failproofai 0.0.14-beta.0 → 0.0.14-beta.2

package/dist/cli.mjs

@@ -19,7 +19,7 @@ var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
 var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
 // package.json
-var version2 = "0.0.14-beta.0";
+var version2 = "0.0.14-beta.2";
 var init_package = () => {};
 
 // src/posthog-key.ts
@@ -727,6 +727,22 @@ function readMergedHooksConfig(cwd) {
     ...llm !== undefined ? { llm } : {}
   };
 }
+function getConfigPath() {
+  return resolve(homedir2(), ".failproofai", "policies-config.json");
+}
+function readHooksConfig() {
+  const configPath = getConfigPath();
+  if (!existsSync2(configPath)) {
+    return { enabledPolicies: [] };
+  }
+  try {
+    const raw = readFileSync(configPath, "utf8");
+    return JSON.parse(raw);
+  } catch (err) {
+    hookLogWarn(`failed to parse config at ${configPath}: ${err instanceof Error ? err.message : String(err)}`);
+    return { enabledPolicies: [] };
+  }
+}
 function getConfigPathForScope(scope, cwd) {
   switch (scope) {
     case "user":
@@ -1178,28 +1194,73 @@ function blockPushMaster(ctx) {
   }
   return allow();
 }
-function rmTargetIsAllowed(cmd, allowPaths) {
-  if (allowPaths.length === 0)
+function expandHomePrefix(path2) {
+  const m = path2.match(/^(?:~|\$HOME|\$\{HOME\})(?=$|\/)/);
+  return m ? homedir3() + path2.slice(m[0].length) : path2;
+}
+function stripTrailingGlob(path2) {
+  return path2.replace(/\/\*$/, "").replace(/\/+$/, "");
+}
+function isCatastrophicTarget(token) {
+  const raw = token.replace(/^['"]|['"]$/g, "");
+  if (raw === "")
     return false;
-  const segments = cmd.split(/&&|\|\||[|;\n]/).map((s) => s.trim()).filter((s) => /\brm\b/.test(s));
-  if (segments.length === 0)
+  const homePrefix = raw.match(HOME_PREFIX_RE);
+  if (!homePrefix && /^[$`]/.test(raw))
+    return true;
+  const belowRoot = homePrefix ? raw.slice(homePrefix[0].length) : raw.startsWith("/") ? raw : null;
+  if (belowRoot === null)
     return false;
-  for (const seg of segments) {
-    const tokens = parseArgvTokens(seg);
-    const rmIdx = tokens.findIndex((t) => t === "rm");
-    if (rmIdx < 0)
-      continue;
-    const flagTokens = tokens.slice(rmIdx + 1).filter((t) => /^-[^-]/.test(t));
-    const longFlagsInSeg = tokens.slice(rmIdx + 1).filter((t) => /^--/.test(t));
-    if (!/r/i.test(flagTokens.join("")) && !longFlagsInSeg.some((f) => /^--recursive$/i.test(f)))
+  const segments = stripTrailingGlob(belowRoot).split("/").filter(Boolean);
+  if (!homePrefix && SCRATCH_ROOTS.some((r) => `/${segments.join("/")}`.startsWith(`${r}/`)))
+    return false;
+  return segments.length <= CATASTROPHIC_DEPTH;
+}
+function recursiveDeletionTargets(seg) {
+  const tokens = parseArgvTokens(seg);
+  const findIdx = tokens.findIndex((t) => FIND_CMD_RE.test(t));
+  if (findIdx >= 0) {
+    const expr = tokens.slice(findIdx + 1);
+    const execIdx = expr.findIndex((t) => FIND_EXEC_RE.test(t));
+    const deletes = expr.includes("-delete") || execIdx >= 0 && RM_CMD_RE.test(expr[execIdx + 1] ?? "");
+    if (deletes) {
+      let start = 0;
+      while (start < expr.length && FIND_GLOBAL_OPT_RE.test(expr[start])) {
+        start += expr[start] === "-D" ? 2 : 1;
+      }
+      const rest = expr.slice(start);
+      const end = rest.findIndex((t) => FIND_EXPR_START_RE.test(t));
+      return end < 0 ? rest : rest.slice(0, end);
+    }
+  }
+  const rmIdx = tokens.findIndex((t) => RM_CMD_RE.test(t));
+  if (rmIdx >= 0) {
+    const args = tokens.slice(rmIdx + 1);
+    const shortFlags = args.filter((t) => /^-[^-]/.test(t)).join("");
+    const longFlags = args.filter((t) => /^--/.test(t));
+    const recursive = /r/i.test(shortFlags) || longFlags.some((f) => /^--recursive$/i.test(f));
+    const force = /f/.test(shortFlags) || longFlags.some((f) => /^--force$/i.test(f));
+    if (recursive && force)
+      return args.filter((t) => !t.startsWith("-"));
+  }
+  return null;
+}
+function shellSegments(cmd) {
+  return cmd.split(/&&|\|\||[|;\n]/).map((s) => s.trim()).filter((s) => s !== "");
+}
+function deletionTargetIsAllowed(cmd, allowPaths) {
+  if (allowPaths.length === 0)
+    return false;
+  const normalizedAllowPaths = allowPaths.map((p) => stripTrailingGlob(expandHomePrefix(p)) || "/");
+  let sawRecursiveDelete = false;
+  for (const seg of shellSegments(cmd)) {
+    const targets = recursiveDeletionTargets(seg);
+    if (targets === null)
       continue;
-    const pathArgs = tokens.slice(rmIdx + 1).filter((t) => !t.startsWith("-"));
-    for (const target of pathArgs) {
-      const normalized = target.replace(/\/\*$/, "").replace(/\/+$/, "") || "/";
-      const covered = allowPaths.some((p) => {
-        const np = p.replace(/\/+$/, "") || "/";
-        return normalized === np || normalized.startsWith(np + "/");
-      });
+    sawRecursiveDelete = true;
+    for (const target of targets) {
+      const normalized = stripTrailingGlob(expandHomePrefix(target)) || "/";
+      const covered = normalizedAllowPaths.some((np) => normalized === np || normalized.startsWith(np + "/"));
       if (!covered) {
         const segCovered = allowPaths.some((p) => {
           const escaped = p.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
@@ -1210,35 +1271,22 @@ function rmTargetIsAllowed(cmd, allowPaths) {
       }
     }
   }
-  return true;
+  return sawRecursiveDelete;
 }
 function blockRmRf(ctx) {
   if (ctx.toolName !== "Bash")
     return allow();
   const cmd = getCommand(ctx);
-  const hasDestructivePath = parseArgvTokens(cmd).some((token) => {
-    const normalized = token.replace(/\/\*$/, "").replace(/\/+$/, "") || (token.startsWith("/") ? "/" : "");
-    return normalized === "/" || normalized === "~" || /^\/[A-Za-z_][\w.-]*$/.test(normalized);
+  const hasCatastrophicTarget = shellSegments(cmd).some((seg) => {
+    const targets = recursiveDeletionTargets(seg);
+    return targets !== null && targets.some(isCatastrophicTarget);
   });
-  if (hasDestructivePath && (/rm\s+-[^\s]*r[^\s]*f[^\s]*/.test(cmd) || /rm\s+-[^\s]*f[^\s]*r[^\s]*/.test(cmd))) {
+  if (hasCatastrophicTarget) {
     const allowPaths = ctx.params?.allowPaths ?? [];
-    if (rmTargetIsAllowed(cmd, allowPaths))
+    if (deletionTargetIsAllowed(cmd, allowPaths))
       return allow();
     return deny("Catastrophic deletion blocked");
   }
-  if (hasDestructivePath && /\brm\b/.test(cmd)) {
-    const tokens = parseArgvTokens(cmd);
-    const shortFlags = tokens.filter((t) => /^-[^-]/.test(t)).join("");
-    const longFlags = tokens.filter((t) => /^--/.test(t));
-    const hasRecursive = /r/i.test(shortFlags) || longFlags.some((f) => /^--recursive$/i.test(f));
-    const hasForce = /f/.test(shortFlags) || longFlags.some((f) => /^--force$/i.test(f));
-    if (hasRecursive && hasForce) {
-      const allowPaths = ctx.params?.allowPaths ?? [];
-      if (rmTargetIsAllowed(cmd, allowPaths))
-        return allow();
-      return deny("Catastrophic deletion blocked");
-    }
-  }
   if (/Remove-Item\s+.*-Recurse.*-Force.*(?:[A-Z]:\\(?:\s|$)|\\\*)/i.test(cmd)) {
     return deny("Catastrophic deletion blocked");
   }
@@ -1250,12 +1298,31 @@ function blockRmRf(ctx) {
 function blockForcePush(ctx) {
   if (ctx.toolName !== "Bash")
     return allow();
-  const args = extractGitPushArgs(getCommand(ctx));
-  if (args.some((a) => FORCE_PUSH_RE.test(a))) {
-    return deny("Force-pushing is blocked");
+  for (const segment of extractGitPushArgs(getCommand(ctx))) {
+    let sawEndOfOptions = false;
+    for (const token of segment.split(/\s+/)) {
+      if (token === "--") {
+        sawEndOfOptions = true;
+        continue;
+      }
+      if (sawEndOfOptions)
+        continue;
+      if (isForcePushFlag(token)) {
+        return deny("Force-pushing is blocked");
+      }
+    }
   }
   return allow();
 }
+function isForcePushFlag(token) {
+  if (token === "--force")
+    return true;
+  if (SAFE_FORCE_PREFIXES.some((prefix) => token.startsWith(prefix)))
+    return false;
+  if (token.startsWith("--force"))
+    return true;
+  return SHORT_FLAG_BUNDLE_RE.test(token);
+}
 function blockSecretsWrite(ctx) {
   if (ctx.toolName !== "Write")
     return allow();
@@ -1836,7 +1903,7 @@ function registerBuiltinPolicies(enabledNames) {
     }
   }
 }
-var isClaudeInternalPath, isClaudeSettingsFile, SHELL_OPERATORS, SHELL_METACHAR_RE, JWT_RE, API_KEY_PATTERNS, CONNECTION_STRING_RE, PRIVATE_KEY_RE, BEARER_TOKEN_RE, SQL_TOOL_RE, DESTRUCTIVE_SQL_RE, DELETE_NO_WHERE_RE, SQL_WHERE_RE, SCHEMA_ALTER_RE, PUBLISH_CMD_RE, ENV_PRINTENV_RE, ECHO_ENV_RE, EXPORT_RE, PS_ENV_VAR_RE, PS_CHILDITEM_ENV_RE, DOTNET_GETENV_RE, CMD_ECHO_ENV_RE, ENV_FILE_PATH_RE, ENV_CMD_RE, SUDO_RE, PS_ELEVATION_RE, RUNAS_RE, CURL_PIPE_SH_RE, PS_WEB_PIPE_RE, FORCE_PUSH_RE, SECRET_FILE_RE, SECRET_FILE_ID_RSA_RE, SECRET_FILE_CREDENTIALS_RE, GIT_COMMIT_MERGE_RE, FAILPROOFAI_CLI_RE, FAILPROOFAI_UNINSTALL_RE, GIT_AMEND_RE, GIT_STASH_DROP_RE, GIT_ADD_ALL_RE, NPM_GLOBAL_RE, YARN_GLOBAL_RE, PNPM_GLOBAL_RE, BUN_GLOBAL_RE, CARGO_INSTALL_RE, PIP_SYSTEM_RE, PKG_MANAGER_DETECTORS, NOHUP_RE, SCREEN_DETACH_RE, TMUX_DETACH_RE, DISOWN_RE, BACKGROUND_AMPERSAND_RE, KUBECTL_RE, TERRAFORM_RE, AWS_CLI_RE, GCLOUD_RE, AZ_CLI_RE, HELM_RE, GH_PIPELINE_RE, gitBranchCache, READ_LIKE_CMDS, TOOL_CALL_TRACKER_MAX_BYTES = 65536, SEGMENT_SPLIT_RE, BUILTIN_POLICIES;
+var isClaudeInternalPath, isClaudeSettingsFile, SHELL_OPERATORS, SHELL_METACHAR_RE, JWT_RE, API_KEY_PATTERNS, CONNECTION_STRING_RE, PRIVATE_KEY_RE, BEARER_TOKEN_RE, SQL_TOOL_RE, DESTRUCTIVE_SQL_RE, DELETE_NO_WHERE_RE, SQL_WHERE_RE, SCHEMA_ALTER_RE, PUBLISH_CMD_RE, ENV_PRINTENV_RE, ECHO_ENV_RE, EXPORT_RE, PS_ENV_VAR_RE, PS_CHILDITEM_ENV_RE, DOTNET_GETENV_RE, CMD_ECHO_ENV_RE, ENV_FILE_PATH_RE, ENV_CMD_RE, SUDO_RE, PS_ELEVATION_RE, RUNAS_RE, CURL_PIPE_SH_RE, PS_WEB_PIPE_RE, SHORT_FLAG_BUNDLE_RE, SAFE_FORCE_PREFIXES, SECRET_FILE_RE, SECRET_FILE_ID_RSA_RE, SECRET_FILE_CREDENTIALS_RE, GIT_COMMIT_MERGE_RE, FAILPROOFAI_CLI_RE, FAILPROOFAI_UNINSTALL_RE, GIT_AMEND_RE, GIT_STASH_DROP_RE, GIT_ADD_ALL_RE, NPM_GLOBAL_RE, YARN_GLOBAL_RE, PNPM_GLOBAL_RE, BUN_GLOBAL_RE, CARGO_INSTALL_RE, PIP_SYSTEM_RE, PKG_MANAGER_DETECTORS, NOHUP_RE, SCREEN_DETACH_RE, TMUX_DETACH_RE, DISOWN_RE, BACKGROUND_AMPERSAND_RE, KUBECTL_RE, TERRAFORM_RE, AWS_CLI_RE, GCLOUD_RE, AZ_CLI_RE, HELM_RE, GH_PIPELINE_RE, gitBranchCache, HOME_PREFIX_RE, RM_CMD_RE, FIND_CMD_RE, FIND_EXEC_RE, FIND_GLOBAL_OPT_RE, FIND_EXPR_START_RE, SCRATCH_ROOTS, CATASTROPHIC_DEPTH = 2, READ_LIKE_CMDS, TOOL_CALL_TRACKER_MAX_BYTES = 65536, SEGMENT_SPLIT_RE, BUILTIN_POLICIES;
 var init_builtin_policies = __esm(() => {
   init_hook_logger();
   isClaudeInternalPath = isAgentInternalPath;
@@ -1878,7 +1945,8 @@ var init_builtin_policies = __esm(() => {
   RUNAS_RE = /(?:^|;|&&|\|\|)\s*runas\s/i;
   CURL_PIPE_SH_RE = /(?:curl|wget)\s.*\|\s*(?:sh|bash|zsh|dash|ksh|csh|tcsh|fish|ash)\b/;
   PS_WEB_PIPE_RE = /(?:Invoke-WebRequest|iwr|Invoke-RestMethod|irm)\s+.*\|\s*(?:Invoke-Expression|iex)/i;
-  FORCE_PUSH_RE = /(?:--force|-f\b)/;
+  SHORT_FLAG_BUNDLE_RE = /^-[a-zA-Z]*f[a-zA-Z]*$/;
+  SAFE_FORCE_PREFIXES = ["--force-with-lease", "--force-if-includes"];
   SECRET_FILE_RE = /\.(?:pem|key)$/;
   SECRET_FILE_ID_RSA_RE = /id_rsa/;
   SECRET_FILE_CREDENTIALS_RE = /credentials/;
@@ -1919,6 +1987,13 @@ var init_builtin_policies = __esm(() => {
   HELM_RE = /(?:^|[;\n]|&&|\|\|?|&)\s*helm(?:\s|$)/;
   GH_PIPELINE_RE = /(?:^|[;\n]|&&|\|\|?|&)\s*gh\s+(?:workflow\s+(?:run|enable|disable)|run\s+(?:rerun|cancel)|pr\s+merge|release\s+(?:create|delete)|cache\s+delete|secret\s+(?:set|delete))\b/;
   gitBranchCache = new Map;
+  HOME_PREFIX_RE = /^(?:~[A-Za-z0-9_.-]*|\$HOME|\$\{HOME\})(?=$|\/)/;
+  RM_CMD_RE = /^(?:\/\S*\/)?rm$/;
+  FIND_CMD_RE = /^(?:\/\S*\/)?find$/;
+  FIND_EXEC_RE = /^-(?:exec|execdir|ok|okdir)$/;
+  FIND_GLOBAL_OPT_RE = /^-(?:[HLP]|D|O\d*)$/;
+  FIND_EXPR_START_RE = /^(?:-|\\?[(!])/;
+  SCRATCH_ROOTS = ["/tmp", "/var/tmp"];
   READ_LIKE_CMDS = /(?:^|;|&&|\|\||\|)\s*(?:ls|find|cat|head|tail|less|more|wc|file|stat|tree|du)\s/;
   SEGMENT_SPLIT_RE = /\s*(?:&&|\|\||\||;)\s*/;
   BUILTIN_POLICIES = [
@@ -3435,6 +3510,15 @@ function discoverPolicyFiles(dir) {
     return [];
   }
 }
+function findSkippedPolicyFiles(dir) {
+  if (!existsSync3(dir))
+    return [];
+  try {
+    return readdirSync(dir, { withFileTypes: true }).filter((e) => e.isFile() && LOADABLE_EXT_RE.test(e.name) && !CONVENTION_FILE_RE.test(e.name) && !e.name.endsWith(".d.ts")).map((e) => e.name).sort((a, b) => a.localeCompare(b));
+  } catch {
+    return [];
+  }
+}
 async function loadSingleFile(absPath, opts) {
   const g = globalThis;
   g[LOADING_KEY] = true;
@@ -3477,10 +3561,18 @@ async function loadCustomHooks(customPoliciesPath, opts) {
   await loadSingleFile(absPath, opts);
   return getCustomHooks();
 }
+function warnSkippedPolicyFiles(dir, scope) {
+  const skipped = findSkippedPolicyFiles(dir);
+  if (skipped.length === 0)
+    return;
+  const suggest = (n) => n.replace(/\.(js|mjs|ts)$/, "-policies.$1");
+  hookLogWarn(`${scope} policies: ${skipped.length} file(s) in ${dir} are NOT loaded — ` + `the convention only loads names ending in "policies.js|mjs|ts". ` + skipped.map((n) => `${n} → rename to ${suggest(n)}`).join("; "));
+}
 async function loadAllCustomHooks(customPoliciesPath, opts) {
   clearCustomHooks();
   const conventionSources = [];
   const projectRoot = findProjectConfigDir(opts?.sessionCwd ?? process.cwd());
+  const conventionEnabled = opts?.customPoliciesEnabled !== false;
   if (customPoliciesPath) {
     const absPath = isAbsolute(customPoliciesPath) ? customPoliciesPath : resolve4(projectRoot, customPoliciesPath);
     if (existsSync3(absPath)) {
@@ -3491,7 +3583,9 @@ async function loadAllCustomHooks(customPoliciesPath, opts) {
   }
   const hooksBeforeConvention = getCustomHooks().length;
   const projectDir = resolve4(projectRoot, ".failproofai", "policies");
-  const projectFiles = discoverPolicyFiles(projectDir);
+  if (conventionEnabled)
+    warnSkippedPolicyFiles(projectDir, "project");
+  const projectFiles = conventionEnabled ? discoverPolicyFiles(projectDir) : [];
   for (const file of projectFiles) {
     const hooksBefore = getCustomHooks().length;
     await loadSingleFile(file, { conventionScope: "project" });
@@ -3505,7 +3599,9 @@ async function loadAllCustomHooks(customPoliciesPath, opts) {
     }
   }
   const userDir = resolve4(homedir4(), ".failproofai", "policies");
-  const userFiles = discoverPolicyFiles(userDir);
+  if (conventionEnabled)
+    warnSkippedPolicyFiles(userDir, "user");
+  const userFiles = conventionEnabled ? discoverPolicyFiles(userDir) : [];
   for (const file of userFiles) {
     const hooksBefore = getCustomHooks().length;
     await loadSingleFile(file, { conventionScope: "user" });
@@ -3520,7 +3616,9 @@ async function loadAllCustomHooks(customPoliciesPath, opts) {
   }
   const allHooks = getCustomHooks();
   const conventionCount = allHooks.length - hooksBeforeConvention;
-  if (projectFiles.length > 0 || userFiles.length > 0) {
+  if (!conventionEnabled) {
+    hookLogInfo("convention policies: DISABLED via customPoliciesEnabled:false — " + "no .failproofai/policies/ files loaded");
+  } else if (projectFiles.length > 0 || userFiles.length > 0) {
     hookLogInfo(`convention policies: ${projectFiles.length} project file(s), ${userFiles.length} user file(s), ${conventionCount} hook(s)`);
   }
   const hookNameToScope = new Map;
@@ -3540,7 +3638,7 @@ async function loadAllCustomHooks(customPoliciesPath, opts) {
   }
   return { hooks: allHooks, conventionSources };
 }
-var LOADING_KEY = "__FAILPROOFAI_LOADING_HOOKS__", CONVENTION_FILE_RE;
+var LOADING_KEY = "__FAILPROOFAI_LOADING_HOOKS__", CONVENTION_FILE_RE, LOADABLE_EXT_RE;
 var init_custom_hooks_loader = __esm(() => {
   init_hook_logger();
   init_custom_hooks_registry();
@@ -3549,6 +3647,7 @@ var init_custom_hooks_loader = __esm(() => {
   init_hook_telemetry2();
   init_telemetry_id2();
   CONVENTION_FILE_RE = /policies\.(js|mjs|ts)$/;
+  LOADABLE_EXT_RE = /\.(js|mjs|ts)$/;
 });
 
 // src/hooks/hook-activity-store.ts
@@ -4761,17 +4860,20 @@ var init_sqlite_reader = () => {};
 function formatDuration(ms) {
   if (ms < 1000)
     return `${ms}ms`;
-  const seconds = ms / 1000;
-  if (seconds < 60)
-    return `${seconds.toFixed(1)}s`;
-  const totalMinutes = Math.floor(seconds / 60);
-  if (totalMinutes >= 60) {
-    const hours = Math.floor(totalMinutes / 60);
-    const remainingMinutes = totalMinutes % 60;
-    return `${hours}h ${remainingMinutes}m`;
+  const deciseconds = Math.round(ms / 100);
+  if (deciseconds < 600) {
+    return `${(deciseconds / 10).toFixed(1)}s`;
   }
-  const remainingSeconds = (seconds % 60).toFixed(0);
-  return `${totalMinutes}m ${remainingSeconds}s`;
+  const totalSeconds = Math.round(ms / 1000);
+  if (totalSeconds < 3600) {
+    const minutes2 = Math.floor(totalSeconds / 60);
+    const seconds = totalSeconds % 60;
+    return `${minutes2}m ${seconds}s`;
+  }
+  const totalMinutes = Math.round(ms / 60000);
+  const hours = Math.floor(totalMinutes / 60);
+  const minutes = totalMinutes % 60;
+  return `${hours}h ${minutes}m`;
 }
 
 // lib/hermes-sessions.ts
@@ -8191,7 +8293,10 @@ async function handleHookEvent(eventType, cli = "claude") {
     const config = readMergedHooksConfig(session.cwd);
     clearPolicies();
     registerBuiltinPolicies(config.enabledPolicies);
-    const loadResult = await loadAllCustomHooks(config.customPoliciesPath, { sessionCwd: session.cwd });
+    const loadResult = await loadAllCustomHooks(config.customPoliciesPath, {
+      sessionCwd: session.cwd,
+      customPoliciesEnabled: config.customPoliciesEnabled
+    });
     const customHooksList = loadResult.hooks;
     const conventionHookNames = new Set(loadResult.conventionSources.flatMap((s) => s.hookNames));
     for (const hook of customHooksList) {
@@ -8314,6 +8419,242 @@ var init_handler = __esm(() => {
   init_hook_logger();
 });
 
+// scripts/install-telemetry.mjs
+import { createHmac, randomUUID } from "node:crypto";
+import { execSync as execSync4 } from "node:child_process";
+import { readFileSync as readFileSync10, writeFileSync as writeFileSync4, mkdirSync as mkdirSync5 } from "node:fs";
+import { homedir as homedir21, platform, arch, hostname, cpus } from "node:os";
+import { join as join24 } from "node:path";
+function hashToId3(raw) {
+  return createHmac("sha256", NAMESPACE3).update(raw).digest("hex");
+}
+function getInstanceId3() {
+  const idDir = join24(homedir21(), ".failproofai");
+  const idFile = join24(idDir, "instance-id");
+  try {
+    const existing = readFileSync10(idFile, "utf-8").trim();
+    if (existing)
+      return existing;
+  } catch {}
+  try {
+    const p = platform();
+    if (p === "linux") {
+      for (const machineIdPath of ["/etc/machine-id", "/var/lib/dbus/machine-id"]) {
+        try {
+          const id2 = readFileSync10(machineIdPath, "utf-8").trim();
+          if (id2)
+            return hashToId3(id2);
+        } catch {}
+      }
+    } else if (p === "darwin") {
+      const out = execSync4("ioreg -rd1 -c IOPlatformExpertDevice", {
+        encoding: "utf-8",
+        timeout: 3000
+      });
+      const m = out.match(/"IOPlatformUUID"\s*=\s*"([^"]+)"/);
+      if (m?.[1])
+        return hashToId3(m[1]);
+    } else if (p === "win32") {
+      const out = execSync4('reg query "HKLM\\SOFTWARE\\Microsoft\\Cryptography" /v MachineGuid', { encoding: "utf-8", timeout: 3000 });
+      const m = out.match(/MachineGuid\s+REG_SZ\s+(\S+)/);
+      if (m?.[1])
+        return hashToId3(m[1]);
+    }
+  } catch {}
+  try {
+    const sysProps = [
+      hostname(),
+      homedir21(),
+      platform(),
+      arch(),
+      cpus()[0]?.model ?? ""
+    ].join(":");
+    return hashToId3(sysProps);
+  } catch {}
+  const id = randomUUID();
+  try {
+    mkdirSync5(idDir, { recursive: true });
+    writeFileSync4(idFile, id, "utf-8");
+  } catch {}
+  return id;
+}
+async function trackInstallEvent(event, properties = {}, opts = {}) {
+  if (process.env.FAILPROOFAI_TELEMETRY_DISABLED === "1")
+    return;
+  const version3 = opts.version ?? process.env.npm_package_version ?? "unknown";
+  const body = JSON.stringify({
+    api_key: process.env.FAILPROOFAI_POSTHOG_KEY ?? API_KEY3,
+    event,
+    distinct_id: getInstanceId3(),
+    properties: {
+      ...properties,
+      $lib: "failproofai-install",
+      failproofai_version: version3,
+      product: PRODUCT
+    }
+  });
+  await fetch(process.env.FAILPROOFAI_POSTHOG_HOST ? `${process.env.FAILPROOFAI_POSTHOG_HOST}/capture/` : CAPTURE_URL3, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body,
+    signal: AbortSignal.timeout(opts.timeoutMs ?? 5000)
+  });
+}
+var NAMESPACE3 = "failproofai-telemetry-v1", API_KEY3 = "phc_Ac1Ww1GqKc0z1SyrRWbmatEeQdlOQIsDEEdP8l8JRgX", CAPTURE_URL3 = "https://us.i.posthog.com/capture/", PRODUCT = "failproofai-oss";
+var init_install_telemetry = () => {};
+
+// lib/install-check.ts
+var exports_install_check = {};
+__export(exports_install_check, {
+  maybeReportInstall: () => maybeReportInstall,
+  compareSemver: () => compareSemver,
+  checkHooks: () => checkHooks
+});
+import { existsSync as existsSync10, readFileSync as readFileSync11, writeFileSync as writeFileSync5, mkdirSync as mkdirSync6 } from "node:fs";
+import { resolve as resolve9 } from "node:path";
+import { platform as platform2, arch as arch2, release, homedir as homedir22, hostname as hostname2 } from "node:os";
+import { createHmac as createHmac2 } from "node:crypto";
+function hashToId4(raw) {
+  return createHmac2("sha256", NAMESPACE4).update(raw).digest("hex");
+}
+function lastVersionPath() {
+  return resolve9(homedir22(), ".failproofai", "last-version");
+}
+function compareSemver(a, b) {
+  const parse = (v) => {
+    const m = /^(\d+)\.(\d+)\.(\d+)(?:-(.+))?$/.exec(v);
+    if (!m)
+      return null;
+    return { nums: [Number(m[1]), Number(m[2]), Number(m[3])], pre: m[4] ?? null };
+  };
+  const pa = parse(a);
+  const pb = parse(b);
+  if (!pa || !pb)
+    return a < b ? -1 : a > b ? 1 : 0;
+  for (let i = 0;i < 3; i++) {
+    if (pa.nums[i] !== pb.nums[i])
+      return pa.nums[i] < pb.nums[i] ? -1 : 1;
+  }
+  if (pa.pre === null && pb.pre === null)
+    return 0;
+  if (pa.pre === null)
+    return 1;
+  if (pb.pre === null)
+    return -1;
+  const ax = pa.pre.split(".");
+  const bx = pb.pre.split(".");
+  for (let i = 0;i < Math.max(ax.length, bx.length); i++) {
+    const ai = ax[i], bi = bx[i];
+    if (ai === undefined)
+      return -1;
+    if (bi === undefined)
+      return 1;
+    const aNum = /^\d+$/.test(ai), bNum = /^\d+$/.test(bi);
+    if (aNum && bNum) {
+      const d = Number(ai) - Number(bi);
+      if (d !== 0)
+        return d < 0 ? -1 : 1;
+    } else if (aNum) {
+      return -1;
+    } else if (bNum) {
+      return 1;
+    } else if (ai !== bi) {
+      return ai < bi ? -1 : 1;
+    }
+  }
+  return 0;
+}
+function checkHooks() {
+  const hooksConfigPath = resolve9(homedir22(), ".failproofai", "policies-config.json");
+  if (!existsSync10(hooksConfigPath)) {
+    return { configured: false, registered: false, policyCount: 0 };
+  }
+  let config;
+  try {
+    config = JSON.parse(readFileSync11(hooksConfigPath, "utf8"));
+  } catch {
+    return { configured: false, registered: false, policyCount: 0 };
+  }
+  if (!Array.isArray(config.enabledPolicies) || config.enabledPolicies.length === 0) {
+    return { configured: false, registered: false, policyCount: 0 };
+  }
+  const policyCount = config.enabledPolicies.length;
+  const settingsPath = resolve9(homedir22(), ".claude", "settings.json");
+  if (!existsSync10(settingsPath))
+    return { configured: true, registered: false, policyCount };
+  let settings;
+  try {
+    settings = JSON.parse(readFileSync11(settingsPath, "utf8"));
+  } catch {
+    return { configured: true, registered: false, policyCount };
+  }
+  if (!settings?.hooks)
+    return { configured: true, registered: false, policyCount };
+  for (const matchers of Object.values(settings.hooks)) {
+    if (!Array.isArray(matchers))
+      continue;
+    for (const matcher of matchers) {
+      if (!matcher?.hooks)
+        continue;
+      if (matcher.hooks.some((h) => h[FAILPROOFAI_HOOK_MARKER2] === true)) {
+        return { configured: true, registered: true, policyCount };
+      }
+    }
+  }
+  return { configured: true, registered: false, policyCount };
+}
+async function maybeReportInstall(version3) {
+  try {
+    const versionFile = lastVersionPath();
+    let previousVersion = null;
+    try {
+      if (existsSync10(versionFile)) {
+        previousVersion = readFileSync11(versionFile, "utf8").trim() || null;
+      }
+    } catch {}
+    if (previousVersion === version3)
+      return;
+    const hooks = checkHooks();
+    const events = [];
+    if (previousVersion === null) {
+      events.push(trackInstallEvent("first_install", {
+        platform: platform2(),
+        arch: arch2(),
+        os_release: release(),
+        node_version: process.versions.node
+      }, { version: version3, timeoutMs: REPORT_TIMEOUT_MS }));
+    } else {
+      const cmp = compareSemver(previousVersion, version3);
+      events.push(trackInstallEvent("version_changed", {
+        from_version: previousVersion,
+        to_version: version3,
+        direction: cmp < 0 ? "upgrade" : "downgrade",
+        platform: platform2(),
+        arch: arch2()
+      }, { version: version3, timeoutMs: REPORT_TIMEOUT_MS }));
+    }
+    events.push(trackInstallEvent("package_installed", {
+      platform: platform2(),
+      arch: arch2(),
+      os_release: release(),
+      node_version: process.versions.node,
+      hostname_hash: hashToId4(hostname2()),
+      hooks_configured: hooks.configured,
+      hooks_registered: hooks.registered,
+      enabled_policy_count: hooks.policyCount
+    }, { version: version3, timeoutMs: REPORT_TIMEOUT_MS }));
+    try {
+      mkdirSync6(resolve9(homedir22(), ".failproofai"), { recursive: true });
+      writeFileSync5(versionFile, version3, "utf8");
+    } catch {}
+    await Promise.all(events.map((p) => p.catch(() => {})));
+  } catch {}
+}
+var FAILPROOFAI_HOOK_MARKER2 = "__failproofai_hook__", NAMESPACE4 = "failproofai-telemetry-v1", REPORT_TIMEOUT_MS = 5000;
+var init_install_check = __esm(() => {
+  init_install_telemetry();
+});
+
 // node_modules/yaml/dist/nodes/identity.js
 var require_identity = __commonJS((exports) => {
   var ALIAS = Symbol.for("yaml.alias");
@@ -15305,32 +15646,32 @@ var init_dist = __esm(() => {
 });
 
 // src/hooks/integrations.ts
-import { execSync as execSync4 } from "node:child_process";
-import { readFileSync as readFileSync10, writeFileSync as writeFileSync4, existsSync as existsSync10, mkdirSync as mkdirSync5, unlinkSync as unlinkSync2 } from "node:fs";
-import { resolve as resolve9, dirname as dirname4 } from "node:path";
+import { execSync as execSync5 } from "node:child_process";
+import { readFileSync as readFileSync12, writeFileSync as writeFileSync6, existsSync as existsSync11, mkdirSync as mkdirSync7, unlinkSync as unlinkSync2 } from "node:fs";
+import { resolve as resolve10, dirname as dirname4 } from "node:path";
 import { fileURLToPath } from "node:url";
-import { homedir as homedir21 } from "node:os";
+import { homedir as homedir23 } from "node:os";
 function readJsonFile(path3) {
-  if (!existsSync10(path3))
+  if (!existsSync11(path3))
     return {};
-  const raw = readFileSync10(path3, "utf8");
+  const raw = readFileSync12(path3, "utf8");
   return JSON.parse(raw);
 }
 function writeJsonFile(path3, data) {
-  mkdirSync5(dirname4(path3), { recursive: true });
-  writeFileSync4(path3, JSON.stringify(data, null, 2) + `
+  mkdirSync7(dirname4(path3), { recursive: true });
+  writeFileSync6(path3, JSON.stringify(data, null, 2) + `
 `, "utf8");
 }
 function readYamlDoc(path3) {
   try {
-    return existsSync10(path3) ? $parseDocument(readFileSync10(path3, "utf8")) : $parseDocument("");
+    return existsSync11(path3) ? $parseDocument(readFileSync12(path3, "utf8")) : $parseDocument("");
   } catch {
     return $parseDocument("");
   }
 }
 function writeYamlDoc(path3, doc) {
-  mkdirSync5(dirname4(path3), { recursive: true });
-  writeFileSync4(path3, doc.toString(), "utf8");
+  mkdirSync7(dirname4(path3), { recursive: true });
+  writeFileSync6(path3, doc.toString(), "utf8");
 }
 function isMarkedHook(hook) {
   if (!hook || typeof hook !== "object")
@@ -15351,7 +15692,7 @@ function stripLegacyVersion(settings) {
 function binaryExists(name) {
   try {
     const cmd = process.platform === "win32" ? `where ${name}` : `which ${name}`;
-    execSync4(cmd, { encoding: "utf8", stdio: "pipe" });
+    execSync5(cmd, { encoding: "utf8", stdio: "pipe" });
     return true;
   } catch {
     return false;
@@ -15369,7 +15710,7 @@ function isMarkedCopilotHook(hook) {
   return false;
 }
 function opencodePluginFilePath(settingsPath) {
-  return resolve9(dirname4(settingsPath), "plugins", "failproofai.mjs");
+  return resolve10(dirname4(settingsPath), "plugins", "failproofai.mjs");
 }
 function buildOpenCodePluginShim(binaryPath, scope) {
   const useNpx = scope === "project";
@@ -15584,8 +15925,8 @@ export default async function failproofaiPlugin({ client, directory }) {
 function getPiExtensionPath() {
   const fromEnv = process.env.FAILPROOFAI_PACKAGE_ROOT;
   if (fromEnv)
-    return resolve9(fromEnv, "pi-extension");
-  return resolve9(fileURLToPath(import.meta.url), "..", "..", "..", "pi-extension");
+    return resolve10(fromEnv, "pi-extension");
+  return resolve10(fileURLToPath(import.meta.url), "..", "..", "..", "pi-extension");
 }
 function isFailproofaiPiEntry(source) {
   if (typeof source !== "string")
@@ -15596,8 +15937,8 @@ function isFailproofaiPiEntry(source) {
 }
 function makePiProjectRelativeEntry(extPath) {
   const cwd = process.cwd();
-  const cwdResolved = resolve9(cwd);
-  const extResolved = resolve9(extPath);
+  const cwdResolved = resolve10(cwd);
+  const extResolved = resolve10(extPath);
   if (extResolved.startsWith(cwdResolved + "/") || extResolved === cwdResolved) {
     const fromSettingsDir = "../" + extResolved.slice(cwdResolved.length + 1);
     return fromSettingsDir;
@@ -15607,8 +15948,8 @@ function makePiProjectRelativeEntry(extPath) {
 function getOpenClawPluginPath() {
   const fromEnv = process.env.FAILPROOFAI_PACKAGE_ROOT;
   if (fromEnv)
-    return resolve9(fromEnv, "openclaw-plugin");
-  return resolve9(fileURLToPath(import.meta.url), "..", "..", "..", "openclaw-plugin");
+    return resolve10(fromEnv, "openclaw-plugin");
+  return resolve10(fileURLToPath(import.meta.url), "..", "..", "..", "openclaw-plugin");
 }
 function isFailproofaiOpenClawPath(p) {
   if (typeof p !== "string")
@@ -15644,14 +15985,14 @@ var init_integrations = __esm(() => {
     scopes: HOOK_SCOPES,
     eventTypes: HOOK_EVENT_TYPES,
     getSettingsPath(scope, cwd) {
-      const base = cwd ? resolve9(cwd) : process.cwd();
+      const base = cwd ? resolve10(cwd) : process.cwd();
       switch (scope) {
         case "user":
-          return resolve9(homedir21(), ".claude", "settings.json");
+          return resolve10(homedir23(), ".claude", "settings.json");
         case "project":
-          return resolve9(base, ".claude", "settings.json");
+          return resolve10(base, ".claude", "settings.json");
         case "local":
-          return resolve9(base, ".claude", "settings.local.json");
+          return resolve10(base, ".claude", "settings.local.json");
       }
     },
     readSettings(settingsPath) {
@@ -15723,7 +16064,7 @@ var init_integrations = __esm(() => {
     },
     hooksInstalledInSettings(scope, cwd) {
       const settingsPath = this.getSettingsPath(scope, cwd);
-      if (!existsSync10(settingsPath))
+      if (!existsSync11(settingsPath))
         return false;
       try {
         const settings = this.readSettings(settingsPath);
@@ -15752,14 +16093,14 @@ var init_integrations = __esm(() => {
     scopes: CODEX_HOOK_SCOPES,
     eventTypes: CODEX_HOOK_EVENT_TYPES,
     getSettingsPath(scope, cwd) {
-      const base = cwd ? resolve9(cwd) : process.cwd();
+      const base = cwd ? resolve10(cwd) : process.cwd();
       switch (scope) {
         case "user":
-          return resolve9(homedir21(), ".codex", "hooks.json");
+          return resolve10(homedir23(), ".codex", "hooks.json");
         case "project":
-          return resolve9(base, ".codex", "hooks.json");
+          return resolve10(base, ".codex", "hooks.json");
         case "local":
-          return resolve9(base, ".codex", "hooks.json");
+          return resolve10(base, ".codex", "hooks.json");
       }
     },
     readSettings(settingsPath) {
@@ -15839,7 +16180,7 @@ var init_integrations = __esm(() => {
     },
     hooksInstalledInSettings(scope, cwd) {
       const settingsPath = this.getSettingsPath(scope, cwd);
-      if (!existsSync10(settingsPath))
+      if (!existsSync11(settingsPath))
         return false;
       try {
         const settings = this.readSettings(settingsPath);
@@ -15868,14 +16209,14 @@ var init_integrations = __esm(() => {
     scopes: COPILOT_HOOK_SCOPES,
     eventTypes: COPILOT_HOOK_EVENT_TYPES,
     getSettingsPath(scope, cwd) {
-      const base = cwd ? resolve9(cwd) : process.cwd();
+      const base = cwd ? resolve10(cwd) : process.cwd();
       switch (scope) {
         case "user":
-          return resolve9(homedir21(), ".copilot", "hooks", "failproofai.json");
+          return resolve10(homedir23(), ".copilot", "hooks", "failproofai.json");
         case "project":
-          return resolve9(base, ".github", "hooks", "failproofai.json");
+          return resolve10(base, ".github", "hooks", "failproofai.json");
         case "local":
-          return resolve9(base, ".github", "hooks", "failproofai.json");
+          return resolve10(base, ".github", "hooks", "failproofai.json");
       }
     },
     readSettings(settingsPath) {
@@ -15953,7 +16294,7 @@ var init_integrations = __esm(() => {
     },
     hooksInstalledInSettings(scope, cwd) {
       const settingsPath = this.getSettingsPath(scope, cwd);
-      if (!existsSync10(settingsPath))
+      if (!existsSync11(settingsPath))
         return false;
       try {
         const settings = this.readSettings(settingsPath);
@@ -15982,14 +16323,14 @@ var init_integrations = __esm(() => {
     scopes: CURSOR_HOOK_SCOPES,
     eventTypes: CURSOR_HOOK_EVENT_TYPES,
     getSettingsPath(scope, cwd) {
-      const base = cwd ? resolve9(cwd) : process.cwd();
+      const base = cwd ? resolve10(cwd) : process.cwd();
       switch (scope) {
         case "user":
-          return resolve9(homedir21(), ".cursor", "hooks.json");
+          return resolve10(homedir23(), ".cursor", "hooks.json");
         case "project":
-          return resolve9(base, ".cursor", "hooks.json");
+          return resolve10(base, ".cursor", "hooks.json");
         case "local":
-          return resolve9(base, ".cursor", "hooks.json");
+          return resolve10(base, ".cursor", "hooks.json");
       }
     },
     readSettings(settingsPath) {
@@ -16056,7 +16397,7 @@ var init_integrations = __esm(() => {
     },
     hooksInstalledInSettings(scope, cwd) {
       const settingsPath = this.getSettingsPath(scope, cwd);
-      if (!existsSync10(settingsPath))
+      if (!existsSync11(settingsPath))
         return false;
       try {
         const settings = this.readSettings(settingsPath);
@@ -16081,14 +16422,14 @@ var init_integrations = __esm(() => {
     scopes: OPENCODE_HOOK_SCOPES,
     eventTypes: OPENCODE_HOOK_EVENT_TYPES,
     getSettingsPath(scope, cwd) {
-      const base = cwd ? resolve9(cwd) : process.cwd();
+      const base = cwd ? resolve10(cwd) : process.cwd();
       switch (scope) {
         case "user":
-          return resolve9(homedir21(), ".config", "opencode", "opencode.json");
+          return resolve10(homedir23(), ".config", "opencode", "opencode.json");
         case "project":
-          return resolve9(base, ".opencode", "opencode.json");
+          return resolve10(base, ".opencode", "opencode.json");
         case "local":
-          return resolve9(base, ".opencode", "opencode.json");
+          return resolve10(base, ".opencode", "opencode.json");
       }
     },
     readSettings(settingsPath) {
@@ -16099,7 +16440,7 @@ var init_integrations = __esm(() => {
     },
     buildHookEntry(_binaryPath, _eventType, scope) {
       if (scope === "user") {
-        const abs = resolve9(homedir21(), ".config", "opencode", "plugins", "failproofai.mjs");
+        const abs = resolve10(homedir23(), ".config", "opencode", "plugins", "failproofai.mjs");
         return { spec: `file://${abs}`, [FAILPROOFAI_HOOK_MARKER]: true };
       }
       return { spec: OPENCODE_PLUGIN_REL_PATH, [FAILPROOFAI_HOOK_MARKER]: true };
@@ -16114,10 +16455,10 @@ var init_integrations = __esm(() => {
     writeHookEntries(settings, binaryPath, scope) {
       const s = settings;
       const effectiveScope = scope ?? "project";
-      const settingsPath = effectiveScope === "user" ? resolve9(homedir21(), ".config", "opencode", "opencode.json") : resolve9(process.cwd(), ".opencode", "opencode.json");
+      const settingsPath = effectiveScope === "user" ? resolve10(homedir23(), ".config", "opencode", "opencode.json") : resolve10(process.cwd(), ".opencode", "opencode.json");
       const pluginPath = opencodePluginFilePath(settingsPath);
-      mkdirSync5(dirname4(pluginPath), { recursive: true });
-      writeFileSync4(pluginPath, buildOpenCodePluginShim(binaryPath, effectiveScope), "utf8");
+      mkdirSync7(dirname4(pluginPath), { recursive: true });
+      writeFileSync6(pluginPath, buildOpenCodePluginShim(binaryPath, effectiveScope), "utf8");
       if (!Array.isArray(s.plugin))
         s.plugin = [];
       const desired = effectiveScope === "user" ? `file://${pluginPath}` : OPENCODE_PLUGIN_REL_PATH;
@@ -16140,9 +16481,9 @@ var init_integrations = __esm(() => {
       }
       this.writeSettings(settingsPath, settings);
       const pluginPath = opencodePluginFilePath(settingsPath);
-      if (existsSync10(pluginPath)) {
+      if (existsSync11(pluginPath)) {
         try {
-          const content = readFileSync10(pluginPath, "utf8");
+          const content = readFileSync12(pluginPath, "utf8");
           if (content.includes(FAILPROOFAI_HOOK_MARKER)) {
             unlinkSync2(pluginPath);
             if (removed === 0)
@@ -16154,7 +16495,7 @@ var init_integrations = __esm(() => {
     },
     hooksInstalledInSettings(scope, cwd) {
       const settingsPath = this.getSettingsPath(scope, cwd);
-      if (!existsSync10(settingsPath))
+      if (!existsSync11(settingsPath))
         return false;
       try {
         const settings = this.readSettings(settingsPath);
@@ -16164,9 +16505,9 @@ var init_integrations = __esm(() => {
         if (!hasEntry)
           return false;
         const pluginPath = opencodePluginFilePath(settingsPath);
-        if (!existsSync10(pluginPath))
+        if (!existsSync11(pluginPath))
           return false;
-        const content = readFileSync10(pluginPath, "utf8");
+        const content = readFileSync12(pluginPath, "utf8");
         return content.includes(FAILPROOFAI_HOOK_MARKER);
       } catch {
         return false;
@@ -16182,14 +16523,14 @@ var init_integrations = __esm(() => {
     scopes: PI_HOOK_SCOPES,
     eventTypes: PI_HOOK_EVENT_TYPES,
     getSettingsPath(scope, cwd) {
-      const base = cwd ? resolve9(cwd) : process.cwd();
+      const base = cwd ? resolve10(cwd) : process.cwd();
       switch (scope) {
         case "user":
-          return resolve9(homedir21(), ".pi", "agent", "settings.json");
+          return resolve10(homedir23(), ".pi", "agent", "settings.json");
         case "project":
-          return resolve9(base, ".pi", "settings.json");
+          return resolve10(base, ".pi", "settings.json");
         case "local":
-          return resolve9(base, ".pi", "settings.json");
+          return resolve10(base, ".pi", "settings.json");
       }
     },
     readSettings(settingsPath) {
@@ -16231,7 +16572,7 @@ var init_integrations = __esm(() => {
       }
     },
     removeHooksFromFile(settingsPath) {
-      if (!existsSync10(settingsPath))
+      if (!existsSync11(settingsPath))
         return 0;
       const settings = this.readSettings(settingsPath);
       if (!Array.isArray(settings.packages))
@@ -16246,7 +16587,7 @@ var init_integrations = __esm(() => {
     },
     hooksInstalledInSettings(scope, cwd) {
       const settingsPath = this.getSettingsPath(scope, cwd);
-      if (!existsSync10(settingsPath))
+      if (!existsSync11(settingsPath))
         return false;
       try {
         const settings = this.readSettings(settingsPath);
@@ -16267,7 +16608,7 @@ var init_integrations = __esm(() => {
     scopes: HERMES_HOOK_SCOPES,
     eventTypes: HERMES_HOOK_EVENT_TYPES,
     getSettingsPath() {
-      return resolve9(homedir21(), ".hermes", "config.yaml");
+      return resolve10(homedir23(), ".hermes", "config.yaml");
     },
     readSettings(settingsPath) {
       return readYamlDoc(settingsPath);
@@ -16302,7 +16643,7 @@ var init_integrations = __esm(() => {
       doc.set("hooks_auto_accept", true);
     },
     removeHooksFromFile(settingsPath) {
-      if (!existsSync10(settingsPath))
+      if (!existsSync11(settingsPath))
         return 0;
       const doc = readYamlDoc(settingsPath);
       const js = doc.toJS() ?? {};
@@ -16335,7 +16676,7 @@ var init_integrations = __esm(() => {
     },
     hooksInstalledInSettings(scope, cwd) {
       const settingsPath = this.getSettingsPath(scope, cwd);
-      if (!existsSync10(settingsPath))
+      if (!existsSync11(settingsPath))
         return false;
       try {
         const doc = readYamlDoc(settingsPath);
@@ -16360,7 +16701,7 @@ var init_integrations = __esm(() => {
     scopes: OPENCLAW_HOOK_SCOPES,
     eventTypes: OPENCLAW_HOOK_EVENT_TYPES,
     getSettingsPath() {
-      return resolve9(homedir21(), ".openclaw", "openclaw.json");
+      return resolve10(homedir23(), ".openclaw", "openclaw.json");
     },
     readSettings(settingsPath) {
       return readJsonFile(settingsPath);
@@ -16405,7 +16746,7 @@ var init_integrations = __esm(() => {
       hooks.allowConversationAccess = true;
     },
     removeHooksFromFile(settingsPath) {
-      if (!existsSync10(settingsPath))
+      if (!existsSync11(settingsPath))
         return 0;
       const settings = this.readSettings(settingsPath);
       const plugins = settings.plugins;
@@ -16434,7 +16775,7 @@ var init_integrations = __esm(() => {
     },
     hooksInstalledInSettings(scope, cwd) {
       const settingsPath = this.getSettingsPath(scope, cwd);
-      if (!existsSync10(settingsPath))
+      if (!existsSync11(settingsPath))
         return false;
       try {
         const settings = this.readSettings(settingsPath);
@@ -16456,14 +16797,14 @@ var init_integrations = __esm(() => {
     scopes: FACTORY_HOOK_SCOPES,
     eventTypes: FACTORY_HOOK_EVENT_TYPES,
     getSettingsPath(scope, cwd) {
-      const base = cwd ? resolve9(cwd) : process.cwd();
+      const base = cwd ? resolve10(cwd) : process.cwd();
       switch (scope) {
         case "user":
-          return resolve9(homedir21(), ".factory", "hooks.json");
+          return resolve10(homedir23(), ".factory", "hooks.json");
         case "project":
-          return resolve9(base, ".factory", "hooks.json");
+          return resolve10(base, ".factory", "hooks.json");
         case "local":
-          return resolve9(base, ".factory", "hooks.json");
+          return resolve10(base, ".factory", "hooks.json");
       }
     },
     readSettings(settingsPath) {
@@ -16531,7 +16872,7 @@ var init_integrations = __esm(() => {
     },
     hooksInstalledInSettings(scope, cwd) {
       const settingsPath = this.getSettingsPath(scope, cwd);
-      if (!existsSync10(settingsPath))
+      if (!existsSync11(settingsPath))
         return false;
       try {
         const settings = this.readSettings(settingsPath);
@@ -16558,14 +16899,14 @@ var init_integrations = __esm(() => {
     scopes: DEVIN_HOOK_SCOPES,
     eventTypes: DEVIN_HOOK_EVENT_TYPES,
     getSettingsPath(scope, cwd) {
-      const base = cwd ? resolve9(cwd) : process.cwd();
+      const base = cwd ? resolve10(cwd) : process.cwd();
       switch (scope) {
         case "user":
-          return resolve9(homedir21(), ".config", "devin", "config.json");
+          return resolve10(homedir23(), ".config", "devin", "config.json");
         case "project":
-          return resolve9(base, ".devin", "config.json");
+          return resolve10(base, ".devin", "config.json");
         case "local":
-          return resolve9(base, ".devin", "config.json");
+          return resolve10(base, ".devin", "config.json");
       }
     },
     readSettings(settingsPath) {
@@ -16637,7 +16978,7 @@ var init_integrations = __esm(() => {
     },
     hooksInstalledInSettings(scope, cwd) {
       const settingsPath = this.getSettingsPath(scope, cwd);
-      if (!existsSync10(settingsPath))
+      if (!existsSync11(settingsPath))
         return false;
       try {
         const settings = this.readSettings(settingsPath);
@@ -16667,14 +17008,14 @@ var init_integrations = __esm(() => {
     scopes: ANTIGRAVITY_HOOK_SCOPES,
     eventTypes: ANTIGRAVITY_HOOK_EVENT_TYPES,
     getSettingsPath(scope, cwd) {
-      const base = cwd ? resolve9(cwd) : process.cwd();
+      const base = cwd ? resolve10(cwd) : process.cwd();
       switch (scope) {
         case "user":
-          return resolve9(homedir21(), ".gemini", "config", "hooks.json");
+          return resolve10(homedir23(), ".gemini", "config", "hooks.json");
         case "project":
-          return resolve9(base, ".agents", "hooks.json");
+          return resolve10(base, ".agents", "hooks.json");
         case "local":
-          return resolve9(base, ".agents", "hooks.json");
+          return resolve10(base, ".agents", "hooks.json");
       }
     },
     readSettings(settingsPath) {
@@ -16776,7 +17117,7 @@ var init_integrations = __esm(() => {
     },
     hooksInstalledInSettings(scope, cwd) {
       const settingsPath = this.getSettingsPath(scope, cwd);
-      if (!existsSync10(settingsPath))
+      if (!existsSync11(settingsPath))
         return false;
       try {
         const settings = this.readSettings(settingsPath);
@@ -16808,14 +17149,14 @@ var init_integrations = __esm(() => {
     scopes: GOOSE_HOOK_SCOPES,
     eventTypes: GOOSE_HOOK_EVENT_TYPES,
     getSettingsPath(scope, cwd) {
-      const base = cwd ? resolve9(cwd) : process.cwd();
+      const base = cwd ? resolve10(cwd) : process.cwd();
       switch (scope) {
         case "user":
-          return resolve9(homedir21(), ".agents", "plugins", "failproofai", "hooks", "hooks.json");
+          return resolve10(homedir23(), ".agents", "plugins", "failproofai", "hooks", "hooks.json");
         case "project":
-          return resolve9(base, ".agents", "plugins", "failproofai", "hooks", "hooks.json");
+          return resolve10(base, ".agents", "plugins", "failproofai", "hooks", "hooks.json");
         case "local":
-          return resolve9(base, ".agents", "plugins", "failproofai", "hooks", "hooks.json");
+          return resolve10(base, ".agents", "plugins", "failproofai", "hooks", "hooks.json");
       }
     },
     readSettings(settingsPath) {
@@ -16882,7 +17223,7 @@ var init_integrations = __esm(() => {
     },
     hooksInstalledInSettings(scope, cwd) {
       const settingsPath = this.getSettingsPath(scope, cwd);
-      if (!existsSync10(settingsPath))
+      if (!existsSync11(settingsPath))
         return false;
       try {
         const settings = this.readSettings(settingsPath);
@@ -16926,6 +17267,11 @@ import * as readline from "node:readline";
 function colorsEnabled(out) {
   return !!out.isTTY && !process.env.NO_COLOR;
 }
+function brandAnsi(role) {
+  const h = HUES[role];
+  const code = truecolorEnabled() ? `38;2;${h.rgb.join(";")}` : h.basic;
+  return `${ESC}[${code}m`;
+}
 function truecolorEnabled() {
   return /truecolor|24bit/i.test(process.env.COLORTERM || "");
 }
@@ -17050,7 +17396,7 @@ function renderLaunchBanner(version3, stdout = process.stdout) {
     row("version", c.pink(version3)),
     row("star", c.dim("https://github.com/failproofai/failproofai")),
     row("docs", c.dim("https://docs.befailproof.ai/introduction")),
-    row("discord", c.dim("https://discord.gg/2zjBZP7yQJ")),
+    row("discord", c.dim("https://discord.befailproof.ai/")),
     ""
   ];
 }
@@ -17145,7 +17491,7 @@ function runPrompt(p) {
       `${c.dim(BAR)}  ${c.dim(p.summaryFor(result))}`
     ]);
   };
-  return new Promise((resolve10) => {
+  return new Promise((resolve11) => {
     hideCursor(stdout);
     repaint(stdout, region, build());
     readline.emitKeypressEvents(stdin);
@@ -17161,7 +17507,7 @@ function runPrompt(p) {
     const finish = (result) => {
       cleanup();
       collapse(result);
-      resolve10(result);
+      resolve11(result);
     };
     function onKey(_s, key) {
       if (!key)
@@ -17222,7 +17568,7 @@ function multiSelect(opts) {
   const choices = opts.choices;
   const minSelected = opts.minSelected ?? 0;
   const noun = opts.summaryNoun ?? "selected";
-  const checked = choices.map((ch) => !!ch.checked);
+  const checked = choices.map((ch) => ch.locked ? ch.checked ?? true : !!ch.checked);
   if (!stdin.isTTY || !stdout.isTTY) {
     return Promise.resolve(choices.filter((_, i) => checked[i]).map((ch) => ch.value));
   }
@@ -17238,7 +17584,7 @@ function multiSelect(opts) {
     renderRow: (index, active, budget) => {
       const choice = choices[index];
       const caret = active ? c.pink(CARET) : " ";
-      const box = checked[index] ? c.pink(CHECK_ON) : c.dim(CHECK_OFF);
+      const box = choice.locked ? checked[index] ? c.guide(CHECK_ON) : c.dim(CHECK_OFF) : checked[index] ? c.pink(CHECK_ON) : c.dim(CHECK_OFF);
       const rawLabel = choice.label.padEnd(nameCol);
       const label = active ? c.pinkBold(rawLabel) : checked[index] ? rawLabel : c.dim(rawLabel);
       const hint = choice.hint ? `  ${c.dim(ellipsize(choice.hint, budget))}` : "";
@@ -17248,19 +17594,23 @@ function multiSelect(opts) {
     footer: opts.hint ?? "↑/↓ move · space select · ctrl+a all · enter confirm",
     onKey: (key, cursor2) => {
       if (key.name === "space") {
+        if (choices[cursor2]?.locked)
+          return "redraw";
         checked[cursor2] = !checked[cursor2];
         warn = false;
         return "redraw";
       }
       if (key.ctrl && key.name === "a") {
-        const allOn = checked.every(Boolean);
-        for (let i = 0;i < checked.length; i++)
-          checked[i] = !allOn;
+        const allOn = choices.every((ch, i) => checked[i] || ch.locked);
+        for (let i = 0;i < checked.length; i++) {
+          checked[i] = choices[i]?.locked ? true : !allOn;
+        }
         return "redraw";
       }
       if (key.name === "return") {
         const selected = choices.filter((_, i) => checked[i]).map((ch) => ch.value);
-        if (selected.length < minSelected) {
+        const chosen = choices.filter((ch, i) => checked[i] && !ch.locked).length;
+        if (chosen < minSelected) {
           warn = true;
           return "redraw";
         }
@@ -17268,10 +17618,10 @@ function multiSelect(opts) {
       }
       return;
     },
-    summaryFor: (values) => values === null ? "cancelled" : summarize(choices.filter((ch) => values.includes(ch.value)).map((ch) => ch.label), noun)
+    summaryFor: (values) => values === null ? "cancelled" : summarize(choices.filter((ch) => values.includes(ch.value) && !ch.summaryExclude).map((ch) => ch.label), noun)
   });
 }
-var ESC = "\x1B", BAR = "│", BAR_END = "└", STEP_ACTIVE = "◆", STEP_DONE = "◇", RADIO_ON = "●", RADIO_OFF = "○", CHECK_ON = "◼", CHECK_OFF = "◻", CARET = "❯", FLOWER = "❋", HUES, LOGO_MIN_COLS = 22, TAGLINE = "end-to-end failure layer for ai agents", LOGO_GRID, LOGO_TEAL, LOGO_PINK, WINDOW = 8;
+var ESC = "\x1B", BAR = "│", BAR_END = "└", STEP_ACTIVE = "◆", STEP_DONE = "◇", RADIO_ON = "●", RADIO_OFF = "○", CHECK_ON = "◼", CHECK_OFF = "◻", CARET = "❯", FLOWER = "❋", HUES, ANSI_RESET, ANSI_BOLD, ANSI_DIM, LOGO_MIN_COLS = 22, TAGLINE = "end-to-end failure layer for ai agents", LOGO_GRID, LOGO_TEAL, LOGO_PINK, WINDOW = 8;
 var init_tui = __esm(() => {
   HUES = {
     guide: { rgb: [102, 209, 181], basic: "36" },
@@ -17280,29 +17630,30 @@ var init_tui = __esm(() => {
     warn: { rgb: [227, 179, 65], basic: "33" },
     dim: { rgb: [107, 118, 132], basic: "2" }
   };
+  ANSI_RESET = `${ESC}[0m`;
+  ANSI_BOLD = `${ESC}[1m`;
+  ANSI_DIM = `${ESC}[2m`;
   LOGO_GRID = [
-    "...tt...........",
-    "..tttt..........",
-    ".tttttt.........",
-    ".tttttt.....ppp.",
-    "..tttt......ppp.",
-    "...tt.......ppp.",
-    "............ppp.",
-    "............ppp.",
-    "..pppp......ppp.",
-    "..pppp......ppp.",
-    "..pppp......ppp.",
-    ".pppppp.....ppp.",
-    ".pppppp.....ppp.",
-    ".pppppp.....ppp.",
-    ".pppppp.....ppp.",
-    "..pppp......ppp.",
-    "..pppp......ppp.",
-    "..pppp......ppp.",
-    "..ppppppppppppp.",
-    "..ppppppppppppp.",
-    "..ppppppppppppp.",
-    "..ppppppppppppp."
+    "...tt........",
+    "..tttt.......",
+    ".tttttt..pppp",
+    ".tttttt..pppp",
+    "..tttt...pppp",
+    "...tt....pppp",
+    ".........pppp",
+    ".........pppp",
+    "..pppp...pppp",
+    "..pppp...pppp",
+    "..pppp...pppp",
+    ".pppppp..pppp",
+    ".pppppp..pppp",
+    ".pppppp..pppp",
+    ".pppppp..pppp",
+    "..pppp...pppp",
+    "..ppppppppppp",
+    "..ppppppppppp",
+    "..ppppppppppp",
+    "..ppppppppppp"
   ];
   LOGO_TEAL = HUES.guide.rgb;
   LOGO_PINK = HUES.logoPink.rgb;
@@ -17457,7 +17808,7 @@ async function promptPolicySelection(preSelected, options = {}) {
 `);
     lastLineCount = lines.length;
   }
-  return new Promise((resolve10) => {
+  return new Promise((resolve11) => {
     render();
     process.stdin.setRawMode(true);
     process.stdin.resume();
@@ -17494,7 +17845,7 @@ async function promptPolicySelection(preSelected, options = {}) {
 ${dim(STEP_DONE)}  Policies
 ${dim(BAR)}  ${dim(`${selected.length} selected`)}
 `);
-        resolve10(selected);
+        resolve11(selected);
       } else if (key.name === "escape") {
         search = "";
         cursor2 = 0;
@@ -17555,10 +17906,10 @@ __export(exports_manager, {
   hooksInstalledInSettings: () => hooksInstalledInSettings,
   getSettingsPath: () => getSettingsPath
 });
-import { execSync as execSync5 } from "node:child_process";
-import { existsSync as existsSync11 } from "node:fs";
-import { resolve as resolve10, basename as basename3 } from "node:path";
-import { homedir as homedir22, platform, arch, release, hostname } from "node:os";
+import { execSync as execSync6 } from "node:child_process";
+import { existsSync as existsSync12 } from "node:fs";
+import { resolve as resolve11, basename as basename3 } from "node:path";
+import { homedir as homedir24, platform as platform3, arch as arch3, release as release2, hostname as hostname3 } from "node:os";
 function getSettingsPath(scope, cwd) {
   return claudeCode.getSettingsPath(scope, cwd);
 }
@@ -17578,7 +17929,7 @@ function resolveFailproofaiBinary() {
     return override.trim();
   try {
     const cmd = process.platform === "win32" ? "where failproofai" : "which failproofai";
-    const result = execSync5(cmd, { encoding: "utf8" }).trim();
+    const result = execSync6(cmd, { encoding: "utf8" }).trim();
     return result.split(`
 `)[0].trim();
   } catch {
@@ -17664,7 +18015,7 @@ async function installHooksImpl(policyNames, scope = "user", cwd, includeBeta =
   if (removeCustomHooks) {
     delete configToWrite.customPoliciesPath;
   } else if (customPoliciesPath) {
-    configToWrite.customPoliciesPath = resolve10(customPoliciesPath);
+    configToWrite.customPoliciesPath = resolve11(customPoliciesPath);
     let validatedHooks = [];
     try {
       validatedHooks = await loadCustomHooks(configToWrite.customPoliciesPath, { strict: true });
@@ -17736,10 +18087,10 @@ Enabled ${selectedPolicies.length} policy(ies): ${selectedPolicies.join(", ")}
       policies_added: policiesAdded,
       policies_removed: policiesRemoved,
       ...source ? { source } : {},
-      platform: platform(),
-      arch: arch(),
-      os_release: release(),
-      hostname_hash: hashToId2(hostname()),
+      platform: platform3(),
+      arch: arch3(),
+      os_release: release2(),
+      hostname_hash: hashToId2(hostname3()),
       has_custom_hooks_path: !!configToWrite.customPoliciesPath,
       has_policy_params: !!(configToWrite.policyParams && Object.keys(configToWrite.policyParams).length > 0),
       param_policy_names: configToWrite.policyParams ? Object.keys(configToWrite.policyParams) : [],
@@ -17826,10 +18177,10 @@ async function removeHooks(policyNames, scope = "user", cwd, opts) {
         policies_removed: actuallyRemoved,
         removed_count: actuallyRemoved.length,
         ...opts?.source ? { source: opts.source } : {},
-        platform: platform(),
-        arch: arch(),
-        os_release: release(),
-        hostname_hash: hashToId2(hostname())
+        platform: platform3(),
+        arch: arch3(),
+        os_release: release2(),
+        hostname_hash: hashToId2(hostname3())
       });
     } catch {}
     console.log(`Disabled ${policyNames.length - notEnabled.length} policy(ies).`);
@@ -17844,7 +18195,7 @@ async function removeHooks(policyNames, scope = "user", cwd, opts) {
     const scopesToRemove = scope === "all" ? [...integration.scopes] : integration.scopes.includes(scope) ? [scope] : [];
     for (const s of scopesToRemove) {
       const settingsPath = integration.getSettingsPath(s, cwd);
-      if (!existsSync11(settingsPath)) {
+      if (!existsSync12(settingsPath)) {
         if (scope !== "all" && selectedClis.length === 1) {
           console.log("No settings file found. Nothing to remove.");
           nothingToReport = true;
@@ -17884,10 +18235,10 @@ async function removeHooks(policyNames, scope = "user", cwd, opts) {
       policies_removed: configBeforeRemoval.enabledPolicies,
       removed_count: totalRemoved,
       ...opts?.source ? { source: opts.source } : {},
-      platform: platform(),
-      arch: arch(),
-      os_release: release(),
-      hostname_hash: hashToId2(hostname())
+      platform: platform3(),
+      arch: arch3(),
+      os_release: release2(),
+      hostname_hash: hashToId2(hostname3())
     });
   } catch {}
   if (scope === "all") {
@@ -18033,7 +18384,7 @@ Failproof AI Hook Policies
   if (config.customPoliciesPath) {
     console.log(`
   ── Custom Policies (${config.customPoliciesPath}) ───────────────────────`);
-    if (!existsSync11(config.customPoliciesPath)) {
+    if (!existsSync12(config.customPoliciesPath)) {
       console.log(`  \x1B[31m✗ File not found: ${config.customPoliciesPath}\x1B[0m`);
     } else {
       const hooks = await loadCustomHooks(config.customPoliciesPath);
@@ -18048,10 +18399,10 @@ Failproof AI Hook Policies
     }
     console.log();
   }
-  const base = cwd ? resolve10(cwd) : process.cwd();
+  const base = cwd ? resolve11(cwd) : process.cwd();
   const conventionDirs = [
-    { label: "Project", dir: resolve10(base, ".failproofai", "policies") },
-    { label: "User", dir: resolve10(homedir22(), ".failproofai", "policies") }
+    { label: "Project", dir: resolve11(base, ".failproofai", "policies") },
+    { label: "User", dir: resolve11(homedir24(), ".failproofai", "policies") }
   ];
   for (const { label, dir } of conventionDirs) {
     const files = discoverPolicyFiles(dir);
@@ -18253,7 +18604,7 @@ async function promptCliTargetSelection(detected, action = "install") {
     lastLineCount = lines.length;
   }
   const itemCount = options.length;
-  return new Promise((resolve11) => {
+  return new Promise((resolve12) => {
     render();
     readline3.emitKeypressEvents(process.stdin);
     const wasRaw = process.stdin.isRaw;
@@ -18286,7 +18637,7 @@ async function promptCliTargetSelection(detected, action = "install") {
         cleanup();
         process.stdout.write(`
 `);
-        resolve11(options[cursor2].value);
+        resolve12(options[cursor2].value);
       }
     }
     process.stdin.on("keypress", onKey);
@@ -18439,7 +18790,7 @@ async function promptPolicySelection2(preSelected, options = {}) {
 `);
     lastLineCount = lines.length;
   }
-  return new Promise((resolve11) => {
+  return new Promise((resolve12) => {
     render();
     process.stdin.setRawMode(true);
     process.stdin.resume();
@@ -18476,7 +18827,7 @@ async function promptPolicySelection2(preSelected, options = {}) {
 ${dim(STEP_DONE)}  Policies
 ${dim(BAR)}  ${dim(`${selected.length} selected`)}
 `);
-        resolve11(selected);
+        resolve12(selected);
       } else if (key.name === "escape") {
         search = "";
         cursor2 = 0;
@@ -18656,12 +19007,12 @@ var init_api_server_client = __esm(() => {
 // lib/atomic-write.ts
 import {
   chmodSync,
-  existsSync as existsSync12,
-  mkdirSync as mkdirSync6,
+  existsSync as existsSync13,
+  mkdirSync as mkdirSync8,
   renameSync as renameSync3,
   rmSync,
   statSync as statSync11,
-  writeFileSync as writeFileSync5
+  writeFileSync as writeFileSync7
 } from "node:fs";
 import { dirname as dirname5 } from "node:path";
 import { randomBytes } from "node:crypto";
@@ -18669,11 +19020,11 @@ function writeJsonAtomically(filePath, value, opts = {}) {
   const mode = opts.mode ?? 384;
   const dirMode = opts.dirMode ?? 448;
   const dir = dirname5(filePath);
-  if (!existsSync12(dir))
-    mkdirSync6(dir, { recursive: true, mode: dirMode });
+  if (!existsSync13(dir))
+    mkdirSync8(dir, { recursive: true, mode: dirMode });
   const tmp = `${filePath}.${process.pid}.${randomBytes(6).toString("hex")}.tmp`;
   try {
-    writeFileSync5(tmp, JSON.stringify(value, null, 2), { mode });
+    writeFileSync7(tmp, JSON.stringify(value, null, 2), { mode });
     try {
       if ((statSync11(tmp).mode & 63) !== 0)
         chmodSync(tmp, mode);
@@ -18693,24 +19044,24 @@ function writeJsonAtomically(filePath, value, opts = {}) {
 var init_atomic_write = () => {};
 
 // lib/auth/auth-store.ts
-import { existsSync as existsSync13, readFileSync as readFileSync11, rmSync as rmSync2 } from "node:fs";
-import { homedir as homedir23 } from "node:os";
-import { join as join24 } from "node:path";
+import { existsSync as existsSync14, readFileSync as readFileSync13, rmSync as rmSync2 } from "node:fs";
+import { homedir as homedir25 } from "node:os";
+import { join as join25 } from "node:path";
 function getAuthDir() {
   const override = process.env.FAILPROOFAI_AUTH_DIR;
   if (override)
     return override;
-  return join24(homedir23(), ".failproofai");
+  return join25(homedir25(), ".failproofai");
 }
 function getAuthFilePath() {
-  return join24(getAuthDir(), "auth.json");
+  return join25(getAuthDir(), "auth.json");
 }
 function readAuth() {
   const p = getAuthFilePath();
-  if (!existsSync13(p))
+  if (!existsSync14(p))
     return null;
   try {
-    const raw = readFileSync11(p, "utf-8");
+    const raw = readFileSync13(p, "utf-8");
     const parsed = JSON.parse(raw);
     if (typeof parsed.access_token !== "string" || typeof parsed.refresh_token !== "string" || typeof parsed.access_expires_at !== "number" || typeof parsed.user !== "object" || !parsed.user || typeof parsed.user.id !== "string" || typeof parsed.user.email !== "string") {
       return null;
@@ -18734,7 +19085,7 @@ function writeAuth(auth) {
 }
 function deleteAuth() {
   const p = getAuthFilePath();
-  if (existsSync13(p))
+  if (existsSync14(p))
     rmSync2(p, { force: true });
 }
 function authFromTokenResponse(token, existingUser) {
@@ -18811,13 +19162,13 @@ function prompt(question, opts = {}) {
         orig(s);
     };
   }
-  return new Promise((resolve11) => {
+  return new Promise((resolve12) => {
     rl.question(question, (answer) => {
       rl.close();
       if (opts.hidden && process.stdin.isTTY)
         process.stdout.write(`
 `);
-      resolve11(answer.trim());
+      resolve12(answer.trim());
     });
   });
 }
@@ -19023,11 +19374,12 @@ async function runAuthCli(args) {
     return runLogout();
   return runWhoami();
 }
-var HELP, LEGACY_FLAG_TO_SUB, SUBCOMMANDS, DIM = "\x1B[2m", RESET = "\x1B[0m", PINK = "\x1B[38;5;204m", GREEN = "\x1B[38;5;120m", RED = "\x1B[38;5;197m";
+var HELP, LEGACY_FLAG_TO_SUB, SUBCOMMANDS, COLOR, DIM, RESET, PINK, GREEN, RED;
 var init_cli = __esm(() => {
   init_api_server_client();
   init_auth_store();
   init_cli_error();
+  init_tui();
   init_hook_telemetry2();
   init_telemetry_id2();
   HELP = `
@@ -19056,11 +19408,17 @@ EXAMPLES
     "--whoami": "whoami"
   };
   SUBCOMMANDS = new Set(["login", "logout", "whoami", "help"]);
+  COLOR = colorsEnabled(process.stdout);
+  DIM = COLOR ? ANSI_DIM : "";
+  RESET = COLOR ? ANSI_RESET : "";
+  PINK = COLOR ? brandAnsi("pink") : "";
+  GREEN = COLOR ? brandAnsi("guide") : "";
+  RED = COLOR ? brandAnsi("warn") : "";
 });
 
 // lib/claude-sessions.ts
-import { readdirSync as readdirSync10, statSync as statSync12, existsSync as existsSync14 } from "node:fs";
-import { join as join25, basename as basename4 } from "node:path";
+import { readdirSync as readdirSync10, statSync as statSync12, existsSync as existsSync15 } from "node:fs";
+import { join as join26, basename as basename4 } from "node:path";
 function getClaudeProjectsRoot() {
   return getClaudeProjectsPath();
 }
@@ -19075,7 +19433,7 @@ function listClaudeProjects() {
   return entries.filter((e) => e.isDirectory()).map((e) => ({
     name: e.name,
     cwd: decodeFolderName(e.name),
-    path: join25(root, e.name)
+    path: join26(root, e.name)
   }));
 }
 function listClaudeTranscripts(project) {
@@ -19091,7 +19449,7 @@ function listClaudeTranscripts(project) {
       const sessionId = entry.name.slice(0, -".jsonl".length);
       if (!UUID_RE2.test(sessionId))
         continue;
-      const transcriptPath = join25(project.path, entry.name);
+      const transcriptPath = join26(project.path, entry.name);
       try {
         const s = statSync12(transcriptPath);
         out.push({
@@ -19105,8 +19463,8 @@ function listClaudeTranscripts(project) {
         });
       } catch {}
     } else if (entry.isDirectory() && UUID_RE2.test(entry.name)) {
-      const subDir = join25(project.path, entry.name, "subagents");
-      if (!existsSync14(subDir))
+      const subDir = join26(project.path, entry.name, "subagents");
+      if (!existsSync15(subDir))
         continue;
       let subEntries;
       try {
@@ -19118,7 +19476,7 @@ function listClaudeTranscripts(project) {
         if (!sub.isFile() || !sub.name.endsWith(".jsonl"))
           continue;
         const agentId = sub.name.slice(0, -".jsonl".length);
-        const transcriptPath = join25(subDir, sub.name);
+        const transcriptPath = join26(subDir, sub.name);
         try {
           const s = statSync12(transcriptPath);
           out.push({
@@ -20372,9 +20730,9 @@ var init_features = __esm(() => {
 
 // src/audit/cache.ts
 import { createHash } from "node:crypto";
-import { existsSync as existsSync15, mkdirSync as mkdirSync7, readFileSync as readFileSync12, writeFileSync as writeFileSync6, chmodSync as chmodSync2 } from "node:fs";
-import { join as join26 } from "node:path";
-import { homedir as homedir24 } from "node:os";
+import { existsSync as existsSync16, mkdirSync as mkdirSync9, readFileSync as readFileSync14, writeFileSync as writeFileSync8, chmodSync as chmodSync2 } from "node:fs";
+import { join as join27 } from "node:path";
+import { homedir as homedir26 } from "node:os";
 function getEngineVersion() {
   if (cachedEngineVersion)
     return cachedEngineVersion;
@@ -20392,18 +20750,18 @@ function getDetectorVersion() {
   return cachedDetectorVersion;
 }
 function getCachePathFor(transcriptPath) {
-  const root = join26(homedir24(), ".failproofai", "cache", "audit");
+  const root = join27(homedir26(), ".failproofai", "cache", "audit");
   const key = createHash("sha1").update(transcriptPath).digest("hex");
-  return join26(root, `${key}.json`);
+  return join27(root, `${key}.json`);
 }
 function readCachedTranscriptResult(transcriptPath, mtimeMs, sizeBytes) {
   if (sizeBytes === 0)
     return null;
   const cachePath = getCachePathFor(transcriptPath);
-  if (!existsSync15(cachePath))
+  if (!existsSync16(cachePath))
     return null;
   try {
-    const raw = readFileSync12(cachePath, "utf-8");
+    const raw = readFileSync14(cachePath, "utf-8");
     const entry = JSON.parse(raw);
     if (entry.schemaVersion !== CACHE_SCHEMA_VERSION)
       return null;
@@ -20427,7 +20785,7 @@ function writeCachedTranscriptResult(transcriptPath, mtimeMs, sizeBytes, result)
     return;
   const cachePath = getCachePathFor(transcriptPath);
   try {
-    mkdirSync7(join26(homedir24(), ".failproofai", "cache", "audit"), { recursive: true });
+    mkdirSync9(join27(homedir26(), ".failproofai", "cache", "audit"), { recursive: true });
     const entry = {
       schemaVersion: CACHE_SCHEMA_VERSION,
       cachedAt: Date.now(),
@@ -20437,7 +20795,7 @@ function writeCachedTranscriptResult(transcriptPath, mtimeMs, sizeBytes, result)
       detectorVersion: getDetectorVersion(),
       result
     };
-    writeFileSync6(cachePath, JSON.stringify(entry), { encoding: "utf-8", mode: 384 });
+    writeFileSync8(cachePath, JSON.stringify(entry), { encoding: "utf-8", mode: 384 });
     try {
       chmodSync2(cachePath, 384);
     } catch {}
@@ -20799,10 +21157,10 @@ var init_audit = __esm(() => {
 });
 
 // src/audit/dashboard-cache.ts
-import { join as join27 } from "node:path";
-import { homedir as homedir25 } from "node:os";
+import { join as join28 } from "node:path";
+import { homedir as homedir27 } from "node:os";
 function getCachePath() {
-  return join27(homedir25(), ".failproofai", "audit-dashboard.json");
+  return join28(homedir27(), ".failproofai", "audit-dashboard.json");
 }
 function writeDashboardCache(params, result) {
   try {
@@ -20892,14 +21250,14 @@ var POLL_INTERVAL_MS = 150, POLL_TIMEOUT_MS = 30000;
 var init_open_browser = () => {};
 
 // scripts/parse-script-args.ts
-import { resolve as resolve11 } from "path";
+import { resolve as resolve12 } from "path";
 function parseStringFlag(flagName, errorLabel, inlineValue, args, index, options) {
   const raw = inlineValue ?? args[index + 1];
   if (raw === undefined || inlineValue === null && raw.startsWith("-")) {
     console.error(`Error: ${flagName} requires ${errorLabel}`);
     process.exit(1);
   }
-  const value = options?.resolve ? resolve11(raw) : raw;
+  const value = options?.resolve ? resolve12(raw) : raw;
   return { value, spliceCount: inlineValue !== null ? 1 : 2 };
 }
 function parseScriptArgs(argv) {
@@ -20947,21 +21305,21 @@ function parseScriptArgs(argv) {
 var init_parse_script_args = () => {};
 
 // scripts/install-diagnosis.mjs
-import { existsSync as existsSync16, readFileSync as readFileSync13, realpathSync } from "node:fs";
-import { dirname as dirname6, resolve as resolve12 } from "node:path";
-import { homedir as homedir26, platform as platform2 } from "node:os";
+import { existsSync as existsSync17, readFileSync as readFileSync15, realpathSync } from "node:fs";
+import { dirname as dirname6, resolve as resolve13 } from "node:path";
+import { homedir as homedir28, platform as platform4 } from "node:os";
 import { spawnSync } from "node:child_process";
 function findPackageRoot(start) {
   try {
     let dir = realpathSync(start);
-    if (existsSync16(dir) && !existsSync16(resolve12(dir, "package.json"))) {
+    if (existsSync17(dir) && !existsSync17(resolve13(dir, "package.json"))) {
       dir = dirname6(dir);
     }
     while (true) {
-      const pkgPath = resolve12(dir, "package.json");
-      if (existsSync16(pkgPath)) {
+      const pkgPath = resolve13(dir, "package.json");
+      if (existsSync17(pkgPath)) {
         try {
-          const pkg = JSON.parse(readFileSync13(pkgPath, "utf8"));
+          const pkg = JSON.parse(readFileSync15(pkgPath, "utf8"));
           if (pkg.name === PKG_NAME)
             return dir;
         } catch {}
@@ -20979,7 +21337,7 @@ function readPackageVersion(packageRoot) {
   if (!packageRoot)
     return null;
   try {
-    const pkg = JSON.parse(readFileSync13(resolve12(packageRoot, "package.json"), "utf8"));
+    const pkg = JSON.parse(readFileSync15(resolve13(packageRoot, "package.json"), "utf8"));
     return typeof pkg.version === "string" ? pkg.version : null;
   } catch {
     return null;
@@ -20987,7 +21345,7 @@ function readPackageVersion(packageRoot) {
 }
 function resolvePathFirstBinary() {
   try {
-    const isWin = platform2() === "win32";
+    const isWin = platform4() === "win32";
     const res = isWin ? spawnSync("where", [PKG_NAME], { encoding: "utf8" }) : spawnSync("sh", ["-c", `command -v ${PKG_NAME}`], { encoding: "utf8" });
     if (res.status !== 0)
       return null;
@@ -21005,16 +21363,16 @@ function locateNpmGlobal() {
     const root = (res.stdout || "").trim();
     if (!root)
       return null;
-    const candidate = resolve12(root, PKG_NAME);
-    return existsSync16(resolve12(candidate, "package.json")) ? candidate : null;
+    const candidate = resolve13(root, PKG_NAME);
+    return existsSync17(resolve13(candidate, "package.json")) ? candidate : null;
   } catch {
     return null;
   }
 }
 function locateBunGlobal() {
   try {
-    const candidate = resolve12(homedir26(), ".bun", "install", "global", "node_modules", PKG_NAME);
-    return existsSync16(resolve12(candidate, "package.json")) ? candidate : null;
+    const candidate = resolve13(homedir28(), ".bun", "install", "global", "node_modules", PKG_NAME);
+    return existsSync17(resolve13(candidate, "package.json")) ? candidate : null;
   } catch {
     return null;
   }
@@ -21022,8 +21380,8 @@ function locateBunGlobal() {
 function buildRecommendation(pathFirstBin) {
   if (!pathFirstBin)
     return null;
-  const bunBinPrefix = resolve12(homedir26(), ".bun", "bin") + "/";
-  const bunGlobalPrefix = resolve12(homedir26(), ".bun", "install", "global") + "/";
+  const bunBinPrefix = resolve13(homedir28(), ".bun", "bin") + "/";
+  const bunGlobalPrefix = resolve13(homedir28(), ".bun", "install", "global") + "/";
   const isBun = pathFirstBin.startsWith(bunBinPrefix) || pathFirstBin.startsWith(bunGlobalPrefix);
   if (isBun) {
     return `rm -f ~/.bun/bin/${PKG_NAME} && rm -rf ~/.bun/install/global/node_modules/${PKG_NAME}`;
@@ -21103,8 +21461,8 @@ __export(exports_launch, {
   launch: () => launch
 });
 import { spawn as spawn2 } from "child_process";
-import { realpathSync as realpathSync2, existsSync as existsSync17 } from "node:fs";
-import { resolve as resolve13, dirname as dirname7 } from "node:path";
+import { realpathSync as realpathSync2, existsSync as existsSync18 } from "node:fs";
+import { resolve as resolve14, dirname as dirname7 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 import { createInterface as createInterface2 } from "node:readline";
 function launch(mode) {
@@ -21119,9 +21477,9 @@ function launch(mode) {
     process.env.PORT = port;
     process.env.HOSTNAME = "0.0.0.0";
     cmd = "node";
-    const packageRoot = process.env.FAILPROOFAI_PACKAGE_ROOT ?? resolve13(dirname7(realpathSync2(fileURLToPath2(import.meta.url))), "..");
-    const serverJsPath = resolve13(packageRoot, ".next/standalone/server.js");
-    if (!existsSync17(serverJsPath)) {
+    const packageRoot = process.env.FAILPROOFAI_PACKAGE_ROOT ?? resolve14(dirname7(realpathSync2(fileURLToPath2(import.meta.url))), "..");
+    const serverJsPath = resolve14(packageRoot, ".next/standalone/server.js");
+    if (!existsSync18(serverJsPath)) {
       let shadowMessage = null;
       try {
         const diag = diagnoseShadow({ selfPackageRoot: packageRoot, selfVersion: version2 });
@@ -21332,9 +21690,20 @@ function printSummary(result) {
     process.stdout.write(`  ${line}
 `);
 }
+function auditCompletedProps(source, result) {
+  return {
+    source,
+    events_scanned: result.eventsScanned,
+    sessions_scanned: result.transcripts.scanned,
+    total_hits: result.totals.hits,
+    findings: result.results.length
+  };
+}
 async function runPostSetupAudit() {
   if (process.env.FAILPROOFAI_NO_AUTO_AUDIT === "1")
     return;
+  const instanceId = getInstanceId2();
+  trackHookEvent2(instanceId, "cli_audit_started", { source: "onboarding" });
   process.stdout.write(`
   ${c(PINK2, "✦")} ${c(BOLD, "failproofai audit now running")}  ${c(DIM2, "· ctrl+c to stop")}
 
@@ -21342,12 +21711,18 @@ async function runPostSetupAudit() {
   let result;
   try {
     result = await runWithProgress({});
-  } catch {
+  } catch (err) {
+    await trackHookEvent2(instanceId, "cli_audit_failed", {
+      source: "onboarding",
+      error_type: err instanceof Error ? err.name : "unknown",
+      error_message: sanitizeErrorMessage(err)
+    });
     process.stdout.write(`  ${c(PINK2, "!")} ${c(DIM2, "audit couldn't finish — run")} ${c(CYAN, "failproofai audit")} ${c(DIM2, "later.")}
 
 `);
     return;
   }
+  await trackHookEvent2(instanceId, "cli_audit_completed", auditCompletedProps("onboarding", result));
   if (result.eventsScanned === 0) {
     process.stdout.write(`
   ${c(DIM2, "no agent sessions to audit yet — come back after using your agent.")}
@@ -21386,13 +21761,7 @@ async function runAuditCli(args) {
     die(`Audit failed: ${err instanceof Error ? err.message : String(err)}`);
   }
   printSummary(result);
-  await trackHookEvent2(instanceId, "cli_audit_completed", {
-    source: "cli",
-    events_scanned: result.eventsScanned,
-    sessions_scanned: result.transcripts.scanned,
-    total_hits: result.totals.hits,
-    findings: result.results.length
-  });
+  await trackHookEvent2(instanceId, "cli_audit_completed", auditCompletedProps("cli", result));
   if (result.eventsScanned === 0) {
     process.stdout.write(`
   ${c(DIM2, "no agent sessions found yet.")}
@@ -21418,7 +21787,7 @@ async function runAuditCli(args) {
   const { launch: launch2 } = await Promise.resolve().then(() => (init_launch(), exports_launch));
   launch2("start");
 }
-var DASHBOARD_PORT = 8020, AUDIT_STAGES, HELP2, RESET2 = "\x1B[0m", DIM2 = "\x1B[2m", BOLD = "\x1B[1m", PINK2 = "\x1B[38;5;204m", GREEN2 = "\x1B[38;5;120m", CYAN = "\x1B[38;5;81m", SPINNER;
+var DASHBOARD_PORT = 8020, AUDIT_STAGES, HELP2, RESET2, DIM2, BOLD, PINK2, GREEN2, CYAN, SPINNER;
 var init_cli2 = __esm(() => {
   init_audit();
   init_dashboard_cache();
@@ -21426,6 +21795,7 @@ var init_cli2 = __esm(() => {
   init_telemetry_id2();
   init_telemetry_sanitize();
   init_open_browser();
+  init_tui();
   AUDIT_STAGES = [
     { label: "discovering transcripts", detail: "walking ~/.claude, ~/.codex, ~/.cursor, …" },
     { label: "parsing session logs", detail: "reading JSONL + sqlite session stores" },
@@ -21449,13 +21819,19 @@ WHAT IT DOES
   Runs fully offline — no account or network required. Press Ctrl+C to stop the
   dashboard server when you're done.
 `.trimStart();
+  RESET2 = ANSI_RESET;
+  DIM2 = ANSI_DIM;
+  BOLD = ANSI_BOLD;
+  PINK2 = brandAnsi("pink");
+  GREEN2 = brandAnsi("guide");
+  CYAN = brandAnsi("guide");
   SPINNER = ["⠋", "⠙", "⠹", "⠸", "⠼", "⠴", "⠦", "⠧", "⠇", "⠏"];
 });
 
 // src/hooks/manager.ts
-import { execSync as execSync6 } from "node:child_process";
-import { resolve as resolve14, basename as basename5 } from "node:path";
-import { homedir as homedir27, platform as platform3, arch as arch2, release as release2, hostname as hostname2 } from "node:os";
+import { execSync as execSync7 } from "node:child_process";
+import { resolve as resolve15, basename as basename5 } from "node:path";
+import { homedir as homedir29, platform as platform5, arch as arch4, release as release3, hostname as hostname4 } from "node:os";
 function getSettingsPath2(scope, cwd) {
   return claudeCode.getSettingsPath(scope, cwd);
 }
@@ -21475,7 +21851,7 @@ function resolveFailproofaiBinary2() {
     return override.trim();
   try {
     const cmd = process.platform === "win32" ? "where failproofai" : "which failproofai";
-    const result = execSync6(cmd, { encoding: "utf8" }).trim();
+    const result = execSync7(cmd, { encoding: "utf8" }).trim();
     return result.split(`
 `)[0].trim();
   } catch {
@@ -21561,7 +21937,7 @@ async function installHooksImpl2(policyNames, scope = "user", cwd, includeBeta =
   if (removeCustomHooks) {
     delete configToWrite.customPoliciesPath;
   } else if (customPoliciesPath) {
-    configToWrite.customPoliciesPath = resolve14(customPoliciesPath);
+    configToWrite.customPoliciesPath = resolve15(customPoliciesPath);
     let validatedHooks = [];
     try {
       validatedHooks = await loadCustomHooks(configToWrite.customPoliciesPath, { strict: true });
@@ -21633,10 +22009,10 @@ Enabled ${selectedPolicies.length} policy(ies): ${selectedPolicies.join(", ")}
       policies_added: policiesAdded,
       policies_removed: policiesRemoved,
       ...source ? { source } : {},
-      platform: platform3(),
-      arch: arch2(),
-      os_release: release2(),
-      hostname_hash: hashToId2(hostname2()),
+      platform: platform5(),
+      arch: arch4(),
+      os_release: release3(),
+      hostname_hash: hashToId2(hostname4()),
       has_custom_hooks_path: !!configToWrite.customPoliciesPath,
       has_policy_params: !!(configToWrite.policyParams && Object.keys(configToWrite.policyParams).length > 0),
       param_policy_names: configToWrite.policyParams ? Object.keys(configToWrite.policyParams) : [],
@@ -21881,9 +22257,20 @@ function printSummary2(result) {
     process.stdout.write(`  ${line}
 `);
 }
+function auditCompletedProps2(source, result) {
+  return {
+    source,
+    events_scanned: result.eventsScanned,
+    sessions_scanned: result.transcripts.scanned,
+    total_hits: result.totals.hits,
+    findings: result.results.length
+  };
+}
 async function runPostSetupAudit2() {
   if (process.env.FAILPROOFAI_NO_AUTO_AUDIT === "1")
     return;
+  const instanceId = getInstanceId2();
+  trackHookEvent2(instanceId, "cli_audit_started", { source: "onboarding" });
   process.stdout.write(`
   ${c2(PINK3, "✦")} ${c2(BOLD2, "failproofai audit now running")}  ${c2(DIM3, "· ctrl+c to stop")}
 
@@ -21891,12 +22278,18 @@ async function runPostSetupAudit2() {
   let result;
   try {
     result = await runWithProgress2({});
-  } catch {
+  } catch (err) {
+    await trackHookEvent2(instanceId, "cli_audit_failed", {
+      source: "onboarding",
+      error_type: err instanceof Error ? err.name : "unknown",
+      error_message: sanitizeErrorMessage(err)
+    });
     process.stdout.write(`  ${c2(PINK3, "!")} ${c2(DIM3, "audit couldn't finish — run")} ${c2(CYAN2, "failproofai audit")} ${c2(DIM3, "later.")}
 
 `);
     return;
   }
+  await trackHookEvent2(instanceId, "cli_audit_completed", auditCompletedProps2("onboarding", result));
   if (result.eventsScanned === 0) {
     process.stdout.write(`
   ${c2(DIM3, "no agent sessions to audit yet — come back after using your agent.")}
@@ -21935,13 +22328,7 @@ async function runAuditCli2(args) {
     die2(`Audit failed: ${err instanceof Error ? err.message : String(err)}`);
   }
   printSummary2(result);
-  await trackHookEvent2(instanceId, "cli_audit_completed", {
-    source: "cli",
-    events_scanned: result.eventsScanned,
-    sessions_scanned: result.transcripts.scanned,
-    total_hits: result.totals.hits,
-    findings: result.results.length
-  });
+  await trackHookEvent2(instanceId, "cli_audit_completed", auditCompletedProps2("cli", result));
   if (result.eventsScanned === 0) {
     process.stdout.write(`
   ${c2(DIM3, "no agent sessions found yet.")}
@@ -21967,7 +22354,7 @@ async function runAuditCli2(args) {
   const { launch: launch2 } = await Promise.resolve().then(() => (init_launch(), exports_launch));
   launch2("start");
 }
-var DASHBOARD_PORT2 = 8020, AUDIT_STAGES2, HELP3, RESET3 = "\x1B[0m", DIM3 = "\x1B[2m", BOLD2 = "\x1B[1m", PINK3 = "\x1B[38;5;204m", GREEN3 = "\x1B[38;5;120m", CYAN2 = "\x1B[38;5;81m", SPINNER2;
+var DASHBOARD_PORT2 = 8020, AUDIT_STAGES2, HELP3, RESET3, DIM3, BOLD2, PINK3, GREEN3, CYAN2, SPINNER2;
 var init_cli3 = __esm(() => {
   init_audit();
   init_dashboard_cache();
@@ -21975,6 +22362,7 @@ var init_cli3 = __esm(() => {
   init_telemetry_id2();
   init_telemetry_sanitize();
   init_open_browser();
+  init_tui();
   AUDIT_STAGES2 = [
     { label: "discovering transcripts", detail: "walking ~/.claude, ~/.codex, ~/.cursor, …" },
     { label: "parsing session logs", detail: "reading JSONL + sqlite session stores" },
@@ -21998,32 +22386,41 @@ WHAT IT DOES
   Runs fully offline — no account or network required. Press Ctrl+C to stop the
   dashboard server when you're done.
 `.trimStart();
+  RESET3 = ANSI_RESET;
+  DIM3 = ANSI_DIM;
+  BOLD2 = ANSI_BOLD;
+  PINK3 = brandAnsi("pink");
+  GREEN3 = brandAnsi("guide");
+  CYAN2 = brandAnsi("guide");
   SPINNER2 = ["⠋", "⠙", "⠹", "⠸", "⠼", "⠴", "⠦", "⠧", "⠇", "⠏"];
 });
 
 // src/hooks/configure-wizard.ts
 var exports_configure_wizard = {};
 __export(exports_configure_wizard, {
+  setCustomPoliciesEnabled: () => setCustomPoliciesEnabled,
   runConfigureWizard: () => runConfigureWizard,
   reviewLines: () => reviewLines,
   resolvePresetSelection: () => resolvePresetSelection,
   maybeFirstRunConfigure: () => maybeFirstRunConfigure,
   markLauncherSeen: () => markLauncherSeen,
   hasSeenLauncher: () => hasSeenLauncher,
+  describeCustomPolicies: () => describeCustomPolicies,
+  clisSupportingScope: () => clisSupportingScope,
   buildScopeChoices: () => buildScopeChoices,
   buildPresetChoices: () => buildPresetChoices,
   buildAgentChoices: () => buildAgentChoices
 });
-import { existsSync as existsSync18, mkdirSync as mkdirSync8, writeFileSync as writeFileSync7 } from "node:fs";
-import { homedir as homedir28 } from "node:os";
-import { resolve as resolve15, sep as sep5 } from "node:path";
+import { existsSync as existsSync19, mkdirSync as mkdirSync10, writeFileSync as writeFileSync9, readFileSync as readFileSync16 } from "node:fs";
+import { homedir as homedir30 } from "node:os";
+import { resolve as resolve16, sep as sep5 } from "node:path";
 async function emit(event, props) {
   try {
     await trackHookEvent2(getInstanceId2(), event, props);
   } catch {}
 }
 function homeify(p) {
-  const home = homedir28();
+  const home = homedir30();
   if (p === home)
     return "~";
   if (p.startsWith(home + sep5))
@@ -22044,6 +22441,9 @@ function buildScopeChoices(cwd) {
     }
   ];
 }
+function clisSupportingScope(scope) {
+  return INTEGRATION_TYPES.filter((id) => getIntegration(id).scopes.includes(scope));
+}
 function buildAgentChoices(scope, cwd) {
   const detected = new Set(detectInstalledClis());
   const ordered = [
@@ -22053,6 +22453,17 @@ function buildAgentChoices(scope, cwd) {
   return ordered.map((id) => {
     const integration = getIntegration(id);
     const isDetected = detected.has(id);
+    const supported = integration.scopes.includes(scope);
+    if (!supported) {
+      return {
+        label: integration.displayName,
+        value: id,
+        checked: false,
+        locked: true,
+        section: "Global only · not configurable per-project",
+        hint: `supports ${integration.scopes.join(", ")} scope — rerun with "Everywhere I code"`
+      };
+    }
     let installedHere = false;
     try {
       installedHere = integration.hooksInstalledInSettings(scope, cwd);
@@ -22068,28 +22479,102 @@ function buildAgentChoices(scope, cwd) {
     };
   });
 }
-function buildPresetChoices() {
-  const choices = POLICY_PRESETS.map((p) => ({ label: p.label, value: p.id, hint: p.description }));
+function buildPresetChoices(cwd = process.cwd(), enabled = true) {
+  const choices = POLICY_PRESETS.map((p) => ({
+    label: p.label,
+    value: p.id,
+    hint: p.description
+  }));
   choices.push({
     label: "Everything",
     value: EVERYTHING,
     hint: `all ${resolveEverything().length} policies`
   });
+  const custom = describeCustomPolicies(cwd);
+  const skipped = custom.warnings.length;
+  const plural = (n) => `${n} file${n === 1 ? "" : "s"}`;
+  const skippedNote = skipped > 0 ? ` · ${skipped} skipped, see next screen` : "";
+  if (custom.fileCount > 0) {
+    choices.push({
+      label: "Custom",
+      value: CUSTOM,
+      checked: enabled,
+      hint: `${plural(custom.fileCount)} in ${custom.scopes.join(" + ")}${skippedNote}`
+    });
+  } else {
+    choices.push({
+      label: "Custom",
+      value: CUSTOM,
+      locked: true,
+      checked: false,
+      summaryExclude: true,
+      hint: skipped > 0 ? `${plural(skipped)} found but NOT loaded — see next screen` : "none yet · drop *-policies.mjs in .failproofai/policies/"
+    });
+  }
   return choices;
 }
 function resolvePresetSelection(values) {
-  if (values.includes(EVERYTHING))
+  const selected = values.filter((v) => v !== CUSTOM);
+  if (selected.includes(EVERYTHING))
     return resolveEverything();
-  return [...new Set(values.flatMap((id) => resolvePreset(id)))];
+  return [...new Set(selected.flatMap((id) => resolvePreset(id)))];
+}
+function setCustomPoliciesEnabled(scope, cwd, enabled) {
+  if (enabled === undefined)
+    return;
+  const path3 = getConfigPathForScope(scope, cwd);
+  let config = {};
+  try {
+    if (existsSync19(path3))
+      config = JSON.parse(readFileSync16(path3, "utf8"));
+  } catch {
+    return;
+  }
+  if (enabled)
+    delete config.customPoliciesEnabled;
+  else
+    config.customPoliciesEnabled = false;
+  try {
+    writeFileSync9(path3, JSON.stringify(config, null, 2) + `
+`, "utf8");
+  } catch {}
+}
+function describeCustomPolicies(cwd) {
+  const active = [];
+  const warnings = [];
+  const scopes = [];
+  let fileCount = 0;
+  const dirs = [
+    { dir: resolve16(cwd, ".failproofai", "policies"), label: "project" },
+    { dir: resolve16(homedir30(), ".failproofai", "policies"), label: "global" }
+  ];
+  for (const { dir, label } of dirs) {
+    const found = discoverPolicyFiles(dir);
+    if (found.length > 0) {
+      active.push(`${found.length} file${found.length === 1 ? "" : "s"} (${label})`);
+      scopes.push(label);
+      fileCount += found.length;
+    }
+    for (const name of findSkippedPolicyFiles(dir)) {
+      warnings.push(`! ${homeify(resolve16(dir, name))} is NOT loaded — rename to ` + `${name.replace(/\.(js|mjs|ts)$/, "-policies.$1")}`);
+    }
+  }
+  return { active, warnings, fileCount, scopes };
 }
 function reviewLines(state) {
-  const { scope, clis, policies, cwd } = state;
+  const { scope, clis, policies, cwd, customEnabled } = state;
   const where = scope === "project" ? `This project (${homeify(cwd)})` : "Everywhere (global)";
   const lines = [];
   const assistantNames = clis.map((c3) => getIntegration(c3).displayName);
   lines.push(`  Where      : ${where}`);
   lines.push(`  Assistants : ${assistantNames.length ? summarize(assistantNames, "assistants") : "(none)"}`);
   lines.push(`  Policies   : ${policies.length} enabled`);
+  const custom = describeCustomPolicies(cwd);
+  if (custom.active.length > 0) {
+    lines.push(`  Custom     : ${custom.active.join(" · ")} ${customEnabled === false ? "— DISABLED, will not load" : DIM_NOTE}`);
+  }
+  for (const warning of custom.warnings)
+    lines.push(`  ${warning}`);
   lines.push("");
   lines.push("  This will update:");
   for (const cli of clis) {
@@ -22100,15 +22585,15 @@ function reviewLines(state) {
   return lines;
 }
 function firstRunMarkerPath() {
-  return resolve15(homedir28(), ".failproofai", ".launcher-configured");
+  return resolve16(homedir30(), ".failproofai", ".launcher-configured");
 }
 function hasSeenLauncher() {
-  return existsSync18(firstRunMarkerPath());
+  return existsSync19(firstRunMarkerPath());
 }
 function markLauncherSeen() {
   try {
-    mkdirSync8(resolve15(homedir28(), ".failproofai"), { recursive: true });
-    writeFileSync7(firstRunMarkerPath(), "1", "utf8");
+    mkdirSync10(resolve16(homedir30(), ".failproofai"), { recursive: true });
+    writeFileSync9(firstRunMarkerPath(), "1", "utf8");
   } catch {}
 }
 function anyHooksInstalledGlobally() {
@@ -22179,7 +22664,8 @@ Use the flag form instead, e.g.:
       {
         label: "Everything available",
         value: ALL_CLIS,
-        hint: `protect all ${INTEGRATION_TYPES.length} supported CLIs`
+        hint: `protect all ${clisSupportingScope(scope).length} CLIs configurable here`,
+        summaryExclude: true
       },
       ...buildAgentChoices(scope, cwd)
     ],
@@ -22191,10 +22677,14 @@ Use the flag form instead, e.g.:
   });
   if (clisSel === null)
     return cancel();
-  const clis = clisSel.includes(ALL_CLIS) ? [...INTEGRATION_TYPES] : clisSel.filter((v) => v !== ALL_CLIS);
+  const supported = new Set(clisSupportingScope(scope));
+  const clis = (clisSel.includes(ALL_CLIS) ? [...INTEGRATION_TYPES] : clisSel.filter((v) => v !== ALL_CLIS)).filter((id) => supported.has(id));
+  const customEnabledBefore = readHooksConfig().customPoliciesEnabled !== false;
+  const presetChoices = buildPresetChoices(cwd, customEnabledBefore);
+  const hasCustomFiles = describeCustomPolicies(cwd).fileCount > 0;
   const presets = await multiSelect({
     message: "What should we guard against?",
-    choices: buildPresetChoices(),
+    choices: presetChoices,
     minSelected: 1,
     summaryNoun: "bundles",
     hint: "space toggles · combine presets · ↵ confirm",
@@ -22204,9 +22694,10 @@ Use the flag form instead, e.g.:
   if (presets === null)
     return cancel();
   const policies = resolvePresetSelection(presets);
+  const customEnabled = hasCustomFiles ? presets.includes(CUSTOM) : undefined;
   const decision = await selectOne({
     message: "Ready to apply?",
-    body: reviewLines({ scope, clis, policies, cwd }),
+    body: reviewLines({ scope, clis, policies, cwd, customEnabled }),
     choices: [
       { label: "Yes, apply now", value: "apply", hint: "write the config" },
       { label: "Cancel", value: "cancel", hint: "quit, no changes" }
@@ -22224,13 +22715,15 @@ Use the flag form instead, e.g.:
     source: presets.join("+")
   });
   await installHooks2(policies, scope, cwd, false, "configure-wizard", undefined, false, clis, { replace: true, quiet: true });
+  setCustomPoliciesEnabled(scope, cwd, customEnabled);
   await applied;
   markLauncherSeen();
-  const agentNames = clis.map((c3) => getIntegration(c3).displayName).join(", ");
-  outro(`Setup complete — ${policies.length} policies guarding ${agentNames}.`, { ok: true }, stdout);
+  const customNote = customEnabled === true ? " + your custom policies" : customEnabled === false ? " · custom policies DISABLED" : "";
+  const assistants = `${clis.length} assistant${clis.length === 1 ? "" : "s"}`;
+  outro(`Setup complete — ${policies.length} policies${customNote} · ${assistants}`, { ok: true }, stdout);
   return { applied: true, scope, clis, policies };
 }
-var EVERYTHING = "__everything__", ALL_CLIS = "__all_clis__";
+var EVERYTHING = "__everything__", ALL_CLIS = "__all_clis__", CUSTOM = "__custom__", DIM_NOTE = "(auto-loaded)";
 var init_configure_wizard = __esm(() => {
   init_tui();
   init_integrations();
@@ -22238,6 +22731,7 @@ var init_configure_wizard = __esm(() => {
   init_manager2();
   init_hooks_config();
   init_policy_presets();
+  init_custom_hooks_loader();
   init_hook_telemetry2();
   init_telemetry_id2();
 });
@@ -22248,8 +22742,8 @@ __export(exports_launch2, {
   launch: () => launch2
 });
 import { spawn as spawn3 } from "child_process";
-import { realpathSync as realpathSync3, existsSync as existsSync19 } from "node:fs";
-import { resolve as resolve16, dirname as dirname8 } from "node:path";
+import { realpathSync as realpathSync3, existsSync as existsSync20 } from "node:fs";
+import { resolve as resolve17, dirname as dirname8 } from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 import { createInterface as createInterface3 } from "node:readline";
 function launch2(mode) {
@@ -22264,9 +22758,9 @@ function launch2(mode) {
     process.env.PORT = port;
     process.env.HOSTNAME = "0.0.0.0";
     cmd = "node";
-    const packageRoot = process.env.FAILPROOFAI_PACKAGE_ROOT ?? resolve16(dirname8(realpathSync3(fileURLToPath3(import.meta.url))), "..");
-    const serverJsPath = resolve16(packageRoot, ".next/standalone/server.js");
-    if (!existsSync19(serverJsPath)) {
+    const packageRoot = process.env.FAILPROOFAI_PACKAGE_ROOT ?? resolve17(dirname8(realpathSync3(fileURLToPath3(import.meta.url))), "..");
+    const serverJsPath = resolve17(packageRoot, ".next/standalone/server.js");
+    if (!existsSync20(serverJsPath)) {
       let shadowMessage = null;
       try {
         const diag = diagnoseShadow({ selfPackageRoot: packageRoot, selfVersion: version2 });
@@ -22360,17 +22854,17 @@ var init_cli_error2 = __esm(() => {
 
 // bin/failproofai.mjs
 import { realpathSync as realpathSync4 } from "fs";
-import { dirname as dirname9, resolve as resolve17 } from "path";
+import { dirname as dirname9, resolve as resolve18 } from "path";
 import { fileURLToPath as fileURLToPath4 } from "url";
 // package.json
-var version = "0.0.14-beta.0";
+var version = "0.0.14-beta.2";
 
 // bin/failproofai.mjs
 if (!process.env.FAILPROOFAI_PACKAGE_ROOT) {
-  process.env.FAILPROOFAI_PACKAGE_ROOT = resolve17(dirname9(realpathSync4(fileURLToPath4(import.meta.url))), "..");
+  process.env.FAILPROOFAI_PACKAGE_ROOT = resolve18(dirname9(realpathSync4(fileURLToPath4(import.meta.url))), "..");
 }
 if (!process.env.FAILPROOFAI_DIST_PATH) {
-  process.env.FAILPROOFAI_DIST_PATH = resolve17(dirname9(realpathSync4(fileURLToPath4(import.meta.url))), "..", "dist");
+  process.env.FAILPROOFAI_DIST_PATH = resolve18(dirname9(realpathSync4(fileURLToPath4(import.meta.url))), "..", "dist");
 }
 var args = process.argv.slice(2);
 if (args[0] === "p")
@@ -22423,6 +22917,10 @@ if (hookIdx >= 0) {
   }
 }
 async function runCli() {
+  try {
+    const { maybeReportInstall: maybeReportInstall2 } = await Promise.resolve().then(() => (init_install_check(), exports_install_check));
+    await maybeReportInstall2(version);
+  } catch {}
   const SUBCOMMANDS2 = ["policies", "policy", "auth", "audit", "config"];
   if ((args.includes("--help") || args.includes("-h")) && !SUBCOMMANDS2.includes(args[0])) {
     const extraArgs = args.filter((a) => a !== "--help" && a !== "-h");
@@ -22508,7 +23006,7 @@ EXAMPLES
 LINKS
   \u2B50 Star us:      https://github.com/failproofai/failproofai
   \uD83D\uDCD6 Docs:         https://docs.befailproof.ai/introduction
-  \uD83D\uDCAC Discord:      https://discord.gg/2zjBZP7yQJ
+  \uD83D\uDCAC Discord:      https://discord.befailproof.ai/
 `.trimStart());
     process.exit(0);
   }