failproofai 1.0.0-beta.14 → 1.0.0-beta.16

package/.next/standalone/package.json

@@ -1,6 +1,6 @@
 {
   "name": "failproofai",
-  "version": "1.0.0-beta.14",
+  "version": "1.0.0-beta.16",
   "description": "The easiest way to manage policies that keep your AI agents reliable, on-task, and running autonomously — for Claude Code & the Agents SDK",
   "bin": {
     "failproofai": "./dist/cli.mjs",
@@ -99,14 +99,12 @@
   },
   "dependencies": {
     "html-to-image": "^1.11.13",
-    "html2canvas": "^1.4.1",
     "posthog-node": "^5.47.7",
     "sql.js": "^1.14.1",
     "yaml": "^2.9.0"
   },
   "overrides": {
-    "postcss": "8.5.23",
-    "nanoid": "3.3.17",
+    "postcss": "8.5.26",
     "eslint-plugin-react-hooks": "7.0.1",
     "vite": "8.0.16",
     "undici": "7.29.0",
@@ -114,15 +112,15 @@
     "sharp": "0.35.0"
   },
   "optionalDependencies": {
-    "@failproofai/failproofaid-linux-x64": "1.0.0-beta.14",
-    "@failproofai/failproofaid-linux-arm64": "1.0.0-beta.14",
-    "@failproofai/failproofaid-darwin-x64": "1.0.0-beta.14",
-    "@failproofai/failproofaid-darwin-arm64": "1.0.0-beta.14"
+    "@failproofai/failproofaid-linux-x64": "1.0.0-beta.16",
+    "@failproofai/failproofaid-linux-arm64": "1.0.0-beta.16",
+    "@failproofai/failproofaid-darwin-x64": "1.0.0-beta.16",
+    "@failproofai/failproofaid-darwin-arm64": "1.0.0-beta.16"
   },
   "failproofaidBinaries": {
-    "linux-x64": "969fa920cb6e06a607d4a97bd17078519929b9b7cfd78e1bbf4ed6bd8d21e300",
-    "linux-arm64": "79caf004fced34e827e7566346fd5b47852e3e8a1fd4e41bb7ecd85e68d76e24",
-    "darwin-x64": "0b81018cb2a851c62f5b561d8027dee6897f34cebe32d695ce531c58b70aecf4",
-    "darwin-arm64": "eb91832ea41d569110cc58d15efa9e18151d5f13daa6aca2b968e72ab57dee41"
+    "linux-x64": "b82471309d2e52724781d8074bae55444892030eb1b48305ef74053bb7938931",
+    "linux-arm64": "5a0bdc9f726844e7ed109c896bb894e84a51c7592fe4aed26eceea78c97fde04",
+    "darwin-x64": "08881822befb31fe13974d2861fc50b6b2c1c72741986656e8f9087586202d88",
+    "darwin-arm64": "cc85096de72f3e5813145b7c906ea6a2d4788f39f4dae6a86532d88107802cab"
   }
 }

package/.next/standalone/server.js

@@ -9,7 +9,7 @@ const currentPort = parseInt(process.env.PORT, 10) || 3000
 const hostname = process.env.HOSTNAME || '0.0.0.0'
 
 let keepAliveTimeout = parseInt(process.env.KEEP_ALIVE_TIMEOUT, 10)
-const nextConfig = {"env":{"NEXT_PUBLIC_APP_VERSION":"1.0.0-beta.14"},"typescript":{"ignoreBuildErrors":false},"typedRoutes":false,"distDir":"./.next","cleanDistDir":true,"assetPrefix":"","cacheMaxMemorySize":52428800,"configOrigin":"next.config.ts","useFileSystemPublicRoutes":true,"generateEtags":true,"pageExtensions":["tsx","ts","jsx","js"],"poweredByHeader":true,"compress":true,"images":{"deviceSizes":[640,750,828,1080,1200,1920,2048,3840],"imageSizes":[32,48,64,96,128,256,384],"path":"/_next/image","loader":"default","loaderFile":"","domains":[],"disableStaticImages":false,"minimumCacheTTL":14400,"formats":["image/webp"],"maximumRedirects":3,"maximumResponseBody":50000000,"dangerouslyAllowLocalIP":false,"dangerouslyAllowSVG":false,"contentSecurityPolicy":"script-src 'none'; frame-src 'none'; sandbox;","contentDispositionType":"attachment","localPatterns":[{"pathname":"**","search":""}],"remotePatterns":[],"qualities":[75],"unoptimized":true,"customCacheHandler":false},"devIndicators":{"position":"bottom-left"},"onDemandEntries":{"maxInactiveAge":60000,"pagesBufferLength":5},"basePath":"","sassOptions":{},"trailingSlash":false,"i18n":null,"productionBrowserSourceMaps":false,"excludeDefaultMomentLocales":true,"reactProductionProfiling":false,"reactStrictMode":null,"reactMaxHeadersLength":6000,"httpAgentOptions":{"keepAlive":true},"logging":{"serverFunctions":true,"browserToTerminal":"warn"},"compiler":{},"expireTime":31536000,"staticPageGenerationTimeout":60,"output":"standalone","modularizeImports":{"@mui/icons-material":{"transform":"@mui/icons-material/{{member}}"},"lodash":{"transform":"lodash/{{member}}"}},"outputFileTracingRoot":"/home/runner/work/failproofai/failproofai","cacheComponents":false,"cacheLife":{"default":{"stale":300,"revalidate":900,"expire":4294967294},"seconds":{"stale":30,"revalidate":1,"expire":60},"minutes":{"stale":300,"revalidate":60,"expire":3600},"hours":{"stale":300,"revalidate":3600,"expire":86400},"days":{"stale":300,"revalidate":86400,"expire":604800},"weeks":{"stale":300,"revalidate":604800,"expire":2592000},"max":{"stale":300,"revalidate":2592000,"expire":31536000}},"cacheHandlers":{},"experimental":{"appNewScrollHandler":false,"useSkewCookie":false,"cssChunking":true,"multiZoneDraftMode":false,"appNavFailHandling":false,"prerenderEarlyExit":true,"serverMinification":true,"linkNoTouchStart":false,"caseSensitiveRoutes":false,"cachedNavigations":false,"partialFallbacks":false,"dynamicOnHover":false,"varyParams":false,"prefetchInlining":false,"preloadEntriesOnStart":true,"clientRouterFilter":true,"clientRouterFilterRedirects":false,"fetchCacheKeyPrefix":"","proxyPrefetch":"flexible","optimisticClientCache":true,"manualClientBasePath":false,"cpus":3,"memoryBasedWorkersCount":false,"imgOptConcurrency":null,"imgOptTimeoutInSeconds":7,"imgOptMaxInputPixels":268402689,"imgOptSequentialRead":null,"isrFlushToDisk":true,"workerThreads":false,"optimizeCss":false,"nextScriptWorkers":false,"scrollRestoration":false,"externalDir":false,"disableOptimizedLoading":false,"gzipSize":true,"craCompat":false,"esmExternals":true,"fullySpecified":false,"swcTraceProfiling":false,"forceSwcTransforms":false,"largePageDataBytes":128000,"typedEnv":false,"parallelServerCompiles":false,"parallelServerBuildTraces":false,"ppr":false,"authInterrupts":false,"webpackMemoryOptimizations":false,"optimizeServerReact":true,"strictRouteTypes":false,"useTypeScriptCli":false,"viewTransition":false,"removeUncaughtErrorAndRejectionListeners":false,"validateRSCRequestHeaders":false,"staleTimes":{"dynamic":0,"static":300},"reactDebugChannel":true,"serverComponentsHmrCache":true,"staticGenerationMaxConcurrency":8,"staticGenerationMinPagesPerWorker":25,"transitionIndicator":false,"gestureTransition":false,"inlineCss":false,"useCache":false,"globalNotFound":false,"browserDebugInfoInTerminal":"warn","lockDistDir":true,"proxyClientMaxBodySize":10485760,"hideLogsAfterAbort":false,"mcpServer":true,"turbopackFileSystemCacheForDev":true,"turbopackFileSystemCacheForBuild":false,"turbopackInferModuleSideEffects":true,"turbopackPluginRuntimeStrategy":"childProcesses","optimizePackageImports":["lucide-react","date-fns","lodash-es","ramda","antd","react-bootstrap","ahooks","@ant-design/icons","@headlessui/react","@headlessui-float/react","@heroicons/react/20/solid","@heroicons/react/24/solid","@heroicons/react/24/outline","@visx/visx","@tremor/react","rxjs","@mui/material","@mui/icons-material","recharts","react-use","effect","@effect/schema","@effect/platform","@effect/platform-node","@effect/platform-browser","@effect/platform-bun","@effect/sql","@effect/sql-mssql","@effect/sql-mysql2","@effect/sql-pg","@effect/sql-sqlite-node","@effect/sql-sqlite-bun","@effect/sql-sqlite-wasm","@effect/sql-sqlite-react-native","@effect/rpc","@effect/rpc-http","@effect/typeclass","@effect/experimental","@effect/opentelemetry","@material-ui/core","@material-ui/icons","@tabler/icons-react","mui-core","react-icons/ai","react-icons/bi","react-icons/bs","react-icons/cg","react-icons/ci","react-icons/di","react-icons/fa","react-icons/fa6","react-icons/fc","react-icons/fi","react-icons/gi","react-icons/go","react-icons/gr","react-icons/hi","react-icons/hi2","react-icons/im","react-icons/io","react-icons/io5","react-icons/lia","react-icons/lib","react-icons/lu","react-icons/md","react-icons/pi","react-icons/ri","react-icons/rx","react-icons/si","react-icons/sl","react-icons/tb","react-icons/tfi","react-icons/ti","react-icons/vsc","react-icons/wi"],"trustHostHeader":false,"isExperimentalCompile":false},"htmlLimitedBots":"[\\w-]+-Google|Google-[\\w-]+|Chrome-Lighthouse|Slurp|DuckDuckBot|baiduspider|yandex|sogou|bitlybot|tumblr|vkShare|quora link preview|redditbot|ia_archiver|Bingbot|BingPreview|applebot|facebookexternalhit|facebookcatalog|Twitterbot|LinkedInBot|Slackbot|Discordbot|WhatsApp|SkypeUriPreview|Yeti|googleweblight","bundlePagesRouterDependencies":false,"configFileName":"next.config.ts","outputFileTracingExcludes":{"*":["node_modules/@img/**","node_modules/sharp/**"]},"turbopack":{"root":"/home/runner/work/failproofai/failproofai"},"distDirRoot":".next"}
+const nextConfig = {"env":{"NEXT_PUBLIC_APP_VERSION":"1.0.0-beta.16"},"typescript":{"ignoreBuildErrors":false},"typedRoutes":false,"distDir":"./.next","cleanDistDir":true,"assetPrefix":"","cacheMaxMemorySize":52428800,"configOrigin":"next.config.ts","useFileSystemPublicRoutes":true,"generateEtags":true,"pageExtensions":["tsx","ts","jsx","js"],"poweredByHeader":true,"compress":true,"images":{"deviceSizes":[640,750,828,1080,1200,1920,2048,3840],"imageSizes":[32,48,64,96,128,256,384],"path":"/_next/image","loader":"default","loaderFile":"","domains":[],"disableStaticImages":false,"minimumCacheTTL":14400,"formats":["image/webp"],"maximumRedirects":3,"maximumResponseBody":50000000,"dangerouslyAllowLocalIP":false,"dangerouslyAllowSVG":false,"contentSecurityPolicy":"script-src 'none'; frame-src 'none'; sandbox;","contentDispositionType":"attachment","localPatterns":[{"pathname":"**","search":""}],"remotePatterns":[],"qualities":[75],"unoptimized":true,"customCacheHandler":false},"devIndicators":{"position":"bottom-left"},"onDemandEntries":{"maxInactiveAge":60000,"pagesBufferLength":5},"basePath":"","sassOptions":{},"trailingSlash":false,"i18n":null,"productionBrowserSourceMaps":false,"excludeDefaultMomentLocales":true,"reactProductionProfiling":false,"reactStrictMode":null,"reactMaxHeadersLength":6000,"httpAgentOptions":{"keepAlive":true},"logging":{"serverFunctions":true,"browserToTerminal":"warn"},"compiler":{},"expireTime":31536000,"staticPageGenerationTimeout":60,"output":"standalone","modularizeImports":{"@mui/icons-material":{"transform":"@mui/icons-material/{{member}}"},"lodash":{"transform":"lodash/{{member}}"}},"outputFileTracingRoot":"/home/runner/work/failproofai/failproofai","cacheComponents":false,"cacheLife":{"default":{"stale":300,"revalidate":900,"expire":4294967294},"seconds":{"stale":30,"revalidate":1,"expire":60},"minutes":{"stale":300,"revalidate":60,"expire":3600},"hours":{"stale":300,"revalidate":3600,"expire":86400},"days":{"stale":300,"revalidate":86400,"expire":604800},"weeks":{"stale":300,"revalidate":604800,"expire":2592000},"max":{"stale":300,"revalidate":2592000,"expire":31536000}},"cacheHandlers":{},"experimental":{"appNewScrollHandler":false,"useSkewCookie":false,"cssChunking":true,"multiZoneDraftMode":false,"appNavFailHandling":false,"prerenderEarlyExit":true,"serverMinification":true,"linkNoTouchStart":false,"caseSensitiveRoutes":false,"cachedNavigations":false,"partialFallbacks":false,"dynamicOnHover":false,"varyParams":false,"prefetchInlining":false,"preloadEntriesOnStart":true,"clientRouterFilter":true,"clientRouterFilterRedirects":false,"fetchCacheKeyPrefix":"","proxyPrefetch":"flexible","optimisticClientCache":true,"manualClientBasePath":false,"cpus":3,"memoryBasedWorkersCount":false,"imgOptConcurrency":null,"imgOptTimeoutInSeconds":7,"imgOptMaxInputPixels":268402689,"imgOptSequentialRead":null,"isrFlushToDisk":true,"workerThreads":false,"optimizeCss":false,"nextScriptWorkers":false,"scrollRestoration":false,"externalDir":false,"disableOptimizedLoading":false,"gzipSize":true,"craCompat":false,"esmExternals":true,"fullySpecified":false,"swcTraceProfiling":false,"forceSwcTransforms":false,"largePageDataBytes":128000,"typedEnv":false,"parallelServerCompiles":false,"parallelServerBuildTraces":false,"ppr":false,"authInterrupts":false,"webpackMemoryOptimizations":false,"optimizeServerReact":true,"strictRouteTypes":false,"useTypeScriptCli":false,"viewTransition":false,"removeUncaughtErrorAndRejectionListeners":false,"validateRSCRequestHeaders":false,"staleTimes":{"dynamic":0,"static":300},"reactDebugChannel":true,"serverComponentsHmrCache":true,"staticGenerationMaxConcurrency":8,"staticGenerationMinPagesPerWorker":25,"transitionIndicator":false,"gestureTransition":false,"inlineCss":false,"useCache":false,"globalNotFound":false,"browserDebugInfoInTerminal":"warn","lockDistDir":true,"proxyClientMaxBodySize":10485760,"hideLogsAfterAbort":false,"mcpServer":true,"turbopackFileSystemCacheForDev":true,"turbopackFileSystemCacheForBuild":false,"turbopackInferModuleSideEffects":true,"turbopackPluginRuntimeStrategy":"childProcesses","optimizePackageImports":["lucide-react","date-fns","lodash-es","ramda","antd","react-bootstrap","ahooks","@ant-design/icons","@headlessui/react","@headlessui-float/react","@heroicons/react/20/solid","@heroicons/react/24/solid","@heroicons/react/24/outline","@visx/visx","@tremor/react","rxjs","@mui/material","@mui/icons-material","recharts","react-use","effect","@effect/schema","@effect/platform","@effect/platform-node","@effect/platform-browser","@effect/platform-bun","@effect/sql","@effect/sql-mssql","@effect/sql-mysql2","@effect/sql-pg","@effect/sql-sqlite-node","@effect/sql-sqlite-bun","@effect/sql-sqlite-wasm","@effect/sql-sqlite-react-native","@effect/rpc","@effect/rpc-http","@effect/typeclass","@effect/experimental","@effect/opentelemetry","@material-ui/core","@material-ui/icons","@tabler/icons-react","mui-core","react-icons/ai","react-icons/bi","react-icons/bs","react-icons/cg","react-icons/ci","react-icons/di","react-icons/fa","react-icons/fa6","react-icons/fc","react-icons/fi","react-icons/gi","react-icons/go","react-icons/gr","react-icons/hi","react-icons/hi2","react-icons/im","react-icons/io","react-icons/io5","react-icons/lia","react-icons/lib","react-icons/lu","react-icons/md","react-icons/pi","react-icons/ri","react-icons/rx","react-icons/si","react-icons/sl","react-icons/tb","react-icons/tfi","react-icons/ti","react-icons/vsc","react-icons/wi"],"trustHostHeader":false,"isExperimentalCompile":false},"htmlLimitedBots":"[\\w-]+-Google|Google-[\\w-]+|Chrome-Lighthouse|Slurp|DuckDuckBot|baiduspider|yandex|sogou|bitlybot|tumblr|vkShare|quora link preview|redditbot|ia_archiver|Bingbot|BingPreview|applebot|facebookexternalhit|facebookcatalog|Twitterbot|LinkedInBot|Slackbot|Discordbot|WhatsApp|SkypeUriPreview|Yeti|googleweblight","bundlePagesRouterDependencies":false,"configFileName":"next.config.ts","outputFileTracingExcludes":{"*":["node_modules/@img/**","node_modules/sharp/**"]},"turbopack":{"root":"/home/runner/work/failproofai/failproofai"},"distDirRoot":".next"}
 
 process.env.__NEXT_PRIVATE_STANDALONE_CONFIG = JSON.stringify(nextConfig)
 

package/bin/failproofai.mjs

@@ -327,26 +327,6 @@ COMMANDS
   harness remove-path <h> <p>    Stop capturing that path
   harness --help, -h             Show this help for the harness command
 
-    Each agent CLI is watched wherever its own installer put it. Extra paths add
-    the places it did not: a second profile, a team share, a per-user home.
-
-    failproofai harness add-path openclaw user1=/srv/.openclaw-user1
-    failproofai harness add-path openclaw user2=/srv/.openclaw-user2
-    failproofai harness add-path hermes   user1=/srv/.hermes-user1/state.db
-
-    LABEL PER-USER PATHS EXPLICITLY. An agent id comes from the cwd recorded
-    inside the transcript, identical in every copy of a project, so unlabelled
-    paths merge two people into one agent whose sessions interleave. Omitting the
-    label derives one from the folder name — fine for .openclaw-user1, but
-    /home/u1/.openclaw and /home/u2/.openclaw both derive "openclaw" and the
-    second is refused. A path overlapping one already captured is refused too.
-
-    FAILPROOFAI_<HARNESS>_EXTRA_PATHS overrides the file for containers:
-      FAILPROOFAI_OPENCLAW_EXTRA_PATHS="user1=/srv/.openclaw-user1,user2=/srv/.openclaw-user2"
-
-    Written to ~/.failproofai/config.json; the daemon picks it up in seconds —
-    no restart, no sudo. Session collection must be on for any of it to be read.
-
   audit                          Audit your agent's behavior, then open the
                                  dashboard at http://localhost:8020/audit
   audit --help, -h               Show this help for the audit command
@@ -363,6 +343,18 @@ COMMANDS
     --wait                         Block until the spool drains (or --timeout)
     --timeout <secs>               How long to wait with --wait (default: 60)
 
+  update                         Finish an upgrade npm cannot: migrate
+                                 ~/.failproofai to this version's layout, put the
+                                 matching daemon binary in place, restart it.
+                                 Run after \`npm install -g failproofai@latest\`.
+    --no-daemon                    Migrate the home only
+
+  migrate                        Run pending layout migrations on their own,
+                                 keyed on the layout in ~/.failproofai/VERSION
+                                 (not the npm version, so skipping releases with
+                                 no layout change runs nothing)
+    --dry-run                      Print the steps and change nothing
+
   uninstall                      Remove failproofai from this machine: hook
                                  entries from every agent CLI, and the daemon
                                  service. Run this BEFORE \`npm rm -g failproofai\`
@@ -465,7 +457,6 @@ LINKS
   // past the help block above and reach here, so without this a user typing
   // `failproofai policies --help` had their home reset by a question. The
   // adjacent, far less destructive first-run gate exempted help from the start.
-  let layoutWasReset = false;
   {
     const isHelpOrVersion =
       args.includes("--help") || args.includes("-h") || args.includes("--version") || args.includes("-v");
@@ -484,12 +475,23 @@ LINKS
         console.error(warning);
         process.exit(1);
       }
-    } else if (!isHelpOrVersion) {
+    } else if (!isHelpOrVersion && args[0] !== "migrate" && args[0] !== "update") {
+      // `migrate` and `update` are exempt because they ARE this step, and letting
+      // it run first breaks them both. `migrate --dry-run` promises to change
+      // nothing and print what would happen — with the check ahead of it, the home
+      // was already migrated by the time the subcommand looked, so it reported
+      // "nothing to migrate" on every stale machine it was ever pointed at, which
+      // is the one answer a dry run must never give wrongly. Caught by a smoke
+      // test on a seeded layout-2 home, not by a unit test: nothing below the CLI
+      // entry point can see this ordering.
       const { checkLayoutForCli } = await import("../src/hooks/fp-reset");
       const check = await checkLayoutForCli();
       for (const line of check.lines) console.error(line);
       if (check.fatal) process.exit(1);
-      layoutWasReset = check.didReset;
+      // `check.didReset` is deliberately not read. It used to force the wizard
+      // below; see the note at `shouldOfferFirstRun` for why a migrated machine
+      // no longer needs setup re-run, and `didReset` in `fp-reset.ts` for what
+      // the field means now.
     }
   }
 
@@ -516,20 +518,25 @@ LINKS
   }
 
   const { shouldOfferFirstRun } = await import("../src/hooks/first-run-gate");
-  if (shouldOfferFirstRun(args) || layoutWasReset) {
+  // `|| layoutWasReset` stood here, with `force: layoutWasReset` below, because a
+  // migration used to delete the home's policy config while leaving the agent
+  // CLIs' settings files alone — so `isConfigured()` read true off
+  // `hasGlobalHooks` and setup was skipped, leaving hooks firing against no
+  // policies, silently and permanently.
+  //
+  // The migration keeps that file now (`HOME_CLASSES` classes it `user-typed`),
+  // along with `config.json` and `credentials.json`, so a migrated machine is
+  // configured in fact and not merely in appearance. Forcing the wizard here
+  // would open an interactive prompt with nothing to answer — and on a fleet box,
+  // a CI runner or a headless gateway, nobody to answer it. A home that never
+  // finished setup still gets here on its own: `isConfigured()` is false for it.
+  // See `didReset` in `fp-reset.ts`.
+  if (shouldOfferFirstRun(args)) {
     try {
       const { maybeFirstRunConfigure } = await import("../src/hooks/configure-wizard");
       // `audit` runs its own scan immediately after this returns; firing the
       // post-setup audit too would scan the whole history twice in a row.
-      //
-      // `force` after a reset: the home's policy config is gone, but the agent
-      // CLIs' settings files were deliberately left alone, so `isConfigured()`
-      // still reads true off `hasGlobalHooks` and setup would be skipped —
-      // leaving hooks firing against no policies, silently and permanently.
-      await maybeFirstRunConfigure(
-        {},
-        { postSetupAudit: args[0] !== "audit", force: layoutWasReset },
-      );
+      await maybeFirstRunConfigure({}, { postSetupAudit: args[0] !== "audit" });
     } catch {
       // Onboarding is never allowed to block the command the user actually typed.
     }
@@ -733,6 +740,14 @@ EXAMPLES
   failproofai harness list
   failproofai harness remove-path claude work
 
+  One home per person — label them, or both derive the same folder-name label
+  and the second is refused:
+  failproofai harness add-path openclaw user1=/srv/.openclaw-user1
+  failproofai harness add-path openclaw user2=/srv/.openclaw-user2
+
+  Containers: FAILPROOFAI_<HARNESS>_EXTRA_PATHS replaces the file's entries.
+  FAILPROOFAI_OPENCLAW_EXTRA_PATHS="user1=/srv/.openclaw-user1,user2=/srv/.openclaw-user2"
+
 `.trimStart());
       process.exit(0);
     }
@@ -762,6 +777,211 @@ EXAMPLES
   // disables policies; this removes the product — hook entries across every
   // agent CLI plus the root-owned daemon service — and the two must not be one
   // keystroke apart.
+  if (args[0] === "migrate") {
+    const subArgs = args.slice(1);
+    if (subArgs.includes("--help") || subArgs.includes("-h")) {
+      console.log(`
+failproofai migrate — bring ~/.failproofai up to the layout this version speaks
+
+USAGE
+  failproofai migrate [--dry-run]
+
+WHY
+  npm cannot update an installed package on its own, so a machine can sit on an
+  old version for months and then jump several layouts at once. This runs the
+  steps for that jump in order, keyed on the LAYOUT recorded in
+  ~/.failproofai/VERSION rather than on the npm version — so skipping thirty
+  releases with no layout change runs nothing at all.
+
+  It normally happens by itself, on the first command after an upgrade. This is
+  for running it deliberately, and for seeing what it would do first.
+
+  Your settings, cloud enrolment, policy selection, your own policy files,
+  decision history and undelivered events are carried across, not removed. The
+  irreplaceable files are copied to migrations/backup-layout<n>/ before anything
+  runs, and every step is recorded in migrations/applied.json.
+
+OPTIONS
+  --dry-run   Print the steps and the files that would be saved. Change nothing.
+`);
+      process.exit(0);
+    }
+
+    const KNOWN = new Set(["--dry-run"]);
+    const unknown = subArgs.find((a) => a.startsWith("-") && !KNOWN.has(a));
+    if (unknown) {
+      throw new CliError(
+        `Unexpected argument: ${unknown}\nRun \`failproofai migrate --help\` for usage.`,
+      );
+    }
+
+    lastSubcommand = "migrate";
+    const { detectLayout } = await import("../src/hooks/fp-config");
+    const { LAYOUT_VERSION } = await import("../src/hooks/fp-home");
+    const { describePlan, runMigrations } = await import("../src/hooks/migrations");
+    const state = detectLayout();
+
+    // A NEWER home is refused here exactly as `checkLayoutForCli` refuses it: the
+    // data is fine and an upgrade would read it, so migrating "forward" from it
+    // is not a thing that exists.
+    if (state.kind === "future") {
+      console.error(
+        `This machine's failproofai directory was written by a newer version (layout ${state.found};`,
+      );
+      console.error(`this build speaks ${LAYOUT_VERSION}). Upgrade rather than migrate:`);
+      console.error(`  npm install -g failproofai@latest`);
+      await track("cli_migrate", { ok: false, reason: "future_layout" });
+      lastSubcommand = null;
+      await exitAfterFlush(1);
+      return;
+    }
+
+    const from = state.kind === "stale" ? state.found : LAYOUT_VERSION;
+    if (subArgs.includes("--dry-run")) {
+      for (const line of describePlan(from)) console.log(line);
+      await track("cli_migrate", { ok: true, dry_run: true, from });
+      lastSubcommand = null;
+      await exitAfterFlush(0);
+      return;
+    }
+
+    if (state.kind !== "stale") {
+      console.log(`Already at layout ${LAYOUT_VERSION}. Nothing to migrate.`);
+      await track("cli_migrate", { ok: true, from, steps: 0 });
+      lastSubcommand = null;
+      await exitAfterFlush(0);
+      return;
+    }
+
+    const run = runMigrations(from);
+    for (const step of run.steps) {
+      console.log(`${step.ok ? "migrated" : "FAILED  "} layout ${step.from} → ${step.to}`);
+    }
+    if (run.backedUp.length > 0) {
+      console.log(`Saved first: ${run.backedUp.join(", ")}`);
+    }
+    if (run.failed) {
+      console.error(`Step ${run.failed.from} → ${run.failed.to} did not finish: ${run.failed.error}`);
+      console.error(`The home is still marked layout ${from} and will be retried.`);
+    }
+    await track("cli_migrate", {
+      ok: !run.failed,
+      from,
+      steps: run.steps.length,
+      removed: run.outcome.removed.length,
+    });
+    lastSubcommand = null;
+    await exitAfterFlush(run.failed ? 1 : 0);
+    return;
+  }
+
+  if (args[0] === "update") {
+    const subArgs = args.slice(1);
+    if (subArgs.includes("--help") || subArgs.includes("-h")) {
+      console.log(`
+failproofai update — finish an upgrade: migrate the home, match the daemon
+
+USAGE
+  npm install -g failproofai@latest && failproofai update [--no-daemon]
+
+WHY
+  npm replaces the CLI and nothing else. The daemon binary lives at
+  ~/.failproofai/bin/failproofaid-<version> and stays exactly where it was, so
+  after an npm upgrade the two halves are different versions — and failproofaid
+  refuses to start against a layout it does not speak, which is the loud version
+  of that problem rather than the silent one.
+
+  This does the rest of the upgrade: runs any pending layout migrations, puts the
+  matching daemon binary in place, and restarts the service.
+
+OPTIONS
+  --no-daemon   Migrate the home only. Leaves a version-skewed daemon in place,
+                so prefer letting it run.
+`);
+      process.exit(0);
+    }
+
+    const KNOWN = new Set(["--no-daemon"]);
+    const unknown = subArgs.find((a) => a.startsWith("-") && !KNOWN.has(a));
+    if (unknown) {
+      throw new CliError(
+        `Unexpected argument: ${unknown}\nRun \`failproofai update --help\` for usage.`,
+      );
+    }
+
+    lastSubcommand = "update";
+    // Runs the migration itself rather than leaning on the check at the top of
+    // this file, which this command is exempt from. Reading the ledger and
+    // inferring "the top-level check must have done it" was the first version, and
+    // it is the kind of indirection that reads fine and reports the wrong thing
+    // the moment either half moves.
+    const { detectLayout } = await import("../src/hooks/fp-config");
+    const { LAYOUT_VERSION } = await import("../src/hooks/fp-home");
+    const { runMigrations } = await import("../src/hooks/migrations");
+    const state = detectLayout();
+
+    if (state.kind === "future") {
+      console.error(
+        `This machine's failproofai directory was written by a NEWER version (layout ${state.found};`,
+      );
+      console.error(`this build speaks ${LAYOUT_VERSION}). This CLI is the stale half:`);
+      console.error(`  npm install -g failproofai@latest`);
+      await track("cli_update", { ok: false, reason: "future_layout" });
+      lastSubcommand = null;
+      await exitAfterFlush(1);
+      return;
+    }
+
+    let migrationsRan = 0;
+    let migrationFailed = false;
+    if (state.kind === "stale") {
+      const run = runMigrations(state.found);
+      migrationsRan = run.steps.length;
+      migrationFailed = Boolean(run.failed);
+      for (const step of run.steps) {
+        console.log(`${step.ok ? "migrated" : "FAILED  "} layout ${step.from} → ${step.to}`);
+      }
+      if (run.backedUp.length > 0) console.log(`Saved first: ${run.backedUp.join(", ")}`);
+      if (run.failed) {
+        console.error(
+          `Step ${run.failed.from} → ${run.failed.to} did not finish: ${run.failed.error}`,
+        );
+        console.error(`The home is still marked layout ${state.found} and will be retried.`);
+      }
+    } else {
+      console.log(`Home is at layout ${LAYOUT_VERSION}; no migration was needed.`);
+    }
+
+    // The daemon is refreshed even when a step failed, and deliberately: the
+    // binary and the layout are independent halves, and leaving a version-skewed
+    // daemon behind on top of a failed migration is strictly worse than fixing
+    // the half that can be fixed. The exit code still reports the failure.
+    let daemonOk = true;
+    if (subArgs.includes("--no-daemon")) {
+      console.log("Skipped the daemon (--no-daemon). Its version may not match this CLI.");
+    } else {
+      const svc = await import("../src/hooks/daemon-service");
+      if (!svc.isDaemonSupportedPlatform()) {
+        console.log(`failproofaid does not run on ${process.platform}; nothing to update.`);
+      } else {
+        // `refreshDaemonToCliVersion` answers "is there a service at all" itself,
+        // so there is no separate installed check to get out of step with it.
+        const result = await svc.refreshDaemonToCliVersion();
+        for (const line of result.lines) console.log(line);
+        daemonOk = result.ok;
+      }
+    }
+
+    await track("cli_update", {
+      ok: daemonOk && !migrationFailed,
+      migrations: migrationsRan,
+      migration_failed: migrationFailed,
+    });
+    lastSubcommand = null;
+    await exitAfterFlush(daemonOk && !migrationFailed ? 0 : 1);
+    return;
+  }
+
   if (args[0] === "uninstall") {
     const subArgs = args.slice(1);
     if (subArgs.includes("--help") || subArgs.includes("-h")) {

package/bin/failproofaid-shim.mjs

@@ -11,10 +11,10 @@
  * keep alive itself. This shim exists only for a user (or script)
  * invoking `failproofaid` by hand.
  *
- * The npm package deliberately ships no binary: one tarball serves every
- * platform, and the four cross-compiled binaries live on the GitHub
- * Release for this version (see `src/hooks/daemon-download.ts`).
- * `failproofai config` is what fetches one. So "not installed" here is a
+ * The root npm tarball contains no native binary. A matching optional platform
+ * package normally supplies it; the GitHub Release for this version is the
+ * verified fallback (see `src/hooks/daemon-download.ts`). `failproofai config`
+ * installs either source into `~/.failproofai/bin`. So "not installed" here is a
  * normal state rather than a broken install, and it degrades with a
  * one-line message and a non-zero exit — never a stack trace — including
  * on a platform that has no binary at all (Windows). The daemon-connect