failproofai 1.0.0-beta.4 → 1.0.0-beta.6

package/src/hooks/custom-hooks-loader.ts

@@ -11,6 +11,7 @@
  * and results in an empty hook list for that file. Builtins continue normally.
  */
 import { resolve, isAbsolute, basename } from "node:path";
+import { randomUUID } from "crypto";
 import { existsSync, readdirSync } from "node:fs";
 import { readFile } from "node:fs/promises";
 import { pathToFileURL } from "node:url";
@@ -18,12 +19,20 @@ import { homedir } from "node:os";
 import { createHash } from "node:crypto";
 import { hookLogWarn, hookLogError, hookLogInfo } from "./hook-logger";
 import { customPolicies, getCustomHooks, clearCustomHooks } from "./custom-hooks-registry";
-import { findDistIndex, rewriteFileTree, TMP_SUFFIX, cleanupTmpFiles } from "./loader-utils";
+import {
+  findDistIndex,
+  rewriteFileTree,
+  TMP_SUFFIX,
+  cleanupTmpFiles,
+  isTmpArtifact,
+  sweepStaleTmpArtifacts,
+} from "./loader-utils";
 import { findProjectConfigDir } from "./hooks-config";
 import { trackHookEvent } from "./hook-telemetry";
 import { getInstanceId } from "../../lib/telemetry-id";
 import type { CustomHook } from "./policy-types";
 import type { CloudManagedPolicyArtifact } from "./cloud-managed-policies";
+import { customPoliciesDir, shimsDir } from "./fp-home";
 
 const LOADING_KEY = "__FAILPROOFAI_LOADING_HOOKS__";
 
@@ -45,6 +54,15 @@ interface CachedPolicyModule {
  * functions prevents an unbounded ESM module-cache leak in the resident worker.
  * A source-tree change replaces this entry and imports one new module. */
 const policyModuleCache = new Map<string, CachedPolicyModule>();
+/**
+ * Cap, for the reason `gitBranchCache` states and this cache did not carry
+ * over: a warm worker touching many projects over its lifetime must not grow
+ * this unboundedly. Keyed by absolute policy-file path and holding cloned hook
+ * closures, so the entries are not small. Cleared wholesale rather than evicted
+ * one at a time — the next load simply re-imports, which is the same cost the
+ * cache exists to avoid paying twice, not a correctness change.
+ */
+const POLICY_MODULE_CACHE_MAX_ENTRIES = 500;
 
 /** Script extensions we could load, used to spot near-miss filenames. */
 const LOADABLE_EXT_RE = /\.(js|mjs|ts)$/;
@@ -87,7 +105,11 @@ export function findSkippedPolicyFiles(dir: string): string[] {
           e.isFile() &&
           LOADABLE_EXT_RE.test(e.name) &&
           !CONVENTION_FILE_RE.test(e.name) &&
-          !e.name.endsWith(".d.ts"),
+          !e.name.endsWith(".d.ts") &&
+          // Never our own generated files. They are `.mjs` and never match the
+          // convention, so each one a killed load left behind was reported to
+          // the user as a policy file that would not load.
+          !isTmpArtifact(e.name),
       )
       .map((e) => e.name)
       .sort((a, b) => a.localeCompare(b));
@@ -96,13 +118,69 @@ export function findSkippedPolicyFiles(dir: string): string[] {
   }
 }
 
+/**
+ * How long a policy module gets to finish evaluating its top level.
+ *
+ * Matches the 10s `handler.ts` gives a policy's `fn` to run, for the same
+ * reason: a policy file is user code, and user code that hangs must cost one
+ * skipped policy rather than the process.
+ *
+ * `FAILPROOFAI_POLICY_LOAD_TIMEOUT_MS` shortens it for tests — a suite proving
+ * the deadline fires should not have to sit out the real one.
+ */
+function moduleLoadTimeoutMs(): number {
+  const override = Number(process.env.FAILPROOFAI_POLICY_LOAD_TIMEOUT_MS);
+  return Number.isFinite(override) && override > 0 ? override : 10_000;
+}
+
+/**
+ * `import()`, but it cannot hang forever.
+ *
+ * A bare `await import(...)` on a module whose top level contains an `await`
+ * that never resolves never settles — it does not reject, so no `catch` and no
+ * `finally` anywhere above it ever runs. In the one-shot hook path that costs
+ * one hook process, which the agent CLI's own timeout reaps. In the warm daemon
+ * worker it holds `worker-server.ts`'s serialization chain forever, and every
+ * subsequent hook on the machine queues behind it and fail-closed denies.
+ *
+ * Losing the race does NOT cancel the import — nothing can. It stops us
+ * *waiting* on it, which is the part that matters, and the caller's `catch`
+ * below reports the file as failed to load. The abandoned module keeps its
+ * half-initialized entry in the ESM cache, but each load writes a uniquely
+ * named temporary tree, so a retry imports a different specifier and is never
+ * poisoned by it.
+ */
+async function importWithDeadline(fileUrl: string): Promise<void> {
+  const budget = moduleLoadTimeoutMs();
+  let timer: ReturnType<typeof setTimeout> | undefined;
+  try {
+    await Promise.race([
+      import(/* webpackIgnore: true */ fileUrl),
+      new Promise<never>((_, reject) => {
+        timer = setTimeout(
+          () => reject(new Error(`timed out loading module after ${budget}ms`)),
+          budget,
+        );
+        timer.unref?.();
+      }),
+    ]);
+  } finally {
+    if (timer) clearTimeout(timer);
+  }
+}
+
 /**
  * Load a single policy file into the globalThis custom hooks registry.
  * Does NOT clear the registry — caller is responsible for that.
  */
 async function loadSingleFile(
   absPath: string,
-  opts?: { strict?: boolean; conventionScope?: "project" | "user" },
+  opts?: {
+    strict?: boolean;
+    conventionScope?: "project" | "user";
+    /** Cloud-managed policies pass their pinned digest for load-time re-verification. */
+    verifyEntrySha?: string;
+  },
 ): Promise<void> {
   const g = globalThis as Record<string, unknown>;
   g[LOADING_KEY] = true;
@@ -113,8 +191,19 @@ async function loadSingleFile(
     const distUrl = distIndex ? pathToFileURL(distIndex).href : null;
 
     const sequence = ++loadSequence;
-    const tmpSuffix = `${TMP_SUFFIX}.${process.pid}.${sequence}.mjs`;
-    tmpFiles = await rewriteFileTree(absPath, distUrl, distIndex, tmpSuffix);
+    // pid + sequence is not unique enough on its own: two containers sharing a
+    // mounted HOME, or two pid namespaces, can collide — and on the shim's
+    // fallback path a collision means EEXIST, which fails the load OPEN. A
+    // random id removes the class. It costs nothing: `fingerprintTemporaryTree`
+    // normalises the whole suffix away, so the module cache still hits.
+    const tmpSuffix = `${TMP_SUFFIX}.${process.pid}.${sequence}.${randomUUID()}.mjs`;
+    tmpFiles = await rewriteFileTree(
+      absPath,
+      distUrl,
+      distIndex,
+      tmpSuffix,
+      opts?.verifyEntrySha,
+    );
 
     const fingerprint = await fingerprintTemporaryTree(tmpFiles, tmpSuffix);
     const cached = policyModuleCache.get(absPath);
@@ -126,7 +215,8 @@ async function loadSingleFile(
     const entryTmp = absPath + tmpSuffix;
     const fileUrl = pathToFileURL(entryTmp).href;
     const hooksBefore = getCustomHooks().length;
-    await import(/* webpackIgnore: true */ fileUrl);
+    await importWithDeadline(fileUrl);
+    if (policyModuleCache.size >= POLICY_MODULE_CACHE_MAX_ENTRIES) policyModuleCache.clear();
     policyModuleCache.set(absPath, {
       fingerprint,
       hooks: getCustomHooks()
@@ -139,7 +229,9 @@ async function loadSingleFile(
       ? "module_not_found"
       : /SyntaxError|Unexpected token/i.test(msg)
         ? "syntax_error"
-        : "runtime_error";
+        : /timed out loading module/i.test(msg)
+          ? "load_timeout"
+          : "runtime_error";
     void trackHookEvent(getInstanceId(), "custom_hooks_load_error", {
       error_type: errorType,
       is_convention: !!opts?.conventionScope,
@@ -282,7 +374,11 @@ export async function loadAllCustomHooks(
       if (!loadedPaths.has(absPath)) {
         loadedPaths.add(absPath);
         const hooksBefore = getCustomHooks().length;
-        await loadSingleFile(absPath);
+        // A cloud-managed policy re-verifies its pinned digest at load, binding
+        // the imported bytes to what desired-state promised.
+        await loadSingleFile(absPath, {
+          verifyEntrySha: cloudManagedByPath.get(absPath)?.sha256,
+        });
         for (const hook of getCustomHooks().slice(hooksBefore)) {
           const cloudManaged = cloudManagedByPath.get(absPath);
           const tagged = hook as CustomHook & {
@@ -312,7 +408,22 @@ export async function loadAllCustomHooks(
   // exactly that — and it is discovered here as well. Skip what step 1 loaded,
   // or the file is imported twice and every hook in it fires twice per event.
   const projectDir = resolve(projectRoot, ".failproofai", "policies");
-  if (conventionEnabled) warnSkippedPolicyFiles(projectDir, "project");
+  // Clear out generated files a killed load left behind, before anything scans
+  // this directory. The temporary tree has to be written beside the sources for
+  // a rewritten relative import to resolve, and its name now carries a pid and
+  // sequence number — so unlike the old fixed name, each abnormal termination
+  // leaks one file permanently rather than leaving one that the next load
+  // overwrites. Best-effort and age-gated, so it can never remove a tree
+  // another process is still importing.
+  if (conventionEnabled) {
+    void sweepStaleTmpArtifacts(projectDir);
+    warnSkippedPolicyFiles(projectDir, "project");
+  }
+  // The shim directory leaks the same way and is swept on the same terms. It is
+  // ours alone and outside the policy tree, so nothing else would ever reap it;
+  // the age gate is what keeps this from removing a shim another process is
+  // still importing.
+  void sweepStaleTmpArtifacts(shimsDir());
   const projectFiles = conventionEnabled
     ? discoverPolicyFiles(projectDir).filter((f) => !loadedPaths.has(f))
     : [];
@@ -347,8 +458,11 @@ export async function loadAllCustomHooks(
   // so the second import is a no-op — but Node honours the query and would
   // double-register. The binary runs under Bun and the tests under Node, so the
   // bug is invisible from both sides. Do not rely on that; dedupe the paths.
-  const userDir = resolve(homedir(), ".failproofai", "policies");
-  if (conventionEnabled && userDir !== projectDir) warnSkippedPolicyFiles(userDir, "user");
+  const userDir = customPoliciesDir();
+  if (conventionEnabled && userDir !== projectDir) {
+    void sweepStaleTmpArtifacts(userDir);
+    warnSkippedPolicyFiles(userDir, "user");
+  }
   const userFiles =
     conventionEnabled && userDir !== projectDir
       ? discoverPolicyFiles(userDir).filter((f) => !loadedPaths.has(f))

package/src/hooks/daemon-client.ts

@@ -18,6 +18,8 @@ import { homedir } from "node:os";
 import type { IntegrationType } from "./types";
 import { readHooksConfig } from "./hooks-config";
 import { existsSync } from "node:fs";
+import { daemonSocket as daemonSocketPath } from "./fp-home";
+import { readConfig } from "./fp-config";
 
 const PROTOCOL_VERSION = 1;
 
@@ -67,6 +69,27 @@ export interface DaemonHookResponse {
   stderr: string;
 }
 
+/**
+ * Why an attempt failed — and it matters, because the two cases deserve
+ * opposite answers.
+ *
+ * `protocol-mismatch` means a daemon answered and is demonstrably HEALTHY; we
+ * simply cannot speak its wire format. The cause is known and benign: the CLI
+ * upgraded via npm and the daemon has not been reinstalled yet. Falling back to
+ * in-process evaluation there loses no enforcement at all — it runs the
+ * identical policy engine, just slower — so denying every tool call over it
+ * would take a working machine offline to protect nothing.
+ *
+ * `unreachable` means nothing answered. That could be a stopped service, a
+ * deleted socket, or tampering, and we cannot tell which — so it keeps failing
+ * closed, which is the whole point of `daemonConfigured`.
+ */
+export type DaemonFailure = "unreachable" | "protocol-mismatch";
+
+export type DaemonAttempt =
+  | { ok: true; response: DaemonHookResponse }
+  | { ok: false; failure: DaemonFailure };
+
 /**
  * Whether a daemon is listening, regardless of how it was started.
  *
@@ -86,7 +109,7 @@ export function daemonSocketPresent(): boolean {
 
 function socketPath(): string {
   if (process.env.FAILPROOFAI_DAEMON_SOCKET) return process.env.FAILPROOFAI_DAEMON_SOCKET;
-  return resolve(homedir(), ".failproofai", "run", "failproofaid.sock");
+  return daemonSocketPath();
 }
 
 /**
@@ -99,8 +122,11 @@ function socketPath(): string {
  */
 export function isDaemonConfigured(): boolean {
   try {
-    return readHooksConfig().daemonConfigured === true;
+    return readConfig().daemon.configured === true;
   } catch {
+    // Unreadable config reads as NOT daemon-configured. The failure direction
+    // is deliberate: the alternative is a machine that fails closed on every
+    // tool call because a config file got truncated.
     return false;
   }
 }
@@ -120,24 +146,52 @@ function encodeFrame(value: unknown): Buffer {
  * falls through to whatever its own fallback policy is.
  */
 export async function tryDaemonHook(req: DaemonHookRequest): Promise<DaemonHookResponse | null> {
+  const attempt = await attemptDaemonHook(req);
+  return attempt.ok ? attempt.response : null;
+}
+
+/**
+ * The same attempt, but reporting WHY it failed.
+ *
+ * `tryDaemonHook` above collapses every failure into `null`, which was fine
+ * while the caller had one answer for all of them. It no longer does: a
+ * protocol mismatch must fall back rather than deny (see `DaemonFailure`), and
+ * a caller cannot make that distinction from `null`.
+ */
+export async function attemptDaemonHook(
+  req: DaemonHookRequest,
+  opts?: {
+    /**
+     * Override the RESPONSE budget only — the connect budget is never
+     * relaxed. Used by the health probe (`probeDaemonEndToEnd`), which runs
+     * from an interactive command rather than a hook and must not make a
+     * person wait out the full 30s hook budget to be told their daemon is
+     * broken. Never set this on the hook path: 30s is matched to the
+     * daemon's own read timeout so this side never gives up on a request the
+     * daemon is still honestly working on.
+     */
+    responseTimeoutMs?: number;
+  },
+): Promise<DaemonAttempt> {
   // Windows never has a daemon in this phase (see the plan's platform
   // scope) — skip the attempt outright rather than depending on however
   // Node happens to behave when handed a POSIX socket path on Windows.
-  if (process.platform === "win32") return null;
+  if (process.platform === "win32") return { ok: false, failure: "unreachable" };
+  const responseBudget = opts?.responseTimeoutMs ?? DAEMON_RESPONSE_TIMEOUT_MS;
 
-  return new Promise<DaemonHookResponse | null>((resolvePromise) => {
+  return new Promise<DaemonAttempt>((resolvePromise) => {
     let settled = false;
     let timer: ReturnType<typeof setTimeout>;
     const arm = (ms: number) => {
       clearTimeout(timer);
-      timer = setTimeout(() => finish(null), ms);
+      timer = setTimeout(() => fail("unreachable"), ms);
       // Don't let this timer alone keep the process alive if everything else
       // has already finished — it's always cleared on the success/failure
       // paths below, this just avoids it being the sole reason a --hook
       // process lingers if something upstream forgets to await us.
       timer.unref?.();
     };
-    const finish = (result: DaemonHookResponse | null) => {
+    const finish = (result: DaemonAttempt) => {
       if (settled) return;
       settled = true;
       clearTimeout(timer);
@@ -145,6 +199,7 @@ export async function tryDaemonHook(req: DaemonHookRequest): Promise<DaemonHookR
       socket.destroy();
       resolvePromise(result);
     };
+    const fail = (failure: DaemonFailure) => finish({ ok: false, failure });
 
     const socket = createConnection({ path: socketPath() });
     arm(DAEMON_CONNECT_TIMEOUT_MS);
@@ -155,7 +210,7 @@ export async function tryDaemonHook(req: DaemonHookRequest): Promise<DaemonHookR
     socket.on("connect", () => {
       // Connected: the daemon is demonstrably reachable, so the question is
       // no longer "is it there" but "how long does this evaluation take".
-      arm(DAEMON_RESPONSE_TIMEOUT_MS);
+      arm(responseBudget);
       socket.write(
         encodeFrame({
           type: "hook",
@@ -175,7 +230,7 @@ export async function tryDaemonHook(req: DaemonHookRequest): Promise<DaemonHookR
         if (recvBuf.length < 4) return;
         declaredLen = recvBuf.readUInt32BE(0);
         if (declaredLen > MAX_FRAME_LEN) {
-          finish(null);
+          fail("unreachable");
           return;
         }
         recvBuf = recvBuf.subarray(4);
@@ -188,12 +243,16 @@ export async function tryDaemonHook(req: DaemonHookRequest): Promise<DaemonHookR
       try {
         message = JSON.parse(body.toString("utf8")) as Record<string, unknown>;
       } catch {
-        finish(null);
+        fail("unreachable");
         return;
       }
 
       if (message.protocolVersion !== PROTOCOL_VERSION) {
-        finish(null);
+        // Catches BOTH directions. A newer CLI sends v2 and the daemon replies
+        // with an error stamped v1; an older CLI sends v1 and a newer daemon
+        // replies stamped v2. Either way the versions disagree here, and either
+        // way a daemon answered — so this is skew, not absence.
+        fail("protocol-mismatch");
         return;
       }
       if (
@@ -202,16 +261,23 @@ export async function tryDaemonHook(req: DaemonHookRequest): Promise<DaemonHookR
         typeof message.stdout === "string" &&
         typeof message.stderr === "string"
       ) {
-        finish({ exitCode: message.exitCode, stdout: message.stdout, stderr: message.stderr });
+        finish({
+          ok: true,
+          response: {
+            exitCode: message.exitCode,
+            stdout: message.stdout,
+            stderr: message.stderr,
+          },
+        });
         return;
       }
-      // Anything else — an explicit `error` message, a `pong` (protocol
-      // confusion), or a well-formed-but-wrong-shape body — is treated
-      // identically to a connection failure: no partial trust.
-      finish(null);
+      // Anything else — an explicit `error` message at a MATCHING protocol
+      // version, a `pong` (protocol confusion), or a well-formed-but-wrong-shape
+      // body — is treated identically to a connection failure: no partial trust.
+      fail("unreachable");
     });
 
-    socket.on("error", () => finish(null));
-    socket.on("close", () => finish(null));
+    socket.on("error", () => fail("unreachable"));
+    socket.on("close", () => fail("unreachable"));
   });
 }

package/src/hooks/daemon-download.ts

@@ -33,13 +33,24 @@
  * this writes an executable that a service manager will then run at login.
  */
 import { createHash } from "node:crypto";
-import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import {
+  chmodSync,
+  existsSync,
+  mkdirSync,
+  readdirSync,
+  readFileSync,
+  renameSync,
+  rmSync,
+  statSync,
+  writeFileSync,
+} from "node:fs";
 import { createRequire } from "node:module";
 import { homedir } from "node:os";
 import { dirname, resolve } from "node:path";
 import { gunzipSync } from "node:zlib";
 import { version } from "../../package.json";
 import type { PlatformKey } from "./daemon-service";
+import { binDir as layoutBinDir } from "./fp-home";
 
 /**
  * Where release assets live. Overridable so an air-gapped or proxied site can
@@ -62,7 +73,7 @@ function baseUrl(): string {
 
 /** Where downloaded binaries live. One directory, one file per version. */
 export function daemonBinaryDir(): string {
-  return resolve(homedir(), ".failproofai", "bin");
+  return layoutBinDir();
 }
 
 /**
@@ -165,6 +176,47 @@ function platformPackageBinary(dir: string): string | null {
  * manager could pick up), mode 0755, pid-suffixed so two concurrent wizards
  * stay off each other's file.
  */
+/**
+ * Delete daemon binaries older than the current and previous versions.
+ *
+ * Called AFTER the new binary is in place and the unit repointed, never
+ * before: a binary a running service points at must not be removed out from
+ * under it. One previous version is kept deliberately — a rollback is then a
+ * local file rather than a re-download, which is the difference between
+ * working and not on a machine that is offline or behind a proxy.
+ *
+ * Sorted by mtime rather than by parsing versions out of filenames: a
+ * prerelease ordering (`1.0.0-beta.10` vs `1.0.0-beta.9`) is easy to get
+ * subtly wrong, and "which did we install most recently" is the question that
+ * actually matters here.
+ */
+export function pruneOldDaemonBinaries(keep = 2): string[] {
+  const removed: string[] = [];
+  try {
+    const dir = daemonBinaryDir();
+    const entries = readdirSync(dir)
+      .filter((f) => f.startsWith("failproofaid-") && !f.endsWith(".tmp"))
+      .map((f) => {
+        const full = resolve(dir, f);
+        return { full, mtime: statSync(full).mtimeMs };
+      })
+      .sort((a, b) => b.mtime - a.mtime);
+
+    for (const stale of entries.slice(keep)) {
+      try {
+        rmSync(stale.full, { force: true });
+        removed.push(stale.full);
+      } catch {
+        // In use, or not ours to delete. Leaving it costs disk; removing it by
+        // force could break a running service.
+      }
+    }
+  } catch {
+    // No directory yet, or unreadable — nothing to prune.
+  }
+  return removed;
+}
+
 function installBinaryBytes(binary: Buffer): string {
   const target = installedBinaryPath();
   const tempPath = `${target}.${process.pid}.tmp`;