failproofai 0.0.6-beta.0 → 0.0.6-beta.2

package/.next/standalone/dist/cli.mjs

@@ -833,6 +833,60 @@ function warnGlobalPackageInstall(ctx) {
   }
   return allow();
 }
+function preferPackageManager(ctx) {
+  if (ctx.toolName !== "Bash")
+    return allow();
+  const cmd = getCommand(ctx);
+  if (!cmd)
+    return allow();
+  const allowed = ctx.params?.allowed ?? [];
+  if (allowed.length === 0)
+    return allow();
+  const allowedSet = new Set(allowed.map((a) => a.toLowerCase()));
+  const blocked = ctx.params?.blocked ?? [];
+  const allowedList = allowed.join(", ");
+  const segments = cmd.split(SEGMENT_SPLIT_RE);
+  for (const segment of segments) {
+    const trimmed = segment.trim();
+    if (!trimmed)
+      continue;
+    let segmentAllowed = false;
+    for (const manager of allowedSet) {
+      const patterns = PKG_MANAGER_DETECTORS[manager];
+      if (!patterns)
+        continue;
+      for (const pattern of patterns) {
+        if (pattern.test(trimmed)) {
+          segmentAllowed = true;
+          break;
+        }
+      }
+      if (segmentAllowed)
+        break;
+    }
+    if (segmentAllowed)
+      continue;
+    for (const [manager, patterns] of Object.entries(PKG_MANAGER_DETECTORS)) {
+      if (allowedSet.has(manager))
+        continue;
+      for (const pattern of patterns) {
+        if (pattern.test(trimmed)) {
+          return deny(`"${manager}" is not an allowed package manager. ` + `Allowed package managers for this project: ${allowedList}. ` + `Rewrite this command using an allowed package manager.`);
+        }
+      }
+    }
+    for (const name of blocked) {
+      const lower = name.toLowerCase();
+      if (allowedSet.has(lower))
+        continue;
+      const re = new RegExp(`\\b${lower.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}\\b`);
+      if (re.test(trimmed)) {
+        return deny(`"${lower}" is not an allowed package manager. ` + `Allowed package managers for this project: ${allowedList}. ` + `Rewrite this command using an allowed package manager.`);
+      }
+    }
+  }
+  return allow();
+}
 function warnBackgroundProcess(ctx) {
   if (ctx.toolName !== "Bash")
     return allow();
@@ -1011,7 +1065,7 @@ function requireCiGreenBeforeStop(ctx) {
     const allChecks = [...workflowRuns, ...thirdPartyChecks, ...commitStatuses];
     if (allChecks.length === 0)
       return allow(`No CI runs found for branch "${branch}".`);
-    const failing = allChecks.filter((r) => r.status === "completed" && r.conclusion !== "success" && r.conclusion !== "skipped");
+    const failing = allChecks.filter((r) => r.status === "completed" && r.conclusion !== "success" && r.conclusion !== "skipped" && r.conclusion !== "cancelled");
     if (failing.length > 0) {
       const names = failing.map((r) => `"${r.name}"`).join(", ");
       return deny(`CI checks are failing on branch "${branch}": ${names}. Fix the failing checks now.`);
@@ -1034,7 +1088,7 @@ function registerBuiltinPolicies(enabledNames) {
     }
   }
 }
-var SHELL_OPERATORS, SHELL_METACHAR_RE, JWT_RE, API_KEY_PATTERNS, CONNECTION_STRING_RE, PRIVATE_KEY_RE, BEARER_TOKEN_RE, SQL_TOOL_RE, DESTRUCTIVE_SQL_RE, DELETE_NO_WHERE_RE, SQL_WHERE_RE, SCHEMA_ALTER_RE, PUBLISH_CMD_RE, ENV_PRINTENV_RE, ECHO_ENV_RE, EXPORT_RE, PS_ENV_VAR_RE, PS_CHILDITEM_ENV_RE, DOTNET_GETENV_RE, CMD_ECHO_ENV_RE, ENV_FILE_PATH_RE, ENV_CMD_RE, SUDO_RE, PS_ELEVATION_RE, RUNAS_RE, CURL_PIPE_SH_RE, PS_WEB_PIPE_RE, FORCE_PUSH_RE, SECRET_FILE_RE, SECRET_FILE_ID_RSA_RE, SECRET_FILE_CREDENTIALS_RE, GIT_COMMIT_MERGE_RE, FAILPROOFAI_CLI_RE, FAILPROOFAI_UNINSTALL_RE, GIT_AMEND_RE, GIT_STASH_DROP_RE, GIT_ADD_ALL_RE, NPM_GLOBAL_RE, YARN_GLOBAL_RE, PNPM_GLOBAL_RE, BUN_GLOBAL_RE, CARGO_INSTALL_RE, PIP_SYSTEM_RE, NOHUP_RE, SCREEN_DETACH_RE, TMUX_DETACH_RE, DISOWN_RE, BACKGROUND_AMPERSAND_RE, gitBranchCache, READ_LIKE_CMDS, TOOL_CALL_TRACKER_MAX_BYTES = 65536, BUILTIN_POLICIES;
+var SHELL_OPERATORS, SHELL_METACHAR_RE, JWT_RE, API_KEY_PATTERNS, CONNECTION_STRING_RE, PRIVATE_KEY_RE, BEARER_TOKEN_RE, SQL_TOOL_RE, DESTRUCTIVE_SQL_RE, DELETE_NO_WHERE_RE, SQL_WHERE_RE, SCHEMA_ALTER_RE, PUBLISH_CMD_RE, ENV_PRINTENV_RE, ECHO_ENV_RE, EXPORT_RE, PS_ENV_VAR_RE, PS_CHILDITEM_ENV_RE, DOTNET_GETENV_RE, CMD_ECHO_ENV_RE, ENV_FILE_PATH_RE, ENV_CMD_RE, SUDO_RE, PS_ELEVATION_RE, RUNAS_RE, CURL_PIPE_SH_RE, PS_WEB_PIPE_RE, FORCE_PUSH_RE, SECRET_FILE_RE, SECRET_FILE_ID_RSA_RE, SECRET_FILE_CREDENTIALS_RE, GIT_COMMIT_MERGE_RE, FAILPROOFAI_CLI_RE, FAILPROOFAI_UNINSTALL_RE, GIT_AMEND_RE, GIT_STASH_DROP_RE, GIT_ADD_ALL_RE, NPM_GLOBAL_RE, YARN_GLOBAL_RE, PNPM_GLOBAL_RE, BUN_GLOBAL_RE, CARGO_INSTALL_RE, PIP_SYSTEM_RE, PKG_MANAGER_DETECTORS, NOHUP_RE, SCREEN_DETACH_RE, TMUX_DETACH_RE, DISOWN_RE, BACKGROUND_AMPERSAND_RE, gitBranchCache, READ_LIKE_CMDS, TOOL_CALL_TRACKER_MAX_BYTES = 65536, SEGMENT_SPLIT_RE, BUILTIN_POLICIES;
 var init_builtin_policies = __esm(() => {
   init_hook_logger();
   SHELL_OPERATORS = new Set(["&&", "||", "|", ";"]);
@@ -1090,6 +1144,18 @@ var init_builtin_policies = __esm(() => {
   BUN_GLOBAL_RE = /\bbun\s+(?:install|add)\b(?=.*(?:\s-g\b|--global\b))/;
   CARGO_INSTALL_RE = /\bcargo\s+install\b/;
   PIP_SYSTEM_RE = /\bpip(?:3)?\s+install\b(?=.*(?:--user\b|--break-system-packages\b))/;
+  PKG_MANAGER_DETECTORS = {
+    pip: [/\bpip\b/, /\bpip3\b/, /\bpython3?\s+-m\s+pip\b/],
+    npm: [/\bnpm\b/, /\bnpx\b/],
+    yarn: [/\byarn\b/],
+    pnpm: [/\bpnpm\b/, /\bpnpx\b/],
+    bun: [/\bbun\b/, /\bbunx\b/],
+    uv: [/\buv\b/],
+    poetry: [/\bpoetry\b/],
+    pipenv: [/\bpipenv\b/],
+    conda: [/\bconda\b/],
+    cargo: [/\bcargo\b/]
+  };
   NOHUP_RE = /\bnohup\s+\S/;
   SCREEN_DETACH_RE = /\bscreen\s+-[A-Za-z]*d[A-Za-z]*\b/;
   TMUX_DETACH_RE = /\btmux\s+(?:new-session|new)\b[^|&;]*-d\b/;
@@ -1097,6 +1163,7 @@ var init_builtin_policies = __esm(() => {
   BACKGROUND_AMPERSAND_RE = /(?<![&|])\s?&\s*(?:$|#|;)/;
   gitBranchCache = new Map;
   READ_LIKE_CMDS = /(?:^|;|&&|\|\||\|)\s*(?:ls|find|cat|head|tail|less|more|wc|file|stat|tree|du)\s/;
+  SEGMENT_SPLIT_RE = /\s*(?:&&|\|\||\||;)\s*/;
   BUILTIN_POLICIES = [
     {
       name: "sanitize-jwt",
@@ -1331,6 +1398,26 @@ var init_builtin_policies = __esm(() => {
       defaultEnabled: false,
       category: "Packages & System"
     },
+    {
+      name: "prefer-package-manager",
+      description: "Blocks non-preferred package managers and tells Claude to use an allowed one (e.g., uv instead of pip)",
+      fn: preferPackageManager,
+      match: { events: ["PreToolUse"], toolNames: ["Bash"] },
+      defaultEnabled: false,
+      category: "Packages & System",
+      params: {
+        allowed: {
+          type: "string[]",
+          description: "Allowed package manager names (e.g. ['uv', 'bun']). Any detected manager not in this list is blocked.",
+          default: []
+        },
+        blocked: {
+          type: "string[]",
+          description: "Additional manager names to block beyond the built-in list (e.g. ['pdm', 'pipx']).",
+          default: []
+        }
+      }
+    },
     {
       name: "warn-large-file-write",
       description: "Warn before writing files larger than 1MB (configurable via thresholdKb param)",
@@ -1968,7 +2055,7 @@ var init_hook_activity_store = __esm(() => {
 });
 
 // package.json
-var version2 = "0.0.6-beta.0";
+var version2 = "0.0.6-beta.2";
 var init_package = () => {};
 
 // src/posthog-key.ts
@@ -3260,7 +3347,7 @@ import { realpathSync as realpathSync2 } from "fs";
 import { dirname as dirname5, resolve as resolve8 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 // package.json
-var version = "0.0.6-beta.0";
+var version = "0.0.6-beta.2";
 
 // bin/failproofai.mjs
 if (!process.env.FAILPROOFAI_PACKAGE_ROOT) {