failproofai 0.0.10 → 0.0.11-beta.10

package/.next/standalone/lib/auth/auth-store.ts

@@ -0,0 +1,250 @@
+/**
+ * Persistence layer for the FailproofAI auth.json file.
+ *
+ * Tokens live at ~/.failproofai/auth.json with mode 0600. The dashboard's
+ * Next.js API routes and the CLI both read/write through here so the user's
+ * session survives across `failproofai` (dashboard) and `failproofai auth`
+ * (CLI) invocations.
+ */
+
+import { existsSync, readFileSync, rmSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+
+import { writeJsonAtomically } from "../atomic-write";
+import {
+  AuthApiError,
+  decodeJwt,
+  fetchMe,
+  refreshAccessToken,
+  type MeResponse,
+} from "./api-server-client";
+
+export interface StoredAuth {
+  access_token: string;
+  refresh_token: string;
+  access_expires_at: number; // unix seconds
+  refresh_expires_at: number; // unix seconds (best-effort; not strictly verified server-side)
+  user: { id: string; email: string };
+}
+
+export function getAuthDir(): string {
+  const override = process.env.FAILPROOFAI_AUTH_DIR;
+  if (override) return override;
+  return join(homedir(), ".failproofai");
+}
+
+export function getAuthFilePath(): string {
+  return join(getAuthDir(), "auth.json");
+}
+
+/** Location of the persisted re-audit reminder (separate from auth.json so
+ *  the reminder survives unrelated session refreshes). */
+export function getReminderFilePath(): string {
+  return join(getAuthDir(), "next-audit.json");
+}
+
+export interface StoredReminder {
+  /** Unix seconds. */
+  next_audit_at: number;
+  /** Email the reminder was set for. Used to invalidate the reminder if the
+   *  active session belongs to a different user. */
+  user_email: string;
+  /** Unix seconds. */
+  set_at: number;
+}
+
+export function readReminder(): StoredReminder | null {
+  const p = getReminderFilePath();
+  if (!existsSync(p)) return null;
+  try {
+    const raw = readFileSync(p, "utf-8");
+    const parsed = JSON.parse(raw) as Partial<StoredReminder>;
+    if (
+      typeof parsed.next_audit_at !== "number" ||
+      typeof parsed.user_email !== "string" ||
+      typeof parsed.set_at !== "number"
+    ) {
+      return null;
+    }
+    return {
+      next_audit_at: parsed.next_audit_at,
+      user_email: parsed.user_email,
+      set_at: parsed.set_at,
+    };
+  } catch {
+    return null;
+  }
+}
+
+export function writeReminder(reminder: StoredReminder): void {
+  writeJsonAtomically(getReminderFilePath(), reminder);
+}
+
+export function deleteReminder(): void {
+  const p = getReminderFilePath();
+  if (existsSync(p)) rmSync(p, { force: true });
+}
+
+export function readAuth(): StoredAuth | null {
+  const p = getAuthFilePath();
+  if (!existsSync(p)) return null;
+  try {
+    const raw = readFileSync(p, "utf-8");
+    const parsed = JSON.parse(raw) as Partial<StoredAuth>;
+    if (
+      typeof parsed.access_token !== "string" ||
+      typeof parsed.refresh_token !== "string" ||
+      typeof parsed.access_expires_at !== "number" ||
+      typeof parsed.user !== "object" ||
+      !parsed.user ||
+      typeof (parsed.user as { id?: unknown }).id !== "string" ||
+      typeof (parsed.user as { email?: unknown }).email !== "string"
+    ) {
+      return null;
+    }
+    return {
+      access_token: parsed.access_token,
+      refresh_token: parsed.refresh_token,
+      access_expires_at: parsed.access_expires_at,
+      refresh_expires_at:
+        typeof parsed.refresh_expires_at === "number"
+          ? parsed.refresh_expires_at
+          : parsed.access_expires_at,
+      user: {
+        id: (parsed.user as { id: string }).id,
+        email: (parsed.user as { email: string }).email,
+      },
+    };
+  } catch {
+    return null;
+  }
+}
+
+export function writeAuth(auth: StoredAuth): void {
+  writeJsonAtomically(getAuthFilePath(), auth);
+}
+
+export function deleteAuth(): void {
+  const p = getAuthFilePath();
+  if (existsSync(p)) rmSync(p, { force: true });
+}
+
+/** Convert verify/refresh response into the on-disk shape. */
+export function authFromTokenResponse(token: {
+  access_token: string;
+  refresh_token: string;
+  access_expires_in: number;
+  refresh_expires_in: number;
+  user?: { id: string; email: string };
+}, existingUser?: { id: string; email: string }): StoredAuth {
+  const now = Math.floor(Date.now() / 1000);
+  const user = token.user ?? existingUser;
+  if (!user) {
+    throw new Error("authFromTokenResponse: missing user identity");
+  }
+  return {
+    access_token: token.access_token,
+    refresh_token: token.refresh_token,
+    access_expires_at: now + token.access_expires_in,
+    refresh_expires_at: now + token.refresh_expires_in,
+    user,
+  };
+}
+
+/**
+ * Return a fresh access token, refreshing in-place if the current one is
+ * within the leeway window of expiry. Mutates auth.json on disk on success.
+ * Returns null if the stored session is gone or the refresh failed (caller
+ * should treat that as "logged out").
+ */
+const REFRESH_LEEWAY_SECS = 60;
+
+/**
+ * In-flight refresh dedup. Without this, two concurrent callers (e.g.
+ * the dashboard's `/api/auth/status` poll and a `/api/auth/reminder`
+ * POST in flight) both observe the same expired access token, both call
+ * `refreshAccessToken(auth.refresh_token)` with the same refresh token,
+ * and the api-server treats the second call as token-replay and revokes
+ * every session for that user — a silent logout. Keying on the refresh
+ * token avoids accidentally sharing a refresh across logins/logouts in
+ * the same process.
+ */
+const inFlightRefreshes = new Map<string, Promise<StoredAuth>>();
+
+async function dedupedRefresh(auth: StoredAuth): Promise<StoredAuth> {
+  const existing = inFlightRefreshes.get(auth.refresh_token);
+  if (existing) return existing;
+  const p = (async () => {
+    const refreshed = await refreshAccessToken(auth.refresh_token);
+    const next = authFromTokenResponse(refreshed, auth.user);
+    writeAuth(next);
+    return next;
+  })();
+  inFlightRefreshes.set(auth.refresh_token, p);
+  try {
+    return await p;
+  } finally {
+    inFlightRefreshes.delete(auth.refresh_token);
+  }
+}
+
+export async function getValidAccessToken(): Promise<StoredAuth | null> {
+  const auth = readAuth();
+  if (!auth) return null;
+  const now = Math.floor(Date.now() / 1000);
+  if (auth.access_expires_at - now > REFRESH_LEEWAY_SECS) return auth;
+  // Either expired or close to expiring — try to refresh.
+  try {
+    return await dedupedRefresh(auth);
+  } catch (err) {
+    if (err instanceof AuthApiError && err.status === 401) {
+      // Session unrecoverable — wipe.
+      deleteAuth();
+      return null;
+    }
+    // Network errors etc — surface to caller as null so the UI can recover.
+    return null;
+  }
+}
+
+/**
+ * Verify with the server that the stored access token is still valid.
+ * Refreshes once on 401. Returns the live /me response and the (possibly
+ * refreshed) stored auth, or null if the session can't be recovered.
+ */
+export async function whoAmI(): Promise<{ me: MeResponse; auth: StoredAuth } | null> {
+  const fresh = await getValidAccessToken();
+  if (!fresh) return null;
+  try {
+    const me = await fetchMe(fresh.access_token);
+    return { me, auth: fresh };
+  } catch (err) {
+    if (err instanceof AuthApiError && err.status === 401) {
+      // Maybe the leeway wasn't enough — try one more refresh and retry.
+      const reread = readAuth();
+      if (!reread) return null;
+      try {
+        const next = await dedupedRefresh(reread);
+        const me = await fetchMe(next.access_token);
+        return { me, auth: next };
+      } catch (retryErr) {
+        // Symmetry with `getValidAccessToken`: wipe the session only on an
+        // unambiguous 401. A transient timeout/5xx during the retry-fetchMe
+        // must NOT throw away the freshly-written valid tokens, otherwise a
+        // brief api-server hiccup silently logs the user out.
+        if (retryErr instanceof AuthApiError && retryErr.status === 401) {
+          deleteAuth();
+        }
+        return null;
+      }
+    }
+    return null;
+  }
+}
+
+/** Reads the JWT exp claim for diagnostics. */
+export function readAccessExpiry(auth: StoredAuth): number | null {
+  const claims = decodeJwt(auth.access_token);
+  return claims?.exp ?? null;
+}

package/.next/standalone/lib/claude-sessions.ts

@@ -0,0 +1,181 @@
+/**
+ * Claude Code session transcript discovery helpers.
+ *
+ * Claude stores transcripts at:
+ *   <CLAUDE_PROJECTS_PATH>/<encoded-cwd>/<sessionId>.jsonl
+ *
+ * Subagent transcripts (when a session spawned subagents) live alongside:
+ *   <CLAUDE_PROJECTS_PATH>/<encoded-cwd>/<sessionId>/subagents/<agentId>.jsonl
+ *
+ * The parser for these files lives in `lib/log-entries.ts` (`parseLogContent`,
+ * `parseSessionLog`). This module exposes discovery only — the audit pipeline
+ * and any future Claude-specific tool walk the directory layout via these
+ * helpers instead of re-implementing the path conventions.
+ *
+ * Mirrors the shape of `lib/cursor-sessions.ts` for parity across CLIs.
+ */
+import { readdirSync, statSync, existsSync } from "node:fs";
+import { join, basename } from "node:path";
+import { getClaudeProjectsPath, decodeFolderName } from "./paths";
+
+const UUID_RE = /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/i;
+
+export interface ClaudeProjectFolder {
+  /** Encoded folder name on disk (e.g. "-home-user-project"). */
+  name: string;
+  /** Decoded filesystem path (e.g. "/home/user/project"). */
+  cwd: string;
+  /** Absolute path of the encoded folder. */
+  path: string;
+}
+
+export interface ClaudeTranscriptFile {
+  projectName: string;
+  /** Decoded cwd of the project. */
+  cwd: string;
+  sessionId: string;
+  /** Absolute path of `<sessionId>.jsonl`. */
+  transcriptPath: string;
+  mtimeMs: number;
+  sizeBytes: number;
+  /** True when this is a subagent transcript spawned from a parent session. */
+  isSubagent: boolean;
+}
+
+/** Returns the Claude projects root, honoring the CLAUDE_PROJECTS_PATH env var. */
+export function getClaudeProjectsRoot(): string {
+  return getClaudeProjectsPath();
+}
+
+/** Lists all Claude project folders (one per encoded cwd). Returns [] if the
+ *  projects root doesn't exist. Filenames that don't look like Claude project
+ *  encodings are still included — encoding is permissive. */
+export function listClaudeProjects(): ClaudeProjectFolder[] {
+  const root = getClaudeProjectsRoot();
+  let entries: import("node:fs").Dirent[];
+  try {
+    entries = readdirSync(root, { withFileTypes: true });
+  } catch {
+    return [];
+  }
+  return entries
+    .filter((e) => e.isDirectory())
+    .map((e) => ({
+      name: e.name,
+      cwd: decodeFolderName(e.name),
+      path: join(root, e.name),
+    }));
+}
+
+/** Lists every JSONL transcript under one Claude project folder, including
+ *  subagent transcripts under `<sessionId>/subagents/`. Returns [] on missing
+ *  or unreadable paths. */
+export function listClaudeTranscripts(project: ClaudeProjectFolder): ClaudeTranscriptFile[] {
+  const out: ClaudeTranscriptFile[] = [];
+  let entries: import("node:fs").Dirent[];
+  try {
+    entries = readdirSync(project.path, { withFileTypes: true });
+  } catch {
+    return out;
+  }
+
+  for (const entry of entries) {
+    if (entry.isFile() && entry.name.endsWith(".jsonl")) {
+      const sessionId = entry.name.slice(0, -".jsonl".length);
+      if (!UUID_RE.test(sessionId)) continue;
+      const transcriptPath = join(project.path, entry.name);
+      try {
+        const s = statSync(transcriptPath);
+        out.push({
+          projectName: project.name,
+          cwd: project.cwd,
+          sessionId,
+          transcriptPath,
+          mtimeMs: s.mtimeMs,
+          sizeBytes: s.size,
+          isSubagent: false,
+        });
+      } catch {
+        // unreadable — skip
+      }
+    } else if (entry.isDirectory() && UUID_RE.test(entry.name)) {
+      // Subagent transcripts at <sessionId>/subagents/<agentId>.jsonl
+      const subDir = join(project.path, entry.name, "subagents");
+      if (!existsSync(subDir)) continue;
+      let subEntries: import("node:fs").Dirent[];
+      try {
+        subEntries = readdirSync(subDir, { withFileTypes: true });
+      } catch {
+        continue;
+      }
+      for (const sub of subEntries) {
+        if (!sub.isFile() || !sub.name.endsWith(".jsonl")) continue;
+        const agentId = sub.name.slice(0, -".jsonl".length);
+        const transcriptPath = join(subDir, sub.name);
+        try {
+          const s = statSync(transcriptPath);
+          out.push({
+            projectName: project.name,
+            cwd: project.cwd,
+            sessionId: agentId,
+            transcriptPath,
+            mtimeMs: s.mtimeMs,
+            sizeBytes: s.size,
+            isSubagent: true,
+          });
+        } catch {
+          // unreadable — skip
+        }
+      }
+    }
+  }
+
+  return out;
+}
+
+/** Convenience: locate one Claude transcript file by session ID across all
+ *  project folders. Returns null if not found. */
+export function findClaudeTranscript(sessionId: string): string | null {
+  if (!UUID_RE.test(sessionId)) return null;
+  for (const project of listClaudeProjects()) {
+    const candidate = join(project.path, `${sessionId}.jsonl`);
+    if (existsSync(candidate)) return candidate;
+    // Subagent fallback
+    let entries: import("node:fs").Dirent[];
+    try {
+      entries = readdirSync(project.path, { withFileTypes: true });
+    } catch {
+      continue;
+    }
+    for (const entry of entries) {
+      if (!entry.isDirectory() || !UUID_RE.test(entry.name)) continue;
+      const subCandidate = join(project.path, entry.name, "subagents", `${sessionId}.jsonl`);
+      if (existsSync(subCandidate)) return subCandidate;
+    }
+  }
+  return null;
+}
+
+/** For tests: list all session IDs across all projects. */
+export function _listAllSessionIds(): string[] {
+  const ids: string[] = [];
+  for (const project of listClaudeProjects()) {
+    for (const t of listClaudeTranscripts(project)) {
+      ids.push(t.sessionId);
+    }
+  }
+  return ids;
+}
+
+/** For tests: stat one transcript file. */
+export function _statTranscript(path: string): { mtimeMs: number; sizeBytes: number } | null {
+  try {
+    const s = statSync(path);
+    return { mtimeMs: s.mtimeMs, sizeBytes: s.size };
+  } catch {
+    return null;
+  }
+}
+
+/** Re-export for callers that want to construct paths from a basename. */
+export { basename };

package/.next/standalone/lib/client-telemetry.ts

@@ -1,4 +1,5 @@
 import type { TelemetryConfig } from "@/app/actions/get-telemetry-config";
+import { POSTHOG_PRODUCT } from "@/src/posthog-key";
 
 let config: TelemetryConfig | null = null;
 
@@ -21,6 +22,7 @@ export function captureClientEvent(
       ...properties,
       $lib: "failproofai-web",
       failproofai_version: config.version,
+      product: POSTHOG_PRODUCT,
       $current_url: window.location.href,
       $pathname: window.location.pathname,
     },

package/.next/standalone/lib/fetch-with-timeout.ts

@@ -0,0 +1,59 @@
+/**
+ * Shared fetch wrapper with per-request timeout and external-signal
+ * composition.
+ *
+ * Replaces three byte-equivalent implementations that had drifted on the
+ * default timeout (15s in two client components, 10s in the server-side
+ * api-server-client). Co-locates the `isAbortError` predicate so callers
+ * can classify timeout vs network failures consistently.
+ *
+ * Built on the platform primitives `AbortSignal.timeout()` — which
+ * aborts with a typed `DOMException(..., "TimeoutError")` rather than
+ * the default bare abort that surfaces as Next.js 16's dev-overlay
+ * "signal is aborted without reason" warning — and `AbortSignal.any()`,
+ * which composes the timeout signal with any caller-supplied
+ * `init.signal` so a component-unmount or parent-controller abort
+ * actually stops the in-flight fetch. The prior `AbortController` +
+ * `setTimeout` implementation called `controller.abort()` with no
+ * reason AND silently dropped `init.signal` by spreading then
+ * overwriting it with the controller's own signal.
+ *
+ * Both APIs are available in every runtime Next.js 16 supports:
+ * `AbortSignal.timeout` since Node 17.3 / 16.14, `AbortSignal.any`
+ * since Node 20.3 (also backported to 18.17). Next.js 16's minimum
+ * runtime (Node >= 20.9, per its engines field) covers both. Browser
+ * support: Chrome 116+, Firefox 124+, Safari 17.4+.
+ */
+
+/** Hard cap on every fetch using this helper unless overridden. Picked to
+ *  exceed the server-side `REQUEST_TIMEOUT_MS` (10s) in `api-server-client.ts`
+ *  so a slow but successful upstream response still lands. */
+export const DEFAULT_FETCH_TIMEOUT_MS = 15_000;
+
+export function fetchWithTimeout(
+  input: RequestInfo | URL,
+  init: RequestInit = {},
+  timeoutMs: number = DEFAULT_FETCH_TIMEOUT_MS,
+): Promise<Response> {
+  const timeoutSignal = AbortSignal.timeout(timeoutMs);
+  const signal = init.signal
+    ? AbortSignal.any([init.signal, timeoutSignal])
+    : timeoutSignal;
+  return fetch(input, { ...init, signal });
+}
+
+/** True when an error came from an `AbortController.abort()` OR an
+ *  `AbortSignal.timeout()` firing. Both surface as objects whose `name`
+ *  is "AbortError" or "TimeoutError" respectively — depending on the
+ *  runtime, they may be `Error` subclasses, `DOMException` instances,
+ *  both, or neither (the jsdom polyfill, for one, breaks the Error
+ *  prototype chain), so we duck-type on `name` rather than the
+ *  provenance. Callers always pass values caught from a try/catch, so
+ *  the universe of inputs is narrow enough that name-matching is
+ *  unambiguous. Keeping the two names in one predicate prevents the
+ *  "I forgot TimeoutError" drift class. */
+export function isAbortError(err: unknown): boolean {
+  if (err === null || typeof err !== "object") return false;
+  const name = (err as { name?: unknown }).name;
+  return name === "AbortError" || name === "TimeoutError";
+}

package/.next/standalone/lib/share-card.ts

@@ -0,0 +1,144 @@
+/**
+ * Helpers for attaching the audit-card PNG to a social share.
+ *
+ *   X and LinkedIn intent URLs cannot carry image attachments — only text
+ *   and a target URL. To actually get an image into a post we have three
+ *   options at different levels of "automatic":
+ *
+ *     1. `shareCardNative` → `navigator.share({ files })` — the system
+ *        share sheet handles the image + text in one step. Works on
+ *        iOS, Android, recent Safari, recent Chrome desktop. When the
+ *        user picks their target (X / LinkedIn / …) the image is
+ *        already attached.
+ *     2. `copyOrDownloadCard` → clipboard + open intent URL — the user
+ *        pastes (⌘/Ctrl+V) in the share dialog and the image attaches.
+ *     3. `downloadCard` → straight download to disk, no other side
+ *        effects. Used by the dedicated "save audit-card" button so
+ *        the user gets a file every time, regardless of clipboard
+ *        permissions.
+ */
+
+export type ShareCardMethod = "native" | "clipboard" | "download" | "failed";
+
+/**
+ * Best-effort "is this a mobile device" check. On mobile, the system share
+ * sheet exposes the actual X / LinkedIn apps as targets so `navigator.share`
+ * is a one-tap UX win. On desktop (notably Windows Chromium / Edge) the same
+ * call opens the OS share dialog — useless for X / LinkedIn — so we
+ * deliberately skip it and fall back to clipboard + intent URL.
+ *
+ * Prefers `userAgentData.mobile` (Chromium UA-Client-Hints, no sniffing),
+ * falls back to a tight UA pattern for Safari / Firefox, and treats
+ * iPadOS 13+ (UA says Mac but multi-touch is available) as mobile.
+ */
+function isLikelyMobile(): boolean {
+  if (typeof navigator === "undefined") return false;
+  type UADataNav = Navigator & { userAgentData?: { mobile?: boolean } };
+  const uaData = (navigator as UADataNav).userAgentData;
+  if (uaData && typeof uaData.mobile === "boolean") return uaData.mobile;
+  const ua = navigator.userAgent || "";
+  if (/Android|iPhone|iPad|iPod|webOS|BlackBerry|IEMobile|Opera Mini/i.test(ua)) return true;
+  if (ua.includes("Mac") && typeof navigator.maxTouchPoints === "number" && navigator.maxTouchPoints > 1) return true;
+  return false;
+}
+
+/**
+ * Try the native Web Share API with a file attachment. Returns `true` on
+ * success, `false` if the API is unavailable, files-sharing isn't
+ * supported, the device is desktop (where the OS share sheet doesn't
+ * include X / LinkedIn), or the user dismissed the sheet. Caller should
+ * fall back to `copyOrDownloadCard` on `false`.
+ */
+export async function shareCardNative(
+  blob: Blob,
+  filename: string,
+  text: string,
+): Promise<boolean> {
+  if (typeof navigator === "undefined" || typeof navigator.share !== "function") {
+    return false;
+  }
+  if (!isLikelyMobile()) return false;
+  const file = new File([blob], filename, { type: "image/png" });
+  // Some browsers (older Chrome desktop) expose `navigator.share` but reject
+  // file payloads. `canShare({ files })` gates that cleanly.
+  type CanShareNav = Navigator & { canShare?: (data: ShareData) => boolean };
+  const navWithCan = navigator as CanShareNav;
+  if (typeof navWithCan.canShare === "function" && !navWithCan.canShare({ files: [file] })) {
+    return false;
+  }
+  try {
+    await navigator.share({ files: [file], text });
+    return true;
+  } catch (err) {
+    // AbortError → user dismissed the sheet. Treat as a soft failure so the
+    // caller can decide whether to open the intent URL anyway.
+    if (err instanceof Error && err.name === "AbortError") return false;
+    return false;
+  }
+}
+
+/**
+ * Copy a captured share-card PNG to the system clipboard, or fall back to a
+ * download if the browser doesn't support image clipboard writes (or the
+ * user denied permission). The caller MUST be inside an active user gesture
+ * (click handler) — Chromium gates `navigator.clipboard.write` on user
+ * activation.
+ */
+export async function copyOrDownloadCard(
+  blob: Blob,
+  filename: string,
+): Promise<Exclude<ShareCardMethod, "native">> {
+  if (
+    typeof ClipboardItem !== "undefined"
+    && typeof navigator !== "undefined"
+    && navigator.clipboard
+    && typeof navigator.clipboard.write === "function"
+  ) {
+    try {
+      await navigator.clipboard.write([
+        new ClipboardItem({ "image/png": blob }),
+      ]);
+      return "clipboard";
+    } catch {
+      /* permission denied, secure-context issue, browser fence, … */
+    }
+  }
+  return downloadCard(blob, filename) ? "download" : "failed";
+}
+
+/**
+ * Trigger a local download of the PNG. Returns `true` on success. No
+ * clipboard interaction — used by the explicit "save audit-card" CTA so the
+ * user reliably gets a file even when clipboard write would succeed.
+ */
+export function downloadCard(blob: Blob, filename: string): boolean {
+  try {
+    if (typeof document === "undefined" || typeof URL === "undefined") return false;
+    const url = URL.createObjectURL(blob);
+    const a = document.createElement("a");
+    a.href = url;
+    a.download = filename;
+    a.style.display = "none";
+    document.body.appendChild(a);
+    a.click();
+    a.remove();
+    queueMicrotask(() => URL.revokeObjectURL(url));
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/** Human-readable toast copy keyed by share method. */
+export function shareCardToastMessage(method: ShareCardMethod): string {
+  switch (method) {
+    case "native":
+      return "✅ image attached — pick where to post";
+    case "clipboard":
+      return "📋 image copied — paste it in the post (⌘/Ctrl+V)";
+    case "download":
+      return "⬇ image downloaded — attach it to your post";
+    case "failed":
+      return "couldn't capture image — opening text-only share";
+  }
+}

package/.next/standalone/lib/telemetry.ts

@@ -10,7 +10,7 @@
 
 import { getInstanceId } from "./telemetry-id";
 import { version } from "../package.json";
-import { POSTHOG_API_KEY } from "../src/posthog-key";
+import { POSTHOG_API_KEY, POSTHOG_PRODUCT } from "../src/posthog-key";
 
 const DEFAULT_API_KEY = POSTHOG_API_KEY;
 const DEFAULT_HOST = "https://us.i.posthog.com";
@@ -81,13 +81,18 @@ export function isTelemetryEnabled(): boolean {
 
 /**
  * Lazily import posthog-node and create a client.
- * No-op when telemetry is disabled.
+ *
+ * No-op when telemetry is disabled. **Never throws** — callers (the
+ * Next.js API routes and the CLI subcommands) can `await initTelemetry()`
+ * unguarded and a posthog init failure can't 500 a valid auth response.
+ * The outer try/catch is the single source of truth; do NOT add a
+ * per-call wrapper at the call sites.
  */
 export async function initTelemetry(): Promise<void> {
-  if (!isTelemetryEnabled()) return;
-  if (globalThis.__FAILPROOFAI_POSTHOG__) return;
-
   try {
+    if (!isTelemetryEnabled()) return;
+    if (globalThis.__FAILPROOFAI_POSTHOG__) return;
+
     const mod: { PostHog: new (key: string, opts: PostHogOptions) => PostHogClient } =
       await import("posthog-node");
     const apiKey = process.env.FAILPROOFAI_POSTHOG_KEY ?? DEFAULT_API_KEY;
@@ -110,7 +115,7 @@ export async function initTelemetry(): Promise<void> {
     process.on("SIGINT", onExit);
   } catch (err) {
     // Always log init failures — silent swallowing makes standalone debugging impossible
-    console.warn("[failproofai:telemetry] PostHog init failed:", err instanceof Error ? err.message : err);
+    console.warn("[failproofai:telemetry] init failed:", err instanceof Error ? err.message : err);
   }
 }
 
@@ -129,7 +134,7 @@ export function trackEvent(
   client.capture({
     distinctId: getInstanceId(),
     event: name,
-    properties: { ...properties, $lib: "failproofai", failproofai_version: version },
+    properties: { ...properties, $lib: "failproofai", failproofai_version: version, product: POSTHOG_PRODUCT },
   });
 }