failproofai 0.0.6-beta.5 → 0.0.6

package/src/hooks/builtin-policies.ts

@@ -7,7 +7,7 @@ import { execSync, execFileSync } from "node:child_process";
 import { homedir } from "node:os";
 import type { BuiltinPolicyDefinition, PolicyContext, PolicyResult, PolicyParamsSchema } from "./policy-types";
 import { allow, deny, instruct } from "./policy-helpers";
-import { registerPolicy } from "./policy-registry";
+import { normalizePolicyName, registerPolicy } from "./policy-registry";
 import { hookLogWarn } from "./hook-logger";
 
 function isClaudeInternalPath(resolved: string): boolean {
@@ -1254,7 +1254,7 @@ function requireNoConflictsBeforeStop(ctx: PolicyContext): PolicyResult {
 
   let prJson: string;
   try {
-    prJson = execSync("gh pr view --json mergeable,number,url", {
+    prJson = execSync("gh pr view --json mergeable,number,url,state", {
       cwd, encoding: "utf8", stdio: ["pipe", "pipe", "pipe"], timeout: 15000,
     }).trim();
   } catch {
@@ -1265,13 +1265,19 @@ function requireNoConflictsBeforeStop(ctx: PolicyContext): PolicyResult {
     );
   }
 
-  let pr: { mergeable: string; number: number; url: string };
+  let pr: { mergeable: string; number: number; url: string; state: string };
   try {
     pr = JSON.parse(prJson);
   } catch {
     return allow("Could not parse gh pr view output, skipping PR mergeability check.");
   }
 
+  // GitHub stops computing mergeability for non-OPEN PRs (returns UNKNOWN forever).
+  // Skip the check entirely so a merged or closed PR doesn't trap Stop in a wait loop.
+  if (pr.state !== "OPEN") {
+    return allow(`PR #${pr.number} is ${pr.state.toLowerCase()}; skipping conflict check.`);
+  }
+
   if (pr.mergeable === "CONFLICTING") {
     return deny(
       `PR #${pr.number} has merge conflicts per GitHub (${pr.url}). ` +
@@ -1718,9 +1724,11 @@ export const BUILTIN_POLICIES: BuiltinPolicyDefinition[] = [
 ];
 
 export function registerBuiltinPolicies(enabledNames: string[]): void {
-  const enabledSet = new Set(enabledNames);
+  // Tolerate both flat ("sanitize-jwt") and qualified ("exospherehost/sanitize-jwt")
+  // forms in the user's enabledPolicies config — canonicalize both sides.
+  const enabledSet = new Set(enabledNames.map(normalizePolicyName));
   for (const policy of BUILTIN_POLICIES) {
-    if (enabledSet.has(policy.name)) {
+    if (enabledSet.has(normalizePolicyName(policy.name))) {
       registerPolicy(policy.name, policy.description, policy.fn, policy.match);
     }
   }

package/src/hooks/policy-evaluator.ts

@@ -5,7 +5,7 @@
 import type { HookEventType, SessionMetadata } from "./types";
 import type { PolicyContext, HooksConfig } from "./policy-types";
 import { BUILTIN_POLICIES } from "./builtin-policies";
-import { getPoliciesForEvent } from "./policy-registry";
+import { DEFAULT_POLICY_NAMESPACE, getPoliciesForEvent, normalizePolicyName } from "./policy-registry";
 import { hookLogInfo, hookLogWarn } from "./hook-logger";
 
 function appendHint(baseReason: string, hint: unknown): string {
@@ -26,11 +26,33 @@ export interface EvaluationResult {
   decision: "allow" | "deny" | "instruct";
 }
 
-// Build a map from policy name to its params schema (for injecting defaults)
+// Build a map from canonical policy name to its params schema (for injecting defaults).
+// Keyed by canonical name because registered policies always carry the canonical form.
 const POLICY_PARAMS_MAP = new Map(
-  BUILTIN_POLICIES.filter((p) => p.params).map((p) => [p.name, p.params!]),
+  BUILTIN_POLICIES.filter((p) => p.params).map((p) => [normalizePolicyName(p.name), p.params!]),
 );
 
+/**
+ * Look up policy params for a canonical policy name in the user config,
+ * tolerating either flat ("block-force-push") or qualified
+ * ("exospherehost/block-force-push") config keys for built-in policies.
+ *
+ * The flat-key fallback is intentionally limited to the default namespace
+ * so namespace isolation is preserved: `policyParams.foo` only matches
+ * `exospherehost/foo`, never `myorg/foo` or `custom/foo`.
+ */
+function getConfigParamsFor(
+  config: HooksConfig | undefined,
+  canonicalName: string,
+): Record<string, unknown> | undefined {
+  if (!config?.policyParams) return undefined;
+  const canonicalParams = config.policyParams[canonicalName];
+  if (canonicalParams) return canonicalParams;
+  const defaultPrefix = `${DEFAULT_POLICY_NAMESPACE}/`;
+  if (!canonicalName.startsWith(defaultPrefix)) return undefined;
+  return config.policyParams[canonicalName.slice(defaultPrefix.length)];
+}
+
 export async function evaluatePolicies(
   eventType: HookEventType,
   payload: Record<string, unknown>,
@@ -63,11 +85,13 @@ export async function evaluatePolicies(
   const allowEntries: Array<{ policyName: string; reason: string }> = [];
 
   for (const policy of policies) {
-    // Inject params: merge policyParams[policy.name] over schema defaults
+    // Inject params: merge policyParams[policy.name] over schema defaults.
+    // policy.name is canonical (e.g. "exospherehost/block-force-push"); user
+    // config keys may be flat or canonical — getConfigParamsFor accepts both.
     const schema = POLICY_PARAMS_MAP.get(policy.name);
     let ctx: PolicyContext;
     if (schema) {
-      const userParams = config?.policyParams?.[policy.name] ?? {};
+      const userParams = getConfigParamsFor(config, policy.name) ?? {};
       const resolvedParams: Record<string, unknown> = {};
       for (const [key, spec] of Object.entries(schema)) {
         resolvedParams[key] = key in userParams ? userParams[key] : spec.default;
@@ -89,7 +113,7 @@ export async function evaluatePolicies(
     if (result.decision === "deny") {
       const reason = appendHint(
         result.reason ?? `Blocked by policy: ${policy.name}`,
-        config?.policyParams?.[policy.name]?.hint,
+        getConfigParamsFor(config, policy.name)?.hint,
       );
       hookLogInfo(`deny by "${policy.name}": ${reason}`);
 
@@ -156,7 +180,7 @@ export async function evaluatePolicies(
     if (result.decision === "instruct") {
       const reason = appendHint(
         result.reason ?? `Instruction from policy: ${policy.name}`,
-        config?.policyParams?.[policy.name]?.hint,
+        getConfigParamsFor(config, policy.name)?.hint,
       );
       instructEntries.push({ policyName: policy.name, reason });
       hookLogInfo(`instruct by "${policy.name}": ${reason}`);

package/src/hooks/policy-registry.ts

@@ -11,6 +11,22 @@ import type { PolicyFunction, PolicyMatcher, RegisteredPolicy } from "./policy-t
 const REGISTRY_KEY = "__FAILPROOFAI_POLICY_REGISTRY__";
 const INDEX_CACHE_KEY = "__FAILPROOFAI_POLICY_INDEX_CACHE__";
 
+/**
+ * The default namespace applied to any policy name registered without a
+ * `<namespace>/` prefix. Builtins live under this namespace; custom hooks
+ * loaded by the handler get their own prefixes (e.g. `custom/foo`).
+ */
+export const DEFAULT_POLICY_NAMESPACE = "exospherehost";
+
+/**
+ * Canonicalize a policy name. If the name already contains a `/`, it is
+ * treated as already-namespaced and returned unchanged. Otherwise the
+ * default namespace is prepended.
+ */
+export function normalizePolicyName(name: string): string {
+  return name.includes("/") ? name : `${DEFAULT_POLICY_NAMESPACE}/${name}`;
+}
+
 interface GlobalWithRegistry {
   [REGISTRY_KEY]?: RegisteredPolicy[];
 }
@@ -42,9 +58,10 @@ export function registerPolicy(
   match: PolicyMatcher,
   priority: number = 0,
 ): void {
+  const canonical = normalizePolicyName(name);
   const registry = getRegistry();
-  const idx = registry.findIndex((p) => p.name === name);
-  const entry: RegisteredPolicy = { name, description, fn, match, priority };
+  const idx = registry.findIndex((p) => p.name === canonical);
+  const entry: RegisteredPolicy = { name: canonical, description, fn, match, priority };
   if (idx >= 0) {
     registry[idx] = entry;
   } else {