failproofai 1.0.0-beta.2 → 1.0.0-beta.21

package/scripts/build-daemon-packages.mjs

@@ -0,0 +1,247 @@
+#!/usr/bin/env node
+/**
+ * Publishes the four `failproofaid` binaries as npm platform packages, so a
+ * plain `npm install failproofai` already carries the daemon for the machine
+ * it landed on instead of fetching one from the GitHub Release later.
+ *
+ * The release assets stay exactly as they are — this is a second channel, not
+ * a replacement. `src/hooks/daemon-download.ts` prefers whichever binary is
+ * already on disk, then this npm package, then the release; the npm path is
+ * the only one that works with no network at `failproofai config` time.
+ *
+ * Two rules make this safe, and both come from the way the first attempt at
+ * npm-shipping the daemon failed (CHANGELOG 1.0.0-beta.3 — four
+ * `optionalDependencies` were declared and never published, so every install
+ * resolved four 404s):
+ *
+ *   1. These packages publish BEFORE the root package that pins them, so the
+ *      names always exist by the time anything depends on them.
+ *   2. A publish failure here is fatal, not a warning (unlike the alias stubs
+ *      in publish-aliases.mjs, where a missing name costs nothing). Failing
+ *      the job leaves the registry untouched; publishing a root package whose
+ *      optional dependency 404s would ship the broken state to every user.
+ *
+ * Usage:
+ *   node scripts/build-daemon-packages.mjs --artifacts <dir> [--dist-tag <tag>]
+ *                                          [--version <v>] [--pin-root] [--dry-run]
+ */
+import { execFileSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import { chmodSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+import { gunzipSync } from "node:zlib";
+import {
+  DAEMON_PLATFORMS,
+  daemonAssetName,
+  daemonOptionalDependencies,
+  daemonPackageName,
+} from "./daemon-platforms.mjs";
+
+const REPO_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "..");
+
+/**
+ * Where the generated packages are staged — **outside the repo**, and that is
+ * load-bearing rather than tidy.
+ *
+ * `npm publish` re-runs `prepare`, so the Next build happens again *after*
+ * this script has run, and Next's file tracing pulls the whole project root
+ * into `.next/standalone` (see the "over-traced project artifacts" prune list
+ * in scripts/prune-standalone.mjs). Anything staged inside the checkout
+ * therefore ends up inside the published CLI tarball — measured: a dry run
+ * shipped 16 MB of daemon `.gz` assets under
+ * `.next/standalone/release-assets/`. Staging in the temp dir cannot be swept
+ * up by a build. `--staging` overrides it for tests.
+ */
+export const STAGING_DIR = resolve(tmpdir(), "failproofaid-packages");
+
+/**
+ * The manifest for one platform package.
+ *
+ * Deliberately carries no `bin` (it would shadow the root package's own
+ * `failproofaid` shim, which is what a user invoking the daemon by hand
+ * should reach) and no `exports` (so `require.resolve("<pkg>/package.json")`
+ * — how the CLI finds this package — keeps working).
+ */
+export function platformPackageManifest(platform, version, rootPkg = {}) {
+  return {
+    name: daemonPackageName(platform.key),
+    version,
+    description: `The failproofaid background daemon binary for ${platform.os} ${platform.cpu}. Installed automatically as an optional dependency of failproofai.`,
+    // npm's own platform filters: with both set, only the matching package is
+    // installed and the other three are skipped without a warning.
+    os: [platform.os],
+    cpu: [platform.cpu],
+    files: ["bin/"],
+    publishConfig: { access: "public" },
+    repository: rootPkg.repository,
+    homepage: rootPkg.homepage,
+    bugs: rootPkg.bugs,
+    license: rootPkg.license,
+  };
+}
+
+/**
+ * Stages one platform package on disk and returns its directory.
+ *
+ * The binary is written decompressed and mode 0755: npm records the executable
+ * bit in the tarball, so it survives publish → install, which is how esbuild
+ * and swc ship their binaries.
+ */
+export function stagePlatformPackage(platform, version, rootPkg, artifactsDir, stagingRoot = STAGING_DIR) {
+  const asset = resolve(artifactsDir, daemonAssetName(platform.key));
+  if (!existsSync(asset)) {
+    throw new Error(`missing artifact ${asset} — the daemon build did not produce ${daemonAssetName(platform.key)}`);
+  }
+
+  const dir = join(stagingRoot, `failproofaid-${platform.key}`);
+  rmSync(dir, { recursive: true, force: true });
+  mkdirSync(join(dir, "bin"), { recursive: true });
+
+  const binary = gunzipSync(readFileSync(asset));
+  const binaryPath = join(dir, "bin", "failproofaid");
+  writeFileSync(binaryPath, binary);
+  chmodSync(binaryPath, 0o755);
+
+  writeFileSync(
+    join(dir, "package.json"),
+    JSON.stringify(platformPackageManifest(platform, version, rootPkg), null, 2) + "\n",
+  );
+  writeFileSync(
+    join(dir, "README.md"),
+    `# ${daemonPackageName(platform.key)}\n\n` +
+      `The \`failproofaid\` background daemon binary for ${platform.os} ${platform.cpu}.\n\n` +
+      `Installed automatically as an optional dependency of [failproofai](https://www.npmjs.com/package/failproofai) — ` +
+      `you do not need to install it yourself.\n`,
+  );
+
+  return dir;
+}
+
+/**
+ * The SHA-256 of the binary inside a staged platform package.
+ *
+ * Read back off disk rather than returned from `stagePlatformPackage` so that
+ * function's contract stays a plain directory path, and so the digest describes
+ * the bytes that will actually be packed — not an in-memory buffer that was
+ * supposed to become them.
+ */
+export function stagedBinaryDigest(dir) {
+  return createHash("sha256")
+    .update(readFileSync(join(dir, "bin", "failproofaid")))
+    .digest("hex");
+}
+
+/**
+ * Writes the four platform packages into the root manifest's
+ * `optionalDependencies`, pinned to `version`.
+ *
+ * Called at publish time rather than committed: a pin to a version that does
+ * not exist yet breaks `bun install --frozen-lockfile` in this repo's own CI,
+ * and keeping four pins in step with every version bump by hand is the drift
+ * this whole file exists to avoid.
+ *
+ * @param {string} version
+ * @param {string} [packageJsonPath]
+ * @param {Record<string, string> | null} [digests] platform key → SHA-256 of
+ *   that platform's staged binary. Omitted leaves the key ABSENT, which
+ *   `expectedNpmBinaryDigest` reads as "nothing to compare against".
+ */
+export function pinRootManifest(version, packageJsonPath = resolve(REPO_ROOT, "package.json"), digests = null) {
+  const pkg = JSON.parse(readFileSync(packageJsonPath, "utf8"));
+  pkg.optionalDependencies = { ...pkg.optionalDependencies, ...daemonOptionalDependencies(version) };
+  // The SHA-256 of each binary as it was staged, recorded in the ROOT manifest
+  // so `installFromNpmPackage` has something to check the file it copies
+  // against. The download channel has verified against `SHA256SUMS` since it
+  // existed; the npm channel had no integrity step of any kind, and it installs
+  // its result as a root-owned, boot-persistent system service.
+  //
+  // Written here rather than into each platform package because a digest
+  // shipped alongside the bytes it describes verifies nothing. This one travels
+  // in a different package, published separately, and `bun build` INLINES it
+  // into dist/cli.mjs — so it is not merely a second file in the same tree.
+  if (digests) pkg.failproofaidBinaries = digests;
+  writeFileSync(packageJsonPath, JSON.stringify(pkg, null, 2) + "\n");
+  return pkg.optionalDependencies;
+}
+
+function parseArgs(argv) {
+  const valueOf = (flag, fallback) => {
+    const index = argv.indexOf(flag);
+    return index !== -1 && argv[index + 1] ? argv[index + 1] : fallback;
+  };
+  return {
+    artifacts: valueOf("--artifacts", "release-assets"),
+    staging: valueOf("--staging", STAGING_DIR),
+    distTag: valueOf("--dist-tag", null),
+    version: valueOf("--version", null),
+    pinRoot: argv.includes("--pin-root"),
+    dryRun: argv.includes("--dry-run"),
+  };
+}
+
+/**
+ * `npm publish`, with provenance when the registry will take it.
+ *
+ * Provenance needs a supported CI and a repository field npm can match to the
+ * building workflow; when it refuses, the publish itself is still correct, so
+ * this retries once without the flag rather than failing the release.
+ */
+function publishPackage(dir, distTag, dryRun) {
+  const args = ["publish", "--tag", distTag];
+  if (dryRun) args.push("--dry-run");
+
+  const attempt = (extra) =>
+    execFileSync("npm", [...args, ...extra], { cwd: dir, stdio: "pipe", encoding: "utf8" });
+
+  const withProvenance = !dryRun && process.env.GITHUB_ACTIONS === "true";
+  try {
+    return attempt(withProvenance ? ["--provenance"] : []);
+  } catch (err) {
+    const output = (err.stdout ?? "") + (err.stderr ?? "");
+    if (output.includes("cannot publish over")) return "[skip] already published at this version";
+    if (withProvenance && /provenance/i.test(output)) {
+      console.log("::warning::provenance was rejected — retrying the publish without it");
+      return attempt([]);
+    }
+    // Fatal on purpose: see the header. The root package pins these names, so
+    // a half-published set must stop the release rather than ship 404s.
+    throw new Error(`npm publish failed for ${dir}:\n${output.trim()}`);
+  }
+}
+
+export function main(argv = process.argv.slice(2)) {
+  const options = parseArgs(argv);
+  const rootPkg = JSON.parse(readFileSync(resolve(REPO_ROOT, "package.json"), "utf8"));
+  const version = options.version ?? rootPkg.version;
+  const distTag = options.distTag ?? (version.includes("-") ? "beta" : "latest");
+  const artifactsDir = resolve(process.cwd(), options.artifacts);
+
+  console.log(
+    `Publishing ${DAEMON_PLATFORMS.length} failproofaid platform packages at ${version} ` +
+      `(tag: ${distTag}${options.dryRun ? ", dry run" : ""}) from ${artifactsDir}`,
+  );
+
+  const digests = {};
+  for (const platform of DAEMON_PLATFORMS) {
+    const dir = stagePlatformPackage(platform, version, rootPkg, artifactsDir, options.staging);
+    const sha256 = stagedBinaryDigest(dir);
+    digests[platform.key] = sha256;
+    const name = daemonPackageName(platform.key);
+    console.log(`\n${name}@${version}  sha256:${sha256}`);
+    console.log(publishPackage(dir, distTag, options.dryRun).trim());
+  }
+
+  if (options.pinRoot) {
+    const pins = pinRootManifest(version, resolve(REPO_ROOT, "package.json"), digests);
+    console.log("\nPinned in the root manifest's optionalDependencies:");
+    console.log(JSON.stringify(pins, null, 2));
+    console.log("\nRecorded binary digests (failproofaidBinaries):");
+    console.log(JSON.stringify(digests, null, 2));
+  }
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  main();
+}

package/scripts/daemon-platforms.mjs

@@ -0,0 +1,42 @@
+/**
+ * The platforms `failproofaid` is cross-compiled for, and the npm packages
+ * those binaries publish under.
+ *
+ * One list, three consumers: `build-daemon-packages.mjs` (publishes them),
+ * `publish-aliases.mjs` (pins them in every typo-squat stub), and the root
+ * package's injected `optionalDependencies`. They have to agree exactly — a
+ * name that appears in a dependency but never gets published is a 404 in
+ * every install, which is precisely how the first attempt at npm-shipping the
+ * daemon failed (see CHANGELOG 1.0.0-beta.3).
+ *
+ * `os` / `cpu` are npm's own filters, spelled in `process.platform` /
+ * `process.arch` values: with both set, npm and bun install only the package
+ * matching the machine and silently skip the other three.
+ */
+
+export const DAEMON_PLATFORMS = [
+  { key: "linux-x64", os: "linux", cpu: "x64" },
+  { key: "linux-arm64", os: "linux", cpu: "arm64" },
+  { key: "darwin-x64", os: "darwin", cpu: "x64" },
+  { key: "darwin-arm64", os: "darwin", cpu: "arm64" },
+];
+
+/** The npm package name carrying the binary for one platform key. */
+export function daemonPackageName(key) {
+  return `@failproofai/failproofaid-${key}`;
+}
+
+/** The release asset the binary for one platform key arrives in. */
+export function daemonAssetName(key) {
+  return `failproofaid-${key}.gz`;
+}
+
+/**
+ * The `optionalDependencies` block that pins all four platform packages to one
+ * version — what the root package and every alias stub carry when published.
+ */
+export function daemonOptionalDependencies(version) {
+  return Object.fromEntries(
+    DAEMON_PLATFORMS.map((platform) => [daemonPackageName(platform.key), version]),
+  );
+}

package/scripts/dev-hook.mjs

@@ -5,7 +5,7 @@
  * End users never run this. They install `npx -y failproofai --hook <Event>`
  * (see `src/hooks/integrations.ts`), which resolves the published package.
  * This file exists because this repo dogfoods itself from source, and doing so
- * has two prerequisites that silently rot:
+ * has three prerequisites that silently rot:
  *
  *   1. `bun` on the hook's PATH. `bin/failproofai.mjs` cannot run under node —
  *      it does a bare `import { version } from "../package.json"` (node needs
@@ -17,13 +17,17 @@
  *      When that happens every hook exits 127 and the session runs with ZERO
  *      policy enforcement — silently.
  *
- *   2. `dist/index.js`. The committed policies in `.failproofai/policies/`
+ *   2. Project dependencies. A fresh checkout has no `node_modules`, so the
+ *      source binary cannot import its runtime dependencies. The launcher
+ *      runs the lockfile-pinned install once before attempting enforcement.
+ *
+ *   3. `dist/index.js`. The committed policies in `.failproofai/policies/`
  *      `import from 'failproofai'`, which `findDistIndex()` resolves to that
  *      bundle. Without it all three fail-open and only builtins enforce.
  *
- * So: locate bun (installing it via npm if we must), make sure the bundle
- * exists, then hand off to the real binary. If we cannot enforce, say so in
- * one line rather than failing silently.
+ * So: locate bun (installing it via npm if we must), install this checkout's
+ * dependencies, make sure the bundle exists, then hand off to the real binary.
+ * If we cannot enforce, say so in one line rather than failing silently.
  *
  * INVARIANT — never write to stdout. Most CLIs' deny contracts are JSON on
  * stdout (Copilot `{decision:"block"}`, Cursor `{followup_message}`, Devin,
@@ -43,6 +47,11 @@ const SRC_BIN = resolve(REPO_ROOT, "bin", "failproofai.mjs");
 const BUNDLE = resolve(REPO_ROOT, "dist", "index.js");
 const CACHE_DIR = resolve(REPO_ROOT, "node_modules", ".cache", "failproofai-dev");
 const LOCK_DIR = join(CACHE_DIR, ".lock");
+const DEPENDENCY_SENTINELS = [
+  resolve(REPO_ROOT, "node_modules", "posthog-node", "package.json"),
+  resolve(REPO_ROOT, "node_modules", "sql.js", "package.json"),
+  resolve(REPO_ROOT, "node_modules", "yaml", "package.json"),
+];
 
 /** A lock older than this belonged to a process that died mid-install. */
 const LOCK_STALE_MS = 5 * 60_000;
@@ -58,6 +67,7 @@ const LOCK_WAIT_MS = 250;
  * @property {string} [home]
  * @property {(p: string) => boolean} [exists]
  * @property {(p: string) => string[]} [readdir]
+ * @property {typeof spawnSync} [spawn]
  */
 
 function warn(msg) {
@@ -167,6 +177,16 @@ export function bunMissingMessage() {
   );
 }
 
+/**
+ * A cheap every-hook check for the runtime dependencies the source hook path
+ * imports. Requiring several direct dependencies also catches interrupted or
+ * partial installs instead of treating any non-empty node_modules as ready.
+ */
+export function projectDependenciesInstalled(deps = {}) {
+  const exists = deps.exists ?? existsSync;
+  return DEPENDENCY_SENTINELS.every((path) => exists(path));
+}
+
 /**
  * Run `doWork` at most once across concurrently-firing hooks. `mkdirSync` is
  * atomic, so it doubles as the lock: EEXIST means another process got there.
@@ -233,6 +253,26 @@ function installBun(deps = {}) {
   return findBun(deps);
 }
 
+/** Install a fresh/partial checkout from the committed lockfile, once. */
+export function ensureProjectDependencies(bunPath, deps = {}) {
+  const run = deps.spawn ?? spawnSync;
+  return ensureOnce(
+    () => projectDependenciesInstalled(deps),
+    () => {
+      warn("project dependencies missing — running bun install (one time)");
+      const r = run(bunPath, ["install", "--frozen-lockfile"], {
+        // Installation/build output is not hook protocol output. Keep stdout
+        // clean, but expose errors so a broken bootstrap is actionable.
+        stdio: ["ignore", "ignore", "inherit"],
+        cwd: REPO_ROOT,
+      });
+      if (r.status !== 0) {
+        warn("bun install failed — hooks are NOT enforcing; see the error above");
+      }
+    },
+  );
+}
+
 /**
  * Build dist/index.js if absent, so `.failproofai/policies/*.mjs` can resolve
  * `import ... from 'failproofai'`. Non-fatal: builtins enforce without it.
@@ -258,6 +298,7 @@ function main() {
     warn(bunMissingMessage());
     process.exit(1);
   }
+  if (!ensureProjectDependencies(bun)) process.exit(1);
   ensureBundle(bun);
 
   // stdio:"inherit" hands the child our actual fds: the payload on stdin and

package/scripts/install-telemetry.mjs

@@ -86,12 +86,19 @@ function getInstanceId() {
  * fire from the CLI (see lib/install-check.ts) because package managers block
  * install scripts by default.
  *
+ * `opts.enabled` carries the resolved answer from lib/telemetry-enabled.ts. This
+ * file is a dependency-free .mjs so that it can run with no node_modules, which
+ * also means it cannot import the TOML config — so the caller, which can, passes
+ * the verdict in. Without it `[telemetry] enabled = false` would silence three
+ * dispatchers out of four and this one would keep reporting.
+ *
  * @param {string} event
  * @param {Record<string, unknown>} [properties]
- * @param {{ version?: string, timeoutMs?: number }} [opts]
+ * @param {{ version?: string, timeoutMs?: number, enabled?: boolean }} [opts]
  */
 export async function trackInstallEvent(event, properties = {}, opts = {}) {
   if (process.env.FAILPROOFAI_TELEMETRY_DISABLED === "1") return;
+  if (opts.enabled === false) return;
 
   const version = opts.version ?? process.env.npm_package_version ?? "unknown";
   const body = JSON.stringify({

package/scripts/launch.ts

@@ -10,22 +10,40 @@ import { parseScriptArgs } from "./parse-script-args";
 import { diagnoseShadow } from "./install-diagnosis.mjs";
 import { makeSkewLogFilter } from "./skew-log-filter";
 import { renderLaunchBanner } from "../src/hooks/tui";
+import { isLoopbackHostname, resolveDashboardHost } from "../lib/dashboard-host";
 import { version } from "../package.json";
 
 export function launch(mode: "dev" | "start"): void {
-  const { loggingLevel, disableTelemetry, allowedDevOrigins, remainingArgs } = parseScriptArgs(process.argv.slice(2));
+  const { loggingLevel, disableTelemetry, allowedDevOrigins, host, remainingArgs } = parseScriptArgs(process.argv.slice(2));
 
   // Branded splash — the same logomark + palette as the `configure` wizard, then
   // a tidy version/links column. Falls back to plain text off a TTY.
   for (const line of renderLaunchBanner(version)) console.log(line);
 
+  // The dashboard has no authentication and can toggle policies and uninstall
+  // hooks from every agent CLI, so it binds loopback unless someone asks
+  // otherwise. It used to bind 0.0.0.0 unconditionally, which handed all of
+  // that to every peer on the network.
+  const bindHost = resolveDashboardHost(host, process.env.FAILPROOFAI_DASHBOARD_HOST);
+  if (!isLoopbackHostname(bindHost)) {
+    console.warn(
+      `\n! Binding the dashboard to ${bindHost}, which is reachable from outside this machine.\n` +
+      `  It has no authentication: anyone who can reach it can read your session\n` +
+      `  transcripts, disable your policies, and uninstall failproofai's hooks.\n`,
+    );
+  }
+  // Read back by proxy.ts, which refuses any request whose Host is not one it
+  // should be answering to — the layer that stops DNS rebinding, which a
+  // loopback bind alone does not.
+  process.env.FAILPROOFAI_DASHBOARD_HOST = bindHost;
+
   let cmd: string;
   let cmdArgs: string[];
   if (mode === "start") {
     const portIdx = remainingArgs.indexOf("--port");
     const port = portIdx >= 0 ? remainingArgs[portIdx + 1] : "8020";
     process.env.PORT = port;
-    process.env.HOSTNAME = "0.0.0.0";
+    process.env.HOSTNAME = bindHost;
     cmd = "node";
     // Resolve the real package root via realpathSync so symlinked npm global binaries
     // don't cause import.meta.url to point at the symlink dir instead of the package dir.
@@ -74,7 +92,11 @@ export function launch(mode: "dev" | "start"): void {
     cmdArgs = [serverJsPath];
   } else {
     cmd = "bunx";
-    cmdArgs = ["--bun", "next", "dev", ...remainingArgs];
+    // `next dev` with no -H listens on every interface too, so dev gets the same
+    // default. Skipped when the caller already passed one through, so an
+    // explicit -H in remainingArgs still wins.
+    const hasHostFlag = remainingArgs.some((a) => a === "-H" || a === "--hostname" || a.startsWith("--hostname="));
+    cmdArgs = ["--bun", "next", "dev", ...(hasHostFlag ? [] : ["-H", bindHost]), ...remainingArgs];
   }
 
   // In `start` (the shipped standalone server) we pipe + filter the child's

package/scripts/parse-script-args.ts

@@ -7,6 +7,13 @@ export interface ParsedScriptArgs {
   loggingLevel: string | undefined;
   disableTelemetry: boolean;
   allowedDevOrigins: string[] | undefined;
+  /**
+   * Interface to bind the dashboard to. Undefined means the safe default
+   * (loopback) — see `resolveDashboardHost` in launch.ts. Only set this to a
+   * non-loopback address deliberately: the dashboard has no authentication and
+   * is a WRITE surface for this machine's security configuration.
+   */
+  host: string | undefined;
   remainingArgs: string[];
 }
 
@@ -32,6 +39,7 @@ export function parseScriptArgs(argv: string[]): ParsedScriptArgs {
   let loggingLevel: string | undefined;
   let disableTelemetry = false;
   let allowedDevOrigins: string[] | undefined;
+  let host: string | undefined;
 
   for (let i = 0; i < args.length; i++) {
     const arg = args[i];
@@ -71,7 +79,25 @@ export function parseScriptArgs(argv: string[]): ParsedScriptArgs {
       i--;
       continue;
     }
+
+    // `-H` / `--hostname` are Next's own spellings of this, and `bun run dev`
+    // passes unrecognised arguments straight through to `next dev`. Capturing
+    // only `--host` meant a raw `-H 0.0.0.0` fell into `remainingArgs`: Next
+    // bound the wildcard, while `bindHost` kept the loopback default and
+    // `FAILPROOFAI_DASHBOARD_HOST=127.0.0.1` told `proxy.ts` it was on
+    // loopback. It then enforced a Host-header pin — which a raw network
+    // client forges trivially, unlike a browser — against a server genuinely
+    // reachable from the network, and skipped the no-Origin refusal that is
+    // the real defence for that bind. The two must agree, so all three
+    // spellings resolve to the same value.
+    if (flag === "--host" || flag === "-H" || flag === "--hostname") {
+      const { value, spliceCount } = parseStringFlag(flag, "an address to bind (e.g. 127.0.0.1)", inlineValue, args, i);
+      host = value;
+      args.splice(i, spliceCount);
+      i--;
+      continue;
+    }
   }
 
-  return { loggingLevel, disableTelemetry, allowedDevOrigins, remainingArgs: args };
+  return { loggingLevel, disableTelemetry, allowedDevOrigins, host, remainingArgs: args };
 }

package/scripts/prune-standalone.mjs

@@ -101,6 +101,24 @@ const STANDALONE_ROOT_PRUNE = [
   ".claude", ".failproofai", ".github", ".vscode", ".idea",
   // Failproofai CLI artifacts — the dashboard never loads these
   "bin", "dist", "scripts", "src",
+  // Release-pipeline scratch: the daemon binaries downloaded from the build
+  // matrix and the staged platform packages. Both are written into the
+  // workspace only by a local/manual run (the publish workflow keeps them in
+  // RUNNER_TEMP precisely so this cannot happen), and 16 MB of `.gz` shipped
+  // inside the CLI tarball once already because nothing pruned them.
+  "release-assets", ".daemon-packages",
+  // The Rust workspace. `target/` is the big one: on any machine that has run
+  // `cargo build`, NFT traces it into the standalone output and it is FIFTEEN
+  // GIGABYTES of compiled artifacts — `npm pack` then hangs trying to tar it,
+  // which is how this was found. CI has not hit it because the Rust jobs build
+  // in a separate workspace, so nothing caught it; a contributor who builds the
+  // daemon and then the package hits it every time. The dashboard is a Next
+  // server — it never reads any of this.
+  "target", "crates",
+  // Test/dev trees NFT also over-traces. `integration-suite` is a harness, the
+  // plugin/extension dirs are shipped from the package root by `files`, not
+  // from inside the standalone bundle.
+  "integration-suite", "pi-extension", "openclaw-plugin", "docker-hook-sync",
 ];
 const STANDALONE_ROOT_PRUNE_FILES = [
   // Top-level markdown / licenses / docs
@@ -111,6 +129,14 @@ const STANDALONE_ROOT_PRUNE_FILES = [
   "vitest.config.mts", "vitest.config.e2e.mts",
   // Lockfiles
   "bun.lock", "bun.lockb", "package-lock.json", "yarn.lock",
+  // Rust workspace manifests, siblings of the `target`/`crates` prune above.
+  "Cargo.toml", "Cargo.lock", "rust-toolchain.toml", "osv-scanner.toml",
+  // 11 MB README animation. Traced because it sits in the repo root and is
+  // referenced from README.md; the running dashboard never serves it.
+  "readme-arch-hq.gif",
+  // Incremental typechecker state — regenerated on every build, read by nothing
+  // at runtime, and routinely a few hundred KB.
+  "tsconfig.tsbuildinfo", "next-env.d.ts", "postcss.config.mjs",
 ];
 for (const d of STANDALONE_ROOT_PRUNE) {
   rmSync(join(STANDALONE, d), { recursive: true, force: true });