failproofai 1.0.1 → 1.0.2-beta.0

package/src/hooks/handler.ts

@@ -43,6 +43,8 @@ import { getInstanceId } from "../../lib/telemetry-id";
 import { hookLogInfo, hookLogWarn } from "./hook-logger";
 import { readStdinPayload } from "./read-stdin";
 import { readActiveCloudManagedPolicies, type CloudManagedPolicyArtifact } from "./cloud-managed-policies";
+import { hasInstalledPacks, readInstalledPacks, type PackError, type ResolvedPack } from "./pack-manifest";
+import { missingGuards, packFailureReason } from "./pack-failclosed";
 import { readActivePause, type ActivePause } from "./session-pause";
 import { layoutWarningForHook } from "./fp-reset";
 
@@ -255,13 +257,23 @@ export async function evaluateHookEvent(
     /** Registered policy name → where it came from. See the set() below. */
     const policyAttribution = new Map<
       string,
-      { source: "custom" | "convention" | "cloud"; cloudPolicyId?: string; cloudVersion?: number }
+      {
+        source: "custom" | "convention" | "cloud" | "pack";
+        cloudPolicyId?: string;
+        cloudVersion?: number;
+        packId?: string;
+        packVersion?: string;
+      }
     >();
     let cloudDeployment: number | undefined;
+    /** Policy names each pack actually got registered, for the fail-closed check. */
+    const registeredByPack = new Map<string, Set<string>>();
+    let packErrors: PackError[] = [];
     /** What observe-mode policies WOULD have done, had they been enforcing. */
     const observedResults: Array<{
       policyId: string;
-      version: number;
+      /** A cloud deployment counts; a pack carries a version STRING. */
+      version: string | number;
       decision: "deny" | "instruct";
       reason: string | null;
     }> = [];
@@ -290,7 +302,34 @@ export async function evaluateHookEvent(
       // already exempts them: a locally-issued command that could switch off a
       // centrally assigned policy would make cloud enforcement decorative.
       activePause = readActivePause(session.sessionId);
-      registerBuiltinPolicies(activePause ? [] : config.enabledPolicies);
+      // Enforcement comes from PACKS now. What still registers from this build is
+      // the always-on self-protection guard, and nothing else: a pack may not
+      // declare `alwaysOn` — a downloaded file that no local command can switch
+      // off is the thing that guard exists to prevent — so it cannot travel the
+      // pack lane and has to ship compiled in.
+      //
+      // The second argument is the migration shim, not a feature. A machine that
+      // upgraded into this build has `enabledPolicies` and no pack installed
+      // yet, and it must not lose enforcement in the gap before `failproofai
+      // update` runs. It disappears for that machine the moment a pack is
+      // installed, and never fires for a machine set up by this version.
+      const packsInstalledHere = hasInstalledPacks();
+      const legacyNames =
+        activePause || packsInstalledHere ? [] : config.enabledPolicies;
+      // `alwaysOn` policies bypass the enabled set inside `registerBuiltinPolicies`,
+      // so an empty list still registers the guard — which is exactly what this
+      // build should contribute once packs carry everything else.
+      registerBuiltinPolicies(activePause ? [] : legacyNames);
+      if (legacyNames.length > 0) {
+        hookLogWarn(
+          `enforcing ${legacyNames.length} policies from this build because no pack is installed — ` +
+            `run \`failproofai update\` to move them into the pack that ships with it`,
+        );
+      }
+      // What actually registered, for the pack-duplicate check below. A paused
+      // session registers none, and then a pack twin is not a duplicate of
+      // anything — but a pause already skips every local policy, pack included.
+      const enabledBuiltinNames = new Set(legacyNames);
 
       // Cloud-managed policies are daemon-reconciled artifacts, but they use
       // the same public JS policy API as local custom policies. Verify and add
@@ -334,13 +373,31 @@ export async function evaluateHookEvent(
       // separate question from "what decided", and only the former can tell a
       // rollout that changed nothing from one that never reached the machine.
       cloudDeployment = cloudManagedPolicies[0]?.deployment;
+      // Installed packs. `readInstalledPacks` never throws: a bad manifest or a
+      // tampered artifact yields zero packs and a recorded reason, which is
+      // sound ONLY because the builtins still ship compiled in and keep
+      // enforcing underneath. See the fail-open note in pack-manifest.ts — the
+      // day builtins become a fetched pack this posture has to change with them.
+      let installedPacks: ResolvedPack[] = [];
+      try {
+        const packResult = readInstalledPacks();
+        installedPacks = packResult.packs;
+        packErrors = packResult.errors;
+        for (const err of packResult.errors) {
+          hookLogWarn(`pack ${err.id ?? "(unnamed)"} not loaded: ${err.reason}`);
+        }
+      } catch (err) {
+        hookLogWarn(`pack manifest unreadable: ${err instanceof Error ? err.message : String(err)}`);
+      }
+
       const configuredCustomPaths = config.customPoliciesPaths ?? config.customPoliciesPath;
       const allExplicitPaths =
-        cloudManagedPolicies.length === 0
+        cloudManagedPolicies.length === 0 && installedPacks.length === 0
           ? configuredCustomPaths
           : [
               ...(typeof configuredCustomPaths === "string" ? [configuredCustomPaths] : configuredCustomPaths ?? []),
               ...cloudManagedPolicies.map((policy) => policy.path),
+              ...installedPacks.map((pack) => pack.path),
             ];
 
       // Load and register custom hooks (layer 2, after builtins)
@@ -348,6 +405,7 @@ export async function evaluateHookEvent(
         sessionCwd: session.cwd,
         customPoliciesEnabled: config.customPoliciesEnabled,
         ...(cloudManagedPolicies.length > 0 ? { cloudManagedPolicies } : {}),
+        ...(installedPacks.length > 0 ? { packs: installedPacks } : {}),
       });
       customHooksList = loadResult.hooks;
       const disabledCustomPolicies = new Set(config.disabledCustomPolicies ?? []);
@@ -357,34 +415,78 @@ export async function evaluateHookEvent(
         const taggedHook = hook as CustomHook & {
           __policyId?: string;
           __cloudManaged?: CloudManagedPolicyArtifact;
+          __pack?: ResolvedPack;
         };
         const policyId = taggedHook.__policyId;
         const cloudManaged = taggedHook.__cloudManaged;
+        const pack = taggedHook.__pack;
         // Local config cannot disable a centrally assigned policy merely by
         // copying its generated ID into disabledCustomPolicies.
         if (!cloudManaged && policyId && disabledCustomPolicies.has(policyId)) continue;
         // Same rule for a session pause — it suspends local policy, never cloud.
         if (!cloudManaged && activePause) continue;
+        // A pack's artifact registers everything it contains; the user may have
+        // taken only some of it. `enabled: null` means the whole pack, which is
+        // what `pack add` writes when no selection was made.
+        if (pack?.enabled && !pack.enabled.includes(hook.name)) continue;
+        // A pack policy whose name is an ENABLED BUILTIN is the same guard
+        // twice. The two register under different keys — `failproofai/block-sudo`
+        // and `pack/<id>@<version>/block-sudo` — so nothing deduped them, and
+        // the bundled pack carries the builtins under exactly these names.
+        //
+        // A deny hides it (the first verdict short-circuits) but an INSTRUCT does
+        // not: instructions accumulate and are joined, so the agent received the
+        // identical paragraph twice. Every duplicate also ran its policy function
+        // a second time, inside its own 10s timeout race, against a 150ms daemon
+        // budget.
+        //
+        // The builtin wins, because a bare name means the builtin everywhere else
+        // — `policies --uninstall block-sudo` disables the compiled one, and a
+        // machine that wants the pack's copy instead turns the builtin off.
+        // A pack policy whose name matches one the MIGRATION SHIM registered.
+        // Only reachable on a machine that has not migrated yet and somehow has
+        // a pack too; once the shim stops, nothing else registers by name.
+        if (pack && enabledBuiltinNames.has(hook.name)) continue;
+        if (pack) {
+          const seen = registeredByPack.get(pack.id) ?? new Set<string>();
+          seen.add(hook.name);
+          registeredByPack.set(pack.id, seen);
+        }
         const hookName = hook.name;
         const conventionScope = (hook as CustomHook & { __conventionScope?: string }).__conventionScope;
         const isConvention = !!conventionScope;
+        // A pack's prefix carries its id and version, and it always contains a
+        // `/` — which is what keeps a pack policy structurally unable to
+        // normalize into the `failproofai/` namespace and REPLACE a builtin.
+        // pack-manifest.ts refuses a `/` in the declared name for the same
+        // reason; this is the second half of that guard.
         const prefix = cloudManaged
           ? `cloud/${cloudManaged.id}@${cloudManaged.version}`
-          : isConvention
-            ? `.failproofai-${conventionScope}`
-            : "custom";
+          : pack
+            ? `pack/${pack.id}@${pack.version}`
+            : isConvention
+              ? `.failproofai-${conventionScope}`
+              : "custom";
         // Observe mode: run it for real, record what it decided, then hand back
         // an allow. Evaluating and discarding is the whole point — a rollout is
         // measured against real traffic before it can break anyone's work, and
         // a policy that did not actually run would measure nothing.
-        const observeOnly = cloudManaged?.effect === "observe";
+        const observeOnly = cloudManaged?.effect === "observe" || pack?.effect === "observe";
         const fn: PolicyFunction = async (ctx): Promise<PolicyResult> => {
           if (observeOnly) {
             const shadow = await runObserved(hook, ctx, hookName, eventType, cli);
             if (shadow.decision !== "allow") {
+              // Sourced from whichever layer asked to observe. This read
+              // `cloudManaged!.id` — a non-null assertion that is simply false
+              // for a pack, so an observe-mode PACK threw on its first non-allow
+              // verdict. The throw escapes before the wrapper's own try below,
+              // so policy-evaluator swallowed it and `continue`d: nothing was
+              // recorded, the row read as a clean allow, and the rollout being
+              // trialled measured nothing while reporting healthy.
+              const observer = cloudManaged ?? pack;
               observedResults.push({
-                policyId: cloudManaged!.id,
-                version: cloudManaged!.version,
+                policyId: observer!.id,
+                version: observer!.version,
                 decision: shadow.decision,
                 reason: shadow.reason ?? null,
               });
@@ -419,8 +521,14 @@ export async function evaluateHookEvent(
         // question cloud attribution has to answer, "which rollout produced
         // this decision", could only be answered by re-parsing our own label.
         policyAttribution.set(registeredName, {
-          source: cloudManaged ? "cloud" : isConvention ? "convention" : "custom",
+          // `pack` was in scope here and simply not consulted, so every pack
+          // decision was filed as "custom" — which is also what a user's own
+          // local .mjs gets, making the two indistinguishable without
+          // re-parsing the `pack/` prefix off the display name. That re-parsing
+          // is exactly the practice these fields exist to replace.
+          source: cloudManaged ? "cloud" : pack ? "pack" : isConvention ? "convention" : "custom",
           ...(cloudManaged ? { cloudPolicyId: cloudManaged.id, cloudVersion: cloudManaged.version } : {}),
+          ...(pack ? { packId: pack.id, packVersion: pack.version } : {}),
         });
         registerPolicy(
           registeredName,
@@ -428,9 +536,69 @@ export async function evaluateHookEvent(
           fn,
           hook.match ?? {},
           -1, // Custom hooks run after builtins (priority 0)
+          // A pack declares its policies' params in its manifest, so they work
+          // exactly like a builtin's — defaults merged under whatever the user
+          // configured. Matched by the pack's own name for the policy, which is
+          // the name before the `pack/<id>@<version>/` prefix is applied.
+          pack?.policies.find((p) => p.name === hook.name)?.params,
         );
       }
 
+      // Fail closed on enforcement this machine was told it had and does not.
+      //
+      // Additive, and deliberately NOT a clearPolicies() the way the
+      // daemon-unreachable branch is: `registerBuiltinPolicies` registers the
+      // alwaysOn self-protection guard unconditionally, and clearing here would
+      // let a corrupt third-party download switch off the one policy nothing may
+      // disable.
+      //
+      // Skipped entirely under a session pause. A pause suspends local policy for
+      // a bounded, deliberate window; a check derived from registrations would
+      // fire for every pack on every paused event and convert that into a
+      // machine-wide deny — the exact inversion of what a pause is for.
+      if (!activePause) {
+        const guards = missingGuards({
+          errors: packErrors,
+          packs: installedPacks,
+          registered: registeredByPack,
+          failed: loadResult.packFailures,
+          disabled: disabledCustomPolicies,
+        });
+        if (guards.length > 0) {
+          const reason = packFailureReason(guards);
+          const match = guards.length === 1
+            ? guards[0].match
+            : {
+                events: guards.every((g) => g.match.events)
+                  ? [...new Set(guards.flatMap((g) => g.match.events ?? []))]
+                  : undefined,
+              };
+          const name = "pack/failproofai-pack-unavailable";
+          policyAttribution.set(name, {
+            source: "pack",
+            packId: guards[0].packId,
+            ...(guards[0].packVersion ? { packVersion: guards[0].packVersion } : {}),
+          });
+          registerPolicy(
+            name,
+            "A policy pack this machine enforces could not be loaded",
+            async (): Promise<PolicyResult> =>
+              // UserPromptSubmit instructs rather than denies, whatever the
+              // missing policies declared: a deny there locks the user out of
+              // their own agent, which is the one thing that stops them fixing it.
+              canonicalEventType === "UserPromptSubmit"
+                ? { decision: "instruct", reason }
+                : { decision: "deny", reason },
+            match,
+            // Above builtins (0) and custom (-1), so the short-circuit attributes
+            // the deny to the missing pack rather than to whichever surviving
+            // policy happened to fire first.
+            1,
+          );
+          hookLogWarn(reason);
+        }
+      }
+
       // Fire telemetry once per invocation for custom hook loads
       if (customHooksList.length > 0) {
         void trackHookEvent(getInstanceId(), "custom_hooks_loaded", {
@@ -501,6 +669,8 @@ export async function evaluateHookEvent(
               ...(attribution?.cloudVersion !== undefined
                 ? { cloudVersion: attribution.cloudVersion }
                 : {}),
+              ...(attribution?.packId ? { packId: attribution.packId } : {}),
+              ...(attribution?.packVersion ? { packVersion: attribution.packVersion } : {}),
             };
           })()
         : {}),

package/src/hooks/harness-cli.ts

@@ -39,6 +39,16 @@ import { homedir } from "node:os";
 import { resolve } from "node:path";
 import { readConfig, updateConfig } from "./fp-config";
 import { configFile } from "./fp-home";
+import {
+  emptyState,
+  note,
+  table,
+  optsFor,
+  rule,
+  stack,
+  title,
+  warning,
+} from "./tui";
 
 /**
  * Harness keys `collector.sources.<key>` accepts.
@@ -314,45 +324,89 @@ export function listPaths(harness?: string): HarnessResult {
     (k) => !(HARNESS_KEYS as readonly string[]).includes(k),
   );
 
+  const opts = optsFor(process.stdout);
+  const head = (extra: number) =>
+    title(
+      "failproofai harness list",
+      `${HARNESS_KEYS.length} harnesses · ${extra} extra path${extra === 1 ? "" : "s"}`,
+      opts,
+    );
+
   if (names.length === 0 && unknown.length === 0) {
-    return ok([
-      "No extra capture paths configured.",
-      "",
-      "Every harness is watching only its default location. Add one with:",
-      "  failproofai harness add-path <harness> [<label>=]<path>",
-      "",
-      `Harnesses: ${HARNESS_KEYS.join(", ")}`,
-    ]);
+    return ok(
+      stack(
+        head(0),
+        emptyState(
+          {
+            what: "No extra capture paths configured. Every harness is watching only its default location.",
+            hint: "Add one with:",
+            cmd: "failproofai harness add-path <harness> [<label>=]<path>",
+          },
+          opts,
+        ),
+        // Wrapped, not joined into one line: twelve names ran off the right edge
+        // of an 80-column terminal, and the twelfth is as real as the first.
+        note(`Harnesses: ${HARNESS_KEYS.join(", ")}`, opts),
+      ),
+    );
   }
 
-  const lines: string[] = [];
+  const configured = names.reduce((n, name) => n + (sources[name]?.extraPaths?.length ?? 0), 0);
+  const groups: Array<string[] | null> = [head(configured)];
   for (const name of names) {
     const entries = sources[name]?.extraPaths ?? [];
     if (entries.length === 0) {
-      if (harness) lines.push(`${name}: no extra paths configured (default location only)`);
+      if (harness) {
+        groups.push(rule(name, opts));
+        groups.push(note("no extra paths configured (default location only)", opts));
+      }
       continue;
     }
-    lines.push(`${name}:`);
-    for (const e of entries) {
-      const label = labelOf(e);
-      lines.push(
-        label
-          ? `  ${pathOf(e)}   → agent ids ${label}-*`
-          : `  ${pathOf(e)}   → label derived from the folder name`,
-      );
-    }
+    groups.push(rule(name, opts));
+    // A table, not label/value rows: the PATH is the fact here, and a row's
+    // label column would have capped it at 24 columns — a truncated path cannot
+    // be copied, which makes the listing useless for the one thing it is for.
+    groups.push(
+      table(
+        {
+          head: ["Path", "Agent ids"],
+          rows: entries.map((e) => {
+            const label = labelOf(e);
+            return [
+              pathOf(e),
+              label ? `${label}-*` : "derived from the folder name",
+            ];
+          }),
+          flex: 1,
+          // The path is the value this listing exists to hand back; it is never
+          // the column that gives way.
+          protect: [0],
+        },
+        opts,
+      ),
+    );
   }
+  const lines: string[] = stack(...groups);
   // Unknown tables are surfaced here as well as by the daemon: a user who
   // hand-edited config.json runs `list` to check it, and that is the moment the
   // typo is cheapest to find.
   if (unknown.length > 0) {
-    if (lines.length === 0) lines.push("No extra capture paths configured for any known harness.");
-    lines.push(
+    const body =
+      configured === 0
+        ? [...head(0), "", ...note("No extra capture paths configured for any known harness.", opts)]
+        : lines;
+    return ok([
+      ...body,
       "",
-      `⚠ config.json configures ${unknown.length} unknown harness(es): ${unknown.join(", ")}`,
-      "  Nothing is captured from them.",
-      `  Known: ${HARNESS_KEYS.join(", ")}`,
-    );
+      ...warning(
+        [
+          `config.json configures ${unknown.length} unknown harness(es): ${unknown.join(", ")}`,
+          "Nothing is captured from them.",
+          `Known: ${HARNESS_KEYS.join(", ")}`,
+        ],
+        opts,
+      ),
+    ]);
   }
   return ok(lines);
 }

package/src/hooks/hook-activity-store.ts

@@ -96,11 +96,20 @@ export interface HookActivityEntry {
    * plain allow) and on rows written before this existed — so, like
    * `matchedPolicies`, `undefined` means "unknown", not "builtin".
    */
-  policySource?: "builtin" | "custom" | "convention" | "cloud";
+  policySource?: "builtin" | "custom" | "convention" | "cloud" | "pack";
   /** Cloud policy id of the decider. Present only when `policySource` is "cloud". */
   cloudPolicyId?: string;
   /** Immutable version of that policy — the half of attribution that identifies WHICH version ran. */
   cloudVersion?: number;
+  /**
+   * Pack id and version of the decider. Present only when `policySource` is
+   * "pack", and here for the same reason the cloud pair is: the display name
+   * encodes both ("pack/acme/finance@1.2.0/…") but only as a string, so without
+   * these the question "which pack, which version decided this" could only be
+   * answered by re-parsing our own label.
+   */
+  packId?: string;
+  packVersion?: string;
   /**
    * The cloud deployment active when this event was evaluated, recorded on
    * every row of a managed machine regardless of what decided. "What was
@@ -117,7 +126,8 @@ export interface HookActivityEntry {
    */
   observed?: Array<{
     policyId: string;
-    version: number;
+    /** A cloud deployment number, or a pack's version string. */
+    version: string | number;
     decision: "deny" | "instruct";
     reason: string | null;
   }>;
@@ -134,7 +144,7 @@ export interface HookActivityFilters {
    * organization's policies decided" is the question cloud rollout reporting
    * is built on, and it is unanswerable without this.
    */
-  source?: "builtin" | "custom" | "convention" | "cloud";
+  source?: "builtin" | "custom" | "convention" | "cloud" | "pack";
 }
 
 export interface HookActivityStats {

package/src/hooks/install-prompt.ts

@@ -358,7 +358,16 @@ export async function promptPolicySelection(
   // If stdin is not a TTY (piped/CI), return defaults
   if (!process.stdin.isTTY) {
     const available = BUILTIN_POLICIES.filter((p) => includeBeta || !p.beta);
-    if (preSelected) return preSelected.filter((name) => available.some((p) => p.name === name));
+    // Returned UNCHANGED, deliberately. This used to intersect with the builtin
+    // catalog, and manager.ts writes the result straight back — so a piped
+    // `policies --install` silently deleted every enabled name the catalog did
+    // not contain: a `failproofai/`-qualified name (a form the enforcement path
+    // explicitly accepts, `registerBuiltinPolicies` canonicalizes both), a beta
+    // policy enabled with `--beta`, and now any pack policy. The line that
+    // reports what was enabled prints only the survivors, so the loss was
+    // invisible. Carrying an unknown name costs nothing — registration looks it
+    // up in a Set and finds nothing — while dropping one destroys configuration.
+    if (preSelected) return [...preSelected];
     return available.filter((p) => p.defaultEnabled).map((p) => p.name);
   }
 
@@ -374,6 +383,14 @@ export async function promptPolicySelection(
       beta: !!p.beta,
     }));
 
+  // Everything the user has enabled that this picker cannot show a row for, for
+  // the same reason as the non-TTY branch above: the picker's universe is the
+  // builtin catalog, and resolving from it alone deletes anything else. Kept in
+  // their original order and appended to whatever the user picks.
+  const carried = preSelected
+    ? preSelected.filter((name) => !items.some((i) => i.name === name))
+    : [];
+
   const total = items.length;
   const WINDOW_SIZE = 10;
 
@@ -570,10 +587,15 @@ export async function promptPolicySelection(
         cleanup();
         const selected = items.filter((i) => i.selected).map((i) => i.name);
         if (lastLineCount > 0) process.stdout.write(`\x1B[${lastLineCount}A\x1B[J`);
+        // Carried entries are NAMED, not counted. "3 kept" reads as fine right
+        // up until someone needs to know which three.
+        const summary = carried.length > 0
+          ? `${selected.length} selected, kept ${carried.join(", ")}`
+          : `${selected.length} selected`;
         process.stdout.write(
-          `${dim(BAR)}\n${dim(DONE)}  Policies\n${dim(BAR)}  ${dim(`${selected.length} selected`)}\n`,
+          `${dim(BAR)}\n${dim(DONE)}  Policies\n${dim(BAR)}  ${dim(summary)}\n`,
         );
-        resolve(selected);
+        resolve([...selected, ...carried]);
       } else if (key.name === "escape") {
         // Clear search filter
         search = "";