failproofai 1.0.0-beta.2 → 1.0.0-beta.4

package/bin/failproofai.mjs

@@ -769,11 +769,140 @@ WHAT IT DOES
     3. Policies   — presets (combine any), Everything, or a custom pick
     4. Review     — confirms the exact files it will change, then applies
 
+FAILPROOF CLOUD
+  failproofai config --connect <url> --token <key> [--machine-id <id>]
+                                    Connect this machine to Failproof Cloud
+                                    [--send-transcripts] also send full session transcripts
+  failproofai config --disconnect   Stop pulling policy and sending activity
+  failproofai config --status       Show connection and pause state
+
+  One connection, two capabilities: this machine PULLS centrally-managed
+  policies and SENDS what its hooks decided, so the dashboard shows the fleet
+  it is enforcing on. Both are checked against the server before anything is
+  written, and reported separately — a key carrying policies:pull but not
+  events:add connects for policy and says exactly why the dashboard is empty.
+
+  Tokens are stored owner-only in ~/.failproofai/, never in the service unit —
+  that file is world-readable. Connecting needs no sudo, and the machine id
+  defaults to this host's name.
+
+  Session transcripts carry prompts, file contents and whatever was pasted into
+  a terminal, so they are NEVER sent unless --send-transcripts is passed.
+
+PAUSING ENFORCEMENT (one session, always time-boxed)
+  failproofai config --pause         Pause this directory's newest agent session (30m)
+  failproofai config --pause 10m     Pause for a given time (max 8h; s/m/h, bare = minutes)
+  failproofai config --resume        End the pause early
+  failproofai config --status        Show what is paused and when it lifts
+    --session <id>                     Target a specific session
+    --all                              With --resume, end every active pause
+
+  A pause suspends builtin, custom and convention policies for that session
+  only, and always expires on its own. Cloud-managed policies keep enforcing.
+
   Prefer flags? See \`failproofai policies --help\`.
 `.trimStart());
       process.exit(0);
     }
     lastSubcommand = "config";
+
+    // --pause / --resume / --status are non-interactive session actions that
+    // share `config`'s surface but not the wizard. They write session state,
+    // never the config file — a pause that reached policies-config.json would
+    // be committed and outlive the session that asked for it.
+    // Cloud enrolment. Deliberately writes a credential file the daemon reads
+    // rather than an Environment= line in the service unit: that unit is
+    // installed world-readable (0644, /etc/systemd/system), so a token there
+    // would be readable by every local user. Keeping it out also means no
+    // sudo, and lets an already-installed daemon be connected.
+    const connectIdx = args.indexOf("--connect");
+    const wantsDisconnect = args.includes("--disconnect");
+    if (connectIdx >= 0 || wantsDisconnect) {
+      if (connectIdx >= 0 && wantsDisconnect) {
+        throw new CliError("--connect and --disconnect cannot be combined.");
+      }
+      const valueAfter = (flag) => {
+        const i = args.indexOf(flag);
+        if (i < 0) return undefined;
+        const v = args[i + 1];
+        if (!v || v.startsWith("-")) throw new CliError(`Missing value after ${flag}.`);
+        return v;
+      };
+      let result;
+      if (wantsDisconnect) {
+        const { runDisconnectCommand } = await import("../src/hooks/cloud-enrollment-cli");
+        result = runDisconnectCommand();
+      } else {
+        const { hostname } = await import("node:os");
+        const { runConnectCommand } = await import("../src/hooks/cloud-enrollment-cli");
+        result = await runConnectCommand({
+          url: valueAfter("--connect"),
+          token: valueAfter("--token"),
+          machineId: valueAfter("--machine-id"),
+          defaultMachineId: hostname(),
+          // Opt-in only. A transcript carries prompts, file contents and
+          // whatever was pasted into a terminal, so it can never be a side
+          // effect of connecting.
+          sessions: args.includes("--send-transcripts"),
+        });
+      }
+      for (const line of result.lines) {
+        if (result.exitCode === 0) console.log(line);
+        else console.error(line);
+      }
+      await track("cli_cloud_enrollment", {
+        action: wantsDisconnect ? "disconnect" : "connect",
+        ok: result.exitCode === 0,
+      });
+      await exitAfterFlush(result.exitCode);
+      return;
+    }
+
+    const pauseIdx = args.indexOf("--pause");
+    const wantsResume = args.includes("--resume");
+    const wantsStatus = args.includes("--status");
+    if (pauseIdx >= 0 || wantsResume || wantsStatus) {
+      const chosen = [pauseIdx >= 0 && "--pause", wantsResume && "--resume", wantsStatus && "--status"].filter(Boolean);
+      if (chosen.length > 1) {
+        throw new CliError(`${chosen.join(" and ")} cannot be combined.`);
+      }
+      const sessionIdx = args.indexOf("--session");
+      if (sessionIdx >= 0 && !args[sessionIdx + 1]) {
+        throw new CliError("Missing session id after --session.");
+      }
+      // A bare `--pause` takes the default duration, so only treat the next
+      // token as a duration when it isn't another flag.
+      const next = pauseIdx >= 0 ? args[pauseIdx + 1] : undefined;
+      const duration = next && !next.startsWith("-") ? next : undefined;
+
+      const { runPauseCommand } = await import("../src/hooks/session-pause-cli");
+      const result = runPauseCommand({
+        action: pauseIdx >= 0 ? "pause" : wantsResume ? "resume" : "status",
+        duration,
+        sessionId: sessionIdx >= 0 ? args[sessionIdx + 1] : undefined,
+        all: args.includes("--all"),
+        cwd: process.cwd(),
+      });
+      // `--status` answers "what is this machine's state?", which is both
+      // halves: whether enforcement is paused AND whether cloud is connected.
+      if (wantsStatus) {
+        const { connectionStatusLines } = await import("../src/hooks/cloud-enrollment-cli");
+        for (const line of connectionStatusLines()) console.log(line);
+        console.log("");
+      }
+      for (const line of result.lines) {
+        if (result.exitCode === 0) console.log(line);
+        else console.error(line);
+      }
+      await track("cli_pause_invoked", {
+        action: pauseIdx >= 0 ? "pause" : wantsResume ? "resume" : "status",
+        ok: result.exitCode === 0,
+        affected: result.affected,
+      });
+      await exitAfterFlush(result.exitCode);
+      return;
+    }
+
     const { runConfigureWizard } = await import("../src/hooks/configure-wizard");
     const result = await runConfigureWizard();
     await track("cli_configure_invoked", {