failproofai 1.0.0-beta.4 → 1.0.0-beta.6

package/src/hooks/policy-types.ts

@@ -126,13 +126,6 @@ export interface HooksConfig {
    * Only ever written explicitly as `false`.
    */
   customPoliciesEnabled?: boolean;
-  /**
-   * Upper bound, in ms, on how long `failproofai config --pause` may suspend
-   * enforcement. Only ever LOWERS the built-in 8h ceiling — a value above it is
-   * clamped back down, because a ceiling a project can raise is not a ceiling.
-   * Absent means the built-in ceiling applies.
-   */
-  maxPauseMs?: number;
   /**
    * Record of the convention policies (`.failproofai/policies/*policies.mjs`)
    * discovered at this scope the last time a failproofai command ran.

package/src/hooks/session-pause-cli.ts

@@ -17,7 +17,6 @@ import {
   writePause,
   type ActivePause,
 } from "./session-pause";
-import { readMergedHooksConfig } from "./hooks-config";
 
 export interface PauseCommandOptions {
   action: "pause" | "resume" | "status";
@@ -39,18 +38,21 @@ export interface PauseCommandResult {
 }
 
 /**
- * The ceiling, after any config lowering. A project may tighten this; nothing
- * may loosen it, so a config asking for 24h still gets 8h.
+ * The ceiling on a single `--pause`.
+ *
+ * Took a `cwd` and consulted `readMergedHooksConfig(cwd).maxPauseMs` to let a
+ * project LOWER it. That path was dead: the merge in `hooks-config.ts` builds
+ * its result field by field and never emits `maxPauseMs`, so the lookup could
+ * only ever read `undefined` — and the two tests that claimed to cover it
+ * `vi.mock`ed `readMergedHooksConfig` to return a field the real function
+ * cannot produce, which is why the gap survived. The knob is removed rather
+ * than wired up: nothing documented it, nothing could have used it, and the
+ * hard ceiling was doing all the work already.
+ *
+ * Kept as a function, and still the only thing `--pause` measures against, so
+ * reinstating a config lowering later is a change in one place.
  */
-export function effectiveCeilingMs(cwd?: string): number {
-  try {
-    const configured = readMergedHooksConfig(cwd).maxPauseMs;
-    if (typeof configured === "number" && Number.isFinite(configured) && configured > 0) {
-      return Math.min(configured, PAUSE_CEILING_MS);
-    }
-  } catch {
-    // An unreadable config must not remove the ceiling.
-  }
+export function effectiveCeilingMs(): number {
   return PAUSE_CEILING_MS;
 }
 
@@ -109,7 +111,7 @@ export function runPauseCommand(opts: PauseCommandOptions): PauseCommandResult {
   // pause
   let durationMs: number;
   try {
-    durationMs = parsePauseDuration(opts.duration, effectiveCeilingMs(cwd));
+    durationMs = parsePauseDuration(opts.duration, effectiveCeilingMs());
   } catch (err) {
     return { exitCode: 1, lines: [err instanceof Error ? err.message : String(err)], affected: 0 };
   }

package/src/hooks/session-pause.ts

@@ -27,6 +27,7 @@ import { createHash } from "node:crypto";
 import { join, resolve } from "node:path";
 import { writeJsonAtomically } from "../../lib/atomic-write";
 import { getAllHookActivityEntries } from "./hook-activity-store";
+import { sessionPauseDir } from "./fp-home";
 
 const SCHEMA_VERSION = 1;
 
@@ -44,6 +45,19 @@ export interface ActivePause {
   sessionId: string;
   /** Epoch ms. */
   pausedAt: number;
+  /**
+   * Epoch ms of the FIRST pause in this unbroken run, which the ceiling is
+   * measured from.
+   *
+   * `pausedAt` moves to now on every renewal, so a ceiling measured from it is
+   * not a ceiling at all: `--pause 8h` every seven hours suspends enforcement
+   * indefinitely, one legal command at a time, and each individual pause passes
+   * every check. This field is what makes 8h mean 8h. Carried forward by
+   * `writePause` while a pause is still live, and reset once one has expired —
+   * the limit is on how long enforcement can stay off in one stretch, not a
+   * daily quota.
+   */
+  firstPausedAt: number;
   /** Epoch ms. Always finite — there is no unbounded pause. */
   expiresAt: number;
   /** Free-form provenance, e.g. "cli". Recorded so the activity log can say who. */
@@ -59,7 +73,7 @@ interface StoredPause extends ActivePause {
 export function pauseStateDir(): string {
   const override = process.env.FAILPROOFAI_STATE_DIR;
   if (override) return resolve(override, "sessions");
-  return join(homedir(), ".failproofai", "state", "sessions");
+  return sessionPauseDir();
 }
 
 /**
@@ -119,11 +133,22 @@ function parseStored(raw: unknown): StoredPause | null {
   if (p.schemaVersion !== SCHEMA_VERSION) return null;
   if (typeof p.sessionId !== "string" || p.sessionId.length === 0) return null;
   if (!Number.isFinite(p.pausedAt) || !Number.isFinite(p.expiresAt)) return null;
+  const pausedAt = p.pausedAt as number;
+  // A file written before this field existed measures its ceiling from the
+  // only start it recorded. Same meaning for a pause that was never renewed.
+  const firstPausedAt = Number.isFinite(p.firstPausedAt) ? (p.firstPausedAt as number) : pausedAt;
   return {
     schemaVersion: SCHEMA_VERSION,
     sessionId: p.sessionId,
-    pausedAt: p.pausedAt as number,
-    expiresAt: p.expiresAt as number,
+    pausedAt,
+    firstPausedAt,
+    // Clamped at READ time, not only at write. The ceiling has to hold against
+    // a file this process did not write: `~/.failproofai/state/sessions/` is
+    // owner-writable by design, and an `expiresAt` a year out would otherwise
+    // be honoured on every subsequent tool call forever. Enforcing it here
+    // means the bound is a property of the pause, not of the path that created
+    // it.
+    expiresAt: Math.min(p.expiresAt as number, firstPausedAt + PAUSE_CEILING_MS),
     setBy: typeof p.setBy === "string" ? p.setBy : "unknown",
     ...(typeof p.cwd === "string" ? { cwd: p.cwd } : {}),
   };
@@ -159,10 +184,17 @@ export function writePause(opts: {
   now?: number;
 }): ActivePause {
   const now = opts.now ?? Date.now();
+  // Carry the run's original start forward while a pause is still live, so a
+  // renewal extends the same stretch rather than starting a fresh ceiling.
+  const existing = readActivePause(opts.sessionId, now);
+  const firstPausedAt = existing?.firstPausedAt ?? now;
   const pause: ActivePause = {
     sessionId: opts.sessionId,
     pausedAt: now,
-    expiresAt: now + opts.durationMs,
+    firstPausedAt,
+    // The requested duration, but never past the ceiling measured from the
+    // start of the run. A renewal can shorten a pause; it cannot outrun 8h.
+    expiresAt: Math.min(now + opts.durationMs, firstPausedAt + PAUSE_CEILING_MS),
     setBy: opts.setBy ?? "cli",
     ...(opts.cwd ? { cwd: opts.cwd } : {}),
   };

package/src/hooks/setup-state.ts

@@ -0,0 +1,256 @@
+/**
+ * What is already set up on this machine, and where.
+ *
+ * Two questions live here, both of which used to be answered ad hoc in two
+ * different places:
+ *
+ *   1. "Has this user ever completed setup?"  — drives first-run onboarding.
+ *   2. "Is this cwd a project, a home directory, or both?" — drives which
+ *      scope the wizard offers to configure.
+ *
+ * Both are pure functions over the filesystem so they can be unit-tested
+ * without a TTY, a wizard, or a real home directory. Every path is derived
+ * from an injectable `home`/`cwd` rather than read from the environment at
+ * call time, because the wizard, the CLI entry point and the tests each have
+ * a different idea of where "home" is.
+ */
+import { existsSync, realpathSync, statSync } from "node:fs";
+import { dirname, resolve } from "node:path";
+import { homedir } from "node:os";
+import { getIntegration } from "./integrations";
+import { INTEGRATION_TYPES } from "./types";
+import { globalPolicyConfigFile, launcherMarker as layoutLauncherMarker } from "./fp-home";
+
+/** Which config a wizard run is going to write. */
+export type SetupTarget = "user" | "project" | "both";
+
+export interface SetupState {
+  /** Absolute cwd this was resolved against. */
+  cwd: string;
+  /** Absolute home directory this was resolved against. */
+  home: string;
+  /**
+   * The directory a project-scope write would land in — the nearest ancestor
+   * holding a `.failproofai/`, else `cwd` itself. Never the home directory:
+   * `~/.failproofai` is the GLOBAL config, and treating it as a project root
+   * would make a wizard run from `~` offer to "configure this project" and
+   * then write the global file under a project label.
+   */
+  projectRoot: string;
+  /** `~/.failproofai/policies-config.json` exists. */
+  hasGlobalConfig: boolean;
+  /** `<projectRoot>/.failproofai/policies-config.json` exists. */
+  hasProjectConfig: boolean;
+  /** Any agent CLI has failproofai hooks installed at user scope. */
+  hasGlobalHooks: boolean;
+  /** The legacy first-run marker written by earlier versions. */
+  hasLegacyMarker: boolean;
+  /** cwd resolves to the home directory itself. */
+  inHomeDir: boolean;
+}
+
+export function globalConfigPath(home: string = homedir()): string {
+  return globalPolicyConfigFile(home);
+}
+
+export function projectConfigPath(projectRoot: string): string {
+  return resolve(projectRoot, ".failproofai", "policies-config.json");
+}
+
+function legacyMarkerPath(home: string): string {
+  return layoutLauncherMarker(home);
+}
+
+function isDir(path: string): boolean {
+  try {
+    return statSync(path).isDirectory();
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * The nearest ancestor of `start` holding a `.failproofai/` directory, or
+ * `start` itself when there is none.
+ *
+ * Mirrors `hooks-config.findProjectConfigDir`, but takes `home` as a
+ * parameter instead of calling `homedir()` — the wizard needs to resolve this
+ * against a caller-supplied home in tests, and the two must not disagree
+ * about where the walk stops or the wizard would offer to write a project
+ * config at a path the policy loader never reads.
+ */
+export function findProjectRoot(start: string, home: string = homedir()): string {
+  // Both sides real-resolved for the same reason `detectSetupState` does it:
+  // a symlinked home would never equal the walked path, so the walk would run
+  // straight past home and could claim `~` — whose `.failproofai/` is the
+  // global config — as a project root.
+  const resolvedHome = realResolve(home);
+  let dir = realResolve(start);
+  while (dir !== resolvedHome) {
+    if (isDir(resolve(dir, ".failproofai"))) return dir;
+    const parent = dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  return resolve(start);
+}
+
+/**
+ * Whether any agent CLI carries failproofai hooks at user scope.
+ *
+ * Deliberately ignores project scope: a checkout that happens to contain
+ * committed project hooks (this repo does) must not convince the wizard that
+ * the MACHINE has been set up.
+ */
+export function hasGlobalHooksInstalled(): boolean {
+  for (const id of INTEGRATION_TYPES) {
+    try {
+      if (getIntegration(id).hooksInstalledInSettings("user")) return true;
+    } catch {
+      // A malformed settings file is not evidence of an install.
+    }
+  }
+  return false;
+}
+
+/**
+ * `resolve()` plus symlink resolution, falling back to the lexical path.
+ *
+ * `$HOME` is very often a symlink (`/home/x` → `/mnt/data/x`, macOS
+ * `/tmp` → `/private/tmp`) while a shell's cwd reports the real path. Compared
+ * lexically, the two never match: `inHomeDir` reads false while standing in
+ * home, and the wizard offers to "configure this project" pointing at the home
+ * directory — whose `.failproofai/` is the GLOBAL config. Comparing real paths
+ * is what makes "am I in my home directory" answerable.
+ *
+ * Falls back to the lexical path when the target does not exist (a cwd that
+ * has been deleted, a home that has not been created yet), because a missing
+ * path is not a reason to fail detection.
+ */
+function realResolve(path: string): string {
+  const lexical = resolve(path);
+  try {
+    return realpathSync(lexical);
+  } catch {
+    return lexical;
+  }
+}
+
+export function detectSetupState(
+  cwd: string = process.cwd(),
+  home: string = homedir(),
+): SetupState {
+  const resolvedCwd = realResolve(cwd);
+  const resolvedHome = realResolve(home);
+  const projectRoot = findProjectRoot(resolvedCwd, resolvedHome);
+
+  return {
+    cwd: resolvedCwd,
+    home: resolvedHome,
+    projectRoot,
+    hasGlobalConfig: existsSync(globalConfigPath(resolvedHome)),
+    // When cwd IS home, `projectRoot` is home and its `.failproofai` is the
+    // global config — reporting that as a project config would double-count
+    // one file as two scopes and offer "Both" for a single target.
+    hasProjectConfig:
+      projectRoot !== resolvedHome && existsSync(projectConfigPath(projectRoot)),
+    hasGlobalHooks: hasGlobalHooksInstalled(),
+    hasLegacyMarker: existsSync(legacyMarkerPath(resolvedHome)),
+    inHomeDir: resolvedCwd === resolvedHome,
+  };
+}
+
+/**
+ * Whether this machine has ever completed setup.
+ *
+ * Deliberately NOT just the marker file. The marker is one of three
+ * independent signals, and any of them means "configured":
+ *
+ *   • a global policies-config.json  — the wizard, or `policies --install`,
+ *     has written real configuration
+ *   • user-scope hooks in any agent CLI — enforcement is live even if the
+ *     config file was hand-deleted
+ *   • the legacy marker — so users onboarded by an earlier version are never
+ *     shown the wizard a second time
+ *
+ * Relying on the marker alone made deleting one file re-run onboarding on a
+ * fully configured machine; relying on hooks alone re-ran it for anyone who
+ * had uninstalled hooks but kept their policy config. Requiring all three
+ * would never fire for a genuinely fresh install. The union is the only
+ * combination that is right in each case.
+ */
+export function isConfigured(state: SetupState = detectSetupState()): boolean {
+  return state.hasGlobalConfig || state.hasGlobalHooks || state.hasLegacyMarker;
+}
+
+export interface TargetChoice {
+  label: string;
+  value: SetupTarget;
+  hint: string;
+  /** True when this target would UPDATE existing config rather than create it. */
+  existing: boolean;
+}
+
+/**
+ * The scope choices to offer, ordered so the most likely intent is first
+ * (and therefore pre-selected).
+ *
+ * The ordering rule is "what did the user point us at": run from inside a
+ * project, the project comes first; run from home — where there is no project
+ * to configure — only the global row is offered, because a "Just this
+ * project" row pointing at `~` would write `~/.failproofai/` and call the
+ * machine-wide config a project.
+ */
+export function buildTargetChoices(state: SetupState): TargetChoice[] {
+  const globalRow: TargetChoice = {
+    label: state.hasGlobalConfig ? "Update my global policies" : "Set up global policies",
+    value: "user",
+    hint: "applies in every project on this machine",
+    existing: state.hasGlobalConfig,
+  };
+
+  // From home (or anywhere with no project marker above it) there is no
+  // second target to offer.
+  if (state.inHomeDir || state.projectRoot === state.home) {
+    return [globalRow];
+  }
+
+  const projectRow: TargetChoice = {
+    label: state.hasProjectConfig
+      ? "Update this project's policies"
+      : "Set up this project's policies",
+    value: "project",
+    hint: homeify(state.projectRoot, state.home),
+    existing: state.hasProjectConfig,
+  };
+
+  const bothRow: TargetChoice = {
+    label: "Both",
+    value: "both",
+    hint: "global defaults, plus overrides for this project",
+    existing: state.hasGlobalConfig && state.hasProjectConfig,
+  };
+
+  // Inside a project, the project is the likelier intent — unless nothing
+  // global exists yet, in which case the machine has never been set up and
+  // configuring only this one project would leave every other project
+  // unprotected without saying so.
+  return state.hasGlobalConfig
+    ? [projectRow, globalRow, bothRow]
+    : [globalRow, projectRow, bothRow];
+}
+
+/** `/home/x/y` → `~/y`, for display only. */
+export function homeify(path: string, home: string = homedir()): string {
+  const resolvedHome = resolve(home);
+  const resolvedPath = resolve(path);
+  if (resolvedPath === resolvedHome) return "~";
+  return resolvedPath.startsWith(resolvedHome + "/")
+    ? `~${resolvedPath.slice(resolvedHome.length)}`
+    : resolvedPath;
+}
+
+/** The scopes a `SetupTarget` expands to. */
+export function scopesFor(target: SetupTarget): Array<"user" | "project"> {
+  return target === "both" ? ["user", "project"] : [target];
+}

package/src/hooks/tui.ts

@@ -112,10 +112,10 @@ export function colorsEnabled(out: TTYOut): boolean {
 
 /**
  * The raw ANSI opening sequence for a brand role, for callers that assemble
- * their own strings instead of using `paint()`'s wrappers (`src/audit/cli.ts`,
- * `src/auth/cli.ts`). Those files previously hardcoded their own 256-colour
- * palette — a green and a blue that appear nowhere in the brand — so `audit`
- * and `auth` looked like different products from `config`. Routing them here
+ * their own strings instead of using `paint()`'s wrappers (`src/audit/cli.ts`).
+ * That file previously hardcoded its own 256-colour palette — a green and a
+ * blue that appear nowhere in the brand — so `audit` looked like a different
+ * product from `config`. Routing it here
  * keeps HUES the single source of truth: change a hue once and every surface
  * follows. Emits truecolor where the terminal advertises it, basic ANSI
  * otherwise; the caller still decides *whether* to colour at all.

package/src/hooks/worker-server.ts

@@ -54,15 +54,67 @@ function encodeFrame(value: unknown): Buffer {
   return Buffer.concat([header, body]);
 }
 
+/**
+ * Last-resort deadline on a single queued task.
+ *
+ * Deliberately far above `daemon-client.ts`'s 30s `DAEMON_RESPONSE_TIMEOUT_MS`:
+ * by the time this fires the client has long since given up and fail-closed, so
+ * nothing legitimate is waiting. It exists only to detect a task that will never
+ * settle at all.
+ */
+const TASK_DEADLINE_MS = 60_000;
+
 /**
  * Serializes every request across every connection through one chain, so
  * `evaluateHookEvent` calls never overlap. `.catch()` on each link keeps the
  * chain alive even if a handler throws unexpectedly — one bad request must
  * never wedge every request queued behind it.
+ *
+ * `.catch()` covers a task that REJECTS. It does nothing for one that never
+ * SETTLES, and that state is reachable: a policy file with a top-level `await`
+ * that never resolves hangs its `import()`, so the task neither resolves nor
+ * rejects and every hook queued behind it waits forever. Each client then burns
+ * its own 30s budget and fail-closed denies — every tool call, every CLI on the
+ * machine, until someone restarts the daemon. This is a class the warm worker
+ * creates: in the one-shot path the identical file hangs one hook process and
+ * the agent CLI's own timeout reaps it.
+ *
+ * `custom-hooks-loader.ts` bounds that import directly, which is the graceful
+ * fix and covers the known cause. This is the backstop for the ones nobody
+ * thought of, and it EXITS rather than continuing: the orphaned task is still
+ * running and still holds the `globalThis` policy registry this chain exists to
+ * serialize access to, so letting the next request proceed would trade a wedge
+ * for silent cross-request registry corruption. Exiting hands the supervisor a
+ * process it will respawn clean (`worker.rs`'s `ensure_started` respawns a
+ * worker whose `try_wait()` reports it gone), which costs one cold start and
+ * denies the in-flight requests — the same fail-closed outcome they were headed
+ * for anyway, but recovered on the next call instead of never.
  */
+const WEDGED_EXIT_CODE = 75;
+
 let processingChain: Promise<void> = Promise.resolve();
 function enqueue(task: () => Promise<void>): void {
-  processingChain = processingChain.then(task).catch(() => {});
+  processingChain = processingChain
+    .then(
+      () =>
+        new Promise<void>((settle) => {
+          const timer = setTimeout(() => {
+            hookLogWarn(
+              `worker: a request did not settle within ${TASK_DEADLINE_MS}ms; ` +
+                `exiting so the supervisor can respawn a clean worker`,
+            );
+            process.exit(WEDGED_EXIT_CODE);
+          }, TASK_DEADLINE_MS);
+          // Never let the deadline itself hold the event loop open.
+          timer.unref?.();
+          const done = () => {
+            clearTimeout(timer);
+            settle();
+          };
+          void task().then(done, done);
+        }),
+    )
+    .catch(() => {});
 }
 
 function handleConnection(socket: Socket): void {