failproofai 0.0.11-beta.7 → 0.0.11-beta.9

package/.next/standalone/app/audit/_components/how-to-improve-section.tsx

@@ -0,0 +1,187 @@
+"use client";
+
+/**
+ * Section 04 — HOW TO IMPROVE. Calm row list, one per prescribed
+ * policy:
+ *
+ *   <policy-name>                 $ failproofai policy add <slug>   [📋]
+ *   <one-line explanation>
+ *
+ * A single "install all" button at the section header copies the
+ * combined install command for every prescribed policy.
+ */
+import React, { useMemo, useState } from "react";
+import type { AuditResult } from "@/src/audit/types";
+import { type Grade, tierName } from "@/src/audit/scoring";
+import { usePostHog } from "@/contexts/PostHogContext";
+
+interface Props {
+  result: AuditResult;
+  projected: number;
+  projectedGrade: Grade;
+}
+
+const DETECTOR_TO_PRIMARY_POLICY: Record<string, string> = {
+  "redundant-cd-cwd":          "warn-repeated-tool-calls",
+  "prefer-edit-over-read-cat": "block-read-outside-cwd",
+  "prefer-edit-over-sed-awk":  "warn-repeated-tool-calls",
+  "prefer-write-over-heredoc": "block-env-files",
+  "sleep-polling-loop":        "warn-background-process",
+  "find-from-root":            "block-read-outside-cwd",
+  "git-commit-no-verify":      "warn-git-amend",
+  "reread-after-edit":         "warn-repeated-tool-calls",
+};
+
+const POLICY_DESC: Record<string, string> = {
+  "warn-repeated-tool-calls": "warns when the same tool is called 3+ times with identical parameters.",
+  "block-read-outside-cwd":   "denies any file read outside the project root, including symlinks.",
+  "block-env-files":          "blocks reads and writes of .env files at the tool layer.",
+  "block-secrets-write":      "blocks writes to .pem, id_rsa, credentials.json, and other secret-key files.",
+  "warn-background-process":  "warns before starting nohup / & / screen / tmux processes.",
+  "warn-git-amend":           "warns before amending git commits.",
+  "require-ci-green-before-stop": "requires CI checks to pass on HEAD before the agent declares the task done.",
+};
+
+function shortName(name: string): string {
+  const slash = name.indexOf("/");
+  return slash >= 0 ? name.slice(slash + 1) : name;
+}
+
+interface FixRow {
+  name: string;
+  desc: string;
+  hits: number;
+}
+
+function buildFixes(result: AuditResult): FixRow[] {
+  const enabledSet = new Set(result.enabledBuiltinNames ?? []);
+  const buckets = new Map<string, number>();
+
+  for (const row of result.results) {
+    if (row.hits === 0) continue;
+
+    let target: string;
+    if (row.source === "audit-detector") {
+      const mapped = DETECTOR_TO_PRIMARY_POLICY[shortName(row.name)];
+      if (!mapped) continue;
+      target = mapped;
+    } else if (row.source === "builtin" && !row.enabledInConfig) {
+      target = shortName(row.name);
+    } else {
+      continue;
+    }
+
+    if (enabledSet.has(target)) continue;
+    buckets.set(target, (buckets.get(target) ?? 0) + row.hits);
+  }
+
+  return [...buckets.entries()]
+    .sort((a, b) => b[1] - a[1])
+    .map(([name, hits]) => ({
+      name,
+      desc: POLICY_DESC[name] ?? "enable this builtin policy to close the gap.",
+      hits,
+    }));
+}
+
+function bulkInstall(fixes: FixRow[]): string {
+  if (fixes.length === 0) return "";
+  if (fixes.length === 1) return `failproofai policy add ${fixes[0]!.name}`;
+  return `failproofai policy add ${fixes.map((f) => f.name).join(" ")}`;
+}
+
+export function HowToImproveSection({ result, projected, projectedGrade }: Props) {
+  const { capture } = usePostHog();
+  const fixes = useMemo(() => buildFixes(result), [result]);
+  const installAllCmd = useMemo(() => bulkInstall(fixes), [fixes]);
+  const [copiedAll, setCopiedAll] = useState(false);
+
+  if (fixes.length === 0) return null;
+
+  const handleInstallAll = async () => {
+    try {
+      await navigator.clipboard.writeText(installAllCmd);
+      setCopiedAll(true);
+      capture("audit_copy_clicked", {
+        source: "how_to_improve_section_install_all",
+        item_type: "bulk_install_command",
+        policy_count: fixes.length,
+      });
+      setTimeout(() => setCopiedAll(false), 1500);
+    } catch { /* ignore */ }
+  };
+
+  return (
+    <section className="audit-sec" data-screen-label="04 How to improve">
+      <div className="audit-sec-head">
+        <span className="audit-sec-eyebrow">
+          <span className="ix">04</span>{"// how to improve"}
+        </span>
+        <button
+          type="button"
+          className="install-all-btn"
+          onClick={handleInstallAll}
+          aria-label="Copy install-all command"
+        >
+          {copiedAll ? "copied" : "install all"}
+        </button>
+      </div>
+      <h2 className="audit-sec-title">install or configure</h2>
+      <div className="audit-sec-sub">
+        enable all {fixes.length === 1 ? "one" : fixes.length} → projected{" "}
+        <strong>{projected}</strong> · {tierName(projectedGrade).toLowerCase()}
+      </div>
+
+      <div className="fix-list">
+        {fixes.map((f, i) => (
+          <FixRow key={f.name} fix={f} idx={i} />
+        ))}
+      </div>
+    </section>
+  );
+}
+
+function FixRow({ fix, idx }: { fix: FixRow; idx: number }) {
+  const { capture } = usePostHog();
+  const [copied, setCopied] = useState(false);
+  const install = `failproofai policy add ${fix.name}`;
+
+  const handleCopy = async () => {
+    try {
+      await navigator.clipboard.writeText(install);
+      setCopied(true);
+      capture("audit_copy_clicked", {
+        source: "how_to_improve_section",
+        item_type: "single_policy_install_command",
+        policy_name: fix.name,
+        policy_rank: idx + 1,
+      });
+      setTimeout(() => setCopied(false), 1500);
+    } catch { /* ignore */ }
+  };
+
+  return (
+    <div className="fix-row">
+      <div className="fix-row-info">
+        <div className="fix-name">{fix.name}</div>
+        <div className="fix-desc">{fix.desc}</div>
+      </div>
+      <div className="fix-row-cmd">
+        <code className="fix-cmd-code">{install}</code>
+        <button
+          type="button"
+          className="copy-icon-btn"
+          onClick={handleCopy}
+          aria-label={`Copy install command for ${fix.name}`}
+        >
+          {copied ? "✓" : (
+            <svg viewBox="0 0 16 16" width="14" height="14" aria-hidden="true">
+              <rect x="3" y="3" width="9" height="11" fill="none" stroke="currentColor" strokeWidth="1.2" />
+              <rect x="5.5" y="0.5" width="9" height="11" fill="none" stroke="currentColor" strokeWidth="1.2" />
+            </svg>
+          )}
+        </button>
+      </div>
+    </div>
+  );
+}

package/.next/standalone/app/audit/_components/invite-dialog.tsx

@@ -0,0 +1,227 @@
+"use client";
+
+/**
+ * Invite dialog — modal that takes a comma/newline-separated list of friend
+ * emails and POSTs them to /api/audit/invite. The api-server composes the
+ * actual invite email (Cc'ing the sender) using the same email infrastructure
+ * that backs the OTP flow.
+ *
+ * Anonymous users get bounced through the AuthDialog by the caller; this
+ * component assumes the session is already established.
+ */
+
+import React, { useCallback, useEffect, useMemo, useRef, useState } from "react";
+import { usePostHog } from "@/contexts/PostHogContext";
+import { toast } from "@/app/components/toast";
+
+interface Props {
+  open: boolean;
+  onClose: () => void;
+  /** Source tag for PostHog so we can split "invited from come-back-better"
+   *  from any future entry points. */
+  source: string;
+  /** Called when the proxy returns 401 (session expired between probe and
+   *  submit). The parent should re-open the AuthDialog so the user can
+   *  re-authenticate; without this, a 401 dead-ends with an inline error. */
+  onUnauthorized?: () => void;
+}
+
+const EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+const MAX_RECIPIENTS = 10;
+
+function parseEmails(input: string): { valid: string[]; invalid: string[] } {
+  const tokens = input
+    .split(/[\s,;]+/)
+    .map((t) => t.trim().toLowerCase())
+    .filter(Boolean);
+  const valid: string[] = [];
+  const invalid: string[] = [];
+  const seen = new Set<string>();
+  for (const t of tokens) {
+    if (seen.has(t)) continue;
+    seen.add(t);
+    if (EMAIL_RE.test(t)) valid.push(t);
+    else invalid.push(t);
+  }
+  return { valid, invalid };
+}
+
+export function InviteDialog({ open, onClose, source, onUnauthorized }: Props): React.ReactElement | null {
+  const { capture } = usePostHog();
+  const [value, setValue] = useState("");
+  const [busy, setBusy] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+  const inputRef = useRef<HTMLTextAreaElement | null>(null);
+
+  useEffect(() => {
+    if (open) {
+      setValue("");
+      setBusy(false);
+      setError(null);
+      capture("audit_invite_dialog_opened", { source });
+    }
+  }, [capture, open, source]);
+
+  useEffect(() => {
+    if (!open) return;
+    const t = setTimeout(() => inputRef.current?.focus(), 50);
+    return () => clearTimeout(t);
+  }, [open]);
+
+  useEffect(() => {
+    if (!open) return;
+    const onKey = (e: KeyboardEvent): void => {
+      if (e.key === "Escape" && !busy) onClose();
+    };
+    window.addEventListener("keydown", onKey);
+    return () => window.removeEventListener("keydown", onKey);
+  }, [open, busy, onClose]);
+
+  const { valid, invalid } = useMemo(() => parseEmails(value), [value]);
+
+  const submit = useCallback(
+    async (e: React.FormEvent<HTMLFormElement>) => {
+      e.preventDefault();
+      if (busy) return;
+      if (valid.length === 0) {
+        setError("add at least one valid email address.");
+        return;
+      }
+      if (valid.length > MAX_RECIPIENTS) {
+        setError(`up to ${MAX_RECIPIENTS} emails at a time. send the rest in a follow-up.`);
+        return;
+      }
+      setBusy(true);
+      setError(null);
+      capture("audit_invite_submitted", {
+        source,
+        recipient_count: valid.length,
+        had_invalid: invalid.length > 0,
+      });
+      try {
+        const res = await fetch("/api/audit/invite", {
+          method: "POST",
+          headers: { "content-type": "application/json" },
+          body: JSON.stringify({ to: valid }),
+        });
+        const body = (await res.json().catch(() => ({}))) as {
+          sent?: string[];
+          failed?: string[];
+          code?: string;
+          message?: string;
+        };
+        if (res.status === 401) {
+          // Session expired between probe and submit — route back through auth.
+          // Without this, repeated submits would dead-end with the same 401.
+          if (onUnauthorized) {
+            onClose();
+            onUnauthorized();
+          } else {
+            setError("session expired. please sign in again.");
+          }
+          return;
+        }
+        if (!res.ok) {
+          const msg = body.message ?? "couldn't send invites.";
+          setError(msg);
+          return;
+        }
+        const sent = body.sent?.length ?? 0;
+        const failed = body.failed?.length ?? 0;
+        toast(
+          failed > 0
+            ? `📨 sent ${sent}, ${failed} bounced — copy the bounce and try again.`
+            : `📨 sent ${sent} ${sent === 1 ? "invite" : "invites"}. thanks for spreading the word.`,
+        );
+        onClose();
+      } catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        setError(`network error: ${message}`);
+      } finally {
+        setBusy(false);
+      }
+    },
+    [busy, valid, invalid, capture, source, onClose, onUnauthorized],
+  );
+
+  if (!open) return null;
+
+  return (
+    <div
+      className="auth-dialog-backdrop"
+      role="dialog"
+      aria-modal="true"
+      aria-labelledby="invite-dialog-title"
+      onClick={(e) => {
+        if (!busy && e.target === e.currentTarget) onClose();
+      }}
+    >
+      <div className="auth-dialog">
+        <button
+          type="button"
+          className="auth-close"
+          onClick={onClose}
+          disabled={busy}
+          aria-label="close"
+        >
+          ×
+        </button>
+
+        <h2 id="invite-dialog-title" className="auth-headline">
+          invite friends to audit theirs
+        </h2>
+        <p className="auth-sub">
+          paste emails separated by commas, spaces, or newlines. you&apos;ll be Cc&apos;d on every invite so they know it&apos;s from you.
+        </p>
+
+        <form onSubmit={submit} className="auth-form">
+          <textarea
+            ref={inputRef}
+            name="emails"
+            placeholder="alice@x.com, bob@y.com&#10;carol@z.com"
+            disabled={busy}
+            className="auth-input invite-textarea"
+            value={value}
+            onChange={(e) => setValue(e.target.value)}
+            rows={4}
+            required
+          />
+          <div className="invite-summary">
+            {valid.length > 0 && (
+              <span className="invite-valid">{valid.length} valid</span>
+            )}
+            {invalid.length > 0 && (
+              <span className="invite-invalid">
+                {invalid.length} invalid: {invalid.slice(0, 3).join(", ")}
+                {invalid.length > 3 ? `, +${invalid.length - 3} more` : ""}
+              </span>
+            )}
+            {valid.length > MAX_RECIPIENTS && (
+              <span className="invite-invalid">
+                only {MAX_RECIPIENTS} per send — first {MAX_RECIPIENTS} will go.
+              </span>
+            )}
+          </div>
+          {error && <div className="auth-error">{error}</div>}
+          <div className="auth-actions">
+            <button
+              type="submit"
+              className="auth-btn primary"
+              disabled={busy || valid.length === 0}
+            >
+              {busy ? "sending…" : `send ${valid.length || ""} invite${valid.length === 1 ? "" : "s"}`.trim()}
+            </button>
+            <button
+              type="button"
+              className="auth-btn"
+              onClick={onClose}
+              disabled={busy}
+            >
+              cancel
+            </button>
+          </div>
+        </form>
+      </div>
+    </div>
+  );
+}

package/.next/standalone/app/audit/_components/quirks-section.tsx

@@ -0,0 +1,75 @@
+"use client";
+
+/**
+ * Section 03 — QUIRKS. "what to improve."
+ *
+ * 4-column table: when · what slipped (+ policy that would've caught it) ·
+ * severity pill · recurrence. Each row corresponds to a triggered
+ * detector. No per-finding card chrome, no 4-quad body, no corner
+ * crosshairs — evidence and fix live in section 04 (How to improve).
+ */
+import React from "react";
+import type { FindingCard } from "@/src/audit/findings";
+
+interface Props {
+  findings: FindingCard[];
+}
+
+type Severity = "low" | "medium" | "high";
+
+/** Heuristic severity from occurrence count — until the audit pipeline
+ *  carries a real severity field. Tuned so a single occurrence reads as
+ *  low and >5 reads as high. */
+function severityFromCount(count: number): Severity {
+  if (count >= 6) return "high";
+  if (count >= 2) return "medium";
+  return "low";
+}
+
+function recurrenceLabel(count: number): string {
+  if (count <= 1) return "new";
+  if (count < 10) return `${count}× seen`;
+  return "recurring";
+}
+
+export function QuirksSection({ findings }: Props) {
+  if (findings.length === 0) return null;
+
+  return (
+    <section className="audit-sec" data-screen-label="03 Quirks">
+      <div className="audit-sec-head">
+        <span className="audit-sec-eyebrow">
+          <span className="ix">03</span>{"// quirks"}
+        </span>
+        <span className="audit-sec-meta">{findings.length} slipped through</span>
+      </div>
+      <h2 className="audit-sec-title">what to improve</h2>
+
+      <div className="quirks-table">
+        <div className="quirks-thead">
+          <span>when</span>
+          <span>what slipped</span>
+          <span>severity</span>
+          <span>seen</span>
+        </div>
+        {findings.map((f) => {
+          const sev = severityFromCount(f.count);
+          return (
+            <div key={f.sourceSlug} className="quirks-row">
+              <span className="q-when">{f.lastSeen}</span>
+              <span className="q-what">
+                <span className="q-title">{f.title}</span>
+                <span className="q-policy">
+                  would&apos;ve been caught by:{" "}
+                  <code>{f.policy}</code>
+                </span>
+              </span>
+              <span className={`q-pill q-pill-${sev}`}>{sev}</span>
+              <span className="q-recur">{recurrenceLabel(f.count)}</span>
+            </div>
+          );
+        })}
+      </div>
+    </section>
+  );
+}

package/.next/standalone/app/audit/_components/rerun-button.tsx

@@ -30,7 +30,13 @@ export interface ScanParams {
 }
 
 const POLL_INTERVAL_MS = 1000;
-const MAX_POLL_MS = 5 * 60_000; // 5 min hard cap
+
+/** Give up polling only after this many *consecutive* status-fetch failures.
+ *  There is no duration cap on a run (a cold all-history scan is unbounded), so
+ *  the only thing that should stop a live poll is losing the server — not the
+ *  run taking a while. At POLL_INTERVAL_MS, this is ~10s of an unreachable
+ *  server before we surface a network error. */
+const MAX_CONSECUTIVE_POLL_FAILURES = 10;
 
 /** Exported for unit testing the option-threading. */
 export function paramsToBody(p: ScanParams) {
@@ -51,7 +57,10 @@ export class RerunError extends Error {
 }
 
 export async function triggerRun(scanParams: ScanParams): Promise<void> {
-  // Kick off the run. 409 (already running) is OK — we'll just poll.
+  // Start the run. The route is fire-and-forget — it kicks off runAudit() in
+  // the background and returns 202 in milliseconds — so the default fast fetch
+  // timeout is correct here: it bounds the *kickoff request*, not the run.
+  // 409 (already running) is fine — we just poll the in-flight run.
   try {
     const res = await fetchWithTimeout("/api/audit/run", {
       method: "POST",
@@ -69,22 +78,42 @@ export async function triggerRun(scanParams: ScanParams): Promise<void> {
     throw new RerunError(isAbortError(err) ? "timeout" : "network", "audit run request failed");
   }
 
-  // Poll status until running flips false. The status route returns
-  // `cachedAt`, which the polling caller can compare against the prior
-  // value to detect "fresh result available" — but for `triggerRun`'s
-  // purposes the `running: false` flip is the success signal.
-  const startedAt = Date.now();
-  while (Date.now() - startedAt < MAX_POLL_MS) {
+  // Poll /api/audit/status until the run finishes. There is deliberately NO
+  // duration cap: a cold, all-history scan can run arbitrarily long and must
+  // not be guillotined client-side. The only failure mode that stops polling is
+  // losing the server, tracked as consecutive status-fetch failures.
+  let consecutiveFailures = 0;
+  for (;;) {
     await new Promise((r) => setTimeout(r, POLL_INTERVAL_MS));
+
+    let status: { running: boolean; error?: string | null } | null = null;
     try {
       const sres = await fetchWithTimeout("/api/audit/status", { cache: "no-store" });
-      if (!sres.ok) continue;
-      const s = await sres.json() as { running: boolean };
-      if (!s.running) return;
+      if (sres.ok) {
+        status = (await sres.json()) as { running: boolean; error?: string | null };
+      }
     } catch {
-      // Transient (including per-request timeout) — keep polling until the
-      // outer MAX_POLL_MS budget runs out.
+      // Transient fetch/JSON failure (including a per-request timeout) — handled
+      // by the connectivity backstop below.
+    }
+
+    if (status === null) {
+      // Status unreachable or non-OK. Only give up once the server has been
+      // unreachable for MAX_CONSECUTIVE_POLL_FAILURES polls in a row; a single
+      // blip must not kill a long, healthy run.
+      if (++consecutiveFailures >= MAX_CONSECUTIVE_POLL_FAILURES) {
+        throw new RerunError("network", "audit status poll lost the server");
+      }
+      continue;
+    }
+
+    consecutiveFailures = 0;
+    if (!status.running) {
+      // Run finished. A non-null error means the background runAudit() threw —
+      // surface it (the dashboard cache was NOT updated). Otherwise it's a clean
+      // success: writeDashboardCache ran before finishRun(null).
+      if (status.error) throw new RerunError("post_failed", status.error);
+      return;
     }
   }
-  throw new RerunError("timeout", "audit poll loop timed out");
 }

package/.next/standalone/app/audit/_components/run-progress.tsx

@@ -66,7 +66,7 @@ export function RunProgress() {
       <div className="panel running-panel">
         <div className="running-header">
           <span className="running-prompt">$</span>
-          <span className="running-cmd">failproofai audit --since 30d</span>
+          <span className="running-cmd">failproofai audit</span>
           <span className="running-cursor" aria-hidden="true">▮</span>
         </div>
 
@@ -112,7 +112,7 @@ export function RunProgress() {
         </div>
 
         <p className="running-foot">
-          this usually takes 10–30 seconds depending on how much session history you have.
+          this can take a while depending on how much session history you have.
         </p>
       </div>
     </section>

package/.next/standalone/app/audit/_components/share-templates.ts

@@ -22,32 +22,33 @@ export interface ShareCtx {
 
 const pol = (n: number) => (n === 1 ? "policy" : "policies");
 
-/** Quirky, emoji-forward — for X. */
+/** Quirky, emoji-forward — for X. No grade-tier framing (sounds bad at
+ *  the low end). Lean on the persona name + score number instead. */
 export const X_TEMPLATES: ((c: ShareCtx) => string)[] = [
-  ({ score, arch, grade, missing }) =>
-    `my AI coding agent just got profiled and it's "${arch}" 🤠\n\n${score}/100 · ${grade} tier${missing > 0 ? ` · ${missing} ${pol(missing)} between me and glory` : ` · every guardrail live`}\n\nwhat's yours? → ${SITE_URL}`,
-  ({ score, arch, grade }) =>
-    `turns out my coding agent has a whole personality and it's ${arch} 💀\n\nscored ${score}/100 (${grade} tier). the audit does not miss.\n\nrun yours in 30s → ${SITE_URL}`,
-  ({ score, arch, grade }) =>
-    `${score}/100. ${grade} tier. archetype: ${arch} 👀\n\nfailproofai reverse-engineered my agent's entire vibe from its own session logs.\n\n${SITE_URL}`,
-  ({ score, arch, grade, missing }) =>
-    `plot twist: my AI agent is ${arch} 🎭\n\n${score}/100 · ${grade} tier${missing > 0 ? ` · ${missing} ${pol(missing)} away from behaving` : ` · spotless, somehow`}\n\nbefailproof.ai`,
-  ({ score, arch, grade }) =>
-    `i let failproofai audit my coding agent and it called me ${arch} ${grade === "S" || grade === "A" ? "😎" : "😬"}\n\n${score}/100, ${grade} tier. brutally accurate. no notes.\n\n${SITE_URL}`,
+  ({ score, arch, missing }) =>
+    `my AI coding agent just got profiled and it's "${arch}" 🤠\n\nscored ${score}/100${missing > 0 ? ` · ${missing} ${pol(missing)} between me and a clean run` : ` · every guardrail live`}\n\nwhat's yours? → ${SITE_URL}`,
+  ({ score, arch }) =>
+    `turns out my coding agent has a whole personality and it's ${arch} 💀\n\n${score}/100. the audit does not miss.\n\nrun yours in 30s → ${SITE_URL}`,
+  ({ score, arch }) =>
+    `archetype: ${arch} 👀\n\n${score}/100 on the failproofai audit. it reverse-engineered my agent's entire vibe from its own session logs.\n\n${SITE_URL}`,
+  ({ score, arch, missing }) =>
+    `plot twist: my AI agent is ${arch} 🎭\n\n${score}/100${missing > 0 ? ` · ${missing} ${pol(missing)} away from behaving` : ` · spotless, somehow`}\n\nbefailproof.ai`,
+  ({ score, arch }) =>
+    `i let failproofai audit my coding agent and it called me ${arch} ${score >= 80 ? "😎" : "😬"}\n\n${score}/100. brutally accurate. no notes.\n\n${SITE_URL}`,
 ];
 
-/** Measured, professional — for LinkedIn. */
+/** Measured, professional — for LinkedIn. No grade-tier framing. */
 export const LI_TEMPLATES: ((c: ShareCtx) => string)[] = [
-  ({ score, arch, grade, missing }) =>
-    `I ran a failproofai audit on our AI coding agents.\n\nResult: ${score}/100 — ${grade} tier, behavioural archetype "${arch}". ${missing > 0 ? `${missing} prescribed ${pol(missing)} would close the remaining gaps.` : `Every prescribed policy is already live.`}\n\nUnderstanding how agents actually behave across real sessions is the first step to securing them. Free and open-source: ${SITE_URL}`,
-  ({ score, arch, grade, missing }) =>
-    `Security posture check on our coding-agent stack, via failproofai.\n\nScore: ${score}/100 (${grade} tier). Behavioural profile: "${arch}". ${missing > 0 ? `${missing} ${pol(missing)} flagged as real, addressable attack surface.` : `No open policy gaps.`}\n\nThirty seconds to run your own assessment: ${SITE_URL}`,
-  ({ score, arch, grade }) =>
-    `Most teams can't answer a simple question: how do our AI agents actually behave when no one is watching?\n\nfailproofai audited ours and profiled it as "${arch}" — ${score}/100, ${grade} tier. Concrete, evidence-backed, and mapped to the exact policies that close each gap.\n\n${SITE_URL}`,
-  ({ score, arch, grade, missing }) =>
-    `Agent security isn't a vibe — it's measurable.\n\nWe scored ${score}/100 (${grade} tier) on the failproofai audit, archetype "${arch}". ${missing > 0 ? `${missing} prescribed ${pol(missing)} remain to harden the stack.` : `Full coverage on every prescribed policy.`}\n\nWorth 30 seconds for any team shipping with AI agents: ${SITE_URL}`,
-  ({ score, arch, grade }) =>
-    `Ran our coding agents through a failproofai behavioural audit.\n\n${score}/100, ${grade} tier — archetype "${arch}". The report maps every risky pattern to the policy that prevents it, so remediation becomes a checklist rather than a guess.\n\nOpen-source, free to run: ${SITE_URL}`,
+  ({ score, arch, missing }) =>
+    `I ran a failproofai audit on our AI coding agents.\n\nResult: ${score}/100, behavioural archetype "${arch}". ${missing > 0 ? `${missing} prescribed ${pol(missing)} would close the remaining gaps.` : `Every prescribed policy is already live.`}\n\nUnderstanding how agents actually behave across real sessions is the first step to securing them. Free and open-source: ${SITE_URL}`,
+  ({ score, arch, missing }) =>
+    `Security posture check on our coding-agent stack, via failproofai.\n\nScore: ${score}/100. Behavioural profile: "${arch}". ${missing > 0 ? `${missing} ${pol(missing)} flagged as real, addressable attack surface.` : `No open policy gaps.`}\n\nThirty seconds to run your own assessment: ${SITE_URL}`,
+  ({ score, arch }) =>
+    `Most teams can't answer a simple question: how do our AI agents actually behave when no one is watching?\n\nfailproofai audited ours and profiled it as "${arch}" — ${score}/100. Concrete, evidence-backed, and mapped to the exact policies that close each gap.\n\n${SITE_URL}`,
+  ({ score, arch, missing }) =>
+    `Agent security isn't a vibe — it's measurable.\n\nWe scored ${score}/100 on the failproofai audit, archetype "${arch}". ${missing > 0 ? `${missing} prescribed ${pol(missing)} remain to harden the stack.` : `Full coverage on every prescribed policy.`}\n\nWorth 30 seconds for any team shipping with AI agents: ${SITE_URL}`,
+  ({ score, arch }) =>
+    `Ran our coding agents through a failproofai behavioural audit.\n\n${score}/100, archetype "${arch}". The report maps every risky pattern to the policy that prevents it, so remediation becomes a checklist rather than a guess.\n\nOpen-source, free to run: ${SITE_URL}`,
 ];
 
 /** djb2 hash — stable per seed so the template choice is deterministic. */