failproofai 1.0.0-beta.2 → 1.0.0-beta.21

package/lib/auth/api-server-client.ts

@@ -1,9 +1,8 @@
 /**
  * Low-level HTTP client for the FailproofAI api-server's /v0/auth/* endpoints.
  *
- * Shared by both the CLI (failproofai auth ...) and the dashboard's Next.js
- * API route proxies. Has no filesystem access — token persistence lives in
- * `./auth-store.ts`.
+ * Used by the dashboard's Next.js API route proxies. Has no filesystem access
+ * — token persistence lives in `./auth-store.ts`.
  *
  * The base URL is resolved from FAILPROOF_API_URL (preferred) or the legacy
  * FAILPROOFAI_API_URL, falling back to the hosted api-server. Local-dev

package/lib/auth/auth-store.ts

@@ -2,16 +2,15 @@
  * Persistence layer for the FailproofAI auth.json file.
  *
  * Tokens live at ~/.failproofai/auth.json with mode 0600. The dashboard's
- * Next.js API routes and the CLI both read/write through here so the user's
- * session survives across `failproofai` (dashboard) and `failproofai auth`
- * (CLI) invocations.
+ * Next.js API routes read and write through here, so a session survives across
+ * dashboard runs.
  */
 
 import { existsSync, readFileSync, rmSync } from "node:fs";
-import { homedir } from "node:os";
 import { join } from "node:path";
 
 import { writeJsonAtomically } from "../atomic-write";
+import { failproofaiHome } from "../../src/hooks/fp-home";
 import {
   AuthApiError,
   decodeJwt,
@@ -31,7 +30,7 @@ export interface StoredAuth {
 export function getAuthDir(): string {
   const override = process.env.FAILPROOFAI_AUTH_DIR;
   if (override) return override;
-  return join(homedir(), ".failproofai");
+  return failproofaiHome();
 }
 
 export function getAuthFilePath(): string {

package/lib/codex-sessions.ts

@@ -33,10 +33,11 @@ import {
   type LogSource,
 } from "./log-entries";
 import { formatDuration } from "./format-duration";
+import { codexSessionPathsFile } from "../src/hooks/fp-home";
 
 // ── Transcript discovery ──
 
-const CACHE_PATH = join(homedir(), ".failproofai", "cache", "codex-session-paths.json");
+const CACHE_PATH = codexSessionPathsFile();
 
 function readCache(): Record<string, string> {
   try {

package/lib/dashboard-host.ts

@@ -0,0 +1,101 @@
+/**
+ * Where the local dashboard binds, and which `Host` headers it will answer to.
+ *
+ * Shared by `scripts/launch.ts` (which chooses the bind address) and `proxy.ts`
+ * (which enforces it per request), because the two drifting apart is exactly how
+ * a lockdown quietly stops working.
+ *
+ * ## Why this exists
+ *
+ * The dashboard is a WRITE surface for this machine's security configuration —
+ * it can toggle policies and uninstall failproofai's hooks from every agent CLI
+ * — and it has no authentication of any kind. It used to bind `0.0.0.0`
+ * unconditionally, so every peer on the network could do all of that.
+ *
+ * Binding loopback is necessary but NOT sufficient. A malicious page can still
+ * reach `http://localhost:8020` from the victim's own browser, and DNS
+ * rebinding (a domain that resolves to 127.0.0.1 after first load) defeats an
+ * `Origin === Host` comparison, because both then read as the attacker's
+ * domain. So the defence is three layers, and all three are load-bearing:
+ *
+ *   1. bind loopback by default (kills every off-machine caller);
+ *   2. answer only to a loopback `Host` (kills DNS rebinding, whose whole trick
+ *      is arriving with an attacker-controlled Host);
+ *   3. reject cross-origin mutating requests by `Origin` (kills the ordinary
+ *      drive-by, which arrives with a perfectly valid `Host: localhost:8020`
+ *      and an `Origin` of the attacker's site).
+ *
+ * Layer 2 is what makes layer 3 trustworthy: without it, a rebound page is
+ * same-origin by the browser's own reckoning and layer 3 waves it through.
+ */
+
+/** The default bind address. Loopback — never the wildcard. */
+export const DEFAULT_DASHBOARD_HOST = "127.0.0.1";
+
+/**
+ * Hostnames that mean "this machine". `[::1]` is the bracketed form as it
+ * appears in a `Host` header; `::1` is the bare form as it appears in a bind
+ * address.
+ */
+const LOOPBACK_HOSTNAMES = new Set(["localhost", "127.0.0.1", "::1", "[::1]", "0:0:0:0:0:0:0:1"]);
+
+/**
+ * True for any address that only this machine can reach.
+ *
+ * The whole 127.0.0.0/8 block is loopback, not just 127.0.0.1 — some setups
+ * bind 127.0.0.2 to separate services, and treating that as external would
+ * refuse a request the user deliberately arranged.
+ */
+export function isLoopbackHostname(hostname: string): boolean {
+  const h = hostname.trim().toLowerCase();
+  if (!h) return false;
+  if (LOOPBACK_HOSTNAMES.has(h)) return true;
+  return /^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(h);
+}
+
+/**
+ * The hostname part of a `Host` header, with the port removed.
+ *
+ * IPv6 literals are bracketed (`[::1]:8020`), so the port cannot be found by
+ * looking for the last colon without handling the brackets first — `[::1]`
+ * is all colons.
+ */
+export function hostnameFromHostHeader(hostHeader: string): string {
+  const raw = hostHeader.trim();
+  if (raw.startsWith("[")) {
+    const end = raw.indexOf("]");
+    return end === -1 ? raw : raw.slice(0, end + 1);
+  }
+  const colon = raw.indexOf(":");
+  return colon === -1 ? raw : raw.slice(0, colon);
+}
+
+/** The hostname part of an `Origin` header (`http://localhost:8020` -> `localhost`). */
+export function hostnameFromOrigin(origin: string): string | null {
+  const raw = origin.trim();
+  // "null" is a real Origin value (sandboxed iframes, some redirects). It is
+  // never ours, so it must not parse into something permissive.
+  if (!raw || raw === "null") return null;
+  try {
+    const url = new URL(raw);
+    // `URL.hostname` KEEPS the brackets on an IPv6 literal ("[::1]"), which is
+    // already the form a Host header carries — so it passes through untouched.
+    // Bracketing it again would produce "[[::1]]" and never match anything.
+    return url.hostname || null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Resolve the bind address from an explicit flag, then the environment, then
+ * the safe default.
+ *
+ * An explicit non-loopback value is honoured — someone running the dashboard in
+ * a container or on a remote dev box has a real need — but it is a deliberate
+ * act, and `launch.ts` says so out loud when it happens.
+ */
+export function resolveDashboardHost(flagHost?: string, envHost?: string): string {
+  const chosen = (flagHost ?? envHost ?? "").trim();
+  return chosen || DEFAULT_DASHBOARD_HOST;
+}

package/lib/install-check.ts

@@ -19,10 +19,12 @@
  * real command.
  */
 import { existsSync, readFileSync, writeFileSync, mkdirSync } from "node:fs";
-import { resolve } from "node:path";
+import { dirname, resolve } from "node:path";
 import { platform, arch, release, homedir, hostname } from "node:os";
 import { createHmac } from "node:crypto";
 import { trackInstallEvent } from "../scripts/install-telemetry.mjs";
+import { isTelemetryEnabled } from "./telemetry-enabled";
+import { globalPolicyConfigFile, lastVersionFile } from "../src/hooks/fp-home";
 
 const FAILPROOFAI_HOOK_MARKER = "__failproofai_hook__";
 const NAMESPACE = "failproofai-telemetry-v1";
@@ -47,7 +49,7 @@ function hashToId(raw: string): string {
 }
 
 function lastVersionPath(): string {
-  return resolve(homedir(), ".failproofai", "last-version");
+  return lastVersionFile();
 }
 
 /**
@@ -110,7 +112,13 @@ export interface HooksState {
  * script so the event keeps its historical meaning.
  */
 export function checkHooks(): HooksState {
-  const hooksConfigPath = resolve(homedir(), ".failproofai", "policies-config.json");
+  // Layout 2's global policy config, via the one module allowed to join a path
+  // onto the home. This read `~/.failproofai/policies-config.json` — layout 1's
+  // location — so on every layout-2 machine it found nothing and reported the
+  // install as unconfigured with zero policies, which is what
+  // `package_installed` telemetry has been recording for every user since the
+  // reorganisation.
+  const hooksConfigPath = globalPolicyConfigFile();
   if (!existsSync(hooksConfigPath)) {
     return { configured: false, registered: false, policyCount: 0 };
   }
@@ -177,6 +185,13 @@ export async function maybeReportInstall(version: string): Promise<void> {
     // Steady state: same version already reported. Costs one stat() per command.
     if (previousVersion === version) return;
 
+    // The install dispatcher is a dependency-free .mjs and cannot import the
+    // TOML config, so it is told the verdict rather than resolving it. Passed
+    // per call rather than checked here, because the version marker below must
+    // still be written when telemetry is off — otherwise this whole check would
+    // re-run on every single CLI invocation, forever.
+    const telemetryEnabled = isTelemetryEnabled();
+
     const hooks = checkHooks();
 
     const events: Promise<void>[] = [];
@@ -187,7 +202,7 @@ export async function maybeReportInstall(version: string): Promise<void> {
           arch: arch(),
           os_release: release(),
           node_version: process.versions.node,
-        }, { version, timeoutMs: REPORT_TIMEOUT_MS }),
+        }, { version, timeoutMs: REPORT_TIMEOUT_MS, enabled: telemetryEnabled }),
       );
     } else {
       const cmp = compareSemver(previousVersion, version);
@@ -198,7 +213,7 @@ export async function maybeReportInstall(version: string): Promise<void> {
           direction: cmp < 0 ? "upgrade" : "downgrade",
           platform: platform(),
           arch: arch(),
-        }, { version, timeoutMs: REPORT_TIMEOUT_MS }),
+        }, { version, timeoutMs: REPORT_TIMEOUT_MS, enabled: telemetryEnabled }),
       );
     }
 
@@ -212,13 +227,13 @@ export async function maybeReportInstall(version: string): Promise<void> {
         hooks_configured: hooks.configured,
         hooks_registered: hooks.registered,
         enabled_policy_count: hooks.policyCount,
-      }, { version, timeoutMs: REPORT_TIMEOUT_MS }),
+      }, { version, timeoutMs: REPORT_TIMEOUT_MS, enabled: telemetryEnabled }),
     );
 
     // Record before awaiting: a dropped event is cheaper than re-reporting the
     // same version on every command because delivery kept failing.
     try {
-      mkdirSync(resolve(homedir(), ".failproofai"), { recursive: true });
+      mkdirSync(dirname(versionFile), { recursive: true });
       writeFileSync(versionFile, version, "utf8");
     } catch {
       // best-effort

package/lib/pi-sessions.ts

@@ -17,12 +17,33 @@
  *   {type: "message",                id, parentId, timestamp,
  *                                    message: {role, content[], timestamp}}
  *
- * `message.content[]` items can be `{type: "text", text}` or
- * `{type: "thinking", thinking, thinkingSignature}`. Tool-call blocks are not
- * yet observed in this codebase (no tool-using runs were captured during
- * Phase 0); when Pi does emit them, this parser preserves them as-is via the
- * fallback "system" branch and the test suite asserts at least the
- * round-trip rather than a specific shape.
+ * `message.content[]` items can be `{type: "text", text}`,
+ * `{type: "thinking", thinking, thinkingSignature}` or `{type: "toolCall",
+ * id, name, arguments}`.
+ *
+ * Tool calls WERE previously believed not to exist here — the header used to
+ * say no tool-using run had been captured, so `toolCall` blocks fell through
+ * to the generic "system" branch and every tool event Pi emits was silently
+ * dropped from the audit path. A live capture (pi 0.73.1 and 0.83.0, driven
+ * against a real provider) shows Pi emits them in full:
+ *
+ *   assistant turn  content[] contains {type:"toolCall", id, name, arguments}
+ *                   and the message carries stopReason:"toolUse"
+ *   tool result     its own record with a THIRD role —
+ *                   message.role === "toolResult", carrying toolCallId,
+ *                   toolName, content[], isError, timestamp (epoch ms)
+ *
+ * `toolResult.toolCallId` pairs exactly with `toolCall.id`, one result record
+ * per call, emitted in call order — so results attach by id, never by
+ * position. Pi supplies no duration, so it is derived from the gap between
+ * the call and its result, the same way the OpenClaw parser does it.
+ *
+ * The format is identical across the 0.73.1 (`@mariozechner/pi-coding-agent`)
+ * and 0.83.0 (`@earendil-works/pi-coding-agent`) packages — same `version: 3`
+ * header, same record types — so one parser covers both. One difference worth
+ * guarding: 0.83.0 emits leading prose alongside the calls
+ * (`["text","toolCall","toolCall"]`) where 0.73.1 emitted only the calls, so
+ * assistant content must not be assumed homogeneous.
  */
 import { readFileSync, readdirSync, existsSync, statSync } from "node:fs";
 import { readFile } from "node:fs/promises";
@@ -38,8 +59,10 @@ import {
   type GenericEntry,
   type QueueOperationEntry,
   type ContentBlock,
+  type ToolUseBlock,
   type LogSource,
 } from "./log-entries";
+import { formatDuration } from "./format-duration";
 
 // ── Paths ──
 
@@ -107,6 +130,10 @@ interface PiSessionRecord {
     role?: string;
     content?: Array<Record<string, unknown>>;
     timestamp?: number;
+    /** Present on `role: "toolResult"` records — pairs with a `toolCall.id`. */
+    toolCallId?: string;
+    toolName?: string;
+    isError?: boolean;
   };
 }
 
@@ -129,9 +156,19 @@ function extractMessageText(content: Array<Record<string, unknown>> | undefined)
   return parts.join("\n\n");
 }
 
-/** Build a list of ContentBlocks for the assistant entry, preserving text and
- *  thinking blocks. Skips blocks with non-string payloads (typeof guards). */
-function buildAssistantContent(content: Array<Record<string, unknown>> | undefined): ContentBlock[] {
+/** Build a list of ContentBlocks for the assistant entry, preserving text,
+ *  thinking and tool-call blocks. Skips blocks with non-string payloads
+ *  (typeof guards).
+ *
+ *  Every `tool_use` block built here is also handed to `onToolUse` so the
+ *  caller can index it by id and attach the matching `toolResult` record when
+ *  it arrives on a later line. The block is passed by reference and mutated
+ *  in place, exactly as the OpenClaw parser does — the entry has already been
+ *  pushed by then, so there is nothing else to attach it to. */
+function buildAssistantContent(
+  content: Array<Record<string, unknown>> | undefined,
+  onToolUse?: (block: ToolUseBlock) => void,
+): ContentBlock[] {
   if (!Array.isArray(content)) return [];
   const blocks: ContentBlock[] = [];
   for (const block of content) {
@@ -143,6 +180,22 @@ function buildAssistantContent(content: Array<Record<string, unknown>> | undefin
     if (block?.type === "thinking" && typeof block.thinking === "string" && block.thinking.length > 0) {
       blocks.push({ type: "text", text: `[thinking] ${block.thinking}` });
     }
+    if (block?.type === "toolCall") {
+      // Fall back to a positional id only when Pi omits one. A synthetic id
+      // still renders, but it can never pair with a result — so it must not
+      // collide with a real one, hence the index suffix.
+      const id = typeof block.id === "string" && block.id.length > 0
+        ? block.id
+        : `${typeof block.name === "string" ? block.name : "tool"}-${blocks.length}`;
+      const name = typeof block.name === "string" ? block.name : "tool";
+      const input =
+        block.arguments && typeof block.arguments === "object" && !Array.isArray(block.arguments)
+          ? (block.arguments as Record<string, unknown>)
+          : {};
+      const toolUse: ToolUseBlock = { type: "tool_use", id, name, input };
+      blocks.push(toolUse);
+      onToolUse?.(toolUse);
+    }
   }
   return blocks;
 }
@@ -161,6 +214,12 @@ export async function parsePiLog(
   const rawLines: Record<string, unknown>[] = [];
   let cwd: string | undefined;
   let seenSessionStart = false;
+  // In-flight tool calls, so a later `toolResult` record can attach its output
+  // to the block it belongs to. Keyed by the provider's own call id, never by
+  // position — Pi emits results in call order today, but pairing by order
+  // would break silently the first time it does not.
+  const toolUseById = new Map<string, ToolUseBlock>();
+  const toolUseStartMs = new Map<string, number>();
 
   for (let i = 0; i < lines.length; i++) {
     if (i > 0 && i % 200 === 0) await new Promise<void>((r) => setImmediate(r));
@@ -215,7 +274,10 @@ export async function parsePiLog(
       }
 
       if (role === "assistant") {
-        const blocks = buildAssistantContent(content);
+        const blocks = buildAssistantContent(content, (block) => {
+          toolUseById.set(block.id, block);
+          toolUseStartMs.set(block.id, date.getTime());
+        });
         if (blocks.length === 0) {
           entries.push({
             type: "system",
@@ -232,6 +294,33 @@ export async function parsePiLog(
         continue;
       }
 
+      // Pi's third role: a tool result, on its own record, pairing back to an
+      // assistant turn's toolCall by id. Attaching it to that block is what
+      // makes the tool's OUTPUT visible — without this the call renders with
+      // no result and the audit path sees no `toolResultText` at all.
+      if (role === "toolResult") {
+        const callId = raw.message.toolCallId;
+        const block = typeof callId === "string" ? toolUseById.get(callId) : undefined;
+        if (block) {
+          // Pi records no duration on the result, so derive it from the gap
+          // between the call and its result. `startMs` is always present for
+          // a block we indexed; the fallback keeps the arithmetic total.
+          const startMs = (typeof callId === "string" && toolUseStartMs.get(callId)) || date.getTime();
+          const durationMs = Math.max(0, date.getTime() - startMs);
+          block.result = {
+            timestamp,
+            timestampFormatted: formatTimestamp(date),
+            content: extractMessageText(content),
+            durationMs,
+            durationFormatted: formatDuration(durationMs),
+          };
+          continue;
+        }
+        // Orphan result — the call was never seen (truncated file, or a
+        // resumed session whose earlier half is in another file). Fall
+        // through so the record is preserved rather than dropped.
+      }
+
       // Unknown role — preserve raw so nothing is dropped.
       entries.push({
         type: "system",
@@ -319,7 +408,3 @@ export function readPiTranscriptSync(sessionId: string): string | null {
     return null;
   }
 }
-
-/** Suppress unused-import warning for formatTimestamp; reserved for tool-call
- *  rendering once Pi emits it (see header comment). */
-void formatTimestamp;

package/lib/telemetry-enabled.ts

@@ -0,0 +1,54 @@
+/**
+ * The single answer to "may we send telemetry?", shared by every dispatcher.
+ *
+ * There are four of them — the CLI and hook path (`src/hooks/hook-telemetry.ts`),
+ * the Next.js server (`lib/telemetry.ts`), the browser (`lib/client-telemetry.ts`,
+ * which inherits this via `getTelemetryConfig`), and the install script
+ * (`scripts/install-telemetry.mjs`, gated by its TypeScript caller). A dispatcher
+ * that resolved this differently would be an opt-out that silently does not hold,
+ * which is worse than having no opt-out at all.
+ *
+ * ## Two sources, and why the file is the important one
+ *
+ * `FAILPROOFAI_TELEMETRY_DISABLED=1` is read from `process.env`. That works for
+ * anything the user launches from a shell, and it is kept because people already
+ * rely on it. It cannot work for **failproofaid**: the daemon is a system-scope
+ * service unit whose environment carries essentially nothing, so an exported
+ * variable is structurally incapable of reaching it. `[telemetry] enabled` in
+ * config.toml is a file both the CLI and the daemon read, which is why it is the
+ * off-switch the documentation points at.
+ *
+ * They resolve to the **more restrictive** of the two: either says stop, and we
+ * stop. The environment can never re-enable something the file switched off —
+ * an env var that could override a written preference is not an opt-out.
+ */
+import { readConfig } from "../src/hooks/fp-config";
+
+/**
+ * Resolved fresh on every call, deliberately.
+ *
+ * Memoising this was the obvious optimisation and it is the wrong one. An
+ * opt-out that a long-lived process (the dashboard server, the warm worker)
+ * keeps ignoring until it restarts is an opt-out that does not hold, and
+ * "telemetry stopped only after a reboot" is precisely the bug that destroys
+ * trust in a switch like this.
+ *
+ * The cost is a small `readFileSync` + TOML parse per event. That is affordable
+ * even on the hook path's 150ms fail-closed budget: the same `readConfig()` is
+ * already called there by `isDaemonConfigured()`, so this adds a repeat of work
+ * the path was already paying for, on a file of a few hundred bytes.
+ */
+export function isTelemetryEnabled(): boolean {
+  // Checked first, and cheaply: an env lookup costs nothing, and letting it
+  // short-circuit means an operator who exported the variable never pays for a
+  // file read at all.
+  if (process.env.FAILPROOFAI_TELEMETRY_DISABLED === "1") return false;
+  try {
+    return readConfig().telemetry.enabled;
+  } catch {
+    // readConfig already resolves an unreadable or malformed file to the
+    // defaults, so reaching here means something more unusual. Fall back to the
+    // shipped default rather than inventing a third answer.
+    return true;
+  }
+}

package/lib/telemetry-id.ts

@@ -3,6 +3,7 @@ import path from "node:path";
 import os from "node:os";
 import crypto from "node:crypto";
 import { execSync } from "node:child_process";
+import { telemetryIdFile } from "../src/hooks/fp-home";
 
 const NAMESPACE = "failproofai-telemetry-v1";
 const ID_DIR = path.join(os.homedir(), ".failproofai");
@@ -66,6 +67,52 @@ function getFileBasedId(): string {
   return id;
 }
 
+/**
+ * Publish the resolved id where **failproofaid** can read it.
+ *
+ * The daemon cannot re-derive this. Tier 2 below hashes `os.arch()` and
+ * `os.cpus()[0].model`, which are Node's own formatting — Node says `x64` where
+ * Rust says `x86_64` — and a near-miss there does not fail, it silently files
+ * one machine under two different PostHog persons with nothing in the data to
+ * say so. So the CLI writes what it resolved and the daemon reads it
+ * (`telemetry_id_path()` in `crates/failproofaid/src/paths.rs`).
+ *
+ * Deliberately NOT gated on the telemetry opt-out. This sends nothing — it
+ * writes one anonymous HMAC to a local file — and gating it would mean a machine
+ * that opted out and later opted back in reported under a different identity
+ * until the next CLI run. The gate belongs on the sending, which is where both
+ * this process and the daemon apply it.
+ *
+ * Every failure is swallowed. This runs on the hook path, and a telemetry id
+ * that could not be published is worth exactly nothing next to a tool call that
+ * did not complete. The read-and-compare is what keeps the common case to one
+ * small `readFileSync` rather than a write per process.
+ */
+function publishInstanceId(id: string): void {
+  let target: string;
+  try {
+    target = telemetryIdFile();
+    if (fs.readFileSync(target, "utf-8").trim() === id) return;
+  } catch {
+    // Absent or unreadable — fall through and try to write it.
+    try {
+      target = telemetryIdFile();
+    } catch {
+      return;
+    }
+  }
+  try {
+    fs.mkdirSync(path.dirname(target), { recursive: true });
+    // tmp → rename, and the tmp name carries the pid: two CLI processes racing
+    // here is ordinary (every hook call resolves an id), and a shared temp name
+    // would let one truncate the file the other is renaming into place, leaving
+    // a torn id that the daemon would then adopt as a permanent, wrong person.
+    const tmp = `${target}.${process.pid}.tmp`;
+    fs.writeFileSync(tmp, id, { encoding: "utf-8", mode: 0o600 });
+    fs.renameSync(tmp, target);
+  } catch {}
+}
+
 /**
  * Returns a stable, anonymous machine ID for telemetry.
  *
@@ -75,7 +122,8 @@ function getFileBasedId(): string {
  * 3. File-based random UUID at `~/.failproofai/instance-id` (final fallback)
  *
  * All raw values are HMAC-hashed with an app-specific namespace so no PII
- * is transmitted. The result is cached in-process to avoid repeated I/O.
+ * is transmitted. The result is cached in-process to avoid repeated I/O, and
+ * published once per process for the daemon (see `publishInstanceId`).
  */
 export function getInstanceId(): string {
   if (cachedId) return cachedId;
@@ -83,15 +131,18 @@ export function getInstanceId(): string {
   const machineId = getPlatformMachineId();
   if (machineId) {
     cachedId = hashToId(machineId);
+    publishInstanceId(cachedId);
     return cachedId;
   }
 
   const sysProps = getSystemPropertiesId();
   if (sysProps) {
     cachedId = hashToId(sysProps);
+    publishInstanceId(cachedId);
     return cachedId;
   }
 
   cachedId = getFileBasedId();
+  publishInstanceId(cachedId);
   return cachedId;
 }

package/lib/telemetry.ts

@@ -9,6 +9,7 @@
  */
 
 import { getInstanceId } from "./telemetry-id";
+import { isTelemetryEnabled } from "./telemetry-enabled";
 import { version } from "../package.json";
 import { POSTHOG_API_KEY, POSTHOG_PRODUCT } from "../src/posthog-key";
 
@@ -74,10 +75,13 @@ async function resilientFetch(
   return new Response("{}", { status: 200 });
 }
 
-/** Returns true unless the user has explicitly opted out. */
-export function isTelemetryEnabled(): boolean {
-  return process.env.FAILPROOFAI_TELEMETRY_DISABLED !== "1";
-}
+/**
+ * Returns true unless the user has explicitly opted out, via either
+ * `FAILPROOFAI_TELEMETRY_DISABLED=1` or `[telemetry] enabled = false` in
+ * config.toml. Re-exported from the shared resolver so all four dispatchers
+ * cannot drift — see lib/telemetry-enabled.ts.
+ */
+export { isTelemetryEnabled };
 
 /**
  * Lazily import posthog-node and create a client.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "failproofai",
-  "version": "1.0.0-beta.2",
+  "version": "1.0.0-beta.21",
   "description": "The easiest way to manage policies that keep your AI agents reliable, on-task, and running autonomously — for Claude Code & the Agents SDK",
   "bin": {
     "failproofai": "./dist/cli.mjs",
@@ -76,19 +76,19 @@
     "@anthropic-ai/sdk": "^0.115.0",
     "@mdx-js/mdx": "^3.1.1",
     "@tailwindcss/postcss": "^4.3.1",
-    "@tanstack/react-virtual": "^3.14.3",
+    "@tanstack/react-virtual": "^3.14.9",
     "@testing-library/jest-dom": "^7.0.0",
     "@testing-library/react": "^16.3.2",
     "@testing-library/user-event": "^14.6.1",
-    "@types/node": "26.1.1",
-    "@types/react": "19.2.17",
+    "@types/node": "26.1.2",
+    "@types/react": "19.2.18",
     "@types/react-dom": "^19.2.3",
-    "@vitejs/plugin-react": "^6.0.1",
+    "@vitejs/plugin-react": "^6.0.5",
     "clsx": "^2.1.1",
     "eslint": "^10.5.0",
     "eslint-config-next": "^16.2.9",
-    "jsdom": "^30.0.0",
-    "lucide-react": "^1.18.0",
+    "jsdom": "^30.0.1",
+    "lucide-react": "^1.28.0",
     "next": "^16.2.11",
     "react": "^19.2.4",
     "react-dom": "^19.2.4",
@@ -99,17 +99,28 @@
   },
   "dependencies": {
     "html-to-image": "^1.11.13",
-    "html2canvas": "^1.4.1",
-    "posthog-node": "^5.37.1",
+    "posthog-node": "^5.47.7",
     "sql.js": "^1.14.1",
     "yaml": "^2.9.0"
   },
   "overrides": {
-    "postcss": "8.5.23",
+    "postcss": "8.5.26",
     "eslint-plugin-react-hooks": "7.0.1",
     "vite": "8.0.16",
-    "undici": "7.28.0",
-    "brace-expansion": "5.0.8",
+    "undici": "7.29.0",
+    "brace-expansion": "5.0.9",
     "sharp": "0.35.0"
+  },
+  "optionalDependencies": {
+    "@failproofai/failproofaid-linux-x64": "1.0.0-beta.21",
+    "@failproofai/failproofaid-linux-arm64": "1.0.0-beta.21",
+    "@failproofai/failproofaid-darwin-x64": "1.0.0-beta.21",
+    "@failproofai/failproofaid-darwin-arm64": "1.0.0-beta.21"
+  },
+  "failproofaidBinaries": {
+    "linux-x64": "78848fa69407c528ee9fea02bdd64c2f95aad6a84a4d3973780200c5644fe61c",
+    "linux-arm64": "eef4b4a435c44ba913610f213436bd34a873299ef774961a1af70cf76da934a2",
+    "darwin-x64": "abdfbdac60f06db20c69b11ff477123481622da3e03bd531e1896b8757ce0884",
+    "darwin-arm64": "49fc9dc590c38ece592aa46e734bb6c0743559e3dbb90996e8381056abb2f5da"
   }
 }