failproofai 1.0.0-beta.16 → 1.0.0-beta.18

package/dist/cli.mjs

@@ -19,7 +19,7 @@ var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
 var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
 // package.json
-var version2 = "1.0.0-beta.16", package_default;
+var version2 = "1.0.0-beta.18", package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "failproofai",
@@ -135,16 +135,16 @@ var init_package = __esm(() => {
       sharp: "0.35.0"
     },
     optionalDependencies: {
-      "@failproofai/failproofaid-linux-x64": "1.0.0-beta.16",
-      "@failproofai/failproofaid-linux-arm64": "1.0.0-beta.16",
-      "@failproofai/failproofaid-darwin-x64": "1.0.0-beta.16",
-      "@failproofai/failproofaid-darwin-arm64": "1.0.0-beta.16"
+      "@failproofai/failproofaid-linux-x64": "1.0.0-beta.18",
+      "@failproofai/failproofaid-linux-arm64": "1.0.0-beta.18",
+      "@failproofai/failproofaid-darwin-x64": "1.0.0-beta.18",
+      "@failproofai/failproofaid-darwin-arm64": "1.0.0-beta.18"
     },
     failproofaidBinaries: {
-      "linux-x64": "b82471309d2e52724781d8074bae55444892030eb1b48305ef74053bb7938931",
-      "linux-arm64": "5a0bdc9f726844e7ed109c896bb894e84a51c7592fe4aed26eceea78c97fde04",
-      "darwin-x64": "08881822befb31fe13974d2861fc50b6b2c1c72741986656e8f9087586202d88",
-      "darwin-arm64": "cc85096de72f3e5813145b7c906ea6a2d4788f39f4dae6a86532d88107802cab"
+      "linux-x64": "54bf7cc41ee8b5a2ea9430459c1fe9b8b03ece25c18d8bee49441feee93c7057",
+      "linux-arm64": "1f5e7c4be2d9c591cf4fd39e5fc122e71f507115cdb2ad1a27c5f30f22a30028",
+      "darwin-x64": "ae510969144aaec5e8891cfa5cdf7374c5efbd7554547046efa5913aab5c3ab2",
+      "darwin-arm64": "bc8d96e295aa9a68590be6e12d4bf3711749a31371206e63ccc36dd42b275e18"
     }
   };
 });
@@ -5060,6 +5060,16 @@ function getAllHookActivityEntries() {
   }
   return [...currentEntries, ...archiveEntries];
 }
+function withRenamedCloudFields(raw) {
+  const entry = raw;
+  if (entry.cloudVersion === undefined && typeof raw.cloudRevision === "number") {
+    entry.cloudVersion = raw.cloudRevision;
+  }
+  if (entry.cloudDeployment === undefined && typeof raw.cloudGeneration === "number") {
+    entry.cloudDeployment = raw.cloudGeneration;
+  }
+  return entry;
+}
 function readJsonlFile(filePath) {
   const content = readFileSafe(filePath);
   if (!content.trim())
@@ -5068,7 +5078,7 @@ function readJsonlFile(filePath) {
   for (const line of content.trim().split(`
 `)) {
     try {
-      entries.push(JSON.parse(line));
+      entries.push(withRenamedCloudFields(JSON.parse(line)));
     } catch {}
   }
   return entries;
@@ -11010,6 +11020,9 @@ function migrateConventionPolicies() {
       }
       if (entry.isDirectory() && statSync15(target).isDirectory()) {
         mergeInto(source, target, `${name}/`);
+        try {
+          rmdirSync(source);
+        } catch {}
       }
     }
   };
@@ -11876,6 +11889,15 @@ function appendLedger(entry) {
 `, "utf8");
   } catch {}
 }
+function filesToBackUp() {
+  const seen = new Set;
+  for (const at2 of [...BACKED_UP, ...BACKED_UP_LEGACY]) {
+    const path3 = at2();
+    if (existsSync20(path3))
+      seen.add(path3);
+  }
+  return [...seen];
+}
 function backupBeforeMigrating(from) {
   const dir = migrationBackupDir(from);
   const saved = [];
@@ -11885,14 +11907,7 @@ function backupBeforeMigrating(from) {
   } catch {
     return [];
   }
-  const seen = new Set;
-  for (const at2 of [...BACKED_UP, ...BACKED_UP_LEGACY]) {
-    const source = at2();
-    if (seen.has(source))
-      continue;
-    seen.add(source);
-    if (!existsSync20(source))
-      continue;
+  for (const source of filesToBackUp()) {
     try {
       copyFileSync2(source, resolve16(dir, basename4(source)));
       saved.push(basename4(source));
@@ -11967,7 +11982,7 @@ function describePlan(from) {
     ...chain.map((m) => `  ${m.from} → ${m.to}  ${m.describe}`),
     ``,
     `These would be copied to ${migrationBackupDir(from)} first:`,
-    ...[...BACKED_UP, ...BACKED_UP_LEGACY].map((at2) => at2()).filter((p) => existsSync20(p)).map((p) => `  ${basename4(p)}`),
+    ...filesToBackUp().map((p) => `  ${basename4(p)}`),
     ``,
     `Settings, cloud enrolment, policy selection, your own policy files, decision`,
     `history and undelivered events are carried, not removed — see \`HOME_CLASSES\`.`
@@ -12011,7 +12026,13 @@ var init_migrations = __esm(() => {
     }
   ];
   BACKED_UP = [configFile, credentialsFile, globalPolicyConfigFile, versionFile];
-  BACKED_UP_LEGACY = [legacy.configToml, legacy.credentialsToml, legacy.policyConfig];
+  BACKED_UP_LEGACY = [
+    legacy.configToml,
+    legacy.credentialsToml,
+    legacy.policyConfig,
+    legacy.cloudCredentials,
+    legacy.ingestCredentials
+  ];
 });
 
 // src/hooks/fp-reset.ts
@@ -12076,6 +12097,9 @@ function migrateConventionPolicies2() {
       }
       if (entry.isDirectory() && statSync16(target).isDirectory()) {
         mergeInto(source, target, `${name}/`);
+        try {
+          rmdirSync2(source);
+        } catch {}
       }
     }
   };
@@ -13009,6 +13033,7 @@ function runPrompt(p) {
       if (key.ctrl && (key.name === "c" || key.name === "d") || key.name === "escape") {
         finish(null);
       } else if (key.name === "left" && p.allowBack) {
+        p.onBack?.();
         finish(BACK);
       } else if (key.name === "up") {
         cursor = cursor > 0 ? cursor - 1 : choices.length - 1;
@@ -13089,6 +13114,7 @@ function multiSelect(opts) {
     },
     warnLine: () => warn ? c.warn(`Select at least ${minSelected}.`) : null,
     allowBack: opts.allowBack,
+    onBack: opts.onBack ? () => opts.onBack?.(choices.filter((_, i) => checked[i]).map((ch) => ch.value)) : undefined,
     footer: opts.hint ?? (opts.allowBack ? "↑/↓ move · space select · ctrl+a all · ← back · enter confirm" : "↑/↓ move · space select · ctrl+a all · enter confirm"),
     onKey: (key, cursor) => {
       if (key.name === "space") {
@@ -26263,6 +26289,7 @@ refreshed. Re-run \`failproofai config\` once you can use sudo.
   const hasCustomFiles = describeCustomPolicies(cwd).fileCount > 0;
   let presets = null;
   let clisSel = null;
+  const carried = { clis: null };
   while (clisSel === null) {
     const priorPresets = presets;
     presets = await multiSelect({
@@ -26275,7 +26302,7 @@ refreshed. Re-run \`failproofai config\` once you can use sudo.
     });
     if (presets === null)
       return cancel();
-    const priorClis = clisSel;
+    const priorClis = carried.clis;
     const picked = await multiSelect({
       message: "Which harnesses should it protect?",
       choices: [
@@ -26291,6 +26318,9 @@ refreshed. Re-run \`failproofai config\` once you can use sudo.
       summaryNoun: "harnesses",
       hint: "detected CLIs are pre-selected · space toggles · ctrl+a all · ← back · ↵ confirm",
       allowBack: true,
+      onBack: (checkedNow) => {
+        carried.clis = checkedNow;
+      },
       stdin,
       stdout
     });
@@ -26886,6 +26916,8 @@ __export(exports_harness_cli, {
   addPath: () => addPath,
   HARNESS_KEYS: () => HARNESS_KEYS
 });
+import { homedir as homedir27 } from "node:os";
+import { resolve as resolve26 } from "node:path";
 function unknownHarness(name) {
   return fail([
     `Unknown harness: ${name}`,
@@ -26924,6 +26956,22 @@ function writePaths(harness, paths) {
     }
   });
 }
+function comparableLabel(raw) {
+  return raw.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+}
+function comparablePath(raw) {
+  const home = homedir27();
+  const expanded = raw === "~" ? home : raw.startsWith("~/") ? resolve26(home, raw.slice(2)) : raw;
+  return expanded.replace(/\/+$/, "");
+}
+function effectiveLabel(entry) {
+  const given = labelOf(entry);
+  if (given)
+    return comparableLabel(given);
+  const path3 = comparablePath(pathOf(entry));
+  const base = path3.split("/").filter(Boolean).pop() ?? "";
+  return comparableLabel(base.replace(/^\.+/, ""));
+}
 function addPath(harness, entry) {
   if (!HARNESS_KEYS.includes(harness))
     return unknownHarness(harness);
@@ -26937,7 +26985,7 @@ function addPath(harness, entry) {
   if (existing.includes(trimmed)) {
     return ok([`${harness}: ${trimmed} is already configured.`]);
   }
-  const samePath = existing.find((e) => pathOf(e) === pathOf(trimmed));
+  const samePath = existing.find((e) => comparablePath(pathOf(e)) === comparablePath(pathOf(trimmed)));
   if (samePath) {
     return fail([
       `${harness} already captures ${pathOf(trimmed)} as ${JSON.stringify(samePath)}.`,
@@ -26947,21 +26995,28 @@ function addPath(harness, entry) {
     ]);
   }
   const wanted = labelOf(trimmed);
-  if (wanted) {
-    const sameLabel = existing.find((e) => labelOf(e) === wanted);
-    if (sameLabel) {
-      return fail([
-        `${harness} already uses the label ${JSON.stringify(wanted)} for ${pathOf(sameLabel)}.`,
-        "",
-        "Labels namespace agent ids, so two paths cannot share one."
-      ]);
-    }
+  const effective = effectiveLabel(trimmed);
+  const sameLabel = effective ? existing.find((e) => effectiveLabel(e) === effective) : undefined;
+  if (sameLabel) {
+    return fail([
+      `${harness} already uses the label ${JSON.stringify(effective)} for ${pathOf(sameLabel)}.`,
+      "",
+      "Labels namespace agent ids, so two paths cannot share one — and the daemon",
+      "lowercases them and collapses punctuation to `-`, so labels that differ only",
+      "in case or spacing collide. An unlabelled path takes its folder name.",
+      "",
+      "Give this one an explicit label:",
+      `  failproofai harness add-path ${harness} <label>=${pathOf(trimmed)}`
+    ]);
   }
   writePaths(harness, [...existing, trimmed]);
   return ok([
-    `${harness}: now also capturing ${pathOf(trimmed)}`,
+    `${harness}: configured to also capture ${pathOf(trimmed)}`,
     wanted ? `  agent ids will be namespaced ${wanted}-*` : "  a label will be derived from the folder name; `failproofai harness list` shows it",
     `  written to ${configFile()}`,
+    "",
+    "  The daemon validates it on the next read and reports what it rejected —",
+    "  `failproofai harness list` shows what is actually being captured.",
     ...TAKES_EFFECT_HINT
   ]);
 }
@@ -27484,12 +27539,12 @@ __export(exports_fp_home, {
   LAYOUT_VERSION: () => LAYOUT_VERSION2,
   HOME_CLASSES: () => HOME_CLASSES2
 });
-import { homedir as homedir27 } from "node:os";
-import { resolve as resolve26 } from "node:path";
+import { homedir as homedir28 } from "node:os";
+import { resolve as resolve27 } from "node:path";
 function failproofaiHome2(home) {
   if (home)
-    return resolve26(home, ".failproofai");
-  return process.env.FAILPROOFAI_HOME || resolve26(homedir27(), ".failproofai");
+    return resolve27(home, ".failproofai");
+  return process.env.FAILPROOFAI_HOME || resolve27(homedir28(), ".failproofai");
 }
 function resettablePaths2() {
   return [
@@ -27517,7 +27572,7 @@ function retiredLayoutPaths2() {
     legacy2.localPoliciesDir()
   ];
 }
-var LAYOUT_VERSION2 = 3, at2 = (...parts) => resolve26(failproofaiHome2(), ...parts), atHome2 = (home, ...parts) => home ? resolve26(failproofaiHome2(home), ...parts) : at2(...parts), versionFile2 = (home) => atHome2(home, "VERSION"), configFile2 = (home) => atHome2(home, "config.json"), credentialsFile2 = (home) => atHome2(home, "credentials.json"), binDir2 = (home) => atHome2(home, "bin"), daemonBinary = (version3, home) => resolve26(binDir2(home), `failproofaid-${version3}`), policiesDir2 = (home) => atHome2(home, "policies"), customPoliciesDir2, globalPolicyConfigFile2 = (home) => atHome2(home, "policies-config.json"), cloudPoliciesDir2 = (home) => resolve26(policiesDir2(home), "cloud-policies"), cursorsDir2 = (source, home) => source ? resolve26(atHome2(home, "cursors"), source) : atHome2(home, "cursors"), customAgentsDir2 = (home) => atHome2(home, "custom-agents"), customAgentsEventsDir = (home) => resolve26(customAgentsDir2(home), "events"), customAgentsFailedDir = (home) => resolve26(customAgentsDir2(home), "failed"), auditDir2 = (home) => atHome2(home, "audit"), auditDashboardFile2 = (home) => resolve26(auditDir2(home), "dashboard.json"), auditCacheDir2 = (home) => resolve26(auditDir2(home), "cache"), hookActivityDir2 = (home) => atHome2(home, "hook-activity"), runDir2 = (home) => atHome2(home, "run"), daemonSocket2 = () => process.env.FAILPROOFAI_DAEMON_SOCKET || resolve26(runDir2(), "failproofaid.sock"), workerSocket = (home) => resolve26(runDir2(home), "worker.sock"), daemonLock = (home) => resolve26(runDir2(home), "failproofaid.lock"), auditLockFile2 = (home) => resolve26(runDir2(home), "audit.lock"), stateDir2 = (home) => atHome2(home, "state"), shimsDir2 = (home) => resolve26(stateDir2(home), "shims"), spoolDir2 = (home) => resolve26(stateDir2(home), "spool"), failedDir2 = (home) => resolve26(stateDir2(home), "failed"), collectorHealthFile2 = (home) => resolve26(stateDir2(home), "collector-health.json"), sessionPauseDir2 = () => resolve26(stateDir2(), "sessions"), auditScheduleFile2 = (home) => resolve26(stateDir2(home), "audit-schedule.json"), telemetryIdFile2 = (home) => resolve26(stateDir2(home), "telemetry-id"), launcherMarker2 = (home) => resolve26(stateDir2(home), "launcher-configured"), onboardingAttemptFile2 = (home) => resolve26(stateDir2(home), "onboarding-attempt.json"), lastVersionFile2 = (home) => resolve26(stateDir2(home), "last-version"), onboardingLockFile2 = (home) => resolve26(stateDir2(home), "onboarding.lock"), codexSessionPathsFile2 = (home) => resolve26(stateDir2(home), "codex-session-paths.json"), logsDir2 = (home) => atHome2(home, "logs"), migrationsDir2 = (home) => atHome2(home, "migrations"), migrationLedgerFile2 = (home) => resolve26(migrationsDir2(home), "applied.json"), migrationBackupDir2 = (layout, home) => resolve26(migrationsDir2(home), `backup-layout${layout}`), HOME_CLASSES2, legacy2;
+var LAYOUT_VERSION2 = 3, at2 = (...parts) => resolve27(failproofaiHome2(), ...parts), atHome2 = (home, ...parts) => home ? resolve27(failproofaiHome2(home), ...parts) : at2(...parts), versionFile2 = (home) => atHome2(home, "VERSION"), configFile2 = (home) => atHome2(home, "config.json"), credentialsFile2 = (home) => atHome2(home, "credentials.json"), binDir2 = (home) => atHome2(home, "bin"), daemonBinary = (version3, home) => resolve27(binDir2(home), `failproofaid-${version3}`), policiesDir2 = (home) => atHome2(home, "policies"), customPoliciesDir2, globalPolicyConfigFile2 = (home) => atHome2(home, "policies-config.json"), cloudPoliciesDir2 = (home) => resolve27(policiesDir2(home), "cloud-policies"), cursorsDir2 = (source, home) => source ? resolve27(atHome2(home, "cursors"), source) : atHome2(home, "cursors"), customAgentsDir2 = (home) => atHome2(home, "custom-agents"), customAgentsEventsDir = (home) => resolve27(customAgentsDir2(home), "events"), customAgentsFailedDir = (home) => resolve27(customAgentsDir2(home), "failed"), auditDir2 = (home) => atHome2(home, "audit"), auditDashboardFile2 = (home) => resolve27(auditDir2(home), "dashboard.json"), auditCacheDir2 = (home) => resolve27(auditDir2(home), "cache"), hookActivityDir2 = (home) => atHome2(home, "hook-activity"), runDir2 = (home) => atHome2(home, "run"), daemonSocket2 = () => process.env.FAILPROOFAI_DAEMON_SOCKET || resolve27(runDir2(), "failproofaid.sock"), workerSocket = (home) => resolve27(runDir2(home), "worker.sock"), daemonLock = (home) => resolve27(runDir2(home), "failproofaid.lock"), auditLockFile2 = (home) => resolve27(runDir2(home), "audit.lock"), stateDir2 = (home) => atHome2(home, "state"), shimsDir2 = (home) => resolve27(stateDir2(home), "shims"), spoolDir2 = (home) => resolve27(stateDir2(home), "spool"), failedDir2 = (home) => resolve27(stateDir2(home), "failed"), collectorHealthFile2 = (home) => resolve27(stateDir2(home), "collector-health.json"), sessionPauseDir2 = () => resolve27(stateDir2(), "sessions"), auditScheduleFile2 = (home) => resolve27(stateDir2(home), "audit-schedule.json"), telemetryIdFile2 = (home) => resolve27(stateDir2(home), "telemetry-id"), launcherMarker2 = (home) => resolve27(stateDir2(home), "launcher-configured"), onboardingAttemptFile2 = (home) => resolve27(stateDir2(home), "onboarding-attempt.json"), lastVersionFile2 = (home) => resolve27(stateDir2(home), "last-version"), onboardingLockFile2 = (home) => resolve27(stateDir2(home), "onboarding.lock"), codexSessionPathsFile2 = (home) => resolve27(stateDir2(home), "codex-session-paths.json"), logsDir2 = (home) => atHome2(home, "logs"), migrationsDir2 = (home) => atHome2(home, "migrations"), migrationLedgerFile2 = (home) => resolve27(migrationsDir2(home), "applied.json"), migrationBackupDir2 = (layout, home) => resolve27(migrationsDir2(home), `backup-layout${layout}`), HOME_CLASSES2, legacy2;
 var init_fp_home2 = __esm(() => {
   customPoliciesDir2 = policiesDir2;
   HOME_CLASSES2 = [
@@ -27529,11 +27584,11 @@ var init_fp_home2 = __esm(() => {
     { path: failedDir2, class: "undelivered" },
     { path: customAgentsDir2, class: "undelivered" },
     { path: hookActivityDir2, class: "undelivered" },
-    { path: (home) => resolve26(stateDir2(home), "flush-request.json"), class: "undelivered" },
-    { path: (home) => resolve26(stateDir2(home), "backfill-request.json"), class: "undelivered" },
+    { path: (home) => resolve27(stateDir2(home), "flush-request.json"), class: "undelivered" },
+    { path: (home) => resolve27(stateDir2(home), "backfill-request.json"), class: "undelivered" },
     { path: cursorsDir2, class: "identity" },
     { path: telemetryIdFile2, class: "identity" },
-    { path: (home) => resolve26(stateDir2(home), "daemon-telemetry-id"), class: "identity" },
+    { path: (home) => resolve27(stateDir2(home), "daemon-telemetry-id"), class: "identity" },
     { path: versionFile2, class: "identity" },
     { path: migrationsDir2, class: "identity" },
     { path: auditDir2, class: "derived" },
@@ -27589,7 +27644,7 @@ __export(exports_migrations2, {
   MIGRATIONS: () => MIGRATIONS2
 });
 import { copyFileSync as copyFileSync4, existsSync as existsSync36, mkdirSync as mkdirSync25, readFileSync as readFileSync29, rmSync as rmSync12, writeFileSync as writeFileSync23 } from "node:fs";
-import { basename as basename7, dirname as dirname22, resolve as resolve27 } from "node:path";
+import { basename as basename7, dirname as dirname22, resolve as resolve28 } from "node:path";
 function planMigration2(from, registry = MIGRATIONS2) {
   if (from >= LAYOUT_VERSION)
     return [];
@@ -27641,6 +27696,15 @@ function appendLedger2(entry) {
 `, "utf8");
   } catch {}
 }
+function filesToBackUp2() {
+  const seen = new Set;
+  for (const at3 of [...BACKED_UP2, ...BACKED_UP_LEGACY2]) {
+    const path3 = at3();
+    if (existsSync36(path3))
+      seen.add(path3);
+  }
+  return [...seen];
+}
 function backupBeforeMigrating2(from) {
   const dir = migrationBackupDir(from);
   const saved = [];
@@ -27650,16 +27714,9 @@ function backupBeforeMigrating2(from) {
   } catch {
     return [];
   }
-  const seen = new Set;
-  for (const at3 of [...BACKED_UP2, ...BACKED_UP_LEGACY2]) {
-    const source = at3();
-    if (seen.has(source))
-      continue;
-    seen.add(source);
-    if (!existsSync36(source))
-      continue;
+  for (const source of filesToBackUp2()) {
     try {
-      copyFileSync4(source, resolve27(dir, basename7(source)));
+      copyFileSync4(source, resolve28(dir, basename7(source)));
       saved.push(basename7(source));
     } catch {}
   }
@@ -27732,7 +27789,7 @@ function describePlan2(from) {
     ...chain.map((m) => `  ${m.from} → ${m.to}  ${m.describe}`),
     ``,
     `These would be copied to ${migrationBackupDir(from)} first:`,
-    ...[...BACKED_UP2, ...BACKED_UP_LEGACY2].map((at3) => at3()).filter((p) => existsSync36(p)).map((p) => `  ${basename7(p)}`),
+    ...filesToBackUp2().map((p) => `  ${basename7(p)}`),
     ``,
     `Settings, cloud enrolment, policy selection, your own policy files, decision`,
     `history and undelivered events are carried, not removed — see \`HOME_CLASSES\`.`
@@ -27745,7 +27802,7 @@ function restoreBackup2(layout) {
   const restored = [];
   for (const at3 of [...BACKED_UP2, ...BACKED_UP_LEGACY2]) {
     const target = at3();
-    const source = resolve27(dir, basename7(target));
+    const source = resolve28(dir, basename7(target));
     if (!existsSync36(source))
       continue;
     try {
@@ -27776,7 +27833,13 @@ var init_migrations2 = __esm(() => {
     }
   ];
   BACKED_UP2 = [configFile, credentialsFile, globalPolicyConfigFile, versionFile];
-  BACKED_UP_LEGACY2 = [legacy.configToml, legacy.credentialsToml, legacy.policyConfig];
+  BACKED_UP_LEGACY2 = [
+    legacy.configToml,
+    legacy.credentialsToml,
+    legacy.policyConfig,
+    legacy.cloudCredentials,
+    legacy.ingestCredentials
+  ];
 });
 
 // src/hooks/daemon-service.ts
@@ -27818,8 +27881,8 @@ import {
   unlinkSync as unlinkSync5,
   rmSync as rmSync13
 } from "node:fs";
-import { homedir as homedir28, tmpdir as tmpdir3, userInfo as userInfo2 } from "node:os";
-import { resolve as resolve28 } from "node:path";
+import { homedir as homedir29, tmpdir as tmpdir3, userInfo as userInfo2 } from "node:os";
+import { resolve as resolve29 } from "node:path";
 import { execFileSync as execFileSync5 } from "node:child_process";
 function setDaemonConfigured2(value, installedVersion) {
   try {
@@ -27846,7 +27909,7 @@ function resolveFailproofaidBinaryPath2() {
   const packageRoot = process.env.FAILPROOFAI_PACKAGE_ROOT;
   if (packageRoot) {
     for (const profile of ["release", "debug"]) {
-      const candidate = resolve28(packageRoot, "target", profile, "failproofaid");
+      const candidate = resolve29(packageRoot, "target", profile, "failproofaid");
       if (existsSync37(candidate))
         return candidate;
     }
@@ -27877,7 +27940,7 @@ function resolveWorkerCommand2() {
   const packageRoot = process.env.FAILPROOFAI_PACKAGE_ROOT;
   if (!packageRoot)
     return null;
-  const workerScript = resolve28(packageRoot, "dist", "worker.mjs");
+  const workerScript = resolve29(packageRoot, "dist", "worker.mjs");
   if (!existsSync37(workerScript))
     return null;
   return `${shellQuote2(process.execPath)} ${shellQuote2(workerScript)}`;
@@ -27888,7 +27951,7 @@ function resolveCliCommand2() {
   const packageRoot = process.env.FAILPROOFAI_PACKAGE_ROOT;
   if (!packageRoot)
     return null;
-  const cliScript = resolve28(packageRoot, "dist", "cli.mjs");
+  const cliScript = resolve29(packageRoot, "dist", "cli.mjs");
   if (!existsSync37(cliScript))
     return null;
   return `${shellQuote2(process.execPath)} ${shellQuote2(cliScript)}`;
@@ -27902,7 +27965,7 @@ function workerScriptPath2() {
   const packageRoot = process.env.FAILPROOFAI_PACKAGE_ROOT;
   if (!packageRoot)
     return null;
-  const workerScript = resolve28(packageRoot, "dist", "worker.mjs");
+  const workerScript = resolve29(packageRoot, "dist", "worker.mjs");
   return existsSync37(workerScript) ? workerScript : null;
 }
 function assertUnitSafe2(value, field) {
@@ -27929,10 +27992,10 @@ function systemdUnitDir2() {
   return process.env.FAILPROOFAI_SYSTEMD_DIR || "/etc/systemd/system";
 }
 function systemdUnitPath2(user = serviceUser2()) {
-  return resolve28(systemdUnitDir2(), systemdUnitName2(user));
+  return resolve29(systemdUnitDir2(), systemdUnitName2(user));
 }
 function legacySystemdUserUnitPath2() {
-  return resolve28(homedir28(), ".config", "systemd", "user", "failproofaid.service");
+  return resolve29(homedir29(), ".config", "systemd", "user", "failproofaid.service");
 }
 function launchdLabel2(user = serviceUser2()) {
   return `ai.failproof.failproofaid.${user}`;
@@ -27941,7 +28004,7 @@ function launchdPlistPath2(user = serviceUser2()) {
   return `/Library/LaunchDaemons/${launchdLabel2(user)}.plist`;
 }
 function legacyLaunchAgentPlistPath2() {
-  return resolve28(homedir28(), "Library", "LaunchAgents", "ai.failproof.failproofaid.plist");
+  return resolve29(homedir29(), "Library", "LaunchAgents", "ai.failproof.failproofaid.plist");
 }
 function legacySharedLaunchDaemonPath2() {
   return "/Library/LaunchDaemons/ai.failproof.failproofaid.plist";
@@ -27989,8 +28052,8 @@ function runPrivileged2(command, args) {
   execFileSync5(cmd, argv, { stdio: "ignore", timeout: SERVICE_CMD_TIMEOUT_MS2 });
 }
 function writePrivilegedFile2(destination, contents, mode = "0644") {
-  const stagingDir = mkdtempSync2(resolve28(tmpdir3(), "failproofaid-stage-"));
-  const staging = resolve28(stagingDir, "service-definition");
+  const stagingDir = mkdtempSync2(resolve29(tmpdir3(), "failproofaid-stage-"));
+  const staging = resolve29(stagingDir, "service-definition");
   try {
     writeFileSync24(staging, contents, "utf8");
     runPrivileged2("install", ["-m", mode, staging, destination]);
@@ -28045,7 +28108,7 @@ function systemdUnitContents2(binaryPath, workerCmd, cliCmd = null) {
 `).join("");
   const user = assertUnitSafe2(serviceUser2(), "User");
   assertUnitSafe2(binaryPath, "ExecStart");
-  assertUnitSafe2(homedir28(), "HOME");
+  assertUnitSafe2(homedir29(), "HOME");
   const conditionPaths = [binaryPath, workerScriptPath2()].filter((p) => typeof p === "string" && existsSync37(p));
   const conditionLines = conditionPaths.map((p) => `ConditionPathExists=${assertUnitSafe2(p, "ConditionPathExists")}
 `).join("");
@@ -28059,7 +28122,7 @@ User=${user}
 # Set explicitly rather than relying on systemd deriving it from User=:
 # failproofaid stores per-user state and refuses to start without HOME, so this
 # required variable is not left to a version-dependent default.
-Environment="HOME=${homedir28()}"
+Environment="HOME=${homedir29()}"
 ${envLines}ExecStart=${binaryPath}
 Restart=on-failure
 RestartSec=2
@@ -28107,9 +28170,9 @@ ${env.map(([key, value]) => `        <key>${key}</key>
     <key>UserName</key>
     <string>${escapeXml2(serviceUser2())}</string>
 ${envBlock}    <key>StandardOutPath</key>
-    <string>${escapeXml2(resolve28(logDir2, "failproofaid.log"))}</string>
+    <string>${escapeXml2(resolve29(logDir2, "failproofaid.log"))}</string>
     <key>StandardErrorPath</key>
-    <string>${escapeXml2(resolve28(logDir2, "failproofaid.err.log"))}</string>
+    <string>${escapeXml2(resolve29(logDir2, "failproofaid.err.log"))}</string>
 </dict>
 </plist>
 `;
@@ -28369,65 +28432,33 @@ async function ensureDaemonServiceCurrent2() {
   }
   return { outcome: "rewritten", daemonRunning: true };
 }
-async function refreshDaemonToCliVersion() {
-  const lines = [];
-  if (daemonServiceStatus2() === "not-installed") {
+async function refreshDaemonToCliVersion(deps = {}) {
+  const status = deps.status ?? daemonServiceStatus2;
+  const install = deps.install ?? installDaemonService2;
+  const prime = deps.prime ?? primeElevation2;
+  const interactive = deps.interactive ?? (() => Boolean(process.stdin.isTTY && process.stdout.isTTY));
+  if (status() === "not-installed") {
     return { ok: true, lines: ["No failproofaid service on this machine; nothing to update."] };
   }
-  const binary = await ensureFailproofaidBinary2();
-  if (!binary.path) {
-    return {
-      ok: false,
-      lines: [
-        `Could not put the failproofaid ${version2} binary in place: ${binary.reason ?? "unknown reason"}`,
-        `The installed daemon is unchanged. It refuses to start against a layout it does`,
-        `not speak, so if this machine has just been migrated, run \`failproofai config\`.`
-      ]
-    };
-  }
-  lines.push(`failproofaid ${version2} binary in place.`);
-  const upgrade = await ensureDaemonServiceCurrent2();
-  if (upgrade.outcome === "failed") {
-    return {
-      ok: false,
-      lines: [
-        ...lines,
-        `The service definition could not be refreshed: ${upgrade.reason ?? "unknown reason"}`,
-        ...upgrade.daemonRunning === false ? [
-          `failproofaid is NOT running. On a machine configured to require it, every tool`,
-          `call denies until it is back — run \`failproofai config\` to rebuild the service.`
-        ] : []
-      ]
-    };
-  }
-  const restart = daemonRestartCommand2();
-  try {
-    if (process.platform === "darwin") {
-      runPrivileged2("launchctl", ["kickstart", "-k", `system/${launchdLabel2()}`]);
-    } else {
-      runPrivileged2("systemctl", ["restart", systemdUnitName2()]);
-    }
-  } catch {
-    return {
-      ok: false,
-      lines: [
-        ...lines,
-        `Could not restart failproofaid without a password. Run this yourself:`,
-        `  ${restart ?? "restart the failproofaid service"}`
-      ]
-    };
-  }
-  if (!await waitForDaemonRunning2()) {
+  if (interactive())
+    prime();
+  const result = await install();
+  if (!result.installed) {
     return {
       ok: false,
       lines: [
-        ...lines,
-        `failproofaid was restarted but did not come back up. \`${daemonStatusCommand2()}\` will say why.`,
-        `On a machine configured to require it, every tool call denies until it does.`
+        `failproofaid ${version2} could not be installed: ${result.reason ?? "unknown reason"}`,
+        `The previous daemon is untouched. On a machine configured to require it,`,
+        `enforcement continues; collection and cloud policy may be stale until this`,
+        `succeeds. \`${daemonStatusCommand2() ?? "systemctl status"}\` will say more.`
       ]
     };
   }
-  return { ok: true, lines: [...lines, `failproofaid restarted and running.`] };
+  writeVersionFile({ daemon: version2 });
+  return {
+    ok: true,
+    lines: [`failproofaid ${version2} installed, service restarted and holding.`]
+  };
 }
 async function uninstallDaemonService2() {
   setDaemonConfigured2(false);
@@ -28960,7 +28991,7 @@ function runPrompt2(p) {
       `${c2.dim(BAR2)}  ${c2.dim(summary)}`
     ]);
   };
-  return new Promise((resolve29) => {
+  return new Promise((resolve30) => {
     hideCursor2(stdout);
     repaint2(stdout, region, build());
     readline3.emitKeypressEvents(stdin);
@@ -28976,7 +29007,7 @@ function runPrompt2(p) {
     const finish = (result) => {
       cleanup();
       collapse(result);
-      resolve29(result);
+      resolve30(result);
     };
     function onKey(_s, key) {
       if (!key)
@@ -28984,6 +29015,7 @@ function runPrompt2(p) {
       if (key.ctrl && (key.name === "c" || key.name === "d") || key.name === "escape") {
         finish(null);
       } else if (key.name === "left" && p.allowBack) {
+        p.onBack?.();
         finish(BACK2);
       } else if (key.name === "up") {
         cursor2 = cursor2 > 0 ? cursor2 - 1 : choices.length - 1;
@@ -29064,6 +29096,7 @@ function multiSelect2(opts) {
     },
     warnLine: () => warn ? c2.warn(`Select at least ${minSelected}.`) : null,
     allowBack: opts.allowBack,
+    onBack: opts.onBack ? () => opts.onBack?.(choices.filter((_, i) => checked[i]).map((ch) => ch.value)) : undefined,
     footer: opts.hint ?? (opts.allowBack ? "↑/↓ move · space select · ctrl+a all · ← back · enter confirm" : "↑/↓ move · space select · ctrl+a all · enter confirm"),
     onKey: (key, cursor2) => {
       if (key.name === "space") {
@@ -29104,7 +29137,7 @@ function promptText2(opts) {
     return error ? { ok: false, error } : { ok: true, value };
   };
   if (!stdin.isTTY) {
-    return new Promise((resolve29) => {
+    return new Promise((resolve30) => {
       let buf = "";
       const onData = (chunk) => {
         buf += String(chunk);
@@ -29117,13 +29150,13 @@ function promptText2(opts) {
         stdin.removeListener("end", done);
         const r = accept(buf.split(`
 `)[0] ?? "");
-        resolve29(r.ok ? r.value : null);
+        resolve30(r.ok ? r.value : null);
       };
       stdin.on("data", onData);
       stdin.on("end", done);
     });
   }
-  return new Promise((resolve29) => {
+  return new Promise((resolve30) => {
     let value = "";
     const draw = (error) => {
       const cols = stdout.columns || 80;
@@ -29153,14 +29186,14 @@ function promptText2(opts) {
         return;
       if (key.ctrl && (key.name === "c" || key.name === "d") || key.name === "escape") {
         cleanup();
-        resolve29(null);
+        resolve30(null);
         return;
       }
       if (key.name === "return" || key.name === "enter") {
         const r = accept(value);
         if (r.ok) {
           cleanup();
-          resolve29(r.value);
+          resolve30(r.value);
         } else {
           draw(r.error);
         }
@@ -29229,7 +29262,7 @@ __export(exports_manager, {
 });
 import { execSync as execSync7 } from "node:child_process";
 import { existsSync as existsSync39 } from "node:fs";
-import { resolve as resolve29, basename as basename8 } from "node:path";
+import { resolve as resolve30, basename as basename8 } from "node:path";
 import { platform as platform5, arch as arch4, release as release3, hostname as hostname5 } from "node:os";
 function getSettingsPath2(scope, cwd) {
   return claudeCode.getSettingsPath(scope, cwd);
@@ -29337,8 +29370,8 @@ async function installHooksImpl2(policyNames, scope = "user", cwd, includeBeta =
     delete configToWrite.customPoliciesPath;
     delete configToWrite.customPoliciesPaths;
   } else if (customPoliciesPath && (typeof customPoliciesPath === "string" || customPoliciesPath.length > 0)) {
-    const incoming = (typeof customPoliciesPath === "string" ? [customPoliciesPath] : customPoliciesPath).map((path3) => resolve29(path3));
-    const carried = (previousConfig.customPoliciesPaths ?? (previousConfig.customPoliciesPath ? [previousConfig.customPoliciesPath] : [])).map((path3) => resolve29(path3)).filter((path3) => {
+    const incoming = (typeof customPoliciesPath === "string" ? [customPoliciesPath] : customPoliciesPath).map((path3) => resolve30(path3));
+    const carried = (previousConfig.customPoliciesPaths ?? (previousConfig.customPoliciesPath ? [previousConfig.customPoliciesPath] : [])).map((path3) => resolve30(path3)).filter((path3) => {
       if (existsSync39(path3))
         return true;
       console.log(`Dropping custom policies path (file no longer exists): ${path3}`);
@@ -29730,7 +29763,7 @@ Failproof AI Hook Policies
     console.log(`
   ── Custom Policies ───────────────────────`);
     for (const path3 of explicitPaths) {
-      const absPath = resolve29(findProjectConfigDir(cwd ?? process.cwd()), path3);
+      const absPath = resolve30(findProjectConfigDir(cwd ?? process.cwd()), path3);
       console.log(`  ${absPath}`);
       if (!existsSync39(absPath)) {
         console.log(`  \x1B[31m✗ File not found: ${absPath}\x1B[0m`);
@@ -29751,7 +29784,7 @@ Failproof AI Hook Policies
     console.log();
   }
   const base = findProjectConfigDir(cwd ?? process.cwd());
-  const projectDir = resolve29(base, ".failproofai", "policies");
+  const projectDir = resolve30(base, ".failproofai", "policies");
   const userDir = customPoliciesDir();
   const sameDir = userDir === projectDir;
   const conventionDirs = [
@@ -29999,7 +30032,7 @@ async function promptCliTargetSelection(detected, action = "install") {
     lastLineCount = lines.length;
   }
   const itemCount = options.length;
-  return new Promise((resolve30) => {
+  return new Promise((resolve31) => {
     render();
     readline4.emitKeypressEvents(process.stdin);
     const wasRaw = process.stdin.isRaw;
@@ -30032,7 +30065,7 @@ async function promptCliTargetSelection(detected, action = "install") {
         cleanup();
         process.stdout.write(`
 `);
-        resolve30(options[cursor2].value);
+        resolve31(options[cursor2].value);
       }
     }
     process.stdin.on("keypress", onKey);
@@ -30185,7 +30218,7 @@ async function promptPolicySelection2(preSelected, options = {}) {
 `);
     lastLineCount = lines.length;
   }
-  return new Promise((resolve30) => {
+  return new Promise((resolve31) => {
     render();
     process.stdin.setRawMode(true);
     process.stdin.resume();
@@ -30222,7 +30255,7 @@ async function promptPolicySelection2(preSelected, options = {}) {
 ${dim(STEP_DONE)}  Policies
 ${dim(BAR)}  ${dim(`${selected.length} selected`)}
 `);
-        resolve30(selected);
+        resolve31(selected);
       } else if (key.name === "escape") {
         search = "";
         cursor2 = 0;
@@ -30884,7 +30917,7 @@ __export(exports_launch2, {
 });
 import { spawn as spawn3 } from "child_process";
 import { realpathSync as realpathSync5, existsSync as existsSync40 } from "node:fs";
-import { resolve as resolve30, dirname as dirname23 } from "node:path";
+import { resolve as resolve31, dirname as dirname23 } from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 import { createInterface as createInterface2 } from "node:readline";
 function launch2(mode) {
@@ -30908,8 +30941,8 @@ function launch2(mode) {
     process.env.PORT = port;
     process.env.HOSTNAME = bindHost;
     cmd = "node";
-    const packageRoot = process.env.FAILPROOFAI_PACKAGE_ROOT ?? resolve30(dirname23(realpathSync5(fileURLToPath3(import.meta.url))), "..");
-    const serverJsPath = resolve30(packageRoot, ".next/standalone/server.js");
+    const packageRoot = process.env.FAILPROOFAI_PACKAGE_ROOT ?? resolve31(dirname23(realpathSync5(fileURLToPath3(import.meta.url))), "..");
+    const serverJsPath = resolve31(packageRoot, ".next/standalone/server.js");
     if (!existsSync40(serverJsPath)) {
       let shadowMessage = null;
       try {
@@ -31007,17 +31040,17 @@ var init_cli_error2 = __esm(() => {
 
 // bin/failproofai.mjs
 import { realpathSync as realpathSync6 } from "fs";
-import { dirname as dirname24, resolve as resolve31 } from "path";
+import { dirname as dirname24, resolve as resolve32 } from "path";
 import { fileURLToPath as fileURLToPath4 } from "url";
 // package.json
-var version = "1.0.0-beta.16";
+var version = "1.0.0-beta.18";
 
 // bin/failproofai.mjs
 if (!process.env.FAILPROOFAI_PACKAGE_ROOT) {
-  process.env.FAILPROOFAI_PACKAGE_ROOT = resolve31(dirname24(realpathSync6(fileURLToPath4(import.meta.url))), "..");
+  process.env.FAILPROOFAI_PACKAGE_ROOT = resolve32(dirname24(realpathSync6(fileURLToPath4(import.meta.url))), "..");
 }
 if (!process.env.FAILPROOFAI_DIST_PATH) {
-  process.env.FAILPROOFAI_DIST_PATH = resolve31(dirname24(realpathSync6(fileURLToPath4(import.meta.url))), "..", "dist");
+  process.env.FAILPROOFAI_DIST_PATH = resolve32(dirname24(realpathSync6(fileURLToPath4(import.meta.url))), "..", "dist");
 }
 var args = process.argv.slice(2);
 if (args[0] === "p")