failproofai 1.0.0-beta.4 → 1.0.0-beta.6

package/.next/standalone/crates/fpai-ipc/src/framing.rs

@@ -1,177 +0,0 @@
-//! Length-prefixed JSON framing shared by the daemon and every client of it.
-//!
-//! Frame = 4-byte big-endian `u32` byte length, followed by that many bytes
-//! of UTF-8 JSON. One frame in, one frame out, per connection — the daemon
-//! never keeps a connection open across multiple logical requests, so there
-//! is no need for a request-id-multiplexed protocol.
-
-use serde::Serialize;
-use serde::de::DeserializeOwned;
-use std::io::{self, Read, Write};
-
-/// Hard cap on a single frame's declared length. A hook payload is at most
-/// 1 MiB (see `handler.ts`'s own stdin cap); 16 MiB leaves headroom without
-/// letting a corrupt or hostile length prefix trigger an unbounded
-/// allocation before a single byte of the body has even been read.
-pub const MAX_FRAME_LEN: u32 = 16 * 1024 * 1024;
-
-#[derive(Debug)]
-pub enum FramingError {
-    Io(io::Error),
-    FrameTooLarge { declared: u32, max: u32 },
-    Json(serde_json::Error),
-}
-
-impl std::fmt::Display for FramingError {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        match self {
-            FramingError::Io(e) => write!(f, "io error: {e}"),
-            FramingError::FrameTooLarge { declared, max } => {
-                write!(f, "frame length {declared} exceeds max {max}")
-            }
-            FramingError::Json(e) => write!(f, "invalid JSON frame: {e}"),
-        }
-    }
-}
-
-impl std::error::Error for FramingError {}
-
-impl From<io::Error> for FramingError {
-    fn from(e: io::Error) -> Self {
-        FramingError::Io(e)
-    }
-}
-
-impl From<serde_json::Error> for FramingError {
-    fn from(e: serde_json::Error) -> Self {
-        FramingError::Json(e)
-    }
-}
-
-/// Serializes `value` to JSON and writes it as one length-prefixed frame.
-pub fn write_message<W: Write, T: Serialize>(
-    writer: &mut W,
-    value: &T,
-) -> Result<(), FramingError> {
-    let body = serde_json::to_vec(value)?;
-    let len = u32::try_from(body.len()).map_err(|_| FramingError::FrameTooLarge {
-        declared: u32::MAX,
-        max: MAX_FRAME_LEN,
-    })?;
-    if len > MAX_FRAME_LEN {
-        return Err(FramingError::FrameTooLarge {
-            declared: len,
-            max: MAX_FRAME_LEN,
-        });
-    }
-    writer.write_all(&len.to_be_bytes())?;
-    writer.write_all(&body)?;
-    writer.flush()?;
-    Ok(())
-}
-
-/// Reads one length-prefixed frame and deserializes it as `T`. Rejects the
-/// frame (without allocating a body buffer) if the declared length exceeds
-/// [`MAX_FRAME_LEN`], so a corrupt or adversarial length prefix can't be
-/// used to force a large allocation.
-pub fn read_message<R: Read, T: DeserializeOwned>(reader: &mut R) -> Result<T, FramingError> {
-    let mut len_bytes = [0u8; 4];
-    reader.read_exact(&mut len_bytes)?;
-    let len = u32::from_be_bytes(len_bytes);
-    if len > MAX_FRAME_LEN {
-        return Err(FramingError::FrameTooLarge {
-            declared: len,
-            max: MAX_FRAME_LEN,
-        });
-    }
-    let mut body = vec![0u8; len as usize];
-    reader.read_exact(&mut body)?;
-    let value = serde_json::from_slice(&body)?;
-    Ok(value)
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use serde::Deserialize;
-    use std::io::Cursor;
-
-    #[derive(Debug, Serialize, Deserialize, PartialEq)]
-    struct Sample {
-        a: u32,
-        b: String,
-    }
-
-    #[test]
-    fn round_trips_a_simple_value() {
-        let mut buf = Vec::new();
-        let msg = Sample {
-            a: 42,
-            b: "hello".to_string(),
-        };
-        write_message(&mut buf, &msg).unwrap();
-        let mut cursor = Cursor::new(buf);
-        let decoded: Sample = read_message(&mut cursor).unwrap();
-        assert_eq!(decoded, msg);
-    }
-
-    #[test]
-    fn round_trips_empty_string_fields() {
-        let mut buf = Vec::new();
-        let msg = Sample {
-            a: 0,
-            b: String::new(),
-        };
-        write_message(&mut buf, &msg).unwrap();
-        let mut cursor = Cursor::new(buf);
-        let decoded: Sample = read_message(&mut cursor).unwrap();
-        assert_eq!(decoded, msg);
-    }
-
-    #[test]
-    fn rejects_a_declared_length_over_the_cap_without_reading_a_body() {
-        let mut buf = Vec::new();
-        buf.extend_from_slice(&(MAX_FRAME_LEN + 1).to_be_bytes());
-        // Deliberately no body bytes follow — if `read_message` tried to
-        // allocate/read the declared length before checking the cap, this
-        // would hang or panic on the short read instead of erroring cleanly.
-        let mut cursor = Cursor::new(buf);
-        let result: Result<Sample, _> = read_message(&mut cursor);
-        assert!(matches!(result, Err(FramingError::FrameTooLarge { .. })));
-    }
-
-    #[test]
-    fn refuses_to_write_a_frame_over_the_cap() {
-        #[derive(Serialize)]
-        struct Big {
-            data: String,
-        }
-        let big = Big {
-            data: "x".repeat((MAX_FRAME_LEN as usize) + 1),
-        };
-        let mut buf = Vec::new();
-        let result = write_message(&mut buf, &big);
-        assert!(matches!(result, Err(FramingError::FrameTooLarge { .. })));
-    }
-
-    #[test]
-    fn rejects_truncated_frames() {
-        let mut buf = Vec::new();
-        buf.extend_from_slice(&10u32.to_be_bytes());
-        buf.extend_from_slice(b"short"); // fewer than the declared 10 bytes
-        let mut cursor = Cursor::new(buf);
-        let result: Result<Sample, _> = read_message(&mut cursor);
-        assert!(matches!(result, Err(FramingError::Io(_))));
-    }
-
-    #[test]
-    fn rejects_malformed_json_inside_a_valid_frame() {
-        let mut buf = Vec::new();
-        let body = b"not json";
-        buf.extend_from_slice(&(body.len() as u32).to_be_bytes());
-        buf.extend_from_slice(body);
-        let mut cursor = Cursor::new(buf);
-        let result: Result<Sample, _> = read_message(&mut cursor);
-        assert!(matches!(result, Err(FramingError::Json(_))));
-    }
-}

package/.next/standalone/crates/fpai-ipc/src/lib.rs

@@ -1,10 +0,0 @@
-//! Wire protocol shared by `failproofaid` and every client/test that talks
-//! to it: message framing, the JSON envelope, and Unix-socket peer
-//! verification.
-
-pub mod envelope;
-pub mod framing;
-pub mod peer;
-
-pub use envelope::{ClientMessage, PROTOCOL_VERSION, ServerMessage};
-pub use framing::{FramingError, MAX_FRAME_LEN, read_message, write_message};

package/.next/standalone/crates/fpai-ipc/src/peer.rs

@@ -1,80 +0,0 @@
-//! Verifies that a Unix socket peer is running as the same OS user as this
-//! process.
-//!
-//! failproofaid is user-scope only (see the plan: "no elevation, the daemon
-//! spawns the worker because the daemon already runs as the user"): the
-//! socket directory is `0700` and the socket file `0600`, which is the
-//! actual access-control boundary. This check is a second, defense-in-depth
-//! layer against the narrow window between a socket file existing and its
-//! permissions having been fully applied, and against misconfigured
-//! filesystems (e.g. a shared mount with unexpectedly loose permissions).
-//! It is not a stronger security boundary than the filesystem permissions
-//! already provide — same OS user can always reach this daemon regardless.
-
-use std::io;
-use std::os::unix::io::AsRawFd;
-use std::os::unix::net::UnixStream;
-
-/// Returns the effective UID of the process on the other end of `stream`.
-#[cfg(target_os = "linux")]
-pub fn peer_uid(stream: &UnixStream) -> io::Result<u32> {
-    use std::mem;
-
-    let fd = stream.as_raw_fd();
-    let mut cred: libc::ucred = unsafe { mem::zeroed() };
-    let mut len = mem::size_of::<libc::ucred>() as libc::socklen_t;
-
-    let ret = unsafe {
-        libc::getsockopt(
-            fd,
-            libc::SOL_SOCKET,
-            libc::SO_PEERCRED,
-            &mut cred as *mut libc::ucred as *mut libc::c_void,
-            &mut len,
-        )
-    };
-    if ret != 0 {
-        return Err(io::Error::last_os_error());
-    }
-    Ok(cred.uid)
-}
-
-/// Returns the effective UID of the process on the other end of `stream`.
-#[cfg(target_os = "macos")]
-pub fn peer_uid(stream: &UnixStream) -> io::Result<u32> {
-    let fd = stream.as_raw_fd();
-    let mut uid: libc::uid_t = 0;
-    let mut gid: libc::gid_t = 0;
-
-    let ret = unsafe { libc::getpeereid(fd, &mut uid, &mut gid) };
-    if ret != 0 {
-        return Err(io::Error::last_os_error());
-    }
-    Ok(uid)
-}
-
-/// Returns this process's own effective UID, for comparison against
-/// [`peer_uid`].
-pub fn own_uid() -> u32 {
-    unsafe { libc::geteuid() }
-}
-
-/// `true` if `stream`'s peer is running as this process's own OS user.
-pub fn is_same_user(stream: &UnixStream) -> io::Result<bool> {
-    Ok(peer_uid(stream)? == own_uid())
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn a_local_socketpair_peer_is_always_the_same_user() {
-        // socketpair() connects two ends of the same process — the peer
-        // UID must equal our own, on every CI runner regardless of who's
-        // executing the test.
-        let (a, _b) = UnixStream::pair().unwrap();
-        assert!(is_same_user(&a).unwrap());
-        assert_eq!(peer_uid(&a).unwrap(), own_uid());
-    }
-}

package/.next/standalone/docker-hook-sync/Dockerfile

@@ -1,79 +0,0 @@
-# Self-contained failproofai hook-sync container.
-#
-# A single-shot daily job (run by a k8s CronJob) that clones failproofai, runs
-# Claude Code in `--effort ultracode` mode to detect drift between every agent-CLI
-# harness we integrate with and this repo, and opens ONE auto-PR with the fix.
-#
-# Bundles:
-#   - Node 20 + npm (npm is a fallback bun installer for scripts/dev-hook.mjs;
-#     node runs the launcher itself)
-#   - bun (STILL REQUIRED: the cloned repo's .claude/settings.json fires hooks via
-#     `node "$CLAUDE_PROJECT_DIR/scripts/dev-hook.mjs" --hook <Event>`, and that
-#     launcher only *locates* bun — it cannot conjure one. Without this layer the
-#     dogfooded require-*-before-stop policies never fire and the auto-PR is
-#     never committed/pushed. We install to BUN_INSTALL=/home/appuser/.bun, which
-#     the launcher probes explicitly, so enforcement survives a broken PATH.)
-#   - Claude Code CLI (`claude`) — run headless with --effort ultracode
-#   - failproofai@latest on PATH (belt-and-suspenders; the dogfood hooks actually
-#     run the clone's SOURCE via bun, not this global)
-#   - git + gh + jq + dumb-init + `script` (PTY wrap for stream-json)
-#
-# Build:  docker build -t hook-sync:latest docker-hook-sync/
-# Run:    docker run --rm -e CLAUDE_CODE_OAUTH_TOKEN=... -e GH_TOKEN=... hook-sync:latest
-#
-# Every dependency is installed at build time. The daily GitHub Actions rebuild
-# (.github/workflows/build-image.yml) keeps claude-code@latest + failproofai@latest fresh.
-FROM node:20-bookworm-slim
-
-ENV DEBIAN_FRONTEND=noninteractive \
-    HOME=/home/appuser \
-    BUN_INSTALL=/home/appuser/.bun \
-    FAILPROOFAI_TELEMETRY_DISABLED=1 \
-    PATH="/home/appuser/.bun/bin:/home/appuser/.local/bin:${PATH}"
-
-# Layer 1: apt deps. dumb-init for PID 1 signal handling; git+gh for the agent's
-# clone/branch/push/PR flow AND the require-*-before-stop hooks; jq for the
-# entrypoint's policy-config edit; bsdextrautils provides `script` (PTY wrap so
-# Node line-flushes --output-format stream-json); curl/gnupg for the gh apt key
-# and the bun installer; unzip is required by the bun installer.
-RUN apt-get update \
- && apt-get install -y --no-install-recommends \
-        ca-certificates curl gnupg dumb-init jq git bsdextrautils unzip \
- && rm -rf /var/lib/apt/lists/*
-
-# Layer 2: GitHub CLI (gh). Used by the agent for `gh pr create/list` and by the
-# require-pr-before-stop hook.
-RUN install -d /etc/apt/keyrings \
- && curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg \
-        | gpg --dearmor -o /etc/apt/keyrings/githubcli-archive-keyring.gpg \
- && echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" \
-        > /etc/apt/sources.list.d/github-cli.list \
- && apt-get update \
- && apt-get install -y --no-install-recommends gh \
- && rm -rf /var/lib/apt/lists/*
-
-# Layer 3: npm globals. Claude Code CLI + failproofai, pinned to latest at build
-# time; the daily workflow rebuild keeps them fresh. Root install so symlinks land
-# in /usr/local/bin (executable by the non-root appuser).
-RUN npm install -g --omit=dev \
-        @anthropic-ai/claude-code@latest \
-        failproofai@latest \
- && npm cache clean --force
-
-# Layer 4: non-root user + chowned workspace.
-RUN useradd --create-home --uid 10001 --shell /bin/bash appuser \
- && mkdir -p /workspace \
- && chown -R appuser:appuser /workspace /home/appuser
-
-COPY entrypoint.sh /usr/local/bin/entrypoint.sh
-RUN chmod 0755 /usr/local/bin/entrypoint.sh
-
-USER appuser
-WORKDIR /home/appuser
-
-# Layer 5: bun (installs into $BUN_INSTALL=/home/appuser/.bun, on PATH per ENV).
-# The dogfood hook fast-path runs TypeScript from src/ directly — bun executes TS
-# natively, so no build step is needed for the hooks to work.
-RUN curl -fsSL https://bun.sh/install | bash
-
-ENTRYPOINT ["dumb-init", "--", "/usr/local/bin/entrypoint.sh"]

package/.next/standalone/docker-hook-sync/entrypoint.sh

@@ -1,109 +0,0 @@
-#!/usr/bin/env bash
-#
-# failproofai hook-sync entrypoint (runs as PID 1 under dumb-init).
-#
-# Lifecycle:
-#   1. Validate env (CLAUDE_CODE_OAUTH_TOKEN, GH_TOKEN).
-#   2. gh auth setup-git + git identity.
-#   3. Clone failproofai --depth=1; cut a fresh auto/sync-cli-harnesses-<UTC> branch.
-#   4. NEUTRALIZE two policies in the THROWAWAY clone's .failproofai config
-#      (require-ci-green-before-stop, block-read-outside-cwd) via jq, then
-#      `git update-index --skip-worktree` so the edit is invisible to
-#      git status/add and never enters the agent's commit/PR — while failproofai
-#      reads the edited WORKTREE file at runtime and sees them gone. The
-#      require-commit/push/pr-before-stop gates stay ACTIVE (dogfooding).
-#   5. exec `claude --effort ultracode -p <prompt>` wrapped in a PTY so
-#      --output-format stream-json line-flushes to `kubectl logs -f`.
-#   6. Exit with claude's return code (all output streams to stdout / the pod log).
-#
-# Exit codes: 0 = agent finished (claude's rc) · 64 = missing required env ·
-#             65 = prompt file missing in clone · 66 = unsafe WORKSPACE · else = claude's rc.
-set -euo pipefail
-
-CLAUDE_CODE_OAUTH_TOKEN="${CLAUDE_CODE_OAUTH_TOKEN:-}"
-GH_TOKEN="${GH_TOKEN:-}"
-REPO_URL="${REPO_URL:-https://github.com/failproofai/failproofai.git}"
-REPO_BRANCH_FROM="${REPO_BRANCH_FROM:-main}"
-WORKSPACE="${WORKSPACE:-/workspace}"
-PROMPT_PATH="${PROMPT_PATH:-scripts/sync-agent-cli-harnesses-prompt.md}"
-CLAUDE_MODEL="${CLAUDE_MODEL:-claude-opus-4-8}"
-
-export HOME="${HOME:-/home/appuser}"
-export CLAUDE_CODE_OAUTH_TOKEN
-export GH_TOKEN
-export GITHUB_TOKEN="${GITHUB_TOKEN:-$GH_TOKEN}"
-export FAILPROOFAI_TELEMETRY_DISABLED=1
-# Keep ultracode background subagents alive in headless -p mode (default is ~10 min).
-export CLAUDE_CODE_PRINT_BG_WAIT_CEILING_MS="${CLAUDE_CODE_PRINT_BG_WAIT_CEILING_MS:-1800000}"
-
-log() { printf '[entrypoint %s] %s\n' "$(date -u +%FT%TZ)" "$*"; }
-
-# ---------------- 1. env validation ----------------
-if [ -z "$CLAUDE_CODE_OAUTH_TOKEN" ]; then log "ERROR: CLAUDE_CODE_OAUTH_TOKEN not set"; exit 64; fi
-if [ -z "$GH_TOKEN" ]; then log "ERROR: GH_TOKEN not set"; exit 64; fi
-
-# ---------------- 2. gh + git auth ----------------
-log "authenticating gh"
-gh auth setup-git >/dev/null
-git config --global user.name  "failproofai-hook-sync"
-git config --global user.email "hook-sync-bot@exosphere.host"
-git config --global init.defaultBranch main
-
-# ---------------- 3. clone + fresh branch ----------------
-case "$WORKSPACE" in
-  ""|"/"|"."|"..") log "ERROR: refusing unsafe WORKSPACE '$WORKSPACE'"; exit 66 ;;
-esac
-mkdir -p "$WORKSPACE"
-if [ -n "$(ls -A "$WORKSPACE" 2>/dev/null)" ]; then
-  find "$WORKSPACE" -mindepth 1 -maxdepth 1 -exec rm -rf {} +
-fi
-log "cloning $REPO_URL@$REPO_BRANCH_FROM -> $WORKSPACE"
-git clone --depth=1 --branch "$REPO_BRANCH_FROM" "$REPO_URL" "$WORKSPACE"
-cd "$WORKSPACE"
-# Fetch the base ref (shallow) so require-*-before-stop can diff against origin/<base>.
-git fetch --depth=1 origin "$REPO_BRANCH_FROM" >/dev/null 2>&1 || true
-BRANCH="auto/sync-cli-harnesses-$(date -u +%Y%m%dT%H%M%SZ)"
-git checkout -b "$BRANCH"
-log "working on branch $BRANCH"
-
-# ---------------- 4. policy-config neutralization ----------------
-# enabledPolicies is a UNION across scopes with no disable field, so a policy must
-# be removed from the file that lists it. --skip-worktree then hides that edit from
-# git status/add (so it never lands in the PR) while failproofai still reads the
-# edited worktree file at runtime. Keeps require-commit/push/pr-before-stop active.
-CFG=".failproofai/policies-config.json"
-if [ -f "$CFG" ]; then
-  cfg_tmp="$(mktemp)"
-  jq '.enabledPolicies |= map(select(. != "require-ci-green-before-stop" and . != "block-read-outside-cwd"))' "$CFG" > "$cfg_tmp" && mv "$cfg_tmp" "$CFG"
-  git update-index --skip-worktree "$CFG"
-  log "neutralized require-ci-green-before-stop + block-read-outside-cwd for this run (skip-worktree; not committed)"
-else
-  log "WARN: $CFG not found; running with the repo's default policy set"
-fi
-
-# ---------------- 5. invoke claude (ULTRACODE, headless, PTY-wrapped) ----------------
-PROMPT_FILE="$WORKSPACE/$PROMPT_PATH"
-if [ ! -f "$PROMPT_FILE" ]; then log "ERROR: prompt missing at $PROMPT_FILE"; exit 65; fi
-
-# Node block-buffers stdout when it's a pipe; `script -qefc ... /dev/null` gives
-# claude a PTY so --output-format stream-json line-flushes to the pod logs. `-e`
-# ties script's exit code to claude's.
-RUN_SH="$(mktemp /tmp/run-claude.XXXXXX.sh)"
-cat >"$RUN_SH" <<EOF
-#!/usr/bin/env bash
-exec claude --effort ultracode --model ${CLAUDE_MODEL} \\
-    --verbose --output-format stream-json \\
-    --dangerously-skip-permissions \\
-    -p "\$(cat "$PROMPT_FILE")" 2>&1
-EOF
-chmod +x "$RUN_SH"
-
-log "invoking claude --effort ultracode --model ${CLAUDE_MODEL} (prompt: $PROMPT_PATH)"
-set +e
-script -qefc "$RUN_SH" /dev/null
-rc=$?
-set -e
-rm -f "$RUN_SH"
-log "claude exited $rc"
-
-exit "$rc"

package/.next/standalone/integration-suite/Dockerfile

@@ -1,47 +0,0 @@
-# failproofai CLI-canary sandbox — base image
-#
-# Design goals (see failproofai-cli-canary-design.md §4):
-#   - SAFE:  non-root user, NO sudo installed, no host FS mounted at runtime.
-#            The canary fires `sudo whoami` / `.env`-read deny-probes; here they
-#            are inert BY CONSTRUCTION even on a day enforcement is broken.
-#   - LIGHT: ephemeral daily container (`docker run --rm`), not a daemon.
-#            Only this image + one named volume persist; zero idle CPU/RAM.
-#   - FRESH: CLIs are NOT baked in — they are `@latest`-installed into the
-#            persistent HOME volume at run time (the whole point of the canary),
-#            so this base image rebuilds rarely.
-#
-# The HOME volume (mounted at /home/canary) holds: npm-global CLIs, every
-# vendor login/token, and per-CLI config — so logins survive across daily runs.
-
-FROM node:22-bookworm-slim
-
-# bun from the official image — no `curl | bash` needed at build time.
-COPY --from=oven/bun:latest /usr/local/bin/bun /usr/local/bin/bun
-
-# Minimal tooling for the various vendor CLI installers. Deliberately NO sudo.
-# Tooling for the various vendor installers. Deliberately NO sudo.
-#   bzip2/xz-utils : goose extracts its Rust binary with these
-#   libsecret-1-0  : antigravity caches login tokens via libsecret (best-effort)
-RUN apt-get update -qq \
- && apt-get install -y -qq --no-install-recommends \
-      git ca-certificates curl unzip bzip2 xz-utils libsecret-1-0 \
- && rm -rf /var/lib/apt/lists/*
-
-# Unprivileged user. HOME is the mount point for the persistent named volume;
-# because the image ships a canary-owned /home/canary, an empty named volume
-# mounted here is initialised canary-owned (Docker copies image content+owner).
-# node:22-slim already ships a `node` user at UID 1000, so pin canary to 1001.
-RUN useradd --create-home --uid 1001 --shell /bin/bash canary
-USER canary
-WORKDIR /home/canary
-RUN mkdir -p /home/canary/.npm-global/bin /home/canary/.local/bin
-
-# NPM_CONFIG_PREFIX via ENV (not `npm config set`) so it survives the volume
-# mount shadowing /home/canary at runtime. Runtime `npm i -g` lands in the volume.
-ENV NPM_CONFIG_PREFIX=/home/canary/.npm-global
-ENV PATH=/home/canary/.npm-global/bin:/home/canary/.local/bin:/usr/local/bin:/usr/bin:/bin
-
-# Sanity: fail the build if bun/node/npm aren't all runnable as the canary user.
-RUN bun --version && node --version && npm --version
-
-CMD ["bash"]

package/.next/standalone/integration-suite/README.md

@@ -1,129 +0,0 @@
-# Integration suite
-
-A daily **live-enforcement integration test** for failproofai. It answers one
-question the unit/e2e suites can't: *does failproofai still enforce against every
-supported agent CLI, at the versions users actually install today?*
-
-Every day (`.github/workflows/integration-suite.yml`) it installs all 12 agent
-CLIs **@latest** into an isolated Docker sandbox, drives each one against
-failproofai's own policies (built from this repo's HEAD), and confirms the hook
-log shows a **DENY**. A *silent-allow* — a blocked action that ran with no deny —
-means enforcement broke against that CLI (e.g. a vendor changed their hook schema
-out from under us). The test asserts the deny **positively**, so drift surfaces
-as a red run + a Slack alert instead of going unnoticed until a user hits it.
-
-## Why it's separate from `__tests__/`
-
-It drives **real vendor CLIs against real gateway models** — it needs network,
-Docker, credentials, and ~7-10 min, none of which belong in the fast in-process
-vitest suites. So it's a scheduled workflow, not a PR gate.
-
-## How a run works
-
-The workflow is a thin trigger; `ci-entrypoint.sh` is the front door and does
-everything below except the Actions cache restore/save.
-
-1. Restore `integration-suite-state.json` from Actions cache (version-gate +
-   broke/recovered diff) — *workflow*.
-2. Build failproofai under test (`dist/index.js` + `dist/cli.mjs`) from this repo.
-3. Decode the OAuth token secrets, build the sandbox image, create the per-run
-   HOME volume, install all 12 CLIs (`install-clis.sh`), inject the credential
-   files (`inject-tokens.sh`), assemble the gateway env-file.
-4. `run.sh` probes each non-gated CLI (`probe-cli.sh`), builds the report
-   (`report.js`), and POSTs it to Slack.
-5. Cleanup (env-file + volume) runs via `trap`, so it happens on failure too.
-
-Run it locally the same way CI does — every input is an env var:
-
-```bash
-CANARY_LLM_API_KEY=... CANARY_SKIP_BUILD=1 \
-  bash integration-suite/ci-entrypoint.sh
-```
-
-**Version-gate:** a CLI is re-probed only when its binary version **or**
-failproofai's HEAD changed since its last green run — unchanged ⇒ can't have
-drifted ⇒ skip, protecting LLM/vendor quota. `FAIL`/`INCONCLUSIVE`/`ERROR` always
-re-probe until they recover. Dispatch with **force** to probe everything.
-
-## Two channels: `stable` and `beta`
-
-The workflow runs as a **matrix over `CANARY_CHANNEL`**, in two concurrent legs
-answering different questions:
-
-| Leg | Installs | Question | On failure |
-|-----|----------|----------|------------|
-| `stable` | what users get, all 12 CLIs | *is enforcement broken now?* | **fails the job** + Slack |
-| `beta` | each vendor's public pre-release ref, 6 CLIs | *is it about to break?* | **advisory only** — never fails |
-
-Only six vendors publish something usable ahead of their release, so the beta leg
-skips the rest rather than re-installing a stable build and reporting it as
-pre-release coverage:
-
-| CLI | Pre-release ref | Typical lead |
-|-----|-----------------|--------------|
-| codex | npm `alpha` | up to ~12 d (minor bumps only — patches ship blind) |
-| copilot | npm `prerelease` | 0.6–5.8 d |
-| openclaw | npm `beta` | 0.3–11.4 d |
-| cursor | `install?channel=lab` | 2–4 d |
-| goose | `CANARY=true` (rolling tag) | ~1 release cycle |
-| claude | `latest` — **inverted**, see below | ~13 d |
-
-**claude runs backwards.** Nothing ships ahead of `latest`, which *is* the
-bleeding edge (~1 release/day); what exists is `stable`, ~13 days behind. So the
-stable leg pins `bash -s stable` — testing what conservative users run, and
-stopping a same-day Anthropic release from red-lighting an unrelated PR — and
-`latest` becomes the early-warning ref. **hermes** is inverted too but has no fix:
-its installer git-clones `main`, which is also what every hermes user gets, so
-there is nothing ahead of us to probe.
-
-**Escalation is a cross-leg comparison, not a beta failure.** A CLI red on both
-legs is already broken and belongs to the stable leg's alarm. The early warning is
-`stable green + beta not-green`, held for **two consecutive runs** so a broken
-alpha that gets reverted before release doesn't burn attention. Note the signal is
-usually `INCONCLUSIVE`/`ERROR`, not `FAIL` — a vendor payload change stops the
-model before it ever calls a tool — so a FAIL-only rule would miss it entirely.
-
-Each leg has its own Docker volume and Actions cache key: a pre-release install
-overwrites the stable binary in a shared `$HOME`, and a beta result must never be
-able to overwrite the stable leg's gating record.
-
-## Auth & secrets (the `cli-integration` Environment)
-
-> The GitHub **Environment** is still named `cli-integration` — it's configured in
-> repo settings, not in this tree, so it was deliberately left alone when this
-> directory was renamed. Renaming it there means renaming `environment:` in the
-> workflow at the same time, or the job loses access to every secret.
-
-Because this repo is public, all credentials live in a scoped **GitHub
-Environment** (`cli-integration`) — only this workflow's job can read them — and
-the workflow triggers on `schedule`/`workflow_dispatch` **only**, so fork PRs can
-never reach them.
-
-| Auth | CLIs | Secret(s) |
-|------|------|-----------|
-| Env-var (gateway) | claude, codex, goose, opencode, pi, hermes, openclaw, factory | `CANARY_LLM_API_KEY`, `CANARY_LLM_BASE_URL` |
-| Env-var (PAT) | copilot | `COPILOT_GITHUB_TOKEN` |
-| Injected token file | cursor, devin, antigravity | `CURSOR_/DEVIN_/ANTIGRAVITY_TOKEN_TGZ_B64` |
-| Delivery | — | `SLACK_WEBHOOK_URL` |
-
-The injected-token CLIs carry OAuth session tokens captured from a logged-in
-machine (see `capture-tokens.sh`). They authenticate on a fresh runner, but may
-eventually expire — when that happens the test reports `⚠️ ERROR` for that CLI;
-re-login on the capture machine and refresh the secret.
-
-> Note: env-var / secret names keep the historical `CANARY_` prefix internally —
-> renaming them across the harness would be churn with no user-visible benefit.
-
-## Files
-
-```
-ci-entrypoint.sh      CI front door: build -> sandbox -> install -> probe -> cleanup
-Dockerfile            non-root sandbox base image
-install-clis.sh       install/upgrade the CLIs for $CANARY_CHANNEL (with retries)
-inject-tokens.sh      write captured OAuth creds into the fresh volume
-probe-cli.sh          live enforcement probe for ONE CLI (the oracle)
-canary-policies.mjs   benign-marker custom policies the probe trips
-run.sh                orchestrator (gate → probe → report → Slack)
-report.js             build the Slack report + diff state (broke/recovered)
-capture-tokens.sh     (run on a logged-in machine) refresh the OAuth token secrets
-```