failproofai 1.0.1 → 1.0.2-beta.1

package/.next/standalone/SECURITY.md

@@ -1,9 +1,10 @@
 # Security Policy
 
-failproofai is an npm package that installs hooks into AI coding agents (Claude
-Code, Codex, and others) and runs locally in developers' environments, observing
-and gating agent actions. A compromised dependency would therefore run on our
-users' machines, inside their agent sessions — so we treat our supply chain as
+failproofai is an npm package that installs hooks into AI agent harnesses
+(Claude Code, Codex, Cursor, the Hermes and OpenClaw gateways, and others) and
+runs locally in the environment the agent runs in, observing and gating agent
+actions. A compromised dependency would therefore run on our
+users' machines and servers, inside their agent sessions — so we treat our supply chain as
 part of our users' trust boundary. This document covers how to report a
 vulnerability and how our dependency supply-chain scanning works.
 

package/.next/standalone/app/actions/get-hooks-config.ts

@@ -2,7 +2,6 @@
 
 import { configuredCustomPolicyPaths, readMergedHooksConfig } from "@/src/hooks/hooks-config";
 import { hooksInstalledInSettings, getSettingsPath } from "@/src/hooks/manager";
-import { BUILTIN_POLICIES } from "@/src/hooks/builtin-policies";
 import { listIntegrations } from "@/src/hooks/integrations";
 import { HOOK_SCOPES } from "@/src/hooks/types";
 import type { HookScope, IntegrationType } from "@/src/hooks/types";
@@ -13,6 +12,8 @@ import { readFile } from "node:fs/promises";
 import { existsSync } from "node:fs";
 import { basename, resolve } from "node:path";
 import { customPoliciesDir } from "@/src/hooks/fp-home";
+import { readInstalledPacks } from "@/src/hooks/pack-manifest";
+import type { PackError, ResolvedPack } from "@/src/hooks/pack-manifest";
 
 export interface PolicyParamSpec {
   type: string;
@@ -30,6 +31,9 @@ export interface PolicyInfo {
   eventScope: string;
   params?: Record<string, PolicyParamSpec>;
   currentParams?: Record<string, unknown>;
+  /** The pack this policy came from — every policy has one now. */
+  packId: string;
+  packVersion: string;
 }
 
 export interface CustomPolicyInfo {
@@ -68,6 +72,25 @@ export interface CliInstallStatus {
   detected: boolean;
 }
 
+/** One policy carried by an installed pack. */
+export interface PackPolicyInfo {
+  name: string;
+  description: string;
+  category: string;
+  enabled: boolean;
+}
+
+export interface InstalledPackInfo {
+  id: string;
+  version: string;
+  /** Where it came from, verbatim — `github:acme/ops@v1.0.0` or `bundled:...`. */
+  source: string;
+  effect: "enforce" | "observe";
+  policies: PackPolicyInfo[];
+  /** Set when the record itself could not be read, e.g. its digest changed. */
+  error?: string;
+}
+
 export interface HooksConfigPayload {
   enabledPolicies: string[];
   /** Claude-only legacy field; kept for back-compat. New UI should consume `clis`. */
@@ -83,6 +106,8 @@ export interface HooksConfigPayload {
   customPolicies?: CustomPolicyInfo[];
   /** Convention-discovered policy files, project scope first. */
   conventionPolicies: ConventionPolicyFile[];
+  /** Installed policy packs, read from `installed.json`. */
+  packs: InstalledPackInfo[];
 }
 
 /**
@@ -179,7 +204,6 @@ export async function getHooksConfigAction(): Promise<HooksConfigPayload> {
   // Match runtime enforcement: project, local, and user config all
   // contribute to the effective policy state shown by the dashboard.
   const config = readMergedHooksConfig(launchCwd);
-  const enabledSet = new Set(config.enabledPolicies);
   const disabledCustomPolicies = new Set(config.disabledCustomPolicies ?? []);
 
   const installedScopes = HOOK_SCOPES.filter((s) => hooksInstalledInSettings(s));
@@ -194,21 +218,52 @@ export async function getHooksConfigAction(): Promise<HooksConfigPayload> {
     detected: integration.detectInstalled(),
   }));
 
-  const policies: PolicyInfo[] = BUILTIN_POLICIES.map((p) => ({
-    name: p.name,
-    description: p.description,
-    category: p.category,
-    defaultEnabled: p.defaultEnabled,
-    beta: !!p.beta,
-    enabled: enabledSet.has(p.name),
-    eventScope: buildEventScope(p.match),
-    params: p.params
-      ? Object.fromEntries(
-          Object.entries(p.params).map(([k, v]) => [k, { type: v.type, description: v.description, default: v.default }])
-        )
-      : undefined,
-    currentParams: p.params ? (config.policyParams?.[p.name] ?? {}) : undefined,
-  }));
+  // Read once, ahead of everything that needs it: the policy list IS the packs'
+  // policies now, and the pack listing further down describes the same read.
+  let installedPacks: ResolvedPack[] = [];
+  let packErrors: PackError[] = [];
+  try {
+    const result = readInstalledPacks();
+    installedPacks = result.packs;
+    packErrors = result.errors;
+  } catch {
+    // A listing must not be the thing that turns an unreadable manifest into a
+    // broken page.
+  }
+
+  // Every policy that enforces here comes from an installed PACK. Nothing is
+  // compiled into this build any more except the always-on self-protection
+  // guard — which no listing can switch off, so it has no row.
+  const policies: PolicyInfo[] = [];
+  for (const pack of installedPacks) {
+    const taken = pack.enabled ?? pack.policies.map((p) => p.name);
+    for (const policy of pack.policies) {
+      policies.push({
+        name: policy.name,
+        description: policy.description,
+        category: policy.category,
+        defaultEnabled: policy.defaultEnabled,
+        beta: false,
+        enabled:
+          taken.includes(policy.name) &&
+          !disabledCustomPolicies.has(`pack:${pack.id}@${pack.version}:${policy.name}`),
+        eventScope: buildEventScope(policy.match),
+        packId: pack.id,
+        packVersion: pack.version,
+        ...(policy.params
+          ? {
+              params: Object.fromEntries(
+                Object.entries(policy.params).map(([k, v]) => [
+                  k,
+                  { type: v.type, description: v.description, default: v.default },
+                ]),
+              ),
+              currentParams: config.policyParams?.[policy.name] ?? {},
+            }
+          : {}),
+      });
+    }
+  }
 
   const customPoliciesPaths = configuredCustomPolicyPaths(config);
   const launchRoot = findProjectConfigDir(launchCwd);
@@ -232,6 +287,41 @@ export async function getHooksConfigAction(): Promise<HooksConfigPayload> {
     new Set(resolvedCustomPaths),
   );
 
+  // Metadata only — deliberately never imported. Same rule as the convention
+  // files above: this runs on every page load, and importing a pack's artifact
+  // would execute a third party's code inside the long-lived dashboard server.
+  // The import check that proves a pack still loads belongs to the CLI and to
+  // the user-initiated install action.
+  const packs: InstalledPackInfo[] = installedPacks.map((pack) => {
+    const taken = pack.enabled ?? pack.policies.map((p) => p.name);
+    return {
+      id: pack.id,
+      version: pack.version,
+      source: pack.source,
+      effect: pack.effect,
+      policies: pack.policies.map((policy) => ({
+        name: policy.name,
+        description: policy.description,
+        category: policy.category,
+        enabled:
+          taken.includes(policy.name) &&
+          !disabledCustomPolicies.has(`pack:${pack.id}@${pack.version}:${policy.name}`),
+      })),
+    };
+  });
+  for (const err of packErrors) {
+    // A pack that will not load is what the machine denies for; a listing that
+    // omitted it would be the quietest possible way to report that.
+    packs.push({
+      id: err.id ?? "(unnamed pack)",
+      version: "",
+      source: "",
+      effect: "enforce",
+      policies: [],
+      error: err.reason,
+    });
+  }
+
   return {
     enabledPolicies: config.enabledPolicies,
     installedScopes,
@@ -242,5 +332,6 @@ export async function getHooksConfigAction(): Promise<HooksConfigPayload> {
     customPoliciesPath: customPoliciesPaths.length === 1 ? customPoliciesPaths[0] : undefined,
     customPolicies: customPolicies.length ? customPolicies : undefined,
     conventionPolicies,
+    packs,
   };
 }

package/.next/standalone/app/actions/pack-actions.ts

@@ -0,0 +1,163 @@
+"use server";
+
+/**
+ * Installing and managing policy packs from the local dashboard.
+ *
+ * These are USER-INITIATED actions, which is what makes it acceptable for
+ * `addPack` to import the pack's artifact here: it verifies that what a
+ * publisher declared is what their code registers, and refusing at install time
+ * is the whole reason a broken pack cannot brick the machine. `get-hooks-config`
+ * deliberately does the opposite — it lists packs from `installed.json` and
+ * imports nothing, because that runs on every page load.
+ */
+import {
+  addPackFromSource,
+  fetchPackPreview,
+  CORE_SOURCE,
+  addPack,
+  removePack,
+  setPackPolicyEnabled,
+} from "@/src/hooks/pack-store";
+import { readHooksConfig, writeHooksConfig } from "@/src/hooks/hooks-config";
+import { readInstalledPacks } from "@/src/hooks/pack-manifest";
+
+export interface PackActionResult {
+  ok: boolean;
+  /** Present when ok — what landed, so the UI can say it without a refetch. */
+  id?: string;
+  version?: string;
+  enabled?: string[];
+  available?: string[];
+  /** Present when not ok — the publisher's or the loader's own words. */
+  error?: string;
+}
+
+/**
+ * Install a pack by the source a person typed: `core`, `acme/ops`,
+ * `acme/ops@v1.2.0`, or a release URL.
+ *
+ * Routed through the SAME resolver the CLI uses. While the alias list lived in
+ * `pack-cli.ts`, `core` worked in the terminal and failed in the browser — the
+ * one thing a shared entry point exists to prevent.
+ */
+export async function addPackWebAction(
+  source: string,
+  opts?: { all?: boolean; only?: string[]; categories?: string[] },
+): Promise<PackActionResult> {
+  const trimmed = source.trim();
+  if (!trimmed) return { ok: false, error: "Enter a pack source, for example acme/ops" };
+  try {
+    const result = await addPackFromSource(trimmed, opts ?? {});
+    return {
+      ok: true,
+      id: result.id,
+      version: result.version,
+      enabled: result.enabled,
+      available: result.available,
+    };
+  } catch (err) {
+    // Surfaced verbatim. Every refusal on this path already names what was wrong
+    // and whose fault it is — an unresolvable source, a digest that does not
+    // match, a manifest declaring a policy its artifact never registers.
+    return { ok: false, error: err instanceof Error ? err.message : String(err) };
+  }
+}
+
+/**
+ * Install the Failproof AI policies.
+ *
+ * Fetched from their GitHub release like anybody else's pack — this package
+ * carries no copy of them. The name is kept so the dashboard's button does not
+ * have to know that, but there is nothing "bundled" about it any more.
+ */
+export async function addBundledPackWebAction(): Promise<PackActionResult> {
+  try {
+    const result = await addPack(CORE_SOURCE);
+    return {
+      ok: true,
+      id: result.id,
+      version: result.version,
+      enabled: result.enabled,
+      available: result.available,
+    };
+  } catch (err) {
+    return { ok: false, error: err instanceof Error ? err.message : String(err) };
+  }
+}
+
+export async function removePackWebAction(id: string): Promise<PackActionResult> {
+  return removePack(id) ? { ok: true, id } : { ok: false, error: `No installed pack with id ${id}` };
+}
+
+/**
+ * Turn one policy of an installed pack on or off.
+ *
+ * Writes the pack's own SELECTION, the same lever the CLI uses — not a
+ * `disabledCustomPolicies` entry, which is keyed by version and would silently
+ * switch everything back on at the next upgrade. Enabling also clears any such
+ * key, so a policy switched off before this existed can still be switched back on.
+ */
+export async function togglePackPolicyAction(
+  packId: string,
+  name: string,
+  enabled: boolean,
+): Promise<PackActionResult> {
+  const result = setPackPolicyEnabled(packId, name, enabled);
+  if (!result.ok) return { ok: false, error: result.reason };
+  if (enabled) {
+    const pack = readInstalledPacks().packs.find((p) => p.id === packId);
+    if (pack) {
+      const key = `pack:${pack.id}@${pack.version}:${name}`;
+      const config = readHooksConfig();
+      const remaining = (config.disabledCustomPolicies ?? []).filter((k) => k !== key);
+      if (remaining.length !== (config.disabledCustomPolicies ?? []).length) {
+        const { disabledCustomPolicies: _dropped, ...rest } = config;
+        writeHooksConfig(
+          remaining.length > 0 ? { ...rest, disabledCustomPolicies: remaining } : rest,
+        );
+      }
+    }
+  }
+  return { ok: true, id: packId };
+}
+
+export interface PackPreviewResult {
+  ok: boolean;
+  id?: string;
+  version?: string;
+  source?: string;
+  effect?: "enforce" | "observe";
+  policies?: Array<{ name: string; description: string; category: string; defaultEnabled: boolean }>;
+  error?: string;
+}
+
+/**
+ * Read what a pack contains WITHOUT installing it — the browser half of
+ * `failproofai pack list <source>`.
+ *
+ * Fetches the manifest only. The entry artifact is never downloaded and never
+ * imported, so previewing a stranger's pack from the dashboard cannot run a
+ * stranger's code inside this long-lived server.
+ */
+export async function previewPackWebAction(source: string): Promise<PackPreviewResult> {
+  const trimmed = source.trim();
+  if (!trimmed) return { ok: false, error: "Enter a pack source, for example acme/ops" };
+  try {
+    const preview = await fetchPackPreview(trimmed);
+    return {
+      ok: true,
+      id: preview.id,
+      version: preview.version,
+      source: preview.source,
+      effect: preview.effect,
+      policies: preview.policies.map((p) => ({
+        name: p.name,
+        description: p.description,
+        category: p.category,
+        defaultEnabled: p.defaultEnabled,
+      })),
+    };
+  } catch (err) {
+    return { ok: false, error: err instanceof Error ? err.message : String(err) };
+  }
+}

package/.next/standalone/app/audit/_components/run-progress.tsx

@@ -21,7 +21,7 @@ import { useEffect, useState } from "react";
 const STAGES = [
   { label: "discovering transcripts", detail: "walking ~/.claude, ~/.codex, ~/.cursor, …" },
   { label: "parsing session logs",   detail: "reading JSONL + sqlite session stores" },
-  { label: "running policy checks",  detail: "replaying through 30 builtin policies" },
+  { label: "running policy checks",  detail: "replaying every policy against each tool call" },
   { label: "aggregating results",    detail: "counting hits, ranking by frequency" },
 ];
 

package/.next/standalone/app/audit/_components/share-templates.ts

@@ -34,49 +34,49 @@ const PASTE_LINE = "[ audit card copied to your clipboard — paste it into the
 /** Short, curiosity-forward — for X / Twitter. Ends on the npx CTA + @failproofai. */
 export const X_TEMPLATES: ((c: ShareCtx) => string)[] = [
   ({ score, arch }) =>
-    `my coding agent has a personality and it's ${arch}. did not see that coming.\n\nran a failproof audit, scored ${score}/100, all local. find out what yours is → ${X_CTA}`,
+    `my agent has a personality and it's ${arch}. did not see that coming.\n\nran a failproof audit, scored ${score}/100, all local. find out what yours is → ${X_CTA}`,
   ({ score, arch }) =>
-    `spent 30 seconds auditing my coding agent. learned more about it than i did all month.\n\nit's ${arch}. scored ${score}/100. → ${X_CTA}`,
+    `spent 30 seconds auditing my agent. learned more about it than i did all month.\n\nit's ${arch}. scored ${score}/100. → ${X_CTA}`,
   ({ score }) =>
     `my agent scored ${score}/100. think yours can beat it?\n\n30 sec audit, runs locally, gives you a personality too → ${X_CTA}`,
   ({ arch }) =>
-    `turns out my coding agent is ${arch} and honestly it explains everything.\n\n→ ${X_CTA}`,
+    `turns out my agent is ${arch} and honestly it explains everything.\n\n→ ${X_CTA}`,
   ({ score, arch }) =>
     `ran a failproof audit on my agent. it reads how it actually behaves when things break, not just the happy path.\n\npersonality: ${arch}. score: ${score}/100. all local → ${X_CTA}`,
   ({ score, arch }) =>
-    `got to know my coding agent today. it's ${arch} and scored ${score}/100. wow.\n\naudit yours in 30s, nothing leaves your machine → ${X_CTA}`,
+    `got to know my agent today. it's ${arch} and scored ${score}/100. wow.\n\naudit yours in 30s, nothing leaves your machine → ${X_CTA}`,
   ({ score, arch }) =>
-    `your coding agent has a personality. you just haven't met it.\n\ni met mine today: ${arch}, ${score}/100. → ${X_CTA}`,
+    `your agent has a personality. you just haven't met it.\n\ni met mine today: ${arch}, ${score}/100. → ${X_CTA}`,
   ({ score, arch }) =>
     `everyone talks about what their agent can build. nobody talks about how it acts when it breaks.\n\nmine's ${arch}, scored ${score}/100, all local → ${X_CTA}`,
   ({ score, arch }) =>
     `every agent builder should run this once.\n\n30 sec, local, gives your agent a personality and a quality score. mine: ${arch}, ${score}/100.\n\n${X_CTA}`,
   ({ score, arch }) =>
-    `i'll go first: ${arch}, ${score}/100.\n\nwhat's your coding agent? 30 sec audit, no signup → ${X_CTA}`,
+    `i'll go first: ${arch}, ${score}/100.\n\nwhat's your agent? 30 sec audit, no signup → ${X_CTA}`,
 ];
 
 /** Longer, reflective — for LinkedIn. Ends on the npx CTA + @Failproof AI. */
 export const LI_TEMPLATES: ((c: ShareCtx) => string)[] = [
   ({ score, arch }) =>
-    `I've spent more hours with my coding agent this month than with most people I know. Today I realized I couldn't tell you a single thing about how it actually behaves.\n\nSo I audited it. Turns out it's ${arch}, and it scored ${score}/100.\n\nThe audit reads its real history, including how it handles failures, not just the clean runs. 30 seconds, runs entirely locally.\n\nMeet yours: ${LI_CTA}`,
+    `I've spent more hours with my agent this month than with most people I know. Today I realized I couldn't tell you a single thing about how it actually behaves.\n\nSo I audited it. Turns out it's ${arch}, and it scored ${score}/100.\n\nThe audit reads its real history, including how it handles failures, not just the clean runs. 30 seconds, runs entirely locally.\n\nMeet yours: ${LI_CTA}`,
   ({ score, arch }) =>
-    `Took a personality test today. It wasn't for me — it was for my AI coding agent.\n\nThe result: ${arch}, with a quality score of ${score}/100.\n\nIt works by reading the agent's actual run history, so the personality comes from how it really behaves, not a vibe. Took 30 seconds and stayed local.\n\nTry it on yours: ${LI_CTA}`,
+    `Took a personality test today. It wasn't for me — it was for my AI agent.\n\nThe result: ${arch}, with a quality score of ${score}/100.\n\nIt works by reading the agent's actual run history, so the personality comes from how it really behaves, not a vibe. Took 30 seconds and stayed local.\n\nTry it on yours: ${LI_CTA}`,
   ({ score, arch }) =>
     `Everyone asks what their AI agent can build. I just found out mine has a temper.\n\nAfter watching how it reacts to a failed command, the audit called it ${arch}. It also scored its quality at ${score}/100.\n\nOddly useful to see it written down. 30 seconds, all local: ${LI_CTA}`,
   ({ score, arch }) =>
     `My agent does this very specific thing every time a command fails. Today I learned there's basically a name for it.\n\nRan a quick audit and it came back ${arch}, scored ${score}/100. The whole read is based on how the agent handles things going wrong, which is where its real character shows.\n\n30 seconds, nothing leaves your machine: ${LI_CTA}`,
   ({ score, arch }) =>
-    `My AI coding agent scored ${score}/100 today. I didn't know you could even measure that.\n\nThe same audit also handed it a personality: ${arch}.\n\nIt reads the agent's real history and tells you where it's solid and where it slips. Took 30 seconds and ran fully locally: ${LI_CTA}`,
+    `My AI agent scored ${score}/100 today. I didn't know you could even measure that.\n\nThe same audit also handed it a personality: ${arch}.\n\nIt reads the agent's real history and tells you where it's solid and where it slips. Took 30 seconds and ran fully locally: ${LI_CTA}`,
   ({ score, arch }) =>
-    `I'm usually the first to scroll past "audit your X" tools. This one took 30 seconds and actually told me something.\n\nMy coding agent is ${arch}, and it scored ${score}/100.\n\nIt reads the agent's real run history rather than asking me anything, and none of it leaves the machine: ${LI_CTA}`,
+    `I'm usually the first to scroll past "audit your X" tools. This one took 30 seconds and actually told me something.\n\nMy agent is ${arch}, and it scored ${score}/100.\n\nIt reads the agent's real run history rather than asking me anything, and none of it leaves the machine: ${LI_CTA}`,
   ({ score, arch }) =>
-    `What is your coding agent's personality? I realized today that I had no answer.\n\nSo I checked. Mine is ${arch}, scored ${score}/100, with a clear read on where it shines and where it slips.\n\nIf you work with agents, run it and drop yours in the comments. 30 seconds, fully local: ${LI_CTA}`,
+    `What is your agent's personality? I realized today that I had no answer.\n\nSo I checked. Mine is ${arch}, scored ${score}/100, with a clear read on where it shines and where it slips.\n\nIf you work with agents, run it and drop yours in the comments. 30 seconds, fully local: ${LI_CTA}`,
   ({ score, arch }) =>
-    `I trusted my coding agent a little less after this morning, and quite a bit more by the afternoon.\n\nI ran an audit on it. It showed me exactly where it's reliable and where it isn't, gave it a personality (${arch}), and scored it ${score}/100.\n\nKnowing the gaps is what made me trust it more. 30 seconds, all local: ${LI_CTA}`,
+    `I trusted my agent a little less after this morning, and quite a bit more by the afternoon.\n\nI ran an audit on it. It showed me exactly where it's reliable and where it isn't, gave it a personality (${arch}), and scored it ${score}/100.\n\nKnowing the gaps is what made me trust it more. 30 seconds, all local: ${LI_CTA}`,
   ({ score, arch }) =>
     `I almost skipped this because I assumed it would quietly ship my code off somewhere. It doesn't. Everything runs locally.\n\n30 seconds later I had my agent's personality (${arch}) and a quality score (${score}/100).\n\nIf privacy is usually what stops you from trying these, this one is different: ${LI_CTA}`,
   ({ score, arch }) =>
-    `Found out my AI coding agent has a personality type. Found out it's ${arch}. Found out that explains a lot.\n\nIt scored ${score}/100 too. The audit reads how the agent handles failures, not just the runs where everything goes fine.\n\n30 seconds, runs locally: ${LI_CTA}`,
+    `Found out my AI agent has a personality type. Found out it's ${arch}. Found out that explains a lot.\n\nIt scored ${score}/100 too. The audit reads how the agent handles failures, not just the runs where everything goes fine.\n\n30 seconds, runs locally: ${LI_CTA}`,
 ];
 
 /** djb2 hash — stable per seed so the template choice is deterministic. */