failproofai 0.0.14-beta.0 → 0.0.14-beta.2

package/.next/standalone/.next/static/chunks/{turbopack-0vavqo2d-tlt3.js → turbopack-10hj8t5pf33tu.js}

@@ -1 +1 @@
-(globalThis.TURBOPACK||(globalThis.TURBOPACK=[])).push(["object"==typeof document?document.currentScript:void 0,{otherChunks:["static/chunks/0zbxssxh53n-3.js","static/chunks/1__i9af9g78vd.js","static/chunks/13f1kmjea-0md.js","static/chunks/1ua5armwfph8o.js","static/chunks/03fmihek9n986.js"],runtimeModuleIds:[94553]}]),(()=>{let e;if(!Array.isArray(globalThis.TURBOPACK))return;let t="/_next/",r=function(){if(null!=self.TURBOPACK_ASSET_SUFFIX)return self.TURBOPACK_ASSET_SUFFIX;let e=document?.currentScript?.getAttribute?.("src")??"",t=e.indexOf("?");return t>=0?e.slice(t):""}(),n=["NEXT_DEPLOYMENT_ID","NEXT_CLIENT_ASSET_SUFFIX"];var o,i=((o=i||{})[o.Runtime=0]="Runtime",o[o.Parent=1]="Parent",o[o.Update=2]="Update",o);let l=new WeakMap;function s(e,t){this.m=e,this.e=t}let u=s.prototype,a=Object.prototype.hasOwnProperty,c="u">typeof Symbol&&Symbol.toStringTag;function f(e,t,r){a.call(e,t)||Object.defineProperty(e,t,r)}function p(e,t){let r=e[t];return r||(r=h(t),e[t]=r),r}function h(e){return{exports:{},error:void 0,id:e,namespaceObject:void 0}}function d(e,t){f(e,"__esModule",{value:!0}),c&&f(e,c,{value:"Module"});let r=0;for(;r<t.length;){let n=t[r++],o=t[r++];if("number"==typeof o)if(0===o)f(e,n,{value:t[r++],enumerable:!0,writable:!1});else throw Error(`unexpected tag: ${o}`);else"function"==typeof t[r]?f(e,n,{get:o,set:t[r++],enumerable:!0}):f(e,n,{get:o,enumerable:!0})}Object.seal(e)}function m(e,t){(null!=t?p(this.c,t):this.m).exports=e}u.s=function(e,t){let r,n;null!=t?n=(r=p(this.c,t)).exports:(r=this.m,n=this.e),r.namespaceObject=n,d(n,e)},u.j=function(e,t){var r,n;let o,i,s;null!=t?i=(o=p(this.c,t)).exports:(o=this.m,i=this.e);let u=(r=o,n=i,(s=l.get(r))||(l.set(r,s=[]),r.exports=r.namespaceObject=new Proxy(n,{get(e,t){if(a.call(e,t)||"default"===t||"__esModule"===t)return Reflect.get(e,t);for(let e of s){let r=Reflect.get(e,t);if(void 0!==r)return r}},ownKeys(e){let t=Reflect.ownKeys(e);for(let e of s)for(let r of Reflect.ownKeys(e))"default"===r||t.includes(r)||t.push(r);return t}})),s);"object"==typeof e&&null!==e&&u.push(e)},u.v=m,u.n=function(e,t){let r;(r=null!=t?p(this.c,t):this.m).exports=r.namespaceObject=e};let b=Object.getPrototypeOf?e=>Object.getPrototypeOf(e):e=>e.__proto__,y=[null,b({}),b([]),b(b)];function g(e,t,r){let n=[],o=-1;for(let t=e;("object"==typeof t||"function"==typeof t)&&!y.includes(t);t=b(t))for(let r of Object.getOwnPropertyNames(t))n.push(r,function(e,t){return()=>e[t]}(e,r)),-1===o&&"default"===r&&(o=n.length-1);return r&&o>=0||(o>=0?n.splice(o,1,0,e):n.push("default",0,e)),d(t,n),t}function O(e){let t=B(e,this.m);if(t.namespaceObject)return t.namespaceObject;let r=t.exports;return t.namespaceObject=g(r,"function"==typeof r?function(...e){return r.apply(this,e)}:Object.create(null),r&&r.__esModule)}function w(e){let t=e.indexOf("#");-1!==t&&(e=e.substring(0,t));let r=e.indexOf("?");return -1!==r&&(e=e.substring(0,r)),e}function k(){let e,t;return{promise:new Promise((r,n)=>{t=n,e=r}),resolve:e,reject:t}}u.i=O,u.A=function(e){return this.r(e)(O.bind(this))},u.t="function"==typeof require?require:function(){throw Error("Unexpected use of runtime require")},u.r=function(e){return B(e,this.m).exports},u.f=function(e){function t(t){if(t=w(t),a.call(e,t))return e[t].module();let r=Error(`Cannot find module '${t}'`);throw r.code="MODULE_NOT_FOUND",r}return t.keys=()=>Object.keys(e),t.resolve=t=>{if(t=w(t),a.call(e,t))return e[t].id();let r=Error(`Cannot find module '${t}'`);throw r.code="MODULE_NOT_FOUND",r},t.import=async e=>await t(e),t};let j=Symbol("turbopack queues"),U=Symbol("turbopack exports"),v=Symbol("turbopack error");function C(e){e&&1!==e.status&&(e.status=1,e.forEach(e=>e.queueCount--),e.forEach(e=>e.queueCount--?e.queueCount++:e()))}u.a=function(e,t){let r=this.m,n=t?Object.assign([],{status:-1}):void 0,o=new Set,{resolve:i,reject:l,promise:s}=k(),u=Object.assign(s,{[U]:r.exports,[j]:e=>{n&&e(n),o.forEach(e),u.catch(()=>{})}}),a={get:()=>u,set(e){e!==u&&(u[U]=e)}};Object.defineProperty(r,"exports",a),Object.defineProperty(r,"namespaceObject",a),e(function(e){let t=e.map(e=>{if(null!==e&&"object"==typeof e){if(j in e)return e;if(null!=e&&"object"==typeof e&&"then"in e&&"function"==typeof e.then){let t=Object.assign([],{status:0}),r={[U]:{},[j]:e=>e(t)};return e.then(e=>{r[U]=e,C(t)},e=>{r[v]=e,C(t)}),r}}return{[U]:e,[j]:()=>{}}}),r=()=>t.map(e=>{if(e[v])throw e[v];return e[U]}),{promise:i,resolve:l}=k(),s=Object.assign(()=>l(r),{queueCount:0});function u(e){e!==n&&!o.has(e)&&(o.add(e),e&&0===e.status&&(s.queueCount++,e.push(s)))}return t.map(e=>e[j](u)),s.queueCount?i:r()},function(e){e?l(u[v]=e):i(u[U]),C(n)}),n&&-1===n.status&&(n.status=0)};let P=function(e){let t=new URL(e,"x:/"),r={};for(let e in t)r[e]=t[e];for(let t in r.href=e,r.pathname=e.replace(/[?#].*/,""),r.origin=r.protocol="",r.toString=r.toJSON=(...t)=>e,r)Object.defineProperty(this,t,{enumerable:!0,configurable:!0,value:r[t]})};function R(e,t){throw Error(`Invariant: ${t(e)}`)}P.prototype=URL.prototype,u.U=P,u.z=function(e){throw Error("dynamic usage of require is not supported")},u.g=globalThis;let S=s.prototype,$=new Map;u.M=$;let _=new Map,E=new Map;async function T(e,t,r){let n;if("string"==typeof r)return M(e,t,N(r));let o=r.included||[],i=o.map(e=>!!$.has(e)||_.get(e));if(i.length>0&&i.every(e=>e))return void await Promise.all(i);let l=r.moduleChunks||[],s=l.map(e=>E.get(e)).filter(e=>e);if(s.length>0){if(s.length===l.length)return void await Promise.all(s);let r=new Set;for(let e of l)E.has(e)||r.add(e);for(let n of r){let r=M(e,t,N(n));E.set(n,r),s.push(r)}n=Promise.all(s)}else{for(let o of(n=M(e,t,N(r.path)),l))E.has(o)||E.set(o,n)}for(let e of o)_.has(e)||_.set(e,n);await n}S.l=function(e){return T(i.Parent,this.m.id,e)};let A=Promise.resolve(void 0),x=new WeakMap;function M(t,r,n){let o=e.loadChunkCached(t,n),l=x.get(o);if(void 0===l){let e=x.set.bind(x,o,A);l=o.then(e).catch(e=>{let o;switch(t){case i.Runtime:o=`as a runtime dependency of chunk ${r}`;break;case i.Parent:o=`from module ${r}`;break;case i.Update:o="from an HMR update";break;default:R(t,e=>`Unknown source type: ${e}`)}let l=Error(`Failed to load chunk ${n} ${o}${e?`: ${e}`:""}`,e?{cause:e}:void 0);throw l.name="ChunkLoadError",l}),x.set(o,l)}return l}function N(e){return`${t}${e.split("/").map(e=>encodeURIComponent(e)).join("/")}${r}`}S.L=function(e){return M(i.Parent,this.m.id,e)},S.R=function(e){let t=this.r(e);return t?.default??t},S.P=function(e){return`/ROOT/${e??""}`},S.q=function(e,t){m.call(this,`${e}${r}`,t)},S.b=function(e,t,o,i){let l="SharedWorker"===e.name,s=[o.map(e=>N(e)).reverse(),r];for(let e of n)s.push(globalThis[e]);let u=new URL(N(t),location.origin),a=JSON.stringify(s);return l?u.searchParams.set("params",a):u.hash="#params="+encodeURIComponent(a),new e(u,i?{...i,type:void 0}:void 0)};let K=/\.js(?:\?[^#]*)?(?:#.*)?$/,q=/\.css(?:\?[^#]*)?(?:#.*)?$/;function L(e){return q.test(e)}u.w=function(t,r,n){return e.loadWebAssembly(i.Parent,this.m.id,t,r,n)},u.u=function(t,r){return e.loadWebAssemblyModule(i.Parent,this.m.id,t,r)};let I={};u.c=I;let B=(e,t)=>{let r=I[e];if(r){if(r.error)throw r.error;return r}return W(e,i.Parent,t.id)};function W(e,t,r){let n=$.get(e);if("function"!=typeof n)throw Error(function(e,t,r){let n;switch(t){case 0:n=`as a runtime entry of chunk ${r}`;break;case 1:n=`because it was required from module ${r}`;break;case 2:n="because of an HMR update";break;default:R(t,e=>`Unknown source type: ${e}`)}return`Module ${e} was instantiated ${n}, but the module factory is not available.`}(e,t,r));let o=h(e),i=o.exports;I[e]=o;let l=new s(o,i);try{n(l,o,i)}catch(e){throw o.error=e,e}return o.namespaceObject&&o.exports!==o.namespaceObject&&g(o.exports,o.namespaceObject),o}function F(t){let r,n=function(e){if("string"==typeof e)return e;if(e)return{src:e.getAttribute("src")};if("u">typeof TURBOPACK_NEXT_CHUNK_URLS)return{src:TURBOPACK_NEXT_CHUNK_URLS.pop()};throw Error("chunk path empty but not in a worker")}(t[0]);return 2===t.length?r=t[1]:(r=void 0,!function(e,t){let r=1;for(;r<e.length;){let n,o=r+1;for(;o<e.length&&"function"!=typeof e[o];)o++;if(o===e.length)throw Error("malformed chunk format, expected a factory function");let i=e[o];for(let i=r;i<o;i++){let r=e[i],o=t.get(r);if(o){n=o;break}}let l=n??i,s=!1;for(let n=r;n<o;n++){let r=e[n];t.has(r)||(s||(l===i&&Object.defineProperty(i,"name",{value:"module evaluation"}),s=!0),t.set(r,l))}r=o+1}}(t,$)),e.registerChunk(n,r)}let X=new Map;function D(e){let t=X.get(e);if(!t){let r,n;t={resolved:!1,loadingStarted:!1,promise:new Promise((e,t)=>{r=e,n=t}),resolve:()=>{t.resolved=!0,r()},reject:n},X.set(e,t)}return t}e={async registerChunk(e,r){let n=function(e){if("string"==typeof e)return e;let r=decodeURIComponent(e.src.replace(/[?#].*$/,""));return r.startsWith(t)?r.slice(t.length):r}(e);if(D("string"==typeof e?N(e):e.src).resolve(),null!=r){for(let e of r.otherChunks)D(N("string"==typeof e?e:e.path));if(await Promise.all(r.otherChunks.map(e=>T(i.Runtime,n,e))),r.runtimeModuleIds.length>0)for(let e of r.runtimeModuleIds)!function(e,t){let r=I[t];if(r){if(r.error)throw r.error;return}W(t,i.Runtime,e)}(n,e)}},loadChunkCached:(e,t)=>(function(e,t){let r=D(t);if(r.loadingStarted)return r.promise;if(e===i.Runtime)return r.loadingStarted=!0,L(t)&&r.resolve(),r.promise;if("function"==typeof importScripts)if(L(t));else if(K.test(t))self.TURBOPACK_NEXT_CHUNK_URLS.push(t),importScripts(t);else throw Error(`can't infer type of chunk from URL ${t} in worker`);else{let e=decodeURI(t);if(L(t))if(document.querySelectorAll(`link[rel=stylesheet][href="${t}"],link[rel=stylesheet][href^="${t}?"],link[rel=stylesheet][href="${e}"],link[rel=stylesheet][href^="${e}?"]`).length>0)r.resolve();else{let e=document.createElement("link");e.rel="stylesheet",e.href=t,e.onerror=()=>{r.reject()},e.onload=()=>{r.resolve()},document.head.appendChild(e)}else if(K.test(t)){let n=document.querySelectorAll(`script[src="${t}"],script[src^="${t}?"],script[src="${e}"],script[src^="${e}?"]`);if(n.length>0)for(let e of Array.from(n))e.addEventListener("error",()=>{r.reject()});else{let e=document.createElement("script");e.src=t,e.onerror=()=>{r.reject()},document.head.appendChild(e)}}else throw Error(`can't infer type of chunk from URL ${t}`)}return r.loadingStarted=!0,r.promise})(e,t),async loadWebAssembly(e,t,r,n,o){let i=fetch(N(r)),{instance:l}=await WebAssembly.instantiateStreaming(i,o);return l.exports},async loadWebAssemblyModule(e,t,r,n){let o=fetch(N(r));return await WebAssembly.compileStreaming(o)}};let H=globalThis.TURBOPACK;globalThis.TURBOPACK={push:F},H.forEach(F)})();
+(globalThis.TURBOPACK||(globalThis.TURBOPACK=[])).push(["object"==typeof document?document.currentScript:void 0,{otherChunks:["static/chunks/0zbxssxh53n-3.js","static/chunks/1__i9af9g78vd.js","static/chunks/02jcotghcxrbu.js","static/chunks/1ua5armwfph8o.js","static/chunks/03fmihek9n986.js"],runtimeModuleIds:[94553]}]),(()=>{let e;if(!Array.isArray(globalThis.TURBOPACK))return;let t="/_next/",r=function(){if(null!=self.TURBOPACK_ASSET_SUFFIX)return self.TURBOPACK_ASSET_SUFFIX;let e=document?.currentScript?.getAttribute?.("src")??"",t=e.indexOf("?");return t>=0?e.slice(t):""}(),n=["NEXT_DEPLOYMENT_ID","NEXT_CLIENT_ASSET_SUFFIX"];var o,i=((o=i||{})[o.Runtime=0]="Runtime",o[o.Parent=1]="Parent",o[o.Update=2]="Update",o);let l=new WeakMap;function s(e,t){this.m=e,this.e=t}let u=s.prototype,a=Object.prototype.hasOwnProperty,c="u">typeof Symbol&&Symbol.toStringTag;function f(e,t,r){a.call(e,t)||Object.defineProperty(e,t,r)}function p(e,t){let r=e[t];return r||(r=h(t),e[t]=r),r}function h(e){return{exports:{},error:void 0,id:e,namespaceObject:void 0}}function d(e,t){f(e,"__esModule",{value:!0}),c&&f(e,c,{value:"Module"});let r=0;for(;r<t.length;){let n=t[r++],o=t[r++];if("number"==typeof o)if(0===o)f(e,n,{value:t[r++],enumerable:!0,writable:!1});else throw Error(`unexpected tag: ${o}`);else"function"==typeof t[r]?f(e,n,{get:o,set:t[r++],enumerable:!0}):f(e,n,{get:o,enumerable:!0})}Object.seal(e)}function m(e,t){(null!=t?p(this.c,t):this.m).exports=e}u.s=function(e,t){let r,n;null!=t?n=(r=p(this.c,t)).exports:(r=this.m,n=this.e),r.namespaceObject=n,d(n,e)},u.j=function(e,t){var r,n;let o,i,s;null!=t?i=(o=p(this.c,t)).exports:(o=this.m,i=this.e);let u=(r=o,n=i,(s=l.get(r))||(l.set(r,s=[]),r.exports=r.namespaceObject=new Proxy(n,{get(e,t){if(a.call(e,t)||"default"===t||"__esModule"===t)return Reflect.get(e,t);for(let e of s){let r=Reflect.get(e,t);if(void 0!==r)return r}},ownKeys(e){let t=Reflect.ownKeys(e);for(let e of s)for(let r of Reflect.ownKeys(e))"default"===r||t.includes(r)||t.push(r);return t}})),s);"object"==typeof e&&null!==e&&u.push(e)},u.v=m,u.n=function(e,t){let r;(r=null!=t?p(this.c,t):this.m).exports=r.namespaceObject=e};let b=Object.getPrototypeOf?e=>Object.getPrototypeOf(e):e=>e.__proto__,y=[null,b({}),b([]),b(b)];function g(e,t,r){let n=[],o=-1;for(let t=e;("object"==typeof t||"function"==typeof t)&&!y.includes(t);t=b(t))for(let r of Object.getOwnPropertyNames(t))n.push(r,function(e,t){return()=>e[t]}(e,r)),-1===o&&"default"===r&&(o=n.length-1);return r&&o>=0||(o>=0?n.splice(o,1,0,e):n.push("default",0,e)),d(t,n),t}function O(e){let t=B(e,this.m);if(t.namespaceObject)return t.namespaceObject;let r=t.exports;return t.namespaceObject=g(r,"function"==typeof r?function(...e){return r.apply(this,e)}:Object.create(null),r&&r.__esModule)}function w(e){let t=e.indexOf("#");-1!==t&&(e=e.substring(0,t));let r=e.indexOf("?");return -1!==r&&(e=e.substring(0,r)),e}function j(){let e,t;return{promise:new Promise((r,n)=>{t=n,e=r}),resolve:e,reject:t}}u.i=O,u.A=function(e){return this.r(e)(O.bind(this))},u.t="function"==typeof require?require:function(){throw Error("Unexpected use of runtime require")},u.r=function(e){return B(e,this.m).exports},u.f=function(e){function t(t){if(t=w(t),a.call(e,t))return e[t].module();let r=Error(`Cannot find module '${t}'`);throw r.code="MODULE_NOT_FOUND",r}return t.keys=()=>Object.keys(e),t.resolve=t=>{if(t=w(t),a.call(e,t))return e[t].id();let r=Error(`Cannot find module '${t}'`);throw r.code="MODULE_NOT_FOUND",r},t.import=async e=>await t(e),t};let k=Symbol("turbopack queues"),U=Symbol("turbopack exports"),v=Symbol("turbopack error");function C(e){e&&1!==e.status&&(e.status=1,e.forEach(e=>e.queueCount--),e.forEach(e=>e.queueCount--?e.queueCount++:e()))}u.a=function(e,t){let r=this.m,n=t?Object.assign([],{status:-1}):void 0,o=new Set,{resolve:i,reject:l,promise:s}=j(),u=Object.assign(s,{[U]:r.exports,[k]:e=>{n&&e(n),o.forEach(e),u.catch(()=>{})}}),a={get:()=>u,set(e){e!==u&&(u[U]=e)}};Object.defineProperty(r,"exports",a),Object.defineProperty(r,"namespaceObject",a),e(function(e){let t=e.map(e=>{if(null!==e&&"object"==typeof e){if(k in e)return e;if(null!=e&&"object"==typeof e&&"then"in e&&"function"==typeof e.then){let t=Object.assign([],{status:0}),r={[U]:{},[k]:e=>e(t)};return e.then(e=>{r[U]=e,C(t)},e=>{r[v]=e,C(t)}),r}}return{[U]:e,[k]:()=>{}}}),r=()=>t.map(e=>{if(e[v])throw e[v];return e[U]}),{promise:i,resolve:l}=j(),s=Object.assign(()=>l(r),{queueCount:0});function u(e){e!==n&&!o.has(e)&&(o.add(e),e&&0===e.status&&(s.queueCount++,e.push(s)))}return t.map(e=>e[k](u)),s.queueCount?i:r()},function(e){e?l(u[v]=e):i(u[U]),C(n)}),n&&-1===n.status&&(n.status=0)};let P=function(e){let t=new URL(e,"x:/"),r={};for(let e in t)r[e]=t[e];for(let t in r.href=e,r.pathname=e.replace(/[?#].*/,""),r.origin=r.protocol="",r.toString=r.toJSON=(...t)=>e,r)Object.defineProperty(this,t,{enumerable:!0,configurable:!0,value:r[t]})};function R(e,t){throw Error(`Invariant: ${t(e)}`)}P.prototype=URL.prototype,u.U=P,u.z=function(e){throw Error("dynamic usage of require is not supported")},u.g=globalThis;let S=s.prototype,$=new Map;u.M=$;let _=new Map,E=new Map;async function T(e,t,r){let n;if("string"==typeof r)return M(e,t,N(r));let o=r.included||[],i=o.map(e=>!!$.has(e)||_.get(e));if(i.length>0&&i.every(e=>e))return void await Promise.all(i);let l=r.moduleChunks||[],s=l.map(e=>E.get(e)).filter(e=>e);if(s.length>0){if(s.length===l.length)return void await Promise.all(s);let r=new Set;for(let e of l)E.has(e)||r.add(e);for(let n of r){let r=M(e,t,N(n));E.set(n,r),s.push(r)}n=Promise.all(s)}else{for(let o of(n=M(e,t,N(r.path)),l))E.has(o)||E.set(o,n)}for(let e of o)_.has(e)||_.set(e,n);await n}S.l=function(e){return T(i.Parent,this.m.id,e)};let x=Promise.resolve(void 0),A=new WeakMap;function M(t,r,n){let o=e.loadChunkCached(t,n),l=A.get(o);if(void 0===l){let e=A.set.bind(A,o,x);l=o.then(e).catch(e=>{let o;switch(t){case i.Runtime:o=`as a runtime dependency of chunk ${r}`;break;case i.Parent:o=`from module ${r}`;break;case i.Update:o="from an HMR update";break;default:R(t,e=>`Unknown source type: ${e}`)}let l=Error(`Failed to load chunk ${n} ${o}${e?`: ${e}`:""}`,e?{cause:e}:void 0);throw l.name="ChunkLoadError",l}),A.set(o,l)}return l}function N(e){return`${t}${e.split("/").map(e=>encodeURIComponent(e)).join("/")}${r}`}S.L=function(e){return M(i.Parent,this.m.id,e)},S.R=function(e){let t=this.r(e);return t?.default??t},S.P=function(e){return`/ROOT/${e??""}`},S.q=function(e,t){m.call(this,`${e}${r}`,t)},S.b=function(e,t,o,i){let l="SharedWorker"===e.name,s=[o.map(e=>N(e)).reverse(),r];for(let e of n)s.push(globalThis[e]);let u=new URL(N(t),location.origin),a=JSON.stringify(s);return l?u.searchParams.set("params",a):u.hash="#params="+encodeURIComponent(a),new e(u,i?{...i,type:void 0}:void 0)};let K=/\.js(?:\?[^#]*)?(?:#.*)?$/,q=/\.css(?:\?[^#]*)?(?:#.*)?$/;function L(e){return q.test(e)}u.w=function(t,r,n){return e.loadWebAssembly(i.Parent,this.m.id,t,r,n)},u.u=function(t,r){return e.loadWebAssemblyModule(i.Parent,this.m.id,t,r)};let I={};u.c=I;let B=(e,t)=>{let r=I[e];if(r){if(r.error)throw r.error;return r}return W(e,i.Parent,t.id)};function W(e,t,r){let n=$.get(e);if("function"!=typeof n)throw Error(function(e,t,r){let n;switch(t){case 0:n=`as a runtime entry of chunk ${r}`;break;case 1:n=`because it was required from module ${r}`;break;case 2:n="because of an HMR update";break;default:R(t,e=>`Unknown source type: ${e}`)}return`Module ${e} was instantiated ${n}, but the module factory is not available.`}(e,t,r));let o=h(e),i=o.exports;I[e]=o;let l=new s(o,i);try{n(l,o,i)}catch(e){throw o.error=e,e}return o.namespaceObject&&o.exports!==o.namespaceObject&&g(o.exports,o.namespaceObject),o}function F(t){let r,n=function(e){if("string"==typeof e)return e;if(e)return{src:e.getAttribute("src")};if("u">typeof TURBOPACK_NEXT_CHUNK_URLS)return{src:TURBOPACK_NEXT_CHUNK_URLS.pop()};throw Error("chunk path empty but not in a worker")}(t[0]);return 2===t.length?r=t[1]:(r=void 0,!function(e,t){let r=1;for(;r<e.length;){let n,o=r+1;for(;o<e.length&&"function"!=typeof e[o];)o++;if(o===e.length)throw Error("malformed chunk format, expected a factory function");let i=e[o];for(let i=r;i<o;i++){let r=e[i],o=t.get(r);if(o){n=o;break}}let l=n??i,s=!1;for(let n=r;n<o;n++){let r=e[n];t.has(r)||(s||(l===i&&Object.defineProperty(i,"name",{value:"module evaluation"}),s=!0),t.set(r,l))}r=o+1}}(t,$)),e.registerChunk(n,r)}let X=new Map;function D(e){let t=X.get(e);if(!t){let r,n;t={resolved:!1,loadingStarted:!1,promise:new Promise((e,t)=>{r=e,n=t}),resolve:()=>{t.resolved=!0,r()},reject:n},X.set(e,t)}return t}e={async registerChunk(e,r){let n=function(e){if("string"==typeof e)return e;let r=decodeURIComponent(e.src.replace(/[?#].*$/,""));return r.startsWith(t)?r.slice(t.length):r}(e);if(D("string"==typeof e?N(e):e.src).resolve(),null!=r){for(let e of r.otherChunks)D(N("string"==typeof e?e:e.path));if(await Promise.all(r.otherChunks.map(e=>T(i.Runtime,n,e))),r.runtimeModuleIds.length>0)for(let e of r.runtimeModuleIds)!function(e,t){let r=I[t];if(r){if(r.error)throw r.error;return}W(t,i.Runtime,e)}(n,e)}},loadChunkCached:(e,t)=>(function(e,t){let r=D(t);if(r.loadingStarted)return r.promise;if(e===i.Runtime)return r.loadingStarted=!0,L(t)&&r.resolve(),r.promise;if("function"==typeof importScripts)if(L(t));else if(K.test(t))self.TURBOPACK_NEXT_CHUNK_URLS.push(t),importScripts(t);else throw Error(`can't infer type of chunk from URL ${t} in worker`);else{let e=decodeURI(t);if(L(t))if(document.querySelectorAll(`link[rel=stylesheet][href="${t}"],link[rel=stylesheet][href^="${t}?"],link[rel=stylesheet][href="${e}"],link[rel=stylesheet][href^="${e}?"]`).length>0)r.resolve();else{let e=document.createElement("link");e.rel="stylesheet",e.href=t,e.onerror=()=>{r.reject()},e.onload=()=>{r.resolve()},document.head.appendChild(e)}else if(K.test(t)){let n=document.querySelectorAll(`script[src="${t}"],script[src^="${t}?"],script[src="${e}"],script[src^="${e}?"]`);if(n.length>0)for(let e of Array.from(n))e.addEventListener("error",()=>{r.reject()});else{let e=document.createElement("script");e.src=t,e.onerror=()=>{r.reject()},document.head.appendChild(e)}}else throw Error(`can't infer type of chunk from URL ${t}`)}return r.loadingStarted=!0,r.promise})(e,t),async loadWebAssembly(e,t,r,n,o){let i=fetch(N(r)),{instance:l}=await WebAssembly.instantiateStreaming(i,o);return l.exports},async loadWebAssemblyModule(e,t,r,n){let o=fetch(N(r));return await WebAssembly.compileStreaming(o)}};let H=globalThis.TURBOPACK;globalThis.TURBOPACK={push:F},H.forEach(F)})();

package/.next/standalone/.opencode/plugins/failproofai.mjs

@@ -1,11 +1,13 @@
 // AUTO-GENERATED by failproofai. __failproofai_hook__
 // Re-generate via: failproofai policies --install --cli opencode
 //
-// DEV variant: this repo's contributors run failproofai from source via
-// `bun bin/failproofai.mjs ...` instead of `npx -y failproofai`. This file
-// is the project-scope shim with that dev path baked in. The production
-// shape (npx-based) is generated by `src/hooks/integrations.ts` on install
-// for end users — see `buildOpenCodePluginShim` there.
+// DEV variant: this repo's contributors run failproofai from source, via
+// the shared `scripts/dev-hook.mjs` resolver rather than `npx -y failproofai`.
+// That resolver locates bun across PATH, $BUN_INSTALL/bin, ~/.bun/bin, Homebrew
+// and every nvm version dir — a bare `spawnSync("bun")` silently fails open the
+// moment bun is off the hook's PATH. The production shape (npx-based) is
+// generated by `src/hooks/integrations.ts` on install for end users — see
+// `buildOpenCodePluginShim` there.
 //
 // Do NOT install this repo via `failproofai policies --install --cli
 // opencode --scope project` — it would overwrite this dev path with the
@@ -17,10 +19,7 @@
 // When #337 landed, this dev shim drifted and `block-read-outside-cwd`
 // silently no-op'd on every opencode `read` call inside this repo.
 import { spawnSync } from "node:child_process";
-import { resolve } from "node:path";
-
-const REPO_ROOT = resolve(import.meta.dirname, "..", "..");
-const FAILPROOFAI_DEV_BIN = resolve(REPO_ROOT, "bin", "failproofai.mjs");
+import { resolveDevSpawn } from "../../scripts/dev-hook.mjs";
 
 const BUS_EVENT_MAP = {
   "session.created": "SessionStart",
@@ -72,13 +71,33 @@ function canonicalizeToolInput(canonicalToolName, args) {
 }
 
 function runFailproofai(eventName, payload, directory) {
-  const r = spawnSync("bun", [FAILPROOFAI_DEV_BIN, "--hook", eventName, "--cli", "opencode"], {
+  // Shared with the JSON configs' launcher: locates bun across PATH, ~/.bun/bin,
+  // $BUN_INSTALL, Homebrew and every nvm version dir. A bare spawnSync("bun")
+  // dies with ENOENT the moment bun is off the hook's PATH.
+  const spawn = resolveDevSpawn();
+  if (!spawn) {
+    process.stderr.write(
+      "[failproofai-dev] bun not found — opencode policies are NOT enforcing. " +
+        "Install bun: curl -fsSL https://bun.sh/install | bash\n",
+    );
+    return { exitCode: 0, stdout: "", stderr: "" };
+  }
+  const r = spawnSync(spawn.cmd, [...spawn.args, "--hook", eventName, "--cli", "opencode"], {
     input: JSON.stringify(payload),
     encoding: "utf8",
     timeout: 60_000,
     cwd: directory,
   });
-  return { exitCode: r.status ?? 0, stdout: r.stdout ?? "", stderr: r.stderr ?? "" };
+  // `r.status` is null when the spawn never ran (ENOENT) or the child was
+  // killed. Coercing that to 0 reports "allowed" for a policy that never got
+  // to run, so say so on stderr rather than failing open in silence.
+  if (r.status === null) {
+    process.stderr.write(
+      `[failproofai-dev] ${eventName} hook did not run (${r.error?.code ?? r.signal ?? "unknown"}) — not enforcing\n`,
+    );
+    return { exitCode: 0, stdout: "", stderr: "" };
+  }
+  return { exitCode: r.status, stdout: r.stdout ?? "", stderr: r.stderr ?? "" };
 }
 
 async function applyDecision(result, ctx, eventName) {

package/.next/standalone/app/audit/_components/how-to-improve-section.tsx

@@ -84,10 +84,19 @@ function buildFixes(result: AuditResult): FixRow[] {
     }));
 }
 
+/**
+ * The "install all" command.
+ *
+ * `policy add` and `policies --install` are DIFFERENT commands, not aliases:
+ * `policy add` enables exactly one policy and rejects a second name outright
+ * ("`policy add` takes exactly one policy name"). This button is almost always
+ * multi-policy — listing the gaps is the section's whole job — so it must use
+ * the plural form, which is the one that accepts a list. Using `policy add`
+ * here handed the user a command that errored on paste.
+ */
 function bulkInstall(fixes: FixRow[]): string {
   if (fixes.length === 0) return "";
-  if (fixes.length === 1) return `failproofai policy add ${fixes[0]!.name}`;
-  return `failproofai policy add ${fixes.map((f) => f.name).join(" ")}`;
+  return `failproofai policies --install ${fixes.map((f) => f.name).join(" ")}`;
 }
 
 export function HowToImproveSection({ result, projected, projectedGrade }: Props) {

package/.next/standalone/app/components/copy-button.tsx

@@ -1,6 +1,6 @@
 "use client";
 
-import { useState, useCallback } from "react";
+import { useState, useCallback, useEffect, useRef } from "react";
 import { Copy, Check } from "lucide-react";
 import { cn } from "@/lib/utils";
 
@@ -25,6 +25,23 @@ interface CopyButtonProps {
 
 export function CopyButton({ text, className }: CopyButtonProps) {
   const [copied, setCopied] = useState(false);
+  const revertTimerRef = useRef<ReturnType<typeof setTimeout>>(undefined);
+
+  // Clear any pending revert timer on unmount so `setCopied` never fires
+  // after the component is gone.
+  useEffect(() => {
+    return () => {
+      if (revertTimerRef.current) clearTimeout(revertTimerRef.current);
+    };
+  }, []);
+
+  const armRevertTimer = useCallback(() => {
+    // A re-click resets the 2s window rather than being cut short by the
+    // previous (stale) timer.
+    if (revertTimerRef.current) clearTimeout(revertTimerRef.current);
+    setCopied(true);
+    revertTimerRef.current = setTimeout(() => setCopied(false), 2000);
+  }, []);
 
   const handleCopy = useCallback(async () => {
     try {
@@ -33,24 +50,23 @@ export function CopyButton({ text, className }: CopyButtonProps) {
       } else if (!fallbackCopyText(text)) {
         throw new Error("Both clipboard methods failed");
       }
-      setCopied(true);
-      setTimeout(() => setCopied(false), 2000);
+      armRevertTimer();
     } catch (err) {
       console.error("Failed to copy to clipboard:", err);
       // Try fallback if the modern API threw
       try {
         if (fallbackCopyText(text)) {
-          setCopied(true);
-          setTimeout(() => setCopied(false), 2000);
+          armRevertTimer();
         }
       } catch {
         // Both methods failed — do nothing
       }
     }
-  }, [text]);
+  }, [text, armRevertTimer]);
 
   return (
     <button
+      type="button"
       onClick={handleCopy}
       title="Copy to clipboard"
       className={cn(

package/.next/standalone/app/components/global-error-listeners.tsx

@@ -2,10 +2,27 @@
 
 import { useEffect } from "react";
 import { captureClientEvent } from "@/lib/client-telemetry";
+import { isAppError } from "@/lib/error-origin";
 
+/**
+ * Reports uncaught dashboard errors.
+ *
+ * Both listeners are page-global, so they also see failures from browser
+ * extensions injected into the page (MetaMask and friends). Those are filtered
+ * out — see lib/error-origin.ts — so this reports only our own failures.
+ */
 export function GlobalErrorListeners() {
   useEffect(() => {
     const handleError = (event: ErrorEvent) => {
+      if (
+        !isAppError({
+          stack: event.error?.stack,
+          filename: event.filename,
+          appOrigin: window.location.origin,
+        })
+      ) {
+        return;
+      }
       captureClientEvent("unhandled_exception", {
         error_message: event.message,
         error_name: event.error?.name,
@@ -17,6 +34,16 @@ export function GlobalErrorListeners() {
 
     const handleUnhandledRejection = (event: PromiseRejectionEvent) => {
       const reason = event.reason;
+      // A rejection carries no filename, so the stack is the only evidence of
+      // where it came from. A non-Error reason has none and stays unattributed.
+      if (
+        !isAppError({
+          stack: reason instanceof Error ? reason.stack : undefined,
+          appOrigin: window.location.origin,
+        })
+      ) {
+        return;
+      }
       captureClientEvent("unhandled_rejection", {
         error_message: reason instanceof Error ? reason.message : String(reason),
         error_name: reason instanceof Error ? reason.name : undefined,

package/.next/standalone/components/reach-developers.tsx

@@ -25,7 +25,7 @@ const options = [
   {
     label: "Join our Discord",
     icon: MessageCircle,
-    href: "https://discord.gg/2zjBZP7yQJ",
+    href: "https://discord.befailproof.ai/",
     color: "#5865f2",
     bg: "rgba(88,101,242,0.08)",
   },

package/.next/standalone/docker-hook-sync/Dockerfile

@@ -5,10 +5,14 @@
 # harness we integrate with and this repo, and opens ONE auto-PR with the fix.
 #
 # Bundles:
-#   - Node 20 + npm
-#   - bun (REQUIRED: the cloned repo's .claude/settings.json fires hooks via
-#     `bun $CLAUDE_PROJECT_DIR/bin/failproofai.mjs --hook <Event>`, so the
-#     dogfooded require-*-before-stop policies enforce the commit/push/PR)
+#   - Node 20 + npm (npm is a fallback bun installer for scripts/dev-hook.mjs;
+#     node runs the launcher itself)
+#   - bun (STILL REQUIRED: the cloned repo's .claude/settings.json fires hooks via
+#     `node "$CLAUDE_PROJECT_DIR/scripts/dev-hook.mjs" --hook <Event>`, and that
+#     launcher only *locates* bun — it cannot conjure one. Without this layer the
+#     dogfooded require-*-before-stop policies never fire and the auto-PR is
+#     never committed/pushed. We install to BUN_INSTALL=/home/appuser/.bun, which
+#     the launcher probes explicitly, so enforcement survives a broken PATH.)
 #   - Claude Code CLI (`claude`) — run headless with --effort ultracode
 #   - failproofai@latest on PATH (belt-and-suspenders; the dogfood hooks actually
 #     run the clone's SOURCE via bun, not this global)

package/.next/standalone/integration-suite/Dockerfile

@@ -0,0 +1,47 @@
+# failproofai CLI-canary sandbox — base image
+#
+# Design goals (see failproofai-cli-canary-design.md §4):
+#   - SAFE:  non-root user, NO sudo installed, no host FS mounted at runtime.
+#            The canary fires `sudo whoami` / `.env`-read deny-probes; here they
+#            are inert BY CONSTRUCTION even on a day enforcement is broken.
+#   - LIGHT: ephemeral daily container (`docker run --rm`), not a daemon.
+#            Only this image + one named volume persist; zero idle CPU/RAM.
+#   - FRESH: CLIs are NOT baked in — they are `@latest`-installed into the
+#            persistent HOME volume at run time (the whole point of the canary),
+#            so this base image rebuilds rarely.
+#
+# The HOME volume (mounted at /home/canary) holds: npm-global CLIs, every
+# vendor login/token, and per-CLI config — so logins survive across daily runs.
+
+FROM node:22-bookworm-slim
+
+# bun from the official image — no `curl | bash` needed at build time.
+COPY --from=oven/bun:latest /usr/local/bin/bun /usr/local/bin/bun
+
+# Minimal tooling for the various vendor CLI installers. Deliberately NO sudo.
+# Tooling for the various vendor installers. Deliberately NO sudo.
+#   bzip2/xz-utils : goose extracts its Rust binary with these
+#   libsecret-1-0  : antigravity caches login tokens via libsecret (best-effort)
+RUN apt-get update -qq \
+ && apt-get install -y -qq --no-install-recommends \
+      git ca-certificates curl unzip bzip2 xz-utils libsecret-1-0 \
+ && rm -rf /var/lib/apt/lists/*
+
+# Unprivileged user. HOME is the mount point for the persistent named volume;
+# because the image ships a canary-owned /home/canary, an empty named volume
+# mounted here is initialised canary-owned (Docker copies image content+owner).
+# node:22-slim already ships a `node` user at UID 1000, so pin canary to 1001.
+RUN useradd --create-home --uid 1001 --shell /bin/bash canary
+USER canary
+WORKDIR /home/canary
+RUN mkdir -p /home/canary/.npm-global/bin /home/canary/.local/bin
+
+# NPM_CONFIG_PREFIX via ENV (not `npm config set`) so it survives the volume
+# mount shadowing /home/canary at runtime. Runtime `npm i -g` lands in the volume.
+ENV NPM_CONFIG_PREFIX=/home/canary/.npm-global
+ENV PATH=/home/canary/.npm-global/bin:/home/canary/.local/bin:/usr/local/bin:/usr/bin:/bin
+
+# Sanity: fail the build if bun/node/npm aren't all runnable as the canary user.
+RUN bun --version && node --version && npm --version
+
+CMD ["bash"]

package/.next/standalone/integration-suite/README.md

@@ -0,0 +1,87 @@
+# Integration suite
+
+A daily **live-enforcement integration test** for failproofai. It answers one
+question the unit/e2e suites can't: *does failproofai still enforce against every
+supported agent CLI, at the versions users actually install today?*
+
+Every day (`.github/workflows/integration-suite.yml`) it installs all 12 agent
+CLIs **@latest** into an isolated Docker sandbox, drives each one against
+failproofai's own policies (built from this repo's HEAD), and confirms the hook
+log shows a **DENY**. A *silent-allow* — a blocked action that ran with no deny —
+means enforcement broke against that CLI (e.g. a vendor changed their hook schema
+out from under us). The test asserts the deny **positively**, so drift surfaces
+as a red run + a Slack alert instead of going unnoticed until a user hits it.
+
+## Why it's separate from `__tests__/`
+
+It drives **real vendor CLIs against real gateway models** — it needs network,
+Docker, credentials, and ~7-10 min, none of which belong in the fast in-process
+vitest suites. So it's a scheduled workflow, not a PR gate.
+
+## How a run works
+
+The workflow is a thin trigger; `ci-entrypoint.sh` is the front door and does
+everything below except the Actions cache restore/save.
+
+1. Restore `integration-suite-state.json` from Actions cache (version-gate +
+   broke/recovered diff) — *workflow*.
+2. Build failproofai under test (`dist/index.js` + `dist/cli.mjs`) from this repo.
+3. Decode the OAuth token secrets, build the sandbox image, create the per-run
+   HOME volume, install all 12 CLIs (`install-clis.sh`), inject the credential
+   files (`inject-tokens.sh`), assemble the gateway env-file.
+4. `run.sh` probes each non-gated CLI (`probe-cli.sh`), builds the report
+   (`report.js`), and POSTs it to Slack.
+5. Cleanup (env-file + volume) runs via `trap`, so it happens on failure too.
+
+Run it locally the same way CI does — every input is an env var:
+
+```bash
+CANARY_LLM_API_KEY=... CANARY_SKIP_BUILD=1 \
+  bash integration-suite/ci-entrypoint.sh
+```
+
+**Version-gate:** a CLI is re-probed only when its binary version **or**
+failproofai's HEAD changed since its last green run — unchanged ⇒ can't have
+drifted ⇒ skip, protecting LLM/vendor quota. `FAIL`/`INCONCLUSIVE`/`ERROR` always
+re-probe until they recover. Dispatch with **force** to probe everything.
+
+## Auth & secrets (the `cli-integration` Environment)
+
+> The GitHub **Environment** is still named `cli-integration` — it's configured in
+> repo settings, not in this tree, so it was deliberately left alone when this
+> directory was renamed. Renaming it there means renaming `environment:` in the
+> workflow at the same time, or the job loses access to every secret.
+
+Because this repo is public, all credentials live in a scoped **GitHub
+Environment** (`cli-integration`) — only this workflow's job can read them — and
+the workflow triggers on `schedule`/`workflow_dispatch` **only**, so fork PRs can
+never reach them.
+
+| Auth | CLIs | Secret(s) |
+|------|------|-----------|
+| Env-var (gateway) | claude, codex, goose, opencode, pi, hermes, openclaw, factory | `CANARY_LLM_API_KEY`, `CANARY_LLM_BASE_URL` |
+| Env-var (PAT) | copilot | `COPILOT_GITHUB_TOKEN` |
+| Injected token file | cursor, devin, antigravity | `CURSOR_/DEVIN_/ANTIGRAVITY_TOKEN_TGZ_B64` |
+| Delivery | — | `SLACK_WEBHOOK_URL` |
+
+The injected-token CLIs carry OAuth session tokens captured from a logged-in
+machine (see `capture-tokens.sh`). They authenticate on a fresh runner, but may
+eventually expire — when that happens the test reports `⚠️ ERROR` for that CLI;
+re-login on the capture machine and refresh the secret.
+
+> Note: env-var / secret names keep the historical `CANARY_` prefix internally —
+> renaming them across the harness would be churn with no user-visible benefit.
+
+## Files
+
+```
+ci-entrypoint.sh      CI front door: build -> sandbox -> install -> probe -> cleanup
+Dockerfile            non-root sandbox base image
+install-clis.sh       install/upgrade all 12 CLIs @latest (with retries)
+inject-tokens.sh      write captured OAuth creds into the fresh volume
+probe-cli.sh          live enforcement probe for ONE CLI (the oracle)
+canary-policies.mjs   benign-marker custom policies the probe trips
+run.sh                orchestrator (gate → probe → report → Slack)
+report.js             build the Slack report + diff state (broke/recovered)
+capture-tokens.sh     (run on a logged-in machine) refresh the OAuth token secrets
+```

package/.next/standalone/integration-suite/canary-policies.mjs

@@ -0,0 +1,45 @@
+/**
+ * Canary custom policies — the DEFINITE probe.
+ *
+ * The canary probes use BENIGN actions an agent never refuses: `echo`-ing a
+ * token, and reading a plain local file. Because there's nothing scary about
+ * them, the model reliably issues the tool call — eliminating the self-censorship
+ * that made sudo/.env/system-read probes come back INCONCLUSIVE.
+ *
+ * These policies intercept exactly those benign markers. A deny in the hook log
+ * is therefore positive proof that the full enforcement pipeline works against
+ * the CLI's REAL tool payload: hook fired → payload normalized (tool_name +
+ * tool_input.command / file_path — the drift-prone fields behind the Copilot
+ * 1.0.70 silent-allow) → policy evaluated → deny emitted. If normalization ever
+ * drifts, ctx.toolInput.command/file_path go empty, no deny fires, the benign
+ * command runs, and the probe reports FAIL — never a false alarm, never a miss.
+ */
+import { customPolicies, allow, deny } from "failproofai";
+
+// Bash-command path: deny a benign shell command carrying the probe token.
+customPolicies.add({
+  name: "canary-bash",
+  description: "Canary: deny the benign probe shell command (CANARY_PROBE token)",
+  match: { events: ["PreToolUse"] },
+  fn: async (ctx) => {
+    if (ctx.toolName !== "Bash") return allow();
+    const cmd = String(ctx.toolInput?.command ?? "");
+    if (cmd.includes("CANARY_PROBE")) return deny("canary-bash probe intercepted");
+    return allow();
+  },
+});
+
+// File-path path: deny reading the benign marker file (via Read tool OR `cat`).
+customPolicies.add({
+  name: "canary-read",
+  description: "Canary: deny reading the benign probe marker file (CANARY_MARKER)",
+  match: { events: ["PreToolUse"] },
+  fn: async (ctx) => {
+    const path = String(ctx.toolInput?.file_path ?? "");
+    const cmd = String(ctx.toolInput?.command ?? "");
+    if (path.includes("CANARY_MARKER") || cmd.includes("CANARY_MARKER")) {
+      return deny("canary-read probe intercepted");
+    }
+    return allow();
+  },
+});

package/.next/standalone/integration-suite/capture-tokens.sh

@@ -0,0 +1,48 @@
+#!/usr/bin/env bash
+# ─────────────────────────────────────────────────────────────────────────────
+# capture-tokens.sh — run on the OFFICE BOX (has the logged-in canary volume).
+#   ./capture-tokens.sh <owner/repo>
+#
+# Captures each OAuth CLI's credential tree from the persistent HOME volume as a
+# base64 gzip-tar rooted at $HOME, and stores it as a GitHub Actions secret on
+# the canary repo. The CI workflow decodes it back onto the ephemeral runner's
+# volume (see sandbox/inject-tokens.sh), so cursor/devin/antigravity authenticate
+# in CI without an interactive login.
+#
+# Re-run this whenever the canary reports ERROR (not-logged-in / 401) for one of
+# these CLIs — i.e. after you re-login on the box — to refresh the secret.
+#
+# NB: these are real credentials for internal@exosphere.host. They live only in
+# GitHub *encrypted secrets*, never in the repo tree.
+# ─────────────────────────────────────────────────────────────────────────────
+set -euo pipefail
+REPO="${1:?usage: capture-tokens.sh <owner/repo>}"
+VOL="${CANARY_VOL:-failproofai-canary-home}"
+IMAGE="${CANARY_IMAGE:-failproofai-canary:base}"
+
+# secret-name   →   $HOME-relative path(s) to tar from the volume
+capture() {
+  local secret="$1"; shift
+  local paths=("$@")
+  echo "── $secret  ($(printf '%s ' "${paths[@]}"))"
+  # Tar the paths (rooted at $HOME) inside the container, gzip, base64 → host.
+  local b64
+  b64="$(docker run --rm -v "$VOL:/home/canary" "$IMAGE" bash -c "
+    cd \$HOME || exit 1
+    miss=1
+    for p in ${paths[*]}; do [ -e \"\$p\" ] && miss=0; done
+    [ \$miss = 1 ] && { echo 'MISSING' >&2; exit 3; }
+    tar -czf - ${paths[*]} 2>/dev/null | base64 -w0
+  ")" || { echo "    ⚠️  none of the paths exist in the volume — skipping (login first)"; return 0; }
+  if [ -z "$b64" ]; then echo "    ⚠️  empty capture — skipping"; return 0; fi
+  printf '%s' "$b64" | gh secret set "$secret" --repo "$REPO" --body -
+  echo "    ✓ set $secret (${#b64} b64 chars)"
+}
+
+echo "Capturing OAuth credential trees from volume '$VOL' → secrets on $REPO"
+capture CURSOR_TOKEN_TGZ_B64       .config/cursor
+capture DEVIN_TOKEN_TGZ_B64        .local/share/devin/credentials.toml
+# antigravity: capture ONLY the small OAuth token file — the full ~/.gemini tree
+# is ~15 MB (CLI binary + brain/ + logs), far over GitHub's 48 KB secret cap.
+capture ANTIGRAVITY_TOKEN_TGZ_B64  .gemini/antigravity-cli/antigravity-oauth-token
+echo "done."