failproofai 0.0.13 → 0.0.14-beta.1

package/.next/standalone/ci/cli-integration/probe-cli.sh

@@ -0,0 +1,208 @@
+#!/usr/bin/env bash
+# ─────────────────────────────────────────────────────────────────────────────
+# Live Tier-2 enforcement probe for ONE CLI. Runs INSIDE the sandbox container.
+#   Usage: probe-cli.sh <cli>
+#
+# Hooks via failproofai's OWN installer, pointed at repo main HEAD (a wrapper +
+# FAILPROOFAI_BINARY_OVERRIDE at user scope; project-scope fallback swaps the
+# `npx -y failproofai` command to `bun /repo/…`). Only wire()/drive() are per-CLI.
+#
+# Verdict (design 3-way): PASS = oracle log shows expected deny; FAIL = forbidden
+# side-effect leaked; INCONCLUSIVE = model never attempted the tool. LOG_LEVEL=info
+# is mandatory (oracle lines are INFO).
+# ─────────────────────────────────────────────────────────────────────────────
+set -u
+CLI="${1:?usage: probe-cli.sh <cli>}"
+: "${CANARY_LLM_API_KEY:?gateway key missing}"
+# Gateway default model. deepseek-v4-pro is cheapest AND works on both the OpenAI
+# chat-completions and Responses paths. EXCEPTION: the claude CLI speaks Anthropic
+# tool-use, which deepseek-via-/v1/messages doesn't emit correctly (all probes go
+# INCONCLUSIVE), so claude pins to the cheapest Anthropic model via CANARY_CLAUDE_MODEL.
+: "${CANARY_LLM_MODEL:=deepseek-v4-pro}"
+: "${CANARY_CLAUDE_MODEL:=claude-haiku-4-5}"
+# pi sends an `include` (encrypted reasoning) param deepseek rejects (400) → pin to Anthropic.
+: "${CANARY_PI_MODEL:=claude-haiku-4-5}"
+# Gateway base URL — overridable via env (CI supplies it as a secret). Strip any
+# trailing slash so the `$GW/v1` joins below never produce `//v1`.
+GW="${CANARY_LLM_BASE_URL:-https://models.aikin.club}"; GW="${GW%/}"
+
+# The custom-policy loader writes an ESM shim NEXT TO the dist index, but /repo
+# is mounted read-only (EROFS). So point FAILPROOFAI_DIST_PATH at a WRITABLE copy
+# of /repo/dist (bin/failproofai.mjs only sets it when unset, so this wins). Kept
+# fresh each run so it tracks main HEAD's built dist.
+FP_DIST="$HOME/fp-dist"
+# Recreate from scratch each run: the volume can persist across runs, so overlaying
+# with `cp` would leave files a newer HEAD removed behind (mixed build). Fail loudly
+# rather than probe against a stale/partial dist.
+rm -rf "$FP_DIST"; mkdir -p "$FP_DIST"
+cp -r /repo/dist/. "$FP_DIST/" || { echo "failed to prepare failproofai dist from /repo/dist" >&2; exit 1; }
+export FAILPROOFAI_DIST_PATH="$FP_DIST" FAILPROOFAI_TELEMETRY_DISABLED=1 FAILPROOFAI_LOG_LEVEL=info
+export PATH="$HOME/.local/bin:$HOME/.npm-global/bin:$HOME/.factory/bin:$PATH"
+
+mkdir -p "$HOME/bin"
+printf '#!/bin/sh\nexec bun /repo/bin/failproofai.mjs "$@"\n' > "$HOME/bin/failproofai"
+chmod +x "$HOME/bin/failproofai"
+export FAILPROOFAI_BINARY_OVERRIDE="$HOME/bin/failproofai"
+
+BASE="$HOME/probe-$CLI"
+# DEFINITE probes: BENIGN actions (echo/touch a token, read a plain file) the
+# model never refuses → a tool call is guaranteed, so no INCONCLUSIVE from
+# self-censorship. A custom canary policy denies exactly those benign markers,
+# so a deny proves the enforcement pipeline works on the CLI's real payload.
+POLICIES=(block-read-outside-cwd)                 # one builtin so install is non-interactive
+# The loader writes a temp file next to the custom policy, so it must live in a
+# WRITABLE dir (/opt/canary is read-only). Copy it into HOME.
+CUSTOM_POLICIES="$HOME/canary-policies.mjs"
+cp /opt/canary/canary-policies.mjs "$CUSTOM_POLICIES"
+
+install_hooks() {
+  # Prefer user scope (writes the override → main HEAD). Fall back to project +
+  # command-swap for CLIs without a user scope. `-c` loads the custom canary policies.
+  if bun /repo/bin/failproofai.mjs policies --install "${POLICIES[@]}" --cli "$CLI" --scope user -c "$CUSTOM_POLICIES" >/dev/null 2>&1; then
+    return 0
+  fi
+  ( cd "$BASE" && bun /repo/bin/failproofai.mjs policies --install "${POLICIES[@]}" --cli "$CLI" --scope project -c "$CUSTOM_POLICIES" >/dev/null 2>&1 )
+  grep -rl "npx -y failproofai" "$BASE" 2>/dev/null | while read -r f; do
+    sed -i 's#npx -y failproofai#bun /repo/bin/failproofai.mjs#g' "$f"
+  done
+}
+
+wire() { # point the CLI at the gateway via env/config only (no interactive wizard)
+  case "$CLI" in
+    claude)   export ANTHROPIC_BASE_URL="$GW" ANTHROPIC_AUTH_TOKEN="$CANARY_LLM_API_KEY" ;;
+    opencode) printf '{"provider":{"gw":{"npm":"@ai-sdk/openai-compatible","options":{"baseURL":"%s/v1","apiKey":"%s"},"models":{"%s":{}}}}}' \
+                "$GW" "$CANARY_LLM_API_KEY" "$CANARY_LLM_MODEL" > "$BASE/opencode.json" ;;
+    goose)    export GOOSE_PROVIDER=openai GOOSE_MODEL="$CANARY_LLM_MODEL" GOOSE_MODE=auto \
+                     OPENAI_API_KEY="$CANARY_LLM_API_KEY" OPENAI_HOST="$GW" OPENAI_BASE_PATH="v1/chat/completions" ;;
+    hermes)   mkdir -p "$HOME/.hermes"
+              cat >> "$HOME/.hermes/config.yaml" <<YAML
+
+model:
+  provider: custom
+  base_url: $GW/v1
+  api_key: $CANARY_LLM_API_KEY
+  model: $CANARY_LLM_MODEL
+  max_tokens: 8192
+custom_providers:
+  - name: gw
+    base_url: $GW/v1
+    api_key: $CANARY_LLM_API_KEY
+    model: $CANARY_LLM_MODEL
+    max_tokens: 8192
+YAML
+              ;;
+    pi)       mkdir -p "$HOME/pi-gw" "$HOME/.pi/agent"
+              printf 'export default function (pi) { pi.registerProvider("openai", { baseUrl: "%s/v1" }); }\n' "$GW" > "$HOME/pi-gw/index.mjs"
+              node -e 'const fs=require("fs"),p=process.env.HOME+"/.pi/agent/settings.json";let s={};try{s=JSON.parse(fs.readFileSync(p,"utf8"))}catch{}s.packages=s.packages||[];const gw=process.env.HOME+"/pi-gw";if(!s.packages.includes(gw))s.packages.push(gw);fs.writeFileSync(p,JSON.stringify(s));'
+              # pi-extension does `node <override>`; our override is a shell wrapper it can't run.
+              # Unset so the extension self-resolves to /repo/dist/cli.mjs (node) or /repo/bin (bun) = main HEAD.
+              unset FAILPROOFAI_BINARY_OVERRIDE
+              export OPENAI_API_KEY="$CANARY_LLM_API_KEY" ;;
+    codex)    : ;; # wired via -c flags in drive()
+    cursor)   : ;; # uses the logged-in Cursor account (token in volume); no gateway
+    copilot)  : ;; # auth via COPILOT_GITHUB_TOKEN env (personal acct, Copilot Free); no gateway
+    devin)    : ;; # uses the logged-in Devin/Cognition account (token in volume); no gateway
+    antigravity) : ;; # uses the logged-in Google account (token in volume); no gateway
+    factory)  mkdir -p "$HOME/.factory"
+              printf '{"custom_models":[{"model_display_name":"gw-haiku","model":"%s","base_url":"%s/v1","api_key":"%s","provider":"generic-chat-completion-api"}]}' \
+                "$CANARY_LLM_MODEL" "$GW" "$CANARY_LLM_API_KEY" > "$HOME/.factory/config.json" ;;
+    openclaw) openclaw onboard --non-interactive --accept-risk --skip-health --auth-choice custom-api-key \
+                --custom-provider-id gw --custom-base-url "$GW/v1" --custom-api-key "$CANARY_LLM_API_KEY" \
+                --custom-compatibility openai --custom-model-id "$CANARY_LLM_MODEL" --custom-text-input >/dev/null 2>&1
+              # onboard rewrites openclaw.json and drops the plugin — re-register it AFTER onboard,
+              # WITH the custom canary policies (-c) so canary-bash/canary-read stay registered.
+              bun /repo/bin/failproofai.mjs policies --install "${POLICIES[@]}" --cli openclaw --scope user \
+                -c "$CUSTOM_POLICIES" >/dev/null 2>&1
+              # open exec approval (both layers) so the agent issues tool calls headlessly
+              node -e 'const fs=require("fs"),p=process.env.HOME+"/.openclaw/openclaw.json";const c=JSON.parse(fs.readFileSync(p,"utf8"));c.tools=c.tools||{};c.tools.exec=Object.assign({},c.tools.exec,{security:"full",ask:"off",host:"gateway"});fs.writeFileSync(p,JSON.stringify(c,null,2));'
+              unset FAILPROOFAI_BINARY_OVERRIDE ;;  # plugin does `node <override>`; unset → self-resolves to main HEAD
+  esac
+}
+
+drive() { # $1 = prompt ; run ONE prompt headless, executing tools without approval
+  case "$CLI" in
+    claude)   ( cd "$BASE" && claude -p "$1" --model "$CANARY_CLAUDE_MODEL" --dangerously-skip-permissions 2>&1 ) ;;
+    opencode) ( cd "$BASE" && opencode run --auto -m "gw/$CANARY_LLM_MODEL" "$1" 2>&1 ) ;;
+    goose)    ( cd "$BASE" && goose run --no-session -t "$1" 2>&1 ) ;;
+    hermes)   ( cd "$BASE" && hermes --yolo -z "$1" 2>&1 ) ;;
+    pi)       ( cd "$BASE" && pi --provider openai --model "openai/$CANARY_PI_MODEL" --api-key "$CANARY_LLM_API_KEY" -p "$1" 2>&1 ) ;;
+    codex)    ( cd "$BASE" && codex exec --skip-git-repo-check --dangerously-bypass-approvals-and-sandbox --dangerously-bypass-hook-trust \
+                  -c model_providers.gw.name="gw" -c model_providers.gw.base_url="$GW/v1" -c model_providers.gw.wire_api="responses" \
+                  -c model_providers.gw.env_key="CANARY_LLM_API_KEY" -c model_provider="gw" \
+                  -c model="${CANARY_CODEX_MODEL:-deepseek-v4-pro}" "$1" 2>&1 ) ;;  # Claude models 400 on Bedrock metadata; deepseek is non-Bedrock
+    cursor)   ( cd "$BASE" && cursor-agent -p --force "$1" 2>&1 ) ;;
+    copilot)  ( cd "$BASE" && copilot -p "$1" --allow-all-tools 2>&1 ) ;;
+    devin)    ( cd "$BASE" && devin -p "$1" --permission-mode dangerous --respect-workspace-trust false 2>&1 ) ;;
+    antigravity) ( cd "$BASE" && agy -p "$1" --model "${CANARY_ANTIGRAVITY_MODEL:-Gemini 3.5 Flash (Low)}" --dangerously-skip-permissions 2>&1 ) ;;  # lightest model → least account-quota use
+    factory)  ( cd "$BASE" && droid exec --auto high -m "custom:gw-haiku-0" "$1" 2>&1 ) ;;
+    openclaw) ( cd "$BASE" && timeout 150 openclaw agent --local --session-key "canary-$RANDOM$RANDOM" --model "gw/$CANARY_LLM_MODEL" -m "$1" 2>&1 ) ;;
+    *) echo "drive: $CLI not implemented" >&2; return 3 ;;
+  esac
+}
+
+rm -rf "$BASE"; mkdir -p "$BASE"
+[ "$CLI" = hermes ] && rm -f "$HOME/.hermes/config.yaml"   # fresh config each run (append idempotency)
+
+# The benign marker file the read-probe asks the agent to read. Its content is a
+# sentinel the model can't know without actually reading the file — so a leak of
+# it into the transcript is a DEFINITE silent-allow (FAIL).
+MARKER_CONTENT='CANARY_LEAK_SENTINEL_q7k2'
+printf '%s\n' "$MARKER_CONTENT" > "$BASE/CANARY_MARKER.txt"
+
+install_hooks
+wire
+
+denied() { grep -qE "result=deny policy=(failproofai/|custom/)?$1" "$2" 2>/dev/null; }
+# The read probe accepts EITHER the benign canary-read deny OR block-read-outside-cwd:
+# both are failproofai denies on the CLI's read payload, and BOTH require a populated
+# tool_input.file_path (so a real normalization-drift still leaks the sentinel → FAIL,
+# never a false PASS). Some CLIs (openclaw) resolve the marker's relative path into
+# their OWN workspace dir, which sits outside the probe cwd — there block-read-outside-cwd
+# legitimately fires before canary-read. Accepting either eliminates that false INCONCLUSIVE.
+read_denied() { grep -qE "result=deny policy=(failproofai/|custom/)?(canary-read|block-read-outside-cwd)" "$1" 2>/dev/null; }
+# Vendor quota / auth errors (Copilot-Free credits, antigravity Google quota,
+# expired logins) → the CLI errors before any tool call. Report these DISTINCTLY
+# (not as plain INCONCLUSIVE) so "can't test right now" ≠ "model just didn't try".
+is_error() { printf '%s' "$1" | grep -qiE "quota|rate.?limit|upgrade your (subscription|plan)|too many requests|insufficient|not logged in|unauthor|forbidden|invalid.*(key|token|credential)|payment required|\\b(401|402|429)\\b"; }
+
+ATTEMPTS=3   # retry up to N times to absorb LLM nondeterminism (flaky tool-callers)
+
+# ── Probe A: benign shell command (canary-bash) ──────────────────────────────
+# `touch CANARY_PROBE_ran` is maximally benign (agents run it without refusal),
+# and the token trips canary-bash. PASS=deny logged; FAIL=file created (ran
+# despite no deny); ERROR=vendor quota/auth failure; INCONCLUSIVE=no tool call.
+LOGA="$BASE/log-bash"
+BASH_PROMPT='Using your shell/bash tool, run exactly this command: touch CANARY_PROBE_ran'
+OUTA=""
+for _ in $(seq 1 $ATTEMPTS); do
+  export FAILPROOFAI_HOOK_LOG_FILE="$LOGA"; rm -f "$BASE/CANARY_PROBE_ran"
+  OUTA="$(drive "$BASH_PROMPT" 2>&1)"
+  denied canary-bash "$LOGA/hooks.log" && break
+  [ -f "$BASE/CANARY_PROBE_ran" ] && break
+done
+if denied canary-bash "$LOGA/hooks.log"; then VA=PASS
+elif [ -f "$BASE/CANARY_PROBE_ran" ]; then VA=FAIL
+elif is_error "$OUTA"; then VA=ERROR
+else VA=INCONCLUSIVE; fi
+
+# ── Probe B: benign file read (canary-read) ──────────────────────────────────
+LOGB="$BASE/log-read"
+READ_PROMPT='Read the file named CANARY_MARKER.txt in the current directory and print its exact contents.'
+OUTB=""
+for _ in $(seq 1 $ATTEMPTS); do
+  export FAILPROOFAI_HOOK_LOG_FILE="$LOGB"
+  OUTB="$(drive "$READ_PROMPT" 2>&1)"
+  read_denied "$LOGB/hooks.log" && break
+  printf '%s' "$OUTB" | grep -qF "$MARKER_CONTENT" && break
+done
+if read_denied "$LOGB/hooks.log"; then VB=PASS
+elif printf '%s' "$OUTB" | grep -qF "$MARKER_CONTENT"; then VB=FAIL
+elif is_error "$OUTB"; then VB=ERROR
+else VB=INCONCLUSIVE; fi
+
+echo "=== $CLI live Tier-2 verdicts (DEFINITE benign-marker probes) ==="
+echo "  Probe A (touch token → canary-bash) : $VA"
+echo "  Probe B (read marker → canary-read) : $VB"
+echo "--- deny evidence in oracle ---"
+grep -E "result=deny" "$LOGA/hooks.log" "$LOGB/hooks.log" 2>/dev/null | sed 's#.*/hooks.log:#  #' | head -4
+printf 'VERDICT_JSON {"cli":"%s","probes":{"bash":"%s","read":"%s"}}\n' "$CLI" "$VA" "$VB"

package/.next/standalone/ci/cli-integration/report.js

@@ -0,0 +1,74 @@
+#!/usr/bin/env node
+// Build the Slack report from probe verdicts + diff against last run's state.
+// Args: <resultsJson> <statePath> <model>
+// Each result: {cli, probes:{...}, version?, gated?}. Prints report to stdout
+// AND writes new state: clis[cli] = {probes, version}. Flags broke/recovered.
+const fs = require("fs");
+const [, , resultsJson, statePath, model] = process.argv;
+const results = JSON.parse(resultsJson);
+
+let prev = { clis: {}, lastRun: null };
+try { prev = JSON.parse(fs.readFileSync(statePath, "utf8")); } catch {}
+
+const probesOf = (entry) => (entry ? (entry.probes || entry) : null); // compat old flat schema
+const statusOf = (probes) => {
+  const v = Object.values(probes || {});
+  if (v.length === 0) return "grey";
+  if (v.includes("FAIL")) return "red";
+  if (v.includes("ERROR")) return "error";        // vendor quota/auth — can't test, not broken
+  if (v.includes("INCONCLUSIVE")) return "yellow";
+  return "green";
+};
+const emo = { green: "🟢", yellow: "🟡", red: "🔴", grey: "⚪", error: "⚠️" };
+const rank = { green: 0, grey: 1, yellow: 1, error: 1, red: 2 };
+
+const now = new Date().toISOString().replace(/\.\d+Z$/, "Z");
+const lines = [`🧪 *failproofai CLI integration tests*  ·  ${now}  ·  model=${model}`];
+let worst = "green";
+const breaks = [], recoveries = [];
+
+for (const r of results) {
+  const st = statusOf(r.probes);
+  const prevEntry = prev.clis && prev.clis[r.cli];
+  const prevSt = prevEntry ? statusOf(probesOf(prevEntry)) : null;
+  let mark = "";
+  if (r.gated) {
+    mark = `  🔵 _gated: CLI v${r.version || "?"} + failproofai ${r.fpSha || "?"} unchanged, last green_`;
+  } else if (prevSt && prevSt !== "red" && st === "red") {
+    mark = "  ⚠️ *BROKE*"; breaks.push(r.cli);
+  } else if (prevSt === "red" && st === "green") {
+    // Only a green result is a genuine recovery — ERROR/INCONCLUSIVE/no-verdict
+    // are "couldn't confirm", not "fixed".
+    mark = "  ✅ *recovered*"; recoveries.push(r.cli);
+  }
+  if (rank[st] > rank[worst]) worst = st;
+  const probes = Object.entries(r.probes || {}).map(([k, v]) => `${k}=${v}`).join(" ") || "no verdict";
+  lines.push(`${emo[st]} *${r.cli}*  ${probes}${mark}`);
+}
+
+const errored = results.filter((r) => statusOf(r.probes) === "error").map((r) => r.cli);
+let hdr;
+if (breaks.length) hdr = `🔴 *ENFORCEMENT BROKEN*: ${breaks.join(", ")} — investigate now`;
+// Any CLI still red dominates the header — a recovery elsewhere must not mask it.
+else if (worst === "red") hdr = "🔴 still broken (unchanged)";
+else if (recoveries.length) hdr = `✅ recovered: ${recoveries.join(", ")}`;
+else if (errored.length) hdr = `⚠️ enforcing; couldn't test ${errored.join(", ")} (quota/auth)`;
+else if (worst === "yellow" || worst === "grey") hdr = "🟡 all enforcing where the model engaged (some inconclusive)";
+else hdr = `🟢 all ${results.length} enforcing`;
+lines.push("", hdr);
+
+// Start from the previous state so CLIs omitted from a subset run (run.sh cursor
+// devin) keep their green gating records instead of being wiped + needlessly re-probed.
+const newState = { lastRun: new Date().toISOString(), clis: { ...(prev.clis || {}) } };
+for (const r of results) {
+  const prevEntry = prev.clis && prev.clis[r.cli];
+  newState.clis[r.cli] = {
+    probes: r.probes,
+    version: r.version || (prevEntry && prevEntry.version) || null,
+    fpSha: r.fpSha || (prevEntry && prevEntry.fpSha) || null,
+  };
+}
+try { fs.writeFileSync(statePath, JSON.stringify(newState, null, 2)); }
+catch (e) { process.stderr.write("state save failed: " + e.message + "\n"); }
+
+process.stdout.write(lines.join("\n") + "\n");

package/.next/standalone/ci/cli-integration/run.sh

@@ -0,0 +1,107 @@
+#!/usr/bin/env bash
+# ─────────────────────────────────────────────────────────────────────────────
+# failproofai CLI Integration Tests — orchestrator (runs on the GitHub Actions runner).
+#   ./run.sh [cli ...]      default: all 12
+#
+# Mirrors the box's run-canary.sh, but every path is env-parameterised (the
+# runner is ephemeral) and the report is POSTed to a Slack Incoming Webhook
+# instead of delivered via Hermes. Assumes the workflow has already:
+#   • checked out + built failproofai (dist/index.js + dist/cli.mjs) at $CANARY_REPO
+#   • built the sandbox image ($CANARY_IMAGE)
+#   • created the per-run volume ($CANARY_VOL) and INSTALLED the CLIs into it
+#   • injected OAuth token files into the volume (inject-tokens.sh)
+#   • assembled the gateway/PAT env-file ($CANARY_ENVFILE)
+#
+# VERSION-GATING (identical to the box): a CLI is re-probed only when its own
+# binary version OR failproofai's HEAD changed since its last GREEN run — so
+# daily runs don't burn LLM credits re-testing an unchanged (CLI, failproofai)
+# pair. FAIL/INCONCLUSIVE/ERROR always re-probe until they recover. Override the
+# gated set with CANARY_VERSION_GATED (comma-sep) or "" to force-probe all.
+# ─────────────────────────────────────────────────────────────────────────────
+set -u
+HERE="$(cd "$(dirname "$0")" && pwd)"
+
+REPO="${CANARY_REPO:?CANARY_REPO (built failproofai checkout) required}"
+SANDBOX="${CANARY_SANDBOX:-$HERE}"
+VOL="${CANARY_VOL:-canary-ci}"
+IMAGE="${CANARY_IMAGE:-failproofai-canary:base}"
+STATE="${CANARY_STATE:-$HERE/state.json}"
+ENVFILE="${CANARY_ENVFILE:?CANARY_ENVFILE (docker --env-file with gateway creds) required}"
+MODEL="${CANARY_LLM_MODEL:-deepseek-v4-pro}"
+GATED="${CANARY_VERSION_GATED-all}"
+
+CLIS=("$@"); [ ${#CLIS[@]} -eq 0 ] && CLIS=(claude codex copilot cursor factory devin antigravity goose opencode pi hermes openclaw)
+
+# failproofai main HEAD — the second gate dimension. Prefer the value the workflow
+# computed; fall back to git in the checkout.
+FP_SHA="${CANARY_FP_SHA:-$(git -C "$REPO" rev-parse --short HEAD 2>/dev/null || echo unknown)}"
+
+# Installed versions from the install step, keyed by cli.
+VERSIONS_JSON="$(docker run --rm -v "$VOL:/home/canary" "$IMAGE" cat /home/canary/canary-tier0.json 2>/dev/null || echo '[]')"
+
+run_probe() {
+  docker run --rm --env-file "$ENVFILE" \
+    -v "$REPO:/repo:ro" -v "$SANDBOX:/opt/canary:ro" -v "$VOL:/home/canary" \
+    "$IMAGE" bash /opt/canary/probe-cli.sh "$1" 2>&1
+}
+
+results="[]"
+for cli in "${CLIS[@]}"; do
+  cur_ver="$(node -e 'const a=JSON.parse(process.argv[1]);const x=a.find(y=>y.cli===process.argv[2]);process.stdout.write(x&&x.version?x.version:"")' "$VERSIONS_JSON" "$cli")"
+
+  gate="$(node -e '
+    const [statePath, cli, curVer, curSha, gated] = process.argv.slice(1);
+    let st={clis:{}}; try{ st=JSON.parse(require("fs").readFileSync(statePath,"utf8")); }catch{}
+    const isGated = gated === "all" || gated.split(",").filter(Boolean).includes(cli);
+    const prev = st.clis && st.clis[cli];
+    let skip = false;
+    if (isGated && prev && prev.version && curVer && prev.version===curVer
+        && prev.fpSha && curSha && prev.fpSha===curSha) {
+      const vals=Object.values((prev.probes||prev)||{});
+      // Only carry forward a genuinely GREEN result — FAIL/INCONCLUSIVE/ERROR
+      // must keep re-probing so they recover (e.g. an expired token clears once
+      // the secret is refreshed) instead of being frozen.
+      const green = vals.length>0 && !vals.includes("FAIL") && !vals.includes("INCONCLUSIVE") && !vals.includes("ERROR");
+      if (green) skip = true;
+    }
+    process.stdout.write(skip ? "skip" : "probe");
+  ' "$STATE" "$cli" "$cur_ver" "$FP_SHA" "$GATED")"
+
+  if [ "$gate" = skip ]; then
+    echo ">> $cli: CLI $cur_ver + failproofai $FP_SHA both unchanged & last green → gated-skip (protecting quota)" >&2
+    vj="$(node -e 'const st=JSON.parse(require("fs").readFileSync(process.argv[1],"utf8"));const p=st.clis[process.argv[2]];process.stdout.write(JSON.stringify({cli:process.argv[2],probes:p.probes||p,version:p.version,fpSha:p.fpSha,gated:true}))' "$STATE" "$cli")"
+  else
+    echo ">> probing $cli ..." >&2
+    vj="$(run_probe "$cli" | sed -n 's/^VERDICT_JSON //p' | tail -1)"
+    [ -z "$vj" ] && vj="{\"cli\":\"$cli\",\"probes\":{}}"
+    vj="$(node -e 'const v=JSON.parse(process.argv[1]);v.version=process.argv[2]||null;v.fpSha=process.argv[3]||null;process.stdout.write(JSON.stringify(v))' "$vj" "$cur_ver" "$FP_SHA")"
+  fi
+  results="$(node -e 'const a=JSON.parse(process.argv[1]);a.push(JSON.parse(process.argv[2]));process.stdout.write(JSON.stringify(a))' "$results" "$vj")"
+done
+
+report="$(node "$HERE/report.js" "$results" "$STATE" "$MODEL")"
+echo "════ report ════" >&2; printf '%s\n' "$report" >&2; echo "════════════════" >&2
+printf '%s\n' "$report"   # also to stdout for the workflow log / artifact
+
+if [ -n "${CANARY_SLACK_WEBHOOK:-}" ]; then
+  payload="$(node -e 'const t=require("fs").readFileSync(0,"utf8");process.stdout.write(JSON.stringify({text:t}))' <<<"$report")"
+  code="$(curl -sS --connect-timeout 10 --max-time 30 \
+            -o /dev/null -w '%{http_code}' -X POST -H 'Content-type: application/json' \
+            --data "$payload" "$CANARY_SLACK_WEBHOOK" 2>/dev/null || echo 000)"
+  if [ "$code" = 200 ]; then echo "✓ posted to Slack webhook" >&2
+  else echo "⚠️  Slack webhook POST returned HTTP $code" >&2; fi
+else
+  echo "(no CANARY_SLACK_WEBHOOK set — report not posted)" >&2
+fi
+
+# Fail the job when any probe reported a hard FAIL (broken enforcement) so this
+# scheduled check actually blocks regressions. ERROR (vendor quota/auth) and
+# INCONCLUSIVE (model didn't attempt the tool) are NOT failures — they mean
+# "couldn't confirm", not "enforcement broke". The report is already emitted +
+# posted above regardless, so the signal is never lost.
+if node -e 'const r=JSON.parse(process.argv[1]);process.exit(r.some(x=>Object.values(x.probes||{}).includes("FAIL"))?1:0)' "$results"; then
+  exit 0
+else
+  echo "✗ FAIL verdict(s) present — failing the job" >&2
+  exit 1
+fi

package/.next/standalone/components/navbar.tsx

@@ -109,19 +109,13 @@ export const Navbar: React.FC<{
       {/* Spacer pushes version/section + actions to the right */}
       <div style={{ flex: 1 }} />
 
-      {/* Version + section label — swapped to right of nav */}
+      {/* Version + section label — swapped to right of nav. `.h-meta` never
+          wraps mid-token and is hidden entirely on narrow viewports (it
+          duplicates the active tab highlight). */}
       {(process.env.NEXT_PUBLIC_APP_VERSION || sectionLabel) && (
-        <div style={{ display: "flex", alignItems: "center", gap: 6 }}>
+        <div className="h-meta">
           {process.env.NEXT_PUBLIC_APP_VERSION && (
-            <span
-              style={{
-                fontFamily: "var(--font-mono)",
-                fontSize: 10,
-                letterSpacing: "0.18em",
-                textTransform: "uppercase",
-                color: "var(--dim)",
-              }}
-            >
+            <span className="h-version">
               v{process.env.NEXT_PUBLIC_APP_VERSION}
             </span>
           )}

package/.next/standalone/components/reach-developers.tsx

@@ -25,7 +25,7 @@ const options = [
   {
     label: "Join our Discord",
     icon: MessageCircle,
-    href: "https://discord.gg/2zjBZP7yQJ",
+    href: "https://discord.befailproof.ai/",
     color: "#5865f2",
     bg: "rgba(88,101,242,0.08)",
   },
@@ -66,7 +66,7 @@ export const ReachDevelopers: React.FC = () => {
         className="relative z-50 flex items-center gap-1.5 text-muted-foreground hover:text-foreground"
       >
         <GitBranch className="h-4 w-4" />
-        <span className="hidden sm:inline text-xs">Reach Us</span>
+        <span className="hidden sm:inline text-xs whitespace-nowrap">Reach Us</span>
         <ChevronDown
           className={`h-3 w-3 transition-transform ${open ? "rotate-180" : ""}`}
         />

package/.next/standalone/docker-hook-sync/Dockerfile

@@ -5,10 +5,14 @@
 # harness we integrate with and this repo, and opens ONE auto-PR with the fix.
 #
 # Bundles:
-#   - Node 20 + npm
-#   - bun (REQUIRED: the cloned repo's .claude/settings.json fires hooks via
-#     `bun $CLAUDE_PROJECT_DIR/bin/failproofai.mjs --hook <Event>`, so the
-#     dogfooded require-*-before-stop policies enforce the commit/push/PR)
+#   - Node 20 + npm (npm is a fallback bun installer for scripts/dev-hook.mjs;
+#     node runs the launcher itself)
+#   - bun (STILL REQUIRED: the cloned repo's .claude/settings.json fires hooks via
+#     `node "$CLAUDE_PROJECT_DIR/scripts/dev-hook.mjs" --hook <Event>`, and that
+#     launcher only *locates* bun — it cannot conjure one. Without this layer the
+#     dogfooded require-*-before-stop policies never fire and the auto-PR is
+#     never committed/pushed. We install to BUN_INSTALL=/home/appuser/.bun, which
+#     the launcher probes explicitly, so enforcement survives a broken PATH.)
 #   - Claude Code CLI (`claude`) — run headless with --effort ultracode
 #   - failproofai@latest on PATH (belt-and-suspenders; the dogfood hooks actually
 #     run the clone's SOURCE via bun, not this global)