId of sessionIds) {
     const eventsPath = path33.join(sessionDir, sessionId, "events.jsonl");
-    if (!fs32.existsSync(eventsPath)) continue;
+    if (!fs33.existsSync(eventsPath)) continue;
     result.filesScanned++;
     onProgress?.(result.filesScanned);
     let raw;
     try {
-      raw = fs32.readFileSync(eventsPath, "utf-8");
+      raw = fs33.readFileSync(eventsPath, "utf-8");
     } catch {
       continue;
     }
@@ -17681,7 +18140,7 @@ function scanCopilotHistory(startDate, onProgress, onLine) {
       if (ev.type === "session.start") {
         const cwd = ev.data?.context?.cwd;
         if (typeof cwd === "string" && cwd) {
-          projLabel = stripTerminalEscapes(cwd).replace(os28.homedir(), "~").slice(0, 40);
+          projLabel = stripTerminalEscapes(cwd).replace(os29.homedir(), "~").slice(0, 40);
         }
         continue;
       }
@@ -17859,7 +18318,7 @@ function scanCodexHistory(startDate, onProgress, onLine) {
     onProgress?.(result.filesScanned);
     let lines;
     try {
-      lines = fs32.readFileSync(filePath, "utf-8").split("\n");
+      lines = fs33.readFileSync(filePath, "utf-8").split("\n");
     } catch {
       continue;
     }
@@ -17882,7 +18341,7 @@ function scanCodexHistory(startDate, onProgress, onLine) {
         sessionId = String(payload["id"] ?? filePath);
         startTime = String(payload["timestamp"] ?? "");
         const cwd = String(payload["cwd"] ?? "");
-        projLabel = stripTerminalEscapes(cwd.replace(os28.homedir(), "~")).slice(0, 40);
+        projLabel = stripTerminalEscapes(cwd.replace(os29.homedir(), "~")).slice(0, 40);
         continue;
       }
       if (entry.type === "event_msg" && payload["type"] === "user_message") {
@@ -18049,17 +18508,17 @@ function scanCodexHistory(startDate, onProgress, onLine) {
   return result;
 }
 function scanShellConfig() {
-  const home = os28.homedir();
+  const home = os29.homedir();
   const configFiles = [".zshrc", ".bashrc", ".bash_profile", ".profile"].map(
     (f) => path33.join(home, f)
   );
   const findings = [];
   const seen = /* @__PURE__ */ new Set();
   for (const filePath of configFiles) {
-    if (!fs32.existsSync(filePath)) continue;
+    if (!fs33.existsSync(filePath)) continue;
     let lines;
     try {
-      lines = fs32.readFileSync(filePath, "utf-8").split("\n");
+      lines = fs33.readFileSync(filePath, "utf-8").split("\n");
     } catch {
       continue;
     }
@@ -19289,12 +19748,12 @@ var init_scan = __esm({
 });
 
 // src/daemon/build-id.ts
-import fs33 from "fs";
+import fs34 from "fs";
 import path34 from "path";
 function readOwnVersion() {
   for (const rel of ["../package.json", "../../package.json"]) {
     try {
-      const raw = fs33.readFileSync(path34.join(__dirname, rel), "utf-8");
+      const raw = fs34.readFileSync(path34.join(__dirname, rel), "utf-8");
       const v = JSON.parse(raw).version;
       if (typeof v === "string" && v.length > 0) return v;
     } catch {
@@ -19305,7 +19764,7 @@ function readOwnVersion() {
 function computeBuildId(entry = process.argv[1] ?? "") {
   let mtimeMs = 0;
   try {
-    if (entry) mtimeMs = fs33.statSync(entry).mtimeMs;
+    if (entry) mtimeMs = fs34.statSync(entry).mtimeMs;
   } catch {
   }
   return { version: readOwnVersion(), mtimeMs };
@@ -19446,7 +19905,7 @@ var init_suggestion_tracker = __esm({
 });
 
 // src/daemon/taint-store.ts
-import fs34 from "fs";
+import fs35 from "fs";
 import path35 from "path";
 var DEFAULT_TTL_MS, TaintStore, SESSION_TAINT_TTL_MS, SessionTaintStore;
 var init_taint_store = __esm({
@@ -19517,7 +19976,7 @@ var init_taint_store = __esm({
       /** Resolve to absolute path, falling back to path.resolve if file doesn't exist yet. */
       _resolve(filePath) {
         try {
-          return fs34.realpathSync.native(path35.resolve(filePath));
+          return fs35.realpathSync.native(path35.resolve(filePath));
         } catch {
           return path35.resolve(filePath);
         }
@@ -19684,14 +20143,14 @@ var init_session_history = __esm({
 
 // src/daemon/state.ts
 import net2 from "net";
-import fs35 from "fs";
+import fs36 from "fs";
 import path36 from "path";
-import os29 from "os";
+import os30 from "os";
 import { randomUUID as randomUUID5 } from "crypto";
 function loadInsightCounts() {
   try {
-    if (!fs35.existsSync(INSIGHT_COUNTS_FILE)) return;
-    const data = JSON.parse(fs35.readFileSync(INSIGHT_COUNTS_FILE, "utf-8"));
+    if (!fs36.existsSync(INSIGHT_COUNTS_FILE)) return;
+    const data = JSON.parse(fs36.readFileSync(INSIGHT_COUNTS_FILE, "utf-8"));
     for (const [tool, count] of Object.entries(data)) {
       if (typeof count === "number" && count > 0) insightCounts.set(tool, count);
     }
@@ -19748,15 +20207,15 @@ function appendAuditLog(data) {
       source: "daemon"
     };
     const dir = path36.dirname(AUDIT_LOG_FILE);
-    if (!fs35.existsSync(dir)) fs35.mkdirSync(dir, { recursive: true });
-    fs35.appendFileSync(AUDIT_LOG_FILE, JSON.stringify(entry) + "\n");
+    if (!fs36.existsSync(dir)) fs36.mkdirSync(dir, { recursive: true });
+    fs36.appendFileSync(AUDIT_LOG_FILE, JSON.stringify(entry) + "\n");
   } catch {
   }
 }
 function getAuditHistory(limit = 20) {
   try {
-    if (!fs35.existsSync(AUDIT_LOG_FILE)) return [];
-    const lines = fs35.readFileSync(AUDIT_LOG_FILE, "utf-8").trim().split("\n");
+    if (!fs36.existsSync(AUDIT_LOG_FILE)) return [];
+    const lines = fs36.readFileSync(AUDIT_LOG_FILE, "utf-8").trim().split("\n");
     if (lines.length === 1 && lines[0] === "") return [];
     return lines.slice(-limit).map((l) => JSON.parse(l)).reverse();
   } catch {
@@ -19765,7 +20224,7 @@ function getAuditHistory(limit = 20) {
 }
 function getOrgName() {
   try {
-    if (fs35.existsSync(CREDENTIALS_FILE)) return "Node9 Cloud";
+    if (fs36.existsSync(CREDENTIALS_FILE)) return "Node9 Cloud";
   } catch {
   }
   return null;
@@ -19773,8 +20232,8 @@ function getOrgName() {
 function writeGlobalSetting(key, value) {
   let config = {};
   try {
-    if (fs35.existsSync(GLOBAL_CONFIG_FILE)) {
-      config = JSON.parse(fs35.readFileSync(GLOBAL_CONFIG_FILE, "utf-8"));
+    if (fs36.existsSync(GLOBAL_CONFIG_FILE)) {
+      config = JSON.parse(fs36.readFileSync(GLOBAL_CONFIG_FILE, "utf-8"));
     }
   } catch {
   }
@@ -19786,8 +20245,8 @@ function writeTrustEntry(toolName, durationMs, commandPattern) {
   try {
     let trust = { entries: [] };
     try {
-      if (fs35.existsSync(TRUST_FILE2))
-        trust = JSON.parse(fs35.readFileSync(TRUST_FILE2, "utf-8"));
+      if (fs36.existsSync(TRUST_FILE2))
+        trust = JSON.parse(fs36.readFileSync(TRUST_FILE2, "utf-8"));
     } catch {
     }
     trust.entries = trust.entries.filter(
@@ -19804,8 +20263,8 @@ function writeTrustEntry(toolName, durationMs, commandPattern) {
 }
 function readPersistentDecisions() {
   try {
-    if (fs35.existsSync(DECISIONS_FILE)) {
-      return JSON.parse(fs35.readFileSync(DECISIONS_FILE, "utf-8"));
+    if (fs36.existsSync(DECISIONS_FILE)) {
+      return JSON.parse(fs36.readFileSync(DECISIONS_FILE, "utf-8"));
     }
   } catch {
   }
@@ -19833,7 +20292,7 @@ function estimateToolCost(tool, args) {
     const filePath = a.file_path ?? a.path;
     if (filePath) {
       try {
-        const bytes = fs35.statSync(filePath).size;
+        const bytes = fs36.statSync(filePath).size;
         return bytes / BYTES_PER_TOKEN / 1e6 * INPUT_PRICE_PER_1M;
       } catch {
       }
@@ -19907,7 +20366,7 @@ function abandonPending() {
   });
   if (autoStarted) {
     try {
-      fs35.unlinkSync(DAEMON_PID_FILE);
+      fs36.unlinkSync(DAEMON_PID_FILE);
     } catch {
     }
     setTimeout(() => {
@@ -19918,7 +20377,7 @@ function abandonPending() {
 }
 function logActivitySocket(msg) {
   try {
-    fs35.appendFileSync(
+    fs36.appendFileSync(
       path36.join(homeDir, ".node9", "hook-debug.log"),
       `[${(/* @__PURE__ */ new Date()).toISOString()}] [activity-socket] ${msg}
 `
@@ -19941,13 +20400,13 @@ function shouldRebind(now = Date.now()) {
 function startActivitySocket() {
   bindActivitySocket();
   activityHealthInterval = setInterval(() => {
-    if (!fs35.existsSync(ACTIVITY_SOCKET_PATH2)) attemptRebind("health-probe");
+    if (!fs36.existsSync(ACTIVITY_SOCKET_PATH2)) attemptRebind("health-probe");
   }, ACTIVITY_HEALTH_PROBE_MS);
   activityHealthInterval.unref();
   process.on("exit", () => {
     if (activityHealthInterval) clearInterval(activityHealthInterval);
     try {
-      fs35.unlinkSync(ACTIVITY_SOCKET_PATH2);
+      fs36.unlinkSync(ACTIVITY_SOCKET_PATH2);
     } catch {
     }
   });
@@ -19975,7 +20434,7 @@ function attemptRebind(reason) {
 }
 function bindActivitySocket() {
   try {
-    fs35.unlinkSync(ACTIVITY_SOCKET_PATH2);
+    fs36.unlinkSync(ACTIVITY_SOCKET_PATH2);
   } catch {
   }
   const ACTIVITY_MAX_BYTES = 1024 * 1024;
@@ -20079,7 +20538,7 @@ var init_state2 = __esm({
     init_session_counters();
     init_session_history();
     init_atomic_write();
-    homeDir = os29.homedir();
+    homeDir = os30.homedir();
     DAEMON_PID_FILE = path36.join(homeDir, ".node9", "daemon.pid");
     DECISIONS_FILE = path36.join(homeDir, ".node9", "decisions.json");
     AUDIT_LOG_FILE = path36.join(homeDir, ".node9", "audit.log");
@@ -20104,7 +20563,7 @@ var init_state2 = __esm({
       "2h": 2 * 60 * 6e4
     };
     autoStarted = process.env.NODE9_AUTO_STARTED === "1";
-    ACTIVITY_SOCKET_PATH2 = process.platform === "win32" ? "\\\\.\\pipe\\node9-activity" : path36.join(os29.tmpdir(), "node9-activity.sock");
+    ACTIVITY_SOCKET_PATH2 = process.platform === "win32" ? "\\\\.\\pipe\\node9-activity" : path36.join(os30.tmpdir(), "node9-activity.sock");
     ACTIVITY_RING_SIZE = 100;
     activityRing = [];
     LARGE_RESPONSE_RING_SIZE = 20;
@@ -20143,9 +20602,9 @@ var init_state2 = __esm({
 });
 
 // src/posture/secrets.ts
-import fs36 from "fs";
+import fs37 from "fs";
 import path37 from "path";
-import os30 from "os";
+import os31 from "os";
 function displayPath(p, home) {
   if (p === home) return "~";
   const prefix = home.endsWith(path37.sep) ? home : home + path37.sep;
@@ -20160,7 +20619,7 @@ function safeRead(file) {
 function candidateFiles(home, cwd) {
   const files = /* @__PURE__ */ new Set();
   try {
-    for (const name of fs36.readdirSync(cwd)) {
+    for (const name of fs37.readdirSync(cwd)) {
       if (name === ".env" || name.startsWith(".env.")) files.add(path37.join(cwd, name));
     }
   } catch {
@@ -20190,7 +20649,7 @@ function plantedDecoyPaths() {
   }
 }
 function checkSecrets(ctx) {
-  const home = ctx.home || os30.homedir();
+  const home = ctx.home || os31.homedir();
   const findings = [];
   const planted = plantedDecoyPaths();
   const plaintext = [];
@@ -20226,7 +20685,7 @@ function checkSecrets(ctx) {
   for (const file of credentialMaterial(home)) {
     if (planted.has(file)) continue;
     try {
-      if (fs36.statSync(file).isFile()) {
+      if (fs37.statSync(file).isFile()) {
         creds.push(displayPath(file, home));
         credPaths.push(file);
       }
@@ -20395,10 +20854,10 @@ var init_templates = __esm({
 });
 
 // src/posture/egress.ts
-import fs37 from "fs";
+import fs38 from "fs";
 function sandboxEgressWallActive() {
   try {
-    return fs37.existsSync(ALLOWED_DOMAINS_PATH);
+    return fs38.existsSync(ALLOWED_DOMAINS_PATH);
   } catch {
     return false;
   }
@@ -20568,9 +21027,9 @@ var init_gate = __esm({
 });
 
 // src/posture/supply-chain.ts
-import os31 from "os";
+import os32 from "os";
 import path38 from "path";
-import { parse as parseToml4 } from "smol-toml";
+import { parse as parseToml5 } from "smol-toml";
 function isNode9Managed(command, args = []) {
   if (!command) return false;
   if (path38.basename(command).toLowerCase() === "node9") return true;
@@ -20584,7 +21043,7 @@ function readServers(file, format, agent) {
     const capped = readCappedText(file, MAX_CONFIG_BYTES);
     if (!capped || capped.truncated) return [];
     const text = capped.text;
-    const map = format === "toml" ? parseToml4(text)?.mcp_servers : JSON.parse(text)?.mcpServers;
+    const map = format === "toml" ? parseToml5(text)?.mcp_servers : JSON.parse(text)?.mcpServers;
     if (!map || typeof map !== "object") return [];
     return Object.entries(map).map(([name, v]) => ({
       name,
@@ -20597,7 +21056,7 @@ function readServers(file, format, agent) {
   }
 }
 function checkSupplyChain(ctx) {
-  const home = ctx.home || os31.homedir();
+  const home = ctx.home || os32.homedir();
   const servers = [];
   for (const spec of AGENT_SPECS) {
     if (!spec.mcpFile) continue;
@@ -20696,11 +21155,11 @@ var init_privilege = __esm({
 });
 
 // src/posture/containment.ts
-import fs38 from "fs";
+import fs39 from "fs";
 function inContainer() {
-  if (fs38.existsSync("/.dockerenv") || fs38.existsSync("/run/.containerenv")) return true;
+  if (fs39.existsSync("/.dockerenv") || fs39.existsSync("/run/.containerenv")) return true;
   try {
-    const cgroup = fs38.readFileSync("/proc/1/cgroup", "utf8");
+    const cgroup = fs39.readFileSync("/proc/1/cgroup", "utf8");
     if (/docker|kubepods|containerd|lxc|libpod/.test(cgroup)) return true;
   } catch {
   }
@@ -20746,7 +21205,7 @@ var init_containment = __esm({
 });
 
 // src/posture/inbound.ts
-import fs39 from "fs";
+import fs40 from "fs";
 function buildNetworkFix(labels) {
   const shielded = [
     ...new Map(
@@ -20804,7 +21263,7 @@ function collectListeners() {
   const byPort = /* @__PURE__ */ new Map();
   for (const file of ["/proc/net/tcp", "/proc/net/tcp6"]) {
     try {
-      for (const l of parseListeners(fs39.readFileSync(file, "utf8"))) {
+      for (const l of parseListeners(fs40.readFileSync(file, "utf8"))) {
         if (!byPort.has(l.port)) byPort.set(l.port, l);
       }
     } catch {
@@ -20816,11 +21275,11 @@ function readProc(pid) {
   let comm = "unknown";
   let cmdline = "";
   try {
-    comm = fs39.readFileSync(`/proc/${pid}/comm`, "utf8").trim().replace(/-MainThread$/, "") || "unknown";
+    comm = fs40.readFileSync(`/proc/${pid}/comm`, "utf8").trim().replace(/-MainThread$/, "") || "unknown";
   } catch {
   }
   try {
-    cmdline = fs39.readFileSync(`/proc/${pid}/cmdline`).toString().replace(/\0/g, " ").trim();
+    cmdline = fs40.readFileSync(`/proc/${pid}/cmdline`).toString().replace(/\0/g, " ").trim();
   } catch {
   }
   return { comm, cmdline };
@@ -20830,21 +21289,21 @@ function resolveProcesses(inodes) {
   if (inodes.size === 0) return map;
   let pids;
   try {
-    pids = fs39.readdirSync("/proc").filter((d) => /^\d+$/.test(d));
+    pids = fs40.readdirSync("/proc").filter((d) => /^\d+$/.test(d));
   } catch {
     return map;
   }
   for (const pid of pids) {
     let fds;
     try {
-      fds = fs39.readdirSync(`/proc/${pid}/fd`);
+      fds = fs40.readdirSync(`/proc/${pid}/fd`);
     } catch {
       continue;
     }
     for (const fd of fds) {
       let link;
       try {
-        link = fs39.readlinkSync(`/proc/${pid}/fd/${fd}`);
+        link = fs40.readlinkSync(`/proc/${pid}/fd/${fd}`);
       } catch {
         continue;
       }
@@ -20949,9 +21408,9 @@ var init_inbound = __esm({
 });
 
 // src/posture/coverage.ts
-import os32 from "os";
+import os33 from "os";
 function checkCoverage(ctx) {
-  const home = ctx.home || os32.homedir();
+  const home = ctx.home || os33.homedir();
   const findings = [];
   const protectedAgents = getAgentWiring(home).filter((r) => r.isProtected);
   if (protectedAgents.length === 0) {
@@ -21313,7 +21772,7 @@ var init_enforcement = __esm({
 });
 
 // src/posture/index.ts
-import os33 from "os";
+import os34 from "os";
 function dropEnforcementRedundant(findings) {
   const coveragePresent = findings.some((f) => f.category === "Coverage");
   if (!coveragePresent) return findings;
@@ -21339,7 +21798,7 @@ async function runChecks(checks, ctx) {
 }
 async function runPosture(opts = {}) {
   const ctx = {
-    home: opts.home ?? os33.homedir(),
+    home: opts.home ?? os34.homedir(),
     cwd: opts.cwd ?? process.cwd(),
     agent: opts.agent
   };
@@ -21566,53 +22025,10 @@ var init_build2 = __esm({
   }
 });
 
-// src/mcp-cmd.ts
-function tokenize4(cmd) {
-  const tokens = [];
-  let current = "";
-  let inDouble = false;
-  let quoted = false;
-  let i = 0;
-  while (i < cmd.length) {
-    const ch = cmd[i];
-    if (inDouble) {
-      if (ch === '"') inDouble = false;
-      else if (ch === "\\" && i + 1 < cmd.length) current += cmd[++i];
-      else current += ch;
-    } else if (ch === '"') {
-      inDouble = true;
-      quoted = true;
-    } else if (ch === " " || ch === "	") {
-      if (current || quoted) {
-        tokens.push(current);
-        current = "";
-        quoted = false;
-      }
-    } else if (ch === "\\" && i + 1 < cmd.length) {
-      current += cmd[++i];
-    } else {
-      current += ch;
-    }
-    i++;
-  }
-  if (current || quoted && !inDouble) tokens.push(current);
-  return tokens;
-}
-function quoteArg(s) {
-  if (s === "") return '""';
-  if (/[\s"\\]/.test(s)) return `"${s.replace(/(["\\])/g, "\\$1")}"`;
-  return s;
-}
-var init_mcp_cmd = __esm({
-  "src/mcp-cmd.ts"() {
-    "use strict";
-  }
-});
-
 // src/daemon/mcp-tools.ts
-import fs40 from "fs";
+import fs41 from "fs";
 import path40 from "path";
-import os34 from "os";
+import os35 from "os";
 function deriveServerName(cmd) {
   if (!cmd || typeof cmd !== "string") return "MCP Server";
   const strip = (s) => s.replace(/^(mcp-server|server|mcp)-/i, "").replace(/-(mcp-server|server|mcp)$/i, "") || s;
@@ -21638,13 +22054,13 @@ function deriveServerName(cmd) {
   return strip(base) || "MCP Server";
 }
 function getMcpToolsFile() {
-  return path40.join(os34.homedir(), ".node9", "mcp-tools.json");
+  return path40.join(os35.homedir(), ".node9", "mcp-tools.json");
 }
 function readMcpToolsConfig() {
   try {
     const file = getMcpToolsFile();
-    if (!fs40.existsSync(file)) return {};
-    const raw = fs40.readFileSync(file, "utf-8");
+    if (!fs41.existsSync(file)) return {};
+    const raw = fs41.readFileSync(file, "utf-8");
     return JSON.parse(raw);
   } catch {
     return {};
@@ -21654,10 +22070,10 @@ function writeMcpToolsConfig(config) {
   try {
     const file = getMcpToolsFile();
     const dir = path40.dirname(file);
-    if (!fs40.existsSync(dir)) fs40.mkdirSync(dir, { recursive: true });
-    const tmpPath = `${file}.${os34.hostname()}.${process.pid}.tmp`;
-    fs40.writeFileSync(tmpPath, JSON.stringify(config, null, 2));
-    fs40.renameSync(tmpPath, file);
+    if (!fs41.existsSync(dir)) fs41.mkdirSync(dir, { recursive: true });
+    const tmpPath = `${file}.${os35.hostname()}.${process.pid}.tmp`;
+    fs41.writeFileSync(tmpPath, JSON.stringify(config, null, 2));
+    fs41.renameSync(tmpPath, file);
   } catch (e) {
     console.error("Failed to write mcp-tools.json", e);
   }
@@ -21711,109 +22127,6 @@ var init_mcp_tools = __esm({
   }
 });
 
-// src/mcp-wrap.ts
-import fs41 from "fs";
-import os35 from "os";
-import { parse as parseToml5, stringify as stringifyToml2 } from "smol-toml";
-function isNode9Command(command) {
-  return /(^|[\\/])node9(\.(exe|cmd|ps1|bat))?$/i.test(command ?? "");
-}
-function classifyMcp(s) {
-  if (isNode9Command(s.command)) {
-    return (s.args ?? [])[0] === "mcp-gateway" ? "gatewayed" : "node9-self";
-  }
-  if (typeof s.command !== "string" || s.command.trim() === "") return "remote";
-  return "ungoverned";
-}
-function toGateway(s, configName) {
-  const upstream = [s.command ?? "", ...s.args ?? []].map(quoteArg).join(" ");
-  const nameArgs = configName && !configName.startsWith("-") ? ["--config-name", configName] : [];
-  return {
-    ...s,
-    command: "node9",
-    args: ["mcp-gateway", ...nameArgs, "--upstream", upstream]
-  };
-}
-function fromGateway(s) {
-  if (!isNode9Command(s.command) || (s.args ?? [])[0] !== "mcp-gateway") return null;
-  const args = s.args ?? [];
-  const i = args.indexOf("--upstream");
-  if (i < 0 || !args[i + 1]) return null;
-  const [command, ...rest] = tokenize4(args[i + 1]);
-  if (!command) return null;
-  return { ...s, command, args: rest };
-}
-function inventoryMcp(home = os35.homedir()) {
-  const out = [];
-  for (const spec of AGENT_SPECS) {
-    if (!spec.mcpFile) continue;
-    const mcpFile = spec.mcpFile(home);
-    const format = spec.mcpFormat ?? "json";
-    const servers = readMcpServers(mcpFile, format);
-    for (const [name, s] of Object.entries(servers)) {
-      if (!s || typeof s !== "object") continue;
-      out.push({
-        agent: String(spec.id),
-        agentLabel: spec.label,
-        mcpFile,
-        format,
-        name,
-        command: s.command ?? "",
-        args: Array.isArray(s.args) ? s.args : [],
-        state: classifyMcp(s),
-        raw: s
-      });
-    }
-  }
-  return out;
-}
-function inventoryServerKeys(inv) {
-  const keys = /* @__PURE__ */ new Set();
-  for (const e of inv) {
-    if (e.state === "gatewayed") {
-      const i = e.args.indexOf("--upstream");
-      if (i >= 0 && e.args[i + 1]) {
-        keys.add(getServerKey(e.args[i + 1]));
-      }
-    } else if (e.state === "ungoverned") {
-      const cmd = [e.command, ...e.args].map(quoteArg).join(" ");
-      keys.add(getServerKey(cmd));
-    }
-  }
-  return keys;
-}
-function writeMcpEntry(mcpFile, format, name, entry) {
-  const key = format === "toml" ? "mcp_servers" : "mcpServers";
-  let root = {};
-  if (fs41.existsSync(mcpFile)) {
-    const raw = fs41.readFileSync(mcpFile, "utf-8");
-    root = format === "toml" ? parseToml5(raw) : JSON.parse(raw);
-    const bak = `${mcpFile}.node9-bak`;
-    try {
-      fs41.writeFileSync(bak, raw, { mode: 384, flag: "wx" });
-    } catch (e) {
-      if (e.code !== "EEXIST") throw e;
-    }
-  }
-  const existing = root[key];
-  const servers = existing && typeof existing === "object" && !Array.isArray(existing) ? existing : {};
-  servers[name] = entry;
-  root[key] = servers;
-  const serialized = format === "toml" ? stringifyToml2(root) : JSON.stringify(root, null, 2);
-  const tmp = `${mcpFile}.${process.pid}.tmp`;
-  fs41.writeFileSync(tmp, serialized, { mode: 384 });
-  fs41.renameSync(tmp, mcpFile);
-}
-var init_mcp_wrap = __esm({
-  "src/mcp-wrap.ts"() {
-    "use strict";
-    init_agent_wiring();
-    init_mcp_cmd();
-    init_mcp_pin();
-    init_mcp_cmd();
-  }
-});
-
 // src/mcp-status.ts
 function substituteEnv(input, env = process.env) {
   const missing = [];
@@ -52282,20 +52595,20 @@ init_agent_wiring();
 // src/credentials.ts
 init_config();
 init_api_url();
-import * as fs21 from "fs";
-import * as os18 from "os";
+import * as fs22 from "fs";
+import * as os19 from "os";
 import * as path22 from "path";
 function writeCredentialsAndConfig(apiKey, opts = {}) {
   const profileName = opts.profileName || "default";
-  const home = opts.homeDir ?? os18.homedir();
+  const home = opts.homeDir ?? os19.homedir();
   const credPath = path22.join(home, ".node9", "credentials.json");
-  if (!fs21.existsSync(path22.dirname(credPath))) {
-    fs21.mkdirSync(path22.dirname(credPath), { recursive: true });
+  if (!fs22.existsSync(path22.dirname(credPath))) {
+    fs22.mkdirSync(path22.dirname(credPath), { recursive: true });
   }
   let existingCreds = {};
   try {
-    if (fs21.existsSync(credPath)) {
-      const raw = JSON.parse(fs21.readFileSync(credPath, "utf-8"));
+    if (fs22.existsSync(credPath)) {
+      const raw = JSON.parse(fs22.readFileSync(credPath, "utf-8"));
       existingCreds = raw.apiKey ? { default: { apiKey: raw.apiKey, apiUrl: raw.apiUrl || DEFAULT_API_URL } } : raw;
     }
   } catch {
@@ -52305,7 +52618,7 @@ function writeCredentialsAndConfig(apiKey, opts = {}) {
     apiUrl: DEFAULT_API_URL,
     ...opts.isLocal ? { localOnly: true } : {}
   };
-  fs21.writeFileSync(credPath, JSON.stringify(existingCreds, null, 2), {
+  fs22.writeFileSync(credPath, JSON.stringify(existingCreds, null, 2), {
     mode: 384
   });
   let effectiveCloud = null;
@@ -52313,8 +52626,8 @@ function writeCredentialsAndConfig(apiKey, opts = {}) {
     const configPath = path22.join(home, ".node9", "config.json");
     let config = {};
     try {
-      if (fs21.existsSync(configPath)) {
-        config = JSON.parse(fs21.readFileSync(configPath, "utf-8"));
+      if (fs22.existsSync(configPath)) {
+        config = JSON.parse(fs22.readFileSync(configPath, "utf-8"));
       }
     } catch {
     }
@@ -52329,10 +52642,10 @@ function writeCredentialsAndConfig(apiKey, opts = {}) {
       terminal: typeof existing.terminal === "boolean" ? existing.terminal : d.terminal,
       cloud: !opts.isLocal
     };
-    if (!fs21.existsSync(path22.dirname(configPath))) {
-      fs21.mkdirSync(path22.dirname(configPath), { recursive: true });
+    if (!fs22.existsSync(path22.dirname(configPath))) {
+      fs22.mkdirSync(path22.dirname(configPath), { recursive: true });
     }
-    fs21.writeFileSync(configPath, JSON.stringify(config, null, 2), {
+    fs22.writeFileSync(configPath, JSON.stringify(config, null, 2), {
       mode: 384
     });
     effectiveCloud = !opts.isLocal;
@@ -56756,6 +57069,7 @@ function registerInitCommand(program2) {
 
 // src/cli/commands/heal.ts
 init_agent_wiring();
+init_mcp_wrap();
 init_setup();
 init_hook_baseline();
 import chalk21 from "chalk";
@@ -56767,8 +57081,28 @@ function backupForHeal(file) {
   } catch {
   }
 }
+function reportCorruptedMcpWraps() {
+  const corrupted = findCorruptedMcpWraps();
+  if (corrupted.length === 0) return;
+  console.log(
+    chalk21.yellow(
+      `  \u26A0\uFE0F  ${corrupted.length} MCP server(s) were corrupted by an older node9 and cannot start:`
+    )
+  );
+  for (const c of corrupted) {
+    console.log(chalk21.yellow(`     \u2022 ${c.name}  (${c.agentLabel})`));
+    console.log(chalk21.gray(`       ${c.mcpFile}`));
+    console.log(chalk21.gray(`       stored upstream: ${c.upstream}`));
+  }
+  console.log(
+    chalk21.gray(
+      "\n     The original command lost its path separators, so node9 cannot recover it.\n     Remove and re-add each server in the agent, then run `node9 init` to re-wrap.\n"
+    )
+  );
+}
 async function runHeal(name) {
   console.log(chalk21.cyan.bold("\n\u{1FA79} Node9 Heal\n"));
+  reportCorruptedMcpWraps();
   const baseline = loadHookBaseline();
   const wiring = getAgentWiring();
   let candidates2 = wiring.filter(
@@ -60535,7 +60869,7 @@ var COLOR = {
   medium: chalk32.yellow,
   advisory: chalk32.gray
 };
-var ACTION_URL = "https://github.com/marketplace/actions/node9-agent-security-check?ref=cli_scan_repo";
+var ACTION_URL = "https://github.com/marketplace/actions/node9-agent-security?ref=cli_scan_repo";
 function renderCta(res) {
   const L = [];
   L.push(chalk32.dim("   " + "\u2500".repeat(63)));