failproofai 0.0.10 → 0.0.11-beta.2

package/bin/failproofai.mjs

@@ -37,6 +37,23 @@ const args = process.argv.slice(2);
 // Normalize 'p' → 'policies' (shorthand alias)
 if (args[0] === "p") args[0] = "policies";
 
+// Lightweight telemetry helper for CLI lifecycle events. Lazy-loads to avoid
+// pulling in the hook-telemetry / telemetry-id modules on the fast --hook path.
+let _telemetry;
+let lastSubcommand = null;
+async function track(name, props) {
+  try {
+    if (!_telemetry) {
+      const [t, i] = await Promise.all([
+        import("../src/hooks/hook-telemetry"),
+        import("../lib/telemetry-id"),
+      ]);
+      _telemetry = { trackHookEvent: t.trackHookEvent, getInstanceId: i.getInstanceId };
+    }
+    await _telemetry.trackHookEvent(_telemetry.getInstanceId(), name, props);
+  } catch {}
+}
+
 // --hook <event> [--cli <name>] — called by an agent CLI hook; fast path, outside
 // runCli() because it has its own exit code contract with the calling agent.
 const hookIdx = args.indexOf("--hook");
@@ -69,25 +86,16 @@ if (hookIdx >= 0) {
     process.exit(exitCode);
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
+    await track("hook_dispatch_error", {
+      event_type: eventType,
+      cli,
+      error_type: err instanceof Error ? err.name : "unknown",
+    });
     console.error(`Unexpected error: ${msg}`);
     process.exit(2);
   }
 }
 
-// --relay-daemon — internal: long-running background process started by
-// ensureRelayRunning(). Streams queued events to the server via WebSocket.
-if (args.includes("--relay-daemon")) {
-  try {
-    const { runDaemon } = await import("../src/relay/daemon");
-    await runDaemon();
-    process.exit(0);
-  } catch (err) {
-    const msg = err instanceof Error ? err.message : String(err);
-    console.error(`Relay daemon error: ${msg}`);
-    process.exit(1);
-  }
-}
-
 /**
  * Centralised error handler for all CLI subcommands.
  * CliError  → clean message, no stack trace, exit exitCode (1 or 2)
@@ -95,7 +103,7 @@ if (args.includes("--relay-daemon")) {
  */
 async function runCli() {
   // --help / -h  (only when not inside a subcommand that handles its own --help)
-  const SUBCOMMANDS = ["policies", "login", "logout", "whoami", "relay", "sync"];
+  const SUBCOMMANDS = ["policies", "audit"];
   if ((args.includes("--help") || args.includes("-h")) && !SUBCOMMANDS.includes(args[0])) {
     const extraArgs = args.filter((a) => a !== "--help" && a !== "-h");
     if (extraArgs.length > 0) {
@@ -132,11 +140,24 @@ COMMANDS
 
   policies --help, -h            Show this help for the policies command
 
-  login                          Authenticate with the failproofai cloud (Google OAuth)
-  logout                         Clear local auth tokens and stop relay daemon
-  whoami                         Print current logged-in user
-  relay start|stop|status        Manage the event relay daemon
-  sync                           One-shot flush of pending events to the server
+  audit  (beta)                  Scan past agent CLI transcripts and count
+                                   "stupid behaviors" (env-var checks, force
+                                   pushes, redundant cd <cwd>, sleep loops,
+                                   etc.) per policy / audit detector.
+                                   Going live shortly — flags + output may
+                                   still change between beta releases.
+    --cli claude|codex|copilot|cursor|opencode|pi|gemini
+                                   Restrict to one or more CLIs (default: all).
+    --project <path>               Restrict to one cwd (repeatable).
+    --since 7d|2026-04-01          Only sessions whose mtime is within window.
+    --policy <name>                Restrict to one policy/detector (repeatable).
+    --limit N                      Top-N rows in the table (default 20).
+    --show-examples                Include one example per row.
+    --report <path>                Markdown report path (default ./failproofai-audit.md).
+    --no-report                    Skip writing the markdown file.
+    --json                         Print JSON to stdout instead of the table.
+    --no-cache                     Bypass the per-transcript cache.
+  audit --help, -h               Show this help for the audit command
 
   --version, -v                  Print version and exit
   --help, -h                     Show this help message
@@ -169,7 +190,7 @@ EXAMPLES
   failproofai policies --uninstall --custom
 
 LINKS
-  ⭐ Star us:      https://github.com/exospherehost/failproofai
+  ⭐ Star us:      https://github.com/failproofai/failproofai
   📖 Docs:         https://befailproof.ai
   💬 Slack:        https://join.slack.com/t/failproofai/shared_invite/zt-3v63b7k5e-O3NBHmj8X6n9gZSGDx6ggQ
 `.trimStart());
@@ -250,6 +271,7 @@ EXAMPLES
     }
 
     if (isInstall) {
+      lastSubcommand = "install";
       const { installHooks } = await import("../src/hooks/manager");
       const { resolveTargetClis } = await import("../src/hooks/install-prompt");
 
@@ -337,10 +359,19 @@ EXAMPLES
         false,
         cli,
       );
+      await track("cli_install_success", {
+        scope,
+        cli,
+        cli_count: cli.length,
+        explicit_policies: explicitPolicyNames.length > 0,
+        include_beta: includeBeta,
+        has_custom_path: !!customPoliciesPath,
+      });
       process.exit(0);
     }
 
     if (isUninstall) {
+      lastSubcommand = "uninstall";
       const { removeHooks } = await import("../src/hooks/manager");
       const { resolveTargetClis } = await import("../src/hooks/install-prompt");
 
@@ -402,6 +433,14 @@ EXAMPLES
         undefined,
         { betaOnly, removeCustomHooks, cli },
       );
+      await track("cli_uninstall_success", {
+        scope,
+        cli,
+        cli_count: cli.length,
+        beta_only: betaOnly,
+        remove_custom_hooks: removeCustomHooks,
+        explicit_policies: policyNames.length > 0,
+      });
       process.exit(0);
     }
 
@@ -424,75 +463,162 @@ EXAMPLES
       );
     }
 
+    lastSubcommand = "list";
     const { listHooks } = await import("../src/hooks/manager");
     await listHooks();
+    await track("cli_list_invoked", {});
     process.exit(0);
   }
 
-  // login — authenticate with failproofai server via Google OAuth
-  if (args[0] === "login") {
-    const { login } = await import("../src/auth/login");
-    await login();
-    process.exit(0);
-  }
+  // audit — scan past transcripts for "stupid behaviors" caught by builtin
+  // policies + a set of audit-only detectors.
+  if (args[0] === "audit") {
+    const subArgs = args.slice(1);
 
-  // logout — clear local tokens and stop relay daemon
-  if (args[0] === "logout") {
-    const { logout } = await import("../src/auth/logout");
-    await logout();
-    process.exit(0);
-  }
+    if (subArgs.includes("--help") || subArgs.includes("-h")) {
+      console.log(`
+failproofai audit (beta) — scan past agent transcripts for stupid behaviors
 
-  // whoami — print current user and auth status
-  if (args[0] === "whoami") {
-    const { whoami } = await import("../src/auth/logout");
-    whoami();
-    process.exit(0);
-  }
+  NOTE: This command is in beta. Flags, output format, and the audit-only
+  detector catalog may change before the next stable cut. Going live shortly.
+
+USAGE
+  failproofai audit [options]
 
-  // relay start|stop|status — manage the event relay daemon
-  if (args[0] === "relay") {
-    const subcmd = args[1];
-    const { relayStatus, stopRelay } = await import("../src/relay/pid");
+OPTIONS
+  --cli claude|codex|copilot|cursor|opencode|pi|gemini
+                                 Restrict to one or more CLIs (space-separated or repeated).
+                                 Default: scan all 7.
+  --project <path>               Restrict to sessions whose cwd matches this path. Repeatable.
+  --since 7d|30d|2026-04-01      Only sessions whose mtime is within window.
+  --policy <name>                Restrict to one policy/detector name. Repeatable.
+  --limit N                      Top-N rows in the table (default 20).
+  --show-examples                Include one example command per row in the table.
+  --report <path>                Markdown report path (default: ./failproofai-audit.md).
+  --no-report                    Skip writing the markdown report.
+  --json                         Print JSON to stdout instead of the table.
+  --no-cache                     Bypass the per-transcript result cache.
+  --help, -h                     Show this help
 
-    if (subcmd === "status") {
-      const s = relayStatus();
-      if (s.running) console.log(`Relay daemon running (pid ${s.pid})`);
-      else if (s.pid !== null) console.log(`Stale PID file (${s.pid}); daemon not running`);
-      else console.log("Relay daemon not running");
+EXAMPLES
+  failproofai audit
+  failproofai audit --cli claude --since 30d
+  failproofai audit --policy protect-env-vars --policy block-force-push
+  failproofai audit --json > audit.json
+  failproofai audit --project /home/me/myrepo --show-examples
+`.trimStart());
       process.exit(0);
     }
 
-    if (subcmd === "stop") {
-      const stopped = stopRelay();
-      console.log(stopped ? "Relay daemon stopped" : "Relay daemon was not running");
-      process.exit(0);
+    const VALID_CLIS = new Set(["claude", "codex", "copilot", "cursor", "opencode", "pi", "gemini"]);
+    /** Consume one or more values for a flag like `--cli a b c`, stopping at
+     *  the next flag or an unknown token (when an allow-set is supplied).
+     *  Throws when the flag appears with zero following values — a bare
+     *  `--cli` would otherwise silently widen the scope to all CLIs. */
+    function collectMulti(flag, allowSet) {
+      const out = [];
+      const consumed = new Set();
+      for (let i = 0; i < subArgs.length; i++) {
+        if (subArgs[i] !== flag) continue;
+        let seenForThisFlag = 0;
+        for (let j = i + 1; j < subArgs.length; j++) {
+          const v = subArgs[j];
+          if (v.startsWith("-")) break;
+          if (allowSet && !allowSet.has(v)) break;
+          out.push(v);
+          consumed.add(j);
+          seenForThisFlag++;
+        }
+        consumed.add(i);
+        if (seenForThisFlag === 0) {
+          throw new CliError(`Missing value(s) for ${flag}`);
+        }
+      }
+      return { values: out, consumed };
+    }
+    /** Take the single value following a one-shot flag like `--since 7d`. */
+    function takeOne(flag) {
+      const i = subArgs.indexOf(flag);
+      if (i < 0) return { value: undefined, consumed: new Set() };
+      const v = subArgs[i + 1];
+      if (v === undefined || v.startsWith("-")) {
+        throw new CliError(`Missing value for ${flag}`);
+      }
+      return { value: v, consumed: new Set([i, i + 1]) };
+    }
+
+    const allConsumed = new Set();
+    const cliRes = collectMulti("--cli", VALID_CLIS);
+    cliRes.consumed.forEach((i) => allConsumed.add(i));
+    const projectRes = collectMulti("--project", null);
+    projectRes.consumed.forEach((i) => allConsumed.add(i));
+    const policyRes = collectMulti("--policy", null);
+    policyRes.consumed.forEach((i) => allConsumed.add(i));
+    const sinceRes = takeOne("--since");
+    sinceRes.consumed.forEach((i) => allConsumed.add(i));
+    const limitRes = takeOne("--limit");
+    limitRes.consumed.forEach((i) => allConsumed.add(i));
+    const reportRes = takeOne("--report");
+    reportRes.consumed.forEach((i) => allConsumed.add(i));
+
+    const showExamples = subArgs.includes("--show-examples");
+    if (showExamples) allConsumed.add(subArgs.indexOf("--show-examples"));
+    const noReport = subArgs.includes("--no-report");
+    if (noReport) allConsumed.add(subArgs.indexOf("--no-report"));
+    const jsonOut = subArgs.includes("--json");
+    if (jsonOut) allConsumed.add(subArgs.indexOf("--json"));
+    const noCache = subArgs.includes("--no-cache");
+    if (noCache) allConsumed.add(subArgs.indexOf("--no-cache"));
+
+    // Reject unknown flags / positional args.
+    for (let i = 0; i < subArgs.length; i++) {
+      if (allConsumed.has(i)) continue;
+      const arg = subArgs[i];
+      throw new CliError(
+        `Unexpected argument: ${arg}\nRun \`failproofai audit --help\` for usage.`,
+      );
     }
 
-    if (subcmd === "start") {
-      const { ensureRelayRunning, waitForRelayAlive } = await import("../src/relay/daemon");
-      ensureRelayRunning();
-      // Spawn is async — give the child a moment to write its PID file
-      const alive = await waitForRelayAlive();
-      const s = relayStatus();
-      if (alive && s.running) {
-        console.log(`Relay daemon started (pid ${s.pid})`);
-        process.exit(0);
+    let parsedLimit;
+    if (limitRes.value !== undefined) {
+      parsedLimit = parseInt(limitRes.value, 10);
+      if (!Number.isInteger(parsedLimit) || parsedLimit <= 0) {
+        throw new CliError(`Invalid value for --limit: "${limitRes.value}". Use a positive integer.`);
       }
-      console.log("Failed to start daemon");
-      process.exit(1);
+    }
+    const opts = {
+      clis: cliRes.values.length > 0 ? cliRes.values : undefined,
+      projects: projectRes.values.length > 0 ? projectRes.values : undefined,
+      policies: policyRes.values.length > 0 ? policyRes.values : undefined,
+      since: sinceRes.value,
+      limit: parsedLimit,
+      showExamples,
+      reportPath: reportRes.value ?? "./failproofai-audit.md",
+      noReport: noReport || jsonOut, // --json implies --no-report unless explicit --report
+      json: jsonOut,
+      noCache,
+    };
+    // Re-enable report when --report was passed alongside --json.
+    if (jsonOut && reportRes.value) opts.noReport = false;
+
+    const { runAudit } = await import("../src/audit");
+    const { formatText, formatJson, formatMarkdown } = await import("../src/audit/report");
+    const result = await runAudit(opts);
+
+    if (jsonOut) {
+      process.stdout.write(formatJson(result) + "\n");
+    } else {
+      process.stdout.write(formatText(result, opts));
     }
 
-    throw new CliError(
-      `Usage: failproofai relay <start|stop|status>`
-    );
-  }
+    if (!opts.noReport) {
+      const { writeFileSync } = await import("node:fs");
+      const { resolve } = await import("node:path");
+      const reportPath = resolve(opts.reportPath);
+      writeFileSync(reportPath, formatMarkdown(result), "utf-8");
+      if (!jsonOut) process.stdout.write(`\nReport written: ${reportPath}\n`);
+    }
 
-  // sync — one-shot flush of pending events to server (fallback for no daemon)
-  if (args[0] === "sync") {
-    const { runOneShotSync } = await import("../src/relay/daemon");
-    const count = await runOneShotSync();
-    console.log(`Synced ${count} event${count === 1 ? "" : "s"} to server`);
     process.exit(0);
   }
 
@@ -514,7 +640,7 @@ EXAMPLES
       return dp[m][n];
     }
 
-    const primary = ["--version", "--help", "--hook", "policies", "login", "logout", "whoami", "relay", "sync"];
+    const primary = ["--version", "--help", "--hook", "policies", "audit"];
     const closest = primary.reduce((best, flag) => {
       const dist = levenshtein(unknownFlag, flag);
       return dist < best.dist ? { flag, dist } : best;
@@ -537,6 +663,17 @@ EXAMPLES
     );
   }
 
+  // First-run nudge — only on truly bare `failproofai` invocations. Best-effort:
+  // any thrown error must not block the dashboard from launching.
+  if (args.length === 0) {
+    try {
+      const { maybeRunFirstRunNudge } = await import("../src/hooks/first-run-nudge");
+      await maybeRunFirstRunNudge();
+    } catch {
+      // Nudge is non-critical; fall through to dashboard.
+    }
+  }
+
   // Dashboard launch — always production mode
   const { launch } = await import("../scripts/launch");
   launch("start");
@@ -550,11 +687,31 @@ try {
   await runCli();
 } catch (err) {
   if (err instanceof CliError) {
+    if (lastSubcommand === "install") {
+      await track("cli_install_failure", { error_type: "cli_error", exit_code: err.exitCode });
+    } else if (lastSubcommand === "uninstall") {
+      await track("cli_uninstall_failure", { error_type: "cli_error", exit_code: err.exitCode });
+    } else {
+      await track("cli_parse_error", {
+        subcommand: lastSubcommand ?? (args[0] ?? null),
+        exit_code: err.exitCode,
+      });
+    }
     console.error(`Error: ${err.message}`);
     process.exit(err.exitCode);
   }
   // Unexpected internal error — show message only, no stack trace
   const msg = err instanceof Error ? err.message : String(err);
+  if (lastSubcommand === "install") {
+    await track("cli_install_failure", { error_type: err instanceof Error ? err.name : "unknown" });
+  } else if (lastSubcommand === "uninstall") {
+    await track("cli_uninstall_failure", { error_type: err instanceof Error ? err.name : "unknown" });
+  } else {
+    await track("cli_unexpected_error", {
+      subcommand: lastSubcommand ?? (args[0] ?? null),
+      error_type: err instanceof Error ? err.name : "unknown",
+    });
+  }
   console.error(`Unexpected error: ${msg}`);
   process.exit(2);
 }