failproofai 1.0.0-beta.7 → 1.0.0-beta.9

package/dist/worker.mjs

@@ -990,11 +990,82 @@ function blockEnvFiles(ctx) {
   }
   return allow();
 }
+function quoteAwareSegments(command) {
+  const segments = [];
+  let tokens = [];
+  let token = "";
+  let quote = null;
+  const endToken = () => {
+    if (token)
+      tokens.push(token);
+    token = "";
+  };
+  const endSegment = () => {
+    endToken();
+    if (tokens.length)
+      segments.push(tokens);
+    tokens = [];
+  };
+  for (let i = 0;i < command.length; i++) {
+    const c = command[i];
+    if (quote) {
+      if (c === "\\" && quote === '"' && i + 1 < command.length) {
+        token += command[++i];
+        continue;
+      }
+      if (c === quote) {
+        quote = null;
+        continue;
+      }
+      token += c;
+      continue;
+    }
+    if (c === "\\" && i + 1 < command.length) {
+      token += command[++i];
+      continue;
+    }
+    if (c === '"' || c === "'") {
+      quote = c;
+      continue;
+    }
+    if (/\s/.test(c)) {
+      endToken();
+      continue;
+    }
+    if (/[;&|\n\r(){}`]/.test(c)) {
+      endSegment();
+      continue;
+    }
+    token += c;
+  }
+  endSegment();
+  return segments;
+}
+function namesElevation(command, depth = 0) {
+  for (const tokens of quoteAwareSegments(command)) {
+    let i = 0;
+    while (i < tokens.length) {
+      const token = tokens[i];
+      const base = token.slice(token.lastIndexOf("/") + 1);
+      if (base === "sudo" || base === "doas")
+        return true;
+      const isSkippable = ENV_ASSIGNMENT_RE.test(token) || token.startsWith("-") || token.startsWith(">") || token.startsWith("<") || RUNNER_OPERAND_RE.test(token) || COMMAND_PREFIX_TOKENS.has(base);
+      if (!isSkippable)
+        break;
+      if (EVAL_FLAG_RE.test(token) && depth < 3 && i + 1 < tokens.length) {
+        if (namesElevation(tokens[i + 1], depth + 1))
+          return true;
+      }
+      i++;
+    }
+  }
+  return false;
+}
 function blockSudo(ctx) {
   if (ctx.toolName !== "Bash")
     return allow();
   const cmd = getCommand(ctx).trimStart();
-  if (SUDO_RE.test(cmd) || cmd.startsWith("sudo ")) {
+  if (namesElevation(cmd)) {
     const allowPatterns = ctx.params?.allowPatterns ?? [];
     if (allowPatterns.some((p) => matchesAllowedPattern(cmd, p)))
       return allow();
@@ -1754,7 +1825,7 @@ function registerBuiltinPolicies(enabledNames) {
     }
   }
 }
-var isClaudeInternalPath, isClaudeSettingsFile, SHELL_OPERATORS, SHELL_METACHAR_RE, JWT_RE, API_KEY_PATTERNS, CONNECTION_STRING_RE, PRIVATE_KEY_RE, BEARER_TOKEN_RE, SQL_TOOL_RE, DESTRUCTIVE_SQL_RE, DELETE_NO_WHERE_RE, SQL_WHERE_RE, SCHEMA_ALTER_RE, PUBLISH_CMD_RE, ENV_PRINTENV_RE, ECHO_ENV_RE, EXPORT_RE, PS_ENV_VAR_RE, PS_CHILDITEM_ENV_RE, DOTNET_GETENV_RE, CMD_ECHO_ENV_RE, ENV_FILE_PATH_RE, ENV_CMD_RE, SUDO_RE, PS_ELEVATION_RE, RUNAS_RE, CURL_PIPE_SH_RE, SEGMENT_SEPARATORS, COMMAND_PREFIX_TOKENS, SELF_BINARY_TOKEN_RE, CONFIG_SUBCOMMAND_RE, PAUSE_FLAG_RE, ENV_ASSIGNMENT_RE, RUNNER_OPERAND_RE, PS_WEB_PIPE_RE, SHORT_FLAG_BUNDLE_RE, SAFE_FORCE_PREFIXES, SECRET_FILE_RE, SECRET_FILE_ID_RSA_RE, SECRET_FILE_CREDENTIALS_RE, GIT_COMMIT_MERGE_RE, FAILPROOFAI_CLI_RE, FAILPROOFAI_UNINSTALL_RE, GIT_AMEND_RE, GIT_STASH_DROP_RE, GIT_ADD_ALL_RE, NPM_GLOBAL_RE, YARN_GLOBAL_RE, PNPM_GLOBAL_RE, BUN_GLOBAL_RE, CARGO_INSTALL_RE, PIP_SYSTEM_RE, PKG_MANAGER_DETECTORS, NOHUP_RE, SCREEN_DETACH_RE, TMUX_DETACH_RE, DISOWN_RE, BACKGROUND_AMPERSAND_RE, KUBECTL_RE, TERRAFORM_RE, AWS_CLI_RE, GCLOUD_RE, AZ_CLI_RE, HELM_RE, GH_PIPELINE_RE, gitBranchCache, GIT_BRANCH_CACHE_MAX_ENTRIES = 500, HOME_PREFIX_RE, RM_CMD_RE, FIND_CMD_RE, FIND_EXEC_RE, FIND_GLOBAL_OPT_RE, FIND_EXPR_START_RE, SCRATCH_ROOTS, CATASTROPHIC_DEPTH = 2, READ_LIKE_CMDS, TOOL_CALL_TRACKER_MAX_BYTES = 65536, SEGMENT_SPLIT_RE, BUILTIN_POLICIES;
+var isClaudeInternalPath, isClaudeSettingsFile, SHELL_OPERATORS, SHELL_METACHAR_RE, JWT_RE, API_KEY_PATTERNS, CONNECTION_STRING_RE, PRIVATE_KEY_RE, BEARER_TOKEN_RE, SQL_TOOL_RE, DESTRUCTIVE_SQL_RE, DELETE_NO_WHERE_RE, SQL_WHERE_RE, SCHEMA_ALTER_RE, PUBLISH_CMD_RE, ENV_PRINTENV_RE, ECHO_ENV_RE, EXPORT_RE, PS_ENV_VAR_RE, PS_CHILDITEM_ENV_RE, DOTNET_GETENV_RE, CMD_ECHO_ENV_RE, ENV_FILE_PATH_RE, ENV_CMD_RE, PS_ELEVATION_RE, RUNAS_RE, CURL_PIPE_SH_RE, SEGMENT_SEPARATORS, COMMAND_PREFIX_TOKENS, SELF_BINARY_TOKEN_RE, CONFIG_SUBCOMMAND_RE, PAUSE_FLAG_RE, ENV_ASSIGNMENT_RE, RUNNER_OPERAND_RE, PS_WEB_PIPE_RE, SHORT_FLAG_BUNDLE_RE, SAFE_FORCE_PREFIXES, SECRET_FILE_RE, SECRET_FILE_ID_RSA_RE, SECRET_FILE_CREDENTIALS_RE, GIT_COMMIT_MERGE_RE, FAILPROOFAI_CLI_RE, FAILPROOFAI_UNINSTALL_RE, GIT_AMEND_RE, GIT_STASH_DROP_RE, GIT_ADD_ALL_RE, NPM_GLOBAL_RE, YARN_GLOBAL_RE, PNPM_GLOBAL_RE, BUN_GLOBAL_RE, CARGO_INSTALL_RE, PIP_SYSTEM_RE, PKG_MANAGER_DETECTORS, NOHUP_RE, SCREEN_DETACH_RE, TMUX_DETACH_RE, DISOWN_RE, BACKGROUND_AMPERSAND_RE, KUBECTL_RE, TERRAFORM_RE, AWS_CLI_RE, GCLOUD_RE, AZ_CLI_RE, HELM_RE, GH_PIPELINE_RE, gitBranchCache, GIT_BRANCH_CACHE_MAX_ENTRIES = 500, EVAL_FLAG_RE, HOME_PREFIX_RE, RM_CMD_RE, FIND_CMD_RE, FIND_EXEC_RE, FIND_GLOBAL_OPT_RE, FIND_EXPR_START_RE, SCRATCH_ROOTS, CATASTROPHIC_DEPTH = 2, READ_LIKE_CMDS, TOOL_CALL_TRACKER_MAX_BYTES = 65536, SEGMENT_SPLIT_RE, BUILTIN_POLICIES;
 var init_builtin_policies = __esm(() => {
   init_hook_logger();
   isClaudeInternalPath = isAgentInternalPath;
@@ -1791,7 +1862,6 @@ var init_builtin_policies = __esm(() => {
   CMD_ECHO_ENV_RE = /echo\s+%[A-Za-z_]/i;
   ENV_FILE_PATH_RE = /(?:^|[\\/])\.env(?:\.|$)/;
   ENV_CMD_RE = /\.env(?:\b|\s|$|\.)/;
-  SUDO_RE = /(?:^|;|&&|\|\|)\s*sudo\s/;
   PS_ELEVATION_RE = /Start-Process\s+.*-Verb\s+RunAs/i;
   RUNAS_RE = /(?:^|;|&&|\|\|)\s*runas\s/i;
   CURL_PIPE_SH_RE = /(?:curl|wget)\s.*\|\s*(?:sh|bash|zsh|dash|ksh|csh|tcsh|fish|ash)\b/;
@@ -1877,6 +1947,7 @@ var init_builtin_policies = __esm(() => {
   HELM_RE = /(?:^|[;\n]|&&|\|\|?|&)\s*helm(?:\s|$)/;
   GH_PIPELINE_RE = /(?:^|[;\n]|&&|\|\|?|&)\s*gh\s+(?:workflow\s+(?:run|enable|disable)|run\s+(?:rerun|cancel)|pr\s+merge|release\s+(?:create|delete)|cache\s+delete|secret\s+(?:set|delete))\b/;
   gitBranchCache = new Map;
+  EVAL_FLAG_RE = /^-{1,2}c$/;
   HOME_PREFIX_RE = /^(?:~[A-Za-z0-9_.-]*|\$HOME|\$\{HOME\})(?=$|\/)/;
   RM_CMD_RE = /^(?:\/\S*\/)?rm$/;
   FIND_CMD_RE = /^(?:\/\S*\/)?find$/;
@@ -2434,7 +2505,7 @@ var init_builtin_policies = __esm(() => {
 });
 
 // package.json
-var version = "1.0.0-beta.7";
+var version = "1.0.0-beta.9";
 var init_package = () => {};
 
 // src/posthog-key.ts
@@ -9993,7 +10064,7 @@ function isWorkerHookRequest(msg) {
   if (!msg || typeof msg !== "object")
     return false;
   const m = msg;
-  return m.type === "hook" && typeof m.hookEvent === "string" && typeof m.cli === "string" && typeof m.stdin === "string" && (m.cwd === undefined || typeof m.cwd === "string");
+  return m.type === "hook" && typeof m.hookEvent === "string" && typeof m.cli === "string" && typeof m.stdin === "string" && (m.cwd === undefined || m.cwd === null || typeof m.cwd === "string");
 }
 function encodeFrame(value) {
   const body = Buffer.from(JSON.stringify(value), "utf8");
@@ -10052,7 +10123,7 @@ function handleConnection(socket) {
         try {
           const result = await evaluateHookEvent(request.hookEvent, request.cli, request.stdin, {
             awaitTelemetryFlush: false,
-            fallbackCwd: request.cwd
+            fallbackCwd: request.cwd ?? undefined
           });
           socket.write(encodeFrame({
             type: "hookResult",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "failproofai",
-  "version": "1.0.0-beta.7",
+  "version": "1.0.0-beta.9",
   "description": "The easiest way to manage policies that keep your AI agents reliable, on-task, and running autonomously — for Claude Code & the Agents SDK",
   "bin": {
     "failproofai": "./dist/cli.mjs",
@@ -114,9 +114,9 @@
     "sharp": "0.35.0"
   },
   "optionalDependencies": {
-    "@failproofai/failproofaid-linux-x64": "1.0.0-beta.7",
-    "@failproofai/failproofaid-linux-arm64": "1.0.0-beta.7",
-    "@failproofai/failproofaid-darwin-x64": "1.0.0-beta.7",
-    "@failproofai/failproofaid-darwin-arm64": "1.0.0-beta.7"
+    "@failproofai/failproofaid-linux-x64": "1.0.0-beta.9",
+    "@failproofai/failproofaid-linux-arm64": "1.0.0-beta.9",
+    "@failproofai/failproofaid-darwin-x64": "1.0.0-beta.9",
+    "@failproofai/failproofaid-darwin-arm64": "1.0.0-beta.9"
   }
 }

package/scripts/repro-npm-install.sh

@@ -0,0 +1,155 @@
+#!/usr/bin/env bash
+# ─────────────────────────────────────────────────────────────────────────────
+# Reproduce a REAL user install, in the shape that actually breaks.
+#
+#   sudo npm i -g failproofai      (global prefix owned by root)
+#   then run the CLI as a NORMAL user
+#
+# That split is the whole point. A single-user laptop where npm's prefix is
+# owned by the person running the hooks hides an entire class of bug — it is
+# how the root-owned policy-shim fail-open shipped: every hook run by a non-root
+# user hit EACCES, the policy never loaded, and the hook exited 0 ALLOWING the
+# call, while builtins kept firing so the machine looked protected.
+#
+# systemd is real here (jrei/systemd-ubuntu), so `failproofai config` installs
+# and starts the actual service rather than skipping that half.
+#
+# Usage:
+#   scripts/repro-npm-install.sh              # build, pack, drop into a shell
+#   scripts/repro-npm-install.sh --published  # install the last RELEASE instead
+# ─────────────────────────────────────────────────────────────────────────────
+set -uo pipefail
+
+REPO="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "$REPO"
+
+IMAGE=jrei/systemd-ubuntu:24.04
+NAME=fpai-repro
+USER_IN_BOX=dev
+PUBLISHED=0
+[ "${1:-}" = "--published" ] && PUBLISHED=1
+
+VERSION=$(node -p "require('$REPO/package.json').version")
+say() { printf '\n\033[1m── %s\033[0m\n' "$1"; }
+
+# ── 1. Build what a tarball would carry ──────────────────────────────────────
+if [ "$PUBLISHED" -eq 0 ]; then
+  say "Building dist + daemon"
+  [ -f dist/cli.mjs ] || bun run build
+  [ -f target/release/failproofaid ] || cargo build --release --bin failproofaid
+
+  # `dist/cli.mjs` INLINES the version at build time. `npm pack --ignore-scripts`
+  # skips the `prepare` script that would rebuild it, so bumping package.json
+  # without rebuilding packs a bundle that reports the OLD version — and you
+  # spend an afternoon testing code you did not write. A real publish never hits
+  # this (publish.yml builds, and `prepare` runs on a normal pack); this is a
+  # trap of the fast path only, which is exactly why it is checked here.
+  if ! grep -q "$VERSION" dist/cli.mjs 2>/dev/null; then
+    say "dist is stale (built for $(grep -o '[0-9]\+\.[0-9]\+\.[0-9]\+-beta\.[0-9]\+' dist/cli.mjs | head -1)) — rebuilding"
+    bun run build
+  fi
+
+  say "Packing $VERSION"
+  rm -f failproofai-*.tgz
+  npm pack --ignore-scripts >/dev/null 2>&1
+  TARBALL="$REPO/failproofai-$VERSION.tgz"
+  [ -f "$TARBALL" ] || { echo "pack failed"; exit 1; }
+  ls -la "$TARBALL" | awk '{printf "  %s bytes  %s\n", $5, $9}'
+
+  # Belt and braces: assert what is actually IN the tarball, not what we meant
+  # to put there.
+  PACKED=$(tar -xzOf "$TARBALL" package/dist/cli.mjs 2>/dev/null \
+             | grep -o '[0-9]\+\.[0-9]\+\.[0-9]\+-beta\.[0-9]\+' | head -1)
+  if [ "$PACKED" != "$VERSION" ]; then
+    echo "  REFUSING: tarball reports '$PACKED' but package.json says '$VERSION'"
+    exit 1
+  fi
+  echo "  bundled version verified: $PACKED"
+fi
+
+# ── 2. A container with a real init ──────────────────────────────────────────
+say "Starting $IMAGE (real systemd)"
+docker rm -f "$NAME" >/dev/null 2>&1
+# --cgroupns=host + the two tmpfs mounts are REQUIRED on a cgroup v2 host
+# (anything modern). Without them systemd cannot set up its own hierarchy and
+# the container exits 255 immediately, with an empty `docker logs` — which is
+# a genuinely awful thing to debug, hence the comment.
+docker run -d --name "$NAME" --privileged --cgroupns=host \
+  --network=host \
+  -v /sys/fs/cgroup:/sys/fs/cgroup:rw --tmpfs /run --tmpfs /run/lock \
+  ${TARBALL:+-v "$TARBALL":/pkg.tgz:ro} \
+  -v "$REPO/target/release/failproofaid":/opt/failproofaid:ro \
+  "$IMAGE" >/dev/null
+# Wait for systemd to finish booting, or `systemctl` answers nothing useful.
+until docker exec "$NAME" systemctl is-system-running 2>/dev/null | grep -qE 'running|degraded'; do
+  if ! docker ps --filter "name=$NAME" --format '{{.Names}}' | grep -q "$NAME"; then
+    echo "  container died during boot — cgroup v2 flags wrong for this host?"
+    docker logs "$NAME" 2>&1 | tail -5
+    exit 1
+  fi
+  sleep 1
+done
+echo "  systemd: $(docker exec "$NAME" systemctl is-system-running 2>/dev/null)"
+
+# ── 3. Node, and a NON-ROOT user to run as ───────────────────────────────────
+say "Installing Node + creating an unprivileged user"
+docker exec "$NAME" bash -lc '
+  apt-get update -qq >/dev/null 2>&1
+  apt-get install -y -qq curl ca-certificates sudo >/dev/null 2>&1
+  curl -fsSL https://deb.nodesource.com/setup_22.x -o /tmp/n.sh 2>/dev/null && bash /tmp/n.sh >/dev/null 2>&1
+  apt-get install -y -qq nodejs >/dev/null 2>&1
+  node --version
+' 2>&1 | sed 's/^/  node /'
+
+docker exec "$NAME" bash -lc "
+  id $USER_IN_BOX >/dev/null 2>&1 || useradd -m -s /bin/bash $USER_IN_BOX
+  # Passwordless sudo: the daemon install needs root, and we are testing the
+  # INSTALL, not whether a human can type a password.
+  echo '$USER_IN_BOX ALL=(ALL) NOPASSWD:ALL' > /etc/sudoers.d/$USER_IN_BOX
+  chmod 440 /etc/sudoers.d/$USER_IN_BOX
+"
+
+# ── 4. Install globally AS ROOT — the shape that exposes ownership bugs ──────
+say "npm install -g (as root)"
+if [ "$PUBLISHED" -eq 1 ]; then
+  docker exec "$NAME" bash -lc "npm install -g failproofai@$VERSION 2>&1 | tail -4"
+else
+  docker exec "$NAME" bash -lc "npm install -g /pkg.tgz 2>&1 | tail -4"
+fi
+
+say "Who owns the global install?"
+docker exec "$NAME" bash -lc '
+  P=$(npm root -g)/failproofai
+  stat -c "  %U:%G %a  %n" "$P" 2>/dev/null
+  stat -c "  %U:%G %a  %n" "$P/dist" 2>/dev/null
+'
+
+# ── 5. Hand over, running as the unprivileged user ───────────────────────────
+say "Ready"
+cat <<EOF
+
+  The box is up as container "$NAME". Everything below runs as the
+  UNPRIVILEGED user, against a root-owned global install — the real shape.
+
+  Shell in:
+    docker exec -it -u $USER_IN_BOX $NAME bash -l
+
+  Then, inside:
+    failproofai --version
+    failproofai config          # real systemd service install
+    systemctl status failproofaid@$USER_IN_BOX
+
+  The daemon binary is mounted at /opt/failproofaid. There is no GitHub
+  release for $VERSION, so point the CLI at it rather than letting it try
+  to download one:
+    export FAILPROOFAI_DAEMON_BINARY=/opt/failproofaid
+
+  Fire a hook exactly as an agent CLI would:
+    printf '{"session_id":"s","cwd":"'"\$PWD"'","hook_event_name":"PreToolUse",
+    "tool_name":"Bash","tool_input":{"command":"sudo rm -rf /"}}' \\
+      | failproofai --hook PreToolUse --cli claude
+
+  Tear down:
+    docker rm -f $NAME
+
+EOF

package/src/hooks/builtin-policies.ts

@@ -164,7 +164,6 @@ const ENV_FILE_PATH_RE = /(?:^|[\\/])\.env(?:\.|$)/;
 const ENV_CMD_RE = /\.env(?:\b|\s|$|\.)/;
 
 // blockSudo
-const SUDO_RE = /(?:^|;|&&|\|\|)\s*sudo\s/;
 const PS_ELEVATION_RE = /Start-Process\s+.*-Verb\s+RunAs/i;
 const RUNAS_RE = /(?:^|;|&&|\|\|)\s*runas\s/i;
 
@@ -749,10 +748,163 @@ function blockEnvFiles(ctx: PolicyContext): PolicyResult {
   return allow();
 }
 
+/**
+ * True when a segment runs an elevation binary IN COMMAND POSITION.
+ *
+ * Anchored structurally rather than by token, for the reason `namesSelfPause`
+ * is: `SUDO_RE` required the literal token `sudo` at a command boundary, so
+ * **`/usr/bin/sudo rm -rf /` was ALLOWED** — a direct invocation, no
+ * obfuscation, one absolute path away from root on a `defaultEnabled` guard.
+ * Every other form the shell resolves before settling on the binary — prefix
+ * assignments, redirections, runners and their flags — is walked off first, and
+ * the comparison is on the BASENAME so a path cannot hide the name.
+ *
+ * `doas` is included because it is the same capability under a different name;
+ * a machine with `doas` installed and only `sudo` blocked is not blocked.
+ *
+ * This raises the bar; it does not close the class. `bash -c "sudo …"`, a
+ * variable (`S=sudo; $S …`) and base64-through-a-pipe all still reach root,
+ * because static inspection of one command string cannot follow them. Closing
+ * that properly needs enforcement below the shell, not a better regex.
+ */
+/**
+ * Split a command into per-segment TOKEN LISTS the way a shell reads it.
+ *
+ * Distinct from `shellSegments` below, which returns raw segment STRINGS and is
+ * what the deletion policies want. Named apart deliberately: defining a second
+ * `shellSegments` here shadowed that one, silently broke every `rm -rf` check,
+ * and disabled this matcher too — caught only because `tsc` reports duplicate
+ * implementations.
+ *
+ * Segmentation happens on the RAW string and skips separators inside quotes,
+ * which is the whole point: stripping quoting FIRST turns `\|` — a literal pipe
+ * in a grep alternation — into a real separator, so `grep "a\|sudo b"` parses
+ * as a command called `sudo` and gets denied. That is a common enough pattern
+ * that over-blocking it is worse than the evasion it would catch.
+ *
+ * Each token is unquoted individually afterwards, which still defeats `\sudo`
+ * and `"sudo"` without ever letting quote removal change where the boundaries
+ * are. Quoted tokens are returned separately so a caller can decide whether
+ * their CONTENTS deserve a second look — see `EVAL_FLAG_RE`.
+ */
+function quoteAwareSegments(command: string): Array<string[]> {
+  const segments: Array<string[]> = [];
+  let tokens: string[] = [];
+  let token = "";
+  let quote: '"' | "'" | null = null;
+  const endToken = () => {
+    if (token) tokens.push(token);
+    token = "";
+  };
+  const endSegment = () => {
+    endToken();
+    if (tokens.length) segments.push(tokens);
+    tokens = [];
+  };
+  for (let i = 0; i < command.length; i++) {
+    const c = command[i];
+    if (quote) {
+      // Inside single quotes a backslash is literal; inside double quotes it escapes.
+      if (c === "\\" && quote === '"' && i + 1 < command.length) {
+        token += command[++i];
+        continue;
+      }
+      if (c === quote) {
+        quote = null;
+        continue;
+      }
+      token += c;
+      continue;
+    }
+    if (c === "\\" && i + 1 < command.length) {
+      // An escaped character is literal — `\sudo` is still sudo, and `\|` is a
+      // pipe CHARACTER rather than a separator.
+      token += command[++i];
+      continue;
+    }
+    if (c === '"' || c === "'") {
+      quote = c;
+      continue;
+    }
+    if (/\s/.test(c)) {
+      endToken();
+      continue;
+    }
+    if (/[;&|\n\r(){}`]/.test(c)) {
+      endSegment();
+      continue;
+    }
+    token += c;
+  }
+  endSegment();
+  return segments;
+}
+
+/** `-c` and friends: the flags whose ARGUMENT is a command, not data. */
+const EVAL_FLAG_RE = /^-{1,2}c$/;
+
+/**
+ * True when a command runs an elevation binary IN COMMAND POSITION.
+ *
+ * Anchored structurally rather than by token, for the reason `namesSelfPause`
+ * is: `SUDO_RE` required the literal token `sudo` at a command boundary, so
+ * **`/usr/bin/sudo rm -rf /` was ALLOWED** — a direct invocation, no
+ * obfuscation, one absolute path away from root on a `defaultEnabled` guard.
+ * Every other form the shell resolves before settling on the binary — prefix
+ * assignments, redirections, runners and their flags — is walked off first, and
+ * the comparison is on the BASENAME so a path cannot hide the name.
+ *
+ * `doas` is included because it is the same capability under a different name;
+ * a machine with `doas` installed and only `sudo` blocked is not blocked.
+ *
+ * A quoted argument is re-examined ONLY when the command that owns it is a
+ * shell runner invoked with an eval flag (`bash -c "sudo …"`). That distinction
+ * is load-bearing: `bash -c "sudo x"` and `grep "a|sudo x"` are identical from
+ * the outside, and the only thing separating an execution from a search string
+ * is whether the receiving binary evaluates its argument.
+ *
+ * This raises the bar; it does not close the class. A variable (`S=sudo; $S …`),
+ * base64 through a pipe, and a wrapper script on disk all still reach root,
+ * because static inspection of one command string cannot follow them. Closing
+ * that properly needs enforcement below the shell, not a better matcher.
+ */
+function namesElevation(command: string, depth = 0): boolean {
+  for (const tokens of quoteAwareSegments(command)) {
+    let i = 0;
+    while (i < tokens.length) {
+      const token = tokens[i];
+      const base = token.slice(token.lastIndexOf("/") + 1);
+      // `sudo`/`doas` are themselves in COMMAND_PREFIX_TOKENS (they legitimately
+      // stand in front of another binary), so they must be tested BEFORE the
+      // skip list or the walk would step straight over the thing being looked for.
+      if (base === "sudo" || base === "doas") return true;
+      const isSkippable =
+        ENV_ASSIGNMENT_RE.test(token) ||
+        token.startsWith("-") ||
+        token.startsWith(">") ||
+        token.startsWith("<") ||
+        RUNNER_OPERAND_RE.test(token) ||
+        COMMAND_PREFIX_TOKENS.has(base);
+      if (!isSkippable) break;
+      // `sh -c "…"` / `bash -c "…"`: the next token is a COMMAND. Bounded
+      // recursion so a nested `bash -c "bash -c …"` cannot spin.
+      if (EVAL_FLAG_RE.test(token) && depth < 3 && i + 1 < tokens.length) {
+        if (namesElevation(tokens[i + 1], depth + 1)) return true;
+      }
+      i++;
+    }
+  }
+  return false;
+}
+
 function blockSudo(ctx: PolicyContext): PolicyResult {
   if (ctx.toolName !== "Bash") return allow();
   const cmd = getCommand(ctx).trimStart();
-  if (SUDO_RE.test(cmd) || cmd.startsWith("sudo ")) {
+  // ONE pass. `shellSegments` unquotes each token individually, so `\sudo` and
+  // `"sudo"` are still caught — without a whole-string strip, which is what
+  // turned an escaped pipe in `grep "a\|sudo b"` into a segment separator and
+  // denied an ordinary search.
+  if (namesElevation(cmd)) {
     // Check allowPatterns — match against parsed tokens, not raw string
     const allowPatterns = ((ctx.params?.allowPatterns ?? []) as string[]);
     if (allowPatterns.some((p) => matchesAllowedPattern(cmd, p))) return allow();

package/src/hooks/collector-config.ts

@@ -31,8 +31,24 @@ import { readHooksConfig, writeHooksConfig } from "./hooks-config";
 import { credentialsFile, failproofaiHome as layoutHome } from "./fp-home";
 import { readCredentials, writeCredentials, updateConfig } from "./fp-config";
 
-/** The hosted ingest endpoint — a COMPLETE endpoint, not a base to join onto. */
-export const DEFAULT_INGEST_URL = "https://server.befailproof.ai/v1/events";
+/**
+ * The hosted ingest endpoint — a COMPLETE endpoint, not a base to join onto.
+ *
+ * The DASHBOARD hostname, not the API server's. On the hosted deployment a
+ * reverse proxy routes `/v1/*` and `/enforcement/v1/*` to the server and
+ * everything else to the Next.js app, so this path already reaches ingest —
+ * the server hostname is not needed to get there and does not need to be a
+ * public name for the product to work.
+ *
+ * One hostname is also what makes `--connect <origin>` mean one thing. Ingest,
+ * key introspection (`/v1/auth/introspect`) and cloud-managed policy
+ * (`/enforcement/v1/*`) all resolve against the same origin someone pastes,
+ * which is the origin they already have in their browser.
+ *
+ * MUST stay byte-identical to `DEFAULT_INGEST_URL` in
+ * `crates/fpai-collect/src/config.rs` — see that copy for why.
+ */
+export const DEFAULT_INGEST_URL = "https://app.befailproof.ai/v1/events";
 
 export interface IngestCredential {
   url: string;

package/src/hooks/configure-wizard.ts

@@ -72,6 +72,7 @@ import {
   daemonVersionSkew,
   primeElevation,
   setDaemonConfigured,
+  probeDaemon,
   probeDaemonEndToEnd,
   uninstallDaemonService,
 } from "./daemon-service";
@@ -1020,39 +1021,60 @@ export async function runConfigureWizard(io: WizardIO = {}): Promise<WizardResul
       }
 
       if (url === null) {
-        const entered = await promptText({
-          message: "Failproof Cloud URL",
-          defaultValue: cloudBaseFor(DEFAULT_INGEST_URL),
-          hint: "Enter for the hosted endpoint",
-          // The SAME guard `--connect` uses, not a looser lookalike. This was
-          // `/^https?:\/\//`, which accepts `http://cloud.example.com` — and
-          // the wizard is the documented primary path, so the interactive flow
-          // put the machine's bearer token on the wire in clear while the flag
-          // nobody uses refused to. `validateCloudUrl` permits http for
-          // loopback only, which is what the local walkthrough needs.
-          validate: (v) => {
-            const check = validateCloudUrl(cloudBaseFor(v));
-            return check.ok ? null : check.reason;
-          },
-          stdin,
-          stdout,
-        });
-        if (entered === null) return cancel();
-        // Asked for as a base and normalised, so this and `--connect` take the
-        // same thing. Someone pasting the older `/events` endpoint still works.
-        const validated = validateCloudUrl(cloudBaseFor(entered));
-        if (!validated.ok) {
-          // Unreachable while `validate` above rejects the same input; kept so
-          // the two can never drift into disagreeing silently.
-          stdout.write(`\n${validated.reason}\n`);
-          return cancel();
+        // NOT asked for. There is exactly one right answer for everybody using
+        // the hosted product, and asking made it look like a decision — which
+        // is how a key ends up pasted into the URL field, and how someone
+        // reasonably types the dashboard's own address and gets a 404 from a
+        // web app that is not the ingest endpoint. Both are real, both happened
+        // within ten minutes of each other, and neither is a mistake the person
+        // making it can be expected to avoid: "Failproof Cloud URL" has no
+        // knowable answer other than the default it was already showing.
+        //
+        // The two audiences that genuinely need a different endpoint keep an
+        // explicit way to say so, and neither is an interactive prompt:
+        //
+        //   • local development / self-hosting → FAILPROOFAI_CLOUD_URL, the
+        //     same variable the DAEMON already reads for cloud-managed policy
+        //     (crates/failproofaid/src/cloud_client.rs), so one export points
+        //     the whole machine at one place instead of the wizard and the
+        //     daemon disagreeing.
+        //   • scripted installs → `failproofai config --connect <url> --token`,
+        //     unchanged.
+        //
+        // The env value goes through the SAME `validateCloudUrl` a typed one
+        // did — it is not a trusted back door. http stays loopback-only, so a
+        // bearer token still cannot be exported onto the wire in clear by
+        // setting a variable.
+        const override = process.env.FAILPROOFAI_CLOUD_URL?.trim();
+        if (override) {
+          const validated = validateCloudUrl(cloudBaseFor(override));
+          if (!validated.ok) {
+            // Loud, not silent-fallback-to-hosted: someone who exported this
+            // wants THAT endpoint, and quietly reporting a machine to the
+            // hosted service instead is the one outcome they did not ask for.
+            stdout.write(
+              `\nFAILPROOFAI_CLOUD_URL is set to "${override}", which cannot be used: ` +
+                `${validated.reason}\n`,
+            );
+            return cancel();
+          }
+          url = validated.url;
+          // Named on screen, because an env var is invisible at the moment it
+          // matters and a machine reporting somewhere unexpected is exactly the
+          // thing nobody notices until they go looking for data that is not
+          // there.
+          stdout.write(`\nUsing ${url} (from FAILPROOFAI_CLOUD_URL).\n`);
+        } else {
+          url = cloudBaseFor(DEFAULT_INGEST_URL);
         }
-        url = validated.url;
       }
 
       if (token === null) {
         token = await promptText({
-          message: "API key",
+          // The destination is in the question now that it is no longer a
+          // question of its own. It is the only remaining place a person can
+          // notice they are about to send a key somewhere they did not mean.
+          message: `API key for ${new URL(url).host}`,
           hint: "needs events:add · policies:pull enables managed policy too",
           // Masked: setup is routinely run while screen-sharing, and a pasted
           // key would otherwise sit in the scrollback of every recording.
@@ -1189,16 +1211,25 @@ export async function runConfigureWizard(io: WizardIO = {}): Promise<WizardResul
     // Checked HERE rather than inside `installDaemonService`, which can only
     // honestly report on the service: keeping them apart is also what lets the
     // install mechanics be tested against a stub binary.
-    if (!(await probeDaemonEndToEnd())) {
-      hookLogWarn("failproofaid was installed and running but did not answer a policy evaluation");
+    const probe = await probeDaemon();
+    if (!probe.ok) {
+      hookLogWarn(
+        `failproofaid was installed and running but did not answer a policy evaluation (${probe.reason})`,
+      );
+      // Two different faults, two different things to go and look at. Saying
+      // "your worker will not start" at a machine whose socket simply never
+      // came up sends someone to inspect a process that is fine.
       stdout.write(
-        "\nfailproofaid started but cannot evaluate policies — its worker process\n" +
-          "could not be run. Setup stopped before changing anything, because a machine\n" +
-          "configured to require a daemon that cannot answer denies every tool call.\n\n" +
+        (probe.reason === "worker"
+          ? "\nfailproofaid started but cannot evaluate policies — it is listening, and\n" +
+            "its worker process could not be run.\n"
+          : "\nfailproofaid started but could not be reached on its socket.\n") +
+          "Setup stopped before changing anything, because a machine configured to\n" +
+          "require a daemon that cannot answer denies every tool call.\n\n" +
           `  Check it with:  ${daemonStatusCommand() ?? "systemctl status failproofaid"}\n` +
           "  Then re-run:    failproofai config\n\n",
       );
-      void emit("configure_aborted", { reason: "daemon_not_answering" });
+      void emit("configure_aborted", { reason: `daemon_not_answering_${probe.reason}` });
       outro("Nothing was changed.", { ok: false }, stdout);
       return { applied: false, abort: "daemon_failed" };
     }