failproofai 1.0.4 → 1.0.5-beta.1

package/dist/cli.mjs

@@ -29,7 +29,7 @@ var __esm = (fn, res, err) => () => {
 var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
 // package.json
-var version2 = "1.0.4", package_default;
+var version2 = "1.0.5-beta.1", package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "failproofai",
@@ -154,16 +154,16 @@ var init_package = __esm(() => {
       browserslist: "4.28.8"
     },
     optionalDependencies: {
-      "@failproofai/failproofaid-linux-x64": "1.0.4",
-      "@failproofai/failproofaid-linux-arm64": "1.0.4",
-      "@failproofai/failproofaid-darwin-x64": "1.0.4",
-      "@failproofai/failproofaid-darwin-arm64": "1.0.4"
+      "@failproofai/failproofaid-linux-x64": "1.0.5-beta.1",
+      "@failproofai/failproofaid-linux-arm64": "1.0.5-beta.1",
+      "@failproofai/failproofaid-darwin-x64": "1.0.5-beta.1",
+      "@failproofai/failproofaid-darwin-arm64": "1.0.5-beta.1"
     },
     failproofaidBinaries: {
-      "linux-x64": "cca1d41ff951784ba084bf2d72cfad0fe8d988f8226e0e7a4538b1fb8d76a5bd",
-      "linux-arm64": "55e9c1e2864cbf6057fd0c27e4bc573ca8fba2cd35d480a3db3a55d398e7bec0",
-      "darwin-x64": "2a46ec77d2cac14a036f35e832f92f16895239814a5f10f02121f3c313e70574",
-      "darwin-arm64": "a0e7ccc6fe24e1017592637192ba8a26c9d05ca839c98bc72a983094c863b39b"
+      "linux-x64": "c782c8d7c8522bf8af6f776640cae80fa671affa5b92d8c09e646c8f381d7fd4",
+      "linux-arm64": "6e9717ef40872a530501ad17cc6bc9743546968e11acf45f87f35488d1563e28",
+      "darwin-x64": "b47adb286e2cf08370ec2e1293ea3ed42891c7d2a8a1bece3da8e3e2b0d72f7a",
+      "darwin-arm64": "a5095522dc3f2518fc8177e9e2a3048062540958e3b623b198b401a7d6a2ddd5"
     }
   };
 });
@@ -15856,6 +15856,22 @@ You MUST complete the above action(s) NOW. Do NOT ask the user for confirmation
           decision: "instruct"
         };
       }
+      if (eventType === "PreToolUse") {
+        return {
+          exitCode: 0,
+          stdout: JSON.stringify({
+            permission: "instruct",
+            reason: `Instruction from failproofai: ${combined}`,
+            policyName: policyNames[0],
+            policyNames
+          }),
+          stderr: "",
+          policyName: policyNames[0],
+          policyNames,
+          reason: combined,
+          decision: "instruct"
+        };
+      }
       const stderrMsg = instructEntries.map((e) => `[failproofai] ${e.policyName}: ${e.reason}`).join(`
 `);
       return {
@@ -17814,13 +17830,169 @@ var init_hermes_projects = __esm(() => {
   getCachedHermesSessionsByEncodedName = runtimeCache((name) => getHermesSessionsByEncodedName(name), 2, { maxSize: 50 });
 });
 
+// lib/openclaw-db.ts
+import { existsSync as existsSync12 } from "node:fs";
+import { join as join14 } from "node:path";
+function str(value) {
+  return typeof value === "string" && value.length > 0 ? value : undefined;
+}
+function parseObject(value) {
+  try {
+    const parsed = JSON.parse(value);
+    return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : undefined;
+  } catch {
+    return;
+  }
+}
+function syntheticPath(agentId, sessionId) {
+  return `openclaw-sqlite://${encodeURIComponent(agentId)}/${sessionId}`;
+}
+function listOpenClawDatabases(home, agentIds) {
+  const out = [];
+  for (const agentId of agentIds) {
+    const dbPath = join14(home, "agents", agentId, "agent", DB_NAME);
+    if (existsSync12(dbPath))
+      out.push({ agentId, dbPath });
+  }
+  return out;
+}
+function readNodeMetadata(db) {
+  const out = new Map;
+  let rows;
+  try {
+    rows = db.query(`SELECT current_session_id, entry_json, label, display_name
+         FROM session_nodes`);
+  } catch {
+    return out;
+  }
+  for (const row of rows) {
+    const entry = parseObject(row.entry_json) ?? {};
+    const origin = entry.origin && typeof entry.origin === "object" && !Array.isArray(entry.origin) ? entry.origin : {};
+    out.set(row.current_session_id, {
+      channel: str(entry.lastChannel) ?? str(origin.provider) ?? str(origin.surface),
+      label: str(row.label) ?? str(row.display_name) ?? str(entry.displayName) ?? str(origin.label),
+      chatId: str(entry.lastTo) ?? str(origin.from),
+      chatType: str(entry.chatType) ?? str(origin.chatType)
+    });
+  }
+  return out;
+}
+function readConversationMetadata(db) {
+  const out = new Map;
+  let rows;
+  try {
+    rows = db.query(`SELECT sc.session_id, c.channel, c.kind, c.peer_id,
+              c.delivery_target, c.label
+         FROM session_conversations sc
+         JOIN conversations c ON c.conversation_id = sc.conversation_id
+        ORDER BY CASE sc.role WHEN 'primary' THEN 0 ELSE 1 END, sc.last_seen_at DESC`);
+  } catch {
+    return out;
+  }
+  for (const row of rows) {
+    if (out.has(row.session_id))
+      continue;
+    out.set(row.session_id, {
+      channel: str(row.channel),
+      label: str(row.label),
+      chatId: str(row.delivery_target) ?? str(row.peer_id),
+      chatType: str(row.kind)
+    });
+  }
+  return out;
+}
+async function listOpenClawSqliteSessions(home, agentIds) {
+  const sessions = [];
+  for (const { agentId, dbPath } of listOpenClawDatabases(home, agentIds)) {
+    const db = await openSqliteReadonly(dbPath);
+    if (!db)
+      continue;
+    try {
+      let rows;
+      try {
+        rows = db.query(`SELECT w.session_id, w.session_key, w.updated_at,
+                  w.transcript_updated_at, w.ended_at, w.channel,
+                  w.chat_type, w.display_name,
+                  COALESCE((SELECT MAX(e.created_at)
+                              FROM transcript_events e
+                             WHERE e.session_id = w.session_id), 0) AS event_updated_at,
+                  COALESCE((SELECT SUM(length(e.event_json) + 1)
+                              FROM transcript_events e
+                             WHERE e.session_id = w.session_id), 0) AS size_bytes
+             FROM session_windows w
+            WHERE EXISTS (SELECT 1 FROM transcript_events e
+                           WHERE e.session_id = w.session_id)`);
+      } catch {
+        continue;
+      }
+      const nodes = readNodeMetadata(db);
+      const conversations = readConversationMetadata(db);
+      for (const row of rows) {
+        const node = nodes.get(row.session_id);
+        const conversation = conversations.get(row.session_id);
+        sessions.push({
+          sessionId: row.session_id,
+          agentId,
+          dbPath,
+          transcriptPath: syntheticPath(agentId, row.session_id),
+          mtimeMs: Math.max(Number(row.updated_at) || 0, Number(row.transcript_updated_at) || 0, Number(row.ended_at) || 0, Number(row.event_updated_at) || 0),
+          sizeBytes: Number(row.size_bytes) || 0,
+          channel: str(row.channel) ?? conversation?.channel ?? node?.channel ?? "local",
+          label: str(row.display_name) ?? conversation?.label ?? node?.label,
+          chatId: conversation?.chatId ?? node?.chatId,
+          chatType: str(row.chat_type) ?? conversation?.chatType ?? node?.chatType
+        });
+      }
+    } finally {
+      db.close();
+    }
+  }
+  return sessions;
+}
+async function readOpenClawSqliteTranscript(home, agentIds, sessionId) {
+  for (const { agentId, dbPath } of listOpenClawDatabases(home, agentIds)) {
+    const db = await openSqliteReadonly(dbPath);
+    if (!db)
+      continue;
+    try {
+      let rows;
+      try {
+        rows = db.query(`SELECT event_json
+             FROM transcript_events
+            WHERE session_id = ?
+            ORDER BY seq ASC`, [sessionId]);
+      } catch {
+        continue;
+      }
+      if (rows.length === 0)
+        continue;
+      const eventJsonLines = rows.map((row) => row.event_json);
+      const rawLines = eventJsonLines.map(parseObject).filter((line) => line !== undefined);
+      return {
+        agentId,
+        dbPath,
+        filePath: syntheticPath(agentId, sessionId),
+        rawLines,
+        eventJsonLines
+      };
+    } finally {
+      db.close();
+    }
+  }
+  return null;
+}
+var DB_NAME = "openclaw-agent.sqlite";
+var init_openclaw_db = __esm(() => {
+  init_sqlite_reader();
+});
+
 // lib/openclaw-sessions.ts
 import { readFile as readFile7 } from "node:fs/promises";
 import { readdirSync as readdirSync5, statSync as statSync7 } from "node:fs";
 import { homedir as homedir12 } from "node:os";
-import { join as join14 } from "node:path";
+import { join as join15 } from "node:path";
 function openclawHome() {
-  return process.env.OPENCLAW_HOME || join14(homedir12(), ".openclaw");
+  return process.env.OPENCLAW_STATE_DIR || process.env.OPENCLAW_HOME || join15(homedir12(), ".openclaw");
 }
 function isPlainObject3(v) {
   return !!v && typeof v === "object" && !Array.isArray(v);
@@ -17907,7 +18079,11 @@ function openclawLinesToLogEntries(lines, source = "session") {
       entries.push({
         type: "assistant",
         ...base,
-        message: { role: "assistant", content: blocks, model: typeof m.model === "string" ? m.model : undefined }
+        message: {
+          role: "assistant",
+          content: blocks,
+          model: typeof m.model === "string" ? m.model : undefined
+        }
       });
       continue;
     }
@@ -17935,13 +18111,13 @@ function openclawLinesToLogEntries(lines, source = "session") {
 }
 function listOpenClawAgents() {
   try {
-    return readdirSync5(join14(openclawHome(), "agents"), { withFileTypes: true }).filter((d) => d.isDirectory() && !d.name.startsWith(".")).map((d) => d.name).sort();
+    return readdirSync5(join15(openclawHome(), "agents"), { withFileTypes: true }).filter((d) => d.isDirectory() && !d.name.startsWith(".")).map((d) => d.name).sort();
   } catch {
     return [];
   }
 }
 function listOpenClawTranscripts() {
-  const agentsDir = join14(openclawHome(), "agents");
+  const agentsDir = join15(openclawHome(), "agents");
   const out = [];
   let agentIds;
   try {
@@ -17950,7 +18126,7 @@ function listOpenClawTranscripts() {
     return out;
   }
   for (const agentId of agentIds) {
-    const sessionsDir = join14(agentsDir, agentId, "sessions");
+    const sessionsDir = join15(agentsDir, agentId, "sessions");
     let files;
     try {
       files = readdirSync5(sessionsDir);
@@ -17963,10 +18139,16 @@ function listOpenClawTranscripts() {
       const sessionId = file.slice(0, -".jsonl".length);
       if (!OPENCLAW_SESSION_ID_RE.test(sessionId))
         continue;
-      const transcriptPath = join14(sessionsDir, file);
+      const transcriptPath = join15(sessionsDir, file);
       try {
         const st = statSync7(transcriptPath);
-        out.push({ agentId, sessionId, transcriptPath, mtimeMs: st.mtimeMs, sizeBytes: st.size });
+        out.push({
+          agentId,
+          sessionId,
+          transcriptPath,
+          mtimeMs: st.mtimeMs,
+          sizeBytes: st.size
+        });
       } catch {}
     }
   }
@@ -17982,6 +18164,25 @@ function findOpenClawTranscript(sessionId) {
   return null;
 }
 async function getOpenClawSessionLog(sessionId) {
+  if (!OPENCLAW_SESSION_ID_RE.test(sessionId))
+    return null;
+  const sqlite = await readOpenClawSqliteTranscript(openclawHome(), listOpenClawAgents(), sessionId);
+  if (sqlite) {
+    const entries = openclawLinesToLogEntries(sqlite.rawLines, "session");
+    let cwd;
+    for (const line of sqlite.rawLines) {
+      if (line.type === "session" && typeof line.cwd === "string" && line.cwd.length > 0) {
+        cwd = line.cwd;
+        break;
+      }
+    }
+    return {
+      entries,
+      rawLines: sqlite.rawLines,
+      cwd,
+      filePath: sqlite.filePath
+    };
+  }
   const filePath = findOpenClawTranscript(sessionId);
   if (!filePath)
     return null;
@@ -18005,6 +18206,7 @@ async function getOpenClawSessionLog(sessionId) {
 var OPENCLAW_SESSION_ID_RE, getCachedOpenClawSessionLog;
 var init_openclaw_sessions = __esm(() => {
   init_log_entries();
+  init_openclaw_db();
   OPENCLAW_SESSION_ID_RE = /^[0-9a-fA-F-]{36}$/;
   getCachedOpenClawSessionLog = runtimeCache((sessionId) => getOpenClawSessionLog(sessionId), 2, { maxSize: 50 });
 });
@@ -18017,13 +18219,13 @@ __export(exports_openclaw_projects, {
   openClawProjectPath: () => openClawProjectPath
 });
 import { readFileSync as readFileSync9 } from "node:fs";
-import { join as join15 } from "node:path";
-function str(v) {
+import { join as join16 } from "node:path";
+function str2(v) {
   return typeof v === "string" && v.length > 0 ? v : undefined;
 }
 function readSessionsIndex(agentId) {
   const out = new Map;
-  const indexPath = join15(openclawHome(), "agents", agentId, "sessions", "sessions.json");
+  const indexPath = join16(openclawHome(), "agents", agentId, "sessions", "sessions.json");
   let raw;
   try {
     raw = JSON.parse(readFileSync9(indexPath, "utf-8"));
@@ -18036,17 +18238,17 @@ function readSessionsIndex(agentId) {
     if (!v || typeof v !== "object")
       continue;
     const e = v;
-    const sessionId = str(e.sessionId);
+    const sessionId = str2(e.sessionId);
     if (!sessionId)
       continue;
     const origin = e.origin && typeof e.origin === "object" ? e.origin : {};
     const lastMs = typeof e.lastInteractionAt === "number" ? e.lastInteractionAt : typeof e.updatedAt === "number" ? e.updatedAt : undefined;
     out.set(sessionId, {
       lastMs,
-      channel: str(e.lastChannel) ?? str(origin.provider) ?? str(origin.surface),
-      chatType: str(e.chatType) ?? str(origin.chatType),
-      label: str(origin.label),
-      chatId: str(e.lastTo) ?? str(origin.from)
+      channel: str2(e.lastChannel) ?? str2(origin.provider) ?? str2(origin.surface),
+      chatType: str2(e.chatType) ?? str2(origin.chatType),
+      label: str2(origin.label),
+      chatId: str2(e.lastTo) ?? str2(origin.from)
     });
   }
   return out;
@@ -18054,7 +18256,7 @@ function readSessionsIndex(agentId) {
 async function getOpenClawSessions() {
   const transcripts = listOpenClawTranscripts();
   const indexByAgent = new Map;
-  const refs = [];
+  const refs = new Map;
   for (const t of transcripts) {
     let idx = indexByAgent.get(t.agentId);
     if (!idx) {
@@ -18062,7 +18264,7 @@ async function getOpenClawSessions() {
       indexByAgent.set(t.agentId, idx);
     }
     const meta = idx.get(t.sessionId);
-    refs.push({
+    refs.set(`${t.agentId}\x00${t.sessionId}`, {
       sessionId: t.sessionId,
       agentId: t.agentId,
       channel: meta?.channel ?? "local",
@@ -18074,8 +18276,11 @@ async function getOpenClawSessions() {
       sizeBytes: t.sizeBytes
     });
   }
-  refs.sort((a, b) => b.mtimeMs - a.mtimeMs);
-  return refs;
+  const sqliteSessions = await listOpenClawSqliteSessions(openclawHome(), listOpenClawAgents());
+  for (const s of sqliteSessions) {
+    refs.set(`${s.agentId}\x00${s.sessionId}`, s);
+  }
+  return [...refs.values()].sort((a, b) => b.mtimeMs - a.mtimeMs);
 }
 function openClawProjectName(agentId, channel) {
   return `openclaw-${agentId}-${channel}`;
@@ -18110,7 +18315,12 @@ async function getOpenClawProjects() {
       prev.latest = Math.max(prev.latest, s.mtimeMs);
       prev.count += 1;
     } else {
-      groups.set(key, { agentId: s.agentId, channel: s.channel, latest: s.mtimeMs, count: 1 });
+      groups.set(key, {
+        agentId: s.agentId,
+        channel: s.channel,
+        latest: s.mtimeMs,
+        count: 1
+      });
     }
   }
   const out = [];
@@ -18168,6 +18378,7 @@ async function getOpenClawSessionsByEncodedName(name) {
 var getCachedOpenClawSessions, getCachedOpenClawProjects, getCachedOpenClawSessionsByEncodedName;
 var init_openclaw_projects = __esm(() => {
   init_openclaw_sessions();
+  init_openclaw_db();
   getCachedOpenClawSessions = runtimeCache(getOpenClawSessions, 2);
   getCachedOpenClawProjects = runtimeCache(getOpenClawProjects, 2);
   getCachedOpenClawSessionsByEncodedName = runtimeCache((name) => getOpenClawSessionsByEncodedName(name), 2, { maxSize: 50 });
@@ -18177,12 +18388,12 @@ var init_openclaw_projects = __esm(() => {
 import { readFile as readFile8 } from "node:fs/promises";
 import { readdirSync as readdirSync6, statSync as statSync8 } from "node:fs";
 import { homedir as homedir13 } from "node:os";
-import { join as join16 } from "node:path";
+import { join as join17 } from "node:path";
 function factoryHome() {
-  return process.env.FACTORY_HOME || join16(homedir13(), ".factory");
+  return process.env.FACTORY_HOME || join17(homedir13(), ".factory");
 }
 function factorySessionsRoot() {
-  return join16(factoryHome(), "sessions");
+  return join17(factoryHome(), "sessions");
 }
 function isPlainObject4(v) {
   return !!v && typeof v === "object" && !Array.isArray(v);
@@ -18328,7 +18539,7 @@ function listFactoryTranscripts() {
   for (const dir of projectDirs) {
     const projectName = dir.name;
     const cwd = decodeFolderName(projectName);
-    const projectPath = join16(root, projectName);
+    const projectPath = join17(root, projectName);
     let files;
     try {
       files = readdirSync6(projectPath);
@@ -18341,7 +18552,7 @@ function listFactoryTranscripts() {
       const sessionId = file.slice(0, -".jsonl".length);
       if (!FACTORY_SESSION_ID_RE.test(sessionId))
         continue;
-      const transcriptPath = join16(projectPath, file);
+      const transcriptPath = join17(projectPath, file);
       try {
         const st = statSync8(transcriptPath);
         out.push({ projectName, cwd, sessionId, transcriptPath, mtimeMs: st.mtimeMs, sizeBytes: st.size });
@@ -18465,12 +18676,12 @@ var init_factory_projects = __esm(() => {
 
 // lib/devin-sessions.ts
 import { homedir as homedir14 } from "node:os";
-import { join as join17 } from "node:path";
+import { join as join18 } from "node:path";
 function devinHome() {
-  return process.env.DEVIN_HOME || join17(homedir14(), ".local", "share", "devin");
+  return process.env.DEVIN_HOME || join18(homedir14(), ".local", "share", "devin");
 }
 function devinDbPath() {
-  return process.env.DEVIN_DB_PATH || join17(devinHome(), "cli", "sessions.db");
+  return process.env.DEVIN_DB_PATH || join18(devinHome(), "cli", "sessions.db");
 }
 function devinEpochToMs(value) {
   if (typeof value === "number" && Number.isFinite(value)) {
@@ -18765,15 +18976,15 @@ var init_devin_projects = __esm(() => {
 import { readFile as readFile9 } from "node:fs/promises";
 import { readdirSync as readdirSync7, statSync as statSync9 } from "node:fs";
 import { homedir as homedir15 } from "node:os";
-import { join as join18 } from "node:path";
+import { join as join19 } from "node:path";
 function antigravityHome() {
-  return process.env.ANTIGRAVITY_HOME || join18(homedir15(), ".gemini", "antigravity-cli");
+  return process.env.ANTIGRAVITY_HOME || join19(homedir15(), ".gemini", "antigravity-cli");
 }
 function antigravityBrainRoot() {
-  return join18(antigravityHome(), "brain");
+  return join19(antigravityHome(), "brain");
 }
 function antigravityTranscriptRelPath() {
-  return join18(".system_generated", "logs", "transcript_full.jsonl");
+  return join19(".system_generated", "logs", "transcript_full.jsonl");
 }
 function isPlainObject6(v) {
   return !!v && typeof v === "object" && !Array.isArray(v);
@@ -18896,7 +19107,7 @@ function listAntigravityTranscripts() {
     const conversationId = dir.name;
     if (!ANTIGRAVITY_CONVERSATION_ID_RE.test(conversationId))
       continue;
-    const transcriptPath = join18(root, conversationId, rel);
+    const transcriptPath = join19(root, conversationId, rel);
     try {
       const st = statSync9(transcriptPath);
       if (!st.isFile())
@@ -18909,7 +19120,7 @@ function listAntigravityTranscripts() {
 function findAntigravityTranscript(conversationId) {
   if (!ANTIGRAVITY_CONVERSATION_ID_RE.test(conversationId))
     return null;
-  const transcriptPath = join18(antigravityBrainRoot(), conversationId, antigravityTranscriptRelPath());
+  const transcriptPath = join19(antigravityBrainRoot(), conversationId, antigravityTranscriptRelPath());
   try {
     if (statSync9(transcriptPath).isFile())
       return transcriptPath;
@@ -18945,9 +19156,9 @@ __export(exports_antigravity_projects, {
   getAntigravityIndex: () => getAntigravityIndex,
   getAntigravityProjects: () => getAntigravityProjects
 });
-import { join as join19 } from "node:path";
+import { join as join20 } from "node:path";
 function antigravitySummariesDbPath() {
-  return join19(antigravityHome(), "conversation_summaries.db");
+  return join20(antigravityHome(), "conversation_summaries.db");
 }
 function parseWorkspaceCwd(raw) {
   if (!raw)
@@ -19091,15 +19302,15 @@ var init_antigravity_projects = __esm(() => {
 
 // lib/goose-sessions.ts
 import { homedir as homedir16 } from "node:os";
-import { join as join20 } from "node:path";
+import { join as join21 } from "node:path";
 function gooseHome() {
   if (process.env.GOOSE_HOME)
     return process.env.GOOSE_HOME;
   const xdg = process.env.XDG_DATA_HOME;
-  return join20(xdg && xdg.length > 0 ? xdg : join20(homedir16(), ".local", "share"), "goose");
+  return join21(xdg && xdg.length > 0 ? xdg : join21(homedir16(), ".local", "share"), "goose");
 }
 function gooseDbPath() {
-  return process.env.GOOSE_DB_PATH || join20(gooseHome(), "sessions", "sessions.db");
+  return process.env.GOOSE_DB_PATH || join21(gooseHome(), "sessions", "sessions.db");
 }
 function gooseTimestampToMs(value) {
   if (typeof value === "number" && Number.isFinite(value)) {
@@ -19363,7 +19574,7 @@ var init_goose_projects = __esm(() => {
 
 // lib/projects.ts
 import { readdir as readdir5, stat as stat4 } from "node:fs/promises";
-import { join as join21, resolve as resolve11, sep } from "node:path";
+import { join as join22, resolve as resolve11, sep } from "node:path";
 async function getMtime(path, label) {
   try {
     return (await stat4(path)).mtime;
@@ -19389,7 +19600,7 @@ async function getClaudeProjectFolders() {
     if (!entries)
       return [];
     const settled = await batchAll(entries.filter((entry) => entry.isDirectory()).map((entry) => async () => {
-      const folderPath = join21(projectsPath, entry.name);
+      const folderPath = join22(projectsPath, entry.name);
       const mtime = await getMtime(folderPath, entry.name);
       return {
         name: entry.name,
@@ -19516,7 +19727,7 @@ function resolveProjectPath(projectName) {
   if (/^[/\\]/.test(projectName))
     throw new RangeError("Absolute project name");
   const projectsPath = resolve11(getClaudeProjectsPath());
-  const candidate = resolve11(join21(projectsPath, projectName));
+  const candidate = resolve11(join22(projectsPath, projectName));
   if (!candidate.startsWith(projectsPath + sep)) {
     throw new RangeError("Project path escapes root");
   }
@@ -19534,7 +19745,7 @@ async function getSessionFiles(projectPath) {
       return [];
     const jsonlEntries = entries.filter((entry) => entry.isFile() && entry.name.endsWith(".jsonl") && extractSessionId2(entry.name));
     const settled = await batchAll(jsonlEntries.map((entry) => async () => {
-      const filePath = join21(projectPath, entry.name);
+      const filePath = join22(projectPath, entry.name);
       const mtime = await getMtime(filePath, entry.name);
       return {
         name: entry.name,
@@ -19563,13 +19774,13 @@ var init_projects = __esm(() => {
 
 // lib/resolve-subagent-path.ts
 import { access as access2 } from "fs/promises";
-import { join as join22, relative as relative3 } from "path";
+import { join as join23, relative as relative3 } from "path";
 async function resolveSubagentPath(projectsPath, projectName, sessionId, agentId) {
   const fileName = `agent-${agentId}.jsonl`;
   const candidatePaths = [
-    join22(projectsPath, projectName, fileName),
-    join22(projectsPath, projectName, sessionId, fileName),
-    join22(projectsPath, projectName, sessionId, "subagents", fileName)
+    join23(projectsPath, projectName, fileName),
+    join23(projectsPath, projectName, sessionId, fileName),
+    join23(projectsPath, projectName, sessionId, "subagents", fileName)
   ];
   for (const candidatePath of candidatePaths) {
     if (relative3(projectsPath, candidatePath).startsWith("..")) {
@@ -19591,7 +19802,7 @@ var init_resolve_subagent_path = () => {};
 
 // lib/log-entries.ts
 import { readFile as readFile10 } from "fs/promises";
-import { join as join23 } from "path";
+import { join as join24 } from "path";
 function formatTimestamp(date) {
   const base = formatDate(date);
   const ms = date.getMilliseconds().toString().padStart(3, "0");
@@ -19789,7 +20000,7 @@ async function parseLogContent(fileContent, source = "session") {
 async function parseSessionLog(projectName, sessionId) {
   const projectDir = resolveProjectPath(projectName);
   const projectsPath = getClaudeProjectsPath();
-  const filePath = join23(projectDir, `${sessionId}.jsonl`);
+  const filePath = join24(projectDir, `${sessionId}.jsonl`);
   const fileContent = await readFile10(filePath, "utf-8");
   const { entries: sessionEntries, rawLines: sessionRawLines, subagentIds } = await parseFileContent(fileContent, "session");
   if (subagentIds.length === 0) {
@@ -19826,13 +20037,13 @@ var init_log_entries = __esm(() => {
 });
 
 // lib/codex-sessions.ts
-import { readFileSync as readFileSync10, readdirSync as readdirSync8, existsSync as existsSync12, writeFileSync as writeFileSync6, mkdirSync as mkdirSync7, statSync as statSync10 } from "node:fs";
+import { readFileSync as readFileSync10, readdirSync as readdirSync8, existsSync as existsSync13, writeFileSync as writeFileSync6, mkdirSync as mkdirSync7, statSync as statSync10 } from "node:fs";
 import { readFile as readFile11 } from "node:fs/promises";
-import { dirname as dirname7, join as join24 } from "node:path";
+import { dirname as dirname7, join as join25 } from "node:path";
 import { homedir as homedir17 } from "node:os";
 function readCache() {
   try {
-    if (!existsSync12(CACHE_PATH))
+    if (!existsSync13(CACHE_PATH))
       return {};
     return JSON.parse(readFileSync10(CACHE_PATH, "utf-8"));
   } catch {
@@ -19851,7 +20062,7 @@ function dirSearch(dir, sessionId) {
   try {
     for (const f of readdirSync8(dir, { withFileTypes: true })) {
       if (f.isFile() && f.name.includes(sessionId) && f.name.endsWith(".jsonl")) {
-        return join24(dir, f.name);
+        return join25(dir, f.name);
       }
     }
   } catch {}
@@ -19860,16 +20071,16 @@ function dirSearch(dir, sessionId) {
 function findCodexTranscript(sessionId) {
   const cache = readCache();
   const cached = cache[sessionId];
-  if (cached && existsSync12(cached))
+  if (cached && existsSync13(cached))
     return cached;
-  const root = join24(homedir17(), ".codex", "sessions");
+  const root = join25(homedir17(), ".codex", "sessions");
   const today = new Date;
   const yesterday = new Date(today.getTime() - 24 * 60 * 60 * 1000);
   const datedDirs = [today, yesterday].map((d) => {
     const y = String(d.getUTCFullYear());
     const m = String(d.getUTCMonth() + 1).padStart(2, "0");
     const day = String(d.getUTCDate()).padStart(2, "0");
-    return join24(root, y, m, day);
+    return join25(root, y, m, day);
   });
   for (const dir of datedDirs) {
     const hit = dirSearch(dir, sessionId);
@@ -19882,13 +20093,13 @@ function findCodexTranscript(sessionId) {
     for (const y of readdirSync8(root, { withFileTypes: true })) {
       if (!y.isDirectory())
         continue;
-      for (const m of readdirSync8(join24(root, y.name), { withFileTypes: true })) {
+      for (const m of readdirSync8(join25(root, y.name), { withFileTypes: true })) {
         if (!m.isDirectory())
           continue;
-        for (const d of readdirSync8(join24(root, y.name, m.name), { withFileTypes: true })) {
+        for (const d of readdirSync8(join25(root, y.name, m.name), { withFileTypes: true })) {
           if (!d.isDirectory())
             continue;
-          const hit = dirSearch(join24(root, y.name, m.name, d.name), sessionId);
+          const hit = dirSearch(join25(root, y.name, m.name, d.name), sessionId);
           if (hit) {
             writeCacheEntry(sessionId, hit);
             return hit;
@@ -20154,15 +20365,15 @@ var init_resolve_permission_mode = __esm(() => {
 });
 
 // lib/copilot-sessions.ts
-import { readFileSync as readFileSync12, readdirSync as readdirSync9, existsSync as existsSync13, statSync as statSync11 } from "node:fs";
+import { readFileSync as readFileSync12, readdirSync as readdirSync9, existsSync as existsSync14, statSync as statSync11 } from "node:fs";
 import { readFile as readFile12 } from "node:fs/promises";
-import { join as join25, resolve as resolve12, sep as sep2 } from "node:path";
+import { join as join26, resolve as resolve12, sep as sep2 } from "node:path";
 import { homedir as homedir18 } from "node:os";
 function getCopilotHome() {
-  return process.env.COPILOT_HOME || join25(homedir18(), ".copilot");
+  return process.env.COPILOT_HOME || join26(homedir18(), ".copilot");
 }
 function getCopilotSessionStateRoot2() {
-  return join25(getCopilotHome(), "session-state");
+  return join26(getCopilotHome(), "session-state");
 }
 function getCopilotSessionDir(sessionId) {
   if (!sessionId)
@@ -20177,19 +20388,19 @@ function resolveSessionFile(sessionId, filename) {
   const dir = getCopilotSessionDir(sessionId);
   if (!dir)
     return null;
-  return join25(dir, filename);
+  return join26(dir, filename);
 }
 function findCopilotTranscript(sessionId) {
   const candidate = resolveSessionFile(sessionId, "events.jsonl");
   if (!candidate)
     return null;
-  return existsSync13(candidate) ? candidate : null;
+  return existsSync14(candidate) ? candidate : null;
 }
 function findCopilotWorkspace(sessionId) {
   const candidate = resolveSessionFile(sessionId, "workspace.yaml");
   if (!candidate)
     return null;
-  return existsSync13(candidate) ? candidate : null;
+  return existsSync14(candidate) ? candidate : null;
 }
 function readYamlScalar(path, key) {
   try {
@@ -20371,12 +20582,12 @@ var init_copilot_sessions = __esm(() => {
 });
 
 // lib/cursor-sessions.ts
-import { readFileSync as readFileSync13, readdirSync as readdirSync10, existsSync as existsSync14, statSync as statSync12 } from "node:fs";
+import { readFileSync as readFileSync13, readdirSync as readdirSync10, existsSync as existsSync15, statSync as statSync12 } from "node:fs";
 import { readFile as readFile13 } from "node:fs/promises";
-import { basename as basename3, join as join26, resolve as resolve13, sep as sep3 } from "node:path";
+import { basename as basename3, join as join27, resolve as resolve13, sep as sep3 } from "node:path";
 import { homedir as homedir19 } from "node:os";
 function getCursorHome2() {
-  return process.env.CURSOR_HOME || join26(homedir19(), ".cursor");
+  return process.env.CURSOR_HOME || join27(homedir19(), ".cursor");
 }
 function getCursorSessionDir(sessionId) {
   if (!sessionId)
@@ -20394,7 +20605,7 @@ function getCursorSessionDir(sessionId) {
     const transcriptRoot = resolve13(projectsRoot, entry.name, NEW_AGENT_TRANSCRIPTS_DIR2);
     if (candidate === transcriptRoot || !candidate.startsWith(`${transcriptRoot}${sep3}`))
       continue;
-    if (existsSync14(candidate))
+    if (existsSync15(candidate))
       return candidate;
   }
   for (const sub of LEGACY_SESSION_ROOT_CANDIDATES2) {
@@ -20402,7 +20613,7 @@ function getCursorSessionDir(sessionId) {
     const candidate = resolve13(root, sessionId);
     if (candidate === root || !candidate.startsWith(`${root}${sep3}`))
       continue;
-    if (existsSync14(candidate))
+    if (existsSync15(candidate))
       return candidate;
   }
   return null;
@@ -20411,12 +20622,12 @@ function findCursorTranscript(sessionId) {
   const dir = getCursorSessionDir(sessionId);
   if (!dir)
     return null;
-  const newCandidate = join26(dir, `${basename3(dir)}.jsonl`);
-  if (existsSync14(newCandidate))
+  const newCandidate = join27(dir, `${basename3(dir)}.jsonl`);
+  if (existsSync15(newCandidate))
     return newCandidate;
   for (const name of LEGACY_TRANSCRIPT_FILE_CANDIDATES2) {
-    const candidate = join26(dir, name);
-    if (existsSync14(candidate))
+    const candidate = join27(dir, name);
+    if (existsSync15(candidate))
       return candidate;
   }
   return null;
@@ -20627,12 +20838,12 @@ var init_cursor_sessions = __esm(() => {
 });
 
 // lib/pi-sessions.ts
-import { readFileSync as readFileSync14, readdirSync as readdirSync11, existsSync as existsSync15, statSync as statSync13 } from "node:fs";
+import { readFileSync as readFileSync14, readdirSync as readdirSync11, existsSync as existsSync16, statSync as statSync13 } from "node:fs";
 import { readFile as readFile14 } from "node:fs/promises";
-import { join as join27, resolve as resolve14, sep as sep4 } from "node:path";
+import { join as join28, resolve as resolve14, sep as sep4 } from "node:path";
 import { homedir as homedir20 } from "node:os";
 function getPiSessionStateRoot() {
-  return process.env.PI_SESSIONS_DIR || join27(homedir20(), ".pi", "agent", "sessions");
+  return process.env.PI_SESSIONS_DIR || join28(homedir20(), ".pi", "agent", "sessions");
 }
 function isSafeSessionId(sessionId) {
   return UUID_RE.test(sessionId);
@@ -20664,7 +20875,7 @@ function findPiTranscript(sessionId) {
       const candidate = resolve14(cwdPath, f);
       if (!candidate.startsWith(`${cwdPath}${sep4}`))
         continue;
-      if (existsSync15(candidate))
+      if (existsSync16(candidate))
         return candidate;
     }
   }
@@ -21070,7 +21281,7 @@ var init_pack_failclosed = __esm(() => {
 // lib/atomic-write.ts
 import {
   chmodSync as chmodSync2,
-  existsSync as existsSync16,
+  existsSync as existsSync17,
   mkdirSync as mkdirSync8,
   renameSync as renameSync4,
   rmSync as rmSync3,
@@ -21083,7 +21294,7 @@ function writeJsonAtomically(filePath, value, opts = {}) {
   const mode = opts.mode ?? 384;
   const dirMode = opts.dirMode ?? 448;
   const dir = dirname8(filePath);
-  if (!existsSync16(dir))
+  if (!existsSync17(dir))
     mkdirSync8(dir, { recursive: true, mode: dirMode });
   const tmp = `${filePath}.${process.pid}.${randomBytes(6).toString("hex")}.tmp`;
   try {
@@ -21107,9 +21318,9 @@ function writeJsonAtomically(filePath, value, opts = {}) {
 var init_atomic_write = () => {};
 
 // src/hooks/session-pause.ts
-import { existsSync as existsSync17, mkdirSync as mkdirSync9, readdirSync as readdirSync12, readFileSync as readFileSync15, rmSync as rmSync4 } from "node:fs";
+import { existsSync as existsSync18, mkdirSync as mkdirSync9, readdirSync as readdirSync12, readFileSync as readFileSync15, rmSync as rmSync4 } from "node:fs";
 import { createHash as createHash6 } from "node:crypto";
-import { join as join28, resolve as resolve15 } from "node:path";
+import { join as join29, resolve as resolve15 } from "node:path";
 function pauseStateDir() {
   const override = process.env.FAILPROOFAI_STATE_DIR;
   if (override)
@@ -21118,7 +21329,7 @@ function pauseStateDir() {
 }
 function pauseFilePath(sessionId) {
   const digest = createHash6("sha256").update(sessionId).digest("hex").slice(0, 32);
-  return join28(pauseStateDir(), `${digest}.json`);
+  return join29(pauseStateDir(), `${digest}.json`);
 }
 function parsePauseDuration(input, ceilingMs = PAUSE_CEILING_MS) {
   if (input === undefined || input === "")
@@ -21174,7 +21385,7 @@ function readActivePause(sessionId, now = Date.now()) {
     return null;
   try {
     const path = pauseFilePath(sessionId);
-    if (!existsSync17(path))
+    if (!existsSync18(path))
       return null;
     const stored = parseStored(JSON.parse(readFileSync15(path, "utf8")));
     if (!stored)
@@ -21205,7 +21416,7 @@ function writePause(opts) {
 }
 function clearPause(sessionId) {
   const path = pauseFilePath(sessionId);
-  if (!existsSync17(path))
+  if (!existsSync18(path))
     return false;
   try {
     rmSync4(path);
@@ -21216,7 +21427,7 @@ function clearPause(sessionId) {
 }
 function listActivePauses(now = Date.now()) {
   const dir = pauseStateDir();
-  if (!existsSync17(dir))
+  if (!existsSync18(dir))
     return [];
   const out = [];
   let names;
@@ -21229,7 +21440,7 @@ function listActivePauses(now = Date.now()) {
     if (!name.endsWith(".json"))
       continue;
     try {
-      const stored = parseStored(JSON.parse(readFileSync15(join28(dir, name), "utf8")));
+      const stored = parseStored(JSON.parse(readFileSync15(join29(dir, name), "utf8")));
       if (!stored || stored.expiresAt <= now)
         continue;
       const { schemaVersion: _ignored, ...pause } = stored;
@@ -21270,7 +21481,7 @@ var init_session_pause = __esm(() => {
 import { createHash as createHash7 } from "node:crypto";
 import {
   chmodSync as chmodSync3,
-  existsSync as existsSync18,
+  existsSync as existsSync19,
   mkdirSync as mkdirSync10,
   readdirSync as readdirSync13,
   readFileSync as readFileSync16,
@@ -21322,7 +21533,7 @@ function platformPackageBinary(dir) {
     return null;
   }
   const candidate = resolve16(dir, "bin", "failproofaid");
-  return existsSync18(candidate) ? candidate : null;
+  return existsSync19(candidate) ? candidate : null;
 }
 function pruneOldDaemonBinaries(keep = 2) {
   const removed = [];
@@ -21400,7 +21611,7 @@ function digestFor2(manifest, assetName) {
 }
 async function downloadFailproofaidBinary(key) {
   const target = installedBinaryPath();
-  if (existsSync18(target))
+  if (existsSync19(target))
     return { path: target };
   if (process.env.FAILPROOFAI_NO_DOWNLOAD) {
     return { error: "daemon downloads are disabled (FAILPROOFAI_NO_DOWNLOAD)" };
@@ -21434,10 +21645,10 @@ var init_daemon_download = __esm(() => {
 
 // src/hooks/daemon-client.ts
 import { createConnection as createConnection2 } from "node:net";
-import { existsSync as existsSync19 } from "node:fs";
+import { existsSync as existsSync20 } from "node:fs";
 function daemonSocketPresent() {
   try {
-    return existsSync19(socketPath2());
+    return existsSync20(socketPath2());
   } catch {
     return false;
   }
@@ -21563,7 +21774,7 @@ var init_daemon_client2 = __esm(() => {
 
 // src/hooks/daemon-service.ts
 import {
-  existsSync as existsSync20,
+  existsSync as existsSync21,
   mkdirSync as mkdirSync11,
   mkdtempSync,
   readFileSync as readFileSync17,
@@ -21594,13 +21805,13 @@ function resolveFailproofaidBinaryPath() {
   if (process.env.FAILPROOFAI_DAEMON_BINARY)
     return process.env.FAILPROOFAI_DAEMON_BINARY;
   const downloaded = installedBinaryPath();
-  if (existsSync20(downloaded))
+  if (existsSync21(downloaded))
     return downloaded;
   const packageRoot = process.env.FAILPROOFAI_PACKAGE_ROOT;
   if (packageRoot) {
     for (const profile of ["release", "debug"]) {
       const candidate = resolve17(packageRoot, "target", profile, "failproofaid");
-      if (existsSync20(candidate))
+      if (existsSync21(candidate))
         return candidate;
     }
   }
@@ -21631,7 +21842,7 @@ function resolveWorkerCommand() {
   if (!packageRoot)
     return null;
   const workerScript = resolve17(packageRoot, "dist", "worker.mjs");
-  if (!existsSync20(workerScript))
+  if (!existsSync21(workerScript))
     return null;
   return `${shellQuote(process.execPath)} ${shellQuote(workerScript)}`;
 }
@@ -21642,7 +21853,7 @@ function resolveCliCommand() {
   if (!packageRoot)
     return null;
   const cliScript = resolve17(packageRoot, "dist", "cli.mjs");
-  if (!existsSync20(cliScript))
+  if (!existsSync21(cliScript))
     return null;
   return `${shellQuote(process.execPath)} ${shellQuote(cliScript)}`;
 }
@@ -21656,7 +21867,7 @@ function workerScriptPath() {
   if (!packageRoot)
     return null;
   const workerScript = resolve17(packageRoot, "dist", "worker.mjs");
-  return existsSync20(workerScript) ? workerScript : null;
+  return existsSync21(workerScript) ? workerScript : null;
 }
 function assertUnitSafe(value, field) {
   if (UNIT_UNSAFE_RE.test(value)) {
@@ -21755,7 +21966,7 @@ function removeLegacyUserService() {
   try {
     if (process.platform === "linux") {
       const legacy = legacySystemdUserUnitPath();
-      if (!existsSync20(legacy))
+      if (!existsSync21(legacy))
         return;
       try {
         execFileSync2("systemctl", ["--user", "disable", "--now", "failproofaid.service"], {
@@ -21772,7 +21983,7 @@ function removeLegacyUserService() {
       } catch {}
     } else {
       const legacyAgent = legacyLaunchAgentPlistPath();
-      if (existsSync20(legacyAgent)) {
+      if (existsSync21(legacyAgent)) {
         try {
           execFileSync2("launchctl", ["unload", "-w", legacyAgent], {
             stdio: "ignore",
@@ -21782,7 +21993,7 @@ function removeLegacyUserService() {
         unlinkSync3(legacyAgent);
       }
       const legacyDaemon = legacySharedLaunchDaemonPath();
-      if (existsSync20(legacyDaemon)) {
+      if (existsSync21(legacyDaemon)) {
         try {
           runPrivileged("launchctl", ["unload", "-w", legacyDaemon]);
         } catch {}
@@ -21799,7 +22010,7 @@ function systemdUnitContents(binaryPath, workerCmd, cliCmd = null) {
   const user = assertUnitSafe(serviceUser(), "User");
   assertUnitSafe(binaryPath, "ExecStart");
   assertUnitSafe(homedir21(), "HOME");
-  const conditionPaths = [binaryPath, workerScriptPath()].filter((p) => typeof p === "string" && existsSync20(p));
+  const conditionPaths = [binaryPath, workerScriptPath()].filter((p) => typeof p === "string" && existsSync21(p));
   const conditionLines = conditionPaths.map((p) => `ConditionPathExists=${assertUnitSafe(p, "ConditionPathExists")}
 `).join("");
   return `[Unit]
@@ -21994,7 +22205,7 @@ function readInstalledServiceDefinition() {
   if (!isDaemonSupportedPlatform())
     return null;
   const path = daemonServiceFilePath();
-  if (!path || !existsSync20(path))
+  if (!path || !existsSync21(path))
     return null;
   try {
     return readFileSync17(path, "utf8");
@@ -22130,7 +22341,7 @@ async function uninstallDaemonService() {
   try {
     if (process.platform === "linux") {
       const unitPath = systemdUnitPath();
-      if (!existsSync20(unitPath))
+      if (!existsSync21(unitPath))
         return;
       try {
         runPrivileged("systemctl", ["disable", "--now", systemdUnitName()]);
@@ -22141,7 +22352,7 @@ async function uninstallDaemonService() {
       } catch {}
     } else {
       const plistPath = launchdPlistPath();
-      if (!existsSync20(plistPath))
+      if (!existsSync21(plistPath))
         return;
       try {
         runPrivileged("launchctl", ["unload", "-w", plistPath]);
@@ -22158,7 +22369,7 @@ function daemonVersionSkew() {
   const recorded = readVersionFile()?.daemon;
   if (!recorded)
     return null;
-  if (!existsSync20(installedBinaryPath(recorded)))
+  if (!existsSync21(installedBinaryPath(recorded)))
     return null;
   return recorded === version2 ? null : { installed: recorded, expected: version2 };
 }
@@ -22176,7 +22387,7 @@ function daemonServiceStatus() {
   if (!isDaemonSupportedPlatform())
     return "unsupported-platform";
   if (process.platform === "linux") {
-    if (!existsSync20(systemdUnitPath()))
+    if (!existsSync21(systemdUnitPath()))
       return "not-installed";
     try {
       const out = execFileSync2("systemctl", ["is-active", systemdUnitName()], {
@@ -22189,7 +22400,7 @@ function daemonServiceStatus() {
     }
   }
   const plistPath = launchdPlistPath();
-  if (!existsSync20(plistPath))
+  if (!existsSync21(plistPath))
     return "not-installed";
   try {
     const root = typeof process.getuid === "function" && process.getuid() === 0;
@@ -22221,7 +22432,7 @@ var init_daemon_service = __esm(() => {
 // src/hooks/fp-reset.ts
 import {
   copyFileSync,
-  existsSync as existsSync21,
+  existsSync as existsSync22,
   mkdirSync as mkdirSync12,
   readFileSync as readFileSync18,
   readdirSync as readdirSync14,
@@ -22234,7 +22445,7 @@ import {
 import { dirname as dirname10, isAbsolute as isAbsolute3, relative as relative4, resolve as resolve18 } from "node:path";
 function migrateConventionPolicies() {
   const from = legacy.customPoliciesDir();
-  if (!existsSync21(from))
+  if (!existsSync22(from))
     return [];
   const moved = [];
   const mergeInto = (dir, dest, prefix) => {
@@ -22255,7 +22466,7 @@ function migrateConventionPolicies() {
       const source = resolve18(dir, entry.name);
       const target = resolve18(dest, entry.name);
       const name = `${prefix}${entry.name}`;
-      if (!existsSync21(target)) {
+      if (!existsSync22(target)) {
         try {
           renameSync6(source, target);
           moved.push(name);
@@ -22282,7 +22493,7 @@ function migrateLegacySpool() {
     [legacy.spoolDir(), spoolDir()],
     [legacy.failedDir(), failedDir()]
   ]) {
-    if (!existsSync21(from))
+    if (!existsSync22(from))
       continue;
     try {
       mkdirSync12(to, { recursive: true });
@@ -22291,7 +22502,7 @@ function migrateLegacySpool() {
           continue;
         let name = entry.name;
         let n = 0;
-        while (existsSync21(resolve18(to, name)))
+        while (existsSync22(resolve18(to, name)))
           name = `legacy-${n++}-${entry.name}`;
         try {
           renameSync6(resolve18(from, entry.name), resolve18(to, name));
@@ -22309,7 +22520,7 @@ function migrateLegacySpool() {
 }
 function migrateHookActivity() {
   const from = legacy.hookActivityDir();
-  if (!existsSync21(from))
+  if (!existsSync22(from))
     return [];
   const moved = [];
   try {
@@ -22324,7 +22535,7 @@ function migrateHookActivity() {
       const source = resolve18(from, entry.name);
       let name = entry.name === "current.jsonl" ? `page-${stamp}-${seq++}.jsonl` : entry.name;
       let target = resolve18(to, name);
-      while (existsSync21(target)) {
+      while (existsSync22(target)) {
         name = `page-${stamp}-${seq++}.jsonl`;
         target = resolve18(to, name);
       }
@@ -22375,7 +22586,7 @@ function retirePolicyConfigKeys() {
 }
 function readCarriedPolicyConfig() {
   const from = resolve18(legacy.localPoliciesDir(), "policies-config.json");
-  if (!existsSync21(from))
+  if (!existsSync22(from))
     return null;
   let parsed;
   try {
@@ -22439,7 +22650,7 @@ function writeCarriedPolicyConfig(carried) {
 }
 function readCarriedTelemetryOptOut() {
   const from = legacy.configToml();
-  if (!existsSync21(from))
+  if (!existsSync22(from))
     return false;
   try {
     const text = readFileSync18(from, "utf8");
@@ -22494,7 +22705,7 @@ function parseLegacyToml(text) {
 }
 function readCarriedLegacyConfig() {
   const from = legacy.configToml();
-  if (!existsSync21(from))
+  if (!existsSync22(from))
     return null;
   try {
     return projectConfig(parseLegacyToml(readFileSync18(from, "utf8")));
@@ -22504,7 +22715,7 @@ function readCarriedLegacyConfig() {
 }
 function readCarriedLegacyCredentials() {
   const toml = legacy.credentialsToml();
-  if (existsSync21(toml)) {
+  if (existsSync22(toml)) {
     try {
       const creds = projectCredentials(parseLegacyToml(readFileSync18(toml, "utf8")));
       if (Object.keys(creds).length > 0)
@@ -22547,7 +22758,7 @@ function resetHome(from, to = LAYOUT_VERSION) {
   const spooled = migrateLegacySpool();
   const removed = [];
   for (const path of resettablePaths()) {
-    if (!existsSync21(path))
+    if (!existsSync22(path))
       continue;
     try {
       rmSync7(path, { recursive: true, force: true });
@@ -22572,7 +22783,7 @@ function layoutWarningForHook() {
   if (state.kind === "future") {
     return `[failproofai] this directory was written by a newer version (layout ${state.found} vs ${LAYOUT_VERSION}) — policies are NOT being enforced. ` + `Upgrade failproofai.`;
   }
-  if (existsSync21(globalPolicyConfigFile()))
+  if (existsSync22(globalPolicyConfigFile()))
     return null;
   return `[failproofai] setup predates this version — global policies are NOT being enforced. ` + `Run \`failproofai config\` to re-create it.`;
 }
@@ -23620,17 +23831,17 @@ var init_collector_config = __esm(() => {
 });
 
 // src/hooks/flush-cli.ts
-import { existsSync as existsSync22, mkdirSync as mkdirSync13, writeFileSync as writeFileSync11, readdirSync as readdirSync15 } from "node:fs";
-import { dirname as dirname11, join as join29 } from "node:path";
+import { existsSync as existsSync23, mkdirSync as mkdirSync13, writeFileSync as writeFileSync11, readdirSync as readdirSync15 } from "node:fs";
+import { dirname as dirname11, join as join30 } from "node:path";
 function flushRequestPath(home) {
-  return join29(failproofaiHome(home), "state", "flush-request.json");
+  return join30(failproofaiHome(home), "state", "flush-request.json");
 }
 function spoolDirs(home) {
   const root = spoolDir(home);
-  if (!existsSync22(root))
+  if (!existsSync23(root))
     return [];
   try {
-    return readdirSync15(root, { withFileTypes: true }).filter((e) => e.isDirectory() && e.name !== "failed").map((e) => join29(root, e.name));
+    return readdirSync15(root, { withFileTypes: true }).filter((e) => e.isDirectory() && e.name !== "failed").map((e) => join30(root, e.name));
   } catch {
     return [];
   }
@@ -23731,14 +23942,14 @@ var init_flush_cli = __esm(() => {
 import {
   chmodSync as chmodSync4,
   copyFileSync as copyFileSync2,
-  existsSync as existsSync23,
+  existsSync as existsSync24,
   mkdirSync as mkdirSync14,
   readFileSync as readFileSync19,
   renameSync as renameSync7,
   rmSync as rmSync8,
   writeFileSync as writeFileSync12
 } from "node:fs";
-import { basename as basename4, dirname as dirname12, join as join30, resolve as resolve19 } from "node:path";
+import { basename as basename4, dirname as dirname12, join as join31, resolve as resolve19 } from "node:path";
 function migrateToLayout4() {
   const moves = [
     { from: legacy.authJson(), to: auditSessionFile() },
@@ -23747,16 +23958,16 @@ function migrateToLayout4() {
   ];
   const authDirOverride = process.env.FAILPROOFAI_AUTH_DIR;
   if (authDirOverride) {
-    moves.push({ from: join30(authDirOverride, "auth.json"), to: join30(authDirOverride, "session.json") }, {
-      from: join30(authDirOverride, "next-audit.json"),
-      to: join30(authDirOverride, "reminder.json")
+    moves.push({ from: join31(authDirOverride, "auth.json"), to: join31(authDirOverride, "session.json") }, {
+      from: join31(authDirOverride, "next-audit.json"),
+      to: join31(authDirOverride, "reminder.json")
     });
   }
   const migrated = [];
   for (const { from, to } of moves) {
-    if (!existsSync23(from))
+    if (!existsSync24(from))
       continue;
-    if (existsSync23(to)) {
+    if (existsSync24(to)) {
       rmSync8(from, { force: true });
       continue;
     }
@@ -23777,7 +23988,7 @@ function migrateToLayout4() {
     migrated.push(`${basename4(from)} → audit/${basename4(to)}`);
   }
   for (const secret of [auditSessionFile()]) {
-    if (!existsSync23(secret))
+    if (!existsSync24(secret))
       continue;
     try {
       chmodSync4(secret, 384);
@@ -23825,10 +24036,10 @@ function pruneMigratedCredentials(from) {
   for (let layout = from;layout < LAYOUT_VERSION; layout++) {
     for (const { as, landsAt } of PRUNED_AFTER_SUCCESS) {
       try {
-        if (!existsSync23(landsAt()))
+        if (!existsSync24(landsAt()))
           continue;
         const copy = resolve19(migrationBackupDir(layout), as);
-        if (!existsSync23(copy))
+        if (!existsSync24(copy))
           continue;
         rmSync8(copy, { force: true });
         pruned.push(as);
@@ -23841,7 +24052,7 @@ function filesToBackUp() {
   const seen = new Map;
   for (const f of [...BACKED_UP, ...BACKED_UP_LEGACY]) {
     const path = f.at();
-    if (existsSync23(path))
+    if (existsSync24(path))
       seen.set(path, backupNameOf(f));
   }
   return [...seen].map(([path, as]) => ({ path, as }));
@@ -24149,13 +24360,13 @@ import { createHmac, randomUUID as randomUUID2 } from "node:crypto";
 import { execSync as execSync5 } from "node:child_process";
 import { readFileSync as readFileSync20, writeFileSync as writeFileSync13, mkdirSync as mkdirSync15 } from "node:fs";
 import { homedir as homedir22, platform, arch, hostname, cpus } from "node:os";
-import { join as join31 } from "node:path";
+import { join as join32 } from "node:path";
 function hashToId3(raw) {
   return createHmac("sha256", NAMESPACE3).update(raw).digest("hex");
 }
 function getInstanceId3() {
-  const idDir = join31(homedir22(), ".failproofai");
-  const idFile = join31(idDir, "instance-id");
+  const idDir = join32(homedir22(), ".failproofai");
+  const idFile = join32(idDir, "instance-id");
   try {
     const existing = readFileSync20(idFile, "utf-8").trim();
     if (existing)
@@ -24231,7 +24442,7 @@ var NAMESPACE3 = "failproofai-telemetry-v1", API_KEY3 = "phc_Ac1Ww1GqKc0z1SyrRWb
 var init_install_telemetry = () => {};
 
 // lib/install-check.ts
-import { existsSync as existsSync24, readFileSync as readFileSync21, writeFileSync as writeFileSync14, mkdirSync as mkdirSync16 } from "node:fs";
+import { existsSync as existsSync25, readFileSync as readFileSync21, writeFileSync as writeFileSync14, mkdirSync as mkdirSync16 } from "node:fs";
 import { dirname as dirname13, resolve as resolve20 } from "node:path";
 import { platform as platform2, arch as arch2, release, homedir as homedir23, hostname as hostname2 } from "node:os";
 import { createHmac as createHmac2 } from "node:crypto";
@@ -24287,7 +24498,7 @@ function compareSemver(a, b) {
 }
 function checkHooks() {
   const hooksConfigPath = globalPolicyConfigFile();
-  if (!existsSync24(hooksConfigPath)) {
+  if (!existsSync25(hooksConfigPath)) {
     return { configured: false, registered: false, policyCount: 0 };
   }
   let config;
@@ -24301,7 +24512,7 @@ function checkHooks() {
   }
   const policyCount = config.enabledPolicies.length;
   const settingsPath = resolve20(homedir23(), ".claude", "settings.json");
-  if (!existsSync24(settingsPath))
+  if (!existsSync25(settingsPath))
     return { configured: true, registered: false, policyCount };
   let settings;
   try {
@@ -24329,7 +24540,7 @@ async function maybeReportInstall(version) {
     const versionFile = lastVersionPath();
     let previousVersion = null;
     try {
-      if (existsSync24(versionFile)) {
+      if (existsSync25(versionFile)) {
         previousVersion = readFileSync21(versionFile, "utf8").trim() || null;
       }
     } catch {}
@@ -24417,7 +24628,7 @@ var init_cli_error = __esm(() => {
 
 // src/hooks/manager.ts
 import { execSync as execSync6 } from "node:child_process";
-import { existsSync as existsSync25 } from "node:fs";
+import { existsSync as existsSync26 } from "node:fs";
 import { resolve as resolve21, basename as basename5 } from "node:path";
 import { platform as platform3, arch as arch3, release as release2, hostname as hostname3 } from "node:os";
 function getSettingsPath(scope, cwd) {
@@ -24639,7 +24850,7 @@ async function installHooksImpl(policyNames, scope = "user", cwd, includeBeta =
   } else if (customPoliciesPath && (typeof customPoliciesPath === "string" || customPoliciesPath.length > 0)) {
     const incoming = (typeof customPoliciesPath === "string" ? [customPoliciesPath] : customPoliciesPath).map((path) => resolve21(path));
     const carried = (previousConfig.customPoliciesPaths ?? (previousConfig.customPoliciesPath ? [previousConfig.customPoliciesPath] : [])).map((path) => resolve21(path)).filter((path) => {
-      if (existsSync25(path))
+      if (existsSync26(path))
         return true;
       console.log(`Dropping custom policies path (file no longer exists): ${path}`);
       return false;
@@ -24862,7 +25073,7 @@ async function removeHooks(policyNames, scope = "user", cwd, opts) {
     const scopesToRemove = scope === "all" ? [...integration.scopes] : integration.scopes.includes(scope) ? [scope] : [];
     for (const s of scopesToRemove) {
       const settingsPaths = settingsPathsFor(integration, s, cwd);
-      const existing = settingsPaths.filter((p) => existsSync25(p));
+      const existing = settingsPaths.filter((p) => existsSync26(p));
       if (existing.length === 0) {
         if (scope !== "all" && selectedClis.length === 1) {
           console.log("No settings file found. Nothing to remove.");
@@ -24965,7 +25176,7 @@ var DEFAULT_FETCH_TIMEOUT_MS = 15000;
 
 // src/hooks/cloud-enrollment.ts
 import { randomUUID as randomUUID3 } from "node:crypto";
-import { existsSync as existsSync26, readFileSync as readFileSync22, rmSync as rmSync9 } from "node:fs";
+import { existsSync as existsSync27, readFileSync as readFileSync22, rmSync as rmSync9 } from "node:fs";
 import { hostname as hostname4 } from "node:os";
 function cloudCredentialPath() {
   return process.env.FAILPROOFAI_CLOUD_CREDENTIALS ?? credentialsFile();
@@ -25004,7 +25215,7 @@ function readCloudCredentials() {
   if (!usingJsonOverride())
     return readCredentials().cloud ?? null;
   const path = cloudCredentialPath();
-  if (!existsSync26(path))
+  if (!existsSync27(path))
     return null;
   try {
     const raw = JSON.parse(readFileSync22(path, "utf8"));
@@ -25046,7 +25257,7 @@ function resolveMachineLabel(explicit) {
 function clearCloudCredentials() {
   if (usingJsonOverride()) {
     const path = cloudCredentialPath();
-    if (!existsSync26(path))
+    if (!existsSync27(path))
       return false;
     try {
       rmSync9(path);
@@ -25297,7 +25508,7 @@ var init_cloud_connection = __esm(() => {
 });
 
 // src/hooks/setup-state.ts
-import { existsSync as existsSync27, realpathSync as realpathSync2, statSync as statSync17 } from "node:fs";
+import { existsSync as existsSync28, realpathSync as realpathSync2, statSync as statSync17 } from "node:fs";
 import { dirname as dirname14, resolve as resolve22 } from "node:path";
 import { homedir as homedir24 } from "node:os";
 function globalConfigPath(home = homedir24()) {
@@ -25354,10 +25565,10 @@ function detectSetupState(cwd = process.cwd(), home = homedir24()) {
     cwd: resolvedCwd,
     home: resolvedHome,
     projectRoot,
-    hasGlobalConfig: existsSync27(globalConfigPath(resolvedHome)),
-    hasProjectConfig: projectRoot !== resolvedHome && existsSync27(projectConfigPath(projectRoot)),
+    hasGlobalConfig: existsSync28(globalConfigPath(resolvedHome)),
+    hasProjectConfig: projectRoot !== resolvedHome && existsSync28(projectConfigPath(projectRoot)),
     hasGlobalHooks: hasGlobalHooksInstalled(),
-    hasLegacyMarker: existsSync27(legacyMarkerPath(resolvedHome)),
+    hasLegacyMarker: existsSync28(legacyMarkerPath(resolvedHome)),
     inHomeDir: resolvedCwd === resolvedHome
   };
 }
@@ -25374,11 +25585,11 @@ var init_setup_state = __esm(() => {
 });
 
 // src/hooks/onboarding-attempt.ts
-import { existsSync as existsSync28, mkdirSync as mkdirSync17, readFileSync as readFileSync23, rmSync as rmSync10, writeFileSync as writeFileSync15 } from "node:fs";
+import { existsSync as existsSync29, mkdirSync as mkdirSync17, readFileSync as readFileSync23, rmSync as rmSync10, writeFileSync as writeFileSync15 } from "node:fs";
 import { dirname as dirname15 } from "node:path";
 function readOnboardingAttempt() {
   const path = onboardingAttemptFile();
-  if (!existsSync28(path))
+  if (!existsSync29(path))
     return null;
   try {
     const raw = JSON.parse(readFileSync23(path, "utf8"));
@@ -25511,8 +25722,8 @@ var init_onboarding_lock = __esm(() => {
 });
 
 // lib/claude-sessions.ts
-import { readdirSync as readdirSync16, statSync as statSync18, existsSync as existsSync29 } from "node:fs";
-import { join as join32, basename as basename6 } from "node:path";
+import { readdirSync as readdirSync16, statSync as statSync18, existsSync as existsSync30 } from "node:fs";
+import { join as join33, basename as basename6 } from "node:path";
 function getClaudeProjectsRoot() {
   return getClaudeProjectsPath();
 }
@@ -25527,7 +25738,7 @@ function listClaudeProjects() {
   return entries.filter((e) => e.isDirectory()).map((e) => ({
     name: e.name,
     cwd: decodeFolderName(e.name),
-    path: join32(root, e.name)
+    path: join33(root, e.name)
   }));
 }
 function listClaudeTranscripts(project) {
@@ -25543,7 +25754,7 @@ function listClaudeTranscripts(project) {
       const sessionId = entry.name.slice(0, -".jsonl".length);
       if (!UUID_RE2.test(sessionId))
         continue;
-      const transcriptPath = join32(project.path, entry.name);
+      const transcriptPath = join33(project.path, entry.name);
       try {
         const s = statSync18(transcriptPath);
         out.push({
@@ -25557,8 +25768,8 @@ function listClaudeTranscripts(project) {
         });
       } catch {}
     } else if (entry.isDirectory() && UUID_RE2.test(entry.name)) {
-      const subDir = join32(project.path, entry.name, "subagents");
-      if (!existsSync29(subDir))
+      const subDir = join33(project.path, entry.name, "subagents");
+      if (!existsSync30(subDir))
         continue;
       let subEntries;
       try {
@@ -25570,7 +25781,7 @@ function listClaudeTranscripts(project) {
         if (!sub.isFile() || !sub.name.endsWith(".jsonl"))
           continue;
         const agentId = sub.name.slice(0, -".jsonl".length);
-        const transcriptPath = join32(subDir, sub.name);
+        const transcriptPath = join33(subDir, sub.name);
         try {
           const s = statSync18(transcriptPath);
           out.push({
@@ -26901,8 +27112,8 @@ var init_features = __esm(() => {
 
 // src/audit/cache.ts
 import { createHash as createHash8 } from "node:crypto";
-import { existsSync as existsSync30, mkdirSync as mkdirSync19, readFileSync as readFileSync25, writeFileSync as writeFileSync17, chmodSync as chmodSync5, openSync, readSync, closeSync } from "node:fs";
-import { join as join33 } from "node:path";
+import { existsSync as existsSync31, mkdirSync as mkdirSync19, readFileSync as readFileSync25, writeFileSync as writeFileSync17, chmodSync as chmodSync5, openSync, readSync, closeSync } from "node:fs";
+import { join as join34 } from "node:path";
 function getEngineVersion() {
   if (cachedEngineVersion)
     return cachedEngineVersion;
@@ -26922,7 +27133,7 @@ function getDetectorVersion() {
 function getCachePathFor(transcriptPath) {
   const root = auditCacheDir();
   const key = createHash8("sha1").update(transcriptPath).digest("hex");
-  return join33(root, `${key}.json`);
+  return join34(root, `${key}.json`);
 }
 function encodeDetectorState(state) {
   return JSON.stringify(state, (_k, v) => v instanceof Map ? { __map: [...v.entries()] } : v);
@@ -26962,7 +27173,7 @@ function readCachedTranscript(transcriptPath, mtimeMs, sizeBytes) {
   if (sizeBytes === 0)
     return null;
   const cachePath = getCachePathFor(transcriptPath);
-  if (!existsSync30(cachePath))
+  if (!existsSync31(cachePath))
     return null;
   try {
     const raw = readFileSync25(cachePath, "utf-8");
@@ -27582,7 +27793,7 @@ var init_audit_lock = __esm(() => {
 });
 
 // src/audit/dashboard-cache.ts
-import { existsSync as existsSync31, readFileSync as readFileSync27 } from "node:fs";
+import { existsSync as existsSync32, readFileSync as readFileSync27 } from "node:fs";
 function getCachePath() {
   return auditDashboardFile();
 }
@@ -27602,7 +27813,7 @@ function writeDashboardCache(params, result) {
 }
 function readDashboardCacheMeta() {
   const cachePath = getCachePath();
-  if (!existsSync31(cachePath))
+  if (!existsSync32(cachePath))
     return null;
   try {
     const raw = readFileSync27(cachePath, "utf-8");
@@ -27829,15 +28040,15 @@ var init_api_server_client = __esm(() => {
 });
 
 // lib/auth/auth-store.ts
-import { existsSync as existsSync32, readFileSync as readFileSync28, readdirSync as readdirSync17, rmSync as rmSync12 } from "node:fs";
-import { join as join34, resolve as resolve23 } from "node:path";
+import { existsSync as existsSync33, readFileSync as readFileSync28, readdirSync as readdirSync17, rmSync as rmSync12 } from "node:fs";
+import { join as join35, resolve as resolve23 } from "node:path";
 function getAuthFilePath() {
   const override = process.env.FAILPROOFAI_AUTH_DIR;
-  return override ? join34(override, "session.json") : auditSessionFile();
+  return override ? join35(override, "session.json") : auditSessionFile();
 }
 function readAuth() {
   const p = getAuthFilePath();
-  if (!existsSync32(p))
+  if (!existsSync33(p))
     return null;
   try {
     const raw = readFileSync28(p, "utf-8");
@@ -27864,17 +28075,17 @@ function writeAuth(auth) {
 }
 function deleteAuth() {
   const p = getAuthFilePath();
-  if (existsSync32(p))
+  if (existsSync33(p))
     rmSync12(p, { force: true });
   try {
     const root = migrationsDir();
-    if (!existsSync32(root))
+    if (!existsSync33(root))
       return;
     for (const entry of readdirSync17(root)) {
       if (!entry.startsWith("backup-layout"))
         continue;
       const copy = resolve23(root, entry, "auth.json");
-      if (existsSync32(copy))
+      if (existsSync33(copy))
         rmSync12(copy, { force: true });
     }
   } catch {}
@@ -28125,12 +28336,12 @@ var init_harm_report = __esm(() => {
 });
 
 // src/audit/machine-store.ts
-import { existsSync as existsSync33, readFileSync as readFileSync29, rmSync as rmSync13 } from "node:fs";
+import { existsSync as existsSync34, readFileSync as readFileSync29, rmSync as rmSync13 } from "node:fs";
 import { hostname as hostname5 } from "node:os";
 import { randomUUID as randomUUID4 } from "node:crypto";
 function readMachineIdentity(home) {
   const path = auditMachineFile(home);
-  if (!existsSync33(path))
+  if (!existsSync34(path))
     return null;
   try {
     const parsed = JSON.parse(readFileSync29(path, "utf8"));
@@ -28455,7 +28666,7 @@ var init_cli = __esm(() => {
 });
 
 // src/hooks/configure-wizard.ts
-import { existsSync as existsSync34, mkdirSync as mkdirSync21, writeFileSync as writeFileSync19, readFileSync as readFileSync30 } from "node:fs";
+import { existsSync as existsSync35, mkdirSync as mkdirSync21, writeFileSync as writeFileSync19, readFileSync as readFileSync30 } from "node:fs";
 import { homedir as homedir27 } from "node:os";
 import { dirname as dirname16, resolve as resolve24, sep as sep5 } from "node:path";
 async function emit(event, props) {
@@ -28480,7 +28691,7 @@ function setCustomPoliciesEnabled(scope, cwd, enabled) {
   const path = getConfigPathForScope(scope, cwd);
   let config = {};
   try {
-    if (existsSync34(path))
+    if (existsSync35(path))
       config = JSON.parse(readFileSync30(path, "utf8"));
   } catch {
     return;
@@ -29117,17 +29328,17 @@ var init_configure_wizard = __esm(() => {
 });
 
 // src/hooks/flush-cli.ts
-import { existsSync as existsSync35, mkdirSync as mkdirSync22, writeFileSync as writeFileSync20, readdirSync as readdirSync18 } from "node:fs";
-import { dirname as dirname17, join as join35 } from "node:path";
+import { existsSync as existsSync36, mkdirSync as mkdirSync22, writeFileSync as writeFileSync20, readdirSync as readdirSync18 } from "node:fs";
+import { dirname as dirname17, join as join36 } from "node:path";
 function flushRequestPath2(home) {
-  return join35(failproofaiHome(home), "state", "flush-request.json");
+  return join36(failproofaiHome(home), "state", "flush-request.json");
 }
 function spoolDirs2(home) {
   const root = spoolDir(home);
-  if (!existsSync35(root))
+  if (!existsSync36(root))
     return [];
   try {
-    return readdirSync18(root, { withFileTypes: true }).filter((e) => e.isDirectory() && e.name !== "failed").map((e) => join35(root, e.name));
+    return readdirSync18(root, { withFileTypes: true }).filter((e) => e.isDirectory() && e.name !== "failed").map((e) => join36(root, e.name));
   } catch {
     return [];
   }
@@ -29225,16 +29436,16 @@ var init_flush_cli2 = __esm(() => {
 });
 
 // src/hooks/backfill-cli.ts
-import { existsSync as existsSync36, mkdirSync as mkdirSync23, writeFileSync as writeFileSync21, readdirSync as readdirSync19, statSync as statSync23 } from "node:fs";
-import { dirname as dirname18, join as join36 } from "node:path";
+import { existsSync as existsSync37, mkdirSync as mkdirSync23, writeFileSync as writeFileSync21, readdirSync as readdirSync19, statSync as statSync23 } from "node:fs";
+import { dirname as dirname18, join as join37 } from "node:path";
 function backfillRequestPath(home) {
-  return join36(failproofaiHome(home), "state", "backfill-request.json");
+  return join37(failproofaiHome(home), "state", "backfill-request.json");
 }
 function surveySessions(sinceMs, homeDir) {
   const out = [];
   for (const { cli, dir } of SESSION_DIRS) {
-    const root = join36(homeDir, dir);
-    if (!existsSync36(root))
+    const root = join37(homeDir, dir);
+    if (!existsSync37(root))
       continue;
     let files = 0;
     let newest = 0;
@@ -29248,7 +29459,7 @@ function surveySessions(sinceMs, homeDir) {
         return;
       }
       for (const e of entries) {
-        const p = join36(d, e.name);
+        const p = join37(d, e.name);
         if (e.isDirectory()) {
           walk(p, depth + 1);
           continue;
@@ -29272,7 +29483,7 @@ function runBackfillCommand(opts = {}) {
   const now = opts.now ?? Date.now();
   const sinceMs = opts.sinceMs ?? now - DEFAULT_BACKFILL_DAYS * 24 * 60 * 60 * 1000;
   const home = failproofaiHome();
-  if (!existsSync36(home)) {
+  if (!existsSync37(home)) {
     return {
       exitCode: 1,
       lines: [`No failproofai home at ${home}. Run \`failproofai config\` first.`]
@@ -29603,7 +29814,7 @@ var init_harness_cli = __esm(() => {
 });
 
 // src/hooks/fp-config.ts
-import { chmodSync as chmodSync6, existsSync as existsSync37, mkdirSync as mkdirSync24, readFileSync as readFileSync31, statSync as statSync24, writeFileSync as writeFileSync22 } from "node:fs";
+import { chmodSync as chmodSync6, existsSync as existsSync38, mkdirSync as mkdirSync24, readFileSync as readFileSync31, statSync as statSync24, writeFileSync as writeFileSync22 } from "node:fs";
 function detectLayout2() {
   const raw = readVersionFile2();
   if (raw) {
@@ -29611,17 +29822,17 @@ function detectLayout2() {
       return { kind: "current", version: raw };
     return raw.layout > LAYOUT_VERSION ? { kind: "future", found: raw.layout } : { kind: "stale", found: raw.layout };
   }
-  if (existsSync37(configFile())) {
+  if (existsSync38(configFile())) {
     const layoutThreePositions = [
       legacy.authJson(),
       legacy.nextAudit(),
       legacy.auditSchedule()
     ];
-    if (layoutThreePositions.some((p) => existsSync37(p)))
+    if (layoutThreePositions.some((p) => existsSync38(p)))
       return { kind: "stale", found: 3 };
     return { kind: "current", version: { layout: LAYOUT_VERSION, cli: "" }, inferred: true };
   }
-  if (existsSync37(legacy.configToml()))
+  if (existsSync38(legacy.configToml()))
     return { kind: "stale", found: 2 };
   const layoutOneMarkers = [
     legacy.policyConfig(),
@@ -29632,7 +29843,7 @@ function detectLayout2() {
     legacy.ingestCredentials(),
     legacy.auditDashboard()
   ];
-  return layoutOneMarkers.some((p) => existsSync37(p)) ? { kind: "stale", found: 1 } : { kind: "absent" };
+  return layoutOneMarkers.some((p) => existsSync38(p)) ? { kind: "stale", found: 1 } : { kind: "absent" };
 }
 function readLegacyTomlVersion2(text) {
   const layout = Number(/^\s*layout\s*=\s*(\d+)\s*$/m.exec(text)?.[1]);
@@ -29675,14 +29886,14 @@ var init_fp_home2 = () => {};
 import {
   chmodSync as chmodSync7,
   copyFileSync as copyFileSync3,
-  existsSync as existsSync38,
+  existsSync as existsSync39,
   mkdirSync as mkdirSync25,
   readFileSync as readFileSync32,
   renameSync as renameSync8,
   rmSync as rmSync14,
   writeFileSync as writeFileSync23
 } from "node:fs";
-import { basename as basename7, dirname as dirname19, join as join37, resolve as resolve26 } from "node:path";
+import { basename as basename7, dirname as dirname19, join as join38, resolve as resolve26 } from "node:path";
 function migrateToLayout42() {
   const moves = [
     { from: legacy.authJson(), to: auditSessionFile() },
@@ -29691,16 +29902,16 @@ function migrateToLayout42() {
   ];
   const authDirOverride = process.env.FAILPROOFAI_AUTH_DIR;
   if (authDirOverride) {
-    moves.push({ from: join37(authDirOverride, "auth.json"), to: join37(authDirOverride, "session.json") }, {
-      from: join37(authDirOverride, "next-audit.json"),
-      to: join37(authDirOverride, "reminder.json")
+    moves.push({ from: join38(authDirOverride, "auth.json"), to: join38(authDirOverride, "session.json") }, {
+      from: join38(authDirOverride, "next-audit.json"),
+      to: join38(authDirOverride, "reminder.json")
     });
   }
   const migrated = [];
   for (const { from, to } of moves) {
-    if (!existsSync38(from))
+    if (!existsSync39(from))
       continue;
-    if (existsSync38(to)) {
+    if (existsSync39(to)) {
       rmSync14(from, { force: true });
       continue;
     }
@@ -29721,7 +29932,7 @@ function migrateToLayout42() {
     migrated.push(`${basename7(from)} → audit/${basename7(to)}`);
   }
   for (const secret of [auditSessionFile()]) {
-    if (!existsSync38(secret))
+    if (!existsSync39(secret))
       continue;
     try {
       chmodSync7(secret, 384);
@@ -29769,10 +29980,10 @@ function pruneMigratedCredentials2(from) {
   for (let layout = from;layout < LAYOUT_VERSION; layout++) {
     for (const { as, landsAt } of PRUNED_AFTER_SUCCESS2) {
       try {
-        if (!existsSync38(landsAt()))
+        if (!existsSync39(landsAt()))
           continue;
         const copy = resolve26(migrationBackupDir(layout), as);
-        if (!existsSync38(copy))
+        if (!existsSync39(copy))
           continue;
         rmSync14(copy, { force: true });
         pruned.push(as);
@@ -29785,7 +29996,7 @@ function filesToBackUp2() {
   const seen = new Map;
   for (const f of [...BACKED_UP2, ...BACKED_UP_LEGACY2]) {
     const path = f.at();
-    if (existsSync38(path))
+    if (existsSync39(path))
       seen.set(path, backupNameOf2(f));
   }
   return [...seen].map(([path, as]) => ({ path, as }));
@@ -29939,7 +30150,7 @@ var init_migrations2 = __esm(() => {
 
 // src/hooks/daemon-service.ts
 import {
-  existsSync as existsSync39,
+  existsSync as existsSync40,
   mkdirSync as mkdirSync26,
   mkdtempSync as mkdtempSync2,
   readFileSync as readFileSync33,
@@ -29964,13 +30175,13 @@ function resolveFailproofaidBinaryPath2() {
   if (process.env.FAILPROOFAI_DAEMON_BINARY)
     return process.env.FAILPROOFAI_DAEMON_BINARY;
   const downloaded = installedBinaryPath();
-  if (existsSync39(downloaded))
+  if (existsSync40(downloaded))
     return downloaded;
   const packageRoot = process.env.FAILPROOFAI_PACKAGE_ROOT;
   if (packageRoot) {
     for (const profile of ["release", "debug"]) {
       const candidate = resolve27(packageRoot, "target", profile, "failproofaid");
-      if (existsSync39(candidate))
+      if (existsSync40(candidate))
         return candidate;
     }
   }
@@ -30001,7 +30212,7 @@ function resolveWorkerCommand2() {
   if (!packageRoot)
     return null;
   const workerScript = resolve27(packageRoot, "dist", "worker.mjs");
-  if (!existsSync39(workerScript))
+  if (!existsSync40(workerScript))
     return null;
   return `${shellQuote2(process.execPath)} ${shellQuote2(workerScript)}`;
 }
@@ -30012,7 +30223,7 @@ function resolveCliCommand2() {
   if (!packageRoot)
     return null;
   const cliScript = resolve27(packageRoot, "dist", "cli.mjs");
-  if (!existsSync39(cliScript))
+  if (!existsSync40(cliScript))
     return null;
   return `${shellQuote2(process.execPath)} ${shellQuote2(cliScript)}`;
 }
@@ -30026,7 +30237,7 @@ function workerScriptPath2() {
   if (!packageRoot)
     return null;
   const workerScript = resolve27(packageRoot, "dist", "worker.mjs");
-  return existsSync39(workerScript) ? workerScript : null;
+  return existsSync40(workerScript) ? workerScript : null;
 }
 function assertUnitSafe2(value, field) {
   if (UNIT_UNSAFE_RE2.test(value)) {
@@ -30115,7 +30326,7 @@ function removeLegacyUserService2() {
   try {
     if (process.platform === "linux") {
       const legacy = legacySystemdUserUnitPath2();
-      if (!existsSync39(legacy))
+      if (!existsSync40(legacy))
         return;
       try {
         execFileSync3("systemctl", ["--user", "disable", "--now", "failproofaid.service"], {
@@ -30132,7 +30343,7 @@ function removeLegacyUserService2() {
       } catch {}
     } else {
       const legacyAgent = legacyLaunchAgentPlistPath2();
-      if (existsSync39(legacyAgent)) {
+      if (existsSync40(legacyAgent)) {
         try {
           execFileSync3("launchctl", ["unload", "-w", legacyAgent], {
             stdio: "ignore",
@@ -30142,7 +30353,7 @@ function removeLegacyUserService2() {
         unlinkSync5(legacyAgent);
       }
       const legacyDaemon = legacySharedLaunchDaemonPath2();
-      if (existsSync39(legacyDaemon)) {
+      if (existsSync40(legacyDaemon)) {
         try {
           runPrivileged2("launchctl", ["unload", "-w", legacyDaemon]);
         } catch {}
@@ -30159,7 +30370,7 @@ function systemdUnitContents2(binaryPath, workerCmd, cliCmd = null) {
   const user = assertUnitSafe2(serviceUser2(), "User");
   assertUnitSafe2(binaryPath, "ExecStart");
   assertUnitSafe2(homedir29(), "HOME");
-  const conditionPaths = [binaryPath, workerScriptPath2()].filter((p) => typeof p === "string" && existsSync39(p));
+  const conditionPaths = [binaryPath, workerScriptPath2()].filter((p) => typeof p === "string" && existsSync40(p));
   const conditionLines = conditionPaths.map((p) => `ConditionPathExists=${assertUnitSafe2(p, "ConditionPathExists")}
 `).join("");
   return `[Unit]
@@ -30364,7 +30575,7 @@ function daemonServiceStatus2() {
   if (!isDaemonSupportedPlatform2())
     return "unsupported-platform";
   if (process.platform === "linux") {
-    if (!existsSync39(systemdUnitPath2()))
+    if (!existsSync40(systemdUnitPath2()))
       return "not-installed";
     try {
       const out = execFileSync3("systemctl", ["is-active", systemdUnitName2()], {
@@ -30377,7 +30588,7 @@ function daemonServiceStatus2() {
     }
   }
   const plistPath = launchdPlistPath2();
-  if (!existsSync39(plistPath))
+  if (!existsSync40(plistPath))
     return "not-installed";
   try {
     const root = typeof process.getuid === "function" && process.getuid() === 0;
@@ -30407,7 +30618,7 @@ var init_daemon_service2 = __esm(() => {
 });
 
 // src/hooks/uninstall-cli.ts
-import { existsSync as existsSync40, rmSync as rmSync16 } from "node:fs";
+import { existsSync as existsSync41, rmSync as rmSync16 } from "node:fs";
 function survey(cwd) {
   const clis = [];
   for (const id of listInstallableIds()) {
@@ -30428,9 +30639,9 @@ function survey(cwd) {
   return {
     clis,
     servicePath,
-    serviceInstalled: !!servicePath && existsSync40(servicePath),
+    serviceInstalled: !!servicePath && existsSync41(servicePath),
     daemonConfigured,
-    homeExists: existsSync40(failproofaiHome())
+    homeExists: existsSync41(failproofaiHome())
   };
 }
 async function runUninstallCommand(opts = {}) {
@@ -30528,7 +30739,7 @@ async function runUninstallCommand(opts = {}) {
       } catch {}
       try {
         await uninstallDaemonService();
-        if (found.servicePath && existsSync40(found.servicePath)) {
+        if (found.servicePath && existsSync41(found.servicePath)) {
           failures.push(`the service at ${found.servicePath} is still there (most often: no sudo). ` + `Remove it with the commands below.`);
         } else {
           lines.push(`✓ stopped and removed the daemon service`);
@@ -30551,7 +30762,7 @@ async function runUninstallCommand(opts = {}) {
     lines.push(``, `Not everything could be removed:`);
     for (const f of failures)
       lines.push(`  ✗ ${f}`);
-    if (found.servicePath && existsSync40(found.servicePath)) {
+    if (found.servicePath && existsSync41(found.servicePath)) {
       lines.push(``, `To remove the service by hand:`, ...manualServiceRemoval(found.servicePath), ``, `(\`${daemonStatusCommand()}\` shows its current state.)`);
     }
     return { exitCode: 1, lines, planLines, purged };
@@ -30585,8 +30796,8 @@ var init_uninstall_cli = __esm(() => {
 import { execFileSync as execFileSync4 } from "node:child_process";
 import { homedir as homedir30, tmpdir as tmpdir4 } from "node:os";
 import { createHash as createHash9 } from "node:crypto";
-import { copyFileSync as copyFileSync4, existsSync as existsSync41, mkdirSync as mkdirSync27, mkdtempSync as mkdtempSync3, readFileSync as readFileSync34, readdirSync as readdirSync20, realpathSync as realpathSync3, rmSync as rmSync17, statSync as statSync25, writeFileSync as writeFileSync25 } from "node:fs";
-import { basename as basename8, dirname as dirname20, isAbsolute as isAbsolute4, join as join38, relative as relative5, resolve as resolve28, sep as sep6 } from "node:path";
+import { copyFileSync as copyFileSync4, existsSync as existsSync42, mkdirSync as mkdirSync27, mkdtempSync as mkdtempSync3, readFileSync as readFileSync34, readdirSync as readdirSync20, realpathSync as realpathSync3, rmSync as rmSync17, statSync as statSync25, writeFileSync as writeFileSync25 } from "node:fs";
+import { basename as basename8, dirname as dirname20, isAbsolute as isAbsolute4, join as join39, relative as relative5, resolve as resolve28, sep as sep6 } from "node:path";
 function parseList(rest, flag) {
   const idx = rest.findIndex((a) => a === flag || a.startsWith(`${flag}=`));
   if (idx === -1)
@@ -30700,7 +30911,7 @@ async function build(rest) {
     return fail2([err instanceof Error ? err.message : String(err)]);
   }
   const entryPath = resolve28(entry);
-  if (!existsSync41(entryPath))
+  if (!existsSync42(entryPath))
     return fail2([`No such file: ${entryPath}`]);
   const source = readFileSync34(entryPath, "utf8");
   const localImport = /(?:^|\n)\s*(?:import|export)[^;\n]*from\s+["'](\.[^"']*)["']/.exec(source);
@@ -30895,7 +31106,7 @@ async function scaffold(target) {
     chosen = answer.trim();
   }
   const path = resolve28(withPolicyExtension(chosen ?? "my-policies"));
-  if (existsSync41(path)) {
+  if (existsSync42(path)) {
     return fail2([`${path} already exists — name a different file, or edit that one.`]);
   }
   mkdirSync27(resolve28(path, ".."), { recursive: true });
@@ -31347,7 +31558,7 @@ function pushExistingHistory(dir, owner, name, token) {
   const branch = git(["rev-parse", "--abbrev-ref", "HEAD"]);
   if (!branch || branch === "HEAD" || !git(["rev-parse", "--verify", "HEAD"]))
     return false;
-  const askpass = join38(mkdtempSync3(join38(tmpdir4(), "fpai-askpass-")), "askpass.sh");
+  const askpass = join39(mkdtempSync3(join39(tmpdir4(), "fpai-askpass-")), "askpass.sh");
   try {
     writeFileSync25(askpass, `#!/bin/sh
 case "$1" in
@@ -32393,7 +32604,7 @@ var init_install_prompt = __esm(() => {
 
 // src/hooks/manager.ts
 import { execSync as execSync7 } from "node:child_process";
-import { existsSync as existsSync42 } from "node:fs";
+import { existsSync as existsSync43 } from "node:fs";
 import { resolve as resolve29, basename as basename9 } from "node:path";
 import { platform as platform4, arch as arch4, release as release3, hostname as hostname6 } from "node:os";
 function getSettingsPath2(scope, cwd) {
@@ -32615,7 +32826,7 @@ async function installHooksImpl2(policyNames, scope = "user", cwd, includeBeta =
   } else if (customPoliciesPath && (typeof customPoliciesPath === "string" || customPoliciesPath.length > 0)) {
     const incoming = (typeof customPoliciesPath === "string" ? [customPoliciesPath] : customPoliciesPath).map((path) => resolve29(path));
     const carried = (previousConfig.customPoliciesPaths ?? (previousConfig.customPoliciesPath ? [previousConfig.customPoliciesPath] : [])).map((path) => resolve29(path)).filter((path) => {
-      if (existsSync42(path))
+      if (existsSync43(path))
         return true;
       console.log(`Dropping custom policies path (file no longer exists): ${path}`);
       return false;
@@ -32838,7 +33049,7 @@ async function removeHooks2(policyNames, scope = "user", cwd, opts) {
     const scopesToRemove = scope === "all" ? [...integration.scopes] : integration.scopes.includes(scope) ? [scope] : [];
     for (const s of scopesToRemove) {
       const settingsPaths = settingsPathsFor(integration, s, cwd);
-      const existing = settingsPaths.filter((p) => existsSync42(p));
+      const existing = settingsPaths.filter((p) => existsSync43(p));
       if (existing.length === 0) {
         if (scope !== "all" && selectedClis.length === 1) {
           console.log("No settings file found. Nothing to remove.");
@@ -32984,7 +33195,7 @@ async function listHooks(cwd) {
     for (const path of explicitPaths) {
       const absPath = resolve29(findProjectConfigDir(cwd ?? process.cwd()), path);
       groups.push(note(absPath, opts));
-      if (!existsSync42(absPath)) {
+      if (!existsSync43(absPath)) {
         groups.push(warning([`file not found: ${absPath}`], opts));
         continue;
       }
@@ -33546,19 +33757,19 @@ function parseScriptArgs(argv) {
 var init_parse_script_args = () => {};
 
 // scripts/install-diagnosis.mjs
-import { existsSync as existsSync43, readFileSync as readFileSync36, realpathSync as realpathSync4 } from "node:fs";
+import { existsSync as existsSync44, readFileSync as readFileSync36, realpathSync as realpathSync4 } from "node:fs";
 import { dirname as dirname21, resolve as resolve31 } from "node:path";
 import { homedir as homedir31, platform as platform5 } from "node:os";
 import { spawnSync } from "node:child_process";
 function findPackageRoot(start) {
   try {
     let dir = realpathSync4(start);
-    if (existsSync43(dir) && !existsSync43(resolve31(dir, "package.json"))) {
+    if (existsSync44(dir) && !existsSync44(resolve31(dir, "package.json"))) {
       dir = dirname21(dir);
     }
     while (true) {
       const pkgPath = resolve31(dir, "package.json");
-      if (existsSync43(pkgPath)) {
+      if (existsSync44(pkgPath)) {
         try {
           const pkg = JSON.parse(readFileSync36(pkgPath, "utf8"));
           if (pkg.name === PKG_NAME)
@@ -33605,7 +33816,7 @@ function locateNpmGlobal() {
     if (!root)
       return null;
     const candidate = resolve31(root, PKG_NAME);
-    return existsSync43(resolve31(candidate, "package.json")) ? candidate : null;
+    return existsSync44(resolve31(candidate, "package.json")) ? candidate : null;
   } catch {
     return null;
   }
@@ -33613,7 +33824,7 @@ function locateNpmGlobal() {
 function locateBunGlobal() {
   try {
     const candidate = resolve31(homedir31(), ".bun", "install", "global", "node_modules", PKG_NAME);
-    return existsSync43(resolve31(candidate, "package.json")) ? candidate : null;
+    return existsSync44(resolve31(candidate, "package.json")) ? candidate : null;
   } catch {
     return null;
   }
@@ -33716,7 +33927,7 @@ var init_dashboard_host = __esm(() => {
 
 // scripts/launch.ts
 import { spawn as spawn2 } from "child_process";
-import { realpathSync as realpathSync5, existsSync as existsSync44 } from "node:fs";
+import { realpathSync as realpathSync5, existsSync as existsSync45 } from "node:fs";
 import { resolve as resolve32, dirname as dirname22 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 import { createInterface } from "node:readline";
@@ -33743,7 +33954,7 @@ function launch(mode) {
     cmd = "node";
     const packageRoot = process.env.FAILPROOFAI_PACKAGE_ROOT ?? resolve32(dirname22(realpathSync5(fileURLToPath2(import.meta.url))), "..");
     const serverJsPath = resolve32(packageRoot, ".next/standalone/server.js");
-    if (!existsSync44(serverJsPath)) {
+    if (!existsSync45(serverJsPath)) {
       let shadowMessage = null;
       try {
         const diag = diagnoseShadow({ selfPackageRoot: packageRoot, selfVersion: version2 });
@@ -34498,7 +34709,7 @@ var init_session_pause_cli = __esm(() => {
 
 // scripts/launch.ts
 import { spawn as spawn3 } from "child_process";
-import { realpathSync as realpathSync6, existsSync as existsSync45 } from "node:fs";
+import { realpathSync as realpathSync6, existsSync as existsSync46 } from "node:fs";
 import { resolve as resolve33, dirname as dirname23 } from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 import { createInterface as createInterface2 } from "node:readline";
@@ -34525,7 +34736,7 @@ function launch2(mode) {
     cmd = "node";
     const packageRoot = process.env.FAILPROOFAI_PACKAGE_ROOT ?? resolve33(dirname23(realpathSync6(fileURLToPath3(import.meta.url))), "..");
     const serverJsPath = resolve33(packageRoot, ".next/standalone/server.js");
-    if (!existsSync45(serverJsPath)) {
+    if (!existsSync46(serverJsPath)) {
       let shadowMessage = null;
       try {
         const diag = diagnoseShadow({ selfPackageRoot: packageRoot, selfVersion: version2 });
@@ -34625,7 +34836,7 @@ import { realpathSync as realpathSync7 } from "fs";
 import { dirname as dirname24, resolve as resolve34 } from "path";
 import { fileURLToPath as fileURLToPath4 } from "url";
 // package.json
-var version = "1.0.4";
+var version = "1.0.5-beta.1";
 
 // bin/failproofai.mjs
 if (!process.env.FAILPROOFAI_PACKAGE_ROOT) {