failproofai 1.0.0-beta.12 → 1.0.0-beta.13

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "failproofai",
-  "version": "1.0.0-beta.12",
+  "version": "1.0.0-beta.13",
   "description": "The easiest way to manage policies that keep your AI agents reliable, on-task, and running autonomously — for Claude Code & the Agents SDK",
   "bin": {
     "failproofai": "./dist/cli.mjs",
@@ -101,12 +101,12 @@
     "html-to-image": "^1.11.13",
     "html2canvas": "^1.4.1",
     "posthog-node": "^5.47.7",
-    "smol-toml": "^1.7.1",
     "sql.js": "^1.14.1",
     "yaml": "^2.9.0"
   },
   "overrides": {
     "postcss": "8.5.23",
+    "nanoid": "3.3.17",
     "eslint-plugin-react-hooks": "7.0.1",
     "vite": "8.0.16",
     "undici": "7.29.0",
@@ -114,15 +114,15 @@
     "sharp": "0.35.0"
   },
   "optionalDependencies": {
-    "@failproofai/failproofaid-linux-x64": "1.0.0-beta.12",
-    "@failproofai/failproofaid-linux-arm64": "1.0.0-beta.12",
-    "@failproofai/failproofaid-darwin-x64": "1.0.0-beta.12",
-    "@failproofai/failproofaid-darwin-arm64": "1.0.0-beta.12"
+    "@failproofai/failproofaid-linux-x64": "1.0.0-beta.13",
+    "@failproofai/failproofaid-linux-arm64": "1.0.0-beta.13",
+    "@failproofai/failproofaid-darwin-x64": "1.0.0-beta.13",
+    "@failproofai/failproofaid-darwin-arm64": "1.0.0-beta.13"
   },
   "failproofaidBinaries": {
-    "linux-x64": "3a17bf65b24cc16cd907578cbb90158b5ec53f12fb133c3d4b37a02e3c41ff98",
-    "linux-arm64": "d341762677d7dbdcf03321d803d97b41ad12f4b903d766cf45b4d5258bf4ed93",
-    "darwin-x64": "d17e95386c51bcefbb845d67134c64e1a269cbb444beed1801e4181ab976ab23",
-    "darwin-arm64": "e8987ecfa755dedc3bc4470bde25a54838735a7a1cefa4b9c9225dd868503f44"
+    "linux-x64": "b96dd035433adbf1290ad8b4ed32fc8134d4dfc03057b8f6a210c041ac7d8d93",
+    "linux-arm64": "0e11c7349de7d10488a6ea8f80714260e3dbedabcd06b0ab530119970b16404d",
+    "darwin-x64": "7d2943d6126430d9282ca106918be8aa2e0133c4c7189493996b14cbbb361d06",
+    "darwin-arm64": "dd6c646611ee81d7db88254917232bd5b0cfac514657bd2ce1062c7bb24cf960"
   }
 }

package/src/hooks/backfill-cli.ts

@@ -168,7 +168,7 @@ export function runBackfillCommand(opts: BackfillOptions = {}): BackfillResult {
       exitCode: 1,
       lines: [
         "Collection is switched off, so a backfill would re-read history and send",
-        "none of it. Enable it in ~/.failproofai/config.toml under [collector].",
+        'none of it. Enable it in ~/.failproofai/config.json under "collector".',
       ],
     };
   }

package/src/hooks/cloud-connection.ts

@@ -137,7 +137,7 @@ export interface CapabilityOutcome {
 }
 
 export interface ConnectOutcome {
-  policy: CapabilityOutcome & { policyCount?: number; generation?: number };
+  policy: CapabilityOutcome & { policyCount?: number; deployment?: number };
   ingest: CapabilityOutcome;
   /** Which organisation the key belongs to. Absent on a pre-introspect server. */
   org?: { id?: string; slug?: string; name?: string };
@@ -232,7 +232,7 @@ export async function connectToCloud(input: ConnectInput): Promise<ConnectOutcom
 
   const outcome: ConnectOutcome = {
     policy: policyResult.ok
-      ? { ok: true, policyCount: policyResult.policyCount, generation: policyResult.generation }
+      ? { ok: true, policyCount: policyResult.policyCount, deployment: policyResult.deployment }
       : { ok: false, reason: policyResult.reason },
     ingest: ingestResult.ok ? { ok: true } : { ok: false, reason: ingestResult.reason },
     anyConfigured: false,
@@ -309,7 +309,7 @@ export function describeOutcome(outcome: ConnectOutcome, machineId: string, url:
   if (outcome.policy.ok && outcome.ingest.ok) {
     lines.push(`Connected to ${url} as ${machineId}${into}.`);
     const n = outcome.policy.policyCount ?? 0;
-    lines.push(`  Policy    ${n} polic${n === 1 ? "y" : "ies"} assigned (generation ${outcome.policy.generation ?? 0}).`);
+    lines.push(`  Policy    ${n} polic${n === 1 ? "y" : "ies"} assigned (deployment ${outcome.policy.deployment ?? 0}).`);
     lines.push(`  Dashboard hook activity will be sent to ${ingestUrlFor(url)}.`);
     return lines;
   }
@@ -317,7 +317,7 @@ export function describeOutcome(outcome: ConnectOutcome, machineId: string, url:
   if (outcome.policy.ok && !outcome.ingest.ok) {
     const n = outcome.policy.policyCount ?? 0;
     lines.push(`Connected to ${url} as ${machineId}${into}, for policy only.`);
-    lines.push(`  Policy    ${n} polic${n === 1 ? "y" : "ies"} assigned (generation ${outcome.policy.generation ?? 0}).`);
+    lines.push(`  Policy    ${n} polic${n === 1 ? "y" : "ies"} assigned (deployment ${outcome.policy.deployment ?? 0}).`);
     lines.push(`  Dashboard NOT configured: ${outcome.ingest.reason}`);
     lines.push("");
     lines.push("  Enforcement works. Nothing will appear in the dashboard until this");

package/src/hooks/cloud-enrollment-cli.ts

@@ -214,7 +214,7 @@ export function runDisconnectCommand(): CommandResult {
   // credential ends the daemon's polling; every artifact already on disk stayed
   // referenced by `active.json` and kept being loaded on every tool call — so a
   // machine that had deliberately left its organisation went on being governed
-  // by whatever generation was current when it left, indefinitely, while
+  // by whatever deployment was current when it left, indefinitely, while
   // `--status` reported it as unconnected.
   const stoppedManaged = clearActiveCloudManagedPolicies();
   // Back to OSS. Leaving mode = "cloud" with no credentials would describe a

package/src/hooks/cloud-enrollment.ts

@@ -182,7 +182,7 @@ export function clearCloudCredentials(): boolean {
 }
 
 export type VerifyResult =
-  | { ok: true; policyCount: number; generation: number }
+  | { ok: true; policyCount: number; deployment: number }
   | { ok: false; reason: string };
 
 /**
@@ -228,11 +228,11 @@ export async function verifyCloudCredentials(creds: CloudCredentials): Promise<V
   }
 
   try {
-    const body = (await response.json()) as { policies?: unknown[]; generation?: number };
+    const body = (await response.json()) as { policies?: unknown[]; deployment?: number };
     return {
       ok: true,
       policyCount: Array.isArray(body.policies) ? body.policies.length : 0,
-      generation: typeof body.generation === "number" ? body.generation : 0,
+      deployment: typeof body.deployment === "number" ? body.deployment : 0,
     };
   } catch {
     return {

package/src/hooks/cloud-managed-policies.ts

@@ -1,5 +1,5 @@
 /**
- * Reads the daemon-owned active cloud policy generation for the TypeScript
+ * Reads the daemon-owned active cloud policy deployment for the TypeScript
  * evaluator. The Rust reconciler is responsible for downloading and repairing
  * artifacts; this boundary independently verifies the digest immediately
  * before import so the worker never knowingly executes modified bytes.
@@ -10,7 +10,21 @@ import { homedir } from "node:os";
 import { isAbsolute, relative, resolve } from "node:path";
 import { cloudPoliciesDir } from "./fp-home";
 
-const ACTIVE_SCHEMA_VERSION = 1;
+/**
+ * Active-manifest schema versions this reader accepts.
+ *
+ * MUST stay in step with `SUPPORTED_SCHEMA_VERSIONS` in `cloud_policies.rs`,
+ * which is what WRITES the file this parses. They are two hand-maintained
+ * copies of one contract in two languages, and the failure is silent in the
+ * worst direction: the daemon reconciles happily, `active.json` is correct on
+ * disk, and only the hook path refuses it — so cloud policy stops being
+ * enforced while every other signal says the machine is healthy. Reproduced
+ * exactly that way while syncing this with AgentEye#559.
+ *
+ * 1 is accepted for files a pre-rename beta daemon left behind; 2 is what is
+ * written now.
+ */
+const ACCEPTED_ACTIVE_SCHEMA_VERSIONS: readonly number[] = [1, 2];
 const SHA256_RE = /^[a-f0-9]{64}$/;
 const POLICY_ID_RE = /^[A-Za-z0-9._-]{1,128}$/;
 
@@ -19,7 +33,7 @@ export type PolicyEffect = "enforce" | "observe";
 
 export interface CloudManagedPolicyArtifact {
   id: string;
-  revision: number;
+  version: number;
   /**
    * `observe` policies are evaluated exactly like any other and then have their
    * verdict discarded, so a rollout can be measured against real traffic before
@@ -30,15 +44,15 @@ export interface CloudManagedPolicyArtifact {
   effect: PolicyEffect;
   sha256: string;
   path: string;
-  generation: number;
+  deployment: number;
 }
 
 interface ActiveManifest {
   schemaVersion: number;
-  generation: number;
+  deployment: number;
   policies: Array<{
     id: string;
-    revision: number;
+    version: number;
     effect?: string;
     sha256: string;
     path: string;
@@ -52,17 +66,41 @@ export function cloudManagedPolicyRoot(): string {
   );
 }
 
+/**
+ * A version-1 manifest, in the spelling a pre-rename daemon actually wrote.
+ *
+ * Accepting schema 1 while reading only the version-2 FIELD NAMES made the
+ * acceptance unreachable: every genuine v1 file threw "active manifest
+ * deployment is invalid". The Rust reader of this same file handles it with
+ * `#[serde(alias = "generation")]` / `#[serde(alias = "revision")]`; this is the
+ * TypeScript half of that pair, and it was missing.
+ */
+interface LegacyActiveManifest {
+  generation?: number;
+  policies?: Array<{ revision?: number }>;
+}
+
 function parseManifest(value: unknown): ActiveManifest {
   if (!value || typeof value !== "object") throw new Error("active manifest is not an object");
-  const manifest = value as Partial<ActiveManifest>;
-  if (manifest.schemaVersion !== ACTIVE_SCHEMA_VERSION) {
-    throw new Error(`unsupported active manifest schema ${String(manifest.schemaVersion)}`);
+  const raw = value as Partial<ActiveManifest> & LegacyActiveManifest;
+  if (!ACCEPTED_ACTIVE_SCHEMA_VERSIONS.includes(raw.schemaVersion as number)) {
+    throw new Error(
+      `unsupported active manifest schema ${String(raw.schemaVersion)} ` +
+        `(supported: ${ACCEPTED_ACTIVE_SCHEMA_VERSIONS.join(", ")})`,
+    );
   }
-  if (!Number.isSafeInteger(manifest.generation) || (manifest.generation ?? -1) < 0) {
-    throw new Error("active manifest generation is invalid");
+  // New name wins; the old one is a fallback, not an equal. A file carrying both
+  // (written by a mixed-version machine) must resolve to the current field.
+  const deployment = raw.deployment ?? raw.generation;
+  if (!Number.isSafeInteger(deployment) || (deployment ?? -1) < 0) {
+    throw new Error("active manifest deployment is invalid");
   }
-  if (!Array.isArray(manifest.policies)) throw new Error("active manifest policies is not an array");
-  return manifest as ActiveManifest;
+  if (!Array.isArray(raw.policies)) throw new Error("active manifest policies is not an array");
+  const policies = raw.policies.map((p) => {
+    const entry = p as ActiveManifest["policies"][number] & { revision?: number };
+    return { ...entry, version: entry.version ?? entry.revision } as ActiveManifest["policies"][number];
+  });
+  return { schemaVersion: raw.schemaVersion as number, deployment: deployment as number, policies };
 }
 
 function resolveManagedPath(root: string, candidate: string): string {
@@ -73,7 +111,7 @@ function resolveManagedPath(root: string, candidate: string): string {
     throw new Error(`managed policy path escapes its root: ${JSON.stringify(candidate)}`);
   }
 
-  // Reject a symlinked artifact or generation directory escaping the managed
+  // Reject a symlinked artifact or deployment directory escaping the managed
   // root. The current daemon is same-user, but following an arbitrary path is
   // still unnecessary ambient authority and becomes dangerous if its service
   // identity is hardened later.
@@ -89,8 +127,8 @@ function resolveManagedPath(root: string, candidate: string): string {
 /**
  * Stop enforcing cloud-managed policies on this machine.
  *
- * Removes `active.json` only — the manifest that says which generation is
- * live. The generation directories and content-addressed artifacts are left
+ * Removes `active.json` only — the manifest that says which deployment is
+ * live. The deployment directories and content-addressed artifacts are left
  * alone: they are large, hash-verified on use, and inert once nothing points
  * at them, so keeping them makes a reconnect cheap and offline-safe.
  *
@@ -98,7 +136,7 @@ function resolveManagedPath(root: string, candidate: string): string {
  * credential stops the daemon REFRESHING policy; every artifact already on disk
  * kept being loaded and enforced on every tool call, so a user who had
  * deliberately left their organisation's cloud went on being governed by
- * whatever generation happened to be current when they left — indefinitely,
+ * whatever deployment happened to be current when they left — indefinitely,
  * with `--status` reporting the machine as unconnected.
  *
  * Returns true when a manifest was actually removed.
@@ -134,8 +172,8 @@ export function readActiveCloudManagedPolicies(): CloudManagedPolicyArtifact[] {
     if (!POLICY_ID_RE.test(policy.id) || policy.id === "." || policy.id === "..") {
       throw new Error(`unsafe cloud-managed policy id ${JSON.stringify(policy.id)}`);
     }
-    if (!Number.isSafeInteger(policy.revision) || policy.revision < 0) {
-      throw new Error(`invalid revision for cloud-managed policy ${policy.id}`);
+    if (!Number.isSafeInteger(policy.version) || policy.version < 0) {
+      throw new Error(`invalid version for cloud-managed policy ${policy.id}`);
     }
     if (!SHA256_RE.test(policy.sha256)) {
       throw new Error(`invalid SHA-256 for cloud-managed policy ${policy.id}`);
@@ -154,16 +192,16 @@ export function readActiveCloudManagedPolicies(): CloudManagedPolicyArtifact[] {
     if (policy.effect !== undefined && policy.effect !== "enforce" && policy.effect !== "observe") {
       // Guessing would mean either enforcing something cloud did not ask to
       // enforce, or observing something it wanted enforced. Both are worse than
-      // refusing the generation.
+      // refusing the deployment.
       throw new Error(`unknown effect ${JSON.stringify(policy.effect)} for cloud-managed policy ${policy.id}`);
     }
     return {
       id: policy.id,
-      revision: policy.revision,
+      version: policy.version,
       effect: (policy.effect as PolicyEffect | undefined) ?? "enforce",
       sha256: policy.sha256,
       path,
-      generation: manifest.generation,
+      deployment: manifest.deployment,
     };
   });
 }

package/src/hooks/configure-wizard.ts

@@ -33,6 +33,7 @@ import { dirname, resolve, sep } from "node:path";
 import {
   selectOne,
   multiSelect,
+  BACK,
   promptText,
   intro,
   outro,
@@ -126,6 +127,7 @@ export type WizardAbort =
   | "cancelled"
   | "needs_root"
   | "daemon_failed"
+  | "unsupported_platform"
   | "not_a_tty"
   | "running_as_sudo";
 
@@ -415,6 +417,37 @@ export function describeCustomPolicies(cwd: string): {
   return { active, warnings, fileCount, scopes };
 }
 
+/**
+ * The wizard's one-line completion summary. Pure and exported so the widest
+ * real combination — every policy, every CLI, custom/daemon/reporting all
+ * present — can be pinned by a test without having to drive the whole wizard
+ * through a real chdir + on-disk custom-policy fixture.
+ *
+ * Kept inside a standard 80-column terminal: `writeLines` truncates with a
+ * hard cut and no ellipsis, so an over-long line doesn't just lose its tail
+ * — it reads as broken output. Naming all ten CLIs once took it to 182
+ * characters; the count alone carries the same information, and the user
+ * picked them two screens ago. A single grouped "· a, b, c" clause bounds the
+ * optional notes to one separator and short tags, rather than three
+ * independent " · " clauses stacking up.
+ */
+export function buildCompletionSummary(
+  policiesCount: number,
+  harnessesCount: number,
+  customEnabled: boolean | undefined,
+  daemonInstalled: boolean,
+  connected: boolean,
+): string {
+  const extras: string[] = [];
+  if (customEnabled === true) extras.push("custom");
+  else if (customEnabled === false) extras.push("custom off");
+  if (daemonInstalled) extras.push("daemon");
+  if (connected) extras.push("reporting");
+  const extrasNote = extras.length > 0 ? ` · ${extras.join(", ")}` : "";
+  const harnesses = `${harnessesCount} harness${harnessesCount === 1 ? "" : "es"}`;
+  return `Setup complete — ${policiesCount} policies · ${harnesses}${extrasNote}`;
+}
+
 export function reviewLines(state: {
   /** What the scope step resolved to. Expands to one or two real scopes. */
   target: SetupTarget;
@@ -441,9 +474,9 @@ export function reviewLines(state: {
         ? `This project (${homeify(cwd)})`
         : "Everywhere (global)";
   const lines: string[] = [];
-  const assistantNames = clis.map((c) => getIntegration(c).displayName);
+  const harnessNames = clis.map((c) => getIntegration(c).displayName);
   lines.push(`  Where      : ${where}`);
-  lines.push(`  Assistants : ${assistantNames.length ? summarize(assistantNames, "assistants") : "(none)"}`);
+  lines.push(`  Harnesses  : ${harnessNames.length ? summarize(harnessNames, "harnesses") : "(none)"}`);
   // Zero is a deliberate answer, not a failed step — say so, and say where to
   // change it, so the review screen doesn't read like the wizard lost the
   // selection. Hooks still install; only the builtin set is empty.
@@ -712,7 +745,26 @@ export async function runConfigureWizard(io: WizardIO = {}): Promise<WizardResul
 
   // Fire-and-forget: never block the wizard's first paint on telemetry.
   void emit("configure_started", {});
-  intro("let's set up your safety net", stdout);
+
+  // failproofaid — the only evaluator on a configured machine — only runs on
+  // Linux and macOS. Checked before intro() draws anything and before a
+  // single prompt is asked: completing setup anyway used to leave e.g. a
+  // Windows machine reading as configured while enforcing in-process with no
+  // fail-closed guarantee, which is worse than not being set up at all.
+  if (!isDaemonSupportedPlatform()) {
+    stdout.write(
+      `failproofai requires failproofaid, its background policy daemon, which runs on\n` +
+        `Linux and macOS only — not ${process.platform}. Setup cannot continue here: an\n` +
+        "installation with no daemon behind it would read as configured while enforcing\n" +
+        "nothing, which is worse than not being set up at all.\n\n" +
+        "Nothing was changed. This platform will be supported once failproofaid gains a\n" +
+        `${process.platform} service target.\n\n`,
+    );
+    void emit("configure_aborted", { reason: "unsupported_platform" });
+    return { applied: false, abort: "unsupported_platform" };
+  }
+
+  intro("let's set up failproofai", stdout);
 
   const cancel = (): WizardResult => {
     outro("Cancelled — nothing was changed.", { ok: false }, stdout);
@@ -733,9 +785,9 @@ export async function runConfigureWizard(io: WizardIO = {}): Promise<WizardResul
   // Machine-level, so it is deliberately NOT gated on the scope chosen in the
   // next step: one daemon serves every project on this machine.
   //
-  // On a platform with no service manager there is nothing to install, so the
-  // requirement does not apply — requiring an impossible step would lock those
-  // users out of setup entirely rather than protecting anything.
+  // Always true here — the guard near the top of this function already
+  // refused setup on anything else. Kept as a real read (not a literal
+  // `true`) so this block still fails safe if that guard is ever moved.
   const daemonSupported = isDaemonSupportedPlatform();
   // An already-healthy daemon needs no install and no password. Re-running
   // setup on a configured machine must not demand sudo for work that is
@@ -909,24 +961,38 @@ export async function runConfigureWizard(io: WizardIO = {}): Promise<WizardResul
   // The assistants step below keeps its minimum deliberately: an empty CLI list
   // does NOT mean "no assistants" there — `installHooksImpl` falls back to
   // ["claude"], so letting it through would silently install for Claude.
-  const presets = await multiSelect<string>({
-    message: "What should we guard against?",
-    choices: presetChoices,
-    summaryNoun: "bundles",
-    hint: "space toggles · combine presets · ↵ confirm · none is fine",
-    stdin,
-    stdout,
-  });
-  if (presets === null) return cancel();
-  const policies = resolvePresetSelection(presets);
-  // Only meaningful when there are files to switch off; with none, the row is
-  // locked-unchecked and must not write a disabling flag.
-  const customEnabled = hasCustomFiles ? presets.includes(CUSTOM) : undefined;
+  // Steps 2 and 3 are navigable: ← on the harness step returns to the policy
+  // step with the previous answer still selected. Before this, changing an
+  // earlier answer meant abandoning setup and starting over, because a prompt
+  // had exactly one way out and it was `null`.
+  //
+  // The policy step itself takes no `allowBack`: the only thing before it is
+  // the scope question, which is frequently not asked at all (a single choice
+  // is stated, not prompted), so ← there would sometimes go nowhere.
+  let presets: string[] | null = null;
+  let clisSel: string[] | null = null;
+  while (clisSel === null) {
+    // Re-entering after a ← must show what was picked, not a blank slate.
+    // Selection state lives on each choice, so carry it back in.
+    // Loop-carried: narrowed to `null` on the first pass, repopulated on a ←.
+    const priorPresets = presets as string[] | null;
+    presets = await multiSelect<string>({
+      message: "What should we guard against?",
+      choices: priorPresets
+        ? presetChoices.map((c) => ({ ...c, checked: priorPresets.includes(c.value) }))
+        : presetChoices,
+      summaryNoun: "bundles",
+      hint: "space toggles · combine presets · ↵ confirm · none is fine",
+      stdin,
+      stdout,
+    });
+    if (presets === null) return cancel();
 
-  // 3 — Which assistants? An "Everything available" row protects every supported
-  // CLI (detected + set-up-ahead); when ticked it wins over the individual boxes.
-  const clisSel = await multiSelect<string>({
-    message: "Which AI assistants should it protect?",
+    // 3 — Which harnesses? An "Everything available" row protects every supported
+    // CLI (detected + set-up-ahead); when ticked it wins over the individual boxes.
+    const priorClis = clisSel as string[] | null;
+    const picked: string[] | typeof BACK | null = await multiSelect<string>({
+    message: "Which harnesses should it protect?",
     choices: [
       {
         label: "Everything available",
@@ -934,19 +1000,30 @@ export async function runConfigureWizard(io: WizardIO = {}): Promise<WizardResul
         // Counts only what this scope can actually take — expanding to all 12
         // under project scope is what crashed the apply on Hermes.
         hint: `protect all ${clisSupportingScope(primaryScope).length} CLIs configurable here`,
-        // A selector, not an assistant. Counting it gave "13 assistants" for
+        // A selector, not a harness. Counting it gave "13 harnesses" for
         // the 12 supported CLIs, and listed "Everything available" among them.
         summaryExclude: true,
       },
       ...buildAgentChoices(primaryScope, cwd),
-    ],
-    minSelected: 1,
-    summaryNoun: "assistants",
-    hint: "detected CLIs are pre-selected · space toggles · ctrl+a all · ↵ confirm",
-    stdin,
-    stdout,
-  });
-  if (clisSel === null) return cancel();
+    ].map((c) => (priorClis ? { ...c, checked: priorClis.includes(c.value) } : c)),
+      minSelected: 1,
+      summaryNoun: "harnesses",
+      hint: "detected CLIs are pre-selected · space toggles · ctrl+a all · ← back · ↵ confirm",
+      allowBack: true as const,
+      stdin,
+      stdout,
+    });
+    if (picked === null) return cancel();
+    // ← re-runs the loop, which re-asks the policy step with its answer intact.
+    if (picked === BACK) continue;
+    clisSel = picked;
+  }
+  // Non-null by construction: the loop only exits once both are assigned.
+  const chosenPresets: string[] = presets ?? [];
+  const policies = resolvePresetSelection(chosenPresets);
+  // Only meaningful when there are files to switch off; with none, the row is
+  // locked-unchecked and must not write a disabling flag.
+  const customEnabled = hasCustomFiles ? chosenPresets.includes(CUSTOM) : undefined;
   // Filter to what the chosen scopes support in BOTH branches: "Everything
   // available" must not expand to CLIs that cannot take any selected scope,
   // and a locked row can't be ticked but belt-and-braces keeps the invariant
@@ -987,17 +1064,21 @@ export async function runConfigureWizard(io: WizardIO = {}): Promise<WizardResul
         "  transcripts — prompts, file contents and command output — to your",
         "  dashboard. Staying local sends nothing, anywhere, ever.",
       ],
+      // Cloud first, and therefore preselected: connecting is what most people
+      // running this wizard came to do, and the local path stays one keystroke
+      // away. Reversing these two is the whole change — neither option's copy
+      // moved, so "stay local" is still stated as plainly as it was.
       choices: [
-        {
-          label: "Not now — stay local",
-          value: "local",
-          hint: "policies still enforce · connect later with failproofai config --connect",
-        },
         {
           label: "Paste an API key",
           value: "key",
           hint: "reports decisions and transcripts to your dashboard",
         },
+        {
+          label: "Not now — stay local",
+          value: "local",
+          hint: "policies still enforce · connect later with failproofai config --connect",
+        },
       ],
       stdin,
       stdout,
@@ -1319,7 +1400,7 @@ export async function runConfigureWizard(io: WizardIO = {}): Promise<WizardResul
     cli: clis,
     cli_count: clis.length,
     policy_count: policies.length,
-    source: presets.join("+"),
+    source: chosenPresets.join("+"),
     connected: connect !== null,
   });
 
@@ -1411,22 +1492,12 @@ export async function runConfigureWizard(io: WizardIO = {}): Promise<WizardResul
   // And any record of an earlier failure is now false: this machine got set up.
   clearOnboardingAttempt();
 
-  // Keep this inside a standard 80-column terminal. `writeLines` truncates with
-  // a hard cut and no ellipsis, so an over-long line doesn't just lose its tail
-  // — it reads as broken output. Naming all ten CLIs took it to 182 characters;
-  // the count alone carries the same information, and the user picked them two
-  // screens ago.
-  const customNote =
-    customEnabled === true
-      ? " + your custom policies"
-      : customEnabled === false
-        ? " · custom policies DISABLED"
-        : "";
-  const daemonNote = daemonInstalled ? " · daemon on" : "";
-  const cloudNote = connected ? " · reporting on" : "";
-  const assistants = `${clis.length} assistant${clis.length === 1 ? "" : "s"}`;
+  // Every real completed setup is on a supported platform now (an unsupported
+  // one aborts before this point), so the optional notes in the summary below
+  // are no longer occasional additions — see buildCompletionSummary's own doc
+  // comment for why the widest combination still fits in 80 columns.
   outro(
-    `Setup complete — ${policies.length} policies${customNote} · ${assistants}${daemonNote}${cloudNote}`,
+    buildCompletionSummary(policies.length, clis.length, customEnabled, daemonInstalled, connected),
     { ok: true },
     stdout,
   );