failproofai 1.0.0-beta.2 → 1.0.0-beta.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "failproofai",
-  "version": "1.0.0-beta.2",
+  "version": "1.0.0-beta.4",
   "description": "The easiest way to manage policies that keep your AI agents reliable, on-task, and running autonomously — for Claude Code & the Agents SDK",
   "bin": {
     "failproofai": "./dist/cli.mjs",
@@ -76,19 +76,19 @@
     "@anthropic-ai/sdk": "^0.115.0",
     "@mdx-js/mdx": "^3.1.1",
     "@tailwindcss/postcss": "^4.3.1",
-    "@tanstack/react-virtual": "^3.14.3",
+    "@tanstack/react-virtual": "^3.14.9",
     "@testing-library/jest-dom": "^7.0.0",
     "@testing-library/react": "^16.3.2",
     "@testing-library/user-event": "^14.6.1",
-    "@types/node": "26.1.1",
+    "@types/node": "26.1.2",
     "@types/react": "19.2.17",
     "@types/react-dom": "^19.2.3",
-    "@vitejs/plugin-react": "^6.0.1",
+    "@vitejs/plugin-react": "^6.0.5",
     "clsx": "^2.1.1",
     "eslint": "^10.5.0",
     "eslint-config-next": "^16.2.9",
-    "jsdom": "^30.0.0",
-    "lucide-react": "^1.18.0",
+    "jsdom": "^30.0.1",
+    "lucide-react": "^1.28.0",
     "next": "^16.2.11",
     "react": "^19.2.4",
     "react-dom": "^19.2.4",
@@ -100,7 +100,7 @@
   "dependencies": {
     "html-to-image": "^1.11.13",
     "html2canvas": "^1.4.1",
-    "posthog-node": "^5.37.1",
+    "posthog-node": "^5.47.7",
     "sql.js": "^1.14.1",
     "yaml": "^2.9.0"
   },
@@ -108,8 +108,14 @@
     "postcss": "8.5.23",
     "eslint-plugin-react-hooks": "7.0.1",
     "vite": "8.0.16",
-    "undici": "7.28.0",
-    "brace-expansion": "5.0.8",
+    "undici": "7.29.0",
+    "brace-expansion": "5.0.9",
     "sharp": "0.35.0"
+  },
+  "optionalDependencies": {
+    "@failproofai/failproofaid-linux-x64": "1.0.0-beta.4",
+    "@failproofai/failproofaid-linux-arm64": "1.0.0-beta.4",
+    "@failproofai/failproofaid-darwin-x64": "1.0.0-beta.4",
+    "@failproofai/failproofaid-darwin-arm64": "1.0.0-beta.4"
   }
 }

package/scripts/build-daemon-packages.mjs

@@ -0,0 +1,210 @@
+#!/usr/bin/env node
+/**
+ * Publishes the four `failproofaid` binaries as npm platform packages, so a
+ * plain `npm install failproofai` already carries the daemon for the machine
+ * it landed on instead of fetching one from the GitHub Release later.
+ *
+ * The release assets stay exactly as they are — this is a second channel, not
+ * a replacement. `src/hooks/daemon-download.ts` prefers whichever binary is
+ * already on disk, then this npm package, then the release; the npm path is
+ * the only one that works with no network at `failproofai config` time.
+ *
+ * Two rules make this safe, and both come from the way the first attempt at
+ * npm-shipping the daemon failed (CHANGELOG 1.0.0-beta.3 — four
+ * `optionalDependencies` were declared and never published, so every install
+ * resolved four 404s):
+ *
+ *   1. These packages publish BEFORE the root package that pins them, so the
+ *      names always exist by the time anything depends on them.
+ *   2. A publish failure here is fatal, not a warning (unlike the alias stubs
+ *      in publish-aliases.mjs, where a missing name costs nothing). Failing
+ *      the job leaves the registry untouched; publishing a root package whose
+ *      optional dependency 404s would ship the broken state to every user.
+ *
+ * Usage:
+ *   node scripts/build-daemon-packages.mjs --artifacts <dir> [--dist-tag <tag>]
+ *                                          [--version <v>] [--pin-root] [--dry-run]
+ */
+import { execFileSync } from "node:child_process";
+import { chmodSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+import { gunzipSync } from "node:zlib";
+import {
+  DAEMON_PLATFORMS,
+  daemonAssetName,
+  daemonOptionalDependencies,
+  daemonPackageName,
+} from "./daemon-platforms.mjs";
+
+const REPO_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "..");
+
+/**
+ * Where the generated packages are staged — **outside the repo**, and that is
+ * load-bearing rather than tidy.
+ *
+ * `npm publish` re-runs `prepare`, so the Next build happens again *after*
+ * this script has run, and Next's file tracing pulls the whole project root
+ * into `.next/standalone` (see the "over-traced project artifacts" prune list
+ * in scripts/prune-standalone.mjs). Anything staged inside the checkout
+ * therefore ends up inside the published CLI tarball — measured: a dry run
+ * shipped 16 MB of daemon `.gz` assets under
+ * `.next/standalone/release-assets/`. Staging in the temp dir cannot be swept
+ * up by a build. `--staging` overrides it for tests.
+ */
+export const STAGING_DIR = resolve(tmpdir(), "failproofaid-packages");
+
+/**
+ * The manifest for one platform package.
+ *
+ * Deliberately carries no `bin` (it would shadow the root package's own
+ * `failproofaid` shim, which is what a user invoking the daemon by hand
+ * should reach) and no `exports` (so `require.resolve("<pkg>/package.json")`
+ * — how the CLI finds this package — keeps working).
+ */
+export function platformPackageManifest(platform, version, rootPkg = {}) {
+  return {
+    name: daemonPackageName(platform.key),
+    version,
+    description: `The failproofaid background daemon binary for ${platform.os} ${platform.cpu}. Installed automatically as an optional dependency of failproofai.`,
+    // npm's own platform filters: with both set, only the matching package is
+    // installed and the other three are skipped without a warning.
+    os: [platform.os],
+    cpu: [platform.cpu],
+    files: ["bin/"],
+    publishConfig: { access: "public" },
+    repository: rootPkg.repository,
+    homepage: rootPkg.homepage,
+    bugs: rootPkg.bugs,
+    license: rootPkg.license,
+  };
+}
+
+/**
+ * Stages one platform package on disk and returns its directory.
+ *
+ * The binary is written decompressed and mode 0755: npm records the executable
+ * bit in the tarball, so it survives publish → install, which is how esbuild
+ * and swc ship their binaries.
+ */
+export function stagePlatformPackage(platform, version, rootPkg, artifactsDir, stagingRoot = STAGING_DIR) {
+  const asset = resolve(artifactsDir, daemonAssetName(platform.key));
+  if (!existsSync(asset)) {
+    throw new Error(`missing artifact ${asset} — the daemon build did not produce ${daemonAssetName(platform.key)}`);
+  }
+
+  const dir = join(stagingRoot, `failproofaid-${platform.key}`);
+  rmSync(dir, { recursive: true, force: true });
+  mkdirSync(join(dir, "bin"), { recursive: true });
+
+  const binary = gunzipSync(readFileSync(asset));
+  const binaryPath = join(dir, "bin", "failproofaid");
+  writeFileSync(binaryPath, binary);
+  chmodSync(binaryPath, 0o755);
+
+  writeFileSync(
+    join(dir, "package.json"),
+    JSON.stringify(platformPackageManifest(platform, version, rootPkg), null, 2) + "\n",
+  );
+  writeFileSync(
+    join(dir, "README.md"),
+    `# ${daemonPackageName(platform.key)}\n\n` +
+      `The \`failproofaid\` background daemon binary for ${platform.os} ${platform.cpu}.\n\n` +
+      `Installed automatically as an optional dependency of [failproofai](https://www.npmjs.com/package/failproofai) — ` +
+      `you do not need to install it yourself.\n`,
+  );
+
+  return dir;
+}
+
+/**
+ * Writes the four platform packages into the root manifest's
+ * `optionalDependencies`, pinned to `version`.
+ *
+ * Called at publish time rather than committed: a pin to a version that does
+ * not exist yet breaks `bun install --frozen-lockfile` in this repo's own CI,
+ * and keeping four pins in step with every version bump by hand is the drift
+ * this whole file exists to avoid.
+ */
+export function pinRootManifest(version, packageJsonPath = resolve(REPO_ROOT, "package.json")) {
+  const pkg = JSON.parse(readFileSync(packageJsonPath, "utf8"));
+  pkg.optionalDependencies = { ...pkg.optionalDependencies, ...daemonOptionalDependencies(version) };
+  writeFileSync(packageJsonPath, JSON.stringify(pkg, null, 2) + "\n");
+  return pkg.optionalDependencies;
+}
+
+function parseArgs(argv) {
+  const valueOf = (flag, fallback) => {
+    const index = argv.indexOf(flag);
+    return index !== -1 && argv[index + 1] ? argv[index + 1] : fallback;
+  };
+  return {
+    artifacts: valueOf("--artifacts", "release-assets"),
+    staging: valueOf("--staging", STAGING_DIR),
+    distTag: valueOf("--dist-tag", null),
+    version: valueOf("--version", null),
+    pinRoot: argv.includes("--pin-root"),
+    dryRun: argv.includes("--dry-run"),
+  };
+}
+
+/**
+ * `npm publish`, with provenance when the registry will take it.
+ *
+ * Provenance needs a supported CI and a repository field npm can match to the
+ * building workflow; when it refuses, the publish itself is still correct, so
+ * this retries once without the flag rather than failing the release.
+ */
+function publishPackage(dir, distTag, dryRun) {
+  const args = ["publish", "--tag", distTag];
+  if (dryRun) args.push("--dry-run");
+
+  const attempt = (extra) =>
+    execFileSync("npm", [...args, ...extra], { cwd: dir, stdio: "pipe", encoding: "utf8" });
+
+  const withProvenance = !dryRun && process.env.GITHUB_ACTIONS === "true";
+  try {
+    return attempt(withProvenance ? ["--provenance"] : []);
+  } catch (err) {
+    const output = (err.stdout ?? "") + (err.stderr ?? "");
+    if (output.includes("cannot publish over")) return "[skip] already published at this version";
+    if (withProvenance && /provenance/i.test(output)) {
+      console.log("::warning::provenance was rejected — retrying the publish without it");
+      return attempt([]);
+    }
+    // Fatal on purpose: see the header. The root package pins these names, so
+    // a half-published set must stop the release rather than ship 404s.
+    throw new Error(`npm publish failed for ${dir}:\n${output.trim()}`);
+  }
+}
+
+export function main(argv = process.argv.slice(2)) {
+  const options = parseArgs(argv);
+  const rootPkg = JSON.parse(readFileSync(resolve(REPO_ROOT, "package.json"), "utf8"));
+  const version = options.version ?? rootPkg.version;
+  const distTag = options.distTag ?? (version.includes("-") ? "beta" : "latest");
+  const artifactsDir = resolve(process.cwd(), options.artifacts);
+
+  console.log(
+    `Publishing ${DAEMON_PLATFORMS.length} failproofaid platform packages at ${version} ` +
+      `(tag: ${distTag}${options.dryRun ? ", dry run" : ""}) from ${artifactsDir}`,
+  );
+
+  for (const platform of DAEMON_PLATFORMS) {
+    const dir = stagePlatformPackage(platform, version, rootPkg, artifactsDir, options.staging);
+    const name = daemonPackageName(platform.key);
+    console.log(`\n${name}@${version}`);
+    console.log(publishPackage(dir, distTag, options.dryRun).trim());
+  }
+
+  if (options.pinRoot) {
+    const pins = pinRootManifest(version);
+    console.log("\nPinned in the root manifest's optionalDependencies:");
+    console.log(JSON.stringify(pins, null, 2));
+  }
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  main();
+}

package/scripts/daemon-platforms.mjs

@@ -0,0 +1,42 @@
+/**
+ * The platforms `failproofaid` is cross-compiled for, and the npm packages
+ * those binaries publish under.
+ *
+ * One list, three consumers: `build-daemon-packages.mjs` (publishes them),
+ * `publish-aliases.mjs` (pins them in every typo-squat stub), and the root
+ * package's injected `optionalDependencies`. They have to agree exactly — a
+ * name that appears in a dependency but never gets published is a 404 in
+ * every install, which is precisely how the first attempt at npm-shipping the
+ * daemon failed (see CHANGELOG 1.0.0-beta.3).
+ *
+ * `os` / `cpu` are npm's own filters, spelled in `process.platform` /
+ * `process.arch` values: with both set, npm and bun install only the package
+ * matching the machine and silently skip the other three.
+ */
+
+export const DAEMON_PLATFORMS = [
+  { key: "linux-x64", os: "linux", cpu: "x64" },
+  { key: "linux-arm64", os: "linux", cpu: "arm64" },
+  { key: "darwin-x64", os: "darwin", cpu: "x64" },
+  { key: "darwin-arm64", os: "darwin", cpu: "arm64" },
+];
+
+/** The npm package name carrying the binary for one platform key. */
+export function daemonPackageName(key) {
+  return `@failproofai/failproofaid-${key}`;
+}
+
+/** The release asset the binary for one platform key arrives in. */
+export function daemonAssetName(key) {
+  return `failproofaid-${key}.gz`;
+}
+
+/**
+ * The `optionalDependencies` block that pins all four platform packages to one
+ * version — what the root package and every alias stub carry when published.
+ */
+export function daemonOptionalDependencies(version) {
+  return Object.fromEntries(
+    DAEMON_PLATFORMS.map((platform) => [daemonPackageName(platform.key), version]),
+  );
+}

package/scripts/prune-standalone.mjs

@@ -101,6 +101,12 @@ const STANDALONE_ROOT_PRUNE = [
   ".claude", ".failproofai", ".github", ".vscode", ".idea",
   // Failproofai CLI artifacts — the dashboard never loads these
   "bin", "dist", "scripts", "src",
+  // Release-pipeline scratch: the daemon binaries downloaded from the build
+  // matrix and the staged platform packages. Both are written into the
+  // workspace only by a local/manual run (the publish workflow keeps them in
+  // RUNNER_TEMP precisely so this cannot happen), and 16 MB of `.gz` shipped
+  // inside the CLI tarball once already because nothing pruned them.
+  "release-assets", ".daemon-packages",
 ];
 const STANDALONE_ROOT_PRUNE_FILES = [
   // Top-level markdown / licenses / docs

package/scripts/publish-aliases.mjs

@@ -2,7 +2,8 @@
 import { execSync } from 'child_process';
 import { readFileSync, writeFileSync, mkdirSync, rmSync, cpSync } from 'fs';
 import { join, dirname } from 'path';
-import { fileURLToPath } from 'url';
+import { fileURLToPath, pathToFileURL } from 'url';
+import { daemonOptionalDependencies } from './daemon-platforms.mjs';
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const rootPkg = JSON.parse(readFileSync(join(__dirname, '..', 'package.json'), 'utf8'));
@@ -11,7 +12,7 @@ const DRY_RUN = process.argv.includes('--dry-run');
 const distTagIdx = process.argv.indexOf('--dist-tag');
 const DIST_TAG = distTagIdx !== -1 ? process.argv[distTagIdx + 1] : (VERSION.includes('-') ? 'beta' : 'latest');
 
-const ALIASES = [
+export const ALIASES = [
   // Formatting variants — no "ai", or hyphen/underscore separators
   'failproof',
   'failproof-ai',
@@ -31,57 +32,77 @@ const ALIASES = [
   'faliproofai',
 ];
 
-const warnings = [];
-
-for (const name of ALIASES) {
-  const tmpDir = join('/tmp', `npm-alias-${name}-${Date.now()}`);
-  const binDir = join(tmpDir, 'bin');
-  mkdirSync(binDir, { recursive: true });
-
-  const pkg = {
+/**
+ * The manifest one alias stub publishes.
+ *
+ * The four `@failproofai/failproofaid-<platform>` pins are the same ones the
+ * root package carries. They arrive transitively through the `failproofai`
+ * dependency anyway, but naming them here means someone who installs a typo'd
+ * name gets the daemon binary for exactly the reason the root package does,
+ * rather than by accident of resolution — and a test can assert it.
+ */
+export function aliasManifest(name, version = VERSION, pkg = rootPkg) {
+  return {
     name,
-    version: VERSION,
+    version,
     description: `Alias for failproofai — installs if you typed '${name}' instead of 'failproofai'`,
     bin: { [name]: './bin/proxy.js' },
     files: ['bin/'],
-    dependencies: { failproofai: VERSION },
+    dependencies: { failproofai: version },
+    optionalDependencies: daemonOptionalDependencies(version),
     publishConfig: { access: 'public' },
-    repository: rootPkg.repository,
-    homepage: rootPkg.homepage,
-    bugs: rootPkg.bugs,
-    license: rootPkg.license,
+    repository: pkg.repository,
+    homepage: pkg.homepage,
+    bugs: pkg.bugs,
+    license: pkg.license,
   };
+}
 
-  writeFileSync(join(tmpDir, 'package.json'), JSON.stringify(pkg, null, 2) + '\n');
-  cpSync(join(__dirname, 'alias-proxy.js'), join(binDir, 'proxy.js'));
+export function main() {
+  const warnings = [];
 
-  if (DRY_RUN) {
-    console.log(`[dry-run] Would publish ${name}@${VERSION} (tag: ${DIST_TAG})`);
-    console.log(JSON.stringify(pkg, null, 2));
-    console.log('---');
-    rmSync(tmpDir, { recursive: true, force: true });
-    continue;
-  }
+  for (const name of ALIASES) {
+    const tmpDir = join('/tmp', `npm-alias-${name}-${Date.now()}`);
+    const binDir = join(tmpDir, 'bin');
+    mkdirSync(binDir, { recursive: true });
+
+    const pkg = aliasManifest(name);
 
-  console.log(`Publishing ${name}@${VERSION}...`);
-  try {
-    execSync(`npm publish --tag ${DIST_TAG}`, { cwd: tmpDir, stdio: 'pipe' });
-    console.log(`Done: ${name}`);
-  } catch (err) {
-    const output = (err.stdout?.toString() ?? '') + (err.stderr?.toString() ?? '');
-    if (output.includes('too similar')) {
-      warnings.push(`${name}: blocked by npm similarity check — request via npm support`);
-    } else if (output.includes('cannot publish over')) {
-      console.log(`[skip] ${name}: already published at ${VERSION}`);
-    } else {
-      warnings.push(`${name}: ${output.trim().split('\n').find(l => l.includes('npm error')) ?? 'unknown error'}`);
+    writeFileSync(join(tmpDir, 'package.json'), JSON.stringify(pkg, null, 2) + '\n');
+    cpSync(join(__dirname, 'alias-proxy.js'), join(binDir, 'proxy.js'));
+
+    if (DRY_RUN) {
+      console.log(`[dry-run] Would publish ${name}@${VERSION} (tag: ${DIST_TAG})`);
+      console.log(JSON.stringify(pkg, null, 2));
+      console.log('---');
+      rmSync(tmpDir, { recursive: true, force: true });
+      continue;
+    }
+
+    console.log(`Publishing ${name}@${VERSION}...`);
+    try {
+      execSync(`npm publish --tag ${DIST_TAG}`, { cwd: tmpDir, stdio: 'pipe' });
+      console.log(`Done: ${name}`);
+    } catch (err) {
+      const output = (err.stdout?.toString() ?? '') + (err.stderr?.toString() ?? '');
+      if (output.includes('too similar')) {
+        warnings.push(`${name}: blocked by npm similarity check — request via npm support`);
+      } else if (output.includes('cannot publish over')) {
+        console.log(`[skip] ${name}: already published at ${VERSION}`);
+      } else {
+        warnings.push(`${name}: ${output.trim().split('\n').find(l => l.includes('npm error')) ?? 'unknown error'}`);
+      }
     }
+
+    rmSync(tmpDir, { recursive: true, force: true });
   }
 
-  rmSync(tmpDir, { recursive: true, force: true });
+  if (warnings.length > 0) {
+    console.log('\n::warning::Some alias packages were not published:');
+    for (const w of warnings) console.log(`  - ${w}`);
+  }
 }
 
-if (warnings.length > 0) {
-  console.log('\n::warning::Some alias packages were not published:');
-  for (const w of warnings) console.log(`  - ${w}`);
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  main();
 }

package/src/hooks/builtin-policies.ts

@@ -170,6 +170,99 @@ const RUNAS_RE = /(?:^|;|&&|\|\|)\s*runas\s/i;
 
 // blockCurlPipeSh
 const CURL_PIPE_SH_RE = /(?:curl|wget)\s.*\|\s*(?:sh|bash|zsh|dash|ksh|csh|tcsh|fish|ash)\b/;
+/**
+ * `failproofai config --pause` in any of its reachable spellings — direct, via
+ * `npx`/`bunx`/`pnpm dlx`, by absolute path, or through the `configure`/`setup`
+ * aliases the CLI normalizes. Only `--pause` matches: `--resume` and `--status`
+ * restore or merely report enforcement, so an agent running either is harmless.
+ *
+ * Two details carry the whole policy, and an earlier version got both wrong:
+ *
+ * `failproofai[^\s]*` rather than `\bfailproofai\b`. A word boundary stops at
+ * the character after the name, so every ordinary way of pinning or pathing the
+ * binary walked straight through: `npx failproofai@latest`, `npx -y
+ * failproofai@0.0.16`, `bunx failproofai@latest`, and
+ * `node /usr/lib/node_modules/failproofai/bin/failproofai.mjs`. The suffix has
+ * to be absorbed by the same token.
+ *
+ * `\s+--pause` rather than `\s--pause`. With a single `\s`, two spaces before
+ * the flag — which no shell cares about and any agent may emit — did not match.
+ *
+ * This still raises the bar rather than closing the class: base64, a wrapper
+ * script, an alias or a shell variable all still reach the same state. Closing
+ * it properly means a pause cannot originate from a tool call at all.
+ *
+ * Matched against BOTH the raw command and its shell-unescaped form (see
+ * `stripShellQuoting`), because a shell reconstructs the binary name from
+ * fragments a regex over the raw string cannot see.
+ */
+const SELF_PAUSE_RE =
+  /failproofai[^\s]*(?:\s+\S+)*?\s+(?:config|configure|setup)\b(?:\s+\S+)*?\s+--pause\b/;
+
+/**
+ * Decode one ANSI-C `$'...'` body (the text between the quotes) to the bytes a
+ * shell would produce. Covers the escape forms that can reconstruct an ASCII
+ * identifier: `\xHH`, octal `\NNN`, `\uHHHH`, `\UHHHHHHHH`, and the named
+ * controls. An out-of-range or malformed sequence is left as-is rather than
+ * throwing — this runs on adversarial input and must never crash the hook.
+ */
+function decodeAnsiC(body: string): string {
+  return body.replace(
+    /\\(x[0-9A-Fa-f]{1,2}|u[0-9A-Fa-f]{1,4}|U[0-9A-Fa-f]{1,8}|[0-7]{1,3}|.)/g,
+    (_, seq: string) => {
+      try {
+        if (seq[0] === "x") return String.fromCharCode(parseInt(seq.slice(1), 16));
+        if (seq[0] === "u" || seq[0] === "U") return String.fromCodePoint(parseInt(seq.slice(1), 16));
+        if (/^[0-7]+$/.test(seq)) return String.fromCharCode(parseInt(seq, 8));
+      } catch {
+        return seq;
+      }
+      const named: Record<string, string> = {
+        a: "\x07", b: "\b", e: "\x1b", f: "\f", n: "\n",
+        r: "\r", t: "\t", v: "\v", "\\": "\\", "'": "'", '"': '"', "?": "?",
+      };
+      return named[seq] ?? seq;
+    },
+  );
+}
+
+/**
+ * Collapse the quoting a POSIX shell resolves LEXICALLY — before it execs a
+ * command — so a literal matcher sees roughly what will actually run.
+ *
+ * Two adversarial red-team rounds defeated the pattern above by reassembling
+ * the binary name from fragments the regex could not see: first backslash and
+ * quote splitting (`fail\proofai`, `fail"proof"ai`, `f\a\i\l\p\r\o\o\f\a\i`),
+ * then ANSI-C quoting (`$'fail\x70roofai'`, octal `\160`, unicode `p`).
+ * Each executes the real pause. This now normalizes all three lexical forms:
+ * ANSI-C `$'...'` bodies are decoded first (the generic backslash pass below
+ * would otherwise turn `\x70` into `x70`), then surrounding single/double
+ * quotes and lone backslash-escapes are removed.
+ *
+ * The boundary is principled, not arbitrary: everything handled here is pure
+ * shell LEXING. What remains — a variable (`f=failproofai; $f …`), command
+ * substitution (`$(printf failproofai)`), `eval`, an alias, a base64 pipe —
+ * requires the shell to EXECUTE something to reconstruct the name, which no
+ * PreToolUse hook inspecting a command string can follow. That class is the one
+ * the header comment above calls out, and the only real closure is to make the
+ * pause ACTION itself refuse to originate from a tool call — deferred with the
+ * rest of the daemon-side redesign.
+ */
+function stripShellQuoting(command: string): string {
+  // Line continuation FIRST. A shell deletes a backslash-newline pair entirely
+  // and rejoins the fragments, so `fail\<newline>proofai` runs the real binary.
+  // The generic `\(.)` strip below cannot catch it — JS `.` excludes newline —
+  // so it has to be removed before that pass, or the fragments never join.
+  // (A third red-team round rode exactly this in.) `\r?\n` also covers a
+  // CRLF-joined line.
+  const joined = command.replace(/\\\r?\n/g, "");
+  // `$'...'` next, honoring `\'` inside the body, so its own escapes decode
+  // before the generic backslash-strip can mangle them.
+  const ansiDecoded = joined.replace(/\$'((?:[^'\\]|\\.)*)'/g, (_, body: string) =>
+    decodeAnsiC(body),
+  );
+  return ansiDecoded.replace(/\\(.)/g, "$1").replace(/['"]/g, "");
+}
 const PS_WEB_PIPE_RE = /(?:Invoke-WebRequest|iwr|Invoke-RestMethod|irm)\s+.*\|\s*(?:Invoke-Expression|iex)/i;
 
 // blockForcePush
@@ -579,6 +672,42 @@ function blockSudo(ctx: PolicyContext): PolicyResult {
   return allow();
 }
 
+/**
+ * A pause the agent can issue is not a guardrail.
+ *
+ * `failproofai config --pause` is a human affordance: you watched the agent get
+ * blocked, you judged the block wrong, you suspended enforcement for a bit. An
+ * agent that can run it turns every other policy advisory — it need only shell
+ * out once to switch them all off, and the pause even survives into later turns.
+ *
+ * This raises the bar rather than closing the class: an agent can still reach
+ * the same state obfuscated (base64, a wrapper script, an alias). Closing it
+ * properly means the pause cannot originate from a tool call at all — a
+ * dashboard action, or a daemon that accepts it only from a TTY. Until then,
+ * the honest description of this policy is "stops the obvious attempt".
+ *
+ * It is deliberately NOT redundant with `block-failproofai-commands`, which
+ * blocks the CLI far more broadly. That one anchors on a command boundary
+ * (`FAILPROOFAI_CLI_RE`), so `npx -y failproofai config --pause` does not match
+ * it — and being broad, it is a policy people plausibly switch off so agents
+ * can run `failproofai audit`. Neither gap should leave pausing reachable, so
+ * this stays narrow, matches the runner forms, and survives that one being off.
+ */
+function blockSelfPause(ctx: PolicyContext): PolicyResult {
+  if (ctx.toolName !== "Bash") return allow();
+  const cmd = getCommand(ctx);
+  // The raw command AND its shell-unescaped form: a shell strips quotes and
+  // backslashes before running the binary, so `fail\proofai config --pause`
+  // reaches the pause CLI even though the literal name is broken.
+  if (SELF_PAUSE_RE.test(cmd) || SELF_PAUSE_RE.test(stripShellQuoting(cmd))) {
+    return deny(
+      "Pausing failproofai enforcement is a human action, not an agent one. " +
+        "If a policy is blocking legitimate work, say so and let the operator decide.",
+    );
+  }
+  return allow();
+}
+
 function blockCurlPipeSh(ctx: PolicyContext): PolicyResult {
   if (ctx.toolName !== "Bash") return allow();
   const cmd = getCommand(ctx);
@@ -1752,6 +1881,16 @@ export const BUILTIN_POLICIES: BuiltinPolicyDefinition[] = [
       },
     } satisfies PolicyParamsSchema,
   },
+  {
+    name: "block-self-pause",
+    displayTitle: "Tried to pause failproofai enforcement",
+    impact: "An agent that can pause enforcement can switch off every other policy.",
+    description: "Block agents from pausing failproofai enforcement",
+    fn: blockSelfPause,
+    match: { events: ["PreToolUse", "PermissionRequest"], toolNames: ["Bash"] },
+    defaultEnabled: true,
+    category: "Dangerous Commands",
+  },
   {
     name: "block-sudo",
     displayTitle: "Tried to run a command with sudo",