failproofai 1.0.5-beta.1 → 1.0.5

package/dist/cli.mjs

@@ -29,7 +29,7 @@ var __esm = (fn, res, err) => () => {
 var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
 // package.json
-var version2 = "1.0.5-beta.1", package_default;
+var version2 = "1.0.5", package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "failproofai",
@@ -154,16 +154,16 @@ var init_package = __esm(() => {
       browserslist: "4.28.8"
     },
     optionalDependencies: {
-      "@failproofai/failproofaid-linux-x64": "1.0.5-beta.1",
-      "@failproofai/failproofaid-linux-arm64": "1.0.5-beta.1",
-      "@failproofai/failproofaid-darwin-x64": "1.0.5-beta.1",
-      "@failproofai/failproofaid-darwin-arm64": "1.0.5-beta.1"
+      "@failproofai/failproofaid-linux-x64": "1.0.5",
+      "@failproofai/failproofaid-linux-arm64": "1.0.5",
+      "@failproofai/failproofaid-darwin-x64": "1.0.5",
+      "@failproofai/failproofaid-darwin-arm64": "1.0.5"
     },
     failproofaidBinaries: {
-      "linux-x64": "c782c8d7c8522bf8af6f776640cae80fa671affa5b92d8c09e646c8f381d7fd4",
-      "linux-arm64": "6e9717ef40872a530501ad17cc6bc9743546968e11acf45f87f35488d1563e28",
-      "darwin-x64": "b47adb286e2cf08370ec2e1293ea3ed42891c7d2a8a1bece3da8e3e2b0d72f7a",
-      "darwin-arm64": "a5095522dc3f2518fc8177e9e2a3048062540958e3b623b198b401a7d6a2ddd5"
+      "linux-x64": "5fb4c8a993af9279e46306803c68d6650ea57290bbd7ec92795a7f7b696bb506",
+      "linux-arm64": "21c502073649d9c12710fc2707b9dee08b7ac1528b8544b85a755017c8fdff0e",
+      "darwin-x64": "5e02c2f4887793c64f5553d8d00fd21507f88dce1a6869ca1aca2f6468129373",
+      "darwin-arm64": "65be288a3485ca86869580a036e6c7e9b7b5660a6589143b375586b6c28b5c84"
     }
   };
 });
@@ -11574,32 +11574,75 @@ function hermesProjectNameCandidates(name) {
 var PROFILES_DIR = "profiles", HERMES_DEFAULT_PROFILE = "default";
 var init_hermes_profiles = () => {};
 
+// lib/openclaw-profiles.ts
+import { existsSync as existsSync6, readdirSync as readdirSync2 } from "node:fs";
+import { homedir as homedir5 } from "node:os";
+import { basename as basename2, dirname as dirname4, join as join4, resolve as resolve7 } from "node:path";
+function openclawProfileHome() {
+  const stateDir = (process.env.OPENCLAW_STATE_DIR ?? "").trim();
+  if (stateDir)
+    return resolve7(stateDir);
+  const openclawHome = (process.env.OPENCLAW_HOME ?? "").trim();
+  if (openclawHome)
+    return resolve7(openclawHome);
+  const configPath = (process.env.OPENCLAW_CONFIG_PATH || "").trim();
+  if (configPath)
+    return dirname4(resolve7(configPath));
+  return join4(homedir5(), ".openclaw");
+}
+function listOpenClawProfiles() {
+  const activeHome = openclawProfileHome();
+  const activeBase = basename2(activeHome);
+  if (activeBase !== ".openclaw" && !activeBase.startsWith(".openclaw-")) {
+    return [{ name: OPENCLAW_DEFAULT_PROFILE, home: activeHome }];
+  }
+  const parent = dirname4(activeHome);
+  const defaultHome = join4(parent, ".openclaw");
+  const out = [
+    { name: OPENCLAW_DEFAULT_PROFILE, home: defaultHome }
+  ];
+  let entries;
+  try {
+    entries = readdirSync2(parent, { withFileTypes: true });
+  } catch {
+    return out;
+  }
+  const named = entries.filter((entry) => (entry.isDirectory() || entry.isSymbolicLink()) && entry.name.startsWith(".openclaw-") && entry.name.length > ".openclaw-".length && existsSync6(join4(parent, entry.name, "openclaw.json"))).map((entry) => ({
+    name: entry.name.slice(".openclaw-".length),
+    home: join4(parent, entry.name)
+  })).sort((a, b) => a.name.localeCompare(b.name));
+  out.push(...named);
+  return out;
+}
+var OPENCLAW_DEFAULT_PROFILE = "default";
+var init_openclaw_profiles = () => {};
+
 // src/hooks/integrations.ts
 import { execSync as execSync3 } from "node:child_process";
-import { readFileSync as readFileSync5, writeFileSync as writeFileSync3, existsSync as existsSync6, mkdirSync as mkdirSync4, unlinkSync } from "node:fs";
-import { resolve as resolve7, dirname as dirname4 } from "node:path";
+import { readFileSync as readFileSync5, writeFileSync as writeFileSync3, existsSync as existsSync7, mkdirSync as mkdirSync4, unlinkSync } from "node:fs";
+import { resolve as resolve8, dirname as dirname5 } from "node:path";
 import { fileURLToPath } from "node:url";
-import { homedir as homedir5 } from "node:os";
+import { homedir as homedir6 } from "node:os";
 function readJsonFile(path) {
-  if (!existsSync6(path))
+  if (!existsSync7(path))
     return {};
   const raw = readFileSync5(path, "utf8");
   return JSON.parse(raw);
 }
 function writeJsonFile(path, data) {
-  mkdirSync4(dirname4(path), { recursive: true });
+  mkdirSync4(dirname5(path), { recursive: true });
   writeFileSync3(path, JSON.stringify(data, null, 2) + `
 `, "utf8");
 }
 function readYamlDoc(path) {
   try {
-    return existsSync6(path) ? $parseDocument(readFileSync5(path, "utf8")) : $parseDocument("");
+    return existsSync7(path) ? $parseDocument(readFileSync5(path, "utf8")) : $parseDocument("");
   } catch {
     return $parseDocument("");
   }
 }
 function writeYamlDoc(path, doc) {
-  mkdirSync4(dirname4(path), { recursive: true });
+  mkdirSync4(dirname5(path), { recursive: true });
   writeFileSync3(path, doc.toString(), "utf8");
 }
 function isMarkedHook(hook) {
@@ -11643,7 +11686,7 @@ function isMarkedCopilotHook(hook) {
   return false;
 }
 function opencodePluginFilePath(settingsPath) {
-  return resolve7(dirname4(settingsPath), "plugins", "failproofai.mjs");
+  return resolve8(dirname5(settingsPath), "plugins", "failproofai.mjs");
 }
 function buildOpenCodePluginShim(binaryPath, scope) {
   const useNpx = scope === "project";
@@ -11858,8 +11901,8 @@ export default async function failproofaiPlugin({ client, directory }) {
 function getPiExtensionPath() {
   const fromEnv = process.env.FAILPROOFAI_PACKAGE_ROOT;
   if (fromEnv)
-    return resolve7(fromEnv, "pi-extension");
-  return resolve7(fileURLToPath(import.meta.url), "..", "..", "..", "pi-extension");
+    return resolve8(fromEnv, "pi-extension");
+  return resolve8(fileURLToPath(import.meta.url), "..", "..", "..", "pi-extension");
 }
 function isFailproofaiPiEntry(source) {
   if (typeof source !== "string")
@@ -11870,8 +11913,8 @@ function isFailproofaiPiEntry(source) {
 }
 function makePiProjectRelativeEntry(extPath) {
   const cwd = process.cwd();
-  const cwdResolved = resolve7(cwd);
-  const extResolved = resolve7(extPath);
+  const cwdResolved = resolve8(cwd);
+  const extResolved = resolve8(extPath);
   if (extResolved.startsWith(cwdResolved + "/") || extResolved === cwdResolved) {
     const fromSettingsDir = "../" + extResolved.slice(cwdResolved.length + 1);
     return fromSettingsDir;
@@ -11879,7 +11922,7 @@ function makePiProjectRelativeEntry(extPath) {
   return extResolved;
 }
 function hermesConfigHasHooks(settingsPath) {
-  if (!existsSync6(settingsPath))
+  if (!existsSync7(settingsPath))
     return false;
   try {
     const doc = readYamlDoc(settingsPath);
@@ -11897,8 +11940,8 @@ function hermesConfigHasHooks(settingsPath) {
 function getOpenClawPluginPath() {
   const fromEnv = process.env.FAILPROOFAI_PACKAGE_ROOT;
   if (fromEnv)
-    return resolve7(fromEnv, "openclaw-plugin");
-  return resolve7(fileURLToPath(import.meta.url), "..", "..", "..", "openclaw-plugin");
+    return resolve8(fromEnv, "openclaw-plugin");
+  return resolve8(fileURLToPath(import.meta.url), "..", "..", "..", "openclaw-plugin");
 }
 function isFailproofaiOpenClawPath(p) {
   if (typeof p !== "string")
@@ -11928,6 +11971,7 @@ var claudeCode, codex, copilot, cursor, OPENCODE_PLUGIN_REL_PATH = "./plugins/fa
 var init_integrations = __esm(() => {
   init_dist();
   init_hermes_profiles();
+  init_openclaw_profiles();
   init_types();
   claudeCode = {
     id: "claude",
@@ -11935,14 +11979,14 @@ var init_integrations = __esm(() => {
     scopes: HOOK_SCOPES,
     eventTypes: CLAUDE_INSTALL_EVENT_TYPES,
     getSettingsPath(scope, cwd) {
-      const base = cwd ? resolve7(cwd) : process.cwd();
+      const base = cwd ? resolve8(cwd) : process.cwd();
       switch (scope) {
         case "user":
-          return resolve7(homedir5(), ".claude", "settings.json");
+          return resolve8(homedir6(), ".claude", "settings.json");
         case "project":
-          return resolve7(base, ".claude", "settings.json");
+          return resolve8(base, ".claude", "settings.json");
         case "local":
-          return resolve7(base, ".claude", "settings.local.json");
+          return resolve8(base, ".claude", "settings.local.json");
       }
     },
     readSettings(settingsPath) {
@@ -12038,7 +12082,7 @@ var init_integrations = __esm(() => {
     },
     hooksInstalledInSettings(scope, cwd) {
       const settingsPath = this.getSettingsPath(scope, cwd);
-      if (!existsSync6(settingsPath))
+      if (!existsSync7(settingsPath))
         return false;
       try {
         const settings = this.readSettings(settingsPath);
@@ -12067,14 +12111,14 @@ var init_integrations = __esm(() => {
     scopes: CODEX_HOOK_SCOPES,
     eventTypes: CODEX_HOOK_EVENT_TYPES,
     getSettingsPath(scope, cwd) {
-      const base = cwd ? resolve7(cwd) : process.cwd();
+      const base = cwd ? resolve8(cwd) : process.cwd();
       switch (scope) {
         case "user":
-          return resolve7(homedir5(), ".codex", "hooks.json");
+          return resolve8(homedir6(), ".codex", "hooks.json");
         case "project":
-          return resolve7(base, ".codex", "hooks.json");
+          return resolve8(base, ".codex", "hooks.json");
         case "local":
-          return resolve7(base, ".codex", "hooks.json");
+          return resolve8(base, ".codex", "hooks.json");
       }
     },
     readSettings(settingsPath) {
@@ -12154,7 +12198,7 @@ var init_integrations = __esm(() => {
     },
     hooksInstalledInSettings(scope, cwd) {
       const settingsPath = this.getSettingsPath(scope, cwd);
-      if (!existsSync6(settingsPath))
+      if (!existsSync7(settingsPath))
         return false;
       try {
         const settings = this.readSettings(settingsPath);
@@ -12183,14 +12227,14 @@ var init_integrations = __esm(() => {
     scopes: COPILOT_HOOK_SCOPES,
     eventTypes: COPILOT_HOOK_EVENT_TYPES,
     getSettingsPath(scope, cwd) {
-      const base = cwd ? resolve7(cwd) : process.cwd();
+      const base = cwd ? resolve8(cwd) : process.cwd();
       switch (scope) {
         case "user":
-          return resolve7(homedir5(), ".copilot", "hooks", "failproofai.json");
+          return resolve8(homedir6(), ".copilot", "hooks", "failproofai.json");
         case "project":
-          return resolve7(base, ".github", "hooks", "failproofai.json");
+          return resolve8(base, ".github", "hooks", "failproofai.json");
         case "local":
-          return resolve7(base, ".github", "hooks", "failproofai.json");
+          return resolve8(base, ".github", "hooks", "failproofai.json");
       }
     },
     readSettings(settingsPath) {
@@ -12268,7 +12312,7 @@ var init_integrations = __esm(() => {
     },
     hooksInstalledInSettings(scope, cwd) {
       const settingsPath = this.getSettingsPath(scope, cwd);
-      if (!existsSync6(settingsPath))
+      if (!existsSync7(settingsPath))
         return false;
       try {
         const settings = this.readSettings(settingsPath);
@@ -12297,14 +12341,14 @@ var init_integrations = __esm(() => {
     scopes: CURSOR_HOOK_SCOPES,
     eventTypes: CURSOR_HOOK_EVENT_TYPES,
     getSettingsPath(scope, cwd) {
-      const base = cwd ? resolve7(cwd) : process.cwd();
+      const base = cwd ? resolve8(cwd) : process.cwd();
       switch (scope) {
         case "user":
-          return resolve7(homedir5(), ".cursor", "hooks.json");
+          return resolve8(homedir6(), ".cursor", "hooks.json");
         case "project":
-          return resolve7(base, ".cursor", "hooks.json");
+          return resolve8(base, ".cursor", "hooks.json");
         case "local":
-          return resolve7(base, ".cursor", "hooks.json");
+          return resolve8(base, ".cursor", "hooks.json");
       }
     },
     readSettings(settingsPath) {
@@ -12371,7 +12415,7 @@ var init_integrations = __esm(() => {
     },
     hooksInstalledInSettings(scope, cwd) {
       const settingsPath = this.getSettingsPath(scope, cwd);
-      if (!existsSync6(settingsPath))
+      if (!existsSync7(settingsPath))
         return false;
       try {
         const settings = this.readSettings(settingsPath);
@@ -12396,14 +12440,14 @@ var init_integrations = __esm(() => {
     scopes: OPENCODE_HOOK_SCOPES,
     eventTypes: OPENCODE_HOOK_EVENT_TYPES,
     getSettingsPath(scope, cwd) {
-      const base = cwd ? resolve7(cwd) : process.cwd();
+      const base = cwd ? resolve8(cwd) : process.cwd();
       switch (scope) {
         case "user":
-          return resolve7(homedir5(), ".config", "opencode", "opencode.json");
+          return resolve8(homedir6(), ".config", "opencode", "opencode.json");
         case "project":
-          return resolve7(base, ".opencode", "opencode.json");
+          return resolve8(base, ".opencode", "opencode.json");
         case "local":
-          return resolve7(base, ".opencode", "opencode.json");
+          return resolve8(base, ".opencode", "opencode.json");
       }
     },
     readSettings(settingsPath) {
@@ -12414,7 +12458,7 @@ var init_integrations = __esm(() => {
     },
     buildHookEntry(_binaryPath, _eventType, scope) {
       if (scope === "user") {
-        const abs = resolve7(homedir5(), ".config", "opencode", "plugins", "failproofai.mjs");
+        const abs = resolve8(homedir6(), ".config", "opencode", "plugins", "failproofai.mjs");
         return { spec: `file://${abs}`, [FAILPROOFAI_HOOK_MARKER]: true };
       }
       return { spec: OPENCODE_PLUGIN_REL_PATH, [FAILPROOFAI_HOOK_MARKER]: true };
@@ -12429,9 +12473,9 @@ var init_integrations = __esm(() => {
     writeHookEntries(settings, binaryPath, scope) {
       const s = settings;
       const effectiveScope = scope ?? "project";
-      const settingsPath = effectiveScope === "user" ? resolve7(homedir5(), ".config", "opencode", "opencode.json") : resolve7(process.cwd(), ".opencode", "opencode.json");
+      const settingsPath = effectiveScope === "user" ? resolve8(homedir6(), ".config", "opencode", "opencode.json") : resolve8(process.cwd(), ".opencode", "opencode.json");
       const pluginPath = opencodePluginFilePath(settingsPath);
-      mkdirSync4(dirname4(pluginPath), { recursive: true });
+      mkdirSync4(dirname5(pluginPath), { recursive: true });
       writeFileSync3(pluginPath, buildOpenCodePluginShim(binaryPath, effectiveScope), "utf8");
       if (!Array.isArray(s.plugin))
         s.plugin = [];
@@ -12455,7 +12499,7 @@ var init_integrations = __esm(() => {
       }
       this.writeSettings(settingsPath, settings);
       const pluginPath = opencodePluginFilePath(settingsPath);
-      if (existsSync6(pluginPath)) {
+      if (existsSync7(pluginPath)) {
         try {
           const content = readFileSync5(pluginPath, "utf8");
           if (content.includes(FAILPROOFAI_HOOK_MARKER)) {
@@ -12469,7 +12513,7 @@ var init_integrations = __esm(() => {
     },
     hooksInstalledInSettings(scope, cwd) {
       const settingsPath = this.getSettingsPath(scope, cwd);
-      if (!existsSync6(settingsPath))
+      if (!existsSync7(settingsPath))
         return false;
       try {
         const settings = this.readSettings(settingsPath);
@@ -12479,7 +12523,7 @@ var init_integrations = __esm(() => {
         if (!hasEntry)
           return false;
         const pluginPath = opencodePluginFilePath(settingsPath);
-        if (!existsSync6(pluginPath))
+        if (!existsSync7(pluginPath))
           return false;
         const content = readFileSync5(pluginPath, "utf8");
         return content.includes(FAILPROOFAI_HOOK_MARKER);
@@ -12497,14 +12541,14 @@ var init_integrations = __esm(() => {
     scopes: PI_HOOK_SCOPES,
     eventTypes: PI_HOOK_EVENT_TYPES,
     getSettingsPath(scope, cwd) {
-      const base = cwd ? resolve7(cwd) : process.cwd();
+      const base = cwd ? resolve8(cwd) : process.cwd();
       switch (scope) {
         case "user":
-          return resolve7(homedir5(), ".pi", "agent", "settings.json");
+          return resolve8(homedir6(), ".pi", "agent", "settings.json");
         case "project":
-          return resolve7(base, ".pi", "settings.json");
+          return resolve8(base, ".pi", "settings.json");
         case "local":
-          return resolve7(base, ".pi", "settings.json");
+          return resolve8(base, ".pi", "settings.json");
       }
     },
     readSettings(settingsPath) {
@@ -12546,7 +12590,7 @@ var init_integrations = __esm(() => {
       }
     },
     removeHooksFromFile(settingsPath) {
-      if (!existsSync6(settingsPath))
+      if (!existsSync7(settingsPath))
         return 0;
       const settings = this.readSettings(settingsPath);
       if (!Array.isArray(settings.packages))
@@ -12561,7 +12605,7 @@ var init_integrations = __esm(() => {
     },
     hooksInstalledInSettings(scope, cwd) {
       const settingsPath = this.getSettingsPath(scope, cwd);
-      if (!existsSync6(settingsPath))
+      if (!existsSync7(settingsPath))
         return false;
       try {
         const settings = this.readSettings(settingsPath);
@@ -12582,10 +12626,10 @@ var init_integrations = __esm(() => {
     scopes: HERMES_HOOK_SCOPES,
     eventTypes: HERMES_HOOK_EVENT_TYPES,
     getSettingsPath() {
-      return resolve7(hermesRoot(), "config.yaml");
+      return resolve8(hermesRoot(), "config.yaml");
     },
     getSettingsPaths() {
-      return listHermesProfiles().map((p) => resolve7(p.home, "config.yaml"));
+      return listHermesProfiles().map((p) => resolve8(p.home, "config.yaml"));
     },
     readSettings(settingsPath) {
       return readYamlDoc(settingsPath);
@@ -12620,7 +12664,7 @@ var init_integrations = __esm(() => {
       doc.set("hooks_auto_accept", true);
     },
     removeHooksFromFile(settingsPath) {
-      if (!existsSync6(settingsPath))
+      if (!existsSync7(settingsPath))
         return 0;
       const doc = readYamlDoc(settingsPath);
       const js = doc.toJS() ?? {};
@@ -12665,7 +12709,10 @@ var init_integrations = __esm(() => {
     scopes: OPENCLAW_HOOK_SCOPES,
     eventTypes: OPENCLAW_HOOK_EVENT_TYPES,
     getSettingsPath() {
-      return resolve7(homedir5(), ".openclaw", "openclaw.json");
+      return resolve8(listOpenClawProfiles()[0].home, "openclaw.json");
+    },
+    getSettingsPaths() {
+      return listOpenClawProfiles().map((profile) => resolve8(profile.home, "openclaw.json"));
     },
     readSettings(settingsPath) {
       return readJsonFile(settingsPath);
@@ -12710,7 +12757,7 @@ var init_integrations = __esm(() => {
       hooks.allowConversationAccess = true;
     },
     removeHooksFromFile(settingsPath) {
-      if (!existsSync6(settingsPath))
+      if (!existsSync7(settingsPath))
         return 0;
       const settings = this.readSettings(settingsPath);
       const plugins = settings.plugins;
@@ -12738,18 +12785,20 @@ var init_integrations = __esm(() => {
       return removed;
     },
     hooksInstalledInSettings(scope, cwd) {
-      const settingsPath = this.getSettingsPath(scope, cwd);
-      if (!existsSync6(settingsPath))
-        return false;
-      try {
-        const settings = this.readSettings(settingsPath);
-        const paths = settings.plugins?.load?.paths;
-        const pathPresent = Array.isArray(paths) && paths.some((p) => isFailproofaiOpenClawPath(p));
-        const entryEnabled = settings.plugins?.entries?.[OPENCLAW_PLUGIN_ID]?.enabled === true;
-        return pathPresent && entryEnabled;
-      } catch {
-        return false;
-      }
+      const settingsPaths = settingsPathsFor(this, scope, cwd);
+      return settingsPaths.length > 0 && settingsPaths.every((settingsPath) => {
+        if (!existsSync7(settingsPath))
+          return false;
+        try {
+          const settings = this.readSettings(settingsPath);
+          const paths = settings.plugins?.load?.paths;
+          const pathPresent = Array.isArray(paths) && paths.some((p) => isFailproofaiOpenClawPath(p));
+          const entryEnabled = settings.plugins?.entries?.[OPENCLAW_PLUGIN_ID]?.enabled === true;
+          return pathPresent && entryEnabled;
+        } catch {
+          return false;
+        }
+      });
     },
     detectInstalled() {
       return binaryExists("openclaw");
@@ -12761,14 +12810,14 @@ var init_integrations = __esm(() => {
     scopes: FACTORY_HOOK_SCOPES,
     eventTypes: FACTORY_HOOK_EVENT_TYPES,
     getSettingsPath(scope, cwd) {
-      const base = cwd ? resolve7(cwd) : process.cwd();
+      const base = cwd ? resolve8(cwd) : process.cwd();
       switch (scope) {
         case "user":
-          return resolve7(homedir5(), ".factory", "hooks.json");
+          return resolve8(homedir6(), ".factory", "hooks.json");
         case "project":
-          return resolve7(base, ".factory", "hooks.json");
+          return resolve8(base, ".factory", "hooks.json");
         case "local":
-          return resolve7(base, ".factory", "hooks.json");
+          return resolve8(base, ".factory", "hooks.json");
       }
     },
     readSettings(settingsPath) {
@@ -12836,7 +12885,7 @@ var init_integrations = __esm(() => {
     },
     hooksInstalledInSettings(scope, cwd) {
       const settingsPath = this.getSettingsPath(scope, cwd);
-      if (!existsSync6(settingsPath))
+      if (!existsSync7(settingsPath))
         return false;
       try {
         const settings = this.readSettings(settingsPath);
@@ -12863,14 +12912,14 @@ var init_integrations = __esm(() => {
     scopes: DEVIN_HOOK_SCOPES,
     eventTypes: DEVIN_HOOK_EVENT_TYPES,
     getSettingsPath(scope, cwd) {
-      const base = cwd ? resolve7(cwd) : process.cwd();
+      const base = cwd ? resolve8(cwd) : process.cwd();
       switch (scope) {
         case "user":
-          return resolve7(homedir5(), ".config", "devin", "config.json");
+          return resolve8(homedir6(), ".config", "devin", "config.json");
         case "project":
-          return resolve7(base, ".devin", "config.json");
+          return resolve8(base, ".devin", "config.json");
         case "local":
-          return resolve7(base, ".devin", "config.json");
+          return resolve8(base, ".devin", "config.json");
       }
     },
     readSettings(settingsPath) {
@@ -12942,7 +12991,7 @@ var init_integrations = __esm(() => {
     },
     hooksInstalledInSettings(scope, cwd) {
       const settingsPath = this.getSettingsPath(scope, cwd);
-      if (!existsSync6(settingsPath))
+      if (!existsSync7(settingsPath))
         return false;
       try {
         const settings = this.readSettings(settingsPath);
@@ -12972,14 +13021,14 @@ var init_integrations = __esm(() => {
     scopes: ANTIGRAVITY_HOOK_SCOPES,
     eventTypes: ANTIGRAVITY_HOOK_EVENT_TYPES,
     getSettingsPath(scope, cwd) {
-      const base = cwd ? resolve7(cwd) : process.cwd();
+      const base = cwd ? resolve8(cwd) : process.cwd();
       switch (scope) {
         case "user":
-          return resolve7(homedir5(), ".gemini", "config", "hooks.json");
+          return resolve8(homedir6(), ".gemini", "config", "hooks.json");
         case "project":
-          return resolve7(base, ".agents", "hooks.json");
+          return resolve8(base, ".agents", "hooks.json");
         case "local":
-          return resolve7(base, ".agents", "hooks.json");
+          return resolve8(base, ".agents", "hooks.json");
       }
     },
     readSettings(settingsPath) {
@@ -13081,7 +13130,7 @@ var init_integrations = __esm(() => {
     },
     hooksInstalledInSettings(scope, cwd) {
       const settingsPath = this.getSettingsPath(scope, cwd);
-      if (!existsSync6(settingsPath))
+      if (!existsSync7(settingsPath))
         return false;
       try {
         const settings = this.readSettings(settingsPath);
@@ -13113,14 +13162,14 @@ var init_integrations = __esm(() => {
     scopes: GOOSE_HOOK_SCOPES,
     eventTypes: GOOSE_HOOK_EVENT_TYPES,
     getSettingsPath(scope, cwd) {
-      const base = cwd ? resolve7(cwd) : process.cwd();
+      const base = cwd ? resolve8(cwd) : process.cwd();
       switch (scope) {
         case "user":
-          return resolve7(homedir5(), ".agents", "plugins", "failproofai", "hooks", "hooks.json");
+          return resolve8(homedir6(), ".agents", "plugins", "failproofai", "hooks", "hooks.json");
         case "project":
-          return resolve7(base, ".agents", "plugins", "failproofai", "hooks", "hooks.json");
+          return resolve8(base, ".agents", "plugins", "failproofai", "hooks", "hooks.json");
         case "local":
-          return resolve7(base, ".agents", "plugins", "failproofai", "hooks", "hooks.json");
+          return resolve8(base, ".agents", "plugins", "failproofai", "hooks", "hooks.json");
       }
     },
     readSettings(settingsPath) {
@@ -13187,7 +13236,7 @@ var init_integrations = __esm(() => {
     },
     hooksInstalledInSettings(scope, cwd) {
       const settingsPath = this.getSettingsPath(scope, cwd);
-      if (!existsSync6(settingsPath))
+      if (!existsSync7(settingsPath))
         return false;
       try {
         const settings = this.readSettings(settingsPath);
@@ -13252,7 +13301,7 @@ var init_custom_hooks_registry = __esm(() => {
 // src/hooks/loader-utils.ts
 import { readFile as readFile2, writeFile as writeFile2, unlink, access, mkdir, lstat } from "fs/promises";
 import { tmpdir } from "os";
-import { resolve as resolve8, dirname as dirname5, relative as relative2, join as join4 } from "path";
+import { resolve as resolve9, dirname as dirname6, relative as relative2, join as join5 } from "path";
 import { pathToFileURL } from "url";
 import { createHash as createHash3 } from "crypto";
 function isTmpArtifact(name) {
@@ -13265,7 +13314,7 @@ async function sweepStaleTmpArtifacts(dir, now = Date.now()) {
     for (const name of await readdir(dir)) {
       if (!isTmpArtifact(name))
         continue;
-      const path = resolve8(dir, name);
+      const path = resolve9(dir, name);
       try {
         const info = await stat(path);
         if (now - info.mtimeMs < TMP_SWEEP_MIN_AGE_MS)
@@ -13288,14 +13337,14 @@ async function fileExists(path) {
 async function findDistIndex() {
   const distPath = process.env.FAILPROOFAI_DIST_PATH;
   if (distPath) {
-    const candidate = resolve8(distPath, "index.js");
+    const candidate = resolve9(distPath, "index.js");
     if (await fileExists(candidate))
       return candidate;
   }
   const candidates = [
-    resolve8(dirname5(process.execPath), "..", "assets", "dist", "index.js"),
-    resolve8(process.cwd(), "dist", "index.js"),
-    resolve8(process.cwd(), "node_modules", "failproofai", "dist", "index.js")
+    resolve9(dirname6(process.execPath), "..", "assets", "dist", "index.js"),
+    resolve9(process.cwd(), "dist", "index.js"),
+    resolve9(process.cwd(), "node_modules", "failproofai", "dist", "index.js")
   ];
   for (const c of candidates) {
     if (await fileExists(c))
@@ -13304,8 +13353,8 @@ async function findDistIndex() {
   return null;
 }
 async function resolveLocalImport(fromDir, specifier) {
-  const base = resolve8(fromDir, specifier);
-  const candidates = [base, `${base}.js`, `${base}.mjs`, `${base}.ts`, resolve8(base, "index.js")];
+  const base = resolve9(fromDir, specifier);
+  const candidates = [base, `${base}.js`, `${base}.mjs`, `${base}.ts`, resolve9(base, "index.js")];
   for (const c of candidates) {
     if (await fileExists(c))
       return c;
@@ -13313,7 +13362,7 @@ async function resolveLocalImport(fromDir, specifier) {
   return null;
 }
 async function writeShim(dir, name, code, exclusive) {
-  const shimPath = join4(dir, name);
+  const shimPath = join5(dir, name);
   await writeFile2(shimPath, code, {
     encoding: "utf-8",
     mode: 384,
@@ -13382,7 +13431,7 @@ async function rewriteFileTree(entryPath, distUrl, distIndex, tmpSuffix = TMP_SU
     if (distIndex) {
       code = code.replace(/require\s*\(\s*(['"])(?:claudeye|failproofai)\1\s*\)/g, `require('${distIndex.replace(/\\/g, "\\\\")}')`);
     }
-    const dir = dirname5(filePath);
+    const dir = dirname6(filePath);
     const rewrites = new Map;
     for (const re of [LOCAL_IMPORT_RE, LOCAL_REQUIRE_RE]) {
       const freshRe = new RegExp(re.source, re.flags);
@@ -13576,27 +13625,27 @@ var init_telemetry_id2 = __esm(() => {
 });
 
 // src/hooks/custom-hooks-loader.ts
-import { resolve as resolve9, isAbsolute as isAbsolute2, basename as basename2 } from "node:path";
+import { resolve as resolve10, isAbsolute as isAbsolute2, basename as basename3 } from "node:path";
 import { randomUUID } from "crypto";
-import { existsSync as existsSync7, readdirSync as readdirSync2 } from "node:fs";
+import { existsSync as existsSync8, readdirSync as readdirSync3 } from "node:fs";
 import { readFile as readFile3 } from "node:fs/promises";
 import { pathToFileURL as pathToFileURL2 } from "node:url";
 import { createHash as createHash4 } from "node:crypto";
 function discoverPolicyFiles(dir) {
-  if (!existsSync7(dir))
+  if (!existsSync8(dir))
     return [];
   try {
-    const entries = readdirSync2(dir, { withFileTypes: true });
-    return entries.filter((e) => e.isFile() && CONVENTION_FILE_RE.test(e.name)).sort((a, b) => a.name.localeCompare(b.name)).map((e) => resolve9(dir, e.name));
+    const entries = readdirSync3(dir, { withFileTypes: true });
+    return entries.filter((e) => e.isFile() && CONVENTION_FILE_RE.test(e.name)).sort((a, b) => a.name.localeCompare(b.name)).map((e) => resolve10(dir, e.name));
   } catch {
     return [];
   }
 }
 function findSkippedPolicyFiles(dir) {
-  if (!existsSync7(dir))
+  if (!existsSync8(dir))
     return [];
   try {
-    return readdirSync2(dir, { withFileTypes: true }).filter((e) => e.isFile() && LOADABLE_EXT_RE.test(e.name) && !CONVENTION_FILE_RE.test(e.name) && !e.name.endsWith(".d.ts") && !isTmpArtifact(e.name)).map((e) => e.name).sort((a, b) => a.localeCompare(b));
+    return readdirSync3(dir, { withFileTypes: true }).filter((e) => e.isFile() && LOADABLE_EXT_RE.test(e.name) && !CONVENTION_FILE_RE.test(e.name) && !e.name.endsWith(".d.ts") && !isTmpArtifact(e.name)).map((e) => e.name).sort((a, b) => a.localeCompare(b));
   } catch {
     return [];
   }
@@ -13656,7 +13705,7 @@ async function loadSingleFile(absPath, opts) {
       error_type: errorType,
       is_convention: !!opts?.conventionScope,
       convention_scope: opts?.conventionScope ?? null,
-      file_basename: basename2(absPath)
+      file_basename: basename3(absPath)
     });
     if (opts?.strict)
       throw new Error(`Failed to load custom hooks from ${absPath}: ${msg}`);
@@ -13679,8 +13728,8 @@ async function fingerprintTemporaryTree(tmpFiles, tmpSuffix) {
 async function loadCustomHooks(customPoliciesPath, opts) {
   if (!customPoliciesPath)
     return [];
-  const absPath = isAbsolute2(customPoliciesPath) ? customPoliciesPath : resolve9(opts?.sessionCwd ?? process.cwd(), customPoliciesPath);
-  if (!existsSync7(absPath)) {
+  const absPath = isAbsolute2(customPoliciesPath) ? customPoliciesPath : resolve10(opts?.sessionCwd ?? process.cwd(), customPoliciesPath);
+  if (!existsSync8(absPath)) {
     if (opts?.strict)
       throw new Error(`Custom hooks file not found: ${absPath}`);
     hookLogWarn(`customPoliciesPath not found: ${absPath}`);
@@ -13726,7 +13775,7 @@ async function loadAllCustomHooks(customPoliciesPaths, opts) {
   const loadedPaths = new Set;
   const cloudManagedByPath = new Map;
   for (const policy of opts?.cloudManagedPolicies ?? []) {
-    const key = resolve9(policy.path);
+    const key = resolve10(policy.path);
     const existing = cloudManagedByPath.get(key);
     if (!existing) {
       cloudManagedByPath.set(key, policy);
@@ -13745,7 +13794,7 @@ async function loadAllCustomHooks(customPoliciesPaths, opts) {
   const packByPath = new Map;
   const packIdsByPath = new Map;
   for (const pack of opts?.packs ?? []) {
-    const key = resolve9(pack.path);
+    const key = resolve10(pack.path);
     packIdsByPath.set(key, [...packIdsByPath.get(key) ?? [], pack.id]);
     const existing = packByPath.get(key);
     if (!existing) {
@@ -13763,10 +13812,10 @@ async function loadAllCustomHooks(customPoliciesPaths, opts) {
     });
   }
   for (const customPoliciesPath of typeof customPoliciesPaths === "string" ? [customPoliciesPaths] : customPoliciesPaths ?? []) {
-    const absPath = resolve9(projectRoot, customPoliciesPath);
+    const absPath = resolve10(projectRoot, customPoliciesPath);
     const cloudManaged = cloudManagedByPath.get(absPath);
     const pack = packByPath.get(absPath);
-    if (existsSync7(absPath)) {
+    if (existsSync8(absPath)) {
       if (!loadedPaths.has(absPath)) {
         loadedPaths.add(absPath);
         const hooksBefore = getCustomHooks().length;
@@ -13801,7 +13850,7 @@ async function loadAllCustomHooks(customPoliciesPaths, opts) {
     }
   }
   const hooksBeforeConvention = getCustomHooks().length;
-  const projectDir = resolve9(projectRoot, ".failproofai", "policies");
+  const projectDir = resolve10(projectRoot, ".failproofai", "policies");
   const projectScope = projectDir === customPoliciesDir() ? "user" : "project";
   if (conventionEnabled) {
     sweepStaleTmpArtifacts(projectDir);
@@ -13815,12 +13864,12 @@ async function loadAllCustomHooks(customPoliciesPaths, opts) {
     await loadSingleFile(file, { conventionScope: projectScope });
     const newHooks = getCustomHooks().slice(hooksBefore);
     for (const hook of newHooks) {
-      hook.__policyId = conventionPolicyId(projectScope, basename2(file), hook.name);
+      hook.__policyId = conventionPolicyId(projectScope, basename3(file), hook.name);
     }
     if (newHooks.length > 0) {
       conventionSources.push({
         scope: projectScope,
-        file: basename2(file),
+        file: basename3(file),
         hookNames: newHooks.map((h) => h.name)
       });
     }
@@ -13837,12 +13886,12 @@ async function loadAllCustomHooks(customPoliciesPaths, opts) {
     await loadSingleFile(file, { conventionScope: "user" });
     const newHooks = getCustomHooks().slice(hooksBefore);
     for (const hook of newHooks) {
-      hook.__policyId = conventionPolicyId("user", basename2(file), hook.name);
+      hook.__policyId = conventionPolicyId("user", basename3(file), hook.name);
     }
     if (newHooks.length > 0) {
       conventionSources.push({
         scope: "user",
-        file: basename2(file),
+        file: basename3(file),
         hookNames: newHooks.map((h) => h.name)
       });
     }
@@ -14834,8 +14883,8 @@ var init_pack_cli = __esm(() => {
 
 // src/hooks/pack-store.ts
 import { createHash as createHash5 } from "node:crypto";
-import { existsSync as existsSync8, mkdirSync as mkdirSync5, readFileSync as readFileSync6, renameSync as renameSync2, rmSync as rmSync2, writeFileSync as writeFileSync4 } from "node:fs";
-import { dirname as dirname6, resolve as resolve10 } from "node:path";
+import { existsSync as existsSync9, mkdirSync as mkdirSync5, readFileSync as readFileSync6, renameSync as renameSync2, rmSync as rmSync2, writeFileSync as writeFileSync4 } from "node:fs";
+import { dirname as dirname7, resolve as resolve11 } from "node:path";
 function baseUrl() {
   return (process.env.FAILPROOFAI_PACK_BASE_URL || DEFAULT_BASE_URL).replace(/\/+$/, "");
 }
@@ -15006,7 +15055,7 @@ function sha256(bytes) {
 function writeAtomic(target, bytes) {
   const tempPath = `${target}.${process.pid}.tmp`;
   try {
-    mkdirSync5(dirname6(target), { recursive: true });
+    mkdirSync5(dirname7(target), { recursive: true });
     writeFileSync4(tempPath, bytes);
     renameSync2(tempPath, target);
   } catch (err) {
@@ -15183,8 +15232,8 @@ async function addPack(source, opts) {
   const { enabled, reason } = resolveSelection(fetched.policies, opts, prior?.enabled ? prior.enabled.filter((n) => available.includes(n)) : prior?.enabled, Boolean(prior));
   const root = packsRoot();
   const artifactRel = `artifacts/${fetched.artifactDigest}.mjs`;
-  const artifactAbs = resolve10(root, artifactRel);
-  if (!existsSync8(artifactAbs))
+  const artifactAbs = resolve11(root, artifactRel);
+  if (!existsSync9(artifactAbs))
     writeAtomic(artifactAbs, fetched.artifact);
   try {
     await verifyArtifactRegisters(artifactAbs, available);
@@ -15226,8 +15275,8 @@ async function addPack(source, opts) {
   };
 }
 function setPackPolicyEnabled(packId, name, on) {
-  const manifestPath = resolve10(packsRoot(), "installed.json");
-  if (!existsSync8(manifestPath))
+  const manifestPath = resolve11(packsRoot(), "installed.json");
+  if (!existsSync9(manifestPath))
     return { ok: false, reason: "no packs are installed" };
   let raw;
   try {
@@ -15260,8 +15309,8 @@ function bareId(value) {
   return (at > 0 ? trimmed.slice(0, at) : trimmed).trim();
 }
 function removePack(id) {
-  const manifestPath = resolve10(packsRoot(), "installed.json");
-  if (!existsSync8(manifestPath))
+  const manifestPath = resolve11(packsRoot(), "installed.json");
+  if (!existsSync9(manifestPath))
     return null;
   let raw;
   try {
@@ -15284,9 +15333,9 @@ function removePack(id) {
   return removed.id;
 }
 function upsertInstalled(record, carryAbsorbedSelection = true) {
-  const manifestPath = resolve10(packsRoot(), "installed.json");
+  const manifestPath = resolve11(packsRoot(), "installed.json");
   let packs = [];
-  if (existsSync8(manifestPath)) {
+  if (existsSync9(manifestPath)) {
     try {
       const raw = JSON.parse(readFileSync6(manifestPath, "utf8"));
       if (Array.isArray(raw.packs))
@@ -16130,21 +16179,21 @@ import {
   writeFileSync as writeFileSync5,
   appendFileSync as appendFileSync2,
   renameSync as renameSync3,
-  readdirSync as readdirSync3,
+  readdirSync as readdirSync4,
   mkdirSync as mkdirSync6,
-  existsSync as existsSync9,
+  existsSync as existsSync10,
   statSync as statSync5,
   unlinkSync as unlinkSync2
 } from "node:fs";
-import { join as join5 } from "node:path";
+import { join as join6 } from "node:path";
 function ensureDir() {
-  if (!existsSync9(storeDirValue())) {
+  if (!existsSync10(storeDirValue())) {
     mkdirSync6(storeDirValue(), { recursive: true });
   }
 }
 function acquireLock() {
   ensureDir();
-  const lockPath = join5(storeDirValue(), LOCK_FILE);
+  const lockPath = join6(storeDirValue(), LOCK_FILE);
   const deadline = Date.now() + LOCK_STALE_MS;
   while (Date.now() < deadline) {
     try {
@@ -16165,15 +16214,15 @@ function acquireLock() {
 }
 function releaseLock() {
   try {
-    unlinkSync2(join5(storeDirValue(), LOCK_FILE));
+    unlinkSync2(join6(storeDirValue(), LOCK_FILE));
   } catch {}
 }
 function persistHookActivity(entry) {
   ensureDir();
   acquireLock();
   try {
-    const currentPath = join5(storeDirValue(), CURRENT_FILE);
-    const countPath = join5(storeDirValue(), COUNT_FILE);
+    const currentPath = join6(storeDirValue(), CURRENT_FILE);
+    const countPath = join6(storeDirValue(), COUNT_FILE);
     const lineCount = readCount(countPath);
     if (lineCount >= PAGE_SIZE) {
       try {
@@ -16193,7 +16242,7 @@ function persistHookActivity(entry) {
 }
 function rotate(currentPath, countPath) {
   const archiveName = `page-${Date.now()}-${rotateSeq++}.jsonl`;
-  const archivePath = join5(storeDirValue(), archiveName);
+  const archivePath = join6(storeDirValue(), archiveName);
   renameSync3(currentPath, archivePath);
   writeCount(countPath, 0);
 }
@@ -16219,7 +16268,7 @@ function readFileSafe(filePath) {
 }
 function readStoredStats() {
   try {
-    return JSON.parse(readFileSync7(join5(storeDirValue(), STATS_FILE), "utf-8"));
+    return JSON.parse(readFileSync7(join6(storeDirValue(), STATS_FILE), "utf-8"));
   } catch {
     return { totalEvents: 0, denyCount: 0, policyMap: {} };
   }
@@ -16237,10 +16286,10 @@ function foldEntry(s, entry) {
   }
 }
 function writeStoredStats(s) {
-  const tmpPath = join5(storeDirValue(), `stats.json.${process.pid}.tmp`);
+  const tmpPath = join6(storeDirValue(), `stats.json.${process.pid}.tmp`);
   try {
     writeFileSync5(tmpPath, JSON.stringify(s), "utf-8");
-    renameSync3(tmpPath, join5(storeDirValue(), STATS_FILE));
+    renameSync3(tmpPath, join6(storeDirValue(), STATS_FILE));
     return true;
   } catch {
     try {
@@ -16260,8 +16309,8 @@ function rebuildHookActivityStats() {
   const s = { totalEvents: 0, denyCount: 0, policyMap: {} };
   let sawAny = false;
   for (const file of files) {
-    const path = join5(storeDirValue(), file);
-    if (!existsSync9(path))
+    const path = join6(storeDirValue(), file);
+    if (!existsSync10(path))
       continue;
     sawAny = true;
     for (const entry of readJsonlFile(path))
@@ -16273,12 +16322,12 @@ function rebuildHookActivityStats() {
 }
 function getAllHookActivityEntries() {
   ensureDir();
-  const currentPath = join5(storeDirValue(), CURRENT_FILE);
+  const currentPath = join6(storeDirValue(), CURRENT_FILE);
   const currentEntries = readJsonlFile(currentPath).reverse();
   const archives = getArchiveFiles();
   const archiveEntries = [];
   for (const file of archives) {
-    const entries = readJsonlFile(join5(storeDirValue(), file));
+    const entries = readJsonlFile(join6(storeDirValue(), file));
     archiveEntries.push(...entries.reverse());
   }
   return [...currentEntries, ...archiveEntries];
@@ -16308,7 +16357,7 @@ function readJsonlFile(filePath) {
 }
 function getArchiveFiles() {
   try {
-    const files = readdirSync3(storeDirValue());
+    const files = readdirSync4(storeDirValue());
     return files.filter((f) => f.startsWith("page-") && f.endsWith(".jsonl")).sort((a, b) => {
       const partsA = a.slice(5, -6).split("-");
       const partsB = b.slice(5, -6).split("-");
@@ -16330,8 +16379,8 @@ var init_hook_activity_store = __esm(() => {
 });
 
 // src/hooks/delivery-health.ts
-import { existsSync as existsSync10, readdirSync as readdirSync4, statSync as statSync6 } from "node:fs";
-import { join as join6 } from "node:path";
+import { existsSync as existsSync11, readdirSync as readdirSync5, statSync as statSync6 } from "node:fs";
+import { join as join7 } from "node:path";
 function parseParkedName(name) {
   const poison = name.endsWith(POISON_SUFFIX);
   const withoutPoison = poison ? name.slice(0, -POISON_SUFFIX.length) : name;
@@ -16359,11 +16408,11 @@ function parseParkedName(name) {
 }
 function deliveryHealth(home, now = Date.now()) {
   const dir = failedDir(home);
-  if (!existsSync10(dir))
+  if (!existsSync11(dir))
     return EMPTY;
   let entries;
   try {
-    entries = readdirSync4(dir);
+    entries = readdirSync5(dir);
   } catch {
     return EMPTY;
   }
@@ -16384,7 +16433,7 @@ function deliveryHealth(home, now = Date.now()) {
         credentialRejected += 1;
     }
     try {
-      const mtime = statSync6(join6(dir, name)).mtimeMs;
+      const mtime = statSync6(join7(dir, name)).mtimeMs;
       if (oldestMtime === undefined || mtime < oldestMtime)
         oldestMtime = mtime;
     } catch {}
@@ -16478,10 +16527,10 @@ function runtimeCache(fn, revalidateSeconds, options) {
 }
 
 // lib/paths.ts
-import { homedir as homedir6 } from "os";
-import { join as join7 } from "path";
+import { homedir as homedir7 } from "os";
+import { join as join8 } from "path";
 function getDefaultClaudeProjectsPath() {
-  return join7(homedir6(), ".claude", "projects");
+  return join8(homedir7(), ".claude", "projects");
 }
 function decodeFolderName(name) {
   if (/^[A-Za-z]--/.test(name)) {
@@ -16571,8 +16620,8 @@ __export(exports_codex_projects, {
   getCodexSessionsByEncodedName: () => getCodexSessionsByEncodedName
 });
 import { open, readdir } from "node:fs/promises";
-import { homedir as homedir7 } from "node:os";
-import { join as join8 } from "node:path";
+import { homedir as homedir8 } from "node:os";
+import { join as join9 } from "node:path";
 async function safeReaddir(dir) {
   try {
     return await readdir(dir, { withFileTypes: true });
@@ -16620,7 +16669,7 @@ async function listJsonlFiles(dir) {
   const entries = await safeReaddir(dir);
   if (!entries)
     return [];
-  return entries.filter((e) => e.isFile() && e.name.endsWith(".jsonl")).map((e) => join8(dir, e.name));
+  return entries.filter((e) => e.isFile() && e.name.endsWith(".jsonl")).map((e) => join9(dir, e.name));
 }
 async function scanCodexSessions() {
   const yearDirs = await safeReaddir(CODEX_SESSIONS_ROOT);
@@ -16630,19 +16679,19 @@ async function scanCodexSessions() {
   for (const y of yearDirs) {
     if (!y.isDirectory())
       continue;
-    const monthDirs = await safeReaddir(join8(CODEX_SESSIONS_ROOT, y.name));
+    const monthDirs = await safeReaddir(join9(CODEX_SESSIONS_ROOT, y.name));
     if (!monthDirs)
       continue;
     for (const m of monthDirs) {
       if (!m.isDirectory())
         continue;
-      const dayDirs = await safeReaddir(join8(CODEX_SESSIONS_ROOT, y.name, m.name));
+      const dayDirs = await safeReaddir(join9(CODEX_SESSIONS_ROOT, y.name, m.name));
       if (!dayDirs)
         continue;
       for (const d of dayDirs) {
         if (!d.isDirectory())
           continue;
-        const dayPath = join8(CODEX_SESSIONS_ROOT, y.name, m.name, d.name);
+        const dayPath = join9(CODEX_SESSIONS_ROOT, y.name, m.name, d.name);
         filePaths.push(...await listJsonlFiles(dayPath));
       }
     }
@@ -16750,7 +16799,7 @@ var CODEX_SESSIONS_ROOT, SESSION_ID_RE, FIRST_LINE_CHUNK_BYTES, cachedScan, getC
 var init_codex_projects = __esm(() => {
   init_paths();
   init_logger();
-  CODEX_SESSIONS_ROOT = join8(homedir7(), ".codex", "sessions");
+  CODEX_SESSIONS_ROOT = join9(homedir8(), ".codex", "sessions");
   SESSION_ID_RE = /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/i;
   FIRST_LINE_CHUNK_BYTES = 256 * 1024;
   cachedScan = runtimeCache(scanCodexSessions, 30);
@@ -16766,10 +16815,10 @@ __export(exports_copilot_projects, {
   getCopilotSessionsByEncodedName: () => getCopilotSessionsByEncodedName
 });
 import { readdir as readdir2, readFile as readFile4, stat } from "node:fs/promises";
-import { homedir as homedir8 } from "node:os";
-import { join as join9 } from "node:path";
+import { homedir as homedir9 } from "node:os";
+import { join as join10 } from "node:path";
 function getCopilotSessionStateRoot() {
-  return join9(process.env.COPILOT_HOME || join9(homedir8(), ".copilot"), "session-state");
+  return join10(process.env.COPILOT_HOME || join10(homedir9(), ".copilot"), "session-state");
 }
 async function safeReaddir2(dir) {
   try {
@@ -16798,8 +16847,8 @@ async function scanCopilotSessions() {
     return [];
   const candidates = entries.filter((e) => e.isDirectory()).map((e) => ({
     sessionId: e.name,
-    workspacePath: join9(root, e.name, "workspace.yaml"),
-    eventsPath: join9(root, e.name, "events.jsonl")
+    workspacePath: join10(root, e.name, "workspace.yaml"),
+    eventsPath: join10(root, e.name, "events.jsonl")
   }));
   const settled = await batchAll(candidates.map((c) => async () => {
     let workspaceText;
@@ -16910,10 +16959,10 @@ __export(exports_cursor_projects, {
   getCursorSessionsByEncodedName: () => getCursorSessionsByEncodedName
 });
 import { readdir as readdir3, readFile as readFile5, stat as stat2 } from "node:fs/promises";
-import { homedir as homedir9 } from "node:os";
-import { join as join10 } from "node:path";
+import { homedir as homedir10 } from "node:os";
+import { join as join11 } from "node:path";
 function getCursorHome() {
-  return process.env.CURSOR_HOME || join10(homedir9(), ".cursor");
+  return process.env.CURSOR_HOME || join11(homedir10(), ".cursor");
 }
 async function safeReaddir3(dir) {
   try {
@@ -16945,7 +16994,7 @@ function parseCwdFromMetaText(text) {
 }
 async function findFirstUsableMeta(dir, candidates) {
   for (const name of candidates) {
-    const path = join10(dir, name);
+    const path = join11(dir, name);
     if (await statMtime2(path) === null)
       continue;
     let text;
@@ -16962,7 +17011,7 @@ async function findFirstUsableMeta(dir, candidates) {
 }
 async function findFirstExistingPath(dir, candidates) {
   for (const name of candidates) {
-    const path = join10(dir, name);
+    const path = join11(dir, name);
     if (await statMtime2(path) !== null)
       return path;
   }
@@ -16972,7 +17021,7 @@ async function scanCursorSessions() {
   const home = getCursorHome();
   const newCandidates = [];
   const legacyCandidates = [];
-  const projectsRoot = join10(home, NEW_PROJECTS_DIR);
+  const projectsRoot = join11(home, NEW_PROJECTS_DIR);
   const projectEntries = await safeReaddir3(projectsRoot);
   if (projectEntries) {
     for (const proj of projectEntries) {
@@ -16980,7 +17029,7 @@ async function scanCursorSessions() {
         continue;
       const decoded = decodeFolderName(proj.name);
       const cwd = decoded.startsWith("/") || /^[A-Za-z]:\//.test(decoded) ? decoded : `/${decoded}`;
-      const transcriptsRoot = join10(projectsRoot, proj.name, NEW_AGENT_TRANSCRIPTS_DIR);
+      const transcriptsRoot = join11(projectsRoot, proj.name, NEW_AGENT_TRANSCRIPTS_DIR);
       const sessionDirs = await safeReaddir3(transcriptsRoot);
       if (!sessionDirs)
         continue;
@@ -16989,28 +17038,28 @@ async function scanCursorSessions() {
           continue;
         newCandidates.push({
           sessionId: sd.name,
-          dir: join10(transcriptsRoot, sd.name),
+          dir: join11(transcriptsRoot, sd.name),
           cwd
         });
       }
     }
   }
   for (const sub of LEGACY_SESSION_ROOT_CANDIDATES) {
-    const root = join10(home, sub);
+    const root = join11(home, sub);
     const entries = await safeReaddir3(root);
     if (!entries)
       continue;
     for (const e of entries) {
       if (!e.isDirectory())
         continue;
-      legacyCandidates.push({ sessionId: e.name, dir: join10(root, e.name) });
+      legacyCandidates.push({ sessionId: e.name, dir: join11(root, e.name) });
     }
   }
   if (newCandidates.length === 0 && legacyCandidates.length === 0)
     return [];
   const settled = await batchAll([
     ...newCandidates.map((c) => async () => {
-      const transcriptPath = join10(c.dir, `${c.sessionId}.jsonl`);
+      const transcriptPath = join11(c.dir, `${c.sessionId}.jsonl`);
       const transcriptMtime = await statMtime2(transcriptPath);
       if (!transcriptMtime)
         return null;
@@ -17124,7 +17173,7 @@ var init_cursor_projects = __esm(() => {
 });
 
 // lib/sqlite-reader.ts
-import { existsSync as existsSync11, readFileSync as readFileSync8 } from "node:fs";
+import { existsSync as existsSync12, readFileSync as readFileSync8, statSync as statSync7 } from "node:fs";
 import initSqlJs from "sql.js/dist/sql-asm.js";
 async function tryNodeSqlite(dbPath) {
   try {
@@ -17148,10 +17197,117 @@ function loadSqlJs() {
     sqlPromise = initSqlJs();
   return sqlPromise;
 }
+function fileVersion(path) {
+  const stat = statSync7(path);
+  return { size: stat.size, mtimeMs: stat.mtimeMs, ctimeMs: stat.ctimeMs };
+}
+function sameVersion(a, b) {
+  return a.size === b.size && a.mtimeMs === b.mtimeMs && a.ctimeMs === b.ctimeMs;
+}
+function sqlitePageSize(db) {
+  if (db.length < 100)
+    return null;
+  if (Buffer.from(db.subarray(0, 16)).toString("binary") !== "SQLite format 3\x00")
+    return null;
+  const encoded = db[16] << 8 | db[17];
+  const pageSize = encoded === 1 ? 65536 : encoded;
+  return pageSize >= 512 && pageSize <= 65536 && (pageSize & pageSize - 1) === 0 ? pageSize : null;
+}
+function walChecksum(bytes, offset, length, bigEndian, initial = [0, 0]) {
+  const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+  let [sum1, sum2] = initial;
+  for (let cursor = offset;cursor < offset + length; cursor += 8) {
+    const first = view.getUint32(cursor, !bigEndian);
+    const second = view.getUint32(cursor + 4, !bigEndian);
+    sum1 = sum1 + first + sum2 >>> 0;
+    sum2 = sum2 + second + sum1 >>> 0;
+  }
+  return [sum1, sum2];
+}
+function applyCommittedWal(db, wal) {
+  const pageSize = sqlitePageSize(db);
+  if (pageSize === null || wal.length < 32)
+    return db;
+  const view = new DataView(wal.buffer, wal.byteOffset, wal.byteLength);
+  const magic = view.getUint32(0, false);
+  if (magic !== 931071618 && magic !== 931071619)
+    return db;
+  if (view.getUint32(4, false) !== 3007000)
+    return db;
+  if (view.getUint32(8, false) !== pageSize)
+    return db;
+  const checksumBigEndian = (magic & 1) === 1;
+  let checksum = walChecksum(wal, 0, 24, checksumBigEndian);
+  if (view.getUint32(24, false) !== checksum[0] || view.getUint32(28, false) !== checksum[1]) {
+    return db;
+  }
+  const salt1 = view.getUint32(16, false);
+  const salt2 = view.getUint32(20, false);
+  const frameSize = 24 + pageSize;
+  const frameCount = Math.floor((wal.length - 32) / frameSize);
+  let lastCommit = -1;
+  let committedPages = 0;
+  for (let index = 0;index < frameCount; index += 1) {
+    const offset = 32 + index * frameSize;
+    const pageNumber = view.getUint32(offset, false);
+    if (pageNumber === 0 || view.getUint32(offset + 8, false) !== salt1 || view.getUint32(offset + 12, false) !== salt2) {
+      break;
+    }
+    checksum = walChecksum(wal, offset, 8, checksumBigEndian, checksum);
+    checksum = walChecksum(wal, offset + 24, pageSize, checksumBigEndian, checksum);
+    if (view.getUint32(offset + 16, false) !== checksum[0] || view.getUint32(offset + 20, false) !== checksum[1]) {
+      break;
+    }
+    const databasePages = view.getUint32(offset + 4, false);
+    if (databasePages > 0) {
+      lastCommit = index;
+      committedPages = databasePages;
+    }
+  }
+  if (lastCommit < 0 || committedPages === 0)
+    return db;
+  const targetSize = committedPages * pageSize;
+  if (!Number.isSafeInteger(targetSize) || targetSize > db.length + frameCount * pageSize) {
+    return db;
+  }
+  const snapshot = new Uint8Array(targetSize);
+  snapshot.set(db.subarray(0, targetSize));
+  for (let index = 0;index <= lastCommit; index += 1) {
+    const offset = 32 + index * frameSize;
+    const pageNumber = view.getUint32(offset, false);
+    const destination = (pageNumber - 1) * pageSize;
+    if (destination >= targetSize)
+      continue;
+    snapshot.set(wal.subarray(offset + 24, offset + frameSize), destination);
+  }
+  return snapshot;
+}
+function readPortableSnapshot(dbPath) {
+  const walPath = `${dbPath}-wal`;
+  for (let attempt = 0;attempt < 3; attempt += 1) {
+    const before = fileVersion(dbPath);
+    const main = readFileSync8(dbPath);
+    const afterMain = fileVersion(dbPath);
+    if (!sameVersion(before, afterMain))
+      continue;
+    let wal = null;
+    try {
+      wal = readFileSync8(walPath);
+    } catch (error) {
+      if (error.code !== "ENOENT")
+        throw error;
+    }
+    const afterWal = fileVersion(dbPath);
+    if (!sameVersion(before, afterWal))
+      continue;
+    return wal ? applyCommittedWal(main, wal) : main;
+  }
+  throw new Error(`SQLite database changed while reading: ${dbPath}`);
+}
 async function trySqlJs(dbPath) {
   try {
     const SQL = await loadSqlJs();
-    const db = new SQL.Database(readFileSync8(dbPath));
+    const db = new SQL.Database(readPortableSnapshot(dbPath));
     return {
       query(sql, params) {
         const stmt = db.prepare(sql);
@@ -17174,22 +17330,27 @@ async function trySqlJs(dbPath) {
     return null;
   }
 }
-async function openSqliteReadonly(dbPath) {
-  if (!existsSync11(dbPath))
+async function openSqliteReadonly(dbPath, options = {}) {
+  if (!existsSync12(dbPath))
     return null;
-  return await tryNodeSqlite(dbPath) ?? await trySqlJs(dbPath);
+  if (!options.forcePortable) {
+    const native = await tryNodeSqlite(dbPath);
+    if (native)
+      return native;
+  }
+  return trySqlJs(dbPath);
 }
 var sqlPromise = null;
 var init_sqlite_reader = () => {};
 
 // lib/opencode-db.ts
-import { homedir as homedir10 } from "node:os";
-import { join as join11 } from "node:path";
+import { homedir as homedir11 } from "node:os";
+import { join as join12 } from "node:path";
 function opencodeDbPath() {
   if (process.env.OPENCODE_DB_PATH)
     return process.env.OPENCODE_DB_PATH;
-  const home = process.env.OPENCODE_HOME ?? join11(homedir10(), ".local", "share", "opencode");
-  return join11(home, "opencode.db");
+  const home = process.env.OPENCODE_HOME ?? join12(homedir11(), ".local", "share", "opencode");
+  return join12(home, "opencode.db");
 }
 async function withOpenCodeDb(fn) {
   const db = await openSqliteReadonly(opencodeDbPath());
@@ -17349,10 +17510,10 @@ __export(exports_pi_projects, {
   getPiSessionsByEncodedName: () => getPiSessionsByEncodedName
 });
 import { readdir as readdir4, readFile as readFile6, stat as stat3 } from "node:fs/promises";
-import { homedir as homedir11 } from "node:os";
-import { join as join12 } from "node:path";
+import { homedir as homedir12 } from "node:os";
+import { join as join13 } from "node:path";
 function getPiSessionsRoot() {
-  return process.env.PI_SESSIONS_DIR || join12(homedir11(), ".pi", "agent", "sessions");
+  return process.env.PI_SESSIONS_DIR || join13(homedir12(), ".pi", "agent", "sessions");
 }
 async function safeReaddir4(dir) {
   try {
@@ -17400,7 +17561,7 @@ async function scanPiSessions() {
   for (const cwdDir of cwdDirs) {
     if (!cwdDir.isDirectory())
       continue;
-    const cwdPath = join12(root, cwdDir.name);
+    const cwdPath = join13(root, cwdDir.name);
     const sessionFiles = await safeReaddir4(cwdPath);
     if (!sessionFiles)
       continue;
@@ -17410,7 +17571,7 @@ async function scanPiSessions() {
       const m = SESSION_FILE_RE.exec(f.name);
       if (!m)
         continue;
-      candidates.push({ sessionId: m[1], filePath: join12(cwdPath, f.name) });
+      candidates.push({ sessionId: m[1], filePath: join13(cwdPath, f.name) });
     }
   }
   if (candidates.length === 0)
@@ -17532,14 +17693,14 @@ function formatDuration(ms) {
 }
 
 // lib/hermes-sessions.ts
-import { join as join13 } from "node:path";
+import { join as join14 } from "node:path";
 function hermesDbPaths() {
   const override = process.env.HERMES_DB_PATH;
   if (override)
     return [{ profile: HERMES_DEFAULT_PROFILE, dbPath: override }];
   return listHermesProfiles().map((p) => ({
     profile: p.name,
-    dbPath: join13(p.home, "state.db")
+    dbPath: join14(p.home, "state.db")
   }));
 }
 function epochToMs(value) {
@@ -17831,8 +17992,8 @@ var init_hermes_projects = __esm(() => {
 });
 
 // lib/openclaw-db.ts
-import { existsSync as existsSync12 } from "node:fs";
-import { join as join14 } from "node:path";
+import { existsSync as existsSync13 } from "node:fs";
+import { join as join15 } from "node:path";
 function str(value) {
   return typeof value === "string" && value.length > 0 ? value : undefined;
 }
@@ -17850,8 +18011,8 @@ function syntheticPath(agentId, sessionId) {
 function listOpenClawDatabases(home, agentIds) {
   const out = [];
   for (const agentId of agentIds) {
-    const dbPath = join14(home, "agents", agentId, "agent", DB_NAME);
-    if (existsSync12(dbPath))
+    const dbPath = join15(home, "agents", agentId, "agent", DB_NAME);
+    if (existsSync13(dbPath))
       out.push({ agentId, dbPath });
   }
   return out;
@@ -17988,11 +18149,11 @@ var init_openclaw_db = __esm(() => {
 
 // lib/openclaw-sessions.ts
 import { readFile as readFile7 } from "node:fs/promises";
-import { readdirSync as readdirSync5, statSync as statSync7 } from "node:fs";
-import { homedir as homedir12 } from "node:os";
-import { join as join15 } from "node:path";
+import { readdirSync as readdirSync6, statSync as statSync8 } from "node:fs";
+import { homedir as homedir13 } from "node:os";
+import { join as join16 } from "node:path";
 function openclawHome() {
-  return process.env.OPENCLAW_STATE_DIR || process.env.OPENCLAW_HOME || join15(homedir12(), ".openclaw");
+  return process.env.OPENCLAW_STATE_DIR || process.env.OPENCLAW_HOME || join16(homedir13(), ".openclaw");
 }
 function isPlainObject3(v) {
   return !!v && typeof v === "object" && !Array.isArray(v);
@@ -18111,25 +18272,25 @@ function openclawLinesToLogEntries(lines, source = "session") {
 }
 function listOpenClawAgents() {
   try {
-    return readdirSync5(join15(openclawHome(), "agents"), { withFileTypes: true }).filter((d) => d.isDirectory() && !d.name.startsWith(".")).map((d) => d.name).sort();
+    return readdirSync6(join16(openclawHome(), "agents"), { withFileTypes: true }).filter((d) => d.isDirectory() && !d.name.startsWith(".")).map((d) => d.name).sort();
   } catch {
     return [];
   }
 }
 function listOpenClawTranscripts() {
-  const agentsDir = join15(openclawHome(), "agents");
+  const agentsDir = join16(openclawHome(), "agents");
   const out = [];
   let agentIds;
   try {
-    agentIds = readdirSync5(agentsDir, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name);
+    agentIds = readdirSync6(agentsDir, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name);
   } catch {
     return out;
   }
   for (const agentId of agentIds) {
-    const sessionsDir = join15(agentsDir, agentId, "sessions");
+    const sessionsDir = join16(agentsDir, agentId, "sessions");
     let files;
     try {
-      files = readdirSync5(sessionsDir);
+      files = readdirSync6(sessionsDir);
     } catch {
       continue;
     }
@@ -18139,9 +18300,9 @@ function listOpenClawTranscripts() {
       const sessionId = file.slice(0, -".jsonl".length);
       if (!OPENCLAW_SESSION_ID_RE.test(sessionId))
         continue;
-      const transcriptPath = join15(sessionsDir, file);
+      const transcriptPath = join16(sessionsDir, file);
       try {
-        const st = statSync7(transcriptPath);
+        const st = statSync8(transcriptPath);
         out.push({
           agentId,
           sessionId,
@@ -18219,13 +18380,13 @@ __export(exports_openclaw_projects, {
   openClawProjectPath: () => openClawProjectPath
 });
 import { readFileSync as readFileSync9 } from "node:fs";
-import { join as join16 } from "node:path";
+import { join as join17 } from "node:path";
 function str2(v) {
   return typeof v === "string" && v.length > 0 ? v : undefined;
 }
 function readSessionsIndex(agentId) {
   const out = new Map;
-  const indexPath = join16(openclawHome(), "agents", agentId, "sessions", "sessions.json");
+  const indexPath = join17(openclawHome(), "agents", agentId, "sessions", "sessions.json");
   let raw;
   try {
     raw = JSON.parse(readFileSync9(indexPath, "utf-8"));
@@ -18386,14 +18547,14 @@ var init_openclaw_projects = __esm(() => {
 
 // lib/factory-sessions.ts
 import { readFile as readFile8 } from "node:fs/promises";
-import { readdirSync as readdirSync6, statSync as statSync8 } from "node:fs";
-import { homedir as homedir13 } from "node:os";
-import { join as join17 } from "node:path";
+import { readdirSync as readdirSync7, statSync as statSync9 } from "node:fs";
+import { homedir as homedir14 } from "node:os";
+import { join as join18 } from "node:path";
 function factoryHome() {
-  return process.env.FACTORY_HOME || join17(homedir13(), ".factory");
+  return process.env.FACTORY_HOME || join18(homedir14(), ".factory");
 }
 function factorySessionsRoot() {
-  return join17(factoryHome(), "sessions");
+  return join18(factoryHome(), "sessions");
 }
 function isPlainObject4(v) {
   return !!v && typeof v === "object" && !Array.isArray(v);
@@ -18532,17 +18693,17 @@ function listFactoryTranscripts() {
   const out = [];
   let projectDirs;
   try {
-    projectDirs = readdirSync6(root, { withFileTypes: true }).filter((d) => d.isDirectory());
+    projectDirs = readdirSync7(root, { withFileTypes: true }).filter((d) => d.isDirectory());
   } catch {
     return out;
   }
   for (const dir of projectDirs) {
     const projectName = dir.name;
     const cwd = decodeFolderName(projectName);
-    const projectPath = join17(root, projectName);
+    const projectPath = join18(root, projectName);
     let files;
     try {
-      files = readdirSync6(projectPath);
+      files = readdirSync7(projectPath);
     } catch {
       continue;
     }
@@ -18552,9 +18713,9 @@ function listFactoryTranscripts() {
       const sessionId = file.slice(0, -".jsonl".length);
       if (!FACTORY_SESSION_ID_RE.test(sessionId))
         continue;
-      const transcriptPath = join17(projectPath, file);
+      const transcriptPath = join18(projectPath, file);
       try {
-        const st = statSync8(transcriptPath);
+        const st = statSync9(transcriptPath);
         out.push({ projectName, cwd, sessionId, transcriptPath, mtimeMs: st.mtimeMs, sizeBytes: st.size });
       } catch {}
     }
@@ -18675,13 +18836,13 @@ var init_factory_projects = __esm(() => {
 });
 
 // lib/devin-sessions.ts
-import { homedir as homedir14 } from "node:os";
-import { join as join18 } from "node:path";
+import { homedir as homedir15 } from "node:os";
+import { join as join19 } from "node:path";
 function devinHome() {
-  return process.env.DEVIN_HOME || join18(homedir14(), ".local", "share", "devin");
+  return process.env.DEVIN_HOME || join19(homedir15(), ".local", "share", "devin");
 }
 function devinDbPath() {
-  return process.env.DEVIN_DB_PATH || join18(devinHome(), "cli", "sessions.db");
+  return process.env.DEVIN_DB_PATH || join19(devinHome(), "cli", "sessions.db");
 }
 function devinEpochToMs(value) {
   if (typeof value === "number" && Number.isFinite(value)) {
@@ -18974,17 +19135,17 @@ var init_devin_projects = __esm(() => {
 
 // lib/antigravity-sessions.ts
 import { readFile as readFile9 } from "node:fs/promises";
-import { readdirSync as readdirSync7, statSync as statSync9 } from "node:fs";
-import { homedir as homedir15 } from "node:os";
-import { join as join19 } from "node:path";
+import { readdirSync as readdirSync8, statSync as statSync10 } from "node:fs";
+import { homedir as homedir16 } from "node:os";
+import { join as join20 } from "node:path";
 function antigravityHome() {
-  return process.env.ANTIGRAVITY_HOME || join19(homedir15(), ".gemini", "antigravity-cli");
+  return process.env.ANTIGRAVITY_HOME || join20(homedir16(), ".gemini", "antigravity-cli");
 }
 function antigravityBrainRoot() {
-  return join19(antigravityHome(), "brain");
+  return join20(antigravityHome(), "brain");
 }
 function antigravityTranscriptRelPath() {
-  return join19(".system_generated", "logs", "transcript_full.jsonl");
+  return join20(".system_generated", "logs", "transcript_full.jsonl");
 }
 function isPlainObject6(v) {
   return !!v && typeof v === "object" && !Array.isArray(v);
@@ -19099,7 +19260,7 @@ function listAntigravityTranscripts() {
   const out = [];
   let convoDirs;
   try {
-    convoDirs = readdirSync7(root, { withFileTypes: true }).filter((d) => d.isDirectory());
+    convoDirs = readdirSync8(root, { withFileTypes: true }).filter((d) => d.isDirectory());
   } catch {
     return out;
   }
@@ -19107,9 +19268,9 @@ function listAntigravityTranscripts() {
     const conversationId = dir.name;
     if (!ANTIGRAVITY_CONVERSATION_ID_RE.test(conversationId))
       continue;
-    const transcriptPath = join19(root, conversationId, rel);
+    const transcriptPath = join20(root, conversationId, rel);
     try {
-      const st = statSync9(transcriptPath);
+      const st = statSync10(transcriptPath);
       if (!st.isFile())
         continue;
       out.push({ conversationId, transcriptPath, mtimeMs: st.mtimeMs, sizeBytes: st.size });
@@ -19120,9 +19281,9 @@ function listAntigravityTranscripts() {
 function findAntigravityTranscript(conversationId) {
   if (!ANTIGRAVITY_CONVERSATION_ID_RE.test(conversationId))
     return null;
-  const transcriptPath = join19(antigravityBrainRoot(), conversationId, antigravityTranscriptRelPath());
+  const transcriptPath = join20(antigravityBrainRoot(), conversationId, antigravityTranscriptRelPath());
   try {
-    if (statSync9(transcriptPath).isFile())
+    if (statSync10(transcriptPath).isFile())
       return transcriptPath;
   } catch {}
   return null;
@@ -19156,9 +19317,9 @@ __export(exports_antigravity_projects, {
   getAntigravityIndex: () => getAntigravityIndex,
   getAntigravityProjects: () => getAntigravityProjects
 });
-import { join as join20 } from "node:path";
+import { join as join21 } from "node:path";
 function antigravitySummariesDbPath() {
-  return join20(antigravityHome(), "conversation_summaries.db");
+  return join21(antigravityHome(), "conversation_summaries.db");
 }
 function parseWorkspaceCwd(raw) {
   if (!raw)
@@ -19301,16 +19462,16 @@ var init_antigravity_projects = __esm(() => {
 });
 
 // lib/goose-sessions.ts
-import { homedir as homedir16 } from "node:os";
-import { join as join21 } from "node:path";
+import { homedir as homedir17 } from "node:os";
+import { join as join22 } from "node:path";
 function gooseHome() {
   if (process.env.GOOSE_HOME)
     return process.env.GOOSE_HOME;
   const xdg = process.env.XDG_DATA_HOME;
-  return join21(xdg && xdg.length > 0 ? xdg : join21(homedir16(), ".local", "share"), "goose");
+  return join22(xdg && xdg.length > 0 ? xdg : join22(homedir17(), ".local", "share"), "goose");
 }
 function gooseDbPath() {
-  return process.env.GOOSE_DB_PATH || join21(gooseHome(), "sessions", "sessions.db");
+  return process.env.GOOSE_DB_PATH || join22(gooseHome(), "sessions", "sessions.db");
 }
 function gooseTimestampToMs(value) {
   if (typeof value === "number" && Number.isFinite(value)) {
@@ -19574,7 +19735,7 @@ var init_goose_projects = __esm(() => {
 
 // lib/projects.ts
 import { readdir as readdir5, stat as stat4 } from "node:fs/promises";
-import { join as join22, resolve as resolve11, sep } from "node:path";
+import { join as join23, resolve as resolve12, sep } from "node:path";
 async function getMtime(path, label) {
   try {
     return (await stat4(path)).mtime;
@@ -19600,7 +19761,7 @@ async function getClaudeProjectFolders() {
     if (!entries)
       return [];
     const settled = await batchAll(entries.filter((entry) => entry.isDirectory()).map((entry) => async () => {
-      const folderPath = join22(projectsPath, entry.name);
+      const folderPath = join23(projectsPath, entry.name);
       const mtime = await getMtime(folderPath, entry.name);
       return {
         name: entry.name,
@@ -19726,8 +19887,8 @@ function resolveProjectPath(projectName) {
     throw new RangeError("Empty project name");
   if (/^[/\\]/.test(projectName))
     throw new RangeError("Absolute project name");
-  const projectsPath = resolve11(getClaudeProjectsPath());
-  const candidate = resolve11(join22(projectsPath, projectName));
+  const projectsPath = resolve12(getClaudeProjectsPath());
+  const candidate = resolve12(join23(projectsPath, projectName));
   if (!candidate.startsWith(projectsPath + sep)) {
     throw new RangeError("Project path escapes root");
   }
@@ -19745,7 +19906,7 @@ async function getSessionFiles(projectPath) {
       return [];
     const jsonlEntries = entries.filter((entry) => entry.isFile() && entry.name.endsWith(".jsonl") && extractSessionId2(entry.name));
     const settled = await batchAll(jsonlEntries.map((entry) => async () => {
-      const filePath = join22(projectPath, entry.name);
+      const filePath = join23(projectPath, entry.name);
       const mtime = await getMtime(filePath, entry.name);
       return {
         name: entry.name,
@@ -19774,13 +19935,13 @@ var init_projects = __esm(() => {
 
 // lib/resolve-subagent-path.ts
 import { access as access2 } from "fs/promises";
-import { join as join23, relative as relative3 } from "path";
+import { join as join24, relative as relative3 } from "path";
 async function resolveSubagentPath(projectsPath, projectName, sessionId, agentId) {
   const fileName = `agent-${agentId}.jsonl`;
   const candidatePaths = [
-    join23(projectsPath, projectName, fileName),
-    join23(projectsPath, projectName, sessionId, fileName),
-    join23(projectsPath, projectName, sessionId, "subagents", fileName)
+    join24(projectsPath, projectName, fileName),
+    join24(projectsPath, projectName, sessionId, fileName),
+    join24(projectsPath, projectName, sessionId, "subagents", fileName)
   ];
   for (const candidatePath of candidatePaths) {
     if (relative3(projectsPath, candidatePath).startsWith("..")) {
@@ -19802,7 +19963,7 @@ var init_resolve_subagent_path = () => {};
 
 // lib/log-entries.ts
 import { readFile as readFile10 } from "fs/promises";
-import { join as join24 } from "path";
+import { join as join25 } from "path";
 function formatTimestamp(date) {
   const base = formatDate(date);
   const ms = date.getMilliseconds().toString().padStart(3, "0");
@@ -20000,7 +20161,7 @@ async function parseLogContent(fileContent, source = "session") {
 async function parseSessionLog(projectName, sessionId) {
   const projectDir = resolveProjectPath(projectName);
   const projectsPath = getClaudeProjectsPath();
-  const filePath = join24(projectDir, `${sessionId}.jsonl`);
+  const filePath = join25(projectDir, `${sessionId}.jsonl`);
   const fileContent = await readFile10(filePath, "utf-8");
   const { entries: sessionEntries, rawLines: sessionRawLines, subagentIds } = await parseFileContent(fileContent, "session");
   if (subagentIds.length === 0) {
@@ -20037,13 +20198,13 @@ var init_log_entries = __esm(() => {
 });
 
 // lib/codex-sessions.ts
-import { readFileSync as readFileSync10, readdirSync as readdirSync8, existsSync as existsSync13, writeFileSync as writeFileSync6, mkdirSync as mkdirSync7, statSync as statSync10 } from "node:fs";
+import { readFileSync as readFileSync10, readdirSync as readdirSync9, existsSync as existsSync14, writeFileSync as writeFileSync6, mkdirSync as mkdirSync7, statSync as statSync11 } from "node:fs";
 import { readFile as readFile11 } from "node:fs/promises";
-import { dirname as dirname7, join as join25 } from "node:path";
-import { homedir as homedir17 } from "node:os";
+import { dirname as dirname8, join as join26 } from "node:path";
+import { homedir as homedir18 } from "node:os";
 function readCache() {
   try {
-    if (!existsSync13(CACHE_PATH))
+    if (!existsSync14(CACHE_PATH))
       return {};
     return JSON.parse(readFileSync10(CACHE_PATH, "utf-8"));
   } catch {
@@ -20052,7 +20213,7 @@ function readCache() {
 }
 function writeCacheEntry(sessionId, path) {
   try {
-    mkdirSync7(dirname7(CACHE_PATH), { recursive: true });
+    mkdirSync7(dirname8(CACHE_PATH), { recursive: true });
     const cache = readCache();
     cache[sessionId] = path;
     writeFileSync6(CACHE_PATH, JSON.stringify(cache), "utf-8");
@@ -20060,9 +20221,9 @@ function writeCacheEntry(sessionId, path) {
 }
 function dirSearch(dir, sessionId) {
   try {
-    for (const f of readdirSync8(dir, { withFileTypes: true })) {
+    for (const f of readdirSync9(dir, { withFileTypes: true })) {
       if (f.isFile() && f.name.includes(sessionId) && f.name.endsWith(".jsonl")) {
-        return join25(dir, f.name);
+        return join26(dir, f.name);
       }
     }
   } catch {}
@@ -20071,16 +20232,16 @@ function dirSearch(dir, sessionId) {
 function findCodexTranscript(sessionId) {
   const cache = readCache();
   const cached = cache[sessionId];
-  if (cached && existsSync13(cached))
+  if (cached && existsSync14(cached))
     return cached;
-  const root = join25(homedir17(), ".codex", "sessions");
+  const root = join26(homedir18(), ".codex", "sessions");
   const today = new Date;
   const yesterday = new Date(today.getTime() - 24 * 60 * 60 * 1000);
   const datedDirs = [today, yesterday].map((d) => {
     const y = String(d.getUTCFullYear());
     const m = String(d.getUTCMonth() + 1).padStart(2, "0");
     const day = String(d.getUTCDate()).padStart(2, "0");
-    return join25(root, y, m, day);
+    return join26(root, y, m, day);
   });
   for (const dir of datedDirs) {
     const hit = dirSearch(dir, sessionId);
@@ -20090,16 +20251,16 @@ function findCodexTranscript(sessionId) {
     }
   }
   try {
-    for (const y of readdirSync8(root, { withFileTypes: true })) {
+    for (const y of readdirSync9(root, { withFileTypes: true })) {
       if (!y.isDirectory())
         continue;
-      for (const m of readdirSync8(join25(root, y.name), { withFileTypes: true })) {
+      for (const m of readdirSync9(join26(root, y.name), { withFileTypes: true })) {
         if (!m.isDirectory())
           continue;
-        for (const d of readdirSync8(join25(root, y.name, m.name), { withFileTypes: true })) {
+        for (const d of readdirSync9(join26(root, y.name, m.name), { withFileTypes: true })) {
           if (!d.isDirectory())
             continue;
-          const hit = dirSearch(join25(root, y.name, m.name, d.name), sessionId);
+          const hit = dirSearch(join26(root, y.name, m.name, d.name), sessionId);
           if (hit) {
             writeCacheEntry(sessionId, hit);
             return hit;
@@ -20365,21 +20526,21 @@ var init_resolve_permission_mode = __esm(() => {
 });
 
 // lib/copilot-sessions.ts
-import { readFileSync as readFileSync12, readdirSync as readdirSync9, existsSync as existsSync14, statSync as statSync11 } from "node:fs";
+import { readFileSync as readFileSync12, readdirSync as readdirSync10, existsSync as existsSync15, statSync as statSync12 } from "node:fs";
 import { readFile as readFile12 } from "node:fs/promises";
-import { join as join26, resolve as resolve12, sep as sep2 } from "node:path";
-import { homedir as homedir18 } from "node:os";
+import { join as join27, resolve as resolve13, sep as sep2 } from "node:path";
+import { homedir as homedir19 } from "node:os";
 function getCopilotHome() {
-  return process.env.COPILOT_HOME || join26(homedir18(), ".copilot");
+  return process.env.COPILOT_HOME || join27(homedir19(), ".copilot");
 }
 function getCopilotSessionStateRoot2() {
-  return join26(getCopilotHome(), "session-state");
+  return join27(getCopilotHome(), "session-state");
 }
 function getCopilotSessionDir(sessionId) {
   if (!sessionId)
     return null;
-  const root = resolve12(getCopilotSessionStateRoot2());
-  const candidate = resolve12(root, sessionId);
+  const root = resolve13(getCopilotSessionStateRoot2());
+  const candidate = resolve13(root, sessionId);
   if (candidate === root || !candidate.startsWith(`${root}${sep2}`))
     return null;
   return candidate;
@@ -20388,19 +20549,19 @@ function resolveSessionFile(sessionId, filename) {
   const dir = getCopilotSessionDir(sessionId);
   if (!dir)
     return null;
-  return join26(dir, filename);
+  return join27(dir, filename);
 }
 function findCopilotTranscript(sessionId) {
   const candidate = resolveSessionFile(sessionId, "events.jsonl");
   if (!candidate)
     return null;
-  return existsSync14(candidate) ? candidate : null;
+  return existsSync15(candidate) ? candidate : null;
 }
 function findCopilotWorkspace(sessionId) {
   const candidate = resolveSessionFile(sessionId, "workspace.yaml");
   if (!candidate)
     return null;
-  return existsSync14(candidate) ? candidate : null;
+  return existsSync15(candidate) ? candidate : null;
 }
 function readYamlScalar(path, key) {
   try {
@@ -20582,38 +20743,38 @@ var init_copilot_sessions = __esm(() => {
 });
 
 // lib/cursor-sessions.ts
-import { readFileSync as readFileSync13, readdirSync as readdirSync10, existsSync as existsSync15, statSync as statSync12 } from "node:fs";
+import { readFileSync as readFileSync13, readdirSync as readdirSync11, existsSync as existsSync16, statSync as statSync13 } from "node:fs";
 import { readFile as readFile13 } from "node:fs/promises";
-import { basename as basename3, join as join27, resolve as resolve13, sep as sep3 } from "node:path";
-import { homedir as homedir19 } from "node:os";
+import { basename as basename4, join as join28, resolve as resolve14, sep as sep3 } from "node:path";
+import { homedir as homedir20 } from "node:os";
 function getCursorHome2() {
-  return process.env.CURSOR_HOME || join27(homedir19(), ".cursor");
+  return process.env.CURSOR_HOME || join28(homedir20(), ".cursor");
 }
 function getCursorSessionDir(sessionId) {
   if (!sessionId)
     return null;
-  const home = resolve13(getCursorHome2());
-  const projectsRoot = resolve13(home, NEW_PROJECTS_DIR2);
+  const home = resolve14(getCursorHome2());
+  const projectsRoot = resolve14(home, NEW_PROJECTS_DIR2);
   let projectEntries = [];
   try {
-    projectEntries = readdirSync10(projectsRoot, { withFileTypes: true });
+    projectEntries = readdirSync11(projectsRoot, { withFileTypes: true });
   } catch {}
   for (const entry of projectEntries) {
     if (!entry.isDirectory())
       continue;
-    const candidate = resolve13(projectsRoot, entry.name, NEW_AGENT_TRANSCRIPTS_DIR2, sessionId);
-    const transcriptRoot = resolve13(projectsRoot, entry.name, NEW_AGENT_TRANSCRIPTS_DIR2);
+    const candidate = resolve14(projectsRoot, entry.name, NEW_AGENT_TRANSCRIPTS_DIR2, sessionId);
+    const transcriptRoot = resolve14(projectsRoot, entry.name, NEW_AGENT_TRANSCRIPTS_DIR2);
     if (candidate === transcriptRoot || !candidate.startsWith(`${transcriptRoot}${sep3}`))
       continue;
-    if (existsSync15(candidate))
+    if (existsSync16(candidate))
       return candidate;
   }
   for (const sub of LEGACY_SESSION_ROOT_CANDIDATES2) {
-    const root = resolve13(home, sub);
-    const candidate = resolve13(root, sessionId);
+    const root = resolve14(home, sub);
+    const candidate = resolve14(root, sessionId);
     if (candidate === root || !candidate.startsWith(`${root}${sep3}`))
       continue;
-    if (existsSync15(candidate))
+    if (existsSync16(candidate))
       return candidate;
   }
   return null;
@@ -20622,12 +20783,12 @@ function findCursorTranscript(sessionId) {
   const dir = getCursorSessionDir(sessionId);
   if (!dir)
     return null;
-  const newCandidate = join27(dir, `${basename3(dir)}.jsonl`);
-  if (existsSync15(newCandidate))
+  const newCandidate = join28(dir, `${basename4(dir)}.jsonl`);
+  if (existsSync16(newCandidate))
     return newCandidate;
   for (const name of LEGACY_TRANSCRIPT_FILE_CANDIDATES2) {
-    const candidate = join27(dir, name);
-    if (existsSync15(candidate))
+    const candidate = join28(dir, name);
+    if (existsSync16(candidate))
       return candidate;
   }
   return null;
@@ -20838,12 +20999,12 @@ var init_cursor_sessions = __esm(() => {
 });
 
 // lib/pi-sessions.ts
-import { readFileSync as readFileSync14, readdirSync as readdirSync11, existsSync as existsSync16, statSync as statSync13 } from "node:fs";
+import { readFileSync as readFileSync14, readdirSync as readdirSync12, existsSync as existsSync17, statSync as statSync14 } from "node:fs";
 import { readFile as readFile14 } from "node:fs/promises";
-import { join as join28, resolve as resolve14, sep as sep4 } from "node:path";
-import { homedir as homedir20 } from "node:os";
+import { join as join29, resolve as resolve15, sep as sep4 } from "node:path";
+import { homedir as homedir21 } from "node:os";
 function getPiSessionStateRoot() {
-  return process.env.PI_SESSIONS_DIR || join28(homedir20(), ".pi", "agent", "sessions");
+  return process.env.PI_SESSIONS_DIR || join29(homedir21(), ".pi", "agent", "sessions");
 }
 function isSafeSessionId(sessionId) {
   return UUID_RE.test(sessionId);
@@ -20851,20 +21012,20 @@ function isSafeSessionId(sessionId) {
 function findPiTranscript(sessionId) {
   if (!isSafeSessionId(sessionId))
     return null;
-  const root = resolve14(getPiSessionStateRoot());
+  const root = resolve15(getPiSessionStateRoot());
   let cwdDirs;
   try {
-    cwdDirs = readdirSync11(root);
+    cwdDirs = readdirSync12(root);
   } catch {
     return null;
   }
   for (const cwdDir of cwdDirs) {
-    const cwdPath = resolve14(root, cwdDir);
+    const cwdPath = resolve15(root, cwdDir);
     if (!cwdPath.startsWith(`${root}${sep4}`))
       continue;
     let files;
     try {
-      files = readdirSync11(cwdPath);
+      files = readdirSync12(cwdPath);
     } catch {
       continue;
     }
@@ -20872,10 +21033,10 @@ function findPiTranscript(sessionId) {
       const m = SESSION_FILE_RE2.exec(f);
       if (!m || m[1].toLowerCase() !== sessionId.toLowerCase())
         continue;
-      const candidate = resolve14(cwdPath, f);
+      const candidate = resolve15(cwdPath, f);
       if (!candidate.startsWith(`${cwdPath}${sep4}`))
         continue;
-      if (existsSync16(candidate))
+      if (existsSync17(candidate))
         return candidate;
     }
   }
@@ -21281,31 +21442,31 @@ var init_pack_failclosed = __esm(() => {
 // lib/atomic-write.ts
 import {
   chmodSync as chmodSync2,
-  existsSync as existsSync17,
+  existsSync as existsSync18,
   mkdirSync as mkdirSync8,
   renameSync as renameSync4,
   rmSync as rmSync3,
-  statSync as statSync14,
+  statSync as statSync15,
   writeFileSync as writeFileSync7
 } from "node:fs";
-import { dirname as dirname8 } from "node:path";
+import { dirname as dirname9 } from "node:path";
 import { randomBytes } from "node:crypto";
 function writeJsonAtomically(filePath, value, opts = {}) {
   const mode = opts.mode ?? 384;
   const dirMode = opts.dirMode ?? 448;
-  const dir = dirname8(filePath);
-  if (!existsSync17(dir))
+  const dir = dirname9(filePath);
+  if (!existsSync18(dir))
     mkdirSync8(dir, { recursive: true, mode: dirMode });
   const tmp = `${filePath}.${process.pid}.${randomBytes(6).toString("hex")}.tmp`;
   try {
     writeFileSync7(tmp, JSON.stringify(value, null, 2), { mode });
     try {
-      if ((statSync14(tmp).mode & 63) !== 0)
+      if ((statSync15(tmp).mode & 63) !== 0)
         chmodSync2(tmp, mode);
     } catch {}
     renameSync4(tmp, filePath);
     try {
-      if ((statSync14(filePath).mode & 63) !== 0)
+      if ((statSync15(filePath).mode & 63) !== 0)
         chmodSync2(filePath, mode);
     } catch {}
   } catch (err) {
@@ -21318,18 +21479,18 @@ function writeJsonAtomically(filePath, value, opts = {}) {
 var init_atomic_write = () => {};
 
 // src/hooks/session-pause.ts
-import { existsSync as existsSync18, mkdirSync as mkdirSync9, readdirSync as readdirSync12, readFileSync as readFileSync15, rmSync as rmSync4 } from "node:fs";
+import { existsSync as existsSync19, mkdirSync as mkdirSync9, readdirSync as readdirSync13, readFileSync as readFileSync15, rmSync as rmSync4 } from "node:fs";
 import { createHash as createHash6 } from "node:crypto";
-import { join as join29, resolve as resolve15 } from "node:path";
+import { join as join30, resolve as resolve16 } from "node:path";
 function pauseStateDir() {
   const override = process.env.FAILPROOFAI_STATE_DIR;
   if (override)
-    return resolve15(override, "sessions");
+    return resolve16(override, "sessions");
   return sessionPauseDir();
 }
 function pauseFilePath(sessionId) {
   const digest = createHash6("sha256").update(sessionId).digest("hex").slice(0, 32);
-  return join29(pauseStateDir(), `${digest}.json`);
+  return join30(pauseStateDir(), `${digest}.json`);
 }
 function parsePauseDuration(input, ceilingMs = PAUSE_CEILING_MS) {
   if (input === undefined || input === "")
@@ -21385,7 +21546,7 @@ function readActivePause(sessionId, now = Date.now()) {
     return null;
   try {
     const path = pauseFilePath(sessionId);
-    if (!existsSync18(path))
+    if (!existsSync19(path))
       return null;
     const stored = parseStored(JSON.parse(readFileSync15(path, "utf8")));
     if (!stored)
@@ -21416,7 +21577,7 @@ function writePause(opts) {
 }
 function clearPause(sessionId) {
   const path = pauseFilePath(sessionId);
-  if (!existsSync18(path))
+  if (!existsSync19(path))
     return false;
   try {
     rmSync4(path);
@@ -21427,12 +21588,12 @@ function clearPause(sessionId) {
 }
 function listActivePauses(now = Date.now()) {
   const dir = pauseStateDir();
-  if (!existsSync18(dir))
+  if (!existsSync19(dir))
     return [];
   const out = [];
   let names;
   try {
-    names = readdirSync12(dir);
+    names = readdirSync13(dir);
   } catch {
     return [];
   }
@@ -21440,7 +21601,7 @@ function listActivePauses(now = Date.now()) {
     if (!name.endsWith(".json"))
       continue;
     try {
-      const stored = parseStored(JSON.parse(readFileSync15(join29(dir, name), "utf8")));
+      const stored = parseStored(JSON.parse(readFileSync15(join30(dir, name), "utf8")));
       if (!stored || stored.expiresAt <= now)
         continue;
       const { schemaVersion: _ignored, ...pause } = stored;
@@ -21481,17 +21642,17 @@ var init_session_pause = __esm(() => {
 import { createHash as createHash7 } from "node:crypto";
 import {
   chmodSync as chmodSync3,
-  existsSync as existsSync19,
+  existsSync as existsSync20,
   mkdirSync as mkdirSync10,
-  readdirSync as readdirSync13,
+  readdirSync as readdirSync14,
   readFileSync as readFileSync16,
   renameSync as renameSync5,
   rmSync as rmSync5,
-  statSync as statSync15,
+  statSync as statSync16,
   writeFileSync as writeFileSync8
 } from "node:fs";
 import { createRequire as createRequire2 } from "node:module";
-import { dirname as dirname9, resolve as resolve16 } from "node:path";
+import { dirname as dirname10, resolve as resolve17 } from "node:path";
 import { gunzipSync } from "node:zlib";
 function baseUrl2() {
   return (process.env.FAILPROOFAI_DAEMON_BASE_URL || DEFAULT_BASE_URL2).replace(/\/+$/, "");
@@ -21500,7 +21661,7 @@ function daemonBinaryDir() {
   return binDir();
 }
 function installedBinaryPath(ver = version2) {
-  return resolve16(daemonBinaryDir(), `failproofaid-${ver}`);
+  return resolve17(daemonBinaryDir(), `failproofaid-${ver}`);
 }
 function daemonAssetUrl(key, ver = version2) {
   return `${baseUrl2()}/v${ver}/failproofaid-${key}.gz`;
@@ -21517,31 +21678,31 @@ function npmPlatformBinaryPath(key) {
     return null;
   const name = platformPackageName(key);
   try {
-    const requireFromRoot = createRequire2(resolve16(packageRoot, "package.json"));
-    const found = platformPackageBinary(dirname9(requireFromRoot.resolve(`${name}/package.json`)));
+    const requireFromRoot = createRequire2(resolve17(packageRoot, "package.json"));
+    const found = platformPackageBinary(dirname10(requireFromRoot.resolve(`${name}/package.json`)));
     if (found)
       return found;
   } catch {}
-  return platformPackageBinary(resolve16(packageRoot, "node_modules", name));
+  return platformPackageBinary(resolve17(packageRoot, "node_modules", name));
 }
 function platformPackageBinary(dir) {
   try {
-    const manifest = JSON.parse(readFileSync16(resolve16(dir, "package.json"), "utf8"));
+    const manifest = JSON.parse(readFileSync16(resolve17(dir, "package.json"), "utf8"));
     if (manifest.version !== version2)
       return null;
   } catch {
     return null;
   }
-  const candidate = resolve16(dir, "bin", "failproofaid");
-  return existsSync19(candidate) ? candidate : null;
+  const candidate = resolve17(dir, "bin", "failproofaid");
+  return existsSync20(candidate) ? candidate : null;
 }
 function pruneOldDaemonBinaries(keep = 2) {
   const removed = [];
   try {
     const dir = daemonBinaryDir();
-    const entries = readdirSync13(dir).filter((f) => f.startsWith("failproofaid-") && !f.endsWith(".tmp")).map((f) => {
-      const full = resolve16(dir, f);
-      return { full, mtime: statSync15(full).mtimeMs };
+    const entries = readdirSync14(dir).filter((f) => f.startsWith("failproofaid-") && !f.endsWith(".tmp")).map((f) => {
+      const full = resolve17(dir, f);
+      return { full, mtime: statSync16(full).mtimeMs };
     }).sort((a, b) => b.mtime - a.mtime);
     for (const stale of entries.slice(keep)) {
       try {
@@ -21611,7 +21772,7 @@ function digestFor2(manifest, assetName) {
 }
 async function downloadFailproofaidBinary(key) {
   const target = installedBinaryPath();
-  if (existsSync19(target))
+  if (existsSync20(target))
     return { path: target };
   if (process.env.FAILPROOFAI_NO_DOWNLOAD) {
     return { error: "daemon downloads are disabled (FAILPROOFAI_NO_DOWNLOAD)" };
@@ -21645,10 +21806,10 @@ var init_daemon_download = __esm(() => {
 
 // src/hooks/daemon-client.ts
 import { createConnection as createConnection2 } from "node:net";
-import { existsSync as existsSync20 } from "node:fs";
+import { existsSync as existsSync21 } from "node:fs";
 function daemonSocketPresent() {
   try {
-    return existsSync20(socketPath2());
+    return existsSync21(socketPath2());
   } catch {
     return false;
   }
@@ -21774,7 +21935,7 @@ var init_daemon_client2 = __esm(() => {
 
 // src/hooks/daemon-service.ts
 import {
-  existsSync as existsSync21,
+  existsSync as existsSync22,
   mkdirSync as mkdirSync11,
   mkdtempSync,
   readFileSync as readFileSync17,
@@ -21782,8 +21943,8 @@ import {
   unlinkSync as unlinkSync3,
   rmSync as rmSync6
 } from "node:fs";
-import { homedir as homedir21, tmpdir as tmpdir2, userInfo } from "node:os";
-import { resolve as resolve17 } from "node:path";
+import { homedir as homedir22, tmpdir as tmpdir2, userInfo } from "node:os";
+import { resolve as resolve18 } from "node:path";
 import { execFileSync as execFileSync2 } from "node:child_process";
 function setDaemonConfigured(value, installedVersion) {
   try {
@@ -21805,13 +21966,13 @@ function resolveFailproofaidBinaryPath() {
   if (process.env.FAILPROOFAI_DAEMON_BINARY)
     return process.env.FAILPROOFAI_DAEMON_BINARY;
   const downloaded = installedBinaryPath();
-  if (existsSync21(downloaded))
+  if (existsSync22(downloaded))
     return downloaded;
   const packageRoot = process.env.FAILPROOFAI_PACKAGE_ROOT;
   if (packageRoot) {
     for (const profile of ["release", "debug"]) {
-      const candidate = resolve17(packageRoot, "target", profile, "failproofaid");
-      if (existsSync21(candidate))
+      const candidate = resolve18(packageRoot, "target", profile, "failproofaid");
+      if (existsSync22(candidate))
         return candidate;
     }
   }
@@ -21841,8 +22002,8 @@ function resolveWorkerCommand() {
   const packageRoot = process.env.FAILPROOFAI_PACKAGE_ROOT;
   if (!packageRoot)
     return null;
-  const workerScript = resolve17(packageRoot, "dist", "worker.mjs");
-  if (!existsSync21(workerScript))
+  const workerScript = resolve18(packageRoot, "dist", "worker.mjs");
+  if (!existsSync22(workerScript))
     return null;
   return `${shellQuote(process.execPath)} ${shellQuote(workerScript)}`;
 }
@@ -21852,8 +22013,8 @@ function resolveCliCommand() {
   const packageRoot = process.env.FAILPROOFAI_PACKAGE_ROOT;
   if (!packageRoot)
     return null;
-  const cliScript = resolve17(packageRoot, "dist", "cli.mjs");
-  if (!existsSync21(cliScript))
+  const cliScript = resolve18(packageRoot, "dist", "cli.mjs");
+  if (!existsSync22(cliScript))
     return null;
   return `${shellQuote(process.execPath)} ${shellQuote(cliScript)}`;
 }
@@ -21866,8 +22027,8 @@ function workerScriptPath() {
   const packageRoot = process.env.FAILPROOFAI_PACKAGE_ROOT;
   if (!packageRoot)
     return null;
-  const workerScript = resolve17(packageRoot, "dist", "worker.mjs");
-  return existsSync21(workerScript) ? workerScript : null;
+  const workerScript = resolve18(packageRoot, "dist", "worker.mjs");
+  return existsSync22(workerScript) ? workerScript : null;
 }
 function assertUnitSafe(value, field) {
   if (UNIT_UNSAFE_RE.test(value)) {
@@ -21893,10 +22054,10 @@ function systemdUnitDir() {
   return process.env.FAILPROOFAI_SYSTEMD_DIR || "/etc/systemd/system";
 }
 function systemdUnitPath(user = serviceUser()) {
-  return resolve17(systemdUnitDir(), systemdUnitName(user));
+  return resolve18(systemdUnitDir(), systemdUnitName(user));
 }
 function legacySystemdUserUnitPath() {
-  return resolve17(homedir21(), ".config", "systemd", "user", "failproofaid.service");
+  return resolve18(homedir22(), ".config", "systemd", "user", "failproofaid.service");
 }
 function launchdLabel(user = serviceUser()) {
   return `ai.failproof.failproofaid.${user}`;
@@ -21905,7 +22066,7 @@ function launchdPlistPath(user = serviceUser()) {
   return `/Library/LaunchDaemons/${launchdLabel(user)}.plist`;
 }
 function legacyLaunchAgentPlistPath() {
-  return resolve17(homedir21(), "Library", "LaunchAgents", "ai.failproof.failproofaid.plist");
+  return resolve18(homedir22(), "Library", "LaunchAgents", "ai.failproof.failproofaid.plist");
 }
 function legacySharedLaunchDaemonPath() {
   return "/Library/LaunchDaemons/ai.failproof.failproofaid.plist";
@@ -21953,8 +22114,8 @@ function runPrivileged(command, args) {
   execFileSync2(cmd, argv, { stdio: "ignore", timeout: SERVICE_CMD_TIMEOUT_MS });
 }
 function writePrivilegedFile(destination, contents, mode = "0644") {
-  const stagingDir = mkdtempSync(resolve17(tmpdir2(), "failproofaid-stage-"));
-  const staging = resolve17(stagingDir, "service-definition");
+  const stagingDir = mkdtempSync(resolve18(tmpdir2(), "failproofaid-stage-"));
+  const staging = resolve18(stagingDir, "service-definition");
   try {
     writeFileSync9(staging, contents, "utf8");
     runPrivileged("install", ["-m", mode, staging, destination]);
@@ -21966,7 +22127,7 @@ function removeLegacyUserService() {
   try {
     if (process.platform === "linux") {
       const legacy = legacySystemdUserUnitPath();
-      if (!existsSync21(legacy))
+      if (!existsSync22(legacy))
         return;
       try {
         execFileSync2("systemctl", ["--user", "disable", "--now", "failproofaid.service"], {
@@ -21983,7 +22144,7 @@ function removeLegacyUserService() {
       } catch {}
     } else {
       const legacyAgent = legacyLaunchAgentPlistPath();
-      if (existsSync21(legacyAgent)) {
+      if (existsSync22(legacyAgent)) {
         try {
           execFileSync2("launchctl", ["unload", "-w", legacyAgent], {
             stdio: "ignore",
@@ -21993,7 +22154,7 @@ function removeLegacyUserService() {
         unlinkSync3(legacyAgent);
       }
       const legacyDaemon = legacySharedLaunchDaemonPath();
-      if (existsSync21(legacyDaemon)) {
+      if (existsSync22(legacyDaemon)) {
         try {
           runPrivileged("launchctl", ["unload", "-w", legacyDaemon]);
         } catch {}
@@ -22009,8 +22170,8 @@ function systemdUnitContents(binaryPath, workerCmd, cliCmd = null) {
 `).join("");
   const user = assertUnitSafe(serviceUser(), "User");
   assertUnitSafe(binaryPath, "ExecStart");
-  assertUnitSafe(homedir21(), "HOME");
-  const conditionPaths = [binaryPath, workerScriptPath()].filter((p) => typeof p === "string" && existsSync21(p));
+  assertUnitSafe(homedir22(), "HOME");
+  const conditionPaths = [binaryPath, workerScriptPath()].filter((p) => typeof p === "string" && existsSync22(p));
   const conditionLines = conditionPaths.map((p) => `ConditionPathExists=${assertUnitSafe(p, "ConditionPathExists")}
 `).join("");
   return `[Unit]
@@ -22023,7 +22184,7 @@ User=${user}
 # Set explicitly rather than relying on systemd deriving it from User=:
 # failproofaid stores per-user state and refuses to start without HOME, so this
 # required variable is not left to a version-dependent default.
-Environment="HOME=${homedir21()}"
+Environment="HOME=${homedir22()}"
 ${envLines}ExecStart=${binaryPath}
 Restart=on-failure
 RestartSec=2
@@ -22071,9 +22232,9 @@ ${env.map(([key, value]) => `        <key>${key}</key>
     <key>UserName</key>
     <string>${escapeXml(serviceUser())}</string>
 ${envBlock}    <key>StandardOutPath</key>
-    <string>${escapeXml(resolve17(logDir, "failproofaid.log"))}</string>
+    <string>${escapeXml(resolve18(logDir, "failproofaid.log"))}</string>
     <key>StandardErrorPath</key>
-    <string>${escapeXml(resolve17(logDir, "failproofaid.err.log"))}</string>
+    <string>${escapeXml(resolve18(logDir, "failproofaid.err.log"))}</string>
 </dict>
 </plist>
 `;
@@ -22205,7 +22366,7 @@ function readInstalledServiceDefinition() {
   if (!isDaemonSupportedPlatform())
     return null;
   const path = daemonServiceFilePath();
-  if (!path || !existsSync21(path))
+  if (!path || !existsSync22(path))
     return null;
   try {
     return readFileSync17(path, "utf8");
@@ -22341,7 +22502,7 @@ async function uninstallDaemonService() {
   try {
     if (process.platform === "linux") {
       const unitPath = systemdUnitPath();
-      if (!existsSync21(unitPath))
+      if (!existsSync22(unitPath))
         return;
       try {
         runPrivileged("systemctl", ["disable", "--now", systemdUnitName()]);
@@ -22352,7 +22513,7 @@ async function uninstallDaemonService() {
       } catch {}
     } else {
       const plistPath = launchdPlistPath();
-      if (!existsSync21(plistPath))
+      if (!existsSync22(plistPath))
         return;
       try {
         runPrivileged("launchctl", ["unload", "-w", plistPath]);
@@ -22369,7 +22530,7 @@ function daemonVersionSkew() {
   const recorded = readVersionFile()?.daemon;
   if (!recorded)
     return null;
-  if (!existsSync21(installedBinaryPath(recorded)))
+  if (!existsSync22(installedBinaryPath(recorded)))
     return null;
   return recorded === version2 ? null : { installed: recorded, expected: version2 };
 }
@@ -22387,7 +22548,7 @@ function daemonServiceStatus() {
   if (!isDaemonSupportedPlatform())
     return "unsupported-platform";
   if (process.platform === "linux") {
-    if (!existsSync21(systemdUnitPath()))
+    if (!existsSync22(systemdUnitPath()))
       return "not-installed";
     try {
       const out = execFileSync2("systemctl", ["is-active", systemdUnitName()], {
@@ -22400,7 +22561,7 @@ function daemonServiceStatus() {
     }
   }
   const plistPath = launchdPlistPath();
-  if (!existsSync21(plistPath))
+  if (!existsSync22(plistPath))
     return "not-installed";
   try {
     const root = typeof process.getuid === "function" && process.getuid() === 0;
@@ -22432,26 +22593,26 @@ var init_daemon_service = __esm(() => {
 // src/hooks/fp-reset.ts
 import {
   copyFileSync,
-  existsSync as existsSync22,
+  existsSync as existsSync23,
   mkdirSync as mkdirSync12,
   readFileSync as readFileSync18,
-  readdirSync as readdirSync14,
+  readdirSync as readdirSync15,
   renameSync as renameSync6,
   rmSync as rmSync7,
   rmdirSync,
-  statSync as statSync16,
+  statSync as statSync17,
   writeFileSync as writeFileSync10
 } from "node:fs";
-import { dirname as dirname10, isAbsolute as isAbsolute3, relative as relative4, resolve as resolve18 } from "node:path";
+import { dirname as dirname11, isAbsolute as isAbsolute3, relative as relative4, resolve as resolve19 } from "node:path";
 function migrateConventionPolicies() {
   const from = legacy.customPoliciesDir();
-  if (!existsSync22(from))
+  if (!existsSync23(from))
     return [];
   const moved = [];
   const mergeInto = (dir, dest, prefix) => {
     let entries;
     try {
-      entries = readdirSync14(dir, { withFileTypes: true });
+      entries = readdirSync15(dir, { withFileTypes: true });
     } catch {
       return;
     }
@@ -22463,17 +22624,17 @@ function migrateConventionPolicies() {
       return;
     }
     for (const entry of entries) {
-      const source = resolve18(dir, entry.name);
-      const target = resolve18(dest, entry.name);
+      const source = resolve19(dir, entry.name);
+      const target = resolve19(dest, entry.name);
       const name = `${prefix}${entry.name}`;
-      if (!existsSync22(target)) {
+      if (!existsSync23(target)) {
         try {
           renameSync6(source, target);
           moved.push(name);
         } catch {}
         continue;
       }
-      if (entry.isDirectory() && statSync16(target).isDirectory()) {
+      if (entry.isDirectory() && statSync17(target).isDirectory()) {
         mergeInto(source, target, `${name}/`);
         try {
           rmdirSync(source);
@@ -22493,23 +22654,23 @@ function migrateLegacySpool() {
     [legacy.spoolDir(), spoolDir()],
     [legacy.failedDir(), failedDir()]
   ]) {
-    if (!existsSync22(from))
+    if (!existsSync23(from))
       continue;
     try {
       mkdirSync12(to, { recursive: true });
-      for (const entry of readdirSync14(from, { withFileTypes: true })) {
+      for (const entry of readdirSync15(from, { withFileTypes: true })) {
         if (!entry.isFile())
           continue;
         let name = entry.name;
         let n = 0;
-        while (existsSync22(resolve18(to, name)))
+        while (existsSync23(resolve19(to, name)))
           name = `legacy-${n++}-${entry.name}`;
         try {
-          renameSync6(resolve18(from, entry.name), resolve18(to, name));
+          renameSync6(resolve19(from, entry.name), resolve19(to, name));
           moved.push(name);
         } catch {
           try {
-            copyFileSync(resolve18(from, entry.name), resolve18(to, name));
+            copyFileSync(resolve19(from, entry.name), resolve19(to, name));
             moved.push(name);
           } catch {}
         }
@@ -22520,11 +22681,11 @@ function migrateLegacySpool() {
 }
 function migrateHookActivity() {
   const from = legacy.hookActivityDir();
-  if (!existsSync22(from))
+  if (!existsSync23(from))
     return [];
   const moved = [];
   try {
-    const entries = readdirSync14(from, { withFileTypes: true }).filter((e) => e.isFile() && e.name.endsWith(".jsonl"));
+    const entries = readdirSync15(from, { withFileTypes: true }).filter((e) => e.isFile() && e.name.endsWith(".jsonl"));
     if (entries.length === 0)
       return [];
     const to = hookActivityDir();
@@ -22532,12 +22693,12 @@ function migrateHookActivity() {
     const stamp = Date.now();
     let seq = 0;
     for (const entry of entries) {
-      const source = resolve18(from, entry.name);
+      const source = resolve19(from, entry.name);
       let name = entry.name === "current.jsonl" ? `page-${stamp}-${seq++}.jsonl` : entry.name;
-      let target = resolve18(to, name);
-      while (existsSync22(target)) {
+      let target = resolve19(to, name);
+      while (existsSync23(target)) {
         name = `page-${stamp}-${seq++}.jsonl`;
-        target = resolve18(to, name);
+        target = resolve19(to, name);
       }
       try {
         renameSync6(source, target);
@@ -22585,8 +22746,8 @@ function retirePolicyConfigKeys() {
   return [...removed];
 }
 function readCarriedPolicyConfig() {
-  const from = resolve18(legacy.localPoliciesDir(), "policies-config.json");
-  if (!existsSync22(from))
+  const from = resolve19(legacy.localPoliciesDir(), "policies-config.json");
+  if (!existsSync23(from))
     return null;
   let parsed;
   try {
@@ -22615,11 +22776,11 @@ function rewriteCarriedCustomPaths(carried) {
   const repoint = (value) => {
     if (typeof value !== "string" || value === "")
       return value;
-    const abs = resolve18(value);
+    const abs = resolve19(value);
     const rel = relative4(fromDir, abs);
     if (rel === "" || rel.startsWith("..") || isAbsolute3(rel))
       return value;
-    return resolve18(toDir, rel);
+    return resolve19(toDir, rel);
   };
   if (Array.isArray(carried.customPoliciesPaths)) {
     carried.customPoliciesPaths = carried.customPoliciesPaths.map(repoint);
@@ -22640,7 +22801,7 @@ function writeCarriedPolicyConfig(carried) {
     }
   } catch {}
   try {
-    mkdirSync12(dirname10(to), { recursive: true });
+    mkdirSync12(dirname11(to), { recursive: true });
     writeFileSync10(to, JSON.stringify({ ...existing, ...carried }, null, 2) + `
 `, "utf8");
   } catch {
@@ -22650,7 +22811,7 @@ function writeCarriedPolicyConfig(carried) {
 }
 function readCarriedTelemetryOptOut() {
   const from = legacy.configToml();
-  if (!existsSync22(from))
+  if (!existsSync23(from))
     return false;
   try {
     const text = readFileSync18(from, "utf8");
@@ -22705,7 +22866,7 @@ function parseLegacyToml(text) {
 }
 function readCarriedLegacyConfig() {
   const from = legacy.configToml();
-  if (!existsSync22(from))
+  if (!existsSync23(from))
     return null;
   try {
     return projectConfig(parseLegacyToml(readFileSync18(from, "utf8")));
@@ -22715,7 +22876,7 @@ function readCarriedLegacyConfig() {
 }
 function readCarriedLegacyCredentials() {
   const toml = legacy.credentialsToml();
-  if (existsSync22(toml)) {
+  if (existsSync23(toml)) {
     try {
       const creds = projectCredentials(parseLegacyToml(readFileSync18(toml, "utf8")));
       if (Object.keys(creds).length > 0)
@@ -22758,7 +22919,7 @@ function resetHome(from, to = LAYOUT_VERSION) {
   const spooled = migrateLegacySpool();
   const removed = [];
   for (const path of resettablePaths()) {
-    if (!existsSync22(path))
+    if (!existsSync23(path))
       continue;
     try {
       rmSync7(path, { recursive: true, force: true });
@@ -22783,7 +22944,7 @@ function layoutWarningForHook() {
   if (state.kind === "future") {
     return `[failproofai] this directory was written by a newer version (layout ${state.found} vs ${LAYOUT_VERSION}) — policies are NOT being enforced. ` + `Upgrade failproofai.`;
   }
-  if (existsSync22(globalPolicyConfigFile()))
+  if (existsSync23(globalPolicyConfigFile()))
     return null;
   return `[failproofai] setup predates this version — global policies are NOT being enforced. ` + `Run \`failproofai config\` to re-create it.`;
 }
@@ -23831,17 +23992,17 @@ var init_collector_config = __esm(() => {
 });
 
 // src/hooks/flush-cli.ts
-import { existsSync as existsSync23, mkdirSync as mkdirSync13, writeFileSync as writeFileSync11, readdirSync as readdirSync15 } from "node:fs";
-import { dirname as dirname11, join as join30 } from "node:path";
+import { existsSync as existsSync24, mkdirSync as mkdirSync13, writeFileSync as writeFileSync11, readdirSync as readdirSync16 } from "node:fs";
+import { dirname as dirname12, join as join31 } from "node:path";
 function flushRequestPath(home) {
-  return join30(failproofaiHome(home), "state", "flush-request.json");
+  return join31(failproofaiHome(home), "state", "flush-request.json");
 }
 function spoolDirs(home) {
   const root = spoolDir(home);
-  if (!existsSync23(root))
+  if (!existsSync24(root))
     return [];
   try {
-    return readdirSync15(root, { withFileTypes: true }).filter((e) => e.isDirectory() && e.name !== "failed").map((e) => join30(root, e.name));
+    return readdirSync16(root, { withFileTypes: true }).filter((e) => e.isDirectory() && e.name !== "failed").map((e) => join31(root, e.name));
   } catch {
     return [];
   }
@@ -23850,7 +24011,7 @@ function pendingBatches(home) {
   let n = 0;
   for (const dir of spoolDirs(home)) {
     try {
-      n += readdirSync15(dir).filter((f) => f.endsWith(".jsonl")).length;
+      n += readdirSync16(dir).filter((f) => f.endsWith(".jsonl")).length;
     } catch {}
   }
   return n;
@@ -23907,7 +24068,7 @@ async function runFlushCommand(opts = {}) {
     return { exitCode: 0, pending: 0, lines: ["Nothing spooled — everything already delivered."] };
   }
   const path = flushRequestPath(home);
-  mkdirSync13(dirname11(path), { recursive: true });
+  mkdirSync13(dirname12(path), { recursive: true });
   writeFileSync11(path, `${JSON.stringify({ requestedAtMs: Date.now() }, null, 2)}
 `, {
     mode: 384
@@ -23942,14 +24103,14 @@ var init_flush_cli = __esm(() => {
 import {
   chmodSync as chmodSync4,
   copyFileSync as copyFileSync2,
-  existsSync as existsSync24,
+  existsSync as existsSync25,
   mkdirSync as mkdirSync14,
   readFileSync as readFileSync19,
   renameSync as renameSync7,
   rmSync as rmSync8,
   writeFileSync as writeFileSync12
 } from "node:fs";
-import { basename as basename4, dirname as dirname12, join as join31, resolve as resolve19 } from "node:path";
+import { basename as basename5, dirname as dirname13, join as join32, resolve as resolve20 } from "node:path";
 function migrateToLayout4() {
   const moves = [
     { from: legacy.authJson(), to: auditSessionFile() },
@@ -23958,20 +24119,20 @@ function migrateToLayout4() {
   ];
   const authDirOverride = process.env.FAILPROOFAI_AUTH_DIR;
   if (authDirOverride) {
-    moves.push({ from: join31(authDirOverride, "auth.json"), to: join31(authDirOverride, "session.json") }, {
-      from: join31(authDirOverride, "next-audit.json"),
-      to: join31(authDirOverride, "reminder.json")
+    moves.push({ from: join32(authDirOverride, "auth.json"), to: join32(authDirOverride, "session.json") }, {
+      from: join32(authDirOverride, "next-audit.json"),
+      to: join32(authDirOverride, "reminder.json")
     });
   }
   const migrated = [];
   for (const { from, to } of moves) {
-    if (!existsSync24(from))
+    if (!existsSync25(from))
       continue;
-    if (existsSync24(to)) {
+    if (existsSync25(to)) {
       rmSync8(from, { force: true });
       continue;
     }
-    mkdirSync14(dirname12(to), { recursive: true });
+    mkdirSync14(dirname13(to), { recursive: true });
     try {
       renameSync7(from, to);
     } catch {
@@ -23985,10 +24146,10 @@ function migrateToLayout4() {
       }
       rmSync8(from, { force: true });
     }
-    migrated.push(`${basename4(from)} → audit/${basename4(to)}`);
+    migrated.push(`${basename5(from)} → audit/${basename5(to)}`);
   }
   for (const secret of [auditSessionFile()]) {
-    if (!existsSync24(secret))
+    if (!existsSync25(secret))
       continue;
     try {
       chmodSync4(secret, 384);
@@ -24029,17 +24190,17 @@ function appendLedger(entry) {
   } catch {}
 }
 function backupNameOf(f) {
-  return f.as ?? basename4(f.at());
+  return f.as ?? basename5(f.at());
 }
 function pruneMigratedCredentials(from) {
   const pruned = [];
   for (let layout = from;layout < LAYOUT_VERSION; layout++) {
     for (const { as, landsAt } of PRUNED_AFTER_SUCCESS) {
       try {
-        if (!existsSync24(landsAt()))
+        if (!existsSync25(landsAt()))
           continue;
-        const copy = resolve19(migrationBackupDir(layout), as);
-        if (!existsSync24(copy))
+        const copy = resolve20(migrationBackupDir(layout), as);
+        if (!existsSync25(copy))
           continue;
         rmSync8(copy, { force: true });
         pruned.push(as);
@@ -24052,7 +24213,7 @@ function filesToBackUp() {
   const seen = new Map;
   for (const f of [...BACKED_UP, ...BACKED_UP_LEGACY]) {
     const path = f.at();
-    if (existsSync24(path))
+    if (existsSync25(path))
       seen.set(path, backupNameOf(f));
   }
   return [...seen].map(([path, as]) => ({ path, as }));
@@ -24068,7 +24229,7 @@ function backupBeforeMigrating(from) {
   }
   for (const { path: source, as } of filesToBackUp()) {
     try {
-      copyFileSync2(source, resolve19(dir, as));
+      copyFileSync2(source, resolve20(dir, as));
       saved.push(as);
     } catch {}
   }
@@ -24178,7 +24339,7 @@ var init_migrations = __esm(() => {
     { at: legacy.auditSchedule }
   ];
   PRUNED_AFTER_SUCCESS = [
-    { as: basename4(legacy.authJson()), landsAt: auditSessionFile }
+    { as: basename5(legacy.authJson()), landsAt: auditSessionFile }
   ];
 });
 
@@ -24359,14 +24520,14 @@ var init_fp_reset2 = __esm(() => {
 import { createHmac, randomUUID as randomUUID2 } from "node:crypto";
 import { execSync as execSync5 } from "node:child_process";
 import { readFileSync as readFileSync20, writeFileSync as writeFileSync13, mkdirSync as mkdirSync15 } from "node:fs";
-import { homedir as homedir22, platform, arch, hostname, cpus } from "node:os";
-import { join as join32 } from "node:path";
+import { homedir as homedir23, platform, arch, hostname, cpus } from "node:os";
+import { join as join33 } from "node:path";
 function hashToId3(raw) {
   return createHmac("sha256", NAMESPACE3).update(raw).digest("hex");
 }
 function getInstanceId3() {
-  const idDir = join32(homedir22(), ".failproofai");
-  const idFile = join32(idDir, "instance-id");
+  const idDir = join33(homedir23(), ".failproofai");
+  const idFile = join33(idDir, "instance-id");
   try {
     const existing = readFileSync20(idFile, "utf-8").trim();
     if (existing)
@@ -24400,7 +24561,7 @@ function getInstanceId3() {
   try {
     const sysProps = [
       hostname(),
-      homedir22(),
+      homedir23(),
       platform(),
       arch(),
       cpus()[0]?.model ?? ""
@@ -24442,9 +24603,9 @@ var NAMESPACE3 = "failproofai-telemetry-v1", API_KEY3 = "phc_Ac1Ww1GqKc0z1SyrRWb
 var init_install_telemetry = () => {};
 
 // lib/install-check.ts
-import { existsSync as existsSync25, readFileSync as readFileSync21, writeFileSync as writeFileSync14, mkdirSync as mkdirSync16 } from "node:fs";
-import { dirname as dirname13, resolve as resolve20 } from "node:path";
-import { platform as platform2, arch as arch2, release, homedir as homedir23, hostname as hostname2 } from "node:os";
+import { existsSync as existsSync26, readFileSync as readFileSync21, writeFileSync as writeFileSync14, mkdirSync as mkdirSync16 } from "node:fs";
+import { dirname as dirname14, resolve as resolve21 } from "node:path";
+import { platform as platform2, arch as arch2, release, homedir as homedir24, hostname as hostname2 } from "node:os";
 import { createHmac as createHmac2 } from "node:crypto";
 function hashToId4(raw) {
   return createHmac2("sha256", NAMESPACE4).update(raw).digest("hex");
@@ -24498,7 +24659,7 @@ function compareSemver(a, b) {
 }
 function checkHooks() {
   const hooksConfigPath = globalPolicyConfigFile();
-  if (!existsSync25(hooksConfigPath)) {
+  if (!existsSync26(hooksConfigPath)) {
     return { configured: false, registered: false, policyCount: 0 };
   }
   let config;
@@ -24511,8 +24672,8 @@ function checkHooks() {
     return { configured: false, registered: false, policyCount: 0 };
   }
   const policyCount = config.enabledPolicies.length;
-  const settingsPath = resolve20(homedir23(), ".claude", "settings.json");
-  if (!existsSync25(settingsPath))
+  const settingsPath = resolve21(homedir24(), ".claude", "settings.json");
+  if (!existsSync26(settingsPath))
     return { configured: true, registered: false, policyCount };
   let settings;
   try {
@@ -24540,7 +24701,7 @@ async function maybeReportInstall(version) {
     const versionFile = lastVersionPath();
     let previousVersion = null;
     try {
-      if (existsSync25(versionFile)) {
+      if (existsSync26(versionFile)) {
         previousVersion = readFileSync21(versionFile, "utf8").trim() || null;
       }
     } catch {}
@@ -24577,7 +24738,7 @@ async function maybeReportInstall(version) {
       enabled_policy_count: hooks.policyCount
     }, { version, timeoutMs: REPORT_TIMEOUT_MS, enabled: telemetryEnabled }));
     try {
-      mkdirSync16(dirname13(versionFile), { recursive: true });
+      mkdirSync16(dirname14(versionFile), { recursive: true });
       writeFileSync14(versionFile, version, "utf8");
     } catch {}
     await Promise.all(events.map((p) => p.catch(() => {})));
@@ -24628,8 +24789,8 @@ var init_cli_error = __esm(() => {
 
 // src/hooks/manager.ts
 import { execSync as execSync6 } from "node:child_process";
-import { existsSync as existsSync26 } from "node:fs";
-import { resolve as resolve21, basename as basename5 } from "node:path";
+import { existsSync as existsSync27 } from "node:fs";
+import { resolve as resolve22, basename as basename6 } from "node:path";
 import { platform as platform3, arch as arch3, release as release2, hostname as hostname3 } from "node:os";
 function getSettingsPath(scope, cwd) {
   return claudeCode.getSettingsPath(scope, cwd);
@@ -24848,9 +25009,9 @@ async function installHooksImpl(policyNames, scope = "user", cwd, includeBeta =
     delete configToWrite.customPoliciesPath;
     delete configToWrite.customPoliciesPaths;
   } else if (customPoliciesPath && (typeof customPoliciesPath === "string" || customPoliciesPath.length > 0)) {
-    const incoming = (typeof customPoliciesPath === "string" ? [customPoliciesPath] : customPoliciesPath).map((path) => resolve21(path));
-    const carried = (previousConfig.customPoliciesPaths ?? (previousConfig.customPoliciesPath ? [previousConfig.customPoliciesPath] : [])).map((path) => resolve21(path)).filter((path) => {
-      if (existsSync26(path))
+    const incoming = (typeof customPoliciesPath === "string" ? [customPoliciesPath] : customPoliciesPath).map((path) => resolve22(path));
+    const carried = (previousConfig.customPoliciesPaths ?? (previousConfig.customPoliciesPath ? [previousConfig.customPoliciesPath] : [])).map((path) => resolve22(path)).filter((path) => {
+      if (existsSync27(path))
         return true;
       console.log(`Dropping custom policies path (file no longer exists): ${path}`);
       return false;
@@ -25073,7 +25234,7 @@ async function removeHooks(policyNames, scope = "user", cwd, opts) {
     const scopesToRemove = scope === "all" ? [...integration.scopes] : integration.scopes.includes(scope) ? [scope] : [];
     for (const s of scopesToRemove) {
       const settingsPaths = settingsPathsFor(integration, s, cwd);
-      const existing = settingsPaths.filter((p) => existsSync26(p));
+      const existing = settingsPaths.filter((p) => existsSync27(p));
       if (existing.length === 0) {
         if (scope !== "all" && selectedClis.length === 1) {
           console.log("No settings file found. Nothing to remove.");
@@ -25176,7 +25337,7 @@ var DEFAULT_FETCH_TIMEOUT_MS = 15000;
 
 // src/hooks/cloud-enrollment.ts
 import { randomUUID as randomUUID3 } from "node:crypto";
-import { existsSync as existsSync27, readFileSync as readFileSync22, rmSync as rmSync9 } from "node:fs";
+import { existsSync as existsSync28, readFileSync as readFileSync22, rmSync as rmSync9 } from "node:fs";
 import { hostname as hostname4 } from "node:os";
 function cloudCredentialPath() {
   return process.env.FAILPROOFAI_CLOUD_CREDENTIALS ?? credentialsFile();
@@ -25215,7 +25376,7 @@ function readCloudCredentials() {
   if (!usingJsonOverride())
     return readCredentials().cloud ?? null;
   const path = cloudCredentialPath();
-  if (!existsSync27(path))
+  if (!existsSync28(path))
     return null;
   try {
     const raw = JSON.parse(readFileSync22(path, "utf8"));
@@ -25257,7 +25418,7 @@ function resolveMachineLabel(explicit) {
 function clearCloudCredentials() {
   if (usingJsonOverride()) {
     const path = cloudCredentialPath();
-    if (!existsSync27(path))
+    if (!existsSync28(path))
       return false;
     try {
       rmSync9(path);
@@ -25508,37 +25669,37 @@ var init_cloud_connection = __esm(() => {
 });
 
 // src/hooks/setup-state.ts
-import { existsSync as existsSync28, realpathSync as realpathSync2, statSync as statSync17 } from "node:fs";
-import { dirname as dirname14, resolve as resolve22 } from "node:path";
-import { homedir as homedir24 } from "node:os";
-function globalConfigPath(home = homedir24()) {
+import { existsSync as existsSync29, realpathSync as realpathSync2, statSync as statSync18 } from "node:fs";
+import { dirname as dirname15, resolve as resolve23 } from "node:path";
+import { homedir as homedir25 } from "node:os";
+function globalConfigPath(home = homedir25()) {
   return globalPolicyConfigFile(home);
 }
 function projectConfigPath(projectRoot) {
-  return resolve22(projectRoot, ".failproofai", "policies-config.json");
+  return resolve23(projectRoot, ".failproofai", "policies-config.json");
 }
 function legacyMarkerPath(home) {
   return launcherMarker(home);
 }
 function isDir(path) {
   try {
-    return statSync17(path).isDirectory();
+    return statSync18(path).isDirectory();
   } catch {
     return false;
   }
 }
-function findProjectRoot(start, home = homedir24()) {
+function findProjectRoot(start, home = homedir25()) {
   const resolvedHome = realResolve(home);
   let dir = realResolve(start);
   while (dir !== resolvedHome) {
-    if (isDir(resolve22(dir, ".failproofai")))
+    if (isDir(resolve23(dir, ".failproofai")))
       return dir;
-    const parent = dirname14(dir);
+    const parent = dirname15(dir);
     if (parent === dir)
       break;
     dir = parent;
   }
-  return resolve22(start);
+  return resolve23(start);
 }
 function hasGlobalHooksInstalled() {
   for (const id of INTEGRATION_TYPES) {
@@ -25550,14 +25711,14 @@ function hasGlobalHooksInstalled() {
   return false;
 }
 function realResolve(path) {
-  const lexical = resolve22(path);
+  const lexical = resolve23(path);
   try {
     return realpathSync2(lexical);
   } catch {
     return lexical;
   }
 }
-function detectSetupState(cwd = process.cwd(), home = homedir24()) {
+function detectSetupState(cwd = process.cwd(), home = homedir25()) {
   const resolvedCwd = realResolve(cwd);
   const resolvedHome = realResolve(home);
   const projectRoot = findProjectRoot(resolvedCwd, resolvedHome);
@@ -25565,10 +25726,10 @@ function detectSetupState(cwd = process.cwd(), home = homedir24()) {
     cwd: resolvedCwd,
     home: resolvedHome,
     projectRoot,
-    hasGlobalConfig: existsSync28(globalConfigPath(resolvedHome)),
-    hasProjectConfig: projectRoot !== resolvedHome && existsSync28(projectConfigPath(projectRoot)),
+    hasGlobalConfig: existsSync29(globalConfigPath(resolvedHome)),
+    hasProjectConfig: projectRoot !== resolvedHome && existsSync29(projectConfigPath(projectRoot)),
     hasGlobalHooks: hasGlobalHooksInstalled(),
-    hasLegacyMarker: existsSync28(legacyMarkerPath(resolvedHome)),
+    hasLegacyMarker: existsSync29(legacyMarkerPath(resolvedHome)),
     inHomeDir: resolvedCwd === resolvedHome
   };
 }
@@ -25585,11 +25746,11 @@ var init_setup_state = __esm(() => {
 });
 
 // src/hooks/onboarding-attempt.ts
-import { existsSync as existsSync29, mkdirSync as mkdirSync17, readFileSync as readFileSync23, rmSync as rmSync10, writeFileSync as writeFileSync15 } from "node:fs";
-import { dirname as dirname15 } from "node:path";
+import { existsSync as existsSync30, mkdirSync as mkdirSync17, readFileSync as readFileSync23, rmSync as rmSync10, writeFileSync as writeFileSync15 } from "node:fs";
+import { dirname as dirname16 } from "node:path";
 function readOnboardingAttempt() {
   const path = onboardingAttemptFile();
-  if (!existsSync29(path))
+  if (!existsSync30(path))
     return null;
   try {
     const raw = JSON.parse(readFileSync23(path, "utf8"));
@@ -25611,7 +25772,7 @@ function readOnboardingAttempt() {
 function recordOnboardingAttempt(reason, cliVersion, daemonStatus, now = Date.now()) {
   try {
     const path = onboardingAttemptFile();
-    mkdirSync17(dirname15(path), { recursive: true });
+    mkdirSync17(dirname16(path), { recursive: true });
     const record = {
       schemaVersion: SCHEMA_VERSION3,
       reason,
@@ -25667,8 +25828,8 @@ var init_onboarding_attempt = __esm(() => {
 
 // src/hooks/onboarding-lock.ts
 import { mkdirSync as mkdirSync18, readFileSync as readFileSync24, rmSync as rmSync11, writeFileSync as writeFileSync16 } from "node:fs";
-import { homedir as homedir25 } from "node:os";
-function onboardingLockPath(home = homedir25()) {
+import { homedir as homedir26 } from "node:os";
+function onboardingLockPath(home = homedir26()) {
   return onboardingLockFile(home);
 }
 function processAlive(pid) {
@@ -25691,7 +25852,7 @@ function readLock(path) {
     return null;
   }
 }
-function acquireOnboardingLock(home = homedir25()) {
+function acquireOnboardingLock(home = homedir26()) {
   const path = onboardingLockPath(home);
   try {
     const held = readLock(path);
@@ -25722,8 +25883,8 @@ var init_onboarding_lock = __esm(() => {
 });
 
 // lib/claude-sessions.ts
-import { readdirSync as readdirSync16, statSync as statSync18, existsSync as existsSync30 } from "node:fs";
-import { join as join33, basename as basename6 } from "node:path";
+import { readdirSync as readdirSync17, statSync as statSync19, existsSync as existsSync31 } from "node:fs";
+import { join as join34, basename as basename7 } from "node:path";
 function getClaudeProjectsRoot() {
   return getClaudeProjectsPath();
 }
@@ -25731,21 +25892,21 @@ function listClaudeProjects() {
   const root = getClaudeProjectsRoot();
   let entries;
   try {
-    entries = readdirSync16(root, { withFileTypes: true });
+    entries = readdirSync17(root, { withFileTypes: true });
   } catch {
     return [];
   }
   return entries.filter((e) => e.isDirectory()).map((e) => ({
     name: e.name,
     cwd: decodeFolderName(e.name),
-    path: join33(root, e.name)
+    path: join34(root, e.name)
   }));
 }
 function listClaudeTranscripts(project) {
   const out = [];
   let entries;
   try {
-    entries = readdirSync16(project.path, { withFileTypes: true });
+    entries = readdirSync17(project.path, { withFileTypes: true });
   } catch {
     return out;
   }
@@ -25754,9 +25915,9 @@ function listClaudeTranscripts(project) {
       const sessionId = entry.name.slice(0, -".jsonl".length);
       if (!UUID_RE2.test(sessionId))
         continue;
-      const transcriptPath = join33(project.path, entry.name);
+      const transcriptPath = join34(project.path, entry.name);
       try {
-        const s = statSync18(transcriptPath);
+        const s = statSync19(transcriptPath);
         out.push({
           projectName: project.name,
           cwd: project.cwd,
@@ -25768,12 +25929,12 @@ function listClaudeTranscripts(project) {
         });
       } catch {}
     } else if (entry.isDirectory() && UUID_RE2.test(entry.name)) {
-      const subDir = join33(project.path, entry.name, "subagents");
-      if (!existsSync30(subDir))
+      const subDir = join34(project.path, entry.name, "subagents");
+      if (!existsSync31(subDir))
         continue;
       let subEntries;
       try {
-        subEntries = readdirSync16(subDir, { withFileTypes: true });
+        subEntries = readdirSync17(subDir, { withFileTypes: true });
       } catch {
         continue;
       }
@@ -25781,9 +25942,9 @@ function listClaudeTranscripts(project) {
         if (!sub.isFile() || !sub.name.endsWith(".jsonl"))
           continue;
         const agentId = sub.name.slice(0, -".jsonl".length);
-        const transcriptPath = join33(subDir, sub.name);
+        const transcriptPath = join34(subDir, sub.name);
         try {
-          const s = statSync18(transcriptPath);
+          const s = statSync19(transcriptPath);
           out.push({
             projectName: project.name,
             cwd: project.cwd,
@@ -25999,7 +26160,7 @@ var init_claude = __esm(() => {
 });
 
 // src/audit/cli-adapters/codex.ts
-import { statSync as statSync19 } from "node:fs";
+import { statSync as statSync20 } from "node:fs";
 async function listCodexTranscriptMetadata(opts = {}) {
   const projectFilter = opts.projects ? new Set(opts.projects) : null;
   const sinceMs = opts.sinceMs ?? 0;
@@ -26016,7 +26177,7 @@ async function listCodexTranscriptMetadata(opts = {}) {
         continue;
       let sizeBytes = 0;
       try {
-        sizeBytes = statSync19(s.path).size;
+        sizeBytes = statSync20(s.path).size;
       } catch {}
       if (!s.sessionId)
         continue;
@@ -26050,7 +26211,7 @@ var init_codex = __esm(() => {
 });
 
 // src/audit/cli-adapters/copilot.ts
-import { statSync as statSync20 } from "node:fs";
+import { statSync as statSync21 } from "node:fs";
 async function listCopilotTranscriptMetadata(opts = {}) {
   const projectFilter = opts.projects ? new Set(opts.projects) : null;
   const sinceMs = opts.sinceMs ?? 0;
@@ -26067,7 +26228,7 @@ async function listCopilotTranscriptMetadata(opts = {}) {
         continue;
       let sizeBytes = 0;
       try {
-        sizeBytes = statSync20(s.path).size;
+        sizeBytes = statSync21(s.path).size;
       } catch {}
       if (!s.sessionId)
         continue;
@@ -26101,7 +26262,7 @@ var init_copilot = __esm(() => {
 });
 
 // src/audit/cli-adapters/cursor.ts
-import { statSync as statSync21 } from "node:fs";
+import { statSync as statSync22 } from "node:fs";
 async function listCursorTranscriptMetadata(opts = {}) {
   const projectFilter = opts.projects ? new Set(opts.projects) : null;
   const sinceMs = opts.sinceMs ?? 0;
@@ -26118,7 +26279,7 @@ async function listCursorTranscriptMetadata(opts = {}) {
         continue;
       let sizeBytes = 0;
       try {
-        sizeBytes = statSync21(s.path).size;
+        sizeBytes = statSync22(s.path).size;
       } catch {}
       if (!s.sessionId)
         continue;
@@ -26359,7 +26520,7 @@ var init_opencode = __esm(() => {
 });
 
 // src/audit/cli-adapters/pi.ts
-import { statSync as statSync22 } from "node:fs";
+import { statSync as statSync23 } from "node:fs";
 async function listPiTranscriptMetadata(opts = {}) {
   const projectFilter = opts.projects ? new Set(opts.projects) : null;
   const sinceMs = opts.sinceMs ?? 0;
@@ -26376,7 +26537,7 @@ async function listPiTranscriptMetadata(opts = {}) {
         continue;
       let sizeBytes = 0;
       try {
-        sizeBytes = statSync22(s.path).size;
+        sizeBytes = statSync23(s.path).size;
       } catch {}
       if (!s.sessionId)
         continue;
@@ -27112,8 +27273,8 @@ var init_features = __esm(() => {
 
 // src/audit/cache.ts
 import { createHash as createHash8 } from "node:crypto";
-import { existsSync as existsSync31, mkdirSync as mkdirSync19, readFileSync as readFileSync25, writeFileSync as writeFileSync17, chmodSync as chmodSync5, openSync, readSync, closeSync } from "node:fs";
-import { join as join34 } from "node:path";
+import { existsSync as existsSync32, mkdirSync as mkdirSync19, readFileSync as readFileSync25, writeFileSync as writeFileSync17, chmodSync as chmodSync5, openSync, readSync, closeSync } from "node:fs";
+import { join as join35 } from "node:path";
 function getEngineVersion() {
   if (cachedEngineVersion)
     return cachedEngineVersion;
@@ -27133,7 +27294,7 @@ function getDetectorVersion() {
 function getCachePathFor(transcriptPath) {
   const root = auditCacheDir();
   const key = createHash8("sha1").update(transcriptPath).digest("hex");
-  return join34(root, `${key}.json`);
+  return join35(root, `${key}.json`);
 }
 function encodeDetectorState(state) {
   return JSON.stringify(state, (_k, v) => v instanceof Map ? { __map: [...v.entries()] } : v);
@@ -27173,7 +27334,7 @@ function readCachedTranscript(transcriptPath, mtimeMs, sizeBytes) {
   if (sizeBytes === 0)
     return null;
   const cachePath = getCachePathFor(transcriptPath);
-  if (!existsSync31(cachePath))
+  if (!existsSync32(cachePath))
     return null;
   try {
     const raw = readFileSync25(cachePath, "utf-8");
@@ -27793,7 +27954,7 @@ var init_audit_lock = __esm(() => {
 });
 
 // src/audit/dashboard-cache.ts
-import { existsSync as existsSync32, readFileSync as readFileSync27 } from "node:fs";
+import { existsSync as existsSync33, readFileSync as readFileSync27 } from "node:fs";
 function getCachePath() {
   return auditDashboardFile();
 }
@@ -27813,7 +27974,7 @@ function writeDashboardCache(params, result) {
 }
 function readDashboardCacheMeta() {
   const cachePath = getCachePath();
-  if (!existsSync32(cachePath))
+  if (!existsSync33(cachePath))
     return null;
   try {
     const raw = readFileSync27(cachePath, "utf-8");
@@ -28040,15 +28201,15 @@ var init_api_server_client = __esm(() => {
 });
 
 // lib/auth/auth-store.ts
-import { existsSync as existsSync33, readFileSync as readFileSync28, readdirSync as readdirSync17, rmSync as rmSync12 } from "node:fs";
-import { join as join35, resolve as resolve23 } from "node:path";
+import { existsSync as existsSync34, readFileSync as readFileSync28, readdirSync as readdirSync18, rmSync as rmSync12 } from "node:fs";
+import { join as join36, resolve as resolve24 } from "node:path";
 function getAuthFilePath() {
   const override = process.env.FAILPROOFAI_AUTH_DIR;
-  return override ? join35(override, "session.json") : auditSessionFile();
+  return override ? join36(override, "session.json") : auditSessionFile();
 }
 function readAuth() {
   const p = getAuthFilePath();
-  if (!existsSync33(p))
+  if (!existsSync34(p))
     return null;
   try {
     const raw = readFileSync28(p, "utf-8");
@@ -28075,17 +28236,17 @@ function writeAuth(auth) {
 }
 function deleteAuth() {
   const p = getAuthFilePath();
-  if (existsSync33(p))
+  if (existsSync34(p))
     rmSync12(p, { force: true });
   try {
     const root = migrationsDir();
-    if (!existsSync33(root))
+    if (!existsSync34(root))
       return;
-    for (const entry of readdirSync17(root)) {
+    for (const entry of readdirSync18(root)) {
       if (!entry.startsWith("backup-layout"))
         continue;
-      const copy = resolve23(root, entry, "auth.json");
-      if (existsSync33(copy))
+      const copy = resolve24(root, entry, "auth.json");
+      if (existsSync34(copy))
         rmSync12(copy, { force: true });
     }
   } catch {}
@@ -28147,7 +28308,7 @@ var init_auth_store = __esm(() => {
 });
 
 // src/audit/redact-example.ts
-import { homedir as homedir26 } from "node:os";
+import { homedir as homedir27 } from "node:os";
 function maskTruncatedSecret(input) {
   for (const [pattern, label] of SECRET_PREFIXES) {
     if (pattern.test(input)) {
@@ -28182,7 +28343,7 @@ function maskSecrets(input) {
   }
   return out;
 }
-function shortenPaths(input, home = homedir26()) {
+function shortenPaths(input, home = homedir27()) {
   const homeRoot = home.replace(/\/+$/, "");
   return input.replace(ABSOLUTE_PATH_RE, (match, offset, whole) => {
     if (PUBLIC_PATH_ROOTS.some((root) => match.startsWith(root)))
@@ -28213,7 +28374,7 @@ function shortenPaths(input, home = homedir26()) {
     return `${root}${middle}/${tail}${trailingSlash ? "/" : ""}`;
   });
 }
-function redactExample(input, home = homedir26()) {
+function redactExample(input, home = homedir27()) {
   const masked = maskAssignedSecrets(maskTruncatedSecret(maskSecrets(input)));
   const shortened = shortenPaths(masked, home);
   const collapsed = shortened.replace(/\s+/g, " ").trim();
@@ -28336,12 +28497,12 @@ var init_harm_report = __esm(() => {
 });
 
 // src/audit/machine-store.ts
-import { existsSync as existsSync34, readFileSync as readFileSync29, rmSync as rmSync13 } from "node:fs";
+import { existsSync as existsSync35, readFileSync as readFileSync29, rmSync as rmSync13 } from "node:fs";
 import { hostname as hostname5 } from "node:os";
 import { randomUUID as randomUUID4 } from "node:crypto";
 function readMachineIdentity(home) {
   const path = auditMachineFile(home);
-  if (!existsSync34(path))
+  if (!existsSync35(path))
     return null;
   try {
     const parsed = JSON.parse(readFileSync29(path, "utf8"));
@@ -28666,16 +28827,16 @@ var init_cli = __esm(() => {
 });
 
 // src/hooks/configure-wizard.ts
-import { existsSync as existsSync35, mkdirSync as mkdirSync21, writeFileSync as writeFileSync19, readFileSync as readFileSync30 } from "node:fs";
-import { homedir as homedir27 } from "node:os";
-import { dirname as dirname16, resolve as resolve24, sep as sep5 } from "node:path";
+import { existsSync as existsSync36, mkdirSync as mkdirSync21, writeFileSync as writeFileSync19, readFileSync as readFileSync30 } from "node:fs";
+import { homedir as homedir28 } from "node:os";
+import { dirname as dirname17, resolve as resolve25, sep as sep5 } from "node:path";
 async function emit(event, props) {
   try {
     await trackHookEvent2(getInstanceId2(), event, props);
   } catch {}
 }
 function homeify(p) {
-  const home = homedir27();
+  const home = homedir28();
   if (p === home)
     return "~";
   if (p.startsWith(home + sep5))
@@ -28691,7 +28852,7 @@ function setCustomPoliciesEnabled(scope, cwd, enabled) {
   const path = getConfigPathForScope(scope, cwd);
   let config = {};
   try {
-    if (existsSync35(path))
+    if (existsSync36(path))
       config = JSON.parse(readFileSync30(path, "utf8"));
   } catch {
     return;
@@ -28732,7 +28893,7 @@ function describeCustomPolicies(cwd) {
   const scopes = [];
   let fileCount = 0;
   const dirs = [
-    { dir: resolve24(cwd, ".failproofai", "policies"), label: "project" },
+    { dir: resolve25(cwd, ".failproofai", "policies"), label: "project" },
     { dir: customPoliciesDir(), label: "global" }
   ];
   for (const { dir, label } of dirs) {
@@ -28743,7 +28904,7 @@ function describeCustomPolicies(cwd) {
       fileCount += found.length;
     }
     for (const name of findSkippedPolicyFiles(dir)) {
-      warnings.push(`! ${homeify(resolve24(dir, name))} is NOT loaded — rename to ` + `${name.replace(/\.(js|mjs|ts)$/, "-policies.$1")}`);
+      warnings.push(`! ${homeify(resolve25(dir, name))} is NOT loaded — rename to ` + `${name.replace(/\.(js|mjs|ts)$/, "-policies.$1")}`);
     }
   }
   return { active, warnings, fileCount, scopes };
@@ -28836,7 +28997,7 @@ function firstRunMarkerPath() {
 }
 function markLauncherSeen() {
   try {
-    mkdirSync21(dirname16(firstRunMarkerPath()), { recursive: true });
+    mkdirSync21(dirname17(firstRunMarkerPath()), { recursive: true });
     writeFileSync19(firstRunMarkerPath(), "1", "utf8");
   } catch {}
 }
@@ -29328,17 +29489,17 @@ var init_configure_wizard = __esm(() => {
 });
 
 // src/hooks/flush-cli.ts
-import { existsSync as existsSync36, mkdirSync as mkdirSync22, writeFileSync as writeFileSync20, readdirSync as readdirSync18 } from "node:fs";
-import { dirname as dirname17, join as join36 } from "node:path";
+import { existsSync as existsSync37, mkdirSync as mkdirSync22, writeFileSync as writeFileSync20, readdirSync as readdirSync19 } from "node:fs";
+import { dirname as dirname18, join as join37 } from "node:path";
 function flushRequestPath2(home) {
-  return join36(failproofaiHome(home), "state", "flush-request.json");
+  return join37(failproofaiHome(home), "state", "flush-request.json");
 }
 function spoolDirs2(home) {
   const root = spoolDir(home);
-  if (!existsSync36(root))
+  if (!existsSync37(root))
     return [];
   try {
-    return readdirSync18(root, { withFileTypes: true }).filter((e) => e.isDirectory() && e.name !== "failed").map((e) => join36(root, e.name));
+    return readdirSync19(root, { withFileTypes: true }).filter((e) => e.isDirectory() && e.name !== "failed").map((e) => join37(root, e.name));
   } catch {
     return [];
   }
@@ -29347,7 +29508,7 @@ function pendingBatches2(home) {
   let n = 0;
   for (const dir of spoolDirs2(home)) {
     try {
-      n += readdirSync18(dir).filter((f) => f.endsWith(".jsonl")).length;
+      n += readdirSync19(dir).filter((f) => f.endsWith(".jsonl")).length;
     } catch {}
   }
   return n;
@@ -29404,7 +29565,7 @@ async function runFlushCommand2(opts = {}) {
     return { exitCode: 0, pending: 0, lines: ["Nothing spooled — everything already delivered."] };
   }
   const path = flushRequestPath2(home);
-  mkdirSync22(dirname17(path), { recursive: true });
+  mkdirSync22(dirname18(path), { recursive: true });
   writeFileSync20(path, `${JSON.stringify({ requestedAtMs: Date.now() }, null, 2)}
 `, {
     mode: 384
@@ -29436,16 +29597,16 @@ var init_flush_cli2 = __esm(() => {
 });
 
 // src/hooks/backfill-cli.ts
-import { existsSync as existsSync37, mkdirSync as mkdirSync23, writeFileSync as writeFileSync21, readdirSync as readdirSync19, statSync as statSync23 } from "node:fs";
-import { dirname as dirname18, join as join37 } from "node:path";
+import { existsSync as existsSync38, mkdirSync as mkdirSync23, writeFileSync as writeFileSync21, readdirSync as readdirSync20, statSync as statSync24 } from "node:fs";
+import { dirname as dirname19, join as join38 } from "node:path";
 function backfillRequestPath(home) {
-  return join37(failproofaiHome(home), "state", "backfill-request.json");
+  return join38(failproofaiHome(home), "state", "backfill-request.json");
 }
 function surveySessions(sinceMs, homeDir) {
   const out = [];
   for (const { cli, dir } of SESSION_DIRS) {
-    const root = join37(homeDir, dir);
-    if (!existsSync37(root))
+    const root = join38(homeDir, dir);
+    if (!existsSync38(root))
       continue;
     let files = 0;
     let newest = 0;
@@ -29454,18 +29615,18 @@ function surveySessions(sinceMs, homeDir) {
         return;
       let entries;
       try {
-        entries = readdirSync19(d, { withFileTypes: true });
+        entries = readdirSync20(d, { withFileTypes: true });
       } catch {
         return;
       }
       for (const e of entries) {
-        const p = join37(d, e.name);
+        const p = join38(d, e.name);
         if (e.isDirectory()) {
           walk(p, depth + 1);
           continue;
         }
         try {
-          const st = statSync23(p);
+          const st = statSync24(p);
           if (st.mtimeMs >= sinceMs) {
             files += 1;
             newest = Math.max(newest, st.mtimeMs);
@@ -29483,7 +29644,7 @@ function runBackfillCommand(opts = {}) {
   const now = opts.now ?? Date.now();
   const sinceMs = opts.sinceMs ?? now - DEFAULT_BACKFILL_DAYS * 24 * 60 * 60 * 1000;
   const home = failproofaiHome();
-  if (!existsSync37(home)) {
+  if (!existsSync38(home)) {
     return {
       exitCode: 1,
       lines: [`No failproofai home at ${home}. Run \`failproofai config\` first.`]
@@ -29515,7 +29676,7 @@ function runBackfillCommand(opts = {}) {
       ]
     };
   }
-  const found = surveySessions(sinceMs, dirname18(home));
+  const found = surveySessions(sinceMs, dirname19(home));
   const totalFiles = found.reduce((n, f) => n + f.files, 0);
   const sinceLabel = new Date(sinceMs).toISOString().slice(0, 10);
   const lines = [
@@ -29538,7 +29699,7 @@ function runBackfillCommand(opts = {}) {
   }
   try {
     const path = backfillRequestPath();
-    mkdirSync23(dirname18(path), { recursive: true });
+    mkdirSync23(dirname19(path), { recursive: true });
     writeFileSync21(path, `${JSON.stringify({ sinceMs, requestedAtMs: now }, null, 2)}
 `, {
       mode: 384
@@ -29581,8 +29742,8 @@ var init_backfill_cli = __esm(() => {
 });
 
 // src/hooks/harness-cli.ts
-import { homedir as homedir28 } from "node:os";
-import { resolve as resolve25 } from "node:path";
+import { homedir as homedir29 } from "node:os";
+import { resolve as resolve26 } from "node:path";
 function unknownHarness(name) {
   return fail([
     `Unknown harness: ${name}`,
@@ -29625,8 +29786,8 @@ function comparableLabel(raw) {
   return raw.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
 }
 function comparablePath(raw) {
-  const home = homedir28();
-  const expanded = raw === "~" ? home : raw.startsWith("~/") ? resolve25(home, raw.slice(2)) : raw;
+  const home = homedir29();
+  const expanded = raw === "~" ? home : raw.startsWith("~/") ? resolve26(home, raw.slice(2)) : raw;
   return expanded.replace(/\/+$/, "");
 }
 function effectiveLabel(entry) {
@@ -29814,7 +29975,7 @@ var init_harness_cli = __esm(() => {
 });
 
 // src/hooks/fp-config.ts
-import { chmodSync as chmodSync6, existsSync as existsSync38, mkdirSync as mkdirSync24, readFileSync as readFileSync31, statSync as statSync24, writeFileSync as writeFileSync22 } from "node:fs";
+import { chmodSync as chmodSync6, existsSync as existsSync39, mkdirSync as mkdirSync24, readFileSync as readFileSync31, statSync as statSync25, writeFileSync as writeFileSync22 } from "node:fs";
 function detectLayout2() {
   const raw = readVersionFile2();
   if (raw) {
@@ -29822,17 +29983,17 @@ function detectLayout2() {
       return { kind: "current", version: raw };
     return raw.layout > LAYOUT_VERSION ? { kind: "future", found: raw.layout } : { kind: "stale", found: raw.layout };
   }
-  if (existsSync38(configFile())) {
+  if (existsSync39(configFile())) {
     const layoutThreePositions = [
       legacy.authJson(),
       legacy.nextAudit(),
       legacy.auditSchedule()
     ];
-    if (layoutThreePositions.some((p) => existsSync38(p)))
+    if (layoutThreePositions.some((p) => existsSync39(p)))
       return { kind: "stale", found: 3 };
     return { kind: "current", version: { layout: LAYOUT_VERSION, cli: "" }, inferred: true };
   }
-  if (existsSync38(legacy.configToml()))
+  if (existsSync39(legacy.configToml()))
     return { kind: "stale", found: 2 };
   const layoutOneMarkers = [
     legacy.policyConfig(),
@@ -29843,7 +30004,7 @@ function detectLayout2() {
     legacy.ingestCredentials(),
     legacy.auditDashboard()
   ];
-  return layoutOneMarkers.some((p) => existsSync38(p)) ? { kind: "stale", found: 1 } : { kind: "absent" };
+  return layoutOneMarkers.some((p) => existsSync39(p)) ? { kind: "stale", found: 1 } : { kind: "absent" };
 }
 function readLegacyTomlVersion2(text) {
   const layout = Number(/^\s*layout\s*=\s*(\d+)\s*$/m.exec(text)?.[1]);
@@ -29886,14 +30047,14 @@ var init_fp_home2 = () => {};
 import {
   chmodSync as chmodSync7,
   copyFileSync as copyFileSync3,
-  existsSync as existsSync39,
+  existsSync as existsSync40,
   mkdirSync as mkdirSync25,
   readFileSync as readFileSync32,
   renameSync as renameSync8,
   rmSync as rmSync14,
   writeFileSync as writeFileSync23
 } from "node:fs";
-import { basename as basename7, dirname as dirname19, join as join38, resolve as resolve26 } from "node:path";
+import { basename as basename8, dirname as dirname20, join as join39, resolve as resolve27 } from "node:path";
 function migrateToLayout42() {
   const moves = [
     { from: legacy.authJson(), to: auditSessionFile() },
@@ -29902,20 +30063,20 @@ function migrateToLayout42() {
   ];
   const authDirOverride = process.env.FAILPROOFAI_AUTH_DIR;
   if (authDirOverride) {
-    moves.push({ from: join38(authDirOverride, "auth.json"), to: join38(authDirOverride, "session.json") }, {
-      from: join38(authDirOverride, "next-audit.json"),
-      to: join38(authDirOverride, "reminder.json")
+    moves.push({ from: join39(authDirOverride, "auth.json"), to: join39(authDirOverride, "session.json") }, {
+      from: join39(authDirOverride, "next-audit.json"),
+      to: join39(authDirOverride, "reminder.json")
     });
   }
   const migrated = [];
   for (const { from, to } of moves) {
-    if (!existsSync39(from))
+    if (!existsSync40(from))
       continue;
-    if (existsSync39(to)) {
+    if (existsSync40(to)) {
       rmSync14(from, { force: true });
       continue;
     }
-    mkdirSync25(dirname19(to), { recursive: true });
+    mkdirSync25(dirname20(to), { recursive: true });
     try {
       renameSync8(from, to);
     } catch {
@@ -29929,10 +30090,10 @@ function migrateToLayout42() {
       }
       rmSync14(from, { force: true });
     }
-    migrated.push(`${basename7(from)} → audit/${basename7(to)}`);
+    migrated.push(`${basename8(from)} → audit/${basename8(to)}`);
   }
   for (const secret of [auditSessionFile()]) {
-    if (!existsSync39(secret))
+    if (!existsSync40(secret))
       continue;
     try {
       chmodSync7(secret, 384);
@@ -29973,17 +30134,17 @@ function appendLedger2(entry) {
   } catch {}
 }
 function backupNameOf2(f) {
-  return f.as ?? basename7(f.at());
+  return f.as ?? basename8(f.at());
 }
 function pruneMigratedCredentials2(from) {
   const pruned = [];
   for (let layout = from;layout < LAYOUT_VERSION; layout++) {
     for (const { as, landsAt } of PRUNED_AFTER_SUCCESS2) {
       try {
-        if (!existsSync39(landsAt()))
+        if (!existsSync40(landsAt()))
           continue;
-        const copy = resolve26(migrationBackupDir(layout), as);
-        if (!existsSync39(copy))
+        const copy = resolve27(migrationBackupDir(layout), as);
+        if (!existsSync40(copy))
           continue;
         rmSync14(copy, { force: true });
         pruned.push(as);
@@ -29996,7 +30157,7 @@ function filesToBackUp2() {
   const seen = new Map;
   for (const f of [...BACKED_UP2, ...BACKED_UP_LEGACY2]) {
     const path = f.at();
-    if (existsSync39(path))
+    if (existsSync40(path))
       seen.set(path, backupNameOf2(f));
   }
   return [...seen].map(([path, as]) => ({ path, as }));
@@ -30012,7 +30173,7 @@ function backupBeforeMigrating2(from) {
   }
   for (const { path: source, as } of filesToBackUp2()) {
     try {
-      copyFileSync3(source, resolve26(dir, as));
+      copyFileSync3(source, resolve27(dir, as));
       saved.push(as);
     } catch {}
   }
@@ -30144,13 +30305,13 @@ var init_migrations2 = __esm(() => {
     { at: legacy.auditSchedule }
   ];
   PRUNED_AFTER_SUCCESS2 = [
-    { as: basename7(legacy.authJson()), landsAt: auditSessionFile }
+    { as: basename8(legacy.authJson()), landsAt: auditSessionFile }
   ];
 });
 
 // src/hooks/daemon-service.ts
 import {
-  existsSync as existsSync40,
+  existsSync as existsSync41,
   mkdirSync as mkdirSync26,
   mkdtempSync as mkdtempSync2,
   readFileSync as readFileSync33,
@@ -30158,8 +30319,8 @@ import {
   unlinkSync as unlinkSync5,
   rmSync as rmSync15
 } from "node:fs";
-import { homedir as homedir29, tmpdir as tmpdir3, userInfo as userInfo2 } from "node:os";
-import { resolve as resolve27 } from "node:path";
+import { homedir as homedir30, tmpdir as tmpdir3, userInfo as userInfo2 } from "node:os";
+import { resolve as resolve28 } from "node:path";
 import { execFileSync as execFileSync3 } from "node:child_process";
 function isDaemonSupportedPlatform2() {
   return process.platform === "linux" || process.platform === "darwin";
@@ -30175,13 +30336,13 @@ function resolveFailproofaidBinaryPath2() {
   if (process.env.FAILPROOFAI_DAEMON_BINARY)
     return process.env.FAILPROOFAI_DAEMON_BINARY;
   const downloaded = installedBinaryPath();
-  if (existsSync40(downloaded))
+  if (existsSync41(downloaded))
     return downloaded;
   const packageRoot = process.env.FAILPROOFAI_PACKAGE_ROOT;
   if (packageRoot) {
     for (const profile of ["release", "debug"]) {
-      const candidate = resolve27(packageRoot, "target", profile, "failproofaid");
-      if (existsSync40(candidate))
+      const candidate = resolve28(packageRoot, "target", profile, "failproofaid");
+      if (existsSync41(candidate))
         return candidate;
     }
   }
@@ -30211,8 +30372,8 @@ function resolveWorkerCommand2() {
   const packageRoot = process.env.FAILPROOFAI_PACKAGE_ROOT;
   if (!packageRoot)
     return null;
-  const workerScript = resolve27(packageRoot, "dist", "worker.mjs");
-  if (!existsSync40(workerScript))
+  const workerScript = resolve28(packageRoot, "dist", "worker.mjs");
+  if (!existsSync41(workerScript))
     return null;
   return `${shellQuote2(process.execPath)} ${shellQuote2(workerScript)}`;
 }
@@ -30222,8 +30383,8 @@ function resolveCliCommand2() {
   const packageRoot = process.env.FAILPROOFAI_PACKAGE_ROOT;
   if (!packageRoot)
     return null;
-  const cliScript = resolve27(packageRoot, "dist", "cli.mjs");
-  if (!existsSync40(cliScript))
+  const cliScript = resolve28(packageRoot, "dist", "cli.mjs");
+  if (!existsSync41(cliScript))
     return null;
   return `${shellQuote2(process.execPath)} ${shellQuote2(cliScript)}`;
 }
@@ -30236,8 +30397,8 @@ function workerScriptPath2() {
   const packageRoot = process.env.FAILPROOFAI_PACKAGE_ROOT;
   if (!packageRoot)
     return null;
-  const workerScript = resolve27(packageRoot, "dist", "worker.mjs");
-  return existsSync40(workerScript) ? workerScript : null;
+  const workerScript = resolve28(packageRoot, "dist", "worker.mjs");
+  return existsSync41(workerScript) ? workerScript : null;
 }
 function assertUnitSafe2(value, field) {
   if (UNIT_UNSAFE_RE2.test(value)) {
@@ -30263,10 +30424,10 @@ function systemdUnitDir2() {
   return process.env.FAILPROOFAI_SYSTEMD_DIR || "/etc/systemd/system";
 }
 function systemdUnitPath2(user = serviceUser2()) {
-  return resolve27(systemdUnitDir2(), systemdUnitName2(user));
+  return resolve28(systemdUnitDir2(), systemdUnitName2(user));
 }
 function legacySystemdUserUnitPath2() {
-  return resolve27(homedir29(), ".config", "systemd", "user", "failproofaid.service");
+  return resolve28(homedir30(), ".config", "systemd", "user", "failproofaid.service");
 }
 function launchdLabel2(user = serviceUser2()) {
   return `ai.failproof.failproofaid.${user}`;
@@ -30275,7 +30436,7 @@ function launchdPlistPath2(user = serviceUser2()) {
   return `/Library/LaunchDaemons/${launchdLabel2(user)}.plist`;
 }
 function legacyLaunchAgentPlistPath2() {
-  return resolve27(homedir29(), "Library", "LaunchAgents", "ai.failproof.failproofaid.plist");
+  return resolve28(homedir30(), "Library", "LaunchAgents", "ai.failproof.failproofaid.plist");
 }
 function legacySharedLaunchDaemonPath2() {
   return "/Library/LaunchDaemons/ai.failproof.failproofaid.plist";
@@ -30313,8 +30474,8 @@ function runPrivileged2(command, args) {
   execFileSync3(cmd, argv, { stdio: "ignore", timeout: SERVICE_CMD_TIMEOUT_MS2 });
 }
 function writePrivilegedFile2(destination, contents, mode = "0644") {
-  const stagingDir = mkdtempSync2(resolve27(tmpdir3(), "failproofaid-stage-"));
-  const staging = resolve27(stagingDir, "service-definition");
+  const stagingDir = mkdtempSync2(resolve28(tmpdir3(), "failproofaid-stage-"));
+  const staging = resolve28(stagingDir, "service-definition");
   try {
     writeFileSync24(staging, contents, "utf8");
     runPrivileged2("install", ["-m", mode, staging, destination]);
@@ -30326,7 +30487,7 @@ function removeLegacyUserService2() {
   try {
     if (process.platform === "linux") {
       const legacy = legacySystemdUserUnitPath2();
-      if (!existsSync40(legacy))
+      if (!existsSync41(legacy))
         return;
       try {
         execFileSync3("systemctl", ["--user", "disable", "--now", "failproofaid.service"], {
@@ -30343,7 +30504,7 @@ function removeLegacyUserService2() {
       } catch {}
     } else {
       const legacyAgent = legacyLaunchAgentPlistPath2();
-      if (existsSync40(legacyAgent)) {
+      if (existsSync41(legacyAgent)) {
         try {
           execFileSync3("launchctl", ["unload", "-w", legacyAgent], {
             stdio: "ignore",
@@ -30353,7 +30514,7 @@ function removeLegacyUserService2() {
         unlinkSync5(legacyAgent);
       }
       const legacyDaemon = legacySharedLaunchDaemonPath2();
-      if (existsSync40(legacyDaemon)) {
+      if (existsSync41(legacyDaemon)) {
         try {
           runPrivileged2("launchctl", ["unload", "-w", legacyDaemon]);
         } catch {}
@@ -30369,8 +30530,8 @@ function systemdUnitContents2(binaryPath, workerCmd, cliCmd = null) {
 `).join("");
   const user = assertUnitSafe2(serviceUser2(), "User");
   assertUnitSafe2(binaryPath, "ExecStart");
-  assertUnitSafe2(homedir29(), "HOME");
-  const conditionPaths = [binaryPath, workerScriptPath2()].filter((p) => typeof p === "string" && existsSync40(p));
+  assertUnitSafe2(homedir30(), "HOME");
+  const conditionPaths = [binaryPath, workerScriptPath2()].filter((p) => typeof p === "string" && existsSync41(p));
   const conditionLines = conditionPaths.map((p) => `ConditionPathExists=${assertUnitSafe2(p, "ConditionPathExists")}
 `).join("");
   return `[Unit]
@@ -30383,7 +30544,7 @@ User=${user}
 # Set explicitly rather than relying on systemd deriving it from User=:
 # failproofaid stores per-user state and refuses to start without HOME, so this
 # required variable is not left to a version-dependent default.
-Environment="HOME=${homedir29()}"
+Environment="HOME=${homedir30()}"
 ${envLines}ExecStart=${binaryPath}
 Restart=on-failure
 RestartSec=2
@@ -30428,9 +30589,9 @@ ${env.map(([key, value]) => `        <key>${key}</key>
     <key>UserName</key>
     <string>${escapeXml2(serviceUser2())}</string>
 ${envBlock}    <key>StandardOutPath</key>
-    <string>${escapeXml2(resolve27(logDir, "failproofaid.log"))}</string>
+    <string>${escapeXml2(resolve28(logDir, "failproofaid.log"))}</string>
     <key>StandardErrorPath</key>
-    <string>${escapeXml2(resolve27(logDir, "failproofaid.err.log"))}</string>
+    <string>${escapeXml2(resolve28(logDir, "failproofaid.err.log"))}</string>
 </dict>
 </plist>
 `;
@@ -30575,7 +30736,7 @@ function daemonServiceStatus2() {
   if (!isDaemonSupportedPlatform2())
     return "unsupported-platform";
   if (process.platform === "linux") {
-    if (!existsSync40(systemdUnitPath2()))
+    if (!existsSync41(systemdUnitPath2()))
       return "not-installed";
     try {
       const out = execFileSync3("systemctl", ["is-active", systemdUnitName2()], {
@@ -30588,7 +30749,7 @@ function daemonServiceStatus2() {
     }
   }
   const plistPath = launchdPlistPath2();
-  if (!existsSync40(plistPath))
+  if (!existsSync41(plistPath))
     return "not-installed";
   try {
     const root = typeof process.getuid === "function" && process.getuid() === 0;
@@ -30618,7 +30779,7 @@ var init_daemon_service2 = __esm(() => {
 });
 
 // src/hooks/uninstall-cli.ts
-import { existsSync as existsSync41, rmSync as rmSync16 } from "node:fs";
+import { existsSync as existsSync42, rmSync as rmSync16 } from "node:fs";
 function survey(cwd) {
   const clis = [];
   for (const id of listInstallableIds()) {
@@ -30639,9 +30800,9 @@ function survey(cwd) {
   return {
     clis,
     servicePath,
-    serviceInstalled: !!servicePath && existsSync41(servicePath),
+    serviceInstalled: !!servicePath && existsSync42(servicePath),
     daemonConfigured,
-    homeExists: existsSync41(failproofaiHome())
+    homeExists: existsSync42(failproofaiHome())
   };
 }
 async function runUninstallCommand(opts = {}) {
@@ -30739,7 +30900,7 @@ async function runUninstallCommand(opts = {}) {
       } catch {}
       try {
         await uninstallDaemonService();
-        if (found.servicePath && existsSync41(found.servicePath)) {
+        if (found.servicePath && existsSync42(found.servicePath)) {
           failures.push(`the service at ${found.servicePath} is still there (most often: no sudo). ` + `Remove it with the commands below.`);
         } else {
           lines.push(`✓ stopped and removed the daemon service`);
@@ -30762,7 +30923,7 @@ async function runUninstallCommand(opts = {}) {
     lines.push(``, `Not everything could be removed:`);
     for (const f of failures)
       lines.push(`  ✗ ${f}`);
-    if (found.servicePath && existsSync41(found.servicePath)) {
+    if (found.servicePath && existsSync42(found.servicePath)) {
       lines.push(``, `To remove the service by hand:`, ...manualServiceRemoval(found.servicePath), ``, `(\`${daemonStatusCommand()}\` shows its current state.)`);
     }
     return { exitCode: 1, lines, planLines, purged };
@@ -30794,10 +30955,10 @@ var init_uninstall_cli = __esm(() => {
 
 // src/hooks/pack-cli.ts
 import { execFileSync as execFileSync4 } from "node:child_process";
-import { homedir as homedir30, tmpdir as tmpdir4 } from "node:os";
+import { homedir as homedir31, tmpdir as tmpdir4 } from "node:os";
 import { createHash as createHash9 } from "node:crypto";
-import { copyFileSync as copyFileSync4, existsSync as existsSync42, mkdirSync as mkdirSync27, mkdtempSync as mkdtempSync3, readFileSync as readFileSync34, readdirSync as readdirSync20, realpathSync as realpathSync3, rmSync as rmSync17, statSync as statSync25, writeFileSync as writeFileSync25 } from "node:fs";
-import { basename as basename8, dirname as dirname20, isAbsolute as isAbsolute4, join as join39, relative as relative5, resolve as resolve28, sep as sep6 } from "node:path";
+import { copyFileSync as copyFileSync4, existsSync as existsSync43, mkdirSync as mkdirSync27, mkdtempSync as mkdtempSync3, readFileSync as readFileSync34, readdirSync as readdirSync21, realpathSync as realpathSync3, rmSync as rmSync17, statSync as statSync26, writeFileSync as writeFileSync25 } from "node:fs";
+import { basename as basename9, dirname as dirname21, isAbsolute as isAbsolute4, join as join40, relative as relative5, resolve as resolve29, sep as sep6 } from "node:path";
 function parseList(rest, flag) {
   const idx = rest.findIndex((a) => a === flag || a.startsWith(`${flag}=`));
   if (idx === -1)
@@ -30897,7 +31058,7 @@ async function build(rest) {
   const version = flag("version");
   const commit = flag("commit");
   const effect = flag("effect") ?? "enforce";
-  const outDir = resolve28(flag("out") ?? "dist-pack");
+  const outDir = resolve29(flag("out") ?? "dist-pack");
   if (!entry || !id || !version) {
     return fail2([
       "Usage: failproofai publish <entry.mjs> --repo <owner>/<repo> --version <version>",
@@ -30910,8 +31071,8 @@ async function build(rest) {
   } catch (err) {
     return fail2([err instanceof Error ? err.message : String(err)]);
   }
-  const entryPath = resolve28(entry);
-  if (!existsSync42(entryPath))
+  const entryPath = resolve29(entry);
+  if (!existsSync43(entryPath))
     return fail2([`No such file: ${entryPath}`]);
   const source = readFileSync34(entryPath, "utf8");
   const localImport = /(?:^|\n)\s*(?:import|export)[^;\n]*from\s+["'](\.[^"']*)["']/.exec(source);
@@ -30970,12 +31131,12 @@ async function build(rest) {
   }, null, 2) + `
 `;
   mkdirSync27(outDir, { recursive: true });
-  const manifestPath = resolve28(outDir, PACK_MANIFEST_ASSET);
-  const entryOut = resolve28(outDir, PACK_ENTRY_ASSET);
+  const manifestPath = resolve29(outDir, PACK_MANIFEST_ASSET);
+  const entryOut = resolve29(outDir, PACK_ENTRY_ASSET);
   writeFileSync25(manifestPath, manifest, "utf8");
   copyFileSync4(entryPath, entryOut);
   const sha = (bytes) => createHash9("sha256").update(bytes).digest("hex");
-  writeFileSync25(resolve28(outDir, PACK_CHECKSUMS_ASSET), `${sha(manifest)}  ${PACK_MANIFEST_ASSET}
+  writeFileSync25(resolve29(outDir, PACK_CHECKSUMS_ASSET), `${sha(manifest)}  ${PACK_MANIFEST_ASSET}
 ${sha(readFileSync34(entryOut))}  ${PACK_ENTRY_ASSET}
 `, "utf8");
   const on = policies.filter((p) => p.defaultEnabled).length;
@@ -31105,11 +31266,11 @@ async function scaffold(target) {
       return ok2(["Nothing written."]);
     chosen = answer.trim();
   }
-  const path = resolve28(withPolicyExtension(chosen ?? "my-policies"));
-  if (existsSync42(path)) {
+  const path = resolve29(withPolicyExtension(chosen ?? "my-policies"));
+  if (existsSync43(path)) {
     return fail2([`${path} already exists — name a different file, or edit that one.`]);
   }
-  mkdirSync27(resolve28(path, ".."), { recursive: true });
+  mkdirSync27(resolve29(path, ".."), { recursive: true });
   writeFileSync25(path, `import { customPolicies, allow, deny } from "failproofai";
 
 // One file, no relative imports: only this entry is digest-pinned, so a pack
@@ -31147,7 +31308,7 @@ customPolicies.add({
 function inferRepo(entryPath) {
   try {
     const url = execFileSync4("git", ["remote", "get-url", "origin"], {
-      cwd: resolve28(entryPath, ".."),
+      cwd: resolve29(entryPath, ".."),
       encoding: "utf8",
       stdio: ["ignore", "pipe", "ignore"],
       timeout: 5000
@@ -31159,7 +31320,7 @@ function inferRepo(entryPath) {
   }
 }
 function inferCommit(entryPath, outDir, sources) {
-  const cwd = resolve28(entryPath, "..");
+  const cwd = resolve29(entryPath, "..");
   const raw = (args) => {
     try {
       return execFileSync4("git", args, {
@@ -31214,9 +31375,9 @@ function realOrSelf(path) {
   }
 }
 function sourcesInHead(git, raw, sources) {
-  const paths = sources.map((f) => realOrSelf(resolve28(f)));
+  const paths = sources.map((f) => realOrSelf(resolve29(f)));
   const shown = git(["rev-parse", "--show-toplevel"]);
-  const top = shown === null ? null : realOrSelf(resolve28(shown));
+  const top = shown === null ? null : realOrSelf(resolve29(shown));
   const missing = [];
   for (const path of paths) {
     const rel = top ? relative5(top, path) : null;
@@ -31240,7 +31401,7 @@ function sourcesInHead(git, raw, sources) {
   ]);
   if (status === null)
     return { ok: false, offending: paths, why: "modified" };
-  const dirty = porcelainEntries(status).flatMap((entry) => [entry.path, entry.from].filter(Boolean).map((path) => resolve28(top ?? ".", path)));
+  const dirty = porcelainEntries(status).flatMap((entry) => [entry.path, entry.from].filter(Boolean).map((path) => resolve29(top ?? ".", path)));
   if (dirty.length > 0)
     return { ok: false, offending: dirty, why: "modified" };
   return { ok: true };
@@ -31248,19 +31409,19 @@ function sourcesInHead(git, raw, sources) {
 function skipOutDir(git, entryPath, outDir) {
   if (!outDir)
     return [];
-  const out = resolve28(outDir);
-  if (resolve28(entryPath).startsWith(out + sep6))
+  const out = resolve29(outDir);
+  if (resolve29(entryPath).startsWith(out + sep6))
     return [];
   const top = git(["rev-parse", "--show-toplevel"]);
   if (!top)
     return [];
-  const rel = relative5(resolve28(top), out);
+  const rel = relative5(resolve29(top), out);
   if (!rel || rel.startsWith("..") || isAbsolute4(rel))
     return [];
   return ["--", ":(top)", `:(exclude,literal,top)${rel.split(sep6).join("/")}`];
 }
 function inferTaggedVersion(entryPath, sources) {
-  const cwd = resolve28(entryPath, "..");
+  const cwd = resolve29(entryPath, "..");
   const raw = (args) => {
     try {
       return execFileSync4("git", args, {
@@ -31290,7 +31451,7 @@ function inferTaggedVersion(entryPath, sources) {
 function findEntry(dir) {
   let names;
   try {
-    names = readdirSync20(dir);
+    names = readdirSync21(dir);
   } catch {
     return [];
   }
@@ -31298,9 +31459,9 @@ function findEntry(dir) {
   for (const name of names) {
     if (!/\.(mjs|js|ts)$/.test(name))
       continue;
-    const full = resolve28(dir, name);
+    const full = resolve29(dir, name);
     try {
-      if (statSync25(full).size > 512 * 1024)
+      if (statSync26(full).size > 512 * 1024)
         continue;
       const text = readFileSync34(full, "utf8");
       if (/from\s+["']failproofai["']/.test(text) && /customPolicies\s*\.\s*add\s*\(/.test(text)) {
@@ -31313,13 +31474,13 @@ function findEntry(dir) {
   return found.sort();
 }
 function withLocalImports(sources) {
-  const seen = new Set(sources.map((f) => resolve28(f)));
+  const seen = new Set(sources.map((f) => resolve29(f)));
   const queue = [...seen];
   while (queue.length > 0 && seen.size < 500) {
     const file = queue.shift();
     let text;
     try {
-      if (statSync25(file).size > 512 * 1024)
+      if (statSync26(file).size > 512 * 1024)
         continue;
       text = readFileSync34(file, "utf8");
     } catch {
@@ -31327,13 +31488,13 @@ function withLocalImports(sources) {
     }
     for (const re of LOCAL_IMPORT_RES) {
       for (const match of text.matchAll(re)) {
-        const base = resolve28(dirname20(file), match[1]);
+        const base = resolve29(dirname21(file), match[1]);
         for (const ext of LOCAL_IMPORT_EXTENSIONS) {
           const candidate = base + ext;
           if (seen.has(candidate))
             break;
           try {
-            if (!statSync25(candidate).isFile())
+            if (!statSync26(candidate).isFile())
               continue;
           } catch {
             continue;
@@ -31348,7 +31509,7 @@ function withLocalImports(sources) {
   return [...seen];
 }
 function settleGitState(entryPath, provenance, packFiles, id, outDir) {
-  const cwd = resolve28(entryPath, "..");
+  const cwd = resolve29(entryPath, "..");
   const raw = (args) => {
     try {
       return execFileSync4("git", args, {
@@ -31423,11 +31584,11 @@ function settleGitState(entryPath, provenance, packFiles, id, outDir) {
   if (root === null || status === null)
     return null;
   const entries = porcelainEntries(status);
-  const dirty = entries.map((entry) => resolve28(root, entry.path));
-  const renamedFrom = entries.filter((entry) => entry.from).map((entry) => resolve28(root, entry.from));
+  const dirty = entries.map((entry) => resolve29(root, entry.path));
+  const renamedFrom = entries.filter((entry) => entry.from).map((entry) => resolve29(root, entry.from));
   if (dirty.length === 0)
     return null;
-  const mine = new Set(packFiles.map((f) => resolve28(f)));
+  const mine = new Set(packFiles.map((f) => resolve29(f)));
   const foreign = dirty.filter((path) => !mine.has(path));
   const toStage = [...dirty, ...renamedFrom];
   if (foreign.length > 0) {
@@ -31558,7 +31719,7 @@ function pushExistingHistory(dir, owner, name, token) {
   const branch = git(["rev-parse", "--abbrev-ref", "HEAD"]);
   if (!branch || branch === "HEAD" || !git(["rev-parse", "--verify", "HEAD"]))
     return false;
-  const askpass = join39(mkdtempSync3(join39(tmpdir4(), "fpai-askpass-")), "askpass.sh");
+  const askpass = join40(mkdtempSync3(join40(tmpdir4(), "fpai-askpass-")), "askpass.sh");
   try {
     writeFileSync25(askpass, `#!/bin/sh
 case "$1" in
@@ -31580,7 +31741,7 @@ esac
     return true;
   } finally {
     try {
-      rmSync17(dirname20(askpass), { recursive: true, force: true });
+      rmSync17(dirname21(askpass), { recursive: true, force: true });
     } catch {}
   }
 }
@@ -31604,8 +31765,8 @@ failproofai policies add ${owner}/${name}
 function findBun() {
   const candidates = [
     "bun",
-    process.env.BUN_INSTALL ? resolve28(process.env.BUN_INSTALL, "bin", "bun") : null,
-    resolve28(homedir30(), ".bun", "bin", "bun"),
+    process.env.BUN_INSTALL ? resolve29(process.env.BUN_INSTALL, "bin", "bun") : null,
+    resolve29(homedir31(), ".bun", "bin", "bun"),
     "/opt/homebrew/bin/bun",
     "/usr/local/bin/bun"
   ].filter((c) => c !== null);
@@ -31632,11 +31793,11 @@ function bundleEntry(sources, outDir) {
     };
   }
   mkdirSync27(outDir, { recursive: true });
-  const entry = resolve28(outDir, ".entry.generated.mjs");
-  writeFileSync25(entry, sources.map((f) => `import ${JSON.stringify(f.startsWith("/") ? f : resolve28(f))};`).join(`
+  const entry = resolve29(outDir, ".entry.generated.mjs");
+  writeFileSync25(entry, sources.map((f) => `import ${JSON.stringify(f.startsWith("/") ? f : resolve29(f))};`).join(`
 `) + `
 `, "utf8");
-  const bundled = resolve28(outDir, ".bundled.mjs");
+  const bundled = resolve29(outDir, ".bundled.mjs");
   try {
     execFileSync4(bun, [
       "build",
@@ -31749,12 +31910,12 @@ async function publish(rest) {
   if (askingWhere) {
     const found = discovered.length > 0 ? discovered : [entry];
     process.stdout.write(`
-  ${found.length} policy ${found.length === 1 ? "file" : "files"}: ` + `${found.map((f) => basename8(f)).join(", ")}
+  ${found.length} policy ${found.length === 1 ? "file" : "files"}: ` + `${found.map((f) => basename9(f)).join(", ")}
 
 `);
     const token = githubToken();
     const login = token ? await credentialLogin(token) : null;
-    const folder = basename8(resolve28(entry, ".."));
+    const folder = basename9(resolve29(entry, ".."));
     const answered = await askWhereToPublish(`${login ?? "your-account"}/${folder}`, { stdin: process.stdin, stdout: process.stdout });
     if (answered === null)
       return ok2(["Nothing was published."]);
@@ -31765,7 +31926,7 @@ async function publish(rest) {
   let versionFromSha = false;
   const dryRun = rest.includes("--dry-run") || !repo;
   const allowPrivate = rest.includes("--allow-private");
-  const id = flag("id") ?? repo ?? (dryRun && entry ? `local/${basename8(resolve28(entry, ".."))}` : undefined);
+  const id = flag("id") ?? repo ?? (dryRun && entry ? `local/${basename9(resolve29(entry, ".."))}` : undefined);
   const [owner, name] = (repo ?? "/").split("/");
   if (repo && (!owner || !name || repo.split("/").length !== 2)) {
     return fail2([`--repo must be <owner>/<repo>, got ${JSON.stringify(repo)}`]);
@@ -31784,7 +31945,7 @@ async function publish(rest) {
       "With no --repo it writes the three release assets and stops."
     ]);
   }
-  const outDirEarly = resolve28(flag("out") ?? "dist-pack");
+  const outDirEarly = resolve29(flag("out") ?? "dist-pack");
   let provenance = entry ? inferCommit(entry, outDirEarly, bundledSources) : null;
   const gitLines = [];
   if (!version && entry && interactive) {
@@ -31824,7 +31985,7 @@ async function publish(rest) {
         "It needs write access to releases on that repository, and nothing else."
       ]);
     }
-    const ensured = await ensureRepo(owner, name, id, token, resolve28(entry, ".."));
+    const ensured = await ensureRepo(owner, name, id, token, resolve29(entry, ".."));
     if ("error" in ensured)
       return fail2(ensured.error);
     created = ensured.created;
@@ -31923,7 +32084,7 @@ async function publish(rest) {
     if (prior) {
       await gh(`${GITHUB_API2}/repos/${owner}/${name}/releases/assets/${prior.id}`, auth, { method: "DELETE" });
     }
-    const bytes = readFileSync34(resolve28(outDir, asset));
+    const bytes = readFileSync34(resolve29(outDir, asset));
     const upload = await gh(`${GITHUB_UPLOADS2}/repos/${owner}/${name}/releases/${releaseId}/assets?name=${encodeURIComponent(asset)}`, auth, {
       method: "POST",
       contentType: asset.endsWith(".json") ? "application/json" : "application/octet-stream",
@@ -32604,8 +32765,8 @@ var init_install_prompt = __esm(() => {
 
 // src/hooks/manager.ts
 import { execSync as execSync7 } from "node:child_process";
-import { existsSync as existsSync43 } from "node:fs";
-import { resolve as resolve29, basename as basename9 } from "node:path";
+import { existsSync as existsSync44 } from "node:fs";
+import { resolve as resolve30, basename as basename10 } from "node:path";
 import { platform as platform4, arch as arch4, release as release3, hostname as hostname6 } from "node:os";
 function getSettingsPath2(scope, cwd) {
   return claudeCode.getSettingsPath(scope, cwd);
@@ -32824,9 +32985,9 @@ async function installHooksImpl2(policyNames, scope = "user", cwd, includeBeta =
     delete configToWrite.customPoliciesPath;
     delete configToWrite.customPoliciesPaths;
   } else if (customPoliciesPath && (typeof customPoliciesPath === "string" || customPoliciesPath.length > 0)) {
-    const incoming = (typeof customPoliciesPath === "string" ? [customPoliciesPath] : customPoliciesPath).map((path) => resolve29(path));
-    const carried = (previousConfig.customPoliciesPaths ?? (previousConfig.customPoliciesPath ? [previousConfig.customPoliciesPath] : [])).map((path) => resolve29(path)).filter((path) => {
-      if (existsSync43(path))
+    const incoming = (typeof customPoliciesPath === "string" ? [customPoliciesPath] : customPoliciesPath).map((path) => resolve30(path));
+    const carried = (previousConfig.customPoliciesPaths ?? (previousConfig.customPoliciesPath ? [previousConfig.customPoliciesPath] : [])).map((path) => resolve30(path)).filter((path) => {
+      if (existsSync44(path))
         return true;
       console.log(`Dropping custom policies path (file no longer exists): ${path}`);
       return false;
@@ -33049,7 +33210,7 @@ async function removeHooks2(policyNames, scope = "user", cwd, opts) {
     const scopesToRemove = scope === "all" ? [...integration.scopes] : integration.scopes.includes(scope) ? [scope] : [];
     for (const s of scopesToRemove) {
       const settingsPaths = settingsPathsFor(integration, s, cwd);
-      const existing = settingsPaths.filter((p) => existsSync43(p));
+      const existing = settingsPaths.filter((p) => existsSync44(p));
       if (existing.length === 0) {
         if (scope !== "all" && selectedClis.length === 1) {
           console.log("No settings file found. Nothing to remove.");
@@ -33193,9 +33354,9 @@ async function listHooks(cwd) {
   if (explicitPaths.length > 0) {
     groups.push(rule("Custom Policies", opts));
     for (const path of explicitPaths) {
-      const absPath = resolve29(findProjectConfigDir(cwd ?? process.cwd()), path);
+      const absPath = resolve30(findProjectConfigDir(cwd ?? process.cwd()), path);
       groups.push(note(absPath, opts));
-      if (!existsSync43(absPath)) {
+      if (!existsSync44(absPath)) {
         groups.push(warning([`file not found: ${absPath}`], opts));
         continue;
       }
@@ -33215,7 +33376,7 @@ async function listHooks(cwd) {
     }
   }
   const base = findProjectConfigDir(cwd ?? process.cwd());
-  const projectDir = resolve29(base, ".failproofai", "policies");
+  const projectDir = resolve30(base, ".failproofai", "policies");
   const userDir = customPoliciesDir();
   const sameDir = userDir === projectDir;
   const conventionDirs = [
@@ -33240,7 +33401,7 @@ async function listHooks(cwd) {
     groups.push(note(dir, opts));
     const rows = [];
     for (const file of files) {
-      const filename = basename9(file);
+      const filename = basename10(file);
       try {
         const hooks = await loadCustomHooks(file);
         record(filename, hooks.map((h) => h.name));
@@ -33694,14 +33855,14 @@ var init_schedule_cli = __esm(() => {
 });
 
 // scripts/parse-script-args.ts
-import { resolve as resolve30 } from "path";
+import { resolve as resolve31 } from "path";
 function parseStringFlag(flagName, errorLabel, inlineValue, args, index, options) {
   const raw = inlineValue ?? args[index + 1];
   if (raw === undefined || inlineValue === null && raw.startsWith("-")) {
     console.error(`Error: ${flagName} requires ${errorLabel}`);
     process.exit(1);
   }
-  const value = options?.resolve ? resolve30(raw) : raw;
+  const value = options?.resolve ? resolve31(raw) : raw;
   return { value, spliceCount: inlineValue !== null ? 1 : 2 };
 }
 function parseScriptArgs(argv) {
@@ -33757,26 +33918,26 @@ function parseScriptArgs(argv) {
 var init_parse_script_args = () => {};
 
 // scripts/install-diagnosis.mjs
-import { existsSync as existsSync44, readFileSync as readFileSync36, realpathSync as realpathSync4 } from "node:fs";
-import { dirname as dirname21, resolve as resolve31 } from "node:path";
-import { homedir as homedir31, platform as platform5 } from "node:os";
+import { existsSync as existsSync45, readFileSync as readFileSync36, realpathSync as realpathSync4 } from "node:fs";
+import { dirname as dirname22, resolve as resolve32 } from "node:path";
+import { homedir as homedir32, platform as platform5 } from "node:os";
 import { spawnSync } from "node:child_process";
 function findPackageRoot(start) {
   try {
     let dir = realpathSync4(start);
-    if (existsSync44(dir) && !existsSync44(resolve31(dir, "package.json"))) {
-      dir = dirname21(dir);
+    if (existsSync45(dir) && !existsSync45(resolve32(dir, "package.json"))) {
+      dir = dirname22(dir);
     }
     while (true) {
-      const pkgPath = resolve31(dir, "package.json");
-      if (existsSync44(pkgPath)) {
+      const pkgPath = resolve32(dir, "package.json");
+      if (existsSync45(pkgPath)) {
         try {
           const pkg = JSON.parse(readFileSync36(pkgPath, "utf8"));
           if (pkg.name === PKG_NAME)
             return dir;
         } catch {}
       }
-      const parent = dirname21(dir);
+      const parent = dirname22(dir);
       if (parent === dir)
         return null;
       dir = parent;
@@ -33789,7 +33950,7 @@ function readPackageVersion(packageRoot) {
   if (!packageRoot)
     return null;
   try {
-    const pkg = JSON.parse(readFileSync36(resolve31(packageRoot, "package.json"), "utf8"));
+    const pkg = JSON.parse(readFileSync36(resolve32(packageRoot, "package.json"), "utf8"));
     return typeof pkg.version === "string" ? pkg.version : null;
   } catch {
     return null;
@@ -33815,16 +33976,16 @@ function locateNpmGlobal() {
     const root = (res.stdout || "").trim();
     if (!root)
       return null;
-    const candidate = resolve31(root, PKG_NAME);
-    return existsSync44(resolve31(candidate, "package.json")) ? candidate : null;
+    const candidate = resolve32(root, PKG_NAME);
+    return existsSync45(resolve32(candidate, "package.json")) ? candidate : null;
   } catch {
     return null;
   }
 }
 function locateBunGlobal() {
   try {
-    const candidate = resolve31(homedir31(), ".bun", "install", "global", "node_modules", PKG_NAME);
-    return existsSync44(resolve31(candidate, "package.json")) ? candidate : null;
+    const candidate = resolve32(homedir32(), ".bun", "install", "global", "node_modules", PKG_NAME);
+    return existsSync45(resolve32(candidate, "package.json")) ? candidate : null;
   } catch {
     return null;
   }
@@ -33832,8 +33993,8 @@ function locateBunGlobal() {
 function buildRecommendation(pathFirstBin) {
   if (!pathFirstBin)
     return null;
-  const bunBinPrefix = resolve31(homedir31(), ".bun", "bin") + "/";
-  const bunGlobalPrefix = resolve31(homedir31(), ".bun", "install", "global") + "/";
+  const bunBinPrefix = resolve32(homedir32(), ".bun", "bin") + "/";
+  const bunGlobalPrefix = resolve32(homedir32(), ".bun", "install", "global") + "/";
   const isBun = pathFirstBin.startsWith(bunBinPrefix) || pathFirstBin.startsWith(bunGlobalPrefix);
   if (isBun) {
     return `rm -f ~/.bun/bin/${PKG_NAME} && rm -rf ~/.bun/install/global/node_modules/${PKG_NAME}`;
@@ -33927,8 +34088,8 @@ var init_dashboard_host = __esm(() => {
 
 // scripts/launch.ts
 import { spawn as spawn2 } from "child_process";
-import { realpathSync as realpathSync5, existsSync as existsSync45 } from "node:fs";
-import { resolve as resolve32, dirname as dirname22 } from "node:path";
+import { realpathSync as realpathSync5, existsSync as existsSync46 } from "node:fs";
+import { resolve as resolve33, dirname as dirname23 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 import { createInterface } from "node:readline";
 function launch(mode) {
@@ -33952,9 +34113,9 @@ function launch(mode) {
     process.env.PORT = port;
     process.env.HOSTNAME = bindHost;
     cmd = "node";
-    const packageRoot = process.env.FAILPROOFAI_PACKAGE_ROOT ?? resolve32(dirname22(realpathSync5(fileURLToPath2(import.meta.url))), "..");
-    const serverJsPath = resolve32(packageRoot, ".next/standalone/server.js");
-    if (!existsSync45(serverJsPath)) {
+    const packageRoot = process.env.FAILPROOFAI_PACKAGE_ROOT ?? resolve33(dirname23(realpathSync5(fileURLToPath2(import.meta.url))), "..");
+    const serverJsPath = resolve33(packageRoot, ".next/standalone/server.js");
+    if (!existsSync46(serverJsPath)) {
       let shadowMessage = null;
       try {
         const diag = diagnoseShadow({ selfPackageRoot: packageRoot, selfVersion: version2 });
@@ -34709,8 +34870,8 @@ var init_session_pause_cli = __esm(() => {
 
 // scripts/launch.ts
 import { spawn as spawn3 } from "child_process";
-import { realpathSync as realpathSync6, existsSync as existsSync46 } from "node:fs";
-import { resolve as resolve33, dirname as dirname23 } from "node:path";
+import { realpathSync as realpathSync6, existsSync as existsSync47 } from "node:fs";
+import { resolve as resolve34, dirname as dirname24 } from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 import { createInterface as createInterface2 } from "node:readline";
 function launch2(mode) {
@@ -34734,9 +34895,9 @@ function launch2(mode) {
     process.env.PORT = port;
     process.env.HOSTNAME = bindHost;
     cmd = "node";
-    const packageRoot = process.env.FAILPROOFAI_PACKAGE_ROOT ?? resolve33(dirname23(realpathSync6(fileURLToPath3(import.meta.url))), "..");
-    const serverJsPath = resolve33(packageRoot, ".next/standalone/server.js");
-    if (!existsSync46(serverJsPath)) {
+    const packageRoot = process.env.FAILPROOFAI_PACKAGE_ROOT ?? resolve34(dirname24(realpathSync6(fileURLToPath3(import.meta.url))), "..");
+    const serverJsPath = resolve34(packageRoot, ".next/standalone/server.js");
+    if (!existsSync47(serverJsPath)) {
       let shadowMessage = null;
       try {
         const diag = diagnoseShadow({ selfPackageRoot: packageRoot, selfVersion: version2 });
@@ -34833,17 +34994,17 @@ var init_cli_error2 = __esm(() => {
 
 // bin/failproofai.mjs
 import { realpathSync as realpathSync7 } from "fs";
-import { dirname as dirname24, resolve as resolve34 } from "path";
+import { dirname as dirname25, resolve as resolve35 } from "path";
 import { fileURLToPath as fileURLToPath4 } from "url";
 // package.json
-var version = "1.0.5-beta.1";
+var version = "1.0.5";
 
 // bin/failproofai.mjs
 if (!process.env.FAILPROOFAI_PACKAGE_ROOT) {
-  process.env.FAILPROOFAI_PACKAGE_ROOT = resolve34(dirname24(realpathSync7(fileURLToPath4(import.meta.url))), "..");
+  process.env.FAILPROOFAI_PACKAGE_ROOT = resolve35(dirname25(realpathSync7(fileURLToPath4(import.meta.url))), "..");
 }
 if (!process.env.FAILPROOFAI_DIST_PATH) {
-  process.env.FAILPROOFAI_DIST_PATH = resolve34(dirname24(realpathSync7(fileURLToPath4(import.meta.url))), "..", "dist");
+  process.env.FAILPROOFAI_DIST_PATH = resolve35(dirname25(realpathSync7(fileURLToPath4(import.meta.url))), "..", "dist");
 }
 var args = process.argv.slice(2);
 if (args[0] === "p" || args[0] === "policy")