failproofai 1.0.0 → 1.0.1-beta.0

package/.next/standalone/.next/server/chunks/[root-of-the-server]__1hstmft._.js

@@ -0,0 +1,3 @@
+module.exports=[70406,(e,t,r)=>{t.exports=e.x("next/dist/compiled/@opentelemetry/api",()=>require("next/dist/compiled/@opentelemetry/api"))},18622,(e,t,r)=>{t.exports=e.x("next/dist/compiled/next-server/app-page-turbo.runtime.prod.js",()=>require("next/dist/compiled/next-server/app-page-turbo.runtime.prod.js"))},20635,(e,t,r)=>{t.exports=e.x("next/dist/server/app-render/action-async-storage.external.js",()=>require("next/dist/server/app-render/action-async-storage.external.js"))},24725,(e,t,r)=>{t.exports=e.x("next/dist/server/app-render/after-task-async-storage.external.js",()=>require("next/dist/server/app-render/after-task-async-storage.external.js"))},56704,(e,t,r)=>{t.exports=e.x("next/dist/server/app-render/work-async-storage.external.js",()=>require("next/dist/server/app-render/work-async-storage.external.js"))},32319,(e,t,r)=>{t.exports=e.x("next/dist/server/app-render/work-unit-async-storage.external.js",()=>require("next/dist/server/app-render/work-unit-async-storage.external.js"))},59043,(e,t,r)=>{t.exports=e.x("next/dist/server/runtime-reacts.external.js",()=>require("next/dist/server/runtime-reacts.external.js"))},93695,(e,t,r)=>{t.exports=e.x("next/dist/shared/lib/no-fallback-error.external.js",()=>require("next/dist/shared/lib/no-fallback-error.external.js"))},74533,(e,t,r)=>{t.exports=e.x("node:child_process",()=>require("node:child_process"))},66680,(e,t,r)=>{t.exports=e.x("node:crypto",()=>require("node:crypto"))},2157,(e,t,r)=>{t.exports=e.x("node:fs",()=>require("node:fs"))},60526,(e,t,r)=>{t.exports=e.x("node:os",()=>require("node:os"))},50227,(e,t,r)=>{t.exports=e.x("node:path",()=>require("node:path"))},81111,(e,t,r)=>{t.exports=e.x("node:stream",()=>require("node:stream"))},94930,e=>{"use strict";var t=e.i(2157),r=e.i(50227),n=e.i(66680);e.s(["writeJsonAtomically",0,function(e,s,o={}){let a=o.mode??384,i=o.dirMode??448,c=(0,r.dirname)(e);(0,t.existsSync)(c)||(0,t.mkdirSync)(c,{recursive:!0,mode:i});let u=`${e}.${process.pid}.${(0,n.randomBytes)(6).toString("hex")}.tmp`;try{(0,t.writeFileSync)(u,JSON.stringify(s,null,2),{mode:a});try{(63&(0,t.statSync)(u).mode)!=0&&(0,t.chmodSync)(u,a)}catch{}(0,t.renameSync)(u,e);try{(63&(0,t.statSync)(e).mode)!=0&&(0,t.chmodSync)(e,a)}catch{}}catch(e){try{(0,t.rmSync)(u,{force:!0})}catch{}throw e}}])},6375,e=>{"use strict";var t=e.i(46501);function r(){return(process.env.FAILPROOF_API_URL??process.env.FAILPROOFAI_API_URL??"https://api.befailproof.ai").replace(/\/+$/,"")}class n extends Error{status;code;retryAfterSecs;constructor(e,t,r,n){super(r),this.status=e,this.code=t,this.retryAfterSecs=n,this.name="AuthApiError"}}async function s(e){let t={};try{t=await e.json()}catch{}let r=t.code??`http_${e.status}`,s=t.message??t.detail??e.statusText??"request failed",o=t.retry_after_secs;if(void 0===o){let t=e.headers.get("retry-after");if(t){let e=Number(t);Number.isFinite(e)&&(o=e)}}return void 0!==o&&(o=Math.max(0,Math.min(86400,o))),new n(e.status,r,s,o)}async function o(e,r){try{return await fetch(e,{...r,signal:function(e){let t=AbortSignal.timeout(1e4);if(!e)return t;let r=AbortSignal.any;if(r)return r([t,e]);let n=new AbortController;if(t.aborted)n.abort(t.reason);else t.addEventListener("abort",()=>n.abort(t.reason),{once:!0});if(e.aborted)n.abort(e.reason);else e.addEventListener("abort",()=>n.abort(e.reason),{once:!0});return n.signal}(r.signal??void 0)})}catch(o){let s=function(e){if(null===e||"object"!=typeof e)return!1;let t=e.name;return"AbortError"===t||"TimeoutError"===t}(o);if((0,t.trackEvent)("api_server_unreachable",{kind:s?"timeout":"network",path:function(e){try{return new URL(e).pathname}catch{return e}}(e),method:"string"==typeof r.method?r.method:"GET"}),s)throw new n(0,"timeout",`request to ${e} timed out after 10000ms`);throw o}}async function a(e,t,n){let a={"content-type":"application/json"};n?.accessToken&&(a.authorization=`Bearer ${n.accessToken}`);let i=await o(`${r()}${e}`,{method:"POST",headers:a,body:JSON.stringify(t)});if(204!==i.status){if(!i.ok)throw await s(i);return await i.json()}}async function i(e,t){let n=await o(`${r()}${e}`,{method:"GET",headers:{authorization:`Bearer ${t}`}});if(!n.ok)throw await s(n);return await n.json()}async function c(e){return a("/v0/auth/login/request",{email:e})}async function u(e,t){return a("/v0/auth/login/verify",{email:e,code:t})}async function l(e){return a("/v0/auth/token/refresh",{refresh_token:e})}async function f(e,t){await a("/v0/auth/logout",{refresh_token:t},{accessToken:e})}async function d(e){return i("/v0/auth/me",e)}async function p(e,t,r){return a("/v0/invite",void 0===r?{to:t}:{to:t,score:r},{accessToken:e})}e.s(["AuthApiError",0,n,"fetchMe",0,d,"logoutSession",0,f,"refreshAccessToken",0,l,"requestLoginCode",0,c,"sendInvites",0,p,"verifyLoginCode",0,u],6375)},17707,e=>{"use strict";var t=e.i(2157),r=e.i(50227),n=e.i(94930),s=e.i(79857),o=e.i(6375);function a(){let e=process.env.FAILPROOFAI_AUTH_DIR;return e?(0,r.join)(e,"session.json"):(0,s.auditSessionFile)()}function i(){let e=a();if(!(0,t.existsSync)(e))return null;try{let r=(0,t.readFileSync)(e,"utf-8"),n=JSON.parse(r);if("string"!=typeof n.access_token||"string"!=typeof n.refresh_token||"number"!=typeof n.access_expires_at||"object"!=typeof n.user||!n.user||"string"!=typeof n.user.id||"string"!=typeof n.user.email)return null;return{access_token:n.access_token,refresh_token:n.refresh_token,access_expires_at:n.access_expires_at,refresh_expires_at:"number"==typeof n.refresh_expires_at?n.refresh_expires_at:n.access_expires_at,user:{id:n.user.id,email:n.user.email}}}catch{return null}}function c(e){(0,n.writeJsonAtomically)(a(),e)}function u(){let e=a();(0,t.existsSync)(e)&&(0,t.rmSync)(e,{force:!0});try{let e=(0,s.migrationsDir)();if(!(0,t.existsSync)(e))return;for(let n of(0,t.readdirSync)(e)){if(!n.startsWith("backup-layout"))continue;let s=(0,r.resolve)(e,n,"auth.json");(0,t.existsSync)(s)&&(0,t.rmSync)(s,{force:!0})}}catch{}}function l(e,t){let r=Math.floor(Date.now()/1e3),n=e.user??t;if(!n)throw Error("authFromTokenResponse: missing user identity");return{access_token:e.access_token,refresh_token:e.refresh_token,access_expires_at:r+e.access_expires_in,refresh_expires_at:r+e.refresh_expires_in,user:n}}let f=new Map;async function d(e){let t=f.get(e.refresh_token);if(t)return t;let r=(async()=>{let t=l(await (0,o.refreshAccessToken)(e.refresh_token),e.user);return c(t),t})();f.set(e.refresh_token,r);try{return await r}finally{f.delete(e.refresh_token)}}async function p(){let e=i();if(!e)return null;let t=Math.floor(Date.now()/1e3);if(e.access_expires_at-t>60)return e;try{return await d(e)}catch(e){return e instanceof o.AuthApiError&&401===e.status&&u(),null}}async function h(){let e=await p();if(!e)return null;try{return{me:await (0,o.fetchMe)(e.access_token),auth:e}}catch(e){if(e instanceof o.AuthApiError&&401===e.status){let e=i();if(!e)return null;try{let t=await d(e);return{me:await (0,o.fetchMe)(t.access_token),auth:t}}catch(e){e instanceof o.AuthApiError&&401===e.status&&u()}}return null}}e.s(["authFromTokenResponse",0,l,"deleteAuth",0,u,"readAuth",0,i,"whoAmI",0,h,"writeAuth",0,c])},78081,e=>{e.v(t=>Promise.all(["server/chunks/[externals]__0qxhecv._.js","server/chunks/node_modules_posthog-node_dist_entrypoints_index_node_mjs_01r25oi._.js"].map(t=>e.l(t))).then(()=>t(39702)))}];
+
+//# sourceMappingURL=%5Broot-of-the-server%5D__1hstmft._.js.map

package/.next/standalone/.next/server/chunks/[root-of-the-server]__1p8poxd._.js

@@ -0,0 +1,3 @@
+module.exports=[70406,(e,t,r)=>{t.exports=e.x("next/dist/compiled/@opentelemetry/api",()=>require("next/dist/compiled/@opentelemetry/api"))},18622,(e,t,r)=>{t.exports=e.x("next/dist/compiled/next-server/app-page-turbo.runtime.prod.js",()=>require("next/dist/compiled/next-server/app-page-turbo.runtime.prod.js"))},20635,(e,t,r)=>{t.exports=e.x("next/dist/server/app-render/action-async-storage.external.js",()=>require("next/dist/server/app-render/action-async-storage.external.js"))},24725,(e,t,r)=>{t.exports=e.x("next/dist/server/app-render/after-task-async-storage.external.js",()=>require("next/dist/server/app-render/after-task-async-storage.external.js"))},56704,(e,t,r)=>{t.exports=e.x("next/dist/server/app-render/work-async-storage.external.js",()=>require("next/dist/server/app-render/work-async-storage.external.js"))},32319,(e,t,r)=>{t.exports=e.x("next/dist/server/app-render/work-unit-async-storage.external.js",()=>require("next/dist/server/app-render/work-unit-async-storage.external.js"))},59043,(e,t,r)=>{t.exports=e.x("next/dist/server/runtime-reacts.external.js",()=>require("next/dist/server/runtime-reacts.external.js"))},93695,(e,t,r)=>{t.exports=e.x("next/dist/shared/lib/no-fallback-error.external.js",()=>require("next/dist/shared/lib/no-fallback-error.external.js"))},74533,(e,t,r)=>{t.exports=e.x("node:child_process",()=>require("node:child_process"))},66680,(e,t,r)=>{t.exports=e.x("node:crypto",()=>require("node:crypto"))},2157,(e,t,r)=>{t.exports=e.x("node:fs",()=>require("node:fs"))},60526,(e,t,r)=>{t.exports=e.x("node:os",()=>require("node:os"))},50227,(e,t,r)=>{t.exports=e.x("node:path",()=>require("node:path"))},81111,(e,t,r)=>{t.exports=e.x("node:stream",()=>require("node:stream"))},61403,e=>{"use strict";var t=e.i(89171),r=e.i(6375),a=e.i(46501);async function s(e){await (0,a.initTelemetry)();let s={};try{s=await e.json()}catch{return(0,a.trackEvent)("audit_otp_requested",{status:"validation_error",source:"dashboard",reason:"invalid_json"}),t.NextResponse.json({code:"validation_error",message:"Invalid JSON body"},{status:400})}if("string"!=typeof s.email||!s.email.trim())return(0,a.trackEvent)("audit_otp_requested",{status:"validation_error",source:"dashboard",reason:"missing_email"}),t.NextResponse.json({code:"validation_error",message:"email is required"},{status:400});let n=s.email.trim().toLowerCase();try{let e=await (0,r.requestLoginCode)(s.email);return(0,a.trackEvent)("audit_otp_requested",{status:"success",email:n,source:"dashboard",expires_in:e.expires_in,resend_available_in:e.resend_available_in}),t.NextResponse.json({status:e.status,expires_in:e.expires_in,resend_available_in:e.resend_available_in},{status:200})}catch(s){if(s instanceof r.AuthApiError){(0,a.trackEvent)("audit_otp_requested",{status:"failed",email:n,source:"dashboard",error_code:s.code,http_status:s.status,retry_after_secs:s.retryAfterSecs??null});let e=s.status>=200&&s.status<600?s.status:504;return t.NextResponse.json({code:s.code,message:s.message,...void 0!==s.retryAfterSecs?{retry_after_secs:s.retryAfterSecs}:{}},{status:e})}let e=s instanceof Error?s.message:String(s);return(0,a.trackEvent)("audit_otp_requested",{status:"failed",email:n,source:"dashboard",error_code:"upstream_unreachable",error_message:e.slice(0,200)}),t.NextResponse.json({code:"upstream_unreachable",message:`api-server unreachable: ${e}`},{status:502})}}e.s(["POST",0,s,"dynamic",0,"force-dynamic"])},51481,e=>{"use strict";var t=e.i(47909),r=e.i(74017),a=e.i(96250),s=e.i(59756),n=e.i(61916),o=e.i(74677),i=e.i(69741),u=e.i(16795),l=e.i(87718),d=e.i(95169),c=e.i(47587),p=e.i(66012),h=e.i(70101),f=e.i(26937),v=e.i(10372),x=e.i(93695);e.i(52474);var m=e.i(220);let g=new t.AppRouteRouteModule({definition:{kind:r.RouteKind.APP_ROUTE,page:"/api/auth/login-request/route",pathname:"/api/auth/login-request",filename:"route",bundlePath:""},distDir:".next",relativeProjectDir:"",resolvedPagePath:"[project]/app/api/auth/login-request/route.ts",nextConfigOutput:"standalone",userland:()=>e.r(61403),...{}}),{workAsyncStorage:y,workUnitAsyncStorage:R,serverHooks:_}=g;async function w(e,t,a){a.requestMeta&&(0,s.setRequestMeta)(e,a.requestMeta),g.isDev&&(0,s.addRequestMeta)(e,"devRequestTimingInternalsEnd",process.hrtime.bigint());let y="/api/auth/login-request/route";y=y.replace(/\/index$/,"")||"/";let R=await g.prepare(e,t,{srcPage:y,multiZoneDraftMode:!1});if(!R)return t.statusCode=400,t.end("Bad Request"),null==a.waitUntil||a.waitUntil.call(a,Promise.resolve()),null;let{buildId:_,deploymentId:w,params:b,nextConfig:E,parsedUrl:A,isDraftMode:q,prerenderManifest:C,routerServerContext:T,isOnDemandRevalidate:S,revalidateOnlyGenerated:k,resolvedPathname:j,clientReferenceManifest:N,serverActionsManifest:P}=R,O=(0,i.normalizeAppPath)(y),I=!!(C.dynamicRoutes[O]||C.routes[j]),H=async()=>((null==T?void 0:T.render404)?await T.render404(e,t,A,!1):t.end("This page could not be found"),null);if(I&&!q){let e=!!C.routes[j],t=C.dynamicRoutes[O];if(t&&!1===t.fallback&&!e){if(E.adapterPath)return await H();throw new x.NoFallbackError}}let M=null;!I||g.isDev||q||(M="/index"===(M=j)?"/":M);let L=!0===g.isDev||!I,U=I&&!L;P&&N&&(0,o.setManifestsSingleton)({page:y,clientReferenceManifest:N,serverActionsManifest:P});let $=e.method||"GET",D=(0,n.getTracer)(),F=D.getActiveScopeSpan(),B=!!(null==T?void 0:T.isWrappedByNextServer),K=!!(0,s.getRequestMeta)(e,"minimalMode"),G=(0,s.getRequestMeta)(e,"incrementalCache")||await g.getIncrementalCache(e,E,C,K);null==G||G.resetRequestCache(),globalThis.__incrementalCache=G;let z={params:b,previewProps:C.preview,renderOpts:{experimental:{authInterrupts:!!E.experimental.authInterrupts,useCacheTimeout:E.experimental.useCacheTimeout},cacheComponents:!!E.cacheComponents,validationLevel:E.experimental.instantInsights.validationLevel,supportsDynamicResponse:L,incrementalCache:G,hmrRefreshHash:(0,s.getRequestMeta)(e,"hmrRefreshHash"),cacheLifeProfiles:E.cacheLife,staticPageGenerationTimeout:E.staticPageGenerationTimeout,waitUntil:a.waitUntil,onClose:e=>{t.on("close",e)},onAfterTaskError:void 0,onInstrumentationRequestError:(t,r,a,s)=>g.onRequestError(e,t,a,s,T)},sharedContext:{buildId:_,deploymentId:w}},V=new u.NodeNextRequest(e),X=new u.NodeNextResponse(t),J=l.NextRequestAdapter.fromNodeNextRequest(V,(0,l.signalFromNodeResponse)(t)),W=async({previousCacheEntry:r})=>{try{if(!K&&S&&k&&!r)return t.statusCode=404,t.setHeader("x-nextjs-cache","REVALIDATED"),t.end("This page could not be found"),null;let s=await g.handle(J,z);e.fetchMetrics=z.renderOpts.fetchMetrics;let n=z.renderOpts.pendingWaitUntil;n&&a.waitUntil&&(a.waitUntil(n),n=void 0);let o=z.renderOpts.collectedTags;if(!I)return await (0,p.sendResponse)(V,X,s,n),null;{let e=await s.blob(),t=(0,h.toNodeOutgoingHttpHeaders)(s.headers);o&&(t[v.NEXT_CACHE_TAGS_HEADER]=o),!t["content-type"]&&e.type&&(t["content-type"]=e.type);let r=void 0!==z.renderOpts.collectedRevalidate&&!(z.renderOpts.collectedRevalidate>=v.INFINITE_CACHE)&&z.renderOpts.collectedRevalidate,a=void 0===z.renderOpts.collectedExpire||z.renderOpts.collectedExpire>=v.INFINITE_CACHE?!1!==r&&r>0?E.expireTime:void 0:z.renderOpts.collectedExpire;return{value:{kind:m.CachedRouteKind.APP_ROUTE,status:s.status,body:Buffer.from(await e.arrayBuffer()),headers:t},cacheControl:{revalidate:r,expire:a}}}}catch(t){throw(null==r?void 0:r.isStale)&&await g.onRequestError(e,t,{routerKind:"App Router",routePath:y,routeType:"route",revalidateReason:(0,c.getRevalidateReason)({isStaticGeneration:U,isOnDemandRevalidate:S})},!1,T),t}},Z=async(s,o)=>{try{var i,u;let s=await g.handleResponse({req:e,nextConfig:E,cacheKey:M,routeKind:r.RouteKind.APP_ROUTE,isFallback:!1,prerenderManifest:C,isRoutePPREnabled:!1,isOnDemandRevalidate:S,revalidateOnlyGenerated:k,responseGenerator:W,waitUntil:a.waitUntil,isMinimalMode:K});if(!I)return;if((null==s||null==(i=s.value)?void 0:i.kind)!==m.CachedRouteKind.APP_ROUTE)throw Object.defineProperty(Error(`Invariant: app-route received invalid cache entry ${null==s||null==(u=s.value)?void 0:u.kind}`),"__NEXT_ERROR_CODE",{value:"E701",enumerable:!1,configurable:!0});K||t.setHeader("x-nextjs-cache",S?"REVALIDATED":s.isMiss?"MISS":s.isStale?"STALE":"HIT"),q&&t.setHeader("Cache-Control","private, no-cache, no-store, max-age=0, must-revalidate");let n=(0,h.fromNodeOutgoingHttpHeaders)(s.value.headers);K&&I||n.delete(v.NEXT_CACHE_TAGS_HEADER),!s.cacheControl||t.getHeader("Cache-Control")||n.get("Cache-Control")||n.set("Cache-Control",(0,f.getCacheControlHeader)(s.cacheControl)),await (0,p.sendResponse)(V,X,new Response(s.value.body,{headers:n,status:s.value.status||200}));return}catch(t){if(t instanceof x.NoFallbackError||await g.onRequestError(e,t,{routerKind:"App Router",routePath:O,routeType:"route",revalidateReason:(0,c.getRevalidateReason)({isStaticGeneration:U,isOnDemandRevalidate:S})},!1,T),I)throw t;await (0,p.sendResponse)(V,X,new Response(null,{status:500}));return}finally{(()=>{if(!s)return;let e=t.statusCode;s.setAttributes({"http.status_code":e,"next.rsc":!1}),e&&e>=500&&(s.setStatus({code:n.SpanStatusCode.ERROR}),s.setAttribute("error.type",e.toString()));let r=D.getRootSpanAttributes();if(!r)return;if(r.get("next.span_type")!==d.BaseServerSpan.handleRequest)return console.warn(`Unexpected root span type '${r.get("next.span_type")}'. Please report this Next.js issue https://github.com/vercel/next.js`);let a=r.get("next.route")||O,i=`${$} ${a}`;s.setAttributes({"next.route":a,"http.route":a,"next.span_name":i}),s.updateName(i),o&&o!==s&&(o.setAttribute("http.route",a),o.updateName(i))})()}};if(B&&F)await Z(F,void 0);else{let t=D.getActiveScopeSpan();await D.withPropagatedContext(e.headers,()=>D.trace(d.BaseServerSpan.handleRequest,{spanName:`${$} ${y}`,kind:n.SpanKind.SERVER,attributes:{"http.method":$,"http.target":e.url}},e=>Z(e,t)),void 0,!B)}}e.s(["handler",0,w,"patchFetch",0,function(){return(0,a.patchFetch)({workAsyncStorage:y,workUnitAsyncStorage:R})},"routeModule",0,g,"serverHooks",0,_,"workAsyncStorage",0,y,"workUnitAsyncStorage",0,R])},6375,e=>{"use strict";var t=e.i(46501);function r(){return(process.env.FAILPROOF_API_URL??process.env.FAILPROOFAI_API_URL??"https://api.befailproof.ai").replace(/\/+$/,"")}class a extends Error{status;code;retryAfterSecs;constructor(e,t,r,a){super(r),this.status=e,this.code=t,this.retryAfterSecs=a,this.name="AuthApiError"}}async function s(e){let t={};try{t=await e.json()}catch{}let r=t.code??`http_${e.status}`,s=t.message??t.detail??e.statusText??"request failed",n=t.retry_after_secs;if(void 0===n){let t=e.headers.get("retry-after");if(t){let e=Number(t);Number.isFinite(e)&&(n=e)}}return void 0!==n&&(n=Math.max(0,Math.min(86400,n))),new a(e.status,r,s,n)}async function n(e,r){try{return await fetch(e,{...r,signal:function(e){let t=AbortSignal.timeout(1e4);if(!e)return t;let r=AbortSignal.any;if(r)return r([t,e]);let a=new AbortController;if(t.aborted)a.abort(t.reason);else t.addEventListener("abort",()=>a.abort(t.reason),{once:!0});if(e.aborted)a.abort(e.reason);else e.addEventListener("abort",()=>a.abort(e.reason),{once:!0});return a.signal}(r.signal??void 0)})}catch(n){let s=function(e){if(null===e||"object"!=typeof e)return!1;let t=e.name;return"AbortError"===t||"TimeoutError"===t}(n);if((0,t.trackEvent)("api_server_unreachable",{kind:s?"timeout":"network",path:function(e){try{return new URL(e).pathname}catch{return e}}(e),method:"string"==typeof r.method?r.method:"GET"}),s)throw new a(0,"timeout",`request to ${e} timed out after 10000ms`);throw n}}async function o(e,t,a){let o={"content-type":"application/json"};a?.accessToken&&(o.authorization=`Bearer ${a.accessToken}`);let i=await n(`${r()}${e}`,{method:"POST",headers:o,body:JSON.stringify(t)});if(204!==i.status){if(!i.ok)throw await s(i);return await i.json()}}async function i(e,t){let a=await n(`${r()}${e}`,{method:"GET",headers:{authorization:`Bearer ${t}`}});if(!a.ok)throw await s(a);return await a.json()}async function u(e){return o("/v0/auth/login/request",{email:e})}async function l(e,t){return o("/v0/auth/login/verify",{email:e,code:t})}async function d(e){return o("/v0/auth/token/refresh",{refresh_token:e})}async function c(e,t){await o("/v0/auth/logout",{refresh_token:t},{accessToken:e})}async function p(e){return i("/v0/auth/me",e)}async function h(e,t,r){return o("/v0/invite",void 0===r?{to:t}:{to:t,score:r},{accessToken:e})}e.s(["AuthApiError",0,a,"fetchMe",0,p,"logoutSession",0,c,"refreshAccessToken",0,d,"requestLoginCode",0,u,"sendInvites",0,h,"verifyLoginCode",0,l],6375)}];
+
+//# sourceMappingURL=%5Broot-of-the-server%5D__1p8poxd._.js.map

package/.next/standalone/.next/server/chunks/_0lxbzdq._.js

@@ -1,3 +1,3 @@
-module.exports=[17694,e=>{"use strict";var t=e.i(2157);e.i(50227);var i=e.i(79857);let r={mode:"oss",daemon:{configured:!1},collector:{sessions:!1,hooks:!0,hooksVerbosity:"decisions",redact:"minimal",environment:"local"},telemetry:{enabled:!0},audit:{auto:!1,intervalDays:7}};e.s(["isTelemetryEnabled",0,function(){if("1"===process.env.FAILPROOFAI_TELEMETRY_DISABLED)return!1;try{return function(){try{var e;let r,n,a,s,o;return e=JSON.parse((0,t.readFileSync)((0,i.configFile)(),"utf8")),r=e.mode?.kind,n=e.daemon??{},a=e.collector??{},s=e.telemetry??{},o=e.audit??{},{mode:"cloud"===r?"cloud":"oss",daemon:{configured:!0===n.configured},collector:{sessions:!0===a.sessions,hooks:!1!==a.hooks,hooksVerbosity:"all"===a.hooks_verbosity||"off"===a.hooks_verbosity?a.hooks_verbosity:"decisions",redact:"off"===a.redact?"off":"minimal",environment:"string"==typeof a.environment?a.environment:"local",machineId:"string"==typeof a.machine_id?a.machine_id:void 0,sources:function(e){if(!e||"object"!=typeof e||Array.isArray(e))return;let t={};for(let[i,r]of Object.entries(e)){if(!r||"object"!=typeof r||Array.isArray(r))continue;let e=r.extra_paths;if(!Array.isArray(e))continue;let n=e.filter(e=>"string"==typeof e&&""!==e.trim());n.length>0&&(t[i]={extraPaths:n})}return Object.keys(t).length>0?t:void 0}(a.sources)},telemetry:{enabled:!1!==s.enabled},audit:{auto:!0===o.auto,intervalDays:function(e){if("number"!=typeof e||!Number.isFinite(e))return 7;let t=Math.floor(e);return t<1?7:Math.min(t,90)}(o.interval_days)}}}catch{return structuredClone(r)}}().telemetry.enabled}catch{return!0}}],17694)},10659,e=>{"use strict";let t;var i=e.i(2157),r=e.i(50227),n=e.i(60526),a=e.i(66680);e.i(74533);var s=e.i(79857);let o=r.default.join(n.default.homedir(),".failproofai"),l=r.default.join(o,"instance-id");function c(e){return a.default.createHmac("sha256","failproofai-telemetry-v1").update(e).digest("hex")}function d(e){let t;try{if(t=(0,s.telemetryIdFile)(),i.default.readFileSync(t,"utf-8").trim()===e)return}catch{try{t=(0,s.telemetryIdFile)()}catch{return}}try{i.default.mkdirSync(r.default.dirname(t),{recursive:!0});let n=`${t}.${process.pid}.tmp`;i.default.writeFileSync(n,e,{encoding:"utf-8",mode:384}),i.default.renameSync(n,t)}catch{}}e.s(["getInstanceId",0,function(){if(t)return t;let e=function(){try{for(let e of(n.default.platform(),["/etc/machine-id","/var/lib/dbus/machine-id"]))try{let t=i.default.readFileSync(e,"utf-8").trim();if(t)return t}catch{}}catch{}}();if(e)return d(t=c(e)),t;let r=[n.default.hostname(),n.default.homedir(),n.default.platform(),n.default.arch(),n.default.cpus()[0]?.model??""].join(":");return r?d(t=c(r)):d(t=function(){try{let e=i.default.readFileSync(l,"utf-8").trim();if(e)return e}catch{}let e=a.default.randomUUID();try{i.default.mkdirSync(o,{recursive:!0}),i.default.writeFileSync(l,e,"utf-8")}catch{}return e}()),t}])},46501,e=>{"use strict";var t=e.i(10659),i=e.i(17694),r=e.i(24214),n=e.i(28067);let a=n.POSTHOG_API_KEY;async function s(e,t){for(let i=1;i<=5;i++){try{let{signal:i,...r}=t,n=await fetch(e,{...r,signal:AbortSignal.timeout(5e3)});if(n.ok)return n}catch{}if(i<5){let e=Math.min(1e3*2**(i-1),8e3);await new Promise(t=>setTimeout(t,e))}}return new Response("{}",{status:200})}async function o(){try{if(!(0,i.isTelemetryEnabled)()||globalThis.__FAILPROOFAI_POSTHOG__)return;let t=await e.A(78081),r=process.env.FAILPROOFAI_POSTHOG_KEY??a,n=process.env.FAILPROOFAI_POSTHOG_HOST??"https://us.i.posthog.com";globalThis.__FAILPROOFAI_POSTHOG__=new t.PostHog(r,{host:n,flushAt:1,flushInterval:0,requestTimeout:5e3,fetchRetryCount:0,fetch:s});let o=()=>{globalThis.__FAILPROOFAI_POSTHOG__?.shutdown().catch(()=>{})};process.on("beforeExit",o),process.on("SIGTERM",o),process.on("SIGINT",o)}catch(e){console.warn("[failproofai:telemetry] init failed:",e instanceof Error?e.message:e)}}e.s(["initTelemetry",0,o,"trackEvent",0,function(e,a){if(!(0,i.isTelemetryEnabled)())return;let s=globalThis.__FAILPROOFAI_POSTHOG__;s&&s.capture({distinctId:(0,t.getInstanceId)(),event:e,properties:{...a,$lib:"failproofai",failproofai_version:r.version,product:n.POSTHOG_PRODUCT}})}])},24214,(e,t,i)=>{t.exports={name:"failproofai",version:"1.0.0",description:"The easiest way to manage policies that keep your AI agents reliable, on-task, and running autonomously — for Claude Code & the Agents SDK",bin:{failproofai:"./dist/cli.mjs",failproofaid:"./bin/failproofaid-shim.mjs"},files:["bin/","src/","scripts/","lib/","pi-extension/","openclaw-plugin/",".next/standalone/","dist/","README.md"],engines:{node:">=20.9.0",bun:">=1.3.0"},scripts:{predev:"bun run build:cli && bun link",dev:"FAILPROOFAI_TELEMETRY_DISABLED=1 bun scripts/dev.ts --port 8020","build:cli":"bun build --target=node --format=esm --outfile=dist/cli.mjs bin/failproofai.mjs --external posthog-node --external sql.js && node -e \"const fs=require('fs');const c=fs.readFileSync('dist/cli.mjs','utf8');fs.writeFileSync('dist/cli.mjs',c.replace('#!/usr/bin/env bun','#!/usr/bin/env node').replace('// @bun\\n',''))\"","build:worker":"bun build --target=node --format=esm --outfile=dist/worker.mjs bin/failproofai-worker.mjs --external posthog-node --external sql.js",build:"bun build --target=node --format=cjs --outfile=dist/index.js src/index.ts && bun run build:cli && bun run build:worker && bun --bun next build && node -e \"const {cpSync}=require('fs');cpSync('.next/static','.next/standalone/.next/static',{recursive:true});\" && node scripts/prune-standalone.mjs",prestart:"bun run build:cli && bun link",start:"FAILPROOFAI_TELEMETRY_DISABLED=1 bun scripts/start.ts",test:"vitest","test:run":"vitest run",lint:"eslint . --config eslint.config.mjs",prepare:"bun run build","test:e2e":"vitest run --config vitest.config.e2e.mts","test:e2e:watch":"vitest --config vitest.config.e2e.mts",translate:"bun scripts/translate-docs/cli.ts","translate:readme":"bun scripts/translate-docs/cli.ts --readme-only","translate:docs":"bun scripts/translate-docs/cli.ts --docs-only","translate:dry-run":"bun scripts/translate-docs/cli.ts --dry-run","translate:validate":"bun scripts/translate-docs/cli.ts --validate","validate:mdx":"bun scripts/validate-mdx.ts"},keywords:["claude","claude-code","claude-agents-sdk","anthropic","ai-agent","agent-reliability","agent-monitoring","autonomous-agent","failure-prevention","developer-tools","devtools","cli","local-first","hooks","policies"],author:"ExosphereHost Inc. <failproofai@exosphere.host>",license:"SEE LICENSE IN LICENSE",homepage:"https://github.com/FailproofAI/failproofai",repository:{type:"git",url:"https://github.com/FailproofAI/failproofai.git"},bugs:{url:"https://github.com/FailproofAI/failproofai/issues"},publishConfig:{access:"public"},devDependencies:{"@anthropic-ai/sdk":"^0.116.0","@mdx-js/mdx":"^3.1.1","@tailwindcss/postcss":"^4.3.1","@tanstack/react-virtual":"^3.14.9","@testing-library/jest-dom":"^7.0.0","@testing-library/react":"^16.3.2","@testing-library/user-event":"^14.6.1","@types/node":"26.2.0","@types/react":"19.2.18","@types/react-dom":"^19.2.3","@vitejs/plugin-react":"^6.0.5",clsx:"^2.1.1",eslint:"^10.5.0","eslint-config-next":"^16.2.9",jsdom:"^30.0.1","lucide-react":"^1.28.0",next:"^16.2.11",react:"^19.2.4","react-dom":"^19.2.4","tailwind-merge":"^3.4.0",tailwindcss:"^4.3.1",typescript:"6.0.3",vitest:"^4.1.9"},dependencies:{"html-to-image":"^1.11.13","posthog-node":"^5.47.7","sql.js":"^1.14.1",yaml:"^2.9.0"},overrides:{postcss:"8.5.26","eslint-plugin-react-hooks":"7.0.1",vite:"8.0.16",undici:"7.29.0","brace-expansion":"5.0.9",sharp:"0.35.0"},optionalDependencies:{"@failproofai/failproofaid-linux-x64":"1.0.0","@failproofai/failproofaid-linux-arm64":"1.0.0","@failproofai/failproofaid-darwin-x64":"1.0.0","@failproofai/failproofaid-darwin-arm64":"1.0.0"},failproofaidBinaries:{"linux-x64":"67d9404812145b8b13dc97debd33cd667a5de347989b2c9c47bbdfcb5e99344c","linux-arm64":"ca003a2ca755f5d696e2d6f4ddd8eedc0f8c4914f972101aa9803986ec409000","darwin-x64":"53f1ed8710da69c2e3d3668d3b62380383a46328471870093936f53fc0a4fb05","darwin-arm64":"682c22084906877760285e925b232d3563a1874a7a1f42c4c27deb1b7b74fb6f"}}},28067,e=>{"use strict";e.s(["POSTHOG_API_KEY",0,"phc_Ac1Ww1GqKc0z1SyrRWbmatEeQdlOQIsDEEdP8l8JRgX","POSTHOG_PRODUCT",0,"failproofai-oss"])}];
+module.exports=[17694,e=>{"use strict";var t=e.i(2157);e.i(50227);var i=e.i(79857);let r={mode:"oss",daemon:{configured:!1},collector:{sessions:!1,hooks:!0,hooksVerbosity:"decisions",redact:"minimal",environment:"local"},telemetry:{enabled:!0},audit:{auto:!1,intervalDays:7}};e.s(["isTelemetryEnabled",0,function(){if("1"===process.env.FAILPROOFAI_TELEMETRY_DISABLED)return!1;try{return function(){try{var e;let r,n,a,s,o;return e=JSON.parse((0,t.readFileSync)((0,i.configFile)(),"utf8")),r=e.mode?.kind,n=e.daemon??{},a=e.collector??{},s=e.telemetry??{},o=e.audit??{},{mode:"cloud"===r?"cloud":"oss",daemon:{configured:!0===n.configured},collector:{sessions:!0===a.sessions,hooks:!1!==a.hooks,hooksVerbosity:"all"===a.hooks_verbosity||"off"===a.hooks_verbosity?a.hooks_verbosity:"decisions",redact:"off"===a.redact?"off":"minimal",environment:"string"==typeof a.environment?a.environment:"local",machineId:"string"==typeof a.machine_id?a.machine_id:void 0,sources:function(e){if(!e||"object"!=typeof e||Array.isArray(e))return;let t={};for(let[i,r]of Object.entries(e)){if(!r||"object"!=typeof r||Array.isArray(r))continue;let e=r.extra_paths;if(!Array.isArray(e))continue;let n=e.filter(e=>"string"==typeof e&&""!==e.trim());n.length>0&&(t[i]={extraPaths:n})}return Object.keys(t).length>0?t:void 0}(a.sources)},telemetry:{enabled:!1!==s.enabled},audit:{auto:!0===o.auto,intervalDays:function(e){if("number"!=typeof e||!Number.isFinite(e))return 7;let t=Math.floor(e);return t<1?7:Math.min(t,90)}(o.interval_days),reportsConsentedAt:"number"==typeof o.reports_consented_at&&Number.isFinite(o.reports_consented_at)?o.reports_consented_at:void 0}}}catch{return structuredClone(r)}}().telemetry.enabled}catch{return!0}}],17694)},10659,e=>{"use strict";let t;var i=e.i(2157),r=e.i(50227),n=e.i(60526),a=e.i(66680);e.i(74533);var s=e.i(79857);let o=r.default.join(n.default.homedir(),".failproofai"),l=r.default.join(o,"instance-id");function c(e){return a.default.createHmac("sha256","failproofai-telemetry-v1").update(e).digest("hex")}function d(e){let t;try{if(t=(0,s.telemetryIdFile)(),i.default.readFileSync(t,"utf-8").trim()===e)return}catch{try{t=(0,s.telemetryIdFile)()}catch{return}}try{i.default.mkdirSync(r.default.dirname(t),{recursive:!0});let n=`${t}.${process.pid}.tmp`;i.default.writeFileSync(n,e,{encoding:"utf-8",mode:384}),i.default.renameSync(n,t)}catch{}}e.s(["getInstanceId",0,function(){if(t)return t;let e=function(){try{for(let e of(n.default.platform(),["/etc/machine-id","/var/lib/dbus/machine-id"]))try{let t=i.default.readFileSync(e,"utf-8").trim();if(t)return t}catch{}}catch{}}();if(e)return d(t=c(e)),t;let r=[n.default.hostname(),n.default.homedir(),n.default.platform(),n.default.arch(),n.default.cpus()[0]?.model??""].join(":");return r?d(t=c(r)):d(t=function(){try{let e=i.default.readFileSync(l,"utf-8").trim();if(e)return e}catch{}let e=a.default.randomUUID();try{i.default.mkdirSync(o,{recursive:!0}),i.default.writeFileSync(l,e,"utf-8")}catch{}return e}()),t}])},46501,e=>{"use strict";var t=e.i(10659),i=e.i(17694),r=e.i(24214),n=e.i(28067);let a=n.POSTHOG_API_KEY;async function s(e,t){for(let i=1;i<=5;i++){try{let{signal:i,...r}=t,n=await fetch(e,{...r,signal:AbortSignal.timeout(5e3)});if(n.ok)return n}catch{}if(i<5){let e=Math.min(1e3*2**(i-1),8e3);await new Promise(t=>setTimeout(t,e))}}return new Response("{}",{status:200})}async function o(){try{if(!(0,i.isTelemetryEnabled)()||globalThis.__FAILPROOFAI_POSTHOG__)return;let t=await e.A(78081),r=process.env.FAILPROOFAI_POSTHOG_KEY??a,n=process.env.FAILPROOFAI_POSTHOG_HOST??"https://us.i.posthog.com";globalThis.__FAILPROOFAI_POSTHOG__=new t.PostHog(r,{host:n,flushAt:1,flushInterval:0,requestTimeout:5e3,fetchRetryCount:0,fetch:s});let o=()=>{globalThis.__FAILPROOFAI_POSTHOG__?.shutdown().catch(()=>{})};process.on("beforeExit",o),process.on("SIGTERM",o),process.on("SIGINT",o)}catch(e){console.warn("[failproofai:telemetry] init failed:",e instanceof Error?e.message:e)}}e.s(["initTelemetry",0,o,"trackEvent",0,function(e,a){if(!(0,i.isTelemetryEnabled)())return;let s=globalThis.__FAILPROOFAI_POSTHOG__;s&&s.capture({distinctId:(0,t.getInstanceId)(),event:e,properties:{...a,$lib:"failproofai",failproofai_version:r.version,product:n.POSTHOG_PRODUCT}})}])},24214,(e,t,i)=>{t.exports={name:"failproofai",version:"1.0.1-beta.0",description:"The easiest way to manage policies that keep your AI agents reliable, on-task, and running autonomously — for Claude Code & the Agents SDK",bin:{failproofai:"./dist/cli.mjs",failproofaid:"./bin/failproofaid-shim.mjs"},files:["bin/","src/","scripts/","lib/","pi-extension/","openclaw-plugin/",".next/standalone/","dist/","README.md"],engines:{node:">=20.9.0",bun:">=1.3.0"},scripts:{predev:"bun run build:cli && bun link",dev:"FAILPROOFAI_TELEMETRY_DISABLED=1 bun scripts/dev.ts --port 8020","build:cli":"bun build --target=node --format=esm --outfile=dist/cli.mjs bin/failproofai.mjs --external posthog-node --external sql.js && node -e \"const fs=require('fs');const c=fs.readFileSync('dist/cli.mjs','utf8');fs.writeFileSync('dist/cli.mjs',c.replace('#!/usr/bin/env bun','#!/usr/bin/env node').replace('// @bun\\n',''))\"","build:worker":"bun build --target=node --format=esm --outfile=dist/worker.mjs bin/failproofai-worker.mjs --external posthog-node --external sql.js",build:"bun build --target=node --format=cjs --outfile=dist/index.js src/index.ts && bun run build:cli && bun run build:worker && bun --bun next build && node -e \"const {cpSync}=require('fs');cpSync('.next/static','.next/standalone/.next/static',{recursive:true});\" && node scripts/prune-standalone.mjs",prestart:"bun run build:cli && bun link",start:"FAILPROOFAI_TELEMETRY_DISABLED=1 bun scripts/start.ts",test:"vitest","test:run":"vitest run",lint:"eslint . --config eslint.config.mjs",prepare:"bun run build","test:e2e":"vitest run --config vitest.config.e2e.mts","test:e2e:watch":"vitest --config vitest.config.e2e.mts",translate:"bun scripts/translate-docs/cli.ts","translate:readme":"bun scripts/translate-docs/cli.ts --readme-only","translate:docs":"bun scripts/translate-docs/cli.ts --docs-only","translate:dry-run":"bun scripts/translate-docs/cli.ts --dry-run","translate:validate":"bun scripts/translate-docs/cli.ts --validate","validate:mdx":"bun scripts/validate-mdx.ts","docs:audit":"bun scripts/docs-audit.ts"},keywords:["claude","claude-code","claude-agents-sdk","anthropic","ai-agent","agent-reliability","agent-monitoring","autonomous-agent","failure-prevention","developer-tools","devtools","cli","local-first","hooks","policies"],author:"ExosphereHost Inc. <failproofai@exosphere.host>",license:"SEE LICENSE IN LICENSE",homepage:"https://github.com/FailproofAI/failproofai",repository:{type:"git",url:"https://github.com/FailproofAI/failproofai.git"},bugs:{url:"https://github.com/FailproofAI/failproofai/issues"},publishConfig:{access:"public"},devDependencies:{"@anthropic-ai/sdk":"^0.116.0","@mdx-js/mdx":"^3.1.1","@tailwindcss/postcss":"^4.3.1","@tanstack/react-virtual":"^3.14.9","@testing-library/jest-dom":"^7.0.0","@testing-library/react":"^16.3.2","@testing-library/user-event":"^14.6.1","@types/node":"26.2.0","@types/react":"19.2.18","@types/react-dom":"^19.2.3","@vitejs/plugin-react":"^6.0.5",clsx:"^2.1.1",eslint:"^10.5.0","eslint-config-next":"^16.2.9",jsdom:"^30.0.1","lucide-react":"^1.28.0",next:"^16.2.11",react:"^19.2.4","react-dom":"^19.2.4","tailwind-merge":"^3.4.0",tailwindcss:"^4.3.1",typescript:"6.0.3",vitest:"^4.1.9"},dependencies:{"html-to-image":"^1.11.13","posthog-node":"^5.47.7","sql.js":"^1.14.1",yaml:"^2.9.0"},overrides:{nanoid:"3.3.18",postcss:"8.5.26","eslint-plugin-react-hooks":"7.0.1",vite:"8.0.16",undici:"7.29.0","brace-expansion":"5.0.9",sharp:"0.35.0"},optionalDependencies:{"@failproofai/failproofaid-linux-x64":"1.0.1-beta.0","@failproofai/failproofaid-linux-arm64":"1.0.1-beta.0","@failproofai/failproofaid-darwin-x64":"1.0.1-beta.0","@failproofai/failproofaid-darwin-arm64":"1.0.1-beta.0"},failproofaidBinaries:{"linux-x64":"8259a934de6ae1302e49a7e7d81e7caac533fa8437167fddc2a9b36d05745ce2","linux-arm64":"c9a4e90c94c23c78973ddb26740f39ab4d3368da5567cebe475e805049c158e9","darwin-x64":"cf0c70a0dab9f737a9ffde27b3ab3fb18ef159b851656ef778ed193a0a72a476","darwin-arm64":"f4d4e300339acc7557251a96500c24e8d675f934febc9d587560cf0544d3eef1"}}},28067,e=>{"use strict";e.s(["POSTHOG_API_KEY",0,"phc_Ac1Ww1GqKc0z1SyrRWbmatEeQdlOQIsDEEdP8l8JRgX","POSTHOG_PRODUCT",0,"failproofai-oss"])}];
 
 //# sourceMappingURL=_0lxbzdq._.js.map

package/.next/standalone/.next/server/chunks/_1ek68ln._.js

@@ -1,6 +1,6 @@
 module.exports=[97610,e=>{"use strict";var t=e.i(89171),i=e.i(71809),n=e.i(50227),o=e.i(2157),s=e.i(12714),r=e.i(74533),a=e.i(60526);function l(e){return e?{decision:"allow",reason:e}:{decision:"allow"}}function c(e){return{decision:"deny",reason:e}}function d(e){return{decision:"instruct",reason:e}}let p="__FAILPROOFAI_POLICY_REGISTRY__",u="__FAILPROOFAI_POLICY_INDEX_CACHE__",m="failproofai";function f(e){return e.includes("/")?e:`${m}/${e}`}function h(e){globalThis[u]=e}function g(){let e=globalThis;return e[p]||(e[p]=[]),e[p]}var y=e.i(79857);let b={info:0,warn:1,error:2},w=(0,y.logsDir)(),k=!1,v="warn",N=!1,S=w;function T(e){return!function(){if(k)return;k=!0;let e=(process.env.FAILPROOFAI_LOG_LEVEL??"").toLowerCase();("info"===e||"warn"===e||"error"===e)&&(v=e);let t=(process.env.FAILPROOFAI_HOOK_LOG_FILE??"").trim();t&&(N=!0,"1"!==t&&"true"!==t&&(S=t))}(),b[e]>=b[v]}function P(e,t){process.stderr.write(`[failproofai:hook] ${e} ${t}
 `)}function E(e,t){if(N)try{(0,o.existsSync)(S)||(0,o.mkdirSync)(S,{recursive:!0});let i=(0,n.join)(S,"hooks.log");try{if((0,o.statSync)(i).size>=524288){let e=`hooks-${Date.now()}.log`;(0,o.renameSync)(i,(0,n.join)(S,e))}}catch{}let s=new Date().toISOString(),r=`[${s}] ${e} ${t}
-`;(0,o.appendFileSync)(i,r,"utf-8")}catch{}}function $(e){T("info")&&(P("INFO",e),E("INFO",e))}function C(e){T("warn")&&(P("WARN",e),E("WARN",e))}let I=function(e){let t=e.replaceAll("\\","/");for(let e of[".claude",".codex",".copilot",".cursor",".opencode",".pi",".gemini"]){let i=(0,n.join)((0,a.homedir)(),e).replaceAll("\\","/");if(t===i||t.startsWith(i+"/"))return!0}for(let e of[(0,n.join)(".config","opencode"),(0,n.join)(".local","share","opencode")]){let i=(0,n.join)((0,a.homedir)(),e).replaceAll("\\","/");if(t===i||t.startsWith(i+"/"))return!0}return!1},x=function(e){return!!(/[\\/]\.claude[\\/]settings(?:\.[^/\\]+)?\.json$/.test(e)||/[\\/]\.codex[\\/]hooks\.json$/.test(e)||/[\\/]\.copilot[\\/]hooks[\\/][^/\\]+\.json$/.test(e)||/[\\/]\.github[\\/]hooks[\\/][^/\\]+\.json$/.test(e)||/[\\/]\.cursor[\\/]hooks\.json$/.test(e)||/[\\/]\.opencode[\\/]opencode\.jsonc?$/.test(e)||/[\\/]\.opencode[\\/]plugins[\\/][^/\\]+\.(?:mjs|js|ts)$/.test(e)||/[\\/]\.config[\\/]opencode[\\/]opencode\.jsonc?$/.test(e)||/[\\/]\.config[\\/]opencode[\\/]config\.json$/.test(e)||/[\\/]\.config[\\/]opencode[\\/]plugins[\\/][^/\\]+\.(?:mjs|js|ts)$/.test(e)||/[\\/]\.pi[\\/](?:agent[\\/])?settings\.json$/.test(e)||/[\\/]\.pi[\\/](?:agent[\\/])?extensions[\\/]/.test(e)||/[\\/]\.gemini[\\/]settings\.json$/.test(e)||/[\\/]\.gemini[\\/]config[\\/]hooks\.json$/.test(e))};function A(e){return e.toolInput?.command??""}function R(e){return e.toolInput?.file_path??""}function O(e){return e.trim().split(/\s+/).map(e=>e.replace(/^['"]|['"]$/g,""))}let _=new Set(["&&","||","|",";"]),B=/[;&<>`$()\\]/,j=/eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/,D=[[/sk-ant-[A-Za-z0-9\-_]{20,}/,"Anthropic API key"],[/sk-proj-[A-Za-z0-9\-_]{20,}/,"OpenAI project API key"],[/sk-[A-Za-z0-9]{20,}/,"OpenAI API key"],[/ghp_[A-Za-z0-9]{36}/,"GitHub personal access token"],[/github_pat_[A-Za-z0-9_]{82}/,"GitHub fine-grained token"],[/AKIA[A-Z0-9]{16}/,"AWS access key ID"],[/sk_live_[A-Za-z0-9]{24,}/,"Stripe live secret key"],[/sk_test_[A-Za-z0-9]{24,}/,"Stripe test secret key"],[/AIza[0-9A-Za-z\-_]{35}/,"Google API key"]],W=/(?:postgresql|postgres|mysql|mongodb(?:\+srv)?|redis|amqps?|smtps?):\/\/[^@\s]+@/,M=/-----BEGIN (?:[A-Z]+ )?PRIVATE KEY-----/,U=/Authorization:\s*Bearer\s+[A-Za-z0-9\-._~+/]{20,}/i,L=/\b(?:psql|mysql|sqlite3|pgcli|clickhouse-client)\b/,z=/\b(?:DROP\s+(?:TABLE|DATABASE|SCHEMA)|TRUNCATE\b)/i,F=/\bDELETE\s+FROM\b/i,H=/\bWHERE\b/i,q=/\bALTER\s+TABLE\b[\s\S]*\b(?:DROP\s+COLUMN|ADD\s+COLUMN|RENAME\s+(?:COLUMN|TO)|MODIFY\s+COLUMN)\b/i,J=/(?:npm\s+publish|bun\s+publish|pnpm\s+publish|yarn\s+npm\s+publish|twine\s+upload|poetry\s+publish|cargo\s+publish|gem\s+push)\b/,G=/(?:^|\s|;|&&|\|\|)(?:env|printenv)(?:\s|$|;|&&|\|)/,Y=/echo\s+.*\$\{?[A-Za-z_]/,Z=/(?:^|\s|;|&&|\|\|)export\s+\w+/,K=/\$env:[A-Za-z_]/i,Q=/(?:Get-ChildItem|dir|gci|ls)\s+Env:/i,V=/\[Environment\]::GetEnvironment/i,X=/echo\s+%[A-Za-z_]/i,ee=/(?:^|[\\/])\.env(?:\.|$)/,et=/\.env(?:\b|\s|$|\.)/,ei=/Start-Process\s+.*-Verb\s+RunAs/i,en=/(?:^|;|&&|\|\|)\s*runas\s/i,eo=/(?:curl|wget)\s.*\|\s*(?:sh|bash|zsh|dash|ksh|csh|tcsh|fish|ash)\b/,es=/[;&|\n\r(){}`]+/,er=new Set(["npx","bunx","pnpx","npm","pnpm","yarn","dlx","exec","run","node","bun","deno","env","command","builtin","nohup","setsid","time","timeout","nice","stdbuf","xargs","sudo","doas","sh","bash","zsh","dash","ksh","fish","ash"]),ea=/(?:^|\/)failproofai[^/]*$/,el=/^(?:config|configure|setup)$/,ec=/^--pause(?:=|$)/,ed=/^[A-Za-z_][A-Za-z0-9_]*=/,ep=/^\d+[a-z]*$/i;function eu(e){for(let t of e.split(es)){let e=t.split(/\s+/).filter(Boolean),i=0;for(;i<e.length;){let t=e[i];if(!(ed.test(t)||t.startsWith("-")||t.startsWith(">")||t.startsWith("<")||ep.test(t)||er.has(t.slice(t.lastIndexOf("/")+1))))break;i++}if(i>=e.length||!ea.test(e[i]))continue;let n=e.slice(i+1),o=n.findIndex(e=>el.test(e));if(-1!==o&&n.slice(o+1).some(e=>ec.test(e)))return!0}return!1}let em=/(?:Invoke-WebRequest|iwr|Invoke-RestMethod|irm)\s+.*\|\s*(?:Invoke-Expression|iex)/i,ef=/^-[a-zA-Z]*f[a-zA-Z]*$/,eh=["--force-with-lease","--force-if-includes"],eg=/\.(?:pem|key)$/,ey=/id_rsa/,eb=/credentials/,ew=/git\s+(commit|merge|rebase|cherry-pick)\b/,ek=/(?:^|;|&&|\|\||\|)\s*failproofai(?:\s|$)/,ev=/(?:npm\s+(?:uninstall|remove|un|r)\s.*failproofai|bun\s+remove\s.*failproofai|yarn\s+global\s+remove\s+failproofai|pnpm\s+(?:remove|uninstall|un)\s.*failproofai)/,eN=/\bgit\s+commit\b.*--amend\b/,eS=/\bgit\s+stash\s+(?:drop|clear)\b/,eT=/\bgit\s+add\s+(?:-A\b|--all\b|\.(?:\s|$|;|&&|\|\|))/,eP=/\bnpm\s+(?:install|i)\b(?=.*(?:\s-g\b|--global\b))/,eE=/\byarn\s+global\s+add\b/,e$=/\bpnpm\s+(?:add|install|i)\b(?=.*(?:\s-g\b|--global\b))/,eC=/\bbun\s+(?:install|add)\b(?=.*(?:\s-g\b|--global\b))/,eI=/\bcargo\s+install\b/,ex=/\bpip(?:3)?\s+install\b(?=.*(?:--user\b|--break-system-packages\b))/,eA={pip:[/\bpip\b/,/\bpip3\b/,/\bpython3?\s+-m\s+pip\b/],npm:[/\bnpm\b/,/\bnpx\b/],yarn:[/\byarn\b/],pnpm:[/\bpnpm\b/,/\bpnpx\b/],bun:[/\bbun\b/,/\bbunx\b/],uv:[/\buv\b/],poetry:[/\bpoetry\b/],pipenv:[/\bpipenv\b/],conda:[/\bconda\b/],cargo:[/\bcargo\b/]},eR=/\bnohup\s+\S/,eO=/\bscreen\s+-[A-Za-z]*d[A-Za-z]*\b/,e_=/\btmux\s+(?:new-session|new)\b[^|&;]*-d\b/,eB=/\bdisown\b/,ej=/(?<![&|])\s?&\s*(?:$|#|;)/,eD=/(?:^|[;\n]|&&|\|\|?|&)\s*kubectl(?:\s|$)/,eW=/(?:^|[;\n]|&&|\|\|?|&)\s*(?:terraform|tofu)(?:\s|$)/,eM=/(?:^|[;\n]|&&|\|\|?|&)\s*aws(?:\s|$)/,eU=/(?:^|[;\n]|&&|\|\|?|&)\s*gcloud(?:\s|$)/,eL=/(?:^|[;\n]|&&|\|\|?|&)\s*az(?:\s|$)/,ez=/(?:^|[;\n]|&&|\|\|?|&)\s*helm(?:\s|$)/,eF=/(?:^|[;\n]|&&|\|\|?|&)\s*gh\s+(?:workflow\s+(?:run|enable|disable)|run\s+(?:rerun|cancel)|pr\s+merge|release\s+(?:create|delete)|cache\s+delete|secret\s+(?:set|delete))\b/,eH=new Map;function eq(e){try{let t=function(e){try{return(0,o.statSync)((0,n.join)(e,".git","HEAD")).mtimeMs}catch{return null}}(e),i=eH.get(e);if(i&&null!==t&&i.headMtimeMs===t)return i.branch||null;let s=(0,r.execSync)("git rev-parse --abbrev-ref HEAD",{cwd:e,encoding:"utf8",stdio:["pipe","pipe","pipe"],timeout:3e3}).trim();return null!==t&&(eH.size>=500&&eH.clear(),eH.set(e,{branch:s,headMtimeMs:t})),s||null}catch{return null}}function eJ(e,t){let i=O(e),n=O(t);return!(i.length<n.length||i.some(e=>_.has(e))||i.some(e=>B.test(e)))&&n.every((e,t)=>"*"===e||e===i[t])}let eG=/^-{1,2}c$/;function eY(e){return e.split(/&&|\|\||[|;\n]/).map(e=>e.trim()).filter(e=>/^git\s+push\s/.test(e)).map(e=>e.replace(/^git\s+push\s+/,""))}let eZ=/^(?:~[A-Za-z0-9_.-]*|\$HOME|\$\{HOME\})(?=$|\/)/,eK=/^(?:\/\S*\/)?rm$/,eQ=/^(?:\/\S*\/)?find$/,eV=/^-(?:exec|execdir|ok|okdir)$/,eX=/^-(?:[HLP]|D|O\d*)$/,e0=/^(?:-|\\?[(!])/,e1=["/tmp","/var/tmp"];function e3(e){let t=e.match(/^(?:~|\$HOME|\$\{HOME\})(?=$|\/)/);return t?(0,a.homedir)()+e.slice(t[0].length):e}function e8(e){return e.replace(/\/\*$/,"").replace(/\/+$/,"")}function e6(e){let t=e.replace(/^['"]|['"]$/g,"");if(""===t)return!1;let i=t.match(eZ);if(!i&&/^[$`]/.test(t))return!0;let n=i?t.slice(i[0].length):t.startsWith("/")?t:null;if(null===n)return!1;let o=e8(n).split("/").filter(Boolean);return!(!i&&e1.some(e=>`/${o.join("/")}`.startsWith(`${e}/`)))&&o.length<=2}function e2(e){let t=O(e),i=t.findIndex(e=>eQ.test(e));if(i>=0){let e=t.slice(i+1),n=e.findIndex(e=>eV.test(e));if(e.includes("-delete")||n>=0&&eK.test(e[n+1]??"")){let t=0;for(;t<e.length&&eX.test(e[t]);)t+="-D"===e[t]?2:1;let i=e.slice(t),n=i.findIndex(e=>e0.test(e));return n<0?i:i.slice(0,n)}}let n=t.findIndex(e=>eK.test(e));if(n>=0){let e=t.slice(n+1),i=e.filter(e=>/^-[^-]/.test(e)).join(""),o=e.filter(e=>/^--/.test(e)),s=/r/i.test(i)||o.some(e=>/^--recursive$/i.test(e)),r=/f/.test(i)||o.some(e=>/^--force$/i.test(e));if(s&&r)return e.filter(e=>!e.startsWith("-"))}return null}function e4(e){return e.split(/&&|\|\||[|;\n]/).map(e=>e.trim()).filter(e=>""!==e)}let e9=/(?:^|;|&&|\|\||\|)\s*(?:ls|find|cat|head|tail|less|more|wc|file|stat|tree|du)\s/;function e5(e,t,i){if("Bash"!==e.toolName)return l();let n=A(e);return!t.test(n)||(e.params?.allowPatterns??[]).some(e=>eJ(n,e))?l():c(i)}let e7=/\s*(?:&&|\|\||\||;)\s*/;function te(e){return e.session?.permissionMode==="plan"}let tt=[{name:"sanitize-jwt",description:"Stop Claude from reading JWTs in tool responses",displayTitle:"Redacted JWT tokens from tool output",impact:"Stops the agent from echoing auth tokens it saw in command output.",fn:function(e){let t=JSON.stringify(e.payload);return j.test(t)?{decision:"deny",reason:"JWT token detected in tool output",message:"[REDACTED: JWT token removed by failproofai]"}:l()},match:{events:["PostToolUse"]},defaultEnabled:!0,category:"Sanitize"},{name:"sanitize-api-keys",description:"Stop Claude from reading API keys (OpenAI, Anthropic, GitHub, AWS, Stripe, Google) in tool responses",displayTitle:"Redacted API keys from tool output",impact:"Catches OpenAI / Anthropic / GitHub / AWS / Stripe / Google keys before the model sees them.",fn:function(e){let t=JSON.stringify(e.payload);for(let[e,i]of D)if(e.test(t))return{decision:"deny",reason:`${i} detected in tool output`,message:`[REDACTED: ${i} removed by failproofai]`};for(let{regex:i,label:n}of e.params?.additionalPatterns??[])try{if(new RegExp(i).test(t))return{decision:"deny",reason:`${n} detected in tool output`,message:`[REDACTED: ${n} removed by failproofai]`}}catch{C(`additionalPatterns: invalid regex "${i}", skipping`)}return l()},match:{events:["PostToolUse"]},defaultEnabled:!0,category:"Sanitize",params:{additionalPatterns:{type:"pattern[]",description:"Additional API key patterns to scrub, each with { regex, label }",default:[]}}},{name:"sanitize-connection-strings",description:"Stop Claude from reading database connection strings with embedded credentials in tool responses",displayTitle:"Redacted database connection strings from tool output",impact:"Strips embedded DB credentials before they reach the model context.",fn:function(e){let t=JSON.stringify(e.payload);return W.test(t)?{decision:"deny",reason:"Database connection string with credentials detected in tool output",message:"[REDACTED: connection string removed by failproofai]"}:l()},match:{events:["PostToolUse"]},defaultEnabled:!0,category:"Sanitize"},{name:"sanitize-private-key-content",description:"Stop Claude from reading PEM private key content in tool responses",displayTitle:"Redacted PEM private keys from tool output",impact:"Prevents private key bodies from being echoed into chat context.",fn:function(e){let t=JSON.stringify(e.payload);return M.test(t)?{decision:"deny",reason:"Private key content detected in tool output",message:"[REDACTED: private key content removed by failproofai]"}:l()},match:{events:["PostToolUse"]},defaultEnabled:!0,category:"Sanitize"},{name:"sanitize-bearer-tokens",displayTitle:"Redacted bearer tokens from tool output",impact:"Strips Authorization: Bearer values before they hit the model.",description:"Stop Claude from reading Authorization Bearer tokens in tool responses",fn:function(e){let t=JSON.stringify(e.payload);return U.test(t)?{decision:"deny",reason:"Bearer token detected in tool output",message:"[REDACTED: Bearer token removed by failproofai]"}:l()},match:{events:["PostToolUse"]},defaultEnabled:!0,category:"Sanitize"},{name:"protect-env-vars",displayTitle:"Tried to dump environment variables to chat",impact:"Env vars often contain secrets; blocking `env` / `printenv` keeps them out of the model context.",description:"Prevent commands that read environment variables",fn:function(e){if("Bash"!==e.toolName)return l();let t=A(e);return G.test(t)?c("Command reads environment variables"):Y.test(t)?c("Command echoes environment variable"):Z.test(t)?c("Command exports environment variable"):K.test(t)?c("Command reads environment variable via PowerShell"):Q.test(t)?c("Command reads environment variables via PowerShell"):V.test(t)?c("Command reads environment variable via .NET"):X.test(t)?c("Command echoes environment variable via cmd"):l()},match:{events:["PreToolUse"],toolNames:["Bash"]},defaultEnabled:!0,category:"Environment"},{name:"block-env-files",displayTitle:"Tried to read or write a .env file",impact:"`.env` files routinely contain API keys and DB credentials.",description:"Block reading/writing .env files",fn:function(e){let t=A(e),i=R(e);return i&&ee.test(i)?c("Access to .env file blocked"):"Bash"===e.toolName&&et.test(t)?c("Command references .env file"):l()},match:{events:["PreToolUse"]},defaultEnabled:!0,category:"Environment"},{name:"block-read-outside-cwd",displayTitle:"Tried to read files outside your project directory",impact:"Stops the agent from peeking at neighboring repos or your home directory.",description:"Block file reads outside the session working directory",fn:function(e){let t=process.env.CLAUDE_PROJECT_DIR||e.session?.cwd;if(!t)return l();let i=e.params?.allowPaths??[];if("Bash"===e.toolName){let o=A(e);if(!e9.test(o))return l();let s=function(e){let t,i=[],o=/(?<![a-zA-Z0-9_.\-~\\*?:=])(?:~\/[^\s;|&"'()\[\]{}]*|~(?=\s|$|[;|&"'()\[\]{}])|\/[^\s;|&"'()\[\]{}]*)/g;function s(e){let t;for(o.lastIndex=0;null!==(t=o.exec(e));){let e=t[0];"~"===e?e=(0,a.homedir)():e.startsWith("~/")&&(e=(0,n.join)((0,a.homedir)(),e.slice(2))),i.push(e)}}let r=e.length,l=!1,c=!1;for(let t=0;t<e.length;t++){let i=e[t];if('"'!==i||c)if("'"!==i||l){if("|"===i&&!l&&!c){r=t;break}}else c=!c;else l=!l}let d=e.slice(0,r),p=/"([^"]*)"|'([^']*)'/g;for(;null!==(t=p.exec(d));){let e=t[1]??t[2]??"";/[*?\[\]^$+()\\]/.test(e)||s(e)}return s(e.replace(/"[^"]*"/g,e=>" ".repeat(e.length)).replace(/'[^']*'/g,e=>" ".repeat(e.length))),i}(o),r=t.endsWith("/")?t:t+"/";for(let e of s){let o=(0,n.resolve)(t,e);if(x(o))return c(`Reading agent settings file blocked: ${o}`);if(!I(o)&&"/dev/null"!==o&&o!==t&&!o.startsWith(r)){if(i.some(e=>o===e||o.startsWith(e.endsWith("/")?e:e+"/")))continue;return c(`Bash read outside project directory blocked: ${o}`)}}return l()}let o=R(e),s=e.toolInput?.path??"",r=o||s;if(!r)return l();let d=(0,n.resolve)(t,r);if(x(d))return c(`Reading agent settings file blocked: ${d}`);if(I(d)||"/dev/null"===d)return l();let p=t.endsWith("/")?t:t+"/";return d===t||d.startsWith(p)?l():i.some(e=>d===e||d.startsWith(e.endsWith("/")?e:e+"/"))?l():c(`Access outside project directory blocked: ${d}`)},match:{events:["PreToolUse"],toolNames:["Read","Glob","Grep","Bash"]},defaultEnabled:!1,category:"Environment",params:{allowPaths:{type:"string[]",description:"Absolute paths outside cwd that are allowed to be read",default:[]}}},{name:"block-self-pause",displayTitle:"Tried to pause failproofai enforcement",impact:"An agent that can pause enforcement can switch off every other policy.",description:"Block agents from pausing failproofai enforcement",fn:function(e){if("Bash"!==e.toolName)return l();let t=A(e);return eu(t)||eu(t.replace(/\\\r?\n/g,"").replace(/\$'((?:[^'\\]|\\.)*)'/g,(e,t)=>t.replace(/\\(x[0-9A-Fa-f]{1,2}|u[0-9A-Fa-f]{1,4}|U[0-9A-Fa-f]{1,8}|[0-7]{1,3}|.)/g,(e,t)=>{try{if("x"===t[0])return String.fromCharCode(parseInt(t.slice(1),16));if("u"===t[0]||"U"===t[0])return String.fromCodePoint(parseInt(t.slice(1),16));if(/^[0-7]+$/.test(t))return String.fromCharCode(parseInt(t,8))}catch{return t}return({a:"\x07",b:"\b",e:"\x1b",f:"\f",n:"\n",r:"\r",t:"	",v:"\v","\\":"\\","'":"'",'"':'"',"?":"?"})[t]??t})).replace(/\\(.)/g,"$1").replace(/['"]/g,""))?c("Pausing failproofai enforcement is a human action, not an agent one. If a policy is blocking legitimate work, say so and let the operator decide."):l()},match:{events:["PreToolUse","PermissionRequest"],toolNames:["Bash"]},defaultEnabled:!0,category:"Dangerous Commands"},{name:"block-sudo",displayTitle:"Tried to run a command with sudo",impact:"Sudo gives the agent root — blocked unless explicitly allow-listed.",description:"Block sudo commands",fn:function(e){if("Bash"!==e.toolName)return l();let t=A(e).trimStart();return function e(t,i=0){for(let n of function(e){let t=[],i=[],n="",o=null,s=()=>{n&&i.push(n),n=""},r=()=>{s(),i.length&&t.push(i),i=[]};for(let t=0;t<e.length;t++){let i=e[t];if(o){if("\\"===i&&'"'===o&&t+1<e.length){n+=e[++t];continue}if(i===o){o=null;continue}n+=i;continue}if("\\"===i&&t+1<e.length){n+=e[++t];continue}if('"'===i||"'"===i){o=i;continue}if(/\s/.test(i)){s();continue}if(/[;&|\n\r(){}`]/.test(i)){r();continue}n+=i}return r(),t}(t)){let t=0;for(;t<n.length;){let o=n[t],s=o.slice(o.lastIndexOf("/")+1);if("sudo"===s||"doas"===s)return!0;if(!(ed.test(o)||o.startsWith("-")||o.startsWith(">")||o.startsWith("<")||ep.test(o)||er.has(s)))break;if(eG.test(o)&&i<3&&t+1<n.length&&e(n[t+1],i+1))return!0;t++}}return!1}(t)?(e.params?.allowPatterns??[]).some(e=>eJ(t,e))?l():c("sudo commands are blocked"):ei.test(t)?c("Elevated process launch is blocked"):en.test(t)?c("runas elevation is blocked"):l()},match:{events:["PreToolUse","PermissionRequest"],toolNames:["Bash"]},defaultEnabled:!0,category:"Dangerous Commands",params:{allowPatterns:{type:"string[]",description:"Sudo command patterns to allow, matched token-by-token (e.g. 'sudo systemctl status')",default:[]}}},{name:"block-curl-pipe-sh",displayTitle:"Tried to pipe a downloaded script straight to a shell",impact:"`curl ... | sh` runs unverified remote code on your machine.",description:"Block piping downloads to shell",fn:function(e){if("Bash"!==e.toolName)return l();let t=A(e);return eo.test(t)?c("Piping downloads to shell is blocked"):em.test(t)?c("Piping downloads to Invoke-Expression is blocked"):l()},match:{events:["PreToolUse"],toolNames:["Bash"]},defaultEnabled:!0,category:"Dangerous Commands"},{name:"block-rm-rf",displayTitle:"Tried to recursively delete a system path",impact:"Catches catastrophic `rm -rf /` and Windows equivalents.",description:"Prevent catastrophic deletions",fn:function(e){if("Bash"!==e.toolName)return l();let t=A(e);return e4(t).some(e=>{let t=e2(e);return null!==t&&t.some(e6)})?!function(e,t){if(0===t.length)return!1;let i=t.map(e=>e8(e3(e))||"/"),n=!1;for(let o of e4(e)){let e=e2(o);if(null!==e)for(let s of(n=!0,e)){let e=e8(e3(s))||"/";if(!i.some(t=>e===t||e.startsWith(t+"/"))&&!t.some(e=>{let t=e.replace(/[.*+?^${}()|[\]\\]/g,"\\$&");return RegExp(`${t}(?:[/"'\\s/*]|$)`).test(o)}))return!1}}return n}(t,e.params?.allowPaths??[])?c("Catastrophic deletion blocked"):l():/Remove-Item\s+.*-Recurse.*-Force.*(?:[A-Z]:\\(?:\s|$)|\\\*)/i.test(t)||/(?:rd|rmdir)\s+\/s\s+\/q\s+[A-Z]:\\/i.test(t)?c("Catastrophic deletion blocked"):l()},match:{events:["PreToolUse"],toolNames:["Bash"]},defaultEnabled:!1,category:"Dangerous Commands",params:{allowPaths:{type:"string[]",description:"Paths that are allowed to be recursively deleted",default:[]}}},{name:"block-failproofai-commands",displayTitle:"Tried to disable or modify failproofai itself",impact:"Prevents the agent from turning off the policies that protect you.",description:"Block failproofai CLI commands and uninstallation",fn:function(e){if("Bash"!==e.toolName)return l();let t=A(e);return ek.test(t)?c("Running failproofai CLI commands is blocked"):ev.test(t)?c("Uninstalling failproofai is blocked"):l()},match:{events:["PreToolUse"],toolNames:["Bash"]},defaultEnabled:!0,category:"Dangerous Commands"},{name:"block-kubectl",displayTitle:"Tried to run a Kubernetes command",impact:"kubectl can change live cluster state — gated unless allow-listed.",description:"Block kubectl commands (Kubernetes cluster mutations)",fn:function(e){return e5(e,eD,"kubectl commands are blocked")},match:{events:["PreToolUse"],toolNames:["Bash"]},defaultEnabled:!1,category:"Infra Commands",params:{allowPatterns:{type:"string[]",description:"kubectl command patterns to allow, matched token-by-token (e.g. 'kubectl get *', 'kubectl describe *')",default:[]}}},{name:"block-terraform",displayTitle:"Tried to run a Terraform/OpenTofu command",impact:"Terraform mutates real infrastructure — gated unless allow-listed.",description:"Block terraform and tofu (OpenTofu) commands",fn:function(e){return e5(e,eW,"terraform/tofu commands are blocked")},match:{events:["PreToolUse"],toolNames:["Bash"]},defaultEnabled:!1,category:"Infra Commands",params:{allowPatterns:{type:"string[]",description:"terraform/tofu command patterns to allow (e.g. 'terraform plan', 'terraform validate')",default:[]}}},{name:"block-aws-cli",displayTitle:"Tried to run an AWS CLI command",impact:"AWS CLI can spend money or break prod — gated.",description:"Block aws CLI commands",fn:function(e){return e5(e,eM,"aws CLI commands are blocked")},match:{events:["PreToolUse"],toolNames:["Bash"]},defaultEnabled:!1,category:"Infra Commands",params:{allowPatterns:{type:"string[]",description:"aws CLI command patterns to allow (e.g. 'aws s3 ls *', 'aws sts get-caller-identity')",default:[]}}},{name:"block-gcloud",displayTitle:"Tried to run a Google Cloud command",impact:"gcloud can spend money or break prod — gated.",description:"Block gcloud (Google Cloud) CLI commands",fn:function(e){return e5(e,eU,"gcloud commands are blocked")},match:{events:["PreToolUse"],toolNames:["Bash"]},defaultEnabled:!1,category:"Infra Commands",params:{allowPatterns:{type:"string[]",description:"gcloud command patterns to allow (e.g. 'gcloud auth list', 'gcloud config list')",default:[]}}},{name:"block-az-cli",displayTitle:"Tried to run an Azure CLI command",impact:"az can spend money or break prod — gated.",description:"Block az (Azure) CLI commands",fn:function(e){return e5(e,eL,"az (Azure) CLI commands are blocked")},match:{events:["PreToolUse"],toolNames:["Bash"]},defaultEnabled:!1,category:"Infra Commands",params:{allowPatterns:{type:"string[]",description:"az CLI command patterns to allow (e.g. 'az account show', 'az group list')",default:[]}}},{name:"block-helm",displayTitle:"Tried to run a Helm command",impact:"Helm releases mutate cluster state — gated.",description:"Block helm commands",fn:function(e){return e5(e,ez,"helm commands are blocked")},match:{events:["PreToolUse"],toolNames:["Bash"]},defaultEnabled:!1,category:"Infra Commands",params:{allowPatterns:{type:"string[]",description:"helm command patterns to allow (e.g. 'helm list', 'helm status *')",default:[]}}},{name:"block-gh-pipeline",displayTitle:"Tried to run a privileged GitHub CLI pipeline command",impact:"Catches `gh workflow run`, `gh pr merge`, `gh secret set`, etc.",description:"Block gh CLI pipeline-trigger subcommands (workflow run, run rerun/cancel, pr merge, release create/delete, cache delete, secret set/delete)",fn:function(e){return e5(e,eF,"gh pipeline-trigger commands are blocked")},match:{events:["PreToolUse"],toolNames:["Bash"]},defaultEnabled:!1,category:"Infra Commands",params:{allowPatterns:{type:"string[]",description:"gh pipeline command patterns to allow (e.g. specific scripted invocations); read-only gh subcommands like 'gh pr view' and 'gh run list' are not matched by this policy",default:[]}}},{name:"block-secrets-write",displayTitle:"Tried to write a secret-key file",impact:"Stops the agent from creating `.pem`, `id_rsa`, `credentials.json`, etc.",description:"Block writing secret key files",fn:function(e){if("Write"!==e.toolName)return l();let t=R(e);if(eg.test(t)||ey.test(t)||eb.test(t))return c("Writing secret key files is blocked");for(let i of e.params?.additionalPatterns??[])if(t.includes(i))return c(`Writing blocked file pattern: ${i}`);return l()},match:{events:["PreToolUse"],toolNames:["Write"]},defaultEnabled:!1,category:"Dangerous Commands",params:{additionalPatterns:{type:"string[]",description:"Additional filename patterns (substrings) to block",default:[]}}},{name:"block-push-master",displayTitle:"Tried to push directly to main/master",impact:"Direct pushes to a protected branch bypass review.",description:"Block pushing to main/master",fn:function(e){if("Bash"!==e.toolName)return l();let t=e.params?.protectedBranches??["main","master"];if(0===t.length)return l();let i=eY(A(e)),n=RegExp(`\\b(?:${t.map(e=>e.replace(/[.*+?^${}()|[\]\\]/g,"\\$&")).join("|")})\\b`);return i.some(e=>n.test(e))?c(`Pushing to ${t.join("/")} is blocked`):l()},match:{events:["PreToolUse"],toolNames:["Bash"]},defaultEnabled:!0,category:"Git",params:{protectedBranches:{type:"string[]",description:"Branch names to protect from direct pushes",default:["main","master"]}}},{name:"block-force-push",displayTitle:"Tried to force-push",impact:"Force-pushes rewrite history and can clobber teammates' work.",description:"Prevent force-pushing to any branch",fn:function(e){if("Bash"!==e.toolName)return l();for(let t of eY(A(e))){let e=!1;for(let i of t.split(/\s+/)){if("--"===i){e=!0;continue}if(!e&&function(e){return"--force"===e||!eh.some(t=>e.startsWith(t))&&(!!e.startsWith("--force")||ef.test(e))}(i))return c("Force-pushing is blocked")}}return l()},match:{events:["PreToolUse"],toolNames:["Bash"]},defaultEnabled:!1,category:"Git"},{name:"block-work-on-main",displayTitle:"Tried to commit or merge on main/master",impact:"Work should land via PR — direct commits skip review.",description:"Block git commits and merges on main/master branch",fn:function(e){if("Bash"!==e.toolName)return l();let t=A(e).match(ew);if(!t)return l();let i=e.session?.cwd;if(!i)return l();let n=eq(i);return n&&(e.params?.protectedBranches??["main","master"]).includes(n)?c(`Git ${t[1]} on ${n} is blocked. Create a feature branch first.`):l()},match:{events:["PreToolUse"],toolNames:["Bash"]},defaultEnabled:!1,category:"Git",params:{protectedBranches:{type:"string[]",description:"Branch names where commits/merges are blocked",default:["main","master"]}}},{name:"warn-git-amend",displayTitle:"Used git commit --amend",impact:"Amending after a push rewrites history that others may have pulled.",description:"Warns before amending git commits, which rewrites history",fn:function(e){if("Bash"!==e.toolName)return l();let t=A(e);return eN.test(t)?d("STOP: This command amends the last commit, which rewrites git history. If this commit has already been pushed to a shared branch, this will cause divergence for other contributors. Confirm with the user before executing."):l()},match:{events:["PreToolUse"],toolNames:["Bash"]},defaultEnabled:!1,category:"Git"},{name:"warn-git-stash-drop",displayTitle:"Tried to drop or clear git stash",impact:"Stash deletions are permanent and silent.",description:"Warns before permanently deleting stashed changes",fn:function(e){if("Bash"!==e.toolName)return l();let t=A(e);return eS.test(t)?d("STOP: This command permanently deletes stashed changes (git stash drop/clear). Stash entries cannot be recovered after deletion. Confirm with the user before executing."):l()},match:{events:["PreToolUse"],toolNames:["Bash"]},defaultEnabled:!1,category:"Git"},{name:"warn-all-files-staged",displayTitle:"Staged all files with git add -A / .",impact:"Wide stages routinely catch generated files or secrets you didn't intend to commit.",description:"Warns before staging all working tree files with git add -A / . / --all",fn:function(e){if("Bash"!==e.toolName)return l();let t=A(e);return eT.test(t)?d("STOP: This command stages all files in the working tree (git add -A / --all / .). This may inadvertently include build artifacts, generated files, or sensitive files not covered by .gitignore. Confirm with the user before executing."):l()},match:{events:["PreToolUse"],toolNames:["Bash"]},defaultEnabled:!1,category:"Git"},{name:"warn-destructive-sql",displayTitle:"Ran destructive SQL (DROP / TRUNCATE / DELETE without WHERE)",impact:"Easy way to wipe a table by accident.",description:"Warn before executing destructive SQL (DROP/TRUNCATE/DELETE without WHERE) via database clients",fn:function(e){if("Bash"!==e.toolName)return l();let t=A(e);return L.test(t)&&(z.test(t)||F.test(t)&&!H.test(t))?d("STOP: This command contains destructive SQL (DROP/TRUNCATE/DELETE). Confirm with the user before executing."):l()},match:{events:["PreToolUse"],toolNames:["Bash"]},defaultEnabled:!1,category:"Database"},{name:"warn-schema-alteration",displayTitle:"Altered a database schema column",impact:"ALTER TABLE operations can lock tables and break readers.",description:"Warns before SQL schema changes (ALTER TABLE with column or rename operations)",fn:function(e){if("Bash"!==e.toolName)return l();let t=A(e);return L.test(t)&&q.test(t)?d("STOP: This command contains a schema-altering SQL statement (ALTER TABLE with column or rename operation). Schema changes on production databases are irreversible or disruptive. Confirm with the user before executing."):l()},match:{events:["PreToolUse"],toolNames:["Bash"]},defaultEnabled:!1,category:"Database"},{name:"warn-package-publish",displayTitle:"Tried to publish a package",impact:"Publishes are irreversible — `npm publish` / `cargo publish` shouldn't happen without intent.",description:"Warn before publishing packages to public registries (npm, PyPI, crates.io, RubyGems, etc.)",fn:function(e){if("Bash"!==e.toolName)return l();let t=A(e);return J.test(t)?d("STOP: This command publishes a package to a public registry. Confirm with the user that this is intentional."):l()},match:{events:["PreToolUse"],toolNames:["Bash"]},defaultEnabled:!1,category:"Packages & System"},{name:"warn-global-package-install",displayTitle:"Installed a package globally",impact:"`npm i -g`, `cargo install`, `pip --user` pollute your machine outside the project.",description:"Warns before installing packages globally (npm -g, cargo install, etc.)",fn:function(e){if("Bash"!==e.toolName)return l();let t=A(e);return eP.test(t)||eE.test(t)||e$.test(t)||eC.test(t)||eI.test(t)||ex.test(t)?d("STOP: This command installs a package globally, which modifies the system-wide environment outside the project. This can conflict with other projects or system tools. Confirm with the user before executing."):l()},match:{events:["PreToolUse"],toolNames:["Bash"]},defaultEnabled:!1,category:"Packages & System"},{name:"prefer-package-manager",displayTitle:"Used a non-preferred package manager",impact:"Mixing package managers creates lockfile churn for your team.",description:"Blocks non-preferred package managers and tells Claude to use an allowed one (e.g., uv instead of pip)",fn:function(e){if("Bash"!==e.toolName)return l();let t=A(e);if(!t)return l();let i=e.params?.allowed??[];if(0===i.length)return l();let n=new Set(i.map(e=>e.toLowerCase())),o=e.params?.blocked??[],s=i.join(", ");for(let e of t.split(e7)){let t=e.trim();if(!t)continue;let i=!1;for(let e of n){let n=eA[e];if(n){for(let e of n)if(e.test(t)){i=!0;break}if(i)break}}if(!i){for(let[e,i]of Object.entries(eA))if(!n.has(e)){for(let n of i)if(n.test(t))return c(`"${e}" is not an allowed package manager. Allowed package managers for this project: ${s}. Rewrite this command using an allowed package manager.`)}for(let e of o){let i=e.toLowerCase();if(!n.has(i)&&RegExp(`\\b${i.replace(/[.*+?^${}()|[\]\\]/g,"\\$&")}\\b`).test(t))return c(`"${i}" is not an allowed package manager. Allowed package managers for this project: ${s}. Rewrite this command using an allowed package manager.`)}}}return l()},match:{events:["PreToolUse"],toolNames:["Bash"]},defaultEnabled:!1,category:"Packages & System",params:{allowed:{type:"string[]",description:"Allowed package manager names (e.g. ['uv', 'bun']). Any detected manager not in this list is blocked.",default:[]},blocked:{type:"string[]",description:"Additional manager names to block beyond the built-in list (e.g. ['pdm', 'pipx']).",default:[]}}},{name:"warn-large-file-write",displayTitle:"Wrote a file larger than the configured threshold",impact:"Catches accidentally large file writes (logs, binaries, model dumps).",description:"Warn before writing files larger than 1MB (configurable via thresholdKb param)",fn:function(e){if("Write"!==e.toolName)return l();let t=e.toolInput?.content;if("string"!=typeof t)return l();let i=e.params?.thresholdKb??1024;return t.length>1024*i?d(`STOP: You are writing a file larger than ${i}KB (${Math.round(t.length/1024)}KB). This is unusually large. Confirm this is intentional before proceeding.`):l()},match:{events:["PreToolUse"],toolNames:["Write"]},defaultEnabled:!1,category:"Packages & System",params:{thresholdKb:{type:"number",description:"File size threshold in KB above which a warning is issued",default:1024}}},{name:"warn-background-process",displayTitle:"Started a long-lived background process",impact:"Catches `nohup` / `&` / `screen` / `tmux` / `disown` patterns that the agent often forgets to clean up.",description:"Warns before starting detached or background processes",fn:function(e){if("Bash"!==e.toolName)return l();let t=A(e);return eR.test(t)||eO.test(t)||e_.test(t)||eB.test(t)||ej.test(t)?d("STOP: This command starts a background or detached process (nohup, screen -d, tmux -d, or trailing &). Background processes persist after Claude's session and may be difficult to track or stop. Confirm with the user before executing."):l()},match:{events:["PreToolUse"],toolNames:["Bash"]},defaultEnabled:!1,category:"Packages & System"},{name:"warn-repeated-tool-calls",displayTitle:"Called the same tool 3+ times with identical arguments",impact:"Usually a sign of a stuck loop burning tokens.",description:"Warn when the same tool is called 3+ times with identical parameters",fn:async function e(e){let t=e.session?.transcriptPath;if(!t||!e.toolName||!e.toolInput)return l();let i=`${t}.tool-calls.json`,n=JSON.stringify({tool:e.toolName,input:e.toolInput}),o={};try{let e=await (0,s.readFile)(i,"utf8");o=JSON.parse(e)}catch{}let r=o[n]??0;if(r>=3)return d(`STOP: You have already called ${e.toolName} ${r} times with identical parameters. This is wasteful and unproductive. Do NOT repeat this call — use a different approach or ask the user for clarification.`);o[n]=r+1;try{let e=JSON.stringify(o);e.length<=65536&&await (0,s.writeFile)(i,e,"utf8")}catch{}return l()},match:{events:["PreToolUse"]},defaultEnabled:!1,category:"AI Behavior"},{name:"require-commit-before-stop",displayTitle:"Stopped with uncommitted changes",impact:"Work not in a commit is invisible to teammates and easy to lose.",description:"Require all changes to be committed before Claude stops",fn:function(e){if(te(e))return l("Plan mode — no changes made, skipping commit check.");let t=e.session?.cwd;if(!t)return l("No working directory available, skipping commit check.");try{if((0,r.execSync)("git status --porcelain",{cwd:t,encoding:"utf8",stdio:["pipe","pipe","pipe"],timeout:5e3}).trim().length>0)return c("You have uncommitted changes in the working directory. Commit all changes now.");return l("All changes are committed.")}catch{return l("Not a git repository, skipping commit check.")}},match:{events:["Stop"]},defaultEnabled:!1,category:"Workflow"},{name:"require-push-before-stop",displayTitle:"Stopped with unpushed commits",impact:"Local-only commits won't trigger CI or be reviewable.",description:"Require all commits to be pushed to remote before Claude stops",fn:function(e){if(te(e))return l("Plan mode — no changes made, skipping push check.");let t=e.session?.cwd;if(!t)return l("No working directory available, skipping push check.");try{if(!(0,r.execSync)("git remote",{cwd:t,encoding:"utf8",stdio:["pipe","pipe","pipe"],timeout:3e3}).trim())return l("No git remote configured, skipping push check.");let i=e.params?.remote??"origin",n=eq(t);if(!n||"HEAD"===n)return l("Detached HEAD, skipping push check.");let o=e.params?.baseBranch??"main";if(n===o)return l(`On base branch "${o}", skipping push check.`);try{if(!(0,r.execFileSync)("git",["log",`${i}/${o}..HEAD`,"--oneline"],{cwd:t,encoding:"utf8",stdio:["pipe","pipe","pipe"],timeout:5e3}).trim())return l(`No commits ahead of ${i}/${o}, skipping push check.`);if(!(0,r.execFileSync)("git",["diff","--stat",`${i}/${o}`,"HEAD"],{cwd:t,encoding:"utf8",stdio:["pipe","pipe","pipe"],timeout:5e3}).trim())return l(`No file changes compared to ${i}/${o}, skipping push check.`)}catch{}let s=!1;try{(0,r.execFileSync)("git",["rev-parse","--verify",`${i}/${n}`],{cwd:t,encoding:"utf8",stdio:["pipe","pipe","pipe"],timeout:3e3}),s=!0}catch{}if(!s)return c(`Branch "${n}" has not been pushed to remote "${i}". Run now: git push -u ${i} ${n}`);let a=(0,r.execFileSync)("git",["log",`${i}/${n}..HEAD`,"--oneline"],{cwd:t,encoding:"utf8",stdio:["pipe","pipe","pipe"],timeout:5e3}).trim();if(a.length>0){let e=a.split("\n").length;return c(`You have ${e} unpushed commit${e>1?"s":""} on branch "${n}". Run now: git push`)}return l(`All commits pushed to "${i}".`)}catch{return l("Could not check push status, skipping.")}},match:{events:["Stop"]},defaultEnabled:!1,category:"Workflow",params:{remote:{type:"string",description:"Remote name to push to (default: origin)",default:"origin"},baseBranch:{type:"string",description:"Base branch to compare against (default: main)",default:"main"}}},{name:"require-pr-before-stop",displayTitle:"Stopped without a PR for the branch",impact:"Branches without PRs don't get reviewed.",description:"Require a pull request to exist for the current branch before Claude stops",fn:function(e){if(te(e))return l("Plan mode — no changes made, skipping PR check.");let t=e.session?.cwd;if(!t)return l("No working directory available, skipping PR check.");try{let i;try{(0,r.execSync)("gh --version",{cwd:t,encoding:"utf8",stdio:["pipe","pipe","pipe"],timeout:3e3})}catch{return l("GitHub CLI (gh) not installed, skipping PR check.")}let n=eq(t);if(!n||"HEAD"===n)return l("Detached HEAD, skipping PR check.");let o=e.params?.baseBranch??"main";if(n===o)return l(`On base branch "${o}", skipping PR check.`);try{if(!(0,r.execFileSync)("git",["log",`origin/${o}..HEAD`,"--oneline"],{cwd:t,encoding:"utf8",stdio:["pipe","pipe","pipe"],timeout:5e3}).trim())return l(`No commits ahead of origin/${o}, skipping PR check.`);if(!(0,r.execFileSync)("git",["diff","--stat",`origin/${o}`,"HEAD"],{cwd:t,encoding:"utf8",stdio:["pipe","pipe","pipe"],timeout:5e3}).trim())return l(`No file changes compared to origin/${o}, skipping PR check.`)}catch{}try{i=(0,r.execSync)("gh pr view --json number,url,state",{cwd:t,encoding:"utf8",stdio:["pipe","pipe","pipe"],timeout:15e3}).trim()}catch{return c(`No pull request found for branch "${n}". Run now: gh pr create`)}let s=JSON.parse(i);if("OPEN"===s.state)return l(`PR #${s.number} exists: ${s.url}`);if("MERGED"===s.state)return l(`PR #${s.number} was merged: ${s.url}. Switch off this branch (e.g. 'git checkout ${o} && git pull') before stopping again.`);return c(`Pull request for branch "${n}" is ${s.state.toLowerCase()}. Run now: gh pr create`)}catch{return l("Could not check PR status, skipping.")}},match:{events:["Stop"]},defaultEnabled:!1,category:"Workflow",params:{baseBranch:{type:"string",description:"Base branch to compare against (default: main)",default:"main"}}},{name:"require-no-conflicts-before-stop",displayTitle:"Stopped with a branch that conflicts with main",impact:"Conflicting branches can't merge — surface them early.",description:"Require the current branch to merge cleanly with the base branch before Claude stops",fn:function(e){let t,i;if(te(e))return l("Plan mode — no changes made, skipping conflict check.");let n=e.session?.cwd;if(!n)return l("No working directory available, skipping conflict check.");let o=eq(n);if(!o||"HEAD"===o)return l("Detached HEAD, skipping conflict check.");let s=e.params?.baseBranch??"main";if(o===s)return l(`On base branch "${s}", skipping conflict check.`);try{(0,r.execSync)("gh --version",{cwd:n,encoding:"utf8",stdio:["pipe","pipe","pipe"],timeout:3e3})}catch{return l("gh CLI not installed, skipping conflict check.")}try{t=(0,r.execSync)("gh pr view --json mergeable,number,url,state",{cwd:n,encoding:"utf8",stdio:["pipe","pipe","pipe"],timeout:15e3}).trim()}catch{return l("No pull request found for branch, skipping conflict check.")}try{i=JSON.parse(t)}catch{return l("Could not parse gh pr view output, skipping conflict check.")}if("OPEN"!==i.state)return l(`PR #${i.number} is ${i.state.toLowerCase()}; skipping conflict check.`);try{(0,r.execFileSync)("git",["rev-parse","--verify",`origin/${s}`],{cwd:n,encoding:"utf8",stdio:["pipe","pipe","pipe"],timeout:3e3}),(0,r.execFileSync)("git",["log",`origin/${s}..HEAD`,"--oneline"],{cwd:n,encoding:"utf8",stdio:["pipe","pipe","pipe"],timeout:5e3}).trim()&&(0,r.execFileSync)("git",["merge-tree","--write-tree","--name-only",`origin/${s}`,"HEAD"],{cwd:n,encoding:"utf8",stdio:["pipe","pipe","pipe"],timeout:1e4})}catch(e){if(1===e.status){let t=("string"==typeof e.stdout?e.stdout:e.stdout?.toString("utf8")??"").trim().split("\n"),i=[];for(let e=1;e<t.length;e++){let n=t[e];if(""===n)break;i.push(n)}let n=i.length?i.join(", "):"one or more files";return c(`Branch "${o}" has merge conflicts with ${s} in: ${n}. Rebase or merge origin/${s} now and resolve the conflicts.`)}}return"CONFLICTING"===i.mergeable?c(`PR #${i.number} has merge conflicts per GitHub (${i.url}). Rebase or merge origin/${s} now and resolve the conflicts.`):"UNKNOWN"===i.mergeable?c(`GitHub is still computing mergeability for PR #${i.number} (${i.url}). Wait ~10 seconds, then re-check with \`gh pr view --json mergeable\` before attempting to stop again.`):l(`PR #${i.number} merges cleanly per GitHub.`)},match:{events:["Stop"]},defaultEnabled:!1,category:"Workflow",params:{baseBranch:{type:"string",description:"Base branch to check for conflicts against (default: main)",default:"main"}}},{name:"require-ci-green-before-stop",displayTitle:"Stopped with failing CI",impact:"Failing CI blocks deploy.",description:"Require CI checks to pass on the current HEAD commit before Claude stops (ignores stale runs on prior commits)",fn:function(e){if(te(e))return l("Plan mode — no changes made, skipping CI check.");let t=e.session?.cwd;if(!t)return l("No working directory available, skipping CI check.");try{try{(0,r.execSync)("gh --version",{cwd:t,encoding:"utf8",stdio:["pipe","pipe","pipe"],timeout:3e3})}catch{return l("GitHub CLI (gh) not installed, skipping CI check.")}let e=eq(t);if(!e||"HEAD"===e)return l("Detached HEAD, skipping CI check.");let i=function(e){try{return(0,r.execSync)("git rev-parse HEAD",{cwd:e,encoding:"utf8",stdio:["pipe","pipe","pipe"],timeout:3e3}).trim()||null}catch{return null}}(t),n=[];try{let o=(0,r.execFileSync)("gh",["run","list","--branch",e,"--limit","20","--json","status,conclusion,name,headSha"],{cwd:t,encoding:"utf8",stdio:["pipe","pipe","pipe"],timeout:15e3}).trim();if(o&&"[]"!==o){let e=JSON.parse(o),t=i?e.filter(e=>e.headSha===i):e,s=new Set;n=t.filter(e=>!s.has(e.name)&&(s.add(e.name),!0))}}catch{}let o=[],s=[];i&&(o=function(e,t){try{let i=(0,r.execFileSync)("gh",["api",`repos/{owner}/{repo}/commits/${t}/check-runs`,"--jq",'.check_runs | map(select(.app.slug != "github-actions")) | map({name: .name, status: .status, conclusion: (.conclusion // "")})'],{cwd:e,encoding:"utf8",stdio:["pipe","pipe","pipe"],timeout:15e3}).trim();if(!i||"[]"===i)return[];return JSON.parse(i)}catch{return[]}}(t,i),s=function(e,t){try{let i=(0,r.execFileSync)("gh",["api",`repos/{owner}/{repo}/commits/${t}/statuses`,"--jq","map({name: .context, state: .state}) | unique_by(.name)"],{cwd:e,encoding:"utf8",stdio:["pipe","pipe","pipe"],timeout:15e3}).trim();if(!i||"[]"===i)return[];return JSON.parse(i).map(e=>({name:e.name,status:"pending"===e.state?"in_progress":"completed",conclusion:"pending"===e.state?"":"success"===e.state?"success":"failure"}))}catch{return[]}}(t,i));let a=[...n,...o,...s];if(0===a.length)return l(`No CI runs found for branch "${e}".`);let d=a.filter(e=>"completed"===e.status&&"success"!==e.conclusion&&"skipped"!==e.conclusion&&"cancelled"!==e.conclusion&&"neutral"!==e.conclusion);if(d.length>0){let t=d.map(e=>`"${e.name}"`).join(", ");return c(`CI checks are failing on branch "${e}": ${t}. Fix the failing checks now.`)}let p=a.filter(e=>"in_progress"===e.status||"queued"===e.status||"waiting"===e.status);if(p.length>0){let t=p.map(e=>`"${e.name}"`).join(", ");return c(`CI checks are still running on branch "${e}": ${t}. Wait for all checks to complete, then verify they pass.`)}return l(`All CI checks passed on branch "${e}".`)}catch{return l("Could not check CI status, skipping.")}},match:{events:["Stop"]},defaultEnabled:!1,category:"Workflow"}];function ti(e){if(!(0,o.existsSync)(e))return{};try{let t=(0,o.readFileSync)(e,"utf8");return JSON.parse(t)}catch(t){return C(`failed to parse config at ${e}: ${t instanceof Error?t.message:String(t)}`),{}}}let tn=["claude","codex","copilot","cursor","opencode","pi","hermes","openclaw","factory","devin","antigravity","goose"],to={apply_patch:"Edit",write_stdin:"Bash"},ts={terminal:"Bash",bash:"Bash",read_file:"Read",write_file:"Write",patch:"Edit",web_search:"WebSearch",web_extract:"WebFetch",search_files:"Grep",todo:"TodoWrite"},tr={Read:{path:"file_path"},Write:{path:"file_path"},Edit:{path:"file_path"}},ta={bash:"Bash",powershell:"Bash",list_bash:"Bash",read_bash:"Bash",stop_bash:"Bash",write_bash:"Bash",list_powershell:"Bash",read_powershell:"Bash",stop_powershell:"Bash",write_powershell:"Bash",read:"Read",view:"Read",show_file:"Read",write:"Write",create:"Write",edit:"Edit",apply_patch:"Edit",str_replace_editor:"Edit",glob:"Glob",grep:"Grep",rg:"Grep",ls:"LS",web_fetch:"WebFetch"},tl={Read:{path:"file_path"},Write:{path:"file_path",file_text:"content"},Edit:{path:"file_path",old_str:"old_string",new_str:"new_string"}},tc={Shell:"Bash"},td={bash:"Bash",read:"Read",write:"Write",edit:"Edit",apply_patch:"Edit",glob:"Glob",grep:"Grep",list:"LS",webfetch:"WebFetch",websearch:"WebSearch",todowrite:"TodoWrite",todoread:"TodoRead"},tp={Read:{filePath:"file_path"},Write:{filePath:"file_path"},Edit:{filePath:"file_path",oldString:"old_string",newString:"new_string",replaceAll:"replace_all"}},tu={bash:"Bash",read:"Read",write:"Write",edit:"Edit",glob:"Glob",grep:"Grep"},tm={Read:{path:"file_path"},Write:{path:"file_path"},Edit:{path:"file_path"}},tf={exec:"Bash",read:"Read",write:"Write",edit:"Edit",grep:"Grep",glob:"Glob",web_search:"WebSearch",web_fetch:"WebFetch"},th={Read:{path:"file_path"},Write:{path:"file_path"},Edit:{path:"file_path"}},tg={Execute:"Bash",Read:"Read",Edit:"Edit",Create:"Write",Grep:"Grep",Glob:"Glob",LS:"LS",FetchUrl:"WebFetch",WebSearch:"WebSearch",TodoWrite:"TodoWrite",Task:"Task"},ty={exec:"Bash"},tb={run_command:"Bash",write_to_file:"Write",read_file:"Read",view_file:"Read",edit_file:"Edit",replace_file_content:"Edit",list_dir:"LS",find_by_name:"Glob",grep_search:"Grep",read_url_content:"WebFetch",search_web:"WebSearch"},tw={Bash:{CommandLine:"command",Cwd:"cwd"},Write:{TargetFile:"file_path",CodeContent:"content"},Edit:{TargetFile:"file_path"},Read:{TargetFile:"file_path",AbsolutePath:"file_path",File:"file_path"}},tk={shell:"Bash",write:"Write",edit:"Edit",view:"Read",read_image:"Read",glob:"Glob",grep:"Grep",tree:"LS",delegate:"Task",todo__todo_write:"TodoWrite"},tv={Read:{path:"file_path",source:"file_path"},Write:{path:"file_path"},Edit:{path:"file_path"},LS:{path:"file_path"}};["SessionStart","SessionEnd","UserPromptSubmit","PreToolUse","PermissionRequest","PermissionDenied","PostToolUse","PostToolUseFailure","Notification","SubagentStart","SubagentStop","TaskCreated","TaskCompleted","Stop","StopFailure","TeammateIdle","InstructionsLoaded","ConfigChange","CwdChanged","FileChanged","WorktreeCreate","WorktreeRemove","PreCompact","PostCompact","Elicitation","ElicitationResult","UserPromptExpansion","PostToolBatch","Setup"].filter(e=>"WorktreeCreate"!==e);var tN=e.i(81580);let tS=/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/i;var tT=e.i(54214);function tP(e,t){let i=[];for(let o of e)if("assistant"===o.type)for(let e of o.message.content){var n;let s;if("tool_use"!==e.type)continue;let r=e.name,a=(n=t.cli,(r?"copilot"===n?ta[r]??r:"cursor"===n?tc[r]??r:"codex"===n?to[r]??r:"opencode"===n?td[r]??r:"pi"===n?tu[r]??r:"hermes"===n?ts[r]??r:"openclaw"===n?tf[r]??r:"factory"===n?tg[r]??r:"devin"===n?ty[r]??r:"antigravity"===n?tb[r]??r:"goose"===n?tk[r]??r:r:r)??r),l=function(e,t,i){let n;if(!e||!t||"object"!=typeof t||Array.isArray(t)||("copilot"===i?n=tl[e]:"opencode"===i?n=tp[e]:"pi"===i?n=tm[e]:"hermes"===i?n=tr[e]:"openclaw"===i?n=th[e]:"antigravity"===i?n=tw[e]:"goose"===i&&(n=tv[e]),!n))return t;let o={};for(let[e,i]of Object.entries(t))o[n[e]??e]=i;return o}(a,e.input,t.cli);e.result?.content&&(s=function(e){let t=Buffer.from(e,"utf-8");if(t.byteLength<=65536)return e;let i=65536;for(;i>0&&(192&t[i])==128;)i--;return t.subarray(0,i).toString("utf-8")}(e.result.content)),i.push({cli:t.cli,sessionId:t.sessionId,transcriptPath:t.transcriptPath,cwd:t.cwd,timestamp:o.timestamp,toolName:a,rawToolName:r,toolInput:l??{},toolResultText:s})}return i}async function tE(e={}){let t=e.projects?new Set(e.projects):null,i=e.sinceMs??0,s=[];for(let e of function(){let e,t=(0,tN.getClaudeProjectsPath)();try{e=(0,o.readdirSync)(t,{withFileTypes:!0})}catch{return[]}return e.filter(e=>e.isDirectory()).map(e=>({name:e.name,cwd:(0,tN.decodeFolderName)(e.name),path:(0,n.join)(t,e.name)}))}()){let r;if(!t||t.has(e.cwd)){try{r=function(e){let t,i=[];try{t=(0,o.readdirSync)(e.path,{withFileTypes:!0})}catch{return i}for(let s of t)if(s.isFile()&&s.name.endsWith(".jsonl")){let t=s.name.slice(0,-6);if(!tS.test(t))continue;let r=(0,n.join)(e.path,s.name);try{let n=(0,o.statSync)(r);i.push({projectName:e.name,cwd:e.cwd,sessionId:t,transcriptPath:r,mtimeMs:n.mtimeMs,sizeBytes:n.size,isSubagent:!1})}catch{}}else if(s.isDirectory()&&tS.test(s.name)){let t,r=(0,n.join)(e.path,s.name,"subagents");if(!(0,o.existsSync)(r))continue;try{t=(0,o.readdirSync)(r,{withFileTypes:!0})}catch{continue}for(let s of t){if(!s.isFile()||!s.name.endsWith(".jsonl"))continue;let t=s.name.slice(0,-6),a=(0,n.join)(r,s.name);try{let n=(0,o.statSync)(a);i.push({projectName:e.name,cwd:e.cwd,sessionId:t,transcriptPath:a,mtimeMs:n.mtimeMs,sizeBytes:n.size,isSubagent:!0})}catch{}}}return i}(e)}catch{continue}for(let t of r)t.mtimeMs<i||s.push({cli:"claude",projectName:e.name,sessionId:t.sessionId,transcriptPath:t.transcriptPath,mtimeMs:t.mtimeMs,sizeBytes:t.sizeBytes})}}return s}async function t$(e){let t,i;try{t=await (0,s.readFile)(e.transcriptPath,"utf-8")}catch{return[]}try{i=await (0,tT.parseLogContent)(t,"session")}catch{return[]}let n="";for(let e of t.split("\n",50))if(e.trim())try{let t=JSON.parse(e);if("string"==typeof t.cwd&&t.cwd.length>0){n=t.cwd;break}}catch{}return tP(i,{cli:"claude",sessionId:e.sessionId,transcriptPath:e.transcriptPath,cwd:n})}var tC=e.i(36203),tI=e.i(57232);async function tx(e={}){let t=e.projects?new Set(e.projects):null,i=e.sinceMs??0,n=[];for(let e of(await (0,tC.getCodexProjects)())){let{cwd:s,sessions:r}=await (0,tC.getCodexSessionsByEncodedName)(e.name),a=s??"";if(!t||t.has(a))for(let t of r){let s=t.lastModified.getTime();if(s<i)continue;let r=0;try{r=(0,o.statSync)(t.path).size}catch{}t.sessionId&&n.push({cli:"codex",projectName:e.name,sessionId:t.sessionId,transcriptPath:t.path,mtimeMs:s,sizeBytes:r})}}return n}async function tA(e){let t=await (0,tI.getCodexSessionLog)(e.sessionId);return t?tP(t.entries,{cli:"codex",sessionId:e.sessionId,transcriptPath:e.transcriptPath,cwd:t.cwd??""}):[]}var tR=e.i(55851),tO=e.i(78166);async function t_(e={}){let t=e.projects?new Set(e.projects):null,i=e.sinceMs??0,n=[];for(let e of(await (0,tR.getCopilotProjects)())){let{cwd:s,sessions:r}=await (0,tR.getCopilotSessionsByEncodedName)(e.name),a=s??"";if(!t||t.has(a))for(let t of r){let s=t.lastModified.getTime();if(s<i)continue;let r=0;try{r=(0,o.statSync)(t.path).size}catch{}t.sessionId&&n.push({cli:"copilot",projectName:e.name,sessionId:t.sessionId,transcriptPath:t.path,mtimeMs:s,sizeBytes:r})}}return n}async function tB(e){let t=await (0,tO.getCopilotSessionLog)(e.sessionId);return t?tP(t.entries,{cli:"copilot",sessionId:e.sessionId,transcriptPath:e.transcriptPath,cwd:t.cwd??""}):[]}var tj=e.i(46413),tD=e.i(72094);async function tW(e={}){let t=e.projects?new Set(e.projects):null,i=e.sinceMs??0,n=[];for(let e of(await (0,tj.getCursorProjects)())){let{cwd:s,sessions:r}=await (0,tj.getCursorSessionsByEncodedName)(e.name),a=s??"";if(!t||t.has(a))for(let t of r){let s=t.lastModified.getTime();if(s<i)continue;let r=0;try{r=(0,o.statSync)(t.path).size}catch{}t.sessionId&&n.push({cli:"cursor",projectName:e.name,sessionId:t.sessionId,transcriptPath:t.path,mtimeMs:s,sizeBytes:r})}}return n}async function tM(e){let t=await (0,tD.getCursorSessionLog)(e.sessionId);return t?tP(t.entries,{cli:"cursor",sessionId:e.sessionId,transcriptPath:e.transcriptPath,cwd:t.cwd??""}):[]}var tU=e.i(35435),tL=e.i(99440);async function tz(e={}){let t=e.projects?new Set(e.projects):null,i=e.sinceMs??0,n=[];for(let e of(await (0,tU.getOpenCodeProjects)())){let{cwd:o,sessions:s}=await (0,tU.getOpenCodeSessionsByEncodedName)(e.name),r=o??"";if(!t||t.has(r))for(let t of s){let o=t.lastModified.getTime();!(o<i)&&t.sessionId&&n.push({cli:"opencode",projectName:e.name,sessionId:t.sessionId,transcriptPath:t.path,mtimeMs:o,sizeBytes:0})}}return n}async function tF(e){let t=await (0,tL.getOpenCodeSessionLog)(e.sessionId);return t?tP(t.entries,{cli:"opencode",sessionId:e.sessionId,transcriptPath:e.transcriptPath,cwd:t.cwd??""}):[]}var tH=e.i(19791),tq=e.i(85116);async function tJ(e={}){let t=e.projects?new Set(e.projects):null,i=e.sinceMs??0,n=[];for(let e of(await (0,tH.getPiProjects)())){let{cwd:s,sessions:r}=await (0,tH.getPiSessionsByEncodedName)(e.name),a=s??"";if(!t||t.has(a))for(let t of r){let s=t.lastModified.getTime();if(s<i)continue;let r=0;try{r=(0,o.statSync)(t.path).size}catch{}t.sessionId&&n.push({cli:"pi",projectName:e.name,sessionId:t.sessionId,transcriptPath:t.path,mtimeMs:s,sizeBytes:r})}}return n}async function tG(e){let t=await (0,tq.getPiSessionLog)(e.sessionId);return t?tP(t.entries,{cli:"pi",sessionId:e.sessionId,transcriptPath:e.transcriptPath,cwd:t.cwd??""}):[]}var tY=e.i(64828),tZ=e.i(28898),tK=e.i(3605);async function tQ(e={}){let t=e.projects?new Set(e.projects):null,i=e.sinceMs??0,n=await (0,tY.getHermesSessions)(),o=[];for(let e of n)!(e.mtimeMs<i)&&(!(e.messageCount<=0)||e.hasMessages)&&(!t||e.cwd&&t.has(e.cwd))&&o.push({cli:"hermes",projectName:e.cwd?(0,tN.encodeFolderName)(e.cwd):e.source?(0,tZ.hermesProjectPath)(e.profile,e.source):`hermes:${e.profile}`,sessionId:e.sessionId,transcriptPath:`hermes://${e.sessionId}`,mtimeMs:e.mtimeMs,sizeBytes:e.messageCount});return o}async function tV(e){let t=await (0,tK.getHermesSessionLog)(e.sessionId);return t?tP(t.entries,{cli:"hermes",sessionId:e.sessionId,transcriptPath:e.transcriptPath,cwd:t.cwd??""}):[]}var tX=e.i(90624),t0=e.i(64199);async function t1(e={}){if(e.projects&&e.projects.length>0)return[];let t=e.sinceMs??0,i=[];for(let e of(await (0,tX.getOpenClawSessions)()))e.mtimeMs<t||i.push({cli:"openclaw",projectName:(0,tX.openClawProjectPath)(e.agentId,e.channel),sessionId:e.sessionId,transcriptPath:e.transcriptPath,mtimeMs:e.mtimeMs,sizeBytes:e.sizeBytes});return i}async function t3(e){let t=await (0,t0.getOpenClawSessionLog)(e.sessionId);return t?tP(t.entries,{cli:"openclaw",sessionId:e.sessionId,transcriptPath:e.transcriptPath,cwd:t.cwd??""}):[]}var t8=e.i(28246);async function t6(e={}){let t=e.projects?new Set(e.projects):null,i=e.sinceMs??0,n=[];for(let e of(0,t8.listFactoryTranscripts)())!(e.mtimeMs<i)&&(!t||t.has(e.cwd))&&n.push({cli:"factory",projectName:e.projectName,sessionId:e.sessionId,transcriptPath:e.transcriptPath,mtimeMs:e.mtimeMs,sizeBytes:e.sizeBytes});return n}async function t2(e){let t;try{t=await (0,s.readFile)(e.transcriptPath,"utf-8")}catch{return[]}let i=(0,tT.parseRawLines)(t,"session"),n=(0,t8.factoryLinesToLogEntries)(i,"session"),o="";for(let e of i)if(e&&"object"==typeof e&&"session_start"===e.type){let t=e.cwd;if("string"==typeof t&&t.length>0){o=t;break}}return tP(n,{cli:"factory",sessionId:e.sessionId,transcriptPath:e.transcriptPath,cwd:o})}var t4=e.i(93114),t9=e.i(30441);async function t5(e={}){let t=e.projects?new Set(e.projects):null,i=e.sinceMs??0,n=[],o=await (0,t9.getAntigravityIndex)();for(let e of(0,t4.listAntigravityTranscripts)()){if(e.mtimeMs<i)continue;let s=o.get(e.conversationId)?.cwd;(!t||s&&t.has(s))&&n.push({cli:"antigravity",projectName:s?(0,tN.encodeFolderName)(s):"antigravity",sessionId:e.conversationId,transcriptPath:e.transcriptPath,mtimeMs:e.mtimeMs,sizeBytes:e.sizeBytes})}return n}async function t7(e){let t;try{t=await (0,s.readFile)(e.transcriptPath,"utf-8")}catch{return[]}let i=(0,tT.parseRawLines)(t,"session"),n=(0,t4.antigravityLinesToLogEntries)(i,"session"),o="";for(let e of i){if(!e||"object"!=typeof e)continue;let t=e.tool_calls;if(Array.isArray(t)){for(let e of t){let t=e&&"object"==typeof e?e.args:void 0,i=t&&"object"==typeof t?t.Cwd:void 0;if("string"==typeof i&&i.length>0){o=i;break}}if(o)break}}return tP(n,{cli:"antigravity",sessionId:e.sessionId,transcriptPath:e.transcriptPath,cwd:o})}var ie=e.i(79364),it=e.i(40375);async function ii(e={}){let t=e.projects?new Set(e.projects):null,i=e.sinceMs??0,n=await (0,ie.getDevinSessions)(),o=[];for(let e of n)!(e.mtimeMs<i)&&(!t||e.cwd&&t.has(e.cwd))&&o.push({cli:"devin",projectName:e.projectName,sessionId:e.sessionId,transcriptPath:`devin-db://${e.sessionId}`,mtimeMs:e.mtimeMs,sizeBytes:0});return o}async function io(e){let t=await (0,it.getDevinSessionLog)(e.sessionId);return t?tP(t.entries,{cli:"devin",sessionId:e.sessionId,transcriptPath:e.transcriptPath,cwd:t.cwd??""}):[]}var is=e.i(69164),ir=e.i(36618);let ia={claude:{cli:"claude",listTranscripts:tE,streamEvents:t$},codex:{cli:"codex",listTranscripts:tx,streamEvents:tA},copilot:{cli:"copilot",listTranscripts:t_,streamEvents:tB},cursor:{cli:"cursor",listTranscripts:tW,streamEvents:tM},opencode:{cli:"opencode",listTranscripts:tz,streamEvents:tF},pi:{cli:"pi",listTranscripts:tJ,streamEvents:tG},hermes:{cli:"hermes",listTranscripts:tQ,streamEvents:tV},openclaw:{cli:"openclaw",listTranscripts:t1,streamEvents:t3},factory:{cli:"factory",listTranscripts:t6,streamEvents:t2},devin:{cli:"devin",listTranscripts:ii,streamEvents:io},antigravity:{cli:"antigravity",listTranscripts:t5,streamEvents:t7},goose:{cli:"goose",listTranscripts:async function(e={}){let t=e.projects?new Set(e.projects):null,i=e.sinceMs??0,n=await (0,is.getGooseSessions)(),o=[];for(let e of n)!(e.mtimeMs<i)&&(!t||e.cwd&&t.has(e.cwd))&&o.push({cli:"goose",projectName:e.projectName,sessionId:e.sessionId,transcriptPath:`goose-db://${e.sessionId}`,mtimeMs:e.mtimeMs,sizeBytes:0});return o},streamEvents:async function(e){let t=await (0,ir.getGooseSessionLog)(e.sessionId);return t?tP(t.entries,{cli:"goose",sessionId:e.sessionId,transcriptPath:e.transcriptPath,cwd:t.cwd??""}):[]}}},il=/\.(?:ts|tsx|js|jsx|mjs|cjs|py|go|rs|java|kt|swift|rb|php|c|h|cc|cpp|hpp|cs|scala|sh|bash|zsh|json|yaml|yml|toml|md|txt|sql|html|css|scss|sass)$/i,ic=["/","/home","/usr","/etc","/var","/opt","/Users"],id="rereadAfterEdit",ip=[{name:"redundant-cd-cwd",description:"Bash commands prefixed with `cd <cwd> && …` even though commands already run in cwd.",category:"Wasteful",severity:"info",displayTitle:"Prepended cd <cwd> before commands",impact:"Pure waste — your agent's shell already runs in `cwd`.",detect(e){if("Bash"!==e.toolName)return null;let t=e.toolInput.command;if("string"!=typeof t||!e.cwd)return null;let i=t.trimStart(),n=/^cd\s+(?:"([^"]+)"|'([^']+)'|(\S+))\s*&&\s*([\s\S]+)$/.exec(i);if(!n)return null;let o=(n[1]??n[2]??n[3]??"").replace(/\/+$/,"");if(o!==e.cwd.replace(/\/+$/,""))return null;let s=n[4].trim();return{example:`cd ${o} && ${s}`}}},{name:"prefer-edit-over-read-cat",description:"Bash `cat`/`head`/`tail`/`less`/`more` on a single source file — use Read.",category:"Wasteful",severity:"info",displayTitle:"Used `cat`/`head`/`tail` on a source file",impact:"Burns tokens; the Read tool returns content directly without going through Bash output.",detect(e){if("Bash"!==e.toolName)return null;let t=e.toolInput.command;if("string"!=typeof t)return null;let i=t.trim();if(/[|<>;&`$()]/.test(i))return null;let n=/^(cat|head|tail|less|more)\s+(?:-\S+\s+)*(?:"([^"]+)"|'([^']+)'|(\S+))\s*$/.exec(i);if(!n)return null;let o=n[2]??n[3]??n[4]??"";return!o||/(?:^|\/)\.env(?:\..+)?$/.test(o)||!il.test(o)?null:{example:i}}},{name:"prefer-edit-over-sed-awk",description:"Bash `sed -i`/`awk` in-place edits — use Edit.",category:"Wasteful",severity:"info",displayTitle:"Used sed -i or awk for an in-place edit",impact:"Edit tool is safer and produces a diff the agent can verify.",detect(e){if("Bash"!==e.toolName)return null;let t=e.toolInput.command;if("string"!=typeof t)return null;let i=t.trim();return/(?:^|\s|;|&&|\|\|)sed\b[^|]*\s-i(?=\b|['"])/.test(i)||/(?:^|\s|;|&&|\|\|)awk\b[^|]*\s>\s*\S+/.test(i)&&!/\|/.test(i)?{example:i}:null}},{name:"prefer-write-over-heredoc",description:"Bash heredoc / `echo > file` writing multi-line content — use Write.",category:"Wasteful",severity:"info",displayTitle:"Used heredoc / `echo > file` to write a multi-line file",impact:"Write tool handles escaping and is verifiable.",detect(e){if("Bash"!==e.toolName)return null;let t=e.toolInput.command;return"string"!=typeof t?null:/<<-?\s*['"]?[A-Za-z_][A-Za-z0-9_]*['"]?\s*>\s*\S/.test(t)||/(?:^|\s|;|&&|\|\|)(?:echo|printf)\s+["'][^"']*\n[^"']*["']\s*>\s*\S/.test(t)?{example:t.replace(/\s+/g," ").trim().slice(0,160)}:null}},{name:"sleep-polling-loop",description:"Bash long `sleep` or while-sleep polling loops.",category:"Wasteful",severity:"info",displayTitle:"Used a long sleep or while-sleep polling loop",impact:"Burns wall-clock; better to wait for an explicit signal.",detect(e){if("Bash"!==e.toolName)return null;let t=e.toolInput.command;if("string"!=typeof t)return null;if(/\bwhile\b[\s\S]*?\bsleep\b[\s\S]*?\bdone\b/.test(t))return{example:t.replace(/\s+/g," ").trim().slice(0,160)};let i=/\bsleep\s+(\d+(?:\.\d+)?)(m|h|d)?\b/.exec(t);if(i){let e=parseFloat(i[1]),n=i[2]??"s";if(("m"===n?60*e:"h"===n?3600*e:"d"===n?86400*e:e)>=30)return{example:t.replace(/\s+/g," ").trim().slice(0,160)}}return null}},{name:"find-from-root",description:"Bash `find` against `/`, `/home`, `/usr`, etc. — scope to cwd instead.",category:"Risky",severity:"warn",displayTitle:"Ran find from /, /home, /usr, etc.",impact:"Filesystem-wide finds exhaust resources and rarely return useful results.",detect(e){if("Bash"!==e.toolName)return null;let t=e.toolInput.command;if("string"!=typeof t)return null;let i=t.trim(),n=/(?:^|[\s;|&])find\s+(?:-\S+\s+)*("[^"]+"|'[^']+'|\S+)/.exec(i);if(!n)return null;let o=n[1].replace(/^["']|["']$/g,"").replace(/\/+$/,"")||"/";return ic.includes(o)?{example:i.slice(0,160)}:null}},{name:"git-commit-no-verify",description:"git commit invoked with --no-verify / -n, skipping hooks.",category:"Risky",severity:"warn",displayTitle:"Committed with --no-verify",impact:"Skips pre-commit hooks that exist to catch broken or unsafe code.",detect(e){if("Bash"!==e.toolName)return null;let t=e.toolInput.command;return"string"!=typeof t?null:/\bgit\s+commit\b/.test(t)&&(/\s--no-verify\b/.test(t)||/\s-n\b/.test(t))?{example:t.replace(/\s+/g," ").trim().slice(0,160)}:null}},{name:"reread-after-edit",description:"Read of a file that was just Edit'd or Write'n in the same session.",category:"Wasteful",severity:"info",displayTitle:"Re-read a file it just edited",impact:"Edit/Write already returned the updated content; the second Read is wasted tokens.",detect(e,t){let i,n=((i=t[id])||(i={countdown:new Map},t[id]=i),i),o=e.toolInput.file_path,s="string"==typeof o?o:null;for(let[e,t]of n.countdown)t<=1?n.countdown.delete(e):n.countdown.set(e,t-1);return s?"Edit"===e.toolName||"Write"===e.toolName?(n.countdown.set(s,5),null):"Read"===e.toolName&&n.countdown.has(s)?(n.countdown.delete(s),{example:`Read ${s} immediately after Edit/Write`}):null:null}}],iu=["cowboy","explorer","ghost","optimist","hammer","architect"],im={explorer:.38,architect:.33,hammer:.11,cowboy:.11,optimist:.07,ghost:.01,precision:0,goldfish:0},ih={optimist:0,cowboy:0,explorer:0,goldfish:0,architect:0,precision:0,hammer:0,ghost:0};for(let e of iu)ih[e]=Math.max(im[e],.05);var ig=e.i(66680);let iy=null,ib=null;function iw(){if(iy)return iy;let e=tt.map(e=>`${e.name}|${e.fn.toString()}`).sort().join("\n");return iy=(0,ig.createHash)("sha1").update(e).digest("hex").slice(0,16)}function ik(){if(ib)return ib;let e=ip.map(e=>`${e.name}|${e.detect.toString()}`).sort().join("\n");return ib=(0,ig.createHash)("sha1").update(e).digest("hex").slice(0,16)}function iv(e){let t=(0,y.auditCacheDir)(),i=(0,ig.createHash)("sha1").update(e).digest("hex");return(0,n.join)(t,`${i}.json`)}var iN=e.i(24214),iS=e.i(28067),iT=e.i(17694);let iP=iS.POSTHOG_API_KEY,iE=new Set;async function i$(e,t,i){let n=JSON.stringify({api_key:process.env.FAILPROOFAI_POSTHOG_KEY??iP,event:t,distinct_id:e,properties:{...i,$lib:"failproofai-hooks",failproofai_version:iN.version,product:iS.POSTHOG_PRODUCT}});try{await fetch(process.env.FAILPROOFAI_POSTHOG_HOST?`${process.env.FAILPROOFAI_POSTHOG_HOST}/capture/`:"https://us.i.posthog.com/capture/",{method:"POST",headers:{"Content-Type":"application/json"},body:n,signal:AbortSignal.timeout(5e3)})}catch{}}async function iC(e,t,i){if(!(0,iT.isTelemetryEnabled)())return;let n=i$(e,t,i);iE.add(n),n.finally(()=>iE.delete(n)),await n}var iI=e.i(10659);function ix(e,t){let i=e.trim(),n="string"==typeof t?t.trim():"";return n?i?`${i}. ${n}`:n:i}let iA=new Map(tt.filter(e=>e.params).map(e=>[f(e.name),e.params]));function iR(e,t){if(!e?.policyParams)return;let i=e.policyParams[t];if(i)return i;let n=`${m}/`;if(t.startsWith(n))return e.policyParams[t.slice(n.length)]}async function iO(e,t,i,n){let o=t.tool_name,s=t.tool_input,r=function(e,t){let i=globalThis[u];i||h(i=new Map);let n=`${e}:${t??""}`,o=i.get(n);if(o)return o;let s=g().filter(i=>(!i.match.events||!(i.match.events.length>0)||!!i.match.events.includes(e))&&(!i.match.toolNames||!(i.match.toolNames.length>0)||!!t&&!!i.match.toolNames.includes(t))).sort((e,t)=>t.priority-e.priority);return i.set(n,s),s}(e,o);if($(`evaluating ${r.length} policies for ${e}`),0===r.length)return{exitCode:0,stdout:"",stderr:"",policyName:null,reason:null,decision:"allow"};let a={eventType:e,payload:t,toolName:o,toolInput:s,session:i,cli:i?.cli},l=[],c=[];for(let t of r){let o,s,r=iA.get(t.name);if(r){let e=iR(n,t.name)??{},i={};for(let[t,n]of Object.entries(r))i[t]=t in e?e[t]:n.default;o={...a,params:i}}else o={...a,params:{}};try{s=await t.fn(o)}catch(o){let n=o instanceof Error?o.message:String(o);C(`policy "${t.name}" threw: ${n}`),t.name.startsWith("custom/")||t.name.startsWith(".failproofai-")||iC((0,iI.getInstanceId)(),"policy_evaluation_error",{policy_name:t.name,event_type:e,cli:i?.cli??null,error_type:o instanceof Error?o.name:"unknown"});continue}if("deny"===s.decision){let r,a=ix(s.reason??`Blocked by policy: ${t.name}`,iR(n,t.name)?.hint);$(`deny by "${t.name}": ${a}`),r=o.toolName?o.toolName:"UserPromptSubmit"===e?"prompt":"SessionStart"===e?"session start":"SessionEnd"===e?"session end":"Stop"===e?"stop":"operation";let l=`Blocked ${r} by failproofai because: ${a}, as per the policy configured by the user`;if(i?.cli==="cursor"){if("Stop"===e||"SubagentStop"===e)return{exitCode:0,stdout:JSON.stringify({followup_message:`MANDATORY ACTION REQUIRED from failproofai (policy: ${t.name}): ${a}
+`;(0,o.appendFileSync)(i,r,"utf-8")}catch{}}function $(e){T("info")&&(P("INFO",e),E("INFO",e))}function C(e){T("warn")&&(P("WARN",e),E("WARN",e))}let I=function(e){let t=e.replaceAll("\\","/");for(let e of[".claude",".codex",".copilot",".cursor",".opencode",".pi",".gemini"]){let i=(0,n.join)((0,a.homedir)(),e).replaceAll("\\","/");if(t===i||t.startsWith(i+"/"))return!0}for(let e of[(0,n.join)(".config","opencode"),(0,n.join)(".local","share","opencode")]){let i=(0,n.join)((0,a.homedir)(),e).replaceAll("\\","/");if(t===i||t.startsWith(i+"/"))return!0}return!1},x=function(e){return!!(/[\\/]\.claude[\\/]settings(?:\.[^/\\]+)?\.json$/.test(e)||/[\\/]\.codex[\\/]hooks\.json$/.test(e)||/[\\/]\.copilot[\\/]hooks[\\/][^/\\]+\.json$/.test(e)||/[\\/]\.github[\\/]hooks[\\/][^/\\]+\.json$/.test(e)||/[\\/]\.cursor[\\/]hooks\.json$/.test(e)||/[\\/]\.opencode[\\/]opencode\.jsonc?$/.test(e)||/[\\/]\.opencode[\\/]plugins[\\/][^/\\]+\.(?:mjs|js|ts)$/.test(e)||/[\\/]\.config[\\/]opencode[\\/]opencode\.jsonc?$/.test(e)||/[\\/]\.config[\\/]opencode[\\/]config\.json$/.test(e)||/[\\/]\.config[\\/]opencode[\\/]plugins[\\/][^/\\]+\.(?:mjs|js|ts)$/.test(e)||/[\\/]\.pi[\\/](?:agent[\\/])?settings\.json$/.test(e)||/[\\/]\.pi[\\/](?:agent[\\/])?extensions[\\/]/.test(e)||/[\\/]\.gemini[\\/]settings\.json$/.test(e)||/[\\/]\.gemini[\\/]config[\\/]hooks\.json$/.test(e))};function A(e){return e.toolInput?.command??""}function R(e){return e.toolInput?.file_path??""}function O(e){return e.trim().split(/\s+/).map(e=>e.replace(/^['"]|['"]$/g,""))}let _=new Set(["&&","||","|",";"]),B=/[;&<>`$()\\]/,j=/eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/,D=[[/sk-ant-[A-Za-z0-9\-_]{20,}/,"Anthropic API key"],[/sk-proj-[A-Za-z0-9\-_]{20,}/,"OpenAI project API key"],[/sk-[A-Za-z0-9]{20,}/,"OpenAI API key"],[/ghp_[A-Za-z0-9]{36}/,"GitHub personal access token"],[/github_pat_[A-Za-z0-9_]{82}/,"GitHub fine-grained token"],[/AKIA[A-Z0-9]{16}/,"AWS access key ID"],[/sk_live_[A-Za-z0-9]{24,}/,"Stripe live secret key"],[/sk_test_[A-Za-z0-9]{24,}/,"Stripe test secret key"],[/AIza[0-9A-Za-z\-_]{35}/,"Google API key"]],W=/(?:postgresql|postgres|mysql|mongodb(?:\+srv)?|redis|amqps?|smtps?):\/\/[^@\s]+@/,M=/-----BEGIN (?:[A-Z]+ )?PRIVATE KEY-----/,U=/Authorization:\s*Bearer\s+[A-Za-z0-9\-._~+/]{20,}/i;[...D];let L=/\b(?:psql|mysql|sqlite3|pgcli|clickhouse-client)\b/,z=/\b(?:DROP\s+(?:TABLE|DATABASE|SCHEMA)|TRUNCATE\b)/i,F=/\bDELETE\s+FROM\b/i,H=/\bWHERE\b/i,q=/\bALTER\s+TABLE\b[\s\S]*\b(?:DROP\s+COLUMN|ADD\s+COLUMN|RENAME\s+(?:COLUMN|TO)|MODIFY\s+COLUMN)\b/i,J=/(?:npm\s+publish|bun\s+publish|pnpm\s+publish|yarn\s+npm\s+publish|twine\s+upload|poetry\s+publish|cargo\s+publish|gem\s+push)\b/,G=/(?:^|\s|;|&&|\|\|)(?:env|printenv)(?:\s|$|;|&&|\|)/,Y=/echo\s+.*\$\{?[A-Za-z_]/,Z=/(?:^|\s|;|&&|\|\|)export\s+\w+/,K=/\$env:[A-Za-z_]/i,Q=/(?:Get-ChildItem|dir|gci|ls)\s+Env:/i,V=/\[Environment\]::GetEnvironment/i,X=/echo\s+%[A-Za-z_]/i,ee=/(?:^|[\\/])\.env(?:\.|$)/,et=/\.env(?:\b|\s|$|\.)/,ei=/Start-Process\s+.*-Verb\s+RunAs/i,en=/(?:^|;|&&|\|\|)\s*runas\s/i,eo=/(?:curl|wget)\s.*\|\s*(?:sh|bash|zsh|dash|ksh|csh|tcsh|fish|ash)\b/,es=/[;&|\n\r(){}`]+/,er=new Set(["npx","bunx","pnpx","npm","pnpm","yarn","dlx","exec","run","node","bun","deno","env","command","builtin","nohup","setsid","time","timeout","nice","stdbuf","xargs","sudo","doas","sh","bash","zsh","dash","ksh","fish","ash"]),ea=/(?:^|\/)failproofai[^/]*$/,el=/^(?:config|configure|setup)$/,ec=/^--pause(?:=|$)/,ed=/^[A-Za-z_][A-Za-z0-9_]*=/,ep=/^\d+[a-z]*$/i;function eu(e){for(let t of e.split(es)){let e=t.split(/\s+/).filter(Boolean),i=0;for(;i<e.length;){let t=e[i];if(!(ed.test(t)||t.startsWith("-")||t.startsWith(">")||t.startsWith("<")||ep.test(t)||er.has(t.slice(t.lastIndexOf("/")+1))))break;i++}if(i>=e.length||!ea.test(e[i]))continue;let n=e.slice(i+1),o=n.findIndex(e=>el.test(e));if(-1!==o&&n.slice(o+1).some(e=>ec.test(e)))return!0}return!1}let em=/(?:Invoke-WebRequest|iwr|Invoke-RestMethod|irm)\s+.*\|\s*(?:Invoke-Expression|iex)/i,ef=/^-[a-zA-Z]*f[a-zA-Z]*$/,eh=["--force-with-lease","--force-if-includes"],eg=/\.(?:pem|key)$/,ey=/id_rsa/,eb=/credentials/,ew=/git\s+(commit|merge|rebase|cherry-pick)\b/,ek=/(?:^|;|&&|\|\||\|)\s*failproofai(?:\s|$)/,ev=/(?:npm\s+(?:uninstall|remove|un|r)\s.*failproofai|bun\s+remove\s.*failproofai|yarn\s+global\s+remove\s+failproofai|pnpm\s+(?:remove|uninstall|un)\s.*failproofai)/,eN=/\bgit\s+commit\b.*--amend\b/,eS=/\bgit\s+stash\s+(?:drop|clear)\b/,eT=/\bgit\s+add\s+(?:-A\b|--all\b|\.(?:\s|$|;|&&|\|\|))/,eP=/\bnpm\s+(?:install|i)\b(?=.*(?:\s-g\b|--global\b))/,eE=/\byarn\s+global\s+add\b/,e$=/\bpnpm\s+(?:add|install|i)\b(?=.*(?:\s-g\b|--global\b))/,eC=/\bbun\s+(?:install|add)\b(?=.*(?:\s-g\b|--global\b))/,eI=/\bcargo\s+install\b/,ex=/\bpip(?:3)?\s+install\b(?=.*(?:--user\b|--break-system-packages\b))/,eA={pip:[/\bpip\b/,/\bpip3\b/,/\bpython3?\s+-m\s+pip\b/],npm:[/\bnpm\b/,/\bnpx\b/],yarn:[/\byarn\b/],pnpm:[/\bpnpm\b/,/\bpnpx\b/],bun:[/\bbun\b/,/\bbunx\b/],uv:[/\buv\b/],poetry:[/\bpoetry\b/],pipenv:[/\bpipenv\b/],conda:[/\bconda\b/],cargo:[/\bcargo\b/]},eR=/\bnohup\s+\S/,eO=/\bscreen\s+-[A-Za-z]*d[A-Za-z]*\b/,e_=/\btmux\s+(?:new-session|new)\b[^|&;]*-d\b/,eB=/\bdisown\b/,ej=/(?<![&|])\s?&\s*(?:$|#|;)/,eD=/(?:^|[;\n]|&&|\|\|?|&)\s*kubectl(?:\s|$)/,eW=/(?:^|[;\n]|&&|\|\|?|&)\s*(?:terraform|tofu)(?:\s|$)/,eM=/(?:^|[;\n]|&&|\|\|?|&)\s*aws(?:\s|$)/,eU=/(?:^|[;\n]|&&|\|\|?|&)\s*gcloud(?:\s|$)/,eL=/(?:^|[;\n]|&&|\|\|?|&)\s*az(?:\s|$)/,ez=/(?:^|[;\n]|&&|\|\|?|&)\s*helm(?:\s|$)/,eF=/(?:^|[;\n]|&&|\|\|?|&)\s*gh\s+(?:workflow\s+(?:run|enable|disable)|run\s+(?:rerun|cancel)|pr\s+merge|release\s+(?:create|delete)|cache\s+delete|secret\s+(?:set|delete))\b/,eH=new Map;function eq(e){try{let t=function(e){try{return(0,o.statSync)((0,n.join)(e,".git","HEAD")).mtimeMs}catch{return null}}(e),i=eH.get(e);if(i&&null!==t&&i.headMtimeMs===t)return i.branch||null;let s=(0,r.execSync)("git rev-parse --abbrev-ref HEAD",{cwd:e,encoding:"utf8",stdio:["pipe","pipe","pipe"],timeout:3e3}).trim();return null!==t&&(eH.size>=500&&eH.clear(),eH.set(e,{branch:s,headMtimeMs:t})),s||null}catch{return null}}function eJ(e,t){let i=O(e),n=O(t);return!(i.length<n.length||i.some(e=>_.has(e))||i.some(e=>B.test(e)))&&n.every((e,t)=>"*"===e||e===i[t])}let eG=/^-{1,2}c$/;function eY(e){return e.split(/&&|\|\||[|;\n]/).map(e=>e.trim()).filter(e=>/^git\s+push\s/.test(e)).map(e=>e.replace(/^git\s+push\s+/,""))}let eZ=/^(?:~[A-Za-z0-9_.-]*|\$HOME|\$\{HOME\})(?=$|\/)/,eK=/^(?:\/\S*\/)?rm$/,eQ=/^(?:\/\S*\/)?find$/,eV=/^-(?:exec|execdir|ok|okdir)$/,eX=/^-(?:[HLP]|D|O\d*)$/,e0=/^(?:-|\\?[(!])/,e1=["/tmp","/var/tmp"];function e3(e){let t=e.match(/^(?:~|\$HOME|\$\{HOME\})(?=$|\/)/);return t?(0,a.homedir)()+e.slice(t[0].length):e}function e8(e){return e.replace(/\/\*$/,"").replace(/\/+$/,"")}function e6(e){let t=e.replace(/^['"]|['"]$/g,"");if(""===t)return!1;let i=t.match(eZ);if(!i&&/^[$`]/.test(t))return!0;let n=i?t.slice(i[0].length):t.startsWith("/")?t:null;if(null===n)return!1;let o=e8(n).split("/").filter(Boolean);return!(!i&&e1.some(e=>`/${o.join("/")}`.startsWith(`${e}/`)))&&o.length<=2}function e2(e){let t=O(e),i=t.findIndex(e=>eQ.test(e));if(i>=0){let e=t.slice(i+1),n=e.findIndex(e=>eV.test(e));if(e.includes("-delete")||n>=0&&eK.test(e[n+1]??"")){let t=0;for(;t<e.length&&eX.test(e[t]);)t+="-D"===e[t]?2:1;let i=e.slice(t),n=i.findIndex(e=>e0.test(e));return n<0?i:i.slice(0,n)}}let n=t.findIndex(e=>eK.test(e));if(n>=0){let e=t.slice(n+1),i=e.filter(e=>/^-[^-]/.test(e)).join(""),o=e.filter(e=>/^--/.test(e)),s=/r/i.test(i)||o.some(e=>/^--recursive$/i.test(e)),r=/f/.test(i)||o.some(e=>/^--force$/i.test(e));if(s&&r)return e.filter(e=>!e.startsWith("-"))}return null}function e4(e){return e.split(/&&|\|\||[|;\n]/).map(e=>e.trim()).filter(e=>""!==e)}let e9=/(?:^|;|&&|\|\||\|)\s*(?:ls|find|cat|head|tail|less|more|wc|file|stat|tree|du)\s/;function e5(e,t,i){if("Bash"!==e.toolName)return l();let n=A(e);return!t.test(n)||(e.params?.allowPatterns??[]).some(e=>eJ(n,e))?l():c(i)}let e7=/\s*(?:&&|\|\||\||;)\s*/;function te(e){return e.session?.permissionMode==="plan"}let tt=[{name:"sanitize-jwt",description:"Stop Claude from reading JWTs in tool responses",displayTitle:"Redacted JWT tokens from tool output",impact:"Stops the agent from echoing auth tokens it saw in command output.",fn:function(e){let t=JSON.stringify(e.payload);return j.test(t)?{decision:"deny",reason:"JWT token detected in tool output",message:"[REDACTED: JWT token removed by failproofai]"}:l()},match:{events:["PostToolUse"]},defaultEnabled:!0,category:"Sanitize"},{name:"sanitize-api-keys",description:"Stop Claude from reading API keys (OpenAI, Anthropic, GitHub, AWS, Stripe, Google) in tool responses",displayTitle:"Redacted API keys from tool output",impact:"Catches OpenAI / Anthropic / GitHub / AWS / Stripe / Google keys before the model sees them.",fn:function(e){let t=JSON.stringify(e.payload);for(let[e,i]of D)if(e.test(t))return{decision:"deny",reason:`${i} detected in tool output`,message:`[REDACTED: ${i} removed by failproofai]`};for(let{regex:i,label:n}of e.params?.additionalPatterns??[])try{if(new RegExp(i).test(t))return{decision:"deny",reason:`${n} detected in tool output`,message:`[REDACTED: ${n} removed by failproofai]`}}catch{C(`additionalPatterns: invalid regex "${i}", skipping`)}return l()},match:{events:["PostToolUse"]},defaultEnabled:!0,category:"Sanitize",params:{additionalPatterns:{type:"pattern[]",description:"Additional API key patterns to scrub, each with { regex, label }",default:[]}}},{name:"sanitize-connection-strings",description:"Stop Claude from reading database connection strings with embedded credentials in tool responses",displayTitle:"Redacted database connection strings from tool output",impact:"Strips embedded DB credentials before they reach the model context.",fn:function(e){let t=JSON.stringify(e.payload);return W.test(t)?{decision:"deny",reason:"Database connection string with credentials detected in tool output",message:"[REDACTED: connection string removed by failproofai]"}:l()},match:{events:["PostToolUse"]},defaultEnabled:!0,category:"Sanitize"},{name:"sanitize-private-key-content",description:"Stop Claude from reading PEM private key content in tool responses",displayTitle:"Redacted PEM private keys from tool output",impact:"Prevents private key bodies from being echoed into chat context.",fn:function(e){let t=JSON.stringify(e.payload);return M.test(t)?{decision:"deny",reason:"Private key content detected in tool output",message:"[REDACTED: private key content removed by failproofai]"}:l()},match:{events:["PostToolUse"]},defaultEnabled:!0,category:"Sanitize"},{name:"sanitize-bearer-tokens",displayTitle:"Redacted bearer tokens from tool output",impact:"Strips Authorization: Bearer values before they hit the model.",description:"Stop Claude from reading Authorization Bearer tokens in tool responses",fn:function(e){let t=JSON.stringify(e.payload);return U.test(t)?{decision:"deny",reason:"Bearer token detected in tool output",message:"[REDACTED: Bearer token removed by failproofai]"}:l()},match:{events:["PostToolUse"]},defaultEnabled:!0,category:"Sanitize"},{name:"protect-env-vars",displayTitle:"Tried to dump environment variables to chat",impact:"Env vars often contain secrets; blocking `env` / `printenv` keeps them out of the model context.",description:"Prevent commands that read environment variables",fn:function(e){if("Bash"!==e.toolName)return l();let t=A(e);return G.test(t)?c("Command reads environment variables"):Y.test(t)?c("Command echoes environment variable"):Z.test(t)?c("Command exports environment variable"):K.test(t)?c("Command reads environment variable via PowerShell"):Q.test(t)?c("Command reads environment variables via PowerShell"):V.test(t)?c("Command reads environment variable via .NET"):X.test(t)?c("Command echoes environment variable via cmd"):l()},match:{events:["PreToolUse"],toolNames:["Bash"]},defaultEnabled:!0,category:"Environment"},{name:"block-env-files",displayTitle:"Tried to read or write a .env file",impact:"`.env` files routinely contain API keys and DB credentials.",description:"Block reading/writing .env files",fn:function(e){let t=A(e),i=R(e);return i&&ee.test(i)?c("Access to .env file blocked"):"Bash"===e.toolName&&et.test(t)?c("Command references .env file"):l()},match:{events:["PreToolUse"]},defaultEnabled:!0,category:"Environment"},{name:"block-read-outside-cwd",displayTitle:"Tried to read files outside your project directory",impact:"Stops the agent from peeking at neighboring repos or your home directory.",description:"Block file reads outside the session working directory",fn:function(e){let t=process.env.CLAUDE_PROJECT_DIR||e.session?.cwd;if(!t)return l();let i=e.params?.allowPaths??[];if("Bash"===e.toolName){let o=A(e);if(!e9.test(o))return l();let s=function(e){let t,i=[],o=/(?<![a-zA-Z0-9_.\-~\\*?:=])(?:~\/[^\s;|&"'()\[\]{}]*|~(?=\s|$|[;|&"'()\[\]{}])|\/[^\s;|&"'()\[\]{}]*)/g;function s(e){let t;for(o.lastIndex=0;null!==(t=o.exec(e));){let e=t[0];"~"===e?e=(0,a.homedir)():e.startsWith("~/")&&(e=(0,n.join)((0,a.homedir)(),e.slice(2))),i.push(e)}}let r=e.length,l=!1,c=!1;for(let t=0;t<e.length;t++){let i=e[t];if('"'!==i||c)if("'"!==i||l){if("|"===i&&!l&&!c){r=t;break}}else c=!c;else l=!l}let d=e.slice(0,r),p=/"([^"]*)"|'([^']*)'/g;for(;null!==(t=p.exec(d));){let e=t[1]??t[2]??"";/[*?\[\]^$+()\\]/.test(e)||s(e)}return s(e.replace(/"[^"]*"/g,e=>" ".repeat(e.length)).replace(/'[^']*'/g,e=>" ".repeat(e.length))),i}(o),r=t.endsWith("/")?t:t+"/";for(let e of s){let o=(0,n.resolve)(t,e);if(x(o))return c(`Reading agent settings file blocked: ${o}`);if(!I(o)&&"/dev/null"!==o&&o!==t&&!o.startsWith(r)){if(i.some(e=>o===e||o.startsWith(e.endsWith("/")?e:e+"/")))continue;return c(`Bash read outside project directory blocked: ${o}`)}}return l()}let o=R(e),s=e.toolInput?.path??"",r=o||s;if(!r)return l();let d=(0,n.resolve)(t,r);if(x(d))return c(`Reading agent settings file blocked: ${d}`);if(I(d)||"/dev/null"===d)return l();let p=t.endsWith("/")?t:t+"/";return d===t||d.startsWith(p)?l():i.some(e=>d===e||d.startsWith(e.endsWith("/")?e:e+"/"))?l():c(`Access outside project directory blocked: ${d}`)},match:{events:["PreToolUse"],toolNames:["Read","Glob","Grep","Bash"]},defaultEnabled:!1,category:"Environment",params:{allowPaths:{type:"string[]",description:"Absolute paths outside cwd that are allowed to be read",default:[]}}},{name:"block-self-pause",displayTitle:"Tried to pause failproofai enforcement",impact:"An agent that can pause enforcement can switch off every other policy.",description:"Block agents from pausing failproofai enforcement",fn:function(e){if("Bash"!==e.toolName)return l();let t=A(e);return eu(t)||eu(t.replace(/\\\r?\n/g,"").replace(/\$'((?:[^'\\]|\\.)*)'/g,(e,t)=>t.replace(/\\(x[0-9A-Fa-f]{1,2}|u[0-9A-Fa-f]{1,4}|U[0-9A-Fa-f]{1,8}|[0-7]{1,3}|.)/g,(e,t)=>{try{if("x"===t[0])return String.fromCharCode(parseInt(t.slice(1),16));if("u"===t[0]||"U"===t[0])return String.fromCodePoint(parseInt(t.slice(1),16));if(/^[0-7]+$/.test(t))return String.fromCharCode(parseInt(t,8))}catch{return t}return({a:"\x07",b:"\b",e:"\x1b",f:"\f",n:"\n",r:"\r",t:"	",v:"\v","\\":"\\","'":"'",'"':'"',"?":"?"})[t]??t})).replace(/\\(.)/g,"$1").replace(/['"]/g,""))?c("Pausing failproofai enforcement is a human action, not an agent one. If a policy is blocking legitimate work, say so and let the operator decide."):l()},match:{events:["PreToolUse","PermissionRequest"],toolNames:["Bash"]},defaultEnabled:!0,category:"Dangerous Commands"},{name:"block-sudo",displayTitle:"Tried to run a command with sudo",impact:"Sudo gives the agent root — blocked unless explicitly allow-listed.",description:"Block sudo commands",fn:function(e){if("Bash"!==e.toolName)return l();let t=A(e).trimStart();return function e(t,i=0){for(let n of function(e){let t=[],i=[],n="",o=null,s=()=>{n&&i.push(n),n=""},r=()=>{s(),i.length&&t.push(i),i=[]};for(let t=0;t<e.length;t++){let i=e[t];if(o){if("\\"===i&&'"'===o&&t+1<e.length){n+=e[++t];continue}if(i===o){o=null;continue}n+=i;continue}if("\\"===i&&t+1<e.length){n+=e[++t];continue}if('"'===i||"'"===i){o=i;continue}if(/\s/.test(i)){s();continue}if(/[;&|\n\r(){}`]/.test(i)){r();continue}n+=i}return r(),t}(t)){let t=0;for(;t<n.length;){let o=n[t],s=o.slice(o.lastIndexOf("/")+1);if("sudo"===s||"doas"===s)return!0;if(!(ed.test(o)||o.startsWith("-")||o.startsWith(">")||o.startsWith("<")||ep.test(o)||er.has(s)))break;if(eG.test(o)&&i<3&&t+1<n.length&&e(n[t+1],i+1))return!0;t++}}return!1}(t)?(e.params?.allowPatterns??[]).some(e=>eJ(t,e))?l():c("sudo commands are blocked"):ei.test(t)?c("Elevated process launch is blocked"):en.test(t)?c("runas elevation is blocked"):l()},match:{events:["PreToolUse","PermissionRequest"],toolNames:["Bash"]},defaultEnabled:!0,category:"Dangerous Commands",params:{allowPatterns:{type:"string[]",description:"Sudo command patterns to allow, matched token-by-token (e.g. 'sudo systemctl status')",default:[]}}},{name:"block-curl-pipe-sh",displayTitle:"Tried to pipe a downloaded script straight to a shell",impact:"`curl ... | sh` runs unverified remote code on your machine.",description:"Block piping downloads to shell",fn:function(e){if("Bash"!==e.toolName)return l();let t=A(e);return eo.test(t)?c("Piping downloads to shell is blocked"):em.test(t)?c("Piping downloads to Invoke-Expression is blocked"):l()},match:{events:["PreToolUse"],toolNames:["Bash"]},defaultEnabled:!0,category:"Dangerous Commands"},{name:"block-rm-rf",displayTitle:"Tried to recursively delete a system path",impact:"Catches catastrophic `rm -rf /` and Windows equivalents.",description:"Prevent catastrophic deletions",fn:function(e){if("Bash"!==e.toolName)return l();let t=A(e);return e4(t).some(e=>{let t=e2(e);return null!==t&&t.some(e6)})?!function(e,t){if(0===t.length)return!1;let i=t.map(e=>e8(e3(e))||"/"),n=!1;for(let o of e4(e)){let e=e2(o);if(null!==e)for(let s of(n=!0,e)){let e=e8(e3(s))||"/";if(!i.some(t=>e===t||e.startsWith(t+"/"))&&!t.some(e=>{let t=e.replace(/[.*+?^${}()|[\]\\]/g,"\\$&");return RegExp(`${t}(?:[/"'\\s/*]|$)`).test(o)}))return!1}}return n}(t,e.params?.allowPaths??[])?c("Catastrophic deletion blocked"):l():/Remove-Item\s+.*-Recurse.*-Force.*(?:[A-Z]:\\(?:\s|$)|\\\*)/i.test(t)||/(?:rd|rmdir)\s+\/s\s+\/q\s+[A-Z]:\\/i.test(t)?c("Catastrophic deletion blocked"):l()},match:{events:["PreToolUse"],toolNames:["Bash"]},defaultEnabled:!1,category:"Dangerous Commands",params:{allowPaths:{type:"string[]",description:"Paths that are allowed to be recursively deleted",default:[]}}},{name:"block-failproofai-commands",displayTitle:"Tried to disable or modify failproofai itself",impact:"Prevents the agent from turning off the policies that protect you.",description:"Block failproofai CLI commands and uninstallation",fn:function(e){if("Bash"!==e.toolName)return l();let t=A(e);return ek.test(t)?c("Running failproofai CLI commands is blocked"):ev.test(t)?c("Uninstalling failproofai is blocked"):l()},match:{events:["PreToolUse"],toolNames:["Bash"]},defaultEnabled:!0,category:"Dangerous Commands"},{name:"block-kubectl",displayTitle:"Tried to run a Kubernetes command",impact:"kubectl can change live cluster state — gated unless allow-listed.",description:"Block kubectl commands (Kubernetes cluster mutations)",fn:function(e){return e5(e,eD,"kubectl commands are blocked")},match:{events:["PreToolUse"],toolNames:["Bash"]},defaultEnabled:!1,category:"Infra Commands",params:{allowPatterns:{type:"string[]",description:"kubectl command patterns to allow, matched token-by-token (e.g. 'kubectl get *', 'kubectl describe *')",default:[]}}},{name:"block-terraform",displayTitle:"Tried to run a Terraform/OpenTofu command",impact:"Terraform mutates real infrastructure — gated unless allow-listed.",description:"Block terraform and tofu (OpenTofu) commands",fn:function(e){return e5(e,eW,"terraform/tofu commands are blocked")},match:{events:["PreToolUse"],toolNames:["Bash"]},defaultEnabled:!1,category:"Infra Commands",params:{allowPatterns:{type:"string[]",description:"terraform/tofu command patterns to allow (e.g. 'terraform plan', 'terraform validate')",default:[]}}},{name:"block-aws-cli",displayTitle:"Tried to run an AWS CLI command",impact:"AWS CLI can spend money or break prod — gated.",description:"Block aws CLI commands",fn:function(e){return e5(e,eM,"aws CLI commands are blocked")},match:{events:["PreToolUse"],toolNames:["Bash"]},defaultEnabled:!1,category:"Infra Commands",params:{allowPatterns:{type:"string[]",description:"aws CLI command patterns to allow (e.g. 'aws s3 ls *', 'aws sts get-caller-identity')",default:[]}}},{name:"block-gcloud",displayTitle:"Tried to run a Google Cloud command",impact:"gcloud can spend money or break prod — gated.",description:"Block gcloud (Google Cloud) CLI commands",fn:function(e){return e5(e,eU,"gcloud commands are blocked")},match:{events:["PreToolUse"],toolNames:["Bash"]},defaultEnabled:!1,category:"Infra Commands",params:{allowPatterns:{type:"string[]",description:"gcloud command patterns to allow (e.g. 'gcloud auth list', 'gcloud config list')",default:[]}}},{name:"block-az-cli",displayTitle:"Tried to run an Azure CLI command",impact:"az can spend money or break prod — gated.",description:"Block az (Azure) CLI commands",fn:function(e){return e5(e,eL,"az (Azure) CLI commands are blocked")},match:{events:["PreToolUse"],toolNames:["Bash"]},defaultEnabled:!1,category:"Infra Commands",params:{allowPatterns:{type:"string[]",description:"az CLI command patterns to allow (e.g. 'az account show', 'az group list')",default:[]}}},{name:"block-helm",displayTitle:"Tried to run a Helm command",impact:"Helm releases mutate cluster state — gated.",description:"Block helm commands",fn:function(e){return e5(e,ez,"helm commands are blocked")},match:{events:["PreToolUse"],toolNames:["Bash"]},defaultEnabled:!1,category:"Infra Commands",params:{allowPatterns:{type:"string[]",description:"helm command patterns to allow (e.g. 'helm list', 'helm status *')",default:[]}}},{name:"block-gh-pipeline",displayTitle:"Tried to run a privileged GitHub CLI pipeline command",impact:"Catches `gh workflow run`, `gh pr merge`, `gh secret set`, etc.",description:"Block gh CLI pipeline-trigger subcommands (workflow run, run rerun/cancel, pr merge, release create/delete, cache delete, secret set/delete)",fn:function(e){return e5(e,eF,"gh pipeline-trigger commands are blocked")},match:{events:["PreToolUse"],toolNames:["Bash"]},defaultEnabled:!1,category:"Infra Commands",params:{allowPatterns:{type:"string[]",description:"gh pipeline command patterns to allow (e.g. specific scripted invocations); read-only gh subcommands like 'gh pr view' and 'gh run list' are not matched by this policy",default:[]}}},{name:"block-secrets-write",displayTitle:"Tried to write a secret-key file",impact:"Stops the agent from creating `.pem`, `id_rsa`, `credentials.json`, etc.",description:"Block writing secret key files",fn:function(e){if("Write"!==e.toolName)return l();let t=R(e);if(eg.test(t)||ey.test(t)||eb.test(t))return c("Writing secret key files is blocked");for(let i of e.params?.additionalPatterns??[])if(t.includes(i))return c(`Writing blocked file pattern: ${i}`);return l()},match:{events:["PreToolUse"],toolNames:["Write"]},defaultEnabled:!1,category:"Dangerous Commands",params:{additionalPatterns:{type:"string[]",description:"Additional filename patterns (substrings) to block",default:[]}}},{name:"block-push-master",displayTitle:"Tried to push directly to main/master",impact:"Direct pushes to a protected branch bypass review.",description:"Block pushing to main/master",fn:function(e){if("Bash"!==e.toolName)return l();let t=e.params?.protectedBranches??["main","master"];if(0===t.length)return l();let i=eY(A(e)),n=RegExp(`\\b(?:${t.map(e=>e.replace(/[.*+?^${}()|[\]\\]/g,"\\$&")).join("|")})\\b`);return i.some(e=>n.test(e))?c(`Pushing to ${t.join("/")} is blocked`):l()},match:{events:["PreToolUse"],toolNames:["Bash"]},defaultEnabled:!0,category:"Git",params:{protectedBranches:{type:"string[]",description:"Branch names to protect from direct pushes",default:["main","master"]}}},{name:"block-force-push",displayTitle:"Tried to force-push",impact:"Force-pushes rewrite history and can clobber teammates' work.",description:"Prevent force-pushing to any branch",fn:function(e){if("Bash"!==e.toolName)return l();for(let t of eY(A(e))){let e=!1;for(let i of t.split(/\s+/)){if("--"===i){e=!0;continue}if(!e&&function(e){return"--force"===e||!eh.some(t=>e.startsWith(t))&&(!!e.startsWith("--force")||ef.test(e))}(i))return c("Force-pushing is blocked")}}return l()},match:{events:["PreToolUse"],toolNames:["Bash"]},defaultEnabled:!1,category:"Git"},{name:"block-work-on-main",displayTitle:"Tried to commit or merge on main/master",impact:"Work should land via PR — direct commits skip review.",description:"Block git commits and merges on main/master branch",fn:function(e){if("Bash"!==e.toolName)return l();let t=A(e).match(ew);if(!t)return l();let i=e.session?.cwd;if(!i)return l();let n=eq(i);return n&&(e.params?.protectedBranches??["main","master"]).includes(n)?c(`Git ${t[1]} on ${n} is blocked. Create a feature branch first.`):l()},match:{events:["PreToolUse"],toolNames:["Bash"]},defaultEnabled:!1,category:"Git",params:{protectedBranches:{type:"string[]",description:"Branch names where commits/merges are blocked",default:["main","master"]}}},{name:"warn-git-amend",displayTitle:"Used git commit --amend",impact:"Amending after a push rewrites history that others may have pulled.",description:"Warns before amending git commits, which rewrites history",fn:function(e){if("Bash"!==e.toolName)return l();let t=A(e);return eN.test(t)?d("STOP: This command amends the last commit, which rewrites git history. If this commit has already been pushed to a shared branch, this will cause divergence for other contributors. Confirm with the user before executing."):l()},match:{events:["PreToolUse"],toolNames:["Bash"]},defaultEnabled:!1,category:"Git"},{name:"warn-git-stash-drop",displayTitle:"Tried to drop or clear git stash",impact:"Stash deletions are permanent and silent.",description:"Warns before permanently deleting stashed changes",fn:function(e){if("Bash"!==e.toolName)return l();let t=A(e);return eS.test(t)?d("STOP: This command permanently deletes stashed changes (git stash drop/clear). Stash entries cannot be recovered after deletion. Confirm with the user before executing."):l()},match:{events:["PreToolUse"],toolNames:["Bash"]},defaultEnabled:!1,category:"Git"},{name:"warn-all-files-staged",displayTitle:"Staged all files with git add -A / .",impact:"Wide stages routinely catch generated files or secrets you didn't intend to commit.",description:"Warns before staging all working tree files with git add -A / . / --all",fn:function(e){if("Bash"!==e.toolName)return l();let t=A(e);return eT.test(t)?d("STOP: This command stages all files in the working tree (git add -A / --all / .). This may inadvertently include build artifacts, generated files, or sensitive files not covered by .gitignore. Confirm with the user before executing."):l()},match:{events:["PreToolUse"],toolNames:["Bash"]},defaultEnabled:!1,category:"Git"},{name:"warn-destructive-sql",displayTitle:"Ran destructive SQL (DROP / TRUNCATE / DELETE without WHERE)",impact:"Easy way to wipe a table by accident.",description:"Warn before executing destructive SQL (DROP/TRUNCATE/DELETE without WHERE) via database clients",fn:function(e){if("Bash"!==e.toolName)return l();let t=A(e);return L.test(t)&&(z.test(t)||F.test(t)&&!H.test(t))?d("STOP: This command contains destructive SQL (DROP/TRUNCATE/DELETE). Confirm with the user before executing."):l()},match:{events:["PreToolUse"],toolNames:["Bash"]},defaultEnabled:!1,category:"Database"},{name:"warn-schema-alteration",displayTitle:"Altered a database schema column",impact:"ALTER TABLE operations can lock tables and break readers.",description:"Warns before SQL schema changes (ALTER TABLE with column or rename operations)",fn:function(e){if("Bash"!==e.toolName)return l();let t=A(e);return L.test(t)&&q.test(t)?d("STOP: This command contains a schema-altering SQL statement (ALTER TABLE with column or rename operation). Schema changes on production databases are irreversible or disruptive. Confirm with the user before executing."):l()},match:{events:["PreToolUse"],toolNames:["Bash"]},defaultEnabled:!1,category:"Database"},{name:"warn-package-publish",displayTitle:"Tried to publish a package",impact:"Publishes are irreversible — `npm publish` / `cargo publish` shouldn't happen without intent.",description:"Warn before publishing packages to public registries (npm, PyPI, crates.io, RubyGems, etc.)",fn:function(e){if("Bash"!==e.toolName)return l();let t=A(e);return J.test(t)?d("STOP: This command publishes a package to a public registry. Confirm with the user that this is intentional."):l()},match:{events:["PreToolUse"],toolNames:["Bash"]},defaultEnabled:!1,category:"Packages & System"},{name:"warn-global-package-install",displayTitle:"Installed a package globally",impact:"`npm i -g`, `cargo install`, `pip --user` pollute your machine outside the project.",description:"Warns before installing packages globally (npm -g, cargo install, etc.)",fn:function(e){if("Bash"!==e.toolName)return l();let t=A(e);return eP.test(t)||eE.test(t)||e$.test(t)||eC.test(t)||eI.test(t)||ex.test(t)?d("STOP: This command installs a package globally, which modifies the system-wide environment outside the project. This can conflict with other projects or system tools. Confirm with the user before executing."):l()},match:{events:["PreToolUse"],toolNames:["Bash"]},defaultEnabled:!1,category:"Packages & System"},{name:"prefer-package-manager",displayTitle:"Used a non-preferred package manager",impact:"Mixing package managers creates lockfile churn for your team.",description:"Blocks non-preferred package managers and tells Claude to use an allowed one (e.g., uv instead of pip)",fn:function(e){if("Bash"!==e.toolName)return l();let t=A(e);if(!t)return l();let i=e.params?.allowed??[];if(0===i.length)return l();let n=new Set(i.map(e=>e.toLowerCase())),o=e.params?.blocked??[],s=i.join(", ");for(let e of t.split(e7)){let t=e.trim();if(!t)continue;let i=!1;for(let e of n){let n=eA[e];if(n){for(let e of n)if(e.test(t)){i=!0;break}if(i)break}}if(!i){for(let[e,i]of Object.entries(eA))if(!n.has(e)){for(let n of i)if(n.test(t))return c(`"${e}" is not an allowed package manager. Allowed package managers for this project: ${s}. Rewrite this command using an allowed package manager.`)}for(let e of o){let i=e.toLowerCase();if(!n.has(i)&&RegExp(`\\b${i.replace(/[.*+?^${}()|[\]\\]/g,"\\$&")}\\b`).test(t))return c(`"${i}" is not an allowed package manager. Allowed package managers for this project: ${s}. Rewrite this command using an allowed package manager.`)}}}return l()},match:{events:["PreToolUse"],toolNames:["Bash"]},defaultEnabled:!1,category:"Packages & System",params:{allowed:{type:"string[]",description:"Allowed package manager names (e.g. ['uv', 'bun']). Any detected manager not in this list is blocked.",default:[]},blocked:{type:"string[]",description:"Additional manager names to block beyond the built-in list (e.g. ['pdm', 'pipx']).",default:[]}}},{name:"warn-large-file-write",displayTitle:"Wrote a file larger than the configured threshold",impact:"Catches accidentally large file writes (logs, binaries, model dumps).",description:"Warn before writing files larger than 1MB (configurable via thresholdKb param)",fn:function(e){if("Write"!==e.toolName)return l();let t=e.toolInput?.content;if("string"!=typeof t)return l();let i=e.params?.thresholdKb??1024;return t.length>1024*i?d(`STOP: You are writing a file larger than ${i}KB (${Math.round(t.length/1024)}KB). This is unusually large. Confirm this is intentional before proceeding.`):l()},match:{events:["PreToolUse"],toolNames:["Write"]},defaultEnabled:!1,category:"Packages & System",params:{thresholdKb:{type:"number",description:"File size threshold in KB above which a warning is issued",default:1024}}},{name:"warn-background-process",displayTitle:"Started a long-lived background process",impact:"Catches `nohup` / `&` / `screen` / `tmux` / `disown` patterns that the agent often forgets to clean up.",description:"Warns before starting detached or background processes",fn:function(e){if("Bash"!==e.toolName)return l();let t=A(e);return eR.test(t)||eO.test(t)||e_.test(t)||eB.test(t)||ej.test(t)?d("STOP: This command starts a background or detached process (nohup, screen -d, tmux -d, or trailing &). Background processes persist after Claude's session and may be difficult to track or stop. Confirm with the user before executing."):l()},match:{events:["PreToolUse"],toolNames:["Bash"]},defaultEnabled:!1,category:"Packages & System"},{name:"warn-repeated-tool-calls",displayTitle:"Called the same tool 3+ times with identical arguments",impact:"Usually a sign of a stuck loop burning tokens.",description:"Warn when the same tool is called 3+ times with identical parameters",fn:async function e(e){let t=e.session?.transcriptPath;if(!t||!e.toolName||!e.toolInput)return l();let i=`${t}.tool-calls.json`,n=JSON.stringify({tool:e.toolName,input:e.toolInput}),o={};try{let e=await (0,s.readFile)(i,"utf8");o=JSON.parse(e)}catch{}let r=o[n]??0;if(r>=3)return d(`STOP: You have already called ${e.toolName} ${r} times with identical parameters. This is wasteful and unproductive. Do NOT repeat this call — use a different approach or ask the user for clarification.`);o[n]=r+1;try{let e=JSON.stringify(o);e.length<=65536&&await (0,s.writeFile)(i,e,"utf8")}catch{}return l()},match:{events:["PreToolUse"]},defaultEnabled:!1,category:"AI Behavior"},{name:"require-commit-before-stop",displayTitle:"Stopped with uncommitted changes",impact:"Work not in a commit is invisible to teammates and easy to lose.",description:"Require all changes to be committed before Claude stops",fn:function(e){if(te(e))return l("Plan mode — no changes made, skipping commit check.");let t=e.session?.cwd;if(!t)return l("No working directory available, skipping commit check.");try{if((0,r.execSync)("git status --porcelain",{cwd:t,encoding:"utf8",stdio:["pipe","pipe","pipe"],timeout:5e3}).trim().length>0)return c("You have uncommitted changes in the working directory. Commit all changes now.");return l("All changes are committed.")}catch{return l("Not a git repository, skipping commit check.")}},match:{events:["Stop"]},defaultEnabled:!1,category:"Workflow"},{name:"require-push-before-stop",displayTitle:"Stopped with unpushed commits",impact:"Local-only commits won't trigger CI or be reviewable.",description:"Require all commits to be pushed to remote before Claude stops",fn:function(e){if(te(e))return l("Plan mode — no changes made, skipping push check.");let t=e.session?.cwd;if(!t)return l("No working directory available, skipping push check.");try{if(!(0,r.execSync)("git remote",{cwd:t,encoding:"utf8",stdio:["pipe","pipe","pipe"],timeout:3e3}).trim())return l("No git remote configured, skipping push check.");let i=e.params?.remote??"origin",n=eq(t);if(!n||"HEAD"===n)return l("Detached HEAD, skipping push check.");let o=e.params?.baseBranch??"main";if(n===o)return l(`On base branch "${o}", skipping push check.`);try{if(!(0,r.execFileSync)("git",["log",`${i}/${o}..HEAD`,"--oneline"],{cwd:t,encoding:"utf8",stdio:["pipe","pipe","pipe"],timeout:5e3}).trim())return l(`No commits ahead of ${i}/${o}, skipping push check.`);if(!(0,r.execFileSync)("git",["diff","--stat",`${i}/${o}`,"HEAD"],{cwd:t,encoding:"utf8",stdio:["pipe","pipe","pipe"],timeout:5e3}).trim())return l(`No file changes compared to ${i}/${o}, skipping push check.`)}catch{}let s=!1;try{(0,r.execFileSync)("git",["rev-parse","--verify",`${i}/${n}`],{cwd:t,encoding:"utf8",stdio:["pipe","pipe","pipe"],timeout:3e3}),s=!0}catch{}if(!s)return c(`Branch "${n}" has not been pushed to remote "${i}". Run now: git push -u ${i} ${n}`);let a=(0,r.execFileSync)("git",["log",`${i}/${n}..HEAD`,"--oneline"],{cwd:t,encoding:"utf8",stdio:["pipe","pipe","pipe"],timeout:5e3}).trim();if(a.length>0){let e=a.split("\n").length;return c(`You have ${e} unpushed commit${e>1?"s":""} on branch "${n}". Run now: git push`)}return l(`All commits pushed to "${i}".`)}catch{return l("Could not check push status, skipping.")}},match:{events:["Stop"]},defaultEnabled:!1,category:"Workflow",params:{remote:{type:"string",description:"Remote name to push to (default: origin)",default:"origin"},baseBranch:{type:"string",description:"Base branch to compare against (default: main)",default:"main"}}},{name:"require-pr-before-stop",displayTitle:"Stopped without a PR for the branch",impact:"Branches without PRs don't get reviewed.",description:"Require a pull request to exist for the current branch before Claude stops",fn:function(e){if(te(e))return l("Plan mode — no changes made, skipping PR check.");let t=e.session?.cwd;if(!t)return l("No working directory available, skipping PR check.");try{let i;try{(0,r.execSync)("gh --version",{cwd:t,encoding:"utf8",stdio:["pipe","pipe","pipe"],timeout:3e3})}catch{return l("GitHub CLI (gh) not installed, skipping PR check.")}let n=eq(t);if(!n||"HEAD"===n)return l("Detached HEAD, skipping PR check.");let o=e.params?.baseBranch??"main";if(n===o)return l(`On base branch "${o}", skipping PR check.`);try{if(!(0,r.execFileSync)("git",["log",`origin/${o}..HEAD`,"--oneline"],{cwd:t,encoding:"utf8",stdio:["pipe","pipe","pipe"],timeout:5e3}).trim())return l(`No commits ahead of origin/${o}, skipping PR check.`);if(!(0,r.execFileSync)("git",["diff","--stat",`origin/${o}`,"HEAD"],{cwd:t,encoding:"utf8",stdio:["pipe","pipe","pipe"],timeout:5e3}).trim())return l(`No file changes compared to origin/${o}, skipping PR check.`)}catch{}try{i=(0,r.execSync)("gh pr view --json number,url,state",{cwd:t,encoding:"utf8",stdio:["pipe","pipe","pipe"],timeout:15e3}).trim()}catch{return c(`No pull request found for branch "${n}". Run now: gh pr create`)}let s=JSON.parse(i);if("OPEN"===s.state)return l(`PR #${s.number} exists: ${s.url}`);if("MERGED"===s.state)return l(`PR #${s.number} was merged: ${s.url}. Switch off this branch (e.g. 'git checkout ${o} && git pull') before stopping again.`);return c(`Pull request for branch "${n}" is ${s.state.toLowerCase()}. Run now: gh pr create`)}catch{return l("Could not check PR status, skipping.")}},match:{events:["Stop"]},defaultEnabled:!1,category:"Workflow",params:{baseBranch:{type:"string",description:"Base branch to compare against (default: main)",default:"main"}}},{name:"require-no-conflicts-before-stop",displayTitle:"Stopped with a branch that conflicts with main",impact:"Conflicting branches can't merge — surface them early.",description:"Require the current branch to merge cleanly with the base branch before Claude stops",fn:function(e){let t,i;if(te(e))return l("Plan mode — no changes made, skipping conflict check.");let n=e.session?.cwd;if(!n)return l("No working directory available, skipping conflict check.");let o=eq(n);if(!o||"HEAD"===o)return l("Detached HEAD, skipping conflict check.");let s=e.params?.baseBranch??"main";if(o===s)return l(`On base branch "${s}", skipping conflict check.`);try{(0,r.execSync)("gh --version",{cwd:n,encoding:"utf8",stdio:["pipe","pipe","pipe"],timeout:3e3})}catch{return l("gh CLI not installed, skipping conflict check.")}try{t=(0,r.execSync)("gh pr view --json mergeable,number,url,state",{cwd:n,encoding:"utf8",stdio:["pipe","pipe","pipe"],timeout:15e3}).trim()}catch{return l("No pull request found for branch, skipping conflict check.")}try{i=JSON.parse(t)}catch{return l("Could not parse gh pr view output, skipping conflict check.")}if("OPEN"!==i.state)return l(`PR #${i.number} is ${i.state.toLowerCase()}; skipping conflict check.`);try{(0,r.execFileSync)("git",["rev-parse","--verify",`origin/${s}`],{cwd:n,encoding:"utf8",stdio:["pipe","pipe","pipe"],timeout:3e3}),(0,r.execFileSync)("git",["log",`origin/${s}..HEAD`,"--oneline"],{cwd:n,encoding:"utf8",stdio:["pipe","pipe","pipe"],timeout:5e3}).trim()&&(0,r.execFileSync)("git",["merge-tree","--write-tree","--name-only",`origin/${s}`,"HEAD"],{cwd:n,encoding:"utf8",stdio:["pipe","pipe","pipe"],timeout:1e4})}catch(e){if(1===e.status){let t=("string"==typeof e.stdout?e.stdout:e.stdout?.toString("utf8")??"").trim().split("\n"),i=[];for(let e=1;e<t.length;e++){let n=t[e];if(""===n)break;i.push(n)}let n=i.length?i.join(", "):"one or more files";return c(`Branch "${o}" has merge conflicts with ${s} in: ${n}. Rebase or merge origin/${s} now and resolve the conflicts.`)}}return"CONFLICTING"===i.mergeable?c(`PR #${i.number} has merge conflicts per GitHub (${i.url}). Rebase or merge origin/${s} now and resolve the conflicts.`):"UNKNOWN"===i.mergeable?c(`GitHub is still computing mergeability for PR #${i.number} (${i.url}). Wait ~10 seconds, then re-check with \`gh pr view --json mergeable\` before attempting to stop again.`):l(`PR #${i.number} merges cleanly per GitHub.`)},match:{events:["Stop"]},defaultEnabled:!1,category:"Workflow",params:{baseBranch:{type:"string",description:"Base branch to check for conflicts against (default: main)",default:"main"}}},{name:"require-ci-green-before-stop",displayTitle:"Stopped with failing CI",impact:"Failing CI blocks deploy.",description:"Require CI checks to pass on the current HEAD commit before Claude stops (ignores stale runs on prior commits)",fn:function(e){if(te(e))return l("Plan mode — no changes made, skipping CI check.");let t=e.session?.cwd;if(!t)return l("No working directory available, skipping CI check.");try{try{(0,r.execSync)("gh --version",{cwd:t,encoding:"utf8",stdio:["pipe","pipe","pipe"],timeout:3e3})}catch{return l("GitHub CLI (gh) not installed, skipping CI check.")}let e=eq(t);if(!e||"HEAD"===e)return l("Detached HEAD, skipping CI check.");let i=function(e){try{return(0,r.execSync)("git rev-parse HEAD",{cwd:e,encoding:"utf8",stdio:["pipe","pipe","pipe"],timeout:3e3}).trim()||null}catch{return null}}(t),n=[];try{let o=(0,r.execFileSync)("gh",["run","list","--branch",e,"--limit","20","--json","status,conclusion,name,headSha"],{cwd:t,encoding:"utf8",stdio:["pipe","pipe","pipe"],timeout:15e3}).trim();if(o&&"[]"!==o){let e=JSON.parse(o),t=i?e.filter(e=>e.headSha===i):e,s=new Set;n=t.filter(e=>!s.has(e.name)&&(s.add(e.name),!0))}}catch{}let o=[],s=[];i&&(o=function(e,t){try{let i=(0,r.execFileSync)("gh",["api",`repos/{owner}/{repo}/commits/${t}/check-runs`,"--jq",'.check_runs | map(select(.app.slug != "github-actions")) | map({name: .name, status: .status, conclusion: (.conclusion // "")})'],{cwd:e,encoding:"utf8",stdio:["pipe","pipe","pipe"],timeout:15e3}).trim();if(!i||"[]"===i)return[];return JSON.parse(i)}catch{return[]}}(t,i),s=function(e,t){try{let i=(0,r.execFileSync)("gh",["api",`repos/{owner}/{repo}/commits/${t}/statuses`,"--jq","map({name: .context, state: .state}) | unique_by(.name)"],{cwd:e,encoding:"utf8",stdio:["pipe","pipe","pipe"],timeout:15e3}).trim();if(!i||"[]"===i)return[];return JSON.parse(i).map(e=>({name:e.name,status:"pending"===e.state?"in_progress":"completed",conclusion:"pending"===e.state?"":"success"===e.state?"success":"failure"}))}catch{return[]}}(t,i));let a=[...n,...o,...s];if(0===a.length)return l(`No CI runs found for branch "${e}".`);let d=a.filter(e=>"completed"===e.status&&"success"!==e.conclusion&&"skipped"!==e.conclusion&&"cancelled"!==e.conclusion&&"neutral"!==e.conclusion);if(d.length>0){let t=d.map(e=>`"${e.name}"`).join(", ");return c(`CI checks are failing on branch "${e}": ${t}. Fix the failing checks now.`)}let p=a.filter(e=>"in_progress"===e.status||"queued"===e.status||"waiting"===e.status);if(p.length>0){let t=p.map(e=>`"${e.name}"`).join(", ");return c(`CI checks are still running on branch "${e}": ${t}. Wait for all checks to complete, then verify they pass.`)}return l(`All CI checks passed on branch "${e}".`)}catch{return l("Could not check CI status, skipping.")}},match:{events:["Stop"]},defaultEnabled:!1,category:"Workflow"}];function ti(e){if(!(0,o.existsSync)(e))return{};try{let t=(0,o.readFileSync)(e,"utf8");return JSON.parse(t)}catch(t){return C(`failed to parse config at ${e}: ${t instanceof Error?t.message:String(t)}`),{}}}let tn=["claude","codex","copilot","cursor","opencode","pi","hermes","openclaw","factory","devin","antigravity","goose"],to={apply_patch:"Edit",write_stdin:"Bash"},ts={terminal:"Bash",bash:"Bash",read_file:"Read",write_file:"Write",patch:"Edit",web_search:"WebSearch",web_extract:"WebFetch",search_files:"Grep",todo:"TodoWrite"},tr={Read:{path:"file_path"},Write:{path:"file_path"},Edit:{path:"file_path"}},ta={bash:"Bash",powershell:"Bash",list_bash:"Bash",read_bash:"Bash",stop_bash:"Bash",write_bash:"Bash",list_powershell:"Bash",read_powershell:"Bash",stop_powershell:"Bash",write_powershell:"Bash",read:"Read",view:"Read",show_file:"Read",write:"Write",create:"Write",edit:"Edit",apply_patch:"Edit",str_replace_editor:"Edit",glob:"Glob",grep:"Grep",rg:"Grep",ls:"LS",web_fetch:"WebFetch"},tl={Read:{path:"file_path"},Write:{path:"file_path",file_text:"content"},Edit:{path:"file_path",old_str:"old_string",new_str:"new_string"}},tc={Shell:"Bash"},td={bash:"Bash",read:"Read",write:"Write",edit:"Edit",apply_patch:"Edit",glob:"Glob",grep:"Grep",list:"LS",webfetch:"WebFetch",websearch:"WebSearch",todowrite:"TodoWrite",todoread:"TodoRead"},tp={Read:{filePath:"file_path"},Write:{filePath:"file_path"},Edit:{filePath:"file_path",oldString:"old_string",newString:"new_string",replaceAll:"replace_all"}},tu={bash:"Bash",read:"Read",write:"Write",edit:"Edit",glob:"Glob",grep:"Grep"},tm={Read:{path:"file_path"},Write:{path:"file_path"},Edit:{path:"file_path"}},tf={exec:"Bash",read:"Read",write:"Write",edit:"Edit",grep:"Grep",glob:"Glob",web_search:"WebSearch",web_fetch:"WebFetch"},th={Read:{path:"file_path"},Write:{path:"file_path"},Edit:{path:"file_path"}},tg={Execute:"Bash",Read:"Read",Edit:"Edit",Create:"Write",Grep:"Grep",Glob:"Glob",LS:"LS",FetchUrl:"WebFetch",WebSearch:"WebSearch",TodoWrite:"TodoWrite",Task:"Task"},ty={exec:"Bash"},tb={run_command:"Bash",write_to_file:"Write",read_file:"Read",view_file:"Read",edit_file:"Edit",replace_file_content:"Edit",list_dir:"LS",find_by_name:"Glob",grep_search:"Grep",read_url_content:"WebFetch",search_web:"WebSearch"},tw={Bash:{CommandLine:"command",Cwd:"cwd"},Write:{TargetFile:"file_path",CodeContent:"content"},Edit:{TargetFile:"file_path"},Read:{TargetFile:"file_path",AbsolutePath:"file_path",File:"file_path"}},tk={shell:"Bash",write:"Write",edit:"Edit",view:"Read",read_image:"Read",glob:"Glob",grep:"Grep",tree:"LS",delegate:"Task",todo__todo_write:"TodoWrite"},tv={Read:{path:"file_path",source:"file_path"},Write:{path:"file_path"},Edit:{path:"file_path"},LS:{path:"file_path"}};["SessionStart","SessionEnd","UserPromptSubmit","PreToolUse","PermissionRequest","PermissionDenied","PostToolUse","PostToolUseFailure","Notification","SubagentStart","SubagentStop","TaskCreated","TaskCompleted","Stop","StopFailure","TeammateIdle","InstructionsLoaded","ConfigChange","CwdChanged","FileChanged","WorktreeCreate","WorktreeRemove","PreCompact","PostCompact","Elicitation","ElicitationResult","UserPromptExpansion","PostToolBatch","Setup"].filter(e=>"WorktreeCreate"!==e);var tN=e.i(81580);let tS=/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/i;var tT=e.i(54214);function tP(e,t){let i=[];for(let o of e)if("assistant"===o.type)for(let e of o.message.content){var n;let s;if("tool_use"!==e.type)continue;let r=e.name,a=(n=t.cli,(r?"copilot"===n?ta[r]??r:"cursor"===n?tc[r]??r:"codex"===n?to[r]??r:"opencode"===n?td[r]??r:"pi"===n?tu[r]??r:"hermes"===n?ts[r]??r:"openclaw"===n?tf[r]??r:"factory"===n?tg[r]??r:"devin"===n?ty[r]??r:"antigravity"===n?tb[r]??r:"goose"===n?tk[r]??r:r:r)??r),l=function(e,t,i){let n;if(!e||!t||"object"!=typeof t||Array.isArray(t)||("copilot"===i?n=tl[e]:"opencode"===i?n=tp[e]:"pi"===i?n=tm[e]:"hermes"===i?n=tr[e]:"openclaw"===i?n=th[e]:"antigravity"===i?n=tw[e]:"goose"===i&&(n=tv[e]),!n))return t;let o={};for(let[e,i]of Object.entries(t))o[n[e]??e]=i;return o}(a,e.input,t.cli);e.result?.content&&(s=function(e){let t=Buffer.from(e,"utf-8");if(t.byteLength<=65536)return e;let i=65536;for(;i>0&&(192&t[i])==128;)i--;return t.subarray(0,i).toString("utf-8")}(e.result.content)),i.push({cli:t.cli,sessionId:t.sessionId,transcriptPath:t.transcriptPath,cwd:t.cwd,timestamp:o.timestamp,toolName:a,rawToolName:r,toolInput:l??{},toolResultText:s})}return i}async function tE(e={}){let t=e.projects?new Set(e.projects):null,i=e.sinceMs??0,s=[];for(let e of function(){let e,t=(0,tN.getClaudeProjectsPath)();try{e=(0,o.readdirSync)(t,{withFileTypes:!0})}catch{return[]}return e.filter(e=>e.isDirectory()).map(e=>({name:e.name,cwd:(0,tN.decodeFolderName)(e.name),path:(0,n.join)(t,e.name)}))}()){let r;if(!t||t.has(e.cwd)){try{r=function(e){let t,i=[];try{t=(0,o.readdirSync)(e.path,{withFileTypes:!0})}catch{return i}for(let s of t)if(s.isFile()&&s.name.endsWith(".jsonl")){let t=s.name.slice(0,-6);if(!tS.test(t))continue;let r=(0,n.join)(e.path,s.name);try{let n=(0,o.statSync)(r);i.push({projectName:e.name,cwd:e.cwd,sessionId:t,transcriptPath:r,mtimeMs:n.mtimeMs,sizeBytes:n.size,isSubagent:!1})}catch{}}else if(s.isDirectory()&&tS.test(s.name)){let t,r=(0,n.join)(e.path,s.name,"subagents");if(!(0,o.existsSync)(r))continue;try{t=(0,o.readdirSync)(r,{withFileTypes:!0})}catch{continue}for(let s of t){if(!s.isFile()||!s.name.endsWith(".jsonl"))continue;let t=s.name.slice(0,-6),a=(0,n.join)(r,s.name);try{let n=(0,o.statSync)(a);i.push({projectName:e.name,cwd:e.cwd,sessionId:t,transcriptPath:a,mtimeMs:n.mtimeMs,sizeBytes:n.size,isSubagent:!0})}catch{}}}return i}(e)}catch{continue}for(let t of r)t.mtimeMs<i||s.push({cli:"claude",projectName:e.name,sessionId:t.sessionId,transcriptPath:t.transcriptPath,mtimeMs:t.mtimeMs,sizeBytes:t.sizeBytes})}}return s}async function t$(e){let t,i;try{t=await (0,s.readFile)(e.transcriptPath,"utf-8")}catch{return[]}try{i=await (0,tT.parseLogContent)(t,"session")}catch{return[]}let n="";for(let e of t.split("\n",50))if(e.trim())try{let t=JSON.parse(e);if("string"==typeof t.cwd&&t.cwd.length>0){n=t.cwd;break}}catch{}return tP(i,{cli:"claude",sessionId:e.sessionId,transcriptPath:e.transcriptPath,cwd:n})}var tC=e.i(36203),tI=e.i(57232);async function tx(e={}){let t=e.projects?new Set(e.projects):null,i=e.sinceMs??0,n=[];for(let e of(await (0,tC.getCodexProjects)())){let{cwd:s,sessions:r}=await (0,tC.getCodexSessionsByEncodedName)(e.name),a=s??"";if(!t||t.has(a))for(let t of r){let s=t.lastModified.getTime();if(s<i)continue;let r=0;try{r=(0,o.statSync)(t.path).size}catch{}t.sessionId&&n.push({cli:"codex",projectName:e.name,sessionId:t.sessionId,transcriptPath:t.path,mtimeMs:s,sizeBytes:r})}}return n}async function tA(e){let t=await (0,tI.getCodexSessionLog)(e.sessionId);return t?tP(t.entries,{cli:"codex",sessionId:e.sessionId,transcriptPath:e.transcriptPath,cwd:t.cwd??""}):[]}var tR=e.i(55851),tO=e.i(78166);async function t_(e={}){let t=e.projects?new Set(e.projects):null,i=e.sinceMs??0,n=[];for(let e of(await (0,tR.getCopilotProjects)())){let{cwd:s,sessions:r}=await (0,tR.getCopilotSessionsByEncodedName)(e.name),a=s??"";if(!t||t.has(a))for(let t of r){let s=t.lastModified.getTime();if(s<i)continue;let r=0;try{r=(0,o.statSync)(t.path).size}catch{}t.sessionId&&n.push({cli:"copilot",projectName:e.name,sessionId:t.sessionId,transcriptPath:t.path,mtimeMs:s,sizeBytes:r})}}return n}async function tB(e){let t=await (0,tO.getCopilotSessionLog)(e.sessionId);return t?tP(t.entries,{cli:"copilot",sessionId:e.sessionId,transcriptPath:e.transcriptPath,cwd:t.cwd??""}):[]}var tj=e.i(46413),tD=e.i(72094);async function tW(e={}){let t=e.projects?new Set(e.projects):null,i=e.sinceMs??0,n=[];for(let e of(await (0,tj.getCursorProjects)())){let{cwd:s,sessions:r}=await (0,tj.getCursorSessionsByEncodedName)(e.name),a=s??"";if(!t||t.has(a))for(let t of r){let s=t.lastModified.getTime();if(s<i)continue;let r=0;try{r=(0,o.statSync)(t.path).size}catch{}t.sessionId&&n.push({cli:"cursor",projectName:e.name,sessionId:t.sessionId,transcriptPath:t.path,mtimeMs:s,sizeBytes:r})}}return n}async function tM(e){let t=await (0,tD.getCursorSessionLog)(e.sessionId);return t?tP(t.entries,{cli:"cursor",sessionId:e.sessionId,transcriptPath:e.transcriptPath,cwd:t.cwd??""}):[]}var tU=e.i(35435),tL=e.i(99440);async function tz(e={}){let t=e.projects?new Set(e.projects):null,i=e.sinceMs??0,n=[];for(let e of(await (0,tU.getOpenCodeProjects)())){let{cwd:o,sessions:s}=await (0,tU.getOpenCodeSessionsByEncodedName)(e.name),r=o??"";if(!t||t.has(r))for(let t of s){let o=t.lastModified.getTime();!(o<i)&&t.sessionId&&n.push({cli:"opencode",projectName:e.name,sessionId:t.sessionId,transcriptPath:t.path,mtimeMs:o,sizeBytes:0})}}return n}async function tF(e){let t=await (0,tL.getOpenCodeSessionLog)(e.sessionId);return t?tP(t.entries,{cli:"opencode",sessionId:e.sessionId,transcriptPath:e.transcriptPath,cwd:t.cwd??""}):[]}var tH=e.i(19791),tq=e.i(85116);async function tJ(e={}){let t=e.projects?new Set(e.projects):null,i=e.sinceMs??0,n=[];for(let e of(await (0,tH.getPiProjects)())){let{cwd:s,sessions:r}=await (0,tH.getPiSessionsByEncodedName)(e.name),a=s??"";if(!t||t.has(a))for(let t of r){let s=t.lastModified.getTime();if(s<i)continue;let r=0;try{r=(0,o.statSync)(t.path).size}catch{}t.sessionId&&n.push({cli:"pi",projectName:e.name,sessionId:t.sessionId,transcriptPath:t.path,mtimeMs:s,sizeBytes:r})}}return n}async function tG(e){let t=await (0,tq.getPiSessionLog)(e.sessionId);return t?tP(t.entries,{cli:"pi",sessionId:e.sessionId,transcriptPath:e.transcriptPath,cwd:t.cwd??""}):[]}var tY=e.i(64828),tZ=e.i(28898),tK=e.i(3605);async function tQ(e={}){let t=e.projects?new Set(e.projects):null,i=e.sinceMs??0,n=await (0,tY.getHermesSessions)(),o=[];for(let e of n)!(e.mtimeMs<i)&&(!(e.messageCount<=0)||e.hasMessages)&&(!t||e.cwd&&t.has(e.cwd))&&o.push({cli:"hermes",projectName:e.cwd?(0,tN.encodeFolderName)(e.cwd):e.source?(0,tZ.hermesProjectPath)(e.profile,e.source):`hermes:${e.profile}`,sessionId:e.sessionId,transcriptPath:`hermes://${e.sessionId}`,mtimeMs:e.mtimeMs,sizeBytes:e.messageCount});return o}async function tV(e){let t=await (0,tK.getHermesSessionLog)(e.sessionId);return t?tP(t.entries,{cli:"hermes",sessionId:e.sessionId,transcriptPath:e.transcriptPath,cwd:t.cwd??""}):[]}var tX=e.i(90624),t0=e.i(64199);async function t1(e={}){if(e.projects&&e.projects.length>0)return[];let t=e.sinceMs??0,i=[];for(let e of(await (0,tX.getOpenClawSessions)()))e.mtimeMs<t||i.push({cli:"openclaw",projectName:(0,tX.openClawProjectPath)(e.agentId,e.channel),sessionId:e.sessionId,transcriptPath:e.transcriptPath,mtimeMs:e.mtimeMs,sizeBytes:e.sizeBytes});return i}async function t3(e){let t=await (0,t0.getOpenClawSessionLog)(e.sessionId);return t?tP(t.entries,{cli:"openclaw",sessionId:e.sessionId,transcriptPath:e.transcriptPath,cwd:t.cwd??""}):[]}var t8=e.i(28246);async function t6(e={}){let t=e.projects?new Set(e.projects):null,i=e.sinceMs??0,n=[];for(let e of(0,t8.listFactoryTranscripts)())!(e.mtimeMs<i)&&(!t||t.has(e.cwd))&&n.push({cli:"factory",projectName:e.projectName,sessionId:e.sessionId,transcriptPath:e.transcriptPath,mtimeMs:e.mtimeMs,sizeBytes:e.sizeBytes});return n}async function t2(e){let t;try{t=await (0,s.readFile)(e.transcriptPath,"utf-8")}catch{return[]}let i=(0,tT.parseRawLines)(t,"session"),n=(0,t8.factoryLinesToLogEntries)(i,"session"),o="";for(let e of i)if(e&&"object"==typeof e&&"session_start"===e.type){let t=e.cwd;if("string"==typeof t&&t.length>0){o=t;break}}return tP(n,{cli:"factory",sessionId:e.sessionId,transcriptPath:e.transcriptPath,cwd:o})}var t4=e.i(93114),t9=e.i(30441);async function t5(e={}){let t=e.projects?new Set(e.projects):null,i=e.sinceMs??0,n=[],o=await (0,t9.getAntigravityIndex)();for(let e of(0,t4.listAntigravityTranscripts)()){if(e.mtimeMs<i)continue;let s=o.get(e.conversationId)?.cwd;(!t||s&&t.has(s))&&n.push({cli:"antigravity",projectName:s?(0,tN.encodeFolderName)(s):"antigravity",sessionId:e.conversationId,transcriptPath:e.transcriptPath,mtimeMs:e.mtimeMs,sizeBytes:e.sizeBytes})}return n}async function t7(e){let t;try{t=await (0,s.readFile)(e.transcriptPath,"utf-8")}catch{return[]}let i=(0,tT.parseRawLines)(t,"session"),n=(0,t4.antigravityLinesToLogEntries)(i,"session"),o="";for(let e of i){if(!e||"object"!=typeof e)continue;let t=e.tool_calls;if(Array.isArray(t)){for(let e of t){let t=e&&"object"==typeof e?e.args:void 0,i=t&&"object"==typeof t?t.Cwd:void 0;if("string"==typeof i&&i.length>0){o=i;break}}if(o)break}}return tP(n,{cli:"antigravity",sessionId:e.sessionId,transcriptPath:e.transcriptPath,cwd:o})}var ie=e.i(79364),it=e.i(40375);async function ii(e={}){let t=e.projects?new Set(e.projects):null,i=e.sinceMs??0,n=await (0,ie.getDevinSessions)(),o=[];for(let e of n)!(e.mtimeMs<i)&&(!t||e.cwd&&t.has(e.cwd))&&o.push({cli:"devin",projectName:e.projectName,sessionId:e.sessionId,transcriptPath:`devin-db://${e.sessionId}`,mtimeMs:e.mtimeMs,sizeBytes:0});return o}async function io(e){let t=await (0,it.getDevinSessionLog)(e.sessionId);return t?tP(t.entries,{cli:"devin",sessionId:e.sessionId,transcriptPath:e.transcriptPath,cwd:t.cwd??""}):[]}var is=e.i(69164),ir=e.i(36618);let ia={claude:{cli:"claude",listTranscripts:tE,streamEvents:t$},codex:{cli:"codex",listTranscripts:tx,streamEvents:tA},copilot:{cli:"copilot",listTranscripts:t_,streamEvents:tB},cursor:{cli:"cursor",listTranscripts:tW,streamEvents:tM},opencode:{cli:"opencode",listTranscripts:tz,streamEvents:tF},pi:{cli:"pi",listTranscripts:tJ,streamEvents:tG},hermes:{cli:"hermes",listTranscripts:tQ,streamEvents:tV},openclaw:{cli:"openclaw",listTranscripts:t1,streamEvents:t3},factory:{cli:"factory",listTranscripts:t6,streamEvents:t2},devin:{cli:"devin",listTranscripts:ii,streamEvents:io},antigravity:{cli:"antigravity",listTranscripts:t5,streamEvents:t7},goose:{cli:"goose",listTranscripts:async function(e={}){let t=e.projects?new Set(e.projects):null,i=e.sinceMs??0,n=await (0,is.getGooseSessions)(),o=[];for(let e of n)!(e.mtimeMs<i)&&(!t||e.cwd&&t.has(e.cwd))&&o.push({cli:"goose",projectName:e.projectName,sessionId:e.sessionId,transcriptPath:`goose-db://${e.sessionId}`,mtimeMs:e.mtimeMs,sizeBytes:0});return o},streamEvents:async function(e){let t=await (0,ir.getGooseSessionLog)(e.sessionId);return t?tP(t.entries,{cli:"goose",sessionId:e.sessionId,transcriptPath:e.transcriptPath,cwd:t.cwd??""}):[]}}},il=/\.(?:ts|tsx|js|jsx|mjs|cjs|py|go|rs|java|kt|swift|rb|php|c|h|cc|cpp|hpp|cs|scala|sh|bash|zsh|json|yaml|yml|toml|md|txt|sql|html|css|scss|sass)$/i,ic=["/","/home","/usr","/etc","/var","/opt","/Users"],id="rereadAfterEdit",ip=[{name:"redundant-cd-cwd",description:"Bash commands prefixed with `cd <cwd> && …` even though commands already run in cwd.",category:"Wasteful",severity:"info",displayTitle:"Prepended cd <cwd> before commands",impact:"Pure waste — your agent's shell already runs in `cwd`.",detect(e){if("Bash"!==e.toolName)return null;let t=e.toolInput.command;if("string"!=typeof t||!e.cwd)return null;let i=t.trimStart(),n=/^cd\s+(?:"([^"]+)"|'([^']+)'|(\S+))\s*&&\s*([\s\S]+)$/.exec(i);if(!n)return null;let o=(n[1]??n[2]??n[3]??"").replace(/\/+$/,"");if(o!==e.cwd.replace(/\/+$/,""))return null;let s=n[4].trim();return{example:`cd ${o} && ${s}`}}},{name:"prefer-edit-over-read-cat",description:"Bash `cat`/`head`/`tail`/`less`/`more` on a single source file — use Read.",category:"Wasteful",severity:"info",displayTitle:"Used `cat`/`head`/`tail` on a source file",impact:"Burns tokens; the Read tool returns content directly without going through Bash output.",detect(e){if("Bash"!==e.toolName)return null;let t=e.toolInput.command;if("string"!=typeof t)return null;let i=t.trim();if(/[|<>;&`$()]/.test(i))return null;let n=/^(cat|head|tail|less|more)\s+(?:-\S+\s+)*(?:"([^"]+)"|'([^']+)'|(\S+))\s*$/.exec(i);if(!n)return null;let o=n[2]??n[3]??n[4]??"";return!o||/(?:^|\/)\.env(?:\..+)?$/.test(o)||!il.test(o)?null:{example:i}}},{name:"prefer-edit-over-sed-awk",description:"Bash `sed -i`/`awk` in-place edits — use Edit.",category:"Wasteful",severity:"info",displayTitle:"Used sed -i or awk for an in-place edit",impact:"Edit tool is safer and produces a diff the agent can verify.",detect(e){if("Bash"!==e.toolName)return null;let t=e.toolInput.command;if("string"!=typeof t)return null;let i=t.trim();return/(?:^|\s|;|&&|\|\|)sed\b[^|]*\s-i(?=\b|['"])/.test(i)||/(?:^|\s|;|&&|\|\|)awk\b[^|]*\s>\s*\S+/.test(i)&&!/\|/.test(i)?{example:i}:null}},{name:"prefer-write-over-heredoc",description:"Bash heredoc / `echo > file` writing multi-line content — use Write.",category:"Wasteful",severity:"info",displayTitle:"Used heredoc / `echo > file` to write a multi-line file",impact:"Write tool handles escaping and is verifiable.",detect(e){if("Bash"!==e.toolName)return null;let t=e.toolInput.command;return"string"!=typeof t?null:/<<-?\s*['"]?[A-Za-z_][A-Za-z0-9_]*['"]?\s*>\s*\S/.test(t)||/(?:^|\s|;|&&|\|\|)(?:echo|printf)\s+["'][^"']*\n[^"']*["']\s*>\s*\S/.test(t)?{example:t.replace(/\s+/g," ").trim().slice(0,160)}:null}},{name:"sleep-polling-loop",description:"Bash long `sleep` or while-sleep polling loops.",category:"Wasteful",severity:"info",displayTitle:"Used a long sleep or while-sleep polling loop",impact:"Burns wall-clock; better to wait for an explicit signal.",detect(e){if("Bash"!==e.toolName)return null;let t=e.toolInput.command;if("string"!=typeof t)return null;if(/\bwhile\b[\s\S]*?\bsleep\b[\s\S]*?\bdone\b/.test(t))return{example:t.replace(/\s+/g," ").trim().slice(0,160)};let i=/\bsleep\s+(\d+(?:\.\d+)?)(m|h|d)?\b/.exec(t);if(i){let e=parseFloat(i[1]),n=i[2]??"s";if(("m"===n?60*e:"h"===n?3600*e:"d"===n?86400*e:e)>=30)return{example:t.replace(/\s+/g," ").trim().slice(0,160)}}return null}},{name:"find-from-root",description:"Bash `find` against `/`, `/home`, `/usr`, etc. — scope to cwd instead.",category:"Risky",severity:"warn",displayTitle:"Ran find from /, /home, /usr, etc.",impact:"Filesystem-wide finds exhaust resources and rarely return useful results.",detect(e){if("Bash"!==e.toolName)return null;let t=e.toolInput.command;if("string"!=typeof t)return null;let i=t.trim(),n=/(?:^|[\s;|&])find\s+(?:-\S+\s+)*("[^"]+"|'[^']+'|\S+)/.exec(i);if(!n)return null;let o=n[1].replace(/^["']|["']$/g,"").replace(/\/+$/,"")||"/";return ic.includes(o)?{example:i.slice(0,160)}:null}},{name:"git-commit-no-verify",description:"git commit invoked with --no-verify / -n, skipping hooks.",category:"Risky",severity:"warn",displayTitle:"Committed with --no-verify",impact:"Skips pre-commit hooks that exist to catch broken or unsafe code.",detect(e){if("Bash"!==e.toolName)return null;let t=e.toolInput.command;return"string"!=typeof t?null:/\bgit\s+commit\b/.test(t)&&(/\s--no-verify\b/.test(t)||/\s-n\b/.test(t))?{example:t.replace(/\s+/g," ").trim().slice(0,160)}:null}},{name:"reread-after-edit",description:"Read of a file that was just Edit'd or Write'n in the same session.",category:"Wasteful",severity:"info",displayTitle:"Re-read a file it just edited",impact:"Edit/Write already returned the updated content; the second Read is wasted tokens.",detect(e,t){let i,n=((i=t[id])||(i={countdown:new Map},t[id]=i),i),o=e.toolInput.file_path,s="string"==typeof o?o:null;for(let[e,t]of n.countdown)t<=1?n.countdown.delete(e):n.countdown.set(e,t-1);return s?"Edit"===e.toolName||"Write"===e.toolName?(n.countdown.set(s,5),null):"Read"===e.toolName&&n.countdown.has(s)?(n.countdown.delete(s),{example:`Read ${s} immediately after Edit/Write`}):null:null}}],iu=["cowboy","explorer","ghost","optimist","hammer","architect"],im={explorer:.38,architect:.33,hammer:.11,cowboy:.11,optimist:.07,ghost:.01,precision:0,goldfish:0},ih={optimist:0,cowboy:0,explorer:0,goldfish:0,architect:0,precision:0,hammer:0,ghost:0};for(let e of iu)ih[e]=Math.max(im[e],.05);var ig=e.i(66680);let iy=null,ib=null;function iw(){if(iy)return iy;let e=tt.map(e=>`${e.name}|${e.fn.toString()}`).sort().join("\n");return iy=(0,ig.createHash)("sha1").update(e).digest("hex").slice(0,16)}function ik(){if(ib)return ib;let e=ip.map(e=>`${e.name}|${e.detect.toString()}`).sort().join("\n");return ib=(0,ig.createHash)("sha1").update(e).digest("hex").slice(0,16)}function iv(e){let t=(0,y.auditCacheDir)(),i=(0,ig.createHash)("sha1").update(e).digest("hex");return(0,n.join)(t,`${i}.json`)}var iN=e.i(24214),iS=e.i(28067),iT=e.i(17694);let iP=iS.POSTHOG_API_KEY,iE=new Set;async function i$(e,t,i){let n=JSON.stringify({api_key:process.env.FAILPROOFAI_POSTHOG_KEY??iP,event:t,distinct_id:e,properties:{...i,$lib:"failproofai-hooks",failproofai_version:iN.version,product:iS.POSTHOG_PRODUCT}});try{await fetch(process.env.FAILPROOFAI_POSTHOG_HOST?`${process.env.FAILPROOFAI_POSTHOG_HOST}/capture/`:"https://us.i.posthog.com/capture/",{method:"POST",headers:{"Content-Type":"application/json"},body:n,signal:AbortSignal.timeout(5e3)})}catch{}}async function iC(e,t,i){if(!(0,iT.isTelemetryEnabled)())return;let n=i$(e,t,i);iE.add(n),n.finally(()=>iE.delete(n)),await n}var iI=e.i(10659);function ix(e,t){let i=e.trim(),n="string"==typeof t?t.trim():"";return n?i?`${i}. ${n}`:n:i}let iA=new Map(tt.filter(e=>e.params).map(e=>[f(e.name),e.params]));function iR(e,t){if(!e?.policyParams)return;let i=e.policyParams[t];if(i)return i;let n=`${m}/`;if(t.startsWith(n))return e.policyParams[t.slice(n.length)]}async function iO(e,t,i,n){let o=t.tool_name,s=t.tool_input,r=function(e,t){let i=globalThis[u];i||h(i=new Map);let n=`${e}:${t??""}`,o=i.get(n);if(o)return o;let s=g().filter(i=>(!i.match.events||!(i.match.events.length>0)||!!i.match.events.includes(e))&&(!i.match.toolNames||!(i.match.toolNames.length>0)||!!t&&!!i.match.toolNames.includes(t))).sort((e,t)=>t.priority-e.priority);return i.set(n,s),s}(e,o);if($(`evaluating ${r.length} policies for ${e}`),0===r.length)return{exitCode:0,stdout:"",stderr:"",policyName:null,reason:null,decision:"allow"};let a={eventType:e,payload:t,toolName:o,toolInput:s,session:i,cli:i?.cli},l=[],c=[];for(let t of r){let o,s,r=iA.get(t.name);if(r){let e=iR(n,t.name)??{},i={};for(let[t,n]of Object.entries(r))i[t]=t in e?e[t]:n.default;o={...a,params:i}}else o={...a,params:{}};try{s=await t.fn(o)}catch(o){let n=o instanceof Error?o.message:String(o);C(`policy "${t.name}" threw: ${n}`),t.name.startsWith("custom/")||t.name.startsWith(".failproofai-")||iC((0,iI.getInstanceId)(),"policy_evaluation_error",{policy_name:t.name,event_type:e,cli:i?.cli??null,error_type:o instanceof Error?o.name:"unknown"});continue}if("deny"===s.decision){let r,a=ix(s.reason??`Blocked by policy: ${t.name}`,iR(n,t.name)?.hint);$(`deny by "${t.name}": ${a}`),r=o.toolName?o.toolName:"UserPromptSubmit"===e?"prompt":"SessionStart"===e?"session start":"SessionEnd"===e?"session end":"Stop"===e?"stop":"operation";let l=`Blocked ${r} by failproofai because: ${a}, as per the policy configured by the user`;if(i?.cli==="cursor"){if("Stop"===e||"SubagentStop"===e)return{exitCode:0,stdout:JSON.stringify({followup_message:`MANDATORY ACTION REQUIRED from failproofai (policy: ${t.name}): ${a}
 
 You MUST complete the above action NOW. Do NOT ask the user for confirmation — execute the required action, then attempt to finish your task again.`}),stderr:"",policyName:t.name,reason:a,decision:"deny"};if("UserPromptSubmit"===e)return{exitCode:0,stdout:JSON.stringify({continue:!1,user_message:l}),stderr:"",policyName:t.name,reason:a,decision:"deny"};return{exitCode:0,stdout:JSON.stringify({permission:"deny",user_message:l,agent_message:l}),stderr:"",policyName:t.name,reason:a,decision:"deny"}}if(i?.cli==="pi"){if("Stop"===e)return{exitCode:0,stdout:JSON.stringify({permission:"deny",reason:`MANDATORY ACTION REQUIRED from failproofai (policy: ${t.name}): ${a}
 

package/.next/standalone/.next/server/chunks/_1zuiiy3._.js

@@ -1,3 +1,3 @@
-module.exports=[17694,e=>{"use strict";var t=e.i(2157);e.i(50227);var i=e.i(79857);let r={mode:"oss",daemon:{configured:!1},collector:{sessions:!1,hooks:!0,hooksVerbosity:"decisions",redact:"minimal",environment:"local"},telemetry:{enabled:!0},audit:{auto:!1,intervalDays:7}};e.s(["isTelemetryEnabled",0,function(){if("1"===process.env.FAILPROOFAI_TELEMETRY_DISABLED)return!1;try{return function(){try{var e;let r,n,a,s,o;return e=JSON.parse((0,t.readFileSync)((0,i.configFile)(),"utf8")),r=e.mode?.kind,n=e.daemon??{},a=e.collector??{},s=e.telemetry??{},o=e.audit??{},{mode:"cloud"===r?"cloud":"oss",daemon:{configured:!0===n.configured},collector:{sessions:!0===a.sessions,hooks:!1!==a.hooks,hooksVerbosity:"all"===a.hooks_verbosity||"off"===a.hooks_verbosity?a.hooks_verbosity:"decisions",redact:"off"===a.redact?"off":"minimal",environment:"string"==typeof a.environment?a.environment:"local",machineId:"string"==typeof a.machine_id?a.machine_id:void 0,sources:function(e){if(!e||"object"!=typeof e||Array.isArray(e))return;let t={};for(let[i,r]of Object.entries(e)){if(!r||"object"!=typeof r||Array.isArray(r))continue;let e=r.extra_paths;if(!Array.isArray(e))continue;let n=e.filter(e=>"string"==typeof e&&""!==e.trim());n.length>0&&(t[i]={extraPaths:n})}return Object.keys(t).length>0?t:void 0}(a.sources)},telemetry:{enabled:!1!==s.enabled},audit:{auto:!0===o.auto,intervalDays:function(e){if("number"!=typeof e||!Number.isFinite(e))return 7;let t=Math.floor(e);return t<1?7:Math.min(t,90)}(o.interval_days)}}}catch{return structuredClone(r)}}().telemetry.enabled}catch{return!0}}],17694)},10659,e=>{"use strict";let t;var i=e.i(2157),r=e.i(50227),n=e.i(60526),a=e.i(66680);e.i(74533);var s=e.i(79857);let o=r.default.join(n.default.homedir(),".failproofai"),l=r.default.join(o,"instance-id");function c(e){return a.default.createHmac("sha256","failproofai-telemetry-v1").update(e).digest("hex")}function d(e){let t;try{if(t=(0,s.telemetryIdFile)(),i.default.readFileSync(t,"utf-8").trim()===e)return}catch{try{t=(0,s.telemetryIdFile)()}catch{return}}try{i.default.mkdirSync(r.default.dirname(t),{recursive:!0});let n=`${t}.${process.pid}.tmp`;i.default.writeFileSync(n,e,{encoding:"utf-8",mode:384}),i.default.renameSync(n,t)}catch{}}e.s(["getInstanceId",0,function(){if(t)return t;let e=function(){try{for(let e of(n.default.platform(),["/etc/machine-id","/var/lib/dbus/machine-id"]))try{let t=i.default.readFileSync(e,"utf-8").trim();if(t)return t}catch{}}catch{}}();if(e)return d(t=c(e)),t;let r=[n.default.hostname(),n.default.homedir(),n.default.platform(),n.default.arch(),n.default.cpus()[0]?.model??""].join(":");return r?d(t=c(r)):d(t=function(){try{let e=i.default.readFileSync(l,"utf-8").trim();if(e)return e}catch{}let e=a.default.randomUUID();try{i.default.mkdirSync(o,{recursive:!0}),i.default.writeFileSync(l,e,"utf-8")}catch{}return e}()),t}])},46501,e=>{"use strict";var t=e.i(10659),i=e.i(17694),r=e.i(24214),n=e.i(28067);let a=n.POSTHOG_API_KEY;async function s(e,t){for(let i=1;i<=5;i++){try{let{signal:i,...r}=t,n=await fetch(e,{...r,signal:AbortSignal.timeout(5e3)});if(n.ok)return n}catch{}if(i<5){let e=Math.min(1e3*2**(i-1),8e3);await new Promise(t=>setTimeout(t,e))}}return new Response("{}",{status:200})}async function o(){try{if(!(0,i.isTelemetryEnabled)()||globalThis.__FAILPROOFAI_POSTHOG__)return;let t=await e.A(78081),r=process.env.FAILPROOFAI_POSTHOG_KEY??a,n=process.env.FAILPROOFAI_POSTHOG_HOST??"https://us.i.posthog.com";globalThis.__FAILPROOFAI_POSTHOG__=new t.PostHog(r,{host:n,flushAt:1,flushInterval:0,requestTimeout:5e3,fetchRetryCount:0,fetch:s});let o=()=>{globalThis.__FAILPROOFAI_POSTHOG__?.shutdown().catch(()=>{})};process.on("beforeExit",o),process.on("SIGTERM",o),process.on("SIGINT",o)}catch(e){console.warn("[failproofai:telemetry] init failed:",e instanceof Error?e.message:e)}}e.s(["initTelemetry",0,o,"trackEvent",0,function(e,a){if(!(0,i.isTelemetryEnabled)())return;let s=globalThis.__FAILPROOFAI_POSTHOG__;s&&s.capture({distinctId:(0,t.getInstanceId)(),event:e,properties:{...a,$lib:"failproofai",failproofai_version:r.version,product:n.POSTHOG_PRODUCT}})}])},24214,(e,t,i)=>{t.exports={name:"failproofai",version:"1.0.0",description:"The easiest way to manage policies that keep your AI agents reliable, on-task, and running autonomously — for Claude Code & the Agents SDK",bin:{failproofai:"./dist/cli.mjs",failproofaid:"./bin/failproofaid-shim.mjs"},files:["bin/","src/","scripts/","lib/","pi-extension/","openclaw-plugin/",".next/standalone/","dist/","README.md"],engines:{node:">=20.9.0",bun:">=1.3.0"},scripts:{predev:"bun run build:cli && bun link",dev:"FAILPROOFAI_TELEMETRY_DISABLED=1 bun scripts/dev.ts --port 8020","build:cli":"bun build --target=node --format=esm --outfile=dist/cli.mjs bin/failproofai.mjs --external posthog-node --external sql.js && node -e \"const fs=require('fs');const c=fs.readFileSync('dist/cli.mjs','utf8');fs.writeFileSync('dist/cli.mjs',c.replace('#!/usr/bin/env bun','#!/usr/bin/env node').replace('// @bun\\n',''))\"","build:worker":"bun build --target=node --format=esm --outfile=dist/worker.mjs bin/failproofai-worker.mjs --external posthog-node --external sql.js",build:"bun build --target=node --format=cjs --outfile=dist/index.js src/index.ts && bun run build:cli && bun run build:worker && bun --bun next build && node -e \"const {cpSync}=require('fs');cpSync('.next/static','.next/standalone/.next/static',{recursive:true});\" && node scripts/prune-standalone.mjs",prestart:"bun run build:cli && bun link",start:"FAILPROOFAI_TELEMETRY_DISABLED=1 bun scripts/start.ts",test:"vitest","test:run":"vitest run",lint:"eslint . --config eslint.config.mjs",prepare:"bun run build","test:e2e":"vitest run --config vitest.config.e2e.mts","test:e2e:watch":"vitest --config vitest.config.e2e.mts",translate:"bun scripts/translate-docs/cli.ts","translate:readme":"bun scripts/translate-docs/cli.ts --readme-only","translate:docs":"bun scripts/translate-docs/cli.ts --docs-only","translate:dry-run":"bun scripts/translate-docs/cli.ts --dry-run","translate:validate":"bun scripts/translate-docs/cli.ts --validate","validate:mdx":"bun scripts/validate-mdx.ts"},keywords:["claude","claude-code","claude-agents-sdk","anthropic","ai-agent","agent-reliability","agent-monitoring","autonomous-agent","failure-prevention","developer-tools","devtools","cli","local-first","hooks","policies"],author:"ExosphereHost Inc. <failproofai@exosphere.host>",license:"SEE LICENSE IN LICENSE",homepage:"https://github.com/FailproofAI/failproofai",repository:{type:"git",url:"https://github.com/FailproofAI/failproofai.git"},bugs:{url:"https://github.com/FailproofAI/failproofai/issues"},publishConfig:{access:"public"},devDependencies:{"@anthropic-ai/sdk":"^0.116.0","@mdx-js/mdx":"^3.1.1","@tailwindcss/postcss":"^4.3.1","@tanstack/react-virtual":"^3.14.9","@testing-library/jest-dom":"^7.0.0","@testing-library/react":"^16.3.2","@testing-library/user-event":"^14.6.1","@types/node":"26.2.0","@types/react":"19.2.18","@types/react-dom":"^19.2.3","@vitejs/plugin-react":"^6.0.5",clsx:"^2.1.1",eslint:"^10.5.0","eslint-config-next":"^16.2.9",jsdom:"^30.0.1","lucide-react":"^1.28.0",next:"^16.2.11",react:"^19.2.4","react-dom":"^19.2.4","tailwind-merge":"^3.4.0",tailwindcss:"^4.3.1",typescript:"6.0.3",vitest:"^4.1.9"},dependencies:{"html-to-image":"^1.11.13","posthog-node":"^5.47.7","sql.js":"^1.14.1",yaml:"^2.9.0"},overrides:{postcss:"8.5.26","eslint-plugin-react-hooks":"7.0.1",vite:"8.0.16",undici:"7.29.0","brace-expansion":"5.0.9",sharp:"0.35.0"},optionalDependencies:{"@failproofai/failproofaid-linux-x64":"1.0.0","@failproofai/failproofaid-linux-arm64":"1.0.0","@failproofai/failproofaid-darwin-x64":"1.0.0","@failproofai/failproofaid-darwin-arm64":"1.0.0"},failproofaidBinaries:{"linux-x64":"67d9404812145b8b13dc97debd33cd667a5de347989b2c9c47bbdfcb5e99344c","linux-arm64":"ca003a2ca755f5d696e2d6f4ddd8eedc0f8c4914f972101aa9803986ec409000","darwin-x64":"53f1ed8710da69c2e3d3668d3b62380383a46328471870093936f53fc0a4fb05","darwin-arm64":"682c22084906877760285e925b232d3563a1874a7a1f42c4c27deb1b7b74fb6f"}}},28067,e=>{"use strict";e.s(["POSTHOG_API_KEY",0,"phc_Ac1Ww1GqKc0z1SyrRWbmatEeQdlOQIsDEEdP8l8JRgX","POSTHOG_PRODUCT",0,"failproofai-oss"])}];
+module.exports=[17694,e=>{"use strict";var t=e.i(2157);e.i(50227);var i=e.i(79857);let r={mode:"oss",daemon:{configured:!1},collector:{sessions:!1,hooks:!0,hooksVerbosity:"decisions",redact:"minimal",environment:"local"},telemetry:{enabled:!0},audit:{auto:!1,intervalDays:7}};e.s(["isTelemetryEnabled",0,function(){if("1"===process.env.FAILPROOFAI_TELEMETRY_DISABLED)return!1;try{return function(){try{var e;let r,n,a,s,o;return e=JSON.parse((0,t.readFileSync)((0,i.configFile)(),"utf8")),r=e.mode?.kind,n=e.daemon??{},a=e.collector??{},s=e.telemetry??{},o=e.audit??{},{mode:"cloud"===r?"cloud":"oss",daemon:{configured:!0===n.configured},collector:{sessions:!0===a.sessions,hooks:!1!==a.hooks,hooksVerbosity:"all"===a.hooks_verbosity||"off"===a.hooks_verbosity?a.hooks_verbosity:"decisions",redact:"off"===a.redact?"off":"minimal",environment:"string"==typeof a.environment?a.environment:"local",machineId:"string"==typeof a.machine_id?a.machine_id:void 0,sources:function(e){if(!e||"object"!=typeof e||Array.isArray(e))return;let t={};for(let[i,r]of Object.entries(e)){if(!r||"object"!=typeof r||Array.isArray(r))continue;let e=r.extra_paths;if(!Array.isArray(e))continue;let n=e.filter(e=>"string"==typeof e&&""!==e.trim());n.length>0&&(t[i]={extraPaths:n})}return Object.keys(t).length>0?t:void 0}(a.sources)},telemetry:{enabled:!1!==s.enabled},audit:{auto:!0===o.auto,intervalDays:function(e){if("number"!=typeof e||!Number.isFinite(e))return 7;let t=Math.floor(e);return t<1?7:Math.min(t,90)}(o.interval_days),reportsConsentedAt:"number"==typeof o.reports_consented_at&&Number.isFinite(o.reports_consented_at)?o.reports_consented_at:void 0}}}catch{return structuredClone(r)}}().telemetry.enabled}catch{return!0}}],17694)},10659,e=>{"use strict";let t;var i=e.i(2157),r=e.i(50227),n=e.i(60526),a=e.i(66680);e.i(74533);var s=e.i(79857);let o=r.default.join(n.default.homedir(),".failproofai"),l=r.default.join(o,"instance-id");function c(e){return a.default.createHmac("sha256","failproofai-telemetry-v1").update(e).digest("hex")}function d(e){let t;try{if(t=(0,s.telemetryIdFile)(),i.default.readFileSync(t,"utf-8").trim()===e)return}catch{try{t=(0,s.telemetryIdFile)()}catch{return}}try{i.default.mkdirSync(r.default.dirname(t),{recursive:!0});let n=`${t}.${process.pid}.tmp`;i.default.writeFileSync(n,e,{encoding:"utf-8",mode:384}),i.default.renameSync(n,t)}catch{}}e.s(["getInstanceId",0,function(){if(t)return t;let e=function(){try{for(let e of(n.default.platform(),["/etc/machine-id","/var/lib/dbus/machine-id"]))try{let t=i.default.readFileSync(e,"utf-8").trim();if(t)return t}catch{}}catch{}}();if(e)return d(t=c(e)),t;let r=[n.default.hostname(),n.default.homedir(),n.default.platform(),n.default.arch(),n.default.cpus()[0]?.model??""].join(":");return r?d(t=c(r)):d(t=function(){try{let e=i.default.readFileSync(l,"utf-8").trim();if(e)return e}catch{}let e=a.default.randomUUID();try{i.default.mkdirSync(o,{recursive:!0}),i.default.writeFileSync(l,e,"utf-8")}catch{}return e}()),t}])},46501,e=>{"use strict";var t=e.i(10659),i=e.i(17694),r=e.i(24214),n=e.i(28067);let a=n.POSTHOG_API_KEY;async function s(e,t){for(let i=1;i<=5;i++){try{let{signal:i,...r}=t,n=await fetch(e,{...r,signal:AbortSignal.timeout(5e3)});if(n.ok)return n}catch{}if(i<5){let e=Math.min(1e3*2**(i-1),8e3);await new Promise(t=>setTimeout(t,e))}}return new Response("{}",{status:200})}async function o(){try{if(!(0,i.isTelemetryEnabled)()||globalThis.__FAILPROOFAI_POSTHOG__)return;let t=await e.A(78081),r=process.env.FAILPROOFAI_POSTHOG_KEY??a,n=process.env.FAILPROOFAI_POSTHOG_HOST??"https://us.i.posthog.com";globalThis.__FAILPROOFAI_POSTHOG__=new t.PostHog(r,{host:n,flushAt:1,flushInterval:0,requestTimeout:5e3,fetchRetryCount:0,fetch:s});let o=()=>{globalThis.__FAILPROOFAI_POSTHOG__?.shutdown().catch(()=>{})};process.on("beforeExit",o),process.on("SIGTERM",o),process.on("SIGINT",o)}catch(e){console.warn("[failproofai:telemetry] init failed:",e instanceof Error?e.message:e)}}e.s(["initTelemetry",0,o,"trackEvent",0,function(e,a){if(!(0,i.isTelemetryEnabled)())return;let s=globalThis.__FAILPROOFAI_POSTHOG__;s&&s.capture({distinctId:(0,t.getInstanceId)(),event:e,properties:{...a,$lib:"failproofai",failproofai_version:r.version,product:n.POSTHOG_PRODUCT}})}])},24214,(e,t,i)=>{t.exports={name:"failproofai",version:"1.0.1-beta.0",description:"The easiest way to manage policies that keep your AI agents reliable, on-task, and running autonomously — for Claude Code & the Agents SDK",bin:{failproofai:"./dist/cli.mjs",failproofaid:"./bin/failproofaid-shim.mjs"},files:["bin/","src/","scripts/","lib/","pi-extension/","openclaw-plugin/",".next/standalone/","dist/","README.md"],engines:{node:">=20.9.0",bun:">=1.3.0"},scripts:{predev:"bun run build:cli && bun link",dev:"FAILPROOFAI_TELEMETRY_DISABLED=1 bun scripts/dev.ts --port 8020","build:cli":"bun build --target=node --format=esm --outfile=dist/cli.mjs bin/failproofai.mjs --external posthog-node --external sql.js && node -e \"const fs=require('fs');const c=fs.readFileSync('dist/cli.mjs','utf8');fs.writeFileSync('dist/cli.mjs',c.replace('#!/usr/bin/env bun','#!/usr/bin/env node').replace('// @bun\\n',''))\"","build:worker":"bun build --target=node --format=esm --outfile=dist/worker.mjs bin/failproofai-worker.mjs --external posthog-node --external sql.js",build:"bun build --target=node --format=cjs --outfile=dist/index.js src/index.ts && bun run build:cli && bun run build:worker && bun --bun next build && node -e \"const {cpSync}=require('fs');cpSync('.next/static','.next/standalone/.next/static',{recursive:true});\" && node scripts/prune-standalone.mjs",prestart:"bun run build:cli && bun link",start:"FAILPROOFAI_TELEMETRY_DISABLED=1 bun scripts/start.ts",test:"vitest","test:run":"vitest run",lint:"eslint . --config eslint.config.mjs",prepare:"bun run build","test:e2e":"vitest run --config vitest.config.e2e.mts","test:e2e:watch":"vitest --config vitest.config.e2e.mts",translate:"bun scripts/translate-docs/cli.ts","translate:readme":"bun scripts/translate-docs/cli.ts --readme-only","translate:docs":"bun scripts/translate-docs/cli.ts --docs-only","translate:dry-run":"bun scripts/translate-docs/cli.ts --dry-run","translate:validate":"bun scripts/translate-docs/cli.ts --validate","validate:mdx":"bun scripts/validate-mdx.ts","docs:audit":"bun scripts/docs-audit.ts"},keywords:["claude","claude-code","claude-agents-sdk","anthropic","ai-agent","agent-reliability","agent-monitoring","autonomous-agent","failure-prevention","developer-tools","devtools","cli","local-first","hooks","policies"],author:"ExosphereHost Inc. <failproofai@exosphere.host>",license:"SEE LICENSE IN LICENSE",homepage:"https://github.com/FailproofAI/failproofai",repository:{type:"git",url:"https://github.com/FailproofAI/failproofai.git"},bugs:{url:"https://github.com/FailproofAI/failproofai/issues"},publishConfig:{access:"public"},devDependencies:{"@anthropic-ai/sdk":"^0.116.0","@mdx-js/mdx":"^3.1.1","@tailwindcss/postcss":"^4.3.1","@tanstack/react-virtual":"^3.14.9","@testing-library/jest-dom":"^7.0.0","@testing-library/react":"^16.3.2","@testing-library/user-event":"^14.6.1","@types/node":"26.2.0","@types/react":"19.2.18","@types/react-dom":"^19.2.3","@vitejs/plugin-react":"^6.0.5",clsx:"^2.1.1",eslint:"^10.5.0","eslint-config-next":"^16.2.9",jsdom:"^30.0.1","lucide-react":"^1.28.0",next:"^16.2.11",react:"^19.2.4","react-dom":"^19.2.4","tailwind-merge":"^3.4.0",tailwindcss:"^4.3.1",typescript:"6.0.3",vitest:"^4.1.9"},dependencies:{"html-to-image":"^1.11.13","posthog-node":"^5.47.7","sql.js":"^1.14.1",yaml:"^2.9.0"},overrides:{nanoid:"3.3.18",postcss:"8.5.26","eslint-plugin-react-hooks":"7.0.1",vite:"8.0.16",undici:"7.29.0","brace-expansion":"5.0.9",sharp:"0.35.0"},optionalDependencies:{"@failproofai/failproofaid-linux-x64":"1.0.1-beta.0","@failproofai/failproofaid-linux-arm64":"1.0.1-beta.0","@failproofai/failproofaid-darwin-x64":"1.0.1-beta.0","@failproofai/failproofaid-darwin-arm64":"1.0.1-beta.0"},failproofaidBinaries:{"linux-x64":"8259a934de6ae1302e49a7e7d81e7caac533fa8437167fddc2a9b36d05745ce2","linux-arm64":"c9a4e90c94c23c78973ddb26740f39ab4d3368da5567cebe475e805049c158e9","darwin-x64":"cf0c70a0dab9f737a9ffde27b3ab3fb18ef159b851656ef778ed193a0a72a476","darwin-arm64":"f4d4e300339acc7557251a96500c24e8d675f934febc9d587560cf0544d3eef1"}}},28067,e=>{"use strict";e.s(["POSTHOG_API_KEY",0,"phc_Ac1Ww1GqKc0z1SyrRWbmatEeQdlOQIsDEEdP8l8JRgX","POSTHOG_PRODUCT",0,"failproofai-oss"])}];
 
 //# sourceMappingURL=_1zuiiy3._.js.map

package/.next/standalone/.next/server/chunks/lib_telemetry_ts_0dctyyw._.js

@@ -1,3 +1,3 @@
-module.exports=[34324,e=>{"use strict";var t=e.i(15855),o=e.i(2157);e.i(50227);var r=e.i(43477);let i={mode:"oss",daemon:{configured:!1},collector:{sessions:!1,hooks:!0,hooksVerbosity:"decisions",redact:"minimal",environment:"local"},telemetry:{enabled:!0},audit:{auto:!1,intervalDays:7}};function n(){if("1"===process.env.FAILPROOFAI_TELEMETRY_DISABLED)return!1;try{return function(){try{var e;let t,i,n,s,a;return e=JSON.parse((0,o.readFileSync)((0,r.configFile)(),"utf8")),t=e.mode?.kind,i=e.daemon??{},n=e.collector??{},s=e.telemetry??{},a=e.audit??{},{mode:"cloud"===t?"cloud":"oss",daemon:{configured:!0===i.configured},collector:{sessions:!0===n.sessions,hooks:!1!==n.hooks,hooksVerbosity:"all"===n.hooks_verbosity||"off"===n.hooks_verbosity?n.hooks_verbosity:"decisions",redact:"off"===n.redact?"off":"minimal",environment:"string"==typeof n.environment?n.environment:"local",machineId:"string"==typeof n.machine_id?n.machine_id:void 0,sources:function(e){if(!e||"object"!=typeof e||Array.isArray(e))return;let t={};for(let[o,r]of Object.entries(e)){if(!r||"object"!=typeof r||Array.isArray(r))continue;let e=r.extra_paths;if(!Array.isArray(e))continue;let i=e.filter(e=>"string"==typeof e&&""!==e.trim());i.length>0&&(t[o]={extraPaths:i})}return Object.keys(t).length>0?t:void 0}(n.sources)},telemetry:{enabled:!1!==s.enabled},audit:{auto:!0===a.auto,intervalDays:function(e){if("number"!=typeof e||!Number.isFinite(e))return 7;let t=Math.floor(e);return t<1?7:Math.min(t,90)}(a.interval_days)}}}catch{return structuredClone(i)}}().telemetry.enabled}catch{return!0}}var s=e.i(93133);async function a(e,t){for(let o=1;o<=5;o++){try{let{signal:o,...r}=t,i=await fetch(e,{...r,signal:AbortSignal.timeout(5e3)});if(i.ok)return i}catch{}if(o<5){let e=Math.min(1e3*2**(o-1),8e3);await new Promise(t=>setTimeout(t,e))}}return new Response("{}",{status:200})}async function l(){try{if(!n()||globalThis.__FAILPROOFAI_POSTHOG__)return;let t=await e.A(37581),o=process.env.FAILPROOFAI_POSTHOG_KEY??"phc_Ac1Ww1GqKc0z1SyrRWbmatEeQdlOQIsDEEdP8l8JRgX",r=process.env.FAILPROOFAI_POSTHOG_HOST??"https://us.i.posthog.com";globalThis.__FAILPROOFAI_POSTHOG__=new t.PostHog(o,{host:r,flushAt:1,flushInterval:0,requestTimeout:5e3,fetchRetryCount:0,fetch:a});let i=()=>{globalThis.__FAILPROOFAI_POSTHOG__?.shutdown().catch(()=>{})};process.on("beforeExit",i),process.on("SIGTERM",i),process.on("SIGINT",i)}catch(e){console.warn("[failproofai:telemetry] init failed:",e instanceof Error?e.message:e)}}function c(e,o){if(!n())return;let r=globalThis.__FAILPROOFAI_POSTHOG__;r&&r.capture({distinctId:(0,t.getInstanceId)(),event:e,properties:{...o,$lib:"failproofai",failproofai_version:s.version,product:"failproofai-oss"}})}async function u(){let e=globalThis.__FAILPROOFAI_POSTHOG__;e&&await e.flush()}async function f(){let e=globalThis.__FAILPROOFAI_POSTHOG__;e&&await e.shutdown()}e.s(["flushTelemetry",0,u,"initTelemetry",0,l,"shutdownTelemetry",0,f,"trackEvent",0,c],2477),e.i(2477),e.s(["flushTelemetry",0,u,"initTelemetry",0,l,"trackEvent",0,c],34324)}];
+module.exports=[34324,e=>{"use strict";var t=e.i(15855),o=e.i(2157);e.i(50227);var r=e.i(43477);let n={mode:"oss",daemon:{configured:!1},collector:{sessions:!1,hooks:!0,hooksVerbosity:"decisions",redact:"minimal",environment:"local"},telemetry:{enabled:!0},audit:{auto:!1,intervalDays:7}};function i(){if("1"===process.env.FAILPROOFAI_TELEMETRY_DISABLED)return!1;try{return function(){try{var e;let t,n,i,s,a;return e=JSON.parse((0,o.readFileSync)((0,r.configFile)(),"utf8")),t=e.mode?.kind,n=e.daemon??{},i=e.collector??{},s=e.telemetry??{},a=e.audit??{},{mode:"cloud"===t?"cloud":"oss",daemon:{configured:!0===n.configured},collector:{sessions:!0===i.sessions,hooks:!1!==i.hooks,hooksVerbosity:"all"===i.hooks_verbosity||"off"===i.hooks_verbosity?i.hooks_verbosity:"decisions",redact:"off"===i.redact?"off":"minimal",environment:"string"==typeof i.environment?i.environment:"local",machineId:"string"==typeof i.machine_id?i.machine_id:void 0,sources:function(e){if(!e||"object"!=typeof e||Array.isArray(e))return;let t={};for(let[o,r]of Object.entries(e)){if(!r||"object"!=typeof r||Array.isArray(r))continue;let e=r.extra_paths;if(!Array.isArray(e))continue;let n=e.filter(e=>"string"==typeof e&&""!==e.trim());n.length>0&&(t[o]={extraPaths:n})}return Object.keys(t).length>0?t:void 0}(i.sources)},telemetry:{enabled:!1!==s.enabled},audit:{auto:!0===a.auto,intervalDays:function(e){if("number"!=typeof e||!Number.isFinite(e))return 7;let t=Math.floor(e);return t<1?7:Math.min(t,90)}(a.interval_days),reportsConsentedAt:"number"==typeof a.reports_consented_at&&Number.isFinite(a.reports_consented_at)?a.reports_consented_at:void 0}}}catch{return structuredClone(n)}}().telemetry.enabled}catch{return!0}}var s=e.i(93133);async function a(e,t){for(let o=1;o<=5;o++){try{let{signal:o,...r}=t,n=await fetch(e,{...r,signal:AbortSignal.timeout(5e3)});if(n.ok)return n}catch{}if(o<5){let e=Math.min(1e3*2**(o-1),8e3);await new Promise(t=>setTimeout(t,e))}}return new Response("{}",{status:200})}async function l(){try{if(!i()||globalThis.__FAILPROOFAI_POSTHOG__)return;let t=await e.A(37581),o=process.env.FAILPROOFAI_POSTHOG_KEY??"phc_Ac1Ww1GqKc0z1SyrRWbmatEeQdlOQIsDEEdP8l8JRgX",r=process.env.FAILPROOFAI_POSTHOG_HOST??"https://us.i.posthog.com";globalThis.__FAILPROOFAI_POSTHOG__=new t.PostHog(o,{host:r,flushAt:1,flushInterval:0,requestTimeout:5e3,fetchRetryCount:0,fetch:a});let n=()=>{globalThis.__FAILPROOFAI_POSTHOG__?.shutdown().catch(()=>{})};process.on("beforeExit",n),process.on("SIGTERM",n),process.on("SIGINT",n)}catch(e){console.warn("[failproofai:telemetry] init failed:",e instanceof Error?e.message:e)}}function c(e,o){if(!i())return;let r=globalThis.__FAILPROOFAI_POSTHOG__;r&&r.capture({distinctId:(0,t.getInstanceId)(),event:e,properties:{...o,$lib:"failproofai",failproofai_version:s.version,product:"failproofai-oss"}})}async function u(){let e=globalThis.__FAILPROOFAI_POSTHOG__;e&&await e.flush()}async function f(){let e=globalThis.__FAILPROOFAI_POSTHOG__;e&&await e.shutdown()}e.s(["flushTelemetry",0,u,"initTelemetry",0,l,"shutdownTelemetry",0,f,"trackEvent",0,c],2477),e.i(2477),e.s(["flushTelemetry",0,u,"initTelemetry",0,l,"trackEvent",0,c],34324)}];
 
 //# sourceMappingURL=lib_telemetry_ts_0dctyyw._.js.map