failproofai 0.0.11-beta.9 → 0.0.11

package/dist/cli.mjs

@@ -16,7 +16,7 @@ var __export = (target, all) => {
 var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
 
 // package.json
-var version2 = "0.0.11-beta.9";
+var version2 = "0.0.11";
 var init_package = () => {};
 
 // src/posthog-key.ts
@@ -656,6 +656,14 @@ function clearPolicies() {
   g[REGISTRY_KEY] = [];
   setIndexCache(null);
 }
+function getAllPolicies() {
+  return [...getRegistry()];
+}
+function setAllPolicies(policies) {
+  const g = globalThis;
+  g[REGISTRY_KEY] = [...policies];
+  setIndexCache(null);
+}
 var REGISTRY_KEY = "__FAILPROOFAI_POLICY_REGISTRY__", INDEX_CACHE_KEY = "__FAILPROOFAI_POLICY_INDEX_CACHE__", DEFAULT_POLICY_NAMESPACE = "failproofai";
 
 // src/hooks/builtin-policies.ts
@@ -4883,6 +4891,10 @@ async function parseFileContent(fileContent, source) {
   entries.sort((a, b) => a.timestampMs - b.timestampMs);
   return { entries, rawLines, subagentIds: Array.from(subagentIdSet) };
 }
+async function parseLogContent(fileContent, source = "session") {
+  const result = await parseFileContent(fileContent, source);
+  return result.entries;
+}
 async function parseSessionLog(projectName, sessionId) {
   const projectDir = resolveProjectPath(projectName);
   const projectsPath = getClaudeProjectsPath();
@@ -9039,7 +9051,7 @@ async function runLogin() {
     const nowSecs = Math.floor(Date.now() / 1000);
     const refreshUsable = existing.refresh_expires_at > nowSecs;
     if (refreshUsable) {
-      trackHookEvent2(getInstanceId2(), "audit_cli_auth_login_completed", {
+      await trackHookEvent2(getInstanceId2(), "audit_cli_auth_login_completed", {
         source: "cli",
         status: "already_signed_in",
         user_id: existing.user.id
@@ -9072,7 +9084,7 @@ async function runLogin() {
     email = "";
   }
   if (!email) {
-    trackHookEvent2(getInstanceId2(), "audit_cli_auth_login_completed", {
+    await trackHookEvent2(getInstanceId2(), "audit_cli_auth_login_completed", {
       source: "cli",
       status: "aborted_invalid_email"
     });
@@ -9091,7 +9103,7 @@ ${GREEN}code sent.${RESET} ${DIM}check ${email} — expires in ${r.expires_in}s.
 `);
   } catch (err) {
     const isApi = err instanceof AuthApiError;
-    trackHookEvent2(getInstanceId2(), "audit_otp_requested", {
+    await trackHookEvent2(getInstanceId2(), "audit_otp_requested", {
       source: "cli",
       status: "failed",
       error_code: isApi ? err.code : "upstream_unreachable",
@@ -9118,7 +9130,7 @@ ${GREEN}code sent.${RESET} ${DIM}check ${email} — expires in ${r.expires_in}s.
       break;
     } catch (err) {
       const isApi = err instanceof AuthApiError;
-      trackHookEvent2(getInstanceId2(), "audit_otp_verified", {
+      await trackHookEvent2(getInstanceId2(), "audit_otp_verified", {
         source: "cli",
         status: "failed",
         attempt: verifyAttempts,
@@ -9137,7 +9149,7 @@ ${GREEN}code sent.${RESET} ${DIM}check ${email} — expires in ${r.expires_in}s.
     }
   }
   if (!tokenResp) {
-    trackHookEvent2(getInstanceId2(), "audit_cli_auth_login_completed", {
+    await trackHookEvent2(getInstanceId2(), "audit_cli_auth_login_completed", {
       source: "cli",
       status: "exhausted_attempts",
       attempts: verifyAttempts
@@ -9145,21 +9157,21 @@ ${GREEN}code sent.${RESET} ${DIM}check ${email} — expires in ${r.expires_in}s.
     throw new CliError("Too many bad codes — start over.");
   }
   writeAuth(authFromTokenResponse(tokenResp));
-  trackHookEvent2(getInstanceId2(), "audit_otp_verified", {
+  await trackHookEvent2(getInstanceId2(), "audit_otp_verified", {
     source: "cli",
     status: "success",
     attempt: verifyAttempts,
     user_id: tokenResp.user.id,
     email: tokenResp.user.email
   });
-  trackHookEvent2(getInstanceId2(), "audit_user_identity_linked", {
+  await trackHookEvent2(getInstanceId2(), "audit_user_identity_linked", {
     source: "cli",
     user_id: tokenResp.user.id,
     email: tokenResp.user.email,
     local_random_id: getInstanceId2(),
     $set: { email: tokenResp.user.email, user_id: tokenResp.user.id }
   });
-  trackHookEvent2(getInstanceId2(), "audit_cli_auth_login_completed", {
+  await trackHookEvent2(getInstanceId2(), "audit_cli_auth_login_completed", {
     source: "cli",
     status: "success",
     attempts: verifyAttempts,
@@ -9173,7 +9185,7 @@ ${GREEN}✓ signed in as ${tokenResp.user.email}${RESET}
 async function runLogout() {
   const existing = readAuth();
   if (!existing) {
-    trackHookEvent2(getInstanceId2(), "audit_cli_auth_logout_completed", {
+    await trackHookEvent2(getInstanceId2(), "audit_cli_auth_logout_completed", {
       source: "cli",
       had_session: false,
       upstream: "noop"
@@ -9191,7 +9203,7 @@ async function runLogout() {
     }
   }
   deleteAuth();
-  trackHookEvent2(getInstanceId2(), "audit_cli_auth_logout_completed", {
+  await trackHookEvent2(getInstanceId2(), "audit_cli_auth_logout_completed", {
     source: "cli",
     had_session: true,
     upstream,
@@ -9200,10 +9212,10 @@ async function runLogout() {
   process.stdout.write(`${GREEN}✓ signed out as ${existing.user.email}.${RESET}
 `);
 }
-function runWhoami() {
+async function runWhoami() {
   const existing = readAuth();
   if (!existing) {
-    trackHookEvent2(getInstanceId2(), "audit_cli_auth_whoami", {
+    await trackHookEvent2(getInstanceId2(), "audit_cli_auth_whoami", {
       source: "cli",
       authenticated: false
     });
@@ -9212,7 +9224,7 @@ function runWhoami() {
     process.exitCode = 1;
     return;
   }
-  trackHookEvent2(getInstanceId2(), "audit_cli_auth_whoami", {
+  await trackHookEvent2(getInstanceId2(), "audit_cli_auth_whoami", {
     source: "cli",
     authenticated: true,
     user_id: existing.user.id
@@ -9267,180 +9279,2269 @@ EXAMPLES
   SUBCOMMANDS = new Set(["login", "logout", "whoami", "help"]);
 });
 
-// src/hooks/manager.ts
-import { execSync as execSync6 } from "node:child_process";
-import { resolve as resolve12, basename as basename4 } from "node:path";
-import { homedir as homedir20, platform as platform2, arch as arch2, release as release2, hostname as hostname2 } from "node:os";
-function getSettingsPath2(scope, cwd) {
-  return claudeCode.getSettingsPath(scope, cwd);
-}
-function scopeLabel2(scope) {
-  switch (scope) {
-    case "user":
-      return `~/.claude/settings.json`;
-    case "project":
-      return `{cwd}/.claude/settings.json`;
-    case "local":
-      return `{cwd}/.claude/settings.local.json`;
-  }
-}
-function resolveFailproofaiBinary2() {
-  const override = process.env.FAILPROOFAI_BINARY_OVERRIDE;
-  if (override && override.trim())
-    return override.trim();
+// lib/claude-sessions.ts
+import { readdirSync as readdirSync8, statSync as statSync10, existsSync as existsSync14 } from "node:fs";
+import { join as join19, basename as basename4 } from "node:path";
+function getClaudeProjectsRoot() {
+  return getClaudeProjectsPath();
+}
+function listClaudeProjects() {
+  const root = getClaudeProjectsRoot();
+  let entries;
   try {
-    const cmd = process.platform === "win32" ? "where failproofai" : "which failproofai";
-    const result = execSync6(cmd, { encoding: "utf8" }).trim();
-    return result.split(`
-`)[0].trim();
+    entries = readdirSync8(root, { withFileTypes: true });
   } catch {
-    throw new CliError(`failproofai binary not found in PATH.
-` + "Install it globally first: npm install -g failproofai");
-  }
-}
-function validatePolicyNames2(names) {
-  const invalid = names.filter((n) => !VALID_POLICY_NAMES2.has(n));
-  if (invalid.length > 0) {
-    const validList = [...VALID_POLICY_NAMES2].join(", ");
-    throw new CliError(`Unknown policy name(s): ${invalid.join(", ")}
-` + `Valid policies: ${validList}`);
+    return [];
   }
+  return entries.filter((e) => e.isDirectory()).map((e) => ({
+    name: e.name,
+    cwd: decodeFolderName(e.name),
+    path: join19(root, e.name)
+  }));
 }
-function deduplicateScopes2(scopes, cwd) {
-  const seen = new Set;
-  return scopes.filter((s) => {
-    const p = getSettingsPath2(s, cwd);
-    if (seen.has(p))
-      return false;
-    seen.add(p);
-    return true;
-  });
-}
-function hooksInstalledInSettings2(scope, cwd) {
-  return claudeCode.hooksInstalledInSettings(scope, cwd);
-}
-async function installHooks2(policyNames, scope = "user", cwd, includeBeta = false, source, customPoliciesPath, removeCustomHooks = false, cli) {
-  if (policyNames !== undefined && policyNames.length > 0) {
-    const nonAllNames = policyNames.filter((n) => n !== "all");
-    if (nonAllNames.length > 0)
-      validatePolicyNames2(nonAllNames);
-    if (policyNames.includes("all") && nonAllNames.length > 0) {
-      throw new CliError(`"all" cannot be combined with specific policy names.
-` + `Use either: --install all  or  --install block-sudo sanitize-jwt ...`);
-    }
+function listClaudeTranscripts(project) {
+  const out = [];
+  let entries;
+  try {
+    entries = readdirSync8(project.path, { withFileTypes: true });
+  } catch {
+    return out;
   }
-  const selectedClis = cli && cli.length > 0 ? [...new Set(cli)] : ["claude"];
-  for (const cliId of selectedClis) {
-    const integration = getIntegration(cliId);
-    if (!integration.scopes.includes(scope)) {
+  for (const entry of entries) {
+    if (entry.isFile() && entry.name.endsWith(".jsonl")) {
+      const sessionId = entry.name.slice(0, -".jsonl".length);
+      if (!UUID_RE4.test(sessionId))
+        continue;
+      const transcriptPath = join19(project.path, entry.name);
       try {
-        await trackHookEvent2(getInstanceId2(), "scope_validation_failed", {
-          cli: cliId,
-          scope,
-          supported_scopes: integration.scopes
+        const s = statSync10(transcriptPath);
+        out.push({
+          projectName: project.name,
+          cwd: project.cwd,
+          sessionId,
+          transcriptPath,
+          mtimeMs: s.mtimeMs,
+          sizeBytes: s.size,
+          isSubagent: false
         });
       } catch {}
-      throw new CliError(`Scope "${scope}" is not supported by ${integration.displayName}. ` + `Valid scopes: ${integration.scopes.join(", ")}`);
+    } else if (entry.isDirectory() && UUID_RE4.test(entry.name)) {
+      const subDir = join19(project.path, entry.name, "subagents");
+      if (!existsSync14(subDir))
+        continue;
+      let subEntries;
+      try {
+        subEntries = readdirSync8(subDir, { withFileTypes: true });
+      } catch {
+        continue;
+      }
+      for (const sub of subEntries) {
+        if (!sub.isFile() || !sub.name.endsWith(".jsonl"))
+          continue;
+        const agentId = sub.name.slice(0, -".jsonl".length);
+        const transcriptPath = join19(subDir, sub.name);
+        try {
+          const s = statSync10(transcriptPath);
+          out.push({
+            projectName: project.name,
+            cwd: project.cwd,
+            sessionId: agentId,
+            transcriptPath,
+            mtimeMs: s.mtimeMs,
+            sizeBytes: s.size,
+            isSubagent: true
+          });
+        } catch {}
+      }
     }
   }
-  const binaryPath = resolveFailproofaiBinary2();
-  const previousConfig = readScopedHooksConfig(scope, cwd);
-  const previousEnabled = new Set(previousConfig.enabledPolicies);
-  let selectedPolicies;
-  if (policyNames !== undefined) {
-    let incoming;
-    if (policyNames.length === 1 && policyNames[0] === "all") {
-      incoming = BUILTIN_POLICIES.filter((p) => includeBeta || !p.beta).map((p) => p.name);
-    } else {
-      incoming = policyNames;
+  return out;
+}
+var UUID_RE4;
+var init_claude_sessions = __esm(() => {
+  init_paths();
+  UUID_RE4 = /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/i;
+});
+
+// src/audit/types.ts
+var AUDIT_TOOL_RESULT_MAX_BYTES, AUDIT_EXAMPLE_MAX_CHARS = 80, AUDIT_MAX_EXAMPLES_PER_NAME = 3;
+var init_types2 = __esm(() => {
+  AUDIT_TOOL_RESULT_MAX_BYTES = 64 * 1024;
+});
+
+// src/audit/cli-adapters/shared.ts
+function truncateToUtf8Bytes(s, maxBytes) {
+  const buf = Buffer.from(s, "utf-8");
+  if (buf.byteLength <= maxBytes)
+    return s;
+  let end = maxBytes;
+  while (end > 0 && (buf[end] & 192) === 128)
+    end--;
+  return buf.subarray(0, end).toString("utf-8");
+}
+function logEntriesToEvents(entries, ctx) {
+  const events = [];
+  for (const entry of entries) {
+    if (entry.type !== "assistant")
+      continue;
+    for (const block of entry.message.content) {
+      if (block.type !== "tool_use")
+        continue;
+      const rawName = block.name;
+      const canonicalName = canonicalizeToolName(rawName, ctx.cli) ?? rawName;
+      const canonicalInput = canonicalizeToolInput(canonicalName, block.input, ctx.cli);
+      let toolResultText;
+      if (block.result?.content) {
+        toolResultText = truncateToUtf8Bytes(block.result.content, AUDIT_TOOL_RESULT_MAX_BYTES);
+      }
+      events.push({
+        cli: ctx.cli,
+        sessionId: ctx.sessionId,
+        transcriptPath: ctx.transcriptPath,
+        cwd: ctx.cwd,
+        timestamp: entry.timestamp,
+        toolName: canonicalName,
+        rawToolName: rawName,
+        toolInput: canonicalInput ?? {},
+        toolResultText
+      });
     }
-    selectedPolicies = [...new Set([...previousConfig.enabledPolicies, ...incoming])];
-  } else {
-    const preSelected = previousConfig.enabledPolicies.length > 0 ? previousConfig.enabledPolicies : undefined;
-    selectedPolicies = await promptPolicySelection(preSelected, { includeBeta });
   }
-  const configToWrite = { ...previousConfig, enabledPolicies: selectedPolicies };
-  if (removeCustomHooks) {
-    delete configToWrite.customPoliciesPath;
-  } else if (customPoliciesPath) {
-    configToWrite.customPoliciesPath = resolve12(customPoliciesPath);
-    let validatedHooks = [];
+  return events;
+}
+var init_shared = __esm(() => {
+  init_tool_name_canonicalize();
+  init_types2();
+});
+
+// src/audit/cli-adapters/claude.ts
+import { readFile as readFile13 } from "node:fs/promises";
+async function listClaudeTranscriptMetadata(opts = {}) {
+  const projectFilter = opts.projects ? new Set(opts.projects) : null;
+  const sinceMs = opts.sinceMs ?? 0;
+  const out = [];
+  for (const project of listClaudeProjects()) {
+    if (projectFilter && !projectFilter.has(project.cwd))
+      continue;
+    let transcripts;
     try {
-      validatedHooks = await loadCustomHooks(configToWrite.customPoliciesPath, { strict: true });
-    } catch (err) {
-      const msg = err instanceof Error ? err.message : String(err);
+      transcripts = listClaudeTranscripts(project);
+    } catch {
+      continue;
+    }
+    for (const t of transcripts) {
+      if (t.mtimeMs < sinceMs)
+        continue;
+      out.push({
+        cli: "claude",
+        projectName: project.name,
+        sessionId: t.sessionId,
+        transcriptPath: t.transcriptPath,
+        mtimeMs: t.mtimeMs,
+        sizeBytes: t.sizeBytes
+      });
+    }
+  }
+  return out;
+}
+async function streamClaudeEvents(meta) {
+  let content;
+  try {
+    content = await readFile13(meta.transcriptPath, "utf-8");
+  } catch {
+    return [];
+  }
+  const source = "session";
+  let entries;
+  try {
+    entries = await parseLogContent(content, source);
+  } catch {
+    return [];
+  }
+  let cwd = "";
+  for (const line of content.split(`
+`, 50)) {
+    if (!line.trim())
+      continue;
+    try {
+      const parsed = JSON.parse(line);
+      if (typeof parsed.cwd === "string" && parsed.cwd.length > 0) {
+        cwd = parsed.cwd;
+        break;
+      }
+    } catch {}
+  }
+  return logEntriesToEvents(entries, {
+    cli: "claude",
+    sessionId: meta.sessionId,
+    transcriptPath: meta.transcriptPath,
+    cwd
+  });
+}
+var init_claude = __esm(() => {
+  init_claude_sessions();
+  init_log_entries();
+  init_shared();
+});
+
+// src/audit/cli-adapters/codex.ts
+import { statSync as statSync11 } from "node:fs";
+async function listCodexTranscriptMetadata(opts = {}) {
+  const projectFilter = opts.projects ? new Set(opts.projects) : null;
+  const sinceMs = opts.sinceMs ?? 0;
+  const out = [];
+  const projects = await getCodexProjects();
+  for (const project of projects) {
+    const { cwd, sessions } = await getCodexSessionsByEncodedName(project.name);
+    const effectiveCwd = cwd ?? "";
+    if (projectFilter && !projectFilter.has(effectiveCwd))
+      continue;
+    for (const s of sessions) {
+      const mtimeMs = s.lastModified.getTime();
+      if (mtimeMs < sinceMs)
+        continue;
+      let sizeBytes = 0;
       try {
-        await trackHookEvent2(getInstanceId2(), "custom_policy_validation_failed", {
-          scope,
-          error_type: /not found/i.test(msg) ? "file_not_found" : "load_error"
-        });
+        sizeBytes = statSync11(s.path).size;
       } catch {}
-      console.error(`Error: ${msg}`);
-      process.exit(1);
+      if (!s.sessionId)
+        continue;
+      out.push({
+        cli: "codex",
+        projectName: project.name,
+        sessionId: s.sessionId,
+        transcriptPath: s.path,
+        mtimeMs,
+        sizeBytes
+      });
     }
-    if (validatedHooks.length === 0) {
+  }
+  return out;
+}
+async function streamCodexEvents(meta) {
+  const log = await getCodexSessionLog(meta.sessionId);
+  if (!log)
+    return [];
+  return logEntriesToEvents(log.entries, {
+    cli: "codex",
+    sessionId: meta.sessionId,
+    transcriptPath: meta.transcriptPath,
+    cwd: log.cwd ?? ""
+  });
+}
+var init_codex = __esm(() => {
+  init_codex_projects();
+  init_codex_sessions();
+  init_shared();
+});
+
+// src/audit/cli-adapters/copilot.ts
+import { statSync as statSync12 } from "node:fs";
+async function listCopilotTranscriptMetadata(opts = {}) {
+  const projectFilter = opts.projects ? new Set(opts.projects) : null;
+  const sinceMs = opts.sinceMs ?? 0;
+  const out = [];
+  const projects = await getCopilotProjects();
+  for (const project of projects) {
+    const { cwd, sessions } = await getCopilotSessionsByEncodedName(project.name);
+    const effectiveCwd = cwd ?? "";
+    if (projectFilter && !projectFilter.has(effectiveCwd))
+      continue;
+    for (const s of sessions) {
+      const mtimeMs = s.lastModified.getTime();
+      if (mtimeMs < sinceMs)
+        continue;
+      let sizeBytes = 0;
       try {
-        await trackHookEvent2(getInstanceId2(), "custom_policy_validation_failed", {
-          scope,
-          error_type: "no_hooks_registered"
-        });
+        sizeBytes = statSync12(s.path).size;
       } catch {}
-      console.error(`Error: no hooks registered in ${customPoliciesPath}. ` + `Make sure your file calls customPolicies.add(...) at least once.`);
-      process.exit(1);
+      if (!s.sessionId)
+        continue;
+      out.push({
+        cli: "copilot",
+        projectName: project.name,
+        sessionId: s.sessionId,
+        transcriptPath: s.path,
+        mtimeMs,
+        sizeBytes
+      });
     }
-    console.log(`
-Validated ${validatedHooks.length} custom hook(s): ${validatedHooks.map((h) => h.name).join(", ")}`);
-  }
-  writeScopedHooksConfig(configToWrite, scope, cwd);
-  console.log(`
-Enabled ${selectedPolicies.length} policy(ies): ${selectedPolicies.join(", ")}
-`);
-  if (removeCustomHooks) {
-    console.log("Custom hooks path cleared.");
-  } else if (configToWrite.customPoliciesPath) {
-    console.log(`Custom hooks path: ${configToWrite.customPoliciesPath}`);
   }
-  const writtenSettingsPaths = [];
-  for (const cliId of selectedClis) {
-    const integration = getIntegration(cliId);
-    const settingsPath = integration.getSettingsPath(scope, cwd);
-    try {
-      const settings = integration.readSettings(settingsPath);
-      integration.writeHookEntries(settings, binaryPath, scope);
-      integration.writeSettings(settingsPath, settings);
-      writtenSettingsPaths.push({ cli: cliId, path: settingsPath });
-    } catch (err) {
-      const errorType = err instanceof Error && /EACCES|EPERM/.test(err.message) ? "permission_denied" : err instanceof Error && /ENOENT|ENOTDIR/.test(err.message) ? "path_not_found" : "write_error";
+  return out;
+}
+async function streamCopilotEvents(meta) {
+  const log = await getCopilotSessionLog(meta.sessionId);
+  if (!log)
+    return [];
+  return logEntriesToEvents(log.entries, {
+    cli: "copilot",
+    sessionId: meta.sessionId,
+    transcriptPath: meta.transcriptPath,
+    cwd: log.cwd ?? ""
+  });
+}
+var init_copilot = __esm(() => {
+  init_copilot_projects();
+  init_copilot_sessions();
+  init_shared();
+});
+
+// src/audit/cli-adapters/cursor.ts
+import { statSync as statSync13 } from "node:fs";
+async function listCursorTranscriptMetadata(opts = {}) {
+  const projectFilter = opts.projects ? new Set(opts.projects) : null;
+  const sinceMs = opts.sinceMs ?? 0;
+  const out = [];
+  const projects = await getCursorProjects();
+  for (const project of projects) {
+    const { cwd, sessions } = await getCursorSessionsByEncodedName(project.name);
+    const effectiveCwd = cwd ?? "";
+    if (projectFilter && !projectFilter.has(effectiveCwd))
+      continue;
+    for (const s of sessions) {
+      const mtimeMs = s.lastModified.getTime();
+      if (mtimeMs < sinceMs)
+        continue;
+      let sizeBytes = 0;
       try {
-        await trackHookEvent2(getInstanceId2(), "hook_write_failed", {
-          cli: cliId,
-          scope,
-          error_type: errorType
-        });
+        sizeBytes = statSync13(s.path).size;
       } catch {}
-      throw err;
+      if (!s.sessionId)
+        continue;
+      out.push({
+        cli: "cursor",
+        projectName: project.name,
+        sessionId: s.sessionId,
+        transcriptPath: s.path,
+        mtimeMs,
+        sizeBytes
+      });
     }
   }
+  return out;
+}
+async function streamCursorEvents(meta) {
+  const log = await getCursorSessionLog(meta.sessionId);
+  if (!log)
+    return [];
+  return logEntriesToEvents(log.entries, {
+    cli: "cursor",
+    sessionId: meta.sessionId,
+    transcriptPath: meta.transcriptPath,
+    cwd: log.cwd ?? ""
+  });
+}
+var init_cursor = __esm(() => {
+  init_cursor_projects();
+  init_cursor_sessions();
+  init_shared();
+});
+
+// lib/opencode-sessions.ts
+import { execFileSync as execFileSync3 } from "node:child_process";
+function runOpenCodeDb2(sql) {
   try {
-    const newSet = new Set(selectedPolicies);
-    const policiesAdded = selectedPolicies.filter((p) => !previousEnabled.has(p));
-    const policiesRemoved = [...previousEnabled].filter((p) => !newSet.has(p));
-    const distinctId = getInstanceId2();
-    await trackHookEvent2(distinctId, "hooks_installed", {
-      scope,
-      cli: selectedClis,
-      cli_count: selectedClis.length,
-      policies: selectedPolicies,
-      policy_count: selectedPolicies.length,
-      policies_added: policiesAdded,
-      policies_removed: policiesRemoved,
-      ...source ? { source } : {},
-      platform: platform2(),
-      arch: arch2(),
-      os_release: release2(),
-      hostname_hash: hashToId2(hostname2()),
-      has_custom_hooks_path: !!configToWrite.customPoliciesPath,
-      has_policy_params: !!(configToWrite.policyParams && Object.keys(configToWrite.policyParams).length > 0),
+    const stdout = execFileSync3("opencode", ["db", "--format", "json", sql], {
+      encoding: "utf8",
+      timeout: 5000,
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    if (!stdout.trim())
+      return [];
+    const parsed = JSON.parse(stdout);
+    if (!Array.isArray(parsed))
+      return null;
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+function isPlainObject(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value);
+}
+function parseDataColumn(raw) {
+  if (typeof raw !== "string" || raw.length === 0)
+    return null;
+  try {
+    const parsed = JSON.parse(raw);
+    return isPlainObject(parsed) ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+function readContentText(data) {
+  if (typeof data.text === "string")
+    return data.text;
+  if (typeof data.content === "string")
+    return data.content;
+  return "";
+}
+function translateMessage(msgRow, partRows, source) {
+  const msgData = parseDataColumn(msgRow.data) ?? {};
+  const role = typeof msgData.role === "string" ? msgData.role : "system";
+  const date = new Date(msgRow.time_created);
+  const timestamp = date.toISOString();
+  const raw = { uuid: msgRow.id, parentUuid: null };
+  const base = baseEntry(raw, timestamp, date, source);
+  const content = [];
+  let userText = "";
+  for (const p of partRows) {
+    const data = parseDataColumn(p.data);
+    if (!data)
+      continue;
+    const type = typeof data.type === "string" ? data.type : "unknown";
+    if (type === "text") {
+      const text = readContentText(data);
+      if (text) {
+        content.push({ type: "text", text });
+        userText += (userText ? `
+` : "") + text;
+      }
+      continue;
+    }
+    if (type === "tool") {
+      const toolName = typeof data.tool === "string" ? data.tool : typeof data.name === "string" ? data.name : "tool";
+      const state = isPlainObject(data.state) ? data.state : null;
+      const input = state && isPlainObject(state.input) ? state.input : isPlainObject(data.input) ? data.input : isPlainObject(data.args) ? data.args : {};
+      const block = {
+        type: "tool_use",
+        id: p.id,
+        name: toolName,
+        input
+      };
+      const status = state && typeof state.status === "string" ? state.status : "";
+      if (state && (status === "completed" || status === "error")) {
+        const errorText = status === "error" && typeof state.error === "string" ? state.error : null;
+        const rawOutput = errorText ?? state.output;
+        const contentText = typeof rawOutput === "string" ? rawOutput : rawOutput != null ? JSON.stringify(rawOutput) : "";
+        const time = isPlainObject(state.time) ? state.time : {};
+        const startMs = typeof time.start === "number" ? time.start : p.time_created;
+        const endMs = typeof time.end === "number" ? time.end : p.time_updated;
+        const durationMs = Math.max(0, endMs - startMs);
+        const date2 = new Date(endMs);
+        block.result = {
+          timestamp: date2.toISOString(),
+          timestampFormatted: formatTimestamp(date2),
+          content: contentText,
+          durationMs,
+          durationFormatted: formatDuration(durationMs)
+        };
+      }
+      content.push(block);
+      continue;
+    }
+    content.push({ type: "text", text: `[opencode ${type}]` });
+  }
+  if (role === "user") {
+    const entry2 = {
+      ...base,
+      type: "user",
+      message: { role: "user", content: userText }
+    };
+    return entry2;
+  }
+  if (role === "assistant") {
+    const modelInfo = isPlainObject(msgData.model) ? msgData.model : null;
+    const modelStr = modelInfo && typeof modelInfo.modelID === "string" ? modelInfo.modelID : undefined;
+    const entry2 = {
+      ...base,
+      type: "assistant",
+      message: { role: "assistant", content, model: modelStr }
+    };
+    return entry2;
+  }
+  const entry = {
+    ...base,
+    type: "system",
+    raw: { id: msgRow.id, role, parts: content }
+  };
+  return entry;
+}
+async function getOpenCodeSessionLog(sessionId) {
+  if (!sessionId || !/^[A-Za-z0-9_-]+$/.test(sessionId))
+    return null;
+  const sessions = runOpenCodeDb2(`SELECT id, project_id, slug, directory, title, time_created, time_updated FROM session WHERE id = '${sessionId}'`);
+  if (!sessions || sessions.length === 0)
+    return null;
+  const session = sessions[0];
+  const messages = runOpenCodeDb2(`SELECT id, session_id, time_created, time_updated, data FROM message WHERE session_id = '${sessionId}' ORDER BY time_created ASC`);
+  const parts = runOpenCodeDb2(`SELECT id, message_id, session_id, time_created, time_updated, data FROM part WHERE session_id = '${sessionId}' ORDER BY time_created ASC`);
+  if (!messages)
+    return { entries: [], rawLines: [], cwd: session.directory ?? undefined, filePath: `opencode://${sessionId}` };
+  const partsByMessage = new Map;
+  for (const p of parts ?? []) {
+    let bucket = partsByMessage.get(p.message_id);
+    if (!bucket) {
+      bucket = [];
+      partsByMessage.set(p.message_id, bucket);
+    }
+    bucket.push(p);
+  }
+  const entries = [];
+  const rawLines = [];
+  for (const msg of messages) {
+    const partRows = partsByMessage.get(msg.id) ?? [];
+    entries.push(translateMessage(msg, partRows, "session"));
+    const data = parseDataColumn(msg.data);
+    rawLines.push({
+      id: msg.id,
+      session_id: msg.session_id,
+      time_created: msg.time_created,
+      data: data ?? msg.data
+    });
+  }
+  return {
+    entries,
+    rawLines,
+    cwd: session.directory ?? undefined,
+    filePath: `opencode://${sessionId}`
+  };
+}
+var getCachedOpenCodeSessionLog;
+var init_opencode_sessions = __esm(() => {
+  init_log_entries();
+  getCachedOpenCodeSessionLog = runtimeCache((sessionId) => getOpenCodeSessionLog(sessionId), 30, { maxSize: 50 });
+});
+
+// src/audit/cli-adapters/opencode.ts
+async function listOpenCodeTranscriptMetadata(opts = {}) {
+  const projectFilter = opts.projects ? new Set(opts.projects) : null;
+  const sinceMs = opts.sinceMs ?? 0;
+  const out = [];
+  const projects = await getOpenCodeProjects();
+  for (const project of projects) {
+    const { cwd, sessions } = await getOpenCodeSessionsByEncodedName(project.name);
+    const effectiveCwd = cwd ?? "";
+    if (projectFilter && !projectFilter.has(effectiveCwd))
+      continue;
+    for (const s of sessions) {
+      const mtimeMs = s.lastModified.getTime();
+      if (mtimeMs < sinceMs)
+        continue;
+      if (!s.sessionId)
+        continue;
+      out.push({
+        cli: "opencode",
+        projectName: project.name,
+        sessionId: s.sessionId,
+        transcriptPath: s.path,
+        mtimeMs,
+        sizeBytes: 0
+      });
+    }
+  }
+  return out;
+}
+async function streamOpenCodeEvents(meta) {
+  const log = await getOpenCodeSessionLog(meta.sessionId);
+  if (!log)
+    return [];
+  return logEntriesToEvents(log.entries, {
+    cli: "opencode",
+    sessionId: meta.sessionId,
+    transcriptPath: meta.transcriptPath,
+    cwd: log.cwd ?? ""
+  });
+}
+var init_opencode = __esm(() => {
+  init_opencode_projects();
+  init_opencode_sessions();
+  init_shared();
+});
+
+// src/audit/cli-adapters/pi.ts
+import { statSync as statSync14 } from "node:fs";
+async function listPiTranscriptMetadata(opts = {}) {
+  const projectFilter = opts.projects ? new Set(opts.projects) : null;
+  const sinceMs = opts.sinceMs ?? 0;
+  const out = [];
+  const projects = await getPiProjects();
+  for (const project of projects) {
+    const { cwd, sessions } = await getPiSessionsByEncodedName(project.name);
+    const effectiveCwd = cwd ?? "";
+    if (projectFilter && !projectFilter.has(effectiveCwd))
+      continue;
+    for (const s of sessions) {
+      const mtimeMs = s.lastModified.getTime();
+      if (mtimeMs < sinceMs)
+        continue;
+      let sizeBytes = 0;
+      try {
+        sizeBytes = statSync14(s.path).size;
+      } catch {}
+      if (!s.sessionId)
+        continue;
+      out.push({
+        cli: "pi",
+        projectName: project.name,
+        sessionId: s.sessionId,
+        transcriptPath: s.path,
+        mtimeMs,
+        sizeBytes
+      });
+    }
+  }
+  return out;
+}
+async function streamPiEvents(meta) {
+  const log = await getPiSessionLog(meta.sessionId);
+  if (!log)
+    return [];
+  return logEntriesToEvents(log.entries, {
+    cli: "pi",
+    sessionId: meta.sessionId,
+    transcriptPath: meta.transcriptPath,
+    cwd: log.cwd ?? ""
+  });
+}
+var init_pi = __esm(() => {
+  init_pi_projects();
+  init_pi_sessions();
+  init_shared();
+});
+
+// src/audit/cli-adapters/gemini.ts
+import { statSync as statSync15 } from "node:fs";
+async function listGeminiTranscriptMetadata(opts = {}) {
+  const projectFilter = opts.projects ? new Set(opts.projects) : null;
+  const sinceMs = opts.sinceMs ?? 0;
+  const out = [];
+  const projects = await getGeminiProjects();
+  for (const project of projects) {
+    const { cwd, sessions } = await getGeminiSessionsByEncodedName(project.name);
+    const effectiveCwd = cwd ?? "";
+    if (projectFilter && !projectFilter.has(effectiveCwd))
+      continue;
+    for (const s of sessions) {
+      const mtimeMs = s.lastModified.getTime();
+      if (mtimeMs < sinceMs)
+        continue;
+      let sizeBytes = 0;
+      try {
+        sizeBytes = statSync15(s.path).size;
+      } catch {}
+      if (!s.sessionId)
+        continue;
+      out.push({
+        cli: "gemini",
+        projectName: project.name,
+        sessionId: s.sessionId,
+        transcriptPath: s.path,
+        mtimeMs,
+        sizeBytes
+      });
+    }
+  }
+  return out;
+}
+async function streamGeminiEvents(meta) {
+  const log = await getGeminiSessionLog(meta.sessionId);
+  if (!log)
+    return [];
+  return logEntriesToEvents(log.entries, {
+    cli: "gemini",
+    sessionId: meta.sessionId,
+    transcriptPath: meta.transcriptPath,
+    cwd: log.cwd ?? ""
+  });
+}
+var init_gemini = __esm(() => {
+  init_gemini_projects();
+  init_gemini_sessions();
+  init_shared();
+});
+
+// src/audit/cli-adapters/index.ts
+var ADAPTERS;
+var init_cli_adapters = __esm(() => {
+  init_claude();
+  init_codex();
+  init_copilot();
+  init_cursor();
+  init_opencode();
+  init_pi();
+  init_gemini();
+  ADAPTERS = {
+    claude: {
+      cli: "claude",
+      listTranscripts: listClaudeTranscriptMetadata,
+      streamEvents: streamClaudeEvents
+    },
+    codex: {
+      cli: "codex",
+      listTranscripts: listCodexTranscriptMetadata,
+      streamEvents: streamCodexEvents
+    },
+    copilot: {
+      cli: "copilot",
+      listTranscripts: listCopilotTranscriptMetadata,
+      streamEvents: streamCopilotEvents
+    },
+    cursor: {
+      cli: "cursor",
+      listTranscripts: listCursorTranscriptMetadata,
+      streamEvents: streamCursorEvents
+    },
+    opencode: {
+      cli: "opencode",
+      listTranscripts: listOpenCodeTranscriptMetadata,
+      streamEvents: streamOpenCodeEvents
+    },
+    pi: {
+      cli: "pi",
+      listTranscripts: listPiTranscriptMetadata,
+      streamEvents: streamPiEvents
+    },
+    gemini: {
+      cli: "gemini",
+      listTranscripts: listGeminiTranscriptMetadata,
+      streamEvents: streamGeminiEvents
+    }
+  };
+});
+
+// src/audit/detectors/redundant-cd-cwd.ts
+var redundantCdCwd;
+var init_redundant_cd_cwd = __esm(() => {
+  redundantCdCwd = {
+    name: "redundant-cd-cwd",
+    description: "Bash commands prefixed with `cd <cwd> && …` even though commands already run in cwd.",
+    category: "Wasteful",
+    severity: "info",
+    displayTitle: "Prepended cd <cwd> before commands",
+    impact: "Pure waste — your agent's shell already runs in `cwd`.",
+    detect(event) {
+      if (event.toolName !== "Bash")
+        return null;
+      const command = event.toolInput.command;
+      if (typeof command !== "string" || !event.cwd)
+        return null;
+      const trimmed = command.trimStart();
+      const match = /^cd\s+(?:"([^"]+)"|'([^']+)'|(\S+))\s*&&\s*([\s\S]+)$/.exec(trimmed);
+      if (!match)
+        return null;
+      const path3 = (match[1] ?? match[2] ?? match[3] ?? "").replace(/\/+$/, "");
+      const cwd = event.cwd.replace(/\/+$/, "");
+      if (path3 !== cwd)
+        return null;
+      const rest = match[4].trim();
+      return { example: `cd ${path3} && ${rest}` };
+    }
+  };
+});
+
+// src/audit/detectors/prefer-edit-over-read-cat.ts
+var SOURCE_EXT_RE, preferEditOverReadCat;
+var init_prefer_edit_over_read_cat = __esm(() => {
+  SOURCE_EXT_RE = /\.(?:ts|tsx|js|jsx|mjs|cjs|py|go|rs|java|kt|swift|rb|php|c|h|cc|cpp|hpp|cs|scala|sh|bash|zsh|json|yaml|yml|toml|md|txt|sql|html|css|scss|sass)$/i;
+  preferEditOverReadCat = {
+    name: "prefer-edit-over-read-cat",
+    description: "Bash `cat`/`head`/`tail`/`less`/`more` on a single source file — use Read.",
+    category: "Wasteful",
+    severity: "info",
+    displayTitle: "Used `cat`/`head`/`tail` on a source file",
+    impact: "Burns tokens; the Read tool returns content directly without going through Bash output.",
+    detect(event) {
+      if (event.toolName !== "Bash")
+        return null;
+      const command = event.toolInput.command;
+      if (typeof command !== "string")
+        return null;
+      const cmd = command.trim();
+      if (/[|<>;&`$()]/.test(cmd))
+        return null;
+      const match = /^(cat|head|tail|less|more)\s+(?:-\S+\s+)*(?:"([^"]+)"|'([^']+)'|(\S+))\s*$/.exec(cmd);
+      if (!match)
+        return null;
+      const path3 = match[2] ?? match[3] ?? match[4] ?? "";
+      if (!path3)
+        return null;
+      if (/(?:^|\/)\.env(?:\..+)?$/.test(path3))
+        return null;
+      if (!SOURCE_EXT_RE.test(path3))
+        return null;
+      return { example: cmd };
+    }
+  };
+});
+
+// src/audit/detectors/prefer-edit-over-sed-awk.ts
+var preferEditOverSedAwk;
+var init_prefer_edit_over_sed_awk = __esm(() => {
+  preferEditOverSedAwk = {
+    name: "prefer-edit-over-sed-awk",
+    description: "Bash `sed -i`/`awk` in-place edits — use Edit.",
+    category: "Wasteful",
+    severity: "info",
+    displayTitle: "Used sed -i or awk for an in-place edit",
+    impact: "Edit tool is safer and produces a diff the agent can verify.",
+    detect(event) {
+      if (event.toolName !== "Bash")
+        return null;
+      const command = event.toolInput.command;
+      if (typeof command !== "string")
+        return null;
+      const cmd = command.trim();
+      if (/(?:^|\s|;|&&|\|\|)sed\b[^|]*\s-i(?=\b|['"])/.test(cmd)) {
+        return { example: cmd };
+      }
+      if (/(?:^|\s|;|&&|\|\|)awk\b[^|]*\s>\s*\S+/.test(cmd) && !/\|/.test(cmd)) {
+        return { example: cmd };
+      }
+      return null;
+    }
+  };
+});
+
+// src/audit/detectors/prefer-write-over-heredoc.ts
+var preferWriteOverHeredoc;
+var init_prefer_write_over_heredoc = __esm(() => {
+  preferWriteOverHeredoc = {
+    name: "prefer-write-over-heredoc",
+    description: "Bash heredoc / `echo > file` writing multi-line content — use Write.",
+    category: "Wasteful",
+    severity: "info",
+    displayTitle: "Used heredoc / `echo > file` to write a multi-line file",
+    impact: "Write tool handles escaping and is verifiable.",
+    detect(event) {
+      if (event.toolName !== "Bash")
+        return null;
+      const command = event.toolInput.command;
+      if (typeof command !== "string")
+        return null;
+      const cmd = command;
+      if (/<<-?\s*['"]?[A-Za-z_][A-Za-z0-9_]*['"]?\s*>\s*\S/.test(cmd)) {
+        const summary = cmd.replace(/\s+/g, " ").trim().slice(0, 160);
+        return { example: summary };
+      }
+      if (/(?:^|\s|;|&&|\|\|)(?:echo|printf)\s+["'][^"']*\n[^"']*["']\s*>\s*\S/.test(cmd)) {
+        const summary = cmd.replace(/\s+/g, " ").trim().slice(0, 160);
+        return { example: summary };
+      }
+      return null;
+    }
+  };
+});
+
+// src/audit/detectors/sleep-polling-loop.ts
+var SLEEP_THRESHOLD_SECONDS = 30, sleepPollingLoop;
+var init_sleep_polling_loop = __esm(() => {
+  sleepPollingLoop = {
+    name: "sleep-polling-loop",
+    description: "Bash long `sleep` or while-sleep polling loops.",
+    category: "Wasteful",
+    severity: "info",
+    displayTitle: "Used a long sleep or while-sleep polling loop",
+    impact: "Burns wall-clock; better to wait for an explicit signal.",
+    detect(event) {
+      if (event.toolName !== "Bash")
+        return null;
+      const command = event.toolInput.command;
+      if (typeof command !== "string")
+        return null;
+      const cmd = command;
+      if (/\bwhile\b[\s\S]*?\bsleep\b[\s\S]*?\bdone\b/.test(cmd)) {
+        return { example: cmd.replace(/\s+/g, " ").trim().slice(0, 160) };
+      }
+      const match = /\bsleep\s+(\d+(?:\.\d+)?)(m|h|d)?\b/.exec(cmd);
+      if (match) {
+        const n = parseFloat(match[1]);
+        const unit = match[2] ?? "s";
+        const seconds = unit === "m" ? n * 60 : unit === "h" ? n * 3600 : unit === "d" ? n * 86400 : n;
+        if (seconds >= SLEEP_THRESHOLD_SECONDS) {
+          return { example: cmd.replace(/\s+/g, " ").trim().slice(0, 160) };
+        }
+      }
+      return null;
+    }
+  };
+});
+
+// src/audit/detectors/find-from-root.ts
+var RISKY_ROOTS, findFromRoot;
+var init_find_from_root = __esm(() => {
+  RISKY_ROOTS = ["/", "/home", "/usr", "/etc", "/var", "/opt", "/Users"];
+  findFromRoot = {
+    name: "find-from-root",
+    description: "Bash `find` against `/`, `/home`, `/usr`, etc. — scope to cwd instead.",
+    category: "Risky",
+    severity: "warn",
+    displayTitle: "Ran find from /, /home, /usr, etc.",
+    impact: "Filesystem-wide finds exhaust resources and rarely return useful results.",
+    detect(event) {
+      if (event.toolName !== "Bash")
+        return null;
+      const command = event.toolInput.command;
+      if (typeof command !== "string")
+        return null;
+      const cmd = command.trim();
+      const match = /(?:^|[\s;|&])find\s+(?:-\S+\s+)*("[^"]+"|'[^']+'|\S+)/.exec(cmd);
+      if (!match)
+        return null;
+      const raw = match[1].replace(/^["']|["']$/g, "");
+      const stripped = raw.replace(/\/+$/, "") || "/";
+      if (!RISKY_ROOTS.includes(stripped))
+        return null;
+      return { example: cmd.slice(0, 160) };
+    }
+  };
+});
+
+// src/audit/detectors/git-commit-no-verify.ts
+var gitCommitNoVerify;
+var init_git_commit_no_verify = __esm(() => {
+  gitCommitNoVerify = {
+    name: "git-commit-no-verify",
+    description: "git commit invoked with --no-verify / -n, skipping hooks.",
+    category: "Risky",
+    severity: "warn",
+    displayTitle: "Committed with --no-verify",
+    impact: "Skips pre-commit hooks that exist to catch broken or unsafe code.",
+    detect(event) {
+      if (event.toolName !== "Bash")
+        return null;
+      const command = event.toolInput.command;
+      if (typeof command !== "string")
+        return null;
+      const cmd = command;
+      if (!/\bgit\s+commit\b/.test(cmd))
+        return null;
+      if (/\s--no-verify\b/.test(cmd) || /\s-n\b/.test(cmd)) {
+        return { example: cmd.replace(/\s+/g, " ").trim().slice(0, 160) };
+      }
+      return null;
+    }
+  };
+});
+
+// src/audit/detectors/reread-after-edit.ts
+function getState(state) {
+  let s = state[STATE_KEY];
+  if (!s) {
+    s = { countdown: new Map };
+    state[STATE_KEY] = s;
+  }
+  return s;
+}
+var STATE_KEY = "rereadAfterEdit", WINDOW = 5, rereadAfterEdit;
+var init_reread_after_edit = __esm(() => {
+  rereadAfterEdit = {
+    name: "reread-after-edit",
+    description: "Read of a file that was just Edit'd or Write'n in the same session.",
+    category: "Wasteful",
+    severity: "info",
+    displayTitle: "Re-read a file it just edited",
+    impact: "Edit/Write already returned the updated content; the second Read is wasted tokens.",
+    detect(event, sessionState) {
+      const state = getState(sessionState);
+      const filePath = event.toolInput.file_path;
+      const pathStr = typeof filePath === "string" ? filePath : null;
+      for (const [key, n] of state.countdown) {
+        if (n <= 1)
+          state.countdown.delete(key);
+        else
+          state.countdown.set(key, n - 1);
+      }
+      if (!pathStr)
+        return null;
+      if (event.toolName === "Edit" || event.toolName === "Write") {
+        state.countdown.set(pathStr, WINDOW);
+        return null;
+      }
+      if (event.toolName === "Read") {
+        if (state.countdown.has(pathStr)) {
+          state.countdown.delete(pathStr);
+          return { example: `Read ${pathStr} immediately after Edit/Write` };
+        }
+      }
+      return null;
+    }
+  };
+});
+
+// src/audit/detectors/index.ts
+var AUDIT_DETECTORS;
+var init_detectors = __esm(() => {
+  init_redundant_cd_cwd();
+  init_prefer_edit_over_read_cat();
+  init_prefer_edit_over_sed_awk();
+  init_prefer_write_over_heredoc();
+  init_sleep_polling_loop();
+  init_find_from_root();
+  init_git_commit_no_verify();
+  init_reread_after_edit();
+  AUDIT_DETECTORS = [
+    redundantCdCwd,
+    preferEditOverReadCat,
+    preferEditOverSedAwk,
+    preferWriteOverHeredoc,
+    sleepPollingLoop,
+    findFromRoot,
+    gitCommitNoVerify,
+    rereadAfterEdit
+  ];
+});
+
+// src/audit/features.ts
+function shortName(name) {
+  const slash = name.indexOf("/");
+  return slash >= 0 ? name.slice(slash + 1) : name;
+}
+function severityForBuiltin(name) {
+  const n = shortName(name);
+  if (n.startsWith("sanitize-"))
+    return "sanitize";
+  if (n.startsWith("block-"))
+    return "deny";
+  if (n.startsWith("warn-") || n.startsWith("protect-") || n.startsWith("prefer-") || n.startsWith("require-"))
+    return "warn";
+  return "deny";
+}
+function emptyWeights() {
+  return {
+    optimist: 0,
+    cowboy: 0,
+    explorer: 0,
+    goldfish: 0,
+    architect: 0,
+    precision: 0,
+    hammer: 0,
+    ghost: 0
+  };
+}
+var MAPPABLE_KEYS, ARCHITECT_CAUTION_SIGNALS, MIN_BASELINE = 0.05, EMPIRICAL_FIRING_SHARE, BASELINE_SHARE;
+var init_features = __esm(() => {
+  MAPPABLE_KEYS = [
+    "cowboy",
+    "explorer",
+    "ghost",
+    "optimist",
+    "hammer",
+    "architect"
+  ];
+  ARCHITECT_CAUTION_SIGNALS = new Set(["reread-after-edit", "redundant-cd-cwd"]);
+  EMPIRICAL_FIRING_SHARE = {
+    explorer: 0.38,
+    architect: 0.33,
+    hammer: 0.11,
+    cowboy: 0.11,
+    optimist: 0.07,
+    ghost: 0.01,
+    precision: 0,
+    goldfish: 0
+  };
+  BASELINE_SHARE = (() => {
+    const out = emptyWeights();
+    for (const k of MAPPABLE_KEYS)
+      out[k] = Math.max(EMPIRICAL_FIRING_SHARE[k], MIN_BASELINE);
+    return out;
+  })();
+});
+
+// src/audit/cache.ts
+import { createHash } from "node:crypto";
+import { existsSync as existsSync15, mkdirSync as mkdirSync7, readFileSync as readFileSync11, writeFileSync as writeFileSync6, chmodSync as chmodSync2 } from "node:fs";
+import { join as join20 } from "node:path";
+import { homedir as homedir20 } from "node:os";
+function getEngineVersion() {
+  if (cachedEngineVersion)
+    return cachedEngineVersion;
+  const blob = BUILTIN_POLICIES.map((p) => `${p.name}|${p.fn.toString()}`).sort().join(`
+`);
+  cachedEngineVersion = createHash("sha1").update(blob).digest("hex").slice(0, 16);
+  return cachedEngineVersion;
+}
+function getDetectorVersion() {
+  if (cachedDetectorVersion)
+    return cachedDetectorVersion;
+  const blob = AUDIT_DETECTORS.map((d) => `${d.name}|${d.detect.toString()}`).sort().join(`
+`);
+  cachedDetectorVersion = createHash("sha1").update(blob).digest("hex").slice(0, 16);
+  return cachedDetectorVersion;
+}
+function getCachePathFor(transcriptPath) {
+  const root = join20(homedir20(), ".failproofai", "cache", "audit");
+  const key = createHash("sha1").update(transcriptPath).digest("hex");
+  return join20(root, `${key}.json`);
+}
+function readCachedTranscriptResult(transcriptPath, mtimeMs, sizeBytes) {
+  if (sizeBytes === 0)
+    return null;
+  const cachePath = getCachePathFor(transcriptPath);
+  if (!existsSync15(cachePath))
+    return null;
+  try {
+    const raw = readFileSync11(cachePath, "utf-8");
+    const entry = JSON.parse(raw);
+    if (entry.schemaVersion !== CACHE_SCHEMA_VERSION)
+      return null;
+    if (entry.mtimeMs !== mtimeMs)
+      return null;
+    if (entry.sizeBytes !== sizeBytes)
+      return null;
+    if (entry.engineVersion !== getEngineVersion())
+      return null;
+    if (entry.detectorVersion !== getDetectorVersion())
+      return null;
+    if (!Number.isFinite(entry.cachedAt) || Date.now() - entry.cachedAt > CACHE_TTL_MS)
+      return null;
+    return entry.result ?? null;
+  } catch {
+    return null;
+  }
+}
+function writeCachedTranscriptResult(transcriptPath, mtimeMs, sizeBytes, result) {
+  if (sizeBytes === 0)
+    return;
+  const cachePath = getCachePathFor(transcriptPath);
+  try {
+    mkdirSync7(join20(homedir20(), ".failproofai", "cache", "audit"), { recursive: true });
+    const entry = {
+      schemaVersion: CACHE_SCHEMA_VERSION,
+      cachedAt: Date.now(),
+      mtimeMs,
+      sizeBytes,
+      engineVersion: getEngineVersion(),
+      detectorVersion: getDetectorVersion(),
+      result
+    };
+    writeFileSync6(cachePath, JSON.stringify(entry), { encoding: "utf-8", mode: 384 });
+    try {
+      chmodSync2(cachePath, 384);
+    } catch {}
+  } catch {}
+}
+var cachedEngineVersion = null, cachedDetectorVersion = null, CACHE_SCHEMA_VERSION = 3, CACHE_TTL_MS;
+var init_cache = __esm(() => {
+  init_builtin_policies();
+  init_detectors();
+  CACHE_TTL_MS = 7 * 24 * 60 * 60000;
+});
+
+// src/audit/replay.ts
+function initReplay() {
+  if (initialized)
+    return;
+  savedSnapshot = getAllPolicies();
+  clearPolicies();
+  const enabled = BUILTIN_POLICIES.map((p) => p.name).filter((n) => !SKIP_POLICIES.has(normalizePolicyName(n)));
+  registerBuiltinPolicies(enabled);
+  initialized = true;
+}
+function restoreReplay() {
+  if (!initialized)
+    return;
+  if (savedSnapshot !== null) {
+    setAllPolicies(savedSnapshot);
+    savedSnapshot = null;
+  }
+  initialized = false;
+}
+async function replayEvent(event) {
+  if (!initialized)
+    initReplay();
+  const session = {
+    sessionId: event.sessionId,
+    transcriptPath: event.transcriptPath,
+    cwd: event.cwd,
+    cli: event.cli
+  };
+  const baseToolPayload = {
+    tool_name: event.toolName,
+    tool_input: event.toolInput,
+    session_id: event.sessionId,
+    cwd: event.cwd,
+    transcript_path: event.transcriptPath
+  };
+  const out = [];
+  const pre = await evaluatePolicies("PreToolUse", baseToolPayload, session);
+  collectHits(pre, "PreToolUse", out);
+  if (event.toolResultText !== undefined) {
+    const postPayload = { ...baseToolPayload, tool_response: event.toolResultText };
+    const post = await evaluatePolicies("PostToolUse", postPayload, session);
+    collectHits(post, "PostToolUse", out);
+  }
+  return out;
+}
+function collectHits(result, eventType, out) {
+  const names = result.policyNames && result.policyNames.length > 0 ? result.policyNames : result.policyName ? [result.policyName] : [];
+  for (const name of names) {
+    out.push({
+      policyName: name,
+      decision: result.decision,
+      reason: result.reason,
+      eventType
+    });
+  }
+}
+var SKIP_POLICIES, initialized = false, savedSnapshot = null;
+var init_replay = __esm(() => {
+  init_policy_evaluator();
+  init_builtin_policies();
+  SKIP_POLICIES = new Set(["warn-repeated-tool-calls"].map((n) => normalizePolicyName(n)));
+});
+
+// src/audit/index.ts
+function shortPolicyName(name) {
+  const slash = name.indexOf("/");
+  return slash >= 0 ? name.slice(slash + 1) : name;
+}
+function findBuiltin(name) {
+  const short = shortPolicyName(name);
+  for (const p of BUILTIN_POLICIES) {
+    if (p.name === name || shortPolicyName(p.name) === short)
+      return p;
+  }
+  return null;
+}
+function buildInstallHint(name, source, enabled) {
+  if (source === "audit-detector") {
+    return "Audit-only — `failproofai audit` will keep tracking these.";
+  }
+  if (enabled) {
+    return "Already enforced — failproofai is blocking these in real time.";
+  }
+  return `Enable in one command:  failproofai policies --install ${shortPolicyName(name)}`;
+}
+function truncateExample(s) {
+  if (s.length <= AUDIT_EXAMPLE_MAX_CHARS)
+    return s;
+  return s.slice(0, AUDIT_EXAMPLE_MAX_CHARS - 1) + "…";
+}
+function parseSinceOpt(since) {
+  if (!since)
+    return;
+  const m = /^(\d+)\s*([dhm])$/i.exec(since.trim());
+  if (m) {
+    const n = parseInt(m[1], 10);
+    const unit = m[2].toLowerCase();
+    const ms = unit === "d" ? 86400000 : unit === "h" ? 3600000 : 60000;
+    return Date.now() - n * ms;
+  }
+  const t = Date.parse(since);
+  if (!Number.isNaN(t))
+    return t;
+  throw new Error(`Invalid --since value: "${since}" (expected e.g. "7d", "30d", or "2026-04-01")`);
+}
+async function scanOneTranscript(meta) {
+  const empty = {
+    transcriptPath: meta.transcriptPath,
+    cli: meta.cli,
+    projectName: meta.projectName,
+    sessionId: meta.sessionId,
+    mtimeMs: meta.mtimeMs,
+    sizeBytes: meta.sizeBytes,
+    cwd: "",
+    eventsScanned: 0,
+    hitsByName: {},
+    examplesByName: {},
+    rangeByName: {}
+  };
+  const events = await ADAPTERS[meta.cli].streamEvents(meta);
+  if (events.length === 0)
+    return empty;
+  const result = empty;
+  result.eventsScanned = events.length;
+  result.cwd = events[0].cwd || "";
+  const sessionState = {};
+  for (const event of events) {
+    for (const detector of AUDIT_DETECTORS) {
+      const hit = detector.detect(event, sessionState);
+      if (!hit)
+        continue;
+      recordHit(result, detector.name, event.timestamp, event.cwd, truncateExample(hit.example));
+    }
+    let replayHits;
+    try {
+      replayHits = await replayEvent(event);
+    } catch {
+      continue;
+    }
+    for (const hit of replayHits) {
+      const example = formatPolicyExample(hit.policyName, event);
+      recordHit(result, hit.policyName, event.timestamp, event.cwd, truncateExample(example));
+    }
+  }
+  return result;
+}
+function formatPolicyExample(_policyName, event) {
+  if (event.toolName === "Bash") {
+    const command = event.toolInput.command;
+    if (typeof command === "string")
+      return command.replace(/\s+/g, " ");
+  }
+  const filePath = event.toolInput.file_path;
+  if (typeof filePath === "string")
+    return `${event.toolName} ${filePath}`;
+  return `${event.toolName}`;
+}
+function recordHit(result, name, timestamp, cwd, example) {
+  result.hitsByName[name] = (result.hitsByName[name] ?? 0) + 1;
+  const exs = result.examplesByName[name] ?? [];
+  if (exs.length < AUDIT_MAX_EXAMPLES_PER_NAME) {
+    exs.push({ timestamp, cwd, example });
+    result.examplesByName[name] = exs;
+  }
+  const range = result.rangeByName[name];
+  if (!range) {
+    result.rangeByName[name] = { first: timestamp, last: timestamp };
+  } else {
+    if (timestamp < range.first)
+      range.first = timestamp;
+    if (timestamp > range.last)
+      range.last = timestamp;
+  }
+}
+function aggregateResults(perTranscript, enabledBuiltins) {
+  const byName = new Map;
+  for (const t of perTranscript) {
+    for (const [name, count] of Object.entries(t.hitsByName)) {
+      const bucket = byName.get(name) ?? {
+        hits: 0,
+        projects: new Set,
+        examples: []
+      };
+      bucket.hits += count;
+      bucket.projects.add(t.projectName);
+      const tExs = t.examplesByName[name] ?? [];
+      for (const e of tExs) {
+        if (bucket.examples.length < AUDIT_MAX_EXAMPLES_PER_NAME) {
+          bucket.examples.push({ ...e, sessionId: t.sessionId });
+        }
+      }
+      const range = t.rangeByName[name];
+      if (range) {
+        if (!bucket.first || range.first < bucket.first)
+          bucket.first = range.first;
+        if (!bucket.last || range.last > bucket.last)
+          bucket.last = range.last;
+      }
+      byName.set(name, bucket);
+    }
+  }
+  const detectorByName = new Map(AUDIT_DETECTORS.map((d) => [d.name, d]));
+  const out = [];
+  for (const [name, bucket] of byName) {
+    const detector = detectorByName.get(name);
+    const isDetector = !!detector;
+    const builtin = isDetector ? null : findBuiltin(name);
+    const source = isDetector ? "audit-detector" : "builtin";
+    const enabled = isDetector ? false : enabledBuiltins.has(normalizePolicyName(name));
+    const displayTitle = detector?.displayTitle ?? builtin?.displayTitle ?? detector?.description ?? builtin?.description ?? shortPolicyName(name);
+    const impact = detector?.impact ?? builtin?.impact ?? "";
+    out.push({
+      name,
+      source,
+      category: detector?.category ?? builtin?.category ?? "Custom",
+      severity: isDetector ? detector?.severity ?? "info" : severityForBuiltin(name),
+      hits: bucket.hits,
+      projects: bucket.projects.size,
+      firstSeen: bucket.first,
+      lastSeen: bucket.last,
+      examples: bucket.examples,
+      displayTitle,
+      impact,
+      enabledInConfig: enabled,
+      installHint: buildInstallHint(name, source, enabled)
+    });
+  }
+  out.sort((a, b) => b.hits - a.hits);
+  return out;
+}
+async function runAudit(opts = {}) {
+  const startedAt = Date.now();
+  initReplay();
+  try {
+    return await runAuditInner(opts, startedAt);
+  } finally {
+    restoreReplay();
+  }
+}
+async function runAuditInner(opts, startedAt) {
+  const clis = opts.clis ?? Array.from(INTEGRATION_TYPES);
+  const sinceMs = parseSinceOpt(opts.since);
+  const userConfig = readMergedHooksConfig();
+  const enabledBuiltins = new Set((userConfig.enabledPolicies ?? []).map((n) => normalizePolicyName(n)));
+  const allTranscripts = [];
+  for (const cli of clis) {
+    const adapter = ADAPTERS[cli];
+    let list;
+    try {
+      list = await adapter.listTranscripts({ projects: opts.projects, sinceMs });
+    } catch {
+      continue;
+    }
+    allTranscripts.push(...list);
+  }
+  let skipped = 0;
+  let errors = 0;
+  const tasks = allTranscripts.map((meta) => async () => {
+    if (!opts.noCache) {
+      const cached = readCachedTranscriptResult(meta.transcriptPath, meta.mtimeMs, meta.sizeBytes);
+      if (cached)
+        return cached;
+    }
+    try {
+      const fresh = await scanOneTranscript(meta);
+      if (!opts.noCache) {
+        writeCachedTranscriptResult(meta.transcriptPath, meta.mtimeMs, meta.sizeBytes, fresh);
+      }
+      return fresh;
+    } catch {
+      errors++;
+      return {
+        transcriptPath: meta.transcriptPath,
+        cli: meta.cli,
+        projectName: meta.projectName,
+        cwd: "",
+        sessionId: meta.sessionId,
+        mtimeMs: meta.mtimeMs,
+        sizeBytes: meta.sizeBytes,
+        eventsScanned: 0,
+        hitsByName: {},
+        examplesByName: {},
+        rangeByName: {}
+      };
+    }
+  });
+  const settled = await batchAll(tasks, TRANSCRIPT_CONCURRENCY);
+  const perTranscript = [];
+  for (const s of settled) {
+    if (s.status === "fulfilled")
+      perTranscript.push(s.value);
+    else
+      skipped++;
+  }
+  let results = aggregateResults(perTranscript, enabledBuiltins);
+  if (opts.policies?.length) {
+    const wanted = new Set(opts.policies.map(shortPolicyName));
+    results = results.filter((r) => wanted.has(shortPolicyName(r.name)));
+  }
+  const totalsHits = results.reduce((sum, r) => sum + r.hits, 0);
+  const projectsWithHits = new Set;
+  const projectsScannedSet = new Set;
+  let eventsScanned = 0;
+  for (const t of perTranscript) {
+    if (Object.keys(t.hitsByName).length > 0)
+      projectsWithHits.add(t.projectName);
+    if (t.cwd)
+      projectsScannedSet.add(t.cwd);
+    eventsScanned += t.eventsScanned ?? 0;
+  }
+  const auditResult = {
+    version: 2,
+    scannedAt: new Date(startedAt).toISOString(),
+    scope: {
+      cli: clis,
+      projects: opts.projects ?? "all",
+      since: opts.since ?? null
+    },
+    transcripts: {
+      scanned: allTranscripts.length,
+      skipped,
+      errors,
+      durationMs: Date.now() - startedAt
+    },
+    results,
+    totals: {
+      hits: totalsHits,
+      projectsWithHits: projectsWithHits.size
+    },
+    projectsScanned: [...projectsScannedSet].sort(),
+    eventsScanned,
+    enabledBuiltinNames: [...enabledBuiltins].map((n) => n.includes("/") ? n.slice(n.indexOf("/") + 1) : n)
+  };
+  return auditResult;
+}
+var TRANSCRIPT_CONCURRENCY = 8;
+var init_audit = __esm(() => {
+  init_builtin_policies();
+  init_hooks_config();
+  init_types();
+  init_cli_adapters();
+  init_detectors();
+  init_features();
+  init_cache();
+  init_replay();
+  init_types2();
+});
+
+// src/audit/dashboard-cache.ts
+import { join as join21 } from "node:path";
+import { homedir as homedir21 } from "node:os";
+function getCachePath() {
+  return join21(homedir21(), ".failproofai", "audit-dashboard.json");
+}
+function writeDashboardCache(params, result) {
+  try {
+    const entry = {
+      schemaVersion: DASHBOARD_CACHE_SCHEMA_VERSION,
+      cachedAt: new Date().toISOString(),
+      params,
+      result
+    };
+    writeJsonAtomically(getCachePath(), entry);
+    return true;
+  } catch {
+    return false;
+  }
+}
+var DASHBOARD_CACHE_TTL_MINUTES, DASHBOARD_CACHE_SCHEMA_VERSION = 2;
+var init_dashboard_cache = __esm(() => {
+  init_atomic_write();
+  DASHBOARD_CACHE_TTL_MINUTES = 7 * 24 * 60;
+});
+
+// src/audit/open-browser.ts
+import { spawn } from "node:child_process";
+function openUrl(url) {
+  let cmd;
+  let args;
+  if (process.platform === "darwin") {
+    cmd = "open";
+    args = [url];
+  } else if (process.platform === "win32") {
+    cmd = "cmd";
+    args = ["/c", "start", "", url];
+  } else {
+    cmd = "xdg-open";
+    args = [url];
+  }
+  try {
+    const child = spawn(cmd, args, { stdio: "ignore", detached: true });
+    child.on("error", () => {});
+    child.unref();
+  } catch {}
+}
+function openWhenReady(port, path3) {
+  const base = `http://localhost:${port}`;
+  const target = `${base}${path3}`;
+  (async () => {
+    const deadline = Date.now() + POLL_TIMEOUT_MS;
+    while (Date.now() < deadline) {
+      try {
+        await fetch(base, { method: "GET", redirect: "manual" });
+        openUrl(target);
+        return;
+      } catch {
+        await new Promise((r) => setTimeout(r, POLL_INTERVAL_MS));
+      }
+    }
+    openUrl(target);
+  })();
+}
+var POLL_INTERVAL_MS = 150, POLL_TIMEOUT_MS = 30000;
+var init_open_browser = () => {};
+
+// scripts/parse-script-args.ts
+import { resolve as resolve12 } from "path";
+function parseStringFlag(flagName, errorLabel, inlineValue, args, index, options) {
+  const raw = inlineValue ?? args[index + 1];
+  if (raw === undefined || inlineValue === null && raw.startsWith("-")) {
+    console.error(`Error: ${flagName} requires ${errorLabel}`);
+    process.exit(1);
+  }
+  const value = options?.resolve ? resolve12(raw) : raw;
+  return { value, spliceCount: inlineValue !== null ? 1 : 2 };
+}
+function parseScriptArgs(argv) {
+  const args = [...argv];
+  let loggingLevel;
+  let disableTelemetry = false;
+  let allowedDevOrigins;
+  for (let i = 0;i < args.length; i++) {
+    const arg = args[i];
+    const eqIdx = arg.indexOf("=");
+    const flag = eqIdx >= 0 ? arg.slice(0, eqIdx) : arg;
+    const inlineValue = eqIdx >= 0 ? arg.slice(eqIdx + 1) : null;
+    if (flag === "--logging") {
+      const raw = inlineValue ?? args[i + 1];
+      if (raw === undefined || inlineValue === null && raw.startsWith("-")) {
+        console.error("Error: --logging requires a level (info, warn, error)");
+        process.exit(1);
+      }
+      const val = raw.toLowerCase();
+      if (val !== "info" && val !== "warn" && val !== "error") {
+        console.error("Error: --logging must be one of: info, warn, error");
+        process.exit(1);
+      }
+      loggingLevel = val;
+      args.splice(i, inlineValue !== null ? 1 : 2);
+      i--;
+      continue;
+    }
+    if (flag === "--disable-telemetry") {
+      disableTelemetry = true;
+      args.splice(i, 1);
+      i--;
+      continue;
+    }
+    if (flag === "--allowed-origins") {
+      const { value, spliceCount } = parseStringFlag(flag, "a comma-separated list of origins", inlineValue, args, i);
+      allowedDevOrigins = value.split(",").map((s) => s.trim()).filter(Boolean);
+      args.splice(i, spliceCount);
+      i--;
+      continue;
+    }
+  }
+  return { loggingLevel, disableTelemetry, allowedDevOrigins, remainingArgs: args };
+}
+var init_parse_script_args = () => {};
+
+// scripts/install-diagnosis.mjs
+import { existsSync as existsSync16, readFileSync as readFileSync12, realpathSync } from "node:fs";
+import { dirname as dirname6, resolve as resolve13 } from "node:path";
+import { homedir as homedir22, platform as platform2 } from "node:os";
+import { spawnSync } from "node:child_process";
+function findPackageRoot(start) {
+  try {
+    let dir = realpathSync(start);
+    if (existsSync16(dir) && !existsSync16(resolve13(dir, "package.json"))) {
+      dir = dirname6(dir);
+    }
+    while (true) {
+      const pkgPath = resolve13(dir, "package.json");
+      if (existsSync16(pkgPath)) {
+        try {
+          const pkg = JSON.parse(readFileSync12(pkgPath, "utf8"));
+          if (pkg.name === PKG_NAME)
+            return dir;
+        } catch {}
+      }
+      const parent = dirname6(dir);
+      if (parent === dir)
+        return null;
+      dir = parent;
+    }
+  } catch {
+    return null;
+  }
+}
+function readPackageVersion(packageRoot) {
+  if (!packageRoot)
+    return null;
+  try {
+    const pkg = JSON.parse(readFileSync12(resolve13(packageRoot, "package.json"), "utf8"));
+    return typeof pkg.version === "string" ? pkg.version : null;
+  } catch {
+    return null;
+  }
+}
+function resolvePathFirstBinary() {
+  try {
+    const isWin = platform2() === "win32";
+    const res = isWin ? spawnSync("where", [PKG_NAME], { encoding: "utf8" }) : spawnSync("sh", ["-c", `command -v ${PKG_NAME}`], { encoding: "utf8" });
+    if (res.status !== 0)
+      return null;
+    const first = (res.stdout || "").split(/\r?\n/).find((l) => l.trim().length > 0);
+    return first ? first.trim() : null;
+  } catch {
+    return null;
+  }
+}
+function locateNpmGlobal() {
+  try {
+    const res = spawnSync("npm", ["root", "-g"], { encoding: "utf8" });
+    if (res.status !== 0)
+      return null;
+    const root = (res.stdout || "").trim();
+    if (!root)
+      return null;
+    const candidate = resolve13(root, PKG_NAME);
+    return existsSync16(resolve13(candidate, "package.json")) ? candidate : null;
+  } catch {
+    return null;
+  }
+}
+function locateBunGlobal() {
+  try {
+    const candidate = resolve13(homedir22(), ".bun", "install", "global", "node_modules", PKG_NAME);
+    return existsSync16(resolve13(candidate, "package.json")) ? candidate : null;
+  } catch {
+    return null;
+  }
+}
+function buildRecommendation(pathFirstBin) {
+  if (!pathFirstBin)
+    return null;
+  const bunBinPrefix = resolve13(homedir22(), ".bun", "bin") + "/";
+  const bunGlobalPrefix = resolve13(homedir22(), ".bun", "install", "global") + "/";
+  const isBun = pathFirstBin.startsWith(bunBinPrefix) || pathFirstBin.startsWith(bunGlobalPrefix);
+  if (isBun) {
+    return `rm -f ~/.bun/bin/${PKG_NAME} && rm -rf ~/.bun/install/global/node_modules/${PKG_NAME}`;
+  }
+  return `npm rm -g ${PKG_NAME}`;
+}
+function diagnoseShadow(self) {
+  const selfPackageRoot = (() => {
+    try {
+      return self?.selfPackageRoot ? realpathSync(self.selfPackageRoot) : null;
+    } catch {
+      return self?.selfPackageRoot ?? null;
+    }
+  })();
+  const selfVersion = self?.selfVersion ?? null;
+  const pathFirstBin = resolvePathFirstBinary();
+  const pathFirstPackageRoot = pathFirstBin ? findPackageRoot(pathFirstBin) : null;
+  const pathFirstVersion = readPackageVersion(pathFirstPackageRoot);
+  const npmGlobalPath = locateNpmGlobal();
+  const npmGlobalVersion = readPackageVersion(npmGlobalPath);
+  const bunGlobalPath = locateBunGlobal();
+  const bunGlobalVersion = readPackageVersion(bunGlobalPath);
+  let shadowed = false;
+  if (selfPackageRoot && pathFirstPackageRoot && pathFirstPackageRoot !== selfPackageRoot) {
+    shadowed = true;
+  } else if (pathFirstPackageRoot) {
+    if (npmGlobalPath && npmGlobalPath !== pathFirstPackageRoot)
+      shadowed = true;
+    else if (bunGlobalPath && bunGlobalPath !== pathFirstPackageRoot)
+      shadowed = true;
+  }
+  const recommendation = shadowed ? buildRecommendation(pathFirstBin) : null;
+  let shadowDescription = null;
+  if (shadowed) {
+    shadowDescription = `PATH resolves to ${pathFirstPackageRoot}` + (pathFirstVersion ? ` (v${pathFirstVersion})` : "") + `, but you just installed ${selfPackageRoot}` + (selfVersion ? ` (v${selfVersion})` : "") + ".";
+  }
+  return {
+    selfPackageRoot,
+    selfVersion,
+    pathFirstBin,
+    pathFirstPath: pathFirstPackageRoot,
+    pathFirstVersion,
+    npmGlobalPath,
+    npmGlobalVersion,
+    bunGlobalPath,
+    bunGlobalVersion,
+    shadowed,
+    shadowDescription,
+    recommendation
+  };
+}
+var PKG_NAME = "failproofai";
+var init_install_diagnosis = () => {};
+
+// scripts/skew-log-filter.ts
+function makeSkewLogFilter() {
+  let inSkewBlock = false;
+  return (line) => {
+    if (line.includes("Failed to find Server Action")) {
+      inSkewBlock = true;
+      return null;
+    }
+    if (inSkewBlock) {
+      const trimmed = line.trimStart();
+      if (trimmed.startsWith("Read more:") || line.includes("failed-to-find-server-action") || line.includes("ignore-listed frames") || /^\s+at\s/.test(line)) {
+        return null;
+      }
+      inSkewBlock = false;
+    }
+    return line;
+  };
+}
+
+// scripts/launch.ts
+var exports_launch = {};
+__export(exports_launch, {
+  launch: () => launch
+});
+import { spawn as spawn2 } from "child_process";
+import { realpathSync as realpathSync2, existsSync as existsSync17 } from "node:fs";
+import { resolve as resolve14, dirname as dirname7 } from "node:path";
+import { fileURLToPath as fileURLToPath2 } from "node:url";
+import { createInterface as createInterface2 } from "node:readline";
+function launch(mode) {
+  const { loggingLevel, disableTelemetry, allowedDevOrigins, remainingArgs } = parseScriptArgs(process.argv.slice(2));
+  console.log(`
+  failproof ai
+`);
+  console.log(`  \uD83D\uDCE6 Version:      ${version2}`);
+  console.log(`  ⭐ Star us:      https://github.com/failproofai/failproofai`);
+  console.log(`  \uD83D\uDCD6 Docs:         https://docs.befailproof.ai/introduction`);
+  console.log(`  \uD83D\uDCAC Discord:      https://discord.gg/2zjBZP7yQJ
+`);
+  let cmd;
+  let cmdArgs;
+  if (mode === "start") {
+    const portIdx = remainingArgs.indexOf("--port");
+    const port = portIdx >= 0 ? remainingArgs[portIdx + 1] : "8020";
+    process.env.PORT = port;
+    process.env.HOSTNAME = "0.0.0.0";
+    cmd = "node";
+    const packageRoot = process.env.FAILPROOFAI_PACKAGE_ROOT ?? resolve14(dirname7(realpathSync2(fileURLToPath2(import.meta.url))), "..");
+    const serverJsPath = resolve14(packageRoot, ".next/standalone/server.js");
+    if (!existsSync17(serverJsPath)) {
+      let shadowMessage = null;
+      try {
+        const diag = diagnoseShadow({ selfPackageRoot: packageRoot, selfVersion: version2 });
+        if (diag.shadowed) {
+          const alt = (diag.npmGlobalPath && diag.npmGlobalPath !== diag.pathFirstPath ? { path: diag.npmGlobalPath, version: diag.npmGlobalVersion } : null) ?? (diag.bunGlobalPath && diag.bunGlobalPath !== diag.pathFirstPath ? { path: diag.bunGlobalPath, version: diag.bunGlobalVersion } : null);
+          const newer = alt?.path ?? "(unknown)";
+          const newerVer = alt?.version ?? "?";
+          shadowMessage = `
+Error: failproofai on your PATH is a stale install that no longer has its build output.
+` + `  Running:    ${diag.pathFirstPath}` + (diag.pathFirstVersion ? `  (v${diag.pathFirstVersion})` : "") + `
+` + `  Newer copy: ${newer}  (v${newerVer})
+
+` + `Remove the shadow with:
+  ${diag.recommendation}
+`;
+        }
+      } catch {}
+      console.error(shadowMessage ?? `
+Error: Cannot find server.js at:
+  ${serverJsPath}
+
+` + `The package may be missing its build output.
+` + `Try reinstalling:
+  npm install -g failproofai@latest
+`);
+      process.exit(1);
+    }
+    cmdArgs = [serverJsPath];
+  } else {
+    cmd = "bunx";
+    cmdArgs = ["--bun", "next", "dev", ...remainingArgs];
+  }
+  const filterLogs = mode === "start";
+  const nextProcess = spawn2(cmd, cmdArgs, {
+    stdio: filterLogs ? ["inherit", "pipe", "pipe"] : "inherit",
+    env: {
+      ...process.env,
+      ...filterLogs ? { FORCE_COLOR: process.env.FORCE_COLOR ?? "1" } : {},
+      ...loggingLevel ? { FAILPROOFAI_LOG_LEVEL: loggingLevel } : {},
+      ...disableTelemetry ? { FAILPROOFAI_TELEMETRY_DISABLED: "1" } : {},
+      ...allowedDevOrigins ? { FAILPROOFAI_ALLOWED_DEV_ORIGINS: allowedDevOrigins.join(",") } : {}
+    }
+  });
+  if (filterLogs) {
+    for (const [src, dest] of [
+      [nextProcess.stdout, process.stdout],
+      [nextProcess.stderr, process.stderr]
+    ]) {
+      if (!src)
+        continue;
+      const filter = makeSkewLogFilter();
+      createInterface2({ input: src }).on("line", (line) => {
+        const out = filter(line);
+        if (out !== null)
+          dest.write(out + `
+`);
+      });
+    }
+  }
+  nextProcess.on("error", (error) => {
+    console.error("Error starting Next.js:", error);
+    process.exit(1);
+  });
+  nextProcess.on("exit", (code) => {
+    process.exit(code || 0);
+  });
+}
+var init_launch = __esm(() => {
+  init_parse_script_args();
+  init_install_diagnosis();
+  init_package();
+});
+
+// src/audit/cli.ts
+var exports_cli2 = {};
+__export(exports_cli2, {
+  runAuditCli: () => runAuditCli,
+  buildSummary: () => buildSummary,
+  AUDIT_STAGES: () => AUDIT_STAGES
+});
+function colorOn() {
+  if (process.env.NO_COLOR && process.env.NO_COLOR !== "")
+    return false;
+  if (process.env.FORCE_COLOR === "0")
+    return false;
+  if (process.env.FORCE_COLOR)
+    return true;
+  return !!process.stdout.isTTY;
+}
+function c(code, s) {
+  return colorOn() ? `${code}${s}${RESET2}` : s;
+}
+function num(n) {
+  return n.toLocaleString("en-US");
+}
+function die(message) {
+  process.stderr.write(`Error: ${message}
+`);
+  process.exit(1);
+}
+function startProgress() {
+  const n = AUDIT_STAGES.length;
+  let stage = 0;
+  let tick = 0;
+  let done = false;
+  let printed = false;
+  const lineFor = (i) => {
+    const s = AUDIT_STAGES[i];
+    if (done || i < stage)
+      return `  ${c(GREEN2, "✓")} ${c(DIM2, s.label)}`;
+    if (i === stage) {
+      return `  ${c(PINK2, SPINNER[tick % SPINNER.length])} ${s.label}  ${c(DIM2, s.detail)}`;
+    }
+    return `  ${c(DIM2, "○")} ${c(DIM2, s.label)}`;
+  };
+  const render = () => {
+    const lines = Array.from({ length: n }, (_, i) => lineFor(i));
+    if (printed)
+      process.stdout.write(`\x1B[${n}A`);
+    process.stdout.write(lines.map((l) => `\x1B[2K${l}`).join(`
+`) + `
+`);
+    printed = true;
+  };
+  render();
+  const spinTimer = setInterval(() => {
+    tick++;
+    render();
+  }, 90);
+  const stageTimer = setInterval(() => {
+    if (stage < n - 1) {
+      stage++;
+      render();
+    }
+  }, 1100);
+  const stop = () => {
+    clearInterval(spinTimer);
+    clearInterval(stageTimer);
+  };
+  return {
+    finish() {
+      stop();
+      done = true;
+      render();
+    },
+    fail() {
+      stop();
+      process.stdout.write(`
+`);
+    }
+  };
+}
+async function runWithProgress(opts) {
+  if (!process.stdout.isTTY) {
+    process.stdout.write(`  scanning your agent session history — this can take a moment…
+`);
+    return runAudit(opts);
+  }
+  const progress = startProgress();
+  try {
+    const result = await runAudit(opts);
+    progress.finish();
+    return result;
+  } catch (err) {
+    progress.fail();
+    throw err;
+  }
+}
+function printHeader() {
+  process.stdout.write(`
+  ${c(PINK2, "\uD83D\uDEE1  failproofai audit")}  ${c(DIM2, "· beta")}
+
+`);
+  process.stdout.write(`  ${c(DIM2, "starting audit…")}
+
+`);
+}
+function buildSummary(result) {
+  const sessions = result.transcripts.scanned;
+  const events = result.eventsScanned;
+  const projects = result.projectsScanned.length;
+  const enabledRows = result.results.filter((r) => r.source === "builtin" && r.enabledInConfig);
+  const slippingRows = result.results.filter((r) => !(r.source === "builtin" && r.enabledInConfig));
+  const lines = [];
+  lines.push(`${c(GREEN2, "✓ audit complete")}  ${c(DIM2, "·")}  ` + `${c(BOLD, num(events))} tool call${events === 1 ? "" : "s"} across ` + `${num(sessions)} session${sessions === 1 ? "" : "s"}` + (projects > 0 ? ` ${c(DIM2, "·")} ${num(projects)} project${projects === 1 ? "" : "s"}` : ""));
+  if (result.totals.hits === 0) {
+    if (events > 0)
+      lines.push(c(DIM2, "clean run — nothing flagged. nice."));
+    return lines;
+  }
+  const parts = [];
+  if (slippingRows.length > 0) {
+    parts.push(`${c(PINK2, String(slippingRows.length))} ${slippingRows.length === 1 ? "pattern" : "patterns"} slipping through`);
+  }
+  if (enabledRows.length > 0) {
+    parts.push(`${c(GREEN2, String(enabledRows.length))} already blocked by your policies`);
+  }
+  if (parts.length > 0)
+    lines.push(parts.join(`  ${c(DIM2, "·")}  `));
+  return lines;
+}
+function printSummary(result) {
+  process.stdout.write(`
+`);
+  for (const line of buildSummary(result))
+    process.stdout.write(`  ${line}
+`);
+}
+async function runAuditCli(args) {
+  if (args.includes("--help") || args.includes("-h")) {
+    process.stdout.write(HELP2);
+    process.exit(0);
+  }
+  const stray = args.find((a) => a !== "--help" && a !== "-h");
+  if (stray) {
+    die(`\`audit\` takes no arguments yet (got: ${stray}).
+` + `Run \`failproofai audit\` to scan your history and open the dashboard.`);
+  }
+  const instanceId = getInstanceId2();
+  trackHookEvent2(instanceId, "cli_audit_started", { source: "cli" });
+  printHeader();
+  const opts = {};
+  let result;
+  try {
+    result = await runWithProgress(opts);
+  } catch (err) {
+    await trackHookEvent2(instanceId, "cli_audit_failed", {
+      source: "cli",
+      error_type: err instanceof Error ? err.name : "unknown"
+    });
+    die(`Audit failed: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  printSummary(result);
+  await trackHookEvent2(instanceId, "cli_audit_completed", {
+    source: "cli",
+    events_scanned: result.eventsScanned,
+    sessions_scanned: result.transcripts.scanned,
+    total_hits: result.totals.hits,
+    findings: result.results.length
+  });
+  if (result.eventsScanned === 0) {
+    process.stdout.write(`
+  ${c(DIM2, "no agent sessions found yet.")}
+` + `  install hooks with ${c(CYAN, "failproofai policies --install")} ` + `${c(DIM2, "and come back after using your agent.")}
+
+`);
+    process.exit(0);
+  }
+  const persisted = writeDashboardCache(opts, result);
+  if (!persisted) {
+    process.stdout.write(`
+  ${c(PINK2, "!")} ${c(DIM2, "couldn't save the audit cache; the dashboard may show an empty state.")}
+`);
+  }
+  const url = `http://localhost:${DASHBOARD_PORT}/audit`;
+  process.stdout.write(`
+  ${c(DIM2, "starting the dashboard…")}
+` + `  ${c(PINK2, "✦")} ${c(BOLD, "here's your audit")}  ${c(DIM2, "→")}  ${c(CYAN, url)}
+` + `  ${c(DIM2, "(opening in your browser — press Ctrl+C to stop the server)")}
+
+`);
+  openWhenReady(DASHBOARD_PORT, "/audit");
+  const { launch: launch2 } = await Promise.resolve().then(() => (init_launch(), exports_launch));
+  launch2("start");
+}
+var DASHBOARD_PORT = 8020, AUDIT_STAGES, HELP2, RESET2 = "\x1B[0m", DIM2 = "\x1B[2m", BOLD = "\x1B[1m", PINK2 = "\x1B[38;5;204m", GREEN2 = "\x1B[38;5;120m", CYAN = "\x1B[38;5;81m", SPINNER;
+var init_cli2 = __esm(() => {
+  init_audit();
+  init_dashboard_cache();
+  init_hook_telemetry2();
+  init_telemetry_id2();
+  init_open_browser();
+  AUDIT_STAGES = [
+    { label: "discovering transcripts", detail: "walking ~/.claude, ~/.codex, ~/.cursor, …" },
+    { label: "parsing session logs", detail: "reading JSONL + sqlite session stores" },
+    { label: "running policy checks", detail: "replaying through 30 builtin policies" },
+    { label: "aggregating results", detail: "counting hits, ranking by frequency" }
+  ];
+  HELP2 = `
+failproofai audit — audit your AI agent's behavior, then open the dashboard
+
+USAGE
+  failproofai audit          Scan your agent-CLI session history for risky and
+                             wasteful patterns, then open the audit dashboard.
+  failproofai audit --help   Show this help.
+
+WHAT IT DOES
+  1. Scans past sessions from every installed agent CLI (Claude, Codex, Cursor,
+     Copilot, OpenCode, Pi, Gemini) — entirely on your machine.
+  2. Starts the local dashboard and opens
+     http://localhost:${DASHBOARD_PORT}/audit with your results.
+
+  Runs fully offline — no account or network required. Press Ctrl+C to stop the
+  dashboard server when you're done.
+`.trimStart();
+  SPINNER = ["⠋", "⠙", "⠹", "⠸", "⠼", "⠴", "⠦", "⠧", "⠇", "⠏"];
+});
+
+// src/hooks/manager.ts
+import { execSync as execSync6 } from "node:child_process";
+import { resolve as resolve15, basename as basename5 } from "node:path";
+import { homedir as homedir23, platform as platform3, arch as arch2, release as release2, hostname as hostname2 } from "node:os";
+function getSettingsPath2(scope, cwd) {
+  return claudeCode.getSettingsPath(scope, cwd);
+}
+function scopeLabel2(scope) {
+  switch (scope) {
+    case "user":
+      return `~/.claude/settings.json`;
+    case "project":
+      return `{cwd}/.claude/settings.json`;
+    case "local":
+      return `{cwd}/.claude/settings.local.json`;
+  }
+}
+function resolveFailproofaiBinary2() {
+  const override = process.env.FAILPROOFAI_BINARY_OVERRIDE;
+  if (override && override.trim())
+    return override.trim();
+  try {
+    const cmd = process.platform === "win32" ? "where failproofai" : "which failproofai";
+    const result = execSync6(cmd, { encoding: "utf8" }).trim();
+    return result.split(`
+`)[0].trim();
+  } catch {
+    throw new CliError(`failproofai binary not found in PATH.
+` + "Install it globally first: npm install -g failproofai");
+  }
+}
+function validatePolicyNames2(names) {
+  const invalid = names.filter((n) => !VALID_POLICY_NAMES2.has(n));
+  if (invalid.length > 0) {
+    const validList = [...VALID_POLICY_NAMES2].join(", ");
+    throw new CliError(`Unknown policy name(s): ${invalid.join(", ")}
+` + `Valid policies: ${validList}`);
+  }
+}
+function deduplicateScopes2(scopes, cwd) {
+  const seen = new Set;
+  return scopes.filter((s) => {
+    const p = getSettingsPath2(s, cwd);
+    if (seen.has(p))
+      return false;
+    seen.add(p);
+    return true;
+  });
+}
+function hooksInstalledInSettings2(scope, cwd) {
+  return claudeCode.hooksInstalledInSettings(scope, cwd);
+}
+async function installHooks2(policyNames, scope = "user", cwd, includeBeta = false, source, customPoliciesPath, removeCustomHooks = false, cli) {
+  if (policyNames !== undefined && policyNames.length > 0) {
+    const nonAllNames = policyNames.filter((n) => n !== "all");
+    if (nonAllNames.length > 0)
+      validatePolicyNames2(nonAllNames);
+    if (policyNames.includes("all") && nonAllNames.length > 0) {
+      throw new CliError(`"all" cannot be combined with specific policy names.
+` + `Use either: --install all  or  --install block-sudo sanitize-jwt ...`);
+    }
+  }
+  const selectedClis = cli && cli.length > 0 ? [...new Set(cli)] : ["claude"];
+  for (const cliId of selectedClis) {
+    const integration = getIntegration(cliId);
+    if (!integration.scopes.includes(scope)) {
+      try {
+        await trackHookEvent2(getInstanceId2(), "scope_validation_failed", {
+          cli: cliId,
+          scope,
+          supported_scopes: integration.scopes
+        });
+      } catch {}
+      throw new CliError(`Scope "${scope}" is not supported by ${integration.displayName}. ` + `Valid scopes: ${integration.scopes.join(", ")}`);
+    }
+  }
+  const binaryPath = resolveFailproofaiBinary2();
+  const previousConfig = readScopedHooksConfig(scope, cwd);
+  const previousEnabled = new Set(previousConfig.enabledPolicies);
+  let selectedPolicies;
+  if (policyNames !== undefined) {
+    let incoming;
+    if (policyNames.length === 1 && policyNames[0] === "all") {
+      incoming = BUILTIN_POLICIES.filter((p) => includeBeta || !p.beta).map((p) => p.name);
+    } else {
+      incoming = policyNames;
+    }
+    selectedPolicies = [...new Set([...previousConfig.enabledPolicies, ...incoming])];
+  } else {
+    const preSelected = previousConfig.enabledPolicies.length > 0 ? previousConfig.enabledPolicies : undefined;
+    selectedPolicies = await promptPolicySelection(preSelected, { includeBeta });
+  }
+  const configToWrite = { ...previousConfig, enabledPolicies: selectedPolicies };
+  if (removeCustomHooks) {
+    delete configToWrite.customPoliciesPath;
+  } else if (customPoliciesPath) {
+    configToWrite.customPoliciesPath = resolve15(customPoliciesPath);
+    let validatedHooks = [];
+    try {
+      validatedHooks = await loadCustomHooks(configToWrite.customPoliciesPath, { strict: true });
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      try {
+        await trackHookEvent2(getInstanceId2(), "custom_policy_validation_failed", {
+          scope,
+          error_type: /not found/i.test(msg) ? "file_not_found" : "load_error"
+        });
+      } catch {}
+      console.error(`Error: ${msg}`);
+      process.exit(1);
+    }
+    if (validatedHooks.length === 0) {
+      try {
+        await trackHookEvent2(getInstanceId2(), "custom_policy_validation_failed", {
+          scope,
+          error_type: "no_hooks_registered"
+        });
+      } catch {}
+      console.error(`Error: no hooks registered in ${customPoliciesPath}. ` + `Make sure your file calls customPolicies.add(...) at least once.`);
+      process.exit(1);
+    }
+    console.log(`
+Validated ${validatedHooks.length} custom hook(s): ${validatedHooks.map((h) => h.name).join(", ")}`);
+  }
+  writeScopedHooksConfig(configToWrite, scope, cwd);
+  console.log(`
+Enabled ${selectedPolicies.length} policy(ies): ${selectedPolicies.join(", ")}
+`);
+  if (removeCustomHooks) {
+    console.log("Custom hooks path cleared.");
+  } else if (configToWrite.customPoliciesPath) {
+    console.log(`Custom hooks path: ${configToWrite.customPoliciesPath}`);
+  }
+  const writtenSettingsPaths = [];
+  for (const cliId of selectedClis) {
+    const integration = getIntegration(cliId);
+    const settingsPath = integration.getSettingsPath(scope, cwd);
+    try {
+      const settings = integration.readSettings(settingsPath);
+      integration.writeHookEntries(settings, binaryPath, scope);
+      integration.writeSettings(settingsPath, settings);
+      writtenSettingsPaths.push({ cli: cliId, path: settingsPath });
+    } catch (err) {
+      const errorType = err instanceof Error && /EACCES|EPERM/.test(err.message) ? "permission_denied" : err instanceof Error && /ENOENT|ENOTDIR/.test(err.message) ? "path_not_found" : "write_error";
+      try {
+        await trackHookEvent2(getInstanceId2(), "hook_write_failed", {
+          cli: cliId,
+          scope,
+          error_type: errorType
+        });
+      } catch {}
+      throw err;
+    }
+  }
+  try {
+    const newSet = new Set(selectedPolicies);
+    const policiesAdded = selectedPolicies.filter((p) => !previousEnabled.has(p));
+    const policiesRemoved = [...previousEnabled].filter((p) => !newSet.has(p));
+    const distinctId = getInstanceId2();
+    await trackHookEvent2(distinctId, "hooks_installed", {
+      scope,
+      cli: selectedClis,
+      cli_count: selectedClis.length,
+      policies: selectedPolicies,
+      policy_count: selectedPolicies.length,
+      policies_added: policiesAdded,
+      policies_removed: policiesRemoved,
+      ...source ? { source } : {},
+      platform: platform3(),
+      arch: arch2(),
+      os_release: release2(),
+      hostname_hash: hashToId2(hostname2()),
+      has_custom_hooks_path: !!configToWrite.customPoliciesPath,
+      has_policy_params: !!(configToWrite.policyParams && Object.keys(configToWrite.policyParams).length > 0),
       param_policy_names: configToWrite.policyParams ? Object.keys(configToWrite.policyParams) : [],
       command_format: scope === "project" ? "npx" : "absolute"
     });
@@ -9529,7 +11630,7 @@ function clisLabel(detected) {
   return detected.map((id) => getIntegration(id).displayName).join(", ");
 }
 async function promptYesNo(stdin, stdout) {
-  return new Promise((resolve13) => {
+  return new Promise((resolve16) => {
     const rl = readline4.createInterface({ input: stdin, output: stdout });
     let settled = false;
     const finish = (answer) => {
@@ -9537,7 +11638,7 @@ async function promptYesNo(stdin, stdout) {
         return;
       settled = true;
       rl.close();
-      resolve13(answer);
+      resolve16(answer);
     };
     rl.on("SIGINT", () => finish("sigint"));
     rl.question("Install policies now? [Y/n] ", (raw) => {
@@ -9609,211 +11710,25 @@ var init_first_run_nudge = __esm(() => {
   init_telemetry_id2();
 });
 
-// scripts/parse-script-args.ts
-import { resolve as resolve13 } from "path";
-function parseStringFlag(flagName, errorLabel, inlineValue, args, index, options) {
-  const raw = inlineValue ?? args[index + 1];
-  if (raw === undefined || inlineValue === null && raw.startsWith("-")) {
-    console.error(`Error: ${flagName} requires ${errorLabel}`);
-    process.exit(1);
-  }
-  const value = options?.resolve ? resolve13(raw) : raw;
-  return { value, spliceCount: inlineValue !== null ? 1 : 2 };
-}
-function parseScriptArgs(argv) {
-  const args = [...argv];
-  let loggingLevel;
-  let disableTelemetry = false;
-  let allowedDevOrigins;
-  for (let i = 0;i < args.length; i++) {
-    const arg = args[i];
-    const eqIdx = arg.indexOf("=");
-    const flag = eqIdx >= 0 ? arg.slice(0, eqIdx) : arg;
-    const inlineValue = eqIdx >= 0 ? arg.slice(eqIdx + 1) : null;
-    if (flag === "--logging") {
-      const raw = inlineValue ?? args[i + 1];
-      if (raw === undefined || inlineValue === null && raw.startsWith("-")) {
-        console.error("Error: --logging requires a level (info, warn, error)");
-        process.exit(1);
-      }
-      const val = raw.toLowerCase();
-      if (val !== "info" && val !== "warn" && val !== "error") {
-        console.error("Error: --logging must be one of: info, warn, error");
-        process.exit(1);
-      }
-      loggingLevel = val;
-      args.splice(i, inlineValue !== null ? 1 : 2);
-      i--;
-      continue;
-    }
-    if (flag === "--disable-telemetry") {
-      disableTelemetry = true;
-      args.splice(i, 1);
-      i--;
-      continue;
-    }
-    if (flag === "--allowed-origins") {
-      const { value, spliceCount } = parseStringFlag(flag, "a comma-separated list of origins", inlineValue, args, i);
-      allowedDevOrigins = value.split(",").map((s) => s.trim()).filter(Boolean);
-      args.splice(i, spliceCount);
-      i--;
-      continue;
-    }
-  }
-  return { loggingLevel, disableTelemetry, allowedDevOrigins, remainingArgs: args };
-}
-var init_parse_script_args = () => {};
-
-// scripts/install-diagnosis.mjs
-import { existsSync as existsSync14, readFileSync as readFileSync11, realpathSync } from "node:fs";
-import { dirname as dirname6, resolve as resolve14 } from "node:path";
-import { homedir as homedir21, platform as platform3 } from "node:os";
-import { spawnSync } from "node:child_process";
-function findPackageRoot(start) {
-  try {
-    let dir = realpathSync(start);
-    if (existsSync14(dir) && !existsSync14(resolve14(dir, "package.json"))) {
-      dir = dirname6(dir);
-    }
-    while (true) {
-      const pkgPath = resolve14(dir, "package.json");
-      if (existsSync14(pkgPath)) {
-        try {
-          const pkg = JSON.parse(readFileSync11(pkgPath, "utf8"));
-          if (pkg.name === PKG_NAME)
-            return dir;
-        } catch {}
-      }
-      const parent = dirname6(dir);
-      if (parent === dir)
-        return null;
-      dir = parent;
-    }
-  } catch {
-    return null;
-  }
-}
-function readPackageVersion(packageRoot) {
-  if (!packageRoot)
-    return null;
-  try {
-    const pkg = JSON.parse(readFileSync11(resolve14(packageRoot, "package.json"), "utf8"));
-    return typeof pkg.version === "string" ? pkg.version : null;
-  } catch {
-    return null;
-  }
-}
-function resolvePathFirstBinary() {
-  try {
-    const isWin = platform3() === "win32";
-    const res = isWin ? spawnSync("where", [PKG_NAME], { encoding: "utf8" }) : spawnSync("sh", ["-c", `command -v ${PKG_NAME}`], { encoding: "utf8" });
-    if (res.status !== 0)
-      return null;
-    const first = (res.stdout || "").split(/\r?\n/).find((l) => l.trim().length > 0);
-    return first ? first.trim() : null;
-  } catch {
-    return null;
-  }
-}
-function locateNpmGlobal() {
-  try {
-    const res = spawnSync("npm", ["root", "-g"], { encoding: "utf8" });
-    if (res.status !== 0)
-      return null;
-    const root = (res.stdout || "").trim();
-    if (!root)
-      return null;
-    const candidate = resolve14(root, PKG_NAME);
-    return existsSync14(resolve14(candidate, "package.json")) ? candidate : null;
-  } catch {
-    return null;
-  }
-}
-function locateBunGlobal() {
-  try {
-    const candidate = resolve14(homedir21(), ".bun", "install", "global", "node_modules", PKG_NAME);
-    return existsSync14(resolve14(candidate, "package.json")) ? candidate : null;
-  } catch {
-    return null;
-  }
-}
-function buildRecommendation(pathFirstBin) {
-  if (!pathFirstBin)
-    return null;
-  const bunBinPrefix = resolve14(homedir21(), ".bun", "bin") + "/";
-  const bunGlobalPrefix = resolve14(homedir21(), ".bun", "install", "global") + "/";
-  const isBun = pathFirstBin.startsWith(bunBinPrefix) || pathFirstBin.startsWith(bunGlobalPrefix);
-  if (isBun) {
-    return `rm -f ~/.bun/bin/${PKG_NAME} && rm -rf ~/.bun/install/global/node_modules/${PKG_NAME}`;
-  }
-  return `npm rm -g ${PKG_NAME}`;
-}
-function diagnoseShadow(self) {
-  const selfPackageRoot = (() => {
-    try {
-      return self?.selfPackageRoot ? realpathSync(self.selfPackageRoot) : null;
-    } catch {
-      return self?.selfPackageRoot ?? null;
-    }
-  })();
-  const selfVersion = self?.selfVersion ?? null;
-  const pathFirstBin = resolvePathFirstBinary();
-  const pathFirstPackageRoot = pathFirstBin ? findPackageRoot(pathFirstBin) : null;
-  const pathFirstVersion = readPackageVersion(pathFirstPackageRoot);
-  const npmGlobalPath = locateNpmGlobal();
-  const npmGlobalVersion = readPackageVersion(npmGlobalPath);
-  const bunGlobalPath = locateBunGlobal();
-  const bunGlobalVersion = readPackageVersion(bunGlobalPath);
-  let shadowed = false;
-  if (selfPackageRoot && pathFirstPackageRoot && pathFirstPackageRoot !== selfPackageRoot) {
-    shadowed = true;
-  } else if (pathFirstPackageRoot) {
-    if (npmGlobalPath && npmGlobalPath !== pathFirstPackageRoot)
-      shadowed = true;
-    else if (bunGlobalPath && bunGlobalPath !== pathFirstPackageRoot)
-      shadowed = true;
-  }
-  const recommendation = shadowed ? buildRecommendation(pathFirstBin) : null;
-  let shadowDescription = null;
-  if (shadowed) {
-    shadowDescription = `PATH resolves to ${pathFirstPackageRoot}` + (pathFirstVersion ? ` (v${pathFirstVersion})` : "") + `, but you just installed ${selfPackageRoot}` + (selfVersion ? ` (v${selfVersion})` : "") + ".";
-  }
-  return {
-    selfPackageRoot,
-    selfVersion,
-    pathFirstBin,
-    pathFirstPath: pathFirstPackageRoot,
-    pathFirstVersion,
-    npmGlobalPath,
-    npmGlobalVersion,
-    bunGlobalPath,
-    bunGlobalVersion,
-    shadowed,
-    shadowDescription,
-    recommendation
-  };
-}
-var PKG_NAME = "failproofai";
-var init_install_diagnosis = () => {};
-
 // scripts/launch.ts
-var exports_launch = {};
-__export(exports_launch, {
-  launch: () => launch
+var exports_launch2 = {};
+__export(exports_launch2, {
+  launch: () => launch2
 });
-import { spawn } from "child_process";
-import { realpathSync as realpathSync2, existsSync as existsSync15 } from "node:fs";
-import { resolve as resolve15, dirname as dirname7 } from "node:path";
-import { fileURLToPath as fileURLToPath2 } from "node:url";
-function launch(mode) {
+import { spawn as spawn3 } from "child_process";
+import { realpathSync as realpathSync3, existsSync as existsSync18 } from "node:fs";
+import { resolve as resolve16, dirname as dirname8 } from "node:path";
+import { fileURLToPath as fileURLToPath3 } from "node:url";
+import { createInterface as createInterface4 } from "node:readline";
+function launch2(mode) {
   const { loggingLevel, disableTelemetry, allowedDevOrigins, remainingArgs } = parseScriptArgs(process.argv.slice(2));
   console.log(`
   failproof ai
 `);
   console.log(`  \uD83D\uDCE6 Version:      ${version2}`);
   console.log(`  ⭐ Star us:      https://github.com/failproofai/failproofai`);
-  console.log(`  \uD83D\uDCD6 Docs:         https://befailproof.ai`);
-  console.log(`  \uD83D\uDCAC Slack:        https://join.slack.com/t/failproofai/shared_invite/zt-3v63b7k5e-O3NBHmj8X6n9gZSGDx6ggQ
+  console.log(`  \uD83D\uDCD6 Docs:         https://docs.befailproof.ai/introduction`);
+  console.log(`  \uD83D\uDCAC Discord:      https://discord.gg/2zjBZP7yQJ
 `);
   let cmd;
   let cmdArgs;
@@ -9823,9 +11738,9 @@ function launch(mode) {
     process.env.PORT = port;
     process.env.HOSTNAME = "0.0.0.0";
     cmd = "node";
-    const packageRoot = process.env.FAILPROOFAI_PACKAGE_ROOT ?? resolve15(dirname7(realpathSync2(fileURLToPath2(import.meta.url))), "..");
-    const serverJsPath = resolve15(packageRoot, ".next/standalone/server.js");
-    if (!existsSync15(serverJsPath)) {
+    const packageRoot = process.env.FAILPROOFAI_PACKAGE_ROOT ?? resolve16(dirname8(realpathSync3(fileURLToPath3(import.meta.url))), "..");
+    const serverJsPath = resolve16(packageRoot, ".next/standalone/server.js");
+    if (!existsSync18(serverJsPath)) {
       let shadowMessage = null;
       try {
         const diag = diagnoseShadow({ selfPackageRoot: packageRoot, selfVersion: version2 });
@@ -9858,15 +11773,33 @@ Error: Cannot find server.js at:
     cmd = "bunx";
     cmdArgs = ["--bun", "next", "dev", ...remainingArgs];
   }
-  const nextProcess = spawn(cmd, cmdArgs, {
-    stdio: "inherit",
+  const filterLogs = mode === "start";
+  const nextProcess = spawn3(cmd, cmdArgs, {
+    stdio: filterLogs ? ["inherit", "pipe", "pipe"] : "inherit",
     env: {
       ...process.env,
+      ...filterLogs ? { FORCE_COLOR: process.env.FORCE_COLOR ?? "1" } : {},
       ...loggingLevel ? { FAILPROOFAI_LOG_LEVEL: loggingLevel } : {},
       ...disableTelemetry ? { FAILPROOFAI_TELEMETRY_DISABLED: "1" } : {},
       ...allowedDevOrigins ? { FAILPROOFAI_ALLOWED_DEV_ORIGINS: allowedDevOrigins.join(",") } : {}
     }
   });
+  if (filterLogs) {
+    for (const [src, dest] of [
+      [nextProcess.stdout, process.stdout],
+      [nextProcess.stderr, process.stderr]
+    ]) {
+      if (!src)
+        continue;
+      const filter = makeSkewLogFilter();
+      createInterface4({ input: src }).on("line", (line) => {
+        const out = filter(line);
+        if (out !== null)
+          dest.write(out + `
+`);
+      });
+    }
+  }
   nextProcess.on("error", (error) => {
     console.error("Error starting Next.js:", error);
     process.exit(1);
@@ -9875,7 +11808,7 @@ Error: Cannot find server.js at:
     process.exit(code || 0);
   });
 }
-var init_launch = __esm(() => {
+var init_launch2 = __esm(() => {
   init_parse_script_args();
   init_install_diagnosis();
   init_package();
@@ -9899,18 +11832,18 @@ var init_cli_error2 = __esm(() => {
 });
 
 // bin/failproofai.mjs
-import { realpathSync as realpathSync3 } from "fs";
-import { dirname as dirname8, resolve as resolve16 } from "path";
-import { fileURLToPath as fileURLToPath3 } from "url";
+import { realpathSync as realpathSync4 } from "fs";
+import { dirname as dirname9, resolve as resolve17 } from "path";
+import { fileURLToPath as fileURLToPath4 } from "url";
 // package.json
-var version = "0.0.11-beta.9";
+var version = "0.0.11";
 
 // bin/failproofai.mjs
 if (!process.env.FAILPROOFAI_PACKAGE_ROOT) {
-  process.env.FAILPROOFAI_PACKAGE_ROOT = resolve16(dirname8(realpathSync3(fileURLToPath3(import.meta.url))), "..");
+  process.env.FAILPROOFAI_PACKAGE_ROOT = resolve17(dirname9(realpathSync4(fileURLToPath4(import.meta.url))), "..");
 }
 if (!process.env.FAILPROOFAI_DIST_PATH) {
-  process.env.FAILPROOFAI_DIST_PATH = resolve16(dirname8(realpathSync3(fileURLToPath3(import.meta.url))), "..", "dist");
+  process.env.FAILPROOFAI_DIST_PATH = resolve17(dirname9(realpathSync4(fileURLToPath4(import.meta.url))), "..", "dist");
 }
 var args = process.argv.slice(2);
 if (args[0] === "p")
@@ -9957,7 +11890,7 @@ if (hookIdx >= 0) {
   }
 }
 async function runCli() {
-  const SUBCOMMANDS2 = ["policies", "policy", "auth"];
+  const SUBCOMMANDS2 = ["policies", "policy", "auth", "audit"];
   if ((args.includes("--help") || args.includes("-h")) && !SUBCOMMANDS2.includes(args[0])) {
     const extraArgs = args.filter((a) => a !== "--help" && a !== "-h");
     if (extraArgs.length > 0) {
@@ -10004,6 +11937,10 @@ COMMANDS
     whoami                         Print the currently authenticated identity
   auth --help, -h                Show this help for the auth command
 
+  audit                          Audit your agent's behavior, then open the
+                                 dashboard at http://localhost:8020/audit
+  audit --help, -h               Show this help for the audit command
+
   --version, -v                  Print version and exit
   --help, -h                     Show this help message
 
@@ -10036,8 +11973,8 @@ EXAMPLES
 
 LINKS
   \u2B50 Star us:      https://github.com/failproofai/failproofai
-  \uD83D\uDCD6 Docs:         https://befailproof.ai
-  \uD83D\uDCAC Slack:        https://join.slack.com/t/failproofai/shared_invite/zt-3v63b7k5e-O3NBHmj8X6n9gZSGDx6ggQ
+  \uD83D\uDCD6 Docs:         https://docs.befailproof.ai/introduction
+  \uD83D\uDCAC Discord:      https://discord.gg/2zjBZP7yQJ
 `.trimStart());
     process.exit(0);
   }
@@ -10254,9 +12191,19 @@ Run \`failproofai policies --help\` for usage.`);
     lastSubcommand = "auth";
     const { runAuthCli: runAuthCli2 } = await Promise.resolve().then(() => (init_cli(), exports_cli));
     await runAuthCli2(args.slice(1));
-    await track("cli_auth_invoked", { args_count: args.length - 1 });
+    await track("cli_auth_invoked", {
+      args_count: args.length - 1,
+      subcommand: args[1] ?? "help",
+      exit_code: process.exitCode ?? 0
+    });
     process.exit(process.exitCode ?? 0);
   }
+  if (args[0] === "audit") {
+    lastSubcommand = "audit";
+    const { runAuditCli: runAuditCli2 } = await Promise.resolve().then(() => (init_cli2(), exports_cli2));
+    await runAuditCli2(args.slice(1));
+    return;
+  }
   if (args[0] === "policy") {
     lastSubcommand = "policy";
     const subArgs = args.slice(1);
@@ -10379,7 +12326,7 @@ For multiple policies use \`failproofai policies --${action === "add" ? "install
           dp[i][j] = a[i - 1] === b[j - 1] ? dp[i - 1][j - 1] : 1 + Math.min(dp[i - 1][j], dp[i][j - 1], dp[i - 1][j - 1]);
       return dp[m][n];
     };
-    const primary = ["--version", "--help", "--hook", "policies", "policy", "auth"];
+    const primary = ["--version", "--help", "--hook", "policies", "policy", "auth", "audit"];
     const closest = primary.reduce((best, flag) => {
       const dist = levenshtein(unknownFlag, flag);
       return dist < best.dist ? { flag, dist } : best;
@@ -10400,8 +12347,8 @@ Run \`failproofai --help\` for usage details.`);
       await maybeRunFirstRunNudge2();
     } catch {}
   }
-  const { launch: launch2 } = await Promise.resolve().then(() => (init_launch(), exports_launch));
-  launch2("start");
+  const { launch: launch3 } = await Promise.resolve().then(() => (init_launch2(), exports_launch2));
+  launch3("start");
 }
 var { CliError: CliError3 } = await Promise.resolve().then(() => (init_cli_error2(), exports_cli_error));
 try {