failproofai 0.0.6-beta.2 → 0.0.6-beta.3

package/dist/cli.mjs

@@ -281,6 +281,7 @@ function getCurrentBranch(cwd) {
       branch = execSync("git rev-parse --abbrev-ref HEAD", {
         cwd,
         encoding: "utf8",
+        stdio: ["pipe", "pipe", "pipe"],
         timeout: 3000
       }).trim();
       gitBranchCache.set(cwd, branch);
@@ -295,6 +296,7 @@ function getHeadSha(cwd) {
     const sha = execSync("git rev-parse HEAD", {
       cwd,
       encoding: "utf8",
+      stdio: ["pipe", "pipe", "pipe"],
       timeout: 3000
     }).trim();
     return sha || null;
@@ -312,6 +314,7 @@ function getThirdPartyCheckRuns(cwd, sha) {
     ], {
       cwd,
       encoding: "utf8",
+      stdio: ["pipe", "pipe", "pipe"],
       timeout: 15000
     }).trim();
     if (!json || json === "[]")
@@ -331,6 +334,7 @@ function getCommitStatuses(cwd, sha) {
     ], {
       cwd,
       encoding: "utf8",
+      stdio: ["pipe", "pipe", "pipe"],
       timeout: 15000
     }).trim();
     if (!json || json === "[]")
@@ -682,7 +686,7 @@ function extractAbsolutePaths(command) {
   return paths;
 }
 function blockReadOutsideCwd(ctx) {
-  const cwd = ctx.session?.cwd;
+  const cwd = process.env.CLAUDE_PROJECT_DIR || ctx.session?.cwd;
   if (!cwd)
     return allow();
   const allowPaths = ctx.params?.allowPaths ?? [];
@@ -905,6 +909,7 @@ function requireCommitBeforeStop(ctx) {
     const status = execSync("git status --porcelain", {
       cwd,
       encoding: "utf8",
+      stdio: ["pipe", "pipe", "pipe"],
       timeout: 5000
     }).trim();
     if (status.length > 0) {
@@ -923,6 +928,7 @@ function requirePushBeforeStop(ctx) {
     const remotes = execSync("git remote", {
       cwd,
       encoding: "utf8",
+      stdio: ["pipe", "pipe", "pipe"],
       timeout: 3000
     }).trim();
     if (!remotes)
@@ -936,11 +942,11 @@ function requirePushBeforeStop(ctx) {
       return allow(`On base branch "${baseBranch}", skipping push check.`);
     }
     try {
-      const ahead = execFileSync("git", ["log", `${remote}/${baseBranch}..HEAD`, "--oneline"], { cwd, encoding: "utf8", timeout: 5000 }).trim();
+      const ahead = execFileSync("git", ["log", `${remote}/${baseBranch}..HEAD`, "--oneline"], { cwd, encoding: "utf8", stdio: ["pipe", "pipe", "pipe"], timeout: 5000 }).trim();
       if (!ahead) {
         return allow(`No commits ahead of ${remote}/${baseBranch}, skipping push check.`);
       }
-      const diff = execFileSync("git", ["diff", "--stat", `${remote}/${baseBranch}`, "HEAD"], { cwd, encoding: "utf8", timeout: 5000 }).trim();
+      const diff = execFileSync("git", ["diff", "--stat", `${remote}/${baseBranch}`, "HEAD"], { cwd, encoding: "utf8", stdio: ["pipe", "pipe", "pipe"], timeout: 5000 }).trim();
       if (!diff) {
         return allow(`No file changes compared to ${remote}/${baseBranch}, skipping push check.`);
       }
@@ -950,6 +956,7 @@ function requirePushBeforeStop(ctx) {
       execFileSync("git", ["rev-parse", "--verify", `${remote}/${branch}`], {
         cwd,
         encoding: "utf8",
+        stdio: ["pipe", "pipe", "pipe"],
         timeout: 3000
       });
       hasTracking = true;
@@ -960,6 +967,7 @@ function requirePushBeforeStop(ctx) {
     const unpushed = execFileSync("git", ["log", `${remote}/${branch}..HEAD`, "--oneline"], {
       cwd,
       encoding: "utf8",
+      stdio: ["pipe", "pipe", "pipe"],
       timeout: 5000
     }).trim();
     if (unpushed.length > 0) {
@@ -978,7 +986,7 @@ function requirePrBeforeStop(ctx) {
     return allow("No working directory available, skipping PR check.");
   try {
     try {
-      execSync("gh --version", { cwd, encoding: "utf8", timeout: 3000 });
+      execSync("gh --version", { cwd, encoding: "utf8", stdio: ["pipe", "pipe", "pipe"], timeout: 3000 });
     } catch {
       return allow("GitHub CLI (gh) not installed, skipping PR check.");
     }
@@ -990,11 +998,11 @@ function requirePrBeforeStop(ctx) {
       return allow(`On base branch "${baseBranch}", skipping PR check.`);
     }
     try {
-      const ahead = execFileSync("git", ["log", `origin/${baseBranch}..HEAD`, "--oneline"], { cwd, encoding: "utf8", timeout: 5000 }).trim();
+      const ahead = execFileSync("git", ["log", `origin/${baseBranch}..HEAD`, "--oneline"], { cwd, encoding: "utf8", stdio: ["pipe", "pipe", "pipe"], timeout: 5000 }).trim();
       if (!ahead) {
         return allow(`No commits ahead of origin/${baseBranch}, skipping PR check.`);
       }
-      const diff = execFileSync("git", ["diff", "--stat", `origin/${baseBranch}`, "HEAD"], { cwd, encoding: "utf8", timeout: 5000 }).trim();
+      const diff = execFileSync("git", ["diff", "--stat", `origin/${baseBranch}`, "HEAD"], { cwd, encoding: "utf8", stdio: ["pipe", "pipe", "pipe"], timeout: 5000 }).trim();
       if (!diff) {
         return allow(`No file changes compared to origin/${baseBranch}, skipping PR check.`);
       }
@@ -1004,6 +1012,7 @@ function requirePrBeforeStop(ctx) {
       prJson = execSync("gh pr view --json number,url,state", {
         cwd,
         encoding: "utf8",
+        stdio: ["pipe", "pipe", "pipe"],
         timeout: 15000
       }).trim();
     } catch {
@@ -1018,13 +1027,14 @@ function requirePrBeforeStop(ctx) {
         execFileSync("git", ["fetch", "origin", `+refs/heads/${baseBranch}:refs/remotes/origin/${baseBranch}`], {
           cwd,
           encoding: "utf8",
+          stdio: ["pipe", "pipe", "pipe"],
           timeout: 1e4
         });
-        const freshAhead = execFileSync("git", ["log", `origin/${baseBranch}..HEAD`, "--oneline"], { cwd, encoding: "utf8", timeout: 5000 }).trim();
+        const freshAhead = execFileSync("git", ["log", `origin/${baseBranch}..HEAD`, "--oneline"], { cwd, encoding: "utf8", stdio: ["pipe", "pipe", "pipe"], timeout: 5000 }).trim();
         if (!freshAhead) {
           return allow(`PR #${pr.number} was merged; branch is up to date with ${baseBranch}.`);
         }
-        const freshDiff = execFileSync("git", ["diff", "--stat", `origin/${baseBranch}`, "HEAD"], { cwd, encoding: "utf8", timeout: 5000 }).trim();
+        const freshDiff = execFileSync("git", ["diff", "--stat", `origin/${baseBranch}`, "HEAD"], { cwd, encoding: "utf8", stdio: ["pipe", "pipe", "pipe"], timeout: 5000 }).trim();
         if (!freshDiff) {
           return allow(`PR #${pr.number} was merged; no file changes vs ${baseBranch}.`);
         }
@@ -1041,7 +1051,7 @@ function requireCiGreenBeforeStop(ctx) {
     return allow("No working directory available, skipping CI check.");
   try {
     try {
-      execSync("gh --version", { cwd, encoding: "utf8", timeout: 3000 });
+      execSync("gh --version", { cwd, encoding: "utf8", stdio: ["pipe", "pipe", "pipe"], timeout: 3000 });
     } catch {
       return allow("GitHub CLI (gh) not installed, skipping CI check.");
     }
@@ -1050,7 +1060,7 @@ function requireCiGreenBeforeStop(ctx) {
       return allow("Detached HEAD, skipping CI check.");
     let workflowRuns = [];
     try {
-      const runsJson = execFileSync("gh", ["run", "list", "--branch", branch, "--limit", "5", "--json", "status,conclusion,name"], { cwd, encoding: "utf8", timeout: 15000 }).trim();
+      const runsJson = execFileSync("gh", ["run", "list", "--branch", branch, "--limit", "5", "--json", "status,conclusion,name"], { cwd, encoding: "utf8", stdio: ["pipe", "pipe", "pipe"], timeout: 15000 }).trim();
       if (runsJson && runsJson !== "[]") {
         workflowRuns = JSON.parse(runsJson);
       }
@@ -2055,7 +2065,7 @@ var init_hook_activity_store = __esm(() => {
 });
 
 // package.json
-var version2 = "0.0.6-beta.2";
+var version2 = "0.0.6-beta.3";
 var init_package = () => {};
 
 // src/posthog-key.ts
@@ -2167,6 +2177,538 @@ var init_telemetry_id = __esm(() => {
   ID_FILE = path.join(ID_DIR, "instance-id");
 });
 
+// src/auth/token-store.ts
+import {
+  readFileSync as readFileSync3,
+  writeFileSync as writeFileSync3,
+  existsSync as existsSync5,
+  mkdirSync as mkdirSync4,
+  unlinkSync as unlinkSync2,
+  renameSync as renameSync3,
+  openSync,
+  closeSync
+} from "node:fs";
+import { join as join4 } from "node:path";
+import { homedir as homedir6 } from "node:os";
+function ensureAuthDir() {
+  if (!existsSync5(AUTH_DIR))
+    mkdirSync4(AUTH_DIR, { recursive: true, mode: 448 });
+}
+function readTokens() {
+  if (!existsSync5(AUTH_FILE))
+    return null;
+  try {
+    const raw = readFileSync3(AUTH_FILE, "utf8");
+    return JSON.parse(raw);
+  } catch {
+    return null;
+  }
+}
+function writeTokens(tokens) {
+  ensureAuthDir();
+  const tmpPath = `${AUTH_FILE}.tmp`;
+  const fd = openSync(tmpPath, "w", 384);
+  try {
+    writeFileSync3(fd, JSON.stringify(tokens, null, 2));
+  } finally {
+    closeSync(fd);
+  }
+  renameSync3(tmpPath, AUTH_FILE);
+}
+function clearTokens() {
+  if (existsSync5(AUTH_FILE))
+    unlinkSync2(AUTH_FILE);
+}
+function isLoggedIn() {
+  return existsSync5(AUTH_FILE);
+}
+var AUTH_DIR, AUTH_FILE;
+var init_token_store = __esm(() => {
+  AUTH_DIR = join4(homedir6(), ".failproofai");
+  AUTH_FILE = join4(AUTH_DIR, "auth.json");
+});
+
+// src/relay/queue.ts
+var exports_queue = {};
+__export(exports_queue, {
+  readProcessingFile: () => readProcessingFile,
+  queueSizeBytes: () => queueSizeBytes,
+  findOrphanProcessingFiles: () => findOrphanProcessingFiles,
+  deleteProcessingFile: () => deleteProcessingFile,
+  claimPendingBatch: () => claimPendingBatch,
+  appendToServerQueue: () => appendToServerQueue
+});
+import {
+  appendFileSync as appendFileSync3,
+  mkdirSync as mkdirSync5,
+  existsSync as existsSync6,
+  readFileSync as readFileSync4,
+  statSync as statSync3,
+  renameSync as renameSync4,
+  unlinkSync as unlinkSync3,
+  readdirSync as readdirSync3,
+  chmodSync
+} from "node:fs";
+import { join as join5 } from "node:path";
+import { homedir as homedir7 } from "node:os";
+import { createHash, randomUUID } from "node:crypto";
+function hashCwd(cwd) {
+  if (!cwd)
+    return null;
+  return createHash("sha256").update(cwd).digest("hex");
+}
+function redactReason(reason) {
+  if (!reason)
+    return reason ?? null;
+  return reason.replace(/AKIA[0-9A-Z]{16}/g, "[REDACTED-AWS-KEY]").replace(/eyJ[A-Za-z0-9_=-]+\.[A-Za-z0-9_=-]+\.[A-Za-z0-9_=-]+/g, "[REDACTED-JWT]").replace(/ghp_[A-Za-z0-9]{36,}/g, "[REDACTED-GH-TOKEN]").replace(/sk-[A-Za-z0-9]{20,}/g, "[REDACTED-API-KEY]").replace(/Bearer\s+[A-Za-z0-9_.=+-]+/gi, "Bearer [REDACTED]");
+}
+function sanitize(entry) {
+  return {
+    client_event_id: randomUUID(),
+    timestamp: entry.timestamp,
+    event_type: entry.eventType,
+    tool_name: entry.toolName ?? null,
+    policy_name: entry.policyName ?? null,
+    policy_names: entry.policyNames ?? [],
+    decision: entry.decision,
+    reason: redactReason(entry.reason),
+    duration_ms: entry.durationMs,
+    session_id: entry.sessionId ?? null,
+    cwd_hash: hashCwd(entry.cwd),
+    permission_mode: entry.permissionMode ?? null,
+    hook_event_name: entry.hookEventName ?? null
+  };
+}
+function ensureDir2() {
+  if (!existsSync6(QUEUE_DIR)) {
+    mkdirSync5(QUEUE_DIR, { recursive: true, mode: 448 });
+  }
+}
+function appendToServerQueue(entry) {
+  if (!isLoggedIn())
+    return;
+  ensureDir2();
+  try {
+    if (existsSync6(PENDING_FILE) && statSync3(PENDING_FILE).size > MAX_QUEUE_BYTES) {
+      return;
+    }
+  } catch {}
+  const sanitized = sanitize(entry);
+  appendFileSync3(PENDING_FILE, JSON.stringify(sanitized) + `
+`, { mode: 384 });
+  try {
+    chmodSync(PENDING_FILE, 384);
+  } catch {}
+}
+function queueSizeBytes() {
+  try {
+    return statSync3(PENDING_FILE).size;
+  } catch {
+    return 0;
+  }
+}
+function claimPendingBatch() {
+  if (!existsSync6(PENDING_FILE))
+    return null;
+  try {
+    const size = statSync3(PENDING_FILE).size;
+    if (size === 0)
+      return null;
+  } catch {
+    return null;
+  }
+  const seq = `${Date.now()}-${process.pid}`;
+  const processingFile = join5(QUEUE_DIR, `${PROCESSING_PREFIX}${seq}.jsonl`);
+  try {
+    renameSync4(PENDING_FILE, processingFile);
+    try {
+      chmodSync(processingFile, 384);
+    } catch {}
+    return processingFile;
+  } catch (err) {
+    const e = err;
+    if (e?.code === "ENOENT")
+      return null;
+    throw err;
+  }
+}
+function findOrphanProcessingFiles() {
+  ensureDir2();
+  try {
+    return readdirSync3(QUEUE_DIR).filter((n) => n.startsWith(PROCESSING_PREFIX) && n.endsWith(".jsonl")).map((n) => join5(QUEUE_DIR, n)).sort();
+  } catch {
+    return [];
+  }
+}
+function readProcessingFile(path2) {
+  if (!existsSync6(path2))
+    return [];
+  const content = readFileSync4(path2, "utf8");
+  const out = [];
+  for (const line of content.split(`
+`)) {
+    const trimmed = line.trim();
+    if (!trimmed)
+      continue;
+    try {
+      out.push(JSON.parse(trimmed));
+    } catch {}
+  }
+  return out;
+}
+function deleteProcessingFile(path2) {
+  try {
+    unlinkSync3(path2);
+  } catch {}
+}
+var QUEUE_DIR, PENDING_FILE, PROCESSING_PREFIX = "processing-", MAX_QUEUE_BYTES;
+var init_queue = __esm(() => {
+  init_token_store();
+  QUEUE_DIR = join5(homedir7(), ".failproofai", "cache", "server-queue");
+  PENDING_FILE = join5(QUEUE_DIR, "pending.jsonl");
+  MAX_QUEUE_BYTES = 50 * 1024 * 1024;
+});
+
+// src/relay/pid.ts
+import { readFileSync as readFileSync5, writeFileSync as writeFileSync4, existsSync as existsSync7, unlinkSync as unlinkSync4, mkdirSync as mkdirSync6 } from "node:fs";
+import { join as join6, dirname as dirname3 } from "node:path";
+import { homedir as homedir8 } from "node:os";
+function readPid() {
+  if (!existsSync7(PID_FILE))
+    return null;
+  try {
+    const raw = readFileSync5(PID_FILE, "utf8").trim();
+    const pid = parseInt(raw, 10);
+    if (Number.isNaN(pid) || pid <= 0)
+      return null;
+    return pid;
+  } catch {
+    return null;
+  }
+}
+function writePid(pid) {
+  const dir = dirname3(PID_FILE);
+  if (!existsSync7(dir))
+    mkdirSync6(dir, { recursive: true, mode: 448 });
+  writeFileSync4(PID_FILE, String(pid));
+}
+function clearPid() {
+  if (existsSync7(PID_FILE))
+    unlinkSync4(PID_FILE);
+}
+function isProcessAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (err) {
+    const e = err;
+    if (e?.code === "EPERM")
+      return true;
+    return false;
+  }
+}
+function stopRelay() {
+  const pid = readPid();
+  if (pid === null)
+    return false;
+  if (!isProcessAlive(pid)) {
+    clearPid();
+    return false;
+  }
+  try {
+    process.kill(pid, "SIGTERM");
+    clearPid();
+    return true;
+  } catch {
+    return false;
+  }
+}
+var PID_FILE;
+var init_pid = __esm(() => {
+  PID_FILE = join6(homedir8(), ".failproofai", "relay.pid");
+});
+
+// src/relay/daemon.ts
+var exports_daemon = {};
+__export(exports_daemon, {
+  waitForRelayAlive: () => waitForRelayAlive,
+  runOneShotSync: () => runOneShotSync,
+  runDaemon: () => runDaemon,
+  ensureRelayRunning: () => ensureRelayRunning
+});
+import { spawn } from "node:child_process";
+import { existsSync as existsSync8 } from "node:fs";
+import { join as join7 } from "node:path";
+import { homedir as homedir9 } from "node:os";
+import { randomUUID as randomUUID2 } from "node:crypto";
+function ensureRelayRunning() {
+  if (!isLoggedIn())
+    return;
+  const pid = readPid();
+  if (pid !== null && isProcessAlive(pid))
+    return;
+  if (pid !== null)
+    clearPid();
+  spawnDaemon();
+}
+function spawnDaemon() {
+  const entrypoint = process.env.FAILPROOFAI_RELAY_ENTRYPOINT ?? process.argv[1];
+  if (!entrypoint)
+    return;
+  const child = spawn(process.execPath, [entrypoint, "--relay-daemon"], {
+    detached: true,
+    stdio: "ignore",
+    env: { ...process.env, FAILPROOFAI_DAEMON: "1" }
+  });
+  child.unref();
+  if (typeof child.pid === "number") {
+    writePid(child.pid);
+  }
+}
+async function waitForRelayAlive(timeoutMs = 2000) {
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    const pid = readPid();
+    if (pid !== null && isProcessAlive(pid))
+      return true;
+    await new Promise((r) => setTimeout(r, 50));
+  }
+  return false;
+}
+async function refreshTokenIfNeeded() {
+  const tokens = readTokens();
+  if (!tokens)
+    return null;
+  const nowSec = Math.floor(Date.now() / 1000);
+  if (tokens.expires_at - nowSec > 300) {
+    return tokens.access_token;
+  }
+  try {
+    const resp = await fetch(`${tokens.server_url}/api/v1/auth/refresh`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ refresh_token: tokens.refresh_token }),
+      signal: AbortSignal.timeout(HTTP_TIMEOUT_MS)
+    });
+    if (!resp.ok)
+      return tokens.access_token;
+    const refreshed = await resp.json();
+    writeTokens({
+      ...tokens,
+      access_token: refreshed.access_token,
+      refresh_token: refreshed.refresh_token,
+      expires_at: nowSec + refreshed.expires_in
+    });
+    return refreshed.access_token;
+  } catch {
+    return tokens.access_token;
+  }
+}
+
+class Relay {
+  ws;
+  pendingAcks = new Map;
+  closed = false;
+  constructor(ws) {
+    this.ws = ws;
+    ws.onmessage = (ev) => this.handleMessage(ev.data);
+    ws.onclose = () => this.handleClose();
+    ws.onerror = () => this.handleClose();
+  }
+  handleMessage(data) {
+    try {
+      const msg = JSON.parse(data);
+      if (msg.ack && this.pendingAcks.has(msg.ack)) {
+        const resolve5 = this.pendingAcks.get(msg.ack);
+        this.pendingAcks.delete(msg.ack);
+        resolve5(true);
+      }
+    } catch {}
+  }
+  handleClose() {
+    this.closed = true;
+    for (const [, resolve5] of this.pendingAcks) {
+      resolve5(false);
+    }
+    this.pendingAcks.clear();
+  }
+  isClosed() {
+    return this.closed;
+  }
+  close() {
+    try {
+      this.ws.close();
+    } catch {}
+  }
+  async sendBatchAndWaitAck(events) {
+    if (this.closed)
+      return false;
+    const batchId = randomUUID2();
+    const ackPromise = new Promise((resolve5) => {
+      this.pendingAcks.set(batchId, resolve5);
+      setTimeout(() => {
+        if (this.pendingAcks.delete(batchId))
+          resolve5(false);
+      }, ACK_TIMEOUT_MS);
+    });
+    try {
+      this.ws.send(JSON.stringify({ batch_id: batchId, events }));
+    } catch {
+      this.pendingAcks.delete(batchId);
+      return false;
+    }
+    return ackPromise;
+  }
+}
+async function connect(wsUrl, token) {
+  const WSCtor = globalThis.WebSocket;
+  if (!WSCtor) {
+    throw new Error("WebSocket not available in this Node version. Requires Node 22+.");
+  }
+  const ws = new WSCtor(wsUrl);
+  await new Promise((resolve5, reject) => {
+    let settled = false;
+    const timeout = setTimeout(() => {
+      if (settled)
+        return;
+      settled = true;
+      try {
+        ws.close();
+      } catch {}
+      reject(new Error("WebSocket connect timeout"));
+    }, WS_CONNECT_TIMEOUT_MS);
+    ws.onopen = () => {
+      if (settled)
+        return;
+      settled = true;
+      clearTimeout(timeout);
+      try {
+        ws.send(token);
+        resolve5();
+      } catch (e) {
+        reject(e);
+      }
+    };
+    ws.onerror = (e) => {
+      if (settled)
+        return;
+      settled = true;
+      clearTimeout(timeout);
+      reject(e);
+    };
+    ws.onclose = () => {
+      if (settled)
+        return;
+      settled = true;
+      clearTimeout(timeout);
+      reject(new Error("WebSocket closed before opening"));
+    };
+  });
+  return ws;
+}
+async function sendProcessingFile(relay, path2) {
+  const events = readProcessingFile(path2);
+  if (events.length === 0)
+    return true;
+  for (let i = 0;i < events.length; i += BATCH_SIZE) {
+    const batch = events.slice(i, i + BATCH_SIZE);
+    const ok = await relay.sendBatchAndWaitAck(batch);
+    if (!ok)
+      return false;
+  }
+  return true;
+}
+async function runDaemon() {
+  let reconnectDelay = RECONNECT_BASE_MS;
+  while (true) {
+    const token = await refreshTokenIfNeeded();
+    const tokens = readTokens();
+    if (!token || !tokens) {
+      await new Promise((r) => setTimeout(r, 30000));
+      continue;
+    }
+    const wsUrl = `${tokens.server_url.replace(/^http/, "ws")}/ws/events/ingest`;
+    try {
+      const ws = await connect(wsUrl, token);
+      const relay = new Relay(ws);
+      reconnectDelay = RECONNECT_BASE_MS;
+      for (const orphan of findOrphanProcessingFiles()) {
+        if (relay.isClosed())
+          break;
+        const ok = await sendProcessingFile(relay, orphan);
+        if (ok)
+          deleteProcessingFile(orphan);
+      }
+      while (!relay.isClosed()) {
+        let processingFile = null;
+        try {
+          processingFile = claimPendingBatch();
+        } catch {}
+        if (processingFile) {
+          const ok = await sendProcessingFile(relay, processingFile);
+          if (ok) {
+            deleteProcessingFile(processingFile);
+          } else {
+            break;
+          }
+        }
+        await new Promise((r) => setTimeout(r, FLUSH_INTERVAL_MS));
+      }
+      relay.close();
+    } catch {}
+    if (existsSync8(QUEUE_DIR2)) {}
+    await new Promise((r) => setTimeout(r, reconnectDelay));
+    reconnectDelay = Math.min(reconnectDelay * 2, RECONNECT_MAX_MS);
+  }
+}
+async function runOneShotSync() {
+  const token = await refreshTokenIfNeeded();
+  const tokens = readTokens();
+  if (!token || !tokens) {
+    throw new Error("Not logged in. Run `failproofai login` first.");
+  }
+  let total = 0;
+  async function postBatch(events) {
+    const resp = await fetch(`${tokens.server_url}/api/v1/events/batch`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Authorization: `Bearer ${token}`
+      },
+      body: JSON.stringify({ events }),
+      signal: AbortSignal.timeout(HTTP_TIMEOUT_MS)
+    });
+    if (!resp.ok) {
+      throw new Error(`Sync failed: ${resp.status} ${resp.statusText}`);
+    }
+  }
+  for (const orphan of findOrphanProcessingFiles()) {
+    const events = readProcessingFile(orphan);
+    if (events.length > 0) {
+      await postBatch(events);
+      total += events.length;
+    }
+    deleteProcessingFile(orphan);
+  }
+  const processingFile = claimPendingBatch();
+  if (processingFile) {
+    const events = readProcessingFile(processingFile);
+    if (events.length > 0) {
+      await postBatch(events);
+      total += events.length;
+    }
+    deleteProcessingFile(processingFile);
+  }
+  return total;
+}
+var QUEUE_DIR2, BATCH_SIZE = 100, FLUSH_INTERVAL_MS = 2000, RECONNECT_BASE_MS = 1000, RECONNECT_MAX_MS = 60000, HTTP_TIMEOUT_MS = 1e4, WS_CONNECT_TIMEOUT_MS = 15000, ACK_TIMEOUT_MS = 30000;
+var init_daemon = __esm(() => {
+  init_token_store();
+  init_pid();
+  init_queue();
+  QUEUE_DIR2 = join7(homedir9(), ".failproofai", "cache", "server-queue");
+});
+
 // src/hooks/handler.ts
 var exports_handler = {};
 __export(exports_handler, {
@@ -2274,25 +2816,34 @@ async function handleHookEvent(eventType) {
   if (result.stderr) {
     process.stderr.write(result.stderr);
   }
+  const activityEntry = {
+    timestamp: Date.now(),
+    eventType,
+    toolName: parsed.tool_name ?? null,
+    policyName: result.policyName,
+    policyNames: result.policyNames,
+    decision: result.decision,
+    reason: result.reason,
+    durationMs,
+    sessionId: session.sessionId,
+    transcriptPath: session.transcriptPath,
+    cwd: session.cwd,
+    permissionMode: session.permissionMode,
+    hookEventName: session.hookEventName
+  };
   try {
-    persistHookActivity({
-      timestamp: Date.now(),
-      eventType,
-      toolName: parsed.tool_name ?? null,
-      policyName: result.policyName,
-      policyNames: result.policyNames,
-      decision: result.decision,
-      reason: result.reason,
-      durationMs,
-      sessionId: session.sessionId,
-      transcriptPath: session.transcriptPath,
-      cwd: session.cwd,
-      permissionMode: session.permissionMode,
-      hookEventName: session.hookEventName
-    });
+    persistHookActivity(activityEntry);
   } catch {
     hookLogWarn("activity persistence failed");
   }
+  try {
+    const { appendToServerQueue: appendToServerQueue2 } = await Promise.resolve().then(() => (init_queue(), exports_queue));
+    appendToServerQueue2(activityEntry);
+  } catch {}
+  try {
+    const { ensureRelayRunning: ensureRelayRunning2 } = await Promise.resolve().then(() => (init_daemon(), exports_daemon));
+    ensureRelayRunning2();
+  } catch {}
   if (result.decision === "deny" || result.decision === "instruct") {
     try {
       const isCustomHook = result.policyName?.startsWith("custom/") ?? false;
@@ -2327,6 +2878,287 @@ var init_handler = __esm(() => {
   init_hook_logger();
 });
 
+// src/relay/daemon.ts
+var exports_daemon2 = {};
+__export(exports_daemon2, {
+  waitForRelayAlive: () => waitForRelayAlive2,
+  runOneShotSync: () => runOneShotSync2,
+  runDaemon: () => runDaemon2,
+  ensureRelayRunning: () => ensureRelayRunning2
+});
+import { spawn as spawn2 } from "node:child_process";
+import { existsSync as existsSync9 } from "node:fs";
+import { join as join8 } from "node:path";
+import { homedir as homedir10 } from "node:os";
+import { randomUUID as randomUUID3 } from "node:crypto";
+function ensureRelayRunning2() {
+  if (!isLoggedIn())
+    return;
+  const pid = readPid();
+  if (pid !== null && isProcessAlive(pid))
+    return;
+  if (pid !== null)
+    clearPid();
+  spawnDaemon2();
+}
+function spawnDaemon2() {
+  const entrypoint = process.env.FAILPROOFAI_RELAY_ENTRYPOINT ?? process.argv[1];
+  if (!entrypoint)
+    return;
+  const child = spawn2(process.execPath, [entrypoint, "--relay-daemon"], {
+    detached: true,
+    stdio: "ignore",
+    env: { ...process.env, FAILPROOFAI_DAEMON: "1" }
+  });
+  child.unref();
+  if (typeof child.pid === "number") {
+    writePid(child.pid);
+  }
+}
+async function waitForRelayAlive2(timeoutMs = 2000) {
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    const pid = readPid();
+    if (pid !== null && isProcessAlive(pid))
+      return true;
+    await new Promise((r) => setTimeout(r, 50));
+  }
+  return false;
+}
+async function refreshTokenIfNeeded2() {
+  const tokens = readTokens();
+  if (!tokens)
+    return null;
+  const nowSec = Math.floor(Date.now() / 1000);
+  if (tokens.expires_at - nowSec > 300) {
+    return tokens.access_token;
+  }
+  try {
+    const resp = await fetch(`${tokens.server_url}/api/v1/auth/refresh`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ refresh_token: tokens.refresh_token }),
+      signal: AbortSignal.timeout(HTTP_TIMEOUT_MS2)
+    });
+    if (!resp.ok)
+      return tokens.access_token;
+    const refreshed = await resp.json();
+    writeTokens({
+      ...tokens,
+      access_token: refreshed.access_token,
+      refresh_token: refreshed.refresh_token,
+      expires_at: nowSec + refreshed.expires_in
+    });
+    return refreshed.access_token;
+  } catch {
+    return tokens.access_token;
+  }
+}
+
+class Relay2 {
+  ws;
+  pendingAcks = new Map;
+  closed = false;
+  constructor(ws) {
+    this.ws = ws;
+    ws.onmessage = (ev) => this.handleMessage(ev.data);
+    ws.onclose = () => this.handleClose();
+    ws.onerror = () => this.handleClose();
+  }
+  handleMessage(data) {
+    try {
+      const msg = JSON.parse(data);
+      if (msg.ack && this.pendingAcks.has(msg.ack)) {
+        const resolve5 = this.pendingAcks.get(msg.ack);
+        this.pendingAcks.delete(msg.ack);
+        resolve5(true);
+      }
+    } catch {}
+  }
+  handleClose() {
+    this.closed = true;
+    for (const [, resolve5] of this.pendingAcks) {
+      resolve5(false);
+    }
+    this.pendingAcks.clear();
+  }
+  isClosed() {
+    return this.closed;
+  }
+  close() {
+    try {
+      this.ws.close();
+    } catch {}
+  }
+  async sendBatchAndWaitAck(events) {
+    if (this.closed)
+      return false;
+    const batchId = randomUUID3();
+    const ackPromise = new Promise((resolve5) => {
+      this.pendingAcks.set(batchId, resolve5);
+      setTimeout(() => {
+        if (this.pendingAcks.delete(batchId))
+          resolve5(false);
+      }, ACK_TIMEOUT_MS2);
+    });
+    try {
+      this.ws.send(JSON.stringify({ batch_id: batchId, events }));
+    } catch {
+      this.pendingAcks.delete(batchId);
+      return false;
+    }
+    return ackPromise;
+  }
+}
+async function connect2(wsUrl, token) {
+  const WSCtor = globalThis.WebSocket;
+  if (!WSCtor) {
+    throw new Error("WebSocket not available in this Node version. Requires Node 22+.");
+  }
+  const ws = new WSCtor(wsUrl);
+  await new Promise((resolve5, reject) => {
+    let settled = false;
+    const timeout = setTimeout(() => {
+      if (settled)
+        return;
+      settled = true;
+      try {
+        ws.close();
+      } catch {}
+      reject(new Error("WebSocket connect timeout"));
+    }, WS_CONNECT_TIMEOUT_MS2);
+    ws.onopen = () => {
+      if (settled)
+        return;
+      settled = true;
+      clearTimeout(timeout);
+      try {
+        ws.send(token);
+        resolve5();
+      } catch (e) {
+        reject(e);
+      }
+    };
+    ws.onerror = (e) => {
+      if (settled)
+        return;
+      settled = true;
+      clearTimeout(timeout);
+      reject(e);
+    };
+    ws.onclose = () => {
+      if (settled)
+        return;
+      settled = true;
+      clearTimeout(timeout);
+      reject(new Error("WebSocket closed before opening"));
+    };
+  });
+  return ws;
+}
+async function sendProcessingFile2(relay, path2) {
+  const events = readProcessingFile(path2);
+  if (events.length === 0)
+    return true;
+  for (let i = 0;i < events.length; i += BATCH_SIZE2) {
+    const batch = events.slice(i, i + BATCH_SIZE2);
+    const ok = await relay.sendBatchAndWaitAck(batch);
+    if (!ok)
+      return false;
+  }
+  return true;
+}
+async function runDaemon2() {
+  let reconnectDelay = RECONNECT_BASE_MS2;
+  while (true) {
+    const token = await refreshTokenIfNeeded2();
+    const tokens = readTokens();
+    if (!token || !tokens) {
+      await new Promise((r) => setTimeout(r, 30000));
+      continue;
+    }
+    const wsUrl = `${tokens.server_url.replace(/^http/, "ws")}/ws/events/ingest`;
+    try {
+      const ws = await connect2(wsUrl, token);
+      const relay = new Relay2(ws);
+      reconnectDelay = RECONNECT_BASE_MS2;
+      for (const orphan of findOrphanProcessingFiles()) {
+        if (relay.isClosed())
+          break;
+        const ok = await sendProcessingFile2(relay, orphan);
+        if (ok)
+          deleteProcessingFile(orphan);
+      }
+      while (!relay.isClosed()) {
+        let processingFile = null;
+        try {
+          processingFile = claimPendingBatch();
+        } catch {}
+        if (processingFile) {
+          const ok = await sendProcessingFile2(relay, processingFile);
+          if (ok) {
+            deleteProcessingFile(processingFile);
+          } else {
+            break;
+          }
+        }
+        await new Promise((r) => setTimeout(r, FLUSH_INTERVAL_MS2));
+      }
+      relay.close();
+    } catch {}
+    if (existsSync9(QUEUE_DIR3)) {}
+    await new Promise((r) => setTimeout(r, reconnectDelay));
+    reconnectDelay = Math.min(reconnectDelay * 2, RECONNECT_MAX_MS2);
+  }
+}
+async function runOneShotSync2() {
+  const token = await refreshTokenIfNeeded2();
+  const tokens = readTokens();
+  if (!token || !tokens) {
+    throw new Error("Not logged in. Run `failproofai login` first.");
+  }
+  let total = 0;
+  async function postBatch(events) {
+    const resp = await fetch(`${tokens.server_url}/api/v1/events/batch`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Authorization: `Bearer ${token}`
+      },
+      body: JSON.stringify({ events }),
+      signal: AbortSignal.timeout(HTTP_TIMEOUT_MS2)
+    });
+    if (!resp.ok) {
+      throw new Error(`Sync failed: ${resp.status} ${resp.statusText}`);
+    }
+  }
+  for (const orphan of findOrphanProcessingFiles()) {
+    const events = readProcessingFile(orphan);
+    if (events.length > 0) {
+      await postBatch(events);
+      total += events.length;
+    }
+    deleteProcessingFile(orphan);
+  }
+  const processingFile = claimPendingBatch();
+  if (processingFile) {
+    const events = readProcessingFile(processingFile);
+    if (events.length > 0) {
+      await postBatch(events);
+      total += events.length;
+    }
+    deleteProcessingFile(processingFile);
+  }
+  return total;
+}
+var QUEUE_DIR3, BATCH_SIZE2 = 100, FLUSH_INTERVAL_MS2 = 2000, RECONNECT_BASE_MS2 = 1000, RECONNECT_MAX_MS2 = 60000, HTTP_TIMEOUT_MS2 = 1e4, WS_CONNECT_TIMEOUT_MS2 = 15000, ACK_TIMEOUT_MS2 = 30000;
+var init_daemon2 = __esm(() => {
+  init_token_store();
+  init_pid();
+  init_queue();
+  QUEUE_DIR3 = join8(homedir10(), ".failproofai", "cache", "server-queue");
+});
+
 // src/hooks/types.ts
 var HOOK_SCOPES, HOOK_EVENT_TYPES, FAILPROOFAI_HOOK_MARKER = "__failproofai_hook__";
 var init_types = __esm(() => {
@@ -2640,14 +3472,14 @@ __export(exports_manager, {
   getSettingsPath: () => getSettingsPath
 });
 import { execSync as execSync3 } from "node:child_process";
-import { readFileSync as readFileSync3, writeFileSync as writeFileSync3, existsSync as existsSync5, mkdirSync as mkdirSync4 } from "node:fs";
-import { resolve as resolve5, dirname as dirname3, basename as basename2 } from "node:path";
-import { homedir as homedir6, platform, arch, release, hostname } from "node:os";
+import { readFileSync as readFileSync6, writeFileSync as writeFileSync5, existsSync as existsSync10, mkdirSync as mkdirSync7 } from "node:fs";
+import { resolve as resolve5, dirname as dirname4, basename as basename2 } from "node:path";
+import { homedir as homedir11, platform, arch, release, hostname } from "node:os";
 function getSettingsPath(scope, cwd) {
   const base = cwd ? resolve5(cwd) : process.cwd();
   switch (scope) {
     case "user":
-      return resolve5(homedir6(), ".claude", "settings.json");
+      return resolve5(homedir11(), ".claude", "settings.json");
     case "project":
       return resolve5(base, ".claude", "settings.json");
     case "local":
@@ -2665,15 +3497,15 @@ function scopeLabel(scope) {
   }
 }
 function readSettings(settingsPath) {
-  if (!existsSync5(settingsPath)) {
+  if (!existsSync10(settingsPath)) {
     return {};
   }
-  const raw = readFileSync3(settingsPath, "utf8");
+  const raw = readFileSync6(settingsPath, "utf8");
   return JSON.parse(raw);
 }
 function writeSettings(settingsPath, settings) {
-  mkdirSync4(dirname3(settingsPath), { recursive: true });
-  writeFileSync3(settingsPath, JSON.stringify(settings, null, 2) + `
+  mkdirSync7(dirname4(settingsPath), { recursive: true });
+  writeFileSync5(settingsPath, JSON.stringify(settings, null, 2) + `
 `, "utf8");
 }
 function resolveFailproofaiBinary() {
@@ -2713,7 +3545,7 @@ function deduplicateScopes(scopes, cwd) {
 }
 function hooksInstalledInSettings(scope, cwd) {
   const settingsPath = getSettingsPath(scope, cwd);
-  if (!existsSync5(settingsPath))
+  if (!existsSync10(settingsPath))
     return false;
   try {
     const settings = readSettings(settingsPath);
@@ -2941,7 +3773,7 @@ async function removeHooks(policyNames, scope = "user", cwd, opts) {
   let totalRemoved = 0;
   for (const s of scopesToRemove) {
     const settingsPath = getSettingsPath(s, cwd);
-    if (!existsSync5(settingsPath)) {
+    if (!existsSync10(settingsPath)) {
       if (scope !== "all") {
         console.log("No settings file found. Nothing to remove.");
         return;
@@ -3116,7 +3948,7 @@ Failproof AI Hook Policies
   if (config.customPoliciesPath) {
     console.log(`
   ── Custom Policies (${config.customPoliciesPath}) ───────────────────────`);
-    if (!existsSync5(config.customPoliciesPath)) {
+    if (!existsSync10(config.customPoliciesPath)) {
       console.log(`  \x1B[31m✗ File not found: ${config.customPoliciesPath}\x1B[0m`);
     } else {
       const hooks = await loadCustomHooks(config.customPoliciesPath);
@@ -3134,7 +3966,7 @@ Failproof AI Hook Policies
   const base = cwd ? resolve5(cwd) : process.cwd();
   const conventionDirs = [
     { label: "Project", dir: resolve5(base, ".failproofai", "policies") },
-    { label: "User", dir: resolve5(homedir6(), ".failproofai", "policies") }
+    { label: "User", dir: resolve5(homedir11(), ".failproofai", "policies") }
   ];
   for (const { label, dir } of conventionDirs) {
     const files = discoverPolicyFiles(dir);
@@ -3174,11 +4006,210 @@ var init_manager = __esm(() => {
   VALID_POLICY_NAMES = new Set(BUILTIN_POLICIES.map((p) => p.name));
 });
 
+// src/auth/login.ts
+var exports_login = {};
+__export(exports_login, {
+  login: () => login
+});
+import { spawn as spawn3 } from "node:child_process";
+import { platform as platform2 } from "node:os";
+function openBrowser(url) {
+  const os2 = platform2();
+  try {
+    if (os2 === "darwin") {
+      spawn3("open", [url], { detached: true, stdio: "ignore" }).unref();
+    } else if (os2 === "win32") {
+      spawn3("cmd", ["/c", "start", "", url], { detached: true, stdio: "ignore" }).unref();
+    } else {
+      spawn3("xdg-open", [url], { detached: true, stdio: "ignore" }).unref();
+    }
+  } catch {}
+}
+async function postJson(url, body, timeoutMs = HTTP_TIMEOUT_MS3) {
+  const resp = await fetch(url, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify(body),
+    signal: AbortSignal.timeout(timeoutMs)
+  });
+  if (!resp.ok) {
+    throw new Error(`${url} → ${resp.status} ${resp.statusText}`);
+  }
+  return await resp.json();
+}
+async function login() {
+  const serverUrl = DEFAULT_SERVER_URL;
+  console.log("Requesting device code...");
+  const dc = await postJson(`${serverUrl}/api/v1/auth/device-code`, {});
+  console.log(`
+  Open this URL in your browser (will be opened automatically):`);
+  console.log(`    ${dc.verification_url}
+`);
+  console.log(`  Your code: ${dc.user_code}
+`);
+  openBrowser(dc.verification_url);
+  const deadline = Date.now() + dc.expires_in * 1000;
+  const intervalMs = dc.interval * 1000;
+  while (Date.now() < deadline) {
+    await new Promise((r) => setTimeout(r, intervalMs));
+    try {
+      const result = await postJson(`${serverUrl}/api/v1/auth/device-token`, { device_code: dc.device_code });
+      if ("access_token" in result) {
+        const tokens = {
+          access_token: result.access_token,
+          refresh_token: result.refresh_token,
+          expires_at: Math.floor(Date.now() / 1000) + result.expires_in,
+          user_email: result.user.email,
+          user_id: result.user.id,
+          server_url: serverUrl
+        };
+        writeTokens(tokens);
+        console.log(`Logged in as ${result.user.email}`);
+        try {
+          const { ensureRelayRunning: ensureRelayRunning3 } = await Promise.resolve().then(() => (init_daemon(), exports_daemon));
+          ensureRelayRunning3();
+          console.log("Relay daemon started.");
+        } catch (e) {
+          console.warn("Failed to auto-start relay daemon:", e);
+        }
+        return;
+      }
+    } catch {}
+  }
+  throw new Error("Login timed out. Run `failproofai login` again.");
+}
+var DEFAULT_SERVER_URL, HTTP_TIMEOUT_MS3 = 1e4;
+var init_login = __esm(() => {
+  init_token_store();
+  DEFAULT_SERVER_URL = process.env.FAILPROOFAI_SERVER_URL ?? "https://api.befailproof.ai";
+});
+
+// src/auth/logout.ts
+var exports_logout = {};
+__export(exports_logout, {
+  whoami: () => whoami,
+  logout: () => logout
+});
+async function logout() {
+  const tokens = readTokens();
+  if (!tokens) {
+    console.log("Not logged in.");
+    return;
+  }
+  try {
+    await fetch(`${tokens.server_url}/api/v1/auth/logout`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ refresh_token: tokens.refresh_token }),
+      signal: AbortSignal.timeout(LOGOUT_TIMEOUT_MS)
+    });
+  } catch {}
+  try {
+    stopRelay();
+  } catch {}
+  clearTokens();
+  console.log("Logged out.");
+}
+function whoami() {
+  const tokens = readTokens();
+  if (!tokens) {
+    console.log("Not logged in. Run `failproofai login` to authenticate.");
+    process.exit(1);
+  }
+  console.log(`Logged in as ${tokens.user_email}`);
+  console.log(`Server: ${tokens.server_url}`);
+  const expiresIn = tokens.expires_at - Math.floor(Date.now() / 1000);
+  if (expiresIn > 0) {
+    console.log(`Access token expires in ${Math.floor(expiresIn / 60)} minutes`);
+  } else {
+    console.log(`Access token expired (will refresh on next use)`);
+  }
+}
+var LOGOUT_TIMEOUT_MS = 3000;
+var init_logout = __esm(() => {
+  init_token_store();
+  init_pid();
+});
+
+// src/relay/pid.ts
+var exports_pid = {};
+__export(exports_pid, {
+  writePid: () => writePid2,
+  stopRelay: () => stopRelay2,
+  relayStatus: () => relayStatus,
+  readPid: () => readPid2,
+  isProcessAlive: () => isProcessAlive2,
+  clearPid: () => clearPid2
+});
+import { readFileSync as readFileSync7, writeFileSync as writeFileSync6, existsSync as existsSync11, unlinkSync as unlinkSync5, mkdirSync as mkdirSync8 } from "node:fs";
+import { join as join9, dirname as dirname5 } from "node:path";
+import { homedir as homedir12 } from "node:os";
+function readPid2() {
+  if (!existsSync11(PID_FILE2))
+    return null;
+  try {
+    const raw = readFileSync7(PID_FILE2, "utf8").trim();
+    const pid = parseInt(raw, 10);
+    if (Number.isNaN(pid) || pid <= 0)
+      return null;
+    return pid;
+  } catch {
+    return null;
+  }
+}
+function writePid2(pid) {
+  const dir = dirname5(PID_FILE2);
+  if (!existsSync11(dir))
+    mkdirSync8(dir, { recursive: true, mode: 448 });
+  writeFileSync6(PID_FILE2, String(pid));
+}
+function clearPid2() {
+  if (existsSync11(PID_FILE2))
+    unlinkSync5(PID_FILE2);
+}
+function isProcessAlive2(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (err) {
+    const e = err;
+    if (e?.code === "EPERM")
+      return true;
+    return false;
+  }
+}
+function stopRelay2() {
+  const pid = readPid2();
+  if (pid === null)
+    return false;
+  if (!isProcessAlive2(pid)) {
+    clearPid2();
+    return false;
+  }
+  try {
+    process.kill(pid, "SIGTERM");
+    clearPid2();
+    return true;
+  } catch {
+    return false;
+  }
+}
+function relayStatus() {
+  const pid = readPid2();
+  if (pid === null)
+    return { running: false, pid: null };
+  return { running: isProcessAlive2(pid), pid };
+}
+var PID_FILE2;
+var init_pid2 = __esm(() => {
+  PID_FILE2 = join9(homedir12(), ".failproofai", "relay.pid");
+});
+
 // lib/paths.ts
-import { homedir as homedir7 } from "os";
-import { join as join4 } from "path";
+import { homedir as homedir13 } from "os";
+import { join as join10 } from "path";
 function getDefaultClaudeProjectsPath() {
-  return join4(homedir7(), ".claude", "projects");
+  return join10(homedir13(), ".claude", "projects");
 }
 var init_paths = () => {};
 
@@ -3250,9 +4281,9 @@ var exports_launch = {};
 __export(exports_launch, {
   launch: () => launch
 });
-import { spawn } from "child_process";
-import { realpathSync, existsSync as existsSync6 } from "node:fs";
-import { resolve as resolve7, dirname as dirname4 } from "node:path";
+import { spawn as spawn4 } from "child_process";
+import { realpathSync, existsSync as existsSync12 } from "node:fs";
+import { resolve as resolve7, dirname as dirname6 } from "node:path";
 import { fileURLToPath } from "node:url";
 function launch(mode) {
   const { claudeProjectsPath: parsedPath, loggingLevel, disableTelemetry, allowedDevOrigins, remainingArgs } = parseScriptArgs(process.argv.slice(2));
@@ -3283,9 +4314,9 @@ function launch(mode) {
     process.env.PORT = port;
     process.env.HOSTNAME = "0.0.0.0";
     cmd = "node";
-    const packageRoot = process.env.FAILPROOFAI_PACKAGE_ROOT ?? resolve7(dirname4(realpathSync(fileURLToPath(import.meta.url))), "..");
+    const packageRoot = process.env.FAILPROOFAI_PACKAGE_ROOT ?? resolve7(dirname6(realpathSync(fileURLToPath(import.meta.url))), "..");
     const serverJsPath = resolve7(packageRoot, ".next/standalone/server.js");
-    if (!existsSync6(serverJsPath)) {
+    if (!existsSync12(serverJsPath)) {
       console.error(`
 Error: Cannot find server.js at:
   ${serverJsPath}
@@ -3301,7 +4332,7 @@ Error: Cannot find server.js at:
     cmd = "bunx";
     cmdArgs = ["--bun", "next", "dev", ...remainingArgs];
   }
-  const nextProcess = spawn(cmd, cmdArgs, {
+  const nextProcess = spawn4(cmd, cmdArgs, {
     stdio: "inherit",
     env: {
       ...process.env,
@@ -3344,17 +4375,17 @@ var init_cli_error2 = __esm(() => {
 
 // bin/failproofai.mjs
 import { realpathSync as realpathSync2 } from "fs";
-import { dirname as dirname5, resolve as resolve8 } from "path";
+import { dirname as dirname7, resolve as resolve8 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 // package.json
-var version = "0.0.6-beta.2";
+var version = "0.0.6-beta.3";
 
 // bin/failproofai.mjs
 if (!process.env.FAILPROOFAI_PACKAGE_ROOT) {
-  process.env.FAILPROOFAI_PACKAGE_ROOT = resolve8(dirname5(realpathSync2(fileURLToPath2(import.meta.url))), "..");
+  process.env.FAILPROOFAI_PACKAGE_ROOT = resolve8(dirname7(realpathSync2(fileURLToPath2(import.meta.url))), "..");
 }
 if (!process.env.FAILPROOFAI_DIST_PATH) {
-  process.env.FAILPROOFAI_DIST_PATH = resolve8(dirname5(realpathSync2(fileURLToPath2(import.meta.url))), "..", "dist");
+  process.env.FAILPROOFAI_DIST_PATH = resolve8(dirname7(realpathSync2(fileURLToPath2(import.meta.url))), "..", "dist");
 }
 var args = process.argv.slice(2);
 if (args[0] === "p")
@@ -3376,8 +4407,19 @@ if (hookIdx >= 0) {
     process.exit(2);
   }
 }
+if (args.includes("--relay-daemon")) {
+  try {
+    const { runDaemon: runDaemon3 } = await Promise.resolve().then(() => (init_daemon2(), exports_daemon2));
+    await runDaemon3();
+    process.exit(0);
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    console.error(`Relay daemon error: ${msg}`);
+    process.exit(1);
+  }
+}
 async function runCli() {
-  const SUBCOMMANDS = ["policies"];
+  const SUBCOMMANDS = ["policies", "login", "logout", "whoami", "relay", "sync"];
   if ((args.includes("--help") || args.includes("-h")) && !SUBCOMMANDS.includes(args[0])) {
     const extraArgs = args.filter((a) => a !== "--help" && a !== "-h");
     if (extraArgs.length > 0) {
@@ -3408,6 +4450,12 @@ COMMANDS
 
   policies --help, -h            Show this help for the policies command
 
+  login                          Authenticate with the failproofai cloud (Google OAuth)
+  logout                         Clear local auth tokens and stop relay daemon
+  whoami                         Print current logged-in user
+  relay start|stop|status        Manage the event relay daemon
+  sync                           One-shot flush of pending events to the server
+
   --version, -v                  Print version and exit
   --help, -h                     Show this help message
 
@@ -3552,6 +4600,59 @@ Run \`failproofai policies --help\` for usage.`);
     await listHooks2();
     process.exit(0);
   }
+  if (args[0] === "login") {
+    const { login: login2 } = await Promise.resolve().then(() => (init_login(), exports_login));
+    await login2();
+    process.exit(0);
+  }
+  if (args[0] === "logout") {
+    const { logout: logout2 } = await Promise.resolve().then(() => (init_logout(), exports_logout));
+    await logout2();
+    process.exit(0);
+  }
+  if (args[0] === "whoami") {
+    const { whoami: whoami2 } = await Promise.resolve().then(() => (init_logout(), exports_logout));
+    whoami2();
+    process.exit(0);
+  }
+  if (args[0] === "relay") {
+    const subcmd = args[1];
+    const { relayStatus: relayStatus2, stopRelay: stopRelay3 } = await Promise.resolve().then(() => (init_pid2(), exports_pid));
+    if (subcmd === "status") {
+      const s = relayStatus2();
+      if (s.running)
+        console.log(`Relay daemon running (pid ${s.pid})`);
+      else if (s.pid !== null)
+        console.log(`Stale PID file (${s.pid}); daemon not running`);
+      else
+        console.log("Relay daemon not running");
+      process.exit(0);
+    }
+    if (subcmd === "stop") {
+      const stopped = stopRelay3();
+      console.log(stopped ? "Relay daemon stopped" : "Relay daemon was not running");
+      process.exit(0);
+    }
+    if (subcmd === "start") {
+      const { ensureRelayRunning: ensureRelayRunning3, waitForRelayAlive: waitForRelayAlive3 } = await Promise.resolve().then(() => (init_daemon2(), exports_daemon2));
+      ensureRelayRunning3();
+      const alive = await waitForRelayAlive3();
+      const s = relayStatus2();
+      if (alive && s.running) {
+        console.log(`Relay daemon started (pid ${s.pid})`);
+        process.exit(0);
+      }
+      console.log("Failed to start daemon");
+      process.exit(1);
+    }
+    throw new CliError3(`Usage: failproofai relay <start|stop|status>`);
+  }
+  if (args[0] === "sync") {
+    const { runOneShotSync: runOneShotSync3 } = await Promise.resolve().then(() => (init_daemon2(), exports_daemon2));
+    const count = await runOneShotSync3();
+    console.log(`Synced ${count} event${count === 1 ? "" : "s"} to server`);
+    process.exit(0);
+  }
   const knownFlags = ["--version", "-v", "--help", "-h", "--hook"];
   const unknownFlag = args.find((a) => a.startsWith("-") && !knownFlags.includes(a));
   if (unknownFlag) {
@@ -3563,7 +4664,7 @@ Run \`failproofai policies --help\` for usage.`);
           dp[i][j] = a[i - 1] === b[j - 1] ? dp[i - 1][j - 1] : 1 + Math.min(dp[i - 1][j], dp[i][j - 1], dp[i - 1][j - 1]);
       return dp[m][n];
     };
-    const primary = ["--version", "--help", "--hook", "policies"];
+    const primary = ["--version", "--help", "--hook", "policies", "login", "logout", "whoami", "relay", "sync"];
     const closest = primary.reduce((best, flag) => {
       const dist = levenshtein(unknownFlag, flag);
       return dist < best.dist ? { flag, dist } : best;
@@ -3572,7 +4673,7 @@ Run \`failproofai policies --help\` for usage.`);
 Did you mean: ${closest.flag}?
 Run \`failproofai --help\` for usage details.`);
   }
-  const unknownSubcommand = args.find((a) => !a.startsWith("-") && a !== "policies");
+  const unknownSubcommand = args.find((a) => !a.startsWith("-") && !SUBCOMMANDS.includes(a));
   if (unknownSubcommand) {
     throw new CliError3(`Unknown command: ${unknownSubcommand}
 Did you mean: failproofai policies?