failproofai 1.0.0-beta.2 → 1.0.0-beta.21

package/.next/standalone/crates/fpai-ipc/src/envelope.rs

@@ -1,175 +0,0 @@
-//! The JSON envelope carried inside each [`crate::framing`] frame.
-//!
-//! This mirrors the `(argv --hook <Event> --cli <cli>, stdin JSON payload)
-//! -> (stdout, stderr, exitCode)` contract every hook invocation already
-//! has today — see `src/hooks/handler.ts`'s `handleHookEvent`. The daemon
-//! adds nothing to that contract; it only relays it over a socket instead
-//! of a fresh process's argv/stdin/stdout.
-
-use serde::{Deserialize, Serialize};
-
-/// Bumped whenever a wire-incompatible change is made to either message
-/// enum below. The client treats any mismatch identically to "daemon
-/// unreachable" (see `docs/configuration.mdx` and the failproofaid plan) —
-/// there is no negotiation, only agree-or-fall-back.
-pub const PROTOCOL_VERSION: u32 = 1;
-
-#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
-#[serde(tag = "type", rename_all = "camelCase")]
-pub enum ClientMessage {
-    /// Cheap liveness/handshake check — used by tests and by a client that
-    /// only wants to confirm a compatible daemon is listening.
-    #[serde(rename_all = "camelCase")]
-    Ping { protocol_version: u32 },
-    /// One hook evaluation request, corresponding 1:1 to one
-    /// `failproofai --hook <Event> --cli <cli>` invocation.
-    #[serde(rename_all = "camelCase")]
-    Hook {
-        protocol_version: u32,
-        hook_event: String,
-        cli: String,
-        /// The raw stdin payload the calling agent CLI wrote to the
-        /// one-shot `failproofai` process — forwarded verbatim.
-        stdin: String,
-        /// Best-effort cwd of the *originating* CLI process, not the
-        /// daemon's own cwd (the daemon is a single long-lived process; its
-        /// own `cwd` does not vary per request and must never be used to
-        /// resolve project config or custom policies).
-        cwd: Option<String>,
-    },
-}
-
-#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
-#[serde(tag = "type", rename_all = "camelCase")]
-pub enum ServerMessage {
-    #[serde(rename_all = "camelCase")]
-    Pong { protocol_version: u32 },
-    #[serde(rename_all = "camelCase")]
-    HookResult {
-        protocol_version: u32,
-        exit_code: i32,
-        stdout: String,
-        stderr: String,
-    },
-    /// The daemon accepted the connection and parsed the request, but could
-    /// not produce a verdict (e.g. the worker is down/hung). Distinct from
-    /// `HookResult` so a client can tell "ran and decided" apart from
-    /// "daemon couldn't evaluate at all" — the latter is what drives the
-    /// client's fail-closed path.
-    #[serde(rename_all = "camelCase")]
-    Error {
-        protocol_version: u32,
-        message: String,
-    },
-}
-
-impl ClientMessage {
-    pub fn protocol_version(&self) -> u32 {
-        match self {
-            ClientMessage::Ping { protocol_version } => *protocol_version,
-            ClientMessage::Hook {
-                protocol_version, ..
-            } => *protocol_version,
-        }
-    }
-}
-
-impl ServerMessage {
-    pub fn protocol_version(&self) -> u32 {
-        match self {
-            ServerMessage::Pong { protocol_version } => *protocol_version,
-            ServerMessage::HookResult {
-                protocol_version, ..
-            } => *protocol_version,
-            ServerMessage::Error {
-                protocol_version, ..
-            } => *protocol_version,
-        }
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn ping_serializes_with_a_type_tag() {
-        let msg = ClientMessage::Ping {
-            protocol_version: PROTOCOL_VERSION,
-        };
-        let json = serde_json::to_value(&msg).unwrap();
-        assert_eq!(json["type"], "ping");
-        assert_eq!(json["protocolVersion"], PROTOCOL_VERSION);
-    }
-
-    #[test]
-    fn hook_request_uses_camel_case_field_names_on_the_wire() {
-        let msg = ClientMessage::Hook {
-            protocol_version: PROTOCOL_VERSION,
-            hook_event: "PreToolUse".to_string(),
-            cli: "claude".to_string(),
-            stdin: "{}".to_string(),
-            cwd: Some("/repo".to_string()),
-        };
-        let json = serde_json::to_value(&msg).unwrap();
-        assert_eq!(json["type"], "hook");
-        assert_eq!(json["hookEvent"], "PreToolUse");
-        assert_eq!(json["cli"], "claude");
-        assert_eq!(json["cwd"], "/repo");
-    }
-
-    #[test]
-    fn hook_request_cwd_is_optional() {
-        let json = serde_json::json!({
-            "type": "hook",
-            "protocolVersion": 1,
-            "hookEvent": "Stop",
-            "cli": "codex",
-            "stdin": "{}"
-        });
-        let msg: ClientMessage = serde_json::from_value(json).unwrap();
-        match msg {
-            ClientMessage::Hook { cwd, .. } => assert_eq!(cwd, None),
-            _ => panic!("expected Hook variant"),
-        }
-    }
-
-    #[test]
-    fn unknown_message_type_fails_to_deserialize() {
-        let json = serde_json::json!({ "type": "bogus", "protocolVersion": 1 });
-        let result: Result<ClientMessage, _> = serde_json::from_value(json);
-        assert!(result.is_err());
-    }
-
-    #[test]
-    fn server_hook_result_round_trips() {
-        let msg = ServerMessage::HookResult {
-            protocol_version: PROTOCOL_VERSION,
-            exit_code: 2,
-            stdout: String::new(),
-            stderr: "blocked".to_string(),
-        };
-        let json = serde_json::to_string(&msg).unwrap();
-        let decoded: ServerMessage = serde_json::from_str(&json).unwrap();
-        assert_eq!(decoded, msg);
-    }
-
-    #[test]
-    fn protocol_version_accessor_matches_every_variant() {
-        assert_eq!(
-            ClientMessage::Ping {
-                protocol_version: 7
-            }
-            .protocol_version(),
-            7
-        );
-        assert_eq!(
-            ServerMessage::Error {
-                protocol_version: 9,
-                message: "x".to_string()
-            }
-            .protocol_version(),
-            9
-        );
-    }
-}

package/.next/standalone/crates/fpai-ipc/src/framing.rs

@@ -1,177 +0,0 @@
-//! Length-prefixed JSON framing shared by the daemon and every client of it.
-//!
-//! Frame = 4-byte big-endian `u32` byte length, followed by that many bytes
-//! of UTF-8 JSON. One frame in, one frame out, per connection — the daemon
-//! never keeps a connection open across multiple logical requests, so there
-//! is no need for a request-id-multiplexed protocol.
-
-use serde::Serialize;
-use serde::de::DeserializeOwned;
-use std::io::{self, Read, Write};
-
-/// Hard cap on a single frame's declared length. A hook payload is at most
-/// 1 MiB (see `handler.ts`'s own stdin cap); 16 MiB leaves headroom without
-/// letting a corrupt or hostile length prefix trigger an unbounded
-/// allocation before a single byte of the body has even been read.
-pub const MAX_FRAME_LEN: u32 = 16 * 1024 * 1024;
-
-#[derive(Debug)]
-pub enum FramingError {
-    Io(io::Error),
-    FrameTooLarge { declared: u32, max: u32 },
-    Json(serde_json::Error),
-}
-
-impl std::fmt::Display for FramingError {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        match self {
-            FramingError::Io(e) => write!(f, "io error: {e}"),
-            FramingError::FrameTooLarge { declared, max } => {
-                write!(f, "frame length {declared} exceeds max {max}")
-            }
-            FramingError::Json(e) => write!(f, "invalid JSON frame: {e}"),
-        }
-    }
-}
-
-impl std::error::Error for FramingError {}
-
-impl From<io::Error> for FramingError {
-    fn from(e: io::Error) -> Self {
-        FramingError::Io(e)
-    }
-}
-
-impl From<serde_json::Error> for FramingError {
-    fn from(e: serde_json::Error) -> Self {
-        FramingError::Json(e)
-    }
-}
-
-/// Serializes `value` to JSON and writes it as one length-prefixed frame.
-pub fn write_message<W: Write, T: Serialize>(
-    writer: &mut W,
-    value: &T,
-) -> Result<(), FramingError> {
-    let body = serde_json::to_vec(value)?;
-    let len = u32::try_from(body.len()).map_err(|_| FramingError::FrameTooLarge {
-        declared: u32::MAX,
-        max: MAX_FRAME_LEN,
-    })?;
-    if len > MAX_FRAME_LEN {
-        return Err(FramingError::FrameTooLarge {
-            declared: len,
-            max: MAX_FRAME_LEN,
-        });
-    }
-    writer.write_all(&len.to_be_bytes())?;
-    writer.write_all(&body)?;
-    writer.flush()?;
-    Ok(())
-}
-
-/// Reads one length-prefixed frame and deserializes it as `T`. Rejects the
-/// frame (without allocating a body buffer) if the declared length exceeds
-/// [`MAX_FRAME_LEN`], so a corrupt or adversarial length prefix can't be
-/// used to force a large allocation.
-pub fn read_message<R: Read, T: DeserializeOwned>(reader: &mut R) -> Result<T, FramingError> {
-    let mut len_bytes = [0u8; 4];
-    reader.read_exact(&mut len_bytes)?;
-    let len = u32::from_be_bytes(len_bytes);
-    if len > MAX_FRAME_LEN {
-        return Err(FramingError::FrameTooLarge {
-            declared: len,
-            max: MAX_FRAME_LEN,
-        });
-    }
-    let mut body = vec![0u8; len as usize];
-    reader.read_exact(&mut body)?;
-    let value = serde_json::from_slice(&body)?;
-    Ok(value)
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use serde::Deserialize;
-    use std::io::Cursor;
-
-    #[derive(Debug, Serialize, Deserialize, PartialEq)]
-    struct Sample {
-        a: u32,
-        b: String,
-    }
-
-    #[test]
-    fn round_trips_a_simple_value() {
-        let mut buf = Vec::new();
-        let msg = Sample {
-            a: 42,
-            b: "hello".to_string(),
-        };
-        write_message(&mut buf, &msg).unwrap();
-        let mut cursor = Cursor::new(buf);
-        let decoded: Sample = read_message(&mut cursor).unwrap();
-        assert_eq!(decoded, msg);
-    }
-
-    #[test]
-    fn round_trips_empty_string_fields() {
-        let mut buf = Vec::new();
-        let msg = Sample {
-            a: 0,
-            b: String::new(),
-        };
-        write_message(&mut buf, &msg).unwrap();
-        let mut cursor = Cursor::new(buf);
-        let decoded: Sample = read_message(&mut cursor).unwrap();
-        assert_eq!(decoded, msg);
-    }
-
-    #[test]
-    fn rejects_a_declared_length_over_the_cap_without_reading_a_body() {
-        let mut buf = Vec::new();
-        buf.extend_from_slice(&(MAX_FRAME_LEN + 1).to_be_bytes());
-        // Deliberately no body bytes follow — if `read_message` tried to
-        // allocate/read the declared length before checking the cap, this
-        // would hang or panic on the short read instead of erroring cleanly.
-        let mut cursor = Cursor::new(buf);
-        let result: Result<Sample, _> = read_message(&mut cursor);
-        assert!(matches!(result, Err(FramingError::FrameTooLarge { .. })));
-    }
-
-    #[test]
-    fn refuses_to_write_a_frame_over_the_cap() {
-        #[derive(Serialize)]
-        struct Big {
-            data: String,
-        }
-        let big = Big {
-            data: "x".repeat((MAX_FRAME_LEN as usize) + 1),
-        };
-        let mut buf = Vec::new();
-        let result = write_message(&mut buf, &big);
-        assert!(matches!(result, Err(FramingError::FrameTooLarge { .. })));
-    }
-
-    #[test]
-    fn rejects_truncated_frames() {
-        let mut buf = Vec::new();
-        buf.extend_from_slice(&10u32.to_be_bytes());
-        buf.extend_from_slice(b"short"); // fewer than the declared 10 bytes
-        let mut cursor = Cursor::new(buf);
-        let result: Result<Sample, _> = read_message(&mut cursor);
-        assert!(matches!(result, Err(FramingError::Io(_))));
-    }
-
-    #[test]
-    fn rejects_malformed_json_inside_a_valid_frame() {
-        let mut buf = Vec::new();
-        let body = b"not json";
-        buf.extend_from_slice(&(body.len() as u32).to_be_bytes());
-        buf.extend_from_slice(body);
-        let mut cursor = Cursor::new(buf);
-        let result: Result<Sample, _> = read_message(&mut cursor);
-        assert!(matches!(result, Err(FramingError::Json(_))));
-    }
-}

package/.next/standalone/crates/fpai-ipc/src/lib.rs

@@ -1,10 +0,0 @@
-//! Wire protocol shared by `failproofaid` and every client/test that talks
-//! to it: message framing, the JSON envelope, and Unix-socket peer
-//! verification.
-
-pub mod envelope;
-pub mod framing;
-pub mod peer;
-
-pub use envelope::{ClientMessage, PROTOCOL_VERSION, ServerMessage};
-pub use framing::{FramingError, MAX_FRAME_LEN, read_message, write_message};

package/.next/standalone/crates/fpai-ipc/src/peer.rs

@@ -1,80 +0,0 @@
-//! Verifies that a Unix socket peer is running as the same OS user as this
-//! process.
-//!
-//! failproofaid is user-scope only (see the plan: "no elevation, the daemon
-//! spawns the worker because the daemon already runs as the user"): the
-//! socket directory is `0700` and the socket file `0600`, which is the
-//! actual access-control boundary. This check is a second, defense-in-depth
-//! layer against the narrow window between a socket file existing and its
-//! permissions having been fully applied, and against misconfigured
-//! filesystems (e.g. a shared mount with unexpectedly loose permissions).
-//! It is not a stronger security boundary than the filesystem permissions
-//! already provide — same OS user can always reach this daemon regardless.
-
-use std::io;
-use std::os::unix::io::AsRawFd;
-use std::os::unix::net::UnixStream;
-
-/// Returns the effective UID of the process on the other end of `stream`.
-#[cfg(target_os = "linux")]
-pub fn peer_uid(stream: &UnixStream) -> io::Result<u32> {
-    use std::mem;
-
-    let fd = stream.as_raw_fd();
-    let mut cred: libc::ucred = unsafe { mem::zeroed() };
-    let mut len = mem::size_of::<libc::ucred>() as libc::socklen_t;
-
-    let ret = unsafe {
-        libc::getsockopt(
-            fd,
-            libc::SOL_SOCKET,
-            libc::SO_PEERCRED,
-            &mut cred as *mut libc::ucred as *mut libc::c_void,
-            &mut len,
-        )
-    };
-    if ret != 0 {
-        return Err(io::Error::last_os_error());
-    }
-    Ok(cred.uid)
-}
-
-/// Returns the effective UID of the process on the other end of `stream`.
-#[cfg(target_os = "macos")]
-pub fn peer_uid(stream: &UnixStream) -> io::Result<u32> {
-    let fd = stream.as_raw_fd();
-    let mut uid: libc::uid_t = 0;
-    let mut gid: libc::gid_t = 0;
-
-    let ret = unsafe { libc::getpeereid(fd, &mut uid, &mut gid) };
-    if ret != 0 {
-        return Err(io::Error::last_os_error());
-    }
-    Ok(uid)
-}
-
-/// Returns this process's own effective UID, for comparison against
-/// [`peer_uid`].
-pub fn own_uid() -> u32 {
-    unsafe { libc::geteuid() }
-}
-
-/// `true` if `stream`'s peer is running as this process's own OS user.
-pub fn is_same_user(stream: &UnixStream) -> io::Result<bool> {
-    Ok(peer_uid(stream)? == own_uid())
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn a_local_socketpair_peer_is_always_the_same_user() {
-        // socketpair() connects two ends of the same process — the peer
-        // UID must equal our own, on every CI runner regardless of who's
-        // executing the test.
-        let (a, _b) = UnixStream::pair().unwrap();
-        assert!(is_same_user(&a).unwrap());
-        assert_eq!(peer_uid(&a).unwrap(), own_uid());
-    }
-}

package/.next/standalone/docker-hook-sync/Dockerfile

@@ -1,79 +0,0 @@
-# Self-contained failproofai hook-sync container.
-#
-# A single-shot daily job (run by a k8s CronJob) that clones failproofai, runs
-# Claude Code in `--effort ultracode` mode to detect drift between every agent-CLI
-# harness we integrate with and this repo, and opens ONE auto-PR with the fix.
-#
-# Bundles:
-#   - Node 20 + npm (npm is a fallback bun installer for scripts/dev-hook.mjs;
-#     node runs the launcher itself)
-#   - bun (STILL REQUIRED: the cloned repo's .claude/settings.json fires hooks via
-#     `node "$CLAUDE_PROJECT_DIR/scripts/dev-hook.mjs" --hook <Event>`, and that
-#     launcher only *locates* bun — it cannot conjure one. Without this layer the
-#     dogfooded require-*-before-stop policies never fire and the auto-PR is
-#     never committed/pushed. We install to BUN_INSTALL=/home/appuser/.bun, which
-#     the launcher probes explicitly, so enforcement survives a broken PATH.)
-#   - Claude Code CLI (`claude`) — run headless with --effort ultracode
-#   - failproofai@latest on PATH (belt-and-suspenders; the dogfood hooks actually
-#     run the clone's SOURCE via bun, not this global)
-#   - git + gh + jq + dumb-init + `script` (PTY wrap for stream-json)
-#
-# Build:  docker build -t hook-sync:latest docker-hook-sync/
-# Run:    docker run --rm -e CLAUDE_CODE_OAUTH_TOKEN=... -e GH_TOKEN=... hook-sync:latest
-#
-# Every dependency is installed at build time. The daily GitHub Actions rebuild
-# (.github/workflows/build-image.yml) keeps claude-code@latest + failproofai@latest fresh.
-FROM node:20-bookworm-slim
-
-ENV DEBIAN_FRONTEND=noninteractive \
-    HOME=/home/appuser \
-    BUN_INSTALL=/home/appuser/.bun \
-    FAILPROOFAI_TELEMETRY_DISABLED=1 \
-    PATH="/home/appuser/.bun/bin:/home/appuser/.local/bin:${PATH}"
-
-# Layer 1: apt deps. dumb-init for PID 1 signal handling; git+gh for the agent's
-# clone/branch/push/PR flow AND the require-*-before-stop hooks; jq for the
-# entrypoint's policy-config edit; bsdextrautils provides `script` (PTY wrap so
-# Node line-flushes --output-format stream-json); curl/gnupg for the gh apt key
-# and the bun installer; unzip is required by the bun installer.
-RUN apt-get update \
- && apt-get install -y --no-install-recommends \
-        ca-certificates curl gnupg dumb-init jq git bsdextrautils unzip \
- && rm -rf /var/lib/apt/lists/*
-
-# Layer 2: GitHub CLI (gh). Used by the agent for `gh pr create/list` and by the
-# require-pr-before-stop hook.
-RUN install -d /etc/apt/keyrings \
- && curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg \
-        | gpg --dearmor -o /etc/apt/keyrings/githubcli-archive-keyring.gpg \
- && echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" \
-        > /etc/apt/sources.list.d/github-cli.list \
- && apt-get update \
- && apt-get install -y --no-install-recommends gh \
- && rm -rf /var/lib/apt/lists/*
-
-# Layer 3: npm globals. Claude Code CLI + failproofai, pinned to latest at build
-# time; the daily workflow rebuild keeps them fresh. Root install so symlinks land
-# in /usr/local/bin (executable by the non-root appuser).
-RUN npm install -g --omit=dev \
-        @anthropic-ai/claude-code@latest \
-        failproofai@latest \
- && npm cache clean --force
-
-# Layer 4: non-root user + chowned workspace.
-RUN useradd --create-home --uid 10001 --shell /bin/bash appuser \
- && mkdir -p /workspace \
- && chown -R appuser:appuser /workspace /home/appuser
-
-COPY entrypoint.sh /usr/local/bin/entrypoint.sh
-RUN chmod 0755 /usr/local/bin/entrypoint.sh
-
-USER appuser
-WORKDIR /home/appuser
-
-# Layer 5: bun (installs into $BUN_INSTALL=/home/appuser/.bun, on PATH per ENV).
-# The dogfood hook fast-path runs TypeScript from src/ directly — bun executes TS
-# natively, so no build step is needed for the hooks to work.
-RUN curl -fsSL https://bun.sh/install | bash
-
-ENTRYPOINT ["dumb-init", "--", "/usr/local/bin/entrypoint.sh"]

package/.next/standalone/docker-hook-sync/entrypoint.sh

@@ -1,109 +0,0 @@
-#!/usr/bin/env bash
-#
-# failproofai hook-sync entrypoint (runs as PID 1 under dumb-init).
-#
-# Lifecycle:
-#   1. Validate env (CLAUDE_CODE_OAUTH_TOKEN, GH_TOKEN).
-#   2. gh auth setup-git + git identity.
-#   3. Clone failproofai --depth=1; cut a fresh auto/sync-cli-harnesses-<UTC> branch.
-#   4. NEUTRALIZE two policies in the THROWAWAY clone's .failproofai config
-#      (require-ci-green-before-stop, block-read-outside-cwd) via jq, then
-#      `git update-index --skip-worktree` so the edit is invisible to
-#      git status/add and never enters the agent's commit/PR — while failproofai
-#      reads the edited WORKTREE file at runtime and sees them gone. The
-#      require-commit/push/pr-before-stop gates stay ACTIVE (dogfooding).
-#   5. exec `claude --effort ultracode -p <prompt>` wrapped in a PTY so
-#      --output-format stream-json line-flushes to `kubectl logs -f`.
-#   6. Exit with claude's return code (all output streams to stdout / the pod log).
-#
-# Exit codes: 0 = agent finished (claude's rc) · 64 = missing required env ·
-#             65 = prompt file missing in clone · 66 = unsafe WORKSPACE · else = claude's rc.
-set -euo pipefail
-
-CLAUDE_CODE_OAUTH_TOKEN="${CLAUDE_CODE_OAUTH_TOKEN:-}"
-GH_TOKEN="${GH_TOKEN:-}"
-REPO_URL="${REPO_URL:-https://github.com/failproofai/failproofai.git}"
-REPO_BRANCH_FROM="${REPO_BRANCH_FROM:-main}"
-WORKSPACE="${WORKSPACE:-/workspace}"
-PROMPT_PATH="${PROMPT_PATH:-scripts/sync-agent-cli-harnesses-prompt.md}"
-CLAUDE_MODEL="${CLAUDE_MODEL:-claude-opus-4-8}"
-
-export HOME="${HOME:-/home/appuser}"
-export CLAUDE_CODE_OAUTH_TOKEN
-export GH_TOKEN
-export GITHUB_TOKEN="${GITHUB_TOKEN:-$GH_TOKEN}"
-export FAILPROOFAI_TELEMETRY_DISABLED=1
-# Keep ultracode background subagents alive in headless -p mode (default is ~10 min).
-export CLAUDE_CODE_PRINT_BG_WAIT_CEILING_MS="${CLAUDE_CODE_PRINT_BG_WAIT_CEILING_MS:-1800000}"
-
-log() { printf '[entrypoint %s] %s\n' "$(date -u +%FT%TZ)" "$*"; }
-
-# ---------------- 1. env validation ----------------
-if [ -z "$CLAUDE_CODE_OAUTH_TOKEN" ]; then log "ERROR: CLAUDE_CODE_OAUTH_TOKEN not set"; exit 64; fi
-if [ -z "$GH_TOKEN" ]; then log "ERROR: GH_TOKEN not set"; exit 64; fi
-
-# ---------------- 2. gh + git auth ----------------
-log "authenticating gh"
-gh auth setup-git >/dev/null
-git config --global user.name  "failproofai-hook-sync"
-git config --global user.email "hook-sync-bot@exosphere.host"
-git config --global init.defaultBranch main
-
-# ---------------- 3. clone + fresh branch ----------------
-case "$WORKSPACE" in
-  ""|"/"|"."|"..") log "ERROR: refusing unsafe WORKSPACE '$WORKSPACE'"; exit 66 ;;
-esac
-mkdir -p "$WORKSPACE"
-if [ -n "$(ls -A "$WORKSPACE" 2>/dev/null)" ]; then
-  find "$WORKSPACE" -mindepth 1 -maxdepth 1 -exec rm -rf {} +
-fi
-log "cloning $REPO_URL@$REPO_BRANCH_FROM -> $WORKSPACE"
-git clone --depth=1 --branch "$REPO_BRANCH_FROM" "$REPO_URL" "$WORKSPACE"
-cd "$WORKSPACE"
-# Fetch the base ref (shallow) so require-*-before-stop can diff against origin/<base>.
-git fetch --depth=1 origin "$REPO_BRANCH_FROM" >/dev/null 2>&1 || true
-BRANCH="auto/sync-cli-harnesses-$(date -u +%Y%m%dT%H%M%SZ)"
-git checkout -b "$BRANCH"
-log "working on branch $BRANCH"
-
-# ---------------- 4. policy-config neutralization ----------------
-# enabledPolicies is a UNION across scopes with no disable field, so a policy must
-# be removed from the file that lists it. --skip-worktree then hides that edit from
-# git status/add (so it never lands in the PR) while failproofai still reads the
-# edited worktree file at runtime. Keeps require-commit/push/pr-before-stop active.
-CFG=".failproofai/policies-config.json"
-if [ -f "$CFG" ]; then
-  cfg_tmp="$(mktemp)"
-  jq '.enabledPolicies |= map(select(. != "require-ci-green-before-stop" and . != "block-read-outside-cwd"))' "$CFG" > "$cfg_tmp" && mv "$cfg_tmp" "$CFG"
-  git update-index --skip-worktree "$CFG"
-  log "neutralized require-ci-green-before-stop + block-read-outside-cwd for this run (skip-worktree; not committed)"
-else
-  log "WARN: $CFG not found; running with the repo's default policy set"
-fi
-
-# ---------------- 5. invoke claude (ULTRACODE, headless, PTY-wrapped) ----------------
-PROMPT_FILE="$WORKSPACE/$PROMPT_PATH"
-if [ ! -f "$PROMPT_FILE" ]; then log "ERROR: prompt missing at $PROMPT_FILE"; exit 65; fi
-
-# Node block-buffers stdout when it's a pipe; `script -qefc ... /dev/null` gives
-# claude a PTY so --output-format stream-json line-flushes to the pod logs. `-e`
-# ties script's exit code to claude's.
-RUN_SH="$(mktemp /tmp/run-claude.XXXXXX.sh)"
-cat >"$RUN_SH" <<EOF
-#!/usr/bin/env bash
-exec claude --effort ultracode --model ${CLAUDE_MODEL} \\
-    --verbose --output-format stream-json \\
-    --dangerously-skip-permissions \\
-    -p "\$(cat "$PROMPT_FILE")" 2>&1
-EOF
-chmod +x "$RUN_SH"
-
-log "invoking claude --effort ultracode --model ${CLAUDE_MODEL} (prompt: $PROMPT_PATH)"
-set +e
-script -qefc "$RUN_SH" /dev/null
-rc=$?
-set -e
-rm -f "$RUN_SH"
-log "claude exited $rc"
-
-exit "$rc"

package/.next/standalone/integration-suite/Dockerfile

@@ -1,47 +0,0 @@
-# failproofai CLI-canary sandbox — base image
-#
-# Design goals (see failproofai-cli-canary-design.md §4):
-#   - SAFE:  non-root user, NO sudo installed, no host FS mounted at runtime.
-#            The canary fires `sudo whoami` / `.env`-read deny-probes; here they
-#            are inert BY CONSTRUCTION even on a day enforcement is broken.
-#   - LIGHT: ephemeral daily container (`docker run --rm`), not a daemon.
-#            Only this image + one named volume persist; zero idle CPU/RAM.
-#   - FRESH: CLIs are NOT baked in — they are `@latest`-installed into the
-#            persistent HOME volume at run time (the whole point of the canary),
-#            so this base image rebuilds rarely.
-#
-# The HOME volume (mounted at /home/canary) holds: npm-global CLIs, every
-# vendor login/token, and per-CLI config — so logins survive across daily runs.
-
-FROM node:22-bookworm-slim
-
-# bun from the official image — no `curl | bash` needed at build time.
-COPY --from=oven/bun:latest /usr/local/bin/bun /usr/local/bin/bun
-
-# Minimal tooling for the various vendor CLI installers. Deliberately NO sudo.
-# Tooling for the various vendor installers. Deliberately NO sudo.
-#   bzip2/xz-utils : goose extracts its Rust binary with these
-#   libsecret-1-0  : antigravity caches login tokens via libsecret (best-effort)
-RUN apt-get update -qq \
- && apt-get install -y -qq --no-install-recommends \
-      git ca-certificates curl unzip bzip2 xz-utils libsecret-1-0 \
- && rm -rf /var/lib/apt/lists/*
-
-# Unprivileged user. HOME is the mount point for the persistent named volume;
-# because the image ships a canary-owned /home/canary, an empty named volume
-# mounted here is initialised canary-owned (Docker copies image content+owner).
-# node:22-slim already ships a `node` user at UID 1000, so pin canary to 1001.
-RUN useradd --create-home --uid 1001 --shell /bin/bash canary
-USER canary
-WORKDIR /home/canary
-RUN mkdir -p /home/canary/.npm-global/bin /home/canary/.local/bin
-
-# NPM_CONFIG_PREFIX via ENV (not `npm config set`) so it survives the volume
-# mount shadowing /home/canary at runtime. Runtime `npm i -g` lands in the volume.
-ENV NPM_CONFIG_PREFIX=/home/canary/.npm-global
-ENV PATH=/home/canary/.npm-global/bin:/home/canary/.local/bin:/usr/local/bin:/usr/bin:/bin
-
-# Sanity: fail the build if bun/node/npm aren't all runnable as the canary user.
-RUN bun --version && node --version && npm --version
-
-CMD ["bash"]