failproofai 1.0.4-beta.4 → 1.0.4-beta.6

package/dist/worker.mjs

@@ -378,7 +378,7 @@ function failproofaiHome(home) {
     return resolve(home, ".failproofai");
   return process.env.FAILPROOFAI_HOME || resolve(homedir(), ".failproofai");
 }
-var LAYOUT_VERSION = 4, at = (...parts) => resolve(failproofaiHome(), ...parts), atHome = (home, ...parts) => home ? resolve(failproofaiHome(home), ...parts) : at(...parts), versionFile = (home) => atHome(home, "VERSION"), configFile = (home) => atHome(home, "config.json"), policiesDir = (home) => atHome(home, "policies"), customPoliciesDir, globalPolicyConfigFile = (home) => atHome(home, "policies-config.json"), cloudPoliciesDir = (home) => resolve(policiesDir(home), "cloud-policies"), packsDir = (home) => resolve(policiesDir(home), "packs"), packsInstalledFile = (home) => resolve(packsDir(home), "installed.json"), auditDir = (home) => atHome(home, "audit"), auditLeaksFile = (home) => resolve(auditDir(home), "leaks.json"), auditLeakIdentityFile = (home) => resolve(auditDir(home), "leak-identity.json"), hookActivityDir = (home) => atHome(home, "hook-activity"), stateDir = (home) => atHome(home, "state"), shimsDir = (home) => resolve(stateDir(home), "shims"), sessionPauseDir = () => resolve(stateDir(), "sessions"), telemetryIdFile = (home) => resolve(stateDir(home), "telemetry-id"), codexSessionPathsFile = (home) => resolve(stateDir(home), "codex-session-paths.json"), logsDir = (home) => atHome(home, "logs"), legacy;
+var LAYOUT_VERSION = 4, at = (...parts) => resolve(failproofaiHome(), ...parts), atHome = (home, ...parts) => home ? resolve(failproofaiHome(home), ...parts) : at(...parts), versionFile = (home) => atHome(home, "VERSION"), configFile = (home) => atHome(home, "config.json"), policiesDir = (home) => atHome(home, "policies"), customPoliciesDir, globalPolicyConfigFile = (home) => atHome(home, "policies-config.json"), cloudPoliciesDir = (home) => resolve(policiesDir(home), "cloud-policies"), packsDir = (home) => resolve(policiesDir(home), "packs"), packsInstalledFile = (home) => resolve(packsDir(home), "installed.json"), hookActivityDir = (home) => atHome(home, "hook-activity"), stateDir = (home) => atHome(home, "state"), shimsDir = (home) => resolve(stateDir(home), "shims"), sessionPauseDir = () => resolve(stateDir(), "sessions"), telemetryIdFile = (home) => resolve(stateDir(home), "telemetry-id"), codexSessionPathsFile = (home) => resolve(stateDir(home), "codex-session-paths.json"), logsDir = (home) => atHome(home, "logs"), legacy;
 var init_fp_home = __esm(() => {
   customPoliciesDir = policiesDir;
   legacy = {
@@ -3507,7 +3507,7 @@ function parsePackPolicyName(canonicalName) {
 }
 
 // package.json
-var version = "1.0.4-beta.4";
+var version = "1.0.4-beta.6";
 var init_package = () => {};
 
 // src/posthog-key.ts
@@ -5211,260 +5211,6 @@ var init_delivery_health = __esm(() => {
   CREDENTIAL_STATUSES = new Set([401, 403]);
 });
 
-// src/hooks/notice.ts
-function shapeNotice(cli, notice, existingStdout = "") {
-  const empty = { stdout: existingStdout, stderr: "" };
-  if (!notice.trim() || !cli)
-    return empty;
-  const channel = NOTICE_CHANNEL[cli] ?? "none";
-  const text = notice.length > MAX_NOTICE_CHARS ? notice.slice(0, MAX_NOTICE_CHARS - 1) + "…" : notice;
-  switch (channel) {
-    case "systemMessage": {
-      if (existingStdout.trim().startsWith("{")) {
-        try {
-          const parsed = JSON.parse(existingStdout);
-          parsed.systemMessage = text;
-          return { stdout: JSON.stringify(parsed), stderr: "" };
-        } catch {
-          return empty;
-        }
-      }
-      if (existingStdout.trim())
-        return empty;
-      return { stdout: JSON.stringify({ systemMessage: text }), stderr: "" };
-    }
-    case "stderr":
-      return { stdout: existingStdout, stderr: text + `
-` };
-    case "stdout":
-      if (existingStdout.trim())
-        return empty;
-      return { stdout: text + `
-`, stderr: "" };
-    case "shim": {
-      if (existingStdout.trim().startsWith("{")) {
-        try {
-          const parsed = JSON.parse(existingStdout);
-          parsed.failproofaiNotice = text;
-          return { stdout: JSON.stringify(parsed), stderr: "" };
-        } catch {
-          return empty;
-        }
-      }
-      if (existingStdout.trim())
-        return empty;
-      return { stdout: JSON.stringify({ failproofaiNotice: text }), stderr: "" };
-    }
-    default:
-      return empty;
-  }
-}
-function canDeliverNotice(cli) {
-  return !!cli && (NOTICE_CHANNEL[cli] ?? "none") !== "none";
-}
-function leakNoticeText(newFindings) {
-  const n = newFindings === 1 ? "a possible credential exposure" : `${newFindings} possible credential exposures`;
-  return `failproofai found ${n} in this project's agent transcripts.
-` + "Run `failproofai audit` to review the matches and rotate anything real.";
-}
-var NOTICE_CHANNEL, MAX_NOTICE_CHARS = 900;
-var init_notice = __esm(() => {
-  NOTICE_CHANNEL = {
-    claude: "systemMessage",
-    codex: "systemMessage",
-    copilot: "stderr",
-    factory: "stdout",
-    opencode: "shim",
-    pi: "shim"
-  };
-});
-
-// lib/atomic-write.ts
-import {
-  chmodSync as chmodSync2,
-  existsSync as existsSync8,
-  mkdirSync as mkdirSync5,
-  renameSync as renameSync3,
-  rmSync as rmSync2,
-  statSync as statSync6,
-  writeFileSync as writeFileSync4
-} from "node:fs";
-import { dirname as dirname3 } from "node:path";
-import { randomBytes } from "node:crypto";
-function writeJsonAtomically(filePath, value, opts = {}) {
-  const mode = opts.mode ?? 384;
-  const dirMode = opts.dirMode ?? 448;
-  const dir = dirname3(filePath);
-  if (!existsSync8(dir))
-    mkdirSync5(dir, { recursive: true, mode: dirMode });
-  const tmp = `${filePath}.${process.pid}.${randomBytes(6).toString("hex")}.tmp`;
-  try {
-    writeFileSync4(tmp, JSON.stringify(value, null, 2), { mode });
-    try {
-      if ((statSync6(tmp).mode & 63) !== 0)
-        chmodSync2(tmp, mode);
-    } catch {}
-    renameSync3(tmp, filePath);
-    try {
-      if ((statSync6(filePath).mode & 63) !== 0)
-        chmodSync2(filePath, mode);
-    } catch {}
-  } catch (err) {
-    try {
-      rmSync2(tmp, { force: true });
-    } catch {}
-    throw err;
-  }
-}
-var init_atomic_write = () => {};
-
-// src/audit/leak-record.ts
-function emptyRecord(salt, nowIso) {
-  return {
-    schemaVersion: LEAK_RECORD_SCHEMA_VERSION,
-    salt,
-    updatedAt: nowIso,
-    findings: []
-  };
-}
-var LEAK_RECORD_SCHEMA_VERSION = 1;
-
-// src/audit/leak-fingerprint.ts
-function isFindingId(id) {
-  return /^[0-9a-f]{16}$/.test(id);
-}
-var init_leak_fingerprint = () => {};
-
-// src/audit/leak-store.ts
-import { randomBytes as randomBytes2 } from "node:crypto";
-import { existsSync as existsSync9, mkdirSync as mkdirSync6, readFileSync as readFileSync6 } from "node:fs";
-import { dirname as dirname4 } from "node:path";
-function readJson(path) {
-  try {
-    if (!existsSync9(path))
-      return null;
-    return JSON.parse(readFileSync6(path, "utf8"));
-  } catch {
-    return null;
-  }
-}
-function readLeakIdentity(home) {
-  const existing = readJson(auditLeakIdentityFile(home));
-  if (existing && typeof existing.salt === "string" && existing.salt.length >= 32) {
-    return {
-      salt: existing.salt,
-      dismissed: existing.dismissed ?? [],
-      reportViewedAt: typeof existing.reportViewedAt === "number" && Number.isFinite(existing.reportViewedAt) ? existing.reportViewedAt : undefined
-    };
-  }
-  const minted = { salt: randomBytes2(32).toString("hex"), dismissed: [] };
-  writeLeakIdentity(minted, home);
-  return minted;
-}
-function writeLeakIdentity(identity, home) {
-  const path = auditLeakIdentityFile(home);
-  try {
-    mkdirSync6(dirname4(path), { recursive: true });
-    writeJsonAtomically(path, identity, { mode: FILE_MODE });
-    return true;
-  } catch {
-    return false;
-  }
-}
-function sanitizeFinding(raw) {
-  if (!raw || typeof raw !== "object" || Array.isArray(raw))
-    return null;
-  const f = raw;
-  if (typeof f.id !== "string" || !isFindingId(f.id))
-    return null;
-  const fp = f.fingerprint;
-  if (!fp || typeof fp !== "object" || typeof fp.display !== "string" || typeof fp.label !== "string") {
-    return null;
-  }
-  const sightings = Array.isArray(f.sightings) ? f.sightings.filter((s) => {
-    if (!s || typeof s !== "object")
-      return false;
-    const m = s.mechanism;
-    return !!m && typeof m === "object" && typeof m.summary === "string";
-  }) : [];
-  return {
-    ...f,
-    fingerprint: {
-      display: fp.display,
-      label: fp.label,
-      length: typeof fp.length === "number" && Number.isFinite(fp.length) ? fp.length : 0,
-      attributed: fp.attributed === true
-    },
-    name: typeof f.name === "string" ? f.name : null,
-    firstSeen: typeof f.firstSeen === "string" ? f.firstSeen : "",
-    lastSeen: typeof f.lastSeen === "string" ? f.lastSeen : "",
-    occurrences: typeof f.occurrences === "number" && Number.isFinite(f.occurrences) ? f.occurrences : sightings.length,
-    sightings
-  };
-}
-function readLeakRecord(home) {
-  const identity = readLeakIdentity(home);
-  const raw = readJson(auditLeaksFile(home));
-  if (!raw || raw.schemaVersion !== LEAK_RECORD_SCHEMA_VERSION || !Array.isArray(raw.findings)) {
-    return emptyRecord(identity.salt, new Date().toISOString());
-  }
-  const findings = raw.findings.map(sanitizeFinding).filter((f) => f !== null);
-  return { ...raw, findings, salt: identity.salt };
-}
-function activeFindings(record, home) {
-  const dismissed = new Set(readLeakIdentity(home).dismissed);
-  return record.findings.filter((f) => !dismissed.has(f.id)).sort((a, b) => a.lastSeen < b.lastSeen ? 1 : a.lastSeen > b.lastSeen ? -1 : 0);
-}
-var FILE_MODE = 384;
-var init_leak_store = __esm(() => {
-  init_fp_home();
-  init_atomic_write();
-  init_leak_fingerprint();
-});
-
-// src/audit/leak-notice.ts
-import { existsSync as existsSync10, mkdirSync as mkdirSync7, readdirSync as readdirSync3, statSync as statSync7, writeFileSync as writeFileSync5, rmSync as rmSync3 } from "node:fs";
-import { resolve as resolve8 } from "node:path";
-function sessionNoticePending(sessionId, home) {
-  try {
-    if (!sessionId || !/^[\w.:-]{1,200}$/.test(sessionId))
-      return { ids: [], count: 0 };
-    const dir = resolve8(auditDir(home), "notified-sessions");
-    if (existsSync10(resolve8(dir, sessionId)))
-      return { ids: [], count: 0 };
-    const findings = activeFindings(readLeakRecord(home), home);
-    if (findings.length === 0)
-      return { ids: [], count: 0 };
-    const viewedAt = readLeakIdentity(home).reportViewedAt ?? 0;
-    const unviewed = findings.filter((f) => {
-      const seen = Date.parse(f.firstSeen);
-      return !Number.isFinite(seen) || seen > viewedAt;
-    });
-    return { ids: unviewed.map((f) => f.id), count: unviewed.length };
-  } catch {
-    return { ids: [], count: 0 };
-  }
-}
-function markSessionNoticed(sessionId, home) {
-  try {
-    if (!sessionId || !/^[\w.:-]{1,200}$/.test(sessionId))
-      return false;
-    const dir = resolve8(auditDir(home), "notified-sessions");
-    mkdirSync7(dir, { recursive: true });
-    writeFileSync5(resolve8(dir, sessionId), "", { flag: "wx", mode: 384 });
-    return true;
-  } catch {
-    return false;
-  }
-}
-var MARKER_TTL_MS;
-var init_leak_notice = __esm(() => {
-  init_fp_home();
-  init_leak_store();
-  init_leak_fingerprint();
-  MARKER_TTL_MS = 120 * 86400000;
-});
-
 // src/hooks/resolve-cwd.ts
 function resolveCwd(integration, parsed) {
   const direct = typeof parsed.cwd === "string" && parsed.cwd.length > 0 ? parsed.cwd : undefined;
@@ -6154,7 +5900,7 @@ var init_cursor_projects = __esm(() => {
 });
 
 // lib/sqlite-reader.ts
-import { existsSync as existsSync11, readFileSync as readFileSync7 } from "node:fs";
+import { existsSync as existsSync8, readFileSync as readFileSync6 } from "node:fs";
 import initSqlJs from "sql.js/dist/sql-asm.js";
 function silenceSqliteExperimentalWarning() {
   if (warningPatched)
@@ -6205,7 +5951,7 @@ function clearWalFlag(bytes) {
 async function trySqlJs(dbPath) {
   try {
     const SQL = await loadSqlJs();
-    const db = new SQL.Database(clearWalFlag(readFileSync7(dbPath)));
+    const db = new SQL.Database(clearWalFlag(readFileSync6(dbPath)));
     return {
       query(sql, params) {
         const stmt = db.prepare(sql);
@@ -6229,7 +5975,7 @@ async function trySqlJs(dbPath) {
   }
 }
 async function openSqliteReadonly(dbPath) {
-  if (!existsSync11(dbPath))
+  if (!existsSync8(dbPath))
     return null;
   return await tryNodeSqlite(dbPath) ?? await trySqlJs(dbPath);
 }
@@ -6564,16 +6310,16 @@ var init_pi_projects = __esm(() => {
 });
 
 // lib/hermes-profiles.ts
-import { readdirSync as readdirSync4 } from "node:fs";
+import { readdirSync as readdirSync3 } from "node:fs";
 import { homedir as homedir10 } from "node:os";
-import { basename as basename2, dirname as dirname5, join as join11, resolve as resolve9 } from "node:path";
+import { basename as basename2, dirname as dirname3, join as join11, resolve as resolve8 } from "node:path";
 function hermesRoot() {
   const env = (process.env.HERMES_HOME || "").trim();
   if (env) {
-    const home = resolve9(env);
-    const parent = dirname5(home);
+    const home = resolve8(env);
+    const parent = dirname3(home);
     if (basename2(parent) === PROFILES_DIR)
-      return dirname5(parent);
+      return dirname3(parent);
     return home;
   }
   return join11(homedir10(), ".hermes");
@@ -6584,7 +6330,7 @@ function listHermesProfiles() {
   const seen = new Set([HERMES_DEFAULT_PROFILE]);
   let names;
   try {
-    names = readdirSync4(join11(root, PROFILES_DIR), { withFileTypes: true }).filter((e) => (e.isDirectory() || e.isSymbolicLink()) && !e.name.startsWith(".")).map((e) => e.name).sort();
+    names = readdirSync3(join11(root, PROFILES_DIR), { withFileTypes: true }).filter((e) => (e.isDirectory() || e.isSymbolicLink()) && !e.name.startsWith(".")).map((e) => e.name).sort();
   } catch {
     return out;
   }
@@ -6942,7 +6688,7 @@ var init_hermes_projects = __esm(() => {
 
 // lib/openclaw-sessions.ts
 import { readFile as readFile7 } from "node:fs/promises";
-import { readdirSync as readdirSync5, statSync as statSync8 } from "node:fs";
+import { readdirSync as readdirSync4, statSync as statSync6 } from "node:fs";
 import { homedir as homedir11 } from "node:os";
 import { join as join13 } from "node:path";
 function openclawHome() {
@@ -7061,7 +6807,7 @@ function openclawLinesToLogEntries(lines, source = "session") {
 }
 function listOpenClawAgents() {
   try {
-    return readdirSync5(join13(openclawHome(), "agents"), { withFileTypes: true }).filter((d) => d.isDirectory() && !d.name.startsWith(".")).map((d) => d.name).sort();
+    return readdirSync4(join13(openclawHome(), "agents"), { withFileTypes: true }).filter((d) => d.isDirectory() && !d.name.startsWith(".")).map((d) => d.name).sort();
   } catch {
     return [];
   }
@@ -7071,7 +6817,7 @@ function listOpenClawTranscripts() {
   const out = [];
   let agentIds;
   try {
-    agentIds = readdirSync5(agentsDir, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name);
+    agentIds = readdirSync4(agentsDir, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name);
   } catch {
     return out;
   }
@@ -7079,7 +6825,7 @@ function listOpenClawTranscripts() {
     const sessionsDir = join13(agentsDir, agentId, "sessions");
     let files;
     try {
-      files = readdirSync5(sessionsDir);
+      files = readdirSync4(sessionsDir);
     } catch {
       continue;
     }
@@ -7091,7 +6837,7 @@ function listOpenClawTranscripts() {
         continue;
       const transcriptPath = join13(sessionsDir, file);
       try {
-        const st = statSync8(transcriptPath);
+        const st = statSync6(transcriptPath);
         out.push({ agentId, sessionId, transcriptPath, mtimeMs: st.mtimeMs, sizeBytes: st.size });
       } catch {}
     }
@@ -7140,7 +6886,7 @@ var exports_openclaw_projects = {};
 __export(exports_openclaw_projects, {
   getOpenClawProjects: () => getOpenClawProjects
 });
-import { readFileSync as readFileSync8 } from "node:fs";
+import { readFileSync as readFileSync7 } from "node:fs";
 import { join as join14 } from "node:path";
 function str(v) {
   return typeof v === "string" && v.length > 0 ? v : undefined;
@@ -7150,7 +6896,7 @@ function readSessionsIndex(agentId) {
   const indexPath = join14(openclawHome(), "agents", agentId, "sessions", "sessions.json");
   let raw;
   try {
-    raw = JSON.parse(readFileSync8(indexPath, "utf-8"));
+    raw = JSON.parse(readFileSync7(indexPath, "utf-8"));
   } catch {
     return out;
   }
@@ -7299,7 +7045,7 @@ var init_openclaw_projects = __esm(() => {
 
 // lib/factory-sessions.ts
 import { readFile as readFile8 } from "node:fs/promises";
-import { readdirSync as readdirSync6, statSync as statSync9 } from "node:fs";
+import { readdirSync as readdirSync5, statSync as statSync7 } from "node:fs";
 import { homedir as homedir12 } from "node:os";
 import { join as join15 } from "node:path";
 function factoryHome() {
@@ -7445,7 +7191,7 @@ function listFactoryTranscripts() {
   const out = [];
   let projectDirs;
   try {
-    projectDirs = readdirSync6(root, { withFileTypes: true }).filter((d) => d.isDirectory());
+    projectDirs = readdirSync5(root, { withFileTypes: true }).filter((d) => d.isDirectory());
   } catch {
     return out;
   }
@@ -7455,7 +7201,7 @@ function listFactoryTranscripts() {
     const projectPath = join15(root, projectName);
     let files;
     try {
-      files = readdirSync6(projectPath);
+      files = readdirSync5(projectPath);
     } catch {
       continue;
     }
@@ -7467,7 +7213,7 @@ function listFactoryTranscripts() {
         continue;
       const transcriptPath = join15(projectPath, file);
       try {
-        const st = statSync9(transcriptPath);
+        const st = statSync7(transcriptPath);
         out.push({ projectName, cwd, sessionId, transcriptPath, mtimeMs: st.mtimeMs, sizeBytes: st.size });
       } catch {}
     }
@@ -7886,7 +7632,7 @@ var init_devin_projects = __esm(() => {
 
 // lib/antigravity-sessions.ts
 import { readFile as readFile9 } from "node:fs/promises";
-import { readdirSync as readdirSync7, statSync as statSync10 } from "node:fs";
+import { readdirSync as readdirSync6, statSync as statSync8 } from "node:fs";
 import { homedir as homedir14 } from "node:os";
 import { join as join17 } from "node:path";
 function antigravityHome() {
@@ -8011,7 +7757,7 @@ function listAntigravityTranscripts() {
   const out = [];
   let convoDirs;
   try {
-    convoDirs = readdirSync7(root, { withFileTypes: true }).filter((d) => d.isDirectory());
+    convoDirs = readdirSync6(root, { withFileTypes: true }).filter((d) => d.isDirectory());
   } catch {
     return out;
   }
@@ -8021,7 +7767,7 @@ function listAntigravityTranscripts() {
       continue;
     const transcriptPath = join17(root, conversationId, rel);
     try {
-      const st = statSync10(transcriptPath);
+      const st = statSync8(transcriptPath);
       if (!st.isFile())
         continue;
       out.push({ conversationId, transcriptPath, mtimeMs: st.mtimeMs, sizeBytes: st.size });
@@ -8034,7 +7780,7 @@ function findAntigravityTranscript(conversationId) {
     return null;
   const transcriptPath = join17(antigravityBrainRoot(), conversationId, antigravityTranscriptRelPath());
   try {
-    if (statSync10(transcriptPath).isFile())
+    if (statSync8(transcriptPath).isFile())
       return transcriptPath;
   } catch {}
   return null;
@@ -8484,7 +8230,7 @@ var init_goose_projects = __esm(() => {
 
 // lib/projects.ts
 import { readdir as readdir5, stat as stat4 } from "node:fs/promises";
-import { join as join20, resolve as resolve10, sep } from "node:path";
+import { join as join20, resolve as resolve9, sep } from "node:path";
 async function getMtime(path, label) {
   try {
     return (await stat4(path)).mtime;
@@ -8636,8 +8382,8 @@ function resolveProjectPath(projectName) {
     throw new RangeError("Empty project name");
   if (/^[/\\]/.test(projectName))
     throw new RangeError("Absolute project name");
-  const projectsPath = resolve10(getClaudeProjectsPath());
-  const candidate = resolve10(join20(projectsPath, projectName));
+  const projectsPath = resolve9(getClaudeProjectsPath());
+  const candidate = resolve9(join20(projectsPath, projectName));
   if (!candidate.startsWith(projectsPath + sep)) {
     throw new RangeError("Project path escapes root");
   }
@@ -8943,30 +8689,30 @@ var init_log_entries = __esm(() => {
 });
 
 // lib/codex-sessions.ts
-import { readFileSync as readFileSync9, readdirSync as readdirSync8, existsSync as existsSync12, writeFileSync as writeFileSync6, mkdirSync as mkdirSync8, statSync as statSync11 } from "node:fs";
+import { readFileSync as readFileSync8, readdirSync as readdirSync7, existsSync as existsSync9, writeFileSync as writeFileSync4, mkdirSync as mkdirSync5, statSync as statSync9 } from "node:fs";
 import { readFile as readFile11 } from "node:fs/promises";
-import { dirname as dirname6, join as join23 } from "node:path";
+import { dirname as dirname4, join as join23 } from "node:path";
 import { homedir as homedir16 } from "node:os";
 function readCache() {
   try {
-    if (!existsSync12(CACHE_PATH))
+    if (!existsSync9(CACHE_PATH))
       return {};
-    return JSON.parse(readFileSync9(CACHE_PATH, "utf-8"));
+    return JSON.parse(readFileSync8(CACHE_PATH, "utf-8"));
   } catch {
     return {};
   }
 }
 function writeCacheEntry(sessionId, path) {
   try {
-    mkdirSync8(dirname6(CACHE_PATH), { recursive: true });
+    mkdirSync5(dirname4(CACHE_PATH), { recursive: true });
     const cache = readCache();
     cache[sessionId] = path;
-    writeFileSync6(CACHE_PATH, JSON.stringify(cache), "utf-8");
+    writeFileSync4(CACHE_PATH, JSON.stringify(cache), "utf-8");
   } catch {}
 }
 function dirSearch(dir, sessionId) {
   try {
-    for (const f of readdirSync8(dir, { withFileTypes: true })) {
+    for (const f of readdirSync7(dir, { withFileTypes: true })) {
       if (f.isFile() && f.name.includes(sessionId) && f.name.endsWith(".jsonl")) {
         return join23(dir, f.name);
       }
@@ -8977,7 +8723,7 @@ function dirSearch(dir, sessionId) {
 function findCodexTranscript(sessionId) {
   const cache = readCache();
   const cached = cache[sessionId];
-  if (cached && existsSync12(cached))
+  if (cached && existsSync9(cached))
     return cached;
   const root = join23(homedir16(), ".codex", "sessions");
   const today = new Date;
@@ -8996,13 +8742,13 @@ function findCodexTranscript(sessionId) {
     }
   }
   try {
-    for (const y of readdirSync8(root, { withFileTypes: true })) {
+    for (const y of readdirSync7(root, { withFileTypes: true })) {
       if (!y.isDirectory())
         continue;
-      for (const m of readdirSync8(join23(root, y.name), { withFileTypes: true })) {
+      for (const m of readdirSync7(join23(root, y.name), { withFileTypes: true })) {
         if (!m.isDirectory())
           continue;
-        for (const d of readdirSync8(join23(root, y.name, m.name), { withFileTypes: true })) {
+        for (const d of readdirSync7(join23(root, y.name, m.name), { withFileTypes: true })) {
           if (!d.isDirectory())
             continue;
           const hit = dirSearch(join23(root, y.name, m.name, d.name), sessionId);
@@ -9031,6 +8777,15 @@ function joinTexts(blocks, wantedType) {
   return blocks.filter((b) => b?.type === wantedType && typeof b.text === "string").map((b) => b.text).join(`
 `);
 }
+function toolOutputText(output) {
+  if (typeof output === "string")
+    return output;
+  if (Array.isArray(output)) {
+    return output.filter((block) => !!block && typeof block === "object").map((block) => typeof block.text === "string" ? block.text : "").filter(Boolean).join(`
+`);
+  }
+  return output === undefined ? "" : JSON.stringify(output);
+}
 async function parseCodexLog(fileContent, source = "session") {
   const lines = fileContent.split(`
 `).filter((line) => line.trim() !== "");
@@ -9107,10 +8862,11 @@ async function parseCodexLog(fileContent, source = "session") {
         });
         continue;
       }
-      if (subType === "function_call") {
+      if (subType === "function_call" || subType === "custom_tool_call") {
         const callId = payload.call_id;
         const name = payload.name ?? "function_call";
-        const input = safeJsonParse4(payload.arguments);
+        const encodedInput = payload.arguments ?? payload.input;
+        const input = safeJsonParse4(encodedInput);
         const toolUse = {
           type: "tool_use",
           id: callId ?? `${timestamp}-${name}`,
@@ -9129,7 +8885,7 @@ async function parseCodexLog(fileContent, source = "session") {
         }
         continue;
       }
-      if (subType === "function_call_output") {
+      if (subType === "function_call_output" || subType === "custom_tool_call_output") {
         const callId = payload.call_id;
         const block = callId ? toolUseById.get(callId) : undefined;
         if (block) {
@@ -9138,7 +8894,7 @@ async function parseCodexLog(fileContent, source = "session") {
           block.result = {
             timestamp,
             timestampFormatted: formatTimestamp(date),
-            content: typeof payload.output === "string" ? payload.output : JSON.stringify(payload.output),
+            content: toolOutputText(payload.output),
             durationMs: duration,
             durationFormatted: formatDuration(duration)
           };
@@ -9231,7 +8987,7 @@ var init_codex_sessions = __esm(() => {
 });
 
 // src/hooks/resolve-permission-mode.ts
-import { readFileSync as readFileSync10 } from "node:fs";
+import { readFileSync as readFileSync9 } from "node:fs";
 function resolvePermissionMode(integration, parsed, sessionId) {
   if (integration === "claude") {
     return parsed.permission_mode ?? "default";
@@ -9246,7 +9002,7 @@ function resolveCodexMode(sessionId) {
     const path = findCodexTranscript(sessionId);
     if (!path)
       return;
-    for (const line of readFileSync10(path, "utf-8").split(`
+    for (const line of readFileSync9(path, "utf-8").split(`
 `)) {
       if (!line.includes("turn_context"))
         continue;
@@ -9271,9 +9027,9 @@ var init_resolve_permission_mode = __esm(() => {
 });
 
 // lib/copilot-sessions.ts
-import { readFileSync as readFileSync11, readdirSync as readdirSync9, existsSync as existsSync13, statSync as statSync12 } from "node:fs";
+import { readFileSync as readFileSync10, readdirSync as readdirSync8, existsSync as existsSync10, statSync as statSync10 } from "node:fs";
 import { readFile as readFile12 } from "node:fs/promises";
-import { join as join24, resolve as resolve11, sep as sep2 } from "node:path";
+import { join as join24, resolve as resolve10, sep as sep2 } from "node:path";
 import { homedir as homedir17 } from "node:os";
 function getCopilotHome() {
   return process.env.COPILOT_HOME || join24(homedir17(), ".copilot");
@@ -9284,8 +9040,8 @@ function getCopilotSessionStateRoot2() {
 function getCopilotSessionDir(sessionId) {
   if (!sessionId)
     return null;
-  const root = resolve11(getCopilotSessionStateRoot2());
-  const candidate = resolve11(root, sessionId);
+  const root = resolve10(getCopilotSessionStateRoot2());
+  const candidate = resolve10(root, sessionId);
   if (candidate === root || !candidate.startsWith(`${root}${sep2}`))
     return null;
   return candidate;
@@ -9300,17 +9056,17 @@ function findCopilotTranscript(sessionId) {
   const candidate = resolveSessionFile(sessionId, "events.jsonl");
   if (!candidate)
     return null;
-  return existsSync13(candidate) ? candidate : null;
+  return existsSync10(candidate) ? candidate : null;
 }
 function findCopilotWorkspace(sessionId) {
   const candidate = resolveSessionFile(sessionId, "workspace.yaml");
   if (!candidate)
     return null;
-  return existsSync13(candidate) ? candidate : null;
+  return existsSync10(candidate) ? candidate : null;
 }
 function readYamlScalar(path, key) {
   try {
-    const text = readFileSync11(path, "utf-8");
+    const text = readFileSync10(path, "utf-8");
     const re = new RegExp(`^${key}\\s*:\\s*(.+?)\\s*$`, "m");
     const m = text.match(re);
     if (!m)
@@ -9333,6 +9089,8 @@ async function parseCopilotLog(fileContent, source = "session") {
   const rawLines = [];
   const toolUseById = new Map;
   const toolUseStartMs = new Map;
+  let mostRecentToolUse;
+  let mostRecentToolUseStartMs = 0;
   let cwd;
   let seenSessionStart = false;
   for (let i = 0;i < lines.length; i++) {
@@ -9428,8 +9186,24 @@ async function parseCopilotLog(fileContent, source = "session") {
         toolUseById.set(callId, toolUse);
         toolUseStartMs.set(callId, date.getTime());
       }
+      mostRecentToolUse = toolUse;
+      mostRecentToolUseStartMs = date.getTime();
       continue;
     }
+    if (recType === "hook.start" && data.hookType === "postToolUse" && mostRecentToolUse) {
+      const input = data.input ?? {};
+      const hookResult = input.toolResult ?? {};
+      const hookContent = hookResult.textResultForLlm ?? hookResult.sessionLog;
+      if (typeof hookContent === "string" && hookContent.length > 0) {
+        mostRecentToolUse.result = {
+          timestamp,
+          timestampFormatted: formatTimestamp(date),
+          content: hookContent,
+          durationMs: Math.max(0, date.getTime() - mostRecentToolUseStartMs),
+          durationFormatted: formatDuration(Math.max(0, date.getTime() - mostRecentToolUseStartMs))
+        };
+      }
+    }
     if (recType === "tool.execution_complete") {
       const callId = data.toolCallId;
       const block = callId ? toolUseById.get(callId) : undefined;
@@ -9439,7 +9213,8 @@ async function parseCopilotLog(fileContent, source = "session") {
         const telemetry = data.toolTelemetry ?? {};
         const reportedMs = telemetry.metrics?.commandTimeMs ?? telemetry.metrics?.durationMs ?? null;
         const durationMs = typeof reportedMs === "number" && reportedMs >= 0 ? reportedMs : Math.max(0, date.getTime() - startMs);
-        const content = result.detailedContent ?? result.content ?? "";
+        const completionContent = result.detailedContent ?? result.content ?? "";
+        const content = block.result?.content || completionContent;
         block.result = {
           timestamp,
           timestampFormatted: formatTimestamp(date),
@@ -9488,9 +9263,9 @@ var init_copilot_sessions = __esm(() => {
 });
 
 // lib/cursor-sessions.ts
-import { readFileSync as readFileSync12, readdirSync as readdirSync10, existsSync as existsSync14, statSync as statSync13 } from "node:fs";
+import { readFileSync as readFileSync11, readdirSync as readdirSync9, existsSync as existsSync11, statSync as statSync11 } from "node:fs";
 import { readFile as readFile13 } from "node:fs/promises";
-import { basename as basename3, join as join25, resolve as resolve12, sep as sep3 } from "node:path";
+import { basename as basename3, join as join25, resolve as resolve11, sep as sep3 } from "node:path";
 import { homedir as homedir18 } from "node:os";
 function getCursorHome2() {
   return process.env.CURSOR_HOME || join25(homedir18(), ".cursor");
@@ -9498,28 +9273,28 @@ function getCursorHome2() {
 function getCursorSessionDir(sessionId) {
   if (!sessionId)
     return null;
-  const home = resolve12(getCursorHome2());
-  const projectsRoot = resolve12(home, NEW_PROJECTS_DIR2);
+  const home = resolve11(getCursorHome2());
+  const projectsRoot = resolve11(home, NEW_PROJECTS_DIR2);
   let projectEntries = [];
   try {
-    projectEntries = readdirSync10(projectsRoot, { withFileTypes: true });
+    projectEntries = readdirSync9(projectsRoot, { withFileTypes: true });
   } catch {}
   for (const entry of projectEntries) {
     if (!entry.isDirectory())
       continue;
-    const candidate = resolve12(projectsRoot, entry.name, NEW_AGENT_TRANSCRIPTS_DIR2, sessionId);
-    const transcriptRoot = resolve12(projectsRoot, entry.name, NEW_AGENT_TRANSCRIPTS_DIR2);
+    const candidate = resolve11(projectsRoot, entry.name, NEW_AGENT_TRANSCRIPTS_DIR2, sessionId);
+    const transcriptRoot = resolve11(projectsRoot, entry.name, NEW_AGENT_TRANSCRIPTS_DIR2);
     if (candidate === transcriptRoot || !candidate.startsWith(`${transcriptRoot}${sep3}`))
       continue;
-    if (existsSync14(candidate))
+    if (existsSync11(candidate))
       return candidate;
   }
   for (const sub of LEGACY_SESSION_ROOT_CANDIDATES2) {
-    const root = resolve12(home, sub);
-    const candidate = resolve12(root, sessionId);
+    const root = resolve11(home, sub);
+    const candidate = resolve11(root, sessionId);
     if (candidate === root || !candidate.startsWith(`${root}${sep3}`))
       continue;
-    if (existsSync14(candidate))
+    if (existsSync11(candidate))
       return candidate;
   }
   return null;
@@ -9529,11 +9304,11 @@ function findCursorTranscript(sessionId) {
   if (!dir)
     return null;
   const newCandidate = join25(dir, `${basename3(dir)}.jsonl`);
-  if (existsSync14(newCandidate))
+  if (existsSync11(newCandidate))
     return newCandidate;
   for (const name of LEGACY_TRANSCRIPT_FILE_CANDIDATES2) {
     const candidate = join25(dir, name);
-    if (existsSync14(candidate))
+    if (existsSync11(candidate))
       return candidate;
   }
   return null;
@@ -9563,8 +9338,27 @@ async function parseCursorLog(fileContent, source = "session") {
     if (!raw.type && raw.role && raw.message?.content) {
       const synthDate = new Date(SYNTH_T0 + i);
       const synthTs = synthDate.toISOString();
-      const textParts = raw.message.content.filter((c) => c?.type === "text" && typeof c.text === "string").map((c) => c.text).join("");
+      const messageContent = raw.message.content;
+      const textParts = messageContent.filter((c) => c?.type === "text" && typeof c.text === "string").map((c) => c.text).join("");
       if (raw.role === "user") {
+        let attachedResult = false;
+        for (const block of messageContent) {
+          if (block?.type !== "tool_result")
+            continue;
+          const callId = typeof block.tool_use_id === "string" ? block.tool_use_id : undefined;
+          const toolUse = callId ? toolUseById.get(callId) : undefined;
+          if (!toolUse)
+            continue;
+          const durationMs = Math.max(0, synthDate.getTime() - (toolUseStartMs.get(callId) ?? synthDate.getTime()));
+          toolUse.result = {
+            timestamp: synthTs,
+            timestampFormatted: formatTimestamp(synthDate),
+            content: typeof block.content === "string" ? block.content : block.content == null ? "" : JSON.stringify(block.content),
+            durationMs,
+            durationFormatted: formatDuration(durationMs)
+          };
+          attachedResult = true;
+        }
         const queryMatch = /<user_query>\s*([\s\S]*?)\s*<\/user_query>/.exec(textParts);
         const text = queryMatch ? queryMatch[1] : textParts;
         if (text) {
@@ -9573,11 +9367,35 @@ async function parseCursorLog(fileContent, source = "session") {
             ...baseEntry(rawCopy, synthTs, synthDate, source),
             message: { role: "user", content: text }
           });
+        } else if (!attachedResult) {
+          entries.push({
+            type: "system",
+            ...baseEntry(rawCopy, synthTs, synthDate, source),
+            raw: rawCopy
+          });
         }
         continue;
       }
       if (raw.role === "assistant") {
-        const blocks = textParts ? [{ type: "text", text: textParts }] : [];
+        const blocks = [];
+        if (textParts)
+          blocks.push({ type: "text", text: textParts });
+        for (let j = 0;j < messageContent.length; j++) {
+          const contentBlock = messageContent[j];
+          if (contentBlock?.type !== "tool_use")
+            continue;
+          const name = typeof contentBlock.name === "string" ? contentBlock.name : "tool";
+          const id = typeof contentBlock.id === "string" && contentBlock.id ? contentBlock.id : `cursor-${i}-${name}-${j}`;
+          const toolUse = {
+            type: "tool_use",
+            id,
+            name,
+            input: contentBlock.input && typeof contentBlock.input === "object" ? contentBlock.input : {}
+          };
+          blocks.push(toolUse);
+          toolUseById.set(id, toolUse);
+          toolUseStartMs.set(id, synthDate.getTime());
+        }
         if (blocks.length === 0) {
           entries.push({
             type: "system",
@@ -9744,9 +9562,9 @@ var init_cursor_sessions = __esm(() => {
 });
 
 // lib/pi-sessions.ts
-import { readFileSync as readFileSync13, readdirSync as readdirSync11, existsSync as existsSync15, statSync as statSync14 } from "node:fs";
+import { readFileSync as readFileSync12, readdirSync as readdirSync10, existsSync as existsSync12, statSync as statSync12 } from "node:fs";
 import { readFile as readFile14 } from "node:fs/promises";
-import { join as join26, resolve as resolve13, sep as sep4 } from "node:path";
+import { join as join26, resolve as resolve12, sep as sep4 } from "node:path";
 import { homedir as homedir19 } from "node:os";
 function getPiSessionStateRoot() {
   return process.env.PI_SESSIONS_DIR || join26(homedir19(), ".pi", "agent", "sessions");
@@ -9757,20 +9575,20 @@ function isSafeSessionId(sessionId) {
 function findPiTranscript(sessionId) {
   if (!isSafeSessionId(sessionId))
     return null;
-  const root = resolve13(getPiSessionStateRoot());
+  const root = resolve12(getPiSessionStateRoot());
   let cwdDirs;
   try {
-    cwdDirs = readdirSync11(root);
+    cwdDirs = readdirSync10(root);
   } catch {
     return null;
   }
   for (const cwdDir of cwdDirs) {
-    const cwdPath = resolve13(root, cwdDir);
+    const cwdPath = resolve12(root, cwdDir);
     if (!cwdPath.startsWith(`${root}${sep4}`))
       continue;
     let files;
     try {
-      files = readdirSync11(cwdPath);
+      files = readdirSync10(cwdPath);
     } catch {
       continue;
     }
@@ -9778,10 +9596,10 @@ function findPiTranscript(sessionId) {
       const m = SESSION_FILE_RE2.exec(f);
       if (!m || m[1].toLowerCase() !== sessionId.toLowerCase())
         continue;
-      const candidate = resolve13(cwdPath, f);
+      const candidate = resolve12(cwdPath, f);
       if (!candidate.startsWith(`${cwdPath}${sep4}`))
         continue;
-      if (existsSync15(candidate))
+      if (existsSync12(candidate))
         return candidate;
     }
   }
@@ -10137,14 +9955,17 @@ var init_pack_failclosed = __esm(() => {
   ]);
 });
 
+// lib/atomic-write.ts
+var init_atomic_write = () => {};
+
 // src/hooks/session-pause.ts
-import { existsSync as existsSync16, mkdirSync as mkdirSync9, readdirSync as readdirSync12, readFileSync as readFileSync14, rmSync as rmSync4 } from "node:fs";
+import { existsSync as existsSync13, mkdirSync as mkdirSync6, readdirSync as readdirSync11, readFileSync as readFileSync13, rmSync as rmSync2 } from "node:fs";
 import { createHash as createHash5 } from "node:crypto";
-import { join as join27, resolve as resolve14 } from "node:path";
+import { join as join27, resolve as resolve13 } from "node:path";
 function pauseStateDir() {
   const override = process.env.FAILPROOFAI_STATE_DIR;
   if (override)
-    return resolve14(override, "sessions");
+    return resolve13(override, "sessions");
   return sessionPauseDir();
 }
 function pauseFilePath(sessionId) {
@@ -10178,9 +9999,9 @@ function readActivePause(sessionId, now = Date.now()) {
     return null;
   try {
     const path = pauseFilePath(sessionId);
-    if (!existsSync16(path))
+    if (!existsSync13(path))
       return null;
-    const stored = parseStored(JSON.parse(readFileSync14(path, "utf8")));
+    const stored = parseStored(JSON.parse(readFileSync13(path, "utf8")));
     if (!stored)
       return null;
     if (stored.expiresAt <= now)
@@ -10219,15 +10040,15 @@ var init_daemon_service = __esm(() => {
 // src/hooks/fp-reset.ts
 import {
   copyFileSync,
-  existsSync as existsSync17,
-  mkdirSync as mkdirSync10,
-  readFileSync as readFileSync15,
-  readdirSync as readdirSync13,
-  renameSync as renameSync4,
-  rmSync as rmSync5,
+  existsSync as existsSync14,
+  mkdirSync as mkdirSync7,
+  readFileSync as readFileSync14,
+  readdirSync as readdirSync12,
+  renameSync as renameSync3,
+  rmSync as rmSync3,
   rmdirSync,
-  statSync as statSync15,
-  writeFileSync as writeFileSync7
+  statSync as statSync13,
+  writeFileSync as writeFileSync5
 } from "node:fs";
 function layoutWarningForHook() {
   const state = detectLayout();
@@ -10236,7 +10057,7 @@ function layoutWarningForHook() {
   if (state.kind === "future") {
     return `[failproofai] this directory was written by a newer version (layout ${state.found} vs ${LAYOUT_VERSION}) — policies are NOT being enforced. ` + `Upgrade failproofai.`;
   }
-  if (existsSync17(globalPolicyConfigFile()))
+  if (existsSync14(globalPolicyConfigFile()))
     return null;
   return `[failproofai] setup predates this version — global policies are NOT being enforced. ` + `Run \`failproofai config\` to re-create it.`;
 }
@@ -10281,31 +10102,6 @@ function canonicalizeEventType(raw, cli) {
   }
   return raw;
 }
-function attachLeakNotice(eventType, cli, outcome, sessionId) {
-  try {
-    if (!canDeliverNotice(cli))
-      return outcome;
-    if (!cli)
-      return outcome;
-    const canonical = canonicalizeEventType(eventType, cli);
-    if (canonical !== "Stop")
-      return outcome;
-    const pending = sessionNoticePending(sessionId ?? "");
-    if (pending.count === 0)
-      return outcome;
-    const shaped = shapeNotice(cli, leakNoticeText(pending.count), outcome.stdout);
-    if (shaped.stdout === outcome.stdout && !shaped.stderr)
-      return outcome;
-    markSessionNoticed(sessionId ?? "");
-    return {
-      exitCode: outcome.exitCode,
-      stdout: shaped.stdout,
-      stderr: outcome.stderr + shaped.stderr
-    };
-  } catch {
-    return outcome;
-  }
-}
 async function runObserved(hook, ctx, hookName, eventType, cli) {
   try {
     return await Promise.race([
@@ -10608,8 +10404,7 @@ async function evaluateHookEvent(eventType, cli = "claude", stdinPayload, opts)
         }
       } catch {}
     }
-    const withNotice = attachLeakNotice(eventType, cli, { exitCode: result.exitCode, stdout: result.stdout, stderr: result.stderr }, sessionId);
-    return withNotice;
+    return { exitCode: result.exitCode, stdout: result.stdout, stderr: result.stderr };
   } finally {
     if (opts?.awaitTelemetryFlush ?? true) {
       await flushHookTelemetry();
@@ -10625,8 +10420,6 @@ var init_handler = __esm(() => {
   init_custom_hooks_loader();
   init_hook_activity_store();
   init_delivery_health();
-  init_notice();
-  init_leak_notice();
   init_hook_telemetry();
   init_resolve_permission_mode();
   init_resolve_transcript_path();
@@ -10641,7 +10434,7 @@ var init_handler = __esm(() => {
 
 // src/hooks/worker-server.ts
 import { createConnection, createServer } from "node:net";
-import { existsSync as existsSync18, unlinkSync as unlinkSync2 } from "node:fs";
+import { existsSync as existsSync15, unlinkSync as unlinkSync2 } from "node:fs";
 function isWorkerHookRequest(msg) {
   if (!msg || typeof msg !== "object")
     return false;
@@ -10774,14 +10567,14 @@ function requestExistingWorkerShutdown(socketPath) {
 function startWorkerServer(socketPath, shutdown) {
   const server = createServer((socket) => handleConnection(socket, shutdown ?? (() => server.close())));
   const listen = () => {
-    if (existsSync18(socketPath)) {
+    if (existsSync15(socketPath)) {
       try {
         unlinkSync2(socketPath);
       } catch {}
     }
     server.listen(socketPath);
   };
-  if (!existsSync18(socketPath))
+  if (!existsSync15(socketPath))
     listen();
   else
     requestExistingWorkerShutdown(socketPath).then(listen, (err) => server.emit("error", err));
@@ -10797,13 +10590,13 @@ var init_worker_server = __esm(() => {
 
 // bin/failproofai-worker.mjs
 import { realpathSync as realpathSync2 } from "node:fs";
-import { dirname as dirname7, resolve as resolve15 } from "node:path";
+import { dirname as dirname5, resolve as resolve14 } from "node:path";
 import { fileURLToPath } from "node:url";
 if (!process.env.FAILPROOFAI_PACKAGE_ROOT) {
-  process.env.FAILPROOFAI_PACKAGE_ROOT = resolve15(dirname7(realpathSync2(fileURLToPath(import.meta.url))), "..");
+  process.env.FAILPROOFAI_PACKAGE_ROOT = resolve14(dirname5(realpathSync2(fileURLToPath(import.meta.url))), "..");
 }
 if (!process.env.FAILPROOFAI_DIST_PATH) {
-  process.env.FAILPROOFAI_DIST_PATH = resolve15(dirname7(realpathSync2(fileURLToPath(import.meta.url))), "..", "dist");
+  process.env.FAILPROOFAI_DIST_PATH = resolve14(dirname5(realpathSync2(fileURLToPath(import.meta.url))), "..", "dist");
 }
 var socketPath = process.env.FAILPROOFAI_WORKER_SOCKET;
 if (!socketPath) {