failproofai 1.0.0-beta.12 → 1.0.0-beta.14

package/.next/standalone/package.json

@@ -1,6 +1,6 @@
 {
   "name": "failproofai",
-  "version": "1.0.0-beta.12",
+  "version": "1.0.0-beta.14",
   "description": "The easiest way to manage policies that keep your AI agents reliable, on-task, and running autonomously — for Claude Code & the Agents SDK",
   "bin": {
     "failproofai": "./dist/cli.mjs",
@@ -101,12 +101,12 @@
     "html-to-image": "^1.11.13",
     "html2canvas": "^1.4.1",
     "posthog-node": "^5.47.7",
-    "smol-toml": "^1.7.1",
     "sql.js": "^1.14.1",
     "yaml": "^2.9.0"
   },
   "overrides": {
     "postcss": "8.5.23",
+    "nanoid": "3.3.17",
     "eslint-plugin-react-hooks": "7.0.1",
     "vite": "8.0.16",
     "undici": "7.29.0",
@@ -114,15 +114,15 @@
     "sharp": "0.35.0"
   },
   "optionalDependencies": {
-    "@failproofai/failproofaid-linux-x64": "1.0.0-beta.12",
-    "@failproofai/failproofaid-linux-arm64": "1.0.0-beta.12",
-    "@failproofai/failproofaid-darwin-x64": "1.0.0-beta.12",
-    "@failproofai/failproofaid-darwin-arm64": "1.0.0-beta.12"
+    "@failproofai/failproofaid-linux-x64": "1.0.0-beta.14",
+    "@failproofai/failproofaid-linux-arm64": "1.0.0-beta.14",
+    "@failproofai/failproofaid-darwin-x64": "1.0.0-beta.14",
+    "@failproofai/failproofaid-darwin-arm64": "1.0.0-beta.14"
   },
   "failproofaidBinaries": {
-    "linux-x64": "3a17bf65b24cc16cd907578cbb90158b5ec53f12fb133c3d4b37a02e3c41ff98",
-    "linux-arm64": "d341762677d7dbdcf03321d803d97b41ad12f4b903d766cf45b4d5258bf4ed93",
-    "darwin-x64": "d17e95386c51bcefbb845d67134c64e1a269cbb444beed1801e4181ab976ab23",
-    "darwin-arm64": "e8987ecfa755dedc3bc4470bde25a54838735a7a1cefa4b9c9225dd868503f44"
+    "linux-x64": "969fa920cb6e06a607d4a97bd17078519929b9b7cfd78e1bbf4ed6bd8d21e300",
+    "linux-arm64": "79caf004fced34e827e7566346fd5b47852e3e8a1fd4e41bb7ecd85e68d76e24",
+    "darwin-x64": "0b81018cb2a851c62f5b561d8027dee6897f34cebe32d695ce531c58b70aecf4",
+    "darwin-arm64": "eb91832ea41d569110cc58d15efa9e18151d5f13daa6aca2b968e72ab57dee41"
   }
 }

package/.next/standalone/server.js

@@ -9,7 +9,7 @@ const currentPort = parseInt(process.env.PORT, 10) || 3000
 const hostname = process.env.HOSTNAME || '0.0.0.0'
 
 let keepAliveTimeout = parseInt(process.env.KEEP_ALIVE_TIMEOUT, 10)
-const nextConfig = {"env":{"NEXT_PUBLIC_APP_VERSION":"1.0.0-beta.12"},"typescript":{"ignoreBuildErrors":false},"typedRoutes":false,"distDir":"./.next","cleanDistDir":true,"assetPrefix":"","cacheMaxMemorySize":52428800,"configOrigin":"next.config.ts","useFileSystemPublicRoutes":true,"generateEtags":true,"pageExtensions":["tsx","ts","jsx","js"],"poweredByHeader":true,"compress":true,"images":{"deviceSizes":[640,750,828,1080,1200,1920,2048,3840],"imageSizes":[32,48,64,96,128,256,384],"path":"/_next/image","loader":"default","loaderFile":"","domains":[],"disableStaticImages":false,"minimumCacheTTL":14400,"formats":["image/webp"],"maximumRedirects":3,"maximumResponseBody":50000000,"dangerouslyAllowLocalIP":false,"dangerouslyAllowSVG":false,"contentSecurityPolicy":"script-src 'none'; frame-src 'none'; sandbox;","contentDispositionType":"attachment","localPatterns":[{"pathname":"**","search":""}],"remotePatterns":[],"qualities":[75],"unoptimized":true,"customCacheHandler":false},"devIndicators":{"position":"bottom-left"},"onDemandEntries":{"maxInactiveAge":60000,"pagesBufferLength":5},"basePath":"","sassOptions":{},"trailingSlash":false,"i18n":null,"productionBrowserSourceMaps":false,"excludeDefaultMomentLocales":true,"reactProductionProfiling":false,"reactStrictMode":null,"reactMaxHeadersLength":6000,"httpAgentOptions":{"keepAlive":true},"logging":{"serverFunctions":true,"browserToTerminal":"warn"},"compiler":{},"expireTime":31536000,"staticPageGenerationTimeout":60,"output":"standalone","modularizeImports":{"@mui/icons-material":{"transform":"@mui/icons-material/{{member}}"},"lodash":{"transform":"lodash/{{member}}"}},"outputFileTracingRoot":"/home/runner/work/failproofai/failproofai","cacheComponents":false,"cacheLife":{"default":{"stale":300,"revalidate":900,"expire":4294967294},"seconds":{"stale":30,"revalidate":1,"expire":60},"minutes":{"stale":300,"revalidate":60,"expire":3600},"hours":{"stale":300,"revalidate":3600,"expire":86400},"days":{"stale":300,"revalidate":86400,"expire":604800},"weeks":{"stale":300,"revalidate":604800,"expire":2592000},"max":{"stale":300,"revalidate":2592000,"expire":31536000}},"cacheHandlers":{},"experimental":{"appNewScrollHandler":false,"useSkewCookie":false,"cssChunking":true,"multiZoneDraftMode":false,"appNavFailHandling":false,"prerenderEarlyExit":true,"serverMinification":true,"linkNoTouchStart":false,"caseSensitiveRoutes":false,"cachedNavigations":false,"partialFallbacks":false,"dynamicOnHover":false,"varyParams":false,"prefetchInlining":false,"preloadEntriesOnStart":true,"clientRouterFilter":true,"clientRouterFilterRedirects":false,"fetchCacheKeyPrefix":"","proxyPrefetch":"flexible","optimisticClientCache":true,"manualClientBasePath":false,"cpus":3,"memoryBasedWorkersCount":false,"imgOptConcurrency":null,"imgOptTimeoutInSeconds":7,"imgOptMaxInputPixels":268402689,"imgOptSequentialRead":null,"isrFlushToDisk":true,"workerThreads":false,"optimizeCss":false,"nextScriptWorkers":false,"scrollRestoration":false,"externalDir":false,"disableOptimizedLoading":false,"gzipSize":true,"craCompat":false,"esmExternals":true,"fullySpecified":false,"swcTraceProfiling":false,"forceSwcTransforms":false,"largePageDataBytes":128000,"typedEnv":false,"parallelServerCompiles":false,"parallelServerBuildTraces":false,"ppr":false,"authInterrupts":false,"webpackMemoryOptimizations":false,"optimizeServerReact":true,"strictRouteTypes":false,"useTypeScriptCli":false,"viewTransition":false,"removeUncaughtErrorAndRejectionListeners":false,"validateRSCRequestHeaders":false,"staleTimes":{"dynamic":0,"static":300},"reactDebugChannel":true,"serverComponentsHmrCache":true,"staticGenerationMaxConcurrency":8,"staticGenerationMinPagesPerWorker":25,"transitionIndicator":false,"gestureTransition":false,"inlineCss":false,"useCache":false,"globalNotFound":false,"browserDebugInfoInTerminal":"warn","lockDistDir":true,"proxyClientMaxBodySize":10485760,"hideLogsAfterAbort":false,"mcpServer":true,"turbopackFileSystemCacheForDev":true,"turbopackFileSystemCacheForBuild":false,"turbopackInferModuleSideEffects":true,"turbopackPluginRuntimeStrategy":"childProcesses","optimizePackageImports":["lucide-react","date-fns","lodash-es","ramda","antd","react-bootstrap","ahooks","@ant-design/icons","@headlessui/react","@headlessui-float/react","@heroicons/react/20/solid","@heroicons/react/24/solid","@heroicons/react/24/outline","@visx/visx","@tremor/react","rxjs","@mui/material","@mui/icons-material","recharts","react-use","effect","@effect/schema","@effect/platform","@effect/platform-node","@effect/platform-browser","@effect/platform-bun","@effect/sql","@effect/sql-mssql","@effect/sql-mysql2","@effect/sql-pg","@effect/sql-sqlite-node","@effect/sql-sqlite-bun","@effect/sql-sqlite-wasm","@effect/sql-sqlite-react-native","@effect/rpc","@effect/rpc-http","@effect/typeclass","@effect/experimental","@effect/opentelemetry","@material-ui/core","@material-ui/icons","@tabler/icons-react","mui-core","react-icons/ai","react-icons/bi","react-icons/bs","react-icons/cg","react-icons/ci","react-icons/di","react-icons/fa","react-icons/fa6","react-icons/fc","react-icons/fi","react-icons/gi","react-icons/go","react-icons/gr","react-icons/hi","react-icons/hi2","react-icons/im","react-icons/io","react-icons/io5","react-icons/lia","react-icons/lib","react-icons/lu","react-icons/md","react-icons/pi","react-icons/ri","react-icons/rx","react-icons/si","react-icons/sl","react-icons/tb","react-icons/tfi","react-icons/ti","react-icons/vsc","react-icons/wi"],"trustHostHeader":false,"isExperimentalCompile":false},"htmlLimitedBots":"[\\w-]+-Google|Google-[\\w-]+|Chrome-Lighthouse|Slurp|DuckDuckBot|baiduspider|yandex|sogou|bitlybot|tumblr|vkShare|quora link preview|redditbot|ia_archiver|Bingbot|BingPreview|applebot|facebookexternalhit|facebookcatalog|Twitterbot|LinkedInBot|Slackbot|Discordbot|WhatsApp|SkypeUriPreview|Yeti|googleweblight","bundlePagesRouterDependencies":false,"configFileName":"next.config.ts","outputFileTracingExcludes":{"*":["node_modules/@img/**","node_modules/sharp/**"]},"turbopack":{"root":"/home/runner/work/failproofai/failproofai"},"distDirRoot":".next"}
+const nextConfig = {"env":{"NEXT_PUBLIC_APP_VERSION":"1.0.0-beta.14"},"typescript":{"ignoreBuildErrors":false},"typedRoutes":false,"distDir":"./.next","cleanDistDir":true,"assetPrefix":"","cacheMaxMemorySize":52428800,"configOrigin":"next.config.ts","useFileSystemPublicRoutes":true,"generateEtags":true,"pageExtensions":["tsx","ts","jsx","js"],"poweredByHeader":true,"compress":true,"images":{"deviceSizes":[640,750,828,1080,1200,1920,2048,3840],"imageSizes":[32,48,64,96,128,256,384],"path":"/_next/image","loader":"default","loaderFile":"","domains":[],"disableStaticImages":false,"minimumCacheTTL":14400,"formats":["image/webp"],"maximumRedirects":3,"maximumResponseBody":50000000,"dangerouslyAllowLocalIP":false,"dangerouslyAllowSVG":false,"contentSecurityPolicy":"script-src 'none'; frame-src 'none'; sandbox;","contentDispositionType":"attachment","localPatterns":[{"pathname":"**","search":""}],"remotePatterns":[],"qualities":[75],"unoptimized":true,"customCacheHandler":false},"devIndicators":{"position":"bottom-left"},"onDemandEntries":{"maxInactiveAge":60000,"pagesBufferLength":5},"basePath":"","sassOptions":{},"trailingSlash":false,"i18n":null,"productionBrowserSourceMaps":false,"excludeDefaultMomentLocales":true,"reactProductionProfiling":false,"reactStrictMode":null,"reactMaxHeadersLength":6000,"httpAgentOptions":{"keepAlive":true},"logging":{"serverFunctions":true,"browserToTerminal":"warn"},"compiler":{},"expireTime":31536000,"staticPageGenerationTimeout":60,"output":"standalone","modularizeImports":{"@mui/icons-material":{"transform":"@mui/icons-material/{{member}}"},"lodash":{"transform":"lodash/{{member}}"}},"outputFileTracingRoot":"/home/runner/work/failproofai/failproofai","cacheComponents":false,"cacheLife":{"default":{"stale":300,"revalidate":900,"expire":4294967294},"seconds":{"stale":30,"revalidate":1,"expire":60},"minutes":{"stale":300,"revalidate":60,"expire":3600},"hours":{"stale":300,"revalidate":3600,"expire":86400},"days":{"stale":300,"revalidate":86400,"expire":604800},"weeks":{"stale":300,"revalidate":604800,"expire":2592000},"max":{"stale":300,"revalidate":2592000,"expire":31536000}},"cacheHandlers":{},"experimental":{"appNewScrollHandler":false,"useSkewCookie":false,"cssChunking":true,"multiZoneDraftMode":false,"appNavFailHandling":false,"prerenderEarlyExit":true,"serverMinification":true,"linkNoTouchStart":false,"caseSensitiveRoutes":false,"cachedNavigations":false,"partialFallbacks":false,"dynamicOnHover":false,"varyParams":false,"prefetchInlining":false,"preloadEntriesOnStart":true,"clientRouterFilter":true,"clientRouterFilterRedirects":false,"fetchCacheKeyPrefix":"","proxyPrefetch":"flexible","optimisticClientCache":true,"manualClientBasePath":false,"cpus":3,"memoryBasedWorkersCount":false,"imgOptConcurrency":null,"imgOptTimeoutInSeconds":7,"imgOptMaxInputPixels":268402689,"imgOptSequentialRead":null,"isrFlushToDisk":true,"workerThreads":false,"optimizeCss":false,"nextScriptWorkers":false,"scrollRestoration":false,"externalDir":false,"disableOptimizedLoading":false,"gzipSize":true,"craCompat":false,"esmExternals":true,"fullySpecified":false,"swcTraceProfiling":false,"forceSwcTransforms":false,"largePageDataBytes":128000,"typedEnv":false,"parallelServerCompiles":false,"parallelServerBuildTraces":false,"ppr":false,"authInterrupts":false,"webpackMemoryOptimizations":false,"optimizeServerReact":true,"strictRouteTypes":false,"useTypeScriptCli":false,"viewTransition":false,"removeUncaughtErrorAndRejectionListeners":false,"validateRSCRequestHeaders":false,"staleTimes":{"dynamic":0,"static":300},"reactDebugChannel":true,"serverComponentsHmrCache":true,"staticGenerationMaxConcurrency":8,"staticGenerationMinPagesPerWorker":25,"transitionIndicator":false,"gestureTransition":false,"inlineCss":false,"useCache":false,"globalNotFound":false,"browserDebugInfoInTerminal":"warn","lockDistDir":true,"proxyClientMaxBodySize":10485760,"hideLogsAfterAbort":false,"mcpServer":true,"turbopackFileSystemCacheForDev":true,"turbopackFileSystemCacheForBuild":false,"turbopackInferModuleSideEffects":true,"turbopackPluginRuntimeStrategy":"childProcesses","optimizePackageImports":["lucide-react","date-fns","lodash-es","ramda","antd","react-bootstrap","ahooks","@ant-design/icons","@headlessui/react","@headlessui-float/react","@heroicons/react/20/solid","@heroicons/react/24/solid","@heroicons/react/24/outline","@visx/visx","@tremor/react","rxjs","@mui/material","@mui/icons-material","recharts","react-use","effect","@effect/schema","@effect/platform","@effect/platform-node","@effect/platform-browser","@effect/platform-bun","@effect/sql","@effect/sql-mssql","@effect/sql-mysql2","@effect/sql-pg","@effect/sql-sqlite-node","@effect/sql-sqlite-bun","@effect/sql-sqlite-wasm","@effect/sql-sqlite-react-native","@effect/rpc","@effect/rpc-http","@effect/typeclass","@effect/experimental","@effect/opentelemetry","@material-ui/core","@material-ui/icons","@tabler/icons-react","mui-core","react-icons/ai","react-icons/bi","react-icons/bs","react-icons/cg","react-icons/ci","react-icons/di","react-icons/fa","react-icons/fa6","react-icons/fc","react-icons/fi","react-icons/gi","react-icons/go","react-icons/gr","react-icons/hi","react-icons/hi2","react-icons/im","react-icons/io","react-icons/io5","react-icons/lia","react-icons/lib","react-icons/lu","react-icons/md","react-icons/pi","react-icons/ri","react-icons/rx","react-icons/si","react-icons/sl","react-icons/tb","react-icons/tfi","react-icons/ti","react-icons/vsc","react-icons/wi"],"trustHostHeader":false,"isExperimentalCompile":false},"htmlLimitedBots":"[\\w-]+-Google|Google-[\\w-]+|Chrome-Lighthouse|Slurp|DuckDuckBot|baiduspider|yandex|sogou|bitlybot|tumblr|vkShare|quora link preview|redditbot|ia_archiver|Bingbot|BingPreview|applebot|facebookexternalhit|facebookcatalog|Twitterbot|LinkedInBot|Slackbot|Discordbot|WhatsApp|SkypeUriPreview|Yeti|googleweblight","bundlePagesRouterDependencies":false,"configFileName":"next.config.ts","outputFileTracingExcludes":{"*":["node_modules/@img/**","node_modules/sharp/**"]},"turbopack":{"root":"/home/runner/work/failproofai/failproofai"},"distDirRoot":".next"}
 
 process.env.__NEXT_PRIVATE_STANDALONE_CONFIG = JSON.stringify(nextConfig)
 

package/bin/failproofai.mjs

@@ -271,7 +271,7 @@ if (hookIdx >= 0) {
  */
 async function runCli() {
   // --help / -h  (only when not inside a subcommand that handles its own --help)
-  const SUBCOMMANDS = ["policies", "policy", "audit", "config", "uninstall", "backfill"];
+  const SUBCOMMANDS = ["policies", "policy", "audit", "config", "uninstall", "backfill", "flush", "harness"];
   if ((args.includes("--help") || args.includes("-h")) && !SUBCOMMANDS.includes(args[0])) {
     const extraArgs = args.filter((a) => a !== "--help" && a !== "-h");
     if (extraArgs.length > 0) {
@@ -286,6 +286,13 @@ USAGE
 COMMANDS
   (no args)                      Launch the policy dashboard
   config                         Interactive setup — pick scope, agents & policies
+    --connect <url> --token <key>  Connect to Failproof Cloud non-interactively
+    --machine-id <id>              Stable id for this machine
+    --machine-label <name>         Human-readable name in the dashboard
+    --no-transcripts               Report decisions only, never transcripts
+    --disconnect                   Stop pulling policy and sending activity
+    --status                       Show connection, daemon and pause state
+    --pause / --resume             Pause or resume enforcement
 
   policy add <name>              Enable a single policy (see \`policy --help\`)
   policy remove <name>           Disable a single policy
@@ -312,10 +319,50 @@ COMMANDS
 
   policies --help, -h            Show this help for the policies command
 
+  harness list                   Show extra capture paths per agent CLI
+  harness add-path <h> <path>    Also capture sessions from <path> for harness
+                                 <h>. Accepts \`<label>=<path>\`; the label
+                                 namespaces agent ids so two copies of one
+                                 project stay distinct.
+  harness remove-path <h> <p>    Stop capturing that path
+  harness --help, -h             Show this help for the harness command
+
+    Each agent CLI is watched wherever its own installer put it. Extra paths add
+    the places it did not: a second profile, a team share, a per-user home.
+
+    failproofai harness add-path openclaw user1=/srv/.openclaw-user1
+    failproofai harness add-path openclaw user2=/srv/.openclaw-user2
+    failproofai harness add-path hermes   user1=/srv/.hermes-user1/state.db
+
+    LABEL PER-USER PATHS EXPLICITLY. An agent id comes from the cwd recorded
+    inside the transcript, identical in every copy of a project, so unlabelled
+    paths merge two people into one agent whose sessions interleave. Omitting the
+    label derives one from the folder name — fine for .openclaw-user1, but
+    /home/u1/.openclaw and /home/u2/.openclaw both derive "openclaw" and the
+    second is refused. A path overlapping one already captured is refused too.
+
+    FAILPROOFAI_<HARNESS>_EXTRA_PATHS overrides the file for containers:
+      FAILPROOFAI_OPENCLAW_EXTRA_PATHS="user1=/srv/.openclaw-user1,user2=/srv/.openclaw-user2"
+
+    Written to ~/.failproofai/config.json; the daemon picks it up in seconds —
+    no restart, no sudo. Session collection must be on for any of it to be read.
+
   audit                          Audit your agent's behavior, then open the
                                  dashboard at http://localhost:8020/audit
   audit --help, -h               Show this help for the audit command
 
+  backfill                       Re-send history the collector already read past
+                                 — after clearing the dashboard, re-enrolling a
+                                 machine, or connecting later than the work
+    --since <when>                 How far back: 30d, 6m, or YYYY-MM-DD
+                                   (default: 30 days)
+    --dry-run                      Report what would be re-read, change nothing
+
+  flush                          Deliver everything already spooled, now,
+                                 instead of waiting for the next sweep
+    --wait                         Block until the spool drains (or --timeout)
+    --timeout <secs>               How long to wait with --wait (default: 60)
+
   uninstall                      Remove failproofai from this machine: hook
                                  entries from every agent CLI, and the daemon
                                  service. Run this BEFORE \`npm rm -g failproofai\`
@@ -355,6 +402,10 @@ EXAMPLES
   failproofai policies --uninstall --cli opencode
   failproofai policies --uninstall --cli pi
   failproofai policies --uninstall --custom
+  failproofai backfill --since 6m
+  failproofai backfill --dry-run
+  failproofai flush --wait
+  failproofai config --status
 
 LINKS
   ⭐ Star us:      https://github.com/failproofai/failproofai
@@ -419,8 +470,12 @@ LINKS
     const isHelpOrVersion =
       args.includes("--help") || args.includes("-h") || args.includes("--version") || args.includes("-v");
     if (args[0] === "audit" && args.includes("--scheduled")) {
-      const { layoutWarningForHook } = await import("../src/hooks/fp-reset");
-      const warning = layoutWarningForHook();
+      // NOT `layoutWarningForHook` — that one answers the hook's question
+      // ("are policies unenforced?") and deliberately stays quiet when the
+      // global config is readable. This gate is about the LAYOUT, and must
+      // fire whenever completing the run would reset the home.
+      const { layoutBlockerForScheduledRun } = await import("../src/hooks/fp-reset");
+      const warning = layoutBlockerForScheduledRun();
       if (warning) {
         // Exit 1, not 75: 75 means "another audit holds the lock" and is retried
         // in fifteen minutes, which here would just re-warn four times an hour
@@ -487,6 +542,72 @@ LINKS
   // over. Every precondition a person can get wrong is still checked HERE,
   // synchronously, because reporting success and leaving the real failure in the
   // journal is what already cost twenty minutes on a live machine.
+  if (args[0] === "flush") {
+    const subArgs = args.slice(1);
+    if (subArgs.includes("--help") || subArgs.includes("-h")) {
+      console.log(`
+failproofai flush — deliver what is already spooled, now
+
+USAGE
+  failproofai flush [--wait] [--timeout <secs>]
+
+WHY
+  The collector is unhurried on purpose: a batch is swept once it is older than
+  two minutes, at most 64 per pass, on a 60-second cadence. That pacing keeps a
+  backlog from stampeding the server, and it is exactly wrong when you are
+  standing at a dashboard waiting to see your own events — "not delivered yet"
+  and "not working" look identical from there.
+
+  This asks the daemon to make a pass right now, with no minimum age and no
+  per-pass cap. It re-sends nothing: only batches already spooled and not yet
+  delivered. For history the collector has already read past, use \`backfill\`.
+
+OPTIONS
+  --wait             Block until the spool drains, or --timeout elapses.
+  --timeout <secs>   How long --wait waits. Default: 60.
+`);
+      process.exit(0);
+    }
+
+    const KNOWN = new Set(["--wait", "--timeout"]);
+    const unknown = subArgs.find(
+      (a, i) => a.startsWith("-") && !KNOWN.has(a) && subArgs[i - 1] !== "--timeout",
+    );
+    if (unknown) {
+      throw new CliError(`Unexpected argument: ${unknown}\nRun \`failproofai flush --help\` for usage.`);
+    }
+
+    let timeoutSecs;
+    const tIdx = subArgs.indexOf("--timeout");
+    if (tIdx >= 0) {
+      const raw = subArgs[tIdx + 1];
+      if (!raw || raw.startsWith("-")) throw new CliError("Missing value after --timeout.");
+      const n = Number(raw);
+      // Rejected rather than coerced: NaN would silently become "wait forever
+      // or not at all" depending on the comparison, and neither is what was asked.
+      if (!Number.isFinite(n) || n <= 0) {
+        throw new CliError(`Could not read --timeout ${raw}. Give a number of seconds.`);
+      }
+      timeoutSecs = n;
+    }
+
+    lastSubcommand = "flush";
+    const { runFlushCommand } = await import("../src/hooks/flush-cli");
+    const result = await runFlushCommand({ wait: subArgs.includes("--wait"), timeoutSecs });
+    for (const line of result.lines) {
+      if (result.exitCode === 0) console.log(line);
+      else console.error(line);
+    }
+    await track("cli_flush", {
+      ok: result.exitCode === 0,
+      waited: subArgs.includes("--wait"),
+      pending: result.pending,
+    });
+    lastSubcommand = null;
+    await exitAfterFlush(result.exitCode);
+    return;
+  }
+
   if (args[0] === "backfill") {
     const subArgs = args.slice(1);
     if (subArgs.includes("--help") || subArgs.includes("-h")) {
@@ -557,6 +678,84 @@ OPTIONS
     return;
   }
 
+  // harness list | add-path | remove-path
+  //
+  // Extra capture paths per harness. Writes ~/.failproofai/config.toml and
+  // nothing else — no root, no daemon call — so it works on a machine whose
+  // daemon is stopped, which is when someone is most likely to be fixing what
+  // it captures.
+  if (args[0] === "harness") {
+    const subArgs = args.slice(1);
+    if (subArgs.length === 0 || subArgs.includes("--help") || subArgs.includes("-h")) {
+      console.log(`
+failproofai harness — capture sessions from more than one location per agent CLI
+
+USAGE
+  failproofai harness list [<harness>]
+  failproofai harness add-path <harness> [<label>=]<path>
+  failproofai harness remove-path <harness> <path|label>
+
+WHY
+  Each agent CLI is watched wherever its own installer put it — ~/.claude/projects,
+  ~/.hermes/state.db, and so on. That misses every other arrangement: a second
+  profile, a mounted team share, a container's home beside the host's, an agent
+  an operator moved. Those hold real sessions and nothing collects them.
+
+THE LABEL
+  An entry is \`<path>\` or \`<label>=<path>\`. The label namespaces agent ids as
+  <label>-<agentId>, and it matters: two locations holding the same project
+  derive the SAME id (it comes from the cwd inside the transcript, identical in
+  both copies), so without a label they merge into one agent whose sessions
+  interleave from two machines' worth of history. Omit it and one is derived
+  from the folder name.
+
+HARNESSES
+  claude, codex, copilot, openclaw, pi, factory, antigravity, cursor,
+  goose, opencode, devin, hermes
+
+  \`claude\` covers subagent transcripts too — they live under the same root.
+
+NOTES
+  • Session collection must be on for any of this to be read; extra paths live
+    under "collector" in ~/.failproofai/config.json like the default ones do.
+  • A path overlapping one already captured is REFUSED by the daemon at startup
+    rather than collected twice under two ids. It says so in the journal.
+  • Two entries sharing a LABEL are refused too: they would share one cursor
+    directory, whose whole map is written at once, so each would clobber the
+    other's watermark and re-read from zero after every restart.
+  • Takes effect within seconds — the daemon re-reads config.json on an interval
+    and cycles its collector. No restart, no sudo.
+
+EXAMPLES
+  failproofai harness add-path claude work=/srv/team/.claude/projects
+  failproofai harness add-path hermes prod=/srv/hermes-prod/state.db
+  failproofai harness add-path codex /mnt/other-home/.codex/sessions
+  failproofai harness list
+  failproofai harness remove-path claude work
+
+`.trimStart());
+      process.exit(0);
+    }
+
+    lastSubcommand = "harness";
+    const { runHarnessCommand } = await import("../src/hooks/harness-cli");
+    const result = runHarnessCommand(subArgs);
+    for (const line of result.lines) {
+      if (result.exitCode === 0) console.log(line);
+      else console.error(line);
+    }
+    await track("cli_harness", {
+      ok: result.exitCode === 0,
+      // The subcommand only — never the harness name, the label or the path.
+      // A path is a value the user typed, and `enterprise-docs/product-analytics.md`
+      // promises we send shape, never value.
+      sub: ["list", "add-path", "remove-path"].includes(subArgs[0]) ? subArgs[0] : "unknown",
+    });
+    lastSubcommand = null;
+    await exitAfterFlush(result.exitCode);
+    return;
+  }
+
   // uninstall [--purge] [--dry-run] [--yes|-y]
   //
   // Top-level, and deliberately NOT a flag on `policies`. `policies --uninstall`
@@ -1115,7 +1314,7 @@ USAGE
 WHAT IT DOES
   Walks you through 4 quick steps and writes everything for you:
     1. Where      — global (all projects) or just this project
-    2. Assistants — which agent CLIs to protect (Claude, Codex, ...)
+    2. Harnesses  — which agent CLIs to protect (Claude, Codex, ...)
     3. Policies   — presets (combine any), Everything, or a custom pick
     4. Review     — confirms the exact files it will change, then applies
 
@@ -1124,7 +1323,13 @@ FAILPROOF CLOUD
                                     Connect this machine to Failproof Cloud
                                     [--no-transcripts] decisions only, no transcripts
   failproofai config --disconnect   Stop pulling policy and sending activity
-  failproofai config --status       Show connection and pause state
+  failproofai config --status       Show connection, daemon and pause state
+  failproofai config --pause [--session <id>]
+                                    Pause enforcement, time-boxed
+  failproofai config --resume [--all]
+                                    Resume enforcement
+
+    --machine-label <name>          Human-readable name in the dashboard
 
   One connection, two capabilities: this machine PULLS centrally-managed
   policies and SENDS what its hooks decided, so the dashboard shows the fleet