failproofai 0.0.6-beta.2 → 0.0.6-beta.4

package/.next/standalone/README.md

@@ -1,301 +0,0 @@
-```
-    ______      _ __                       ____   ___    ____
-   / ____/___ _(_) /___  _________  ____  / __/  /   |  /  _/
-  / /_  / __ `/ / / __ \/ ___/ __ \/ __ \/ /_   / /| |  / /
- / __/ / /_/ / / / /_/ / /  / /_/ / /_/ / __/  / ___ |_/ /
-/_/    \__,_/_/_/ .___/_/   \____/\____/_/    /_/  |_/___/
-               /_/
-```
-
-# Failproof AI
-
-[![Docs](https://img.shields.io/badge/docs-befailproof.ai-002CA7?style=flat-square)](https://befailproof.ai)
-[![npm](https://img.shields.io/npm/v/failproofai?style=flat-square&color=CB3837)](https://www.npmjs.com/package/failproofai)
-[![License](https://img.shields.io/badge/license-MIT%20%2B%20Commons%20Clause-blue?style=flat-square)](LICENSE)
-[![CI](https://img.shields.io/github/actions/workflow/status/exospherehost/failproofai/ci.yml?branch=main&style=flat-square&label=CI)](https://github.com/exospherehost/failproofai/actions)
-[![Slack](https://img.shields.io/badge/Slack-join%20us-4A154B?style=flat-square&logo=slack)](https://join.slack.com/t/failproofai/shared_invite/zt-3v63b7k5e-O3NBHmj8X6n9gZSGDx6ggQ)
-
-**Translations**: [简体中文](docs/i18n/README.zh.md) | [日本語](docs/i18n/README.ja.md) | [한국어](docs/i18n/README.ko.md) | [Español](docs/i18n/README.es.md) | [Português](docs/i18n/README.pt-br.md) | [Deutsch](docs/i18n/README.de.md) | [Français](docs/i18n/README.fr.md) | [Русский](docs/i18n/README.ru.md) | [हिन्दी](docs/i18n/README.hi.md) | [Türkçe](docs/i18n/README.tr.md) | [Tiếng Việt](docs/i18n/README.vi.md) | [Italiano](docs/i18n/README.it.md) | [العربية](docs/i18n/README.ar.md) | [עברית](docs/i18n/README.he.md)
-
-The easiest way to manage policies that keep your AI agents reliable, on-task, and running autonomously - for **Claude Code** & the **Agents SDK**.
-
-- **30 Built-in Policies** - Catch common agent failure modes out of the box. Block destructive commands, prevent secret leakage, keep agents inside project boundaries, detect loops, and more.
-- **Custom Policies** - Write your own reliability rules in JavaScript. Use the `allow`/`deny`/`instruct` API to enforce conventions, prevent drift, gate operations, or integrate with external systems.
-- **Easy Configuration** - Tune any policy without writing code. Set allowlists, protected branches, thresholds per-project or globally. Three-scope config merges automatically.
-- **Agent Monitor** - See what your agents did while you were away. Browse sessions, inspect every tool call, and review exactly where policies fired.
-
-Everything runs locally - no data leaves your machine.
-
----
-
-## Requirements
-
-- Node.js >= 20.9.0
-- Bun >= 1.3.0 (optional - only needed for development / building from source)
-
----
-
-## Install
-
-```bash
-npm install -g failproofai
-# or
-bun add -g failproofai
-```
-
----
-
-## Quick start
-
-### 1. Enable policies globally
-
-```bash
-failproofai policies --install
-```
-
-Writes hook entries into `~/.claude/settings.json`. Claude Code will now invoke failproofai before and after each tool call.
-
-### 2. Launch the dashboard
-
-```bash
-failproofai
-```
-
-Opens `http://localhost:8020` - browse sessions, inspect logs, manage policies.
-
-### 3. Check what's active
-
-```bash
-failproofai policies
-```
-
----
-
-## Policy installation
-
-### Scopes
-
-| Scope | Command | Where it writes |
-|-------|---------|-----------------|
-| Global (default) | `failproofai policies --install` | `~/.claude/settings.json` |
-| Project | `failproofai policies --install --scope project` | `.claude/settings.json` |
-| Local | `failproofai policies --install --scope local` | `.claude/settings.local.json` |
-
-### Install specific policies
-
-```bash
-failproofai policies --install block-sudo block-rm-rf sanitize-api-keys
-```
-
-### Remove policies
-
-```bash
-failproofai policies --uninstall
-# or for a specific scope:
-failproofai policies --uninstall --scope project
-```
-
----
-
-## Configuration
-
-Policy configuration lives in `~/.failproofai/policies-config.json` (global) or `.failproofai/policies-config.json` in your project (per-project).
-
-```json
-{
-  "enabledPolicies": [
-    "block-sudo",
-    "block-rm-rf",
-    "sanitize-api-keys",
-    "block-push-master",
-    "block-env-files",
-    "block-read-outside-cwd"
-  ],
-  "policyParams": {
-    "block-sudo": {
-      "allowPatterns": ["sudo systemctl status", "sudo journalctl"],
-      "hint": "Use apt-get directly without sudo."
-    },
-    "block-push-master": {
-      "protectedBranches": ["main", "release", "prod"],
-      "hint": "Try creating a fresh branch instead."
-    },
-    "sanitize-api-keys": {
-      "additionalPatterns": [
-        { "regex": "myco_[A-Za-z0-9]{32}", "label": "MyCo API key" }
-      ]
-    },
-    "warn-large-file-write": {
-      "thresholdKb": 512
-    }
-  }
-}
-```
-
-**Three config scopes** are merged automatically (project → local → global). See [docs/configuration.mdx](docs/configuration.mdx) for full merge rules.
-
----
-
-## Built-in policies
-
-| Policy | Description | Configurable |
-|--------|-------------|:---:|
-| `block-sudo` | Prevent agents from running privileged system commands | `allowPatterns` |
-| `block-rm-rf` | Prevent accidental recursive file deletion | `allowPaths` |
-| `block-curl-pipe-sh` | Prevent agents from piping untrusted scripts to shell | |
-| `block-failproofai-commands` | Prevent self-uninstallation | |
-| `sanitize-jwt` | Stop JWT tokens from leaking into agent context | |
-| `sanitize-api-keys` | Stop API keys from leaking into agent context | `additionalPatterns` |
-| `sanitize-connection-strings` | Stop database credentials from leaking into agent context | |
-| `sanitize-private-key-content` | Redact PEM private key blocks from output | |
-| `sanitize-bearer-tokens` | Redact Authorization Bearer tokens from output | |
-| `block-env-files` | Keep agents from reading .env files | |
-| `protect-env-vars` | Prevent agents from printing environment variables | |
-| `block-read-outside-cwd` | Keep agents inside project boundaries | `allowPaths` |
-| `block-secrets-write` | Prevent writes to private key and certificate files | `additionalPatterns` |
-| `block-push-master` | Prevent accidental pushes to main/master | `protectedBranches` |
-| `block-work-on-main` | Keep agents off protected branches | `protectedBranches` |
-| `block-force-push` | Prevent `git push --force` | |
-| `warn-git-amend` | Remind agents before amending commits | |
-| `warn-git-stash-drop` | Remind agents before dropping stashes | |
-| `warn-all-files-staged` | Catch accidental `git add -A` | |
-| `warn-destructive-sql` | Catch DROP/DELETE SQL before execution | |
-| `warn-schema-alteration` | Catch ALTER TABLE before execution | |
-| `warn-large-file-write` | Catch unexpectedly large file writes | `thresholdKb` |
-| `warn-package-publish` | Catch accidental `npm publish` | |
-| `warn-background-process` | Catch unintended background process launches | |
-| `warn-global-package-install` | Catch unintended global package installs | |
-| …and more | | |
-
-Full policy details and parameter reference: [docs/built-in-policies.mdx](docs/built-in-policies.mdx)
-
----
-
-## Custom policies
-
-Write your own policies to keep agents reliable and on-task:
-
-```js
-import { customPolicies, allow, deny, instruct } from "failproofai";
-
-customPolicies.add({
-  name: "no-production-writes",
-  description: "Block writes to paths containing 'production'",
-  match: { events: ["PreToolUse"] },
-  fn: async (ctx) => {
-    if (!["Write", "Edit"].includes(ctx.toolName ?? "")) return allow();
-    const path = ctx.toolInput?.file_path ?? "";
-    if (path.includes("production")) return deny("Writes to production paths are blocked");
-    return allow();
-  },
-});
-```
-
-Install with:
-
-```bash
-failproofai policies --install --custom ./my-policies.js
-```
-
-### Decision helpers
-
-| Function | Effect |
-|----------|--------|
-| `allow()` | Permit the operation |
-| `allow(message)` | Permit and send informational context to Claude |
-| `deny(message)` | Block the operation; message shown to Claude |
-| `instruct(message)` | Add context to Claude's prompt; does not block |
-
-### Context object (`ctx`)
-
-| Field | Type | Description |
-|-------|------|-------------|
-| `eventType` | `string` | `"PreToolUse"`, `"PostToolUse"`, `"Notification"`, `"Stop"` |
-| `toolName` | `string` | Tool being called (`"Bash"`, `"Write"`, `"Read"`, …) |
-| `toolInput` | `object` | Tool's input parameters |
-| `payload` | `object` | Full raw event payload |
-| `session.cwd` | `string` | Working directory of the Claude Code session |
-| `session.sessionId` | `string` | Session identifier |
-| `session.transcriptPath` | `string` | Path to the session transcript file |
-
-Custom hooks support transitive local imports, async/await, and access to `process.env`. Errors are fail-open (logged to `~/.failproofai/hook.log`, built-in policies continue). See [docs/custom-hooks.mdx](docs/custom-hooks.mdx) for the full guide.
-
-### Convention-based policies
-
-Drop `*policies.{js,mjs,ts}` files into `.failproofai/policies/` and they're automatically loaded — no flags or config changes needed. Commit the directory to git and every team member gets the same quality standards automatically.
-
-```text
-# Project level — committed to git, shared with the team
-.failproofai/policies/security-policies.mjs
-.failproofai/policies/workflow-policies.mjs
-
-# User level — personal, applies to all projects
-~/.failproofai/policies/my-policies.mjs
-```
-
-Both levels load (union). Files are loaded alphabetically within each directory. Prefix with `01-`, `02-`, etc. to control order. As your team discovers new failure modes, add a policy and push — everyone gets the update on their next pull. See [examples/convention-policies/](examples/convention-policies/) for ready-to-use examples.
-
----
-
-## Telemetry
-
-Failproof AI collects anonymous usage telemetry via PostHog to understand feature usage. No session content, file names, tool inputs, or personal information is ever sent.
-
-Disable it:
-
-```bash
-FAILPROOFAI_TELEMETRY_DISABLED=1 failproofai
-```
-
----
-
-## Documentation
-
-| Guide | Description |
-|-------|-------------|
-| [Getting Started](docs/getting-started.mdx) | Installation and first steps |
-| [Built-in Policies](docs/built-in-policies.mdx) | All 30 built-in policies with parameters |
-| [Custom Policies](docs/custom-policies.mdx) | Write your own policies |
-| [Configuration](docs/configuration.mdx) | Config file format and scope merging |
-| [Dashboard](docs/dashboard.mdx) | Monitor sessions and review policy activity |
-| [Architecture](docs/architecture.mdx) | How the hook system works |
-| [Testing](docs/testing.mdx) | Running tests and writing new ones |
-
-### Run docs locally
-
-```bash
-docker build -f Dockerfile.docs -t failproofai-docs .
-docker run --rm -p 3000:3000 failproofai-docs
-```
-
-Opens the Mintlify docs site at `http://localhost:3000`. The container watches for changes if you mount the docs directory:
-
-```bash
-docker run --rm -p 3000:3000 -v $(pwd)/docs:/app/docs failproofai-docs
-```
-
----
-
-## Note for failproofai contributors
-
-This repo's `.claude/settings.json` uses `bun ./bin/failproofai.mjs --hook <EventType>` instead of the standard `npx -y failproofai` command. This is because running `npx -y failproofai` inside the failproofai project itself creates a self-referencing conflict.
-
-For all other repos, the recommended approach is `npx -y failproofai`, installed via:
-
-```bash
-failproofai policies --install --scope project
-```
-
-## Contributing
-
-See [CONTRIBUTING.md](CONTRIBUTING.md).
-
----
-
-## License
-
-See [LICENSE](LICENSE).
-
----
-
-Built and Maintained by **ExosphereHost: Reliability Research Lab for Your Agents**. We help enterprises and startups improve the reliability of their AI agents through our own agents, software, and expertise. Learn more at [exosphere.host](https://exosphere.host).

package/.next/standalone/bin/failproofai.mjs

@@ -1,352 +0,0 @@
-#!/usr/bin/env bun
-/**
- * failproofai — main entry point.
- *
- * Handles:
- *   --hook <event>        Hook event from Claude Code (minimal startup latency)
- *   --version / -v        Print version and exit
- *   --help / -h           Show usage and exit
- *   policies              Manage policies (list / install / uninstall)
- *   (default)             Launch production dashboard
- */
-import { realpathSync } from "node:fs";
-import { dirname, resolve } from "node:path";
-import { fileURLToPath } from "node:url";
-import { version } from "../package.json";
-
-// Resolve the real package root early (following any npm bin symlinks) so that
-// scripts/launch.ts can locate .next/standalone/server.js correctly regardless
-// of how bun resolves import.meta.url for dynamically-imported modules.
-if (!process.env.FAILPROOFAI_PACKAGE_ROOT) {
-  process.env.FAILPROOFAI_PACKAGE_ROOT = resolve(
-    dirname(realpathSync(fileURLToPath(import.meta.url))),
-    ".."
-  );
-}
-
-if (!process.env.FAILPROOFAI_DIST_PATH) {
-  process.env.FAILPROOFAI_DIST_PATH = resolve(
-    dirname(realpathSync(fileURLToPath(import.meta.url))),
-    "..",
-    "dist"
-  );
-}
-
-const args = process.argv.slice(2);
-
-// Normalize 'p' → 'policies' (shorthand alias)
-if (args[0] === "p") args[0] = "policies";
-
-// --hook <event> — called by Claude Code hooks; fast path, outside runCli()
-// because it has its own exit code contract with Claude Code.
-const hookIdx = args.indexOf("--hook");
-if (hookIdx >= 0) {
-  if (!args[hookIdx + 1]) {
-    console.error("Error: Missing event type after --hook");
-    console.error("Usage: failproofai --hook <event>  (e.g. PreToolUse, PostToolUse)");
-    process.exit(1);
-  }
-  try {
-    const { handleHookEvent } = await import("../src/hooks/handler");
-    const exitCode = await handleHookEvent(args[hookIdx + 1]);
-    process.exit(exitCode);
-  } catch (err) {
-    const msg = err instanceof Error ? err.message : String(err);
-    console.error(`Unexpected error: ${msg}`);
-    process.exit(2);
-  }
-}
-
-/**
- * Centralised error handler for all CLI subcommands.
- * CliError  → clean message, no stack trace, exit exitCode (1 or 2)
- * Error     → unexpected; shows message only, exits 2
- */
-async function runCli() {
-  // --help / -h  (only when not inside a subcommand that handles its own --help)
-  const SUBCOMMANDS = ["policies"];
-  if ((args.includes("--help") || args.includes("-h")) && !SUBCOMMANDS.includes(args[0])) {
-    const extraArgs = args.filter((a) => a !== "--help" && a !== "-h");
-    if (extraArgs.length > 0) {
-      throw new CliError(`Unexpected argument: ${extraArgs[0]}\nRun \`failproofai --help\` for usage.`);
-    }
-    console.log(`
-failproofai v${version}
-
-USAGE
-  failproofai [command] [options]
-
-COMMANDS
-  (no args)                      Launch the policy dashboard
-
-  policies, p                    List all available policies and their status
-  policies --install, -i         Enable policies in Claude Code settings
-    [names...]                     Specific policy names to enable
-    --scope user|project|local     Config scope to write to (default: user)
-    --beta                         Include beta policies
-    --custom, -c <path>            Path to a JS file of custom policies
-
-  policies --uninstall, -u       Disable policies or remove hooks
-    [names...]                     Specific policy names to disable
-    --scope user|project|local|all Config scope to remove from (default: user)
-    --beta                         Remove only beta policies
-    --custom, -c                   Clear the customPoliciesPath from config
-
-  policies --help, -h            Show this help for the policies command
-
-  --version, -v                  Print version and exit
-  --help, -h                     Show this help message
-
-CONVENTION POLICIES
-  Drop *policies.{js,mjs,ts} files into .failproofai/policies/ for auto-loading.
-  Works at project level (.failproofai/policies/) and user level (~/.failproofai/policies/).
-  No --custom flag or config changes needed — just drop files and they're picked up.
-
-EXAMPLES
-  failproofai policies
-  failproofai policies --install
-  failproofai policies --install block-sudo sanitize-api-keys --scope project
-  failproofai policies --install --custom ./my-policies.js
-  failproofai policies -i -c ./my-policies.js
-  failproofai policies --uninstall block-sudo
-  failproofai policies --uninstall --custom
-
-LINKS
-  ⭐ Star us:      https://github.com/exospherehost/failproofai
-  📖 Docs:         https://befailproof.ai
-`.trimStart());
-    process.exit(0);
-  }
-
-  // --version / -v
-  if ((args.includes("--version") || args.includes("-v")) && !SUBCOMMANDS.includes(args[0])) {
-    const extraArgs = args.filter((a) => a !== "--version" && a !== "-v");
-    if (extraArgs.length > 0) {
-      throw new CliError(`Unexpected argument: ${extraArgs[0]}\nRun \`failproofai --help\` for usage.`);
-    }
-    console.log(version);
-    process.exit(0);
-  }
-
-  // policies [--install|-i|--uninstall|-u|--help|-h] [names...] [--scope] [--beta] [--custom|-c <path>]
-  if (args[0] === "policies") {
-    const subArgs = args.slice(1);
-
-    const isInstall   = subArgs.includes("--install")   || subArgs.includes("-i");
-    const isUninstall = subArgs.includes("--uninstall")  || subArgs.includes("-u");
-    const isHelp      = subArgs.includes("--help")       || subArgs.includes("-h");
-
-    if (isHelp) {
-      console.log(`
-failproofai policies — manage Failproof AI policies
-
-USAGE
-  failproofai policies                       List all policies and their status
-  failproofai policies --install, -i         Enable policies
-  failproofai policies --uninstall, -u       Disable policies or remove hooks
-
-OPTIONS (install)
-  [names...]                     Specific policy names to enable (omit for interactive)
-  --scope user|project|local     Config scope to write to (default: user)
-  --beta                         Include beta policies
-  --custom, -c <path>            Path to a JS file of custom policies
-                                 (skips interactive prompt; validates file first)
-
-OPTIONS (uninstall)
-  [names...]                     Specific policy names to disable (omit to remove hooks)
-  --scope user|project|local|all Config scope to remove from (default: user)
-  --beta                         Remove only beta policies
-  --custom, -c                   Clear the customPoliciesPath from config
-
-EXAMPLES
-  failproofai policies
-  failproofai policies --install
-  failproofai policies --install block-sudo sanitize-api-keys
-  failproofai policies --install --custom ./my-policies.js
-  failproofai policies -i -c ./my-policies.js
-  failproofai policies --uninstall block-sudo
-  failproofai policies -u
-  failproofai policies --uninstall --custom
-`.trimStart());
-      process.exit(0);
-    }
-
-    if (isInstall) {
-      const { installHooks } = await import("../src/hooks/manager");
-
-      const scopeIdx = subArgs.indexOf("--scope");
-      const scope = scopeIdx >= 0 ? subArgs[scopeIdx + 1] : "user";
-      if (scopeIdx >= 0 && (!scope || scope.startsWith("-"))) {
-        throw new CliError("Missing value for --scope. Valid values: user, project, local");
-      }
-      if (scopeIdx >= 0 && !["user", "project", "local"].includes(scope)) {
-        throw new CliError(`Invalid scope: ${scope}. Valid values: user, project, local`);
-      }
-
-      const customIdx = subArgs.includes("--custom") ? subArgs.indexOf("--custom")
-                      : subArgs.includes("-c")        ? subArgs.indexOf("-c")
-                      : -1;
-      const customPoliciesPath = customIdx >= 0 ? subArgs[customIdx + 1] : undefined;
-      if (customIdx >= 0 && (!customPoliciesPath || customPoliciesPath.startsWith("-"))) {
-        throw new CliError("Missing path after --custom/-c\nUsage: --custom <path>  (e.g. --custom ./my-policies.js)");
-      }
-
-      const includeBeta = subArgs.includes("--beta");
-
-      // Collect positional policy names — args that don't start with - and aren't
-      // values consumed by --scope or --custom/-c (tracked by index, not value,
-      // so a policy named "user" isn't incorrectly dropped by the default scope).
-      const consumedIdxs = new Set();
-      if (scopeIdx >= 0) consumedIdxs.add(scopeIdx + 1);
-      if (customIdx >= 0) consumedIdxs.add(customIdx + 1);
-      const flags = new Set(["--install", "-i", "--scope", "--beta", "--custom", "-c"]);
-      const unknownInstallFlag = subArgs.find((a) => a.startsWith("-") && !flags.has(a));
-      if (unknownInstallFlag) {
-        throw new CliError(`Unknown flag: ${unknownInstallFlag}\nRun \`failproofai policies --help\` for usage.`);
-      }
-
-      const explicitPolicyNames = subArgs.filter(
-        (a, idx) => !a.startsWith("-") && !consumedIdxs.has(idx)
-      );
-
-      // When --custom/-c is present but no explicit policy names, pass [] so
-      // installHooks uses the existing enabled policies and skips the interactive
-      // prompt — validation of the custom file happens inside installHooks.
-      const policyNames =
-        explicitPolicyNames.length > 0 ? explicitPolicyNames
-        : customPoliciesPath !== undefined ? []
-        : undefined;
-
-      await installHooks(
-        policyNames,
-        scope,
-        undefined,
-        includeBeta,
-        undefined,
-        customPoliciesPath,
-      );
-      process.exit(0);
-    }
-
-    if (isUninstall) {
-      const { removeHooks } = await import("../src/hooks/manager");
-
-      const scopeIdx = subArgs.indexOf("--scope");
-      const scope = scopeIdx >= 0 ? subArgs[scopeIdx + 1] : "user";
-      if (scopeIdx >= 0 && (!scope || scope.startsWith("-"))) {
-        throw new CliError("Missing value for --scope. Valid values: user, project, local, all");
-      }
-      if (scopeIdx >= 0 && !["user", "project", "local", "all"].includes(scope)) {
-        throw new CliError(`Invalid scope: ${scope}. Valid values: user, project, local, all`);
-      }
-
-      const betaOnly = subArgs.includes("--beta");
-      const removeCustomHooks = subArgs.includes("--custom") || subArgs.includes("-c");
-
-      const consumedIdxs = new Set();
-      if (scopeIdx >= 0) consumedIdxs.add(scopeIdx + 1);
-      const flags = new Set(["--uninstall", "-u", "--scope", "--beta", "--custom", "-c"]);
-      const unknownUninstallFlag = subArgs.find((a) => a.startsWith("-") && !flags.has(a));
-      if (unknownUninstallFlag) {
-        throw new CliError(`Unknown flag: ${unknownUninstallFlag}\nRun \`failproofai policies --help\` for usage.`);
-      }
-
-      const policyNames = subArgs.filter(
-        (a, idx) => !a.startsWith("-") && !consumedIdxs.has(idx)
-      );
-
-      await removeHooks(
-        policyNames.length > 0 ? policyNames : undefined,
-        scope,
-        undefined,
-        { betaOnly, removeCustomHooks },
-      );
-      process.exit(0);
-    }
-
-    // Default: list policies
-    // Accept --list as a no-op alias (common intuition), reject all other unknown flags
-    // and unexpected positional args (e.g. "hi").
-    const knownListFlags = new Set(["--install", "-i", "--uninstall", "-u", "--help", "-h", "--list"]);
-    const unknownListArg = subArgs.find((a) => a.startsWith("-") && !knownListFlags.has(a));
-    if (unknownListArg) {
-      throw new CliError(
-        `Unknown flag: ${unknownListArg}\n` +
-        `Run \`failproofai policies --help\` for usage.`
-      );
-    }
-    const positionalArgs = subArgs.filter((a) => !a.startsWith("-"));
-    if (positionalArgs.length > 0) {
-      throw new CliError(
-        `Unexpected argument: ${positionalArgs[0]}\n` +
-        `Run \`failproofai policies --help\` for usage.`
-      );
-    }
-
-    const { listHooks } = await import("../src/hooks/manager");
-    await listHooks();
-    process.exit(0);
-  }
-
-  // Unknown flag guard — must appear after all known-flag branches
-  const knownFlags = ["--version", "-v", "--help", "-h", "--hook"];
-  const unknownFlag = args.find(a => a.startsWith("-") && !knownFlags.includes(a));
-
-  if (unknownFlag) {
-    function levenshtein(a, b) {
-      const m = a.length, n = b.length;
-      const dp = Array.from({ length: m + 1 }, (_, i) =>
-        Array.from({ length: n + 1 }, (_, j) => (i === 0 ? j : j === 0 ? i : 0))
-      );
-      for (let i = 1; i <= m; i++)
-        for (let j = 1; j <= n; j++)
-          dp[i][j] = a[i - 1] === b[j - 1]
-            ? dp[i - 1][j - 1]
-            : 1 + Math.min(dp[i - 1][j], dp[i][j - 1], dp[i - 1][j - 1]);
-      return dp[m][n];
-    }
-
-    const primary = ["--version", "--help", "--hook", "policies"];
-    const closest = primary.reduce((best, flag) => {
-      const dist = levenshtein(unknownFlag, flag);
-      return dist < best.dist ? { flag, dist } : best;
-    }, { flag: primary[0], dist: Infinity });
-
-    throw new CliError(
-      `Unknown flag: ${unknownFlag}\n` +
-      `Did you mean: ${closest.flag}?\n` +
-      `Run \`failproofai --help\` for usage details.`
-    );
-  }
-
-  // Unknown subcommand guard (non-flag args that aren't "policies")
-  const unknownSubcommand = args.find(a => !a.startsWith("-") && a !== "policies");
-  if (unknownSubcommand) {
-    throw new CliError(
-      `Unknown command: ${unknownSubcommand}\n` +
-      `Did you mean: failproofai policies?\n` +
-      `Run \`failproofai --help\` for usage details.`
-    );
-  }
-
-  // Dashboard launch — always production mode
-  const { launch } = await import("../scripts/launch");
-  launch("start");
-}
-
-// ── Import CliError for use in the guard above ────────────────────────────────
-const { CliError } = await import("../src/cli-error");
-
-// ── Run ───────────────────────────────────────────────────────────────────────
-try {
-  await runCli();
-} catch (err) {
-  if (err instanceof CliError) {
-    console.error(`Error: ${err.message}`);
-    process.exit(err.exitCode);
-  }
-  // Unexpected internal error — show message only, no stack trace
-  const msg = err instanceof Error ? err.message : String(err);
-  console.error(`Unexpected error: ${msg}`);
-  process.exit(2);
-}