failproofai 1.0.0-beta.1 → 1.0.0-beta.3

package/src/hooks/daemon-service.ts

@@ -8,7 +8,15 @@
  * `configure-wizard.ts` calls the functions here directly, the same
  * relationship it already has with `manager.ts`'s `installHooks()`.
  */
-import { existsSync, mkdirSync, readFileSync, writeFileSync, unlinkSync, rmSync } from "node:fs";
+import {
+  existsSync,
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  writeFileSync,
+  unlinkSync,
+  rmSync,
+} from "node:fs";
 import { homedir, tmpdir, userInfo } from "node:os";
 import { resolve, dirname } from "node:path";
 import { execFileSync } from "node:child_process";
@@ -45,6 +53,14 @@ const SERVICE_START_POLL_MS = 100;
  */
 const SERVICE_SETTLE_MS = 750;
 
+/**
+ * How long `sudo -v` may sit at its password prompt. Unlike every other
+ * timeout here, this one is waiting on a human typing, not on a service
+ * manager — three attempts at a password is well inside two minutes, and
+ * sudo gives up on its own long before that.
+ */
+const SUDO_PROMPT_TIMEOUT_MS = 120_000;
+
 /**
  * Writes (or clears) the machine-wide `daemonConfigured` marker in
  * `~/.failproofai/policies-config.json`.
@@ -175,6 +191,14 @@ export function resolveWorkerCommand(): string | null {
   if (!packageRoot) return null;
   const workerScript = resolve(packageRoot, "dist", "worker.mjs");
   if (!existsSync(workerScript)) return null;
+  // Both paths are shell-quoted: the daemon runs this value through `sh -c`
+  // (`WorkerCommand::Shell` in crates/failproofaid/src/worker.rs), so an
+  // unquoted path splits on its spaces and the worker never starts. Not
+  // hypothetical on macOS, where `/Users/First Last/...` is ordinary — and
+  // more exposed since execPath replaced a bare `node`, because execPath is
+  // home-derived. systemd's own `Environment="..."` quoting does not help
+  // here; that protects the unit parse, not the later shell split.
+  //
   // `process.execPath`, not a bare `node`. A system-scope service does not
   // inherit a login environment, so its PATH is the system default — and the
   // single most common way to install Node is nvm, which puts it under
@@ -183,7 +207,13 @@ export function resolveWorkerCommand(): string | null {
   // silently, on exactly the machines least likely to notice. execPath is
   // whatever runtime is executing this CLI right now (node for the published
   // bin, bun in a source checkout), absolute either way.
-  return `${process.execPath} ${workerScript}`;
+  return `${shellQuote(process.execPath)} ${shellQuote(workerScript)}`;
+}
+
+/** POSIX single-quoting: everything is literal inside '…', and a literal
+ *  quote is closed, escaped and reopened. */
+function shellQuote(value: string): string {
+  return `'${value.replace(/'/g, `'\\''`)}'`;
 }
 
 /**
@@ -224,15 +254,33 @@ function legacySystemdUserUnitPath(): string {
   return resolve(homedir(), ".config", "systemd", "user", "failproofaid.service");
 }
 
-const LAUNCHD_LABEL = "ai.failproof.failproofaid";
+/**
+ * Per user, for the same reason the systemd unit is: a LaunchDaemon's
+ * contents are entirely user-specific — `UserName`, the ExecStart path under
+ * that user's `~/.failproofai/bin`, the log paths under that user's home — so
+ * one shared label means the second user's install silently overwrites the
+ * first's daemon, and their uninstall deletes it.
+ */
+function launchdLabel(user: string = serviceUser()): string {
+  return `ai.failproof.failproofaid.${user}`;
+}
 
-function launchdPlistPath(): string {
-  return `/Library/LaunchDaemons/${LAUNCHD_LABEL}.plist`;
+function launchdPlistPath(user: string = serviceUser()): string {
+  return `/Library/LaunchDaemons/${launchdLabel(user)}.plist`;
 }
 
-/** The pre-1.0.0-beta.1 LaunchAgent — same migration problem as above. */
+/** The pre-1.0.0-beta.1 LaunchAgent. */
 function legacyLaunchAgentPlistPath(): string {
-  return resolve(homedir(), "Library", "LaunchAgents", `${LAUNCHD_LABEL}.plist`);
+  return resolve(homedir(), "Library", "LaunchAgents", "ai.failproof.failproofaid.plist");
+}
+
+/**
+ * The 1.0.0-beta.1 LaunchDaemon, before the label was namespaced. Removed on
+ * install like the LaunchAgent is: it holds the same singleton flock, so
+ * leaving it would leave two daemons racing for one socket.
+ */
+function legacySharedLaunchDaemonPath(): string {
+  return "/Library/LaunchDaemons/ai.failproof.failproofaid.plist";
 }
 
 /**
@@ -255,7 +303,38 @@ export function daemonStatusCommand(): string | null {
   if (!isDaemonSupportedPlatform()) return null;
   return process.platform === "linux"
     ? `systemctl status ${systemdUnitName()}`
-    : `sudo launchctl print system/${LAUNCHD_LABEL}`;
+    : `sudo launchctl print system/${launchdLabel()}`;
+}
+
+/**
+ * Acquires sudo credentials up front, prompting in the terminal if needed.
+ *
+ * `sudo -v` refreshes the user's sudo timestamp and returns; every later
+ * `sudo -n` in this run then succeeds against that cached credential. Doing it
+ * here, once, at a known point in the wizard is what makes the rest of the
+ * install non-interactive — the alternative, an interactive sudo firing from
+ * underneath a half-drawn TUI screen, is a password prompt the user cannot
+ * see.
+ *
+ * NOT the same as running the whole CLI under sudo, which is actively wrong:
+ * `homedir()` would become /root, so the hooks, the policy config, the
+ * downloaded binary and the unit's own `User=` would all be root's rather
+ * than the user's, quietly configuring the wrong account.
+ *
+ * `stdio: "inherit"` so the prompt and the typed password go straight to the
+ * real terminal. The timeout is generous because a human is typing.
+ */
+export function primeElevation(): boolean {
+  if (typeof process.getuid === "function" && process.getuid() === 0) return true;
+  if (canElevate()) return true; // NOPASSWD, or already primed
+  try {
+    execFileSync("sudo", ["-v"], { stdio: "inherit", timeout: SUDO_PROMPT_TIMEOUT_MS });
+    return canElevate();
+  } catch {
+    // Wrong password, no sudo rights, or the user pressed ctrl-C. All of them
+    // mean the same thing here: carry on without a daemon.
+    return false;
+  }
 }
 
 /** True when privileged commands can run without prompting for a password. */
@@ -289,12 +368,19 @@ function runPrivileged(command: string, args: string[]): void {
  * mode in the same step, so the file is never briefly world-writable.
  */
 function writePrivilegedFile(destination: string, contents: string, mode = "0644"): void {
-  const staging = resolve(tmpdir(), `failproofaid-${process.pid}-${Date.now()}.tmp`);
+  // mkdtempSync, not a name built from pid + timestamp in the shared tmpdir.
+  // That name is guessable, and `writeFileSync` follows a symlink already
+  // sitting at the path — so on a multi-user box another local user could
+  // pre-create it and have `install` copy content they control into
+  // /etc/systemd/system as root. mkdtemp gives a 0700 directory with a name
+  // they cannot predict, so there is nothing to pre-create.
+  const stagingDir = mkdtempSync(resolve(tmpdir(), "failproofaid-stage-"));
+  const staging = resolve(stagingDir, "service-definition");
   try {
     writeFileSync(staging, contents, "utf8");
     runPrivileged("install", ["-m", mode, staging, destination]);
   } finally {
-    rmSync(staging, { force: true });
+    rmSync(stagingDir, { recursive: true, force: true });
   }
 }
 
@@ -326,17 +412,30 @@ function removeLegacyUserService(): void {
         /* best-effort */
       }
     } else {
-      const legacy = legacyLaunchAgentPlistPath();
-      if (!existsSync(legacy)) return;
-      try {
-        execFileSync("launchctl", ["unload", "-w", legacy], {
-          stdio: "ignore",
-          timeout: SERVICE_CMD_TIMEOUT_MS,
-        });
-      } catch {
-        /* not loaded */
+      const legacyAgent = legacyLaunchAgentPlistPath();
+      if (existsSync(legacyAgent)) {
+        try {
+          execFileSync("launchctl", ["unload", "-w", legacyAgent], {
+            stdio: "ignore",
+            timeout: SERVICE_CMD_TIMEOUT_MS,
+          });
+        } catch {
+          /* not loaded */
+        }
+        unlinkSync(legacyAgent);
+      }
+
+      // The 1.0.0-beta.1 daemon, before the label was per-user. Privileged,
+      // and only reachable on a path that has already elevated.
+      const legacyDaemon = legacySharedLaunchDaemonPath();
+      if (existsSync(legacyDaemon)) {
+        try {
+          runPrivileged("launchctl", ["unload", "-w", legacyDaemon]);
+        } catch {
+          /* not loaded */
+        }
+        runPrivileged("rm", ["-f", legacyDaemon]);
       }
-      unlinkSync(legacy);
     }
   } catch (err) {
     hookLogWarn(`could not remove the legacy user-scope daemon: ${err instanceof Error ? err.message : String(err)}`);
@@ -390,7 +489,7 @@ function launchdPlistContents(binaryPath: string, logDir: string, workerCmd: str
 <plist version="1.0">
 <dict>
     <key>Label</key>
-    <string>${LAUNCHD_LABEL}</string>
+    <string>${escapeXml(launchdLabel())}</string>
     <key>ProgramArguments</key>
     <array>
         <string>${escapeXml(binaryPath)}</string>
@@ -471,8 +570,10 @@ export async function installDaemonService(): Promise<DaemonInstallResult> {
     return {
       installed: false,
       reason:
-        "root privileges are required to install the failproofaid system service, and sudo is not available without a password. " +
-        `Run: sudo failproofai config  (or install manually: ${daemonInstallCommands(binaryPath, workerCmd).join(" && ")})`,
+        "root privileges are required to install the failproofaid system service, and sudo credentials were not available. " +
+        "Re-run `failproofai config` and approve the sudo prompt — do NOT run the CLI itself under sudo, which would " +
+        "configure root's account instead of yours. To install by hand: " +
+        daemonInstallCommands(binaryPath, workerCmd).join(" && "),
     };
   }
 
@@ -631,7 +732,7 @@ export function daemonServiceStatus(): DaemonServiceStatus {
     // `launchctl list` cannot see — unlike systemd, reading the state needs
     // the same elevation installing it did.
     const root = typeof process.getuid === "function" && process.getuid() === 0;
-    const args = ["print", `system/${LAUNCHD_LABEL}`];
+    const args = ["print", `system/${launchdLabel()}`];
     const out = root
       ? execFileSync("launchctl", args, {
           stdio: ["ignore", "pipe", "ignore"],

package/src/hooks/handler.ts

@@ -41,6 +41,8 @@ import { resolveTranscriptPath } from "./resolve-transcript-path";
 import { getInstanceId } from "../../lib/telemetry-id";
 import { hookLogInfo, hookLogWarn } from "./hook-logger";
 import { readStdinPayload } from "./read-stdin";
+import { readActiveCloudManagedPolicies, type CloudManagedPolicyArtifact } from "./cloud-managed-policies";
+import { readActivePause, type ActivePause } from "./session-pause";
 
 /**
  * Canonicalize an event name to PascalCase. Codex sends snake_case event names
@@ -134,6 +136,37 @@ export interface EvaluateHookEventOptions {
   fallbackCwd?: string;
 }
 
+/**
+ * Runs an observe-mode policy under the same timeout and error handling as an
+ * enforcing one, so what gets measured is what would actually have happened —
+ * including a policy that times out, which in enforce mode is an allow and must
+ * be recorded as one rather than as a would-deny.
+ */
+async function runObserved(
+  hook: CustomHook,
+  ctx: Parameters<CustomHook["fn"]>[0],
+  hookName: string,
+  eventType: string,
+  cli: IntegrationType,
+): Promise<PolicyResult> {
+  try {
+    return await Promise.race([
+      hook.fn(ctx),
+      new Promise<PolicyResult>((_, reject) => setTimeout(() => reject(new Error("timeout")), 10_000)),
+    ]);
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    void trackHookEvent(getInstanceId(), "custom_hook_error", {
+      hook_name: hookName,
+      error_type: msg === "timeout" ? "timeout" : "exception",
+      event_type: eventType,
+      cli,
+      is_observe_mode: true,
+    });
+    return { decision: "allow" };
+  }
+}
+
 /**
  * The core hook-evaluation logic, decoupled from process stdin/stdout so it
  * can be called repeatedly inside a long-lived process (the daemon's warm
@@ -209,6 +242,20 @@ export async function evaluateHookEvent(
     let config: HooksConfig;
     let customHooksList: CustomHook[] = [];
     let conventionHookNames = new Set<string>();
+    let activePause: ActivePause | null = null;
+    /** Registered policy name → where it came from. See the set() below. */
+    const policyAttribution = new Map<
+      string,
+      { source: "custom" | "convention" | "cloud"; cloudPolicyId?: string; cloudRevision?: number }
+    >();
+    let cloudGeneration: number | undefined;
+    /** What observe-mode policies WOULD have done, had they been enforcing. */
+    const observedResults: Array<{
+      policyId: string;
+      revision: number;
+      decision: "deny" | "instruct";
+      reason: string | null;
+    }> = [];
 
     if (opts?.forceDecision) {
       // Fail-closed: no config/custom-hook loading at all — a daemon that
@@ -228,25 +275,80 @@ export async function evaluateHookEvent(
       // Load enabled policies (merge across project/local/global scopes)
       config = readMergedHooksConfig(session.cwd);
       clearPolicies();
-      registerBuiltinPolicies(config.enabledPolicies);
+
+      // A session pause suspends LOCAL policy only, for a bounded time. Cloud
+      // assignments are exempt below for the same reason `disabledCustomPolicies`
+      // already exempts them: a locally-issued command that could switch off a
+      // centrally assigned policy would make cloud enforcement decorative.
+      activePause = readActivePause(session.sessionId);
+      registerBuiltinPolicies(activePause ? [] : config.enabledPolicies);
+
+      // Cloud-managed policies are daemon-reconciled artifacts, but they use
+      // the same public JS policy API as local custom policies. Verify and add
+      // only the paths referenced by the atomically active generation.
+      const cloudManagedPolicies = readActiveCloudManagedPolicies();
+      // Recorded on every row once a machine is managed, whether or not a cloud
+      // policy decided this event: "what was deployed here at the time" is a
+      // separate question from "what decided", and only the former can tell a
+      // rollout that changed nothing from one that never reached the machine.
+      cloudGeneration = cloudManagedPolicies[0]?.generation;
+      const configuredCustomPaths = config.customPoliciesPaths ?? config.customPoliciesPath;
+      const allExplicitPaths =
+        cloudManagedPolicies.length === 0
+          ? configuredCustomPaths
+          : [
+              ...(typeof configuredCustomPaths === "string" ? [configuredCustomPaths] : configuredCustomPaths ?? []),
+              ...cloudManagedPolicies.map((policy) => policy.path),
+            ];
 
       // Load and register custom hooks (layer 2, after builtins)
-      const loadResult = await loadAllCustomHooks(config.customPoliciesPaths ?? config.customPoliciesPath, {
+      const loadResult = await loadAllCustomHooks(allExplicitPaths, {
         sessionCwd: session.cwd,
         customPoliciesEnabled: config.customPoliciesEnabled,
+        ...(cloudManagedPolicies.length > 0 ? { cloudManagedPolicies } : {}),
       });
       customHooksList = loadResult.hooks;
       const disabledCustomPolicies = new Set(config.disabledCustomPolicies ?? []);
       conventionHookNames = new Set(loadResult.conventionSources.flatMap((s) => s.hookNames));
 
       for (const hook of customHooksList) {
-        const policyId = (hook as CustomHook & { __policyId?: string }).__policyId;
-        if (policyId && disabledCustomPolicies.has(policyId)) continue;
+        const taggedHook = hook as CustomHook & {
+          __policyId?: string;
+          __cloudManaged?: CloudManagedPolicyArtifact;
+        };
+        const policyId = taggedHook.__policyId;
+        const cloudManaged = taggedHook.__cloudManaged;
+        // Local config cannot disable a centrally assigned policy merely by
+        // copying its generated ID into disabledCustomPolicies.
+        if (!cloudManaged && policyId && disabledCustomPolicies.has(policyId)) continue;
+        // Same rule for a session pause — it suspends local policy, never cloud.
+        if (!cloudManaged && activePause) continue;
         const hookName = hook.name;
         const conventionScope = (hook as CustomHook & { __conventionScope?: string }).__conventionScope;
         const isConvention = !!conventionScope;
-        const prefix = isConvention ? `.failproofai-${conventionScope}` : "custom";
+        const prefix = cloudManaged
+          ? `cloud/${cloudManaged.id}@${cloudManaged.revision}`
+          : isConvention
+            ? `.failproofai-${conventionScope}`
+            : "custom";
+        // Observe mode: run it for real, record what it decided, then hand back
+        // an allow. Evaluating and discarding is the whole point — a rollout is
+        // measured against real traffic before it can break anyone's work, and
+        // a policy that did not actually run would measure nothing.
+        const observeOnly = cloudManaged?.effect === "observe";
         const fn: PolicyFunction = async (ctx): Promise<PolicyResult> => {
+          if (observeOnly) {
+            const shadow = await runObserved(hook, ctx, hookName, eventType, cli);
+            if (shadow.decision !== "allow") {
+              observedResults.push({
+                policyId: cloudManaged!.id,
+                revision: cloudManaged!.revision,
+                decision: shadow.decision,
+                reason: shadow.reason ?? null,
+              });
+            }
+            return { decision: "allow" };
+          }
           try {
             const result = await Promise.race([
               hook.fn(ctx),
@@ -268,8 +370,18 @@ export async function evaluateHookEvent(
             return { decision: "allow" };
           }
         };
+        const registeredName = `${prefix}/${hookName}`;
+        // Record where this policy came from as structured data, keyed by the
+        // exact name the evaluator will report back. The display name already
+        // encodes it ("cloud/org-guard@7/…"), but only as a string — so the one
+        // question cloud attribution has to answer, "which rollout produced
+        // this decision", could only be answered by re-parsing our own label.
+        policyAttribution.set(registeredName, {
+          source: cloudManaged ? "cloud" : isConvention ? "convention" : "custom",
+          ...(cloudManaged ? { cloudPolicyId: cloudManaged.id, cloudRevision: cloudManaged.revision } : {}),
+        });
         registerPolicy(
-          `${prefix}/${hookName}`,
+          registeredName,
           hook.description ?? "",
           fn,
           hook.match ?? {},
@@ -335,6 +447,32 @@ export async function evaluateHookEvent(
       cwd: session.cwd,
       permissionMode: session.permissionMode,
       hookEventName: session.hookEventName,
+      // Attribution. A builtin is anything registered that is not in the map,
+      // so its absence is meaningful rather than missing — but only when a
+      // policy actually decided; a plain allow names nobody.
+      ...(result.policyName
+        ? (() => {
+            const attribution = policyAttribution.get(result.policyName);
+            return {
+              policySource: attribution?.source ?? ("builtin" as const),
+              ...(attribution?.cloudPolicyId ? { cloudPolicyId: attribution.cloudPolicyId } : {}),
+              ...(attribution?.cloudRevision !== undefined
+                ? { cloudRevision: attribution.cloudRevision }
+                : {}),
+            };
+          })()
+        : {}),
+      ...(cloudGeneration !== undefined ? { cloudGeneration } : {}),
+      // The point of observe mode is this record. Without it the rollout is
+      // unmeasurable and the row is indistinguishable from one where the policy
+      // never matched at all.
+      ...(observedResults.length > 0 ? { observed: observedResults } : {}),
+      // Without these, a row logged during a pause is indistinguishable from
+      // one where every policy ran and allowed — the log would assert a clean
+      // window over exactly the window that was not enforced.
+      ...(activePause
+        ? { pausedBy: activePause.setBy, pauseExpiresAt: activePause.expiresAt }
+        : {}),
     };
     try {
       persistHookActivity(activityEntry);

package/src/hooks/hook-activity-store.ts

@@ -69,6 +69,45 @@ export interface HookActivityEntry {
   cwd?: string;
   permissionMode?: string;
   hookEventName?: string;
+  /**
+   * Set only on events evaluated while a session pause was active. Absent on
+   * every ordinary row and on every row written before pausing existed, so —
+   * like `matchedPolicies` — consumers must treat `undefined` as "not paused"
+   * rather than rendering it as unknown.
+   */
+  pausedBy?: string;
+  /** Epoch ms the pause lifts. Present iff `pausedBy` is. */
+  pauseExpiresAt?: number;
+  /**
+   * Where the policy that DECIDED came from. Absent when nothing decided (a
+   * plain allow) and on rows written before this existed — so, like
+   * `matchedPolicies`, `undefined` means "unknown", not "builtin".
+   */
+  policySource?: "builtin" | "custom" | "convention" | "cloud";
+  /** Cloud policy id of the decider. Present only when `policySource` is "cloud". */
+  cloudPolicyId?: string;
+  /** Immutable revision of that policy — the half of attribution that identifies WHICH version ran. */
+  cloudRevision?: number;
+  /**
+   * The cloud generation active when this event was evaluated, recorded on
+   * every row of a managed machine regardless of what decided. "What was
+   * deployed here" is a different question from "what decided", and only this
+   * distinguishes a rollout that changed no outcomes from one that never
+   * arrived.
+   */
+  cloudGeneration?: number;
+  /**
+   * What observe-mode policies WOULD have done, had they been enforcing. This
+   * record is the entire point of observe mode: without it the row is
+   * indistinguishable from one where the policy never matched, and the rollout
+   * being trialled is unmeasurable.
+   */
+  observed?: Array<{
+    policyId: string;
+    revision: number;
+    decision: "deny" | "instruct";
+    reason: string | null;
+  }>;
 }
 
 export interface HookActivityFilters {
@@ -77,6 +116,12 @@ export interface HookActivityFilters {
   policyName?: string;
   sessionId?: string;
   integration?: IntegrationType;
+  /**
+   * Filter by where the deciding policy came from. "Show me everything my
+   * organization's policies decided" is the question cloud rollout reporting
+   * is built on, and it is unanswerable without this.
+   */
+  source?: "builtin" | "custom" | "convention" | "cloud";
 }
 
 export interface HookActivityStats {
@@ -298,6 +343,11 @@ export function searchHookActivity(
       return false;
     }
     if (filters.integration && entry.integration !== filters.integration) return false;
+    // Rows written before attribution existed have no policySource. They are
+    // excluded from every source filter rather than guessed at — a wrong
+    // attribution is worse than a missing one when the point is proving which
+    // rollout decided something.
+    if (filters.source && entry.policySource !== filters.source) return false;
     return true;
   });
 

package/src/hooks/loader-utils.ts

@@ -77,8 +77,9 @@ export async function resolveLocalImport(
 export async function createEsmShim(
   distIndex: string,
   distUrl: string,
+  tmpSuffix = TMP_SUFFIX,
 ): Promise<{ shimPath: string; shimUrl: string }> {
-  const shimPath = distIndex + ".__failproofai_esm_shim__.mjs";
+  const shimPath = `${distIndex}${tmpSuffix}.shim.mjs`;
   const shimCode = [
     `import _cjs from '${distUrl}';`,
     `export const customPolicies = _cjs.customPolicies;`,
@@ -101,6 +102,7 @@ export async function rewriteFileTree(
   entryPath: string,
   distUrl: string | null,
   distIndex: string | null,
+  tmpSuffix = TMP_SUFFIX,
 ): Promise<string[]> {
   const queue: string[] = [entryPath];
   const visited = new Set<string>();
@@ -108,7 +110,7 @@ export async function rewriteFileTree(
 
   let esmShimUrl: string | null = null;
   if (distIndex && distUrl) {
-    const shim = await createEsmShim(distIndex, distUrl);
+    const shim = await createEsmShim(distIndex, distUrl, tmpSuffix);
     tmpFiles.push(shim.shimPath);
     esmShimUrl = shim.shimUrl;
   }
@@ -148,7 +150,7 @@ export async function rewriteFileTree(
         if (!visited.has(resolved) && !queue.includes(resolved)) {
           queue.push(resolved);
         }
-        let relPath = relative(dir, resolved + TMP_SUFFIX).split("\\").join("/");
+        let relPath = relative(dir, resolved + tmpSuffix).split("\\").join("/");
         if (!relPath.startsWith(".")) relPath = "./" + relPath;
         rewrites.set(specifier, relPath);
       }
@@ -163,7 +165,7 @@ export async function rewriteFileTree(
       code = code.replace(new RegExp(`"${escaped}"`, "g"), `"${replacement}"`);
     }
 
-    const tmpPath = filePath + TMP_SUFFIX;
+    const tmpPath = filePath + tmpSuffix;
     await writeFile(tmpPath, code, "utf-8");
     tmpFiles.push(tmpPath);
   }

package/src/hooks/policy-types.ts

@@ -80,8 +80,36 @@ export interface LlmConfig {
   model?: string;
 }
 
+/**
+ * The collector's non-secret settings. The ingest credential deliberately does
+ * NOT live here: this file is written with a bare `writeFileSync`, so it
+ * inherits the umask and lands at 0664 inside a 0775 `~/.failproofai/` — an API
+ * key here would be readable by every local user. It lives in
+ * `~/.failproofai/ingest.json` at 0600 instead.
+ *
+ * Read by the Rust daemon (`crates/fpai-collect/src/config.rs`); the field
+ * names must stay in step with the `Settings` struct there.
+ */
+export interface CollectorConfig {
+  /**
+   * Ship agent session transcripts. Defaults to false and is a SEPARATE opt-in
+   * from configuring a key, because transcripts carry prompts, file contents
+   * and whatever was pasted into a terminal.
+   */
+  sessions?: boolean;
+  /** Ship hook activity. Carries decisions and tool names, never file contents. */
+  hooks?: boolean;
+  /** `decisions` keeps every deny/instruct exact and aggregates the ~99% allows. */
+  hooksVerbosity?: "all" | "decisions" | "off";
+  redact?: "minimal" | "off";
+  /** Label stamped on every event. Must not contain a comma — ingest skips those lines. */
+  environment?: string;
+}
+
 export interface HooksConfig {
   enabledPolicies: string[];
+  /** Collector settings; see {@link CollectorConfig}. Absent means unconfigured. */
+  collector?: CollectorConfig;
   llm?: LlmConfig;
   policyParams?: Record<string, Record<string, unknown>>;
   /** Explicit custom policy files, loaded in array order. */
@@ -98,6 +126,13 @@ export interface HooksConfig {
    * Only ever written explicitly as `false`.
    */
   customPoliciesEnabled?: boolean;
+  /**
+   * Upper bound, in ms, on how long `failproofai config --pause` may suspend
+   * enforcement. Only ever LOWERS the built-in 8h ceiling — a value above it is
+   * clamped back down, because a ceiling a project can raise is not a ceiling.
+   * Absent means the built-in ceiling applies.
+   */
+  maxPauseMs?: number;
   /**
    * Record of the convention policies (`.failproofai/policies/*policies.mjs`)
    * discovered at this scope the last time a failproofai command ran.