failproofai 1.0.0 → 1.0.1-beta.1

package/dist/cli.mjs

@@ -19,7 +19,7 @@ var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
 var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
 // package.json
-var version2 = "1.0.0", package_default;
+var version2 = "1.0.1-beta.1", package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "failproofai",
@@ -63,7 +63,8 @@ var init_package = __esm(() => {
       "translate:docs": "bun scripts/translate-docs/cli.ts --docs-only",
       "translate:dry-run": "bun scripts/translate-docs/cli.ts --dry-run",
       "translate:validate": "bun scripts/translate-docs/cli.ts --validate",
-      "validate:mdx": "bun scripts/validate-mdx.ts"
+      "validate:mdx": "bun scripts/validate-mdx.ts",
+      "docs:audit": "bun scripts/docs-audit.ts"
     },
     keywords: [
       "claude",
@@ -127,6 +128,7 @@ var init_package = __esm(() => {
       yaml: "^2.9.0"
     },
     overrides: {
+      nanoid: "3.3.18",
       postcss: "8.5.26",
       "eslint-plugin-react-hooks": "7.0.1",
       vite: "8.0.16",
@@ -135,16 +137,16 @@ var init_package = __esm(() => {
       sharp: "0.35.0"
     },
     optionalDependencies: {
-      "@failproofai/failproofaid-linux-x64": "1.0.0",
-      "@failproofai/failproofaid-linux-arm64": "1.0.0",
-      "@failproofai/failproofaid-darwin-x64": "1.0.0",
-      "@failproofai/failproofaid-darwin-arm64": "1.0.0"
+      "@failproofai/failproofaid-linux-x64": "1.0.1-beta.1",
+      "@failproofai/failproofaid-linux-arm64": "1.0.1-beta.1",
+      "@failproofai/failproofaid-darwin-x64": "1.0.1-beta.1",
+      "@failproofai/failproofaid-darwin-arm64": "1.0.1-beta.1"
     },
     failproofaidBinaries: {
-      "linux-x64": "67d9404812145b8b13dc97debd33cd667a5de347989b2c9c47bbdfcb5e99344c",
-      "linux-arm64": "ca003a2ca755f5d696e2d6f4ddd8eedc0f8c4914f972101aa9803986ec409000",
-      "darwin-x64": "53f1ed8710da69c2e3d3668d3b62380383a46328471870093936f53fc0a4fb05",
-      "darwin-arm64": "682c22084906877760285e925b232d3563a1874a7a1f42c4c27deb1b7b74fb6f"
+      "linux-x64": "cf623441aa67363e423a1dba7db734d3e9243f0abff5e63a9ed7ddc096213e51",
+      "linux-arm64": "339281280ae8e60d03415da88a372ff4d3fb356c375f0e1f9eea17063233d52b",
+      "darwin-x64": "b972c37a9ca83b085d11d1312b3fa8487dead09dbc81e1e115000d2614051248",
+      "darwin-arm64": "597cbdae5f564fd0c7c917b2b0b94a91ba8465e568487da0d1cac0508b94cee5"
     }
   };
 });
@@ -175,6 +177,7 @@ function retiredLayoutPaths() {
     legacy.lastVersion(),
     legacy.auditDashboard(),
     legacy.auditCacheDir(),
+    legacy.auditReminder(),
     legacy.codexSessionPaths(),
     legacy.spoolDir(),
     legacy.failedDir(),
@@ -186,7 +189,7 @@ function retiredLayoutPaths() {
     legacy.localPoliciesDir()
   ];
 }
-var LAYOUT_VERSION = 3, at = (...parts) => resolve(failproofaiHome(), ...parts), atHome = (home, ...parts) => home ? resolve(failproofaiHome(home), ...parts) : at(...parts), versionFile = (home) => atHome(home, "VERSION"), configFile = (home) => atHome(home, "config.json"), credentialsFile = (home) => atHome(home, "credentials.json"), binDir = (home) => atHome(home, "bin"), policiesDir = (home) => atHome(home, "policies"), customPoliciesDir, globalPolicyConfigFile = (home) => atHome(home, "policies-config.json"), cloudPoliciesDir = (home) => resolve(policiesDir(home), "cloud-policies"), cursorsDir = (source, home) => source ? resolve(atHome(home, "cursors"), source) : atHome(home, "cursors"), customAgentsDir = (home) => atHome(home, "custom-agents"), auditDir = (home) => atHome(home, "audit"), auditDashboardFile = (home) => resolve(auditDir(home), "dashboard.json"), auditCacheDir = (home) => resolve(auditDir(home), "cache"), hookActivityDir = (home) => atHome(home, "hook-activity"), runDir = (home) => atHome(home, "run"), daemonSocket = () => process.env.FAILPROOFAI_DAEMON_SOCKET || resolve(runDir(), "failproofaid.sock"), auditLockFile = (home) => resolve(runDir(home), "audit.lock"), stateDir = (home) => atHome(home, "state"), shimsDir = (home) => resolve(stateDir(home), "shims"), spoolDir = (home) => resolve(stateDir(home), "spool"), failedDir = (home) => resolve(stateDir(home), "failed"), collectorHealthFile = (home) => resolve(stateDir(home), "collector-health.json"), sessionPauseDir = () => resolve(stateDir(), "sessions"), auditScheduleFile = (home) => resolve(stateDir(home), "audit-schedule.json"), telemetryIdFile = (home) => resolve(stateDir(home), "telemetry-id"), launcherMarker = (home) => resolve(stateDir(home), "launcher-configured"), onboardingAttemptFile = (home) => resolve(stateDir(home), "onboarding-attempt.json"), lastVersionFile = (home) => resolve(stateDir(home), "last-version"), onboardingLockFile = (home) => resolve(stateDir(home), "onboarding.lock"), codexSessionPathsFile = (home) => resolve(stateDir(home), "codex-session-paths.json"), logsDir = (home) => atHome(home, "logs"), migrationsDir = (home) => atHome(home, "migrations"), migrationLedgerFile = (home) => resolve(migrationsDir(home), "applied.json"), migrationBackupDir = (layout, home) => resolve(migrationsDir(home), `backup-layout${layout}`), HOME_CLASSES, legacy;
+var LAYOUT_VERSION = 4, at = (...parts) => resolve(failproofaiHome(), ...parts), atHome = (home, ...parts) => home ? resolve(failproofaiHome(home), ...parts) : at(...parts), versionFile = (home) => atHome(home, "VERSION"), configFile = (home) => atHome(home, "config.json"), credentialsFile = (home) => atHome(home, "credentials.json"), binDir = (home) => atHome(home, "bin"), policiesDir = (home) => atHome(home, "policies"), customPoliciesDir, globalPolicyConfigFile = (home) => atHome(home, "policies-config.json"), cloudPoliciesDir = (home) => resolve(policiesDir(home), "cloud-policies"), cursorsDir = (source, home) => source ? resolve(atHome(home, "cursors"), source) : atHome(home, "cursors"), customAgentsDir = (home) => atHome(home, "custom-agents"), auditDir = (home) => atHome(home, "audit"), auditDashboardFile = (home) => resolve(auditDir(home), "dashboard.json"), auditCacheDir = (home) => resolve(auditDir(home), "cache"), auditSessionFile = (home) => resolve(auditDir(home), "session.json"), auditMachineFile = (home) => resolve(auditDir(home), "machine.json"), hookActivityDir = (home) => atHome(home, "hook-activity"), runDir = (home) => atHome(home, "run"), daemonSocket = () => process.env.FAILPROOFAI_DAEMON_SOCKET || resolve(runDir(), "failproofaid.sock"), auditLockFile = (home) => resolve(runDir(home), "audit.lock"), stateDir = (home) => atHome(home, "state"), shimsDir = (home) => resolve(stateDir(home), "shims"), spoolDir = (home) => resolve(stateDir(home), "spool"), failedDir = (home) => resolve(stateDir(home), "failed"), collectorHealthFile = (home) => resolve(stateDir(home), "collector-health.json"), sessionPauseDir = () => resolve(stateDir(), "sessions"), auditScheduleFile = (home) => resolve(auditDir(home), "schedule.json"), telemetryIdFile = (home) => resolve(stateDir(home), "telemetry-id"), launcherMarker = (home) => resolve(stateDir(home), "launcher-configured"), onboardingAttemptFile = (home) => resolve(stateDir(home), "onboarding-attempt.json"), lastVersionFile = (home) => resolve(stateDir(home), "last-version"), onboardingLockFile = (home) => resolve(stateDir(home), "onboarding.lock"), codexSessionPathsFile = (home) => resolve(stateDir(home), "codex-session-paths.json"), logsDir = (home) => atHome(home, "logs"), migrationsDir = (home) => atHome(home, "migrations"), migrationLedgerFile = (home) => resolve(migrationsDir(home), "applied.json"), migrationBackupDir = (layout, home) => resolve(migrationsDir(home), `backup-layout${layout}`), HOME_CLASSES, legacy;
 var init_fp_home = __esm(() => {
   customPoliciesDir = policiesDir;
   HOME_CLASSES = [
@@ -194,6 +197,7 @@ var init_fp_home = __esm(() => {
     { path: configFile, class: "user-typed" },
     { path: globalPolicyConfigFile, class: "user-typed" },
     { path: policiesDir, class: "user-typed" },
+    { path: auditSessionFile, class: "user-typed" },
     { path: spoolDir, class: "undelivered" },
     { path: failedDir, class: "undelivered" },
     { path: customAgentsDir, class: "undelivered" },
@@ -205,9 +209,11 @@ var init_fp_home = __esm(() => {
     { path: (home) => resolve(stateDir(home), "daemon-telemetry-id"), class: "identity" },
     { path: versionFile, class: "identity" },
     { path: migrationsDir, class: "identity" },
-    { path: auditDir, class: "derived" },
-    { path: collectorHealthFile, class: "derived" },
+    { path: auditMachineFile, class: "identity" },
+    { path: auditDashboardFile, class: "derived" },
+    { path: auditCacheDir, class: "derived" },
     { path: auditScheduleFile, class: "derived" },
+    { path: collectorHealthFile, class: "derived" },
     { path: codexSessionPathsFile, class: "derived" },
     { path: shimsDir, class: "derived" },
     { path: sessionPauseDir, class: "derived" },
@@ -233,6 +239,10 @@ var init_fp_home = __esm(() => {
     launcherMarker: () => at(".launcher-configured"),
     lastVersion: () => at("last-version"),
     auditDashboard: () => at("audit-dashboard.json"),
+    authJson: () => at("auth.json"),
+    nextAudit: () => at("next-audit.json"),
+    auditReminder: () => at("audit", "reminder.json"),
+    auditSchedule: () => at("state", "audit-schedule.json"),
     cacheDir: () => at("cache"),
     hookActivityDir: () => at("cache", "hook-activity"),
     auditCacheDir: () => at("cache", "audit"),
@@ -257,10 +267,17 @@ function detectLayout() {
     return raw.layout > LAYOUT_VERSION ? { kind: "future", found: raw.layout } : { kind: "stale", found: raw.layout };
   }
   if (existsSync(configFile())) {
+    const layoutThreePositions = [
+      legacy.authJson(),
+      legacy.nextAudit(),
+      legacy.auditSchedule()
+    ];
+    if (layoutThreePositions.some((p) => existsSync(p)))
+      return { kind: "stale", found: 3 };
     return { kind: "current", version: { layout: LAYOUT_VERSION, cli: "" }, inferred: true };
   }
   if (existsSync(legacy.configToml()))
-    return { kind: "stale", found: LAYOUT_VERSION - 1 };
+    return { kind: "stale", found: 2 };
   const layoutOneMarkers = [
     legacy.policyConfig(),
     legacy.cacheDir(),
@@ -303,7 +320,7 @@ function readVersionFile() {
 function writeVersionFile(v = {}) {
   const existing = readVersionFile();
   const next = {
-    layout: LAYOUT_VERSION,
+    layout: v.layout ?? LAYOUT_VERSION,
     cli: v.cli ?? version2,
     daemon: v.clearDaemon ? undefined : v.daemon ?? existing?.daemon
   };
@@ -372,7 +389,11 @@ function projectConfig(parsed) {
         sources: readSources(collector.sources)
       },
       telemetry: { enabled: telemetry.enabled !== false },
-      audit: { auto: audit.auto === true, intervalDays: readIntervalDays(audit.interval_days) }
+      audit: {
+        auto: audit.auto === true,
+        intervalDays: readIntervalDays(audit.interval_days),
+        reportsConsentedAt: typeof audit.reports_consented_at === "number" && Number.isFinite(audit.reports_consented_at) ? audit.reports_consented_at : undefined
+      }
     };
   }
 }
@@ -421,7 +442,11 @@ function writeConfig(config, raw) {
       } : {}
     },
     ...config.telemetry.enabled ? {} : { telemetry: { enabled: false } },
-    audit: { auto: config.audit.auto, interval_days: config.audit.intervalDays }
+    audit: {
+      auto: config.audit.auto,
+      interval_days: config.audit.intervalDays,
+      ...config.audit.reportsConsentedAt === undefined ? {} : { reports_consented_at: config.audit.reportsConsentedAt }
+    }
   };
   const merged = structuredClone(raw ?? readConfigRaw().raw);
   for (const path of OWNED_CONFIG_KEYS)
@@ -567,7 +592,8 @@ var init_fp_config = __esm(() => {
     ["collector", "sources", "*", "extra_paths"],
     ["telemetry", "enabled"],
     ["audit", "auto"],
-    ["audit", "interval_days"]
+    ["audit", "interval_days"],
+    ["audit", "reports_consented_at"]
   ];
   OWNED_CREDENTIAL_KEYS = [
     ["cloud", "url"],
@@ -2910,7 +2936,7 @@ function registerBuiltinPolicies(enabledNames) {
     }
   }
 }
-var isClaudeInternalPath, isClaudeSettingsFile, SHELL_OPERATORS, SHELL_METACHAR_RE, JWT_RE, API_KEY_PATTERNS, CONNECTION_STRING_RE, PRIVATE_KEY_RE, BEARER_TOKEN_RE, SQL_TOOL_RE, DESTRUCTIVE_SQL_RE, DELETE_NO_WHERE_RE, SQL_WHERE_RE, SCHEMA_ALTER_RE, PUBLISH_CMD_RE, ENV_PRINTENV_RE, ECHO_ENV_RE, EXPORT_RE, PS_ENV_VAR_RE, PS_CHILDITEM_ENV_RE, DOTNET_GETENV_RE, CMD_ECHO_ENV_RE, ENV_FILE_PATH_RE, ENV_CMD_RE, PS_ELEVATION_RE, RUNAS_RE, CURL_PIPE_SH_RE, SEGMENT_SEPARATORS, COMMAND_PREFIX_TOKENS, SELF_BINARY_TOKEN_RE, CONFIG_SUBCOMMAND_RE, PAUSE_FLAG_RE, ENV_ASSIGNMENT_RE, RUNNER_OPERAND_RE, PS_WEB_PIPE_RE, SHORT_FLAG_BUNDLE_RE, SAFE_FORCE_PREFIXES, SECRET_FILE_RE, SECRET_FILE_ID_RSA_RE, SECRET_FILE_CREDENTIALS_RE, GIT_COMMIT_MERGE_RE, FAILPROOFAI_CLI_RE, FAILPROOFAI_UNINSTALL_RE, GIT_AMEND_RE, GIT_STASH_DROP_RE, GIT_ADD_ALL_RE, NPM_GLOBAL_RE, YARN_GLOBAL_RE, PNPM_GLOBAL_RE, BUN_GLOBAL_RE, CARGO_INSTALL_RE, PIP_SYSTEM_RE, PKG_MANAGER_DETECTORS, NOHUP_RE, SCREEN_DETACH_RE, TMUX_DETACH_RE, DISOWN_RE, BACKGROUND_AMPERSAND_RE, KUBECTL_RE, TERRAFORM_RE, AWS_CLI_RE, GCLOUD_RE, AZ_CLI_RE, HELM_RE, GH_PIPELINE_RE, gitBranchCache, GIT_BRANCH_CACHE_MAX_ENTRIES = 500, EVAL_FLAG_RE, HOME_PREFIX_RE, RM_CMD_RE, FIND_CMD_RE, FIND_EXEC_RE, FIND_GLOBAL_OPT_RE, FIND_EXPR_START_RE, SCRATCH_ROOTS, CATASTROPHIC_DEPTH = 2, READ_LIKE_CMDS, TOOL_CALL_TRACKER_MAX_BYTES = 65536, SEGMENT_SPLIT_RE, BUILTIN_POLICIES;
+var isClaudeInternalPath, isClaudeSettingsFile, SHELL_OPERATORS, SHELL_METACHAR_RE, JWT_RE, API_KEY_PATTERNS, CONNECTION_STRING_RE, PRIVATE_KEY_RE, BEARER_TOKEN_RE, SECRET_PATTERNS, SQL_TOOL_RE, DESTRUCTIVE_SQL_RE, DELETE_NO_WHERE_RE, SQL_WHERE_RE, SCHEMA_ALTER_RE, PUBLISH_CMD_RE, ENV_PRINTENV_RE, ECHO_ENV_RE, EXPORT_RE, PS_ENV_VAR_RE, PS_CHILDITEM_ENV_RE, DOTNET_GETENV_RE, CMD_ECHO_ENV_RE, ENV_FILE_PATH_RE, ENV_CMD_RE, PS_ELEVATION_RE, RUNAS_RE, CURL_PIPE_SH_RE, SEGMENT_SEPARATORS, COMMAND_PREFIX_TOKENS, SELF_BINARY_TOKEN_RE, CONFIG_SUBCOMMAND_RE, PAUSE_FLAG_RE, ENV_ASSIGNMENT_RE, RUNNER_OPERAND_RE, PS_WEB_PIPE_RE, SHORT_FLAG_BUNDLE_RE, SAFE_FORCE_PREFIXES, SECRET_FILE_RE, SECRET_FILE_ID_RSA_RE, SECRET_FILE_CREDENTIALS_RE, GIT_COMMIT_MERGE_RE, FAILPROOFAI_CLI_RE, FAILPROOFAI_UNINSTALL_RE, GIT_AMEND_RE, GIT_STASH_DROP_RE, GIT_ADD_ALL_RE, NPM_GLOBAL_RE, YARN_GLOBAL_RE, PNPM_GLOBAL_RE, BUN_GLOBAL_RE, CARGO_INSTALL_RE, PIP_SYSTEM_RE, PKG_MANAGER_DETECTORS, NOHUP_RE, SCREEN_DETACH_RE, TMUX_DETACH_RE, DISOWN_RE, BACKGROUND_AMPERSAND_RE, KUBECTL_RE, TERRAFORM_RE, AWS_CLI_RE, GCLOUD_RE, AZ_CLI_RE, HELM_RE, GH_PIPELINE_RE, gitBranchCache, GIT_BRANCH_CACHE_MAX_ENTRIES = 500, EVAL_FLAG_RE, HOME_PREFIX_RE, RM_CMD_RE, FIND_CMD_RE, FIND_EXEC_RE, FIND_GLOBAL_OPT_RE, FIND_EXPR_START_RE, SCRATCH_ROOTS, CATASTROPHIC_DEPTH = 2, READ_LIKE_CMDS, TOOL_CALL_TRACKER_MAX_BYTES = 65536, SEGMENT_SPLIT_RE, BUILTIN_POLICIES;
 var init_builtin_policies = __esm(() => {
   init_hook_logger();
   isClaudeInternalPath = isAgentInternalPath;
@@ -2932,6 +2958,13 @@ var init_builtin_policies = __esm(() => {
   CONNECTION_STRING_RE = /(?:postgresql|postgres|mysql|mongodb(?:\+srv)?|redis|amqps?|smtps?):\/\/[^@\s]+@/;
   PRIVATE_KEY_RE = /-----BEGIN (?:[A-Z]+ )?PRIVATE KEY-----/;
   BEARER_TOKEN_RE = /Authorization:\s*Bearer\s+[A-Za-z0-9\-._~+/]{20,}/i;
+  SECRET_PATTERNS = [
+    [PRIVATE_KEY_RE, "private key"],
+    [JWT_RE, "JWT"],
+    [BEARER_TOKEN_RE, "bearer token"],
+    [CONNECTION_STRING_RE, "database credentials"],
+    ...API_KEY_PATTERNS
+  ];
   SQL_TOOL_RE = /\b(?:psql|mysql|sqlite3|pgcli|clickhouse-client)\b/;
   DESTRUCTIVE_SQL_RE = /\b(?:DROP\s+(?:TABLE|DATABASE|SCHEMA)|TRUNCATE\b)/i;
   DELETE_NO_WHERE_RE = /\bDELETE\s+FROM\b/i;
@@ -11432,7 +11465,7 @@ function readCarriedLegacyCredentials() {
   const creds = projectCredentials(raw);
   return Object.keys(creds).length > 0 ? creds : null;
 }
-function resetHome(from) {
+function resetHome(from, to = LAYOUT_VERSION) {
   const migrated = migrateConventionPolicies();
   const activity = migrateHookActivity();
   const pendingPolicyConfig = readCarriedPolicyConfig();
@@ -11457,7 +11490,7 @@ function resetHome(from) {
     writeConfig(pendingConfig);
   if (telemetryOptOut)
     updateConfig({ telemetry: { enabled: false } });
-  writeVersionFile();
+  writeVersionFile({ layout: to });
   return { removed, migrated, activity, policyConfig, spooled, from };
 }
 function layoutWarningForHook() {
@@ -12033,14 +12066,71 @@ __export(exports_migrations, {
   runMigrations: () => runMigrations,
   restoreBackup: () => restoreBackup,
   readLedger: () => readLedger,
+  pruneMigratedCredentials: () => pruneMigratedCredentials,
   planMigration: () => planMigration,
   migrationCoverageGap: () => migrationCoverageGap,
   describePlan: () => describePlan,
   backupBeforeMigrating: () => backupBeforeMigrating,
   MIGRATIONS: () => MIGRATIONS
 });
-import { copyFileSync as copyFileSync2, existsSync as existsSync21, mkdirSync as mkdirSync12, readFileSync as readFileSync16, rmSync as rmSync7, writeFileSync as writeFileSync10 } from "node:fs";
-import { basename as basename4, dirname as dirname10, resolve as resolve16 } from "node:path";
+import {
+  chmodSync as chmodSync4,
+  copyFileSync as copyFileSync2,
+  existsSync as existsSync21,
+  mkdirSync as mkdirSync12,
+  readFileSync as readFileSync16,
+  renameSync as renameSync6,
+  rmSync as rmSync7,
+  writeFileSync as writeFileSync10
+} from "node:fs";
+import { basename as basename4, dirname as dirname10, join as join29, resolve as resolve16 } from "node:path";
+function migrateToLayout4() {
+  const moves = [
+    { from: legacy.authJson(), to: auditSessionFile() },
+    { from: legacy.nextAudit(), to: legacy.auditReminder() },
+    { from: legacy.auditSchedule(), to: auditScheduleFile() }
+  ];
+  const authDirOverride = process.env.FAILPROOFAI_AUTH_DIR;
+  if (authDirOverride) {
+    moves.push({ from: join29(authDirOverride, "auth.json"), to: join29(authDirOverride, "session.json") }, {
+      from: join29(authDirOverride, "next-audit.json"),
+      to: join29(authDirOverride, "reminder.json")
+    });
+  }
+  const migrated = [];
+  for (const { from, to } of moves) {
+    if (!existsSync21(from))
+      continue;
+    if (existsSync21(to)) {
+      rmSync7(from, { force: true });
+      continue;
+    }
+    mkdirSync12(dirname10(to), { recursive: true });
+    try {
+      renameSync6(from, to);
+    } catch {
+      try {
+        copyFileSync2(from, to);
+      } catch (err) {
+        try {
+          rmSync7(to, { force: true });
+        } catch {}
+        throw err;
+      }
+      rmSync7(from, { force: true });
+    }
+    migrated.push(`${basename4(from)} → audit/${basename4(to)}`);
+  }
+  for (const secret of [auditSessionFile()]) {
+    if (!existsSync21(secret))
+      continue;
+    try {
+      chmodSync4(secret, 384);
+    } catch {}
+  }
+  writeVersionFile({ layout: 4 });
+  return { removed: [], migrated, activity: [], policyConfig: [], spooled: [], from: 3 };
+}
 function planMigration(from, registry = MIGRATIONS) {
   if (from >= LAYOUT_VERSION)
     return [];
@@ -12095,6 +12185,23 @@ function appendLedger(entry) {
 function backupNameOf(f) {
   return f.as ?? basename4(f.at());
 }
+function pruneMigratedCredentials(from) {
+  const pruned = [];
+  for (let layout = from;layout < LAYOUT_VERSION; layout++) {
+    for (const { as, landsAt } of PRUNED_AFTER_SUCCESS) {
+      try {
+        if (!existsSync21(landsAt()))
+          continue;
+        const copy = resolve16(migrationBackupDir(layout), as);
+        if (!existsSync21(copy))
+          continue;
+        rmSync7(copy, { force: true });
+        pruned.push(as);
+      } catch {}
+    }
+  }
+  return pruned;
+}
 function filesToBackUp() {
   const seen = new Map;
   for (const f of [...BACKED_UP, ...BACKED_UP_LEGACY]) {
@@ -12156,6 +12263,11 @@ function runMigrations(from, chain = planMigration(from)) {
       });
     } catch (err) {
       steps.push({ from: step.from, to: step.to, ok: false });
+      try {
+        const marker = readVersionFile();
+        if (marker && marker.layout >= LAYOUT_VERSION)
+          writeVersionFile({ layout: step.from });
+      } catch {}
       failed = {
         from: step.from,
         to: step.to,
@@ -12172,6 +12284,8 @@ function runMigrations(from, chain = planMigration(from)) {
       break;
     }
   }
+  if (!failed)
+    pruneMigratedCredentials(from);
   return { from, steps, backedUp, outcome, failed };
 }
 function describePlan(from) {
@@ -12214,23 +12328,30 @@ function restoreBackup(layout) {
   }
   return restored.sort((a, b) => a.localeCompare(b));
 }
-var MIGRATIONS, BACKED_UP, BACKED_UP_LEGACY;
+var MIGRATIONS, BACKED_UP, BACKED_UP_LEGACY, PRUNED_AFTER_SUCCESS;
 var init_migrations = __esm(() => {
   init_package();
   init_fp_home();
+  init_fp_config();
   init_fp_reset();
   MIGRATIONS = [
     {
       from: 1,
       to: 3,
       describe: "layout 1 → 3: carry the decision log out of cache/, keep the policy config in place, drop the layout-1 credential files",
-      run: () => resetHome(1)
+      run: () => resetHome(1, 3)
     },
     {
       from: 2,
       to: 3,
       describe: "layout 2 → 3: carry config.toml and credentials.toml into JSON, move custom-policies/ back up into policies/, nest the policy config at the root",
-      run: () => resetHome(2)
+      run: () => resetHome(2, 3)
+    },
+    {
+      from: 3,
+      to: 4,
+      describe: "layout 3 → 4: gather the audit's files under audit/ — auth.json becomes audit/session.json, next-audit.json becomes audit/reminder.json, state/audit-schedule.json becomes audit/schedule.json",
+      run: migrateToLayout4
     }
   ];
   BACKED_UP = [
@@ -12245,7 +12366,13 @@ var init_migrations = __esm(() => {
     { at: legacy.policyConfig },
     { at: legacy.localPolicyConfig, as: "local-policies-policies-config.json" },
     { at: legacy.cloudCredentials },
-    { at: legacy.ingestCredentials }
+    { at: legacy.ingestCredentials },
+    { at: legacy.authJson },
+    { at: legacy.nextAudit },
+    { at: legacy.auditSchedule }
+  ];
+  PRUNED_AFTER_SUCCESS = [
+    { as: basename4(legacy.authJson()), landsAt: auditSessionFile }
   ];
 });
 
@@ -12272,7 +12399,7 @@ import {
   mkdirSync as mkdirSync13,
   readFileSync as readFileSync17,
   readdirSync as readdirSync16,
-  renameSync as renameSync6,
+  renameSync as renameSync7,
   rmSync as rmSync8,
   rmdirSync as rmdirSync2,
   statSync as statSync17,
@@ -12304,7 +12431,7 @@ function migrateConventionPolicies2() {
       const name = `${prefix}${entry.name}`;
       if (!existsSync22(target)) {
         try {
-          renameSync6(source, target);
+          renameSync7(source, target);
           moved.push(name);
         } catch {}
         continue;
@@ -12341,7 +12468,7 @@ function migrateLegacySpool2() {
         while (existsSync22(resolve17(to, name)))
           name = `legacy-${n++}-${entry.name}`;
         try {
-          renameSync6(resolve17(from, entry.name), resolve17(to, name));
+          renameSync7(resolve17(from, entry.name), resolve17(to, name));
           moved.push(name);
         } catch {
           try {
@@ -12376,7 +12503,7 @@ function migrateHookActivity2() {
         target = resolve17(to, name);
       }
       try {
-        renameSync6(source, target);
+        renameSync7(source, target);
         moved.push(name);
       } catch {
         try {
@@ -12584,7 +12711,7 @@ function readCarriedLegacyCredentials2() {
   const creds = projectCredentials(raw);
   return Object.keys(creds).length > 0 ? creds : null;
 }
-function resetHome2(from) {
+function resetHome2(from, to = LAYOUT_VERSION) {
   const migrated = migrateConventionPolicies2();
   const activity = migrateHookActivity2();
   const pendingPolicyConfig = readCarriedPolicyConfig2();
@@ -12609,7 +12736,7 @@ function resetHome2(from) {
     writeConfig(pendingConfig);
   if (telemetryOptOut)
     updateConfig({ telemetry: { enabled: false } });
-  writeVersionFile();
+  writeVersionFile({ layout: to });
   return { removed, migrated, activity, policyConfig, spooled, from };
 }
 async function drainSpoolAfterMigrating() {
@@ -12647,6 +12774,7 @@ async function checkLayoutForCli() {
     const run = runMigrations2(state.found);
     const { removed, migrated, activity } = run.outcome;
     const pending3 = await drainSpoolAfterMigrating();
+    const daemonHint = staleDaemonHint();
     return {
       state,
       fatal: false,
@@ -12678,7 +12806,8 @@ async function checkLayoutForCli() {
           `Step ${run.failed.from} → ${run.failed.to} did not finish: ${run.failed.error}`,
           `The home is still marked layout ${state.found} and will be retried. Copies of`,
           `your settings and enrolment were saved first, in ${migrationBackupDir(state.found)}.`
-        ] : []
+        ] : [],
+        ...daemonHint.length > 0 ? ["", ...daemonHint] : []
       ]
     };
   }
@@ -12743,8 +12872,23 @@ function staleDaemonHint() {
     const skew = daemonVersionSkew();
     if (!skew)
       return [];
+    let requiresDaemon = false;
+    try {
+      requiresDaemon = readConfig().daemon.configured;
+    } catch {}
+    if (requiresDaemon) {
+      return [
+        `[failproofai] daemon is ${skew.installed}, CLI is ${skew.expected}.`,
+        `This machine is configured to REQUIRE the daemon. A daemon built against a`,
+        `different on-disk layout refuses to start, and this version moved it — so the`,
+        `next reboot or restart can leave the service down, which denies every tool`,
+        `call until it is fixed.`,
+        `Run \`failproofai update\` now to bring the daemon in line.`,
+        ``
+      ];
+    }
     return [
-      `[failproofai] daemon is ${skew.installed}, CLI is ${skew.expected} — ` + `run \`failproofai config\` to update it.`,
+      `[failproofai] daemon is ${skew.installed}, CLI is ${skew.expected} — ` + `run \`failproofai update\` to update it.`,
       ``
     ];
   } catch {
@@ -12785,13 +12929,13 @@ import { createHmac, randomUUID as randomUUID2 } from "node:crypto";
 import { execSync as execSync4 } from "node:child_process";
 import { readFileSync as readFileSync18, writeFileSync as writeFileSync12, mkdirSync as mkdirSync14 } from "node:fs";
 import { homedir as homedir20, platform, arch, hostname, cpus } from "node:os";
-import { join as join29 } from "node:path";
+import { join as join30 } from "node:path";
 function hashToId3(raw) {
   return createHmac("sha256", NAMESPACE3).update(raw).digest("hex");
 }
 function getInstanceId3() {
-  const idDir = join29(homedir20(), ".failproofai");
-  const idFile = join29(idDir, "instance-id");
+  const idDir = join30(homedir20(), ".failproofai");
+  const idFile = join30(idDir, "instance-id");
   try {
     const existing = readFileSync18(idFile, "utf-8").trim();
     if (existing)
@@ -13187,6 +13331,27 @@ function renderLaunchBanner(version3, stdout = process.stdout) {
     ""
   ];
 }
+function step(message, summary, stdout = process.stdout) {
+  const c = paint(colorsEnabled(stdout));
+  const rows = summary === undefined ? [] : Array.isArray(summary) ? summary : [summary];
+  if (!stdout.isTTY) {
+    if (rows.length)
+      stdout.write(`${message}: ${rows.join(" ")}
+`);
+    return;
+  }
+  const cols = stdout.columns || 80;
+  const lines = [c.dim(BAR), truncate(`${c.dim(STEP_DONE)}  ${message}`, cols - 1)];
+  for (const r of rows)
+    lines.push(truncate(`${c.dim(BAR)}  ${c.dim(r)}`, cols - 1));
+  writeLines(stdout, lines);
+}
+function stepOpen(message, stdout = process.stdout) {
+  const c = paint(colorsEnabled(stdout));
+  if (!stdout.isTTY)
+    return;
+  writeLines(stdout, [c.dim(BAR), `${c.guide(STEP_ACTIVE)}  ${c.bold(message)}`]);
+}
 function outro(message, opts = {}, stdout = process.stdout) {
   const c = paint(colorsEnabled(stdout));
   const ok = opts.ok !== false;
@@ -13449,10 +13614,10 @@ function promptText(opts) {
     const draw = (error) => {
       const cols = stdout.columns || 80;
       const shown = opts.mask ? "•".repeat(value.length) : value;
-      const hint = opts.hint ? `  ${c.dim(opts.hint)}` : "";
-      const line = truncate(`${c.bold(opts.message)} ${shown}${hint}`, cols - 1);
+      const hint = opts.hint && value.length === 0 ? `  ${c.dim(opts.hint)}` : "";
+      const line = truncate(`${opts.prefix ?? ""}${c.bold(opts.message)} ${shown}${hint}`, cols - 1);
       const err = error ? `
-  ${truncate(c.warn(error), cols - 3)}` : "";
+${opts.prefix ?? "  "}${truncate(c.warn(error), cols - 3)}` : "";
       stdout.write(`\r\x1B[2K${line}${err}`);
       if (err)
         stdout.write("\x1B[1A");
@@ -23469,7 +23634,7 @@ var init_onboarding_lock = __esm(() => {
 
 // lib/claude-sessions.ts
 import { readdirSync as readdirSync17, statSync as statSync19, existsSync as existsSync29 } from "node:fs";
-import { join as join30, basename as basename6 } from "node:path";
+import { join as join31, basename as basename6 } from "node:path";
 function getClaudeProjectsRoot() {
   return getClaudeProjectsPath();
 }
@@ -23484,7 +23649,7 @@ function listClaudeProjects() {
   return entries.filter((e) => e.isDirectory()).map((e) => ({
     name: e.name,
     cwd: decodeFolderName(e.name),
-    path: join30(root, e.name)
+    path: join31(root, e.name)
   }));
 }
 function listClaudeTranscripts(project) {
@@ -23500,7 +23665,7 @@ function listClaudeTranscripts(project) {
       const sessionId = entry.name.slice(0, -".jsonl".length);
       if (!UUID_RE2.test(sessionId))
         continue;
-      const transcriptPath = join30(project.path, entry.name);
+      const transcriptPath = join31(project.path, entry.name);
       try {
         const s = statSync19(transcriptPath);
         out.push({
@@ -23514,7 +23679,7 @@ function listClaudeTranscripts(project) {
         });
       } catch {}
     } else if (entry.isDirectory() && UUID_RE2.test(entry.name)) {
-      const subDir = join30(project.path, entry.name, "subagents");
+      const subDir = join31(project.path, entry.name, "subagents");
       if (!existsSync29(subDir))
         continue;
       let subEntries;
@@ -23527,7 +23692,7 @@ function listClaudeTranscripts(project) {
         if (!sub.isFile() || !sub.name.endsWith(".jsonl"))
           continue;
         const agentId = sub.name.slice(0, -".jsonl".length);
-        const transcriptPath = join30(subDir, sub.name);
+        const transcriptPath = join31(subDir, sub.name);
         try {
           const s = statSync19(transcriptPath);
           out.push({
@@ -24790,8 +24955,8 @@ var init_features = __esm(() => {
 
 // src/audit/cache.ts
 import { createHash as createHash6 } from "node:crypto";
-import { existsSync as existsSync30, mkdirSync as mkdirSync19, readFileSync as readFileSync24, writeFileSync as writeFileSync17, chmodSync as chmodSync4 } from "node:fs";
-import { join as join31 } from "node:path";
+import { existsSync as existsSync30, mkdirSync as mkdirSync19, readFileSync as readFileSync24, writeFileSync as writeFileSync17, chmodSync as chmodSync5 } from "node:fs";
+import { join as join32 } from "node:path";
 function getEngineVersion() {
   if (cachedEngineVersion)
     return cachedEngineVersion;
@@ -24811,7 +24976,7 @@ function getDetectorVersion() {
 function getCachePathFor(transcriptPath) {
   const root = auditCacheDir();
   const key = createHash6("sha1").update(transcriptPath).digest("hex");
-  return join31(root, `${key}.json`);
+  return join32(root, `${key}.json`);
 }
 function readCachedTranscriptResult(transcriptPath, mtimeMs, sizeBytes) {
   if (sizeBytes === 0)
@@ -24856,7 +25021,7 @@ function writeCachedTranscriptResult(transcriptPath, mtimeMs, sizeBytes, result)
     };
     writeFileSync17(cachePath, JSON.stringify(entry), { encoding: "utf-8", mode: 384 });
     try {
-      chmodSync4(cachePath, 384);
+      chmodSync5(cachePath, 384);
     } catch {}
   } catch {}
 }
@@ -25343,6 +25508,7 @@ var init_audit_lock = __esm(() => {
 });
 
 // src/audit/dashboard-cache.ts
+import { existsSync as existsSync31, readFileSync as readFileSync26 } from "node:fs";
 function getCachePath() {
   return auditDashboardFile();
 }
@@ -25360,6 +25526,27 @@ function writeDashboardCache(params, result) {
     return false;
   }
 }
+function readDashboardCacheMeta() {
+  const cachePath = getCachePath();
+  if (!existsSync31(cachePath))
+    return null;
+  try {
+    const raw = readFileSync26(cachePath, "utf-8");
+    const entry = JSON.parse(raw);
+    if (!entry || entry.schemaVersion !== DASHBOARD_CACHE_SCHEMA_VERSION || typeof entry.cachedAt !== "string" || Number.isNaN(new Date(entry.cachedAt).getTime()))
+      return null;
+    const result = entry.result;
+    const count = (v) => typeof v === "number" && Number.isFinite(v) ? v : null;
+    return {
+      cachedAt: entry.cachedAt,
+      findings: count(result?.totals?.hits),
+      sessionsScanned: count(result?.transcripts?.scanned),
+      eventsScanned: count(result?.eventsScanned)
+    };
+  } catch {
+    return null;
+  }
+}
 var DASHBOARD_CACHE_TTL_MINUTES, DASHBOARD_CACHE_SCHEMA_VERSION = 2;
 var init_dashboard_cache = __esm(() => {
   init_atomic_write();
@@ -25434,160 +25621,1095 @@ function openWhenReady(port, path3) {
 var POLL_INTERVAL_MS = 150, POLL_TIMEOUT_MS = 30000;
 var init_open_browser = () => {};
 
-// scripts/parse-script-args.ts
-import { resolve as resolve22 } from "path";
-function parseStringFlag(flagName, errorLabel, inlineValue, args, index, options) {
-  const raw = inlineValue ?? args[index + 1];
-  if (raw === undefined || inlineValue === null && raw.startsWith("-")) {
-    console.error(`Error: ${flagName} requires ${errorLabel}`);
-    process.exit(1);
-  }
-  const value = options?.resolve ? resolve22(raw) : raw;
-  return { value, spliceCount: inlineValue !== null ? 1 : 2 };
+// lib/telemetry.ts
+function trackEvent(name, properties) {
+  if (!isTelemetryEnabled())
+    return;
+  const client = globalThis.__FAILPROOFAI_POSTHOG__;
+  if (!client)
+    return;
+  client.capture({
+    distinctId: getInstanceId2(),
+    event: name,
+    properties: { ...properties, $lib: "failproofai", failproofai_version: version2, product: POSTHOG_PRODUCT }
+  });
 }
-function parseScriptArgs(argv) {
-  const args = [...argv];
-  let loggingLevel;
-  let disableTelemetry = false;
-  let allowedDevOrigins;
-  let host;
-  for (let i = 0;i < args.length; i++) {
-    const arg = args[i];
-    const eqIdx = arg.indexOf("=");
-    const flag = eqIdx >= 0 ? arg.slice(0, eqIdx) : arg;
-    const inlineValue = eqIdx >= 0 ? arg.slice(eqIdx + 1) : null;
-    if (flag === "--logging") {
-      const raw = inlineValue ?? args[i + 1];
-      if (raw === undefined || inlineValue === null && raw.startsWith("-")) {
-        console.error("Error: --logging requires a level (info, warn, error)");
-        process.exit(1);
-      }
-      const val = raw.toLowerCase();
-      if (val !== "info" && val !== "warn" && val !== "error") {
-        console.error("Error: --logging must be one of: info, warn, error");
-        process.exit(1);
-      }
-      loggingLevel = val;
-      args.splice(i, inlineValue !== null ? 1 : 2);
-      i--;
-      continue;
-    }
-    if (flag === "--disable-telemetry") {
-      disableTelemetry = true;
-      args.splice(i, 1);
-      i--;
-      continue;
-    }
-    if (flag === "--allowed-origins") {
-      const { value, spliceCount } = parseStringFlag(flag, "a comma-separated list of origins", inlineValue, args, i);
-      allowedDevOrigins = value.split(",").map((s) => s.trim()).filter(Boolean);
-      args.splice(i, spliceCount);
-      i--;
-      continue;
+var init_telemetry = __esm(() => {
+  init_telemetry_id2();
+  init_telemetry_enabled();
+  init_package();
+});
+
+// lib/auth/api-server-client.ts
+function getApiBase() {
+  const raw = process.env.FAILPROOF_API_URL ?? process.env.FAILPROOFAI_API_URL ?? DEFAULT_API_BASE;
+  return raw.replace(/\/+$/, "");
+}
+async function parseError(res) {
+  let body = {};
+  try {
+    body = await res.json();
+  } catch {}
+  const code = body.code ?? `http_${res.status}`;
+  const message = body.message ?? body.detail ?? res.statusText ?? "request failed";
+  let retryAfterSecs = body.retry_after_secs;
+  if (retryAfterSecs === undefined) {
+    const h = res.headers.get("retry-after");
+    if (h) {
+      const n = Number(h);
+      if (Number.isFinite(n))
+        retryAfterSecs = n;
     }
-    if (flag === "--host" || flag === "-H" || flag === "--hostname") {
-      const { value, spliceCount } = parseStringFlag(flag, "an address to bind (e.g. 127.0.0.1)", inlineValue, args, i);
-      host = value;
-      args.splice(i, spliceCount);
-      i--;
-      continue;
+  }
+  if (retryAfterSecs !== undefined) {
+    retryAfterSecs = Math.max(0, Math.min(86400, retryAfterSecs));
+  }
+  return new AuthApiError(res.status, code, message, retryAfterSecs);
+}
+function timeoutSignal(extra) {
+  const t = AbortSignal.timeout(REQUEST_TIMEOUT_MS);
+  if (!extra)
+    return t;
+  const anyFn = AbortSignal.any;
+  if (anyFn)
+    return anyFn([t, extra]);
+  const composed = new AbortController;
+  const onAbort = (s) => composed.abort(s.reason);
+  if (t.aborted)
+    onAbort(t);
+  else
+    t.addEventListener("abort", () => onAbort(t), { once: true });
+  if (extra.aborted)
+    onAbort(extra);
+  else
+    extra.addEventListener("abort", () => onAbort(extra), { once: true });
+  return composed.signal;
+}
+function pathFromUrl(url) {
+  try {
+    return new URL(url).pathname;
+  } catch {
+    return url;
+  }
+}
+async function fetchWithTimeout2(url, init) {
+  try {
+    return await fetch(url, { ...init, signal: timeoutSignal(init.signal ?? undefined) });
+  } catch (err) {
+    const isTimeout = isAbortError(err);
+    trackEvent("api_server_unreachable", {
+      kind: isTimeout ? "timeout" : "network",
+      path: pathFromUrl(url),
+      method: typeof init.method === "string" ? init.method : "GET"
+    });
+    if (isTimeout) {
+      throw new AuthApiError(0, "timeout", `request to ${url} timed out after ${REQUEST_TIMEOUT_MS}ms`);
     }
+    throw err;
   }
-  return { loggingLevel, disableTelemetry, allowedDevOrigins, host, remainingArgs: args };
 }
-var init_parse_script_args = () => {};
+async function postJson(path3, body, init) {
+  const headers = { "content-type": "application/json" };
+  if (init?.accessToken)
+    headers["authorization"] = `Bearer ${init.accessToken}`;
+  const res = await fetchWithTimeout2(`${getApiBase()}${path3}`, {
+    method: "POST",
+    headers,
+    body: JSON.stringify(body)
+  });
+  if (res.status === 204)
+    return;
+  if (!res.ok)
+    throw await parseError(res);
+  return await res.json();
+}
+async function requestLoginCode(email) {
+  return postJson("/v0/auth/login/request", { email });
+}
+async function verifyLoginCode(email, code) {
+  return postJson("/v0/auth/login/verify", { email, code });
+}
+async function refreshAccessToken(refreshToken) {
+  return postJson("/v0/auth/token/refresh", {
+    refresh_token: refreshToken
+  });
+}
+async function submitAuditReport(accessToken, body) {
+  return postJson("/v0/audit-reports", body, { accessToken });
+}
+var DEFAULT_API_BASE = "https://api.befailproof.ai", AuthApiError, REQUEST_TIMEOUT_MS = 1e4;
+var init_api_server_client = __esm(() => {
+  init_telemetry();
+  AuthApiError = class AuthApiError extends Error {
+    status;
+    code;
+    retryAfterSecs;
+    constructor(status, code, message, retryAfterSecs) {
+      super(message);
+      this.status = status;
+      this.code = code;
+      this.retryAfterSecs = retryAfterSecs;
+      this.name = "AuthApiError";
+    }
+  };
+});
 
-// scripts/install-diagnosis.mjs
-import { existsSync as existsSync31, readFileSync as readFileSync26, realpathSync as realpathSync3 } from "node:fs";
-import { dirname as dirname16, resolve as resolve23 } from "node:path";
-import { homedir as homedir25, platform as platform4 } from "node:os";
-import { spawnSync } from "node:child_process";
-function findPackageRoot(start) {
+// lib/auth/auth-store.ts
+import { existsSync as existsSync32, readFileSync as readFileSync27, readdirSync as readdirSync18, rmSync as rmSync12 } from "node:fs";
+import { join as join33, resolve as resolve22 } from "node:path";
+function getAuthFilePath() {
+  const override = process.env.FAILPROOFAI_AUTH_DIR;
+  return override ? join33(override, "session.json") : auditSessionFile();
+}
+function readAuth() {
+  const p = getAuthFilePath();
+  if (!existsSync32(p))
+    return null;
   try {
-    let dir = realpathSync3(start);
-    if (existsSync31(dir) && !existsSync31(resolve23(dir, "package.json"))) {
-      dir = dirname16(dir);
+    const raw = readFileSync27(p, "utf-8");
+    const parsed = JSON.parse(raw);
+    if (typeof parsed.access_token !== "string" || typeof parsed.refresh_token !== "string" || typeof parsed.access_expires_at !== "number" || typeof parsed.user !== "object" || !parsed.user || typeof parsed.user.id !== "string" || typeof parsed.user.email !== "string") {
+      return null;
     }
-    while (true) {
-      const pkgPath = resolve23(dir, "package.json");
-      if (existsSync31(pkgPath)) {
-        try {
-          const pkg = JSON.parse(readFileSync26(pkgPath, "utf8"));
-          if (pkg.name === PKG_NAME)
-            return dir;
-        } catch {}
+    return {
+      access_token: parsed.access_token,
+      refresh_token: parsed.refresh_token,
+      access_expires_at: parsed.access_expires_at,
+      refresh_expires_at: typeof parsed.refresh_expires_at === "number" ? parsed.refresh_expires_at : parsed.access_expires_at,
+      user: {
+        id: parsed.user.id,
+        email: parsed.user.email
       }
-      const parent = dirname16(dir);
-      if (parent === dir)
-        return null;
-      dir = parent;
-    }
+    };
   } catch {
     return null;
   }
 }
-function readPackageVersion(packageRoot) {
-  if (!packageRoot)
-    return null;
+function writeAuth(auth) {
+  writeJsonAtomically(getAuthFilePath(), auth);
+}
+function deleteAuth() {
+  const p = getAuthFilePath();
+  if (existsSync32(p))
+    rmSync12(p, { force: true });
   try {
-    const pkg = JSON.parse(readFileSync26(resolve23(packageRoot, "package.json"), "utf8"));
-    return typeof pkg.version === "string" ? pkg.version : null;
-  } catch {
-    return null;
+    const root = migrationsDir();
+    if (!existsSync32(root))
+      return;
+    for (const entry of readdirSync18(root)) {
+      if (!entry.startsWith("backup-layout"))
+        continue;
+      const copy = resolve22(root, entry, "auth.json");
+      if (existsSync32(copy))
+        rmSync12(copy, { force: true });
+    }
+  } catch {}
+}
+function authFromTokenResponse(token, existingUser) {
+  const now = Math.floor(Date.now() / 1000);
+  const user = token.user ?? existingUser;
+  if (!user) {
+    throw new Error("authFromTokenResponse: missing user identity");
   }
+  return {
+    access_token: token.access_token,
+    refresh_token: token.refresh_token,
+    access_expires_at: now + token.access_expires_in,
+    refresh_expires_at: now + token.refresh_expires_in,
+    user
+  };
 }
-function resolvePathFirstBinary() {
+async function dedupedRefresh(auth) {
+  const existing = inFlightRefreshes.get(auth.refresh_token);
+  if (existing)
+    return existing;
+  const p = (async () => {
+    const refreshed = await refreshAccessToken(auth.refresh_token);
+    const next = authFromTokenResponse(refreshed, auth.user);
+    writeAuth(next);
+    return next;
+  })();
+  inFlightRefreshes.set(auth.refresh_token, p);
   try {
-    const isWin = platform4() === "win32";
-    const res = isWin ? spawnSync("where", [PKG_NAME], { encoding: "utf8" }) : spawnSync("sh", ["-c", `command -v ${PKG_NAME}`], { encoding: "utf8" });
-    if (res.status !== 0)
-      return null;
-    const first = (res.stdout || "").split(/\r?\n/).find((l) => l.trim().length > 0);
-    return first ? first.trim() : null;
-  } catch {
-    return null;
+    return await p;
+  } finally {
+    inFlightRefreshes.delete(auth.refresh_token);
   }
 }
-function locateNpmGlobal() {
+async function getValidAccessToken() {
+  const auth = readAuth();
+  if (!auth)
+    return null;
+  const now = Math.floor(Date.now() / 1000);
+  if (auth.access_expires_at - now > REFRESH_LEEWAY_SECS)
+    return auth;
   try {
-    const res = spawnSync("npm", ["root", "-g"], { encoding: "utf8" });
-    if (res.status !== 0)
-      return null;
-    const root = (res.stdout || "").trim();
-    if (!root)
+    return await dedupedRefresh(auth);
+  } catch (err) {
+    if (err instanceof AuthApiError && err.status === 401) {
+      deleteAuth();
       return null;
-    const candidate = resolve23(root, PKG_NAME);
-    return existsSync31(resolve23(candidate, "package.json")) ? candidate : null;
-  } catch {
+    }
     return null;
   }
 }
-function locateBunGlobal() {
-  try {
-    const candidate = resolve23(homedir25(), ".bun", "install", "global", "node_modules", PKG_NAME);
-    return existsSync31(resolve23(candidate, "package.json")) ? candidate : null;
-  } catch {
-    return null;
+var REFRESH_LEEWAY_SECS = 60, inFlightRefreshes;
+var init_auth_store = __esm(() => {
+  init_atomic_write();
+  init_fp_home();
+  init_api_server_client();
+  inFlightRefreshes = new Map;
+});
+
+// src/audit/redact-example.ts
+import { homedir as homedir25 } from "node:os";
+function maskTruncatedSecret(input) {
+  for (const [pattern, label] of SECRET_PREFIXES) {
+    if (pattern.test(input)) {
+      return input.replace(pattern, `[REDACTED: ${label}]`);
+    }
   }
+  return input;
 }
-function buildRecommendation(pathFirstBin) {
-  if (!pathFirstBin)
-    return null;
-  const bunBinPrefix = resolve23(homedir25(), ".bun", "bin") + "/";
-  const bunGlobalPrefix = resolve23(homedir25(), ".bun", "install", "global") + "/";
-  const isBun = pathFirstBin.startsWith(bunBinPrefix) || pathFirstBin.startsWith(bunGlobalPrefix);
-  if (isBun) {
-    return `rm -f ~/.bun/bin/${PKG_NAME} && rm -rf ~/.bun/install/global/node_modules/${PKG_NAME}`;
+function isSecretName(name) {
+  const upper = name.toUpperCase();
+  if (SECRET_NAME_SUBSTRINGS.some((word) => upper.includes(word)))
+    return true;
+  return upper.split("_").some((part) => SECRET_NAME_COMPONENTS.includes(part));
+}
+function maskAssignedSecrets(input) {
+  let out = input.replace(ASSIGNMENT_RE, (match, name, value) => {
+    if (!isSecretName(name))
+      return match;
+    if (value.startsWith("[REDACTED"))
+      return match;
+    return `${name}=[REDACTED: assigned secret]`;
+  });
+  out = out.replace(URL_CREDENTIALS_RE, "$1[REDACTED: URL credentials]@");
+  out = out.replace(BASIC_AUTH_FLAG_RE, "$1[REDACTED: basic auth]");
+  return out;
+}
+function maskSecrets(input) {
+  let out = input;
+  for (const [pattern, label] of SECRET_PATTERNS) {
+    const global = new RegExp(pattern.source, pattern.flags.includes("g") ? pattern.flags : `${pattern.flags}g`);
+    out = out.replace(global, `[REDACTED: ${label}]`);
   }
-  return `npm rm -g ${PKG_NAME}`;
+  return out;
 }
-function diagnoseShadow(self) {
-  const selfPackageRoot = (() => {
-    try {
-      return self?.selfPackageRoot ? realpathSync3(self.selfPackageRoot) : null;
-    } catch {
-      return self?.selfPackageRoot ?? null;
-    }
+function shortenPaths(input, home = homedir25()) {
+  const homeRoot = home.replace(/\/+$/, "");
+  return input.replace(ABSOLUTE_PATH_RE, (match, offset, whole) => {
+    if (PUBLIC_PATH_ROOTS.some((root2) => match.startsWith(root2)))
+      return match;
+    if (offset > 0 && whole[offset - 1] === "/" && /[a-z][a-z0-9+.\-]*:$/i.test(whole.slice(0, offset - 1))) {
+      const urlSegments = match.split("/").filter(Boolean);
+      if (urlSegments.length <= 1)
+        return match;
+      const host = urlSegments[0];
+      const leaf = urlSegments[urlSegments.length - 1];
+      const elided = urlSegments.length > 2 ? "/…" : "";
+      return `/${host}${elided}/${leaf}${match.endsWith("/") ? "/" : ""}`;
+    }
+    const trailingSlash = match.endsWith("/");
+    const segments = match.split("/").filter(Boolean);
+    if (segments.length === 0)
+      return match;
+    const basename7 = segments[segments.length - 1];
+    const kept = segments.slice(Math.max(0, segments.length - 1 - KEPT_PARENT_SEGMENTS), segments.length - 1);
+    const matchRoot = match.replace(/\/+$/, "");
+    const underHome = homeRoot.length > 0 && (matchRoot === homeRoot || matchRoot.startsWith(`${homeRoot}/`));
+    if (matchRoot === homeRoot && homeRoot.length > 0) {
+      return trailingSlash ? "~/" : "~";
+    }
+    const root = underHome ? "~" : "";
+    const middle = segments.length - kept.length - 1 > 0 ? "/…" : "";
+    const tail = [...kept, basename7].join("/");
+    return `${root}${middle}/${tail}${trailingSlash ? "/" : ""}`;
+  });
+}
+function redactExample(input, home = homedir25()) {
+  const masked = maskAssignedSecrets(maskTruncatedSecret(maskSecrets(input)));
+  const shortened = shortenPaths(masked, home);
+  const collapsed = shortened.replace(/\s+/g, " ").trim();
+  return collapsed.length > REDACTED_EXAMPLE_MAX_CHARS ? `${collapsed.slice(0, REDACTED_EXAMPLE_MAX_CHARS - 1)}…` : collapsed;
+}
+var REDACTED_EXAMPLE_MAX_CHARS = 160, KEPT_PARENT_SEGMENTS = 0, ABSOLUTE_PATH_RE, PUBLIC_PATH_ROOTS, SECRET_PREFIXES, SECRET_NAME_SUBSTRINGS, SECRET_NAME_COMPONENTS, ASSIGNMENT_RE, URL_CREDENTIALS_RE, BASIC_AUTH_FLAG_RE;
+var init_redact_example = __esm(() => {
+  init_builtin_policies();
+  ABSOLUTE_PATH_RE = /(?:\/[\w.\-@+]+){2,}\/?/g;
+  PUBLIC_PATH_ROOTS = ["/dev/", "/proc/", "/sys/"];
+  SECRET_PREFIXES = [
+    [/(?<!\w)(?:Authorization:\s*)?Bearer\s+\S*$/i, "bearer token"],
+    [/(?<!\w)sk-ant-\S*$/, "Anthropic API key"],
+    [/(?<!\w)sk-proj-\S*$/, "OpenAI project API key"],
+    [/(?<!\w)sk-\S*$/, "OpenAI API key"],
+    [/(?<!\w)ghp_\S*$/, "GitHub personal access token"],
+    [/(?<!\w)github_pat_\S*$/, "GitHub fine-grained token"],
+    [/(?<!\w)AKIA\S*$/, "AWS access key ID"],
+    [/(?<!\w)sk_live_\S*$/, "Stripe live secret key"],
+    [/(?<!\w)sk_test_\S*$/, "Stripe test secret key"],
+    [/(?<!\w)AIza\S*$/, "Google API key"],
+    [/-----BEGIN\s[A-Z ]*$/, "private key"]
+  ];
+  SECRET_NAME_SUBSTRINGS = [
+    "TOKEN",
+    "SECRET",
+    "PASSWORD",
+    "PASSWD",
+    "CREDENTIAL",
+    "APIKEY",
+    "PRIVATEKEY"
+  ];
+  SECRET_NAME_COMPONENTS = ["KEY", "PASS", "AUTH", "PAT", "SIG", "SIGNATURE", "SESSION", "COOKIE"];
+  ASSIGNMENT_RE = /\b([A-Za-z_][A-Za-z0-9_]*)=("[^"]*"|'[^']*'|[^\s;|&"']+)/g;
+  URL_CREDENTIALS_RE = /([a-z][a-z0-9+.\-]*:\/\/)[^\s/:@]+:[^\s/@]+@/gi;
+  BASIC_AUTH_FLAG_RE = /((?:^|\s)(?:-u|--user)[\s=])\S+:\S+/g;
+});
+
+// src/audit/harm-report.ts
+function shortName2(name) {
+  const slash = name.indexOf("/");
+  return slash === -1 ? name : name.slice(slash + 1);
+}
+function isHarmful(count) {
+  if (count.source !== "builtin")
+    return false;
+  const short = shortName2(count.name);
+  return HARMFUL_SEVERITIES.has(count.severity) || ALSO_HARMFUL.has(short);
+}
+function ts(value) {
+  if (!value)
+    return null;
+  const n = Date.parse(value);
+  return Number.isFinite(n) ? n : null;
+}
+function selectHarmful(result, from, to, opts = {}) {
+  const includeUnplaceable = opts.includeUnplaceable ?? from === undefined;
+  const fromMs = from ? from.getTime() : null;
+  const toMs2 = to.getTime();
+  const out = [];
+  for (const count of result.results) {
+    if (!isHarmful(count))
+      continue;
+    const last = ts(count.lastSeen);
+    const first = ts(count.firstSeen);
+    if (fromMs !== null && last !== null && last <= fromMs)
+      continue;
+    if (first !== null && first > toMs2)
+      continue;
+    const inWindow = count.examples.filter((e) => {
+      const at2 = ts(e.timestamp);
+      if (at2 === null)
+        return includeUnplaceable;
+      if (fromMs !== null && at2 <= fromMs)
+        return false;
+      return at2 <= toMs2;
+    });
+    const unplaceable = last === null && first === null;
+    if (unplaceable && !includeUnplaceable)
+      continue;
+    const afterLowerEdge = fromMs === null || first !== null && first > fromMs;
+    const beforeUpperEdge = last !== null && last <= toMs2;
+    const wholly = unplaceable || afterLowerEdge && beforeUpperEdge;
+    const floor = beforeUpperEdge ? 1 : 0;
+    const hits = wholly ? count.hits : Math.max(inWindow.length, floor);
+    if (hits <= 0)
+      continue;
+    out.push({
+      policy: shortName2(count.name),
+      category: count.category,
+      title: count.displayTitle ?? "",
+      hits,
+      first_seen: count.firstSeen,
+      last_seen: count.lastSeen,
+      examples: inWindow.map((e) => redactExample(e.example)).filter((e) => e.length > 0)
+    });
+  }
+  out.sort((a, b) => b.hits - a.hits);
+  return out;
+}
+function buildHarmReport(result, lastReportedAt, intervalDays) {
+  const to = new Date(Date.parse(result.scannedAt));
+  const windowTo = Number.isFinite(to.getTime()) ? to : new Date;
+  const watermark = ts(lastReportedAt);
+  const isFirstReport = watermark === null;
+  const oneInterval = Math.max(1, intervalDays) * 86400000;
+  const fallbackFrom = windowTo.getTime() - oneInterval;
+  const from = new Date(isFirstReport || watermark >= windowTo.getTime() ? fallbackFrom : watermark);
+  return {
+    window_from: from.toISOString(),
+    window_to: windowTo.toISOString(),
+    harmful: selectHarmful(result, from, windowTo, { includeUnplaceable: isFirstReport })
+  };
+}
+var HARMFUL_SEVERITIES, ALSO_HARMFUL;
+var init_harm_report = __esm(() => {
+  init_redact_example();
+  HARMFUL_SEVERITIES = new Set(["deny", "sanitize"]);
+  ALSO_HARMFUL = new Set(["protect-env-vars"]);
+});
+
+// src/audit/machine-store.ts
+import { existsSync as existsSync33, readFileSync as readFileSync28, rmSync as rmSync13 } from "node:fs";
+import { hostname as hostname5 } from "node:os";
+import { randomUUID as randomUUID4 } from "node:crypto";
+function readMachineIdentity(home) {
+  const path3 = auditMachineFile(home);
+  if (!existsSync33(path3))
+    return null;
+  try {
+    const parsed = JSON.parse(readFileSync28(path3, "utf8"));
+    if (typeof parsed.machine_id !== "string" || !parsed.machine_id)
+      return null;
+    return {
+      machine_id: parsed.machine_id,
+      last_reported_at: typeof parsed.last_reported_at === "string" ? parsed.last_reported_at : undefined,
+      created_at: typeof parsed.created_at === "string" ? parsed.created_at : new Date(0).toISOString()
+    };
+  } catch {
+    return null;
+  }
+}
+function ensureMachineIdentity(home) {
+  const existing = readMachineIdentity(home);
+  if (existing)
+    return existing;
+  const fresh = {
+    machine_id: randomUUID4(),
+    created_at: new Date().toISOString()
+  };
+  writeJsonAtomically(auditMachineFile(home), fresh);
+  return fresh;
+}
+function recordReportWatermark(nextWindowFrom, home) {
+  const current = ensureMachineIdentity(home);
+  writeJsonAtomically(auditMachineFile(home), {
+    ...current,
+    last_reported_at: nextWindowFrom
+  });
+}
+function machineLabel() {
+  try {
+    const h = hostname5().trim();
+    return h.length > 0 ? h : undefined;
+  } catch {
+    return;
+  }
+}
+var init_machine_store = __esm(() => {
+  init_atomic_write();
+  init_fp_home();
+});
+
+// src/audit/report-harm.ts
+async function reportHarm(result) {
+  let auto = false;
+  let consentedAt;
+  let intervalDays = 7;
+  try {
+    const config = readConfig();
+    auto = config.audit.auto;
+    consentedAt = config.audit.reportsConsentedAt;
+    intervalDays = config.audit.intervalDays;
+  } catch {
+    return { kind: "disabled" };
+  }
+  if (!auto)
+    return { kind: "disabled" };
+  if (consentedAt === undefined)
+    return { kind: "consent-required" };
+  const auth = await getValidAccessToken();
+  if (!auth) {
+    return { kind: "signed-out" };
+  }
+  let identity2;
+  try {
+    identity2 = ensureMachineIdentity();
+  } catch (err) {
+    return { kind: "failed", error: err instanceof Error ? err.message : String(err) };
+  }
+  const report = buildHarmReport(result, identity2.last_reported_at, intervalDays);
+  const hits = report.harmful.reduce((n, p) => n + p.hits, 0);
+  try {
+    const res = await submitAuditReport(auth.access_token, {
+      machine_id: identity2.machine_id,
+      label: machineLabel(),
+      platform: process.platform,
+      window_from: report.window_from,
+      window_to: report.window_to,
+      harmful: report.harmful
+    });
+    try {
+      recordReportWatermark(res.next_window_from);
+    } catch {}
+    return res.emailed ? { kind: "sent", hits } : { kind: "held", hits, reason: res.reason ?? "not_sent" };
+  } catch (err) {
+    const error = err instanceof AuthApiError ? `${err.code}: ${err.message}` : err instanceof Error ? err.message : String(err);
+    return { kind: "failed", error };
+  }
+}
+function describeOutcome2(outcome) {
+  switch (outcome.kind) {
+    case "disabled":
+      return null;
+    case "consent-required":
+      return "failproofai: scheduled scans are on, but emailing what they find needs a fresh opt-in — run `failproofai audit --schedule` (or visit /settings) to turn digests on";
+    case "signed-out":
+      return "failproofai: emailed reports are on but this machine is signed out — run `failproofai audit --schedule` or visit /settings to resume them";
+    case "sent":
+      return `failproofai: emailed a harm digest (${outcome.hits} finding${outcome.hits === 1 ? "" : "s"})`;
+    case "held":
+      return `failproofai: ${outcome.hits} finding${outcome.hits === 1 ? "" : "s"} reported, no email (${outcome.reason})`;
+    case "failed":
+      return `failproofai: could not send the harm report: ${outcome.error}`;
+  }
+}
+var init_report_harm = __esm(() => {
+  init_auth_store();
+  init_api_server_client();
+  init_fp_config();
+  init_harm_report();
+  init_machine_store();
+});
+
+// src/audit/audit-schedule.ts
+import { readFileSync as readFileSync29 } from "node:fs";
+function readAuditSchedule(home) {
+  let raw;
+  try {
+    raw = readFileSync29(auditScheduleFile(home), "utf8");
+  } catch {
+    return null;
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return null;
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+    return null;
+  const obj = parsed;
+  const num = (v) => typeof v === "number" && Number.isFinite(v) ? v : null;
+  const schema = num(obj.schema);
+  return {
+    schema,
+    nextDueAtMs: num(obj.next_due_at_ms),
+    lastAttemptAtMs: num(obj.last_attempt_at_ms),
+    lastRunAtMs: num(obj.last_run_at_ms),
+    lastExitCode: num(obj.last_exit_code),
+    schemaAhead: schema !== null && schema > AUDIT_SCHEDULE_SCHEMA
+  };
+}
+var AUDIT_SCHEDULE_SCHEMA = 1;
+var init_audit_schedule = __esm(() => {
+  init_fp_home();
+});
+
+// src/audit/cli-login.ts
+var exports_cli_login = {};
+__export(exports_cli_login, {
+  runLogin: () => runLogin,
+  invalidEmail: () => invalidEmail,
+  extractCode: () => extractCode,
+  ensureSignedIn: () => ensureSignedIn,
+  canPrompt: () => canPrompt,
+  LoginError: () => LoginError
+});
+function spine() {
+  return colorsEnabled(process.stdout) ? `${ANSI_DIM_BAR}${BAR}${ANSI_RESET}  ` : "";
+}
+function extractCode(raw) {
+  const trimmed = raw.trim();
+  if (/^\d+$/.test(trimmed))
+    return trimmed;
+  const runs = trimmed.match(/\d+/g) ?? [];
+  if (runs.length === 0)
+    return trimmed;
+  const whole = runs.find((run) => run.length >= CODE_MIN);
+  if (whole)
+    return whole;
+  return runs.join("");
+}
+function canPrompt() {
+  return Boolean(process.stdin.isTTY && process.stdout.isTTY);
+}
+function sessionStillValid(auth) {
+  if (!auth)
+    return null;
+  return auth.refresh_expires_at * 1000 > Date.now() ? auth : null;
+}
+async function ensureSignedIn(preset) {
+  const existing = sessionStillValid(readAuth());
+  if (existing) {
+    if (preset && !sameAddress(preset, existing.user.email)) {
+      throw new LoginError(`This machine is already signed in as ${existing.user.email}.
+` + `To report as ${preset.trim().toLowerCase()} instead, sign out first — ` + `from the dashboard, or by removing ~/.failproofai/audit/session.json.`);
+    }
+    return { user: existing.user, prompted: false };
+  }
+  if (!canPrompt()) {
+    throw new LoginError(`Signing in needs an interactive terminal, and this one is not.
+` + "Run `failproofai audit --schedule` from a shell you are sitting at,\n" + "or sign in from the dashboard — both write the same session file.");
+  }
+  return { user: await runLogin(preset), prompted: true };
+}
+function sameAddress(a, b) {
+  return a.trim().toLowerCase() === b.trim().toLowerCase();
+}
+function invalidEmail(address) {
+  return EMAIL_RE.test(address.trim()) ? null : `\`--email\` needs an email address (got: ${address}).`;
+}
+async function runLogin(preset) {
+  intro("scheduled audits need somewhere to send the report");
+  let address;
+  if (preset) {
+    address = preset.trim().toLowerCase();
+    step("your email", address);
+  } else {
+    const email = await promptText({
+      prefix: spine(),
+      message: "your email",
+      hint: "you@yourdomain.com",
+      validate: (v) => EMAIL_RE.test(v.trim()) ? null : "that doesn't look like an email"
+    });
+    if (email === null) {
+      outro("Cancelled — nothing was changed.", { ok: false });
+      throw new LoginError("Cancelled.");
+    }
+    address = email.trim().toLowerCase();
+  }
+  let expiresInMin = 10;
+  try {
+    const sent = await requestLoginCode(address);
+    expiresInMin = Math.max(1, Math.ceil(sent.expires_in / 60));
+  } catch (err) {
+    outro("Could not send a login code.", { ok: false });
+    throw new LoginError(describeAuthError(err, "Could not send a login code"));
+  }
+  step("code sent", `to ${address} · expires in ${expiresInMin} min`);
+  const ATTEMPTS = 3;
+  for (let attempt = 1;attempt <= ATTEMPTS; attempt += 1) {
+    stepOpen(attempt === 1 ? "the code from that email" : "try that code again");
+    const typed = await promptText({
+      prefix: spine(),
+      message: "code",
+      hint: attempt === 1 ? "123456 · paste the whole line if you like" : `attempt ${attempt} of ${ATTEMPTS}`,
+      validate: (v) => {
+        if (!/\d/.test(v))
+          return "a code is digits — paste the line from the email";
+        const code = extractCode(v);
+        if (code.length < CODE_MIN)
+          return "that looks too short to be the code";
+        if (code.length > CODE_MAX)
+          return "that looks too long — paste just the code";
+        return null;
+      }
+    });
+    if (typed === null) {
+      outro("Cancelled — nothing was changed.", { ok: false });
+      throw new LoginError("Cancelled.");
+    }
+    try {
+      const tokens = await verifyLoginCode(address, extractCode(typed));
+      writeAuth(authFromTokenResponse(tokens));
+      step("signed in", tokens.user.email);
+      return { id: tokens.user.id, email: tokens.user.email };
+    } catch (err) {
+      const wrongCode = err instanceof AuthApiError && err.code === "invalid_code";
+      if (wrongCode && attempt < ATTEMPTS) {
+        step("that code was wrong or expired", `${ATTEMPTS - attempt} more ${ATTEMPTS - attempt === 1 ? "try" : "tries"} before it asks for a new one`);
+        continue;
+      }
+      outro("Could not verify that code.", { ok: false });
+      throw new LoginError(describeAuthError(err, "Could not verify that code"));
+    }
+  }
+  outro("Too many wrong codes.", { ok: false });
+  throw new LoginError("Too many wrong codes. Run the command again for a fresh one.");
+}
+function describeAuthError(err, prefix) {
+  if (err instanceof AuthApiError) {
+    if (err.code === "rate_limited") {
+      const wait = err.retryAfterSecs;
+      return `${prefix}: too many attempts.${wait ? ` Try again in ${wait}s.` : ""}`;
+    }
+    if (err.status === 0 || err.code === "timeout") {
+      return `${prefix}: the api-server did not respond.
+` + `It is at ${apiBaseForMessage()} — check that it is running,
+` + `or set FAILPROOF_API_URL to point somewhere else.`;
+    }
+    return `${prefix}: ${err.message}`;
+  }
+  return `${prefix}: ${err instanceof Error ? err.message : String(err)}`;
+}
+function apiBaseForMessage() {
+  return process.env.FAILPROOF_API_URL ?? process.env.FAILPROOFAI_API_URL ?? "https://api.befailproof.ai";
+}
+var EMAIL_RE, CODE_MIN = 4, CODE_MAX = 12, ANSI_DIM_BAR = "\x1B[2m", LoginError;
+var init_cli_login = __esm(() => {
+  init_api_server_client();
+  init_auth_store();
+  init_tui();
+  EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+  LoginError = class LoginError extends Error {
+  };
+});
+
+// src/audit/schedule-cli.ts
+var exports_schedule_cli = {};
+__export(exports_schedule_cli, {
+  runScheduleStatus: () => runScheduleStatus,
+  runScheduleOn: () => runScheduleOn,
+  runScheduleOff: () => runScheduleOff,
+  asScheduleError: () => asScheduleError,
+  ScheduleCliError: () => ScheduleCliError
+});
+function row(label, value, note) {
+  const gap = " ".repeat(Math.max(1, LABEL_WIDTH - label.length));
+  return `${rail()}  ${dim(label)}${gap}${value}${note ? `  ${dim(note)}` : ""}`;
+}
+async function runScheduleOn(daysArg, emailArg) {
+  let days;
+  if (daysArg !== undefined) {
+    const parsed = Number(daysArg);
+    if (!Number.isFinite(parsed) || !Number.isInteger(parsed)) {
+      throw new ScheduleCliError(`\`--schedule\` takes a whole number of days (got: ${daysArg}).`);
+    }
+    if (parsed < MIN_DAYS || parsed > MAX_DAYS) {
+      throw new ScheduleCliError(`\`--schedule\` must be between ${MIN_DAYS} and ${MAX_DAYS} days (got: ${parsed}).`);
+    }
+    days = parsed;
+  }
+  if (emailArg !== undefined) {
+    const bad = invalidEmail(emailArg);
+    if (bad)
+      throw new ScheduleCliError(bad);
+  }
+  const { user, prompted } = await ensureSignedIn(emailArg);
+  const next = updateConfig({
+    audit: {
+      auto: true,
+      reportsConsentedAt: Date.now(),
+      ...days !== undefined ? { intervalDays: days } : {}
+    }
+  });
+  const interval = next.audit.intervalDays;
+  const summary = [
+    `every ${interval} day${interval === 1 ? "" : "s"} · reports to ${user.email}`,
+    "you only hear from it when a scan finds something harmful",
+    "each report sends: finding counts, redacted example commands, this machine's name"
+  ];
+  if (prompted) {
+    step("scheduled audits are on", summary);
+  } else {
+    process.stdout.write(`
+${green("✓")}  ${bold("scheduled audits are on")}
+` + summary.map((r) => `   ${dim(r)}
+`).join(""));
+  }
+  warnIfDaemonWontRun();
+  if (prompted) {
+    outro("failproofai audit --status  ·  when the next scan is due");
+  } else {
+    process.stdout.write(dim(`
+   failproofai audit --status   when the next scan is due
+
+`));
+  }
+}
+function runScheduleOff() {
+  const before = readConfig().audit.auto;
+  const next = updateConfig({ audit: { auto: false } });
+  if (next.audit.auto) {
+    process.stdout.write(`Could not turn scheduled audits off.
+`);
+    return;
+  }
+  if (!before) {
+    process.stdout.write(dim(`
+Scheduled audits were already off.
+
+`));
+    return;
+  }
+  process.stdout.write(`
+${green("✓")}  ${bold("scheduled audits are off")}
+` + `   ${dim("nothing runs on a timer and nothing is sent")}
+` + `   ${dim("your session is untouched — sign out from the dashboard for that")}
+
+`);
+}
+function runScheduleStatus() {
+  const config = readConfig();
+  const auth = readAuth();
+  const sched = readAuditSchedule();
+  const meta = readDashboardCacheMeta();
+  const machine = readMachineIdentity();
+  const daemon = daemonServiceStatus();
+  const on = config.audit.auto;
+  const out = [""];
+  out.push(`${rail()}  ${bold("scheduled audit")}   ${on ? green("on") : dim("off")}` + (on ? dim(`  every ${config.audit.intervalDays} days`) : ""));
+  out.push(rail());
+  const live = auth && auth.refresh_expires_at * 1000 > Date.now() ? auth : null;
+  out.push(row("reports to", live ? live.user.email : dim("— signed out")));
+  if (on && !live) {
+    out.push(row("", pink("scans continue; digests are paused until you sign in")));
+  } else if (on && config.audit.reportsConsentedAt === undefined) {
+    out.push(row("", pink("scans continue; digests need a fresh opt-in — run `--schedule` to turn them on")));
+  }
+  out.push(row("daemon", describeDaemon(daemon)));
+  if (sched?.nextDueAtMs != null && on) {
+    out.push(row("next scan", untilPhrase(sched.nextDueAtMs)));
+  }
+  if (sched?.lastRunAtMs != null) {
+    const exit = sched.lastExitCode;
+    out.push(row("last scheduled", agoPhrase(sched.lastRunAtMs), exit != null && exit !== 0 && exit !== 75 ? pink(`exit ${exit}`) : undefined));
+  }
+  out.push(row("last result", meta?.cachedAt ? agoPhrase(Date.parse(meta.cachedAt)) : dim("none yet")));
+  if (machine?.last_reported_at) {
+    out.push(row("last reported", agoPhrase(Date.parse(machine.last_reported_at))));
+  }
+  out.push("");
+  process.stdout.write(out.join(`
+`));
+}
+function describeDaemon(status) {
+  switch (status) {
+    case "running":
+      return green("running");
+    case "stopped":
+      return pink("stopped — run `failproofai config` to repair it");
+    case "not-installed":
+      return pink("not installed — run `failproofai config`");
+    case "condition-failed":
+      return pink("installed but its binary is missing — run `failproofai config`");
+    default:
+      return isDaemonSupportedPlatform() ? dim(String(status)) : dim("unavailable on this platform");
+  }
+}
+function warnIfDaemonWontRun() {
+  const status = daemonServiceStatus();
+  if (status === "running")
+    return;
+  if (status === "unknown")
+    return;
+  if (!isDaemonSupportedPlatform()) {
+    process.stderr.write(`
+  ${pink("!")} The background service is not available on this platform,
+` + `    so nothing will run on the timer here. \`failproofai audit\` still works.
+`);
+    return;
+  }
+  process.stderr.write(`
+  ${pink("!")} The background service is ${status.replace("-", " ")}, ` + `so nothing will run on the timer yet.
+` + `    Run \`failproofai config\` to install or repair it.
+`);
+}
+function untilPhrase(ms) {
+  const diff = ms - Date.now();
+  if (diff <= 0)
+    return "due now";
+  const d = Math.floor(diff / 86400000);
+  const h = Math.floor(diff % 86400000 / 3600000);
+  if (d > 0)
+    return `in ${d}d${h > 0 ? ` ${h}h` : ""}`;
+  if (h > 0)
+    return `in ${h}h`;
+  return `in ${Math.max(1, Math.floor(diff / 60000))}m`;
+}
+function agoPhrase(ms) {
+  if (!Number.isFinite(ms))
+    return "unknown";
+  const diff = Date.now() - ms;
+  if (diff < 0)
+    return "just now";
+  const d = Math.floor(diff / 86400000);
+  const h = Math.floor(diff / 3600000);
+  const m = Math.floor(diff / 60000);
+  if (d > 0)
+    return `${d}d ago`;
+  if (h > 0)
+    return `${h}h ago`;
+  if (m > 0)
+    return `${m}m ago`;
+  return "just now";
+}
+function asScheduleError(err) {
+  if (err instanceof LoginError || err instanceof ScheduleCliError) {
+    throw new ScheduleCliError(err.message);
+  }
+  throw err;
+}
+var MIN_DAYS = 1, MAX_DAYS = 90, ScheduleCliError, styled = () => colorsEnabled(process.stdout), wrap = (open2, s) => styled() ? `${open2}${s}${ANSI_RESET}` : s, pink = (s) => wrap(brandAnsi("pink"), s), green = (s) => wrap(brandAnsi("guide"), s), dim = (s) => wrap(ANSI_DIM, s), bold = (s) => wrap(ANSI_BOLD, s), rail = () => " ", LABEL_WIDTH = 15;
+var init_schedule_cli = __esm(() => {
+  init_fp_config();
+  init_daemon_service();
+  init_auth_store();
+  init_audit_schedule();
+  init_dashboard_cache();
+  init_machine_store();
+  init_cli_login();
+  init_tui();
+  ScheduleCliError = class ScheduleCliError extends Error {
+  };
+});
+
+// scripts/parse-script-args.ts
+import { resolve as resolve23 } from "path";
+function parseStringFlag(flagName, errorLabel, inlineValue, args, index, options) {
+  const raw = inlineValue ?? args[index + 1];
+  if (raw === undefined || inlineValue === null && raw.startsWith("-")) {
+    console.error(`Error: ${flagName} requires ${errorLabel}`);
+    process.exit(1);
+  }
+  const value = options?.resolve ? resolve23(raw) : raw;
+  return { value, spliceCount: inlineValue !== null ? 1 : 2 };
+}
+function parseScriptArgs(argv) {
+  const args = [...argv];
+  let loggingLevel;
+  let disableTelemetry = false;
+  let allowedDevOrigins;
+  let host;
+  for (let i = 0;i < args.length; i++) {
+    const arg = args[i];
+    const eqIdx = arg.indexOf("=");
+    const flag = eqIdx >= 0 ? arg.slice(0, eqIdx) : arg;
+    const inlineValue = eqIdx >= 0 ? arg.slice(eqIdx + 1) : null;
+    if (flag === "--logging") {
+      const raw = inlineValue ?? args[i + 1];
+      if (raw === undefined || inlineValue === null && raw.startsWith("-")) {
+        console.error("Error: --logging requires a level (info, warn, error)");
+        process.exit(1);
+      }
+      const val = raw.toLowerCase();
+      if (val !== "info" && val !== "warn" && val !== "error") {
+        console.error("Error: --logging must be one of: info, warn, error");
+        process.exit(1);
+      }
+      loggingLevel = val;
+      args.splice(i, inlineValue !== null ? 1 : 2);
+      i--;
+      continue;
+    }
+    if (flag === "--disable-telemetry") {
+      disableTelemetry = true;
+      args.splice(i, 1);
+      i--;
+      continue;
+    }
+    if (flag === "--allowed-origins") {
+      const { value, spliceCount } = parseStringFlag(flag, "a comma-separated list of origins", inlineValue, args, i);
+      allowedDevOrigins = value.split(",").map((s) => s.trim()).filter(Boolean);
+      args.splice(i, spliceCount);
+      i--;
+      continue;
+    }
+    if (flag === "--host" || flag === "-H" || flag === "--hostname") {
+      const { value, spliceCount } = parseStringFlag(flag, "an address to bind (e.g. 127.0.0.1)", inlineValue, args, i);
+      host = value;
+      args.splice(i, spliceCount);
+      i--;
+      continue;
+    }
+  }
+  return { loggingLevel, disableTelemetry, allowedDevOrigins, host, remainingArgs: args };
+}
+var init_parse_script_args = () => {};
+
+// scripts/install-diagnosis.mjs
+import { existsSync as existsSync34, readFileSync as readFileSync30, realpathSync as realpathSync3 } from "node:fs";
+import { dirname as dirname16, resolve as resolve24 } from "node:path";
+import { homedir as homedir26, platform as platform4 } from "node:os";
+import { spawnSync } from "node:child_process";
+function findPackageRoot(start) {
+  try {
+    let dir = realpathSync3(start);
+    if (existsSync34(dir) && !existsSync34(resolve24(dir, "package.json"))) {
+      dir = dirname16(dir);
+    }
+    while (true) {
+      const pkgPath = resolve24(dir, "package.json");
+      if (existsSync34(pkgPath)) {
+        try {
+          const pkg = JSON.parse(readFileSync30(pkgPath, "utf8"));
+          if (pkg.name === PKG_NAME)
+            return dir;
+        } catch {}
+      }
+      const parent = dirname16(dir);
+      if (parent === dir)
+        return null;
+      dir = parent;
+    }
+  } catch {
+    return null;
+  }
+}
+function readPackageVersion(packageRoot) {
+  if (!packageRoot)
+    return null;
+  try {
+    const pkg = JSON.parse(readFileSync30(resolve24(packageRoot, "package.json"), "utf8"));
+    return typeof pkg.version === "string" ? pkg.version : null;
+  } catch {
+    return null;
+  }
+}
+function resolvePathFirstBinary() {
+  try {
+    const isWin = platform4() === "win32";
+    const res = isWin ? spawnSync("where", [PKG_NAME], { encoding: "utf8" }) : spawnSync("sh", ["-c", `command -v ${PKG_NAME}`], { encoding: "utf8" });
+    if (res.status !== 0)
+      return null;
+    const first = (res.stdout || "").split(/\r?\n/).find((l) => l.trim().length > 0);
+    return first ? first.trim() : null;
+  } catch {
+    return null;
+  }
+}
+function locateNpmGlobal() {
+  try {
+    const res = spawnSync("npm", ["root", "-g"], { encoding: "utf8" });
+    if (res.status !== 0)
+      return null;
+    const root = (res.stdout || "").trim();
+    if (!root)
+      return null;
+    const candidate = resolve24(root, PKG_NAME);
+    return existsSync34(resolve24(candidate, "package.json")) ? candidate : null;
+  } catch {
+    return null;
+  }
+}
+function locateBunGlobal() {
+  try {
+    const candidate = resolve24(homedir26(), ".bun", "install", "global", "node_modules", PKG_NAME);
+    return existsSync34(resolve24(candidate, "package.json")) ? candidate : null;
+  } catch {
+    return null;
+  }
+}
+function buildRecommendation(pathFirstBin) {
+  if (!pathFirstBin)
+    return null;
+  const bunBinPrefix = resolve24(homedir26(), ".bun", "bin") + "/";
+  const bunGlobalPrefix = resolve24(homedir26(), ".bun", "install", "global") + "/";
+  const isBun = pathFirstBin.startsWith(bunBinPrefix) || pathFirstBin.startsWith(bunGlobalPrefix);
+  if (isBun) {
+    return `rm -f ~/.bun/bin/${PKG_NAME} && rm -rf ~/.bun/install/global/node_modules/${PKG_NAME}`;
+  }
+  return `npm rm -g ${PKG_NAME}`;
+}
+function diagnoseShadow(self) {
+  const selfPackageRoot = (() => {
+    try {
+      return self?.selfPackageRoot ? realpathSync3(self.selfPackageRoot) : null;
+    } catch {
+      return self?.selfPackageRoot ?? null;
+    }
   })();
   const selfVersion = self?.selfVersion ?? null;
   const pathFirstBin = resolvePathFirstBinary();
@@ -25649,8 +26771,8 @@ function makeSkewLogFilter() {
 }
 
 // lib/dashboard-host.ts
-function isLoopbackHostname(hostname5) {
-  const h = hostname5.trim().toLowerCase();
+function isLoopbackHostname(hostname6) {
+  const h = hostname6.trim().toLowerCase();
   if (!h)
     return false;
   if (LOOPBACK_HOSTNAMES.has(h))
@@ -25672,8 +26794,8 @@ __export(exports_launch, {
   launch: () => launch
 });
 import { spawn as spawn2 } from "child_process";
-import { realpathSync as realpathSync4, existsSync as existsSync32 } from "node:fs";
-import { resolve as resolve24, dirname as dirname17 } from "node:path";
+import { realpathSync as realpathSync4, existsSync as existsSync35 } from "node:fs";
+import { resolve as resolve25, dirname as dirname17 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 import { createInterface } from "node:readline";
 function launch(mode) {
@@ -25697,9 +26819,9 @@ function launch(mode) {
     process.env.PORT = port;
     process.env.HOSTNAME = bindHost;
     cmd = "node";
-    const packageRoot = process.env.FAILPROOFAI_PACKAGE_ROOT ?? resolve24(dirname17(realpathSync4(fileURLToPath2(import.meta.url))), "..");
-    const serverJsPath = resolve24(packageRoot, ".next/standalone/server.js");
-    if (!existsSync32(serverJsPath)) {
+    const packageRoot = process.env.FAILPROOFAI_PACKAGE_ROOT ?? resolve25(dirname17(realpathSync4(fileURLToPath2(import.meta.url))), "..");
+    const serverJsPath = resolve25(packageRoot, ".next/standalone/server.js");
+    if (!existsSync35(serverJsPath)) {
       let shadowMessage = null;
       try {
         const diag = diagnoseShadow({ selfPackageRoot: packageRoot, selfVersion: version2 });
@@ -25783,10 +26905,43 @@ __export(exports_cli, {
   runScheduledAudit: () => runScheduledAudit,
   runPostSetupAudit: () => runPostSetupAudit,
   runAuditCli: () => runAuditCli,
+  helpText: () => helpText,
   buildSummary: () => buildSummary,
   EXIT_AUDIT_ALREADY_RUNNING: () => EXIT_AUDIT_ALREADY_RUNNING,
   AUDIT_STAGES: () => AUDIT_STAGES
 });
+function helpText() {
+  const row2 = (command, lines) => {
+    const pad = " ".repeat(Math.max(1, HELP_DESC_COL - 2 - command.length));
+    return lines.map((line, i) => i === 0 ? `  ${c(CYAN, command)}${pad}${line}` : `${" ".repeat(HELP_DESC_COL)}${line}`).join(`
+`);
+  };
+  return [
+    `${c(BOLD, "failproofai audit")} — review your agent CLIs for risky and wasteful patterns.`,
+    c(DIM, "Everything runs on this machine; only a scheduled digest ever leaves it."),
+    "",
+    c(BOLD, "USAGE"),
+    row2("failproofai audit", [
+      "Scan your session history, then open",
+      `http://localhost:${DASHBOARD_PORT}/audit`
+    ]),
+    row2("failproofai audit --schedule [days]", [
+      "Scan on a timer and email the findings.",
+      "Default 7 days, range 1-90.",
+      "Signs you in the first time; add",
+      "--email <address> to skip a prompt."
+    ]),
+    row2("failproofai audit --no-schedule", ["Stop the timer. Leaves you signed in."]),
+    row2("failproofai audit --status", [
+      "Whether scheduling is on, where reports",
+      "go, the daemon's state, and when the",
+      "next scan is due."
+    ]),
+    row2("failproofai audit -h, --help", ["Show this help."]),
+    ""
+  ].join(`
+`);
+}
 function colorOn() {
   if (process.env.NO_COLOR && process.env.NO_COLOR !== "")
     return false;
@@ -25961,6 +27116,13 @@ async function runScheduledAudit() {
     }
     process.stdout.write(`failproofai: audit complete — ${num(result.eventsScanned)} tool calls across ` + `${num(result.transcripts.scanned)} sessions, ${num(result.totals.hits)} hits
 `);
+    const outcome = await reportHarm(result);
+    const line = describeOutcome2(outcome);
+    if (line) {
+      const stream = outcome.kind === "sent" ? process.stdout : process.stderr;
+      stream.write(`${line}
+`);
+    }
     return 0;
   } finally {
     attempt.lock.release();
@@ -26016,7 +27178,7 @@ async function runPostSetupAudit() {
 }
 async function runAuditCli(args) {
   if (args.includes("--help") || args.includes("-h")) {
-    process.stdout.write(HELP);
+    process.stdout.write(helpText());
     process.exit(0);
   }
   if (args.includes("--scheduled")) {
@@ -26025,15 +27187,71 @@ async function runAuditCli(args) {
       die(`\`audit --scheduled\` takes no other arguments (got: ${extra}).`);
     process.exit(await runScheduledAudit());
   }
+  if (args.includes("--status")) {
+    const extra = args.find((a) => a !== "--status");
+    if (extra)
+      die(`\`audit --status\` takes no other arguments (got: ${extra}).`);
+    const { runScheduleStatus: runScheduleStatus2 } = await Promise.resolve().then(() => (init_schedule_cli(), exports_schedule_cli));
+    runScheduleStatus2();
+    process.exit(0);
+  }
+  if (args.includes("--no-schedule")) {
+    const extra = args.find((a) => a !== "--no-schedule");
+    if (extra)
+      die(`\`audit --no-schedule\` takes no other arguments (got: ${extra}).`);
+    const { runScheduleOff: runScheduleOff2 } = await Promise.resolve().then(() => (init_schedule_cli(), exports_schedule_cli));
+    runScheduleOff2();
+    process.exit(0);
+  }
+  const scheduleAt = args.indexOf("--schedule");
+  if (scheduleAt !== -1) {
+    let days;
+    let email;
+    for (let i = 0;i < args.length; i += 1) {
+      const a = args[i];
+      if (a === "--schedule") {
+        const next = args[i + 1];
+        if (next !== undefined && !next.startsWith("-")) {
+          days = next;
+          i += 1;
+        }
+        continue;
+      }
+      if (a === "--email" || a.startsWith("--email=")) {
+        if (a.startsWith("--email=")) {
+          email = a.slice("--email=".length);
+        } else {
+          email = args[i + 1];
+          i += 1;
+        }
+        if (email === undefined || email.length === 0 || email.startsWith("-")) {
+          die("`--email` needs an address, e.g. `--email you@yourdomain.com`.");
+        }
+        continue;
+      }
+      die(`\`audit --schedule\` does not take ${a}.`);
+    }
+    const { runScheduleOn: runScheduleOn2, ScheduleCliError: ScheduleCliError2 } = await Promise.resolve().then(() => (init_schedule_cli(), exports_schedule_cli));
+    const { LoginError: LoginError2 } = await Promise.resolve().then(() => (init_cli_login(), exports_cli_login));
+    try {
+      await runScheduleOn2(days, email);
+    } catch (err) {
+      if (err instanceof ScheduleCliError2 || err instanceof LoginError2)
+        die(err.message);
+      throw err;
+    }
+    process.exit(0);
+  }
   const stray = args.find((a) => a !== "--help" && a !== "-h");
   if (stray) {
-    die(`\`audit\` takes no arguments yet (got: ${stray}).
-` + `Run \`failproofai audit\` to scan your history and open the dashboard.`);
+    die(`\`audit\` does not take ${stray}.
+Run \`failproofai audit\` to scan your history and open the dashboard,
+or \`failproofai audit --help\` for the scheduling commands.`);
   }
   const attempt = acquireAuditLock("cli");
   if (!attempt.ok) {
     process.stderr.write(`Error: ${heldByLine(attempt.heldBy)}.
-` + `Two audits write the same cache files, so this one won't start. Try again shortly.
+Two audits write the same cache files, so this one won't start. Try again shortly.
 `);
     process.exit(EXIT_AUDIT_ALREADY_RUNNING);
   }
@@ -26057,7 +27275,7 @@ async function runAuditCli(args) {
   if (result.eventsScanned === 0) {
     process.stdout.write(`
   ${c(DIM, "no agent sessions found yet.")}
-` + `  install hooks with ${c(CYAN, "failproofai policies --install")} ` + `${c(DIM, "and come back after using your agent.")}
+  install hooks with ${c(CYAN, "failproofai policies --install")} ${c(DIM, "and come back after using your agent.")}
 
 `);
     process.exit(0);
@@ -26072,15 +27290,15 @@ async function runAuditCli(args) {
   const url = `http://localhost:${DASHBOARD_PORT}/audit`;
   process.stdout.write(`
   ${c(DIM, "starting the dashboard…")}
-` + `  ${c(PINK, "✦")} ${c(BOLD, "here's your audit")}  ${c(DIM, "→")}  ${c(CYAN, url)}
-` + `  ${c(DIM, "(opening in your browser — press Ctrl+C to stop the server)")}
+  ${c(PINK, "✦")} ${c(BOLD, "here's your audit")}  ${c(DIM, "→")}  ${c(CYAN, url)}
+  ${c(DIM, "(opening in your browser — press Ctrl+C to stop the server)")}
 
 `);
   openWhenReady(DASHBOARD_PORT, "/audit");
   const { launch: launch2 } = await Promise.resolve().then(() => (init_launch(), exports_launch));
   launch2("start");
 }
-var DASHBOARD_PORT = 8020, EXIT_AUDIT_ALREADY_RUNNING = 75, AUDIT_STAGES, HELP, RESET, DIM, BOLD, PINK, GREEN, CYAN, SPINNER;
+var DASHBOARD_PORT = 8020, EXIT_AUDIT_ALREADY_RUNNING = 75, AUDIT_STAGES, HELP_DESC_COL = 40, RESET, DIM, BOLD, PINK, GREEN, CYAN, SPINNER;
 var init_cli = __esm(() => {
   init_audit();
   init_audit_lock();
@@ -26089,6 +27307,7 @@ var init_cli = __esm(() => {
   init_telemetry_id2();
   init_telemetry_sanitize();
   init_open_browser();
+  init_report_harm();
   init_tui();
   AUDIT_STAGES = [
     { label: "discovering transcripts", detail: "walking ~/.claude, ~/.codex, ~/.cursor, …" },
@@ -26096,29 +27315,6 @@ var init_cli = __esm(() => {
     { label: "running policy checks", detail: "replaying through 30 builtin policies" },
     { label: "aggregating results", detail: "counting hits, ranking by frequency" }
   ];
-  HELP = `
-failproofai audit — audit your AI agent's behavior, then open the dashboard
-
-USAGE
-  failproofai audit          Scan your agent-CLI session history for risky and
-                             wasteful patterns, then open the audit dashboard.
-  failproofai audit --help   Show this help.
-
-  failproofai audit --scheduled
-                             Headless run: scan, refresh the dashboard's cached
-                             result, print one line, exit. No browser, no
-                             server. This is what a scheduled audit runs; exit
-                             75 means another audit already had the lock.
-
-WHAT IT DOES
-  1. Scans past sessions from every installed agent CLI (Claude, Codex, Cursor,
-     Copilot, OpenCode, Pi) — entirely on your machine.
-  2. Starts the local dashboard and opens
-     http://localhost:${DASHBOARD_PORT}/audit with your results.
-
-  Runs fully offline — no account or network required. Press Ctrl+C to stop the
-  dashboard server when you're done.
-`.trimStart();
   RESET = ANSI_RESET;
   DIM = ANSI_DIM;
   BOLD = ANSI_BOLD;
@@ -26147,16 +27343,16 @@ __export(exports_configure_wizard, {
   buildCompletionSummary: () => buildCompletionSummary,
   buildAgentChoices: () => buildAgentChoices
 });
-import { existsSync as existsSync33, mkdirSync as mkdirSync21, writeFileSync as writeFileSync19, readFileSync as readFileSync27 } from "node:fs";
-import { homedir as homedir26 } from "node:os";
-import { dirname as dirname18, resolve as resolve25, sep as sep5 } from "node:path";
+import { existsSync as existsSync36, mkdirSync as mkdirSync21, writeFileSync as writeFileSync19, readFileSync as readFileSync31 } from "node:fs";
+import { homedir as homedir27 } from "node:os";
+import { dirname as dirname18, resolve as resolve26, sep as sep5 } from "node:path";
 async function emit(event, props) {
   try {
     await trackHookEvent2(getInstanceId2(), event, props);
   } catch {}
 }
 function homeify2(p) {
-  const home = homedir26();
+  const home = homedir27();
   if (p === home)
     return "~";
   if (p.startsWith(home + sep5))
@@ -26280,8 +27476,8 @@ function setCustomPoliciesEnabled(scope, cwd, enabled) {
   const path3 = getConfigPathForScope(scope, cwd);
   let config = {};
   try {
-    if (existsSync33(path3))
-      config = JSON.parse(readFileSync27(path3, "utf8"));
+    if (existsSync36(path3))
+      config = JSON.parse(readFileSync31(path3, "utf8"));
   } catch {
     return;
   }
@@ -26321,7 +27517,7 @@ function describeCustomPolicies(cwd) {
   const scopes = [];
   let fileCount = 0;
   const dirs = [
-    { dir: resolve25(cwd, ".failproofai", "policies"), label: "project" },
+    { dir: resolve26(cwd, ".failproofai", "policies"), label: "project" },
     { dir: customPoliciesDir(), label: "global" }
   ];
   for (const { dir, label } of dirs) {
@@ -26332,7 +27528,7 @@ function describeCustomPolicies(cwd) {
       fileCount += found.length;
     }
     for (const name of findSkippedPolicyFiles(dir)) {
-      warnings.push(`! ${homeify2(resolve25(dir, name))} is NOT loaded — rename to ` + `${name.replace(/\.(js|mjs|ts)$/, "-policies.$1")}`);
+      warnings.push(`! ${homeify2(resolve26(dir, name))} is NOT loaded — rename to ` + `${name.replace(/\.(js|mjs|ts)$/, "-policies.$1")}`);
     }
   }
   return { active, warnings, fileCount, scopes };
@@ -26438,7 +27634,7 @@ function firstRunMarkerPath() {
   return launcherMarker();
 }
 function hasSeenLauncher() {
-  return existsSync33(firstRunMarkerPath());
+  return existsSync36(firstRunMarkerPath());
 }
 function markLauncherSeen() {
   try {
@@ -26740,7 +27936,7 @@ refreshed. Re-run \`failproofai config\` once you can use sudo.
       let url = null;
       let token = null;
       let machineId = resolveMachineId();
-      let machineLabel = existing?.machineLabel ?? resolveMachineLabel();
+      let machineLabel2 = existing?.machineLabel ?? resolveMachineLabel();
       if (existing) {
         const reuse = await selectOne({
           message: `Use this machine's existing connection to ${existing.url}?`,
@@ -26761,7 +27957,7 @@ refreshed. Re-run \`failproofai config\` once you can use sudo.
           url = existing.url;
           token = existing.token;
           machineId = existing.machineId;
-          machineLabel = existing.machineLabel ?? machineLabel;
+          machineLabel2 = existing.machineLabel ?? machineLabel2;
         }
       }
       if (url === null) {
@@ -26815,13 +28011,13 @@ That did not work: ${probe.reason}
         if (retry === "skip") {
           stdout.write("Staying local. Connect later with `failproofai config --connect`.\n\n");
         } else {
-          connect = { url, token, machineId, machineLabel };
+          connect = { url, token, machineId, machineLabel: machineLabel2 };
         }
       } else {
         stdout.write(`looks good.
 
 `);
-        connect = { url, token, machineId, machineLabel };
+        connect = { url, token, machineId, machineLabel: machineLabel2 };
       }
     }
   }
@@ -27024,17 +28220,17 @@ __export(exports_flush_cli2, {
   flushRequestPath: () => flushRequestPath2,
   DEFAULT_FLUSH_TIMEOUT_SECS: () => DEFAULT_FLUSH_TIMEOUT_SECS2
 });
-import { existsSync as existsSync34, mkdirSync as mkdirSync22, writeFileSync as writeFileSync20, readdirSync as readdirSync18 } from "node:fs";
-import { dirname as dirname19, join as join32 } from "node:path";
+import { existsSync as existsSync37, mkdirSync as mkdirSync22, writeFileSync as writeFileSync20, readdirSync as readdirSync19 } from "node:fs";
+import { dirname as dirname19, join as join34 } from "node:path";
 function flushRequestPath2(home) {
-  return join32(failproofaiHome(home), "state", "flush-request.json");
+  return join34(failproofaiHome(home), "state", "flush-request.json");
 }
 function spoolDirs2(home) {
   const root = spoolDir(home);
-  if (!existsSync34(root))
+  if (!existsSync37(root))
     return [];
   try {
-    return readdirSync18(root, { withFileTypes: true }).filter((e) => e.isDirectory() && e.name !== "failed").map((e) => join32(root, e.name));
+    return readdirSync19(root, { withFileTypes: true }).filter((e) => e.isDirectory() && e.name !== "failed").map((e) => join34(root, e.name));
   } catch {
     return [];
   }
@@ -27043,7 +28239,7 @@ function pendingBatches2(home) {
   let n = 0;
   for (const dir of spoolDirs2(home)) {
     try {
-      n += readdirSync18(dir).filter((f) => f.endsWith(".jsonl")).length;
+      n += readdirSync19(dir).filter((f) => f.endsWith(".jsonl")).length;
     } catch {}
   }
   return n;
@@ -27138,16 +28334,16 @@ __export(exports_backfill_cli, {
   backfillRequestPath: () => backfillRequestPath,
   DEFAULT_BACKFILL_DAYS: () => DEFAULT_BACKFILL_DAYS
 });
-import { existsSync as existsSync35, mkdirSync as mkdirSync23, writeFileSync as writeFileSync21, readdirSync as readdirSync19, statSync as statSync24 } from "node:fs";
-import { dirname as dirname20, join as join33 } from "node:path";
+import { existsSync as existsSync38, mkdirSync as mkdirSync23, writeFileSync as writeFileSync21, readdirSync as readdirSync20, statSync as statSync24 } from "node:fs";
+import { dirname as dirname20, join as join35 } from "node:path";
 function backfillRequestPath(home) {
-  return join33(failproofaiHome(home), "state", "backfill-request.json");
+  return join35(failproofaiHome(home), "state", "backfill-request.json");
 }
 function surveySessions(sinceMs, homeDir) {
   const out = [];
   for (const { cli, dir } of SESSION_DIRS) {
-    const root = join33(homeDir, dir);
-    if (!existsSync35(root))
+    const root = join35(homeDir, dir);
+    if (!existsSync38(root))
       continue;
     let files = 0;
     let newest = 0;
@@ -27156,12 +28352,12 @@ function surveySessions(sinceMs, homeDir) {
         return;
       let entries;
       try {
-        entries = readdirSync19(d, { withFileTypes: true });
+        entries = readdirSync20(d, { withFileTypes: true });
       } catch {
         return;
       }
       for (const e of entries) {
-        const p = join33(d, e.name);
+        const p = join35(d, e.name);
         if (e.isDirectory()) {
           walk(p, depth + 1);
           continue;
@@ -27185,7 +28381,7 @@ function runBackfillCommand(opts = {}) {
   const now = opts.now ?? Date.now();
   const sinceMs = opts.sinceMs ?? now - DEFAULT_BACKFILL_DAYS * 24 * 60 * 60 * 1000;
   const home = failproofaiHome();
-  if (!existsSync35(home)) {
+  if (!existsSync38(home)) {
     return {
       exitCode: 1,
       lines: [`No failproofai home at ${home}. Run \`failproofai config\` first.`]
@@ -27291,8 +28487,8 @@ __export(exports_harness_cli, {
   addPath: () => addPath,
   HARNESS_KEYS: () => HARNESS_KEYS
 });
-import { homedir as homedir27 } from "node:os";
-import { resolve as resolve26 } from "node:path";
+import { homedir as homedir28 } from "node:os";
+import { resolve as resolve27 } from "node:path";
 function unknownHarness(name) {
   return fail([
     `Unknown harness: ${name}`,
@@ -27335,8 +28531,8 @@ function comparableLabel(raw) {
   return raw.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
 }
 function comparablePath(raw) {
-  const home = homedir27();
-  const expanded = raw === "~" ? home : raw.startsWith("~/") ? resolve26(home, raw.slice(2)) : raw;
+  const home = homedir28();
+  const expanded = raw === "~" ? home : raw.startsWith("~/") ? resolve27(home, raw.slice(2)) : raw;
   return expanded.replace(/\/+$/, "");
 }
 function effectiveLabel(entry) {
@@ -27523,7 +28719,7 @@ __export(exports_fp_config, {
   DEFAULT_CONFIG: () => DEFAULT_CONFIG2,
   DEFAULT_AUDIT_INTERVAL_DAYS: () => DEFAULT_AUDIT_INTERVAL_DAYS2
 });
-import { chmodSync as chmodSync5, existsSync as existsSync36, mkdirSync as mkdirSync24, readFileSync as readFileSync28, statSync as statSync25, writeFileSync as writeFileSync22 } from "node:fs";
+import { chmodSync as chmodSync6, existsSync as existsSync39, mkdirSync as mkdirSync24, readFileSync as readFileSync32, statSync as statSync25, writeFileSync as writeFileSync22 } from "node:fs";
 import { dirname as dirname21 } from "node:path";
 function detectLayout2() {
   const raw = readVersionFile2();
@@ -27532,11 +28728,18 @@ function detectLayout2() {
       return { kind: "current", version: raw };
     return raw.layout > LAYOUT_VERSION ? { kind: "future", found: raw.layout } : { kind: "stale", found: raw.layout };
   }
-  if (existsSync36(configFile())) {
+  if (existsSync39(configFile())) {
+    const layoutThreePositions = [
+      legacy.authJson(),
+      legacy.nextAudit(),
+      legacy.auditSchedule()
+    ];
+    if (layoutThreePositions.some((p) => existsSync39(p)))
+      return { kind: "stale", found: 3 };
     return { kind: "current", version: { layout: LAYOUT_VERSION, cli: "" }, inferred: true };
   }
-  if (existsSync36(legacy.configToml()))
-    return { kind: "stale", found: LAYOUT_VERSION - 1 };
+  if (existsSync39(legacy.configToml()))
+    return { kind: "stale", found: 2 };
   const layoutOneMarkers = [
     legacy.policyConfig(),
     legacy.cacheDir(),
@@ -27546,7 +28749,7 @@ function detectLayout2() {
     legacy.ingestCredentials(),
     legacy.auditDashboard()
   ];
-  return layoutOneMarkers.some((p) => existsSync36(p)) ? { kind: "stale", found: 1 } : { kind: "absent" };
+  return layoutOneMarkers.some((p) => existsSync39(p)) ? { kind: "stale", found: 1 } : { kind: "absent" };
 }
 function readLegacyTomlVersion2(text) {
   const layout = Number(/^\s*layout\s*=\s*(\d+)\s*$/m.exec(text)?.[1]);
@@ -27558,7 +28761,7 @@ function readLegacyTomlVersion2(text) {
 function readVersionFile2() {
   let text;
   try {
-    text = readFileSync28(versionFile(), "utf8");
+    text = readFileSync32(versionFile(), "utf8");
   } catch {
     return null;
   }
@@ -27579,7 +28782,7 @@ function readVersionFile2() {
 function writeVersionFile2(v = {}) {
   const existing = readVersionFile2();
   const next = {
-    layout: LAYOUT_VERSION,
+    layout: v.layout ?? LAYOUT_VERSION,
     cli: v.cli ?? version2,
     daemon: v.clearDaemon ? undefined : v.daemon ?? existing?.daemon
   };
@@ -27613,7 +28816,7 @@ function readSources2(raw) {
 function readConfigRaw2() {
   let raw = {};
   try {
-    const parsed = JSON.parse(readFileSync28(configFile(), "utf8"));
+    const parsed = JSON.parse(readFileSync32(configFile(), "utf8"));
     if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
       raw = parsed;
     }
@@ -27622,7 +28825,7 @@ function readConfigRaw2() {
 }
 function readConfig2() {
   try {
-    const parsed = JSON.parse(readFileSync28(configFile(), "utf8"));
+    const parsed = JSON.parse(readFileSync32(configFile(), "utf8"));
     return projectConfig2(parsed);
   } catch {
     return structuredClone(DEFAULT_CONFIG2);
@@ -27648,7 +28851,11 @@ function projectConfig2(parsed) {
         sources: readSources2(collector.sources)
       },
       telemetry: { enabled: telemetry.enabled !== false },
-      audit: { auto: audit.auto === true, intervalDays: readIntervalDays2(audit.interval_days) }
+      audit: {
+        auto: audit.auto === true,
+        intervalDays: readIntervalDays2(audit.interval_days),
+        reportsConsentedAt: typeof audit.reports_consented_at === "number" && Number.isFinite(audit.reports_consented_at) ? audit.reports_consented_at : undefined
+      }
     };
   }
 }
@@ -27697,7 +28904,11 @@ function writeConfig2(config, raw) {
       } : {}
     },
     ...config.telemetry.enabled ? {} : { telemetry: { enabled: false } },
-    audit: { auto: config.audit.auto, interval_days: config.audit.intervalDays }
+    audit: {
+      auto: config.audit.auto,
+      interval_days: config.audit.intervalDays,
+      ...config.audit.reportsConsentedAt === undefined ? {} : { reports_consented_at: config.audit.reportsConsentedAt }
+    }
   };
   const merged = structuredClone(raw ?? readConfigRaw2().raw);
   for (const path3 of OWNED_CONFIG_KEYS2)
@@ -27721,7 +28932,7 @@ function updateConfig2(patch) {
 function readCredentialsRaw2() {
   let raw = {};
   try {
-    const parsed = JSON.parse(readFileSync28(credentialsFile(), "utf8"));
+    const parsed = JSON.parse(readFileSync32(credentialsFile(), "utf8"));
     if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
       raw = parsed;
     }
@@ -27730,7 +28941,7 @@ function readCredentialsRaw2() {
 }
 function readCredentials2() {
   try {
-    return projectCredentials2(JSON.parse(readFileSync28(credentialsFile(), "utf8")));
+    return projectCredentials2(JSON.parse(readFileSync32(credentialsFile(), "utf8")));
   } catch {
     return {};
   }
@@ -27742,8 +28953,8 @@ function projectCredentials2(parsed) {
     const auth = parsed.auth;
     const out = {};
     if (cloud && typeof cloud.url === "string" && typeof cloud.machine_id === "string" && typeof cloud.token === "string" && cloud.url && cloud.token) {
-      const machineLabel = typeof cloud.machine_label === "string" && cloud.machine_label ? cloud.machine_label : undefined;
-      out.cloud = { url: cloud.url, machineId: cloud.machine_id, token: cloud.token, machineLabel };
+      const machineLabel2 = typeof cloud.machine_label === "string" && cloud.machine_label ? cloud.machine_label : undefined;
+      out.cloud = { url: cloud.url, machineId: cloud.machine_id, token: cloud.token, machineLabel: machineLabel2 };
     }
     const org = parsed.org;
     if (org) {
@@ -27802,12 +29013,12 @@ function writeCredentials2(creds, raw) {
   mkdirSync24(home, { recursive: true });
   try {
     if (statSync25(home).mode & 63)
-      chmodSync5(home, 448);
+      chmodSync6(home, 448);
   } catch {}
   writeFileSync22(credentialsFile(), `${JSON.stringify(merged, null, 2)}
 `, { mode: 384 });
   try {
-    chmodSync5(credentialsFile(), 384);
+    chmodSync6(credentialsFile(), 384);
   } catch {}
 }
 function hasCloudCredentials() {
@@ -27847,7 +29058,8 @@ var init_fp_config2 = __esm(() => {
     ["collector", "sources", "*", "extra_paths"],
     ["telemetry", "enabled"],
     ["audit", "auto"],
-    ["audit", "interval_days"]
+    ["audit", "interval_days"],
+    ["audit", "reports_consented_at"]
   ];
   OWNED_CREDENTIAL_KEYS2 = [
     ["cloud", "url"],
@@ -27906,7 +29118,9 @@ __export(exports_fp_home, {
   codexSessionPathsFile: () => codexSessionPathsFile2,
   cloudPoliciesDir: () => cloudPoliciesDir2,
   binDir: () => binDir2,
+  auditSessionFile: () => auditSessionFile2,
   auditScheduleFile: () => auditScheduleFile2,
+  auditMachineFile: () => auditMachineFile2,
   auditLockFile: () => auditLockFile2,
   auditDir: () => auditDir2,
   auditDashboardFile: () => auditDashboardFile2,
@@ -27914,12 +29128,12 @@ __export(exports_fp_home, {
   LAYOUT_VERSION: () => LAYOUT_VERSION2,
   HOME_CLASSES: () => HOME_CLASSES2
 });
-import { homedir as homedir28 } from "node:os";
-import { resolve as resolve27 } from "node:path";
+import { homedir as homedir29 } from "node:os";
+import { resolve as resolve28 } from "node:path";
 function failproofaiHome2(home) {
   if (home)
-    return resolve27(home, ".failproofai");
-  return process.env.FAILPROOFAI_HOME || resolve27(homedir28(), ".failproofai");
+    return resolve28(home, ".failproofai");
+  return process.env.FAILPROOFAI_HOME || resolve28(homedir29(), ".failproofai");
 }
 function resettablePaths2() {
   return [
@@ -27936,6 +29150,7 @@ function retiredLayoutPaths2() {
     legacy2.lastVersion(),
     legacy2.auditDashboard(),
     legacy2.auditCacheDir(),
+    legacy2.auditReminder(),
     legacy2.codexSessionPaths(),
     legacy2.spoolDir(),
     legacy2.failedDir(),
@@ -27947,7 +29162,7 @@ function retiredLayoutPaths2() {
     legacy2.localPoliciesDir()
   ];
 }
-var LAYOUT_VERSION2 = 3, at2 = (...parts) => resolve27(failproofaiHome2(), ...parts), atHome2 = (home, ...parts) => home ? resolve27(failproofaiHome2(home), ...parts) : at2(...parts), versionFile2 = (home) => atHome2(home, "VERSION"), configFile2 = (home) => atHome2(home, "config.json"), credentialsFile2 = (home) => atHome2(home, "credentials.json"), binDir2 = (home) => atHome2(home, "bin"), daemonBinary = (version3, home) => resolve27(binDir2(home), `failproofaid-${version3}`), policiesDir2 = (home) => atHome2(home, "policies"), customPoliciesDir2, globalPolicyConfigFile2 = (home) => atHome2(home, "policies-config.json"), cloudPoliciesDir2 = (home) => resolve27(policiesDir2(home), "cloud-policies"), cursorsDir2 = (source, home) => source ? resolve27(atHome2(home, "cursors"), source) : atHome2(home, "cursors"), customAgentsDir2 = (home) => atHome2(home, "custom-agents"), customAgentsEventsDir = (home) => resolve27(customAgentsDir2(home), "events"), customAgentsFailedDir = (home) => resolve27(customAgentsDir2(home), "failed"), auditDir2 = (home) => atHome2(home, "audit"), auditDashboardFile2 = (home) => resolve27(auditDir2(home), "dashboard.json"), auditCacheDir2 = (home) => resolve27(auditDir2(home), "cache"), hookActivityDir2 = (home) => atHome2(home, "hook-activity"), runDir2 = (home) => atHome2(home, "run"), daemonSocket2 = () => process.env.FAILPROOFAI_DAEMON_SOCKET || resolve27(runDir2(), "failproofaid.sock"), workerSocket = (home) => resolve27(runDir2(home), "worker.sock"), daemonLock = (home) => resolve27(runDir2(home), "failproofaid.lock"), auditLockFile2 = (home) => resolve27(runDir2(home), "audit.lock"), stateDir2 = (home) => atHome2(home, "state"), shimsDir2 = (home) => resolve27(stateDir2(home), "shims"), spoolDir2 = (home) => resolve27(stateDir2(home), "spool"), failedDir2 = (home) => resolve27(stateDir2(home), "failed"), collectorHealthFile2 = (home) => resolve27(stateDir2(home), "collector-health.json"), sessionPauseDir2 = () => resolve27(stateDir2(), "sessions"), auditScheduleFile2 = (home) => resolve27(stateDir2(home), "audit-schedule.json"), telemetryIdFile2 = (home) => resolve27(stateDir2(home), "telemetry-id"), launcherMarker2 = (home) => resolve27(stateDir2(home), "launcher-configured"), onboardingAttemptFile2 = (home) => resolve27(stateDir2(home), "onboarding-attempt.json"), lastVersionFile2 = (home) => resolve27(stateDir2(home), "last-version"), onboardingLockFile2 = (home) => resolve27(stateDir2(home), "onboarding.lock"), codexSessionPathsFile2 = (home) => resolve27(stateDir2(home), "codex-session-paths.json"), logsDir2 = (home) => atHome2(home, "logs"), migrationsDir2 = (home) => atHome2(home, "migrations"), migrationLedgerFile2 = (home) => resolve27(migrationsDir2(home), "applied.json"), migrationBackupDir2 = (layout, home) => resolve27(migrationsDir2(home), `backup-layout${layout}`), HOME_CLASSES2, legacy2;
+var LAYOUT_VERSION2 = 4, at2 = (...parts) => resolve28(failproofaiHome2(), ...parts), atHome2 = (home, ...parts) => home ? resolve28(failproofaiHome2(home), ...parts) : at2(...parts), versionFile2 = (home) => atHome2(home, "VERSION"), configFile2 = (home) => atHome2(home, "config.json"), credentialsFile2 = (home) => atHome2(home, "credentials.json"), binDir2 = (home) => atHome2(home, "bin"), daemonBinary = (version3, home) => resolve28(binDir2(home), `failproofaid-${version3}`), policiesDir2 = (home) => atHome2(home, "policies"), customPoliciesDir2, globalPolicyConfigFile2 = (home) => atHome2(home, "policies-config.json"), cloudPoliciesDir2 = (home) => resolve28(policiesDir2(home), "cloud-policies"), cursorsDir2 = (source, home) => source ? resolve28(atHome2(home, "cursors"), source) : atHome2(home, "cursors"), customAgentsDir2 = (home) => atHome2(home, "custom-agents"), customAgentsEventsDir = (home) => resolve28(customAgentsDir2(home), "events"), customAgentsFailedDir = (home) => resolve28(customAgentsDir2(home), "failed"), auditDir2 = (home) => atHome2(home, "audit"), auditDashboardFile2 = (home) => resolve28(auditDir2(home), "dashboard.json"), auditCacheDir2 = (home) => resolve28(auditDir2(home), "cache"), auditSessionFile2 = (home) => resolve28(auditDir2(home), "session.json"), auditMachineFile2 = (home) => resolve28(auditDir2(home), "machine.json"), hookActivityDir2 = (home) => atHome2(home, "hook-activity"), runDir2 = (home) => atHome2(home, "run"), daemonSocket2 = () => process.env.FAILPROOFAI_DAEMON_SOCKET || resolve28(runDir2(), "failproofaid.sock"), workerSocket = (home) => resolve28(runDir2(home), "worker.sock"), daemonLock = (home) => resolve28(runDir2(home), "failproofaid.lock"), auditLockFile2 = (home) => resolve28(runDir2(home), "audit.lock"), stateDir2 = (home) => atHome2(home, "state"), shimsDir2 = (home) => resolve28(stateDir2(home), "shims"), spoolDir2 = (home) => resolve28(stateDir2(home), "spool"), failedDir2 = (home) => resolve28(stateDir2(home), "failed"), collectorHealthFile2 = (home) => resolve28(stateDir2(home), "collector-health.json"), sessionPauseDir2 = () => resolve28(stateDir2(), "sessions"), auditScheduleFile2 = (home) => resolve28(auditDir2(home), "schedule.json"), telemetryIdFile2 = (home) => resolve28(stateDir2(home), "telemetry-id"), launcherMarker2 = (home) => resolve28(stateDir2(home), "launcher-configured"), onboardingAttemptFile2 = (home) => resolve28(stateDir2(home), "onboarding-attempt.json"), lastVersionFile2 = (home) => resolve28(stateDir2(home), "last-version"), onboardingLockFile2 = (home) => resolve28(stateDir2(home), "onboarding.lock"), codexSessionPathsFile2 = (home) => resolve28(stateDir2(home), "codex-session-paths.json"), logsDir2 = (home) => atHome2(home, "logs"), migrationsDir2 = (home) => atHome2(home, "migrations"), migrationLedgerFile2 = (home) => resolve28(migrationsDir2(home), "applied.json"), migrationBackupDir2 = (layout, home) => resolve28(migrationsDir2(home), `backup-layout${layout}`), HOME_CLASSES2, legacy2;
 var init_fp_home2 = __esm(() => {
   customPoliciesDir2 = policiesDir2;
   HOME_CLASSES2 = [
@@ -27955,20 +29170,23 @@ var init_fp_home2 = __esm(() => {
     { path: configFile2, class: "user-typed" },
     { path: globalPolicyConfigFile2, class: "user-typed" },
     { path: policiesDir2, class: "user-typed" },
+    { path: auditSessionFile2, class: "user-typed" },
     { path: spoolDir2, class: "undelivered" },
     { path: failedDir2, class: "undelivered" },
     { path: customAgentsDir2, class: "undelivered" },
     { path: hookActivityDir2, class: "undelivered" },
-    { path: (home) => resolve27(stateDir2(home), "flush-request.json"), class: "undelivered" },
-    { path: (home) => resolve27(stateDir2(home), "backfill-request.json"), class: "undelivered" },
+    { path: (home) => resolve28(stateDir2(home), "flush-request.json"), class: "undelivered" },
+    { path: (home) => resolve28(stateDir2(home), "backfill-request.json"), class: "undelivered" },
     { path: cursorsDir2, class: "identity" },
     { path: telemetryIdFile2, class: "identity" },
-    { path: (home) => resolve27(stateDir2(home), "daemon-telemetry-id"), class: "identity" },
+    { path: (home) => resolve28(stateDir2(home), "daemon-telemetry-id"), class: "identity" },
     { path: versionFile2, class: "identity" },
     { path: migrationsDir2, class: "identity" },
-    { path: auditDir2, class: "derived" },
-    { path: collectorHealthFile2, class: "derived" },
+    { path: auditMachineFile2, class: "identity" },
+    { path: auditDashboardFile2, class: "derived" },
+    { path: auditCacheDir2, class: "derived" },
     { path: auditScheduleFile2, class: "derived" },
+    { path: collectorHealthFile2, class: "derived" },
     { path: codexSessionPathsFile2, class: "derived" },
     { path: shimsDir2, class: "derived" },
     { path: sessionPauseDir2, class: "derived" },
@@ -27994,6 +29212,10 @@ var init_fp_home2 = __esm(() => {
     launcherMarker: () => at2(".launcher-configured"),
     lastVersion: () => at2("last-version"),
     auditDashboard: () => at2("audit-dashboard.json"),
+    authJson: () => at2("auth.json"),
+    nextAudit: () => at2("next-audit.json"),
+    auditReminder: () => at2("audit", "reminder.json"),
+    auditSchedule: () => at2("state", "audit-schedule.json"),
     cacheDir: () => at2("cache"),
     hookActivityDir: () => at2("cache", "hook-activity"),
     auditCacheDir: () => at2("cache", "audit"),
@@ -28013,26 +29235,83 @@ __export(exports_migrations2, {
   runMigrations: () => runMigrations2,
   restoreBackup: () => restoreBackup2,
   readLedger: () => readLedger2,
+  pruneMigratedCredentials: () => pruneMigratedCredentials2,
   planMigration: () => planMigration2,
   migrationCoverageGap: () => migrationCoverageGap2,
   describePlan: () => describePlan2,
   backupBeforeMigrating: () => backupBeforeMigrating2,
   MIGRATIONS: () => MIGRATIONS2
 });
-import { copyFileSync as copyFileSync4, existsSync as existsSync37, mkdirSync as mkdirSync25, readFileSync as readFileSync29, rmSync as rmSync12, writeFileSync as writeFileSync23 } from "node:fs";
-import { basename as basename7, dirname as dirname22, resolve as resolve28 } from "node:path";
+import {
+  chmodSync as chmodSync7,
+  copyFileSync as copyFileSync4,
+  existsSync as existsSync40,
+  mkdirSync as mkdirSync25,
+  readFileSync as readFileSync33,
+  renameSync as renameSync8,
+  rmSync as rmSync14,
+  writeFileSync as writeFileSync23
+} from "node:fs";
+import { basename as basename7, dirname as dirname22, join as join36, resolve as resolve29 } from "node:path";
+function migrateToLayout42() {
+  const moves = [
+    { from: legacy.authJson(), to: auditSessionFile() },
+    { from: legacy.nextAudit(), to: legacy.auditReminder() },
+    { from: legacy.auditSchedule(), to: auditScheduleFile() }
+  ];
+  const authDirOverride = process.env.FAILPROOFAI_AUTH_DIR;
+  if (authDirOverride) {
+    moves.push({ from: join36(authDirOverride, "auth.json"), to: join36(authDirOverride, "session.json") }, {
+      from: join36(authDirOverride, "next-audit.json"),
+      to: join36(authDirOverride, "reminder.json")
+    });
+  }
+  const migrated = [];
+  for (const { from, to } of moves) {
+    if (!existsSync40(from))
+      continue;
+    if (existsSync40(to)) {
+      rmSync14(from, { force: true });
+      continue;
+    }
+    mkdirSync25(dirname22(to), { recursive: true });
+    try {
+      renameSync8(from, to);
+    } catch {
+      try {
+        copyFileSync4(from, to);
+      } catch (err) {
+        try {
+          rmSync14(to, { force: true });
+        } catch {}
+        throw err;
+      }
+      rmSync14(from, { force: true });
+    }
+    migrated.push(`${basename7(from)} → audit/${basename7(to)}`);
+  }
+  for (const secret of [auditSessionFile()]) {
+    if (!existsSync40(secret))
+      continue;
+    try {
+      chmodSync7(secret, 384);
+    } catch {}
+  }
+  writeVersionFile({ layout: 4 });
+  return { removed: [], migrated, activity: [], policyConfig: [], spooled: [], from: 3 };
+}
 function planMigration2(from, registry = MIGRATIONS2) {
   if (from >= LAYOUT_VERSION)
     return [];
   const chain = [];
   let at3 = from;
   while (at3 < LAYOUT_VERSION) {
-    const step = registry.find((m) => m.from === at3);
-    if (!step) {
+    const step2 = registry.find((m) => m.from === at3);
+    if (!step2) {
       throw new Error(`no migration from layout ${at3} to ${LAYOUT_VERSION} — this build cannot upgrade that home`);
     }
-    chain.push(step);
-    at3 = step.to;
+    chain.push(step2);
+    at3 = step2.to;
   }
   return chain;
 }
@@ -28058,7 +29337,7 @@ function migrationCoverageGap2(registry = MIGRATIONS2) {
 }
 function readLedger2() {
   try {
-    const parsed = JSON.parse(readFileSync29(migrationLedgerFile(), "utf8"));
+    const parsed = JSON.parse(readFileSync33(migrationLedgerFile(), "utf8"));
     return Array.isArray(parsed) ? parsed : [];
   } catch {
     return [];
@@ -28075,11 +29354,28 @@ function appendLedger2(entry) {
 function backupNameOf2(f) {
   return f.as ?? basename7(f.at());
 }
+function pruneMigratedCredentials2(from) {
+  const pruned = [];
+  for (let layout = from;layout < LAYOUT_VERSION; layout++) {
+    for (const { as, landsAt } of PRUNED_AFTER_SUCCESS2) {
+      try {
+        if (!existsSync40(landsAt()))
+          continue;
+        const copy = resolve29(migrationBackupDir(layout), as);
+        if (!existsSync40(copy))
+          continue;
+        rmSync14(copy, { force: true });
+        pruned.push(as);
+      } catch {}
+    }
+  }
+  return pruned;
+}
 function filesToBackUp2() {
   const seen = new Map;
   for (const f of [...BACKED_UP2, ...BACKED_UP_LEGACY2]) {
     const path3 = f.at();
-    if (existsSync37(path3))
+    if (existsSync40(path3))
       seen.set(path3, backupNameOf2(f));
   }
   return [...seen].map(([path3, as]) => ({ path: path3, as }));
@@ -28088,14 +29384,14 @@ function backupBeforeMigrating2(from) {
   const dir = migrationBackupDir(from);
   const saved = [];
   try {
-    rmSync12(dir, { recursive: true, force: true });
+    rmSync14(dir, { recursive: true, force: true });
     mkdirSync25(dir, { recursive: true });
   } catch {
     return [];
   }
   for (const { path: source, as } of filesToBackUp2()) {
     try {
-      copyFileSync4(source, resolve28(dir, as));
+      copyFileSync4(source, resolve29(dir, as));
       saved.push(as);
     } catch {}
   }
@@ -28113,19 +29409,19 @@ function runMigrations2(from, chain = planMigration2(from)) {
     from
   };
   let failed;
-  for (const step of chain) {
+  for (const step2 of chain) {
     const startedAt = Date.now();
     try {
-      const result = step.run();
+      const result = step2.run();
       outcome.removed.push(...result.removed);
       outcome.migrated.push(...result.migrated);
       outcome.activity.push(...result.activity);
       outcome.policyConfig.push(...result.policyConfig);
       outcome.spooled.push(...result.spooled);
-      steps.push({ from: step.from, to: step.to, ok: true });
+      steps.push({ from: step2.from, to: step2.to, ok: true });
       appendLedger2({
-        from: step.from,
-        to: step.to,
+        from: step2.from,
+        to: step2.to,
         cli: version2,
         at: new Date(startedAt).toISOString(),
         durationMs: Date.now() - startedAt,
@@ -28135,15 +29431,20 @@ function runMigrations2(from, chain = planMigration2(from)) {
         activity: result.activity.length
       });
     } catch (err) {
-      steps.push({ from: step.from, to: step.to, ok: false });
+      steps.push({ from: step2.from, to: step2.to, ok: false });
+      try {
+        const marker = readVersionFile();
+        if (marker && marker.layout >= LAYOUT_VERSION)
+          writeVersionFile({ layout: step2.from });
+      } catch {}
       failed = {
-        from: step.from,
-        to: step.to,
+        from: step2.from,
+        to: step2.to,
         error: err instanceof Error ? err.message : String(err)
       };
       appendLedger2({
-        from: step.from,
-        to: step.to,
+        from: step2.from,
+        to: step2.to,
         cli: version2,
         at: new Date(startedAt).toISOString(),
         durationMs: Date.now() - startedAt,
@@ -28152,6 +29453,8 @@ function runMigrations2(from, chain = planMigration2(from)) {
       break;
     }
   }
+  if (!failed)
+    pruneMigratedCredentials2(from);
   return { from, steps, backedUp, outcome, failed };
 }
 function describePlan2(from) {
@@ -28178,13 +29481,13 @@ function describePlan2(from) {
 }
 function restoreBackup2(layout) {
   const dir = migrationBackupDir(layout);
-  if (!existsSync37(dir))
+  if (!existsSync40(dir))
     return [];
   const restored = [];
   for (const f of [...BACKED_UP2, ...BACKED_UP_LEGACY2]) {
     const target = f.at();
-    const source = resolve28(dir, backupNameOf2(f));
-    if (!existsSync37(source))
+    const source = resolve29(dir, backupNameOf2(f));
+    if (!existsSync40(source))
       continue;
     try {
       mkdirSync25(dirname22(target), { recursive: true });
@@ -28194,23 +29497,30 @@ function restoreBackup2(layout) {
   }
   return restored.sort((a, b) => a.localeCompare(b));
 }
-var MIGRATIONS2, BACKED_UP2, BACKED_UP_LEGACY2;
+var MIGRATIONS2, BACKED_UP2, BACKED_UP_LEGACY2, PRUNED_AFTER_SUCCESS2;
 var init_migrations2 = __esm(() => {
   init_package();
   init_fp_home();
+  init_fp_config();
   init_fp_reset();
   MIGRATIONS2 = [
     {
       from: 1,
       to: 3,
       describe: "layout 1 → 3: carry the decision log out of cache/, keep the policy config in place, drop the layout-1 credential files",
-      run: () => resetHome(1)
+      run: () => resetHome(1, 3)
     },
     {
       from: 2,
       to: 3,
       describe: "layout 2 → 3: carry config.toml and credentials.toml into JSON, move custom-policies/ back up into policies/, nest the policy config at the root",
-      run: () => resetHome(2)
+      run: () => resetHome(2, 3)
+    },
+    {
+      from: 3,
+      to: 4,
+      describe: "layout 3 → 4: gather the audit's files under audit/ — auth.json becomes audit/session.json, next-audit.json becomes audit/reminder.json, state/audit-schedule.json becomes audit/schedule.json",
+      run: migrateToLayout42
     }
   ];
   BACKED_UP2 = [
@@ -28225,7 +29535,13 @@ var init_migrations2 = __esm(() => {
     { at: legacy.policyConfig },
     { at: legacy.localPolicyConfig, as: "local-policies-policies-config.json" },
     { at: legacy.cloudCredentials },
-    { at: legacy.ingestCredentials }
+    { at: legacy.ingestCredentials },
+    { at: legacy.authJson },
+    { at: legacy.nextAudit },
+    { at: legacy.auditSchedule }
+  ];
+  PRUNED_AFTER_SUCCESS2 = [
+    { as: basename7(legacy.authJson()), landsAt: auditSessionFile }
   ];
 });
 
@@ -28237,6 +29553,7 @@ __export(exports_daemon_service, {
   upgradedServiceDefinition: () => upgradedServiceDefinition2,
   uninstallDaemonService: () => uninstallDaemonService2,
   systemdUnitContents: () => systemdUnitContents2,
+  startedAtFromMonotonic: () => startedAtFromMonotonic,
   setDaemonConfigured: () => setDaemonConfigured2,
   resolveWorkerCommand: () => resolveWorkerCommand2,
   resolveFailproofaidBinaryPath: () => resolveFailproofaidBinaryPath2,
@@ -28253,6 +29570,7 @@ __export(exports_daemon_service, {
   ensureDaemonServiceCurrent: () => ensureDaemonServiceCurrent2,
   daemonVersionSkew: () => daemonVersionSkew2,
   daemonStatusCommand: () => daemonStatusCommand2,
+  daemonStartedAtMs: () => daemonStartedAtMs,
   daemonServiceStatus: () => daemonServiceStatus2,
   daemonServiceNeedsUpgrade: () => daemonServiceNeedsUpgrade2,
   daemonServiceFilePath: () => daemonServiceFilePath2,
@@ -28260,16 +29578,16 @@ __export(exports_daemon_service, {
   canElevate: () => canElevate2
 });
 import {
-  existsSync as existsSync38,
+  existsSync as existsSync41,
   mkdirSync as mkdirSync26,
   mkdtempSync as mkdtempSync2,
-  readFileSync as readFileSync30,
+  readFileSync as readFileSync34,
   writeFileSync as writeFileSync24,
   unlinkSync as unlinkSync5,
-  rmSync as rmSync13
+  rmSync as rmSync15
 } from "node:fs";
-import { homedir as homedir29, tmpdir as tmpdir3, userInfo as userInfo2 } from "node:os";
-import { resolve as resolve29 } from "node:path";
+import { homedir as homedir30, tmpdir as tmpdir3, userInfo as userInfo2 } from "node:os";
+import { resolve as resolve30 } from "node:path";
 import { execFileSync as execFileSync5 } from "node:child_process";
 function setDaemonConfigured2(value, installedVersion) {
   try {
@@ -28291,13 +29609,13 @@ function resolveFailproofaidBinaryPath2() {
   if (process.env.FAILPROOFAI_DAEMON_BINARY)
     return process.env.FAILPROOFAI_DAEMON_BINARY;
   const downloaded = installedBinaryPath();
-  if (existsSync38(downloaded))
+  if (existsSync41(downloaded))
     return downloaded;
   const packageRoot = process.env.FAILPROOFAI_PACKAGE_ROOT;
   if (packageRoot) {
     for (const profile of ["release", "debug"]) {
-      const candidate = resolve29(packageRoot, "target", profile, "failproofaid");
-      if (existsSync38(candidate))
+      const candidate = resolve30(packageRoot, "target", profile, "failproofaid");
+      if (existsSync41(candidate))
         return candidate;
     }
   }
@@ -28327,8 +29645,8 @@ function resolveWorkerCommand2() {
   const packageRoot = process.env.FAILPROOFAI_PACKAGE_ROOT;
   if (!packageRoot)
     return null;
-  const workerScript = resolve29(packageRoot, "dist", "worker.mjs");
-  if (!existsSync38(workerScript))
+  const workerScript = resolve30(packageRoot, "dist", "worker.mjs");
+  if (!existsSync41(workerScript))
     return null;
   return `${shellQuote2(process.execPath)} ${shellQuote2(workerScript)}`;
 }
@@ -28338,8 +29656,8 @@ function resolveCliCommand2() {
   const packageRoot = process.env.FAILPROOFAI_PACKAGE_ROOT;
   if (!packageRoot)
     return null;
-  const cliScript = resolve29(packageRoot, "dist", "cli.mjs");
-  if (!existsSync38(cliScript))
+  const cliScript = resolve30(packageRoot, "dist", "cli.mjs");
+  if (!existsSync41(cliScript))
     return null;
   return `${shellQuote2(process.execPath)} ${shellQuote2(cliScript)}`;
 }
@@ -28352,8 +29670,8 @@ function workerScriptPath2() {
   const packageRoot = process.env.FAILPROOFAI_PACKAGE_ROOT;
   if (!packageRoot)
     return null;
-  const workerScript = resolve29(packageRoot, "dist", "worker.mjs");
-  return existsSync38(workerScript) ? workerScript : null;
+  const workerScript = resolve30(packageRoot, "dist", "worker.mjs");
+  return existsSync41(workerScript) ? workerScript : null;
 }
 function assertUnitSafe2(value, field) {
   if (UNIT_UNSAFE_RE2.test(value)) {
@@ -28379,10 +29697,10 @@ function systemdUnitDir2() {
   return process.env.FAILPROOFAI_SYSTEMD_DIR || "/etc/systemd/system";
 }
 function systemdUnitPath2(user = serviceUser2()) {
-  return resolve29(systemdUnitDir2(), systemdUnitName2(user));
+  return resolve30(systemdUnitDir2(), systemdUnitName2(user));
 }
 function legacySystemdUserUnitPath2() {
-  return resolve29(homedir29(), ".config", "systemd", "user", "failproofaid.service");
+  return resolve30(homedir30(), ".config", "systemd", "user", "failproofaid.service");
 }
 function launchdLabel2(user = serviceUser2()) {
   return `ai.failproof.failproofaid.${user}`;
@@ -28391,7 +29709,7 @@ function launchdPlistPath2(user = serviceUser2()) {
   return `/Library/LaunchDaemons/${launchdLabel2(user)}.plist`;
 }
 function legacyLaunchAgentPlistPath2() {
-  return resolve29(homedir29(), "Library", "LaunchAgents", "ai.failproof.failproofaid.plist");
+  return resolve30(homedir30(), "Library", "LaunchAgents", "ai.failproof.failproofaid.plist");
 }
 function legacySharedLaunchDaemonPath2() {
   return "/Library/LaunchDaemons/ai.failproof.failproofaid.plist";
@@ -28439,20 +29757,20 @@ function runPrivileged2(command, args) {
   execFileSync5(cmd, argv, { stdio: "ignore", timeout: SERVICE_CMD_TIMEOUT_MS2 });
 }
 function writePrivilegedFile2(destination, contents, mode = "0644") {
-  const stagingDir = mkdtempSync2(resolve29(tmpdir3(), "failproofaid-stage-"));
-  const staging = resolve29(stagingDir, "service-definition");
+  const stagingDir = mkdtempSync2(resolve30(tmpdir3(), "failproofaid-stage-"));
+  const staging = resolve30(stagingDir, "service-definition");
   try {
     writeFileSync24(staging, contents, "utf8");
     runPrivileged2("install", ["-m", mode, staging, destination]);
   } finally {
-    rmSync13(stagingDir, { recursive: true, force: true });
+    rmSync15(stagingDir, { recursive: true, force: true });
   }
 }
 function removeLegacyUserService2() {
   try {
     if (process.platform === "linux") {
       const legacy3 = legacySystemdUserUnitPath2();
-      if (!existsSync38(legacy3))
+      if (!existsSync41(legacy3))
         return;
       try {
         execFileSync5("systemctl", ["--user", "disable", "--now", "failproofaid.service"], {
@@ -28469,7 +29787,7 @@ function removeLegacyUserService2() {
       } catch {}
     } else {
       const legacyAgent = legacyLaunchAgentPlistPath2();
-      if (existsSync38(legacyAgent)) {
+      if (existsSync41(legacyAgent)) {
         try {
           execFileSync5("launchctl", ["unload", "-w", legacyAgent], {
             stdio: "ignore",
@@ -28479,7 +29797,7 @@ function removeLegacyUserService2() {
         unlinkSync5(legacyAgent);
       }
       const legacyDaemon = legacySharedLaunchDaemonPath2();
-      if (existsSync38(legacyDaemon)) {
+      if (existsSync41(legacyDaemon)) {
         try {
           runPrivileged2("launchctl", ["unload", "-w", legacyDaemon]);
         } catch {}
@@ -28495,8 +29813,8 @@ function systemdUnitContents2(binaryPath, workerCmd, cliCmd = null) {
 `).join("");
   const user = assertUnitSafe2(serviceUser2(), "User");
   assertUnitSafe2(binaryPath, "ExecStart");
-  assertUnitSafe2(homedir29(), "HOME");
-  const conditionPaths = [binaryPath, workerScriptPath2()].filter((p) => typeof p === "string" && existsSync38(p));
+  assertUnitSafe2(homedir30(), "HOME");
+  const conditionPaths = [binaryPath, workerScriptPath2()].filter((p) => typeof p === "string" && existsSync41(p));
   const conditionLines = conditionPaths.map((p) => `ConditionPathExists=${assertUnitSafe2(p, "ConditionPathExists")}
 `).join("");
   return `[Unit]
@@ -28509,7 +29827,7 @@ User=${user}
 # Set explicitly rather than relying on systemd deriving it from User=:
 # failproofaid stores per-user state and refuses to start without HOME, so this
 # required variable is not left to a version-dependent default.
-Environment="HOME=${homedir29()}"
+Environment="HOME=${homedir30()}"
 ${envLines}ExecStart=${binaryPath}
 Restart=on-failure
 RestartSec=2
@@ -28557,9 +29875,9 @@ ${env.map(([key, value]) => `        <key>${key}</key>
     <key>UserName</key>
     <string>${escapeXml2(serviceUser2())}</string>
 ${envBlock}    <key>StandardOutPath</key>
-    <string>${escapeXml2(resolve29(logDir2, "failproofaid.log"))}</string>
+    <string>${escapeXml2(resolve30(logDir2, "failproofaid.log"))}</string>
     <key>StandardErrorPath</key>
-    <string>${escapeXml2(resolve29(logDir2, "failproofaid.err.log"))}</string>
+    <string>${escapeXml2(resolve30(logDir2, "failproofaid.err.log"))}</string>
 </dict>
 </plist>
 `;
@@ -28691,10 +30009,10 @@ function readInstalledServiceDefinition2() {
   if (!isDaemonSupportedPlatform2())
     return null;
   const path3 = daemonServiceFilePath2();
-  if (!path3 || !existsSync38(path3))
+  if (!path3 || !existsSync41(path3))
     return null;
   try {
-    return readFileSync30(path3, "utf8");
+    return readFileSync34(path3, "utf8");
   } catch {
     return null;
   }
@@ -28855,7 +30173,7 @@ async function uninstallDaemonService2() {
   try {
     if (process.platform === "linux") {
       const unitPath = systemdUnitPath2();
-      if (!existsSync38(unitPath))
+      if (!existsSync41(unitPath))
         return;
       try {
         runPrivileged2("systemctl", ["disable", "--now", systemdUnitName2()]);
@@ -28866,7 +30184,7 @@ async function uninstallDaemonService2() {
       } catch {}
     } else {
       const plistPath = launchdPlistPath2();
-      if (!existsSync38(plistPath))
+      if (!existsSync41(plistPath))
         return;
       try {
         runPrivileged2("launchctl", ["unload", "-w", plistPath]);
@@ -28883,7 +30201,7 @@ function daemonVersionSkew2() {
   const recorded = readVersionFile()?.daemon;
   if (!recorded)
     return null;
-  if (!existsSync38(installedBinaryPath(recorded)))
+  if (!existsSync41(installedBinaryPath(recorded)))
     return null;
   return recorded === version2 ? null : { installed: recorded, expected: version2 };
 }
@@ -28901,7 +30219,7 @@ function daemonServiceStatus2() {
   if (!isDaemonSupportedPlatform2())
     return "unsupported-platform";
   if (process.platform === "linux") {
-    if (!existsSync38(systemdUnitPath2()))
+    if (!existsSync41(systemdUnitPath2()))
       return "not-installed";
     try {
       const out = execFileSync5("systemctl", ["is-active", systemdUnitName2()], {
@@ -28914,7 +30232,7 @@ function daemonServiceStatus2() {
     }
   }
   const plistPath = launchdPlistPath2();
-  if (!existsSync38(plistPath))
+  if (!existsSync41(plistPath))
     return "not-installed";
   try {
     const root = typeof process.getuid === "function" && process.getuid() === 0;
@@ -28933,6 +30251,28 @@ function daemonServiceStatus2() {
     return "stopped";
   }
 }
+function daemonStartedAtMs() {
+  if (process.platform !== "linux")
+    return null;
+  if (!existsSync41(systemdUnitPath2()))
+    return null;
+  try {
+    const raw = execFileSync5("systemctl", ["show", systemdUnitName2(), "-p", "ActiveEnterTimestampMonotonic", "--value"], { stdio: ["ignore", "pipe", "ignore"], timeout: SERVICE_CMD_TIMEOUT_MS2 }).toString().trim();
+    return startedAtFromMonotonic(Number(raw), Math.floor(Number(process.hrtime.bigint()) / 1000), Date.now());
+  } catch {
+    return null;
+  }
+}
+function startedAtFromMonotonic(activeEnterMonotonicUs, monotonicNowUs, nowMs) {
+  if (!Number.isFinite(activeEnterMonotonicUs) || activeEnterMonotonicUs <= 0)
+    return null;
+  if (!Number.isFinite(monotonicNowUs) || monotonicNowUs <= 0)
+    return null;
+  const activeForMs = (monotonicNowUs - activeEnterMonotonicUs) / 1000;
+  if (activeForMs < 0)
+    return null;
+  return Math.round(nowMs - activeForMs);
+}
 var SERVICE_CMD_TIMEOUT_MS2 = 1e4, SERVICE_START_TIMEOUT_MS2 = 5000, SERVICE_START_POLL_MS2 = 100, SERVICE_SETTLE_MS2 = 750, SUDO_PROMPT_TIMEOUT_MS2 = 120000, UNIT_UNSAFE_RE2, DAEMON_PROBE_TIMEOUT_MS2 = 5000, DAEMON_PROBE_READY_TIMEOUT_MS2 = 1e4, DAEMON_PROBE_RETRY_MS2 = 150;
 var init_daemon_service2 = __esm(() => {
   init_hook_logger();
@@ -28949,7 +30289,7 @@ __export(exports_uninstall_cli, {
   serviceStateLabel: () => serviceStateLabel,
   runUninstallCommand: () => runUninstallCommand
 });
-import { existsSync as existsSync39, rmSync as rmSync14 } from "node:fs";
+import { existsSync as existsSync42, rmSync as rmSync16 } from "node:fs";
 function survey(cwd) {
   const clis = [];
   for (const id of listInstallableIds()) {
@@ -28970,9 +30310,9 @@ function survey(cwd) {
   return {
     clis,
     servicePath,
-    serviceInstalled: !!servicePath && existsSync39(servicePath),
+    serviceInstalled: !!servicePath && existsSync42(servicePath),
     daemonConfigured,
-    homeExists: existsSync39(failproofaiHome())
+    homeExists: existsSync42(failproofaiHome())
   };
 }
 async function runUninstallCommand(opts = {}) {
@@ -29070,7 +30410,7 @@ async function runUninstallCommand(opts = {}) {
       } catch {}
       try {
         await uninstallDaemonService();
-        if (found.servicePath && existsSync39(found.servicePath)) {
+        if (found.servicePath && existsSync42(found.servicePath)) {
           failures.push(`the service at ${found.servicePath} is still there (most often: no sudo). ` + `Remove it with the commands below.`);
         } else {
           lines.push(`✓ stopped and removed the daemon service`);
@@ -29082,7 +30422,7 @@ async function runUninstallCommand(opts = {}) {
   }
   if (opts.purge && found.homeExists) {
     try {
-      rmSync14(failproofaiHome(), { recursive: true, force: true });
+      rmSync16(failproofaiHome(), { recursive: true, force: true });
       purged = true;
       lines.push(`✓ deleted ${failproofaiHome()}`);
     } catch (err) {
@@ -29093,7 +30433,7 @@ async function runUninstallCommand(opts = {}) {
     lines.push(``, `Not everything could be removed:`);
     for (const f of failures)
       lines.push(`  ✗ ${f}`);
-    if (found.servicePath && existsSync39(found.servicePath)) {
+    if (found.servicePath && existsSync42(found.servicePath)) {
       lines.push(``, `To remove the service by hand:`, ...manualServiceRemoval(found.servicePath), ``, `(\`${daemonStatusCommand()}\` shows its current state.)`);
     }
     return { exitCode: 1, lines, planLines, purged };
@@ -29136,6 +30476,8 @@ var exports_tui = {};
 __export(exports_tui, {
   truncate: () => truncate2,
   summarize: () => summarize2,
+  stepOpen: () => stepOpen2,
+  step: () => step2,
   selectOne: () => selectOne2,
   renderLaunchBanner: () => renderLaunchBanner2,
   renderBrandLogo: () => renderBrandLogo2,
@@ -29172,11 +30514,11 @@ function truecolorEnabled2() {
 }
 function paint2(on) {
   const tc = on && truecolorEnabled2();
-  const mk = (h, bold = false) => (s) => {
+  const mk = (h, bold2 = false) => (s) => {
     if (!on)
       return s;
     const code = tc ? `38;2;${h.rgb[0]};${h.rgb[1]};${h.rgb[2]}` : h.basic;
-    return `${ESC2}[${bold ? "1;" : ""}${code}m${s}${ESC2}[0m`;
+    return `${ESC2}[${bold2 ? "1;" : ""}${code}m${s}${ESC2}[0m`;
   };
   return {
     bold: (s) => on ? `${ESC2}[1m${s}${ESC2}[0m` : s,
@@ -29282,19 +30624,40 @@ function intro2(message, stdout = process.stdout) {
 }
 function renderLaunchBanner2(version3, stdout = process.stdout) {
   const c2 = paint2(colorsEnabled2(stdout));
-  const row = (label, value) => `  ${c2.guide(label.padEnd(9))}${value}`;
+  const row2 = (label, value) => `  ${c2.guide(label.padEnd(9))}${value}`;
   const header = stdout.isTTY ? renderBrandLogo2(stdout) : ["  failproof ai", `  ${TAGLINE2}`];
   return [
     "",
     ...header,
     "",
-    row("version", c2.pink(version3)),
-    row("star", c2.dim("https://github.com/failproofai/failproofai")),
-    row("docs", c2.dim("https://docs.befailproof.ai/introduction")),
-    row("discord", c2.dim("https://discord.befailproof.ai/")),
+    row2("version", c2.pink(version3)),
+    row2("star", c2.dim("https://github.com/failproofai/failproofai")),
+    row2("docs", c2.dim("https://docs.befailproof.ai/introduction")),
+    row2("discord", c2.dim("https://discord.befailproof.ai/")),
     ""
   ];
 }
+function step2(message, summary, stdout = process.stdout) {
+  const c2 = paint2(colorsEnabled2(stdout));
+  const rows = summary === undefined ? [] : Array.isArray(summary) ? summary : [summary];
+  if (!stdout.isTTY) {
+    if (rows.length)
+      stdout.write(`${message}: ${rows.join(" ")}
+`);
+    return;
+  }
+  const cols = stdout.columns || 80;
+  const lines = [c2.dim(BAR2), truncate2(`${c2.dim(STEP_DONE2)}  ${message}`, cols - 1)];
+  for (const r of rows)
+    lines.push(truncate2(`${c2.dim(BAR2)}  ${c2.dim(r)}`, cols - 1));
+  writeLines2(stdout, lines);
+}
+function stepOpen2(message, stdout = process.stdout) {
+  const c2 = paint2(colorsEnabled2(stdout));
+  if (!stdout.isTTY)
+    return;
+  writeLines2(stdout, [c2.dim(BAR2), `${c2.guide(STEP_ACTIVE2)}  ${c2.bold(message)}`]);
+}
 function outro2(message, opts = {}, stdout = process.stdout) {
   const c2 = paint2(colorsEnabled2(stdout));
   const ok2 = opts.ok !== false;
@@ -29364,11 +30727,11 @@ function runPrompt2(p) {
       lines.push(`${c2.dim(BAR2)}    ${c2.dim(`↑ ${above} more`)}`);
     const budget = Math.max(6, cols - nameCol - 10);
     for (let ri = start;ri < end; ri++) {
-      const row = rows[ri];
-      if (row.kind === "header") {
-        lines.push(`${c2.dim(BAR2)}  ${c2.dim(row.text)}`);
+      const row2 = rows[ri];
+      if (row2.kind === "header") {
+        lines.push(`${c2.dim(BAR2)}  ${c2.dim(row2.text)}`);
       } else {
-        lines.push(`${c2.dim(BAR2)}  ${p.renderRow(row.index, row.index === cursor2, budget)}`);
+        lines.push(`${c2.dim(BAR2)}  ${p.renderRow(row2.index, row2.index === cursor2, budget)}`);
       }
     }
     if (below > 0)
@@ -29387,7 +30750,7 @@ function runPrompt2(p) {
       `${c2.dim(BAR2)}  ${c2.dim(summary)}`
     ]);
   };
-  return new Promise((resolve30) => {
+  return new Promise((resolve31) => {
     hideCursor2(stdout);
     repaint2(stdout, region, build());
     readline3.emitKeypressEvents(stdin);
@@ -29403,7 +30766,7 @@ function runPrompt2(p) {
     const finish = (result) => {
       cleanup();
       collapse(result);
-      resolve30(result);
+      resolve31(result);
     };
     function onKey(_s, key) {
       if (!key)
@@ -29533,7 +30896,7 @@ function promptText2(opts) {
     return error ? { ok: false, error } : { ok: true, value };
   };
   if (!stdin.isTTY) {
-    return new Promise((resolve30) => {
+    return new Promise((resolve31) => {
       let buf = "";
       const onData = (chunk) => {
         buf += String(chunk);
@@ -29546,21 +30909,21 @@ function promptText2(opts) {
         stdin.removeListener("end", done);
         const r = accept(buf.split(`
 `)[0] ?? "");
-        resolve30(r.ok ? r.value : null);
+        resolve31(r.ok ? r.value : null);
       };
       stdin.on("data", onData);
       stdin.on("end", done);
     });
   }
-  return new Promise((resolve30) => {
+  return new Promise((resolve31) => {
     let value = "";
     const draw = (error) => {
       const cols = stdout.columns || 80;
       const shown = opts.mask ? "•".repeat(value.length) : value;
-      const hint = opts.hint ? `  ${c2.dim(opts.hint)}` : "";
-      const line = truncate2(`${c2.bold(opts.message)} ${shown}${hint}`, cols - 1);
+      const hint = opts.hint && value.length === 0 ? `  ${c2.dim(opts.hint)}` : "";
+      const line = truncate2(`${opts.prefix ?? ""}${c2.bold(opts.message)} ${shown}${hint}`, cols - 1);
       const err = error ? `
-  ${truncate2(c2.warn(error), cols - 3)}` : "";
+${opts.prefix ?? "  "}${truncate2(c2.warn(error), cols - 3)}` : "";
       stdout.write(`\r\x1B[2K${line}${err}`);
       if (err)
         stdout.write("\x1B[1A");
@@ -29582,14 +30945,14 @@ function promptText2(opts) {
         return;
       if (key.ctrl && (key.name === "c" || key.name === "d") || key.name === "escape") {
         cleanup();
-        resolve30(null);
+        resolve31(null);
         return;
       }
       if (key.name === "return" || key.name === "enter") {
         const r = accept(value);
         if (r.ok) {
           cleanup();
-          resolve30(r.value);
+          resolve31(r.value);
         } else {
           draw(r.error);
         }
@@ -29657,9 +31020,9 @@ __export(exports_manager, {
   getSettingsPath: () => getSettingsPath2
 });
 import { execSync as execSync7 } from "node:child_process";
-import { existsSync as existsSync40 } from "node:fs";
-import { resolve as resolve30, basename as basename8 } from "node:path";
-import { platform as platform5, arch as arch4, release as release3, hostname as hostname5 } from "node:os";
+import { existsSync as existsSync43 } from "node:fs";
+import { resolve as resolve31, basename as basename8 } from "node:path";
+import { platform as platform5, arch as arch4, release as release3, hostname as hostname6 } from "node:os";
 function getSettingsPath2(scope, cwd) {
   return claudeCode.getSettingsPath(scope, cwd);
 }
@@ -29766,9 +31129,9 @@ async function installHooksImpl2(policyNames, scope = "user", cwd, includeBeta =
     delete configToWrite.customPoliciesPath;
     delete configToWrite.customPoliciesPaths;
   } else if (customPoliciesPath && (typeof customPoliciesPath === "string" || customPoliciesPath.length > 0)) {
-    const incoming = (typeof customPoliciesPath === "string" ? [customPoliciesPath] : customPoliciesPath).map((path3) => resolve30(path3));
-    const carried = (previousConfig.customPoliciesPaths ?? (previousConfig.customPoliciesPath ? [previousConfig.customPoliciesPath] : [])).map((path3) => resolve30(path3)).filter((path3) => {
-      if (existsSync40(path3))
+    const incoming = (typeof customPoliciesPath === "string" ? [customPoliciesPath] : customPoliciesPath).map((path3) => resolve31(path3));
+    const carried = (previousConfig.customPoliciesPaths ?? (previousConfig.customPoliciesPath ? [previousConfig.customPoliciesPath] : [])).map((path3) => resolve31(path3)).filter((path3) => {
+      if (existsSync43(path3))
         return true;
       console.log(`Dropping custom policies path (file no longer exists): ${path3}`);
       return false;
@@ -29854,7 +31217,7 @@ Enabled ${selectedPolicies.length} policy(ies): ${selectedPolicies.join(", ")}
       platform: platform5(),
       arch: arch4(),
       os_release: release3(),
-      hostname_hash: hashToId2(hostname5()),
+      hostname_hash: hashToId2(hostname6()),
       has_custom_hooks_path: !!(configToWrite.customPoliciesPaths?.length || configToWrite.customPoliciesPath),
       has_policy_params: !!(configToWrite.policyParams && Object.keys(configToWrite.policyParams).length > 0),
       param_policy_names: configToWrite.policyParams ? Object.keys(configToWrite.policyParams) : [],
@@ -29945,7 +31308,7 @@ async function removeHooks2(policyNames, scope = "user", cwd, opts) {
         platform: platform5(),
         arch: arch4(),
         os_release: release3(),
-        hostname_hash: hashToId2(hostname5())
+        hostname_hash: hashToId2(hostname6())
       });
     } catch {}
     console.log(`Disabled ${policyNames.length - notEnabled.length} policy(ies).`);
@@ -29960,7 +31323,7 @@ async function removeHooks2(policyNames, scope = "user", cwd, opts) {
     const scopesToRemove = scope === "all" ? [...integration.scopes] : integration.scopes.includes(scope) ? [scope] : [];
     for (const s of scopesToRemove) {
       const settingsPaths = settingsPathsFor(integration, s, cwd);
-      const existing = settingsPaths.filter((p) => existsSync40(p));
+      const existing = settingsPaths.filter((p) => existsSync43(p));
       if (existing.length === 0) {
         if (scope !== "all" && selectedClis.length === 1) {
           console.log("No settings file found. Nothing to remove.");
@@ -30010,7 +31373,7 @@ async function removeHooks2(policyNames, scope = "user", cwd, opts) {
       platform: platform5(),
       arch: arch4(),
       os_release: release3(),
-      hostname_hash: hashToId2(hostname5())
+      hostname_hash: hashToId2(hostname6())
     });
   } catch {}
   if (scope === "all") {
@@ -30109,16 +31472,16 @@ Failproof AI Hook Policies
     console.log(`  ${"─".repeat(scopeHeaderWidth)}${"─".repeat(nameColWidth)}${"─".repeat(38)}`);
     const printMultiScopeRow = (policy) => {
       const enabled = enabledSet.has(policy.name);
-      let row = "  ";
+      let row2 = "  ";
       for (const _scope of installedScopes) {
         if (enabled) {
-          row += `\x1B[32m✓ ON\x1B[0m` + " ".repeat(COL - 4);
+          row2 += `\x1B[32m✓ ON\x1B[0m` + " ".repeat(COL - 4);
         } else {
-          row += "  OFF" + " ".repeat(COL - 5);
+          row2 += "  OFF" + " ".repeat(COL - 5);
         }
       }
-      row += policy.name.padEnd(nameColWidth) + policy.description;
-      console.log(row);
+      row2 += policy.name.padEnd(nameColWidth) + policy.description;
+      console.log(row2);
       printParamsSummary(policy.name, `  ${" ".repeat(scopeHeaderWidth)}`);
     };
     for (const policy of regularPolicies)
@@ -30159,9 +31522,9 @@ Failproof AI Hook Policies
     console.log(`
   ── Custom Policies ───────────────────────`);
     for (const path3 of explicitPaths) {
-      const absPath = resolve30(findProjectConfigDir(cwd ?? process.cwd()), path3);
+      const absPath = resolve31(findProjectConfigDir(cwd ?? process.cwd()), path3);
       console.log(`  ${absPath}`);
-      if (!existsSync40(absPath)) {
+      if (!existsSync43(absPath)) {
         console.log(`  \x1B[31m✗ File not found: ${absPath}\x1B[0m`);
         continue;
       }
@@ -30180,7 +31543,7 @@ Failproof AI Hook Policies
     console.log();
   }
   const base = findProjectConfigDir(cwd ?? process.cwd());
-  const projectDir = resolve30(base, ".failproofai", "policies");
+  const projectDir = resolve31(base, ".failproofai", "policies");
   const userDir = customPoliciesDir();
   const sameDir = userDir === projectDir;
   const conventionDirs = [
@@ -30393,32 +31756,32 @@ async function promptCliTargetSelection(detected, action = "install") {
       cursorHidden = false;
     }
   }
-  const { dim, bold, guide: teal, pink, pinkBold } = paint(!process.env.NO_COLOR);
+  const { dim: dim2, bold: bold2, guide: teal, pink: pink2, pinkBold } = paint(!process.env.NO_COLOR);
   const heading = action === "uninstall" ? "Remove failproofai hooks" : "Install failproofai hooks";
   function render() {
     const cols = process.stdout.columns || 100;
     hideCursor3();
-    const g = dim(BAR);
-    const lines = [g, `${teal(STEP_ACTIVE)}  ${bold(heading)}`];
-    for (const row of buildDisplayRows()) {
-      if (row.kind === "blank") {
+    const g = dim2(BAR);
+    const lines = [g, `${teal(STEP_ACTIVE)}  ${bold2(heading)}`];
+    for (const row2 of buildDisplayRows()) {
+      if (row2.kind === "blank") {
         lines.push(g);
         continue;
       }
-      if (row.kind === "header") {
-        const hint = row.hint ? `  ${dim("· " + row.hint)}` : "";
-        lines.push(`${g}  ${dim(row.title)}${hint}`);
+      if (row2.kind === "header") {
+        const hint = row2.hint ? `  ${dim2("· " + row2.hint)}` : "";
+        lines.push(`${g}  ${dim2(row2.title)}${hint}`);
         continue;
       }
-      const opt = row.option;
-      const isActive = row.itemIndex === cursor2;
-      const caret = isActive ? pink("❯") : " ";
-      const marker = opt.isAll ? teal("★") : opt.detected ? pink("●") : dim("○");
-      const label = isActive ? pinkBold(opt.label) : opt.detected ? opt.label : dim(opt.label);
+      const opt = row2.option;
+      const isActive = row2.itemIndex === cursor2;
+      const caret = isActive ? pink2("❯") : " ";
+      const marker = opt.isAll ? teal("★") : opt.detected ? pink2("●") : dim2("○");
+      const label = isActive ? pinkBold(opt.label) : opt.detected ? opt.label : dim2(opt.label);
       lines.push(`${g}  ${caret} ${marker}  ${label}`);
     }
     lines.push(g);
-    lines.push(`${g}  ${dim("↑/↓ move · ↵ select · esc cancel")}`);
+    lines.push(`${g}  ${dim2("↑/↓ move · ↵ select · esc cancel")}`);
     if (lastLineCount > 0) {
       process.stdout.write(`\x1B[${lastLineCount}A\x1B[J`);
     }
@@ -30428,7 +31791,7 @@ async function promptCliTargetSelection(detected, action = "install") {
     lastLineCount = lines.length;
   }
   const itemCount = options.length;
-  return new Promise((resolve31) => {
+  return new Promise((resolve32) => {
     render();
     readline4.emitKeypressEvents(process.stdin);
     const wasRaw = process.stdin.isRaw;
@@ -30461,7 +31824,7 @@ async function promptCliTargetSelection(detected, action = "install") {
         cleanup();
         process.stdout.write(`
 `);
-        resolve31(options[cursor2].value);
+        resolve32(options[cursor2].value);
       }
     }
     process.stdin.on("keypress", onKey);
@@ -30487,7 +31850,7 @@ async function promptPolicySelection2(preSelected, options = {}) {
   const WINDOW_SIZE = 10;
   const useColor = !process.env.NO_COLOR;
   const c2 = paint(useColor);
-  const { dim, bold } = c2;
+  const { dim: dim2, bold: bold2 } = c2;
   const stepMark = c2.guide;
   const activeName = c2.pinkBold;
   const selectedMark = c2.pink;
@@ -30556,24 +31919,24 @@ async function promptPolicySelection2(preSelected, options = {}) {
     if (shown > 0 && cursor2 >= shown)
       cursor2 = shown - 1;
     const selectedCount = items.filter((i) => i.selected).length;
-    const g = dim(BAR);
+    const g = dim2(BAR);
     const lines = [];
     lines.push(g);
-    lines.push(`${stepMark(STEP_ACTIVE)}  ${bold("Choose the policies to enable")}   ${dim("·")}   ` + `${stepMark(String(selectedCount))} ${dim("selected")}`);
+    lines.push(`${stepMark(STEP_ACTIVE)}  ${bold2("Choose the policies to enable")}   ${dim2("·")}   ` + `${stepMark(String(selectedCount))} ${dim2("selected")}`);
     const blockCursor = useColor ? "\x1B[7m \x1B[0m" : "_";
-    const countLabel = search ? dim(`${shown}/${total} shown`) : dim(`${total} policies`);
-    lines.push(`${g}  ${dim("filter ›")} ${search}${blockCursor}   ${countLabel}`);
+    const countLabel = search ? dim2(`${shown}/${total} shown`) : dim2(`${total} policies`);
+    lines.push(`${g}  ${dim2("filter ›")} ${search}${blockCursor}   ${countLabel}`);
     lines.push(g);
     if (shown === 0) {
-      lines.push(`${g}  ${dim(`no policies match “${search}”`)}`);
+      lines.push(`${g}  ${dim2(`no policies match “${search}”`)}`);
       for (let i = 0;i < WINDOW_SIZE + 1; i++)
         lines.push(g);
     } else {
       const displayRows3 = buildDisplayRows(filtered);
       let cursorDisplayRow = 0;
       for (let i = 0;i < displayRows3.length; i++) {
-        const row = displayRows3[i];
-        if (row.kind === "item" && row.filteredIndex === cursor2) {
+        const row2 = displayRows3[i];
+        if (row2.kind === "item" && row2.filteredIndex === cursor2) {
           cursorDisplayRow = i;
           break;
         }
@@ -30583,30 +31946,30 @@ async function promptPolicySelection2(preSelected, options = {}) {
       windowStart = Math.min(windowStart, Math.max(0, displayRows3.length - WINDOW_SIZE));
       const windowEnd = Math.min(displayRows3.length, windowStart + WINDOW_SIZE);
       const aboveItems = displayRows3.slice(0, windowStart).filter((r) => r.kind === "item").length;
-      lines.push(aboveItems > 0 ? `${g}  ${dim(`↑ ${aboveItems} more`)}` : g);
+      lines.push(aboveItems > 0 ? `${g}  ${dim2(`↑ ${aboveItems} more`)}` : g);
       for (let i = windowStart;i < windowEnd; i++) {
-        const row = displayRows3[i];
-        if (row.kind === "header") {
-          lines.push(`${g}  ${dim(row.category.toUpperCase())}  ${dim(`${row.enabledCount}/${row.totalCount}`)}`);
+        const row2 = displayRows3[i];
+        if (row2.kind === "header") {
+          lines.push(`${g}  ${dim2(row2.category.toUpperCase())}  ${dim2(`${row2.enabledCount}/${row2.totalCount}`)}`);
         } else {
-          const item = row.item;
-          const active = row.filteredIndex === cursor2;
-          const box = item.selected ? selectedMark(CHECK_ON) : dim(CHECK_OFF);
+          const item = row2.item;
+          const active = row2.filteredIndex === cursor2;
+          const box = item.selected ? selectedMark(CHECK_ON) : dim2(CHECK_OFF);
           const rawName = item.name.padEnd(NAME_COL);
-          const name = active ? activeName(rawName) : item.selected ? rawName : dim(rawName);
+          const name = active ? activeName(rawName) : item.selected ? rawName : dim2(rawName);
           const beta = item.beta ? ` ${betaTag("beta")}` : "";
           const descWidth = Math.max(8, cols - NAME_COL - 8 - (item.beta ? 5 : 0));
-          const desc = dim(truncate(item.description, descWidth));
+          const desc = dim2(truncate(item.description, descWidth));
           lines.push(`${g}  ${box} ${name}${beta}  ${desc}`);
         }
       }
       for (let i = windowEnd - windowStart;i < WINDOW_SIZE; i++)
         lines.push(g);
       const belowItems = displayRows3.slice(windowEnd).filter((r) => r.kind === "item").length;
-      lines.push(belowItems > 0 ? `${g}  ${dim(`↓ ${belowItems} more`)}` : g);
+      lines.push(belowItems > 0 ? `${g}  ${dim2(`↓ ${belowItems} more`)}` : g);
     }
     lines.push(g);
-    lines.push(`${g}  ${dim("↑/↓ move · space select · ctrl+a all · ↵ save · type to filter · esc clear")}`);
+    lines.push(`${g}  ${dim2("↑/↓ move · space select · ctrl+a all · ↵ save · type to filter · esc clear")}`);
     if (lastLineCount > 0)
       process.stdout.write(`\x1B[${lastLineCount}A\x1B[J`);
     process.stdout.write(lines.map((l) => truncate(l, cols)).join(`
@@ -30614,7 +31977,7 @@ async function promptPolicySelection2(preSelected, options = {}) {
 `);
     lastLineCount = lines.length;
   }
-  return new Promise((resolve31) => {
+  return new Promise((resolve32) => {
     render();
     process.stdin.setRawMode(true);
     process.stdin.resume();
@@ -30647,11 +32010,11 @@ async function promptPolicySelection2(preSelected, options = {}) {
         const selected = items.filter((i) => i.selected).map((i) => i.name);
         if (lastLineCount > 0)
           process.stdout.write(`\x1B[${lastLineCount}A\x1B[J`);
-        process.stdout.write(`${dim(BAR)}
-${dim(STEP_DONE)}  Policies
-${dim(BAR)}  ${dim(`${selected.length} selected`)}
+        process.stdout.write(`${dim2(BAR)}
+${dim2(STEP_DONE)}  Policies
+${dim2(BAR)}  ${dim2(`${selected.length} selected`)}
 `);
-        resolve31(selected);
+        resolve32(selected);
       } else if (key.name === "escape") {
         search = "";
         cursor2 = 0;
@@ -30696,10 +32059,43 @@ __export(exports_cli2, {
   runScheduledAudit: () => runScheduledAudit2,
   runPostSetupAudit: () => runPostSetupAudit2,
   runAuditCli: () => runAuditCli2,
+  helpText: () => helpText2,
   buildSummary: () => buildSummary2,
   EXIT_AUDIT_ALREADY_RUNNING: () => EXIT_AUDIT_ALREADY_RUNNING2,
   AUDIT_STAGES: () => AUDIT_STAGES2
 });
+function helpText2() {
+  const row2 = (command, lines) => {
+    const pad = " ".repeat(Math.max(1, HELP_DESC_COL2 - 2 - command.length));
+    return lines.map((line, i) => i === 0 ? `  ${c2(CYAN2, command)}${pad}${line}` : `${" ".repeat(HELP_DESC_COL2)}${line}`).join(`
+`);
+  };
+  return [
+    `${c2(BOLD2, "failproofai audit")} — review your agent CLIs for risky and wasteful patterns.`,
+    c2(DIM2, "Everything runs on this machine; only a scheduled digest ever leaves it."),
+    "",
+    c2(BOLD2, "USAGE"),
+    row2("failproofai audit", [
+      "Scan your session history, then open",
+      `http://localhost:${DASHBOARD_PORT2}/audit`
+    ]),
+    row2("failproofai audit --schedule [days]", [
+      "Scan on a timer and email the findings.",
+      "Default 7 days, range 1-90.",
+      "Signs you in the first time; add",
+      "--email <address> to skip a prompt."
+    ]),
+    row2("failproofai audit --no-schedule", ["Stop the timer. Leaves you signed in."]),
+    row2("failproofai audit --status", [
+      "Whether scheduling is on, where reports",
+      "go, the daemon's state, and when the",
+      "next scan is due."
+    ]),
+    row2("failproofai audit -h, --help", ["Show this help."]),
+    ""
+  ].join(`
+`);
+}
 function colorOn2() {
   if (process.env.NO_COLOR && process.env.NO_COLOR !== "")
     return false;
@@ -30874,6 +32270,13 @@ async function runScheduledAudit2() {
     }
     process.stdout.write(`failproofai: audit complete — ${num2(result.eventsScanned)} tool calls across ` + `${num2(result.transcripts.scanned)} sessions, ${num2(result.totals.hits)} hits
 `);
+    const outcome = await reportHarm(result);
+    const line = describeOutcome2(outcome);
+    if (line) {
+      const stream = outcome.kind === "sent" ? process.stdout : process.stderr;
+      stream.write(`${line}
+`);
+    }
     return 0;
   } finally {
     attempt.lock.release();
@@ -30929,7 +32332,7 @@ async function runPostSetupAudit2() {
 }
 async function runAuditCli2(args) {
   if (args.includes("--help") || args.includes("-h")) {
-    process.stdout.write(HELP2);
+    process.stdout.write(helpText2());
     process.exit(0);
   }
   if (args.includes("--scheduled")) {
@@ -30938,15 +32341,71 @@ async function runAuditCli2(args) {
       die2(`\`audit --scheduled\` takes no other arguments (got: ${extra}).`);
     process.exit(await runScheduledAudit2());
   }
+  if (args.includes("--status")) {
+    const extra = args.find((a) => a !== "--status");
+    if (extra)
+      die2(`\`audit --status\` takes no other arguments (got: ${extra}).`);
+    const { runScheduleStatus: runScheduleStatus2 } = await Promise.resolve().then(() => (init_schedule_cli(), exports_schedule_cli));
+    runScheduleStatus2();
+    process.exit(0);
+  }
+  if (args.includes("--no-schedule")) {
+    const extra = args.find((a) => a !== "--no-schedule");
+    if (extra)
+      die2(`\`audit --no-schedule\` takes no other arguments (got: ${extra}).`);
+    const { runScheduleOff: runScheduleOff2 } = await Promise.resolve().then(() => (init_schedule_cli(), exports_schedule_cli));
+    runScheduleOff2();
+    process.exit(0);
+  }
+  const scheduleAt = args.indexOf("--schedule");
+  if (scheduleAt !== -1) {
+    let days;
+    let email;
+    for (let i = 0;i < args.length; i += 1) {
+      const a = args[i];
+      if (a === "--schedule") {
+        const next = args[i + 1];
+        if (next !== undefined && !next.startsWith("-")) {
+          days = next;
+          i += 1;
+        }
+        continue;
+      }
+      if (a === "--email" || a.startsWith("--email=")) {
+        if (a.startsWith("--email=")) {
+          email = a.slice("--email=".length);
+        } else {
+          email = args[i + 1];
+          i += 1;
+        }
+        if (email === undefined || email.length === 0 || email.startsWith("-")) {
+          die2("`--email` needs an address, e.g. `--email you@yourdomain.com`.");
+        }
+        continue;
+      }
+      die2(`\`audit --schedule\` does not take ${a}.`);
+    }
+    const { runScheduleOn: runScheduleOn2, ScheduleCliError: ScheduleCliError2 } = await Promise.resolve().then(() => (init_schedule_cli(), exports_schedule_cli));
+    const { LoginError: LoginError2 } = await Promise.resolve().then(() => (init_cli_login(), exports_cli_login));
+    try {
+      await runScheduleOn2(days, email);
+    } catch (err) {
+      if (err instanceof ScheduleCliError2 || err instanceof LoginError2)
+        die2(err.message);
+      throw err;
+    }
+    process.exit(0);
+  }
   const stray = args.find((a) => a !== "--help" && a !== "-h");
   if (stray) {
-    die2(`\`audit\` takes no arguments yet (got: ${stray}).
-` + `Run \`failproofai audit\` to scan your history and open the dashboard.`);
+    die2(`\`audit\` does not take ${stray}.
+Run \`failproofai audit\` to scan your history and open the dashboard,
+or \`failproofai audit --help\` for the scheduling commands.`);
   }
   const attempt = acquireAuditLock("cli");
   if (!attempt.ok) {
     process.stderr.write(`Error: ${heldByLine2(attempt.heldBy)}.
-` + `Two audits write the same cache files, so this one won't start. Try again shortly.
+Two audits write the same cache files, so this one won't start. Try again shortly.
 `);
     process.exit(EXIT_AUDIT_ALREADY_RUNNING2);
   }
@@ -30970,7 +32429,7 @@ async function runAuditCli2(args) {
   if (result.eventsScanned === 0) {
     process.stdout.write(`
   ${c2(DIM2, "no agent sessions found yet.")}
-` + `  install hooks with ${c2(CYAN2, "failproofai policies --install")} ` + `${c2(DIM2, "and come back after using your agent.")}
+  install hooks with ${c2(CYAN2, "failproofai policies --install")} ${c2(DIM2, "and come back after using your agent.")}
 
 `);
     process.exit(0);
@@ -30985,15 +32444,15 @@ async function runAuditCli2(args) {
   const url = `http://localhost:${DASHBOARD_PORT2}/audit`;
   process.stdout.write(`
   ${c2(DIM2, "starting the dashboard…")}
-` + `  ${c2(PINK2, "✦")} ${c2(BOLD2, "here's your audit")}  ${c2(DIM2, "→")}  ${c2(CYAN2, url)}
-` + `  ${c2(DIM2, "(opening in your browser — press Ctrl+C to stop the server)")}
+  ${c2(PINK2, "✦")} ${c2(BOLD2, "here's your audit")}  ${c2(DIM2, "→")}  ${c2(CYAN2, url)}
+  ${c2(DIM2, "(opening in your browser — press Ctrl+C to stop the server)")}
 
 `);
   openWhenReady(DASHBOARD_PORT2, "/audit");
   const { launch: launch2 } = await Promise.resolve().then(() => (init_launch(), exports_launch));
   launch2("start");
 }
-var DASHBOARD_PORT2 = 8020, EXIT_AUDIT_ALREADY_RUNNING2 = 75, AUDIT_STAGES2, HELP2, RESET2, DIM2, BOLD2, PINK2, GREEN2, CYAN2, SPINNER2;
+var DASHBOARD_PORT2 = 8020, EXIT_AUDIT_ALREADY_RUNNING2 = 75, AUDIT_STAGES2, HELP_DESC_COL2 = 40, RESET2, DIM2, BOLD2, PINK2, GREEN2, CYAN2, SPINNER2;
 var init_cli2 = __esm(() => {
   init_audit();
   init_audit_lock();
@@ -31002,6 +32461,7 @@ var init_cli2 = __esm(() => {
   init_telemetry_id2();
   init_telemetry_sanitize();
   init_open_browser();
+  init_report_harm();
   init_tui();
   AUDIT_STAGES2 = [
     { label: "discovering transcripts", detail: "walking ~/.claude, ~/.codex, ~/.cursor, …" },
@@ -31009,29 +32469,6 @@ var init_cli2 = __esm(() => {
     { label: "running policy checks", detail: "replaying through 30 builtin policies" },
     { label: "aggregating results", detail: "counting hits, ranking by frequency" }
   ];
-  HELP2 = `
-failproofai audit — audit your AI agent's behavior, then open the dashboard
-
-USAGE
-  failproofai audit          Scan your agent-CLI session history for risky and
-                             wasteful patterns, then open the audit dashboard.
-  failproofai audit --help   Show this help.
-
-  failproofai audit --scheduled
-                             Headless run: scan, refresh the dashboard's cached
-                             result, print one line, exit. No browser, no
-                             server. This is what a scheduled audit runs; exit
-                             75 means another audit already had the lock.
-
-WHAT IT DOES
-  1. Scans past sessions from every installed agent CLI (Claude, Codex, Cursor,
-     Copilot, OpenCode, Pi) — entirely on your machine.
-  2. Starts the local dashboard and opens
-     http://localhost:${DASHBOARD_PORT2}/audit with your results.
-
-  Runs fully offline — no account or network required. Press Ctrl+C to stop the
-  dashboard server when you're done.
-`.trimStart();
   RESET2 = ANSI_RESET;
   DIM2 = ANSI_DIM;
   BOLD2 = ANSI_BOLD;
@@ -31051,10 +32488,10 @@ __export(exports_cloud_enrollment_cli, {
   describeMachine: () => describeMachine,
   connectionStatusLines: () => connectionStatusLines
 });
-function describeMachine(machineId, machineLabel, full = false) {
-  if (!machineLabel || machineLabel === machineId)
+function describeMachine(machineId, machineLabel2, full = false) {
+  if (!machineLabel2 || machineLabel2 === machineId)
     return machineId;
-  return full ? `${machineLabel} (${machineId})` : `${machineLabel} (${machineId.slice(0, 8)})`;
+  return full ? `${machineLabel2} (${machineId})` : `${machineLabel2} (${machineId.slice(0, 8)})`;
 }
 function daemonWarning(status) {
   if (status === "running")
@@ -31113,13 +32550,13 @@ async function runConnectCommand(opts) {
   if (!validated.ok)
     return { exitCode: 1, lines: [validated.reason] };
   const machineId = resolveMachineId(opts.machineId);
-  const machineLabel = resolveMachineLabel(opts.machineLabel ?? opts.defaultMachineId);
-  const shownAs = describeMachine(machineId, machineLabel);
+  const machineLabel2 = resolveMachineLabel(opts.machineLabel ?? opts.defaultMachineId);
+  const shownAs = describeMachine(machineId, machineLabel2);
   const outcome = await connectToCloud({
     url: validated.url,
     token: opts.token,
     machineId,
-    machineLabel,
+    machineLabel: machineLabel2,
     sessions: opts.sessions,
     environment: opts.environment,
     verifyPolicy: opts.verify,
@@ -31365,8 +32802,8 @@ __export(exports_launch2, {
   launch: () => launch2
 });
 import { spawn as spawn3 } from "child_process";
-import { realpathSync as realpathSync5, existsSync as existsSync41 } from "node:fs";
-import { resolve as resolve31, dirname as dirname23 } from "node:path";
+import { realpathSync as realpathSync5, existsSync as existsSync44 } from "node:fs";
+import { resolve as resolve32, dirname as dirname23 } from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 import { createInterface as createInterface2 } from "node:readline";
 function launch2(mode) {
@@ -31390,9 +32827,9 @@ function launch2(mode) {
     process.env.PORT = port;
     process.env.HOSTNAME = bindHost;
     cmd = "node";
-    const packageRoot = process.env.FAILPROOFAI_PACKAGE_ROOT ?? resolve31(dirname23(realpathSync5(fileURLToPath3(import.meta.url))), "..");
-    const serverJsPath = resolve31(packageRoot, ".next/standalone/server.js");
-    if (!existsSync41(serverJsPath)) {
+    const packageRoot = process.env.FAILPROOFAI_PACKAGE_ROOT ?? resolve32(dirname23(realpathSync5(fileURLToPath3(import.meta.url))), "..");
+    const serverJsPath = resolve32(packageRoot, ".next/standalone/server.js");
+    if (!existsSync44(serverJsPath)) {
       let shadowMessage = null;
       try {
         const diag = diagnoseShadow({ selfPackageRoot: packageRoot, selfVersion: version2 });
@@ -31489,17 +32926,17 @@ var init_cli_error2 = __esm(() => {
 
 // bin/failproofai.mjs
 import { realpathSync as realpathSync6 } from "fs";
-import { dirname as dirname24, resolve as resolve32 } from "path";
+import { dirname as dirname24, resolve as resolve33 } from "path";
 import { fileURLToPath as fileURLToPath4 } from "url";
 // package.json
-var version = "1.0.0";
+var version = "1.0.1-beta.1";
 
 // bin/failproofai.mjs
 if (!process.env.FAILPROOFAI_PACKAGE_ROOT) {
-  process.env.FAILPROOFAI_PACKAGE_ROOT = resolve32(dirname24(realpathSync6(fileURLToPath4(import.meta.url))), "..");
+  process.env.FAILPROOFAI_PACKAGE_ROOT = resolve33(dirname24(realpathSync6(fileURLToPath4(import.meta.url))), "..");
 }
 if (!process.env.FAILPROOFAI_DIST_PATH) {
-  process.env.FAILPROOFAI_DIST_PATH = resolve32(dirname24(realpathSync6(fileURLToPath4(import.meta.url))), "..", "dist");
+  process.env.FAILPROOFAI_DIST_PATH = resolve33(dirname24(realpathSync6(fileURLToPath4(import.meta.url))), "..", "dist");
 }
 var args = process.argv.slice(2);
 if (args[0] === "p")
@@ -31682,6 +33119,12 @@ COMMANDS
 
   audit                          Audit your agent's behavior, then open the
                                  dashboard at http://localhost:8020/audit
+  audit --schedule [days]        Audit on a timer (default 7 days) and email you
+                                 what it finds. Signs you in the first time;
+                                 --email <address> skips that question
+  audit --no-schedule            Stop auditing on a timer
+  audit --status                 Whether scheduling is on, where reports go, and
+                                 when the next scan is due
   audit --help, -h               Show this help for the audit command
 
   backfill                       Re-send history the collector already read past
@@ -32069,8 +33512,8 @@ Run \`failproofai migrate --help\` for usage.`);
       return;
     }
     const run = runMigrations3(from);
-    for (const step of run.steps) {
-      console.log(`${step.ok ? "migrated" : "FAILED  "} layout ${step.from} \u2192 ${step.to}`);
+    for (const step3 of run.steps) {
+      console.log(`${step3.ok ? "migrated" : "FAILED  "} layout ${step3.from} \u2192 ${step3.to}`);
     }
     if (run.backedUp.length > 0) {
       console.log(`Saved first: ${run.backedUp.join(", ")}`);
@@ -32140,8 +33583,8 @@ Run \`failproofai update --help\` for usage.`);
       const run = runMigrations3(state.found);
       migrationsRan = run.steps.length;
       migrationFailed = Boolean(run.failed);
-      for (const step of run.steps) {
-        console.log(`${step.ok ? "migrated" : "FAILED  "} layout ${step.from} \u2192 ${step.to}`);
+      for (const step3 of run.steps) {
+        console.log(`${step3.ok ? "migrated" : "FAILED  "} layout ${step3.from} \u2192 ${step3.to}`);
       }
       if (run.backedUp.length > 0)
         console.log(`Saved first: ${run.backedUp.join(", ")}`);
@@ -32678,14 +34121,14 @@ PAUSING ENFORCEMENT (one session, always time-boxed)
         const { runDisconnectCommand: runDisconnectCommand2 } = await Promise.resolve().then(() => (init_cloud_enrollment_cli(), exports_cloud_enrollment_cli));
         result2 = runDisconnectCommand2();
       } else {
-        const { hostname: hostname6 } = await import("os");
+        const { hostname: hostname7 } = await import("os");
         const { runConnectCommand: runConnectCommand2 } = await Promise.resolve().then(() => (init_cloud_enrollment_cli(), exports_cloud_enrollment_cli));
         result2 = await runConnectCommand2({
           url: valueAfter("--connect"),
           token: valueAfter("--token"),
           machineId: valueAfter("--machine-id"),
           machineLabel: valueAfter("--machine-label"),
-          defaultMachineId: hostname6(),
+          defaultMachineId: hostname7(),
           sessions: !args.includes("--no-transcripts")
         });
       }