failproofai 1.0.2-beta.4 → 1.0.2-beta.5

package/dist/cli.mjs

@@ -19,7 +19,7 @@ var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
 var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
 // package.json
-var version2 = "1.0.2-beta.4", package_default;
+var version2 = "1.0.2-beta.5", package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "failproofai",
@@ -143,16 +143,16 @@ var init_package = __esm(() => {
       sharp: "0.35.0"
     },
     optionalDependencies: {
-      "@failproofai/failproofaid-linux-x64": "1.0.2-beta.4",
-      "@failproofai/failproofaid-linux-arm64": "1.0.2-beta.4",
-      "@failproofai/failproofaid-darwin-x64": "1.0.2-beta.4",
-      "@failproofai/failproofaid-darwin-arm64": "1.0.2-beta.4"
+      "@failproofai/failproofaid-linux-x64": "1.0.2-beta.5",
+      "@failproofai/failproofaid-linux-arm64": "1.0.2-beta.5",
+      "@failproofai/failproofaid-darwin-x64": "1.0.2-beta.5",
+      "@failproofai/failproofaid-darwin-arm64": "1.0.2-beta.5"
     },
     failproofaidBinaries: {
-      "linux-x64": "08bc00a7f8d7c80bf898471ce59c57f4e96c1420080009cc933b2ddeb4f23750",
-      "linux-arm64": "1167d809628cff04c38efbc0eaa83ca26ab8de2878bed0ef59ca43054173eea7",
-      "darwin-x64": "6ed32db21af6869c4475e753e524ad8e128436674209ad778421b240a4bd5c53",
-      "darwin-arm64": "3843de034c9d6b11f77c1f423e6201ad6a77b7eff3b3d4460ba324c5aeb62021"
+      "linux-x64": "e19a1cf9a254df830f205fac024b8a229c162c93ae73851b985d2794e09da035",
+      "linux-arm64": "fafcff01e4cce00809b5cd9ff2822705d7373acbab79444e0384cb058b6da921",
+      "darwin-x64": "d7bd609387e13f5e75287674d948c69d739bac8d6963aa731b93111d1bdd2ea2",
+      "darwin-arm64": "9a57c8eb0f23ed25328e0f7b06638a6ab7f51e1deebf479bac2c779bf9912941"
     }
   };
 });
@@ -6055,6 +6055,95 @@ var init_cursor_projects = __esm(() => {
   getCachedCursorSessionsByEncodedName = runtimeCache((name) => getCursorSessionsByEncodedName(name), 30, { maxSize: 50 });
 });
 
+// lib/sqlite-reader.ts
+import { existsSync as existsSync8, readFileSync as readFileSync4 } from "node:fs";
+import initSqlJs from "sql.js/dist/sql-asm.js";
+async function tryNodeSqlite(dbPath) {
+  try {
+    const mod = await import("node:sqlite");
+    const db = new mod.DatabaseSync(dbPath, { readOnly: true });
+    return {
+      query(sql, params = []) {
+        const stmt = db.prepare(sql);
+        return params.length ? stmt.all(...params) : stmt.all();
+      },
+      close() {
+        db.close();
+      }
+    };
+  } catch {
+    return null;
+  }
+}
+function loadSqlJs() {
+  if (!sqlPromise)
+    sqlPromise = initSqlJs();
+  return sqlPromise;
+}
+async function trySqlJs(dbPath) {
+  try {
+    const SQL = await loadSqlJs();
+    const db = new SQL.Database(readFileSync4(dbPath));
+    return {
+      query(sql, params) {
+        const stmt = db.prepare(sql);
+        try {
+          if (params && params.length)
+            stmt.bind(params);
+          const rows = [];
+          while (stmt.step())
+            rows.push(stmt.getAsObject());
+          return rows;
+        } finally {
+          stmt.free();
+        }
+      },
+      close() {
+        db.close();
+      }
+    };
+  } catch {
+    return null;
+  }
+}
+async function openSqliteReadonly(dbPath) {
+  if (!existsSync8(dbPath))
+    return null;
+  return await tryNodeSqlite(dbPath) ?? await trySqlJs(dbPath);
+}
+var sqlPromise = null;
+var init_sqlite_reader = () => {};
+
+// lib/opencode-db.ts
+import { homedir as homedir8 } from "node:os";
+import { join as join10 } from "node:path";
+function opencodeDbPath() {
+  if (process.env.OPENCODE_DB_PATH)
+    return process.env.OPENCODE_DB_PATH;
+  const home = process.env.OPENCODE_HOME ?? join10(homedir8(), ".local", "share", "opencode");
+  return join10(home, "opencode.db");
+}
+async function withOpenCodeDb(fn) {
+  const db = await openSqliteReadonly(opencodeDbPath());
+  if (!db)
+    return null;
+  try {
+    return fn(db);
+  } catch {
+    return null;
+  } finally {
+    try {
+      db.close();
+    } catch {}
+  }
+}
+async function queryOpenCodeDb(sql, params = []) {
+  return withOpenCodeDb((db) => db.query(sql, params));
+}
+var init_opencode_db = __esm(() => {
+  init_sqlite_reader();
+});
+
 // lib/opencode-projects.ts
 var exports_opencode_projects = {};
 __export(exports_opencode_projects, {
@@ -6065,33 +6154,18 @@ __export(exports_opencode_projects, {
   getOpenCodeSessionsByEncodedName: () => getOpenCodeSessionsByEncodedName,
   getOpenCodeSessionsForCwd: () => getOpenCodeSessionsForCwd
 });
-import { execFileSync as execFileSync2 } from "node:child_process";
-function runOpenCodeDb(sql) {
-  try {
-    const stdout = execFileSync2("opencode", ["db", "--format", "json", sql], {
-      encoding: "utf8",
-      timeout: 5000,
-      stdio: ["ignore", "pipe", "pipe"]
-    });
-    if (!stdout.trim())
-      return [];
-    const parsed = JSON.parse(stdout);
-    if (!Array.isArray(parsed))
-      return null;
-    return parsed;
-  } catch {
-    return null;
-  }
-}
-function readSessionRows() {
-  return runOpenCodeDb(`SELECT id, project_id, slug, directory, title, time_created, time_updated FROM session ORDER BY time_updated DESC LIMIT ${SESSION_LIMIT}`);
+async function readSessionRows() {
+  return queryOpenCodeDb("SELECT id, project_id, slug, directory, title, time_created, time_updated FROM session ORDER BY time_updated DESC LIMIT ?", [SESSION_LIMIT]);
 }
-function readProjectRows() {
-  return runOpenCodeDb(`SELECT id, worktree, vcs, name, time_created, time_updated FROM project`);
+async function readBothRows() {
+  const rows = await withOpenCodeDb((db) => ({
+    sessions: db.query("SELECT id, project_id, slug, directory, title, time_created, time_updated FROM session ORDER BY time_updated DESC LIMIT ?", [SESSION_LIMIT]),
+    projects: db.query("SELECT id, worktree, vcs, name, time_created, time_updated FROM project")
+  }));
+  return { sessions: rows?.sessions ?? null, projects: rows?.projects ?? null };
 }
 async function getOpenCodeProjects() {
-  const sessions = readSessionRows();
-  const projects = readProjectRows();
+  const { sessions, projects } = await readBothRows();
   if (sessions === null && projects === null) {
     return [];
   }
@@ -6148,7 +6222,7 @@ async function getOpenCodeProjects() {
   return out;
 }
 async function getOpenCodeSessionsForCwd(cwd) {
-  const sessions = readSessionRows();
+  const sessions = await readSessionRows();
   if (!sessions)
     return [];
   const matches = sessions.filter((s) => s.directory === cwd);
@@ -6168,8 +6242,7 @@ async function getOpenCodeSessionsByEncodedName(name) {
   let projects;
   let sessions;
   try {
-    projects = readProjectRows();
-    sessions = readSessionRows();
+    ({ projects, sessions } = await readBothRows());
   } catch (error) {
     logWarn("Failed to read OpenCode DB:", error);
     return { cwd: null, sessions: [] };
@@ -6197,6 +6270,7 @@ async function getOpenCodeSessionsByEncodedName(name) {
 }
 var SESSION_LIMIT = 1000, getCachedOpenCodeProjects, getCachedOpenCodeSessionsForCwd, getCachedOpenCodeSessionsByEncodedName;
 var init_opencode_projects = __esm(() => {
+  init_opencode_db();
   init_paths();
   init_logger();
   getCachedOpenCodeProjects = runtimeCache(getOpenCodeProjects, 30);
@@ -6215,10 +6289,10 @@ __export(exports_pi_projects, {
   getPiSessionsForCwd: () => getPiSessionsForCwd
 });
 import { readdir as readdir4, readFile as readFile6, stat as stat3 } from "node:fs/promises";
-import { homedir as homedir8 } from "node:os";
-import { join as join10 } from "node:path";
+import { homedir as homedir9 } from "node:os";
+import { join as join11 } from "node:path";
 function getPiSessionsRoot() {
-  return process.env.PI_SESSIONS_DIR || join10(homedir8(), ".pi", "agent", "sessions");
+  return process.env.PI_SESSIONS_DIR || join11(homedir9(), ".pi", "agent", "sessions");
 }
 async function safeReaddir4(dir) {
   try {
@@ -6266,7 +6340,7 @@ async function scanPiSessions() {
   for (const cwdDir of cwdDirs) {
     if (!cwdDir.isDirectory())
       continue;
-    const cwdPath = join10(root, cwdDir.name);
+    const cwdPath = join11(root, cwdDir.name);
     const sessionFiles = await safeReaddir4(cwdPath);
     if (!sessionFiles)
       continue;
@@ -6276,7 +6350,7 @@ async function scanPiSessions() {
       const m = SESSION_FILE_RE.exec(f.name);
       if (!m)
         continue;
-      candidates.push({ sessionId: m[1], filePath: join10(cwdPath, f.name) });
+      candidates.push({ sessionId: m[1], filePath: join11(cwdPath, f.name) });
     }
   }
   if (candidates.length === 0)
@@ -6377,69 +6451,10 @@ var init_pi_projects = __esm(() => {
   getCachedPiSessionsByEncodedName = runtimeCache((name) => getPiSessionsByEncodedName(name), 30, { maxSize: 50 });
 });
 
-// lib/sqlite-reader.ts
-import { existsSync as existsSync8, readFileSync as readFileSync4 } from "node:fs";
-import initSqlJs from "sql.js/dist/sql-asm.js";
-async function tryNodeSqlite(dbPath) {
-  try {
-    const mod = await import("node:sqlite");
-    const db = new mod.DatabaseSync(dbPath, { readOnly: true });
-    return {
-      query(sql, params = []) {
-        const stmt = db.prepare(sql);
-        return params.length ? stmt.all(...params) : stmt.all();
-      },
-      close() {
-        db.close();
-      }
-    };
-  } catch {
-    return null;
-  }
-}
-function loadSqlJs() {
-  if (!sqlPromise)
-    sqlPromise = initSqlJs();
-  return sqlPromise;
-}
-async function trySqlJs(dbPath) {
-  try {
-    const SQL = await loadSqlJs();
-    const db = new SQL.Database(readFileSync4(dbPath));
-    return {
-      query(sql, params) {
-        const stmt = db.prepare(sql);
-        try {
-          if (params && params.length)
-            stmt.bind(params);
-          const rows = [];
-          while (stmt.step())
-            rows.push(stmt.getAsObject());
-          return rows;
-        } finally {
-          stmt.free();
-        }
-      },
-      close() {
-        db.close();
-      }
-    };
-  } catch {
-    return null;
-  }
-}
-async function openSqliteReadonly(dbPath) {
-  if (!existsSync8(dbPath))
-    return null;
-  return await tryNodeSqlite(dbPath) ?? await trySqlJs(dbPath);
-}
-var sqlPromise = null;
-var init_sqlite_reader = () => {};
-
 // lib/hermes-profiles.ts
 import { readdirSync as readdirSync4 } from "node:fs";
-import { homedir as homedir9 } from "node:os";
-import { basename as basename2, dirname as dirname4, join as join11, resolve as resolve6 } from "node:path";
+import { homedir as homedir10 } from "node:os";
+import { basename as basename2, dirname as dirname4, join as join12, resolve as resolve6 } from "node:path";
 function hermesRoot() {
   const env = (process.env.HERMES_HOME || "").trim();
   if (env) {
@@ -6449,7 +6464,7 @@ function hermesRoot() {
       return dirname4(parent);
     return home;
   }
-  return join11(homedir9(), ".hermes");
+  return join12(homedir10(), ".hermes");
 }
 function listHermesProfiles() {
   const root = hermesRoot();
@@ -6457,7 +6472,7 @@ function listHermesProfiles() {
   const seen = new Set([HERMES_DEFAULT_PROFILE]);
   let names;
   try {
-    names = readdirSync4(join11(root, PROFILES_DIR), { withFileTypes: true }).filter((e) => (e.isDirectory() || e.isSymbolicLink()) && !e.name.startsWith(".")).map((e) => e.name).sort();
+    names = readdirSync4(join12(root, PROFILES_DIR), { withFileTypes: true }).filter((e) => (e.isDirectory() || e.isSymbolicLink()) && !e.name.startsWith(".")).map((e) => e.name).sort();
   } catch {
     return out;
   }
@@ -6465,7 +6480,7 @@ function listHermesProfiles() {
     if (seen.has(name))
       continue;
     seen.add(name);
-    out.push({ name, home: join11(root, PROFILES_DIR, name) });
+    out.push({ name, home: join12(root, PROFILES_DIR, name) });
   }
   return out;
 }
@@ -6516,14 +6531,14 @@ function formatDuration(ms) {
 }
 
 // lib/hermes-sessions.ts
-import { join as join12 } from "node:path";
+import { join as join13 } from "node:path";
 function hermesDbPaths() {
   const override = process.env.HERMES_DB_PATH;
   if (override)
     return [{ profile: HERMES_DEFAULT_PROFILE, dbPath: override }];
   return listHermesProfiles().map((p) => ({
     profile: p.name,
-    dbPath: join12(p.home, "state.db")
+    dbPath: join13(p.home, "state.db")
   }));
 }
 function epochToMs(value) {
@@ -6821,10 +6836,10 @@ var init_hermes_projects = __esm(() => {
 // lib/openclaw-sessions.ts
 import { readFile as readFile7 } from "node:fs/promises";
 import { readdirSync as readdirSync5, statSync as statSync7 } from "node:fs";
-import { homedir as homedir10 } from "node:os";
-import { join as join13 } from "node:path";
+import { homedir as homedir11 } from "node:os";
+import { join as join14 } from "node:path";
 function openclawHome() {
-  return process.env.OPENCLAW_HOME || join13(homedir10(), ".openclaw");
+  return process.env.OPENCLAW_HOME || join14(homedir11(), ".openclaw");
 }
 function isPlainObject3(v) {
   return !!v && typeof v === "object" && !Array.isArray(v);
@@ -6939,13 +6954,13 @@ function openclawLinesToLogEntries(lines, source = "session") {
 }
 function listOpenClawAgents() {
   try {
-    return readdirSync5(join13(openclawHome(), "agents"), { withFileTypes: true }).filter((d) => d.isDirectory() && !d.name.startsWith(".")).map((d) => d.name).sort();
+    return readdirSync5(join14(openclawHome(), "agents"), { withFileTypes: true }).filter((d) => d.isDirectory() && !d.name.startsWith(".")).map((d) => d.name).sort();
   } catch {
     return [];
   }
 }
 function listOpenClawTranscripts() {
-  const agentsDir = join13(openclawHome(), "agents");
+  const agentsDir = join14(openclawHome(), "agents");
   const out = [];
   let agentIds;
   try {
@@ -6954,7 +6969,7 @@ function listOpenClawTranscripts() {
     return out;
   }
   for (const agentId of agentIds) {
-    const sessionsDir = join13(agentsDir, agentId, "sessions");
+    const sessionsDir = join14(agentsDir, agentId, "sessions");
     let files;
     try {
       files = readdirSync5(sessionsDir);
@@ -6967,7 +6982,7 @@ function listOpenClawTranscripts() {
       const sessionId = file.slice(0, -".jsonl".length);
       if (!OPENCLAW_SESSION_ID_RE.test(sessionId))
         continue;
-      const transcriptPath = join13(sessionsDir, file);
+      const transcriptPath = join14(sessionsDir, file);
       try {
         const st = statSync7(transcriptPath);
         out.push({ agentId, sessionId, transcriptPath, mtimeMs: st.mtimeMs, sizeBytes: st.size });
@@ -7028,13 +7043,13 @@ __export(exports_openclaw_projects, {
   parseOpenClawProjectName: () => parseOpenClawProjectName
 });
 import { readFileSync as readFileSync5 } from "node:fs";
-import { join as join14 } from "node:path";
+import { join as join15 } from "node:path";
 function str(v) {
   return typeof v === "string" && v.length > 0 ? v : undefined;
 }
 function readSessionsIndex(agentId) {
   const out = new Map;
-  const indexPath = join14(openclawHome(), "agents", agentId, "sessions", "sessions.json");
+  const indexPath = join15(openclawHome(), "agents", agentId, "sessions", "sessions.json");
   let raw;
   try {
     raw = JSON.parse(readFileSync5(indexPath, "utf-8"));
@@ -7190,13 +7205,13 @@ var init_openclaw_projects = __esm(() => {
 // lib/factory-sessions.ts
 import { readFile as readFile8 } from "node:fs/promises";
 import { readdirSync as readdirSync6, statSync as statSync8 } from "node:fs";
-import { homedir as homedir11 } from "node:os";
-import { join as join15 } from "node:path";
+import { homedir as homedir12 } from "node:os";
+import { join as join16 } from "node:path";
 function factoryHome() {
-  return process.env.FACTORY_HOME || join15(homedir11(), ".factory");
+  return process.env.FACTORY_HOME || join16(homedir12(), ".factory");
 }
 function factorySessionsRoot() {
-  return join15(factoryHome(), "sessions");
+  return join16(factoryHome(), "sessions");
 }
 function isPlainObject4(v) {
   return !!v && typeof v === "object" && !Array.isArray(v);
@@ -7342,7 +7357,7 @@ function listFactoryTranscripts() {
   for (const dir of projectDirs) {
     const projectName = dir.name;
     const cwd = decodeFolderName(projectName);
-    const projectPath = join15(root, projectName);
+    const projectPath = join16(root, projectName);
     let files;
     try {
       files = readdirSync6(projectPath);
@@ -7355,7 +7370,7 @@ function listFactoryTranscripts() {
       const sessionId = file.slice(0, -".jsonl".length);
       if (!FACTORY_SESSION_ID_RE.test(sessionId))
         continue;
-      const transcriptPath = join15(projectPath, file);
+      const transcriptPath = join16(projectPath, file);
       try {
         const st = statSync8(transcriptPath);
         out.push({ projectName, cwd, sessionId, transcriptPath, mtimeMs: st.mtimeMs, sizeBytes: st.size });
@@ -7481,13 +7496,13 @@ var init_factory_projects = __esm(() => {
 });
 
 // lib/devin-sessions.ts
-import { homedir as homedir12 } from "node:os";
-import { join as join16 } from "node:path";
+import { homedir as homedir13 } from "node:os";
+import { join as join17 } from "node:path";
 function devinHome() {
-  return process.env.DEVIN_HOME || join16(homedir12(), ".local", "share", "devin");
+  return process.env.DEVIN_HOME || join17(homedir13(), ".local", "share", "devin");
 }
 function devinDbPath() {
-  return process.env.DEVIN_DB_PATH || join16(devinHome(), "cli", "sessions.db");
+  return process.env.DEVIN_DB_PATH || join17(devinHome(), "cli", "sessions.db");
 }
 function devinEpochToMs(value) {
   if (typeof value === "number" && Number.isFinite(value)) {
@@ -7785,16 +7800,16 @@ var init_devin_projects = __esm(() => {
 // lib/antigravity-sessions.ts
 import { readFile as readFile9 } from "node:fs/promises";
 import { readdirSync as readdirSync7, statSync as statSync9 } from "node:fs";
-import { homedir as homedir13 } from "node:os";
-import { join as join17 } from "node:path";
+import { homedir as homedir14 } from "node:os";
+import { join as join18 } from "node:path";
 function antigravityHome() {
-  return process.env.ANTIGRAVITY_HOME || join17(homedir13(), ".gemini", "antigravity-cli");
+  return process.env.ANTIGRAVITY_HOME || join18(homedir14(), ".gemini", "antigravity-cli");
 }
 function antigravityBrainRoot() {
-  return join17(antigravityHome(), "brain");
+  return join18(antigravityHome(), "brain");
 }
 function antigravityTranscriptRelPath() {
-  return join17(".system_generated", "logs", "transcript_full.jsonl");
+  return join18(".system_generated", "logs", "transcript_full.jsonl");
 }
 function isPlainObject6(v) {
   return !!v && typeof v === "object" && !Array.isArray(v);
@@ -7917,7 +7932,7 @@ function listAntigravityTranscripts() {
     const conversationId = dir.name;
     if (!ANTIGRAVITY_CONVERSATION_ID_RE.test(conversationId))
       continue;
-    const transcriptPath = join17(root, conversationId, rel);
+    const transcriptPath = join18(root, conversationId, rel);
     try {
       const st = statSync9(transcriptPath);
       if (!st.isFile())
@@ -7930,7 +7945,7 @@ function listAntigravityTranscripts() {
 function findAntigravityTranscript(conversationId) {
   if (!ANTIGRAVITY_CONVERSATION_ID_RE.test(conversationId))
     return null;
-  const transcriptPath = join17(antigravityBrainRoot(), conversationId, antigravityTranscriptRelPath());
+  const transcriptPath = join18(antigravityBrainRoot(), conversationId, antigravityTranscriptRelPath());
   try {
     if (statSync9(transcriptPath).isFile())
       return transcriptPath;
@@ -7970,9 +7985,9 @@ __export(exports_antigravity_projects, {
   getCachedAntigravityProjects: () => getCachedAntigravityProjects,
   getCachedAntigravitySessionsByEncodedName: () => getCachedAntigravitySessionsByEncodedName
 });
-import { join as join18 } from "node:path";
+import { join as join19 } from "node:path";
 function antigravitySummariesDbPath() {
-  return join18(antigravityHome(), "conversation_summaries.db");
+  return join19(antigravityHome(), "conversation_summaries.db");
 }
 function parseWorkspaceCwd(raw) {
   if (!raw)
@@ -8115,16 +8130,16 @@ var init_antigravity_projects = __esm(() => {
 });
 
 // lib/goose-sessions.ts
-import { homedir as homedir14 } from "node:os";
-import { join as join19 } from "node:path";
+import { homedir as homedir15 } from "node:os";
+import { join as join20 } from "node:path";
 function gooseHome() {
   if (process.env.GOOSE_HOME)
     return process.env.GOOSE_HOME;
   const xdg = process.env.XDG_DATA_HOME;
-  return join19(xdg && xdg.length > 0 ? xdg : join19(homedir14(), ".local", "share"), "goose");
+  return join20(xdg && xdg.length > 0 ? xdg : join20(homedir15(), ".local", "share"), "goose");
 }
 function gooseDbPath() {
-  return process.env.GOOSE_DB_PATH || join19(gooseHome(), "sessions", "sessions.db");
+  return process.env.GOOSE_DB_PATH || join20(gooseHome(), "sessions", "sessions.db");
 }
 function gooseTimestampToMs(value) {
   if (typeof value === "number" && Number.isFinite(value)) {
@@ -8392,7 +8407,7 @@ var init_goose_projects = __esm(() => {
 
 // lib/projects.ts
 import { readdir as readdir5, stat as stat4 } from "node:fs/promises";
-import { join as join20, resolve as resolve7, sep } from "node:path";
+import { join as join21, resolve as resolve7, sep } from "node:path";
 async function getMtime(path3, label) {
   try {
     return (await stat4(path3)).mtime;
@@ -8418,7 +8433,7 @@ async function getClaudeProjectFolders() {
     if (!entries)
       return [];
     const settled = await batchAll(entries.filter((entry) => entry.isDirectory()).map((entry) => async () => {
-      const folderPath = join20(projectsPath, entry.name);
+      const folderPath = join21(projectsPath, entry.name);
       const mtime = await getMtime(folderPath, entry.name);
       return {
         name: entry.name,
@@ -8545,7 +8560,7 @@ function resolveProjectPath(projectName) {
   if (/^[/\\]/.test(projectName))
     throw new RangeError("Absolute project name");
   const projectsPath = resolve7(getClaudeProjectsPath());
-  const candidate = resolve7(join20(projectsPath, projectName));
+  const candidate = resolve7(join21(projectsPath, projectName));
   if (!candidate.startsWith(projectsPath + sep)) {
     throw new RangeError("Project path escapes root");
   }
@@ -8563,7 +8578,7 @@ async function getSessionFiles(projectPath) {
       return [];
     const jsonlEntries = entries.filter((entry) => entry.isFile() && entry.name.endsWith(".jsonl") && extractSessionId2(entry.name));
     const settled = await batchAll(jsonlEntries.map((entry) => async () => {
-      const filePath = join20(projectPath, entry.name);
+      const filePath = join21(projectPath, entry.name);
       const mtime = await getMtime(filePath, entry.name);
       return {
         name: entry.name,
@@ -8592,13 +8607,13 @@ var init_projects = __esm(() => {
 
 // lib/resolve-subagent-path.ts
 import { access as access2 } from "fs/promises";
-import { join as join21, relative as relative2 } from "path";
+import { join as join22, relative as relative2 } from "path";
 async function resolveSubagentPath(projectsPath, projectName, sessionId, agentId) {
   const fileName = `agent-${agentId}.jsonl`;
   const candidatePaths = [
-    join21(projectsPath, projectName, fileName),
-    join21(projectsPath, projectName, sessionId, fileName),
-    join21(projectsPath, projectName, sessionId, "subagents", fileName)
+    join22(projectsPath, projectName, fileName),
+    join22(projectsPath, projectName, sessionId, fileName),
+    join22(projectsPath, projectName, sessionId, "subagents", fileName)
   ];
   for (const candidatePath of candidatePaths) {
     if (relative2(projectsPath, candidatePath).startsWith("..")) {
@@ -8620,7 +8635,7 @@ var init_resolve_subagent_path = () => {};
 
 // lib/log-entries.ts
 import { readFile as readFile10 } from "fs/promises";
-import { join as join22 } from "path";
+import { join as join23 } from "path";
 function formatTimestamp(date) {
   const base = formatDate(date);
   const ms = date.getMilliseconds().toString().padStart(3, "0");
@@ -8818,7 +8833,7 @@ async function parseLogContent(fileContent, source = "session") {
 async function parseSessionLog(projectName, sessionId) {
   const projectDir = resolveProjectPath(projectName);
   const projectsPath = getClaudeProjectsPath();
-  const filePath = join22(projectDir, `${sessionId}.jsonl`);
+  const filePath = join23(projectDir, `${sessionId}.jsonl`);
   const fileContent = await readFile10(filePath, "utf-8");
   const { entries: sessionEntries, rawLines: sessionRawLines, subagentIds } = await parseFileContent(fileContent, "session");
   if (subagentIds.length === 0) {
@@ -8857,8 +8872,8 @@ var init_log_entries = __esm(() => {
 // lib/codex-sessions.ts
 import { readFileSync as readFileSync6, readdirSync as readdirSync8, existsSync as existsSync9, writeFileSync as writeFileSync4, mkdirSync as mkdirSync5, statSync as statSync10 } from "node:fs";
 import { readFile as readFile11 } from "node:fs/promises";
-import { dirname as dirname5, join as join23 } from "node:path";
-import { homedir as homedir15 } from "node:os";
+import { dirname as dirname5, join as join24 } from "node:path";
+import { homedir as homedir16 } from "node:os";
 function readCache() {
   try {
     if (!existsSync9(CACHE_PATH))
@@ -8880,7 +8895,7 @@ function dirSearch(dir, sessionId) {
   try {
     for (const f of readdirSync8(dir, { withFileTypes: true })) {
       if (f.isFile() && f.name.includes(sessionId) && f.name.endsWith(".jsonl")) {
-        return join23(dir, f.name);
+        return join24(dir, f.name);
       }
     }
   } catch {}
@@ -8891,14 +8906,14 @@ function findCodexTranscript(sessionId) {
   const cached = cache[sessionId];
   if (cached && existsSync9(cached))
     return cached;
-  const root = join23(homedir15(), ".codex", "sessions");
+  const root = join24(homedir16(), ".codex", "sessions");
   const today = new Date;
   const yesterday = new Date(today.getTime() - 24 * 60 * 60 * 1000);
   const datedDirs = [today, yesterday].map((d) => {
     const y = String(d.getUTCFullYear());
     const m = String(d.getUTCMonth() + 1).padStart(2, "0");
     const day = String(d.getUTCDate()).padStart(2, "0");
-    return join23(root, y, m, day);
+    return join24(root, y, m, day);
   });
   for (const dir of datedDirs) {
     const hit = dirSearch(dir, sessionId);
@@ -8911,13 +8926,13 @@ function findCodexTranscript(sessionId) {
     for (const y of readdirSync8(root, { withFileTypes: true })) {
       if (!y.isDirectory())
         continue;
-      for (const m of readdirSync8(join23(root, y.name), { withFileTypes: true })) {
+      for (const m of readdirSync8(join24(root, y.name), { withFileTypes: true })) {
         if (!m.isDirectory())
           continue;
-        for (const d of readdirSync8(join23(root, y.name, m.name), { withFileTypes: true })) {
+        for (const d of readdirSync8(join24(root, y.name, m.name), { withFileTypes: true })) {
           if (!d.isDirectory())
             continue;
-          const hit = dirSearch(join23(root, y.name, m.name, d.name), sessionId);
+          const hit = dirSearch(join24(root, y.name, m.name, d.name), sessionId);
           if (hit) {
             writeCacheEntry(sessionId, hit);
             return hit;
@@ -9185,13 +9200,13 @@ var init_resolve_permission_mode = __esm(() => {
 // lib/copilot-sessions.ts
 import { readFileSync as readFileSync8, readdirSync as readdirSync9, existsSync as existsSync10, statSync as statSync11 } from "node:fs";
 import { readFile as readFile12 } from "node:fs/promises";
-import { join as join24, resolve as resolve8, sep as sep2 } from "node:path";
-import { homedir as homedir16 } from "node:os";
+import { join as join25, resolve as resolve8, sep as sep2 } from "node:path";
+import { homedir as homedir17 } from "node:os";
 function getCopilotHome() {
-  return process.env.COPILOT_HOME || join24(homedir16(), ".copilot");
+  return process.env.COPILOT_HOME || join25(homedir17(), ".copilot");
 }
 function getCopilotSessionStateRoot2() {
-  return join24(getCopilotHome(), "session-state");
+  return join25(getCopilotHome(), "session-state");
 }
 function getCopilotSessionDir(sessionId) {
   if (!sessionId)
@@ -9206,7 +9221,7 @@ function resolveSessionFile(sessionId, filename) {
   const dir = getCopilotSessionDir(sessionId);
   if (!dir)
     return null;
-  return join24(dir, filename);
+  return join25(dir, filename);
 }
 function findCopilotTranscript(sessionId) {
   const candidate = resolveSessionFile(sessionId, "events.jsonl");
@@ -9402,10 +9417,10 @@ var init_copilot_sessions = __esm(() => {
 // lib/cursor-sessions.ts
 import { readFileSync as readFileSync9, readdirSync as readdirSync10, existsSync as existsSync11, statSync as statSync12 } from "node:fs";
 import { readFile as readFile13 } from "node:fs/promises";
-import { basename as basename3, join as join25, resolve as resolve9, sep as sep3 } from "node:path";
-import { homedir as homedir17 } from "node:os";
+import { basename as basename3, join as join26, resolve as resolve9, sep as sep3 } from "node:path";
+import { homedir as homedir18 } from "node:os";
 function getCursorHome2() {
-  return process.env.CURSOR_HOME || join25(homedir17(), ".cursor");
+  return process.env.CURSOR_HOME || join26(homedir18(), ".cursor");
 }
 function getCursorSessionDir(sessionId) {
   if (!sessionId)
@@ -9440,11 +9455,11 @@ function findCursorTranscript(sessionId) {
   const dir = getCursorSessionDir(sessionId);
   if (!dir)
     return null;
-  const newCandidate = join25(dir, `${basename3(dir)}.jsonl`);
+  const newCandidate = join26(dir, `${basename3(dir)}.jsonl`);
   if (existsSync11(newCandidate))
     return newCandidate;
   for (const name of LEGACY_TRANSCRIPT_FILE_CANDIDATES2) {
-    const candidate = join25(dir, name);
+    const candidate = join26(dir, name);
     if (existsSync11(candidate))
       return candidate;
   }
@@ -9658,10 +9673,10 @@ var init_cursor_sessions = __esm(() => {
 // lib/pi-sessions.ts
 import { readFileSync as readFileSync10, readdirSync as readdirSync11, existsSync as existsSync12, statSync as statSync13 } from "node:fs";
 import { readFile as readFile14 } from "node:fs/promises";
-import { join as join26, resolve as resolve10, sep as sep4 } from "node:path";
-import { homedir as homedir18 } from "node:os";
+import { join as join27, resolve as resolve10, sep as sep4 } from "node:path";
+import { homedir as homedir19 } from "node:os";
 function getPiSessionStateRoot() {
-  return process.env.PI_SESSIONS_DIR || join26(homedir18(), ".pi", "agent", "sessions");
+  return process.env.PI_SESSIONS_DIR || join27(homedir19(), ".pi", "agent", "sessions");
 }
 function isSafeSessionId(sessionId) {
   return UUID_RE.test(sessionId);
@@ -10383,7 +10398,7 @@ var init_atomic_write = () => {};
 // src/hooks/session-pause.ts
 import { existsSync as existsSync16, mkdirSync as mkdirSync7, readdirSync as readdirSync12, readFileSync as readFileSync13, rmSync as rmSync3 } from "node:fs";
 import { createHash as createHash5 } from "node:crypto";
-import { join as join27, resolve as resolve13 } from "node:path";
+import { join as join28, resolve as resolve13 } from "node:path";
 function pauseStateDir() {
   const override = process.env.FAILPROOFAI_STATE_DIR;
   if (override)
@@ -10392,7 +10407,7 @@ function pauseStateDir() {
 }
 function pauseFilePath(sessionId) {
   const digest = createHash5("sha256").update(sessionId).digest("hex").slice(0, 32);
-  return join27(pauseStateDir(), `${digest}.json`);
+  return join28(pauseStateDir(), `${digest}.json`);
 }
 function parsePauseDuration(input, ceilingMs = PAUSE_CEILING_MS) {
   if (input === undefined || input === "")
@@ -10503,7 +10518,7 @@ function listActivePauses(now = Date.now()) {
     if (!name.endsWith(".json"))
       continue;
     try {
-      const stored = parseStored(JSON.parse(readFileSync13(join27(dir, name), "utf8")));
+      const stored = parseStored(JSON.parse(readFileSync13(join28(dir, name), "utf8")));
       if (!stored || stored.expiresAt <= now)
         continue;
       const { schemaVersion: _ignored, ...pause } = stored;
@@ -10859,9 +10874,9 @@ import {
   unlinkSync as unlinkSync2,
   rmSync as rmSync5
 } from "node:fs";
-import { homedir as homedir19, tmpdir as tmpdir2, userInfo } from "node:os";
+import { homedir as homedir20, tmpdir as tmpdir2, userInfo } from "node:os";
 import { resolve as resolve15 } from "node:path";
-import { execFileSync as execFileSync3 } from "node:child_process";
+import { execFileSync as execFileSync2 } from "node:child_process";
 function setDaemonConfigured(value, installedVersion) {
   try {
     updateConfig({ daemon: { configured: value } });
@@ -10973,7 +10988,7 @@ function systemdUnitPath(user = serviceUser()) {
   return resolve15(systemdUnitDir(), systemdUnitName(user));
 }
 function legacySystemdUserUnitPath() {
-  return resolve15(homedir19(), ".config", "systemd", "user", "failproofaid.service");
+  return resolve15(homedir20(), ".config", "systemd", "user", "failproofaid.service");
 }
 function launchdLabel(user = serviceUser()) {
   return `ai.failproof.failproofaid.${user}`;
@@ -10982,7 +10997,7 @@ function launchdPlistPath(user = serviceUser()) {
   return `/Library/LaunchDaemons/${launchdLabel(user)}.plist`;
 }
 function legacyLaunchAgentPlistPath() {
-  return resolve15(homedir19(), "Library", "LaunchAgents", "ai.failproof.failproofaid.plist");
+  return resolve15(homedir20(), "Library", "LaunchAgents", "ai.failproof.failproofaid.plist");
 }
 function legacySharedLaunchDaemonPath() {
   return "/Library/LaunchDaemons/ai.failproof.failproofaid.plist";
@@ -11008,7 +11023,7 @@ function primeElevation() {
   if (canElevate())
     return true;
   try {
-    execFileSync3("sudo", ["-v"], { stdio: "inherit", timeout: SUDO_PROMPT_TIMEOUT_MS });
+    execFileSync2("sudo", ["-v"], { stdio: "inherit", timeout: SUDO_PROMPT_TIMEOUT_MS });
     return canElevate();
   } catch {
     return false;
@@ -11018,7 +11033,7 @@ function canElevate() {
   if (typeof process.getuid === "function" && process.getuid() === 0)
     return true;
   try {
-    execFileSync3("sudo", ["-n", "true"], { stdio: "ignore", timeout: SERVICE_CMD_TIMEOUT_MS });
+    execFileSync2("sudo", ["-n", "true"], { stdio: "ignore", timeout: SERVICE_CMD_TIMEOUT_MS });
     return true;
   } catch {
     return false;
@@ -11027,7 +11042,7 @@ function canElevate() {
 function runPrivileged(command, args) {
   const root = typeof process.getuid === "function" && process.getuid() === 0;
   const [cmd, argv] = root ? [command, args] : ["sudo", ["-n", command, ...args]];
-  execFileSync3(cmd, argv, { stdio: "ignore", timeout: SERVICE_CMD_TIMEOUT_MS });
+  execFileSync2(cmd, argv, { stdio: "ignore", timeout: SERVICE_CMD_TIMEOUT_MS });
 }
 function writePrivilegedFile(destination, contents, mode = "0644") {
   const stagingDir = mkdtempSync(resolve15(tmpdir2(), "failproofaid-stage-"));
@@ -11046,14 +11061,14 @@ function removeLegacyUserService() {
       if (!existsSync19(legacy2))
         return;
       try {
-        execFileSync3("systemctl", ["--user", "disable", "--now", "failproofaid.service"], {
+        execFileSync2("systemctl", ["--user", "disable", "--now", "failproofaid.service"], {
           stdio: "ignore",
           timeout: SERVICE_CMD_TIMEOUT_MS
         });
       } catch {}
       unlinkSync2(legacy2);
       try {
-        execFileSync3("systemctl", ["--user", "daemon-reload"], {
+        execFileSync2("systemctl", ["--user", "daemon-reload"], {
           stdio: "ignore",
           timeout: SERVICE_CMD_TIMEOUT_MS
         });
@@ -11062,7 +11077,7 @@ function removeLegacyUserService() {
       const legacyAgent = legacyLaunchAgentPlistPath();
       if (existsSync19(legacyAgent)) {
         try {
-          execFileSync3("launchctl", ["unload", "-w", legacyAgent], {
+          execFileSync2("launchctl", ["unload", "-w", legacyAgent], {
             stdio: "ignore",
             timeout: SERVICE_CMD_TIMEOUT_MS
           });
@@ -11086,7 +11101,7 @@ function systemdUnitContents(binaryPath, workerCmd, cliCmd = null) {
 `).join("");
   const user = assertUnitSafe(serviceUser(), "User");
   assertUnitSafe(binaryPath, "ExecStart");
-  assertUnitSafe(homedir19(), "HOME");
+  assertUnitSafe(homedir20(), "HOME");
   const conditionPaths = [binaryPath, workerScriptPath()].filter((p) => typeof p === "string" && existsSync19(p));
   const conditionLines = conditionPaths.map((p) => `ConditionPathExists=${assertUnitSafe(p, "ConditionPathExists")}
 `).join("");
@@ -11100,7 +11115,7 @@ User=${user}
 # Set explicitly rather than relying on systemd deriving it from User=:
 # failproofaid stores per-user state and refuses to start without HOME, so this
 # required variable is not left to a version-dependent default.
-Environment="HOME=${homedir19()}"
+Environment="HOME=${homedir20()}"
 ${envLines}ExecStart=${binaryPath}
 Restart=on-failure
 RestartSec=2
@@ -11452,7 +11467,7 @@ function daemonVersionSkew() {
 }
 function inactiveLinuxStatus() {
   try {
-    return interpretConditionResult(execFileSync3("systemctl", ["show", systemdUnitName(), "--property=ConditionResult", "--value"], { stdio: ["ignore", "pipe", "ignore"], timeout: SERVICE_CMD_TIMEOUT_MS }).toString());
+    return interpretConditionResult(execFileSync2("systemctl", ["show", systemdUnitName(), "--property=ConditionResult", "--value"], { stdio: ["ignore", "pipe", "ignore"], timeout: SERVICE_CMD_TIMEOUT_MS }).toString());
   } catch {
     return "stopped";
   }
@@ -11467,7 +11482,7 @@ function daemonServiceStatus() {
     if (!existsSync19(systemdUnitPath()))
       return "not-installed";
     try {
-      const out = execFileSync3("systemctl", ["is-active", systemdUnitName()], {
+      const out = execFileSync2("systemctl", ["is-active", systemdUnitName()], {
         stdio: ["ignore", "pipe", "ignore"],
         timeout: SERVICE_CMD_TIMEOUT_MS
       }).toString().trim();
@@ -11484,10 +11499,10 @@ function daemonServiceStatus() {
     if (!root && !canElevate())
       return "unknown";
     const args = ["print", `system/${launchdLabel()}`];
-    const out = root ? execFileSync3("launchctl", args, {
+    const out = root ? execFileSync2("launchctl", args, {
       stdio: ["ignore", "pipe", "ignore"],
       timeout: SERVICE_CMD_TIMEOUT_MS
-    }).toString() : execFileSync3("sudo", ["-n", "launchctl", ...args], {
+    }).toString() : execFileSync2("sudo", ["-n", "launchctl", ...args], {
       stdio: ["ignore", "pipe", "ignore"],
       timeout: SERVICE_CMD_TIMEOUT_MS
     }).toString();
@@ -13301,16 +13316,16 @@ __export(exports_flush_cli, {
   runFlushCommand: () => runFlushCommand
 });
 import { existsSync as existsSync21, mkdirSync as mkdirSync11, writeFileSync as writeFileSync9, readdirSync as readdirSync15 } from "node:fs";
-import { dirname as dirname9, join as join28 } from "node:path";
+import { dirname as dirname9, join as join29 } from "node:path";
 function flushRequestPath(home) {
-  return join28(failproofaiHome(home), "state", "flush-request.json");
+  return join29(failproofaiHome(home), "state", "flush-request.json");
 }
 function spoolDirs(home) {
   const root = spoolDir(home);
   if (!existsSync21(root))
     return [];
   try {
-    return readdirSync15(root, { withFileTypes: true }).filter((e) => e.isDirectory() && e.name !== "failed").map((e) => join28(root, e.name));
+    return readdirSync15(root, { withFileTypes: true }).filter((e) => e.isDirectory() && e.name !== "failed").map((e) => join29(root, e.name));
   } catch {
     return [];
   }
@@ -13430,7 +13445,7 @@ import {
   rmSync as rmSync7,
   writeFileSync as writeFileSync10
 } from "node:fs";
-import { basename as basename4, dirname as dirname10, join as join29, resolve as resolve17 } from "node:path";
+import { basename as basename4, dirname as dirname10, join as join30, resolve as resolve17 } from "node:path";
 function migrateToLayout4() {
   const moves = [
     { from: legacy.authJson(), to: auditSessionFile() },
@@ -13439,9 +13454,9 @@ function migrateToLayout4() {
   ];
   const authDirOverride = process.env.FAILPROOFAI_AUTH_DIR;
   if (authDirOverride) {
-    moves.push({ from: join29(authDirOverride, "auth.json"), to: join29(authDirOverride, "session.json") }, {
-      from: join29(authDirOverride, "next-audit.json"),
-      to: join29(authDirOverride, "reminder.json")
+    moves.push({ from: join30(authDirOverride, "auth.json"), to: join30(authDirOverride, "session.json") }, {
+      from: join30(authDirOverride, "next-audit.json"),
+      to: join30(authDirOverride, "reminder.json")
     });
   }
   const migrated = [];
@@ -14275,14 +14290,14 @@ var init_fp_reset2 = __esm(() => {
 import { createHmac, randomUUID as randomUUID2 } from "node:crypto";
 import { execSync as execSync4 } from "node:child_process";
 import { readFileSync as readFileSync19, writeFileSync as writeFileSync12, mkdirSync as mkdirSync14 } from "node:fs";
-import { homedir as homedir20, platform, arch, hostname, cpus } from "node:os";
-import { join as join30 } from "node:path";
+import { homedir as homedir21, platform, arch, hostname, cpus } from "node:os";
+import { join as join31 } from "node:path";
 function hashToId3(raw) {
   return createHmac("sha256", NAMESPACE3).update(raw).digest("hex");
 }
 function getInstanceId3() {
-  const idDir = join30(homedir20(), ".failproofai");
-  const idFile = join30(idDir, "instance-id");
+  const idDir = join31(homedir21(), ".failproofai");
+  const idFile = join31(idDir, "instance-id");
   try {
     const existing = readFileSync19(idFile, "utf-8").trim();
     if (existing)
@@ -14316,7 +14331,7 @@ function getInstanceId3() {
   try {
     const sysProps = [
       hostname(),
-      homedir20(),
+      homedir21(),
       platform(),
       arch(),
       cpus()[0]?.model ?? ""
@@ -14366,7 +14381,7 @@ __export(exports_install_check, {
 });
 import { existsSync as existsSync24, readFileSync as readFileSync20, writeFileSync as writeFileSync13, mkdirSync as mkdirSync15 } from "node:fs";
 import { dirname as dirname12, resolve as resolve19 } from "node:path";
-import { platform as platform2, arch as arch2, release, homedir as homedir21, hostname as hostname2 } from "node:os";
+import { platform as platform2, arch as arch2, release, homedir as homedir22, hostname as hostname2 } from "node:os";
 import { createHmac as createHmac2 } from "node:crypto";
 function hashToId4(raw) {
   return createHmac2("sha256", NAMESPACE4).update(raw).digest("hex");
@@ -14433,7 +14448,7 @@ function checkHooks() {
     return { configured: false, registered: false, policyCount: 0 };
   }
   const policyCount = config.enabledPolicies.length;
-  const settingsPath = resolve19(homedir21(), ".claude", "settings.json");
+  const settingsPath = resolve19(homedir22(), ".claude", "settings.json");
   if (!existsSync24(settingsPath))
     return { configured: true, registered: false, policyCount };
   let settings;
@@ -22364,7 +22379,7 @@ import { execSync as execSync5 } from "node:child_process";
 import { readFileSync as readFileSync21, writeFileSync as writeFileSync14, existsSync as existsSync25, mkdirSync as mkdirSync16, unlinkSync as unlinkSync3 } from "node:fs";
 import { resolve as resolve20, dirname as dirname13 } from "node:path";
 import { fileURLToPath } from "node:url";
-import { homedir as homedir22 } from "node:os";
+import { homedir as homedir23 } from "node:os";
 function readJsonFile(path3) {
   if (!existsSync25(path3))
     return {};
@@ -22726,7 +22741,7 @@ var init_integrations = __esm(() => {
       const base = cwd ? resolve20(cwd) : process.cwd();
       switch (scope) {
         case "user":
-          return resolve20(homedir22(), ".claude", "settings.json");
+          return resolve20(homedir23(), ".claude", "settings.json");
         case "project":
           return resolve20(base, ".claude", "settings.json");
         case "local":
@@ -22858,7 +22873,7 @@ var init_integrations = __esm(() => {
       const base = cwd ? resolve20(cwd) : process.cwd();
       switch (scope) {
         case "user":
-          return resolve20(homedir22(), ".codex", "hooks.json");
+          return resolve20(homedir23(), ".codex", "hooks.json");
         case "project":
           return resolve20(base, ".codex", "hooks.json");
         case "local":
@@ -22974,7 +22989,7 @@ var init_integrations = __esm(() => {
       const base = cwd ? resolve20(cwd) : process.cwd();
       switch (scope) {
         case "user":
-          return resolve20(homedir22(), ".copilot", "hooks", "failproofai.json");
+          return resolve20(homedir23(), ".copilot", "hooks", "failproofai.json");
         case "project":
           return resolve20(base, ".github", "hooks", "failproofai.json");
         case "local":
@@ -23088,7 +23103,7 @@ var init_integrations = __esm(() => {
       const base = cwd ? resolve20(cwd) : process.cwd();
       switch (scope) {
         case "user":
-          return resolve20(homedir22(), ".cursor", "hooks.json");
+          return resolve20(homedir23(), ".cursor", "hooks.json");
         case "project":
           return resolve20(base, ".cursor", "hooks.json");
         case "local":
@@ -23187,7 +23202,7 @@ var init_integrations = __esm(() => {
       const base = cwd ? resolve20(cwd) : process.cwd();
       switch (scope) {
         case "user":
-          return resolve20(homedir22(), ".config", "opencode", "opencode.json");
+          return resolve20(homedir23(), ".config", "opencode", "opencode.json");
         case "project":
           return resolve20(base, ".opencode", "opencode.json");
         case "local":
@@ -23202,7 +23217,7 @@ var init_integrations = __esm(() => {
     },
     buildHookEntry(_binaryPath, _eventType, scope) {
       if (scope === "user") {
-        const abs = resolve20(homedir22(), ".config", "opencode", "plugins", "failproofai.mjs");
+        const abs = resolve20(homedir23(), ".config", "opencode", "plugins", "failproofai.mjs");
         return { spec: `file://${abs}`, [FAILPROOFAI_HOOK_MARKER]: true };
       }
       return { spec: OPENCODE_PLUGIN_REL_PATH, [FAILPROOFAI_HOOK_MARKER]: true };
@@ -23217,7 +23232,7 @@ var init_integrations = __esm(() => {
     writeHookEntries(settings, binaryPath, scope) {
       const s = settings;
       const effectiveScope = scope ?? "project";
-      const settingsPath = effectiveScope === "user" ? resolve20(homedir22(), ".config", "opencode", "opencode.json") : resolve20(process.cwd(), ".opencode", "opencode.json");
+      const settingsPath = effectiveScope === "user" ? resolve20(homedir23(), ".config", "opencode", "opencode.json") : resolve20(process.cwd(), ".opencode", "opencode.json");
       const pluginPath = opencodePluginFilePath(settingsPath);
       mkdirSync16(dirname13(pluginPath), { recursive: true });
       writeFileSync14(pluginPath, buildOpenCodePluginShim(binaryPath, effectiveScope), "utf8");
@@ -23288,7 +23303,7 @@ var init_integrations = __esm(() => {
       const base = cwd ? resolve20(cwd) : process.cwd();
       switch (scope) {
         case "user":
-          return resolve20(homedir22(), ".pi", "agent", "settings.json");
+          return resolve20(homedir23(), ".pi", "agent", "settings.json");
         case "project":
           return resolve20(base, ".pi", "settings.json");
         case "local":
@@ -23453,7 +23468,7 @@ var init_integrations = __esm(() => {
     scopes: OPENCLAW_HOOK_SCOPES,
     eventTypes: OPENCLAW_HOOK_EVENT_TYPES,
     getSettingsPath() {
-      return resolve20(homedir22(), ".openclaw", "openclaw.json");
+      return resolve20(homedir23(), ".openclaw", "openclaw.json");
     },
     readSettings(settingsPath) {
       return readJsonFile(settingsPath);
@@ -23552,7 +23567,7 @@ var init_integrations = __esm(() => {
       const base = cwd ? resolve20(cwd) : process.cwd();
       switch (scope) {
         case "user":
-          return resolve20(homedir22(), ".factory", "hooks.json");
+          return resolve20(homedir23(), ".factory", "hooks.json");
         case "project":
           return resolve20(base, ".factory", "hooks.json");
         case "local":
@@ -23654,7 +23669,7 @@ var init_integrations = __esm(() => {
       const base = cwd ? resolve20(cwd) : process.cwd();
       switch (scope) {
         case "user":
-          return resolve20(homedir22(), ".config", "devin", "config.json");
+          return resolve20(homedir23(), ".config", "devin", "config.json");
         case "project":
           return resolve20(base, ".devin", "config.json");
         case "local":
@@ -23763,7 +23778,7 @@ var init_integrations = __esm(() => {
       const base = cwd ? resolve20(cwd) : process.cwd();
       switch (scope) {
         case "user":
-          return resolve20(homedir22(), ".gemini", "config", "hooks.json");
+          return resolve20(homedir23(), ".gemini", "config", "hooks.json");
         case "project":
           return resolve20(base, ".agents", "hooks.json");
         case "local":
@@ -23904,7 +23919,7 @@ var init_integrations = __esm(() => {
       const base = cwd ? resolve20(cwd) : process.cwd();
       switch (scope) {
         case "user":
-          return resolve20(homedir22(), ".agents", "plugins", "failproofai", "hooks", "hooks.json");
+          return resolve20(homedir23(), ".agents", "plugins", "failproofai", "hooks", "hooks.json");
         case "project":
           return resolve20(base, ".agents", "plugins", "failproofai", "hooks", "hooks.json");
         case "local":
@@ -24799,14 +24814,30 @@ function deduplicateScopes(scopes, cwd) {
   });
 }
 function hooksInstalledInSettings(scope, cwd) {
-  return INTEGRATION_TYPES.some((id) => {
+  return integrationsInstalledAt(scope, cwd).length > 0;
+}
+function integrationsInstalledAt(scope, cwd) {
+  return INTEGRATION_TYPES.filter((id) => {
     try {
-      return getIntegration(id).hooksInstalledInSettings(scope, cwd);
+      const integration = getIntegration(id);
+      if (!integration.scopes.includes(scope))
+        return false;
+      if (!integration.hooksInstalledInSettings(scope, cwd))
+        return false;
+      const here = integration.getSettingsPath(scope, cwd);
+      return !HOOK_SCOPES.some((other) => other !== scope && HOOK_SCOPES.indexOf(other) < HOOK_SCOPES.indexOf(scope) && integration.scopes.includes(other) && safeSettingsPath(integration, other, cwd) === here);
     } catch {
       return false;
     }
   });
 }
+function safeSettingsPath(integration, scope, cwd) {
+  try {
+    return integration.getSettingsPath(scope, cwd);
+  } catch {
+    return null;
+  }
+}
 async function installHooks(policyNames, scope = "user", cwd, includeBeta = false, source, customPoliciesPath, removeCustomHooks = false, cli, options = {}) {
   const { replace = false, quiet = false } = options;
   if (!quiet) {
@@ -25532,8 +25563,8 @@ var init_cloud_connection = __esm(() => {
 // src/hooks/setup-state.ts
 import { existsSync as existsSync29, realpathSync as realpathSync2, statSync as statSync18 } from "node:fs";
 import { dirname as dirname15, resolve as resolve23 } from "node:path";
-import { homedir as homedir23 } from "node:os";
-function globalConfigPath(home = homedir23()) {
+import { homedir as homedir24 } from "node:os";
+function globalConfigPath(home = homedir24()) {
   return globalPolicyConfigFile(home);
 }
 function projectConfigPath(projectRoot) {
@@ -25549,7 +25580,7 @@ function isDir(path3) {
     return false;
   }
 }
-function findProjectRoot(start, home = homedir23()) {
+function findProjectRoot(start, home = homedir24()) {
   const resolvedHome = realResolve(home);
   let dir = realResolve(start);
   while (dir !== resolvedHome) {
@@ -25579,7 +25610,7 @@ function realResolve(path3) {
     return lexical;
   }
 }
-function detectSetupState(cwd = process.cwd(), home = homedir23()) {
+function detectSetupState(cwd = process.cwd(), home = homedir24()) {
   const resolvedCwd = realResolve(cwd);
   const resolvedHome = realResolve(home);
   const projectRoot = findProjectRoot(resolvedCwd, resolvedHome);
@@ -25691,8 +25722,8 @@ var init_onboarding_attempt = __esm(() => {
 
 // src/hooks/onboarding-lock.ts
 import { mkdirSync as mkdirSync19, readFileSync as readFileSync25, rmSync as rmSync12, writeFileSync as writeFileSync17 } from "node:fs";
-import { homedir as homedir24 } from "node:os";
-function onboardingLockPath(home = homedir24()) {
+import { homedir as homedir25 } from "node:os";
+function onboardingLockPath(home = homedir25()) {
   return onboardingLockFile(home);
 }
 function processAlive(pid) {
@@ -25715,7 +25746,7 @@ function readLock(path3) {
     return null;
   }
 }
-function acquireOnboardingLock(home = homedir24()) {
+function acquireOnboardingLock(home = homedir25()) {
   const path3 = onboardingLockPath(home);
   try {
     const held = readLock(path3);
@@ -25747,7 +25778,7 @@ var init_onboarding_lock = __esm(() => {
 
 // lib/claude-sessions.ts
 import { readdirSync as readdirSync17, statSync as statSync19, existsSync as existsSync31 } from "node:fs";
-import { join as join31, basename as basename6 } from "node:path";
+import { join as join32, basename as basename6 } from "node:path";
 function getClaudeProjectsRoot() {
   return getClaudeProjectsPath();
 }
@@ -25762,7 +25793,7 @@ function listClaudeProjects() {
   return entries.filter((e) => e.isDirectory()).map((e) => ({
     name: e.name,
     cwd: decodeFolderName(e.name),
-    path: join31(root, e.name)
+    path: join32(root, e.name)
   }));
 }
 function listClaudeTranscripts(project) {
@@ -25778,7 +25809,7 @@ function listClaudeTranscripts(project) {
       const sessionId = entry.name.slice(0, -".jsonl".length);
       if (!UUID_RE2.test(sessionId))
         continue;
-      const transcriptPath = join31(project.path, entry.name);
+      const transcriptPath = join32(project.path, entry.name);
       try {
         const s = statSync19(transcriptPath);
         out.push({
@@ -25792,7 +25823,7 @@ function listClaudeTranscripts(project) {
         });
       } catch {}
     } else if (entry.isDirectory() && UUID_RE2.test(entry.name)) {
-      const subDir = join31(project.path, entry.name, "subagents");
+      const subDir = join32(project.path, entry.name, "subagents");
       if (!existsSync31(subDir))
         continue;
       let subEntries;
@@ -25805,7 +25836,7 @@ function listClaudeTranscripts(project) {
         if (!sub.isFile() || !sub.name.endsWith(".jsonl"))
           continue;
         const agentId = sub.name.slice(0, -".jsonl".length);
-        const transcriptPath = join31(subDir, sub.name);
+        const transcriptPath = join32(subDir, sub.name);
         try {
           const s = statSync19(transcriptPath);
           out.push({
@@ -25881,7 +25912,7 @@ var init_shared = __esm(() => {
 });
 
 // src/audit/cli-adapters/claude.ts
-import { readFile as readFile15 } from "node:fs/promises";
+import { readFile as readFile15, open as open2 } from "node:fs/promises";
 async function listClaudeTranscriptMetadata(opts = {}) {
   const projectFilter = opts.projects ? new Set(opts.projects) : null;
   const sinceMs = opts.sinceMs ?? 0;
@@ -25944,6 +25975,78 @@ async function streamClaudeEvents(meta) {
     cwd
   });
 }
+async function streamClaudeEventsFrom(meta, fromByte) {
+  if (!Number.isFinite(fromByte) || fromByte < 0)
+    return null;
+  let handle = null;
+  let chunk;
+  try {
+    handle = await open2(meta.transcriptPath, "r");
+    const { size } = await handle.stat();
+    if (fromByte > size)
+      return null;
+    if (fromByte === size) {
+      return { events: [], bytesConsumed: fromByte };
+    }
+    const buf = Buffer.alloc(size - fromByte);
+    await handle.read(buf, 0, buf.length, fromByte);
+    chunk = buf.toString("utf-8");
+  } catch {
+    return null;
+  } finally {
+    if (handle) {
+      try {
+        await handle.close();
+      } catch {}
+    }
+  }
+  const lastNewline = chunk.lastIndexOf(`
+`);
+  const head = lastNewline === -1 ? "" : chunk.slice(0, lastNewline + 1);
+  const tail = chunk.slice(lastNewline + 1);
+  const tailIsWholeLine = tail.trim().length > 0 && (() => {
+    try {
+      JSON.parse(tail);
+      return true;
+    } catch {
+      return false;
+    }
+  })();
+  const complete = tailIsWholeLine ? head + tail : head;
+  if (complete.length === 0) {
+    return { events: [], bytesConsumed: fromByte };
+  }
+  const bytesConsumed = fromByte + Buffer.byteLength(complete, "utf-8");
+  let entries;
+  try {
+    entries = await parseLogContent(complete, "session");
+  } catch {
+    return null;
+  }
+  let cwd = "";
+  for (const line of complete.split(`
+`, 50)) {
+    if (!line.trim())
+      continue;
+    try {
+      const parsed = JSON.parse(line);
+      if (typeof parsed.cwd === "string" && parsed.cwd.length > 0) {
+        cwd = parsed.cwd;
+        break;
+      }
+    } catch {}
+  }
+  return {
+    events: logEntriesToEvents(entries, {
+      cli: "claude",
+      sessionId: meta.sessionId,
+      transcriptPath: meta.transcriptPath,
+      cwd
+    }),
+    bytesConsumed,
+    cwd: cwd || undefined
+  };
+}
 var init_claude = __esm(() => {
   init_claude_sessions();
   init_log_entries();
@@ -26104,20 +26207,9 @@ var init_cursor = __esm(() => {
 });
 
 // lib/opencode-sessions.ts
-import { execFileSync as execFileSync4 } from "node:child_process";
-function runOpenCodeDb2(sql) {
+function safeQuery(run) {
   try {
-    const stdout = execFileSync4("opencode", ["db", "--format", "json", sql], {
-      encoding: "utf8",
-      timeout: 5000,
-      stdio: ["ignore", "pipe", "pipe"]
-    });
-    if (!stdout.trim())
-      return [];
-    const parsed = JSON.parse(stdout);
-    if (!Array.isArray(parsed))
-      return null;
-    return parsed;
+    return run();
   } catch {
     return null;
   }
@@ -26226,12 +26318,17 @@ function translateMessage(msgRow, partRows, source) {
 async function getOpenCodeSessionLog(sessionId) {
   if (!sessionId || !/^[A-Za-z0-9_-]+$/.test(sessionId))
     return null;
-  const sessions = runOpenCodeDb2(`SELECT id, project_id, slug, directory, title, time_created, time_updated FROM session WHERE id = '${sessionId}'`);
+  const rows3 = await withOpenCodeDb((db) => ({
+    sessions: safeQuery(() => db.query("SELECT id, project_id, slug, directory, title, time_created, time_updated FROM session WHERE id = ?", [sessionId])),
+    messages: safeQuery(() => db.query("SELECT id, session_id, time_created, time_updated, data FROM message WHERE session_id = ? ORDER BY time_created ASC", [sessionId])),
+    parts: safeQuery(() => db.query("SELECT id, message_id, session_id, time_created, time_updated, data FROM part WHERE session_id = ? ORDER BY time_created ASC", [sessionId]))
+  }));
+  const sessions = rows3?.sessions ?? null;
   if (!sessions || sessions.length === 0)
     return null;
   const session = sessions[0];
-  const messages = runOpenCodeDb2(`SELECT id, session_id, time_created, time_updated, data FROM message WHERE session_id = '${sessionId}' ORDER BY time_created ASC`);
-  const parts = runOpenCodeDb2(`SELECT id, message_id, session_id, time_created, time_updated, data FROM part WHERE session_id = '${sessionId}' ORDER BY time_created ASC`);
+  const messages = rows3?.messages ?? null;
+  const parts = rows3?.parts ?? null;
   if (!messages)
     return { entries: [], rawLines: [], cwd: session.directory ?? undefined, filePath: `opencode://${sessionId}` };
   const partsByMessage = new Map;
@@ -26265,6 +26362,7 @@ async function getOpenCodeSessionLog(sessionId) {
 }
 var getCachedOpenCodeSessionLog;
 var init_opencode_sessions = __esm(() => {
+  init_opencode_db();
   init_log_entries();
   getCachedOpenCodeSessionLog = runtimeCache((sessionId) => getOpenCodeSessionLog(sessionId), 30, { maxSize: 50 });
 });
@@ -26668,7 +26766,8 @@ var init_cli_adapters = __esm(() => {
     claude: {
       cli: "claude",
       listTranscripts: listClaudeTranscriptMetadata,
-      streamEvents: streamClaudeEvents
+      streamEvents: streamClaudeEvents,
+      streamEventsFrom: streamClaudeEventsFrom
     },
     codex: {
       cli: "codex",
@@ -27068,8 +27167,8 @@ var init_features = __esm(() => {
 
 // src/audit/cache.ts
 import { createHash as createHash8 } from "node:crypto";
-import { existsSync as existsSync32, mkdirSync as mkdirSync20, readFileSync as readFileSync26, writeFileSync as writeFileSync18, chmodSync as chmodSync5 } from "node:fs";
-import { join as join32 } from "node:path";
+import { existsSync as existsSync32, mkdirSync as mkdirSync20, readFileSync as readFileSync26, writeFileSync as writeFileSync18, chmodSync as chmodSync5, openSync, readSync, closeSync } from "node:fs";
+import { join as join33 } from "node:path";
 function getEngineVersion() {
   if (cachedEngineVersion)
     return cachedEngineVersion;
@@ -27089,9 +27188,43 @@ function getDetectorVersion() {
 function getCachePathFor(transcriptPath) {
   const root = auditCacheDir();
   const key = createHash8("sha1").update(transcriptPath).digest("hex");
-  return join32(root, `${key}.json`);
+  return join33(root, `${key}.json`);
+}
+function encodeDetectorState(state) {
+  return JSON.stringify(state, (_k, v) => v instanceof Map ? { __map: [...v.entries()] } : v);
+}
+function decodeDetectorState(raw) {
+  if (!raw)
+    return {};
+  try {
+    return JSON.parse(raw, (_k, v) => v && typeof v === "object" && Array.isArray(v.__map) ? new Map(v.__map) : v);
+  } catch {
+    return {};
+  }
+}
+function anchorHashFor(transcriptPath, upTo) {
+  if (upTo <= 0)
+    return null;
+  let fd = null;
+  try {
+    fd = openSync(transcriptPath, "r");
+    const head = Buffer.alloc(Math.min(ANCHOR_WINDOW, upTo));
+    readSync(fd, head, 0, head.length, 0);
+    const tailLen = Math.min(ANCHOR_WINDOW, upTo);
+    const tail = Buffer.alloc(tailLen);
+    readSync(fd, tail, 0, tailLen, upTo - tailLen);
+    return createHash8("sha1").update(String(upTo)).update(head).update(tail).digest("hex").slice(0, 32);
+  } catch {
+    return null;
+  } finally {
+    if (fd !== null) {
+      try {
+        closeSync(fd);
+      } catch {}
+    }
+  }
 }
-function readCachedTranscriptResult(transcriptPath, mtimeMs, sizeBytes) {
+function readCachedTranscript(transcriptPath, mtimeMs, sizeBytes) {
   if (sizeBytes === 0)
     return null;
   const cachePath = getCachePathFor(transcriptPath);
@@ -27102,22 +27235,37 @@ function readCachedTranscriptResult(transcriptPath, mtimeMs, sizeBytes) {
     const entry = JSON.parse(raw);
     if (entry.schemaVersion !== CACHE_SCHEMA_VERSION)
       return null;
-    if (entry.mtimeMs !== mtimeMs)
-      return null;
-    if (entry.sizeBytes !== sizeBytes)
-      return null;
     if (entry.engineVersion !== getEngineVersion())
       return null;
     if (entry.detectorVersion !== getDetectorVersion())
       return null;
     if (!Number.isFinite(entry.cachedAt) || Date.now() - entry.cachedAt > CACHE_TTL_MS)
       return null;
-    return entry.result ?? null;
+    if (!entry.result)
+      return null;
+    if (entry.mtimeMs === mtimeMs && entry.sizeBytes === sizeBytes) {
+      return { kind: "hit", result: entry.result };
+    }
+    const from = entry.bytesScanned;
+    if (!Number.isFinite(from) || from <= 0)
+      return null;
+    if (from > sizeBytes)
+      return null;
+    if (!entry.anchorHash)
+      return null;
+    if (anchorHashFor(transcriptPath, from) !== entry.anchorHash)
+      return null;
+    return {
+      kind: "resume",
+      result: entry.result,
+      fromByte: from,
+      detectorState: decodeDetectorState(entry.detectorState)
+    };
   } catch {
     return null;
   }
 }
-function writeCachedTranscriptResult(transcriptPath, mtimeMs, sizeBytes, result) {
+function writeCachedTranscriptResult(transcriptPath, mtimeMs, sizeBytes, result, resume) {
   if (sizeBytes === 0)
     return;
   const cachePath = getCachePathFor(transcriptPath);
@@ -27132,13 +27280,21 @@ function writeCachedTranscriptResult(transcriptPath, mtimeMs, sizeBytes, result)
       detectorVersion: getDetectorVersion(),
       result
     };
+    if (resume && resume.bytesScanned > 0) {
+      const anchor = anchorHashFor(transcriptPath, resume.bytesScanned);
+      if (anchor) {
+        entry.bytesScanned = resume.bytesScanned;
+        entry.anchorHash = anchor;
+        entry.detectorState = encodeDetectorState(resume.detectorState);
+      }
+    }
     writeFileSync18(cachePath, JSON.stringify(entry), { encoding: "utf-8", mode: 384 });
     try {
       chmodSync5(cachePath, 384);
     } catch {}
   } catch {}
 }
-var cachedEngineVersion = null, cachedDetectorVersion = null, CACHE_SCHEMA_VERSION = 3, CACHE_TTL_MS;
+var cachedEngineVersion = null, cachedDetectorVersion = null, CACHE_SCHEMA_VERSION = 4, ANCHOR_WINDOW = 4096, CACHE_TTL_MS;
 var init_cache = __esm(() => {
   init_builtin_policies();
   init_detectors();
@@ -27251,7 +27407,7 @@ function parseSinceOpt(since) {
     return t;
   throw new Error(`Invalid --since value: "${since}" (expected e.g. "7d", "30d", or "2026-04-01")`);
 }
-async function scanOneTranscript(meta) {
+async function scanOneTranscript(meta, resume) {
   const empty = {
     transcriptPath: meta.transcriptPath,
     cli: meta.cli,
@@ -27265,13 +27421,30 @@ async function scanOneTranscript(meta) {
     examplesByName: {},
     rangeByName: {}
   };
-  const events = await ADAPTERS[meta.cli].streamEvents(meta);
-  if (events.length === 0)
-    return empty;
+  const adapter = ADAPTERS[meta.cli];
+  let events;
+  let bytesScanned = 0;
+  const sessionState = resume?.detectorState ?? {};
+  if (adapter.streamEventsFrom) {
+    const scan = await adapter.streamEventsFrom(meta, resume?.fromByte ?? 0);
+    if (!scan) {
+      events = await adapter.streamEvents(meta);
+      bytesScanned = 0;
+    } else {
+      events = scan.events;
+      bytesScanned = scan.bytesConsumed;
+      empty.cwd = scan.cwd ?? "";
+    }
+  } else {
+    events = await adapter.streamEvents(meta);
+    bytesScanned = 0;
+  }
+  if (events.length === 0) {
+    return { result: empty, bytesScanned, detectorState: sessionState };
+  }
   const result = empty;
   result.eventsScanned = events.length;
-  result.cwd = events[0].cwd || "";
-  const sessionState = {};
+  result.cwd = result.cwd || events[0].cwd || "";
   for (const event of events) {
     for (const detector of AUDIT_DETECTORS) {
       const hit = detector.detect(event, sessionState);
@@ -27290,7 +27463,7 @@ async function scanOneTranscript(meta) {
       recordHit(result, hit.policyName, event.timestamp, event.cwd, truncateExample(example));
     }
   }
-  return result;
+  return { result, bytesScanned, detectorState: sessionState };
 }
 function formatPolicyExample(_policyName, event) {
   if (event.toolName === "Bash") {
@@ -27303,6 +27476,45 @@ function formatPolicyExample(_policyName, event) {
     return `${event.toolName} ${filePath}`;
   return `${event.toolName}`;
 }
+function mergeIncremental(cached, tail) {
+  const out = {
+    ...cached,
+    mtimeMs: tail.mtimeMs,
+    sizeBytes: tail.sizeBytes,
+    cwd: cached.cwd || tail.cwd || "",
+    eventsScanned: (cached.eventsScanned ?? 0) + (tail.eventsScanned ?? 0),
+    hitsByName: { ...cached.hitsByName },
+    examplesByName: {},
+    rangeByName: { ...cached.rangeByName }
+  };
+  for (const [name, list] of Object.entries(cached.examplesByName)) {
+    out.examplesByName[name] = [...list];
+  }
+  for (const [name, count] of Object.entries(tail.hitsByName)) {
+    out.hitsByName[name] = (out.hitsByName[name] ?? 0) + count;
+  }
+  for (const [name, list] of Object.entries(tail.examplesByName)) {
+    const exs = out.examplesByName[name] ?? [];
+    for (const ex of list) {
+      if (exs.length >= AUDIT_MAX_EXAMPLES_PER_NAME)
+        break;
+      exs.push(ex);
+    }
+    out.examplesByName[name] = exs;
+  }
+  for (const [name, range] of Object.entries(tail.rangeByName)) {
+    const existing = out.rangeByName[name];
+    if (!existing) {
+      out.rangeByName[name] = { ...range };
+    } else {
+      if (range.first < existing.first)
+        existing.first = range.first;
+      if (range.last > existing.last)
+        existing.last = range.last;
+    }
+  }
+  return out;
+}
 function recordHit(result, name, timestamp, cwd, example) {
   result.hitsByName[name] = (result.hitsByName[name] ?? 0) + 1;
   const exs = result.examplesByName[name] ?? [];
@@ -27404,15 +27616,20 @@ async function runAuditInner(opts, startedAt) {
   let skipped = 0;
   let errors2 = 0;
   const tasks = allTranscripts.map((meta) => async () => {
+    let resume;
+    let cachedPrefix = null;
     if (!opts.noCache) {
-      const cached = readCachedTranscriptResult(meta.transcriptPath, meta.mtimeMs, meta.sizeBytes);
-      if (cached)
-        return cached;
+      const found = readCachedTranscript(meta.transcriptPath, meta.mtimeMs, meta.sizeBytes);
+      if (found?.kind === "hit")
+        return found.result;
+      resume = found?.kind === "resume" ? { fromByte: found.fromByte, detectorState: found.detectorState } : undefined;
+      cachedPrefix = found?.kind === "resume" ? found.result : null;
     }
     try {
-      const fresh = await scanOneTranscript(meta);
+      const scan = await scanOneTranscript(meta, resume);
+      const fresh = cachedPrefix ? mergeIncremental(cachedPrefix, scan.result) : scan.result;
       if (!opts.noCache) {
-        writeCachedTranscriptResult(meta.transcriptPath, meta.mtimeMs, meta.sizeBytes, fresh);
+        writeCachedTranscriptResult(meta.transcriptPath, meta.mtimeMs, meta.sizeBytes, fresh, scan.bytesScanned > 0 ? { bytesScanned: scan.bytesScanned, detectorState: scan.detectorState } : undefined);
       }
       return fresh;
     } catch {
@@ -27496,10 +27713,10 @@ var init_audit = __esm(() => {
 
 // src/audit/audit-lock.ts
 import {
-  closeSync,
+  closeSync as closeSync2,
   linkSync,
   mkdirSync as mkdirSync21,
-  openSync,
+  openSync as openSync2,
   readFileSync as readFileSync27,
   unlinkSync as unlinkSync4,
   writeFileSync as writeFileSync19,
@@ -27597,7 +27814,7 @@ function writeLockExclusive(path3, info) {
 function createThenWrite(path3, body) {
   let fd;
   try {
-    fd = openSync(path3, "wx", 384);
+    fd = openSync2(path3, "wx", 384);
     writeSync(fd, body);
     return true;
   } catch {
@@ -27605,7 +27822,7 @@ function createThenWrite(path3, body) {
   } finally {
     if (fd !== undefined) {
       try {
-        closeSync(fd);
+        closeSync2(fd);
       } catch {}
     }
   }
@@ -27869,10 +28086,10 @@ var init_api_server_client = __esm(() => {
 
 // lib/auth/auth-store.ts
 import { existsSync as existsSync34, readFileSync as readFileSync29, readdirSync as readdirSync18, rmSync as rmSync13 } from "node:fs";
-import { join as join33, resolve as resolve24 } from "node:path";
+import { join as join34, resolve as resolve24 } from "node:path";
 function getAuthFilePath() {
   const override = process.env.FAILPROOFAI_AUTH_DIR;
-  return override ? join33(override, "session.json") : auditSessionFile();
+  return override ? join34(override, "session.json") : auditSessionFile();
 }
 function readAuth() {
   const p = getAuthFilePath();
@@ -27975,7 +28192,7 @@ var init_auth_store = __esm(() => {
 });
 
 // src/audit/redact-example.ts
-import { homedir as homedir25 } from "node:os";
+import { homedir as homedir26 } from "node:os";
 function maskTruncatedSecret(input) {
   for (const [pattern, label] of SECRET_PREFIXES) {
     if (pattern.test(input)) {
@@ -28010,7 +28227,7 @@ function maskSecrets(input) {
   }
   return out;
 }
-function shortenPaths(input, home = homedir25()) {
+function shortenPaths(input, home = homedir26()) {
   const homeRoot = home.replace(/\/+$/, "");
   return input.replace(ABSOLUTE_PATH_RE, (match, offset, whole) => {
     if (PUBLIC_PATH_ROOTS.some((root2) => match.startsWith(root2)))
@@ -28041,7 +28258,7 @@ function shortenPaths(input, home = homedir25()) {
     return `${root}${middle}/${tail}${trailingSlash ? "/" : ""}`;
   });
 }
-function redactExample(input, home = homedir25()) {
+function redactExample(input, home = homedir26()) {
   const masked = maskAssignedSecrets(maskTruncatedSecret(maskSecrets(input)));
   const shortened = shortenPaths(masked, home);
   const collapsed = shortened.replace(/\s+/g, " ").trim();
@@ -28662,7 +28879,7 @@ function asScheduleError(err) {
   }
   throw err;
 }
-var MIN_DAYS = 1, MAX_DAYS = 90, ScheduleCliError, styled = () => colorsEnabled2(process.stdout), wrap3 = (open2, s) => styled() ? `${open2}${s}${ANSI_RESET2}` : s, pink = (s) => wrap3(brandAnsi2("pink"), s), green = (s) => wrap3(brandAnsi2("guide"), s), dim = (s) => wrap3(ANSI_DIM2, s), bold = (s) => wrap3(ANSI_BOLD2, s);
+var MIN_DAYS = 1, MAX_DAYS = 90, ScheduleCliError, styled = () => colorsEnabled2(process.stdout), wrap3 = (open3, s) => styled() ? `${open3}${s}${ANSI_RESET2}` : s, pink = (s) => wrap3(brandAnsi2("pink"), s), green = (s) => wrap3(brandAnsi2("guide"), s), dim = (s) => wrap3(ANSI_DIM2, s), bold = (s) => wrap3(ANSI_BOLD2, s);
 var init_schedule_cli = __esm(() => {
   init_fp_config();
   init_daemon_service();
@@ -28742,7 +28959,7 @@ var init_parse_script_args = () => {};
 // scripts/install-diagnosis.mjs
 import { existsSync as existsSync36, readFileSync as readFileSync32, realpathSync as realpathSync3 } from "node:fs";
 import { dirname as dirname17, resolve as resolve26 } from "node:path";
-import { homedir as homedir26, platform as platform4 } from "node:os";
+import { homedir as homedir27, platform as platform4 } from "node:os";
 import { spawnSync } from "node:child_process";
 function findPackageRoot(start) {
   try {
@@ -28806,7 +29023,7 @@ function locateNpmGlobal() {
 }
 function locateBunGlobal() {
   try {
-    const candidate = resolve26(homedir26(), ".bun", "install", "global", "node_modules", PKG_NAME);
+    const candidate = resolve26(homedir27(), ".bun", "install", "global", "node_modules", PKG_NAME);
     return existsSync36(resolve26(candidate, "package.json")) ? candidate : null;
   } catch {
     return null;
@@ -28815,8 +29032,8 @@ function locateBunGlobal() {
 function buildRecommendation(pathFirstBin) {
   if (!pathFirstBin)
     return null;
-  const bunBinPrefix = resolve26(homedir26(), ".bun", "bin") + "/";
-  const bunGlobalPrefix = resolve26(homedir26(), ".bun", "install", "global") + "/";
+  const bunBinPrefix = resolve26(homedir27(), ".bun", "bin") + "/";
+  const bunGlobalPrefix = resolve26(homedir27(), ".bun", "install", "global") + "/";
   const isBun = pathFirstBin.startsWith(bunBinPrefix) || pathFirstBin.startsWith(bunGlobalPrefix);
   if (isBun) {
     return `rm -f ~/.bun/bin/${PKG_NAME} && rm -rf ~/.bun/install/global/node_modules/${PKG_NAME}`;
@@ -29461,7 +29678,7 @@ __export(exports_configure_wizard, {
   setCustomPoliciesEnabled: () => setCustomPoliciesEnabled
 });
 import { existsSync as existsSync38, mkdirSync as mkdirSync22, writeFileSync as writeFileSync20, readFileSync as readFileSync33 } from "node:fs";
-import { homedir as homedir27 } from "node:os";
+import { homedir as homedir28 } from "node:os";
 import { dirname as dirname19, resolve as resolve28, sep as sep5 } from "node:path";
 async function emit(event, props) {
   try {
@@ -29469,7 +29686,7 @@ async function emit(event, props) {
   } catch {}
 }
 function homeify(p) {
-  const home = homedir27();
+  const home = homedir28();
   if (p === home)
     return "~";
   if (p.startsWith(home + sep5))
@@ -30160,16 +30377,16 @@ __export(exports_flush_cli2, {
   runFlushCommand: () => runFlushCommand2
 });
 import { existsSync as existsSync39, mkdirSync as mkdirSync23, writeFileSync as writeFileSync21, readdirSync as readdirSync19 } from "node:fs";
-import { dirname as dirname20, join as join34 } from "node:path";
+import { dirname as dirname20, join as join35 } from "node:path";
 function flushRequestPath2(home) {
-  return join34(failproofaiHome(home), "state", "flush-request.json");
+  return join35(failproofaiHome(home), "state", "flush-request.json");
 }
 function spoolDirs2(home) {
   const root = spoolDir(home);
   if (!existsSync39(root))
     return [];
   try {
-    return readdirSync19(root, { withFileTypes: true }).filter((e) => e.isDirectory() && e.name !== "failed").map((e) => join34(root, e.name));
+    return readdirSync19(root, { withFileTypes: true }).filter((e) => e.isDirectory() && e.name !== "failed").map((e) => join35(root, e.name));
   } catch {
     return [];
   }
@@ -30274,14 +30491,14 @@ __export(exports_backfill_cli, {
   runBackfillCommand: () => runBackfillCommand
 });
 import { existsSync as existsSync40, mkdirSync as mkdirSync24, writeFileSync as writeFileSync22, readdirSync as readdirSync20, statSync as statSync24 } from "node:fs";
-import { dirname as dirname21, join as join35 } from "node:path";
+import { dirname as dirname21, join as join36 } from "node:path";
 function backfillRequestPath(home) {
-  return join35(failproofaiHome(home), "state", "backfill-request.json");
+  return join36(failproofaiHome(home), "state", "backfill-request.json");
 }
 function surveySessions(sinceMs, homeDir) {
   const out = [];
   for (const { cli, dir } of SESSION_DIRS) {
-    const root = join35(homeDir, dir);
+    const root = join36(homeDir, dir);
     if (!existsSync40(root))
       continue;
     let files = 0;
@@ -30296,7 +30513,7 @@ function surveySessions(sinceMs, homeDir) {
         return;
       }
       for (const e of entries) {
-        const p = join35(d, e.name);
+        const p = join36(d, e.name);
         if (e.isDirectory()) {
           walk(p, depth + 1);
           continue;
@@ -30420,16 +30637,17 @@ var init_backfill_cli = __esm(() => {
 // src/hooks/pack-cli.ts
 var exports_pack_cli = {};
 __export(exports_pack_cli, {
+  __pushExistingHistoryForTest: () => __pushExistingHistoryForTest,
   packAddSource: () => packAddSource,
   runPackCommand: () => runPackCommand,
   runPolicyPicker: () => runPolicyPicker,
   runPublishCommand: () => runPublishCommand
 });
-import { execFileSync as execFileSync5 } from "node:child_process";
-import { homedir as homedir28 } from "node:os";
+import { execFileSync as execFileSync3 } from "node:child_process";
+import { homedir as homedir29, tmpdir as tmpdir3 } from "node:os";
 import { createHash as createHash9 } from "node:crypto";
-import { copyFileSync as copyFileSync4, existsSync as existsSync41, mkdirSync as mkdirSync25, readFileSync as readFileSync34, readdirSync as readdirSync21, statSync as statSync25, writeFileSync as writeFileSync23 } from "node:fs";
-import { resolve as resolve29 } from "node:path";
+import { copyFileSync as copyFileSync4, existsSync as existsSync41, mkdirSync as mkdirSync25, mkdtempSync as mkdtempSync2, readFileSync as readFileSync34, readdirSync as readdirSync21, rmSync as rmSync15, statSync as statSync25, writeFileSync as writeFileSync23 } from "node:fs";
+import { basename as basename7, dirname as dirname22, join as join37, resolve as resolve29 } from "node:path";
 function parseList(rest, flag) {
   const idx = rest.findIndex((a) => a === flag || a.startsWith(`${flag}=`));
   if (idx === -1)
@@ -30622,6 +30840,9 @@ async function runPolicyPicker(action, io = {}) {
     lines.push(`  turned off (${turnedOff.length}): ${summarise(turnedOff)}`);
   return ok(lines);
 }
+function withPolicyExtension(name) {
+  return /\.(mjs|js|ts)$/.test(name) ? name : `${name}.mjs`;
+}
 async function scaffold(target) {
   let chosen = target;
   if (!chosen && process.stdin.isTTY && process.stdout.isTTY) {
@@ -30635,9 +30856,9 @@ async function scaffold(target) {
     });
     if (answer === null)
       return ok(["Nothing written."]);
-    chosen = `./${answer.trim().replace(/\.(mjs|js|ts)$/, "")}.mjs`;
+    chosen = answer.trim();
   }
-  const path3 = resolve29(chosen ?? "./my-policies.mjs");
+  const path3 = resolve29(withPolicyExtension(chosen ?? "my-policies"));
   if (existsSync41(path3)) {
     return fail([`${path3} already exists — name a different file, or edit that one.`]);
   }
@@ -30673,12 +30894,12 @@ customPolicies.add({
     "  then ask your agent to force-push — it gets refused",
     "",
     "Then publish it:",
-    `  failproofai publish ${path3} --repo <you>/<repo> --version 1.0.0`
+    "  failproofai publish --repo <you>/<repo>"
   ]);
 }
 function inferRepo(entryPath) {
   try {
-    const url = execFileSync5("git", ["remote", "get-url", "origin"], {
+    const url = execFileSync3("git", ["remote", "get-url", "origin"], {
       cwd: resolve29(entryPath, ".."),
       encoding: "utf8",
       stdio: ["ignore", "pipe", "ignore"],
@@ -30694,7 +30915,7 @@ function inferTaggedVersion(entryPath) {
   const cwd = resolve29(entryPath, "..");
   const git = (args) => {
     try {
-      return execFileSync5("git", args, {
+      return execFileSync3("git", args, {
         cwd,
         encoding: "utf8",
         stdio: ["ignore", "pipe", "ignore"],
@@ -30751,7 +30972,7 @@ async function nextVersion(owner, name, token) {
   }
   return best ? `${best[0]}.${best[1]}.${best[2] + 1}` : "1.0.0";
 }
-async function ensureRepo(owner, name, id, token) {
+async function ensureRepo(owner, name, id, token, sourceDir) {
   let info = await gh(`${GITHUB_API}/repos/${owner}/${name}`, token);
   let created = false;
   if (info.status === 404) {
@@ -30765,7 +30986,7 @@ async function ensureRepo(owner, name, id, token) {
         name,
         private: false,
         description: `failproofai policy pack — ${id}`,
-        auto_init: true
+        auto_init: false
       })
     });
     if (made.status >= 400) {
@@ -30779,6 +31000,9 @@ async function ensureRepo(owner, name, id, token) {
       };
     }
     created = true;
+    if (!(sourceDir && pushExistingHistory(sourceDir, owner, name, token))) {
+      await seedDefaultBranch(owner, name, id, token);
+    }
     info = await gh(`${GITHUB_API}/repos/${owner}/${name}`, token);
   }
   if (info.status >= 400) {
@@ -30786,17 +31010,77 @@ async function ensureRepo(owner, name, id, token) {
   }
   return { info, created };
 }
+function pushExistingHistory(dir, owner, name, token) {
+  const git = (args, env) => {
+    try {
+      return execFileSync3("git", args, {
+        cwd: dir,
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "ignore"],
+        timeout: 60000,
+        env: env ? { ...process.env, ...env } : process.env
+      }).trim();
+    } catch {
+      return null;
+    }
+  };
+  const branch = git(["rev-parse", "--abbrev-ref", "HEAD"]);
+  if (!branch || branch === "HEAD" || !git(["rev-parse", "--verify", "HEAD"]))
+    return false;
+  const askpass = join37(mkdtempSync2(join37(tmpdir3(), "fpai-askpass-")), "askpass.sh");
+  try {
+    writeFileSync23(askpass, `#!/bin/sh
+case "$1" in
+*Username*) echo x-access-token ;;
+*) echo "$FPAI_GH_TOKEN" ;;
+esac
+`, { mode: 448 });
+    const env = { GIT_ASKPASS: askpass, FPAI_GH_TOKEN: token, GIT_TERMINAL_PROMPT: "0" };
+    const url = `${GITHUB_GIT}/${owner}/${name}.git`;
+    const adopt = !git(["remote", "get-url", "origin"]);
+    if (adopt)
+      git(["remote", "add", "origin", url]);
+    const pushed = adopt ? git(["push", "-u", "origin", `${branch}:${branch}`], env) : git(["push", url, `${branch}:${branch}`], env);
+    if (pushed === null) {
+      if (adopt)
+        git(["remote", "remove", "origin"]);
+      return false;
+    }
+    return true;
+  } finally {
+    try {
+      rmSync15(dirname22(askpass), { recursive: true, force: true });
+    } catch {}
+  }
+}
+async function seedDefaultBranch(owner, name, id, token) {
+  await gh(`${GITHUB_API}/repos/${owner}/${name}/contents/README.md`, token, {
+    method: "PUT",
+    contentType: "application/json",
+    body: JSON.stringify({
+      message: `${id}: create pack repository`,
+      content: Buffer.from(`# ${name}
+
+A [failproofai](https://github.com/failproofai/failproofai) policy pack.
+
+\`\`\`bash
+failproofai policies add ${owner}/${name}
+\`\`\`
+`, "utf8").toString("base64")
+    })
+  });
+}
 function findBun() {
   const candidates = [
     "bun",
     process.env.BUN_INSTALL ? resolve29(process.env.BUN_INSTALL, "bin", "bun") : null,
-    resolve29(homedir28(), ".bun", "bin", "bun"),
+    resolve29(homedir29(), ".bun", "bin", "bun"),
     "/opt/homebrew/bin/bun",
     "/usr/local/bin/bun"
   ].filter((c2) => c2 !== null);
   for (const candidate of candidates) {
     try {
-      execFileSync5(candidate, ["--version"], { stdio: "ignore", timeout: 5000 });
+      execFileSync3(candidate, ["--version"], { stdio: "ignore", timeout: 5000 });
       return candidate;
     } catch {
       continue;
@@ -30823,7 +31107,7 @@ function bundleEntry(sources, outDir) {
 `, "utf8");
   const bundled = resolve29(outDir, ".bundled.mjs");
   try {
-    execFileSync5(bun, [
+    execFileSync3(bun, [
       "build",
       "--target=node",
       "--format=esm",
@@ -30853,7 +31137,7 @@ function githubToken() {
   if (fromEnv)
     return fromEnv.trim();
   try {
-    const out = execFileSync5("gh", ["auth", "token"], {
+    const out = execFileSync3("gh", ["auth", "token"], {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "ignore"],
       timeout: 5000
@@ -30890,6 +31174,30 @@ function ghError(res) {
   const errors2 = Array.isArray(res.json?.errors) ? res.json.errors.map((e) => [e.field, e.code].filter(Boolean).join(" ")).filter(Boolean) : [];
   return errors2.length > 0 ? `${message} (${errors2.join("; ")})` : message;
 }
+async function askWhereToPublish(suggestion, io) {
+  const answer = await promptText2({
+    message: "Where should this publish?",
+    hint: `${suggestion}  ·  created if it does not exist`,
+    defaultValue: suggestion,
+    validate: (v) => {
+      const t = v.trim();
+      if (!/^[A-Za-z0-9][\w.-]*\/[A-Za-z0-9][\w.-]*$/.test(t))
+        return "owner/repo";
+      return null;
+    },
+    stdin: io.stdin,
+    stdout: io.stdout
+  });
+  return answer === null ? null : answer.trim();
+}
+async function credentialLogin(token) {
+  try {
+    const me = await gh(`${GITHUB_API}/user`, token);
+    return typeof me.json?.login === "string" ? me.json.login : null;
+  } catch {
+    return null;
+  }
+}
 async function publish(rest) {
   const flag = (name2) => {
     const i = rest.findIndex((a) => a === `--${name2}` || a.startsWith(`--${name2}=`));
@@ -30904,11 +31212,27 @@ async function publish(rest) {
   const discovered = entry ? [] : findEntry(process.cwd());
   if (!entry && discovered.length > 0)
     entry = discovered[0];
-  const repo = flag("repo") ?? (entry ? inferRepo(entry) : null) ?? undefined;
+  let repo = flag("repo") ?? (entry ? inferRepo(entry) : null) ?? undefined;
+  const interactive = Boolean(process.stdin.isTTY && process.stdout.isTTY);
+  const askingWhere = interactive && !repo && entry && !rest.includes("--dry-run");
+  if (askingWhere) {
+    const found = discovered.length > 0 ? discovered : [entry];
+    process.stdout.write(`
+  ${found.length} policy ${found.length === 1 ? "file" : "files"}: ` + `${found.map((f) => basename7(f)).join(", ")}
+
+`);
+    const token2 = githubToken();
+    const login = token2 ? await credentialLogin(token2) : null;
+    const folder = basename7(resolve29(entry, ".."));
+    const answered = await askWhereToPublish(`${login ?? "your-account"}/${folder}`, { stdin: process.stdin, stdout: process.stdout });
+    if (answered === null)
+      return ok(["Nothing was published."]);
+    repo = answered;
+  }
   let version3 = flag("version") ?? (entry ? inferTaggedVersion(entry) : null) ?? undefined;
   let versionCounted = false;
-  const id = flag("id") ?? repo;
   const dryRun = rest.includes("--dry-run") || !repo;
+  const id = flag("id") ?? repo ?? (dryRun && entry ? `local/${basename7(resolve29(entry, ".."))}` : undefined);
   const [owner, name] = (repo ?? "/").split("/");
   if (repo && (!owner || !name || repo.split("/").length !== 2)) {
     return fail([`--repo must be <owner>/<repo>, got ${JSON.stringify(repo)}`]);
@@ -30947,7 +31271,7 @@ async function publish(rest) {
         "It needs write access to releases on that repository, and nothing else."
       ]);
     }
-    const ensured = await ensureRepo(owner, name, id, token);
+    const ensured = await ensureRepo(owner, name, id, token, resolve29(entry, ".."));
     if ("error" in ensured)
       return fail(ensured.error);
     created = ensured.created;
@@ -30988,7 +31312,7 @@ async function publish(rest) {
       "",
       ...repo ? ["Dry run — nothing was published.", `Drop --dry-run to release it on ${repo}.`] : [
         "Nothing was published: name a repository to release it on.",
-        `  failproofai publish ${entry} --repo <owner>/<repo> --version ${version3}`
+        "  failproofai publish --repo <owner>/<repo>"
       ]
     ]);
   }
@@ -31297,7 +31621,7 @@ async function runPackCommand(argv) {
       return fail([`Unknown pack subcommand ${JSON.stringify(sub)}`, "Try: add, remove, list, build"]);
   }
 }
-var ok = (lines) => ({ lines, exitCode: 0 }), fail = (lines) => ({ lines, exitCode: 1 }), VALUE_FLAGS, PUBLISH_VALUE_FLAGS, GITHUB_API, GITHUB_UPLOADS;
+var ok = (lines) => ({ lines, exitCode: 0 }), fail = (lines) => ({ lines, exitCode: 1 }), VALUE_FLAGS, __pushExistingHistoryForTest = (dir, owner, name, token) => pushExistingHistory(dir, owner, name, token), PUBLISH_VALUE_FLAGS, GITHUB_API, GITHUB_UPLOADS, GITHUB_GIT;
 var init_pack_cli = __esm(() => {
   init_types();
   init_pack_manifest();
@@ -31320,6 +31644,7 @@ var init_pack_cli = __esm(() => {
   ]);
   GITHUB_API = process.env.FAILPROOFAI_GITHUB_API ?? "https://api.github.com";
   GITHUB_UPLOADS = process.env.FAILPROOFAI_GITHUB_UPLOADS ?? "https://uploads.github.com";
+  GITHUB_GIT = process.env.FAILPROOFAI_GITHUB_GIT ?? "https://github.com";
 });
 
 // src/hooks/harness-cli.ts
@@ -31331,7 +31656,7 @@ __export(exports_harness_cli, {
   removePath: () => removePath,
   runHarnessCommand: () => runHarnessCommand
 });
-import { homedir as homedir29 } from "node:os";
+import { homedir as homedir30 } from "node:os";
 import { resolve as resolve30 } from "node:path";
 function unknownHarness(name) {
   return fail2([
@@ -31375,7 +31700,7 @@ function comparableLabel(raw) {
   return raw.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
 }
 function comparablePath(raw) {
-  const home = homedir29();
+  const home = homedir30();
   const expanded = raw === "~" ? home : raw.startsWith("~/") ? resolve30(home, raw.slice(2)) : raw;
   return expanded.replace(/\/+$/, "");
 }
@@ -31583,7 +31908,7 @@ __export(exports_fp_config, {
   writeVersionFile: () => writeVersionFile2
 });
 import { chmodSync as chmodSync6, existsSync as existsSync42, mkdirSync as mkdirSync26, readFileSync as readFileSync35, statSync as statSync26, writeFileSync as writeFileSync24 } from "node:fs";
-import { dirname as dirname22 } from "node:path";
+import { dirname as dirname23 } from "node:path";
 function detectLayout2() {
   const raw = readVersionFile2();
   if (raw) {
@@ -31889,7 +32214,7 @@ function hasCloudCredentials() {
   return Boolean(c2.cloud || c2.ingest);
 }
 function writeFileAt2(path3, contents) {
-  mkdirSync26(dirname22(path3), { recursive: true });
+  mkdirSync26(dirname23(path3), { recursive: true });
   writeFileSync24(path3, contents, "utf8");
 }
 var DEFAULT_AUDIT_INTERVAL_DAYS2 = 7, MIN_AUDIT_INTERVAL_DAYS2 = 1, MAX_AUDIT_INTERVAL_DAYS2 = 90, DEFAULT_CONFIG2, OWNED_CONFIG_KEYS2, isPlainObject9 = (v) => typeof v === "object" && v !== null && !Array.isArray(v), OWNED_CREDENTIAL_KEYS2;
@@ -31996,12 +32321,12 @@ __export(exports_fp_home, {
   versionFile: () => versionFile2,
   workerSocket: () => workerSocket
 });
-import { homedir as homedir30 } from "node:os";
+import { homedir as homedir31 } from "node:os";
 import { resolve as resolve31 } from "node:path";
 function failproofaiHome2(home) {
   if (home)
     return resolve31(home, ".failproofai");
-  return process.env.FAILPROOFAI_HOME || resolve31(homedir30(), ".failproofai");
+  return process.env.FAILPROOFAI_HOME || resolve31(homedir31(), ".failproofai");
 }
 function resettablePaths2() {
   return [
@@ -32119,10 +32444,10 @@ import {
   mkdirSync as mkdirSync27,
   readFileSync as readFileSync36,
   renameSync as renameSync9,
-  rmSync as rmSync15,
+  rmSync as rmSync16,
   writeFileSync as writeFileSync25
 } from "node:fs";
-import { basename as basename7, dirname as dirname23, join as join36, resolve as resolve32 } from "node:path";
+import { basename as basename8, dirname as dirname24, join as join38, resolve as resolve32 } from "node:path";
 function migrateToLayout42() {
   const moves = [
     { from: legacy.authJson(), to: auditSessionFile() },
@@ -32131,9 +32456,9 @@ function migrateToLayout42() {
   ];
   const authDirOverride = process.env.FAILPROOFAI_AUTH_DIR;
   if (authDirOverride) {
-    moves.push({ from: join36(authDirOverride, "auth.json"), to: join36(authDirOverride, "session.json") }, {
-      from: join36(authDirOverride, "next-audit.json"),
-      to: join36(authDirOverride, "reminder.json")
+    moves.push({ from: join38(authDirOverride, "auth.json"), to: join38(authDirOverride, "session.json") }, {
+      from: join38(authDirOverride, "next-audit.json"),
+      to: join38(authDirOverride, "reminder.json")
     });
   }
   const migrated = [];
@@ -32141,10 +32466,10 @@ function migrateToLayout42() {
     if (!existsSync43(from))
       continue;
     if (existsSync43(to)) {
-      rmSync15(from, { force: true });
+      rmSync16(from, { force: true });
       continue;
     }
-    mkdirSync27(dirname23(to), { recursive: true });
+    mkdirSync27(dirname24(to), { recursive: true });
     try {
       renameSync9(from, to);
     } catch {
@@ -32152,13 +32477,13 @@ function migrateToLayout42() {
         copyFileSync5(from, to);
       } catch (err) {
         try {
-          rmSync15(to, { force: true });
+          rmSync16(to, { force: true });
         } catch {}
         throw err;
       }
-      rmSync15(from, { force: true });
+      rmSync16(from, { force: true });
     }
-    migrated.push(`${basename7(from)} → audit/${basename7(to)}`);
+    migrated.push(`${basename8(from)} → audit/${basename8(to)}`);
   }
   for (const secret of [auditSessionFile()]) {
     if (!existsSync43(secret))
@@ -32222,7 +32547,7 @@ function appendLedger2(entry) {
   } catch {}
 }
 function backupNameOf2(f) {
-  return f.as ?? basename7(f.at());
+  return f.as ?? basename8(f.at());
 }
 function pruneMigratedCredentials2(from) {
   const pruned = [];
@@ -32234,7 +32559,7 @@ function pruneMigratedCredentials2(from) {
         const copy = resolve32(migrationBackupDir(layout), as);
         if (!existsSync43(copy))
           continue;
-        rmSync15(copy, { force: true });
+        rmSync16(copy, { force: true });
         pruned.push(as);
       } catch {}
     }
@@ -32254,7 +32579,7 @@ function backupBeforeMigrating2(from) {
   const dir = migrationBackupDir(from);
   const saved = [];
   try {
-    rmSync15(dir, { recursive: true, force: true });
+    rmSync16(dir, { recursive: true, force: true });
     mkdirSync27(dir, { recursive: true });
   } catch {
     return [];
@@ -32360,7 +32685,7 @@ function restoreBackup2(layout) {
     if (!existsSync43(source))
       continue;
     try {
-      mkdirSync27(dirname23(target), { recursive: true });
+      mkdirSync27(dirname24(target), { recursive: true });
       copyFileSync5(source, target);
       restored.push(backupNameOf2(f));
     } catch {}
@@ -32411,7 +32736,7 @@ var init_migrations2 = __esm(() => {
     { at: legacy.auditSchedule }
   ];
   PRUNED_AFTER_SUCCESS2 = [
-    { as: basename7(legacy.authJson()), landsAt: auditSessionFile }
+    { as: basename8(legacy.authJson()), landsAt: auditSessionFile }
   ];
 });
 
@@ -32450,15 +32775,15 @@ __export(exports_daemon_service, {
 import {
   existsSync as existsSync44,
   mkdirSync as mkdirSync28,
-  mkdtempSync as mkdtempSync2,
+  mkdtempSync as mkdtempSync3,
   readFileSync as readFileSync37,
   writeFileSync as writeFileSync26,
   unlinkSync as unlinkSync5,
-  rmSync as rmSync16
+  rmSync as rmSync17
 } from "node:fs";
-import { homedir as homedir31, tmpdir as tmpdir3, userInfo as userInfo2 } from "node:os";
+import { homedir as homedir32, tmpdir as tmpdir4, userInfo as userInfo2 } from "node:os";
 import { resolve as resolve33 } from "node:path";
-import { execFileSync as execFileSync6 } from "node:child_process";
+import { execFileSync as execFileSync4 } from "node:child_process";
 function setDaemonConfigured2(value, installedVersion) {
   try {
     updateConfig({ daemon: { configured: value } });
@@ -32570,7 +32895,7 @@ function systemdUnitPath2(user = serviceUser2()) {
   return resolve33(systemdUnitDir2(), systemdUnitName2(user));
 }
 function legacySystemdUserUnitPath2() {
-  return resolve33(homedir31(), ".config", "systemd", "user", "failproofaid.service");
+  return resolve33(homedir32(), ".config", "systemd", "user", "failproofaid.service");
 }
 function launchdLabel2(user = serviceUser2()) {
   return `ai.failproof.failproofaid.${user}`;
@@ -32579,7 +32904,7 @@ function launchdPlistPath2(user = serviceUser2()) {
   return `/Library/LaunchDaemons/${launchdLabel2(user)}.plist`;
 }
 function legacyLaunchAgentPlistPath2() {
-  return resolve33(homedir31(), "Library", "LaunchAgents", "ai.failproof.failproofaid.plist");
+  return resolve33(homedir32(), "Library", "LaunchAgents", "ai.failproof.failproofaid.plist");
 }
 function legacySharedLaunchDaemonPath2() {
   return "/Library/LaunchDaemons/ai.failproof.failproofaid.plist";
@@ -32605,7 +32930,7 @@ function primeElevation2() {
   if (canElevate2())
     return true;
   try {
-    execFileSync6("sudo", ["-v"], { stdio: "inherit", timeout: SUDO_PROMPT_TIMEOUT_MS2 });
+    execFileSync4("sudo", ["-v"], { stdio: "inherit", timeout: SUDO_PROMPT_TIMEOUT_MS2 });
     return canElevate2();
   } catch {
     return false;
@@ -32615,7 +32940,7 @@ function canElevate2() {
   if (typeof process.getuid === "function" && process.getuid() === 0)
     return true;
   try {
-    execFileSync6("sudo", ["-n", "true"], { stdio: "ignore", timeout: SERVICE_CMD_TIMEOUT_MS2 });
+    execFileSync4("sudo", ["-n", "true"], { stdio: "ignore", timeout: SERVICE_CMD_TIMEOUT_MS2 });
     return true;
   } catch {
     return false;
@@ -32624,16 +32949,16 @@ function canElevate2() {
 function runPrivileged2(command, args) {
   const root = typeof process.getuid === "function" && process.getuid() === 0;
   const [cmd, argv] = root ? [command, args] : ["sudo", ["-n", command, ...args]];
-  execFileSync6(cmd, argv, { stdio: "ignore", timeout: SERVICE_CMD_TIMEOUT_MS2 });
+  execFileSync4(cmd, argv, { stdio: "ignore", timeout: SERVICE_CMD_TIMEOUT_MS2 });
 }
 function writePrivilegedFile2(destination, contents, mode = "0644") {
-  const stagingDir = mkdtempSync2(resolve33(tmpdir3(), "failproofaid-stage-"));
+  const stagingDir = mkdtempSync3(resolve33(tmpdir4(), "failproofaid-stage-"));
   const staging = resolve33(stagingDir, "service-definition");
   try {
     writeFileSync26(staging, contents, "utf8");
     runPrivileged2("install", ["-m", mode, staging, destination]);
   } finally {
-    rmSync16(stagingDir, { recursive: true, force: true });
+    rmSync17(stagingDir, { recursive: true, force: true });
   }
 }
 function removeLegacyUserService2() {
@@ -32643,14 +32968,14 @@ function removeLegacyUserService2() {
       if (!existsSync44(legacy3))
         return;
       try {
-        execFileSync6("systemctl", ["--user", "disable", "--now", "failproofaid.service"], {
+        execFileSync4("systemctl", ["--user", "disable", "--now", "failproofaid.service"], {
           stdio: "ignore",
           timeout: SERVICE_CMD_TIMEOUT_MS2
         });
       } catch {}
       unlinkSync5(legacy3);
       try {
-        execFileSync6("systemctl", ["--user", "daemon-reload"], {
+        execFileSync4("systemctl", ["--user", "daemon-reload"], {
           stdio: "ignore",
           timeout: SERVICE_CMD_TIMEOUT_MS2
         });
@@ -32659,7 +32984,7 @@ function removeLegacyUserService2() {
       const legacyAgent = legacyLaunchAgentPlistPath2();
       if (existsSync44(legacyAgent)) {
         try {
-          execFileSync6("launchctl", ["unload", "-w", legacyAgent], {
+          execFileSync4("launchctl", ["unload", "-w", legacyAgent], {
             stdio: "ignore",
             timeout: SERVICE_CMD_TIMEOUT_MS2
           });
@@ -32683,7 +33008,7 @@ function systemdUnitContents2(binaryPath, workerCmd, cliCmd = null) {
 `).join("");
   const user = assertUnitSafe2(serviceUser2(), "User");
   assertUnitSafe2(binaryPath, "ExecStart");
-  assertUnitSafe2(homedir31(), "HOME");
+  assertUnitSafe2(homedir32(), "HOME");
   const conditionPaths = [binaryPath, workerScriptPath2()].filter((p) => typeof p === "string" && existsSync44(p));
   const conditionLines = conditionPaths.map((p) => `ConditionPathExists=${assertUnitSafe2(p, "ConditionPathExists")}
 `).join("");
@@ -32697,7 +33022,7 @@ User=${user}
 # Set explicitly rather than relying on systemd deriving it from User=:
 # failproofaid stores per-user state and refuses to start without HOME, so this
 # required variable is not left to a version-dependent default.
-Environment="HOME=${homedir31()}"
+Environment="HOME=${homedir32()}"
 ${envLines}ExecStart=${binaryPath}
 Restart=on-failure
 RestartSec=2
@@ -33077,7 +33402,7 @@ function daemonVersionSkew2() {
 }
 function inactiveLinuxStatus2() {
   try {
-    return interpretConditionResult2(execFileSync6("systemctl", ["show", systemdUnitName2(), "--property=ConditionResult", "--value"], { stdio: ["ignore", "pipe", "ignore"], timeout: SERVICE_CMD_TIMEOUT_MS2 }).toString());
+    return interpretConditionResult2(execFileSync4("systemctl", ["show", systemdUnitName2(), "--property=ConditionResult", "--value"], { stdio: ["ignore", "pipe", "ignore"], timeout: SERVICE_CMD_TIMEOUT_MS2 }).toString());
   } catch {
     return "stopped";
   }
@@ -33092,7 +33417,7 @@ function daemonServiceStatus2() {
     if (!existsSync44(systemdUnitPath2()))
       return "not-installed";
     try {
-      const out = execFileSync6("systemctl", ["is-active", systemdUnitName2()], {
+      const out = execFileSync4("systemctl", ["is-active", systemdUnitName2()], {
         stdio: ["ignore", "pipe", "ignore"],
         timeout: SERVICE_CMD_TIMEOUT_MS2
       }).toString().trim();
@@ -33109,10 +33434,10 @@ function daemonServiceStatus2() {
     if (!root && !canElevate2())
       return "unknown";
     const args = ["print", `system/${launchdLabel2()}`];
-    const out = root ? execFileSync6("launchctl", args, {
+    const out = root ? execFileSync4("launchctl", args, {
       stdio: ["ignore", "pipe", "ignore"],
       timeout: SERVICE_CMD_TIMEOUT_MS2
-    }).toString() : execFileSync6("sudo", ["-n", "launchctl", ...args], {
+    }).toString() : execFileSync4("sudo", ["-n", "launchctl", ...args], {
       stdio: ["ignore", "pipe", "ignore"],
       timeout: SERVICE_CMD_TIMEOUT_MS2
     }).toString();
@@ -33127,7 +33452,7 @@ function daemonStartedAtMs() {
   if (!existsSync44(systemdUnitPath2()))
     return null;
   try {
-    const raw = execFileSync6("systemctl", ["show", systemdUnitName2(), "-p", "ActiveEnterTimestampMonotonic", "--value"], { stdio: ["ignore", "pipe", "ignore"], timeout: SERVICE_CMD_TIMEOUT_MS2 }).toString().trim();
+    const raw = execFileSync4("systemctl", ["show", systemdUnitName2(), "-p", "ActiveEnterTimestampMonotonic", "--value"], { stdio: ["ignore", "pipe", "ignore"], timeout: SERVICE_CMD_TIMEOUT_MS2 }).toString().trim();
     return startedAtFromMonotonic(Number(raw), Math.floor(Number(process.hrtime.bigint()) / 1000), Date.now());
   } catch {
     return null;
@@ -33159,7 +33484,7 @@ __export(exports_uninstall_cli, {
   runUninstallCommand: () => runUninstallCommand,
   serviceStateLabel: () => serviceStateLabel
 });
-import { existsSync as existsSync45, rmSync as rmSync17 } from "node:fs";
+import { existsSync as existsSync45, rmSync as rmSync18 } from "node:fs";
 function survey(cwd) {
   const clis = [];
   for (const id of listInstallableIds()) {
@@ -33292,7 +33617,7 @@ async function runUninstallCommand(opts = {}) {
   }
   if (opts.purge && found.homeExists) {
     try {
-      rmSync17(failproofaiHome(), { recursive: true, force: true });
+      rmSync18(failproofaiHome(), { recursive: true, force: true });
       purged = true;
       lines.push(`✓ deleted ${failproofaiHome()}`);
     } catch (err) {
@@ -33364,8 +33689,8 @@ __export(exports_pack_store, {
   slugifyCategory: () => slugifyCategory2
 });
 import { createHash as createHash10 } from "node:crypto";
-import { existsSync as existsSync46, mkdirSync as mkdirSync29, readFileSync as readFileSync38, renameSync as renameSync10, rmSync as rmSync18, writeFileSync as writeFileSync27 } from "node:fs";
-import { dirname as dirname24, resolve as resolve34 } from "node:path";
+import { existsSync as existsSync46, mkdirSync as mkdirSync29, readFileSync as readFileSync38, renameSync as renameSync10, rmSync as rmSync19, writeFileSync as writeFileSync27 } from "node:fs";
+import { dirname as dirname25, resolve as resolve34 } from "node:path";
 function baseUrl3() {
   return (process.env.FAILPROOFAI_PACK_BASE_URL || DEFAULT_BASE_URL3).replace(/\/+$/, "");
 }
@@ -33485,11 +33810,11 @@ function sha2562(bytes) {
 function writeAtomic2(target, bytes) {
   const tempPath = `${target}.${process.pid}.tmp`;
   try {
-    mkdirSync29(dirname24(target), { recursive: true });
+    mkdirSync29(dirname25(target), { recursive: true });
     writeFileSync27(tempPath, bytes);
     renameSync10(tempPath, target);
   } catch (err) {
-    rmSync18(tempPath, { force: true });
+    rmSync19(tempPath, { force: true });
     throw err;
   }
 }
@@ -34226,12 +34551,13 @@ __export(exports_manager, {
   getSettingsPath: () => getSettingsPath2,
   hooksInstalledInSettings: () => hooksInstalledInSettings2,
   installHooks: () => installHooks2,
+  integrationsInstalledAt: () => integrationsInstalledAt2,
   listHooks: () => listHooks,
   removeHooks: () => removeHooks2
 });
 import { execSync as execSync7 } from "node:child_process";
 import { existsSync as existsSync47 } from "node:fs";
-import { resolve as resolve35, basename as basename8 } from "node:path";
+import { resolve as resolve35, basename as basename9 } from "node:path";
 import { platform as platform5, arch as arch4, release as release3, hostname as hostname6 } from "node:os";
 function getSettingsPath2(scope, cwd) {
   return claudeCode.getSettingsPath(scope, cwd);
@@ -34356,14 +34682,30 @@ function deduplicateScopes2(scopes, cwd) {
   });
 }
 function hooksInstalledInSettings2(scope, cwd) {
-  return INTEGRATION_TYPES.some((id) => {
+  return integrationsInstalledAt2(scope, cwd).length > 0;
+}
+function integrationsInstalledAt2(scope, cwd) {
+  return INTEGRATION_TYPES.filter((id) => {
     try {
-      return getIntegration(id).hooksInstalledInSettings(scope, cwd);
+      const integration = getIntegration(id);
+      if (!integration.scopes.includes(scope))
+        return false;
+      if (!integration.hooksInstalledInSettings(scope, cwd))
+        return false;
+      const here = integration.getSettingsPath(scope, cwd);
+      return !HOOK_SCOPES.some((other) => other !== scope && HOOK_SCOPES.indexOf(other) < HOOK_SCOPES.indexOf(scope) && integration.scopes.includes(other) && safeSettingsPath2(integration, other, cwd) === here);
     } catch {
       return false;
     }
   });
 }
+function safeSettingsPath2(integration, scope, cwd) {
+  try {
+    return integration.getSettingsPath(scope, cwd);
+  } catch {
+    return null;
+  }
+}
 async function installHooks2(policyNames, scope = "user", cwd, includeBeta = false, source, customPoliciesPath, removeCustomHooks = false, cli, options = {}) {
   const { replace = false, quiet = false } = options;
   if (!quiet) {
@@ -34829,7 +35171,7 @@ async function listHooks(cwd) {
     groups.push(note2(dir, opts));
     const rows3 = [];
     for (const file of files) {
-      const filename = basename8(file);
+      const filename = basename9(file);
       try {
         const hooks = await loadCustomHooks(file);
         record(filename, hooks.map((h) => h.name));
@@ -35680,7 +36022,7 @@ __export(exports_launch2, {
 });
 import { spawn as spawn3 } from "child_process";
 import { realpathSync as realpathSync5, existsSync as existsSync48 } from "node:fs";
-import { resolve as resolve36, dirname as dirname25 } from "node:path";
+import { resolve as resolve36, dirname as dirname26 } from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 import { createInterface as createInterface2 } from "node:readline";
 function launch2(mode) {
@@ -35704,7 +36046,7 @@ function launch2(mode) {
     process.env.PORT = port;
     process.env.HOSTNAME = bindHost;
     cmd = "node";
-    const packageRoot = process.env.FAILPROOFAI_PACKAGE_ROOT ?? resolve36(dirname25(realpathSync5(fileURLToPath3(import.meta.url))), "..");
+    const packageRoot = process.env.FAILPROOFAI_PACKAGE_ROOT ?? resolve36(dirname26(realpathSync5(fileURLToPath3(import.meta.url))), "..");
     const serverJsPath = resolve36(packageRoot, ".next/standalone/server.js");
     if (!existsSync48(serverJsPath)) {
       let shadowMessage = null;
@@ -35803,17 +36145,17 @@ var init_cli_error2 = __esm(() => {
 
 // bin/failproofai.mjs
 import { realpathSync as realpathSync6 } from "fs";
-import { dirname as dirname26, resolve as resolve37 } from "path";
+import { dirname as dirname27, resolve as resolve37 } from "path";
 import { fileURLToPath as fileURLToPath4 } from "url";
 // package.json
-var version = "1.0.2-beta.4";
+var version = "1.0.2-beta.5";
 
 // bin/failproofai.mjs
 if (!process.env.FAILPROOFAI_PACKAGE_ROOT) {
-  process.env.FAILPROOFAI_PACKAGE_ROOT = resolve37(dirname26(realpathSync6(fileURLToPath4(import.meta.url))), "..");
+  process.env.FAILPROOFAI_PACKAGE_ROOT = resolve37(dirname27(realpathSync6(fileURLToPath4(import.meta.url))), "..");
 }
 if (!process.env.FAILPROOFAI_DIST_PATH) {
-  process.env.FAILPROOFAI_DIST_PATH = resolve37(dirname26(realpathSync6(fileURLToPath4(import.meta.url))), "..", "dist");
+  process.env.FAILPROOFAI_DIST_PATH = resolve37(dirname27(realpathSync6(fileURLToPath4(import.meta.url))), "..", "dist");
 }
 var args = process.argv.slice(2);
 if (args[0] === "p" || args[0] === "policy")
@@ -36621,7 +36963,7 @@ Run \`failproofai uninstall --help\` for usage.`);
   }
   if (args[0] === "publish") {
     const subArgs = args.slice(1);
-    if (subArgs.includes("--help") || subArgs.includes("-h") || subArgs.length === 0) {
+    if (subArgs.includes("--help") || subArgs.includes("-h")) {
       console.log(`
 failproofai publish \u2014 ship your policies as a pack anyone can install
 
@@ -36630,8 +36972,13 @@ TWO COMMANDS, FROM NOTHING
   failproofai publish --init      write a policy to start from
   failproofai publish             ship it
 
-  Everything else is optional. Every flag below overrides something that is
-  otherwise worked out for you.
+  Write your policies in a git repo, run publish, answer one question, done.
+  It asks WHERE only when nothing tells it \u2014 no remote to read \u2014 and works
+  the rest out: which files hold policies, what version is next, who you are.
+
+  Every flag below overrides something it would otherwise decide for you.
+  None of them is required, and on a pipe or in CI the flags are all there
+  is: nothing prompts where nobody can answer.
 
 WHAT --init DOES
   Asks what the pack is called, writes <name>.mjs, and stops. No network, no
@@ -36690,11 +37037,16 @@ THE REPO MUST BE PUBLIC
   Only the release matters. Installs read releases/download/<tag>/<asset> and
   never touch your git tree \u2014 pushing the source is for humans reading it.
 
-YOUR ENTRY FILE
-  One file, no relative imports: only the entry is digest-pinned, so a pack
-  importing siblings could not honestly claim to be verified. Bundle first
-  (esbuild, bun build, rollup) if yours is split. Each policy may carry
-  category and defaultEnabled alongside the usual fields.
+YOUR POLICY FILES
+  Write as many as you like \u2014 one per category reads well. Every file here
+  that registers policies is found and bundled into the single artifact a
+  pack has to be, because only the entry is digest-pinned and a pack
+  importing siblings could not honestly claim to be verified. Bundling needs
+  bun; without it, name one self-contained file.
+
+  Each policy may carry category and defaultEnabled alongside the usual
+  fields. category is what --category selects on; defaultEnabled is what a
+  bare 'policies add' switches on, and it defaults to false.
 
 OPTIONS
   --init [file]           Write a starter policy and stop.
@@ -36741,7 +37093,7 @@ USAGE
   failproofai policies add                 Pick from what is installed here
   failproofai policies add <name>          Turn one policy on
   failproofai policies add <owner>/<repo>  Install someone's pack
-  failproofai policies add core            Our pack, from this package, offline
+  failproofai policies add core            Our pack, fetched like any other
   failproofai policies remove <name>       Turn one policy off
   failproofai policies remove <pack-id>    Uninstall a pack
   failproofai policies show <owner>/<repo> What a pack contains, before you take it