failproofai 0.0.11-beta.5 → 0.0.11-beta.7

package/.next/standalone/app/audit/audit-styles.css

@@ -2064,3 +2064,123 @@
   .share-dock-fab { transition: none; }
   .share-dock-caret { transition: none; }
 }
+
+/* ─────────────────────────────────────────────────────────────────────
+   audit-progress-strip — sticky banner pinned to the top of the viewport
+   while a re-audit is in flight. Pink hard-offset shadow matches the
+   page's `.share-btn:hover` vocabulary. Right-edge pulse is a CSS-only
+   keyframe (transform-only — no layout thrash) and is not a fake
+   progress bar.
+   ───────────────────────────────────────────────────────────────────── */
+.audit-progress-strip {
+  position: sticky;
+  top: 0;
+  left: 0;
+  right: 0;
+  z-index: 60;
+  background: var(--bg-2);
+  border-bottom: 1px solid var(--accent-pink);
+  box-shadow: 0 4px 0 0 var(--accent-pink-shadow);
+  font-family: var(--font-mono);
+  /* Slide in from above on mount */
+  animation: audit-progress-slide-in 220ms cubic-bezier(0.22, 1, 0.36, 1);
+}
+.audit-progress-strip--failed {
+  border-bottom-color: var(--accent-pink);
+  background: linear-gradient(to right, var(--accent-pink-bg), var(--bg-2));
+}
+.audit-progress-strip__inner {
+  position: relative;
+  max-width: 1480px;
+  margin: 0 auto;
+  padding: 12px clamp(20px, 3vw, 48px);
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 16px;
+}
+.audit-progress-strip__label {
+  display: inline-flex;
+  align-items: center;
+  gap: 10px;
+  color: var(--ink);
+  font-size: 12px;
+  letter-spacing: 0.06em;
+  text-transform: lowercase;
+}
+.audit-progress-strip--failed .audit-progress-strip__label { color: var(--accent-pink); }
+.audit-progress-strip__elapsed {
+  font-variant-numeric: tabular-nums;
+  font-size: 12px;
+  color: var(--accent-pink);
+  letter-spacing: 0.08em;
+}
+.audit-progress-strip__spinner {
+  width: 9px;
+  height: 9px;
+  border-radius: 50%;
+  background: transparent;
+  border: 1.5px solid var(--accent-pink);
+  border-top-color: transparent;
+  animation: audit-progress-spin 800ms linear infinite;
+}
+.audit-progress-strip__x {
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  width: 14px;
+  height: 14px;
+  border: 1px solid var(--accent-pink);
+  color: var(--accent-pink);
+  font-size: 11px;
+  line-height: 1;
+}
+.audit-progress-strip__dismiss {
+  background: transparent;
+  border: 1px solid var(--line-2);
+  color: var(--ink-2);
+  padding: 5px 10px;
+  font-family: var(--font-mono);
+  font-size: 11px;
+  text-transform: lowercase;
+  letter-spacing: 0.06em;
+  cursor: pointer;
+  transition: border-color 140ms ease, color 140ms ease;
+}
+.audit-progress-strip__dismiss:hover {
+  border-color: var(--accent-pink);
+  color: var(--accent-pink);
+}
+.audit-progress-strip__pulse {
+  position: absolute;
+  bottom: -1px;
+  left: 0;
+  right: 0;
+  height: 1px;
+  background: linear-gradient(
+    90deg,
+    transparent 0%,
+    var(--accent-pink) 20%,
+    var(--accent-pink) 80%,
+    transparent 100%
+  );
+  transform-origin: left center;
+  animation: audit-progress-pulse 2400ms cubic-bezier(0.55, 0.1, 0.45, 0.9) infinite;
+}
+@keyframes audit-progress-spin {
+  to { transform: rotate(360deg); }
+}
+@keyframes audit-progress-pulse {
+  0%   { transform: scaleX(0)   translateX(0%);    opacity: 0.4; }
+  50%  { transform: scaleX(0.6) translateX(20%);   opacity: 1; }
+  100% { transform: scaleX(0)   translateX(100%);  opacity: 0.2; }
+}
+@keyframes audit-progress-slide-in {
+  from { transform: translateY(-100%); opacity: 0; }
+  to   { transform: translateY(0);     opacity: 1; }
+}
+@media (prefers-reduced-motion: reduce) {
+  .audit-progress-strip { animation: none; }
+  .audit-progress-strip__spinner { animation: none; border-top-color: var(--accent-pink); }
+  .audit-progress-strip__pulse { animation: none; opacity: 0.4; transform: scaleX(0.4) translateX(30%); }
+}

package/.next/standalone/app/audit/page.tsx

@@ -8,7 +8,7 @@
  */
 import { Suspense } from "react";
 import { notFound } from "next/navigation";
-import { readDashboardCache } from "@/src/audit/dashboard-cache";
+import { readDashboardCache, readDashboardCacheMeta } from "@/src/audit/dashboard-cache";
 import { BUILTIN_POLICIES } from "@/src/hooks/builtin-policies";
 import { AUDIT_DETECTORS } from "@/src/audit/detectors";
 import { AuditDashboard } from "./_components/audit-dashboard";
@@ -32,14 +32,24 @@ export default async function AuditPage({ searchParams }: PageProps) {
   const { p } = await searchParams;
 
   const cache = readDashboardCache();
-  const initial = cache
-    ? {
-        status: "cached" as const,
-        cachedAt: cache.cachedAt,
-        params: cache.params,
-        result: cache.result,
-      }
-    : { status: "empty" as const };
+  let initial;
+  if (cache) {
+    initial = {
+      status: "cached" as const,
+      cachedAt: cache.cachedAt,
+      params: cache.params,
+      result: cache.result,
+    };
+  } else {
+    // No fresh cache. Probe meta so we can distinguish "first run" from
+    // "your last audit expired" and surface the right top-bar nudge.
+    const meta = readDashboardCacheMeta();
+    initial = {
+      status: "empty" as const,
+      expired: meta !== null,
+      expiredAt: meta?.cachedAt ?? null,
+    };
+  }
 
   return (
     <Suspense>

package/.next/standalone/lib/fetch-with-timeout.ts

@@ -1,14 +1,28 @@
 /**
- * Shared fetch wrapper with per-request timeout via AbortController.
+ * Shared fetch wrapper with per-request timeout and external-signal
+ * composition.
  *
  * Replaces three byte-equivalent implementations that had drifted on the
  * default timeout (15s in two client components, 10s in the server-side
  * api-server-client). Co-locates the `isAbortError` predicate so callers
  * can classify timeout vs network failures consistently.
  *
- * Server-side uses `AbortSignal.timeout` where available (cheaper); this
- * helper uses the AbortController+setTimeout form because the client
- * code-paths need a guaranteed cleanup hook.
+ * Built on the platform primitives `AbortSignal.timeout()` — which
+ * aborts with a typed `DOMException(..., "TimeoutError")` rather than
+ * the default bare abort that surfaces as Next.js 16's dev-overlay
+ * "signal is aborted without reason" warning — and `AbortSignal.any()`,
+ * which composes the timeout signal with any caller-supplied
+ * `init.signal` so a component-unmount or parent-controller abort
+ * actually stops the in-flight fetch. The prior `AbortController` +
+ * `setTimeout` implementation called `controller.abort()` with no
+ * reason AND silently dropped `init.signal` by spreading then
+ * overwriting it with the controller's own signal.
+ *
+ * Both APIs are available in every runtime Next.js 16 supports:
+ * `AbortSignal.timeout` since Node 17.3 / 16.14, `AbortSignal.any`
+ * since Node 20.3 (also backported to 18.17). Next.js 16's minimum
+ * runtime (Node >= 20.9, per its engines field) covers both. Browser
+ * support: Chrome 116+, Firefox 124+, Safari 17.4+.
  */
 
 /** Hard cap on every fetch using this helper unless overridden. Picked to
@@ -16,27 +30,30 @@
  *  so a slow but successful upstream response still lands. */
 export const DEFAULT_FETCH_TIMEOUT_MS = 15_000;
 
-export async function fetchWithTimeout(
+export function fetchWithTimeout(
   input: RequestInfo | URL,
   init: RequestInit = {},
   timeoutMs: number = DEFAULT_FETCH_TIMEOUT_MS,
 ): Promise<Response> {
-  const controller = new AbortController();
-  const id = setTimeout(() => controller.abort(), timeoutMs);
-  try {
-    return await fetch(input, { ...init, signal: controller.signal });
-  } finally {
-    clearTimeout(id);
-  }
+  const timeoutSignal = AbortSignal.timeout(timeoutMs);
+  const signal = init.signal
+    ? AbortSignal.any([init.signal, timeoutSignal])
+    : timeoutSignal;
+  return fetch(input, { ...init, signal });
 }
 
-/** True when an error came from an AbortController.abort() OR a
- *  `AbortSignal.timeout` firing. Both surface as `Error` with `name`
- *  set to "AbortError" or "TimeoutError" respectively. Keeping the two
- *  in one predicate prevents the "I forgot TimeoutError" drift class. */
+/** True when an error came from an `AbortController.abort()` OR an
+ *  `AbortSignal.timeout()` firing. Both surface as objects whose `name`
+ *  is "AbortError" or "TimeoutError" respectively — depending on the
+ *  runtime, they may be `Error` subclasses, `DOMException` instances,
+ *  both, or neither (the jsdom polyfill, for one, breaks the Error
+ *  prototype chain), so we duck-type on `name` rather than the
+ *  provenance. Callers always pass values caught from a try/catch, so
+ *  the universe of inputs is narrow enough that name-matching is
+ *  unambiguous. Keeping the two names in one predicate prevents the
+ *  "I forgot TimeoutError" drift class. */
 export function isAbortError(err: unknown): boolean {
-  return (
-    err instanceof Error
-    && (err.name === "AbortError" || err.name === "TimeoutError")
-  );
+  if (err === null || typeof err !== "object") return false;
+  const name = (err as { name?: unknown }).name;
+  return name === "AbortError" || name === "TimeoutError";
 }

package/.next/standalone/package.json

@@ -1,6 +1,6 @@
 {
   "name": "failproofai",
-  "version": "0.0.11-beta.5",
+  "version": "0.0.11-beta.7",
   "description": "The easiest way to manage policies that keep your AI agents reliable, on-task, and running autonomously — for Claude Code & the Agents SDK",
   "bin": {
     "failproofai": "./dist/cli.mjs"

package/.next/standalone/server.js

@@ -9,7 +9,7 @@ const currentPort = parseInt(process.env.PORT, 10) || 3000
 const hostname = process.env.HOSTNAME || '0.0.0.0'
 
 let keepAliveTimeout = parseInt(process.env.KEEP_ALIVE_TIMEOUT, 10)
-const nextConfig = {"env":{"NEXT_PUBLIC_APP_VERSION":"0.0.11-beta.5"},"typescript":{"ignoreBuildErrors":false},"typedRoutes":false,"distDir":"./.next","cleanDistDir":true,"assetPrefix":"","cacheMaxMemorySize":52428800,"configOrigin":"next.config.ts","useFileSystemPublicRoutes":true,"generateEtags":true,"pageExtensions":["tsx","ts","jsx","js"],"poweredByHeader":true,"compress":true,"images":{"deviceSizes":[640,750,828,1080,1200,1920,2048,3840],"imageSizes":[32,48,64,96,128,256,384],"path":"/_next/image","loader":"default","loaderFile":"","domains":[],"disableStaticImages":false,"minimumCacheTTL":14400,"formats":["image/webp"],"maximumRedirects":3,"maximumResponseBody":50000000,"dangerouslyAllowLocalIP":false,"dangerouslyAllowSVG":false,"contentSecurityPolicy":"script-src 'none'; frame-src 'none'; sandbox;","contentDispositionType":"attachment","localPatterns":[{"pathname":"**","search":""}],"remotePatterns":[],"qualities":[75],"unoptimized":true,"customCacheHandler":false},"devIndicators":{"position":"bottom-left"},"onDemandEntries":{"maxInactiveAge":60000,"pagesBufferLength":5},"basePath":"","sassOptions":{},"trailingSlash":false,"i18n":null,"productionBrowserSourceMaps":false,"excludeDefaultMomentLocales":true,"reactProductionProfiling":false,"reactStrictMode":null,"reactMaxHeadersLength":6000,"httpAgentOptions":{"keepAlive":true},"logging":{"serverFunctions":true,"browserToTerminal":"warn"},"compiler":{},"expireTime":31536000,"staticPageGenerationTimeout":60,"output":"standalone","modularizeImports":{"@mui/icons-material":{"transform":"@mui/icons-material/{{member}}"},"lodash":{"transform":"lodash/{{member}}"}},"outputFileTracingRoot":"/home/runner/work/failproofai/failproofai","cacheComponents":false,"cacheLife":{"default":{"stale":300,"revalidate":900,"expire":4294967294},"seconds":{"stale":30,"revalidate":1,"expire":60},"minutes":{"stale":300,"revalidate":60,"expire":3600},"hours":{"stale":300,"revalidate":3600,"expire":86400},"days":{"stale":300,"revalidate":86400,"expire":604800},"weeks":{"stale":300,"revalidate":604800,"expire":2592000},"max":{"stale":300,"revalidate":2592000,"expire":31536000}},"cacheHandlers":{},"experimental":{"appNewScrollHandler":false,"useSkewCookie":false,"cssChunking":true,"multiZoneDraftMode":false,"appNavFailHandling":false,"prerenderEarlyExit":true,"serverMinification":true,"linkNoTouchStart":false,"caseSensitiveRoutes":false,"cachedNavigations":false,"partialFallbacks":false,"dynamicOnHover":false,"varyParams":false,"prefetchInlining":false,"preloadEntriesOnStart":true,"clientRouterFilter":true,"clientRouterFilterRedirects":false,"fetchCacheKeyPrefix":"","proxyPrefetch":"flexible","optimisticClientCache":true,"manualClientBasePath":false,"cpus":3,"memoryBasedWorkersCount":false,"imgOptConcurrency":null,"imgOptTimeoutInSeconds":7,"imgOptMaxInputPixels":268402689,"imgOptSequentialRead":null,"imgOptSkipMetadata":null,"isrFlushToDisk":true,"workerThreads":false,"optimizeCss":false,"nextScriptWorkers":false,"scrollRestoration":false,"externalDir":false,"disableOptimizedLoading":false,"gzipSize":true,"craCompat":false,"esmExternals":true,"fullySpecified":false,"swcTraceProfiling":false,"forceSwcTransforms":false,"largePageDataBytes":128000,"typedEnv":false,"parallelServerCompiles":false,"parallelServerBuildTraces":false,"ppr":false,"authInterrupts":false,"webpackMemoryOptimizations":false,"optimizeServerReact":true,"strictRouteTypes":false,"viewTransition":false,"removeUncaughtErrorAndRejectionListeners":false,"validateRSCRequestHeaders":false,"staleTimes":{"dynamic":0,"static":300},"reactDebugChannel":true,"serverComponentsHmrCache":true,"staticGenerationMaxConcurrency":8,"staticGenerationMinPagesPerWorker":25,"transitionIndicator":false,"gestureTransition":false,"inlineCss":false,"useCache":false,"globalNotFound":false,"browserDebugInfoInTerminal":"warn","lockDistDir":true,"proxyClientMaxBodySize":10485760,"hideLogsAfterAbort":false,"mcpServer":true,"turbopackFileSystemCacheForDev":true,"turbopackFileSystemCacheForBuild":false,"turbopackInferModuleSideEffects":true,"turbopackPluginRuntimeStrategy":"childProcesses","optimizePackageImports":["lucide-react","date-fns","lodash-es","ramda","antd","react-bootstrap","ahooks","@ant-design/icons","@headlessui/react","@headlessui-float/react","@heroicons/react/20/solid","@heroicons/react/24/solid","@heroicons/react/24/outline","@visx/visx","@tremor/react","rxjs","@mui/material","@mui/icons-material","recharts","react-use","effect","@effect/schema","@effect/platform","@effect/platform-node","@effect/platform-browser","@effect/platform-bun","@effect/sql","@effect/sql-mssql","@effect/sql-mysql2","@effect/sql-pg","@effect/sql-sqlite-node","@effect/sql-sqlite-bun","@effect/sql-sqlite-wasm","@effect/sql-sqlite-react-native","@effect/rpc","@effect/rpc-http","@effect/typeclass","@effect/experimental","@effect/opentelemetry","@material-ui/core","@material-ui/icons","@tabler/icons-react","mui-core","react-icons/ai","react-icons/bi","react-icons/bs","react-icons/cg","react-icons/ci","react-icons/di","react-icons/fa","react-icons/fa6","react-icons/fc","react-icons/fi","react-icons/gi","react-icons/go","react-icons/gr","react-icons/hi","react-icons/hi2","react-icons/im","react-icons/io","react-icons/io5","react-icons/lia","react-icons/lib","react-icons/lu","react-icons/md","react-icons/pi","react-icons/ri","react-icons/rx","react-icons/si","react-icons/sl","react-icons/tb","react-icons/tfi","react-icons/ti","react-icons/vsc","react-icons/wi"],"trustHostHeader":false,"isExperimentalCompile":false},"htmlLimitedBots":"[\\w-]+-Google|Google-[\\w-]+|Chrome-Lighthouse|Slurp|DuckDuckBot|baiduspider|yandex|sogou|bitlybot|tumblr|vkShare|quora link preview|redditbot|ia_archiver|Bingbot|BingPreview|applebot|facebookexternalhit|facebookcatalog|Twitterbot|LinkedInBot|Slackbot|Discordbot|WhatsApp|SkypeUriPreview|Yeti|googleweblight","bundlePagesRouterDependencies":false,"configFileName":"next.config.ts","outputFileTracingExcludes":{"*":["node_modules/@img/**","node_modules/sharp/**"]},"turbopack":{"root":"/home/runner/work/failproofai/failproofai"},"distDirRoot":".next"}
+const nextConfig = {"env":{"NEXT_PUBLIC_APP_VERSION":"0.0.11-beta.7"},"typescript":{"ignoreBuildErrors":false},"typedRoutes":false,"distDir":"./.next","cleanDistDir":true,"assetPrefix":"","cacheMaxMemorySize":52428800,"configOrigin":"next.config.ts","useFileSystemPublicRoutes":true,"generateEtags":true,"pageExtensions":["tsx","ts","jsx","js"],"poweredByHeader":true,"compress":true,"images":{"deviceSizes":[640,750,828,1080,1200,1920,2048,3840],"imageSizes":[32,48,64,96,128,256,384],"path":"/_next/image","loader":"default","loaderFile":"","domains":[],"disableStaticImages":false,"minimumCacheTTL":14400,"formats":["image/webp"],"maximumRedirects":3,"maximumResponseBody":50000000,"dangerouslyAllowLocalIP":false,"dangerouslyAllowSVG":false,"contentSecurityPolicy":"script-src 'none'; frame-src 'none'; sandbox;","contentDispositionType":"attachment","localPatterns":[{"pathname":"**","search":""}],"remotePatterns":[],"qualities":[75],"unoptimized":true,"customCacheHandler":false},"devIndicators":{"position":"bottom-left"},"onDemandEntries":{"maxInactiveAge":60000,"pagesBufferLength":5},"basePath":"","sassOptions":{},"trailingSlash":false,"i18n":null,"productionBrowserSourceMaps":false,"excludeDefaultMomentLocales":true,"reactProductionProfiling":false,"reactStrictMode":null,"reactMaxHeadersLength":6000,"httpAgentOptions":{"keepAlive":true},"logging":{"serverFunctions":true,"browserToTerminal":"warn"},"compiler":{},"expireTime":31536000,"staticPageGenerationTimeout":60,"output":"standalone","modularizeImports":{"@mui/icons-material":{"transform":"@mui/icons-material/{{member}}"},"lodash":{"transform":"lodash/{{member}}"}},"outputFileTracingRoot":"/home/runner/work/failproofai/failproofai","cacheComponents":false,"cacheLife":{"default":{"stale":300,"revalidate":900,"expire":4294967294},"seconds":{"stale":30,"revalidate":1,"expire":60},"minutes":{"stale":300,"revalidate":60,"expire":3600},"hours":{"stale":300,"revalidate":3600,"expire":86400},"days":{"stale":300,"revalidate":86400,"expire":604800},"weeks":{"stale":300,"revalidate":604800,"expire":2592000},"max":{"stale":300,"revalidate":2592000,"expire":31536000}},"cacheHandlers":{},"experimental":{"appNewScrollHandler":false,"useSkewCookie":false,"cssChunking":true,"multiZoneDraftMode":false,"appNavFailHandling":false,"prerenderEarlyExit":true,"serverMinification":true,"linkNoTouchStart":false,"caseSensitiveRoutes":false,"cachedNavigations":false,"partialFallbacks":false,"dynamicOnHover":false,"varyParams":false,"prefetchInlining":false,"preloadEntriesOnStart":true,"clientRouterFilter":true,"clientRouterFilterRedirects":false,"fetchCacheKeyPrefix":"","proxyPrefetch":"flexible","optimisticClientCache":true,"manualClientBasePath":false,"cpus":3,"memoryBasedWorkersCount":false,"imgOptConcurrency":null,"imgOptTimeoutInSeconds":7,"imgOptMaxInputPixels":268402689,"imgOptSequentialRead":null,"imgOptSkipMetadata":null,"isrFlushToDisk":true,"workerThreads":false,"optimizeCss":false,"nextScriptWorkers":false,"scrollRestoration":false,"externalDir":false,"disableOptimizedLoading":false,"gzipSize":true,"craCompat":false,"esmExternals":true,"fullySpecified":false,"swcTraceProfiling":false,"forceSwcTransforms":false,"largePageDataBytes":128000,"typedEnv":false,"parallelServerCompiles":false,"parallelServerBuildTraces":false,"ppr":false,"authInterrupts":false,"webpackMemoryOptimizations":false,"optimizeServerReact":true,"strictRouteTypes":false,"viewTransition":false,"removeUncaughtErrorAndRejectionListeners":false,"validateRSCRequestHeaders":false,"staleTimes":{"dynamic":0,"static":300},"reactDebugChannel":true,"serverComponentsHmrCache":true,"staticGenerationMaxConcurrency":8,"staticGenerationMinPagesPerWorker":25,"transitionIndicator":false,"gestureTransition":false,"inlineCss":false,"useCache":false,"globalNotFound":false,"browserDebugInfoInTerminal":"warn","lockDistDir":true,"proxyClientMaxBodySize":10485760,"hideLogsAfterAbort":false,"mcpServer":true,"turbopackFileSystemCacheForDev":true,"turbopackFileSystemCacheForBuild":false,"turbopackInferModuleSideEffects":true,"turbopackPluginRuntimeStrategy":"childProcesses","optimizePackageImports":["lucide-react","date-fns","lodash-es","ramda","antd","react-bootstrap","ahooks","@ant-design/icons","@headlessui/react","@headlessui-float/react","@heroicons/react/20/solid","@heroicons/react/24/solid","@heroicons/react/24/outline","@visx/visx","@tremor/react","rxjs","@mui/material","@mui/icons-material","recharts","react-use","effect","@effect/schema","@effect/platform","@effect/platform-node","@effect/platform-browser","@effect/platform-bun","@effect/sql","@effect/sql-mssql","@effect/sql-mysql2","@effect/sql-pg","@effect/sql-sqlite-node","@effect/sql-sqlite-bun","@effect/sql-sqlite-wasm","@effect/sql-sqlite-react-native","@effect/rpc","@effect/rpc-http","@effect/typeclass","@effect/experimental","@effect/opentelemetry","@material-ui/core","@material-ui/icons","@tabler/icons-react","mui-core","react-icons/ai","react-icons/bi","react-icons/bs","react-icons/cg","react-icons/ci","react-icons/di","react-icons/fa","react-icons/fa6","react-icons/fc","react-icons/fi","react-icons/gi","react-icons/go","react-icons/gr","react-icons/hi","react-icons/hi2","react-icons/im","react-icons/io","react-icons/io5","react-icons/lia","react-icons/lib","react-icons/lu","react-icons/md","react-icons/pi","react-icons/ri","react-icons/rx","react-icons/si","react-icons/sl","react-icons/tb","react-icons/tfi","react-icons/ti","react-icons/vsc","react-icons/wi"],"trustHostHeader":false,"isExperimentalCompile":false},"htmlLimitedBots":"[\\w-]+-Google|Google-[\\w-]+|Chrome-Lighthouse|Slurp|DuckDuckBot|baiduspider|yandex|sogou|bitlybot|tumblr|vkShare|quora link preview|redditbot|ia_archiver|Bingbot|BingPreview|applebot|facebookexternalhit|facebookcatalog|Twitterbot|LinkedInBot|Slackbot|Discordbot|WhatsApp|SkypeUriPreview|Yeti|googleweblight","bundlePagesRouterDependencies":false,"configFileName":"next.config.ts","outputFileTracingExcludes":{"*":["node_modules/@img/**","node_modules/sharp/**"]},"turbopack":{"root":"/home/runner/work/failproofai/failproofai"},"distDirRoot":".next"}
 
 process.env.__NEXT_PRIVATE_STANDALONE_CONFIG = JSON.stringify(nextConfig)
 

package/dist/cli.mjs

@@ -16,7 +16,7 @@ var __export = (target, all) => {
 var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
 
 // package.json
-var version2 = "0.0.11-beta.5";
+var version2 = "0.0.11-beta.7";
 var init_package = () => {};
 
 // src/posthog-key.ts
@@ -8747,7 +8747,10 @@ var init_telemetry = __esm(() => {
 
 // lib/fetch-with-timeout.ts
 function isAbortError(err) {
-  return err instanceof Error && (err.name === "AbortError" || err.name === "TimeoutError");
+  if (err === null || typeof err !== "object")
+    return false;
+  const name = err.name;
+  return name === "AbortError" || name === "TimeoutError";
 }
 
 // lib/auth/api-server-client.ts
@@ -9900,7 +9903,7 @@ import { realpathSync as realpathSync3 } from "fs";
 import { dirname as dirname8, resolve as resolve16 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 // package.json
-var version = "0.0.11-beta.5";
+var version = "0.0.11-beta.7";
 
 // bin/failproofai.mjs
 if (!process.env.FAILPROOFAI_PACKAGE_ROOT) {

package/lib/fetch-with-timeout.ts

@@ -1,14 +1,28 @@
 /**
- * Shared fetch wrapper with per-request timeout via AbortController.
+ * Shared fetch wrapper with per-request timeout and external-signal
+ * composition.
  *
  * Replaces three byte-equivalent implementations that had drifted on the
  * default timeout (15s in two client components, 10s in the server-side
  * api-server-client). Co-locates the `isAbortError` predicate so callers
  * can classify timeout vs network failures consistently.
  *
- * Server-side uses `AbortSignal.timeout` where available (cheaper); this
- * helper uses the AbortController+setTimeout form because the client
- * code-paths need a guaranteed cleanup hook.
+ * Built on the platform primitives `AbortSignal.timeout()` — which
+ * aborts with a typed `DOMException(..., "TimeoutError")` rather than
+ * the default bare abort that surfaces as Next.js 16's dev-overlay
+ * "signal is aborted without reason" warning — and `AbortSignal.any()`,
+ * which composes the timeout signal with any caller-supplied
+ * `init.signal` so a component-unmount or parent-controller abort
+ * actually stops the in-flight fetch. The prior `AbortController` +
+ * `setTimeout` implementation called `controller.abort()` with no
+ * reason AND silently dropped `init.signal` by spreading then
+ * overwriting it with the controller's own signal.
+ *
+ * Both APIs are available in every runtime Next.js 16 supports:
+ * `AbortSignal.timeout` since Node 17.3 / 16.14, `AbortSignal.any`
+ * since Node 20.3 (also backported to 18.17). Next.js 16's minimum
+ * runtime (Node >= 20.9, per its engines field) covers both. Browser
+ * support: Chrome 116+, Firefox 124+, Safari 17.4+.
  */
 
 /** Hard cap on every fetch using this helper unless overridden. Picked to
@@ -16,27 +30,30 @@
  *  so a slow but successful upstream response still lands. */
 export const DEFAULT_FETCH_TIMEOUT_MS = 15_000;
 
-export async function fetchWithTimeout(
+export function fetchWithTimeout(
   input: RequestInfo | URL,
   init: RequestInit = {},
   timeoutMs: number = DEFAULT_FETCH_TIMEOUT_MS,
 ): Promise<Response> {
-  const controller = new AbortController();
-  const id = setTimeout(() => controller.abort(), timeoutMs);
-  try {
-    return await fetch(input, { ...init, signal: controller.signal });
-  } finally {
-    clearTimeout(id);
-  }
+  const timeoutSignal = AbortSignal.timeout(timeoutMs);
+  const signal = init.signal
+    ? AbortSignal.any([init.signal, timeoutSignal])
+    : timeoutSignal;
+  return fetch(input, { ...init, signal });
 }
 
-/** True when an error came from an AbortController.abort() OR a
- *  `AbortSignal.timeout` firing. Both surface as `Error` with `name`
- *  set to "AbortError" or "TimeoutError" respectively. Keeping the two
- *  in one predicate prevents the "I forgot TimeoutError" drift class. */
+/** True when an error came from an `AbortController.abort()` OR an
+ *  `AbortSignal.timeout()` firing. Both surface as objects whose `name`
+ *  is "AbortError" or "TimeoutError" respectively — depending on the
+ *  runtime, they may be `Error` subclasses, `DOMException` instances,
+ *  both, or neither (the jsdom polyfill, for one, breaks the Error
+ *  prototype chain), so we duck-type on `name` rather than the
+ *  provenance. Callers always pass values caught from a try/catch, so
+ *  the universe of inputs is narrow enough that name-matching is
+ *  unambiguous. Keeping the two names in one predicate prevents the
+ *  "I forgot TimeoutError" drift class. */
 export function isAbortError(err: unknown): boolean {
-  return (
-    err instanceof Error
-    && (err.name === "AbortError" || err.name === "TimeoutError")
-  );
+  if (err === null || typeof err !== "object") return false;
+  const name = (err as { name?: unknown }).name;
+  return name === "AbortError" || name === "TimeoutError";
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "failproofai",
-  "version": "0.0.11-beta.5",
+  "version": "0.0.11-beta.7",
   "description": "The easiest way to manage policies that keep your AI agents reliable, on-task, and running autonomously — for Claude Code & the Agents SDK",
   "bin": {
     "failproofai": "./dist/cli.mjs"

package/src/audit/archetypes.ts

@@ -826,6 +826,14 @@ const ARCHITECT_COWBOY_MAX_LIFT = 1.0;
  *  vector, and 0.75 left goldfish under-reachable (< 4% of the population). */
 const GOLDFISH_ENTROPY = 0.70;
 const GOLDFISH_MIN_NONZERO = 4;
+/** Goldfish also requires the SECOND-highest cluster lift to be meaningfully
+ *  above baseline. Entropy on its own is satisfied by a uniform-at-baseline
+ *  lift vector (every cluster firing at typical ambient rate → all lifts ≈ 1.0
+ *  → entropy = max), which would otherwise collapse every "typical" agent onto
+ *  goldfish. Requiring secondLift > 1.3 means at least TWO clusters are
+ *  genuinely over-indexing — the actual definition of scatter, not just
+ *  "average-volume noise spread across many clusters". */
+const GOLDFISH_MIN_SECOND_LIFT = 1.3;
 /** When the top-two lifts are within this ratio, resolve deterministically by
  *  the behaviour fingerprint instead of always taking the arithmetic winner —
  *  spreads near-ties across the population without any RNG. */
@@ -891,9 +899,18 @@ export function classifyAgent(result: AuditResult, seed = ""): Classification {
     return { archetype: "architect", secondary: ARCHETYPES.architect.secondary, ...base };
   }
 
-  // 3. goldfish — genuinely scattered across many clusters.
+  // 3. goldfish — genuinely scattered across many clusters. Both the entropy
+  //    and the second-lift gate must clear: entropy catches "many clusters
+  //    contribute", secondLift catches "the contribution is actually elevated
+  //    relative to ambient". Without secondLift, a high-volume average user
+  //    (lifts ≈ 1.0 everywhere) passes the entropy gate and collapses onto
+  //    goldfish — that's the bug fixed alongside this gate.
   const nonZero = MAPPABLE_KEYS.filter((k) => f.clusterLift[k] > 0).length;
-  if (nonZero >= GOLDFISH_MIN_NONZERO && f.entropy > GOLDFISH_ENTROPY) {
+  if (
+    nonZero >= GOLDFISH_MIN_NONZERO &&
+    f.entropy > GOLDFISH_ENTROPY &&
+    f.secondLift >= GOLDFISH_MIN_SECOND_LIFT
+  ) {
     const strongest = rankByLift(f, MAPPABLE_KEYS)[0];
     return { archetype: "goldfish", secondary: strongest, ...base };
   }

package/src/audit/cache.ts

@@ -61,12 +61,26 @@ function getCachePathFor(transcriptPath: string): string {
  * silently rendered them as `cwd: undefined` (dropped from
  * `projectsScanned`) and `eventsScanned: 0`. Rejecting v1 forces a
  * re-scan so the new fields are populated correctly.
+ *
+ * v3: `CacheEntry` gained `cachedAt` to support the 7-day TTL below. v2
+ * entries lack the field; without a bump the age check would treat
+ * `cachedAt: undefined` as `NaN` (passes the `<= TTL` comparison
+ * accidentally on some paths) so we reject them outright and force a
+ * re-scan.
  */
-export const CACHE_SCHEMA_VERSION = 2;
+export const CACHE_SCHEMA_VERSION = 3;
+
+/** Hard expiry: a cached transcript result is rejected on read once it's
+ *  this old. Keeps the audit pipeline honest about long-lived results that
+ *  may no longer reflect current detector intent even if the transcript
+ *  bytes and policy hashes haven't changed. */
+export const CACHE_TTL_MS = 7 * 24 * 60 * 60_000;
 
 interface CacheEntry {
   /** Bumped whenever the on-disk shape changes incompatibly. */
   schemaVersion: number;
+  /** ms since epoch when the entry was written. Drives the 7-day TTL. */
+  cachedAt: number;
   mtimeMs: number;
   sizeBytes: number;
   engineVersion: string;
@@ -90,6 +104,10 @@ export function readCachedTranscriptResult(
     if (entry.sizeBytes !== sizeBytes) return null;
     if (entry.engineVersion !== getEngineVersion()) return null;
     if (entry.detectorVersion !== getDetectorVersion()) return null;
+    // Number.isFinite (not typeof) so a malformed JSON `Infinity` /
+    // `NaN` is rejected — those would otherwise bypass the TTL check
+    // and pin a stale entry as valid forever.
+    if (!Number.isFinite(entry.cachedAt) || Date.now() - (entry.cachedAt as number) > CACHE_TTL_MS) return null;
     return entry.result ?? null;
   } catch {
     return null;
@@ -108,6 +126,7 @@ export function writeCachedTranscriptResult(
     mkdirSync(join(homedir(), ".failproofai", "cache", "audit"), { recursive: true });
     const entry: CacheEntry = {
       schemaVersion: CACHE_SCHEMA_VERSION,
+      cachedAt: Date.now(),
       mtimeMs,
       sizeBytes,
       engineVersion: getEngineVersion(),

package/src/audit/dashboard-cache.ts

@@ -18,6 +18,12 @@ import type { AuditResult, RunAuditOptions } from "./types";
 
 const DEFAULT_MAX_AGE_MINUTES = 30;
 
+/** Hard expiry: the dashboard cache is rejected on read once it's this old.
+ *  Matches the per-transcript TTL in `cache.ts` so the whole audit surface
+ *  has a consistent 7-day freshness window — past that, `/audit` falls
+ *  through to its empty state and nudges the user to re-audit. */
+const DASHBOARD_CACHE_TTL_MINUTES = 7 * 24 * 60;
+
 /**
  * Bump whenever the on-disk shape of a cached entry changes in a way the
  * reader can't tolerate (added required field, renamed key, swapped result
@@ -75,6 +81,9 @@ export function readDashboardCache(): DashboardCacheEntry | null {
     if (entry.schemaVersion !== DASHBOARD_CACHE_SCHEMA_VERSION) {
       return null;
     }
+    if (isCacheStale(entry.cachedAt, DASHBOARD_CACHE_TTL_MINUTES)) {
+      return null;
+    }
     return entry;
   } catch {
     return null;
@@ -109,3 +118,34 @@ export function isCacheStale(cachedAt: string, maxAgeMinutes: number = DEFAULT_M
   const ageMs = Date.now() - cachedMs;
   return ageMs > maxAgeMinutes * 60_000;
 }
+
+/**
+ * Read just the `cachedAt` timestamp from the dashboard cache file,
+ * **bypassing** the TTL check. Used by the empty-state path to tell apart
+ * "no audit has ever run" from "your last audit aged out". A non-null
+ * return whose age exceeds `DASHBOARD_CACHE_TTL_MINUTES` means the cache
+ * was rejected by `readDashboardCache()` for being expired (rather than
+ * missing or schema-incompatible).
+ */
+export function readDashboardCacheMeta(): { cachedAt: string } | null {
+  const cachePath = getCachePath();
+  if (!existsSync(cachePath)) return null;
+  try {
+    const raw = readFileSync(cachePath, "utf-8");
+    const entry = JSON.parse(raw) as Partial<DashboardCacheEntry>;
+    // Require schema-version match + a parseable ISO timestamp before
+    // surfacing the entry as "this user's audit aged out". A
+    // schema-incompatible entry is structurally indistinguishable from
+    // "no audit has ever run", so it should fall through to the
+    // first-run empty copy, not the expired banner.
+    if (
+      !entry
+      || entry.schemaVersion !== DASHBOARD_CACHE_SCHEMA_VERSION
+      || typeof entry.cachedAt !== "string"
+      || Number.isNaN(new Date(entry.cachedAt).getTime())
+    ) return null;
+    return { cachedAt: entry.cachedAt };
+  } catch {
+    return null;
+  }
+}

package/src/audit/features.ts

@@ -249,6 +249,11 @@ export interface AuditFeatures {
   clusterLift: Record<ArchetypeKey, number>;
   /** Normalised entropy of the lift vector (goldfish detector). */
   entropy: number;
+  /** Second-highest cluster lift. Goldfish requires this to be elevated:
+   *  high entropy alone is satisfied by a uniform-at-baseline lift vector
+   *  (every cluster fires at ambient rate → lifts ≈ 1.0 → entropy = max),
+   *  which would otherwise collapse every "typical" agent onto goldfish. */
+  secondLift: number;
   /** Share of total signal coming from the two architect caution detectors. */
   cautionShare: number;
   cowboyLift: number;
@@ -288,7 +293,10 @@ export function deriveFeatures(result: AuditResult, seed = ""): AuditFeatures {
     clusterLift[k] = BASELINE_SHARE[k] > 0 ? share / BASELINE_SHARE[k] : 0;
   }
 
-  const entropy = normalizedEntropy(MAPPABLE_KEYS.map((k) => clusterLift[k]));
+  const liftVec = MAPPABLE_KEYS.map((k) => clusterLift[k]);
+  const entropy = normalizedEntropy(liftVec);
+  const sortedLifts = [...liftVec].sort((a, b) => b - a);
+  const secondLift = sortedLifts[1] ?? 0;
   const cautionShare = totalSignal > 0 ? cautionRaw / totalSignal : 0;
   const faultRate = totalHits / events;
 
@@ -300,7 +308,7 @@ export function deriveFeatures(result: AuditResult, seed = ""): AuditFeatures {
 
   return {
     events, sessions, totalHits, faultRate,
-    clusterRaw, totalSignal, clusterLift, entropy,
+    clusterRaw, totalSignal, clusterLift, entropy, secondLift,
     cautionShare, cowboyLift: clusterLift.cowboy, fingerprint,
   };
 }