npm - failproofai - Versions diffs - 0.0.13 → 0.0.14-beta.1 - Mend

failproofai 0.0.13 → 0.0.14-beta.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (310) hide show

package/.next/standalone/assets/logos/antigravity.svg ADDED Viewed

@@ -0,0 +1 @@

+ <svg height="1em" style="flex:none;line-height:1" viewBox="0 0 24 24" width="1em" xmlns="http://www.w3.org/2000/svg"><title>Antigravity</title><mask height="23" id="lobe-icons-antigravity-0-_R_0_" maskUnits="userSpaceOnUse" width="24" x="0" y="1"><path d="M21.751 22.607c1.34 1.005 3.35.335 1.508-1.508C17.73 15.74 18.904 1 12.037 1 5.17 1 6.342 15.74.815 21.1c-2.01 2.009.167 2.511 1.507 1.506 5.192-3.517 4.857-9.714 9.715-9.714 4.857 0 4.522 6.197 9.714 9.715z" fill="#fff"></path></mask><g mask="url(#lobe-icons-antigravity-0-_R_0_)"><g filter="url(#lobe-icons-antigravity-1-_R_0_)"><path d="M-1.018-3.992c-.408 3.591 2.686 6.89 6.91 7.37 4.225.48 7.98-2.043 8.387-5.633.408-3.59-2.686-6.89-6.91-7.37-4.225-.479-7.98 2.043-8.387 5.633z" fill="#FFE432"></path></g><g filter="url(#lobe-icons-antigravity-2-_R_0_)"><path d="M15.269 7.747c1.058 4.557 5.691 7.374 10.348 6.293 4.657-1.082 7.575-5.653 6.516-10.21-1.058-4.556-5.691-7.374-10.348-6.292-4.657 1.082-7.575 5.653-6.516 10.21z" fill="#FC413D"></path></g><g filter="url(#lobe-icons-antigravity-3-_R_0_)"><path d="M-12.443 10.804c1.338 4.703 7.36 7.11 13.453 5.378 6.092-1.733 9.947-6.95 8.61-11.652C8.282-.173 2.26-2.58-3.833-.848-9.925.884-13.78 6.1-12.443 10.804z" fill="#00B95C"></path></g><g filter="url(#lobe-icons-antigravity-4-_R_0_)"><path d="M-12.443 10.804c1.338 4.703 7.36 7.11 13.453 5.378 6.092-1.733 9.947-6.95 8.61-11.652C8.282-.173 2.26-2.58-3.833-.848-9.925.884-13.78 6.1-12.443 10.804z" fill="#00B95C"></path></g><g filter="url(#lobe-icons-antigravity-5-_R_0_)"><path d="M-7.608 14.703c3.352 3.424 9.126 3.208 12.896-.483 3.77-3.69 4.108-9.459.756-12.883C2.69-2.087-3.083-1.871-6.853 1.82c-3.77 3.69-4.108 9.458-.755 12.883z" fill="#00B95C"></path></g><g filter="url(#lobe-icons-antigravity-6-_R_0_)"><path d="M9.932 27.617c1.04 4.482 5.384 7.303 9.7 6.3 4.316-1.002 6.971-5.448 5.93-9.93-1.04-4.483-5.384-7.304-9.7-6.301-4.316 1.002-6.971 5.448-5.93 9.93z" fill="#3186FF"></path></g><g filter="url(#lobe-icons-antigravity-7-_R_0_)"><path d="M2.572-8.185C.392-3.329 2.778 2.472 7.9 4.771c5.122 2.3 11.042.227 13.222-4.63 2.18-4.855-.205-10.656-5.327-12.955-5.122-2.3-11.042-.227-13.222 4.63z" fill="#FBBC04"></path></g><g filter="url(#lobe-icons-antigravity-8-_R_0_)"><path d="M-3.267 38.686c-5.277-2.072 3.742-19.117 5.984-24.83 2.243-5.712 8.34-8.664 13.616-6.592 5.278 2.071 11.533 13.482 9.29 19.195-2.242 5.713-23.613 14.298-28.89 12.227z" fill="#3186FF"></path></g><g filter="url(#lobe-icons-antigravity-9-_R_0_)"><path d="M28.71 17.471c-1.413 1.649-5.1.808-8.236-1.878-3.135-2.687-4.531-6.201-3.118-7.85 1.412-1.649 5.1-.808 8.235 1.878s4.532 6.2 3.119 7.85z" fill="#749BFF"></path></g><g filter="url(#lobe-icons-antigravity-10-_R_0_)"><path d="M18.163 9.077c5.81 3.93 12.502 4.19 14.946.577 2.443-3.612-.287-9.727-6.098-13.658-5.81-3.931-12.502-4.19-14.946-.577-2.443 3.612.287 9.727 6.098 13.658z" fill="#FC413D"></path></g><g filter="url(#lobe-icons-antigravity-11-_R_0_)"><path d="M-.915 2.684c-1.44 3.473-.97 6.967 1.05 7.804 2.02.837 4.824-1.3 6.264-4.772 1.44-3.473.97-6.967-1.05-7.804-2.02-.837-4.824 1.3-6.264 4.772z" fill="#FFEE48"></path></g></g><defs><filter color-interpolation-filters="sRGB" filterUnits="userSpaceOnUse" height="17.587" id="lobe-icons-antigravity-1-_R_0_" width="19.838" x="-3.288" y="-11.917"><feFlood flood-opacity="0" result="BackgroundImageFix"></feFlood><feBlend in="SourceGraphic" in2="BackgroundImageFix" result="shape"></feBlend><feGaussianBlur result="effect1_foregroundBlur_977_115" stdDeviation="1.117"></feGaussianBlur></filter><filter color-interpolation-filters="sRGB" filterUnits="userSpaceOnUse" height="38.565" id="lobe-icons-antigravity-2-_R_0_" width="38.9" x="4.251" y="-13.493"><feFlood flood-opacity="0" result="BackgroundImageFix"></feFlood><feBlend in="SourceGraphic" in2="BackgroundImageFix" result="shape"></feBlend><feGaussianBlur result="effect1_foregroundBlur_977_115" stdDeviation="5.4"></feGaussianBlur></filter><filter color-interpolation-filters="sRGB" filterUnits="userSpaceOnUse" height="36.517" id="lobe-icons-antigravity-3-_R_0_" width="40.955" x="-21.889" y="-10.592"><feFlood flood-opacity="0" result="BackgroundImageFix"></feFlood><feBlend in="SourceGraphic" in2="BackgroundImageFix" result="shape"></feBlend><feGaussianBlur result="effect1_foregroundBlur_977_115" stdDeviation="4.591"></feGaussianBlur></filter><filter color-interpolation-filters="sRGB" filterUnits="userSpaceOnUse" height="36.517" id="lobe-icons-antigravity-4-_R_0_" width="40.955" x="-21.889" y="-10.592"><feFlood flood-opacity="0" result="BackgroundImageFix"></feFlood><feBlend in="SourceGraphic" in2="BackgroundImageFix" result="shape"></feBlend><feGaussianBlur result="effect1_foregroundBlur_977_115" stdDeviation="4.591"></feGaussianBlur></filter><filter color-interpolation-filters="sRGB" filterUnits="userSpaceOnUse" height="36.595" id="lobe-icons-antigravity-5-_R_0_" width="36.632" x="-19.099" y="-10.278"><feFlood flood-opacity="0" result="BackgroundImageFix"></feFlood><feBlend in="SourceGraphic" in2="BackgroundImageFix" result="shape"></feBlend><feGaussianBlur result="effect1_foregroundBlur_977_115" stdDeviation="4.591"></feGaussianBlur></filter><filter color-interpolation-filters="sRGB" filterUnits="userSpaceOnUse" height="34.087" id="lobe-icons-antigravity-6-_R_0_" width="33.533" x=".981" y="8.758"><feFlood flood-opacity="0" result="BackgroundImageFix"></feFlood><feBlend in="SourceGraphic" in2="BackgroundImageFix" result="shape"></feBlend><feGaussianBlur result="effect1_foregroundBlur_977_115" stdDeviation="4.363"></feGaussianBlur></filter><filter color-interpolation-filters="sRGB" filterUnits="userSpaceOnUse" height="35.276" id="lobe-icons-antigravity-7-_R_0_" width="35.978" x="-6.143" y="-21.659"><feFlood flood-opacity="0" result="BackgroundImageFix"></feFlood><feBlend in="SourceGraphic" in2="BackgroundImageFix" result="shape"></feBlend><feGaussianBlur result="effect1_foregroundBlur_977_115" stdDeviation="3.954"></feGaussianBlur></filter><filter color-interpolation-filters="sRGB" filterUnits="userSpaceOnUse" height="46.523" id="lobe-icons-antigravity-8-_R_0_" width="45.114" x="-11.96" y="-.46"><feFlood flood-opacity="0" result="BackgroundImageFix"></feFlood><feBlend in="SourceGraphic" in2="BackgroundImageFix" result="shape"></feBlend><feGaussianBlur result="effect1_foregroundBlur_977_115" stdDeviation="3.531"></feGaussianBlur></filter><filter color-interpolation-filters="sRGB" filterUnits="userSpaceOnUse" height="24.054" id="lobe-icons-antigravity-9-_R_0_" width="25.094" x="10.485" y=".58"><feFlood flood-opacity="0" result="BackgroundImageFix"></feFlood><feBlend in="SourceGraphic" in2="BackgroundImageFix" result="shape"></feBlend><feGaussianBlur result="effect1_foregroundBlur_977_115" stdDeviation="3.159"></feGaussianBlur></filter><filter color-interpolation-filters="sRGB" filterUnits="userSpaceOnUse" height="30.007" id="lobe-icons-antigravity-10-_R_0_" width="33.508" x="5.833" y="-12.467"><feFlood flood-opacity="0" result="BackgroundImageFix"></feFlood><feBlend in="SourceGraphic" in2="BackgroundImageFix" result="shape"></feBlend><feGaussianBlur result="effect1_foregroundBlur_977_115" stdDeviation="2.669"></feGaussianBlur></filter><filter color-interpolation-filters="sRGB" filterUnits="userSpaceOnUse" height="26.151" id="lobe-icons-antigravity-11-_R_0_" width="22.194" x="-8.355" y="-8.876"><feFlood flood-opacity="0" result="BackgroundImageFix"></feFlood><feBlend in="SourceGraphic" in2="BackgroundImageFix" result="shape"></feBlend><feGaussianBlur result="effect1_foregroundBlur_977_115" stdDeviation="3.303"></feGaussianBlur></filter></defs></svg>

package/.next/standalone/assets/logos/devin.svg ADDED Viewed

@@ -0,0 +1 @@

+ <svg height="1em" style="flex:none;line-height:1" viewBox="0 0 24 24" width="1em" xmlns="http://www.w3.org/2000/svg"><title>Devin</title><path d="M2.033 9.867l2.554 1.483a.589.589 0 00.592 0l2.554-1.483.01-.008a.608.608 0 00.11-.084l.013-.015a.631.631 0 00.076-.1c.003-.005.008-.01.01-.016a.558.558 0 00.052-.125l.007-.028a.611.611 0 00.019-.14V7.868c0-.572.307-1.105.8-1.392a1.595 1.595 0 011.598 0l1.277.742a.54.54 0 00.129.053l.028.01c.044.01.088.015.133.016h.006l.013-.002a.587.587 0 00.27-.074l.011-.004 2.554-1.483a.596.596 0 00.297-.516V2.253a.595.595 0 00-.297-.516L12.293.257a.587.587 0 00-.591 0L9.148 1.737l-.01.01a.609.609 0 00-.109.083l-.014.015a.632.632 0 00-.076.1c-.003.005-.008.01-.01.016a.57.57 0 00-.052.124l-.007.028a.612.612 0 00-.018.14v1.483c0 .572-.307 1.105-.8 1.393a1.597 1.597 0 01-1.599 0l-1.276-.742a.603.603 0 00-.13-.053l-.028-.008a.658.658 0 00-.133-.018h-.02a.57.57 0 00-.269.074c-.003.002-.008.002-.012.005L2.033 5.872a.596.596 0 00-.297.515v2.966c0 .213.113.41.297.515z" fill="#3969CA"></path><path d="M15.943 10.607a1.596 1.596 0 011.599 0l1.276.74c.041.025.085.04.13.055l.028.008c.043.01.088.016.133.018h.005c.005 0 .01-.002.014-.003a.474.474 0 00.122-.016l.021-.005a.616.616 0 00.126-.052c.004-.002.009-.002.013-.005l2.554-1.482a.597.597 0 00.297-.516V6.383a.596.596 0 00-.297-.515l-2.552-1.483a.587.587 0 00-.592 0l-2.553 1.482-.011.008a.61.61 0 00-.108.084l-.014.016a.637.637 0 00-.076.1c-.003.005-.008.01-.01.016a.57.57 0 00-.052.124l-.007.029a.612.612 0 00-.018.14v1.482c0 .572-.307 1.105-.8 1.393a1.597 1.597 0 01-1.599 0l-1.276-.742a.584.584 0 00-.13-.053l-.028-.008a.62.62 0 00-.133-.018h-.02a.587.587 0 00-.269.074l-.012.004L9.15 10a.596.596 0 00-.296.516v2.966c0 .212.112.409.296.515l2.554 1.483s.008.002.012.005c.04.022.082.04.126.052l.02.004a.57.57 0 00.123.017l.014.002h.006c.054 0 .108-.01.16-.025a.587.587 0 00.13-.054l1.277-.741a1.597 1.597 0 012.398 1.392v1.482c0 .049.007.095.019.14l.007.028a.619.619 0 00.051.125c.004.006.008.01.01.016a.6.6 0 00.076.1l.014.015c.033.032.069.06.108.084.004.002.006.006.011.008l2.554 1.483a.59.59 0 00.593 0l2.554-1.483a.597.597 0 00.296-.516v-2.965a.595.595 0 00-.296-.516l-2.554-1.483s-.008-.002-.012-.005a.54.54 0 00-.126-.051c-.007-.003-.013-.003-.02-.005a.635.635 0 00-.125-.017h-.018a.557.557 0 00-.16.026.588.588 0 00-.13.053l-1.276.742a1.595 1.595 0 01-1.598 0 1.615 1.615 0 010-2.785l-.005-.001z" fill="#21C19A"></path><path d="M14.848 18.265l-2.554-1.482-.012-.005a.526.526 0 00-.126-.052c-.007-.002-.014-.002-.02-.005a.64.64 0 00-.124-.017h-.02a.56.56 0 00-.16.026.588.588 0 00-.13.053l-1.276.742a1.594 1.594 0 01-1.598 0c-.493-.286-.8-.82-.8-1.393V14.65a.563.563 0 00-.018-.14l-.008-.028a.604.604 0 00-.051-.124l-.01-.017a.603.603 0 00-.076-.1l-.014-.015a.596.596 0 00-.109-.084c-.003-.002-.005-.006-.01-.008L5.178 12.65a.587.587 0 00-.591 0l-2.554 1.483a.596.596 0 00-.297.516v2.965c0 .213.113.41.297.516l2.554 1.483.012.004a.618.618 0 00.267.074l.016.002h.007a.55.55 0 00.16-.026.584.584 0 00.129-.053l1.277-.742a1.597 1.597 0 012.398 1.393v1.482c0 .05.007.095.019.14l.007.028c.013.044.03.085.051.125l.01.016c.022.036.047.07.076.1l.014.015c.032.032.069.06.109.084l.01.008 2.554 1.483a.587.587 0 00.593 0l2.554-1.483a.596.596 0 00.296-.515v-2.966a.596.596 0 00-.296-.516h-.002z" fill="#0294DE"></path></svg>

package/.next/standalone/assets/logos/factory-dark.png ADDED Viewed

Binary file

package/.next/standalone/assets/logos/factory-light.png ADDED Viewed

Binary file

package/.next/standalone/assets/logos/goose-dark.svg ADDED Viewed

@@ -0,0 +1 @@

+ <svg fill="#ffffff" fill-rule="evenodd" height="1em" style="flex:none;line-height:1" viewBox="0 0 24 24" width="1em" xmlns="http://www.w3.org/2000/svg"><title>Goose</title><path d="M21.595 23.61c1.167-.254 2.405-.944 2.405-.944l-2.167-1.784a12.124 12.124 0 01-2.695-3.131 12.127 12.127 0 00-3.97-4.049l-.794-.462a1.115 1.115 0 01-.488-.815.844.844 0 01.154-.575c.413-.582 2.548-3.115 2.94-3.44.503-.416 1.065-.762 1.586-1.159.074-.056.148-.112.221-.17.003-.002.007-.004.009-.007.167-.131.325-.272.45-.438.453-.524.563-.988.59-1.193-.061-.197-.244-.639-.753-1.148.319.02.705.272 1.056.569.235-.376.481-.773.727-1.171.165-.266-.08-.465-.086-.471h-.001V3.22c-.007-.007-.206-.25-.471-.086-.567.35-1.134.702-1.639 1.021 0 0-.597-.012-1.305.599a2.464 2.464 0 00-.438.45l-.007.009c-.058.072-.114.147-.17.221-.397.521-.743 1.083-1.16 1.587-.323.391-2.857 2.526-3.44 2.94a.842.842 0 01-.574.153 1.115 1.115 0 01-.815-.488l-.462-.794a12.123 12.123 0 00-4.049-3.97 12.133 12.133 0 01-3.13-2.695L1.332 0S.643 1.238.39 2.405c.352.428 1.27 1.49 2.34 2.302C1.58 4.167.73 3.75.06 3.4c-.103.765-.063 1.92.043 2.816.726.317 1.961.806 3.219 1.066-1.006.236-2.11.278-2.961.262.15.554.358 1.119.64 1.688.119.263.25.52.39.77.452.125 2.222.383 3.164.171l-2.51.897a27.776 27.776 0 002.544 2.726c2.031-1.092 2.494-1.241 4.018-2.238-2.467 2.008-3.108 2.828-3.8 3.67l-.483.678c-.25.351-.469.725-.65 1.117-.61 1.31-1.47 4.1-1.47 4.1-.154.486.202.842.674.674 0 0 2.79-.861 4.1-1.47.392-.182.766-.4 1.118-.65l.677-.483c.227-.187.453-.37.701-.586 0 0 1.705 2.02 3.458 3.349l.896-2.511c-.211.942.046 2.712.17 3.163.252.142.509.272.772.392.569.28 1.134.49 1.688.64-.016-.853.026-1.956.261-2.962.26 1.258.75 2.493 1.067 3.219.895.106 2.051.146 2.816.043a73.87 73.87 0 01-1.308-2.67c.811 1.07 1.874 1.988 2.302 2.34h-.001z"></path></svg>

package/.next/standalone/assets/logos/goose-light.svg ADDED Viewed

@@ -0,0 +1 @@

+ <svg fill="#111111" fill-rule="evenodd" height="1em" style="flex:none;line-height:1" viewBox="0 0 24 24" width="1em" xmlns="http://www.w3.org/2000/svg"><title>Goose</title><path d="M21.595 23.61c1.167-.254 2.405-.944 2.405-.944l-2.167-1.784a12.124 12.124 0 01-2.695-3.131 12.127 12.127 0 00-3.97-4.049l-.794-.462a1.115 1.115 0 01-.488-.815.844.844 0 01.154-.575c.413-.582 2.548-3.115 2.94-3.44.503-.416 1.065-.762 1.586-1.159.074-.056.148-.112.221-.17.003-.002.007-.004.009-.007.167-.131.325-.272.45-.438.453-.524.563-.988.59-1.193-.061-.197-.244-.639-.753-1.148.319.02.705.272 1.056.569.235-.376.481-.773.727-1.171.165-.266-.08-.465-.086-.471h-.001V3.22c-.007-.007-.206-.25-.471-.086-.567.35-1.134.702-1.639 1.021 0 0-.597-.012-1.305.599a2.464 2.464 0 00-.438.45l-.007.009c-.058.072-.114.147-.17.221-.397.521-.743 1.083-1.16 1.587-.323.391-2.857 2.526-3.44 2.94a.842.842 0 01-.574.153 1.115 1.115 0 01-.815-.488l-.462-.794a12.123 12.123 0 00-4.049-3.97 12.133 12.133 0 01-3.13-2.695L1.332 0S.643 1.238.39 2.405c.352.428 1.27 1.49 2.34 2.302C1.58 4.167.73 3.75.06 3.4c-.103.765-.063 1.92.043 2.816.726.317 1.961.806 3.219 1.066-1.006.236-2.11.278-2.961.262.15.554.358 1.119.64 1.688.119.263.25.52.39.77.452.125 2.222.383 3.164.171l-2.51.897a27.776 27.776 0 002.544 2.726c2.031-1.092 2.494-1.241 4.018-2.238-2.467 2.008-3.108 2.828-3.8 3.67l-.483.678c-.25.351-.469.725-.65 1.117-.61 1.31-1.47 4.1-1.47 4.1-.154.486.202.842.674.674 0 0 2.79-.861 4.1-1.47.392-.182.766-.4 1.118-.65l.677-.483c.227-.187.453-.37.701-.586 0 0 1.705 2.02 3.458 3.349l.896-2.511c-.211.942.046 2.712.17 3.163.252.142.509.272.772.392.569.28 1.134.49 1.688.64-.016-.853.026-1.956.261-2.962.26 1.258.75 2.493 1.067 3.219.895.106 2.051.146 2.816.043a73.87 73.87 0 01-1.308-2.67c.811 1.07 1.874 1.988 2.302 2.34h-.001z"></path></svg>

package/.next/standalone/assets/logos/openclaw.svg ADDED Viewed

@@ -0,0 +1,22 @@
+<svg viewBox="0 0 120 120" fill="none" xmlns="http://www.w3.org/2000/svg">
+  <defs>
+    <linearGradient id="lobster-gradient" x1="0%" y1="0%" x2="100%" y2="100%">
+      <stop offset="0%" stop-color="#ff4d4d"/>
+      <stop offset="100%" stop-color="#991b1b"/>
+    </linearGradient>
+  </defs>
+  <!-- Body -->
+  <path d="M60 10 C30 10 15 35 15 55 C15 75 30 95 45 100 L45 110 L55 110 L55 100 C55 100 60 102 65 100 L65 110 L75 110 L75 100 C90 95 105 75 105 55 C105 35 90 10 60 10Z" fill="url(#lobster-gradient)"/>
+  <!-- Left Claw -->
+  <path d="M20 45 C5 40 0 50 5 60 C10 70 20 65 25 55 C28 48 25 45 20 45Z" fill="url(#lobster-gradient)"/>
+  <!-- Right Claw -->
+  <path d="M100 45 C115 40 120 50 115 60 C110 70 100 65 95 55 C92 48 95 45 100 45Z" fill="url(#lobster-gradient)"/>
+  <!-- Antenna -->
+  <path d="M45 15 Q35 5 30 8" stroke="#ff4d4d" stroke-width="3" stroke-linecap="round"/>
+  <path d="M75 15 Q85 5 90 8" stroke="#ff4d4d" stroke-width="3" stroke-linecap="round"/>
+  <!-- Eyes -->
+  <circle cx="45" cy="35" r="6" fill="#050810"/>
+  <circle cx="75" cy="35" r="6" fill="#050810"/>
+  <circle cx="46" cy="34" r="2.5" fill="#00e5cc"/>
+  <circle cx="76" cy="34" r="2.5" fill="#00e5cc"/>
+</svg>

package/.next/standalone/ci/cli-integration/Dockerfile ADDED Viewed

@@ -0,0 +1,47 @@
+# failproofai CLI-canary sandbox — base image
+#
+# Design goals (see failproofai-cli-canary-design.md §4):
+#   - SAFE:  non-root user, NO sudo installed, no host FS mounted at runtime.
+#            The canary fires `sudo whoami` / `.env`-read deny-probes; here they
+#            are inert BY CONSTRUCTION even on a day enforcement is broken.
+#   - LIGHT: ephemeral daily container (`docker run --rm`), not a daemon.
+#            Only this image + one named volume persist; zero idle CPU/RAM.
+#   - FRESH: CLIs are NOT baked in — they are `@latest`-installed into the
+#            persistent HOME volume at run time (the whole point of the canary),
+#            so this base image rebuilds rarely.
+#
+# The HOME volume (mounted at /home/canary) holds: npm-global CLIs, every
+# vendor login/token, and per-CLI config — so logins survive across daily runs.
+FROM node:22-bookworm-slim
+# bun from the official image — no `curl | bash` needed at build time.
+COPY --from=oven/bun:latest /usr/local/bin/bun /usr/local/bin/bun
+# Minimal tooling for the various vendor CLI installers. Deliberately NO sudo.
+# Tooling for the various vendor installers. Deliberately NO sudo.
+#   bzip2/xz-utils : goose extracts its Rust binary with these
+#   libsecret-1-0  : antigravity caches login tokens via libsecret (best-effort)
+RUN apt-get update -qq \
+ && apt-get install -y -qq --no-install-recommends \
+      git ca-certificates curl unzip bzip2 xz-utils libsecret-1-0 \
+ && rm -rf /var/lib/apt/lists/*
+# Unprivileged user. HOME is the mount point for the persistent named volume;
+# because the image ships a canary-owned /home/canary, an empty named volume
+# mounted here is initialised canary-owned (Docker copies image content+owner).
+# node:22-slim already ships a `node` user at UID 1000, so pin canary to 1001.
+RUN useradd --create-home --uid 1001 --shell /bin/bash canary
+USER canary
+WORKDIR /home/canary
+RUN mkdir -p /home/canary/.npm-global/bin /home/canary/.local/bin
+# NPM_CONFIG_PREFIX via ENV (not `npm config set`) so it survives the volume
+# mount shadowing /home/canary at runtime. Runtime `npm i -g` lands in the volume.
+ENV NPM_CONFIG_PREFIX=/home/canary/.npm-global
+ENV PATH=/home/canary/.npm-global/bin:/home/canary/.local/bin:/usr/local/bin:/usr/bin:/bin
+# Sanity: fail the build if bun/node/npm aren't all runnable as the canary user.
+RUN bun --version && node --version && npm --version
+CMD ["bash"]

package/.next/standalone/ci/cli-integration/README.md ADDED Viewed

@@ -0,0 +1,69 @@
+# CLI integration tests
+A daily **live-enforcement integration test** for failproofai. It answers one
+question the unit/e2e suites can't: *does failproofai still enforce against every
+supported agent CLI, at the versions users actually install today?*
+Every day (`.github/workflows/cli-integration.yml`) it installs all 12 agent
+CLIs **@latest** into an isolated Docker sandbox, drives each one against
+failproofai's own policies (built from this repo's HEAD), and confirms the hook
+log shows a **DENY**. A *silent-allow* — a blocked action that ran with no deny —
+means enforcement broke against that CLI (e.g. a vendor changed their hook schema
+out from under us). The test asserts the deny **positively**, so drift surfaces
+as a red run + a Slack alert instead of going unnoticed until a user hits it.
+## Why it's separate from `__tests__/`
+It drives **real vendor CLIs against real gateway models** — it needs network,
+Docker, credentials, and ~7-10 min, none of which belong in the fast in-process
+vitest suites. So it's a scheduled workflow, not a PR gate.
+## How a run works
+1. Build failproofai under test (`dist/index.js` + `dist/cli.mjs`) from this repo.
+2. Restore `cli-integration-state.json` from Actions cache (version-gate +
+   broke/recovered diff).
+3. Build the sandbox image, install all 12 CLIs (`install-clis.sh`), inject the
+   OAuth credential files from secrets (`inject-tokens.sh`).
+4. `run.sh` probes each non-gated CLI (`probe-cli.sh`), builds the report
+   (`report.js`), and POSTs it to Slack.
+**Version-gate:** a CLI is re-probed only when its binary version **or**
+failproofai's HEAD changed since its last green run — unchanged ⇒ can't have
+drifted ⇒ skip, protecting LLM/vendor quota. `FAIL`/`INCONCLUSIVE`/`ERROR` always
+re-probe until they recover. Dispatch with **force** to probe everything.
+## Auth & secrets (the `cli-integration` Environment)
+Because this repo is public, all credentials live in a scoped **GitHub
+Environment** (`cli-integration`) — only this workflow's job can read them — and
+the workflow triggers on `schedule`/`workflow_dispatch` **only**, so fork PRs can
+never reach them.
+| Auth | CLIs | Secret(s) |
+|------|------|-----------|
+| Env-var (gateway) | claude, codex, goose, opencode, pi, hermes, openclaw, factory | `CANARY_LLM_API_KEY`, `CANARY_LLM_BASE_URL` |
+| Env-var (PAT) | copilot | `COPILOT_GITHUB_TOKEN` |
+| Injected token file | cursor, devin, antigravity | `CURSOR_/DEVIN_/ANTIGRAVITY_TOKEN_TGZ_B64` |
+| Delivery | — | `SLACK_WEBHOOK_URL` |
+The injected-token CLIs carry OAuth session tokens captured from a logged-in
+machine (see `capture-tokens.sh`). They authenticate on a fresh runner, but may
+eventually expire — when that happens the test reports `⚠️ ERROR` for that CLI;
+re-login on the capture machine and refresh the secret.
+> Note: env-var / secret names keep the historical `CANARY_` prefix internally —
+> renaming them across the harness would be churn with no user-visible benefit.
+## Files
+```
+Dockerfile            non-root sandbox base image
+install-clis.sh       install/upgrade all 12 CLIs @latest (with retries)
+inject-tokens.sh      write captured OAuth creds into the fresh volume
+probe-cli.sh          live enforcement probe for ONE CLI (the oracle)
+canary-policies.mjs   benign-marker custom policies the probe trips
+run.sh                orchestrator (gate → probe → report → Slack)
+report.js             build the Slack report + diff state (broke/recovered)
+capture-tokens.sh     (run on a logged-in machine) refresh the OAuth token secrets
+```

package/.next/standalone/ci/cli-integration/canary-policies.mjs ADDED Viewed

@@ -0,0 +1,45 @@
+/**
+ * Canary custom policies — the DEFINITE probe.
+ *
+ * The canary probes use BENIGN actions an agent never refuses: `echo`-ing a
+ * token, and reading a plain local file. Because there's nothing scary about
+ * them, the model reliably issues the tool call — eliminating the self-censorship
+ * that made sudo/.env/system-read probes come back INCONCLUSIVE.
+ *
+ * These policies intercept exactly those benign markers. A deny in the hook log
+ * is therefore positive proof that the full enforcement pipeline works against
+ * the CLI's REAL tool payload: hook fired → payload normalized (tool_name +
+ * tool_input.command / file_path — the drift-prone fields behind the Copilot
+ * 1.0.70 silent-allow) → policy evaluated → deny emitted. If normalization ever
+ * drifts, ctx.toolInput.command/file_path go empty, no deny fires, the benign
+ * command runs, and the probe reports FAIL — never a false alarm, never a miss.
+ */
+import { customPolicies, allow, deny } from "failproofai";
+// Bash-command path: deny a benign shell command carrying the probe token.
+customPolicies.add({
+  name: "canary-bash",
+  description: "Canary: deny the benign probe shell command (CANARY_PROBE token)",
+  match: { events: ["PreToolUse"] },
+  fn: async (ctx) => {
+    if (ctx.toolName !== "Bash") return allow();
+    const cmd = String(ctx.toolInput?.command ?? "");
+    if (cmd.includes("CANARY_PROBE")) return deny("canary-bash probe intercepted");
+    return allow();
+  },
+});
+// File-path path: deny reading the benign marker file (via Read tool OR `cat`).
+customPolicies.add({
+  name: "canary-read",
+  description: "Canary: deny reading the benign probe marker file (CANARY_MARKER)",
+  match: { events: ["PreToolUse"] },
+  fn: async (ctx) => {
+    const path = String(ctx.toolInput?.file_path ?? "");
+    const cmd = String(ctx.toolInput?.command ?? "");
+    if (path.includes("CANARY_MARKER") || cmd.includes("CANARY_MARKER")) {
+      return deny("canary-read probe intercepted");
+    }
+    return allow();
+  },
+});

package/.next/standalone/ci/cli-integration/capture-tokens.sh ADDED Viewed

@@ -0,0 +1,48 @@
+#!/usr/bin/env bash
+# ─────────────────────────────────────────────────────────────────────────────
+# capture-tokens.sh — run on the OFFICE BOX (has the logged-in canary volume).
+#   ./capture-tokens.sh <owner/repo>
+#
+# Captures each OAuth CLI's credential tree from the persistent HOME volume as a
+# base64 gzip-tar rooted at $HOME, and stores it as a GitHub Actions secret on
+# the canary repo. The CI workflow decodes it back onto the ephemeral runner's
+# volume (see sandbox/inject-tokens.sh), so cursor/devin/antigravity authenticate
+# in CI without an interactive login.
+#
+# Re-run this whenever the canary reports ERROR (not-logged-in / 401) for one of
+# these CLIs — i.e. after you re-login on the box — to refresh the secret.
+#
+# NB: these are real credentials for internal@exosphere.host. They live only in
+# GitHub *encrypted secrets*, never in the repo tree.
+# ─────────────────────────────────────────────────────────────────────────────
+set -euo pipefail
+REPO="${1:?usage: capture-tokens.sh <owner/repo>}"
+VOL="${CANARY_VOL:-failproofai-canary-home}"
+IMAGE="${CANARY_IMAGE:-failproofai-canary:base}"
+# secret-name   →   $HOME-relative path(s) to tar from the volume
+capture() {
+  local secret="$1"; shift
+  local paths=("$@")
+  echo "── $secret  ($(printf '%s ' "${paths[@]}"))"
+  # Tar the paths (rooted at $HOME) inside the container, gzip, base64 → host.
+  local b64
+  b64="$(docker run --rm -v "$VOL:/home/canary" "$IMAGE" bash -c "
+    cd \$HOME || exit 1
+    miss=1
+    for p in ${paths[*]}; do [ -e \"\$p\" ] && miss=0; done
+    [ \$miss = 1 ] && { echo 'MISSING' >&2; exit 3; }
+    tar -czf - ${paths[*]} 2>/dev/null | base64 -w0
+  ")" || { echo "    ⚠️  none of the paths exist in the volume — skipping (login first)"; return 0; }
+  if [ -z "$b64" ]; then echo "    ⚠️  empty capture — skipping"; return 0; fi
+  printf '%s' "$b64" | gh secret set "$secret" --repo "$REPO" --body -
+  echo "    ✓ set $secret (${#b64} b64 chars)"
+}
+echo "Capturing OAuth credential trees from volume '$VOL' → secrets on $REPO"
+capture CURSOR_TOKEN_TGZ_B64       .config/cursor
+capture DEVIN_TOKEN_TGZ_B64        .local/share/devin/credentials.toml
+# antigravity: capture ONLY the small OAuth token file — the full ~/.gemini tree
+# is ~15 MB (CLI binary + brain/ + logs), far over GitHub's 48 KB secret cap.
+capture ANTIGRAVITY_TOKEN_TGZ_B64  .gemini/antigravity-cli/antigravity-oauth-token
+echo "done."

package/.next/standalone/ci/cli-integration/inject-tokens.sh ADDED Viewed

@@ -0,0 +1,44 @@
+#!/usr/bin/env bash
+# ─────────────────────────────────────────────────────────────────────────────
+# Token injection — runs INSIDE the sandbox container, against the fresh per-run
+# HOME volume, BEFORE the probes.
+#
+# On the office box the OAuth logins (cursor / devin / antigravity) live in a
+# PERSISTENT volume. GitHub-Actions runners are ephemeral, so instead each of
+# those credential trees is captured once (see capture-tokens.sh) into a GitHub
+# secret as a base64 gzip-tar rooted at $HOME, decoded by the workflow into
+# /opt/tokens/<name>.tgz, and extracted here into the fresh volume's $HOME.
+#
+# Extraction is rooted at $HOME and the tarballs were created with $HOME-relative
+# paths (e.g. `.config/cursor`, `.local/share/devin/credentials.toml`), so each
+# file lands exactly where its CLI expects it. Env-var-auth CLIs (gateway key,
+# copilot PAT, factory BYOK) need NO file here — they authenticate from env.
+# ─────────────────────────────────────────────────────────────────────────────
+set -u
+TOK="${1:-/opt/tokens}"
+if [ ! -d "$TOK" ]; then
+  echo "inject-tokens: no token dir at $TOK — nothing to inject (env-var CLIs only)"
+  exit 0
+fi
+shopt -s nullglob
+found=0
+for t in "$TOK"/*.tgz "$TOK"/*.tar.gz; do
+  found=1
+  echo "── injecting $(basename "$t") → \$HOME ──"
+  if tar -C "$HOME" -xzf "$t"; then
+    tar -tzf "$t" 2>/dev/null | sed 's/^/    /' | head -8
+  else
+    echo "    WARN: extract failed for $t (skipping — that CLI will report ERROR)"
+  fi
+done
+[ "$found" = 0 ] && echo "inject-tokens: token dir present but empty — env-var CLIs only"
+echo "── credential files now present in volume ──"
+for f in "$HOME/.config/cursor/auth.json" \
+         "$HOME/.local/share/devin/credentials.toml" \
+         "$HOME/.gemini/antigravity-cli"; do
+  [ -e "$f" ] && echo "  ✓ $f" || echo "  ✗ $f (absent)"
+done
+exit 0

package/.next/standalone/ci/cli-integration/install-clis.sh ADDED Viewed

@@ -0,0 +1,91 @@
+#!/usr/bin/env bash
+# ─────────────────────────────────────────────────────────────────────────────
+# Tier-0 install probe — runs INSIDE the canary sandbox container.
+#
+# Installs/upgrades all 12 agent CLIs to @latest into the persistent HOME volume,
+# then records which resolve to a runnable binary + their version. This is both
+# the daily "fresh upgrade" step AND the Tier-0 canary signal (packaging/binary
+# breaks show up here as a FAIL).
+#
+# Install methods verified 2026-07-16 (see failproofai-cli-canary-design.md).
+# Vendor installers scatter binaries across several dirs, so we search an
+# expanded PATH and fall back to a bounded `find` under $HOME.
+#
+# Output: a JSON array at $CANARY_RESULTS (default ~/canary-tier0.json) + a
+# human table on stdout. Never `set -e` — one CLI failing must not abort the rest.
+# ─────────────────────────────────────────────────────────────────────────────
+set -u
+RESULTS="${CANARY_RESULTS:-$HOME/canary-tier0.json}"
+LOGDIR="${CANARY_LOGDIR:-$HOME/canary-logs}"
+mkdir -p "$LOGDIR"
+# Cover every dir the vendor installers are known to drop binaries into.
+export PATH="$HOME/.npm-global/bin:$HOME/.local/bin:$HOME/.factory/bin:$HOME/.hermes/bin:$HOME/.cursor/bin:$HOME/.codex/bin:$HOME/bin:$PATH"
+ROWS=()
+probe() {
+  local id="$1" bin="$2" vflag="$3" install="$4"
+  echo "════════════════════ $id ════════════════════"
+  local t0 t1 rc=1; t0=$SECONDS
+  # Retry transient install failures. Flaky vendor CDNs / HTTP-2 stream resets are
+  # common on ephemeral CI runners (e.g. factory's `curl … | sh` dropping the
+  # download mid-stream with `curl: (18)`). Break as soon as the binary resolves;
+  # otherwise give it up to 3 attempts so one bad download isn't a false FAIL.
+  for attempt in 1 2 3; do
+    bash -c "$install" >"$LOGDIR/$id.install.log" 2>&1
+    rc=$?
+    hash -r 2>/dev/null
+    command -v "$bin" >/dev/null 2>&1 && break
+    find "$HOME" -maxdepth 5 -name "$bin" -type f -perm -u+x 2>/dev/null | grep -q . && break
+    [ "$attempt" -lt 3 ] && { echo "  ↻ $id install attempt $attempt failed (rc=$rc) — retrying in 5s"; sleep 5; }
+  done
+  t1=$SECONDS
+  hash -r 2>/dev/null
+  # Resolve the binary: PATH first, then a bounded find under $HOME.
+  local resolved; resolved="$(command -v "$bin" 2>/dev/null || true)"
+  if [ -z "$resolved" ]; then
+    resolved="$(find "$HOME" -maxdepth 5 -name "$bin" -type f -perm -u+x 2>/dev/null | head -1)"
+  fi
+  local ver="" status="FAIL"
+  if [ -n "$resolved" ]; then
+    status="OK"
+    ver="$("$resolved" $vflag 2>&1 | head -1 | tr -cd '[:alnum:] ._+:/-')"
+  fi
+  printf '  rc=%s  time=%ss  bin=%s  ver=%s  => %s\n' \
+    "$rc" "$((t1 - t0))" "${resolved:-<none>}" "${ver:-<none>}" "$status"
+  [ "$status" = FAIL ] && echo "  ↳ last install log lines:" && tail -3 "$LOGDIR/$id.install.log" | sed 's/^/    /'
+  ROWS+=("$(printf '{"cli":"%s","status":"%s","binary":"%s","version":"%s","install_rc":%s,"secs":%s}' \
+    "$id" "$status" "${resolved:-}" "${ver:-}" "$rc" "$((t1 - t0))")")
+}
+#      id           binary         --ver flag    install command (@latest)
+probe  claude       claude         "--version"   'curl -fsSL https://claude.ai/install.sh | bash'
+probe  codex        codex          "--version"   'npm install -g @openai/codex@latest'
+probe  copilot      copilot        "--version"   'npm install -g @github/copilot@latest'
+probe  cursor       cursor-agent   "--version"   'curl https://cursor.com/install -fsS | bash'
+probe  opencode     opencode       "--version"   'npm install -g opencode-ai@latest'
+probe  pi           pi             "--version"   'npm install -g @mariozechner/pi-coding-agent@latest'
+probe  hermes       hermes         "--version"   'curl -fsSL https://hermes-agent.nousresearch.com/install.sh | bash'
+probe  openclaw     openclaw       "--version"   'npm install -g openclaw@latest'
+probe  factory      droid          "--version"   'curl -fsSL https://app.factory.ai/cli | sh'
+probe  devin        devin          "--version"   'curl -fsSL https://cli.devin.ai/install.sh | bash'
+probe  antigravity  agy            "--version"   'curl -fsSL https://antigravity.google/cli/install.sh | bash'
+probe  goose        goose          "--version"   'curl -fsSL https://github.com/aaif-goose/goose/releases/download/stable/download_cli.sh | CONFIGURE=false bash'
+# Emit JSON array.
+{ printf '['; IFS=,; printf '%s' "${ROWS[*]}"; printf ']\n'; } > "$RESULTS"
+echo
+echo "════════════════════ TIER-0 SUMMARY ════════════════════"
+ok=0; fail=0
+for r in "${ROWS[@]}"; do
+  case "$r" in *'"status":"OK"'*) ok=$((ok+1));; *) fail=$((fail+1));; esac
+done
+printf 'installed OK: %s / 12   failed: %s\n' "$ok" "$fail"
+echo "results JSON: $RESULTS"