failproofai 1.0.0-beta.1 → 1.0.0-beta.2

package/.next/standalone/server.js

@@ -9,7 +9,7 @@ const currentPort = parseInt(process.env.PORT, 10) || 3000
 const hostname = process.env.HOSTNAME || '0.0.0.0'
 
 let keepAliveTimeout = parseInt(process.env.KEEP_ALIVE_TIMEOUT, 10)
-const nextConfig = {"env":{"NEXT_PUBLIC_APP_VERSION":"1.0.0-beta.1"},"typescript":{"ignoreBuildErrors":false},"typedRoutes":false,"distDir":"./.next","cleanDistDir":true,"assetPrefix":"","cacheMaxMemorySize":52428800,"configOrigin":"next.config.ts","useFileSystemPublicRoutes":true,"generateEtags":true,"pageExtensions":["tsx","ts","jsx","js"],"poweredByHeader":true,"compress":true,"images":{"deviceSizes":[640,750,828,1080,1200,1920,2048,3840],"imageSizes":[32,48,64,96,128,256,384],"path":"/_next/image","loader":"default","loaderFile":"","domains":[],"disableStaticImages":false,"minimumCacheTTL":14400,"formats":["image/webp"],"maximumRedirects":3,"maximumResponseBody":50000000,"dangerouslyAllowLocalIP":false,"dangerouslyAllowSVG":false,"contentSecurityPolicy":"script-src 'none'; frame-src 'none'; sandbox;","contentDispositionType":"attachment","localPatterns":[{"pathname":"**","search":""}],"remotePatterns":[],"qualities":[75],"unoptimized":true,"customCacheHandler":false},"devIndicators":{"position":"bottom-left"},"onDemandEntries":{"maxInactiveAge":60000,"pagesBufferLength":5},"basePath":"","sassOptions":{},"trailingSlash":false,"i18n":null,"productionBrowserSourceMaps":false,"excludeDefaultMomentLocales":true,"reactProductionProfiling":false,"reactStrictMode":null,"reactMaxHeadersLength":6000,"httpAgentOptions":{"keepAlive":true},"logging":{"serverFunctions":true,"browserToTerminal":"warn"},"compiler":{},"expireTime":31536000,"staticPageGenerationTimeout":60,"output":"standalone","modularizeImports":{"@mui/icons-material":{"transform":"@mui/icons-material/{{member}}"},"lodash":{"transform":"lodash/{{member}}"}},"outputFileTracingRoot":"/home/runner/work/failproofai/failproofai","cacheComponents":false,"cacheLife":{"default":{"stale":300,"revalidate":900,"expire":4294967294},"seconds":{"stale":30,"revalidate":1,"expire":60},"minutes":{"stale":300,"revalidate":60,"expire":3600},"hours":{"stale":300,"revalidate":3600,"expire":86400},"days":{"stale":300,"revalidate":86400,"expire":604800},"weeks":{"stale":300,"revalidate":604800,"expire":2592000},"max":{"stale":300,"revalidate":2592000,"expire":31536000}},"cacheHandlers":{},"experimental":{"appNewScrollHandler":false,"useSkewCookie":false,"cssChunking":true,"multiZoneDraftMode":false,"appNavFailHandling":false,"prerenderEarlyExit":true,"serverMinification":true,"linkNoTouchStart":false,"caseSensitiveRoutes":false,"cachedNavigations":false,"partialFallbacks":false,"dynamicOnHover":false,"varyParams":false,"prefetchInlining":false,"preloadEntriesOnStart":true,"clientRouterFilter":true,"clientRouterFilterRedirects":false,"fetchCacheKeyPrefix":"","proxyPrefetch":"flexible","optimisticClientCache":true,"manualClientBasePath":false,"cpus":3,"memoryBasedWorkersCount":false,"imgOptConcurrency":null,"imgOptTimeoutInSeconds":7,"imgOptMaxInputPixels":268402689,"imgOptSequentialRead":null,"isrFlushToDisk":true,"workerThreads":false,"optimizeCss":false,"nextScriptWorkers":false,"scrollRestoration":false,"externalDir":false,"disableOptimizedLoading":false,"gzipSize":true,"craCompat":false,"esmExternals":true,"fullySpecified":false,"swcTraceProfiling":false,"forceSwcTransforms":false,"largePageDataBytes":128000,"typedEnv":false,"parallelServerCompiles":false,"parallelServerBuildTraces":false,"ppr":false,"authInterrupts":false,"webpackMemoryOptimizations":false,"optimizeServerReact":true,"strictRouteTypes":false,"useTypeScriptCli":false,"viewTransition":false,"removeUncaughtErrorAndRejectionListeners":false,"validateRSCRequestHeaders":false,"staleTimes":{"dynamic":0,"static":300},"reactDebugChannel":true,"serverComponentsHmrCache":true,"staticGenerationMaxConcurrency":8,"staticGenerationMinPagesPerWorker":25,"transitionIndicator":false,"gestureTransition":false,"inlineCss":false,"useCache":false,"globalNotFound":false,"browserDebugInfoInTerminal":"warn","lockDistDir":true,"proxyClientMaxBodySize":10485760,"hideLogsAfterAbort":false,"mcpServer":true,"turbopackFileSystemCacheForDev":true,"turbopackFileSystemCacheForBuild":false,"turbopackInferModuleSideEffects":true,"turbopackPluginRuntimeStrategy":"childProcesses","optimizePackageImports":["lucide-react","date-fns","lodash-es","ramda","antd","react-bootstrap","ahooks","@ant-design/icons","@headlessui/react","@headlessui-float/react","@heroicons/react/20/solid","@heroicons/react/24/solid","@heroicons/react/24/outline","@visx/visx","@tremor/react","rxjs","@mui/material","@mui/icons-material","recharts","react-use","effect","@effect/schema","@effect/platform","@effect/platform-node","@effect/platform-browser","@effect/platform-bun","@effect/sql","@effect/sql-mssql","@effect/sql-mysql2","@effect/sql-pg","@effect/sql-sqlite-node","@effect/sql-sqlite-bun","@effect/sql-sqlite-wasm","@effect/sql-sqlite-react-native","@effect/rpc","@effect/rpc-http","@effect/typeclass","@effect/experimental","@effect/opentelemetry","@material-ui/core","@material-ui/icons","@tabler/icons-react","mui-core","react-icons/ai","react-icons/bi","react-icons/bs","react-icons/cg","react-icons/ci","react-icons/di","react-icons/fa","react-icons/fa6","react-icons/fc","react-icons/fi","react-icons/gi","react-icons/go","react-icons/gr","react-icons/hi","react-icons/hi2","react-icons/im","react-icons/io","react-icons/io5","react-icons/lia","react-icons/lib","react-icons/lu","react-icons/md","react-icons/pi","react-icons/ri","react-icons/rx","react-icons/si","react-icons/sl","react-icons/tb","react-icons/tfi","react-icons/ti","react-icons/vsc","react-icons/wi"],"trustHostHeader":false,"isExperimentalCompile":false},"htmlLimitedBots":"[\\w-]+-Google|Google-[\\w-]+|Chrome-Lighthouse|Slurp|DuckDuckBot|baiduspider|yandex|sogou|bitlybot|tumblr|vkShare|quora link preview|redditbot|ia_archiver|Bingbot|BingPreview|applebot|facebookexternalhit|facebookcatalog|Twitterbot|LinkedInBot|Slackbot|Discordbot|WhatsApp|SkypeUriPreview|Yeti|googleweblight","bundlePagesRouterDependencies":false,"configFileName":"next.config.ts","outputFileTracingExcludes":{"*":["node_modules/@img/**","node_modules/sharp/**"]},"turbopack":{"root":"/home/runner/work/failproofai/failproofai"},"distDirRoot":".next"}
+const nextConfig = {"env":{"NEXT_PUBLIC_APP_VERSION":"1.0.0-beta.2"},"typescript":{"ignoreBuildErrors":false},"typedRoutes":false,"distDir":"./.next","cleanDistDir":true,"assetPrefix":"","cacheMaxMemorySize":52428800,"configOrigin":"next.config.ts","useFileSystemPublicRoutes":true,"generateEtags":true,"pageExtensions":["tsx","ts","jsx","js"],"poweredByHeader":true,"compress":true,"images":{"deviceSizes":[640,750,828,1080,1200,1920,2048,3840],"imageSizes":[32,48,64,96,128,256,384],"path":"/_next/image","loader":"default","loaderFile":"","domains":[],"disableStaticImages":false,"minimumCacheTTL":14400,"formats":["image/webp"],"maximumRedirects":3,"maximumResponseBody":50000000,"dangerouslyAllowLocalIP":false,"dangerouslyAllowSVG":false,"contentSecurityPolicy":"script-src 'none'; frame-src 'none'; sandbox;","contentDispositionType":"attachment","localPatterns":[{"pathname":"**","search":""}],"remotePatterns":[],"qualities":[75],"unoptimized":true,"customCacheHandler":false},"devIndicators":{"position":"bottom-left"},"onDemandEntries":{"maxInactiveAge":60000,"pagesBufferLength":5},"basePath":"","sassOptions":{},"trailingSlash":false,"i18n":null,"productionBrowserSourceMaps":false,"excludeDefaultMomentLocales":true,"reactProductionProfiling":false,"reactStrictMode":null,"reactMaxHeadersLength":6000,"httpAgentOptions":{"keepAlive":true},"logging":{"serverFunctions":true,"browserToTerminal":"warn"},"compiler":{},"expireTime":31536000,"staticPageGenerationTimeout":60,"output":"standalone","modularizeImports":{"@mui/icons-material":{"transform":"@mui/icons-material/{{member}}"},"lodash":{"transform":"lodash/{{member}}"}},"outputFileTracingRoot":"/home/runner/work/failproofai/failproofai","cacheComponents":false,"cacheLife":{"default":{"stale":300,"revalidate":900,"expire":4294967294},"seconds":{"stale":30,"revalidate":1,"expire":60},"minutes":{"stale":300,"revalidate":60,"expire":3600},"hours":{"stale":300,"revalidate":3600,"expire":86400},"days":{"stale":300,"revalidate":86400,"expire":604800},"weeks":{"stale":300,"revalidate":604800,"expire":2592000},"max":{"stale":300,"revalidate":2592000,"expire":31536000}},"cacheHandlers":{},"experimental":{"appNewScrollHandler":false,"useSkewCookie":false,"cssChunking":true,"multiZoneDraftMode":false,"appNavFailHandling":false,"prerenderEarlyExit":true,"serverMinification":true,"linkNoTouchStart":false,"caseSensitiveRoutes":false,"cachedNavigations":false,"partialFallbacks":false,"dynamicOnHover":false,"varyParams":false,"prefetchInlining":false,"preloadEntriesOnStart":true,"clientRouterFilter":true,"clientRouterFilterRedirects":false,"fetchCacheKeyPrefix":"","proxyPrefetch":"flexible","optimisticClientCache":true,"manualClientBasePath":false,"cpus":3,"memoryBasedWorkersCount":false,"imgOptConcurrency":null,"imgOptTimeoutInSeconds":7,"imgOptMaxInputPixels":268402689,"imgOptSequentialRead":null,"isrFlushToDisk":true,"workerThreads":false,"optimizeCss":false,"nextScriptWorkers":false,"scrollRestoration":false,"externalDir":false,"disableOptimizedLoading":false,"gzipSize":true,"craCompat":false,"esmExternals":true,"fullySpecified":false,"swcTraceProfiling":false,"forceSwcTransforms":false,"largePageDataBytes":128000,"typedEnv":false,"parallelServerCompiles":false,"parallelServerBuildTraces":false,"ppr":false,"authInterrupts":false,"webpackMemoryOptimizations":false,"optimizeServerReact":true,"strictRouteTypes":false,"useTypeScriptCli":false,"viewTransition":false,"removeUncaughtErrorAndRejectionListeners":false,"validateRSCRequestHeaders":false,"staleTimes":{"dynamic":0,"static":300},"reactDebugChannel":true,"serverComponentsHmrCache":true,"staticGenerationMaxConcurrency":8,"staticGenerationMinPagesPerWorker":25,"transitionIndicator":false,"gestureTransition":false,"inlineCss":false,"useCache":false,"globalNotFound":false,"browserDebugInfoInTerminal":"warn","lockDistDir":true,"proxyClientMaxBodySize":10485760,"hideLogsAfterAbort":false,"mcpServer":true,"turbopackFileSystemCacheForDev":true,"turbopackFileSystemCacheForBuild":false,"turbopackInferModuleSideEffects":true,"turbopackPluginRuntimeStrategy":"childProcesses","optimizePackageImports":["lucide-react","date-fns","lodash-es","ramda","antd","react-bootstrap","ahooks","@ant-design/icons","@headlessui/react","@headlessui-float/react","@heroicons/react/20/solid","@heroicons/react/24/solid","@heroicons/react/24/outline","@visx/visx","@tremor/react","rxjs","@mui/material","@mui/icons-material","recharts","react-use","effect","@effect/schema","@effect/platform","@effect/platform-node","@effect/platform-browser","@effect/platform-bun","@effect/sql","@effect/sql-mssql","@effect/sql-mysql2","@effect/sql-pg","@effect/sql-sqlite-node","@effect/sql-sqlite-bun","@effect/sql-sqlite-wasm","@effect/sql-sqlite-react-native","@effect/rpc","@effect/rpc-http","@effect/typeclass","@effect/experimental","@effect/opentelemetry","@material-ui/core","@material-ui/icons","@tabler/icons-react","mui-core","react-icons/ai","react-icons/bi","react-icons/bs","react-icons/cg","react-icons/ci","react-icons/di","react-icons/fa","react-icons/fa6","react-icons/fc","react-icons/fi","react-icons/gi","react-icons/go","react-icons/gr","react-icons/hi","react-icons/hi2","react-icons/im","react-icons/io","react-icons/io5","react-icons/lia","react-icons/lib","react-icons/lu","react-icons/md","react-icons/pi","react-icons/ri","react-icons/rx","react-icons/si","react-icons/sl","react-icons/tb","react-icons/tfi","react-icons/ti","react-icons/vsc","react-icons/wi"],"trustHostHeader":false,"isExperimentalCompile":false},"htmlLimitedBots":"[\\w-]+-Google|Google-[\\w-]+|Chrome-Lighthouse|Slurp|DuckDuckBot|baiduspider|yandex|sogou|bitlybot|tumblr|vkShare|quora link preview|redditbot|ia_archiver|Bingbot|BingPreview|applebot|facebookexternalhit|facebookcatalog|Twitterbot|LinkedInBot|Slackbot|Discordbot|WhatsApp|SkypeUriPreview|Yeti|googleweblight","bundlePagesRouterDependencies":false,"configFileName":"next.config.ts","outputFileTracingExcludes":{"*":["node_modules/@img/**","node_modules/sharp/**"]},"turbopack":{"root":"/home/runner/work/failproofai/failproofai"},"distDirRoot":".next"}
 
 process.env.__NEXT_PRIVATE_STANDALONE_CONFIG = JSON.stringify(nextConfig)
 

package/dist/cli.mjs

@@ -19,7 +19,7 @@ var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
 var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
 // package.json
-var version2 = "1.0.0-beta.1";
+var version2 = "1.0.0-beta.2";
 var init_package = () => {};
 
 // src/posthog-key.ts
@@ -22763,7 +22763,15 @@ var init_daemon_download = __esm(() => {
 });
 
 // src/hooks/daemon-service.ts
-import { existsSync as existsSync21, mkdirSync as mkdirSync11, readFileSync as readFileSync16, writeFileSync as writeFileSync10, unlinkSync as unlinkSync3, rmSync as rmSync4 } from "node:fs";
+import {
+  existsSync as existsSync21,
+  mkdirSync as mkdirSync11,
+  mkdtempSync,
+  readFileSync as readFileSync16,
+  writeFileSync as writeFileSync10,
+  unlinkSync as unlinkSync3,
+  rmSync as rmSync4
+} from "node:fs";
 import { homedir as homedir32, tmpdir, userInfo } from "node:os";
 import { resolve as resolve19, dirname as dirname9 } from "node:path";
 import { execFileSync as execFileSync4 } from "node:child_process";
@@ -22834,7 +22842,10 @@ function resolveWorkerCommand() {
   const workerScript = resolve19(packageRoot, "dist", "worker.mjs");
   if (!existsSync21(workerScript))
     return null;
-  return `${process.execPath} ${workerScript}`;
+  return `${shellQuote(process.execPath)} ${shellQuote(workerScript)}`;
+}
+function shellQuote(value) {
+  return `'${value.replace(/'/g, `'\\''`)}'`;
 }
 function serviceUser() {
   return userInfo().username;
@@ -22848,17 +22859,35 @@ function systemdUnitPath(user = serviceUser()) {
 function legacySystemdUserUnitPath() {
   return resolve19(homedir32(), ".config", "systemd", "user", "failproofaid.service");
 }
-function launchdPlistPath() {
-  return `/Library/LaunchDaemons/${LAUNCHD_LABEL}.plist`;
+function launchdLabel(user = serviceUser()) {
+  return `ai.failproof.failproofaid.${user}`;
+}
+function launchdPlistPath(user = serviceUser()) {
+  return `/Library/LaunchDaemons/${launchdLabel(user)}.plist`;
 }
 function legacyLaunchAgentPlistPath() {
-  return resolve19(homedir32(), "Library", "LaunchAgents", `${LAUNCHD_LABEL}.plist`);
+  return resolve19(homedir32(), "Library", "LaunchAgents", "ai.failproof.failproofaid.plist");
+}
+function legacySharedLaunchDaemonPath() {
+  return "/Library/LaunchDaemons/ai.failproof.failproofaid.plist";
 }
 function daemonServiceFilePath() {
   if (!isDaemonSupportedPlatform())
     return null;
   return process.platform === "linux" ? systemdUnitPath() : launchdPlistPath();
 }
+function primeElevation() {
+  if (typeof process.getuid === "function" && process.getuid() === 0)
+    return true;
+  if (canElevate())
+    return true;
+  try {
+    execFileSync4("sudo", ["-v"], { stdio: "inherit", timeout: SUDO_PROMPT_TIMEOUT_MS });
+    return canElevate();
+  } catch {
+    return false;
+  }
+}
 function canElevate() {
   if (typeof process.getuid === "function" && process.getuid() === 0)
     return true;
@@ -22875,12 +22904,13 @@ function runPrivileged(command, args) {
   execFileSync4(cmd, argv, { stdio: "ignore", timeout: SERVICE_CMD_TIMEOUT_MS });
 }
 function writePrivilegedFile(destination, contents, mode = "0644") {
-  const staging = resolve19(tmpdir(), `failproofaid-${process.pid}-${Date.now()}.tmp`);
+  const stagingDir = mkdtempSync(resolve19(tmpdir(), "failproofaid-stage-"));
+  const staging = resolve19(stagingDir, "service-definition");
   try {
     writeFileSync10(staging, contents, "utf8");
     runPrivileged("install", ["-m", mode, staging, destination]);
   } finally {
-    rmSync4(staging, { force: true });
+    rmSync4(stagingDir, { recursive: true, force: true });
   }
 }
 function removeLegacyUserService() {
@@ -22903,16 +22933,23 @@ function removeLegacyUserService() {
         });
       } catch {}
     } else {
-      const legacy = legacyLaunchAgentPlistPath();
-      if (!existsSync21(legacy))
-        return;
-      try {
-        execFileSync4("launchctl", ["unload", "-w", legacy], {
-          stdio: "ignore",
-          timeout: SERVICE_CMD_TIMEOUT_MS
-        });
-      } catch {}
-      unlinkSync3(legacy);
+      const legacyAgent = legacyLaunchAgentPlistPath();
+      if (existsSync21(legacyAgent)) {
+        try {
+          execFileSync4("launchctl", ["unload", "-w", legacyAgent], {
+            stdio: "ignore",
+            timeout: SERVICE_CMD_TIMEOUT_MS
+          });
+        } catch {}
+        unlinkSync3(legacyAgent);
+      }
+      const legacyDaemon = legacySharedLaunchDaemonPath();
+      if (existsSync21(legacyDaemon)) {
+        try {
+          runPrivileged("launchctl", ["unload", "-w", legacyDaemon]);
+        } catch {}
+        runPrivileged("rm", ["-f", legacyDaemon]);
+      }
     }
   } catch (err) {
     hookLogWarn(`could not remove the legacy user-scope daemon: ${err instanceof Error ? err.message : String(err)}`);
@@ -22960,7 +22997,7 @@ function launchdPlistContents(binaryPath, logDir2, workerCmd) {
 <plist version="1.0">
 <dict>
     <key>Label</key>
-    <string>${LAUNCHD_LABEL}</string>
+    <string>${escapeXml(launchdLabel())}</string>
     <key>ProgramArguments</key>
     <array>
         <string>${escapeXml(binaryPath)}</string>
@@ -23009,7 +23046,7 @@ async function installDaemonService() {
   if (!canElevate()) {
     return {
       installed: false,
-      reason: "root privileges are required to install the failproofaid system service, and sudo is not available without a password. " + `Run: sudo failproofai config  (or install manually: ${daemonInstallCommands(binaryPath, workerCmd).join(" && ")})`
+      reason: "root privileges are required to install the failproofaid system service, and sudo credentials were not available. " + "Re-run `failproofai config` and approve the sudo prompt — do NOT run the CLI itself under sudo, which would " + "configure root's account instead of yours. To install by hand: " + daemonInstallCommands(binaryPath, workerCmd).join(" && ")
     };
   }
   removeLegacyUserService();
@@ -23073,7 +23110,7 @@ function daemonServiceStatus() {
     return "not-installed";
   try {
     const root = typeof process.getuid === "function" && process.getuid() === 0;
-    const args = ["print", `system/${LAUNCHD_LABEL}`];
+    const args = ["print", `system/${launchdLabel()}`];
     const out = root ? execFileSync4("launchctl", args, {
       stdio: ["ignore", "pipe", "ignore"],
       timeout: SERVICE_CMD_TIMEOUT_MS
@@ -23086,7 +23123,7 @@ function daemonServiceStatus() {
     return "stopped";
   }
 }
-var SERVICE_CMD_TIMEOUT_MS = 1e4, SERVICE_START_TIMEOUT_MS = 5000, SERVICE_START_POLL_MS = 100, SERVICE_SETTLE_MS = 750, LAUNCHD_LABEL = "ai.failproof.failproofaid";
+var SERVICE_CMD_TIMEOUT_MS = 1e4, SERVICE_START_TIMEOUT_MS = 5000, SERVICE_START_POLL_MS = 100, SERVICE_SETTLE_MS = 750, SUDO_PROMPT_TIMEOUT_MS = 120000;
 var init_daemon_service = __esm(() => {
   init_hook_logger();
   init_hooks_config();
@@ -23565,15 +23602,15 @@ function describeCustomPolicies(cwd) {
   return { active, warnings, fileCount, scopes };
 }
 function reviewLines(state) {
-  const { scope, clis, policies, cwd, customEnabled } = state;
+  const { scope, clis, policies, cwd, customEnabled, installDaemon } = state;
   const where = scope === "project" ? `This project (${homeify(cwd)})` : "Everywhere (global)";
   const lines = [];
   const assistantNames = clis.map((c3) => getIntegration(c3).displayName);
   lines.push(`  Where      : ${where}`);
   lines.push(`  Assistants : ${assistantNames.length ? summarize(assistantNames, "assistants") : "(none)"}`);
   lines.push(`  Policies   : ${policies.length} enabled`);
-  if (scope === "user" && isDaemonSupportedPlatform()) {
-    lines.push(`  Daemon     : failproofaid will be installed/started as a background service`);
+  if (installDaemon && isDaemonSupportedPlatform()) {
+    lines.push(`  Daemon     : failproofaid, installed as a system service running as you`);
   }
   const custom = describeCustomPolicies(cwd);
   if (custom.active.length > 0) {
@@ -23590,10 +23627,10 @@ function reviewLines(state) {
     }
   }
   lines.push(`    ${homeify(getConfigPathForScope(scope, cwd))}   ${policies.length} policies`);
-  if (scope === "user" && isDaemonSupportedPlatform()) {
+  if (installDaemon && isDaemonSupportedPlatform()) {
     const servicePath = daemonServiceFilePath();
     if (servicePath)
-      lines.push(`    ${homeify(servicePath)}   failproofaid service`);
+      lines.push(`    ${homeify(servicePath)}   failproofaid service (needs root)`);
   }
   return lines;
 }
@@ -23654,6 +23691,15 @@ async function runConfigureWizard(io = {}) {
     stdout.write(`failproofai config needs an interactive terminal.
 Use the flag form instead, e.g.:
   failproofai policies --install --scope user --cli claude
+`);
+    return { applied: false };
+  }
+  if (typeof process.getuid === "function" && process.getuid() === 0 && process.env.SUDO_USER) {
+    stdout.write(`Run failproofai config as ${process.env.SUDO_USER}, not under sudo.
+` + `Everything it configures is per-user — hooks, policies and the daemon's own
+` + `account — so under sudo it would set all of that up for root instead of you.
+` + `The one step that needs root (installing the service) asks for your password
+on its own.
 `);
     return { applied: false };
   }
@@ -23663,6 +23709,43 @@ Use the flag form instead, e.g.:
     outro("Cancelled — nothing was changed.", { ok: false }, stdout);
     return { applied: false };
   };
+  let daemonWanted = false;
+  let elevated = false;
+  if (isDaemonSupportedPlatform()) {
+    const choice = await selectOne({
+      message: "Install the failproofaid background daemon?",
+      choices: [
+        {
+          label: "Yes — keep policy evaluation warm",
+          value: "install",
+          hint: "a system service, started at boot, running as you · needs your password once"
+        },
+        {
+          label: "Not now",
+          value: "skip",
+          hint: "policies still enforce, evaluated per hook call"
+        }
+      ],
+      stdin,
+      stdout
+    });
+    if (choice === null)
+      return cancel();
+    daemonWanted = choice === "install";
+    if (daemonWanted) {
+      stdout.write(`
+Installing the failproofaid service needs root. Your password stays with sudo.
+`);
+      elevated = primeElevation();
+      if (!elevated) {
+        stdout.write(`Could not get sudo — carrying on without the daemon.
+` + `Everything else still applies, and policies still enforce in-process.
+
+`);
+        daemonWanted = false;
+      }
+    }
+  }
   const scope = await selectOne({
     message: "Where should this apply?",
     choices: buildScopeChoices(cwd),
@@ -23710,7 +23793,7 @@ Use the flag form instead, e.g.:
   const customEnabled = hasCustomFiles ? presets.includes(CUSTOM) : undefined;
   const decision = await selectOne({
     message: "Ready to apply?",
-    body: reviewLines({ scope, clis, policies, cwd, customEnabled }),
+    body: reviewLines({ scope, clis, policies, cwd, customEnabled, installDaemon: daemonWanted }),
     choices: [
       { label: "Yes, apply now", value: "apply", hint: "write the config" },
       { label: "Cancel", value: "cancel", hint: "quit, no changes" }
@@ -23730,7 +23813,7 @@ Use the flag form instead, e.g.:
   await installHooks2(policies, scope, cwd, false, "configure-wizard", undefined, false, clis, { replace: true, quiet: true });
   setCustomPoliciesEnabled(scope, cwd, customEnabled);
   let daemonInstalled = false;
-  if (scope === "user" && isDaemonSupportedPlatform()) {
+  if (daemonWanted) {
     const daemonResult = await installDaemonService();
     if (daemonResult.installed) {
       setDaemonConfigured(true);
@@ -23889,7 +23972,7 @@ import { realpathSync as realpathSync4 } from "fs";
 import { dirname as dirname11, resolve as resolve22 } from "path";
 import { fileURLToPath as fileURLToPath4 } from "url";
 // package.json
-var version = "1.0.0-beta.1";
+var version = "1.0.0-beta.2";
 
 // bin/failproofai.mjs
 if (!process.env.FAILPROOFAI_PACKAGE_ROOT) {

package/dist/worker.mjs

@@ -2285,7 +2285,7 @@ var init_builtin_policies = __esm(() => {
 });
 
 // package.json
-var version = "1.0.0-beta.1";
+var version = "1.0.0-beta.2";
 var init_package = () => {};
 
 // src/posthog-key.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "failproofai",
-  "version": "1.0.0-beta.1",
+  "version": "1.0.0-beta.2",
   "description": "The easiest way to manage policies that keep your AI agents reliable, on-task, and running autonomously — for Claude Code & the Agents SDK",
   "bin": {
     "failproofai": "./dist/cli.mjs",

package/src/hooks/configure-wizard.ts

@@ -43,6 +43,7 @@ import {
   isDaemonSupportedPlatform,
   installDaemonService,
   daemonServiceFilePath,
+  primeElevation,
   setDaemonConfigured,
 } from "./daemon-service";
 import { hookLogWarn } from "./hook-logger";
@@ -350,8 +351,14 @@ export function reviewLines(state: {
   cwd: string;
   /** The Custom checkbox. `undefined` = nothing to toggle, leave as-is. */
   customEnabled?: boolean;
+  /**
+   * Step 0's answer. The daemon is machine-level, so this is a decision the
+   * user made explicitly rather than something inferred from the scope —
+   * showing it any other way would promise a service the apply won't install.
+   */
+  installDaemon?: boolean;
 }): string[] {
-  const { scope, clis, policies, cwd, customEnabled } = state;
+  const { scope, clis, policies, cwd, customEnabled, installDaemon } = state;
   const where =
     scope === "project" ? `This project (${homeify(cwd)})` : "Everywhere (global)";
   const lines: string[] = [];
@@ -359,9 +366,9 @@ export function reviewLines(state: {
   lines.push(`  Where      : ${where}`);
   lines.push(`  Assistants : ${assistantNames.length ? summarize(assistantNames, "assistants") : "(none)"}`);
   lines.push(`  Policies   : ${policies.length} enabled`);
-  if (scope === "user" && isDaemonSupportedPlatform()) {
+  if (installDaemon && isDaemonSupportedPlatform()) {
     lines.push(
-      `  Daemon     : failproofaid will be installed/started as a background service`,
+      `  Daemon     : failproofaid, installed as a system service running as you`,
     );
   }
 
@@ -389,9 +396,9 @@ export function reviewLines(state: {
     }
   }
   lines.push(`    ${homeify(getConfigPathForScope(scope, cwd))}   ${policies.length} policies`);
-  if (scope === "user" && isDaemonSupportedPlatform()) {
+  if (installDaemon && isDaemonSupportedPlatform()) {
     const servicePath = daemonServiceFilePath();
-    if (servicePath) lines.push(`    ${homeify(servicePath)}   failproofaid service`);
+    if (servicePath) lines.push(`    ${homeify(servicePath)}   failproofaid service (needs root)`);
   }
   return lines;
 }
@@ -500,6 +507,24 @@ export async function runConfigureWizard(io: WizardIO = {}): Promise<WizardResul
     return { applied: false };
   }
 
+  // Running the wizard itself under sudo configures the WRONG ACCOUNT, and
+  // does it silently: homedir() becomes /root, so the hooks land in root's
+  // settings, `daemonConfigured` is set for root, the daemon binary downloads
+  // to /root/.failproofai/bin, and the unit is generated with User=root —
+  // exactly the elevation the design exists to avoid. SUDO_USER is set only
+  // when a real user sudo'd here, which distinguishes this mistake from a
+  // legitimately root-only environment (a container that has no other user).
+  if (typeof process.getuid === "function" && process.getuid() === 0 && process.env.SUDO_USER) {
+    stdout.write(
+      `Run failproofai config as ${process.env.SUDO_USER}, not under sudo.\n` +
+        "Everything it configures is per-user — hooks, policies and the daemon's own\n" +
+        "account — so under sudo it would set all of that up for root instead of you.\n" +
+        "The one step that needs root (installing the service) asks for your password\n" +
+        "on its own.\n",
+    );
+    return { applied: false };
+  }
+
   // Fire-and-forget: never block the wizard's first paint on telemetry.
   void emit("configure_started", {});
   intro("let's set up your safety net", stdout);
@@ -509,6 +534,55 @@ export async function runConfigureWizard(io: WizardIO = {}): Promise<WizardResul
     return { applied: false };
   };
 
+  // 0 — The background daemon, before anything else.
+  //
+  // First because it is the only step that needs a password: asking here
+  // means sudo prompts on a clean terminal, before any question has drawn a
+  // screen, instead of firing from underneath a rendered TUI where the prompt
+  // is invisible and the typed password lands in a redrawn frame. `sudo -v`
+  // caches the credential for the rest of the run, so the actual install at
+  // apply time stays non-interactive.
+  //
+  // Machine-level, so it is deliberately NOT gated on the scope chosen in the
+  // next step: one daemon serves every project on this machine.
+  let daemonWanted = false;
+  let elevated = false;
+  if (isDaemonSupportedPlatform()) {
+    const choice = await selectOne<"install" | "skip">({
+      message: "Install the failproofaid background daemon?",
+      choices: [
+        {
+          label: "Yes — keep policy evaluation warm",
+          value: "install",
+          hint: "a system service, started at boot, running as you · needs your password once",
+        },
+        {
+          label: "Not now",
+          value: "skip",
+          hint: "policies still enforce, evaluated per hook call",
+        },
+      ],
+      stdin,
+      stdout,
+    });
+    if (choice === null) return cancel();
+    daemonWanted = choice === "install";
+
+    if (daemonWanted) {
+      stdout.write("\nInstalling the failproofaid service needs root. Your password stays with sudo.\n");
+      elevated = primeElevation();
+      if (!elevated) {
+        // Never fatal: the rest of setup is worth applying, and a machine with
+        // no daemon is exactly the machine every release before this one had.
+        stdout.write(
+          "Could not get sudo — carrying on without the daemon.\n" +
+            "Everything else still applies, and policies still enforce in-process.\n\n",
+        );
+        daemonWanted = false;
+      }
+    }
+  }
+
   // 1 — Where?
   const scope = await selectOne<HookScope>({
     message: "Where should this apply?",
@@ -579,7 +653,7 @@ export async function runConfigureWizard(io: WizardIO = {}): Promise<WizardResul
   // 4 — Review & apply
   const decision = await selectOne<"apply" | "cancel">({
     message: "Ready to apply?",
-    body: reviewLines({ scope, clis, policies, cwd, customEnabled }),
+    body: reviewLines({ scope, clis, policies, cwd, customEnabled, installDaemon: daemonWanted }),
     choices: [
       { label: "Yes, apply now", value: "apply", hint: "write the config" },
       { label: "Cancel", value: "cancel", hint: "quit, no changes" },
@@ -615,14 +689,14 @@ export async function runConfigureWizard(io: WizardIO = {}): Promise<WizardResul
   );
   setCustomPoliciesEnabled(scope, cwd, customEnabled);
 
-  // Daemon setup — unconditional on Linux/macOS whenever the global scope
-  // was chosen (a daemon is per-machine, not per-project), no separate
-  // opt-in step or command. A failure here (binary not found, no service
-  // manager, ...) never fails the wizard — the rest of setup already
-  // applied, and this machine simply stays on the in-process path exactly
-  // as before, since `daemonConfigured` is only set on success.
+  // Daemon setup — driven by step 0's answer, with the sudo credential it
+  // already primed, so nothing here can stop to ask a question. A failure
+  // (binary download blocked, no service manager, a daemon that won't stay
+  // up) never fails the wizard: the rest of setup already applied, and this
+  // machine simply stays on the in-process path, since `daemonConfigured` is
+  // only set on success.
   let daemonInstalled = false;
-  if (scope === "user" && isDaemonSupportedPlatform()) {
+  if (daemonWanted) {
     const daemonResult = await installDaemonService();
     if (daemonResult.installed) {
       setDaemonConfigured(true);