failproofai 1.0.0-beta.2 → 1.0.0-beta.21

package/scripts/publish-aliases.mjs

@@ -2,7 +2,8 @@
 import { execSync } from 'child_process';
 import { readFileSync, writeFileSync, mkdirSync, rmSync, cpSync } from 'fs';
 import { join, dirname } from 'path';
-import { fileURLToPath } from 'url';
+import { fileURLToPath, pathToFileURL } from 'url';
+import { daemonOptionalDependencies } from './daemon-platforms.mjs';
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const rootPkg = JSON.parse(readFileSync(join(__dirname, '..', 'package.json'), 'utf8'));
@@ -11,7 +12,7 @@ const DRY_RUN = process.argv.includes('--dry-run');
 const distTagIdx = process.argv.indexOf('--dist-tag');
 const DIST_TAG = distTagIdx !== -1 ? process.argv[distTagIdx + 1] : (VERSION.includes('-') ? 'beta' : 'latest');
 
-const ALIASES = [
+export const ALIASES = [
   // Formatting variants — no "ai", or hyphen/underscore separators
   'failproof',
   'failproof-ai',
@@ -31,57 +32,77 @@ const ALIASES = [
   'faliproofai',
 ];
 
-const warnings = [];
-
-for (const name of ALIASES) {
-  const tmpDir = join('/tmp', `npm-alias-${name}-${Date.now()}`);
-  const binDir = join(tmpDir, 'bin');
-  mkdirSync(binDir, { recursive: true });
-
-  const pkg = {
+/**
+ * The manifest one alias stub publishes.
+ *
+ * The four `@failproofai/failproofaid-<platform>` pins are the same ones the
+ * root package carries. They arrive transitively through the `failproofai`
+ * dependency anyway, but naming them here means someone who installs a typo'd
+ * name gets the daemon binary for exactly the reason the root package does,
+ * rather than by accident of resolution — and a test can assert it.
+ */
+export function aliasManifest(name, version = VERSION, pkg = rootPkg) {
+  return {
     name,
-    version: VERSION,
+    version,
     description: `Alias for failproofai — installs if you typed '${name}' instead of 'failproofai'`,
     bin: { [name]: './bin/proxy.js' },
     files: ['bin/'],
-    dependencies: { failproofai: VERSION },
+    dependencies: { failproofai: version },
+    optionalDependencies: daemonOptionalDependencies(version),
     publishConfig: { access: 'public' },
-    repository: rootPkg.repository,
-    homepage: rootPkg.homepage,
-    bugs: rootPkg.bugs,
-    license: rootPkg.license,
+    repository: pkg.repository,
+    homepage: pkg.homepage,
+    bugs: pkg.bugs,
+    license: pkg.license,
   };
+}
 
-  writeFileSync(join(tmpDir, 'package.json'), JSON.stringify(pkg, null, 2) + '\n');
-  cpSync(join(__dirname, 'alias-proxy.js'), join(binDir, 'proxy.js'));
+export function main() {
+  const warnings = [];
 
-  if (DRY_RUN) {
-    console.log(`[dry-run] Would publish ${name}@${VERSION} (tag: ${DIST_TAG})`);
-    console.log(JSON.stringify(pkg, null, 2));
-    console.log('---');
-    rmSync(tmpDir, { recursive: true, force: true });
-    continue;
-  }
+  for (const name of ALIASES) {
+    const tmpDir = join('/tmp', `npm-alias-${name}-${Date.now()}`);
+    const binDir = join(tmpDir, 'bin');
+    mkdirSync(binDir, { recursive: true });
+
+    const pkg = aliasManifest(name);
 
-  console.log(`Publishing ${name}@${VERSION}...`);
-  try {
-    execSync(`npm publish --tag ${DIST_TAG}`, { cwd: tmpDir, stdio: 'pipe' });
-    console.log(`Done: ${name}`);
-  } catch (err) {
-    const output = (err.stdout?.toString() ?? '') + (err.stderr?.toString() ?? '');
-    if (output.includes('too similar')) {
-      warnings.push(`${name}: blocked by npm similarity check — request via npm support`);
-    } else if (output.includes('cannot publish over')) {
-      console.log(`[skip] ${name}: already published at ${VERSION}`);
-    } else {
-      warnings.push(`${name}: ${output.trim().split('\n').find(l => l.includes('npm error')) ?? 'unknown error'}`);
+    writeFileSync(join(tmpDir, 'package.json'), JSON.stringify(pkg, null, 2) + '\n');
+    cpSync(join(__dirname, 'alias-proxy.js'), join(binDir, 'proxy.js'));
+
+    if (DRY_RUN) {
+      console.log(`[dry-run] Would publish ${name}@${VERSION} (tag: ${DIST_TAG})`);
+      console.log(JSON.stringify(pkg, null, 2));
+      console.log('---');
+      rmSync(tmpDir, { recursive: true, force: true });
+      continue;
+    }
+
+    console.log(`Publishing ${name}@${VERSION}...`);
+    try {
+      execSync(`npm publish --tag ${DIST_TAG}`, { cwd: tmpDir, stdio: 'pipe' });
+      console.log(`Done: ${name}`);
+    } catch (err) {
+      const output = (err.stdout?.toString() ?? '') + (err.stderr?.toString() ?? '');
+      if (output.includes('too similar')) {
+        warnings.push(`${name}: blocked by npm similarity check — request via npm support`);
+      } else if (output.includes('cannot publish over')) {
+        console.log(`[skip] ${name}: already published at ${VERSION}`);
+      } else {
+        warnings.push(`${name}: ${output.trim().split('\n').find(l => l.includes('npm error')) ?? 'unknown error'}`);
+      }
     }
+
+    rmSync(tmpDir, { recursive: true, force: true });
   }
 
-  rmSync(tmpDir, { recursive: true, force: true });
+  if (warnings.length > 0) {
+    console.log('\n::warning::Some alias packages were not published:');
+    for (const w of warnings) console.log(`  - ${w}`);
+  }
 }
 
-if (warnings.length > 0) {
-  console.log('\n::warning::Some alias packages were not published:');
-  for (const w of warnings) console.log(`  - ${w}`);
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  main();
 }

package/scripts/repro-npm-install.sh

@@ -0,0 +1,155 @@
+#!/usr/bin/env bash
+# ─────────────────────────────────────────────────────────────────────────────
+# Reproduce a REAL user install, in the shape that actually breaks.
+#
+#   sudo npm i -g failproofai      (global prefix owned by root)
+#   then run the CLI as a NORMAL user
+#
+# That split is the whole point. A single-user laptop where npm's prefix is
+# owned by the person running the hooks hides an entire class of bug — it is
+# how the root-owned policy-shim fail-open shipped: every hook run by a non-root
+# user hit EACCES, the policy never loaded, and the hook exited 0 ALLOWING the
+# call, while builtins kept firing so the machine looked protected.
+#
+# systemd is real here (jrei/systemd-ubuntu), so `failproofai config` installs
+# and starts the actual service rather than skipping that half.
+#
+# Usage:
+#   scripts/repro-npm-install.sh              # build, pack, drop into a shell
+#   scripts/repro-npm-install.sh --published  # install the last RELEASE instead
+# ─────────────────────────────────────────────────────────────────────────────
+set -uo pipefail
+
+REPO="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "$REPO"
+
+IMAGE=jrei/systemd-ubuntu:24.04
+NAME=fpai-repro
+USER_IN_BOX=dev
+PUBLISHED=0
+[ "${1:-}" = "--published" ] && PUBLISHED=1
+
+VERSION=$(node -p "require('$REPO/package.json').version")
+say() { printf '\n\033[1m── %s\033[0m\n' "$1"; }
+
+# ── 1. Build what a tarball would carry ──────────────────────────────────────
+if [ "$PUBLISHED" -eq 0 ]; then
+  say "Building dist + daemon"
+  [ -f dist/cli.mjs ] || bun run build
+  [ -f target/release/failproofaid ] || cargo build --release --bin failproofaid
+
+  # `dist/cli.mjs` INLINES the version at build time. `npm pack --ignore-scripts`
+  # skips the `prepare` script that would rebuild it, so bumping package.json
+  # without rebuilding packs a bundle that reports the OLD version — and you
+  # spend an afternoon testing code you did not write. A real publish never hits
+  # this (publish.yml builds, and `prepare` runs on a normal pack); this is a
+  # trap of the fast path only, which is exactly why it is checked here.
+  if ! grep -q "$VERSION" dist/cli.mjs 2>/dev/null; then
+    say "dist is stale (built for $(grep -o '[0-9]\+\.[0-9]\+\.[0-9]\+-beta\.[0-9]\+' dist/cli.mjs | head -1)) — rebuilding"
+    bun run build
+  fi
+
+  say "Packing $VERSION"
+  rm -f failproofai-*.tgz
+  npm pack --ignore-scripts >/dev/null 2>&1
+  TARBALL="$REPO/failproofai-$VERSION.tgz"
+  [ -f "$TARBALL" ] || { echo "pack failed"; exit 1; }
+  ls -la "$TARBALL" | awk '{printf "  %s bytes  %s\n", $5, $9}'
+
+  # Belt and braces: assert what is actually IN the tarball, not what we meant
+  # to put there.
+  PACKED=$(tar -xzOf "$TARBALL" package/dist/cli.mjs 2>/dev/null \
+             | grep -o '[0-9]\+\.[0-9]\+\.[0-9]\+-beta\.[0-9]\+' | head -1)
+  if [ "$PACKED" != "$VERSION" ]; then
+    echo "  REFUSING: tarball reports '$PACKED' but package.json says '$VERSION'"
+    exit 1
+  fi
+  echo "  bundled version verified: $PACKED"
+fi
+
+# ── 2. A container with a real init ──────────────────────────────────────────
+say "Starting $IMAGE (real systemd)"
+docker rm -f "$NAME" >/dev/null 2>&1
+# --cgroupns=host + the two tmpfs mounts are REQUIRED on a cgroup v2 host
+# (anything modern). Without them systemd cannot set up its own hierarchy and
+# the container exits 255 immediately, with an empty `docker logs` — which is
+# a genuinely awful thing to debug, hence the comment.
+docker run -d --name "$NAME" --privileged --cgroupns=host \
+  --network=host \
+  -v /sys/fs/cgroup:/sys/fs/cgroup:rw --tmpfs /run --tmpfs /run/lock \
+  ${TARBALL:+-v "$TARBALL":/pkg.tgz:ro} \
+  -v "$REPO/target/release/failproofaid":/opt/failproofaid:ro \
+  "$IMAGE" >/dev/null
+# Wait for systemd to finish booting, or `systemctl` answers nothing useful.
+until docker exec "$NAME" systemctl is-system-running 2>/dev/null | grep -qE 'running|degraded'; do
+  if ! docker ps --filter "name=$NAME" --format '{{.Names}}' | grep -q "$NAME"; then
+    echo "  container died during boot — cgroup v2 flags wrong for this host?"
+    docker logs "$NAME" 2>&1 | tail -5
+    exit 1
+  fi
+  sleep 1
+done
+echo "  systemd: $(docker exec "$NAME" systemctl is-system-running 2>/dev/null)"
+
+# ── 3. Node, and a NON-ROOT user to run as ───────────────────────────────────
+say "Installing Node + creating an unprivileged user"
+docker exec "$NAME" bash -lc '
+  apt-get update -qq >/dev/null 2>&1
+  apt-get install -y -qq curl ca-certificates sudo >/dev/null 2>&1
+  curl -fsSL https://deb.nodesource.com/setup_22.x -o /tmp/n.sh 2>/dev/null && bash /tmp/n.sh >/dev/null 2>&1
+  apt-get install -y -qq nodejs >/dev/null 2>&1
+  node --version
+' 2>&1 | sed 's/^/  node /'
+
+docker exec "$NAME" bash -lc "
+  id $USER_IN_BOX >/dev/null 2>&1 || useradd -m -s /bin/bash $USER_IN_BOX
+  # Passwordless sudo: the daemon install needs root, and we are testing the
+  # INSTALL, not whether a human can type a password.
+  echo '$USER_IN_BOX ALL=(ALL) NOPASSWD:ALL' > /etc/sudoers.d/$USER_IN_BOX
+  chmod 440 /etc/sudoers.d/$USER_IN_BOX
+"
+
+# ── 4. Install globally AS ROOT — the shape that exposes ownership bugs ──────
+say "npm install -g (as root)"
+if [ "$PUBLISHED" -eq 1 ]; then
+  docker exec "$NAME" bash -lc "npm install -g failproofai@$VERSION 2>&1 | tail -4"
+else
+  docker exec "$NAME" bash -lc "npm install -g /pkg.tgz 2>&1 | tail -4"
+fi
+
+say "Who owns the global install?"
+docker exec "$NAME" bash -lc '
+  P=$(npm root -g)/failproofai
+  stat -c "  %U:%G %a  %n" "$P" 2>/dev/null
+  stat -c "  %U:%G %a  %n" "$P/dist" 2>/dev/null
+'
+
+# ── 5. Hand over, running as the unprivileged user ───────────────────────────
+say "Ready"
+cat <<EOF
+
+  The box is up as container "$NAME". Everything below runs as the
+  UNPRIVILEGED user, against a root-owned global install — the real shape.
+
+  Shell in:
+    docker exec -it -u $USER_IN_BOX $NAME bash -l
+
+  Then, inside:
+    failproofai --version
+    failproofai config          # real systemd service install
+    systemctl status failproofaid@$USER_IN_BOX
+
+  The daemon binary is mounted at /opt/failproofaid. There is no GitHub
+  release for $VERSION, so point the CLI at it rather than letting it try
+  to download one:
+    export FAILPROOFAI_DAEMON_BINARY=/opt/failproofaid
+
+  Fire a hook exactly as an agent CLI would:
+    printf '{"session_id":"s","cwd":"'"\$PWD"'","hook_event_name":"PreToolUse",
+    "tool_name":"Bash","tool_input":{"command":"sudo rm -rf /"}}' \\
+      | failproofai --hook PreToolUse --cli claude
+
+  Tear down:
+    docker rm -f $NAME
+
+EOF

package/scripts/translate-docs/cache.ts

@@ -2,7 +2,7 @@ import { createHash } from "node:crypto";
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
-import type { CacheEntry, TranslationCache } from "./types";
+import type { TranslationCache } from "./types";
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const CACHE_FILE = join(__dirname, ".translation-cache.json");

package/scripts/translate-docs/cli.ts

@@ -1,6 +1,6 @@
 #!/usr/bin/env bun
 import { parseArgs } from "node:util";
-import { existsSync, readdirSync, readFileSync } from "node:fs";
+import { existsSync, readFileSync } from "node:fs";
 import { dirname, join, relative } from "node:path";
 import { fileURLToPath } from "node:url";
 import {
@@ -297,7 +297,7 @@ async function main() {
 
     // Translate uncached pages with concurrency limit
     if (uncachedTasks.length > 0) {
-      const taskResults = await runWithConcurrency(
+      await runWithConcurrency(
         uncachedTasks.map(({ page, relPath, lang }) => async () => {
           try {
             const result = await translateMdxPage(page, lang, {

package/scripts/translate-docs/mintlify-nav.ts

@@ -1,7 +1,7 @@
 import { readFileSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
-import { getLanguageByCode, NAV_TRANSLATIONS, LANGUAGES } from "./config";
+import { getLanguageByCode, NAV_TRANSLATIONS } from "./config";
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const DOCS_JSON_PATH = join(__dirname, "..", "..", "docs", "docs.json");

package/scripts/translate-docs/readme-translator.ts

@@ -17,6 +17,158 @@ const ROOT_DIR = join(__dirname, "..", "..");
 const README_PATH = join(ROOT_DIR, "README.md");
 const I18N_DIR = join(ROOT_DIR, "docs", "i18n");
 
+/**
+ * Prefix that walks from `docs/i18n/` back to the repo root. Keep in sync with
+ * I18N_DIR — the disclaimer and language selector already hard-code the same
+ * two levels in their `../../README.md` links.
+ */
+const TO_REPO_ROOT = "../../";
+
+/** Raw-content base for repo files that must resolve off-GitHub too. */
+const RAW_BASE = "https://raw.githubusercontent.com/FailproofAI/failproofai/main/";
+
+const ASSET_RE = /\.(?:png|jpe?g|gif|svg|webp|ico|mp4|webm)$/i;
+
+/**
+ * Re-point the root README's repo-root-relative paths so they still resolve
+ * from `docs/i18n/README.<lang>.md`, two directories deeper.
+ *
+ * The root README lives AT the repo root, so it writes `readme-arch-hq.gif` and
+ * `assets/logos/claude.svg` — correct there. The translator is prompt-forbidden
+ * from touching paths ("Preserve all URLs and paths", translator.ts), and
+ * rightly so, but that means every translated copy inherited those paths
+ * verbatim into a directory two levels down, where they resolve against
+ * `docs/i18n/`. Both consumers 404'd: GitHub asked for
+ * `docs/i18n/assets/logos/claude.svg` and Mintlify (which also serves these
+ * pages, unlisted, at `/i18n/README.<lang>`) asked S3 for `exosphere/i18n/...`.
+ * Every logo and the architecture GIF were broken in all 14 languages.
+ *
+ * The two ref kinds get different treatment because they resolve in different
+ * places:
+ *  - IMAGES become absolute raw.githubusercontent URLs. A `../../` relative
+ *    path would fix GitHub but not Mintlify, whose copy of the page has no
+ *    `assets/` tree above it to walk into — an absolute URL is the only form
+ *    that renders on BOTH surfaces.
+ *  - DOCUMENT links (`./LICENSE`, `./CONTRIBUTING.md`, the translations row's
+ *    `./docs/i18n/README.*.md`) get the `../../` prefix instead. GitHub is the
+ *    only surface where a link to a repo file resolves at all, and a raw URL
+ *    there would serve unrendered plaintext.
+ *
+ * Left alone: absolute URLs, anchors, `mailto:`, protocol-relative `//`,
+ * site-absolute `/`, anything already starting with `../`, and everything
+ * inside a fenced code block (where a path is literal sample text, not a ref).
+ */
+export function rebaseReadmePaths(content: string): string {
+  // Recomputed before each pass. `String.replace` reports offsets into the
+  // string it is scanning, so one map is valid for a whole pass — but a pass
+  // that rewrites a path AHEAD of a fence lengthens the text and shifts that
+  // fence, leaving offsets from the previous string pointing short. The next
+  // pass would then read a literal `<img src=…>` inside a fence as ordinary
+  // markup and rewrite the sample path this guard exists to protect.
+  let fenceRanges = findFenceRanges(content);
+  const insideFence = (offset: number): boolean =>
+    fenceRanges.some(([start, end]) => offset >= start && offset < end);
+
+  const rebase = (path: string): string | null => {
+    if (path === "" || /^[a-z][a-z0-9+.-]*:/i.test(path)) return null; // scheme
+    if (path.startsWith("#") || path.startsWith("/")) return null; // anchor, site-absolute
+    if (path.startsWith("../")) return null; // already rebased
+    const bare = path.replace(/^\.\//, "");
+    if (bare === "" || bare.startsWith("../")) return null;
+    return ASSET_RE.test(bare.split(/[?#]/)[0])
+      ? `${RAW_BASE}${bare}`
+      : `${TO_REPO_ROOT}${bare}`;
+  };
+
+  // Markdown links and images: `](path)` / `](path "title")`.
+  let out = content.replace(
+    /(\]\()([^)\s]+)/g,
+    (match, prefix: string, path: string, offset: number) => {
+      if (insideFence(offset)) return match;
+      const next = rebase(path);
+      return next === null ? match : `${prefix}${next}`;
+    },
+  );
+
+  // HTML/JSX attributes: the README's logo table is a raw <table> of <img>.
+  fenceRanges = findFenceRanges(out);
+  out = out.replace(
+    /((?:src|href)=(["']))(.*?)\2/g,
+    (match, prefix: string, quote: string, path: string, offset: number) => {
+      if (insideFence(offset)) return match;
+      const next = rebase(path);
+      return next === null ? match : `${prefix}${next}${quote}`;
+    },
+  );
+
+  // `srcset` needs its own pass: each logo cell is a <picture> whose dark-mode
+  // <source srcset="assets/logos/*-dark.svg"> sits beside the <img src>. Miss
+  // it and half the table stays broken for dark-theme readers only — the half
+  // least likely to be noticed in review.
+  fenceRanges = findFenceRanges(out);
+  out = out.replace(
+    /(srcset=(["']))(.*?)\2/g,
+    (match, prefix: string, quote: string, value: string, offset: number) => {
+      if (insideFence(offset)) return match;
+      return `${prefix}${rebaseSrcset(value)}${quote}`;
+    },
+  );
+
+  return out;
+
+  /**
+   * Rebase every candidate in a `srcset` value, preserving each one's optional
+   * density/width descriptor (`logo.svg 2x`, `wide.png 800w`) and the original
+   * comma spacing.
+   */
+  function rebaseSrcset(value: string): string {
+    return value
+      .split(",")
+      .map((candidate) => {
+        const [, lead, url, descriptor] =
+          /^(\s*)(\S+)(.*)$/.exec(candidate) ?? [];
+        if (url === undefined) return candidate; // whitespace-only candidate
+        const next = rebase(url);
+        return `${lead}${next ?? url}${descriptor}`;
+      })
+      .join(",");
+  }
+}
+
+/**
+ * Byte ranges covered by fenced code blocks, per CommonMark: a fence opens with
+ * ≥3 backticks or tildes and closes only on a later line using the SAME
+ * character at ≥ the same length.
+ *
+ * Follows the scanner in `mdx-translator.convertHtmlComments`, with one
+ * correction: a CLOSING fence may carry only trailing whitespace, never an info
+ * string. Accepting ```` ```ts ```` as a close would end the block at the first
+ * *nested* opener inside it and leave the real code that follows looking like
+ * prose — whose sample paths this function exists to protect.
+ */
+function findFenceRanges(content: string): Array<[number, number]> {
+  const ranges: Array<[number, number]> = [];
+  const fenceRe = /^[ \t]*(`{3,}|~{3,})([^\n]*)$/gm;
+  let match: RegExpExecArray | null;
+  let open: { char: string; length: number; start: number } | null = null;
+  while ((match = fenceRe.exec(content)) !== null) {
+    const [, marker, rest] = match;
+    if (!open) {
+      open = { char: marker[0], length: marker.length, start: match.index };
+    } else if (
+      marker[0] === open.char &&
+      marker.length >= open.length &&
+      rest.trim() === ""
+    ) {
+      const lineEnd = content.indexOf("\n", fenceRe.lastIndex);
+      ranges.push([open.start, lineEnd === -1 ? content.length : lineEnd]);
+      open = null;
+    }
+  }
+  if (open) ranges.push([open.start, content.length]);
+  return ranges;
+}
+
 function buildLanguageSelector(currentLang: string): string {
   const flags: Record<string, string> = {
     en: "\ud83c\uddfa\ud83c\uddf8",
@@ -117,10 +269,17 @@ export async function translateReadme(
         // Same MDX sanitizers as translateMdxPage — the README emits JSX (the
         // logo table), so strip stray attribute quotes, drop any unmatched
         // trailing code fence (which would swallow the RTL `</div>`), and
-        // convert HTML comments to MDX — then wrap in disclaimer + selector +
-        // RTL div.
-        const cleaned = convertHtmlComments(
-          stripStrayTrailingFence(sanitizeJsxAttributes(raw)),
+        // convert HTML comments to MDX — then re-point the root README's
+        // repo-root-relative paths for this file's depth, and wrap in
+        // disclaimer + selector + RTL div.
+        //
+        // The rebase runs on the model output ONLY, never on the wrapper: the
+        // disclaimer's `../../README.md` and the selector's sibling
+        // `README.<lang>.md` links are already written for `docs/i18n/`.
+        const cleaned = rebaseReadmePaths(
+          convertHtmlComments(
+            stripStrayTrailingFence(sanitizeJsxAttributes(raw)),
+          ),
         );
         return `${disclaimer}\n\n${langSelector}\n\n---\n${rtlOpen}\n${cleaned}\n${rtlClose}`;
       },