failproofai 0.0.15 → 1.0.0-beta.0

package/dist/cli.mjs

@@ -19,7 +19,7 @@ var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
 var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
 // package.json
-var version2 = "0.0.15";
+var version2 = "1.0.0-beta.0";
 var init_package = () => {};
 
 // src/posthog-key.ts
@@ -155,6 +155,383 @@ var init_telemetry_id = __esm(() => {
   ID_FILE = path.join(ID_DIR, "instance-id");
 });
 
+// src/hooks/hook-logger.ts
+import {
+  appendFileSync,
+  renameSync,
+  mkdirSync,
+  existsSync,
+  statSync
+} from "node:fs";
+import { join } from "node:path";
+import { homedir } from "node:os";
+function ensureResolved() {
+  if (resolved)
+    return;
+  resolved = true;
+  const rawLevel = (process.env.FAILPROOFAI_LOG_LEVEL ?? "").toLowerCase();
+  if (rawLevel === "info" || rawLevel === "warn" || rawLevel === "error") {
+    currentLevel = rawLevel;
+  }
+  const rawFile = (process.env.FAILPROOFAI_HOOK_LOG_FILE ?? "").trim();
+  if (rawFile) {
+    fileLoggingEnabled = true;
+    if (rawFile !== "1" && rawFile !== "true") {
+      logDir = rawFile;
+    }
+  }
+}
+function shouldEmit(level) {
+  ensureResolved();
+  return LEVEL_ORDER[level] >= LEVEL_ORDER[currentLevel];
+}
+function emitStderr(label, msg) {
+  process.stderr.write(`[failproofai:hook] ${label} ${msg}
+`);
+}
+function ensureLogDir() {
+  if (!existsSync(logDir)) {
+    mkdirSync(logDir, { recursive: true });
+  }
+}
+function rotateIfNeeded(filePath) {
+  try {
+    const stats = statSync(filePath);
+    if (stats.size >= MAX_FILE_SIZE) {
+      const archiveName = `hooks-${Date.now()}.log`;
+      renameSync(filePath, join(logDir, archiveName));
+    }
+  } catch {}
+}
+function appendToFile(label, msg) {
+  if (!fileLoggingEnabled)
+    return;
+  try {
+    ensureLogDir();
+    const filePath = join(logDir, LOG_FILENAME);
+    rotateIfNeeded(filePath);
+    const timestamp = new Date().toISOString();
+    const line = `[${timestamp}] ${label} ${msg}
+`;
+    appendFileSync(filePath, line, "utf-8");
+  } catch {}
+}
+function hookLogInfo(msg) {
+  if (!shouldEmit("info"))
+    return;
+  emitStderr("INFO", msg);
+  appendToFile("INFO", msg);
+}
+function hookLogWarn(msg) {
+  if (!shouldEmit("warn"))
+    return;
+  emitStderr("WARN", msg);
+  appendToFile("WARN", msg);
+}
+function hookLogError(msg) {
+  if (!shouldEmit("error"))
+    return;
+  emitStderr("ERROR", msg);
+  appendToFile("ERROR", msg);
+}
+var LEVEL_ORDER, MAX_FILE_SIZE, LOG_FILENAME = "hooks.log", DEFAULT_LOG_DIR, resolved = false, currentLevel = "warn", fileLoggingEnabled = false, logDir;
+var init_hook_logger = __esm(() => {
+  LEVEL_ORDER = { info: 0, warn: 1, error: 2 };
+  MAX_FILE_SIZE = 512 * 1024;
+  DEFAULT_LOG_DIR = join(homedir(), ".failproofai", "logs");
+  logDir = DEFAULT_LOG_DIR;
+});
+
+// src/hooks/hooks-config.ts
+import { readFileSync, writeFileSync, existsSync as existsSync2, mkdirSync as mkdirSync2, statSync as statSync2 } from "node:fs";
+import { resolve, dirname } from "node:path";
+import { homedir as homedir2 } from "node:os";
+function configuredCustomPolicyPaths(config) {
+  return config.customPoliciesPaths ?? (config.customPoliciesPath ? [config.customPoliciesPath] : []);
+}
+function readConfigAt(path2) {
+  if (!existsSync2(path2))
+    return {};
+  try {
+    const raw = readFileSync(path2, "utf8");
+    return JSON.parse(raw);
+  } catch (err) {
+    hookLogWarn(`failed to parse config at ${path2}: ${err instanceof Error ? err.message : String(err)}`);
+    return {};
+  }
+}
+function findProjectConfigDir(start) {
+  const home = homedir2();
+  let dir = resolve(start);
+  while (dir !== home) {
+    const marker = resolve(dir, ".failproofai");
+    try {
+      if (statSync2(marker).isDirectory())
+        return dir;
+    } catch {}
+    const parent = dirname(dir);
+    if (parent === dir)
+      break;
+    dir = parent;
+  }
+  return resolve(start);
+}
+function readMergedHooksConfig(cwd) {
+  const base = findProjectConfigDir(cwd ?? process.cwd());
+  const projectPath = resolve(base, ".failproofai", "policies-config.json");
+  const localPath = resolve(base, ".failproofai", "policies-config.local.json");
+  const globalPath = resolve(homedir2(), ".failproofai", "policies-config.json");
+  const project = readConfigAt(projectPath);
+  const local = readConfigAt(localPath);
+  const global_ = readConfigAt(globalPath);
+  const enabledSet = new Set([
+    ...project.enabledPolicies ?? [],
+    ...local.enabledPolicies ?? [],
+    ...global_.enabledPolicies ?? []
+  ]);
+  const mergedParams = {};
+  for (const scope of [project, local, global_]) {
+    if (!scope.policyParams)
+      continue;
+    for (const [policyName, params] of Object.entries(scope.policyParams)) {
+      if (!(policyName in mergedParams)) {
+        mergedParams[policyName] = params;
+      }
+    }
+  }
+  const customPoliciesPaths = [project, local, global_].map((scope) => scope.customPoliciesPaths !== undefined ? scope.customPoliciesPaths : scope.customPoliciesPath !== undefined ? [scope.customPoliciesPath] : undefined).find((paths) => paths !== undefined);
+  const disabledCustomPolicies = new Set([
+    ...project.disabledCustomPolicies ?? [],
+    ...local.disabledCustomPolicies ?? [],
+    ...global_.disabledCustomPolicies ?? []
+  ]);
+  const customPoliciesEnabled = project.customPoliciesEnabled ?? local.customPoliciesEnabled ?? global_.customPoliciesEnabled;
+  const llm = project.llm ?? local.llm ?? global_.llm;
+  return {
+    enabledPolicies: [...enabledSet],
+    ...Object.keys(mergedParams).length > 0 ? { policyParams: mergedParams } : {},
+    ...customPoliciesPaths !== undefined ? { customPoliciesPaths } : {},
+    ...disabledCustomPolicies.size ? { disabledCustomPolicies: [...disabledCustomPolicies] } : {},
+    ...customPoliciesEnabled !== undefined ? { customPoliciesEnabled } : {},
+    ...llm !== undefined ? { llm } : {}
+  };
+}
+function getConfigPath() {
+  return resolve(homedir2(), ".failproofai", "policies-config.json");
+}
+function readHooksConfig() {
+  const configPath = getConfigPath();
+  if (!existsSync2(configPath)) {
+    return { enabledPolicies: [] };
+  }
+  try {
+    const raw = readFileSync(configPath, "utf8");
+    return JSON.parse(raw);
+  } catch (err) {
+    hookLogWarn(`failed to parse config at ${configPath}: ${err instanceof Error ? err.message : String(err)}`);
+    return { enabledPolicies: [] };
+  }
+}
+function getConfigPathForScope(scope, cwd) {
+  switch (scope) {
+    case "user":
+      return resolve(homedir2(), ".failproofai", "policies-config.json");
+    case "project":
+      return resolve(findProjectConfigDir(cwd ?? process.cwd()), ".failproofai", "policies-config.json");
+    case "local":
+      return resolve(findProjectConfigDir(cwd ?? process.cwd()), ".failproofai", "policies-config.local.json");
+  }
+}
+function readScopedHooksConfig(scope, cwd) {
+  const configPath = getConfigPathForScope(scope, cwd);
+  if (!existsSync2(configPath)) {
+    return { enabledPolicies: [] };
+  }
+  try {
+    const raw = readFileSync(configPath, "utf8");
+    return JSON.parse(raw);
+  } catch (err) {
+    hookLogWarn(`failed to parse config at ${configPath}: ${err instanceof Error ? err.message : String(err)}`);
+    return { enabledPolicies: [] };
+  }
+}
+function writeScopedHooksConfig(config, scope, cwd) {
+  const configPath = getConfigPathForScope(scope, cwd);
+  const dir = dirname(configPath);
+  if (!existsSync2(dir)) {
+    mkdirSync2(dir, { recursive: true });
+  }
+  writeFileSync(configPath, JSON.stringify(config, null, 2) + `
+`, "utf8");
+}
+function syncConventionPolicies(entries, scope, cwd) {
+  const configPath = getConfigPathForScope(scope, cwd);
+  if (!existsSync2(configPath) && entries.length === 0)
+    return false;
+  if (existsSync2(configPath)) {
+    try {
+      JSON.parse(readFileSync(configPath, "utf8"));
+    } catch {
+      hookLogWarn(`not recording convention policies: ${configPath} is not valid JSON — ` + `fix the syntax error and re-run. Nothing was written.`);
+      return false;
+    }
+  }
+  const config = readScopedHooksConfig(scope, cwd);
+  const sorted = [...entries].sort((a, b) => a.file.localeCompare(b.file));
+  const next = { ...config };
+  if (sorted.length === 0)
+    delete next.conventionPolicies;
+  else
+    next.conventionPolicies = sorted;
+  if (JSON.stringify(next.conventionPolicies ?? null) === JSON.stringify(config.conventionPolicies ?? null)) {
+    return false;
+  }
+  writeScopedHooksConfig(next, scope, cwd);
+  return true;
+}
+var init_hooks_config = __esm(() => {
+  init_hook_logger();
+});
+
+// src/hooks/daemon-client.ts
+var exports_daemon_client = {};
+__export(exports_daemon_client, {
+  tryDaemonHook: () => tryDaemonHook,
+  isDaemonConfigured: () => isDaemonConfigured
+});
+import { createConnection } from "node:net";
+import { resolve as resolve2 } from "node:path";
+import { homedir as homedir3 } from "node:os";
+function socketPath() {
+  if (process.env.FAILPROOFAI_DAEMON_SOCKET)
+    return process.env.FAILPROOFAI_DAEMON_SOCKET;
+  return resolve2(homedir3(), ".failproofai", "run", "failproofaid.sock");
+}
+function isDaemonConfigured() {
+  try {
+    return readHooksConfig().daemonConfigured === true;
+  } catch {
+    return false;
+  }
+}
+function encodeFrame(value) {
+  const body = Buffer.from(JSON.stringify(value), "utf8");
+  const header = Buffer.alloc(4);
+  header.writeUInt32BE(body.length, 0);
+  return Buffer.concat([header, body]);
+}
+async function tryDaemonHook(req) {
+  if (process.platform === "win32")
+    return null;
+  return new Promise((resolvePromise) => {
+    let settled = false;
+    let timer;
+    const arm = (ms) => {
+      clearTimeout(timer);
+      timer = setTimeout(() => finish(null), ms);
+      timer.unref?.();
+    };
+    const finish = (result) => {
+      if (settled)
+        return;
+      settled = true;
+      clearTimeout(timer);
+      socket.removeAllListeners();
+      socket.destroy();
+      resolvePromise(result);
+    };
+    const socket = createConnection({ path: socketPath() });
+    arm(DAEMON_CONNECT_TIMEOUT_MS);
+    let recvBuf = Buffer.alloc(0);
+    let declaredLen = null;
+    socket.on("connect", () => {
+      arm(DAEMON_RESPONSE_TIMEOUT_MS);
+      socket.write(encodeFrame({
+        type: "hook",
+        protocolVersion: PROTOCOL_VERSION,
+        hookEvent: req.hookEvent,
+        cli: req.cli,
+        stdin: req.stdin,
+        cwd: req.cwd
+      }));
+    });
+    socket.on("data", (chunk) => {
+      recvBuf = Buffer.concat([recvBuf, chunk]);
+      if (declaredLen === null) {
+        if (recvBuf.length < 4)
+          return;
+        declaredLen = recvBuf.readUInt32BE(0);
+        if (declaredLen > MAX_FRAME_LEN) {
+          finish(null);
+          return;
+        }
+        recvBuf = recvBuf.subarray(4);
+      }
+      if (recvBuf.length < declaredLen)
+        return;
+      const body = recvBuf.subarray(0, declaredLen);
+      let message;
+      try {
+        message = JSON.parse(body.toString("utf8"));
+      } catch {
+        finish(null);
+        return;
+      }
+      if (message.protocolVersion !== PROTOCOL_VERSION) {
+        finish(null);
+        return;
+      }
+      if (message.type === "hookResult" && typeof message.exitCode === "number" && typeof message.stdout === "string" && typeof message.stderr === "string") {
+        finish({ exitCode: message.exitCode, stdout: message.stdout, stderr: message.stderr });
+        return;
+      }
+      finish(null);
+    });
+    socket.on("error", () => finish(null));
+    socket.on("close", () => finish(null));
+  });
+}
+var PROTOCOL_VERSION = 1, DAEMON_CONNECT_TIMEOUT_MS = 150, DAEMON_RESPONSE_TIMEOUT_MS = 30000, MAX_FRAME_LEN;
+var init_daemon_client = __esm(() => {
+  init_hooks_config();
+  MAX_FRAME_LEN = 16 * 1024 * 1024;
+});
+
+// src/hooks/read-stdin.ts
+var exports_read_stdin = {};
+__export(exports_read_stdin, {
+  readStdinPayload: () => readStdinPayload
+});
+async function readStdinPayload(maxBytes = 1048576) {
+  let payload = "";
+  let oversized = false;
+  let readError = false;
+  try {
+    payload = await new Promise((resolve3, reject) => {
+      const chunks = [];
+      let totalBytes = 0;
+      process.stdin.setEncoding("utf8");
+      process.stdin.on("data", (chunk) => {
+        totalBytes += Buffer.byteLength(chunk);
+        if (totalBytes > maxBytes) {
+          oversized = true;
+          process.stdin.destroy();
+          resolve3("");
+          return;
+        }
+        chunks.push(chunk);
+      });
+      process.stdin.on("end", () => resolve3(chunks.join("")));
+      process.stdin.on("error", reject);
+      if (process.stdin.readableEnded)
+        resolve3("");
+    });
+  } catch {
+    readError = true;
+  }
+  return { payload, oversized, readError };
+}
+
 // src/hooks/types.ts
 var HOOK_SCOPES, INTEGRATION_TYPES, CODEX_HOOK_SCOPES, CODEX_HOOK_EVENT_TYPES, CODEX_EVENT_MAP, CODEX_TOOL_MAP, HERMES_TOOL_MAP, HERMES_TOOL_INPUT_MAP, HERMES_HOOK_SCOPES, HERMES_HOOK_EVENT_TYPES, HERMES_EVENT_MAP, COPILOT_HOOK_SCOPES, COPILOT_HOOK_EVENT_TYPES, COPILOT_TOOL_MAP, COPILOT_TOOL_INPUT_MAP, CURSOR_HOOK_SCOPES, CURSOR_HOOK_EVENT_TYPES, CURSOR_EVENT_MAP, CURSOR_TOOL_MAP, OPENCODE_HOOK_SCOPES, OPENCODE_HOOK_EVENT_TYPES, OPENCODE_TOOL_MAP, OPENCODE_TOOL_INPUT_MAP, PI_HOOK_SCOPES, PI_HOOK_EVENT_TYPES, PI_EVENT_MAP, PI_TOOL_MAP, PI_TOOL_INPUT_MAP, OPENCLAW_HOOK_SCOPES, OPENCLAW_HOOK_EVENT_TYPES, OPENCLAW_EVENT_MAP, OPENCLAW_TOOL_MAP, OPENCLAW_TOOL_INPUT_MAP, FACTORY_HOOK_SCOPES, FACTORY_HOOK_EVENT_TYPES, FACTORY_TOOL_MAP, DEVIN_HOOK_SCOPES, DEVIN_HOOK_EVENT_TYPES, DEVIN_TOOL_MAP, ANTIGRAVITY_HOOK_SCOPES, ANTIGRAVITY_HOOK_EVENT_TYPES, ANTIGRAVITY_EVENT_MAP, ANTIGRAVITY_TOOL_MAP, ANTIGRAVITY_TOOL_INPUT_MAP, GOOSE_HOOK_SCOPES, GOOSE_HOOK_EVENT_TYPES, GOOSE_TOOL_MAP, GOOSE_TOOL_INPUT_MAP, HOOK_EVENT_TYPES, CLAUDE_INSTALL_EVENT_TYPES, FAILPROOFAI_HOOK_MARKER = "__failproofai_hook__";
 var init_types = __esm(() => {
@@ -578,243 +955,43 @@ var init_tool_name_canonicalize = __esm(() => {
   init_types();
 });
 
-// src/hooks/hook-logger.ts
-import {
-  appendFileSync,
-  renameSync,
-  mkdirSync,
-  existsSync,
-  statSync
-} from "node:fs";
-import { join } from "node:path";
-import { homedir } from "node:os";
-function ensureResolved() {
-  if (resolved)
-    return;
-  resolved = true;
-  const rawLevel = (process.env.FAILPROOFAI_LOG_LEVEL ?? "").toLowerCase();
-  if (rawLevel === "info" || rawLevel === "warn" || rawLevel === "error") {
-    currentLevel = rawLevel;
-  }
-  const rawFile = (process.env.FAILPROOFAI_HOOK_LOG_FILE ?? "").trim();
-  if (rawFile) {
-    fileLoggingEnabled = true;
-    if (rawFile !== "1" && rawFile !== "true") {
-      logDir = rawFile;
+// src/hooks/normalize-cli-payload.ts
+function normalizeCliPayload(cli, parsed) {
+  if (cli === "antigravity") {
+    const tc = parsed.toolCall;
+    if (tc && typeof tc === "object") {
+      if (tc.name !== undefined)
+        parsed.tool_name = tc.name;
+      if (tc.args !== undefined)
+        parsed.tool_input = tc.args;
     }
-  }
-}
-function shouldEmit(level) {
-  ensureResolved();
-  return LEVEL_ORDER[level] >= LEVEL_ORDER[currentLevel];
-}
-function emitStderr(label, msg) {
-  process.stderr.write(`[failproofai:hook] ${label} ${msg}
-`);
-}
-function ensureLogDir() {
-  if (!existsSync(logDir)) {
-    mkdirSync(logDir, { recursive: true });
-  }
-}
-function rotateIfNeeded(filePath) {
-  try {
-    const stats = statSync(filePath);
-    if (stats.size >= MAX_FILE_SIZE) {
-      const archiveName = `hooks-${Date.now()}.log`;
-      renameSync(filePath, join(logDir, archiveName));
+    if (typeof parsed.conversationId === "string")
+      parsed.session_id = parsed.conversationId;
+    if (Array.isArray(parsed.workspacePaths) && typeof parsed.workspacePaths[0] === "string") {
+      parsed.cwd = parsed.workspacePaths[0];
     }
-  } catch {}
-}
-function appendToFile(label, msg) {
-  if (!fileLoggingEnabled)
-    return;
-  try {
-    ensureLogDir();
-    const filePath = join(logDir, LOG_FILENAME);
-    rotateIfNeeded(filePath);
-    const timestamp = new Date().toISOString();
-    const line = `[${timestamp}] ${label} ${msg}
-`;
-    appendFileSync(filePath, line, "utf-8");
-  } catch {}
-}
-function hookLogInfo(msg) {
-  if (!shouldEmit("info"))
-    return;
-  emitStderr("INFO", msg);
-  appendToFile("INFO", msg);
-}
-function hookLogWarn(msg) {
-  if (!shouldEmit("warn"))
-    return;
-  emitStderr("WARN", msg);
-  appendToFile("WARN", msg);
-}
-function hookLogError(msg) {
-  if (!shouldEmit("error"))
-    return;
-  emitStderr("ERROR", msg);
-  appendToFile("ERROR", msg);
-}
-var LEVEL_ORDER, MAX_FILE_SIZE, LOG_FILENAME = "hooks.log", DEFAULT_LOG_DIR, resolved = false, currentLevel = "warn", fileLoggingEnabled = false, logDir;
-var init_hook_logger = __esm(() => {
-  LEVEL_ORDER = { info: 0, warn: 1, error: 2 };
-  MAX_FILE_SIZE = 512 * 1024;
-  DEFAULT_LOG_DIR = join(homedir(), ".failproofai", "logs");
-  logDir = DEFAULT_LOG_DIR;
-});
-
-// src/hooks/hooks-config.ts
-import { readFileSync, writeFileSync, existsSync as existsSync2, mkdirSync as mkdirSync2, statSync as statSync2 } from "node:fs";
-import { resolve, dirname } from "node:path";
-import { homedir as homedir2 } from "node:os";
-function configuredCustomPolicyPaths(config) {
-  return config.customPoliciesPaths ?? (config.customPoliciesPath ? [config.customPoliciesPath] : []);
-}
-function readConfigAt(path2) {
-  if (!existsSync2(path2))
-    return {};
-  try {
-    const raw = readFileSync(path2, "utf8");
-    return JSON.parse(raw);
-  } catch (err) {
-    hookLogWarn(`failed to parse config at ${path2}: ${err instanceof Error ? err.message : String(err)}`);
-    return {};
-  }
-}
-function findProjectConfigDir(start) {
-  const home = homedir2();
-  let dir = resolve(start);
-  while (dir !== home) {
-    const marker = resolve(dir, ".failproofai");
-    try {
-      if (statSync2(marker).isDirectory())
-        return dir;
-    } catch {}
-    const parent = dirname(dir);
-    if (parent === dir)
-      break;
-    dir = parent;
+    if (typeof parsed.transcriptPath === "string")
+      parsed.transcript_path = parsed.transcriptPath;
   }
-  return resolve(start);
-}
-function readMergedHooksConfig(cwd) {
-  const base = findProjectConfigDir(cwd ?? process.cwd());
-  const projectPath = resolve(base, ".failproofai", "policies-config.json");
-  const localPath = resolve(base, ".failproofai", "policies-config.local.json");
-  const globalPath = resolve(homedir2(), ".failproofai", "policies-config.json");
-  const project = readConfigAt(projectPath);
-  const local = readConfigAt(localPath);
-  const global_ = readConfigAt(globalPath);
-  const enabledSet = new Set([
-    ...project.enabledPolicies ?? [],
-    ...local.enabledPolicies ?? [],
-    ...global_.enabledPolicies ?? []
-  ]);
-  const mergedParams = {};
-  for (const scope of [project, local, global_]) {
-    if (!scope.policyParams)
-      continue;
-    for (const [policyName, params] of Object.entries(scope.policyParams)) {
-      if (!(policyName in mergedParams)) {
-        mergedParams[policyName] = params;
-      }
+  if (cli === "copilot") {
+    if (typeof parsed.toolName === "string" && parsed.tool_name === undefined) {
+      parsed.tool_name = parsed.toolName;
     }
-  }
-  const customPoliciesPaths = [project, local, global_].map((scope) => scope.customPoliciesPaths !== undefined ? scope.customPoliciesPaths : scope.customPoliciesPath !== undefined ? [scope.customPoliciesPath] : undefined).find((paths) => paths !== undefined);
-  const disabledCustomPolicies = new Set([
-    ...project.disabledCustomPolicies ?? [],
-    ...local.disabledCustomPolicies ?? [],
-    ...global_.disabledCustomPolicies ?? []
-  ]);
-  const customPoliciesEnabled = project.customPoliciesEnabled ?? local.customPoliciesEnabled ?? global_.customPoliciesEnabled;
-  const llm = project.llm ?? local.llm ?? global_.llm;
-  return {
-    enabledPolicies: [...enabledSet],
-    ...Object.keys(mergedParams).length > 0 ? { policyParams: mergedParams } : {},
-    ...customPoliciesPaths !== undefined ? { customPoliciesPaths } : {},
-    ...disabledCustomPolicies.size ? { disabledCustomPolicies: [...disabledCustomPolicies] } : {},
-    ...customPoliciesEnabled !== undefined ? { customPoliciesEnabled } : {},
-    ...llm !== undefined ? { llm } : {}
-  };
-}
-function getConfigPath() {
-  return resolve(homedir2(), ".failproofai", "policies-config.json");
-}
-function readHooksConfig() {
-  const configPath = getConfigPath();
-  if (!existsSync2(configPath)) {
-    return { enabledPolicies: [] };
-  }
-  try {
-    const raw = readFileSync(configPath, "utf8");
-    return JSON.parse(raw);
-  } catch (err) {
-    hookLogWarn(`failed to parse config at ${configPath}: ${err instanceof Error ? err.message : String(err)}`);
-    return { enabledPolicies: [] };
-  }
-}
-function getConfigPathForScope(scope, cwd) {
-  switch (scope) {
-    case "user":
-      return resolve(homedir2(), ".failproofai", "policies-config.json");
-    case "project":
-      return resolve(findProjectConfigDir(cwd ?? process.cwd()), ".failproofai", "policies-config.json");
-    case "local":
-      return resolve(findProjectConfigDir(cwd ?? process.cwd()), ".failproofai", "policies-config.local.json");
-  }
-}
-function readScopedHooksConfig(scope, cwd) {
-  const configPath = getConfigPathForScope(scope, cwd);
-  if (!existsSync2(configPath)) {
-    return { enabledPolicies: [] };
-  }
-  try {
-    const raw = readFileSync(configPath, "utf8");
-    return JSON.parse(raw);
-  } catch (err) {
-    hookLogWarn(`failed to parse config at ${configPath}: ${err instanceof Error ? err.message : String(err)}`);
-    return { enabledPolicies: [] };
-  }
-}
-function writeScopedHooksConfig(config, scope, cwd) {
-  const configPath = getConfigPathForScope(scope, cwd);
-  const dir = dirname(configPath);
-  if (!existsSync2(dir)) {
-    mkdirSync2(dir, { recursive: true });
-  }
-  writeFileSync(configPath, JSON.stringify(config, null, 2) + `
-`, "utf8");
-}
-function syncConventionPolicies(entries, scope, cwd) {
-  const configPath = getConfigPathForScope(scope, cwd);
-  if (!existsSync2(configPath) && entries.length === 0)
-    return false;
-  if (existsSync2(configPath)) {
-    try {
-      JSON.parse(readFileSync(configPath, "utf8"));
-    } catch {
-      hookLogWarn(`not recording convention policies: ${configPath} is not valid JSON — ` + `fix the syntax error and re-run. Nothing was written.`);
-      return false;
+    if (parsed.toolInput !== undefined && parsed.tool_input === undefined) {
+      parsed.tool_input = parsed.toolInput;
+    }
+    if (typeof parsed.sessionId === "string" && parsed.session_id === undefined) {
+      parsed.session_id = parsed.sessionId;
+    }
+  }
+  if (cli === "goose") {
+    if (typeof parsed.working_dir === "string")
+      parsed.cwd = parsed.working_dir;
+    if (typeof parsed.event === "string" && parsed.hook_event_name === undefined) {
+      parsed.hook_event_name = parsed.event;
     }
   }
-  const config = readScopedHooksConfig(scope, cwd);
-  const sorted = [...entries].sort((a, b) => a.file.localeCompare(b.file));
-  const next = { ...config };
-  if (sorted.length === 0)
-    delete next.conventionPolicies;
-  else
-    next.conventionPolicies = sorted;
-  if (JSON.stringify(next.conventionPolicies ?? null) === JSON.stringify(config.conventionPolicies ?? null)) {
-    return false;
-  }
-  writeScopedHooksConfig(next, scope, cwd);
-  return true;
 }
-var init_hooks_config = __esm(() => {
-  init_hook_logger();
-});
 
 // src/hooks/policy-helpers.ts
 function allow(reason) {
@@ -896,19 +1073,20 @@ function setAllPolicies(policies) {
 var REGISTRY_KEY = "__FAILPROOFAI_POLICY_REGISTRY__", INDEX_CACHE_KEY = "__FAILPROOFAI_POLICY_INDEX_CACHE__", DEFAULT_POLICY_NAMESPACE = "failproofai";
 
 // src/hooks/builtin-policies.ts
-import { resolve as resolve2, join as join2 } from "node:path";
+import { resolve as resolve3, join as join2 } from "node:path";
+import { statSync as statSync3 } from "node:fs";
 import { readFile, writeFile } from "node:fs/promises";
 import { execSync as execSync2, execFileSync } from "node:child_process";
-import { homedir as homedir3 } from "node:os";
+import { homedir as homedir4 } from "node:os";
 function isAgentInternalPath(resolved2) {
   const normResolved = resolved2.replaceAll("\\", "/");
   for (const dir of [".claude", ".codex", ".copilot", ".cursor", ".opencode", ".pi", ".gemini"]) {
-    const root = join2(homedir3(), dir).replaceAll("\\", "/");
+    const root = join2(homedir4(), dir).replaceAll("\\", "/");
     if (normResolved === root || normResolved.startsWith(root + "/"))
       return true;
   }
   for (const sub of [join2(".config", "opencode"), join2(".local", "share", "opencode")]) {
-    const root = join2(homedir3(), sub).replaceAll("\\", "/");
+    const root = join2(homedir4(), sub).replaceAll("\\", "/");
     if (normResolved === root || normResolved.startsWith(root + "/"))
       return true;
   }
@@ -954,17 +1132,30 @@ function getFilePath(ctx) {
 function parseArgvTokens(cmd) {
   return cmd.trim().split(/\s+/).map((t) => t.replace(/^['"]|['"]$/g, ""));
 }
+function statGitHeadMtimeMs(cwd) {
+  try {
+    return statSync3(join2(cwd, ".git", "HEAD")).mtimeMs;
+  } catch {
+    return null;
+  }
+}
 function getCurrentBranch(cwd) {
   try {
-    let branch = gitBranchCache.get(cwd);
-    if (branch === undefined) {
-      branch = execSync2("git rev-parse --abbrev-ref HEAD", {
-        cwd,
-        encoding: "utf8",
-        stdio: ["pipe", "pipe", "pipe"],
-        timeout: 3000
-      }).trim();
-      gitBranchCache.set(cwd, branch);
+    const headMtimeMs = statGitHeadMtimeMs(cwd);
+    const cached = gitBranchCache.get(cwd);
+    if (cached && headMtimeMs !== null && cached.headMtimeMs === headMtimeMs) {
+      return cached.branch || null;
+    }
+    const branch = execSync2("git rev-parse --abbrev-ref HEAD", {
+      cwd,
+      encoding: "utf8",
+      stdio: ["pipe", "pipe", "pipe"],
+      timeout: 3000
+    }).trim();
+    if (headMtimeMs !== null) {
+      if (gitBranchCache.size >= GIT_BRANCH_CACHE_MAX_ENTRIES)
+        gitBranchCache.clear();
+      gitBranchCache.set(cwd, { branch, headMtimeMs });
     }
     return branch || null;
   } catch {
@@ -1233,7 +1424,7 @@ function blockPushMaster(ctx) {
 }
 function expandHomePrefix(path2) {
   const m = path2.match(/^(?:~|\$HOME|\$\{HOME\})(?=$|\/)/);
-  return m ? homedir3() + path2.slice(m[0].length) : path2;
+  return m ? homedir4() + path2.slice(m[0].length) : path2;
 }
 function stripTrailingGlob(path2) {
   return path2.replace(/\/\*$/, "").replace(/\/+$/, "");
@@ -1384,9 +1575,9 @@ function extractAbsolutePaths(command) {
     while ((m = pathRe.exec(s)) !== null) {
       let p = m[0];
       if (p === "~")
-        p = homedir3();
+        p = homedir4();
       else if (p.startsWith("~/"))
-        p = join2(homedir3(), p.slice(2));
+        p = join2(homedir4(), p.slice(2));
       paths.push(p);
     }
   }
@@ -1428,7 +1619,7 @@ function blockReadOutsideCwd(ctx) {
     const paths = extractAbsolutePaths(cmd);
     const cwdWithSep2 = cwd.endsWith("/") ? cwd : cwd + "/";
     for (const p of paths) {
-      const resolved3 = resolve2(cwd, p);
+      const resolved3 = resolve3(cwd, p);
       if (isClaudeSettingsFile(resolved3)) {
         return deny(`Reading agent settings file blocked: ${resolved3}`);
       }
@@ -1449,7 +1640,7 @@ function blockReadOutsideCwd(ctx) {
   const target = filePath || searchPath;
   if (!target)
     return allow();
-  const resolved2 = resolve2(cwd, target);
+  const resolved2 = resolve3(cwd, target);
   if (isClaudeSettingsFile(resolved2)) {
     return deny(`Reading agent settings file blocked: ${resolved2}`);
   }
@@ -1940,7 +2131,7 @@ function registerBuiltinPolicies(enabledNames) {
     }
   }
 }
-var isClaudeInternalPath, isClaudeSettingsFile, SHELL_OPERATORS, SHELL_METACHAR_RE, JWT_RE, API_KEY_PATTERNS, CONNECTION_STRING_RE, PRIVATE_KEY_RE, BEARER_TOKEN_RE, SQL_TOOL_RE, DESTRUCTIVE_SQL_RE, DELETE_NO_WHERE_RE, SQL_WHERE_RE, SCHEMA_ALTER_RE, PUBLISH_CMD_RE, ENV_PRINTENV_RE, ECHO_ENV_RE, EXPORT_RE, PS_ENV_VAR_RE, PS_CHILDITEM_ENV_RE, DOTNET_GETENV_RE, CMD_ECHO_ENV_RE, ENV_FILE_PATH_RE, ENV_CMD_RE, SUDO_RE, PS_ELEVATION_RE, RUNAS_RE, CURL_PIPE_SH_RE, PS_WEB_PIPE_RE, SHORT_FLAG_BUNDLE_RE, SAFE_FORCE_PREFIXES, SECRET_FILE_RE, SECRET_FILE_ID_RSA_RE, SECRET_FILE_CREDENTIALS_RE, GIT_COMMIT_MERGE_RE, FAILPROOFAI_CLI_RE, FAILPROOFAI_UNINSTALL_RE, GIT_AMEND_RE, GIT_STASH_DROP_RE, GIT_ADD_ALL_RE, NPM_GLOBAL_RE, YARN_GLOBAL_RE, PNPM_GLOBAL_RE, BUN_GLOBAL_RE, CARGO_INSTALL_RE, PIP_SYSTEM_RE, PKG_MANAGER_DETECTORS, NOHUP_RE, SCREEN_DETACH_RE, TMUX_DETACH_RE, DISOWN_RE, BACKGROUND_AMPERSAND_RE, KUBECTL_RE, TERRAFORM_RE, AWS_CLI_RE, GCLOUD_RE, AZ_CLI_RE, HELM_RE, GH_PIPELINE_RE, gitBranchCache, HOME_PREFIX_RE, RM_CMD_RE, FIND_CMD_RE, FIND_EXEC_RE, FIND_GLOBAL_OPT_RE, FIND_EXPR_START_RE, SCRATCH_ROOTS, CATASTROPHIC_DEPTH = 2, READ_LIKE_CMDS, TOOL_CALL_TRACKER_MAX_BYTES = 65536, SEGMENT_SPLIT_RE, BUILTIN_POLICIES;
+var isClaudeInternalPath, isClaudeSettingsFile, SHELL_OPERATORS, SHELL_METACHAR_RE, JWT_RE, API_KEY_PATTERNS, CONNECTION_STRING_RE, PRIVATE_KEY_RE, BEARER_TOKEN_RE, SQL_TOOL_RE, DESTRUCTIVE_SQL_RE, DELETE_NO_WHERE_RE, SQL_WHERE_RE, SCHEMA_ALTER_RE, PUBLISH_CMD_RE, ENV_PRINTENV_RE, ECHO_ENV_RE, EXPORT_RE, PS_ENV_VAR_RE, PS_CHILDITEM_ENV_RE, DOTNET_GETENV_RE, CMD_ECHO_ENV_RE, ENV_FILE_PATH_RE, ENV_CMD_RE, SUDO_RE, PS_ELEVATION_RE, RUNAS_RE, CURL_PIPE_SH_RE, PS_WEB_PIPE_RE, SHORT_FLAG_BUNDLE_RE, SAFE_FORCE_PREFIXES, SECRET_FILE_RE, SECRET_FILE_ID_RSA_RE, SECRET_FILE_CREDENTIALS_RE, GIT_COMMIT_MERGE_RE, FAILPROOFAI_CLI_RE, FAILPROOFAI_UNINSTALL_RE, GIT_AMEND_RE, GIT_STASH_DROP_RE, GIT_ADD_ALL_RE, NPM_GLOBAL_RE, YARN_GLOBAL_RE, PNPM_GLOBAL_RE, BUN_GLOBAL_RE, CARGO_INSTALL_RE, PIP_SYSTEM_RE, PKG_MANAGER_DETECTORS, NOHUP_RE, SCREEN_DETACH_RE, TMUX_DETACH_RE, DISOWN_RE, BACKGROUND_AMPERSAND_RE, KUBECTL_RE, TERRAFORM_RE, AWS_CLI_RE, GCLOUD_RE, AZ_CLI_RE, HELM_RE, GH_PIPELINE_RE, gitBranchCache, GIT_BRANCH_CACHE_MAX_ENTRIES = 500, HOME_PREFIX_RE, RM_CMD_RE, FIND_CMD_RE, FIND_EXEC_RE, FIND_GLOBAL_OPT_RE, FIND_EXPR_START_RE, SCRATCH_ROOTS, CATASTROPHIC_DEPTH = 2, READ_LIKE_CMDS, TOOL_CALL_TRACKER_MAX_BYTES = 65536, SEGMENT_SPLIT_RE, BUILTIN_POLICIES;
 var init_builtin_policies = __esm(() => {
   init_hook_logger();
   isClaudeInternalPath = isAgentInternalPath;
@@ -3442,7 +3633,7 @@ var init_custom_hooks_registry = () => {};
 
 // src/hooks/loader-utils.ts
 import { readFile as readFile2, writeFile as writeFile2, unlink, access } from "fs/promises";
-import { resolve as resolve3, dirname as dirname2, relative } from "path";
+import { resolve as resolve4, dirname as dirname2, relative } from "path";
 import { pathToFileURL } from "url";
 async function fileExists(path3) {
   try {
@@ -3455,14 +3646,14 @@ async function fileExists(path3) {
 async function findDistIndex() {
   const distPath = process.env.FAILPROOFAI_DIST_PATH;
   if (distPath) {
-    const candidate = resolve3(distPath, "index.js");
+    const candidate = resolve4(distPath, "index.js");
     if (await fileExists(candidate))
       return candidate;
   }
   const candidates = [
-    resolve3(dirname2(process.execPath), "..", "assets", "dist", "index.js"),
-    resolve3(process.cwd(), "dist", "index.js"),
-    resolve3(process.cwd(), "node_modules", "failproofai", "dist", "index.js")
+    resolve4(dirname2(process.execPath), "..", "assets", "dist", "index.js"),
+    resolve4(process.cwd(), "dist", "index.js"),
+    resolve4(process.cwd(), "node_modules", "failproofai", "dist", "index.js")
   ];
   for (const c of candidates) {
     if (await fileExists(c))
@@ -3471,8 +3662,8 @@ async function findDistIndex() {
   return null;
 }
 async function resolveLocalImport(fromDir, specifier) {
-  const base = resolve3(fromDir, specifier);
-  const candidates = [base, `${base}.js`, `${base}.mjs`, `${base}.ts`, resolve3(base, "index.js")];
+  const base = resolve4(fromDir, specifier);
+  const candidates = [base, `${base}.js`, `${base}.mjs`, `${base}.ts`, resolve4(base, "index.js")];
   for (const c of candidates) {
     if (await fileExists(c))
       return c;
@@ -3565,16 +3756,16 @@ var init_loader_utils = __esm(() => {
 });
 
 // src/hooks/custom-hooks-loader.ts
-import { resolve as resolve4, isAbsolute, basename } from "node:path";
+import { resolve as resolve5, isAbsolute, basename } from "node:path";
 import { existsSync as existsSync3, readdirSync } from "node:fs";
 import { pathToFileURL as pathToFileURL2 } from "node:url";
-import { homedir as homedir4 } from "node:os";
+import { homedir as homedir5 } from "node:os";
 function discoverPolicyFiles(dir) {
   if (!existsSync3(dir))
     return [];
   try {
     const entries = readdirSync(dir, { withFileTypes: true });
-    return entries.filter((e) => e.isFile() && CONVENTION_FILE_RE.test(e.name)).sort((a, b) => a.name.localeCompare(b.name)).map((e) => resolve4(dir, e.name));
+    return entries.filter((e) => e.isFile() && CONVENTION_FILE_RE.test(e.name)).sort((a, b) => a.name.localeCompare(b.name)).map((e) => resolve5(dir, e.name));
   } catch {
     return [];
   }
@@ -3619,7 +3810,7 @@ async function loadSingleFile(absPath, opts) {
 async function loadCustomHooks(customPoliciesPath, opts) {
   if (!customPoliciesPath)
     return [];
-  const absPath = isAbsolute(customPoliciesPath) ? customPoliciesPath : resolve4(opts?.sessionCwd ?? process.cwd(), customPoliciesPath);
+  const absPath = isAbsolute(customPoliciesPath) ? customPoliciesPath : resolve5(opts?.sessionCwd ?? process.cwd(), customPoliciesPath);
   if (!existsSync3(absPath)) {
     if (opts?.strict)
       throw new Error(`Custom hooks file not found: ${absPath}`);
@@ -3650,7 +3841,7 @@ async function loadAllCustomHooks(customPoliciesPaths, opts) {
   const conventionEnabled = opts?.customPoliciesEnabled !== false;
   const loadedPaths = new Set;
   for (const customPoliciesPath of typeof customPoliciesPaths === "string" ? [customPoliciesPaths] : customPoliciesPaths ?? []) {
-    const absPath = resolve4(projectRoot, customPoliciesPath);
+    const absPath = resolve5(projectRoot, customPoliciesPath);
     if (existsSync3(absPath)) {
       if (!loadedPaths.has(absPath)) {
         loadedPaths.add(absPath);
@@ -3665,7 +3856,7 @@ async function loadAllCustomHooks(customPoliciesPaths, opts) {
     }
   }
   const hooksBeforeConvention = getCustomHooks().length;
-  const projectDir = resolve4(projectRoot, ".failproofai", "policies");
+  const projectDir = resolve5(projectRoot, ".failproofai", "policies");
   if (conventionEnabled)
     warnSkippedPolicyFiles(projectDir, "project");
   const projectFiles = conventionEnabled ? discoverPolicyFiles(projectDir).filter((f) => !loadedPaths.has(f)) : [];
@@ -3685,7 +3876,7 @@ async function loadAllCustomHooks(customPoliciesPaths, opts) {
       });
     }
   }
-  const userDir = resolve4(homedir4(), ".failproofai", "policies");
+  const userDir = resolve5(homedir5(), ".failproofai", "policies");
   if (conventionEnabled && userDir !== projectDir)
     warnSkippedPolicyFiles(userDir, "user");
   const userFiles = conventionEnabled && userDir !== projectDir ? discoverPolicyFiles(userDir).filter((f) => !loadedPaths.has(f)) : [];
@@ -3750,11 +3941,11 @@ import {
   readdirSync as readdirSync2,
   mkdirSync as mkdirSync3,
   existsSync as existsSync4,
-  statSync as statSync3,
+  statSync as statSync4,
   unlinkSync
 } from "node:fs";
 import { join as join3 } from "node:path";
-import { homedir as homedir5 } from "node:os";
+import { homedir as homedir6 } from "node:os";
 function ensureDir() {
   if (!existsSync4(storeDir)) {
     mkdirSync3(storeDir, { recursive: true });
@@ -3772,7 +3963,7 @@ function acquireLock() {
       if (e.code !== "EEXIST")
         return;
       try {
-        const s = statSync3(lockPath);
+        const s = statSync4(lockPath);
         if (Date.now() - s.mtimeMs > LOCK_STALE_MS) {
           writeFileSync2(lockPath, String(process.pid), "utf-8");
           return;
@@ -3859,7 +4050,7 @@ function updateStats(entry) {
 }
 var PAGE_SIZE = 25, DEFAULT_STORE_DIR, CURRENT_FILE = "current.jsonl", COUNT_FILE = "current.count", STATS_FILE = "stats.json", LOCK_FILE = "current.lock", LOCK_STALE_MS = 2000, storeDir, rotateSeq = 0;
 var init_hook_activity_store = __esm(() => {
-  DEFAULT_STORE_DIR = join3(homedir5(), ".failproofai", "cache", "hook-activity");
+  DEFAULT_STORE_DIR = join3(homedir6(), ".failproofai", "cache", "hook-activity");
   storeDir = DEFAULT_STORE_DIR;
 });
 
@@ -3909,10 +4100,10 @@ function runtimeCache(fn, revalidateSeconds, options) {
 }
 
 // lib/paths.ts
-import { homedir as homedir6 } from "os";
+import { homedir as homedir7 } from "os";
 import { join as join4 } from "path";
 function getDefaultClaudeProjectsPath() {
-  return join4(homedir6(), ".claude", "projects");
+  return join4(homedir7(), ".claude", "projects");
 }
 function decodeFolderName(name) {
   if (/^[A-Za-z]--/.test(name)) {
@@ -4006,7 +4197,7 @@ __export(exports_codex_projects, {
   getCachedCodexProjects: () => getCachedCodexProjects
 });
 import { open as open2, readdir } from "node:fs/promises";
-import { homedir as homedir7 } from "node:os";
+import { homedir as homedir8 } from "node:os";
 import { join as join5 } from "node:path";
 async function safeReaddir(dir) {
   try {
@@ -4185,7 +4376,7 @@ var CODEX_SESSIONS_ROOT, SESSION_ID_RE, FIRST_LINE_CHUNK_BYTES, cachedScan, getC
 var init_codex_projects = __esm(() => {
   init_paths();
   init_logger();
-  CODEX_SESSIONS_ROOT = join5(homedir7(), ".codex", "sessions");
+  CODEX_SESSIONS_ROOT = join5(homedir8(), ".codex", "sessions");
   SESSION_ID_RE = /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/i;
   FIRST_LINE_CHUNK_BYTES = 256 * 1024;
   cachedScan = runtimeCache(scanCodexSessions, 30);
@@ -4205,10 +4396,10 @@ __export(exports_copilot_projects, {
   getCachedCopilotProjects: () => getCachedCopilotProjects
 });
 import { readdir as readdir2, readFile as readFile3, stat as stat2 } from "node:fs/promises";
-import { homedir as homedir8 } from "node:os";
+import { homedir as homedir9 } from "node:os";
 import { join as join6 } from "node:path";
 function getCopilotSessionStateRoot() {
-  return join6(process.env.COPILOT_HOME || join6(homedir8(), ".copilot"), "session-state");
+  return join6(process.env.COPILOT_HOME || join6(homedir9(), ".copilot"), "session-state");
 }
 async function safeReaddir2(dir) {
   try {
@@ -4353,10 +4544,10 @@ __export(exports_cursor_projects, {
   getCachedCursorProjects: () => getCachedCursorProjects
 });
 import { readdir as readdir3, readFile as readFile4, stat as stat3 } from "node:fs/promises";
-import { homedir as homedir9 } from "node:os";
+import { homedir as homedir10 } from "node:os";
 import { join as join7 } from "node:path";
 function getCursorHome() {
-  return process.env.CURSOR_HOME || join7(homedir9(), ".cursor");
+  return process.env.CURSOR_HOME || join7(homedir10(), ".cursor");
 }
 async function safeReaddir3(dir) {
   try {
@@ -4726,10 +4917,10 @@ __export(exports_pi_projects, {
   getCachedPiProjects: () => getCachedPiProjects
 });
 import { readdir as readdir4, readFile as readFile5, stat as stat4 } from "node:fs/promises";
-import { homedir as homedir10 } from "node:os";
+import { homedir as homedir11 } from "node:os";
 import { join as join8 } from "node:path";
 function getPiSessionsRoot() {
-  return process.env.PI_SESSIONS_DIR || join8(homedir10(), ".pi", "agent", "sessions");
+  return process.env.PI_SESSIONS_DIR || join8(homedir11(), ".pi", "agent", "sessions");
 }
 async function safeReaddir4(dir) {
   try {
@@ -4949,18 +5140,18 @@ var init_sqlite_reader = () => {};
 
 // lib/hermes-profiles.ts
 import { readdirSync as readdirSync3 } from "node:fs";
-import { homedir as homedir11 } from "node:os";
-import { basename as basename2, dirname as dirname3, join as join9, resolve as resolve5 } from "node:path";
+import { homedir as homedir12 } from "node:os";
+import { basename as basename2, dirname as dirname3, join as join9, resolve as resolve6 } from "node:path";
 function hermesRoot() {
   const env = (process.env.HERMES_HOME || "").trim();
   if (env) {
-    const home = resolve5(env);
+    const home = resolve6(env);
     const parent = dirname3(home);
     if (basename2(parent) === PROFILES_DIR)
       return dirname3(parent);
     return home;
   }
-  return join9(homedir11(), ".hermes");
+  return join9(homedir12(), ".hermes");
 }
 function listHermesProfiles() {
   const root = hermesRoot();
@@ -5331,11 +5522,11 @@ var init_hermes_projects = __esm(() => {
 
 // lib/openclaw-sessions.ts
 import { readFile as readFile6 } from "node:fs/promises";
-import { readdirSync as readdirSync4, statSync as statSync4 } from "node:fs";
-import { homedir as homedir12 } from "node:os";
+import { readdirSync as readdirSync4, statSync as statSync5 } from "node:fs";
+import { homedir as homedir13 } from "node:os";
 import { join as join11 } from "node:path";
 function openclawHome() {
-  return process.env.OPENCLAW_HOME || join11(homedir12(), ".openclaw");
+  return process.env.OPENCLAW_HOME || join11(homedir13(), ".openclaw");
 }
 function isPlainObject2(v) {
   return !!v && typeof v === "object" && !Array.isArray(v);
@@ -5480,7 +5671,7 @@ function listOpenClawTranscripts() {
         continue;
       const transcriptPath = join11(sessionsDir, file);
       try {
-        const st = statSync4(transcriptPath);
+        const st = statSync5(transcriptPath);
         out.push({ agentId, sessionId, transcriptPath, mtimeMs: st.mtimeMs, sizeBytes: st.size });
       } catch {}
     }
@@ -5700,11 +5891,11 @@ var init_openclaw_projects = __esm(() => {
 
 // lib/factory-sessions.ts
 import { readFile as readFile7 } from "node:fs/promises";
-import { readdirSync as readdirSync5, statSync as statSync5 } from "node:fs";
-import { homedir as homedir13 } from "node:os";
+import { readdirSync as readdirSync5, statSync as statSync6 } from "node:fs";
+import { homedir as homedir14 } from "node:os";
 import { join as join13 } from "node:path";
 function factoryHome() {
-  return process.env.FACTORY_HOME || join13(homedir13(), ".factory");
+  return process.env.FACTORY_HOME || join13(homedir14(), ".factory");
 }
 function factorySessionsRoot() {
   return join13(factoryHome(), "sessions");
@@ -5868,7 +6059,7 @@ function listFactoryTranscripts() {
         continue;
       const transcriptPath = join13(projectPath, file);
       try {
-        const st = statSync5(transcriptPath);
+        const st = statSync6(transcriptPath);
         out.push({ projectName, cwd, sessionId, transcriptPath, mtimeMs: st.mtimeMs, sizeBytes: st.size });
       } catch {}
     }
@@ -5992,10 +6183,10 @@ var init_factory_projects = __esm(() => {
 });
 
 // lib/devin-sessions.ts
-import { homedir as homedir14 } from "node:os";
+import { homedir as homedir15 } from "node:os";
 import { join as join14 } from "node:path";
 function devinHome() {
-  return process.env.DEVIN_HOME || join14(homedir14(), ".local", "share", "devin");
+  return process.env.DEVIN_HOME || join14(homedir15(), ".local", "share", "devin");
 }
 function devinDbPath() {
   return process.env.DEVIN_DB_PATH || join14(devinHome(), "cli", "sessions.db");
@@ -6295,11 +6486,11 @@ var init_devin_projects = __esm(() => {
 
 // lib/antigravity-sessions.ts
 import { readFile as readFile8 } from "node:fs/promises";
-import { readdirSync as readdirSync6, statSync as statSync6 } from "node:fs";
-import { homedir as homedir15 } from "node:os";
+import { readdirSync as readdirSync6, statSync as statSync7 } from "node:fs";
+import { homedir as homedir16 } from "node:os";
 import { join as join15 } from "node:path";
 function antigravityHome() {
-  return process.env.ANTIGRAVITY_HOME || join15(homedir15(), ".gemini", "antigravity-cli");
+  return process.env.ANTIGRAVITY_HOME || join15(homedir16(), ".gemini", "antigravity-cli");
 }
 function antigravityBrainRoot() {
   return join15(antigravityHome(), "brain");
@@ -6430,7 +6621,7 @@ function listAntigravityTranscripts() {
       continue;
     const transcriptPath = join15(root, conversationId, rel);
     try {
-      const st = statSync6(transcriptPath);
+      const st = statSync7(transcriptPath);
       if (!st.isFile())
         continue;
       out.push({ conversationId, transcriptPath, mtimeMs: st.mtimeMs, sizeBytes: st.size });
@@ -6443,7 +6634,7 @@ function findAntigravityTranscript(conversationId) {
     return null;
   const transcriptPath = join15(antigravityBrainRoot(), conversationId, antigravityTranscriptRelPath());
   try {
-    if (statSync6(transcriptPath).isFile())
+    if (statSync7(transcriptPath).isFile())
       return transcriptPath;
   } catch {}
   return null;
@@ -6626,13 +6817,13 @@ var init_antigravity_projects = __esm(() => {
 });
 
 // lib/goose-sessions.ts
-import { homedir as homedir16 } from "node:os";
+import { homedir as homedir17 } from "node:os";
 import { join as join17 } from "node:path";
 function gooseHome() {
   if (process.env.GOOSE_HOME)
     return process.env.GOOSE_HOME;
   const xdg = process.env.XDG_DATA_HOME;
-  return join17(xdg && xdg.length > 0 ? xdg : join17(homedir16(), ".local", "share"), "goose");
+  return join17(xdg && xdg.length > 0 ? xdg : join17(homedir17(), ".local", "share"), "goose");
 }
 function gooseDbPath() {
   return process.env.GOOSE_DB_PATH || join17(gooseHome(), "sessions", "sessions.db");
@@ -6903,7 +7094,7 @@ var init_goose_projects = __esm(() => {
 
 // lib/projects.ts
 import { readdir as readdir5, stat as stat5 } from "node:fs/promises";
-import { join as join18, resolve as resolve6, sep } from "node:path";
+import { join as join18, resolve as resolve7, sep } from "node:path";
 async function getMtime(path3, label) {
   try {
     return (await stat5(path3)).mtime;
@@ -7055,8 +7246,8 @@ function resolveProjectPath(projectName) {
     throw new RangeError("Empty project name");
   if (/^[/\\]/.test(projectName))
     throw new RangeError("Absolute project name");
-  const projectsPath = resolve6(getClaudeProjectsPath());
-  const candidate = resolve6(join18(projectsPath, projectName));
+  const projectsPath = resolve7(getClaudeProjectsPath());
+  const candidate = resolve7(join18(projectsPath, projectName));
   if (!candidate.startsWith(projectsPath + sep)) {
     throw new RangeError("Project path escapes root");
   }
@@ -7366,10 +7557,10 @@ var init_log_entries = __esm(() => {
 });
 
 // lib/codex-sessions.ts
-import { readFileSync as readFileSync5, readdirSync as readdirSync7, existsSync as existsSync6, writeFileSync as writeFileSync3, mkdirSync as mkdirSync4, statSync as statSync7 } from "node:fs";
+import { readFileSync as readFileSync5, readdirSync as readdirSync7, existsSync as existsSync6, writeFileSync as writeFileSync3, mkdirSync as mkdirSync4, statSync as statSync8 } from "node:fs";
 import { readFile as readFile10 } from "node:fs/promises";
 import { dirname as dirname4, join as join21 } from "node:path";
-import { homedir as homedir17 } from "node:os";
+import { homedir as homedir18 } from "node:os";
 function readCache() {
   try {
     if (!existsSync6(CACHE_PATH))
@@ -7402,7 +7593,7 @@ function findCodexTranscript(sessionId) {
   const cached = cache[sessionId];
   if (cached && existsSync6(cached))
     return cached;
-  const root = join21(homedir17(), ".codex", "sessions");
+  const root = join21(homedir18(), ".codex", "sessions");
   const today = new Date;
   const yesterday = new Date(today.getTime() - 24 * 60 * 60 * 1000);
   const datedDirs = [today, yesterday].map((d) => {
@@ -7648,7 +7839,7 @@ async function getCodexSessionLog(sessionId) {
 var CACHE_PATH, getCachedCodexSessionLog;
 var init_codex_sessions = __esm(() => {
   init_log_entries();
-  CACHE_PATH = join21(homedir17(), ".failproofai", "cache", "codex-session-paths.json");
+  CACHE_PATH = join21(homedir18(), ".failproofai", "cache", "codex-session-paths.json");
   getCachedCodexSessionLog = runtimeCache((sessionId) => getCodexSessionLog(sessionId), 60, { maxSize: 50 });
 });
 
@@ -7693,12 +7884,12 @@ var init_resolve_permission_mode = __esm(() => {
 });
 
 // lib/copilot-sessions.ts
-import { readFileSync as readFileSync7, readdirSync as readdirSync8, existsSync as existsSync7, statSync as statSync8 } from "node:fs";
+import { readFileSync as readFileSync7, readdirSync as readdirSync8, existsSync as existsSync7, statSync as statSync9 } from "node:fs";
 import { readFile as readFile11 } from "node:fs/promises";
-import { join as join22, resolve as resolve7, sep as sep2 } from "node:path";
-import { homedir as homedir18 } from "node:os";
+import { join as join22, resolve as resolve8, sep as sep2 } from "node:path";
+import { homedir as homedir19 } from "node:os";
 function getCopilotHome() {
-  return process.env.COPILOT_HOME || join22(homedir18(), ".copilot");
+  return process.env.COPILOT_HOME || join22(homedir19(), ".copilot");
 }
 function getCopilotSessionStateRoot2() {
   return join22(getCopilotHome(), "session-state");
@@ -7706,8 +7897,8 @@ function getCopilotSessionStateRoot2() {
 function getCopilotSessionDir(sessionId) {
   if (!sessionId)
     return null;
-  const root = resolve7(getCopilotSessionStateRoot2());
-  const candidate = resolve7(root, sessionId);
+  const root = resolve8(getCopilotSessionStateRoot2());
+  const candidate = resolve8(root, sessionId);
   if (candidate === root || !candidate.startsWith(`${root}${sep2}`))
     return null;
   return candidate;
@@ -7910,18 +8101,18 @@ var init_copilot_sessions = __esm(() => {
 });
 
 // lib/cursor-sessions.ts
-import { readFileSync as readFileSync8, readdirSync as readdirSync9, existsSync as existsSync8, statSync as statSync9 } from "node:fs";
+import { readFileSync as readFileSync8, readdirSync as readdirSync9, existsSync as existsSync8, statSync as statSync10 } from "node:fs";
 import { readFile as readFile12 } from "node:fs/promises";
-import { basename as basename3, join as join23, resolve as resolve8, sep as sep3 } from "node:path";
-import { homedir as homedir19 } from "node:os";
+import { basename as basename3, join as join23, resolve as resolve9, sep as sep3 } from "node:path";
+import { homedir as homedir20 } from "node:os";
 function getCursorHome2() {
-  return process.env.CURSOR_HOME || join23(homedir19(), ".cursor");
+  return process.env.CURSOR_HOME || join23(homedir20(), ".cursor");
 }
 function getCursorSessionDir(sessionId) {
   if (!sessionId)
     return null;
-  const home = resolve8(getCursorHome2());
-  const projectsRoot = resolve8(home, NEW_PROJECTS_DIR2);
+  const home = resolve9(getCursorHome2());
+  const projectsRoot = resolve9(home, NEW_PROJECTS_DIR2);
   let projectEntries = [];
   try {
     projectEntries = readdirSync9(projectsRoot, { withFileTypes: true });
@@ -7929,16 +8120,16 @@ function getCursorSessionDir(sessionId) {
   for (const entry of projectEntries) {
     if (!entry.isDirectory())
       continue;
-    const candidate = resolve8(projectsRoot, entry.name, NEW_AGENT_TRANSCRIPTS_DIR2, sessionId);
-    const transcriptRoot = resolve8(projectsRoot, entry.name, NEW_AGENT_TRANSCRIPTS_DIR2);
+    const candidate = resolve9(projectsRoot, entry.name, NEW_AGENT_TRANSCRIPTS_DIR2, sessionId);
+    const transcriptRoot = resolve9(projectsRoot, entry.name, NEW_AGENT_TRANSCRIPTS_DIR2);
     if (candidate === transcriptRoot || !candidate.startsWith(`${transcriptRoot}${sep3}`))
       continue;
     if (existsSync8(candidate))
       return candidate;
   }
   for (const sub of LEGACY_SESSION_ROOT_CANDIDATES2) {
-    const root = resolve8(home, sub);
-    const candidate = resolve8(root, sessionId);
+    const root = resolve9(home, sub);
+    const candidate = resolve9(root, sessionId);
     if (candidate === root || !candidate.startsWith(`${root}${sep3}`))
       continue;
     if (existsSync8(candidate))
@@ -8166,12 +8357,12 @@ var init_cursor_sessions = __esm(() => {
 });
 
 // lib/pi-sessions.ts
-import { readFileSync as readFileSync9, readdirSync as readdirSync10, existsSync as existsSync9, statSync as statSync10 } from "node:fs";
+import { readFileSync as readFileSync9, readdirSync as readdirSync10, existsSync as existsSync9, statSync as statSync11 } from "node:fs";
 import { readFile as readFile13 } from "node:fs/promises";
-import { join as join24, resolve as resolve9, sep as sep4 } from "node:path";
-import { homedir as homedir20 } from "node:os";
+import { join as join24, resolve as resolve10, sep as sep4 } from "node:path";
+import { homedir as homedir21 } from "node:os";
 function getPiSessionStateRoot() {
-  return process.env.PI_SESSIONS_DIR || join24(homedir20(), ".pi", "agent", "sessions");
+  return process.env.PI_SESSIONS_DIR || join24(homedir21(), ".pi", "agent", "sessions");
 }
 function isSafeSessionId(sessionId) {
   return UUID_RE.test(sessionId);
@@ -8179,7 +8370,7 @@ function isSafeSessionId(sessionId) {
 function findPiTranscript(sessionId) {
   if (!isSafeSessionId(sessionId))
     return null;
-  const root = resolve9(getPiSessionStateRoot());
+  const root = resolve10(getPiSessionStateRoot());
   let cwdDirs;
   try {
     cwdDirs = readdirSync10(root);
@@ -8187,7 +8378,7 @@ function findPiTranscript(sessionId) {
     return null;
   }
   for (const cwdDir of cwdDirs) {
-    const cwdPath = resolve9(root, cwdDir);
+    const cwdPath = resolve10(root, cwdDir);
     if (!cwdPath.startsWith(`${root}${sep4}`))
       continue;
     let files;
@@ -8200,7 +8391,7 @@ function findPiTranscript(sessionId) {
       const m = SESSION_FILE_RE2.exec(f);
       if (!m || m[1].toLowerCase() !== sessionId.toLowerCase())
         continue;
-      const candidate = resolve9(cwdPath, f);
+      const candidate = resolve10(cwdPath, f);
       if (!candidate.startsWith(`${cwdPath}${sep4}`))
         continue;
       if (existsSync9(candidate))
@@ -8399,10 +8590,43 @@ var init_resolve_transcript_path = __esm(() => {
   init_antigravity_sessions();
 });
 
+// src/hooks/read-stdin.ts
+async function readStdinPayload2(maxBytes = 1048576) {
+  let payload = "";
+  let oversized = false;
+  let readError = false;
+  try {
+    payload = await new Promise((resolve11, reject) => {
+      const chunks = [];
+      let totalBytes = 0;
+      process.stdin.setEncoding("utf8");
+      process.stdin.on("data", (chunk) => {
+        totalBytes += Buffer.byteLength(chunk);
+        if (totalBytes > maxBytes) {
+          oversized = true;
+          process.stdin.destroy();
+          resolve11("");
+          return;
+        }
+        chunks.push(chunk);
+      });
+      process.stdin.on("end", () => resolve11(chunks.join("")));
+      process.stdin.on("error", reject);
+      if (process.stdin.readableEnded)
+        resolve11("");
+    });
+  } catch {
+    readError = true;
+  }
+  return { payload, oversized, readError };
+}
+
 // src/hooks/handler.ts
 var exports_handler = {};
 __export(exports_handler, {
-  handleHookEvent: () => handleHookEvent
+  handleHookEvent: () => handleHookEvent,
+  evaluateHookEvent: () => evaluateHookEvent,
+  canonicalizeEventType: () => canonicalizeEventType
 });
 function canonicalizeEventType(raw, cli) {
   if (cli === "codex") {
@@ -8437,95 +8661,23 @@ function canonicalizeEventType(raw, cli) {
   }
   return raw;
 }
-async function handleHookEvent(eventType, cli = "claude") {
+async function evaluateHookEvent(eventType, cli = "claude", stdinPayload, opts) {
   const startTime = performance.now();
   try {
-    const MAX_STDIN_BYTES = 1048576;
-    let payload = "";
-    let stdinOversized = false;
-    try {
-      payload = await new Promise((resolve10, reject) => {
-        const chunks = [];
-        let totalBytes = 0;
-        process.stdin.setEncoding("utf8");
-        process.stdin.on("data", (chunk) => {
-          totalBytes += Buffer.byteLength(chunk);
-          if (totalBytes > MAX_STDIN_BYTES) {
-            hookLogWarn(`stdin payload exceeds 1 MB for ${eventType}, discarding`);
-            stdinOversized = true;
-            process.stdin.destroy();
-            resolve10("");
-            return;
-          }
-          chunks.push(chunk);
-        });
-        process.stdin.on("end", () => resolve10(chunks.join("")));
-        process.stdin.on("error", reject);
-        if (process.stdin.readableEnded)
-          resolve10("");
-      });
-    } catch (err) {
-      hookLogWarn(`stdin read failed for ${eventType}`);
-      trackHookEvent2(getInstanceId2(), "hook_stdin_error", {
-        event_type: eventType,
-        cli,
-        error_type: err instanceof Error ? err.name : "unknown"
-      });
-    }
-    if (stdinOversized) {
-      trackHookEvent2(getInstanceId2(), "hook_stdin_error", {
-        event_type: eventType,
-        cli,
-        error_type: "oversized"
-      });
-    }
     let parsed = {};
-    if (payload) {
+    if (stdinPayload) {
       try {
-        parsed = JSON.parse(payload);
+        parsed = JSON.parse(stdinPayload);
       } catch {
-        hookLogWarn(`payload parse failed for ${eventType} (${payload.length} bytes)`);
+        hookLogWarn(`payload parse failed for ${eventType} (${stdinPayload.length} bytes)`);
         trackHookEvent2(getInstanceId2(), "hook_payload_parse_error", {
           event_type: eventType,
           cli,
-          payload_size: payload.length
+          payload_size: stdinPayload.length
         });
       }
     }
-    if (cli === "antigravity") {
-      const tc = parsed.toolCall;
-      if (tc && typeof tc === "object") {
-        if (tc.name !== undefined)
-          parsed.tool_name = tc.name;
-        if (tc.args !== undefined)
-          parsed.tool_input = tc.args;
-      }
-      if (typeof parsed.conversationId === "string")
-        parsed.session_id = parsed.conversationId;
-      if (Array.isArray(parsed.workspacePaths) && typeof parsed.workspacePaths[0] === "string") {
-        parsed.cwd = parsed.workspacePaths[0];
-      }
-      if (typeof parsed.transcriptPath === "string")
-        parsed.transcript_path = parsed.transcriptPath;
-    }
-    if (cli === "copilot") {
-      if (typeof parsed.toolName === "string" && parsed.tool_name === undefined) {
-        parsed.tool_name = parsed.toolName;
-      }
-      if (parsed.toolInput !== undefined && parsed.tool_input === undefined) {
-        parsed.tool_input = parsed.toolInput;
-      }
-      if (typeof parsed.sessionId === "string" && parsed.session_id === undefined) {
-        parsed.session_id = parsed.sessionId;
-      }
-    }
-    if (cli === "goose") {
-      if (typeof parsed.working_dir === "string")
-        parsed.cwd = parsed.working_dir;
-      if (typeof parsed.event === "string" && parsed.hook_event_name === undefined) {
-        parsed.hook_event_name = parsed.event;
-      }
-    }
+    normalizeCliPayload(cli, parsed);
     const canonicalEventType = canonicalizeEventType(eventType, cli);
     const rawToolName = parsed.tool_name;
     const canonicalToolName = canonicalizeToolName(rawToolName, cli);
@@ -8541,82 +8693,86 @@ async function handleHookEvent(eventType, cli = "claude") {
     const session = {
       sessionId,
       transcriptPath: resolveTranscriptPath(cli, parsed, sessionId),
-      cwd: resolveCwd(cli, parsed),
+      cwd: resolveCwd(cli, parsed) ?? opts?.fallbackCwd,
       permissionMode: resolvePermissionMode(cli, parsed, sessionId),
       hookEventName: parsed.hook_event_name,
       rawHookEventName: eventType,
       cli
     };
-    const config = readMergedHooksConfig(session.cwd);
-    clearPolicies();
-    registerBuiltinPolicies(config.enabledPolicies);
-    const loadResult = await loadAllCustomHooks(config.customPoliciesPaths ?? config.customPoliciesPath, {
-      sessionCwd: session.cwd,
-      customPoliciesEnabled: config.customPoliciesEnabled
-    });
-    const customHooksList = loadResult.hooks;
-    const disabledCustomPolicies = new Set(config.disabledCustomPolicies ?? []);
-    const conventionHookNames = new Set(loadResult.conventionSources.flatMap((s) => s.hookNames));
-    for (const hook of customHooksList) {
-      const policyId = hook.__policyId;
-      if (policyId && disabledCustomPolicies.has(policyId))
-        continue;
-      const hookName = hook.name;
-      const conventionScope = hook.__conventionScope;
-      const isConvention = !!conventionScope;
-      const prefix = isConvention ? `.failproofai-${conventionScope}` : "custom";
-      const fn = async (ctx) => {
-        try {
-          const result2 = await Promise.race([
-            hook.fn(ctx),
-            new Promise((_, reject) => setTimeout(() => reject(new Error("timeout")), 1e4))
-          ]);
-          return result2;
-        } catch (err) {
-          const msg = err instanceof Error ? err.message : String(err);
-          const isTimeout = msg === "timeout";
-          hookLogWarn(`${prefix} hook "${hookName}" failed: ${msg}`);
-          trackHookEvent2(getInstanceId2(), "custom_hook_error", {
-            hook_name: hookName,
-            error_type: isTimeout ? "timeout" : "exception",
-            event_type: eventType,
-            cli,
-            is_convention_policy: isConvention,
-            convention_scope: conventionScope ?? null
-          });
-          return { decision: "allow" };
-        }
-      };
-      registerPolicy(`${prefix}/${hookName}`, hook.description ?? "", fn, hook.match ?? {}, -1);
-    }
-    if (customHooksList.length > 0) {
-      trackHookEvent2(getInstanceId2(), "custom_hooks_loaded", {
-        cli,
-        custom_hooks_count: customHooksList.length,
-        custom_hook_names: customHooksList.map((h) => h.name),
-        event_types_covered: [...new Set(customHooksList.flatMap((h) => h.match?.events ?? []))]
-      });
-    }
-    if (loadResult.conventionSources.length > 0) {
-      trackHookEvent2(getInstanceId2(), "convention_policies_loaded", {
-        event_type: canonicalEventType,
-        cli,
-        project_file_count: loadResult.conventionSources.filter((s) => s.scope === "project").length,
-        user_file_count: loadResult.conventionSources.filter((s) => s.scope === "user").length,
-        convention_hook_count: conventionHookNames.size,
-        convention_hook_names: [...conventionHookNames]
+    let config;
+    let customHooksList = [];
+    let conventionHookNames = new Set;
+    if (opts?.forceDecision) {
+      config = { enabledPolicies: [] };
+      clearPolicies();
+      const decision = opts.forceDecision;
+      registerPolicy("failproofai/daemon-unreachable", "Fail-closed: the failproofaid daemon could not be reached for this daemon-configured scope.", async () => ({ decision: decision.decision, reason: decision.reason }), {});
+    } else {
+      config = readMergedHooksConfig(session.cwd);
+      clearPolicies();
+      registerBuiltinPolicies(config.enabledPolicies);
+      const loadResult = await loadAllCustomHooks(config.customPoliciesPaths ?? config.customPoliciesPath, {
+        sessionCwd: session.cwd,
+        customPoliciesEnabled: config.customPoliciesEnabled
       });
+      customHooksList = loadResult.hooks;
+      const disabledCustomPolicies = new Set(config.disabledCustomPolicies ?? []);
+      conventionHookNames = new Set(loadResult.conventionSources.flatMap((s) => s.hookNames));
+      for (const hook of customHooksList) {
+        const policyId = hook.__policyId;
+        if (policyId && disabledCustomPolicies.has(policyId))
+          continue;
+        const hookName = hook.name;
+        const conventionScope = hook.__conventionScope;
+        const isConvention = !!conventionScope;
+        const prefix = isConvention ? `.failproofai-${conventionScope}` : "custom";
+        const fn = async (ctx) => {
+          try {
+            const result2 = await Promise.race([
+              hook.fn(ctx),
+              new Promise((_, reject) => setTimeout(() => reject(new Error("timeout")), 1e4))
+            ]);
+            return result2;
+          } catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            const isTimeout = msg === "timeout";
+            hookLogWarn(`${prefix} hook "${hookName}" failed: ${msg}`);
+            trackHookEvent2(getInstanceId2(), "custom_hook_error", {
+              hook_name: hookName,
+              error_type: isTimeout ? "timeout" : "exception",
+              event_type: eventType,
+              cli,
+              is_convention_policy: isConvention,
+              convention_scope: conventionScope ?? null
+            });
+            return { decision: "allow" };
+          }
+        };
+        registerPolicy(`${prefix}/${hookName}`, hook.description ?? "", fn, hook.match ?? {}, -1);
+      }
+      if (customHooksList.length > 0) {
+        trackHookEvent2(getInstanceId2(), "custom_hooks_loaded", {
+          cli,
+          custom_hooks_count: customHooksList.length,
+          custom_hook_names: customHooksList.map((h) => h.name),
+          event_types_covered: [...new Set(customHooksList.flatMap((h) => h.match?.events ?? []))]
+        });
+      }
+      if (loadResult.conventionSources.length > 0) {
+        trackHookEvent2(getInstanceId2(), "convention_policies_loaded", {
+          event_type: canonicalEventType,
+          cli,
+          project_file_count: loadResult.conventionSources.filter((s) => s.scope === "project").length,
+          user_file_count: loadResult.conventionSources.filter((s) => s.scope === "user").length,
+          convention_hook_count: conventionHookNames.size,
+          convention_hook_names: [...conventionHookNames]
+        });
+      }
+      hookLogInfo(`event=${canonicalEventType} cli=${cli} policies=${config.enabledPolicies.length} custom=${customHooksList.length} convention=${conventionHookNames.size}`);
     }
-    hookLogInfo(`event=${canonicalEventType} cli=${cli} policies=${config.enabledPolicies.length} custom=${customHooksList.length} convention=${conventionHookNames.size}`);
     const result = await evaluatePolicies(canonicalEventType, parsed, session, config);
     const durationMs = Math.round(performance.now() - startTime);
     hookLogInfo(`result=${result.decision} policy=${result.policyName ?? "none"} duration=${durationMs}ms`);
-    if (result.stdout) {
-      process.stdout.write(result.stdout);
-    }
-    if (result.stderr) {
-      process.stderr.write(result.stderr);
-    }
     const matchedPolicies = getPoliciesForEvent(canonicalEventType, parsed.tool_name).map((p) => p.name);
     const activityEntry = {
       timestamp: Date.now(),
@@ -8648,7 +8804,7 @@ async function handleHookEvent(eventType, cli = "claude") {
         const hasCustomParams = !isCustomHook && !isConventionPolicy && !!(result.policyName && config.policyParams?.[result.policyName]);
         const paramKeysOverridden = hasCustomParams ? Object.keys(config.policyParams[result.policyName]) : [];
         const distinctId = getInstanceId2();
-        await trackHookEvent2(distinctId, "hook_policy_triggered", {
+        const trackPromise = trackHookEvent2(distinctId, "hook_policy_triggered", {
           event_type: canonicalEventType,
           cli,
           tool_name: parsed.tool_name ?? null,
@@ -8660,12 +8816,45 @@ async function handleHookEvent(eventType, cli = "claude") {
           has_custom_params: hasCustomParams,
           param_keys_overridden: paramKeysOverridden
         });
+        if (opts?.awaitTelemetryFlush ?? true) {
+          await trackPromise;
+        }
       } catch {}
     }
-    return result.exitCode;
+    return { exitCode: result.exitCode, stdout: result.stdout, stderr: result.stderr };
   } finally {
-    await flushHookTelemetry2();
+    if (opts?.awaitTelemetryFlush ?? true) {
+      await flushHookTelemetry2();
+    }
+  }
+}
+async function handleHookEvent(eventType, cli = "claude") {
+  const MAX_STDIN_BYTES = 1048576;
+  const stdinRead = await readStdinPayload2(MAX_STDIN_BYTES);
+  if (stdinRead.readError) {
+    hookLogWarn(`stdin read failed for ${eventType}`);
+    trackHookEvent2(getInstanceId2(), "hook_stdin_error", {
+      event_type: eventType,
+      cli,
+      error_type: "unknown"
+    });
+  }
+  if (stdinRead.oversized) {
+    hookLogWarn(`stdin payload exceeds 1 MB for ${eventType}, discarding`);
+    trackHookEvent2(getInstanceId2(), "hook_stdin_error", {
+      event_type: eventType,
+      cli,
+      error_type: "oversized"
+    });
+  }
+  const result = await evaluateHookEvent(eventType, cli, stdinRead.payload);
+  if (result.stdout) {
+    process.stdout.write(result.stdout);
+  }
+  if (result.stderr) {
+    process.stderr.write(result.stderr);
   }
+  return result.exitCode;
 }
 var init_handler = __esm(() => {
   init_types();
@@ -8686,13 +8875,13 @@ var init_handler = __esm(() => {
 import { createHmac, randomUUID } from "node:crypto";
 import { execSync as execSync4 } from "node:child_process";
 import { readFileSync as readFileSync10, writeFileSync as writeFileSync4, mkdirSync as mkdirSync5 } from "node:fs";
-import { homedir as homedir21, platform, arch, hostname, cpus } from "node:os";
+import { homedir as homedir22, platform, arch, hostname, cpus } from "node:os";
 import { join as join25 } from "node:path";
 function hashToId3(raw) {
   return createHmac("sha256", NAMESPACE3).update(raw).digest("hex");
 }
 function getInstanceId3() {
-  const idDir = join25(homedir21(), ".failproofai");
+  const idDir = join25(homedir22(), ".failproofai");
   const idFile = join25(idDir, "instance-id");
   try {
     const existing = readFileSync10(idFile, "utf-8").trim();
@@ -8727,7 +8916,7 @@ function getInstanceId3() {
   try {
     const sysProps = [
       hostname(),
-      homedir21(),
+      homedir22(),
       platform(),
       arch(),
       cpus()[0]?.model ?? ""
@@ -8774,14 +8963,14 @@ __export(exports_install_check, {
   checkHooks: () => checkHooks
 });
 import { existsSync as existsSync10, readFileSync as readFileSync11, writeFileSync as writeFileSync5, mkdirSync as mkdirSync6 } from "node:fs";
-import { resolve as resolve10 } from "node:path";
-import { platform as platform2, arch as arch2, release, homedir as homedir22, hostname as hostname2 } from "node:os";
+import { resolve as resolve11 } from "node:path";
+import { platform as platform2, arch as arch2, release, homedir as homedir23, hostname as hostname2 } from "node:os";
 import { createHmac as createHmac2 } from "node:crypto";
 function hashToId4(raw) {
   return createHmac2("sha256", NAMESPACE4).update(raw).digest("hex");
 }
 function lastVersionPath() {
-  return resolve10(homedir22(), ".failproofai", "last-version");
+  return resolve11(homedir23(), ".failproofai", "last-version");
 }
 function compareSemver(a, b) {
   const parse = (v) => {
@@ -8828,7 +9017,7 @@ function compareSemver(a, b) {
   return 0;
 }
 function checkHooks() {
-  const hooksConfigPath = resolve10(homedir22(), ".failproofai", "policies-config.json");
+  const hooksConfigPath = resolve11(homedir23(), ".failproofai", "policies-config.json");
   if (!existsSync10(hooksConfigPath)) {
     return { configured: false, registered: false, policyCount: 0 };
   }
@@ -8842,7 +9031,7 @@ function checkHooks() {
     return { configured: false, registered: false, policyCount: 0 };
   }
   const policyCount = config.enabledPolicies.length;
-  const settingsPath = resolve10(homedir22(), ".claude", "settings.json");
+  const settingsPath = resolve11(homedir23(), ".claude", "settings.json");
   if (!existsSync10(settingsPath))
     return { configured: true, registered: false, policyCount };
   let settings;
@@ -8907,7 +9096,7 @@ async function maybeReportInstall(version3) {
       enabled_policy_count: hooks.policyCount
     }, { version: version3, timeoutMs: REPORT_TIMEOUT_MS }));
     try {
-      mkdirSync6(resolve10(homedir22(), ".failproofai"), { recursive: true });
+      mkdirSync6(resolve11(homedir23(), ".failproofai"), { recursive: true });
       writeFileSync5(versionFile, version3, "utf8");
     } catch {}
     await Promise.all(events.map((p) => p.catch(() => {})));
@@ -15911,9 +16100,9 @@ var init_dist = __esm(() => {
 // src/hooks/integrations.ts
 import { execSync as execSync5 } from "node:child_process";
 import { readFileSync as readFileSync12, writeFileSync as writeFileSync6, existsSync as existsSync11, mkdirSync as mkdirSync7, unlinkSync as unlinkSync2 } from "node:fs";
-import { resolve as resolve11, dirname as dirname5 } from "node:path";
+import { resolve as resolve12, dirname as dirname5 } from "node:path";
 import { fileURLToPath } from "node:url";
-import { homedir as homedir23 } from "node:os";
+import { homedir as homedir24 } from "node:os";
 function readJsonFile(path3) {
   if (!existsSync11(path3))
     return {};
@@ -15977,7 +16166,7 @@ function isMarkedCopilotHook(hook) {
   return false;
 }
 function opencodePluginFilePath(settingsPath) {
-  return resolve11(dirname5(settingsPath), "plugins", "failproofai.mjs");
+  return resolve12(dirname5(settingsPath), "plugins", "failproofai.mjs");
 }
 function buildOpenCodePluginShim(binaryPath, scope) {
   const useNpx = scope === "project";
@@ -16192,8 +16381,8 @@ export default async function failproofaiPlugin({ client, directory }) {
 function getPiExtensionPath() {
   const fromEnv = process.env.FAILPROOFAI_PACKAGE_ROOT;
   if (fromEnv)
-    return resolve11(fromEnv, "pi-extension");
-  return resolve11(fileURLToPath(import.meta.url), "..", "..", "..", "pi-extension");
+    return resolve12(fromEnv, "pi-extension");
+  return resolve12(fileURLToPath(import.meta.url), "..", "..", "..", "pi-extension");
 }
 function isFailproofaiPiEntry(source) {
   if (typeof source !== "string")
@@ -16204,8 +16393,8 @@ function isFailproofaiPiEntry(source) {
 }
 function makePiProjectRelativeEntry(extPath) {
   const cwd = process.cwd();
-  const cwdResolved = resolve11(cwd);
-  const extResolved = resolve11(extPath);
+  const cwdResolved = resolve12(cwd);
+  const extResolved = resolve12(extPath);
   if (extResolved.startsWith(cwdResolved + "/") || extResolved === cwdResolved) {
     const fromSettingsDir = "../" + extResolved.slice(cwdResolved.length + 1);
     return fromSettingsDir;
@@ -16229,13 +16418,13 @@ function hermesConfigHasHooks(settingsPath) {
   return false;
 }
 function unhookedHermesProfiles() {
-  return listHermesProfiles().filter((p) => existsSync11(p.home)).filter((p) => !hermesConfigHasHooks(resolve11(p.home, "config.yaml"))).map((p) => p.name);
+  return listHermesProfiles().filter((p) => existsSync11(p.home)).filter((p) => !hermesConfigHasHooks(resolve12(p.home, "config.yaml"))).map((p) => p.name);
 }
 function getOpenClawPluginPath() {
   const fromEnv = process.env.FAILPROOFAI_PACKAGE_ROOT;
   if (fromEnv)
-    return resolve11(fromEnv, "openclaw-plugin");
-  return resolve11(fileURLToPath(import.meta.url), "..", "..", "..", "openclaw-plugin");
+    return resolve12(fromEnv, "openclaw-plugin");
+  return resolve12(fileURLToPath(import.meta.url), "..", "..", "..", "openclaw-plugin");
 }
 function isFailproofaiOpenClawPath(p) {
   if (typeof p !== "string")
@@ -16272,14 +16461,14 @@ var init_integrations = __esm(() => {
     scopes: HOOK_SCOPES,
     eventTypes: CLAUDE_INSTALL_EVENT_TYPES,
     getSettingsPath(scope, cwd) {
-      const base = cwd ? resolve11(cwd) : process.cwd();
+      const base = cwd ? resolve12(cwd) : process.cwd();
       switch (scope) {
         case "user":
-          return resolve11(homedir23(), ".claude", "settings.json");
+          return resolve12(homedir24(), ".claude", "settings.json");
         case "project":
-          return resolve11(base, ".claude", "settings.json");
+          return resolve12(base, ".claude", "settings.json");
         case "local":
-          return resolve11(base, ".claude", "settings.local.json");
+          return resolve12(base, ".claude", "settings.local.json");
       }
     },
     readSettings(settingsPath) {
@@ -16404,14 +16593,14 @@ var init_integrations = __esm(() => {
     scopes: CODEX_HOOK_SCOPES,
     eventTypes: CODEX_HOOK_EVENT_TYPES,
     getSettingsPath(scope, cwd) {
-      const base = cwd ? resolve11(cwd) : process.cwd();
+      const base = cwd ? resolve12(cwd) : process.cwd();
       switch (scope) {
         case "user":
-          return resolve11(homedir23(), ".codex", "hooks.json");
+          return resolve12(homedir24(), ".codex", "hooks.json");
         case "project":
-          return resolve11(base, ".codex", "hooks.json");
+          return resolve12(base, ".codex", "hooks.json");
         case "local":
-          return resolve11(base, ".codex", "hooks.json");
+          return resolve12(base, ".codex", "hooks.json");
       }
     },
     readSettings(settingsPath) {
@@ -16520,14 +16709,14 @@ var init_integrations = __esm(() => {
     scopes: COPILOT_HOOK_SCOPES,
     eventTypes: COPILOT_HOOK_EVENT_TYPES,
     getSettingsPath(scope, cwd) {
-      const base = cwd ? resolve11(cwd) : process.cwd();
+      const base = cwd ? resolve12(cwd) : process.cwd();
       switch (scope) {
         case "user":
-          return resolve11(homedir23(), ".copilot", "hooks", "failproofai.json");
+          return resolve12(homedir24(), ".copilot", "hooks", "failproofai.json");
         case "project":
-          return resolve11(base, ".github", "hooks", "failproofai.json");
+          return resolve12(base, ".github", "hooks", "failproofai.json");
         case "local":
-          return resolve11(base, ".github", "hooks", "failproofai.json");
+          return resolve12(base, ".github", "hooks", "failproofai.json");
       }
     },
     readSettings(settingsPath) {
@@ -16634,14 +16823,14 @@ var init_integrations = __esm(() => {
     scopes: CURSOR_HOOK_SCOPES,
     eventTypes: CURSOR_HOOK_EVENT_TYPES,
     getSettingsPath(scope, cwd) {
-      const base = cwd ? resolve11(cwd) : process.cwd();
+      const base = cwd ? resolve12(cwd) : process.cwd();
       switch (scope) {
         case "user":
-          return resolve11(homedir23(), ".cursor", "hooks.json");
+          return resolve12(homedir24(), ".cursor", "hooks.json");
         case "project":
-          return resolve11(base, ".cursor", "hooks.json");
+          return resolve12(base, ".cursor", "hooks.json");
         case "local":
-          return resolve11(base, ".cursor", "hooks.json");
+          return resolve12(base, ".cursor", "hooks.json");
       }
     },
     readSettings(settingsPath) {
@@ -16733,14 +16922,14 @@ var init_integrations = __esm(() => {
     scopes: OPENCODE_HOOK_SCOPES,
     eventTypes: OPENCODE_HOOK_EVENT_TYPES,
     getSettingsPath(scope, cwd) {
-      const base = cwd ? resolve11(cwd) : process.cwd();
+      const base = cwd ? resolve12(cwd) : process.cwd();
       switch (scope) {
         case "user":
-          return resolve11(homedir23(), ".config", "opencode", "opencode.json");
+          return resolve12(homedir24(), ".config", "opencode", "opencode.json");
         case "project":
-          return resolve11(base, ".opencode", "opencode.json");
+          return resolve12(base, ".opencode", "opencode.json");
         case "local":
-          return resolve11(base, ".opencode", "opencode.json");
+          return resolve12(base, ".opencode", "opencode.json");
       }
     },
     readSettings(settingsPath) {
@@ -16751,7 +16940,7 @@ var init_integrations = __esm(() => {
     },
     buildHookEntry(_binaryPath, _eventType, scope) {
       if (scope === "user") {
-        const abs = resolve11(homedir23(), ".config", "opencode", "plugins", "failproofai.mjs");
+        const abs = resolve12(homedir24(), ".config", "opencode", "plugins", "failproofai.mjs");
         return { spec: `file://${abs}`, [FAILPROOFAI_HOOK_MARKER]: true };
       }
       return { spec: OPENCODE_PLUGIN_REL_PATH, [FAILPROOFAI_HOOK_MARKER]: true };
@@ -16766,7 +16955,7 @@ var init_integrations = __esm(() => {
     writeHookEntries(settings, binaryPath, scope) {
       const s = settings;
       const effectiveScope = scope ?? "project";
-      const settingsPath = effectiveScope === "user" ? resolve11(homedir23(), ".config", "opencode", "opencode.json") : resolve11(process.cwd(), ".opencode", "opencode.json");
+      const settingsPath = effectiveScope === "user" ? resolve12(homedir24(), ".config", "opencode", "opencode.json") : resolve12(process.cwd(), ".opencode", "opencode.json");
       const pluginPath = opencodePluginFilePath(settingsPath);
       mkdirSync7(dirname5(pluginPath), { recursive: true });
       writeFileSync6(pluginPath, buildOpenCodePluginShim(binaryPath, effectiveScope), "utf8");
@@ -16834,14 +17023,14 @@ var init_integrations = __esm(() => {
     scopes: PI_HOOK_SCOPES,
     eventTypes: PI_HOOK_EVENT_TYPES,
     getSettingsPath(scope, cwd) {
-      const base = cwd ? resolve11(cwd) : process.cwd();
+      const base = cwd ? resolve12(cwd) : process.cwd();
       switch (scope) {
         case "user":
-          return resolve11(homedir23(), ".pi", "agent", "settings.json");
+          return resolve12(homedir24(), ".pi", "agent", "settings.json");
         case "project":
-          return resolve11(base, ".pi", "settings.json");
+          return resolve12(base, ".pi", "settings.json");
         case "local":
-          return resolve11(base, ".pi", "settings.json");
+          return resolve12(base, ".pi", "settings.json");
       }
     },
     readSettings(settingsPath) {
@@ -16919,10 +17108,10 @@ var init_integrations = __esm(() => {
     scopes: HERMES_HOOK_SCOPES,
     eventTypes: HERMES_HOOK_EVENT_TYPES,
     getSettingsPath() {
-      return resolve11(hermesRoot(), "config.yaml");
+      return resolve12(hermesRoot(), "config.yaml");
     },
     getSettingsPaths() {
-      return listHermesProfiles().map((p) => resolve11(p.home, "config.yaml"));
+      return listHermesProfiles().map((p) => resolve12(p.home, "config.yaml"));
     },
     readSettings(settingsPath) {
       return readYamlDoc(settingsPath);
@@ -17002,7 +17191,7 @@ var init_integrations = __esm(() => {
     scopes: OPENCLAW_HOOK_SCOPES,
     eventTypes: OPENCLAW_HOOK_EVENT_TYPES,
     getSettingsPath() {
-      return resolve11(homedir23(), ".openclaw", "openclaw.json");
+      return resolve12(homedir24(), ".openclaw", "openclaw.json");
     },
     readSettings(settingsPath) {
       return readJsonFile(settingsPath);
@@ -17098,14 +17287,14 @@ var init_integrations = __esm(() => {
     scopes: FACTORY_HOOK_SCOPES,
     eventTypes: FACTORY_HOOK_EVENT_TYPES,
     getSettingsPath(scope, cwd) {
-      const base = cwd ? resolve11(cwd) : process.cwd();
+      const base = cwd ? resolve12(cwd) : process.cwd();
       switch (scope) {
         case "user":
-          return resolve11(homedir23(), ".factory", "hooks.json");
+          return resolve12(homedir24(), ".factory", "hooks.json");
         case "project":
-          return resolve11(base, ".factory", "hooks.json");
+          return resolve12(base, ".factory", "hooks.json");
         case "local":
-          return resolve11(base, ".factory", "hooks.json");
+          return resolve12(base, ".factory", "hooks.json");
       }
     },
     readSettings(settingsPath) {
@@ -17200,14 +17389,14 @@ var init_integrations = __esm(() => {
     scopes: DEVIN_HOOK_SCOPES,
     eventTypes: DEVIN_HOOK_EVENT_TYPES,
     getSettingsPath(scope, cwd) {
-      const base = cwd ? resolve11(cwd) : process.cwd();
+      const base = cwd ? resolve12(cwd) : process.cwd();
       switch (scope) {
         case "user":
-          return resolve11(homedir23(), ".config", "devin", "config.json");
+          return resolve12(homedir24(), ".config", "devin", "config.json");
         case "project":
-          return resolve11(base, ".devin", "config.json");
+          return resolve12(base, ".devin", "config.json");
         case "local":
-          return resolve11(base, ".devin", "config.json");
+          return resolve12(base, ".devin", "config.json");
       }
     },
     readSettings(settingsPath) {
@@ -17309,14 +17498,14 @@ var init_integrations = __esm(() => {
     scopes: ANTIGRAVITY_HOOK_SCOPES,
     eventTypes: ANTIGRAVITY_HOOK_EVENT_TYPES,
     getSettingsPath(scope, cwd) {
-      const base = cwd ? resolve11(cwd) : process.cwd();
+      const base = cwd ? resolve12(cwd) : process.cwd();
       switch (scope) {
         case "user":
-          return resolve11(homedir23(), ".gemini", "config", "hooks.json");
+          return resolve12(homedir24(), ".gemini", "config", "hooks.json");
         case "project":
-          return resolve11(base, ".agents", "hooks.json");
+          return resolve12(base, ".agents", "hooks.json");
         case "local":
-          return resolve11(base, ".agents", "hooks.json");
+          return resolve12(base, ".agents", "hooks.json");
       }
     },
     readSettings(settingsPath) {
@@ -17450,14 +17639,14 @@ var init_integrations = __esm(() => {
     scopes: GOOSE_HOOK_SCOPES,
     eventTypes: GOOSE_HOOK_EVENT_TYPES,
     getSettingsPath(scope, cwd) {
-      const base = cwd ? resolve11(cwd) : process.cwd();
+      const base = cwd ? resolve12(cwd) : process.cwd();
       switch (scope) {
         case "user":
-          return resolve11(homedir23(), ".agents", "plugins", "failproofai", "hooks", "hooks.json");
+          return resolve12(homedir24(), ".agents", "plugins", "failproofai", "hooks", "hooks.json");
         case "project":
-          return resolve11(base, ".agents", "plugins", "failproofai", "hooks", "hooks.json");
+          return resolve12(base, ".agents", "plugins", "failproofai", "hooks", "hooks.json");
         case "local":
-          return resolve11(base, ".agents", "plugins", "failproofai", "hooks", "hooks.json");
+          return resolve12(base, ".agents", "plugins", "failproofai", "hooks", "hooks.json");
       }
     },
     readSettings(settingsPath) {
@@ -17792,7 +17981,7 @@ function runPrompt(p) {
       `${c.dim(BAR)}  ${c.dim(p.summaryFor(result))}`
     ]);
   };
-  return new Promise((resolve12) => {
+  return new Promise((resolve13) => {
     hideCursor(stdout);
     repaint(stdout, region, build());
     readline.emitKeypressEvents(stdin);
@@ -17808,7 +17997,7 @@ function runPrompt(p) {
     const finish = (result) => {
       cleanup();
       collapse(result);
-      resolve12(result);
+      resolve13(result);
     };
     function onKey(_s, key) {
       if (!key)
@@ -18109,7 +18298,7 @@ async function promptPolicySelection(preSelected, options = {}) {
 `);
     lastLineCount = lines.length;
   }
-  return new Promise((resolve12) => {
+  return new Promise((resolve13) => {
     render();
     process.stdin.setRawMode(true);
     process.stdin.resume();
@@ -18146,7 +18335,7 @@ async function promptPolicySelection(preSelected, options = {}) {
 ${dim(STEP_DONE)}  Policies
 ${dim(BAR)}  ${dim(`${selected.length} selected`)}
 `);
-        resolve12(selected);
+        resolve13(selected);
       } else if (key.name === "escape") {
         search = "";
         cursor2 = 0;
@@ -18209,8 +18398,8 @@ __export(exports_manager, {
 });
 import { execSync as execSync6 } from "node:child_process";
 import { existsSync as existsSync12 } from "node:fs";
-import { resolve as resolve12, basename as basename4 } from "node:path";
-import { homedir as homedir24, platform as platform3, arch as arch3, release as release2, hostname as hostname3 } from "node:os";
+import { resolve as resolve13, basename as basename4 } from "node:path";
+import { homedir as homedir25, platform as platform3, arch as arch3, release as release2, hostname as hostname3 } from "node:os";
 function getSettingsPath(scope, cwd) {
   return claudeCode.getSettingsPath(scope, cwd);
 }
@@ -18317,8 +18506,8 @@ async function installHooksImpl(policyNames, scope = "user", cwd, includeBeta =
     delete configToWrite.customPoliciesPath;
     delete configToWrite.customPoliciesPaths;
   } else if (customPoliciesPath && (typeof customPoliciesPath === "string" || customPoliciesPath.length > 0)) {
-    const incoming = (typeof customPoliciesPath === "string" ? [customPoliciesPath] : customPoliciesPath).map((path3) => resolve12(path3));
-    const carried = (previousConfig.customPoliciesPaths ?? (previousConfig.customPoliciesPath ? [previousConfig.customPoliciesPath] : [])).map((path3) => resolve12(path3)).filter((path3) => {
+    const incoming = (typeof customPoliciesPath === "string" ? [customPoliciesPath] : customPoliciesPath).map((path3) => resolve13(path3));
+    const carried = (previousConfig.customPoliciesPaths ?? (previousConfig.customPoliciesPath ? [previousConfig.customPoliciesPath] : [])).map((path3) => resolve13(path3)).filter((path3) => {
       if (existsSync12(path3))
         return true;
       console.log(`Dropping custom policies path (file no longer exists): ${path3}`);
@@ -18710,7 +18899,7 @@ Failproof AI Hook Policies
     console.log(`
   ── Custom Policies ───────────────────────`);
     for (const path3 of explicitPaths) {
-      const absPath = resolve12(findProjectConfigDir(cwd ?? process.cwd()), path3);
+      const absPath = resolve13(findProjectConfigDir(cwd ?? process.cwd()), path3);
       console.log(`  ${absPath}`);
       if (!existsSync12(absPath)) {
         console.log(`  \x1B[31m✗ File not found: ${absPath}\x1B[0m`);
@@ -18731,8 +18920,8 @@ Failproof AI Hook Policies
     console.log();
   }
   const base = findProjectConfigDir(cwd ?? process.cwd());
-  const projectDir = resolve12(base, ".failproofai", "policies");
-  const userDir = resolve12(homedir24(), ".failproofai", "policies");
+  const projectDir = resolve13(base, ".failproofai", "policies");
+  const userDir = resolve13(homedir25(), ".failproofai", "policies");
   const sameDir = userDir === projectDir;
   const conventionDirs = [
     { label: sameDir ? "Project + User" : "Project", dir: projectDir },
@@ -18962,7 +19151,7 @@ async function promptCliTargetSelection(detected, action = "install") {
     lastLineCount = lines.length;
   }
   const itemCount = options.length;
-  return new Promise((resolve13) => {
+  return new Promise((resolve14) => {
     render();
     readline3.emitKeypressEvents(process.stdin);
     const wasRaw = process.stdin.isRaw;
@@ -18995,7 +19184,7 @@ async function promptCliTargetSelection(detected, action = "install") {
         cleanup();
         process.stdout.write(`
 `);
-        resolve13(options[cursor2].value);
+        resolve14(options[cursor2].value);
       }
     }
     process.stdin.on("keypress", onKey);
@@ -19148,7 +19337,7 @@ async function promptPolicySelection2(preSelected, options = {}) {
 `);
     lastLineCount = lines.length;
   }
-  return new Promise((resolve13) => {
+  return new Promise((resolve14) => {
     render();
     process.stdin.setRawMode(true);
     process.stdin.resume();
@@ -19185,7 +19374,7 @@ async function promptPolicySelection2(preSelected, options = {}) {
 ${dim(STEP_DONE)}  Policies
 ${dim(BAR)}  ${dim(`${selected.length} selected`)}
 `);
-        resolve13(selected);
+        resolve14(selected);
       } else if (key.name === "escape") {
         search = "";
         cursor2 = 0;
@@ -19369,7 +19558,7 @@ import {
   mkdirSync as mkdirSync8,
   renameSync as renameSync3,
   rmSync,
-  statSync as statSync11,
+  statSync as statSync12,
   writeFileSync as writeFileSync7
 } from "node:fs";
 import { dirname as dirname6 } from "node:path";
@@ -19384,12 +19573,12 @@ function writeJsonAtomically(filePath, value, opts = {}) {
   try {
     writeFileSync7(tmp, JSON.stringify(value, null, 2), { mode });
     try {
-      if ((statSync11(tmp).mode & 63) !== 0)
+      if ((statSync12(tmp).mode & 63) !== 0)
         chmodSync(tmp, mode);
     } catch {}
     renameSync3(tmp, filePath);
     try {
-      if ((statSync11(filePath).mode & 63) !== 0)
+      if ((statSync12(filePath).mode & 63) !== 0)
         chmodSync(filePath, mode);
     } catch {}
   } catch (err) {
@@ -19403,13 +19592,13 @@ var init_atomic_write = () => {};
 
 // lib/auth/auth-store.ts
 import { existsSync as existsSync14, readFileSync as readFileSync13, rmSync as rmSync2 } from "node:fs";
-import { homedir as homedir25 } from "node:os";
+import { homedir as homedir26 } from "node:os";
 import { join as join26 } from "node:path";
 function getAuthDir() {
   const override = process.env.FAILPROOFAI_AUTH_DIR;
   if (override)
     return override;
-  return join26(homedir25(), ".failproofai");
+  return join26(homedir26(), ".failproofai");
 }
 function getAuthFilePath() {
   return join26(getAuthDir(), "auth.json");
@@ -19520,13 +19709,13 @@ function prompt(question, opts = {}) {
         orig(s);
     };
   }
-  return new Promise((resolve13) => {
+  return new Promise((resolve14) => {
     rl.question(question, (answer) => {
       rl.close();
       if (opts.hidden && process.stdin.isTTY)
         process.stdout.write(`
 `);
-      resolve13(answer.trim());
+      resolve14(answer.trim());
     });
   });
 }
@@ -19775,7 +19964,7 @@ EXAMPLES
 });
 
 // lib/claude-sessions.ts
-import { readdirSync as readdirSync11, statSync as statSync12, existsSync as existsSync15 } from "node:fs";
+import { readdirSync as readdirSync11, statSync as statSync13, existsSync as existsSync15 } from "node:fs";
 import { join as join27, basename as basename5 } from "node:path";
 function getClaudeProjectsRoot() {
   return getClaudeProjectsPath();
@@ -19809,7 +19998,7 @@ function listClaudeTranscripts(project) {
         continue;
       const transcriptPath = join27(project.path, entry.name);
       try {
-        const s = statSync12(transcriptPath);
+        const s = statSync13(transcriptPath);
         out.push({
           projectName: project.name,
           cwd: project.cwd,
@@ -19836,7 +20025,7 @@ function listClaudeTranscripts(project) {
         const agentId = sub.name.slice(0, -".jsonl".length);
         const transcriptPath = join27(subDir, sub.name);
         try {
-          const s = statSync12(transcriptPath);
+          const s = statSync13(transcriptPath);
           out.push({
             projectName: project.name,
             cwd: project.cwd,
@@ -19980,7 +20169,7 @@ var init_claude = __esm(() => {
 });
 
 // src/audit/cli-adapters/codex.ts
-import { statSync as statSync13 } from "node:fs";
+import { statSync as statSync14 } from "node:fs";
 async function listCodexTranscriptMetadata(opts = {}) {
   const projectFilter = opts.projects ? new Set(opts.projects) : null;
   const sinceMs = opts.sinceMs ?? 0;
@@ -19997,7 +20186,7 @@ async function listCodexTranscriptMetadata(opts = {}) {
         continue;
       let sizeBytes = 0;
       try {
-        sizeBytes = statSync13(s.path).size;
+        sizeBytes = statSync14(s.path).size;
       } catch {}
       if (!s.sessionId)
         continue;
@@ -20031,7 +20220,7 @@ var init_codex = __esm(() => {
 });
 
 // src/audit/cli-adapters/copilot.ts
-import { statSync as statSync14 } from "node:fs";
+import { statSync as statSync15 } from "node:fs";
 async function listCopilotTranscriptMetadata(opts = {}) {
   const projectFilter = opts.projects ? new Set(opts.projects) : null;
   const sinceMs = opts.sinceMs ?? 0;
@@ -20048,7 +20237,7 @@ async function listCopilotTranscriptMetadata(opts = {}) {
         continue;
       let sizeBytes = 0;
       try {
-        sizeBytes = statSync14(s.path).size;
+        sizeBytes = statSync15(s.path).size;
       } catch {}
       if (!s.sessionId)
         continue;
@@ -20082,7 +20271,7 @@ var init_copilot = __esm(() => {
 });
 
 // src/audit/cli-adapters/cursor.ts
-import { statSync as statSync15 } from "node:fs";
+import { statSync as statSync16 } from "node:fs";
 async function listCursorTranscriptMetadata(opts = {}) {
   const projectFilter = opts.projects ? new Set(opts.projects) : null;
   const sinceMs = opts.sinceMs ?? 0;
@@ -20099,7 +20288,7 @@ async function listCursorTranscriptMetadata(opts = {}) {
         continue;
       let sizeBytes = 0;
       try {
-        sizeBytes = statSync15(s.path).size;
+        sizeBytes = statSync16(s.path).size;
       } catch {}
       if (!s.sessionId)
         continue;
@@ -20345,7 +20534,7 @@ var init_opencode = __esm(() => {
 });
 
 // src/audit/cli-adapters/pi.ts
-import { statSync as statSync16 } from "node:fs";
+import { statSync as statSync17 } from "node:fs";
 async function listPiTranscriptMetadata(opts = {}) {
   const projectFilter = opts.projects ? new Set(opts.projects) : null;
   const sinceMs = opts.sinceMs ?? 0;
@@ -20362,7 +20551,7 @@ async function listPiTranscriptMetadata(opts = {}) {
         continue;
       let sizeBytes = 0;
       try {
-        sizeBytes = statSync16(s.path).size;
+        sizeBytes = statSync17(s.path).size;
       } catch {}
       if (!s.sessionId)
         continue;
@@ -21092,7 +21281,7 @@ var init_features = __esm(() => {
 import { createHash } from "node:crypto";
 import { existsSync as existsSync16, mkdirSync as mkdirSync9, readFileSync as readFileSync14, writeFileSync as writeFileSync8, chmodSync as chmodSync2 } from "node:fs";
 import { join as join28 } from "node:path";
-import { homedir as homedir26 } from "node:os";
+import { homedir as homedir27 } from "node:os";
 function getEngineVersion() {
   if (cachedEngineVersion)
     return cachedEngineVersion;
@@ -21110,7 +21299,7 @@ function getDetectorVersion() {
   return cachedDetectorVersion;
 }
 function getCachePathFor(transcriptPath) {
-  const root = join28(homedir26(), ".failproofai", "cache", "audit");
+  const root = join28(homedir27(), ".failproofai", "cache", "audit");
   const key = createHash("sha1").update(transcriptPath).digest("hex");
   return join28(root, `${key}.json`);
 }
@@ -21145,7 +21334,7 @@ function writeCachedTranscriptResult(transcriptPath, mtimeMs, sizeBytes, result)
     return;
   const cachePath = getCachePathFor(transcriptPath);
   try {
-    mkdirSync9(join28(homedir26(), ".failproofai", "cache", "audit"), { recursive: true });
+    mkdirSync9(join28(homedir27(), ".failproofai", "cache", "audit"), { recursive: true });
     const entry = {
       schemaVersion: CACHE_SCHEMA_VERSION,
       cachedAt: Date.now(),
@@ -21518,9 +21707,9 @@ var init_audit = __esm(() => {
 
 // src/audit/dashboard-cache.ts
 import { join as join29 } from "node:path";
-import { homedir as homedir27 } from "node:os";
+import { homedir as homedir28 } from "node:os";
 function getCachePath() {
-  return join29(homedir27(), ".failproofai", "audit-dashboard.json");
+  return join29(homedir28(), ".failproofai", "audit-dashboard.json");
 }
 function writeDashboardCache(params, result) {
   try {
@@ -21610,14 +21799,14 @@ var POLL_INTERVAL_MS = 150, POLL_TIMEOUT_MS = 30000;
 var init_open_browser = () => {};
 
 // scripts/parse-script-args.ts
-import { resolve as resolve13 } from "path";
+import { resolve as resolve14 } from "path";
 function parseStringFlag(flagName, errorLabel, inlineValue, args, index, options) {
   const raw = inlineValue ?? args[index + 1];
   if (raw === undefined || inlineValue === null && raw.startsWith("-")) {
     console.error(`Error: ${flagName} requires ${errorLabel}`);
     process.exit(1);
   }
-  const value = options?.resolve ? resolve13(raw) : raw;
+  const value = options?.resolve ? resolve14(raw) : raw;
   return { value, spliceCount: inlineValue !== null ? 1 : 2 };
 }
 function parseScriptArgs(argv) {
@@ -21666,17 +21855,17 @@ var init_parse_script_args = () => {};
 
 // scripts/install-diagnosis.mjs
 import { existsSync as existsSync17, readFileSync as readFileSync15, realpathSync } from "node:fs";
-import { dirname as dirname7, resolve as resolve14 } from "node:path";
-import { homedir as homedir28, platform as platform4 } from "node:os";
+import { dirname as dirname7, resolve as resolve15 } from "node:path";
+import { homedir as homedir29, platform as platform4 } from "node:os";
 import { spawnSync } from "node:child_process";
 function findPackageRoot(start) {
   try {
     let dir = realpathSync(start);
-    if (existsSync17(dir) && !existsSync17(resolve14(dir, "package.json"))) {
+    if (existsSync17(dir) && !existsSync17(resolve15(dir, "package.json"))) {
       dir = dirname7(dir);
     }
     while (true) {
-      const pkgPath = resolve14(dir, "package.json");
+      const pkgPath = resolve15(dir, "package.json");
       if (existsSync17(pkgPath)) {
         try {
           const pkg = JSON.parse(readFileSync15(pkgPath, "utf8"));
@@ -21697,7 +21886,7 @@ function readPackageVersion(packageRoot) {
   if (!packageRoot)
     return null;
   try {
-    const pkg = JSON.parse(readFileSync15(resolve14(packageRoot, "package.json"), "utf8"));
+    const pkg = JSON.parse(readFileSync15(resolve15(packageRoot, "package.json"), "utf8"));
     return typeof pkg.version === "string" ? pkg.version : null;
   } catch {
     return null;
@@ -21723,16 +21912,16 @@ function locateNpmGlobal() {
     const root = (res.stdout || "").trim();
     if (!root)
       return null;
-    const candidate = resolve14(root, PKG_NAME);
-    return existsSync17(resolve14(candidate, "package.json")) ? candidate : null;
+    const candidate = resolve15(root, PKG_NAME);
+    return existsSync17(resolve15(candidate, "package.json")) ? candidate : null;
   } catch {
     return null;
   }
 }
 function locateBunGlobal() {
   try {
-    const candidate = resolve14(homedir28(), ".bun", "install", "global", "node_modules", PKG_NAME);
-    return existsSync17(resolve14(candidate, "package.json")) ? candidate : null;
+    const candidate = resolve15(homedir29(), ".bun", "install", "global", "node_modules", PKG_NAME);
+    return existsSync17(resolve15(candidate, "package.json")) ? candidate : null;
   } catch {
     return null;
   }
@@ -21740,8 +21929,8 @@ function locateBunGlobal() {
 function buildRecommendation(pathFirstBin) {
   if (!pathFirstBin)
     return null;
-  const bunBinPrefix = resolve14(homedir28(), ".bun", "bin") + "/";
-  const bunGlobalPrefix = resolve14(homedir28(), ".bun", "install", "global") + "/";
+  const bunBinPrefix = resolve15(homedir29(), ".bun", "bin") + "/";
+  const bunGlobalPrefix = resolve15(homedir29(), ".bun", "install", "global") + "/";
   const isBun = pathFirstBin.startsWith(bunBinPrefix) || pathFirstBin.startsWith(bunGlobalPrefix);
   if (isBun) {
     return `rm -f ~/.bun/bin/${PKG_NAME} && rm -rf ~/.bun/install/global/node_modules/${PKG_NAME}`;
@@ -21822,7 +22011,7 @@ __export(exports_launch, {
 });
 import { spawn as spawn2 } from "child_process";
 import { realpathSync as realpathSync2, existsSync as existsSync18 } from "node:fs";
-import { resolve as resolve15, dirname as dirname8 } from "node:path";
+import { resolve as resolve16, dirname as dirname8 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 import { createInterface as createInterface2 } from "node:readline";
 function launch(mode) {
@@ -21837,8 +22026,8 @@ function launch(mode) {
     process.env.PORT = port;
     process.env.HOSTNAME = "0.0.0.0";
     cmd = "node";
-    const packageRoot = process.env.FAILPROOFAI_PACKAGE_ROOT ?? resolve15(dirname8(realpathSync2(fileURLToPath2(import.meta.url))), "..");
-    const serverJsPath = resolve15(packageRoot, ".next/standalone/server.js");
+    const packageRoot = process.env.FAILPROOFAI_PACKAGE_ROOT ?? resolve16(dirname8(realpathSync2(fileURLToPath2(import.meta.url))), "..");
+    const serverJsPath = resolve16(packageRoot, ".next/standalone/server.js");
     if (!existsSync18(serverJsPath)) {
       let shadowMessage = null;
       try {
@@ -22192,8 +22381,8 @@ WHAT IT DOES
 // src/hooks/manager.ts
 import { execSync as execSync7 } from "node:child_process";
 import { existsSync as existsSync19 } from "node:fs";
-import { resolve as resolve16, basename as basename6 } from "node:path";
-import { homedir as homedir29, platform as platform5, arch as arch4, release as release3, hostname as hostname4 } from "node:os";
+import { resolve as resolve17, basename as basename6 } from "node:path";
+import { homedir as homedir30, platform as platform5, arch as arch4, release as release3, hostname as hostname4 } from "node:os";
 function getSettingsPath2(scope, cwd) {
   return claudeCode.getSettingsPath(scope, cwd);
 }
@@ -22300,8 +22489,8 @@ async function installHooksImpl2(policyNames, scope = "user", cwd, includeBeta =
     delete configToWrite.customPoliciesPath;
     delete configToWrite.customPoliciesPaths;
   } else if (customPoliciesPath && (typeof customPoliciesPath === "string" || customPoliciesPath.length > 0)) {
-    const incoming = (typeof customPoliciesPath === "string" ? [customPoliciesPath] : customPoliciesPath).map((path3) => resolve16(path3));
-    const carried = (previousConfig.customPoliciesPaths ?? (previousConfig.customPoliciesPath ? [previousConfig.customPoliciesPath] : [])).map((path3) => resolve16(path3)).filter((path3) => {
+    const incoming = (typeof customPoliciesPath === "string" ? [customPoliciesPath] : customPoliciesPath).map((path3) => resolve17(path3));
+    const carried = (previousConfig.customPoliciesPaths ?? (previousConfig.customPoliciesPath ? [previousConfig.customPoliciesPath] : [])).map((path3) => resolve17(path3)).filter((path3) => {
       if (existsSync19(path3))
         return true;
       console.log(`Dropping custom policies path (file no longer exists): ${path3}`);
@@ -22498,6 +22687,314 @@ var init_policy_presets = __esm(() => {
   ];
 });
 
+// src/hooks/daemon-download.ts
+import { createHash as createHash2 } from "node:crypto";
+import { chmodSync as chmodSync3, existsSync as existsSync20, mkdirSync as mkdirSync10, renameSync as renameSync4, rmSync as rmSync3, writeFileSync as writeFileSync9 } from "node:fs";
+import { homedir as homedir31 } from "node:os";
+import { resolve as resolve18 } from "node:path";
+import { gunzipSync } from "node:zlib";
+function baseUrl() {
+  return (process.env.FAILPROOFAI_DAEMON_BASE_URL || DEFAULT_BASE_URL).replace(/\/+$/, "");
+}
+function daemonBinaryDir() {
+  return resolve18(homedir31(), ".failproofai", "bin");
+}
+function installedBinaryPath(ver = version2) {
+  return resolve18(daemonBinaryDir(), `failproofaid-${ver}`);
+}
+function daemonAssetUrl(key, ver = version2) {
+  return `${baseUrl()}/v${ver}/failproofaid-${key}.gz`;
+}
+function checksumsUrl(ver = version2) {
+  return `${baseUrl()}/v${ver}/SHA256SUMS`;
+}
+async function fetchBytes(url) {
+  const response = await fetch(url, { signal: AbortSignal.timeout(DOWNLOAD_TIMEOUT_MS) });
+  if (!response.ok)
+    throw new Error(`GET ${url} returned ${response.status}`);
+  return Buffer.from(await response.arrayBuffer());
+}
+function digestFor(manifest, assetName) {
+  for (const line of manifest.split(`
+`)) {
+    const match = line.trim().match(/^([0-9a-f]{64})\s+\*?(.+)$/i);
+    if (match && match[2].trim() === assetName)
+      return match[1].toLowerCase();
+  }
+  return null;
+}
+async function downloadFailproofaidBinary(key) {
+  const target = installedBinaryPath();
+  if (existsSync20(target))
+    return { path: target };
+  if (process.env.FAILPROOFAI_NO_DOWNLOAD) {
+    return { error: "daemon downloads are disabled (FAILPROOFAI_NO_DOWNLOAD)" };
+  }
+  const assetName = `failproofaid-${key}.gz`;
+  const tempPath = `${target}.${process.pid}.tmp`;
+  try {
+    const [asset, manifest] = await Promise.all([
+      fetchBytes(daemonAssetUrl(key)),
+      fetchBytes(checksumsUrl()).then((b) => b.toString("utf8"))
+    ]);
+    const expected = digestFor(manifest, assetName);
+    if (!expected) {
+      return { error: `SHA256SUMS for v${version2} has no entry for ${assetName}` };
+    }
+    const actual = createHash2("sha256").update(asset).digest("hex");
+    if (actual !== expected) {
+      return { error: `checksum mismatch for ${assetName} (expected ${expected}, got ${actual})` };
+    }
+    const binary = gunzipSync(asset);
+    mkdirSync10(daemonBinaryDir(), { recursive: true });
+    writeFileSync9(tempPath, binary);
+    chmodSync3(tempPath, 493);
+    renameSync4(tempPath, target);
+    return { path: target };
+  } catch (err) {
+    rmSync3(tempPath, { force: true });
+    const message = err instanceof Error ? err.message : String(err);
+    return { error: `failed to download failproofaid v${version2} for ${key}: ${message}` };
+  }
+}
+var DEFAULT_BASE_URL = "https://github.com/FailproofAI/failproofai/releases/download", DOWNLOAD_TIMEOUT_MS = 60000;
+var init_daemon_download = __esm(() => {
+  init_package();
+});
+
+// src/hooks/daemon-service.ts
+import { existsSync as existsSync21, mkdirSync as mkdirSync11, readFileSync as readFileSync16, writeFileSync as writeFileSync10, unlinkSync as unlinkSync3 } from "node:fs";
+import { homedir as homedir32 } from "node:os";
+import { resolve as resolve19, dirname as dirname9 } from "node:path";
+import { execFileSync as execFileSync4 } from "node:child_process";
+function setDaemonConfigured(value) {
+  const path3 = getConfigPathForScope("user");
+  let config = {};
+  try {
+    if (existsSync21(path3))
+      config = JSON.parse(readFileSync16(path3, "utf8"));
+  } catch {
+    return;
+  }
+  if (value)
+    config.daemonConfigured = true;
+  else
+    delete config.daemonConfigured;
+  try {
+    mkdirSync11(dirname9(path3), { recursive: true });
+    writeFileSync10(path3, JSON.stringify(config, null, 2) + `
+`, "utf8");
+  } catch {}
+}
+function isDaemonSupportedPlatform() {
+  return process.platform === "linux" || process.platform === "darwin";
+}
+function platformKey() {
+  const os4 = process.platform === "linux" ? "linux" : process.platform === "darwin" ? "darwin" : null;
+  const arch5 = process.arch === "x64" ? "x64" : process.arch === "arm64" ? "arm64" : null;
+  if (!os4 || !arch5)
+    return null;
+  return `${os4}-${arch5}`;
+}
+function resolveFailproofaidBinaryPath() {
+  if (process.env.FAILPROOFAI_DAEMON_BINARY)
+    return process.env.FAILPROOFAI_DAEMON_BINARY;
+  const downloaded = installedBinaryPath();
+  if (existsSync21(downloaded))
+    return downloaded;
+  const packageRoot = process.env.FAILPROOFAI_PACKAGE_ROOT;
+  if (packageRoot) {
+    for (const profile of ["release", "debug"]) {
+      const candidate = resolve19(packageRoot, "target", profile, "failproofaid");
+      if (existsSync21(candidate))
+        return candidate;
+    }
+  }
+  return null;
+}
+async function ensureFailproofaidBinary() {
+  const existing = resolveFailproofaidBinaryPath();
+  if (existing)
+    return { path: existing };
+  const key = platformKey();
+  if (!key) {
+    return { reason: `failproofaid has no prebuilt binary for ${process.platform}/${process.arch}` };
+  }
+  const result = await downloadFailproofaidBinary(key);
+  if (result.path)
+    return { path: result.path };
+  return { reason: result.error ?? "failproofaid binary could not be downloaded" };
+}
+function resolveWorkerCommand() {
+  if (process.env.FAILPROOFAI_WORKER_CMD)
+    return process.env.FAILPROOFAI_WORKER_CMD;
+  const packageRoot = process.env.FAILPROOFAI_PACKAGE_ROOT;
+  if (!packageRoot)
+    return null;
+  const workerScript = resolve19(packageRoot, "dist", "worker.mjs");
+  if (!existsSync21(workerScript))
+    return null;
+  return `node ${workerScript}`;
+}
+function systemdUnitPath() {
+  return resolve19(homedir32(), ".config", "systemd", "user", "failproofaid.service");
+}
+function launchdPlistPath() {
+  return resolve19(homedir32(), "Library", "LaunchAgents", "ai.failproof.failproofaid.plist");
+}
+function daemonServiceFilePath() {
+  if (!isDaemonSupportedPlatform())
+    return null;
+  return process.platform === "linux" ? systemdUnitPath() : launchdPlistPath();
+}
+function systemdUnitContents(binaryPath, workerCmd) {
+  const envLine = workerCmd ? `Environment="FAILPROOFAI_WORKER_CMD=${workerCmd}"
+` : "";
+  return `[Unit]
+Description=failproofai background daemon (failproofaid)
+After=network.target
+
+[Service]
+Type=simple
+${envLine}ExecStart=${binaryPath}
+Restart=on-failure
+RestartSec=2
+
+[Install]
+WantedBy=default.target
+`;
+}
+function escapeXml(s) {
+  return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+}
+function launchdPlistContents(binaryPath, logDir2, workerCmd) {
+  const envBlock = workerCmd ? `    <key>EnvironmentVariables</key>
+    <dict>
+        <key>FAILPROOFAI_WORKER_CMD</key>
+        <string>${escapeXml(workerCmd)}</string>
+    </dict>
+` : "";
+  return `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+    <key>Label</key>
+    <string>ai.failproof.failproofaid</string>
+    <key>ProgramArguments</key>
+    <array>
+        <string>${escapeXml(binaryPath)}</string>
+    </array>
+    <key>RunAtLoad</key>
+    <true/>
+    <key>KeepAlive</key>
+    <true/>
+${envBlock}    <key>StandardOutPath</key>
+    <string>${escapeXml(resolve19(logDir2, "failproofaid.log"))}</string>
+    <key>StandardErrorPath</key>
+    <string>${escapeXml(resolve19(logDir2, "failproofaid.err.log"))}</string>
+</dict>
+</plist>
+`;
+}
+async function installDaemonService() {
+  if (!isDaemonSupportedPlatform()) {
+    return { installed: false, reason: `failproofaid is not supported on ${process.platform} yet` };
+  }
+  const { path: binaryPath, reason: binaryReason } = await ensureFailproofaidBinary();
+  if (!binaryPath) {
+    return { installed: false, reason: binaryReason ?? "failproofaid binary not found for this platform" };
+  }
+  const workerCmd = resolveWorkerCommand();
+  try {
+    if (process.platform === "linux") {
+      const unitPath = systemdUnitPath();
+      mkdirSync11(dirname9(unitPath), { recursive: true });
+      writeFileSync10(unitPath, systemdUnitContents(binaryPath, workerCmd), "utf8");
+      execFileSync4("systemctl", ["--user", "daemon-reload"], {
+        stdio: "ignore",
+        timeout: SERVICE_CMD_TIMEOUT_MS
+      });
+      execFileSync4("systemctl", ["--user", "enable", "--now", "failproofaid.service"], {
+        stdio: "ignore",
+        timeout: SERVICE_CMD_TIMEOUT_MS
+      });
+    } else {
+      const plistPath = launchdPlistPath();
+      const logDir2 = resolve19(homedir32(), ".failproofai", "logs");
+      mkdirSync11(dirname9(plistPath), { recursive: true });
+      mkdirSync11(logDir2, { recursive: true });
+      writeFileSync10(plistPath, launchdPlistContents(binaryPath, logDir2, workerCmd), "utf8");
+      try {
+        execFileSync4("launchctl", ["unload", plistPath], {
+          stdio: "ignore",
+          timeout: SERVICE_CMD_TIMEOUT_MS
+        });
+      } catch {}
+      execFileSync4("launchctl", ["load", "-w", plistPath], {
+        stdio: "ignore",
+        timeout: SERVICE_CMD_TIMEOUT_MS
+      });
+    }
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    hookLogWarn(`daemon service install failed: ${msg}`);
+    return { installed: false, reason: msg };
+  }
+  if (!await waitForDaemonRunning()) {
+    const reason = `failproofaid was installed but did not reach a running state within ${SERVICE_START_TIMEOUT_MS}ms (status: ${daemonServiceStatus()})`;
+    hookLogWarn(`daemon service install failed: ${reason}`);
+    return { installed: false, reason };
+  }
+  return { installed: true };
+}
+async function waitForDaemonRunning() {
+  const deadline = Date.now() + SERVICE_START_TIMEOUT_MS;
+  for (;; ) {
+    if (daemonServiceStatus() === "running")
+      break;
+    if (Date.now() >= deadline)
+      return false;
+    await new Promise((r) => setTimeout(r, SERVICE_START_POLL_MS));
+  }
+  await new Promise((r) => setTimeout(r, SERVICE_SETTLE_MS));
+  return daemonServiceStatus() === "running";
+}
+function daemonServiceStatus() {
+  if (!isDaemonSupportedPlatform())
+    return "unsupported-platform";
+  if (process.platform === "linux") {
+    if (!existsSync21(systemdUnitPath()))
+      return "not-installed";
+    try {
+      const out = execFileSync4("systemctl", ["--user", "is-active", "failproofaid.service"], {
+        stdio: ["ignore", "pipe", "ignore"],
+        timeout: SERVICE_CMD_TIMEOUT_MS
+      }).toString().trim();
+      return out === "active" ? "running" : "stopped";
+    } catch {
+      return "stopped";
+    }
+  }
+  const plistPath = launchdPlistPath();
+  if (!existsSync21(plistPath))
+    return "not-installed";
+  try {
+    const out = execFileSync4("launchctl", ["list"], {
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout: SERVICE_CMD_TIMEOUT_MS
+    }).toString();
+    return out.includes("ai.failproof.failproofaid") ? "running" : "stopped";
+  } catch {
+    return "stopped";
+  }
+}
+var SERVICE_CMD_TIMEOUT_MS = 1e4, SERVICE_START_TIMEOUT_MS = 5000, SERVICE_START_POLL_MS = 100, SERVICE_SETTLE_MS = 750;
+var init_daemon_service = __esm(() => {
+  init_hook_logger();
+  init_hooks_config();
+  init_daemon_download();
+});
+
 // src/audit/cli.ts
 var exports_cli3 = {};
 __export(exports_cli3, {
@@ -22784,20 +23281,21 @@ __export(exports_configure_wizard, {
   hasSeenLauncher: () => hasSeenLauncher,
   describeCustomPolicies: () => describeCustomPolicies,
   clisSupportingScope: () => clisSupportingScope,
+  classifyDaemonInstallFailure: () => classifyDaemonInstallFailure,
   buildScopeChoices: () => buildScopeChoices,
   buildPresetChoices: () => buildPresetChoices,
   buildAgentChoices: () => buildAgentChoices
 });
-import { existsSync as existsSync20, mkdirSync as mkdirSync10, writeFileSync as writeFileSync9, readFileSync as readFileSync16 } from "node:fs";
-import { homedir as homedir30 } from "node:os";
-import { resolve as resolve17, sep as sep5 } from "node:path";
+import { existsSync as existsSync22, mkdirSync as mkdirSync12, writeFileSync as writeFileSync11, readFileSync as readFileSync17 } from "node:fs";
+import { homedir as homedir33 } from "node:os";
+import { resolve as resolve20, sep as sep5 } from "node:path";
 async function emit(event, props) {
   try {
     await trackHookEvent2(getInstanceId2(), event, props);
   } catch {}
 }
 function homeify(p) {
-  const home = homedir30();
+  const home = homedir33();
   if (p === home)
     return "~";
   if (p.startsWith(home + sep5))
@@ -22911,8 +23409,8 @@ function setCustomPoliciesEnabled(scope, cwd, enabled) {
   const path3 = getConfigPathForScope(scope, cwd);
   let config = {};
   try {
-    if (existsSync20(path3))
-      config = JSON.parse(readFileSync16(path3, "utf8"));
+    if (existsSync22(path3))
+      config = JSON.parse(readFileSync17(path3, "utf8"));
   } catch {
     return;
   }
@@ -22921,18 +23419,37 @@ function setCustomPoliciesEnabled(scope, cwd, enabled) {
   else
     config.customPoliciesEnabled = false;
   try {
-    writeFileSync9(path3, JSON.stringify(config, null, 2) + `
+    writeFileSync11(path3, JSON.stringify(config, null, 2) + `
 `, "utf8");
   } catch {}
 }
+function classifyDaemonInstallFailure(reason) {
+  if (!reason)
+    return "unknown";
+  if (/not supported on/.test(reason))
+    return "unsupported_platform";
+  if (/no prebuilt binary for/.test(reason))
+    return "unsupported_platform";
+  if (/binary not found/.test(reason))
+    return "binary_not_found";
+  if (/checksum mismatch|has no entry for/.test(reason))
+    return "checksum_mismatch";
+  if (/downloads are disabled/.test(reason))
+    return "downloads_disabled";
+  if (/failed to download/.test(reason))
+    return "download_failed";
+  if (/did not reach a running state/.test(reason))
+    return "did_not_start";
+  return "service_manager_error";
+}
 function describeCustomPolicies(cwd) {
   const active = [];
   const warnings = [];
   const scopes = [];
   let fileCount = 0;
   const dirs = [
-    { dir: resolve17(cwd, ".failproofai", "policies"), label: "project" },
-    { dir: resolve17(homedir30(), ".failproofai", "policies"), label: "global" }
+    { dir: resolve20(cwd, ".failproofai", "policies"), label: "project" },
+    { dir: resolve20(homedir33(), ".failproofai", "policies"), label: "global" }
   ];
   for (const { dir, label } of dirs) {
     const found = discoverPolicyFiles(dir);
@@ -22942,7 +23459,7 @@ function describeCustomPolicies(cwd) {
       fileCount += found.length;
     }
     for (const name of findSkippedPolicyFiles(dir)) {
-      warnings.push(`! ${homeify(resolve17(dir, name))} is NOT loaded — rename to ` + `${name.replace(/\.(js|mjs|ts)$/, "-policies.$1")}`);
+      warnings.push(`! ${homeify(resolve20(dir, name))} is NOT loaded — rename to ` + `${name.replace(/\.(js|mjs|ts)$/, "-policies.$1")}`);
     }
   }
   return { active, warnings, fileCount, scopes };
@@ -22955,6 +23472,9 @@ function reviewLines(state) {
   lines.push(`  Where      : ${where}`);
   lines.push(`  Assistants : ${assistantNames.length ? summarize(assistantNames, "assistants") : "(none)"}`);
   lines.push(`  Policies   : ${policies.length} enabled`);
+  if (scope === "user" && isDaemonSupportedPlatform()) {
+    lines.push(`  Daemon     : failproofaid will be installed/started as a background service`);
+  }
   const custom = describeCustomPolicies(cwd);
   if (custom.active.length > 0) {
     lines.push(`  Custom     : ${custom.active.join(" · ")} ${customEnabled === false ? "— DISABLED, will not load" : DIM_NOTE}`);
@@ -22970,18 +23490,23 @@ function reviewLines(state) {
     }
   }
   lines.push(`    ${homeify(getConfigPathForScope(scope, cwd))}   ${policies.length} policies`);
+  if (scope === "user" && isDaemonSupportedPlatform()) {
+    const servicePath = daemonServiceFilePath();
+    if (servicePath)
+      lines.push(`    ${homeify(servicePath)}   failproofaid service`);
+  }
   return lines;
 }
 function firstRunMarkerPath() {
-  return resolve17(homedir30(), ".failproofai", ".launcher-configured");
+  return resolve20(homedir33(), ".failproofai", ".launcher-configured");
 }
 function hasSeenLauncher() {
-  return existsSync20(firstRunMarkerPath());
+  return existsSync22(firstRunMarkerPath());
 }
 function markLauncherSeen() {
   try {
-    mkdirSync10(resolve17(homedir30(), ".failproofai"), { recursive: true });
-    writeFileSync9(firstRunMarkerPath(), "1", "utf8");
+    mkdirSync12(resolve20(homedir33(), ".failproofai"), { recursive: true });
+    writeFileSync11(firstRunMarkerPath(), "1", "utf8");
   } catch {}
 }
 function anyHooksInstalledGlobally() {
@@ -23104,11 +23629,27 @@ Use the flag form instead, e.g.:
   });
   await installHooks2(policies, scope, cwd, false, "configure-wizard", undefined, false, clis, { replace: true, quiet: true });
   setCustomPoliciesEnabled(scope, cwd, customEnabled);
+  let daemonInstalled = false;
+  if (scope === "user" && isDaemonSupportedPlatform()) {
+    const daemonResult = await installDaemonService();
+    if (daemonResult.installed) {
+      setDaemonConfigured(true);
+      daemonInstalled = true;
+    } else {
+      hookLogWarn(`failproofaid was not installed as a service: ${daemonResult.reason}`);
+    }
+    emit("configure_daemon_install", {
+      installed: daemonResult.installed,
+      reason: daemonResult.installed ? null : classifyDaemonInstallFailure(daemonResult.reason),
+      platform: process.platform
+    });
+  }
   await applied;
   markLauncherSeen();
   const customNote = customEnabled === true ? " + your custom policies" : customEnabled === false ? " · custom policies DISABLED" : "";
+  const daemonNote = daemonInstalled ? " · background daemon enabled" : "";
   const assistants = `${clis.length} assistant${clis.length === 1 ? "" : "s"}`;
-  outro(`Setup complete — ${policies.length} policies${customNote} · ${assistants}`, { ok: true }, stdout);
+  outro(`Setup complete — ${policies.length} policies${customNote} · ${assistants}${daemonNote}`, { ok: true }, stdout);
   return { applied: true, scope, clis, policies };
 }
 var EVERYTHING = "__everything__", ALL_CLIS = "__all_clis__", CUSTOM = "__custom__", DIM_NOTE = "(auto-loaded)";
@@ -23122,6 +23663,8 @@ var init_configure_wizard = __esm(() => {
   init_custom_hooks_loader();
   init_hook_telemetry2();
   init_telemetry_id2();
+  init_daemon_service();
+  init_hook_logger();
 });
 
 // scripts/launch.ts
@@ -23130,8 +23673,8 @@ __export(exports_launch2, {
   launch: () => launch2
 });
 import { spawn as spawn3 } from "child_process";
-import { realpathSync as realpathSync3, existsSync as existsSync21 } from "node:fs";
-import { resolve as resolve18, dirname as dirname9 } from "node:path";
+import { realpathSync as realpathSync3, existsSync as existsSync23 } from "node:fs";
+import { resolve as resolve21, dirname as dirname10 } from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 import { createInterface as createInterface3 } from "node:readline";
 function launch2(mode) {
@@ -23146,9 +23689,9 @@ function launch2(mode) {
     process.env.PORT = port;
     process.env.HOSTNAME = "0.0.0.0";
     cmd = "node";
-    const packageRoot = process.env.FAILPROOFAI_PACKAGE_ROOT ?? resolve18(dirname9(realpathSync3(fileURLToPath3(import.meta.url))), "..");
-    const serverJsPath = resolve18(packageRoot, ".next/standalone/server.js");
-    if (!existsSync21(serverJsPath)) {
+    const packageRoot = process.env.FAILPROOFAI_PACKAGE_ROOT ?? resolve21(dirname10(realpathSync3(fileURLToPath3(import.meta.url))), "..");
+    const serverJsPath = resolve21(packageRoot, ".next/standalone/server.js");
+    if (!existsSync23(serverJsPath)) {
       let shadowMessage = null;
       try {
         const diag = diagnoseShadow({ selfPackageRoot: packageRoot, selfVersion: version2 });
@@ -23243,17 +23786,17 @@ var init_cli_error2 = __esm(() => {
 
 // bin/failproofai.mjs
 import { realpathSync as realpathSync4 } from "fs";
-import { dirname as dirname10, resolve as resolve19 } from "path";
+import { dirname as dirname11, resolve as resolve22 } from "path";
 import { fileURLToPath as fileURLToPath4 } from "url";
 // package.json
-var version = "0.0.15";
+var version = "1.0.0-beta.0";
 
 // bin/failproofai.mjs
 if (!process.env.FAILPROOFAI_PACKAGE_ROOT) {
-  process.env.FAILPROOFAI_PACKAGE_ROOT = resolve19(dirname10(realpathSync4(fileURLToPath4(import.meta.url))), "..");
+  process.env.FAILPROOFAI_PACKAGE_ROOT = resolve22(dirname11(realpathSync4(fileURLToPath4(import.meta.url))), "..");
 }
 if (!process.env.FAILPROOFAI_DIST_PATH) {
-  process.env.FAILPROOFAI_DIST_PATH = resolve19(dirname10(realpathSync4(fileURLToPath4(import.meta.url))), "..", "dist");
+  process.env.FAILPROOFAI_DIST_PATH = resolve22(dirname11(realpathSync4(fileURLToPath4(import.meta.url))), "..", "dist");
 }
 var args = process.argv.slice(2);
 if (args[0] === "p")
@@ -23275,6 +23818,18 @@ async function track(name, props) {
     await _telemetry.trackHookEvent(_telemetry.getInstanceId(), name, props);
   } catch {}
 }
+async function exitAfterFlush(code) {
+  const drain = (stream) => new Promise((resolveDrain) => {
+    if (stream.writableLength === 0 || stream.destroyed)
+      resolveDrain();
+    else
+      stream.write("", () => resolveDrain());
+  });
+  try {
+    await Promise.all([drain(process.stdout), drain(process.stderr)]);
+  } catch {}
+  process.exit(code);
+}
 var hookIdx = args.indexOf("--hook");
 if (hookIdx >= 0) {
   if (!args[hookIdx + 1]) {
@@ -23287,9 +23842,32 @@ if (hookIdx >= 0) {
   const cliArg = cliIdx >= 0 ? args[cliIdx + 1] : undefined;
   const cli = cliArg && (cliArg === "claude" || cliArg === "codex" || cliArg === "copilot" || cliArg === "cursor" || cliArg === "opencode" || cliArg === "pi" || cliArg === "hermes" || cliArg === "openclaw" || cliArg === "factory" || cliArg === "devin" || cliArg === "antigravity" || cliArg === "goose") ? cliArg : "claude";
   try {
+    const { isDaemonConfigured: isDaemonConfigured2, tryDaemonHook: tryDaemonHook2 } = await Promise.resolve().then(() => (init_daemon_client(), exports_daemon_client));
+    if (isDaemonConfigured2()) {
+      const { readStdinPayload: readStdinPayload3 } = await Promise.resolve().then(() => exports_read_stdin);
+      const { evaluateHookEvent: evaluateHookEvent2 } = await Promise.resolve().then(() => (init_handler(), exports_handler));
+      const stdinRead = await readStdinPayload3();
+      const daemonResult = await tryDaemonHook2({
+        hookEvent: eventType,
+        cli,
+        stdin: stdinRead.payload,
+        cwd: process.cwd()
+      });
+      const result = daemonResult ?? await evaluateHookEvent2(eventType, cli, stdinRead.payload, {
+        forceDecision: {
+          decision: "deny",
+          reason: "failproofaid could not be reached. This machine is configured to run hooks through it " + "\u2014 check the daemon (see `failproofai config`) rather than retrying blindly."
+        }
+      });
+      if (result.stdout)
+        process.stdout.write(result.stdout);
+      if (result.stderr)
+        process.stderr.write(result.stderr);
+      await exitAfterFlush(result.exitCode);
+    }
     const { handleHookEvent: handleHookEvent2 } = await Promise.resolve().then(() => (init_handler(), exports_handler));
     const exitCode = await handleHookEvent2(eventType, cli);
-    process.exit(exitCode);
+    await exitAfterFlush(exitCode);
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
     await track("hook_dispatch_error", {