failproofai 1.0.1 → 1.0.2-beta.1

package/dist/worker.mjs

@@ -370,7 +370,7 @@ function failproofaiHome(home) {
     return resolve(home, ".failproofai");
   return process.env.FAILPROOFAI_HOME || resolve(homedir(), ".failproofai");
 }
-var LAYOUT_VERSION = 4, at = (...parts) => resolve(failproofaiHome(), ...parts), atHome = (home, ...parts) => home ? resolve(failproofaiHome(home), ...parts) : at(...parts), versionFile = (home) => atHome(home, "VERSION"), configFile = (home) => atHome(home, "config.json"), policiesDir = (home) => atHome(home, "policies"), customPoliciesDir, globalPolicyConfigFile = (home) => atHome(home, "policies-config.json"), cloudPoliciesDir = (home) => resolve(policiesDir(home), "cloud-policies"), hookActivityDir = (home) => atHome(home, "hook-activity"), stateDir = (home) => atHome(home, "state"), shimsDir = (home) => resolve(stateDir(home), "shims"), sessionPauseDir = () => resolve(stateDir(), "sessions"), telemetryIdFile = (home) => resolve(stateDir(home), "telemetry-id"), codexSessionPathsFile = (home) => resolve(stateDir(home), "codex-session-paths.json"), logsDir = (home) => atHome(home, "logs"), legacy;
+var LAYOUT_VERSION = 4, at = (...parts) => resolve(failproofaiHome(), ...parts), atHome = (home, ...parts) => home ? resolve(failproofaiHome(home), ...parts) : at(...parts), versionFile = (home) => atHome(home, "VERSION"), configFile = (home) => atHome(home, "config.json"), policiesDir = (home) => atHome(home, "policies"), customPoliciesDir, globalPolicyConfigFile = (home) => atHome(home, "policies-config.json"), cloudPoliciesDir = (home) => resolve(policiesDir(home), "cloud-policies"), packsDir = (home) => resolve(policiesDir(home), "packs"), packsInstalledFile = (home) => resolve(packsDir(home), "installed.json"), hookActivityDir = (home) => atHome(home, "hook-activity"), stateDir = (home) => atHome(home, "state"), shimsDir = (home) => resolve(stateDir(home), "shims"), sessionPauseDir = () => resolve(stateDir(), "sessions"), telemetryIdFile = (home) => resolve(stateDir(home), "telemetry-id"), codexSessionPathsFile = (home) => resolve(stateDir(home), "codex-session-paths.json"), logsDir = (home) => atHome(home, "logs"), legacy;
 var init_fp_home = __esm(() => {
   customPoliciesDir = policiesDir;
   legacy = {
@@ -566,1963 +566,2000 @@ var init_hooks_config = __esm(() => {
   init_fp_home();
 });
 
-// src/hooks/policy-helpers.ts
-function allow(reason) {
-  return reason ? { decision: "allow", reason } : { decision: "allow" };
-}
-function deny(reason) {
-  return { decision: "deny", reason };
-}
-function instruct(reason) {
-  return { decision: "instruct", reason };
-}
-
-// src/hooks/policy-registry.ts
-function normalizePolicyName(name) {
-  return name.includes("/") ? name : `${DEFAULT_POLICY_NAMESPACE}/${name}`;
-}
-function getIndexCache() {
-  return globalThis[INDEX_CACHE_KEY];
-}
-function setIndexCache(cache) {
-  globalThis[INDEX_CACHE_KEY] = cache;
-}
-function getRegistry() {
-  const g = globalThis;
-  if (!g[REGISTRY_KEY]) {
-    g[REGISTRY_KEY] = [];
-  }
-  return g[REGISTRY_KEY];
-}
-function registerPolicy(name, description, fn, match, priority = 0) {
-  const canonical = normalizePolicyName(name);
-  const registry = getRegistry();
-  const idx = registry.findIndex((p) => p.name === canonical);
-  const entry = { name: canonical, description, fn, match, priority };
-  if (idx >= 0) {
-    registry[idx] = entry;
-  } else {
-    registry.push(entry);
-  }
-  setIndexCache(null);
-}
-function getPoliciesForEvent(eventType, toolName) {
-  let cache = getIndexCache();
-  if (!cache) {
-    cache = new Map;
-    setIndexCache(cache);
-  }
-  const key = `${eventType}:${toolName ?? ""}`;
-  const cached = cache.get(key);
-  if (cached)
-    return cached;
-  const result = getRegistry().filter((p) => {
-    if (p.match.events && p.match.events.length > 0) {
-      if (!p.match.events.includes(eventType))
-        return false;
-    }
-    if (p.match.toolNames && p.match.toolNames.length > 0) {
-      if (!toolName || !p.match.toolNames.includes(toolName))
-        return false;
-    }
-    return true;
-  }).sort((a, b) => b.priority - a.priority);
-  cache.set(key, result);
-  return result;
-}
-function clearPolicies() {
-  const g = globalThis;
-  g[REGISTRY_KEY] = [];
-  setIndexCache(null);
-}
-var REGISTRY_KEY = "__FAILPROOFAI_POLICY_REGISTRY__", INDEX_CACHE_KEY = "__FAILPROOFAI_POLICY_INDEX_CACHE__", DEFAULT_POLICY_NAMESPACE = "failproofai";
-
-// src/hooks/builtin-policies.ts
-import { resolve as resolve3, join as join2 } from "node:path";
-import { statSync as statSync3 } from "node:fs";
-import { readFile, writeFile } from "node:fs/promises";
-import { execSync, execFileSync } from "node:child_process";
-import { homedir as homedir3 } from "node:os";
-function isAgentInternalPath(resolved2) {
-  const normResolved = resolved2.replaceAll("\\", "/");
-  for (const dir of [".claude", ".codex", ".copilot", ".cursor", ".opencode", ".pi", ".gemini"]) {
-    const root = join2(homedir3(), dir).replaceAll("\\", "/");
-    if (normResolved === root || normResolved.startsWith(root + "/"))
-      return true;
-  }
-  for (const sub of [join2(".config", "opencode"), join2(".local", "share", "opencode")]) {
-    const root = join2(homedir3(), sub).replaceAll("\\", "/");
-    if (normResolved === root || normResolved.startsWith(root + "/"))
-      return true;
-  }
-  return false;
-}
-function isAgentSettingsFile(resolved2) {
-  if (/[\\/]\.claude[\\/]settings(?:\.[^/\\]+)?\.json$/.test(resolved2))
-    return true;
-  if (/[\\/]\.codex[\\/]hooks\.json$/.test(resolved2))
-    return true;
-  if (/[\\/]\.copilot[\\/]hooks[\\/][^/\\]+\.json$/.test(resolved2))
-    return true;
-  if (/[\\/]\.github[\\/]hooks[\\/][^/\\]+\.json$/.test(resolved2))
-    return true;
-  if (/[\\/]\.cursor[\\/]hooks\.json$/.test(resolved2))
-    return true;
-  if (/[\\/]\.opencode[\\/]opencode\.jsonc?$/.test(resolved2))
-    return true;
-  if (/[\\/]\.opencode[\\/]plugins[\\/][^/\\]+\.(?:mjs|js|ts)$/.test(resolved2))
-    return true;
-  if (/[\\/]\.config[\\/]opencode[\\/]opencode\.jsonc?$/.test(resolved2))
-    return true;
-  if (/[\\/]\.config[\\/]opencode[\\/]config\.json$/.test(resolved2))
-    return true;
-  if (/[\\/]\.config[\\/]opencode[\\/]plugins[\\/][^/\\]+\.(?:mjs|js|ts)$/.test(resolved2))
-    return true;
-  if (/[\\/]\.pi[\\/](?:agent[\\/])?settings\.json$/.test(resolved2))
-    return true;
-  if (/[\\/]\.pi[\\/](?:agent[\\/])?extensions[\\/]/.test(resolved2))
-    return true;
-  if (/[\\/]\.gemini[\\/]settings\.json$/.test(resolved2))
-    return true;
-  if (/[\\/]\.gemini[\\/]config[\\/]hooks\.json$/.test(resolved2))
-    return true;
-  return false;
-}
-function getCommand(ctx) {
-  return ctx.toolInput?.command ?? "";
-}
-function getFilePath(ctx) {
-  return ctx.toolInput?.file_path ?? "";
-}
-function parseArgvTokens(cmd) {
-  return cmd.trim().split(/\s+/).map((t) => t.replace(/^['"]|['"]$/g, ""));
-}
-function namesSelfPause(command) {
-  for (const segment of command.split(SEGMENT_SEPARATORS)) {
-    const tokens = segment.split(/\s+/).filter(Boolean);
-    let i = 0;
-    while (i < tokens.length) {
-      const token = tokens[i];
-      const isSkippable = ENV_ASSIGNMENT_RE.test(token) || token.startsWith("-") || token.startsWith(">") || token.startsWith("<") || RUNNER_OPERAND_RE.test(token) || COMMAND_PREFIX_TOKENS.has(token.slice(token.lastIndexOf("/") + 1));
-      if (!isSkippable)
-        break;
-      i++;
-    }
-    if (i >= tokens.length)
-      continue;
-    if (!SELF_BINARY_TOKEN_RE.test(tokens[i]))
-      continue;
-    const args = tokens.slice(i + 1);
-    const configAt = args.findIndex((a) => CONFIG_SUBCOMMAND_RE.test(a));
-    if (configAt === -1)
-      continue;
-    if (args.slice(configAt + 1).some((a) => PAUSE_FLAG_RE.test(a)))
-      return true;
-  }
-  return false;
-}
-function decodeAnsiC(body) {
-  return body.replace(/\\(x[0-9A-Fa-f]{1,2}|u[0-9A-Fa-f]{1,4}|U[0-9A-Fa-f]{1,8}|[0-7]{1,3}|.)/g, (_, seq) => {
-    try {
-      if (seq[0] === "x")
-        return String.fromCharCode(parseInt(seq.slice(1), 16));
-      if (seq[0] === "u" || seq[0] === "U")
-        return String.fromCodePoint(parseInt(seq.slice(1), 16));
-      if (/^[0-7]+$/.test(seq))
-        return String.fromCharCode(parseInt(seq, 8));
-    } catch {
-      return seq;
-    }
-    const named = {
-      a: "\x07",
-      b: "\b",
-      e: "\x1B",
-      f: "\f",
-      n: `
-`,
-      r: "\r",
-      t: "\t",
-      v: "\v",
-      "\\": "\\",
-      "'": "'",
-      '"': '"',
-      "?": "?"
-    };
-    return named[seq] ?? seq;
-  });
-}
-function stripShellQuoting(command) {
-  const joined = command.replace(/\\\r?\n/g, "");
-  const ansiDecoded = joined.replace(/\$'((?:[^'\\]|\\.)*)'/g, (_, body) => decodeAnsiC(body));
-  return ansiDecoded.replace(/\\(.)/g, "$1").replace(/['"]/g, "");
-}
-function statGitHeadMtimeMs(cwd) {
-  try {
-    return statSync3(join2(cwd, ".git", "HEAD")).mtimeMs;
-  } catch {
-    return null;
-  }
-}
-function getCurrentBranch(cwd) {
-  try {
-    const headMtimeMs = statGitHeadMtimeMs(cwd);
-    const cached = gitBranchCache.get(cwd);
-    if (cached && headMtimeMs !== null && cached.headMtimeMs === headMtimeMs) {
-      return cached.branch || null;
-    }
-    const branch = execSync("git rev-parse --abbrev-ref HEAD", {
-      cwd,
-      encoding: "utf8",
-      stdio: ["pipe", "pipe", "pipe"],
-      timeout: 3000
-    }).trim();
-    if (headMtimeMs !== null) {
-      if (gitBranchCache.size >= GIT_BRANCH_CACHE_MAX_ENTRIES)
-        gitBranchCache.clear();
-      gitBranchCache.set(cwd, { branch, headMtimeMs });
-    }
-    return branch || null;
-  } catch {
-    return null;
-  }
-}
-function getHeadSha(cwd) {
-  try {
-    const sha = execSync("git rev-parse HEAD", {
-      cwd,
-      encoding: "utf8",
-      stdio: ["pipe", "pipe", "pipe"],
-      timeout: 3000
-    }).trim();
-    return sha || null;
-  } catch {
-    return null;
-  }
-}
-function getThirdPartyCheckRuns(cwd, sha) {
-  try {
-    const json = execFileSync("gh", [
-      "api",
-      `repos/{owner}/{repo}/commits/${sha}/check-runs`,
-      "--jq",
-      '.check_runs | map(select(.app.slug != "github-actions")) | map({name: .name, status: .status, conclusion: (.conclusion // "")})'
-    ], {
-      cwd,
-      encoding: "utf8",
-      stdio: ["pipe", "pipe", "pipe"],
-      timeout: 15000
-    }).trim();
-    if (!json || json === "[]")
-      return [];
-    return JSON.parse(json);
-  } catch {
-    return [];
-  }
-}
-function getCommitStatuses(cwd, sha) {
-  try {
-    const json = execFileSync("gh", [
-      "api",
-      `repos/{owner}/{repo}/commits/${sha}/statuses`,
-      "--jq",
-      "map({name: .context, state: .state}) | unique_by(.name)"
-    ], {
-      cwd,
-      encoding: "utf8",
-      stdio: ["pipe", "pipe", "pipe"],
-      timeout: 15000
-    }).trim();
-    if (!json || json === "[]")
-      return [];
-    const statuses = JSON.parse(json);
-    return statuses.map((s) => ({
-      name: s.name,
-      status: s.state === "pending" ? "in_progress" : "completed",
-      conclusion: s.state === "pending" ? "" : s.state === "success" ? "success" : "failure"
-    }));
-  } catch {
-    return [];
-  }
-}
-function matchesAllowedPattern(cmd, pattern) {
-  const cmdTokens = parseArgvTokens(cmd);
-  const patTokens = parseArgvTokens(pattern);
-  if (cmdTokens.length < patTokens.length)
-    return false;
-  if (cmdTokens.some((tok) => SHELL_OPERATORS.has(tok)))
-    return false;
-  if (cmdTokens.some((tok) => SHELL_METACHAR_RE.test(tok)))
-    return false;
-  return patTokens.every((tok, i) => tok === "*" || tok === cmdTokens[i]);
-}
-function sanitizeJwt(ctx) {
-  const output = JSON.stringify(ctx.payload);
-  if (JWT_RE.test(output)) {
-    return {
-      decision: "deny",
-      reason: "JWT token detected in tool output",
-      message: "[REDACTED: JWT token removed by failproofai]"
-    };
-  }
-  return allow();
-}
-function sanitizeApiKeys(ctx) {
-  const output = JSON.stringify(ctx.payload);
-  for (const [pattern, label] of API_KEY_PATTERNS) {
-    if (pattern.test(output)) {
-      return {
-        decision: "deny",
-        reason: `${label} detected in tool output`,
-        message: `[REDACTED: ${label} removed by failproofai]`
-      };
-    }
-  }
-  const additional = ctx.params?.additionalPatterns ?? [];
-  for (const { regex, label } of additional) {
-    try {
-      if (new RegExp(regex).test(output)) {
-        return {
-          decision: "deny",
-          reason: `${label} detected in tool output`,
-          message: `[REDACTED: ${label} removed by failproofai]`
-        };
-      }
-    } catch {
-      hookLogWarn(`additionalPatterns: invalid regex "${regex}", skipping`);
-    }
-  }
-  return allow();
-}
-function sanitizeConnectionStrings(ctx) {
-  const output = JSON.stringify(ctx.payload);
-  if (CONNECTION_STRING_RE.test(output)) {
-    return {
-      decision: "deny",
-      reason: "Database connection string with credentials detected in tool output",
-      message: "[REDACTED: connection string removed by failproofai]"
-    };
-  }
-  return allow();
-}
-function sanitizePrivateKeyContent(ctx) {
-  const output = JSON.stringify(ctx.payload);
-  if (PRIVATE_KEY_RE.test(output)) {
-    return {
-      decision: "deny",
-      reason: "Private key content detected in tool output",
-      message: "[REDACTED: private key content removed by failproofai]"
-    };
-  }
-  return allow();
-}
-function sanitizeBearerTokens(ctx) {
-  const output = JSON.stringify(ctx.payload);
-  if (BEARER_TOKEN_RE.test(output)) {
-    return {
-      decision: "deny",
-      reason: "Bearer token detected in tool output",
-      message: "[REDACTED: Bearer token removed by failproofai]"
-    };
-  }
-  return allow();
-}
-function warnDestructiveSql(ctx) {
-  if (ctx.toolName !== "Bash")
-    return allow();
-  const cmd = getCommand(ctx);
-  if (!SQL_TOOL_RE.test(cmd))
-    return allow();
-  if (DESTRUCTIVE_SQL_RE.test(cmd)) {
-    return instruct("STOP: This command contains destructive SQL (DROP/TRUNCATE/DELETE). Confirm with the user before executing.");
-  }
-  if (DELETE_NO_WHERE_RE.test(cmd) && !SQL_WHERE_RE.test(cmd)) {
-    return instruct("STOP: This command contains destructive SQL (DROP/TRUNCATE/DELETE). Confirm with the user before executing.");
-  }
-  return allow();
-}
-function warnLargeFileWrite(ctx) {
-  if (ctx.toolName !== "Write")
-    return allow();
-  const content = ctx.toolInput?.content;
-  if (typeof content !== "string")
-    return allow();
-  const thresholdKb = ctx.params?.thresholdKb ?? 1024;
-  const thresholdBytes = thresholdKb * 1024;
-  if (content.length > thresholdBytes) {
-    return instruct(`STOP: You are writing a file larger than ${thresholdKb}KB (${Math.round(content.length / 1024)}KB). This is unusually large. Confirm this is intentional before proceeding.`);
-  }
-  return allow();
-}
-function warnPackagePublish(ctx) {
-  if (ctx.toolName !== "Bash")
-    return allow();
-  const cmd = getCommand(ctx);
-  if (PUBLISH_CMD_RE.test(cmd)) {
-    return instruct("STOP: This command publishes a package to a public registry. Confirm with the user that this is intentional.");
-  }
-  return allow();
-}
-function protectEnvVars(ctx) {
-  if (ctx.toolName !== "Bash")
-    return allow();
-  const cmd = getCommand(ctx);
-  if (ENV_PRINTENV_RE.test(cmd)) {
-    return deny("Command reads environment variables");
-  }
-  if (ECHO_ENV_RE.test(cmd)) {
-    return deny("Command echoes environment variable");
-  }
-  if (EXPORT_RE.test(cmd)) {
-    return deny("Command exports environment variable");
-  }
-  if (PS_ENV_VAR_RE.test(cmd)) {
-    return deny("Command reads environment variable via PowerShell");
-  }
-  if (PS_CHILDITEM_ENV_RE.test(cmd)) {
-    return deny("Command reads environment variables via PowerShell");
-  }
-  if (DOTNET_GETENV_RE.test(cmd)) {
-    return deny("Command reads environment variable via .NET");
-  }
-  if (CMD_ECHO_ENV_RE.test(cmd)) {
-    return deny("Command echoes environment variable via cmd");
-  }
-  return allow();
-}
-function blockEnvFiles(ctx) {
-  const cmd = getCommand(ctx);
-  const filePath = getFilePath(ctx);
-  if (filePath && ENV_FILE_PATH_RE.test(filePath)) {
-    return deny("Access to .env file blocked");
-  }
-  if (ctx.toolName === "Bash" && ENV_CMD_RE.test(cmd)) {
-    return deny("Command references .env file");
-  }
-  return allow();
-}
-function quoteAwareSegments(command) {
-  const segments = [];
-  let tokens = [];
-  let token = "";
-  let quote = null;
-  const endToken = () => {
-    if (token)
-      tokens.push(token);
-    token = "";
-  };
-  const endSegment = () => {
-    endToken();
-    if (tokens.length)
-      segments.push(tokens);
-    tokens = [];
-  };
-  for (let i = 0;i < command.length; i++) {
-    const c = command[i];
-    if (quote) {
-      if (c === "\\" && quote === '"' && i + 1 < command.length) {
-        token += command[++i];
-        continue;
-      }
-      if (c === quote) {
-        quote = null;
-        continue;
-      }
-      token += c;
-      continue;
-    }
-    if (c === "\\" && i + 1 < command.length) {
-      token += command[++i];
-      continue;
-    }
-    if (c === '"' || c === "'") {
-      quote = c;
-      continue;
-    }
-    if (/\s/.test(c)) {
-      endToken();
-      continue;
-    }
-    if (/[;&|\n\r(){}`]/.test(c)) {
-      endSegment();
-      continue;
-    }
-    token += c;
-  }
-  endSegment();
-  return segments;
-}
-function namesElevation(command, depth = 0) {
-  for (const tokens of quoteAwareSegments(command)) {
-    let i = 0;
-    while (i < tokens.length) {
-      const token = tokens[i];
-      const base = token.slice(token.lastIndexOf("/") + 1);
-      if (base === "sudo" || base === "doas")
-        return true;
-      const isSkippable = ENV_ASSIGNMENT_RE.test(token) || token.startsWith("-") || token.startsWith(">") || token.startsWith("<") || RUNNER_OPERAND_RE.test(token) || COMMAND_PREFIX_TOKENS.has(base);
-      if (!isSkippable)
-        break;
-      if (EVAL_FLAG_RE.test(token) && depth < 3 && i + 1 < tokens.length) {
-        if (namesElevation(tokens[i + 1], depth + 1))
-          return true;
-      }
-      i++;
-    }
-  }
-  return false;
-}
-function blockSudo(ctx) {
-  if (ctx.toolName !== "Bash")
-    return allow();
-  const cmd = getCommand(ctx).trimStart();
-  if (namesElevation(cmd)) {
-    const allowPatterns = ctx.params?.allowPatterns ?? [];
-    if (allowPatterns.some((p) => matchesAllowedPattern(cmd, p)))
-      return allow();
-    return deny("sudo commands are blocked");
-  }
-  if (PS_ELEVATION_RE.test(cmd)) {
-    return deny("Elevated process launch is blocked");
-  }
-  if (RUNAS_RE.test(cmd)) {
-    return deny("runas elevation is blocked");
-  }
-  return allow();
-}
-function blockSelfPause(ctx) {
-  if (ctx.toolName !== "Bash")
-    return allow();
-  const cmd = getCommand(ctx);
-  if (namesSelfPause(cmd) || namesSelfPause(stripShellQuoting(cmd))) {
-    return deny("Pausing failproofai enforcement is a human action, not an agent one. " + "If a policy is blocking legitimate work, say so and let the operator decide.");
-  }
-  return allow();
-}
-function blockCurlPipeSh(ctx) {
-  if (ctx.toolName !== "Bash")
-    return allow();
-  const cmd = getCommand(ctx);
-  if (CURL_PIPE_SH_RE.test(cmd)) {
-    return deny("Piping downloads to shell is blocked");
-  }
-  if (PS_WEB_PIPE_RE.test(cmd)) {
-    return deny("Piping downloads to Invoke-Expression is blocked");
-  }
-  return allow();
-}
-function extractGitPushArgs(cmd) {
-  return cmd.split(/&&|\|\||[|;\n]/).map((s) => s.trim()).filter((s) => /^git\s+push\s/.test(s)).map((s) => s.replace(/^git\s+push\s+/, ""));
-}
-function blockPushMaster(ctx) {
-  if (ctx.toolName !== "Bash")
-    return allow();
-  const protectedBranches = ctx.params?.protectedBranches ?? ["main", "master"];
-  if (protectedBranches.length === 0)
-    return allow();
-  const args = extractGitPushArgs(getCommand(ctx));
-  const branchPattern = new RegExp(`\\b(?:${protectedBranches.map((b) => b.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|")})\\b`);
-  if (args.some((a) => branchPattern.test(a))) {
-    return deny(`Pushing to ${protectedBranches.join("/")} is blocked`);
-  }
-  return allow();
-}
-function expandHomePrefix(path) {
-  const m = path.match(/^(?:~|\$HOME|\$\{HOME\})(?=$|\/)/);
-  return m ? homedir3() + path.slice(m[0].length) : path;
-}
-function stripTrailingGlob(path) {
-  return path.replace(/\/\*$/, "").replace(/\/+$/, "");
-}
-function isCatastrophicTarget(token) {
-  const raw = token.replace(/^['"]|['"]$/g, "");
-  if (raw === "")
-    return false;
-  const homePrefix = raw.match(HOME_PREFIX_RE);
-  if (!homePrefix && /^[$`]/.test(raw))
-    return true;
-  const belowRoot = homePrefix ? raw.slice(homePrefix[0].length) : raw.startsWith("/") ? raw : null;
-  if (belowRoot === null)
-    return false;
-  const segments = stripTrailingGlob(belowRoot).split("/").filter(Boolean);
-  if (!homePrefix && SCRATCH_ROOTS.some((r) => `/${segments.join("/")}`.startsWith(`${r}/`)))
-    return false;
-  return segments.length <= CATASTROPHIC_DEPTH;
-}
-function recursiveDeletionTargets(seg) {
-  const tokens = parseArgvTokens(seg);
-  const findIdx = tokens.findIndex((t) => FIND_CMD_RE.test(t));
-  if (findIdx >= 0) {
-    const expr = tokens.slice(findIdx + 1);
-    const execIdx = expr.findIndex((t) => FIND_EXEC_RE.test(t));
-    const deletes = expr.includes("-delete") || execIdx >= 0 && RM_CMD_RE.test(expr[execIdx + 1] ?? "");
-    if (deletes) {
-      let start = 0;
-      while (start < expr.length && FIND_GLOBAL_OPT_RE.test(expr[start])) {
-        start += expr[start] === "-D" ? 2 : 1;
-      }
-      const rest = expr.slice(start);
-      const end = rest.findIndex((t) => FIND_EXPR_START_RE.test(t));
-      return end < 0 ? rest : rest.slice(0, end);
-    }
-  }
-  const rmIdx = tokens.findIndex((t) => RM_CMD_RE.test(t));
-  if (rmIdx >= 0) {
-    const args = tokens.slice(rmIdx + 1);
-    const shortFlags = args.filter((t) => /^-[^-]/.test(t)).join("");
-    const longFlags = args.filter((t) => /^--/.test(t));
-    const recursive = /r/i.test(shortFlags) || longFlags.some((f) => /^--recursive$/i.test(f));
-    const force = /f/.test(shortFlags) || longFlags.some((f) => /^--force$/i.test(f));
-    if (recursive && force)
-      return args.filter((t) => !t.startsWith("-"));
-  }
-  return null;
-}
-function shellSegments(cmd) {
-  return cmd.split(/&&|\|\||[|;\n]/).map((s) => s.trim()).filter((s) => s !== "");
-}
-function deletionTargetIsAllowed(cmd, allowPaths) {
-  if (allowPaths.length === 0)
-    return false;
-  const normalizedAllowPaths = allowPaths.map((p) => stripTrailingGlob(expandHomePrefix(p)) || "/");
-  let sawRecursiveDelete = false;
-  for (const seg of shellSegments(cmd)) {
-    const targets = recursiveDeletionTargets(seg);
-    if (targets === null)
-      continue;
-    sawRecursiveDelete = true;
-    for (const target of targets) {
-      const normalized = stripTrailingGlob(expandHomePrefix(target)) || "/";
-      const covered = normalizedAllowPaths.some((np) => normalized === np || normalized.startsWith(np + "/"));
-      if (!covered) {
-        const segCovered = allowPaths.some((p) => {
-          const escaped = p.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-          return new RegExp(`${escaped}(?:[/"'\\s/*]|$)`).test(seg);
-        });
-        if (!segCovered)
-          return false;
-      }
-    }
-  }
-  return sawRecursiveDelete;
-}
-function blockRmRf(ctx) {
-  if (ctx.toolName !== "Bash")
-    return allow();
-  const cmd = getCommand(ctx);
-  const hasCatastrophicTarget = shellSegments(cmd).some((seg) => {
-    const targets = recursiveDeletionTargets(seg);
-    return targets !== null && targets.some(isCatastrophicTarget);
-  });
-  if (hasCatastrophicTarget) {
-    const allowPaths = ctx.params?.allowPaths ?? [];
-    if (deletionTargetIsAllowed(cmd, allowPaths))
-      return allow();
-    return deny("Catastrophic deletion blocked");
-  }
-  if (/Remove-Item\s+.*-Recurse.*-Force.*(?:[A-Z]:\\(?:\s|$)|\\\*)/i.test(cmd)) {
-    return deny("Catastrophic deletion blocked");
-  }
-  if (/(?:rd|rmdir)\s+\/s\s+\/q\s+[A-Z]:\\/i.test(cmd)) {
-    return deny("Catastrophic deletion blocked");
-  }
-  return allow();
-}
-function blockForcePush(ctx) {
-  if (ctx.toolName !== "Bash")
-    return allow();
-  for (const segment of extractGitPushArgs(getCommand(ctx))) {
-    let sawEndOfOptions = false;
-    for (const token of segment.split(/\s+/)) {
-      if (token === "--") {
-        sawEndOfOptions = true;
-        continue;
-      }
-      if (sawEndOfOptions)
-        continue;
-      if (isForcePushFlag(token)) {
-        return deny("Force-pushing is blocked");
-      }
-    }
-  }
-  return allow();
-}
-function isForcePushFlag(token) {
-  if (token === "--force")
-    return true;
-  if (SAFE_FORCE_PREFIXES.some((prefix) => token.startsWith(prefix)))
-    return false;
-  if (token.startsWith("--force"))
-    return true;
-  return SHORT_FLAG_BUNDLE_RE.test(token);
-}
-function blockSecretsWrite(ctx) {
-  if (ctx.toolName !== "Write")
-    return allow();
-  const filePath = getFilePath(ctx);
-  if (SECRET_FILE_RE.test(filePath) || SECRET_FILE_ID_RSA_RE.test(filePath) || SECRET_FILE_CREDENTIALS_RE.test(filePath)) {
-    return deny("Writing secret key files is blocked");
-  }
-  const additionalPatterns = ctx.params?.additionalPatterns ?? [];
-  for (const pattern of additionalPatterns) {
-    if (filePath.includes(pattern)) {
-      return deny(`Writing blocked file pattern: ${pattern}`);
-    }
-  }
-  return allow();
-}
-function extractAbsolutePaths(command) {
-  const paths = [];
-  const pathRe = /(?<![a-zA-Z0-9_.\-~\\*?:=])(?:~\/[^\s;|&"'()\[\]{}]*|~(?=\s|$|[;|&"'()\[\]{}])|\/[^\s;|&"'()\[\]{}]*)/g;
-  function addPaths(s) {
-    pathRe.lastIndex = 0;
-    let m;
-    while ((m = pathRe.exec(s)) !== null) {
-      let p = m[0];
-      if (p === "~")
-        p = homedir3();
-      else if (p.startsWith("~/"))
-        p = join2(homedir3(), p.slice(2));
-      paths.push(p);
-    }
-  }
-  let firstBarePipe = command.length;
-  let inDouble = false, inSingle = false;
-  for (let i = 0;i < command.length; i++) {
-    const c = command[i];
-    if (c === '"' && !inSingle)
-      inDouble = !inDouble;
-    else if (c === "'" && !inDouble)
-      inSingle = !inSingle;
-    else if (c === "|" && !inDouble && !inSingle) {
-      firstBarePipe = i;
-      break;
-    }
-  }
-  const firstSegment = command.slice(0, firstBarePipe);
-  const quotedRe = /"([^"]*)"|'([^']*)'/g;
-  let qm;
-  while ((qm = quotedRe.exec(firstSegment)) !== null) {
-    const content = qm[1] ?? qm[2] ?? "";
-    if (/[*?\[\]^$+()\\]/.test(content))
-      continue;
-    addPaths(content);
-  }
-  const stripped = command.replace(/"[^"]*"/g, (m) => " ".repeat(m.length)).replace(/'[^']*'/g, (m) => " ".repeat(m.length));
-  addPaths(stripped);
-  return paths;
-}
-function blockReadOutsideCwd(ctx) {
-  const cwd = process.env.CLAUDE_PROJECT_DIR || ctx.session?.cwd;
-  if (!cwd)
-    return allow();
-  const allowPaths = ctx.params?.allowPaths ?? [];
-  if (ctx.toolName === "Bash") {
-    const cmd = getCommand(ctx);
-    if (!READ_LIKE_CMDS.test(cmd))
-      return allow();
-    const paths = extractAbsolutePaths(cmd);
-    const cwdWithSep2 = cwd.endsWith("/") ? cwd : cwd + "/";
-    for (const p of paths) {
-      const resolved3 = resolve3(cwd, p);
-      if (isClaudeSettingsFile(resolved3)) {
-        return deny(`Reading agent settings file blocked: ${resolved3}`);
-      }
-      if (isClaudeInternalPath(resolved3))
-        continue;
-      if (resolved3 === "/dev/null")
-        continue;
-      if (resolved3 !== cwd && !resolved3.startsWith(cwdWithSep2)) {
-        if (allowPaths.some((ap) => resolved3 === ap || resolved3.startsWith(ap.endsWith("/") ? ap : ap + "/")))
-          continue;
-        return deny(`Bash read outside project directory blocked: ${resolved3}`);
-      }
-    }
-    return allow();
-  }
-  const filePath = getFilePath(ctx);
-  const searchPath = ctx.toolInput?.path ?? "";
-  const target = filePath || searchPath;
-  if (!target)
-    return allow();
-  const resolved2 = resolve3(cwd, target);
-  if (isClaudeSettingsFile(resolved2)) {
-    return deny(`Reading agent settings file blocked: ${resolved2}`);
-  }
-  if (isClaudeInternalPath(resolved2))
-    return allow();
-  if (resolved2 === "/dev/null")
-    return allow();
-  const cwdWithSep = cwd.endsWith("/") ? cwd : cwd + "/";
-  if (resolved2 !== cwd && !resolved2.startsWith(cwdWithSep)) {
-    if (allowPaths.some((ap) => resolved2 === ap || resolved2.startsWith(ap.endsWith("/") ? ap : ap + "/")))
-      return allow();
-    return deny(`Access outside project directory blocked: ${resolved2}`);
-  }
-  return allow();
-}
-function blockWorkOnMain(ctx) {
-  if (ctx.toolName !== "Bash")
-    return allow();
-  const cmd = getCommand(ctx);
-  const match = cmd.match(GIT_COMMIT_MERGE_RE);
-  if (!match)
-    return allow();
-  const cwd = ctx.session?.cwd;
-  if (!cwd)
-    return allow();
-  const branch = getCurrentBranch(cwd);
-  if (!branch)
-    return allow();
-  const protectedBranches = ctx.params?.protectedBranches ?? ["main", "master"];
-  if (protectedBranches.includes(branch)) {
-    return deny(`Git ${match[1]} on ${branch} is blocked. Create a feature branch first.`);
-  }
-  return allow();
-}
-function blockFailproofaiCommands(ctx) {
-  if (ctx.toolName !== "Bash")
-    return allow();
-  const cmd = getCommand(ctx);
-  if (FAILPROOFAI_CLI_RE.test(cmd)) {
-    return deny("Running failproofai CLI commands is blocked");
-  }
-  if (FAILPROOFAI_UNINSTALL_RE.test(cmd)) {
-    return deny("Uninstalling failproofai is blocked");
-  }
-  return allow();
-}
-function blockInfraCli(ctx, re, denyMsg) {
-  if (ctx.toolName !== "Bash")
-    return allow();
-  const cmd = getCommand(ctx);
-  if (!re.test(cmd))
-    return allow();
-  const allowPatterns = ctx.params?.allowPatterns ?? [];
-  if (allowPatterns.some((p) => matchesAllowedPattern(cmd, p)))
-    return allow();
-  return deny(denyMsg);
-}
-function blockKubectl(ctx) {
-  return blockInfraCli(ctx, KUBECTL_RE, "kubectl commands are blocked");
-}
-function blockTerraform(ctx) {
-  return blockInfraCli(ctx, TERRAFORM_RE, "terraform/tofu commands are blocked");
-}
-function blockAwsCli(ctx) {
-  return blockInfraCli(ctx, AWS_CLI_RE, "aws CLI commands are blocked");
-}
-function blockGcloud(ctx) {
-  return blockInfraCli(ctx, GCLOUD_RE, "gcloud commands are blocked");
-}
-function blockAzCli(ctx) {
-  return blockInfraCli(ctx, AZ_CLI_RE, "az (Azure) CLI commands are blocked");
-}
-function blockHelm(ctx) {
-  return blockInfraCli(ctx, HELM_RE, "helm commands are blocked");
-}
-function blockGhPipeline(ctx) {
-  return blockInfraCli(ctx, GH_PIPELINE_RE, "gh pipeline-trigger commands are blocked");
-}
-async function warnRepeatedToolCalls(ctx) {
-  const THRESHOLD = 3;
-  const transcriptPath = ctx.session?.transcriptPath;
-  if (!transcriptPath || !ctx.toolName || !ctx.toolInput)
-    return allow();
-  const trackerPath = `${transcriptPath}.tool-calls.json`;
-  const fingerprint = JSON.stringify({ tool: ctx.toolName, input: ctx.toolInput });
-  let counts = {};
-  try {
-    const raw = await readFile(trackerPath, "utf8");
-    counts = JSON.parse(raw);
-  } catch {}
-  const prevCount = counts[fingerprint] ?? 0;
-  if (prevCount >= THRESHOLD) {
-    return instruct(`STOP: You have already called ${ctx.toolName} ${prevCount} times with identical parameters. This is wasteful and unproductive. Do NOT repeat this call — use a different approach or ask the user for clarification.`);
-  }
-  counts[fingerprint] = prevCount + 1;
-  try {
-    const serialized = JSON.stringify(counts);
-    if (serialized.length <= TOOL_CALL_TRACKER_MAX_BYTES) {
-      await writeFile(trackerPath, serialized, "utf8");
-    }
-  } catch {}
-  return allow();
-}
-function warnGitAmend(ctx) {
-  if (ctx.toolName !== "Bash")
-    return allow();
-  const cmd = getCommand(ctx);
-  if (GIT_AMEND_RE.test(cmd)) {
-    return instruct("STOP: This command amends the last commit, which rewrites git history. If this commit has already been pushed to a shared branch, this will cause divergence for other contributors. Confirm with the user before executing.");
-  }
-  return allow();
-}
-function warnGitStashDrop(ctx) {
-  if (ctx.toolName !== "Bash")
-    return allow();
-  const cmd = getCommand(ctx);
-  if (GIT_STASH_DROP_RE.test(cmd)) {
-    return instruct("STOP: This command permanently deletes stashed changes (git stash drop/clear). Stash entries cannot be recovered after deletion. Confirm with the user before executing.");
-  }
-  return allow();
-}
-function warnAllFilesStaged(ctx) {
-  if (ctx.toolName !== "Bash")
-    return allow();
-  const cmd = getCommand(ctx);
-  if (GIT_ADD_ALL_RE.test(cmd)) {
-    return instruct("STOP: This command stages all files in the working tree (git add -A / --all / .). This may inadvertently include build artifacts, generated files, or sensitive files not covered by .gitignore. Confirm with the user before executing.");
-  }
-  return allow();
-}
-function warnSchemaAlteration(ctx) {
-  if (ctx.toolName !== "Bash")
-    return allow();
-  const cmd = getCommand(ctx);
-  if (!SQL_TOOL_RE.test(cmd))
-    return allow();
-  if (SCHEMA_ALTER_RE.test(cmd)) {
-    return instruct("STOP: This command contains a schema-altering SQL statement (ALTER TABLE with column or rename operation). Schema changes on production databases are irreversible or disruptive. Confirm with the user before executing.");
-  }
-  return allow();
-}
-function warnGlobalPackageInstall(ctx) {
-  if (ctx.toolName !== "Bash")
-    return allow();
-  const cmd = getCommand(ctx);
-  const isGlobal = NPM_GLOBAL_RE.test(cmd) || YARN_GLOBAL_RE.test(cmd) || PNPM_GLOBAL_RE.test(cmd) || BUN_GLOBAL_RE.test(cmd) || CARGO_INSTALL_RE.test(cmd) || PIP_SYSTEM_RE.test(cmd);
-  if (isGlobal) {
-    return instruct("STOP: This command installs a package globally, which modifies the system-wide environment outside the project. This can conflict with other projects or system tools. Confirm with the user before executing.");
-  }
-  return allow();
-}
-function preferPackageManager(ctx) {
-  if (ctx.toolName !== "Bash")
-    return allow();
-  const cmd = getCommand(ctx);
-  if (!cmd)
-    return allow();
-  const allowed = ctx.params?.allowed ?? [];
-  if (allowed.length === 0)
-    return allow();
-  const allowedSet = new Set(allowed.map((a) => a.toLowerCase()));
-  const blocked = ctx.params?.blocked ?? [];
-  const allowedList = allowed.join(", ");
-  const segments = cmd.split(SEGMENT_SPLIT_RE);
-  for (const segment of segments) {
-    const trimmed = segment.trim();
-    if (!trimmed)
-      continue;
-    let segmentAllowed = false;
-    for (const manager of allowedSet) {
-      const patterns = PKG_MANAGER_DETECTORS[manager];
-      if (!patterns)
-        continue;
-      for (const pattern of patterns) {
-        if (pattern.test(trimmed)) {
-          segmentAllowed = true;
-          break;
-        }
-      }
-      if (segmentAllowed)
-        break;
-    }
-    if (segmentAllowed)
-      continue;
-    for (const [manager, patterns] of Object.entries(PKG_MANAGER_DETECTORS)) {
-      if (allowedSet.has(manager))
-        continue;
-      for (const pattern of patterns) {
-        if (pattern.test(trimmed)) {
-          return deny(`"${manager}" is not an allowed package manager. ` + `Allowed package managers for this project: ${allowedList}. ` + `Rewrite this command using an allowed package manager.`);
-        }
-      }
-    }
-    for (const name of blocked) {
-      const lower = name.toLowerCase();
-      if (allowedSet.has(lower))
-        continue;
-      const re = new RegExp(`\\b${lower.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}\\b`);
-      if (re.test(trimmed)) {
-        return deny(`"${lower}" is not an allowed package manager. ` + `Allowed package managers for this project: ${allowedList}. ` + `Rewrite this command using an allowed package manager.`);
-      }
-    }
-  }
-  return allow();
-}
-function warnBackgroundProcess(ctx) {
-  if (ctx.toolName !== "Bash")
-    return allow();
-  const cmd = getCommand(ctx);
-  const isBackground = NOHUP_RE.test(cmd) || SCREEN_DETACH_RE.test(cmd) || TMUX_DETACH_RE.test(cmd) || DISOWN_RE.test(cmd) || BACKGROUND_AMPERSAND_RE.test(cmd);
-  if (isBackground) {
-    return instruct("STOP: This command starts a background or detached process (nohup, screen -d, tmux -d, or trailing &). Background processes persist after Claude's session and may be difficult to track or stop. Confirm with the user before executing.");
-  }
-  return allow();
-}
-function isPlanMode(ctx) {
-  return ctx.session?.permissionMode === "plan";
-}
-function requireCommitBeforeStop(ctx) {
-  if (isPlanMode(ctx))
-    return allow("Plan mode — no changes made, skipping commit check.");
-  const cwd = ctx.session?.cwd;
-  if (!cwd)
-    return allow("No working directory available, skipping commit check.");
-  try {
-    const status = execSync("git status --porcelain", {
-      cwd,
-      encoding: "utf8",
-      stdio: ["pipe", "pipe", "pipe"],
-      timeout: 5000
-    }).trim();
-    if (status.length > 0) {
-      return deny("You have uncommitted changes in the working directory. Commit all changes now.");
-    }
-    return allow("All changes are committed.");
-  } catch {
-    return allow("Not a git repository, skipping commit check.");
-  }
-}
-function requirePushBeforeStop(ctx) {
-  if (isPlanMode(ctx))
-    return allow("Plan mode — no changes made, skipping push check.");
-  const cwd = ctx.session?.cwd;
-  if (!cwd)
-    return allow("No working directory available, skipping push check.");
-  try {
-    const remotes = execSync("git remote", {
-      cwd,
-      encoding: "utf8",
-      stdio: ["pipe", "pipe", "pipe"],
-      timeout: 3000
-    }).trim();
-    if (!remotes)
-      return allow("No git remote configured, skipping push check.");
-    const remote = ctx.params?.remote ?? "origin";
-    const branch = getCurrentBranch(cwd);
-    if (!branch || branch === "HEAD")
-      return allow("Detached HEAD, skipping push check.");
-    const baseBranch = ctx.params?.baseBranch ?? "main";
-    if (branch === baseBranch) {
-      return allow(`On base branch "${baseBranch}", skipping push check.`);
-    }
-    try {
-      const ahead = execFileSync("git", ["log", `${remote}/${baseBranch}..HEAD`, "--oneline"], { cwd, encoding: "utf8", stdio: ["pipe", "pipe", "pipe"], timeout: 5000 }).trim();
-      if (!ahead) {
-        return allow(`No commits ahead of ${remote}/${baseBranch}, skipping push check.`);
-      }
-      const diff = execFileSync("git", ["diff", "--stat", `${remote}/${baseBranch}`, "HEAD"], { cwd, encoding: "utf8", stdio: ["pipe", "pipe", "pipe"], timeout: 5000 }).trim();
-      if (!diff) {
-        return allow(`No file changes compared to ${remote}/${baseBranch}, skipping push check.`);
-      }
-    } catch {}
-    let hasTracking = false;
-    try {
-      execFileSync("git", ["rev-parse", "--verify", `${remote}/${branch}`], {
-        cwd,
-        encoding: "utf8",
-        stdio: ["pipe", "pipe", "pipe"],
-        timeout: 3000
-      });
-      hasTracking = true;
-    } catch {}
-    if (!hasTracking) {
-      return deny(`Branch "${branch}" has not been pushed to remote "${remote}". ` + `Run now: git push -u ${remote} ${branch}`);
-    }
-    const unpushed = execFileSync("git", ["log", `${remote}/${branch}..HEAD`, "--oneline"], {
-      cwd,
-      encoding: "utf8",
-      stdio: ["pipe", "pipe", "pipe"],
-      timeout: 5000
-    }).trim();
-    if (unpushed.length > 0) {
-      const commitCount = unpushed.split(`
-`).length;
-      return deny(`You have ${commitCount} unpushed commit${commitCount > 1 ? "s" : ""} on branch "${branch}". ` + `Run now: git push`);
-    }
-    return allow(`All commits pushed to "${remote}".`);
-  } catch {
-    return allow("Could not check push status, skipping.");
-  }
-}
-function requirePrBeforeStop(ctx) {
-  if (isPlanMode(ctx))
-    return allow("Plan mode — no changes made, skipping PR check.");
-  const cwd = ctx.session?.cwd;
-  if (!cwd)
-    return allow("No working directory available, skipping PR check.");
-  try {
-    try {
-      execSync("gh --version", { cwd, encoding: "utf8", stdio: ["pipe", "pipe", "pipe"], timeout: 3000 });
-    } catch {
-      return allow("GitHub CLI (gh) not installed, skipping PR check.");
-    }
-    const branch = getCurrentBranch(cwd);
-    if (!branch || branch === "HEAD")
-      return allow("Detached HEAD, skipping PR check.");
-    const baseBranch = ctx.params?.baseBranch ?? "main";
-    if (branch === baseBranch) {
-      return allow(`On base branch "${baseBranch}", skipping PR check.`);
-    }
-    try {
-      const ahead = execFileSync("git", ["log", `origin/${baseBranch}..HEAD`, "--oneline"], { cwd, encoding: "utf8", stdio: ["pipe", "pipe", "pipe"], timeout: 5000 }).trim();
-      if (!ahead) {
-        return allow(`No commits ahead of origin/${baseBranch}, skipping PR check.`);
-      }
-      const diff = execFileSync("git", ["diff", "--stat", `origin/${baseBranch}`, "HEAD"], { cwd, encoding: "utf8", stdio: ["pipe", "pipe", "pipe"], timeout: 5000 }).trim();
-      if (!diff) {
-        return allow(`No file changes compared to origin/${baseBranch}, skipping PR check.`);
+// src/hooks/policy-catalog.ts
+var POLICY_CATALOG;
+var init_policy_catalog = __esm(() => {
+  POLICY_CATALOG = [
+    {
+      name: "sanitize-jwt",
+      description: "Stop Claude from reading JWTs in tool responses",
+      displayTitle: "Redacted JWT tokens from tool output",
+      impact: "Stops the agent from echoing auth tokens it saw in command output.",
+      match: { events: ["PostToolUse"] },
+      defaultEnabled: true,
+      category: "Sanitize"
+    },
+    {
+      name: "sanitize-api-keys",
+      description: "Stop Claude from reading API keys (OpenAI, Anthropic, GitHub, AWS, Stripe, Google) in tool responses",
+      displayTitle: "Redacted API keys from tool output",
+      impact: "Catches OpenAI / Anthropic / GitHub / AWS / Stripe / Google keys before the model sees them.",
+      match: { events: ["PostToolUse"] },
+      defaultEnabled: true,
+      category: "Sanitize",
+      params: {
+        additionalPatterns: {
+          type: "pattern[]",
+          description: "Additional API key patterns to scrub, each with { regex, label }",
+          default: []
+        }
       }
-    } catch {}
-    let prJson;
-    try {
-      prJson = execSync("gh pr view --json number,url,state", {
-        cwd,
-        encoding: "utf8",
-        stdio: ["pipe", "pipe", "pipe"],
-        timeout: 15000
-      }).trim();
-    } catch {
-      return deny(`No pull request found for branch "${branch}". ` + `Run now: gh pr create`);
-    }
-    const pr = JSON.parse(prJson);
-    if (pr.state === "OPEN") {
-      return allow(`PR #${pr.number} exists: ${pr.url}`);
-    }
-    if (pr.state === "MERGED") {
-      return allow(`PR #${pr.number} was merged: ${pr.url}. ` + `Switch off this branch (e.g. 'git checkout ${baseBranch} && git pull') before stopping again.`);
-    }
-    return deny(`Pull request for branch "${branch}" is ${pr.state.toLowerCase()}. Run now: gh pr create`);
-  } catch {
-    return allow("Could not check PR status, skipping.");
-  }
-}
-function requireNoConflictsBeforeStop(ctx) {
-  if (isPlanMode(ctx))
-    return allow("Plan mode — no changes made, skipping conflict check.");
-  const cwd = ctx.session?.cwd;
-  if (!cwd)
-    return allow("No working directory available, skipping conflict check.");
-  const branch = getCurrentBranch(cwd);
-  if (!branch || branch === "HEAD")
-    return allow("Detached HEAD, skipping conflict check.");
-  const baseBranch = ctx.params?.baseBranch ?? "main";
-  if (branch === baseBranch) {
-    return allow(`On base branch "${baseBranch}", skipping conflict check.`);
-  }
-  try {
-    execSync("gh --version", { cwd, encoding: "utf8", stdio: ["pipe", "pipe", "pipe"], timeout: 3000 });
-  } catch {
-    return allow("gh CLI not installed, skipping conflict check.");
-  }
-  let prJson;
-  try {
-    prJson = execSync("gh pr view --json mergeable,number,url,state", {
-      cwd,
-      encoding: "utf8",
-      stdio: ["pipe", "pipe", "pipe"],
-      timeout: 15000
-    }).trim();
-  } catch {
-    return allow("No pull request found for branch, skipping conflict check.");
-  }
-  let pr;
-  try {
-    pr = JSON.parse(prJson);
-  } catch {
-    return allow("Could not parse gh pr view output, skipping conflict check.");
-  }
-  if (pr.state !== "OPEN") {
-    return allow(`PR #${pr.number} is ${pr.state.toLowerCase()}; skipping conflict check.`);
-  }
-  try {
-    execFileSync("git", ["rev-parse", "--verify", `origin/${baseBranch}`], {
-      cwd,
-      encoding: "utf8",
-      stdio: ["pipe", "pipe", "pipe"],
-      timeout: 3000
-    });
-    const ahead = execFileSync("git", ["log", `origin/${baseBranch}..HEAD`, "--oneline"], { cwd, encoding: "utf8", stdio: ["pipe", "pipe", "pipe"], timeout: 5000 }).trim();
-    if (ahead) {
-      execFileSync("git", ["merge-tree", "--write-tree", "--name-only", `origin/${baseBranch}`, "HEAD"], { cwd, encoding: "utf8", stdio: ["pipe", "pipe", "pipe"], timeout: 1e4 });
-    }
-  } catch (err) {
-    const e = err;
-    if (e.status === 1) {
-      const out = (typeof e.stdout === "string" ? e.stdout : e.stdout?.toString("utf8") ?? "").trim();
-      const lines = out.split(`
-`);
-      const files = [];
-      for (let i = 1;i < lines.length; i++) {
-        const line = lines[i];
-        if (line === "")
-          break;
-        files.push(line);
+    },
+    {
+      name: "sanitize-connection-strings",
+      description: "Stop Claude from reading database connection strings with embedded credentials in tool responses",
+      displayTitle: "Redacted database connection strings from tool output",
+      impact: "Strips embedded DB credentials before they reach the model context.",
+      match: { events: ["PostToolUse"] },
+      defaultEnabled: true,
+      category: "Sanitize"
+    },
+    {
+      name: "sanitize-private-key-content",
+      description: "Stop Claude from reading PEM private key content in tool responses",
+      displayTitle: "Redacted PEM private keys from tool output",
+      impact: "Prevents private key bodies from being echoed into chat context.",
+      match: { events: ["PostToolUse"] },
+      defaultEnabled: true,
+      category: "Sanitize"
+    },
+    {
+      name: "sanitize-bearer-tokens",
+      displayTitle: "Redacted bearer tokens from tool output",
+      impact: "Strips Authorization: Bearer values before they hit the model.",
+      description: "Stop Claude from reading Authorization Bearer tokens in tool responses",
+      match: { events: ["PostToolUse"] },
+      defaultEnabled: true,
+      category: "Sanitize"
+    },
+    {
+      name: "protect-env-vars",
+      displayTitle: "Tried to dump environment variables to chat",
+      impact: "Env vars often contain secrets; blocking `env` / `printenv` keeps them out of the model context.",
+      description: "Prevent commands that read environment variables",
+      match: { events: ["PreToolUse"], toolNames: ["Bash"] },
+      defaultEnabled: true,
+      category: "Environment"
+    },
+    {
+      name: "block-env-files",
+      displayTitle: "Tried to read or write a .env file",
+      impact: "`.env` files routinely contain API keys and DB credentials.",
+      description: "Block reading/writing .env files",
+      match: { events: ["PreToolUse"] },
+      defaultEnabled: true,
+      category: "Environment"
+    },
+    {
+      name: "block-read-outside-cwd",
+      displayTitle: "Tried to read files outside your project directory",
+      impact: "Stops the agent from peeking at neighboring repos or your home directory.",
+      description: "Block file reads outside the session working directory",
+      match: { events: ["PreToolUse"], toolNames: ["Read", "Glob", "Grep", "Bash"] },
+      defaultEnabled: false,
+      category: "Environment",
+      params: {
+        allowPaths: {
+          type: "string[]",
+          description: "Absolute paths outside cwd that are allowed to be read",
+          default: []
+        }
       }
-      const fileList = files.length ? files.join(", ") : "one or more files";
-      return deny(`Branch "${branch}" has merge conflicts with ${baseBranch} in: ${fileList}. ` + `Rebase or merge origin/${baseBranch} now and resolve the conflicts.`);
-    }
-  }
-  if (pr.mergeable === "CONFLICTING") {
-    return deny(`PR #${pr.number} has merge conflicts per GitHub (${pr.url}). ` + `Rebase or merge origin/${baseBranch} now and resolve the conflicts.`);
-  }
-  if (pr.mergeable === "UNKNOWN") {
-    return deny(`GitHub is still computing mergeability for PR #${pr.number} (${pr.url}). ` + `Wait ~10 seconds, then re-check with \`gh pr view --json mergeable\` before attempting to stop again.`);
-  }
-  return allow(`PR #${pr.number} merges cleanly per GitHub.`);
-}
-function requireCiGreenBeforeStop(ctx) {
-  if (isPlanMode(ctx))
-    return allow("Plan mode — no changes made, skipping CI check.");
-  const cwd = ctx.session?.cwd;
-  if (!cwd)
-    return allow("No working directory available, skipping CI check.");
-  try {
-    try {
-      execSync("gh --version", { cwd, encoding: "utf8", stdio: ["pipe", "pipe", "pipe"], timeout: 3000 });
-    } catch {
-      return allow("GitHub CLI (gh) not installed, skipping CI check.");
-    }
-    const branch = getCurrentBranch(cwd);
-    if (!branch || branch === "HEAD")
-      return allow("Detached HEAD, skipping CI check.");
-    const sha = getHeadSha(cwd);
-    let workflowRuns = [];
-    try {
-      const runsJson = execFileSync("gh", ["run", "list", "--branch", branch, "--limit", "20", "--json", "status,conclusion,name,headSha"], { cwd, encoding: "utf8", stdio: ["pipe", "pipe", "pipe"], timeout: 15000 }).trim();
-      if (runsJson && runsJson !== "[]") {
-        const allWorkflowRuns = JSON.parse(runsJson);
-        const headRuns = sha ? allWorkflowRuns.filter((r) => r.headSha === sha) : allWorkflowRuns;
-        const seen = new Set;
-        workflowRuns = headRuns.filter((r) => {
-          if (seen.has(r.name))
-            return false;
-          seen.add(r.name);
-          return true;
-        });
+    },
+    {
+      name: "block-sudo",
+      displayTitle: "Tried to run a command with sudo",
+      impact: "Sudo gives the agent root — blocked unless explicitly allow-listed.",
+      description: "Block sudo commands",
+      match: { events: ["PreToolUse", "PermissionRequest"], toolNames: ["Bash"] },
+      defaultEnabled: true,
+      category: "Dangerous Commands",
+      params: {
+        allowPatterns: {
+          type: "string[]",
+          description: "Sudo command patterns to allow, matched token-by-token (e.g. 'sudo systemctl status')",
+          default: []
+        }
       }
-    } catch {}
-    let thirdPartyChecks = [];
-    let commitStatuses = [];
-    if (sha) {
-      thirdPartyChecks = getThirdPartyCheckRuns(cwd, sha);
-      commitStatuses = getCommitStatuses(cwd, sha);
-    }
-    const allChecks = [...workflowRuns, ...thirdPartyChecks, ...commitStatuses];
-    if (allChecks.length === 0)
-      return allow(`No CI runs found for branch "${branch}".`);
-    const failing = allChecks.filter((r) => r.status === "completed" && r.conclusion !== "success" && r.conclusion !== "skipped" && r.conclusion !== "cancelled" && r.conclusion !== "neutral");
-    if (failing.length > 0) {
-      const names = failing.map((r) => `"${r.name}"`).join(", ");
-      return deny(`CI checks are failing on branch "${branch}": ${names}. Fix the failing checks now.`);
-    }
-    const pending = allChecks.filter((r) => r.status === "in_progress" || r.status === "queued" || r.status === "waiting");
-    if (pending.length > 0) {
-      const names = pending.map((r) => `"${r.name}"`).join(", ");
-      return deny(`CI checks are still running on branch "${branch}": ${names}. Wait for all checks to complete, then verify they pass.`);
-    }
-    return allow(`All CI checks passed on branch "${branch}".`);
-  } catch {
-    return allow("Could not check CI status, skipping.");
-  }
-}
-function registerBuiltinPolicies(enabledNames) {
-  const enabledSet = new Set(enabledNames.map(normalizePolicyName));
-  for (const policy of BUILTIN_POLICIES) {
-    if (enabledSet.has(normalizePolicyName(policy.name))) {
-      registerPolicy(policy.name, policy.description, policy.fn, policy.match);
-    }
-  }
-}
-var isClaudeInternalPath, isClaudeSettingsFile, SHELL_OPERATORS, SHELL_METACHAR_RE, JWT_RE, API_KEY_PATTERNS, CONNECTION_STRING_RE, PRIVATE_KEY_RE, BEARER_TOKEN_RE, SECRET_PATTERNS, SQL_TOOL_RE, DESTRUCTIVE_SQL_RE, DELETE_NO_WHERE_RE, SQL_WHERE_RE, SCHEMA_ALTER_RE, PUBLISH_CMD_RE, ENV_PRINTENV_RE, ECHO_ENV_RE, EXPORT_RE, PS_ENV_VAR_RE, PS_CHILDITEM_ENV_RE, DOTNET_GETENV_RE, CMD_ECHO_ENV_RE, ENV_FILE_PATH_RE, ENV_CMD_RE, PS_ELEVATION_RE, RUNAS_RE, CURL_PIPE_SH_RE, SEGMENT_SEPARATORS, COMMAND_PREFIX_TOKENS, SELF_BINARY_TOKEN_RE, CONFIG_SUBCOMMAND_RE, PAUSE_FLAG_RE, ENV_ASSIGNMENT_RE, RUNNER_OPERAND_RE, PS_WEB_PIPE_RE, SHORT_FLAG_BUNDLE_RE, SAFE_FORCE_PREFIXES, SECRET_FILE_RE, SECRET_FILE_ID_RSA_RE, SECRET_FILE_CREDENTIALS_RE, GIT_COMMIT_MERGE_RE, FAILPROOFAI_CLI_RE, FAILPROOFAI_UNINSTALL_RE, GIT_AMEND_RE, GIT_STASH_DROP_RE, GIT_ADD_ALL_RE, NPM_GLOBAL_RE, YARN_GLOBAL_RE, PNPM_GLOBAL_RE, BUN_GLOBAL_RE, CARGO_INSTALL_RE, PIP_SYSTEM_RE, PKG_MANAGER_DETECTORS, NOHUP_RE, SCREEN_DETACH_RE, TMUX_DETACH_RE, DISOWN_RE, BACKGROUND_AMPERSAND_RE, KUBECTL_RE, TERRAFORM_RE, AWS_CLI_RE, GCLOUD_RE, AZ_CLI_RE, HELM_RE, GH_PIPELINE_RE, gitBranchCache, GIT_BRANCH_CACHE_MAX_ENTRIES = 500, EVAL_FLAG_RE, HOME_PREFIX_RE, RM_CMD_RE, FIND_CMD_RE, FIND_EXEC_RE, FIND_GLOBAL_OPT_RE, FIND_EXPR_START_RE, SCRATCH_ROOTS, CATASTROPHIC_DEPTH = 2, READ_LIKE_CMDS, TOOL_CALL_TRACKER_MAX_BYTES = 65536, SEGMENT_SPLIT_RE, BUILTIN_POLICIES;
-var init_builtin_policies = __esm(() => {
-  init_hook_logger();
-  isClaudeInternalPath = isAgentInternalPath;
-  isClaudeSettingsFile = isAgentSettingsFile;
-  SHELL_OPERATORS = new Set(["&&", "||", "|", ";"]);
-  SHELL_METACHAR_RE = /[;&<>`$()\\]/;
-  JWT_RE = /eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/;
-  API_KEY_PATTERNS = [
-    [/sk-ant-[A-Za-z0-9\-_]{20,}/, "Anthropic API key"],
-    [/sk-proj-[A-Za-z0-9\-_]{20,}/, "OpenAI project API key"],
-    [/sk-[A-Za-z0-9]{20,}/, "OpenAI API key"],
-    [/ghp_[A-Za-z0-9]{36}/, "GitHub personal access token"],
-    [/github_pat_[A-Za-z0-9_]{82}/, "GitHub fine-grained token"],
-    [/AKIA[A-Z0-9]{16}/, "AWS access key ID"],
-    [/sk_live_[A-Za-z0-9]{24,}/, "Stripe live secret key"],
-    [/sk_test_[A-Za-z0-9]{24,}/, "Stripe test secret key"],
-    [/AIza[0-9A-Za-z\-_]{35}/, "Google API key"]
-  ];
-  CONNECTION_STRING_RE = /(?:postgresql|postgres|mysql|mongodb(?:\+srv)?|redis|amqps?|smtps?):\/\/[^@\s]+@/;
-  PRIVATE_KEY_RE = /-----BEGIN (?:[A-Z]+ )?PRIVATE KEY-----/;
-  BEARER_TOKEN_RE = /Authorization:\s*Bearer\s+[A-Za-z0-9\-._~+/]{20,}/i;
-  SECRET_PATTERNS = [
-    [PRIVATE_KEY_RE, "private key"],
-    [JWT_RE, "JWT"],
-    [BEARER_TOKEN_RE, "bearer token"],
-    [CONNECTION_STRING_RE, "database credentials"],
-    ...API_KEY_PATTERNS
-  ];
-  SQL_TOOL_RE = /\b(?:psql|mysql|sqlite3|pgcli|clickhouse-client)\b/;
-  DESTRUCTIVE_SQL_RE = /\b(?:DROP\s+(?:TABLE|DATABASE|SCHEMA)|TRUNCATE\b)/i;
-  DELETE_NO_WHERE_RE = /\bDELETE\s+FROM\b/i;
-  SQL_WHERE_RE = /\bWHERE\b/i;
-  SCHEMA_ALTER_RE = /\bALTER\s+TABLE\b[\s\S]*\b(?:DROP\s+COLUMN|ADD\s+COLUMN|RENAME\s+(?:COLUMN|TO)|MODIFY\s+COLUMN)\b/i;
-  PUBLISH_CMD_RE = /(?:npm\s+publish|bun\s+publish|pnpm\s+publish|yarn\s+npm\s+publish|twine\s+upload|poetry\s+publish|cargo\s+publish|gem\s+push)\b/;
-  ENV_PRINTENV_RE = /(?:^|\s|;|&&|\|\|)(?:env|printenv)(?:\s|$|;|&&|\|)/;
-  ECHO_ENV_RE = /echo\s+.*\$\{?[A-Za-z_]/;
-  EXPORT_RE = /(?:^|\s|;|&&|\|\|)export\s+\w+/;
-  PS_ENV_VAR_RE = /\$env:[A-Za-z_]/i;
-  PS_CHILDITEM_ENV_RE = /(?:Get-ChildItem|dir|gci|ls)\s+Env:/i;
-  DOTNET_GETENV_RE = /\[Environment\]::GetEnvironment/i;
-  CMD_ECHO_ENV_RE = /echo\s+%[A-Za-z_]/i;
-  ENV_FILE_PATH_RE = /(?:^|[\\/])\.env(?:\.|$)/;
-  ENV_CMD_RE = /\.env(?:\b|\s|$|\.)/;
-  PS_ELEVATION_RE = /Start-Process\s+.*-Verb\s+RunAs/i;
-  RUNAS_RE = /(?:^|;|&&|\|\|)\s*runas\s/i;
-  CURL_PIPE_SH_RE = /(?:curl|wget)\s.*\|\s*(?:sh|bash|zsh|dash|ksh|csh|tcsh|fish|ash)\b/;
-  SEGMENT_SEPARATORS = /[;&|\n\r(){}`]+/;
-  COMMAND_PREFIX_TOKENS = new Set([
-    "npx",
-    "bunx",
-    "pnpx",
-    "npm",
-    "pnpm",
-    "yarn",
-    "dlx",
-    "exec",
-    "run",
-    "node",
-    "bun",
-    "deno",
-    "env",
-    "command",
-    "builtin",
-    "nohup",
-    "setsid",
-    "time",
-    "timeout",
-    "nice",
-    "stdbuf",
-    "xargs",
-    "sudo",
-    "doas",
-    "sh",
-    "bash",
-    "zsh",
-    "dash",
-    "ksh",
-    "fish",
-    "ash"
-  ]);
-  SELF_BINARY_TOKEN_RE = /(?:^|\/)failproofai[^/]*$/;
-  CONFIG_SUBCOMMAND_RE = /^(?:config|configure|setup)$/;
-  PAUSE_FLAG_RE = /^--pause(?:=|$)/;
-  ENV_ASSIGNMENT_RE = /^[A-Za-z_][A-Za-z0-9_]*=/;
-  RUNNER_OPERAND_RE = /^\d+[a-z]*$/i;
-  PS_WEB_PIPE_RE = /(?:Invoke-WebRequest|iwr|Invoke-RestMethod|irm)\s+.*\|\s*(?:Invoke-Expression|iex)/i;
-  SHORT_FLAG_BUNDLE_RE = /^-[a-zA-Z]*f[a-zA-Z]*$/;
-  SAFE_FORCE_PREFIXES = ["--force-with-lease", "--force-if-includes"];
-  SECRET_FILE_RE = /\.(?:pem|key)$/;
-  SECRET_FILE_ID_RSA_RE = /id_rsa/;
-  SECRET_FILE_CREDENTIALS_RE = /credentials/;
-  GIT_COMMIT_MERGE_RE = /git\s+(commit|merge|rebase|cherry-pick)\b/;
-  FAILPROOFAI_CLI_RE = /(?:^|;|&&|\|\||\|)\s*failproofai(?:\s|$)/;
-  FAILPROOFAI_UNINSTALL_RE = /(?:npm\s+(?:uninstall|remove|un|r)\s.*failproofai|bun\s+remove\s.*failproofai|yarn\s+global\s+remove\s+failproofai|pnpm\s+(?:remove|uninstall|un)\s.*failproofai)/;
-  GIT_AMEND_RE = /\bgit\s+commit\b.*--amend\b/;
-  GIT_STASH_DROP_RE = /\bgit\s+stash\s+(?:drop|clear)\b/;
-  GIT_ADD_ALL_RE = /\bgit\s+add\s+(?:-A\b|--all\b|\.(?:\s|$|;|&&|\|\|))/;
-  NPM_GLOBAL_RE = /\bnpm\s+(?:install|i)\b(?=.*(?:\s-g\b|--global\b))/;
-  YARN_GLOBAL_RE = /\byarn\s+global\s+add\b/;
-  PNPM_GLOBAL_RE = /\bpnpm\s+(?:add|install|i)\b(?=.*(?:\s-g\b|--global\b))/;
-  BUN_GLOBAL_RE = /\bbun\s+(?:install|add)\b(?=.*(?:\s-g\b|--global\b))/;
-  CARGO_INSTALL_RE = /\bcargo\s+install\b/;
-  PIP_SYSTEM_RE = /\bpip(?:3)?\s+install\b(?=.*(?:--user\b|--break-system-packages\b))/;
-  PKG_MANAGER_DETECTORS = {
-    pip: [/\bpip\b/, /\bpip3\b/, /\bpython3?\s+-m\s+pip\b/],
-    npm: [/\bnpm\b/, /\bnpx\b/],
-    yarn: [/\byarn\b/],
-    pnpm: [/\bpnpm\b/, /\bpnpx\b/],
-    bun: [/\bbun\b/, /\bbunx\b/],
-    uv: [/\buv\b/],
-    poetry: [/\bpoetry\b/],
-    pipenv: [/\bpipenv\b/],
-    conda: [/\bconda\b/],
-    cargo: [/\bcargo\b/]
-  };
-  NOHUP_RE = /\bnohup\s+\S/;
-  SCREEN_DETACH_RE = /\bscreen\s+-[A-Za-z]*d[A-Za-z]*\b/;
-  TMUX_DETACH_RE = /\btmux\s+(?:new-session|new)\b[^|&;]*-d\b/;
-  DISOWN_RE = /\bdisown\b/;
-  BACKGROUND_AMPERSAND_RE = /(?<![&|])\s?&\s*(?:$|#|;)/;
-  KUBECTL_RE = /(?:^|[;\n]|&&|\|\|?|&)\s*kubectl(?:\s|$)/;
-  TERRAFORM_RE = /(?:^|[;\n]|&&|\|\|?|&)\s*(?:terraform|tofu)(?:\s|$)/;
-  AWS_CLI_RE = /(?:^|[;\n]|&&|\|\|?|&)\s*aws(?:\s|$)/;
-  GCLOUD_RE = /(?:^|[;\n]|&&|\|\|?|&)\s*gcloud(?:\s|$)/;
-  AZ_CLI_RE = /(?:^|[;\n]|&&|\|\|?|&)\s*az(?:\s|$)/;
-  HELM_RE = /(?:^|[;\n]|&&|\|\|?|&)\s*helm(?:\s|$)/;
-  GH_PIPELINE_RE = /(?:^|[;\n]|&&|\|\|?|&)\s*gh\s+(?:workflow\s+(?:run|enable|disable)|run\s+(?:rerun|cancel)|pr\s+merge|release\s+(?:create|delete)|cache\s+delete|secret\s+(?:set|delete))\b/;
-  gitBranchCache = new Map;
-  EVAL_FLAG_RE = /^-{1,2}c$/;
-  HOME_PREFIX_RE = /^(?:~[A-Za-z0-9_.-]*|\$HOME|\$\{HOME\})(?=$|\/)/;
-  RM_CMD_RE = /^(?:\/\S*\/)?rm$/;
-  FIND_CMD_RE = /^(?:\/\S*\/)?find$/;
-  FIND_EXEC_RE = /^-(?:exec|execdir|ok|okdir)$/;
-  FIND_GLOBAL_OPT_RE = /^-(?:[HLP]|D|O\d*)$/;
-  FIND_EXPR_START_RE = /^(?:-|\\?[(!])/;
-  SCRATCH_ROOTS = ["/tmp", "/var/tmp"];
-  READ_LIKE_CMDS = /(?:^|;|&&|\|\||\|)\s*(?:ls|find|cat|head|tail|less|more|wc|file|stat|tree|du)\s/;
-  SEGMENT_SPLIT_RE = /\s*(?:&&|\|\||\||;)\s*/;
-  BUILTIN_POLICIES = [
+    },
+    {
+      name: "block-curl-pipe-sh",
+      displayTitle: "Tried to pipe a downloaded script straight to a shell",
+      impact: "`curl ... | sh` runs unverified remote code on your machine.",
+      description: "Block piping downloads to shell",
+      match: { events: ["PreToolUse"], toolNames: ["Bash"] },
+      defaultEnabled: true,
+      category: "Dangerous Commands"
+    },
+    {
+      name: "block-rm-rf",
+      displayTitle: "Tried to recursively delete a system path",
+      impact: "Catches catastrophic `rm -rf /` and Windows equivalents.",
+      description: "Prevent catastrophic deletions",
+      match: { events: ["PreToolUse"], toolNames: ["Bash"] },
+      defaultEnabled: false,
+      category: "Dangerous Commands",
+      params: {
+        allowPaths: {
+          type: "string[]",
+          description: "Paths that are allowed to be recursively deleted",
+          default: []
+        }
+      }
+    },
     {
-      name: "sanitize-jwt",
-      description: "Stop Claude from reading JWTs in tool responses",
-      displayTitle: "Redacted JWT tokens from tool output",
-      impact: "Stops the agent from echoing auth tokens it saw in command output.",
-      fn: sanitizeJwt,
-      match: { events: ["PostToolUse"] },
+      name: "block-failproofai-commands",
+      displayTitle: "Tried to disable, pause or modify failproofai itself",
+      impact: "An agent that can pause or remove enforcement can switch off every other policy.",
+      description: "Block failproofai CLI commands, self-pause and uninstallation",
+      match: { events: ["PreToolUse", "PermissionRequest"], toolNames: ["Bash"] },
       defaultEnabled: true,
-      category: "Sanitize"
+      alwaysOn: true,
+      category: "Dangerous Commands"
     },
     {
-      name: "sanitize-api-keys",
-      description: "Stop Claude from reading API keys (OpenAI, Anthropic, GitHub, AWS, Stripe, Google) in tool responses",
-      displayTitle: "Redacted API keys from tool output",
-      impact: "Catches OpenAI / Anthropic / GitHub / AWS / Stripe / Google keys before the model sees them.",
-      fn: sanitizeApiKeys,
-      match: { events: ["PostToolUse"] },
-      defaultEnabled: true,
-      category: "Sanitize",
+      name: "block-kubectl",
+      displayTitle: "Tried to run a Kubernetes command",
+      impact: "kubectl can change live cluster state — gated unless allow-listed.",
+      description: "Block kubectl commands (Kubernetes cluster mutations)",
+      match: { events: ["PreToolUse"], toolNames: ["Bash"] },
+      defaultEnabled: false,
+      category: "Infra Commands",
+      params: {
+        allowPatterns: {
+          type: "string[]",
+          description: "kubectl command patterns to allow, matched token-by-token (e.g. 'kubectl get *', 'kubectl describe *')",
+          default: []
+        }
+      }
+    },
+    {
+      name: "block-terraform",
+      displayTitle: "Tried to run a Terraform/OpenTofu command",
+      impact: "Terraform mutates real infrastructure — gated unless allow-listed.",
+      description: "Block terraform and tofu (OpenTofu) commands",
+      match: { events: ["PreToolUse"], toolNames: ["Bash"] },
+      defaultEnabled: false,
+      category: "Infra Commands",
+      params: {
+        allowPatterns: {
+          type: "string[]",
+          description: "terraform/tofu command patterns to allow (e.g. 'terraform plan', 'terraform validate')",
+          default: []
+        }
+      }
+    },
+    {
+      name: "block-aws-cli",
+      displayTitle: "Tried to run an AWS CLI command",
+      impact: "AWS CLI can spend money or break prod — gated.",
+      description: "Block aws CLI commands",
+      match: { events: ["PreToolUse"], toolNames: ["Bash"] },
+      defaultEnabled: false,
+      category: "Infra Commands",
+      params: {
+        allowPatterns: {
+          type: "string[]",
+          description: "aws CLI command patterns to allow (e.g. 'aws s3 ls *', 'aws sts get-caller-identity')",
+          default: []
+        }
+      }
+    },
+    {
+      name: "block-gcloud",
+      displayTitle: "Tried to run a Google Cloud command",
+      impact: "gcloud can spend money or break prod — gated.",
+      description: "Block gcloud (Google Cloud) CLI commands",
+      match: { events: ["PreToolUse"], toolNames: ["Bash"] },
+      defaultEnabled: false,
+      category: "Infra Commands",
+      params: {
+        allowPatterns: {
+          type: "string[]",
+          description: "gcloud command patterns to allow (e.g. 'gcloud auth list', 'gcloud config list')",
+          default: []
+        }
+      }
+    },
+    {
+      name: "block-az-cli",
+      displayTitle: "Tried to run an Azure CLI command",
+      impact: "az can spend money or break prod — gated.",
+      description: "Block az (Azure) CLI commands",
+      match: { events: ["PreToolUse"], toolNames: ["Bash"] },
+      defaultEnabled: false,
+      category: "Infra Commands",
+      params: {
+        allowPatterns: {
+          type: "string[]",
+          description: "az CLI command patterns to allow (e.g. 'az account show', 'az group list')",
+          default: []
+        }
+      }
+    },
+    {
+      name: "block-helm",
+      displayTitle: "Tried to run a Helm command",
+      impact: "Helm releases mutate cluster state — gated.",
+      description: "Block helm commands",
+      match: { events: ["PreToolUse"], toolNames: ["Bash"] },
+      defaultEnabled: false,
+      category: "Infra Commands",
+      params: {
+        allowPatterns: {
+          type: "string[]",
+          description: "helm command patterns to allow (e.g. 'helm list', 'helm status *')",
+          default: []
+        }
+      }
+    },
+    {
+      name: "block-gh-pipeline",
+      displayTitle: "Tried to run a privileged GitHub CLI pipeline command",
+      impact: "Catches `gh workflow run`, `gh pr merge`, `gh secret set`, etc.",
+      description: "Block gh CLI pipeline-trigger subcommands (workflow run, run rerun/cancel, pr merge, release create/delete, cache delete, secret set/delete)",
+      match: { events: ["PreToolUse"], toolNames: ["Bash"] },
+      defaultEnabled: false,
+      category: "Infra Commands",
+      params: {
+        allowPatterns: {
+          type: "string[]",
+          description: "gh pipeline command patterns to allow (e.g. specific scripted invocations); read-only gh subcommands like 'gh pr view' and 'gh run list' are not matched by this policy",
+          default: []
+        }
+      }
+    },
+    {
+      name: "block-secrets-write",
+      displayTitle: "Tried to write a secret-key file",
+      impact: "Stops the agent from creating `.pem`, `id_rsa`, `credentials.json`, etc.",
+      description: "Block writing secret key files",
+      match: { events: ["PreToolUse"], toolNames: ["Write"] },
+      defaultEnabled: false,
+      category: "Dangerous Commands",
       params: {
         additionalPatterns: {
-          type: "pattern[]",
-          description: "Additional API key patterns to scrub, each with { regex, label }",
+          type: "string[]",
+          description: "Additional filename patterns (substrings) to block",
           default: []
         }
       }
     },
     {
-      name: "sanitize-connection-strings",
-      description: "Stop Claude from reading database connection strings with embedded credentials in tool responses",
-      displayTitle: "Redacted database connection strings from tool output",
-      impact: "Strips embedded DB credentials before they reach the model context.",
-      fn: sanitizeConnectionStrings,
-      match: { events: ["PostToolUse"] },
+      name: "block-push-master",
+      displayTitle: "Tried to push directly to main/master",
+      impact: "Direct pushes to a protected branch bypass review.",
+      description: "Block pushing to main/master",
+      match: { events: ["PreToolUse"], toolNames: ["Bash"] },
       defaultEnabled: true,
-      category: "Sanitize"
+      category: "Git",
+      params: {
+        protectedBranches: {
+          type: "string[]",
+          description: "Branch names to protect from direct pushes",
+          default: ["main", "master"]
+        }
+      }
     },
     {
-      name: "sanitize-private-key-content",
-      description: "Stop Claude from reading PEM private key content in tool responses",
-      displayTitle: "Redacted PEM private keys from tool output",
-      impact: "Prevents private key bodies from being echoed into chat context.",
-      fn: sanitizePrivateKeyContent,
-      match: { events: ["PostToolUse"] },
-      defaultEnabled: true,
-      category: "Sanitize"
+      name: "block-force-push",
+      displayTitle: "Tried to force-push",
+      impact: "Force-pushes rewrite history and can clobber teammates' work.",
+      description: "Prevent force-pushing to any branch",
+      match: { events: ["PreToolUse"], toolNames: ["Bash"] },
+      defaultEnabled: false,
+      category: "Git"
     },
     {
-      name: "sanitize-bearer-tokens",
-      displayTitle: "Redacted bearer tokens from tool output",
-      impact: "Strips Authorization: Bearer values before they hit the model.",
-      description: "Stop Claude from reading Authorization Bearer tokens in tool responses",
-      fn: sanitizeBearerTokens,
-      match: { events: ["PostToolUse"] },
-      defaultEnabled: true,
-      category: "Sanitize"
+      name: "block-work-on-main",
+      displayTitle: "Tried to commit or merge on main/master",
+      impact: "Work should land via PR — direct commits skip review.",
+      description: "Block git commits and merges on main/master branch",
+      match: { events: ["PreToolUse"], toolNames: ["Bash"] },
+      defaultEnabled: false,
+      category: "Git",
+      params: {
+        protectedBranches: {
+          type: "string[]",
+          description: "Branch names where commits/merges are blocked",
+          default: ["main", "master"]
+        }
+      }
     },
     {
-      name: "protect-env-vars",
-      displayTitle: "Tried to dump environment variables to chat",
-      impact: "Env vars often contain secrets; blocking `env` / `printenv` keeps them out of the model context.",
-      description: "Prevent commands that read environment variables",
-      fn: protectEnvVars,
+      name: "warn-git-amend",
+      displayTitle: "Used git commit --amend",
+      impact: "Amending after a push rewrites history that others may have pulled.",
+      description: "Warns before amending git commits, which rewrites history",
       match: { events: ["PreToolUse"], toolNames: ["Bash"] },
-      defaultEnabled: true,
-      category: "Environment"
+      defaultEnabled: false,
+      category: "Git"
+    },
+    {
+      name: "warn-git-stash-drop",
+      displayTitle: "Tried to drop or clear git stash",
+      impact: "Stash deletions are permanent and silent.",
+      description: "Warns before permanently deleting stashed changes",
+      match: { events: ["PreToolUse"], toolNames: ["Bash"] },
+      defaultEnabled: false,
+      category: "Git"
+    },
+    {
+      name: "warn-all-files-staged",
+      displayTitle: "Staged all files with git add -A / .",
+      impact: "Wide stages routinely catch generated files or secrets you didn't intend to commit.",
+      description: "Warns before staging all working tree files with git add -A / . / --all",
+      match: { events: ["PreToolUse"], toolNames: ["Bash"] },
+      defaultEnabled: false,
+      category: "Git"
+    },
+    {
+      name: "warn-destructive-sql",
+      displayTitle: "Ran destructive SQL (DROP / TRUNCATE / DELETE without WHERE)",
+      impact: "Easy way to wipe a table by accident.",
+      description: "Warn before executing destructive SQL (DROP/TRUNCATE/DELETE without WHERE) via database clients",
+      match: { events: ["PreToolUse"], toolNames: ["Bash"] },
+      defaultEnabled: false,
+      category: "Database"
+    },
+    {
+      name: "warn-schema-alteration",
+      displayTitle: "Altered a database schema column",
+      impact: "ALTER TABLE operations can lock tables and break readers.",
+      description: "Warns before SQL schema changes (ALTER TABLE with column or rename operations)",
+      match: { events: ["PreToolUse"], toolNames: ["Bash"] },
+      defaultEnabled: false,
+      category: "Database"
+    },
+    {
+      name: "warn-package-publish",
+      displayTitle: "Tried to publish a package",
+      impact: "Publishes are irreversible — `npm publish` / `cargo publish` shouldn't happen without intent.",
+      description: "Warn before publishing packages to public registries (npm, PyPI, crates.io, RubyGems, etc.)",
+      match: { events: ["PreToolUse"], toolNames: ["Bash"] },
+      defaultEnabled: false,
+      category: "Packages & System"
     },
     {
-      name: "block-env-files",
-      displayTitle: "Tried to read or write a .env file",
-      impact: "`.env` files routinely contain API keys and DB credentials.",
-      description: "Block reading/writing .env files",
-      fn: blockEnvFiles,
-      match: { events: ["PreToolUse"] },
-      defaultEnabled: true,
-      category: "Environment"
+      name: "warn-global-package-install",
+      displayTitle: "Installed a package globally",
+      impact: "`npm i -g`, `cargo install`, `pip --user` pollute your machine outside the project.",
+      description: "Warns before installing packages globally (npm -g, cargo install, etc.)",
+      match: { events: ["PreToolUse"], toolNames: ["Bash"] },
+      defaultEnabled: false,
+      category: "Packages & System"
     },
     {
-      name: "block-read-outside-cwd",
-      displayTitle: "Tried to read files outside your project directory",
-      impact: "Stops the agent from peeking at neighboring repos or your home directory.",
-      description: "Block file reads outside the session working directory",
-      fn: blockReadOutsideCwd,
-      match: { events: ["PreToolUse"], toolNames: ["Read", "Glob", "Grep", "Bash"] },
+      name: "prefer-package-manager",
+      displayTitle: "Used a non-preferred package manager",
+      impact: "Mixing package managers creates lockfile churn for your team.",
+      description: "Blocks non-preferred package managers and tells Claude to use an allowed one (e.g., uv instead of pip)",
+      match: { events: ["PreToolUse"], toolNames: ["Bash"] },
       defaultEnabled: false,
-      category: "Environment",
+      category: "Packages & System",
       params: {
-        allowPaths: {
+        allowed: {
           type: "string[]",
-          description: "Absolute paths outside cwd that are allowed to be read",
+          description: "Allowed package manager names (e.g. ['uv', 'bun']). Any detected manager not in this list is blocked.",
+          default: []
+        },
+        blocked: {
+          type: "string[]",
+          description: "Additional manager names to block beyond the built-in list (e.g. ['pdm', 'pipx']).",
           default: []
         }
       }
     },
     {
-      name: "block-self-pause",
-      displayTitle: "Tried to pause failproofai enforcement",
-      impact: "An agent that can pause enforcement can switch off every other policy.",
-      description: "Block agents from pausing failproofai enforcement",
-      fn: blockSelfPause,
-      match: { events: ["PreToolUse", "PermissionRequest"], toolNames: ["Bash"] },
-      defaultEnabled: true,
-      category: "Dangerous Commands"
-    },
-    {
-      name: "block-sudo",
-      displayTitle: "Tried to run a command with sudo",
-      impact: "Sudo gives the agent root — blocked unless explicitly allow-listed.",
-      description: "Block sudo commands",
-      fn: blockSudo,
-      match: { events: ["PreToolUse", "PermissionRequest"], toolNames: ["Bash"] },
-      defaultEnabled: true,
-      category: "Dangerous Commands",
+      name: "warn-large-file-write",
+      displayTitle: "Wrote a file larger than the configured threshold",
+      impact: "Catches accidentally large file writes (logs, binaries, model dumps).",
+      description: "Warn before writing files larger than 1MB (configurable via thresholdKb param)",
+      match: { events: ["PreToolUse"], toolNames: ["Write"] },
+      defaultEnabled: false,
+      category: "Packages & System",
       params: {
-        allowPatterns: {
-          type: "string[]",
-          description: "Sudo command patterns to allow, matched token-by-token (e.g. 'sudo systemctl status')",
-          default: []
+        thresholdKb: {
+          type: "number",
+          description: "File size threshold in KB above which a warning is issued",
+          default: 1024
         }
       }
     },
     {
-      name: "block-curl-pipe-sh",
-      displayTitle: "Tried to pipe a downloaded script straight to a shell",
-      impact: "`curl ... | sh` runs unverified remote code on your machine.",
-      description: "Block piping downloads to shell",
-      fn: blockCurlPipeSh,
+      name: "warn-background-process",
+      displayTitle: "Started a long-lived background process",
+      impact: "Catches `nohup` / `&` / `screen` / `tmux` / `disown` patterns that the agent often forgets to clean up.",
+      description: "Warns before starting detached or background processes",
       match: { events: ["PreToolUse"], toolNames: ["Bash"] },
-      defaultEnabled: true,
-      category: "Dangerous Commands"
+      defaultEnabled: false,
+      category: "Packages & System"
     },
     {
-      name: "block-rm-rf",
-      displayTitle: "Tried to recursively delete a system path",
-      impact: "Catches catastrophic `rm -rf /` and Windows equivalents.",
-      description: "Prevent catastrophic deletions",
-      fn: blockRmRf,
-      match: { events: ["PreToolUse"], toolNames: ["Bash"] },
+      name: "warn-repeated-tool-calls",
+      displayTitle: "Called the same tool 3+ times with identical arguments",
+      impact: "Usually a sign of a stuck loop burning tokens.",
+      description: "Warn when the same tool is called 3+ times with identical parameters",
+      match: { events: ["PreToolUse"] },
       defaultEnabled: false,
-      category: "Dangerous Commands",
+      category: "AI Behavior"
+    },
+    {
+      name: "require-commit-before-stop",
+      displayTitle: "Stopped with uncommitted changes",
+      impact: "Work not in a commit is invisible to teammates and easy to lose.",
+      description: "Require all changes to be committed before Claude stops",
+      match: { events: ["Stop"] },
+      defaultEnabled: false,
+      category: "Workflow"
+    },
+    {
+      name: "require-push-before-stop",
+      displayTitle: "Stopped with unpushed commits",
+      impact: "Local-only commits won't trigger CI or be reviewable.",
+      description: "Require all commits to be pushed to remote before Claude stops",
+      match: { events: ["Stop"] },
+      defaultEnabled: false,
+      category: "Workflow",
       params: {
-        allowPaths: {
-          type: "string[]",
-          description: "Paths that are allowed to be recursively deleted",
-          default: []
+        remote: {
+          type: "string",
+          description: "Remote name to push to (default: origin)",
+          default: "origin"
+        },
+        baseBranch: {
+          type: "string",
+          description: "Base branch to compare against (default: main)",
+          default: "main"
         }
       }
     },
     {
-      name: "block-failproofai-commands",
-      displayTitle: "Tried to disable or modify failproofai itself",
-      impact: "Prevents the agent from turning off the policies that protect you.",
-      description: "Block failproofai CLI commands and uninstallation",
-      fn: blockFailproofaiCommands,
-      match: { events: ["PreToolUse"], toolNames: ["Bash"] },
-      defaultEnabled: true,
-      category: "Dangerous Commands"
-    },
-    {
-      name: "block-kubectl",
-      displayTitle: "Tried to run a Kubernetes command",
-      impact: "kubectl can change live cluster state — gated unless allow-listed.",
-      description: "Block kubectl commands (Kubernetes cluster mutations)",
-      fn: blockKubectl,
-      match: { events: ["PreToolUse"], toolNames: ["Bash"] },
+      name: "require-pr-before-stop",
+      displayTitle: "Stopped without a PR for the branch",
+      impact: "Branches without PRs don't get reviewed.",
+      description: "Require a pull request to exist for the current branch before Claude stops",
+      match: { events: ["Stop"] },
       defaultEnabled: false,
-      category: "Infra Commands",
+      category: "Workflow",
       params: {
-        allowPatterns: {
-          type: "string[]",
-          description: "kubectl command patterns to allow, matched token-by-token (e.g. 'kubectl get *', 'kubectl describe *')",
-          default: []
+        baseBranch: {
+          type: "string",
+          description: "Base branch to compare against (default: main)",
+          default: "main"
         }
       }
     },
     {
-      name: "block-terraform",
-      displayTitle: "Tried to run a Terraform/OpenTofu command",
-      impact: "Terraform mutates real infrastructure — gated unless allow-listed.",
-      description: "Block terraform and tofu (OpenTofu) commands",
-      fn: blockTerraform,
-      match: { events: ["PreToolUse"], toolNames: ["Bash"] },
+      name: "require-no-conflicts-before-stop",
+      displayTitle: "Stopped with a branch that conflicts with main",
+      impact: "Conflicting branches can't merge — surface them early.",
+      description: "Require the current branch to merge cleanly with the base branch before Claude stops",
+      match: { events: ["Stop"] },
       defaultEnabled: false,
-      category: "Infra Commands",
+      category: "Workflow",
       params: {
-        allowPatterns: {
-          type: "string[]",
-          description: "terraform/tofu command patterns to allow (e.g. 'terraform plan', 'terraform validate')",
-          default: []
+        baseBranch: {
+          type: "string",
+          description: "Base branch to check for conflicts against (default: main)",
+          default: "main"
         }
       }
-    },
-    {
-      name: "block-aws-cli",
-      displayTitle: "Tried to run an AWS CLI command",
-      impact: "AWS CLI can spend money or break prod — gated.",
-      description: "Block aws CLI commands",
-      fn: blockAwsCli,
-      match: { events: ["PreToolUse"], toolNames: ["Bash"] },
-      defaultEnabled: false,
-      category: "Infra Commands",
-      params: {
-        allowPatterns: {
-          type: "string[]",
-          description: "aws CLI command patterns to allow (e.g. 'aws s3 ls *', 'aws sts get-caller-identity')",
-          default: []
-        }
+    },
+    {
+      name: "require-ci-green-before-stop",
+      displayTitle: "Stopped with failing CI",
+      impact: "Failing CI blocks deploy.",
+      description: "Require CI checks to pass on the current HEAD commit before Claude stops (ignores stale runs on prior commits)",
+      match: { events: ["Stop"] },
+      defaultEnabled: false,
+      category: "Workflow"
+    }
+  ];
+});
+
+// src/hooks/policy-helpers.ts
+function allow(reason) {
+  return reason ? { decision: "allow", reason } : { decision: "allow" };
+}
+function deny(reason) {
+  return { decision: "deny", reason };
+}
+function instruct(reason) {
+  return { decision: "instruct", reason };
+}
+
+// src/hooks/policy-registry.ts
+function normalizePolicyName(name) {
+  return name.includes("/") ? name : `${DEFAULT_POLICY_NAMESPACE}/${name}`;
+}
+function getIndexCache() {
+  return globalThis[INDEX_CACHE_KEY];
+}
+function setIndexCache(cache) {
+  globalThis[INDEX_CACHE_KEY] = cache;
+}
+function getRegistry() {
+  const g = globalThis;
+  if (!g[REGISTRY_KEY]) {
+    g[REGISTRY_KEY] = [];
+  }
+  return g[REGISTRY_KEY];
+}
+function registerPolicy(name, description, fn, match, priority = 0, params) {
+  const canonical = normalizePolicyName(name);
+  const registry = getRegistry();
+  const idx = registry.findIndex((p) => p.name === canonical);
+  const entry = {
+    name: canonical,
+    description,
+    fn,
+    match,
+    priority,
+    ...params ? { params } : {}
+  };
+  if (idx >= 0) {
+    registry[idx] = entry;
+  } else {
+    registry.push(entry);
+  }
+  setIndexCache(null);
+}
+function getPoliciesForEvent(eventType, toolName) {
+  let cache = getIndexCache();
+  if (!cache) {
+    cache = new Map;
+    setIndexCache(cache);
+  }
+  const key = `${eventType}:${toolName ?? ""}`;
+  const cached = cache.get(key);
+  if (cached)
+    return cached;
+  const result = getRegistry().filter((p) => {
+    if (p.match.events && p.match.events.length > 0) {
+      if (!p.match.events.includes(eventType))
+        return false;
+    }
+    if (p.match.toolNames && p.match.toolNames.length > 0) {
+      if (!toolName || !p.match.toolNames.includes(toolName))
+        return false;
+    }
+    return true;
+  }).sort((a, b) => b.priority - a.priority);
+  cache.set(key, result);
+  return result;
+}
+function clearPolicies() {
+  const g = globalThis;
+  g[REGISTRY_KEY] = [];
+  setIndexCache(null);
+}
+var REGISTRY_KEY = "__FAILPROOFAI_POLICY_REGISTRY__", INDEX_CACHE_KEY = "__FAILPROOFAI_POLICY_INDEX_CACHE__", DEFAULT_POLICY_NAMESPACE = "failproofai";
+
+// src/hooks/builtin-policies.ts
+import { resolve as resolve3, join as join2 } from "node:path";
+import { statSync as statSync3 } from "node:fs";
+import { readFile, writeFile } from "node:fs/promises";
+import { execSync, execFileSync } from "node:child_process";
+import { homedir as homedir3 } from "node:os";
+function isAgentInternalPath(resolved2) {
+  const normResolved = resolved2.replaceAll("\\", "/");
+  for (const dir of [".claude", ".codex", ".copilot", ".cursor", ".opencode", ".pi", ".gemini"]) {
+    const root = join2(homedir3(), dir).replaceAll("\\", "/");
+    if (normResolved === root || normResolved.startsWith(root + "/"))
+      return true;
+  }
+  for (const sub of [join2(".config", "opencode"), join2(".local", "share", "opencode")]) {
+    const root = join2(homedir3(), sub).replaceAll("\\", "/");
+    if (normResolved === root || normResolved.startsWith(root + "/"))
+      return true;
+  }
+  return false;
+}
+function isAgentSettingsFile(resolved2) {
+  if (/[\\/]\.claude[\\/]settings(?:\.[^/\\]+)?\.json$/.test(resolved2))
+    return true;
+  if (/[\\/]\.codex[\\/]hooks\.json$/.test(resolved2))
+    return true;
+  if (/[\\/]\.copilot[\\/]hooks[\\/][^/\\]+\.json$/.test(resolved2))
+    return true;
+  if (/[\\/]\.github[\\/]hooks[\\/][^/\\]+\.json$/.test(resolved2))
+    return true;
+  if (/[\\/]\.cursor[\\/]hooks\.json$/.test(resolved2))
+    return true;
+  if (/[\\/]\.opencode[\\/]opencode\.jsonc?$/.test(resolved2))
+    return true;
+  if (/[\\/]\.opencode[\\/]plugins[\\/][^/\\]+\.(?:mjs|js|ts)$/.test(resolved2))
+    return true;
+  if (/[\\/]\.config[\\/]opencode[\\/]opencode\.jsonc?$/.test(resolved2))
+    return true;
+  if (/[\\/]\.config[\\/]opencode[\\/]config\.json$/.test(resolved2))
+    return true;
+  if (/[\\/]\.config[\\/]opencode[\\/]plugins[\\/][^/\\]+\.(?:mjs|js|ts)$/.test(resolved2))
+    return true;
+  if (/[\\/]\.pi[\\/](?:agent[\\/])?settings\.json$/.test(resolved2))
+    return true;
+  if (/[\\/]\.pi[\\/](?:agent[\\/])?extensions[\\/]/.test(resolved2))
+    return true;
+  if (/[\\/]\.gemini[\\/]settings\.json$/.test(resolved2))
+    return true;
+  if (/[\\/]\.gemini[\\/]config[\\/]hooks\.json$/.test(resolved2))
+    return true;
+  return false;
+}
+function getCommand(ctx) {
+  return ctx.toolInput?.command ?? "";
+}
+function getFilePath(ctx) {
+  return ctx.toolInput?.file_path ?? "";
+}
+function parseArgvTokens(cmd) {
+  return cmd.trim().split(/\s+/).map((t) => t.replace(/^['"]|['"]$/g, ""));
+}
+function classifySelfInvocation(raw) {
+  const command = raw.replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g, "$$$1");
+  let found = null;
+  const selfVars = new Set;
+  for (const [, name, value] of command.matchAll(/(?:^|[\s;&|])([A-Za-z_][A-Za-z0-9_]*)=("[^"]*"|'[^']*'|[^\s;&|]+)/g)) {
+    const bare = value.replace(/^["']|["']$/g, "");
+    if (SELF_BINARY_TOKEN_RE.test(bare) || SELF_ENTRY_PATH_RE.test(bare))
+      selfVars.add(name);
+  }
+  const isSelfVarRef = (token) => {
+    const m = /^\$\{?([A-Za-z_][A-Za-z0-9_]*)\}?$/.exec(token);
+    return m ? selfVars.has(m[1]) : false;
+  };
+  for (const segment of command.split(SEGMENT_SEPARATORS)) {
+    const tokens = segment.split(/\s+/).filter(Boolean);
+    let i = 0;
+    while (i < tokens.length) {
+      const token = tokens[i];
+      const isSkippable = ENV_ASSIGNMENT_RE.test(token) || token.startsWith("-") || token.startsWith(">") || token.startsWith("<") || RUNNER_OPERAND_RE.test(token) || COMMAND_PREFIX_TOKENS.has(token.slice(token.lastIndexOf("/") + 1));
+      if (!isSkippable)
+        break;
+      i++;
+    }
+    if (i >= tokens.length)
+      continue;
+    if (!SELF_BINARY_TOKEN_RE.test(tokens[i]) && !SELF_ENTRY_PATH_RE.test(tokens[i]) && !isSelfVarRef(tokens[i])) {
+      continue;
+    }
+    const args = tokens.slice(i + 1);
+    const configAt = args.findIndex((a) => CONFIG_SUBCOMMAND_RE.test(a));
+    if (configAt !== -1 && args.slice(configAt + 1).some((a) => PAUSE_FLAG_RE.test(a))) {
+      return "pause";
+    }
+    found = "cli";
+  }
+  return found;
+}
+function decodeAnsiC(body) {
+  return body.replace(/\\(x[0-9A-Fa-f]{1,2}|u[0-9A-Fa-f]{1,4}|U[0-9A-Fa-f]{1,8}|[0-7]{1,3}|.)/g, (_, seq) => {
+    try {
+      if (seq[0] === "x")
+        return String.fromCharCode(parseInt(seq.slice(1), 16));
+      if (seq[0] === "u" || seq[0] === "U")
+        return String.fromCodePoint(parseInt(seq.slice(1), 16));
+      if (/^[0-7]+$/.test(seq))
+        return String.fromCharCode(parseInt(seq, 8));
+    } catch {
+      return seq;
+    }
+    const named = {
+      a: "\x07",
+      b: "\b",
+      e: "\x1B",
+      f: "\f",
+      n: `
+`,
+      r: "\r",
+      t: "\t",
+      v: "\v",
+      "\\": "\\",
+      "'": "'",
+      '"': '"',
+      "?": "?"
+    };
+    return named[seq] ?? seq;
+  });
+}
+function stripShellQuoting(command) {
+  const joined = command.replace(/\\\r?\n/g, "");
+  const ansiDecoded = joined.replace(/\$'((?:[^'\\]|\\.)*)'/g, (_, body) => decodeAnsiC(body));
+  return ansiDecoded.replace(/\\(.)/g, "$1").replace(/['"]/g, "");
+}
+function statGitHeadMtimeMs(cwd) {
+  try {
+    return statSync3(join2(cwd, ".git", "HEAD")).mtimeMs;
+  } catch {
+    return null;
+  }
+}
+function getCurrentBranch(cwd) {
+  try {
+    const headMtimeMs = statGitHeadMtimeMs(cwd);
+    const cached = gitBranchCache.get(cwd);
+    if (cached && headMtimeMs !== null && cached.headMtimeMs === headMtimeMs) {
+      return cached.branch || null;
+    }
+    const branch = execSync("git rev-parse --abbrev-ref HEAD", {
+      cwd,
+      encoding: "utf8",
+      stdio: ["pipe", "pipe", "pipe"],
+      timeout: 3000
+    }).trim();
+    if (headMtimeMs !== null) {
+      if (gitBranchCache.size >= GIT_BRANCH_CACHE_MAX_ENTRIES)
+        gitBranchCache.clear();
+      gitBranchCache.set(cwd, { branch, headMtimeMs });
+    }
+    return branch || null;
+  } catch {
+    return null;
+  }
+}
+function getHeadSha(cwd) {
+  try {
+    const sha = execSync("git rev-parse HEAD", {
+      cwd,
+      encoding: "utf8",
+      stdio: ["pipe", "pipe", "pipe"],
+      timeout: 3000
+    }).trim();
+    return sha || null;
+  } catch {
+    return null;
+  }
+}
+function getThirdPartyCheckRuns(cwd, sha) {
+  try {
+    const json = execFileSync("gh", [
+      "api",
+      `repos/{owner}/{repo}/commits/${sha}/check-runs`,
+      "--jq",
+      '.check_runs | map(select(.app.slug != "github-actions")) | map({name: .name, status: .status, conclusion: (.conclusion // "")})'
+    ], {
+      cwd,
+      encoding: "utf8",
+      stdio: ["pipe", "pipe", "pipe"],
+      timeout: 15000
+    }).trim();
+    if (!json || json === "[]")
+      return [];
+    return JSON.parse(json);
+  } catch {
+    return [];
+  }
+}
+function getCommitStatuses(cwd, sha) {
+  try {
+    const json = execFileSync("gh", [
+      "api",
+      `repos/{owner}/{repo}/commits/${sha}/statuses`,
+      "--jq",
+      "map({name: .context, state: .state}) | unique_by(.name)"
+    ], {
+      cwd,
+      encoding: "utf8",
+      stdio: ["pipe", "pipe", "pipe"],
+      timeout: 15000
+    }).trim();
+    if (!json || json === "[]")
+      return [];
+    const statuses = JSON.parse(json);
+    return statuses.map((s) => ({
+      name: s.name,
+      status: s.state === "pending" ? "in_progress" : "completed",
+      conclusion: s.state === "pending" ? "" : s.state === "success" ? "success" : "failure"
+    }));
+  } catch {
+    return [];
+  }
+}
+function matchesAllowedPattern(cmd, pattern) {
+  const cmdTokens = parseArgvTokens(cmd);
+  const patTokens = parseArgvTokens(pattern);
+  if (cmdTokens.length < patTokens.length)
+    return false;
+  if (cmdTokens.some((tok) => SHELL_OPERATORS.has(tok)))
+    return false;
+  if (cmdTokens.some((tok) => SHELL_METACHAR_RE.test(tok)))
+    return false;
+  return patTokens.every((tok, i) => tok === "*" || tok === cmdTokens[i]);
+}
+function sanitizeJwt(ctx) {
+  const output = JSON.stringify(ctx.payload);
+  if (JWT_RE.test(output)) {
+    return {
+      decision: "deny",
+      reason: "JWT token detected in tool output",
+      message: "[REDACTED: JWT token removed by failproofai]"
+    };
+  }
+  return allow();
+}
+function sanitizeApiKeys(ctx) {
+  const output = JSON.stringify(ctx.payload);
+  for (const [pattern, label] of API_KEY_PATTERNS) {
+    if (pattern.test(output)) {
+      return {
+        decision: "deny",
+        reason: `${label} detected in tool output`,
+        message: `[REDACTED: ${label} removed by failproofai]`
+      };
+    }
+  }
+  const additional = ctx.params?.additionalPatterns ?? [];
+  for (const { regex, label } of additional) {
+    try {
+      if (new RegExp(regex).test(output)) {
+        return {
+          decision: "deny",
+          reason: `${label} detected in tool output`,
+          message: `[REDACTED: ${label} removed by failproofai]`
+        };
+      }
+    } catch {
+      hookLogWarn(`additionalPatterns: invalid regex "${regex}", skipping`);
+    }
+  }
+  return allow();
+}
+function sanitizeConnectionStrings(ctx) {
+  const output = JSON.stringify(ctx.payload);
+  if (CONNECTION_STRING_RE.test(output)) {
+    return {
+      decision: "deny",
+      reason: "Database connection string with credentials detected in tool output",
+      message: "[REDACTED: connection string removed by failproofai]"
+    };
+  }
+  return allow();
+}
+function sanitizePrivateKeyContent(ctx) {
+  const output = JSON.stringify(ctx.payload);
+  if (PRIVATE_KEY_RE.test(output)) {
+    return {
+      decision: "deny",
+      reason: "Private key content detected in tool output",
+      message: "[REDACTED: private key content removed by failproofai]"
+    };
+  }
+  return allow();
+}
+function sanitizeBearerTokens(ctx) {
+  const output = JSON.stringify(ctx.payload);
+  if (BEARER_TOKEN_RE.test(output)) {
+    return {
+      decision: "deny",
+      reason: "Bearer token detected in tool output",
+      message: "[REDACTED: Bearer token removed by failproofai]"
+    };
+  }
+  return allow();
+}
+function warnDestructiveSql(ctx) {
+  if (ctx.toolName !== "Bash")
+    return allow();
+  const cmd = getCommand(ctx);
+  if (!SQL_TOOL_RE.test(cmd))
+    return allow();
+  if (DESTRUCTIVE_SQL_RE.test(cmd)) {
+    return instruct("STOP: This command contains destructive SQL (DROP/TRUNCATE/DELETE). Confirm with the user before executing.");
+  }
+  if (DELETE_NO_WHERE_RE.test(cmd) && !SQL_WHERE_RE.test(cmd)) {
+    return instruct("STOP: This command contains destructive SQL (DROP/TRUNCATE/DELETE). Confirm with the user before executing.");
+  }
+  return allow();
+}
+function warnLargeFileWrite(ctx) {
+  if (ctx.toolName !== "Write")
+    return allow();
+  const content = ctx.toolInput?.content;
+  if (typeof content !== "string")
+    return allow();
+  const thresholdKb = ctx.params?.thresholdKb ?? 1024;
+  const thresholdBytes = thresholdKb * 1024;
+  if (content.length > thresholdBytes) {
+    return instruct(`STOP: You are writing a file larger than ${thresholdKb}KB (${Math.round(content.length / 1024)}KB). This is unusually large. Confirm this is intentional before proceeding.`);
+  }
+  return allow();
+}
+function warnPackagePublish(ctx) {
+  if (ctx.toolName !== "Bash")
+    return allow();
+  const cmd = getCommand(ctx);
+  if (PUBLISH_CMD_RE.test(cmd)) {
+    return instruct("STOP: This command publishes a package to a public registry. Confirm with the user that this is intentional.");
+  }
+  return allow();
+}
+function protectEnvVars(ctx) {
+  if (ctx.toolName !== "Bash")
+    return allow();
+  const cmd = getCommand(ctx);
+  if (ENV_PRINTENV_RE.test(cmd)) {
+    return deny("Command reads environment variables");
+  }
+  if (ECHO_ENV_RE.test(cmd)) {
+    return deny("Command echoes environment variable");
+  }
+  if (EXPORT_RE.test(cmd)) {
+    return deny("Command exports environment variable");
+  }
+  if (PS_ENV_VAR_RE.test(cmd)) {
+    return deny("Command reads environment variable via PowerShell");
+  }
+  if (PS_CHILDITEM_ENV_RE.test(cmd)) {
+    return deny("Command reads environment variables via PowerShell");
+  }
+  if (DOTNET_GETENV_RE.test(cmd)) {
+    return deny("Command reads environment variable via .NET");
+  }
+  if (CMD_ECHO_ENV_RE.test(cmd)) {
+    return deny("Command echoes environment variable via cmd");
+  }
+  return allow();
+}
+function blockEnvFiles(ctx) {
+  const cmd = getCommand(ctx);
+  const filePath = getFilePath(ctx);
+  if (filePath && ENV_FILE_PATH_RE.test(filePath)) {
+    return deny("Access to .env file blocked");
+  }
+  if (ctx.toolName === "Bash" && ENV_CMD_RE.test(cmd)) {
+    return deny("Command references .env file");
+  }
+  return allow();
+}
+function quoteAwareSegments(command) {
+  const segments = [];
+  let tokens = [];
+  let token = "";
+  let quote = null;
+  const endToken = () => {
+    if (token)
+      tokens.push(token);
+    token = "";
+  };
+  const endSegment = () => {
+    endToken();
+    if (tokens.length)
+      segments.push(tokens);
+    tokens = [];
+  };
+  for (let i = 0;i < command.length; i++) {
+    const c = command[i];
+    if (quote) {
+      if (c === "\\" && quote === '"' && i + 1 < command.length) {
+        token += command[++i];
+        continue;
       }
-    },
-    {
-      name: "block-gcloud",
-      displayTitle: "Tried to run a Google Cloud command",
-      impact: "gcloud can spend money or break prod — gated.",
-      description: "Block gcloud (Google Cloud) CLI commands",
-      fn: blockGcloud,
-      match: { events: ["PreToolUse"], toolNames: ["Bash"] },
-      defaultEnabled: false,
-      category: "Infra Commands",
-      params: {
-        allowPatterns: {
-          type: "string[]",
-          description: "gcloud command patterns to allow (e.g. 'gcloud auth list', 'gcloud config list')",
-          default: []
-        }
+      if (c === quote) {
+        quote = null;
+        continue;
       }
-    },
-    {
-      name: "block-az-cli",
-      displayTitle: "Tried to run an Azure CLI command",
-      impact: "az can spend money or break prod — gated.",
-      description: "Block az (Azure) CLI commands",
-      fn: blockAzCli,
-      match: { events: ["PreToolUse"], toolNames: ["Bash"] },
-      defaultEnabled: false,
-      category: "Infra Commands",
-      params: {
-        allowPatterns: {
-          type: "string[]",
-          description: "az CLI command patterns to allow (e.g. 'az account show', 'az group list')",
-          default: []
-        }
+      token += c;
+      continue;
+    }
+    if (c === "\\" && i + 1 < command.length) {
+      token += command[++i];
+      continue;
+    }
+    if (c === '"' || c === "'") {
+      quote = c;
+      continue;
+    }
+    if (/\s/.test(c)) {
+      endToken();
+      continue;
+    }
+    if (/[;&|\n\r(){}`]/.test(c)) {
+      endSegment();
+      continue;
+    }
+    token += c;
+  }
+  endSegment();
+  return segments;
+}
+function namesElevation(command, depth = 0) {
+  for (const tokens of quoteAwareSegments(command)) {
+    let i = 0;
+    while (i < tokens.length) {
+      const token = tokens[i];
+      const base = token.slice(token.lastIndexOf("/") + 1);
+      if (base === "sudo" || base === "doas")
+        return true;
+      const isSkippable = ENV_ASSIGNMENT_RE.test(token) || token.startsWith("-") || token.startsWith(">") || token.startsWith("<") || RUNNER_OPERAND_RE.test(token) || COMMAND_PREFIX_TOKENS.has(base);
+      if (!isSkippable)
+        break;
+      if (EVAL_FLAG_RE.test(token) && depth < 3 && i + 1 < tokens.length) {
+        if (namesElevation(tokens[i + 1], depth + 1))
+          return true;
       }
-    },
-    {
-      name: "block-helm",
-      displayTitle: "Tried to run a Helm command",
-      impact: "Helm releases mutate cluster state — gated.",
-      description: "Block helm commands",
-      fn: blockHelm,
-      match: { events: ["PreToolUse"], toolNames: ["Bash"] },
-      defaultEnabled: false,
-      category: "Infra Commands",
-      params: {
-        allowPatterns: {
-          type: "string[]",
-          description: "helm command patterns to allow (e.g. 'helm list', 'helm status *')",
-          default: []
-        }
+      i++;
+    }
+  }
+  return false;
+}
+function blockSudo(ctx) {
+  if (ctx.toolName !== "Bash")
+    return allow();
+  const cmd = getCommand(ctx).trimStart();
+  if (namesElevation(cmd)) {
+    const allowPatterns = ctx.params?.allowPatterns ?? [];
+    if (allowPatterns.some((p) => matchesAllowedPattern(cmd, p)))
+      return allow();
+    return deny("sudo commands are blocked");
+  }
+  if (PS_ELEVATION_RE.test(cmd)) {
+    return deny("Elevated process launch is blocked");
+  }
+  if (RUNAS_RE.test(cmd)) {
+    return deny("runas elevation is blocked");
+  }
+  return allow();
+}
+function blockCurlPipeSh(ctx) {
+  if (ctx.toolName !== "Bash")
+    return allow();
+  const cmd = getCommand(ctx);
+  if (CURL_PIPE_SH_RE.test(cmd)) {
+    return deny("Piping downloads to shell is blocked");
+  }
+  if (PS_WEB_PIPE_RE.test(cmd)) {
+    return deny("Piping downloads to Invoke-Expression is blocked");
+  }
+  return allow();
+}
+function extractGitPushArgs(cmd) {
+  return cmd.split(/&&|\|\||[|;\n]/).map((s) => s.trim()).filter((s) => /^git\s+push\s/.test(s)).map((s) => s.replace(/^git\s+push\s+/, ""));
+}
+function blockPushMaster(ctx) {
+  if (ctx.toolName !== "Bash")
+    return allow();
+  const protectedBranches = ctx.params?.protectedBranches ?? ["main", "master"];
+  if (protectedBranches.length === 0)
+    return allow();
+  const args = extractGitPushArgs(getCommand(ctx));
+  const branchPattern = new RegExp(`\\b(?:${protectedBranches.map((b) => b.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|")})\\b`);
+  if (args.some((a) => branchPattern.test(a))) {
+    return deny(`Pushing to ${protectedBranches.join("/")} is blocked`);
+  }
+  return allow();
+}
+function expandHomePrefix(path) {
+  const m = path.match(/^(?:~|\$HOME|\$\{HOME\})(?=$|\/)/);
+  return m ? homedir3() + path.slice(m[0].length) : path;
+}
+function stripTrailingGlob(path) {
+  return path.replace(/\/\*$/, "").replace(/\/+$/, "");
+}
+function isCatastrophicTarget(token) {
+  const raw = token.replace(/^['"]|['"]$/g, "");
+  if (raw === "")
+    return false;
+  const homePrefix = raw.match(HOME_PREFIX_RE);
+  if (!homePrefix && /^[$`]/.test(raw))
+    return true;
+  const belowRoot = homePrefix ? raw.slice(homePrefix[0].length) : raw.startsWith("/") ? raw : null;
+  if (belowRoot === null)
+    return false;
+  const segments = stripTrailingGlob(belowRoot).split("/").filter(Boolean);
+  if (!homePrefix && SCRATCH_ROOTS.some((r) => `/${segments.join("/")}`.startsWith(`${r}/`)))
+    return false;
+  return segments.length <= CATASTROPHIC_DEPTH;
+}
+function recursiveDeletionTargets(seg) {
+  const tokens = parseArgvTokens(seg);
+  const findIdx = tokens.findIndex((t) => FIND_CMD_RE.test(t));
+  if (findIdx >= 0) {
+    const expr = tokens.slice(findIdx + 1);
+    const execIdx = expr.findIndex((t) => FIND_EXEC_RE.test(t));
+    const deletes = expr.includes("-delete") || execIdx >= 0 && RM_CMD_RE.test(expr[execIdx + 1] ?? "");
+    if (deletes) {
+      let start = 0;
+      while (start < expr.length && FIND_GLOBAL_OPT_RE.test(expr[start])) {
+        start += expr[start] === "-D" ? 2 : 1;
       }
-    },
-    {
-      name: "block-gh-pipeline",
-      displayTitle: "Tried to run a privileged GitHub CLI pipeline command",
-      impact: "Catches `gh workflow run`, `gh pr merge`, `gh secret set`, etc.",
-      description: "Block gh CLI pipeline-trigger subcommands (workflow run, run rerun/cancel, pr merge, release create/delete, cache delete, secret set/delete)",
-      fn: blockGhPipeline,
-      match: { events: ["PreToolUse"], toolNames: ["Bash"] },
-      defaultEnabled: false,
-      category: "Infra Commands",
-      params: {
-        allowPatterns: {
-          type: "string[]",
-          description: "gh pipeline command patterns to allow (e.g. specific scripted invocations); read-only gh subcommands like 'gh pr view' and 'gh run list' are not matched by this policy",
-          default: []
-        }
+      const rest = expr.slice(start);
+      const end = rest.findIndex((t) => FIND_EXPR_START_RE.test(t));
+      return end < 0 ? rest : rest.slice(0, end);
+    }
+  }
+  const rmIdx = tokens.findIndex((t) => RM_CMD_RE.test(t));
+  if (rmIdx >= 0) {
+    const args = tokens.slice(rmIdx + 1);
+    const shortFlags = args.filter((t) => /^-[^-]/.test(t)).join("");
+    const longFlags = args.filter((t) => /^--/.test(t));
+    const recursive = /r/i.test(shortFlags) || longFlags.some((f) => /^--recursive$/i.test(f));
+    const force = /f/.test(shortFlags) || longFlags.some((f) => /^--force$/i.test(f));
+    if (recursive && force)
+      return args.filter((t) => !t.startsWith("-"));
+  }
+  return null;
+}
+function shellSegments(cmd) {
+  return cmd.split(/&&|\|\||[|;\n]/).map((s) => s.trim()).filter((s) => s !== "");
+}
+function deletionTargetIsAllowed(cmd, allowPaths) {
+  if (allowPaths.length === 0)
+    return false;
+  const normalizedAllowPaths = allowPaths.map((p) => stripTrailingGlob(expandHomePrefix(p)) || "/");
+  let sawRecursiveDelete = false;
+  for (const seg of shellSegments(cmd)) {
+    const targets = recursiveDeletionTargets(seg);
+    if (targets === null)
+      continue;
+    sawRecursiveDelete = true;
+    for (const target of targets) {
+      const normalized = stripTrailingGlob(expandHomePrefix(target)) || "/";
+      const covered = normalizedAllowPaths.some((np) => normalized === np || normalized.startsWith(np + "/"));
+      if (!covered) {
+        const segCovered = allowPaths.some((p) => {
+          const escaped = p.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+          return new RegExp(`${escaped}(?:[/"'\\s/*]|$)`).test(seg);
+        });
+        if (!segCovered)
+          return false;
       }
-    },
-    {
-      name: "block-secrets-write",
-      displayTitle: "Tried to write a secret-key file",
-      impact: "Stops the agent from creating `.pem`, `id_rsa`, `credentials.json`, etc.",
-      description: "Block writing secret key files",
-      fn: blockSecretsWrite,
-      match: { events: ["PreToolUse"], toolNames: ["Write"] },
-      defaultEnabled: false,
-      category: "Dangerous Commands",
-      params: {
-        additionalPatterns: {
-          type: "string[]",
-          description: "Additional filename patterns (substrings) to block",
-          default: []
-        }
+    }
+  }
+  return sawRecursiveDelete;
+}
+function blockRmRf(ctx) {
+  if (ctx.toolName !== "Bash")
+    return allow();
+  const cmd = getCommand(ctx);
+  const hasCatastrophicTarget = shellSegments(cmd).some((seg) => {
+    const targets = recursiveDeletionTargets(seg);
+    return targets !== null && targets.some(isCatastrophicTarget);
+  });
+  if (hasCatastrophicTarget) {
+    const allowPaths = ctx.params?.allowPaths ?? [];
+    if (deletionTargetIsAllowed(cmd, allowPaths))
+      return allow();
+    return deny("Catastrophic deletion blocked");
+  }
+  if (/Remove-Item\s+.*-Recurse.*-Force.*(?:[A-Z]:\\(?:\s|$)|\\\*)/i.test(cmd)) {
+    return deny("Catastrophic deletion blocked");
+  }
+  if (/(?:rd|rmdir)\s+\/s\s+\/q\s+[A-Z]:\\/i.test(cmd)) {
+    return deny("Catastrophic deletion blocked");
+  }
+  return allow();
+}
+function blockForcePush(ctx) {
+  if (ctx.toolName !== "Bash")
+    return allow();
+  for (const segment of extractGitPushArgs(getCommand(ctx))) {
+    let sawEndOfOptions = false;
+    for (const token of segment.split(/\s+/)) {
+      if (token === "--") {
+        sawEndOfOptions = true;
+        continue;
       }
-    },
-    {
-      name: "block-push-master",
-      displayTitle: "Tried to push directly to main/master",
-      impact: "Direct pushes to a protected branch bypass review.",
-      description: "Block pushing to main/master",
-      fn: blockPushMaster,
-      match: { events: ["PreToolUse"], toolNames: ["Bash"] },
-      defaultEnabled: true,
-      category: "Git",
-      params: {
-        protectedBranches: {
-          type: "string[]",
-          description: "Branch names to protect from direct pushes",
-          default: ["main", "master"]
-        }
+      if (sawEndOfOptions)
+        continue;
+      if (isForcePushFlag(token)) {
+        return deny("Force-pushing is blocked");
       }
-    },
-    {
-      name: "block-force-push",
-      displayTitle: "Tried to force-push",
-      impact: "Force-pushes rewrite history and can clobber teammates' work.",
-      description: "Prevent force-pushing to any branch",
-      fn: blockForcePush,
-      match: { events: ["PreToolUse"], toolNames: ["Bash"] },
-      defaultEnabled: false,
-      category: "Git"
-    },
-    {
-      name: "block-work-on-main",
-      displayTitle: "Tried to commit or merge on main/master",
-      impact: "Work should land via PR — direct commits skip review.",
-      description: "Block git commits and merges on main/master branch",
-      fn: blockWorkOnMain,
-      match: { events: ["PreToolUse"], toolNames: ["Bash"] },
-      defaultEnabled: false,
-      category: "Git",
-      params: {
-        protectedBranches: {
-          type: "string[]",
-          description: "Branch names where commits/merges are blocked",
-          default: ["main", "master"]
-        }
+    }
+  }
+  return allow();
+}
+function isForcePushFlag(token) {
+  if (token === "--force")
+    return true;
+  if (SAFE_FORCE_PREFIXES.some((prefix) => token.startsWith(prefix)))
+    return false;
+  if (token.startsWith("--force"))
+    return true;
+  return SHORT_FLAG_BUNDLE_RE.test(token);
+}
+function blockSecretsWrite(ctx) {
+  if (ctx.toolName !== "Write")
+    return allow();
+  const filePath = getFilePath(ctx);
+  if (SECRET_FILE_RE.test(filePath) || SECRET_FILE_ID_RSA_RE.test(filePath) || SECRET_FILE_CREDENTIALS_RE.test(filePath)) {
+    return deny("Writing secret key files is blocked");
+  }
+  const additionalPatterns = ctx.params?.additionalPatterns ?? [];
+  for (const pattern of additionalPatterns) {
+    if (filePath.includes(pattern)) {
+      return deny(`Writing blocked file pattern: ${pattern}`);
+    }
+  }
+  return allow();
+}
+function extractAbsolutePaths(command) {
+  const paths = [];
+  const pathRe = /(?<![a-zA-Z0-9_.\-~\\*?:=])(?:~\/[^\s;|&"'()\[\]{}]*|~(?=\s|$|[;|&"'()\[\]{}])|\/[^\s;|&"'()\[\]{}]*)/g;
+  function addPaths(s) {
+    pathRe.lastIndex = 0;
+    let m;
+    while ((m = pathRe.exec(s)) !== null) {
+      let p = m[0];
+      if (p === "~")
+        p = homedir3();
+      else if (p.startsWith("~/"))
+        p = join2(homedir3(), p.slice(2));
+      paths.push(p);
+    }
+  }
+  let firstBarePipe = command.length;
+  let inDouble = false, inSingle = false;
+  for (let i = 0;i < command.length; i++) {
+    const c = command[i];
+    if (c === '"' && !inSingle)
+      inDouble = !inDouble;
+    else if (c === "'" && !inDouble)
+      inSingle = !inSingle;
+    else if (c === "|" && !inDouble && !inSingle) {
+      firstBarePipe = i;
+      break;
+    }
+  }
+  const firstSegment = command.slice(0, firstBarePipe);
+  const quotedRe = /"([^"]*)"|'([^']*)'/g;
+  let qm;
+  while ((qm = quotedRe.exec(firstSegment)) !== null) {
+    const content = qm[1] ?? qm[2] ?? "";
+    if (/[*?\[\]^$+()\\]/.test(content))
+      continue;
+    addPaths(content);
+  }
+  const stripped = command.replace(/"[^"]*"/g, (m) => " ".repeat(m.length)).replace(/'[^']*'/g, (m) => " ".repeat(m.length));
+  addPaths(stripped);
+  return paths;
+}
+function blockReadOutsideCwd(ctx) {
+  const cwd = process.env.CLAUDE_PROJECT_DIR || ctx.session?.cwd;
+  if (!cwd)
+    return allow();
+  const allowPaths = ctx.params?.allowPaths ?? [];
+  if (ctx.toolName === "Bash") {
+    const cmd = getCommand(ctx);
+    if (!READ_LIKE_CMDS.test(cmd))
+      return allow();
+    const paths = extractAbsolutePaths(cmd);
+    const cwdWithSep2 = cwd.endsWith("/") ? cwd : cwd + "/";
+    for (const p of paths) {
+      const resolved3 = resolve3(cwd, p);
+      if (isClaudeSettingsFile(resolved3)) {
+        return deny(`Reading agent settings file blocked: ${resolved3}`);
       }
-    },
-    {
-      name: "warn-git-amend",
-      displayTitle: "Used git commit --amend",
-      impact: "Amending after a push rewrites history that others may have pulled.",
-      description: "Warns before amending git commits, which rewrites history",
-      fn: warnGitAmend,
-      match: { events: ["PreToolUse"], toolNames: ["Bash"] },
-      defaultEnabled: false,
-      category: "Git"
-    },
-    {
-      name: "warn-git-stash-drop",
-      displayTitle: "Tried to drop or clear git stash",
-      impact: "Stash deletions are permanent and silent.",
-      description: "Warns before permanently deleting stashed changes",
-      fn: warnGitStashDrop,
-      match: { events: ["PreToolUse"], toolNames: ["Bash"] },
-      defaultEnabled: false,
-      category: "Git"
-    },
-    {
-      name: "warn-all-files-staged",
-      displayTitle: "Staged all files with git add -A / .",
-      impact: "Wide stages routinely catch generated files or secrets you didn't intend to commit.",
-      description: "Warns before staging all working tree files with git add -A / . / --all",
-      fn: warnAllFilesStaged,
-      match: { events: ["PreToolUse"], toolNames: ["Bash"] },
-      defaultEnabled: false,
-      category: "Git"
-    },
-    {
-      name: "warn-destructive-sql",
-      displayTitle: "Ran destructive SQL (DROP / TRUNCATE / DELETE without WHERE)",
-      impact: "Easy way to wipe a table by accident.",
-      description: "Warn before executing destructive SQL (DROP/TRUNCATE/DELETE without WHERE) via database clients",
-      fn: warnDestructiveSql,
-      match: { events: ["PreToolUse"], toolNames: ["Bash"] },
-      defaultEnabled: false,
-      category: "Database"
-    },
-    {
-      name: "warn-schema-alteration",
-      displayTitle: "Altered a database schema column",
-      impact: "ALTER TABLE operations can lock tables and break readers.",
-      description: "Warns before SQL schema changes (ALTER TABLE with column or rename operations)",
-      fn: warnSchemaAlteration,
-      match: { events: ["PreToolUse"], toolNames: ["Bash"] },
-      defaultEnabled: false,
-      category: "Database"
-    },
-    {
-      name: "warn-package-publish",
-      displayTitle: "Tried to publish a package",
-      impact: "Publishes are irreversible — `npm publish` / `cargo publish` shouldn't happen without intent.",
-      description: "Warn before publishing packages to public registries (npm, PyPI, crates.io, RubyGems, etc.)",
-      fn: warnPackagePublish,
-      match: { events: ["PreToolUse"], toolNames: ["Bash"] },
-      defaultEnabled: false,
-      category: "Packages & System"
-    },
-    {
-      name: "warn-global-package-install",
-      displayTitle: "Installed a package globally",
-      impact: "`npm i -g`, `cargo install`, `pip --user` pollute your machine outside the project.",
-      description: "Warns before installing packages globally (npm -g, cargo install, etc.)",
-      fn: warnGlobalPackageInstall,
-      match: { events: ["PreToolUse"], toolNames: ["Bash"] },
-      defaultEnabled: false,
-      category: "Packages & System"
-    },
-    {
-      name: "prefer-package-manager",
-      displayTitle: "Used a non-preferred package manager",
-      impact: "Mixing package managers creates lockfile churn for your team.",
-      description: "Blocks non-preferred package managers and tells Claude to use an allowed one (e.g., uv instead of pip)",
-      fn: preferPackageManager,
-      match: { events: ["PreToolUse"], toolNames: ["Bash"] },
-      defaultEnabled: false,
-      category: "Packages & System",
-      params: {
-        allowed: {
-          type: "string[]",
-          description: "Allowed package manager names (e.g. ['uv', 'bun']). Any detected manager not in this list is blocked.",
-          default: []
-        },
-        blocked: {
-          type: "string[]",
-          description: "Additional manager names to block beyond the built-in list (e.g. ['pdm', 'pipx']).",
-          default: []
+      if (isClaudeInternalPath(resolved3))
+        continue;
+      if (resolved3 === "/dev/null")
+        continue;
+      if (resolved3 !== cwd && !resolved3.startsWith(cwdWithSep2)) {
+        if (allowPaths.some((ap) => resolved3 === ap || resolved3.startsWith(ap.endsWith("/") ? ap : ap + "/")))
+          continue;
+        return deny(`Bash read outside project directory blocked: ${resolved3}`);
+      }
+    }
+    return allow();
+  }
+  const filePath = getFilePath(ctx);
+  const searchPath = ctx.toolInput?.path ?? "";
+  const target = filePath || searchPath;
+  if (!target)
+    return allow();
+  const resolved2 = resolve3(cwd, target);
+  if (isClaudeSettingsFile(resolved2)) {
+    return deny(`Reading agent settings file blocked: ${resolved2}`);
+  }
+  if (isClaudeInternalPath(resolved2))
+    return allow();
+  if (resolved2 === "/dev/null")
+    return allow();
+  const cwdWithSep = cwd.endsWith("/") ? cwd : cwd + "/";
+  if (resolved2 !== cwd && !resolved2.startsWith(cwdWithSep)) {
+    if (allowPaths.some((ap) => resolved2 === ap || resolved2.startsWith(ap.endsWith("/") ? ap : ap + "/")))
+      return allow();
+    return deny(`Access outside project directory blocked: ${resolved2}`);
+  }
+  return allow();
+}
+function blockWorkOnMain(ctx) {
+  if (ctx.toolName !== "Bash")
+    return allow();
+  const cmd = getCommand(ctx);
+  const match = cmd.match(GIT_COMMIT_MERGE_RE);
+  if (!match)
+    return allow();
+  const cwd = ctx.session?.cwd;
+  if (!cwd)
+    return allow();
+  const branch = getCurrentBranch(cwd);
+  if (!branch)
+    return allow();
+  const protectedBranches = ctx.params?.protectedBranches ?? ["main", "master"];
+  if (protectedBranches.includes(branch)) {
+    return deny(`Git ${match[1]} on ${branch} is blocked. Create a feature branch first.`);
+  }
+  return allow();
+}
+function blockFailproofaiCommands(ctx) {
+  if (ctx.toolName !== "Bash")
+    return allow();
+  const cmd = getCommand(ctx);
+  const unescaped = stripShellQuoting(cmd);
+  const kind = classifySelfInvocation(cmd) ?? classifySelfInvocation(unescaped);
+  if (kind === "pause") {
+    return deny("Pausing failproofai enforcement is a human action, not an agent one. " + "If a policy is blocking legitimate work, say so and let the operator decide.");
+  }
+  if (kind === "cli") {
+    return deny("Running failproofai CLI commands is blocked");
+  }
+  if (FAILPROOFAI_UNINSTALL_RE.test(cmd) || FAILPROOFAI_UNINSTALL_RE.test(unescaped)) {
+    return deny("Uninstalling failproofai is blocked");
+  }
+  if (FAILPROOFAI_STATE_WRITE_RE.test(cmd) || FAILPROOFAI_STATE_WRITE_RE.test(unescaped)) {
+    return deny("Deleting or moving failproofai's own state would switch enforcement off. " + "If a policy is blocking legitimate work, say so and let the operator decide.");
+  }
+  return allow();
+}
+function blockInfraCli(ctx, re, denyMsg) {
+  if (ctx.toolName !== "Bash")
+    return allow();
+  const cmd = getCommand(ctx);
+  if (!re.test(cmd))
+    return allow();
+  const allowPatterns = ctx.params?.allowPatterns ?? [];
+  if (allowPatterns.some((p) => matchesAllowedPattern(cmd, p)))
+    return allow();
+  return deny(denyMsg);
+}
+function blockKubectl(ctx) {
+  return blockInfraCli(ctx, KUBECTL_RE, "kubectl commands are blocked");
+}
+function blockTerraform(ctx) {
+  return blockInfraCli(ctx, TERRAFORM_RE, "terraform/tofu commands are blocked");
+}
+function blockAwsCli(ctx) {
+  return blockInfraCli(ctx, AWS_CLI_RE, "aws CLI commands are blocked");
+}
+function blockGcloud(ctx) {
+  return blockInfraCli(ctx, GCLOUD_RE, "gcloud commands are blocked");
+}
+function blockAzCli(ctx) {
+  return blockInfraCli(ctx, AZ_CLI_RE, "az (Azure) CLI commands are blocked");
+}
+function blockHelm(ctx) {
+  return blockInfraCli(ctx, HELM_RE, "helm commands are blocked");
+}
+function blockGhPipeline(ctx) {
+  return blockInfraCli(ctx, GH_PIPELINE_RE, "gh pipeline-trigger commands are blocked");
+}
+async function warnRepeatedToolCalls(ctx) {
+  const THRESHOLD = 3;
+  const transcriptPath = ctx.session?.transcriptPath;
+  if (!transcriptPath || !ctx.toolName || !ctx.toolInput)
+    return allow();
+  const trackerPath = `${transcriptPath}.tool-calls.json`;
+  const fingerprint = JSON.stringify({ tool: ctx.toolName, input: ctx.toolInput });
+  let counts = {};
+  try {
+    const raw = await readFile(trackerPath, "utf8");
+    counts = JSON.parse(raw);
+  } catch {}
+  const prevCount = counts[fingerprint] ?? 0;
+  if (prevCount >= THRESHOLD) {
+    return instruct(`STOP: You have already called ${ctx.toolName} ${prevCount} times with identical parameters. This is wasteful and unproductive. Do NOT repeat this call — use a different approach or ask the user for clarification.`);
+  }
+  counts[fingerprint] = prevCount + 1;
+  try {
+    const serialized = JSON.stringify(counts);
+    if (serialized.length <= TOOL_CALL_TRACKER_MAX_BYTES) {
+      await writeFile(trackerPath, serialized, "utf8");
+    }
+  } catch {}
+  return allow();
+}
+function warnGitAmend(ctx) {
+  if (ctx.toolName !== "Bash")
+    return allow();
+  const cmd = getCommand(ctx);
+  if (GIT_AMEND_RE.test(cmd)) {
+    return instruct("STOP: This command amends the last commit, which rewrites git history. If this commit has already been pushed to a shared branch, this will cause divergence for other contributors. Confirm with the user before executing.");
+  }
+  return allow();
+}
+function warnGitStashDrop(ctx) {
+  if (ctx.toolName !== "Bash")
+    return allow();
+  const cmd = getCommand(ctx);
+  if (GIT_STASH_DROP_RE.test(cmd)) {
+    return instruct("STOP: This command permanently deletes stashed changes (git stash drop/clear). Stash entries cannot be recovered after deletion. Confirm with the user before executing.");
+  }
+  return allow();
+}
+function warnAllFilesStaged(ctx) {
+  if (ctx.toolName !== "Bash")
+    return allow();
+  const cmd = getCommand(ctx);
+  if (GIT_ADD_ALL_RE.test(cmd)) {
+    return instruct("STOP: This command stages all files in the working tree (git add -A / --all / .). This may inadvertently include build artifacts, generated files, or sensitive files not covered by .gitignore. Confirm with the user before executing.");
+  }
+  return allow();
+}
+function warnSchemaAlteration(ctx) {
+  if (ctx.toolName !== "Bash")
+    return allow();
+  const cmd = getCommand(ctx);
+  if (!SQL_TOOL_RE.test(cmd))
+    return allow();
+  if (SCHEMA_ALTER_RE.test(cmd)) {
+    return instruct("STOP: This command contains a schema-altering SQL statement (ALTER TABLE with column or rename operation). Schema changes on production databases are irreversible or disruptive. Confirm with the user before executing.");
+  }
+  return allow();
+}
+function warnGlobalPackageInstall(ctx) {
+  if (ctx.toolName !== "Bash")
+    return allow();
+  const cmd = getCommand(ctx);
+  const isGlobal = NPM_GLOBAL_RE.test(cmd) || YARN_GLOBAL_RE.test(cmd) || PNPM_GLOBAL_RE.test(cmd) || BUN_GLOBAL_RE.test(cmd) || CARGO_INSTALL_RE.test(cmd) || PIP_SYSTEM_RE.test(cmd);
+  if (isGlobal) {
+    return instruct("STOP: This command installs a package globally, which modifies the system-wide environment outside the project. This can conflict with other projects or system tools. Confirm with the user before executing.");
+  }
+  return allow();
+}
+function preferPackageManager(ctx) {
+  if (ctx.toolName !== "Bash")
+    return allow();
+  const cmd = getCommand(ctx);
+  if (!cmd)
+    return allow();
+  const allowed = ctx.params?.allowed ?? [];
+  if (allowed.length === 0)
+    return allow();
+  const allowedSet = new Set(allowed.map((a) => a.toLowerCase()));
+  const blocked = ctx.params?.blocked ?? [];
+  const allowedList = allowed.join(", ");
+  const segments = cmd.split(SEGMENT_SPLIT_RE);
+  for (const segment of segments) {
+    const trimmed = segment.trim();
+    if (!trimmed)
+      continue;
+    let segmentAllowed = false;
+    for (const manager of allowedSet) {
+      const patterns = PKG_MANAGER_DETECTORS[manager];
+      if (!patterns)
+        continue;
+      for (const pattern of patterns) {
+        if (pattern.test(trimmed)) {
+          segmentAllowed = true;
+          break;
         }
       }
-    },
-    {
-      name: "warn-large-file-write",
-      displayTitle: "Wrote a file larger than the configured threshold",
-      impact: "Catches accidentally large file writes (logs, binaries, model dumps).",
-      description: "Warn before writing files larger than 1MB (configurable via thresholdKb param)",
-      fn: warnLargeFileWrite,
-      match: { events: ["PreToolUse"], toolNames: ["Write"] },
-      defaultEnabled: false,
-      category: "Packages & System",
-      params: {
-        thresholdKb: {
-          type: "number",
-          description: "File size threshold in KB above which a warning is issued",
-          default: 1024
+      if (segmentAllowed)
+        break;
+    }
+    if (segmentAllowed)
+      continue;
+    for (const [manager, patterns] of Object.entries(PKG_MANAGER_DETECTORS)) {
+      if (allowedSet.has(manager))
+        continue;
+      for (const pattern of patterns) {
+        if (pattern.test(trimmed)) {
+          return deny(`"${manager}" is not an allowed package manager. ` + `Allowed package managers for this project: ${allowedList}. ` + `Rewrite this command using an allowed package manager.`);
         }
       }
-    },
-    {
-      name: "warn-background-process",
-      displayTitle: "Started a long-lived background process",
-      impact: "Catches `nohup` / `&` / `screen` / `tmux` / `disown` patterns that the agent often forgets to clean up.",
-      description: "Warns before starting detached or background processes",
-      fn: warnBackgroundProcess,
-      match: { events: ["PreToolUse"], toolNames: ["Bash"] },
-      defaultEnabled: false,
-      category: "Packages & System"
-    },
-    {
-      name: "warn-repeated-tool-calls",
-      displayTitle: "Called the same tool 3+ times with identical arguments",
-      impact: "Usually a sign of a stuck loop burning tokens.",
-      description: "Warn when the same tool is called 3+ times with identical parameters",
-      fn: warnRepeatedToolCalls,
-      match: { events: ["PreToolUse"] },
-      defaultEnabled: false,
-      category: "AI Behavior"
-    },
-    {
-      name: "require-commit-before-stop",
-      displayTitle: "Stopped with uncommitted changes",
-      impact: "Work not in a commit is invisible to teammates and easy to lose.",
-      description: "Require all changes to be committed before Claude stops",
-      fn: requireCommitBeforeStop,
-      match: { events: ["Stop"] },
-      defaultEnabled: false,
-      category: "Workflow"
-    },
-    {
-      name: "require-push-before-stop",
-      displayTitle: "Stopped with unpushed commits",
-      impact: "Local-only commits won't trigger CI or be reviewable.",
-      description: "Require all commits to be pushed to remote before Claude stops",
-      fn: requirePushBeforeStop,
-      match: { events: ["Stop"] },
-      defaultEnabled: false,
-      category: "Workflow",
-      params: {
-        remote: {
-          type: "string",
-          description: "Remote name to push to (default: origin)",
-          default: "origin"
-        },
-        baseBranch: {
-          type: "string",
-          description: "Base branch to compare against (default: main)",
-          default: "main"
-        }
+    }
+    for (const name of blocked) {
+      const lower = name.toLowerCase();
+      if (allowedSet.has(lower))
+        continue;
+      const re = new RegExp(`\\b${lower.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}\\b`);
+      if (re.test(trimmed)) {
+        return deny(`"${lower}" is not an allowed package manager. ` + `Allowed package managers for this project: ${allowedList}. ` + `Rewrite this command using an allowed package manager.`);
       }
-    },
-    {
-      name: "require-pr-before-stop",
-      displayTitle: "Stopped without a PR for the branch",
-      impact: "Branches without PRs don't get reviewed.",
-      description: "Require a pull request to exist for the current branch before Claude stops",
-      fn: requirePrBeforeStop,
-      match: { events: ["Stop"] },
-      defaultEnabled: false,
-      category: "Workflow",
-      params: {
-        baseBranch: {
-          type: "string",
-          description: "Base branch to compare against (default: main)",
-          default: "main"
-        }
+    }
+  }
+  return allow();
+}
+function warnBackgroundProcess(ctx) {
+  if (ctx.toolName !== "Bash")
+    return allow();
+  const cmd = getCommand(ctx);
+  const isBackground = NOHUP_RE.test(cmd) || SCREEN_DETACH_RE.test(cmd) || TMUX_DETACH_RE.test(cmd) || DISOWN_RE.test(cmd) || BACKGROUND_AMPERSAND_RE.test(cmd);
+  if (isBackground) {
+    return instruct("STOP: This command starts a background or detached process (nohup, screen -d, tmux -d, or trailing &). Background processes persist after Claude's session and may be difficult to track or stop. Confirm with the user before executing.");
+  }
+  return allow();
+}
+function isPlanMode(ctx) {
+  return ctx.session?.permissionMode === "plan";
+}
+function requireCommitBeforeStop(ctx) {
+  if (isPlanMode(ctx))
+    return allow("Plan mode — no changes made, skipping commit check.");
+  const cwd = ctx.session?.cwd;
+  if (!cwd)
+    return allow("No working directory available, skipping commit check.");
+  try {
+    const status = execSync("git status --porcelain", {
+      cwd,
+      encoding: "utf8",
+      stdio: ["pipe", "pipe", "pipe"],
+      timeout: 5000
+    }).trim();
+    if (status.length > 0) {
+      return deny("You have uncommitted changes in the working directory. Commit all changes now.");
+    }
+    return allow("All changes are committed.");
+  } catch {
+    return allow("Not a git repository, skipping commit check.");
+  }
+}
+function requirePushBeforeStop(ctx) {
+  if (isPlanMode(ctx))
+    return allow("Plan mode — no changes made, skipping push check.");
+  const cwd = ctx.session?.cwd;
+  if (!cwd)
+    return allow("No working directory available, skipping push check.");
+  try {
+    const remotes = execSync("git remote", {
+      cwd,
+      encoding: "utf8",
+      stdio: ["pipe", "pipe", "pipe"],
+      timeout: 3000
+    }).trim();
+    if (!remotes)
+      return allow("No git remote configured, skipping push check.");
+    const remote = ctx.params?.remote ?? "origin";
+    const branch = getCurrentBranch(cwd);
+    if (!branch || branch === "HEAD")
+      return allow("Detached HEAD, skipping push check.");
+    const baseBranch = ctx.params?.baseBranch ?? "main";
+    if (branch === baseBranch) {
+      return allow(`On base branch "${baseBranch}", skipping push check.`);
+    }
+    try {
+      const ahead = execFileSync("git", ["log", `${remote}/${baseBranch}..HEAD`, "--oneline"], { cwd, encoding: "utf8", stdio: ["pipe", "pipe", "pipe"], timeout: 5000 }).trim();
+      if (!ahead) {
+        return allow(`No commits ahead of ${remote}/${baseBranch}, skipping push check.`);
+      }
+      const diff = execFileSync("git", ["diff", "--stat", `${remote}/${baseBranch}`, "HEAD"], { cwd, encoding: "utf8", stdio: ["pipe", "pipe", "pipe"], timeout: 5000 }).trim();
+      if (!diff) {
+        return allow(`No file changes compared to ${remote}/${baseBranch}, skipping push check.`);
+      }
+    } catch {}
+    let hasTracking = false;
+    try {
+      execFileSync("git", ["rev-parse", "--verify", `${remote}/${branch}`], {
+        cwd,
+        encoding: "utf8",
+        stdio: ["pipe", "pipe", "pipe"],
+        timeout: 3000
+      });
+      hasTracking = true;
+    } catch {}
+    if (!hasTracking) {
+      return deny(`Branch "${branch}" has not been pushed to remote "${remote}". ` + `Run now: git push -u ${remote} ${branch}`);
+    }
+    const unpushed = execFileSync("git", ["log", `${remote}/${branch}..HEAD`, "--oneline"], {
+      cwd,
+      encoding: "utf8",
+      stdio: ["pipe", "pipe", "pipe"],
+      timeout: 5000
+    }).trim();
+    if (unpushed.length > 0) {
+      const commitCount = unpushed.split(`
+`).length;
+      return deny(`You have ${commitCount} unpushed commit${commitCount > 1 ? "s" : ""} on branch "${branch}". ` + `Run now: git push`);
+    }
+    return allow(`All commits pushed to "${remote}".`);
+  } catch {
+    return allow("Could not check push status, skipping.");
+  }
+}
+function requirePrBeforeStop(ctx) {
+  if (isPlanMode(ctx))
+    return allow("Plan mode — no changes made, skipping PR check.");
+  const cwd = ctx.session?.cwd;
+  if (!cwd)
+    return allow("No working directory available, skipping PR check.");
+  try {
+    try {
+      execSync("gh --version", { cwd, encoding: "utf8", stdio: ["pipe", "pipe", "pipe"], timeout: 3000 });
+    } catch {
+      return allow("GitHub CLI (gh) not installed, skipping PR check.");
+    }
+    const branch = getCurrentBranch(cwd);
+    if (!branch || branch === "HEAD")
+      return allow("Detached HEAD, skipping PR check.");
+    const baseBranch = ctx.params?.baseBranch ?? "main";
+    if (branch === baseBranch) {
+      return allow(`On base branch "${baseBranch}", skipping PR check.`);
+    }
+    try {
+      const ahead = execFileSync("git", ["log", `origin/${baseBranch}..HEAD`, "--oneline"], { cwd, encoding: "utf8", stdio: ["pipe", "pipe", "pipe"], timeout: 5000 }).trim();
+      if (!ahead) {
+        return allow(`No commits ahead of origin/${baseBranch}, skipping PR check.`);
       }
-    },
-    {
-      name: "require-no-conflicts-before-stop",
-      displayTitle: "Stopped with a branch that conflicts with main",
-      impact: "Conflicting branches can't merge — surface them early.",
-      description: "Require the current branch to merge cleanly with the base branch before Claude stops",
-      fn: requireNoConflictsBeforeStop,
-      match: { events: ["Stop"] },
-      defaultEnabled: false,
-      category: "Workflow",
-      params: {
-        baseBranch: {
-          type: "string",
-          description: "Base branch to check for conflicts against (default: main)",
-          default: "main"
-        }
+      const diff = execFileSync("git", ["diff", "--stat", `origin/${baseBranch}`, "HEAD"], { cwd, encoding: "utf8", stdio: ["pipe", "pipe", "pipe"], timeout: 5000 }).trim();
+      if (!diff) {
+        return allow(`No file changes compared to origin/${baseBranch}, skipping PR check.`);
       }
-    },
-    {
-      name: "require-ci-green-before-stop",
-      displayTitle: "Stopped with failing CI",
-      impact: "Failing CI blocks deploy.",
-      description: "Require CI checks to pass on the current HEAD commit before Claude stops (ignores stale runs on prior commits)",
-      fn: requireCiGreenBeforeStop,
-      match: { events: ["Stop"] },
-      defaultEnabled: false,
-      category: "Workflow"
+    } catch {}
+    let prJson;
+    try {
+      prJson = execSync("gh pr view --json number,url,state", {
+        cwd,
+        encoding: "utf8",
+        stdio: ["pipe", "pipe", "pipe"],
+        timeout: 15000
+      }).trim();
+    } catch {
+      return deny(`No pull request found for branch "${branch}". ` + `Run now: gh pr create`);
+    }
+    const pr = JSON.parse(prJson);
+    if (pr.state === "OPEN") {
+      return allow(`PR #${pr.number} exists: ${pr.url}`);
+    }
+    if (pr.state === "MERGED") {
+      return allow(`PR #${pr.number} was merged: ${pr.url}. ` + `Switch off this branch (e.g. 'git checkout ${baseBranch} && git pull') before stopping again.`);
+    }
+    return deny(`Pull request for branch "${branch}" is ${pr.state.toLowerCase()}. Run now: gh pr create`);
+  } catch {
+    return allow("Could not check PR status, skipping.");
+  }
+}
+function requireNoConflictsBeforeStop(ctx) {
+  if (isPlanMode(ctx))
+    return allow("Plan mode — no changes made, skipping conflict check.");
+  const cwd = ctx.session?.cwd;
+  if (!cwd)
+    return allow("No working directory available, skipping conflict check.");
+  const branch = getCurrentBranch(cwd);
+  if (!branch || branch === "HEAD")
+    return allow("Detached HEAD, skipping conflict check.");
+  const baseBranch = ctx.params?.baseBranch ?? "main";
+  if (branch === baseBranch) {
+    return allow(`On base branch "${baseBranch}", skipping conflict check.`);
+  }
+  try {
+    execSync("gh --version", { cwd, encoding: "utf8", stdio: ["pipe", "pipe", "pipe"], timeout: 3000 });
+  } catch {
+    return allow("gh CLI not installed, skipping conflict check.");
+  }
+  let prJson;
+  try {
+    prJson = execSync("gh pr view --json mergeable,number,url,state", {
+      cwd,
+      encoding: "utf8",
+      stdio: ["pipe", "pipe", "pipe"],
+      timeout: 15000
+    }).trim();
+  } catch {
+    return allow("No pull request found for branch, skipping conflict check.");
+  }
+  let pr;
+  try {
+    pr = JSON.parse(prJson);
+  } catch {
+    return allow("Could not parse gh pr view output, skipping conflict check.");
+  }
+  if (pr.state !== "OPEN") {
+    return allow(`PR #${pr.number} is ${pr.state.toLowerCase()}; skipping conflict check.`);
+  }
+  try {
+    execFileSync("git", ["rev-parse", "--verify", `origin/${baseBranch}`], {
+      cwd,
+      encoding: "utf8",
+      stdio: ["pipe", "pipe", "pipe"],
+      timeout: 3000
+    });
+    const ahead = execFileSync("git", ["log", `origin/${baseBranch}..HEAD`, "--oneline"], { cwd, encoding: "utf8", stdio: ["pipe", "pipe", "pipe"], timeout: 5000 }).trim();
+    if (ahead) {
+      execFileSync("git", ["merge-tree", "--write-tree", "--name-only", `origin/${baseBranch}`, "HEAD"], { cwd, encoding: "utf8", stdio: ["pipe", "pipe", "pipe"], timeout: 1e4 });
+    }
+  } catch (err) {
+    const e = err;
+    if (e.status === 1) {
+      const out = (typeof e.stdout === "string" ? e.stdout : e.stdout?.toString("utf8") ?? "").trim();
+      const lines = out.split(`
+`);
+      const files = [];
+      for (let i = 1;i < lines.length; i++) {
+        const line = lines[i];
+        if (line === "")
+          break;
+        files.push(line);
+      }
+      const fileList = files.length ? files.join(", ") : "one or more files";
+      return deny(`Branch "${branch}" has merge conflicts with ${baseBranch} in: ${fileList}. ` + `Rebase or merge origin/${baseBranch} now and resolve the conflicts.`);
+    }
+  }
+  if (pr.mergeable === "CONFLICTING") {
+    return deny(`PR #${pr.number} has merge conflicts per GitHub (${pr.url}). ` + `Rebase or merge origin/${baseBranch} now and resolve the conflicts.`);
+  }
+  if (pr.mergeable === "UNKNOWN") {
+    return deny(`GitHub is still computing mergeability for PR #${pr.number} (${pr.url}). ` + `Wait ~10 seconds, then re-check with \`gh pr view --json mergeable\` before attempting to stop again.`);
+  }
+  return allow(`PR #${pr.number} merges cleanly per GitHub.`);
+}
+function requireCiGreenBeforeStop(ctx) {
+  if (isPlanMode(ctx))
+    return allow("Plan mode — no changes made, skipping CI check.");
+  const cwd = ctx.session?.cwd;
+  if (!cwd)
+    return allow("No working directory available, skipping CI check.");
+  try {
+    try {
+      execSync("gh --version", { cwd, encoding: "utf8", stdio: ["pipe", "pipe", "pipe"], timeout: 3000 });
+    } catch {
+      return allow("GitHub CLI (gh) not installed, skipping CI check.");
+    }
+    const branch = getCurrentBranch(cwd);
+    if (!branch || branch === "HEAD")
+      return allow("Detached HEAD, skipping CI check.");
+    const sha = getHeadSha(cwd);
+    let workflowRuns = [];
+    try {
+      const runsJson = execFileSync("gh", ["run", "list", "--branch", branch, "--limit", "20", "--json", "status,conclusion,name,headSha"], { cwd, encoding: "utf8", stdio: ["pipe", "pipe", "pipe"], timeout: 15000 }).trim();
+      if (runsJson && runsJson !== "[]") {
+        const allWorkflowRuns = JSON.parse(runsJson);
+        const headRuns = sha ? allWorkflowRuns.filter((r) => r.headSha === sha) : allWorkflowRuns;
+        const seen = new Set;
+        workflowRuns = headRuns.filter((r) => {
+          if (seen.has(r.name))
+            return false;
+          seen.add(r.name);
+          return true;
+        });
+      }
+    } catch {}
+    let thirdPartyChecks = [];
+    let commitStatuses = [];
+    if (sha) {
+      thirdPartyChecks = getThirdPartyCheckRuns(cwd, sha);
+      commitStatuses = getCommitStatuses(cwd, sha);
+    }
+    const allChecks = [...workflowRuns, ...thirdPartyChecks, ...commitStatuses];
+    if (allChecks.length === 0)
+      return allow(`No CI runs found for branch "${branch}".`);
+    const failing = allChecks.filter((r) => r.status === "completed" && r.conclusion !== "success" && r.conclusion !== "skipped" && r.conclusion !== "cancelled" && r.conclusion !== "neutral");
+    if (failing.length > 0) {
+      const names = failing.map((r) => `"${r.name}"`).join(", ");
+      return deny(`CI checks are failing on branch "${branch}": ${names}. Fix the failing checks now.`);
+    }
+    const pending = allChecks.filter((r) => r.status === "in_progress" || r.status === "queued" || r.status === "waiting");
+    if (pending.length > 0) {
+      const names = pending.map((r) => `"${r.name}"`).join(", ");
+      return deny(`CI checks are still running on branch "${branch}": ${names}. Wait for all checks to complete, then verify they pass.`);
+    }
+    return allow(`All CI checks passed on branch "${branch}".`);
+  } catch {
+    return allow("Could not check CI status, skipping.");
+  }
+}
+function assertCatalogBijection() {
+  const implNames = new Set(Object.keys(POLICY_IMPLEMENTATIONS));
+  const missing = POLICY_CATALOG.filter((e) => !implNames.has(e.name)).map((e) => e.name);
+  if (missing.length > 0) {
+    throw new Error(`failproofai: builtin policies missing an implementation: ${missing.join(", ")}`);
+  }
+  const catalogNames = new Set(POLICY_CATALOG.map((e) => e.name));
+  const orphaned = [...implNames].filter((n) => !catalogNames.has(n));
+  if (orphaned.length > 0) {
+    throw new Error(`failproofai: policy implementations with no catalog entry: ${orphaned.join(", ")}`);
+  }
+}
+function registerBuiltinPolicies(enabledNames) {
+  const enabledSet = new Set(enabledNames.map(normalizePolicyName));
+  for (const policy of BUILTIN_POLICIES) {
+    if (policy.alwaysOn || enabledSet.has(normalizePolicyName(policy.name))) {
+      registerPolicy(policy.name, policy.description, policy.fn, policy.match, 0, policy.params);
     }
+  }
+}
+var isClaudeInternalPath, isClaudeSettingsFile, SHELL_OPERATORS, SHELL_METACHAR_RE, JWT_RE, API_KEY_PATTERNS, CONNECTION_STRING_RE, PRIVATE_KEY_RE, BEARER_TOKEN_RE, SECRET_PATTERNS, SQL_TOOL_RE, DESTRUCTIVE_SQL_RE, DELETE_NO_WHERE_RE, SQL_WHERE_RE, SCHEMA_ALTER_RE, PUBLISH_CMD_RE, ENV_PRINTENV_RE, ECHO_ENV_RE, EXPORT_RE, PS_ENV_VAR_RE, PS_CHILDITEM_ENV_RE, DOTNET_GETENV_RE, CMD_ECHO_ENV_RE, ENV_FILE_PATH_RE, ENV_CMD_RE, PS_ELEVATION_RE, RUNAS_RE, CURL_PIPE_SH_RE, SEGMENT_SEPARATORS, COMMAND_PREFIX_TOKENS, SELF_BINARY_TOKEN_RE, SELF_ENTRY_PATH_RE, CONFIG_SUBCOMMAND_RE, PAUSE_FLAG_RE, ENV_ASSIGNMENT_RE, RUNNER_OPERAND_RE, PS_WEB_PIPE_RE, SHORT_FLAG_BUNDLE_RE, SAFE_FORCE_PREFIXES, SECRET_FILE_RE, SECRET_FILE_ID_RSA_RE, SECRET_FILE_CREDENTIALS_RE, GIT_COMMIT_MERGE_RE, FAILPROOFAI_STATE_WRITE_RE, FAILPROOFAI_UNINSTALL_RE, GIT_AMEND_RE, GIT_STASH_DROP_RE, GIT_ADD_ALL_RE, NPM_GLOBAL_RE, YARN_GLOBAL_RE, PNPM_GLOBAL_RE, BUN_GLOBAL_RE, CARGO_INSTALL_RE, PIP_SYSTEM_RE, PKG_MANAGER_DETECTORS, NOHUP_RE, SCREEN_DETACH_RE, TMUX_DETACH_RE, DISOWN_RE, BACKGROUND_AMPERSAND_RE, KUBECTL_RE, TERRAFORM_RE, AWS_CLI_RE, GCLOUD_RE, AZ_CLI_RE, HELM_RE, GH_PIPELINE_RE, gitBranchCache, GIT_BRANCH_CACHE_MAX_ENTRIES = 500, EVAL_FLAG_RE, HOME_PREFIX_RE, RM_CMD_RE, FIND_CMD_RE, FIND_EXEC_RE, FIND_GLOBAL_OPT_RE, FIND_EXPR_START_RE, SCRATCH_ROOTS, CATASTROPHIC_DEPTH = 2, READ_LIKE_CMDS, TOOL_CALL_TRACKER_MAX_BYTES = 65536, SEGMENT_SPLIT_RE, POLICY_IMPLEMENTATIONS, BUILTIN_POLICIES;
+var init_builtin_policies = __esm(() => {
+  init_policy_catalog();
+  init_hook_logger();
+  isClaudeInternalPath = isAgentInternalPath;
+  isClaudeSettingsFile = isAgentSettingsFile;
+  SHELL_OPERATORS = new Set(["&&", "||", "|", ";"]);
+  SHELL_METACHAR_RE = /[;&<>`$()\\]/;
+  JWT_RE = /eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/;
+  API_KEY_PATTERNS = [
+    [/sk-ant-[A-Za-z0-9\-_]{20,}/, "Anthropic API key"],
+    [/sk-proj-[A-Za-z0-9\-_]{20,}/, "OpenAI project API key"],
+    [/sk-[A-Za-z0-9]{20,}/, "OpenAI API key"],
+    [/ghp_[A-Za-z0-9]{36}/, "GitHub personal access token"],
+    [/github_pat_[A-Za-z0-9_]{82}/, "GitHub fine-grained token"],
+    [/AKIA[A-Z0-9]{16}/, "AWS access key ID"],
+    [/sk_live_[A-Za-z0-9]{24,}/, "Stripe live secret key"],
+    [/sk_test_[A-Za-z0-9]{24,}/, "Stripe test secret key"],
+    [/AIza[0-9A-Za-z\-_]{35}/, "Google API key"]
+  ];
+  CONNECTION_STRING_RE = /(?:postgresql|postgres|mysql|mongodb(?:\+srv)?|redis|amqps?|smtps?):\/\/[^@\s]+@/;
+  PRIVATE_KEY_RE = /-----BEGIN (?:[A-Z]+ )?PRIVATE KEY-----/;
+  BEARER_TOKEN_RE = /Authorization:\s*Bearer\s+[A-Za-z0-9\-._~+/]{20,}/i;
+  SECRET_PATTERNS = [
+    [PRIVATE_KEY_RE, "private key"],
+    [JWT_RE, "JWT"],
+    [BEARER_TOKEN_RE, "bearer token"],
+    [CONNECTION_STRING_RE, "database credentials"],
+    ...API_KEY_PATTERNS
   ];
+  SQL_TOOL_RE = /\b(?:psql|mysql|sqlite3|pgcli|clickhouse-client)\b/;
+  DESTRUCTIVE_SQL_RE = /\b(?:DROP\s+(?:TABLE|DATABASE|SCHEMA)|TRUNCATE\b)/i;
+  DELETE_NO_WHERE_RE = /\bDELETE\s+FROM\b/i;
+  SQL_WHERE_RE = /\bWHERE\b/i;
+  SCHEMA_ALTER_RE = /\bALTER\s+TABLE\b[\s\S]*\b(?:DROP\s+COLUMN|ADD\s+COLUMN|RENAME\s+(?:COLUMN|TO)|MODIFY\s+COLUMN)\b/i;
+  PUBLISH_CMD_RE = /(?:npm\s+publish|bun\s+publish|pnpm\s+publish|yarn\s+npm\s+publish|twine\s+upload|poetry\s+publish|cargo\s+publish|gem\s+push)\b/;
+  ENV_PRINTENV_RE = /(?:^|\s|;|&&|\|\|)(?:env|printenv)(?:\s|$|;|&&|\|)/;
+  ECHO_ENV_RE = /echo\s+.*\$\{?[A-Za-z_]/;
+  EXPORT_RE = /(?:^|\s|;|&&|\|\|)export\s+\w+/;
+  PS_ENV_VAR_RE = /\$env:[A-Za-z_]/i;
+  PS_CHILDITEM_ENV_RE = /(?:Get-ChildItem|dir|gci|ls)\s+Env:/i;
+  DOTNET_GETENV_RE = /\[Environment\]::GetEnvironment/i;
+  CMD_ECHO_ENV_RE = /echo\s+%[A-Za-z_]/i;
+  ENV_FILE_PATH_RE = /(?:^|[\\/])\.env(?:\.|$)/;
+  ENV_CMD_RE = /\.env(?:\b|\s|$|\.)/;
+  PS_ELEVATION_RE = /Start-Process\s+.*-Verb\s+RunAs/i;
+  RUNAS_RE = /(?:^|;|&&|\|\|)\s*runas\s/i;
+  CURL_PIPE_SH_RE = /(?:curl|wget)\s.*\|\s*(?:sh|bash|zsh|dash|ksh|csh|tcsh|fish|ash)\b/;
+  SEGMENT_SEPARATORS = /[;&|\n\r(){}`]+/;
+  COMMAND_PREFIX_TOKENS = new Set([
+    "npx",
+    "bunx",
+    "pnpx",
+    "npm",
+    "pnpm",
+    "yarn",
+    "dlx",
+    "exec",
+    "run",
+    "eval",
+    "node",
+    "bun",
+    "deno",
+    "env",
+    "command",
+    "builtin",
+    "nohup",
+    "setsid",
+    "time",
+    "timeout",
+    "nice",
+    "stdbuf",
+    "xargs",
+    "sudo",
+    "doas",
+    "sh",
+    "bash",
+    "zsh",
+    "dash",
+    "ksh",
+    "fish",
+    "ash"
+  ]);
+  SELF_BINARY_TOKEN_RE = /(?:^|\/)failproofai[^/]*$/;
+  SELF_ENTRY_PATH_RE = /failproofai\/(?:dist\/(?:cli|index)\.mjs|bin\/failproofai\.mjs)$/;
+  CONFIG_SUBCOMMAND_RE = /^(?:config|configure|setup)$/;
+  PAUSE_FLAG_RE = /^--pause(?:=|$)/;
+  ENV_ASSIGNMENT_RE = /^[A-Za-z_][A-Za-z0-9_]*=/;
+  RUNNER_OPERAND_RE = /^\d+[a-z]*$/i;
+  PS_WEB_PIPE_RE = /(?:Invoke-WebRequest|iwr|Invoke-RestMethod|irm)\s+.*\|\s*(?:Invoke-Expression|iex)/i;
+  SHORT_FLAG_BUNDLE_RE = /^-[a-zA-Z]*f[a-zA-Z]*$/;
+  SAFE_FORCE_PREFIXES = ["--force-with-lease", "--force-if-includes"];
+  SECRET_FILE_RE = /\.(?:pem|key)$/;
+  SECRET_FILE_ID_RSA_RE = /id_rsa/;
+  SECRET_FILE_CREDENTIALS_RE = /credentials/;
+  GIT_COMMIT_MERGE_RE = /git\s+(commit|merge|rebase|cherry-pick)\b/;
+  FAILPROOFAI_STATE_WRITE_RE = /\b(?:rm|unlink|shred|mv|truncate)\b[^;&|]*\.failproofai(?:\/|\b)/;
+  FAILPROOFAI_UNINSTALL_RE = /(?:npm\s+(?:uninstall|remove|un|r)\s.*failproofai|bun\s+remove\s.*failproofai|yarn\s+global\s+remove\s+failproofai|pnpm\s+(?:remove|uninstall|un)\s.*failproofai)/;
+  GIT_AMEND_RE = /\bgit\s+commit\b.*--amend\b/;
+  GIT_STASH_DROP_RE = /\bgit\s+stash\s+(?:drop|clear)\b/;
+  GIT_ADD_ALL_RE = /\bgit\s+add\s+(?:-A\b|--all\b|\.(?:\s|$|;|&&|\|\|))/;
+  NPM_GLOBAL_RE = /\bnpm\s+(?:install|i)\b(?=.*(?:\s-g\b|--global\b))/;
+  YARN_GLOBAL_RE = /\byarn\s+global\s+add\b/;
+  PNPM_GLOBAL_RE = /\bpnpm\s+(?:add|install|i)\b(?=.*(?:\s-g\b|--global\b))/;
+  BUN_GLOBAL_RE = /\bbun\s+(?:install|add)\b(?=.*(?:\s-g\b|--global\b))/;
+  CARGO_INSTALL_RE = /\bcargo\s+install\b/;
+  PIP_SYSTEM_RE = /\bpip(?:3)?\s+install\b(?=.*(?:--user\b|--break-system-packages\b))/;
+  PKG_MANAGER_DETECTORS = {
+    pip: [/\bpip\b/, /\bpip3\b/, /\bpython3?\s+-m\s+pip\b/],
+    npm: [/\bnpm\b/, /\bnpx\b/],
+    yarn: [/\byarn\b/],
+    pnpm: [/\bpnpm\b/, /\bpnpx\b/],
+    bun: [/\bbun\b/, /\bbunx\b/],
+    uv: [/\buv\b/],
+    poetry: [/\bpoetry\b/],
+    pipenv: [/\bpipenv\b/],
+    conda: [/\bconda\b/],
+    cargo: [/\bcargo\b/]
+  };
+  NOHUP_RE = /\bnohup\s+\S/;
+  SCREEN_DETACH_RE = /\bscreen\s+-[A-Za-z]*d[A-Za-z]*\b/;
+  TMUX_DETACH_RE = /\btmux\s+(?:new-session|new)\b[^|&;]*-d\b/;
+  DISOWN_RE = /\bdisown\b/;
+  BACKGROUND_AMPERSAND_RE = /(?<![&|])\s?&\s*(?:$|#|;)/;
+  KUBECTL_RE = /(?:^|[;\n]|&&|\|\|?|&)\s*kubectl(?:\s|$)/;
+  TERRAFORM_RE = /(?:^|[;\n]|&&|\|\|?|&)\s*(?:terraform|tofu)(?:\s|$)/;
+  AWS_CLI_RE = /(?:^|[;\n]|&&|\|\|?|&)\s*aws(?:\s|$)/;
+  GCLOUD_RE = /(?:^|[;\n]|&&|\|\|?|&)\s*gcloud(?:\s|$)/;
+  AZ_CLI_RE = /(?:^|[;\n]|&&|\|\|?|&)\s*az(?:\s|$)/;
+  HELM_RE = /(?:^|[;\n]|&&|\|\|?|&)\s*helm(?:\s|$)/;
+  GH_PIPELINE_RE = /(?:^|[;\n]|&&|\|\|?|&)\s*gh\s+(?:workflow\s+(?:run|enable|disable)|run\s+(?:rerun|cancel)|pr\s+merge|release\s+(?:create|delete)|cache\s+delete|secret\s+(?:set|delete))\b/;
+  gitBranchCache = new Map;
+  EVAL_FLAG_RE = /^-{1,2}c$/;
+  HOME_PREFIX_RE = /^(?:~[A-Za-z0-9_.-]*|\$HOME|\$\{HOME\})(?=$|\/)/;
+  RM_CMD_RE = /^(?:\/\S*\/)?rm$/;
+  FIND_CMD_RE = /^(?:\/\S*\/)?find$/;
+  FIND_EXEC_RE = /^-(?:exec|execdir|ok|okdir)$/;
+  FIND_GLOBAL_OPT_RE = /^-(?:[HLP]|D|O\d*)$/;
+  FIND_EXPR_START_RE = /^(?:-|\\?[(!])/;
+  SCRATCH_ROOTS = ["/tmp", "/var/tmp"];
+  READ_LIKE_CMDS = /(?:^|;|&&|\|\||\|)\s*(?:ls|find|cat|head|tail|less|more|wc|file|stat|tree|du)\s/;
+  SEGMENT_SPLIT_RE = /\s*(?:&&|\|\||\||;)\s*/;
+  POLICY_IMPLEMENTATIONS = {
+    "sanitize-jwt": sanitizeJwt,
+    "sanitize-api-keys": sanitizeApiKeys,
+    "sanitize-connection-strings": sanitizeConnectionStrings,
+    "sanitize-private-key-content": sanitizePrivateKeyContent,
+    "sanitize-bearer-tokens": sanitizeBearerTokens,
+    "protect-env-vars": protectEnvVars,
+    "block-env-files": blockEnvFiles,
+    "block-read-outside-cwd": blockReadOutsideCwd,
+    "block-sudo": blockSudo,
+    "block-curl-pipe-sh": blockCurlPipeSh,
+    "block-rm-rf": blockRmRf,
+    "block-failproofai-commands": blockFailproofaiCommands,
+    "block-kubectl": blockKubectl,
+    "block-terraform": blockTerraform,
+    "block-aws-cli": blockAwsCli,
+    "block-gcloud": blockGcloud,
+    "block-az-cli": blockAzCli,
+    "block-helm": blockHelm,
+    "block-gh-pipeline": blockGhPipeline,
+    "block-secrets-write": blockSecretsWrite,
+    "block-push-master": blockPushMaster,
+    "block-force-push": blockForcePush,
+    "block-work-on-main": blockWorkOnMain,
+    "warn-git-amend": warnGitAmend,
+    "warn-git-stash-drop": warnGitStashDrop,
+    "warn-all-files-staged": warnAllFilesStaged,
+    "warn-destructive-sql": warnDestructiveSql,
+    "warn-schema-alteration": warnSchemaAlteration,
+    "warn-package-publish": warnPackagePublish,
+    "warn-global-package-install": warnGlobalPackageInstall,
+    "prefer-package-manager": preferPackageManager,
+    "warn-large-file-write": warnLargeFileWrite,
+    "warn-background-process": warnBackgroundProcess,
+    "warn-repeated-tool-calls": warnRepeatedToolCalls,
+    "require-commit-before-stop": requireCommitBeforeStop,
+    "require-push-before-stop": requirePushBeforeStop,
+    "require-pr-before-stop": requirePrBeforeStop,
+    "require-no-conflicts-before-stop": requireNoConflictsBeforeStop,
+    "require-ci-green-before-stop": requireCiGreenBeforeStop
+  };
+  assertCatalogBijection();
+  BUILTIN_POLICIES = POLICY_CATALOG.map((entry) => ({
+    ...entry,
+    fn: POLICY_IMPLEMENTATIONS[entry.name]
+  }));
 });
 
 // package.json
-var version = "1.0.1";
+var version = "1.0.2-beta.1";
 var init_package = () => {};
 
 // src/posthog-key.ts
@@ -2864,17 +2901,17 @@ async function evaluatePolicies(eventType, payload, session, config) {
   const instructEntries = [];
   const allowEntries = [];
   for (const policy of policies) {
-    const schema = POLICY_PARAMS_MAP.get(policy.name);
+    const schema = policy.params;
+    const userParams = getConfigParamsFor(config, policy.name) ?? {};
     let ctx;
     if (schema) {
-      const userParams = getConfigParamsFor(config, policy.name) ?? {};
       const resolvedParams = {};
       for (const [key, spec] of Object.entries(schema)) {
         resolvedParams[key] = key in userParams ? userParams[key] : spec.default;
       }
       ctx = { ...baseCtx, params: resolvedParams };
     } else {
-      ctx = { ...baseCtx, params: {} };
+      ctx = { ...baseCtx, params: userParams };
     }
     let result;
     try {
@@ -2882,8 +2919,8 @@ async function evaluatePolicies(eventType, payload, session, config) {
     } catch (err) {
       const msg = err instanceof Error ? err.message : String(err);
       hookLogWarn(`policy "${policy.name}" threw: ${msg}`);
-      const isCustom = policy.name.startsWith("custom/") || policy.name.startsWith(".failproofai-");
-      if (!isCustom) {
+      const isBuiltin = policy.name.startsWith(`${DEFAULT_POLICY_NAMESPACE}/`);
+      if (isBuiltin) {
         trackHookEvent(getInstanceId(), "policy_evaluation_error", {
           policy_name: policy.name,
           event_type: eventType,
@@ -3560,13 +3597,10 @@ You MUST complete the above action(s) NOW. Do NOT ask the user for confirmation
   }
   return { exitCode: 0, stdout: "", stderr: "", policyName: null, reason: null, decision: "allow" };
 }
-var POLICY_PARAMS_MAP;
 var init_policy_evaluator = __esm(() => {
-  init_builtin_policies();
   init_hook_logger();
   init_hook_telemetry();
   init_telemetry_id();
-  POLICY_PARAMS_MAP = new Map(BUILTIN_POLICIES.filter((p) => p.params).map((p) => [normalizePolicyName(p.name), p.params]));
 });
 
 // src/hooks/custom-hooks-registry.ts
@@ -3836,7 +3870,7 @@ async function loadSingleFile(absPath, opts) {
     if (cached?.fingerprint === fingerprint) {
       for (const hook of cached.hooks)
         customPolicies.add({ ...hook });
-      return;
+      return null;
     }
     const entryTmp = absPath + tmpSuffix;
     const fileUrl = pathToFileURL2(entryTmp).href;
@@ -3848,6 +3882,7 @@ async function loadSingleFile(absPath, opts) {
       fingerprint,
       hooks: getCustomHooks().slice(hooksBefore).map((hook) => ({ ...hook }))
     });
+    return null;
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
     const errorType = /Cannot find module|MODULE_NOT_FOUND|ENOENT/i.test(msg) ? "module_not_found" : /SyntaxError|Unexpected token/i.test(msg) ? "syntax_error" : /timed out loading module/i.test(msg) ? "load_timeout" : "runtime_error";
@@ -3860,6 +3895,7 @@ async function loadSingleFile(absPath, opts) {
     if (opts?.strict)
       throw new Error(`Failed to load custom hooks from ${absPath}: ${msg}`);
     hookLogError(`failed to load custom hooks from ${absPath}: ${msg}`);
+    return { type: errorType, reason: msg };
   } finally {
     g[LOADING_KEY] = false;
     await cleanupTmpFiles(tmpFiles);
@@ -3887,9 +3923,24 @@ function warnSkippedPolicyFiles(dir, scope) {
   const suggest = (n) => n.replace(/\.(js|mjs|ts)$/, "-policies.$1");
   hookLogWarn(`${scope} policies: ${skipped.length} file(s) in ${dir} are NOT loaded — ` + `the convention only loads names ending in "policies.js|mjs|ts". ` + skipped.map((n) => `${n} → rename to ${suggest(n)}`).join("; "));
 }
+function reconcilePackManifest(pack, loaded) {
+  if (!pack || pack.policies.length === 0)
+    return;
+  const declared = new Set(pack.policies.map((p) => p.name));
+  const registered = new Set(loaded.map((h) => h.name));
+  const missing = [...declared].filter((n) => !registered.has(n));
+  const extra = [...registered].filter((n) => !declared.has(n));
+  if (missing.length > 0) {
+    hookLogWarn(`pack ${pack.id}@${pack.version} declares ${missing.join(", ")} but its artifact does not ` + `register ${missing.length === 1 ? "it" : "them"} — listed as protection that never runs`);
+  }
+  if (extra.length > 0) {
+    hookLogWarn(`pack ${pack.id}@${pack.version} registers undeclared ${extra.join(", ")} — ` + `${extra.length === 1 ? "it enforces" : "they enforce"} but will not appear in listings`);
+  }
+}
 async function loadAllCustomHooks(customPoliciesPaths, opts) {
   clearCustomHooks();
   const conventionSources = [];
+  const packFailures = new Map;
   const projectRoot = findProjectConfigDir(opts?.sessionCwd ?? process.cwd());
   const conventionEnabled = opts?.customPoliciesEnabled !== false;
   const loadedPaths = new Set;
@@ -3906,28 +3957,50 @@ async function loadAllCustomHooks(customPoliciesPaths, opts) {
       cloudManagedByPath.set(key, policy);
     }
   }
+  const packByPath = new Map;
+  for (const pack of opts?.packs ?? []) {
+    const key = resolve5(pack.path);
+    const existing = packByPath.get(key);
+    if (!existing) {
+      packByPath.set(key, pack);
+      continue;
+    }
+    hookLogWarn(`packs ${existing.id} and ${pack.id} have identical source, so they share one artifact ` + `and load as one pack; enforcing it if either asks to enforce`);
+    if (existing.effect !== "enforce" && pack.effect === "enforce") {
+      packByPath.set(key, pack);
+    }
+  }
   for (const customPoliciesPath of typeof customPoliciesPaths === "string" ? [customPoliciesPaths] : customPoliciesPaths ?? []) {
     const absPath = resolve5(projectRoot, customPoliciesPath);
+    const cloudManaged = cloudManagedByPath.get(absPath);
+    const pack = packByPath.get(absPath);
     if (existsSync4(absPath)) {
       if (!loadedPaths.has(absPath)) {
         loadedPaths.add(absPath);
         const hooksBefore = getCustomHooks().length;
-        await loadSingleFile(absPath, {
-          verifyEntrySha: cloudManagedByPath.get(absPath)?.sha256
+        const failure = await loadSingleFile(absPath, {
+          verifyEntrySha: cloudManaged?.sha256 ?? pack?.sha256
         });
+        if (failure && pack)
+          packFailures.set(pack.id, failure);
         for (const hook of getCustomHooks().slice(hooksBefore)) {
-          const cloudManaged = cloudManagedByPath.get(absPath);
           const tagged = hook;
           if (cloudManaged) {
             tagged.__cloudManaged = cloudManaged;
             tagged.__policyId = `cloud:${cloudManaged.id}@${cloudManaged.version}:${hook.name}`;
+          } else if (pack) {
+            tagged.__pack = pack;
+            tagged.__policyId = `pack:${pack.id}@${pack.version}:${hook.name}`;
           } else {
             tagged.__policyId = customPolicyId(absPath, hook.name);
           }
         }
+        reconcilePackManifest(pack, getCustomHooks().slice(hooksBefore));
       }
     } else {
       hookLogWarn(`custom policy path not found: ${absPath}`);
+      if (pack)
+        packFailures.set(pack.id, { type: "path_missing", reason: `path missing: ${absPath}` });
     }
   }
   const hooksBeforeConvention = getCustomHooks().length;
@@ -3999,7 +4072,7 @@ async function loadAllCustomHooks(customPoliciesPaths, opts) {
       hook.__conventionScope = hookNameToScope.get(hook.name) ?? "project";
     }
   }
-  return { hooks: allHooks, conventionSources };
+  return { hooks: allHooks, conventionSources, packFailures };
 }
 var LOADING_KEY = "__FAILPROOFAI_LOADING_HOOKS__", CONVENTION_FILE_RE, loadSequence = 0, policyModuleCache, POLICY_MODULE_CACHE_MAX_ENTRIES = 500, LOADABLE_EXT_RE;
 var init_custom_hooks_loader = __esm(() => {
@@ -4285,12 +4358,12 @@ function formatDate(date) {
 // lib/codex-projects.ts
 var exports_codex_projects = {};
 __export(exports_codex_projects, {
-  getCodexSessionsForCwd: () => getCodexSessionsForCwd,
-  getCodexSessionsByEncodedName: () => getCodexSessionsByEncodedName,
-  getCodexProjects: () => getCodexProjects,
-  getCachedCodexSessionsForCwd: () => getCachedCodexSessionsForCwd,
+  getCachedCodexProjects: () => getCachedCodexProjects,
   getCachedCodexSessionsByEncodedName: () => getCachedCodexSessionsByEncodedName,
-  getCachedCodexProjects: () => getCachedCodexProjects
+  getCachedCodexSessionsForCwd: () => getCachedCodexSessionsForCwd,
+  getCodexProjects: () => getCodexProjects,
+  getCodexSessionsByEncodedName: () => getCodexSessionsByEncodedName,
+  getCodexSessionsForCwd: () => getCodexSessionsForCwd
 });
 import { open, readdir } from "node:fs/promises";
 import { homedir as homedir5 } from "node:os";
@@ -4484,12 +4557,12 @@ var init_codex_projects = __esm(() => {
 // lib/copilot-projects.ts
 var exports_copilot_projects = {};
 __export(exports_copilot_projects, {
-  getCopilotSessionsForCwd: () => getCopilotSessionsForCwd,
-  getCopilotSessionsByEncodedName: () => getCopilotSessionsByEncodedName,
-  getCopilotProjects: () => getCopilotProjects,
-  getCachedCopilotSessionsForCwd: () => getCachedCopilotSessionsForCwd,
+  getCachedCopilotProjects: () => getCachedCopilotProjects,
   getCachedCopilotSessionsByEncodedName: () => getCachedCopilotSessionsByEncodedName,
-  getCachedCopilotProjects: () => getCachedCopilotProjects
+  getCachedCopilotSessionsForCwd: () => getCachedCopilotSessionsForCwd,
+  getCopilotProjects: () => getCopilotProjects,
+  getCopilotSessionsByEncodedName: () => getCopilotSessionsByEncodedName,
+  getCopilotSessionsForCwd: () => getCopilotSessionsForCwd
 });
 import { readdir as readdir2, readFile as readFile4, stat } from "node:fs/promises";
 import { homedir as homedir6 } from "node:os";
@@ -4632,12 +4705,12 @@ var init_copilot_projects = __esm(() => {
 // lib/cursor-projects.ts
 var exports_cursor_projects = {};
 __export(exports_cursor_projects, {
-  getCursorSessionsForCwd: () => getCursorSessionsForCwd,
-  getCursorSessionsByEncodedName: () => getCursorSessionsByEncodedName,
-  getCursorProjects: () => getCursorProjects,
-  getCachedCursorSessionsForCwd: () => getCachedCursorSessionsForCwd,
+  getCachedCursorProjects: () => getCachedCursorProjects,
   getCachedCursorSessionsByEncodedName: () => getCachedCursorSessionsByEncodedName,
-  getCachedCursorProjects: () => getCachedCursorProjects
+  getCachedCursorSessionsForCwd: () => getCachedCursorSessionsForCwd,
+  getCursorProjects: () => getCursorProjects,
+  getCursorSessionsByEncodedName: () => getCursorSessionsByEncodedName,
+  getCursorSessionsForCwd: () => getCursorSessionsForCwd
 });
 import { readdir as readdir3, readFile as readFile5, stat as stat2 } from "node:fs/promises";
 import { homedir as homedir7 } from "node:os";
@@ -4856,12 +4929,12 @@ var init_cursor_projects = __esm(() => {
 // lib/opencode-projects.ts
 var exports_opencode_projects = {};
 __export(exports_opencode_projects, {
-  getOpenCodeSessionsForCwd: () => getOpenCodeSessionsForCwd,
-  getOpenCodeSessionsByEncodedName: () => getOpenCodeSessionsByEncodedName,
-  getOpenCodeProjects: () => getOpenCodeProjects,
-  getCachedOpenCodeSessionsForCwd: () => getCachedOpenCodeSessionsForCwd,
+  getCachedOpenCodeProjects: () => getCachedOpenCodeProjects,
   getCachedOpenCodeSessionsByEncodedName: () => getCachedOpenCodeSessionsByEncodedName,
-  getCachedOpenCodeProjects: () => getCachedOpenCodeProjects
+  getCachedOpenCodeSessionsForCwd: () => getCachedOpenCodeSessionsForCwd,
+  getOpenCodeProjects: () => getOpenCodeProjects,
+  getOpenCodeSessionsByEncodedName: () => getOpenCodeSessionsByEncodedName,
+  getOpenCodeSessionsForCwd: () => getOpenCodeSessionsForCwd
 });
 import { execFileSync as execFileSync2 } from "node:child_process";
 function runOpenCodeDb(sql) {
@@ -5005,12 +5078,12 @@ var init_opencode_projects = __esm(() => {
 // lib/pi-projects.ts
 var exports_pi_projects = {};
 __export(exports_pi_projects, {
-  getPiSessionsForCwd: () => getPiSessionsForCwd,
-  getPiSessionsByEncodedName: () => getPiSessionsByEncodedName,
-  getPiProjects: () => getPiProjects,
-  getCachedPiSessionsForCwd: () => getCachedPiSessionsForCwd,
+  getCachedPiProjects: () => getCachedPiProjects,
   getCachedPiSessionsByEncodedName: () => getCachedPiSessionsByEncodedName,
-  getCachedPiProjects: () => getCachedPiProjects
+  getCachedPiSessionsForCwd: () => getCachedPiSessionsForCwd,
+  getPiProjects: () => getPiProjects,
+  getPiSessionsByEncodedName: () => getPiSessionsByEncodedName,
+  getPiSessionsForCwd: () => getPiSessionsForCwd
 });
 import { readdir as readdir4, readFile as readFile6, stat as stat3 } from "node:fs/promises";
 import { homedir as homedir8 } from "node:os";
@@ -5496,12 +5569,12 @@ var init_hermes_sessions = __esm(() => {
 // lib/hermes-projects.ts
 var exports_hermes_projects = {};
 __export(exports_hermes_projects, {
-  getHermesSessionsByEncodedName: () => getHermesSessionsByEncodedName,
-  getHermesSessions: () => getHermesSessions,
-  getHermesProjects: () => getHermesProjects,
-  getCachedHermesSessionsByEncodedName: () => getCachedHermesSessionsByEncodedName,
+  getCachedHermesProjects: () => getCachedHermesProjects,
   getCachedHermesSessions: () => getCachedHermesSessions,
-  getCachedHermesProjects: () => getCachedHermesProjects
+  getCachedHermesSessionsByEncodedName: () => getCachedHermesSessionsByEncodedName,
+  getHermesProjects: () => getHermesProjects,
+  getHermesSessions: () => getHermesSessions,
+  getHermesSessionsByEncodedName: () => getHermesSessionsByEncodedName
 });
 async function getHermesSessions() {
   const out = [];
@@ -5814,16 +5887,16 @@ var init_openclaw_sessions = __esm(() => {
 // lib/openclaw-projects.ts
 var exports_openclaw_projects = {};
 __export(exports_openclaw_projects, {
-  parseOpenClawProjectName: () => parseOpenClawProjectName,
-  openClawProjectPath: () => openClawProjectPath,
-  openClawProjectNameCandidates: () => openClawProjectNameCandidates,
-  openClawProjectName: () => openClawProjectName,
-  getOpenClawSessionsByEncodedName: () => getOpenClawSessionsByEncodedName,
-  getOpenClawSessions: () => getOpenClawSessions,
-  getOpenClawProjects: () => getOpenClawProjects,
-  getCachedOpenClawSessionsByEncodedName: () => getCachedOpenClawSessionsByEncodedName,
+  getCachedOpenClawProjects: () => getCachedOpenClawProjects,
   getCachedOpenClawSessions: () => getCachedOpenClawSessions,
-  getCachedOpenClawProjects: () => getCachedOpenClawProjects
+  getCachedOpenClawSessionsByEncodedName: () => getCachedOpenClawSessionsByEncodedName,
+  getOpenClawProjects: () => getOpenClawProjects,
+  getOpenClawSessions: () => getOpenClawSessions,
+  getOpenClawSessionsByEncodedName: () => getOpenClawSessionsByEncodedName,
+  openClawProjectName: () => openClawProjectName,
+  openClawProjectNameCandidates: () => openClawProjectNameCandidates,
+  openClawProjectPath: () => openClawProjectPath,
+  parseOpenClawProjectName: () => parseOpenClawProjectName
 });
 import { readFileSync as readFileSync5 } from "node:fs";
 import { join as join13 } from "node:path";
@@ -6203,10 +6276,10 @@ var init_factory_sessions = __esm(() => {
 // lib/factory-projects.ts
 var exports_factory_projects = {};
 __export(exports_factory_projects, {
-  getFactorySessionsByEncodedName: () => getFactorySessionsByEncodedName,
-  getFactoryProjects: () => getFactoryProjects,
+  getCachedFactoryProjects: () => getCachedFactoryProjects,
   getCachedFactorySessionsByEncodedName: () => getCachedFactorySessionsByEncodedName,
-  getCachedFactoryProjects: () => getCachedFactoryProjects
+  getFactoryProjects: () => getFactoryProjects,
+  getFactorySessionsByEncodedName: () => getFactorySessionsByEncodedName
 });
 async function getFactoryProjects() {
   let transcripts;
@@ -6493,12 +6566,12 @@ var init_devin_sessions = __esm(() => {
 // lib/devin-projects.ts
 var exports_devin_projects = {};
 __export(exports_devin_projects, {
-  getDevinSessionsByEncodedName: () => getDevinSessionsByEncodedName,
-  getDevinSessions: () => getDevinSessions,
-  getDevinProjects: () => getDevinProjects,
-  getCachedDevinSessionsByEncodedName: () => getCachedDevinSessionsByEncodedName,
+  getCachedDevinProjects: () => getCachedDevinProjects,
   getCachedDevinSessions: () => getCachedDevinSessions,
-  getCachedDevinProjects: () => getCachedDevinProjects
+  getCachedDevinSessionsByEncodedName: () => getCachedDevinSessionsByEncodedName,
+  getDevinProjects: () => getDevinProjects,
+  getDevinSessions: () => getDevinSessions,
+  getDevinSessionsByEncodedName: () => getDevinSessionsByEncodedName
 });
 async function getDevinSessions() {
   const db = await openSqliteReadonly(devinDbPath());
@@ -6761,12 +6834,12 @@ var init_antigravity_sessions = __esm(() => {
 // lib/antigravity-projects.ts
 var exports_antigravity_projects = {};
 __export(exports_antigravity_projects, {
-  getCachedAntigravitySessionsByEncodedName: () => getCachedAntigravitySessionsByEncodedName,
-  getCachedAntigravityProjects: () => getCachedAntigravityProjects,
-  getAntigravitySessionsByEncodedName: () => getAntigravitySessionsByEncodedName,
-  getAntigravityProjects: () => getAntigravityProjects,
+  antigravitySummariesDbPath: () => antigravitySummariesDbPath,
   getAntigravityIndex: () => getAntigravityIndex,
-  antigravitySummariesDbPath: () => antigravitySummariesDbPath
+  getAntigravityProjects: () => getAntigravityProjects,
+  getAntigravitySessionsByEncodedName: () => getAntigravitySessionsByEncodedName,
+  getCachedAntigravityProjects: () => getCachedAntigravityProjects,
+  getCachedAntigravitySessionsByEncodedName: () => getCachedAntigravitySessionsByEncodedName
 });
 import { join as join17 } from "node:path";
 function antigravitySummariesDbPath() {
@@ -7100,12 +7173,12 @@ var init_goose_sessions = __esm(() => {
 // lib/goose-projects.ts
 var exports_goose_projects = {};
 __export(exports_goose_projects, {
-  getGooseSessionsByEncodedName: () => getGooseSessionsByEncodedName,
-  getGooseSessions: () => getGooseSessions,
-  getGooseProjects: () => getGooseProjects,
-  getCachedGooseSessionsByEncodedName: () => getCachedGooseSessionsByEncodedName,
+  getCachedGooseProjects: () => getCachedGooseProjects,
   getCachedGooseSessions: () => getCachedGooseSessions,
-  getCachedGooseProjects: () => getCachedGooseProjects
+  getCachedGooseSessionsByEncodedName: () => getCachedGooseSessionsByEncodedName,
+  getGooseProjects: () => getGooseProjects,
+  getGooseSessions: () => getGooseSessions,
+  getGooseSessionsByEncodedName: () => getGooseSessionsByEncodedName
 });
 async function getGooseSessions() {
   const db = await openSqliteReadonly(gooseDbPath());
@@ -8806,21 +8879,299 @@ var init_cloud_managed_policies = __esm(() => {
   POLICY_ID_RE = /^[A-Za-z0-9._-]{1,128}$/;
 });
 
+// src/hooks/pack-manifest.ts
+import { createHash as createHash4 } from "node:crypto";
+import { existsSync as existsSync12, readFileSync as readFileSync12 } from "node:fs";
+import { resolve as resolve12 } from "node:path";
+function packsRoot() {
+  return process.env.FAILPROOFAI_PACK_DIR ?? packsDir();
+}
+function parsePackIdentity(value) {
+  if (typeof value.id !== "string" || !PACK_ID_RE.test(value.id)) {
+    throw new Error(`unsafe pack id ${JSON.stringify(value.id)}`);
+  }
+  if (typeof value.version !== "string" || !PACK_VERSION_RE.test(value.version)) {
+    throw new Error(`invalid version for pack ${value.id}`);
+  }
+  if (value.effect !== undefined && value.effect !== "enforce" && value.effect !== "observe") {
+    throw new Error(`unknown effect ${JSON.stringify(value.effect)} for pack ${value.id}`);
+  }
+  return {
+    id: value.id,
+    version: value.version,
+    effect: value.effect ?? "enforce"
+  };
+}
+function hasInstalledPacks() {
+  try {
+    const raw = JSON.parse(readFileSync12(installedFilePath(), "utf8"));
+    return Array.isArray(raw.packs) && raw.packs.length > 0;
+  } catch {
+    return false;
+  }
+}
+function installedFilePath() {
+  return process.env.FAILPROOFAI_PACK_DIR ? resolve12(process.env.FAILPROOFAI_PACK_DIR, "installed.json") : packsInstalledFile();
+}
+function parsePackPolicy(packId, value, index) {
+  const where = `${packId} policy #${index}`;
+  if (!value || typeof value !== "object")
+    throw new Error(`${where} is not an object`);
+  const raw = value;
+  const name = raw.name;
+  if (typeof name !== "string" || !PACK_POLICY_NAME_RE.test(name)) {
+    throw new Error(`${where} has an unsafe name ${JSON.stringify(name)}`);
+  }
+  if ("alwaysOn" in raw) {
+    throw new Error(`${where} declares alwaysOn, which packs may not set`);
+  }
+  if (typeof raw.description !== "string" || raw.description.length === 0) {
+    throw new Error(`${where} is missing a description`);
+  }
+  if (typeof raw.category !== "string" || raw.category.length === 0) {
+    throw new Error(`${where} is missing a category`);
+  }
+  if (typeof raw.defaultEnabled !== "boolean") {
+    throw new Error(`${where} is missing defaultEnabled`);
+  }
+  if (!raw.match || typeof raw.match !== "object") {
+    throw new Error(`${where} is missing a match`);
+  }
+  return raw;
+}
+function parsePack(root, value) {
+  if (!value || typeof value !== "object")
+    throw new Error("pack entry is not an object");
+  const raw = value;
+  const identity = parsePackIdentity(raw);
+  if (typeof raw.source !== "string" || raw.source.length === 0) {
+    throw new Error(`pack ${raw.id} has no source`);
+  }
+  if (typeof raw.sha256 !== "string" || !SHA256_RE2.test(raw.sha256)) {
+    throw new Error(`invalid SHA-256 for pack ${raw.id}`);
+  }
+  const effect = identity.effect;
+  const path2 = resolveManagedPath(root, raw.entry);
+  const actual = createHash4("sha256").update(readFileSync12(path2)).digest("hex");
+  if (actual !== raw.sha256) {
+    throw new Error(`pack ${raw.id} failed integrity verification: expected ${raw.sha256}, got ${actual}`);
+  }
+  if (!Array.isArray(raw.policies))
+    throw new Error(`pack ${raw.id} policies is not an array`);
+  const policies = raw.policies.map((p, i) => parsePackPolicy(raw.id, p, i));
+  const names = new Set;
+  for (const p of policies) {
+    if (names.has(p.name))
+      throw new Error(`pack ${raw.id} declares ${p.name} twice`);
+    names.add(p.name);
+  }
+  let enabled = null;
+  if (raw.enabled !== undefined) {
+    if (!Array.isArray(raw.enabled) || raw.enabled.some((n) => typeof n !== "string")) {
+      throw new Error(`pack ${raw.id} enabled is not an array of names`);
+    }
+    enabled = raw.enabled.filter((n) => names.has(n));
+  }
+  return {
+    id: identity.id,
+    version: identity.version,
+    source: raw.source,
+    path: path2,
+    sha256: raw.sha256,
+    effect,
+    policies,
+    enabled
+  };
+}
+function readInstalledPacks() {
+  const manifestPath = installedFilePath();
+  if (!existsSync12(manifestPath))
+    return { packs: [], errors: [] };
+  let raw;
+  try {
+    raw = JSON.parse(readFileSync12(manifestPath, "utf8"));
+  } catch (err) {
+    return {
+      packs: [],
+      errors: [{ id: null, reason: `unreadable pack manifest: ${errText(err)}` }]
+    };
+  }
+  if (!raw || typeof raw !== "object") {
+    return { packs: [], errors: [{ id: null, reason: "pack manifest is not an object" }] };
+  }
+  const manifest = raw;
+  if (!ACCEPTED_PACK_SCHEMA_VERSIONS.includes(manifest.schemaVersion)) {
+    return {
+      packs: [],
+      errors: [
+        {
+          id: null,
+          reason: `unsupported pack manifest schema ${String(manifest.schemaVersion)} ` + `(supported: ${ACCEPTED_PACK_SCHEMA_VERSIONS.join(", ")})`
+        }
+      ]
+    };
+  }
+  if (!Array.isArray(manifest.packs)) {
+    return { packs: [], errors: [{ id: null, reason: "pack manifest packs is not an array" }] };
+  }
+  const root = packsRoot();
+  const packs = [];
+  const errors = [];
+  const seen = new Set;
+  for (const entry of manifest.packs) {
+    const declaredId = entry && typeof entry === "object" && typeof entry.id === "string" ? entry.id : null;
+    try {
+      const pack = parsePack(root, entry);
+      if (seen.has(pack.id))
+        throw new Error(`duplicate pack id ${pack.id}`);
+      seen.add(pack.id);
+      packs.push(pack);
+    } catch (err) {
+      const rec = entry;
+      const declaredEffect = rec && (rec.effect === "observe" || rec.effect === "enforce") ? rec.effect : "enforce";
+      errors.push({
+        id: declaredId,
+        reason: errText(err),
+        effect: declaredEffect,
+        ...Array.isArray(rec?.policies) ? { declared: safeDeclared(rec.policies) } : {}
+      });
+    }
+  }
+  return { packs, errors };
+}
+function safeDeclared(raw) {
+  const out = [];
+  for (const value of raw) {
+    if (!value || typeof value !== "object")
+      continue;
+    const p = value;
+    if (typeof p.name !== "string" || !p.match || typeof p.match !== "object")
+      continue;
+    out.push(p);
+  }
+  return out;
+}
+function errText(err) {
+  return err instanceof Error ? err.message : String(err);
+}
+var ACCEPTED_PACK_SCHEMA_VERSIONS, SHA256_RE2, PACK_ID_RE, PACK_VERSION_RE, PACK_POLICY_NAME_RE;
+var init_pack_manifest = __esm(() => {
+  init_fp_home();
+  init_cloud_managed_policies();
+  ACCEPTED_PACK_SCHEMA_VERSIONS = [1];
+  SHA256_RE2 = /^[a-f0-9]{64}$/;
+  PACK_ID_RE = /^[A-Za-z0-9._-]{1,64}\/[A-Za-z0-9._-]{1,64}$/;
+  PACK_VERSION_RE = /^[A-Za-z0-9][A-Za-z0-9._+-]{0,63}$/;
+  PACK_POLICY_NAME_RE = /^[A-Za-z0-9._-]{1,128}$/;
+});
+
+// src/hooks/pack-failclosed.ts
+function unionMatch(matchers) {
+  const events = new Set;
+  const toolNames = new Set;
+  let anyEvent = false;
+  let anyTool = false;
+  for (const m of matchers) {
+    if (!m.events || m.events.length === 0)
+      anyEvent = true;
+    else
+      for (const e of m.events)
+        events.add(e);
+    if (!m.toolNames || m.toolNames.length === 0)
+      anyTool = true;
+    else
+      for (const t of m.toolNames)
+        toolNames.add(t);
+  }
+  const scoped = {};
+  if (!anyEvent)
+    scoped.events = [...events];
+  if (!anyTool)
+    scoped.toolNames = [...toolNames];
+  return scoped;
+}
+function missingGuards(input) {
+  const out = [];
+  for (const err of input.errors) {
+    if (err.effect === "observe")
+      continue;
+    const declared = err.declared ?? [];
+    out.push({
+      packId: err.id ?? "(unnamed pack)",
+      packVersion: null,
+      policies: declared.map((p) => p.name),
+      match: declared.length > 0 ? unionMatch(declared.map((p) => p.match)) : unionMatch([{}]),
+      reason: err.reason
+    });
+  }
+  for (const pack of input.packs) {
+    if (pack.effect === "observe")
+      continue;
+    const loadFailure = input.failed.get(pack.id);
+    if (loadFailure && PERMANENT_LOAD_FAILURES.has(loadFailure.type)) {
+      const taken2 = pack.enabled ?? pack.policies.map((p) => p.name);
+      const unavailable = pack.policies.filter((p) => taken2.includes(p.name) && !input.disabled.has(`pack:${pack.id}@${pack.version}:${p.name}`));
+      if (unavailable.length > 0) {
+        out.push({
+          packId: pack.id,
+          packVersion: pack.version,
+          policies: unavailable.map((p) => p.name),
+          match: unionMatch(unavailable.map((p) => p.match)),
+          reason: `artifact failed to load: ${loadFailure.reason}`
+        });
+      }
+      continue;
+    }
+    const registered = input.registered.get(pack.id);
+    if (!registered)
+      continue;
+    const taken = pack.enabled ?? pack.policies.map((p) => p.name);
+    const missing = pack.policies.filter((p) => taken.includes(p.name) && !registered.has(p.name) && !input.disabled.has(`pack:${pack.id}@${pack.version}:${p.name}`));
+    if (missing.length === 0)
+      continue;
+    out.push({
+      packId: pack.id,
+      packVersion: pack.version,
+      policies: missing.map((p) => p.name),
+      match: unionMatch(missing.map((p) => p.match)),
+      reason: `declared ${missing.length} polic${missing.length === 1 ? "y" : "ies"} its artifact did not register`
+    });
+  }
+  return out.filter((g) => !(g.match.events && g.match.events.length === 0));
+}
+function packFailureReason(guards) {
+  const named = guards.map((g) => {
+    const where = g.packVersion ? `${g.packId}@${g.packVersion}` : g.packId;
+    const what = g.policies.length > 0 ? `: ${g.policies.slice(0, 4).join(", ")}` : "";
+    return `${where} (${g.reason})${what}`;
+  }).join("; ");
+  return `Blocked because a policy pack this machine is configured to enforce is not running — ${named}. ` + `Enforcement you were told you had is missing, so this is refused rather than allowed silently. ` + `A human needs to run: failproofai policies, then failproofai policies add <source> (or failproofai config). ` + `The agent cannot run those itself.`;
+}
+var PERMANENT_LOAD_FAILURES;
+var init_pack_failclosed = __esm(() => {
+  PERMANENT_LOAD_FAILURES = new Set([
+    "module_not_found",
+    "syntax_error",
+    "runtime_error",
+    "path_missing"
+  ]);
+});
+
 // lib/atomic-write.ts
 var init_atomic_write = () => {};
 
 // src/hooks/session-pause.ts
-import { existsSync as existsSync12, mkdirSync as mkdirSync6, readdirSync as readdirSync11, readFileSync as readFileSync12, rmSync as rmSync2 } from "node:fs";
-import { createHash as createHash4 } from "node:crypto";
-import { join as join26, resolve as resolve12 } from "node:path";
+import { existsSync as existsSync13, mkdirSync as mkdirSync6, readdirSync as readdirSync11, readFileSync as readFileSync13, rmSync as rmSync2 } from "node:fs";
+import { createHash as createHash5 } from "node:crypto";
+import { join as join26, resolve as resolve13 } from "node:path";
 function pauseStateDir() {
   const override = process.env.FAILPROOFAI_STATE_DIR;
   if (override)
-    return resolve12(override, "sessions");
+    return resolve13(override, "sessions");
   return sessionPauseDir();
 }
 function pauseFilePath(sessionId) {
-  const digest = createHash4("sha256").update(sessionId).digest("hex").slice(0, 32);
+  const digest = createHash5("sha256").update(sessionId).digest("hex").slice(0, 32);
   return join26(pauseStateDir(), `${digest}.json`);
 }
 function parseStored(raw) {
@@ -8850,9 +9201,9 @@ function readActivePause(sessionId, now = Date.now()) {
     return null;
   try {
     const path2 = pauseFilePath(sessionId);
-    if (!existsSync12(path2))
+    if (!existsSync13(path2))
       return null;
-    const stored = parseStored(JSON.parse(readFileSync12(path2, "utf8")));
+    const stored = parseStored(JSON.parse(readFileSync13(path2, "utf8")));
     if (!stored)
       return null;
     if (stored.expiresAt <= now)
@@ -8891,9 +9242,9 @@ var init_daemon_service = __esm(() => {
 // src/hooks/fp-reset.ts
 import {
   copyFileSync,
-  existsSync as existsSync13,
+  existsSync as existsSync14,
   mkdirSync as mkdirSync7,
-  readFileSync as readFileSync13,
+  readFileSync as readFileSync14,
   readdirSync as readdirSync12,
   renameSync as renameSync3,
   rmSync as rmSync3,
@@ -8908,7 +9259,7 @@ function layoutWarningForHook() {
   if (state.kind === "future") {
     return `[failproofai] this directory was written by a newer version (layout ${state.found} vs ${LAYOUT_VERSION}) — policies are NOT being enforced. ` + `Upgrade failproofai.`;
   }
-  if (existsSync13(globalPolicyConfigFile()))
+  if (existsSync14(globalPolicyConfigFile()))
     return null;
   return `[failproofai] setup predates this version — global policies are NOT being enforced. ` + `Run \`failproofai config\` to re-create it.`;
 }
@@ -8917,6 +9268,7 @@ var init_fp_reset = __esm(() => {
   init_fp_home();
   init_fp_config();
   init_daemon_service();
+  init_hooks_config();
 });
 
 // src/hooks/handler.ts
@@ -9018,6 +9370,8 @@ async function evaluateHookEvent(eventType, cli = "claude", stdinPayload, opts)
     let activePause = null;
     const policyAttribution = new Map;
     let cloudDeployment;
+    const registeredByPack = new Map;
+    let packErrors = [];
     const observedResults = [];
     if (opts?.forceDecision) {
       config = { enabledPolicies: [] };
@@ -9028,7 +9382,13 @@ async function evaluateHookEvent(eventType, cli = "claude", stdinPayload, opts)
       config = readMergedHooksConfig(session.cwd);
       clearPolicies();
       activePause = readActivePause(session.sessionId);
-      registerBuiltinPolicies(activePause ? [] : config.enabledPolicies);
+      const packsInstalledHere = hasInstalledPacks();
+      const legacyNames = activePause || packsInstalledHere ? [] : config.enabledPolicies;
+      registerBuiltinPolicies(activePause ? [] : legacyNames);
+      if (legacyNames.length > 0) {
+        hookLogWarn(`enforcing ${legacyNames.length} policies from this build because no pack is installed — ` + `run \`failproofai policies add core\` to move them into a real pack`);
+      }
+      const enabledBuiltinNames = new Set(legacyNames);
       let cloudManagedPolicies = [];
       try {
         cloudManagedPolicies = readActiveCloudManagedPolicies();
@@ -9041,15 +9401,28 @@ async function evaluateHookEvent(eventType, cli = "claude", stdinPayload, opts)
         });
       }
       cloudDeployment = cloudManagedPolicies[0]?.deployment;
+      let installedPacks = [];
+      try {
+        const packResult = readInstalledPacks();
+        installedPacks = packResult.packs;
+        packErrors = packResult.errors;
+        for (const err of packResult.errors) {
+          hookLogWarn(`pack ${err.id ?? "(unnamed)"} not loaded: ${err.reason}`);
+        }
+      } catch (err) {
+        hookLogWarn(`pack manifest unreadable: ${err instanceof Error ? err.message : String(err)}`);
+      }
       const configuredCustomPaths = config.customPoliciesPaths ?? config.customPoliciesPath;
-      const allExplicitPaths = cloudManagedPolicies.length === 0 ? configuredCustomPaths : [
+      const allExplicitPaths = cloudManagedPolicies.length === 0 && installedPacks.length === 0 ? configuredCustomPaths : [
         ...typeof configuredCustomPaths === "string" ? [configuredCustomPaths] : configuredCustomPaths ?? [],
-        ...cloudManagedPolicies.map((policy) => policy.path)
+        ...cloudManagedPolicies.map((policy) => policy.path),
+        ...installedPacks.map((pack) => pack.path)
       ];
       const loadResult = await loadAllCustomHooks(allExplicitPaths, {
         sessionCwd: session.cwd,
         customPoliciesEnabled: config.customPoliciesEnabled,
-        ...cloudManagedPolicies.length > 0 ? { cloudManagedPolicies } : {}
+        ...cloudManagedPolicies.length > 0 ? { cloudManagedPolicies } : {},
+        ...installedPacks.length > 0 ? { packs: installedPacks } : {}
       });
       customHooksList = loadResult.hooks;
       const disabledCustomPolicies = new Set(config.disabledCustomPolicies ?? []);
@@ -9058,22 +9431,33 @@ async function evaluateHookEvent(eventType, cli = "claude", stdinPayload, opts)
         const taggedHook = hook;
         const policyId = taggedHook.__policyId;
         const cloudManaged = taggedHook.__cloudManaged;
+        const pack = taggedHook.__pack;
         if (!cloudManaged && policyId && disabledCustomPolicies.has(policyId))
           continue;
         if (!cloudManaged && activePause)
           continue;
+        if (pack?.enabled && !pack.enabled.includes(hook.name))
+          continue;
+        if (pack && enabledBuiltinNames.has(hook.name))
+          continue;
+        if (pack) {
+          const seen = registeredByPack.get(pack.id) ?? new Set;
+          seen.add(hook.name);
+          registeredByPack.set(pack.id, seen);
+        }
         const hookName = hook.name;
         const conventionScope = hook.__conventionScope;
         const isConvention = !!conventionScope;
-        const prefix = cloudManaged ? `cloud/${cloudManaged.id}@${cloudManaged.version}` : isConvention ? `.failproofai-${conventionScope}` : "custom";
-        const observeOnly = cloudManaged?.effect === "observe";
+        const prefix = cloudManaged ? `cloud/${cloudManaged.id}@${cloudManaged.version}` : pack ? `pack/${pack.id}@${pack.version}` : isConvention ? `.failproofai-${conventionScope}` : "custom";
+        const observeOnly = cloudManaged?.effect === "observe" || pack?.effect === "observe";
         const fn = async (ctx) => {
           if (observeOnly) {
             const shadow = await runObserved(hook, ctx, hookName, eventType, cli);
             if (shadow.decision !== "allow") {
+              const observer = cloudManaged ?? pack;
               observedResults.push({
-                policyId: cloudManaged.id,
-                version: cloudManaged.version,
+                policyId: observer.id,
+                version: observer.version,
                 decision: shadow.decision,
                 reason: shadow.reason ?? null
               });
@@ -9103,10 +9487,34 @@ async function evaluateHookEvent(eventType, cli = "claude", stdinPayload, opts)
         };
         const registeredName = `${prefix}/${hookName}`;
         policyAttribution.set(registeredName, {
-          source: cloudManaged ? "cloud" : isConvention ? "convention" : "custom",
-          ...cloudManaged ? { cloudPolicyId: cloudManaged.id, cloudVersion: cloudManaged.version } : {}
+          source: cloudManaged ? "cloud" : pack ? "pack" : isConvention ? "convention" : "custom",
+          ...cloudManaged ? { cloudPolicyId: cloudManaged.id, cloudVersion: cloudManaged.version } : {},
+          ...pack ? { packId: pack.id, packVersion: pack.version } : {}
+        });
+        registerPolicy(registeredName, hook.description ?? "", fn, hook.match ?? {}, -1, pack?.policies.find((p) => p.name === hook.name)?.params);
+      }
+      if (!activePause) {
+        const guards = missingGuards({
+          errors: packErrors,
+          packs: installedPacks,
+          registered: registeredByPack,
+          failed: loadResult.packFailures,
+          disabled: disabledCustomPolicies
         });
-        registerPolicy(registeredName, hook.description ?? "", fn, hook.match ?? {}, -1);
+        if (guards.length > 0) {
+          const reason = packFailureReason(guards);
+          const match = guards.length === 1 ? guards[0].match : {
+            events: guards.every((g) => g.match.events) ? [...new Set(guards.flatMap((g) => g.match.events ?? []))] : undefined
+          };
+          const name = "pack/failproofai-pack-unavailable";
+          policyAttribution.set(name, {
+            source: "pack",
+            packId: guards[0].packId,
+            ...guards[0].packVersion ? { packVersion: guards[0].packVersion } : {}
+          });
+          registerPolicy(name, "A policy pack this machine enforces could not be loaded", async () => canonicalEventType === "UserPromptSubmit" ? { decision: "instruct", reason } : { decision: "deny", reason }, match, 1);
+          hookLogWarn(reason);
+        }
       }
       if (customHooksList.length > 0) {
         trackHookEvent(getInstanceId(), "custom_hooks_loaded", {
@@ -9153,7 +9561,9 @@ async function evaluateHookEvent(eventType, cli = "claude", stdinPayload, opts)
         return {
           policySource: attribution?.source ?? "builtin",
           ...attribution?.cloudPolicyId ? { cloudPolicyId: attribution.cloudPolicyId } : {},
-          ...attribution?.cloudVersion !== undefined ? { cloudVersion: attribution.cloudVersion } : {}
+          ...attribution?.cloudVersion !== undefined ? { cloudVersion: attribution.cloudVersion } : {},
+          ...attribution?.packId ? { packId: attribution.packId } : {},
+          ...attribution?.packVersion ? { packVersion: attribution.packVersion } : {}
         };
       })() : {},
       ...cloudDeployment !== undefined ? { cloudDeployment } : {},
@@ -9212,6 +9622,8 @@ var init_handler = __esm(() => {
   init_telemetry_id();
   init_hook_logger();
   init_cloud_managed_policies();
+  init_pack_manifest();
+  init_pack_failclosed();
   init_session_pause();
   init_fp_reset();
 });
@@ -9222,7 +9634,7 @@ __export(exports_worker_server, {
   startWorkerServer: () => startWorkerServer
 });
 import { createConnection, createServer } from "node:net";
-import { existsSync as existsSync14, unlinkSync as unlinkSync2 } from "node:fs";
+import { existsSync as existsSync15, unlinkSync as unlinkSync2 } from "node:fs";
 function isWorkerHookRequest(msg) {
   if (!msg || typeof msg !== "object")
     return false;
@@ -9355,14 +9767,14 @@ function requestExistingWorkerShutdown(socketPath) {
 function startWorkerServer(socketPath, shutdown) {
   const server = createServer((socket) => handleConnection(socket, shutdown ?? (() => server.close())));
   const listen = () => {
-    if (existsSync14(socketPath)) {
+    if (existsSync15(socketPath)) {
       try {
         unlinkSync2(socketPath);
       } catch {}
     }
     server.listen(socketPath);
   };
-  if (!existsSync14(socketPath))
+  if (!existsSync15(socketPath))
     listen();
   else
     requestExistingWorkerShutdown(socketPath).then(listen, (err) => server.emit("error", err));
@@ -9378,13 +9790,13 @@ var init_worker_server = __esm(() => {
 
 // bin/failproofai-worker.mjs
 import { realpathSync as realpathSync2 } from "node:fs";
-import { dirname as dirname5, resolve as resolve13 } from "node:path";
+import { dirname as dirname5, resolve as resolve14 } from "node:path";
 import { fileURLToPath } from "node:url";
 if (!process.env.FAILPROOFAI_PACKAGE_ROOT) {
-  process.env.FAILPROOFAI_PACKAGE_ROOT = resolve13(dirname5(realpathSync2(fileURLToPath(import.meta.url))), "..");
+  process.env.FAILPROOFAI_PACKAGE_ROOT = resolve14(dirname5(realpathSync2(fileURLToPath(import.meta.url))), "..");
 }
 if (!process.env.FAILPROOFAI_DIST_PATH) {
-  process.env.FAILPROOFAI_DIST_PATH = resolve13(dirname5(realpathSync2(fileURLToPath(import.meta.url))), "..", "dist");
+  process.env.FAILPROOFAI_DIST_PATH = resolve14(dirname5(realpathSync2(fileURLToPath(import.meta.url))), "..", "dist");
 }
 var socketPath = process.env.FAILPROOFAI_WORKER_SOCKET;
 if (!socketPath) {