failproofai 1.0.0 → 1.0.1-beta.0

package/.next/standalone/app/settings/settings.css

@@ -0,0 +1,354 @@
+/* /settings — a console for the service running on this machine.
+ *
+ * Every colour is an existing token from globals.css. No new hue, no third
+ * accent: pink is the control that acts and anything that needs a person, mint
+ * is the thing that is alive, everything else is the charcoal stack and the ink
+ * ramp. The chunky pixel shadow comes from `.btn-press`, which already exists —
+ * this file puts one on the console and nothing else.
+ *
+ * ## The hairline grid
+ *
+ * Every rule between cells is a `gap: 1px` over a line-coloured background, not
+ * a border on each cell. Borders double where two cells meet and go missing at
+ * the edges; a gap over a background cannot do either, so the grid is exactly
+ * one pixel everywhere by construction rather than by arithmetic.
+ *
+ * The tape is the only drawn element on the page. That is the budget.
+ */
+
+.set-sec {
+  max-width: 940px;
+}
+
+/* ── the console: stat row over panel row, one hairline grid ──────────────── */
+
+.set-console {
+  display: flex;
+  flex-direction: column;
+  /* The gap IS the grid — see the note above. */
+  gap: 1px;
+  background: var(--line);
+  border: 1px solid var(--line);
+  /* Print-register depth, matching `.btn-press`. Hard offset, never a blur. */
+  box-shadow: 6px 6px 0 0 var(--accent-pink-shadow);
+}
+
+.set-cell {
+  background: var(--bg-2);
+  padding: 20px 22px;
+}
+
+.set-stats {
+  display: grid;
+  grid-template-columns: repeat(4, 1fr);
+  gap: 1px;
+  background: var(--line);
+}
+
+.set-stat {
+  background: var(--bg-2);
+  padding: 16px 18px 15px;
+  display: flex;
+  flex-direction: column;
+  gap: 7px;
+  min-width: 0;
+}
+.set-stat-label {
+  font-family: var(--font-mono);
+  font-size: 9.5px;
+  font-weight: 500;
+  letter-spacing: 0.18em;
+  text-transform: uppercase;
+  color: var(--dim);
+}
+.set-stat-value {
+  /* The pixel display face, on the page title and these four numbers only. */
+  font-family: var(--font-display);
+  font-size: 26px;
+  line-height: 1;
+  letter-spacing: 0.04em;
+  color: var(--ink);
+  text-transform: lowercase;
+  /* Four cells of digits should line up as a row, not drift per glyph width. */
+  font-variant-numeric: tabular-nums;
+  overflow-wrap: anywhere;
+}
+.set-stat-value.ok { color: var(--accent-green); }
+.set-stat-value.warn { color: var(--accent-pink); }
+.set-stat-sub {
+  font-family: var(--font-mono);
+  font-size: 10.5px;
+  line-height: 1.5;
+  color: var(--ink-2);
+  /* Reserve the line even when empty, so cells with and without a sub-line
+   * keep the same height and the row's baselines stay level. */
+  min-height: 1.5em;
+}
+
+/* ── panel row: controls, then what the scan does ─────────────────────────── */
+
+.set-cols {
+  display: grid;
+  /* ~56/44 — the controls carry more, so they get more. */
+  grid-template-columns: 1.28fr 1fr;
+  gap: 1px;
+  background: var(--line);
+}
+
+.set-config {
+  display: flex;
+  flex-direction: column;
+  gap: 16px;
+}
+
+.set-cell-title {
+  font-family: var(--font-mono);
+  font-size: 10px;
+  font-weight: 600;
+  letter-spacing: 0.18em;
+  text-transform: uppercase;
+  color: var(--ink-2);
+  margin: 0;
+}
+
+.set-actions {
+  margin-top: auto;
+  padding-top: 4px;
+}
+
+/* ── how it works ─────────────────────────────────────────────────────────── */
+
+.set-how {
+  display: flex;
+  flex-direction: column;
+  gap: 16px;
+}
+.set-how-list {
+  display: flex;
+  flex-direction: column;
+  gap: 14px;
+  margin: 0;
+}
+.set-how-row {
+  display: grid;
+  grid-template-columns: 58px 1fr;
+  gap: 12px;
+  align-items: baseline;
+}
+.set-how-label {
+  font-family: var(--font-mono);
+  font-size: 9.5px;
+  font-weight: 500;
+  letter-spacing: 0.16em;
+  text-transform: uppercase;
+  color: var(--accent-pink);
+}
+.set-how-body {
+  font-family: var(--font-mono);
+  font-size: 11.5px;
+  line-height: 1.65;
+  color: var(--ink-2);
+  margin: 0;
+}
+
+/* ── masthead ─────────────────────────────────────────────────────────────── */
+
+.set-mast {
+  margin-bottom: 28px;
+}
+.set-title {
+  /* The pixel display face, used once on the page and nowhere else. */
+  font-family: var(--font-display);
+  font-size: 40px;
+  line-height: 1;
+  letter-spacing: 0.06em;
+  color: var(--ink);
+  margin: 0 0 10px;
+  text-transform: lowercase;
+}
+.set-lede {
+  font-family: var(--font-mono);
+  font-size: 13px;
+  line-height: 1.6;
+  color: var(--ink-2);
+  margin: 0;
+  /* Wide enough to hold the sentence on one line at desktop width — 52ch broke
+   * it after "not", which reads as a typo rather than a line. */
+  max-width: 64ch;
+}
+
+/* ── the panel ────────────────────────────────────────────────────────────── */
+
+/* ── rows ─────────────────────────────────────────────────────────────────── */
+
+.set-row {
+  display: flex;
+  align-items: center;
+  gap: 12px;
+  font-family: var(--font-mono);
+  font-size: 13px;
+  color: var(--ink);
+}
+.set-row-main {
+  align-items: flex-start;
+}
+.set-row-copy {
+  display: flex;
+  flex-direction: column;
+  gap: 3px;
+  line-height: 1.5;
+}
+.set-row-interval {
+  gap: 10px;
+  flex-wrap: wrap;
+}
+.set-row-identity {
+  flex-wrap: wrap;
+  gap: 8px;
+  font-size: 12px;
+}
+
+.set-strong { color: var(--ink); }
+.set-dim { color: var(--ink-2); }
+.set-hint { color: var(--dim); font-size: 11px; }
+.set-email { color: var(--accent-green); }
+
+.set-num {
+  font-family: var(--font-mono);
+  font-size: 13px;
+  width: 62px;
+  padding: 6px 10px;
+  background: var(--bg);
+  border: 1px solid var(--line-2);
+  color: var(--ink);
+  border-radius: 0;
+}
+.set-num:focus-visible {
+  outline: 2px solid var(--accent-pink);
+  outline-offset: 1px;
+}
+
+.set-link {
+  font-family: var(--font-mono);
+  font-size: 12px;
+  color: var(--dim);
+  background: none;
+  border: none;
+  padding: 0;
+  text-decoration: underline;
+  text-underline-offset: 3px;
+}
+.set-link:hover:not(:disabled) { color: var(--ink); }
+.set-link:disabled { opacity: 0.5; cursor: not-allowed; }
+.set-link:focus-visible { outline: 2px solid var(--accent-pink); outline-offset: 2px; }
+
+.set-warn {
+  font-family: var(--font-mono);
+  font-size: 12px;
+  line-height: 1.6;
+  color: var(--accent-pink);
+  margin: 0;
+}
+.set-warn-inline { color: var(--accent-pink); }
+
+.set-rule {
+  height: 1px;
+  background: var(--line);
+  margin: 2px 0;
+}
+
+/* ── the switch ───────────────────────────────────────────────────────────── */
+
+.sw {
+  position: relative;
+  flex: none;
+  width: 38px;
+  height: 20px;
+  border-radius: 10px;
+  border: none;
+  background: var(--line-2);
+  cursor: pointer;
+  padding: 0;
+  transition: background-color 140ms cubic-bezier(0.22, 1, 0.36, 1);
+}
+.sw[data-on="true"] { background: var(--accent-pink); }
+.sw:disabled { opacity: 0.5; cursor: not-allowed; }
+.sw:focus-visible { outline: 2px solid var(--accent-pink); outline-offset: 3px; }
+.sw-knob {
+  position: absolute;
+  top: 3px;
+  left: 3px;
+  width: 14px;
+  height: 14px;
+  border-radius: 50%;
+  background: var(--bg);
+  transition: transform 140ms cubic-bezier(0.22, 1, 0.36, 1);
+}
+.sw[data-on="true"] .sw-knob { transform: translateX(18px); }
+
+/* ── the schedule tape — the one drawn element ────────────────────────────── */
+
+.tape {
+  display: flex;
+  flex-direction: column;
+  gap: 8px;
+  /* Clears the console's 6px pixel shadow rather than sitting on it. */
+  margin-top: 26px;
+}
+.tape-rail {
+  position: relative;
+  height: 3px;
+  background: var(--line-2);
+}
+.tape-fill {
+  position: absolute;
+  inset: 0 auto 0 0;
+  background: var(--accent-green);
+  opacity: 0.55;
+}
+.tape-now {
+  position: absolute;
+  top: -4px;
+  width: 2px;
+  height: 11px;
+  background: var(--accent-pink);
+  /* Centre the marker on its position rather than hanging it to the right. */
+  transform: translateX(-1px);
+}
+.tape-ends {
+  display: flex;
+  justify-content: space-between;
+  gap: 12px;
+  font-family: var(--font-mono);
+  font-size: 10.5px;
+  letter-spacing: 0.04em;
+  color: var(--dim);
+}
+.tape-next { color: var(--ink-2); }
+
+/* ── narrow ───────────────────────────────────────────────────────────────── */
+
+/* The stat row folds 4 → 2 before it folds 2 → 1: four cells at phone width
+ * would each be too narrow for a display-face number, and a single column
+ * makes four facts into a list you scroll rather than a row you scan. */
+@media (max-width: 860px) {
+  .set-stats { grid-template-columns: repeat(2, 1fr); }
+  .set-cols { grid-template-columns: 1fr; }
+}
+
+@media (max-width: 640px) {
+  .set-title { font-size: 32px; }
+  .set-console { box-shadow: 4px 4px 0 0 var(--accent-pink-shadow); }
+  .set-stat-value { font-size: 22px; }
+  .set-cell { padding: 18px; }
+}
+
+@media (max-width: 420px) {
+  .set-stats { grid-template-columns: 1fr; }
+  .set-how-row { grid-template-columns: 1fr; gap: 4px; }
+}
+
+@media (prefers-reduced-motion: reduce) {
+  .sw,
+  .sw-knob { transition: none; }
+}

package/.next/standalone/components/navbar.tsx

@@ -1,16 +1,22 @@
-/** Top navigation bar — wordmark, primary nav, refresh + reach-developers controls.
+/** Top navigation bar — wordmark, primary nav, refresh + settings + reach-us.
  *
  * Restyled to the audit / brutalist-pixel-craft system: the wordmark uses the
  * same pixel pink mark + Bitcount Prop Single lowercase name as the audit
  * report, and each nav link is a `.tab` with a sharp pink underline on the
- * active route. No lucide icons in the bar itself — the chrome stays text-
- * forward to match the rest of the design system.
+ * active route.
+ *
+ * The bar was text-forward with no icons. Settings is the one exception, and
+ * deliberately so: the tabs are VIEWS OF DATA (projects, policies, audit) and
+ * settings is machine configuration, so putting it in that row would have
+ * claimed it was another place to look at results. As an icon among the other
+ * chrome controls it reads as what it is.
  */
 "use client";
 
 import React from "react";
 import Link from "next/link";
 import { usePathname } from "next/navigation";
+import { Settings } from "lucide-react";
 import { ReachDevelopers } from "@/components/reach-developers";
 import { RefreshButton } from "@/app/components/refresh-button";
 import { usePostHog } from "@/contexts/PostHogContext";
@@ -19,7 +25,6 @@ const NAV_LINKS = [
   { href: "/projects", label: "projects" },
   { href: "/policies", label: "policies" },
   { href: "/audit", label: "audit" },
-  { href: "/settings", label: "settings" },
 ];
 
 const REMOTE_LOGO_URL =
@@ -131,6 +136,30 @@ export const Navbar: React.FC<{
       <div className="h-actions">
         <RefreshButton />
         <span style={{ width: 1, height: 18, background: "var(--line)", margin: "0 6px" }} />
+        {/* Settings sits between the refresh controls and reach-us as an ICON,
+            not a nav tab: it is machine configuration rather than a view of the
+            data, so it belongs with the other chrome controls rather than
+            beside projects / policies / audit.
+
+            Being chrome rather than a tab is what put it OUTSIDE the filter
+            above, so `FAILPROOFAI_DISABLE_PAGES=settings` hid nothing and the
+            gear kept pointing at a page the operator had turned off. The tabs
+            and the icon are different placements of the same idea, and the
+            filter applies to both. */}
+        {!disabledPages.includes("settings") && (
+          <>
+            <Link
+              href="/settings"
+              className={`h-icon-btn${pathname.startsWith("/settings") ? " is-active" : ""}`}
+              aria-label="settings"
+              aria-current={pathname.startsWith("/settings") ? "page" : undefined}
+              title="settings"
+            >
+              <Settings className="w-3.5 h-3.5" strokeWidth={1.75} aria-hidden="true" />
+            </Link>
+            <span style={{ width: 1, height: 18, background: "var(--line)", margin: "0 6px" }} />
+          </>
+        )}
         <ReachDevelopers />
       </div>
     </header>

package/.next/standalone/lib/auth/api-server-client.ts

@@ -107,7 +107,7 @@ async function parseError(res: Response): Promise<AuthApiError> {
   return new AuthApiError(res.status, code, message, retryAfterSecs);
 }
 
-/** Hard cap on every auth/reminder HTTP call. Without this, a wedged DNS
+/** Hard cap on every auth/report HTTP call. Without this, a wedged DNS
  *  resolver or a hung server keeps the CLI / dashboard route stuck forever. */
 const REQUEST_TIMEOUT_MS = 10_000;
 
@@ -210,34 +210,6 @@ export async function fetchMe(accessToken: string): Promise<MeResponse> {
   return getJson<MeResponse>("/v0/auth/me", accessToken);
 }
 
-export interface ServerReminder {
-  user_id: string;
-  email: string;
-  fire_at: number; // unix seconds
-  set_at: number;  // unix seconds
-}
-
-export async function scheduleReminder(
-  accessToken: string,
-  body: { in_days?: number; at?: number },
-): Promise<ServerReminder> {
-  const res = await postJson<{ reminder: ServerReminder }>(
-    "/v0/reminders",
-    body,
-    { accessToken },
-  );
-  return res.reminder;
-}
-
-export async function cancelReminder(accessToken: string): Promise<void> {
-  const res = await fetchWithTimeout(`${getApiBase()}/v0/reminders`, {
-    method: "DELETE",
-    headers: { authorization: `Bearer ${accessToken}` },
-  });
-  if (res.status === 204 || res.ok) return;
-  throw await parseError(res);
-}
-
 export interface InviteSendResult {
   /** Recipients that were dispatched successfully. */
   sent: string[];
@@ -266,6 +238,56 @@ export async function sendInvites(
   );
 }
 
+export interface AuditReportBody {
+  machine_id: string;
+  label?: string;
+  platform?: string;
+  window_from?: string;
+  window_to: string;
+  harmful: {
+    policy: string;
+    category: string;
+    title: string;
+    hits: number;
+    first_seen?: string;
+    last_seen?: string;
+    examples: string[];
+  }[];
+}
+
+export interface AuditReportResult {
+  report_id: string;
+  /** Whether this report produced an email. */
+  emailed: boolean;
+  /** `below_threshold`, `cooldown`, `send_failed`, or null when mail went out. */
+  reason: string | null;
+  /**
+   * Where the next window starts, per the SERVER.
+   *
+   * Persisted verbatim rather than computed locally. The server anchors it on
+   * the last DELIVERED digest, so a report held by the cooldown — or one whose
+   * send failed — correctly leaves the watermark where it was, and its findings
+   * turn up in the next digest instead of falling into a gap. A machine that
+   * lost `machine.json` also resyncs here rather than re-reporting from the
+   * beginning of time.
+   */
+  next_window_from: string;
+}
+
+/**
+ * Submit one scheduled scan's harmful findings.
+ *
+ * Called only by the audit child, and only on `--scheduled`. The destination
+ * address is never sent: the api-server takes it from the access-token claims,
+ * so a report cannot name where its digest goes.
+ */
+export async function submitAuditReport(
+  accessToken: string,
+  body: AuditReportBody,
+): Promise<AuditReportResult> {
+  return postJson<AuditReportResult>("/v0/audit-reports", body, { accessToken });
+}
+
 interface JwtClaims {
   sub: string;
   email: string;

package/.next/standalone/lib/auth/auth-store.ts

@@ -1,16 +1,17 @@
 /**
- * Persistence layer for the FailproofAI auth.json file.
+ * Persistence layer for the signed-in session.
  *
- * Tokens live at ~/.failproofai/auth.json with mode 0600. The dashboard's
- * Next.js API routes read and write through here, so a session survives across
- * dashboard runs.
+ * Tokens live at `~/.failproofai/audit/session.json` with mode 0600 (layout 4;
+ * `auth.json` at the home root before that). The dashboard's Next.js API routes
+ * and the audit child both read and write through here, so a session survives
+ * across dashboard runs and is the same one a scheduled report uses.
  */
 
-import { existsSync, readFileSync, rmSync } from "node:fs";
-import { join } from "node:path";
+import { existsSync, readFileSync, readdirSync, rmSync } from "node:fs";
+import { join, resolve } from "node:path";
 
 import { writeJsonAtomically } from "../atomic-write";
-import { failproofaiHome } from "../../src/hooks/fp-home";
+import { auditDir, auditSessionFile, migrationsDir } from "../../src/hooks/fp-home";
 import {
   AuthApiError,
   decodeJwt,
@@ -27,62 +28,24 @@ export interface StoredAuth {
   user: { id: string; email: string };
 }
 
+/**
+ * Where the session file lives.
+ *
+ * `FAILPROOFAI_AUTH_DIR` overrides it OUTRIGHT — the override names the
+ * directory the two files sit in directly, with no `audit/` beneath it, which is
+ * the contract it has always had and what every test using it expects. Without
+ * the override the paths come from `fp-home.ts`, which as of layout 4 puts them
+ * under `audit/` with the rest of what the audit owns.
+ */
 export function getAuthDir(): string {
   const override = process.env.FAILPROOFAI_AUTH_DIR;
   if (override) return override;
-  return failproofaiHome();
+  return auditDir();
 }
 
 export function getAuthFilePath(): string {
-  return join(getAuthDir(), "auth.json");
-}
-
-/** Location of the persisted re-audit reminder (separate from auth.json so
- *  the reminder survives unrelated session refreshes). */
-export function getReminderFilePath(): string {
-  return join(getAuthDir(), "next-audit.json");
-}
-
-export interface StoredReminder {
-  /** Unix seconds. */
-  next_audit_at: number;
-  /** Email the reminder was set for. Used to invalidate the reminder if the
-   *  active session belongs to a different user. */
-  user_email: string;
-  /** Unix seconds. */
-  set_at: number;
-}
-
-export function readReminder(): StoredReminder | null {
-  const p = getReminderFilePath();
-  if (!existsSync(p)) return null;
-  try {
-    const raw = readFileSync(p, "utf-8");
-    const parsed = JSON.parse(raw) as Partial<StoredReminder>;
-    if (
-      typeof parsed.next_audit_at !== "number" ||
-      typeof parsed.user_email !== "string" ||
-      typeof parsed.set_at !== "number"
-    ) {
-      return null;
-    }
-    return {
-      next_audit_at: parsed.next_audit_at,
-      user_email: parsed.user_email,
-      set_at: parsed.set_at,
-    };
-  } catch {
-    return null;
-  }
-}
-
-export function writeReminder(reminder: StoredReminder): void {
-  writeJsonAtomically(getReminderFilePath(), reminder);
-}
-
-export function deleteReminder(): void {
-  const p = getReminderFilePath();
-  if (existsSync(p)) rmSync(p, { force: true });
+  const override = process.env.FAILPROOFAI_AUTH_DIR;
+  return override ? join(override, "session.json") : auditSessionFile();
 }
 
 export function readAuth(): StoredAuth | null {
@@ -127,6 +90,28 @@ export function writeAuth(auth: StoredAuth): void {
 export function deleteAuth(): void {
   const p = getAuthFilePath();
   if (existsSync(p)) rmSync(p, { force: true });
+
+  // Also any copy a migration took and could not clean up.
+  //
+  // The layout-4 step backs `auth.json` up before moving it, and a chain that
+  // FAILED deliberately keeps that copy — it is the only insurance against a
+  // half-moved credential. But "sign me out" has to mean the token is off this
+  // machine, and `migrationsDir` is classed `identity`, so nothing else will
+  // ever remove it: without this sweep a dashboard sign-out, a 401 auto-delete
+  // and `failproofai reset` all left a live bearer and refresh token on disk,
+  // to be carried into every dotfile backup and container image after it.
+  try {
+    const root = migrationsDir();
+    if (!existsSync(root)) return;
+    for (const entry of readdirSync(root)) {
+      if (!entry.startsWith("backup-layout")) continue;
+      const copy = resolve(root, entry, "auth.json");
+      if (existsSync(copy)) rmSync(copy, { force: true });
+    }
+  } catch {
+    // Sign-out must succeed even if the sweep cannot. The live token — the one
+    // that actually authenticates a request — is already gone above.
+  }
 }
 
 /** Convert verify/refresh response into the on-disk shape. */
@@ -161,8 +146,8 @@ const REFRESH_LEEWAY_SECS = 60;
 
 /**
  * In-flight refresh dedup. Without this, two concurrent callers (e.g.
- * the dashboard's `/api/auth/status` poll and a `/api/auth/reminder`
- * POST in flight) both observe the same expired access token, both call
+ * the dashboard's `/api/auth/status` poll and a scheduled audit's report
+ * in flight) both observe the same expired access token, both call
  * `refreshAccessToken(auth.refresh_token)` with the same refresh token,
  * and the api-server treats the second call as token-replay and revokes
  * every session for that user — a silent logout. Keying on the refresh