failproofai 1.0.0-beta.3 → 1.0.0-beta.5

package/scripts/publish-aliases.mjs

@@ -2,7 +2,8 @@
 import { execSync } from 'child_process';
 import { readFileSync, writeFileSync, mkdirSync, rmSync, cpSync } from 'fs';
 import { join, dirname } from 'path';
-import { fileURLToPath } from 'url';
+import { fileURLToPath, pathToFileURL } from 'url';
+import { daemonOptionalDependencies } from './daemon-platforms.mjs';
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const rootPkg = JSON.parse(readFileSync(join(__dirname, '..', 'package.json'), 'utf8'));
@@ -11,7 +12,7 @@ const DRY_RUN = process.argv.includes('--dry-run');
 const distTagIdx = process.argv.indexOf('--dist-tag');
 const DIST_TAG = distTagIdx !== -1 ? process.argv[distTagIdx + 1] : (VERSION.includes('-') ? 'beta' : 'latest');
 
-const ALIASES = [
+export const ALIASES = [
   // Formatting variants — no "ai", or hyphen/underscore separators
   'failproof',
   'failproof-ai',
@@ -31,57 +32,77 @@ const ALIASES = [
   'faliproofai',
 ];
 
-const warnings = [];
-
-for (const name of ALIASES) {
-  const tmpDir = join('/tmp', `npm-alias-${name}-${Date.now()}`);
-  const binDir = join(tmpDir, 'bin');
-  mkdirSync(binDir, { recursive: true });
-
-  const pkg = {
+/**
+ * The manifest one alias stub publishes.
+ *
+ * The four `@failproofai/failproofaid-<platform>` pins are the same ones the
+ * root package carries. They arrive transitively through the `failproofai`
+ * dependency anyway, but naming them here means someone who installs a typo'd
+ * name gets the daemon binary for exactly the reason the root package does,
+ * rather than by accident of resolution — and a test can assert it.
+ */
+export function aliasManifest(name, version = VERSION, pkg = rootPkg) {
+  return {
     name,
-    version: VERSION,
+    version,
     description: `Alias for failproofai — installs if you typed '${name}' instead of 'failproofai'`,
     bin: { [name]: './bin/proxy.js' },
     files: ['bin/'],
-    dependencies: { failproofai: VERSION },
+    dependencies: { failproofai: version },
+    optionalDependencies: daemonOptionalDependencies(version),
     publishConfig: { access: 'public' },
-    repository: rootPkg.repository,
-    homepage: rootPkg.homepage,
-    bugs: rootPkg.bugs,
-    license: rootPkg.license,
+    repository: pkg.repository,
+    homepage: pkg.homepage,
+    bugs: pkg.bugs,
+    license: pkg.license,
   };
+}
 
-  writeFileSync(join(tmpDir, 'package.json'), JSON.stringify(pkg, null, 2) + '\n');
-  cpSync(join(__dirname, 'alias-proxy.js'), join(binDir, 'proxy.js'));
+export function main() {
+  const warnings = [];
 
-  if (DRY_RUN) {
-    console.log(`[dry-run] Would publish ${name}@${VERSION} (tag: ${DIST_TAG})`);
-    console.log(JSON.stringify(pkg, null, 2));
-    console.log('---');
-    rmSync(tmpDir, { recursive: true, force: true });
-    continue;
-  }
+  for (const name of ALIASES) {
+    const tmpDir = join('/tmp', `npm-alias-${name}-${Date.now()}`);
+    const binDir = join(tmpDir, 'bin');
+    mkdirSync(binDir, { recursive: true });
+
+    const pkg = aliasManifest(name);
 
-  console.log(`Publishing ${name}@${VERSION}...`);
-  try {
-    execSync(`npm publish --tag ${DIST_TAG}`, { cwd: tmpDir, stdio: 'pipe' });
-    console.log(`Done: ${name}`);
-  } catch (err) {
-    const output = (err.stdout?.toString() ?? '') + (err.stderr?.toString() ?? '');
-    if (output.includes('too similar')) {
-      warnings.push(`${name}: blocked by npm similarity check — request via npm support`);
-    } else if (output.includes('cannot publish over')) {
-      console.log(`[skip] ${name}: already published at ${VERSION}`);
-    } else {
-      warnings.push(`${name}: ${output.trim().split('\n').find(l => l.includes('npm error')) ?? 'unknown error'}`);
+    writeFileSync(join(tmpDir, 'package.json'), JSON.stringify(pkg, null, 2) + '\n');
+    cpSync(join(__dirname, 'alias-proxy.js'), join(binDir, 'proxy.js'));
+
+    if (DRY_RUN) {
+      console.log(`[dry-run] Would publish ${name}@${VERSION} (tag: ${DIST_TAG})`);
+      console.log(JSON.stringify(pkg, null, 2));
+      console.log('---');
+      rmSync(tmpDir, { recursive: true, force: true });
+      continue;
+    }
+
+    console.log(`Publishing ${name}@${VERSION}...`);
+    try {
+      execSync(`npm publish --tag ${DIST_TAG}`, { cwd: tmpDir, stdio: 'pipe' });
+      console.log(`Done: ${name}`);
+    } catch (err) {
+      const output = (err.stdout?.toString() ?? '') + (err.stderr?.toString() ?? '');
+      if (output.includes('too similar')) {
+        warnings.push(`${name}: blocked by npm similarity check — request via npm support`);
+      } else if (output.includes('cannot publish over')) {
+        console.log(`[skip] ${name}: already published at ${VERSION}`);
+      } else {
+        warnings.push(`${name}: ${output.trim().split('\n').find(l => l.includes('npm error')) ?? 'unknown error'}`);
+      }
     }
+
+    rmSync(tmpDir, { recursive: true, force: true });
   }
 
-  rmSync(tmpDir, { recursive: true, force: true });
+  if (warnings.length > 0) {
+    console.log('\n::warning::Some alias packages were not published:');
+    for (const w of warnings) console.log(`  - ${w}`);
+  }
 }
 
-if (warnings.length > 0) {
-  console.log('\n::warning::Some alias packages were not published:');
-  for (const w of warnings) console.log(`  - ${w}`);
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  main();
 }

package/src/hooks/cloud-connection.ts

@@ -143,6 +143,9 @@ export async function connectToCloud(input: ConnectInput): Promise<ConnectOutcom
       // a terminal, so they stay off unless explicitly asked for.
       sessions: input.sessions === true,
       environment: input.environment,
+      // So the daemon stamps this machine's id on every collected event and the
+      // dashboard groups by machine, not by per-project agent_id.
+      machineId: input.machineId,
     };
     writeCollectorSettings(settings);
     outcome.anyConfigured = true;

package/src/hooks/collector-config.ts

@@ -45,6 +45,13 @@ export interface CollectorSettings {
   hooksVerbosity?: "all" | "decisions" | "off";
   redact?: "minimal" | "off";
   environment?: string;
+  /**
+   * The machine's id, so the daemon can stamp it on every collected event and
+   * the dashboard groups by machine rather than by `agent_id` (a per-project
+   * identity). Written by `--connect --machine-id`; the Rust collector reads it
+   * as `collector.machineId`.
+   */
+  machineId?: string;
 }
 
 export function failproofaiHome(): string {
@@ -130,6 +137,9 @@ export function writeCollectorSettings(settings: CollectorSettings): void {
       hooksVerbosity: settings.hooksVerbosity ?? "decisions",
       redact: settings.redact ?? "minimal",
       environment: settings.environment ?? "local",
+      // Omit when unknown rather than writing null: the Rust side treats an
+      // absent field as "no machine", which is the correct fallback.
+      ...(settings.machineId ? { machineId: settings.machineId } : {}),
     },
   });
 }

package/src/hooks/daemon-download.ts

@@ -1,20 +1,31 @@
 /**
- * Fetches the compiled `failproofaid` binary for this platform from the
- * GitHub Release that matches this CLI's own version.
+ * Gets the compiled `failproofaid` binary for this platform onto disk, from
+ * whichever of its two channels can supply it.
  *
- * Why a download rather than a dependency: the daemon is a 4-way
- * cross-compiled Rust binary, and shipping it through npm means four
- * per-platform packages that every install resolves, an npm org to own the
- * scope, and a second publish channel that can silently drift from the first
- * (it already did — the platform packages were declared as
- * `optionalDependencies` and never published, so every install of them 404'd).
- * The release assets have to exist for standalone installs regardless, so
- * pointing the CLI at the same artifacts leaves exactly one channel.
+ * **npm first.** The four binaries publish as
+ * `@failproofai/failproofaid-<os>-<arch>` platform packages, pinned as
+ * `optionalDependencies` of this package, so `npm install failproofai` has
+ * usually already brought down the one matching this machine — `os`/`cpu`
+ * make npm skip the other three. Copying that file costs no network at all,
+ * which is the only thing that works behind a proxy or air-gapped.
  *
- * The URL is *constructed*, never discovered — no API call, no `releases/latest`
- * redirect, no rate limit, and no chance of fetching a daemon built from
- * different source than the CLI talking to it: the tag is this package's own
- * version, so a CLI upgrade downloads its own matching binary.
+ * **The GitHub Release second.** `failproofaid-<os>-<arch>.gz` plus a
+ * `SHA256SUMS` manifest are attached to the release tagged with this CLI's own
+ * version. That channel has to exist regardless — it is how anyone installs
+ * the daemon standalone, and how an install that skipped optional dependencies
+ * still gets one.
+ *
+ * The pair failed once before in a way worth keeping in mind: the platform
+ * packages were declared as `optionalDependencies` and never published, so
+ * every install resolved four 404s (see CHANGELOG 1.0.0-beta.3). What makes
+ * them safe now is that `scripts/build-daemon-packages.mjs` publishes them
+ * *before* the root package that pins them, and fails the release if it
+ * cannot — the names always exist by the time anything depends on them.
+ *
+ * The download URL is *constructed*, never discovered — no API call, no
+ * `releases/latest` redirect, no rate limit, and no chance of fetching a daemon
+ * built from different source than the CLI talking to it: the tag is this
+ * package's own version, so a CLI upgrade fetches its own matching binary.
  *
  * Everything here fails closed and never throws. A daemon that cannot be
  * fetched leaves the machine on the in-process path it was already using;
@@ -22,9 +33,10 @@
  * this writes an executable that a service manager will then run at login.
  */
 import { createHash } from "node:crypto";
-import { chmodSync, existsSync, mkdirSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { createRequire } from "node:module";
 import { homedir } from "node:os";
-import { resolve } from "node:path";
+import { dirname, resolve } from "node:path";
 import { gunzipSync } from "node:zlib";
 import { version } from "../../package.json";
 import type { PlatformKey } from "./daemon-service";
@@ -82,6 +94,114 @@ export interface DaemonDownloadResult {
   error?: string;
 }
 
+/** The npm package carrying the daemon binary for one platform. */
+export function platformPackageName(key: PlatformKey): string {
+  return `@failproofai/failproofaid-${key}`;
+}
+
+/**
+ * Locates the binary inside the installed platform package, or null.
+ *
+ * Resolution is anchored at `FAILPROOFAI_PACKAGE_ROOT` (set by
+ * `bin/failproofai.mjs` and the bundled `dist/cli.mjs`) rather than at
+ * `import.meta.url`, which does not survive the CJS bundle. Node's algorithm
+ * walks up from there, which covers both real layouts: a global install nests
+ * its dependencies at `<root>/node_modules/@failproofai/…`, a local one hoists
+ * them to `<project>/node_modules/@failproofai/…`.
+ *
+ * The specifier is *computed*, deliberately. A literal would make the bundler
+ * try to resolve a package that is optional, platform-specific, and absent on
+ * three machines out of four at build time.
+ */
+export function npmPlatformBinaryPath(key: PlatformKey): string | null {
+  const packageRoot = process.env.FAILPROOFAI_PACKAGE_ROOT;
+  if (!packageRoot) return null;
+  const name = platformPackageName(key);
+
+  try {
+    const requireFromRoot = createRequire(resolve(packageRoot, "package.json"));
+    const found = platformPackageBinary(dirname(requireFromRoot.resolve(`${name}/package.json`)));
+    if (found) return found;
+  } catch {
+    // Not installed (the common case on a machine that skipped optional
+    // dependencies), or a resolver that cannot see it. The direct check below
+    // is the fallback, not a failure.
+  }
+
+  return platformPackageBinary(resolve(packageRoot, "node_modules", name));
+}
+
+/**
+ * The binary inside one candidate platform-package directory, if it is the
+ * right one.
+ *
+ * The version check is not belt-and-braces. npm pins the exact version, but a
+ * workspace holding two `failproofai` versions can hoist the other one's
+ * platform package to the top of the tree — and installing that binary under
+ * *this* version's filename would put a daemon built from different source
+ * behind a CLI that believes it matches, which is the single thing the
+ * versioned install path exists to prevent. A mismatch falls through to the
+ * download, whose URL is pinned to this version.
+ */
+function platformPackageBinary(dir: string): string | null {
+  try {
+    const manifest = JSON.parse(readFileSync(resolve(dir, "package.json"), "utf8")) as {
+      version?: string;
+    };
+    if (manifest.version !== version) return null;
+  } catch {
+    return null;
+  }
+  const candidate = resolve(dir, "bin", "failproofaid");
+  return existsSync(candidate) ? candidate : null;
+}
+
+/**
+ * Writes the daemon binary to its versioned path.
+ *
+ * Shared by both channels so a binary lands identically however it arrived:
+ * staged in the same directory as the target (so the install is an atomic
+ * rename within one filesystem, never a half-written executable a service
+ * manager could pick up), mode 0755, pid-suffixed so two concurrent wizards
+ * stay off each other's file.
+ */
+function installBinaryBytes(binary: Buffer): string {
+  const target = installedBinaryPath();
+  const tempPath = `${target}.${process.pid}.tmp`;
+  try {
+    mkdirSync(daemonBinaryDir(), { recursive: true });
+    writeFileSync(tempPath, binary);
+    chmodSync(tempPath, 0o755);
+    renameSync(tempPath, target);
+    return target;
+  } catch (err) {
+    rmSync(tempPath, { force: true });
+    throw err;
+  }
+}
+
+/**
+ * Installs the daemon from the npm platform package, if one is present.
+ *
+ * No checksum step, unlike the download: npm verified the tarball's integrity
+ * against the registry when it installed it, and this file never crossed the
+ * network on its own.
+ *
+ * Deliberately NOT gated on `FAILPROOFAI_NO_DOWNLOAD` — that variable exists
+ * so an air-gapped machine does not reach out, and this is a local copy. On
+ * exactly those machines it is the only channel that can work.
+ */
+export function installFromNpmPackage(key: PlatformKey): DaemonDownloadResult {
+  const source = npmPlatformBinaryPath(key);
+  if (!source) return { error: `${platformPackageName(key)} is not installed` };
+  try {
+    return { path: installBinaryBytes(readFileSync(source)) };
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    return { error: `failed to install failproofaid from ${source}: ${message}` };
+  }
+}
+
 async function fetchBytes(url: string): Promise<Buffer> {
   const response = await fetch(url, { signal: AbortSignal.timeout(DOWNLOAD_TIMEOUT_MS) });
   if (!response.ok) throw new Error(`GET ${url} returned ${response.status}`);
@@ -118,10 +238,6 @@ export async function downloadFailproofaidBinary(key: PlatformKey): Promise<Daem
   }
 
   const assetName = `failproofaid-${key}.gz`;
-  // Same directory as the target so the install is a rename within one
-  // filesystem — atomic, and never a half-written binary a service manager
-  // could pick up. The pid keeps two concurrent wizards off each other's file.
-  const tempPath = `${target}.${process.pid}.tmp`;
 
   try {
     const [asset, manifest] = await Promise.all([
@@ -138,14 +254,8 @@ export async function downloadFailproofaidBinary(key: PlatformKey): Promise<Daem
       return { error: `checksum mismatch for ${assetName} (expected ${expected}, got ${actual})` };
     }
 
-    const binary = gunzipSync(asset);
-    mkdirSync(daemonBinaryDir(), { recursive: true });
-    writeFileSync(tempPath, binary);
-    chmodSync(tempPath, 0o755);
-    renameSync(tempPath, target);
-    return { path: target };
+    return { path: installBinaryBytes(gunzipSync(asset)) };
   } catch (err) {
-    rmSync(tempPath, { force: true });
     const message = err instanceof Error ? err.message : String(err);
     return { error: `failed to download failproofaid v${version} for ${key}: ${message}` };
   }

package/src/hooks/daemon-service.ts

@@ -22,7 +22,7 @@ import { resolve, dirname } from "node:path";
 import { execFileSync } from "node:child_process";
 import { hookLogWarn } from "./hook-logger";
 import { getConfigPathForScope } from "./hooks-config";
-import { downloadFailproofaidBinary, installedBinaryPath } from "./daemon-download";
+import { downloadFailproofaidBinary, installFromNpmPackage, installedBinaryPath } from "./daemon-download";
 
 /**
  * Every `systemctl --user` / `launchctl` call is bounded. Both talk to a
@@ -145,13 +145,19 @@ export function resolveFailproofaidBinaryPath(): string | null {
 }
 
 /**
- * Resolves the binary, downloading it from this version's release if it is
- * not already on disk.
+ * Resolves the binary, installing one if it is not already on disk.
  *
- * Only the install path calls this. The npm package ships no binary — it is
- * one CLI tarball for every platform — so `failproofai config` choosing the
- * global scope is the moment a machine that opted into a daemon actually
- * acquires one.
+ * Only the install path calls this — `failproofai config` choosing the global
+ * scope is the moment a machine that opted into a daemon actually acquires
+ * one. Two channels, in this order:
+ *
+ *   1. The `@failproofai/failproofaid-<os>-<arch>` platform package, which a
+ *      plain `npm install failproofai` already brought down as an optional
+ *      dependency. No network, so it is also the only channel that works
+ *      air-gapped or behind a proxy that blocks github.com.
+ *   2. The GitHub Release asset for this exact version, checksum-verified.
+ *      Covers installs that skipped optional dependencies, older tarballs, and
+ *      anyone installing the daemon standalone.
  */
 export async function ensureFailproofaidBinary(): Promise<{ path?: string; reason?: string }> {
   const existing = resolveFailproofaidBinaryPath();
@@ -162,9 +168,18 @@ export async function ensureFailproofaidBinary(): Promise<{ path?: string; reaso
     return { reason: `failproofaid has no prebuilt binary for ${process.platform}/${process.arch}` };
   }
 
+  const fromNpm = installFromNpmPackage(key);
+  if (fromNpm.path) return { path: fromNpm.path };
+
   const result = await downloadFailproofaidBinary(key);
   if (result.path) return { path: result.path };
-  return { reason: result.error ?? "failproofaid binary could not be downloaded" };
+  // Both channels are worth reporting: "not installed" alone reads as a broken
+  // package, and the download error alone hides that npm could have supplied it.
+  return {
+    reason: result.error
+      ? `${result.error} (${fromNpm.error})`
+      : "failproofaid binary could not be installed",
+  };
 }
 
 /**

package/.next/standalone/.next/server/chunks/[externals]__14odj07._.js

@@ -1,3 +0,0 @@
-module.exports=[14747,(e,o,r)=>{o.exports=e.x("path",()=>require("path"))},78500,(e,o,r)=>{o.exports=e.x("node:async_hooks",()=>require("node:async_hooks"))},1457,(e,o,r)=>{o.exports=e.x("node:readline",()=>require("node:readline"))}];
-
-//# sourceMappingURL=%5Bexternals%5D__14odj07._.js.map

package/.next/standalone/.next/server/chunks/[externals]__1s61mel._.js

@@ -1,3 +0,0 @@
-module.exports=[14747,(e,o,r)=>{o.exports=e.x("path",()=>require("path"))},2157,(e,o,r)=>{o.exports=e.x("node:fs",()=>require("node:fs"))},1457,(e,o,r)=>{o.exports=e.x("node:readline",()=>require("node:readline"))},78500,(e,o,r)=>{o.exports=e.x("node:async_hooks",()=>require("node:async_hooks"))}];
-
-//# sourceMappingURL=%5Bexternals%5D__1s61mel._.js.map