failproofai 1.0.0-beta.2 → 1.0.0-beta.20

package/.next/standalone/app/api/audit/status/route.ts

@@ -8,6 +8,7 @@
  */
 import { NextResponse } from "next/server";
 import { readDashboardCache } from "@/src/audit/dashboard-cache";
+import { readActiveAuditLock } from "@/src/audit/audit-lock";
 import { getRunState } from "../_state";
 
 export const dynamic = "force-dynamic";
@@ -15,8 +16,19 @@ export const dynamic = "force-dynamic";
 export async function GET(): Promise<NextResponse> {
   const state = getRunState();
   const cache = readDashboardCache();
+  // `running` must answer "is a scan running on this MACHINE", not just "in this
+  // process". The in-memory state only sees dashboard-initiated runs; a
+  // scheduled daemon child or a `failproofai audit` writes the same cache from
+  // another process and holds the cross-process lock instead. Fold that in so a
+  // client polling after a 409 (or the settings page on mount) sees the machine
+  // as busy and waits it out, rather than reading idle and clobbering a live
+  // scan's cache. `readActiveAuditLock` applies the same dead-pid/age staleness
+  // rules as acquire, so a crashed run's leftover lockfile never wedges this at
+  // "running" forever.
+  const externalLock = readActiveAuditLock();
+  const externallyRunning = externalLock !== null && externalLock.pid !== process.pid;
   return NextResponse.json({
-    running: state.running,
+    running: state.running || externallyRunning,
     startedAt: state.startedAt ?? null,
     cachedAt: cache?.cachedAt ?? null,
     error: state.error,

package/.next/standalone/app/api/auth/status/route.ts

@@ -3,7 +3,7 @@
  *
  * Returns the currently signed-in identity by reading the local
  * `~/.failproofai/auth.json` cache. No round-trip to the api-server — the
- * file is the source of truth, same as the CLI's `failproofai auth whoami`.
+ * file is the source of truth for who is signed in on this machine.
  * This keeps the dashboard UI and the CLI consistent regardless of whether
  * the api-server is reachable.
  *

package/.next/standalone/app/audit/_components/audit-dashboard.tsx

@@ -14,7 +14,7 @@
  *
  * Empty / running states fall back to EmptyState and RunProgress.
  */
-import React, { useCallback, useEffect, useMemo, useRef, useState } from "react";
+import { useCallback, useEffect, useMemo, useRef, useState } from "react";
 import { getAuditResultAction } from "@/app/actions/get-audit-result";
 import type { AuditResult, RunAuditOptions } from "@/src/audit/types";
 import { classifyAgent } from "@/src/audit/archetypes";
@@ -227,8 +227,6 @@ export function AuditDashboard({ initial, projectFromUrl, totalCatalogSize }: Pr
   const result = cache.status === "cached" ? cache.result : null;
   if (!result) return null;
   const cachedAt = cache.status === "cached" ? cache.cachedAt : null;
-  const params = cache.status === "cached" ? cache.params : undefined;
-
   /* ---- scanned but zero sessions --------------------------------- */
   if (result.transcripts.scanned === 0) {
     return (

package/.next/standalone/app/audit/_components/audit-progress-strip.tsx

@@ -15,7 +15,7 @@
  * Reuses the existing `RerunError.kind` discrimination to render a red
  * error strip with kind-specific copy when a run dies.
  */
-import React, { useEffect, useState } from "react";
+import { useEffect, useState } from "react";
 import type { RerunError } from "./rerun-button";
 
 export type RerunStatus =

package/.next/standalone/app/audit/_components/auth-dialog.css

@@ -0,0 +1,159 @@
+/* Styles for <AuthDialog> — co-located with the component and imported by it,
+ * NOT living in a route stylesheet.
+ *
+ * Why here: the dialog was first used only on /audit, so these rules used to sit
+ * in audit-styles.css (route-scoped to /audit). The /settings page reuses the
+ * same component to lead a signed-out user into the existing OTP login flow, and
+ * a route stylesheet would not load there — the modal would render unstyled.
+ * Importing this file from auth-dialog.tsx makes the CSS travel with the
+ * component to every route that renders it. Every var below is defined in
+ * globals.css :root, so it resolves anywhere.
+ */
+
+.auth-dialog-backdrop {
+  position: fixed; inset: 0; z-index: 10000;
+  display: grid; place-items: center;
+  padding: 32px 16px;
+  background: rgba(8,8,10,0.7);
+  backdrop-filter: blur(6px);
+  -webkit-backdrop-filter: blur(6px);
+}
+
+.auth-dialog {
+  position: relative;
+  width: 100%;
+  max-width: 420px;
+  padding: 28px 28px 24px;
+  border: 1px solid var(--line-2);
+  background: var(--bg-2);
+  font-family: var(--font-mono);
+  color: var(--ink);
+}
+
+.auth-close {
+  position: absolute; top: 12px; right: 14px;
+  font-family: var(--font-mono); font-size: 20px;
+  line-height: 1;
+  color: var(--dim);
+  background: transparent; border: none; padding: 4px 8px;
+  cursor: pointer;
+  transition: color 120ms;
+}
+.auth-close:hover { color: var(--accent-pink); }
+.auth-close:disabled { color: var(--line-2); cursor: not-allowed; }
+
+.auth-headline {
+  font-family: var(--font-mono);
+  font-size: 18px;
+  font-weight: 600;
+  letter-spacing: 0;
+  line-height: 1.3;
+  text-transform: none;
+  color: var(--ink);
+  margin: 0 0 8px;
+}
+
+.auth-sub {
+  font-family: var(--font-mono); font-size: 12px;
+  line-height: 1.55; color: var(--ink-2);
+  margin: 0 0 18px;
+}
+.auth-sub .auth-email {
+  color: var(--accent-pink);
+}
+.auth-sub .auth-ok {
+  color: var(--accent-green);
+  margin-right: 6px;
+}
+
+.auth-form { display: flex; flex-direction: column; gap: 10px; }
+
+.auth-field-label {
+  font-family: var(--font-mono); font-size: 10px;
+  letter-spacing: 0.22em; text-transform: uppercase;
+  color: var(--accent-green);
+}
+
+.auth-input {
+  width: 100%;
+  padding: 11px 14px;
+  background: var(--bg);
+  border: 1px solid var(--line-2);
+  color: var(--ink);
+  font-family: var(--font-mono); font-size: 14px;
+  letter-spacing: 0.03em;
+  outline: none;
+  transition: border-color 120ms, box-shadow 120ms;
+}
+.auth-input:focus {
+  border-color: var(--accent-pink);
+  box-shadow: 0 0 0 1px var(--accent-pink-soft);
+}
+.auth-input:disabled {
+  opacity: 0.55; cursor: not-allowed;
+}
+.auth-input-code {
+  letter-spacing: 0.5em;
+  text-align: center;
+  font-size: 18px;
+  font-variant-numeric: tabular-nums;
+}
+.auth-input::placeholder { color: var(--dim); }
+
+.auth-error {
+  font-family: var(--font-mono); font-size: 12px;
+  color: var(--accent-pink);
+  padding: 8px 12px;
+  background: var(--accent-pink-bg);
+  border: 1px solid var(--accent-pink);
+  border-left-width: 3px;
+  letter-spacing: 0.02em;
+  margin-top: 4px;
+}
+
+.auth-actions {
+  display: flex; gap: 10px; flex-wrap: wrap;
+  margin-top: 14px;
+}
+
+.auth-btn {
+  display: inline-flex; align-items: center; gap: 8px;
+  padding: 10px 16px;
+  font-family: var(--font-mono); font-size: 12px;
+  letter-spacing: 0.06em;
+  background: transparent;
+  border: 1px solid var(--line-2);
+  color: var(--ink);
+  cursor: pointer;
+  transition: all 120ms ease;
+}
+.auth-btn:hover:not(:disabled) {
+  border-color: var(--ink); background: rgba(255,255,255,0.04);
+}
+.auth-btn:disabled { opacity: 0.45; cursor: not-allowed; }
+.auth-btn.primary {
+  border-color: var(--accent-pink);
+  color: var(--accent-pink);
+  background: var(--accent-pink-bg);
+}
+.auth-btn.primary:hover:not(:disabled) {
+  background: var(--accent-pink); color: var(--bg);
+}
+
+.auth-back {
+  align-self: flex-start;
+  margin-top: 4px;
+  background: transparent; border: none; padding: 6px 0;
+  font-family: var(--font-mono); font-size: 11px;
+  letter-spacing: 0.1em; color: var(--dim);
+  cursor: pointer;
+  transition: color 120ms;
+}
+.auth-back:hover:not(:disabled) { color: var(--ink-2); }
+.auth-back:disabled { opacity: 0.45; cursor: not-allowed; }
+
+@media (max-width: 520px) {
+  .auth-dialog { padding: 26px 22px 22px; }
+  .auth-actions { flex-direction: column; align-items: stretch; }
+  .auth-btn { justify-content: center; }
+}

package/.next/standalone/app/audit/_components/auth-dialog.tsx

@@ -16,6 +16,9 @@
 import React, { useCallback, useEffect, useRef, useState } from "react";
 import { usePostHog } from "@/contexts/PostHogContext";
 import { fetchWithTimeout, isAbortError } from "@/lib/fetch-with-timeout";
+// Co-located so the dialog is styled on EVERY route that renders it (/audit and
+// /settings), not only the one route stylesheet these rules used to live in.
+import "./auth-dialog.css";
 
 export interface AuthedUser {
   id: string;

package/.next/standalone/app/audit/_components/come-back-better-section.tsx

@@ -18,7 +18,7 @@
  * link sits under the reminder card so the affordance survives without
  * dominating the layout.
  */
-import React, { useCallback, useEffect, useRef, useState } from "react";
+import { useCallback, useEffect, useRef, useState } from "react";
 import { usePostHog } from "@/contexts/PostHogContext";
 import { isAbortError } from "@/lib/fetch-with-timeout";
 import { AuthDialog, type AuthedUser } from "./auth-dialog";

package/.next/standalone/app/audit/_components/empty-state.tsx

@@ -12,7 +12,6 @@
  * sharp `.btn-press` action button. Sized so it occupies the same vertical
  * space as the loaded dashboard does on its hero — no more cramped popover.
  */
-import React from "react";
 import { triggerRun } from "./rerun-button";
 import { usePostHog } from "@/contexts/PostHogContext";
 

package/.next/standalone/app/audit/_components/how-to-improve-section.tsx

@@ -10,7 +10,7 @@
  * A single "install all" button at the section header copies the
  * combined install command for every prescribed policy.
  */
-import React, { useMemo, useState } from "react";
+import { useMemo, useState } from "react";
 import type { AuditResult } from "@/src/audit/types";
 import { type Grade, tierName } from "@/src/audit/scoring";
 import { usePostHog } from "@/contexts/PostHogContext";

package/.next/standalone/app/audit/_components/quirks-section.tsx

@@ -8,7 +8,6 @@
  * detector. No per-finding card chrome, no 4-quad body, no corner
  * crosshairs — evidence and fix live in section 04 (How to improve).
  */
-import React from "react";
 import type { FindingCard } from "@/src/audit/findings";
 
 interface Props {

package/.next/standalone/app/audit/_components/report-footer.tsx

@@ -1,7 +1,5 @@
 "use client";
 
-import React from "react";
-
 interface Props {
   cachedAt: string | null;
   fixed?: boolean;

package/.next/standalone/app/audit/_components/run-progress.tsx

@@ -16,7 +16,7 @@
  * pink "▮▮" / dim "○" markers, and a marquee progress bar at the bottom
  * filling pink-on-dark as the run advances.
  */
-import React, { useEffect, useState } from "react";
+import { useEffect, useState } from "react";
 
 const STAGES = [
   { label: "discovering transcripts", detail: "walking ~/.claude, ~/.codex, ~/.cursor, …" },

package/.next/standalone/app/audit/_components/strengths-section.tsx

@@ -5,7 +5,6 @@
  * ✓ glyph · headline + sub · right-aligned metric. No card chrome,
  * no hover backgrounds, no checkmark backdrop.
  */
-import React from "react";
 import type { Strength } from "@/src/audit/strengths";
 
 interface Props {

package/.next/standalone/app/audit/audit-styles.css

@@ -255,155 +255,12 @@
   margin-right: 6px;
 }
 
-/* ───────────────────────── auth dialog (set-a-reminder gate) ───────────────────────── */
-
-.auth-dialog-backdrop {
-  position: fixed; inset: 0; z-index: 10000;
-  display: grid; place-items: center;
-  padding: 32px 16px;
-  background: rgba(8,8,10,0.7);
-  backdrop-filter: blur(6px);
-  -webkit-backdrop-filter: blur(6px);
-}
-
-.auth-dialog {
-  position: relative;
-  width: 100%;
-  max-width: 420px;
-  padding: 28px 28px 24px;
-  border: 1px solid var(--line-2);
-  background: var(--bg-2);
-  font-family: var(--font-mono);
-  color: var(--ink);
-}
-
-.auth-close {
-  position: absolute; top: 12px; right: 14px;
-  font-family: var(--font-mono); font-size: 20px;
-  line-height: 1;
-  color: var(--dim);
-  background: transparent; border: none; padding: 4px 8px;
-  cursor: pointer;
-  transition: color 120ms;
-}
-.auth-close:hover { color: var(--accent-pink); }
-.auth-close:disabled { color: var(--line-2); cursor: not-allowed; }
-
-.auth-headline {
-  font-family: var(--font-mono);
-  font-size: 18px;
-  font-weight: 600;
-  letter-spacing: 0;
-  line-height: 1.3;
-  text-transform: none;
-  color: var(--ink);
-  margin: 0 0 8px;
-}
-
-.auth-sub {
-  font-family: var(--font-mono); font-size: 12px;
-  line-height: 1.55; color: var(--ink-2);
-  margin: 0 0 18px;
-}
-.auth-sub .auth-email {
-  color: var(--accent-pink);
-}
-.auth-sub .auth-ok {
-  color: var(--accent-green);
-  margin-right: 6px;
-}
-
-.auth-form { display: flex; flex-direction: column; gap: 10px; }
-
-.auth-field-label {
-  font-family: var(--font-mono); font-size: 10px;
-  letter-spacing: 0.22em; text-transform: uppercase;
-  color: var(--accent-green);
-}
-
-.auth-input {
-  width: 100%;
-  padding: 11px 14px;
-  background: var(--bg);
-  border: 1px solid var(--line-2);
-  color: var(--ink);
-  font-family: var(--font-mono); font-size: 14px;
-  letter-spacing: 0.03em;
-  outline: none;
-  transition: border-color 120ms, box-shadow 120ms;
-}
-.auth-input:focus {
-  border-color: var(--accent-pink);
-  box-shadow: 0 0 0 1px var(--accent-pink-soft);
-}
-.auth-input:disabled {
-  opacity: 0.55; cursor: not-allowed;
-}
-.auth-input-code {
-  letter-spacing: 0.5em;
-  text-align: center;
-  font-size: 18px;
-  font-variant-numeric: tabular-nums;
-}
-.auth-input::placeholder { color: var(--dim); }
-
-.auth-error {
-  font-family: var(--font-mono); font-size: 12px;
-  color: var(--accent-pink);
-  padding: 8px 12px;
-  background: var(--accent-pink-bg);
-  border: 1px solid var(--accent-pink);
-  border-left-width: 3px;
-  letter-spacing: 0.02em;
-  margin-top: 4px;
-}
-
-.auth-actions {
-  display: flex; gap: 10px; flex-wrap: wrap;
-  margin-top: 14px;
-}
-
-.auth-btn {
-  display: inline-flex; align-items: center; gap: 8px;
-  padding: 10px 16px;
-  font-family: var(--font-mono); font-size: 12px;
-  letter-spacing: 0.06em;
-  background: transparent;
-  border: 1px solid var(--line-2);
-  color: var(--ink);
-  cursor: pointer;
-  transition: all 120ms ease;
-}
-.auth-btn:hover:not(:disabled) {
-  border-color: var(--ink); background: rgba(255,255,255,0.04);
-}
-.auth-btn:disabled { opacity: 0.45; cursor: not-allowed; }
-.auth-btn.primary {
-  border-color: var(--accent-pink);
-  color: var(--accent-pink);
-  background: var(--accent-pink-bg);
-}
-.auth-btn.primary:hover:not(:disabled) {
-  background: var(--accent-pink); color: var(--bg);
-}
-
-.auth-back {
-  align-self: flex-start;
-  margin-top: 4px;
-  background: transparent; border: none; padding: 6px 0;
-  font-family: var(--font-mono); font-size: 11px;
-  letter-spacing: 0.1em; color: var(--dim);
-  cursor: pointer;
-  transition: color 120ms;
-}
-.auth-back:hover:not(:disabled) { color: var(--ink-2); }
-.auth-back:disabled { opacity: 0.45; cursor: not-allowed; }
-
-@media (max-width: 520px) {
-  .auth-dialog { padding: 26px 22px 22px; }
-  .auth-actions { flex-direction: column; align-items: stretch; }
-  .auth-btn { justify-content: center; }
-}
+/* ───────────────────────── auth dialog (set-a-reminder gate) ─────────────────────────
+ * The dialog's own styles moved to app/audit/_components/auth-dialog.css, which
+ * <AuthDialog> imports directly, so the modal is styled on every route that
+ * renders it (/audit and now /settings) rather than only this route stylesheet.
+ * The `.auth-status-pill` below stays here — it belongs to the /audit return
+ * CTA (come-back-better-section), not the dialog. */
 
 /* status pill in the return CTA: shows current logged-in email */
 .auth-status-pill {

package/.next/standalone/app/components/pause-notices.tsx

@@ -0,0 +1,111 @@
+"use client";
+
+/**
+ * The dashboard's rendering of a paused machine.
+ *
+ * Split out of `hooks-client.tsx` because these are the pieces that keep the
+ * activity view honest: a row evaluated during a pause looks identical to one
+ * where every policy ran and allowed, and without saying so the log asserts a
+ * clean window over exactly the window that was not enforced.
+ */
+import { useEffect, useState } from "react";
+import { ShieldAlert, TriangleAlert } from "lucide-react";
+import type { ActivePause } from "@/src/hooks/session-pause";
+
+/** Compact "time left" for a future timestamp. */
+export function formatRemaining(ms: number): string {
+  if (ms <= 0) return "expiring now";
+  // Sub-minute is checked before rounding: Math.round(30s) is "1m", which tells
+  // someone they have more time than they do. On a countdown to enforcement
+  // coming back, never round up.
+  if (ms < 60_000) return "under a minute";
+  const minutes = Math.round(ms / 60_000);
+  if (minutes < 60) return `${minutes}m`;
+  const hours = Math.floor(minutes / 60);
+  const rest = minutes % 60;
+  return rest === 0 ? `${hours}h` : `${hours}h${rest}m`;
+}
+
+/**
+ * Live state, not history: enforcement is paused RIGHT NOW.
+ *
+ * The rows below cannot carry this on their own — a pause set seconds ago has
+ * produced none yet, and that is precisely when someone needs telling that the
+ * machine is unguarded. An absent banner has to mean "enforcing", so this is fed
+ * from live pause state rather than inferred from whatever is on screen.
+ */
+export function PausedBanner({ pauses, now: nowProp }: { pauses: ActivePause[]; now?: number }) {
+  const [tick, setTick] = useState(() => Date.now());
+  // Re-render on a timer so "22m left" does not sit frozen while the pause
+  // silently drains away.
+  useEffect(() => {
+    const id = setInterval(() => setTick(Date.now()), 30_000);
+    return () => clearInterval(id);
+  }, []);
+  const now = nowProp ?? tick;
+
+  // Filter again here rather than trusting the fetch: the list was accurate
+  // when it arrived, and a short pause can expire between polls.
+  const live = pauses.filter((p) => p.expiresAt > now);
+  if (live.length === 0) return null;
+  const soonest = live.reduce((a, b) => (a.expiresAt < b.expiresAt ? a : b));
+
+  return (
+    <div
+      role="status"
+      className="mb-4 flex items-start gap-2.5 rounded border border-amber-500/40 bg-amber-500/[0.07] px-3 py-2.5"
+    >
+      <ShieldAlert className="h-4 w-4 shrink-0 text-amber-500 mt-0.5" aria-hidden="true" />
+      <div className="text-xs leading-relaxed">
+        <p className="font-medium text-foreground">
+          Enforcement is paused for {live.length} session{live.length === 1 ? "" : "s"} —{" "}
+          {formatRemaining(soonest.expiresAt - now)} left
+          {live.length > 1 ? " on the next to expire" : ""}.
+        </p>
+        <p className="text-muted-foreground mt-0.5">
+          Builtin, custom and convention policies are suspended for{" "}
+          {live.length === 1 ? "that session" : "those sessions"}; cloud-managed policies keep
+          enforcing. It lifts on its own — or run{" "}
+          <span className="font-mono text-foreground">failproofai config --resume</span>.
+        </p>
+      </div>
+    </div>
+  );
+}
+
+/** Marks a row that was evaluated while enforcement was paused. */
+export function PausedPill() {
+  return (
+    <span
+      title="Enforcement was paused for this session — local policies did not run"
+      className="ml-1.5 inline-flex items-center rounded px-1.5 py-0.5 text-[0.6rem] font-medium uppercase tracking-wide border border-amber-500/40 bg-amber-500/10 text-amber-600 dark:text-amber-500"
+    >
+      paused
+    </span>
+  );
+}
+
+/** Why an `allow` on this row proves nothing. */
+export function PausedNote({
+  item,
+}: {
+  item: { pausedBy?: string; pauseExpiresAt?: number };
+}) {
+  if (!item.pausedBy) return null;
+  const lifted =
+    typeof item.pauseExpiresAt === "number"
+      ? new Date(item.pauseExpiresAt).toLocaleTimeString()
+      : null;
+  return (
+    <div className="sm:col-span-2 lg:col-span-3 mt-1 flex items-start gap-2 rounded border border-amber-500/30 bg-amber-500/5 px-2.5 py-2">
+      <TriangleAlert className="h-3.5 w-3.5 shrink-0 text-amber-500/80 mt-0.5" aria-hidden="true" />
+      <p className="text-[0.7rem] leading-relaxed text-muted-foreground">
+        <span className="font-medium text-foreground">Not enforced — paused.</span> Enforcement was
+        suspended for this session
+        {item.pausedBy === "cli" ? " from the CLI" : ` by ${item.pausedBy}`}
+        {lifted ? `, lifting at ${lifted}` : ""}. Builtin, custom and convention policies did not
+        run for this event; cloud-managed policies did.
+      </p>
+    </div>
+  );
+}

package/.next/standalone/app/components/raw-log-viewer.tsx

@@ -5,7 +5,7 @@
  */
 "use client";
 
-import React, { useCallback, useEffect, useLayoutEffect, useMemo, useRef, useState } from "react";
+import { useCallback, useEffect, useLayoutEffect, useMemo, useRef, useState } from "react";
 import { useWindowVirtualizer } from "@tanstack/react-virtual";
 import { ChevronDown, Wrench } from "lucide-react";
 import type { LogEntry, ToolUseBlock } from "@/lib/log-entries";

package/.next/standalone/app/components/toast.tsx

@@ -1,6 +1,6 @@
 "use client";
 
-import { useSyncExternalStore, useCallback, useEffect, useState } from "react";
+import { useSyncExternalStore, useEffect, useState } from "react";
 
 interface Toast {
   id: number;