failproofai 1.0.0-beta.11 → 1.0.0-beta.13

package/dist/cli.mjs

@@ -19,7 +19,7 @@ var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
 var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
 // package.json
-var version2 = "1.0.0-beta.11", package_default;
+var version2 = "1.0.0-beta.13", package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "failproofai",
@@ -124,12 +124,12 @@ var init_package = __esm(() => {
       "html-to-image": "^1.11.13",
       html2canvas: "^1.4.1",
       "posthog-node": "^5.47.7",
-      "smol-toml": "^1.7.1",
       "sql.js": "^1.14.1",
       yaml: "^2.9.0"
     },
     overrides: {
       postcss: "8.5.23",
+      nanoid: "3.3.17",
       "eslint-plugin-react-hooks": "7.0.1",
       vite: "8.0.16",
       undici: "7.29.0",
@@ -137,16 +137,16 @@ var init_package = __esm(() => {
       sharp: "0.35.0"
     },
     optionalDependencies: {
-      "@failproofai/failproofaid-linux-x64": "1.0.0-beta.11",
-      "@failproofai/failproofaid-linux-arm64": "1.0.0-beta.11",
-      "@failproofai/failproofaid-darwin-x64": "1.0.0-beta.11",
-      "@failproofai/failproofaid-darwin-arm64": "1.0.0-beta.11"
+      "@failproofai/failproofaid-linux-x64": "1.0.0-beta.13",
+      "@failproofai/failproofaid-linux-arm64": "1.0.0-beta.13",
+      "@failproofai/failproofaid-darwin-x64": "1.0.0-beta.13",
+      "@failproofai/failproofaid-darwin-arm64": "1.0.0-beta.13"
     },
     failproofaidBinaries: {
-      "linux-x64": "e0621c8dd2b5f20e82d14e0a818832a065fb88b025da2a1769f2f81ee903ba89",
-      "linux-arm64": "e15da1fab4d2655f587b5e8423e8b36058f839dbbbd5630fac5bad2b1a4a7ecf",
-      "darwin-x64": "d54d493e905db563b33c14ad0d5cb0f16579cf2b9ec558ae0276855f323668f6",
-      "darwin-arm64": "2b27fb6968d149dc9edf4d5f85d60df564dd13c3db011629e1789a487aa0a375"
+      "linux-x64": "b96dd035433adbf1290ad8b4ed32fc8134d4dfc03057b8f6a210c041ac7d8d93",
+      "linux-arm64": "0e11c7349de7d10488a6ea8f80714260e3dbedabcd06b0ab530119970b16404d",
+      "darwin-x64": "7d2943d6126430d9282ca106918be8aa2e0133c4c7189493996b14cbbb361d06",
+      "darwin-arm64": "dd6c646611ee81d7db88254917232bd5b0cfac514657bd2ce1062c7bb24cf960"
     }
   };
 });
@@ -154,971 +154,6 @@ var init_package = __esm(() => {
 // src/posthog-key.ts
 var POSTHOG_API_KEY = "phc_Ac1Ww1GqKc0z1SyrRWbmatEeQdlOQIsDEEdP8l8JRgX", POSTHOG_PRODUCT = "failproofai-oss";
 
-// node_modules/smol-toml/dist/date.js
-var DATE_TIME_RE, TomlDate;
-var init_date = __esm(() => {
-  /*!
-   * Copyright (c) Squirrel Chat et al., All rights reserved.
-   * SPDX-License-Identifier: BSD-3-Clause
-   *
-   * Redistribution and use in source and binary forms, with or without
-   * modification, are permitted provided that the following conditions are met:
-   *
-   * 1. Redistributions of source code must retain the above copyright notice, this
-   *    list of conditions and the following disclaimer.
-   * 2. Redistributions in binary form must reproduce the above copyright notice,
-   *    this list of conditions and the following disclaimer in the
-   *    documentation and/or other materials provided with the distribution.
-   * 3. Neither the name of the copyright holder nor the names of its contributors
-   *    may be used to endorse or promote products derived from this software without
-   *    specific prior written permission.
-   *
-   * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
-   * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
-   * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
-   * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
-   * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
-   * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
-   * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
-   * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
-   * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-   * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-   */
-  DATE_TIME_RE = /^(\d{4}-\d{2}-\d{2})?[T ]?(?:(\d{2}):\d{2}(?::\d{2}(?:\.\d+)?)?)?(Z|[-+]\d{2}:\d{2})?$/i;
-  TomlDate = class TomlDate extends Date {
-    #hasDate = false;
-    #hasTime = false;
-    #offset = null;
-    constructor(date) {
-      let hasDate = true;
-      let hasTime = true;
-      let offset = "Z";
-      if (typeof date === "string") {
-        let match = date.match(DATE_TIME_RE);
-        if (match) {
-          if (!match[1]) {
-            hasDate = false;
-            date = `0000-01-01T${date}`;
-          }
-          hasTime = !!match[2];
-          hasTime && date[10] === " " && (date = date.replace(" ", "T"));
-          if (match[2] && +match[2] > 23) {
-            date = "";
-          } else {
-            offset = match[3] || null;
-            date = date.toUpperCase();
-            if (!offset && hasTime)
-              date += "Z";
-          }
-        } else {
-          date = "";
-        }
-      }
-      super(date);
-      if (!isNaN(this.getTime())) {
-        this.#hasDate = hasDate;
-        this.#hasTime = hasTime;
-        this.#offset = offset;
-      }
-    }
-    isDateTime() {
-      return this.#hasDate && this.#hasTime;
-    }
-    isLocal() {
-      return !this.#hasDate || !this.#hasTime || !this.#offset;
-    }
-    isDate() {
-      return this.#hasDate && !this.#hasTime;
-    }
-    isTime() {
-      return this.#hasTime && !this.#hasDate;
-    }
-    isValid() {
-      return this.#hasDate || this.#hasTime;
-    }
-    toISOString() {
-      let iso = super.toISOString();
-      if (this.isDate())
-        return iso.slice(0, 10);
-      if (this.isTime())
-        return iso.slice(11, 23);
-      if (this.#offset === null)
-        return iso.slice(0, -1);
-      if (this.#offset === "Z")
-        return iso;
-      let offset = +this.#offset.slice(1, 3) * 60 + +this.#offset.slice(4, 6);
-      offset = this.#offset[0] === "-" ? offset : -offset;
-      let offsetDate = new Date(this.getTime() - offset * 60000);
-      return offsetDate.toISOString().slice(0, -1) + this.#offset;
-    }
-    static wrapAsOffsetDateTime(jsDate, offset = "Z") {
-      let date = new TomlDate(jsDate);
-      date.#offset = offset;
-      return date;
-    }
-    static wrapAsLocalDateTime(jsDate) {
-      let date = new TomlDate(jsDate);
-      date.#offset = null;
-      return date;
-    }
-    static wrapAsLocalDate(jsDate) {
-      let date = new TomlDate(jsDate);
-      date.#hasTime = false;
-      date.#offset = null;
-      return date;
-    }
-    static wrapAsLocalTime(jsDate) {
-      let date = new TomlDate(jsDate);
-      date.#hasDate = false;
-      date.#offset = null;
-      return date;
-    }
-  };
-});
-
-// node_modules/smol-toml/dist/error.js
-function getLineColFromPtr(string, ptr) {
-  let lines = string.slice(0, ptr).split(/\r\n|\n|\r/g);
-  return [lines.length, lines.pop().length + 1];
-}
-function makeCodeBlock(string, line, column) {
-  let lines = string.split(/\r\n|\n|\r/g);
-  let codeblock = "";
-  let numberLen = (Math.log10(line + 1) | 0) + 1;
-  for (let i = line - 1;i <= line + 1; i++) {
-    let l = lines[i - 1];
-    if (!l)
-      continue;
-    codeblock += i.toString().padEnd(numberLen, " ");
-    codeblock += ":  ";
-    codeblock += l;
-    codeblock += `
-`;
-    if (i === line) {
-      codeblock += " ".repeat(numberLen + column + 2);
-      codeblock += `^
-`;
-    }
-  }
-  return codeblock;
-}
-var TomlError;
-var init_error = __esm(() => {
-  /*!
-   * Copyright (c) Squirrel Chat et al., All rights reserved.
-   * SPDX-License-Identifier: BSD-3-Clause
-   *
-   * Redistribution and use in source and binary forms, with or without
-   * modification, are permitted provided that the following conditions are met:
-   *
-   * 1. Redistributions of source code must retain the above copyright notice, this
-   *    list of conditions and the following disclaimer.
-   * 2. Redistributions in binary form must reproduce the above copyright notice,
-   *    this list of conditions and the following disclaimer in the
-   *    documentation and/or other materials provided with the distribution.
-   * 3. Neither the name of the copyright holder nor the names of its contributors
-   *    may be used to endorse or promote products derived from this software without
-   *    specific prior written permission.
-   *
-   * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
-   * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
-   * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
-   * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
-   * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
-   * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
-   * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
-   * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
-   * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-   * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-   */
-  TomlError = class TomlError extends Error {
-    line;
-    column;
-    codeblock;
-    constructor(message, options) {
-      const [line, column] = getLineColFromPtr(options.toml, options.ptr);
-      const codeblock = makeCodeBlock(options.toml, line, column);
-      super(`Invalid TOML document: ${message}
-
-${codeblock}`, options);
-      this.line = line;
-      this.column = column;
-      this.codeblock = codeblock;
-    }
-  };
-});
-
-// node_modules/smol-toml/dist/primitive.js
-function parseString(str, ptr) {
-  let c = str[ptr++];
-  let first = c;
-  let isLiteral = c === "'";
-  let isMultiline = c === str[ptr] && c === str[ptr + 1];
-  if (isMultiline) {
-    if (str[ptr += 2] === `
-`)
-      ptr++;
-    else if (str[ptr] === "\r" && str[ptr + 1] === `
-`)
-      ptr += 2;
-  }
-  let parsed = "";
-  let sliceStart = ptr;
-  let state = 0;
-  for (let i = ptr;i < str.length; i++) {
-    c = str[i];
-    if (isMultiline && (c === `
-` || c === "\r" && str[i + 1] === `
-`)) {
-      state = state && 3;
-    } else if (c < " " && c !== "\t" || c === "") {
-      throw new TomlError("control characters are not allowed in strings", {
-        toml: str,
-        ptr: i
-      });
-    } else if ((!state || state === 3) && c === first && (!isMultiline || str[i + 1] === first && str[i + 2] === first)) {
-      if (isMultiline) {
-        if (str[i + 3] === first)
-          i++;
-        if (str[i + 3] === first)
-          i++;
-      }
-      return [
-        state ? parsed : parsed + str.slice(sliceStart, i),
-        i + (isMultiline ? 3 : 1)
-      ];
-    } else if (!state) {
-      if (!isLiteral && c === "\\") {
-        parsed += str.slice(sliceStart, sliceStart = i);
-        state = 1;
-      }
-    } else if (state === 1) {
-      if (c === "x" || c === "u" || c === "U") {
-        let value = 0;
-        let len = c === "x" ? 2 : c === "u" ? 4 : 8;
-        for (let j = 0;j < len; j++, i++) {
-          let hex = str.charCodeAt(i + 1);
-          let digit = hex >= 48 && hex <= 57 ? hex - 48 : hex >= 65 && hex <= 70 ? hex - 65 + 10 : hex >= 97 && hex <= 102 ? hex - 97 + 10 : -1;
-          if (digit < 0)
-            throw new TomlError("invalid non-hex character in unicode escape", { toml: str, ptr: i + 1 });
-          value = value << 4 | digit;
-        }
-        if (value < 0 || value > 1114111 || value >= 55296 && value <= 57343) {
-          throw new TomlError("invalid unicode escape", { toml: str, ptr: i });
-        }
-        parsed += String.fromCodePoint(value);
-        sliceStart = i + 1;
-        state = 0;
-      } else if (c === " " || c === "\t") {
-        state = 2;
-      } else {
-        if (c === "b")
-          parsed += "\b";
-        else if (c === "t")
-          parsed += "\t";
-        else if (c === "n")
-          parsed += `
-`;
-        else if (c === "f")
-          parsed += "\f";
-        else if (c === "r")
-          parsed += "\r";
-        else if (c === "e")
-          parsed += "\x1B";
-        else if (c === '"')
-          parsed += '"';
-        else if (c === "\\")
-          parsed += "\\";
-        else
-          throw new TomlError("unrecognized escape sequence", { toml: str, ptr: i });
-        sliceStart = i + 1;
-        state = 0;
-      }
-    } else if (c !== " " && c !== "\t") {
-      if (state === 2) {
-        throw new TomlError("invalid escape: only line-ending whitespace may be escaped", {
-          toml: str,
-          ptr: sliceStart
-        });
-      }
-      state = !isLiteral && c === "\\" ? 1 : 0;
-      sliceStart = i;
-    }
-  }
-  throw new TomlError("unfinished string", { toml: str, ptr });
-}
-function parseValue(value, toml, ptr, integersAsBigInt) {
-  if (value === "true")
-    return true;
-  if (value === "false")
-    return false;
-  if (value === "-inf")
-    return -Infinity;
-  if (value === "inf" || value === "+inf")
-    return Infinity;
-  if (value === "nan" || value === "+nan" || value === "-nan")
-    return NaN;
-  if (value === "-0")
-    return integersAsBigInt ? 0n : 0;
-  let isInt = INT_REGEX.test(value);
-  if (isInt || FLOAT_REGEX.test(value)) {
-    if (LEADING_ZERO.test(value)) {
-      throw new TomlError("leading zeroes are not allowed", {
-        toml,
-        ptr
-      });
-    }
-    value = value.replace(/_/g, "");
-    let numeric = +value;
-    if (isNaN(numeric)) {
-      throw new TomlError("invalid number", {
-        toml,
-        ptr
-      });
-    }
-    if (isInt) {
-      if ((isInt = !Number.isSafeInteger(numeric)) && !integersAsBigInt) {
-        throw new TomlError("integer value cannot be represented losslessly", {
-          toml,
-          ptr
-        });
-      }
-      if (isInt || integersAsBigInt === true)
-        numeric = BigInt(value);
-    }
-    return numeric;
-  }
-  const date = new TomlDate(value);
-  if (!date.isValid()) {
-    throw new TomlError("invalid value", {
-      toml,
-      ptr
-    });
-  }
-  return date;
-}
-var INT_REGEX, FLOAT_REGEX, LEADING_ZERO;
-var init_primitive = __esm(() => {
-  init_date();
-  init_error();
-  /*!
-   * Copyright (c) Squirrel Chat et al., All rights reserved.
-   * SPDX-License-Identifier: BSD-3-Clause
-   *
-   * Redistribution and use in source and binary forms, with or without
-   * modification, are permitted provided that the following conditions are met:
-   *
-   * 1. Redistributions of source code must retain the above copyright notice, this
-   *    list of conditions and the following disclaimer.
-   * 2. Redistributions in binary form must reproduce the above copyright notice,
-   *    this list of conditions and the following disclaimer in the
-   *    documentation and/or other materials provided with the distribution.
-   * 3. Neither the name of the copyright holder nor the names of its contributors
-   *    may be used to endorse or promote products derived from this software without
-   *    specific prior written permission.
-   *
-   * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
-   * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
-   * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
-   * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
-   * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
-   * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
-   * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
-   * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
-   * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-   * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-   */
-  INT_REGEX = /^((0x[0-9a-fA-F](_?[0-9a-fA-F])*)|(([+-]|0[ob])?\d(_?\d)*))$/;
-  FLOAT_REGEX = /^[+-]?\d(_?\d)*(\.\d(_?\d)*)?([eE][+-]?\d(_?\d)*)?$/;
-  LEADING_ZERO = /^[+-]?0[0-9_]/;
-});
-
-// node_modules/smol-toml/dist/util.js
-function indexOfNewline(str, start = 0, end = str.length) {
-  let idx = str.indexOf(`
-`, start);
-  if (str[idx - 1] === "\r")
-    idx--;
-  return idx <= end ? idx : -1;
-}
-function skipComment(str, ptr) {
-  for (let i = ptr;i < str.length; i++) {
-    let c = str[i];
-    if (c === `
-`)
-      return i;
-    if (c === "\r" && str[i + 1] === `
-`)
-      return i + 1;
-    if (c < " " && c !== "\t" || c === "") {
-      throw new TomlError("control characters are not allowed in comments", {
-        toml: str,
-        ptr
-      });
-    }
-  }
-  return str.length;
-}
-function skipVoid(str, ptr, banNewLines, banComments) {
-  let c;
-  while (true) {
-    while ((c = str[ptr]) === " " || c === "\t" || !banNewLines && (c === `
-` || c === "\r" && str[ptr + 1] === `
-`))
-      ptr++;
-    if (banComments || c !== "#")
-      break;
-    ptr = skipComment(str, ptr);
-  }
-  return ptr;
-}
-function skipUntil(str, ptr, sep, end, banNewLines = false) {
-  if (!end) {
-    ptr = indexOfNewline(str, ptr);
-    return ptr < 0 ? str.length : ptr;
-  }
-  for (let i = ptr;i < str.length; i++) {
-    let c = str[i];
-    if (c === "#") {
-      i = indexOfNewline(str, i);
-      if (i < 0)
-        break;
-    } else if (c === sep) {
-      return i + 1;
-    } else if (c === end || banNewLines && (c === `
-` || c === "\r" && str[i + 1] === `
-`)) {
-      return i;
-    }
-  }
-  throw new TomlError("cannot find end of structure", {
-    toml: str,
-    ptr
-  });
-}
-var init_util = __esm(() => {
-  init_error();
-  /*!
-   * Copyright (c) Squirrel Chat et al., All rights reserved.
-   * SPDX-License-Identifier: BSD-3-Clause
-   *
-   * Redistribution and use in source and binary forms, with or without
-   * modification, are permitted provided that the following conditions are met:
-   *
-   * 1. Redistributions of source code must retain the above copyright notice, this
-   *    list of conditions and the following disclaimer.
-   * 2. Redistributions in binary form must reproduce the above copyright notice,
-   *    this list of conditions and the following disclaimer in the
-   *    documentation and/or other materials provided with the distribution.
-   * 3. Neither the name of the copyright holder nor the names of its contributors
-   *    may be used to endorse or promote products derived from this software without
-   *    specific prior written permission.
-   *
-   * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
-   * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
-   * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
-   * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
-   * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
-   * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
-   * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
-   * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
-   * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-   * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-   */
-});
-
-// node_modules/smol-toml/dist/extract.js
-function sliceAndTrimEndOf(str, startPtr, endPtr) {
-  let value = str.slice(startPtr, endPtr);
-  let commentIdx = value.indexOf("#");
-  if (commentIdx > -1) {
-    skipComment(str, commentIdx);
-    value = value.slice(0, commentIdx);
-  }
-  return [value.trimEnd(), commentIdx];
-}
-function extractValue(str, ptr, end, depth, integersAsBigInt) {
-  if (depth === 0) {
-    throw new TomlError("document contains excessively nested structures. aborting.", {
-      toml: str,
-      ptr
-    });
-  }
-  let c = str[ptr];
-  if (c === "[" || c === "{") {
-    let [value, endPtr2] = c === "[" ? parseArray(str, ptr, depth, integersAsBigInt) : parseInlineTable(str, ptr, depth, integersAsBigInt);
-    if (end) {
-      endPtr2 = skipVoid(str, endPtr2);
-      if (str[endPtr2] === ",")
-        endPtr2++;
-      else if (str[endPtr2] !== end) {
-        throw new TomlError("expected comma or end of structure", {
-          toml: str,
-          ptr: endPtr2
-        });
-      }
-    }
-    return [value, endPtr2];
-  }
-  if (c === '"' || c === "'") {
-    let [parsed, endPtr2] = parseString(str, ptr);
-    if (end) {
-      endPtr2 = skipVoid(str, endPtr2);
-      if (str[endPtr2] && str[endPtr2] !== "," && str[endPtr2] !== end && str[endPtr2] !== `
-` && str[endPtr2] !== "\r") {
-        throw new TomlError("unexpected character encountered", {
-          toml: str,
-          ptr: endPtr2
-        });
-      }
-      if (str[endPtr2] === ",")
-        endPtr2++;
-    }
-    return [parsed, endPtr2];
-  }
-  let endPtr = skipUntil(str, ptr, ",", end);
-  let slice = sliceAndTrimEndOf(str, ptr, endPtr - (str[endPtr - 1] === "," ? 1 : 0));
-  if (!slice[0]) {
-    throw new TomlError("incomplete key-value declaration: no value specified", {
-      toml: str,
-      ptr
-    });
-  }
-  if (end && slice[1] > -1) {
-    endPtr = skipVoid(str, ptr + slice[1]);
-    if (str[endPtr] === ",")
-      endPtr++;
-  }
-  return [
-    parseValue(slice[0], str, ptr, integersAsBigInt),
-    endPtr
-  ];
-}
-var init_extract = __esm(() => {
-  init_primitive();
-  init_struct();
-  init_util();
-  init_error();
-  /*!
-   * Copyright (c) Squirrel Chat et al., All rights reserved.
-   * SPDX-License-Identifier: BSD-3-Clause
-   *
-   * Redistribution and use in source and binary forms, with or without
-   * modification, are permitted provided that the following conditions are met:
-   *
-   * 1. Redistributions of source code must retain the above copyright notice, this
-   *    list of conditions and the following disclaimer.
-   * 2. Redistributions in binary form must reproduce the above copyright notice,
-   *    this list of conditions and the following disclaimer in the
-   *    documentation and/or other materials provided with the distribution.
-   * 3. Neither the name of the copyright holder nor the names of its contributors
-   *    may be used to endorse or promote products derived from this software without
-   *    specific prior written permission.
-   *
-   * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
-   * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
-   * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
-   * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
-   * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
-   * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
-   * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
-   * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
-   * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-   * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-   */
-});
-
-// node_modules/smol-toml/dist/struct.js
-function parseKey(str, ptr, end = "=") {
-  let dot = ptr - 1;
-  let parsed = [];
-  let endPtr = str.indexOf(end, ptr);
-  if (endPtr < 0) {
-    throw new TomlError("incomplete key-value: cannot find end of key", {
-      toml: str,
-      ptr
-    });
-  }
-  do {
-    let c = str[ptr = ++dot];
-    if (c !== " " && c !== "\t") {
-      if (c === '"' || c === "'") {
-        if (c === str[ptr + 1] && c === str[ptr + 2]) {
-          throw new TomlError("multiline strings are not allowed in keys", {
-            toml: str,
-            ptr
-          });
-        }
-        let [part, eos] = parseString(str, ptr);
-        dot = str.indexOf(".", eos);
-        let strEnd = str.slice(eos, dot < 0 || dot > endPtr ? endPtr : dot);
-        let newLine = indexOfNewline(strEnd);
-        if (newLine > -1) {
-          throw new TomlError("newlines are not allowed in keys", {
-            toml: str,
-            ptr: ptr + dot + newLine
-          });
-        }
-        if (strEnd.trimStart()) {
-          throw new TomlError("found extra tokens after the string part", {
-            toml: str,
-            ptr: eos
-          });
-        }
-        if (endPtr < eos) {
-          endPtr = str.indexOf(end, eos);
-          if (endPtr < 0) {
-            throw new TomlError("incomplete key-value: cannot find end of key", {
-              toml: str,
-              ptr
-            });
-          }
-        }
-        parsed.push(part);
-      } else {
-        dot = str.indexOf(".", ptr);
-        let part = str.slice(ptr, dot < 0 || dot > endPtr ? endPtr : dot);
-        if (!KEY_PART_RE.test(part)) {
-          throw new TomlError("only letter, numbers, dashes and underscores are allowed in keys", {
-            toml: str,
-            ptr
-          });
-        }
-        parsed.push(part.trimEnd());
-      }
-    }
-  } while (dot + 1 && dot < endPtr);
-  return [parsed, skipVoid(str, endPtr + 1, true, true)];
-}
-function parseInlineTable(str, ptr, depth, integersAsBigInt) {
-  let res = {};
-  let seen = new Set;
-  let c;
-  ptr++;
-  while ((c = str[ptr++]) !== "}" && c) {
-    if (c === ",") {
-      throw new TomlError("expected value, found comma", {
-        toml: str,
-        ptr: ptr - 1
-      });
-    } else if (c === "#")
-      ptr = skipComment(str, ptr);
-    else if (c !== " " && c !== "\t" && c !== `
-` && c !== "\r") {
-      let k;
-      let t = res;
-      let hasOwn = false;
-      let [key, keyEndPtr] = parseKey(str, ptr - 1);
-      for (let i = 0;i < key.length; i++) {
-        if (i)
-          t = hasOwn ? t[k] : t[k] = {};
-        k = key[i];
-        if ((hasOwn = Object.hasOwn(t, k)) && (typeof t[k] !== "object" || seen.has(t[k]))) {
-          throw new TomlError("trying to redefine an already defined value", {
-            toml: str,
-            ptr
-          });
-        }
-        if (!hasOwn && k === "__proto__") {
-          Object.defineProperty(t, k, { enumerable: true, configurable: true, writable: true });
-        }
-      }
-      if (hasOwn) {
-        throw new TomlError("trying to redefine an already defined value", {
-          toml: str,
-          ptr
-        });
-      }
-      let [value, valueEndPtr] = extractValue(str, keyEndPtr, "}", depth - 1, integersAsBigInt);
-      seen.add(value);
-      t[k] = value;
-      ptr = valueEndPtr;
-    }
-  }
-  if (!c) {
-    throw new TomlError("unfinished table encountered", {
-      toml: str,
-      ptr
-    });
-  }
-  return [res, ptr];
-}
-function parseArray(str, ptr, depth, integersAsBigInt) {
-  let res = [];
-  let c;
-  ptr++;
-  while ((c = str[ptr++]) !== "]" && c) {
-    if (c === ",") {
-      throw new TomlError("expected value, found comma", {
-        toml: str,
-        ptr: ptr - 1
-      });
-    } else if (c === "#")
-      ptr = skipComment(str, ptr);
-    else if (c !== " " && c !== "\t" && c !== `
-` && c !== "\r") {
-      let e = extractValue(str, ptr - 1, "]", depth - 1, integersAsBigInt);
-      res.push(e[0]);
-      ptr = e[1];
-    }
-  }
-  if (!c) {
-    throw new TomlError("unfinished array encountered", {
-      toml: str,
-      ptr
-    });
-  }
-  return [res, ptr];
-}
-var KEY_PART_RE;
-var init_struct = __esm(() => {
-  init_primitive();
-  init_extract();
-  init_util();
-  init_error();
-  /*!
-   * Copyright (c) Squirrel Chat et al., All rights reserved.
-   * SPDX-License-Identifier: BSD-3-Clause
-   *
-   * Redistribution and use in source and binary forms, with or without
-   * modification, are permitted provided that the following conditions are met:
-   *
-   * 1. Redistributions of source code must retain the above copyright notice, this
-   *    list of conditions and the following disclaimer.
-   * 2. Redistributions in binary form must reproduce the above copyright notice,
-   *    this list of conditions and the following disclaimer in the
-   *    documentation and/or other materials provided with the distribution.
-   * 3. Neither the name of the copyright holder nor the names of its contributors
-   *    may be used to endorse or promote products derived from this software without
-   *    specific prior written permission.
-   *
-   * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
-   * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
-   * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
-   * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
-   * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
-   * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
-   * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
-   * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
-   * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-   * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-   */
-  KEY_PART_RE = /^[a-zA-Z0-9-_]+[ \t]*$/;
-});
-
-// node_modules/smol-toml/dist/parse.js
-function peekTable(key, table, meta, type) {
-  let t = table;
-  let m = meta;
-  let k;
-  let hasOwn = false;
-  let state;
-  for (let i = 0;i < key.length; i++) {
-    if (i) {
-      t = hasOwn ? t[k] : t[k] = {};
-      m = (state = m[k]).c;
-      if (type === 0 && (state.t === 1 || state.t === 2)) {
-        return null;
-      }
-      if (state.t === 2) {
-        let l = t.length - 1;
-        t = t[l];
-        m = m[l].c;
-      }
-    }
-    k = key[i];
-    if ((hasOwn = Object.hasOwn(t, k)) && m[k]?.t === 0 && m[k]?.d) {
-      return null;
-    }
-    if (!hasOwn) {
-      if (k === "__proto__") {
-        Object.defineProperty(t, k, { enumerable: true, configurable: true, writable: true });
-        Object.defineProperty(m, k, { enumerable: true, configurable: true, writable: true });
-      }
-      m[k] = {
-        t: i < key.length - 1 && type === 2 ? 3 : type,
-        d: false,
-        i: 0,
-        c: {}
-      };
-    }
-  }
-  state = m[k];
-  if (state.t !== type && !(type === 1 && state.t === 3)) {
-    return null;
-  }
-  if (type === 2) {
-    if (!state.d) {
-      state.d = true;
-      t[k] = [];
-    }
-    t[k].push(t = {});
-    state.c[state.i++] = state = { t: 1, d: false, i: 0, c: {} };
-  }
-  if (state.d) {
-    return null;
-  }
-  state.d = true;
-  if (type === 1) {
-    t = hasOwn ? t[k] : t[k] = {};
-  } else if (type === 0 && hasOwn) {
-    return null;
-  }
-  return [k, t, state.c];
-}
-function parse(toml, { maxDepth = 1000, integersAsBigInt } = {}) {
-  let res = {};
-  let meta = {};
-  let tbl = res;
-  let m = meta;
-  for (let ptr = skipVoid(toml, 0);ptr < toml.length; ) {
-    if (toml[ptr] === "[") {
-      let isTableArray = toml[++ptr] === "[";
-      let k = parseKey(toml, ptr += +isTableArray, "]");
-      if (isTableArray) {
-        if (toml[k[1] - 1] !== "]") {
-          throw new TomlError("expected end of table declaration", {
-            toml,
-            ptr: k[1] - 1
-          });
-        }
-        k[1]++;
-      }
-      let p = peekTable(k[0], res, meta, isTableArray ? 2 : 1);
-      if (!p) {
-        throw new TomlError("trying to redefine an already defined table or value", {
-          toml,
-          ptr
-        });
-      }
-      m = p[2];
-      tbl = p[1];
-      ptr = k[1];
-    } else {
-      let k = parseKey(toml, ptr);
-      let p = peekTable(k[0], tbl, m, 0);
-      if (!p) {
-        throw new TomlError("trying to redefine an already defined table or value", {
-          toml,
-          ptr
-        });
-      }
-      let v = extractValue(toml, k[1], undefined, maxDepth, integersAsBigInt);
-      p[1][p[0]] = v[0];
-      ptr = v[1];
-    }
-    ptr = skipVoid(toml, ptr, true);
-    if (toml[ptr] && toml[ptr] !== `
-` && toml[ptr] !== "\r") {
-      throw new TomlError("each key-value declaration must be followed by an end-of-line", {
-        toml,
-        ptr
-      });
-    }
-    ptr = skipVoid(toml, ptr);
-  }
-  return res;
-}
-var init_parse = __esm(() => {
-  init_struct();
-  init_extract();
-  init_util();
-  init_error();
-  /*!
-   * Copyright (c) Squirrel Chat et al., All rights reserved.
-   * SPDX-License-Identifier: BSD-3-Clause
-   *
-   * Redistribution and use in source and binary forms, with or without
-   * modification, are permitted provided that the following conditions are met:
-   *
-   * 1. Redistributions of source code must retain the above copyright notice, this
-   *    list of conditions and the following disclaimer.
-   * 2. Redistributions in binary form must reproduce the above copyright notice,
-   *    this list of conditions and the following disclaimer in the
-   *    documentation and/or other materials provided with the distribution.
-   * 3. Neither the name of the copyright holder nor the names of its contributors
-   *    may be used to endorse or promote products derived from this software without
-   *    specific prior written permission.
-   *
-   * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
-   * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
-   * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
-   * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
-   * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
-   * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
-   * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
-   * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
-   * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-   * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-   */
-});
-
-// node_modules/smol-toml/dist/stringify.js
-var init_stringify = __esm(() => {
-  /*!
-   * Copyright (c) Squirrel Chat et al., All rights reserved.
-   * SPDX-License-Identifier: BSD-3-Clause
-   *
-   * Redistribution and use in source and binary forms, with or without
-   * modification, are permitted provided that the following conditions are met:
-   *
-   * 1. Redistributions of source code must retain the above copyright notice, this
-   *    list of conditions and the following disclaimer.
-   * 2. Redistributions in binary form must reproduce the above copyright notice,
-   *    this list of conditions and the following disclaimer in the
-   *    documentation and/or other materials provided with the distribution.
-   * 3. Neither the name of the copyright holder nor the names of its contributors
-   *    may be used to endorse or promote products derived from this software without
-   *    specific prior written permission.
-   *
-   * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
-   * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
-   * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
-   * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
-   * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
-   * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
-   * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
-   * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
-   * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-   * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-   */
-});
-
-// node_modules/smol-toml/dist/index.js
-var init_dist = __esm(() => {
-  init_parse();
-  init_stringify();
-  init_date();
-  init_error();
-  /*!
-   * Copyright (c) Squirrel Chat et al., All rights reserved.
-   * SPDX-License-Identifier: BSD-3-Clause
-   *
-   * Redistribution and use in source and binary forms, with or without
-   * modification, are permitted provided that the following conditions are met:
-   *
-   * 1. Redistributions of source code must retain the above copyright notice, this
-   *    list of conditions and the following disclaimer.
-   * 2. Redistributions in binary form must reproduce the above copyright notice,
-   *    this list of conditions and the following disclaimer in the
-   *    documentation and/or other materials provided with the distribution.
-   * 3. Neither the name of the copyright holder nor the names of its contributors
-   *    may be used to endorse or promote products derived from this software without
-   *    specific prior written permission.
-   *
-   * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
-   * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
-   * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
-   * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
-   * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
-   * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
-   * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
-   * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
-   * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-   * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-   */
-});
-
 // src/hooks/fp-home.ts
 import { homedir } from "node:os";
 import { resolve } from "node:path";
@@ -1143,7 +178,10 @@ function resettablePaths() {
     legacy.collectorHealth(),
     legacy.onboardingLock(),
     legacy.cloudManagedPolicies(),
-    localPoliciesDir(),
+    legacy.configToml(),
+    legacy.credentialsToml(),
+    legacy.localPoliciesDir(),
+    globalPolicyConfigFile(),
     cloudPoliciesDir(),
     at("state"),
     configFile(),
@@ -1153,10 +191,15 @@ function resettablePaths() {
     logsDir()
   ];
 }
-var LAYOUT_VERSION = 2, at = (...parts) => resolve(failproofaiHome(), ...parts), atHome = (home, ...parts) => home ? resolve(failproofaiHome(home), ...parts) : at(...parts), versionFile = (home) => atHome(home, "VERSION"), configFile = (home) => atHome(home, "config.toml"), credentialsFile = (home) => atHome(home, "credentials.toml"), binDir = (home) => atHome(home, "bin"), policiesDir = (home) => atHome(home, "policies"), localPoliciesDir = (home) => atHome(home, "policies", "local-policies"), globalPolicyConfigFile = (home) => resolve(localPoliciesDir(home), "policies-config.json"), cloudPoliciesDir = (home) => resolve(policiesDir(home), "cloud-policies"), customPoliciesDir = (home) => resolve(policiesDir(home), "custom-policies"), customAgentsDir = (home) => atHome(home, "custom-agents"), auditDir = (home) => atHome(home, "audit"), auditDashboardFile = (home) => resolve(auditDir(home), "dashboard.json"), auditCacheDir = (home) => resolve(auditDir(home), "cache"), hookActivityDir = (home) => atHome(home, "hook-activity"), runDir = (home) => atHome(home, "run"), daemonSocket = () => process.env.FAILPROOFAI_DAEMON_SOCKET || resolve(runDir(), "failproofaid.sock"), auditLockFile = (home) => resolve(runDir(home), "audit.lock"), stateDir = (home) => atHome(home, "state"), shimsDir = (home) => resolve(stateDir(home), "shims"), sessionPauseDir = () => resolve(stateDir(), "sessions"), telemetryIdFile = (home) => resolve(stateDir(home), "telemetry-id"), launcherMarker = (home) => resolve(stateDir(home), "launcher-configured"), onboardingAttemptFile = (home) => resolve(stateDir(home), "onboarding-attempt.json"), lastVersionFile = (home) => resolve(stateDir(home), "last-version"), onboardingLockFile = (home) => resolve(stateDir(home), "onboarding.lock"), codexSessionPathsFile = (home) => resolve(stateDir(home), "codex-session-paths.json"), logsDir = (home) => atHome(home, "logs"), legacy;
+var LAYOUT_VERSION = 3, at = (...parts) => resolve(failproofaiHome(), ...parts), atHome = (home, ...parts) => home ? resolve(failproofaiHome(home), ...parts) : at(...parts), versionFile = (home) => atHome(home, "VERSION"), configFile = (home) => atHome(home, "config.json"), credentialsFile = (home) => atHome(home, "credentials.json"), binDir = (home) => atHome(home, "bin"), policiesDir = (home) => atHome(home, "policies"), customPoliciesDir, globalPolicyConfigFile = (home) => atHome(home, "policies-config.json"), cloudPoliciesDir = (home) => resolve(policiesDir(home), "cloud-policies"), customAgentsDir = (home) => atHome(home, "custom-agents"), auditDir = (home) => atHome(home, "audit"), auditDashboardFile = (home) => resolve(auditDir(home), "dashboard.json"), auditCacheDir = (home) => resolve(auditDir(home), "cache"), hookActivityDir = (home) => atHome(home, "hook-activity"), runDir = (home) => atHome(home, "run"), daemonSocket = () => process.env.FAILPROOFAI_DAEMON_SOCKET || resolve(runDir(), "failproofaid.sock"), auditLockFile = (home) => resolve(runDir(home), "audit.lock"), stateDir = (home) => atHome(home, "state"), shimsDir = (home) => resolve(stateDir(home), "shims"), spoolDir = (home) => resolve(stateDir(home), "spool"), sessionPauseDir = () => resolve(stateDir(), "sessions"), telemetryIdFile = (home) => resolve(stateDir(home), "telemetry-id"), launcherMarker = (home) => resolve(stateDir(home), "launcher-configured"), onboardingAttemptFile = (home) => resolve(stateDir(home), "onboarding-attempt.json"), lastVersionFile = (home) => resolve(stateDir(home), "last-version"), onboardingLockFile = (home) => resolve(stateDir(home), "onboarding.lock"), codexSessionPathsFile = (home) => resolve(stateDir(home), "codex-session-paths.json"), logsDir = (home) => atHome(home, "logs"), legacy;
 var init_fp_home = __esm(() => {
+  customPoliciesDir = policiesDir;
   legacy = {
     policyConfig: () => at("policies-config.json"),
+    configToml: () => at("config.toml"),
+    credentialsToml: () => at("credentials.toml"),
+    localPoliciesDir: () => at("policies", "local-policies"),
+    customPoliciesDir: () => at("policies", "custom-policies"),
     policyConfigLocal: () => at("policies-config.local.json"),
     cloudCredentials: () => at("cloud.json"),
     ingestCredentials: () => at("ingest.json"),
@@ -1186,6 +229,11 @@ function detectLayout() {
       return { kind: "current", version: raw };
     return raw.layout > LAYOUT_VERSION ? { kind: "future", found: raw.layout } : { kind: "stale", found: raw.layout };
   }
+  if (existsSync(configFile())) {
+    return { kind: "current", version: { layout: LAYOUT_VERSION, cli: "" }, inferred: true };
+  }
+  if (existsSync(legacy.configToml()))
+    return { kind: "stale", found: LAYOUT_VERSION - 1 };
   const layoutOneMarkers = [
     legacy.policyConfig(),
     legacy.cacheDir(),
@@ -1197,9 +245,22 @@ function detectLayout() {
   ];
   return layoutOneMarkers.some((p) => existsSync(p)) ? { kind: "stale", found: 1 } : { kind: "absent" };
 }
+function readLegacyTomlVersion(text) {
+  const layout = Number(/^\s*layout\s*=\s*(\d+)\s*$/m.exec(text)?.[1]);
+  if (!Number.isFinite(layout))
+    return null;
+  const str = (key) => new RegExp(`^\\s*${key}\\s*=\\s*"([^"]*)"`, "m").exec(text)?.[1];
+  return { layout, cli: str("cli") ?? "", daemon: str("daemon") };
+}
 function readVersionFile() {
+  let text;
+  try {
+    text = readFileSync(versionFile(), "utf8");
+  } catch {
+    return null;
+  }
   try {
-    const parsed = parse(readFileSync(versionFile(), "utf8"));
+    const parsed = JSON.parse(text);
     const layout = Number(parsed.layout);
     if (!Number.isFinite(layout))
       return null;
@@ -1209,7 +270,7 @@ function readVersionFile() {
       daemon: typeof parsed.daemon === "string" ? parsed.daemon : undefined
     };
   } catch {
-    return null;
+    return readLegacyTomlVersion(text);
   }
 }
 function writeVersionFile(v = {}) {
@@ -1219,16 +280,7 @@ function writeVersionFile(v = {}) {
     cli: v.cli ?? version2,
     daemon: v.clearDaemon ? undefined : v.daemon ?? existing?.daemon
   };
-  const lines = [
-    "# Written by failproofai. `layout` is what tells a newer CLI whether this",
-    "# directory can be read as-is; do not edit it by hand.",
-    `layout = ${next.layout}`,
-    `cli = ${JSON.stringify(next.cli)}`
-  ];
-  if (next.daemon)
-    lines.push(`daemon = ${JSON.stringify(next.daemon)}`);
-  writeFileAt(versionFile(), lines.join(`
-`) + `
+  writeFileAt(versionFile(), `${JSON.stringify({ layout: next.layout, cli: next.cli, ...next.daemon ? { daemon: next.daemon } : {} }, null, 2)}
 `);
 }
 function readIntervalDays(raw) {
@@ -1239,9 +291,25 @@ function readIntervalDays(raw) {
     return DEFAULT_AUDIT_INTERVAL_DAYS;
   return Math.min(days, MAX_AUDIT_INTERVAL_DAYS);
 }
+function readSources(raw) {
+  if (!raw || typeof raw !== "object" || Array.isArray(raw))
+    return;
+  const out = {};
+  for (const [name, table] of Object.entries(raw)) {
+    if (!table || typeof table !== "object" || Array.isArray(table))
+      continue;
+    const entries = table.extra_paths;
+    if (!Array.isArray(entries))
+      continue;
+    const paths = entries.filter((e) => typeof e === "string" && e.trim() !== "");
+    if (paths.length > 0)
+      out[name] = { extraPaths: paths };
+  }
+  return Object.keys(out).length > 0 ? out : undefined;
+}
 function readConfig() {
   try {
-    const parsed = parse(readFileSync(configFile(), "utf8"));
+    const parsed = JSON.parse(readFileSync(configFile(), "utf8"));
     const mode = parsed.mode?.kind;
     const daemon = parsed.daemon ?? {};
     const collector = parsed.collector ?? {};
@@ -1256,7 +324,8 @@ function readConfig() {
         hooksVerbosity: collector.hooks_verbosity === "all" || collector.hooks_verbosity === "off" ? collector.hooks_verbosity : "decisions",
         redact: collector.redact === "off" ? "off" : "minimal",
         environment: typeof collector.environment === "string" ? collector.environment : "local",
-        machineId: typeof collector.machine_id === "string" ? collector.machine_id : undefined
+        machineId: typeof collector.machine_id === "string" ? collector.machine_id : undefined,
+        sources: readSources(collector.sources)
       },
       telemetry: { enabled: telemetry.enabled !== false },
       audit: { auto: audit.auto === true, intervalDays: readIntervalDays(audit.interval_days) }
@@ -1267,31 +336,24 @@ function readConfig() {
 }
 function writeConfig(config) {
   const c = config.collector;
-  const lines = [
-    "# failproofai configuration. Safe to edit by hand.",
-    "# Credentials are NOT here — see credentials.toml (owner-only).",
-    "",
-    "[mode]",
-    '# "oss"   — fully local. No transcripts, hook activity or policy leave',
-    "#           this machine.",
-    '# "cloud" — reports to, and receives policy from, Failproof Cloud.',
-    `kind = ${JSON.stringify(config.mode)}`,
-    "",
-    "[daemon]",
-    "# When true, hooks route through failproofaid AND FAIL CLOSED if it is",
-    "# unreachable. Never set this by hand: `failproofai config` sets it only",
-    "# after verifying the service is genuinely running.",
-    `configured = ${config.daemon.configured}`
-  ];
-  lines.push("", "[collector]", "# Session transcripts carry prompts, file contents and command output.", `sessions = ${c.sessions}`, "# Hook decisions: which policy fired and what it decided. No file contents.", `hooks = ${c.hooks}`, `hooks_verbosity = ${JSON.stringify(c.hooksVerbosity)}`, `redact = ${JSON.stringify(c.redact)}`, `environment = ${JSON.stringify(c.environment)}`);
-  if (c.machineId)
-    lines.push(`machine_id = ${JSON.stringify(c.machineId)}`);
-  if (!config.telemetry.enabled) {
-    lines.push("", "[telemetry]", "enabled = false");
-  }
-  lines.push("", "[audit]", "# Scan this machine's agent history on a schedule and refresh the audit", "# dashboard. OFF by default: the scan reads the CONTENTS of every session", "# transcript on disk, so it waits to be asked. It runs as a separate", "# short-lived process — never on the hook path.", `auto = ${config.audit.auto}`, `interval_days = ${config.audit.intervalDays}`);
-  writeFileAt(configFile(), lines.join(`
-`) + `
+  const out = {
+    mode: { kind: config.mode },
+    daemon: { configured: config.daemon.configured },
+    collector: {
+      sessions: c.sessions,
+      hooks: c.hooks,
+      hooks_verbosity: c.hooksVerbosity,
+      redact: c.redact,
+      environment: c.environment,
+      ...c.machineId ? { machine_id: c.machineId } : {},
+      ...Object.entries(c.sources ?? {}).some(([, s]) => s.extraPaths?.length) ? {
+        sources: Object.fromEntries(Object.entries(c.sources ?? {}).filter(([, s]) => s.extraPaths?.length).map(([name, s]) => [name, { extra_paths: s.extraPaths }]))
+      } : {}
+    },
+    ...config.telemetry.enabled ? {} : { telemetry: { enabled: false } },
+    audit: { auto: config.audit.auto, interval_days: config.audit.intervalDays }
+  };
+  writeFileAt(configFile(), `${JSON.stringify(out, null, 2)}
 `);
 }
 function updateConfig(patch) {
@@ -1308,7 +370,7 @@ function updateConfig(patch) {
 }
 function readCredentials() {
   try {
-    const parsed = parse(readFileSync(credentialsFile(), "utf8"));
+    const parsed = JSON.parse(readFileSync(credentialsFile(), "utf8"));
     const cloud = parsed.cloud;
     const ingest = parsed.ingest;
     const auth = parsed.auth;
@@ -1341,34 +403,32 @@ function readCredentials() {
   }
 }
 function writeCredentials(creds) {
-  const lines = [
-    "# failproofai credentials — owner-only (0600). Do not commit."
-  ];
+  const out = {};
   if (creds.cloud) {
-    lines.push("", "[cloud]", `url = ${JSON.stringify(creds.cloud.url)}`, `machine_id = ${JSON.stringify(creds.cloud.machineId)}`, ...creds.cloud.machineLabel ? [`machine_label = ${JSON.stringify(creds.cloud.machineLabel)}`] : [], `token = ${JSON.stringify(creds.cloud.token)}`);
+    out.cloud = {
+      url: creds.cloud.url,
+      machine_id: creds.cloud.machineId,
+      ...creds.cloud.machineLabel ? { machine_label: creds.cloud.machineLabel } : {},
+      token: creds.cloud.token
+    };
   }
   if (creds.ingest) {
-    lines.push("", "[ingest]", `url = ${JSON.stringify(creds.ingest.url)}`, `key = ${JSON.stringify(creds.ingest.key)}`);
+    out.ingest = { url: creds.ingest.url, key: creds.ingest.key };
   }
   if (creds.org && (creds.org.id || creds.org.slug || creds.org.name)) {
-    lines.push("", "[org]");
-    if (creds.org.id)
-      lines.push(`id = ${JSON.stringify(creds.org.id)}`);
-    if (creds.org.slug)
-      lines.push(`slug = ${JSON.stringify(creds.org.slug)}`);
-    if (creds.org.name)
-      lines.push(`name = ${JSON.stringify(creds.org.name)}`);
+    out.org = {
+      ...creds.org.id ? { id: creds.org.id } : {},
+      ...creds.org.slug ? { slug: creds.org.slug } : {},
+      ...creds.org.name ? { name: creds.org.name } : {}
+    };
   }
   if (creds.auth && (creds.auth.sessionToken || creds.auth.email)) {
-    lines.push("", "[auth]");
-    if (creds.auth.baseUrl)
-      lines.push(`base_url = ${JSON.stringify(creds.auth.baseUrl)}`);
-    if (creds.auth.sessionToken)
-      lines.push(`session_token = ${JSON.stringify(creds.auth.sessionToken)}`);
-    if (creds.auth.expiresAt)
-      lines.push(`expires_at = ${creds.auth.expiresAt}`);
-    if (creds.auth.email)
-      lines.push(`email = ${JSON.stringify(creds.auth.email)}`);
+    out.auth = {
+      ...creds.auth.baseUrl ? { base_url: creds.auth.baseUrl } : {},
+      ...creds.auth.sessionToken ? { session_token: creds.auth.sessionToken } : {},
+      ...creds.auth.expiresAt ? { expires_at: creds.auth.expiresAt } : {},
+      ...creds.auth.email ? { email: creds.auth.email } : {}
+    };
   }
   const home = failproofaiHome();
   mkdirSync(home, { recursive: true });
@@ -1376,8 +436,7 @@ function writeCredentials(creds) {
     if (statSync(home).mode & 63)
       chmodSync(home, 448);
   } catch {}
-  writeFileSync(credentialsFile(), lines.join(`
-`) + `
+  writeFileSync(credentialsFile(), `${JSON.stringify(out, null, 2)}
 `, { mode: 384 });
   try {
     chmodSync(credentialsFile(), 384);
@@ -1389,7 +448,6 @@ function writeFileAt(path, contents) {
 }
 var DEFAULT_AUDIT_INTERVAL_DAYS = 7, MIN_AUDIT_INTERVAL_DAYS = 1, MAX_AUDIT_INTERVAL_DAYS = 90, DEFAULT_CONFIG;
 var init_fp_config = __esm(() => {
-  init_dist();
   init_package();
   init_fp_home();
   DEFAULT_CONFIG = {
@@ -5631,7 +4689,19 @@ async function loadAllCustomHooks(customPoliciesPaths, opts) {
   const projectRoot = findProjectConfigDir(opts?.sessionCwd ?? process.cwd());
   const conventionEnabled = opts?.customPoliciesEnabled !== false;
   const loadedPaths = new Set;
-  const cloudManagedByPath = new Map((opts?.cloudManagedPolicies ?? []).map((policy) => [resolve5(policy.path), policy]));
+  const cloudManagedByPath = new Map;
+  for (const policy of opts?.cloudManagedPolicies ?? []) {
+    const key = resolve5(policy.path);
+    const existing = cloudManagedByPath.get(key);
+    if (!existing) {
+      cloudManagedByPath.set(key, policy);
+      continue;
+    }
+    hookLogWarn(`cloud-managed policies ${existing.id} and ${policy.id} have identical source, so they share ` + `one artifact and load as one policy; enforcing it if either asks to enforce`);
+    if (existing.effect !== "enforce" && policy.effect === "enforce") {
+      cloudManagedByPath.set(key, policy);
+    }
+  }
   for (const customPoliciesPath of typeof customPoliciesPaths === "string" ? [customPoliciesPaths] : customPoliciesPaths ?? []) {
     const absPath = resolve5(projectRoot, customPoliciesPath);
     if (existsSync5(absPath)) {
@@ -5646,7 +4716,7 @@ async function loadAllCustomHooks(customPoliciesPaths, opts) {
           const tagged = hook;
           if (cloudManaged) {
             tagged.__cloudManaged = cloudManaged;
-            tagged.__policyId = `cloud:${cloudManaged.id}@${cloudManaged.revision}:${hook.name}`;
+            tagged.__policyId = `cloud:${cloudManaged.id}@${cloudManaged.version}:${hook.name}`;
           } else {
             tagged.__policyId = customPolicyId(absPath, hook.name);
           }
@@ -5658,23 +4728,24 @@ async function loadAllCustomHooks(customPoliciesPaths, opts) {
   }
   const hooksBeforeConvention = getCustomHooks().length;
   const projectDir = resolve5(projectRoot, ".failproofai", "policies");
+  const projectScope = projectDir === customPoliciesDir() ? "user" : "project";
   if (conventionEnabled) {
     sweepStaleTmpArtifacts(projectDir);
-    warnSkippedPolicyFiles(projectDir, "project");
+    warnSkippedPolicyFiles(projectDir, projectScope);
   }
   sweepStaleTmpArtifacts(shimsDir());
   const projectFiles = conventionEnabled ? discoverPolicyFiles(projectDir).filter((f) => !loadedPaths.has(f)) : [];
   for (const file of projectFiles) {
     loadedPaths.add(file);
     const hooksBefore = getCustomHooks().length;
-    await loadSingleFile(file, { conventionScope: "project" });
+    await loadSingleFile(file, { conventionScope: projectScope });
     const newHooks = getCustomHooks().slice(hooksBefore);
     for (const hook of newHooks) {
-      hook.__policyId = conventionPolicyId("project", basename(file), hook.name);
+      hook.__policyId = conventionPolicyId(projectScope, basename(file), hook.name);
     }
     if (newHooks.length > 0) {
       conventionSources.push({
-        scope: "project",
+        scope: projectScope,
         file: basename(file),
         hookNames: newHooks.map((h) => h.name)
       });
@@ -10517,16 +9588,21 @@ function cloudManagedPolicyRoot() {
 function parseManifest(value) {
   if (!value || typeof value !== "object")
     throw new Error("active manifest is not an object");
-  const manifest = value;
-  if (manifest.schemaVersion !== ACTIVE_SCHEMA_VERSION) {
-    throw new Error(`unsupported active manifest schema ${String(manifest.schemaVersion)}`);
+  const raw = value;
+  if (!ACCEPTED_ACTIVE_SCHEMA_VERSIONS.includes(raw.schemaVersion)) {
+    throw new Error(`unsupported active manifest schema ${String(raw.schemaVersion)} ` + `(supported: ${ACCEPTED_ACTIVE_SCHEMA_VERSIONS.join(", ")})`);
   }
-  if (!Number.isSafeInteger(manifest.generation) || (manifest.generation ?? -1) < 0) {
-    throw new Error("active manifest generation is invalid");
+  const deployment = raw.deployment ?? raw.generation;
+  if (!Number.isSafeInteger(deployment) || (deployment ?? -1) < 0) {
+    throw new Error("active manifest deployment is invalid");
   }
-  if (!Array.isArray(manifest.policies))
+  if (!Array.isArray(raw.policies))
     throw new Error("active manifest policies is not an array");
-  return manifest;
+  const policies = raw.policies.map((p) => {
+    const entry = p;
+    return { ...entry, version: entry.version ?? entry.revision };
+  });
+  return { schemaVersion: raw.schemaVersion, deployment, policies };
 }
 function resolveManagedPath(root, candidate) {
   if (!candidate || isAbsolute2(candidate))
@@ -10572,8 +9648,8 @@ function readActiveCloudManagedPolicies() {
     if (!POLICY_ID_RE.test(policy.id) || policy.id === "." || policy.id === "..") {
       throw new Error(`unsafe cloud-managed policy id ${JSON.stringify(policy.id)}`);
     }
-    if (!Number.isSafeInteger(policy.revision) || policy.revision < 0) {
-      throw new Error(`invalid revision for cloud-managed policy ${policy.id}`);
+    if (!Number.isSafeInteger(policy.version) || policy.version < 0) {
+      throw new Error(`invalid version for cloud-managed policy ${policy.id}`);
     }
     if (!SHA256_RE.test(policy.sha256)) {
       throw new Error(`invalid SHA-256 for cloud-managed policy ${policy.id}`);
@@ -10592,17 +9668,18 @@ function readActiveCloudManagedPolicies() {
     }
     return {
       id: policy.id,
-      revision: policy.revision,
+      version: policy.version,
       effect: policy.effect ?? "enforce",
       sha256: policy.sha256,
       path: path3,
-      generation: manifest.generation
+      deployment: manifest.deployment
     };
   });
 }
-var ACTIVE_SCHEMA_VERSION = 1, SHA256_RE, POLICY_ID_RE;
+var ACCEPTED_ACTIVE_SCHEMA_VERSIONS, SHA256_RE, POLICY_ID_RE;
 var init_cloud_managed_policies = __esm(() => {
   init_fp_home();
+  ACCEPTED_ACTIVE_SCHEMA_VERSIONS = [1, 2];
   SHA256_RE = /^[a-f0-9]{64}$/;
   POLICY_ID_RE = /^[A-Za-z0-9._-]{1,128}$/;
 });
@@ -11512,20 +10589,40 @@ async function probeDaemon() {
     return { ok: false, reason: "unreachable" };
   }
 }
+async function daemonAcceptsConnectionsQuietly() {
+  try {
+    const { daemonAcceptsConnections: daemonAcceptsConnections3 } = await Promise.resolve().then(() => (init_daemon_client2(), exports_daemon_client2));
+    return await daemonAcceptsConnections3();
+  } catch {
+    return false;
+  }
+}
 async function probeDaemonEndToEnd() {
   return (await probeDaemon()).ok;
 }
-async function waitForDaemonRunning() {
-  const deadline = Date.now() + SERVICE_START_TIMEOUT_MS;
+async function waitForDaemonRunning(deps = {}) {
+  const status = deps.status ?? daemonServiceStatus;
+  const accepts = deps.accepts ?? daemonAcceptsConnectionsQuietly;
+  const sleep = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+  const now = deps.now ?? Date.now;
+  const deadline = now() + SERVICE_START_TIMEOUT_MS;
   for (;; ) {
-    if (daemonServiceStatus() === "running")
+    if (status() === "running")
       break;
-    if (Date.now() >= deadline)
+    if (now() >= deadline)
       return false;
-    await new Promise((r) => setTimeout(r, SERVICE_START_POLL_MS));
+    await sleep(SERVICE_START_POLL_MS);
+  }
+  const settleUntil = now() + SERVICE_SETTLE_MS;
+  for (;; ) {
+    if (status() !== "running")
+      return false;
+    if (await accepts())
+      return true;
+    if (now() >= settleUntil)
+      return true;
+    await sleep(SERVICE_START_POLL_MS);
   }
-  await new Promise((r) => setTimeout(r, SERVICE_SETTLE_MS));
-  return daemonServiceStatus() === "running";
 }
 function readInstalledServiceDefinition() {
   if (!isDaemonSupportedPlatform())
@@ -11756,6 +10853,18 @@ var init_daemon_service = __esm(() => {
 });
 
 // src/hooks/fp-reset.ts
+import {
+  copyFileSync,
+  existsSync as existsSync18,
+  mkdirSync as mkdirSync10,
+  readFileSync as readFileSync15,
+  readdirSync as readdirSync13,
+  renameSync as renameSync5,
+  rmSync as rmSync6,
+  rmdirSync,
+  statSync as statSync15,
+  writeFileSync as writeFileSync8
+} from "node:fs";
 function layoutWarningForHook() {
   const state = detectLayout();
   if (state.kind === "current" || state.kind === "absent")
@@ -11763,6 +10872,8 @@ function layoutWarningForHook() {
   if (state.kind === "future") {
     return `[failproofai] this directory was written by a newer version ` + `(layout ${state.found} vs ${LAYOUT_VERSION}) — policies are NOT being enforced. ` + `Upgrade failproofai.`;
   }
+  if (existsSync18(globalPolicyConfigFile()))
+    return null;
   return `[failproofai] setup predates this version — global policies are NOT being enforced. ` + `Run \`failproofai config\` to re-create it.`;
 }
 var init_fp_reset = __esm(() => {
@@ -11875,7 +10986,7 @@ async function evaluateHookEvent(eventType, cli = "claude", stdinPayload, opts)
     let conventionHookNames = new Set;
     let activePause = null;
     const policyAttribution = new Map;
-    let cloudGeneration;
+    let cloudDeployment;
     const observedResults = [];
     if (opts?.forceDecision) {
       config = { enabledPolicies: [] };
@@ -11898,7 +11009,7 @@ async function evaluateHookEvent(eventType, cli = "claude", stdinPayload, opts)
           cli
         });
       }
-      cloudGeneration = cloudManagedPolicies[0]?.generation;
+      cloudDeployment = cloudManagedPolicies[0]?.deployment;
       const configuredCustomPaths = config.customPoliciesPaths ?? config.customPoliciesPath;
       const allExplicitPaths = cloudManagedPolicies.length === 0 ? configuredCustomPaths : [
         ...typeof configuredCustomPaths === "string" ? [configuredCustomPaths] : configuredCustomPaths ?? [],
@@ -11923,7 +11034,7 @@ async function evaluateHookEvent(eventType, cli = "claude", stdinPayload, opts)
         const hookName = hook.name;
         const conventionScope = hook.__conventionScope;
         const isConvention = !!conventionScope;
-        const prefix = cloudManaged ? `cloud/${cloudManaged.id}@${cloudManaged.revision}` : isConvention ? `.failproofai-${conventionScope}` : "custom";
+        const prefix = cloudManaged ? `cloud/${cloudManaged.id}@${cloudManaged.version}` : isConvention ? `.failproofai-${conventionScope}` : "custom";
         const observeOnly = cloudManaged?.effect === "observe";
         const fn = async (ctx) => {
           if (observeOnly) {
@@ -11931,7 +11042,7 @@ async function evaluateHookEvent(eventType, cli = "claude", stdinPayload, opts)
             if (shadow.decision !== "allow") {
               observedResults.push({
                 policyId: cloudManaged.id,
-                revision: cloudManaged.revision,
+                version: cloudManaged.version,
                 decision: shadow.decision,
                 reason: shadow.reason ?? null
               });
@@ -11962,7 +11073,7 @@ async function evaluateHookEvent(eventType, cli = "claude", stdinPayload, opts)
         const registeredName = `${prefix}/${hookName}`;
         policyAttribution.set(registeredName, {
           source: cloudManaged ? "cloud" : isConvention ? "convention" : "custom",
-          ...cloudManaged ? { cloudPolicyId: cloudManaged.id, cloudRevision: cloudManaged.revision } : {}
+          ...cloudManaged ? { cloudPolicyId: cloudManaged.id, cloudVersion: cloudManaged.version } : {}
         });
         registerPolicy(registeredName, hook.description ?? "", fn, hook.match ?? {}, -1);
       }
@@ -12011,10 +11122,10 @@ async function evaluateHookEvent(eventType, cli = "claude", stdinPayload, opts)
         return {
           policySource: attribution?.source ?? "builtin",
           ...attribution?.cloudPolicyId ? { cloudPolicyId: attribution.cloudPolicyId } : {},
-          ...attribution?.cloudRevision !== undefined ? { cloudRevision: attribution.cloudRevision } : {}
+          ...attribution?.cloudVersion !== undefined ? { cloudVersion: attribution.cloudVersion } : {}
         };
       })() : {},
-      ...cloudGeneration !== undefined ? { cloudGeneration } : {},
+      ...cloudDeployment !== undefined ? { cloudDeployment } : {},
       ...observedResults.length > 0 ? { observed: observedResults } : {},
       ...activePause ? { pausedBy: activePause.setBy, pauseExpiresAt: activePause.expiresAt } : {}
     };
@@ -12104,65 +11215,98 @@ var init_handler = __esm(() => {
 // src/hooks/fp-reset.ts
 var exports_fp_reset = {};
 __export(exports_fp_reset, {
+  writeCarriedPolicyConfig: () => writeCarriedPolicyConfig,
   resetHome: () => resetHome,
+  readCarriedTelemetryOptOut: () => readCarriedTelemetryOptOut,
+  readCarriedPolicyConfig: () => readCarriedPolicyConfig,
   migrateHookActivity: () => migrateHookActivity,
   migrateConventionPolicies: () => migrateConventionPolicies,
   layoutWarningForHook: () => layoutWarningForHook2,
+  layoutBlockerForScheduledRun: () => layoutBlockerForScheduledRun,
   checkLayoutForCli: () => checkLayoutForCli
 });
-import { copyFileSync, existsSync as existsSync18, mkdirSync as mkdirSync10, readdirSync as readdirSync13, renameSync as renameSync5, rmSync as rmSync6 } from "node:fs";
-import { resolve as resolve15 } from "node:path";
+import {
+  copyFileSync as copyFileSync2,
+  existsSync as existsSync19,
+  mkdirSync as mkdirSync11,
+  readFileSync as readFileSync16,
+  readdirSync as readdirSync14,
+  renameSync as renameSync6,
+  rmSync as rmSync7,
+  rmdirSync as rmdirSync2,
+  statSync as statSync16,
+  writeFileSync as writeFileSync9
+} from "node:fs";
+import { dirname as dirname9, resolve as resolve15 } from "node:path";
 function migrateConventionPolicies() {
-  const from = policiesDir();
-  if (!existsSync18(from))
+  const from = legacy.customPoliciesDir();
+  if (!existsSync19(from))
     return [];
   const moved = [];
-  try {
-    const entries = readdirSync13(from, { withFileTypes: true }).filter((e) => e.isFile() && USER_SOURCE_RE.test(e.name) && !e.name.endsWith(".d.ts"));
+  const mergeInto = (dir, dest, prefix) => {
+    let entries;
+    try {
+      entries = readdirSync14(dir, { withFileTypes: true });
+    } catch {
+      return;
+    }
     if (entries.length === 0)
-      return [];
-    const to = customPoliciesDir();
-    mkdirSync10(to, { recursive: true });
+      return;
+    try {
+      mkdirSync11(dest, { recursive: true });
+    } catch {
+      return;
+    }
     for (const entry of entries) {
-      const target = resolve15(to, entry.name);
-      if (existsSync18(target))
+      const source = resolve15(dir, entry.name);
+      const target = resolve15(dest, entry.name);
+      const name = `${prefix}${entry.name}`;
+      if (!existsSync19(target)) {
+        try {
+          renameSync6(source, target);
+          moved.push(name);
+        } catch {}
         continue;
-      try {
-        renameSync5(resolve15(from, entry.name), target);
-        moved.push(entry.name);
-      } catch {}
+      }
+      if (entry.isDirectory() && statSync16(target).isDirectory()) {
+        mergeInto(source, target, `${name}/`);
+      }
     }
+  };
+  mergeInto(from, policiesDir(), "");
+  try {
+    rmdirSync2(from);
   } catch {}
   return moved.sort((a, b) => a.localeCompare(b));
 }
 function migrateHookActivity() {
   const from = legacy.hookActivityDir();
-  if (!existsSync18(from))
+  if (!existsSync19(from))
     return [];
   const moved = [];
   try {
-    const entries = readdirSync13(from, { withFileTypes: true }).filter((e) => e.isFile() && e.name.endsWith(".jsonl"));
+    const entries = readdirSync14(from, { withFileTypes: true }).filter((e) => e.isFile() && e.name.endsWith(".jsonl"));
     if (entries.length === 0)
       return [];
     const to = hookActivityDir();
-    mkdirSync10(to, { recursive: true });
+    mkdirSync11(to, { recursive: true });
     const stamp2 = Date.now();
     let seq = 0;
     for (const entry of entries) {
       const source = resolve15(from, entry.name);
       let name = entry.name === "current.jsonl" ? `page-${stamp2}-${seq++}.jsonl` : entry.name;
       let target = resolve15(to, name);
-      while (existsSync18(target)) {
+      while (existsSync19(target)) {
         name = `page-${stamp2}-${seq++}.jsonl`;
         target = resolve15(to, name);
       }
       try {
-        renameSync5(source, target);
+        renameSync6(source, target);
         moved.push(name);
       } catch (err) {
         if (err?.code === "EXDEV") {
           try {
-            copyFileSync(source, target);
+            copyFileSync2(source, target);
             moved.push(name);
           } catch {}
         }
@@ -12171,20 +11315,85 @@ function migrateHookActivity() {
   } catch {}
   return moved.sort((a, b) => a.localeCompare(b));
 }
+function readCarriedPolicyConfig() {
+  const to = globalPolicyConfigFile();
+  const layoutTwo = resolve15(legacy.localPoliciesDir(), "policies-config.json");
+  const from = existsSync19(layoutTwo) ? layoutTwo : legacy.policyConfig();
+  if (!existsSync19(from))
+    return null;
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync16(from, "utf8"));
+  } catch {
+    return null;
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+    return null;
+  const carried = {};
+  let found = false;
+  for (const key of CARRIED_POLICY_CONFIG_KEYS) {
+    if (parsed[key] !== undefined) {
+      carried[key] = parsed[key];
+      found = true;
+    }
+  }
+  if (!found)
+    return null;
+  if (carried.enabledPolicies === undefined)
+    carried.enabledPolicies = [];
+  return carried;
+}
+function writeCarriedPolicyConfig(carried) {
+  if (!carried)
+    return [];
+  const to = globalPolicyConfigFile();
+  try {
+    mkdirSync11(dirname9(to), { recursive: true });
+    writeFileSync9(to, JSON.stringify(carried, null, 2) + `
+`, "utf8");
+  } catch {
+    return [];
+  }
+  return Object.keys(carried).sort((a, b) => a.localeCompare(b));
+}
+function readCarriedTelemetryOptOut() {
+  const from = legacy.configToml();
+  if (!existsSync19(from))
+    return false;
+  try {
+    const text = readFileSync16(from, "utf8");
+    const start = text.search(/^\s*\[telemetry\]\s*$/m);
+    if (start === -1)
+      return false;
+    const body = text.slice(start).replace(/^\s*\[telemetry\]\s*$/m, "");
+    const nextTable = body.search(/^\s*\[/m);
+    const section = nextTable === -1 ? body : body.slice(0, nextTable);
+    return /^\s*enabled\s*=\s*false\s*$/m.test(section);
+  } catch {
+    return false;
+  }
+}
 function resetHome(from) {
   const migrated = migrateConventionPolicies();
   const activity = migrateHookActivity();
+  const pendingPolicyConfig = readCarriedPolicyConfig();
+  const telemetryOptOut = readCarriedTelemetryOptOut();
   const removed = [];
   for (const path3 of resettablePaths()) {
-    if (!existsSync18(path3))
+    if (from === LAYOUT_VERSION && path3 === globalPolicyConfigFile())
+      continue;
+    if (!existsSync19(path3))
       continue;
     try {
-      rmSync6(path3, { recursive: true, force: true });
+      rmSync7(path3, { recursive: true, force: true });
       removed.push(path3);
     } catch {}
   }
+  const policyConfig = writeCarriedPolicyConfig(pendingPolicyConfig);
+  if (telemetryOptOut)
+    updateConfig({ telemetry: { enabled: false } });
   writeVersionFile();
-  return { removed, migrated, activity, from };
+  return { removed, migrated, activity, policyConfig, from };
 }
 async function checkLayoutForCli() {
   const state = detectLayout();
@@ -12227,7 +11436,7 @@ async function checkLayoutForCli() {
       ]
     };
   }
-  if (state.kind === "absent")
+  if (state.kind === "absent" || state.kind === "current" && state.inferred)
     writeVersionFile();
   return {
     state,
@@ -12296,6 +11505,15 @@ function staleDaemonHint() {
     return [];
   }
 }
+function layoutBlockerForScheduledRun() {
+  const state = detectLayout();
+  if (state.kind === "current" || state.kind === "absent")
+    return null;
+  if (state.kind === "future") {
+    return `[failproofai] this directory was written by a newer version ` + `(layout ${state.found} vs ${LAYOUT_VERSION}) — refusing to run unattended. ` + `Upgrade failproofai.`;
+  }
+  return `[failproofai] setup predates this version (layout ${state.found} vs ${LAYOUT_VERSION}) — ` + `refusing to run unattended, because completing it would reset this home. ` + `Run \`failproofai config\`.`;
+}
 function layoutWarningForHook2() {
   const state = detectLayout();
   if (state.kind === "current" || state.kind === "absent")
@@ -12303,20 +11521,31 @@ function layoutWarningForHook2() {
   if (state.kind === "future") {
     return `[failproofai] this directory was written by a newer version ` + `(layout ${state.found} vs ${LAYOUT_VERSION}) — policies are NOT being enforced. ` + `Upgrade failproofai.`;
   }
+  if (existsSync19(globalPolicyConfigFile()))
+    return null;
   return `[failproofai] setup predates this version — global policies are NOT being enforced. ` + `Run \`failproofai config\` to re-create it.`;
 }
-var USER_SOURCE_RE;
+var CARRIED_POLICY_CONFIG_KEYS;
 var init_fp_reset2 = __esm(() => {
   init_fp_home();
   init_fp_config();
   init_daemon_service();
-  USER_SOURCE_RE = /\.(js|mjs|ts)$/;
+  CARRIED_POLICY_CONFIG_KEYS = [
+    "enabledPolicies",
+    "customPoliciesPaths",
+    "customPoliciesPath",
+    "disabledCustomPolicies",
+    "conventionPolicies",
+    "disabledConventionPolicies",
+    "policyParams",
+    "llm"
+  ];
 });
 
 // scripts/install-telemetry.mjs
 import { createHmac, randomUUID as randomUUID2 } from "node:crypto";
 import { execSync as execSync4 } from "node:child_process";
-import { readFileSync as readFileSync15, writeFileSync as writeFileSync8, mkdirSync as mkdirSync11 } from "node:fs";
+import { readFileSync as readFileSync17, writeFileSync as writeFileSync10, mkdirSync as mkdirSync12 } from "node:fs";
 import { homedir as homedir20, platform, arch, hostname, cpus } from "node:os";
 import { join as join27 } from "node:path";
 function hashToId3(raw) {
@@ -12326,7 +11555,7 @@ function getInstanceId3() {
   const idDir = join27(homedir20(), ".failproofai");
   const idFile = join27(idDir, "instance-id");
   try {
-    const existing = readFileSync15(idFile, "utf-8").trim();
+    const existing = readFileSync17(idFile, "utf-8").trim();
     if (existing)
       return existing;
   } catch {}
@@ -12335,7 +11564,7 @@ function getInstanceId3() {
     if (p === "linux") {
       for (const machineIdPath of ["/etc/machine-id", "/var/lib/dbus/machine-id"]) {
         try {
-          const id2 = readFileSync15(machineIdPath, "utf-8").trim();
+          const id2 = readFileSync17(machineIdPath, "utf-8").trim();
           if (id2)
             return hashToId3(id2);
         } catch {}
@@ -12367,8 +11596,8 @@ function getInstanceId3() {
   } catch {}
   const id = randomUUID2();
   try {
-    mkdirSync11(idDir, { recursive: true });
-    writeFileSync8(idFile, id, "utf-8");
+    mkdirSync12(idDir, { recursive: true });
+    writeFileSync10(idFile, id, "utf-8");
   } catch {}
   return id;
 }
@@ -12406,8 +11635,8 @@ __export(exports_install_check, {
   compareSemver: () => compareSemver,
   checkHooks: () => checkHooks
 });
-import { existsSync as existsSync19, readFileSync as readFileSync16, writeFileSync as writeFileSync9, mkdirSync as mkdirSync12 } from "node:fs";
-import { dirname as dirname9, resolve as resolve16 } from "node:path";
+import { existsSync as existsSync20, readFileSync as readFileSync18, writeFileSync as writeFileSync11, mkdirSync as mkdirSync13 } from "node:fs";
+import { dirname as dirname10, resolve as resolve16 } from "node:path";
 import { platform as platform2, arch as arch2, release, homedir as homedir21, hostname as hostname2 } from "node:os";
 import { createHmac as createHmac2 } from "node:crypto";
 function hashToId4(raw) {
@@ -12417,14 +11646,14 @@ function lastVersionPath() {
   return lastVersionFile();
 }
 function compareSemver(a, b) {
-  const parse2 = (v) => {
+  const parse = (v) => {
     const m = /^(\d+)\.(\d+)\.(\d+)(?:-(.+))?$/.exec(v);
     if (!m)
       return null;
     return { nums: [Number(m[1]), Number(m[2]), Number(m[3])], pre: m[4] ?? null };
   };
-  const pa = parse2(a);
-  const pb = parse2(b);
+  const pa = parse(a);
+  const pb = parse(b);
   if (!pa || !pb)
     return a < b ? -1 : a > b ? 1 : 0;
   for (let i = 0;i < 3; i++) {
@@ -12462,12 +11691,12 @@ function compareSemver(a, b) {
 }
 function checkHooks() {
   const hooksConfigPath = globalPolicyConfigFile();
-  if (!existsSync19(hooksConfigPath)) {
+  if (!existsSync20(hooksConfigPath)) {
     return { configured: false, registered: false, policyCount: 0 };
   }
   let config;
   try {
-    config = JSON.parse(readFileSync16(hooksConfigPath, "utf8"));
+    config = JSON.parse(readFileSync18(hooksConfigPath, "utf8"));
   } catch {
     return { configured: false, registered: false, policyCount: 0 };
   }
@@ -12476,11 +11705,11 @@ function checkHooks() {
   }
   const policyCount = config.enabledPolicies.length;
   const settingsPath = resolve16(homedir21(), ".claude", "settings.json");
-  if (!existsSync19(settingsPath))
+  if (!existsSync20(settingsPath))
     return { configured: true, registered: false, policyCount };
   let settings;
   try {
-    settings = JSON.parse(readFileSync16(settingsPath, "utf8"));
+    settings = JSON.parse(readFileSync18(settingsPath, "utf8"));
   } catch {
     return { configured: true, registered: false, policyCount };
   }
@@ -12504,8 +11733,8 @@ async function maybeReportInstall(version3) {
     const versionFile2 = lastVersionPath();
     let previousVersion = null;
     try {
-      if (existsSync19(versionFile2)) {
-        previousVersion = readFileSync16(versionFile2, "utf8").trim() || null;
+      if (existsSync20(versionFile2)) {
+        previousVersion = readFileSync18(versionFile2, "utf8").trim() || null;
       }
     } catch {}
     if (previousVersion === version3)
@@ -12541,8 +11770,8 @@ async function maybeReportInstall(version3) {
       enabled_policy_count: hooks.policyCount
     }, { version: version3, timeoutMs: REPORT_TIMEOUT_MS, enabled: telemetryEnabled }));
     try {
-      mkdirSync12(dirname9(versionFile2), { recursive: true });
-      writeFileSync9(versionFile2, version3, "utf8");
+      mkdirSync13(dirname10(versionFile2), { recursive: true });
+      writeFileSync11(versionFile2, version3, "utf8");
     } catch {}
     await Promise.all(events.map((p) => p.catch(() => {})));
   } catch {}
@@ -12805,10 +12034,11 @@ function runPrompt(p) {
     return lines;
   };
   const collapse = (result) => {
+    const summary = result === BACK ? "back" : p.summaryFor(result);
     repaint(stdout, region, [
       c.dim(BAR),
       `${c.dim(STEP_DONE)}  ${p.message}`,
-      `${c.dim(BAR)}  ${c.dim(p.summaryFor(result))}`
+      `${c.dim(BAR)}  ${c.dim(summary)}`
     ]);
   };
   return new Promise((resolve17) => {
@@ -12834,6 +12064,8 @@ function runPrompt(p) {
         return;
       if (key.ctrl && (key.name === "c" || key.name === "d") || key.name === "escape") {
         finish(null);
+      } else if (key.name === "left" && p.allowBack) {
+        finish(BACK);
       } else if (key.name === "up") {
         cursor = cursor > 0 ? cursor - 1 : choices.length - 1;
         repaint(stdout, region, build());
@@ -12877,7 +12109,8 @@ function selectOne(opts) {
       const hint = choice.hint ? `  ${c.dim(ellipsize(choice.hint, budget))}` : "";
       return `${dot} ${label}${hint}`;
     },
-    footer: "↑/↓ navigate · enter to select · esc to cancel",
+    allowBack: opts.allowBack,
+    footer: opts.allowBack ? "↑/↓ navigate · enter to select · ← back · esc to cancel" : "↑/↓ navigate · enter to select · esc to cancel",
     onKey: (key, cursor) => key.name === "return" ? { done: choices[cursor].value } : undefined,
     summaryFor: (value) => value === null ? "cancelled" : choices.find((ch) => ch.value === value)?.label ?? String(value)
   });
@@ -12911,7 +12144,8 @@ function multiSelect(opts) {
       return `${caret} ${box} ${label}${hint}`;
     },
     warnLine: () => warn ? c.warn(`Select at least ${minSelected}.`) : null,
-    footer: opts.hint ?? "↑/↓ move · space select · ctrl+a all · enter confirm",
+    allowBack: opts.allowBack,
+    footer: opts.hint ?? (opts.allowBack ? "↑/↓ move · space select · ctrl+a all · ← back · enter confirm" : "↑/↓ move · space select · ctrl+a all · enter confirm"),
     onKey: (key, cursor) => {
       if (key.name === "space") {
         if (choices[cursor]?.locked)
@@ -12973,11 +12207,13 @@ function promptText(opts) {
   return new Promise((resolve17) => {
     let value = "";
     const draw = (error) => {
+      const cols = stdout.columns || 80;
       const shown = opts.mask ? "•".repeat(value.length) : value;
       const hint = opts.hint ? `  ${c.dim(opts.hint)}` : "";
+      const line = truncate(`${c.bold(opts.message)} ${shown}${hint}`, cols - 1);
       const err = error ? `
-  ${c.warn(error)}` : "";
-      stdout.write(`\r\x1B[2K${c.bold(opts.message)} ${shown}${hint}${err}`);
+  ${truncate(c.warn(error), cols - 3)}` : "";
+      stdout.write(`\r\x1B[2K${line}${err}`);
       if (err)
         stdout.write("\x1B[1A");
     };
@@ -13024,7 +12260,7 @@ function promptText(opts) {
     stdin.on("keypress", onKey);
   });
 }
-var ESC = "\x1B", BAR = "│", BAR_END = "└", STEP_ACTIVE = "◆", STEP_DONE = "◇", RADIO_ON = "●", RADIO_OFF = "○", CHECK_ON = "◼", CHECK_OFF = "◻", CARET = "❯", FLOWER = "❋", HUES, ANSI_RESET, ANSI_BOLD, ANSI_DIM, LOGO_MIN_COLS = 22, TAGLINE = "end-to-end failure layer for ai agents", LOGO_GRID, LOGO_TEAL, LOGO_PINK, WINDOW = 8;
+var ESC = "\x1B", BAR = "│", BAR_END = "└", STEP_ACTIVE = "◆", STEP_DONE = "◇", RADIO_ON = "●", RADIO_OFF = "○", CHECK_ON = "◼", CHECK_OFF = "◻", CARET = "❯", FLOWER = "❋", HUES, ANSI_RESET, ANSI_BOLD, ANSI_DIM, LOGO_MIN_COLS = 22, TAGLINE = "end-to-end failure layer for ai agents", LOGO_GRID, LOGO_TEAL, LOGO_PINK, WINDOW = 8, BACK;
 var init_tui = __esm(() => {
   HUES = {
     guide: { rgb: [102, 209, 181], basic: "36" },
@@ -13060,6 +12296,7 @@ var init_tui = __esm(() => {
   ];
   LOGO_TEAL = HUES.guide.rgb;
   LOGO_PINK = HUES.logoPink.rgb;
+  BACK = Symbol("failproofai.back");
 });
 
 // src/hooks/collector-config.ts
@@ -14556,7 +13793,7 @@ var require_stringify = __commonJS((exports) => {
       props.push(doc.directives.tagString(tag));
     return props.join(" ");
   }
-  function stringify2(item, ctx, onComment, onChompKeep) {
+  function stringify(item, ctx, onComment, onChompKeep) {
     if (identity.isPair(item))
       return item.toString(ctx, onComment, onChompKeep);
     if (identity.isAlias(item)) {
@@ -14585,14 +13822,14 @@ var require_stringify = __commonJS((exports) => {
 ${ctx.indent}${str2}`;
   }
   exports.createStringifyContext = createStringifyContext;
-  exports.stringify = stringify2;
+  exports.stringify = stringify;
 });
 
 // node_modules/yaml/dist/stringify/stringifyPair.js
 var require_stringifyPair = __commonJS((exports) => {
   var identity = require_identity();
   var Scalar = require_Scalar();
-  var stringify2 = require_stringify();
+  var stringify = require_stringify();
   var stringifyComment = require_stringifyComment();
   function stringifyPair({ key, value }, ctx, onComment, onChompKeep) {
     const { allNullValues, doc, indent, indentStep, options: { commentString, indentSeq, simpleKeys } } = ctx;
@@ -14614,7 +13851,7 @@ var require_stringifyPair = __commonJS((exports) => {
     });
     let keyCommentDone = false;
     let chompKeep = false;
-    let str2 = stringify2.stringify(key, ctx, () => keyCommentDone = true, () => chompKeep = true);
+    let str2 = stringify.stringify(key, ctx, () => keyCommentDone = true, () => chompKeep = true);
     if (!explicitKey && !ctx.inFlow && str2.length > 1024) {
       if (simpleKeys)
         throw new Error("With simple keys, single line scalar must not span more than 1024 characters");
@@ -14666,7 +13903,7 @@ ${indent}:`;
       ctx.indent = ctx.indent.substring(2);
     }
     let valueCommentDone = false;
-    const valueStr = stringify2.stringify(value, ctx, () => valueCommentDone = true, () => chompKeep = true);
+    const valueStr = stringify.stringify(value, ctx, () => valueCommentDone = true, () => chompKeep = true);
     let ws = " ";
     if (keyComment || vsb || vcb) {
       ws = vsb ? `
@@ -14804,7 +14041,7 @@ var require_merge = __commonJS((exports) => {
 var require_addPairToJSMap = __commonJS((exports) => {
   var log = require_log();
   var merge = require_merge();
-  var stringify2 = require_stringify();
+  var stringify = require_stringify();
   var identity = require_identity();
   var toJS = require_toJS();
   function addPairToJSMap(ctx, map, { key, value }) {
@@ -14840,7 +14077,7 @@ var require_addPairToJSMap = __commonJS((exports) => {
     if (typeof jsKey !== "object")
       return String(jsKey);
     if (identity.isNode(key) && ctx?.doc) {
-      const strCtx = stringify2.createStringifyContext(ctx.doc, {});
+      const strCtx = stringify.createStringifyContext(ctx.doc, {});
       strCtx.anchors = new Set;
       for (const node of ctx.anchors.keys())
         strCtx.anchors.add(node.anchor);
@@ -14902,12 +14139,12 @@ var require_Pair = __commonJS((exports) => {
 // node_modules/yaml/dist/stringify/stringifyCollection.js
 var require_stringifyCollection = __commonJS((exports) => {
   var identity = require_identity();
-  var stringify2 = require_stringify();
+  var stringify = require_stringify();
   var stringifyComment = require_stringifyComment();
   function stringifyCollection(collection, ctx, options) {
     const flow = ctx.inFlow ?? collection.flow;
-    const stringify3 = flow ? stringifyFlowCollection : stringifyBlockCollection;
-    return stringify3(collection, ctx, options);
+    const stringify2 = flow ? stringifyFlowCollection : stringifyBlockCollection;
+    return stringify2(collection, ctx, options);
   }
   function stringifyBlockCollection({ comment, items }, ctx, { blockItemPrefix, flowChars, itemIndent, onChompKeep, onComment }) {
     const { indent, options: { commentString } } = ctx;
@@ -14932,7 +14169,7 @@ var require_stringifyCollection = __commonJS((exports) => {
         }
       }
       chompKeep = false;
-      let str3 = stringify2.stringify(item, itemCtx, () => comment2 = null, () => chompKeep = true);
+      let str3 = stringify.stringify(item, itemCtx, () => comment2 = null, () => chompKeep = true);
       if (comment2)
         str3 += stringifyComment.lineComment(str3, itemIndent, commentString(comment2));
       if (chompKeep && comment2)
@@ -15001,7 +14238,7 @@ ${indent}${line}` : `
       }
       if (comment)
         reqNewline = true;
-      let str2 = stringify2.stringify(item, itemCtx, () => comment = null);
+      let str2 = stringify.stringify(item, itemCtx, () => comment = null);
       reqNewline || (reqNewline = lines.length > linesAtValue || str2.includes(`
 `));
       if (i < items.length - 1) {
@@ -16242,7 +15479,7 @@ var require_Schema = __commonJS((exports) => {
 // node_modules/yaml/dist/stringify/stringifyDocument.js
 var require_stringifyDocument = __commonJS((exports) => {
   var identity = require_identity();
-  var stringify2 = require_stringify();
+  var stringify = require_stringify();
   var stringifyComment = require_stringifyComment();
   function stringifyDocument(doc, options) {
     const lines = [];
@@ -16257,7 +15494,7 @@ var require_stringifyDocument = __commonJS((exports) => {
     }
     if (hasDirectives)
       lines.push("---");
-    const ctx = stringify2.createStringifyContext(doc, options);
+    const ctx = stringify.createStringifyContext(doc, options);
     const { commentString } = ctx.options;
     if (doc.commentBefore) {
       if (lines.length !== 1)
@@ -16279,7 +15516,7 @@ var require_stringifyDocument = __commonJS((exports) => {
         contentComment = doc.contents.comment;
       }
       const onChompKeep = contentComment ? undefined : () => chompKeep = true;
-      let body = stringify2.stringify(doc.contents, ctx, () => contentComment = null, onChompKeep);
+      let body = stringify.stringify(doc.contents, ctx, () => contentComment = null, onChompKeep);
       if (contentComment)
         body += stringifyComment.lineComment(body, "", commentString(contentComment));
       if ((body[0] === "|" || body[0] === ">") && lines[lines.length - 1] === "---") {
@@ -16287,7 +15524,7 @@ var require_stringifyDocument = __commonJS((exports) => {
       } else
         lines.push(body);
     } else {
-      lines.push(stringify2.stringify(doc.contents, ctx));
+      lines.push(stringify.stringify(doc.contents, ctx));
     }
     if (doc.directives?.docEnd) {
       if (doc.comment) {
@@ -18306,7 +17543,7 @@ var require_cst_scalar = __commonJS((exports) => {
 
 // node_modules/yaml/dist/parse/cst-stringify.js
 var require_cst_stringify = __commonJS((exports) => {
-  var stringify2 = (cst) => ("type" in cst) ? stringifyToken(cst) : stringifyItem(cst);
+  var stringify = (cst) => ("type" in cst) ? stringifyToken(cst) : stringifyItem(cst);
   function stringifyToken(token) {
     switch (token.type) {
       case "block-scalar": {
@@ -18359,7 +17596,7 @@ var require_cst_stringify = __commonJS((exports) => {
       res += stringifyToken(value);
     return res;
   }
-  exports.stringify = stringify2;
+  exports.stringify = stringify;
 });
 
 // node_modules/yaml/dist/parse/cst-visit.js
@@ -20050,7 +19287,7 @@ var require_public_api = __commonJS((exports) => {
     }
     return doc;
   }
-  function parse2(src, reviver, options) {
+  function parse(src, reviver, options) {
     let _reviver = undefined;
     if (typeof reviver === "function") {
       _reviver = reviver;
@@ -20069,7 +19306,7 @@ var require_public_api = __commonJS((exports) => {
     }
     return doc.toJS(Object.assign({ reviver: _reviver }, options));
   }
-  function stringify2(value, replacer, options) {
+  function stringify(value, replacer, options) {
     let _replacer = null;
     if (typeof replacer === "function" || Array.isArray(replacer)) {
       _replacer = replacer;
@@ -20091,15 +19328,15 @@ var require_public_api = __commonJS((exports) => {
       return value.toString(options);
     return new Document.Document(value, _replacer, options).toString(options);
   }
-  exports.parse = parse2;
+  exports.parse = parse;
   exports.parseAllDocuments = parseAllDocuments;
   exports.parseDocument = parseDocument;
-  exports.stringify = stringify2;
+  exports.stringify = stringify;
 });
 
 // node_modules/yaml/dist/index.js
 var composer, Document, Schema, errors, Alias, identity, Pair, Scalar, YAMLMap, YAMLSeq, cst, lexer, lineCounter, parser, publicApi, visit, $Composer, $Document, $Schema, $YAMLError, $YAMLParseError, $YAMLWarning, $Alias, $isAlias, $isCollection, $isDocument, $isMap, $isNode, $isPair, $isScalar, $isSeq, $Pair, $Scalar, $YAMLMap, $YAMLSeq, $Lexer, $LineCounter, $Parser, $parse, $parseAllDocuments, $parseDocument, $stringify, $visit, $visitAsync;
-var init_dist2 = __esm(() => {
+var init_dist = __esm(() => {
   composer = require_composer();
   Document = require_Document();
   Schema = require_Schema();
@@ -20148,31 +19385,31 @@ var init_dist2 = __esm(() => {
 
 // src/hooks/integrations.ts
 import { execSync as execSync5 } from "node:child_process";
-import { readFileSync as readFileSync17, writeFileSync as writeFileSync10, existsSync as existsSync20, mkdirSync as mkdirSync13, unlinkSync as unlinkSync3 } from "node:fs";
-import { resolve as resolve17, dirname as dirname10 } from "node:path";
+import { readFileSync as readFileSync19, writeFileSync as writeFileSync12, existsSync as existsSync21, mkdirSync as mkdirSync14, unlinkSync as unlinkSync3 } from "node:fs";
+import { resolve as resolve17, dirname as dirname11 } from "node:path";
 import { fileURLToPath } from "node:url";
 import { homedir as homedir22 } from "node:os";
 function readJsonFile(path3) {
-  if (!existsSync20(path3))
+  if (!existsSync21(path3))
     return {};
-  const raw = readFileSync17(path3, "utf8");
+  const raw = readFileSync19(path3, "utf8");
   return JSON.parse(raw);
 }
 function writeJsonFile(path3, data) {
-  mkdirSync13(dirname10(path3), { recursive: true });
-  writeFileSync10(path3, JSON.stringify(data, null, 2) + `
+  mkdirSync14(dirname11(path3), { recursive: true });
+  writeFileSync12(path3, JSON.stringify(data, null, 2) + `
 `, "utf8");
 }
 function readYamlDoc(path3) {
   try {
-    return existsSync20(path3) ? $parseDocument(readFileSync17(path3, "utf8")) : $parseDocument("");
+    return existsSync21(path3) ? $parseDocument(readFileSync19(path3, "utf8")) : $parseDocument("");
   } catch {
     return $parseDocument("");
   }
 }
 function writeYamlDoc(path3, doc) {
-  mkdirSync13(dirname10(path3), { recursive: true });
-  writeFileSync10(path3, doc.toString(), "utf8");
+  mkdirSync14(dirname11(path3), { recursive: true });
+  writeFileSync12(path3, doc.toString(), "utf8");
 }
 function isMarkedHook(hook) {
   if (!hook || typeof hook !== "object")
@@ -20215,7 +19452,7 @@ function isMarkedCopilotHook(hook) {
   return false;
 }
 function opencodePluginFilePath(settingsPath) {
-  return resolve17(dirname10(settingsPath), "plugins", "failproofai.mjs");
+  return resolve17(dirname11(settingsPath), "plugins", "failproofai.mjs");
 }
 function buildOpenCodePluginShim(binaryPath, scope) {
   const useNpx = scope === "project";
@@ -20451,7 +19688,7 @@ function makePiProjectRelativeEntry(extPath) {
   return extResolved;
 }
 function hermesConfigHasHooks(settingsPath) {
-  if (!existsSync20(settingsPath))
+  if (!existsSync21(settingsPath))
     return false;
   try {
     const doc = readYamlDoc(settingsPath);
@@ -20467,7 +19704,7 @@ function hermesConfigHasHooks(settingsPath) {
   return false;
 }
 function unhookedHermesProfiles() {
-  return listHermesProfiles().filter((p) => existsSync20(p.home)).filter((p) => !hermesConfigHasHooks(resolve17(p.home, "config.yaml"))).map((p) => p.name);
+  return listHermesProfiles().filter((p) => existsSync21(p.home)).filter((p) => !hermesConfigHasHooks(resolve17(p.home, "config.yaml"))).map((p) => p.name);
 }
 function getOpenClawPluginPath() {
   const fromEnv = process.env.FAILPROOFAI_PACKAGE_ROOT;
@@ -20501,7 +19738,7 @@ function detectInstalledClis() {
 }
 var claudeCode, codex, copilot, cursor, OPENCODE_PLUGIN_REL_PATH = "./plugins/failproofai.mjs", opencode, pi, hermes, OPENCLAW_PLUGIN_ID = "failproofai", openclaw, factory, devin, ANTIGRAVITY_HOOK_NAME = "failproofai", ANTIGRAVITY_TOOL_EVENTS, antigravity, goose, INTEGRATIONS;
 var init_integrations = __esm(() => {
-  init_dist2();
+  init_dist();
   init_hermes_profiles();
   init_types();
   claudeCode = {
@@ -20613,7 +19850,7 @@ var init_integrations = __esm(() => {
     },
     hooksInstalledInSettings(scope, cwd) {
       const settingsPath = this.getSettingsPath(scope, cwd);
-      if (!existsSync20(settingsPath))
+      if (!existsSync21(settingsPath))
         return false;
       try {
         const settings = this.readSettings(settingsPath);
@@ -20729,7 +19966,7 @@ var init_integrations = __esm(() => {
     },
     hooksInstalledInSettings(scope, cwd) {
       const settingsPath = this.getSettingsPath(scope, cwd);
-      if (!existsSync20(settingsPath))
+      if (!existsSync21(settingsPath))
         return false;
       try {
         const settings = this.readSettings(settingsPath);
@@ -20843,7 +20080,7 @@ var init_integrations = __esm(() => {
     },
     hooksInstalledInSettings(scope, cwd) {
       const settingsPath = this.getSettingsPath(scope, cwd);
-      if (!existsSync20(settingsPath))
+      if (!existsSync21(settingsPath))
         return false;
       try {
         const settings = this.readSettings(settingsPath);
@@ -20946,7 +20183,7 @@ var init_integrations = __esm(() => {
     },
     hooksInstalledInSettings(scope, cwd) {
       const settingsPath = this.getSettingsPath(scope, cwd);
-      if (!existsSync20(settingsPath))
+      if (!existsSync21(settingsPath))
         return false;
       try {
         const settings = this.readSettings(settingsPath);
@@ -21006,8 +20243,8 @@ var init_integrations = __esm(() => {
       const effectiveScope = scope ?? "project";
       const settingsPath = effectiveScope === "user" ? resolve17(homedir22(), ".config", "opencode", "opencode.json") : resolve17(process.cwd(), ".opencode", "opencode.json");
       const pluginPath = opencodePluginFilePath(settingsPath);
-      mkdirSync13(dirname10(pluginPath), { recursive: true });
-      writeFileSync10(pluginPath, buildOpenCodePluginShim(binaryPath, effectiveScope), "utf8");
+      mkdirSync14(dirname11(pluginPath), { recursive: true });
+      writeFileSync12(pluginPath, buildOpenCodePluginShim(binaryPath, effectiveScope), "utf8");
       if (!Array.isArray(s.plugin))
         s.plugin = [];
       const desired = effectiveScope === "user" ? `file://${pluginPath}` : OPENCODE_PLUGIN_REL_PATH;
@@ -21030,9 +20267,9 @@ var init_integrations = __esm(() => {
       }
       this.writeSettings(settingsPath, settings);
       const pluginPath = opencodePluginFilePath(settingsPath);
-      if (existsSync20(pluginPath)) {
+      if (existsSync21(pluginPath)) {
         try {
-          const content = readFileSync17(pluginPath, "utf8");
+          const content = readFileSync19(pluginPath, "utf8");
           if (content.includes(FAILPROOFAI_HOOK_MARKER)) {
             unlinkSync3(pluginPath);
             if (removed === 0)
@@ -21044,7 +20281,7 @@ var init_integrations = __esm(() => {
     },
     hooksInstalledInSettings(scope, cwd) {
       const settingsPath = this.getSettingsPath(scope, cwd);
-      if (!existsSync20(settingsPath))
+      if (!existsSync21(settingsPath))
         return false;
       try {
         const settings = this.readSettings(settingsPath);
@@ -21054,9 +20291,9 @@ var init_integrations = __esm(() => {
         if (!hasEntry)
           return false;
         const pluginPath = opencodePluginFilePath(settingsPath);
-        if (!existsSync20(pluginPath))
+        if (!existsSync21(pluginPath))
           return false;
-        const content = readFileSync17(pluginPath, "utf8");
+        const content = readFileSync19(pluginPath, "utf8");
         return content.includes(FAILPROOFAI_HOOK_MARKER);
       } catch {
         return false;
@@ -21121,7 +20358,7 @@ var init_integrations = __esm(() => {
       }
     },
     removeHooksFromFile(settingsPath) {
-      if (!existsSync20(settingsPath))
+      if (!existsSync21(settingsPath))
         return 0;
       const settings = this.readSettings(settingsPath);
       if (!Array.isArray(settings.packages))
@@ -21136,7 +20373,7 @@ var init_integrations = __esm(() => {
     },
     hooksInstalledInSettings(scope, cwd) {
       const settingsPath = this.getSettingsPath(scope, cwd);
-      if (!existsSync20(settingsPath))
+      if (!existsSync21(settingsPath))
         return false;
       try {
         const settings = this.readSettings(settingsPath);
@@ -21195,7 +20432,7 @@ var init_integrations = __esm(() => {
       doc.set("hooks_auto_accept", true);
     },
     removeHooksFromFile(settingsPath) {
-      if (!existsSync20(settingsPath))
+      if (!existsSync21(settingsPath))
         return 0;
       const doc = readYamlDoc(settingsPath);
       const js = doc.toJS() ?? {};
@@ -21285,7 +20522,7 @@ var init_integrations = __esm(() => {
       hooks.allowConversationAccess = true;
     },
     removeHooksFromFile(settingsPath) {
-      if (!existsSync20(settingsPath))
+      if (!existsSync21(settingsPath))
         return 0;
       const settings = this.readSettings(settingsPath);
       const plugins = settings.plugins;
@@ -21314,7 +20551,7 @@ var init_integrations = __esm(() => {
     },
     hooksInstalledInSettings(scope, cwd) {
       const settingsPath = this.getSettingsPath(scope, cwd);
-      if (!existsSync20(settingsPath))
+      if (!existsSync21(settingsPath))
         return false;
       try {
         const settings = this.readSettings(settingsPath);
@@ -21411,7 +20648,7 @@ var init_integrations = __esm(() => {
     },
     hooksInstalledInSettings(scope, cwd) {
       const settingsPath = this.getSettingsPath(scope, cwd);
-      if (!existsSync20(settingsPath))
+      if (!existsSync21(settingsPath))
         return false;
       try {
         const settings = this.readSettings(settingsPath);
@@ -21517,7 +20754,7 @@ var init_integrations = __esm(() => {
     },
     hooksInstalledInSettings(scope, cwd) {
       const settingsPath = this.getSettingsPath(scope, cwd);
-      if (!existsSync20(settingsPath))
+      if (!existsSync21(settingsPath))
         return false;
       try {
         const settings = this.readSettings(settingsPath);
@@ -21656,7 +20893,7 @@ var init_integrations = __esm(() => {
     },
     hooksInstalledInSettings(scope, cwd) {
       const settingsPath = this.getSettingsPath(scope, cwd);
-      if (!existsSync20(settingsPath))
+      if (!existsSync21(settingsPath))
         return false;
       try {
         const settings = this.readSettings(settingsPath);
@@ -21762,7 +20999,7 @@ var init_integrations = __esm(() => {
     },
     hooksInstalledInSettings(scope, cwd) {
       const settingsPath = this.getSettingsPath(scope, cwd);
-      if (!existsSync20(settingsPath))
+      if (!existsSync21(settingsPath))
         return false;
       try {
         const settings = this.readSettings(settingsPath);
@@ -22041,7 +21278,7 @@ var init_cli_error = __esm(() => {
 
 // src/hooks/manager.ts
 import { execSync as execSync6 } from "node:child_process";
-import { existsSync as existsSync21 } from "node:fs";
+import { existsSync as existsSync22 } from "node:fs";
 import { resolve as resolve18, basename as basename4 } from "node:path";
 import { platform as platform3, arch as arch3, release as release2, hostname as hostname3 } from "node:os";
 function getSettingsPath(scope, cwd) {
@@ -22152,7 +21389,7 @@ async function installHooksImpl(policyNames, scope = "user", cwd, includeBeta =
   } else if (customPoliciesPath && (typeof customPoliciesPath === "string" || customPoliciesPath.length > 0)) {
     const incoming = (typeof customPoliciesPath === "string" ? [customPoliciesPath] : customPoliciesPath).map((path3) => resolve18(path3));
     const carried = (previousConfig.customPoliciesPaths ?? (previousConfig.customPoliciesPath ? [previousConfig.customPoliciesPath] : [])).map((path3) => resolve18(path3)).filter((path3) => {
-      if (existsSync21(path3))
+      if (existsSync22(path3))
         return true;
       console.log(`Dropping custom policies path (file no longer exists): ${path3}`);
       return false;
@@ -22344,7 +21581,7 @@ async function removeHooks(policyNames, scope = "user", cwd, opts) {
     const scopesToRemove = scope === "all" ? [...integration.scopes] : integration.scopes.includes(scope) ? [scope] : [];
     for (const s of scopesToRemove) {
       const settingsPaths = settingsPathsFor(integration, s, cwd);
-      const existing = settingsPaths.filter((p) => existsSync21(p));
+      const existing = settingsPaths.filter((p) => existsSync22(p));
       if (existing.length === 0) {
         if (scope !== "all" && selectedClis.length === 1) {
           console.log("No settings file found. Nothing to remove.");
@@ -22424,6 +21661,7 @@ var init_manager = __esm(() => {
   init_cli_error();
   init_hook_logger();
   init_fp_home();
+  init_cloud_managed_policies();
   VALID_POLICY_NAMES = new Set(BUILTIN_POLICIES.map((p) => p.name));
 });
 
@@ -22488,7 +21726,7 @@ var DEFAULT_FETCH_TIMEOUT_MS = 15000;
 
 // src/hooks/cloud-enrollment.ts
 import { randomUUID as randomUUID3 } from "node:crypto";
-import { existsSync as existsSync22, readFileSync as readFileSync18, rmSync as rmSync7 } from "node:fs";
+import { existsSync as existsSync23, readFileSync as readFileSync20, rmSync as rmSync8 } from "node:fs";
 import { hostname as hostname4 } from "node:os";
 function cloudCredentialPath() {
   return process.env.FAILPROOFAI_CLOUD_CREDENTIALS ?? credentialsFile();
@@ -22527,10 +21765,10 @@ function readCloudCredentials() {
   if (!usingJsonOverride())
     return readCredentials().cloud ?? null;
   const path3 = cloudCredentialPath();
-  if (!existsSync22(path3))
+  if (!existsSync23(path3))
     return null;
   try {
-    const raw = JSON.parse(readFileSync18(path3, "utf8"));
+    const raw = JSON.parse(readFileSync20(path3, "utf8"));
     if (raw.schemaVersion !== SCHEMA_VERSION2)
       return null;
     if (typeof raw.url !== "string" || typeof raw.machineId !== "string" || typeof raw.token !== "string") {
@@ -22566,10 +21804,10 @@ function resolveMachineLabel(explicit) {
 function clearCloudCredentials() {
   if (usingJsonOverride()) {
     const path3 = cloudCredentialPath();
-    if (!existsSync22(path3))
+    if (!existsSync23(path3))
       return false;
     try {
-      rmSync7(path3);
+      rmSync8(path3);
       return true;
     } catch {
       return false;
@@ -22610,7 +21848,7 @@ async function verifyCloudCredentials(creds) {
     return {
       ok: true,
       policyCount: Array.isArray(body.policies) ? body.policies.length : 0,
-      generation: typeof body.generation === "number" ? body.generation : 0
+      deployment: typeof body.deployment === "number" ? body.deployment : 0
     };
   } catch {
     return {
@@ -22735,7 +21973,7 @@ async function connectToCloud(input) {
     canIngest ? verifyIngest({ url: ingestUrl, key: input.token }) : Promise.resolve({ ok: false, reason: missing(PERMISSION_EVENTS) })
   ]);
   const outcome = {
-    policy: policyResult.ok ? { ok: true, policyCount: policyResult.policyCount, generation: policyResult.generation } : { ok: false, reason: policyResult.reason },
+    policy: policyResult.ok ? { ok: true, policyCount: policyResult.policyCount, deployment: policyResult.deployment } : { ok: false, reason: policyResult.reason },
     ingest: ingestResult.ok ? { ok: true } : { ok: false, reason: ingestResult.reason },
     anyConfigured: false,
     org: known ? { id: known.orgId, slug: known.orgSlug, name: known.orgName } : undefined
@@ -22773,14 +22011,14 @@ function describeOutcome(outcome, machineId, url) {
   if (outcome.policy.ok && outcome.ingest.ok) {
     lines.push(`Connected to ${url} as ${machineId}${into}.`);
     const n = outcome.policy.policyCount ?? 0;
-    lines.push(`  Policy    ${n} polic${n === 1 ? "y" : "ies"} assigned (generation ${outcome.policy.generation ?? 0}).`);
+    lines.push(`  Policy    ${n} polic${n === 1 ? "y" : "ies"} assigned (deployment ${outcome.policy.deployment ?? 0}).`);
     lines.push(`  Dashboard hook activity will be sent to ${ingestUrlFor(url)}.`);
     return lines;
   }
   if (outcome.policy.ok && !outcome.ingest.ok) {
     const n = outcome.policy.policyCount ?? 0;
     lines.push(`Connected to ${url} as ${machineId}${into}, for policy only.`);
-    lines.push(`  Policy    ${n} polic${n === 1 ? "y" : "ies"} assigned (generation ${outcome.policy.generation ?? 0}).`);
+    lines.push(`  Policy    ${n} polic${n === 1 ? "y" : "ies"} assigned (deployment ${outcome.policy.deployment ?? 0}).`);
     lines.push(`  Dashboard NOT configured: ${outcome.ingest.reason}`);
     lines.push("");
     lines.push("  Enforcement works. Nothing will appear in the dashboard until this");
@@ -22817,8 +22055,8 @@ var init_cloud_connection = __esm(() => {
 });
 
 // src/hooks/setup-state.ts
-import { existsSync as existsSync23, realpathSync as realpathSync2, statSync as statSync15 } from "node:fs";
-import { dirname as dirname11, resolve as resolve19 } from "node:path";
+import { existsSync as existsSync24, realpathSync as realpathSync2, statSync as statSync17 } from "node:fs";
+import { dirname as dirname12, resolve as resolve19 } from "node:path";
 import { homedir as homedir25 } from "node:os";
 function globalConfigPath(home = homedir25()) {
   return globalPolicyConfigFile(home);
@@ -22831,7 +22069,7 @@ function legacyMarkerPath(home) {
 }
 function isDir(path3) {
   try {
-    return statSync15(path3).isDirectory();
+    return statSync17(path3).isDirectory();
   } catch {
     return false;
   }
@@ -22842,7 +22080,7 @@ function findProjectRoot(start, home = homedir25()) {
   while (dir !== resolvedHome) {
     if (isDir(resolve19(dir, ".failproofai")))
       return dir;
-    const parent = dirname11(dir);
+    const parent = dirname12(dir);
     if (parent === dir)
       break;
     dir = parent;
@@ -22874,10 +22112,10 @@ function detectSetupState(cwd = process.cwd(), home = homedir25()) {
     cwd: resolvedCwd,
     home: resolvedHome,
     projectRoot,
-    hasGlobalConfig: existsSync23(globalConfigPath(resolvedHome)),
-    hasProjectConfig: projectRoot !== resolvedHome && existsSync23(projectConfigPath(projectRoot)),
+    hasGlobalConfig: existsSync24(globalConfigPath(resolvedHome)),
+    hasProjectConfig: projectRoot !== resolvedHome && existsSync24(projectConfigPath(projectRoot)),
     hasGlobalHooks: hasGlobalHooksInstalled(),
-    hasLegacyMarker: existsSync23(legacyMarkerPath(resolvedHome)),
+    hasLegacyMarker: existsSync24(legacyMarkerPath(resolvedHome)),
     inHomeDir: resolvedCwd === resolvedHome
   };
 }
@@ -22925,14 +22163,14 @@ var init_setup_state = __esm(() => {
 });
 
 // src/hooks/onboarding-attempt.ts
-import { existsSync as existsSync24, mkdirSync as mkdirSync14, readFileSync as readFileSync19, rmSync as rmSync8, writeFileSync as writeFileSync11 } from "node:fs";
-import { dirname as dirname12 } from "node:path";
+import { existsSync as existsSync25, mkdirSync as mkdirSync15, readFileSync as readFileSync21, rmSync as rmSync9, writeFileSync as writeFileSync13 } from "node:fs";
+import { dirname as dirname13 } from "node:path";
 function readOnboardingAttempt() {
   const path3 = onboardingAttemptFile();
-  if (!existsSync24(path3))
+  if (!existsSync25(path3))
     return null;
   try {
-    const raw = JSON.parse(readFileSync19(path3, "utf8"));
+    const raw = JSON.parse(readFileSync21(path3, "utf8"));
     if (raw.schemaVersion !== SCHEMA_VERSION3)
       return null;
     if (typeof raw.reason !== "string" || typeof raw.cliVersion !== "string")
@@ -22951,7 +22189,7 @@ function readOnboardingAttempt() {
 function recordOnboardingAttempt(reason, cliVersion, daemonStatus, now = Date.now()) {
   try {
     const path3 = onboardingAttemptFile();
-    mkdirSync14(dirname12(path3), { recursive: true });
+    mkdirSync15(dirname13(path3), { recursive: true });
     const record = {
       schemaVersion: SCHEMA_VERSION3,
       reason,
@@ -22959,12 +22197,12 @@ function recordOnboardingAttempt(reason, cliVersion, daemonStatus, now = Date.no
       daemonStatus,
       at: now
     };
-    writeFileSync11(path3, JSON.stringify(record, null, 2), "utf8");
+    writeFileSync13(path3, JSON.stringify(record, null, 2), "utf8");
   } catch {}
 }
 function clearOnboardingAttempt() {
   try {
-    rmSync8(onboardingAttemptFile(), { force: true });
+    rmSync9(onboardingAttemptFile(), { force: true });
   } catch {}
 }
 function blockerCleared(attempt, probe) {
@@ -22975,6 +22213,8 @@ function blockerCleared(attempt, probe) {
       return probe.daemonStatus() !== attempt.daemonStatus || probe.canElevate();
     case "cancelled":
       return probe.cliVersion !== attempt.cliVersion;
+    case "unsupported_platform":
+      return probe.cliVersion !== attempt.cliVersion;
     case "not_a_tty":
     case "running_as_sudo":
       return true;
@@ -22987,14 +22227,16 @@ function attemptHintLines(attempt) {
     needs_root: "it needs root to install the failproofaid service",
     daemon_failed: "the failproofaid service could not be started",
     cancelled: "it was cancelled",
+    unsupported_platform: "failproofaid does not run on this platform",
     not_a_tty: "there was no terminal to ask in",
     running_as_sudo: "it was run under sudo"
   };
   const detail = why[attempt.reason] ?? "it did not finish";
+  const action = attempt.reason === "unsupported_platform" ? "Check for a failproofai update — this platform may be supported by a newer release." : "Run `failproofai config` when you are ready.";
   return [
     ``,
     `[failproofai] Setup is not finished — ${detail}.`,
-    `              Run \`failproofai config\` when you are ready.`,
+    `              ${action}`,
     ``
   ];
 }
@@ -23004,7 +22246,7 @@ var init_onboarding_attempt = __esm(() => {
 });
 
 // src/hooks/onboarding-lock.ts
-import { mkdirSync as mkdirSync15, readFileSync as readFileSync20, rmSync as rmSync9, writeFileSync as writeFileSync12 } from "node:fs";
+import { mkdirSync as mkdirSync16, readFileSync as readFileSync22, rmSync as rmSync10, writeFileSync as writeFileSync14 } from "node:fs";
 import { homedir as homedir26 } from "node:os";
 function onboardingLockPath(home = homedir26()) {
   return onboardingLockFile(home);
@@ -23021,7 +22263,7 @@ function processAlive(pid) {
 }
 function readLock(path3) {
   try {
-    const parsed = JSON.parse(readFileSync20(path3, "utf8"));
+    const parsed = JSON.parse(readFileSync22(path3, "utf8"));
     if (typeof parsed.pid !== "number")
       return null;
     return { pid: parsed.pid, startedAt: Number(parsed.startedAt) || 0 };
@@ -23035,9 +22277,9 @@ function acquireOnboardingLock(home = homedir26()) {
     const held = readLock(path3);
     if (held && held.pid !== process.pid && processAlive(held.pid))
       return null;
-    mkdirSync15(stateDir(home), { recursive: true });
+    mkdirSync16(stateDir(home), { recursive: true });
     const body = { pid: process.pid, startedAt: Date.now() };
-    writeFileSync12(path3, JSON.stringify(body), "utf8");
+    writeFileSync14(path3, JSON.stringify(body), "utf8");
     let released = false;
     return {
       release() {
@@ -23047,7 +22289,7 @@ function acquireOnboardingLock(home = homedir26()) {
         try {
           const current = readLock(path3);
           if (!current || current.pid === process.pid)
-            rmSync9(path3, { force: true });
+            rmSync10(path3, { force: true });
         } catch {}
       }
     };
@@ -23060,7 +22302,7 @@ var init_onboarding_lock = __esm(() => {
 });
 
 // lib/claude-sessions.ts
-import { readdirSync as readdirSync14, statSync as statSync16, existsSync as existsSync26 } from "node:fs";
+import { readdirSync as readdirSync15, statSync as statSync18, existsSync as existsSync27 } from "node:fs";
 import { join as join28, basename as basename5 } from "node:path";
 function getClaudeProjectsRoot() {
   return getClaudeProjectsPath();
@@ -23069,7 +22311,7 @@ function listClaudeProjects() {
   const root = getClaudeProjectsRoot();
   let entries;
   try {
-    entries = readdirSync14(root, { withFileTypes: true });
+    entries = readdirSync15(root, { withFileTypes: true });
   } catch {
     return [];
   }
@@ -23083,7 +22325,7 @@ function listClaudeTranscripts(project) {
   const out = [];
   let entries;
   try {
-    entries = readdirSync14(project.path, { withFileTypes: true });
+    entries = readdirSync15(project.path, { withFileTypes: true });
   } catch {
     return out;
   }
@@ -23094,7 +22336,7 @@ function listClaudeTranscripts(project) {
         continue;
       const transcriptPath = join28(project.path, entry.name);
       try {
-        const s = statSync16(transcriptPath);
+        const s = statSync18(transcriptPath);
         out.push({
           projectName: project.name,
           cwd: project.cwd,
@@ -23107,11 +22349,11 @@ function listClaudeTranscripts(project) {
       } catch {}
     } else if (entry.isDirectory() && UUID_RE2.test(entry.name)) {
       const subDir = join28(project.path, entry.name, "subagents");
-      if (!existsSync26(subDir))
+      if (!existsSync27(subDir))
         continue;
       let subEntries;
       try {
-        subEntries = readdirSync14(subDir, { withFileTypes: true });
+        subEntries = readdirSync15(subDir, { withFileTypes: true });
       } catch {
         continue;
       }
@@ -23121,7 +22363,7 @@ function listClaudeTranscripts(project) {
         const agentId = sub.name.slice(0, -".jsonl".length);
         const transcriptPath = join28(subDir, sub.name);
         try {
-          const s = statSync16(transcriptPath);
+          const s = statSync18(transcriptPath);
           out.push({
             projectName: project.name,
             cwd: project.cwd,
@@ -23265,7 +22507,7 @@ var init_claude = __esm(() => {
 });
 
 // src/audit/cli-adapters/codex.ts
-import { statSync as statSync17 } from "node:fs";
+import { statSync as statSync19 } from "node:fs";
 async function listCodexTranscriptMetadata(opts = {}) {
   const projectFilter = opts.projects ? new Set(opts.projects) : null;
   const sinceMs = opts.sinceMs ?? 0;
@@ -23282,7 +22524,7 @@ async function listCodexTranscriptMetadata(opts = {}) {
         continue;
       let sizeBytes = 0;
       try {
-        sizeBytes = statSync17(s.path).size;
+        sizeBytes = statSync19(s.path).size;
       } catch {}
       if (!s.sessionId)
         continue;
@@ -23316,7 +22558,7 @@ var init_codex = __esm(() => {
 });
 
 // src/audit/cli-adapters/copilot.ts
-import { statSync as statSync18 } from "node:fs";
+import { statSync as statSync20 } from "node:fs";
 async function listCopilotTranscriptMetadata(opts = {}) {
   const projectFilter = opts.projects ? new Set(opts.projects) : null;
   const sinceMs = opts.sinceMs ?? 0;
@@ -23333,7 +22575,7 @@ async function listCopilotTranscriptMetadata(opts = {}) {
         continue;
       let sizeBytes = 0;
       try {
-        sizeBytes = statSync18(s.path).size;
+        sizeBytes = statSync20(s.path).size;
       } catch {}
       if (!s.sessionId)
         continue;
@@ -23367,7 +22609,7 @@ var init_copilot = __esm(() => {
 });
 
 // src/audit/cli-adapters/cursor.ts
-import { statSync as statSync19 } from "node:fs";
+import { statSync as statSync21 } from "node:fs";
 async function listCursorTranscriptMetadata(opts = {}) {
   const projectFilter = opts.projects ? new Set(opts.projects) : null;
   const sinceMs = opts.sinceMs ?? 0;
@@ -23384,7 +22626,7 @@ async function listCursorTranscriptMetadata(opts = {}) {
         continue;
       let sizeBytes = 0;
       try {
-        sizeBytes = statSync19(s.path).size;
+        sizeBytes = statSync21(s.path).size;
       } catch {}
       if (!s.sessionId)
         continue;
@@ -23630,7 +22872,7 @@ var init_opencode = __esm(() => {
 });
 
 // src/audit/cli-adapters/pi.ts
-import { statSync as statSync20 } from "node:fs";
+import { statSync as statSync22 } from "node:fs";
 async function listPiTranscriptMetadata(opts = {}) {
   const projectFilter = opts.projects ? new Set(opts.projects) : null;
   const sinceMs = opts.sinceMs ?? 0;
@@ -23647,7 +22889,7 @@ async function listPiTranscriptMetadata(opts = {}) {
         continue;
       let sizeBytes = 0;
       try {
-        sizeBytes = statSync20(s.path).size;
+        sizeBytes = statSync22(s.path).size;
       } catch {}
       if (!s.sessionId)
         continue;
@@ -24382,7 +23624,7 @@ var init_features = __esm(() => {
 
 // src/audit/cache.ts
 import { createHash as createHash6 } from "node:crypto";
-import { existsSync as existsSync27, mkdirSync as mkdirSync16, readFileSync as readFileSync21, writeFileSync as writeFileSync13, chmodSync as chmodSync4 } from "node:fs";
+import { existsSync as existsSync28, mkdirSync as mkdirSync17, readFileSync as readFileSync23, writeFileSync as writeFileSync15, chmodSync as chmodSync4 } from "node:fs";
 import { join as join29 } from "node:path";
 function getEngineVersion() {
   if (cachedEngineVersion)
@@ -24409,10 +23651,10 @@ function readCachedTranscriptResult(transcriptPath, mtimeMs, sizeBytes) {
   if (sizeBytes === 0)
     return null;
   const cachePath = getCachePathFor(transcriptPath);
-  if (!existsSync27(cachePath))
+  if (!existsSync28(cachePath))
     return null;
   try {
-    const raw = readFileSync21(cachePath, "utf-8");
+    const raw = readFileSync23(cachePath, "utf-8");
     const entry = JSON.parse(raw);
     if (entry.schemaVersion !== CACHE_SCHEMA_VERSION)
       return null;
@@ -24436,7 +23678,7 @@ function writeCachedTranscriptResult(transcriptPath, mtimeMs, sizeBytes, result)
     return;
   const cachePath = getCachePathFor(transcriptPath);
   try {
-    mkdirSync16(auditCacheDir(), { recursive: true });
+    mkdirSync17(auditCacheDir(), { recursive: true });
     const entry = {
       schemaVersion: CACHE_SCHEMA_VERSION,
       cachedAt: Date.now(),
@@ -24446,7 +23688,7 @@ function writeCachedTranscriptResult(transcriptPath, mtimeMs, sizeBytes, result)
       detectorVersion: getDetectorVersion(),
       result
     };
-    writeFileSync13(cachePath, JSON.stringify(entry), { encoding: "utf-8", mode: 384 });
+    writeFileSync15(cachePath, JSON.stringify(entry), { encoding: "utf-8", mode: 384 });
     try {
       chmodSync4(cachePath, 384);
     } catch {}
@@ -24812,11 +24054,11 @@ var init_audit = __esm(() => {
 import {
   closeSync,
   linkSync,
-  mkdirSync as mkdirSync17,
+  mkdirSync as mkdirSync18,
   openSync,
-  readFileSync as readFileSync22,
+  readFileSync as readFileSync24,
   unlinkSync as unlinkSync4,
-  writeFileSync as writeFileSync14,
+  writeFileSync as writeFileSync16,
   writeSync
 } from "node:fs";
 function acquireAuditLock(source, now = Date.now()) {
@@ -24875,7 +24117,7 @@ function handleFor(path3, info) {
 }
 function readLock2(path3) {
   try {
-    const parsed = JSON.parse(readFileSync22(path3, "utf8"));
+    const parsed = JSON.parse(readFileSync24(path3, "utf8"));
     if (typeof parsed?.pid !== "number" || typeof parsed?.startedAt !== "number")
       return null;
     return {
@@ -24891,7 +24133,7 @@ function writeLockExclusive(path3, info) {
   const body = JSON.stringify(info);
   const staging = `${path3}.${process.pid}.tmp`;
   try {
-    writeFileSync14(staging, body, { mode: 384 });
+    writeFileSync16(staging, body, { mode: 384 });
   } catch {
     return false;
   }
@@ -24925,8 +24167,8 @@ function createThenWrite(path3, body) {
   }
 }
 function ensureRunDir() {
-  mkdirSync17(failproofaiHome(), { recursive: true });
-  mkdirSync17(runDir(), { recursive: true, mode: 448 });
+  mkdirSync18(failproofaiHome(), { recursive: true });
+  mkdirSync18(runDir(), { recursive: true, mode: 448 });
 }
 var AUDIT_LOCK_MAX_AGE_MS;
 var init_audit_lock = __esm(() => {
@@ -25090,26 +24332,26 @@ function parseScriptArgs(argv) {
 var init_parse_script_args = () => {};
 
 // scripts/install-diagnosis.mjs
-import { existsSync as existsSync28, readFileSync as readFileSync23, realpathSync as realpathSync3 } from "node:fs";
-import { dirname as dirname13, resolve as resolve21 } from "node:path";
+import { existsSync as existsSync29, readFileSync as readFileSync25, realpathSync as realpathSync3 } from "node:fs";
+import { dirname as dirname14, resolve as resolve21 } from "node:path";
 import { homedir as homedir27, platform as platform4 } from "node:os";
 import { spawnSync } from "node:child_process";
 function findPackageRoot(start) {
   try {
     let dir = realpathSync3(start);
-    if (existsSync28(dir) && !existsSync28(resolve21(dir, "package.json"))) {
-      dir = dirname13(dir);
+    if (existsSync29(dir) && !existsSync29(resolve21(dir, "package.json"))) {
+      dir = dirname14(dir);
     }
     while (true) {
       const pkgPath = resolve21(dir, "package.json");
-      if (existsSync28(pkgPath)) {
+      if (existsSync29(pkgPath)) {
         try {
-          const pkg = JSON.parse(readFileSync23(pkgPath, "utf8"));
+          const pkg = JSON.parse(readFileSync25(pkgPath, "utf8"));
           if (pkg.name === PKG_NAME)
             return dir;
         } catch {}
       }
-      const parent = dirname13(dir);
+      const parent = dirname14(dir);
       if (parent === dir)
         return null;
       dir = parent;
@@ -25122,7 +24364,7 @@ function readPackageVersion(packageRoot) {
   if (!packageRoot)
     return null;
   try {
-    const pkg = JSON.parse(readFileSync23(resolve21(packageRoot, "package.json"), "utf8"));
+    const pkg = JSON.parse(readFileSync25(resolve21(packageRoot, "package.json"), "utf8"));
     return typeof pkg.version === "string" ? pkg.version : null;
   } catch {
     return null;
@@ -25149,7 +24391,7 @@ function locateNpmGlobal() {
     if (!root)
       return null;
     const candidate = resolve21(root, PKG_NAME);
-    return existsSync28(resolve21(candidate, "package.json")) ? candidate : null;
+    return existsSync29(resolve21(candidate, "package.json")) ? candidate : null;
   } catch {
     return null;
   }
@@ -25157,7 +24399,7 @@ function locateNpmGlobal() {
 function locateBunGlobal() {
   try {
     const candidate = resolve21(homedir27(), ".bun", "install", "global", "node_modules", PKG_NAME);
-    return existsSync28(resolve21(candidate, "package.json")) ? candidate : null;
+    return existsSync29(resolve21(candidate, "package.json")) ? candidate : null;
   } catch {
     return null;
   }
@@ -25264,8 +24506,8 @@ __export(exports_launch, {
   launch: () => launch
 });
 import { spawn as spawn2 } from "child_process";
-import { realpathSync as realpathSync4, existsSync as existsSync29 } from "node:fs";
-import { resolve as resolve22, dirname as dirname14 } from "node:path";
+import { realpathSync as realpathSync4, existsSync as existsSync30 } from "node:fs";
+import { resolve as resolve22, dirname as dirname15 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 import { createInterface } from "node:readline";
 function launch(mode) {
@@ -25289,9 +24531,9 @@ function launch(mode) {
     process.env.PORT = port;
     process.env.HOSTNAME = bindHost;
     cmd = "node";
-    const packageRoot = process.env.FAILPROOFAI_PACKAGE_ROOT ?? resolve22(dirname14(realpathSync4(fileURLToPath2(import.meta.url))), "..");
+    const packageRoot = process.env.FAILPROOFAI_PACKAGE_ROOT ?? resolve22(dirname15(realpathSync4(fileURLToPath2(import.meta.url))), "..");
     const serverJsPath = resolve22(packageRoot, ".next/standalone/server.js");
-    if (!existsSync29(serverJsPath)) {
+    if (!existsSync30(serverJsPath)) {
       let shadowMessage = null;
       try {
         const diag = diagnoseShadow({ selfPackageRoot: packageRoot, selfVersion: version2 });
@@ -25734,11 +24976,12 @@ __export(exports_configure_wizard, {
   clisSupportingScope: () => clisSupportingScope,
   classifyDaemonInstallFailure: () => classifyDaemonInstallFailure,
   buildPresetChoices: () => buildPresetChoices,
+  buildCompletionSummary: () => buildCompletionSummary,
   buildAgentChoices: () => buildAgentChoices
 });
-import { existsSync as existsSync30, mkdirSync as mkdirSync18, writeFileSync as writeFileSync15, readFileSync as readFileSync24 } from "node:fs";
+import { existsSync as existsSync31, mkdirSync as mkdirSync19, writeFileSync as writeFileSync17, readFileSync as readFileSync26 } from "node:fs";
 import { homedir as homedir28 } from "node:os";
-import { dirname as dirname15, resolve as resolve23, sep as sep5 } from "node:path";
+import { dirname as dirname16, resolve as resolve23, sep as sep5 } from "node:path";
 async function emit(event, props) {
   try {
     await trackHookEvent2(getInstanceId2(), event, props);
@@ -25845,8 +25088,8 @@ function setCustomPoliciesEnabled(scope, cwd, enabled) {
   const path3 = getConfigPathForScope(scope, cwd);
   let config = {};
   try {
-    if (existsSync30(path3))
-      config = JSON.parse(readFileSync24(path3, "utf8"));
+    if (existsSync31(path3))
+      config = JSON.parse(readFileSync26(path3, "utf8"));
   } catch {
     return;
   }
@@ -25855,7 +25098,7 @@ function setCustomPoliciesEnabled(scope, cwd, enabled) {
   else
     config.customPoliciesEnabled = false;
   try {
-    writeFileSync15(path3, JSON.stringify(config, null, 2) + `
+    writeFileSync17(path3, JSON.stringify(config, null, 2) + `
 `, "utf8");
   } catch {}
 }
@@ -25902,14 +25145,28 @@ function describeCustomPolicies(cwd) {
   }
   return { active, warnings, fileCount, scopes };
 }
+function buildCompletionSummary(policiesCount, harnessesCount, customEnabled, daemonInstalled, connected) {
+  const extras = [];
+  if (customEnabled === true)
+    extras.push("custom");
+  else if (customEnabled === false)
+    extras.push("custom off");
+  if (daemonInstalled)
+    extras.push("daemon");
+  if (connected)
+    extras.push("reporting");
+  const extrasNote = extras.length > 0 ? ` · ${extras.join(", ")}` : "";
+  const harnesses = `${harnessesCount} harness${harnessesCount === 1 ? "" : "es"}`;
+  return `Setup complete — ${policiesCount} policies · ${harnesses}${extrasNote}`;
+}
 function reviewLines(state) {
   const { target, clis, policies, cwd, customEnabled, installDaemon, connect } = state;
   const scopes = scopesFor(target);
   const where = target === "both" ? `Global, plus this project (${homeify2(cwd)})` : target === "project" ? `This project (${homeify2(cwd)})` : "Everywhere (global)";
   const lines = [];
-  const assistantNames = clis.map((c2) => getIntegration(c2).displayName);
+  const harnessNames = clis.map((c2) => getIntegration(c2).displayName);
   lines.push(`  Where      : ${where}`);
-  lines.push(`  Assistants : ${assistantNames.length ? summarize(assistantNames, "assistants") : "(none)"}`);
+  lines.push(`  Harnesses  : ${harnessNames.length ? summarize(harnessNames, "harnesses") : "(none)"}`);
   lines.push(policies.length === 0 ? "  Policies   : none enabled (add later: failproofai policies --install)" : `  Policies   : ${policies.length} enabled`);
   if (installDaemon && isDaemonSupportedPlatform()) {
     lines.push(`  Daemon     : failproofaid, installed as a system service running as you`);
@@ -25955,12 +25212,12 @@ function firstRunMarkerPath() {
   return launcherMarker();
 }
 function hasSeenLauncher() {
-  return existsSync30(firstRunMarkerPath());
+  return existsSync31(firstRunMarkerPath());
 }
 function markLauncherSeen() {
   try {
-    mkdirSync18(dirname15(firstRunMarkerPath()), { recursive: true });
-    writeFileSync15(firstRunMarkerPath(), "1", "utf8");
+    mkdirSync19(dirname16(firstRunMarkerPath()), { recursive: true });
+    writeFileSync17(firstRunMarkerPath(), "1", "utf8");
   } catch {}
 }
 function retryProbe() {
@@ -26053,7 +25310,20 @@ on its own.
     return { applied: false };
   }
   emit("configure_started", {});
-  intro("let's set up your safety net", stdout);
+  if (!isDaemonSupportedPlatform()) {
+    stdout.write(`failproofai requires failproofaid, its background policy daemon, which runs on
+` + `Linux and macOS only — not ${process.platform}. Setup cannot continue here: an
+installation with no daemon behind it would read as configured while enforcing
+nothing, which is worse than not being set up at all.
+
+Nothing was changed. This platform will be supported once failproofaid gains a
+${process.platform} service target.
+
+`);
+    emit("configure_aborted", { reason: "unsupported_platform" });
+    return { applied: false, abort: "unsupported_platform" };
+  }
+  intro("let's set up failproofai", stdout);
   const cancel = () => {
     outro("Cancelled — nothing was changed.", { ok: false }, stdout);
     return { applied: false, abort: "cancelled" };
@@ -26141,37 +25411,48 @@ refreshed. Re-run \`failproofai config\` once you can use sudo.
   const customEnabledBefore = readHooksConfig().customPoliciesEnabled !== false;
   const presetChoices = buildPresetChoices(cwd, customEnabledBefore);
   const hasCustomFiles = describeCustomPolicies(cwd).fileCount > 0;
-  const presets = await multiSelect({
-    message: "What should we guard against?",
-    choices: presetChoices,
-    summaryNoun: "bundles",
-    hint: "space toggles · combine presets · ↵ confirm · none is fine",
-    stdin,
-    stdout
-  });
-  if (presets === null)
-    return cancel();
-  const policies = resolvePresetSelection(presets);
-  const customEnabled = hasCustomFiles ? presets.includes(CUSTOM) : undefined;
-  const clisSel = await multiSelect({
-    message: "Which AI assistants should it protect?",
-    choices: [
-      {
-        label: "Everything available",
-        value: ALL_CLIS,
-        hint: `protect all ${clisSupportingScope(primaryScope).length} CLIs configurable here`,
-        summaryExclude: true
-      },
-      ...buildAgentChoices(primaryScope, cwd)
-    ],
-    minSelected: 1,
-    summaryNoun: "assistants",
-    hint: "detected CLIs are pre-selected · space toggles · ctrl+a all · ↵ confirm",
-    stdin,
-    stdout
-  });
-  if (clisSel === null)
-    return cancel();
+  let presets = null;
+  let clisSel = null;
+  while (clisSel === null) {
+    const priorPresets = presets;
+    presets = await multiSelect({
+      message: "What should we guard against?",
+      choices: priorPresets ? presetChoices.map((c2) => ({ ...c2, checked: priorPresets.includes(c2.value) })) : presetChoices,
+      summaryNoun: "bundles",
+      hint: "space toggles · combine presets · ↵ confirm · none is fine",
+      stdin,
+      stdout
+    });
+    if (presets === null)
+      return cancel();
+    const priorClis = clisSel;
+    const picked = await multiSelect({
+      message: "Which harnesses should it protect?",
+      choices: [
+        {
+          label: "Everything available",
+          value: ALL_CLIS,
+          hint: `protect all ${clisSupportingScope(primaryScope).length} CLIs configurable here`,
+          summaryExclude: true
+        },
+        ...buildAgentChoices(primaryScope, cwd)
+      ].map((c2) => priorClis ? { ...c2, checked: priorClis.includes(c2.value) } : c2),
+      minSelected: 1,
+      summaryNoun: "harnesses",
+      hint: "detected CLIs are pre-selected · space toggles · ctrl+a all · ← back · ↵ confirm",
+      allowBack: true,
+      stdin,
+      stdout
+    });
+    if (picked === null)
+      return cancel();
+    if (picked === BACK)
+      continue;
+    clisSel = picked;
+  }
+  const chosenPresets = presets ?? [];
+  const policies = resolvePresetSelection(chosenPresets);
+  const customEnabled = hasCustomFiles ? chosenPresets.includes(CUSTOM) : undefined;
   const supported = new Set(scopes.flatMap((s) => clisSupportingScope(s)));
   const clis = (clisSel.includes(ALL_CLIS) ? [...INTEGRATION_TYPES] : clisSel.filter((v) => v !== ALL_CLIS)).filter((id) => supported.has(id));
   let connect = null;
@@ -26184,15 +25465,15 @@ refreshed. Re-run \`failproofai config\` once you can use sudo.
         "  dashboard. Staying local sends nothing, anywhere, ever."
       ],
       choices: [
-        {
-          label: "Not now — stay local",
-          value: "local",
-          hint: "policies still enforce · connect later with failproofai config --connect"
-        },
         {
           label: "Paste an API key",
           value: "key",
           hint: "reports decisions and transcripts to your dashboard"
+        },
+        {
+          label: "Not now — stay local",
+          value: "local",
+          hint: "policies still enforce · connect later with failproofai config --connect"
         }
       ],
       stdin,
@@ -26406,7 +25687,7 @@ Hooks keep enforcing; scheduled audits stay off until it is.
     cli: clis,
     cli_count: clis.length,
     policy_count: policies.length,
-    source: presets.join("+"),
+    source: chosenPresets.join("+"),
     connected: connect !== null
   });
   for (const scope of scopes) {
@@ -26445,11 +25726,7 @@ Hooks keep enforcing; scheduled audits stay off until it is.
   await applied;
   markLauncherSeen();
   clearOnboardingAttempt();
-  const customNote = customEnabled === true ? " + your custom policies" : customEnabled === false ? " · custom policies DISABLED" : "";
-  const daemonNote = daemonInstalled ? " · daemon on" : "";
-  const cloudNote = connected ? " · reporting on" : "";
-  const assistants = `${clis.length} assistant${clis.length === 1 ? "" : "s"}`;
-  outro(`Setup complete — ${policies.length} policies${customNote} · ${assistants}${daemonNote}${cloudNote}`, { ok: true }, stdout);
+  outro(buildCompletionSummary(policies.length, clis.length, customEnabled, daemonInstalled, connected), { ok: true }, stdout);
   return {
     applied: true,
     target,
@@ -26484,6 +25761,121 @@ var init_configure_wizard = __esm(() => {
   init_onboarding_lock();
 });
 
+// src/hooks/flush-cli.ts
+var exports_flush_cli = {};
+__export(exports_flush_cli, {
+  runFlushCommand: () => runFlushCommand,
+  pendingBatches: () => pendingBatches,
+  flushRequestPath: () => flushRequestPath,
+  DEFAULT_FLUSH_TIMEOUT_SECS: () => DEFAULT_FLUSH_TIMEOUT_SECS
+});
+import { existsSync as existsSync32, mkdirSync as mkdirSync20, writeFileSync as writeFileSync18, readdirSync as readdirSync16 } from "node:fs";
+import { dirname as dirname17, join as join30 } from "node:path";
+function flushRequestPath(home) {
+  return join30(failproofaiHome(home), "state", "flush-request.json");
+}
+function spoolDirs(home) {
+  const root = spoolDir(home);
+  if (!existsSync32(root))
+    return [];
+  try {
+    return readdirSync16(root, { withFileTypes: true }).filter((e) => e.isDirectory() && e.name !== "failed").map((e) => join30(root, e.name));
+  } catch {
+    return [];
+  }
+}
+function pendingBatches(home) {
+  let n = 0;
+  for (const dir of spoolDirs(home)) {
+    try {
+      n += readdirSync16(dir).filter((f) => f.endsWith(".jsonl")).length;
+    } catch {}
+  }
+  return n;
+}
+async function runFlushCommand(opts = {}) {
+  const { home, wait = false } = opts;
+  const timeoutSecs = opts.timeoutSecs ?? DEFAULT_FLUSH_TIMEOUT_SECS;
+  const sleep = opts.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+  const lines = [];
+  const cfg = readConfig();
+  if (!cfg.collector?.hooks && !cfg.collector?.sessions) {
+    return {
+      exitCode: 1,
+      pending: 0,
+      lines: [
+        "Collection is off, so nothing is spooled to flush.",
+        "Turn it on with `failproofai config`."
+      ]
+    };
+  }
+  if (!readIngestCredential()) {
+    return {
+      exitCode: 1,
+      pending: 0,
+      lines: [
+        "This machine is not connected, so there is nowhere to flush to.",
+        "Connect it with `failproofai config`."
+      ]
+    };
+  }
+  if (!isDaemonSupportedPlatform()) {
+    return {
+      exitCode: 1,
+      pending: pendingBatches(home),
+      lines: [
+        `failproofaid does not run on ${process.platform}, and it is what delivers batches.`,
+        "Nothing would pick this request up, so nothing was written."
+      ]
+    };
+  }
+  const status = daemonServiceStatus();
+  if (status !== "running") {
+    return {
+      exitCode: 1,
+      pending: pendingBatches(home),
+      lines: [
+        `failproofaid is ${status}, and it is what delivers batches.`,
+        "Start it with `failproofai config`."
+      ]
+    };
+  }
+  const before = pendingBatches(home);
+  if (before === 0) {
+    return { exitCode: 0, pending: 0, lines: ["Nothing spooled — everything already delivered."] };
+  }
+  const path3 = flushRequestPath(home);
+  mkdirSync20(dirname17(path3), { recursive: true });
+  writeFileSync18(path3, `${JSON.stringify({ requestedAtMs: Date.now() }, null, 2)}
+`, {
+    mode: 384
+  });
+  lines.push(`${before} batch${before === 1 ? "" : "es"} spooled. Requested delivery.`);
+  if (!wait) {
+    lines.push("The daemon picks this up within a few seconds.");
+    return { exitCode: 0, pending: before, lines };
+  }
+  const deadline = Date.now() + timeoutSecs * 1000;
+  let pending3 = before;
+  while (Date.now() < deadline) {
+    await sleep(1000);
+    pending3 = pendingBatches(home);
+    if (pending3 === 0) {
+      lines.push("Spool drained.");
+      return { exitCode: 0, pending: 0, lines };
+    }
+  }
+  lines.push(`Still ${pending3} batch${pending3 === 1 ? "" : "es"} spooled after ${timeoutSecs}s.`, "Delivery continues in the background; re-run with a longer --timeout to keep watching.");
+  return { exitCode: 1, pending: pending3, lines };
+}
+var DEFAULT_FLUSH_TIMEOUT_SECS = 60;
+var init_flush_cli = __esm(() => {
+  init_fp_home();
+  init_fp_config();
+  init_collector_config();
+  init_daemon_service();
+});
+
 // src/hooks/backfill-cli.ts
 var exports_backfill_cli = {};
 __export(exports_backfill_cli, {
@@ -26491,16 +25883,16 @@ __export(exports_backfill_cli, {
   backfillRequestPath: () => backfillRequestPath,
   DEFAULT_BACKFILL_DAYS: () => DEFAULT_BACKFILL_DAYS
 });
-import { existsSync as existsSync31, mkdirSync as mkdirSync19, writeFileSync as writeFileSync16, readdirSync as readdirSync15, statSync as statSync21 } from "node:fs";
-import { dirname as dirname16, join as join30 } from "node:path";
+import { existsSync as existsSync33, mkdirSync as mkdirSync21, writeFileSync as writeFileSync19, readdirSync as readdirSync17, statSync as statSync23 } from "node:fs";
+import { dirname as dirname18, join as join31 } from "node:path";
 function backfillRequestPath(home) {
-  return join30(failproofaiHome(home), "state", "backfill-request.json");
+  return join31(failproofaiHome(home), "state", "backfill-request.json");
 }
 function surveySessions(sinceMs, homeDir) {
   const out = [];
   for (const { cli, dir } of SESSION_DIRS) {
-    const root = join30(homeDir, dir);
-    if (!existsSync31(root))
+    const root = join31(homeDir, dir);
+    if (!existsSync33(root))
       continue;
     let files = 0;
     let newest = 0;
@@ -26509,18 +25901,18 @@ function surveySessions(sinceMs, homeDir) {
         return;
       let entries;
       try {
-        entries = readdirSync15(d, { withFileTypes: true });
+        entries = readdirSync17(d, { withFileTypes: true });
       } catch {
         return;
       }
       for (const e of entries) {
-        const p = join30(d, e.name);
+        const p = join31(d, e.name);
         if (e.isDirectory()) {
           walk(p, depth + 1);
           continue;
         }
         try {
-          const st = statSync21(p);
+          const st = statSync23(p);
           if (st.mtimeMs >= sinceMs) {
             files += 1;
             newest = Math.max(newest, st.mtimeMs);
@@ -26538,7 +25930,7 @@ function runBackfillCommand(opts = {}) {
   const now = opts.now ?? Date.now();
   const sinceMs = opts.sinceMs ?? now - DEFAULT_BACKFILL_DAYS * 24 * 60 * 60 * 1000;
   const home = failproofaiHome();
-  if (!existsSync31(home)) {
+  if (!existsSync33(home)) {
     return {
       exitCode: 1,
       lines: [`No failproofai home at ${home}. Run \`failproofai config\` first.`]
@@ -26566,11 +25958,11 @@ function runBackfillCommand(opts = {}) {
       exitCode: 1,
       lines: [
         "Collection is switched off, so a backfill would re-read history and send",
-        "none of it. Enable it in ~/.failproofai/config.toml under [collector]."
+        'none of it. Enable it in ~/.failproofai/config.json under "collector".'
       ]
     };
   }
-  const found = surveySessions(sinceMs, dirname16(home));
+  const found = surveySessions(sinceMs, dirname18(home));
   const totalFiles = found.reduce((n, f) => n + f.files, 0);
   const sinceLabel = new Date(sinceMs).toISOString().slice(0, 10);
   const lines = [
@@ -26593,8 +25985,8 @@ function runBackfillCommand(opts = {}) {
   }
   try {
     const path3 = backfillRequestPath();
-    mkdirSync19(dirname16(path3), { recursive: true });
-    writeFileSync16(path3, `${JSON.stringify({ sinceMs, requestedAtMs: now }, null, 2)}
+    mkdirSync21(dirname18(path3), { recursive: true });
+    writeFileSync19(path3, `${JSON.stringify({ sinceMs, requestedAtMs: now }, null, 2)}
 `, {
       mode: 384
     });
@@ -26635,13 +26027,210 @@ var init_backfill_cli = __esm(() => {
   ];
 });
 
+// src/hooks/harness-cli.ts
+var exports_harness_cli = {};
+__export(exports_harness_cli, {
+  runHarnessCommand: () => runHarnessCommand,
+  removePath: () => removePath,
+  listPaths: () => listPaths,
+  addPath: () => addPath,
+  HARNESS_KEYS: () => HARNESS_KEYS
+});
+function unknownHarness(name) {
+  return fail([
+    `Unknown harness: ${name}`,
+    "",
+    `Known harnesses: ${HARNESS_KEYS.join(", ")}`
+  ]);
+}
+function pathOf(entry) {
+  const eq = entry.indexOf("=");
+  if (eq <= 0)
+    return entry.trim();
+  const label = entry.slice(0, eq).trim();
+  return label === "" ? entry.trim() : entry.slice(eq + 1).trim();
+}
+function labelOf(entry) {
+  const eq = entry.indexOf("=");
+  if (eq <= 0)
+    return null;
+  const label = entry.slice(0, eq).trim();
+  return label === "" ? null : label;
+}
+function currentPaths(harness) {
+  return readConfig().collector.sources?.[harness]?.extraPaths ?? [];
+}
+function writePaths(harness, paths) {
+  const cfg = readConfig();
+  const sources = { ...cfg.collector.sources ?? {} };
+  if (paths.length > 0)
+    sources[harness] = { extraPaths: paths };
+  else
+    delete sources[harness];
+  updateConfig({
+    collector: {
+      ...cfg.collector,
+      sources: Object.keys(sources).length > 0 ? sources : undefined
+    }
+  });
+}
+function addPath(harness, entry) {
+  if (!HARNESS_KEYS.includes(harness))
+    return unknownHarness(harness);
+  const trimmed = entry.trim();
+  if (trimmed === "")
+    return fail(["A path is required."]);
+  if (pathOf(trimmed) === "") {
+    return fail([`Could not read a path out of ${JSON.stringify(entry)}.`, "", "Use `<path>` or `<label>=<path>`."]);
+  }
+  const existing = currentPaths(harness);
+  if (existing.includes(trimmed)) {
+    return ok([`${harness}: ${trimmed} is already configured.`]);
+  }
+  const samePath = existing.find((e) => pathOf(e) === pathOf(trimmed));
+  if (samePath) {
+    return fail([
+      `${harness} already captures ${pathOf(trimmed)} as ${JSON.stringify(samePath)}.`,
+      "",
+      "Remove it first if you meant to relabel it:",
+      `  failproofai harness remove-path ${harness} ${pathOf(trimmed)}`
+    ]);
+  }
+  const wanted = labelOf(trimmed);
+  if (wanted) {
+    const sameLabel = existing.find((e) => labelOf(e) === wanted);
+    if (sameLabel) {
+      return fail([
+        `${harness} already uses the label ${JSON.stringify(wanted)} for ${pathOf(sameLabel)}.`,
+        "",
+        "Labels namespace agent ids, so two paths cannot share one."
+      ]);
+    }
+  }
+  writePaths(harness, [...existing, trimmed]);
+  return ok([
+    `${harness}: now also capturing ${pathOf(trimmed)}`,
+    wanted ? `  agent ids will be namespaced ${wanted}-*` : "  a label will be derived from the folder name; `failproofai harness list` shows it",
+    `  written to ${configFile()}`,
+    ...TAKES_EFFECT_HINT
+  ]);
+}
+function removePath(harness, target) {
+  if (!HARNESS_KEYS.includes(harness))
+    return unknownHarness(harness);
+  const existing = currentPaths(harness);
+  const t = target.trim();
+  const kept = existing.filter((e) => e !== t && pathOf(e) !== t && labelOf(e) !== t);
+  if (kept.length === existing.length) {
+    return fail([
+      `${harness} has no extra path matching ${JSON.stringify(t)}.`,
+      "",
+      existing.length > 0 ? `Configured: ${existing.join(", ")}` : `${harness} has no extra paths configured.`
+    ]);
+  }
+  writePaths(harness, kept);
+  return ok([
+    `${harness}: no longer capturing ${t}`,
+    "",
+    "Already-collected sessions from that path are NOT removed — they are on the",
+    "server. This only stops new ones.",
+    ...TAKES_EFFECT_HINT
+  ]);
+}
+function listPaths(harness) {
+  if (harness && !HARNESS_KEYS.includes(harness))
+    return unknownHarness(harness);
+  const sources = readConfig().collector.sources ?? {};
+  const names = harness ? [harness] : HARNESS_KEYS.filter((k) => sources[k]?.extraPaths?.length);
+  const unknown = Object.keys(sources).filter((k) => !HARNESS_KEYS.includes(k));
+  if (names.length === 0 && unknown.length === 0) {
+    return ok([
+      "No extra capture paths configured.",
+      "",
+      "Every harness is watching only its default location. Add one with:",
+      "  failproofai harness add-path <harness> [<label>=]<path>",
+      "",
+      `Harnesses: ${HARNESS_KEYS.join(", ")}`
+    ]);
+  }
+  const lines = [];
+  for (const name of names) {
+    const entries = sources[name]?.extraPaths ?? [];
+    if (entries.length === 0) {
+      if (harness)
+        lines.push(`${name}: no extra paths configured (default location only)`);
+      continue;
+    }
+    lines.push(`${name}:`);
+    for (const e of entries) {
+      const label = labelOf(e);
+      lines.push(label ? `  ${pathOf(e)}   → agent ids ${label}-*` : `  ${pathOf(e)}   → label derived from the folder name`);
+    }
+  }
+  if (unknown.length > 0) {
+    if (lines.length === 0)
+      lines.push("No extra capture paths configured for any known harness.");
+    lines.push("", `⚠ config.json configures ${unknown.length} unknown harness(es): ${unknown.join(", ")}`, "  Nothing is captured from them.", `  Known: ${HARNESS_KEYS.join(", ")}`);
+  }
+  return ok(lines);
+}
+function runHarnessCommand(argv) {
+  const [sub, ...rest] = argv;
+  switch (sub) {
+    case "add-path":
+      if (rest.length < 2) {
+        return fail(["Usage: failproofai harness add-path <harness> [<label>=]<path>"]);
+      }
+      return addPath(rest[0], rest.slice(1).join(" "));
+    case "remove-path":
+      if (rest.length < 2) {
+        return fail(["Usage: failproofai harness remove-path <harness> <path|label>"]);
+      }
+      return removePath(rest[0], rest.slice(1).join(" "));
+    case "list":
+      return listPaths(rest[0]);
+    default:
+      return fail([
+        sub ? `Unknown subcommand: ${sub}` : "A subcommand is required.",
+        "",
+        "Usage:",
+        "  failproofai harness list [<harness>]",
+        "  failproofai harness add-path <harness> [<label>=]<path>",
+        "  failproofai harness remove-path <harness> <path|label>"
+      ]);
+  }
+}
+var HARNESS_KEYS, ok = (lines) => ({ lines, exitCode: 0 }), fail = (lines) => ({ lines, exitCode: 1 }), TAKES_EFFECT_HINT;
+var init_harness_cli = __esm(() => {
+  init_fp_config();
+  init_fp_home();
+  HARNESS_KEYS = [
+    "claude",
+    "codex",
+    "copilot",
+    "openclaw",
+    "pi",
+    "factory",
+    "antigravity",
+    "cursor",
+    "goose",
+    "opencode",
+    "devin",
+    "hermes"
+  ];
+  TAKES_EFFECT_HINT = [
+    "",
+    "The daemon picks this up on its own within a few seconds — no restart, no sudo."
+  ];
+});
+
 // src/hooks/uninstall-cli.ts
 var exports_uninstall_cli = {};
 __export(exports_uninstall_cli, {
   serviceStateLabel: () => serviceStateLabel,
   runUninstallCommand: () => runUninstallCommand
 });
-import { existsSync as existsSync32, rmSync as rmSync10 } from "node:fs";
+import { existsSync as existsSync34, rmSync as rmSync11 } from "node:fs";
 function survey(cwd) {
   const clis = [];
   for (const id of listInstallableIds()) {
@@ -26662,9 +26251,9 @@ function survey(cwd) {
   return {
     clis,
     servicePath,
-    serviceInstalled: !!servicePath && existsSync32(servicePath),
+    serviceInstalled: !!servicePath && existsSync34(servicePath),
     daemonConfigured,
-    homeExists: existsSync32(failproofaiHome())
+    homeExists: existsSync34(failproofaiHome())
   };
 }
 async function runUninstallCommand(opts = {}) {
@@ -26731,7 +26320,7 @@ async function runUninstallCommand(opts = {}) {
         purged: false,
         lines: [
           ...lines,
-          `✗ could not update ${failproofaiHome()}/config.toml: ${err instanceof Error ? err.message : String(err)}`,
+          `✗ could not update ${failproofaiHome()}/config.json: ${err instanceof Error ? err.message : String(err)}`,
           ``,
           `Stopped before touching the service. Removing it while this machine still`,
           `requires it would deny every tool call. Fix the file's permissions and re-run.`
@@ -26754,7 +26343,7 @@ async function runUninstallCommand(opts = {}) {
   if (found.serviceInstalled) {
     try {
       await uninstallDaemonService();
-      if (found.servicePath && existsSync32(found.servicePath)) {
+      if (found.servicePath && existsSync34(found.servicePath)) {
         failures.push(`the service at ${found.servicePath} is still there (most often: no sudo). ` + `Remove it with the commands below.`);
       } else {
         lines.push(`✓ stopped and removed the daemon service`);
@@ -26765,7 +26354,7 @@ async function runUninstallCommand(opts = {}) {
   }
   if (opts.purge && found.homeExists) {
     try {
-      rmSync10(failproofaiHome(), { recursive: true, force: true });
+      rmSync11(failproofaiHome(), { recursive: true, force: true });
       purged = true;
       lines.push(`✓ deleted ${failproofaiHome()}`);
     } catch (err) {
@@ -26776,7 +26365,7 @@ async function runUninstallCommand(opts = {}) {
     lines.push(``, `Not everything could be removed:`);
     for (const f of failures)
       lines.push(`  ✗ ${f}`);
-    if (found.servicePath && existsSync32(found.servicePath)) {
+    if (found.servicePath && existsSync34(found.servicePath)) {
       lines.push(``, `To remove the service by hand:`, ...manualServiceRemoval(found.servicePath), ``, `(\`${daemonStatusCommand()}\` shows its current state.)`);
     }
     return { exitCode: 1, lines, planLines, purged };
@@ -26836,6 +26425,7 @@ __export(exports_tui, {
   CHECK_OFF: () => CHECK_OFF2,
   CARET: () => CARET2,
   BAR: () => BAR2,
+  BACK: () => BACK2,
   ANSI_RESET: () => ANSI_RESET2,
   ANSI_DIM: () => ANSI_DIM2,
   ANSI_BOLD: () => ANSI_BOLD2
@@ -26979,14 +26569,14 @@ function renderLaunchBanner2(version3, stdout = process.stdout) {
 }
 function outro2(message, opts = {}, stdout = process.stdout) {
   const c2 = paint2(colorsEnabled2(stdout));
-  const ok = opts.ok !== false;
+  const ok2 = opts.ok !== false;
   if (!stdout.isTTY) {
     stdout.write(message + `
 `);
     return;
   }
-  const end = ok ? c2.pink(BAR_END2) : c2.dim(BAR_END2);
-  const text = ok ? c2.pink(message) : c2.dim(message);
+  const end = ok2 ? c2.pink(BAR_END2) : c2.dim(BAR_END2);
+  const text = ok2 ? c2.pink(message) : c2.dim(message);
   writeLines2(stdout, [c2.dim(BAR2), `${end}  ${text}`]);
 }
 function repaint2(out, region, lines) {
@@ -27062,10 +26652,11 @@ function runPrompt2(p) {
     return lines;
   };
   const collapse = (result) => {
+    const summary = result === BACK2 ? "back" : p.summaryFor(result);
     repaint2(stdout, region, [
       c2.dim(BAR2),
       `${c2.dim(STEP_DONE2)}  ${p.message}`,
-      `${c2.dim(BAR2)}  ${c2.dim(p.summaryFor(result))}`
+      `${c2.dim(BAR2)}  ${c2.dim(summary)}`
     ]);
   };
   return new Promise((resolve24) => {
@@ -27091,6 +26682,8 @@ function runPrompt2(p) {
         return;
       if (key.ctrl && (key.name === "c" || key.name === "d") || key.name === "escape") {
         finish(null);
+      } else if (key.name === "left" && p.allowBack) {
+        finish(BACK2);
       } else if (key.name === "up") {
         cursor2 = cursor2 > 0 ? cursor2 - 1 : choices.length - 1;
         repaint2(stdout, region, build());
@@ -27134,7 +26727,8 @@ function selectOne2(opts) {
       const hint = choice.hint ? `  ${c2.dim(ellipsize2(choice.hint, budget))}` : "";
       return `${dot} ${label}${hint}`;
     },
-    footer: "↑/↓ navigate · enter to select · esc to cancel",
+    allowBack: opts.allowBack,
+    footer: opts.allowBack ? "↑/↓ navigate · enter to select · ← back · esc to cancel" : "↑/↓ navigate · enter to select · esc to cancel",
     onKey: (key, cursor2) => key.name === "return" ? { done: choices[cursor2].value } : undefined,
     summaryFor: (value) => value === null ? "cancelled" : choices.find((ch) => ch.value === value)?.label ?? String(value)
   });
@@ -27168,7 +26762,8 @@ function multiSelect2(opts) {
       return `${caret} ${box} ${label}${hint}`;
     },
     warnLine: () => warn ? c2.warn(`Select at least ${minSelected}.`) : null,
-    footer: opts.hint ?? "↑/↓ move · space select · ctrl+a all · enter confirm",
+    allowBack: opts.allowBack,
+    footer: opts.hint ?? (opts.allowBack ? "↑/↓ move · space select · ctrl+a all · ← back · enter confirm" : "↑/↓ move · space select · ctrl+a all · enter confirm"),
     onKey: (key, cursor2) => {
       if (key.name === "space") {
         if (choices[cursor2]?.locked)
@@ -27230,11 +26825,13 @@ function promptText2(opts) {
   return new Promise((resolve24) => {
     let value = "";
     const draw = (error) => {
+      const cols = stdout.columns || 80;
       const shown = opts.mask ? "•".repeat(value.length) : value;
       const hint = opts.hint ? `  ${c2.dim(opts.hint)}` : "";
+      const line = truncate2(`${c2.bold(opts.message)} ${shown}${hint}`, cols - 1);
       const err = error ? `
-  ${c2.warn(error)}` : "";
-      stdout.write(`\r\x1B[2K${c2.bold(opts.message)} ${shown}${hint}${err}`);
+  ${truncate2(c2.warn(error), cols - 3)}` : "";
+      stdout.write(`\r\x1B[2K${line}${err}`);
       if (err)
         stdout.write("\x1B[1A");
     };
@@ -27281,7 +26878,7 @@ function promptText2(opts) {
     stdin.on("keypress", onKey);
   });
 }
-var ESC2 = "\x1B", BAR2 = "│", BAR_END2 = "└", STEP_ACTIVE2 = "◆", STEP_DONE2 = "◇", RADIO_ON2 = "●", RADIO_OFF2 = "○", CHECK_ON2 = "◼", CHECK_OFF2 = "◻", CARET2 = "❯", FLOWER2 = "❋", HUES2, ANSI_RESET2, ANSI_BOLD2, ANSI_DIM2, LOGO_MIN_COLS2 = 22, TAGLINE2 = "end-to-end failure layer for ai agents", LOGO_GRID2, LOGO_TEAL2, LOGO_PINK2, WINDOW3 = 8;
+var ESC2 = "\x1B", BAR2 = "│", BAR_END2 = "└", STEP_ACTIVE2 = "◆", STEP_DONE2 = "◇", RADIO_ON2 = "●", RADIO_OFF2 = "○", CHECK_ON2 = "◼", CHECK_OFF2 = "◻", CARET2 = "❯", FLOWER2 = "❋", HUES2, ANSI_RESET2, ANSI_BOLD2, ANSI_DIM2, LOGO_MIN_COLS2 = 22, TAGLINE2 = "end-to-end failure layer for ai agents", LOGO_GRID2, LOGO_TEAL2, LOGO_PINK2, WINDOW3 = 8, BACK2;
 var init_tui2 = __esm(() => {
   HUES2 = {
     guide: { rgb: [102, 209, 181], basic: "36" },
@@ -27317,6 +26914,7 @@ var init_tui2 = __esm(() => {
   ];
   LOGO_TEAL2 = HUES2.guide.rgb;
   LOGO_PINK2 = HUES2.logoPink.rgb;
+  BACK2 = Symbol("failproofai.back");
 });
 
 // src/hooks/manager.ts
@@ -27329,7 +26927,7 @@ __export(exports_manager, {
   getSettingsPath: () => getSettingsPath2
 });
 import { execSync as execSync7 } from "node:child_process";
-import { existsSync as existsSync33 } from "node:fs";
+import { existsSync as existsSync35 } from "node:fs";
 import { resolve as resolve24, basename as basename6 } from "node:path";
 import { platform as platform5, arch as arch4, release as release3, hostname as hostname5 } from "node:os";
 function getSettingsPath2(scope, cwd) {
@@ -27440,7 +27038,7 @@ async function installHooksImpl2(policyNames, scope = "user", cwd, includeBeta =
   } else if (customPoliciesPath && (typeof customPoliciesPath === "string" || customPoliciesPath.length > 0)) {
     const incoming = (typeof customPoliciesPath === "string" ? [customPoliciesPath] : customPoliciesPath).map((path3) => resolve24(path3));
     const carried = (previousConfig.customPoliciesPaths ?? (previousConfig.customPoliciesPath ? [previousConfig.customPoliciesPath] : [])).map((path3) => resolve24(path3)).filter((path3) => {
-      if (existsSync33(path3))
+      if (existsSync35(path3))
         return true;
       console.log(`Dropping custom policies path (file no longer exists): ${path3}`);
       return false;
@@ -27632,7 +27230,7 @@ async function removeHooks2(policyNames, scope = "user", cwd, opts) {
     const scopesToRemove = scope === "all" ? [...integration.scopes] : integration.scopes.includes(scope) ? [scope] : [];
     for (const s of scopesToRemove) {
       const settingsPaths = settingsPathsFor(integration, s, cwd);
-      const existing = settingsPaths.filter((p) => existsSync33(p));
+      const existing = settingsPaths.filter((p) => existsSync35(p));
       if (existing.length === 0) {
         if (scope !== "all" && selectedClis.length === 1) {
           console.log("No settings file found. Nothing to remove.");
@@ -27833,7 +27431,7 @@ Failproof AI Hook Policies
     for (const path3 of explicitPaths) {
       const absPath = resolve24(findProjectConfigDir(cwd ?? process.cwd()), path3);
       console.log(`  ${absPath}`);
-      if (!existsSync33(absPath)) {
+      if (!existsSync35(absPath)) {
         console.log(`  \x1B[31m✗ File not found: ${absPath}\x1B[0m`);
         continue;
       }
@@ -27901,6 +27499,21 @@ Failproof AI Hook Policies
     }
     console.log();
   }
+  try {
+    const cloud = readActiveCloudManagedPolicies();
+    if (cloud.length > 0) {
+      const gen = cloud[0].deployment;
+      console.log(`
+  ── Cloud-managed — deployment ${gen} ─────────`);
+      const colWidth = Math.max(nameColWidth, ...cloud.map((c2) => c2.id.length + 2));
+      for (const artifact of cloud) {
+        const status = artifact.effect === "observe" ? "\x1B[33m◐ OBS\x1B[0m" : "\x1B[32m✓ ON\x1B[0m";
+        console.log(`  ${status}    ${artifact.id.padEnd(colWidth)}v${artifact.version}`);
+      }
+      console.log("\n  Managed from the dashboard — not switchable with `failproofai policies`.");
+      console.log();
+    }
+  } catch {}
   try {
     syncConventionPolicies(discovered.user, "user");
   } catch (err) {
@@ -27920,6 +27533,7 @@ var init_manager2 = __esm(() => {
   init_cli_error();
   init_hook_logger();
   init_fp_home();
+  init_cloud_managed_policies();
   VALID_POLICY_NAMES2 = new Set(BUILTIN_POLICIES.map((p) => p.name));
 });
 
@@ -28968,8 +28582,8 @@ __export(exports_launch2, {
   launch: () => launch2
 });
 import { spawn as spawn3 } from "child_process";
-import { realpathSync as realpathSync5, existsSync as existsSync34 } from "node:fs";
-import { resolve as resolve25, dirname as dirname17 } from "node:path";
+import { realpathSync as realpathSync5, existsSync as existsSync36 } from "node:fs";
+import { resolve as resolve25, dirname as dirname19 } from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 import { createInterface as createInterface2 } from "node:readline";
 function launch2(mode) {
@@ -28993,9 +28607,9 @@ function launch2(mode) {
     process.env.PORT = port;
     process.env.HOSTNAME = bindHost;
     cmd = "node";
-    const packageRoot = process.env.FAILPROOFAI_PACKAGE_ROOT ?? resolve25(dirname17(realpathSync5(fileURLToPath3(import.meta.url))), "..");
+    const packageRoot = process.env.FAILPROOFAI_PACKAGE_ROOT ?? resolve25(dirname19(realpathSync5(fileURLToPath3(import.meta.url))), "..");
     const serverJsPath = resolve25(packageRoot, ".next/standalone/server.js");
-    if (!existsSync34(serverJsPath)) {
+    if (!existsSync36(serverJsPath)) {
       let shadowMessage = null;
       try {
         const diag = diagnoseShadow({ selfPackageRoot: packageRoot, selfVersion: version2 });
@@ -29092,17 +28706,17 @@ var init_cli_error2 = __esm(() => {
 
 // bin/failproofai.mjs
 import { realpathSync as realpathSync6 } from "fs";
-import { dirname as dirname18, resolve as resolve26 } from "path";
+import { dirname as dirname20, resolve as resolve26 } from "path";
 import { fileURLToPath as fileURLToPath4 } from "url";
 // package.json
-var version = "1.0.0-beta.11";
+var version = "1.0.0-beta.13";
 
 // bin/failproofai.mjs
 if (!process.env.FAILPROOFAI_PACKAGE_ROOT) {
-  process.env.FAILPROOFAI_PACKAGE_ROOT = resolve26(dirname18(realpathSync6(fileURLToPath4(import.meta.url))), "..");
+  process.env.FAILPROOFAI_PACKAGE_ROOT = resolve26(dirname20(realpathSync6(fileURLToPath4(import.meta.url))), "..");
 }
 if (!process.env.FAILPROOFAI_DIST_PATH) {
-  process.env.FAILPROOFAI_DIST_PATH = resolve26(dirname18(realpathSync6(fileURLToPath4(import.meta.url))), "..", "dist");
+  process.env.FAILPROOFAI_DIST_PATH = resolve26(dirname20(realpathSync6(fileURLToPath4(import.meta.url))), "..", "dist");
 }
 var args = process.argv.slice(2);
 if (args[0] === "p")
@@ -29226,7 +28840,7 @@ if (hookIdx >= 0) {
   }
 }
 async function runCli() {
-  const SUBCOMMANDS = ["policies", "policy", "audit", "config", "uninstall", "backfill"];
+  const SUBCOMMANDS = ["policies", "policy", "audit", "config", "uninstall", "backfill", "flush", "harness"];
   if ((args.includes("--help") || args.includes("-h")) && !SUBCOMMANDS.includes(args[0])) {
     const extraArgs = args.filter((a) => a !== "--help" && a !== "-h");
     if (extraArgs.length > 0) {
@@ -29242,6 +28856,13 @@ USAGE
 COMMANDS
   (no args)                      Launch the policy dashboard
   config                         Interactive setup \u2014 pick scope, agents & policies
+    --connect <url> --token <key>  Connect to Failproof Cloud non-interactively
+    --machine-id <id>              Stable id for this machine
+    --machine-label <name>         Human-readable name in the dashboard
+    --no-transcripts               Report decisions only, never transcripts
+    --disconnect                   Stop pulling policy and sending activity
+    --status                       Show connection, daemon and pause state
+    --pause / --resume             Pause or resume enforcement
 
   policy add <name>              Enable a single policy (see \`policy --help\`)
   policy remove <name>           Disable a single policy
@@ -29268,10 +28889,30 @@ COMMANDS
 
   policies --help, -h            Show this help for the policies command
 
+  harness list                   Show extra capture paths per agent CLI
+  harness add-path <h> <path>    Also capture sessions from <path> for harness
+                                 <h>. Accepts \`<label>=<path>\`; the label
+                                 namespaces agent ids so two copies of one
+                                 project stay distinct.
+  harness remove-path <h> <p>    Stop capturing that path
+  harness --help, -h             Show this help for the harness command
+
   audit                          Audit your agent's behavior, then open the
                                  dashboard at http://localhost:8020/audit
   audit --help, -h               Show this help for the audit command
 
+  backfill                       Re-send history the collector already read past
+                                 \u2014 after clearing the dashboard, re-enrolling a
+                                 machine, or connecting later than the work
+    --since <when>                 How far back: 30d, 6m, or YYYY-MM-DD
+                                   (default: 30 days)
+    --dry-run                      Report what would be re-read, change nothing
+
+  flush                          Deliver everything already spooled, now,
+                                 instead of waiting for the next sweep
+    --wait                         Block until the spool drains (or --timeout)
+    --timeout <secs>               How long to wait with --wait (default: 60)
+
   uninstall                      Remove failproofai from this machine: hook
                                  entries from every agent CLI, and the daemon
                                  service. Run this BEFORE \`npm rm -g failproofai\`
@@ -29311,6 +28952,10 @@ EXAMPLES
   failproofai policies --uninstall --cli opencode
   failproofai policies --uninstall --cli pi
   failproofai policies --uninstall --custom
+  failproofai backfill --since 6m
+  failproofai backfill --dry-run
+  failproofai flush --wait
+  failproofai config --status
 
 LINKS
   \u2B50 Star us:      https://github.com/failproofai/failproofai
@@ -29332,8 +28977,8 @@ Run \`failproofai --help\` for usage.`);
   {
     const isHelpOrVersion = args.includes("--help") || args.includes("-h") || args.includes("--version") || args.includes("-v");
     if (args[0] === "audit" && args.includes("--scheduled")) {
-      const { layoutWarningForHook: layoutWarningForHook3 } = await Promise.resolve().then(() => (init_fp_reset2(), exports_fp_reset));
-      const warning = layoutWarningForHook3();
+      const { layoutBlockerForScheduledRun: layoutBlockerForScheduledRun2 } = await Promise.resolve().then(() => (init_fp_reset2(), exports_fp_reset));
+      const warning = layoutBlockerForScheduledRun2();
       if (warning) {
         console.error(warning);
         process.exit(1);
@@ -29359,6 +29004,68 @@ Run \`failproofai --help\` for usage.`);
       await maybeFirstRunConfigure2({}, { postSetupAudit: args[0] !== "audit", force: layoutWasReset });
     } catch {}
   }
+  if (args[0] === "flush") {
+    const subArgs = args.slice(1);
+    if (subArgs.includes("--help") || subArgs.includes("-h")) {
+      console.log(`
+failproofai flush \u2014 deliver what is already spooled, now
+
+USAGE
+  failproofai flush [--wait] [--timeout <secs>]
+
+WHY
+  The collector is unhurried on purpose: a batch is swept once it is older than
+  two minutes, at most 64 per pass, on a 60-second cadence. That pacing keeps a
+  backlog from stampeding the server, and it is exactly wrong when you are
+  standing at a dashboard waiting to see your own events \u2014 "not delivered yet"
+  and "not working" look identical from there.
+
+  This asks the daemon to make a pass right now, with no minimum age and no
+  per-pass cap. It re-sends nothing: only batches already spooled and not yet
+  delivered. For history the collector has already read past, use \`backfill\`.
+
+OPTIONS
+  --wait             Block until the spool drains, or --timeout elapses.
+  --timeout <secs>   How long --wait waits. Default: 60.
+`);
+      process.exit(0);
+    }
+    const KNOWN = new Set(["--wait", "--timeout"]);
+    const unknown = subArgs.find((a, i) => a.startsWith("-") && !KNOWN.has(a) && subArgs[i - 1] !== "--timeout");
+    if (unknown) {
+      throw new CliError3(`Unexpected argument: ${unknown}
+Run \`failproofai flush --help\` for usage.`);
+    }
+    let timeoutSecs;
+    const tIdx = subArgs.indexOf("--timeout");
+    if (tIdx >= 0) {
+      const raw = subArgs[tIdx + 1];
+      if (!raw || raw.startsWith("-"))
+        throw new CliError3("Missing value after --timeout.");
+      const n = Number(raw);
+      if (!Number.isFinite(n) || n <= 0) {
+        throw new CliError3(`Could not read --timeout ${raw}. Give a number of seconds.`);
+      }
+      timeoutSecs = n;
+    }
+    lastSubcommand = "flush";
+    const { runFlushCommand: runFlushCommand2 } = await Promise.resolve().then(() => (init_flush_cli(), exports_flush_cli));
+    const result = await runFlushCommand2({ wait: subArgs.includes("--wait"), timeoutSecs });
+    for (const line of result.lines) {
+      if (result.exitCode === 0)
+        console.log(line);
+      else
+        console.error(line);
+    }
+    await track("cli_flush", {
+      ok: result.exitCode === 0,
+      waited: subArgs.includes("--wait"),
+      pending: result.pending
+    });
+    lastSubcommand = null;
+    await exitAfterFlush(result.exitCode);
+    return;
+  }
   if (args[0] === "backfill") {
     const subArgs = args.slice(1);
     if (subArgs.includes("--help") || subArgs.includes("-h")) {
@@ -29426,6 +29133,71 @@ Run \`failproofai backfill --help\` for usage.`);
     await exitAfterFlush(result.exitCode);
     return;
   }
+  if (args[0] === "harness") {
+    const subArgs = args.slice(1);
+    if (subArgs.length === 0 || subArgs.includes("--help") || subArgs.includes("-h")) {
+      console.log(`
+failproofai harness \u2014 capture sessions from more than one location per agent CLI
+
+USAGE
+  failproofai harness list [<harness>]
+  failproofai harness add-path <harness> [<label>=]<path>
+  failproofai harness remove-path <harness> <path|label>
+
+WHY
+  Each agent CLI is watched wherever its own installer put it \u2014 ~/.claude/projects,
+  ~/.hermes/state.db, and so on. That misses every other arrangement: a second
+  profile, a mounted team share, a container's home beside the host's, an agent
+  an operator moved. Those hold real sessions and nothing collects them.
+
+THE LABEL
+  An entry is \`<path>\` or \`<label>=<path>\`. The label namespaces agent ids as
+  <label>-<agentId>, and it matters: two locations holding the same project
+  derive the SAME id (it comes from the cwd inside the transcript, identical in
+  both copies), so without a label they merge into one agent whose sessions
+  interleave from two machines' worth of history. Omit it and one is derived
+  from the folder name.
+
+HARNESSES
+  claude, codex, copilot, openclaw, pi, factory, antigravity, cursor,
+  goose, opencode, devin, hermes
+
+  \`claude\` covers subagent transcripts too \u2014 they live under the same root.
+
+NOTES
+  \u2022 Session collection must be on for any of this to be read; extra paths follow
+    [collector] in ~/.failproofai/config.toml like the default ones do.
+  \u2022 A path overlapping one already captured is REFUSED by the daemon at startup
+    rather than collected twice under two ids. It says so in the journal.
+  \u2022 Takes effect within seconds \u2014 the daemon re-reads config.toml on an interval
+    and cycles its collector. No restart, no sudo.
+
+EXAMPLES
+  failproofai harness add-path claude work=/srv/team/.claude/projects
+  failproofai harness add-path hermes prod=/srv/hermes-prod/state.db
+  failproofai harness add-path codex /mnt/other-home/.codex/sessions
+  failproofai harness list
+  failproofai harness remove-path claude work
+`.trimStart());
+      process.exit(0);
+    }
+    lastSubcommand = "harness";
+    const { runHarnessCommand: runHarnessCommand2 } = await Promise.resolve().then(() => (init_harness_cli(), exports_harness_cli));
+    const result = runHarnessCommand2(subArgs);
+    for (const line of result.lines) {
+      if (result.exitCode === 0)
+        console.log(line);
+      else
+        console.error(line);
+    }
+    await track("cli_harness", {
+      ok: result.exitCode === 0,
+      sub: ["list", "add-path", "remove-path"].includes(subArgs[0]) ? subArgs[0] : "unknown"
+    });
+    lastSubcommand = null;
+    await exitAfterFlush(result.exitCode);
+    return;
+  }
   if (args[0] === "uninstall") {
     const subArgs = args.slice(1);
     if (subArgs.includes("--help") || subArgs.includes("-h")) {
@@ -29836,7 +29608,7 @@ USAGE
 WHAT IT DOES
   Walks you through 4 quick steps and writes everything for you:
     1. Where      \u2014 global (all projects) or just this project
-    2. Assistants \u2014 which agent CLIs to protect (Claude, Codex, ...)
+    2. Harnesses  \u2014 which agent CLIs to protect (Claude, Codex, ...)
     3. Policies   \u2014 presets (combine any), Everything, or a custom pick
     4. Review     \u2014 confirms the exact files it will change, then applies
 
@@ -29845,7 +29617,13 @@ FAILPROOF CLOUD
                                     Connect this machine to Failproof Cloud
                                     [--no-transcripts] decisions only, no transcripts
   failproofai config --disconnect   Stop pulling policy and sending activity
-  failproofai config --status       Show connection and pause state
+  failproofai config --status       Show connection, daemon and pause state
+  failproofai config --pause [--session <id>]
+                                    Pause enforcement, time-boxed
+  failproofai config --resume [--all]
+                                    Resume enforcement
+
+    --machine-label <name>          Human-readable name in the dashboard
 
   One connection, two capabilities: this machine PULLS centrally-managed
   policies and SENDS what its hooks decided, so the dashboard shows the fleet