failproofai 0.0.13 → 0.0.14-beta.1

package/.next/standalone/lib/goose-sessions.ts

@@ -0,0 +1,296 @@
+/**
+ * Goose (codename goose, Block) session transcript loader + parser.
+ *
+ * AUDIT-ONLY (Pillar 2). Goose (≥ v1.10.0) stores every session in one SQLite DB
+ * at `~/.local/share/goose/sessions/sessions.db`. We read it DIRECTLY via the
+ * bundled sql.js driver (lib/sqlite-reader.ts) — the same reusable path
+ * Devin/Hermes/OpenClaw use. Like Devin (and unlike the cwd-less Hermes gateway),
+ * each Goose `sessions` row carries a real `working_dir`, so Goose sessions group
+ * by project cwd like Claude/Factory/Devin.
+ *
+ * Schema (verified live against goose v1.43.0, schema_version 15):
+ *   sessions(id TEXT `YYYYMMDD_N`, name, description, session_type
+ *            (user|hidden|subagent|scheduled|terminal|acp), working_dir,
+ *            created_at TIMESTAMP, updated_at TIMESTAMP, total_tokens, …)
+ *   messages(id INTEGER PK, session_id, role (user|assistant),
+ *            content_json TEXT=JSON-array-of-blocks, created_timestamp INT, …)
+ *
+ * `content_json` is a Claude-style typed-block array (NOT OpenAI-style like
+ * Devin): `{type:"text",text}`, `{type:"toolRequest",id,toolCall:{value:{name,
+ * arguments}},_meta:{goose_extension}}`, and `{type:"toolResponse",id,toolResult:
+ * {value:{content:[{type:"text",text}],isError}}}`. Tool RESULTS are stored in
+ * `role:"user"` rows (Claude convention). `gooseRowsToLogEntries` pairs each
+ * toolRequest with its later toolResponse by id and is a PURE function of the
+ * parsed rows, so it is unit-testable without a DB.
+ *
+ * `session_type = 'hidden'` rows are `goose run --no-session` scratch runs — the
+ * enumerator (lib/goose-projects.ts) filters them out.
+ *
+ * Home override: set `GOOSE_HOME` (the data dir that contains `sessions/`, used
+ * by tests) or `GOOSE_DB_PATH` (points directly at a sessions.db).
+ */
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { openSqliteReadonly } from "./sqlite-reader";
+import { runtimeCache } from "./runtime-cache";
+import {
+  baseEntry,
+  formatTimestamp,
+  type LogEntry,
+  type UserEntry,
+  type AssistantEntry,
+  type GenericEntry,
+  type ContentBlock,
+  type ToolUseBlock,
+  type LogSource,
+} from "./log-entries";
+import { formatDuration } from "./format-duration";
+
+/** Goose session IDs are date-prefixed counters, e.g. `20260714_3`. */
+export const GOOSE_SESSION_ID_RE = /^\d{8}_\d+$/;
+
+/** Absolute path to Goose's data home (override with GOOSE_HOME; respects
+ *  XDG_DATA_HOME otherwise). */
+export function gooseHome(): string {
+  if (process.env.GOOSE_HOME) return process.env.GOOSE_HOME;
+  const xdg = process.env.XDG_DATA_HOME;
+  return join(xdg && xdg.length > 0 ? xdg : join(homedir(), ".local", "share"), "goose");
+}
+
+/** Absolute path to Goose's SQLite DB (override with GOOSE_DB_PATH). */
+export function gooseDbPath(): string {
+  return process.env.GOOSE_DB_PATH || join(gooseHome(), "sessions", "sessions.db");
+}
+
+/** Coerce a Goose timestamp to epoch ms. `messages.created_timestamp` is an
+ *  INTEGER epoch (seconds or ms); `sessions.created_at`/`updated_at` are SQLite
+ *  `CURRENT_TIMESTAMP` strings ("YYYY-MM-DD HH:MM:SS", UTC). */
+export function gooseTimestampToMs(value: unknown): number {
+  if (typeof value === "number" && Number.isFinite(value)) {
+    if (value > 1e12) return value; // already ms
+    if (value > 1e9) return value * 1000; // seconds
+  }
+  if (typeof value === "string" && value.length > 0) {
+    // SQLite CURRENT_TIMESTAMP has no zone and is UTC — normalize to ISO-Z so
+    // Date.parse doesn't treat it as local time.
+    const iso = /^\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}$/.test(value)
+      ? value.replace(" ", "T") + "Z"
+      : value;
+    const ms = Date.parse(iso);
+    if (!Number.isNaN(ms)) return ms;
+  }
+  return Date.now();
+}
+
+// ── Parsing helpers ──
+
+function safeJsonParse(s: unknown): unknown {
+  if (typeof s !== "string" || s.length === 0) return undefined;
+  try {
+    return JSON.parse(s);
+  } catch {
+    return undefined;
+  }
+}
+
+function isPlainObject(v: unknown): v is Record<string, unknown> {
+  return !!v && typeof v === "object" && !Array.isArray(v);
+}
+
+/** Text from a `content` field that may be a string or an array of
+ *  `{ type:"text", text }` blocks. */
+function extractText(content: unknown): string {
+  if (typeof content === "string") return content;
+  if (Array.isArray(content)) {
+    return content
+      .map((c) => (isPlainObject(c) && typeof c.text === "string" ? (c.text as string) : ""))
+      .filter(Boolean)
+      .join("\n");
+  }
+  return "";
+}
+
+function toDate(value: unknown, fallbackMs: number): Date {
+  const ms = typeof value === "number" || typeof value === "string" ? gooseTimestampToMs(value) : NaN;
+  return Number.isNaN(ms) ? new Date(fallbackMs) : new Date(ms);
+}
+
+/** Pull `{ id, name, input }` from a Goose `toolRequest` block:
+ *  `{id, toolCall:{status, value:{name, arguments}}}`. */
+function extractToolRequest(
+  block: Record<string, unknown>,
+  idx: number,
+): { id: string; name: string; input: Record<string, unknown> } {
+  const id = typeof block.id === "string" && block.id ? block.id : `goose-tool-${idx}`;
+  const toolCall = isPlainObject(block.toolCall) ? block.toolCall : {};
+  const value = isPlainObject(toolCall.value) ? toolCall.value : {};
+  const name = typeof value.name === "string" ? value.name : "tool";
+  const input = isPlainObject(value.arguments) ? value.arguments : {};
+  return { id, name, input };
+}
+
+/** Text of a Goose `toolResponse` block:
+ *  `{id, toolResult:{status, value:{content:[{type:"text",text}], …}}}`. */
+function extractToolResult(block: Record<string, unknown>): string {
+  const toolResult = isPlainObject(block.toolResult) ? block.toolResult : {};
+  const value = toolResult.value;
+  if (isPlainObject(value) && Array.isArray(value.content)) return extractText(value.content);
+  if (typeof value === "string") return value;
+  if (Array.isArray(value)) return extractText(value);
+  return "";
+}
+
+// ── Pure parser: message rows → LogEntry[] ──
+
+export interface GooseMessageRow {
+  role: string | null;
+  content_json: string | null;
+  created_timestamp: number | null;
+}
+
+/**
+ * Convert Goose `messages` rows (in insertion order) into `LogEntry[]`. Each
+ * row's `content_json` is a typed-block array; `toolRequest` blocks become
+ * `tool_use` blocks on an assistant entry, and later `toolResponse` blocks
+ * (which arrive in `role:"user"` rows) attach as the matching tool_use's result
+ * by id. Pure — unit-testable with plain rows.
+ */
+export function gooseRowsToLogEntries(
+  rows: GooseMessageRow[],
+  source: LogSource = "session",
+): LogEntry[] {
+  const entries: LogEntry[] = [];
+  const toolUseById = new Map<string, ToolUseBlock>();
+  const toolUseStartMs = new Map<string, number>();
+  const baseMs = Date.now();
+
+  for (let i = 0; i < rows.length; i++) {
+    const r = rows[i];
+    const parsed = safeJsonParse(r.content_json);
+    if (!Array.isArray(parsed)) continue;
+
+    const role = typeof r.role === "string" ? r.role : "system";
+    const date = toDate(r.created_timestamp, baseMs + i);
+    const timestamp = date.toISOString();
+    const raw: Record<string, unknown> = { uuid: `goose-${i}`, parentUuid: null };
+    const base = baseEntry(raw, timestamp, date, source);
+
+    const textParts: string[] = [];
+    const toolReqs: Record<string, unknown>[] = [];
+    const toolResps: Record<string, unknown>[] = [];
+    for (const b of parsed) {
+      if (!isPlainObject(b)) continue;
+      if (b.type === "text" && typeof b.text === "string") textParts.push(b.text);
+      else if (b.type === "toolRequest") toolReqs.push(b);
+      else if (b.type === "toolResponse") toolResps.push(b);
+    }
+
+    // Attach tool results to their earlier tool_use blocks (results arrive in
+    // role:"user" rows, so this runs before we consider the row a user turn).
+    for (const tr of toolResps) {
+      const callId = typeof tr.id === "string" ? tr.id : undefined;
+      const block = callId ? toolUseById.get(callId) : undefined;
+      if (!block) continue;
+      const startMs = (callId && toolUseStartMs.get(callId)) || date.getTime();
+      const durationMs = Math.max(0, date.getTime() - startMs);
+      block.result = {
+        timestamp,
+        timestampFormatted: formatTimestamp(date),
+        content: extractToolResult(tr),
+        durationMs,
+        durationFormatted: formatDuration(durationMs),
+      };
+    }
+
+    const text = textParts.join("\n").trim();
+
+    if (toolReqs.length > 0 || (role === "assistant" && text)) {
+      const blocks: ContentBlock[] = [];
+      if (text) blocks.push({ type: "text", text });
+      for (const req of toolReqs) {
+        const { id, name, input } = extractToolRequest(req, blocks.length);
+        const block: ToolUseBlock = { type: "tool_use", id, name, input };
+        blocks.push(block);
+        toolUseById.set(id, block);
+        toolUseStartMs.set(id, date.getTime());
+      }
+      if (blocks.length === 0) continue;
+      entries.push({
+        type: "assistant",
+        ...base,
+        message: { role: "assistant", content: blocks },
+      } satisfies AssistantEntry);
+      continue;
+    }
+
+    if (role === "user" && text) {
+      entries.push({
+        type: "user",
+        ...base,
+        message: { role: "user", content: text },
+      } satisfies UserEntry);
+      continue;
+    }
+
+    // Pure tool-result rows (no text, no requests) produced no new entry above.
+    if (text) {
+      entries.push({ type: "system", ...base, raw } satisfies GenericEntry);
+    }
+  }
+
+  entries.sort((a, b) => a.timestampMs - b.timestampMs);
+  return entries;
+}
+
+// ── DB loader ──
+
+export interface GooseSessionLogData {
+  entries: LogEntry[];
+  rawLines: Record<string, unknown>[];
+  cwd?: string;
+  filePath: string; // synthetic — goose keeps sessions in a DB; we use goose-db://<id>
+}
+
+/**
+ * Load one session by ID from `sessions.db`. Returns `null` when the DB is
+ * unavailable or the session doesn't exist.
+ */
+export async function getGooseSessionLog(
+  sessionId: string,
+): Promise<GooseSessionLogData | null> {
+  if (!sessionId || !GOOSE_SESSION_ID_RE.test(sessionId)) return null;
+  const db = await openSqliteReadonly(gooseDbPath());
+  if (!db) return null;
+  try {
+    const sessionRows = db.query<{ working_dir: string | null }>(
+      "SELECT working_dir FROM sessions WHERE id = ?",
+      [sessionId],
+    );
+    if (sessionRows.length === 0) return null;
+    const realCwd = sessionRows[0].working_dir;
+
+    const msgRows = db.query<GooseMessageRow>(
+      "SELECT role, content_json, created_timestamp FROM messages " +
+        "WHERE session_id = ? ORDER BY id ASC",
+      [sessionId],
+    );
+    const entries = gooseRowsToLogEntries(msgRows, "session");
+    const cwd = realCwd && realCwd.length > 0 ? realCwd : undefined;
+    return {
+      entries,
+      rawLines: msgRows as unknown as Record<string, unknown>[],
+      cwd,
+      filePath: `goose-db://${sessionId}`,
+    };
+  } catch {
+    return null;
+  } finally {
+    db.close();
+  }
+}
+
+export const getCachedGooseSessionLog = runtimeCache(
+  (sessionId: string) => getGooseSessionLog(sessionId),
+  2,
+  { maxSize: 50 },
+);

package/.next/standalone/lib/install-check.ts

@@ -0,0 +1,231 @@
+/**
+ * Install reporting, driven from the CLI instead of an npm lifecycle script.
+ *
+ * This used to live in `scripts/postinstall.mjs`. Every package manager now
+ * blocks dependency install scripts by default — npm 12 (`allowScripts`), pnpm,
+ * bun, and Yarn ≥4.14 — and a publisher cannot opt its own package in, so a
+ * postinstall hook is no longer a channel that reaches users. The first non-hook
+ * CLI invocation is.
+ *
+ * Two constraints shape this module:
+ *
+ *   1. It must never run on the `--hook` fast path in bin/failproofai.mjs. That
+ *      path fires on every tool call of every agent session; the check belongs
+ *      in runCli() only.
+ *   2. It must be free on the steady-state path. When the recorded version
+ *      matches, this returns before touching anything else.
+ *
+ * Everything here is best-effort: telemetry must never break, delay, or fail a
+ * real command.
+ */
+import { existsSync, readFileSync, writeFileSync, mkdirSync } from "node:fs";
+import { resolve } from "node:path";
+import { platform, arch, release, homedir, hostname } from "node:os";
+import { createHmac } from "node:crypto";
+import { trackInstallEvent } from "../scripts/install-telemetry.mjs";
+
+const FAILPROOFAI_HOOK_MARKER = "__failproofai_hook__";
+const NAMESPACE = "failproofai-telemetry-v1";
+
+/**
+ * Cap on the once-per-version report so a hanging network never stalls a command.
+ *
+ * A ceiling, not a cost: delivery resolves as soon as PostHog answers, measured
+ * at ~1.1s from a cold process (these events are the first thing a fresh process
+ * sends, so they always pay the DNS + TLS handshake). Raising this only matters
+ * when the network is slow — precisely when a tight budget would silently drop
+ * the report instead.
+ *
+ * 5s matches hook-telemetry and the postinstall script this replaces. An earlier
+ * 2s left barely any headroom over a 1.85s worst case seen in testing, for a
+ * saving nobody experiences on a healthy network.
+ */
+const REPORT_TIMEOUT_MS = 5000;
+
+function hashToId(raw: string): string {
+  return createHmac("sha256", NAMESPACE).update(raw).digest("hex");
+}
+
+function lastVersionPath(): string {
+  return resolve(homedir(), ".failproofai", "last-version");
+}
+
+/**
+ * Semver ordering. A release outranks the same version carrying a prerelease
+ * tag (semver §11); within a prerelease, numeric identifiers rank below
+ * non-numeric ones.
+ *
+ * Prerelease identifiers are separated by dots only (semver §9). A hyphen is a
+ * legal character *inside* an identifier, so `beta-2` is one non-numeric
+ * identifier compared lexically — not `beta` and `2`.
+ */
+export function compareSemver(a: string, b: string): number {
+  const parse = (v: string) => {
+    const m = /^(\d+)\.(\d+)\.(\d+)(?:-(.+))?$/.exec(v);
+    if (!m) return null;
+    return { nums: [Number(m[1]), Number(m[2]), Number(m[3])], pre: m[4] ?? null };
+  };
+  const pa = parse(a);
+  const pb = parse(b);
+  if (!pa || !pb) return a < b ? -1 : a > b ? 1 : 0;
+  for (let i = 0; i < 3; i++) {
+    if (pa.nums[i] !== pb.nums[i]) return pa.nums[i] < pb.nums[i] ? -1 : 1;
+  }
+  if (pa.pre === null && pb.pre === null) return 0;
+  if (pa.pre === null) return 1;
+  if (pb.pre === null) return -1;
+  const ax = pa.pre.split(".");
+  const bx = pb.pre.split(".");
+  for (let i = 0; i < Math.max(ax.length, bx.length); i++) {
+    const ai = ax[i], bi = bx[i];
+    if (ai === undefined) return -1;
+    if (bi === undefined) return 1;
+    const aNum = /^\d+$/.test(ai), bNum = /^\d+$/.test(bi);
+    if (aNum && bNum) {
+      const d = Number(ai) - Number(bi);
+      if (d !== 0) return d < 0 ? -1 : 1;
+    } else if (aNum) {
+      return -1;
+    } else if (bNum) {
+      return 1;
+    } else if (ai !== bi) {
+      return ai < bi ? -1 : 1;
+    }
+  }
+  return 0;
+}
+
+export interface HooksState {
+  configured: boolean;
+  registered: boolean;
+  policyCount: number;
+}
+
+/**
+ * Snapshot of the user's hook configuration, carried as properties on
+ * package_installed.
+ *
+ * Only inspects Claude's settings, which understates `registered` for someone
+ * running failproofai against another CLI. Preserved as-is from the postinstall
+ * script so the event keeps its historical meaning.
+ */
+export function checkHooks(): HooksState {
+  const hooksConfigPath = resolve(homedir(), ".failproofai", "policies-config.json");
+  if (!existsSync(hooksConfigPath)) {
+    return { configured: false, registered: false, policyCount: 0 };
+  }
+
+  let config;
+  try {
+    config = JSON.parse(readFileSync(hooksConfigPath, "utf8"));
+  } catch {
+    return { configured: false, registered: false, policyCount: 0 };
+  }
+
+  if (!Array.isArray(config.enabledPolicies) || config.enabledPolicies.length === 0) {
+    return { configured: false, registered: false, policyCount: 0 };
+  }
+
+  const policyCount = config.enabledPolicies.length;
+  const settingsPath = resolve(homedir(), ".claude", "settings.json");
+  if (!existsSync(settingsPath)) return { configured: true, registered: false, policyCount };
+
+  let settings;
+  try {
+    settings = JSON.parse(readFileSync(settingsPath, "utf8"));
+  } catch {
+    return { configured: true, registered: false, policyCount };
+  }
+
+  if (!settings?.hooks) return { configured: true, registered: false, policyCount };
+
+  for (const matchers of Object.values(settings.hooks)) {
+    if (!Array.isArray(matchers)) continue;
+    for (const matcher of matchers) {
+      if (!matcher?.hooks) continue;
+      if (matcher.hooks.some((h: Record<string, unknown>) => h[FAILPROOFAI_HOOK_MARKER] === true)) {
+        return { configured: true, registered: true, policyCount };
+      }
+    }
+  }
+
+  return { configured: true, registered: false, policyCount };
+}
+
+/**
+ * Report an install or upgrade, at most once per version.
+ *
+ * Fires first_install (nothing recorded yet) or version_changed (recorded
+ * version differs), then package_installed, then records `version`. A same-version
+ * run is a no-op — unlike the postinstall script this replaces, the CLI has no
+ * signal that would distinguish a reinstall from an ordinary invocation, so
+ * `direction: "reinstall"` is no longer reported.
+ */
+export async function maybeReportInstall(version: string): Promise<void> {
+  try {
+    const versionFile = lastVersionPath();
+
+    let previousVersion: string | null = null;
+    try {
+      if (existsSync(versionFile)) {
+        previousVersion = readFileSync(versionFile, "utf8").trim() || null;
+      }
+    } catch {
+      // Unreadable marker — treat as first run rather than give up.
+    }
+
+    // Steady state: same version already reported. Costs one stat() per command.
+    if (previousVersion === version) return;
+
+    const hooks = checkHooks();
+
+    const events: Promise<void>[] = [];
+    if (previousVersion === null) {
+      events.push(
+        trackInstallEvent("first_install", {
+          platform: platform(),
+          arch: arch(),
+          os_release: release(),
+          node_version: process.versions.node,
+        }, { version, timeoutMs: REPORT_TIMEOUT_MS }),
+      );
+    } else {
+      const cmp = compareSemver(previousVersion, version);
+      events.push(
+        trackInstallEvent("version_changed", {
+          from_version: previousVersion,
+          to_version: version,
+          direction: cmp < 0 ? "upgrade" : "downgrade",
+          platform: platform(),
+          arch: arch(),
+        }, { version, timeoutMs: REPORT_TIMEOUT_MS }),
+      );
+    }
+
+    events.push(
+      trackInstallEvent("package_installed", {
+        platform: platform(),
+        arch: arch(),
+        os_release: release(),
+        node_version: process.versions.node,
+        hostname_hash: hashToId(hostname()),
+        hooks_configured: hooks.configured,
+        hooks_registered: hooks.registered,
+        enabled_policy_count: hooks.policyCount,
+      }, { version, timeoutMs: REPORT_TIMEOUT_MS }),
+    );
+
+    // Record before awaiting: a dropped event is cheaper than re-reporting the
+    // same version on every command because delivery kept failing.
+    try {
+      mkdirSync(resolve(homedir(), ".failproofai"), { recursive: true });
+      writeFileSync(versionFile, version, "utf8");
+    } catch {
+      // best-effort
+    }
+
+    await Promise.all(events.map((p) => p.catch(() => {})));
+  } catch {
+    // Reporting must never break a command.
+  }
+}