failproofai 1.0.0-beta.4 → 1.0.0-beta.6

package/.next/standalone/integration-suite/canary-policies.mjs

@@ -1,45 +0,0 @@
-/**
- * Canary custom policies — the DEFINITE probe.
- *
- * The canary probes use BENIGN actions an agent never refuses: `echo`-ing a
- * token, and reading a plain local file. Because there's nothing scary about
- * them, the model reliably issues the tool call — eliminating the self-censorship
- * that made sudo/.env/system-read probes come back INCONCLUSIVE.
- *
- * These policies intercept exactly those benign markers. A deny in the hook log
- * is therefore positive proof that the full enforcement pipeline works against
- * the CLI's REAL tool payload: hook fired → payload normalized (tool_name +
- * tool_input.command / file_path — the drift-prone fields behind the Copilot
- * 1.0.70 silent-allow) → policy evaluated → deny emitted. If normalization ever
- * drifts, ctx.toolInput.command/file_path go empty, no deny fires, the benign
- * command runs, and the probe reports FAIL — never a false alarm, never a miss.
- */
-import { customPolicies, allow, deny } from "failproofai";
-
-// Bash-command path: deny a benign shell command carrying the probe token.
-customPolicies.add({
-  name: "canary-bash",
-  description: "Canary: deny the benign probe shell command (CANARY_PROBE token)",
-  match: { events: ["PreToolUse"] },
-  fn: async (ctx) => {
-    if (ctx.toolName !== "Bash") return allow();
-    const cmd = String(ctx.toolInput?.command ?? "");
-    if (cmd.includes("CANARY_PROBE")) return deny("canary-bash probe intercepted");
-    return allow();
-  },
-});
-
-// File-path path: deny reading the benign marker file (via Read tool OR `cat`).
-customPolicies.add({
-  name: "canary-read",
-  description: "Canary: deny reading the benign probe marker file (CANARY_MARKER)",
-  match: { events: ["PreToolUse"] },
-  fn: async (ctx) => {
-    const path = String(ctx.toolInput?.file_path ?? "");
-    const cmd = String(ctx.toolInput?.command ?? "");
-    if (path.includes("CANARY_MARKER") || cmd.includes("CANARY_MARKER")) {
-      return deny("canary-read probe intercepted");
-    }
-    return allow();
-  },
-});

package/.next/standalone/integration-suite/capture-tokens.sh

@@ -1,48 +0,0 @@
-#!/usr/bin/env bash
-# ─────────────────────────────────────────────────────────────────────────────
-# capture-tokens.sh — run on the OFFICE BOX (has the logged-in canary volume).
-#   ./capture-tokens.sh <owner/repo>
-#
-# Captures each OAuth CLI's credential tree from the persistent HOME volume as a
-# base64 gzip-tar rooted at $HOME, and stores it as a GitHub Actions secret on
-# the canary repo. The CI workflow decodes it back onto the ephemeral runner's
-# volume (see sandbox/inject-tokens.sh), so cursor/devin/antigravity authenticate
-# in CI without an interactive login.
-#
-# Re-run this whenever the canary reports ERROR (not-logged-in / 401) for one of
-# these CLIs — i.e. after you re-login on the box — to refresh the secret.
-#
-# NB: these are real credentials for internal@exosphere.host. They live only in
-# GitHub *encrypted secrets*, never in the repo tree.
-# ─────────────────────────────────────────────────────────────────────────────
-set -euo pipefail
-REPO="${1:?usage: capture-tokens.sh <owner/repo>}"
-VOL="${CANARY_VOL:-failproofai-canary-home}"
-IMAGE="${CANARY_IMAGE:-failproofai-canary:base}"
-
-# secret-name   →   $HOME-relative path(s) to tar from the volume
-capture() {
-  local secret="$1"; shift
-  local paths=("$@")
-  echo "── $secret  ($(printf '%s ' "${paths[@]}"))"
-  # Tar the paths (rooted at $HOME) inside the container, gzip, base64 → host.
-  local b64
-  b64="$(docker run --rm -v "$VOL:/home/canary" "$IMAGE" bash -c "
-    cd \$HOME || exit 1
-    miss=1
-    for p in ${paths[*]}; do [ -e \"\$p\" ] && miss=0; done
-    [ \$miss = 1 ] && { echo 'MISSING' >&2; exit 3; }
-    tar -czf - ${paths[*]} 2>/dev/null | base64 -w0
-  ")" || { echo "    ⚠️  none of the paths exist in the volume — skipping (login first)"; return 0; }
-  if [ -z "$b64" ]; then echo "    ⚠️  empty capture — skipping"; return 0; fi
-  printf '%s' "$b64" | gh secret set "$secret" --repo "$REPO" --body -
-  echo "    ✓ set $secret (${#b64} b64 chars)"
-}
-
-echo "Capturing OAuth credential trees from volume '$VOL' → secrets on $REPO"
-capture CURSOR_TOKEN_TGZ_B64       .config/cursor
-capture DEVIN_TOKEN_TGZ_B64        .local/share/devin/credentials.toml
-# antigravity: capture ONLY the small OAuth token file — the full ~/.gemini tree
-# is ~15 MB (CLI binary + brain/ + logs), far over GitHub's 48 KB secret cap.
-capture ANTIGRAVITY_TOKEN_TGZ_B64  .gemini/antigravity-cli/antigravity-oauth-token
-echo "done."

package/.next/standalone/integration-suite/ci-entrypoint.sh

@@ -1,179 +0,0 @@
-#!/usr/bin/env bash
-# ─────────────────────────────────────────────────────────────────────────────
-# failproofai integration suite — CI entrypoint (runs on the GitHub Actions runner).
-#
-# This is the suite's single front door for CI. The workflow
-# (.github/workflows/integration-suite.yml) is a thin trigger: it checks out,
-# installs bun, maps secrets into the environment, and calls this script. Every
-# step that actually *does* something lives here, so the harness can be read —
-# and run — without opening the YAML.
-#
-# Responsibilities, in order:
-#   1. build failproofai under test (dist/index.js + dist/cli.mjs)
-#   2. decode the base64 OAuth-token secrets into $TOKENS_DIR
-#   3. build the sandbox image and create the per-run HOME volume
-#   4. install all 12 CLIs @latest into that volume, then inject the tokens
-#   5. assemble the gateway env-file
-#   6. hand off to run.sh, which does the version-gating, probing and reporting
-#
-# Cleanup (env-file + docker volume) runs via trap, so it happens on failure and
-# on early exit too — not just on the happy path.
-#
-# Inputs are all environment variables, so this is runnable outside GH Actions:
-#
-#   GITHUB_WORKSPACE       repo checkout (default: this script's parent dir)
-#   CANARY_LLM_API_KEY     gateway credentials -> written into the env-file
-#   CANARY_LLM_BASE_URL    (default https://models.aikin.club)
-#   CANARY_LLM_MODEL       (default deepseek-v4-pro)
-#   CANARY_CLAUDE_MODEL    (default claude-haiku-4-5)
-#   CANARY_PI_MODEL        (default claude-haiku-4-5)
-#   CANARY_CODEX_MODEL     (default gpt-5.1-codex-mini)
-#   COPILOT_GITHUB_TOKEN   copilot PAT
-#   CURSOR_TOKEN_TGZ_B64   } base64 gzip-tars of each OAuth credential tree,
-#   DEVIN_TOKEN_TGZ_B64    } rooted at $HOME (see capture-tokens.sh)
-#   ANTIGRAVITY_TOKEN_TGZ_B64
-#   CANARY_STATE           version-gate state file (restored/saved by the workflow cache)
-#   CANARY_SLACK_WEBHOOK   optional; report is POSTed here when set
-#   CANARY_FP_SHA          failproofai HEAD, the second version-gate dimension
-#   CANARY_VERSION_GATED   "all" (default) | comma-sep list | "none" to force-probe
-#   CANARY_CLIS            space-separated CLI subset (empty = all 12)
-#   CANARY_SKIP_BUILD      set to 1 to reuse an existing dist/ (local iteration)
-# ─────────────────────────────────────────────────────────────────────────────
-set -u
-
-HERE="$(cd "$(dirname "$0")" && pwd)"
-REPO="${GITHUB_WORKSPACE:-$(dirname "$HERE")}"
-
-# Each channel gets its OWN volume: installing a pre-release into the same $HOME
-# overwrites the stable binary (npm -g, and the vendor installers all rewrite
-# their own shims), so the two refs cannot coexist in one volume.
-CHANNEL="${CANARY_CHANNEL:-stable}"
-SUFFIX=""; [ "$CHANNEL" != stable ] && SUFFIX="-$CHANNEL"
-VOL="${CANARY_VOL:-integration-suite$SUFFIX}"
-IMAGE="${CANARY_IMAGE:-failproofai-integration-suite:base}"
-ENVFILE="${CANARY_ENVFILE:-$REPO/canary$SUFFIX.env}"
-TOKENS_DIR="${CANARY_TOKENS_DIR:-$REPO/tokens$SUFFIX}"
-STATE="${CANARY_STATE:-$REPO/integration-suite-state$SUFFIX.json}"
-# The stable leg's state, so the beta leg can tell "about to break" from
-# "already broken" (see report.js). Unset on the stable leg.
-PEER_STATE="${CANARY_PEER_STATE:-}"
-[ "$CHANNEL" != stable ] && [ -z "$PEER_STATE" ] && PEER_STATE="$REPO/integration-suite-state.json"
-
-step() { echo "── $* ──" >&2; }
-
-cleanup() {
-  local rc=$?
-  step "cleanup"
-  rm -f "$ENVFILE"
-  rm -rf "$TOKENS_DIR"
-  docker volume rm "$VOL" -f >/dev/null 2>&1 || true
-  exit "$rc"
-}
-trap cleanup EXIT
-
-# ── 0. adopt legacy version-gate state (rename transition) ──────────────────
-# This harness was renamed from `cli-integration`, which took the Actions cache
-# key with it. The workflow restores the legacy cache alongside the new one; if
-# only the legacy file is present, adopt it so the version-gate keeps its
-# baseline instead of re-probing all 12 CLIs and reporting every one as changed.
-# Safe to delete (with the workflow's legacy restore step) once a run has saved
-# state under the new key.
-LEGACY_STATE="${CANARY_LEGACY_STATE:-$REPO/cli-integration-state.json}"
-if [ ! -s "$STATE" ] && [ -s "$LEGACY_STATE" ]; then
-  step "adopting legacy version-gate state from $(basename "$LEGACY_STATE")"
-  cp "$LEGACY_STATE" "$STATE" || echo "  WARN: copy failed — gate starts empty" >&2
-fi
-
-# ── 1. build failproofai under test ─────────────────────────────────────────
-if [ "${CANARY_SKIP_BUILD:-0}" = 1 ]; then
-  step "skipping build (CANARY_SKIP_BUILD=1)"
-else
-  step "building failproofai under test (dist/index.js + dist/cli.mjs — no dashboard)"
-  (
-    cd "$REPO" || exit 1
-    bun install --frozen-lockfile || exit 1
-    bun build --target=node --format=cjs --outfile=dist/index.js src/index.ts || exit 1
-    bun run build:cli || exit 1
-  ) || { echo "✗ build failed" >&2; exit 1; }
-fi
-if [ ! -s "$REPO/dist/index.js" ] || [ ! -s "$REPO/dist/cli.mjs" ]; then
-  echo "✗ dist/index.js and dist/cli.mjs must both be non-empty" >&2
-  exit 1
-fi
-
-# ── 2. decode OAuth token secrets ───────────────────────────────────────────
-# Each is a base64 gzip-tar rooted at $HOME. A missing secret is NOT fatal: that
-# CLI simply reports ERROR (can't auth) rather than taking the whole run down.
-step "decoding OAuth token secrets"
-mkdir -p "$TOKENS_DIR"
-chmod 700 "$TOKENS_DIR"
-decode_token() {
-  local name="$1" b64="$2"
-  if [ -z "$b64" ]; then
-    echo "  ✗ $name: no secret set (that CLI will report ERROR)"
-    return 0
-  fi
-  if printf '%s' "$b64" | base64 -d > "$TOKENS_DIR/$name.tgz" 2>/dev/null; then
-    echo "  ✓ $name: $(wc -c < "$TOKENS_DIR/$name.tgz") bytes"
-  else
-    echo "  ✗ $name: base64 decode FAILED (that CLI will report ERROR)"
-    rm -f "$TOKENS_DIR/$name.tgz"
-  fi
-}
-decode_token cursor      "${CURSOR_TOKEN_TGZ_B64:-}"
-decode_token devin       "${DEVIN_TOKEN_TGZ_B64:-}"
-decode_token antigravity "${ANTIGRAVITY_TOKEN_TGZ_B64:-}"
-
-# ── 3. sandbox image + per-run volume ───────────────────────────────────────
-step "building sandbox image ($IMAGE)"
-docker build -t "$IMAGE" "$HERE/" || { echo "✗ sandbox image build failed" >&2; exit 1; }
-
-step "creating per-run HOME volume ($VOL)"
-docker volume rm "$VOL" -f >/dev/null 2>&1 || true
-docker volume create "$VOL" >/dev/null || { echo "✗ volume create failed" >&2; exit 1; }
-
-# ── 4. install CLIs @latest, then inject tokens ─────────────────────────────
-step "installing CLIs (channel=$CHANNEL) into the fresh volume"
-docker run --rm -e CANARY_CHANNEL="$CHANNEL" -v "$VOL:/home/canary" -v "$HERE:/opt/canary:ro" \
-  "$IMAGE" bash /opt/canary/install-clis.sh \
-  || { echo "✗ CLI install failed" >&2; exit 1; }
-
-step "injecting OAuth credential files"
-docker run --rm -v "$VOL:/home/canary" \
-  -v "$HERE:/opt/canary:ro" -v "$TOKENS_DIR:/opt/tokens:ro" \
-  "$IMAGE" bash /opt/canary/inject-tokens.sh \
-  || { echo "✗ token injection failed" >&2; exit 1; }
-
-# ── 5. gateway env-file ─────────────────────────────────────────────────────
-# umask 077 so the file with the gateway key is never group/world readable.
-step "assembling gateway env-file"
-(
-  umask 077
-  {
-    echo "CANARY_LLM_API_KEY=${CANARY_LLM_API_KEY:-}"
-    echo "CANARY_LLM_BASE_URL=${CANARY_LLM_BASE_URL:-https://models.aikin.club}"
-    echo "CANARY_LLM_MODEL=${CANARY_LLM_MODEL:-deepseek-v4-pro}"
-    echo "CANARY_CLAUDE_MODEL=${CANARY_CLAUDE_MODEL:-claude-haiku-4-5}"
-    echo "CANARY_PI_MODEL=${CANARY_PI_MODEL:-claude-haiku-4-5}"
-    # Without this line probe-cli.sh's CANARY_CODEX_MODEL override was dead plumbing:
-    # the var is read inside the container, and only what is written here crosses into it.
-    echo "CANARY_CODEX_MODEL=${CANARY_CODEX_MODEL:-gpt-5.1-codex-mini}"
-    echo "COPILOT_GITHUB_TOKEN=${COPILOT_GITHUB_TOKEN:-}"
-  } > "$ENVFILE"
-)
-
-# ── 6. probe + report ───────────────────────────────────────────────────────
-# run.sh word-splits CANARY_CLIS into args; unquoted on purpose. It owns the
-# exit code (non-zero iff a hard FAIL verdict is present), which the trap
-# preserves.
-step "running integration probes + report"
-# shellcheck disable=SC2086
-CANARY_REPO="$REPO" \
-CANARY_SANDBOX="$HERE" \
-CANARY_VOL="$VOL" \
-CANARY_IMAGE="$IMAGE" \
-CANARY_STATE="$STATE" \
-CANARY_ENVFILE="$ENVFILE" \
-CANARY_CHANNEL="$CHANNEL" \
-CANARY_PEER_STATE="$PEER_STATE" \
-  bash "$HERE/run.sh" ${CANARY_CLIS:-}

package/.next/standalone/integration-suite/inject-tokens.sh

@@ -1,44 +0,0 @@
-#!/usr/bin/env bash
-# ─────────────────────────────────────────────────────────────────────────────
-# Token injection — runs INSIDE the sandbox container, against the fresh per-run
-# HOME volume, BEFORE the probes.
-#
-# On the office box the OAuth logins (cursor / devin / antigravity) live in a
-# PERSISTENT volume. GitHub-Actions runners are ephemeral, so instead each of
-# those credential trees is captured once (see capture-tokens.sh) into a GitHub
-# secret as a base64 gzip-tar rooted at $HOME, decoded by the workflow into
-# /opt/tokens/<name>.tgz, and extracted here into the fresh volume's $HOME.
-#
-# Extraction is rooted at $HOME and the tarballs were created with $HOME-relative
-# paths (e.g. `.config/cursor`, `.local/share/devin/credentials.toml`), so each
-# file lands exactly where its CLI expects it. Env-var-auth CLIs (gateway key,
-# copilot PAT, factory BYOK) need NO file here — they authenticate from env.
-# ─────────────────────────────────────────────────────────────────────────────
-set -u
-TOK="${1:-/opt/tokens}"
-
-if [ ! -d "$TOK" ]; then
-  echo "inject-tokens: no token dir at $TOK — nothing to inject (env-var CLIs only)"
-  exit 0
-fi
-
-shopt -s nullglob
-found=0
-for t in "$TOK"/*.tgz "$TOK"/*.tar.gz; do
-  found=1
-  echo "── injecting $(basename "$t") → \$HOME ──"
-  if tar -C "$HOME" -xzf "$t"; then
-    tar -tzf "$t" 2>/dev/null | sed 's/^/    /' | head -8
-  else
-    echo "    WARN: extract failed for $t (skipping — that CLI will report ERROR)"
-  fi
-done
-[ "$found" = 0 ] && echo "inject-tokens: token dir present but empty — env-var CLIs only"
-
-echo "── credential files now present in volume ──"
-for f in "$HOME/.config/cursor/auth.json" \
-         "$HOME/.local/share/devin/credentials.toml" \
-         "$HOME/.gemini/antigravity-cli"; do
-  [ -e "$f" ] && echo "  ✓ $f" || echo "  ✗ $f (absent)"
-done
-exit 0

package/.next/standalone/integration-suite/install-clis.sh

@@ -1,136 +0,0 @@
-#!/usr/bin/env bash
-# ─────────────────────────────────────────────────────────────────────────────
-# Tier-0 install probe — runs INSIDE the canary sandbox container.
-#
-# Installs/upgrades the agent CLIs into the persistent HOME volume, then records
-# which resolve to a runnable binary + their version. This is both the daily
-# "fresh upgrade" step AND the Tier-0 canary signal (packaging/binary breaks show
-# up here as a FAIL).
-#
-# CANARY_CHANNEL selects WHICH ref of each CLI to install:
-#   stable (default) — what users get. All 12 CLIs.
-#   beta             — the vendor's public pre-release ref, for early warning.
-#                      Only the CLIs that actually publish one; the rest are
-#                      SKIPPED, never silently re-installed at stable (that would
-#                      be duplicate work reported as coverage).
-#
-# Every beta ref below was verified live against the vendor's registry/CDN on
-# 2026-07-23; see ~/Desktop/failproofai-integration-suite-beta-channels-design.md
-# for the evidence, lead times, and the CLIs that have no pre-release ref at all
-# (factory, antigravity, pi, opencode, devin, hermes).
-#
-# Install methods verified 2026-07-16 (see failproofai-cli-canary-design.md).
-# Vendor installers scatter binaries across several dirs, so we search an
-# expanded PATH and fall back to a bounded `find` under $HOME.
-#
-# Output: a JSON array at $CANARY_RESULTS (default ~/canary-tier0.json) + a
-# human table on stdout. Never `set -e` — one CLI failing must not abort the rest.
-# ─────────────────────────────────────────────────────────────────────────────
-set -u
-
-RESULTS="${CANARY_RESULTS:-$HOME/canary-tier0.json}"
-LOGDIR="${CANARY_LOGDIR:-$HOME/canary-logs}"
-CHANNEL="${CANARY_CHANNEL:-stable}"
-mkdir -p "$LOGDIR"
-
-# Cover every dir the vendor installers are known to drop binaries into.
-export PATH="$HOME/.npm-global/bin:$HOME/.local/bin:$HOME/.factory/bin:$HOME/.hermes/bin:$HOME/.cursor/bin:$HOME/.codex/bin:$HOME/bin:$PATH"
-
-ROWS=()
-
-# probe <id> <binary> <--version flag> <stable install cmd> [beta install cmd]
-# Omitting the 5th argument declares "this CLI has no public pre-release ref",
-# which skips it entirely on the beta channel.
-probe() {
-  local id="$1" bin="$2" vflag="$3" install="$4" beta="${5:-}"
-  if [ "$CHANNEL" != stable ]; then
-    if [ -z "$beta" ]; then
-      echo "════════════════════ $id ════════════════════"
-      echo "  skipped — no public pre-release ref for this CLI"
-      return 0
-    fi
-    install="$beta"
-  fi
-  echo "════════════════════ $id ════════════════════"
-  local t0 t1 rc=1; t0=$SECONDS
-  # Retry transient install failures. Flaky vendor CDNs / HTTP-2 stream resets are
-  # common on ephemeral CI runners (e.g. factory's `curl … | sh` dropping the
-  # download mid-stream with `curl: (18)`). Break as soon as the binary resolves;
-  # otherwise give it up to 3 attempts so one bad download isn't a false FAIL.
-  for attempt in 1 2 3; do
-    bash -c "$install" >"$LOGDIR/$id.install.log" 2>&1
-    rc=$?
-    hash -r 2>/dev/null
-    command -v "$bin" >/dev/null 2>&1 && break
-    find "$HOME" -maxdepth 5 -name "$bin" -type f -perm -u+x 2>/dev/null | grep -q . && break
-    [ "$attempt" -lt 3 ] && { echo "  ↻ $id install attempt $attempt failed (rc=$rc) — retrying in 5s"; sleep 5; }
-  done
-  t1=$SECONDS
-  hash -r 2>/dev/null
-
-  # Resolve the binary: PATH first, then a bounded find under $HOME.
-  local resolved; resolved="$(command -v "$bin" 2>/dev/null || true)"
-  if [ -z "$resolved" ]; then
-    resolved="$(find "$HOME" -maxdepth 5 -name "$bin" -type f -perm -u+x 2>/dev/null | head -1)"
-  fi
-
-  local ver="" status="FAIL"
-  if [ -n "$resolved" ]; then
-    status="OK"
-    ver="$("$resolved" $vflag 2>&1 | head -1 | tr -cd '[:alnum:] ._+:/-')"
-  fi
-
-  printf '  rc=%s  time=%ss  bin=%s  ver=%s  => %s\n' \
-    "$rc" "$((t1 - t0))" "${resolved:-<none>}" "${ver:-<none>}" "$status"
-  [ "$status" = FAIL ] && echo "  ↳ last install log lines:" && tail -3 "$LOGDIR/$id.install.log" | sed 's/^/    /'
-
-  ROWS+=("$(printf '{"cli":"%s","status":"%s","binary":"%s","version":"%s","install_rc":%s,"secs":%s}' \
-    "$id" "$status" "${resolved:-}" "${ver:-}" "$rc" "$((t1 - t0))")")
-}
-
-#      id           binary         --ver flag    stable ref                                          beta ref (omitted = none exists)
-#
-# claude is the one CLI whose channels run BACKWARDS: nothing ships ahead of
-# `latest`, which is the bleeding edge (~1 release/day). What exists is `stable`,
-# ~13 days behind. So the stable leg pins `stable` — both to test what
-# conservative users actually run and to stop a same-day Anthropic release
-# red-lighting an unrelated PR — and `latest` becomes the early-warning ref.
-probe  claude       claude         "--version"   'curl -fsSL https://claude.ai/install.sh | bash -s stable' \
-                                                 'curl -fsSL https://claude.ai/install.sh | bash'
-probe  codex        codex          "--version"   'npm install -g @openai/codex@latest' \
-                                                 'npm install -g @openai/codex@alpha'
-probe  copilot      copilot        "--version"   'npm install -g @github/copilot@latest' \
-                                                 'npm install -g @github/copilot@prerelease'
-# Cursor validates the channel server-side: only prod/lab/static/prod-stable-internal
-# return 200, anything else is a 400. `lab` is Anysphere's own dogfood channel.
-probe  cursor       cursor-agent   "--version"   'curl https://cursor.com/install -fsS | bash' \
-                                                 'curl "https://cursor.com/install?channel=lab" -fsS | bash'
-# opencode's beta/dev tags are ~31 branch snapshots a day (0.0.0-<branch>-<ts>),
-# not release candidates — deliberately no beta ref.
-probe  opencode     opencode       "--version"   'npm install -g opencode-ai@latest'
-probe  pi           pi             "--version"   'npm install -g @mariozechner/pi-coding-agent@latest'
-# hermes install.sh git-clones main, which is ALSO what every hermes user gets —
-# its tags are markers nobody installs. So there is nothing ahead of us to probe,
-# and pinning a tag would test something no user runs.
-probe  hermes       hermes         "--version"   'curl -fsSL https://hermes-agent.nousresearch.com/install.sh | bash'
-probe  openclaw     openclaw       "--version"   'npm install -g openclaw@latest' \
-                                                 'npm install -g openclaw@beta'
-probe  factory      droid          "--version"   'curl -fsSL https://app.factory.ai/cli | sh'
-probe  devin        devin          "--version"   'curl -fsSL https://cli.devin.ai/install.sh | bash'
-probe  antigravity  agy            "--version"   'curl -fsSL https://antigravity.google/cli/install.sh | bash'
-# goose's canary is a ROLLING TAG (prerelease:false), selected by env var — not a
-# GitHub prerelease, so channel detection that scans for prerelease:true misses it.
-probe  goose        goose          "--version"   'curl -fsSL https://github.com/aaif-goose/goose/releases/download/stable/download_cli.sh | CONFIGURE=false bash' \
-                                                 'curl -fsSL https://github.com/aaif-goose/goose/releases/download/stable/download_cli.sh | CANARY=true CONFIGURE=false bash'
-
-# Emit JSON array.
-{ printf '['; IFS=,; printf '%s' "${ROWS[*]}"; printf ']\n'; } > "$RESULTS"
-
-echo
-echo "════════════════════ TIER-0 SUMMARY ════════════════════"
-ok=0; fail=0
-for r in "${ROWS[@]}"; do
-  case "$r" in *'"status":"OK"'*) ok=$((ok+1));; *) fail=$((fail+1));; esac
-done
-printf 'channel: %s   installed OK: %s / %s   failed: %s\n' "$CHANNEL" "$ok" "$((ok + fail))" "$fail"
-echo "results JSON: $RESULTS"