[beta.13] Extra capture paths per agent CLI, the deployment/version rename, and two silent enforcement gaps

[chhhee10]

Ten commits, and the original title (a one-line wizard copy change) is now the smallest thing in here. Retitled to match what it actually contains.

Lands with FailproofAI/agenteye#559. The two are one change split across two repos: #559 renames the cloud-policy vocabulary through AgentEye's schema, server and dashboard; this renames it through the daemon and moves the wire contract to schemaVersion: 2. Verified together end to end — see Cross-repo verification below.

---

1. Setup flow — failproofai flush, back-navigation, five defects (fd9cf998, d0132a8e, 15363627)

failproofai flush delivers what is already spooled instead of waiting out the sweeper's interval, with --wait blocking until the spool drains or its timeout expires. The install stopped waiting on a blind sleep; the wizard gained ← back-navigation; cloud-managed policies list with their deployment, version and status.

2. The rename — a generation is a deployment, a revision is a version (921b7f60)

Words the product used nowhere else. Renamed through the daemon, its persisted state and every test name.

3. Capture sessions from more than one location per agent CLI (3ecab827)

Every source watched exactly the place its own installer chose. That is right for one laptop and wrong for a second profile, a mounted team share, a container's home bind-mounted beside the host's, or an agent an operator relocated — all of which hold real sessions that nothing collected.

failproofai harness add-path claude work=/srv/team/.claude/projects
failproofai harness list
failproofai harness remove-path claude work

Writes [collector.sources.<harness>] extra_paths in config.toml; FAILPROOFAI_<HARNESS>_EXTRA_PATHS overrides for containers. 12 harnesses, 13 sources — claude covers subagent transcripts, which share a root and would otherwise be dropped silently under an added path. Grammar, folder-name label fallback and <label>-<agentId> namespacing match AgentEye's own collector rather than inventing a second answer.

Three things are structural, not cosmetic:

Decision	What breaks without it
Each labelled path is its own task	roots is walked by one task with one Params, and the label lives in Params — a second root there inherits the default's agent id
Each gets its own cursor directory	The store rewrites its whole map atomically; sharing means both clobber each other's watermark and re-read from zero after every restart
Each gets its own health key	Otherwise instances overwrite each other's record and root_present alternates, destroying the "absent root versus idle source" distinction. Hermes hit exactly this with per-profile databases

The <label>- prefix is applied in SpoolWriter::push — the one point every event passes through — and not in either engine. A SQLite format takes params.agent_id only as a fallback and derives the real id from the row (devin::agent_id → devin-<project>, which never consults the fallback for a session with a working directory, i.e. all of them). Prefixing in the engine would namespace only the sessions that failed to derive an id; a test fails on precisely that mistake.

No restart and no sudo: the collector manager already re-reads config.toml on an interval and cycles on any CollectorConfig change, and sources rides that by living inside the compared value (79be966b).

4. Upgrades silently emptied the policy set (9c498e5b)

Layout 1 kept the user's policy selection at ~/.failproofai/policies-config.json; layout 2 keeps it at policies/local-policies/policies-config.json — and both were on the reset list. The reset runs unattended on the first command after an upgrade, and the machine still read as configured afterwards (isConfigured() is a union that sees the agent CLIs' untouched settings files), so the wizard never re-asked.

Measured in a container, identical starting state, two upgrade targets:

	@latest → published @next	@latest → this branch
enabledPolicies	absent	all three carried
decision log	252 → 252	252 → 252
claude hook entries	56	56
enforces after upgrade	NO	YES

Hook entries stayed installed in every agent CLI and kept firing — against an empty policy set. An allowlist, not a copy: layout 1's file also held a collector block in camelCase, and layout 2 moved those to snake_case in config.toml, so carrying it would add a key nothing reads that looks preserved and behaves absent. Read-before/write-after, because its source and its destination's parent are both on the reset list.

5. Review fixes (18eaebb5) — 9 CodeRabbit threads, two of them real bugs

• ← hung the wizard. BACK is a symbol the shared handler injects, and multiSelect's summary calls values.includes(...) → TypeError, thrown inside finish before resolve(). The promise never settled and input stopped responding. selectOne rendered Symbol(failproofai.back) as the user's answer. Handled once in collapse().
• Pre-rename cloud state became unreadable. Both persisted structs carry deny_unknown_fields, so an upgraded daemon failed to parse its own active.json on three counts at once.
• flush reported success on platforms with no daemon; mocked git errors said unknown version, a string git never produces; #PR placeholders, --wait wording, rev → version in the activity detail.

6. schemaVersion: 2 (76acc68f)

The v1 payload named its fields generation and revision; after the rename it carried neither, at the same version number. #559 now emits 2, and this accepts both — 1 only for files already on disk, never from a server, because a machine that ran an earlier beta has a desired-state.json and active.json at version 1 and deny_unknown_fields would make them unreadable.

That asymmetry decides where the aliases live: kept on the persisted ActiveDeployment/ActivePolicy (bytes possibly written by an older daemon), removed from the wire DesiredState/DesiredPolicy (no server can emit the old spelling, so an alias is dead code and a silently-tolerated stale field is how two sides drift apart). Tests pin each half, including that the wire now refuses the old spelling.

The TypeScript hook reader had the same constant and accepted only 1 — the worst shape of this bug: the daemon reconciles, writes a correct active.json, logs "deployment 1 active", and the hook path alone refuses it, so cloud policy stops being enforced while every other signal reads healthy. Reproduced exactly that way against a live #559 server before fixing it.

---

Cross-repo verification

Against a real local stack (Postgres + ClickHouse + Redis + server + dashboard) running #559's branch, with a daemon built from this branch:

• fresh database applies all 68 migrations; a database seeded through the old API keeps its rows across the rename
• /enforcement/v1/desired-state emits deployment/version at schemaVersion: 2
• the daemon pulls it, SHA-256 verifies every artifact, writes active.json at v2, and a matching tool call is denied with that policy's reason

Multi-path, five harnesses across both engines, default and extra path:

harness	engine	default	extra path
claude	file-tail	claude-work-default	share-claude-work-share
goose	SQLite	goose-work-goose	alt-goose-work-goose
opencode	SQLite	opencode-work-oco	alt-opencode-work-oco
openclaw	file-tail	openclaw-main	alt-openclaw-main
pi	file-tail	pi-work-pi	alt-pi-work-pi

claude, goose and opencode were driven with a real LLM. OpenClaw is the strongest case — both sessions derive the same id, so only the label separates them. A path added to a running daemon was captured within one poll interval (task count 21 → 23), and its first transcript reached the server.

Tests

8 engine tests through the real filetail/sqlitepoll loops; 16 grammar unit tests; a cross-language contract test parsing the exact config.toml bytes the TypeScript CLI emits; a test reading HARNESS_KEYS out of main.rs so the two hand-maintained lists cannot drift; 7 migration tests; 3 pre-rename compatibility tests; back-navigation and validation-row tests; and an e2e case driving the real binary against a hand-edited config. Two were explicitly proved non-vacuous by reverting the fix and watching them fail.

cargo test --workspace 624 passing, clippy + fmt clean; tsc --noEmit clean; bun run lint 0 errors; bun run test:run 3261 passing.

One pre-existing failure, not from this branch: daemon-service.test.ts > refuses to half-install when it cannot elevate asserts /etc/systemd/system/failproofaid@<user>.service is absent, and the dev machine it ran on has a real one installed. It passes in CI, and fails identically on this branch with every change stashed.

🤖 Generated with Claude Code

https://claude.ai/code/session_01CCSFM55BcUEAHECabpeSr4

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

📝 Walkthrough

Walkthrough

The CLI adds flush with optional waiting and timeout handling. The daemon consumes flush requests and immediately drains pending batches. The setup wizard supports back navigation, uses “harnesses”, and places API-key connection first. Cloud policy metadata now uses deployment/version terminology.

Changes

Flush and interface updates

Layer / File(s)	Summary
Add flush command and daemon delivery src/hooks/flush-cli.ts, bin/failproofai.mjs, crates/failproofaid/src/..., crates/fpai-collect/src/..., related tests	The CLI counts pending batches, checks prerequisites, writes flush requests, optionally waits for delivery, and reports timeout state. The daemon consumes requests and triggers an immediate sweeper pass.
Update setup navigation and prompt rendering src/hooks/configure-wizard.ts, src/hooks/tui.ts, bin/failproofai.mjs, __tests__/hooks/configure-wizard.test.ts, __tests__/hooks/tui.test.ts	The wizard supports back navigation, uses “harnesses”, and uses API-key-first ordering. Prompts truncate long content to terminal width.
Rename cloud policy deployment metadata crates/failproofaid/src/cloud_policies.rs, src/hooks/cloud-managed-policies.ts, src/hooks/handler.ts, crates/fpai-collect/src/sources/hooks/transform.rs, app/policies/hooks-client.tsx, related tests	Cloud policy structures, paths, manifests, attribution fields, telemetry fields, and UI output use deployment/version terminology.
Improve daemon readiness and cloud policy listing src/hooks/daemon-service.ts, src/hooks/manager.ts, related tests	Daemon startup polling checks service state and socket readiness. Hook listing displays active cloud-managed policies and suppresses manifest read failures.
Document the beta.13 release CHANGELOG.md	The changelog records the flush feature and related setup, prompt, terminology, cloud listing, daemon, and CLI documentation updates.

Estimated code review effort: 4 (Complex) | ~60 minutes

Possibly related PRs

• FailproofAI/failproofai#516: Extends the earlier setup wizard and TUI flow.
• FailproofAI/failproofai#623: Modifies related custom-policy loading and cloud policy listing code.
• FailproofAI/failproofai#632: Extends the daemon architecture used by the flush request flow.

Suggested labels: enhancement

Suggested reviewers: hermes-exosphere

Poem

A rabbit sends a flush request,
The daemon clears the waiting nest.
Harnesses guide the setup right,
Cloud deployments shine in light,
Beta.13 completes its quest.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly identifies major changes, including the deployment/version rename and enforcement fixes, but it omits some other changes.
Description check	✅ Passed	The description gives detailed scope, cross-repository context, verification results, and known test limitations, but omits the template headings and checkboxes.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@CHANGELOG.md`:
- Line 6: Replace the `#PR` placeholder in the changelog entry with `#663`,
preserving the existing dated, versioned entry and single-line description.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 46e07879-1743-42f6-86a2-69eaf27e55d0

📥 Commits

Reviewing files that changed from the base of the PR and between 9a51e57 and 01d4973.

📒 Files selected for processing (2)

• CHANGELOG.md
• src/hooks/configure-wizard.ts

[coderabbitai]

Actionable comments posted: 3

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

src/hooks/flush-cli.ts (1)

540-560: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

Consume and validate all flush arguments.

flush --wait unexpected ignores unexpected. flush --timeout 5 accepts a timeout that has no effect because --wait is absent. Repeated --timeout flags silently use only the first value.

Parse the argument list in one pass. Reject positional arguments, duplicate flags, and --timeout without --wait.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/hooks/flush-cli.ts` around lines 540 - 560, Update the flush CLI argument
parsing in the relevant flow of flush-cli.ts to consume and validate the full
argument list in one pass. Reject positional arguments such as unexpected,
duplicate --wait or --timeout flags, and any --timeout usage without --wait;
preserve the existing valid option behavior while ensuring all supplied
arguments are accounted for.

🧹 Nitpick comments (1)

crates/fpai-collect/src/delivery.rs (1)

251-277: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Add a direct flush-sweep behavior test.

The new branch is not exercised by the current tests. crates/fpai-collect/tests/delivery.rs passes an AtomicBool that remains false. The existing stale_batches tests do not verify that sweep observes a request and bypasses both the minimum age and the per-pass limit.

Start a sweeper with fresh batches, set the shared flag, and assert that all batches drain without waiting for SWEEP_MIN_AGE.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@crates/fpai-collect/src/delivery.rs` around lines 251 - 277, Add a delivery
sweep test in the existing delivery test suite that starts the sweeper with
fresh batches and a shared AtomicBool flush flag, sets the flag while the
sweeper is running, and verifies all batches are delivered without waiting for
SWEEP_MIN_AGE or being limited by SWEEP_MAX_FILES. Use the existing sweep and
delivery test helpers, ensuring the test exercises the flush_now branch
directly.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@__tests__/hooks/tui.test.ts`:
- Around line 143-189: Add coverage to the promptText redraw tests for a failing
validate callback after pressing Enter, including the validation-error display
path. Update the measurement helper to split each ANSI-stripped write on newline
boundaries and measure the widest individual row rather than the complete write,
then assert every rendered row stays within the terminal width.

In `@CHANGELOG.md`:
- Line 6: Update the changelog entry for `failproofai flush --wait` to state
that it waits until the spool drains or the configured timeout expires, while
preserving the existing description of flush behavior.

In `@src/hooks/flush-cli.ts`:
- Around line 109-121: Update the flush flow around isDaemonSupportedPlatform()
to return the same error response before writing flush-request.json when the
platform is unsupported; preserve the existing daemon status handling for
supported platforms. Add a regression test for the flush entry point that mocks
an unsupported platform and verifies an error is returned and no request file is
created.

---

Outside diff comments:
In `@src/hooks/flush-cli.ts`:
- Around line 540-560: Update the flush CLI argument parsing in the relevant
flow of flush-cli.ts to consume and validate the full argument list in one pass.
Reject positional arguments such as unexpected, duplicate --wait or --timeout
flags, and any --timeout usage without --wait; preserve the existing valid
option behavior while ensuring all supplied arguments are accounted for.

---

Nitpick comments:
In `@crates/fpai-collect/src/delivery.rs`:
- Around line 251-277: Add a delivery sweep test in the existing delivery test
suite that starts the sweeper with fresh batches and a shared AtomicBool flush
flag, sets the flag while the sweeper is running, and verifies all batches are
delivered without waiting for SWEEP_MIN_AGE or being limited by SWEEP_MAX_FILES.
Use the existing sweep and delivery test helpers, ensuring the test exercises
the flush_now branch directly.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 0a8b3f07-7bb3-4cd4-b609-d7a175423fde

📥 Commits

Reviewing files that changed from the base of the PR and between 01d4973 and 9e23454.

📒 Files selected for processing (12)

• CHANGELOG.md
• __tests__/hooks/configure-wizard.test.ts
• __tests__/hooks/flush-cli.test.ts
• __tests__/hooks/tui.test.ts
• bin/failproofai.mjs
• crates/failproofaid/src/main.rs
• crates/failproofaid/src/paths.rs
• crates/fpai-collect/src/delivery.rs
• crates/fpai-collect/tests/delivery.rs
• src/hooks/configure-wizard.ts
• src/hooks/flush-cli.ts
• src/hooks/tui.ts

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/hooks/tui.ts`:
- Around line 509-512: Update the internal prompt result handling around
multiSelect and selectOne to recognize the Back result before array or choice
formatting, returning the “back” summary without passing the sentinel to
values.includes or rendering it as a choice. Widen the internal result type to
include Back, and add a direct left-arrow multiSelect test in the existing TUI
hook tests covering successful back navigation.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: b45b7acb-e577-43a2-8388-89112d66bb61

📥 Commits

Reviewing files that changed from the base of the PR and between 9e23454 and a632ebb.

📒 Files selected for processing (8)

• CHANGELOG.md
• __tests__/hooks/configure-wizard.test.ts
• __tests__/hooks/daemon-service.test.ts
• __tests__/hooks/manager-cloud-listing.test.ts
• src/hooks/configure-wizard.ts
• src/hooks/daemon-service.ts
• src/hooks/manager.ts
• src/hooks/tui.ts

🚧 Files skipped from review as they are similar to previous changes (1)

• CHANGELOG.md

[coderabbitai]

Actionable comments posted: 4

🧹 Nitpick comments (2)

__tests__/hooks/worker-server.test.ts (1)

247-247: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Rename the stale directory variable.

generationDir now points to deployments/42. Rename it to deploymentDir and update its local uses. This keeps the test aligned with the deployment terminology.

Proposed rename

-    const generationDir = join(managedRoot, "deployments", "42");
+    const deploymentDir = join(managedRoot, "deployments", "42");

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@__tests__/hooks/worker-server.test.ts` at line 247, Rename the local variable
generationDir to deploymentDir in the affected test and update every local
reference accordingly, preserving the existing deployments/42 path and test
behavior.

__tests__/hooks/policy-attribution.test.ts (1)

119-123: 🗄️ Data Integrity & Integration | 🔵 Trivial | ⚡ Quick win

Assert the active deployment in the plain-allow case.

evaluateHookEvent records cloudDeployment when an active cloud deployment exists, even when no policy decides the event. This test only checks that cloudVersion is absent. Add an assertion for cloudDeployment to protect this contract.

Proposed assertion

     expect(row().policySource).toBeUndefined();
     expect(row().cloudVersion).toBeUndefined();
+    expect(row().cloudDeployment).toBe(184);

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@__tests__/hooks/policy-attribution.test.ts` around lines 119 - 123, Update
the plain-allow test around evaluateHookEvent to also assert that
row().cloudDeployment matches the active cloud deployment, while preserving the
existing undefined assertions for policySource and cloudVersion.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@__tests__/hooks/builtin-policies.test.ts`:
- Line 2756: Update the command-error mocks in the base-ref and related cases
around opts.baseRefExists, including the referenced cases, to use realistic Git
diagnostics such as “unknown revision or path not in the working tree,”
“ambiguous argument,” or “Needed a single revision” instead of “unknown
version”; ensure the production classifier recognizes those diagnostics if the
tests exercise it.

In `@app/policies/hooks-client.tsx`:
- Around line 399-400: Update the cloud policy detail template in the relevant
render expression to label item.cloudVersion as “version” instead of “rev”,
preserving the existing cloud metadata and policySource branches.

In `@CHANGELOG.md`:
- Line 8: Remove the duplicate “### Features” heading from the changelog while
preserving the cloud-policy entry under the existing Features section for
version 1.0.0-beta.13.

In `@crates/failproofaid/src/cloud_policies.rs`:
- Around line 30-44: Preserve schemaVersion 1 compatibility across the
cloud-policy migration: in crates/failproofaid/src/cloud_policies.rs:30-44,
update DesiredState deserialization to accept legacy generation and revision
fields; in crates/failproofaid/src/cloud_policies.rs:71-81, apply the same
compatibility to the active-manifest deserializer. In
src/hooks/cloud-managed-policies.ts:36-62, normalize legacy schemaVersion 1
fields, including generations/<id> paths, before validation. Add the
corresponding upgrade fixture in
__tests__/hooks/cloud-managed-policies.test.ts:19-28.

---

Nitpick comments:
In `@__tests__/hooks/policy-attribution.test.ts`:
- Around line 119-123: Update the plain-allow test around evaluateHookEvent to
also assert that row().cloudDeployment matches the active cloud deployment,
while preserving the existing undefined assertions for policySource and
cloudVersion.

In `@__tests__/hooks/worker-server.test.ts`:
- Line 247: Rename the local variable generationDir to deploymentDir in the
affected test and update every local reference accordingly, preserving the
existing deployments/42 path and test behavior.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: b43d42a3-41d7-46ce-a1d7-bb6c91d01850

📥 Commits

Reviewing files that changed from the base of the PR and between a632ebb and 96bb33f.

📒 Files selected for processing (34)

• CHANGELOG.md
• __tests__/hooks/builtin-policies.test.ts
• __tests__/hooks/cloud-connect-permissions.test.ts
• __tests__/hooks/cloud-enrollment-cli.test.ts
• __tests__/hooks/cloud-enrollment.test.ts
• __tests__/hooks/cloud-managed-policies.test.ts
• __tests__/hooks/configure-wizard.test.ts
• __tests__/hooks/fail-closed-force-decision.test.ts
• __tests__/hooks/handler.test.ts
• __tests__/hooks/manager-cloud-listing.test.ts
• __tests__/hooks/policy-attribution.test.ts
• __tests__/hooks/session-pause-enforcement.test.ts
• __tests__/hooks/worker-server.test.ts
• __tests__/integration-suite/is-error.test.ts
• app/policies/hooks-client.tsx
• crates/failproofaid/src/cloud_client.rs
• crates/failproofaid/src/cloud_policies.rs
• crates/failproofaid/src/main.rs
• crates/failproofaid/src/paths.rs
• crates/failproofaid/src/telemetry.rs
• crates/failproofaid/tests/collector_reload_e2e.rs
• crates/fpai-collect/src/health.rs
• crates/fpai-collect/src/sources/hooks/transform.rs
• crates/fpai-collect/tests/hooks_source.rs
• src/hooks/cloud-connection.ts
• src/hooks/cloud-enrollment-cli.ts
• src/hooks/cloud-enrollment.ts
• src/hooks/cloud-managed-policies.ts
• src/hooks/custom-hooks-loader.ts
• src/hooks/daemon-service.ts
• src/hooks/fp-home.ts
• src/hooks/handler.ts
• src/hooks/hook-activity-store.ts
• src/hooks/manager.ts

🚧 Files skipped from review as they are similar to previous changes (6)

• tests/hooks/manager-cloud-listing.test.ts
• tests/hooks/configure-wizard.test.ts
• src/hooks/manager.ts
• crates/failproofaid/src/paths.rs
• src/hooks/daemon-service.ts
• crates/failproofaid/src/main.rs