failproofai 1.0.9-beta.0 → 1.0.9-beta.2

package/dist/cli.mjs

@@ -29,7 +29,7 @@ var __esm = (fn, res, err) => () => {
 var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
 // package.json
-var version2 = "1.0.9-beta.0", package_default;
+var version2 = "1.0.9-beta.2", package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "failproofai",
@@ -114,14 +114,14 @@ var init_package = __esm(() => {
       access: "public"
     },
     devDependencies: {
-      "@anthropic-ai/sdk": "^0.127.0",
+      "@anthropic-ai/sdk": "^0.128.0",
       "@mdx-js/mdx": "^3.1.1",
       "@tailwindcss/postcss": "^4.3.1",
       "@tanstack/react-virtual": "^3.14.10",
       "@testing-library/jest-dom": "^7.0.0",
       "@testing-library/react": "^16.3.2",
       "@testing-library/user-event": "^14.6.5",
-      "@types/node": "26.6.1",
+      "@types/node": "26.6.2",
       "@types/react": "19.3.0",
       "@types/react-dom": "^19.2.3",
       "@vitejs/plugin-react": "^6.1.0",
@@ -155,16 +155,16 @@ var init_package = __esm(() => {
       browserslist: "4.28.8"
     },
     optionalDependencies: {
-      "@failproofai/failproofaid-linux-x64": "1.0.9-beta.0",
-      "@failproofai/failproofaid-linux-arm64": "1.0.9-beta.0",
-      "@failproofai/failproofaid-darwin-x64": "1.0.9-beta.0",
-      "@failproofai/failproofaid-darwin-arm64": "1.0.9-beta.0"
+      "@failproofai/failproofaid-linux-x64": "1.0.9-beta.2",
+      "@failproofai/failproofaid-linux-arm64": "1.0.9-beta.2",
+      "@failproofai/failproofaid-darwin-x64": "1.0.9-beta.2",
+      "@failproofai/failproofaid-darwin-arm64": "1.0.9-beta.2"
     },
     failproofaidBinaries: {
-      "linux-x64": "044b6619007227b8aa1fc1095b8c61a17bd90e11da53183ac1f5adecdcae6839",
-      "linux-arm64": "479450d7d15c52a59bd1a8cf4c7086be9210e8d31ad4f98d99b123f571e944bd",
-      "darwin-x64": "11562912ff726195bfb966ed24a774ffea38d01acc3edc1f9bfa3ea9c298977f",
-      "darwin-arm64": "5bbaee1ec89d2d8032b7f16e502fb96891fbc6aa2ee6c861f43a64a0a60e61ba"
+      "linux-x64": "cd0a7124ae94ae78753cda6ffad985ba30be80443d8bc93d617ce507ba04e211",
+      "linux-arm64": "925446186bbfa827275356a9dc80b7d5351a6dcce9d926731419bbd91c1f98ba",
+      "darwin-x64": "cd35a6549f402b6c04848772074edb110a54a242fe7488792e59f8e8a00af475",
+      "darwin-arm64": "587b045accada4947a556e1bc1d748780a846c2ef95cf8dafb973a23fdbcb173"
     }
   };
 });
@@ -820,8 +820,11 @@ function sanitizeJevActivity(entry) {
     drop("evaluator");
   if (!(typeof out.jevDecision === "string" && DECISIONS.has(out.jevDecision)))
     drop("jevDecision");
+  const unknownMode = out.jevMode !== undefined && !(typeof out.jevMode === "string" && MODES.has(out.jevMode));
   if (!(typeof out.jevMode === "string" && MODES.has(out.jevMode)))
     drop("jevMode");
+  if (unknownMode)
+    drop("jevCleared");
   if (Array.isArray(out.jevCleared)) {
     const names = [
       ...new Set(out.jevCleared.filter(isJevPolicyName))
@@ -12489,24 +12492,95 @@ var init_dist = __esm(() => {
   $visitAsync = visit.visitAsync;
 });
 
+// src/hooks/safe-config-write.ts
+import {
+  chmodSync as chmodSync2,
+  closeSync as closeSync2,
+  copyFileSync,
+  existsSync as existsSync7,
+  fsyncSync,
+  lstatSync,
+  mkdirSync as mkdirSync4,
+  openSync as openSync2,
+  realpathSync as realpathSync2,
+  renameSync as renameSync2,
+  rmSync as rmSync2,
+  statSync as statSync5,
+  writeSync
+} from "node:fs";
+import { randomBytes } from "node:crypto";
+import { basename, dirname as dirname3, join as join3 } from "node:path";
+function resolveWriteTarget(path) {
+  try {
+    if (lstatSync(path).isSymbolicLink())
+      return realpathSync2(path);
+  } catch {}
+  return path;
+}
+function writeConfigFileAtomic(path, content, deps = {}) {
+  const target = resolveWriteTarget(path);
+  const dir = dirname3(target);
+  mkdirSync4(dir, { recursive: true });
+  let mode;
+  try {
+    mode = statSync5(target).mode & 511;
+  } catch {
+    mode = undefined;
+  }
+  const temporary = join3(dir, `.${basename(target)}.failproofai-${process.pid}-${randomBytes(4).toString("hex")}.tmp`);
+  let fd;
+  try {
+    fd = openSync2(temporary, "wx", mode ?? 438);
+    const bytes = Buffer.from(content, "utf8");
+    let written = 0;
+    while (written < bytes.length)
+      written += writeSync(fd, bytes, written, bytes.length - written);
+    fsyncSync(fd);
+    closeSync2(fd);
+    fd = undefined;
+    if (mode !== undefined)
+      chmodSync2(temporary, mode);
+    if (existsSync7(target))
+      copyFileSync(target, `${target}.failproofai-backup`);
+    (deps.rename ?? renameSync2)(temporary, target);
+  } catch (err) {
+    if (fd !== undefined) {
+      try {
+        closeSync2(fd);
+      } catch {}
+    }
+    rmSync2(temporary, { force: true });
+    throw err;
+  }
+  try {
+    const dirFd = openSync2(dir, "r");
+    try {
+      fsyncSync(dirFd);
+    } finally {
+      closeSync2(dirFd);
+    }
+  } catch {}
+}
+var init_safe_config_write = () => {};
+
 // lib/hermes-profiles.ts
-import { existsSync as existsSync7, readdirSync } from "node:fs";
+import { existsSync as existsSync8, readdirSync } from "node:fs";
 import { homedir as homedir4 } from "node:os";
-import { basename, dirname as dirname3, join as join3, resolve as resolve6 } from "node:path";
+import { basename as basename2, dirname as dirname4, join as join4, resolve as resolve6 } from "node:path";
 function hermesRoot() {
   const env = (process.env.HERMES_HOME || "").trim();
   if (env) {
     let home = resolve6(env);
-    const parent = dirname3(home);
-    if (basename(parent) === PROFILES_DIR)
-      home = dirname3(parent);
-    const base = basename(home);
+    const parent = dirname4(home);
+    if (basename2(parent) === PROFILES_DIR)
+      home = dirname4(parent);
+    const base = basename2(home);
     if (base === STANDARD_HOME || base.startsWith(SIBLING_HOME_PREFIX)) {
-      return join3(dirname3(home), STANDARD_HOME);
+      return join4(dirname4(home), STANDARD_HOME);
     }
     return home;
   }
-  return join3(homedir4(), STANDARD_HOME);
+  return join4(homedir4(), STANDARD_HOME);
 }
 function uniqueProfileName(preferred, seen) {
   if (!seen.has(preferred))
@@ -12525,22 +12599,22 @@ function listHermesProfiles() {
   const seen = new Set([HERMES_DEFAULT_PROFILE]);
   let names = [];
   try {
-    names = readdirSync(join3(root, PROFILES_DIR), { withFileTypes: true }).filter((e) => (e.isDirectory() || e.isSymbolicLink()) && !e.name.startsWith(".")).map((e) => e.name).sort();
+    names = readdirSync(join4(root, PROFILES_DIR), { withFileTypes: true }).filter((e) => (e.isDirectory() || e.isSymbolicLink()) && !e.name.startsWith(".")).map((e) => e.name).sort();
   } catch {}
   for (const name of names) {
     if (seen.has(name))
       continue;
     seen.add(name);
-    out.push({ name, home: join3(root, PROFILES_DIR, name) });
+    out.push({ name, home: join4(root, PROFILES_DIR, name) });
   }
-  if (basename(root) !== STANDARD_HOME)
+  if (basename2(root) !== STANDARD_HOME)
     return out;
   let siblings = [];
-  const parent = dirname3(root);
+  const parent = dirname4(root);
   try {
-    siblings = readdirSync(parent, { withFileTypes: true }).filter((entry) => (entry.isDirectory() || entry.isSymbolicLink()) && entry.name.startsWith(SIBLING_HOME_PREFIX) && entry.name.length > SIBLING_HOME_PREFIX.length && existsSync7(join3(parent, entry.name, "config.yaml"))).map((entry) => ({
+    siblings = readdirSync(parent, { withFileTypes: true }).filter((entry) => (entry.isDirectory() || entry.isSymbolicLink()) && entry.name.startsWith(SIBLING_HOME_PREFIX) && entry.name.length > SIBLING_HOME_PREFIX.length && existsSync8(join4(parent, entry.name, "config.yaml"))).map((entry) => ({
       name: entry.name.slice(SIBLING_HOME_PREFIX.length),
-      home: join3(parent, entry.name)
+      home: join4(parent, entry.name)
     })).sort((a, b) => a.name.localeCompare(b.name));
   } catch {
     return out;
@@ -12579,9 +12653,9 @@ var PROFILES_DIR = "profiles", STANDARD_HOME = ".hermes", SIBLING_HOME_PREFIX =
 var init_hermes_profiles = () => {};
 
 // lib/openclaw-profiles.ts
-import { existsSync as existsSync8, readdirSync as readdirSync2 } from "node:fs";
+import { existsSync as existsSync9, readdirSync as readdirSync2 } from "node:fs";
 import { homedir as homedir5 } from "node:os";
-import { basename as basename2, dirname as dirname4, join as join4, resolve as resolve7 } from "node:path";
+import { basename as basename3, dirname as dirname5, join as join5, resolve as resolve7 } from "node:path";
 function openclawProfileHome() {
   const stateDir = (process.env.OPENCLAW_STATE_DIR ?? "").trim();
   if (stateDir)
@@ -12591,17 +12665,17 @@ function openclawProfileHome() {
     return resolve7(openclawHome);
   const configPath = (process.env.OPENCLAW_CONFIG_PATH || "").trim();
   if (configPath)
-    return dirname4(resolve7(configPath));
-  return join4(homedir5(), ".openclaw");
+    return dirname5(resolve7(configPath));
+  return join5(homedir5(), ".openclaw");
 }
 function listOpenClawProfiles() {
   const activeHome = openclawProfileHome();
-  const activeBase = basename2(activeHome);
+  const activeBase = basename3(activeHome);
   if (activeBase !== ".openclaw" && !activeBase.startsWith(".openclaw-")) {
     return [{ name: OPENCLAW_DEFAULT_PROFILE, home: activeHome }];
   }
-  const parent = dirname4(activeHome);
-  const defaultHome = join4(parent, ".openclaw");
+  const parent = dirname5(activeHome);
+  const defaultHome = join5(parent, ".openclaw");
   const out = [
     { name: OPENCLAW_DEFAULT_PROFILE, home: defaultHome }
   ];
@@ -12611,9 +12685,9 @@ function listOpenClawProfiles() {
   } catch {
     return out;
   }
-  const named = entries.filter((entry) => (entry.isDirectory() || entry.isSymbolicLink()) && entry.name.startsWith(".openclaw-") && entry.name.length > ".openclaw-".length && existsSync8(join4(parent, entry.name, "openclaw.json"))).map((entry) => ({
+  const named = entries.filter((entry) => (entry.isDirectory() || entry.isSymbolicLink()) && entry.name.startsWith(".openclaw-") && entry.name.length > ".openclaw-".length && existsSync9(join5(parent, entry.name, "openclaw.json"))).map((entry) => ({
     name: entry.name.slice(".openclaw-".length),
-    home: join4(parent, entry.name)
+    home: join5(parent, entry.name)
   })).sort((a, b) => a.name.localeCompare(b.name));
   out.push(...named);
   return out;
@@ -12627,40 +12701,71 @@ import {
   cpSync,
   readFileSync as readFileSync5,
   writeFileSync as writeFileSync3,
-  existsSync as existsSync9,
-  lstatSync,
-  mkdirSync as mkdirSync4,
+  existsSync as existsSync10,
+  lstatSync as lstatSync2,
+  mkdirSync as mkdirSync5,
   readlinkSync,
-  realpathSync as realpathSync2,
-  renameSync as renameSync2,
-  rmSync as rmSync2,
+  realpathSync as realpathSync3,
+  renameSync as renameSync3,
+  rmSync as rmSync3,
   symlinkSync,
   unlinkSync
 } from "node:fs";
-import { resolve as resolve8, dirname as dirname5, basename as basename3 } from "node:path";
+import { resolve as resolve8, dirname as dirname6, basename as basename4 } from "node:path";
 import { fileURLToPath } from "node:url";
 import { homedir as homedir6 } from "node:os";
 function readJsonFile(path) {
-  if (!existsSync9(path))
+  if (!existsSync10(path))
     return {};
-  const raw = readFileSync5(path, "utf8");
-  return JSON.parse(raw);
+  let raw;
+  try {
+    raw = readFileSync5(path, "utf8");
+  } catch (err) {
+    throw new UnreadableAgentConfigError(path, `it could not be read (${err instanceof Error ? err.message : String(err)})`);
+  }
+  if (raw.trim() === "")
+    return {};
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (err) {
+    throw new UnreadableAgentConfigError(path, `it is not valid JSON (${err instanceof Error ? err.message : String(err)})`);
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new UnreadableAgentConfigError(path, "its top level is not a JSON object");
+  }
+  return parsed;
 }
 function writeJsonFile(path, data) {
-  mkdirSync4(dirname5(path), { recursive: true });
-  writeFileSync3(path, JSON.stringify(data, null, 2) + `
-`, "utf8");
+  writeConfigFileAtomic(path, JSON.stringify(data, null, 2) + `
+`);
 }
 function readYamlDoc(path) {
+  if (!existsSync10(path))
+    return $parseDocument("");
+  let text;
   try {
-    return existsSync9(path) ? $parseDocument(readFileSync5(path, "utf8")) : $parseDocument("");
+    text = readFileSync5(path, "utf8");
+  } catch (err) {
+    throw new UnreadableAgentConfigError(path, `it could not be read (${err instanceof Error ? err.message : String(err)})`);
+  }
+  const doc = $parseDocument(text);
+  if (doc.errors.length > 0) {
+    const first = doc.errors[0]?.message.split(`
+`)[0] ?? "syntax error";
+    throw new UnreadableAgentConfigError(path, `it does not parse as YAML (${first})`);
+  }
+  return doc;
+}
+function inspectYamlDoc(path) {
+  try {
+    return readYamlDoc(path);
   } catch {
-    return $parseDocument("");
+    return null;
   }
 }
 function writeYamlDoc(path, doc) {
-  mkdirSync4(dirname5(path), { recursive: true });
-  writeFileSync3(path, doc.toString(), "utf8");
+  writeConfigFileAtomic(path, doc.toString());
 }
 function isMarkedHook(hook) {
   if (!hook || typeof hook !== "object")
@@ -12703,7 +12808,7 @@ function isMarkedCopilotHook(hook) {
   return false;
 }
 function opencodePluginFilePath(settingsPath) {
-  return resolve8(dirname5(settingsPath), "plugins", "failproofai.mjs");
+  return resolve8(dirname6(settingsPath), "plugins", "failproofai.mjs");
 }
 function buildOpenCodePluginShim(binaryPath, scope) {
   const useNpx = scope === "project";
@@ -12942,26 +13047,39 @@ function getHermesPluginSourcePath() {
   const fromEnv = process.env.FAILPROOFAI_PACKAGE_ROOT;
   if (fromEnv)
     return resolve8(fromEnv, HERMES_PLUGIN_SOURCE_DIR);
-  return resolve8(fileURLToPath(import.meta.url), "..", "..", "..", HERMES_PLUGIN_SOURCE_DIR);
+  return findHermesPluginSourcePath(dirname6(fileURLToPath(import.meta.url)));
+}
+function findHermesPluginSourcePath(startDir) {
+  let dir = resolve8(startDir);
+  for (let i = 0;i < 8; i++) {
+    const candidate = resolve8(dir, HERMES_PLUGIN_SOURCE_DIR);
+    if (existsSync10(resolve8(candidate, "plugin.yaml")))
+      return candidate;
+    const parent = dirname6(dir);
+    if (parent === dir)
+      break;
+    dir = parent;
+  }
+  return resolve8(startDir, "..", "..", HERMES_PLUGIN_SOURCE_DIR);
 }
 function hermesPluginPathForSettings(settingsPath) {
-  return resolve8(dirname5(settingsPath), "plugins", HERMES_PLUGIN_ID);
+  return resolve8(dirname6(settingsPath), "plugins", HERMES_PLUGIN_ID);
 }
 function pathPresent(path) {
   try {
-    lstatSync(path);
+    lstatSync2(path);
     return true;
   } catch {
     return false;
   }
 }
 function hasAllHermesPluginFiles(dir) {
-  return HERMES_PLUGIN_FILES.every((file) => existsSync9(resolve8(dir, file)));
+  return HERMES_PLUGIN_FILES.every((file) => existsSync10(resolve8(dir, file)));
 }
 function isFailproofaiHermesPluginSource(dir) {
-  if (basename3(dir) !== HERMES_PLUGIN_SOURCE_DIR)
+  if (basename4(dir) !== HERMES_PLUGIN_SOURCE_DIR)
     return false;
-  if (!existsSync9(dir))
+  if (!existsSync10(dir))
     return true;
   try {
     const manifest = readFileSync5(resolve8(dir, "plugin.yaml"), "utf8");
@@ -12974,7 +13092,7 @@ function samePath(a, b) {
   if (resolve8(a) === resolve8(b))
     return true;
   try {
-    return realpathSync2(a) === realpathSync2(b);
+    return realpathSync3(a) === realpathSync3(b);
   } catch {
     return false;
   }
@@ -12984,7 +13102,7 @@ function hermesPluginState(settingsPath) {
   let isLink;
   let isDirectory;
   try {
-    const stat = lstatSync(pluginPath);
+    const stat = lstatSync2(pluginPath);
     isLink = stat.isSymbolicLink();
     isDirectory = stat.isDirectory();
   } catch {
@@ -12993,7 +13111,7 @@ function hermesPluginState(settingsPath) {
   if (isLink) {
     let target;
     try {
-      target = resolve8(dirname5(pluginPath), readlinkSync(pluginPath));
+      target = resolve8(dirname6(pluginPath), readlinkSync(pluginPath));
     } catch {
       return { kind: "foreign" };
     }
@@ -13006,7 +13124,7 @@ function hermesPluginState(settingsPath) {
       current: samePath(target, getHermesPluginSourcePath())
     };
   }
-  if (isDirectory && existsSync9(resolve8(pluginPath, HERMES_PLUGIN_MARKER))) {
+  if (isDirectory && existsSync10(resolve8(pluginPath, HERMES_PLUGIN_MARKER))) {
     return { kind: "copy", complete: hasAllHermesPluginFiles(pluginPath) };
   }
   return { kind: "foreign" };
@@ -13021,7 +13139,7 @@ function defaultHermesSymlink(target, path) {
 function installHermesPlugin(settingsPath, deps = {}) {
   const source = getHermesPluginSourcePath();
   for (const file of HERMES_PLUGIN_FILES) {
-    if (!existsSync9(resolve8(source, file))) {
+    if (!existsSync10(resolve8(source, file))) {
       throw new Error(`Hermes plugin asset is missing from the failproofai package: ${file}`);
     }
   }
@@ -13032,7 +13150,7 @@ function installHermesPlugin(settingsPath, deps = {}) {
   }
   if (existing.kind === "link" && existing.current)
     return "unchanged";
-  mkdirSync4(dirname5(destination), { recursive: true });
+  mkdirSync5(dirname6(destination), { recursive: true });
   const suffix = `${process.pid}-${Date.now()}`;
   const temporary = `${destination}.install-${suffix}`;
   let linked = false;
@@ -13040,43 +13158,45 @@ function installHermesPlugin(settingsPath, deps = {}) {
     (deps.symlink ?? defaultHermesSymlink)(source, temporary);
     linked = true;
   } catch {
-    rmSync2(temporary, { recursive: true, force: true });
+    rmSync3(temporary, { recursive: true, force: true });
   }
   if (!linked) {
-    mkdirSync4(temporary, { recursive: true });
+    mkdirSync5(temporary, { recursive: true });
     try {
       for (const file of HERMES_PLUGIN_FILES) {
         cpSync(resolve8(source, file), resolve8(temporary, file));
       }
       writeFileSync3(resolve8(temporary, HERMES_PLUGIN_MARKER), "Managed by failproofai. Remove with `failproofai policies --uninstall --cli hermes`.\n", { encoding: "utf8", mode: 384 });
     } catch (err) {
-      rmSync2(temporary, { recursive: true, force: true });
+      rmSync3(temporary, { recursive: true, force: true });
       throw err;
     }
   }
   if (linked && (existing.kind === "absent" || existing.kind === "link")) {
     try {
-      renameSync2(temporary, destination);
+      renameSync3(temporary, destination);
+      return "linked";
     } catch (err) {
-      rmSync2(temporary, { force: true });
-      throw err;
+      if (existing.kind !== "link") {
+        rmSync3(temporary, { force: true });
+        throw err;
+      }
     }
-    return "linked";
   }
   const backup = `${destination}.backup-${suffix}`;
   let movedExisting = false;
   try {
     if (pathPresent(destination)) {
-      renameSync2(destination, backup);
+      renameSync3(destination, backup);
       movedExisting = true;
     }
-    renameSync2(temporary, destination);
+    renameSync3(temporary, destination);
     if (movedExisting)
-      rmSync2(backup, { recursive: true, force: true });
+      rmSync3(backup, { recursive: true, force: true });
   } catch (err) {
-    rmSync2(temporary, { recursive: true, force: true });
+    rmSync3(temporary, { recursive: true, force: true });
     if (movedExisting && !pathPresent(destination) && pathPresent(backup)) {
-      renameSync2(backup, destination);
+      renameSync3(backup, destination);
     }
     throw err;
   }
@@ -13091,7 +13211,7 @@ function removeManagedHermesPlugin(settingsPath) {
   }
   if (state.kind !== "copy")
     return false;
-  rmSync2(pluginPath, { recursive: true, force: true });
+  rmSync3(pluginPath, { recursive: true, force: true });
   return true;
 }
 function removeLegacyHermesHooks(doc) {
@@ -13122,15 +13242,23 @@ function removeLegacyHermesHooks(doc) {
   return removed;
 }
 function hermesConfigState(settingsPath) {
-  if (!existsSync9(settingsPath)) {
-    return { pluginEnabled: false, legacyShellHookPresent: false };
+  if (!existsSync10(settingsPath)) {
+    return { pluginEnabled: false, pluginListed: false, pluginDisabled: false, legacyShellHookPresent: false };
+  }
+  const doc = inspectYamlDoc(settingsPath);
+  if (!doc) {
+    return { pluginEnabled: false, pluginListed: false, pluginDisabled: false, legacyShellHookPresent: false, unreadable: true };
   }
-  const doc = readYamlDoc(settingsPath);
   const js = doc.toJS() ?? {};
   const enabled = js.plugins?.enabled;
+  const disabled = js.plugins?.disabled;
   const legacyShellHookPresent = !!js.hooks && typeof js.hooks === "object" && Object.values(js.hooks).some((entries) => Array.isArray(entries) && entries.some((entry) => isMarkedHook(entry)));
+  const pluginListed = Array.isArray(enabled) && enabled.includes(HERMES_PLUGIN_ID);
+  const pluginDisabled = Array.isArray(disabled) && disabled.includes(HERMES_PLUGIN_ID);
   return {
-    pluginEnabled: Array.isArray(enabled) && enabled.includes(HERMES_PLUGIN_ID),
+    pluginEnabled: pluginListed && !pluginDisabled,
+    pluginListed,
+    pluginDisabled,
     legacyShellHookPresent
   };
 }
@@ -13153,7 +13281,7 @@ async function migrateHermesProfiles(opts) {
   const results = [];
   let daemonOk;
   for (const profile of listHermesProfiles()) {
-    if (!existsSync9(profile.home))
+    if (!existsSync10(profile.home))
       continue;
     const settingsPath = resolve8(profile.home, "config.yaml");
     const pluginPath = hermesPluginPathForSettings(settingsPath);
@@ -13162,7 +13290,23 @@ async function migrateHermesProfiles(opts) {
     const ours = plugin.kind === "link" || plugin.kind === "copy";
     const base = { name: profile.name, home: profile.home };
     const legacy = config.legacyShellHookPresent;
-    if (!legacy && !ours && !config.pluginEnabled) {
+    if (config.unreadable) {
+      let raw = "";
+      try {
+        raw = readFileSync5(settingsPath, "utf8");
+      } catch {
+        raw = "";
+      }
+      const mentionsUs = ours || raw.includes(FAILPROOFAI_HOOK_MARKER) || /failproofai/.test(raw);
+      results.push(mentionsUs ? {
+        ...base,
+        status: "failed",
+        detail: `${settingsPath} does not parse as YAML; left untouched`,
+        legacyShellHooksRemain: /--hook\s+\S+\s+--cli\s+hermes|__failproofai_hook__/.test(raw)
+      } : { ...base, status: "untouched", detail: "no failproofai integration", legacyShellHooksRemain: false });
+      continue;
+    }
+    if (!legacy && !ours && !config.pluginListed && !config.pluginDisabled) {
       results.push({ ...base, status: "untouched", detail: "no failproofai integration", legacyShellHooksRemain: false });
       continue;
     }
@@ -13179,7 +13323,7 @@ async function migrateHermesProfiles(opts) {
       });
       continue;
     }
-    if (existsSync9(settingsPath)) {
+    if (existsSync10(settingsPath)) {
       const errors = $parseDocument(readFileSync5(settingsPath, "utf8")).errors;
       if (errors.length > 0) {
         results.push({
@@ -13258,12 +13402,21 @@ function listInstallableIds() {
 function detectInstalledClis() {
   return INTEGRATION_TYPES.filter((id) => INTEGRATIONS[id]?.detectInstalled());
 }
-var claudeCode, codex, copilot, cursor, OPENCODE_PLUGIN_REL_PATH = "./plugins/failproofai.mjs", opencode, pi, HERMES_PLUGIN_ID = "failproofai", HERMES_PLUGIN_MARKER = ".failproofai-managed", HERMES_PLUGIN_FILES, HERMES_PLUGIN_SOURCE_DIR = "hermes-plugin", hermes, OPENCLAW_PLUGIN_ID = "failproofai", openclaw, factory, devin, ANTIGRAVITY_HOOK_NAME = "failproofai", ANTIGRAVITY_TOOL_EVENTS, antigravity, goose, INTEGRATIONS;
+var UnreadableAgentConfigError, claudeCode, codex, copilot, cursor, OPENCODE_PLUGIN_REL_PATH = "./plugins/failproofai.mjs", opencode, pi, HERMES_PLUGIN_ID = "failproofai", HERMES_PLUGIN_MARKER = ".failproofai-managed", HERMES_PLUGIN_FILES, HERMES_PLUGIN_SOURCE_DIR = "hermes-plugin", hermes, OPENCLAW_PLUGIN_ID = "failproofai", openclaw, factory, devin, ANTIGRAVITY_HOOK_NAME = "failproofai", ANTIGRAVITY_TOOL_EVENTS, antigravity, goose, INTEGRATIONS;
 var init_integrations = __esm(() => {
   init_dist();
+  init_safe_config_write();
   init_hermes_profiles();
   init_openclaw_profiles();
   init_types();
+  UnreadableAgentConfigError = class UnreadableAgentConfigError extends Error {
+    path;
+    constructor(path, reason) {
+      super(`Refusing to modify ${path}: ${reason}. ` + `failproofai never rewrites a config it could not parse — fix or move the file, then retry.`);
+      this.path = path;
+      this.name = "UnreadableAgentConfigError";
+    }
+  };
   claudeCode = {
     id: "claude",
     displayName: "Claude Code",
@@ -13373,7 +13526,7 @@ var init_integrations = __esm(() => {
     },
     hooksInstalledInSettings(scope, cwd) {
       const settingsPath = this.getSettingsPath(scope, cwd);
-      if (!existsSync9(settingsPath))
+      if (!existsSync10(settingsPath))
         return false;
       try {
         const settings = this.readSettings(settingsPath);
@@ -13489,7 +13642,7 @@ var init_integrations = __esm(() => {
     },
     hooksInstalledInSettings(scope, cwd) {
       const settingsPath = this.getSettingsPath(scope, cwd);
-      if (!existsSync9(settingsPath))
+      if (!existsSync10(settingsPath))
         return false;
       try {
         const settings = this.readSettings(settingsPath);
@@ -13603,7 +13756,7 @@ var init_integrations = __esm(() => {
     },
     hooksInstalledInSettings(scope, cwd) {
       const settingsPath = this.getSettingsPath(scope, cwd);
-      if (!existsSync9(settingsPath))
+      if (!existsSync10(settingsPath))
         return false;
       try {
         const settings = this.readSettings(settingsPath);
@@ -13706,7 +13859,7 @@ var init_integrations = __esm(() => {
     },
     hooksInstalledInSettings(scope, cwd) {
       const settingsPath = this.getSettingsPath(scope, cwd);
-      if (!existsSync9(settingsPath))
+      if (!existsSync10(settingsPath))
         return false;
       try {
         const settings = this.readSettings(settingsPath);
@@ -13766,8 +13919,8 @@ var init_integrations = __esm(() => {
       const effectiveScope = scope ?? "project";
       const settingsPath = effectiveScope === "user" ? resolve8(homedir6(), ".config", "opencode", "opencode.json") : resolve8(process.cwd(), ".opencode", "opencode.json");
       const pluginPath = opencodePluginFilePath(settingsPath);
-      mkdirSync4(dirname5(pluginPath), { recursive: true });
-      writeFileSync3(pluginPath, buildOpenCodePluginShim(binaryPath, effectiveScope), "utf8");
+      mkdirSync5(dirname6(pluginPath), { recursive: true });
+      writeConfigFileAtomic(pluginPath, buildOpenCodePluginShim(binaryPath, effectiveScope));
       if (!Array.isArray(s.plugin))
         s.plugin = [];
       const desired = effectiveScope === "user" ? `file://${pluginPath}` : OPENCODE_PLUGIN_REL_PATH;
@@ -13790,7 +13943,7 @@ var init_integrations = __esm(() => {
       }
       this.writeSettings(settingsPath, settings);
       const pluginPath = opencodePluginFilePath(settingsPath);
-      if (existsSync9(pluginPath)) {
+      if (existsSync10(pluginPath)) {
         try {
           const content = readFileSync5(pluginPath, "utf8");
           if (content.includes(FAILPROOFAI_HOOK_MARKER)) {
@@ -13804,7 +13957,7 @@ var init_integrations = __esm(() => {
     },
     hooksInstalledInSettings(scope, cwd) {
       const settingsPath = this.getSettingsPath(scope, cwd);
-      if (!existsSync9(settingsPath))
+      if (!existsSync10(settingsPath))
         return false;
       try {
         const settings = this.readSettings(settingsPath);
@@ -13814,7 +13967,7 @@ var init_integrations = __esm(() => {
         if (!hasEntry)
           return false;
         const pluginPath = opencodePluginFilePath(settingsPath);
-        if (!existsSync9(pluginPath))
+        if (!existsSync10(pluginPath))
           return false;
         const content = readFileSync5(pluginPath, "utf8");
         return content.includes(FAILPROOFAI_HOOK_MARKER);
@@ -13881,7 +14034,7 @@ var init_integrations = __esm(() => {
       }
     },
     removeHooksFromFile(settingsPath) {
-      if (!existsSync9(settingsPath))
+      if (!existsSync10(settingsPath))
         return 0;
       const settings = this.readSettings(settingsPath);
       if (!Array.isArray(settings.packages))
@@ -13896,7 +14049,7 @@ var init_integrations = __esm(() => {
     },
     hooksInstalledInSettings(scope, cwd) {
       const settingsPath = this.getSettingsPath(scope, cwd);
-      if (!existsSync9(settingsPath))
+      if (!existsSync10(settingsPath))
         return false;
       try {
         const settings = this.readSettings(settingsPath);
@@ -14037,7 +14190,7 @@ var init_integrations = __esm(() => {
       hooks.allowConversationAccess = true;
     },
     removeHooksFromFile(settingsPath) {
-      if (!existsSync9(settingsPath))
+      if (!existsSync10(settingsPath))
         return 0;
       const settings = this.readSettings(settingsPath);
       const plugins = settings.plugins;
@@ -14067,7 +14220,7 @@ var init_integrations = __esm(() => {
     hooksInstalledInSettings(scope, cwd) {
       const settingsPaths = settingsPathsFor(this, scope, cwd);
       return settingsPaths.length > 0 && settingsPaths.every((settingsPath) => {
-        if (!existsSync9(settingsPath))
+        if (!existsSync10(settingsPath))
           return false;
         try {
           const settings = this.readSettings(settingsPath);
@@ -14165,7 +14318,7 @@ var init_integrations = __esm(() => {
     },
     hooksInstalledInSettings(scope, cwd) {
       const settingsPath = this.getSettingsPath(scope, cwd);
-      if (!existsSync9(settingsPath))
+      if (!existsSync10(settingsPath))
         return false;
       try {
         const settings = this.readSettings(settingsPath);
@@ -14271,7 +14424,7 @@ var init_integrations = __esm(() => {
     },
     hooksInstalledInSettings(scope, cwd) {
       const settingsPath = this.getSettingsPath(scope, cwd);
-      if (!existsSync9(settingsPath))
+      if (!existsSync10(settingsPath))
         return false;
       try {
         const settings = this.readSettings(settingsPath);
@@ -14410,7 +14563,7 @@ var init_integrations = __esm(() => {
     },
     hooksInstalledInSettings(scope, cwd) {
       const settingsPath = this.getSettingsPath(scope, cwd);
-      if (!existsSync9(settingsPath))
+      if (!existsSync10(settingsPath))
         return false;
       try {
         const settings = this.readSettings(settingsPath);
@@ -14516,7 +14669,7 @@ var init_integrations = __esm(() => {
     },
     hooksInstalledInSettings(scope, cwd) {
       const settingsPath = this.getSettingsPath(scope, cwd);
-      if (!existsSync9(settingsPath))
+      if (!existsSync10(settingsPath))
         return false;
       try {
         const settings = this.readSettings(settingsPath);
@@ -16877,7 +17030,7 @@ var init_custom_hooks_registry = __esm(() => {
 // src/hooks/loader-utils.ts
 import { readFile as readFile2, writeFile as writeFile2, unlink, access, mkdir, lstat } from "fs/promises";
 import { tmpdir } from "os";
-import { resolve as resolve9, dirname as dirname6, relative as relative2, join as join5 } from "path";
+import { resolve as resolve9, dirname as dirname7, relative as relative2, join as join6 } from "path";
 import { pathToFileURL } from "url";
 import { createHash as createHash3 } from "crypto";
 function isTmpArtifact(name) {
@@ -16918,7 +17071,7 @@ async function findDistIndex() {
       return candidate;
   }
   const candidates = [
-    resolve9(dirname6(process.execPath), "..", "assets", "dist", "index.js"),
+    resolve9(dirname7(process.execPath), "..", "assets", "dist", "index.js"),
     resolve9(process.cwd(), "dist", "index.js"),
     resolve9(process.cwd(), "node_modules", "failproofai", "dist", "index.js")
   ];
@@ -16938,7 +17091,7 @@ async function resolveLocalImport(fromDir, specifier) {
   return null;
 }
 async function writeShim(dir, name, code, exclusive) {
-  const shimPath = join5(dir, name);
+  const shimPath = join6(dir, name);
   await writeFile2(shimPath, code, {
     encoding: "utf-8",
     mode: 384,
@@ -17009,7 +17162,7 @@ async function rewriteFileTree(entryPath, distUrl, distIndex, tmpSuffix = TMP_SU
     if (distIndex) {
       code = code.replace(/require\s*\(\s*(['"])(?:claudeye|failproofai)\1\s*\)/g, `require('${distIndex.replace(/\\/g, "\\\\")}')`);
     }
-    const dir = dirname6(filePath);
+    const dir = dirname7(filePath);
     const rewrites = new Map;
     for (const re of [LOCAL_IMPORT_RE, LOCAL_REQUIRE_RE]) {
       const freshRe = new RegExp(re.source, re.flags);
@@ -17230,14 +17383,14 @@ var init_telemetry_id2 = __esm(() => {
 });
 
 // src/hooks/custom-hooks-loader.ts
-import { resolve as resolve10, isAbsolute as isAbsolute2, basename as basename4 } from "node:path";
+import { resolve as resolve10, isAbsolute as isAbsolute2, basename as basename5 } from "node:path";
 import { randomUUID } from "crypto";
-import { existsSync as existsSync10, readdirSync as readdirSync3 } from "node:fs";
+import { existsSync as existsSync11, readdirSync as readdirSync3 } from "node:fs";
 import { readFile as readFile3 } from "node:fs/promises";
 import { pathToFileURL as pathToFileURL2 } from "node:url";
 import { createHash as createHash4 } from "node:crypto";
 function discoverPolicyFiles(dir) {
-  if (!existsSync10(dir))
+  if (!existsSync11(dir))
     return [];
   try {
     const entries = readdirSync3(dir, { withFileTypes: true });
@@ -17247,7 +17400,7 @@ function discoverPolicyFiles(dir) {
   }
 }
 function findSkippedPolicyFiles(dir) {
-  if (!existsSync10(dir))
+  if (!existsSync11(dir))
     return [];
   try {
     return readdirSync3(dir, { withFileTypes: true }).filter((e) => e.isFile() && LOADABLE_EXT_RE.test(e.name) && !CONVENTION_FILE_RE.test(e.name) && !e.name.endsWith(".d.ts") && !isTmpArtifact(e.name)).map((e) => e.name).sort((a, b) => a.localeCompare(b));
@@ -17300,7 +17453,7 @@ async function loadSingleFile(absPath, opts) {
     const ignored = getSemanticRegistrations().slice(semanticBefore).map((d) => d?.name);
     if (opts?.outsidePack && ignored.length > 0 && !warnedSemanticOutsidePack.has(absPath)) {
       warnedSemanticOutsidePack.add(absPath);
-      hookLogWarn(`${basename4(absPath)}: semanticPolicies.add only takes effect in a pack published with \`failproofai publish\`; ` + `${ignored.join(", ")} ${ignored.length === 1 ? "is" : "are"} never asked here`);
+      hookLogWarn(`${basename5(absPath)}: semanticPolicies.add only takes effect in a pack published with \`failproofai publish\`; ` + `${ignored.join(", ")} ${ignored.length === 1 ? "is" : "are"} never asked here`);
     }
     if (policyModuleCache.size >= POLICY_MODULE_CACHE_MAX_ENTRIES)
       policyModuleCache.clear();
@@ -17316,7 +17469,7 @@ async function loadSingleFile(absPath, opts) {
       error_type: errorType,
       is_convention: !!opts?.conventionScope,
       convention_scope: opts?.conventionScope ?? null,
-      file_basename: basename4(absPath)
+      file_basename: basename5(absPath)
     });
     if (opts?.strict)
       throw new Error(`Failed to load custom hooks from ${absPath}: ${msg}`);
@@ -17340,7 +17493,7 @@ async function loadCustomHooks(customPoliciesPath, opts) {
   if (!customPoliciesPath)
     return [];
   const absPath = isAbsolute2(customPoliciesPath) ? customPoliciesPath : resolve10(opts?.sessionCwd ?? process.cwd(), customPoliciesPath);
-  if (!existsSync10(absPath)) {
+  if (!existsSync11(absPath)) {
     if (opts?.strict)
       throw new Error(`Custom hooks file not found: ${absPath}`);
     hookLogWarn(`customPoliciesPath not found: ${absPath}`);
@@ -17455,7 +17608,7 @@ async function loadAllCustomHooks(customPoliciesPaths, opts) {
     const absPath = resolve10(projectRoot, customPoliciesPath);
     const cloudManaged = cloudManagedByPath.get(absPath);
     const pack = packByPath.get(absPath);
-    if (existsSync10(absPath)) {
+    if (existsSync11(absPath)) {
       if (!loadedPaths.has(absPath)) {
         loadedPaths.add(absPath);
         const hooksBefore = getCustomHooks().length;
@@ -17505,12 +17658,12 @@ async function loadAllCustomHooks(customPoliciesPaths, opts) {
     await loadSingleFile(file, { conventionScope: projectScope, outsidePack: true });
     const newHooks = getCustomHooks().slice(hooksBefore);
     for (const hook of newHooks) {
-      hook.__policyId = conventionPolicyId(projectScope, basename4(file), hook.name);
+      hook.__policyId = conventionPolicyId(projectScope, basename5(file), hook.name);
     }
     if (newHooks.length > 0) {
       conventionSources.push({
         scope: projectScope,
-        file: basename4(file),
+        file: basename5(file),
         hookNames: newHooks.map((h) => h.name)
       });
     }
@@ -17527,12 +17680,12 @@ async function loadAllCustomHooks(customPoliciesPaths, opts) {
     await loadSingleFile(file, { conventionScope: "user", outsidePack: true });
     const newHooks = getCustomHooks().slice(hooksBefore);
     for (const hook of newHooks) {
-      hook.__policyId = conventionPolicyId("user", basename4(file), hook.name);
+      hook.__policyId = conventionPolicyId("user", basename5(file), hook.name);
     }
     if (newHooks.length > 0) {
       conventionSources.push({
         scope: "user",
-        file: basename4(file),
+        file: basename5(file),
         hookNames: newHooks.map((h) => h.name)
       });
     }
@@ -18533,8 +18686,8 @@ var init_pack_cli = __esm(() => {
 
 // src/hooks/pack-store.ts
 import { createHash as createHash5 } from "node:crypto";
-import { existsSync as existsSync11, mkdirSync as mkdirSync5, readFileSync as readFileSync6, renameSync as renameSync3, rmSync as rmSync3, writeFileSync as writeFileSync4 } from "node:fs";
-import { dirname as dirname7, resolve as resolve11 } from "node:path";
+import { existsSync as existsSync12, mkdirSync as mkdirSync6, readFileSync as readFileSync6, renameSync as renameSync4, rmSync as rmSync4, writeFileSync as writeFileSync4 } from "node:fs";
+import { dirname as dirname8, resolve as resolve11 } from "node:path";
 function baseUrl() {
   return (process.env.FAILPROOFAI_PACK_BASE_URL || DEFAULT_BASE_URL).replace(/\/+$/, "");
 }
@@ -18705,11 +18858,11 @@ function sha256(bytes) {
 function writeAtomic(target, bytes) {
   const tempPath = `${target}.${process.pid}.tmp`;
   try {
-    mkdirSync5(dirname7(target), { recursive: true });
+    mkdirSync6(dirname8(target), { recursive: true });
     writeFileSync4(tempPath, bytes);
-    renameSync3(tempPath, target);
+    renameSync4(tempPath, target);
   } catch (err) {
-    rmSync3(tempPath, { force: true });
+    rmSync4(tempPath, { force: true });
     throw err;
   }
 }
@@ -18935,7 +19088,7 @@ async function addPack(source, opts) {
   const root = packsRoot();
   const artifactRel = `artifacts/${fetched.artifactDigest}.mjs`;
   const artifactAbs = resolve11(root, artifactRel);
-  if (!existsSync11(artifactAbs))
+  if (!existsSync12(artifactAbs))
     writeAtomic(artifactAbs, fetched.artifact);
   try {
     await verifyArtifactRegisters(artifactAbs, available);
@@ -18984,7 +19137,7 @@ async function addPack(source, opts) {
 }
 function setPackPolicyEnabled(packId, name, on) {
   const manifestPath = resolve11(packsRoot(), "installed.json");
-  if (!existsSync11(manifestPath))
+  if (!existsSync12(manifestPath))
     return { ok: false, reason: "no packs are installed" };
   let raw;
   try {
@@ -19018,7 +19171,7 @@ function bareId(value) {
 }
 function removePack(id) {
   const manifestPath = resolve11(packsRoot(), "installed.json");
-  if (!existsSync11(manifestPath))
+  if (!existsSync12(manifestPath))
     return null;
   let raw;
   try {
@@ -19043,7 +19196,7 @@ function removePack(id) {
 function upsertInstalled(record, carryAbsorbedSelection = true) {
   const manifestPath = resolve11(packsRoot(), "installed.json");
   let packs = [];
-  if (existsSync11(manifestPath)) {
+  if (existsSync12(manifestPath)) {
     try {
       const raw = JSON.parse(readFileSync6(manifestPath, "utf8"));
       if (Array.isArray(raw.packs))
@@ -20041,22 +20194,22 @@ import {
   readFileSync as readFileSync7,
   writeFileSync as writeFileSync5,
   appendFileSync as appendFileSync2,
-  renameSync as renameSync4,
+  renameSync as renameSync5,
   readdirSync as readdirSync4,
-  mkdirSync as mkdirSync6,
-  existsSync as existsSync12,
-  statSync as statSync5,
+  mkdirSync as mkdirSync7,
+  existsSync as existsSync13,
+  statSync as statSync6,
   unlinkSync as unlinkSync2
 } from "node:fs";
-import { join as join6 } from "node:path";
+import { join as join7 } from "node:path";
 function ensureDir() {
-  if (!existsSync12(storeDirValue())) {
-    mkdirSync6(storeDirValue(), { recursive: true });
+  if (!existsSync13(storeDirValue())) {
+    mkdirSync7(storeDirValue(), { recursive: true });
   }
 }
 function acquireLock() {
   ensureDir();
-  const lockPath = join6(storeDirValue(), LOCK_FILE);
+  const lockPath = join7(storeDirValue(), LOCK_FILE);
   const deadline = Date.now() + LOCK_STALE_MS;
   while (Date.now() < deadline) {
     try {
@@ -20066,7 +20219,7 @@ function acquireLock() {
       if (e.code !== "EEXIST")
         return;
       try {
-        const s = statSync5(lockPath);
+        const s = statSync6(lockPath);
         if (Date.now() - s.mtimeMs > LOCK_STALE_MS) {
           writeFileSync5(lockPath, String(process.pid), "utf-8");
           return;
@@ -20077,7 +20230,7 @@ function acquireLock() {
 }
 function releaseLock() {
   try {
-    unlinkSync2(join6(storeDirValue(), LOCK_FILE));
+    unlinkSync2(join7(storeDirValue(), LOCK_FILE));
   } catch {}
 }
 function persistHookActivity(input) {
@@ -20085,8 +20238,8 @@ function persistHookActivity(input) {
   ensureDir();
   acquireLock();
   try {
-    const currentPath = join6(storeDirValue(), CURRENT_FILE);
-    const countPath = join6(storeDirValue(), COUNT_FILE);
+    const currentPath = join7(storeDirValue(), CURRENT_FILE);
+    const countPath = join7(storeDirValue(), COUNT_FILE);
     const lineCount = readCount(countPath);
     if (lineCount >= PAGE_SIZE) {
       try {
@@ -20106,8 +20259,8 @@ function persistHookActivity(input) {
 }
 function rotate(currentPath, countPath) {
   const archiveName = `page-${Date.now()}-${rotateSeq++}.jsonl`;
-  const archivePath = join6(storeDirValue(), archiveName);
-  renameSync4(currentPath, archivePath);
+  const archivePath = join7(storeDirValue(), archiveName);
+  renameSync5(currentPath, archivePath);
   writeCount(countPath, 0);
 }
 function readCount(countPath) {
@@ -20132,7 +20285,7 @@ function readFileSafe(filePath) {
 }
 function readStoredStats() {
   try {
-    return JSON.parse(readFileSync7(join6(storeDirValue(), STATS_FILE), "utf-8"));
+    return JSON.parse(readFileSync7(join7(storeDirValue(), STATS_FILE), "utf-8"));
   } catch {
     return { totalEvents: 0, denyCount: 0, policyMap: {} };
   }
@@ -20150,10 +20303,10 @@ function foldEntry(s, entry) {
   }
 }
 function writeStoredStats(s) {
-  const tmpPath = join6(storeDirValue(), `stats.json.${process.pid}.tmp`);
+  const tmpPath = join7(storeDirValue(), `stats.json.${process.pid}.tmp`);
   try {
     writeFileSync5(tmpPath, JSON.stringify(s), "utf-8");
-    renameSync4(tmpPath, join6(storeDirValue(), STATS_FILE));
+    renameSync5(tmpPath, join7(storeDirValue(), STATS_FILE));
     return true;
   } catch {
     try {
@@ -20173,8 +20326,8 @@ function rebuildHookActivityStats() {
   const s = { totalEvents: 0, denyCount: 0, policyMap: {} };
   let sawAny = false;
   for (const file of files) {
-    const path = join6(storeDirValue(), file);
-    if (!existsSync12(path))
+    const path = join7(storeDirValue(), file);
+    if (!existsSync13(path))
       continue;
     sawAny = true;
     for (const entry of readJsonlFile(path))
@@ -20186,12 +20339,12 @@ function rebuildHookActivityStats() {
 }
 function getAllHookActivityEntries() {
   ensureDir();
-  const currentPath = join6(storeDirValue(), CURRENT_FILE);
+  const currentPath = join7(storeDirValue(), CURRENT_FILE);
   const currentEntries = readJsonlFile(currentPath).reverse();
   const archives = getArchiveFiles();
   const archiveEntries = [];
   for (const file of archives) {
-    const entries = readJsonlFile(join6(storeDirValue(), file));
+    const entries = readJsonlFile(join7(storeDirValue(), file));
     archiveEntries.push(...entries.reverse());
   }
   return [...currentEntries, ...archiveEntries];
@@ -20202,7 +20355,7 @@ function getHookActivityEntriesSince(sinceMs) {
   const inWindow = (e) => typeof e.timestamp === "number" && e.timestamp >= sinceMs;
   const listedBefore = new Set(getArchiveFiles());
   sinceReadProbe?.("before-current");
-  const current = readJsonlFile(join6(dir, CURRENT_FILE));
+  const current = readJsonlFile(join7(dir, CURRENT_FILE));
   sinceReadProbe?.("after-current");
   const readFromCurrent = new Map;
   for (const e of current) {
@@ -20222,7 +20375,7 @@ function getHookActivityEntriesSince(sinceMs) {
     const rotatedAt = parseInt(file.slice(5, -6).split("-")[0], 10);
     if (Number.isFinite(rotatedAt) && rotatedAt < sinceMs - ROTATION_CLOCK_SLACK_MS)
       break;
-    let entries = readJsonlFile(join6(dir, file));
+    let entries = readJsonlFile(join7(dir, file));
     if (!listedBefore.has(file))
       entries = entries.filter(notReadYet);
     out.push(...entries.reverse().filter(inWindow));
@@ -20278,8 +20431,8 @@ var init_hook_activity_store = __esm(() => {
 });
 
 // src/hooks/delivery-health.ts
-import { existsSync as existsSync13, readdirSync as readdirSync5, statSync as statSync6 } from "node:fs";
-import { join as join7 } from "node:path";
+import { existsSync as existsSync14, readdirSync as readdirSync5, statSync as statSync7 } from "node:fs";
+import { join as join8 } from "node:path";
 function parseParkedName(name) {
   const poison = name.endsWith(POISON_SUFFIX);
   const withoutPoison = poison ? name.slice(0, -POISON_SUFFIX.length) : name;
@@ -20307,7 +20460,7 @@ function parseParkedName(name) {
 }
 function deliveryHealth(home, now = Date.now()) {
   const dir = failedDir(home);
-  if (!existsSync13(dir))
+  if (!existsSync14(dir))
     return EMPTY;
   let entries;
   try {
@@ -20332,7 +20485,7 @@ function deliveryHealth(home, now = Date.now()) {
         credentialRejected += 1;
     }
     try {
-      const mtime = statSync6(join7(dir, name)).mtimeMs;
+      const mtime = statSync7(join8(dir, name)).mtimeMs;
       if (oldestMtime === undefined || mtime < oldestMtime)
         oldestMtime = mtime;
     } catch {}
@@ -20427,9 +20580,9 @@ function runtimeCache(fn, revalidateSeconds, options) {
 
 // lib/paths.ts
 import { homedir as homedir7 } from "os";
-import { join as join8 } from "path";
+import { join as join9 } from "path";
 function getDefaultClaudeProjectsPath() {
-  return join8(homedir7(), ".claude", "projects");
+  return join9(homedir7(), ".claude", "projects");
 }
 function decodeFolderName(name) {
   if (/^[A-Za-z]--/.test(name)) {
@@ -20520,7 +20673,7 @@ __export(exports_codex_projects, {
 });
 import { open, readdir } from "node:fs/promises";
 import { homedir as homedir8 } from "node:os";
-import { join as join9 } from "node:path";
+import { join as join10 } from "node:path";
 async function safeReaddir(dir) {
   try {
     return await readdir(dir, { withFileTypes: true });
@@ -20568,7 +20721,7 @@ async function listJsonlFiles(dir) {
   const entries = await safeReaddir(dir);
   if (!entries)
     return [];
-  return entries.filter((e) => e.isFile() && e.name.endsWith(".jsonl")).map((e) => join9(dir, e.name));
+  return entries.filter((e) => e.isFile() && e.name.endsWith(".jsonl")).map((e) => join10(dir, e.name));
 }
 async function scanCodexSessions() {
   const yearDirs = await safeReaddir(CODEX_SESSIONS_ROOT);
@@ -20578,19 +20731,19 @@ async function scanCodexSessions() {
   for (const y of yearDirs) {
     if (!y.isDirectory())
       continue;
-    const monthDirs = await safeReaddir(join9(CODEX_SESSIONS_ROOT, y.name));
+    const monthDirs = await safeReaddir(join10(CODEX_SESSIONS_ROOT, y.name));
     if (!monthDirs)
       continue;
     for (const m of monthDirs) {
       if (!m.isDirectory())
         continue;
-      const dayDirs = await safeReaddir(join9(CODEX_SESSIONS_ROOT, y.name, m.name));
+      const dayDirs = await safeReaddir(join10(CODEX_SESSIONS_ROOT, y.name, m.name));
       if (!dayDirs)
         continue;
       for (const d of dayDirs) {
         if (!d.isDirectory())
           continue;
-        const dayPath = join9(CODEX_SESSIONS_ROOT, y.name, m.name, d.name);
+        const dayPath = join10(CODEX_SESSIONS_ROOT, y.name, m.name, d.name);
         filePaths.push(...await listJsonlFiles(dayPath));
       }
     }
@@ -20698,7 +20851,7 @@ var CODEX_SESSIONS_ROOT, SESSION_ID_RE, FIRST_LINE_CHUNK_BYTES, cachedScan, getC
 var init_codex_projects = __esm(() => {
   init_paths();
   init_logger();
-  CODEX_SESSIONS_ROOT = join9(homedir8(), ".codex", "sessions");
+  CODEX_SESSIONS_ROOT = join10(homedir8(), ".codex", "sessions");
   SESSION_ID_RE = /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/i;
   FIRST_LINE_CHUNK_BYTES = 256 * 1024;
   cachedScan = runtimeCache(scanCodexSessions, 30);
@@ -20715,9 +20868,9 @@ __export(exports_copilot_projects, {
 });
 import { readdir as readdir2, readFile as readFile4, stat } from "node:fs/promises";
 import { homedir as homedir9 } from "node:os";
-import { join as join10 } from "node:path";
+import { join as join11 } from "node:path";
 function getCopilotSessionStateRoot() {
-  return join10(process.env.COPILOT_HOME || join10(homedir9(), ".copilot"), "session-state");
+  return join11(process.env.COPILOT_HOME || join11(homedir9(), ".copilot"), "session-state");
 }
 async function safeReaddir2(dir) {
   try {
@@ -20746,8 +20899,8 @@ async function scanCopilotSessions() {
     return [];
   const candidates = entries.filter((e) => e.isDirectory()).map((e) => ({
     sessionId: e.name,
-    workspacePath: join10(root, e.name, "workspace.yaml"),
-    eventsPath: join10(root, e.name, "events.jsonl")
+    workspacePath: join11(root, e.name, "workspace.yaml"),
+    eventsPath: join11(root, e.name, "events.jsonl")
   }));
   const settled = await batchAll(candidates.map((c) => async () => {
     let workspaceText;
@@ -20859,9 +21012,9 @@ __export(exports_cursor_projects, {
 });
 import { readdir as readdir3, readFile as readFile5, stat as stat2 } from "node:fs/promises";
 import { homedir as homedir10 } from "node:os";
-import { join as join11 } from "node:path";
+import { join as join12 } from "node:path";
 function getCursorHome() {
-  return process.env.CURSOR_HOME || join11(homedir10(), ".cursor");
+  return process.env.CURSOR_HOME || join12(homedir10(), ".cursor");
 }
 async function safeReaddir3(dir) {
   try {
@@ -20893,7 +21046,7 @@ function parseCwdFromMetaText(text) {
 }
 async function findFirstUsableMeta(dir, candidates) {
   for (const name of candidates) {
-    const path = join11(dir, name);
+    const path = join12(dir, name);
     if (await statMtime2(path) === null)
       continue;
     let text;
@@ -20910,7 +21063,7 @@ async function findFirstUsableMeta(dir, candidates) {
 }
 async function findFirstExistingPath(dir, candidates) {
   for (const name of candidates) {
-    const path = join11(dir, name);
+    const path = join12(dir, name);
     if (await statMtime2(path) !== null)
       return path;
   }
@@ -20920,7 +21073,7 @@ async function scanCursorSessions() {
   const home = getCursorHome();
   const newCandidates = [];
   const legacyCandidates = [];
-  const projectsRoot = join11(home, NEW_PROJECTS_DIR);
+  const projectsRoot = join12(home, NEW_PROJECTS_DIR);
   const projectEntries = await safeReaddir3(projectsRoot);
   if (projectEntries) {
     for (const proj of projectEntries) {
@@ -20928,7 +21081,7 @@ async function scanCursorSessions() {
         continue;
       const decoded = decodeFolderName(proj.name);
       const cwd = decoded.startsWith("/") || /^[A-Za-z]:\//.test(decoded) ? decoded : `/${decoded}`;
-      const transcriptsRoot = join11(projectsRoot, proj.name, NEW_AGENT_TRANSCRIPTS_DIR);
+      const transcriptsRoot = join12(projectsRoot, proj.name, NEW_AGENT_TRANSCRIPTS_DIR);
       const sessionDirs = await safeReaddir3(transcriptsRoot);
       if (!sessionDirs)
         continue;
@@ -20937,28 +21090,28 @@ async function scanCursorSessions() {
           continue;
         newCandidates.push({
           sessionId: sd.name,
-          dir: join11(transcriptsRoot, sd.name),
+          dir: join12(transcriptsRoot, sd.name),
           cwd
         });
       }
     }
   }
   for (const sub of LEGACY_SESSION_ROOT_CANDIDATES) {
-    const root = join11(home, sub);
+    const root = join12(home, sub);
     const entries = await safeReaddir3(root);
     if (!entries)
       continue;
     for (const e of entries) {
       if (!e.isDirectory())
         continue;
-      legacyCandidates.push({ sessionId: e.name, dir: join11(root, e.name) });
+      legacyCandidates.push({ sessionId: e.name, dir: join12(root, e.name) });
     }
   }
   if (newCandidates.length === 0 && legacyCandidates.length === 0)
     return [];
   const settled = await batchAll([
     ...newCandidates.map((c) => async () => {
-      const transcriptPath = join11(c.dir, `${c.sessionId}.jsonl`);
+      const transcriptPath = join12(c.dir, `${c.sessionId}.jsonl`);
       const transcriptMtime = await statMtime2(transcriptPath);
       if (!transcriptMtime)
         return null;
@@ -21072,7 +21225,7 @@ var init_cursor_projects = __esm(() => {
 });
 
 // lib/sqlite-reader.ts
-import { existsSync as existsSync14, readFileSync as readFileSync8, statSync as statSync7 } from "node:fs";
+import { existsSync as existsSync15, readFileSync as readFileSync8, statSync as statSync8 } from "node:fs";
 import initSqlJs from "sql.js/dist/sql-asm.js";
 async function tryNodeSqlite(dbPath) {
   try {
@@ -21097,7 +21250,7 @@ function loadSqlJs() {
   return sqlPromise;
 }
 function fileVersion(path) {
-  const stat = statSync7(path);
+  const stat = statSync8(path);
   return { size: stat.size, mtimeMs: stat.mtimeMs, ctimeMs: stat.ctimeMs };
 }
 function sameVersion(a, b) {
@@ -21230,7 +21383,7 @@ async function trySqlJs(dbPath) {
   }
 }
 async function openSqliteReadonly(dbPath, options = {}) {
-  if (!existsSync14(dbPath))
+  if (!existsSync15(dbPath))
     return null;
   if (!options.forcePortable) {
     const native = await tryNodeSqlite(dbPath);
@@ -21244,12 +21397,12 @@ var init_sqlite_reader = () => {};
 
 // lib/opencode-db.ts
 import { homedir as homedir11 } from "node:os";
-import { join as join12 } from "node:path";
+import { join as join13 } from "node:path";
 function opencodeDbPath() {
   if (process.env.OPENCODE_DB_PATH)
     return process.env.OPENCODE_DB_PATH;
-  const home = process.env.OPENCODE_HOME ?? join12(homedir11(), ".local", "share", "opencode");
-  return join12(home, "opencode.db");
+  const home = process.env.OPENCODE_HOME ?? join13(homedir11(), ".local", "share", "opencode");
+  return join13(home, "opencode.db");
 }
 async function withOpenCodeDb(fn) {
   const db = await openSqliteReadonly(opencodeDbPath());
@@ -21410,9 +21563,9 @@ __export(exports_pi_projects, {
 });
 import { readdir as readdir4, readFile as readFile6, stat as stat3 } from "node:fs/promises";
 import { homedir as homedir12 } from "node:os";
-import { join as join13 } from "node:path";
+import { join as join14 } from "node:path";
 function getPiSessionsRoot() {
-  return process.env.PI_SESSIONS_DIR || join13(homedir12(), ".pi", "agent", "sessions");
+  return process.env.PI_SESSIONS_DIR || join14(homedir12(), ".pi", "agent", "sessions");
 }
 async function safeReaddir4(dir) {
   try {
@@ -21460,7 +21613,7 @@ async function scanPiSessions() {
   for (const cwdDir of cwdDirs) {
     if (!cwdDir.isDirectory())
       continue;
-    const cwdPath = join13(root, cwdDir.name);
+    const cwdPath = join14(root, cwdDir.name);
     const sessionFiles = await safeReaddir4(cwdPath);
     if (!sessionFiles)
       continue;
@@ -21470,7 +21623,7 @@ async function scanPiSessions() {
       const m = SESSION_FILE_RE.exec(f.name);
       if (!m)
         continue;
-      candidates.push({ sessionId: m[1], filePath: join13(cwdPath, f.name) });
+      candidates.push({ sessionId: m[1], filePath: join14(cwdPath, f.name) });
     }
   }
   if (candidates.length === 0)
@@ -21592,14 +21745,14 @@ function formatDuration(ms) {
 }
 
 // lib/hermes-sessions.ts
-import { join as join14 } from "node:path";
+import { join as join15 } from "node:path";
 function hermesDbPaths() {
   const override = process.env.HERMES_DB_PATH;
   if (override)
     return [{ profile: HERMES_DEFAULT_PROFILE, dbPath: override }];
   return listHermesProfiles().map((p) => ({
     profile: p.name,
-    dbPath: join14(p.home, "state.db")
+    dbPath: join15(p.home, "state.db")
   }));
 }
 function epochToMs(value) {
@@ -21891,8 +22044,8 @@ var init_hermes_projects = __esm(() => {
 });
 
 // lib/openclaw-db.ts
-import { existsSync as existsSync15 } from "node:fs";
-import { join as join15 } from "node:path";
+import { existsSync as existsSync16 } from "node:fs";
+import { join as join16 } from "node:path";
 function str(value) {
   return typeof value === "string" && value.length > 0 ? value : undefined;
 }
@@ -21910,8 +22063,8 @@ function syntheticPath(agentId, sessionId) {
 function listOpenClawDatabases(home, agentIds) {
   const out = [];
   for (const agentId of agentIds) {
-    const dbPath = join15(home, "agents", agentId, "agent", DB_NAME);
-    if (existsSync15(dbPath))
+    const dbPath = join16(home, "agents", agentId, "agent", DB_NAME);
+    if (existsSync16(dbPath))
       out.push({ agentId, dbPath });
   }
   return out;
@@ -22048,11 +22201,11 @@ var init_openclaw_db = __esm(() => {
 
 // lib/openclaw-sessions.ts
 import { readFile as readFile7 } from "node:fs/promises";
-import { readdirSync as readdirSync6, statSync as statSync8 } from "node:fs";
+import { readdirSync as readdirSync6, statSync as statSync9 } from "node:fs";
 import { homedir as homedir13 } from "node:os";
-import { join as join16 } from "node:path";
+import { join as join17 } from "node:path";
 function openclawHome() {
-  return process.env.OPENCLAW_STATE_DIR || process.env.OPENCLAW_HOME || join16(homedir13(), ".openclaw");
+  return process.env.OPENCLAW_STATE_DIR || process.env.OPENCLAW_HOME || join17(homedir13(), ".openclaw");
 }
 function isPlainObject3(v) {
   return !!v && typeof v === "object" && !Array.isArray(v);
@@ -22171,13 +22324,13 @@ function openclawLinesToLogEntries(lines, source = "session") {
 }
 function listOpenClawAgents() {
   try {
-    return readdirSync6(join16(openclawHome(), "agents"), { withFileTypes: true }).filter((d) => d.isDirectory() && !d.name.startsWith(".")).map((d) => d.name).sort();
+    return readdirSync6(join17(openclawHome(), "agents"), { withFileTypes: true }).filter((d) => d.isDirectory() && !d.name.startsWith(".")).map((d) => d.name).sort();
   } catch {
     return [];
   }
 }
 function listOpenClawTranscripts() {
-  const agentsDir = join16(openclawHome(), "agents");
+  const agentsDir = join17(openclawHome(), "agents");
   const out = [];
   let agentIds;
   try {
@@ -22186,7 +22339,7 @@ function listOpenClawTranscripts() {
     return out;
   }
   for (const agentId of agentIds) {
-    const sessionsDir = join16(agentsDir, agentId, "sessions");
+    const sessionsDir = join17(agentsDir, agentId, "sessions");
     let files;
     try {
       files = readdirSync6(sessionsDir);
@@ -22199,9 +22352,9 @@ function listOpenClawTranscripts() {
       const sessionId = file.slice(0, -".jsonl".length);
       if (!OPENCLAW_SESSION_ID_RE.test(sessionId))
         continue;
-      const transcriptPath = join16(sessionsDir, file);
+      const transcriptPath = join17(sessionsDir, file);
       try {
-        const st = statSync8(transcriptPath);
+        const st = statSync9(transcriptPath);
         out.push({
           agentId,
           sessionId,
@@ -22279,13 +22432,13 @@ __export(exports_openclaw_projects, {
   openClawProjectPath: () => openClawProjectPath
 });
 import { readFileSync as readFileSync9 } from "node:fs";
-import { join as join17 } from "node:path";
+import { join as join18 } from "node:path";
 function str2(v) {
   return typeof v === "string" && v.length > 0 ? v : undefined;
 }
 function readSessionsIndex(agentId) {
   const out = new Map;
-  const indexPath = join17(openclawHome(), "agents", agentId, "sessions", "sessions.json");
+  const indexPath = join18(openclawHome(), "agents", agentId, "sessions", "sessions.json");
   let raw;
   try {
     raw = JSON.parse(readFileSync9(indexPath, "utf-8"));
@@ -22446,14 +22599,14 @@ var init_openclaw_projects = __esm(() => {
 
 // lib/factory-sessions.ts
 import { readFile as readFile8 } from "node:fs/promises";
-import { readdirSync as readdirSync7, statSync as statSync9 } from "node:fs";
+import { readdirSync as readdirSync7, statSync as statSync10 } from "node:fs";
 import { homedir as homedir14 } from "node:os";
-import { join as join18 } from "node:path";
+import { join as join19 } from "node:path";
 function factoryHome() {
-  return process.env.FACTORY_HOME || join18(homedir14(), ".factory");
+  return process.env.FACTORY_HOME || join19(homedir14(), ".factory");
 }
 function factorySessionsRoot() {
-  return join18(factoryHome(), "sessions");
+  return join19(factoryHome(), "sessions");
 }
 function isPlainObject4(v) {
   return !!v && typeof v === "object" && !Array.isArray(v);
@@ -22599,7 +22752,7 @@ function listFactoryTranscripts() {
   for (const dir of projectDirs) {
     const projectName = dir.name;
     const cwd = decodeFolderName(projectName);
-    const projectPath = join18(root, projectName);
+    const projectPath = join19(root, projectName);
     let files;
     try {
       files = readdirSync7(projectPath);
@@ -22612,9 +22765,9 @@ function listFactoryTranscripts() {
       const sessionId = file.slice(0, -".jsonl".length);
       if (!FACTORY_SESSION_ID_RE.test(sessionId))
         continue;
-      const transcriptPath = join18(projectPath, file);
+      const transcriptPath = join19(projectPath, file);
       try {
-        const st = statSync9(transcriptPath);
+        const st = statSync10(transcriptPath);
         out.push({ projectName, cwd, sessionId, transcriptPath, mtimeMs: st.mtimeMs, sizeBytes: st.size });
       } catch {}
     }
@@ -22736,12 +22889,12 @@ var init_factory_projects = __esm(() => {
 
 // lib/devin-sessions.ts
 import { homedir as homedir15 } from "node:os";
-import { join as join19 } from "node:path";
+import { join as join20 } from "node:path";
 function devinHome() {
-  return process.env.DEVIN_HOME || join19(homedir15(), ".local", "share", "devin");
+  return process.env.DEVIN_HOME || join20(homedir15(), ".local", "share", "devin");
 }
 function devinDbPath() {
-  return process.env.DEVIN_DB_PATH || join19(devinHome(), "cli", "sessions.db");
+  return process.env.DEVIN_DB_PATH || join20(devinHome(), "cli", "sessions.db");
 }
 function devinEpochToMs(value) {
   if (typeof value === "number" && Number.isFinite(value)) {
@@ -23034,17 +23187,17 @@ var init_devin_projects = __esm(() => {
 
 // lib/antigravity-sessions.ts
 import { readFile as readFile9 } from "node:fs/promises";
-import { readdirSync as readdirSync8, statSync as statSync10 } from "node:fs";
+import { readdirSync as readdirSync8, statSync as statSync11 } from "node:fs";
 import { homedir as homedir16 } from "node:os";
-import { join as join20 } from "node:path";
+import { join as join21 } from "node:path";
 function antigravityHome() {
-  return process.env.ANTIGRAVITY_HOME || join20(homedir16(), ".gemini", "antigravity-cli");
+  return process.env.ANTIGRAVITY_HOME || join21(homedir16(), ".gemini", "antigravity-cli");
 }
 function antigravityBrainRoot() {
-  return join20(antigravityHome(), "brain");
+  return join21(antigravityHome(), "brain");
 }
 function antigravityTranscriptRelPath() {
-  return join20(".system_generated", "logs", "transcript_full.jsonl");
+  return join21(".system_generated", "logs", "transcript_full.jsonl");
 }
 function isPlainObject6(v) {
   return !!v && typeof v === "object" && !Array.isArray(v);
@@ -23167,9 +23320,9 @@ function listAntigravityTranscripts() {
     const conversationId = dir.name;
     if (!ANTIGRAVITY_CONVERSATION_ID_RE.test(conversationId))
       continue;
-    const transcriptPath = join20(root, conversationId, rel);
+    const transcriptPath = join21(root, conversationId, rel);
     try {
-      const st = statSync10(transcriptPath);
+      const st = statSync11(transcriptPath);
       if (!st.isFile())
         continue;
       out.push({ conversationId, transcriptPath, mtimeMs: st.mtimeMs, sizeBytes: st.size });
@@ -23180,9 +23333,9 @@ function listAntigravityTranscripts() {
 function findAntigravityTranscript(conversationId) {
   if (!ANTIGRAVITY_CONVERSATION_ID_RE.test(conversationId))
     return null;
-  const transcriptPath = join20(antigravityBrainRoot(), conversationId, antigravityTranscriptRelPath());
+  const transcriptPath = join21(antigravityBrainRoot(), conversationId, antigravityTranscriptRelPath());
   try {
-    if (statSync10(transcriptPath).isFile())
+    if (statSync11(transcriptPath).isFile())
       return transcriptPath;
   } catch {}
   return null;
@@ -23216,9 +23369,9 @@ __export(exports_antigravity_projects, {
   getAntigravityIndex: () => getAntigravityIndex,
   getAntigravityProjects: () => getAntigravityProjects
 });
-import { join as join21 } from "node:path";
+import { join as join22 } from "node:path";
 function antigravitySummariesDbPath() {
-  return join21(antigravityHome(), "conversation_summaries.db");
+  return join22(antigravityHome(), "conversation_summaries.db");
 }
 function parseWorkspaceCwd(raw) {
   if (!raw)
@@ -23362,15 +23515,15 @@ var init_antigravity_projects = __esm(() => {
 
 // lib/goose-sessions.ts
 import { homedir as homedir17 } from "node:os";
-import { join as join22 } from "node:path";
+import { join as join23 } from "node:path";
 function gooseHome() {
   if (process.env.GOOSE_HOME)
     return process.env.GOOSE_HOME;
   const xdg = process.env.XDG_DATA_HOME;
-  return join22(xdg && xdg.length > 0 ? xdg : join22(homedir17(), ".local", "share"), "goose");
+  return join23(xdg && xdg.length > 0 ? xdg : join23(homedir17(), ".local", "share"), "goose");
 }
 function gooseDbPath() {
-  return process.env.GOOSE_DB_PATH || join22(gooseHome(), "sessions", "sessions.db");
+  return process.env.GOOSE_DB_PATH || join23(gooseHome(), "sessions", "sessions.db");
 }
 function gooseTimestampToMs(value) {
   if (typeof value === "number" && Number.isFinite(value)) {
@@ -23634,7 +23787,7 @@ var init_goose_projects = __esm(() => {
 
 // lib/projects.ts
 import { readdir as readdir5, stat as stat4 } from "node:fs/promises";
-import { join as join23, resolve as resolve12, sep } from "node:path";
+import { join as join24, resolve as resolve12, sep } from "node:path";
 async function getMtime(path, label) {
   try {
     return (await stat4(path)).mtime;
@@ -23660,7 +23813,7 @@ async function getClaudeProjectFolders() {
     if (!entries)
       return [];
     const settled = await batchAll(entries.filter((entry) => entry.isDirectory()).map((entry) => async () => {
-      const folderPath = join23(projectsPath, entry.name);
+      const folderPath = join24(projectsPath, entry.name);
       const mtime = await getMtime(folderPath, entry.name);
       return {
         name: entry.name,
@@ -23787,7 +23940,7 @@ function resolveProjectPath(projectName) {
   if (/^[/\\]/.test(projectName))
     throw new RangeError("Absolute project name");
   const projectsPath = resolve12(getClaudeProjectsPath());
-  const candidate = resolve12(join23(projectsPath, projectName));
+  const candidate = resolve12(join24(projectsPath, projectName));
   if (!candidate.startsWith(projectsPath + sep)) {
     throw new RangeError("Project path escapes root");
   }
@@ -23805,7 +23958,7 @@ async function getSessionFiles(projectPath) {
       return [];
     const jsonlEntries = entries.filter((entry) => entry.isFile() && entry.name.endsWith(".jsonl") && extractSessionId2(entry.name));
     const settled = await batchAll(jsonlEntries.map((entry) => async () => {
-      const filePath = join23(projectPath, entry.name);
+      const filePath = join24(projectPath, entry.name);
       const mtime = await getMtime(filePath, entry.name);
       return {
         name: entry.name,
@@ -23834,13 +23987,13 @@ var init_projects = __esm(() => {
 
 // lib/resolve-subagent-path.ts
 import { access as access2 } from "fs/promises";
-import { join as join24, relative as relative3 } from "path";
+import { join as join25, relative as relative3 } from "path";
 async function resolveSubagentPath(projectsPath, projectName, sessionId, agentId) {
   const fileName = `agent-${agentId}.jsonl`;
   const candidatePaths = [
-    join24(projectsPath, projectName, fileName),
-    join24(projectsPath, projectName, sessionId, fileName),
-    join24(projectsPath, projectName, sessionId, "subagents", fileName)
+    join25(projectsPath, projectName, fileName),
+    join25(projectsPath, projectName, sessionId, fileName),
+    join25(projectsPath, projectName, sessionId, "subagents", fileName)
   ];
   for (const candidatePath of candidatePaths) {
     if (relative3(projectsPath, candidatePath).startsWith("..")) {
@@ -23862,7 +24015,7 @@ var init_resolve_subagent_path = () => {};
 
 // lib/log-entries.ts
 import { readFile as readFile10 } from "fs/promises";
-import { join as join25 } from "path";
+import { join as join26 } from "path";
 function formatTimestamp(date) {
   const base = formatDate(date);
   const ms = date.getMilliseconds().toString().padStart(3, "0");
@@ -24060,7 +24213,7 @@ async function parseLogContent(fileContent, source = "session") {
 async function parseSessionLog(projectName, sessionId) {
   const projectDir = resolveProjectPath(projectName);
   const projectsPath = getClaudeProjectsPath();
-  const filePath = join25(projectDir, `${sessionId}.jsonl`);
+  const filePath = join26(projectDir, `${sessionId}.jsonl`);
   const fileContent = await readFile10(filePath, "utf-8");
   const { entries: sessionEntries, rawLines: sessionRawLines, subagentIds } = await parseFileContent(fileContent, "session");
   if (subagentIds.length === 0) {
@@ -24097,13 +24250,13 @@ var init_log_entries = __esm(() => {
 });
 
 // lib/codex-sessions.ts
-import { readFileSync as readFileSync10, readdirSync as readdirSync9, existsSync as existsSync16, writeFileSync as writeFileSync6, mkdirSync as mkdirSync7, statSync as statSync11 } from "node:fs";
+import { readFileSync as readFileSync10, readdirSync as readdirSync9, existsSync as existsSync17, writeFileSync as writeFileSync6, mkdirSync as mkdirSync8, statSync as statSync12 } from "node:fs";
 import { readFile as readFile11 } from "node:fs/promises";
-import { dirname as dirname8, join as join26 } from "node:path";
+import { dirname as dirname9, join as join27 } from "node:path";
 import { homedir as homedir18 } from "node:os";
 function readCache() {
   try {
-    if (!existsSync16(CACHE_PATH))
+    if (!existsSync17(CACHE_PATH))
       return {};
     return JSON.parse(readFileSync10(CACHE_PATH, "utf-8"));
   } catch {
@@ -24112,7 +24265,7 @@ function readCache() {
 }
 function writeCacheEntry(sessionId, path) {
   try {
-    mkdirSync7(dirname8(CACHE_PATH), { recursive: true });
+    mkdirSync8(dirname9(CACHE_PATH), { recursive: true });
     const cache = readCache();
     cache[sessionId] = path;
     writeFileSync6(CACHE_PATH, JSON.stringify(cache), "utf-8");
@@ -24122,7 +24275,7 @@ function dirSearch(dir, sessionId) {
   try {
     for (const f of readdirSync9(dir, { withFileTypes: true })) {
       if (f.isFile() && f.name.includes(sessionId) && f.name.endsWith(".jsonl")) {
-        return join26(dir, f.name);
+        return join27(dir, f.name);
       }
     }
   } catch {}
@@ -24131,16 +24284,16 @@ function dirSearch(dir, sessionId) {
 function findCodexTranscript(sessionId) {
   const cache = readCache();
   const cached = cache[sessionId];
-  if (cached && existsSync16(cached))
+  if (cached && existsSync17(cached))
     return cached;
-  const root = join26(homedir18(), ".codex", "sessions");
+  const root = join27(homedir18(), ".codex", "sessions");
   const today = new Date;
   const yesterday = new Date(today.getTime() - 24 * 60 * 60 * 1000);
   const datedDirs = [today, yesterday].map((d) => {
     const y = String(d.getUTCFullYear());
     const m = String(d.getUTCMonth() + 1).padStart(2, "0");
     const day = String(d.getUTCDate()).padStart(2, "0");
-    return join26(root, y, m, day);
+    return join27(root, y, m, day);
   });
   for (const dir of datedDirs) {
     const hit = dirSearch(dir, sessionId);
@@ -24153,13 +24306,13 @@ function findCodexTranscript(sessionId) {
     for (const y of readdirSync9(root, { withFileTypes: true })) {
       if (!y.isDirectory())
         continue;
-      for (const m of readdirSync9(join26(root, y.name), { withFileTypes: true })) {
+      for (const m of readdirSync9(join27(root, y.name), { withFileTypes: true })) {
         if (!m.isDirectory())
           continue;
-        for (const d of readdirSync9(join26(root, y.name, m.name), { withFileTypes: true })) {
+        for (const d of readdirSync9(join27(root, y.name, m.name), { withFileTypes: true })) {
           if (!d.isDirectory())
             continue;
-          const hit = dirSearch(join26(root, y.name, m.name, d.name), sessionId);
+          const hit = dirSearch(join27(root, y.name, m.name, d.name), sessionId);
           if (hit) {
             writeCacheEntry(sessionId, hit);
             return hit;
@@ -24425,15 +24578,15 @@ var init_resolve_permission_mode = __esm(() => {
 });
 
 // lib/copilot-sessions.ts
-import { readFileSync as readFileSync12, readdirSync as readdirSync10, existsSync as existsSync17, statSync as statSync12 } from "node:fs";
+import { readFileSync as readFileSync12, readdirSync as readdirSync10, existsSync as existsSync18, statSync as statSync13 } from "node:fs";
 import { readFile as readFile12 } from "node:fs/promises";
-import { join as join27, resolve as resolve13, sep as sep2 } from "node:path";
+import { join as join28, resolve as resolve13, sep as sep2 } from "node:path";
 import { homedir as homedir19 } from "node:os";
 function getCopilotHome() {
-  return process.env.COPILOT_HOME || join27(homedir19(), ".copilot");
+  return process.env.COPILOT_HOME || join28(homedir19(), ".copilot");
 }
 function getCopilotSessionStateRoot2() {
-  return join27(getCopilotHome(), "session-state");
+  return join28(getCopilotHome(), "session-state");
 }
 function getCopilotSessionDir(sessionId) {
   if (!sessionId)
@@ -24448,19 +24601,19 @@ function resolveSessionFile(sessionId, filename) {
   const dir = getCopilotSessionDir(sessionId);
   if (!dir)
     return null;
-  return join27(dir, filename);
+  return join28(dir, filename);
 }
 function findCopilotTranscript(sessionId) {
   const candidate = resolveSessionFile(sessionId, "events.jsonl");
   if (!candidate)
     return null;
-  return existsSync17(candidate) ? candidate : null;
+  return existsSync18(candidate) ? candidate : null;
 }
 function findCopilotWorkspace(sessionId) {
   const candidate = resolveSessionFile(sessionId, "workspace.yaml");
   if (!candidate)
     return null;
-  return existsSync17(candidate) ? candidate : null;
+  return existsSync18(candidate) ? candidate : null;
 }
 function readYamlScalar(path, key) {
   try {
@@ -24642,12 +24795,12 @@ var init_copilot_sessions = __esm(() => {
 });
 
 // lib/cursor-sessions.ts
-import { readFileSync as readFileSync13, readdirSync as readdirSync11, existsSync as existsSync18, statSync as statSync13 } from "node:fs";
+import { readFileSync as readFileSync13, readdirSync as readdirSync11, existsSync as existsSync19, statSync as statSync14 } from "node:fs";
 import { readFile as readFile13 } from "node:fs/promises";
-import { basename as basename5, join as join28, resolve as resolve14, sep as sep3 } from "node:path";
+import { basename as basename6, join as join29, resolve as resolve14, sep as sep3 } from "node:path";
 import { homedir as homedir20 } from "node:os";
 function getCursorHome2() {
-  return process.env.CURSOR_HOME || join28(homedir20(), ".cursor");
+  return process.env.CURSOR_HOME || join29(homedir20(), ".cursor");
 }
 function getCursorSessionDir(sessionId) {
   if (!sessionId)
@@ -24665,7 +24818,7 @@ function getCursorSessionDir(sessionId) {
     const transcriptRoot = resolve14(projectsRoot, entry.name, NEW_AGENT_TRANSCRIPTS_DIR2);
     if (candidate === transcriptRoot || !candidate.startsWith(`${transcriptRoot}${sep3}`))
       continue;
-    if (existsSync18(candidate))
+    if (existsSync19(candidate))
       return candidate;
   }
   for (const sub of LEGACY_SESSION_ROOT_CANDIDATES2) {
@@ -24673,7 +24826,7 @@ function getCursorSessionDir(sessionId) {
     const candidate = resolve14(root, sessionId);
     if (candidate === root || !candidate.startsWith(`${root}${sep3}`))
       continue;
-    if (existsSync18(candidate))
+    if (existsSync19(candidate))
       return candidate;
   }
   return null;
@@ -24682,12 +24835,12 @@ function findCursorTranscript(sessionId) {
   const dir = getCursorSessionDir(sessionId);
   if (!dir)
     return null;
-  const newCandidate = join28(dir, `${basename5(dir)}.jsonl`);
-  if (existsSync18(newCandidate))
+  const newCandidate = join29(dir, `${basename6(dir)}.jsonl`);
+  if (existsSync19(newCandidate))
     return newCandidate;
   for (const name of LEGACY_TRANSCRIPT_FILE_CANDIDATES2) {
-    const candidate = join28(dir, name);
-    if (existsSync18(candidate))
+    const candidate = join29(dir, name);
+    if (existsSync19(candidate))
       return candidate;
   }
   return null;
@@ -24898,12 +25051,12 @@ var init_cursor_sessions = __esm(() => {
 });
 
 // lib/pi-sessions.ts
-import { readFileSync as readFileSync14, readdirSync as readdirSync12, existsSync as existsSync19, statSync as statSync14 } from "node:fs";
+import { readFileSync as readFileSync14, readdirSync as readdirSync12, existsSync as existsSync20, statSync as statSync15 } from "node:fs";
 import { readFile as readFile14 } from "node:fs/promises";
-import { join as join29, resolve as resolve15, sep as sep4 } from "node:path";
+import { join as join30, resolve as resolve15, sep as sep4 } from "node:path";
 import { homedir as homedir21 } from "node:os";
 function getPiSessionStateRoot() {
-  return process.env.PI_SESSIONS_DIR || join29(homedir21(), ".pi", "agent", "sessions");
+  return process.env.PI_SESSIONS_DIR || join30(homedir21(), ".pi", "agent", "sessions");
 }
 function isSafeSessionId(sessionId) {
   return UUID_RE.test(sessionId);
@@ -24935,7 +25088,7 @@ function findPiTranscript(sessionId) {
       const candidate = resolve15(cwdPath, f);
       if (!candidate.startsWith(`${cwdPath}${sep4}`))
         continue;
-      if (existsSync19(candidate))
+      if (existsSync20(candidate))
         return candidate;
     }
   }
@@ -25342,37 +25495,37 @@ var init_pack_failclosed = __esm(() => {
 
 // lib/atomic-write.ts
 import {
-  chmodSync as chmodSync2,
-  existsSync as existsSync20,
-  mkdirSync as mkdirSync8,
-  renameSync as renameSync5,
-  rmSync as rmSync4,
-  statSync as statSync15,
+  chmodSync as chmodSync3,
+  existsSync as existsSync21,
+  mkdirSync as mkdirSync9,
+  renameSync as renameSync6,
+  rmSync as rmSync5,
+  statSync as statSync16,
   writeFileSync as writeFileSync7
 } from "node:fs";
-import { dirname as dirname9 } from "node:path";
-import { randomBytes } from "node:crypto";
+import { dirname as dirname10 } from "node:path";
+import { randomBytes as randomBytes2 } from "node:crypto";
 function writeJsonAtomically(filePath, value, opts = {}) {
   const mode = opts.mode ?? 384;
   const dirMode = opts.dirMode ?? 448;
-  const dir = dirname9(filePath);
-  if (!existsSync20(dir))
-    mkdirSync8(dir, { recursive: true, mode: dirMode });
-  const tmp = `${filePath}.${process.pid}.${randomBytes(6).toString("hex")}.tmp`;
+  const dir = dirname10(filePath);
+  if (!existsSync21(dir))
+    mkdirSync9(dir, { recursive: true, mode: dirMode });
+  const tmp = `${filePath}.${process.pid}.${randomBytes2(6).toString("hex")}.tmp`;
   try {
     writeFileSync7(tmp, JSON.stringify(value, null, 2), { mode });
     try {
-      if ((statSync15(tmp).mode & 63) !== 0)
-        chmodSync2(tmp, mode);
+      if ((statSync16(tmp).mode & 63) !== 0)
+        chmodSync3(tmp, mode);
     } catch {}
-    renameSync5(tmp, filePath);
+    renameSync6(tmp, filePath);
     try {
-      if ((statSync15(filePath).mode & 63) !== 0)
-        chmodSync2(filePath, mode);
+      if ((statSync16(filePath).mode & 63) !== 0)
+        chmodSync3(filePath, mode);
     } catch {}
   } catch (err) {
     try {
-      rmSync4(tmp, { force: true });
+      rmSync5(tmp, { force: true });
     } catch {}
     throw err;
   }
@@ -25380,9 +25533,9 @@ function writeJsonAtomically(filePath, value, opts = {}) {
 var init_atomic_write = () => {};
 
 // src/hooks/session-pause.ts
-import { existsSync as existsSync21, mkdirSync as mkdirSync9, readdirSync as readdirSync13, readFileSync as readFileSync15, rmSync as rmSync5 } from "node:fs";
+import { existsSync as existsSync22, mkdirSync as mkdirSync10, readdirSync as readdirSync13, readFileSync as readFileSync15, rmSync as rmSync6 } from "node:fs";
 import { createHash as createHash6 } from "node:crypto";
-import { join as join30, resolve as resolve16 } from "node:path";
+import { join as join31, resolve as resolve16 } from "node:path";
 function pauseStateDir() {
   const override = process.env.FAILPROOFAI_STATE_DIR;
   if (override)
@@ -25391,7 +25544,7 @@ function pauseStateDir() {
 }
 function pauseFilePath(sessionId) {
   const digest = createHash6("sha256").update(sessionId).digest("hex").slice(0, 32);
-  return join30(pauseStateDir(), `${digest}.json`);
+  return join31(pauseStateDir(), `${digest}.json`);
 }
 function parsePauseDuration(input, ceilingMs = PAUSE_CEILING_MS) {
   if (input === undefined || input === "")
@@ -25447,7 +25600,7 @@ function readActivePause(sessionId, now = Date.now()) {
     return null;
   try {
     const path = pauseFilePath(sessionId);
-    if (!existsSync21(path))
+    if (!existsSync22(path))
       return null;
     const stored = parseStored(JSON.parse(readFileSync15(path, "utf8")));
     if (!stored)
@@ -25472,16 +25625,16 @@ function writePause(opts) {
     setBy: opts.setBy ?? "cli",
     ...opts.cwd ? { cwd: opts.cwd } : {}
   };
-  mkdirSync9(pauseStateDir(), { recursive: true, mode: 448 });
+  mkdirSync10(pauseStateDir(), { recursive: true, mode: 448 });
   writeJsonAtomically(pauseFilePath(opts.sessionId), { schemaVersion: SCHEMA_VERSION, ...pause });
   return pause;
 }
 function clearPause(sessionId) {
   const path = pauseFilePath(sessionId);
-  if (!existsSync21(path))
+  if (!existsSync22(path))
     return false;
   try {
-    rmSync5(path);
+    rmSync6(path);
     return true;
   } catch {
     return false;
@@ -25489,7 +25642,7 @@ function clearPause(sessionId) {
 }
 function listActivePauses(now = Date.now()) {
   const dir = pauseStateDir();
-  if (!existsSync21(dir))
+  if (!existsSync22(dir))
     return [];
   const out = [];
   let names;
@@ -25502,7 +25655,7 @@ function listActivePauses(now = Date.now()) {
     if (!name.endsWith(".json"))
       continue;
     try {
-      const stored = parseStored(JSON.parse(readFileSync15(join30(dir, name), "utf8")));
+      const stored = parseStored(JSON.parse(readFileSync15(join31(dir, name), "utf8")));
       if (!stored || stored.expiresAt <= now)
         continue;
       const { schemaVersion: _ignored, ...pause } = stored;
@@ -25542,18 +25695,18 @@ var init_session_pause = __esm(() => {
 // src/hooks/daemon-download.ts
 import { createHash as createHash7 } from "node:crypto";
 import {
-  chmodSync as chmodSync3,
-  existsSync as existsSync22,
-  mkdirSync as mkdirSync10,
+  chmodSync as chmodSync4,
+  existsSync as existsSync23,
+  mkdirSync as mkdirSync11,
   readdirSync as readdirSync14,
   readFileSync as readFileSync16,
-  renameSync as renameSync6,
-  rmSync as rmSync6,
-  statSync as statSync16,
+  renameSync as renameSync7,
+  rmSync as rmSync7,
+  statSync as statSync17,
   writeFileSync as writeFileSync8
 } from "node:fs";
 import { createRequire as createRequire2 } from "node:module";
-import { dirname as dirname10, resolve as resolve17 } from "node:path";
+import { dirname as dirname11, resolve as resolve17 } from "node:path";
 import { gunzipSync } from "node:zlib";
 function baseUrl2() {
   return (process.env.FAILPROOFAI_DAEMON_BASE_URL || DEFAULT_BASE_URL2).replace(/\/+$/, "");
@@ -25580,7 +25733,7 @@ function npmPlatformBinaryPath(key) {
   const name = platformPackageName(key);
   try {
     const requireFromRoot = createRequire2(resolve17(packageRoot, "package.json"));
-    const found = platformPackageBinary(dirname10(requireFromRoot.resolve(`${name}/package.json`)));
+    const found = platformPackageBinary(dirname11(requireFromRoot.resolve(`${name}/package.json`)));
     if (found)
       return found;
   } catch {}
@@ -25595,7 +25748,7 @@ function platformPackageBinary(dir) {
     return null;
   }
   const candidate = resolve17(dir, "bin", "failproofaid");
-  return existsSync22(candidate) ? candidate : null;
+  return existsSync23(candidate) ? candidate : null;
 }
 function pruneOldDaemonBinaries(keep = 2) {
   const removed = [];
@@ -25603,11 +25756,11 @@ function pruneOldDaemonBinaries(keep = 2) {
     const dir = daemonBinaryDir();
     const entries = readdirSync14(dir).filter((f) => f.startsWith("failproofaid-") && !f.endsWith(".tmp")).map((f) => {
       const full = resolve17(dir, f);
-      return { full, mtime: statSync16(full).mtimeMs };
+      return { full, mtime: statSync17(full).mtimeMs };
     }).sort((a, b) => b.mtime - a.mtime);
     for (const stale of entries.slice(keep)) {
       try {
-        rmSync6(stale.full, { force: true });
+        rmSync7(stale.full, { force: true });
         removed.push(stale.full);
       } catch {}
     }
@@ -25618,13 +25771,13 @@ function installBinaryBytes(binary) {
   const target = installedBinaryPath();
   const tempPath = `${target}.${process.pid}.tmp`;
   try {
-    mkdirSync10(daemonBinaryDir(), { recursive: true });
+    mkdirSync11(daemonBinaryDir(), { recursive: true });
     writeFileSync8(tempPath, binary);
-    chmodSync3(tempPath, 493);
-    renameSync6(tempPath, target);
+    chmodSync4(tempPath, 493);
+    renameSync7(tempPath, target);
     return target;
   } catch (err) {
-    rmSync6(tempPath, { force: true });
+    rmSync7(tempPath, { force: true });
     throw err;
   }
 }
@@ -25673,7 +25826,7 @@ function digestFor2(manifest, assetName) {
 }
 async function downloadFailproofaidBinary(key) {
   const target = installedBinaryPath();
-  if (existsSync22(target))
+  if (existsSync23(target))
     return { path: target };
   if (process.env.FAILPROOFAI_NO_DOWNLOAD) {
     return { error: "daemon downloads are disabled (FAILPROOFAI_NO_DOWNLOAD)" };
@@ -25707,10 +25860,10 @@ var init_daemon_download = __esm(() => {
 
 // src/hooks/daemon-client.ts
 import { createConnection as createConnection2 } from "node:net";
-import { existsSync as existsSync23 } from "node:fs";
+import { existsSync as existsSync24 } from "node:fs";
 function daemonSocketPresent() {
   try {
-    return existsSync23(socketPath2());
+    return existsSync24(socketPath2());
   } catch {
     return false;
   }
@@ -25868,13 +26021,13 @@ var init_daemon_client2 = __esm(() => {
 
 // src/hooks/daemon-service.ts
 import {
-  existsSync as existsSync24,
-  mkdirSync as mkdirSync11,
+  existsSync as existsSync25,
+  mkdirSync as mkdirSync12,
   mkdtempSync,
   readFileSync as readFileSync17,
   writeFileSync as writeFileSync9,
   unlinkSync as unlinkSync3,
-  rmSync as rmSync7
+  rmSync as rmSync8
 } from "node:fs";
 import { homedir as homedir22, tmpdir as tmpdir2, userInfo } from "node:os";
 import { resolve as resolve18 } from "node:path";
@@ -25899,13 +26052,13 @@ function resolveFailproofaidBinaryPath() {
   if (process.env.FAILPROOFAI_DAEMON_BINARY)
     return process.env.FAILPROOFAI_DAEMON_BINARY;
   const downloaded = installedBinaryPath();
-  if (existsSync24(downloaded))
+  if (existsSync25(downloaded))
     return downloaded;
   const packageRoot = process.env.FAILPROOFAI_PACKAGE_ROOT;
   if (packageRoot) {
     for (const profile of ["release", "debug"]) {
       const candidate = resolve18(packageRoot, "target", profile, "failproofaid");
-      if (existsSync24(candidate))
+      if (existsSync25(candidate))
         return candidate;
     }
   }
@@ -25936,7 +26089,7 @@ function resolveWorkerCommand() {
   if (!packageRoot)
     return null;
   const workerScript = resolve18(packageRoot, "dist", "worker.mjs");
-  if (!existsSync24(workerScript))
+  if (!existsSync25(workerScript))
     return null;
   return `${shellQuote(process.execPath)} ${shellQuote(workerScript)}`;
 }
@@ -25947,7 +26100,7 @@ function resolveCliCommand() {
   if (!packageRoot)
     return null;
   const cliScript = resolve18(packageRoot, "dist", "cli.mjs");
-  if (!existsSync24(cliScript))
+  if (!existsSync25(cliScript))
     return null;
   return `${shellQuote(process.execPath)} ${shellQuote(cliScript)}`;
 }
@@ -25961,7 +26114,7 @@ function workerScriptPath() {
   if (!packageRoot)
     return null;
   const workerScript = resolve18(packageRoot, "dist", "worker.mjs");
-  return existsSync24(workerScript) ? workerScript : null;
+  return existsSync25(workerScript) ? workerScript : null;
 }
 function assertUnitSafe(value, field) {
   if (UNIT_UNSAFE_RE.test(value)) {
@@ -26053,14 +26206,14 @@ function writePrivilegedFile(destination, contents, mode = "0644") {
     writeFileSync9(staging, contents, "utf8");
     runPrivileged("install", ["-m", mode, staging, destination]);
   } finally {
-    rmSync7(stagingDir, { recursive: true, force: true });
+    rmSync8(stagingDir, { recursive: true, force: true });
   }
 }
 function removeLegacyUserService() {
   try {
     if (process.platform === "linux") {
       const legacy = legacySystemdUserUnitPath();
-      if (!existsSync24(legacy))
+      if (!existsSync25(legacy))
         return;
       try {
         execFileSync2("systemctl", ["--user", "disable", "--now", "failproofaid.service"], {
@@ -26077,7 +26230,7 @@ function removeLegacyUserService() {
       } catch {}
     } else {
       const legacyAgent = legacyLaunchAgentPlistPath();
-      if (existsSync24(legacyAgent)) {
+      if (existsSync25(legacyAgent)) {
         try {
           execFileSync2("launchctl", ["unload", "-w", legacyAgent], {
             stdio: "ignore",
@@ -26087,7 +26240,7 @@ function removeLegacyUserService() {
         unlinkSync3(legacyAgent);
       }
       const legacyDaemon = legacySharedLaunchDaemonPath();
-      if (existsSync24(legacyDaemon)) {
+      if (existsSync25(legacyDaemon)) {
         try {
           runPrivileged("launchctl", ["unload", "-w", legacyDaemon]);
         } catch {}
@@ -26104,7 +26257,7 @@ function systemdUnitContents(binaryPath, workerCmd, cliCmd = null) {
   const user = assertUnitSafe(serviceUser(), "User");
   assertUnitSafe(binaryPath, "ExecStart");
   assertUnitSafe(homedir22(), "HOME");
-  const conditionPaths = [binaryPath, workerScriptPath()].filter((p) => typeof p === "string" && existsSync24(p));
+  const conditionPaths = [binaryPath, workerScriptPath()].filter((p) => typeof p === "string" && existsSync25(p));
   const conditionLines = conditionPaths.map((p) => `ConditionPathExists=${assertUnitSafe(p, "ConditionPathExists")}
 `).join("");
   return `[Unit]
@@ -26213,7 +26366,7 @@ async function installDaemonService() {
     } else {
       const plistPath = launchdPlistPath();
       const logDir = logsDir();
-      mkdirSync11(logDir, { recursive: true });
+      mkdirSync12(logDir, { recursive: true });
       try {
         runPrivileged("launchctl", ["unload", plistPath]);
       } catch {}
@@ -26317,7 +26470,7 @@ function readInstalledServiceDefinition() {
   if (!isDaemonSupportedPlatform())
     return null;
   const path = daemonServiceFilePath();
-  if (!path || !existsSync24(path))
+  if (!path || !existsSync25(path))
     return null;
   try {
     return readFileSync17(path, "utf8");
@@ -26429,7 +26582,7 @@ async function ensureDaemonServiceCurrent() {
       restartSystemdUnit();
     } else {
       const plistPath = launchdPlistPath();
-      mkdirSync11(logDir, { recursive: true });
+      mkdirSync12(logDir, { recursive: true });
       previous = definition;
       try {
         runPrivileged("launchctl", ["unload", plistPath]);
@@ -26453,7 +26606,7 @@ async function uninstallDaemonService() {
   try {
     if (process.platform === "linux") {
       const unitPath = systemdUnitPath();
-      if (!existsSync24(unitPath))
+      if (!existsSync25(unitPath))
         return;
       try {
         runPrivileged("systemctl", ["disable", "--now", systemdUnitName()]);
@@ -26464,7 +26617,7 @@ async function uninstallDaemonService() {
       } catch {}
     } else {
       const plistPath = launchdPlistPath();
-      if (!existsSync24(plistPath))
+      if (!existsSync25(plistPath))
         return;
       try {
         runPrivileged("launchctl", ["unload", "-w", plistPath]);
@@ -26481,7 +26634,7 @@ function daemonVersionSkew() {
   const recorded = readVersionFile()?.daemon;
   if (!recorded)
     return null;
-  if (!existsSync24(installedBinaryPath(recorded)))
+  if (!existsSync25(installedBinaryPath(recorded)))
     return null;
   return recorded === version2 ? null : { installed: recorded, expected: version2 };
 }
@@ -26499,7 +26652,7 @@ function daemonServiceStatus() {
   if (!isDaemonSupportedPlatform())
     return "unsupported-platform";
   if (process.platform === "linux") {
-    if (!existsSync24(systemdUnitPath()))
+    if (!existsSync25(systemdUnitPath()))
       return "not-installed";
     try {
       const out = execFileSync2("systemctl", ["is-active", systemdUnitName()], {
@@ -26512,7 +26665,7 @@ function daemonServiceStatus() {
     }
   }
   const plistPath = launchdPlistPath();
-  if (!existsSync24(plistPath))
+  if (!existsSync25(plistPath))
     return "not-installed";
   try {
     const root = typeof process.getuid === "function" && process.getuid() === 0;
@@ -26543,21 +26696,21 @@ var init_daemon_service = __esm(() => {
 
 // src/hooks/fp-reset.ts
 import {
-  copyFileSync,
-  existsSync as existsSync25,
-  mkdirSync as mkdirSync12,
+  copyFileSync as copyFileSync2,
+  existsSync as existsSync26,
+  mkdirSync as mkdirSync13,
   readFileSync as readFileSync18,
   readdirSync as readdirSync15,
-  renameSync as renameSync7,
-  rmSync as rmSync8,
+  renameSync as renameSync8,
+  rmSync as rmSync9,
   rmdirSync,
-  statSync as statSync17,
+  statSync as statSync18,
   writeFileSync as writeFileSync10
 } from "node:fs";
-import { dirname as dirname11, isAbsolute as isAbsolute3, relative as relative4, resolve as resolve19 } from "node:path";
+import { dirname as dirname12, isAbsolute as isAbsolute3, relative as relative4, resolve as resolve19 } from "node:path";
 function migrateConventionPolicies() {
   const from = legacy.customPoliciesDir();
-  if (!existsSync25(from))
+  if (!existsSync26(from))
     return [];
   const moved = [];
   const mergeInto = (dir, dest, prefix) => {
@@ -26570,7 +26723,7 @@ function migrateConventionPolicies() {
     if (entries.length === 0)
       return;
     try {
-      mkdirSync12(dest, { recursive: true });
+      mkdirSync13(dest, { recursive: true });
     } catch {
       return;
     }
@@ -26578,14 +26731,14 @@ function migrateConventionPolicies() {
       const source = resolve19(dir, entry.name);
       const target = resolve19(dest, entry.name);
       const name = `${prefix}${entry.name}`;
-      if (!existsSync25(target)) {
+      if (!existsSync26(target)) {
         try {
-          renameSync7(source, target);
+          renameSync8(source, target);
           moved.push(name);
         } catch {}
         continue;
       }
-      if (entry.isDirectory() && statSync17(target).isDirectory()) {
+      if (entry.isDirectory() && statSync18(target).isDirectory()) {
         mergeInto(source, target, `${name}/`);
         try {
           rmdirSync(source);
@@ -26605,23 +26758,23 @@ function migrateLegacySpool() {
     [legacy.spoolDir(), spoolDir()],
     [legacy.failedDir(), failedDir()]
   ]) {
-    if (!existsSync25(from))
+    if (!existsSync26(from))
       continue;
     try {
-      mkdirSync12(to, { recursive: true });
+      mkdirSync13(to, { recursive: true });
       for (const entry of readdirSync15(from, { withFileTypes: true })) {
         if (!entry.isFile())
           continue;
         let name = entry.name;
         let n = 0;
-        while (existsSync25(resolve19(to, name)))
+        while (existsSync26(resolve19(to, name)))
           name = `legacy-${n++}-${entry.name}`;
         try {
-          renameSync7(resolve19(from, entry.name), resolve19(to, name));
+          renameSync8(resolve19(from, entry.name), resolve19(to, name));
           moved.push(name);
         } catch {
           try {
-            copyFileSync(resolve19(from, entry.name), resolve19(to, name));
+            copyFileSync2(resolve19(from, entry.name), resolve19(to, name));
             moved.push(name);
           } catch {}
         }
@@ -26632,7 +26785,7 @@ function migrateLegacySpool() {
 }
 function migrateHookActivity() {
   const from = legacy.hookActivityDir();
-  if (!existsSync25(from))
+  if (!existsSync26(from))
     return [];
   const moved = [];
   try {
@@ -26640,23 +26793,23 @@ function migrateHookActivity() {
     if (entries.length === 0)
       return [];
     const to = hookActivityDir();
-    mkdirSync12(to, { recursive: true });
+    mkdirSync13(to, { recursive: true });
     const stamp = Date.now();
     let seq = 0;
     for (const entry of entries) {
       const source = resolve19(from, entry.name);
       let name = entry.name === "current.jsonl" ? `page-${stamp}-${seq++}.jsonl` : entry.name;
       let target = resolve19(to, name);
-      while (existsSync25(target)) {
+      while (existsSync26(target)) {
         name = `page-${stamp}-${seq++}.jsonl`;
         target = resolve19(to, name);
       }
       try {
-        renameSync7(source, target);
+        renameSync8(source, target);
         moved.push(name);
       } catch {
         try {
-          copyFileSync(source, target);
+          copyFileSync2(source, target);
           moved.push(name);
         } catch {}
       }
@@ -26687,7 +26840,7 @@ function retirePolicyConfigKeys() {
     delete parsed[key];
   try {
     if (Object.keys(parsed).length === 0)
-      rmSync8(at, { force: true });
+      rmSync9(at, { force: true });
     else
       writeFileSync10(at, JSON.stringify(parsed, null, 2) + `
 `, "utf8");
@@ -26698,7 +26851,7 @@ function retirePolicyConfigKeys() {
 }
 function readCarriedPolicyConfig() {
   const from = resolve19(legacy.localPoliciesDir(), "policies-config.json");
-  if (!existsSync25(from))
+  if (!existsSync26(from))
     return null;
   let parsed;
   try {
@@ -26752,7 +26905,7 @@ function writeCarriedPolicyConfig(carried) {
     }
   } catch {}
   try {
-    mkdirSync12(dirname11(to), { recursive: true });
+    mkdirSync13(dirname12(to), { recursive: true });
     writeFileSync10(to, JSON.stringify({ ...existing, ...carried }, null, 2) + `
 `, "utf8");
   } catch {
@@ -26762,7 +26915,7 @@ function writeCarriedPolicyConfig(carried) {
 }
 function readCarriedTelemetryOptOut() {
   const from = legacy.configToml();
-  if (!existsSync25(from))
+  if (!existsSync26(from))
     return false;
   try {
     const text = readFileSync18(from, "utf8");
@@ -26817,7 +26970,7 @@ function parseLegacyToml(text) {
 }
 function readCarriedLegacyConfig() {
   const from = legacy.configToml();
-  if (!existsSync25(from))
+  if (!existsSync26(from))
     return null;
   try {
     return projectConfig(parseLegacyToml(readFileSync18(from, "utf8")));
@@ -26827,7 +26980,7 @@ function readCarriedLegacyConfig() {
 }
 function readCarriedLegacyCredentials() {
   const toml = legacy.credentialsToml();
-  if (existsSync25(toml)) {
+  if (existsSync26(toml)) {
     try {
       const creds = projectCredentials(parseLegacyToml(readFileSync18(toml, "utf8")));
       if (Object.keys(creds).length > 0)
@@ -26870,10 +27023,10 @@ function resetHome(from, to = LAYOUT_VERSION) {
   const spooled = migrateLegacySpool();
   const removed = [];
   for (const path of resettablePaths()) {
-    if (!existsSync25(path))
+    if (!existsSync26(path))
       continue;
     try {
-      rmSync8(path, { recursive: true, force: true });
+      rmSync9(path, { recursive: true, force: true });
       removed.push(path);
     } catch {}
   }
@@ -26895,7 +27048,7 @@ function layoutWarningForHook() {
   if (state.kind === "future") {
     return `[failproofai] this directory was written by a newer version (layout ${state.found} vs ${LAYOUT_VERSION}) — policies are NOT being enforced. ` + `Upgrade failproofai.`;
   }
-  if (existsSync25(globalPolicyConfigFile()))
+  if (existsSync26(globalPolicyConfigFile()))
     return null;
   return `[failproofai] setup predates this version — global policies are NOT being enforced. ` + `Run \`failproofai config\` to re-create it.`;
 }
@@ -26909,8 +27062,8 @@ var init_fp_reset = __esm(() => {
 });
 
 // src/hooks/semantic/jev-config.ts
-import { closeSync as closeSync2, constants as fsConstants2, fstatSync as fstatSync2, openSync as openSync2, readSync as readSync2, statSync as statSync18 } from "node:fs";
-import { dirname as dirname12 } from "node:path";
+import { closeSync as closeSync3, constants as fsConstants2, fstatSync as fstatSync2, openSync as openSync3, readSync as readSync2, statSync as statSync19 } from "node:fs";
+import { dirname as dirname13 } from "node:path";
 function parseJevMode(raw) {
   return raw === "off" || raw === "observe" || raw === "enforce" ? raw : null;
 }
@@ -27178,7 +27331,7 @@ function looseConfigDirMode(path) {
   if (!modesAreMeaningful())
     return null;
   try {
-    const mode = statSync18(dirname12(path)).mode & 511;
+    const mode = statSync19(dirname13(path)).mode & 511;
     return (mode & DIR_WRITABLE_BY_OTHERS2) !== 0 ? mode : null;
   } catch {
     return null;
@@ -27191,7 +27344,7 @@ function inspectJevConfig() {
   const path = jevConfigPath();
   let fd;
   try {
-    fd = openSync2(path, OPEN_FLAGS);
+    fd = openSync3(path, OPEN_FLAGS);
   } catch (err) {
     const code = err.code;
     if (code === "ENOENT" || code === "ENOTDIR")
@@ -27239,8 +27392,8 @@ function inspectJevConfig() {
         path,
         mode,
         reason: "too-open",
-        problem: `its directory ${dirname12(path)} is ${dirMode.toString(8).padStart(4, "0")} — other users can write there, ` + `so they can put their own config in its place; it must be owner-only (chmod 700 ${dirname12(path)})`,
-        fix: `chmod 700 ${dirname12(path)}`
+        problem: `its directory ${dirname13(path)} is ${dirMode.toString(8).padStart(4, "0")} — other users can write there, ` + `so they can put their own config in its place; it must be owner-only (chmod 700 ${dirname13(path)})`,
+        fix: `chmod 700 ${dirname13(path)}`
       };
     }
     if (st.size > MAX_CONFIG_BYTES)
@@ -27250,7 +27403,7 @@ function inspectJevConfig() {
     return { status: "refused", path, mode, reason: "unreadable", problem: `cannot read it (${err.code ?? "error"})` };
   } finally {
     try {
-      closeSync2(fd);
+      closeSync3(fd);
     } catch {}
   }
   let parsed;
@@ -27346,7 +27499,7 @@ function readJevConfigFileForUpdate() {
   const path = jevConfigPath();
   let fd;
   try {
-    fd = openSync2(path, OPEN_FLAGS);
+    fd = openSync3(path, OPEN_FLAGS);
   } catch {
     return null;
   }
@@ -27373,7 +27526,7 @@ function readJevConfigFileForUpdate() {
     return null;
   } finally {
     try {
-      closeSync2(fd);
+      closeSync3(fd);
     } catch {}
   }
 }
@@ -27404,9 +27557,9 @@ var init_jev_config = __esm(() => {
 });
 
 // src/hooks/semantic/facts.ts
-import { existsSync as existsSync26, readFileSync as readFileSync19, statSync as statSync19 } from "node:fs";
+import { existsSync as existsSync27, readFileSync as readFileSync19, statSync as statSync20 } from "node:fs";
 import { homedir as homedir23 } from "node:os";
-import { dirname as dirname13, isAbsolute as isAbsolute4, resolve as resolve20 } from "node:path";
+import { dirname as dirname14, isAbsolute as isAbsolute4, resolve as resolve20 } from "node:path";
 function classifyTool(toolName) {
   if (SHELL_TOOLS.has(toolName))
     return { toolClass: "shell", toolIsKnown: true };
@@ -27631,9 +27784,9 @@ function findGitDir(start) {
   let dir = start;
   for (let i = 0;i < 40; i++) {
     const candidate = resolve20(dir, ".git");
-    if (existsSync26(candidate))
+    if (existsSync27(candidate))
       return candidate;
-    const parent = dirname13(dir);
+    const parent = dirname14(dir);
     if (parent === dir)
       return null;
     dir = parent;
@@ -27644,7 +27797,7 @@ function findProjectRoot(cwd) {
   if (!cwd)
     return null;
   const gitDir = findGitDir(cwd);
-  return gitDir ? dirname13(gitDir) : cwd;
+  return gitDir ? dirname14(gitDir) : cwd;
 }
 function readCurrentBranch(cwd) {
   if (!cwd)
@@ -27654,12 +27807,12 @@ function readCurrentBranch(cwd) {
     if (!gitPath)
       return null;
     let headFile = resolve20(gitPath, "HEAD");
-    if (statSync19(gitPath).isFile()) {
+    if (statSync20(gitPath).isFile()) {
       const pointer = readFileSync19(gitPath, "utf8").trim();
       const m = /^gitdir:\s*(.+)$/.exec(pointer);
       if (!m)
         return null;
-      headFile = resolve20(dirname13(gitPath), m[1], "HEAD");
+      headFile = resolve20(dirname14(gitPath), m[1], "HEAD");
     }
     const head = readFileSync19(headFile, "utf8").trim();
     const ref = /^ref:\s*refs\/heads\/(.+)$/.exec(head);
@@ -28049,19 +28202,19 @@ __export(exports_intent, {
   readIntent: () => readIntent
 });
 import {
-  chmodSync as chmodSync4,
-  closeSync as closeSync3,
-  mkdirSync as mkdirSync13,
-  openSync as openSync3,
+  chmodSync as chmodSync5,
+  closeSync as closeSync4,
+  mkdirSync as mkdirSync14,
+  openSync as openSync4,
   readdirSync as readdirSync16,
   readFileSync as readFileSync20,
   readSync as readSync3,
-  renameSync as renameSync8,
-  statSync as statSync20,
+  renameSync as renameSync9,
+  statSync as statSync21,
   unlinkSync as unlinkSync4,
   writeFileSync as writeFileSync11
 } from "node:fs";
-import { dirname as dirname14, resolve as resolve21 } from "node:path";
+import { dirname as dirname15, resolve as resolve21 } from "node:path";
 function modesAreMeaningful2() {
   return process.platform !== "win32";
 }
@@ -28073,7 +28226,7 @@ function storeDirChain() {
     chain.push(dir);
     if (dir === home)
       break;
-    const parent = dirname14(dir);
+    const parent = dirname15(dir);
     if (parent === dir)
       break;
     dir = parent;
@@ -28086,15 +28239,15 @@ function looseIntentStoreDir() {
   for (const dir of storeDirChain()) {
     let mode;
     try {
-      mode = statSync20(dir).mode & 511;
+      mode = statSync21(dir).mode & 511;
     } catch {
       continue;
     }
     if ((mode & DIR_WRITABLE_BY_OTHERS3) === 0)
       continue;
     try {
-      chmodSync4(dir, mode & ~DIR_WRITABLE_BY_OTHERS3);
-      if ((statSync20(dir).mode & DIR_WRITABLE_BY_OTHERS3) !== 0)
+      chmodSync5(dir, mode & ~DIR_WRITABLE_BY_OTHERS3);
+      if ((statSync21(dir).mode & DIR_WRITABLE_BY_OTHERS3) !== 0)
         return dir;
     } catch {
       return dir;
@@ -28117,12 +28270,12 @@ function appendPrompt(sessionId, entry) {
     const kept = last && last.text === entry.text ? file.prompts.slice(0, -1) : file.prompts;
     file.prompts = [...kept, entry].slice(-MAX_RECORDED_PROMPTS);
     const dir = sessionsDir();
-    mkdirSync13(dir, { recursive: true, mode: 448 });
+    mkdirSync14(dir, { recursive: true, mode: 448 });
     const target = intentFile(sessionId);
     const isNew = !fileExists2(target);
     const tmp = `${target}.${process.pid}.tmp`;
     writeFileSync11(tmp, JSON.stringify(file), { mode: 384 });
-    renameSync8(tmp, target);
+    renameSync9(tmp, target);
     if (isNew)
       pruneExpiredSessions(entry.at);
     return true;
@@ -28132,7 +28285,7 @@ function appendPrompt(sessionId, entry) {
 }
 function fileExists2(path) {
   try {
-    statSync20(path);
+    statSync21(path);
     return true;
   } catch {
     return false;
@@ -28147,7 +28300,7 @@ function pruneExpiredSessions(now = Date.now()) {
         continue;
       const path = resolve21(dir, name);
       try {
-        const st = statSync20(path);
+        const st = statSync21(path);
         if (st.isFile() && now - st.mtimeMs > INTENT_MAX_AGE_MS) {
           unlinkSync4(path);
           removed++;
@@ -28456,10 +28609,10 @@ function visitLinesBackwards(transcriptPath, maxBytes, visit) {
     return;
   let fd;
   try {
-    const st = statSync20(path);
+    const st = statSync21(path);
     if (!st.isFile() || st.size === 0)
       return;
-    fd = openSync3(path, "r");
+    fd = openSync4(path, "r");
     let end = st.size;
     let consumed = 0;
     let partial = Buffer.alloc(0);
@@ -28494,7 +28647,7 @@ function visitLinesBackwards(transcriptPath, maxBytes, visit) {
   } catch {} finally {
     if (fd !== undefined) {
       try {
-        closeSync3(fd);
+        closeSync4(fd);
       } catch {}
     }
   }
@@ -29084,7 +29237,7 @@ var init_jev_client = __esm(() => {
 
 // src/hooks/semantic/evaluator.ts
 import { createHash as createHash8 } from "node:crypto";
-import { appendFileSync as appendFileSync3, mkdirSync as mkdirSync14, renameSync as renameSync9, statSync as statSync21 } from "node:fs";
+import { appendFileSync as appendFileSync3, mkdirSync as mkdirSync15, renameSync as renameSync10, statSync as statSync22 } from "node:fs";
 import { resolve as resolve22 } from "node:path";
 function storeCut(message) {
   return typeof message === "string" && message.length >= MAX_USER_MESSAGE_CHARS - STORE_CUT_SLACK && OMISSION_MARK.test(message);
@@ -29256,10 +29409,10 @@ function verdictLogRow(input, outcome, meta) {
 function appendVerdictLog(row) {
   try {
     const file = verdictLogFile();
-    mkdirSync14(semanticDir(), { recursive: true, mode: 448 });
+    mkdirSync15(semanticDir(), { recursive: true, mode: 448 });
     try {
-      if (statSync21(file).size > VERDICT_LOG_MAX_BYTES)
-        renameSync9(file, `${file}.1`);
+      if (statSync22(file).size > VERDICT_LOG_MAX_BYTES)
+        renameSync10(file, `${file}.1`);
     } catch {}
     appendFileSync3(file, JSON.stringify(row) + `
 `, { mode: 384 });
@@ -29489,7 +29642,7 @@ var init_jev_throttle = __esm(() => {
 });
 
 // src/hooks/semantic/session-root.ts
-import { mkdirSync as mkdirSync15, readdirSync as readdirSync17, readFileSync as readFileSync21, statSync as statSync22, unlinkSync as unlinkSync5, writeFileSync as writeFileSync12 } from "node:fs";
+import { mkdirSync as mkdirSync16, readdirSync as readdirSync17, readFileSync as readFileSync21, statSync as statSync23, unlinkSync as unlinkSync5, writeFileSync as writeFileSync12 } from "node:fs";
 import { isAbsolute as isAbsolute5, resolve as resolve23 } from "node:path";
 function validRoot(v) {
   return typeof v === "string" && isAbsolute5(v) && resolve23(v) === v && v !== "/";
@@ -29500,7 +29653,7 @@ function storeIsOurs() {
   if (looseIntentStoreDir() !== null)
     return false;
   try {
-    const mode = statSync22(rootsDir()).mode & 511;
+    const mode = statSync23(rootsDir()).mode & 511;
     return (mode & DIR_WRITABLE_BY_OTHERS4) === 0;
   } catch {
     return true;
@@ -29523,7 +29676,7 @@ function pruneSessionRoots(now = Date.now()) {
         continue;
       const path = resolve23(dir, name);
       try {
-        const st = statSync22(path);
+        const st = statSync23(path);
         if (st.isFile() && now - st.mtimeMs > SESSION_ROOT_MAX_AGE_MS) {
           unlinkSync5(path);
           removed++;
@@ -29547,7 +29700,7 @@ function sessionProjectRoot(sessionId, cwd, now = Date.now()) {
       return pinned;
     if (!validRoot(live))
       return live;
-    mkdirSync15(rootsDir(), { recursive: true, mode: 448 });
+    mkdirSync16(rootsDir(), { recursive: true, mode: 448 });
     writeFileSync12(rootFile(sessionId), JSON.stringify({ root: live, at: now }), { mode: 384, flag: "wx" });
     pruneSessionRoots(now);
   } catch {}
@@ -29873,7 +30026,7 @@ var init_enforcement_capability = __esm(() => {
 });
 
 // src/hooks/handler.ts
-import { existsSync as existsSync27 } from "node:fs";
+import { existsSync as existsSync28 } from "node:fs";
 function canonicalizeEventType(raw, cli) {
   if (cli === "codex") {
     const mapped = CODEX_EVENT_MAP[raw];
@@ -29933,7 +30086,7 @@ function jevForcedOff(opts) {
 }
 async function readJevConfig() {
   try {
-    if (!existsSync27(jevConfigFile()))
+    if (!existsSync28(jevConfigFile()))
       return null;
     await Promise.resolve().then(() => init_jev_config());
     const config = loadJevConfig();
@@ -31045,18 +31198,18 @@ var init_collector_config = __esm(() => {
 });
 
 // src/hooks/flush-cli.ts
-import { existsSync as existsSync28, mkdirSync as mkdirSync16, writeFileSync as writeFileSync13, readdirSync as readdirSync18 } from "node:fs";
-import { dirname as dirname15, join as join31 } from "node:path";
+import { existsSync as existsSync29, mkdirSync as mkdirSync17, writeFileSync as writeFileSync13, readdirSync as readdirSync18 } from "node:fs";
+import { dirname as dirname16, join as join32 } from "node:path";
 function flushRequestPath(home) {
-  return join31(failproofaiHome(home), "state", "flush-request.json");
+  return join32(failproofaiHome(home), "state", "flush-request.json");
 }
 function spoolDirs(home) {
   const root = spoolDir(home);
   const dirs = [root, customAgentsEventsDir(home)];
-  if (!existsSync28(root))
+  if (!existsSync29(root))
     return dirs;
   try {
-    return dirs.concat(readdirSync18(root, { withFileTypes: true }).filter((e) => e.isDirectory() && e.name !== "failed").map((e) => join31(root, e.name)));
+    return dirs.concat(readdirSync18(root, { withFileTypes: true }).filter((e) => e.isDirectory() && e.name !== "failed").map((e) => join32(root, e.name)));
   } catch {
     return dirs;
   }
@@ -31134,7 +31287,7 @@ async function runFlushCommand(opts = {}) {
     return { exitCode: 0, pending: 0, lines: nothing };
   }
   const path = flushRequestPath(home);
-  mkdirSync16(dirname15(path), { recursive: true });
+  mkdirSync17(dirname16(path), { recursive: true });
   writeFileSync13(path, `${JSON.stringify({ requestedAtMs: Date.now() }, null, 2)}
 `, {
     mode: 384
@@ -31169,16 +31322,16 @@ var init_flush_cli = __esm(() => {
 
 // src/hooks/migrations.ts
 import {
-  chmodSync as chmodSync5,
-  copyFileSync as copyFileSync2,
-  existsSync as existsSync29,
-  mkdirSync as mkdirSync17,
+  chmodSync as chmodSync6,
+  copyFileSync as copyFileSync3,
+  existsSync as existsSync30,
+  mkdirSync as mkdirSync18,
   readFileSync as readFileSync22,
-  renameSync as renameSync10,
-  rmSync as rmSync9,
+  renameSync as renameSync11,
+  rmSync as rmSync10,
   writeFileSync as writeFileSync14
 } from "node:fs";
-import { basename as basename6, dirname as dirname16, join as join32, resolve as resolve24 } from "node:path";
+import { basename as basename7, dirname as dirname17, join as join33, resolve as resolve24 } from "node:path";
 function migrateToLayout4() {
   const moves = [
     { from: legacy.authJson(), to: auditSessionFile() },
@@ -31187,40 +31340,40 @@ function migrateToLayout4() {
   ];
   const authDirOverride = process.env.FAILPROOFAI_AUTH_DIR;
   if (authDirOverride) {
-    moves.push({ from: join32(authDirOverride, "auth.json"), to: join32(authDirOverride, "session.json") }, {
-      from: join32(authDirOverride, "next-audit.json"),
-      to: join32(authDirOverride, "reminder.json")
+    moves.push({ from: join33(authDirOverride, "auth.json"), to: join33(authDirOverride, "session.json") }, {
+      from: join33(authDirOverride, "next-audit.json"),
+      to: join33(authDirOverride, "reminder.json")
     });
   }
   const migrated = [];
   for (const { from, to } of moves) {
-    if (!existsSync29(from))
+    if (!existsSync30(from))
       continue;
-    if (existsSync29(to)) {
-      rmSync9(from, { force: true });
+    if (existsSync30(to)) {
+      rmSync10(from, { force: true });
       continue;
     }
-    mkdirSync17(dirname16(to), { recursive: true });
+    mkdirSync18(dirname17(to), { recursive: true });
     try {
-      renameSync10(from, to);
+      renameSync11(from, to);
     } catch {
       try {
-        copyFileSync2(from, to);
+        copyFileSync3(from, to);
       } catch (err) {
         try {
-          rmSync9(to, { force: true });
+          rmSync10(to, { force: true });
         } catch {}
         throw err;
       }
-      rmSync9(from, { force: true });
+      rmSync10(from, { force: true });
     }
-    migrated.push(`${basename6(from)} → audit/${basename6(to)}`);
+    migrated.push(`${basename7(from)} → audit/${basename7(to)}`);
   }
   for (const secret of [auditSessionFile()]) {
-    if (!existsSync29(secret))
+    if (!existsSync30(secret))
       continue;
     try {
-      chmodSync5(secret, 384);
+      chmodSync6(secret, 384);
     } catch {}
   }
   writeVersionFile({ layout: 4 });
@@ -31251,26 +31404,26 @@ function readLedger() {
 }
 function appendLedger(entry) {
   try {
-    mkdirSync17(migrationsDir(), { recursive: true });
+    mkdirSync18(migrationsDir(), { recursive: true });
     const all = [...readLedger(), entry];
     writeFileSync14(migrationLedgerFile(), `${JSON.stringify(all, null, 2)}
 `, "utf8");
   } catch {}
 }
 function backupNameOf(f) {
-  return f.as ?? basename6(f.at());
+  return f.as ?? basename7(f.at());
 }
 function pruneMigratedCredentials(from) {
   const pruned = [];
   for (let layout = from;layout < LAYOUT_VERSION; layout++) {
     for (const { as, landsAt } of PRUNED_AFTER_SUCCESS) {
       try {
-        if (!existsSync29(landsAt()))
+        if (!existsSync30(landsAt()))
           continue;
         const copy = resolve24(migrationBackupDir(layout), as);
-        if (!existsSync29(copy))
+        if (!existsSync30(copy))
           continue;
-        rmSync9(copy, { force: true });
+        rmSync10(copy, { force: true });
         pruned.push(as);
       } catch {}
     }
@@ -31281,7 +31434,7 @@ function filesToBackUp() {
   const seen = new Map;
   for (const f of [...BACKED_UP, ...BACKED_UP_LEGACY]) {
     const path = f.at();
-    if (existsSync29(path))
+    if (existsSync30(path))
       seen.set(path, backupNameOf(f));
   }
   return [...seen].map(([path, as]) => ({ path, as }));
@@ -31290,14 +31443,14 @@ function backupBeforeMigrating(from) {
   const dir = migrationBackupDir(from);
   const saved = [];
   try {
-    rmSync9(dir, { recursive: true, force: true });
-    mkdirSync17(dir, { recursive: true });
+    rmSync10(dir, { recursive: true, force: true });
+    mkdirSync18(dir, { recursive: true });
   } catch {
     return [];
   }
   for (const { path: source, as } of filesToBackUp()) {
     try {
-      copyFileSync2(source, resolve24(dir, as));
+      copyFileSync3(source, resolve24(dir, as));
       saved.push(as);
     } catch {}
   }
@@ -31407,7 +31560,7 @@ var init_migrations = __esm(() => {
     { at: legacy.auditSchedule }
   ];
   PRUNED_AFTER_SUCCESS = [
-    { as: basename6(legacy.authJson()), landsAt: auditSessionFile }
+    { as: basename7(legacy.authJson()), landsAt: auditSessionFile }
   ];
 });
 
@@ -31587,15 +31740,15 @@ var init_fp_reset2 = __esm(() => {
 // scripts/install-telemetry.mjs
 import { createHmac, randomUUID as randomUUID2 } from "node:crypto";
 import { execSync as execSync5 } from "node:child_process";
-import { readFileSync as readFileSync23, writeFileSync as writeFileSync15, mkdirSync as mkdirSync18 } from "node:fs";
+import { readFileSync as readFileSync23, writeFileSync as writeFileSync15, mkdirSync as mkdirSync19 } from "node:fs";
 import { homedir as homedir24, platform, arch, hostname, cpus } from "node:os";
-import { join as join33 } from "node:path";
+import { join as join34 } from "node:path";
 function hashToId3(raw) {
   return createHmac("sha256", NAMESPACE3).update(raw).digest("hex");
 }
 function getInstanceId3() {
-  const idDir = join33(homedir24(), ".failproofai");
-  const idFile = join33(idDir, "instance-id");
+  const idDir = join34(homedir24(), ".failproofai");
+  const idFile = join34(idDir, "instance-id");
   try {
     const existing = readFileSync23(idFile, "utf-8").trim();
     if (existing)
@@ -31638,7 +31791,7 @@ function getInstanceId3() {
   } catch {}
   const id = randomUUID2();
   try {
-    mkdirSync18(idDir, { recursive: true });
+    mkdirSync19(idDir, { recursive: true });
     writeFileSync15(idFile, id, "utf-8");
   } catch {}
   return id;
@@ -31671,8 +31824,8 @@ var NAMESPACE3 = "failproofai-telemetry-v1", API_KEY3 = "phc_Ac1Ww1GqKc0z1SyrRWb
 var init_install_telemetry = () => {};
 
 // lib/install-check.ts
-import { existsSync as existsSync30, readFileSync as readFileSync24, writeFileSync as writeFileSync16, mkdirSync as mkdirSync19 } from "node:fs";
-import { dirname as dirname17, resolve as resolve25 } from "node:path";
+import { existsSync as existsSync31, readFileSync as readFileSync24, writeFileSync as writeFileSync16, mkdirSync as mkdirSync20 } from "node:fs";
+import { dirname as dirname18, resolve as resolve25 } from "node:path";
 import { platform as platform2, arch as arch2, release, homedir as homedir25, hostname as hostname2 } from "node:os";
 import { createHmac as createHmac2 } from "node:crypto";
 function hashToId4(raw) {
@@ -31727,7 +31880,7 @@ function compareSemver2(a, b) {
 }
 function checkHooks() {
   const hooksConfigPath = globalPolicyConfigFile();
-  if (!existsSync30(hooksConfigPath)) {
+  if (!existsSync31(hooksConfigPath)) {
     return { configured: false, registered: false, policyCount: 0 };
   }
   let config;
@@ -31741,7 +31894,7 @@ function checkHooks() {
   }
   const policyCount = config.enabledPolicies.length;
   const settingsPath = resolve25(homedir25(), ".claude", "settings.json");
-  if (!existsSync30(settingsPath))
+  if (!existsSync31(settingsPath))
     return { configured: true, registered: false, policyCount };
   let settings;
   try {
@@ -31769,7 +31922,7 @@ async function maybeReportInstall(version) {
     const versionFile = lastVersionPath();
     let previousVersion = null;
     try {
-      if (existsSync30(versionFile)) {
+      if (existsSync31(versionFile)) {
         previousVersion = readFileSync24(versionFile, "utf8").trim() || null;
       }
     } catch {}
@@ -31806,7 +31959,7 @@ async function maybeReportInstall(version) {
       enabled_policy_count: hooks.policyCount
     }, { version, timeoutMs: REPORT_TIMEOUT_MS, enabled: telemetryEnabled }));
     try {
-      mkdirSync19(dirname17(versionFile), { recursive: true });
+      mkdirSync20(dirname18(versionFile), { recursive: true });
       writeFileSync16(versionFile, version, "utf8");
     } catch {}
     await Promise.all(events.map((p) => p.catch(() => {})));
@@ -31858,8 +32011,8 @@ var init_cli_error = __esm(() => {
 
 // src/hooks/manager.ts
 import { execSync as execSync6 } from "node:child_process";
-import { existsSync as existsSync31 } from "node:fs";
-import { resolve as resolve26, basename as basename7 } from "node:path";
+import { existsSync as existsSync32 } from "node:fs";
+import { resolve as resolve26, basename as basename8 } from "node:path";
 import { platform as platform3, arch as arch3, release as release2, hostname as hostname3 } from "node:os";
 function getSettingsPath(scope, cwd) {
   return claudeCode.getSettingsPath(scope, cwd);
@@ -32090,7 +32243,7 @@ async function installHooksImpl(policyNames, scope = "user", cwd, includeBeta =
   } else if (customPoliciesPath && (typeof customPoliciesPath === "string" || customPoliciesPath.length > 0)) {
     const incoming = (typeof customPoliciesPath === "string" ? [customPoliciesPath] : customPoliciesPath).map((path) => resolve26(path));
     const carried = (previousConfig.customPoliciesPaths ?? (previousConfig.customPoliciesPath ? [previousConfig.customPoliciesPath] : [])).map((path) => resolve26(path)).filter((path) => {
-      if (existsSync31(path))
+      if (existsSync32(path))
         return true;
       console.log(`Dropping custom policies path (file no longer exists): ${path}`);
       return false;
@@ -32322,7 +32475,7 @@ async function removeHooks(policyNames, scope = "user", cwd, opts) {
     const scopesToRemove = scope === "all" ? [...integration.scopes] : integration.scopes.includes(scope) ? [scope] : [];
     for (const s of scopesToRemove) {
       const settingsPaths = settingsPathsFor(integration, s, cwd);
-      const existing = cliId === "hermes" ? settingsPaths : settingsPaths.filter((p) => existsSync31(p));
+      const existing = cliId === "hermes" ? settingsPaths : settingsPaths.filter((p) => existsSync32(p));
       if (existing.length === 0) {
         if (scope !== "all" && selectedClis.length === 1) {
           console.log("No settings file found. Nothing to remove.");
@@ -32427,7 +32580,7 @@ var DEFAULT_FETCH_TIMEOUT_MS = 15000;
 
 // src/hooks/cloud-enrollment.ts
 import { randomUUID as randomUUID3 } from "node:crypto";
-import { existsSync as existsSync32, readFileSync as readFileSync25, rmSync as rmSync10 } from "node:fs";
+import { existsSync as existsSync33, readFileSync as readFileSync25, rmSync as rmSync11 } from "node:fs";
 import { hostname as hostname4 } from "node:os";
 function cloudCredentialPath() {
   return process.env.FAILPROOFAI_CLOUD_CREDENTIALS ?? credentialsFile();
@@ -32466,7 +32619,7 @@ function readCloudCredentials() {
   if (!usingJsonOverride())
     return readCredentials().cloud ?? null;
   const path = cloudCredentialPath();
-  if (!existsSync32(path))
+  if (!existsSync33(path))
     return null;
   try {
     const raw = JSON.parse(readFileSync25(path, "utf8"));
@@ -32508,10 +32661,10 @@ function resolveMachineLabel(explicit) {
 function clearCloudCredentials() {
   if (usingJsonOverride()) {
     const path = cloudCredentialPath();
-    if (!existsSync32(path))
+    if (!existsSync33(path))
       return false;
     try {
-      rmSync10(path);
+      rmSync11(path);
       return true;
     } catch {
       return false;
@@ -32631,25 +32784,25 @@ var INTROSPECT_PATH = "/v1/auth/introspect", PERMISSION_EVENTS = "events:add", P
 
 // src/hooks/jev-cloud-connection.ts
 import {
-  chmodSync as chmodSync6,
-  closeSync as closeSync4,
+  chmodSync as chmodSync7,
+  closeSync as closeSync5,
   constants as fsConstants3,
-  existsSync as existsSync33,
+  existsSync as existsSync34,
   fstatSync as fstatSync3,
   linkSync,
-  lstatSync as lstatSync2,
-  mkdirSync as mkdirSync20,
-  openSync as openSync4,
+  lstatSync as lstatSync3,
+  mkdirSync as mkdirSync21,
+  openSync as openSync5,
   readFileSync as readFileSync26,
   readSync as readSync4,
-  renameSync as renameSync11,
-  rmSync as rmSync11,
-  statSync as statSync23,
+  renameSync as renameSync12,
+  rmSync as rmSync12,
+  statSync as statSync24,
   unlinkSync as unlinkSync6,
   writeFileSync as writeFileSync17
 } from "node:fs";
-import { dirname as dirname18 } from "node:path";
-import { randomBytes as randomBytes2 } from "node:crypto";
+import { dirname as dirname19 } from "node:path";
+import { randomBytes as randomBytes3 } from "node:crypto";
 function writeCloudJevConfigIfAbsent(cloudBase) {
   const path = jevConfigPath();
   let baseUrl;
@@ -32658,17 +32811,17 @@ function writeCloudJevConfigIfAbsent(cloudBase) {
   } catch {
     return { status: "error", path, problem: "the FailproofAI Cloud URL is not a URL" };
   }
-  if (existsSync33(path))
+  if (existsSync34(path))
     return kept(path, cloudBase);
   const body = `${JSON.stringify({ provider: JEV_CLOUD_PROVIDER, baseUrl, mode: CLOUD_JEV_INITIAL_MODE }, null, 2)}
 `;
-  const dir = dirname18(path);
-  const tmp = `${path}.${process.pid}.${randomBytes2(6).toString("hex")}.tmp`;
+  const dir = dirname19(path);
+  const tmp = `${path}.${process.pid}.${randomBytes3(6).toString("hex")}.tmp`;
   try {
-    if (!existsSync33(dir))
-      mkdirSync20(dir, { recursive: true, mode: 448 });
+    if (!existsSync34(dir))
+      mkdirSync21(dir, { recursive: true, mode: 448 });
     writeFileSync17(tmp, body, { mode: 384, flag: "wx" });
-    chmodSync6(tmp, 384);
+    chmodSync7(tmp, 384);
     try {
       linkSync(tmp, path);
     } catch (err) {
@@ -32680,7 +32833,7 @@ function writeCloudJevConfigIfAbsent(cloudBase) {
     return { status: "error", path, problem: `could not write ${path} (${err.code ?? "error"})` };
   } finally {
     try {
-      rmSync11(tmp, { force: true });
+      rmSync12(tmp, { force: true });
     } catch {}
   }
   tightenDir(dir);
@@ -32688,7 +32841,7 @@ function writeCloudJevConfigIfAbsent(cloudBase) {
 }
 function existingJevConfig(cloudBase) {
   const path = jevConfigPath();
-  return existsSync33(path) ? kept(path, cloudBase) : null;
+  return existsSync34(path) ? kept(path, cloudBase) : null;
 }
 function cloudJevRunningMode() {
   try {
@@ -32727,16 +32880,16 @@ function tightenDir(dir) {
   if (process.platform === "win32")
     return;
   try {
-    const before = statSync23(dir).mode & 511;
+    const before = statSync24(dir).mode & 511;
     if ((before & 18) !== 0)
-      chmodSync6(dir, before & ~18);
+      chmodSync7(dir, before & ~18);
   } catch {}
 }
 function removeCloudJevConfig() {
   const path = jevConfigPath();
   let st;
   try {
-    st = lstatSync2(path);
+    st = lstatSync3(path);
   } catch (err) {
     const code = err.code;
     if (code === "ENOENT" || code === "ENOTDIR")
@@ -32745,9 +32898,9 @@ function removeCloudJevConfig() {
   }
   if (!st.isFile())
     return { status: "kept", path, provider: null };
-  const aside = `${path}.${process.pid}.${randomBytes2(6).toString("hex")}.disconnecting`;
+  const aside = `${path}.${process.pid}.${randomBytes3(6).toString("hex")}.disconnecting`;
   try {
-    renameSync11(path, aside);
+    renameSync12(path, aside);
   } catch (err) {
     const code = err.code;
     if (code === "ENOENT")
@@ -32788,12 +32941,12 @@ function putBack(aside, path, mode) {
   let created = false;
   try {
     const bytes = readFileSync26(aside);
-    const fd = openSync4(path, "wx", mode);
+    const fd = openSync5(path, "wx", mode);
     created = true;
     try {
       writeFileSync17(fd, bytes);
     } finally {
-      closeSync4(fd);
+      closeSync5(fd);
     }
     discard(aside);
     return "restored";
@@ -32804,14 +32957,14 @@ function putBack(aside, path, mode) {
       return { code: codeOf(err) };
   }
   try {
-    lstatSync2(path);
+    lstatSync3(path);
     return "occupied";
   } catch (err) {
     if (codeOf(err) !== "ENOENT")
       return { code: codeOf(err) };
   }
   try {
-    renameSync11(aside, path);
+    renameSync12(aside, path);
     return "restored";
   } catch (err) {
     return { code: codeOf(err) };
@@ -32826,7 +32979,7 @@ function fieldsOf(file) {
   const none = { provider: null, off: false };
   let fd;
   try {
-    fd = openSync4(file, fsConstants3.O_RDONLY | (fsConstants3.O_NONBLOCK ?? 0) | (fsConstants3.O_NOFOLLOW ?? 0));
+    fd = openSync5(file, fsConstants3.O_RDONLY | (fsConstants3.O_NONBLOCK ?? 0) | (fsConstants3.O_NOFOLLOW ?? 0));
   } catch {
     return none;
   }
@@ -32849,7 +33002,7 @@ function fieldsOf(file) {
     return none;
   } finally {
     try {
-      closeSync4(fd);
+      closeSync5(fd);
     } catch {}
   }
 }
@@ -33067,8 +33220,8 @@ var init_cloud_connection = __esm(() => {
 });
 
 // src/hooks/setup-state.ts
-import { existsSync as existsSync34, realpathSync as realpathSync3, statSync as statSync24 } from "node:fs";
-import { dirname as dirname19, resolve as resolve27 } from "node:path";
+import { existsSync as existsSync35, realpathSync as realpathSync4, statSync as statSync25 } from "node:fs";
+import { dirname as dirname20, resolve as resolve27 } from "node:path";
 import { homedir as homedir26 } from "node:os";
 function globalConfigPath(home = homedir26()) {
   return globalPolicyConfigFile(home);
@@ -33081,7 +33234,7 @@ function legacyMarkerPath(home) {
 }
 function isDir(path) {
   try {
-    return statSync24(path).isDirectory();
+    return statSync25(path).isDirectory();
   } catch {
     return false;
   }
@@ -33092,7 +33245,7 @@ function findProjectRoot2(start, home = homedir26()) {
   while (dir !== resolvedHome) {
     if (isDir(resolve27(dir, ".failproofai")))
       return dir;
-    const parent = dirname19(dir);
+    const parent = dirname20(dir);
     if (parent === dir)
       break;
     dir = parent;
@@ -33111,7 +33264,7 @@ function hasGlobalHooksInstalled() {
 function realResolve(path) {
   const lexical = resolve27(path);
   try {
-    return realpathSync3(lexical);
+    return realpathSync4(lexical);
   } catch {
     return lexical;
   }
@@ -33124,10 +33277,10 @@ function detectSetupState(cwd = process.cwd(), home = homedir26()) {
     cwd: resolvedCwd,
     home: resolvedHome,
     projectRoot,
-    hasGlobalConfig: existsSync34(globalConfigPath(resolvedHome)),
-    hasProjectConfig: projectRoot !== resolvedHome && existsSync34(projectConfigPath(projectRoot)),
+    hasGlobalConfig: existsSync35(globalConfigPath(resolvedHome)),
+    hasProjectConfig: projectRoot !== resolvedHome && existsSync35(projectConfigPath(projectRoot)),
     hasGlobalHooks: hasGlobalHooksInstalled(),
-    hasLegacyMarker: existsSync34(legacyMarkerPath(resolvedHome)),
+    hasLegacyMarker: existsSync35(legacyMarkerPath(resolvedHome)),
     inHomeDir: resolvedCwd === resolvedHome
   };
 }
@@ -33144,11 +33297,11 @@ var init_setup_state = __esm(() => {
 });
 
 // src/hooks/onboarding-attempt.ts
-import { existsSync as existsSync35, mkdirSync as mkdirSync21, readFileSync as readFileSync27, rmSync as rmSync12, writeFileSync as writeFileSync18 } from "node:fs";
-import { dirname as dirname20 } from "node:path";
+import { existsSync as existsSync36, mkdirSync as mkdirSync22, readFileSync as readFileSync27, rmSync as rmSync13, writeFileSync as writeFileSync18 } from "node:fs";
+import { dirname as dirname21 } from "node:path";
 function readOnboardingAttempt() {
   const path = onboardingAttemptFile();
-  if (!existsSync35(path))
+  if (!existsSync36(path))
     return null;
   try {
     const raw = JSON.parse(readFileSync27(path, "utf8"));
@@ -33170,7 +33323,7 @@ function readOnboardingAttempt() {
 function recordOnboardingAttempt(reason, cliVersion, daemonStatus, now = Date.now()) {
   try {
     const path = onboardingAttemptFile();
-    mkdirSync21(dirname20(path), { recursive: true });
+    mkdirSync22(dirname21(path), { recursive: true });
     const record = {
       schemaVersion: SCHEMA_VERSION3,
       reason,
@@ -33183,7 +33336,7 @@ function recordOnboardingAttempt(reason, cliVersion, daemonStatus, now = Date.no
 }
 function clearOnboardingAttempt() {
   try {
-    rmSync12(onboardingAttemptFile(), { force: true });
+    rmSync13(onboardingAttemptFile(), { force: true });
   } catch {}
 }
 function blockerCleared(attempt, probe) {
@@ -33225,7 +33378,7 @@ var init_onboarding_attempt = __esm(() => {
 });
 
 // src/hooks/onboarding-lock.ts
-import { mkdirSync as mkdirSync22, readFileSync as readFileSync28, rmSync as rmSync13, writeFileSync as writeFileSync19 } from "node:fs";
+import { mkdirSync as mkdirSync23, readFileSync as readFileSync28, rmSync as rmSync14, writeFileSync as writeFileSync19 } from "node:fs";
 import { homedir as homedir27 } from "node:os";
 function onboardingLockPath(home = homedir27()) {
   return onboardingLockFile(home);
@@ -33256,7 +33409,7 @@ function acquireOnboardingLock(home = homedir27()) {
     const held = readLock(path);
     if (held && held.pid !== process.pid && processAlive(held.pid))
       return null;
-    mkdirSync22(stateDir(home), { recursive: true });
+    mkdirSync23(stateDir(home), { recursive: true });
     const body = { pid: process.pid, startedAt: Date.now() };
     writeFileSync19(path, JSON.stringify(body), "utf8");
     let released = false;
@@ -33268,7 +33421,7 @@ function acquireOnboardingLock(home = homedir27()) {
         try {
           const current = readLock(path);
           if (!current || current.pid === process.pid)
-            rmSync13(path, { force: true });
+            rmSync14(path, { force: true });
         } catch {}
       }
     };
@@ -33281,8 +33434,8 @@ var init_onboarding_lock = __esm(() => {
 });
 
 // lib/claude-sessions.ts
-import { readdirSync as readdirSync19, statSync as statSync25, existsSync as existsSync36 } from "node:fs";
-import { join as join34, basename as basename8 } from "node:path";
+import { readdirSync as readdirSync19, statSync as statSync26, existsSync as existsSync37 } from "node:fs";
+import { join as join35, basename as basename9 } from "node:path";
 function getClaudeProjectsRoot() {
   return getClaudeProjectsPath();
 }
@@ -33297,7 +33450,7 @@ function listClaudeProjects() {
   return entries.filter((e) => e.isDirectory()).map((e) => ({
     name: e.name,
     cwd: decodeFolderName(e.name),
-    path: join34(root, e.name)
+    path: join35(root, e.name)
   }));
 }
 function listClaudeTranscripts(project) {
@@ -33313,9 +33466,9 @@ function listClaudeTranscripts(project) {
       const sessionId = entry.name.slice(0, -".jsonl".length);
       if (!UUID_RE2.test(sessionId))
         continue;
-      const transcriptPath = join34(project.path, entry.name);
+      const transcriptPath = join35(project.path, entry.name);
       try {
-        const s = statSync25(transcriptPath);
+        const s = statSync26(transcriptPath);
         out.push({
           projectName: project.name,
           cwd: project.cwd,
@@ -33327,8 +33480,8 @@ function listClaudeTranscripts(project) {
         });
       } catch {}
     } else if (entry.isDirectory() && UUID_RE2.test(entry.name)) {
-      const subDir = join34(project.path, entry.name, "subagents");
-      if (!existsSync36(subDir))
+      const subDir = join35(project.path, entry.name, "subagents");
+      if (!existsSync37(subDir))
         continue;
       let subEntries;
       try {
@@ -33340,9 +33493,9 @@ function listClaudeTranscripts(project) {
         if (!sub.isFile() || !sub.name.endsWith(".jsonl"))
           continue;
         const agentId = sub.name.slice(0, -".jsonl".length);
-        const transcriptPath = join34(subDir, sub.name);
+        const transcriptPath = join35(subDir, sub.name);
         try {
-          const s = statSync25(transcriptPath);
+          const s = statSync26(transcriptPath);
           out.push({
             projectName: project.name,
             cwd: project.cwd,
@@ -33558,7 +33711,7 @@ var init_claude = __esm(() => {
 });
 
 // src/audit/cli-adapters/codex.ts
-import { statSync as statSync26 } from "node:fs";
+import { statSync as statSync27 } from "node:fs";
 async function listCodexTranscriptMetadata(opts = {}) {
   const projectFilter = opts.projects ? new Set(opts.projects) : null;
   const sinceMs = opts.sinceMs ?? 0;
@@ -33575,7 +33728,7 @@ async function listCodexTranscriptMetadata(opts = {}) {
         continue;
       let sizeBytes = 0;
       try {
-        sizeBytes = statSync26(s.path).size;
+        sizeBytes = statSync27(s.path).size;
       } catch {}
       if (!s.sessionId)
         continue;
@@ -33609,7 +33762,7 @@ var init_codex = __esm(() => {
 });
 
 // src/audit/cli-adapters/copilot.ts
-import { statSync as statSync27 } from "node:fs";
+import { statSync as statSync28 } from "node:fs";
 async function listCopilotTranscriptMetadata(opts = {}) {
   const projectFilter = opts.projects ? new Set(opts.projects) : null;
   const sinceMs = opts.sinceMs ?? 0;
@@ -33626,7 +33779,7 @@ async function listCopilotTranscriptMetadata(opts = {}) {
         continue;
       let sizeBytes = 0;
       try {
-        sizeBytes = statSync27(s.path).size;
+        sizeBytes = statSync28(s.path).size;
       } catch {}
       if (!s.sessionId)
         continue;
@@ -33660,7 +33813,7 @@ var init_copilot = __esm(() => {
 });
 
 // src/audit/cli-adapters/cursor.ts
-import { statSync as statSync28 } from "node:fs";
+import { statSync as statSync29 } from "node:fs";
 async function listCursorTranscriptMetadata(opts = {}) {
   const projectFilter = opts.projects ? new Set(opts.projects) : null;
   const sinceMs = opts.sinceMs ?? 0;
@@ -33677,7 +33830,7 @@ async function listCursorTranscriptMetadata(opts = {}) {
         continue;
       let sizeBytes = 0;
       try {
-        sizeBytes = statSync28(s.path).size;
+        sizeBytes = statSync29(s.path).size;
       } catch {}
       if (!s.sessionId)
         continue;
@@ -33918,7 +34071,7 @@ var init_opencode = __esm(() => {
 });
 
 // src/audit/cli-adapters/pi.ts
-import { statSync as statSync29 } from "node:fs";
+import { statSync as statSync30 } from "node:fs";
 async function listPiTranscriptMetadata(opts = {}) {
   const projectFilter = opts.projects ? new Set(opts.projects) : null;
   const sinceMs = opts.sinceMs ?? 0;
@@ -33935,7 +34088,7 @@ async function listPiTranscriptMetadata(opts = {}) {
         continue;
       let sizeBytes = 0;
       try {
-        sizeBytes = statSync29(s.path).size;
+        sizeBytes = statSync30(s.path).size;
       } catch {}
       if (!s.sessionId)
         continue;
@@ -34671,8 +34824,8 @@ var init_features = __esm(() => {
 
 // src/audit/cache.ts
 import { createHash as createHash10 } from "node:crypto";
-import { existsSync as existsSync37, mkdirSync as mkdirSync23, readFileSync as readFileSync29, writeFileSync as writeFileSync20, chmodSync as chmodSync7, openSync as openSync5, readSync as readSync5, closeSync as closeSync5 } from "node:fs";
-import { join as join35 } from "node:path";
+import { existsSync as existsSync38, mkdirSync as mkdirSync24, readFileSync as readFileSync29, writeFileSync as writeFileSync20, chmodSync as chmodSync8, openSync as openSync6, readSync as readSync5, closeSync as closeSync6 } from "node:fs";
+import { join as join36 } from "node:path";
 function getEngineVersion() {
   if (cachedEngineVersion)
     return cachedEngineVersion;
@@ -34692,7 +34845,7 @@ function getDetectorVersion() {
 function getCachePathFor(transcriptPath) {
   const root = auditCacheDir();
   const key = createHash10("sha1").update(transcriptPath).digest("hex");
-  return join35(root, `${key}.json`);
+  return join36(root, `${key}.json`);
 }
 function encodeDetectorState(state) {
   return JSON.stringify(state, (_k, v) => v instanceof Map ? { __map: [...v.entries()] } : v);
@@ -34711,7 +34864,7 @@ function anchorHashFor(transcriptPath, upTo) {
     return null;
   let fd = null;
   try {
-    fd = openSync5(transcriptPath, "r");
+    fd = openSync6(transcriptPath, "r");
     const head = Buffer.alloc(Math.min(ANCHOR_WINDOW, upTo));
     readSync5(fd, head, 0, head.length, 0);
     const tailLen = Math.min(ANCHOR_WINDOW, upTo);
@@ -34723,7 +34876,7 @@ function anchorHashFor(transcriptPath, upTo) {
   } finally {
     if (fd !== null) {
       try {
-        closeSync5(fd);
+        closeSync6(fd);
       } catch {}
     }
   }
@@ -34732,7 +34885,7 @@ function readCachedTranscript(transcriptPath, mtimeMs, sizeBytes) {
   if (sizeBytes === 0)
     return null;
   const cachePath = getCachePathFor(transcriptPath);
-  if (!existsSync37(cachePath))
+  if (!existsSync38(cachePath))
     return null;
   try {
     const raw = readFileSync29(cachePath, "utf-8");
@@ -34774,7 +34927,7 @@ function writeCachedTranscriptResult(transcriptPath, mtimeMs, sizeBytes, result,
     return;
   const cachePath = getCachePathFor(transcriptPath);
   try {
-    mkdirSync23(auditCacheDir(), { recursive: true });
+    mkdirSync24(auditCacheDir(), { recursive: true });
     const entry = {
       schemaVersion: CACHE_SCHEMA_VERSION,
       cachedAt: Date.now(),
@@ -34794,7 +34947,7 @@ function writeCachedTranscriptResult(transcriptPath, mtimeMs, sizeBytes, result,
     }
     writeFileSync20(cachePath, JSON.stringify(entry), { encoding: "utf-8", mode: 384 });
     try {
-      chmodSync7(cachePath, 384);
+      chmodSync8(cachePath, 384);
     } catch {}
   } catch {}
 }
@@ -35229,14 +35382,14 @@ var init_audit = __esm(() => {
 
 // src/audit/audit-lock.ts
 import {
-  closeSync as closeSync6,
+  closeSync as closeSync7,
   linkSync as linkSync2,
-  mkdirSync as mkdirSync24,
-  openSync as openSync6,
+  mkdirSync as mkdirSync25,
+  openSync as openSync7,
   readFileSync as readFileSync30,
   unlinkSync as unlinkSync7,
   writeFileSync as writeFileSync21,
-  writeSync
+  writeSync as writeSync2
 } from "node:fs";
 function acquireAuditLock(source, now = Date.now()) {
   const path = auditLockFile();
@@ -35330,22 +35483,22 @@ function writeLockExclusive(path, info) {
 function createThenWrite(path, body) {
   let fd;
   try {
-    fd = openSync6(path, "wx", 384);
-    writeSync(fd, body);
+    fd = openSync7(path, "wx", 384);
+    writeSync2(fd, body);
     return true;
   } catch {
     return false;
   } finally {
     if (fd !== undefined) {
       try {
-        closeSync6(fd);
+        closeSync7(fd);
       } catch {}
     }
   }
 }
 function ensureRunDir() {
-  mkdirSync24(failproofaiHome(), { recursive: true });
-  mkdirSync24(runDir(), { recursive: true, mode: 448 });
+  mkdirSync25(failproofaiHome(), { recursive: true });
+  mkdirSync25(runDir(), { recursive: true, mode: 448 });
 }
 var AUDIT_LOCK_MAX_AGE_MS;
 var init_audit_lock = __esm(() => {
@@ -35354,7 +35507,7 @@ var init_audit_lock = __esm(() => {
 });
 
 // src/audit/dashboard-cache.ts
-import { existsSync as existsSync38, readFileSync as readFileSync31 } from "node:fs";
+import { existsSync as existsSync39, readFileSync as readFileSync31 } from "node:fs";
 function getCachePath() {
   return auditDashboardFile();
 }
@@ -35374,7 +35527,7 @@ function writeDashboardCache(params, result) {
 }
 function readDashboardCacheMeta() {
   const cachePath = getCachePath();
-  if (!existsSync38(cachePath))
+  if (!existsSync39(cachePath))
     return null;
   try {
     const raw = readFileSync31(cachePath, "utf-8");
@@ -35601,15 +35754,15 @@ var init_api_server_client = __esm(() => {
 });
 
 // lib/auth/auth-store.ts
-import { existsSync as existsSync39, readFileSync as readFileSync32, readdirSync as readdirSync20, rmSync as rmSync14 } from "node:fs";
-import { join as join36, resolve as resolve28 } from "node:path";
+import { existsSync as existsSync40, readFileSync as readFileSync32, readdirSync as readdirSync20, rmSync as rmSync15 } from "node:fs";
+import { join as join37, resolve as resolve28 } from "node:path";
 function getAuthFilePath() {
   const override = process.env.FAILPROOFAI_AUTH_DIR;
-  return override ? join36(override, "session.json") : auditSessionFile();
+  return override ? join37(override, "session.json") : auditSessionFile();
 }
 function readAuth() {
   const p = getAuthFilePath();
-  if (!existsSync39(p))
+  if (!existsSync40(p))
     return null;
   try {
     const raw = readFileSync32(p, "utf-8");
@@ -35636,18 +35789,18 @@ function writeAuth(auth) {
 }
 function deleteAuth() {
   const p = getAuthFilePath();
-  if (existsSync39(p))
-    rmSync14(p, { force: true });
+  if (existsSync40(p))
+    rmSync15(p, { force: true });
   try {
     const root = migrationsDir();
-    if (!existsSync39(root))
+    if (!existsSync40(root))
       return;
     for (const entry of readdirSync20(root)) {
       if (!entry.startsWith("backup-layout"))
         continue;
       const copy = resolve28(root, entry, "auth.json");
-      if (existsSync39(copy))
-        rmSync14(copy, { force: true });
+      if (existsSync40(copy))
+        rmSync15(copy, { force: true });
     }
   } catch {}
 }
@@ -35897,12 +36050,12 @@ var init_harm_report = __esm(() => {
 });
 
 // src/audit/machine-store.ts
-import { existsSync as existsSync40, readFileSync as readFileSync33, rmSync as rmSync15 } from "node:fs";
+import { existsSync as existsSync41, readFileSync as readFileSync33, rmSync as rmSync16 } from "node:fs";
 import { hostname as hostname5 } from "node:os";
 import { randomUUID as randomUUID4 } from "node:crypto";
 function readMachineIdentity(home) {
   const path = auditMachineFile(home);
-  if (!existsSync40(path))
+  if (!existsSync41(path))
     return null;
   try {
     const parsed = JSON.parse(readFileSync33(path, "utf8"));
@@ -36227,9 +36380,9 @@ var init_cli = __esm(() => {
 });
 
 // src/hooks/configure-wizard.ts
-import { existsSync as existsSync41, mkdirSync as mkdirSync25, writeFileSync as writeFileSync22, readFileSync as readFileSync34 } from "node:fs";
+import { existsSync as existsSync42, mkdirSync as mkdirSync26, writeFileSync as writeFileSync22, readFileSync as readFileSync34 } from "node:fs";
 import { homedir as homedir29 } from "node:os";
-import { dirname as dirname21, resolve as resolve29, sep as sep5 } from "node:path";
+import { dirname as dirname22, resolve as resolve29, sep as sep5 } from "node:path";
 async function emit(event, props) {
   try {
     await trackHookEvent2(getInstanceId2(), event, props);
@@ -36252,7 +36405,7 @@ function setCustomPoliciesEnabled(scope, cwd, enabled) {
   const path = getConfigPathForScope(scope, cwd);
   let config = {};
   try {
-    if (existsSync41(path))
+    if (existsSync42(path))
       config = JSON.parse(readFileSync34(path, "utf8"));
   } catch {
     return;
@@ -36397,7 +36550,7 @@ function firstRunMarkerPath() {
 }
 function markLauncherSeen() {
   try {
-    mkdirSync25(dirname21(firstRunMarkerPath()), { recursive: true });
+    mkdirSync26(dirname22(firstRunMarkerPath()), { recursive: true });
     writeFileSync22(firstRunMarkerPath(), "1", "utf8");
   } catch {}
 }
@@ -36896,18 +37049,18 @@ var init_configure_wizard = __esm(() => {
 });
 
 // src/hooks/flush-cli.ts
-import { existsSync as existsSync42, mkdirSync as mkdirSync26, writeFileSync as writeFileSync23, readdirSync as readdirSync21 } from "node:fs";
-import { dirname as dirname22, join as join37 } from "node:path";
+import { existsSync as existsSync43, mkdirSync as mkdirSync27, writeFileSync as writeFileSync23, readdirSync as readdirSync21 } from "node:fs";
+import { dirname as dirname23, join as join38 } from "node:path";
 function flushRequestPath2(home) {
-  return join37(failproofaiHome(home), "state", "flush-request.json");
+  return join38(failproofaiHome(home), "state", "flush-request.json");
 }
 function spoolDirs2(home) {
   const root = spoolDir(home);
   const dirs = [root, customAgentsEventsDir(home)];
-  if (!existsSync42(root))
+  if (!existsSync43(root))
     return dirs;
   try {
-    return dirs.concat(readdirSync21(root, { withFileTypes: true }).filter((e) => e.isDirectory() && e.name !== "failed").map((e) => join37(root, e.name)));
+    return dirs.concat(readdirSync21(root, { withFileTypes: true }).filter((e) => e.isDirectory() && e.name !== "failed").map((e) => join38(root, e.name)));
   } catch {
     return dirs;
   }
@@ -36985,7 +37138,7 @@ async function runFlushCommand2(opts = {}) {
     return { exitCode: 0, pending: 0, lines: nothing };
   }
   const path = flushRequestPath2(home);
-  mkdirSync26(dirname22(path), { recursive: true });
+  mkdirSync27(dirname23(path), { recursive: true });
   writeFileSync23(path, `${JSON.stringify({ requestedAtMs: Date.now() }, null, 2)}
 `, {
     mode: 384
@@ -37019,16 +37172,16 @@ var init_flush_cli2 = __esm(() => {
 });
 
 // src/hooks/backfill-cli.ts
-import { existsSync as existsSync43, mkdirSync as mkdirSync27, writeFileSync as writeFileSync24, readdirSync as readdirSync22, statSync as statSync30 } from "node:fs";
-import { dirname as dirname23, join as join38 } from "node:path";
+import { existsSync as existsSync44, mkdirSync as mkdirSync28, writeFileSync as writeFileSync24, readdirSync as readdirSync22, statSync as statSync31 } from "node:fs";
+import { dirname as dirname24, join as join39 } from "node:path";
 function backfillRequestPath(home) {
-  return join38(failproofaiHome(home), "state", "backfill-request.json");
+  return join39(failproofaiHome(home), "state", "backfill-request.json");
 }
 function surveySessions(sinceMs, homeDir) {
   const out = [];
   for (const { cli, dir } of SESSION_DIRS) {
-    const root = join38(homeDir, dir);
-    if (!existsSync43(root))
+    const root = join39(homeDir, dir);
+    if (!existsSync44(root))
       continue;
     let files = 0;
     let newest = 0;
@@ -37042,13 +37195,13 @@ function surveySessions(sinceMs, homeDir) {
         return;
       }
       for (const e of entries) {
-        const p = join38(d, e.name);
+        const p = join39(d, e.name);
         if (e.isDirectory()) {
           walk(p, depth + 1);
           continue;
         }
         try {
-          const st = statSync30(p);
+          const st = statSync31(p);
           if (st.mtimeMs >= sinceMs) {
             files += 1;
             newest = Math.max(newest, st.mtimeMs);
@@ -37066,7 +37219,7 @@ function runBackfillCommand(opts = {}) {
   const now = opts.now ?? Date.now();
   const sinceMs = opts.sinceMs ?? now - DEFAULT_BACKFILL_DAYS * 24 * 60 * 60 * 1000;
   const home = failproofaiHome();
-  if (!existsSync43(home)) {
+  if (!existsSync44(home)) {
     return {
       exitCode: 1,
       lines: [`No failproofai home at ${home}. Run \`failproofai config\` first.`]
@@ -37098,7 +37251,7 @@ function runBackfillCommand(opts = {}) {
       ]
     };
   }
-  const found = surveySessions(sinceMs, dirname23(home));
+  const found = surveySessions(sinceMs, dirname24(home));
   const totalFiles = found.reduce((n, f) => n + f.files, 0);
   const sinceLabel = new Date(sinceMs).toISOString().slice(0, 10);
   const lines = [
@@ -37121,7 +37274,7 @@ function runBackfillCommand(opts = {}) {
   }
   try {
     const path = backfillRequestPath();
-    mkdirSync27(dirname23(path), { recursive: true });
+    mkdirSync28(dirname24(path), { recursive: true });
     writeFileSync24(path, `${JSON.stringify({ sinceMs, requestedAtMs: now }, null, 2)}
 `, {
       mode: 384
@@ -37413,7 +37566,7 @@ function surveyReviewableCoverage(cwd) {
   let packsInstalled = false;
   let reviewers;
   try {
-    packsInstalled = hasInstalledPacks();
+    packsInstalled = hasInstalledRegexPacks();
     const packs = readInstalledPacks().packs;
     for (const pack of packs) {
       const selected = pack.enabled;
@@ -37602,8 +37755,8 @@ var init_jev_stats = __esm(() => {
 });
 
 // src/hooks/jev-cli.ts
-import { chmodSync as chmodSync8, existsSync as existsSync44, statSync as statSync31, unlinkSync as unlinkSync8 } from "node:fs";
-import { dirname as dirname24 } from "node:path";
+import { chmodSync as chmodSync9, existsSync as existsSync45, statSync as statSync32, unlinkSync as unlinkSync8 } from "node:fs";
+import { dirname as dirname25 } from "node:path";
 function unknownOption(arg) {
   return OPTION_SHAPE.test(arg) ? `Unknown option: ${arg}` : "Unknown option (not repeated here, in case it carries a key).";
 }
@@ -38155,16 +38308,16 @@ async function setupRun(argv, deps, opts) {
   }
   let fileMode = null;
   try {
-    fileMode = statSync31(path).mode & 511;
+    fileMode = statSync32(path).mode & 511;
   } catch {}
-  const dir = dirname24(path);
+  const dir = dirname25(path);
   let tightenedDir = null;
   if (process.platform !== "win32") {
     try {
-      const before = statSync31(dir).mode & 511;
+      const before = statSync32(dir).mode & 511;
       if ((before & 18) !== 0) {
         const after = before & -19;
-        chmodSync8(dir, after);
+        chmodSync9(dir, after);
         tightenedDir = { path: dir, to: after.toString(8).padStart(4, "0") };
       }
     } catch {}
@@ -38283,15 +38436,15 @@ async function cloudSetup(values, bools, opts) {
   }
   if (process.platform !== "win32") {
     try {
-      const dir = dirname24(path);
-      const before = statSync31(dir).mode & 511;
+      const dir = dirname25(path);
+      const before = statSync32(dir).mode & 511;
       if ((before & 18) !== 0)
-        chmodSync8(dir, before & -19);
+        chmodSync9(dir, before & -19);
     } catch {}
   }
   let fileMode = null;
   try {
-    fileMode = statSync31(path).mode & 511;
+    fileMode = statSync32(path).mode & 511;
   } catch {}
   const cfg = checked.value;
   const route = jevRoute(cfg);
@@ -38730,7 +38883,7 @@ function remove(argv, opts) {
   if (parsed.positionals.length > 0)
     return fail2([STRAY_ARGUMENT, "", ...JEV_USAGE]);
   const path = jevConfigPath();
-  if (!existsSync44(path)) {
+  if (!existsSync45(path)) {
     return ok2(stack(title("failproofai jev remove", "nothing to do", opts), note(`There is no ${path}; Jev is already off.`, opts)));
   }
   try {
@@ -38797,16 +38950,16 @@ var init_jev_cli = __esm(() => {
 
 // src/hooks/fp-config.ts
 import {
-  chmodSync as chmodSync9,
-  closeSync as closeSync7,
+  chmodSync as chmodSync10,
+  closeSync as closeSync8,
   constants as fsConstants4,
-  existsSync as existsSync45,
+  existsSync as existsSync46,
   fstatSync as fstatSync4,
-  mkdirSync as mkdirSync28,
-  openSync as openSync7,
+  mkdirSync as mkdirSync29,
+  openSync as openSync8,
   readFileSync as readFileSync35,
   readSync as readSync6,
-  statSync as statSync32,
+  statSync as statSync33,
   writeFileSync as writeFileSync25
 } from "node:fs";
 function detectLayout2() {
@@ -38816,17 +38969,17 @@ function detectLayout2() {
       return { kind: "current", version: raw };
     return raw.layout > LAYOUT_VERSION ? { kind: "future", found: raw.layout } : { kind: "stale", found: raw.layout };
   }
-  if (existsSync45(configFile())) {
+  if (existsSync46(configFile())) {
     const layoutThreePositions = [
       legacy.authJson(),
       legacy.nextAudit(),
       legacy.auditSchedule()
     ];
-    if (layoutThreePositions.some((p) => existsSync45(p)))
+    if (layoutThreePositions.some((p) => existsSync46(p)))
       return { kind: "stale", found: 3 };
     return { kind: "current", version: { layout: LAYOUT_VERSION, cli: "" }, inferred: true };
   }
-  if (existsSync45(legacy.configToml()))
+  if (existsSync46(legacy.configToml()))
     return { kind: "stale", found: 2 };
   const layoutOneMarkers = [
     legacy.policyConfig(),
@@ -38837,7 +38990,7 @@ function detectLayout2() {
     legacy.ingestCredentials(),
     legacy.auditDashboard()
   ];
-  return layoutOneMarkers.some((p) => existsSync45(p)) ? { kind: "stale", found: 1 } : { kind: "absent" };
+  return layoutOneMarkers.some((p) => existsSync46(p)) ? { kind: "stale", found: 1 } : { kind: "absent" };
 }
 function readLegacyTomlVersion2(text) {
   const layout = Number(/^\s*layout\s*=\s*(\d+)\s*$/m.exec(text)?.[1]);
@@ -38880,16 +39033,16 @@ var init_fp_home2 = () => {};
 
 // src/hooks/migrations.ts
 import {
-  chmodSync as chmodSync10,
-  copyFileSync as copyFileSync3,
-  existsSync as existsSync46,
-  mkdirSync as mkdirSync29,
+  chmodSync as chmodSync11,
+  copyFileSync as copyFileSync4,
+  existsSync as existsSync47,
+  mkdirSync as mkdirSync30,
   readFileSync as readFileSync36,
-  renameSync as renameSync12,
-  rmSync as rmSync16,
+  renameSync as renameSync13,
+  rmSync as rmSync17,
   writeFileSync as writeFileSync26
 } from "node:fs";
-import { basename as basename9, dirname as dirname25, join as join39, resolve as resolve32 } from "node:path";
+import { basename as basename10, dirname as dirname26, join as join40, resolve as resolve32 } from "node:path";
 function migrateToLayout42() {
   const moves = [
     { from: legacy.authJson(), to: auditSessionFile() },
@@ -38898,40 +39051,40 @@ function migrateToLayout42() {
   ];
   const authDirOverride = process.env.FAILPROOFAI_AUTH_DIR;
   if (authDirOverride) {
-    moves.push({ from: join39(authDirOverride, "auth.json"), to: join39(authDirOverride, "session.json") }, {
-      from: join39(authDirOverride, "next-audit.json"),
-      to: join39(authDirOverride, "reminder.json")
+    moves.push({ from: join40(authDirOverride, "auth.json"), to: join40(authDirOverride, "session.json") }, {
+      from: join40(authDirOverride, "next-audit.json"),
+      to: join40(authDirOverride, "reminder.json")
     });
   }
   const migrated = [];
   for (const { from, to } of moves) {
-    if (!existsSync46(from))
+    if (!existsSync47(from))
       continue;
-    if (existsSync46(to)) {
-      rmSync16(from, { force: true });
+    if (existsSync47(to)) {
+      rmSync17(from, { force: true });
       continue;
     }
-    mkdirSync29(dirname25(to), { recursive: true });
+    mkdirSync30(dirname26(to), { recursive: true });
     try {
-      renameSync12(from, to);
+      renameSync13(from, to);
     } catch {
       try {
-        copyFileSync3(from, to);
+        copyFileSync4(from, to);
       } catch (err) {
         try {
-          rmSync16(to, { force: true });
+          rmSync17(to, { force: true });
         } catch {}
         throw err;
       }
-      rmSync16(from, { force: true });
+      rmSync17(from, { force: true });
     }
-    migrated.push(`${basename9(from)} → audit/${basename9(to)}`);
+    migrated.push(`${basename10(from)} → audit/${basename10(to)}`);
   }
   for (const secret of [auditSessionFile()]) {
-    if (!existsSync46(secret))
+    if (!existsSync47(secret))
       continue;
     try {
-      chmodSync10(secret, 384);
+      chmodSync11(secret, 384);
     } catch {}
   }
   writeVersionFile({ layout: 4 });
@@ -38962,26 +39115,26 @@ function readLedger2() {
 }
 function appendLedger2(entry) {
   try {
-    mkdirSync29(migrationsDir(), { recursive: true });
+    mkdirSync30(migrationsDir(), { recursive: true });
     const all = [...readLedger2(), entry];
     writeFileSync26(migrationLedgerFile(), `${JSON.stringify(all, null, 2)}
 `, "utf8");
   } catch {}
 }
 function backupNameOf2(f) {
-  return f.as ?? basename9(f.at());
+  return f.as ?? basename10(f.at());
 }
 function pruneMigratedCredentials2(from) {
   const pruned = [];
   for (let layout = from;layout < LAYOUT_VERSION; layout++) {
     for (const { as, landsAt } of PRUNED_AFTER_SUCCESS2) {
       try {
-        if (!existsSync46(landsAt()))
+        if (!existsSync47(landsAt()))
           continue;
         const copy = resolve32(migrationBackupDir(layout), as);
-        if (!existsSync46(copy))
+        if (!existsSync47(copy))
           continue;
-        rmSync16(copy, { force: true });
+        rmSync17(copy, { force: true });
         pruned.push(as);
       } catch {}
     }
@@ -38992,7 +39145,7 @@ function filesToBackUp2() {
   const seen = new Map;
   for (const f of [...BACKED_UP2, ...BACKED_UP_LEGACY2]) {
     const path = f.at();
-    if (existsSync46(path))
+    if (existsSync47(path))
       seen.set(path, backupNameOf2(f));
   }
   return [...seen].map(([path, as]) => ({ path, as }));
@@ -39001,14 +39154,14 @@ function backupBeforeMigrating2(from) {
   const dir = migrationBackupDir(from);
   const saved = [];
   try {
-    rmSync16(dir, { recursive: true, force: true });
-    mkdirSync29(dir, { recursive: true });
+    rmSync17(dir, { recursive: true, force: true });
+    mkdirSync30(dir, { recursive: true });
   } catch {
     return [];
   }
   for (const { path: source, as } of filesToBackUp2()) {
     try {
-      copyFileSync3(source, resolve32(dir, as));
+      copyFileSync4(source, resolve32(dir, as));
       saved.push(as);
     } catch {}
   }
@@ -39140,19 +39293,19 @@ var init_migrations2 = __esm(() => {
     { at: legacy.auditSchedule }
   ];
   PRUNED_AFTER_SUCCESS2 = [
-    { as: basename9(legacy.authJson()), landsAt: auditSessionFile }
+    { as: basename10(legacy.authJson()), landsAt: auditSessionFile }
   ];
 });
 
 // src/hooks/daemon-service.ts
 import {
-  existsSync as existsSync47,
-  mkdirSync as mkdirSync30,
+  existsSync as existsSync48,
+  mkdirSync as mkdirSync31,
   mkdtempSync as mkdtempSync2,
   readFileSync as readFileSync37,
   writeFileSync as writeFileSync27,
   unlinkSync as unlinkSync9,
-  rmSync as rmSync17
+  rmSync as rmSync18
 } from "node:fs";
 import { homedir as homedir31, tmpdir as tmpdir3, userInfo as userInfo2 } from "node:os";
 import { resolve as resolve33 } from "node:path";
@@ -39171,13 +39324,13 @@ function resolveFailproofaidBinaryPath2() {
   if (process.env.FAILPROOFAI_DAEMON_BINARY)
     return process.env.FAILPROOFAI_DAEMON_BINARY;
   const downloaded = installedBinaryPath();
-  if (existsSync47(downloaded))
+  if (existsSync48(downloaded))
     return downloaded;
   const packageRoot = process.env.FAILPROOFAI_PACKAGE_ROOT;
   if (packageRoot) {
     for (const profile of ["release", "debug"]) {
       const candidate = resolve33(packageRoot, "target", profile, "failproofaid");
-      if (existsSync47(candidate))
+      if (existsSync48(candidate))
         return candidate;
     }
   }
@@ -39208,7 +39361,7 @@ function resolveWorkerCommand2() {
   if (!packageRoot)
     return null;
   const workerScript = resolve33(packageRoot, "dist", "worker.mjs");
-  if (!existsSync47(workerScript))
+  if (!existsSync48(workerScript))
     return null;
   return `${shellQuote2(process.execPath)} ${shellQuote2(workerScript)}`;
 }
@@ -39219,7 +39372,7 @@ function resolveCliCommand2() {
   if (!packageRoot)
     return null;
   const cliScript = resolve33(packageRoot, "dist", "cli.mjs");
-  if (!existsSync47(cliScript))
+  if (!existsSync48(cliScript))
     return null;
   return `${shellQuote2(process.execPath)} ${shellQuote2(cliScript)}`;
 }
@@ -39233,7 +39386,7 @@ function workerScriptPath2() {
   if (!packageRoot)
     return null;
   const workerScript = resolve33(packageRoot, "dist", "worker.mjs");
-  return existsSync47(workerScript) ? workerScript : null;
+  return existsSync48(workerScript) ? workerScript : null;
 }
 function assertUnitSafe2(value, field) {
   if (UNIT_UNSAFE_RE2.test(value)) {
@@ -39315,14 +39468,14 @@ function writePrivilegedFile2(destination, contents, mode = "0644") {
     writeFileSync27(staging, contents, "utf8");
     runPrivileged2("install", ["-m", mode, staging, destination]);
   } finally {
-    rmSync17(stagingDir, { recursive: true, force: true });
+    rmSync18(stagingDir, { recursive: true, force: true });
   }
 }
 function removeLegacyUserService2() {
   try {
     if (process.platform === "linux") {
       const legacy = legacySystemdUserUnitPath2();
-      if (!existsSync47(legacy))
+      if (!existsSync48(legacy))
         return;
       try {
         execFileSync3("systemctl", ["--user", "disable", "--now", "failproofaid.service"], {
@@ -39339,7 +39492,7 @@ function removeLegacyUserService2() {
       } catch {}
     } else {
       const legacyAgent = legacyLaunchAgentPlistPath2();
-      if (existsSync47(legacyAgent)) {
+      if (existsSync48(legacyAgent)) {
         try {
           execFileSync3("launchctl", ["unload", "-w", legacyAgent], {
             stdio: "ignore",
@@ -39349,7 +39502,7 @@ function removeLegacyUserService2() {
         unlinkSync9(legacyAgent);
       }
       const legacyDaemon = legacySharedLaunchDaemonPath2();
-      if (existsSync47(legacyDaemon)) {
+      if (existsSync48(legacyDaemon)) {
         try {
           runPrivileged2("launchctl", ["unload", "-w", legacyDaemon]);
         } catch {}
@@ -39366,7 +39519,7 @@ function systemdUnitContents2(binaryPath, workerCmd, cliCmd = null) {
   const user = assertUnitSafe2(serviceUser2(), "User");
   assertUnitSafe2(binaryPath, "ExecStart");
   assertUnitSafe2(homedir31(), "HOME");
-  const conditionPaths = [binaryPath, workerScriptPath2()].filter((p) => typeof p === "string" && existsSync47(p));
+  const conditionPaths = [binaryPath, workerScriptPath2()].filter((p) => typeof p === "string" && existsSync48(p));
   const conditionLines = conditionPaths.map((p) => `ConditionPathExists=${assertUnitSafe2(p, "ConditionPathExists")}
 `).join("");
   return `[Unit]
@@ -39472,7 +39625,7 @@ async function installDaemonService2() {
     } else {
       const plistPath = launchdPlistPath2();
       const logDir = logsDir();
-      mkdirSync30(logDir, { recursive: true });
+      mkdirSync31(logDir, { recursive: true });
       try {
         runPrivileged2("launchctl", ["unload", plistPath]);
       } catch {}
@@ -39620,7 +39773,7 @@ function daemonServiceStatus2() {
   if (!isDaemonSupportedPlatform2())
     return "unsupported-platform";
   if (process.platform === "linux") {
-    if (!existsSync47(systemdUnitPath2()))
+    if (!existsSync48(systemdUnitPath2()))
       return "not-installed";
     try {
       const out = execFileSync3("systemctl", ["is-active", systemdUnitName2()], {
@@ -39633,7 +39786,7 @@ function daemonServiceStatus2() {
     }
   }
   const plistPath = launchdPlistPath2();
-  if (!existsSync47(plistPath))
+  if (!existsSync48(plistPath))
     return "not-installed";
   try {
     const root = typeof process.getuid === "function" && process.getuid() === 0;
@@ -39701,7 +39854,7 @@ var init_hermes_update = __esm(() => {
 });
 
 // src/hooks/uninstall-cli.ts
-import { existsSync as existsSync48, rmSync as rmSync18 } from "node:fs";
+import { existsSync as existsSync49, rmSync as rmSync19 } from "node:fs";
 function survey(cwd) {
   const clis = [];
   for (const id of listInstallableIds()) {
@@ -39722,9 +39875,9 @@ function survey(cwd) {
   return {
     clis,
     servicePath,
-    serviceInstalled: !!servicePath && existsSync48(servicePath),
+    serviceInstalled: !!servicePath && existsSync49(servicePath),
     daemonConfigured,
-    homeExists: existsSync48(failproofaiHome())
+    homeExists: existsSync49(failproofaiHome())
   };
 }
 async function runUninstallCommand(opts = {}) {
@@ -39822,7 +39975,7 @@ async function runUninstallCommand(opts = {}) {
       } catch {}
       try {
         await uninstallDaemonService();
-        if (found.servicePath && existsSync48(found.servicePath)) {
+        if (found.servicePath && existsSync49(found.servicePath)) {
           failures.push(`the service at ${found.servicePath} is still there (most often: no sudo). ` + `Remove it with the commands below.`);
         } else {
           lines.push(`✓ stopped and removed the daemon service`);
@@ -39834,7 +39987,7 @@ async function runUninstallCommand(opts = {}) {
   }
   if (opts.purge && found.homeExists) {
     try {
-      rmSync18(failproofaiHome(), { recursive: true, force: true });
+      rmSync19(failproofaiHome(), { recursive: true, force: true });
       purged = true;
       lines.push(`✓ deleted ${failproofaiHome()}`);
     } catch (err) {
@@ -39845,7 +39998,7 @@ async function runUninstallCommand(opts = {}) {
     lines.push(``, `Not everything could be removed:`);
     for (const f of failures)
       lines.push(`  ✗ ${f}`);
-    if (found.servicePath && existsSync48(found.servicePath)) {
+    if (found.servicePath && existsSync49(found.servicePath)) {
       lines.push(``, `To remove the service by hand:`, ...manualServiceRemoval(found.servicePath), ``, `(\`${daemonStatusCommand()}\` shows its current state.)`);
     }
     return { exitCode: 1, lines, planLines, purged };
@@ -39879,8 +40032,8 @@ var init_uninstall_cli = __esm(() => {
 import { execFileSync as execFileSync4 } from "node:child_process";
 import { homedir as homedir32, tmpdir as tmpdir4 } from "node:os";
 import { createHash as createHash11 } from "node:crypto";
-import { copyFileSync as copyFileSync4, existsSync as existsSync49, mkdirSync as mkdirSync31, mkdtempSync as mkdtempSync3, readFileSync as readFileSync38, readdirSync as readdirSync23, realpathSync as realpathSync4, rmSync as rmSync19, statSync as statSync33, writeFileSync as writeFileSync28 } from "node:fs";
-import { basename as basename10, dirname as dirname26, isAbsolute as isAbsolute6, join as join40, relative as relative5, resolve as resolve34, sep as sep6 } from "node:path";
+import { copyFileSync as copyFileSync5, existsSync as existsSync50, mkdirSync as mkdirSync32, mkdtempSync as mkdtempSync3, readFileSync as readFileSync38, readdirSync as readdirSync23, realpathSync as realpathSync5, rmSync as rmSync20, statSync as statSync34, writeFileSync as writeFileSync28 } from "node:fs";
+import { basename as basename11, dirname as dirname27, isAbsolute as isAbsolute6, join as join41, relative as relative5, resolve as resolve34, sep as sep6 } from "node:path";
 function parseList(rest, ...flags) {
   let found = false;
   const out = [];
@@ -40016,7 +40169,7 @@ async function build(rest) {
     return fail3([err instanceof Error ? err.message : String(err)]);
   }
   const entryPath = resolve34(entry);
-  if (!existsSync49(entryPath))
+  if (!existsSync50(entryPath))
     return fail3([`No such file: ${entryPath}`]);
   const source = readFileSync38(entryPath, "utf8");
   const localImport = firstRelativeSpecifier(source);
@@ -40137,11 +40290,11 @@ async function build(rest) {
     ...semantic.length > 0 ? { semantic } : {}
   }, null, 2) + `
 `;
-  mkdirSync31(outDir, { recursive: true });
+  mkdirSync32(outDir, { recursive: true });
   const manifestPath = resolve34(outDir, PACK_MANIFEST_ASSET);
   const entryOut = resolve34(outDir, PACK_ENTRY_ASSET);
   writeFileSync28(manifestPath, manifest, "utf8");
-  copyFileSync4(entryPath, entryOut);
+  copyFileSync5(entryPath, entryOut);
   const sha = (bytes) => createHash11("sha256").update(bytes).digest("hex");
   writeFileSync28(resolve34(outDir, PACK_CHECKSUMS_ASSET), `${sha(manifest)}  ${PACK_MANIFEST_ASSET}
 ${sha(readFileSync38(entryOut))}  ${PACK_ENTRY_ASSET}
@@ -40285,10 +40438,10 @@ async function scaffold(target) {
     chosen = answer.trim();
   }
   const path = resolve34(withPolicyExtension(chosen ?? "my-policies"));
-  if (existsSync49(path)) {
+  if (existsSync50(path)) {
     return fail3([`${path} already exists — name a different file, or edit that one.`]);
   }
-  mkdirSync31(resolve34(path, ".."), { recursive: true });
+  mkdirSync32(resolve34(path, ".."), { recursive: true });
   writeFileSync28(path, `import { customPolicies, allow, deny } from "failproofai";
 
 // One file, no relative imports: only this entry is digest-pinned, so a pack
@@ -40387,7 +40540,7 @@ function porcelainEntries(status) {
 }
 function realOrSelf(path) {
   try {
-    return realpathSync4(path);
+    return realpathSync5(path);
   } catch {
     return path;
   }
@@ -40479,7 +40632,7 @@ function findEntry(dir) {
       continue;
     const full = resolve34(dir, name);
     try {
-      if (statSync33(full).size > 512 * 1024)
+      if (statSync34(full).size > 512 * 1024)
         continue;
       const text = readFileSync38(full, "utf8");
       if (/from\s+["']failproofai["']/.test(text) && /(?:customPolicies|semanticPolicies)\s*\.\s*add\s*\(/.test(text)) {
@@ -40498,7 +40651,7 @@ function withLocalImports(sources) {
     const file = queue.shift();
     let text;
     try {
-      if (statSync33(file).size > 512 * 1024)
+      if (statSync34(file).size > 512 * 1024)
         continue;
       text = readFileSync38(file, "utf8");
     } catch {
@@ -40506,13 +40659,13 @@ function withLocalImports(sources) {
     }
     for (const re of LOCAL_IMPORT_RES) {
       for (const match of text.matchAll(re)) {
-        const base = resolve34(dirname26(file), match[1]);
+        const base = resolve34(dirname27(file), match[1]);
         for (const ext of LOCAL_IMPORT_EXTENSIONS) {
           const candidate = base + ext;
           if (seen.has(candidate))
             break;
           try {
-            if (!statSync33(candidate).isFile())
+            if (!statSync34(candidate).isFile())
               continue;
           } catch {
             continue;
@@ -40737,7 +40890,7 @@ function pushExistingHistory(dir, owner, name, token) {
   const branch = git(["rev-parse", "--abbrev-ref", "HEAD"]);
   if (!branch || branch === "HEAD" || !git(["rev-parse", "--verify", "HEAD"]))
     return false;
-  const askpass = join40(mkdtempSync3(join40(tmpdir4(), "fpai-askpass-")), "askpass.sh");
+  const askpass = join41(mkdtempSync3(join41(tmpdir4(), "fpai-askpass-")), "askpass.sh");
   try {
     writeFileSync28(askpass, `#!/bin/sh
 case "$1" in
@@ -40759,7 +40912,7 @@ esac
     return true;
   } finally {
     try {
-      rmSync19(dirname26(askpass), { recursive: true, force: true });
+      rmSync20(dirname27(askpass), { recursive: true, force: true });
     } catch {}
   }
 }
@@ -40810,7 +40963,7 @@ function bundleEntry(sources, outDir) {
       ]
     };
   }
-  mkdirSync31(outDir, { recursive: true });
+  mkdirSync32(outDir, { recursive: true });
   const entry = resolve34(outDir, ".entry.generated.mjs");
   writeFileSync28(entry, sources.map((f) => `import ${JSON.stringify(f.startsWith("/") ? f : resolve34(f))};`).join(`
 `) + `
@@ -40942,12 +41095,12 @@ async function publish(rest) {
   if (askingWhere) {
     const found = discovered.length > 0 ? discovered : [entry];
     process.stdout.write(`
-  ${found.length} policy ${found.length === 1 ? "file" : "files"}: ` + `${found.map((f) => basename10(f)).join(", ")}
+  ${found.length} policy ${found.length === 1 ? "file" : "files"}: ` + `${found.map((f) => basename11(f)).join(", ")}
 
 `);
     const token = githubToken();
     const login = token ? await credentialLogin(token) : null;
-    const folder = basename10(resolve34(entry, ".."));
+    const folder = basename11(resolve34(entry, ".."));
     const answered = await askWhereToPublish(`${login ?? "your-account"}/${folder}`, { stdin: process.stdin, stdout: process.stdout });
     if (answered === null)
       return ok3(["Nothing was published."]);
@@ -40958,7 +41111,7 @@ async function publish(rest) {
   let versionFromSha = false;
   const dryRun = rest.includes("--dry-run") || !repo;
   const allowPrivate = rest.includes("--allow-private");
-  const id = flag("id") ?? repo ?? (dryRun && entry ? `local/${basename10(resolve34(entry, ".."))}` : undefined);
+  const id = flag("id") ?? repo ?? (dryRun && entry ? `local/${basename11(resolve34(entry, ".."))}` : undefined);
   const [owner, name] = (repo ?? "/").split("/");
   if (repo && (!owner || !name || repo.split("/").length !== 2)) {
     return fail3([`--repo must be <owner>/<repo>, got ${JSON.stringify(repo)}`]);
@@ -41905,8 +42058,8 @@ var init_install_prompt = __esm(() => {
 
 // src/hooks/manager.ts
 import { execSync as execSync7 } from "node:child_process";
-import { existsSync as existsSync50 } from "node:fs";
-import { resolve as resolve35, basename as basename11 } from "node:path";
+import { existsSync as existsSync51 } from "node:fs";
+import { resolve as resolve35, basename as basename12 } from "node:path";
 import { platform as platform4, arch as arch4, release as release3, hostname as hostname6 } from "node:os";
 function getSettingsPath2(scope, cwd) {
   return claudeCode.getSettingsPath(scope, cwd);
@@ -42137,7 +42290,7 @@ async function installHooksImpl2(policyNames, scope = "user", cwd, includeBeta =
   } else if (customPoliciesPath && (typeof customPoliciesPath === "string" || customPoliciesPath.length > 0)) {
     const incoming = (typeof customPoliciesPath === "string" ? [customPoliciesPath] : customPoliciesPath).map((path) => resolve35(path));
     const carried = (previousConfig.customPoliciesPaths ?? (previousConfig.customPoliciesPath ? [previousConfig.customPoliciesPath] : [])).map((path) => resolve35(path)).filter((path) => {
-      if (existsSync50(path))
+      if (existsSync51(path))
         return true;
       console.log(`Dropping custom policies path (file no longer exists): ${path}`);
       return false;
@@ -42369,7 +42522,7 @@ async function removeHooks2(policyNames, scope = "user", cwd, opts) {
     const scopesToRemove = scope === "all" ? [...integration.scopes] : integration.scopes.includes(scope) ? [scope] : [];
     for (const s of scopesToRemove) {
       const settingsPaths = settingsPathsFor(integration, s, cwd);
-      const existing = cliId === "hermes" ? settingsPaths : settingsPaths.filter((p) => existsSync50(p));
+      const existing = cliId === "hermes" ? settingsPaths : settingsPaths.filter((p) => existsSync51(p));
       if (existing.length === 0) {
         if (scope !== "all" && selectedClis.length === 1) {
           console.log("No settings file found. Nothing to remove.");
@@ -42522,7 +42675,7 @@ async function listHooks(cwd) {
     for (const path of explicitPaths) {
       const absPath = resolve35(findProjectConfigDir(cwd ?? process.cwd()), path);
       groups.push(note(absPath, opts));
-      if (!existsSync50(absPath)) {
+      if (!existsSync51(absPath)) {
         groups.push(warning([`file not found: ${absPath}`], opts));
         continue;
       }
@@ -42567,7 +42720,7 @@ async function listHooks(cwd) {
     groups.push(note(dir, opts));
     const rows = [];
     for (const file of files) {
-      const filename = basename11(file);
+      const filename = basename12(file);
       try {
         const hooks = await loadCustomHooks(file);
         record(filename, hooks.map((h) => h.name));
@@ -43091,26 +43244,26 @@ function parseScriptArgs(argv) {
 var init_parse_script_args = () => {};
 
 // scripts/install-diagnosis.mjs
-import { existsSync as existsSync51, readFileSync as readFileSync40, realpathSync as realpathSync5 } from "node:fs";
-import { dirname as dirname27, resolve as resolve37 } from "node:path";
+import { existsSync as existsSync52, readFileSync as readFileSync40, realpathSync as realpathSync6 } from "node:fs";
+import { dirname as dirname28, resolve as resolve37 } from "node:path";
 import { homedir as homedir33, platform as platform5 } from "node:os";
 import { spawnSync } from "node:child_process";
 function findPackageRoot(start) {
   try {
-    let dir = realpathSync5(start);
-    if (existsSync51(dir) && !existsSync51(resolve37(dir, "package.json"))) {
-      dir = dirname27(dir);
+    let dir = realpathSync6(start);
+    if (existsSync52(dir) && !existsSync52(resolve37(dir, "package.json"))) {
+      dir = dirname28(dir);
     }
     while (true) {
       const pkgPath = resolve37(dir, "package.json");
-      if (existsSync51(pkgPath)) {
+      if (existsSync52(pkgPath)) {
         try {
           const pkg = JSON.parse(readFileSync40(pkgPath, "utf8"));
           if (pkg.name === PKG_NAME)
             return dir;
         } catch {}
       }
-      const parent = dirname27(dir);
+      const parent = dirname28(dir);
       if (parent === dir)
         return null;
       dir = parent;
@@ -43150,7 +43303,7 @@ function locateNpmGlobal() {
     if (!root)
       return null;
     const candidate = resolve37(root, PKG_NAME);
-    return existsSync51(resolve37(candidate, "package.json")) ? candidate : null;
+    return existsSync52(resolve37(candidate, "package.json")) ? candidate : null;
   } catch {
     return null;
   }
@@ -43158,7 +43311,7 @@ function locateNpmGlobal() {
 function locateBunGlobal() {
   try {
     const candidate = resolve37(homedir33(), ".bun", "install", "global", "node_modules", PKG_NAME);
-    return existsSync51(resolve37(candidate, "package.json")) ? candidate : null;
+    return existsSync52(resolve37(candidate, "package.json")) ? candidate : null;
   } catch {
     return null;
   }
@@ -43177,7 +43330,7 @@ function buildRecommendation(pathFirstBin) {
 function diagnoseShadow(self) {
   const selfPackageRoot = (() => {
     try {
-      return self?.selfPackageRoot ? realpathSync5(self.selfPackageRoot) : null;
+      return self?.selfPackageRoot ? realpathSync6(self.selfPackageRoot) : null;
     } catch {
       return self?.selfPackageRoot ?? null;
     }
@@ -43261,8 +43414,8 @@ var init_dashboard_host = __esm(() => {
 
 // scripts/launch.ts
 import { spawn as spawn2 } from "child_process";
-import { realpathSync as realpathSync6, existsSync as existsSync52 } from "node:fs";
-import { resolve as resolve38, dirname as dirname28 } from "node:path";
+import { realpathSync as realpathSync7, existsSync as existsSync53 } from "node:fs";
+import { resolve as resolve38, dirname as dirname29 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 import { createInterface } from "node:readline";
 function launch(mode) {
@@ -43286,9 +43439,9 @@ function launch(mode) {
     process.env.PORT = port;
     process.env.HOSTNAME = bindHost;
     cmd = "node";
-    const packageRoot = process.env.FAILPROOFAI_PACKAGE_ROOT ?? resolve38(dirname28(realpathSync6(fileURLToPath2(import.meta.url))), "..");
+    const packageRoot = process.env.FAILPROOFAI_PACKAGE_ROOT ?? resolve38(dirname29(realpathSync7(fileURLToPath2(import.meta.url))), "..");
     const serverJsPath = resolve38(packageRoot, ".next/standalone/server.js");
-    if (!existsSync52(serverJsPath)) {
+    if (!existsSync53(serverJsPath)) {
       let shadowMessage = null;
       try {
         const diag = diagnoseShadow({ selfPackageRoot: packageRoot, selfVersion: version2 });
@@ -44063,23 +44216,40 @@ import {
   cpSync as cpSync2,
   readFileSync as readFileSync41,
   writeFileSync as writeFileSync29,
-  existsSync as existsSync53,
-  lstatSync as lstatSync3,
-  mkdirSync as mkdirSync32,
+  existsSync as existsSync54,
+  lstatSync as lstatSync4,
+  mkdirSync as mkdirSync33,
   readlinkSync as readlinkSync2,
-  realpathSync as realpathSync7,
-  renameSync as renameSync13,
-  rmSync as rmSync20,
+  realpathSync as realpathSync8,
+  renameSync as renameSync14,
+  rmSync as rmSync21,
   symlinkSync as symlinkSync2,
   unlinkSync as unlinkSync10
 } from "node:fs";
-import { resolve as resolve39, dirname as dirname29, basename as basename12 } from "node:path";
+import { resolve as resolve39, dirname as dirname30, basename as basename13 } from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 function readYamlDoc2(path) {
+  if (!existsSync54(path))
+    return $parseDocument("");
+  let text;
   try {
-    return existsSync53(path) ? $parseDocument(readFileSync41(path, "utf8")) : $parseDocument("");
+    text = readFileSync41(path, "utf8");
+  } catch (err) {
+    throw new UnreadableAgentConfigError2(path, `it could not be read (${err instanceof Error ? err.message : String(err)})`);
+  }
+  const doc = $parseDocument(text);
+  if (doc.errors.length > 0) {
+    const first = doc.errors[0]?.message.split(`
+`)[0] ?? "syntax error";
+    throw new UnreadableAgentConfigError2(path, `it does not parse as YAML (${first})`);
+  }
+  return doc;
+}
+function inspectYamlDoc2(path) {
+  try {
+    return readYamlDoc2(path);
   } catch {
-    return $parseDocument("");
+    return null;
   }
 }
 function isMarkedHook2(hook) {
@@ -44095,18 +44265,31 @@ function getHermesPluginSourcePath2() {
   const fromEnv = process.env.FAILPROOFAI_PACKAGE_ROOT;
   if (fromEnv)
     return resolve39(fromEnv, HERMES_PLUGIN_SOURCE_DIR2);
-  return resolve39(fileURLToPath3(import.meta.url), "..", "..", "..", HERMES_PLUGIN_SOURCE_DIR2);
+  return findHermesPluginSourcePath2(dirname30(fileURLToPath3(import.meta.url)));
+}
+function findHermesPluginSourcePath2(startDir) {
+  let dir = resolve39(startDir);
+  for (let i = 0;i < 8; i++) {
+    const candidate = resolve39(dir, HERMES_PLUGIN_SOURCE_DIR2);
+    if (existsSync54(resolve39(candidate, "plugin.yaml")))
+      return candidate;
+    const parent = dirname30(dir);
+    if (parent === dir)
+      break;
+    dir = parent;
+  }
+  return resolve39(startDir, "..", "..", HERMES_PLUGIN_SOURCE_DIR2);
 }
 function hermesPluginPathForSettings2(settingsPath) {
-  return resolve39(dirname29(settingsPath), "plugins", HERMES_PLUGIN_ID2);
+  return resolve39(dirname30(settingsPath), "plugins", HERMES_PLUGIN_ID2);
 }
 function hasAllHermesPluginFiles2(dir) {
-  return HERMES_PLUGIN_FILES2.every((file) => existsSync53(resolve39(dir, file)));
+  return HERMES_PLUGIN_FILES2.every((file) => existsSync54(resolve39(dir, file)));
 }
 function isFailproofaiHermesPluginSource2(dir) {
-  if (basename12(dir) !== HERMES_PLUGIN_SOURCE_DIR2)
+  if (basename13(dir) !== HERMES_PLUGIN_SOURCE_DIR2)
     return false;
-  if (!existsSync53(dir))
+  if (!existsSync54(dir))
     return true;
   try {
     const manifest = readFileSync41(resolve39(dir, "plugin.yaml"), "utf8");
@@ -44119,7 +44302,7 @@ function samePath2(a, b) {
   if (resolve39(a) === resolve39(b))
     return true;
   try {
-    return realpathSync7(a) === realpathSync7(b);
+    return realpathSync8(a) === realpathSync8(b);
   } catch {
     return false;
   }
@@ -44129,7 +44312,7 @@ function hermesPluginState2(settingsPath) {
   let isLink;
   let isDirectory;
   try {
-    const stat = lstatSync3(pluginPath);
+    const stat = lstatSync4(pluginPath);
     isLink = stat.isSymbolicLink();
     isDirectory = stat.isDirectory();
   } catch {
@@ -44138,7 +44321,7 @@ function hermesPluginState2(settingsPath) {
   if (isLink) {
     let target;
     try {
-      target = resolve39(dirname29(pluginPath), readlinkSync2(pluginPath));
+      target = resolve39(dirname30(pluginPath), readlinkSync2(pluginPath));
     } catch {
       return { kind: "foreign" };
     }
@@ -44151,21 +44334,29 @@ function hermesPluginState2(settingsPath) {
       current: samePath2(target, getHermesPluginSourcePath2())
     };
   }
-  if (isDirectory && existsSync53(resolve39(pluginPath, HERMES_PLUGIN_MARKER2))) {
+  if (isDirectory && existsSync54(resolve39(pluginPath, HERMES_PLUGIN_MARKER2))) {
     return { kind: "copy", complete: hasAllHermesPluginFiles2(pluginPath) };
   }
   return { kind: "foreign" };
 }
 function hermesConfigState2(settingsPath) {
-  if (!existsSync53(settingsPath)) {
-    return { pluginEnabled: false, legacyShellHookPresent: false };
+  if (!existsSync54(settingsPath)) {
+    return { pluginEnabled: false, pluginListed: false, pluginDisabled: false, legacyShellHookPresent: false };
+  }
+  const doc = inspectYamlDoc2(settingsPath);
+  if (!doc) {
+    return { pluginEnabled: false, pluginListed: false, pluginDisabled: false, legacyShellHookPresent: false, unreadable: true };
   }
-  const doc = readYamlDoc2(settingsPath);
   const js = doc.toJS() ?? {};
   const enabled = js.plugins?.enabled;
+  const disabled = js.plugins?.disabled;
   const legacyShellHookPresent = !!js.hooks && typeof js.hooks === "object" && Object.values(js.hooks).some((entries) => Array.isArray(entries) && entries.some((entry) => isMarkedHook2(entry)));
+  const pluginListed = Array.isArray(enabled) && enabled.includes(HERMES_PLUGIN_ID2);
+  const pluginDisabled = Array.isArray(disabled) && disabled.includes(HERMES_PLUGIN_ID2);
   return {
-    pluginEnabled: Array.isArray(enabled) && enabled.includes(HERMES_PLUGIN_ID2),
+    pluginEnabled: pluginListed && !pluginDisabled,
+    pluginListed,
+    pluginDisabled,
     legacyShellHookPresent
   };
 }
@@ -44183,15 +44374,20 @@ function hermesProfileHealth() {
       pluginInstalled,
       pluginMode: plugin.kind === "link" || plugin.kind === "copy" ? plugin.kind : null,
       pluginEnabled: config.pluginEnabled,
+      pluginDisabled: config.pluginDisabled,
       legacyShellHookPresent: config.legacyShellHookPresent,
       cronUnchecked: config.legacyShellHookPresent && !pluginWorks,
-      healthy: pluginWorks && !config.legacyShellHookPresent
+      configUnreadable: config.unreadable === true,
+      healthy: pluginWorks && !config.legacyShellHookPresent && config.unreadable !== true
     };
   });
 }
 function hermesProfileStatusRows() {
-  return hermesProfileHealth().filter((profile) => existsSync53(profile.home)).map((profile) => {
+  return hermesProfileHealth().filter((profile) => existsSync54(profile.home)).map((profile) => {
     const label = "hermes/" + profile.name;
+    if (profile.configUnreadable) {
+      return [label, `UNHEALTHY — ${profile.settingsPath} does not parse; failproofai leaves it untouched until it is fixed`];
+    }
     if (profile.cronUnchecked) {
       return [
         label,
@@ -44201,7 +44397,9 @@ function hermesProfileStatusRows() {
     const problems = [];
     if (!profile.pluginInstalled)
       problems.push("plugin files missing or incomplete");
-    if (!profile.pluginEnabled)
+    if (profile.pluginDisabled)
+      problems.push("plugin disabled (listed in plugins.disabled)");
+    else if (!profile.pluginEnabled)
       problems.push("plugin not enabled");
     if (profile.legacyShellHookPresent)
       problems.push("legacy shell hook also present");
@@ -44213,20 +44411,29 @@ function hermesProfileStatusRows() {
     ];
   });
 }
-var HERMES_PLUGIN_ID2 = "failproofai", HERMES_PLUGIN_MARKER2 = ".failproofai-managed", HERMES_PLUGIN_FILES2, HERMES_PLUGIN_SOURCE_DIR2 = "hermes-plugin", ANTIGRAVITY_TOOL_EVENTS2;
+var UnreadableAgentConfigError2, HERMES_PLUGIN_ID2 = "failproofai", HERMES_PLUGIN_MARKER2 = ".failproofai-managed", HERMES_PLUGIN_FILES2, HERMES_PLUGIN_SOURCE_DIR2 = "hermes-plugin", ANTIGRAVITY_TOOL_EVENTS2;
 var init_integrations2 = __esm(() => {
   init_dist();
+  init_safe_config_write();
   init_hermes_profiles();
   init_openclaw_profiles();
   init_types();
+  UnreadableAgentConfigError2 = class UnreadableAgentConfigError2 extends Error {
+    path;
+    constructor(path, reason) {
+      super(`Refusing to modify ${path}: ${reason}. ` + `failproofai never rewrites a config it could not parse — fix or move the file, then retry.`);
+      this.path = path;
+      this.name = "UnreadableAgentConfigError";
+    }
+  };
   HERMES_PLUGIN_FILES2 = ["plugin.yaml", "__init__.py", "client.py", "ledger.py"];
   ANTIGRAVITY_TOOL_EVENTS2 = new Set(["PreToolUse", "PostToolUse"]);
 });
 
 // scripts/launch.ts
 import { spawn as spawn3 } from "child_process";
-import { realpathSync as realpathSync8, existsSync as existsSync54 } from "node:fs";
-import { resolve as resolve40, dirname as dirname30 } from "node:path";
+import { realpathSync as realpathSync9, existsSync as existsSync55 } from "node:fs";
+import { resolve as resolve40, dirname as dirname31 } from "node:path";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
 import { createInterface as createInterface2 } from "node:readline";
 function launch2(mode) {
@@ -44250,9 +44457,9 @@ function launch2(mode) {
     process.env.PORT = port;
     process.env.HOSTNAME = bindHost;
     cmd = "node";
-    const packageRoot = process.env.FAILPROOFAI_PACKAGE_ROOT ?? resolve40(dirname30(realpathSync8(fileURLToPath4(import.meta.url))), "..");
+    const packageRoot = process.env.FAILPROOFAI_PACKAGE_ROOT ?? resolve40(dirname31(realpathSync9(fileURLToPath4(import.meta.url))), "..");
     const serverJsPath = resolve40(packageRoot, ".next/standalone/server.js");
-    if (!existsSync54(serverJsPath)) {
+    if (!existsSync55(serverJsPath)) {
       let shadowMessage = null;
       try {
         const diag = diagnoseShadow({ selfPackageRoot: packageRoot, selfVersion: version2 });
@@ -44348,18 +44555,18 @@ var init_cli_error2 = __esm(() => {
 });
 
 // bin/failproofai.mjs
-import { realpathSync as realpathSync9 } from "fs";
-import { dirname as dirname31, resolve as resolve41 } from "path";
+import { realpathSync as realpathSync10 } from "fs";
+import { dirname as dirname32, resolve as resolve41 } from "path";
 import { fileURLToPath as fileURLToPath5 } from "url";
 // package.json
-var version = "1.0.9-beta.0";
+var version = "1.0.9-beta.2";
 
 // bin/failproofai.mjs
 if (!process.env.FAILPROOFAI_PACKAGE_ROOT) {
-  process.env.FAILPROOFAI_PACKAGE_ROOT = resolve41(dirname31(realpathSync9(fileURLToPath5(import.meta.url))), "..");
+  process.env.FAILPROOFAI_PACKAGE_ROOT = resolve41(dirname32(realpathSync10(fileURLToPath5(import.meta.url))), "..");
 }
 if (!process.env.FAILPROOFAI_DIST_PATH) {
-  process.env.FAILPROOFAI_DIST_PATH = resolve41(dirname31(realpathSync9(fileURLToPath5(import.meta.url))), "..", "dist");
+  process.env.FAILPROOFAI_DIST_PATH = resolve41(dirname32(realpathSync10(fileURLToPath5(import.meta.url))), "..", "dist");
 }
 var args = process.argv.slice(2);
 if (args[0] === "p" || args[0] === "policy")