failproofai 1.0.0-beta.6 → 1.0.0-beta.7

package/dist/cli.mjs

@@ -19,7 +19,7 @@ var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
 var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
 // package.json
-var version2 = "1.0.0-beta.6";
+var version2 = "1.0.0-beta.7";
 var init_package = () => {};
 
 // src/posthog-key.ts
@@ -1025,7 +1025,7 @@ function resettablePaths() {
     logsDir()
   ];
 }
-var LAYOUT_VERSION = 2, at = (...parts) => resolve(failproofaiHome(), ...parts), atHome = (home, ...parts) => home ? resolve(failproofaiHome(home), ...parts) : at(...parts), versionFile = (home) => atHome(home, "VERSION"), configFile = (home) => atHome(home, "config.toml"), credentialsFile = (home) => atHome(home, "credentials.toml"), binDir = (home) => atHome(home, "bin"), policiesDir = (home) => atHome(home, "policies"), localPoliciesDir = (home) => atHome(home, "policies", "local-policies"), globalPolicyConfigFile = (home) => resolve(localPoliciesDir(home), "policies-config.json"), cloudPoliciesDir = (home) => resolve(policiesDir(home), "cloud-policies"), customPoliciesDir = (home) => resolve(policiesDir(home), "custom-policies"), customAgentsDir = (home) => atHome(home, "custom-agents"), auditDir = (home) => atHome(home, "audit"), auditDashboardFile = (home) => resolve(auditDir(home), "dashboard.json"), auditCacheDir = (home) => resolve(auditDir(home), "cache"), hookActivityDir = (home) => atHome(home, "hook-activity"), runDir = (home) => atHome(home, "run"), daemonSocket = () => process.env.FAILPROOFAI_DAEMON_SOCKET || resolve(runDir(), "failproofaid.sock"), auditLockFile = (home) => resolve(runDir(home), "audit.lock"), stateDir = (home) => atHome(home, "state"), shimsDir = (home) => resolve(stateDir(home), "shims"), sessionPauseDir = () => resolve(stateDir(), "sessions"), telemetryIdFile = (home) => resolve(stateDir(home), "telemetry-id"), launcherMarker = (home) => resolve(stateDir(home), "launcher-configured"), lastVersionFile = (home) => resolve(stateDir(home), "last-version"), onboardingLockFile = (home) => resolve(stateDir(home), "onboarding.lock"), codexSessionPathsFile = (home) => resolve(stateDir(home), "codex-session-paths.json"), logsDir = (home) => atHome(home, "logs"), legacy;
+var LAYOUT_VERSION = 2, at = (...parts) => resolve(failproofaiHome(), ...parts), atHome = (home, ...parts) => home ? resolve(failproofaiHome(home), ...parts) : at(...parts), versionFile = (home) => atHome(home, "VERSION"), configFile = (home) => atHome(home, "config.toml"), credentialsFile = (home) => atHome(home, "credentials.toml"), binDir = (home) => atHome(home, "bin"), policiesDir = (home) => atHome(home, "policies"), localPoliciesDir = (home) => atHome(home, "policies", "local-policies"), globalPolicyConfigFile = (home) => resolve(localPoliciesDir(home), "policies-config.json"), cloudPoliciesDir = (home) => resolve(policiesDir(home), "cloud-policies"), customPoliciesDir = (home) => resolve(policiesDir(home), "custom-policies"), customAgentsDir = (home) => atHome(home, "custom-agents"), auditDir = (home) => atHome(home, "audit"), auditDashboardFile = (home) => resolve(auditDir(home), "dashboard.json"), auditCacheDir = (home) => resolve(auditDir(home), "cache"), hookActivityDir = (home) => atHome(home, "hook-activity"), runDir = (home) => atHome(home, "run"), daemonSocket = () => process.env.FAILPROOFAI_DAEMON_SOCKET || resolve(runDir(), "failproofaid.sock"), auditLockFile = (home) => resolve(runDir(home), "audit.lock"), stateDir = (home) => atHome(home, "state"), shimsDir = (home) => resolve(stateDir(home), "shims"), sessionPauseDir = () => resolve(stateDir(), "sessions"), telemetryIdFile = (home) => resolve(stateDir(home), "telemetry-id"), launcherMarker = (home) => resolve(stateDir(home), "launcher-configured"), onboardingAttemptFile = (home) => resolve(stateDir(home), "onboarding-attempt.json"), lastVersionFile = (home) => resolve(stateDir(home), "last-version"), onboardingLockFile = (home) => resolve(stateDir(home), "onboarding.lock"), codexSessionPathsFile = (home) => resolve(stateDir(home), "codex-session-paths.json"), logsDir = (home) => atHome(home, "logs"), legacy;
 var init_fp_home = __esm(() => {
   legacy = {
     policyConfig: () => at("policies-config.json"),
@@ -22438,8 +22438,87 @@ var init_setup_state = __esm(() => {
   init_fp_home();
 });
 
+// src/hooks/onboarding-attempt.ts
+import { existsSync as existsSync24, mkdirSync as mkdirSync14, readFileSync as readFileSync19, rmSync as rmSync8, writeFileSync as writeFileSync11 } from "node:fs";
+import { dirname as dirname12 } from "node:path";
+function readOnboardingAttempt() {
+  const path3 = onboardingAttemptFile();
+  if (!existsSync24(path3))
+    return null;
+  try {
+    const raw = JSON.parse(readFileSync19(path3, "utf8"));
+    if (raw.schemaVersion !== SCHEMA_VERSION3)
+      return null;
+    if (typeof raw.reason !== "string" || typeof raw.cliVersion !== "string")
+      return null;
+    return {
+      schemaVersion: SCHEMA_VERSION3,
+      reason: raw.reason,
+      cliVersion: raw.cliVersion,
+      daemonStatus: typeof raw.daemonStatus === "string" ? raw.daemonStatus : "",
+      at: typeof raw.at === "number" ? raw.at : 0
+    };
+  } catch {
+    return null;
+  }
+}
+function recordOnboardingAttempt(reason, cliVersion, daemonStatus, now = Date.now()) {
+  try {
+    const path3 = onboardingAttemptFile();
+    mkdirSync14(dirname12(path3), { recursive: true });
+    const record = {
+      schemaVersion: SCHEMA_VERSION3,
+      reason,
+      cliVersion,
+      daemonStatus,
+      at: now
+    };
+    writeFileSync11(path3, JSON.stringify(record, null, 2), "utf8");
+  } catch {}
+}
+function clearOnboardingAttempt() {
+  try {
+    rmSync8(onboardingAttemptFile(), { force: true });
+  } catch {}
+}
+function blockerCleared(attempt, probe) {
+  switch (attempt.reason) {
+    case "needs_root":
+      return probe.canElevate();
+    case "daemon_failed":
+      return probe.daemonStatus() !== attempt.daemonStatus || probe.canElevate();
+    case "cancelled":
+      return probe.cliVersion !== attempt.cliVersion;
+    case "not_a_tty":
+    case "running_as_sudo":
+      return true;
+    default:
+      return true;
+  }
+}
+function attemptHintLines(attempt) {
+  const why = {
+    needs_root: "it needs root to install the failproofaid service",
+    daemon_failed: "the failproofaid service could not be started",
+    cancelled: "it was cancelled",
+    not_a_tty: "there was no terminal to ask in",
+    running_as_sudo: "it was run under sudo"
+  };
+  const detail = why[attempt.reason] ?? "it did not finish";
+  return [
+    ``,
+    `[failproofai] Setup is not finished — ${detail}.`,
+    `              Run \`failproofai config\` when you are ready.`,
+    ``
+  ];
+}
+var SCHEMA_VERSION3 = 1;
+var init_onboarding_attempt = __esm(() => {
+  init_fp_home();
+});
+
 // src/hooks/onboarding-lock.ts
-import { mkdirSync as mkdirSync14, readFileSync as readFileSync19, rmSync as rmSync8, writeFileSync as writeFileSync11 } from "node:fs";
+import { mkdirSync as mkdirSync15, readFileSync as readFileSync20, rmSync as rmSync9, writeFileSync as writeFileSync12 } from "node:fs";
 import { homedir as homedir26 } from "node:os";
 function onboardingLockPath(home = homedir26()) {
   return onboardingLockFile(home);
@@ -22456,7 +22535,7 @@ function processAlive(pid) {
 }
 function readLock(path3) {
   try {
-    const parsed = JSON.parse(readFileSync19(path3, "utf8"));
+    const parsed = JSON.parse(readFileSync20(path3, "utf8"));
     if (typeof parsed.pid !== "number")
       return null;
     return { pid: parsed.pid, startedAt: Number(parsed.startedAt) || 0 };
@@ -22470,9 +22549,9 @@ function acquireOnboardingLock(home = homedir26()) {
     const held = readLock(path3);
     if (held && held.pid !== process.pid && processAlive(held.pid))
       return null;
-    mkdirSync14(stateDir(home), { recursive: true });
+    mkdirSync15(stateDir(home), { recursive: true });
     const body = { pid: process.pid, startedAt: Date.now() };
-    writeFileSync11(path3, JSON.stringify(body), "utf8");
+    writeFileSync12(path3, JSON.stringify(body), "utf8");
     let released = false;
     return {
       release() {
@@ -22482,7 +22561,7 @@ function acquireOnboardingLock(home = homedir26()) {
         try {
           const current = readLock(path3);
           if (!current || current.pid === process.pid)
-            rmSync8(path3, { force: true });
+            rmSync9(path3, { force: true });
         } catch {}
       }
     };
@@ -22495,7 +22574,7 @@ var init_onboarding_lock = __esm(() => {
 });
 
 // lib/claude-sessions.ts
-import { readdirSync as readdirSync14, statSync as statSync16, existsSync as existsSync25 } from "node:fs";
+import { readdirSync as readdirSync14, statSync as statSync16, existsSync as existsSync26 } from "node:fs";
 import { join as join28, basename as basename5 } from "node:path";
 function getClaudeProjectsRoot() {
   return getClaudeProjectsPath();
@@ -22542,7 +22621,7 @@ function listClaudeTranscripts(project) {
       } catch {}
     } else if (entry.isDirectory() && UUID_RE2.test(entry.name)) {
       const subDir = join28(project.path, entry.name, "subagents");
-      if (!existsSync25(subDir))
+      if (!existsSync26(subDir))
         continue;
       let subEntries;
       try {
@@ -23817,7 +23896,7 @@ var init_features = __esm(() => {
 
 // src/audit/cache.ts
 import { createHash as createHash6 } from "node:crypto";
-import { existsSync as existsSync26, mkdirSync as mkdirSync15, readFileSync as readFileSync20, writeFileSync as writeFileSync12, chmodSync as chmodSync4 } from "node:fs";
+import { existsSync as existsSync27, mkdirSync as mkdirSync16, readFileSync as readFileSync21, writeFileSync as writeFileSync13, chmodSync as chmodSync4 } from "node:fs";
 import { join as join29 } from "node:path";
 function getEngineVersion() {
   if (cachedEngineVersion)
@@ -23844,10 +23923,10 @@ function readCachedTranscriptResult(transcriptPath, mtimeMs, sizeBytes) {
   if (sizeBytes === 0)
     return null;
   const cachePath = getCachePathFor(transcriptPath);
-  if (!existsSync26(cachePath))
+  if (!existsSync27(cachePath))
     return null;
   try {
-    const raw = readFileSync20(cachePath, "utf-8");
+    const raw = readFileSync21(cachePath, "utf-8");
     const entry = JSON.parse(raw);
     if (entry.schemaVersion !== CACHE_SCHEMA_VERSION)
       return null;
@@ -23871,7 +23950,7 @@ function writeCachedTranscriptResult(transcriptPath, mtimeMs, sizeBytes, result)
     return;
   const cachePath = getCachePathFor(transcriptPath);
   try {
-    mkdirSync15(auditCacheDir(), { recursive: true });
+    mkdirSync16(auditCacheDir(), { recursive: true });
     const entry = {
       schemaVersion: CACHE_SCHEMA_VERSION,
       cachedAt: Date.now(),
@@ -23881,7 +23960,7 @@ function writeCachedTranscriptResult(transcriptPath, mtimeMs, sizeBytes, result)
       detectorVersion: getDetectorVersion(),
       result
     };
-    writeFileSync12(cachePath, JSON.stringify(entry), { encoding: "utf-8", mode: 384 });
+    writeFileSync13(cachePath, JSON.stringify(entry), { encoding: "utf-8", mode: 384 });
     try {
       chmodSync4(cachePath, 384);
     } catch {}
@@ -24247,11 +24326,11 @@ var init_audit = __esm(() => {
 import {
   closeSync,
   linkSync,
-  mkdirSync as mkdirSync16,
+  mkdirSync as mkdirSync17,
   openSync,
-  readFileSync as readFileSync21,
+  readFileSync as readFileSync22,
   unlinkSync as unlinkSync4,
-  writeFileSync as writeFileSync13,
+  writeFileSync as writeFileSync14,
   writeSync
 } from "node:fs";
 function acquireAuditLock(source, now = Date.now()) {
@@ -24310,7 +24389,7 @@ function handleFor(path3, info) {
 }
 function readLock2(path3) {
   try {
-    const parsed = JSON.parse(readFileSync21(path3, "utf8"));
+    const parsed = JSON.parse(readFileSync22(path3, "utf8"));
     if (typeof parsed?.pid !== "number" || typeof parsed?.startedAt !== "number")
       return null;
     return {
@@ -24326,7 +24405,7 @@ function writeLockExclusive(path3, info) {
   const body = JSON.stringify(info);
   const staging = `${path3}.${process.pid}.tmp`;
   try {
-    writeFileSync13(staging, body, { mode: 384 });
+    writeFileSync14(staging, body, { mode: 384 });
   } catch {
     return false;
   }
@@ -24360,8 +24439,8 @@ function createThenWrite(path3, body) {
   }
 }
 function ensureRunDir() {
-  mkdirSync16(failproofaiHome(), { recursive: true });
-  mkdirSync16(runDir(), { recursive: true, mode: 448 });
+  mkdirSync17(failproofaiHome(), { recursive: true });
+  mkdirSync17(runDir(), { recursive: true, mode: 448 });
 }
 var AUDIT_LOCK_MAX_AGE_MS;
 var init_audit_lock = __esm(() => {
@@ -24525,26 +24604,26 @@ function parseScriptArgs(argv) {
 var init_parse_script_args = () => {};
 
 // scripts/install-diagnosis.mjs
-import { existsSync as existsSync27, readFileSync as readFileSync22, realpathSync as realpathSync3 } from "node:fs";
-import { dirname as dirname12, resolve as resolve21 } from "node:path";
+import { existsSync as existsSync28, readFileSync as readFileSync23, realpathSync as realpathSync3 } from "node:fs";
+import { dirname as dirname13, resolve as resolve21 } from "node:path";
 import { homedir as homedir27, platform as platform4 } from "node:os";
 import { spawnSync } from "node:child_process";
 function findPackageRoot(start) {
   try {
     let dir = realpathSync3(start);
-    if (existsSync27(dir) && !existsSync27(resolve21(dir, "package.json"))) {
-      dir = dirname12(dir);
+    if (existsSync28(dir) && !existsSync28(resolve21(dir, "package.json"))) {
+      dir = dirname13(dir);
     }
     while (true) {
       const pkgPath = resolve21(dir, "package.json");
-      if (existsSync27(pkgPath)) {
+      if (existsSync28(pkgPath)) {
         try {
-          const pkg = JSON.parse(readFileSync22(pkgPath, "utf8"));
+          const pkg = JSON.parse(readFileSync23(pkgPath, "utf8"));
           if (pkg.name === PKG_NAME)
             return dir;
         } catch {}
       }
-      const parent = dirname12(dir);
+      const parent = dirname13(dir);
       if (parent === dir)
         return null;
       dir = parent;
@@ -24557,7 +24636,7 @@ function readPackageVersion(packageRoot) {
   if (!packageRoot)
     return null;
   try {
-    const pkg = JSON.parse(readFileSync22(resolve21(packageRoot, "package.json"), "utf8"));
+    const pkg = JSON.parse(readFileSync23(resolve21(packageRoot, "package.json"), "utf8"));
     return typeof pkg.version === "string" ? pkg.version : null;
   } catch {
     return null;
@@ -24584,7 +24663,7 @@ function locateNpmGlobal() {
     if (!root)
       return null;
     const candidate = resolve21(root, PKG_NAME);
-    return existsSync27(resolve21(candidate, "package.json")) ? candidate : null;
+    return existsSync28(resolve21(candidate, "package.json")) ? candidate : null;
   } catch {
     return null;
   }
@@ -24592,7 +24671,7 @@ function locateNpmGlobal() {
 function locateBunGlobal() {
   try {
     const candidate = resolve21(homedir27(), ".bun", "install", "global", "node_modules", PKG_NAME);
-    return existsSync27(resolve21(candidate, "package.json")) ? candidate : null;
+    return existsSync28(resolve21(candidate, "package.json")) ? candidate : null;
   } catch {
     return null;
   }
@@ -24699,8 +24778,8 @@ __export(exports_launch, {
   launch: () => launch
 });
 import { spawn as spawn2 } from "child_process";
-import { realpathSync as realpathSync4, existsSync as existsSync28 } from "node:fs";
-import { resolve as resolve22, dirname as dirname13 } from "node:path";
+import { realpathSync as realpathSync4, existsSync as existsSync29 } from "node:fs";
+import { resolve as resolve22, dirname as dirname14 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 import { createInterface } from "node:readline";
 function launch(mode) {
@@ -24724,9 +24803,9 @@ function launch(mode) {
     process.env.PORT = port;
     process.env.HOSTNAME = bindHost;
     cmd = "node";
-    const packageRoot = process.env.FAILPROOFAI_PACKAGE_ROOT ?? resolve22(dirname13(realpathSync4(fileURLToPath2(import.meta.url))), "..");
+    const packageRoot = process.env.FAILPROOFAI_PACKAGE_ROOT ?? resolve22(dirname14(realpathSync4(fileURLToPath2(import.meta.url))), "..");
     const serverJsPath = resolve22(packageRoot, ".next/standalone/server.js");
-    if (!existsSync28(serverJsPath)) {
+    if (!existsSync29(serverJsPath)) {
       let shadowMessage = null;
       try {
         const diag = diagnoseShadow({ selfPackageRoot: packageRoot, selfVersion: version2 });
@@ -25171,9 +25250,9 @@ __export(exports_configure_wizard, {
   buildPresetChoices: () => buildPresetChoices,
   buildAgentChoices: () => buildAgentChoices
 });
-import { existsSync as existsSync29, mkdirSync as mkdirSync17, writeFileSync as writeFileSync14, readFileSync as readFileSync23 } from "node:fs";
+import { existsSync as existsSync30, mkdirSync as mkdirSync18, writeFileSync as writeFileSync15, readFileSync as readFileSync24 } from "node:fs";
 import { homedir as homedir28 } from "node:os";
-import { dirname as dirname14, resolve as resolve23, sep as sep5 } from "node:path";
+import { dirname as dirname15, resolve as resolve23, sep as sep5 } from "node:path";
 async function emit(event, props) {
   try {
     await trackHookEvent2(getInstanceId2(), event, props);
@@ -25280,8 +25359,8 @@ function setCustomPoliciesEnabled(scope, cwd, enabled) {
   const path3 = getConfigPathForScope(scope, cwd);
   let config = {};
   try {
-    if (existsSync29(path3))
-      config = JSON.parse(readFileSync23(path3, "utf8"));
+    if (existsSync30(path3))
+      config = JSON.parse(readFileSync24(path3, "utf8"));
   } catch {
     return;
   }
@@ -25290,7 +25369,7 @@ function setCustomPoliciesEnabled(scope, cwd, enabled) {
   else
     config.customPoliciesEnabled = false;
   try {
-    writeFileSync14(path3, JSON.stringify(config, null, 2) + `
+    writeFileSync15(path3, JSON.stringify(config, null, 2) + `
 `, "utf8");
   } catch {}
 }
@@ -25390,14 +25469,33 @@ function firstRunMarkerPath() {
   return launcherMarker();
 }
 function hasSeenLauncher() {
-  return existsSync29(firstRunMarkerPath());
+  return existsSync30(firstRunMarkerPath());
 }
 function markLauncherSeen() {
   try {
-    mkdirSync17(dirname14(firstRunMarkerPath()), { recursive: true });
-    writeFileSync14(firstRunMarkerPath(), "1", "utf8");
+    mkdirSync18(dirname15(firstRunMarkerPath()), { recursive: true });
+    writeFileSync15(firstRunMarkerPath(), "1", "utf8");
   } catch {}
 }
+function retryProbe() {
+  return {
+    canElevate: () => {
+      try {
+        return canElevate();
+      } catch {
+        return false;
+      }
+    },
+    daemonStatus: () => {
+      try {
+        return daemonServiceStatus();
+      } catch {
+        return "";
+      }
+    },
+    cliVersion: version2
+  };
+}
 async function maybeFirstRunConfigure(io = {}, opts = {}) {
   if (process.env.FAILPROOFAI_NO_FIRST_RUN === "1")
     return false;
@@ -25409,6 +25507,13 @@ async function maybeFirstRunConfigure(io = {}, opts = {}) {
       markLauncherSeen();
     return false;
   }
+  const attempt = opts.force ? null : readOnboardingAttempt();
+  if (attempt && !blockerCleared(attempt, retryProbe())) {
+    for (const line of attemptHintLines(attempt))
+      stdout.write(`${line}
+`);
+    return false;
+  }
   if (!stdin.isTTY || !stdout.isTTY) {
     stdout.write(`
 [failproofai] Not set up yet — run \`failproofai config\` to get started.
@@ -25427,6 +25532,9 @@ async function maybeFirstRunConfigure(io = {}, opts = {}) {
   try {
     emit("first_run_configure_shown", {});
     const result = await runConfigureWizard(io);
+    if (!result.applied && result.abort) {
+      recordOnboardingAttempt(result.abort, version2, daemonServiceStatus());
+    }
     if (result.applied && opts.postSetupAudit !== false) {
       try {
         const { runPostSetupAudit: runPostSetupAudit2 } = await Promise.resolve().then(() => (init_cli(), exports_cli));
@@ -25850,6 +25958,7 @@ Hooks keep enforcing; scheduled audits stay off until it is.
   }
   await applied;
   markLauncherSeen();
+  clearOnboardingAttempt();
   const customNote = customEnabled === true ? " + your custom policies" : customEnabled === false ? " · custom policies DISABLED" : "";
   const daemonNote = daemonInstalled ? " · daemon on" : "";
   const cloudNote = connected ? " · reporting on" : "";
@@ -25885,6 +25994,7 @@ var init_configure_wizard = __esm(() => {
   init_fp_home();
   init_daemon_download();
   init_package();
+  init_onboarding_attempt();
   init_onboarding_lock();
 });
 
@@ -25898,7 +26008,7 @@ __export(exports_manager, {
   getSettingsPath: () => getSettingsPath2
 });
 import { execSync as execSync7 } from "node:child_process";
-import { existsSync as existsSync30 } from "node:fs";
+import { existsSync as existsSync31 } from "node:fs";
 import { resolve as resolve24, basename as basename6 } from "node:path";
 import { platform as platform5, arch as arch4, release as release3, hostname as hostname5 } from "node:os";
 function getSettingsPath2(scope, cwd) {
@@ -26009,7 +26119,7 @@ async function installHooksImpl2(policyNames, scope = "user", cwd, includeBeta =
   } else if (customPoliciesPath && (typeof customPoliciesPath === "string" || customPoliciesPath.length > 0)) {
     const incoming = (typeof customPoliciesPath === "string" ? [customPoliciesPath] : customPoliciesPath).map((path3) => resolve24(path3));
     const carried = (previousConfig.customPoliciesPaths ?? (previousConfig.customPoliciesPath ? [previousConfig.customPoliciesPath] : [])).map((path3) => resolve24(path3)).filter((path3) => {
-      if (existsSync30(path3))
+      if (existsSync31(path3))
         return true;
       console.log(`Dropping custom policies path (file no longer exists): ${path3}`);
       return false;
@@ -26201,7 +26311,7 @@ async function removeHooks(policyNames, scope = "user", cwd, opts) {
     const scopesToRemove = scope === "all" ? [...integration.scopes] : integration.scopes.includes(scope) ? [scope] : [];
     for (const s of scopesToRemove) {
       const settingsPaths = settingsPathsFor(integration, s, cwd);
-      const existing = settingsPaths.filter((p) => existsSync30(p));
+      const existing = settingsPaths.filter((p) => existsSync31(p));
       if (existing.length === 0) {
         if (scope !== "all" && selectedClis.length === 1) {
           console.log("No settings file found. Nothing to remove.");
@@ -26402,7 +26512,7 @@ Failproof AI Hook Policies
     for (const path3 of explicitPaths) {
       const absPath = resolve24(findProjectConfigDir(cwd ?? process.cwd()), path3);
       console.log(`  ${absPath}`);
-      if (!existsSync30(absPath)) {
+      if (!existsSync31(absPath)) {
         console.log(`  \x1B[31m✗ File not found: ${absPath}\x1B[0m`);
         continue;
       }
@@ -27537,8 +27647,8 @@ __export(exports_launch2, {
   launch: () => launch2
 });
 import { spawn as spawn3 } from "child_process";
-import { realpathSync as realpathSync5, existsSync as existsSync31 } from "node:fs";
-import { resolve as resolve25, dirname as dirname15 } from "node:path";
+import { realpathSync as realpathSync5, existsSync as existsSync32 } from "node:fs";
+import { resolve as resolve25, dirname as dirname16 } from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 import { createInterface as createInterface2 } from "node:readline";
 function launch2(mode) {
@@ -27562,9 +27672,9 @@ function launch2(mode) {
     process.env.PORT = port;
     process.env.HOSTNAME = bindHost;
     cmd = "node";
-    const packageRoot = process.env.FAILPROOFAI_PACKAGE_ROOT ?? resolve25(dirname15(realpathSync5(fileURLToPath3(import.meta.url))), "..");
+    const packageRoot = process.env.FAILPROOFAI_PACKAGE_ROOT ?? resolve25(dirname16(realpathSync5(fileURLToPath3(import.meta.url))), "..");
     const serverJsPath = resolve25(packageRoot, ".next/standalone/server.js");
-    if (!existsSync31(serverJsPath)) {
+    if (!existsSync32(serverJsPath)) {
       let shadowMessage = null;
       try {
         const diag = diagnoseShadow({ selfPackageRoot: packageRoot, selfVersion: version2 });
@@ -27661,17 +27771,17 @@ var init_cli_error2 = __esm(() => {
 
 // bin/failproofai.mjs
 import { realpathSync as realpathSync6 } from "fs";
-import { dirname as dirname16, resolve as resolve26 } from "path";
+import { dirname as dirname17, resolve as resolve26 } from "path";
 import { fileURLToPath as fileURLToPath4 } from "url";
 // package.json
-var version = "1.0.0-beta.6";
+var version = "1.0.0-beta.7";
 
 // bin/failproofai.mjs
 if (!process.env.FAILPROOFAI_PACKAGE_ROOT) {
-  process.env.FAILPROOFAI_PACKAGE_ROOT = resolve26(dirname16(realpathSync6(fileURLToPath4(import.meta.url))), "..");
+  process.env.FAILPROOFAI_PACKAGE_ROOT = resolve26(dirname17(realpathSync6(fileURLToPath4(import.meta.url))), "..");
 }
 if (!process.env.FAILPROOFAI_DIST_PATH) {
-  process.env.FAILPROOFAI_DIST_PATH = resolve26(dirname16(realpathSync6(fileURLToPath4(import.meta.url))), "..", "dist");
+  process.env.FAILPROOFAI_DIST_PATH = resolve26(dirname17(realpathSync6(fileURLToPath4(import.meta.url))), "..", "dist");
 }
 var args = process.argv.slice(2);
 if (args[0] === "p")
@@ -27731,15 +27841,10 @@ if (hookIdx >= 0) {
       let result;
       if (attempt.ok) {
         result = attempt.response;
-      } else if (attempt.failure === "protocol-mismatch") {
-        console.error("[failproofai] failproofaid speaks a different protocol version than this CLI \u2014 " + "evaluating in-process instead (slower, identical policies). Run `failproofai config` to update the daemon.");
-        result = await evaluateHookEvent2(eventType, cli, stdinRead.payload);
       } else {
+        const reason = attempt.failure === "protocol-mismatch" ? "failproofaid is running a different protocol version than this CLI, so it cannot evaluate this call. Run `failproofai config` to update the daemon." : "failproofaid could not be reached. This machine is configured to run hooks through it " + "\u2014 check the daemon (see `failproofai config`) rather than retrying blindly.";
         result = await evaluateHookEvent2(eventType, cli, stdinRead.payload, {
-          forceDecision: {
-            decision: "deny",
-            reason: "failproofaid could not be reached. This machine is configured to run hooks through it " + "\u2014 check the daemon (see `failproofai config`) rather than retrying blindly."
-          }
+          forceDecision: { decision: "deny", reason }
         });
       }
       if (result.stdout)

package/dist/worker.mjs

@@ -2434,7 +2434,7 @@ var init_builtin_policies = __esm(() => {
 });
 
 // package.json
-var version = "1.0.0-beta.6";
+var version = "1.0.0-beta.7";
 var init_package = () => {};
 
 // src/posthog-key.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "failproofai",
-  "version": "1.0.0-beta.6",
+  "version": "1.0.0-beta.7",
   "description": "The easiest way to manage policies that keep your AI agents reliable, on-task, and running autonomously — for Claude Code & the Agents SDK",
   "bin": {
     "failproofai": "./dist/cli.mjs",
@@ -114,9 +114,9 @@
     "sharp": "0.35.0"
   },
   "optionalDependencies": {
-    "@failproofai/failproofaid-linux-x64": "1.0.0-beta.6",
-    "@failproofai/failproofaid-linux-arm64": "1.0.0-beta.6",
-    "@failproofai/failproofaid-darwin-x64": "1.0.0-beta.6",
-    "@failproofai/failproofaid-darwin-arm64": "1.0.0-beta.6"
+    "@failproofai/failproofaid-linux-x64": "1.0.0-beta.7",
+    "@failproofai/failproofaid-linux-arm64": "1.0.0-beta.7",
+    "@failproofai/failproofaid-darwin-x64": "1.0.0-beta.7",
+    "@failproofai/failproofaid-darwin-arm64": "1.0.0-beta.7"
   }
 }

package/src/hooks/configure-wizard.ts

@@ -61,6 +61,7 @@ import { discoverPolicyFiles, findSkippedPolicyFiles } from "./custom-hooks-load
 import { trackHookEvent } from "./hook-telemetry";
 import { getInstanceId } from "../../lib/telemetry-id";
 import {
+  canElevate,
   isDaemonSupportedPlatform,
   installDaemonService,
   daemonServiceFilePath,
@@ -99,6 +100,14 @@ import {
 import { customPoliciesDir, launcherMarker } from "./fp-home";
 import { pruneOldDaemonBinaries } from "./daemon-download";
 import { version as cliVersion } from "../../package.json";
+import {
+  attemptHintLines,
+  blockerCleared,
+  clearOnboardingAttempt,
+  readOnboardingAttempt,
+  recordOnboardingAttempt,
+  type RetryProbe,
+} from "./onboarding-attempt";
 import { acquireOnboardingLock } from "./onboarding-lock";
 
 export interface WizardIO {
@@ -552,6 +561,33 @@ export interface FirstRunOptions {
   force?: boolean;
 }
 
+/**
+ * The live values `blockerCleared` compares an earlier attempt against.
+ *
+ * Built here rather than imported into `onboarding-attempt.ts` so that module
+ * stays pure and unit-testable without a service manager or a sudo binary.
+ */
+function retryProbe(): RetryProbe {
+  return {
+    canElevate: () => {
+      try {
+        return canElevate();
+      } catch {
+        // No sudo binary at all is a blocker that has not cleared.
+        return false;
+      }
+    },
+    daemonStatus: () => {
+      try {
+        return daemonServiceStatus();
+      } catch {
+        return "";
+      }
+    },
+    cliVersion,
+  };
+}
+
 export async function maybeFirstRunConfigure(
   io: WizardIO = {},
   opts: FirstRunOptions = {},
@@ -572,6 +608,17 @@ export async function maybeFirstRunConfigure(
     return false;
   }
 
+  // A previous attempt that ABORTED. Setup writes nothing on those paths, by
+  // design, so without this record the machine is indistinguishable from one
+  // that has never been offered setup — and the wizard relaunches on every
+  // command forever. `--force` (an explicit `failproofai config`) never reaches
+  // here, so asking for setup by name always gets it.
+  const attempt = opts.force ? null : readOnboardingAttempt();
+  if (attempt && !blockerCleared(attempt, retryProbe())) {
+    for (const line of attemptHintLines(attempt)) stdout.write(`${line}\n`);
+    return false;
+  }
+
   if (!stdin.isTTY || !stdout.isTTY) {
     // Never launch a wizard nobody can answer. This is the CI / piped path,
     // and it must stay a hint rather than a failure: the command the user
@@ -600,6 +647,11 @@ export async function maybeFirstRunConfigure(
     // an apply — so cancelling keeps offering setup on the next run rather
     // than silently never mentioning it again.
     const result = await runConfigureWizard(io);
+    // Remember WHY, so the next command can hint instead of relaunching. Only
+    // on an abort: a completed apply clears the record below.
+    if (!result.applied && result.abort) {
+      recordOnboardingAttempt(result.abort, cliVersion, daemonServiceStatus());
+    }
 
   // Onboarding-only: after a completed first-run setup, run the audit pipeline
   // (scan + cache warm) before the caller boots the dashboard. The explicit
@@ -1306,6 +1358,8 @@ export async function runConfigureWizard(io: WizardIO = {}): Promise<WizardResul
   // Only now — a completed apply — is the launcher considered "seen", so
   // first-run onboarding stops offering itself on every command.
   markLauncherSeen();
+  // And any record of an earlier failure is now false: this machine got set up.
+  clearOnboardingAttempt();
 
   // Keep this inside a standard 80-column terminal. `writeLines` truncates with
   // a hard cut and no ellipsis, so an over-long line doesn't just lose its tail

package/src/hooks/daemon-service.ts

@@ -450,8 +450,16 @@ export function primeElevation(): boolean {
   }
 }
 
-/** True when privileged commands can run without prompting for a password. */
-function canElevate(): boolean {
+/**
+ * True when privileged commands can run without prompting for a password.
+ *
+ * Exported because onboarding re-checks it: `needs_root` is the most common
+ * reason setup aborts, and it is the one most likely to stop being true (the
+ * user gets sudo rights, or primes their timestamp in another terminal). One
+ * `sudo -n true`, no prompt, milliseconds — and never on the hook path, which
+ * does not reach the first-run gate at all.
+ */
+export function canElevate(): boolean {
   if (typeof process.getuid === "function" && process.getuid() === 0) return true;
   try {
     execFileSync("sudo", ["-n", "true"], { stdio: "ignore", timeout: SERVICE_CMD_TIMEOUT_MS });