@node9/proxy 2.3.1 → 2.4.0

package/dist/cli.js

@@ -18303,7 +18303,7 @@ var init_ship = __esm({
 });
 
 // src/policy-snapshot/build.ts
-function buildPolicySnapshot(config, activeShields, overrides, mcpTools = {}, statusEntries = [], syncHealth) {
+function buildPolicySnapshot(config, activeShields, overrides, mcpTools = {}, statusEntries = [], syncHealth, identity) {
   const p = config.policy;
   const statusByKey = /* @__PURE__ */ new Map();
   for (const s of statusEntries) {
@@ -18372,7 +18372,9 @@ function buildPolicySnapshot(config, activeShields, overrides, mcpTools = {}, st
         lastError: syncHealth.lastError,
         consecutiveFailures: syncHealth.consecutiveFailures
       }
-    }
+    },
+    // Machine identity — heals legacy machineId-less keys on the SaaS side.
+    ...identity && { machineId: identity.machineId, platform: identity.platform }
   };
 }
 var MAX_RULES, MAX_EGRESS, MAX_MCP_SERVERS, MAX_MCP_TOOLS;
@@ -18748,6 +18750,34 @@ var init_ship2 = __esm({
   }
 });
 
+// src/machine-id.ts
+function getMachineId(homeDir2 = os34.homedir()) {
+  const file = path37.join(homeDir2, ".node9", "machine-id");
+  try {
+    const existing = fs38.readFileSync(file, "utf-8").trim();
+    if (UUID_RE.test(existing)) return existing;
+  } catch {
+  }
+  const id = crypto5.randomUUID();
+  try {
+    fs38.mkdirSync(path37.dirname(file), { recursive: true });
+    fs38.writeFileSync(file, id + "\n", { mode: 384 });
+  } catch {
+  }
+  return id;
+}
+var crypto5, fs38, os34, path37, UUID_RE;
+var init_machine_id = __esm({
+  "src/machine-id.ts"() {
+    "use strict";
+    crypto5 = __toESM(require("crypto"));
+    fs38 = __toESM(require("fs"));
+    os34 = __toESM(require("os"));
+    path37 = __toESM(require("path"));
+    UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+  }
+});
+
 // src/daemon/sync.ts
 function emptySignals3() {
   return {
@@ -19199,7 +19229,10 @@ async function pushPolicySnapshot(creds) {
       resolveMcpStatus(),
       // fleet-ship Step 2: ship this machine's sync health so the dashboard can
       // show "sync failing" badges. readSyncHealth is local (same module, no circular).
-      readSyncHealth()
+      readSyncHealth(),
+      // Machine identity — heals legacy machineId-less keys on the SaaS side
+      // (login-v2 duplicate-key fix). getMachineId mints on first need.
+      { machineId: getMachineId(), platform: process.platform }
     );
     await shipPolicySnapshot(body, creds);
   } catch {
@@ -19223,7 +19256,8 @@ async function runPolicyPush() {
       // resolve ${VAR} placeholders — so this push reflects THIS process's env
       // (daemon here, user shell in runPolicyPush); see the P2 design's two-env note.
       resolveMcpStatus(),
-      readSyncHealth()
+      readSyncHealth(),
+      { machineId: getMachineId(), platform: process.platform }
     );
     const sent = await shipPolicySnapshot(body, creds);
     return sent ? { ok: true } : { ok: false, reason: "Push failed (network or server error)" };
@@ -19408,6 +19442,7 @@ var init_sync = __esm({
     init_scan_watermark();
     init_state2();
     init_audit();
+    init_machine_id();
     FINDING_TO_SIGNAL3 = {
       dlp: "dlpFindings",
       pii: "piiFindings",
@@ -48382,27 +48417,8 @@ function resolveCloudEndpoint(pathSuffix, override) {
   return PROD_BASE + pathSuffix;
 }
 
-// src/machine-id.ts
-var crypto7 = __toESM(require("crypto"));
-var fs47 = __toESM(require("fs"));
-var os42 = __toESM(require("os"));
-var path45 = __toESM(require("path"));
-var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
-function getMachineId(homeDir2 = os42.homedir()) {
-  const file = path45.join(homeDir2, ".node9", "machine-id");
-  try {
-    const existing = fs47.readFileSync(file, "utf-8").trim();
-    if (UUID_RE.test(existing)) return existing;
-  } catch {
-  }
-  const id = crypto7.randomUUID();
-  try {
-    fs47.mkdirSync(path45.dirname(file), { recursive: true });
-    fs47.writeFileSync(file, id + "\n", { mode: 384 });
-  } catch {
-  }
-  return id;
-}
+// src/auth/device-login.ts
+init_machine_id();
 
 // src/utils/open-browser.ts
 var import_child_process6 = require("child_process");

package/dist/cli.mjs

@@ -18300,7 +18300,7 @@ var init_ship = __esm({
 });
 
 // src/policy-snapshot/build.ts
-function buildPolicySnapshot(config, activeShields, overrides, mcpTools = {}, statusEntries = [], syncHealth) {
+function buildPolicySnapshot(config, activeShields, overrides, mcpTools = {}, statusEntries = [], syncHealth, identity) {
   const p = config.policy;
   const statusByKey = /* @__PURE__ */ new Map();
   for (const s of statusEntries) {
@@ -18369,7 +18369,9 @@ function buildPolicySnapshot(config, activeShields, overrides, mcpTools = {}, st
         lastError: syncHealth.lastError,
         consecutiveFailures: syncHealth.consecutiveFailures
       }
-    }
+    },
+    // Machine identity — heals legacy machineId-less keys on the SaaS side.
+    ...identity && { machineId: identity.machineId, platform: identity.platform }
   };
 }
 var MAX_RULES, MAX_EGRESS, MAX_MCP_SERVERS, MAX_MCP_TOOLS;
@@ -18742,11 +18744,39 @@ var init_ship2 = __esm({
   }
 });
 
+// src/machine-id.ts
+import * as crypto5 from "crypto";
+import * as fs38 from "fs";
+import * as os34 from "os";
+import * as path37 from "path";
+function getMachineId(homeDir2 = os34.homedir()) {
+  const file = path37.join(homeDir2, ".node9", "machine-id");
+  try {
+    const existing = fs38.readFileSync(file, "utf-8").trim();
+    if (UUID_RE.test(existing)) return existing;
+  } catch {
+  }
+  const id = crypto5.randomUUID();
+  try {
+    fs38.mkdirSync(path37.dirname(file), { recursive: true });
+    fs38.writeFileSync(file, id + "\n", { mode: 384 });
+  } catch {
+  }
+  return id;
+}
+var UUID_RE;
+var init_machine_id = __esm({
+  "src/machine-id.ts"() {
+    "use strict";
+    UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+  }
+});
+
 // src/daemon/sync.ts
-import fs38 from "fs";
+import fs39 from "fs";
 import https4 from "https";
-import os34 from "os";
-import path37 from "path";
+import os35 from "os";
+import path38 from "path";
 function emptySignals3() {
   return {
     dlpFindings: 0,
@@ -18791,8 +18821,8 @@ function readCredentials() {
     };
   }
   try {
-    const credPath = path37.join(os34.homedir(), ".node9", "credentials.json");
-    const creds = JSON.parse(fs38.readFileSync(credPath, "utf-8"));
+    const credPath = path38.join(os35.homedir(), ".node9", "credentials.json");
+    const creds = JSON.parse(fs39.readFileSync(credPath, "utf-8"));
     const profileName = process.env.NODE9_PROFILE ?? "default";
     const profile = creds[profileName];
     if (typeof profile?.apiKey === "string" && profile.apiKey.length > 0) {
@@ -18818,7 +18848,7 @@ function readCredentials() {
 }
 function readCachedEtag() {
   try {
-    const raw = JSON.parse(fs38.readFileSync(rulesCacheFile(), "utf-8"));
+    const raw = JSON.parse(fs39.readFileSync(rulesCacheFile(), "utf-8"));
     return typeof raw.etag === "string" ? raw.etag : void 0;
   } catch {
     return void 0;
@@ -18826,7 +18856,7 @@ function readCachedEtag() {
 }
 function readCachedSyncIntervalHours() {
   try {
-    const raw = JSON.parse(fs38.readFileSync(rulesCacheFile(), "utf-8"));
+    const raw = JSON.parse(fs39.readFileSync(rulesCacheFile(), "utf-8"));
     return typeof raw.syncIntervalHours === "number" ? raw.syncIntervalHours : void 0;
   } catch {
     return void 0;
@@ -18843,7 +18873,7 @@ function effectiveSyncIntervalMs() {
 }
 function readSyncHealth() {
   try {
-    const raw = JSON.parse(fs38.readFileSync(syncHealthFile(), "utf-8"));
+    const raw = JSON.parse(fs39.readFileSync(syncHealthFile(), "utf-8"));
     return {
       lastCheckedAt: typeof raw.lastCheckedAt === "string" ? raw.lastCheckedAt : void 0,
       lastChangedAt: typeof raw.lastChangedAt === "string" ? raw.lastChangedAt : void 0,
@@ -18858,17 +18888,17 @@ function readSyncHealth() {
 function writeSyncHealth(h) {
   try {
     const file = syncHealthFile();
-    const dir = path37.dirname(file);
-    if (!fs38.existsSync(dir)) fs38.mkdirSync(dir, { recursive: true });
+    const dir = path38.dirname(file);
+    if (!fs39.existsSync(dir)) fs39.mkdirSync(dir, { recursive: true });
     const tmp = `${file}.${process.pid}.tmp`;
-    fs38.writeFileSync(tmp, JSON.stringify(h, null, 2) + "\n", "utf-8");
-    fs38.renameSync(tmp, file);
+    fs39.writeFileSync(tmp, JSON.stringify(h, null, 2) + "\n", "utf-8");
+    fs39.renameSync(tmp, file);
   } catch {
   }
 }
 function readCacheFetchedAt() {
   try {
-    const raw = JSON.parse(fs38.readFileSync(rulesCacheFile(), "utf-8"));
+    const raw = JSON.parse(fs39.readFileSync(rulesCacheFile(), "utf-8"));
     return typeof raw.fetchedAt === "string" ? raw.fetchedAt : void 0;
   } catch {
     return void 0;
@@ -19070,13 +19100,13 @@ function extractManagedConfig(body) {
 }
 function sweepStaleTmp(target) {
   try {
-    const dir = path37.dirname(target);
-    const prefix = `${path37.basename(target)}.`;
-    for (const name of fs38.readdirSync(dir)) {
+    const dir = path38.dirname(target);
+    const prefix = `${path38.basename(target)}.`;
+    for (const name of fs39.readdirSync(dir)) {
       if (!name.startsWith(prefix) || !name.endsWith(".tmp")) continue;
-      const full = path37.join(dir, name);
+      const full = path38.join(dir, name);
       try {
-        if (Date.now() - fs38.statSync(full).mtimeMs > 5 * 60 * 1e3) fs38.unlinkSync(full);
+        if (Date.now() - fs39.statSync(full).mtimeMs > 5 * 60 * 1e3) fs39.unlinkSync(full);
       } catch {
       }
     }
@@ -19178,7 +19208,7 @@ async function pushBlastSnapshot(creds) {
 }
 async function pushPostureSnapshot(creds) {
   try {
-    const home = os34.homedir();
+    const home = os35.homedir();
     const result = await runPosture({ home, cwd: home });
     await shipPosture(result, creds);
   } catch {
@@ -19197,7 +19227,10 @@ async function pushPolicySnapshot(creds) {
       resolveMcpStatus(),
       // fleet-ship Step 2: ship this machine's sync health so the dashboard can
       // show "sync failing" badges. readSyncHealth is local (same module, no circular).
-      readSyncHealth()
+      readSyncHealth(),
+      // Machine identity — heals legacy machineId-less keys on the SaaS side
+      // (login-v2 duplicate-key fix). getMachineId mints on first need.
+      { machineId: getMachineId(), platform: process.platform }
     );
     await shipPolicySnapshot(body, creds);
   } catch {
@@ -19221,7 +19254,8 @@ async function runPolicyPush() {
       // resolve ${VAR} placeholders — so this push reflects THIS process's env
       // (daemon here, user shell in runPolicyPush); see the P2 design's two-env note.
       resolveMcpStatus(),
-      readSyncHealth()
+      readSyncHealth(),
+      { machineId: getMachineId(), platform: process.platform }
     );
     const sent = await shipPolicySnapshot(body, creds);
     return sent ? { ok: true } : { ok: false, reason: "Push failed (network or server error)" };
@@ -19332,7 +19366,7 @@ async function runCloudSync() {
 }
 function getCloudSyncStatus() {
   try {
-    const raw = JSON.parse(fs38.readFileSync(rulesCacheFile(), "utf-8"));
+    const raw = JSON.parse(fs39.readFileSync(rulesCacheFile(), "utf-8"));
     if (!Array.isArray(raw.rules) || typeof raw.fetchedAt !== "string") return { cached: false };
     return {
       cached: true,
@@ -19349,7 +19383,7 @@ function getCloudSyncStatus() {
 }
 function getCloudRules() {
   try {
-    const raw = JSON.parse(fs38.readFileSync(rulesCacheFile(), "utf-8"));
+    const raw = JSON.parse(fs39.readFileSync(rulesCacheFile(), "utf-8"));
     return Array.isArray(raw.rules) ? raw.rules : null;
   } catch {
     return null;
@@ -19402,6 +19436,7 @@ var init_sync = __esm({
     init_scan_watermark();
     init_state2();
     init_audit();
+    init_machine_id();
     FINDING_TO_SIGNAL3 = {
       dlp: "dlpFindings",
       pii: "piiFindings",
@@ -19414,13 +19449,13 @@ var init_sync = __esm({
       loop: "loops",
       "long-output-redacted": "longOutputRedactions"
     };
-    rulesCacheFile = () => path37.join(os34.homedir(), ".node9", "rules-cache.json");
-    rulesCacheBackupFile = () => path37.join(os34.homedir(), ".node9", "rules-cache.last-good.json");
+    rulesCacheFile = () => path38.join(os35.homedir(), ".node9", "rules-cache.json");
+    rulesCacheBackupFile = () => path38.join(os35.homedir(), ".node9", "rules-cache.last-good.json");
     DEFAULT_API_URL2 = "https://api.node9.ai/api/v1/intercept/policies/sync";
     DEFAULT_INTERVAL_HOURS = 5;
     MIN_INTERVAL_SECONDS = 15;
     MAX_INTERVAL_SECONDS = 24 * 60 * 60;
-    syncHealthFile = () => path37.join(os34.homedir(), ".node9", "sync-health.json");
+    syncHealthFile = () => path38.join(os35.homedir(), ".node9", "sync-health.json");
     STALE_MIN_MS = 3 * 60 * 60 * 1e3;
     STALE_MAX_MS = 24 * 60 * 60 * 1e3;
     STALE_FACTOR = 3;
@@ -19443,26 +19478,26 @@ __export(audit_shipper_exports, {
   startAuditShipper: () => startAuditShipper,
   writeWatermark: () => writeWatermark
 });
-import fs39 from "fs";
-import path38 from "path";
-import os35 from "os";
-import crypto5 from "crypto";
+import fs40 from "fs";
+import path39 from "path";
+import os36 from "os";
+import crypto6 from "crypto";
 function fileSignature(filePath) {
-  const fd = fs39.openSync(filePath, "r");
+  const fd = fs40.openSync(filePath, "r");
   try {
     const buf = Buffer.alloc(512);
-    const read2 = fs39.readSync(fd, buf, 0, 512, 0);
+    const read2 = fs40.readSync(fd, buf, 0, 512, 0);
     const slice = buf.subarray(0, read2);
     const nl = slice.indexOf(10);
     const firstLine = nl === -1 ? slice : slice.subarray(0, nl);
-    return crypto5.createHash("sha256").update(firstLine).digest("hex").slice(0, 16);
+    return crypto6.createHash("sha256").update(firstLine).digest("hex").slice(0, 16);
   } finally {
-    fs39.closeSync(fd);
+    fs40.closeSync(fd);
   }
 }
 function readWatermark(watermarkPath) {
   try {
-    const raw = JSON.parse(fs39.readFileSync(watermarkPath, "utf-8"));
+    const raw = JSON.parse(fs40.readFileSync(watermarkPath, "utf-8"));
     if (typeof raw.fileSig === "string" && typeof raw.offset === "number" && raw.offset >= 0)
       return raw;
   } catch {
@@ -19471,8 +19506,8 @@ function readWatermark(watermarkPath) {
 }
 function writeWatermark(watermarkPath, wm) {
   const tmp = `${watermarkPath}.tmp`;
-  fs39.writeFileSync(tmp, JSON.stringify(wm));
-  fs39.renameSync(tmp, watermarkPath);
+  fs40.writeFileSync(tmp, JSON.stringify(wm));
+  fs40.renameSync(tmp, watermarkPath);
 }
 function buildWireRows(chunk2) {
   const lastNl = chunk2.lastIndexOf(10);
@@ -19550,11 +19585,11 @@ async function shipOnce(deps = {}) {
   if (!creds?.apiKey) return { status: "no-creds", shipped: 0 };
   const endpoint = buildBatchEndpoint(creds.apiUrl);
   if (!endpoint) return { status: "no-creds", shipped: 0 };
-  if (!fs39.existsSync(auditLogPath)) return { status: "idle", shipped: 0 };
+  if (!fs40.existsSync(auditLogPath)) return { status: "idle", shipped: 0 };
   let shipped = 0;
   try {
     for (let chunkN = 0; chunkN < MAX_CHUNKS_PER_TICK; chunkN++) {
-      const size = fs39.statSync(auditLogPath).size;
+      const size = fs40.statSync(auditLogPath).size;
       if (size === 0) break;
       const sig = fileSignature(auditLogPath);
       const wm = readWatermark(watermarkPath);
@@ -19562,12 +19597,12 @@ async function shipOnce(deps = {}) {
       if (offset >= size) break;
       const toRead = Math.min(size - offset, MAX_CHUNK_BYTES);
       const buf = Buffer.alloc(toRead);
-      const fd = fs39.openSync(auditLogPath, "r");
+      const fd = fs40.openSync(auditLogPath, "r");
       let read2;
       try {
-        read2 = fs39.readSync(fd, buf, 0, toRead, offset);
+        read2 = fs40.readSync(fd, buf, 0, toRead, offset);
       } finally {
-        fs39.closeSync(fd);
+        fs40.closeSync(fd);
       }
       const { rows, consumed } = buildWireRows(buf.subarray(0, read2));
       if (consumed === 0) break;
@@ -19614,8 +19649,8 @@ async function shipOnce(deps = {}) {
 }
 function shipLagBytes(auditLogPath = LOCAL_AUDIT_LOG, watermarkPath = AUDIT_SHIP_WATERMARK) {
   try {
-    if (!fs39.existsSync(auditLogPath)) return 0;
-    const size = fs39.statSync(auditLogPath).size;
+    if (!fs40.existsSync(auditLogPath)) return 0;
+    const size = fs40.statSync(auditLogPath).size;
     const wm = readWatermark(watermarkPath);
     if (!wm) return size;
     if (wm.fileSig !== fileSignature(auditLogPath)) return size;
@@ -19646,7 +19681,7 @@ var init_audit_shipper = __esm({
     init_config();
     init_sync();
     init_cloud();
-    AUDIT_SHIP_WATERMARK = path38.join(os35.homedir(), ".node9", "audit-ship.json");
+    AUDIT_SHIP_WATERMARK = path39.join(os36.homedir(), ".node9", "audit-ship.json");
     DEFAULT_INTERVAL_MS = 2e4;
     MAX_BATCH = 500;
     MAX_CHUNK_BYTES = 4 * 1024 * 1024;
@@ -19716,12 +19751,12 @@ var init_decision = __esm({
 });
 
 // src/daemon/dlp-scanner.ts
-import fs40 from "fs";
-import path39 from "path";
-import os36 from "os";
+import fs41 from "fs";
+import path40 from "path";
+import os37 from "os";
 function loadIndex() {
   try {
-    const raw = JSON.parse(fs40.readFileSync(INDEX_FILE, "utf-8"));
+    const raw = JSON.parse(fs41.readFileSync(INDEX_FILE, "utf-8"));
     if (raw && typeof raw === "object" && !Array.isArray(raw)) {
       const r = raw;
       if (r.offsets && typeof r.offsets === "object") return r.offsets;
@@ -19733,63 +19768,63 @@ function loadIndex() {
 }
 function saveIndex(index) {
   try {
-    fs40.writeFileSync(INDEX_FILE, JSON.stringify(index), { encoding: "utf-8", mode: 384 });
+    fs41.writeFileSync(INDEX_FILE, JSON.stringify(index), { encoding: "utf-8", mode: 384 });
   } catch {
   }
 }
 function appendAuditEntry(entry) {
   try {
-    fs40.appendFileSync(AUDIT_LOG_FILE, JSON.stringify(entry) + "\n");
+    fs41.appendFileSync(AUDIT_LOG_FILE, JSON.stringify(entry) + "\n");
   } catch {
   }
 }
 function runDlpScan() {
-  if (!fs40.existsSync(PROJECTS_DIR2)) return;
+  if (!fs41.existsSync(PROJECTS_DIR2)) return;
   const index = loadIndex();
   const seenThisPass = /* @__PURE__ */ new Set();
   const newFindings = [];
   let updated = false;
   let projDirs;
   try {
-    projDirs = fs40.readdirSync(PROJECTS_DIR2);
+    projDirs = fs41.readdirSync(PROJECTS_DIR2);
   } catch {
     return;
   }
   for (const proj of projDirs) {
-    const projPath = path39.join(PROJECTS_DIR2, proj);
+    const projPath = path40.join(PROJECTS_DIR2, proj);
     try {
-      if (!fs40.lstatSync(projPath).isDirectory()) continue;
-      const real = fs40.realpathSync(projPath);
-      if (!real.startsWith(PROJECTS_DIR2 + path39.sep) && real !== PROJECTS_DIR2) continue;
+      if (!fs41.lstatSync(projPath).isDirectory()) continue;
+      const real = fs41.realpathSync(projPath);
+      if (!real.startsWith(PROJECTS_DIR2 + path40.sep) && real !== PROJECTS_DIR2) continue;
     } catch {
       continue;
     }
     let files;
     try {
-      files = fs40.readdirSync(projPath).filter((f) => f.endsWith(".jsonl") && !f.startsWith("agent-"));
+      files = fs41.readdirSync(projPath).filter((f) => f.endsWith(".jsonl") && !f.startsWith("agent-"));
     } catch {
       continue;
     }
     for (const file of files) {
-      const filePath = path39.join(projPath, file);
+      const filePath = path40.join(projPath, file);
       const lastOffset = index[filePath] ?? 0;
       let size;
       try {
-        size = fs40.statSync(filePath).size;
+        size = fs41.statSync(filePath).size;
       } catch {
         continue;
       }
       if (size <= lastOffset) continue;
       let fd;
       try {
-        fd = fs40.openSync(filePath, "r");
+        fd = fs41.openSync(filePath, "r");
       } catch {
         continue;
       }
       try {
         const chunkSize = size - lastOffset;
         const buf = Buffer.alloc(chunkSize);
-        fs40.readSync(fd, buf, 0, chunkSize, lastOffset);
+        fs41.readSync(fd, buf, 0, chunkSize, lastOffset);
         const chunk2 = buf.toString("utf-8");
         for (const line of chunk2.split("\n")) {
           if (!line.trim()) continue;
@@ -19809,7 +19844,7 @@ function runDlpScan() {
             if (typeof text !== "string") continue;
             const match = scanText(text);
             if (!match) continue;
-            const projLabel = decodeURIComponent(proj).replace(os36.homedir(), "~").slice(0, 40);
+            const projLabel = decodeURIComponent(proj).replace(os37.homedir(), "~").slice(0, 40);
             const ts = entry.timestamp ?? (/* @__PURE__ */ new Date()).toISOString();
             appendAuditEntry({
               ts,
@@ -19836,7 +19871,7 @@ function runDlpScan() {
         updated = true;
       } finally {
         try {
-          fs40.closeSync(fd);
+          fs41.closeSync(fd);
         } catch {
         }
       }
@@ -19884,23 +19919,23 @@ var init_dlp_scanner = __esm({
     init_dlp();
     init_native();
     init_state2();
-    INDEX_FILE = path39.join(os36.homedir(), ".node9", "dlp-index.json");
-    PROJECTS_DIR2 = path39.join(os36.homedir(), ".claude", "projects");
+    INDEX_FILE = path40.join(os37.homedir(), ".node9", "dlp-index.json");
+    PROJECTS_DIR2 = path40.join(os37.homedir(), ".claude", "projects");
   }
 });
 
 // src/daemon/mcp-reconciler.ts
-import fs41 from "fs";
-import path40 from "path";
-import os37 from "os";
-import crypto6 from "crypto";
+import fs42 from "fs";
+import path41 from "path";
+import os38 from "os";
+import crypto7 from "crypto";
 function idKey(e) {
-  const cmdHash = crypto6.createHash("sha256").update(`${e.command} ${e.args.join(" ")}`).digest("hex").slice(0, 16);
+  const cmdHash = crypto7.createHash("sha256").update(`${e.command} ${e.args.join(" ")}`).digest("hex").slice(0, 16);
   return `${e.agent}:${e.name}:${cmdHash}`;
 }
 function loadBaseline() {
   try {
-    const raw = JSON.parse(fs41.readFileSync(BASELINE_FILE2, "utf-8"));
+    const raw = JSON.parse(fs42.readFileSync(BASELINE_FILE2, "utf-8"));
     return new Set(Array.isArray(raw) ? raw : []);
   } catch {
     return /* @__PURE__ */ new Set();
@@ -19908,7 +19943,7 @@ function loadBaseline() {
 }
 function saveBaseline(keys) {
   try {
-    fs41.writeFileSync(BASELINE_FILE2, JSON.stringify([...keys].slice(-BASELINE_CAP)), {
+    fs42.writeFileSync(BASELINE_FILE2, JSON.stringify([...keys].slice(-BASELINE_CAP)), {
       mode: 384
     });
   } catch {
@@ -20096,7 +20131,7 @@ var init_mcp_reconciler = __esm({
     init_cloud();
     init_audit();
     init_mcp_pin();
-    BASELINE_FILE2 = path40.join(os37.homedir(), ".node9", "mcp-baseline.json");
+    BASELINE_FILE2 = path41.join(os38.homedir(), ".node9", "mcp-baseline.json");
     BASELINE_CAP = 500;
     DEFAULT_INTERVAL_MIN = 60;
     DEFAULT_STALE_DAYS = 7;
@@ -20171,22 +20206,22 @@ var init_hook_heal = __esm({
 });
 
 // src/daemon/startup-log.ts
-import fs42 from "fs";
-import path41 from "path";
-import os38 from "os";
+import fs43 from "fs";
+import path42 from "path";
+import os39 from "os";
 function capStartupLog(file) {
   try {
-    if (fs42.statSync(file).size > MAX_STARTUP_LOG_BYTES) fs42.truncateSync(file);
+    if (fs43.statSync(file).size > MAX_STARTUP_LOG_BYTES) fs43.truncateSync(file);
   } catch {
   }
 }
 function openStartupLogFd() {
   try {
     const file = DAEMON_STARTUP_LOG();
-    const dir = path41.dirname(file);
-    if (!fs42.existsSync(dir)) fs42.mkdirSync(dir, { recursive: true });
+    const dir = path42.dirname(file);
+    if (!fs43.existsSync(dir)) fs43.mkdirSync(dir, { recursive: true });
     capStartupLog(file);
-    return fs42.openSync(file, "a");
+    return fs43.openSync(file, "a");
   } catch {
     return void 0;
   }
@@ -20202,18 +20237,18 @@ function recordStartupState(outcome, kind, detail) {
       }
     }
     const file = DAEMON_STARTUP_STATE();
-    const dir = path41.dirname(file);
-    if (!fs42.existsSync(dir)) fs42.mkdirSync(dir, { recursive: true });
+    const dir = path42.dirname(file);
+    if (!fs43.existsSync(dir)) fs43.mkdirSync(dir, { recursive: true });
     const state = { outcome, at: (/* @__PURE__ */ new Date()).toISOString() };
     if (kind) state.kind = kind;
     if (detail) state.detail = detail.slice(0, MAX_DETAIL);
     const tmp = `${file}.${process.pid}.tmp`;
     try {
-      fs42.writeFileSync(tmp, JSON.stringify(state), "utf-8");
-      fs42.renameSync(tmp, file);
+      fs43.writeFileSync(tmp, JSON.stringify(state), "utf-8");
+      fs43.renameSync(tmp, file);
     } catch (err2) {
       try {
-        fs42.unlinkSync(tmp);
+        fs43.unlinkSync(tmp);
       } catch {
       }
       throw err2;
@@ -20223,7 +20258,7 @@ function recordStartupState(outcome, kind, detail) {
 }
 function readStartupState() {
   try {
-    const raw = fs42.readFileSync(DAEMON_STARTUP_STATE(), "utf-8");
+    const raw = fs43.readFileSync(DAEMON_STARTUP_STATE(), "utf-8");
     const s = JSON.parse(raw);
     if (!s || typeof s.outcome !== "string" || typeof s.at !== "string") return null;
     return s;
@@ -20258,11 +20293,11 @@ function readStartupCause(maxAgeMs = 24 * 60 * 60 * 1e3) {
 function logDaemonStartup(kind, detail) {
   try {
     const file = DAEMON_STARTUP_LOG();
-    const dir = path41.dirname(file);
-    if (!fs42.existsSync(dir)) fs42.mkdirSync(dir, { recursive: true });
+    const dir = path42.dirname(file);
+    if (!fs43.existsSync(dir)) fs43.mkdirSync(dir, { recursive: true });
     const line = `[${(/* @__PURE__ */ new Date()).toISOString()}] daemon-startup:${kind}${detail ? ` ${detail}` : ""}
 `;
-    fs42.appendFileSync(file, line, "utf-8");
+    fs43.appendFileSync(file, line, "utf-8");
   } catch {
   }
 }
@@ -20270,9 +20305,9 @@ var DAEMON_STARTUP_LOG, MAX_STARTUP_LOG_BYTES, DAEMON_STARTUP_STATE, MAX_DETAIL,
 var init_startup_log = __esm({
   "src/daemon/startup-log.ts"() {
     "use strict";
-    DAEMON_STARTUP_LOG = () => path41.join(os38.homedir(), ".node9", "daemon-startup.log");
+    DAEMON_STARTUP_LOG = () => path42.join(os39.homedir(), ".node9", "daemon-startup.log");
     MAX_STARTUP_LOG_BYTES = 256 * 1024;
-    DAEMON_STARTUP_STATE = () => path41.join(os38.homedir(), ".node9", "daemon-startup-state.json");
+    DAEMON_STARTUP_STATE = () => path42.join(os39.homedir(), ".node9", "daemon-startup-state.json");
     MAX_DETAIL = 200;
     STARTING_GRACE_MS = 90 * 1e3;
   }
@@ -20280,10 +20315,10 @@ var init_startup_log = __esm({
 
 // src/daemon/server.ts
 import http3 from "http";
-import fs43 from "fs";
-import path42 from "path";
-import os39 from "os";
-import { randomUUID as randomUUID4 } from "crypto";
+import fs44 from "fs";
+import path43 from "path";
+import os40 from "os";
+import { randomUUID as randomUUID5 } from "crypto";
 import { spawnSync } from "child_process";
 import chalk6 from "chalk";
 function buildDaemonReport(allEntries, period, now) {
@@ -20373,7 +20408,7 @@ function startDaemon() {
     recordStartupState("failed", "startup-throw", err2 instanceof Error ? err2.message : String(err2));
     process.exit(1);
   }
-  const internalToken = randomUUID4();
+  const internalToken = randomUUID5();
   const validToken = (req) => req.headers["x-node9-internal"] === internalToken || req.headers["x-node9-token"] === internalToken;
   const startedAt = (/* @__PURE__ */ new Date()).toISOString();
   const IDLE_TIMEOUT_MS = 12 * 60 * 60 * 1e3;
@@ -20385,7 +20420,7 @@ function startDaemon() {
     idleTimer = setTimeout(() => {
       if (autoStarted) {
         try {
-          fs43.unlinkSync(DAEMON_PID_FILE);
+          fs44.unlinkSync(DAEMON_PID_FILE);
         } catch {
         }
       }
@@ -20486,7 +20521,7 @@ data: ${JSON.stringify(item.data)}
           cwd,
           localSmartRuleMatched = false
         } = JSON.parse(body);
-        const id = fromCLI && typeof activityId === "string" && activityId || randomUUID4();
+        const id = fromCLI && typeof activityId === "string" && activityId || randomUUID5();
         const entry = {
           id,
           toolName,
@@ -20530,7 +20565,7 @@ data: ${JSON.stringify(item.data)}
             mcpServer: entry.mcpServer
           });
         }
-        const projectCwd = typeof cwd === "string" && path42.isAbsolute(cwd) ? cwd : void 0;
+        const projectCwd = typeof cwd === "string" && path43.isAbsolute(cwd) ? cwd : void 0;
         const projectConfig = getConfig(projectCwd);
         const browserEnabled = projectConfig.settings.approvers?.browser !== false;
         const terminalEnabled = projectConfig.settings.approvers?.terminal !== false;
@@ -20854,8 +20889,8 @@ data: ${JSON.stringify(item.data)}
       if (!validToken(req)) return res.writeHead(403).end();
       const periodParam = reqUrl.searchParams.get("period") || "7d";
       const period = ["today", "7d", "30d", "month"].includes(periodParam) ? periodParam : "7d";
-      const logPath = path42.join(os39.homedir(), ".node9", "audit.log");
-      if (!fs43.existsSync(logPath)) {
+      const logPath = path43.join(os40.homedir(), ".node9", "audit.log");
+      if (!fs44.existsSync(logPath)) {
         res.writeHead(200, { "Content-Type": "application/json" });
         return res.end(
           JSON.stringify({
@@ -20868,7 +20903,7 @@ data: ${JSON.stringify(item.data)}
         );
       }
       try {
-        const raw = fs43.readFileSync(logPath, "utf-8");
+        const raw = fs44.readFileSync(logPath, "utf-8");
         const allEntries = raw.split("\n").flatMap((line) => {
           if (!line.trim()) return [];
           try {
@@ -21096,7 +21131,7 @@ data: ${JSON.stringify(item.data)}
             args: { toolCount: tools.length, status },
             decision: "mcp-discovered"
           });
-          const id = randomUUID4();
+          const id = randomUUID5();
           const entry = {
             id,
             type: "mcp-discovery",
@@ -21275,8 +21310,8 @@ data: ${JSON.stringify(item.data)}
   server.on("error", (e) => {
     if (e.code === "EADDRINUSE") {
       try {
-        if (fs43.existsSync(DAEMON_PID_FILE)) {
-          const parsed = JSON.parse(fs43.readFileSync(DAEMON_PID_FILE, "utf-8"));
+        if (fs44.existsSync(DAEMON_PID_FILE)) {
+          const parsed = JSON.parse(fs44.readFileSync(DAEMON_PID_FILE, "utf-8"));
           const pid = parsed.pid;
           if (typeof pid !== "number" || !Number.isInteger(pid) || pid <= 0 || pid > 4194304) {
             throw new Error("invalid pid in daemon.pid");
@@ -21290,7 +21325,7 @@ data: ${JSON.stringify(item.data)}
         }
       } catch {
         try {
-          fs43.unlinkSync(DAEMON_PID_FILE);
+          fs44.unlinkSync(DAEMON_PID_FILE);
         } catch {
         }
         retryListen();
@@ -21420,15 +21455,15 @@ var init_server = __esm({
 });
 
 // src/daemon/service.ts
-import fs44 from "fs";
-import path43 from "path";
-import os40 from "os";
+import fs45 from "fs";
+import path44 from "path";
+import os41 from "os";
 import { spawnSync as spawnSync2, execFileSync } from "child_process";
 function resolveNode9Binary() {
   try {
     const script = process.argv[1];
-    if (typeof script === "string" && path43.isAbsolute(script) && fs44.existsSync(script)) {
-      return fs44.realpathSync(script);
+    if (typeof script === "string" && path44.isAbsolute(script) && fs45.existsSync(script)) {
+      return fs45.realpathSync(script);
     }
   } catch {
   }
@@ -21446,11 +21481,11 @@ function xmlEscape(s) {
   return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
 }
 function launchdPlist(binaryPath) {
-  const logDir = path43.join(os40.homedir(), ".node9");
+  const logDir = path44.join(os41.homedir(), ".node9");
   const nodePath = xmlEscape(process.execPath);
   const scriptPath = xmlEscape(binaryPath);
-  const outLog = xmlEscape(path43.join(logDir, "daemon.log"));
-  const errLog = xmlEscape(path43.join(logDir, "daemon-error.log"));
+  const outLog = xmlEscape(path44.join(logDir, "daemon.log"));
+  const errLog = xmlEscape(path44.join(logDir, "daemon-error.log"));
   return `<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
@@ -21483,9 +21518,9 @@ function launchdPlist(binaryPath) {
 `;
 }
 function installLaunchd(binaryPath) {
-  const dir = path43.dirname(LAUNCHD_PLIST);
-  if (!fs44.existsSync(dir)) fs44.mkdirSync(dir, { recursive: true });
-  fs44.writeFileSync(LAUNCHD_PLIST, launchdPlist(binaryPath), "utf-8");
+  const dir = path44.dirname(LAUNCHD_PLIST);
+  if (!fs45.existsSync(dir)) fs45.mkdirSync(dir, { recursive: true });
+  fs45.writeFileSync(LAUNCHD_PLIST, launchdPlist(binaryPath), "utf-8");
   spawnSync2("launchctl", ["unload", LAUNCHD_PLIST], { encoding: "utf8" });
   const r = spawnSync2("launchctl", ["load", "-w", LAUNCHD_PLIST], {
     encoding: "utf8",
@@ -21496,13 +21531,13 @@ function installLaunchd(binaryPath) {
   }
 }
 function uninstallLaunchd() {
-  if (fs44.existsSync(LAUNCHD_PLIST)) {
+  if (fs45.existsSync(LAUNCHD_PLIST)) {
     spawnSync2("launchctl", ["unload", "-w", LAUNCHD_PLIST], { encoding: "utf8", timeout: 5e3 });
-    fs44.unlinkSync(LAUNCHD_PLIST);
+    fs45.unlinkSync(LAUNCHD_PLIST);
   }
 }
 function isLaunchdInstalled() {
-  return fs44.existsSync(LAUNCHD_PLIST);
+  return fs45.existsSync(LAUNCHD_PLIST);
 }
 function systemdUnit(binaryPath) {
   return `[Unit]
@@ -21521,12 +21556,12 @@ WantedBy=default.target
 `;
 }
 function installSystemd(binaryPath) {
-  if (!fs44.existsSync(SYSTEMD_UNIT_DIR)) {
-    fs44.mkdirSync(SYSTEMD_UNIT_DIR, { recursive: true });
+  if (!fs45.existsSync(SYSTEMD_UNIT_DIR)) {
+    fs45.mkdirSync(SYSTEMD_UNIT_DIR, { recursive: true });
   }
-  fs44.writeFileSync(SYSTEMD_UNIT, systemdUnit(binaryPath), "utf-8");
+  fs45.writeFileSync(SYSTEMD_UNIT, systemdUnit(binaryPath), "utf-8");
   try {
-    execFileSync("loginctl", ["enable-linger", os40.userInfo().username], { timeout: 3e3 });
+    execFileSync("loginctl", ["enable-linger", os41.userInfo().username], { timeout: 3e3 });
   } catch {
   }
   const reload = spawnSync2("systemctl", ["--user", "daemon-reload"], {
@@ -21546,21 +21581,21 @@ function installSystemd(binaryPath) {
   }
 }
 function uninstallSystemd() {
-  if (fs44.existsSync(SYSTEMD_UNIT)) {
+  if (fs45.existsSync(SYSTEMD_UNIT)) {
     spawnSync2("systemctl", ["--user", "disable", "--now", "node9-daemon"], {
       encoding: "utf8",
       timeout: 5e3
     });
     spawnSync2("systemctl", ["--user", "daemon-reload"], { encoding: "utf8", timeout: 5e3 });
-    fs44.unlinkSync(SYSTEMD_UNIT);
+    fs45.unlinkSync(SYSTEMD_UNIT);
   }
 }
 function isSystemdInstalled() {
-  return fs44.existsSync(SYSTEMD_UNIT);
+  return fs45.existsSync(SYSTEMD_UNIT);
 }
-function windowsStartupDir(homeDir2 = os40.homedir()) {
-  const appData = process.env.APPDATA || path43.join(homeDir2, "AppData", "Roaming");
-  return path43.join(appData, "Microsoft", "Windows", "Start Menu", "Programs", "Startup");
+function windowsStartupDir(homeDir2 = os41.homedir()) {
+  const appData = process.env.APPDATA || path44.join(homeDir2, "AppData", "Roaming");
+  return path44.join(appData, "Microsoft", "Windows", "Start Menu", "Programs", "Startup");
 }
 function windowsLauncherVbs(nodePath, scriptPath) {
   for (const p of [nodePath, scriptPath]) {
@@ -21577,23 +21612,23 @@ function windowsLauncherVbs(nodePath, scriptPath) {
 }
 function installWindowsStartup(binaryPath) {
   const target = WIN_LAUNCHER();
-  const dir = path43.dirname(target);
-  if (!fs44.existsSync(dir)) fs44.mkdirSync(dir, { recursive: true });
-  fs44.writeFileSync(target, windowsLauncherVbs(process.execPath, binaryPath), "utf-8");
+  const dir = path44.dirname(target);
+  if (!fs45.existsSync(dir)) fs45.mkdirSync(dir, { recursive: true });
+  fs45.writeFileSync(target, windowsLauncherVbs(process.execPath, binaryPath), "utf-8");
   spawnSync2("wscript.exe", ["//B", target], { encoding: "utf8", timeout: 1e4 });
 }
 function uninstallWindowsStartup() {
   const target = WIN_LAUNCHER();
-  if (fs44.existsSync(target)) fs44.unlinkSync(target);
+  if (fs45.existsSync(target)) fs45.unlinkSync(target);
 }
 function isWindowsStartupInstalled() {
-  return fs44.existsSync(WIN_LAUNCHER());
+  return fs45.existsSync(WIN_LAUNCHER());
 }
 function stopRunningDaemon() {
-  const pidFile = path43.join(os40.homedir(), ".node9", "daemon.pid");
-  if (!fs44.existsSync(pidFile)) return;
+  const pidFile = path44.join(os41.homedir(), ".node9", "daemon.pid");
+  if (!fs45.existsSync(pidFile)) return;
   try {
-    const data = JSON.parse(fs44.readFileSync(pidFile, "utf-8"));
+    const data = JSON.parse(fs45.readFileSync(pidFile, "utf-8"));
     const pid = data.pid;
     const MAX_PID2 = 4194304;
     if (typeof pid === "number" && Number.isInteger(pid) && pid > 0 && pid <= MAX_PID2) {
@@ -21613,7 +21648,7 @@ function stopRunningDaemon() {
       }
     }
     try {
-      fs44.unlinkSync(pidFile);
+      fs45.unlinkSync(pidFile);
     } catch {
     }
   } catch {
@@ -21778,21 +21813,21 @@ var init_service = __esm({
   "src/daemon/service.ts"() {
     "use strict";
     LAUNCHD_LABEL = "ai.node9.daemon";
-    LAUNCHD_PLIST = path43.join(os40.homedir(), "Library", "LaunchAgents", `${LAUNCHD_LABEL}.plist`);
-    SYSTEMD_UNIT_DIR = path43.join(os40.homedir(), ".config", "systemd", "user");
-    SYSTEMD_UNIT = path43.join(SYSTEMD_UNIT_DIR, "node9-daemon.service");
+    LAUNCHD_PLIST = path44.join(os41.homedir(), "Library", "LaunchAgents", `${LAUNCHD_LABEL}.plist`);
+    SYSTEMD_UNIT_DIR = path44.join(os41.homedir(), ".config", "systemd", "user");
+    SYSTEMD_UNIT = path44.join(SYSTEMD_UNIT_DIR, "node9-daemon.service");
     STARTUP_FILE = "node9-daemon.vbs";
-    WIN_LAUNCHER = () => path43.join(windowsStartupDir(), STARTUP_FILE);
+    WIN_LAUNCHER = () => path44.join(windowsStartupDir(), STARTUP_FILE);
   }
 });
 
 // src/daemon/index.ts
-import fs45 from "fs";
+import fs46 from "fs";
 import chalk7 from "chalk";
 function stopDaemon() {
-  if (!fs45.existsSync(DAEMON_PID_FILE)) return console.log(chalk7.yellow("Not running."));
+  if (!fs46.existsSync(DAEMON_PID_FILE)) return console.log(chalk7.yellow("Not running."));
   try {
-    const data = JSON.parse(fs45.readFileSync(DAEMON_PID_FILE, "utf-8"));
+    const data = JSON.parse(fs46.readFileSync(DAEMON_PID_FILE, "utf-8"));
     const pid = data.pid;
     if (typeof pid !== "number" || !Number.isInteger(pid) || pid <= 0 || pid > MAX_PID) {
       console.log(chalk7.gray("Cleaned up invalid PID file."));
@@ -21804,7 +21839,7 @@ function stopDaemon() {
     console.log(chalk7.gray("Cleaned up stale PID file."));
   } finally {
     try {
-      fs45.unlinkSync(DAEMON_PID_FILE);
+      fs46.unlinkSync(DAEMON_PID_FILE);
     } catch {
     }
   }
@@ -21813,9 +21848,9 @@ function daemonStatus() {
   const serviceInstalled = isDaemonServiceInstalled();
   const serviceLabel = serviceInstalled ? chalk7.green("installed (starts on login)") : chalk7.yellow("not installed \u2014 run: node9 daemon install");
   let processStatus;
-  if (fs45.existsSync(DAEMON_PID_FILE)) {
+  if (fs46.existsSync(DAEMON_PID_FILE)) {
     try {
-      const data = JSON.parse(fs45.readFileSync(DAEMON_PID_FILE, "utf-8"));
+      const data = JSON.parse(fs46.readFileSync(DAEMON_PID_FILE, "utf-8"));
       const pid = data.pid;
       const port = data.port;
       if (typeof pid !== "number" || !Number.isInteger(pid) || pid <= 0 || pid > MAX_PID) {
@@ -48192,26 +48227,26 @@ async function runProxy(targetCommand) {
 init_daemon();
 init_startup_log();
 import { spawn as spawn3 } from "child_process";
-import path44 from "path";
-import fs46 from "fs";
-import os41 from "os";
+import path45 from "path";
+import fs47 from "fs";
+import os42 from "os";
 function isTestingMode() {
   return /^(1|true|yes)$/i.test(process.env.NODE9_TESTING ?? "");
 }
-var SKIP_STAMP = () => path44.join(os41.homedir(), ".node9", ".autostart-skip-stamp");
+var SKIP_STAMP = () => path45.join(os42.homedir(), ".node9", ".autostart-skip-stamp");
 var SKIP_THROTTLE_MS = 60 * 60 * 1e3;
 function logAutostartSkipThrottled(reason) {
   try {
     const stamp = SKIP_STAMP();
     try {
-      if (Date.now() - fs46.statSync(stamp).mtimeMs < SKIP_THROTTLE_MS) return;
+      if (Date.now() - fs47.statSync(stamp).mtimeMs < SKIP_THROTTLE_MS) return;
     } catch {
     }
-    const dir = path44.join(os41.homedir(), ".node9");
-    if (!fs46.existsSync(dir)) fs46.mkdirSync(dir, { recursive: true });
-    fs46.writeFileSync(stamp, "", "utf-8");
-    fs46.appendFileSync(
-      path44.join(dir, "hook-debug.log"),
+    const dir = path45.join(os42.homedir(), ".node9");
+    if (!fs47.existsSync(dir)) fs47.mkdirSync(dir, { recursive: true });
+    fs47.writeFileSync(stamp, "", "utf-8");
+    fs47.appendFileSync(
+      path45.join(dir, "hook-debug.log"),
       `[${(/* @__PURE__ */ new Date()).toISOString()}] daemon-autostart-skip: ${reason}
 `,
       "utf-8"
@@ -48230,10 +48265,10 @@ async function autoStartDaemonAndWait() {
     return true;
   }
   if (isTestingMode()) return false;
-  if (!path44.isAbsolute(process.argv[1])) return false;
+  if (!path45.isAbsolute(process.argv[1])) return false;
   let resolvedArgv1;
   try {
-    resolvedArgv1 = fs46.realpathSync(process.argv[1]);
+    resolvedArgv1 = fs47.realpathSync(process.argv[1]);
   } catch {
     return false;
   }
@@ -48271,7 +48306,7 @@ async function autoStartDaemonAndWait() {
   } finally {
     if (startupFd !== void 0) {
       try {
-        fs46.closeSync(startupFd);
+        fs47.closeSync(startupFd);
       } catch {
       }
     }
@@ -48375,27 +48410,8 @@ function resolveCloudEndpoint(pathSuffix, override) {
   return PROD_BASE + pathSuffix;
 }
 
-// src/machine-id.ts
-import * as crypto7 from "crypto";
-import * as fs47 from "fs";
-import * as os42 from "os";
-import * as path45 from "path";
-var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
-function getMachineId(homeDir2 = os42.homedir()) {
-  const file = path45.join(homeDir2, ".node9", "machine-id");
-  try {
-    const existing = fs47.readFileSync(file, "utf-8").trim();
-    if (UUID_RE.test(existing)) return existing;
-  } catch {
-  }
-  const id = crypto7.randomUUID();
-  try {
-    fs47.mkdirSync(path45.dirname(file), { recursive: true });
-    fs47.writeFileSync(file, id + "\n", { mode: 384 });
-  } catch {
-  }
-  return id;
-}
+// src/auth/device-login.ts
+init_machine_id();
 
 // src/utils/open-browser.ts
 import { spawn as spawn4 } from "child_process";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@node9/proxy",
-  "version": "2.3.1",
+  "version": "2.4.0",
   "description": "The Sudo Command for AI Agents. Execution Security for Claude Code, Codex, Gemini, Cursor, Opencode, Pi, and any MCP server.",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",