failproofai 0.0.15 → 1.0.0-beta.0

package/.next/standalone/crates/fpai-ipc/src/envelope.rs

@@ -0,0 +1,175 @@
+//! The JSON envelope carried inside each [`crate::framing`] frame.
+//!
+//! This mirrors the `(argv --hook <Event> --cli <cli>, stdin JSON payload)
+//! -> (stdout, stderr, exitCode)` contract every hook invocation already
+//! has today — see `src/hooks/handler.ts`'s `handleHookEvent`. The daemon
+//! adds nothing to that contract; it only relays it over a socket instead
+//! of a fresh process's argv/stdin/stdout.
+
+use serde::{Deserialize, Serialize};
+
+/// Bumped whenever a wire-incompatible change is made to either message
+/// enum below. The client treats any mismatch identically to "daemon
+/// unreachable" (see `docs/configuration.mdx` and the failproofaid plan) —
+/// there is no negotiation, only agree-or-fall-back.
+pub const PROTOCOL_VERSION: u32 = 1;
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+#[serde(tag = "type", rename_all = "camelCase")]
+pub enum ClientMessage {
+    /// Cheap liveness/handshake check — used by tests and by a client that
+    /// only wants to confirm a compatible daemon is listening.
+    #[serde(rename_all = "camelCase")]
+    Ping { protocol_version: u32 },
+    /// One hook evaluation request, corresponding 1:1 to one
+    /// `failproofai --hook <Event> --cli <cli>` invocation.
+    #[serde(rename_all = "camelCase")]
+    Hook {
+        protocol_version: u32,
+        hook_event: String,
+        cli: String,
+        /// The raw stdin payload the calling agent CLI wrote to the
+        /// one-shot `failproofai` process — forwarded verbatim.
+        stdin: String,
+        /// Best-effort cwd of the *originating* CLI process, not the
+        /// daemon's own cwd (the daemon is a single long-lived process; its
+        /// own `cwd` does not vary per request and must never be used to
+        /// resolve project config or custom policies).
+        cwd: Option<String>,
+    },
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+#[serde(tag = "type", rename_all = "camelCase")]
+pub enum ServerMessage {
+    #[serde(rename_all = "camelCase")]
+    Pong { protocol_version: u32 },
+    #[serde(rename_all = "camelCase")]
+    HookResult {
+        protocol_version: u32,
+        exit_code: i32,
+        stdout: String,
+        stderr: String,
+    },
+    /// The daemon accepted the connection and parsed the request, but could
+    /// not produce a verdict (e.g. the worker is down/hung). Distinct from
+    /// `HookResult` so a client can tell "ran and decided" apart from
+    /// "daemon couldn't evaluate at all" — the latter is what drives the
+    /// client's fail-closed path.
+    #[serde(rename_all = "camelCase")]
+    Error {
+        protocol_version: u32,
+        message: String,
+    },
+}
+
+impl ClientMessage {
+    pub fn protocol_version(&self) -> u32 {
+        match self {
+            ClientMessage::Ping { protocol_version } => *protocol_version,
+            ClientMessage::Hook {
+                protocol_version, ..
+            } => *protocol_version,
+        }
+    }
+}
+
+impl ServerMessage {
+    pub fn protocol_version(&self) -> u32 {
+        match self {
+            ServerMessage::Pong { protocol_version } => *protocol_version,
+            ServerMessage::HookResult {
+                protocol_version, ..
+            } => *protocol_version,
+            ServerMessage::Error {
+                protocol_version, ..
+            } => *protocol_version,
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn ping_serializes_with_a_type_tag() {
+        let msg = ClientMessage::Ping {
+            protocol_version: PROTOCOL_VERSION,
+        };
+        let json = serde_json::to_value(&msg).unwrap();
+        assert_eq!(json["type"], "ping");
+        assert_eq!(json["protocolVersion"], PROTOCOL_VERSION);
+    }
+
+    #[test]
+    fn hook_request_uses_camel_case_field_names_on_the_wire() {
+        let msg = ClientMessage::Hook {
+            protocol_version: PROTOCOL_VERSION,
+            hook_event: "PreToolUse".to_string(),
+            cli: "claude".to_string(),
+            stdin: "{}".to_string(),
+            cwd: Some("/repo".to_string()),
+        };
+        let json = serde_json::to_value(&msg).unwrap();
+        assert_eq!(json["type"], "hook");
+        assert_eq!(json["hookEvent"], "PreToolUse");
+        assert_eq!(json["cli"], "claude");
+        assert_eq!(json["cwd"], "/repo");
+    }
+
+    #[test]
+    fn hook_request_cwd_is_optional() {
+        let json = serde_json::json!({
+            "type": "hook",
+            "protocolVersion": 1,
+            "hookEvent": "Stop",
+            "cli": "codex",
+            "stdin": "{}"
+        });
+        let msg: ClientMessage = serde_json::from_value(json).unwrap();
+        match msg {
+            ClientMessage::Hook { cwd, .. } => assert_eq!(cwd, None),
+            _ => panic!("expected Hook variant"),
+        }
+    }
+
+    #[test]
+    fn unknown_message_type_fails_to_deserialize() {
+        let json = serde_json::json!({ "type": "bogus", "protocolVersion": 1 });
+        let result: Result<ClientMessage, _> = serde_json::from_value(json);
+        assert!(result.is_err());
+    }
+
+    #[test]
+    fn server_hook_result_round_trips() {
+        let msg = ServerMessage::HookResult {
+            protocol_version: PROTOCOL_VERSION,
+            exit_code: 2,
+            stdout: String::new(),
+            stderr: "blocked".to_string(),
+        };
+        let json = serde_json::to_string(&msg).unwrap();
+        let decoded: ServerMessage = serde_json::from_str(&json).unwrap();
+        assert_eq!(decoded, msg);
+    }
+
+    #[test]
+    fn protocol_version_accessor_matches_every_variant() {
+        assert_eq!(
+            ClientMessage::Ping {
+                protocol_version: 7
+            }
+            .protocol_version(),
+            7
+        );
+        assert_eq!(
+            ServerMessage::Error {
+                protocol_version: 9,
+                message: "x".to_string()
+            }
+            .protocol_version(),
+            9
+        );
+    }
+}

package/.next/standalone/crates/fpai-ipc/src/framing.rs

@@ -0,0 +1,177 @@
+//! Length-prefixed JSON framing shared by the daemon and every client of it.
+//!
+//! Frame = 4-byte big-endian `u32` byte length, followed by that many bytes
+//! of UTF-8 JSON. One frame in, one frame out, per connection — the daemon
+//! never keeps a connection open across multiple logical requests, so there
+//! is no need for a request-id-multiplexed protocol.
+
+use serde::Serialize;
+use serde::de::DeserializeOwned;
+use std::io::{self, Read, Write};
+
+/// Hard cap on a single frame's declared length. A hook payload is at most
+/// 1 MiB (see `handler.ts`'s own stdin cap); 16 MiB leaves headroom without
+/// letting a corrupt or hostile length prefix trigger an unbounded
+/// allocation before a single byte of the body has even been read.
+pub const MAX_FRAME_LEN: u32 = 16 * 1024 * 1024;
+
+#[derive(Debug)]
+pub enum FramingError {
+    Io(io::Error),
+    FrameTooLarge { declared: u32, max: u32 },
+    Json(serde_json::Error),
+}
+
+impl std::fmt::Display for FramingError {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        match self {
+            FramingError::Io(e) => write!(f, "io error: {e}"),
+            FramingError::FrameTooLarge { declared, max } => {
+                write!(f, "frame length {declared} exceeds max {max}")
+            }
+            FramingError::Json(e) => write!(f, "invalid JSON frame: {e}"),
+        }
+    }
+}
+
+impl std::error::Error for FramingError {}
+
+impl From<io::Error> for FramingError {
+    fn from(e: io::Error) -> Self {
+        FramingError::Io(e)
+    }
+}
+
+impl From<serde_json::Error> for FramingError {
+    fn from(e: serde_json::Error) -> Self {
+        FramingError::Json(e)
+    }
+}
+
+/// Serializes `value` to JSON and writes it as one length-prefixed frame.
+pub fn write_message<W: Write, T: Serialize>(
+    writer: &mut W,
+    value: &T,
+) -> Result<(), FramingError> {
+    let body = serde_json::to_vec(value)?;
+    let len = u32::try_from(body.len()).map_err(|_| FramingError::FrameTooLarge {
+        declared: u32::MAX,
+        max: MAX_FRAME_LEN,
+    })?;
+    if len > MAX_FRAME_LEN {
+        return Err(FramingError::FrameTooLarge {
+            declared: len,
+            max: MAX_FRAME_LEN,
+        });
+    }
+    writer.write_all(&len.to_be_bytes())?;
+    writer.write_all(&body)?;
+    writer.flush()?;
+    Ok(())
+}
+
+/// Reads one length-prefixed frame and deserializes it as `T`. Rejects the
+/// frame (without allocating a body buffer) if the declared length exceeds
+/// [`MAX_FRAME_LEN`], so a corrupt or adversarial length prefix can't be
+/// used to force a large allocation.
+pub fn read_message<R: Read, T: DeserializeOwned>(reader: &mut R) -> Result<T, FramingError> {
+    let mut len_bytes = [0u8; 4];
+    reader.read_exact(&mut len_bytes)?;
+    let len = u32::from_be_bytes(len_bytes);
+    if len > MAX_FRAME_LEN {
+        return Err(FramingError::FrameTooLarge {
+            declared: len,
+            max: MAX_FRAME_LEN,
+        });
+    }
+    let mut body = vec![0u8; len as usize];
+    reader.read_exact(&mut body)?;
+    let value = serde_json::from_slice(&body)?;
+    Ok(value)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use serde::Deserialize;
+    use std::io::Cursor;
+
+    #[derive(Debug, Serialize, Deserialize, PartialEq)]
+    struct Sample {
+        a: u32,
+        b: String,
+    }
+
+    #[test]
+    fn round_trips_a_simple_value() {
+        let mut buf = Vec::new();
+        let msg = Sample {
+            a: 42,
+            b: "hello".to_string(),
+        };
+        write_message(&mut buf, &msg).unwrap();
+        let mut cursor = Cursor::new(buf);
+        let decoded: Sample = read_message(&mut cursor).unwrap();
+        assert_eq!(decoded, msg);
+    }
+
+    #[test]
+    fn round_trips_empty_string_fields() {
+        let mut buf = Vec::new();
+        let msg = Sample {
+            a: 0,
+            b: String::new(),
+        };
+        write_message(&mut buf, &msg).unwrap();
+        let mut cursor = Cursor::new(buf);
+        let decoded: Sample = read_message(&mut cursor).unwrap();
+        assert_eq!(decoded, msg);
+    }
+
+    #[test]
+    fn rejects_a_declared_length_over_the_cap_without_reading_a_body() {
+        let mut buf = Vec::new();
+        buf.extend_from_slice(&(MAX_FRAME_LEN + 1).to_be_bytes());
+        // Deliberately no body bytes follow — if `read_message` tried to
+        // allocate/read the declared length before checking the cap, this
+        // would hang or panic on the short read instead of erroring cleanly.
+        let mut cursor = Cursor::new(buf);
+        let result: Result<Sample, _> = read_message(&mut cursor);
+        assert!(matches!(result, Err(FramingError::FrameTooLarge { .. })));
+    }
+
+    #[test]
+    fn refuses_to_write_a_frame_over_the_cap() {
+        #[derive(Serialize)]
+        struct Big {
+            data: String,
+        }
+        let big = Big {
+            data: "x".repeat((MAX_FRAME_LEN as usize) + 1),
+        };
+        let mut buf = Vec::new();
+        let result = write_message(&mut buf, &big);
+        assert!(matches!(result, Err(FramingError::FrameTooLarge { .. })));
+    }
+
+    #[test]
+    fn rejects_truncated_frames() {
+        let mut buf = Vec::new();
+        buf.extend_from_slice(&10u32.to_be_bytes());
+        buf.extend_from_slice(b"short"); // fewer than the declared 10 bytes
+        let mut cursor = Cursor::new(buf);
+        let result: Result<Sample, _> = read_message(&mut cursor);
+        assert!(matches!(result, Err(FramingError::Io(_))));
+    }
+
+    #[test]
+    fn rejects_malformed_json_inside_a_valid_frame() {
+        let mut buf = Vec::new();
+        let body = b"not json";
+        buf.extend_from_slice(&(body.len() as u32).to_be_bytes());
+        buf.extend_from_slice(body);
+        let mut cursor = Cursor::new(buf);
+        let result: Result<Sample, _> = read_message(&mut cursor);
+        assert!(matches!(result, Err(FramingError::Json(_))));
+    }
+}

package/.next/standalone/crates/fpai-ipc/src/lib.rs

@@ -0,0 +1,10 @@
+//! Wire protocol shared by `failproofaid` and every client/test that talks
+//! to it: message framing, the JSON envelope, and Unix-socket peer
+//! verification.
+
+pub mod envelope;
+pub mod framing;
+pub mod peer;
+
+pub use envelope::{ClientMessage, PROTOCOL_VERSION, ServerMessage};
+pub use framing::{FramingError, MAX_FRAME_LEN, read_message, write_message};

package/.next/standalone/crates/fpai-ipc/src/peer.rs

@@ -0,0 +1,80 @@
+//! Verifies that a Unix socket peer is running as the same OS user as this
+//! process.
+//!
+//! failproofaid is user-scope only (see the plan: "no elevation, the daemon
+//! spawns the worker because the daemon already runs as the user"): the
+//! socket directory is `0700` and the socket file `0600`, which is the
+//! actual access-control boundary. This check is a second, defense-in-depth
+//! layer against the narrow window between a socket file existing and its
+//! permissions having been fully applied, and against misconfigured
+//! filesystems (e.g. a shared mount with unexpectedly loose permissions).
+//! It is not a stronger security boundary than the filesystem permissions
+//! already provide — same OS user can always reach this daemon regardless.
+
+use std::io;
+use std::os::unix::io::AsRawFd;
+use std::os::unix::net::UnixStream;
+
+/// Returns the effective UID of the process on the other end of `stream`.
+#[cfg(target_os = "linux")]
+pub fn peer_uid(stream: &UnixStream) -> io::Result<u32> {
+    use std::mem;
+
+    let fd = stream.as_raw_fd();
+    let mut cred: libc::ucred = unsafe { mem::zeroed() };
+    let mut len = mem::size_of::<libc::ucred>() as libc::socklen_t;
+
+    let ret = unsafe {
+        libc::getsockopt(
+            fd,
+            libc::SOL_SOCKET,
+            libc::SO_PEERCRED,
+            &mut cred as *mut libc::ucred as *mut libc::c_void,
+            &mut len,
+        )
+    };
+    if ret != 0 {
+        return Err(io::Error::last_os_error());
+    }
+    Ok(cred.uid)
+}
+
+/// Returns the effective UID of the process on the other end of `stream`.
+#[cfg(target_os = "macos")]
+pub fn peer_uid(stream: &UnixStream) -> io::Result<u32> {
+    let fd = stream.as_raw_fd();
+    let mut uid: libc::uid_t = 0;
+    let mut gid: libc::gid_t = 0;
+
+    let ret = unsafe { libc::getpeereid(fd, &mut uid, &mut gid) };
+    if ret != 0 {
+        return Err(io::Error::last_os_error());
+    }
+    Ok(uid)
+}
+
+/// Returns this process's own effective UID, for comparison against
+/// [`peer_uid`].
+pub fn own_uid() -> u32 {
+    unsafe { libc::geteuid() }
+}
+
+/// `true` if `stream`'s peer is running as this process's own OS user.
+pub fn is_same_user(stream: &UnixStream) -> io::Result<bool> {
+    Ok(peer_uid(stream)? == own_uid())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn a_local_socketpair_peer_is_always_the_same_user() {
+        // socketpair() connects two ends of the same process — the peer
+        // UID must equal our own, on every CI runner regardless of who's
+        // executing the test.
+        let (a, _b) = UnixStream::pair().unwrap();
+        assert!(is_same_user(&a).unwrap());
+        assert_eq!(peer_uid(&a).unwrap(), own_uid());
+    }
+}

package/.next/standalone/package.json

@@ -1,9 +1,10 @@
 {
   "name": "failproofai",
-  "version": "0.0.15",
+  "version": "1.0.0-beta.0",
   "description": "The easiest way to manage policies that keep your AI agents reliable, on-task, and running autonomously — for Claude Code & the Agents SDK",
   "bin": {
-    "failproofai": "./dist/cli.mjs"
+    "failproofai": "./dist/cli.mjs",
+    "failproofaid": "./bin/failproofaid-shim.mjs"
   },
   "files": [
     "bin/",
@@ -24,7 +25,8 @@
     "predev": "bun run build:cli && bun link",
     "dev": "FAILPROOFAI_TELEMETRY_DISABLED=1 bun scripts/dev.ts --port 8020",
     "build:cli": "bun build --target=node --format=esm --outfile=dist/cli.mjs bin/failproofai.mjs --external posthog-node --external sql.js && node -e \"const fs=require('fs');const c=fs.readFileSync('dist/cli.mjs','utf8');fs.writeFileSync('dist/cli.mjs',c.replace('#!/usr/bin/env bun','#!/usr/bin/env node').replace('// @bun\\n',''))\"",
-    "build": "bun build --target=node --format=cjs --outfile=dist/index.js src/index.ts && bun run build:cli && bun --bun next build && node -e \"const {cpSync}=require('fs');cpSync('.next/static','.next/standalone/.next/static',{recursive:true});\" && node scripts/prune-standalone.mjs",
+    "build:worker": "bun build --target=node --format=esm --outfile=dist/worker.mjs bin/failproofai-worker.mjs --external posthog-node --external sql.js",
+    "build": "bun build --target=node --format=cjs --outfile=dist/index.js src/index.ts && bun run build:cli && bun run build:worker && bun --bun next build && node -e \"const {cpSync}=require('fs');cpSync('.next/static','.next/standalone/.next/static',{recursive:true});\" && node scripts/prune-standalone.mjs",
     "prestart": "bun run build:cli && bun link",
     "start": "FAILPROOFAI_TELEMETRY_DISABLED=1 bun scripts/start.ts",
     "test": "vitest",

package/.next/standalone/rust-toolchain.toml

@@ -0,0 +1,4 @@
+[toolchain]
+channel = "1.97.1"
+components = ["rustfmt", "clippy"]
+profile = "minimal"

package/.next/standalone/server.js

@@ -9,7 +9,7 @@ const currentPort = parseInt(process.env.PORT, 10) || 3000
 const hostname = process.env.HOSTNAME || '0.0.0.0'
 
 let keepAliveTimeout = parseInt(process.env.KEEP_ALIVE_TIMEOUT, 10)
-const nextConfig = {"env":{"NEXT_PUBLIC_APP_VERSION":"0.0.15"},"typescript":{"ignoreBuildErrors":false},"typedRoutes":false,"distDir":"./.next","cleanDistDir":true,"assetPrefix":"","cacheMaxMemorySize":52428800,"configOrigin":"next.config.ts","useFileSystemPublicRoutes":true,"generateEtags":true,"pageExtensions":["tsx","ts","jsx","js"],"poweredByHeader":true,"compress":true,"images":{"deviceSizes":[640,750,828,1080,1200,1920,2048,3840],"imageSizes":[32,48,64,96,128,256,384],"path":"/_next/image","loader":"default","loaderFile":"","domains":[],"disableStaticImages":false,"minimumCacheTTL":14400,"formats":["image/webp"],"maximumRedirects":3,"maximumResponseBody":50000000,"dangerouslyAllowLocalIP":false,"dangerouslyAllowSVG":false,"contentSecurityPolicy":"script-src 'none'; frame-src 'none'; sandbox;","contentDispositionType":"attachment","localPatterns":[{"pathname":"**","search":""}],"remotePatterns":[],"qualities":[75],"unoptimized":true,"customCacheHandler":false},"devIndicators":{"position":"bottom-left"},"onDemandEntries":{"maxInactiveAge":60000,"pagesBufferLength":5},"basePath":"","sassOptions":{},"trailingSlash":false,"i18n":null,"productionBrowserSourceMaps":false,"excludeDefaultMomentLocales":true,"reactProductionProfiling":false,"reactStrictMode":null,"reactMaxHeadersLength":6000,"httpAgentOptions":{"keepAlive":true},"logging":{"serverFunctions":true,"browserToTerminal":"warn"},"compiler":{},"expireTime":31536000,"staticPageGenerationTimeout":60,"output":"standalone","modularizeImports":{"@mui/icons-material":{"transform":"@mui/icons-material/{{member}}"},"lodash":{"transform":"lodash/{{member}}"}},"outputFileTracingRoot":"/home/runner/work/failproofai/failproofai","cacheComponents":false,"cacheLife":{"default":{"stale":300,"revalidate":900,"expire":4294967294},"seconds":{"stale":30,"revalidate":1,"expire":60},"minutes":{"stale":300,"revalidate":60,"expire":3600},"hours":{"stale":300,"revalidate":3600,"expire":86400},"days":{"stale":300,"revalidate":86400,"expire":604800},"weeks":{"stale":300,"revalidate":604800,"expire":2592000},"max":{"stale":300,"revalidate":2592000,"expire":31536000}},"cacheHandlers":{},"experimental":{"appNewScrollHandler":false,"useSkewCookie":false,"cssChunking":true,"multiZoneDraftMode":false,"appNavFailHandling":false,"prerenderEarlyExit":true,"serverMinification":true,"linkNoTouchStart":false,"caseSensitiveRoutes":false,"cachedNavigations":false,"partialFallbacks":false,"dynamicOnHover":false,"varyParams":false,"prefetchInlining":false,"preloadEntriesOnStart":true,"clientRouterFilter":true,"clientRouterFilterRedirects":false,"fetchCacheKeyPrefix":"","proxyPrefetch":"flexible","optimisticClientCache":true,"manualClientBasePath":false,"cpus":3,"memoryBasedWorkersCount":false,"imgOptConcurrency":null,"imgOptTimeoutInSeconds":7,"imgOptMaxInputPixels":268402689,"imgOptSequentialRead":null,"isrFlushToDisk":true,"workerThreads":false,"optimizeCss":false,"nextScriptWorkers":false,"scrollRestoration":false,"externalDir":false,"disableOptimizedLoading":false,"gzipSize":true,"craCompat":false,"esmExternals":true,"fullySpecified":false,"swcTraceProfiling":false,"forceSwcTransforms":false,"largePageDataBytes":128000,"typedEnv":false,"parallelServerCompiles":false,"parallelServerBuildTraces":false,"ppr":false,"authInterrupts":false,"webpackMemoryOptimizations":false,"optimizeServerReact":true,"strictRouteTypes":false,"useTypeScriptCli":false,"viewTransition":false,"removeUncaughtErrorAndRejectionListeners":false,"validateRSCRequestHeaders":false,"staleTimes":{"dynamic":0,"static":300},"reactDebugChannel":true,"serverComponentsHmrCache":true,"staticGenerationMaxConcurrency":8,"staticGenerationMinPagesPerWorker":25,"transitionIndicator":false,"gestureTransition":false,"inlineCss":false,"useCache":false,"globalNotFound":false,"browserDebugInfoInTerminal":"warn","lockDistDir":true,"proxyClientMaxBodySize":10485760,"hideLogsAfterAbort":false,"mcpServer":true,"turbopackFileSystemCacheForDev":true,"turbopackFileSystemCacheForBuild":false,"turbopackInferModuleSideEffects":true,"turbopackPluginRuntimeStrategy":"childProcesses","optimizePackageImports":["lucide-react","date-fns","lodash-es","ramda","antd","react-bootstrap","ahooks","@ant-design/icons","@headlessui/react","@headlessui-float/react","@heroicons/react/20/solid","@heroicons/react/24/solid","@heroicons/react/24/outline","@visx/visx","@tremor/react","rxjs","@mui/material","@mui/icons-material","recharts","react-use","effect","@effect/schema","@effect/platform","@effect/platform-node","@effect/platform-browser","@effect/platform-bun","@effect/sql","@effect/sql-mssql","@effect/sql-mysql2","@effect/sql-pg","@effect/sql-sqlite-node","@effect/sql-sqlite-bun","@effect/sql-sqlite-wasm","@effect/sql-sqlite-react-native","@effect/rpc","@effect/rpc-http","@effect/typeclass","@effect/experimental","@effect/opentelemetry","@material-ui/core","@material-ui/icons","@tabler/icons-react","mui-core","react-icons/ai","react-icons/bi","react-icons/bs","react-icons/cg","react-icons/ci","react-icons/di","react-icons/fa","react-icons/fa6","react-icons/fc","react-icons/fi","react-icons/gi","react-icons/go","react-icons/gr","react-icons/hi","react-icons/hi2","react-icons/im","react-icons/io","react-icons/io5","react-icons/lia","react-icons/lib","react-icons/lu","react-icons/md","react-icons/pi","react-icons/ri","react-icons/rx","react-icons/si","react-icons/sl","react-icons/tb","react-icons/tfi","react-icons/ti","react-icons/vsc","react-icons/wi"],"trustHostHeader":false,"isExperimentalCompile":false},"htmlLimitedBots":"[\\w-]+-Google|Google-[\\w-]+|Chrome-Lighthouse|Slurp|DuckDuckBot|baiduspider|yandex|sogou|bitlybot|tumblr|vkShare|quora link preview|redditbot|ia_archiver|Bingbot|BingPreview|applebot|facebookexternalhit|facebookcatalog|Twitterbot|LinkedInBot|Slackbot|Discordbot|WhatsApp|SkypeUriPreview|Yeti|googleweblight","bundlePagesRouterDependencies":false,"configFileName":"next.config.ts","outputFileTracingExcludes":{"*":["node_modules/@img/**","node_modules/sharp/**"]},"turbopack":{"root":"/home/runner/work/failproofai/failproofai"},"distDirRoot":".next"}
+const nextConfig = {"env":{"NEXT_PUBLIC_APP_VERSION":"1.0.0-beta.0"},"typescript":{"ignoreBuildErrors":false},"typedRoutes":false,"distDir":"./.next","cleanDistDir":true,"assetPrefix":"","cacheMaxMemorySize":52428800,"configOrigin":"next.config.ts","useFileSystemPublicRoutes":true,"generateEtags":true,"pageExtensions":["tsx","ts","jsx","js"],"poweredByHeader":true,"compress":true,"images":{"deviceSizes":[640,750,828,1080,1200,1920,2048,3840],"imageSizes":[32,48,64,96,128,256,384],"path":"/_next/image","loader":"default","loaderFile":"","domains":[],"disableStaticImages":false,"minimumCacheTTL":14400,"formats":["image/webp"],"maximumRedirects":3,"maximumResponseBody":50000000,"dangerouslyAllowLocalIP":false,"dangerouslyAllowSVG":false,"contentSecurityPolicy":"script-src 'none'; frame-src 'none'; sandbox;","contentDispositionType":"attachment","localPatterns":[{"pathname":"**","search":""}],"remotePatterns":[],"qualities":[75],"unoptimized":true,"customCacheHandler":false},"devIndicators":{"position":"bottom-left"},"onDemandEntries":{"maxInactiveAge":60000,"pagesBufferLength":5},"basePath":"","sassOptions":{},"trailingSlash":false,"i18n":null,"productionBrowserSourceMaps":false,"excludeDefaultMomentLocales":true,"reactProductionProfiling":false,"reactStrictMode":null,"reactMaxHeadersLength":6000,"httpAgentOptions":{"keepAlive":true},"logging":{"serverFunctions":true,"browserToTerminal":"warn"},"compiler":{},"expireTime":31536000,"staticPageGenerationTimeout":60,"output":"standalone","modularizeImports":{"@mui/icons-material":{"transform":"@mui/icons-material/{{member}}"},"lodash":{"transform":"lodash/{{member}}"}},"outputFileTracingRoot":"/home/runner/work/failproofai/failproofai","cacheComponents":false,"cacheLife":{"default":{"stale":300,"revalidate":900,"expire":4294967294},"seconds":{"stale":30,"revalidate":1,"expire":60},"minutes":{"stale":300,"revalidate":60,"expire":3600},"hours":{"stale":300,"revalidate":3600,"expire":86400},"days":{"stale":300,"revalidate":86400,"expire":604800},"weeks":{"stale":300,"revalidate":604800,"expire":2592000},"max":{"stale":300,"revalidate":2592000,"expire":31536000}},"cacheHandlers":{},"experimental":{"appNewScrollHandler":false,"useSkewCookie":false,"cssChunking":true,"multiZoneDraftMode":false,"appNavFailHandling":false,"prerenderEarlyExit":true,"serverMinification":true,"linkNoTouchStart":false,"caseSensitiveRoutes":false,"cachedNavigations":false,"partialFallbacks":false,"dynamicOnHover":false,"varyParams":false,"prefetchInlining":false,"preloadEntriesOnStart":true,"clientRouterFilter":true,"clientRouterFilterRedirects":false,"fetchCacheKeyPrefix":"","proxyPrefetch":"flexible","optimisticClientCache":true,"manualClientBasePath":false,"cpus":3,"memoryBasedWorkersCount":false,"imgOptConcurrency":null,"imgOptTimeoutInSeconds":7,"imgOptMaxInputPixels":268402689,"imgOptSequentialRead":null,"isrFlushToDisk":true,"workerThreads":false,"optimizeCss":false,"nextScriptWorkers":false,"scrollRestoration":false,"externalDir":false,"disableOptimizedLoading":false,"gzipSize":true,"craCompat":false,"esmExternals":true,"fullySpecified":false,"swcTraceProfiling":false,"forceSwcTransforms":false,"largePageDataBytes":128000,"typedEnv":false,"parallelServerCompiles":false,"parallelServerBuildTraces":false,"ppr":false,"authInterrupts":false,"webpackMemoryOptimizations":false,"optimizeServerReact":true,"strictRouteTypes":false,"useTypeScriptCli":false,"viewTransition":false,"removeUncaughtErrorAndRejectionListeners":false,"validateRSCRequestHeaders":false,"staleTimes":{"dynamic":0,"static":300},"reactDebugChannel":true,"serverComponentsHmrCache":true,"staticGenerationMaxConcurrency":8,"staticGenerationMinPagesPerWorker":25,"transitionIndicator":false,"gestureTransition":false,"inlineCss":false,"useCache":false,"globalNotFound":false,"browserDebugInfoInTerminal":"warn","lockDistDir":true,"proxyClientMaxBodySize":10485760,"hideLogsAfterAbort":false,"mcpServer":true,"turbopackFileSystemCacheForDev":true,"turbopackFileSystemCacheForBuild":false,"turbopackInferModuleSideEffects":true,"turbopackPluginRuntimeStrategy":"childProcesses","optimizePackageImports":["lucide-react","date-fns","lodash-es","ramda","antd","react-bootstrap","ahooks","@ant-design/icons","@headlessui/react","@headlessui-float/react","@heroicons/react/20/solid","@heroicons/react/24/solid","@heroicons/react/24/outline","@visx/visx","@tremor/react","rxjs","@mui/material","@mui/icons-material","recharts","react-use","effect","@effect/schema","@effect/platform","@effect/platform-node","@effect/platform-browser","@effect/platform-bun","@effect/sql","@effect/sql-mssql","@effect/sql-mysql2","@effect/sql-pg","@effect/sql-sqlite-node","@effect/sql-sqlite-bun","@effect/sql-sqlite-wasm","@effect/sql-sqlite-react-native","@effect/rpc","@effect/rpc-http","@effect/typeclass","@effect/experimental","@effect/opentelemetry","@material-ui/core","@material-ui/icons","@tabler/icons-react","mui-core","react-icons/ai","react-icons/bi","react-icons/bs","react-icons/cg","react-icons/ci","react-icons/di","react-icons/fa","react-icons/fa6","react-icons/fc","react-icons/fi","react-icons/gi","react-icons/go","react-icons/gr","react-icons/hi","react-icons/hi2","react-icons/im","react-icons/io","react-icons/io5","react-icons/lia","react-icons/lib","react-icons/lu","react-icons/md","react-icons/pi","react-icons/ri","react-icons/rx","react-icons/si","react-icons/sl","react-icons/tb","react-icons/tfi","react-icons/ti","react-icons/vsc","react-icons/wi"],"trustHostHeader":false,"isExperimentalCompile":false},"htmlLimitedBots":"[\\w-]+-Google|Google-[\\w-]+|Chrome-Lighthouse|Slurp|DuckDuckBot|baiduspider|yandex|sogou|bitlybot|tumblr|vkShare|quora link preview|redditbot|ia_archiver|Bingbot|BingPreview|applebot|facebookexternalhit|facebookcatalog|Twitterbot|LinkedInBot|Slackbot|Discordbot|WhatsApp|SkypeUriPreview|Yeti|googleweblight","bundlePagesRouterDependencies":false,"configFileName":"next.config.ts","outputFileTracingExcludes":{"*":["node_modules/@img/**","node_modules/sharp/**"]},"turbopack":{"root":"/home/runner/work/failproofai/failproofai"},"distDirRoot":".next"}
 
 process.env.__NEXT_PRIVATE_STANDALONE_CONFIG = JSON.stringify(nextConfig)
 

package/bin/failproofai-worker.mjs

@@ -0,0 +1,51 @@
+#!/usr/bin/env node
+/**
+ * failproofai-worker — the warm worker process failproofaid (the Rust
+ * supervisor) spawns and supervises. NOT a user-facing entry point (no
+ * "bin" entry in package.json) — the daemon always invokes this directly by
+ * path, either `node bin/failproofai-worker.mjs` (dev, via
+ * FAILPROOFAI_WORKER_CMD) or the built `dist/worker.mjs` in production.
+ *
+ * Reads FAILPROOFAI_WORKER_SOCKET for where to listen — the daemon resolves
+ * and passes this; the worker never guesses a path of its own.
+ */
+import { realpathSync } from "node:fs";
+import { dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+if (!process.env.FAILPROOFAI_PACKAGE_ROOT) {
+  process.env.FAILPROOFAI_PACKAGE_ROOT = resolve(
+    dirname(realpathSync(fileURLToPath(import.meta.url))),
+    ".."
+  );
+}
+
+if (!process.env.FAILPROOFAI_DIST_PATH) {
+  process.env.FAILPROOFAI_DIST_PATH = resolve(
+    dirname(realpathSync(fileURLToPath(import.meta.url))),
+    "..",
+    "dist"
+  );
+}
+
+const socketPath = process.env.FAILPROOFAI_WORKER_SOCKET;
+if (!socketPath) {
+  console.error("[failproofai-worker] FAILPROOFAI_WORKER_SOCKET is not set");
+  process.exit(1);
+}
+
+const { startWorkerServer } = await import("../src/hooks/worker-server");
+const server = startWorkerServer(socketPath);
+
+server.on("error", (err) => {
+  console.error(`[failproofai-worker] server error: ${err.message}`);
+  process.exit(1);
+});
+
+console.error(`[failproofai-worker] listening on ${socketPath}`);
+
+function shutdown() {
+  server.close(() => process.exit(0));
+}
+process.on("SIGTERM", shutdown);
+process.on("SIGINT", shutdown);

package/bin/failproofai.mjs

@@ -62,6 +62,32 @@ async function track(name, props) {
   } catch {}
 }
 
+/**
+ * Exits only once stdout/stderr have actually been flushed.
+ *
+ * Under every agent CLI a hook's stdout is a pipe, and pipe writes in Node
+ * are asynchronous — `process.exit()` terminates without draining what's
+ * still buffered. That stdout carries the decision payload, so a truncated
+ * write silently changes the decision the CLI observes; on the fail-closed
+ * path it would drop the deny reason entirely and leave the CLI with a bare
+ * exit code and no explanation.
+ */
+async function exitAfterFlush(code) {
+  const drain = (stream) =>
+    new Promise((resolveDrain) => {
+      // A zero-length write's callback still queues behind everything
+      // already buffered, so this resolves after the real output lands.
+      if (stream.writableLength === 0 || stream.destroyed) resolveDrain();
+      else stream.write("", () => resolveDrain());
+    });
+  try {
+    await Promise.all([drain(process.stdout), drain(process.stderr)]);
+  } catch {
+    // Never let a flush problem swallow the exit code itself.
+  }
+  process.exit(code);
+}
+
 // --hook <event> [--cli <name>] — called by an agent CLI hook; fast path, outside
 // runCli() because it has its own exit code contract with the calling agent.
 const hookIdx = args.indexOf("--hook");
@@ -94,11 +120,52 @@ if (hookIdx >= 0) {
       ? cliArg
       : "claude";
   try {
+    // Daemon-aware path — inert (and this whole block skipped) on every
+    // machine until `failproofai config` has installed failproofaid AND
+    // written the daemonConfigured marker (Stage 4). Until then this is
+    // byte-for-byte the same handleHookEvent(...) call below.
+    const { isDaemonConfigured, tryDaemonHook } = await import("../src/hooks/daemon-client");
+    if (isDaemonConfigured()) {
+      const { readStdinPayload } = await import("../src/hooks/read-stdin");
+      const { evaluateHookEvent } = await import("../src/hooks/handler");
+      const stdinRead = await readStdinPayload();
+
+      const daemonResult = await tryDaemonHook({
+        hookEvent: eventType,
+        cli,
+        stdin: stdinRead.payload,
+        // The client's own cwd IS the originating CLI session's cwd — this
+        // process is spawned fresh, at that location, by the calling agent
+        // CLI's own hook mechanism. See daemon-client.ts / PROTOCOL.md.
+        cwd: process.cwd(),
+      });
+
+      // No silent fallback to in-process evaluation here: this machine was
+      // explicitly configured to run through the daemon, so an unreachable
+      // daemon fails closed instead — a loud, correctly-shaped deny (real
+      // per-CLI response shaping, not a generic denial) rather than a
+      // silent downgrade. See the plan's "Confirmed scope decisions".
+      const result =
+        daemonResult ??
+        (await evaluateHookEvent(eventType, cli, stdinRead.payload, {
+          forceDecision: {
+            decision: "deny",
+            reason:
+              "failproofaid could not be reached. This machine is configured to run hooks through it " +
+              "— check the daemon (see `failproofai config`) rather than retrying blindly.",
+          },
+        }));
+
+      if (result.stdout) process.stdout.write(result.stdout);
+      if (result.stderr) process.stderr.write(result.stderr);
+      await exitAfterFlush(result.exitCode);
+    }
+
     const { handleHookEvent } = await import("../src/hooks/handler");
     const exitCode = await handleHookEvent(eventType, cli);
     // handleHookEvent already flushes its own telemetry before returning; this
     // is the normal, reliable exit.
-    process.exit(exitCode);
+    await exitAfterFlush(exitCode);
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
     await track("hook_dispatch_error", {