failproofai 1.0.12 → 1.0.13-beta.2

package/dist/cli.mjs

@@ -29,7 +29,7 @@ var __esm = (fn, res, err) => () => {
 var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
 // package.json
-var version2 = "1.0.12", package_default;
+var version2 = "1.0.13-beta.2", package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "failproofai",
@@ -114,7 +114,7 @@ var init_package = __esm(() => {
       access: "public"
     },
     devDependencies: {
-      "@anthropic-ai/sdk": "^0.135.0",
+      "@anthropic-ai/sdk": "^1.3.0",
       "@mdx-js/mdx": "^3.1.1",
       "@tailwindcss/postcss": "^4.3.1",
       "@tanstack/react-virtual": "^3.14.10",
@@ -159,16 +159,16 @@ var init_package = __esm(() => {
       browserslist: "4.28.8"
     },
     optionalDependencies: {
-      "@failproofai/failproofaid-linux-x64": "1.0.12",
-      "@failproofai/failproofaid-linux-arm64": "1.0.12",
-      "@failproofai/failproofaid-darwin-x64": "1.0.12",
-      "@failproofai/failproofaid-darwin-arm64": "1.0.12"
+      "@failproofai/failproofaid-linux-x64": "1.0.13-beta.2",
+      "@failproofai/failproofaid-linux-arm64": "1.0.13-beta.2",
+      "@failproofai/failproofaid-darwin-x64": "1.0.13-beta.2",
+      "@failproofai/failproofaid-darwin-arm64": "1.0.13-beta.2"
     },
     failproofaidBinaries: {
-      "linux-x64": "3b379ce2b03dd8a74393daed2c3120309f591fe6433e0c939d70c7b20da55be7",
-      "linux-arm64": "bd77d7fee68dc2723fb57cc9c7fcf957b7e939c797e61b099c412263880aa16e",
-      "darwin-x64": "fce3faab9406b1c2267955f0e07d04ef7a2b7a0b007e12ecd144fcfef563ebc8",
-      "darwin-arm64": "765732f8f64aa3d3dbd98e93b1aba71fc02956f65baeb73b08447b37fac3a17b"
+      "linux-x64": "8301567948ddf752b6db30ed5998e62139df4c7e1669b280159a83a9b951b94c",
+      "linux-arm64": "ad53ec24d7c09b2dbc07b792c0739dc1e5f443fdb9a795174d3a40453f90bbcf",
+      "darwin-x64": "e4e65a1071a5793bafb73625dc49d211ff19d7e0d8c03c804959d1357aebea1e",
+      "darwin-arm64": "78aa90272e2ace07ac3648a419b961f8d8bfe56c7fd3a0193d3579085d77e9cb"
     }
   };
 });
@@ -13494,12 +13494,14 @@ import {
   mkdirSync as mkdirSync7,
   mkdtempSync,
   readFileSync as readFileSync7,
+  readdirSync as readdirSync2,
+  statSync as statSync10,
   writeFileSync as writeFileSync5,
   unlinkSync,
   rmSync as rmSync5
 } from "node:fs";
 import { homedir as homedir5, tmpdir, userInfo } from "node:os";
-import { resolve as resolve8 } from "node:path";
+import { dirname as dirname7, resolve as resolve8 } from "node:path";
 import { execFileSync as execFileSync2 } from "node:child_process";
 function setDaemonConfigured(value, installedVersion) {
   try {
@@ -13611,6 +13613,63 @@ function systemdUnitDir() {
 function systemdUnitPath(user = serviceUser()) {
   return resolve8(systemdUnitDir(), systemdUnitName(user));
 }
+function systemBinaryRoot(user = serviceUser()) {
+  return resolve8(process.env.FAILPROOFAI_SYSTEM_BIN_DIR || "/opt/failproofai", user);
+}
+function systemBinaryDir() {
+  return resolve8(systemBinaryRoot(), "bin");
+}
+function daemonSystemBinaryDir() {
+  return process.platform === "linux" ? systemBinaryRoot() : null;
+}
+function systemBinaryTarget(binaryPath) {
+  if (process.platform !== "linux" || process.env.FAILPROOFAI_DAEMON_BINARY)
+    return null;
+  try {
+    if (!statSync10(binaryPath).isFile())
+      return null;
+  } catch {
+    return null;
+  }
+  return resolve8(systemBinaryDir(), `failproofaid-${version2}`);
+}
+function selinuxEnabled() {
+  return existsSync11("/sys/fs/selinux/enforce");
+}
+function stageSystemBinary(binaryPath) {
+  const target = systemBinaryTarget(binaryPath);
+  if (!target)
+    return binaryPath;
+  const dir = systemBinaryDir();
+  const staging = `${target}.${process.pid}.tmp`;
+  runPrivileged("install", ["-d", "-m", "0755", dir]);
+  try {
+    runPrivileged("install", ["-m", "0755", binaryPath, staging]);
+    runPrivileged("mv", ["-f", staging, target]);
+  } catch (err) {
+    try {
+      runPrivileged("rm", ["-f", staging]);
+    } catch {}
+    throw err;
+  }
+  if (selinuxEnabled()) {
+    const root = systemBinaryRoot();
+    try {
+      runPrivileged("restorecon", ["-R", root]);
+    } catch (err) {
+      hookLogWarn(`restorecon on ${root} failed: ${err instanceof Error ? err.message : String(err)}`);
+    }
+  }
+  return target;
+}
+function pruneSystemBinaries(current) {
+  try {
+    const dir = systemBinaryDir();
+    const stale = readdirSync2(dir).filter((f) => f.startsWith("failproofaid-")).map((f) => resolve8(dir, f)).filter((p) => p !== current).map((p) => ({ p, mtime: statSync10(p).mtimeMs })).sort((a, b) => b.mtime - a.mtime).slice(1);
+    for (const { p } of stale)
+      runPrivileged("rm", ["-f", p]);
+  } catch {}
+}
 function legacySystemdUserUnitPath() {
   return resolve8(homedir5(), ".config", "systemd", "user", "failproofaid.service");
 }
@@ -13791,9 +13850,17 @@ ${envBlock}    <key>StandardOutPath</key>
 }
 function daemonInstallCommands(binaryPath, workerCmd, cliCmd) {
   if (process.platform === "linux") {
+    const target = systemBinaryTarget(binaryPath);
+    const dir = systemBinaryDir();
+    const stage = target ? [
+      `sudo install -d -m 0755 ${dir}`,
+      `sudo install -m 0755 ${binaryPath} ${target}`,
+      `{ sudo restorecon -R ${systemBinaryRoot()} 2>/dev/null || true; }`
+    ] : [];
     return [
+      ...stage,
       `sudo tee ${systemdUnitPath()} <<'EOF'
-${systemdUnitContents(binaryPath, workerCmd, cliCmd)}EOF`,
+${systemdUnitContents(target ?? binaryPath, workerCmd, cliCmd)}EOF`,
       "sudo systemctl daemon-reload",
       `sudo systemctl enable ${systemdUnitName()}`,
       `sudo systemctl restart ${systemdUnitName()}`
@@ -13821,9 +13888,11 @@ async function installDaemonService() {
     };
   }
   removeLegacyUserService();
+  let execPath = binaryPath;
   try {
     if (process.platform === "linux") {
-      writePrivilegedFile(systemdUnitPath(), systemdUnitContents(binaryPath, workerCmd, cliCmd));
+      execPath = stageSystemBinary(binaryPath);
+      writePrivilegedFile(systemdUnitPath(), systemdUnitContents(execPath, workerCmd, cliCmd));
       runPrivileged("systemctl", ["daemon-reload"]);
       runPrivileged("systemctl", ["enable", systemdUnitName()]);
       restartSystemdUnit();
@@ -13847,6 +13916,8 @@ async function installDaemonService() {
     hookLogWarn(`daemon service install failed: ${reason}`);
     return { installed: false, reason };
   }
+  if (execPath !== binaryPath)
+    pruneSystemBinaries(execPath);
   return { installed: true };
 }
 async function probeDaemon() {
@@ -14079,6 +14150,13 @@ async function uninstallDaemonService() {
       try {
         runPrivileged("systemctl", ["daemon-reload"]);
       } catch {}
+      const binRoot = systemBinaryRoot();
+      if (existsSync11(binRoot)) {
+        runPrivileged("rm", ["-rf", binRoot]);
+        try {
+          runPrivileged("rmdir", [dirname7(binRoot)]);
+        } catch {}
+      }
     } else {
       const plistPath = launchdPlistPath();
       if (!existsSync11(plistPath))
@@ -14161,9 +14239,9 @@ var init_daemon_service = __esm(() => {
 // src/hooks/codex-system-hooks.ts
 import { execSync as execSync3 } from "node:child_process";
 import { createHash as createHash4 } from "node:crypto";
-import { accessSync, chmodSync as chmodSync5, constants as fsConstants3, existsSync as existsSync12, readFileSync as readFileSync8, rmSync as rmSync6, statSync as statSync10 } from "node:fs";
+import { accessSync, chmodSync as chmodSync5, constants as fsConstants3, existsSync as existsSync12, readFileSync as readFileSync8, rmSync as rmSync6, statSync as statSync11 } from "node:fs";
 import { homedir as homedir6 } from "node:os";
-import { dirname as dirname7, resolve as resolve9 } from "node:path";
+import { dirname as dirname8, resolve as resolve9 } from "node:path";
 function codexSystemConfigPath() {
   const override = process.env.FAILPROOFAI_CODEX_SYSTEM_CONFIG;
   if (override !== undefined)
@@ -14285,9 +14363,9 @@ function resolvedPath(deps) {
   return deps.path !== undefined ? deps.path : codexSystemConfigPath();
 }
 function writableDirectly(path) {
-  let dir = dirname7(path);
+  let dir = dirname8(path);
   while (!existsSync12(dir)) {
-    const parent = dirname7(dir);
+    const parent = dirname8(dir);
     if (parent === dir)
       return false;
     dir = parent;
@@ -14303,7 +14381,7 @@ function writableDirectly(path) {
 }
 function fileMode(path) {
   try {
-    return (statSync10(path).mode & 511).toString(8).padStart(4, "0");
+    return (statSync11(path).mode & 511).toString(8).padStart(4, "0");
   } catch {
     return "0644";
   }
@@ -14314,7 +14392,7 @@ function writeSystemFile(path, contents, mode, direct) {
     chmodSync5(path, parseInt(mode, 8));
     return;
   }
-  runPrivileged("install", ["-d", "-m", "0755", dirname7(path)]);
+  runPrivileged("install", ["-d", "-m", "0755", dirname8(path)]);
   writePrivilegedFile(path, contents, mode);
 }
 function removeSystemFile(path, direct) {
@@ -14680,19 +14758,19 @@ var init_codex_system_hooks = __esm(() => {
 });
 
 // lib/hermes-profiles.ts
-import { existsSync as existsSync13, readdirSync as readdirSync2 } from "node:fs";
+import { existsSync as existsSync13, readdirSync as readdirSync3 } from "node:fs";
 import { homedir as homedir7 } from "node:os";
-import { basename as basename2, dirname as dirname8, join as join4, resolve as resolve10 } from "node:path";
+import { basename as basename2, dirname as dirname9, join as join4, resolve as resolve10 } from "node:path";
 function hermesRoot() {
   const env = (process.env.HERMES_HOME || "").trim();
   if (env) {
     let home = resolve10(env);
-    const parent = dirname8(home);
+    const parent = dirname9(home);
     if (basename2(parent) === PROFILES_DIR)
-      home = dirname8(parent);
+      home = dirname9(parent);
     const base = basename2(home);
     if (base === STANDARD_HOME || base.startsWith(SIBLING_HOME_PREFIX)) {
-      return join4(dirname8(home), STANDARD_HOME);
+      return join4(dirname9(home), STANDARD_HOME);
     }
     return home;
   }
@@ -14715,7 +14793,7 @@ function listHermesProfiles() {
   const seen = new Set([HERMES_DEFAULT_PROFILE]);
   let names = [];
   try {
-    names = readdirSync2(join4(root, PROFILES_DIR), { withFileTypes: true }).filter((e) => (e.isDirectory() || e.isSymbolicLink()) && !e.name.startsWith(".")).map((e) => e.name).sort();
+    names = readdirSync3(join4(root, PROFILES_DIR), { withFileTypes: true }).filter((e) => (e.isDirectory() || e.isSymbolicLink()) && !e.name.startsWith(".")).map((e) => e.name).sort();
   } catch {}
   for (const name of names) {
     if (seen.has(name))
@@ -14726,9 +14804,9 @@ function listHermesProfiles() {
   if (basename2(root) !== STANDARD_HOME)
     return out;
   let siblings = [];
-  const parent = dirname8(root);
+  const parent = dirname9(root);
   try {
-    siblings = readdirSync2(parent, { withFileTypes: true }).filter((entry) => (entry.isDirectory() || entry.isSymbolicLink()) && entry.name.startsWith(SIBLING_HOME_PREFIX) && entry.name.length > SIBLING_HOME_PREFIX.length && existsSync13(join4(parent, entry.name, "config.yaml"))).map((entry) => ({
+    siblings = readdirSync3(parent, { withFileTypes: true }).filter((entry) => (entry.isDirectory() || entry.isSymbolicLink()) && entry.name.startsWith(SIBLING_HOME_PREFIX) && entry.name.length > SIBLING_HOME_PREFIX.length && existsSync13(join4(parent, entry.name, "config.yaml"))).map((entry) => ({
       name: entry.name.slice(SIBLING_HOME_PREFIX.length),
       home: join4(parent, entry.name)
     })).sort((a, b) => a.name.localeCompare(b.name));
@@ -14769,9 +14847,9 @@ var PROFILES_DIR = "profiles", STANDARD_HOME = ".hermes", SIBLING_HOME_PREFIX =
 var init_hermes_profiles = () => {};
 
 // lib/openclaw-profiles.ts
-import { existsSync as existsSync14, readdirSync as readdirSync3 } from "node:fs";
+import { existsSync as existsSync14, readdirSync as readdirSync4 } from "node:fs";
 import { homedir as homedir8 } from "node:os";
-import { basename as basename3, dirname as dirname9, join as join5, resolve as resolve11 } from "node:path";
+import { basename as basename3, dirname as dirname10, join as join5, resolve as resolve11 } from "node:path";
 function openclawProfileHome() {
   const stateDir = (process.env.OPENCLAW_STATE_DIR ?? "").trim();
   if (stateDir)
@@ -14781,7 +14859,7 @@ function openclawProfileHome() {
     return resolve11(openclawHome);
   const configPath = (process.env.OPENCLAW_CONFIG_PATH || "").trim();
   if (configPath)
-    return dirname9(resolve11(configPath));
+    return dirname10(resolve11(configPath));
   return join5(homedir8(), ".openclaw");
 }
 function listOpenClawProfiles() {
@@ -14790,14 +14868,14 @@ function listOpenClawProfiles() {
   if (activeBase !== ".openclaw" && !activeBase.startsWith(".openclaw-")) {
     return [{ name: OPENCLAW_DEFAULT_PROFILE, home: activeHome }];
   }
-  const parent = dirname9(activeHome);
+  const parent = dirname10(activeHome);
   const defaultHome = join5(parent, ".openclaw");
   const out = [
     { name: OPENCLAW_DEFAULT_PROFILE, home: defaultHome }
   ];
   let entries;
   try {
-    entries = readdirSync3(parent, { withFileTypes: true });
+    entries = readdirSync4(parent, { withFileTypes: true });
   } catch {
     return out;
   }
@@ -14827,7 +14905,7 @@ import {
   symlinkSync,
   unlinkSync as unlinkSync2
 } from "node:fs";
-import { resolve as resolve12, dirname as dirname10, basename as basename4 } from "node:path";
+import { resolve as resolve12, dirname as dirname11, basename as basename4 } from "node:path";
 import { fileURLToPath } from "node:url";
 import { homedir as homedir9 } from "node:os";
 function readJsonFile(path) {
@@ -14937,7 +15015,7 @@ function isMarkedCopilotHook(hook) {
   return false;
 }
 function opencodePluginFilePath(settingsPath) {
-  return resolve12(dirname10(settingsPath), "plugins", "failproofai.mjs");
+  return resolve12(dirname11(settingsPath), "plugins", "failproofai.mjs");
 }
 function buildOpenCodePluginShim(binaryPath, scope) {
   const useNpx = scope === "project";
@@ -15177,7 +15255,7 @@ function getHermesPluginSourcePath() {
   const fromEnv = process.env.FAILPROOFAI_PACKAGE_ROOT;
   if (fromEnv)
     return resolve12(fromEnv, HERMES_PLUGIN_SOURCE_DIR);
-  return findHermesPluginSourcePath(dirname10(fileURLToPath(import.meta.url)));
+  return findHermesPluginSourcePath(dirname11(fileURLToPath(import.meta.url)));
 }
 function findHermesPluginSourcePath(startDir) {
   let dir = resolve12(startDir);
@@ -15185,7 +15263,7 @@ function findHermesPluginSourcePath(startDir) {
     const candidate = resolve12(dir, HERMES_PLUGIN_SOURCE_DIR);
     if (existsSync15(resolve12(candidate, "plugin.yaml")))
       return candidate;
-    const parent = dirname10(dir);
+    const parent = dirname11(dir);
     if (parent === dir)
       break;
     dir = parent;
@@ -15193,7 +15271,7 @@ function findHermesPluginSourcePath(startDir) {
   return resolve12(startDir, "..", "..", HERMES_PLUGIN_SOURCE_DIR);
 }
 function hermesPluginPathForSettings(settingsPath) {
-  return resolve12(dirname10(settingsPath), "plugins", HERMES_PLUGIN_ID);
+  return resolve12(dirname11(settingsPath), "plugins", HERMES_PLUGIN_ID);
 }
 function pathPresent(path) {
   try {
@@ -15207,7 +15285,7 @@ function hasAllHermesPluginFiles(dir) {
   return HERMES_PLUGIN_FILES.every((file) => existsSync15(resolve12(dir, file)));
 }
 function hermesLinkRecordPath(pluginPath) {
-  return resolve12(dirname10(pluginPath), HERMES_LINK_RECORD);
+  return resolve12(dirname11(pluginPath), HERMES_LINK_RECORD);
 }
 function readHermesLinkRecord(pluginPath) {
   try {
@@ -15230,10 +15308,10 @@ function isOwnedHermesPluginLink(pluginPath, target) {
     return true;
   if (samePath(target, getHermesPluginSourcePath()))
     return true;
-  const pkgRoot = dirname10(resolve12(target));
+  const pkgRoot = dirname11(resolve12(target));
   if (basename4(resolve12(target)) !== HERMES_PLUGIN_SOURCE_DIR)
     return false;
-  if (basename4(pkgRoot) !== "failproofai" || basename4(dirname10(pkgRoot)) !== "node_modules")
+  if (basename4(pkgRoot) !== "failproofai" || basename4(dirname11(pkgRoot)) !== "node_modules")
     return false;
   try {
     const pkg = JSON.parse(readFileSync9(resolve12(pkgRoot, "package.json"), "utf8"));
@@ -15265,7 +15343,7 @@ function hermesPluginState(settingsPath) {
   if (isLink) {
     let target;
     try {
-      target = resolve12(dirname10(pluginPath), readlinkSync2(pluginPath));
+      target = resolve12(dirname11(pluginPath), readlinkSync2(pluginPath));
     } catch {
       return { kind: "foreign" };
     }
@@ -15310,7 +15388,7 @@ function installHermesPlugin(settingsPath, deps = {}) {
     }
     return "unchanged";
   }
-  mkdirSync8(dirname10(destination), { recursive: true });
+  mkdirSync8(dirname11(destination), { recursive: true });
   const suffix = `${process.pid}-${Date.now()}`;
   const temporary = `${destination}.install-${suffix}`;
   let linked = false;
@@ -16116,7 +16194,7 @@ var init_integrations = __esm(() => {
       const effectiveScope = scope ?? "project";
       const settingsPath = effectiveScope === "user" ? resolve12(homedir9(), ".config", "opencode", "opencode.json") : resolve12(process.cwd(), ".opencode", "opencode.json");
       const pluginPath = opencodePluginFilePath(settingsPath);
-      mkdirSync8(dirname10(pluginPath), { recursive: true });
+      mkdirSync8(dirname11(pluginPath), { recursive: true });
       writeConfigFileAtomic(pluginPath, buildOpenCodePluginShim(binaryPath, effectiveScope), { symlinks: "replace" });
       if (!Array.isArray(s.plugin))
         s.plugin = [];
@@ -19227,7 +19305,7 @@ var init_custom_hooks_registry = __esm(() => {
 // src/hooks/loader-utils.ts
 import { readFile as readFile2, writeFile as writeFile2, unlink, access, mkdir, lstat } from "fs/promises";
 import { tmpdir as tmpdir2 } from "os";
-import { resolve as resolve13, dirname as dirname11, relative as relative2, join as join6 } from "path";
+import { resolve as resolve13, dirname as dirname12, relative as relative2, join as join6 } from "path";
 import { pathToFileURL } from "url";
 import { createHash as createHash5 } from "crypto";
 function isTmpArtifact(name) {
@@ -19268,7 +19346,7 @@ async function findDistIndex() {
       return candidate;
   }
   const candidates = [
-    resolve13(dirname11(process.execPath), "..", "assets", "dist", "index.js"),
+    resolve13(dirname12(process.execPath), "..", "assets", "dist", "index.js"),
     resolve13(process.cwd(), "dist", "index.js"),
     resolve13(process.cwd(), "node_modules", "failproofai", "dist", "index.js")
   ];
@@ -19359,7 +19437,7 @@ async function rewriteFileTree(entryPath, distUrl, distIndex, tmpSuffix = TMP_SU
     if (distIndex) {
       code = code.replace(/require\s*\(\s*(['"])(?:claudeye|failproofai)\1\s*\)/g, `require('${distIndex.replace(/\\/g, "\\\\")}')`);
     }
-    const dir = dirname11(filePath);
+    const dir = dirname12(filePath);
     const rewrites = new Map;
     for (const re of [LOCAL_IMPORT_RE, LOCAL_REQUIRE_RE]) {
       const freshRe = new RegExp(re.source, re.flags);
@@ -19582,7 +19660,7 @@ var init_telemetry_id2 = __esm(() => {
 // src/hooks/custom-hooks-loader.ts
 import { resolve as resolve14, isAbsolute as isAbsolute2, basename as basename5 } from "node:path";
 import { randomUUID } from "crypto";
-import { existsSync as existsSync16, readdirSync as readdirSync4 } from "node:fs";
+import { existsSync as existsSync16, readdirSync as readdirSync5 } from "node:fs";
 import { readFile as readFile3 } from "node:fs/promises";
 import { pathToFileURL as pathToFileURL2 } from "node:url";
 import { createHash as createHash6 } from "node:crypto";
@@ -19590,7 +19668,7 @@ function discoverPolicyFiles(dir) {
   if (!existsSync16(dir))
     return [];
   try {
-    const entries = readdirSync4(dir, { withFileTypes: true });
+    const entries = readdirSync5(dir, { withFileTypes: true });
     return entries.filter((e) => e.isFile() && CONVENTION_FILE_RE.test(e.name)).sort((a, b) => a.name.localeCompare(b.name)).map((e) => resolve14(dir, e.name));
   } catch {
     return [];
@@ -19600,7 +19678,7 @@ function findSkippedPolicyFiles(dir) {
   if (!existsSync16(dir))
     return [];
   try {
-    return readdirSync4(dir, { withFileTypes: true }).filter((e) => e.isFile() && LOADABLE_EXT_RE.test(e.name) && !CONVENTION_FILE_RE.test(e.name) && !e.name.endsWith(".d.ts") && !isTmpArtifact(e.name)).map((e) => e.name).sort((a, b) => a.localeCompare(b));
+    return readdirSync5(dir, { withFileTypes: true }).filter((e) => e.isFile() && LOADABLE_EXT_RE.test(e.name) && !CONVENTION_FILE_RE.test(e.name) && !e.name.endsWith(".d.ts") && !isTmpArtifact(e.name)).map((e) => e.name).sort((a, b) => a.localeCompare(b));
   } catch {
     return [];
   }
@@ -21447,7 +21525,7 @@ var init_pack_cli = __esm(() => {
 // src/hooks/pack-store.ts
 import { createHash as createHash7 } from "node:crypto";
 import { existsSync as existsSync17, mkdirSync as mkdirSync9, readFileSync as readFileSync10, renameSync as renameSync6, rmSync as rmSync8, writeFileSync as writeFileSync7 } from "node:fs";
-import { dirname as dirname12, resolve as resolve15 } from "node:path";
+import { dirname as dirname13, resolve as resolve15 } from "node:path";
 function baseUrl2() {
   return (process.env.FAILPROOFAI_PACK_BASE_URL || DEFAULT_BASE_URL2).replace(/\/+$/, "");
 }
@@ -21618,7 +21696,7 @@ function sha256(bytes) {
 function writeAtomic(target, bytes) {
   const tempPath = `${target}.${process.pid}.tmp`;
   try {
-    mkdirSync9(dirname12(target), { recursive: true });
+    mkdirSync9(dirname13(target), { recursive: true });
     writeFileSync7(tempPath, bytes);
     renameSync6(tempPath, target);
   } catch (err) {
@@ -22963,10 +23041,10 @@ import {
   writeFileSync as writeFileSync8,
   appendFileSync as appendFileSync2,
   renameSync as renameSync7,
-  readdirSync as readdirSync5,
+  readdirSync as readdirSync6,
   mkdirSync as mkdirSync10,
   existsSync as existsSync18,
-  statSync as statSync11,
+  statSync as statSync12,
   unlinkSync as unlinkSync3
 } from "node:fs";
 import { join as join7 } from "node:path";
@@ -22987,7 +23065,7 @@ function acquireLock() {
       if (e.code !== "EEXIST")
         return;
       try {
-        const s = statSync11(lockPath);
+        const s = statSync12(lockPath);
         if (Date.now() - s.mtimeMs > LOCK_STALE_MS) {
           writeFileSync8(lockPath, String(process.pid), "utf-8");
           return;
@@ -23175,7 +23253,7 @@ function readJsonlFile(filePath) {
 }
 function getArchiveFiles() {
   try {
-    const files = readdirSync5(storeDirValue());
+    const files = readdirSync6(storeDirValue());
     return files.filter((f) => f.startsWith("page-") && f.endsWith(".jsonl")).sort((a, b) => {
       const partsA = a.slice(5, -6).split("-");
       const partsB = b.slice(5, -6).split("-");
@@ -23199,7 +23277,7 @@ var init_hook_activity_store = __esm(() => {
 });
 
 // src/hooks/delivery-health.ts
-import { existsSync as existsSync19, readFileSync as readFileSync12, readdirSync as readdirSync6, statSync as statSync12 } from "node:fs";
+import { existsSync as existsSync19, readFileSync as readFileSync12, readdirSync as readdirSync7, statSync as statSync13 } from "node:fs";
 import { join as join8 } from "node:path";
 function parseParkedName(name) {
   const poison = name.endsWith(POISON_SUFFIX);
@@ -23241,7 +23319,7 @@ function deliveryHealth(home, now = Date.now(), connectedAt = home ? undefined :
     return EMPTY;
   let entries;
   try {
-    entries = readdirSync6(dir);
+    entries = readdirSync7(dir);
   } catch {
     return EMPTY;
   }
@@ -23257,7 +23335,7 @@ function deliveryHealth(home, now = Date.now(), connectedAt = home ? undefined :
     const parsed = parseParkedName(name);
     let mtime;
     try {
-      mtime = statSync12(join8(dir, name)).mtimeMs;
+      mtime = statSync13(join8(dir, name)).mtimeMs;
     } catch {
       continue;
     }
@@ -24015,7 +24093,7 @@ var init_cursor_projects = __esm(() => {
 });
 
 // lib/sqlite-reader.ts
-import { existsSync as existsSync20, readFileSync as readFileSync13, statSync as statSync13 } from "node:fs";
+import { existsSync as existsSync20, readFileSync as readFileSync13, statSync as statSync14 } from "node:fs";
 import initSqlJs from "sql.js/dist/sql-asm.js";
 async function tryNodeSqlite(dbPath) {
   try {
@@ -24040,7 +24118,7 @@ function loadSqlJs() {
   return sqlPromise;
 }
 function fileVersion2(path) {
-  const stat = statSync13(path);
+  const stat = statSync14(path);
   return { size: stat.size, mtimeMs: stat.mtimeMs, ctimeMs: stat.ctimeMs };
 }
 function sameVersion(a, b) {
@@ -24991,7 +25069,7 @@ var init_openclaw_db = __esm(() => {
 
 // lib/openclaw-sessions.ts
 import { readFile as readFile7 } from "node:fs/promises";
-import { readdirSync as readdirSync7, statSync as statSync14 } from "node:fs";
+import { readdirSync as readdirSync8, statSync as statSync15 } from "node:fs";
 import { homedir as homedir16 } from "node:os";
 import { join as join17 } from "node:path";
 function openclawHome() {
@@ -25114,7 +25192,7 @@ function openclawLinesToLogEntries(lines, source = "session") {
 }
 function listOpenClawAgents() {
   try {
-    return readdirSync7(join17(openclawHome(), "agents"), { withFileTypes: true }).filter((d) => d.isDirectory() && !d.name.startsWith(".")).map((d) => d.name).sort();
+    return readdirSync8(join17(openclawHome(), "agents"), { withFileTypes: true }).filter((d) => d.isDirectory() && !d.name.startsWith(".")).map((d) => d.name).sort();
   } catch {
     return [];
   }
@@ -25124,7 +25202,7 @@ function listOpenClawTranscripts() {
   const out = [];
   let agentIds;
   try {
-    agentIds = readdirSync7(agentsDir, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name);
+    agentIds = readdirSync8(agentsDir, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name);
   } catch {
     return out;
   }
@@ -25132,7 +25210,7 @@ function listOpenClawTranscripts() {
     const sessionsDir = join17(agentsDir, agentId, "sessions");
     let files;
     try {
-      files = readdirSync7(sessionsDir);
+      files = readdirSync8(sessionsDir);
     } catch {
       continue;
     }
@@ -25144,7 +25222,7 @@ function listOpenClawTranscripts() {
         continue;
       const transcriptPath = join17(sessionsDir, file);
       try {
-        const st = statSync14(transcriptPath);
+        const st = statSync15(transcriptPath);
         out.push({
           agentId,
           sessionId,
@@ -25389,7 +25467,7 @@ var init_openclaw_projects = __esm(() => {
 
 // lib/factory-sessions.ts
 import { readFile as readFile8 } from "node:fs/promises";
-import { readdirSync as readdirSync8, statSync as statSync15 } from "node:fs";
+import { readdirSync as readdirSync9, statSync as statSync16 } from "node:fs";
 import { homedir as homedir17 } from "node:os";
 import { join as join19 } from "node:path";
 function factoryHome() {
@@ -25535,7 +25613,7 @@ function listFactoryTranscripts() {
   const out = [];
   let projectDirs;
   try {
-    projectDirs = readdirSync8(root, { withFileTypes: true }).filter((d) => d.isDirectory());
+    projectDirs = readdirSync9(root, { withFileTypes: true }).filter((d) => d.isDirectory());
   } catch {
     return out;
   }
@@ -25545,7 +25623,7 @@ function listFactoryTranscripts() {
     const projectPath = join19(root, projectName);
     let files;
     try {
-      files = readdirSync8(projectPath);
+      files = readdirSync9(projectPath);
     } catch {
       continue;
     }
@@ -25557,7 +25635,7 @@ function listFactoryTranscripts() {
         continue;
       const transcriptPath = join19(projectPath, file);
       try {
-        const st = statSync15(transcriptPath);
+        const st = statSync16(transcriptPath);
         out.push({ projectName, cwd, sessionId, transcriptPath, mtimeMs: st.mtimeMs, sizeBytes: st.size });
       } catch {}
     }
@@ -25977,7 +26055,7 @@ var init_devin_projects = __esm(() => {
 
 // lib/antigravity-sessions.ts
 import { readFile as readFile9 } from "node:fs/promises";
-import { readdirSync as readdirSync9, statSync as statSync16 } from "node:fs";
+import { readdirSync as readdirSync10, statSync as statSync17 } from "node:fs";
 import { homedir as homedir19 } from "node:os";
 import { join as join21 } from "node:path";
 function antigravityHome() {
@@ -26102,7 +26180,7 @@ function listAntigravityTranscripts() {
   const out = [];
   let convoDirs;
   try {
-    convoDirs = readdirSync9(root, { withFileTypes: true }).filter((d) => d.isDirectory());
+    convoDirs = readdirSync10(root, { withFileTypes: true }).filter((d) => d.isDirectory());
   } catch {
     return out;
   }
@@ -26112,7 +26190,7 @@ function listAntigravityTranscripts() {
       continue;
     const transcriptPath = join21(root, conversationId, rel);
     try {
-      const st = statSync16(transcriptPath);
+      const st = statSync17(transcriptPath);
       if (!st.isFile())
         continue;
       out.push({ conversationId, transcriptPath, mtimeMs: st.mtimeMs, sizeBytes: st.size });
@@ -26125,7 +26203,7 @@ function findAntigravityTranscript(conversationId) {
     return null;
   const transcriptPath = join21(antigravityBrainRoot(), conversationId, antigravityTranscriptRelPath());
   try {
-    if (statSync16(transcriptPath).isFile())
+    if (statSync17(transcriptPath).isFile())
       return transcriptPath;
   } catch {}
   return null;
@@ -27040,9 +27118,9 @@ var init_log_entries = __esm(() => {
 });
 
 // lib/codex-sessions.ts
-import { readFileSync as readFileSync15, readdirSync as readdirSync10, existsSync as existsSync22, writeFileSync as writeFileSync9, mkdirSync as mkdirSync11, statSync as statSync17 } from "node:fs";
+import { readFileSync as readFileSync15, readdirSync as readdirSync11, existsSync as existsSync22, writeFileSync as writeFileSync9, mkdirSync as mkdirSync11, statSync as statSync18 } from "node:fs";
 import { readFile as readFile11 } from "node:fs/promises";
-import { dirname as dirname13, join as join27 } from "node:path";
+import { dirname as dirname14, join as join27 } from "node:path";
 import { homedir as homedir21 } from "node:os";
 function readCache() {
   try {
@@ -27055,7 +27133,7 @@ function readCache() {
 }
 function writeCacheEntry(sessionId, path) {
   try {
-    mkdirSync11(dirname13(CACHE_PATH), { recursive: true });
+    mkdirSync11(dirname14(CACHE_PATH), { recursive: true });
     const cache = readCache();
     cache[sessionId] = path;
     writeFileSync9(CACHE_PATH, JSON.stringify(cache), "utf-8");
@@ -27063,7 +27141,7 @@ function writeCacheEntry(sessionId, path) {
 }
 function dirSearch(dir, sessionId) {
   try {
-    for (const f of readdirSync10(dir, { withFileTypes: true })) {
+    for (const f of readdirSync11(dir, { withFileTypes: true })) {
       if (f.isFile() && f.name.includes(sessionId) && f.name.endsWith(".jsonl")) {
         return join27(dir, f.name);
       }
@@ -27093,13 +27171,13 @@ function findCodexTranscript(sessionId) {
     }
   }
   try {
-    for (const y of readdirSync10(root, { withFileTypes: true })) {
+    for (const y of readdirSync11(root, { withFileTypes: true })) {
       if (!y.isDirectory())
         continue;
-      for (const m of readdirSync10(join27(root, y.name), { withFileTypes: true })) {
+      for (const m of readdirSync11(join27(root, y.name), { withFileTypes: true })) {
         if (!m.isDirectory())
           continue;
-        for (const d of readdirSync10(join27(root, y.name, m.name), { withFileTypes: true })) {
+        for (const d of readdirSync11(join27(root, y.name, m.name), { withFileTypes: true })) {
           if (!d.isDirectory())
             continue;
           const hit = dirSearch(join27(root, y.name, m.name, d.name), sessionId);
@@ -27368,7 +27446,7 @@ var init_resolve_permission_mode = __esm(() => {
 });
 
 // lib/copilot-sessions.ts
-import { readFileSync as readFileSync17, readdirSync as readdirSync11, existsSync as existsSync23, statSync as statSync18 } from "node:fs";
+import { readFileSync as readFileSync17, readdirSync as readdirSync12, existsSync as existsSync23, statSync as statSync19 } from "node:fs";
 import { readFile as readFile12 } from "node:fs/promises";
 import { join as join28, resolve as resolve17, sep as sep2 } from "node:path";
 import { homedir as homedir22 } from "node:os";
@@ -27585,7 +27663,7 @@ var init_copilot_sessions = __esm(() => {
 });
 
 // lib/cursor-sessions.ts
-import { readFileSync as readFileSync18, readdirSync as readdirSync12, existsSync as existsSync24, statSync as statSync19 } from "node:fs";
+import { readFileSync as readFileSync18, readdirSync as readdirSync13, existsSync as existsSync24, statSync as statSync20 } from "node:fs";
 import { readFile as readFile13 } from "node:fs/promises";
 import { basename as basename6, join as join29, resolve as resolve18, sep as sep3 } from "node:path";
 import { homedir as homedir23 } from "node:os";
@@ -27599,7 +27677,7 @@ function getCursorSessionDir(sessionId) {
   const projectsRoot = resolve18(home, NEW_PROJECTS_DIR2);
   let projectEntries = [];
   try {
-    projectEntries = readdirSync12(projectsRoot, { withFileTypes: true });
+    projectEntries = readdirSync13(projectsRoot, { withFileTypes: true });
   } catch {}
   for (const entry of projectEntries) {
     if (!entry.isDirectory())
@@ -27841,7 +27919,7 @@ var init_cursor_sessions = __esm(() => {
 });
 
 // lib/pi-sessions.ts
-import { readFileSync as readFileSync19, readdirSync as readdirSync13, existsSync as existsSync25, statSync as statSync20 } from "node:fs";
+import { readFileSync as readFileSync19, readdirSync as readdirSync14, existsSync as existsSync25, statSync as statSync21 } from "node:fs";
 import { readFile as readFile14 } from "node:fs/promises";
 import { join as join30, resolve as resolve19, sep as sep4 } from "node:path";
 import { homedir as homedir24 } from "node:os";
@@ -27857,7 +27935,7 @@ function findPiTranscript(sessionId) {
   const root = resolve19(getPiSessionStateRoot());
   let cwdDirs;
   try {
-    cwdDirs = readdirSync13(root);
+    cwdDirs = readdirSync14(root);
   } catch {
     return null;
   }
@@ -27867,7 +27945,7 @@ function findPiTranscript(sessionId) {
       continue;
     let files;
     try {
-      files = readdirSync13(cwdPath);
+      files = readdirSync14(cwdPath);
     } catch {
       continue;
     }
@@ -28517,7 +28595,7 @@ var init_pack_failclosed = __esm(() => {
 });
 
 // src/hooks/session-pause.ts
-import { existsSync as existsSync27, mkdirSync as mkdirSync12, readdirSync as readdirSync14, readFileSync as readFileSync21, rmSync as rmSync10 } from "node:fs";
+import { existsSync as existsSync27, mkdirSync as mkdirSync12, readdirSync as readdirSync15, readFileSync as readFileSync21, rmSync as rmSync10 } from "node:fs";
 import { createHash as createHash8 } from "node:crypto";
 import { join as join31, resolve as resolve21 } from "node:path";
 function pauseStateDir() {
@@ -28631,7 +28709,7 @@ function listActivePauses(now = Date.now()) {
   const out = [];
   let names;
   try {
-    names = readdirSync14(dir);
+    names = readdirSync15(dir);
   } catch {
     return [];
   }
@@ -28682,14 +28760,14 @@ import {
   existsSync as existsSync28,
   mkdirSync as mkdirSync13,
   readFileSync as readFileSync22,
-  readdirSync as readdirSync15,
+  readdirSync as readdirSync16,
   renameSync as renameSync9,
   rmSync as rmSync11,
   rmdirSync,
-  statSync as statSync21,
+  statSync as statSync22,
   writeFileSync as writeFileSync11
 } from "node:fs";
-import { dirname as dirname14, isAbsolute as isAbsolute3, relative as relative4, resolve as resolve22 } from "node:path";
+import { dirname as dirname15, isAbsolute as isAbsolute3, relative as relative4, resolve as resolve22 } from "node:path";
 function migrateConventionPolicies() {
   const from = legacy.customPoliciesDir();
   if (!existsSync28(from))
@@ -28698,7 +28776,7 @@ function migrateConventionPolicies() {
   const mergeInto = (dir, dest, prefix) => {
     let entries;
     try {
-      entries = readdirSync15(dir, { withFileTypes: true });
+      entries = readdirSync16(dir, { withFileTypes: true });
     } catch {
       return;
     }
@@ -28720,7 +28798,7 @@ function migrateConventionPolicies() {
         } catch {}
         continue;
       }
-      if (entry.isDirectory() && statSync21(target).isDirectory()) {
+      if (entry.isDirectory() && statSync22(target).isDirectory()) {
         mergeInto(source, target, `${name}/`);
         try {
           rmdirSync(source);
@@ -28744,7 +28822,7 @@ function migrateLegacySpool() {
       continue;
     try {
       mkdirSync13(to, { recursive: true });
-      for (const entry of readdirSync15(from, { withFileTypes: true })) {
+      for (const entry of readdirSync16(from, { withFileTypes: true })) {
         if (!entry.isFile())
           continue;
         let name = entry.name;
@@ -28771,7 +28849,7 @@ function migrateHookActivity() {
     return [];
   const moved = [];
   try {
-    const entries = readdirSync15(from, { withFileTypes: true }).filter((e) => e.isFile() && e.name.endsWith(".jsonl"));
+    const entries = readdirSync16(from, { withFileTypes: true }).filter((e) => e.isFile() && e.name.endsWith(".jsonl"));
     if (entries.length === 0)
       return [];
     const to = hookActivityDir();
@@ -28887,7 +28965,7 @@ function writeCarriedPolicyConfig(carried) {
     }
   } catch {}
   try {
-    mkdirSync13(dirname14(to), { recursive: true });
+    mkdirSync13(dirname15(to), { recursive: true });
     writeFileSync11(to, JSON.stringify({ ...existing, ...carried }, null, 2) + `
 `, "utf8");
   } catch {
@@ -29079,12 +29157,12 @@ var init_untraced_note = __esm(() => {
 });
 
 // src/hooks/agent-roster.ts
-import { lstatSync as lstatSync4, readFileSync as readFileSync24, statSync as statSync22 } from "node:fs";
+import { lstatSync as lstatSync4, readFileSync as readFileSync24, statSync as statSync23 } from "node:fs";
 import { homedir as homedir26 } from "node:os";
-import { dirname as dirname15, resolve as resolve23 } from "node:path";
+import { dirname as dirname16, resolve as resolve23 } from "node:path";
 function installedHookAt2(path, cli) {
   try {
-    const stat = statSync22(path);
+    const stat = statSync23(path);
     if (!stat.isFile() || stat.size > 131072)
       return false;
     const text = readFileSync24(path, "utf8");
@@ -29142,7 +29220,7 @@ function runtimeAgentSettingsPath2(cli, cwd, userHome = homedir26(), hookScope)
       if (installedHookAt2(path, cli))
         matches.add(path);
     }
-    const parent = dirname15(dir);
+    const parent = dirname16(dir);
     if (parent === dir)
       break;
     dir = parent;
@@ -29235,8 +29313,8 @@ var init_agent_roster2 = __esm(() => {
 });
 
 // src/hooks/semantic/jev-config.ts
-import { closeSync as closeSync3, constants as fsConstants4, fstatSync as fstatSync2, openSync as openSync3, readSync as readSync2, statSync as statSync23 } from "node:fs";
-import { dirname as dirname16 } from "node:path";
+import { closeSync as closeSync3, constants as fsConstants4, fstatSync as fstatSync2, openSync as openSync3, readSync as readSync2, statSync as statSync24 } from "node:fs";
+import { dirname as dirname17 } from "node:path";
 function parseJevMode(raw) {
   return raw === "off" || raw === "observe" || raw === "enforce" ? raw : null;
 }
@@ -29496,7 +29574,7 @@ function looseConfigDirMode(path) {
   if (!modesAreMeaningful())
     return null;
   try {
-    const mode = statSync23(dirname16(path)).mode & 511;
+    const mode = statSync24(dirname17(path)).mode & 511;
     return (mode & DIR_WRITABLE_BY_OTHERS2) !== 0 ? mode : null;
   } catch {
     return null;
@@ -29557,8 +29635,8 @@ function inspectJevConfig() {
         path,
         mode,
         reason: "too-open",
-        problem: `its directory ${dirname16(path)} is ${dirMode.toString(8).padStart(4, "0")} — other users can write there, ` + `so they can put their own config in its place; it must be owner-only (chmod 700 ${dirname16(path)})`,
-        fix: `chmod 700 ${dirname16(path)}`
+        problem: `its directory ${dirname17(path)} is ${dirMode.toString(8).padStart(4, "0")} — other users can write there, ` + `so they can put their own config in its place; it must be owner-only (chmod 700 ${dirname17(path)})`,
+        fix: `chmod 700 ${dirname17(path)}`
       };
     }
     if (st.size > MAX_CONFIG_BYTES)
@@ -29677,14 +29755,14 @@ function jevInputsVersion() {
     process.platform,
     credentials,
     statVersion(credentials),
-    statVersion(dirname16(credentials)),
+    statVersion(dirname17(credentials)),
     config,
     statVersion(config)
   ].join("\x00");
 }
 function statVersion(path) {
   try {
-    const st = statSync23(path, { bigint: true });
+    const st = statSync24(path, { bigint: true });
     return `${st.dev}:${st.ino}:${st.mode}:${st.size}:${st.mtimeNs}:${st.ctimeNs}`;
   } catch (err) {
     return `-${err.code ?? "error"}`;
@@ -29912,9 +29990,9 @@ var init_cloud_jev_health = __esm(() => {
 });
 
 // src/hooks/semantic/facts.ts
-import { existsSync as existsSync30, readFileSync as readFileSync25, statSync as statSync24 } from "node:fs";
+import { existsSync as existsSync30, readFileSync as readFileSync25, statSync as statSync25 } from "node:fs";
 import { homedir as homedir27 } from "node:os";
-import { dirname as dirname17, isAbsolute as isAbsolute4, resolve as resolve24 } from "node:path";
+import { dirname as dirname18, isAbsolute as isAbsolute4, resolve as resolve24 } from "node:path";
 function classifyTool(toolName) {
   if (SHELL_TOOLS.has(toolName))
     return { toolClass: "shell", toolIsKnown: true };
@@ -30141,7 +30219,7 @@ function findGitDir(start) {
     const candidate = resolve24(dir, ".git");
     if (existsSync30(candidate))
       return candidate;
-    const parent = dirname17(dir);
+    const parent = dirname18(dir);
     if (parent === dir)
       return null;
     dir = parent;
@@ -30152,7 +30230,7 @@ function findProjectRoot(cwd) {
   if (!cwd)
     return null;
   const gitDir = findGitDir(cwd);
-  return gitDir ? dirname17(gitDir) : cwd;
+  return gitDir ? dirname18(gitDir) : cwd;
 }
 function readCurrentBranch(cwd) {
   if (!cwd)
@@ -30162,12 +30240,12 @@ function readCurrentBranch(cwd) {
     if (!gitPath)
       return null;
     let headFile = resolve24(gitPath, "HEAD");
-    if (statSync24(gitPath).isFile()) {
+    if (statSync25(gitPath).isFile()) {
       const pointer = readFileSync25(gitPath, "utf8").trim();
       const m = /^gitdir:\s*(.+)$/.exec(pointer);
       if (!m)
         return null;
-      headFile = resolve24(dirname17(gitPath), m[1], "HEAD");
+      headFile = resolve24(dirname18(gitPath), m[1], "HEAD");
     }
     const head = readFileSync25(headFile, "utf8").trim();
     const ref = /^ref:\s*refs\/heads\/(.+)$/.exec(head);
@@ -30562,15 +30640,15 @@ import {
   closeSync as closeSync4,
   mkdirSync as mkdirSync14,
   openSync as openSync4,
-  readdirSync as readdirSync16,
+  readdirSync as readdirSync17,
   readFileSync as readFileSync26,
   readSync as readSync3,
   renameSync as renameSync10,
-  statSync as statSync25,
+  statSync as statSync26,
   unlinkSync as unlinkSync4,
   writeFileSync as writeFileSync12
 } from "node:fs";
-import { dirname as dirname18, resolve as resolve25 } from "node:path";
+import { dirname as dirname19, resolve as resolve25 } from "node:path";
 function intentProfileKey(profile) {
   if (validAgentIdentity(profile.agent))
     return `${profile.agent.integration}.${profile.agent.instanceId}`;
@@ -30596,7 +30674,7 @@ function storeDirChain(innermost = sessionsDir()) {
     chain.push(dir);
     if (dir === home)
       break;
-    const parent = dirname18(dir);
+    const parent = dirname19(dir);
     if (parent === dir)
       break;
     dir = parent;
@@ -30609,7 +30687,7 @@ function looseIntentStoreDir(innermost) {
   for (const dir of storeDirChain(innermost)) {
     let mode;
     try {
-      mode = statSync25(dir).mode & 511;
+      mode = statSync26(dir).mode & 511;
     } catch {
       continue;
     }
@@ -30617,7 +30695,7 @@ function looseIntentStoreDir(innermost) {
       continue;
     try {
       chmodSync7(dir, mode & ~DIR_WRITABLE_BY_OTHERS3);
-      if ((statSync25(dir).mode & DIR_WRITABLE_BY_OTHERS3) !== 0)
+      if ((statSync26(dir).mode & DIR_WRITABLE_BY_OTHERS3) !== 0)
         return dir;
     } catch {
       return dir;
@@ -30654,7 +30732,7 @@ function appendPrompt(slot, entry) {
 }
 function fileExists2(path) {
   try {
-    statSync25(path);
+    statSync26(path);
     return true;
   } catch {
     return false;
@@ -30664,12 +30742,12 @@ function pruneExpiredSessions(now = Date.now()) {
   const root = sessionsDir();
   let removed = pruneDir(root, now);
   try {
-    for (const name of readdirSync16(root)) {
+    for (const name of readdirSync17(root)) {
       if (!PROFILE_DIR_RE.test(name))
         continue;
       const dir = resolve25(root, name);
       try {
-        if (statSync25(dir).isDirectory())
+        if (statSync26(dir).isDirectory())
           removed += pruneDir(dir, now);
       } catch {}
     }
@@ -30679,12 +30757,12 @@ function pruneExpiredSessions(now = Date.now()) {
 function pruneDir(dir, now) {
   let removed = 0;
   try {
-    for (const name of readdirSync16(dir)) {
+    for (const name of readdirSync17(dir)) {
       if (!SESSION_FILE_RE3.test(name))
         continue;
       const path = resolve25(dir, name);
       try {
-        const st = statSync25(path);
+        const st = statSync26(path);
         if (st.isFile() && now - st.mtimeMs > INTENT_MAX_AGE_MS) {
           unlinkSync4(path);
           removed++;
@@ -30999,7 +31077,7 @@ function visitLinesBackwards(transcriptPath, maxBytes, visit) {
     return;
   let fd;
   try {
-    const st = statSync25(path);
+    const st = statSync26(path);
     if (!st.isFile() || st.size === 0)
       return;
     fd = openSync4(path, "r");
@@ -31635,7 +31713,7 @@ var init_jev_client = __esm(() => {
 
 // src/hooks/semantic/evaluator.ts
 import { createHash as createHash9 } from "node:crypto";
-import { appendFileSync as appendFileSync3, mkdirSync as mkdirSync15, renameSync as renameSync11, statSync as statSync26 } from "node:fs";
+import { appendFileSync as appendFileSync3, mkdirSync as mkdirSync15, renameSync as renameSync11, statSync as statSync27 } from "node:fs";
 import { resolve as resolve26 } from "node:path";
 function storeCut(message) {
   return typeof message === "string" && message.length >= MAX_USER_MESSAGE_CHARS - STORE_CUT_SLACK && OMISSION_MARK.test(message);
@@ -31809,7 +31887,7 @@ function appendVerdictLog(row) {
     const file = verdictLogFile();
     mkdirSync15(semanticDir(), { recursive: true, mode: 448 });
     try {
-      if (statSync26(file).size > VERDICT_LOG_MAX_BYTES)
+      if (statSync27(file).size > VERDICT_LOG_MAX_BYTES)
         renameSync11(file, `${file}.1`);
     } catch {}
     appendFileSync3(file, JSON.stringify(row) + `
@@ -32534,7 +32612,7 @@ var init_jev_throttle = __esm(() => {
 });
 
 // src/hooks/semantic/session-root.ts
-import { mkdirSync as mkdirSync16, readdirSync as readdirSync17, readFileSync as readFileSync27, statSync as statSync27, unlinkSync as unlinkSync5, writeFileSync as writeFileSync13 } from "node:fs";
+import { mkdirSync as mkdirSync16, readdirSync as readdirSync18, readFileSync as readFileSync27, statSync as statSync28, unlinkSync as unlinkSync5, writeFileSync as writeFileSync13 } from "node:fs";
 import { isAbsolute as isAbsolute5, resolve as resolve27 } from "node:path";
 function validRoot(v) {
   return typeof v === "string" && isAbsolute5(v) && resolve27(v) === v && v !== "/";
@@ -32545,7 +32623,7 @@ function storeIsOurs() {
   if (looseIntentStoreDir() !== null)
     return false;
   try {
-    const mode = statSync27(rootsDir()).mode & 511;
+    const mode = statSync28(rootsDir()).mode & 511;
     return (mode & DIR_WRITABLE_BY_OTHERS4) === 0;
   } catch {
     return true;
@@ -32563,12 +32641,12 @@ function pruneSessionRoots(now = Date.now()) {
   let removed = 0;
   try {
     const dir = rootsDir();
-    for (const name of readdirSync17(dir)) {
+    for (const name of readdirSync18(dir)) {
       if (!ROOT_FILE_RE.test(name))
         continue;
       const path = resolve27(dir, name);
       try {
-        const st = statSync27(path);
+        const st = statSync28(path);
         if (st.isFile() && now - st.mtimeMs > SESSION_ROOT_MAX_AGE_MS) {
           unlinkSync5(path);
           removed++;
@@ -34507,8 +34585,8 @@ var init_collector_config = __esm(() => {
 });
 
 // src/hooks/flush-cli.ts
-import { existsSync as existsSync32, mkdirSync as mkdirSync17, writeFileSync as writeFileSync14, readdirSync as readdirSync18, statSync as statSync28 } from "node:fs";
-import { dirname as dirname19, join as join33 } from "node:path";
+import { existsSync as existsSync32, mkdirSync as mkdirSync17, writeFileSync as writeFileSync14, readdirSync as readdirSync19, statSync as statSync29 } from "node:fs";
+import { dirname as dirname20, join as join33 } from "node:path";
 function flushRequestPath(home) {
   return join33(failproofaiHome(home), "state", "flush-request.json");
 }
@@ -34518,14 +34596,14 @@ function spoolDirs(home) {
   if (!existsSync32(root))
     return dirs;
   try {
-    return dirs.concat(readdirSync18(root, { withFileTypes: true }).filter((e) => e.isDirectory() && e.name !== "failed").map((e) => join33(root, e.name)));
+    return dirs.concat(readdirSync19(root, { withFileTypes: true }).filter((e) => e.isDirectory() && e.name !== "failed").map((e) => join33(root, e.name)));
   } catch {
     return dirs;
   }
 }
 function parkedBatches(home) {
   try {
-    return readdirSync18(failedDir(home)).filter((f) => f.endsWith(".jsonl")).length;
+    return readdirSync19(failedDir(home)).filter((f) => f.endsWith(".jsonl")).length;
   } catch {
     return 0;
   }
@@ -34542,14 +34620,14 @@ function spoolBacklog(home, now = Date.now()) {
   for (const dir of spoolDirs(home)) {
     let names;
     try {
-      names = readdirSync18(dir).filter((f) => f.endsWith(".jsonl"));
+      names = readdirSync19(dir).filter((f) => f.endsWith(".jsonl"));
     } catch {
       continue;
     }
     count += names.length;
     for (const name of names) {
       try {
-        const mtime = statSync28(join33(dir, name)).mtimeMs;
+        const mtime = statSync29(join33(dir, name)).mtimeMs;
         if (oldest === undefined || mtime < oldest)
           oldest = mtime;
       } catch {}
@@ -34611,7 +34689,7 @@ async function runFlushCommand(opts = {}) {
     return { exitCode: 0, pending: 0, lines: nothing };
   }
   const path = flushRequestPath(home);
-  mkdirSync17(dirname19(path), { recursive: true });
+  mkdirSync17(dirname20(path), { recursive: true });
   writeFileSync14(path, `${JSON.stringify({ requestedAtMs: Date.now() }, null, 2)}
 `, {
     mode: 384
@@ -34655,7 +34733,7 @@ import {
   rmSync as rmSync12,
   writeFileSync as writeFileSync15
 } from "node:fs";
-import { basename as basename7, dirname as dirname20, join as join34, resolve as resolve28 } from "node:path";
+import { basename as basename7, dirname as dirname21, join as join34, resolve as resolve28 } from "node:path";
 function migrateToLayout4() {
   const moves = [
     { from: legacy.authJson(), to: auditSessionFile() },
@@ -34677,7 +34755,7 @@ function migrateToLayout4() {
       rmSync12(from, { force: true });
       continue;
     }
-    mkdirSync18(dirname20(to), { recursive: true });
+    mkdirSync18(dirname21(to), { recursive: true });
     try {
       renameSync12(from, to);
     } catch {
@@ -35114,7 +35192,7 @@ var init_install_telemetry = () => {};
 
 // lib/install-check.ts
 import { existsSync as existsSync34, readFileSync as readFileSync30, writeFileSync as writeFileSync17, mkdirSync as mkdirSync20 } from "node:fs";
-import { dirname as dirname21, resolve as resolve29 } from "node:path";
+import { dirname as dirname22, resolve as resolve29 } from "node:path";
 import { platform as platform2, arch as arch2, release, homedir as homedir29, hostname as hostname2 } from "node:os";
 import { createHmac as createHmac2 } from "node:crypto";
 function hashToId4(raw) {
@@ -35248,7 +35326,7 @@ async function maybeReportInstall(version) {
       enabled_policy_count: hooks.policyCount
     }, { version, timeoutMs: REPORT_TIMEOUT_MS, enabled: telemetryEnabled }));
     try {
-      mkdirSync20(dirname21(versionFile), { recursive: true });
+      mkdirSync20(dirname22(versionFile), { recursive: true });
       writeFileSync17(versionFile, version, "utf8");
     } catch {}
     await Promise.all(events.map((p) => p.catch(() => {})));
@@ -36716,7 +36794,7 @@ var init_cloud_introspect = __esm(() => {
 
 // src/hooks/credential-recovery.ts
 import { createHash as createHash11 } from "node:crypto";
-import { existsSync as existsSync40, mkdirSync as mkdirSync22, readdirSync as readdirSync19, renameSync as renameSync13 } from "node:fs";
+import { existsSync as existsSync40, mkdirSync as mkdirSync22, readdirSync as readdirSync20, renameSync as renameSync13 } from "node:fs";
 import { join as join38 } from "node:path";
 function previousOrgDirectory(id) {
   const safe = id && /^[A-Za-z0-9_-]{1,128}$/.test(id) ? id : id ? createHash11("sha256").update(id).digest("hex") : "unknown";
@@ -36727,7 +36805,7 @@ function recoverCredentialRefusals(sameOrg, oldOrgId) {
   if (!existsSync40(dir))
     return 0;
   let recovered = 0;
-  for (const name of readdirSync19(dir)) {
+  for (const name of readdirSync20(dir)) {
     if (!/\.c(401|403)\.jsonl$/.test(name) || name.startsWith("."))
       continue;
     const targetDir = sameOrg ? dir : join38(previousOrgDirectory(oldOrgId), "failed");
@@ -36764,11 +36842,11 @@ import {
   readSync as readSync4,
   renameSync as renameSync14,
   rmSync as rmSync15,
-  statSync as statSync29,
+  statSync as statSync30,
   unlinkSync as unlinkSync6,
   writeFileSync as writeFileSync18
 } from "node:fs";
-import { dirname as dirname22 } from "node:path";
+import { dirname as dirname23 } from "node:path";
 import { randomBytes as randomBytes3 } from "node:crypto";
 function writeCloudJevConfig(cloudBase) {
   const first = writeCloudJevConfigIfAbsent(cloudBase);
@@ -36849,7 +36927,7 @@ function writeCloudJevConfigIfAbsent(cloudBase) {
     return kept(path, cloudBase);
   const body = `${JSON.stringify({ provider: JEV_CLOUD_PROVIDER, baseUrl, mode: CLOUD_JEV_INITIAL_MODE }, null, 2)}
 `;
-  const dir = dirname22(path);
+  const dir = dirname23(path);
   const tmp = `${path}.${process.pid}.${randomBytes3(6).toString("hex")}.tmp`;
   try {
     if (!existsSync41(dir))
@@ -36914,7 +36992,7 @@ function tightenDir(dir) {
   if (process.platform === "win32")
     return;
   try {
-    const before = statSync29(dir).mode & 511;
+    const before = statSync30(dir).mode & 511;
     if ((before & 18) !== 0)
       chmodSync9(dir, before & ~18);
   } catch {}
@@ -37337,8 +37415,8 @@ var init_cloud_connection = __esm(() => {
 });
 
 // src/hooks/setup-state.ts
-import { existsSync as existsSync42, realpathSync as realpathSync4, statSync as statSync30 } from "node:fs";
-import { dirname as dirname23, resolve as resolve32 } from "node:path";
+import { existsSync as existsSync42, realpathSync as realpathSync4, statSync as statSync31 } from "node:fs";
+import { dirname as dirname24, resolve as resolve32 } from "node:path";
 import { homedir as homedir31 } from "node:os";
 function globalConfigPath(home = homedir31()) {
   return globalPolicyConfigFile(home);
@@ -37351,7 +37429,7 @@ function legacyMarkerPath(home) {
 }
 function isDir(path) {
   try {
-    return statSync30(path).isDirectory();
+    return statSync31(path).isDirectory();
   } catch {
     return false;
   }
@@ -37362,7 +37440,7 @@ function findProjectRoot2(start, home = homedir31()) {
   while (dir !== resolvedHome) {
     if (isDir(resolve32(dir, ".failproofai")))
       return dir;
-    const parent = dirname23(dir);
+    const parent = dirname24(dir);
     if (parent === dir)
       break;
     dir = parent;
@@ -37412,7 +37490,7 @@ var init_setup_state = __esm(() => {
 
 // src/hooks/onboarding-attempt.ts
 import { existsSync as existsSync43, mkdirSync as mkdirSync24, readFileSync as readFileSync34, rmSync as rmSync17, writeFileSync as writeFileSync19 } from "node:fs";
-import { dirname as dirname24 } from "node:path";
+import { dirname as dirname25 } from "node:path";
 function readOnboardingAttempt() {
   const path = onboardingAttemptFile();
   if (!existsSync43(path))
@@ -37437,7 +37515,7 @@ function readOnboardingAttempt() {
 function recordOnboardingAttempt(reason, cliVersion, daemonStatus, now = Date.now()) {
   try {
     const path = onboardingAttemptFile();
-    mkdirSync24(dirname24(path), { recursive: true });
+    mkdirSync24(dirname25(path), { recursive: true });
     const record = {
       schemaVersion: SCHEMA_VERSION3,
       reason,
@@ -37545,7 +37623,7 @@ var init_onboarding_lock = __esm(() => {
 });
 
 // lib/claude-sessions.ts
-import { readdirSync as readdirSync20, statSync as statSync31, existsSync as existsSync44 } from "node:fs";
+import { readdirSync as readdirSync21, statSync as statSync32, existsSync as existsSync44 } from "node:fs";
 import { join as join39, basename as basename9 } from "node:path";
 function getClaudeProjectsRoot() {
   return getClaudeProjectsPath();
@@ -37554,7 +37632,7 @@ function listClaudeProjects() {
   const root = getClaudeProjectsRoot();
   let entries;
   try {
-    entries = readdirSync20(root, { withFileTypes: true });
+    entries = readdirSync21(root, { withFileTypes: true });
   } catch {
     return [];
   }
@@ -37568,7 +37646,7 @@ function listClaudeTranscripts(project) {
   const out = [];
   let entries;
   try {
-    entries = readdirSync20(project.path, { withFileTypes: true });
+    entries = readdirSync21(project.path, { withFileTypes: true });
   } catch {
     return out;
   }
@@ -37579,7 +37657,7 @@ function listClaudeTranscripts(project) {
         continue;
       const transcriptPath = join39(project.path, entry.name);
       try {
-        const s = statSync31(transcriptPath);
+        const s = statSync32(transcriptPath);
         out.push({
           projectName: project.name,
           cwd: project.cwd,
@@ -37596,7 +37674,7 @@ function listClaudeTranscripts(project) {
         continue;
       let subEntries;
       try {
-        subEntries = readdirSync20(subDir, { withFileTypes: true });
+        subEntries = readdirSync21(subDir, { withFileTypes: true });
       } catch {
         continue;
       }
@@ -37606,7 +37684,7 @@ function listClaudeTranscripts(project) {
         const agentId = sub.name.slice(0, -".jsonl".length);
         const transcriptPath = join39(subDir, sub.name);
         try {
-          const s = statSync31(transcriptPath);
+          const s = statSync32(transcriptPath);
           out.push({
             projectName: project.name,
             cwd: project.cwd,
@@ -37822,7 +37900,7 @@ var init_claude = __esm(() => {
 });
 
 // src/audit/cli-adapters/codex.ts
-import { statSync as statSync32 } from "node:fs";
+import { statSync as statSync33 } from "node:fs";
 async function listCodexTranscriptMetadata(opts = {}) {
   const projectFilter = opts.projects ? new Set(opts.projects) : null;
   const sinceMs = opts.sinceMs ?? 0;
@@ -37839,7 +37917,7 @@ async function listCodexTranscriptMetadata(opts = {}) {
         continue;
       let sizeBytes = 0;
       try {
-        sizeBytes = statSync32(s.path).size;
+        sizeBytes = statSync33(s.path).size;
       } catch {}
       if (!s.sessionId)
         continue;
@@ -37873,7 +37951,7 @@ var init_codex = __esm(() => {
 });
 
 // src/audit/cli-adapters/copilot.ts
-import { statSync as statSync33 } from "node:fs";
+import { statSync as statSync34 } from "node:fs";
 async function listCopilotTranscriptMetadata(opts = {}) {
   const projectFilter = opts.projects ? new Set(opts.projects) : null;
   const sinceMs = opts.sinceMs ?? 0;
@@ -37890,7 +37968,7 @@ async function listCopilotTranscriptMetadata(opts = {}) {
         continue;
       let sizeBytes = 0;
       try {
-        sizeBytes = statSync33(s.path).size;
+        sizeBytes = statSync34(s.path).size;
       } catch {}
       if (!s.sessionId)
         continue;
@@ -37924,7 +38002,7 @@ var init_copilot = __esm(() => {
 });
 
 // src/audit/cli-adapters/cursor.ts
-import { statSync as statSync34 } from "node:fs";
+import { statSync as statSync35 } from "node:fs";
 async function listCursorTranscriptMetadata(opts = {}) {
   const projectFilter = opts.projects ? new Set(opts.projects) : null;
   const sinceMs = opts.sinceMs ?? 0;
@@ -37941,7 +38019,7 @@ async function listCursorTranscriptMetadata(opts = {}) {
         continue;
       let sizeBytes = 0;
       try {
-        sizeBytes = statSync34(s.path).size;
+        sizeBytes = statSync35(s.path).size;
       } catch {}
       if (!s.sessionId)
         continue;
@@ -38182,7 +38260,7 @@ var init_opencode = __esm(() => {
 });
 
 // src/audit/cli-adapters/pi.ts
-import { statSync as statSync35 } from "node:fs";
+import { statSync as statSync36 } from "node:fs";
 async function listPiTranscriptMetadata(opts = {}) {
   const projectFilter = opts.projects ? new Set(opts.projects) : null;
   const sinceMs = opts.sinceMs ?? 0;
@@ -38199,7 +38277,7 @@ async function listPiTranscriptMetadata(opts = {}) {
         continue;
       let sizeBytes = 0;
       try {
-        sizeBytes = statSync35(s.path).size;
+        sizeBytes = statSync36(s.path).size;
       } catch {}
       if (!s.sessionId)
         continue;
@@ -39858,7 +39936,7 @@ var init_api_server_client = __esm(() => {
 });
 
 // lib/auth/auth-store.ts
-import { existsSync as existsSync47, readFileSync as readFileSync39, readdirSync as readdirSync21, rmSync as rmSync19 } from "node:fs";
+import { existsSync as existsSync47, readFileSync as readFileSync39, readdirSync as readdirSync22, rmSync as rmSync19 } from "node:fs";
 import { join as join41, resolve as resolve33 } from "node:path";
 function getAuthFilePath() {
   const override = process.env.FAILPROOFAI_AUTH_DIR;
@@ -39899,7 +39977,7 @@ function deleteAuth() {
     const root = migrationsDir();
     if (!existsSync47(root))
       return;
-    for (const entry of readdirSync21(root)) {
+    for (const entry of readdirSync22(root)) {
       if (!entry.startsWith("backup-layout"))
         continue;
       const copy = resolve33(root, entry, "auth.json");
@@ -40494,7 +40572,7 @@ var init_cli = __esm(() => {
 // src/hooks/configure-wizard.ts
 import { existsSync as existsSync49, mkdirSync as mkdirSync28, writeFileSync as writeFileSync23, readFileSync as readFileSync41 } from "node:fs";
 import { homedir as homedir34 } from "node:os";
-import { dirname as dirname25, resolve as resolve34, sep as sep5 } from "node:path";
+import { dirname as dirname26, resolve as resolve34, sep as sep5 } from "node:path";
 async function emit(event, props) {
   try {
     await trackHookEvent2(getInstanceId2(), event, props);
@@ -40683,7 +40761,7 @@ function firstRunMarkerPath() {
 }
 function markLauncherSeen() {
   try {
-    mkdirSync28(dirname25(firstRunMarkerPath()), { recursive: true });
+    mkdirSync28(dirname26(firstRunMarkerPath()), { recursive: true });
     writeFileSync23(firstRunMarkerPath(), "1", "utf8");
   } catch {}
 }
@@ -41510,8 +41588,8 @@ var init_configure_wizard = __esm(() => {
 });
 
 // src/hooks/flush-cli.ts
-import { existsSync as existsSync50, mkdirSync as mkdirSync29, writeFileSync as writeFileSync24, readdirSync as readdirSync22, statSync as statSync36 } from "node:fs";
-import { dirname as dirname26, join as join42 } from "node:path";
+import { existsSync as existsSync50, mkdirSync as mkdirSync29, writeFileSync as writeFileSync24, readdirSync as readdirSync23, statSync as statSync37 } from "node:fs";
+import { dirname as dirname27, join as join42 } from "node:path";
 function flushRequestPath2(home) {
   return join42(failproofaiHome(home), "state", "flush-request.json");
 }
@@ -41521,14 +41599,14 @@ function spoolDirs2(home) {
   if (!existsSync50(root))
     return dirs;
   try {
-    return dirs.concat(readdirSync22(root, { withFileTypes: true }).filter((e) => e.isDirectory() && e.name !== "failed").map((e) => join42(root, e.name)));
+    return dirs.concat(readdirSync23(root, { withFileTypes: true }).filter((e) => e.isDirectory() && e.name !== "failed").map((e) => join42(root, e.name)));
   } catch {
     return dirs;
   }
 }
 function parkedBatches2(home) {
   try {
-    return readdirSync22(failedDir(home)).filter((f) => f.endsWith(".jsonl")).length;
+    return readdirSync23(failedDir(home)).filter((f) => f.endsWith(".jsonl")).length;
   } catch {
     return 0;
   }
@@ -41545,14 +41623,14 @@ function spoolBacklog2(home, now = Date.now()) {
   for (const dir of spoolDirs2(home)) {
     let names;
     try {
-      names = readdirSync22(dir).filter((f) => f.endsWith(".jsonl"));
+      names = readdirSync23(dir).filter((f) => f.endsWith(".jsonl"));
     } catch {
       continue;
     }
     count += names.length;
     for (const name of names) {
       try {
-        const mtime = statSync36(join42(dir, name)).mtimeMs;
+        const mtime = statSync37(join42(dir, name)).mtimeMs;
         if (oldest === undefined || mtime < oldest)
           oldest = mtime;
       } catch {}
@@ -41614,7 +41692,7 @@ async function runFlushCommand2(opts = {}) {
     return { exitCode: 0, pending: 0, lines: nothing };
   }
   const path = flushRequestPath2(home);
-  mkdirSync29(dirname26(path), { recursive: true });
+  mkdirSync29(dirname27(path), { recursive: true });
   writeFileSync24(path, `${JSON.stringify({ requestedAtMs: Date.now() }, null, 2)}
 `, {
     mode: 384
@@ -44143,7 +44221,7 @@ var init_main = __esm(() => {
 // src/hooks/otel-writers.ts
 import { homedir as homedir35 } from "node:os";
 import { resolve as resolve35 } from "node:path";
-import { accessSync as accessSync2, constants, readdirSync as readdirSync23, statSync as statSync37 } from "node:fs";
+import { accessSync as accessSync2, constants, readdirSync as readdirSync24, statSync as statSync38 } from "node:fs";
 function vscodeSettingsPath(home = homedir35(), platform = process.platform) {
   if (platform === "darwin")
     return resolve35(home, "Library/Application Support/Code/User/settings.json");
@@ -44158,7 +44236,7 @@ function vscodeInstalled(home = homedir35(), platform = process.platform) {
   const executable = (path) => {
     try {
       accessSync2(path, platform === "win32" ? constants.F_OK : constants.X_OK);
-      return statSync37(path).isFile();
+      return statSync38(path).isFile();
     } catch {
       return false;
     }
@@ -44170,7 +44248,7 @@ function vscodeInstalled(home = homedir35(), platform = process.platform) {
     return true;
   return [".vscode", ".vscode-insiders"].some((folder) => {
     try {
-      return readdirSync23(resolve35(home, folder, "extensions"), { withFileTypes: true }).some((entry) => entry.isDirectory() && /^github\.copilot(?:-chat)?-\d/i.test(entry.name));
+      return readdirSync24(resolve35(home, folder, "extensions"), { withFileTypes: true }).some((entry) => entry.isDirectory() && /^github\.copilot(?:-chat)?-\d/i.test(entry.name));
     } catch {
       return false;
     }
@@ -44393,11 +44471,11 @@ import {
   existsSync as existsSync52,
   mkdirSync as mkdirSync30,
   readFileSync as readFileSync42,
-  statSync as statSync38,
+  statSync as statSync39,
   unlinkSync as unlinkSync8,
   writeFileSync as writeFileSync25
 } from "node:fs";
-import { dirname as dirname27 } from "node:path";
+import { dirname as dirname28 } from "node:path";
 import { createHash as createHash13, randomUUID as randomUUID6 } from "node:crypto";
 import { homedir as homedir36 } from "node:os";
 import { connect } from "node:net";
@@ -44457,13 +44535,13 @@ function credential() {
 function backupOnce(path, original) {
   if (existsSync52(`${path}.failproofai-bak`))
     return;
-  mkdirSync30(dirname27(path), { recursive: true });
+  mkdirSync30(dirname28(path), { recursive: true });
   writeFileSync25(`${path}.failproofai-bak`, original ?? "", { flag: "wx", mode: 384 });
   chmodSync11(`${path}.failproofai-bak`, 384);
 }
 function savePrivate(agent, state) {
   const path = otelAgentStateFile(agent);
-  mkdirSync30(dirname27(path), { recursive: true, mode: 448 });
+  mkdirSync30(dirname28(path), { recursive: true, mode: 448 });
   writeConfigFileAtomic(path, JSON.stringify(state), { backup: false, mode: 384 });
   chmodSync11(path, 384);
 }
@@ -44568,7 +44646,7 @@ async function enableAgent(agent, yes, localFlag, content, options) {
   const next = editAgentConfig(original ?? "", agent, [...released, ...writes]);
   const state = oldState ?? {
     original,
-    originalMode: original === null ? undefined : statSync38(file).mode & 511,
+    originalMode: original === null ? undefined : statSync39(file).mode & 511,
     writtenHash: "",
     previous: writes.map((w) => ({ path: w.path, value: getSetting(parsed, w.path) }))
   };
@@ -45246,8 +45324,8 @@ var init_jev_stats = __esm(() => {
 });
 
 // src/hooks/jev-cli.ts
-import { chmodSync as chmodSync12, existsSync as existsSync53, statSync as statSync39, unlinkSync as unlinkSync9 } from "node:fs";
-import { dirname as dirname28 } from "node:path";
+import { chmodSync as chmodSync12, existsSync as existsSync53, statSync as statSync40, unlinkSync as unlinkSync9 } from "node:fs";
+import { dirname as dirname29 } from "node:path";
 function jevHeader(name, meta, opts) {
   return [screenKit(opts).header(meta ? `${name}  ·  ${meta}` : name)];
 }
@@ -45828,13 +45906,13 @@ async function setupRun(argv, deps, opts) {
   }
   let fileMode = null;
   try {
-    fileMode = statSync39(path).mode & 511;
+    fileMode = statSync40(path).mode & 511;
   } catch {}
-  const dir = dirname28(path);
+  const dir = dirname29(path);
   let tightenedDir = null;
   if (process.platform !== "win32") {
     try {
-      const before = statSync39(dir).mode & 511;
+      const before = statSync40(dir).mode & 511;
       if ((before & 18) !== 0) {
         const after = before & -19;
         chmodSync12(dir, after);
@@ -45956,15 +46034,15 @@ async function cloudSetup(values, bools, opts) {
   }
   if (process.platform !== "win32") {
     try {
-      const dir = dirname28(path);
-      const before = statSync39(dir).mode & 511;
+      const dir = dirname29(path);
+      const before = statSync40(dir).mode & 511;
       if ((before & 18) !== 0)
         chmodSync12(dir, before & -19);
     } catch {}
   }
   let fileMode = null;
   try {
-    fileMode = statSync39(path).mode & 511;
+    fileMode = statSync40(path).mode & 511;
   } catch {}
   const cfg = checked.value;
   const route = jevRoute(cfg);
@@ -46593,7 +46671,7 @@ import {
   openSync as openSync8,
   readFileSync as readFileSync43,
   readSync as readSync6,
-  statSync as statSync40,
+  statSync as statSync41,
   writeFileSync as writeFileSync26
 } from "node:fs";
 function detectLayout2() {
@@ -46677,7 +46755,7 @@ import {
   rmSync as rmSync21,
   writeFileSync as writeFileSync27
 } from "node:fs";
-import { basename as basename10, dirname as dirname29, join as join43, resolve as resolve38 } from "node:path";
+import { basename as basename10, dirname as dirname30, join as join43, resolve as resolve38 } from "node:path";
 function migrateToLayout42() {
   const moves = [
     { from: legacy.authJson(), to: auditSessionFile() },
@@ -46699,7 +46777,7 @@ function migrateToLayout42() {
       rmSync21(from, { force: true });
       continue;
     }
-    mkdirSync32(dirname29(to), { recursive: true });
+    mkdirSync32(dirname30(to), { recursive: true });
     try {
       renameSync15(from, to);
     } catch {
@@ -46938,12 +47016,14 @@ import {
   mkdirSync as mkdirSync33,
   mkdtempSync as mkdtempSync2,
   readFileSync as readFileSync45,
+  readdirSync as readdirSync25,
+  statSync as statSync42,
   writeFileSync as writeFileSync28,
   unlinkSync as unlinkSync10,
   rmSync as rmSync22
 } from "node:fs";
 import { homedir as homedir38, tmpdir as tmpdir3, userInfo as userInfo2 } from "node:os";
-import { resolve as resolve39 } from "node:path";
+import { dirname as dirname31, resolve as resolve39 } from "node:path";
 import { execFileSync as execFileSync3 } from "node:child_process";
 function isDaemonSupportedPlatform2() {
   return process.platform === "linux" || process.platform === "darwin";
@@ -47049,6 +47129,60 @@ function systemdUnitDir2() {
 function systemdUnitPath2(user = serviceUser2()) {
   return resolve39(systemdUnitDir2(), systemdUnitName2(user));
 }
+function systemBinaryRoot2(user = serviceUser2()) {
+  return resolve39(process.env.FAILPROOFAI_SYSTEM_BIN_DIR || "/opt/failproofai", user);
+}
+function systemBinaryDir2() {
+  return resolve39(systemBinaryRoot2(), "bin");
+}
+function systemBinaryTarget2(binaryPath) {
+  if (process.platform !== "linux" || process.env.FAILPROOFAI_DAEMON_BINARY)
+    return null;
+  try {
+    if (!statSync42(binaryPath).isFile())
+      return null;
+  } catch {
+    return null;
+  }
+  return resolve39(systemBinaryDir2(), `failproofaid-${version2}`);
+}
+function selinuxEnabled2() {
+  return existsSync56("/sys/fs/selinux/enforce");
+}
+function stageSystemBinary2(binaryPath) {
+  const target = systemBinaryTarget2(binaryPath);
+  if (!target)
+    return binaryPath;
+  const dir = systemBinaryDir2();
+  const staging = `${target}.${process.pid}.tmp`;
+  runPrivileged2("install", ["-d", "-m", "0755", dir]);
+  try {
+    runPrivileged2("install", ["-m", "0755", binaryPath, staging]);
+    runPrivileged2("mv", ["-f", staging, target]);
+  } catch (err) {
+    try {
+      runPrivileged2("rm", ["-f", staging]);
+    } catch {}
+    throw err;
+  }
+  if (selinuxEnabled2()) {
+    const root = systemBinaryRoot2();
+    try {
+      runPrivileged2("restorecon", ["-R", root]);
+    } catch (err) {
+      hookLogWarn(`restorecon on ${root} failed: ${err instanceof Error ? err.message : String(err)}`);
+    }
+  }
+  return target;
+}
+function pruneSystemBinaries2(current) {
+  try {
+    const dir = systemBinaryDir2();
+    const stale = readdirSync25(dir).filter((f) => f.startsWith("failproofaid-")).map((f) => resolve39(dir, f)).filter((p) => p !== current).map((p) => ({ p, mtime: statSync42(p).mtimeMs })).sort((a, b) => b.mtime - a.mtime).slice(1);
+    for (const { p } of stale)
+      runPrivileged2("rm", ["-f", p]);
+  } catch {}
+}
 function legacySystemdUserUnitPath2() {
   return resolve39(homedir38(), ".config", "systemd", "user", "failproofaid.service");
 }
@@ -47221,9 +47355,17 @@ ${envBlock}    <key>StandardOutPath</key>
 }
 function daemonInstallCommands2(binaryPath, workerCmd, cliCmd) {
   if (process.platform === "linux") {
+    const target = systemBinaryTarget2(binaryPath);
+    const dir = systemBinaryDir2();
+    const stage = target ? [
+      `sudo install -d -m 0755 ${dir}`,
+      `sudo install -m 0755 ${binaryPath} ${target}`,
+      `{ sudo restorecon -R ${systemBinaryRoot2()} 2>/dev/null || true; }`
+    ] : [];
     return [
+      ...stage,
       `sudo tee ${systemdUnitPath2()} <<'EOF'
-${systemdUnitContents2(binaryPath, workerCmd, cliCmd)}EOF`,
+${systemdUnitContents2(target ?? binaryPath, workerCmd, cliCmd)}EOF`,
       "sudo systemctl daemon-reload",
       `sudo systemctl enable ${systemdUnitName2()}`,
       `sudo systemctl restart ${systemdUnitName2()}`
@@ -47251,9 +47393,11 @@ async function installDaemonService2() {
     };
   }
   removeLegacyUserService2();
+  let execPath = binaryPath;
   try {
     if (process.platform === "linux") {
-      writePrivilegedFile2(systemdUnitPath2(), systemdUnitContents2(binaryPath, workerCmd, cliCmd));
+      execPath = stageSystemBinary2(binaryPath);
+      writePrivilegedFile2(systemdUnitPath2(), systemdUnitContents2(execPath, workerCmd, cliCmd));
       runPrivileged2("systemctl", ["daemon-reload"]);
       runPrivileged2("systemctl", ["enable", systemdUnitName2()]);
       restartSystemdUnit2();
@@ -47277,6 +47421,8 @@ async function installDaemonService2() {
     hookLogWarn(`daemon service install failed: ${reason}`);
     return { installed: false, reason };
   }
+  if (execPath !== binaryPath)
+    pruneSystemBinaries2(execPath);
   return { installed: true };
 }
 async function probeDaemon2() {
@@ -47685,10 +47831,12 @@ function manualServiceRemoval(servicePath) {
     return [`sudo launchctl unload -w ${servicePath}`, `sudo rm -f ${servicePath}`];
   }
   const unit = servicePath.split("/").pop() ?? servicePath;
+  const binDir = daemonSystemBinaryDir();
   return [
     `sudo systemctl disable --now ${unit}`,
     `sudo rm -f ${servicePath}`,
-    `sudo systemctl daemon-reload`
+    `sudo systemctl daemon-reload`,
+    ...binDir ? [`sudo rm -rf ${binDir}`] : []
   ];
 }
 var init_uninstall_cli = __esm(() => {
@@ -47706,8 +47854,8 @@ var init_uninstall_cli = __esm(() => {
 import { execFileSync as execFileSync4 } from "node:child_process";
 import { homedir as homedir39, tmpdir as tmpdir4 } from "node:os";
 import { createHash as createHash14 } from "node:crypto";
-import { copyFileSync as copyFileSync5, existsSync as existsSync58, mkdirSync as mkdirSync34, mkdtempSync as mkdtempSync3, readFileSync as readFileSync46, readdirSync as readdirSync24, realpathSync as realpathSync5, rmSync as rmSync24, statSync as statSync41, writeFileSync as writeFileSync29 } from "node:fs";
-import { basename as basename11, dirname as dirname30, isAbsolute as isAbsolute6, join as join44, relative as relative5, resolve as resolve40, sep as sep6 } from "node:path";
+import { copyFileSync as copyFileSync5, existsSync as existsSync58, mkdirSync as mkdirSync34, mkdtempSync as mkdtempSync3, readFileSync as readFileSync46, readdirSync as readdirSync26, realpathSync as realpathSync5, rmSync as rmSync24, statSync as statSync43, writeFileSync as writeFileSync29 } from "node:fs";
+import { basename as basename11, dirname as dirname32, isAbsolute as isAbsolute6, join as join44, relative as relative5, resolve as resolve40, sep as sep6 } from "node:path";
 function parseList(rest, ...flags) {
   let found = false;
   const out = [];
@@ -48297,7 +48445,7 @@ function inferTaggedVersion(entryPath, sources) {
 function findEntry(dir) {
   let names;
   try {
-    names = readdirSync24(dir);
+    names = readdirSync26(dir);
   } catch {
     return [];
   }
@@ -48307,7 +48455,7 @@ function findEntry(dir) {
       continue;
     const full = resolve40(dir, name);
     try {
-      if (statSync41(full).size > 512 * 1024)
+      if (statSync43(full).size > 512 * 1024)
         continue;
       const text = readFileSync46(full, "utf8");
       if (/from\s+["']failproofai["']/.test(text) && /(?:customPolicies|semanticPolicies)\s*\.\s*add\s*\(/.test(text)) {
@@ -48326,7 +48474,7 @@ function withLocalImports(sources) {
     const file = queue.shift();
     let text;
     try {
-      if (statSync41(file).size > 512 * 1024)
+      if (statSync43(file).size > 512 * 1024)
         continue;
       text = readFileSync46(file, "utf8");
     } catch {
@@ -48334,13 +48482,13 @@ function withLocalImports(sources) {
     }
     for (const re of LOCAL_IMPORT_RES) {
       for (const match of text.matchAll(re)) {
-        const base = resolve40(dirname30(file), match[1]);
+        const base = resolve40(dirname32(file), match[1]);
         for (const ext of LOCAL_IMPORT_EXTENSIONS) {
           const candidate = base + ext;
           if (seen.has(candidate))
             break;
           try {
-            if (!statSync41(candidate).isFile())
+            if (!statSync43(candidate).isFile())
               continue;
           } catch {
             continue;
@@ -48587,7 +48735,7 @@ esac
     return true;
   } finally {
     try {
-      rmSync24(dirname30(askpass), { recursive: true, force: true });
+      rmSync24(dirname32(askpass), { recursive: true, force: true });
     } catch {}
   }
 }
@@ -51099,14 +51247,14 @@ var init_parse_script_args = () => {};
 
 // scripts/install-diagnosis.mjs
 import { existsSync as existsSync60, readFileSync as readFileSync48, realpathSync as realpathSync6 } from "node:fs";
-import { dirname as dirname31, resolve as resolve43 } from "node:path";
+import { dirname as dirname33, resolve as resolve43 } from "node:path";
 import { homedir as homedir40, platform as platform5 } from "node:os";
 import { spawnSync } from "node:child_process";
 function findPackageRoot(start) {
   try {
     let dir = realpathSync6(start);
     if (existsSync60(dir) && !existsSync60(resolve43(dir, "package.json"))) {
-      dir = dirname31(dir);
+      dir = dirname33(dir);
     }
     while (true) {
       const pkgPath = resolve43(dir, "package.json");
@@ -51117,7 +51265,7 @@ function findPackageRoot(start) {
             return dir;
         } catch {}
       }
-      const parent = dirname31(dir);
+      const parent = dirname33(dir);
       if (parent === dir)
         return null;
       dir = parent;
@@ -51648,7 +51796,7 @@ var init_launch_ready = () => {};
 // scripts/launch.ts
 import { spawn as spawn2 } from "child_process";
 import { realpathSync as realpathSync7, existsSync as existsSync61 } from "node:fs";
-import { resolve as resolve44, dirname as dirname32 } from "node:path";
+import { resolve as resolve44, dirname as dirname34 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 function launch(mode, options = {}) {
   const { loggingLevel, disableTelemetry, allowedDevOrigins, host, remainingArgs } = parseScriptArgs(process.argv.slice(2));
@@ -51684,7 +51832,7 @@ ${k.caution(exposedBindWarning(exposed.host))}
     process.env.PORT = port;
     process.env.HOSTNAME = bindHost;
     cmd = "node";
-    const packageRoot = process.env.FAILPROOFAI_PACKAGE_ROOT ?? resolve44(dirname32(realpathSync7(fileURLToPath2(import.meta.url))), "..");
+    const packageRoot = process.env.FAILPROOFAI_PACKAGE_ROOT ?? resolve44(dirname34(realpathSync7(fileURLToPath2(import.meta.url))), "..");
     const serverJsPath = resolve44(packageRoot, ".next/standalone/server.js");
     if (!existsSync61(serverJsPath)) {
       let shadowMessage = null;
@@ -52913,7 +53061,7 @@ var init_session_pause_cli2 = __esm(() => {
 // scripts/launch.ts
 import { spawn as spawn3 } from "child_process";
 import { realpathSync as realpathSync8, existsSync as existsSync62 } from "node:fs";
-import { resolve as resolve46, dirname as dirname33 } from "node:path";
+import { resolve as resolve46, dirname as dirname35 } from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 function launch2(mode, options = {}) {
   const { loggingLevel, disableTelemetry, allowedDevOrigins, host, remainingArgs } = parseScriptArgs(process.argv.slice(2));
@@ -52949,7 +53097,7 @@ ${k.caution(exposedBindWarning(exposed.host))}
     process.env.PORT = port;
     process.env.HOSTNAME = bindHost;
     cmd = "node";
-    const packageRoot = process.env.FAILPROOFAI_PACKAGE_ROOT ?? resolve46(dirname33(realpathSync8(fileURLToPath3(import.meta.url))), "..");
+    const packageRoot = process.env.FAILPROOFAI_PACKAGE_ROOT ?? resolve46(dirname35(realpathSync8(fileURLToPath3(import.meta.url))), "..");
     const serverJsPath = resolve46(packageRoot, ".next/standalone/server.js");
     if (!existsSync62(serverJsPath)) {
       let shadowMessage = null;
@@ -53071,17 +53219,17 @@ var init_cli_error2 = __esm(() => {
 
 // bin/failproofai.mjs
 import { realpathSync as realpathSync9 } from "fs";
-import { dirname as dirname34, resolve as resolve47 } from "path";
+import { dirname as dirname36, resolve as resolve47 } from "path";
 import { fileURLToPath as fileURLToPath4 } from "url";
 // package.json
-var version = "1.0.12";
+var version = "1.0.13-beta.2";
 
 // bin/failproofai.mjs
 if (!process.env.FAILPROOFAI_PACKAGE_ROOT) {
-  process.env.FAILPROOFAI_PACKAGE_ROOT = resolve47(dirname34(realpathSync9(fileURLToPath4(import.meta.url))), "..");
+  process.env.FAILPROOFAI_PACKAGE_ROOT = resolve47(dirname36(realpathSync9(fileURLToPath4(import.meta.url))), "..");
 }
 if (!process.env.FAILPROOFAI_DIST_PATH) {
-  process.env.FAILPROOFAI_DIST_PATH = resolve47(dirname34(realpathSync9(fileURLToPath4(import.meta.url))), "..", "dist");
+  process.env.FAILPROOFAI_DIST_PATH = resolve47(dirname36(realpathSync9(fileURLToPath4(import.meta.url))), "..", "dist");
 }
 var args = process.argv.slice(2);
 if (args[0] === "p" || args[0] === "policy")