failproofai 0.0.6-beta.3 → 0.0.6-beta.4

package/.next/standalone/src/hooks/hook-activity-store.ts

@@ -1,349 +0,0 @@
-/**
- * Disk persistence for hook activity entries using page-sized JSONL files.
- *
- * Storage location: ~/.failproofai/cache/hook-activity/
- *
- * File structure:
- * - current.jsonl — actively written to, 0–PAGE_SIZE entries
- * - page-{timestamp}-{seq}.jsonl — rotated archive files, exactly PAGE_SIZE entries each
- *
- * The hook handler is a short-lived process so writes are synchronous (no buffer).
- * Dashboard reads are async and lazy (per-page).
- */
-import {
-  readFileSync,
-  writeFileSync,
-  appendFileSync,
-  renameSync,
-  readdirSync,
-  mkdirSync,
-  existsSync,
-  statSync,
-  unlinkSync,
-} from "node:fs";
-import { join } from "node:path";
-import { homedir } from "node:os";
-
-export const PAGE_SIZE = 25;
-
-const DEFAULT_STORE_DIR = join(homedir(), ".failproofai", "cache", "hook-activity");
-const CURRENT_FILE = "current.jsonl";
-const COUNT_FILE = "current.count"; // tracks line count; O(1) read/write vs rereading current.jsonl
-const STATS_FILE = "stats.json";
-const LOCK_FILE = "current.lock";  // advisory lock for concurrent hook processes
-const LOCK_STALE_MS = 2000;        // steal lock if older than 2 s (covers crashed processes)
-
-let storeDir = DEFAULT_STORE_DIR;
-let rotateSeq = 0;
-
-// ── Types ──
-
-export interface HookActivityEntry {
-  timestamp: number;
-  eventType: string;
-  toolName: string | null;
-  policyName: string | null;
-  policyNames?: string[];
-  decision: "allow" | "deny" | "instruct";
-  reason: string | null;
-  durationMs: number;
-  sessionId?: string;
-  transcriptPath?: string;
-  cwd?: string;
-  permissionMode?: string;
-  hookEventName?: string;
-}
-
-export interface HookActivityFilters {
-  decision?: "allow" | "deny" | "instruct";
-  eventType?: string;
-  policyName?: string;
-  sessionId?: string;
-}
-
-export interface HookActivityStats {
-  totalEvents: number;
-  denyCount: number;
-  topPolicy: string | null;
-  topPolicyCount: number;
-}
-
-// ── Directory setup ──
-
-function ensureDir(): void {
-  if (!existsSync(storeDir)) {
-    mkdirSync(storeDir, { recursive: true });
-  }
-}
-
-// ── Advisory lock (protects count + stats read-modify-write cycles) ──
-
-function acquireLock(): void {
-  ensureDir();
-  const lockPath = join(storeDir, LOCK_FILE);
-  const deadline = Date.now() + LOCK_STALE_MS;
-  while (Date.now() < deadline) {
-    try {
-      // Exclusive create — fails with EEXIST if another process holds the lock
-      writeFileSync(lockPath, String(process.pid), { flag: "wx" });
-      return; // acquired
-    } catch (e) {
-      if ((e as NodeJS.ErrnoException).code !== "EEXIST") return; // unexpected — proceed unlocked
-      // Check if the lock is stale (process may have crashed)
-      try {
-        const s = statSync(lockPath);
-        if (Date.now() - s.mtimeMs > LOCK_STALE_MS) {
-          writeFileSync(lockPath, String(process.pid), "utf-8"); // steal stale lock
-          return;
-        }
-      } catch { /* lock file disappeared — retry */ }
-    }
-  }
-  // Timed out — proceed without lock (best-effort, extremely rare)
-}
-
-function releaseLock(): void {
-  try { unlinkSync(join(storeDir, LOCK_FILE)); } catch { /* ignore */ }
-}
-
-// ── Writing (synchronous — hook handler is short-lived) ──
-
-export function persistHookActivity(entry: HookActivityEntry): void {
-  ensureDir();
-  acquireLock();
-  try {
-    const currentPath = join(storeDir, CURRENT_FILE);
-    const countPath = join(storeDir, COUNT_FILE);
-
-    const lineCount = readCount(countPath);
-    if (lineCount >= PAGE_SIZE) {
-      try {
-        rotate(currentPath, countPath);
-      } catch (e) {
-        if ((e as NodeJS.ErrnoException).code !== "ENOENT") throw e;
-        // Another process rotated concurrently — proceed to append to fresh file.
-      }
-    }
-
-    appendFileSync(currentPath, JSON.stringify(entry) + "\n", "utf-8");
-    writeCount(countPath, lineCount >= PAGE_SIZE ? 1 : lineCount + 1);
-    updateStats(entry);
-  } finally {
-    releaseLock();
-  }
-}
-
-function rotate(currentPath: string, countPath: string): void {
-  const archiveName = `page-${Date.now()}-${rotateSeq++}.jsonl`;
-  const archivePath = join(storeDir, archiveName);
-  renameSync(currentPath, archivePath);
-  // Reset count for the fresh file (write 0 — next append will set it to 1)
-  writeCount(countPath, 0);
-}
-
-// O(1) line count via a tiny sidecar file; avoids rereading current.jsonl.
-function readCount(countPath: string): number {
-  try {
-    const n = parseInt(readFileSync(countPath, "utf-8"), 10);
-    return isNaN(n) ? 0 : n;
-  } catch {
-    return 0;
-  }
-}
-
-function writeCount(countPath: string, n: number): void {
-  try {
-    writeFileSync(countPath, String(n), "utf-8");
-  } catch {
-    // Non-fatal: worst case we recount from 0 next time
-  }
-}
-
-function readFileSafe(filePath: string): string {
-  try {
-    return readFileSync(filePath, "utf-8");
-  } catch {
-    return "";
-  }
-}
-
-// ── Incremental stats (O(1) reads/writes) ──
-
-interface StoredStats {
-  totalEvents: number;
-  denyCount: number;
-  policyMap: Record<string, number>;
-}
-
-function readStoredStats(): StoredStats {
-  try {
-    return JSON.parse(readFileSync(join(storeDir, STATS_FILE), "utf-8")) as StoredStats;
-  } catch {
-    return { totalEvents: 0, denyCount: 0, policyMap: {} };
-  }
-}
-
-function updateStats(entry: HookActivityEntry): void {
-  const s = readStoredStats();
-  s.totalEvents += 1;
-  if (entry.decision === "deny") s.denyCount += 1;
-  if (entry.policyNames && entry.policyNames.length > 0) {
-    for (const name of entry.policyNames) {
-      s.policyMap[name] = (s.policyMap[name] ?? 0) + 1;
-    }
-  } else if (entry.policyName) {
-    s.policyMap[entry.policyName] = (s.policyMap[entry.policyName] ?? 0) + 1;
-  }
-  // Write atomically: write to a PID-unique temp file then rename — prevents partial reads.
-  const tmpPath = join(storeDir, `stats.json.${process.pid}.tmp`);
-  try {
-    writeFileSync(tmpPath, JSON.stringify(s), "utf-8");
-    renameSync(tmpPath, join(storeDir, STATS_FILE));
-  } catch {
-    try { unlinkSync(tmpPath); } catch { /* ignore */ }
-    // Non-fatal: stats file write failure doesn't block the hook
-  }
-}
-
-function readStats(): HookActivityStats {
-  const s = readStoredStats();
-  let topPolicy: string | null = null;
-  let topPolicyCount = 0;
-  for (const [name, count] of Object.entries(s.policyMap)) {
-    if (count > topPolicyCount) {
-      topPolicy = name;
-      topPolicyCount = count;
-    }
-  }
-  return { totalEvents: s.totalEvents, denyCount: s.denyCount, topPolicy, topPolicyCount };
-}
-
-// ── Reading (lazy, per-page) ──
-
-export function getHookActivityPage(page: number): HookActivityEntry[] {
-  ensureDir();
-  if (page < 1) return [];
-
-  if (page === 1) {
-    const currentPath = join(storeDir, CURRENT_FILE);
-    return readJsonlFile(currentPath).reverse();
-  }
-
-  const archives = getArchiveFiles();
-  const archiveIndex = page - 2;
-  if (archiveIndex >= archives.length) return [];
-
-  return readJsonlFile(join(storeDir, archives[archiveIndex])).reverse();
-}
-
-export function getHookActivityPageCount(): number {
-  ensureDir();
-  return 1 + getArchiveFiles().length;
-}
-
-export function getAllHookActivityEntries(): HookActivityEntry[] {
-  ensureDir();
-
-  const currentPath = join(storeDir, CURRENT_FILE);
-  const currentEntries = readJsonlFile(currentPath).reverse();
-
-  const archives = getArchiveFiles();
-  const archiveEntries: HookActivityEntry[] = [];
-  for (const file of archives) {
-    const entries = readJsonlFile(join(storeDir, file));
-    archiveEntries.push(...entries.reverse());
-  }
-
-  return [...currentEntries, ...archiveEntries];
-}
-
-
-export function searchHookActivity(
-  filters: HookActivityFilters,
-  page: number,
-): { entries: HookActivityEntry[]; totalPages: number; page: number; stats: HookActivityStats } {
-  const all = getAllHookActivityEntries();
-
-  const filtered = all.filter((entry) => {
-    if (filters.decision && entry.decision !== filters.decision) return false;
-    if (filters.eventType && entry.eventType !== filters.eventType) return false;
-    if (
-      filters.policyName &&
-      (!entry.policyName || !entry.policyName.toLowerCase().includes(filters.policyName.toLowerCase()))
-    ) {
-      return false;
-    }
-    if (
-      filters.sessionId &&
-      (!entry.sessionId || !entry.sessionId.toLowerCase().includes(filters.sessionId.toLowerCase()))
-    ) {
-      return false;
-    }
-    return true;
-  });
-
-  const totalPages = Math.max(1, Math.ceil(filtered.length / PAGE_SIZE));
-  const start = (page - 1) * PAGE_SIZE;
-  const entries = filtered.slice(start, start + PAGE_SIZE);
-  // Stats come from the O(1) incremental stats file rather than a full rescan.
-  const stats = readStats();
-
-  return { entries, totalPages, page, stats };
-}
-
-export function getHookActivityHistory(page: number): {
-  entries: HookActivityEntry[];
-  totalPages: number;
-  page: number;
-  stats: HookActivityStats;
-} {
-  const entries = getHookActivityPage(page);
-  const totalPages = getHookActivityPageCount();
-  // Stats come from the O(1) incremental stats file rather than a full rescan.
-  const stats = readStats();
-  return { entries, totalPages, page, stats };
-}
-
-// ── Internal helpers ──
-
-function readJsonlFile(filePath: string): HookActivityEntry[] {
-  const content = readFileSafe(filePath);
-  if (!content.trim()) return [];
-
-  const entries: HookActivityEntry[] = [];
-  for (const line of content.trim().split("\n")) {
-    try {
-      entries.push(JSON.parse(line) as HookActivityEntry);
-    } catch {
-      // Skip malformed lines
-    }
-  }
-  return entries;
-}
-
-function getArchiveFiles(): string[] {
-  try {
-    const files = readdirSync(storeDir);
-    return files
-      .filter((f) => f.startsWith("page-") && f.endsWith(".jsonl"))
-      .sort((a, b) => {
-        const partsA = a.slice(5, -6).split("-");
-        const partsB = b.slice(5, -6).split("-");
-        const tsA = parseInt(partsA[0], 10);
-        const tsB = parseInt(partsB[0], 10);
-        if (tsA !== tsB) return tsB - tsA;
-        const seqA = partsA.length > 1 ? parseInt(partsA[1], 10) : 0;
-        const seqB = partsB.length > 1 ? parseInt(partsB[1], 10) : 0;
-        return seqB - seqA;
-      });
-  } catch {
-    return [];
-  }
-}
-
-// ── Test helpers ──
-
-export function _resetForTest(testDir?: string): void {
-  rotateSeq = 0;
-  storeDir = testDir ?? DEFAULT_STORE_DIR;
-}

package/.next/standalone/src/hooks/hook-logger.ts

@@ -1,133 +0,0 @@
-/**
- * Lightweight logger for hook processes.
- *
- * ALL output goes to stderr (stdout is reserved for the hook JSON response
- * that Claude Code reads).
- *
- * Optionally writes to a log file with size-based rotation.
- *
- * Env vars:
- *   FAILPROOFAI_LOG_LEVEL      — info | warn | error (default: warn)
- *   FAILPROOFAI_HOOK_LOG_FILE  — enable file logging:
- *       unset / ""   → disabled (stderr only)
- *       "1" / "true" → enabled, writes to ~/.failproofai/logs/
- *       <path>       → enabled, writes to that directory
- */
-import {
-  appendFileSync,
-  renameSync,
-  mkdirSync,
-  existsSync,
-  statSync,
-} from "node:fs";
-import { join } from "node:path";
-import { homedir } from "node:os";
-
-export type LogLevel = "info" | "warn" | "error";
-
-const LEVEL_ORDER: Record<LogLevel, number> = { info: 0, warn: 1, error: 2 };
-const MAX_FILE_SIZE = 512 * 1024; // 500 KB
-const LOG_FILENAME = "hooks.log";
-const DEFAULT_LOG_DIR = join(homedir(), ".failproofai", "logs");
-
-// ── State (lazy-initialized) ──
-
-let resolved = false;
-let currentLevel: LogLevel = "warn";
-let fileLoggingEnabled = false;
-let logDir = DEFAULT_LOG_DIR;
-
-function ensureResolved(): void {
-  if (resolved) return;
-  resolved = true;
-
-  // Log level
-  const rawLevel = (process.env.FAILPROOFAI_LOG_LEVEL ?? "").toLowerCase();
-  if (rawLevel === "info" || rawLevel === "warn" || rawLevel === "error") {
-    currentLevel = rawLevel;
-  }
-
-  // File logging
-  const rawFile = (process.env.FAILPROOFAI_HOOK_LOG_FILE ?? "").trim();
-  if (rawFile) {
-    fileLoggingEnabled = true;
-    if (rawFile !== "1" && rawFile !== "true") {
-      logDir = rawFile;
-    }
-  }
-}
-
-function shouldEmit(level: LogLevel): boolean {
-  ensureResolved();
-  return LEVEL_ORDER[level] >= LEVEL_ORDER[currentLevel];
-}
-
-// ── Stderr output ──
-
-function emitStderr(label: string, msg: string): void {
-  process.stderr.write(`[failproofai:hook] ${label} ${msg}\n`);
-}
-
-// ── File output (synchronous — hook processes are short-lived) ──
-
-function ensureLogDir(): void {
-  if (!existsSync(logDir)) {
-    mkdirSync(logDir, { recursive: true });
-  }
-}
-
-function rotateIfNeeded(filePath: string): void {
-  try {
-    const stats = statSync(filePath);
-    if (stats.size >= MAX_FILE_SIZE) {
-      const archiveName = `hooks-${Date.now()}.log`;
-      renameSync(filePath, join(logDir, archiveName));
-    }
-  } catch {
-    // File doesn't exist yet — nothing to rotate
-  }
-}
-
-function appendToFile(label: string, msg: string): void {
-  if (!fileLoggingEnabled) return;
-
-  try {
-    ensureLogDir();
-    const filePath = join(logDir, LOG_FILENAME);
-    rotateIfNeeded(filePath);
-
-    const timestamp = new Date().toISOString();
-    const line = `[${timestamp}] ${label} ${msg}\n`;
-    appendFileSync(filePath, line, "utf-8");
-  } catch {
-    // File logging is best-effort — never fail the hook
-  }
-}
-
-// ── Public API ──
-
-export function hookLogInfo(msg: string): void {
-  if (!shouldEmit("info")) return;
-  emitStderr("INFO", msg);
-  appendToFile("INFO", msg);
-}
-
-export function hookLogWarn(msg: string): void {
-  if (!shouldEmit("warn")) return;
-  emitStderr("WARN", msg);
-  appendToFile("WARN", msg);
-}
-
-export function hookLogError(msg: string): void {
-  if (!shouldEmit("error")) return;
-  emitStderr("ERROR", msg);
-  appendToFile("ERROR", msg);
-}
-
-/** Reset internal state (for testing only). */
-export function _resetHookLogger(): void {
-  resolved = false;
-  currentLevel = "warn";
-  fileLoggingEnabled = false;
-  logDir = DEFAULT_LOG_DIR;
-}

package/.next/standalone/src/hooks/hook-telemetry.ts

@@ -1,43 +0,0 @@
-/**
- * Lightweight PostHog telemetry for the compiled hook binary.
- *
- * Uses fetch() directly instead of posthog-node, since the binary
- * doesn't have access to node_modules at runtime.
- */
-
-import { version } from "../../package.json";
-import { POSTHOG_API_KEY } from "../posthog-key";
-
-const API_KEY = POSTHOG_API_KEY;
-const CAPTURE_URL = "https://us.i.posthog.com/capture/";
-
-export async function trackHookEvent(
-  distinctId: string,
-  event: string,
-  properties?: Record<string, unknown>,
-): Promise<void> {
-  if (process.env.FAILPROOFAI_TELEMETRY_DISABLED === "1") return;
-
-  const body = JSON.stringify({
-    api_key: process.env.FAILPROOFAI_POSTHOG_KEY ?? API_KEY,
-    event,
-    distinct_id: distinctId,
-    properties: { ...properties, $lib: "failproofai-hooks", failproofai_version: version },
-  });
-
-  try {
-    await fetch(
-      process.env.FAILPROOFAI_POSTHOG_HOST
-        ? `${process.env.FAILPROOFAI_POSTHOG_HOST}/capture/`
-        : CAPTURE_URL,
-      {
-        method: "POST",
-        headers: { "Content-Type": "application/json" },
-        body,
-        signal: AbortSignal.timeout(5000),
-      },
-    );
-  } catch {
-    // Telemetry is best-effort — never fail the hook
-  }
-}

package/.next/standalone/src/hooks/hooks-config.ts

@@ -1,166 +0,0 @@
-/**
- * Read/write the hooks configuration file at ~/.failproofai/policies-config.json.
- */
-import { readFileSync, writeFileSync, existsSync, mkdirSync } from "node:fs";
-import { resolve, dirname } from "node:path";
-import { homedir } from "node:os";
-import type { HooksConfig } from "./policy-types";
-import type { HookScope } from "./types";
-import { hookLogInfo, hookLogWarn } from "./hook-logger";
-
-function readConfigAt(path: string): Partial<HooksConfig> {
-  if (!existsSync(path)) return {};
-  try {
-    const raw = readFileSync(path, "utf8");
-    return JSON.parse(raw) as Partial<HooksConfig>;
-  } catch (err) {
-    hookLogWarn(`failed to parse config at ${path}: ${err instanceof Error ? err.message : String(err)}`);
-    return {};
-  }
-}
-
-/**
- * Read and merge hooks config from three scopes in priority order:
- *   1. {cwd}/.failproofai/policies-config.json        (project)
- *   2. {cwd}/.failproofai/policies-config.local.json  (local)
- *   3. ~/.failproofai/policies-config.json             (global)
- *
- * Merge rules:
- *   enabledPolicies: union + dedup across all three
- *   policyParams:    per-policy key, first scope that defines it wins entirely
- *   customPoliciesPath: first scope that defines it wins
- *   llm:            first scope that defines it wins
- */
-export function readMergedHooksConfig(cwd?: string): HooksConfig {
-  const base = cwd ? resolve(cwd) : process.cwd();
-  const projectPath = resolve(base, ".failproofai", "policies-config.json");
-  const localPath = resolve(base, ".failproofai", "policies-config.local.json");
-  const globalPath = resolve(homedir(), ".failproofai", "policies-config.json");
-
-  const project = readConfigAt(projectPath);
-  const local = readConfigAt(localPath);
-  const global_ = readConfigAt(globalPath);
-
-  // enabledPolicies: union + dedup
-  const enabledSet = new Set<string>([
-    ...(project.enabledPolicies ?? []),
-    ...(local.enabledPolicies ?? []),
-    ...(global_.enabledPolicies ?? []),
-  ]);
-
-  // policyParams: per-policy, first scope wins
-  const mergedParams: Record<string, Record<string, unknown>> = {};
-  for (const scope of [project, local, global_]) {
-    if (!scope.policyParams) continue;
-    for (const [policyName, params] of Object.entries(scope.policyParams)) {
-      if (!(policyName in mergedParams)) {
-        mergedParams[policyName] = params;
-      }
-    }
-  }
-
-  // customPoliciesPath: first scope wins
-  const customPoliciesPath =
-    project.customPoliciesPath ?? local.customPoliciesPath ?? global_.customPoliciesPath;
-
-  // llm: first scope wins
-  const llm = project.llm ?? local.llm ?? global_.llm;
-
-  return {
-    enabledPolicies: [...enabledSet],
-    ...(Object.keys(mergedParams).length > 0 ? { policyParams: mergedParams } : {}),
-    ...(customPoliciesPath !== undefined ? { customPoliciesPath } : {}),
-    ...(llm !== undefined ? { llm } : {}),
-  };
-}
-
-function getConfigPath(): string {
-  return resolve(homedir(), ".failproofai", "policies-config.json");
-}
-
-export function readHooksConfig(): HooksConfig {
-  const configPath = getConfigPath();
-  if (!existsSync(configPath)) {
-    return { enabledPolicies: [] };
-  }
-  try {
-    const raw = readFileSync(configPath, "utf8");
-    return JSON.parse(raw) as HooksConfig;
-  } catch (err) {
-    hookLogWarn(`failed to parse config at ${configPath}: ${err instanceof Error ? err.message : String(err)}`);
-    return { enabledPolicies: [] };
-  }
-}
-
-export function writeHooksConfig(config: HooksConfig): void {
-  const configPath = getConfigPath();
-  const dir = dirname(configPath);
-  if (!existsSync(dir)) {
-    mkdirSync(dir, { recursive: true });
-  }
-  writeFileSync(configPath, JSON.stringify(config, null, 2) + "\n", "utf8");
-}
-
-/**
- * Resolve the policies-config path for a specific scope.
- */
-export function getConfigPathForScope(scope: HookScope, cwd?: string): string {
-  const base = cwd ? resolve(cwd) : process.cwd();
-  switch (scope) {
-    case "user":
-      return resolve(homedir(), ".failproofai", "policies-config.json");
-    case "project":
-      return resolve(base, ".failproofai", "policies-config.json");
-    case "local":
-      return resolve(base, ".failproofai", "policies-config.local.json");
-  }
-}
-
-/**
- * Read hooks config from a single specific scope (not merged).
- */
-export function readScopedHooksConfig(scope: HookScope, cwd?: string): HooksConfig {
-  const configPath = getConfigPathForScope(scope, cwd);
-  if (!existsSync(configPath)) {
-    return { enabledPolicies: [] };
-  }
-  try {
-    const raw = readFileSync(configPath, "utf8");
-    return JSON.parse(raw) as HooksConfig;
-  } catch (err) {
-    hookLogWarn(`failed to parse config at ${configPath}: ${err instanceof Error ? err.message : String(err)}`);
-    return { enabledPolicies: [] };
-  }
-}
-
-/**
- * Write hooks config to the scope-appropriate path.
- */
-export function writeScopedHooksConfig(config: HooksConfig, scope: HookScope, cwd?: string): void {
-  const configPath = getConfigPathForScope(scope, cwd);
-  const dir = dirname(configPath);
-  if (!existsSync(dir)) {
-    mkdirSync(dir, { recursive: true });
-  }
-  writeFileSync(configPath, JSON.stringify(config, null, 2) + "\n", "utf8");
-}
-
-export interface ResolvedLlmConfig {
-  baseUrl: string;
-  apiKey: string;
-  model: string;
-}
-
-export function readLlmConfig(cwd?: string): ResolvedLlmConfig | null {
-  const config = readMergedHooksConfig(cwd);
-  const baseUrl =
-    process.env.FAILPROOFAI_LLM_BASE_URL ?? config.llm?.baseUrl ?? "https://api.openai.com/v1";
-  const apiKey = process.env.FAILPROOFAI_LLM_API_KEY ?? config.llm?.apiKey;
-  const model = process.env.FAILPROOFAI_LLM_MODEL ?? config.llm?.model ?? "gpt-4o-mini";
-  const apiKeySource = process.env.FAILPROOFAI_LLM_API_KEY ? "env" : config.llm?.apiKey ? "file" : "missing";
-  const baseUrlSource = process.env.FAILPROOFAI_LLM_BASE_URL ? "env" : config.llm?.baseUrl ? "file" : "default";
-  const modelSource = process.env.FAILPROOFAI_LLM_MODEL ? "env" : config.llm?.model ? "file" : "default";
-  hookLogInfo(`llm-config: apiKey=${apiKeySource} baseUrl=${baseUrlSource}(${baseUrl}) model=${modelSource}(${model})`);
-  if (!apiKey) return null;
-  return { baseUrl, apiKey, model };
-}