failproofai 1.0.0-beta.16 → 1.0.0-beta.18

package/dist/worker.mjs

@@ -2510,7 +2510,7 @@ var init_builtin_policies = __esm(() => {
 });
 
 // package.json
-var version = "1.0.0-beta.16";
+var version = "1.0.0-beta.18";
 var init_package = () => {};
 
 // src/posthog-key.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "failproofai",
-  "version": "1.0.0-beta.16",
+  "version": "1.0.0-beta.18",
   "description": "The easiest way to manage policies that keep your AI agents reliable, on-task, and running autonomously — for Claude Code & the Agents SDK",
   "bin": {
     "failproofai": "./dist/cli.mjs",
@@ -112,15 +112,15 @@
     "sharp": "0.35.0"
   },
   "optionalDependencies": {
-    "@failproofai/failproofaid-linux-x64": "1.0.0-beta.16",
-    "@failproofai/failproofaid-linux-arm64": "1.0.0-beta.16",
-    "@failproofai/failproofaid-darwin-x64": "1.0.0-beta.16",
-    "@failproofai/failproofaid-darwin-arm64": "1.0.0-beta.16"
+    "@failproofai/failproofaid-linux-x64": "1.0.0-beta.18",
+    "@failproofai/failproofaid-linux-arm64": "1.0.0-beta.18",
+    "@failproofai/failproofaid-darwin-x64": "1.0.0-beta.18",
+    "@failproofai/failproofaid-darwin-arm64": "1.0.0-beta.18"
   },
   "failproofaidBinaries": {
-    "linux-x64": "b82471309d2e52724781d8074bae55444892030eb1b48305ef74053bb7938931",
-    "linux-arm64": "5a0bdc9f726844e7ed109c896bb894e84a51c7592fe4aed26eceea78c97fde04",
-    "darwin-x64": "08881822befb31fe13974d2861fc50b6b2c1c72741986656e8f9087586202d88",
-    "darwin-arm64": "cc85096de72f3e5813145b7c906ea6a2d4788f39f4dae6a86532d88107802cab"
+    "linux-x64": "54bf7cc41ee8b5a2ea9430459c1fe9b8b03ece25c18d8bee49441feee93c7057",
+    "linux-arm64": "1f5e7c4be2d9c591cf4fd39e5fc122e71f507115cdb2ad1a27c5f30f22a30028",
+    "darwin-x64": "ae510969144aaec5e8891cfa5cdf7374c5efbd7554547046efa5913aab5c3ab2",
+    "darwin-arm64": "bc8d96e295aa9a68590be6e12d4bf3711749a31371206e63ccc36dd42b275e18"
   }
 }

package/src/hooks/configure-wizard.ts

@@ -967,6 +967,24 @@ export async function runConfigureWizard(io: WizardIO = {}): Promise<WizardResul
   // is stated, not prompted), so ← there would sometimes go nowhere.
   let presets: string[] | null = null;
   let clisSel: string[] | null = null;
+  /**
+   * What the harness step had ticked when ← was last pressed.
+   *
+   * A SEPARATE variable, because `clisSel` cannot do this job: it is the loop's
+   * own condition (`while (clisSel === null)`), so it is null on every entry into
+   * the body by definition, and it is assigned only on the line that ends the
+   * loop. The restore that read `clisSel` was therefore unreachable — provably
+   * dead, with a comment stating the opposite intent.
+   *
+   * The cost was not cosmetic: deselect a CLI, press ← to fix an earlier answer,
+   * come back, and the step showed the detected defaults again. Pressing ↵ then —
+   * reasonably, having been told the selection was carried back — re-enabled hook
+   * installation for a CLI the user had explicitly turned off.
+   *
+   * `presets` just above works because it is assigned MID-loop and survives to the
+   * next iteration; this mirrors that, filled from the prompt's `onBack`.
+   */
+  const carried: { clis: string[] | null } = { clis: null };
   while (clisSel === null) {
     // Re-entering after a ← must show what was picked, not a blank slate.
     // Selection state lives on each choice, so carry it back in.
@@ -986,7 +1004,16 @@ export async function runConfigureWizard(io: WizardIO = {}): Promise<WizardResul
 
     // 3 — Which harnesses? An "Everything available" row protects every supported
     // CLI (detected + set-up-ahead); when ticked it wins over the individual boxes.
-    const priorClis = clisSel as string[] | null;
+    // Read off a HOLDER OBJECT, not a bare `let`, and not through a cast.
+    //
+    // A `let` assigned only inside a callback is narrowed by control-flow analysis
+    // to its initializer, so `priorClis.includes` will not compile — and the
+    // original defeated that with `clisSel as string[] | null`. That cast is
+    // precisely why the dead code type-checked and nobody noticed: it silenced the
+    // compiler making exactly the point the reviewer later made by hand, that the
+    // value could only ever be null. A property read carries the declared type
+    // without suppressing anything.
+    const priorClis = carried.clis;
     const picked: string[] | typeof BACK | null = await multiSelect<string>({
     message: "Which harnesses should it protect?",
     choices: [
@@ -1006,6 +1033,12 @@ export async function runConfigureWizard(io: WizardIO = {}): Promise<WizardResul
       summaryNoun: "harnesses",
       hint: "detected CLIs are pre-selected · space toggles · ctrl+a all · ← back · ↵ confirm",
       allowBack: true as const,
+      // `BACK` is a symbol and cannot carry the selection, so the prompt reports
+      // it here instead — otherwise a ← discards what the user had ticked and the
+      // next pass redraws the detected defaults.
+      onBack: (checkedNow) => {
+        carried.clis = checkedNow;
+      },
       stdin,
       stdout,
     });

package/src/hooks/daemon-service.ts

@@ -1506,77 +1506,104 @@ export async function ensureDaemonServiceCurrent(): Promise<DaemonUpgradeResult>
  * to in-process evaluation would trade a visible failure for an invisible one.
  * The lines say so.
  */
-export async function refreshDaemonToCliVersion(): Promise<{ ok: boolean; lines: string[] }> {
-  const lines: string[] = [];
-  if (daemonServiceStatus() === "not-installed") {
+export async function refreshDaemonToCliVersion(
+  /**
+   * Injectable for tests, matching `waitForDaemonRunning`'s shape in this file.
+   * A `vi.spyOn` on the module namespace cannot intercept these — the module
+   * calls its own local bindings — so without a seam a test asserting either
+   * branch passes for the wrong reason: on a machine with no service, "no-op"
+   * and "the spy worked" are indistinguishable.
+   */
+  deps: {
+    status?: () => DaemonServiceStatus;
+    install?: () => Promise<DaemonInstallResult>;
+    prime?: () => boolean;
+    interactive?: () => boolean;
+  } = {},
+): Promise<{ ok: boolean; lines: string[] }> {
+  const status = deps.status ?? daemonServiceStatus;
+  const install = deps.install ?? installDaemonService;
+  const prime = deps.prime ?? primeElevation;
+  const interactive =
+    deps.interactive ?? (() => Boolean(process.stdin.isTTY && process.stdout.isTTY));
+  if (status() === "not-installed") {
     return { ok: true, lines: ["No failproofaid service on this machine; nothing to update."] };
   }
 
-  const binary = await ensureFailproofaidBinary();
-  if (!binary.path) {
-    return {
-      ok: false,
-      lines: [
-        `Could not put the failproofaid ${version} binary in place: ${binary.reason ?? "unknown reason"}`,
-        `The installed daemon is unchanged. It refuses to start against a layout it does`,
-        `not speak, so if this machine has just been migrated, run \`failproofai config\`.`,
-      ],
-    };
-  }
-  lines.push(`failproofaid ${version} binary in place.`);
-
-  const upgrade = await ensureDaemonServiceCurrent();
-  if (upgrade.outcome === "failed") {
-    return {
-      ok: false,
-      lines: [
-        ...lines,
-        `The service definition could not be refreshed: ${upgrade.reason ?? "unknown reason"}`,
-        ...(upgrade.daemonRunning === false
-          ? [
-              `failproofaid is NOT running. On a machine configured to require it, every tool`,
-              `call denies until it is back — run \`failproofai config\` to rebuild the service.`,
-            ]
-          : []),
-      ],
-    };
-  }
-
-  // `daemonRestartCommand()` returns the human-facing string (`sudo systemctl
-  // restart …`); the actual call goes through `runPrivileged`, which is `sudo -n`
-  // and never prompts. A machine that cannot elevate gets the command to run by
-  // hand — the same contract `installDaemonService` follows.
-  const restart = daemonRestartCommand();
-  try {
-    if (process.platform === "darwin") {
-      runPrivileged("launchctl", ["kickstart", "-k", `system/${launchdLabel()}`]);
-    } else {
-      runPrivileged("systemctl", ["restart", systemdUnitName()]);
-    }
-  } catch {
-    return {
-      ok: false,
-      lines: [
-        ...lines,
-        `Could not restart failproofaid without a password. Run this yourself:`,
-        `  ${restart ?? "restart the failproofaid service"}`,
-      ],
-    };
-  }
-  // Probed, never inferred from the restart command's exit code — see
-  // `waitForDaemonRunning`, which exists because one reading of `is-active`
-  // passes a daemon that died immediately after forking.
-  if (!(await waitForDaemonRunning())) {
+  // `installDaemonService()`, not a binary fetch plus a restart.
+  //
+  // The first version of this did the latter, and it did not work: it called
+  // `ensureFailproofaidBinary()` (which correctly lands
+  // `bin/failproofaid-<this version>`) and then `ensureDaemonServiceCurrent()`,
+  // whose rewrite goes through `upgradedServiceDefinition` — and that PRESERVES
+  // the existing `ExecStart` via `installedExecStart(definition)`, by design,
+  // because its job is to upgrade the unit's SHAPE without changing which binary
+  // runs. So on a machine coming from an older release the new binary was
+  // downloaded, the unit was rewritten, the service was restarted, and the OLD
+  // binary came back up — under a message that said the daemon had been
+  // refreshed. Worse than not having the command, because it reports success.
+  //
+  // `installDaemonService()` is the function that already knows how to make the
+  // service run THIS CLI's version: it resolves the binary for this version,
+  // writes the unit around that path, removes any legacy user unit, reloads,
+  // enables, and waits for the service to reach AND HOLD a running state rather
+  // than trusting the moment a `Type=simple` unit reports active. It is
+  // idempotent, which is what makes it safe to call on an already-installed
+  // machine.
+  // ASK FOR THE PASSWORD, when there is somebody to ask.
+  //
+  // Writing the unit needs root, and `runPrivileged` uses `sudo -n` — which never
+  // prompts. That rule exists for the WIZARD, whose reason is stated where it is
+  // enforced: a password prompt fired from underneath a full-screen TUI is
+  // unreadable at best. It does not transfer to this command, which is plain line
+  // output with nothing to corrupt, and the wizard itself calls `primeElevation()`
+  // for exactly this at exactly this point.
+  //
+  // Without it, `failproofai update` on the machine it exists for — one with a
+  // daemon, upgrading — failed with "sudo credentials were not available" and a
+  // thirty-line unit file to paste by hand. The only working alternatives were
+  // `sudo -v` first (undocumented) or `failproofai config`, an interactive wizard.
+  // That is not an upgrade path.
+  //
+  // Gated on a TTY, not attempted blindly: on a CI runner or a fleet box there is
+  // nobody to type a password, and `sudo -v` there would block on a prompt nothing
+  // will answer. Those runs still fall through to `sudo -n`, fail, and get the
+  // exact commands to run — which is the right outcome for an unattended machine.
+  // `primeElevation()` is itself a no-op when already root or NOPASSWD.
+  if (interactive()) prime();
+
+  const result = await install();
+  if (!result.installed) {
     return {
       ok: false,
       lines: [
-        ...lines,
-        `failproofaid was restarted but did not come back up. \`${daemonStatusCommand()}\` will say why.`,
-        `On a machine configured to require it, every tool call denies until it does.`,
+        `failproofaid ${version} could not be installed: ${result.reason ?? "unknown reason"}`,
+        `The previous daemon is untouched. On a machine configured to require it,`,
+        `enforcement continues; collection and cloud policy may be stale until this`,
+        `succeeds. \`${daemonStatusCommand() ?? "systemctl status"}\` will say more.`,
       ],
     };
   }
-  return { ok: true, lines: [...lines, `failproofaid restarted and running.`] };
+  // RECORD THE VERSION, or the refresh is invisible to everything that asks.
+  //
+  // `installDaemonService()` deliberately does not write it — only the wizard did
+  // (`setDaemonConfigured(true, cliVersion)`), because that is where "this machine
+  // is now configured, at this version" is decided. So without this line the new
+  // binary runs while `VERSION.daemon` still names the old one, and
+  // `daemonVersionSkew()` reads that file: every later CLI command keeps nudging
+  // about a stale daemon that was just replaced, and the wizard's `daemonMaybeUp`
+  // stays false on the skew it should no longer see — so a later `failproofai
+  // config` would tear down and rebuild a perfectly current service.
+  //
+  // `writeVersionFile` rather than `setDaemonConfigured(true, …)`: that helper also
+  // sets `daemon.configured`, and turning on fail-closed enforcement as a SIDE
+  // EFFECT of an update is not this command's decision to make. An update refreshes
+  // what is installed; it does not change whether the machine requires it.
+  writeVersionFile({ daemon: version });
+  return {
+    ok: true,
+    lines: [`failproofaid ${version} installed, service restarted and holding.`],
+  };
 }
 
 export async function uninstallDaemonService(): Promise<void> {

package/src/hooks/fp-reset.ts

@@ -207,6 +207,22 @@ export function migrateConventionPolicies(): string[] {
       // the same rule, one level down.
       if (entry.isDirectory() && statSync(target).isDirectory()) {
         mergeInto(source, target, `${name}/`);
+        // AND remove the child once the recursion drained it. Without this, a
+        // merged directory leaves an empty husk behind, so the `rmdirSync(from)`
+        // below throws ENOTEMPTY into a swallowing `catch` and
+        // `custom-policies/` survives the migration it just completed —
+        // permanently, because the next run recurses into the same empty child
+        // and fails the same way, so it never self-heals.
+        //
+        // Only reachable when the merge moved EVERYTHING: a genuine leaf
+        // collision inside leaves a file here, `rmdirSync` refuses, and the
+        // catch is then correct — that husk is the user's remaining source,
+        // which is the one thing this function must not delete.
+        try {
+          rmdirSync(source);
+        } catch {
+          // Not empty, so something was deliberately left. Keep it.
+        }
       }
     }
   };

package/src/hooks/harness-cli.ts

@@ -35,6 +35,8 @@
  * running daemon never picks up.
  */
 
+import { homedir } from "node:os";
+import { resolve } from "node:path";
 import { readConfig, updateConfig } from "./fp-config";
 import { configFile } from "./fp-home";
 
@@ -143,6 +145,55 @@ const TAKES_EFFECT_HINT = [
   "The daemon picks this up on its own within a few seconds — no restart, no sudo.",
 ];
 
+/**
+ * The daemon's label rule, FOR COMPARISON ONLY.
+ *
+ * Mirrors `sanitize_label()` in `crates/fpai-collect/src/extra_paths.rs`:
+ * lowercase, every non-alphanumeric run collapsed to one `-`, leading and
+ * trailing dashes trimmed.
+ *
+ * Deliberately NOT used to rewrite what is stored. The daemon is the authority on
+ * the grammar, and this file's header is explicit that it must not re-implement
+ * the parser — "two parsers is how the CLI comes to accept a path the daemon then
+ * silently drops". Normalising for a duplicate CHECK is the narrow opposite of
+ * that: it makes the CLI's own pre-flight agree with the rule it exists to
+ * pre-empt, while the stored string stays exactly what the user typed and the
+ * daemon still derives the real label.
+ */
+function comparableLabel(raw: string): string {
+  return raw
+    .toLowerCase()
+    .replace(/[^a-z0-9]+/g, "-")
+    .replace(/^-+|-+$/g, "");
+}
+
+/**
+ * The daemon's path rule, for comparison only. Mirrors `clean()`: `~/` expanded,
+ * trailing slashes trimmed.
+ */
+function comparablePath(raw: string): string {
+  const home = homedir();
+  const expanded = raw === "~" ? home : raw.startsWith("~/") ? resolve(home, raw.slice(2)) : raw;
+  return expanded.replace(/\/+$/, "");
+}
+
+/**
+ * What the daemon will call this entry, label given or derived.
+ *
+ * Mirrors `derive_label()` for the unlabelled case: the folder name with a leading
+ * dot stripped, then sanitised. Without this an unlabelled
+ * `/mnt/team-a/.claude/projects` and `/mnt/team-b/.claude/projects` both derive
+ * "projects" — the CLI's label check was skipped entirely for unlabelled entries,
+ * so both were written and the daemon silently dropped the second.
+ */
+function effectiveLabel(entry: string): string {
+  const given = labelOf(entry);
+  if (given) return comparableLabel(given);
+  const path = comparablePath(pathOf(entry));
+  const base = path.split("/").filter(Boolean).pop() ?? "";
+  return comparableLabel(base.replace(/^\.+/, ""));
+}
+
 export function addPath(harness: string, entry: string): HarnessResult {
   if (!(HARNESS_KEYS as readonly string[]).includes(harness)) return unknownHarness(harness);
   const trimmed = entry.trim();
@@ -163,7 +214,11 @@ export function addPath(harness: string, entry: string): HarnessResult {
   // Both are rejected HERE rather than left to the daemon, because the daemon
   // resolves them at startup and drops one — so the CLI would report success
   // for a path that is never captured.
-  const samePath = existing.find((e) => pathOf(e) === pathOf(trimmed));
+  // Compared NORMALISED, not raw. `add-path claude a=/srv/x/` then
+  // `add-path claude b=/srv/x` differ as strings and are the same path to the
+  // daemon, which resolves them at startup and drops one — so the CLI reported
+  // success for a path that is never captured.
+  const samePath = existing.find((e) => comparablePath(pathOf(e)) === comparablePath(pathOf(trimmed)));
   if (samePath) {
     return fail([
       `${harness} already captures ${pathOf(trimmed)} as ${JSON.stringify(samePath)}.`,
@@ -173,24 +228,46 @@ export function addPath(harness: string, entry: string): HarnessResult {
     ]);
   }
   const wanted = labelOf(trimmed);
-  if (wanted) {
-    const sameLabel = existing.find((e) => labelOf(e) === wanted);
-    if (sameLabel) {
-      return fail([
-        `${harness} already uses the label ${JSON.stringify(wanted)} for ${pathOf(sameLabel)}.`,
-        "",
-        "Labels namespace agent ids, so two paths cannot share one.",
-      ]);
-    }
+  // The EFFECTIVE label, normalised, and computed for unlabelled entries too.
+  // Three inputs slipped past the old exact-string check on the given label:
+  // `"Team Share"` vs `team-share` (the daemon lowercases and substitutes), and two
+  // unlabelled paths whose folder name derives the same label — for which the check
+  // did not run at all. In every case both entries were written, `harness list`
+  // showed both, and only one was captured.
+  const effective = effectiveLabel(trimmed);
+  const sameLabel = effective
+    ? existing.find((e) => effectiveLabel(e) === effective)
+    : undefined;
+  if (sameLabel) {
+    return fail([
+      `${harness} already uses the label ${JSON.stringify(effective)} for ${pathOf(sameLabel)}.`,
+      "",
+      "Labels namespace agent ids, so two paths cannot share one — and the daemon",
+      "lowercases them and collapses punctuation to `-`, so labels that differ only",
+      "in case or spacing collide. An unlabelled path takes its folder name.",
+      "",
+      "Give this one an explicit label:",
+      `  failproofai harness add-path ${harness} <label>=${pathOf(trimmed)}`,
+    ]);
   }
 
   writePaths(harness, [...existing, trimmed]);
   return ok([
-    `${harness}: now also capturing ${pathOf(trimmed)}`,
+    // "configured", NOT "now capturing". The checks above cover what this side can
+    // know — the entries already in the file — and there is one rejection it
+    // cannot: a path overlapping the harness's own DEFAULT capture root, which the
+    // daemon owns and refuses. Claiming capture there was a promise this command
+    // is not in a position to make, so it says what it did and where the answer
+    // is. Teaching the CLI all thirteen sources' default roots would be the second
+    // parser this file exists to avoid.
+    `${harness}: configured to also capture ${pathOf(trimmed)}`,
     wanted
       ? `  agent ids will be namespaced ${wanted}-*`
       : "  a label will be derived from the folder name; `failproofai harness list` shows it",
     `  written to ${configFile()}`,
+    "",
+    "  The daemon validates it on the next read and reports what it rejected —",
+    "  `failproofai harness list` shows what is actually being captured.",
     ...TAKES_EFFECT_HINT,
   ]);
 }

package/src/hooks/hook-activity-store.ts

@@ -388,6 +388,34 @@ export function getHookActivityHistory(page: number): {
 
 // ── Internal helpers ──
 
+/**
+ * Accept the pre-rename spelling of the two cloud-attribution fields.
+ *
+ * These pages are written by the DAEMON, so a machine that was cloud-connected
+ * before `cloudRevision`→`cloudVersion` / `cloudGeneration`→`cloudDeployment` has
+ * real rows on disk naming the old keys. Nothing here validates the shape — the
+ * line is `JSON.parse`d and cast — so those rows do not error, they simply carry
+ * keys nothing reads: every pre-upgrade cloud-decided decision renders as
+ * unattributed, which is the exact question these fields were added to answer.
+ *
+ * The Rust writer takes the same two aliases (`transform.rs`). Renaming a symbol
+ * is safe; renaming the name of data an older build already wrote is not.
+ *
+ * One-directional and non-destructive: the new key wins if both somehow appear,
+ * and the old key is left in place rather than deleted, since nothing reads it and
+ * removing it would rewrite history to look like it was always current.
+ */
+function withRenamedCloudFields(raw: Record<string, unknown>): HookActivityEntry {
+  const entry = raw as HookActivityEntry & Record<string, unknown>;
+  if (entry.cloudVersion === undefined && typeof raw.cloudRevision === "number") {
+    entry.cloudVersion = raw.cloudRevision;
+  }
+  if (entry.cloudDeployment === undefined && typeof raw.cloudGeneration === "number") {
+    entry.cloudDeployment = raw.cloudGeneration;
+  }
+  return entry;
+}
+
 function readJsonlFile(filePath: string): HookActivityEntry[] {
   const content = readFileSafe(filePath);
   if (!content.trim()) return [];
@@ -395,7 +423,7 @@ function readJsonlFile(filePath: string): HookActivityEntry[] {
   const entries: HookActivityEntry[] = [];
   for (const line of content.trim().split("\n")) {
     try {
-      entries.push(JSON.parse(line) as HookActivityEntry);
+      entries.push(withRenamedCloudFields(JSON.parse(line) as Record<string, unknown>));
     } catch {
       // Skip malformed lines
     }

package/src/hooks/migrations.ts

@@ -207,7 +207,44 @@ function appendLedger(entry: LedgerEntry): void {
  * such a bug would hurt.
  */
 const BACKED_UP = [configFile, credentialsFile, globalPolicyConfigFile, versionFile];
-const BACKED_UP_LEGACY = [legacy.configToml, legacy.credentialsToml, legacy.policyConfig];
+const BACKED_UP_LEGACY = [
+  legacy.configToml,
+  legacy.credentialsToml,
+  legacy.policyConfig,
+  // Layout 1's credentials, which the migration DELETES and which nothing
+  // regenerates. They were missing here while the carry that reads them was
+  // added, so on the layout-1 leg — the one a user upgrading from the published
+  // `latest` actually takes — the cloud token was removed with no copy kept. That
+  // is precisely the file this backup exists for, and its absence made the backup
+  // most incomplete exactly where it mattered most.
+  legacy.cloudCredentials,
+  legacy.ingestCredentials,
+];
+
+/**
+ * The files that exist right now and would be backed up, each exactly once.
+ *
+ * ONE function, because there were two: `backupBeforeMigrating` deduped by path
+ * and `describePlan` built the same list again without deduping, so
+ * `migrate --dry-run` printed `policies-config.json` TWICE while the backup
+ * correctly wrote it once. Seen on a real machine, in the one command whose
+ * entire job is to state accurately what is about to happen.
+ *
+ * The duplicate is not a typo waiting to be spotted, it is structural:
+ * `legacy.policyConfig()` and `globalPolicyConfigFile()` are the SAME path,
+ * because layout 3 put the policy config back exactly where layout 1 kept it. Any
+ * caller that walks both lists sees it twice. So the walk lives here once and
+ * nobody walks those arrays directly — which is the same "state it once, derive
+ * the rest" move `resettablePaths()` makes over `HOME_CLASSES`.
+ */
+function filesToBackUp(): string[] {
+  const seen = new Set<string>();
+  for (const at of [...BACKED_UP, ...BACKED_UP_LEGACY]) {
+    const path = at();
+    if (existsSync(path)) seen.add(path);
+  }
+  return [...seen];
+}
 
 /** Copy the irreplaceable files aside. Returns the basenames it saved. */
 export function backupBeforeMigrating(from: number): string[] {
@@ -221,16 +258,7 @@ export function backupBeforeMigrating(from: number): string[] {
   } catch {
     return [];
   }
-  // DEDUPED BY PATH. `legacy.policyConfig()` and `globalPolicyConfigFile()` are
-  // the SAME file — layout 3 put the policy config back exactly where layout 1
-  // kept it — so listing both copied it twice and printed the name twice in the
-  // "Saved first:" line the user actually reads.
-  const seen = new Set<string>();
-  for (const at of [...BACKED_UP, ...BACKED_UP_LEGACY]) {
-    const source = at();
-    if (seen.has(source)) continue;
-    seen.add(source);
-    if (!existsSync(source)) continue;
+  for (const source of filesToBackUp()) {
     try {
       copyFileSync(source, resolve(dir, basename(source)));
       saved.push(basename(source));
@@ -350,10 +378,7 @@ export function describePlan(from: number): string[] {
     ...chain.map((m) => `  ${m.from} → ${m.to}  ${m.describe}`),
     ``,
     `These would be copied to ${migrationBackupDir(from)} first:`,
-    ...[...BACKED_UP, ...BACKED_UP_LEGACY]
-      .map((at) => at())
-      .filter((p) => existsSync(p))
-      .map((p) => `  ${basename(p)}`),
+    ...filesToBackUp().map((p) => `  ${basename(p)}`),
     ``,
     `Settings, cloud enrolment, policy selection, your own policy files, decision`,
     `history and undelivered events are carried, not removed — see \`HOME_CLASSES\`.`,

package/src/hooks/tui.ts

@@ -68,6 +68,22 @@ export interface MultiChoice<T> {
 export interface MultiSelectOptions<T> {
   /** Offer ← to go back a step. The caller must handle `BACK`. */
   allowBack?: boolean;
+  /**
+   * Called with what was ticked at the moment ← was pressed.
+   *
+   * `BACK` is a symbol, so it cannot carry a value, and the selection lives in a
+   * local array here rather than on the caller's choice objects — so a caller had
+   * no way to learn what a user had toggled before stepping back. The wizard's
+   * harness step needs exactly that: without it, deselecting a CLI and pressing ←
+   * discards the deselection, the step is redrawn from the detected defaults, and
+   * confirming re-enables hook installation for a CLI the user explicitly turned
+   * off.
+   *
+   * OPTIONAL and additive rather than a change to the return type: `BACK` is
+   * shared with `selectOne` and every other caller, and widening that contract to
+   * fix one step's state would be a much larger surface than the bug.
+   */
+  onBack?: (checkedNow: T[]) => void;
   message: string;
   choices: MultiChoice<T>[];
   minSelected?: number;
@@ -429,6 +445,8 @@ interface PromptSpec<R> {
   warnLine?: () => string | null;
   /** When set, ← resolves `BACK` so the caller can step backwards. */
   allowBack?: boolean;
+  /** Called just before ← resolves, so a caller can keep in-progress state. */
+  onBack?: () => void;
   footer: string;
   /** Handle non-navigation keys. `{done}` finishes, `"redraw"` repaints. */
   onKey: (key: readline.Key, cursor: number) => { done: R } | "redraw" | undefined;
@@ -520,6 +538,11 @@ function runPrompt<R>(p: PromptSpec<R>): Promise<R | null> {
       } else if (key.name === "left" && p.allowBack) {
         // Only when the caller opted in. A prompt with nowhere to go back TO
         // must not appear to offer it.
+        //
+        // Reported BEFORE finishing, because `finish` collapses the prompt and
+        // resolves — after that the selection is gone and the caller is already
+        // running.
+        p.onBack?.();
         finish(BACK as unknown as never);
       } else if (key.name === "up") {
         cursor = cursor > 0 ? cursor - 1 : choices.length - 1;
@@ -648,6 +671,11 @@ export function multiSelect<T>(opts: MultiSelectOptions<T>): Promise<T[] | null
     },
     warnLine: () => (warn ? c.warn(`Select at least ${minSelected}.`) : null),
     allowBack: opts.allowBack,
+    // Reads the SAME `checked` array the prompt is driving, so what the caller
+    // learns is exactly what was on screen when ← was pressed.
+    onBack: opts.onBack
+      ? () => opts.onBack?.(choices.filter((_, i) => checked[i]).map((ch) => ch.value))
+      : undefined,
     footer:
       opts.hint ??
       (opts.allowBack