failproofai 0.0.14-beta.0 → 0.0.14-beta.2

package/src/hooks/builtin-policies.ts

@@ -172,7 +172,8 @@ const CURL_PIPE_SH_RE = /(?:curl|wget)\s.*\|\s*(?:sh|bash|zsh|dash|ksh|csh|tcsh|
 const PS_WEB_PIPE_RE = /(?:Invoke-WebRequest|iwr|Invoke-RestMethod|irm)\s+.*\|\s*(?:Invoke-Expression|iex)/i;
 
 // blockForcePush
-const FORCE_PUSH_RE = /(?:--force|-f\b)/;
+const SHORT_FLAG_BUNDLE_RE = /^-[a-zA-Z]*f[a-zA-Z]*$/;
+const SAFE_FORCE_PREFIXES = ["--force-with-lease", "--force-if-includes"] as const;
 
 // blockSecretsWrite
 const SECRET_FILE_RE = /\.(?:pem|key)$/;
@@ -587,36 +588,154 @@ function blockPushMaster(ctx: PolicyContext): PolicyResult {
   return allow();
 }
 
+// -- block-rm-rf: deletion-target resolution --
+
+/**
+ * Leading shell forms that resolve to a home directory: `~`, `~user`, `$HOME`,
+ * `${HOME}`. The lookahead keeps `$HOMEBREW_PREFIX` (a variable this policy
+ * cannot resolve) from being mistaken for `$HOME`.
+ */
+const HOME_PREFIX_RE = /^(?:~[A-Za-z0-9_.-]*|\$HOME|\$\{HOME\})(?=$|\/)/;
+
+/** `rm`, `/bin/rm`, `/usr/bin/rm`, … — the command word of a delete. */
+const RM_CMD_RE = /^(?:\/\S*\/)?rm$/;
+
+/** `find` expression that deletes: `-delete`, `-exec rm`, `-execdir rm`, `-ok rm`. */
+// Same shape as RM_CMD_RE: `find` is just as dangerous when invoked by
+// absolute path (`/usr/bin/find / -delete`), so match both forms.
+const FIND_CMD_RE = /^(?:\/\S*\/)?find$/;
+const FIND_EXEC_RE = /^-(?:exec|execdir|ok|okdir)$/;
+
+/** find's global options, which precede its path operands (`find -L / -delete`). */
+const FIND_GLOBAL_OPT_RE = /^-(?:[HLP]|D|O\d*)$/;
+
+/** First token of find's expression — everything before it is a path operand. */
+const FIND_EXPR_START_RE = /^(?:-|\\?[(!])/;
+
+/**
+ * Roots that exist to hold throwaway data. A delete of the root itself is still
+ * catastrophic (`rm -rf /tmp` wipes every process's scratch space); a delete of
+ * something *inside* one is ordinary work.
+ */
+const SCRATCH_ROOTS = ["/tmp", "/var/tmp"];
+
+/**
+ * How many path segments below a root (`/` or a home directory) a delete has to
+ * reach before it stops being catastrophic. `/etc` (1) and `/home/chetan` (2)
+ * are system- and user-level directories; `/home/chetan/project` (3) is a
+ * specific thing the caller meant to delete.
+ */
+const CATASTROPHIC_DEPTH = 2;
+
+/** Expand the leading `~` / `$HOME` / `${HOME}` of a path to the real home directory. */
+function expandHomePrefix(path: string): string {
+  const m = path.match(/^(?:~|\$HOME|\$\{HOME\})(?=$|\/)/);
+  return m ? homedir() + path.slice(m[0].length) : path;
+}
+
+/** Drop a trailing `/*` glob and any trailing slashes: `/tmp/foo/*` → `/tmp/foo`. */
+function stripTrailingGlob(path: string): string {
+  return path.replace(/\/\*$/, "").replace(/\/+$/, "");
+}
+
+/**
+ * Would deleting this target be catastrophic?
+ *
+ * Rather than pattern-matching the raw command text, this resolves the token as
+ * far as the shell would: quotes are stripped, `~` / `$HOME` are recognised as a
+ * root in their own right, and the remaining path segments are counted. A target
+ * within {@link CATASTROPHIC_DEPTH} segments of either root (`/` or home) takes
+ * out the machine or the user's data.
+ *
+ * Fails safe: a token whose head is an expansion this policy cannot evaluate —
+ * command substitution (`$(…)`, backticks) or any variable other than `$HOME` —
+ * could expand to `/`, so it counts as catastrophic. Relative targets are not
+ * flagged: they resolve under the working directory, not under a root.
+ */
+function isCatastrophicTarget(token: string): boolean {
+  const raw = token.replace(/^['"]|['"]$/g, "");
+  if (raw === "") return false;
+
+  const homePrefix = raw.match(HOME_PREFIX_RE);
+  // Unresolvable head: `$(echo /)`, `` `pwd` ``, `$TARGET_DIR`, …
+  if (!homePrefix && /^[$`]/.test(raw)) return true;
+
+  const belowRoot = homePrefix ? raw.slice(homePrefix[0].length) : raw.startsWith("/") ? raw : null;
+  if (belowRoot === null) return false;
+
+  const segments = stripTrailingGlob(belowRoot).split("/").filter(Boolean);
+  if (!homePrefix && SCRATCH_ROOTS.some((r) => `/${segments.join("/")}`.startsWith(`${r}/`))) return false;
+  return segments.length <= CATASTROPHIC_DEPTH;
+}
+
 /**
- * Check whether all *recursive* rm path targets in a command are under an allowlisted path.
+ * The paths a single command segment would recursively delete, or `null` when the
+ * segment is not a recursive delete at all.
+ *
+ * Understands the two shapes that reach every file under a target: `rm` with both
+ * `-r` and `-f` (in any spelling or order), and `find`, which recurses by design,
+ * paired with `-delete` or an `-exec rm`.
+ */
+function recursiveDeletionTargets(seg: string): string[] | null {
+  const tokens = parseArgvTokens(seg);
+
+  const findIdx = tokens.findIndex((t) => FIND_CMD_RE.test(t));
+  if (findIdx >= 0) {
+    const expr = tokens.slice(findIdx + 1);
+    const execIdx = expr.findIndex((t) => FIND_EXEC_RE.test(t));
+    const deletes = expr.includes("-delete") || (execIdx >= 0 && RM_CMD_RE.test(expr[execIdx + 1] ?? ""));
+    if (deletes) {
+      // find's path operands sit between the leading global options and the
+      // first expression token: `find -L /home/chetan -name '*.log' -delete`
+      let start = 0;
+      while (start < expr.length && FIND_GLOBAL_OPT_RE.test(expr[start])) {
+        start += expr[start] === "-D" ? 2 : 1;
+      }
+      const rest = expr.slice(start);
+      const end = rest.findIndex((t) => FIND_EXPR_START_RE.test(t));
+      return end < 0 ? rest : rest.slice(0, end);
+    }
+  }
+
+  const rmIdx = tokens.findIndex((t) => RM_CMD_RE.test(t));
+  if (rmIdx >= 0) {
+    const args = tokens.slice(rmIdx + 1);
+    const shortFlags = args.filter((t) => /^-[^-]/.test(t)).join("");
+    const longFlags = args.filter((t) => /^--/.test(t));
+    const recursive = /r/i.test(shortFlags) || longFlags.some((f) => /^--recursive$/i.test(f));
+    const force = /f/.test(shortFlags) || longFlags.some((f) => /^--force$/i.test(f));
+    if (recursive && force) return args.filter((t) => !t.startsWith("-"));
+  }
+
+  return null;
+}
+
+/** Split a command into the segments the shell would run as separate commands. */
+function shellSegments(cmd: string): string[] {
+  return cmd.split(/&&|\|\||[|;\n]/).map((s) => s.trim()).filter((s) => s !== "");
+}
+
+/**
+ * Check whether all recursive-delete targets in a command are under an allowlisted path.
  * Splits on shell operators first so that `/tmp` appearing in an unrelated
  * sub-command (e.g. `echo /tmp && rm -rf /`) does not trigger a false allow.
  * Uses path-boundary comparison so `/tmp` does not cover `/tmp2`.
  * Non-recursive rm segments (no -r/-R flag) are skipped — they pose no catastrophic risk.
  * Quoted paths with spaces are handled via a segment-level regex fallback.
+ * Home-relative targets and allowPaths entries are expanded, so `~/scratch` is
+ * covered by an allowPaths entry of either `~/scratch` or the absolute home path.
  */
-function rmTargetIsAllowed(cmd: string, allowPaths: string[]): boolean {
+function deletionTargetIsAllowed(cmd: string, allowPaths: string[]): boolean {
   if (allowPaths.length === 0) return false;
-  const segments = cmd
-    .split(/&&|\|\||[|;\n]/)
-    .map((s) => s.trim())
-    .filter((s) => /\brm\b/.test(s));
-  if (segments.length === 0) return false;
-  for (const seg of segments) {
-    const tokens = parseArgvTokens(seg);
-    const rmIdx = tokens.findIndex((t) => t === "rm");
-    if (rmIdx < 0) continue;
-    // Only validate recursive rm segments — non-recursive rm has no catastrophic-deletion risk
-    const flagTokens = tokens.slice(rmIdx + 1).filter((t) => /^-[^-]/.test(t));
-    const longFlagsInSeg = tokens.slice(rmIdx + 1).filter((t) => /^--/.test(t));
-    if (!/r/i.test(flagTokens.join("")) && !longFlagsInSeg.some(f => /^--recursive$/i.test(f))) continue;
-    const pathArgs = tokens.slice(rmIdx + 1).filter((t) => !t.startsWith("-"));
-    for (const target of pathArgs) {
-      const normalized = target.replace(/\/\*$/, "").replace(/\/+$/, "") || "/";
-      const covered = allowPaths.some((p) => {
-        const np = p.replace(/\/+$/, "") || "/";
-        return normalized === np || normalized.startsWith(np + "/");
-      });
+  const normalizedAllowPaths = allowPaths.map((p) => stripTrailingGlob(expandHomePrefix(p)) || "/");
+  let sawRecursiveDelete = false;
+  for (const seg of shellSegments(cmd)) {
+    const targets = recursiveDeletionTargets(seg);
+    if (targets === null) continue;
+    sawRecursiveDelete = true;
+    for (const target of targets) {
+      const normalized = stripTrailingGlob(expandHomePrefix(target)) || "/";
+      const covered = normalizedAllowPaths.some((np) => normalized === np || normalized.startsWith(np + "/"));
       if (!covered) {
         // Fallback: check the raw segment for quoted paths that contain spaces
         // (parseArgvTokens splits on whitespace, so "/tmp/my dir" becomes two tokens)
@@ -628,40 +747,23 @@ function rmTargetIsAllowed(cmd: string, allowPaths: string[]): boolean {
       }
     }
   }
-  return true;
+  return sawRecursiveDelete;
 }
 
 function blockRmRf(ctx: PolicyContext): PolicyResult {
   if (ctx.toolName !== "Bash") return allow();
   const cmd = getCommand(ctx);
-  const hasDestructivePath = parseArgvTokens(cmd).some((token) => {
-    const normalized = token.replace(/\/\*$/, "").replace(/\/+$/, "") || (token.startsWith("/") ? "/" : "");
-    return normalized === "/" || normalized === "~" || /^\/[A-Za-z_][\w.-]*$/.test(normalized);
-  });
 
-  // Combined flags in one token: rm -rf /, rm -fr /
-  if (hasDestructivePath && (
-    /rm\s+-[^\s]*r[^\s]*f[^\s]*/.test(cmd) ||
-    /rm\s+-[^\s]*f[^\s]*r[^\s]*/.test(cmd)
-  )) {
+  const hasCatastrophicTarget = shellSegments(cmd).some((seg) => {
+    const targets = recursiveDeletionTargets(seg);
+    return targets !== null && targets.some(isCatastrophicTarget);
+  });
+  if (hasCatastrophicTarget) {
     const allowPaths = ((ctx.params?.allowPaths ?? []) as string[]);
-    if (rmTargetIsAllowed(cmd, allowPaths)) return allow();
+    if (deletionTargetIsAllowed(cmd, allowPaths)) return allow();
     return deny("Catastrophic deletion blocked");
   }
 
-  // Separated flags: rm -r -f /, rm -f -r /, rm -r -v -f /, etc.
-  if (hasDestructivePath && /\brm\b/.test(cmd)) {
-    const tokens = parseArgvTokens(cmd);
-    const shortFlags = tokens.filter((t) => /^-[^-]/.test(t)).join("");
-    const longFlags = tokens.filter((t) => /^--/.test(t));
-    const hasRecursive = /r/i.test(shortFlags) || longFlags.some(f => /^--recursive$/i.test(f));
-    const hasForce = /f/.test(shortFlags) || longFlags.some(f => /^--force$/i.test(f));
-    if (hasRecursive && hasForce) {
-      const allowPaths = ((ctx.params?.allowPaths ?? []) as string[]);
-      if (rmTargetIsAllowed(cmd, allowPaths)) return allow();
-      return deny("Catastrophic deletion blocked");
-    }
-  }
   // PowerShell: Remove-Item -Recurse -Force on root/drive
   if (/Remove-Item\s+.*-Recurse.*-Force.*(?:[A-Z]:\\(?:\s|$)|\\\*)/i.test(cmd)) {
     return deny("Catastrophic deletion blocked");
@@ -675,13 +777,29 @@ function blockRmRf(ctx: PolicyContext): PolicyResult {
 
 function blockForcePush(ctx: PolicyContext): PolicyResult {
   if (ctx.toolName !== "Bash") return allow();
-  const args = extractGitPushArgs(getCommand(ctx));
-  if (args.some((a) => FORCE_PUSH_RE.test(a))) {
-    return deny("Force-pushing is blocked");
+  for (const segment of extractGitPushArgs(getCommand(ctx))) {
+    let sawEndOfOptions = false;
+    for (const token of segment.split(/\s+/)) {
+      if (token === "--") {
+        sawEndOfOptions = true;
+        continue;
+      }
+      if (sawEndOfOptions) continue;
+      if (isForcePushFlag(token)) {
+        return deny("Force-pushing is blocked");
+      }
+    }
   }
   return allow();
 }
 
+function isForcePushFlag(token: string): boolean {
+  if (token === "--force") return true;
+  if (SAFE_FORCE_PREFIXES.some((prefix) => token.startsWith(prefix))) return false;
+  if (token.startsWith("--force")) return true;
+  return SHORT_FLAG_BUNDLE_RE.test(token);
+}
+
 function blockSecretsWrite(ctx: PolicyContext): PolicyResult {
   if (ctx.toolName !== "Write") return allow();
   const filePath = getFilePath(ctx);

package/src/hooks/configure-wizard.ts

@@ -12,19 +12,29 @@
  * whatever is already enabled, so unticking removes). Reuses the tested
  * install/uninstall manager and the existing searchable policy picker.
  */
-import { existsSync, mkdirSync, writeFileSync } from "node:fs";
+import { existsSync, mkdirSync, writeFileSync, readFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { resolve, sep } from "node:path";
 
-import { selectOne, multiSelect, intro, outro, summarize, type TTYIn, type TTYOut } from "./tui";
+import {
+  selectOne,
+  multiSelect,
+  intro,
+  outro,
+  summarize,
+  type MultiChoice,
+  type TTYIn,
+  type TTYOut,
+} from "./tui";
 import {
   detectInstalledClis,
   getIntegration,
 } from "./integrations";
 import { INTEGRATION_TYPES, type IntegrationType, type HookScope } from "./types";
 import { installHooks } from "./manager";
-import { getConfigPathForScope } from "./hooks-config";
+import { getConfigPathForScope, readHooksConfig } from "./hooks-config";
 import { POLICY_PRESETS, resolvePreset, resolveEverything } from "./policy-presets";
+import { discoverPolicyFiles, findSkippedPolicyFiles } from "./custom-hooks-loader";
 import { trackHookEvent } from "./hook-telemetry";
 import { getInstanceId } from "../../lib/telemetry-id";
 
@@ -75,7 +85,13 @@ export function buildScopeChoices(cwd: string) {
   ];
 }
 
-export function buildAgentChoices(scope: HookScope, cwd: string) {
+/** The CLIs that can actually be configured at `scope`. Hermes and OpenClaw
+ *  are gateways with no project-level config, so they are user-scope only. */
+export function clisSupportingScope(scope: HookScope): IntegrationType[] {
+  return INTEGRATION_TYPES.filter((id) => getIntegration(id).scopes.includes(scope));
+}
+
+export function buildAgentChoices(scope: HookScope, cwd: string): MultiChoice<IntegrationType>[] {
   const detected = new Set(detectInstalledClis());
   // Detected first, then the rest as "install ahead of time".
   const ordered = [
@@ -85,6 +101,25 @@ export function buildAgentChoices(scope: HookScope, cwd: string) {
   return ordered.map((id) => {
     const integration = getIntegration(id);
     const isDetected = detected.has(id);
+
+    // Not every CLI can be configured at every scope — Hermes and OpenClaw
+    // have no project config at all. Offering them anyway meant picking "Just
+    // this project" and applying died with `Scope "project" is not supported
+    // by Hermes`, after the user had answered every question. Show them as
+    // locked and unchecked with the reason, so the constraint is visible
+    // instead of being discovered as a crash.
+    const supported = integration.scopes.includes(scope);
+    if (!supported) {
+      return {
+        label: integration.displayName,
+        value: id,
+        checked: false,
+        locked: true,
+        section: "Global only · not configurable per-project",
+        hint: `supports ${integration.scopes.join(", ")} scope — rerun with "Everywhere I code"`,
+      };
+    }
+
     let installedHere = false;
     try {
       installedHere = integration.hooksInstalledInSettings(scope, cwd);
@@ -103,18 +138,62 @@ export function buildAgentChoices(scope: HookScope, cwd: string) {
 
 const EVERYTHING = "__everything__";
 const ALL_CLIS = "__all_clis__";
+/** Sentinel for the locked "Custom" row — informational, never resolves to
+ *  builtin policy names (custom policies load by convention, not by config). */
+const CUSTOM = "__custom__";
 
 /** The themed preset bundles for the wizard's multi-select, plus an "Everything"
  *  option that enables the full builtin policy set. */
-export function buildPresetChoices() {
-  const choices: Array<{ label: string; value: string; hint: string }> = POLICY_PRESETS.map(
-    (p) => ({ label: p.label, value: p.id, hint: p.description }),
-  );
+export function buildPresetChoices(cwd: string = process.cwd(), enabled = true) {
+  const choices: MultiChoice<string>[] = POLICY_PRESETS.map((p) => ({
+    label: p.label,
+    value: p.id,
+    hint: p.description,
+  }));
   choices.push({
     label: "Everything",
     value: EVERYTHING,
     hint: `all ${resolveEverything().length} policies`,
   });
+
+  // The Custom row is ALWAYS present, because it is the only place the feature
+  // is discoverable: a user who has never written a policy cannot learn the
+  // capability exists, and one who wrote a badly-named file cannot learn why
+  // nothing happened.
+  //
+  // When there are loadable files it is a REAL checkbox — unticking writes
+  // `customPoliciesEnabled: false`, which switches convention discovery off
+  // without renaming or deleting anything. With nothing to toggle (no files,
+  // or only skipped ones) it falls back to a locked status row.
+  const custom = describeCustomPolicies(cwd);
+  const skipped = custom.warnings.length;
+  const plural = (n: number) => `${n} file${n === 1 ? "" : "s"}`;
+  const skippedNote = skipped > 0 ? ` · ${skipped} skipped, see next screen` : "";
+
+  if (custom.fileCount > 0) {
+    choices.push({
+      label: "Custom",
+      value: CUSTOM,
+      checked: enabled,
+      // Deliberately NOT summaryExclude'd: this one is a real choice, and the
+      // step summary is the only place the user sees what they picked. Hiding
+      // it meant unticking Custom and every bundle showed "none", giving no
+      // way to tell the toggle had registered.
+      hint: `${plural(custom.fileCount)} in ${custom.scopes.join(" + ")}${skippedNote}`,
+    });
+  } else {
+    choices.push({
+      label: "Custom",
+      value: CUSTOM,
+      locked: true,
+      checked: false,
+      summaryExclude: true,
+      hint:
+        skipped > 0
+          ? `${plural(skipped)} found but NOT loaded — see next screen`
+          : "none yet · drop *-policies.mjs in .failproofai/policies/",
+    });
+  }
   return choices;
 }
 
@@ -124,14 +203,100 @@ export function buildPresetChoices() {
  * enables the full policy set and wins over any presets.
  */
 export function resolvePresetSelection(values: string[]): string[] {
-  if (values.includes(EVERYTHING)) return resolveEverything();
-  return [...new Set(values.flatMap((id) => resolvePreset(id)))];
+  // The Custom row is informational — custom policies are discovered from disk
+  // by the loader, never named in the enabled-policies config — so it must not
+  // reach resolvePreset(), which only knows builtin bundle ids.
+  const selected = values.filter((v) => v !== CUSTOM);
+  if (selected.includes(EVERYTHING)) return resolveEverything();
+  return [...new Set(selected.flatMap((id) => resolvePreset(id)))];
+}
+
+const DIM_NOTE = "(auto-loaded)";
+
+/**
+ * Persist the Custom checkbox into the scope's config, after installHooks has
+ * written it (installHooks copies the previous config forward, so writing
+ * first would be overwritten).
+ *
+ * Writes the key only to turn discovery OFF, and removes it when turning back
+ * on, so the common case leaves no `customPoliciesEnabled: true` noise in the
+ * file and "absent means enabled" stays the single default. `undefined` means
+ * there was nothing to toggle — leave whatever is there alone.
+ */
+export function setCustomPoliciesEnabled(
+  scope: HookScope,
+  cwd: string,
+  enabled: boolean | undefined,
+): void {
+  if (enabled === undefined) return;
+  const path = getConfigPathForScope(scope, cwd);
+  let config: Record<string, unknown> = {};
+  try {
+    if (existsSync(path)) config = JSON.parse(readFileSync(path, "utf8")) as Record<string, unknown>;
+  } catch {
+    return; // a malformed config is the install path's problem, not ours
+  }
+  if (enabled) delete config.customPoliciesEnabled;
+  else config.customPoliciesEnabled = false;
+  try {
+    writeFileSync(path, JSON.stringify(config, null, 2) + "\n", "utf8");
+  } catch {
+    /* best-effort: never fail a completed setup over this flag */
+  }
 }
 
-export function reviewLines(
-  state: { scope: HookScope; clis: IntegrationType[]; policies: string[]; cwd: string },
-): string[] {
-  const { scope, clis, policies, cwd } = state;
+/**
+ * Summarise the custom policy files on disk, for the review screen.
+ *
+ * Only lists files — it deliberately does NOT load them. Loading executes
+ * user code, which is fine on the hook path but wrong in an interactive
+ * wizard the user hasn't confirmed yet.
+ *
+ * `warnings` covers the silent-skip trap: a file in the right directory whose
+ * name doesn't end in `policies.{js,mjs,ts}` is ignored entirely, with nothing
+ * on screen to say so. Surfacing it here is the difference between "my rule
+ * isn't working and I don't know why" and a one-line rename.
+ */
+export function describeCustomPolicies(cwd: string): {
+  active: string[];
+  warnings: string[];
+  fileCount: number;
+  scopes: string[];
+} {
+  const active: string[] = [];
+  const warnings: string[] = [];
+  const scopes: string[] = [];
+  let fileCount = 0;
+  const dirs: Array<{ dir: string; label: string }> = [
+    { dir: resolve(cwd, ".failproofai", "policies"), label: "project" },
+    { dir: resolve(homedir(), ".failproofai", "policies"), label: "global" },
+  ];
+  for (const { dir, label } of dirs) {
+    const found = discoverPolicyFiles(dir);
+    if (found.length > 0) {
+      active.push(`${found.length} file${found.length === 1 ? "" : "s"} (${label})`);
+      scopes.push(label);
+      fileCount += found.length;
+    }
+    for (const name of findSkippedPolicyFiles(dir)) {
+      warnings.push(
+        `! ${homeify(resolve(dir, name))} is NOT loaded — rename to ` +
+          `${name.replace(/\.(js|mjs|ts)$/, "-policies.$1")}`,
+      );
+    }
+  }
+  return { active, warnings, fileCount, scopes };
+}
+
+export function reviewLines(state: {
+  scope: HookScope;
+  clis: IntegrationType[];
+  policies: string[];
+  cwd: string;
+  /** The Custom checkbox. `undefined` = nothing to toggle, leave as-is. */
+  customEnabled?: boolean;
+}): string[] {
+  const { scope, clis, policies, cwd, customEnabled } = state;
   const where =
     scope === "project" ? `This project (${homeify(cwd)})` : "Everywhere (global)";
   const lines: string[] = [];
@@ -139,6 +304,20 @@ export function reviewLines(
   lines.push(`  Where      : ${where}`);
   lines.push(`  Assistants : ${assistantNames.length ? summarize(assistantNames, "assistants") : "(none)"}`);
   lines.push(`  Policies   : ${policies.length} enabled`);
+
+  // Reflect the Custom decision, not just what is on disk. Reporting
+  // "1 file (project) (auto-loaded)" after the user had just unticked the row
+  // stated the opposite of what was about to happen.
+  const custom = describeCustomPolicies(cwd);
+  if (custom.active.length > 0) {
+    lines.push(
+      `  Custom     : ${custom.active.join(" · ")} ${
+        customEnabled === false ? "— DISABLED, will not load" : DIM_NOTE
+      }`,
+    );
+  }
+  for (const warning of custom.warnings) lines.push(`  ${warning}`);
+
   lines.push("");
   lines.push("  This will update:");
   for (const cli of clis) {
@@ -279,7 +458,12 @@ export async function runConfigureWizard(io: WizardIO = {}): Promise<WizardResul
       {
         label: "Everything available",
         value: ALL_CLIS,
-        hint: `protect all ${INTEGRATION_TYPES.length} supported CLIs`,
+        // Counts only what this scope can actually take — expanding to all 12
+        // under project scope is what crashed the apply on Hermes.
+        hint: `protect all ${clisSupportingScope(scope).length} CLIs configurable here`,
+        // A selector, not an assistant. Counting it gave "13 assistants" for
+        // the 12 supported CLIs, and listed "Everything available" among them.
+        summaryExclude: true,
       },
       ...buildAgentChoices(scope, cwd),
     ],
@@ -290,15 +474,28 @@ export async function runConfigureWizard(io: WizardIO = {}): Promise<WizardResul
     stdout,
   });
   if (clisSel === null) return cancel();
-  const clis: IntegrationType[] = clisSel.includes(ALL_CLIS)
-    ? [...INTEGRATION_TYPES]
-    : (clisSel.filter((v) => v !== ALL_CLIS) as IntegrationType[]);
+  // Filter to what this scope supports in BOTH branches: "Everything
+  // available" must not expand to CLIs that cannot take this scope, and a
+  // locked row can't be ticked but belt-and-braces keeps the invariant local
+  // to the one place `clis` is built.
+  const supported = new Set(clisSupportingScope(scope));
+  const clis: IntegrationType[] = (
+    clisSel.includes(ALL_CLIS)
+      ? [...INTEGRATION_TYPES]
+      : (clisSel.filter((v) => v !== ALL_CLIS) as IntegrationType[])
+  ).filter((id) => supported.has(id));
 
   // 3 — Which policies? Multi-select of themed presets — additive, so the
   // enabled set is the union of every ticked bundle.
+  // Seed the Custom checkbox from whatever the config already says, so the
+  // wizard shows the current state rather than resetting it every run.
+  const customEnabledBefore = readHooksConfig().customPoliciesEnabled !== false;
+  const presetChoices = buildPresetChoices(cwd, customEnabledBefore);
+  const hasCustomFiles = describeCustomPolicies(cwd).fileCount > 0;
+
   const presets = await multiSelect<string>({
     message: "What should we guard against?",
-    choices: buildPresetChoices(),
+    choices: presetChoices,
     minSelected: 1,
     summaryNoun: "bundles",
     hint: "space toggles · combine presets · ↵ confirm",
@@ -307,11 +504,14 @@ export async function runConfigureWizard(io: WizardIO = {}): Promise<WizardResul
   });
   if (presets === null) return cancel();
   const policies = resolvePresetSelection(presets);
+  // Only meaningful when there are files to switch off; with none, the row is
+  // locked-unchecked and must not write a disabling flag.
+  const customEnabled = hasCustomFiles ? presets.includes(CUSTOM) : undefined;
 
   // 4 — Review & apply
   const decision = await selectOne<"apply" | "cancel">({
     message: "Ready to apply?",
-    body: reviewLines({ scope, clis, policies, cwd }),
+    body: reviewLines({ scope, clis, policies, cwd, customEnabled }),
     choices: [
       { label: "Yes, apply now", value: "apply", hint: "write the config" },
       { label: "Cancel", value: "cancel", hint: "quit, no changes" },
@@ -345,12 +545,28 @@ export async function runConfigureWizard(io: WizardIO = {}): Promise<WizardResul
     clis,
     { replace: true, quiet: true },
   );
+  setCustomPoliciesEnabled(scope, cwd, customEnabled);
   await applied;
   // Only now — a completed apply — is the launcher considered "seen", so the
   // first-run bare invocation stops redirecting here and opens the dashboard.
   markLauncherSeen();
 
-  const agentNames = clis.map((c) => getIntegration(c).displayName).join(", ");
-  outro(`Setup complete — ${policies.length} policies guarding ${agentNames}.`, { ok: true }, stdout);
+  // Keep this inside a standard 80-column terminal. `writeLines` truncates with
+  // a hard cut and no ellipsis, so an over-long line doesn't just lose its tail
+  // — it reads as broken output. Naming all ten CLIs took it to 182 characters;
+  // the count alone carries the same information, and the user picked them two
+  // screens ago.
+  const customNote =
+    customEnabled === true
+      ? " + your custom policies"
+      : customEnabled === false
+        ? " · custom policies DISABLED"
+        : "";
+  const assistants = `${clis.length} assistant${clis.length === 1 ? "" : "s"}`;
+  outro(
+    `Setup complete — ${policies.length} policies${customNote} · ${assistants}`,
+    { ok: true },
+    stdout,
+  );
   return { applied: true, scope, clis, policies };
 }