@fml-inc/fml 0.8.7 → 0.8.9

package/dist/pi/extension.js

@@ -1,1227 +1,699 @@
-// src/pi/extension.ts
-import { randomUUID as randomUUID3 } from "node:crypto";
-import fs4 from "node:fs";
-import os2 from "node:os";
-import path7 from "node:path";
+var __defProp = Object.defineProperty;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
 
-// ../../packages/agent-targets/src/install/pi/index.ts
-import fs from "node:fs";
-import path from "node:path";
-import { randomUUID } from "node:crypto";
-var FML_PI_EXTENSION_MARKER = "__FML_PI_EXTENSION_V1__";
-var LEGACY_PI_EXTENSION_MARKER = "__panopticonPiExtensionTest";
-var LEGACY_PI_EXTENSION_SIGNATURES = Object.freeze([
-  "PANOPTICON_PORT",
-  '"/hooks"',
-  "UserPromptSubmit",
-  "PreToolUse",
-  "PostToolUse",
-  "SessionEnd"
-]);
-function pathApiFor(platform) {
-  return platform === "win32" ? path.win32 : path.posix;
+// src/dirs.ts
+import os from "node:os";
+import path3 from "node:path";
+function isPresent(value) {
+  return value !== void 0 && value.trim().length > 0;
 }
-function resolvePiAgentDir(context, pathApi) {
-  const configured = context.env.PI_CODING_AGENT_DIR?.trim();
-  if (!configured) {
-    return pathApi.join(context.homeDir, ".pi", "agent");
+function normalizeAbsolutePath(value, variableName, pathApi) {
+  if (!pathApi.isAbsolute(value)) {
+    throw new Error(`${variableName} must be an absolute path: ${value}`);
   }
-  if (configured === "~") return context.homeDir;
-  if (configured.startsWith("~/") || configured.startsWith("~\\")) {
-    return pathApi.join(context.homeDir, configured.slice(2));
+  return pathApi.normalize(value);
+}
+function explicitDirectory(value, variableName, pathApi) {
+  if (!isPresent(value)) return void 0;
+  return normalizeAbsolutePath(value, variableName, pathApi);
+}
+function platformBaseDirectory(value, pathApi) {
+  if (!isPresent(value) || !pathApi.isAbsolute(value)) return void 0;
+  return pathApi.normalize(value);
+}
+function resolveFmlDirectories(options = {}) {
+  const platform = options.platform ?? process.platform;
+  const env = options.env ?? process.env;
+  const pathApi = platform === "win32" ? path3.win32 : path3.posix;
+  const homeDir = normalizeAbsolutePath(
+    options.homeDir ?? os.homedir(),
+    "home directory",
+    pathApi
+  );
+  const explicitDataDir = explicitDirectory(
+    env.FML_DATA_DIR,
+    "FML_DATA_DIR",
+    pathApi
+  );
+  const explicitStateDir = explicitDirectory(
+    env.FML_STATE_DIR,
+    "FML_STATE_DIR",
+    pathApi
+  );
+  const explicitLogDir = explicitDirectory(
+    env.FML_LOG_DIR,
+    "FML_LOG_DIR",
+    pathApi
+  );
+  let defaultDataDir;
+  let defaultStateDir;
+  let nativeLogDir;
+  switch (platform) {
+    case "darwin": {
+      defaultDataDir = pathApi.join(
+        homeDir,
+        "Library",
+        "Application Support",
+        "fml"
+      );
+      defaultStateDir = defaultDataDir;
+      nativeLogDir = pathApi.join(homeDir, "Library", "Logs", "fml");
+      break;
+    }
+    case "win32": {
+      const roamingAppData = platformBaseDirectory(env.APPDATA, pathApi) ?? pathApi.join(homeDir, "AppData", "Roaming");
+      const localAppData = platformBaseDirectory(env.LOCALAPPDATA, pathApi) ?? pathApi.join(homeDir, "AppData", "Local");
+      defaultDataDir = pathApi.join(roamingAppData, "fml");
+      defaultStateDir = pathApi.join(localAppData, "fml");
+      break;
+    }
+    default: {
+      const xdgDataHome = platformBaseDirectory(env.XDG_DATA_HOME, pathApi) ?? pathApi.join(homeDir, ".local", "share");
+      const xdgStateHome = platformBaseDirectory(env.XDG_STATE_HOME, pathApi) ?? pathApi.join(homeDir, ".local", "state");
+      defaultDataDir = pathApi.join(xdgDataHome, "fml");
+      defaultStateDir = pathApi.join(xdgStateHome, "fml");
+      break;
+    }
   }
-  return pathApi.normalize(configured);
+  const dataDir = explicitDataDir ?? defaultDataDir;
+  const stateDir = explicitStateDir ?? explicitDataDir ?? defaultStateDir;
+  const defaultLogDir = nativeLogDir ?? (platform === "win32" ? pathApi.join(defaultDataDir, "logs") : pathApi.join(defaultStateDir, "log"));
+  const explicitObserverDir = explicitDirectory(
+    env.FML_OBSERVER_DIR,
+    "FML_OBSERVER_DIR",
+    pathApi
+  );
+  const legacyPanopticonHome = explicitDirectory(
+    env.PANOPTICON_HOME,
+    "PANOPTICON_HOME",
+    pathApi
+  );
+  const fmlHome = explicitDirectory(env.FML_HOME, "FML_HOME", pathApi);
+  return {
+    dataDir,
+    stateDir,
+    logDir: explicitLogDir ?? defaultLogDir,
+    observerDir: explicitObserverDir ?? legacyPanopticonHome ?? (fmlHome ? pathApi.join(fmlHome, "panopticon") : pathApi.join(homeDir, ".fml", "panopticon"))
+  };
 }
-function readFileIfPresent(filePath) {
+function observerPort() {
+  const configured = process.env.FML_OBSERVER_PORT ?? process.env.PANOPTICON_PORT;
+  if (configured) {
+    const parsed = Number.parseInt(configured, 10);
+    if (Number.isInteger(parsed) && parsed > 0 && parsed <= 65535) {
+      return parsed;
+    }
+  }
+  return 4318 + (process.getuid?.() ?? 0) % 100;
+}
+var DIRECTORIES, FML_DATA_DIR, FML_STATE_DIR, FML_LOG_DIR, FML_OBSERVER_DIR, FML_OBSERVER_PORT, FML_OBSERVER_STATE_FILE, FML_OBSERVER_LOCK_FILE, FML_OBSERVER_AUTH_TOKEN_FILE, FML_OBSERVER_ENDPOINT_FILE, FML_OBSERVER_LOG_FILE, FML_UPDATE_LOG_FILE, FML_INSTALLATION_ID_FILE, FML_PANOPTICON_DB_FILE, FML_PANOPTICON_DB_OBSERVER_STATE_FILE, FML_PANOPTICON_DB_OBSERVER_LOCK_FILE, FML_LEGACY_OBSERVER_DB_FILE, FML_HOOK_INBOX_DIR, FML_HOOK_CONTEXT_STATE_DIR, FML_HOOK_CAPTURE_DISABLED_FILE;
+var init_dirs = __esm({
+  "src/dirs.ts"() {
+    "use strict";
+    DIRECTORIES = resolveFmlDirectories();
+    FML_DATA_DIR = DIRECTORIES.dataDir;
+    FML_STATE_DIR = DIRECTORIES.stateDir;
+    FML_LOG_DIR = DIRECTORIES.logDir;
+    FML_OBSERVER_DIR = DIRECTORIES.observerDir;
+    FML_OBSERVER_PORT = observerPort();
+    FML_OBSERVER_STATE_FILE = path3.join(
+      FML_OBSERVER_DIR,
+      "observer.pid.json"
+    );
+    FML_OBSERVER_LOCK_FILE = path3.join(
+      FML_OBSERVER_DIR,
+      "observer.lock"
+    );
+    FML_OBSERVER_AUTH_TOKEN_FILE = path3.join(
+      FML_OBSERVER_DIR,
+      "auth-token"
+    );
+    FML_OBSERVER_ENDPOINT_FILE = path3.join(
+      FML_OBSERVER_DIR,
+      "endpoint.json"
+    );
+    FML_OBSERVER_LOG_FILE = path3.join(FML_LOG_DIR, "observer.log");
+    FML_UPDATE_LOG_FILE = path3.join(FML_LOG_DIR, "update.log");
+    FML_INSTALLATION_ID_FILE = path3.join(
+      FML_STATE_DIR,
+      "installation_id"
+    );
+    FML_PANOPTICON_DB_FILE = path3.join(FML_STATE_DIR, "panopticon.db");
+    FML_PANOPTICON_DB_OBSERVER_STATE_FILE = `${FML_PANOPTICON_DB_FILE}.observer.pid.json`;
+    FML_PANOPTICON_DB_OBSERVER_LOCK_FILE = `${FML_PANOPTICON_DB_FILE}.observer.lock`;
+    FML_LEGACY_OBSERVER_DB_FILE = path3.join(
+      FML_OBSERVER_DIR,
+      "observer.db"
+    );
+    FML_HOOK_INBOX_DIR = path3.join(FML_OBSERVER_DIR, "hook-inbox");
+    FML_HOOK_CONTEXT_STATE_DIR = path3.join(
+      FML_OBSERVER_DIR,
+      "hook-context-state"
+    );
+    FML_HOOK_CAPTURE_DISABLED_FILE = path3.join(
+      FML_OBSERVER_DIR,
+      "hook-capture.disabled"
+    );
+  }
+});
+
+// src/config.ts
+import fs2 from "node:fs";
+import path4 from "node:path";
+function isHostedBackendUrl(url) {
+  let normalized;
   try {
-    return fs.readFileSync(filePath, "utf8");
-  } catch (error) {
-    if (error.code === "ENOENT") return null;
-    throw error;
+    normalized = normalizeConvexUrl(url);
+  } catch {
+    return false;
   }
+  return normalized === DEFAULT_PROD_URL || LEGACY_HOSTED_BACKEND_URLS.includes(normalized);
 }
-function isOwnedExtension(source, legacy = false) {
-  return source.includes(FML_PI_EXTENSION_MARKER) || legacy && (source.includes(LEGACY_PI_EXTENSION_MARKER) || LEGACY_PI_EXTENSION_SIGNATURES.every(
-    (signature) => source.includes(signature)
-  ));
+function isValidEnvName(envName) {
+  return ENV_NAME_RE.test(envName);
 }
-function removeLegacyExtension(filePath) {
-  const source = readFileIfPresent(filePath);
-  if (source === null) return { removed: false, preserved: false };
-  if (!isOwnedExtension(source, true)) {
-    return { removed: false, preserved: true };
+function normalizeConvexUrl(value) {
+  const url = new URL(value);
+  const loopback = url.hostname === "localhost" || url.hostname === "127.0.0.1" || url.hostname === "::1";
+  if (url.protocol !== "https:" && !(url.protocol === "http:" && loopback) || url.username || url.password || url.search || url.hash || url.pathname !== "" && url.pathname !== "/") {
+    throw new Error(
+      "FML environment URL must be HTTPS (HTTP is allowed only for loopback) with no path, credentials, query, or fragment"
+    );
   }
-  fs.rmSync(filePath);
-  return { removed: true, preserved: false };
+  return url.origin;
 }
-function writeExtensionAtomically(filePath, source) {
-  fs.mkdirSync(path.dirname(filePath), { recursive: true, mode: 448 });
-  const temporaryPath = path.join(
-    path.dirname(filePath),
-    `.${path.basename(filePath)}.${process.pid}.${randomUUID()}.tmp`
-  );
-  try {
-    fs.writeFileSync(temporaryPath, source, { encoding: "utf8", mode: 384 });
-    if (process.platform === "win32" && fs.existsSync(filePath)) {
-      fs.rmSync(filePath);
-    }
-    fs.renameSync(temporaryPath, filePath);
-  } finally {
-    fs.rmSync(temporaryPath, { force: true });
-  }
+function normalizeAppUrl(value) {
+  return normalizeConvexUrl(value);
 }
-var PI_EXTENSION_INSTALLER = Object.freeze({
-  resolvePaths(context) {
-    const pathApi = pathApiFor(context.platform);
-    const extensionsDir = pathApi.join(
-      resolvePiAgentDir(context, pathApi),
-      "extensions"
+function readEnvConfig() {
+  try {
+    const parsed = JSON.parse(
+      fs2.readFileSync(ENV_CONFIG_PATH, "utf8")
     );
-    return {
-      sourcePath: pathApi.join(
-        context.packageRoot,
-        "dist",
-        "pi",
-        "extension.js"
-      ),
-      extensionsDir,
-      destinationPath: pathApi.join(extensionsDir, "fml.js"),
-      legacyDestinationPath: pathApi.join(extensionsDir, "panopticon.js")
-    };
-  },
-  install(paths) {
-    const source = fs.readFileSync(paths.sourcePath, "utf8");
-    if (!source.includes(FML_PI_EXTENSION_MARKER)) {
-      throw new Error(
-        `Packaged Pi extension is invalid: ${paths.sourcePath} does not contain the FML ownership marker`
-      );
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+      throw new Error("invalid environment config");
     }
-    const existing = readFileIfPresent(paths.destinationPath);
-    if (existing !== null && !isOwnedExtension(existing)) {
-      const legacy2 = removeLegacyExtension(paths.legacyDestinationPath);
-      return {
-        status: "preserved",
-        destinationPath: paths.destinationPath,
-        reason: "an extension not managed by FML already exists at this path",
-        legacyRemoved: legacy2.removed,
-        legacyPreserved: legacy2.preserved
-      };
+    const config = parsed;
+    if (typeof config.active !== "string" || !isValidEnvName(config.active)) {
+      throw new Error("invalid active environment");
     }
-    const status = existing === null ? "installed" : existing === source ? "unchanged" : "updated";
-    if (status !== "unchanged") {
-      writeExtensionAtomically(paths.destinationPath, source);
+    const environments = {};
+    if (config.environments && typeof config.environments === "object" && !Array.isArray(config.environments)) {
+      for (const [name, environment] of Object.entries(
+        config.environments
+      )) {
+        if (!isValidEnvName(name) || !environment || typeof environment !== "object" || Array.isArray(environment)) {
+          continue;
+        }
+        const entry = environment;
+        if (typeof entry.convexUrl !== "string") continue;
+        try {
+          const appUrl = typeof entry.appUrl === "string" ? normalizeAppUrl(entry.appUrl) : void 0;
+          environments[name] = {
+            convexUrl: normalizeConvexUrl(entry.convexUrl),
+            ...appUrl ? { appUrl } : {}
+          };
+        } catch {
+        }
+      }
     }
-    const legacy = removeLegacyExtension(paths.legacyDestinationPath);
+    environments[DEFAULT_TARGET_NAME] = { convexUrl: DEFAULT_PROD_URL };
     return {
-      status,
-      destinationPath: paths.destinationPath,
-      legacyRemoved: legacy.removed,
-      legacyPreserved: legacy.preserved
+      schemaVersion: 1,
+      active: config.active,
+      environments
     };
-  },
-  uninstall(paths) {
-    const existing = readFileIfPresent(paths.destinationPath);
-    const legacy = removeLegacyExtension(paths.legacyDestinationPath);
-    if (existing === null) {
-      return {
-        status: "absent",
-        destinationPath: paths.destinationPath,
-        legacyRemoved: legacy.removed,
-        legacyPreserved: legacy.preserved
-      };
-    }
-    if (!isOwnedExtension(existing)) {
-      return {
-        status: "preserved",
-        destinationPath: paths.destinationPath,
-        reason: "the existing extension is not managed by FML",
-        legacyRemoved: legacy.removed,
-        legacyPreserved: legacy.preserved
-      };
-    }
-    fs.rmSync(paths.destinationPath);
+  } catch {
     return {
-      status: "removed",
-      destinationPath: paths.destinationPath,
-      legacyRemoved: legacy.removed,
-      legacyPreserved: legacy.preserved
+      schemaVersion: 1,
+      active: DEFAULT_TARGET_NAME,
+      environments: {
+        [DEFAULT_TARGET_NAME]: { convexUrl: DEFAULT_PROD_URL }
+      }
     };
   }
+}
+function resolveEnvConvexUrl(envName) {
+  const configured = readEnvConfig().environments?.[envName]?.convexUrl;
+  if (configured) return configured;
+  if (envName === DEFAULT_TARGET_NAME) return DEFAULT_PROD_URL;
+  return null;
+}
+function getActiveEnv() {
+  const config = readEnvConfig();
+  const name = config.active;
+  const stored = config.environments?.[name];
+  const override = process.env.FML_CONVEX_URL;
+  const convexUrl = override ? normalizeConvexUrl(override) : resolveEnvConvexUrl(name);
+  const appUrl = stored?.appUrl && stored.convexUrl === convexUrl ? stored.appUrl : null;
+  return { name, convexUrl, appUrl };
+}
+function authStorePathFor(envName) {
+  return path4.join(FML_DATA_DIR, `auth.${envName}.json`);
+}
+function getSiteUrlForConvexUrl(convexUrl) {
+  const explicit = process.env.CONVEX_SITE_URL;
+  if (explicit) return explicit.replace(/\/$/, "");
+  return (convexUrl ?? DEFAULT_PROD_URL).replace(/\/$/, "");
+}
+var DEFAULT_PROD_URL, DEFAULT_SYNC_URL, DEFAULT_TARGET_NAME, LEGACY_HOSTED_BACKEND_URLS, ENV_CONFIG_PATH, ENV_NAME_RE, CONVEX_URL, WORKOS_API_URL;
+var init_config = __esm({
+  "src/config.ts"() {
+    "use strict";
+    init_dirs();
+    DEFAULT_PROD_URL = "https://api.fml.inc";
+    DEFAULT_SYNC_URL = DEFAULT_PROD_URL;
+    DEFAULT_TARGET_NAME = "fml";
+    LEGACY_HOSTED_BACKEND_URLS = [
+      "https://trustworthy-chihuahua-382.convex.site"
+    ];
+    ENV_CONFIG_PATH = path4.join(FML_DATA_DIR, "env.json");
+    ENV_NAME_RE = /^[A-Za-z0-9_-]+$/;
+    CONVEX_URL = (process.env.FML_CONVEX_URL ?? getActiveEnv().convexUrl ?? DEFAULT_PROD_URL).replace(/\/$/, "");
+    WORKOS_API_URL = "https://api.workos.com";
+  }
 });
 
-// src/hooks/context.ts
-import { createHash as createHash3 } from "node:crypto";
-import path6 from "node:path";
-
-// ../../packages/agent-targets/src/hooks/normalize.ts
-import { createHash } from "node:crypto";
-
-// ../../packages/agent-targets/src/hooks/types.ts
-var HOOK_TARGETS = Object.freeze([
-  "claude",
-  "codex",
-  "gemini",
-  "grok",
-  "pi"
-]);
-
-// ../../packages/agent-targets/src/catalog/hook-events.json
-var hook_events_default = {
-  claude: [
-    "SessionStart",
-    "Setup",
-    "InstructionsLoaded",
-    "UserPromptSubmit",
-    "UserPromptExpansion",
-    "PreToolUse",
-    "PermissionRequest",
-    "PostToolUse",
-    "PostToolUseFailure",
-    "PostToolBatch",
-    "PermissionDenied",
-    "Notification",
-    "SubagentStart",
-    "SubagentStop",
-    "TaskCreated",
-    "TaskCompleted",
-    "Stop",
-    "StopFailure",
-    "TeammateIdle",
-    "ConfigChange",
-    "CwdChanged",
-    "PreCompact",
-    "PostCompact",
-    "SessionEnd",
-    "Elicitation",
-    "ElicitationResult"
-  ],
-  codex: [
-    "SessionStart",
-    "UserPromptSubmit",
-    "PreToolUse",
-    "PermissionRequest",
-    "PostToolUse",
-    "Stop"
-  ],
-  gemini: [
-    "SessionStart",
-    "BeforeAgent",
-    "BeforeTool",
-    "AfterTool",
-    "AfterAgent"
-  ],
-  grok: [
-    "SessionStart",
-    "UserPromptSubmit",
-    "PreToolUse",
-    "PostToolUse",
-    "PostToolUseFailure",
-    "PermissionDenied",
-    "Stop",
-    "StopFailure",
-    "Notification",
-    "SubagentStart",
-    "SubagentStop",
-    "PreCompact",
-    "PostCompact",
-    "SessionEnd"
-  ],
-  pi: [
-    "SessionStart",
-    "UserPromptSubmit",
-    "TurnStart",
-    "PreToolUse",
-    "PostToolUse",
-    "PostToolUseFailure",
-    "Stop",
-    "Notification",
-    "ConfigChange",
-    "PreCompact",
-    "PostCompact",
-    "SessionEnd"
-  ]
-};
-
-// ../../packages/agent-targets/src/catalog/hook-events.ts
-var CLAUDE_HOOK_EVENTS = Object.freeze([
-  ...hook_events_default.claude
-]);
-var CODEX_HOOK_EVENTS = Object.freeze([
-  ...hook_events_default.codex
-]);
-var GEMINI_HOOK_EVENTS = Object.freeze([
-  ...hook_events_default.gemini
-]);
-var GROK_HOOK_EVENTS = Object.freeze([
-  ...hook_events_default.grok
-]);
-var PI_HOOK_EVENTS = Object.freeze([...hook_events_default.pi]);
+// src/sentry.ts
+var sentry, client, Sentry;
+var init_sentry = __esm({
+  "src/sentry.ts"() {
+    "use strict";
+    sentry = null;
+    client = null;
+    Sentry = {
+      captureException: (err) => sentry?.captureException(err),
+      captureMessage: (msg) => sentry?.captureMessage(msg),
+      flush: async (timeoutMs) => {
+        try {
+          await client?.flush(timeoutMs);
+        } catch {
+        }
+      }
+    };
+  }
+});
 
-// ../../packages/agent-targets/src/hooks/read-command.ts
-import path2 from "node:path";
-var SHELL_TOOL_NAMES = /* @__PURE__ */ new Set([
-  "bash",
-  "exec_command",
-  "shell"
-]);
-var COMMAND_SEPARATORS = /* @__PURE__ */ new Set([
-  ";",
-  "&",
-  "&&",
-  "|",
-  "||",
-  "<",
-  "<<",
-  ">",
-  ">>",
-  ">&1",
-  ">&2",
-  "1>",
-  "1>>",
-  "1>&1",
-  "1>&2",
-  "2>",
-  "2>>",
-  "2>&1",
-  "2>&2"
-]);
-function tokenizeShellLikeCommand(command) {
-  const tokens = [];
-  let current = "";
-  let quote = null;
-  let escaping = false;
-  for (let index = 0; index < command.length; index += 1) {
-    const character = command[index];
-    if (escaping) {
-      current += character;
-      escaping = false;
-      continue;
-    }
-    if (character === "\\") {
-      escaping = true;
-      continue;
+// src/telemetry-config.ts
+var telemetry_config_exports = {};
+__export(telemetry_config_exports, {
+  refreshCliTelemetryConfig: () => refreshCliTelemetryConfig,
+  resolveCliSentryConfig: () => resolveCliSentryConfig
+});
+import { createHash as createHash2, randomUUID as randomUUID2 } from "node:crypto";
+import fs3 from "node:fs";
+import path5 from "node:path";
+function parseSentryConfig(value) {
+  if (value === null) return null;
+  if (!value || typeof value !== "object")
+    throw new Error("Invalid Sentry config");
+  const config = value;
+  if (typeof config.dsn !== "string") throw new Error("Invalid Sentry DSN");
+  const url = new URL(config.dsn);
+  if (url.protocol !== "https:" || !url.username || url.password || url.search || url.hash || !/^\/(?:.*\/)?\d+$/.test(url.pathname)) {
+    throw new Error("Invalid Sentry DSN");
+  }
+  if (config.environment !== void 0 && (typeof config.environment !== "string" || !config.environment.trim())) {
+    throw new Error("Invalid Sentry environment");
+  }
+  return {
+    dsn: config.dsn,
+    ...typeof config.environment === "string" ? { environment: config.environment } : {}
+  };
+}
+function cachePathFor(siteUrl) {
+  const key = isHostedBackendUrl(siteUrl) ? DEFAULT_SYNC_URL : siteUrl;
+  return path5.join(
+    FML_DATA_DIR,
+    "telemetry-config",
+    `${createHash2("sha256").update(key).digest("hex")}.json`
+  );
+}
+function readCache(siteUrl) {
+  try {
+    const value = JSON.parse(
+      fs3.readFileSync(cachePathFor(siteUrl), "utf8")
+    );
+    if (!value || typeof value !== "object") return void 0;
+    const entry = value;
+    if (typeof entry.siteUrl !== "string" || entry.siteUrl !== siteUrl && !(isHostedBackendUrl(entry.siteUrl) && isHostedBackendUrl(siteUrl)) || typeof entry.fetchedAt !== "number" || !Number.isFinite(entry.fetchedAt))
+      return void 0;
+    return {
+      siteUrl: entry.siteUrl,
+      fetchedAt: entry.fetchedAt,
+      ...entry.sentry === void 0 ? {} : { sentry: parseSentryConfig(entry.sentry) }
+    };
+  } catch {
+    return void 0;
+  }
+}
+function writeCache(entry) {
+  const cachePath = cachePathFor(entry.siteUrl);
+  const temporaryPath = `${cachePath}.${randomUUID2()}.tmp`;
+  try {
+    fs3.mkdirSync(path5.dirname(cachePath), { recursive: true, mode: 448 });
+    fs3.writeFileSync(temporaryPath, JSON.stringify(entry), { mode: 384 });
+    fs3.renameSync(temporaryPath, cachePath);
+  } catch {
+  } finally {
+    try {
+      fs3.rmSync(temporaryPath, { force: true });
+    } catch {
     }
-    if (quote) {
-      if (character === quote) quote = null;
-      else current += character;
-      continue;
+  }
+}
+async function refreshCliTelemetryConfig(opts) {
+  try {
+    if (opts.signal?.aborted) return;
+    const siteUrl = opts.siteUrl ?? getSiteUrlForConvexUrl(resolveEnvConvexUrl(opts.envName));
+    if (!opts.siteUrl && !isHostedBackendUrl(siteUrl)) return;
+    if (!opts.force) {
+      const age = Date.now() - (readCache(siteUrl)?.fetchedAt ?? Number.NaN);
+      if (age >= 0 && age < CONFIG_TTL_MS) return;
+    }
+    const key = cachePathFor(siteUrl);
+    let refresh = refreshesInFlight.get(key);
+    if (!refresh) {
+      refresh = fetchAndCache(siteUrl, opts.accessToken, opts.signal).finally(
+        () => refreshesInFlight.delete(key)
+      );
+      refreshesInFlight.set(key, refresh);
     }
-    if (character === "'" || character === '"') {
-      quote = character;
-      continue;
-    }
-    if (current === "" && (character === "1" || character === "2") && command[index + 1] === ">") {
-      if (command[index + 2] === ">") {
-        tokens.push(`${character}>>`);
-        index += 2;
-      } else if (command[index + 2] === "&" && (command[index + 3] === "1" || command[index + 3] === "2")) {
-        tokens.push(`${character}>&${command[index + 3]}`);
-        index += 3;
-      } else {
-        tokens.push(`${character}>`);
-        index += 1;
-      }
-      continue;
-    }
-    if (/[;&|<>]/.test(character)) {
-      if (current) {
-        tokens.push(current);
-        current = "";
-      }
-      const next = command[index + 1];
-      if (character === ">" && next === "&" && (command[index + 2] === "1" || command[index + 2] === "2")) {
-        tokens.push(`>&${command[index + 2]}`);
-        index += 2;
-        continue;
-      }
-      if (character === "&" && next === "&" || character === "|" && next === "|" || character === "<" && next === "<" || character === ">" && next === ">") {
-        tokens.push(`${character}${next}`);
-        index += 1;
-        continue;
-      }
-      tokens.push(character);
-      continue;
-    }
-    if (/\s/.test(character)) {
-      if (current) {
-        tokens.push(current);
-        current = "";
-      }
-      continue;
-    }
-    current += character;
+    await refresh;
+  } catch {
   }
-  if (quote || escaping) return [];
-  if (current) tokens.push(current);
-  return tokens;
 }
-function splitCommandSegments(tokens) {
-  const segments = [];
-  let current = [];
-  for (let index = 0; index < tokens.length; index += 1) {
-    const token = tokens[index];
-    if (COMMAND_SEPARATORS.has(token)) {
-      if (current.length > 0) {
-        segments.push(current);
-        current = [];
-      }
-      if (token === "<" || token === "<<") index += 1;
-      continue;
-    }
-    current.push(token);
-  }
-  if (current.length > 0) segments.push(current);
-  return segments;
+async function fetchAndCache(siteUrl, accessToken, signal) {
+  const timeout = AbortSignal.timeout(CONFIG_TIMEOUT_MS);
+  const response = await fetch(`${siteUrl}/api/telemetry/config`, {
+    headers: { Authorization: `Bearer ${accessToken}` },
+    signal: signal ? AbortSignal.any([signal, timeout]) : timeout,
+    redirect: "error"
+  });
+  if (!response.ok) throw new Error("Config fetch failed");
+  const data = await response.json();
+  if (!data || typeof data !== "object" || data.ok !== true)
+    throw new Error("Invalid telemetry config");
+  const sentry2 = data.sentry;
+  writeCache({
+    siteUrl,
+    fetchedAt: Date.now(),
+    ...sentry2 === void 0 ? {} : { sentry: parseSentryConfig(sentry2) }
+  });
 }
-function stripSimpleOptions(args, flagsWithValues = /* @__PURE__ */ new Set(), patternFlags = /* @__PURE__ */ new Set()) {
-  const remaining = [];
-  let consumedPatternFlag = false;
-  for (let index = 0; index < args.length; index += 1) {
-    const argument = args[index];
-    if (argument === "--") {
-      remaining.push(...args.slice(index + 1));
-      break;
-    }
-    if (argument.startsWith("-") && argument.length > 1) {
-      if (flagsWithValues.has(argument)) {
-        if (patternFlags.has(argument)) consumedPatternFlag = true;
-        if (!argument.includes("=")) index += 1;
-      }
-      continue;
-    }
-    remaining.push(argument);
+async function resolveCliSentryConfig(defaultDsn, forceRefresh = false) {
+  if (process.env.FML_SENTRY_DSN !== void 0) {
+    return process.env.FML_SENTRY_DSN ? {
+      dsn: process.env.FML_SENTRY_DSN,
+      environment: process.env.FML_SENTRY_ENVIRONMENT
+    } : null;
+  }
+  const active = getActiveEnv();
+  const siteUrl = getSiteUrlForConvexUrl(active.convexUrl);
+  const hosted = active.convexUrl !== null && isHostedBackendUrl(active.convexUrl) && isHostedBackendUrl(siteUrl);
+  const fallback = hosted && defaultDsn ? {
+    dsn: defaultDsn,
+    environment: process.env.DEPLOYMENT_ENV ?? process.env.NODE_ENV ?? "production"
+  } : null;
+  const auth = readTokens(active.name);
+  if (!auth || auth.refreshInvalidAt || (auth.siteUrl ? auth.siteUrl !== siteUrl && !(hosted && isHostedBackendUrl(auth.siteUrl)) : !hosted))
+    return fallback;
+  if (forceRefresh && auth.expiresAt > Date.now()) {
+    await refreshCliTelemetryConfig({
+      envName: active.name,
+      accessToken: auth.accessToken,
+      siteUrl: auth.siteUrl,
+      force: true
+    });
   }
-  return { args: remaining, consumedPatternFlag };
-}
-function readCommandFileArgs(args, flagsWithValues, patternFlags = flagsWithValues) {
-  const stripped = stripSimpleOptions(args, flagsWithValues, patternFlags);
-  return stripped.consumedPatternFlag ? stripped.args : stripped.args.slice(1);
+  const cached = readCache(siteUrl);
+  return cached?.sentry === void 0 ? fallback : cached.sentry;
 }
-function isPlausibleReadPath(argument) {
-  if (!argument || argument === "-" || argument.startsWith("-")) return false;
-  if (COMMAND_SEPARATORS.has(argument)) return false;
-  if (/[\0*?[{}`$]/.test(argument)) return false;
-  if (/^[A-Za-z_][A-Za-z0-9_]*=/.test(argument)) return false;
-  return path2.posix.isAbsolute(argument) || path2.win32.isAbsolute(argument) || argument.startsWith("~/") || argument.startsWith("./") || argument.startsWith("../") || argument.includes("/") || /\.[A-Za-z0-9][A-Za-z0-9_-]*$/.test(argument) || /^[A-Z][A-Za-z0-9_.-]*$/.test(argument);
-}
-function filePathFromSegment(tokens) {
-  const commandTokens = [...tokens];
-  while (commandTokens[0]?.includes("=") && /^[A-Za-z_][A-Za-z0-9_]*=/.test(commandTokens[0])) {
-    commandTokens.shift();
-  }
-  const commandName = commandTokens.shift()?.split("/").pop();
-  if (!commandName) return null;
-  let args;
-  switch (commandName) {
-    case "bat":
-    case "batcat":
-    case "cat":
-    case "file":
-    case "less":
-    case "more":
-    case "nl":
-    case "stat":
-    case "wc":
-      args = stripSimpleOptions(commandTokens).args;
-      break;
-    case "head":
-    case "tail":
-      args = stripSimpleOptions(commandTokens, /* @__PURE__ */ new Set(["-n", "-c"])).args;
-      break;
-    case "sed":
-      if (commandTokens.some(
-        (argument) => argument.startsWith("-i") || argument === "--in-place" || argument.startsWith("--in-place=")
-      )) {
-        return null;
-      }
-      args = readCommandFileArgs(commandTokens, /* @__PURE__ */ new Set(["-e", "-f"]));
-      break;
-    case "awk":
-      args = readCommandFileArgs(
-        commandTokens,
-        /* @__PURE__ */ new Set(["-f", "-v"]),
-        /* @__PURE__ */ new Set(["-f"])
-      );
-      break;
-    case "grep":
-    case "rg":
-      args = readCommandFileArgs(
-        commandTokens,
-        /* @__PURE__ */ new Set(["-A", "-B", "-C", "-e", "-f", "-g", "-m", "-t"]),
-        /* @__PURE__ */ new Set(["-e", "-f"])
-      );
-      break;
-    default:
-      return null;
+var CONFIG_TTL_MS, CONFIG_TIMEOUT_MS, refreshesInFlight;
+var init_telemetry_config = __esm({
+  "src/telemetry-config.ts"() {
+    "use strict";
+    init_dirs();
+    init_config();
+    init_token_store();
+    CONFIG_TTL_MS = 60 * 60 * 1e3;
+    CONFIG_TIMEOUT_MS = 1500;
+    refreshesInFlight = /* @__PURE__ */ new Map();
   }
-  return args.find(isPlausibleReadPath) ?? null;
-}
-function extractReadFilePathFromCommand(command) {
-  const tokens = tokenizeShellLikeCommand(command);
-  if (tokens.length === 0) return null;
-  for (let index = 0; index < tokens.length - 1; index += 1) {
-    if (tokens[index] === "<" && isPlausibleReadPath(tokens[index + 1])) {
-      return tokens[index + 1];
-    }
+});
+
+// src/auth/token-store.ts
+import { createHash as createHash3, randomUUID as randomUUID3 } from "node:crypto";
+import { execFileSync } from "node:child_process";
+import fs4 from "node:fs";
+import path6 from "node:path";
+function getCurrentProcessIdentity() {
+  let cache = processGlobals[PROCESS_IDENTITY_KEY];
+  if (!cache) {
+    cache = { resolved: false };
+    processGlobals[PROCESS_IDENTITY_KEY] = cache;
   }
-  for (const segment of splitCommandSegments(tokens)) {
-    const filePath = filePathFromSegment(segment);
-    if (filePath) return filePath;
+  if (!cache.resolved) {
+    cache.value = getProcessIdentity(process.pid) ?? void 0;
+    cache.resolved = true;
   }
-  return null;
+  return cache.value;
 }
-
-// ../../packages/agent-targets/src/hooks/normalize.ts
-var MAX_EXTRACTED_TEXT_BYTES = 64 * 1024;
-function isRecord(value) {
-  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+function storePathFor(envName) {
+  return authStorePathFor(envName ?? getActiveEnv().name);
 }
-function firstString(record, keys) {
-  for (const key of keys) {
-    const value = record[key];
-    if (typeof value === "string" && value.length > 0) return value;
-  }
-  return void 0;
+function resolveEnvName(envName) {
+  return envName ?? getActiveEnv().name;
 }
-function extractedText(value) {
-  if (typeof value === "string") return value;
-  if (value === void 0 || value === null) return void 0;
+function ensureDir(envName) {
+  const dir = path6.dirname(storePathFor(envName));
+  fs4.mkdirSync(dir, { recursive: true, mode: 448 });
   try {
-    return JSON.stringify(value);
+    fs4.chmodSync(dir, 448);
   } catch {
-    return void 0;
   }
 }
-function firstText(record, keys) {
-  for (const key of keys) {
-    const value = extractedText(record[key]);
-    if (value !== void 0 && value.length > 0) return value;
+function writeSecretFile(filePath, data) {
+  const temporaryFile = `${filePath}.${process.pid}.${randomUUID3()}.tmp`;
+  let descriptor = null;
+  try {
+    descriptor = fs4.openSync(temporaryFile, "wx", 384);
+    fs4.writeFileSync(descriptor, data, { encoding: "utf8" });
+    fs4.fsyncSync(descriptor);
+    fs4.closeSync(descriptor);
+    descriptor = null;
+    fs4.renameSync(temporaryFile, filePath);
+    try {
+      fs4.chmodSync(filePath, 384);
+    } catch {
+    }
+  } finally {
+    if (descriptor !== null) {
+      try {
+        fs4.closeSync(descriptor);
+      } catch {
+      }
+    }
+    try {
+      fs4.unlinkSync(temporaryFile);
+    } catch {
+    }
   }
-  return void 0;
 }
-function utf8Prefix(value, maxBytes) {
-  let low = 0;
-  let high = value.length;
-  while (low < high) {
-    const middle = Math.ceil((low + high) / 2);
-    if (Buffer.byteLength(value.slice(0, middle), "utf8") <= maxBytes) {
-      low = middle;
-    } else {
-      high = middle - 1;
-    }
+function readTokens(envName) {
+  let raw;
+  try {
+    raw = fs4.readFileSync(storePathFor(envName), "utf-8");
+  } catch {
+    return null;
   }
-  let end = low;
-  if (end > 0 && end < value.length && value.charCodeAt(end - 1) >= 55296 && value.charCodeAt(end - 1) <= 56319 && value.charCodeAt(end) >= 56320 && value.charCodeAt(end) <= 57343) {
-    end -= 1;
+  try {
+    return parseStoredAuthShape(JSON.parse(raw));
+  } catch {
+    return null;
   }
-  return value.slice(0, end);
-}
-function boundedExtractedText(value, field) {
-  if (value === void 0) return void 0;
-  const originalBytes = Buffer.byteLength(value, "utf8");
-  if (originalBytes <= MAX_EXTRACTED_TEXT_BYTES) return value;
-  const digest = createHash("sha256").update(value).digest("hex");
-  const marker = `
-[fml:${field}:truncated originalBytes=${originalBytes} sha256=${digest}]`;
-  return `${utf8Prefix(
-    value,
-    MAX_EXTRACTED_TEXT_BYTES - Buffer.byteLength(marker, "utf8")
-  )}${marker}`;
 }
-function nestedRecord(record, keys) {
-  for (const key of keys) {
-    const value = record[key];
-    if (isRecord(value)) return value;
+function parseStoredAuthShape(parsed) {
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    return null;
   }
-  return void 0;
-}
-function timestampMs(payload, fallback) {
-  for (const key of ["timestamp_ms", "timestampMs", "timestamp"]) {
-    const value = payload[key];
-    if (typeof value === "number" && Number.isFinite(value) && value > 0) {
-      const milliseconds = Math.round(
-        value < 1e10 ? value * 1e3 : value
-      );
-      if (Number.isSafeInteger(milliseconds) && milliseconds > 0) {
-        return milliseconds;
-      }
-    }
-    if (typeof value === "string") {
-      const parsed = Date.parse(value);
-      if (Number.isSafeInteger(parsed) && parsed >= 0) return parsed;
-    }
+  const auth = parsed;
+  const user = auth.user;
+  if (typeof auth.accessToken !== "string" || typeof auth.refreshToken !== "string" || typeof auth.expiresAt !== "number" || !Number.isFinite(auth.expiresAt) || !user || typeof user.id !== "string" || typeof user.email !== "string" || typeof user.name !== "string" || auth.orgId !== void 0 && typeof auth.orgId !== "string" || auth.orgSlug !== void 0 && typeof auth.orgSlug !== "string" || auth.workosClientId !== void 0 && typeof auth.workosClientId !== "string" || auth.siteUrl !== void 0 && typeof auth.siteUrl !== "string" || auth.tokenType !== void 0 && auth.tokenType !== "oauth" && auth.tokenType !== "service" || auth.refreshInvalidAt !== void 0 && (typeof auth.refreshInvalidAt !== "number" || !Number.isFinite(auth.refreshInvalidAt))) {
+    return null;
   }
-  return fallback;
+  return auth;
 }
-function geminiEventType(eventType) {
-  switch (eventType) {
-    case "BeforeAgent":
-    case "BeforeModel":
-      return "UserPromptSubmit";
-    case "BeforeTool":
-      return "PreToolUse";
-    case "AfterTool":
-      return "PostToolUse";
-    case "AfterAgent":
-      return "Stop";
-    default:
-      return eventType;
+function readTokensForReconciliation(envName) {
+  let raw;
+  try {
+    raw = fs4.readFileSync(storePathFor(envName), "utf8");
+  } catch (error) {
+    if (error.code === "ENOENT") return null;
+    throw error;
   }
-}
-var GROK_EVENT_TYPES = Object.freeze({
-  session_start: "SessionStart",
-  user_prompt_submit: "UserPromptSubmit",
-  pre_tool_use: "PreToolUse",
-  post_tool_use: "PostToolUse",
-  post_tool_use_failure: "PostToolUseFailure",
-  permission_denied: "PermissionDenied",
-  stop: "Stop",
-  stop_failure: "StopFailure",
-  notification: "Notification",
-  subagent_start: "SubagentStart",
-  subagent_stop: "SubagentStop",
-  pre_compact: "PreCompact",
-  post_compact: "PostCompact",
-  session_end: "SessionEnd"
-});
-function grokEventType(eventType) {
-  return Object.hasOwn(GROK_EVENT_TYPES, eventType) ? GROK_EVENT_TYPES[eventType] ?? eventType : eventType;
-}
-function geminiUserPrompt(payload) {
-  const request = payload.llm_request;
-  if (!isRecord(request) || !Array.isArray(request.messages)) return void 0;
-  const userMessage = [...request.messages].reverse().find(
-    (message) => isRecord(message) && message.role === "user"
-  );
-  if (!userMessage) return void 0;
-  if (typeof userMessage.content === "string") {
-    return userMessage.content || void 0;
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (error) {
+    throw new CorruptStoredCredentialsError(
+      "Stored credentials are not valid JSON",
+      { cause: error }
+    );
   }
-  if (!Array.isArray(userMessage.content)) return void 0;
-  const text = userMessage.content.filter(
-    (part) => isRecord(part) && part.type === "text" && typeof part.text === "string"
-  ).map((part) => part.text).join("\n");
-  return text || void 0;
+  const auth = parseStoredAuthShape(parsed);
+  if (!auth) {
+    throw new CorruptStoredCredentialsError(
+      "Stored credentials have an invalid shape"
+    );
+  }
+  return auth;
 }
-function normalizedEvent(target, payload, context) {
-  const sessionId = firstString(payload, [
-    "session_id",
-    "sessionId",
-    "conversation_id",
-    "conversationId"
-  ]);
-  const rawEventType = firstString(payload, [
-    "hook_event_name",
-    "hookEventName",
-    "event_name",
-    "eventName",
-    "event"
-  ]);
-  if (!sessionId || !rawEventType) return null;
-  const eventType = target === "gemini" ? geminiEventType(rawEventType) : target === "grok" ? grokEventType(rawEventType) : rawEventType;
-  const toolInput = nestedRecord(payload, ["tool_input", "toolInput"]);
-  const cwd = firstString(payload, [
-    "cwd",
-    "working_directory",
-    "workingDirectory",
-    "workspaceRoot"
-  ]) ?? context.cwd;
-  const command = boundedExtractedText(
-    firstText(payload, ["command"]) ?? (toolInput ? firstText(toolInput, ["command", "cmd"]) : void 0),
-    "command"
-  );
-  const toolName = firstString(payload, ["tool_name", "toolName", "name"]);
-  const filePath = firstString(payload, ["file_path", "filePath", "path"]) ?? (toolInput ? firstString(toolInput, ["file_path", "filePath", "path"]) : void 0) ?? (command && toolName && SHELL_TOOL_NAMES.has(toolName.toLowerCase()) ? extractReadFilePathFromCommand(command) ?? void 0 : void 0);
-  const userPrompt = boundedExtractedText(
-    firstText(payload, ["prompt", "user_prompt", "userPrompt"]) ?? (target === "gemini" ? geminiUserPrompt(payload) : void 0),
-    "user_prompt"
-  );
-  const plan = boundedExtractedText(firstText(payload, ["plan"]), "plan");
-  const allowedPrompts = boundedExtractedText(
-    firstText(payload, ["allowed_prompts", "allowedPrompts"]),
-    "allowed_prompts"
-  );
-  const toolResult = boundedExtractedText(
-    firstText(payload, [
-      "tool_result",
-      "toolResult",
-      "tool_response",
-      "toolResponse"
-    ]),
-    "tool_result"
-  );
-  const nativeEventId = firstString(payload, [
-    "hook_id",
-    "hookId",
-    "event_id",
-    "eventId",
-    "tool_use_id",
-    "toolUseId",
-    "tool_call_id",
-    "toolCallId",
-    "prompt_id",
-    "promptId"
-  ]) ?? (eventType === "UserPromptSubmit" || eventType === "Stop" ? firstString(payload, ["turn_id", "turnId"]) : void 0);
-  return {
-    sessionId,
-    eventType,
-    timestampMs: timestampMs(payload, context.nowMs),
-    ...nativeEventId ? { nativeEventId } : {},
-    ...cwd ? { cwd } : {},
-    ...toolName ? { toolName } : {},
-    ...userPrompt ? { userPrompt } : {},
-    ...filePath ? { filePath } : {},
-    ...command ? { command } : {},
-    ...plan ? { plan } : {},
-    ...allowedPrompts ? { allowedPrompts } : {},
-    ...toolResult ? { toolResult } : {}
-  };
+function writeTokensUnlocked(auth, envName) {
+  ensureDir(envName);
+  writeSecretFile(storePathFor(envName), JSON.stringify(auth, null, 2));
 }
-function capability(targetId, nativeEvents) {
-  return Object.freeze({
-    targetId,
-    nativeEvents,
-    normalize: (payload, context) => normalizedEvent(targetId, payload, context)
-  });
+function credentialHash(value) {
+  return createHash3("sha256").update(value).digest("hex");
 }
-var HOOK_NORMALIZATION_CAPABILITIES = Object.freeze([
-  capability("claude", CLAUDE_HOOK_EVENTS),
-  capability("codex", CODEX_HOOK_EVENTS),
-  capability("gemini", GEMINI_HOOK_EVENTS),
-  capability("grok", GROK_HOOK_EVENTS),
-  capability("pi", PI_HOOK_EVENTS)
-]);
-
-// src/auth/token-store.ts
-import { createHash as createHash2, randomUUID as randomUUID2 } from "node:crypto";
-import { execFileSync } from "node:child_process";
-import fs3 from "node:fs";
-import path5 from "node:path";
-
-// src/config.ts
-import fs2 from "node:fs";
-import path4 from "node:path";
-
-// src/dirs.ts
-import os from "node:os";
-import path3 from "node:path";
-function isPresent(value) {
-  return value !== void 0 && value.trim().length > 0;
+function describeError(error) {
+  return error instanceof Error ? error.message : String(error);
 }
-function normalizeAbsolutePath(value, variableName, pathApi) {
-  if (!pathApi.isAbsolute(value)) {
-    throw new Error(`${variableName} must be an absolute path: ${value}`);
+function getSyncDestinationAuthBinding(envName) {
+  const resolvedEnvName = resolveEnvName(envName);
+  const envToken = process.env.FML_TOKEN;
+  if (envToken?.startsWith("fml_srt_")) {
+    return {
+      destinationIdentity: `service-refresh:${credentialHash(envToken)}`
+    };
   }
-  return pathApi.normalize(value);
-}
-function explicitDirectory(value, variableName, pathApi) {
-  if (!isPresent(value)) return void 0;
-  return normalizeAbsolutePath(value, variableName, pathApi);
+  if (envToken?.startsWith("fml_st_")) {
+    return {
+      destinationIdentity: `service-access:${credentialHash(envToken)}`
+    };
+  }
+  const stored = readTokens(resolvedEnvName);
+  if (!stored) return null;
+  if (stored.tokenType === "service") {
+    return {
+      destinationIdentity: `service-refresh:${credentialHash(stored.refreshToken)}`
+    };
+  }
+  const destinationIdentity = `oauth-user:${stored.user.id}`;
+  if (stored.orgId && stored.orgSlug) {
+    return {
+      destinationIdentity,
+      organizationId: stored.orgId,
+      organizationSlug: stored.orgSlug
+    };
+  }
+  return { destinationIdentity, organizationSelectionRequired: true };
 }
-function platformBaseDirectory(value, pathApi) {
-  if (!isPresent(value) || !pathApi.isAbsolute(value)) return void 0;
-  return pathApi.normalize(value);
+function getSyncDestinationIdentity(envName) {
+  return getSyncDestinationAuthBinding(envName)?.destinationIdentity ?? null;
 }
-function resolveFmlDirectories(options = {}) {
-  const platform = options.platform ?? process.platform;
-  const env = options.env ?? process.env;
-  const pathApi = platform === "win32" ? path3.win32 : path3.posix;
-  const homeDir = normalizeAbsolutePath(
-    options.homeDir ?? os.homedir(),
-    "home directory",
-    pathApi
-  );
-  const explicitDataDir = explicitDirectory(
-    env.FML_DATA_DIR,
-    "FML_DATA_DIR",
-    pathApi
-  );
-  const explicitStateDir = explicitDirectory(
-    env.FML_STATE_DIR,
-    "FML_STATE_DIR",
-    pathApi
-  );
-  const explicitLogDir = explicitDirectory(
-    env.FML_LOG_DIR,
-    "FML_LOG_DIR",
-    pathApi
-  );
-  let defaultDataDir;
-  let defaultStateDir;
-  let nativeLogDir;
-  switch (platform) {
-    case "darwin": {
-      defaultDataDir = pathApi.join(
-        homeDir,
-        "Library",
-        "Application Support",
-        "fml"
-      );
-      defaultStateDir = defaultDataDir;
-      nativeLogDir = pathApi.join(homeDir, "Library", "Logs", "fml");
-      break;
-    }
-    case "win32": {
-      const roamingAppData = platformBaseDirectory(env.APPDATA, pathApi) ?? pathApi.join(homeDir, "AppData", "Roaming");
-      const localAppData = platformBaseDirectory(env.LOCALAPPDATA, pathApi) ?? pathApi.join(homeDir, "AppData", "Local");
-      defaultDataDir = pathApi.join(roamingAppData, "fml");
-      defaultStateDir = pathApi.join(localAppData, "fml");
-      break;
-    }
-    default: {
-      const xdgDataHome = platformBaseDirectory(env.XDG_DATA_HOME, pathApi) ?? pathApi.join(homeDir, ".local", "share");
-      const xdgStateHome = platformBaseDirectory(env.XDG_STATE_HOME, pathApi) ?? pathApi.join(homeDir, ".local", "state");
-      defaultDataDir = pathApi.join(xdgDataHome, "fml");
-      defaultStateDir = pathApi.join(xdgStateHome, "fml");
-      break;
-    }
-  }
-  const dataDir = explicitDataDir ?? defaultDataDir;
-  const stateDir = explicitStateDir ?? explicitDataDir ?? defaultStateDir;
-  const defaultLogDir = nativeLogDir ?? (platform === "win32" ? pathApi.join(defaultDataDir, "logs") : pathApi.join(defaultStateDir, "log"));
-  const explicitObserverDir = explicitDirectory(
-    env.FML_OBSERVER_DIR,
-    "FML_OBSERVER_DIR",
-    pathApi
-  );
-  const legacyPanopticonHome = explicitDirectory(
-    env.PANOPTICON_HOME,
-    "PANOPTICON_HOME",
-    pathApi
-  );
-  const fmlHome = explicitDirectory(env.FML_HOME, "FML_HOME", pathApi);
-  return {
-    dataDir,
-    stateDir,
-    logDir: explicitLogDir ?? defaultLogDir,
-    observerDir: explicitObserverDir ?? legacyPanopticonHome ?? (fmlHome ? pathApi.join(fmlHome, "panopticon") : pathApi.join(homeDir, ".fml", "panopticon"))
-  };
+function waitForTokenRefresh(promise, signal) {
+  if (!signal) return promise;
+  if (signal.aborted) return Promise.resolve(null);
+  return new Promise((resolve, reject) => {
+    const onAbort = () => {
+      cleanup();
+      resolve(null);
+    };
+    const cleanup = () => signal.removeEventListener("abort", onAbort);
+    signal.addEventListener("abort", onAbort, { once: true });
+    void promise.then(
+      (value) => {
+        cleanup();
+        resolve(value);
+      },
+      (error) => {
+        cleanup();
+        reject(error);
+      }
+    );
+  });
 }
-function observerPort() {
-  const configured = process.env.FML_OBSERVER_PORT ?? process.env.PANOPTICON_PORT;
-  if (configured) {
-    const parsed = Number.parseInt(configured, 10);
-    if (Number.isInteger(parsed) && parsed > 0 && parsed <= 65535) {
-      return parsed;
-    }
+function getOrStartTokenRefresh(flights, key, forceRefresh, refresh, signal) {
+  const existing = flights.get(key);
+  if (existing && (!forceRefresh || existing.forceRefresh)) {
+    return waitForTokenRefresh(existing.promise, signal);
   }
-  return 4318 + (process.getuid?.() ?? 0) % 100;
-}
-var DIRECTORIES = resolveFmlDirectories();
-var FML_DATA_DIR = DIRECTORIES.dataDir;
-var FML_STATE_DIR = DIRECTORIES.stateDir;
-var FML_LOG_DIR = DIRECTORIES.logDir;
-var FML_OBSERVER_DIR = DIRECTORIES.observerDir;
-var FML_OBSERVER_PORT = observerPort();
-var FML_OBSERVER_STATE_FILE = path3.join(
-  FML_OBSERVER_DIR,
-  "observer.pid.json"
-);
-var FML_OBSERVER_LOCK_FILE = path3.join(
-  FML_OBSERVER_DIR,
-  "observer.lock"
-);
-var FML_OBSERVER_AUTH_TOKEN_FILE = path3.join(
-  FML_OBSERVER_DIR,
-  "auth-token"
-);
-var FML_OBSERVER_ENDPOINT_FILE = path3.join(
-  FML_OBSERVER_DIR,
-  "endpoint.json"
-);
-var FML_OBSERVER_LOG_FILE = path3.join(FML_LOG_DIR, "observer.log");
-var FML_UPDATE_LOG_FILE = path3.join(FML_LOG_DIR, "update.log");
-var FML_INSTALLATION_ID_FILE = path3.join(
-  FML_STATE_DIR,
-  "installation_id"
-);
-var FML_PANOPTICON_DB_FILE = path3.join(FML_STATE_DIR, "panopticon.db");
-var FML_PANOPTICON_DB_OBSERVER_STATE_FILE = `${FML_PANOPTICON_DB_FILE}.observer.pid.json`;
-var FML_PANOPTICON_DB_OBSERVER_LOCK_FILE = `${FML_PANOPTICON_DB_FILE}.observer.lock`;
-var FML_LEGACY_OBSERVER_DB_FILE = path3.join(
-  FML_OBSERVER_DIR,
-  "observer.db"
-);
-var FML_HOOK_INBOX_DIR = path3.join(FML_OBSERVER_DIR, "hook-inbox");
-var FML_HOOK_CONTEXT_STATE_DIR = path3.join(
-  FML_OBSERVER_DIR,
-  "hook-context-state"
-);
-var FML_HOOK_CAPTURE_DISABLED_FILE = path3.join(
-  FML_OBSERVER_DIR,
-  "hook-capture.disabled"
-);
-
-// src/config.ts
-var DEFAULT_PROD_URL = "https://api.fml.inc";
-var DEFAULT_TARGET_NAME = "fml";
-var ENV_CONFIG_PATH = path4.join(FML_DATA_DIR, "env.json");
-var ENV_NAME_RE = /^[A-Za-z0-9_-]+$/;
-function isValidEnvName(envName) {
-  return ENV_NAME_RE.test(envName);
+  const operation = existing ? existing.promise.then(refresh, refresh) : refresh();
+  let flight;
+  const promise = operation.finally(() => {
+    if (flights.get(key) === flight) flights.delete(key);
+  });
+  flight = { forceRefresh, promise };
+  flights.set(key, flight);
+  return waitForTokenRefresh(promise, signal);
 }
-function normalizeConvexUrl(value) {
-  const url = new URL(value);
-  const loopback = url.hostname === "localhost" || url.hostname === "127.0.0.1" || url.hostname === "::1";
-  if (url.protocol !== "https:" && !(url.protocol === "http:" && loopback) || url.username || url.password || url.search || url.hash || url.pathname !== "" && url.pathname !== "/") {
-    throw new Error(
-      "FML environment URL must be HTTPS (HTTP is allowed only for loopback) with no path, credentials, query, or fragment"
-    );
-  }
-  return url.origin;
+function refreshLockPath(envName) {
+  return `${storePathFor(envName)}.refresh.lock`;
 }
-function normalizeAppUrl(value) {
-  return normalizeConvexUrl(value);
+function pendingOAuthRefreshPrefix(envName) {
+  return `${path6.basename(storePathFor(envName))}.refresh-result.`;
 }
-function readEnvConfig() {
+function parsePendingOAuthRefresh(raw) {
   try {
-    const parsed = JSON.parse(
-      fs2.readFileSync(ENV_CONFIG_PATH, "utf8")
-    );
-    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
-      throw new Error("invalid environment config");
-    }
-    const config = parsed;
-    if (typeof config.active !== "string" || !isValidEnvName(config.active)) {
-      throw new Error("invalid active environment");
-    }
-    const environments = {};
-    if (config.environments && typeof config.environments === "object" && !Array.isArray(config.environments)) {
-      for (const [name, environment] of Object.entries(
-        config.environments
-      )) {
-        if (!isValidEnvName(name) || !environment || typeof environment !== "object" || Array.isArray(environment)) {
-          continue;
-        }
-        const entry = environment;
-        if (typeof entry.convexUrl !== "string") continue;
-        try {
-          const appUrl = typeof entry.appUrl === "string" ? normalizeAppUrl(entry.appUrl) : void 0;
-          environments[name] = {
-            convexUrl: normalizeConvexUrl(entry.convexUrl),
-            ...appUrl ? { appUrl } : {}
-          };
-        } catch {
-        }
-      }
+    const parsed = JSON.parse(raw);
+    const refreshed = parsed.refreshed;
+    if (parsed.version !== 1 || typeof parsed.previousRefreshTokenHash !== "string" || !/^[a-f0-9]{64}$/.test(parsed.previousRefreshTokenHash) || typeof parsed.createdAtMs !== "number" || !Number.isFinite(parsed.createdAtMs) || !refreshed || typeof refreshed.accessToken !== "string" || typeof refreshed.refreshToken !== "string" || typeof refreshed.expiresAt !== "number" || !Number.isFinite(refreshed.expiresAt) || !refreshed.user || typeof refreshed.user.id !== "string" || typeof refreshed.user.email !== "string" || typeof refreshed.user.name !== "string") {
+      return null;
     }
-    environments[DEFAULT_TARGET_NAME] = { convexUrl: DEFAULT_PROD_URL };
-    return {
-      schemaVersion: 1,
-      active: config.active,
-      environments
-    };
+    return parsed;
   } catch {
-    return {
-      schemaVersion: 1,
-      active: DEFAULT_TARGET_NAME,
-      environments: {
-        [DEFAULT_TARGET_NAME]: { convexUrl: DEFAULT_PROD_URL }
-      }
-    };
+    return null;
   }
 }
-function resolveEnvConvexUrl(envName) {
-  const configured = readEnvConfig().environments?.[envName]?.convexUrl;
-  if (configured) return configured;
-  if (envName === DEFAULT_TARGET_NAME) return DEFAULT_PROD_URL;
-  return null;
-}
-function getActiveEnv() {
-  const config = readEnvConfig();
-  const name = config.active;
-  const stored = config.environments?.[name];
-  const override = process.env.FML_CONVEX_URL;
-  const convexUrl = override ? normalizeConvexUrl(override) : resolveEnvConvexUrl(name);
-  const appUrl = stored?.appUrl && stored.convexUrl === convexUrl ? stored.appUrl : null;
-  return { name, convexUrl, appUrl };
-}
-function authStorePathFor(envName) {
-  return path4.join(FML_DATA_DIR, `auth.${envName}.json`);
-}
-var CONVEX_URL = (process.env.FML_CONVEX_URL ?? getActiveEnv().convexUrl ?? DEFAULT_PROD_URL).replace(/\/$/, "");
-var WORKOS_API_URL = "https://api.workos.com";
-function getSiteUrlForConvexUrl(convexUrl) {
-  const explicit = process.env.CONVEX_SITE_URL;
-  if (explicit) return explicit.replace(/\/$/, "");
-  return (convexUrl ?? DEFAULT_PROD_URL).replace(/\/$/, "");
+function stagePendingOAuthRefresh(previousRefreshToken, refreshed, envName) {
+  ensureDir(envName);
+  const resultPath = `${storePathFor(envName)}.refresh-result.${Date.now()}.${randomUUID3()}.json`;
+  const pending = {
+    version: 1,
+    previousRefreshTokenHash: credentialHash(previousRefreshToken),
+    refreshed,
+    createdAtMs: Date.now()
+  };
+  writeSecretFile(resultPath, `${JSON.stringify(pending)}
+`);
+  return resultPath;
 }
-
-// src/sentry.ts
-var sentry = null;
-var client = null;
-var Sentry = {
-  captureException: (err) => sentry?.captureException(err),
-  captureMessage: (msg) => sentry?.captureMessage(msg),
-  flush: async (timeoutMs) => {
-    try {
-      await client?.flush(timeoutMs);
-    } catch {
+function removePendingOAuthRefresh(resultPath) {
+  try {
+    fs4.unlinkSync(resultPath);
+  } catch (error) {
+    if (error.code !== "ENOENT") {
+      console.error(
+        `[fml] Auth: unable to remove a committed refresh result: ${error instanceof Error ? error.message : String(error)}`
+      );
     }
   }
-};
-
-// src/auth/token-store.ts
-var TOKEN_REFRESH_WINDOW_MS = 6e4;
-var OAUTH_REFRESH_LOCK_POLL_MS = 50;
-var OAUTH_REFRESH_LOCK_STALE_MS = 45e3;
-var OAUTH_REFRESH_RECOVERY_STALE_MS = 45e3;
-var OAUTH_REFRESH_LOCK_WAIT_MS = 6e4;
-var OAUTH_REFRESH_REQUEST_TIMEOUT_MS = 3e4;
-var PROCESS_IDENTITY_STALE_MS = 45e3;
-var PROCESS_IDENTITY_RECHECK_MS = 5e3;
-var PROCESS_INSTANCE_KEY = /* @__PURE__ */ Symbol.for("@fml-inc/fml:auth-process-instance");
-var PROCESS_IDENTITY_KEY = /* @__PURE__ */ Symbol.for("@fml-inc/fml:auth-process-identity");
-var processGlobals = globalThis;
-var existingProcessInstanceId = processGlobals[PROCESS_INSTANCE_KEY];
-var CURRENT_PROCESS_INSTANCE_ID = typeof existingProcessInstanceId === "string" ? existingProcessInstanceId : randomUUID2();
-processGlobals[PROCESS_INSTANCE_KEY] = CURRENT_PROCESS_INSTANCE_ID;
-function getCurrentProcessIdentity() {
-  let cache = processGlobals[PROCESS_IDENTITY_KEY];
-  if (!cache) {
-    cache = { resolved: false };
-    processGlobals[PROCESS_IDENTITY_KEY] = cache;
-  }
-  if (!cache.resolved) {
-    cache.value = getProcessIdentity(process.pid) ?? void 0;
-    cache.resolved = true;
-  }
-  return cache.value;
-}
-function storePathFor(envName) {
-  return authStorePathFor(envName ?? getActiveEnv().name);
-}
-function resolveEnvName(envName) {
-  return envName ?? getActiveEnv().name;
 }
-function ensureDir(envName) {
-  const dir = path5.dirname(storePathFor(envName));
-  fs3.mkdirSync(dir, { recursive: true, mode: 448 });
+function reconcilePendingOAuthRefreshes(envName, unreadableStorePolicy = "preserve-staged") {
+  const storePath = storePathFor(envName);
+  const directory = path6.dirname(storePath);
+  const prefix = pendingOAuthRefreshPrefix(envName);
+  let resultPaths;
   try {
-    fs3.chmodSync(dir, 448);
-  } catch {
+    resultPaths = fs4.readdirSync(directory).filter((entry) => entry.startsWith(prefix) && entry.endsWith(".json")).map((entry) => path6.join(directory, entry));
+  } catch (error) {
+    if (error.code === "ENOENT") return;
+    throw error;
   }
-}
-function writeSecretFile(filePath, data) {
-  const temporaryFile = `${filePath}.${process.pid}.${randomUUID2()}.tmp`;
-  let descriptor = null;
-  try {
-    descriptor = fs3.openSync(temporaryFile, "wx", 384);
-    fs3.writeFileSync(descriptor, data, { encoding: "utf8" });
-    fs3.fsyncSync(descriptor);
-    fs3.closeSync(descriptor);
-    descriptor = null;
-    fs3.renameSync(temporaryFile, filePath);
+  const pendingResults = resultPaths.map((resultPath) => {
+    let pending = null;
     try {
-      fs3.chmodSync(filePath, 384);
-    } catch {
-    }
-  } finally {
-    if (descriptor !== null) {
-      try {
-        fs3.closeSync(descriptor);
-      } catch {
-      }
-    }
-    try {
-      fs3.unlinkSync(temporaryFile);
-    } catch {
-    }
-  }
-}
-function readTokens(envName) {
-  let raw;
-  try {
-    raw = fs3.readFileSync(storePathFor(envName), "utf-8");
-  } catch {
-    return null;
-  }
-  try {
-    return parseStoredAuthShape(JSON.parse(raw));
-  } catch {
-    return null;
-  }
-}
-var CorruptStoredCredentialsError = class extends Error {
-};
-function parseStoredAuthShape(parsed) {
-  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
-    return null;
-  }
-  const auth = parsed;
-  const user = auth.user;
-  if (typeof auth.accessToken !== "string" || typeof auth.refreshToken !== "string" || typeof auth.expiresAt !== "number" || !Number.isFinite(auth.expiresAt) || !user || typeof user.id !== "string" || typeof user.email !== "string" || typeof user.name !== "string" || auth.orgId !== void 0 && typeof auth.orgId !== "string" || auth.orgSlug !== void 0 && typeof auth.orgSlug !== "string" || auth.workosClientId !== void 0 && typeof auth.workosClientId !== "string" || auth.siteUrl !== void 0 && typeof auth.siteUrl !== "string" || auth.tokenType !== void 0 && auth.tokenType !== "oauth" && auth.tokenType !== "service" || auth.refreshInvalidAt !== void 0 && (typeof auth.refreshInvalidAt !== "number" || !Number.isFinite(auth.refreshInvalidAt))) {
-    return null;
-  }
-  return auth;
-}
-function readTokensForReconciliation(envName) {
-  let raw;
-  try {
-    raw = fs3.readFileSync(storePathFor(envName), "utf8");
-  } catch (error) {
-    if (error.code === "ENOENT") return null;
-    throw error;
-  }
-  let parsed;
-  try {
-    parsed = JSON.parse(raw);
-  } catch (error) {
-    throw new CorruptStoredCredentialsError(
-      "Stored credentials are not valid JSON",
-      { cause: error }
-    );
-  }
-  const auth = parseStoredAuthShape(parsed);
-  if (!auth) {
-    throw new CorruptStoredCredentialsError(
-      "Stored credentials have an invalid shape"
-    );
-  }
-  return auth;
-}
-function writeTokensUnlocked(auth, envName) {
-  ensureDir(envName);
-  writeSecretFile(storePathFor(envName), JSON.stringify(auth, null, 2));
-}
-function credentialHash(value) {
-  return createHash2("sha256").update(value).digest("hex");
-}
-function describeError(error) {
-  return error instanceof Error ? error.message : String(error);
-}
-function getSyncDestinationAuthBinding(envName) {
-  const resolvedEnvName = resolveEnvName(envName);
-  const envToken = process.env.FML_TOKEN;
-  if (envToken?.startsWith("fml_srt_")) {
-    return {
-      destinationIdentity: `service-refresh:${credentialHash(envToken)}`
-    };
-  }
-  if (envToken?.startsWith("fml_st_")) {
-    return {
-      destinationIdentity: `service-access:${credentialHash(envToken)}`
-    };
-  }
-  const stored = readTokens(resolvedEnvName);
-  if (!stored) return null;
-  if (stored.tokenType === "service") {
-    return {
-      destinationIdentity: `service-refresh:${credentialHash(stored.refreshToken)}`
-    };
-  }
-  const destinationIdentity = `oauth-user:${stored.user.id}`;
-  if (stored.orgId && stored.orgSlug) {
-    return {
-      destinationIdentity,
-      organizationId: stored.orgId,
-      organizationSlug: stored.orgSlug
-    };
-  }
-  return { destinationIdentity, organizationSelectionRequired: true };
-}
-function getSyncDestinationIdentity(envName) {
-  return getSyncDestinationAuthBinding(envName)?.destinationIdentity ?? null;
-}
-var serviceTokenCaches = /* @__PURE__ */ new Map();
-var serviceRefreshPromises = /* @__PURE__ */ new Map();
-var oauthRefreshPromises = /* @__PURE__ */ new Map();
-var cacheKey = (envName) => envName;
-function waitForTokenRefresh(promise, signal) {
-  if (!signal) return promise;
-  if (signal.aborted) return Promise.resolve(null);
-  return new Promise((resolve, reject) => {
-    const onAbort = () => {
-      cleanup();
-      resolve(null);
-    };
-    const cleanup = () => signal.removeEventListener("abort", onAbort);
-    signal.addEventListener("abort", onAbort, { once: true });
-    void promise.then(
-      (value) => {
-        cleanup();
-        resolve(value);
-      },
-      (error) => {
-        cleanup();
-        reject(error);
-      }
-    );
-  });
-}
-function getOrStartTokenRefresh(flights, key, forceRefresh, refresh, signal) {
-  const existing = flights.get(key);
-  if (existing && (!forceRefresh || existing.forceRefresh)) {
-    return waitForTokenRefresh(existing.promise, signal);
-  }
-  const operation = existing ? existing.promise.then(refresh, refresh) : refresh();
-  let flight;
-  const promise = operation.finally(() => {
-    if (flights.get(key) === flight) flights.delete(key);
-  });
-  flight = { forceRefresh, promise };
-  flights.set(key, flight);
-  return waitForTokenRefresh(promise, signal);
-}
-function refreshLockPath(envName) {
-  return `${storePathFor(envName)}.refresh.lock`;
-}
-function pendingOAuthRefreshPrefix(envName) {
-  return `${path5.basename(storePathFor(envName))}.refresh-result.`;
-}
-function parsePendingOAuthRefresh(raw) {
-  try {
-    const parsed = JSON.parse(raw);
-    const refreshed = parsed.refreshed;
-    if (parsed.version !== 1 || typeof parsed.previousRefreshTokenHash !== "string" || !/^[a-f0-9]{64}$/.test(parsed.previousRefreshTokenHash) || typeof parsed.createdAtMs !== "number" || !Number.isFinite(parsed.createdAtMs) || !refreshed || typeof refreshed.accessToken !== "string" || typeof refreshed.refreshToken !== "string" || typeof refreshed.expiresAt !== "number" || !Number.isFinite(refreshed.expiresAt) || !refreshed.user || typeof refreshed.user.id !== "string" || typeof refreshed.user.email !== "string" || typeof refreshed.user.name !== "string") {
-      return null;
-    }
-    return parsed;
-  } catch {
-    return null;
-  }
-}
-function stagePendingOAuthRefresh(previousRefreshToken, refreshed, envName) {
-  ensureDir(envName);
-  const resultPath = `${storePathFor(envName)}.refresh-result.${Date.now()}.${randomUUID2()}.json`;
-  const pending = {
-    version: 1,
-    previousRefreshTokenHash: credentialHash(previousRefreshToken),
-    refreshed,
-    createdAtMs: Date.now()
-  };
-  writeSecretFile(resultPath, `${JSON.stringify(pending)}
-`);
-  return resultPath;
-}
-function removePendingOAuthRefresh(resultPath) {
-  try {
-    fs3.unlinkSync(resultPath);
-  } catch (error) {
-    if (error.code !== "ENOENT") {
-      console.error(
-        `[fml] Auth: unable to remove a committed refresh result: ${error instanceof Error ? error.message : String(error)}`
-      );
-    }
-  }
-}
-function reconcilePendingOAuthRefreshes(envName, unreadableStorePolicy = "preserve-staged") {
-  const storePath = storePathFor(envName);
-  const directory = path5.dirname(storePath);
-  const prefix = pendingOAuthRefreshPrefix(envName);
-  let resultPaths;
-  try {
-    resultPaths = fs3.readdirSync(directory).filter((entry) => entry.startsWith(prefix) && entry.endsWith(".json")).map((entry) => path5.join(directory, entry));
-  } catch (error) {
-    if (error.code === "ENOENT") return;
-    throw error;
-  }
-  const pendingResults = resultPaths.map((resultPath) => {
-    let pending = null;
-    try {
-      pending = parsePendingOAuthRefresh(fs3.readFileSync(resultPath, "utf8"));
-    } catch (error) {
-      if (error.code !== "ENOENT") throw error;
+      pending = parsePendingOAuthRefresh(fs4.readFileSync(resultPath, "utf8"));
+    } catch (error) {
+      if (error.code !== "ENOENT") throw error;
     }
     return { resultPath, pending };
   }).sort(
@@ -1274,7 +746,7 @@ function parseRefreshLockOwner(raw) {
 function getProcessIdentity(pid) {
   try {
     if (process.platform === "linux") {
-      const stat = fs3.readFileSync(`/proc/${pid}/stat`, "utf8");
+      const stat = fs4.readFileSync(`/proc/${pid}/stat`, "utf8");
       const fieldsAfterCommand = stat.slice(stat.lastIndexOf(")") + 2).split(" ");
       const startTimeTicks = fieldsAfterCommand[19];
       return startTimeTicks ? `linux:${startTimeTicks}` : null;
@@ -1326,7 +798,7 @@ function parseRecoveryMarkerOwner(raw) {
 function snapshotLeaseFile(filePath) {
   let stat;
   try {
-    stat = fs3.lstatSync(filePath);
+    stat = fs4.lstatSync(filePath);
   } catch (error) {
     if (error.code === "ENOENT") return null;
     throw error;
@@ -1335,7 +807,7 @@ function snapshotLeaseFile(filePath) {
     try {
       return {
         stat,
-        raw: fs3.readFileSync(path5.join(filePath, "owner.json"), "utf8")
+        raw: fs4.readFileSync(path6.join(filePath, "owner.json"), "utf8")
       };
     } catch (error) {
       if (error.code === "ENOENT") {
@@ -1345,7 +817,7 @@ function snapshotLeaseFile(filePath) {
     }
   }
   try {
-    return { stat, raw: fs3.readFileSync(filePath, "utf8") };
+    return { stat, raw: fs4.readFileSync(filePath, "utf8") };
   } catch (error) {
     if (error.code === "ENOENT") return null;
     throw error;
@@ -1357,21 +829,21 @@ function snapshotsMatch(observed, current) {
 function restoreMovedLease(movedPath, originalPath) {
   let movedStat;
   try {
-    movedStat = fs3.lstatSync(movedPath);
+    movedStat = fs4.lstatSync(movedPath);
   } catch (error) {
     if (error.code === "ENOENT") return;
     throw error;
   }
   if (!movedStat.isFile()) return;
   try {
-    fs3.linkSync(movedPath, originalPath);
+    fs4.linkSync(movedPath, originalPath);
   } catch (error) {
     const code = error.code;
     if (code === "EEXIST" || code === "ENOENT") return;
     throw error;
   }
   try {
-    fs3.unlinkSync(movedPath);
+    fs4.unlinkSync(movedPath);
   } catch (error) {
     if (error.code !== "ENOENT") throw error;
   }
@@ -1385,27 +857,27 @@ function pathMatchesClaim(filePath, claimedStat, ownerId, parseOwner) {
 function markClaimReleased(filePath, claimedStat, owner, parseOwner) {
   let descriptor;
   try {
-    descriptor = fs3.openSync(filePath, "r+");
+    descriptor = fs4.openSync(filePath, "r+");
   } catch (error) {
     if (error.code === "ENOENT") return false;
     throw error;
   }
   try {
-    const currentStat = fs3.fstatSync(descriptor);
+    const currentStat = fs4.fstatSync(descriptor);
     if (currentStat.dev !== claimedStat.dev || currentStat.ino !== claimedStat.ino) {
       return false;
     }
-    const currentOwner = parseOwner(fs3.readFileSync(descriptor, "utf8"));
+    const currentOwner = parseOwner(fs4.readFileSync(descriptor, "utf8"));
     if (currentOwner?.ownerId !== owner.ownerId) return false;
     const serialized = Buffer.from(
       `${JSON.stringify({ ...owner, releasedAtMs: Date.now() })}
 `,
       "utf8"
     );
-    fs3.ftruncateSync(descriptor, 0);
+    fs4.ftruncateSync(descriptor, 0);
     let offset = 0;
     while (offset < serialized.length) {
-      offset += fs3.writeSync(
+      offset += fs4.writeSync(
         descriptor,
         serialized,
         offset,
@@ -1413,19 +885,19 @@ function markClaimReleased(filePath, claimedStat, owner, parseOwner) {
         offset
       );
     }
-    fs3.fsyncSync(descriptor);
+    fs4.fsyncSync(descriptor);
     return true;
   } finally {
-    fs3.closeSync(descriptor);
+    fs4.closeSync(descriptor);
   }
 }
 function releaseOwnedLease(filePath, claimedStat, owner, parseOwner, description) {
-  const releasedPath = `${filePath}.released.${randomUUID2()}`;
+  const releasedPath = `${filePath}.released.${randomUUID3()}`;
   let moved = false;
   try {
     if (!markClaimReleased(filePath, claimedStat, owner, parseOwner)) return;
     try {
-      fs3.renameSync(filePath, releasedPath);
+      fs4.renameSync(filePath, releasedPath);
       moved = true;
     } catch (error) {
       if (error.code === "ENOENT") return;
@@ -1438,7 +910,7 @@ function releaseOwnedLease(filePath, claimedStat, owner, parseOwner, description
       moved = false;
       return;
     }
-    fs3.rmSync(releasedPath, {
+    fs4.rmSync(releasedPath, {
       recursive: released.stat.isDirectory(),
       force: true
     });
@@ -1490,7 +962,6 @@ function isProcessAlive(pid) {
     return error.code === "EPERM";
   }
 }
-var processIdentityChecks = /* @__PURE__ */ new Map();
 function ownerPidWasReused(owner, lockMtimeMs) {
   const now = Date.now();
   if (now - Math.max(owner.createdAtMs, lockMtimeMs) < PROCESS_IDENTITY_STALE_MS)
@@ -1513,9 +984,9 @@ function ownerPidWasReused(owner, lockMtimeMs) {
   return currentIdentity !== null && currentIdentity !== owner.processIdentity;
 }
 function writeClaimToDescriptor(descriptor, serializedOwner) {
-  const claimedStat = fs3.fstatSync(descriptor);
-  fs3.writeFileSync(descriptor, serializedOwner, { encoding: "utf8" });
-  fs3.fsyncSync(descriptor);
+  const claimedStat = fs4.fstatSync(descriptor);
+  fs4.writeFileSync(descriptor, serializedOwner, { encoding: "utf8" });
+  fs4.fsyncSync(descriptor);
   return claimedStat;
 }
 function recoverAbandonedRecoveryMarker(recoveryPath) {
@@ -1525,15 +996,15 @@ function recoverAbandonedRecoveryMarker(recoveryPath) {
   const ownerAlive = owner ? isProcessAlive(owner.pid) : false;
   const reclaimable = owner ? owner.releasedAtMs !== void 0 || !ownerAlive || ownerAlive && ownerPidWasReused(owner, observed.stat.mtimeMs) : Date.now() - observed.stat.mtimeMs > OAUTH_REFRESH_RECOVERY_STALE_MS;
   if (!reclaimable) return;
-  const abandonedPath = `${recoveryPath}.stale.${randomUUID2()}`;
+  const abandonedPath = `${recoveryPath}.stale.${randomUUID3()}`;
   try {
-    fs3.renameSync(recoveryPath, abandonedPath);
+    fs4.renameSync(recoveryPath, abandonedPath);
     const moved = snapshotLeaseFile(abandonedPath);
     if (!moved || !snapshotsMatch(observed, moved)) {
       restoreMovedLease(abandonedPath, recoveryPath);
       return;
     }
-    fs3.rmSync(abandonedPath, {
+    fs4.rmSync(abandonedPath, {
       recursive: moved.stat.isDirectory(),
       force: true
     });
@@ -1542,7 +1013,7 @@ function recoverAbandonedRecoveryMarker(recoveryPath) {
   }
 }
 function acquireRecoveryMarker(recoveryPath) {
-  const ownerId = randomUUID2();
+  const ownerId = randomUUID3();
   const owner = {
     version: 1,
     ownerId,
@@ -1553,7 +1024,7 @@ function acquireRecoveryMarker(recoveryPath) {
   };
   let descriptor;
   try {
-    descriptor = fs3.openSync(recoveryPath, "wx", 384);
+    descriptor = fs4.openSync(recoveryPath, "wx", 384);
   } catch (error) {
     if (error.code === "EEXIST") return null;
     throw error;
@@ -1566,7 +1037,7 @@ function acquireRecoveryMarker(recoveryPath) {
 `
     );
   } finally {
-    fs3.closeSync(descriptor);
+    fs4.closeSync(descriptor);
   }
   const isOwned = () => pathMatchesClaim(
     recoveryPath,
@@ -1610,15 +1081,15 @@ function recoverStaleRefreshLock(lockPath) {
     }
     if (!reclaimable) return;
     if (!recovery.isOwned()) return;
-    const abandonedPath = `${lockPath}.stale.${randomUUID2()}`;
+    const abandonedPath = `${lockPath}.stale.${randomUUID3()}`;
     try {
-      fs3.renameSync(lockPath, abandonedPath);
+      fs4.renameSync(lockPath, abandonedPath);
       const moved = snapshotLeaseFile(abandonedPath);
       if (!moved || !snapshotsMatch(observed, moved)) {
         restoreMovedLease(abandonedPath, lockPath);
         return;
       }
-      fs3.rmSync(abandonedPath, {
+      fs4.rmSync(abandonedPath, {
         recursive: moved.stat.isDirectory(),
         force: true
       });
@@ -1645,7 +1116,7 @@ async function acquireRefreshLock(envName, signal) {
     if (signal?.aborted) {
       throw signal.reason ?? new DOMException("The operation was aborted", "AbortError");
     }
-    if (fs3.existsSync(recoveryPath)) {
+    if (fs4.existsSync(recoveryPath)) {
       try {
         recoverAbandonedRecoveryMarker(recoveryPath);
       } catch (recoveryError) {
@@ -1659,7 +1130,7 @@ async function acquireRefreshLock(envName, signal) {
     }
     let descriptor;
     try {
-      descriptor = fs3.openSync(lockPath, "wx", 384);
+      descriptor = fs4.openSync(lockPath, "wx", 384);
     } catch (error) {
       if (error.code !== "EEXIST") {
         console.error(
@@ -1678,7 +1149,7 @@ async function acquireRefreshLock(envName, signal) {
       await sleep(OAUTH_REFRESH_LOCK_POLL_MS, signal);
       continue;
     }
-    const ownerId = randomUUID2();
+    const ownerId = randomUUID3();
     const owner = {
       version: 1,
       ownerId,
@@ -1695,13 +1166,13 @@ async function acquireRefreshLock(envName, signal) {
 `
       );
     } catch (error) {
-      fs3.closeSync(descriptor);
+      fs4.closeSync(descriptor);
       console.error(
         `[fml] Auth: unable to initialize refresh lock: ${error instanceof Error ? error.message : String(error)}`
       );
       return null;
     }
-    fs3.closeSync(descriptor);
+    fs4.closeSync(descriptor);
     const isOwned = () => pathMatchesClaim(lockPath, claimedStat, ownerId, parseRefreshLockOwner);
     const releaseClaim = () => releaseOwnedLease(
       lockPath,
@@ -1716,7 +1187,7 @@ async function acquireRefreshLock(envName, signal) {
     }
     let entryBlocked;
     try {
-      entryBlocked = fs3.existsSync(recoveryPath) || !isOwned();
+      entryBlocked = fs4.existsSync(recoveryPath) || !isOwned();
     } catch (error) {
       console.error(
         `[fml] Auth: unable to verify refresh lock ownership: ${describeError(error)}`
@@ -1882,7 +1353,7 @@ async function getValidToken(opts) {
     return stored.accessToken;
   }
   if (stored.tokenType === "service") {
-    return await getOrStartTokenRefresh(
+    const accessToken2 = await getOrStartTokenRefresh(
       serviceRefreshPromises,
       key,
       forceRefresh,
@@ -1928,6 +1399,12 @@ async function getValidToken(opts) {
       }),
       opts?.signal
     );
+    await refreshTelemetryConfigAfterTokenRefresh(
+      envName,
+      accessToken2,
+      opts?.signal
+    );
+    return accessToken2;
   }
   if (stored.refreshInvalidAt) {
     console.error(
@@ -1935,13 +1412,34 @@ async function getValidToken(opts) {
     );
     return null;
   }
-  return await getOrStartTokenRefresh(
+  const accessToken = await getOrStartTokenRefresh(
     oauthRefreshPromises,
     key,
     forceRefresh,
     () => refreshTokenWithLock(envName, forceRefresh, opts?.signal),
     opts?.signal
   );
+  await refreshTelemetryConfigAfterTokenRefresh(
+    envName,
+    accessToken,
+    opts?.signal
+  );
+  return accessToken;
+}
+async function refreshTelemetryConfigAfterTokenRefresh(envName, accessToken, signal) {
+  if (!accessToken || signal?.aborted) return;
+  try {
+    const current = readTokens(envName);
+    if (current?.accessToken !== accessToken) return;
+    const { refreshCliTelemetryConfig: refreshCliTelemetryConfig2 } = await Promise.resolve().then(() => (init_telemetry_config(), telemetry_config_exports));
+    await refreshCliTelemetryConfig2({
+      envName,
+      accessToken,
+      siteUrl: current.siteUrl,
+      signal
+    });
+  } catch {
+  }
 }
 async function refreshTokenWithLock(envName, forceRefresh = false, signal) {
   const lock = await acquireRefreshLock(envName, signal);
@@ -2047,7 +1545,9 @@ async function refreshToken(stored, lock, envName, signal) {
       },
       orgId: stored.orgId,
       orgSlug: stored.orgSlug,
-      workosClientId: stored.workosClientId
+      workosClientId: stored.workosClientId,
+      // The backend this login belongs to does not change on rotation.
+      ...stored.siteUrl ? { siteUrl: stored.siteUrl } : {}
     };
     const pendingPath = stagePendingOAuthRefresh(
       stored.refreshToken,
@@ -2082,6 +1582,733 @@ async function refreshToken(stored, lock, envName, signal) {
     return null;
   }
 }
+var TOKEN_REFRESH_WINDOW_MS, OAUTH_REFRESH_LOCK_POLL_MS, OAUTH_REFRESH_LOCK_STALE_MS, OAUTH_REFRESH_RECOVERY_STALE_MS, OAUTH_REFRESH_LOCK_WAIT_MS, OAUTH_REFRESH_REQUEST_TIMEOUT_MS, PROCESS_IDENTITY_STALE_MS, PROCESS_IDENTITY_RECHECK_MS, PROCESS_INSTANCE_KEY, PROCESS_IDENTITY_KEY, processGlobals, existingProcessInstanceId, CURRENT_PROCESS_INSTANCE_ID, CorruptStoredCredentialsError, serviceTokenCaches, serviceRefreshPromises, oauthRefreshPromises, cacheKey, processIdentityChecks;
+var init_token_store = __esm({
+  "src/auth/token-store.ts"() {
+    "use strict";
+    init_config();
+    init_sentry();
+    TOKEN_REFRESH_WINDOW_MS = 6e4;
+    OAUTH_REFRESH_LOCK_POLL_MS = 50;
+    OAUTH_REFRESH_LOCK_STALE_MS = 45e3;
+    OAUTH_REFRESH_RECOVERY_STALE_MS = 45e3;
+    OAUTH_REFRESH_LOCK_WAIT_MS = 6e4;
+    OAUTH_REFRESH_REQUEST_TIMEOUT_MS = 3e4;
+    PROCESS_IDENTITY_STALE_MS = 45e3;
+    PROCESS_IDENTITY_RECHECK_MS = 5e3;
+    PROCESS_INSTANCE_KEY = /* @__PURE__ */ Symbol.for("@fml-inc/fml:auth-process-instance");
+    PROCESS_IDENTITY_KEY = /* @__PURE__ */ Symbol.for("@fml-inc/fml:auth-process-identity");
+    processGlobals = globalThis;
+    existingProcessInstanceId = processGlobals[PROCESS_INSTANCE_KEY];
+    CURRENT_PROCESS_INSTANCE_ID = typeof existingProcessInstanceId === "string" ? existingProcessInstanceId : randomUUID3();
+    processGlobals[PROCESS_INSTANCE_KEY] = CURRENT_PROCESS_INSTANCE_ID;
+    CorruptStoredCredentialsError = class extends Error {
+    };
+    serviceTokenCaches = /* @__PURE__ */ new Map();
+    serviceRefreshPromises = /* @__PURE__ */ new Map();
+    oauthRefreshPromises = /* @__PURE__ */ new Map();
+    cacheKey = (envName) => envName;
+    processIdentityChecks = /* @__PURE__ */ new Map();
+  }
+});
+
+// src/pi/extension.ts
+import { randomUUID as randomUUID4 } from "node:crypto";
+import fs5 from "node:fs";
+import os2 from "node:os";
+import path8 from "node:path";
+
+// ../../packages/agent-targets/src/install/pi/index.ts
+import fs from "node:fs";
+import path from "node:path";
+import { randomUUID } from "node:crypto";
+var FML_PI_EXTENSION_MARKER = "__FML_PI_EXTENSION_V1__";
+var LEGACY_PI_EXTENSION_MARKER = "__panopticonPiExtensionTest";
+var LEGACY_PI_EXTENSION_SIGNATURES = Object.freeze([
+  "PANOPTICON_PORT",
+  '"/hooks"',
+  "UserPromptSubmit",
+  "PreToolUse",
+  "PostToolUse",
+  "SessionEnd"
+]);
+function pathApiFor(platform) {
+  return platform === "win32" ? path.win32 : path.posix;
+}
+function resolvePiAgentDir(context, pathApi) {
+  const configured = context.env.PI_CODING_AGENT_DIR?.trim();
+  if (!configured) {
+    return pathApi.join(context.homeDir, ".pi", "agent");
+  }
+  if (configured === "~") return context.homeDir;
+  if (configured.startsWith("~/") || configured.startsWith("~\\")) {
+    return pathApi.join(context.homeDir, configured.slice(2));
+  }
+  return pathApi.normalize(configured);
+}
+function readFileIfPresent(filePath) {
+  try {
+    return fs.readFileSync(filePath, "utf8");
+  } catch (error) {
+    if (error.code === "ENOENT") return null;
+    throw error;
+  }
+}
+function isOwnedExtension(source, legacy = false) {
+  return source.includes(FML_PI_EXTENSION_MARKER) || legacy && (source.includes(LEGACY_PI_EXTENSION_MARKER) || LEGACY_PI_EXTENSION_SIGNATURES.every(
+    (signature) => source.includes(signature)
+  ));
+}
+function removeLegacyExtension(filePath) {
+  const source = readFileIfPresent(filePath);
+  if (source === null) return { removed: false, preserved: false };
+  if (!isOwnedExtension(source, true)) {
+    return { removed: false, preserved: true };
+  }
+  fs.rmSync(filePath);
+  return { removed: true, preserved: false };
+}
+function writeExtensionAtomically(filePath, source) {
+  fs.mkdirSync(path.dirname(filePath), { recursive: true, mode: 448 });
+  const temporaryPath = path.join(
+    path.dirname(filePath),
+    `.${path.basename(filePath)}.${process.pid}.${randomUUID()}.tmp`
+  );
+  try {
+    fs.writeFileSync(temporaryPath, source, { encoding: "utf8", mode: 384 });
+    if (process.platform === "win32" && fs.existsSync(filePath)) {
+      fs.rmSync(filePath);
+    }
+    fs.renameSync(temporaryPath, filePath);
+  } finally {
+    fs.rmSync(temporaryPath, { force: true });
+  }
+}
+var PI_EXTENSION_INSTALLER = Object.freeze({
+  resolvePaths(context) {
+    const pathApi = pathApiFor(context.platform);
+    const extensionsDir = pathApi.join(
+      resolvePiAgentDir(context, pathApi),
+      "extensions"
+    );
+    return {
+      sourcePath: pathApi.join(
+        context.packageRoot,
+        "dist",
+        "pi",
+        "extension.js"
+      ),
+      extensionsDir,
+      destinationPath: pathApi.join(extensionsDir, "fml.js"),
+      legacyDestinationPath: pathApi.join(extensionsDir, "panopticon.js")
+    };
+  },
+  install(paths) {
+    const source = fs.readFileSync(paths.sourcePath, "utf8");
+    if (!source.includes(FML_PI_EXTENSION_MARKER)) {
+      throw new Error(
+        `Packaged Pi extension is invalid: ${paths.sourcePath} does not contain the FML ownership marker`
+      );
+    }
+    const existing = readFileIfPresent(paths.destinationPath);
+    if (existing !== null && !isOwnedExtension(existing)) {
+      const legacy2 = removeLegacyExtension(paths.legacyDestinationPath);
+      return {
+        status: "preserved",
+        destinationPath: paths.destinationPath,
+        reason: "an extension not managed by FML already exists at this path",
+        legacyRemoved: legacy2.removed,
+        legacyPreserved: legacy2.preserved
+      };
+    }
+    const status = existing === null ? "installed" : existing === source ? "unchanged" : "updated";
+    if (status !== "unchanged") {
+      writeExtensionAtomically(paths.destinationPath, source);
+    }
+    const legacy = removeLegacyExtension(paths.legacyDestinationPath);
+    return {
+      status,
+      destinationPath: paths.destinationPath,
+      legacyRemoved: legacy.removed,
+      legacyPreserved: legacy.preserved
+    };
+  },
+  uninstall(paths) {
+    const existing = readFileIfPresent(paths.destinationPath);
+    const legacy = removeLegacyExtension(paths.legacyDestinationPath);
+    if (existing === null) {
+      return {
+        status: "absent",
+        destinationPath: paths.destinationPath,
+        legacyRemoved: legacy.removed,
+        legacyPreserved: legacy.preserved
+      };
+    }
+    if (!isOwnedExtension(existing)) {
+      return {
+        status: "preserved",
+        destinationPath: paths.destinationPath,
+        reason: "the existing extension is not managed by FML",
+        legacyRemoved: legacy.removed,
+        legacyPreserved: legacy.preserved
+      };
+    }
+    fs.rmSync(paths.destinationPath);
+    return {
+      status: "removed",
+      destinationPath: paths.destinationPath,
+      legacyRemoved: legacy.removed,
+      legacyPreserved: legacy.preserved
+    };
+  }
+});
+
+// src/hooks/context.ts
+import { createHash as createHash4 } from "node:crypto";
+import path7 from "node:path";
+
+// ../../packages/agent-targets/src/hooks/normalize.ts
+import { createHash } from "node:crypto";
+
+// ../../packages/agent-targets/src/hooks/types.ts
+var HOOK_TARGETS = Object.freeze([
+  "claude",
+  "codex",
+  "gemini",
+  "grok",
+  "pi"
+]);
+
+// ../../packages/agent-targets/src/catalog/hook-events.json
+var hook_events_default = {
+  claude: [
+    "SessionStart",
+    "Setup",
+    "InstructionsLoaded",
+    "UserPromptSubmit",
+    "UserPromptExpansion",
+    "PreToolUse",
+    "PermissionRequest",
+    "PostToolUse",
+    "PostToolUseFailure",
+    "PostToolBatch",
+    "PermissionDenied",
+    "Notification",
+    "SubagentStart",
+    "SubagentStop",
+    "TaskCreated",
+    "TaskCompleted",
+    "Stop",
+    "StopFailure",
+    "TeammateIdle",
+    "ConfigChange",
+    "CwdChanged",
+    "PreCompact",
+    "PostCompact",
+    "SessionEnd",
+    "Elicitation",
+    "ElicitationResult"
+  ],
+  codex: [
+    "SessionStart",
+    "UserPromptSubmit",
+    "PreToolUse",
+    "PermissionRequest",
+    "PostToolUse",
+    "Stop"
+  ],
+  gemini: [
+    "SessionStart",
+    "BeforeAgent",
+    "BeforeTool",
+    "AfterTool",
+    "AfterAgent"
+  ],
+  grok: [
+    "SessionStart",
+    "UserPromptSubmit",
+    "PreToolUse",
+    "PostToolUse",
+    "PostToolUseFailure",
+    "PermissionDenied",
+    "Stop",
+    "StopFailure",
+    "Notification",
+    "SubagentStart",
+    "SubagentStop",
+    "PreCompact",
+    "PostCompact",
+    "SessionEnd"
+  ],
+  pi: [
+    "SessionStart",
+    "UserPromptSubmit",
+    "TurnStart",
+    "PreToolUse",
+    "PostToolUse",
+    "PostToolUseFailure",
+    "Stop",
+    "Notification",
+    "ConfigChange",
+    "PreCompact",
+    "PostCompact",
+    "SessionEnd"
+  ]
+};
+
+// ../../packages/agent-targets/src/catalog/hook-events.ts
+var CLAUDE_HOOK_EVENTS = Object.freeze([
+  ...hook_events_default.claude
+]);
+var CODEX_HOOK_EVENTS = Object.freeze([
+  ...hook_events_default.codex
+]);
+var GEMINI_HOOK_EVENTS = Object.freeze([
+  ...hook_events_default.gemini
+]);
+var GROK_HOOK_EVENTS = Object.freeze([
+  ...hook_events_default.grok
+]);
+var PI_HOOK_EVENTS = Object.freeze([...hook_events_default.pi]);
+
+// ../../packages/agent-targets/src/hooks/read-command.ts
+import path2 from "node:path";
+var SHELL_TOOL_NAMES = /* @__PURE__ */ new Set([
+  "bash",
+  "exec_command",
+  "shell"
+]);
+var COMMAND_SEPARATORS = /* @__PURE__ */ new Set([
+  ";",
+  "&",
+  "&&",
+  "|",
+  "||",
+  "<",
+  "<<",
+  ">",
+  ">>",
+  ">&1",
+  ">&2",
+  "1>",
+  "1>>",
+  "1>&1",
+  "1>&2",
+  "2>",
+  "2>>",
+  "2>&1",
+  "2>&2"
+]);
+function tokenizeShellLikeCommand(command) {
+  const tokens = [];
+  let current = "";
+  let quote = null;
+  let escaping = false;
+  for (let index = 0; index < command.length; index += 1) {
+    const character = command[index];
+    if (escaping) {
+      current += character;
+      escaping = false;
+      continue;
+    }
+    if (character === "\\") {
+      escaping = true;
+      continue;
+    }
+    if (quote) {
+      if (character === quote) quote = null;
+      else current += character;
+      continue;
+    }
+    if (character === "'" || character === '"') {
+      quote = character;
+      continue;
+    }
+    if (current === "" && (character === "1" || character === "2") && command[index + 1] === ">") {
+      if (command[index + 2] === ">") {
+        tokens.push(`${character}>>`);
+        index += 2;
+      } else if (command[index + 2] === "&" && (command[index + 3] === "1" || command[index + 3] === "2")) {
+        tokens.push(`${character}>&${command[index + 3]}`);
+        index += 3;
+      } else {
+        tokens.push(`${character}>`);
+        index += 1;
+      }
+      continue;
+    }
+    if (/[;&|<>]/.test(character)) {
+      if (current) {
+        tokens.push(current);
+        current = "";
+      }
+      const next = command[index + 1];
+      if (character === ">" && next === "&" && (command[index + 2] === "1" || command[index + 2] === "2")) {
+        tokens.push(`>&${command[index + 2]}`);
+        index += 2;
+        continue;
+      }
+      if (character === "&" && next === "&" || character === "|" && next === "|" || character === "<" && next === "<" || character === ">" && next === ">") {
+        tokens.push(`${character}${next}`);
+        index += 1;
+        continue;
+      }
+      tokens.push(character);
+      continue;
+    }
+    if (/\s/.test(character)) {
+      if (current) {
+        tokens.push(current);
+        current = "";
+      }
+      continue;
+    }
+    current += character;
+  }
+  if (quote || escaping) return [];
+  if (current) tokens.push(current);
+  return tokens;
+}
+function splitCommandSegments(tokens) {
+  const segments = [];
+  let current = [];
+  for (let index = 0; index < tokens.length; index += 1) {
+    const token = tokens[index];
+    if (COMMAND_SEPARATORS.has(token)) {
+      if (current.length > 0) {
+        segments.push(current);
+        current = [];
+      }
+      if (token === "<" || token === "<<") index += 1;
+      continue;
+    }
+    current.push(token);
+  }
+  if (current.length > 0) segments.push(current);
+  return segments;
+}
+function stripSimpleOptions(args, flagsWithValues = /* @__PURE__ */ new Set(), patternFlags = /* @__PURE__ */ new Set()) {
+  const remaining = [];
+  let consumedPatternFlag = false;
+  for (let index = 0; index < args.length; index += 1) {
+    const argument = args[index];
+    if (argument === "--") {
+      remaining.push(...args.slice(index + 1));
+      break;
+    }
+    if (argument.startsWith("-") && argument.length > 1) {
+      if (flagsWithValues.has(argument)) {
+        if (patternFlags.has(argument)) consumedPatternFlag = true;
+        if (!argument.includes("=")) index += 1;
+      }
+      continue;
+    }
+    remaining.push(argument);
+  }
+  return { args: remaining, consumedPatternFlag };
+}
+function readCommandFileArgs(args, flagsWithValues, patternFlags = flagsWithValues) {
+  const stripped = stripSimpleOptions(args, flagsWithValues, patternFlags);
+  return stripped.consumedPatternFlag ? stripped.args : stripped.args.slice(1);
+}
+function isPlausibleReadPath(argument) {
+  if (!argument || argument === "-" || argument.startsWith("-")) return false;
+  if (COMMAND_SEPARATORS.has(argument)) return false;
+  if (/[\0*?[{}`$]/.test(argument)) return false;
+  if (/^[A-Za-z_][A-Za-z0-9_]*=/.test(argument)) return false;
+  return path2.posix.isAbsolute(argument) || path2.win32.isAbsolute(argument) || argument.startsWith("~/") || argument.startsWith("./") || argument.startsWith("../") || argument.includes("/") || /\.[A-Za-z0-9][A-Za-z0-9_-]*$/.test(argument) || /^[A-Z][A-Za-z0-9_.-]*$/.test(argument);
+}
+function filePathFromSegment(tokens) {
+  const commandTokens = [...tokens];
+  while (commandTokens[0]?.includes("=") && /^[A-Za-z_][A-Za-z0-9_]*=/.test(commandTokens[0])) {
+    commandTokens.shift();
+  }
+  const commandName = commandTokens.shift()?.split("/").pop();
+  if (!commandName) return null;
+  let args;
+  switch (commandName) {
+    case "bat":
+    case "batcat":
+    case "cat":
+    case "file":
+    case "less":
+    case "more":
+    case "nl":
+    case "stat":
+    case "wc":
+      args = stripSimpleOptions(commandTokens).args;
+      break;
+    case "head":
+    case "tail":
+      args = stripSimpleOptions(commandTokens, /* @__PURE__ */ new Set(["-n", "-c"])).args;
+      break;
+    case "sed":
+      if (commandTokens.some(
+        (argument) => argument.startsWith("-i") || argument === "--in-place" || argument.startsWith("--in-place=")
+      )) {
+        return null;
+      }
+      args = readCommandFileArgs(commandTokens, /* @__PURE__ */ new Set(["-e", "-f"]));
+      break;
+    case "awk":
+      args = readCommandFileArgs(
+        commandTokens,
+        /* @__PURE__ */ new Set(["-f", "-v"]),
+        /* @__PURE__ */ new Set(["-f"])
+      );
+      break;
+    case "grep":
+    case "rg":
+      args = readCommandFileArgs(
+        commandTokens,
+        /* @__PURE__ */ new Set(["-A", "-B", "-C", "-e", "-f", "-g", "-m", "-t"]),
+        /* @__PURE__ */ new Set(["-e", "-f"])
+      );
+      break;
+    default:
+      return null;
+  }
+  return args.find(isPlausibleReadPath) ?? null;
+}
+function extractReadFilePathFromCommand(command) {
+  const tokens = tokenizeShellLikeCommand(command);
+  if (tokens.length === 0) return null;
+  for (let index = 0; index < tokens.length - 1; index += 1) {
+    if (tokens[index] === "<" && isPlausibleReadPath(tokens[index + 1])) {
+      return tokens[index + 1];
+    }
+  }
+  for (const segment of splitCommandSegments(tokens)) {
+    const filePath = filePathFromSegment(segment);
+    if (filePath) return filePath;
+  }
+  return null;
+}
+
+// ../../packages/agent-targets/src/hooks/normalize.ts
+var MAX_EXTRACTED_TEXT_BYTES = 64 * 1024;
+function isRecord(value) {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+function firstString(record, keys) {
+  for (const key of keys) {
+    const value = record[key];
+    if (typeof value === "string" && value.length > 0) return value;
+  }
+  return void 0;
+}
+function extractedText(value) {
+  if (typeof value === "string") return value;
+  if (value === void 0 || value === null) return void 0;
+  try {
+    return JSON.stringify(value);
+  } catch {
+    return void 0;
+  }
+}
+function firstText(record, keys) {
+  for (const key of keys) {
+    const value = extractedText(record[key]);
+    if (value !== void 0 && value.length > 0) return value;
+  }
+  return void 0;
+}
+function utf8Prefix(value, maxBytes) {
+  let low = 0;
+  let high = value.length;
+  while (low < high) {
+    const middle = Math.ceil((low + high) / 2);
+    if (Buffer.byteLength(value.slice(0, middle), "utf8") <= maxBytes) {
+      low = middle;
+    } else {
+      high = middle - 1;
+    }
+  }
+  let end = low;
+  if (end > 0 && end < value.length && value.charCodeAt(end - 1) >= 55296 && value.charCodeAt(end - 1) <= 56319 && value.charCodeAt(end) >= 56320 && value.charCodeAt(end) <= 57343) {
+    end -= 1;
+  }
+  return value.slice(0, end);
+}
+function boundedExtractedText(value, field) {
+  if (value === void 0) return void 0;
+  const originalBytes = Buffer.byteLength(value, "utf8");
+  if (originalBytes <= MAX_EXTRACTED_TEXT_BYTES) return value;
+  const digest = createHash("sha256").update(value).digest("hex");
+  const marker = `
+[fml:${field}:truncated originalBytes=${originalBytes} sha256=${digest}]`;
+  return `${utf8Prefix(
+    value,
+    MAX_EXTRACTED_TEXT_BYTES - Buffer.byteLength(marker, "utf8")
+  )}${marker}`;
+}
+function nestedRecord(record, keys) {
+  for (const key of keys) {
+    const value = record[key];
+    if (isRecord(value)) return value;
+  }
+  return void 0;
+}
+function timestampMs(payload, fallback) {
+  for (const key of ["timestamp_ms", "timestampMs", "timestamp"]) {
+    const value = payload[key];
+    if (typeof value === "number" && Number.isFinite(value) && value > 0) {
+      const milliseconds = Math.round(
+        value < 1e10 ? value * 1e3 : value
+      );
+      if (Number.isSafeInteger(milliseconds) && milliseconds > 0) {
+        return milliseconds;
+      }
+    }
+    if (typeof value === "string") {
+      const parsed = Date.parse(value);
+      if (Number.isSafeInteger(parsed) && parsed >= 0) return parsed;
+    }
+  }
+  return fallback;
+}
+function geminiEventType(eventType) {
+  switch (eventType) {
+    case "BeforeAgent":
+    case "BeforeModel":
+      return "UserPromptSubmit";
+    case "BeforeTool":
+      return "PreToolUse";
+    case "AfterTool":
+      return "PostToolUse";
+    case "AfterAgent":
+      return "Stop";
+    default:
+      return eventType;
+  }
+}
+var GROK_EVENT_TYPES = Object.freeze({
+  session_start: "SessionStart",
+  user_prompt_submit: "UserPromptSubmit",
+  pre_tool_use: "PreToolUse",
+  post_tool_use: "PostToolUse",
+  post_tool_use_failure: "PostToolUseFailure",
+  permission_denied: "PermissionDenied",
+  stop: "Stop",
+  stop_failure: "StopFailure",
+  notification: "Notification",
+  subagent_start: "SubagentStart",
+  subagent_stop: "SubagentStop",
+  pre_compact: "PreCompact",
+  post_compact: "PostCompact",
+  session_end: "SessionEnd"
+});
+function grokEventType(eventType) {
+  return Object.hasOwn(GROK_EVENT_TYPES, eventType) ? GROK_EVENT_TYPES[eventType] ?? eventType : eventType;
+}
+function geminiUserPrompt(payload) {
+  const request = payload.llm_request;
+  if (!isRecord(request) || !Array.isArray(request.messages)) return void 0;
+  const userMessage = [...request.messages].reverse().find(
+    (message) => isRecord(message) && message.role === "user"
+  );
+  if (!userMessage) return void 0;
+  if (typeof userMessage.content === "string") {
+    return userMessage.content || void 0;
+  }
+  if (!Array.isArray(userMessage.content)) return void 0;
+  const text = userMessage.content.filter(
+    (part) => isRecord(part) && part.type === "text" && typeof part.text === "string"
+  ).map((part) => part.text).join("\n");
+  return text || void 0;
+}
+function normalizedEvent(target, payload, context) {
+  const sessionId = firstString(payload, [
+    "session_id",
+    "sessionId",
+    "conversation_id",
+    "conversationId"
+  ]);
+  const rawEventType = firstString(payload, [
+    "hook_event_name",
+    "hookEventName",
+    "event_name",
+    "eventName",
+    "event"
+  ]);
+  if (!sessionId || !rawEventType) return null;
+  const eventType = target === "gemini" ? geminiEventType(rawEventType) : target === "grok" ? grokEventType(rawEventType) : rawEventType;
+  const toolInput = nestedRecord(payload, ["tool_input", "toolInput"]);
+  const cwd = firstString(payload, [
+    "cwd",
+    "working_directory",
+    "workingDirectory",
+    "workspaceRoot"
+  ]) ?? context.cwd;
+  const command = boundedExtractedText(
+    firstText(payload, ["command"]) ?? (toolInput ? firstText(toolInput, ["command", "cmd"]) : void 0),
+    "command"
+  );
+  const toolName = firstString(payload, ["tool_name", "toolName", "name"]);
+  const filePath = firstString(payload, ["file_path", "filePath", "path"]) ?? (toolInput ? firstString(toolInput, ["file_path", "filePath", "path"]) : void 0) ?? (command && toolName && SHELL_TOOL_NAMES.has(toolName.toLowerCase()) ? extractReadFilePathFromCommand(command) ?? void 0 : void 0);
+  const userPrompt = boundedExtractedText(
+    firstText(payload, ["prompt", "user_prompt", "userPrompt"]) ?? (target === "gemini" ? geminiUserPrompt(payload) : void 0),
+    "user_prompt"
+  );
+  const plan = boundedExtractedText(firstText(payload, ["plan"]), "plan");
+  const allowedPrompts = boundedExtractedText(
+    firstText(payload, ["allowed_prompts", "allowedPrompts"]),
+    "allowed_prompts"
+  );
+  const toolResult = boundedExtractedText(
+    firstText(payload, [
+      "tool_result",
+      "toolResult",
+      "tool_response",
+      "toolResponse"
+    ]),
+    "tool_result"
+  );
+  const nativeEventId = firstString(payload, [
+    "hook_id",
+    "hookId",
+    "event_id",
+    "eventId",
+    "tool_use_id",
+    "toolUseId",
+    "tool_call_id",
+    "toolCallId",
+    "prompt_id",
+    "promptId"
+  ]) ?? (eventType === "UserPromptSubmit" || eventType === "Stop" ? firstString(payload, ["turn_id", "turnId"]) : void 0);
+  return {
+    sessionId,
+    eventType,
+    timestampMs: timestampMs(payload, context.nowMs),
+    ...nativeEventId ? { nativeEventId } : {},
+    ...cwd ? { cwd } : {},
+    ...toolName ? { toolName } : {},
+    ...userPrompt ? { userPrompt } : {},
+    ...filePath ? { filePath } : {},
+    ...command ? { command } : {},
+    ...plan ? { plan } : {},
+    ...allowedPrompts ? { allowedPrompts } : {},
+    ...toolResult ? { toolResult } : {}
+  };
+}
+function capability(targetId, nativeEvents) {
+  return Object.freeze({
+    targetId,
+    nativeEvents,
+    normalize: (payload, context) => normalizedEvent(targetId, payload, context)
+  });
+}
+var HOOK_NORMALIZATION_CAPABILITIES = Object.freeze([
+  capability("claude", CLAUDE_HOOK_EVENTS),
+  capability("codex", CODEX_HOOK_EVENTS),
+  capability("gemini", GEMINI_HOOK_EVENTS),
+  capability("grok", GROK_HOOK_EVENTS),
+  capability("pi", PI_HOOK_EVENTS)
+]);
+
+// src/hooks/context.ts
+init_token_store();
+init_dirs();
 
 // src/repo.ts
 import { execFile, execFileSync as execFileSync2 } from "node:child_process";
@@ -2132,6 +2359,8 @@ function resolveRepositoryRootFromCwd(cwd, timeoutMs = GIT_TIMEOUT_MS) {
 }
 
 // src/hooks/sync-loop.ts
+init_token_store();
+init_config();
 var MAX_RETRY_INTERVAL_MS = 5 * 6e4;
 var MAX_RETRY_AFTER_MS = 24 * 60 * 6e4;
 var MAX_HOOK_EVENT_ROW_JSON_BYTES = 2 * 1024 * 1024;
@@ -2211,14 +2440,14 @@ function sameDestination(left, right) {
   return left.environment === right.environment && left.targetUrl === right.targetUrl && left.destinationIdentity === right.destinationIdentity;
 }
 function hookContextInjectionId(target, syncId) {
-  const digest = createHash3("sha256").update(`${INJECTION_ID_VERSION}\0${target}\0${syncId}`).digest("base64url");
+  const digest = createHash4("sha256").update(`${INJECTION_ID_VERSION}\0${target}\0${syncId}`).digest("base64url");
   return `${INJECTION_ID_VERSION}_${digest}`;
 }
 function canonicalHookContextFilePath(filePath, cwd, repositoryRoot) {
   const windows = [filePath, cwd, repositoryRoot].some(
     (value) => value !== void 0 && value !== null && /^[A-Za-z]:[\\/]/.test(value)
   );
-  const pathApi = windows ? path6.win32 : path6.posix;
+  const pathApi = windows ? path7.win32 : path7.posix;
   const normalized = pathApi.normalize(filePath);
   const resolved = pathApi.isAbsolute(normalized) ? normalized : cwd && pathApi.isAbsolute(cwd) ? pathApi.resolve(cwd, normalized) : normalized;
   if (repositoryRoot && pathApi.isAbsolute(resolved)) {
@@ -2540,17 +2769,17 @@ function absoluteEnvPath(value) {
   const trimmed = value.trim();
   if (trimmed === "~") return os2.homedir();
   if (trimmed.startsWith("~/") || trimmed.startsWith("~\\")) {
-    return path7.join(os2.homedir(), trimmed.slice(2));
+    return path8.join(os2.homedir(), trimmed.slice(2));
   }
-  return path7.isAbsolute(trimmed) ? path7.normalize(trimmed) : void 0;
+  return path8.isAbsolute(trimmed) ? path8.normalize(trimmed) : void 0;
 }
 function observerDirectory() {
   const fmlHome = absoluteEnvPath(process.env.FML_HOME);
-  return absoluteEnvPath(process.env.FML_OBSERVER_DIR) ?? absoluteEnvPath(process.env.PANOPTICON_HOME) ?? (fmlHome ? path7.join(fmlHome, "panopticon") : path7.join(os2.homedir(), ".fml", "panopticon"));
+  return absoluteEnvPath(process.env.FML_OBSERVER_DIR) ?? absoluteEnvPath(process.env.PANOPTICON_HOME) ?? (fmlHome ? path8.join(fmlHome, "panopticon") : path8.join(os2.homedir(), ".fml", "panopticon"));
 }
 function readObserverEndpoint(filePath) {
   try {
-    const parsed = JSON.parse(fs4.readFileSync(filePath, "utf8"));
+    const parsed = JSON.parse(fs5.readFileSync(filePath, "utf8"));
     if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
       return null;
     }
@@ -2565,15 +2794,15 @@ function readObserverEndpoint(filePath) {
 }
 function readObserverAuthToken(filePath) {
   try {
-    return fs4.readFileSync(filePath, "utf8").trim() || null;
+    return fs5.readFileSync(filePath, "utf8").trim() || null;
   } catch {
     return null;
   }
 }
 async function deliver(event) {
   const directory = observerDirectory();
-  const endpoint = readObserverEndpoint(path7.join(directory, "endpoint.json"));
-  const authToken = readObserverAuthToken(path7.join(directory, "auth-token"));
+  const endpoint = readObserverEndpoint(path8.join(directory, "endpoint.json"));
+  const authToken = readObserverAuthToken(path8.join(directory, "auth-token"));
   if (!endpoint || !authToken) return;
   const host = endpoint.host === "::1" ? "[::1]" : endpoint.host;
   try {
@@ -2715,7 +2944,7 @@ var PiReceiptComponent = class {
   }
 };
 function fmlPiExtension(pi) {
-  let sessionId = randomUUID3();
+  let sessionId = randomUUID4();
   let initializedSessionId = null;
   let cwd;
   let repository = null;