@node9/proxy 2.47.2 → 2.48.0

package/dist/hook.js

@@ -18474,17 +18474,17 @@ var init_audit = __esm({
 // src/hook-entry.ts
 init_cjs_shims();
 var import_commander = require("commander");
-var import_fs35 = __toESM(require("fs"));
-var import_os28 = __toESM(require("os"));
-var import_path37 = __toESM(require("path"));
+var import_fs37 = __toESM(require("fs"));
+var import_os29 = __toESM(require("os"));
+var import_path39 = __toESM(require("path"));
 
 // src/cli/commands/check.ts
 init_cjs_shims();
 var import_chalk2 = __toESM(require("chalk"));
-var import_fs33 = __toESM(require("fs"));
+var import_fs35 = __toESM(require("fs"));
 var import_child_process3 = require("child_process");
-var import_path35 = __toESM(require("path"));
-var import_os26 = __toESM(require("os"));
+var import_path37 = __toESM(require("path"));
+var import_os27 = __toESM(require("os"));
 
 // src/auth/orchestrator.ts
 init_cjs_shims();
@@ -20945,8 +20945,8 @@ var ConfigFileSchema = import_zod.z.object({
 }).strict();
 function formatIssues(issues) {
   const lines = issues.map((issue) => {
-    const path38 = issue.path.length > 0 ? issue.path.map(String).join(".") : "root";
-    return `  \u2022 ${path38}: ${issue.message}`;
+    const path40 = issue.path.length > 0 ? issue.path.map(String).join(".") : "root";
+    return `  \u2022 ${path40}: ${issue.message}`;
   });
   return `Invalid config:
 ${lines.join("\n")}`;
@@ -20959,9 +20959,9 @@ function prunePaths(root, paths) {
     const yi = y[y.length - 1];
     return typeof xi === "number" && typeof yi === "number" ? yi - xi : 0;
   });
-  for (const path38 of ordered) {
+  for (const path40 of ordered) {
     let cur = root;
-    for (const key of path38.slice(0, -1)) {
+    for (const key of path40.slice(0, -1)) {
       if (cur === null || typeof cur !== "object") {
         cur = void 0;
         break;
@@ -20969,7 +20969,7 @@ function prunePaths(root, paths) {
       cur = cur[key];
     }
     if (cur === null || typeof cur !== "object") continue;
-    const last = path38[path38.length - 1];
+    const last = path40[path40.length - 1];
     if (Array.isArray(cur)) {
       const i = Number(last);
       if (Number.isInteger(i) && i >= 0 && i < cur.length) {
@@ -21005,7 +21005,7 @@ function sanitizeConfig(raw) {
           return issue.keys.map((k) => [...at, k]);
         }
         return [at.slice(0, -level || void 0)];
-      }).filter((path38) => path38.length > 0);
+      }).filter((path40) => path40.length > 0);
       if (paths.length === 0 || !prunePaths(working, paths)) break;
     }
     if (ConfigFileSchema.safeParse(working).success) break;
@@ -22226,13 +22226,13 @@ function getConfig(cwd) {
         }
         if (Array.isArray(mc.jailPaths)) {
           for (const jp of mc.jailPaths) {
-            const path38 = typeof jp?.path === "string" ? jp.path.trim() : "";
-            if (!path38) continue;
+            const path40 = typeof jp?.path === "string" ? jp.path.trim() : "";
+            if (!path40) continue;
             const verdict = jp?.verdict === "review" ? "review" : "block";
-            for (const r of pathRules(path38, verdict, "org-managed jail")) {
+            for (const r of pathRules(path40, verdict, "org-managed jail")) {
               mergedPolicy.smartRules.push({ ...r, name: `org:${r.name}` });
             }
-            mergedPolicy.managedJailPaths.push({ path: path38, verdict });
+            mergedPolicy.managedJailPaths.push({ path: path40, verdict });
           }
         }
         if (Array.isArray(mc.trustedHosts)) {
@@ -24159,6 +24159,79 @@ function recordAndCheck(tool, args, threshold = 3, windowMs = 12e4) {
 
 // src/policy/negotiation.ts
 init_cjs_shims();
+init_dist();
+var USER_LINE_ICON = "\u{1F6E1}\uFE0F";
+var QUOTE_INSTRUCTION = "Start your reply with the line above, exactly as written, on its own line.";
+var USER_LINE_PART_MAX = 160;
+var ONE_LINE_INPUT_MAX = 1e3;
+var PICTOGRAPHS = /[\p{Extended_Pictographic}\u200D\uFE0F]/gu;
+function oneLine(text) {
+  return stripTerminalEscapes(text.slice(0, ONE_LINE_INPUT_MAX)).replace(/\s*\u2014\s*/g, ", ").replace(/\s+/g, " ").trim();
+}
+function bounded(text, max = USER_LINE_PART_MAX) {
+  return text.length > max ? `${text.slice(0, max - 3).trimEnd()}...` : text;
+}
+function userLinePart(text) {
+  return bounded(oneLine(text).replace(/[.\s]+$/, ""));
+}
+function userLineValue(text, max = 80) {
+  const v = bounded(oneLine(text).replace(/`/g, "'"), max);
+  return v ? `\`${v}\`` : "";
+}
+function userLineOf(message) {
+  const first = message.split("\n", 1)[0];
+  return first.startsWith(USER_LINE_ICON) ? first : void 0;
+}
+function withUserLine(line, body) {
+  return `${USER_LINE_ICON} ${line}
+${QUOTE_INSTRUCTION}
+${body}`;
+}
+function blockedLine(context, fallback) {
+  return `Node9 blocked: ${ruleWhat(context?.ruleDescription) || fallback}`;
+}
+function firstSentence(text) {
+  const plain = oneLine(text.replace(PICTOGRAPHS, ""));
+  return plain.split(/(?<=[.!?])\s+(?=[A-Z])/)[0] ?? plain;
+}
+function withoutLeadingVerdict(text) {
+  return text.replace(/^node9\b\s*:?\s*/i, "").replace(/^blocked\b\s*:?\s*/i, "");
+}
+var IS_BLOCKED_BY = /^(.+?) (?:is|are) blocked by (.+?)\.?$/i;
+var IS_BLOCKED = /^(.+?) (?:is|are) blocked\.?$/i;
+var COMMA_BLOCKED_BY = /^(.+?), blocked by (.+?)\.?$/i;
+function ruleWhat(description) {
+  if (!description) return "";
+  const s = firstSentence(description).replace(/^node9\s*:\s*/i, "").replace(/^blocked\s*:\s*/i, "");
+  if (!/[\p{L}\p{N}]/u.test(s)) return "";
+  const by = s.match(IS_BLOCKED_BY) ?? s.match(COMMA_BLOCKED_BY);
+  if (by) return userLinePart(`${by[1]} (${by[2]})`);
+  const bare = s.match(IS_BLOCKED);
+  return userLinePart(bare ? bare[1] : s);
+}
+function reasonSentence(reason) {
+  if (!reason) return "";
+  const s = withoutLeadingVerdict(firstSentence(reason));
+  if (/^("[^"]*")?\.?$/.test(s)) return "";
+  return userLinePart(s);
+}
+function maliciousPackageLine(reason) {
+  if (!reason) return "";
+  const names = [...reason.matchAll(/"([^"]+)"/g)].map((m) => {
+    const spec = m[1];
+    const at = spec.lastIndexOf("@");
+    return at > 0 ? spec.slice(0, at) : spec;
+  });
+  if (names.length === 0) return "";
+  const advisories = [...reason.matchAll(/\b((?:MAL|GHSA|CVE|OSV|PYSEC|RUSTSEC)-[\w-]+)/g)].map(
+    (m) => m[1]
+  );
+  const unique2 = [...new Set(names)];
+  const suffix = advisories.length ? ` (${[...new Set(advisories)].join(", ")})` : "";
+  return userLinePart(
+    unique2.length === 1 ? `${unique2[0]} is a known malicious package${suffix}` : `${unique2.join(", ")} are known malicious packages${suffix}`
+  );
+}
 function buildNegotiationMessage(blockedByLabel, isHumanDecision2, humanReason, recoveryCommand, context) {
   if (isHumanDecision2 && context?.redirect && humanReason) {
     return `NODE9: The user stopped this action and gave you an instruction.
@@ -24168,88 +24241,138 @@ INSTRUCTIONS:
 - Retry the original action only if the instruction says you may.`;
   }
   if (isHumanDecision2) {
-    return `NODE9: The human user rejected this action.
+    return withUserLine(
+      "Node9: you blocked this action",
+      `NODE9: The human user rejected this action.
 REASON: ${humanReason || "No specific reason provided."}
 INSTRUCTIONS:
 - Do NOT retry this exact command.
 - Acknowledge the block to the user and ask if there is an alternative approach.
-- If you believe this action is critical, explain your reasoning and ask them to run "node9 pause 15m" to proceed.`;
+- If you believe this action is critical, explain your reasoning and ask them to run "node9 pause 15m" to proceed.`
+    );
   }
   if (context?.kind === "protected-path") {
     const subject = context.path ? `${context.path} is a protected file` : "This file is protected";
-    return `NODE9: Blocked. ${subject}, and node9 stopped this call to it. The call did not run, so nothing was exposed.
+    const shown = context.path ? userLineValue(context.path) : "";
+    const line2 = shown ? `Node9 blocked access to ${shown} (protected file)` : "Node9 blocked access to a protected file";
+    return withUserLine(
+      line2,
+      `NODE9: Blocked. ${subject}, and node9 stopped this call to it. The call did not run, so nothing was exposed.
 INSTRUCTIONS:
 - Do NOT retry, and do NOT reach the file another way (cat, grep, a copy, a script, a redirect).
 - If this step needs that file, ask the user to provide what you need or to do the step themselves.
-- Tell the user node9 protected this file, then ask how to proceed.`;
+- Tell the user node9 protected this file, then ask how to proceed.`
+    );
   }
   const label2 = blockedByLabel.toLowerCase();
   if (label2.includes("dlp") || label2.includes("secret detected") || label2.includes("credential review")) {
-    return `NODE9 SECURITY ALERT: A sensitive credential (API key, token, or private key) was found in your tool call arguments.
+    return withUserLine(
+      "Node9 blocked this command: it contains a secret",
+      `NODE9 SECURITY ALERT: A sensitive credential (API key, token, or private key) was found in your tool call arguments.
 CRITICAL INSTRUCTION: Do NOT retry this action.
 REQUIRED ACTIONS:
 1. Remove the hardcoded credential from your command or code.
 2. Use an environment variable or a dedicated secrets manager instead.
 3. Treat the leaked credential as compromised and rotate it immediately.
 Do NOT attempt to bypass this check or pass the credential through another tool.
-- Tell the user node9 blocked this and why, then ask how to proceed.`;
+- Tell the user node9 blocked this and why, then ask how to proceed.`
+    );
   }
   if (label2.includes("package check")) {
-    return `NODE9: Blocked \u2014 ${humanReason || "a package in this command is known to be malicious."}
+    const pkg = maliciousPackageLine(humanReason);
+    return withUserLine(
+      pkg ? `Node9 blocked: ${pkg}` : "Node9 blocked: this package is known to be malicious",
+      `NODE9: Blocked \u2014 ${humanReason || "a package in this command is known to be malicious."}
 INSTRUCTIONS:
 - Do NOT install this package, and do NOT fetch it another way (a different package manager, a tarball URL, a git URL, a mirror).
 - If a dependency is needed, suggest a well-known alternative and let the user choose.
-- Tell the user node9 blocked this install and name the advisory, then ask how to proceed.`;
+- Tell the user node9 blocked this install and name the advisory, then ask how to proceed.`
+    );
   }
   if (label2.includes("sql safety") && label2.includes("delete without where")) {
-    return `NODE9: Blocked \u2014 DELETE without WHERE clause would wipe the entire table.
+    return withUserLine(
+      blockedLine(context, "DELETE without WHERE would wipe the whole table"),
+      `NODE9: Blocked \u2014 DELETE without WHERE clause would wipe the entire table.
 INSTRUCTION: Add a WHERE clause to scope the deletion (e.g. WHERE id = <value>).
 Do NOT retry without a WHERE clause.
-- Tell the user node9 blocked this and why, then ask how to proceed.`;
+- Tell the user node9 blocked this and why, then ask how to proceed.`
+    );
   }
   if (label2.includes("sql safety") && label2.includes("update without where")) {
-    return `NODE9: Blocked \u2014 UPDATE without WHERE clause would update every row.
+    return withUserLine(
+      blockedLine(context, "UPDATE without WHERE would change every row"),
+      `NODE9: Blocked \u2014 UPDATE without WHERE clause would update every row.
 INSTRUCTION: Add a WHERE clause to scope the update (e.g. WHERE id = <value>).
 Do NOT retry without a WHERE clause.
-- Tell the user node9 blocked this and why, then ask how to proceed.`;
+- Tell the user node9 blocked this and why, then ask how to proceed.`
+    );
   }
   if (label2.includes("dangerous word")) {
     const match = blockedByLabel.match(/dangerous word: "([^"]+)"/i);
     const word = match?.[1] ?? "a dangerous keyword";
-    return `NODE9: Blocked \u2014 command contains forbidden keyword "${word}".
+    return withUserLine(
+      blockedLine(context, `the command contains ${userLineValue(word)}`),
+      `NODE9: Blocked \u2014 command contains forbidden keyword "${word}".
 INSTRUCTION: Do NOT use "${word}". Use a non-destructive alternative.
 Do NOT attempt to bypass this with shell tricks or aliases \u2014 it will be blocked again.
-- Tell the user node9 blocked this and why, then ask how to proceed.`;
+- Tell the user node9 blocked this and why, then ask how to proceed.`
+    );
   }
   if (label2.includes("path blocked") || label2.includes("sandbox")) {
-    return `NODE9: Blocked \u2014 operation targets a path outside the allowed sandbox.
+    return withUserLine(
+      blockedLine(context, "this path is outside the allowed sandbox"),
+      `NODE9: Blocked \u2014 operation targets a path outside the allowed sandbox.
 INSTRUCTION: Move your output to an allowed directory such as /tmp/ or the project directory.
 Do NOT retry on the same path.
-- Tell the user node9 blocked this and why, then ask how to proceed.`;
+- Tell the user node9 blocked this and why, then ask how to proceed.`
+    );
   }
   if (label2.includes("inline execution")) {
-    return `NODE9: Blocked \u2014 inline code execution (e.g. bash -c "...") is not allowed.
+    return withUserLine(
+      blockedLine(context, "inline code execution is not allowed"),
+      `NODE9: Blocked \u2014 inline code execution (e.g. bash -c "...") is not allowed.
 INSTRUCTION: Use individual tool calls instead of embedding code in a shell string.
-- Tell the user node9 blocked this and why, then ask how to proceed.`;
+- Tell the user node9 blocked this and why, then ask how to proceed.`
+    );
   }
   if (label2.includes("strict mode")) {
-    return `NODE9: Blocked \u2014 the Block all level is on. All tool calls require explicit human approval.
-INSTRUCTION: Inform the user this action is pending approval. Wait for them to approve via the dashboard or run "node9 pause".`;
+    return withUserLine(
+      "Node9: the Block all level is on, so every action needs your approval",
+      `NODE9: Blocked \u2014 the Block all level is on. All tool calls require explicit human approval.
+INSTRUCTION: Inform the user this action is pending approval. Wait for them to approve via the dashboard or run "node9 pause".`
+    );
   }
   if (label2.includes("rule") && label2.includes("default block")) {
     const match = blockedByLabel.match(/rule "([^"]+)"/i);
-    const rule = match?.[1] ?? "a policy rule";
-    return `NODE9: Blocked \u2014 action "${rule}" is forbidden by security policy.
-INSTRUCTION: Do NOT use "${rule}". Find a read-only or non-destructive alternative.
+    const rule2 = match?.[1] ?? "a policy rule";
+    return withUserLine(
+      blockedLine(context, `${userLineValue(rule2)} is not allowed by policy`),
+      `NODE9: Blocked \u2014 action "${rule2}" is forbidden by security policy.
+INSTRUCTION: Do NOT use "${rule2}". Find a read-only or non-destructive alternative.
 Do NOT attempt to bypass this rule.
-- Tell the user node9 blocked this and why, then ask how to proceed.`;
+- Tell the user node9 blocked this and why, then ask how to proceed.`
+    );
+  }
+  const timedOut = label2.includes("approval timeout");
+  const rule = ruleWhat(context?.ruleDescription);
+  let line;
+  if (timedOut) {
+    line = rule ? `Node9 blocked: no one approved this in time (${rule.replace(/ \(([^()]+)\)$/, ", $1")})` : "Node9 blocked: no one approved this in time";
+  } else if (rule) {
+    line = `Node9 blocked: ${rule}`;
+  } else {
+    const why = reasonSentence(humanReason);
+    line = why ? `Node9 blocked: ${why}` : `Node9 blocked this action (${userLinePart(agentFacingLabel(blockedByLabel))})`;
   }
   const recovery = recoveryCommand ? `
 REQUIRED ACTION: Run \`${recoveryCommand}\` first, then retry your original command.` : "\n- Pivot to a non-destructive or read-only alternative.";
-  return `NODE9: Action blocked by security policy [${agentFacingLabel(blockedByLabel)}].
+  return withUserLine(
+    line,
+    `NODE9: Action blocked by security policy [${agentFacingLabel(blockedByLabel)}].
 INSTRUCTIONS:
 - Do NOT retry this exact command or attempt to bypass the rule.${recovery}
-- Inform the user which security rule was triggered and ask how to proceed.`;
+- Inform the user which security rule was triggered and ask how to proceed.`
+  );
 }
 function buildReviewMessage(blockedByLabel, ruleDescription, reason) {
   const why = ruleDescription || (reason && reason !== blockedByLabel ? reason : void 0) || blockedByLabel || "this action needs your review";
@@ -24264,7 +24387,7 @@ function isHumanDecision(label2, blockedBy, decidedBy) {
   return l.includes("user") || l.includes("daemon") || l.includes("decision");
 }
 function agentFacingLabel(label2) {
-  const plain = label2.replace(/[\p{Extended_Pictographic}\u200D\uFE0F]/gu, "").replace(/\bNode9\b/g, "node9").replace(/\s+/g, " ").trim();
+  const plain = label2.replace(PICTOGRAPHS, "").replace(/\bNode9\b/g, "node9").replace(/\s+/g, " ").trim();
   return plain || "Security Policy";
 }
 var BLOCKED_BY = " is blocked by ";
@@ -26308,6 +26431,109 @@ function canonicalToolInput(rawToolName, input) {
   return canonical;
 }
 
+// src/utils/own-dir.ts
+init_cjs_shims();
+var import_fs33 = __toESM(require("fs"));
+var import_path35 = __toESM(require("path"));
+var SESSION_FLAG_SUFFIX = ".node9-flag";
+var SESSION_FLAG_NAME = /^[A-Za-z0-9_-]{1,128}\.node9-flag$/;
+function isSessionFlagName(name) {
+  return SESSION_FLAG_NAME.test(name);
+}
+function ownRealDir(st) {
+  if (st.isSymbolicLink() || !st.isDirectory()) return false;
+  return typeof process.getuid !== "function" || st.uid === process.getuid();
+}
+function ensureOwnDir(dir2) {
+  try {
+    import_fs33.default.mkdirSync(dir2, { recursive: true, mode: 448 });
+    const st = import_fs33.default.lstatSync(dir2);
+    return ownRealDir(st) ? { dev: st.dev, ino: st.ino } : null;
+  } catch {
+    return null;
+  }
+}
+function isSameOwnDir(dir2, seen) {
+  try {
+    const st = import_fs33.default.lstatSync(dir2);
+    return ownRealDir(st) && st.dev === seen.dev && st.ino === seen.ino;
+  } catch {
+    return false;
+  }
+}
+function removeOldFlag(dir2, seen, name, cutoffMs) {
+  if (!isSessionFlagName(name)) return;
+  const p = import_path35.default.join(dir2, name);
+  try {
+    const st = import_fs33.default.lstatSync(p);
+    if (!st.isFile() || st.mtimeMs >= cutoffMs) return;
+    if (!isSameOwnDir(dir2, seen)) return;
+    import_fs33.default.unlinkSync(p);
+  } catch {
+  }
+}
+
+// src/notices/session-notice.ts
+init_cjs_shims();
+var import_fs34 = __toESM(require("fs"));
+var import_os26 = __toESM(require("os"));
+var import_path36 = __toESM(require("path"));
+init_dist();
+var ICON = "\u{1F6E1}\uFE0F";
+var LEVEL_NAMES = {
+  audit: "Audit",
+  soft: "Soft",
+  standard: "Standard",
+  strict: "Strict",
+  "block-all": "Block all"
+};
+var SESSION_NOTICE_INSTRUCTION = "Start your next reply to the user with the line above, exactly as written, on its own line.";
+var FLAG_TTL_MS = 7 * 24 * 60 * 60 * 1e3;
+var SAFE_SESSION_ID = /^[A-Za-z0-9_-]{1,128}$/;
+function sessionNoticeLine(mode) {
+  const level = levelOf(mode);
+  if (level === "audit") {
+    return `${ICON} Node9 is in Audit mode: actions are logged, nothing is blocked.`;
+  }
+  return `${ICON} Node9 is on (${LEVEL_NAMES[level]}). Every action in this session is checked.`;
+}
+function sessionNoticeOutput(mode) {
+  const line = sessionNoticeLine(mode);
+  return JSON.stringify({
+    hookSpecificOutput: {
+      hookEventName: "PreToolUse",
+      additionalContext: `${line}
+${SESSION_NOTICE_INSTRUCTION}`
+    },
+    systemMessage: line
+  });
+}
+function sessionNoticeEnabled(env = process.env) {
+  if (env.NODE9_SESSION_NOTICE === "1") return true;
+  return env.NODE9_TESTING !== "1";
+}
+function claimSessionNotice(sessionId, home = import_os26.default.homedir()) {
+  if (!sessionId || !SAFE_SESSION_ID.test(sessionId)) return false;
+  const dir2 = import_path36.default.join(home, ".node9", "notice-sessions");
+  const seen = ensureOwnDir(dir2);
+  if (!seen) return false;
+  try {
+    if (!isSameOwnDir(dir2, seen)) return false;
+    import_fs34.default.closeSync(import_fs34.default.openSync(import_path36.default.join(dir2, sessionId + SESSION_FLAG_SUFFIX), "wx"));
+  } catch {
+    return false;
+  }
+  removeOldFlags(dir2, seen);
+  return true;
+}
+function removeOldFlags(dir2, seen) {
+  const cutoff = Date.now() - FLAG_TTL_MS;
+  try {
+    for (const name of import_fs34.default.readdirSync(dir2)) removeOldFlag(dir2, seen, name, cutoff);
+  } catch {
+  }
+}
+
 // src/cli/commands/check.ts
 function detectAiAgent(payload) {
   const meta = payload.meta;
@@ -26386,9 +26612,9 @@ function registerCheckCommand(program2) {
         } catch (err) {
           const tempConfig = getConfig();
           if (process.env.NODE9_DEBUG === "1" || tempConfig.settings.enableHookLogDebug) {
-            const logPath = import_path35.default.join(import_os26.default.homedir(), ".node9", "hook-debug.log");
+            const logPath = import_path37.default.join(import_os27.default.homedir(), ".node9", "hook-debug.log");
             const errMsg = err instanceof Error ? err.message : String(err);
-            import_fs33.default.appendFileSync(
+            import_fs35.default.appendFileSync(
               logPath,
               `[${(/* @__PURE__ */ new Date()).toISOString()}] JSON_PARSE_ERROR: ${errMsg}
 RAW: ${raw}
@@ -26401,14 +26627,14 @@ RAW: ${raw}
           const prompt = typeof payload.prompt === "string" ? payload.prompt : "";
           if (process.env.NODE9_DEBUG === "1") {
             try {
-              const logPath = import_path35.default.join(import_os26.default.homedir(), ".node9", "hook-debug.log");
-              if (!import_fs33.default.existsSync(import_path35.default.dirname(logPath)))
-                import_fs33.default.mkdirSync(import_path35.default.dirname(logPath), { recursive: true });
+              const logPath = import_path37.default.join(import_os27.default.homedir(), ".node9", "hook-debug.log");
+              if (!import_fs35.default.existsSync(import_path37.default.dirname(logPath)))
+                import_fs35.default.mkdirSync(import_path37.default.dirname(logPath), { recursive: true });
               const sanitized = JSON.stringify({
                 ...payload,
                 prompt: `<redacted, ${prompt.length} bytes>`
               });
-              import_fs33.default.appendFileSync(logPath, `[${(/* @__PURE__ */ new Date()).toISOString()}] STDIN: ${sanitized}
+              import_fs35.default.appendFileSync(logPath, `[${(/* @__PURE__ */ new Date()).toISOString()}] STDIN: ${sanitized}
 `);
             } catch {
             }
@@ -26426,7 +26652,7 @@ RAW: ${raw}
           if (!dlpMatch && !canaryHit) {
             try {
               const sid = typeof payload.session_id === "string" ? payload.session_id : typeof payload.conversationId === "string" ? payload.conversationId : "";
-              const promptCwd = typeof payload.cwd === "string" && import_path35.default.isAbsolute(payload.cwd) ? payload.cwd : void 0;
+              const promptCwd = typeof payload.cwd === "string" && import_path37.default.isAbsolute(payload.cwd) ? payload.cwd : void 0;
               if (sid && getConfig(promptCwd).policy.untrustedContent?.enabled) {
                 await notifyUserMentions(sid, extractContentDestinations(prompt));
               }
@@ -26467,8 +26693,8 @@ RAW: ${raw}
           );
           const reason = `\u{1F6A8} Node9 DLP: ${shownPattern} detected in prompt (${shownSample}). Prompt was not submitted \u2014 remove the credential and try again.`;
           try {
-            const ttyFd = import_fs33.default.openSync("/dev/tty", "w");
-            import_fs33.default.writeSync(
+            const ttyFd = import_fs35.default.openSync("/dev/tty", "w");
+            import_fs35.default.writeSync(
               ttyFd,
               import_chalk2.default.bgRed.white.bold(`
  \u{1F6A8} NODE9 DLP \u2014 PROMPT BLOCKED 
@@ -26478,7 +26704,7 @@ RAW: ${raw}
 
 `)
             );
-            import_fs33.default.closeSync(ttyFd);
+            import_fs35.default.closeSync(ttyFd);
           } catch {
           }
           const isCodex = agent2 === "Codex";
@@ -26497,17 +26723,17 @@ RAW: ${raw}
           process.exit(2);
         }
         const payloadCwd = typeof payload.cwd === "string" ? payload.cwd : Array.isArray(payload.workspacePaths) && typeof payload.workspacePaths[0] === "string" ? payload.workspacePaths[0] : void 0;
-        const safeCwdForConfig = typeof payloadCwd === "string" && import_path35.default.isAbsolute(payloadCwd) ? payloadCwd : void 0;
+        const safeCwdForConfig = typeof payloadCwd === "string" && import_path37.default.isAbsolute(payloadCwd) ? payloadCwd : void 0;
         const config = getConfig(safeCwdForConfig);
         const daemonDown = !isDaemonRunning();
         if (config.settings.autoStartDaemon && daemonDown && !process.env.NODE9_NO_AUTO_DAEMON) {
           try {
             const scriptPath = process.argv[1];
-            if (typeof scriptPath !== "string" || !import_path35.default.isAbsolute(scriptPath))
+            if (typeof scriptPath !== "string" || !import_path37.default.isAbsolute(scriptPath))
               throw new Error("node9: argv[1] is not an absolute path");
-            const resolvedScript = import_fs33.default.realpathSync(scriptPath);
-            const packageDist = import_fs33.default.realpathSync(import_path35.default.resolve(__dirname, "../.."));
-            if (!resolvedScript.startsWith(packageDist + import_path35.default.sep) && resolvedScript !== packageDist)
+            const resolvedScript = import_fs35.default.realpathSync(scriptPath);
+            const packageDist = import_fs35.default.realpathSync(import_path37.default.resolve(__dirname, "../.."));
+            if (!resolvedScript.startsWith(packageDist + import_path37.default.sep) && resolvedScript !== packageDist)
               throw new Error(
                 `node9: daemon spawn aborted \u2014 argv[1] (${resolvedScript}) is outside package dist (${packageDist})`
               );
@@ -26537,17 +26763,17 @@ RAW: ${raw}
             } finally {
               if (startupFd !== void 0) {
                 try {
-                  import_fs33.default.closeSync(startupFd);
+                  import_fs35.default.closeSync(startupFd);
                 } catch {
                 }
               }
             }
           } catch (spawnErr) {
-            const logPath = import_path35.default.join(import_os26.default.homedir(), ".node9", "hook-debug.log");
+            const logPath = import_path37.default.join(import_os27.default.homedir(), ".node9", "hook-debug.log");
             const msg = spawnErr instanceof Error ? spawnErr.message : String(spawnErr);
             recordStartupState("failed", "spawn-aborted", msg);
             try {
-              import_fs33.default.appendFileSync(
+              import_fs35.default.appendFileSync(
                 logPath,
                 `[${(/* @__PURE__ */ new Date()).toISOString()}] daemon-autostart-failed: ${msg}
 `
@@ -26561,10 +26787,10 @@ RAW: ${raw}
           );
         }
         if (process.env.NODE9_DEBUG === "1" || config.settings.enableHookLogDebug) {
-          const logPath = import_path35.default.join(import_os26.default.homedir(), ".node9", "hook-debug.log");
-          if (!import_fs33.default.existsSync(import_path35.default.dirname(logPath)))
-            import_fs33.default.mkdirSync(import_path35.default.dirname(logPath), { recursive: true });
-          import_fs33.default.appendFileSync(
+          const logPath = import_path37.default.join(import_os27.default.homedir(), ".node9", "hook-debug.log");
+          if (!import_fs35.default.existsSync(import_path37.default.dirname(logPath)))
+            import_fs35.default.mkdirSync(import_path37.default.dirname(logPath), { recursive: true });
+          import_fs35.default.appendFileSync(
             logPath,
             `[${(/* @__PURE__ */ new Date()).toISOString()}] STDIN: ${JSON.stringify(raw)}
 `
@@ -26585,8 +26811,8 @@ RAW: ${raw}
           );
           let ttyFd = null;
           try {
-            ttyFd = import_fs33.default.openSync("/dev/tty", "w");
-            const writeTty = (line) => import_fs33.default.writeSync(ttyFd, line + "\n");
+            ttyFd = import_fs35.default.openSync("/dev/tty", "w");
+            const writeTty = (line) => import_fs35.default.writeSync(ttyFd, line + "\n");
             if (result2?.blockKind === "protected-path") {
               writeTty(
                 import_chalk2.default.red.bold(
@@ -26613,7 +26839,7 @@ RAW: ${raw}
           } finally {
             if (ttyFd !== null)
               try {
-                import_fs33.default.closeSync(ttyFd);
+                import_fs35.default.closeSync(ttyFd);
               } catch {
               }
           }
@@ -26622,7 +26848,12 @@ RAW: ${raw}
             humanDecision,
             msg,
             result2?.recoveryCommand,
-            { kind: result2?.blockKind, path: result2?.blockedPath, redirect: !!result2?.redirect }
+            {
+              kind: result2?.blockKind,
+              path: result2?.blockedPath,
+              redirect: !!result2?.redirect,
+              ruleDescription: result2?.ruleDescription
+            }
           );
           if (agent === "Antigravity") {
             process.stdout.write(
@@ -26639,11 +26870,13 @@ RAW: ${raw}
             );
             process.exit(0);
           }
+          const userLine = userLineOf(aiFeedbackMessage);
           process.stdout.write(
             JSON.stringify({
               decision: "block",
               reason: aiFeedbackMessage,
               // This is the core instruction
+              ...agent === "Claude Code" && userLine ? { systemMessage: userLine } : {},
               hookSpecificOutput: {
                 hookEventName: "PreToolUse",
                 permissionDecision: "deny",
@@ -26677,8 +26910,8 @@ RAW: ${raw}
           } catch {
           }
           try {
-            const ttyFd = import_fs33.default.openSync("/dev/tty", "w");
-            import_fs33.default.writeSync(
+            const ttyFd = import_fs35.default.openSync("/dev/tty", "w");
+            import_fs35.default.writeSync(
               ttyFd,
               import_chalk2.default.yellow(
                 `
@@ -26686,7 +26919,7 @@ RAW: ${raw}
 `
               )
             );
-            import_fs33.default.closeSync(ttyFd);
+            import_fs35.default.closeSync(ttyFd);
           } catch {
           }
           if (agent === "GitHub Copilot") {
@@ -26718,17 +26951,20 @@ RAW: ${raw}
         const safeSessionId = /^[A-Za-z0-9_\-]{1,128}$/.test(rawSessionId) ? rawSessionId : "";
         if (skillPinCfg.enabled && safeSessionId) {
           try {
-            const sessionsDir = import_path35.default.join(import_os26.default.homedir(), ".node9", "skill-sessions");
-            const flagPath = import_path35.default.join(sessionsDir, `${safeSessionId}.json`);
+            const sessionsDir = import_path37.default.join(import_os27.default.homedir(), ".node9", "skill-sessions");
+            const flagPath = import_path37.default.join(sessionsDir, `${safeSessionId}${SESSION_FLAG_SUFFIX}`);
+            const memo = ensureOwnDir(sessionsDir);
             let flag = null;
             try {
-              flag = JSON.parse(import_fs33.default.readFileSync(flagPath, "utf-8"));
+              const st = memo ? import_fs35.default.lstatSync(flagPath) : null;
+              if (st && st.isFile() && st.nlink === 1)
+                flag = JSON.parse(import_fs35.default.readFileSync(flagPath, "utf-8"));
             } catch {
             }
             const writeFlag = (data2) => {
+              if (!memo || !isSameOwnDir(sessionsDir, memo)) return;
               try {
-                import_fs33.default.mkdirSync(sessionsDir, { recursive: true });
-                import_fs33.default.writeFileSync(
+                atomicWriteSync(
                   flagPath,
                   JSON.stringify({ ...data2, timestamp: (/* @__PURE__ */ new Date()).toISOString() }, null, 2),
                   { mode: 384 }
@@ -26739,8 +26975,8 @@ RAW: ${raw}
             const sendSkillWarn = (detail, recoveryCmd) => {
               let ttyFd = null;
               try {
-                ttyFd = import_fs33.default.openSync("/dev/tty", "w");
-                const w = (line) => import_fs33.default.writeSync(ttyFd, line + "\n");
+                ttyFd = import_fs35.default.openSync("/dev/tty", "w");
+                const w = (line) => import_fs35.default.writeSync(ttyFd, line + "\n");
                 w(import_chalk2.default.yellow(`
 \u26A0\uFE0F  Node9: installed skill drift detected`));
                 w(import_chalk2.default.gray(`   ${detail}`));
@@ -26755,7 +26991,7 @@ RAW: ${raw}
               } finally {
                 if (ttyFd !== null)
                   try {
-                    import_fs33.default.closeSync(ttyFd);
+                    import_fs35.default.closeSync(ttyFd);
                   } catch {
                   }
               }
@@ -26771,7 +27007,7 @@ RAW: ${raw}
               return;
             }
             if (!flag || flag.state !== "verified" && flag.state !== "warned") {
-              const absoluteCwd = typeof payloadCwd === "string" && import_path35.default.isAbsolute(payloadCwd) ? payloadCwd : void 0;
+              const absoluteCwd = typeof payloadCwd === "string" && import_path37.default.isAbsolute(payloadCwd) ? payloadCwd : void 0;
               const extraRoots = skillPinCfg.roots;
               const resolvedExtra = extraRoots.map((r) => resolveUserSkillRoot(r, absoluteCwd)).filter((r) => typeof r === "string");
               const roots = [...defaultSkillRoots(absoluteCwd), ...resolvedExtra];
@@ -26810,31 +27046,27 @@ RAW: ${raw}
               } else {
                 writeFlag({ state: "verified" });
               }
-              try {
-                const cutoff = Date.now() - 7 * 24 * 60 * 60 * 1e3;
-                for (const name of import_fs33.default.readdirSync(sessionsDir)) {
-                  const p = import_path35.default.join(sessionsDir, name);
-                  try {
-                    if (import_fs33.default.statSync(p).mtimeMs < cutoff) import_fs33.default.unlinkSync(p);
-                  } catch {
-                  }
+              if (memo)
+                try {
+                  const cutoff = Date.now() - 7 * 24 * 60 * 60 * 1e3;
+                  for (const name of import_fs35.default.readdirSync(sessionsDir))
+                    removeOldFlag(sessionsDir, memo, name, cutoff);
+                } catch {
                 }
-              } catch {
-              }
             }
           } catch (err) {
             if (process.env.NODE9_DEBUG === "1") {
               try {
-                const dbg = import_path35.default.join(import_os26.default.homedir(), ".node9", "hook-debug.log");
+                const dbg = import_path37.default.join(import_os27.default.homedir(), ".node9", "hook-debug.log");
                 const msg = err instanceof Error ? err.message : String(err);
-                import_fs33.default.appendFileSync(dbg, `[${(/* @__PURE__ */ new Date()).toISOString()}] SKILL_PIN_ERROR: ${msg}
+                import_fs35.default.appendFileSync(dbg, `[${(/* @__PURE__ */ new Date()).toISOString()}] SKILL_PIN_ERROR: ${msg}
 `);
               } catch {
               }
             }
           }
         }
-        const safeCwdForAuth = typeof payloadCwd === "string" && import_path35.default.isAbsolute(payloadCwd) ? payloadCwd : void 0;
+        const safeCwdForAuth = typeof payloadCwd === "string" && import_path37.default.isAbsolute(payloadCwd) ? payloadCwd : void 0;
         const askMode = resolveAskMode(agent, opts, config);
         const result = await authorizeHeadless(toolName, toolInput, meta, {
           cwd: safeCwdForAuth,
@@ -26847,11 +27079,21 @@ RAW: ${raw}
           } catch {
           }
         }
+        const isSubagentCall = typeof payload.agent_id === "string" && payload.agent_id !== "";
+        const allowExit = (checkedBy) => {
+          if (checkedBy !== "paused" && agent === "Claude Code" && !isSubagentCall && sessionNoticeEnabled() && claimSessionNotice(safeSessionId)) {
+            try {
+              import_fs35.default.writeSync(1, sessionNoticeOutput(config.settings.mode) + "\n");
+            } catch {
+            }
+          }
+          process.exit(0);
+        };
         if (result.approved) {
           if (result.checkedBy && process.env.NODE9_DEBUG === "1")
             process.stderr.write(`\u2713 node9 [${result.checkedBy}]: "${toolName}" allowed
 `);
-          process.exit(0);
+          allowExit(result.checkedBy);
         }
         if (result.review) {
           sendAsk(result);
@@ -26859,12 +27101,12 @@ RAW: ${raw}
         }
         if (result.noApprovalMechanism && !isDaemonRunning() && !process.env.NODE9_NO_AUTO_DAEMON && !process.stdout.isTTY && config.settings.autoStartDaemon) {
           try {
-            const tty = import_fs33.default.openSync("/dev/tty", "w");
-            import_fs33.default.writeSync(
+            const tty = import_fs35.default.openSync("/dev/tty", "w");
+            import_fs35.default.writeSync(
               tty,
               import_chalk2.default.cyan("\n\u{1F6E1}\uFE0F  Node9: Starting approval daemon automatically...\n")
             );
-            import_fs33.default.closeSync(tty);
+            import_fs35.default.closeSync(tty);
           } catch {
           }
           const daemonReady = await autoStartDaemonAndWait();
@@ -26876,7 +27118,7 @@ RAW: ${raw}
               if (retry.checkedBy && process.env.NODE9_DEBUG === "1")
                 process.stderr.write(`\u2713 node9 [${retry.checkedBy}]: "${toolName}" allowed
 `);
-              process.exit(0);
+              allowExit(retry.checkedBy);
             }
             sendBlock(retry.reason ?? `Node9 blocked "${toolName}".`, {
               ...retry,
@@ -26891,9 +27133,9 @@ RAW: ${raw}
         });
       } catch (err) {
         if (process.env.NODE9_DEBUG === "1") {
-          const logPath = import_path35.default.join(import_os26.default.homedir(), ".node9", "hook-debug.log");
+          const logPath = import_path37.default.join(import_os27.default.homedir(), ".node9", "hook-debug.log");
           const errMsg = err instanceof Error ? err.message : String(err);
-          import_fs33.default.appendFileSync(logPath, `[${(/* @__PURE__ */ new Date()).toISOString()}] ERROR: ${errMsg}
+          import_fs35.default.appendFileSync(logPath, `[${(/* @__PURE__ */ new Date()).toISOString()}] ERROR: ${errMsg}
 `);
         }
         process.exit(0);
@@ -26928,9 +27170,9 @@ RAW: ${raw}
 
 // src/cli/commands/log.ts
 init_cjs_shims();
-var import_fs34 = __toESM(require("fs"));
-var import_path36 = __toESM(require("path"));
-var import_os27 = __toESM(require("os"));
+var import_fs36 = __toESM(require("fs"));
+var import_path38 = __toESM(require("path"));
+var import_os28 = __toESM(require("os"));
 init_audit();
 init_dist();
 
@@ -27198,12 +27440,12 @@ function registerLogCommand(program2) {
         if (rawToolName !== tool) entry.agentToolName = rawToolName;
         const payloadSessionId = payload.session_id ?? payload.conversationId;
         if (payloadSessionId) entry.sessionId = payloadSessionId;
-        const logPath = import_path36.default.join(import_os27.default.homedir(), ".node9", "audit.log");
-        if (!import_fs34.default.existsSync(import_path36.default.dirname(logPath)))
-          import_fs34.default.mkdirSync(import_path36.default.dirname(logPath), { recursive: true });
-        import_fs34.default.appendFileSync(logPath, JSON.stringify(entry) + "\n");
+        const logPath = import_path38.default.join(import_os28.default.homedir(), ".node9", "audit.log");
+        if (!import_fs36.default.existsSync(import_path38.default.dirname(logPath)))
+          import_fs36.default.mkdirSync(import_path38.default.dirname(logPath), { recursive: true });
+        import_fs36.default.appendFileSync(logPath, JSON.stringify(entry) + "\n");
         const payloadCwd = typeof payload.cwd === "string" ? payload.cwd : Array.isArray(payload.workspacePaths) && typeof payload.workspacePaths[0] === "string" ? payload.workspacePaths[0] : void 0;
-        const safeCwd = typeof payloadCwd === "string" && import_path36.default.isAbsolute(payloadCwd) ? payloadCwd : void 0;
+        const safeCwd = typeof payloadCwd === "string" && import_path38.default.isAbsolute(payloadCwd) ? payloadCwd : void 0;
         if ((tool === "Bash" || tool === "bash") && isDaemonRunning()) {
           const command = typeof rawInput === "object" && rawInput !== null && "command" in rawInput && typeof rawInput.command === "string" ? rawInput.command : null;
           if (command) {
@@ -27424,9 +27666,9 @@ function registerLogCommand(program2) {
         const msg = err instanceof Error ? err.message : String(err);
         process.stderr.write(`[Node9] audit log error: ${msg}
 `);
-        const debugPath = import_path36.default.join(import_os27.default.homedir(), ".node9", "hook-debug.log");
+        const debugPath = import_path38.default.join(import_os28.default.homedir(), ".node9", "hook-debug.log");
         try {
-          import_fs34.default.appendFileSync(debugPath, `[${(/* @__PURE__ */ new Date()).toISOString()}] LOG_ERROR: ${msg}
+          import_fs36.default.appendFileSync(debugPath, `[${(/* @__PURE__ */ new Date()).toISOString()}] LOG_ERROR: ${msg}
 `);
         } catch {
         }
@@ -27449,9 +27691,9 @@ function registerLogCommand(program2) {
   });
 }
 function absolutePathFor(spelled, cwd) {
-  const expanded = spelled === "~" || spelled.startsWith("~/") ? import_path36.default.join(import_os27.default.homedir(), spelled.slice(1)) : spelled;
-  if (import_path36.default.isAbsolute(expanded)) return expanded;
-  return cwd ? import_path36.default.resolve(cwd, expanded) : import_path36.default.resolve(expanded);
+  const expanded = spelled === "~" || spelled.startsWith("~/") ? import_path38.default.join(import_os28.default.homedir(), spelled.slice(1)) : spelled;
+  if (import_path38.default.isAbsolute(expanded)) return expanded;
+  return cwd ? import_path38.default.resolve(cwd, expanded) : import_path38.default.resolve(expanded);
 }
 async function carryTaintAcrossWrites(command, cwd) {
   let pairs;
@@ -27470,13 +27712,13 @@ async function carryTaintAcrossWrites(command, cwd) {
       continue;
     }
     const sensitive = scanFilePath(src, cwd);
-    if (sensitive) await notifyTaint(dst, `copy:${sensitive.patternName}:${import_path36.default.basename(src)}`);
+    if (sensitive) await notifyTaint(dst, `copy:${sensitive.patternName}:${import_path38.default.basename(src)}`);
   }
 }
 
 // src/hook-entry.ts
 var { version } = JSON.parse(
-  import_fs35.default.readFileSync(import_path37.default.join(__dirname, "../package.json"), "utf-8")
+  import_fs37.default.readFileSync(import_path39.default.join(__dirname, "../package.json"), "utf-8")
 );
 var program = new import_commander.Command();
 program.name("node9").description("The Sudo Command for AI Agents").version(version);
@@ -27485,9 +27727,9 @@ registerLogCommand(program);
 process.on("unhandledRejection", (reason) => {
   if (process.argv[2] === "check") {
     if (process.env.NODE9_DEBUG === "1" || getConfig().settings.enableHookLogDebug) {
-      const logPath = import_path37.default.join(import_os28.default.homedir(), ".node9", "hook-debug.log");
+      const logPath = import_path39.default.join(import_os29.default.homedir(), ".node9", "hook-debug.log");
       const msg = reason instanceof Error ? reason.message : String(reason);
-      import_fs35.default.appendFileSync(logPath, `[${(/* @__PURE__ */ new Date()).toISOString()}] UNHANDLED: ${msg}
+      import_fs37.default.appendFileSync(logPath, `[${(/* @__PURE__ */ new Date()).toISOString()}] UNHANDLED: ${msg}
 `);
     }
     process.exit(0);