failproofai 1.0.0-beta.12 → 1.0.0-beta.13

package/src/hooks/custom-hooks-loader.ts

@@ -358,9 +358,43 @@ export async function loadAllCustomHooks(
   // twice per event. Seeded by the explicit path below and consulted by both
   // convention passes.
   const loadedPaths = new Set<string>();
-  const cloudManagedByPath = new Map(
-    (opts?.cloudManagedPolicies ?? []).map((policy) => [resolve(policy.path), policy]),
-  );
+
+  // Cloud policies keyed by the artifact they resolve to — and artifacts are
+  // CONTENT-ADDRESSED, so two policies whose source is byte-identical share one
+  // path. Building this map with a plain `new Map(entries)` let the last one win
+  // silently, and since `loadedPaths` then loads that file exactly once, the
+  // other policy vanished: its id never appeared in `failproofai policies` or in
+  // the decision log, and — the part that matters — ITS EFFECT DECIDED NOTHING.
+  // An `enforce` policy sharing bytes with an `observe` one was downgraded to
+  // observation, which is a silent enforcement gap, and the reverse turned a
+  // measurement-only rollout into live denials.
+  //
+  // It could not happen before the flattening: `deployments/<n>/<id>.mjs` gave
+  // every policy its own path even when the bytes matched.
+  //
+  // One module instance is right — `customPolicies.add` is an unconditional
+  // push, so importing the file twice would register every hook twice and run
+  // the policy twice per event. So the collision is resolved rather than
+  // avoided, and it resolves toward ENFORCEMENT: over-enforcing is visible to
+  // whoever hits it, while under-enforcing is exactly the silent failure this
+  // codebase exists to remove. It is also announced, so an operator can give the
+  // two policies distinguishable source instead of living with the merge.
+  const cloudManagedByPath = new Map<string, CloudManagedPolicyArtifact>();
+  for (const policy of opts?.cloudManagedPolicies ?? []) {
+    const key = resolve(policy.path);
+    const existing = cloudManagedByPath.get(key);
+    if (!existing) {
+      cloudManagedByPath.set(key, policy);
+      continue;
+    }
+    hookLogWarn(
+      `cloud-managed policies ${existing.id} and ${policy.id} have identical source, so they share ` +
+        `one artifact and load as one policy; enforcing it if either asks to enforce`,
+    );
+    if (existing.effect !== "enforce" && policy.effect === "enforce") {
+      cloudManagedByPath.set(key, policy);
+    }
+  }
 
   // 1. Explicit custom policy paths. Accept a string for callers/configs using
   // the legacy singular form.
@@ -387,7 +421,7 @@ export async function loadAllCustomHooks(
           };
           if (cloudManaged) {
             tagged.__cloudManaged = cloudManaged;
-            tagged.__policyId = `cloud:${cloudManaged.id}@${cloudManaged.revision}:${hook.name}`;
+            tagged.__policyId = `cloud:${cloudManaged.id}@${cloudManaged.version}:${hook.name}`;
           } else {
             tagged.__policyId = customPolicyId(absPath, hook.name);
           }
@@ -415,9 +449,24 @@ export async function loadAllCustomHooks(
   // leaks one file permanently rather than leaving one that the next load
   // overwrites. Best-effort and age-gated, so it can never remove a tree
   // another process is still importing.
+  // WHICH SCOPE this directory is depends on whether it IS the user directory.
+  // Run an agent CLI with the cwd set to $HOME and `<cwd>/.failproofai/policies`
+  // resolves to `~/.failproofai/policies` — the user scope itself. Layout 3 made
+  // that reachable by collapsing `customPoliciesDir()` onto `policiesDir()`;
+  // layout 2 nested the user directory one level deeper, so the two could never
+  // be the same path.
+  //
+  // Tagging it `project` there would make a policy's id depend on where the
+  // agent happened to be launched from — `convention:project:x-policies.mjs:foo`
+  // from $HOME and `convention:user:x-policies.mjs:foo` from anywhere else — and
+  // a disable is RECORDED AGAINST THAT ID. So a user who switched a policy off
+  // would find it firing again whenever they worked out of their home
+  // directory, with nothing to explain it. The files are the user's global
+  // policies; that the cwd also points at them is incidental.
+  const projectScope: "project" | "user" = projectDir === customPoliciesDir() ? "user" : "project";
   if (conventionEnabled) {
     void sweepStaleTmpArtifacts(projectDir);
-    warnSkippedPolicyFiles(projectDir, "project");
+    warnSkippedPolicyFiles(projectDir, projectScope);
   }
   // The shim directory leaks the same way and is swept on the same terms. It is
   // ours alone and outside the policy tree, so nothing else would ever reap it;
@@ -430,14 +479,14 @@ export async function loadAllCustomHooks(
   for (const file of projectFiles) {
     loadedPaths.add(file);
     const hooksBefore = getCustomHooks().length;
-    await loadSingleFile(file, { conventionScope: "project" });
+    await loadSingleFile(file, { conventionScope: projectScope });
     const newHooks = getCustomHooks().slice(hooksBefore);
     for (const hook of newHooks) {
-      (hook as CustomHook & { __policyId?: string }).__policyId = conventionPolicyId("project", basename(file), hook.name);
+      (hook as CustomHook & { __policyId?: string }).__policyId = conventionPolicyId(projectScope, basename(file), hook.name);
     }
     if (newHooks.length > 0) {
       conventionSources.push({
-        scope: "project",
+        scope: projectScope,
         file: basename(file),
         hookNames: newHooks.map((h) => h.name),
       });

package/src/hooks/daemon-service.ts

@@ -1036,25 +1036,80 @@ export async function probeDaemon(): Promise<DaemonProbe> {
   }
 }
 
+/**
+ * "Is anything listening on the daemon socket?" — never throws.
+ *
+ * Split out because `waitForDaemonRunning` needs the connect check WITHOUT the
+ * hook evaluation: it runs inside a settle loop, and a failed import or a
+ * transient refusal there must read as "not yet", never as an error.
+ */
+async function daemonAcceptsConnectionsQuietly(): Promise<boolean> {
+  try {
+    const { daemonAcceptsConnections } = await import("./daemon-client");
+    return await daemonAcceptsConnections();
+  } catch {
+    return false;
+  }
+}
+
 /** Boolean form, for callers that only branch on healthy/not. */
 export async function probeDaemonEndToEnd(): Promise<boolean> {
   return (await probeDaemon()).ok;
 }
 
 /**
- * Waits for the service to report running, then re-checks after a settle
- * window (see `SERVICE_SETTLE_MS`) so a daemon that dies at startup doesn't
- * pass on the strength of one optimistic reading.
+ * Waits for the service to report running and to HOLD it — a `Type=simple` unit
+ * is active the moment it forks, so one optimistic reading passes a daemon that
+ * died at startup.
+ *
+ * WATCHED, not slept through. This used to sleep `SERVICE_SETTLE_MS` blind and
+ * read the status once at the end, which was wrong in both directions on a
+ * healthy machine and a broken one:
+ *
+ *   • Healthy: the socket is up in ~13ms and answers a real hook in ~125ms, and
+ *     setup still sat there for the remaining ~600ms with the answer already in
+ *     hand. Setup runs this twice on the repair path (uninstall, reinstall), so
+ *     it was over a second of dead wait every time.
+ *   • Broken: a daemon that died at 100ms was not noticed until 750ms, because
+ *     nothing looked until the sleep was over.
+ *
+ * Now the window is polled. Leaving `running` at any point fails immediately,
+ * and the wait ends early once the daemon has answered a real hook — a reply is
+ * strictly stronger evidence of "did not die at startup" than "still active
+ * after an arbitrary sleep", which is all the settle ever established.
  */
-async function waitForDaemonRunning(): Promise<boolean> {
-  const deadline = Date.now() + SERVICE_START_TIMEOUT_MS;
+export interface WaitForDaemonDeps {
+  status?: () => DaemonServiceStatus;
+  accepts?: () => Promise<boolean>;
+  sleep?: (ms: number) => Promise<void>;
+  now?: () => number;
+}
+
+export async function waitForDaemonRunning(deps: WaitForDaemonDeps = {}): Promise<boolean> {
+  const status = deps.status ?? daemonServiceStatus;
+  const accepts = deps.accepts ?? daemonAcceptsConnectionsQuietly;
+  const sleep = deps.sleep ?? ((ms: number) => new Promise<void>((r) => setTimeout(r, ms)));
+  const now = deps.now ?? Date.now;
+
+  const deadline = now() + SERVICE_START_TIMEOUT_MS;
+  for (;;) {
+    if (status() === "running") break;
+    if (now() >= deadline) return false;
+    await sleep(SERVICE_START_POLL_MS);
+  }
+
+  const settleUntil = now() + SERVICE_SETTLE_MS;
   for (;;) {
-    if (daemonServiceStatus() === "running") break;
-    if (Date.now() >= deadline) return false;
-    await new Promise((r) => setTimeout(r, SERVICE_START_POLL_MS));
+    // A unit that has left `running` is dead now; there is nothing to wait out.
+    if (status() !== "running") return false;
+    // A daemon that accepted a connection is a daemon that got past startup and
+    // bound its socket. Deliberately the CHEAP check, not a full hook
+    // evaluation: `probeDaemon` runs the end-to-end one moments later, and
+    // paying for it twice is what this rewrite exists to stop.
+    if (await accepts()) return true;
+    if (now() >= settleUntil) return true;
+    await sleep(SERVICE_START_POLL_MS);
   }
-  await new Promise((r) => setTimeout(r, SERVICE_SETTLE_MS));
-  return daemonServiceStatus() === "running";
 }
 
 // ── Upgrading a service definition that predates a variable ──────────────────
@@ -1125,7 +1180,7 @@ function installedExecStart(definition: string): string | null {
  * True when a service IS installed but its definition predates
  * `FAILPROOFAI_CLI_CMD`.
  *
- * Deliberately a content check against the definition on disk, not a revision
+ * Deliberately a content check against the definition on disk, not a version
  * number mirrored into `config.toml`. The mirror is the tempting shape — it is
  * how `daemon.installed_version` is modelled — but that field is declared,
  * read and cleared and has never once been WRITTEN (both `setDaemonConfigured`

package/src/hooks/flush-cli.ts

@@ -0,0 +1,180 @@
+/**
+ * `failproofai flush` — deliver what is already spooled, now.
+ *
+ * The collector is built to be unhurried on purpose. A batch is swept only once
+ * it is older than two minutes, at most 64 per pass, on a 60-second cadence —
+ * pacing that keeps a backlog from stampeding a server and is exactly wrong for
+ * one case: somebody standing at a dashboard waiting to see their own events.
+ * They have no way to tell "not delivered yet" from "not working", and the
+ * honest answer is usually the first one.
+ *
+ * WHY A REQUEST FILE, not the work itself. The uploader's concurrency limiter
+ * and in-flight set live in the running daemon. A second uploader started by
+ * the CLI would share neither, so both would POST the same batch — the exact
+ * double-delivery `delivery.rs` keeps one shared `Delivery` to prevent. So this
+ * writes a request the daemon drains on its next tick.
+ *
+ * What it does NOT hand off is the checking — same rule as `backfill-cli.ts`.
+ * Every precondition a person can get wrong is verified here, synchronously,
+ * before returning success. A CLI that prints "requested" while the daemon is
+ * stopped has told the user the opposite of what happened.
+ */
+import { existsSync, mkdirSync, writeFileSync, readdirSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { failproofaiHome, spoolDir } from "./fp-home";
+import { readConfig } from "./fp-config";
+import { readIngestCredential } from "./collector-config";
+import { daemonServiceStatus, isDaemonSupportedPlatform } from "./daemon-service";
+
+/** How long `--wait` blocks by default. */
+export const DEFAULT_FLUSH_TIMEOUT_SECS = 60;
+
+export interface FlushOptions {
+  wait?: boolean;
+  timeoutSecs?: number;
+  home?: string;
+  /** Injected in tests so the wait loop does not really sleep. */
+  sleep?: (ms: number) => Promise<void>;
+}
+
+export interface FlushResult {
+  exitCode: number;
+  lines: string[];
+  /** Batches still spooled when we stopped looking. */
+  pending: number;
+}
+
+/** Mirrored from the daemon's `paths::flush_request_path()`. */
+export function flushRequestPath(home?: string): string {
+  return join(failproofaiHome(home), "state", "flush-request.json");
+}
+
+/** Every directory the collector spools batches into. */
+function spoolDirs(home?: string): string[] {
+  const root = spoolDir(home);
+  if (!existsSync(root)) return [];
+  try {
+    return readdirSync(root, { withFileTypes: true })
+      .filter((e) => e.isDirectory() && e.name !== "failed")
+      .map((e) => join(root, e.name));
+  } catch {
+    return [];
+  }
+}
+
+/** Batches awaiting delivery. `.tmp` files are half-written and not counted. */
+export function pendingBatches(home?: string): number {
+  let n = 0;
+  for (const dir of spoolDirs(home)) {
+    try {
+      n += readdirSync(dir).filter((f) => f.endsWith(".jsonl")).length;
+    } catch {
+      // A directory that vanished mid-scan is one the collector just drained.
+    }
+  }
+  return n;
+}
+
+export async function runFlushCommand(opts: FlushOptions = {}): Promise<FlushResult> {
+  const { home, wait = false } = opts;
+  const timeoutSecs = opts.timeoutSecs ?? DEFAULT_FLUSH_TIMEOUT_SECS;
+  const sleep = opts.sleep ?? ((ms: number) => new Promise<void>((r) => setTimeout(r, ms)));
+  const lines: string[] = [];
+
+  // Preconditions, in the order that produces the most useful message. Each of
+  // these makes a flush a no-op, and each has a different remedy.
+  const cfg = readConfig();
+  if (!cfg.collector?.hooks && !cfg.collector?.sessions) {
+    return {
+      exitCode: 1,
+      pending: 0,
+      lines: [
+        "Collection is off, so nothing is spooled to flush.",
+        "Turn it on with `failproofai config`.",
+      ],
+    };
+  }
+
+  if (!readIngestCredential()) {
+    return {
+      exitCode: 1,
+      pending: 0,
+      lines: [
+        "This machine is not connected, so there is nowhere to flush to.",
+        "Connect it with `failproofai config`.",
+      ],
+    };
+  }
+
+  // Nothing on an unsupported platform will ever read the request file, so
+  // writing one and reporting success is a lie the user cannot detect: the
+  // command exits 0, the batches stay exactly where they were, and the only
+  // symptom is data that never arrives.
+  //
+  // Refusing here matches what `failproofai config` now does on the same
+  // platforms rather than completing unenforced — the two commands should not
+  // disagree about whether this machine has a daemon.
+  if (!isDaemonSupportedPlatform()) {
+    return {
+      exitCode: 1,
+      pending: pendingBatches(home),
+      lines: [
+        `failproofaid does not run on ${process.platform}, and it is what delivers batches.`,
+        "Nothing would pick this request up, so nothing was written.",
+      ],
+    };
+  }
+
+  const status = daemonServiceStatus();
+  if (status !== "running") {
+    return {
+      exitCode: 1,
+      pending: pendingBatches(home),
+      lines: [
+        `failproofaid is ${status}, and it is what delivers batches.`,
+        "Start it with `failproofai config`.",
+      ],
+    };
+  }
+
+  const before = pendingBatches(home);
+  if (before === 0) {
+    return { exitCode: 0, pending: 0, lines: ["Nothing spooled — everything already delivered."] };
+  }
+
+  const path = flushRequestPath(home);
+  mkdirSync(dirname(path), { recursive: true });
+  writeFileSync(path, `${JSON.stringify({ requestedAtMs: Date.now() }, null, 2)}\n`, {
+    mode: 0o600,
+  });
+
+  lines.push(`${before} batch${before === 1 ? "" : "es"} spooled. Requested delivery.`);
+
+  if (!wait) {
+    lines.push("The daemon picks this up within a few seconds.");
+    return { exitCode: 0, pending: before, lines };
+  }
+
+  // `--wait` exists so a script can flush and then assert. Poll the spool
+  // rather than the server: the question is whether THIS machine still holds
+  // events, and the spool is the only place that can answer it locally.
+  const deadline = Date.now() + timeoutSecs * 1000;
+  let pending = before;
+  while (Date.now() < deadline) {
+    await sleep(1000);
+    pending = pendingBatches(home);
+    if (pending === 0) {
+      lines.push("Spool drained.");
+      return { exitCode: 0, pending: 0, lines };
+    }
+  }
+
+  // A timeout is not necessarily a failure — a large backlog legitimately takes
+  // longer than the budget — so say what is still outstanding rather than
+  // calling it broken.
+  lines.push(
+    `Still ${pending} batch${pending === 1 ? "" : "es"} spooled after ${timeoutSecs}s.`,
+    "Delivery continues in the background; re-run with a longer --timeout to keep watching.",
+  );
+  return { exitCode: 1, pending, lines };
+}