failproofai 1.0.0-beta.8 → 1.0.0-beta.9

package/dist/cli.mjs

@@ -19,7 +19,7 @@ var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
 var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
 // package.json
-var version2 = "1.0.0-beta.8";
+var version2 = "1.0.0-beta.9";
 var init_package = () => {};
 
 // src/posthog-key.ts
@@ -1007,7 +1007,8 @@ function resettablePaths() {
     legacy.launcherMarker(),
     legacy.lastVersion(),
     legacy.auditDashboard(),
-    legacy.cacheDir(),
+    legacy.auditCacheDir(),
+    legacy.codexSessionPaths(),
     legacy.spoolDir(),
     legacy.failedDir(),
     legacy.collectorHealth(),
@@ -1015,12 +1016,10 @@ function resettablePaths() {
     legacy.cloudManagedPolicies(),
     localPoliciesDir(),
     cloudPoliciesDir(),
-    at("cursors"),
     at("state"),
     configFile(),
     credentialsFile(),
     auditDir(),
-    hookActivityDir(),
     customAgentsDir(),
     logsDir()
   ];
@@ -11955,11 +11954,12 @@ var init_handler = __esm(() => {
 var exports_fp_reset = {};
 __export(exports_fp_reset, {
   resetHome: () => resetHome,
+  migrateHookActivity: () => migrateHookActivity,
   migrateConventionPolicies: () => migrateConventionPolicies,
   layoutWarningForHook: () => layoutWarningForHook2,
   checkLayoutForCli: () => checkLayoutForCli
 });
-import { existsSync as existsSync18, mkdirSync as mkdirSync10, readdirSync as readdirSync13, renameSync as renameSync5, rmSync as rmSync6 } from "node:fs";
+import { copyFileSync, existsSync as existsSync18, mkdirSync as mkdirSync10, readdirSync as readdirSync13, renameSync as renameSync5, rmSync as rmSync6 } from "node:fs";
 import { resolve as resolve15 } from "node:path";
 function migrateConventionPolicies() {
   const from = policiesDir();
@@ -11984,8 +11984,45 @@ function migrateConventionPolicies() {
   } catch {}
   return moved.sort((a, b) => a.localeCompare(b));
 }
+function migrateHookActivity() {
+  const from = legacy.hookActivityDir();
+  if (!existsSync18(from))
+    return [];
+  const moved = [];
+  try {
+    const entries = readdirSync13(from, { withFileTypes: true }).filter((e) => e.isFile() && e.name.endsWith(".jsonl"));
+    if (entries.length === 0)
+      return [];
+    const to = hookActivityDir();
+    mkdirSync10(to, { recursive: true });
+    const stamp2 = Date.now();
+    let seq = 0;
+    for (const entry of entries) {
+      const source = resolve15(from, entry.name);
+      let name = entry.name === "current.jsonl" ? `page-${stamp2}-${seq++}.jsonl` : entry.name;
+      let target = resolve15(to, name);
+      while (existsSync18(target)) {
+        name = `page-${stamp2}-${seq++}.jsonl`;
+        target = resolve15(to, name);
+      }
+      try {
+        renameSync5(source, target);
+        moved.push(name);
+      } catch (err) {
+        if (err?.code === "EXDEV") {
+          try {
+            copyFileSync(source, target);
+            moved.push(name);
+          } catch {}
+        }
+      }
+    }
+  } catch {}
+  return moved.sort((a, b) => a.localeCompare(b));
+}
 function resetHome(from) {
   const migrated = migrateConventionPolicies();
+  const activity = migrateHookActivity();
   const removed = [];
   for (const path3 of resettablePaths()) {
     if (!existsSync18(path3))
@@ -11996,7 +12033,7 @@ function resetHome(from) {
     } catch {}
   }
   writeVersionFile();
-  return { removed, migrated, from };
+  return { removed, migrated, activity, from };
 }
 async function checkLayoutForCli() {
   const state = detectLayout();
@@ -12015,21 +12052,25 @@ async function checkLayoutForCli() {
     };
   }
   if (state.kind === "stale") {
-    const { removed, migrated } = resetHome(state.found);
+    const { removed, migrated, activity } = resetHome(state.found);
     return {
       state,
       fatal: false,
       didReset: true,
       lines: [
         `failproofai reorganised ${failproofaiHome()} in this version.`,
-        `Removed ${removed.length} item(s) from the old layout — policy config, activity`,
-        `history and audit cache. Your downloaded daemon binary was kept.`,
+        `Removed ${removed.length} item(s) from the old layout — policy config and`,
+        `audit cache. Your daemon binary and decision history were kept.`,
         ...migrated.length > 0 ? [
           ``,
           `Kept your own policy file(s) and moved them to where this version`,
           `loads them (${customPoliciesDir()}):`,
           ...migrated.map((name) => `  ${name}`)
         ] : [],
+        ...activity.length > 0 ? [
+          ``,
+          `Carried ${activity.length} page(s) of decision history into ${hookActivityDir()}.`
+        ] : [],
         ``,
         `Run \`failproofai config\` to set up again.`
       ]
@@ -12957,7 +12998,7 @@ async function validateIngestKey(cred, fetchImpl = fetch, timeoutMs = 1e4) {
     clearTimeout(timer);
   }
 }
-var DEFAULT_INGEST_URL = "https://server.befailproof.ai/v1/events";
+var DEFAULT_INGEST_URL = "https://app.befailproof.ai/v1/events";
 var init_collector_config = __esm(() => {
   init_fp_home();
   init_fp_config();
@@ -26036,31 +26077,26 @@ refreshed. Re-run \`failproofai config\` once you can use sudo.
         }
       }
       if (url === null) {
-        const entered = await promptText({
-          message: "Failproof Cloud URL",
-          defaultValue: cloudBaseFor(DEFAULT_INGEST_URL),
-          hint: "Enter for the hosted endpoint",
-          validate: (v) => {
-            const check = validateCloudUrl(cloudBaseFor(v));
-            return check.ok ? null : check.reason;
-          },
-          stdin,
-          stdout
-        });
-        if (entered === null)
-          return cancel();
-        const validated = validateCloudUrl(cloudBaseFor(entered));
-        if (!validated.ok) {
+        const override = process.env.FAILPROOFAI_CLOUD_URL?.trim();
+        if (override) {
+          const validated = validateCloudUrl(cloudBaseFor(override));
+          if (!validated.ok) {
+            stdout.write(`
+FAILPROOFAI_CLOUD_URL is set to "${override}", which cannot be used: ${validated.reason}
+`);
+            return cancel();
+          }
+          url = validated.url;
           stdout.write(`
-${validated.reason}
+Using ${url} (from FAILPROOFAI_CLOUD_URL).
 `);
-          return cancel();
+        } else {
+          url = cloudBaseFor(DEFAULT_INGEST_URL);
         }
-        url = validated.url;
       }
       if (token === null) {
         token = await promptText({
-          message: "API key",
+          message: `API key for ${new URL(url).host}`,
           hint: "needs events:add · policies:pull enables managed policy too",
           mask: true,
           validate: (v) => v.length >= 8 ? null : "that looks too short to be a key",
@@ -28751,7 +28787,7 @@ import { realpathSync as realpathSync6 } from "fs";
 import { dirname as dirname17, resolve as resolve26 } from "path";
 import { fileURLToPath as fileURLToPath4 } from "url";
 // package.json
-var version = "1.0.0-beta.8";
+var version = "1.0.0-beta.9";
 
 // bin/failproofai.mjs
 if (!process.env.FAILPROOFAI_PACKAGE_ROOT) {

package/dist/worker.mjs

@@ -2505,7 +2505,7 @@ var init_builtin_policies = __esm(() => {
 });
 
 // package.json
-var version = "1.0.0-beta.8";
+var version = "1.0.0-beta.9";
 var init_package = () => {};
 
 // src/posthog-key.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "failproofai",
-  "version": "1.0.0-beta.8",
+  "version": "1.0.0-beta.9",
   "description": "The easiest way to manage policies that keep your AI agents reliable, on-task, and running autonomously — for Claude Code & the Agents SDK",
   "bin": {
     "failproofai": "./dist/cli.mjs",
@@ -114,9 +114,9 @@
     "sharp": "0.35.0"
   },
   "optionalDependencies": {
-    "@failproofai/failproofaid-linux-x64": "1.0.0-beta.8",
-    "@failproofai/failproofaid-linux-arm64": "1.0.0-beta.8",
-    "@failproofai/failproofaid-darwin-x64": "1.0.0-beta.8",
-    "@failproofai/failproofaid-darwin-arm64": "1.0.0-beta.8"
+    "@failproofai/failproofaid-linux-x64": "1.0.0-beta.9",
+    "@failproofai/failproofaid-linux-arm64": "1.0.0-beta.9",
+    "@failproofai/failproofaid-darwin-x64": "1.0.0-beta.9",
+    "@failproofai/failproofaid-darwin-arm64": "1.0.0-beta.9"
   }
 }

package/src/hooks/collector-config.ts

@@ -31,8 +31,24 @@ import { readHooksConfig, writeHooksConfig } from "./hooks-config";
 import { credentialsFile, failproofaiHome as layoutHome } from "./fp-home";
 import { readCredentials, writeCredentials, updateConfig } from "./fp-config";
 
-/** The hosted ingest endpoint — a COMPLETE endpoint, not a base to join onto. */
-export const DEFAULT_INGEST_URL = "https://server.befailproof.ai/v1/events";
+/**
+ * The hosted ingest endpoint — a COMPLETE endpoint, not a base to join onto.
+ *
+ * The DASHBOARD hostname, not the API server's. On the hosted deployment a
+ * reverse proxy routes `/v1/*` and `/enforcement/v1/*` to the server and
+ * everything else to the Next.js app, so this path already reaches ingest —
+ * the server hostname is not needed to get there and does not need to be a
+ * public name for the product to work.
+ *
+ * One hostname is also what makes `--connect <origin>` mean one thing. Ingest,
+ * key introspection (`/v1/auth/introspect`) and cloud-managed policy
+ * (`/enforcement/v1/*`) all resolve against the same origin someone pastes,
+ * which is the origin they already have in their browser.
+ *
+ * MUST stay byte-identical to `DEFAULT_INGEST_URL` in
+ * `crates/fpai-collect/src/config.rs` — see that copy for why.
+ */
+export const DEFAULT_INGEST_URL = "https://app.befailproof.ai/v1/events";
 
 export interface IngestCredential {
   url: string;

package/src/hooks/configure-wizard.ts

@@ -1021,39 +1021,60 @@ export async function runConfigureWizard(io: WizardIO = {}): Promise<WizardResul
       }
 
       if (url === null) {
-        const entered = await promptText({
-          message: "Failproof Cloud URL",
-          defaultValue: cloudBaseFor(DEFAULT_INGEST_URL),
-          hint: "Enter for the hosted endpoint",
-          // The SAME guard `--connect` uses, not a looser lookalike. This was
-          // `/^https?:\/\//`, which accepts `http://cloud.example.com` — and
-          // the wizard is the documented primary path, so the interactive flow
-          // put the machine's bearer token on the wire in clear while the flag
-          // nobody uses refused to. `validateCloudUrl` permits http for
-          // loopback only, which is what the local walkthrough needs.
-          validate: (v) => {
-            const check = validateCloudUrl(cloudBaseFor(v));
-            return check.ok ? null : check.reason;
-          },
-          stdin,
-          stdout,
-        });
-        if (entered === null) return cancel();
-        // Asked for as a base and normalised, so this and `--connect` take the
-        // same thing. Someone pasting the older `/events` endpoint still works.
-        const validated = validateCloudUrl(cloudBaseFor(entered));
-        if (!validated.ok) {
-          // Unreachable while `validate` above rejects the same input; kept so
-          // the two can never drift into disagreeing silently.
-          stdout.write(`\n${validated.reason}\n`);
-          return cancel();
+        // NOT asked for. There is exactly one right answer for everybody using
+        // the hosted product, and asking made it look like a decision — which
+        // is how a key ends up pasted into the URL field, and how someone
+        // reasonably types the dashboard's own address and gets a 404 from a
+        // web app that is not the ingest endpoint. Both are real, both happened
+        // within ten minutes of each other, and neither is a mistake the person
+        // making it can be expected to avoid: "Failproof Cloud URL" has no
+        // knowable answer other than the default it was already showing.
+        //
+        // The two audiences that genuinely need a different endpoint keep an
+        // explicit way to say so, and neither is an interactive prompt:
+        //
+        //   • local development / self-hosting → FAILPROOFAI_CLOUD_URL, the
+        //     same variable the DAEMON already reads for cloud-managed policy
+        //     (crates/failproofaid/src/cloud_client.rs), so one export points
+        //     the whole machine at one place instead of the wizard and the
+        //     daemon disagreeing.
+        //   • scripted installs → `failproofai config --connect <url> --token`,
+        //     unchanged.
+        //
+        // The env value goes through the SAME `validateCloudUrl` a typed one
+        // did — it is not a trusted back door. http stays loopback-only, so a
+        // bearer token still cannot be exported onto the wire in clear by
+        // setting a variable.
+        const override = process.env.FAILPROOFAI_CLOUD_URL?.trim();
+        if (override) {
+          const validated = validateCloudUrl(cloudBaseFor(override));
+          if (!validated.ok) {
+            // Loud, not silent-fallback-to-hosted: someone who exported this
+            // wants THAT endpoint, and quietly reporting a machine to the
+            // hosted service instead is the one outcome they did not ask for.
+            stdout.write(
+              `\nFAILPROOFAI_CLOUD_URL is set to "${override}", which cannot be used: ` +
+                `${validated.reason}\n`,
+            );
+            return cancel();
+          }
+          url = validated.url;
+          // Named on screen, because an env var is invisible at the moment it
+          // matters and a machine reporting somewhere unexpected is exactly the
+          // thing nobody notices until they go looking for data that is not
+          // there.
+          stdout.write(`\nUsing ${url} (from FAILPROOFAI_CLOUD_URL).\n`);
+        } else {
+          url = cloudBaseFor(DEFAULT_INGEST_URL);
         }
-        url = validated.url;
       }
 
       if (token === null) {
         token = await promptText({
-          message: "API key",
+          // The destination is in the question now that it is no longer a
+          // question of its own. It is the only remaining place a person can
+          // notice they are about to send a key somewhere they did not mean.
+          message: `API key for ${new URL(url).host}`,
           hint: "needs events:add · policies:pull enables managed policy too",
           // Masked: setup is routinely run while screen-sharing, and a pasted
           // key would otherwise sit in the scrollback of every recording.

package/src/hooks/fp-home.ts

@@ -312,7 +312,15 @@ export function resettablePaths(): string[] {
     legacy.launcherMarker(),
     legacy.lastVersion(),
     legacy.auditDashboard(),
-    legacy.cacheDir(),
+    // `legacy.cacheDir()` — the whole of `cache/` — stood here, and it CONTAINS
+    // `cache/hook-activity`: layout 1's decision log. Deleting the parent threw
+    // away every decision the machine had ever recorded, which is the data the
+    // dashboard's activity tab exists to show. Its children are now named
+    // individually so the log can be carried across by
+    // `migrateHookActivity()`, and everything else in `cache/` still goes —
+    // both remaining entries are re-derived on demand.
+    legacy.auditCacheDir(),
+    legacy.codexSessionPaths(),
     legacy.spoolDir(),
     legacy.failedDir(),
     legacy.collectorHealth(),
@@ -335,7 +343,14 @@ export function resettablePaths(): string[] {
     // setup, `cloud-policies/` by the next daemon poll.
     localPoliciesDir(),
     cloudPoliciesDir(),
-    at("cursors"),
+    // `at("cursors")` is deliberately NOT here, and it is load-bearing for the
+    // activity migration above rather than a separate opinion. Cursors are keyed
+    // on `(device, inode)`; `migrateHookActivity()` MOVES pages, which preserves
+    // the inode, so a surviving cursor still points at the file it belongs to
+    // and resumes at the right offset. Delete the cursors and every carried page
+    // reads as new and re-ships in full — which is the outcome the move exists
+    // to avoid. A cursor whose file is gone is inert (`retain_existing` drops
+    // it), so keeping them costs nothing when there is nothing to resume.
     at("state"),
     // Layout 2.
     // NOT versionFile() — it is the layout marker, not user data, and the
@@ -344,7 +359,12 @@ export function resettablePaths(): string[] {
     configFile(),
     credentialsFile(),
     auditDir(),
-    hookActivityDir(),
+    // NOT hookActivityDir(). It is the DESTINATION `migrateHookActivity()` has
+    // just moved layout 1's log into, so listing it here deleted the migration
+    // moments after it happened — the reset runs every path in this list after
+    // the migrations. It is also the one directory here that is neither derived
+    // nor re-fetchable: a decision log is the record of what this machine did,
+    // and nothing regenerates it.
     customAgentsDir(),
     logsDir(),
     // NOT bin/ — a downloaded daemon binary is large, version-pinned and

package/src/hooks/fp-reset.ts

@@ -29,12 +29,14 @@
  * user out of their agent entirely, with no way back except hand-editing JSON.
  * A loud warning that survives until setup runs is the proportionate answer.
  */
-import { existsSync, mkdirSync, readdirSync, renameSync, rmSync } from "node:fs";
+import { copyFileSync, existsSync, mkdirSync, readdirSync, renameSync, rmSync } from "node:fs";
 import { resolve } from "node:path";
 import {
   LAYOUT_VERSION,
   customPoliciesDir,
   failproofaiHome,
+  hookActivityDir,
+  legacy,
   policiesDir,
   resettablePaths,
 } from "./fp-home";
@@ -52,6 +54,8 @@ export interface ResetOutcome {
   removed: string[];
   /** Basenames of user-authored policy files moved into `custom-policies/`. */
   migrated: string[];
+  /** Basenames of decision-log pages carried into layout 2's `hook-activity/`. */
+  activity: string[];
   /** The layout that was found before the reset. */
   from: number;
 }
@@ -110,6 +114,94 @@ export function migrateConventionPolicies(): string[] {
   return moved.sort((a, b) => a.localeCompare(b));
 }
 
+/**
+ * Carry layout 1's decision log into layout 2, WITHOUT re-shipping it.
+ *
+ * `cache/hook-activity` was deleted along with the rest of `cache/`, so an
+ * upgrade silently discarded every decision the machine had ever recorded —
+ * the data the dashboard's activity tab exists to show, and on a connected
+ * machine the data an operator had already been billed the collection of.
+ *
+ * # Why this MOVES rather than copies
+ *
+ * The collector keys its cursors on `(device, inode)` — deliberately, because
+ * the store rotates by RENAMING `current.jsonl`, and a path-keyed cursor would
+ * both re-ship the rotated file and carry its offset onto the fresh one.
+ * `rename()` preserves the inode, so a moved page is still the file its cursor
+ * belongs to and resumes at the right offset. A copy gives every page a NEW
+ * inode, which reads as "never seen before" and re-ships all of it.
+ *
+ * `head_fingerprint` is what makes that safe rather than lucky: the cursor
+ * verifies the file's first bytes whenever a resumed cursor's path has changed,
+ * which is exactly this situation. It was added for inode REUSE; a migration is
+ * the same question asked the other way round.
+ *
+ * The fallback for `EXDEV` (a `cache/` on a different filesystem — rare, since
+ * both live under one home, but possible with bind mounts) is a copy, accepting
+ * that those pages re-ship. Ingest dedups on a content hash and collapses them
+ * at merge, so the cost is bandwidth, not duplicate rows.
+ *
+ * # What is deliberately NOT carried
+ *
+ * `current.count` and `stats.json` are derived state, and two of each cannot be
+ * merged without inventing a number. They are dropped and the store rebuilds
+ * them. The legacy `current.jsonl` is moved under a PAGE name rather than onto
+ * the destination's own `current.jsonl`, which may already exist and may be
+ * mid-write — a rotated page is exactly what the store would have made of it.
+ */
+export function migrateHookActivity(): string[] {
+  const from = legacy.hookActivityDir();
+  if (!existsSync(from)) return [];
+  const moved: string[] = [];
+  try {
+    const entries = readdirSync(from, { withFileTypes: true }).filter(
+      (e) => e.isFile() && e.name.endsWith(".jsonl"),
+    );
+    if (entries.length === 0) return [];
+
+    const to = hookActivityDir();
+    mkdirSync(to, { recursive: true });
+
+    // One timestamp for the whole migration, with a per-file counter, so the
+    // names are stable, ordered, and cannot collide with each other.
+    const stamp = Date.now();
+    let seq = 0;
+
+    for (const entry of entries) {
+      const source = resolve(from, entry.name);
+      // `current.jsonl` becomes a page: the destination has its own, and the
+      // store's reader treats pages and current identically.
+      let name = entry.name === "current.jsonl" ? `page-${stamp}-${seq++}.jsonl` : entry.name;
+      let target = resolve(to, name);
+      // Never overwrite. A same-named page in the destination is a different
+      // file with different records, and losing either is worse than a rename.
+      while (existsSync(target)) {
+        name = `page-${stamp}-${seq++}.jsonl`;
+        target = resolve(to, name);
+      }
+      try {
+        renameSync(source, target);
+        moved.push(name);
+      } catch (err) {
+        // EXDEV: a rename across filesystems. Copy instead and accept the
+        // re-ship; a page left behind would be data lost.
+        if ((err as NodeJS.ErrnoException)?.code === "EXDEV") {
+          try {
+            copyFileSync(source, target);
+            moved.push(name);
+          } catch {
+            // Unreadable or undeletable — leave it where it is. `cache/` is no
+            // longer deleted wholesale, so "left behind" means "still there".
+          }
+        }
+      }
+    }
+  } catch {
+    // An activity directory we cannot read is not worth aborting a reset over.
+  }
+  return moved.sort((a, b) => a.localeCompare(b));
+}
+
 /**
  * Delete every path layout 1 or layout 2 could have written, then stamp
  * VERSION so the next run reads as current.
@@ -124,6 +216,7 @@ export function resetHome(from: number): ResetOutcome {
   // BEFORE the deletions, so a file that is mid-move is never one the reset
   // then walks over.
   const migrated = migrateConventionPolicies();
+  const activity = migrateHookActivity();
   const removed: string[] = [];
   for (const path of resettablePaths()) {
     if (!existsSync(path)) continue;
@@ -137,7 +230,7 @@ export function resetHome(from: number): ResetOutcome {
     }
   }
   writeVersionFile();
-  return { removed, migrated, from };
+  return { removed, migrated, activity, from };
 }
 
 export interface LayoutCheck {
@@ -187,15 +280,19 @@ export async function checkLayoutForCli(): Promise<LayoutCheck> {
   }
 
   if (state.kind === "stale") {
-    const { removed, migrated } = resetHome(state.found);
+    const { removed, migrated, activity } = resetHome(state.found);
     return {
       state,
       fatal: false,
       didReset: true,
       lines: [
         `failproofai reorganised ${failproofaiHome()} in this version.`,
-        `Removed ${removed.length} item(s) from the old layout — policy config, activity`,
-        `history and audit cache. Your downloaded daemon binary was kept.`,
+        // "activity history" was in this sentence while the reset was deleting
+        // it. It is carried over now, so the message says what was KEPT as well
+        // as what went — a user who reads "removed" and nothing else has no way
+        // to know their decision log survived.
+        `Removed ${removed.length} item(s) from the old layout — policy config and`,
+        `audit cache. Your daemon binary and decision history were kept.`,
         // Named individually rather than counted. These are files a person
         // wrote; "moved 3 items" is not something you can check at a glance,
         // and the whole point of saying it is that they can.
@@ -207,6 +304,16 @@ export async function checkLayoutForCli(): Promise<LayoutCheck> {
               ...migrated.map((name) => `  ${name}`),
             ]
           : []),
+        // Counted, not named. Unlike policy files these are machine-written
+        // pages with generated names — a list of them tells the reader nothing
+        // they could act on, where the COUNT answers the only question they
+        // have: did my history survive.
+        ...(activity.length > 0
+          ? [
+              ``,
+              `Carried ${activity.length} page(s) of decision history into ${hookActivityDir()}.`,
+            ]
+          : []),
         ``,
         `Run \`failproofai config\` to set up again.`,
       ],