failproofai 1.0.4-beta.1 → 1.0.4-beta.2

package/.next/standalone/fp-cloud-cli/uv.lock

@@ -208,14 +208,11 @@ wheels = [
 
 [[package]]
 name = "click"
-version = "8.4.2"
+version = "8.5.0"
 source = { registry = "https://pypi.org/simple" }
-dependencies = [
-    { name = "colorama", marker = "sys_platform == 'win32'" },
-]
-sdist = { url = "https://files.pythonhosted.org/packages/76/d4/81420972a676e8ffea40450d8c8c92943e7218a78fe9b64359836cc9876b/click-8.4.2.tar.gz", hash = "sha256:9a6cea6e60b17ebe0a44c5cc636d94f09bd66142c1cd7d8b4cd731c4917a15f6", size = 338000, upload-time = "2026-06-24T17:45:15.148Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/c7/0e/7fa0ef50764b67090eca4114772a2abf8b6148198475e54c660b97caeee6/click-8.5.0.tar.gz", hash = "sha256:ba0d2089de75ea0310e2dde03160e6ca10009947fb95a182f9b54021bb272e34", size = 382235, upload-time = "2026-08-26T13:33:14.56Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/fb/e2/79c688af8b210d232694e31e59da9f6ec747bae31c3f5946e4e9b98860d5/click-8.4.2-py3-none-any.whl", hash = "sha256:e6f9f66136c816745b9d65817da91d61d957fb16e02e4dcd0552553c5a197b76", size = 119243, upload-time = "2026-06-24T17:45:13.73Z" },
+    { url = "https://files.pythonhosted.org/packages/58/50/6c0d534c5f134586a8e1ba4e330569e32f057e33372ae556463212fb4cd3/click-8.5.0-py3-none-any.whl", hash = "sha256:255bc9599cf7748b4b1a446ccc735421bd08a2ae529a8b88597d3de5664ee360", size = 125251, upload-time = "2026-08-26T13:33:12.928Z" },
 ]
 
 [[package]]
@@ -375,7 +372,7 @@ wheels = [
 
 [[package]]
 name = "posthog"
-version = "7.42.0"
+version = "7.47.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "backoff" },
@@ -383,9 +380,9 @@ dependencies = [
     { name = "requests" },
     { name = "typing-extensions" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/79/97/32cc0a72d7896cc2d27d442c75c9d24cc77d0140be9f5e98df7f4ce98f6a/posthog-7.42.0.tar.gz", hash = "sha256:c7e9297446208d413c3071348f101f4c05e32fba4228ac0a85e9d0014c2a274e", size = 469662, upload-time = "2026-08-21T12:57:15.05Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/e4/1b/61eccf2257847def7d01ccae29f9680156cb1cd2b4f00d3e9afaabe236fa/posthog-7.47.0.tar.gz", hash = "sha256:62767af8b0808cb103da37aa3974e728467fed9527e4f201f23e718740debd30", size = 508993, upload-time = "2026-09-04T16:52:31.715Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/31/f0/46e28b947a19c992ad7289931d3197358cfdf4980b33317b5e7cf9c24abe/posthog-7.42.0-py3-none-any.whl", hash = "sha256:6429c9a4145572a8f54ab00330bbfe987340025d3a464212505be814b2b0950d", size = 559119, upload-time = "2026-08-21T12:57:13.299Z" },
+    { url = "https://files.pythonhosted.org/packages/a6/28/16b9b229b9c2380211249377df5bbb4c33cb8b224b7b27ecd46c89bcedac/posthog-7.47.0-py3-none-any.whl", hash = "sha256:c87daf7830eb5ef779d0ff1ec25b5de6d316926d6bbbcde74b80e055172a0ddc", size = 601509, upload-time = "2026-09-04T16:52:29.935Z" },
 ]
 
 [[package]]
@@ -520,7 +517,7 @@ wheels = [
 
 [[package]]
 name = "typer"
-version = "0.27.1"
+version = "0.27.2"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "annotated-doc" },
@@ -528,9 +525,9 @@ dependencies = [
     { name = "rich" },
     { name = "shellingham" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/ae/40/4a3db7990d1f62a53182aa96eaef57aeb2886a27f90a195bc66713565d31/typer-0.27.1.tar.gz", hash = "sha256:a79bef8469a79c45498e7b814ecf8d603cc7644e9acbd9e19cac0334240b18df", size = 203994, upload-time = "2026-08-03T14:41:03.438Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/16/f7/57713ba479fd405eb76de31404b2c744c289e336b2d999511ebf51e496f7/typer-0.27.2.tar.gz", hash = "sha256:269b7eb9d3c202ca84b4bc9618cb04ebb43d3d4d1e567e4c768607232c05f945", size = 204045, upload-time = "2026-08-28T10:26:55.046Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/43/89/9518bc0c3929bee36b3a4a8e3daddd6e03f92f9961c66d4983b837160543/typer-0.27.1-py3-none-any.whl", hash = "sha256:53150287edd11baeb4e4722c8e394fcdf8181c0ae89485cba8d25c778d5edd56", size = 122874, upload-time = "2026-08-03T14:41:04.391Z" },
+    { url = "https://files.pythonhosted.org/packages/dc/bf/205d0004930ede8f542fb58f601526fccf4ae7626075ca1e6c4de5d3d652/typer-0.27.2-py3-none-any.whl", hash = "sha256:b3a5fc4342d5fc8fda8fc3010b1cf117e9249aab7fae800c2eff62fd3842d97d", size = 123130, upload-time = "2026-08-28T10:26:53.752Z" },
 ]
 
 [[package]]

package/.next/standalone/lib/auth/api-server-client.ts

@@ -253,6 +253,34 @@ export interface AuditReportBody {
     last_seen?: string;
     examples: string[];
   }[];
+  /**
+   * Credentials this machine found in its own transcripts.
+   *
+   * Optional on the wire, so a CLI newer than the api-server sends a field the
+   * server ignores rather than failing the whole digest — the harmful counts
+   * are the older half of the contract and must keep arriving either way.
+   *
+   * Every field here is a mask, a label, a length or a location. There is no
+   * shape of this object that carries a secret, because the record it is built
+   * from never stores one: `recordLeaks` fingerprints at detection time and
+   * keeps only the masked rendering.
+   */
+  leaks?: {
+    id: string;
+    display: string;
+    label: string;
+    length: number;
+    attributed: boolean;
+    name: string | null;
+    confidence: string;
+    first_seen: string;
+    last_seen: string;
+    occurrences: number;
+    cli: string;
+    project: string;
+    mechanism: string;
+    direction: "input" | "result";
+  }[];
 }
 
 export interface AuditReportResult {

package/.next/standalone/lib/claude-sessions.ts

@@ -4,8 +4,14 @@
  * Claude stores transcripts at:
  *   <CLAUDE_PROJECTS_PATH>/<encoded-cwd>/<sessionId>.jsonl
  *
- * Subagent transcripts (when a session spawned subagents) live alongside:
+ * Subagent transcripts (when a session spawned subagents) live alongside, in two
+ * shapes — a direct child, and one nested per workflow run:
  *   <CLAUDE_PROJECTS_PATH>/<encoded-cwd>/<sessionId>/subagents/<agentId>.jsonl
+ *   <CLAUDE_PROJECTS_PATH>/<encoded-cwd>/<sessionId>/subagents/workflows/<runId>/<agentId>.jsonl
+ *
+ * Everything below `subagents/` is walked to a bounded depth rather than one
+ * level, because the second shape arrived after this module was written and the
+ * miss was most of the corpus. See `collectSubagentTranscripts`.
  *
  * The parser for these files lives in `lib/log-entries.ts` (`parseLogContent`,
  * `parseSessionLog`). This module exposes discovery only — the audit pipeline
@@ -70,6 +76,99 @@ export function listClaudeProjects(): ClaudeProjectFolder[] {
 /** Lists every JSONL transcript under one Claude project folder, including
  *  subagent transcripts under `<sessionId>/subagents/`. Returns [] on missing
  *  or unreadable paths. */
+/**
+ * Depth of nesting allowed below `subagents/`.
+ *
+ * The two shapes that exist today need 0 and 2 (`<agent>.jsonl` and
+ * `workflows/<runId>/<agent>.jsonl`). The cap is here so an unexpected layout —
+ * or a symlink cycle a future Claude build introduces — costs a bounded walk
+ * rather than an audit that never returns, and it is deliberately loose enough
+ * that a third shape lands inside it without another release.
+ */
+const MAX_SUBAGENT_DEPTH = 5;
+
+/**
+ * Collect every `.jsonl` beneath a session's `subagents/` directory.
+ *
+ * This used to read only the DIRECT children of `subagents/`, which was correct
+ * for the layout Claude shipped when it was written and silently wrong the day
+ * workflow runs started nesting their agents one level further down. On a
+ * machine that uses them the miss is most of the corpus: 1,839 transcripts on
+ * disk, 1,741 under `subagents/`, and 1,679 of those inside
+ * `subagents/workflows/<runId>/` — so the audit was walking 160 files, 8.7% of
+ * the evidence, and reporting the result as though it had read everything.
+ *
+ * ## Session ids come from the relative path, not the basename
+ *
+ * Every workflow run writes a `journal.jsonl` beside its agents, so basenames
+ * are NOT unique below this directory — 1,741 files share 1,613 distinct names
+ * on the machine this was found on. A basename id would collide those 128 files
+ * onto ~one row each, and `sessionId` is what the cache, the per-session
+ * detector state and the example attribution are keyed by, so the collision
+ * would silently merge unrelated sessions rather than fail.
+ *
+ * Nor is the path below `subagents/` unique on its own. A workflow run id is
+ * reused when its session is resumed, so `wf_3d609e92-a38/journal.jsonl` exists
+ * under two different parent sessions in the same project — found by asserting
+ * uniqueness over the real corpus, not by reasoning about it.
+ *
+ * The id is therefore the PARENT SESSION id followed by the path relative to
+ * `subagents/`, minus the extension, joined with `__`:
+ * `<parentUuid>__workflows__wf_123__agent-abc`. That is a filesystem path
+ * within the project, so it is unique by construction rather than by argument,
+ * and it names the session the subagent belongs to. `__` is safe as the joiner
+ * because no id Claude generates contains one — verified against 1,741 real
+ * files, zero hits. Top-level session ids are untouched.
+ *
+ * Symlinks are not followed. Nothing in the layout uses them, and following one
+ * is how a directory walk turns into an infinite loop.
+ */
+function collectSubagentTranscripts(
+  dir: string,
+  relPrefix: string,
+  project: ClaudeProjectFolder,
+  out: ClaudeTranscriptFile[],
+  depth: number,
+): void {
+  if (depth > MAX_SUBAGENT_DEPTH) return;
+  let entries: import("node:fs").Dirent[];
+  try {
+    entries = readdirSync(dir, { withFileTypes: true });
+  } catch {
+    return;
+  }
+  for (const entry of entries) {
+    if (entry.isSymbolicLink()) continue;
+    if (entry.isDirectory()) {
+      collectSubagentTranscripts(
+        join(dir, entry.name),
+        relPrefix ? `${relPrefix}__${entry.name}` : entry.name,
+        project,
+        out,
+        depth + 1,
+      );
+      continue;
+    }
+    if (!entry.isFile() || !entry.name.endsWith(".jsonl")) continue;
+    const stem = entry.name.slice(0, -".jsonl".length);
+    const transcriptPath = join(dir, entry.name);
+    try {
+      const s = statSync(transcriptPath);
+      out.push({
+        projectName: project.name,
+        cwd: project.cwd,
+        sessionId: relPrefix ? `${relPrefix}__${stem}` : stem,
+        transcriptPath,
+        mtimeMs: s.mtimeMs,
+        sizeBytes: s.size,
+        isSubagent: true,
+      });
+    } catch {
+      // unreadable — skip
+    }
+  }
+}
+
 export function listClaudeTranscripts(project: ClaudeProjectFolder): ClaudeTranscriptFile[] {
   const out: ClaudeTranscriptFile[] = [];
   let entries: import("node:fs").Dirent[];
@@ -99,34 +198,9 @@ export function listClaudeTranscripts(project: ClaudeProjectFolder): ClaudeTrans
         // unreadable — skip
       }
     } else if (entry.isDirectory() && UUID_RE.test(entry.name)) {
-      // Subagent transcripts at <sessionId>/subagents/<agentId>.jsonl
       const subDir = join(project.path, entry.name, "subagents");
       if (!existsSync(subDir)) continue;
-      let subEntries: import("node:fs").Dirent[];
-      try {
-        subEntries = readdirSync(subDir, { withFileTypes: true });
-      } catch {
-        continue;
-      }
-      for (const sub of subEntries) {
-        if (!sub.isFile() || !sub.name.endsWith(".jsonl")) continue;
-        const agentId = sub.name.slice(0, -".jsonl".length);
-        const transcriptPath = join(subDir, sub.name);
-        try {
-          const s = statSync(transcriptPath);
-          out.push({
-            projectName: project.name,
-            cwd: project.cwd,
-            sessionId: agentId,
-            transcriptPath,
-            mtimeMs: s.mtimeMs,
-            sizeBytes: s.size,
-            isSubagent: true,
-          });
-        } catch {
-          // unreadable — skip
-        }
-      }
+      collectSubagentTranscripts(subDir, entry.name, project, out, 0);
     }
   }
 

package/.next/standalone/lib/cli-registry.ts

@@ -27,7 +27,7 @@
 import type { IntegrationType } from "@/src/hooks/types";
 
 /** Canonical CLI ids the registry knows about. Mirrors `INTEGRATION_TYPES`. */
-export const KNOWN_CLI_IDS = ["claude", "codex", "copilot", "cursor", "opencode", "pi", "hermes", "openclaw", "factory", "devin", "antigravity", "goose", "grok", "qwen", "ori", "cline"] as const satisfies readonly IntegrationType[];
+export const KNOWN_CLI_IDS = ["claude", "codex", "copilot", "cursor", "opencode", "pi", "hermes", "openclaw", "factory", "devin", "antigravity", "goose"] as const satisfies readonly IntegrationType[];
 export type CliId = (typeof KNOWN_CLI_IDS)[number];
 
 /** Per-CLI metadata consumed by the dashboard. */
@@ -99,38 +99,6 @@ const CLI_ENTRIES: Record<CliId, CliEntry> = {
     label: "Goose",
     badgeClasses: "bg-lime-500/10 text-lime-400 border-lime-500/20",
   },
-  grok: {
-    id: "grok",
-    label: "grok CLI",
-    // Neutral zinc, matching the design system's `--color-default`. Deliberately
-    // NOT a status hue: green/amber/red carry health meaning in this dashboard
-    // and must never be spent on identity. Neutral also happens to suit xAI's
-    // monochrome brand, and it is maximally far from qwen's magenta — the two
-    // were previously indistinguishable.
-    badgeClasses: "bg-zinc-500/10 text-zinc-200 border-zinc-500/20",
-  },
-  qwen: {
-    id: "qwen",
-    label: "Qwen Code",
-    // Magenta — the opposite pole from grok's neutral, and outside the
-    // status set (success/amber/orange/error) so it reads as identity.
-    badgeClasses: "bg-fuchsia-500/10 text-fuchsia-400 border-fuchsia-500/20",
-  },
-  ori: {
-    id: "ori",
-    label: "Ori",
-    // Sky — the badge set must be UNIQUE per CLI (a test asserts it), and
-    // violet/teal were already taken. Still outside the status set
-    // (success/amber/orange/error) so it reads as identity, not state.
-    badgeClasses: "bg-sky-500/10 text-sky-400 border-sky-500/20",
-  },
-  cline: {
-    id: "cline",
-    label: "Cline",
-    // Stone — the remaining neutral that is not zinc (grok's) and not a status
-    // colour.
-    badgeClasses: "bg-stone-500/10 text-stone-300 border-stone-500/20",
-  },
 };
 
 export function getCliEntry(id: string): CliEntry | undefined {

package/.next/standalone/lib/download-session.ts

@@ -125,21 +125,6 @@ export async function resolveDownloadSource(
     return path ? { kind: "file", path } : null;
   }
 
-  if (cli === "grok") {
-    // grok writes a real chat_history.jsonl per session directory — stream it
-    // verbatim (no synthesis, like Factory).
-    const { findGrokTranscript } = await import("./grok-sessions");
-    const path = findGrokTranscript(sessionId);
-    return path ? { kind: "file", path } : null;
-  }
-
-  if (cli === "qwen") {
-    // qwen writes a real JSONL transcript per session — stream it verbatim.
-    const { findQwenTranscript } = await import("./qwen-sessions");
-    const path = findQwenTranscript(sessionId);
-    return path ? { kind: "file", path } : null;
-  }
-
   if (cli === "devin") {
     // Devin keeps sessions in SQLite (~/.local/share/devin/cli/sessions.db).
     // Synthesize a JSONL export of the session's raw chat_message rows.
@@ -167,28 +152,6 @@ export async function resolveDownloadSource(
     return { kind: "synthesized", body, contentType: "application/x-ndjson", extension: "jsonl" };
   }
 
-  if (cli === "ori") {
-    // Ori keeps the whole conversation in one SQLite column
-    // (ori_agent_loop_history.prompt). Synthesize a JSONL export from the
-    // parsed entries — there is no per-session file to stream.
-    const { getOriSessionLog } = await import("./ori-sessions");
-    const result = await getOriSessionLog(sessionId);
-    if (!result) return null;
-    const body = result.entries.map((e) => JSON.stringify(e)).join("\n") + "\n";
-    return { kind: "synthesized", body, contentType: "application/x-ndjson", extension: "jsonl" };
-  }
-
-  if (cli === "cline") {
-    // Cline stores a real per-session messages file, but it is a single JSON
-    // document rather than JSONL, so stream the parsed entries as JSONL for
-    // consistency with every other synthesized export.
-    const { getClineSessionLog } = await import("./cline-sessions");
-    const result = await getClineSessionLog(sessionId);
-    if (!result) return null;
-    const body = result.entries.map((e) => JSON.stringify(e)).join("\n") + "\n";
-    return { kind: "synthesized", body, contentType: "application/x-ndjson", extension: "jsonl" };
-  }
-
   // Exhaustive — but TypeScript can't always see CliId is exhausted across the
   // if-chain above, so guard with a runtime fallback.
   const _exhaustive: never = cli;

package/.next/standalone/lib/projects.ts

@@ -16,7 +16,7 @@ import { formatDate } from "./format-date";
 export const UUID_RE = /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/;
 export const PATH_TRAVERSAL_RE = /(^|[\\/])\.\.($|[\\/])/;
 
-export type ProjectCli = "claude" | "codex" | "copilot" | "cursor" | "opencode" | "pi" | "hermes" | "openclaw" | "factory" | "devin" | "antigravity" | "goose" | "grok" | "qwen" | "ori" | "cline";
+export type ProjectCli = "claude" | "codex" | "copilot" | "cursor" | "opencode" | "pi" | "hermes" | "openclaw" | "factory" | "devin" | "antigravity" | "goose";
 
 export interface ProjectFolder {
   name: string;
@@ -171,10 +171,6 @@ export async function getProjectFolders(): Promise<ProjectFolder[]> {
     { getDevinProjects },
     { getAntigravityProjects },
     { getGooseProjects },
-    { getGrokProjects },
-    { getQwenProjects },
-    { getOriProjects },
-    { getClineProjects },
   ] = await Promise.all([
     import("./codex-projects"),
     import("./copilot-projects"),
@@ -187,12 +183,8 @@ export async function getProjectFolders(): Promise<ProjectFolder[]> {
     import("./devin-projects"),
     import("./antigravity-projects"),
     import("./goose-projects"),
-    import("./grok-projects"),
-    import("./qwen-projects"),
-    import("./ori-projects"),
-    import("./cline-projects"),
   ]);
-  const [claude, codex, copilot, cursor, opencode, pi, hermes, openclaw, factory, devin, antigravity, goose, grok, qwen, ori, cline] = await Promise.all([
+  const [claude, codex, copilot, cursor, opencode, pi, hermes, openclaw, factory, devin, antigravity, goose] = await Promise.all([
     getClaudeProjectFolders(),
     getCodexProjects().catch((error) => {
       logError("Error reading Codex projects:", error);
@@ -238,24 +230,8 @@ export async function getProjectFolders(): Promise<ProjectFolder[]> {
       logError("Error reading Goose projects:", error);
       return [] as ProjectFolder[];
     }),
-    getGrokProjects().catch((error) => {
-      logError("Error reading grok projects:", error);
-      return [] as ProjectFolder[];
-    }),
-    getQwenProjects().catch((error) => {
-      logError("Error reading Qwen projects:", error);
-      return [] as ProjectFolder[];
-    }),
-    getOriProjects().catch((error) => {
-      logError("Error reading Ori projects:", error);
-      return [] as ProjectFolder[];
-    }),
-    getClineProjects().catch((error) => {
-      logError("Error reading Cline projects:", error);
-      return [] as ProjectFolder[];
-    }),
   ]);
-  return mergeProjectFolders(claude, codex, copilot, cursor, opencode, pi, hermes, openclaw, factory, devin, antigravity, goose, grok, qwen, ori, cline);
+  return mergeProjectFolders(claude, codex, copilot, cursor, opencode, pi, hermes, openclaw, factory, devin, antigravity, goose);
 }
 
 /**

package/.next/standalone/node_modules/@next/env/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@next/env",
-  "version": "16.3.3",
+  "version": "16.3.4",
   "keywords": [
     "react",
     "next",

package/.next/standalone/node_modules/next/dist/build/swc/index.js

@@ -139,7 +139,7 @@ var HmrTarget = /*#__PURE__*/ function(HmrTarget) {
     HmrTarget["Server"] = "server";
     return HmrTarget;
 }({});
-const nextVersion = "16.3.3";
+const nextVersion = "16.3.4";
 const ArchName = (0, _os.arch)();
 const PlatformName = (0, _os.platform)();
 function infoLog(...args) {