failproofai 1.0.10 → 1.0.11-beta.0

package/scripts/launch.ts

@@ -1,47 +1,89 @@
 /**
- * Shared launch logic for dev.ts and start.ts.
+ * Shared launch logic for dev.ts and start.ts, bare `failproofai`, and the
+ * dashboard hand-off at the end of `failproofai audit`.
  */
 import { spawn } from "child_process";
 import { realpathSync, existsSync } from "node:fs";
 import { resolve, dirname } from "node:path";
 import { fileURLToPath } from "node:url";
-import { createInterface } from "node:readline";
 import { parseScriptArgs } from "./parse-script-args";
 import { diagnoseShadow } from "./install-diagnosis.mjs";
-import { makeSkewLogFilter } from "./skew-log-filter";
-import { renderLaunchBanner } from "../src/hooks/tui";
+import { colorsEnabled, screenKit } from "../src/hooks/tui";
 import { isLoopbackHostname, resolveDashboardHost } from "../lib/dashboard-host";
+import { dashboardBrowseUrl, exposedBindWarning, launchFailureLines, launchScreenLines } from "./launch-screen";
+import { gatherLaunchFacts } from "./launch-facts";
+import { dashboardProbeHost, probeDashboardPort, watchDashboardStart } from "./launch-ready";
 import { version } from "../package.json";
 
-export function launch(mode: "dev" | "start"): void {
-  const { loggingLevel, disableTelemetry, allowedDevOrigins, host, remainingArgs } = parseScriptArgs(process.argv.slice(2));
+export interface LaunchOptions {
+  /**
+   * Print the launch screen. Off for `failproofai audit`, whose hand-off prints
+   * its own lines and the /audit address before the server starts.
+   */
+  screen?: boolean;
+  /**
+   * Draw the logomark above the screen, on a terminal. Off when the first-run
+   * setup wizard already drew it in this process.
+   */
+  logo?: boolean;
+}
 
-  // Branded splash — the same logomark + palette as the `configure` wizard, then
-  // a tidy version/links column. Falls back to plain text off a TTY.
-  for (const line of renderLaunchBanner(version)) console.log(line);
+export function launch(mode: "dev" | "start", options: LaunchOptions = {}): void {
+  const { loggingLevel, disableTelemetry, allowedDevOrigins, host, remainingArgs } = parseScriptArgs(process.argv.slice(2));
+  const showScreen = options.screen !== false;
 
   // The dashboard has no authentication and can toggle policies and uninstall
   // hooks from every agent CLI, so it binds loopback unless someone asks
   // otherwise. It used to bind 0.0.0.0 unconditionally, which handed all of
   // that to every peer on the network.
   const bindHost = resolveDashboardHost(host, process.env.FAILPROOFAI_DASHBOARD_HOST);
-  if (!isLoopbackHostname(bindHost)) {
-    console.warn(
-      `\n! Binding the dashboard to ${bindHost}, which is reachable from outside this machine.\n` +
-      `  It has no authentication: anyone who can reach it can read your session\n` +
-      `  transcripts, disable your policies, and uninstall failproofai's hooks.\n`,
-    );
-  }
+  const exposed = isLoopbackHostname(bindHost)
+    ? undefined
+    : { host: bindHost, fix: host !== undefined ? "--host 127.0.0.1" : "unset FAILPROOFAI_DASHBOARD_HOST" };
   // Read back by proxy.ts, which refuses any request whose Host is not one it
   // should be answering to — the layer that stops DNS rebinding, which a
   // loopback bind alone does not.
   process.env.FAILPROOFAI_DASHBOARD_HOST = bindHost;
 
+  // A routable bind is allowed, and said out loud. The launch screen carries
+  // that warning as its attention line; audit's hand-off has no screen, so it
+  // is said here, before anything listens.
+  if (exposed && !showScreen) {
+    const k = screenKit({ color: colorsEnabled(process.stderr) });
+    process.stderr.write(`\n${k.caution(exposedBindWarning(exposed.host))}\n  ${k.cmd(exposed.fix)}\n\n`);
+  }
+
+  // `.next/standalone/server.js` does `process.chdir(__dirname)` on its first
+  // line, so by the time a server action runs, `process.cwd()` is the PACKAGE
+  // directory, not the directory the user launched from. Anything resolving
+  // project-scope paths from cwd would look inside the installed package and
+  // find nothing. So the real cwd is captured here, before the child starts,
+  // the same way FAILPROOFAI_PACKAGE_ROOT is threaded through, and the launch
+  // screen reads the project from the same place the dashboard will.
+  const launchCwd = process.env.FAILPROOFAI_LAUNCH_CWD ?? process.cwd();
+
+  const portIdx = remainingArgs.indexOf("--port");
+  const portFlag = portIdx >= 0 ? remainingArgs[portIdx + 1] : undefined;
+  // `next dev` serves on PORT, else 3000, unless --port is passed through.
+  const port = mode === "start" ? (portFlag ?? "8020") : (portFlag ?? process.env.PORT ?? "3000");
+
+  const printScreen = (live: boolean): void => {
+    const lines = launchScreenLines(
+      { url: dashboardBrowseUrl(bindHost, port), live, exposed, ...gatherLaunchFacts(launchCwd) },
+      {
+        color: colorsEnabled(process.stdout),
+        // Some pseudo-terminals report 0 columns; that is "unknown", not narrow.
+        cols: process.stdout.columns || undefined,
+        // Piped output is a log: no art in it.
+        logo: options.logo !== false && Boolean(process.stdout.isTTY),
+      },
+    );
+    process.stdout.write(`${lines.join("\n")}\n`);
+  };
+
   let cmd: string;
   let cmdArgs: string[];
   if (mode === "start") {
-    const portIdx = remainingArgs.indexOf("--port");
-    const port = portIdx >= 0 ? remainingArgs[portIdx + 1] : "8020";
     process.env.PORT = port;
     process.env.HOSTNAME = bindHost;
     cmd = "node";
@@ -100,52 +142,67 @@ export function launch(mode: "dev" | "start"): void {
   }
 
   // In `start` (the shipped standalone server) we pipe + filter the child's
-  // output to drop the benign "Failed to find Server Action" deployment-skew
+  // output: to drop the benign "Failed to find Server Action" deployment-skew
   // block — a stale browser tab POSTing an old action ID after a rebuild, which
-  // the client recovers from via Next's graceful 404 (see skew-log-filter.ts).
+  // the client recovers from via Next's graceful 404 (see skew-log-filter.ts) —
+  // and to learn when the server is listening, so the launch screen can say so.
   // `dev` keeps "inherit" so Next's interactive compile output is untouched.
-  // FORCE_COLOR keeps the piped child's output colored despite the non-TTY pipe.
   const filterLogs = mode === "start";
 
+  // Dev never learns when its server is up, so its screen goes first, as the
+  // banner always did, and says it is starting.
+  if (!filterLogs && showScreen) printScreen(false);
+
   const nextProcess = spawn(cmd, cmdArgs, {
     stdio: filterLogs ? ["inherit", "pipe", "pipe"] : "inherit",
     env: {
       ...process.env,
-      // `.next/standalone/server.js` does `process.chdir(__dirname)` on its
-      // first line, so by the time a server action runs, `process.cwd()` is the
-      // PACKAGE directory, not the directory the user launched from. Anything
-      // resolving project-scope paths from cwd would look inside the installed
-      // package and find nothing. Capture the real cwd here, before the child
-      // starts, the same way FAILPROOFAI_PACKAGE_ROOT is threaded through.
-      FAILPROOFAI_LAUNCH_CWD: process.env.FAILPROOFAI_LAUNCH_CWD ?? process.cwd(),
-      ...(filterLogs ? { FORCE_COLOR: process.env.FORCE_COLOR ?? "1" } : {}),
+      FAILPROOFAI_LAUNCH_CWD: launchCwd,
+      // Keeps the piped child's output coloured despite the pipe, when this
+      // process is itself writing to a terminal. Not otherwise: piped output is
+      // a log file, and forced colour put escape codes in it.
+      ...(filterLogs && process.stdout.isTTY ? { FORCE_COLOR: process.env.FORCE_COLOR ?? "1" } : {}),
       ...(loggingLevel ? { FAILPROOFAI_LOG_LEVEL: loggingLevel } : {}),
       ...(disableTelemetry ? { FAILPROOFAI_TELEMETRY_DISABLED: "1" } : {}),
       ...(allowedDevOrigins ? { FAILPROOFAI_ALLOWED_DEV_ORIGINS: allowedDevOrigins.join(",") } : {}),
     },
   });
 
-  if (filterLogs) {
-    // One filter instance per stream — the skew block is multi-line and stateful.
-    for (const [src, dest] of [
-      [nextProcess.stdout, process.stdout],
-      [nextProcess.stderr, process.stderr],
-    ] as const) {
-      if (!src) continue;
-      const filter = makeSkewLogFilter();
-      createInterface({ input: src }).on("line", (line) => {
-        const out = filter(line);
-        if (out !== null) dest.write(out + "\n");
-      });
-    }
+  if (!filterLogs) {
+    nextProcess.on("error", (error) => {
+      console.error("Error starting Next.js:", error);
+      process.exit(1);
+    });
+    nextProcess.on("exit", (code) => {
+      process.exit(code || 0);
+    });
+    return;
   }
 
-  nextProcess.on("error", (error) => {
-    console.error("Error starting Next.js:", error);
-    process.exit(1);
-  });
-
-  nextProcess.on("exit", (code) => {
-    process.exit(code || 0);
+  const failLine = (text: string): void => {
+    process.stderr.write(`${screenKit({ color: colorsEnabled(process.stderr) }).fail(text)}\n`);
+  };
+  watchDashboardStart({
+    child: nextProcess,
+    stdout: process.stdout,
+    stderr: process.stderr,
+    probe: () => probeDashboardPort(dashboardProbeHost(bindHost), Number(port)),
+    onSettled: (outcome) => {
+      if (outcome.kind === "failed") {
+        const lines = launchFailureLines(outcome, {
+          port,
+          portFromFlag: portFlag !== undefined,
+          color: colorsEnabled(process.stderr),
+        });
+        process.stderr.write(`${lines.join("\n")}\n`);
+        process.exit(outcome.code ?? 1);
+        return;
+      }
+      if (showScreen) printScreen(outcome.kind === "ready");
+    },
+    onExit: (code, error) => {
+      if (error) failLine(`The dashboard server failed: ${error.message}`);
+      process.exit(error ? 1 : code || 0);
+    },
   });
 }

package/scripts/skew-log-filter.ts

@@ -44,3 +44,41 @@ export function makeSkewLogFilter(): (line: string) => string | null {
     return line;
   };
 }
+
+/**
+ * Drops Next's own startup banner from the standalone server's stdout, and
+ * reports the moment the server is listening.
+ *
+ * The launch screen prints the dashboard's address itself once the server is
+ * up, so in `start` mode Next's banner would say it a second time, in another
+ * style:
+ *
+ *     ▲ Next.js 16.3.6
+ *     - Local:         http://127.0.0.1:8020
+ *     - Network:       http://127.0.0.1:8020
+ *     ✓ Ready in 0ms
+ *
+ * Next logs `Ready in` from its `listening` handler, straight after the banner,
+ * so that line doubles as the readiness signal (`onReady`). Only those four
+ * shapes are dropped, and only until the ready line; every other line, and
+ * every line after it, passes through verbatim. That is the skew filter's
+ * contract too, and the reason the two are separate: its test pins these exact
+ * lines passing through it.
+ *
+ * The child is coloured when failproofai runs on a terminal, so a line is
+ * matched with its SGR codes stripped and, when kept, emitted as it arrived.
+ */
+export function makeNextStartupFilter(onReady?: () => void): (line: string) => string | null {
+  let listening = false;
+  return (line: string): string | null => {
+    if (listening) return line;
+    const plain = line.replace(/\x1B\[[0-9;]*m/g, "").trim();
+    if (/^(?:✓\s*)?Ready in\b/.test(plain)) {
+      listening = true;
+      onReady?.();
+      return null;
+    }
+    if (/^▲ Next\.js\b/.test(plain) || /^- (?:Local|Network):/.test(plain)) return null;
+    return line;
+  };
+}

package/src/audit/cli-login.ts

@@ -20,16 +20,7 @@ import {
   writeAuth,
   type StoredAuth,
 } from "../../lib/auth/auth-store";
-import {
-  ANSI_RESET,
-  BAR,
-  colorsEnabled,
-  intro,
-  outro,
-  promptText,
-  step,
-  stepOpen,
-} from "../hooks/tui";
+import { INDENT, optsFor, paint, promptText, screenKit } from "../hooks/tui";
 
 const EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
 
@@ -43,18 +34,6 @@ const EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
 const CODE_MIN = 4;
 const CODE_MAX = 12;
 
-/**
- * The spine a prompt hangs off, so the two questions sit inside the same frame
- * `intro`/`outro` draw. Empty when colour is off or output is piped: the frame
- * is decoration, and a log file should not collect box-drawing characters.
- */
-function spine(): string {
-  return colorsEnabled(process.stdout)
-    ? `${ANSI_DIM_BAR}${BAR}${ANSI_RESET}  `
-    : "";
-}
-const ANSI_DIM_BAR = "\x1B[2m";
-
 /**
  * Codes are numeric (`auth/otp.rs` generates digits only), so anything else in
  * the field is packaging: "Your failproof code is 123456", a copied "123 456",
@@ -93,10 +72,9 @@ export interface SignedIn {
 /**
  * Whether a sign-in flow actually ran.
  *
- * The caller uses it to decide whether its confirmation continues an open frame
- * or stands on its own: the `│` spine means "a flow is happening", so printing
- * one under a command that answered instantly from the session file would be a
- * frame with no beginning.
+ * The caller uses it to decide whether its confirmation continues an open
+ * screen or opens its own: a sign-in has already printed the `Audit` header, so
+ * a second one under it would read as a second command.
  */
 export interface EnsureSignedIn {
   user: SignedIn;
@@ -199,35 +177,40 @@ export function invalidEmail(address: string): string | null {
 }
 
 /**
- * The two prompts, inside the frame `failproofai config` uses.
+ * The sign-in screen: `failproofai audit --schedule`'s two prompts.
  *
- * Same logo, same `│` spine, same `◆ / ◇` step glyphs, same pink `└` close —
- * because this is the same product asking, and a sign-in that looked like a
- * different tool would be the one moment the seam showed. It is also the only
- * moment this command asks for something personal, which is the moment worth
- * spending the frame on.
+ * In the language every other screen speaks — the `Audit` header, an
+ * UPPERCASE heading, a field per question, and a `✓` or `✕` line for each
+ * outcome — so a sign-in reads as the same product asking. It used to open
+ * with the full logomark inside `config`'s step spine, on the argument that
+ * the one personal question deserved the frame; the redesign keeps the mark to
+ * bare `failproofai` and `config` (LAUNCH-10), and the wordmark in the header
+ * is what every screen shares.
  *
  * Exported so a test can drive it without the caller.
  */
 export async function runLogin(preset?: string): Promise<SignedIn> {
-  intro("scheduled audits need somewhere to send the report");
+  const k = screenKit(optsFor(process.stdout));
+  const say = (...lines: string[]) => process.stdout.write(`${lines.join("\n")}\n`);
+  say("", k.header("Audit"), "", k.head("Sign in"));
 
   let address: string;
   if (preset) {
     // Supplied on the command line, so the question is already answered — but
-    // it is still SHOWN, as a settled step, because it is the address a code is
-    // about to be sent to and the flag is exactly where a typo hides.
+    // it is still SHOWN, as the field it would have been typed into, because it
+    // is the address a code is about to be sent to and the flag is exactly
+    // where a typo hides.
     address = preset.trim().toLowerCase();
-    step("your email", address);
+    say(`${INDENT}${"email".padEnd(10)}${paint(optsFor(process.stdout).color).pink("›")} ${address}`);
   } else {
     const email = await promptText({
-      prefix: spine(),
-      message: "your email",
+      field: true,
+      message: "email",
       hint: "you@yourdomain.com",
-      validate: (v) => (EMAIL_RE.test(v.trim()) ? null : "that doesn't look like an email"),
+      validate: (v) => (EMAIL_RE.test(v.trim()) ? null : "That doesn't look like an email address."),
     });
     if (email === null) {
-      outro("Cancelled — nothing was changed.", { ok: false });
+      say("Cancelled. Nothing was changed.");
       throw new LoginError("Cancelled.");
     }
     address = email.trim().toLowerCase();
@@ -237,65 +220,62 @@ export async function runLogin(preset?: string): Promise<SignedIn> {
     const sent = await requestLoginCode(address);
     expiresInMin = Math.max(1, Math.ceil(sent.expires_in / 60));
   } catch (err) {
-    outro("Could not send a login code.", { ok: false });
+    say(k.fail("Could not send a login code."));
     throw new LoginError(describeAuthError(err, "Could not send a login code"));
   }
 
-  // The address is echoed back on the settled step rather than left to memory:
-  // a typo in it is the single most likely reason no code arrives, and this is
-  // the last place it can be noticed before somebody starts waiting.
-  step("code sent", `to ${address} · expires in ${expiresInMin} min`);
+  // The address is echoed back rather than left to memory: a typo in it is the
+  // single most likely reason no code arrives, and this is the last place it
+  // can be noticed before somebody starts waiting.
+  say(k.ok(`Sent a code to ${address}, valid for ${expiresInMin} minute${expiresInMin === 1 ? "" : "s"}.`));
 
   // Three attempts, matching the server's own per-code cap. Looping forever
   // would keep a person typing at a code the server stopped accepting after
   // the fifth try, and one attempt would punish a typo with a fresh email.
   const ATTEMPTS = 3;
   for (let attempt = 1; attempt <= ATTEMPTS; attempt += 1) {
-    stepOpen(attempt === 1 ? "the code from that email" : "try that code again");
     const typed = await promptText({
-      prefix: spine(),
+      field: true,
       message: "code",
       // Unmasked on purpose. A login code is single-use and expires in minutes,
       // so hiding it protects nothing and costs the one thing that matters at
       // this prompt: seeing your own typo before pressing enter.
       hint:
         attempt === 1
-          ? "123456 · paste the whole line if you like"
+          ? "123456  ·  paste the whole line if you like"
           : `attempt ${attempt} of ${ATTEMPTS}`,
       validate: (v) => {
         // No digits at all is not a mistyped code, it is not a code — caught
         // here rather than spent as one of the server's five attempts.
-        if (!/\d/.test(v)) return "a code is digits — paste the line from the email";
+        if (!/\d/.test(v)) return "A code is digits. Paste the line from the email.";
         const code = extractCode(v);
-        if (code.length < CODE_MIN) return "that looks too short to be the code";
-        if (code.length > CODE_MAX) return "that looks too long — paste just the code";
+        if (code.length < CODE_MIN) return "That looks too short to be the code.";
+        if (code.length > CODE_MAX) return "That looks too long. Paste just the code.";
         return null;
       },
     });
     if (typed === null) {
-      outro("Cancelled — nothing was changed.", { ok: false });
+      say("Cancelled. Nothing was changed.");
       throw new LoginError("Cancelled.");
     }
 
     try {
       const tokens = await verifyLoginCode(address, extractCode(typed));
       writeAuth(authFromTokenResponse(tokens));
-      step("signed in", tokens.user.email);
+      say(k.ok(`Signed in as ${tokens.user.email}.`));
       return { id: tokens.user.id, email: tokens.user.email };
     } catch (err) {
       const wrongCode = err instanceof AuthApiError && err.code === "invalid_code";
       if (wrongCode && attempt < ATTEMPTS) {
-        step(
-          "that code was wrong or expired",
-          `${ATTEMPTS - attempt} more ${ATTEMPTS - attempt === 1 ? "try" : "tries"} before it asks for a new one`,
-        );
+        // The tries left are on the next field's hint, `attempt 2 of 3`.
+        say(k.fail("That code was wrong or has expired."));
         continue;
       }
-      outro("Could not verify that code.", { ok: false });
+      say(k.fail("Could not verify that code."));
       throw new LoginError(describeAuthError(err, "Could not verify that code"));
     }
   }
-  outro("Too many wrong codes.", { ok: false });
+  say(k.fail("Too many wrong codes."));
   throw new LoginError("Too many wrong codes. Run the command again for a fresh one.");
 }