failproofai 1.0.0-beta.2 → 1.0.0-beta.3

package/.next/standalone/crates/fpai-collect/src/config.rs

@@ -0,0 +1,412 @@
+//! Collector configuration: where to send events, and what to collect.
+//!
+//! # Two files, on purpose
+//!
+//! The credential lives alone in `~/.failproofai/ingest.json` at mode 0600.
+//! Everything else — which sources are on, backfill window, hook verbosity —
+//! lives in `policies-config.json` beside the rest of failproofai's settings,
+//! where it is readable, diffable and safe to commit to a dotfiles repo.
+//!
+//! That split is not tidiness. `policies-config.json` is written by
+//! `hooks-config.ts` with a bare `writeFileSync`, so it inherits the umask and
+//! lands at 0664 on a normal machine — inside `~/.failproofai/`, which is
+//! itself 0775. Putting an API key there would publish it to every local user
+//! on the box. `~/.agenteye/cli.json` already stores its session token at 0600,
+//! so the correct precedent existed; this follows it.
+//!
+//! # Disabled is the default, and it is a real default
+//!
+//! No `ingest.json`, or one with no key, means collection is off: no tasks, so
+//! no thread and no runtime (see [`crate::supervisor::spawn_supervised`]). A
+//! machine that has not opted in pays nothing for this code existing. Session
+//! collection additionally requires its own explicit opt-in, because
+//! transcripts carry prompts, file contents and whatever the user pasted into
+//! a terminal — configuring a key must not silently start shipping those.
+
+use std::fs;
+use std::io;
+use std::path::{Path, PathBuf};
+
+use serde::{Deserialize, Serialize};
+
+/// The hosted ingest endpoint. A COMPLETE endpoint including its path, not a
+/// base to join onto — byte-identical to what `agenteye-collector` defaults
+/// to, so a migrated config needs no rewriting and a self-hoster replaces the
+/// whole value with one of their own.
+pub const DEFAULT_INGEST_URL: &str = "https://server.befailproof.ai/events";
+
+/// Filename of the credential file inside the failproofai home.
+const INGEST_FILE: &str = "ingest.json";
+/// Filename of the shared settings file, owned by the TypeScript side.
+const POLICIES_FILE: &str = "policies-config.json";
+
+/// Mode the credential file must have. Anything wider is a finding.
+#[cfg(unix)]
+const CREDENTIAL_MODE: u32 = 0o600;
+
+/// What the daemon needs in order to ship anything at all.
+#[derive(Debug, Clone, PartialEq, Eq, Deserialize, Serialize)]
+pub struct Ingest {
+    /// Complete endpoint URL. Absent in the file means [`DEFAULT_INGEST_URL`].
+    #[serde(default = "default_url")]
+    pub url: String,
+    /// An `events:add` API key, sent as a bearer token.
+    pub key: String,
+}
+
+fn default_url() -> String {
+    DEFAULT_INGEST_URL.to_string()
+}
+
+/// How much hook activity to ship.
+///
+/// Measured on a real machine: 19,339 rows over 17 days from one developer on
+/// one CLI, of which 99.1% were plain `allow`. Emitting a triggered/completed
+/// pair per row is ~38,700 events for that one machine, almost all of it
+/// no-ops — hence a default that keeps every decision exact and rolls the rest
+/// up rather than dropping it.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Deserialize, Serialize, Default)]
+#[serde(rename_all = "lowercase")]
+pub enum HooksVerbosity {
+    /// Every hook invocation, in full.
+    All,
+    /// `deny` and `instruct` in full; `allow` aggregated per (session, event,
+    /// tool) per minute. The aggregate carries a count, so the denominator
+    /// survives — "we evaluated 19,000 calls and blocked 15" stays answerable.
+    #[default]
+    Decisions,
+    /// No hook events at all.
+    Off,
+}
+
+/// Client-side redaction strength.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Deserialize, Serialize, Default)]
+#[serde(rename_all = "lowercase")]
+pub enum Redact {
+    /// A fixed, deterministic pattern set over tool inputs and outputs.
+    /// Deterministic is load-bearing, not incidental: the server dedups on a
+    /// content hash, so a redaction that varied between reads of the same
+    /// bytes would defeat it.
+    #[default]
+    Minimal,
+    /// Ship verbatim.
+    Off,
+}
+
+/// The non-secret half, read from `policies-config.json` under `"collector"`.
+#[derive(Debug, Clone, PartialEq, Eq, Deserialize, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct Settings {
+    /// Ship agent session transcripts. Defaults to FALSE and is deliberately
+    /// separate from having a key: transcripts carry prompts, file contents
+    /// and pasted credentials, so configuring ingest must not silently start
+    /// sending them.
+    #[serde(default)]
+    pub sessions: bool,
+    /// Ship hook activity. Defaults to TRUE once ingest is configured — it
+    /// carries decisions and tool names, never file contents, and it is the
+    /// capability that justifies collecting from inside failproofai at all.
+    #[serde(default = "default_true")]
+    pub hooks: bool,
+    #[serde(default)]
+    pub hooks_verbosity: HooksVerbosity,
+    #[serde(default)]
+    pub redact: Redact,
+    /// Label stamped on every event. Rejected if it contains a comma: the
+    /// ingest endpoint skips any line whose `environment` has one, so a comma
+    /// here would silently drop every event this machine produced.
+    #[serde(default = "default_environment")]
+    pub environment: String,
+}
+
+fn default_true() -> bool {
+    true
+}
+
+fn default_environment() -> String {
+    "local".to_string()
+}
+
+impl Default for Settings {
+    fn default() -> Self {
+        Settings {
+            sessions: false,
+            hooks: true,
+            hooks_verbosity: HooksVerbosity::default(),
+            redact: Redact::default(),
+            environment: default_environment(),
+        }
+    }
+}
+
+/// Everything the collector needs, resolved.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct CollectorConfig {
+    /// `None` means collection is off for this process.
+    pub ingest: Option<Ingest>,
+    pub settings: Settings,
+    /// Directories watched for ready-to-upload event batches, in the order
+    /// they are scanned.
+    pub spool_dirs: Vec<PathBuf>,
+    /// Where this daemon writes its own derived batches. Always the first
+    /// entry of `spool_dirs`.
+    pub own_spool_dir: PathBuf,
+    /// Batches the server rejected, parked for retry.
+    pub failed_dir: PathBuf,
+}
+
+impl CollectorConfig {
+    /// True when there is a usable credential AND at least one stream enabled.
+    /// This is what `collector_tasks()` keys off, so an unconfigured machine
+    /// starts no thread and no runtime.
+    pub fn is_enabled(&self) -> bool {
+        self.ingest.is_some() && (self.settings.sessions || self.settings.hooks)
+    }
+}
+
+#[derive(Debug)]
+pub enum ConfigError {
+    Io(io::Error),
+    /// The file exists but is not valid JSON. Deliberately NOT treated as
+    /// "absent": silently disabling collection because someone fat-fingered a
+    /// comma is the kind of quiet failure this project exists to remove.
+    Malformed {
+        path: PathBuf,
+        detail: String,
+    },
+    /// A value is present but unusable.
+    Invalid(String),
+}
+
+impl std::fmt::Display for ConfigError {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        match self {
+            ConfigError::Io(e) => write!(f, "{e}"),
+            ConfigError::Malformed { path, detail } => {
+                write!(f, "{} is not valid JSON: {detail}", path.display())
+            }
+            ConfigError::Invalid(m) => write!(f, "{m}"),
+        }
+    }
+}
+
+impl std::error::Error for ConfigError {}
+
+impl From<io::Error> for ConfigError {
+    fn from(e: io::Error) -> Self {
+        ConfigError::Io(e)
+    }
+}
+
+/// Resolve the collector's configuration.
+///
+/// `home` is the failproofai home (`~/.failproofai`), passed rather than
+/// derived so tests need no environment mutation.
+///
+/// Precedence for the endpoint and key is env → file → default, matching every
+/// other knob in this codebase. The env override exists for containers and for
+/// local development against a stack on `localhost`, where writing a file to a
+/// real home directory would be the wrong shape.
+pub fn load(home: &Path) -> Result<CollectorConfig, ConfigError> {
+    let ingest = load_ingest(home)?;
+    let settings = load_settings(home)?;
+
+    if settings.environment.contains(',') {
+        // Fail here rather than let ingest silently skip every line. The
+        // server splits on commas, so this is unrecoverable downstream and
+        // invisible upstream — exactly the shape of bug worth erroring on.
+        return Err(ConfigError::Invalid(format!(
+            "collector environment {:?} contains a comma, which the ingest endpoint rejects; \
+             every event from this machine would be silently dropped",
+            settings.environment
+        )));
+    }
+
+    let own_spool_dir = home.join("spool");
+    let failed_dir = home.join("failed");
+
+    // Watch our own derived batches first, then the directory the Python SDK
+    // and any custom agent already write to. Watching both is what lets
+    // failproofaid supersede agenteye-collector without every SDK user having
+    // to reconfigure anything: their events keep being collected, by a
+    // different daemon, with no change on their side.
+    let mut spool_dirs = vec![own_spool_dir.clone()];
+    let sdk_spool = agenteye_events_dir();
+    if !spool_dirs.contains(&sdk_spool) {
+        spool_dirs.push(sdk_spool);
+    }
+
+    Ok(CollectorConfig {
+        ingest,
+        settings,
+        spool_dirs,
+        own_spool_dir,
+        failed_dir,
+    })
+}
+
+/// The directory the AgentEye Python SDK drops event batches into. Honors
+/// `AGENTEYE_HOME` for the same reason the SDK and collector do.
+fn agenteye_events_dir() -> PathBuf {
+    let base = std::env::var_os("AGENTEYE_HOME")
+        .map(PathBuf::from)
+        .or_else(|| std::env::var_os("HOME").map(|h| PathBuf::from(h).join(".agenteye")))
+        .unwrap_or_else(|| PathBuf::from(".agenteye"));
+    base.join("events")
+}
+
+fn load_ingest(home: &Path) -> Result<Option<Ingest>, ConfigError> {
+    let path = home.join(INGEST_FILE);
+
+    let from_file: Option<Ingest> = match fs::read_to_string(&path) {
+        Ok(text) => {
+            warn_if_world_readable(&path);
+            match serde_json::from_str::<Ingest>(&text) {
+                Ok(v) => Some(v),
+                Err(e) => {
+                    return Err(ConfigError::Malformed {
+                        path,
+                        detail: e.to_string(),
+                    });
+                }
+            }
+        }
+        Err(e) if e.kind() == io::ErrorKind::NotFound => None,
+        Err(e) => return Err(ConfigError::Io(e)),
+    };
+
+    let key = env_nonempty("FAILPROOFAI_INGEST_KEY")
+        .or_else(|| from_file.as_ref().map(|i| i.key.clone()));
+    let url = env_nonempty("FAILPROOFAI_INGEST_URL")
+        .or_else(|| from_file.as_ref().map(|i| i.url.clone()))
+        .unwrap_or_else(default_url);
+
+    // A file with an empty key is "configured but not really" — treat it as
+    // absent rather than sending `Authorization: Bearer ` and collecting 401s.
+    match key {
+        Some(key) if !key.trim().is_empty() => Ok(Some(Ingest { url, key })),
+        _ => Ok(None),
+    }
+}
+
+fn load_settings(home: &Path) -> Result<Settings, ConfigError> {
+    let path = home.join(POLICIES_FILE);
+    let text = match fs::read_to_string(&path) {
+        Ok(t) => t,
+        Err(e) if e.kind() == io::ErrorKind::NotFound => return Ok(Settings::default()),
+        Err(e) => return Err(ConfigError::Io(e)),
+    };
+
+    let root: serde_json::Value =
+        serde_json::from_str(&text).map_err(|e| ConfigError::Malformed {
+            path: path.clone(),
+            detail: e.to_string(),
+        })?;
+
+    match root.get("collector") {
+        None => Ok(Settings::default()),
+        Some(v) => serde_json::from_value(v.clone()).map_err(|e| ConfigError::Malformed {
+            path,
+            detail: format!("the \"collector\" block is not usable: {e}"),
+        }),
+    }
+}
+
+fn env_nonempty(name: &str) -> Option<String> {
+    std::env::var(name).ok().filter(|v| !v.trim().is_empty())
+}
+
+/// Log loudly if the credential file is readable by anyone but its owner.
+///
+/// Warn rather than refuse: the key still works, and disabling collection over
+/// a permission bit would be a confusing failure for something the operator
+/// can fix in one command. But it is never silent — a credential readable by
+/// every local user is worth a line in the journal every startup.
+#[cfg(unix)]
+fn warn_if_world_readable(path: &Path) {
+    use std::os::unix::fs::PermissionsExt;
+    let Ok(meta) = fs::metadata(path) else { return };
+    let mode = meta.permissions().mode() & 0o777;
+    if mode & 0o077 != 0 {
+        tracing::warn!(
+            path = %path.display(),
+            mode = format!("{mode:o}"),
+            "the ingest credential is readable by other users on this machine; \
+             tighten it with `chmod 600`"
+        );
+    }
+}
+
+#[cfg(not(unix))]
+fn warn_if_world_readable(_path: &Path) {}
+
+/// Write the credential file with owner-only permissions.
+///
+/// Used by the setup wizard through the daemon, and by tests. The mode is set
+/// at CREATE time rather than chmod-ed afterwards, so the key is never briefly
+/// world-readable between the write and the fix.
+pub fn write_ingest(home: &Path, ingest: &Ingest) -> Result<PathBuf, ConfigError> {
+    fs::create_dir_all(home)?;
+    tighten_home(home);
+
+    let path = home.join(INGEST_FILE);
+    let body = serde_json::to_string_pretty(ingest)
+        .map_err(|e| ConfigError::Invalid(format!("could not serialize ingest config: {e}")))?;
+
+    write_private(&path, body.as_bytes())?;
+    Ok(path)
+}
+
+#[cfg(unix)]
+fn write_private(path: &Path, bytes: &[u8]) -> Result<(), ConfigError> {
+    use std::io::Write;
+    use std::os::unix::fs::{OpenOptionsExt, PermissionsExt};
+    let mut f = fs::OpenOptions::new()
+        .write(true)
+        .create(true)
+        .truncate(true)
+        .mode(CREDENTIAL_MODE)
+        .open(path)?;
+    f.write_all(bytes)?;
+    f.sync_all()?;
+    // `mode()` only applies when the file is CREATED, so an existing file that
+    // was already too permissive would keep its mode. Set it explicitly too.
+    fs::set_permissions(path, fs::Permissions::from_mode(CREDENTIAL_MODE))?;
+    Ok(())
+}
+
+#[cfg(not(unix))]
+fn write_private(path: &Path, bytes: &[u8]) -> Result<(), ConfigError> {
+    fs::write(path, bytes)?;
+    Ok(())
+}
+
+/// Best-effort tightening of the failproofai home to owner-only.
+///
+/// It is 0775 on a normal machine because nothing ever needed it otherwise.
+/// Once a credential lives inside it, a world-traversable parent undermines
+/// the 0600 on the file itself. Best-effort because failing to chmod a
+/// directory we do not own must not stop the daemon starting.
+#[cfg(unix)]
+fn tighten_home(home: &Path) {
+    use std::os::unix::fs::PermissionsExt;
+    let Ok(meta) = fs::metadata(home) else { return };
+    let mode = meta.permissions().mode() & 0o777;
+    if mode & 0o077 != 0 {
+        match fs::set_permissions(home, fs::Permissions::from_mode(0o700)) {
+            Ok(()) => tracing::info!(
+                path = %home.display(),
+                was = format!("{mode:o}"),
+                "tightened the failproofai home to 0700 so the ingest credential inside it is not world-readable"
+            ),
+            Err(err) => tracing::warn!(
+                path = %home.display(),
+                %err,
+                "could not tighten the failproofai home; the ingest credential's directory stays group/world-traversable"
+            ),
+        }
+    }
+}
+
+#[cfg(not(unix))]
+fn tighten_home(_home: &Path) {}