failproofai 1.0.1-beta.1 → 1.0.2-beta.0

package/.next/standalone/server.js

@@ -9,7 +9,7 @@ const currentPort = parseInt(process.env.PORT, 10) || 3000
 const hostname = process.env.HOSTNAME || '0.0.0.0'
 
 let keepAliveTimeout = parseInt(process.env.KEEP_ALIVE_TIMEOUT, 10)
-const nextConfig = {"env":{"NEXT_PUBLIC_APP_VERSION":"1.0.1-beta.1"},"typescript":{"ignoreBuildErrors":false},"typedRoutes":false,"distDir":"./.next","cleanDistDir":true,"assetPrefix":"","cacheMaxMemorySize":52428800,"configOrigin":"next.config.ts","useFileSystemPublicRoutes":true,"generateEtags":true,"pageExtensions":["tsx","ts","jsx","js"],"instrumentationClientInject":[],"poweredByHeader":true,"compress":true,"images":{"deviceSizes":[640,750,828,1080,1200,1920,2048,3840],"imageSizes":[32,48,64,96,128,256,384],"path":"/_next/image","loader":"default","loaderFile":"","domains":[],"disableStaticImages":false,"minimumCacheTTL":14400,"formats":["image/webp"],"maximumRedirects":3,"maximumResponseBody":50000000,"dangerouslyAllowLocalIP":false,"dangerouslyAllowSVG":false,"contentSecurityPolicy":"script-src 'none'; frame-src 'none'; sandbox;","contentDispositionType":"attachment","localPatterns":[{"pathname":"**","search":""}],"remotePatterns":[],"qualities":[75],"unoptimized":true,"customCacheHandler":false},"devIndicators":{"position":"bottom-left"},"onDemandEntries":{"maxInactiveAge":60000,"pagesBufferLength":5},"basePath":"","sassOptions":{},"trailingSlash":false,"i18n":null,"productionBrowserSourceMaps":false,"excludeDefaultMomentLocales":true,"reactProductionProfiling":false,"reactStrictMode":null,"reactMaxHeadersLength":6000,"httpAgentOptions":{"keepAlive":true},"logging":{"serverFunctions":true,"browserToTerminal":"warn"},"compiler":{},"expireTime":31536000,"staticPageGenerationTimeout":60,"output":"standalone","modularizeImports":{"@mui/icons-material":{"transform":"@mui/icons-material/{{member}}"},"lodash":{"transform":"lodash/{{member}}"}},"outputFileTracingRoot":"/home/runner/work/failproofai/failproofai","enablePrerenderSourceMaps":true,"cacheComponents":false,"cacheLife":{"default":{"stale":300,"revalidate":900,"expire":4294967294},"seconds":{"stale":30,"revalidate":1,"expire":60},"minutes":{"stale":300,"revalidate":60,"expire":3600},"hours":{"stale":300,"revalidate":3600,"expire":86400},"days":{"stale":300,"revalidate":86400,"expire":604800},"weeks":{"stale":300,"revalidate":604800,"expire":2592000},"max":{"stale":300,"revalidate":2592000,"expire":31536000}},"cacheHandlers":{},"experimental":{"appNewScrollHandler":true,"coldCacheBadge":false,"devValidationWorker":true,"useSkewCookie":false,"cssChunking":true,"multiZoneDraftMode":false,"appNavFailHandling":false,"prerenderEarlyExit":true,"serverMinification":true,"linkNoTouchStart":false,"caseSensitiveRoutes":false,"cachedNavigations":false,"dynamicOnHover":false,"useOffline":false,"varyParams":true,"optimisticRouting":true,"instrumentationClientRouterTransitionEvents":false,"prefetchInlining":{"maxSize":2048,"maxBundleSize":10240},"preloadEntriesOnStart":true,"clientRouterFilter":true,"clientRouterFilterRedirects":false,"fetchCacheKeyPrefix":"","proxyPrefetch":"flexible","optimisticClientCache":true,"manualClientBasePath":false,"cpus":3,"memoryBasedWorkersCount":false,"imgOptConcurrency":null,"imgOptOperationCache":null,"imgOptTimeoutInSeconds":7,"imgOptMaxInputPixels":268402689,"imgOptSequentialRead":null,"isrFlushToDisk":true,"workerThreads":false,"optimizeCss":false,"nextScriptWorkers":false,"scrollRestoration":false,"externalDir":false,"devMemoryThresholdRestart":true,"disableOptimizedLoading":false,"gzipSize":true,"craCompat":false,"esmExternals":true,"fullySpecified":false,"swcTraceProfiling":false,"forceSwcTransforms":false,"requestInsights":false,"largePageDataBytes":128000,"typedEnv":false,"parallelServerCompiles":false,"parallelServerBuildTraces":false,"ppr":false,"authInterrupts":false,"webpackMemoryOptimizations":false,"optimizeServerReact":true,"strictRouteTypes":false,"useTypeScriptCli":true,"removeUncaughtErrorAndRejectionListeners":false,"validateRSCRequestHeaders":true,"staleTimes":{"dynamic":0,"static":300},"reactDebugChannel":true,"serverComponentsHmrCache":true,"serverComponentsHmrCancellation":false,"staticGenerationMaxConcurrency":8,"staticGenerationMinPagesPerWorker":25,"transitionIndicator":false,"gestureTransition":false,"inlineCss":false,"useCache":false,"globalNotFound":false,"browserDebugInfoInTerminal":"warn","lockDistDir":true,"proxyClientMaxBodySize":10485760,"hideLogsAfterAbort":false,"mcpServer":true,"turbopackFileSystemCacheForDev":true,"turbopackFileSystemCacheForBuild":true,"turbopackInferModuleSideEffects":true,"turbopackPluginRuntimeStrategy":"childProcesses","turbopackMemoryEvictionMode":"auto","optimizePackageImports":["lucide-react","date-fns","lodash-es","ramda","antd","react-bootstrap","ahooks","@ant-design/icons","@headlessui/react","@headlessui-float/react","@heroicons/react/20/solid","@heroicons/react/24/solid","@heroicons/react/24/outline","@visx/visx","@tremor/react","rxjs","@mui/material","@mui/icons-material","recharts","react-use","effect","@effect/schema","@effect/platform","@effect/platform-node","@effect/platform-browser","@effect/platform-bun","@effect/sql","@effect/sql-mssql","@effect/sql-mysql2","@effect/sql-pg","@effect/sql-sqlite-node","@effect/sql-sqlite-bun","@effect/sql-sqlite-wasm","@effect/sql-sqlite-react-native","@effect/rpc","@effect/rpc-http","@effect/typeclass","@effect/experimental","@effect/opentelemetry","@material-ui/core","@material-ui/icons","@tabler/icons-react","mui-core","react-icons/ai","react-icons/bi","react-icons/bs","react-icons/cg","react-icons/ci","react-icons/di","react-icons/fa","react-icons/fa6","react-icons/fc","react-icons/fi","react-icons/gi","react-icons/go","react-icons/gr","react-icons/hi","react-icons/hi2","react-icons/im","react-icons/io","react-icons/io5","react-icons/lia","react-icons/lib","react-icons/lu","react-icons/md","react-icons/pi","react-icons/ri","react-icons/rx","react-icons/si","react-icons/sl","react-icons/tb","react-icons/tfi","react-icons/ti","react-icons/vsc","react-icons/wi"],"useCacheTimeout":54,"instantInsights":{"validationLevel":"warning"},"trustHostHeader":false,"isExperimentalCompile":false},"htmlLimitedBots":"[\\w-]+-Google|Google-[\\w-]+|Chrome-Lighthouse|Slurp|DuckDuckBot|baiduspider|yandex|sogou|bitlybot|tumblr|vkShare|quora link preview|redditbot|ia_archiver|Bingbot|BingPreview|applebot|facebookexternalhit|facebookcatalog|Twitterbot|LinkedInBot|Slackbot|Discordbot|WhatsApp|SkypeUriPreview|Yeti|googleweblight","bundlePagesRouterDependencies":false,"configFileName":"next.config.ts","outputFileTracingExcludes":{"*":["node_modules/@img/**","node_modules/sharp/**"]},"turbopack":{"root":"/home/runner/work/failproofai/failproofai"},"repoRoot":"/home/runner/work/failproofai/failproofai","distDirRoot":".next"}
+const nextConfig = {"env":{"NEXT_PUBLIC_APP_VERSION":"1.0.2-beta.0"},"typescript":{"ignoreBuildErrors":false},"typedRoutes":false,"distDir":"./.next","cleanDistDir":true,"assetPrefix":"","cacheMaxMemorySize":52428800,"configOrigin":"next.config.ts","useFileSystemPublicRoutes":true,"generateEtags":true,"pageExtensions":["tsx","ts","jsx","js"],"instrumentationClientInject":[],"poweredByHeader":true,"compress":true,"images":{"deviceSizes":[640,750,828,1080,1200,1920,2048,3840],"imageSizes":[32,48,64,96,128,256,384],"path":"/_next/image","loader":"default","loaderFile":"","domains":[],"disableStaticImages":false,"minimumCacheTTL":14400,"formats":["image/webp"],"maximumRedirects":3,"maximumResponseBody":50000000,"dangerouslyAllowLocalIP":false,"dangerouslyAllowSVG":false,"contentSecurityPolicy":"script-src 'none'; frame-src 'none'; sandbox;","contentDispositionType":"attachment","localPatterns":[{"pathname":"**","search":""}],"remotePatterns":[],"qualities":[75],"unoptimized":true,"customCacheHandler":false},"devIndicators":{"position":"bottom-left"},"onDemandEntries":{"maxInactiveAge":60000,"pagesBufferLength":5},"basePath":"","sassOptions":{},"trailingSlash":false,"i18n":null,"productionBrowserSourceMaps":false,"excludeDefaultMomentLocales":true,"reactProductionProfiling":false,"reactStrictMode":null,"reactMaxHeadersLength":6000,"httpAgentOptions":{"keepAlive":true},"logging":{"serverFunctions":true,"browserToTerminal":"warn"},"compiler":{},"expireTime":31536000,"staticPageGenerationTimeout":60,"output":"standalone","modularizeImports":{"@mui/icons-material":{"transform":"@mui/icons-material/{{member}}"},"lodash":{"transform":"lodash/{{member}}"}},"outputFileTracingRoot":"/home/runner/work/failproofai/failproofai","enablePrerenderSourceMaps":true,"cacheComponents":false,"cacheLife":{"default":{"stale":300,"revalidate":900,"expire":4294967294},"seconds":{"stale":30,"revalidate":1,"expire":60},"minutes":{"stale":300,"revalidate":60,"expire":3600},"hours":{"stale":300,"revalidate":3600,"expire":86400},"days":{"stale":300,"revalidate":86400,"expire":604800},"weeks":{"stale":300,"revalidate":604800,"expire":2592000},"max":{"stale":300,"revalidate":2592000,"expire":31536000}},"cacheHandlers":{},"experimental":{"appNewScrollHandler":true,"coldCacheBadge":false,"devValidationWorker":true,"useSkewCookie":false,"cssChunking":true,"multiZoneDraftMode":false,"appNavFailHandling":false,"prerenderEarlyExit":true,"serverMinification":true,"linkNoTouchStart":false,"caseSensitiveRoutes":false,"cachedNavigations":false,"dynamicOnHover":false,"useOffline":false,"varyParams":true,"optimisticRouting":true,"instrumentationClientRouterTransitionEvents":false,"prefetchInlining":{"maxSize":2048,"maxBundleSize":10240},"preloadEntriesOnStart":true,"clientRouterFilter":true,"clientRouterFilterRedirects":false,"fetchCacheKeyPrefix":"","proxyPrefetch":"flexible","optimisticClientCache":true,"manualClientBasePath":false,"cpus":3,"memoryBasedWorkersCount":false,"imgOptConcurrency":null,"imgOptOperationCache":null,"imgOptTimeoutInSeconds":7,"imgOptMaxInputPixels":268402689,"imgOptSequentialRead":null,"isrFlushToDisk":true,"workerThreads":false,"optimizeCss":false,"nextScriptWorkers":false,"scrollRestoration":false,"externalDir":false,"devMemoryThresholdRestart":true,"disableOptimizedLoading":false,"gzipSize":true,"craCompat":false,"esmExternals":true,"fullySpecified":false,"swcTraceProfiling":false,"forceSwcTransforms":false,"requestInsights":false,"largePageDataBytes":128000,"typedEnv":false,"parallelServerCompiles":false,"parallelServerBuildTraces":false,"ppr":false,"authInterrupts":false,"webpackMemoryOptimizations":false,"optimizeServerReact":true,"strictRouteTypes":false,"useTypeScriptCli":true,"removeUncaughtErrorAndRejectionListeners":false,"validateRSCRequestHeaders":true,"staleTimes":{"dynamic":0,"static":300},"reactDebugChannel":true,"serverComponentsHmrCache":true,"serverComponentsHmrCancellation":false,"staticGenerationMaxConcurrency":8,"staticGenerationMinPagesPerWorker":25,"transitionIndicator":false,"gestureTransition":false,"inlineCss":false,"useCache":false,"globalNotFound":false,"browserDebugInfoInTerminal":"warn","lockDistDir":true,"proxyClientMaxBodySize":10485760,"hideLogsAfterAbort":false,"mcpServer":true,"turbopackFileSystemCacheForDev":true,"turbopackFileSystemCacheForBuild":true,"turbopackInferModuleSideEffects":true,"turbopackPluginRuntimeStrategy":"childProcesses","turbopackMemoryEvictionMode":"auto","optimizePackageImports":["lucide-react","date-fns","lodash-es","ramda","antd","react-bootstrap","ahooks","@ant-design/icons","@headlessui/react","@headlessui-float/react","@heroicons/react/20/solid","@heroicons/react/24/solid","@heroicons/react/24/outline","@visx/visx","@tremor/react","rxjs","@mui/material","@mui/icons-material","recharts","react-use","effect","@effect/schema","@effect/platform","@effect/platform-node","@effect/platform-browser","@effect/platform-bun","@effect/sql","@effect/sql-mssql","@effect/sql-mysql2","@effect/sql-pg","@effect/sql-sqlite-node","@effect/sql-sqlite-bun","@effect/sql-sqlite-wasm","@effect/sql-sqlite-react-native","@effect/rpc","@effect/rpc-http","@effect/typeclass","@effect/experimental","@effect/opentelemetry","@material-ui/core","@material-ui/icons","@tabler/icons-react","mui-core","react-icons/ai","react-icons/bi","react-icons/bs","react-icons/cg","react-icons/ci","react-icons/di","react-icons/fa","react-icons/fa6","react-icons/fc","react-icons/fi","react-icons/gi","react-icons/go","react-icons/gr","react-icons/hi","react-icons/hi2","react-icons/im","react-icons/io","react-icons/io5","react-icons/lia","react-icons/lib","react-icons/lu","react-icons/md","react-icons/pi","react-icons/ri","react-icons/rx","react-icons/si","react-icons/sl","react-icons/tb","react-icons/tfi","react-icons/ti","react-icons/vsc","react-icons/wi"],"useCacheTimeout":54,"instantInsights":{"validationLevel":"warning"},"trustHostHeader":false,"isExperimentalCompile":false},"htmlLimitedBots":"[\\w-]+-Google|Google-[\\w-]+|Chrome-Lighthouse|Slurp|DuckDuckBot|baiduspider|yandex|sogou|bitlybot|tumblr|vkShare|quora link preview|redditbot|ia_archiver|Bingbot|BingPreview|applebot|facebookexternalhit|facebookcatalog|Twitterbot|LinkedInBot|Slackbot|Discordbot|WhatsApp|SkypeUriPreview|Yeti|googleweblight","bundlePagesRouterDependencies":false,"configFileName":"next.config.ts","outputFileTracingExcludes":{"*":["node_modules/@img/**","node_modules/sharp/**"]},"turbopack":{"root":"/home/runner/work/failproofai/failproofai"},"repoRoot":"/home/runner/work/failproofai/failproofai","distDirRoot":".next"}
 
 process.env.__NEXT_PRIVATE_STANDALONE_CONFIG = JSON.stringify(nextConfig)
 

package/README.md

@@ -2,18 +2,23 @@
 
 <img src="https://d2wq11aau0arks.cloudfront.net/failproof/fa_updated_full.svg" alt="failproof ai" width="220" />
 
+<a href="https://trendshift.io/repositories/69722?utm_source=trendshift-badge&amp;utm_medium=badge&amp;utm_campaign=badge-trendshift-69722" target="_blank" rel="noopener noreferrer"><img src="https://trendshift.io/api/badge/trendshift/repositories/69722/daily?language=TypeScript" alt="FailproofAI%2Ffailproofai | Trendshift" width="250" height="55"/></a>
+
 [![npm](https://img.shields.io/npm/v/failproofai?style=flat-square&color=CB3837)](https://www.npmjs.com/package/failproofai)
 [![CI](https://img.shields.io/github/actions/workflow/status/failproofai/failproofai/ci.yml?branch=main&style=flat-square&label=CI)](https://github.com/failproofai/failproofai/actions)
 [![Supply Chain](https://img.shields.io/badge/supply%20chain-secure-brightgreen?style=flat-square)](https://github.com/failproofai/failproofai/actions/workflows/osv-scanner.yml)
 [![Discord](https://img.shields.io/badge/Discord-join%20us-5865F2?style=flat-square&logo=discord)](https://discord.befailproof.ai/)
-[![Docs](https://img.shields.io/badge/docs-befailproof.ai-002CA7?style=flat-square)](https://docs.befailproof.ai/introduction)
+[![Reddit](https://img.shields.io/badge/Reddit-r%2Ffailproofai-FF4500?style=flat-square&logo=reddit)](https://www.reddit.com/r/failproofai/)
+[![Docs](https://img.shields.io/badge/docs-befailproof.ai-002CA7?style=flat-square)](https://docs.befailproof.ai/)
 [![License](https://img.shields.io/badge/license-MIT%20%2B%20Commons%20Clause-blue?style=flat-square)](./LICENSE)
 
 **Translations:** [简体中文](./docs/i18n/README.zh.md) · [日本語](./docs/i18n/README.ja.md) · [한국어](./docs/i18n/README.ko.md) · [Español](./docs/i18n/README.es.md) · [Português](./docs/i18n/README.pt-br.md) · [Deutsch](./docs/i18n/README.de.md) · [Français](./docs/i18n/README.fr.md) · [Русский](./docs/i18n/README.ru.md) · [हिन्दी](./docs/i18n/README.hi.md) · [Türkçe](./docs/i18n/README.tr.md) · [Tiếng Việt](./docs/i18n/README.vi.md) · [Italiano](./docs/i18n/README.it.md) · [العربية](./docs/i18n/README.ar.md) · [עברית](./docs/i18n/README.he.md)
 
-**Runtime failure resolution for coding agents.**
-Hooks into Claude Code and Codex. Catches loops, dangerous actions, and secret leaks
-before they become incidents. Zero latency. Runs locally.
+**Observability and enforcement for every harness your agents run in.**
+Wherever your agents run, we see it — and we can say no. Failproof hooks 12 agent
+harnesses — coding CLIs like Claude Code and Codex, chat gateways like Hermes,
+self-hosted assistants like OpenClaw — capturing every run and blocking dangerous
+tool calls before they execute. 39 built-in policies. Zero latency. Runs locally.
 
 </div>
 
@@ -23,7 +28,15 @@ before they become incidents. Zero latency. Runs locally.
 
 ---
 
-## Supported agent CLIs
+## Supported harnesses
+
+Twelve harnesses in two classes — ten coding CLIs, and two chat and assistant
+gateways (Hermes, OpenClaw). Same events, same policies, same session history,
+whichever one your agent runs in.
+
+Agents that run in none of them report through the [Python SDK](https://docs.befailproof.ai/reference/custom-agents),
+which gives you tracing, sessions and audits. Enforcement there needs a hook in
+your own runtime — [talk to us](mailto:support@befailproof.ai) and we'll map it.
 
 <!-- A 6-column table instead of inline <img> runs: table columns never re-wrap,
      so the grid stays 2×6 at any window width (scrolling on very narrow screens
@@ -127,7 +140,7 @@ failproofai policies --install   # or just run `failproofai` and accept the firs
 failproofai
 ```
 
-30 built-in policies activate immediately. Dashboard at `localhost:8020`. Disable the first-run prompt with `FAILPROOFAI_NO_FIRST_RUN=1`.
+39 built-in policies activate immediately. Dashboard at `localhost:8020`. Disable the first-run prompt with `FAILPROOFAI_NO_FIRST_RUN=1`.
 
 ---
 
@@ -135,13 +148,19 @@ failproofai
 
 | Policy | What it blocks |
 |---|---|
-| `block-push-master` | Direct pushes to `main` / `master` |
-| `block-force-push` | `git push --force` |
-| `block-work-on-main` | Commits, merges, rebases on `main` / `master` |
+| `sanitize-api-keys` | API keys leaking into the agent's context |
+| `block-env-files` | Reads of `.env` and other secret files |
+| `warn-repeated-tool-calls` | The agent looping on the same call |
+| `block-sudo` | Privilege escalation |
+| `warn-destructive-sql` | `DROP`, `TRUNCATE`, unbounded `DELETE` |
+| `block-terraform` / `block-kubectl` | Unreviewed changes to live infrastructure |
 | `block-rm-rf` | Recursive file deletion |
-| `sanitize-api-keys` | API keys leaking into agent context |
+| `block-force-push` / `block-push-master` | `git push --force`, direct pushes to `main` |
+
+The first five apply to any agent that can call a tool. The last three are the
+developer favourites — coding CLIs are the harness class we cover deepest.
 
-→ [All 30 built-in policies](https://docs.befailproof.ai/built-in-policies)
+→ [All 39 built-in policies](https://docs.befailproof.ai/policies/builtin)
 
 ---
 
@@ -172,28 +191,65 @@ Three decisions available to every policy:
 | `deny(message)` | Block it — message goes back to the agent |
 | `instruct(message)` | Let it through, but add context to the agent's next prompt |
 
-→ [Custom policies guide](https://docs.befailproof.ai/custom-policies)
+→ [Custom policies guide](https://docs.befailproof.ai/policies/custom)
 
 ---
 
-## Session visibility
+## Observability
+
+Enforcement is one half. The other half is seeing what the agent actually did.
+
+Run `failproofai` with no arguments and it serves a dashboard on `localhost:8020`
+reading the run history already on your machine — no account, no signup, nothing
+leaving the box. You get the session list, the sequence of model calls, tool calls
+and hook decisions inside each run, what was blocked and what the policy told the
+agent, and an offline audit (`failproofai audit`) that scans your history for risky
+patterns and suggests policies to stop them.
+
+→ [Local dashboard](https://docs.befailproof.ai/reference/local-dashboard) ·
+[Read a trace](https://docs.befailproof.ai/sessions/read-a-trace) ·
+[Local audit](https://docs.befailproof.ai/audits/local-audit)
 
-Every tool call your agent makes is logged locally. The dashboard shows what ran,
-what was blocked, and what the policy told the agent — so you're not guessing
-when something goes wrong. → [Dashboard guide](https://docs.befailproof.ai/dashboard)
+**Failproof AI Observability** is the hosted side of the same data model, for teams
+running agents across a fleet: every run from every harness in one place, an
+execution graph with parallel sub-agents on their own lanes, p50/p95/p99 latency
+for models, tools and hooks, per-model cost and context-window tracking, error
+tracking, SQL over your own traces with shareable dashboards, evaluations scored by
+your own service, scheduled audits that turn recurring failures into evidence-backed
+findings, and alerts routed to Slack, email or a signed webhook. Self-hosting in your
+own cluster is available on the Enterprise plan.
+
+→ [Sessions](https://docs.befailproof.ai/sessions/overview) ·
+[Audits](https://docs.befailproof.ai/audits/overview) ·
+[Book a demo](https://befailproof.ai/get-a-demo)
 
 ---
 
 ## Documentation
 
-| | |
+| Start | |
+|---|---|
+| [Quickstart](https://docs.befailproof.ai/start/quickstart) | Install, connect a harness, see the first run |
+| [Concepts](https://docs.befailproof.ai/start/concepts) | How the hook system works |
+| [Supported harnesses](https://docs.befailproof.ai/reference/harnesses) | All 12, and what each one can enforce |
+
+| Observe | |
+|---|---|
+| [Sessions](https://docs.befailproof.ai/sessions/overview) | Follow a run: models, tools, errors, latency |
+| [Read a trace](https://docs.befailproof.ai/sessions/read-a-trace) | What the execution graph is telling you |
+| [Audits](https://docs.befailproof.ai/audits/overview) | Find failure patterns across many sessions |
+| [Local dashboard](https://docs.befailproof.ai/reference/local-dashboard) | `localhost:8020`, no account needed |
+
+| Enforce | |
+|---|---|
+| [Built-in policies](https://docs.befailproof.ai/policies/builtin) | All 39 policies with parameters |
+| [Custom policies](https://docs.befailproof.ai/policies/custom) | Write your own |
+| [Configuration](https://docs.befailproof.ai/policies/local-configuration) | Config scopes and merge rules |
+
+| Instrument your own agent | |
 |---|---|
-| [Getting Started](https://docs.befailproof.ai/getting-started) | Installation and first steps |
-| [Built-in Policies](https://docs.befailproof.ai/built-in-policies) | All 30 policies with parameters |
-| [Custom Policies](https://docs.befailproof.ai/custom-policies) | Write your own |
-| [Configuration](https://docs.befailproof.ai/configuration) | Config scopes and merge rules |
-| [Dashboard](https://docs.befailproof.ai/dashboard) | Session monitor and policy activity |
-| [Architecture](https://docs.befailproof.ai/architecture) | How the hook system works |
+| [Python SDK](https://docs.befailproof.ai/reference/custom-agents) | Report runs from an agent with no harness |
+| [Policy SDK](https://docs.befailproof.ai/reference/policy-sdk) | `allow` / `deny` / `instruct` reference |
 
 ---
 

package/bin/failproofai.mjs

@@ -271,7 +271,7 @@ if (hookIdx >= 0) {
  */
 async function runCli() {
   // --help / -h  (only when not inside a subcommand that handles its own --help)
-  const SUBCOMMANDS = ["policies", "policy", "audit", "config", "uninstall", "backfill", "flush", "harness"];
+  const SUBCOMMANDS = ["policies", "policy", "audit", "config", "uninstall", "backfill", "flush", "harness", "pack"];
   if ((args.includes("--help") || args.includes("-h")) && !SUBCOMMANDS.includes(args[0])) {
     const extraArgs = args.filter((a) => a !== "--help" && a !== "-h");
     if (extraArgs.length > 0) {
@@ -319,6 +319,21 @@ COMMANDS
 
   policies --help, -h            Show this help for the policies command
 
+  pack add core                  Install the Failproof AI policies — from this
+                                 package, so it needs no network.
+                                 --policy <a,b> takes only those, --category
+                                 <x,y> takes whole categories, --all takes it all
+  pack list                      Show installed policy packs
+  pack list <source>             Show what a pack CONTAINS before installing it.
+                                 Reads only its manifest — the code is never
+                                 downloaded, so looking is never running
+  pack add <source>              Install someone else's pack from a GitHub release.
+                                 <source> is acme/pack, acme/pack@v1.2.0, or a
+                                 release URL; no tag takes the newest and pins it
+  pack remove <publisher/name>   Deactivate an installed pack
+  pack build <entry.mjs>         Turn your own policy file into the three assets
+                                 a GitHub release needs, so others can install it
+  pack --help, -h                Show this help for the pack command
   harness list                   Show extra capture paths per agent CLI
   harness add-path <h> <path>    Also capture sessions from <path> for harness
                                  <h>. Accepts \`<label>=<path>\`; the label
@@ -400,6 +415,10 @@ EXAMPLES
   failproofai policies --uninstall --cli opencode
   failproofai policies --uninstall --cli pi
   failproofai policies --uninstall --custom
+  failproofai pack add core
+  failproofai pack add core --category git,database
+  failproofai pack list acme/support-agent
+  failproofai pack build ./my-policies.mjs --id acme/support --version 1.0.0
   failproofai backfill --since 6m
   failproofai backfill --dry-run
   failproofai flush --wait
@@ -409,6 +428,7 @@ LINKS
   ⭐ Star us:      https://github.com/failproofai/failproofai
   📖 Docs:         https://docs.befailproof.ai/introduction
   💬 Discord:      https://discord.befailproof.ai/
+  👽 Reddit:       https://www.reddit.com/r/failproofai/
 `.trimStart());
     process.exit(0);
   }
@@ -697,6 +717,88 @@ OPTIONS
   // nothing else — no root, no daemon call — so it works on a machine whose
   // daemon is stopped, which is when someone is most likely to be fixing what
   // it captures.
+  // pack list | add | remove
+  //
+  // Policies that did not ship compiled into this build. Fetches over the
+  // network, so it is a CLI command only and is never reachable from the hook
+  // path.
+  if (args[0] === "pack") {
+    const subArgs = args.slice(1);
+    if (subArgs.includes("--help") || subArgs.includes("-h")) {
+      console.log(`
+failproofai pack — install policy packs published as GitHub releases
+
+Usage:
+  failproofai pack add core                     the Failproof AI policies
+  failproofai pack add core --policy <a,b>      just these
+  failproofai pack add core --category <x,y>    whole categories
+  failproofai pack add core --all               everything in it
+  failproofai pack list                         packs installed here
+  failproofai pack list <source>                what a pack out there contains
+  failproofai pack add <source> [--policy <a,b>] [--category <x,y>] [--all]
+  failproofai pack remove <publisher/name>
+  failproofai pack build <entry.mjs> --id <publisher/name> --version <v>
+
+A pack is one entry artifact plus a manifest, verified against the release's
+SHA256SUMS at install time. The digest is recorded, and re-verified before every
+import — so a pack cannot change under this machine after you installed it.
+
+<source> is core for the Failproof AI policies, or any of these:
+  acme/support-agent                 newest release, pinned to its exact tag
+  acme/support-agent@v2.1.0          that release
+  github:acme/support-agent@v2.1.0   same, explicit
+  https://github.com/acme/support-agent/releases/tag/v2.1.0
+
+Naming no tag installs the newest release AND pins it, so what gets recorded
+always names one version — running the same command later can install something
+different, and it will tell you the tag it chose.
+
+By default you get the pack's OWN defaults — the policies its author marked
+safe to switch on unattended — not everything it contains. Take more, or less:
+
+  --category x,y  Take whole categories (see: failproofai pack list)
+  --only a,b      Take exactly these policies
+  --all           Take everything the pack contains
+
+Re-adding at a newer version keeps whatever you chose rather than switching the
+rest back on.
+
+Examples:
+  failproofai pack add FailproofAI/policies
+  failproofai pack add core --category sanitize,git
+  failproofai pack add github:acme/support-agent@v2.1.0 --only block-refunds
+  failproofai pack remove acme/support-agent
+
+Publishing: pack build writes failproofai-pack.json, failproofai-pack.mjs and
+SHA256SUMS. Attach all three to a GitHub release; anyone then runs
+failproofai pack add <owner>/<repo>
+
+Offline: FAILPROOFAI_NO_DOWNLOAD=1 refuses to fetch, while packs already
+installed keep enforcing. FAILPROOFAI_PACK_BASE_URL points the whole thing at a
+mirror instead of github.com.
+`.trimStart());
+      process.exit(0);
+    }
+
+    lastSubcommand = "pack";
+    const { runPackCommand } = await import("../src/hooks/pack-cli");
+    const result = await runPackCommand(subArgs);
+    for (const line of result.lines) {
+      if (result.exitCode === 0) console.log(line);
+      else console.error(line);
+    }
+    await track("cli_pack", {
+      ok: result.exitCode === 0,
+      // The subcommand only — never the pack id, source or policy names. A pack
+      // source is a value the user typed, and a third-party pack name is a
+      // publisher-controlled string; we send shape, never value.
+      sub: ["list", "add", "remove"].includes(subArgs[0]) ? subArgs[0] : "unknown",
+    });
+    lastSubcommand = null;
+    await exitAfterFlush(result.exitCode);
+    return;
+  }
+
   if (args[0] === "harness") {
     const subArgs = args.slice(1);
     if (subArgs.length === 0 || subArgs.includes("--help") || subArgs.includes("-h")) {
@@ -1176,6 +1278,10 @@ EXAMPLES
   failproofai policies --uninstall --cli pi
   failproofai policies -u
   failproofai policies --uninstall --custom
+  failproofai pack add core
+  failproofai pack add core --category git,database
+  failproofai pack list acme/support-agent
+  failproofai pack build ./my-policies.mjs --id acme/support --version 1.0.0
 `.trimStart());
       process.exit(0);
     }
@@ -1709,16 +1815,44 @@ PAUSING ENFORCEMENT (one session, always time-boxed)
       // `--status` answers "what is this machine's state?", which is both
       // halves: whether enforcement is paused AND whether cloud is connected.
       if (wantsStatus) {
-        const { connectionStatusLines } = await import("../src/hooks/cloud-enrollment-cli");
-        for (const line of connectionStatusLines()) console.log(line);
-        // Always printed, including where reports can never work: "why am I
-        // not getting them?" is the question --status exists to answer, and an
-        // omitted line answers it with silence.
-        console.log("");
-      }
-      for (const line of result.lines) {
-        if (result.exitCode === 0) console.log(line);
-        else console.error(line);
+        const { connectionStatusReport, versionStatusLines } = await import(
+          "../src/hooks/cloud-enrollment-cli"
+        );
+        const { optsFor, printBlock, rows, stack, title, warning } = await import(
+          "../src/hooks/tui"
+        );
+        const opts = optsFor(process.stdout);
+        const report = connectionStatusReport();
+        // The version line was written to be "the only place a user can find out
+        // which daemon they are running" and then never called from anywhere. It
+        // is the right thing for the heading to carry, and it retires a heading
+        // that would otherwise have said the word "status" back to someone who
+        // just typed it.
+        printBlock(
+          process.stdout,
+          stack(
+            title("failproofai config", versionStatusLines()[0], opts),
+            // ONE rows() call over both blocks, so the connection facts and the
+            // enforcement state share a label column. Rendered separately they
+            // computed one column each and the window read as two commands'
+            // output stacked up.
+            //
+            // Always printed, including where reports can never work: "why am I
+            // not getting them?" is the question --status exists to answer, and
+            // an omitted line answers it with silence.
+            rows([...report.rows, ...(result.rows ?? [])], opts),
+            report.warnings.length > 0 ? warning(report.warnings, opts) : null,
+            // The trailer is not rows — it is the note and the resume command.
+            // Rendering only `rows` dropped the one line that tells a paused
+            // user how to get unpaused.
+            result.rows ? (result.trailer ?? null) : result.lines,
+          ),
+        );
+      } else {
+        for (const line of result.lines) {
+          if (result.exitCode === 0) console.log(line);
+          else console.error(line);
+        }
       }
       await track("cli_pause_invoked", {
         action: pauseIdx >= 0 ? "pause" : wantsResume ? "resume" : "status",