failproofai 1.0.11-beta.0 → 1.0.11-beta.2

package/src/hooks/collector-config.ts

@@ -137,7 +137,7 @@ export function writeCollectorSettings(settings: CollectorSettings): void {
 
 export type KeyCheck =
   | { ok: true }
-  | { ok: false; reason: string };
+  | { ok: false; reason: string; status?: number };
 
 /**
  * Verify a key against the endpoint before writing it anywhere.
@@ -179,18 +179,19 @@ export async function validateIngestKey(
     if (res.status >= 300 && res.status < 400) {
       return {
         ok: false,
+        status: res.status,
         reason:
           "that URL redirects rather than accepting events — it looks like the dashboard, not the ingest API",
       };
     }
     if (res.status === 401 || res.status === 403) {
-      return { ok: false, reason: `the server rejected that key (${res.status})` };
+      return { ok: false, status: res.status, reason: `the server rejected that key (${res.status})` };
     }
     if (res.status === 404) {
-      return { ok: false, reason: `no ingest endpoint at that URL (404)` };
+      return { ok: false, status: res.status, reason: `no ingest endpoint at that URL (404)` };
     }
     if (!res.ok) {
-      return { ok: false, reason: `the server answered ${res.status}` };
+      return { ok: false, status: res.status, reason: `the server answered ${res.status}` };
     }
     // A 2xx is not enough either. Ingest answers `{"accepted":N,"skipped":M}`;
     // anything else returning 200 (a proxy, a static host, a catch-all router)

package/src/hooks/config-status.ts

@@ -1,10 +1,9 @@
 /**
  * `failproofai config --status`: what this machine is doing, on one screen.
  *
- *   THIS MACHINE   the daemon, the local dashboard, and any paused sessions
+ *   THIS MACHINE   the daemon and any paused sessions
  *   CLOUD          where this machine's data goes, and whether it arrives
- *   ENFORCEMENT    which agents are traced, which policies are on, and what
- *                  they blocked or warned about today
+ *   ENFORCEMENT    which agents are traced and which policies are on
  *
  * Then at most ONE line that needs attention, the most severe thing wrong with
  * its fix. Everything a reader could need to act on also stays in a row, so a
@@ -23,10 +22,9 @@
  * history is rescanned at upgrade.
  */
 import { readFileSync } from "node:fs";
-import { createConnection } from "node:net";
 import { resolve } from "node:path";
-import { resolveDashboardHost } from "../../lib/dashboard-host";
 import { readCloudCredentials } from "./cloud-enrollment";
+import { CODEX_UNTRUSTED_NOTICE, codexHookTrust, type CodexHookTrust } from "./codex-system-hooks";
 import { describeMachine } from "./cloud-enrollment-cli";
 import { cloudBaseFor } from "./cloud-connection";
 import { readActiveCloudManagedPolicies } from "./cloud-managed-policies";
@@ -44,9 +42,8 @@ import { deliveryHealth, type DeliveryHealth } from "./delivery-health";
 import { spoolBacklog } from "./flush-cli";
 import { isAgentTraced, readConfig, readCredentials, readVersionFile } from "./fp-config";
 import { collectorHealthFile, customPoliciesDir } from "./fp-home";
-import { getHookActivityEntriesSince } from "./hook-activity-store";
 import { configuredCustomPolicyPaths, findProjectConfigDir, readMergedHooksConfig } from "./hooks-config";
-import { detectInstalledClis, hermesProfileStatusRows, listInstallableIds } from "./integrations";
+import { detectInstalledClis, listInstallableIds } from "./integrations";
 import { notEnforcingReason, type NotEnforcingReason } from "./manager";
 import { hasInstalledRegexPacks, readInstalledPacks } from "./pack-manifest";
 import { CORE_SOURCE } from "./pack-store";
@@ -55,10 +52,6 @@ import { pauseClockTime, type PauseClock } from "./session-pause-cli";
 import { optsFor, screenKit, type ScreenKitOpts, type TTYOut } from "./tui";
 import type { IntegrationType } from "./types";
 
-/** Where `failproofai` (no arguments) serves the dashboard unless told otherwise. */
-export const STATUS_DASHBOARD_PORT = 8020;
-/** The dashboard probe's whole budget. A status command must not hang on it. */
-export const STATUS_PROBE_TIMEOUT_MS = 150;
 /**
  * A health record older than this was left by a daemon that stopped writing it.
  * The daemon rewrites it every 30 s and deletes it on a clean shutdown, so four
@@ -96,6 +89,7 @@ export type StatusCloud =
       machine?: string;
       pullsPolicies: boolean;
       sendsEvents: boolean;
+      splitKeys?: boolean;
     };
 
 /** Where the policies on this machine come from, counted. */
@@ -140,7 +134,6 @@ export interface StatusFacts {
     skew: { installed: string; expected: string } | null;
     checkCommand: string | null;
   };
-  dashboard: { url: string; listening: boolean };
   pauses: Array<{ sessionId: string; expiresAt: number; cwd?: string }>;
   cloud: StatusCloud;
   /** Absent when nothing is connected. */
@@ -153,10 +146,12 @@ export interface StatusFacts {
   /** notTraced: found on this machine and left out of the selection. */
   agents: { traced: number; notTraced?: number; notInstalled: number };
   policies: StatusPolicies;
-  today: { blocked: number; warned: number };
-  /** Hermes profiles that are not healthy, with what is wrong. Healthy ones are omitted. */
-  hermes: Array<{ profile: string; problem: string }>;
   notEnforcing: NotEnforcingReason | null;
+  /**
+   * Whether Codex runs failproofai's user-scope hooks. Codex skips hooks.json
+   * hooks nobody has trusted, so hooks being installed is not enough.
+   */
+  codex?: CodexHookTrust;
 }
 
 /** Seams for everything that would otherwise reach a service manager, PATH or the network. */
@@ -166,9 +161,8 @@ export interface StatusDeps {
   daemonStatus?: () => DaemonServiceStatus;
   daemonAnswering?: () => boolean;
   detectInstalled?: () => IntegrationType[];
-  probeDashboard?: (host: string, port: number) => Promise<boolean>;
-  hermesRows?: () => Array<[string, string]>;
   notEnforcing?: (cwd?: string) => NotEnforcingReason | null;
+  codexTrust?: () => CodexHookTrust;
 }
 
 /**
@@ -212,63 +206,6 @@ export function readCollectorHealth(file: string = collectorHealthFile()): Statu
   };
 }
 
-/**
- * Whether anything accepts a TCP connection at `host:port`, within the budget.
- *
- * Nothing records that the dashboard is running — it runs in the foreground with
- * no pid file — so the only honest answer is to knock. Connect only: nothing is
- * sent, so a stranger listening on the port learns nothing from it.
- */
-export function probeDashboardListening(
-  host: string,
-  port: number,
-  timeoutMs: number = STATUS_PROBE_TIMEOUT_MS,
-): Promise<boolean> {
-  return new Promise((done) => {
-    let settled = false;
-    const socket = createConnection({ host, port });
-    const finish = (up: boolean) => {
-      if (settled) return;
-      settled = true;
-      clearTimeout(timer);
-      socket.destroy();
-      done(up);
-    };
-    const timer = setTimeout(() => finish(false), timeoutMs);
-    timer.unref?.();
-    socket.once("connect", () => finish(true));
-    socket.once("error", () => finish(false));
-  });
-}
-
-/** Local midnight of the day `now` falls in — where "today" starts for a reader. */
-export function startOfLocalDay(now: number): number {
-  const day = new Date(now);
-  day.setHours(0, 0, 0, 0);
-  return day.getTime();
-}
-
-/**
- * Tool calls blocked (`deny`) and warned about (`instruct`) since `sinceMs`.
- *
- * Read through the store the dashboard's activity tab reads, with its windowed
- * reader, so a long-lived machine pays for today's pages and not its history.
- * Observe-mode verdicts are not counted: they decided nothing.
- */
-export function countDecisionsSince(sinceMs: number): { blocked: number; warned: number } {
-  let blocked = 0;
-  let warned = 0;
-  try {
-    for (const entry of getHookActivityEntriesSince(sinceMs)) {
-      if (entry.decision === "deny") blocked++;
-      else if (entry.decision === "instruct") warned++;
-    }
-  } catch {
-    // An unreadable store is no activity, not a failed status command.
-  }
-  return { blocked, warned };
-}
-
 /**
  * Count where this machine's policies come from.
  *
@@ -345,13 +282,6 @@ export async function gatherStatusFacts(deps: StatusDeps = {}): Promise<StatusFa
   const now = deps.now ?? Date.now();
   const cwd = deps.cwd ?? process.cwd();
 
-  // Started first and awaited last: the probe is the one read that waits, and
-  // everything else here is a file. A wildcard bind is reached on loopback.
-  const bind = resolveDashboardHost(undefined, process.env.FAILPROOFAI_DASHBOARD_HOST).replace(/^\[(.*)\]$/, "$1");
-  const probeHost = bind === "0.0.0.0" ? "127.0.0.1" : bind === "::" ? "::1" : bind;
-  const dashboardUrl = `http://${probeHost.includes(":") ? `[${probeHost}]` : probeHost}:${STATUS_DASHBOARD_PORT}`;
-  const listening = (deps.probeDashboard ?? probeDashboardListening)(probeHost, STATUS_DASHBOARD_PORT).catch(() => false);
-
   const daemon: StatusFacts["daemon"] = {
     supported: isDaemonSupportedPlatform(),
     platform: process.platform,
@@ -394,6 +324,7 @@ export async function gatherStatusFacts(deps: StatusDeps = {}): Promise<StatusFa
         ...(machineId ? { machine: describeMachine(machineId, creds?.machineLabel) } : {}),
         pullsPolicies: Boolean(creds),
         sendsEvents: Boolean(ingest),
+        ...(creds && ingest && creds.token !== ingest.key ? { splitKeys: true } : {}),
       };
     }
   }
@@ -418,18 +349,6 @@ export async function gatherStatusFacts(deps: StatusDeps = {}): Promise<StatusFa
     detected = new Set();
   }
 
-  // hermesProfileStatusRows keeps its own wording for each problem, and its
-  // rows are pinned by its own tests; only the unhealthy ones are shown here.
-  const unhealthy = "UNHEALTHY — ";
-  let hermes: StatusFacts["hermes"] = [];
-  try {
-    hermes = (deps.hermesRows ?? hermesProfileStatusRows)()
-      .filter(([, value]) => value.startsWith(unhealthy))
-      .map(([label, value]) => ({ profile: label.replace(/^hermes\//, ""), problem: value.slice(unhealthy.length) }));
-  } catch {
-    // Hermes config unreadable as a whole: its own commands report that.
-  }
-
   let notEnforcing: NotEnforcingReason | null = null;
   try {
     notEnforcing = (deps.notEnforcing ?? notEnforcingReason)(cwd);
@@ -440,7 +359,6 @@ export async function gatherStatusFacts(deps: StatusDeps = {}): Promise<StatusFa
   return {
     now,
     daemon,
-    dashboard: { url: dashboardUrl, listening: await listening },
     pauses: listActivePauses(now).map((pause) => ({
       sessionId: pause.sessionId,
       expiresAt: pause.expiresAt,
@@ -454,17 +372,26 @@ export async function gatherStatusFacts(deps: StatusDeps = {}): Promise<StatusFa
       notInstalled: known.filter((id) => !detected.has(id)).length,
     },
     policies: summarizePolicySources(cwd),
-    today: countDecisionsSince(startOfLocalDay(now)),
-    hermes,
     notEnforcing,
+    codex: readCodexTrust(deps),
   };
 }
 
+function readCodexTrust(deps: StatusDeps): CodexHookTrust {
+  try {
+    return (deps.codexTrust ?? codexHookTrust)();
+  } catch {
+    return { kind: "none" };
+  }
+}
+
 /** The one line that needs attention, before it is painted. */
 export interface StatusAttention {
   severity: "fail" | "caution";
   text: string;
   fix?: string;
+  /** A second line for a fix that is more than one command; `backticks` mark commands. */
+  detail?: string;
 }
 
 /**
@@ -509,15 +436,9 @@ export function pickStatusAttention(facts: StatusFacts): StatusAttention | null
             : `failproofai policies add ${CORE_SOURCE}`;
     return { severity: "caution", text: "Policies are not enforcing yet.", fix };
   }
-  if (facts.hermes.length > 0) {
-    return {
-      severity: "caution",
-      text:
-        facts.hermes.length === 1
-          ? `Hermes profile ${facts.hermes[0].profile} is unhealthy.`
-          : `${facts.hermes.length} Hermes profiles are unhealthy.`,
-      fix: "failproofai update",
-    };
+  if (facts.codex?.kind === "untrusted") {
+    const [text, fixLine] = CODEX_UNTRUSTED_NOTICE.split("\n");
+    return { severity: "caution", text, detail: fixLine };
   }
   if (cloud.kind !== "none" && !daemon.answering && daemon.service !== "running") {
     const idle =
@@ -634,9 +555,20 @@ export function renderStatusScreen(facts: StatusFacts, opts: ScreenKitOpts & { c
     return policies.anyPack ? `0 on from ${policies.anyPack}` : "None installed";
   };
 
+  // Only when failproofai's Codex hooks are installed at user scope: whether
+  // Codex actually runs them is the one per-agent fact this screen keeps,
+  // because hooks being written does not make them run.
+  const codexValue = (): string | null => {
+    const codex = facts.codex;
+    if (!codex || codex.kind === "none") return null;
+    if (codex.kind === "system") return `${kit.on} Enforcing (system config)`;
+    if (codex.kind === "trusted") return `${kit.on} Enforcing (hooks trusted)`;
+    if (codex.kind === "ungated") return `${kit.on} Enforcing`;
+    return `${kit.off} Not enforcing: ${codex.untrusted === codex.total ? "hooks not trusted" : `${codex.untrusted} of ${codex.total} hooks not trusted`}`;
+  };
+
   const machineRows: Array<[string, string]> = [
     ["daemon", daemonValue()],
-    ["dashboard", facts.dashboard.listening ? `${kit.on} ${kit.cmd(facts.dashboard.url)}` : `${kit.off} Not running`],
     ["paused", facts.pauses.length === 0 ? "No" : many(facts.pauses.length, "session")],
     // One row per pause, under the value column: the id is what
     // `--resume --session <id>` needs, so it is never folded into a count.
@@ -664,6 +596,9 @@ export function renderStatusScreen(facts: StatusFacts, opts: ScreenKitOpts & { c
                 `${cloud.pullsPolicies ? "" : ", for reporting only"}`,
             ],
             ...(cloud.machine ? [["machine", cloud.machine] as [string, string]] : []),
+            ...(cloud.splitKeys
+              ? [["keys", `Policy and ingest use different keys; reconnect with ${kit.cmd("failproofai config")}.`] as [string, string]]
+              : []),
             ["delivery", deliveryValue()],
           ];
 
@@ -675,13 +610,7 @@ export function renderStatusScreen(facts: StatusFacts, opts: ScreenKitOpts & { c
         (agents.notInstalled > 0 ? `, ${agents.notInstalled} not installed` : ""),
     ],
     ["policies", policiesValue()],
-    ["today", `${facts.today.blocked} blocked, ${facts.today.warned} warned`],
-    // The problem keeps hermesProfileStatusRows' own words; a `command` in them
-    // is painted as one, the way every command on this screen is.
-    ...facts.hermes.map((profile, i): [string, string] => [
-      i === 0 ? "hermes" : "",
-      kit.caution(`${profile.profile}: ${profile.problem.replace(/`([^`]+)`/g, (_, typed: string) => kit.cmd(typed))}`),
-    ]),
+    ...(codexValue() ? [["codex", codexValue()!] as [string, string]] : []),
   ];
 
   const sections: Array<[string, Array<[string, string]>]> = [
@@ -699,7 +628,11 @@ export function renderStatusScreen(facts: StatusFacts, opts: ScreenKitOpts & { c
 
   const attention = pickStatusAttention(facts);
   if (attention) {
-    screen.push("", attention.severity === "fail" ? kit.fail(attention.text, attention.fix) : kit.caution(attention.text, attention.fix));
+    if (attention.detail) {
+      screen.push("", ...kit.notice(attention.severity, `${attention.text}\n${attention.detail}`));
+    } else {
+      screen.push("", attention.severity === "fail" ? kit.fail(attention.text, attention.fix) : kit.caution(attention.text, attention.fix));
+    }
   }
   if (facts.pauses.length > 0) {
     const id = facts.pauses.length === 1 ? facts.pauses[0].sessionId : "<id>";

package/src/hooks/configure-wizard.ts

@@ -1,14 +1,13 @@
 /**
  * `failproofai config` — the interactive setup launcher.
  *
- * Five steps, in the order the machine needs them:
+ * Four steps, in the order the machine needs them:
  *
  *   1. Daemon  — REQUIRED. Asks for sudo first, on a clean terminal.
  *   2. Connect — one masked API-key field; Tab for open source.
  *   3. Agents  — which agents failproofai traces: hooks, collection and
  *                backfill all follow this one saved list.
- *   4. OTEL    — optional, default No, on interactive Cloud setup only.
- *   5. Done    — applied after the last answer; there is no separate review.
+ *   4. Done    — applied after the last answer; there is no separate review.
  *                Esc at any step before that changes nothing.
  *
  * ## Two ordering rules that are not cosmetic
@@ -31,7 +30,6 @@ import { dirname, resolve, sep } from "node:path";
 import { CORE_SOURCE } from "./pack-store";
 
 import {
-  selectOne,
   collapseAfter,
   colorsEnabled,
   multiSelect,
@@ -58,6 +56,12 @@ import {
 } from "./integrations";
 import { INTEGRATION_TYPES, type IntegrationType, type HookScope } from "./types";
 import { enforcingPolicyCount, installHooks, notEnforcingReason } from "./manager";
+import {
+  CODEX_UNTRUSTED_NOTICE,
+  codexHookTrust,
+  removeCodexSystemHooks,
+  type CodexHookTrust,
+} from "./codex-system-hooks";
 import { readInstalledPacks } from "./pack-manifest";
 import { getConfigPathForScope, readScopedHooksConfig } from "./hooks-config";
 import { discoverPolicyFiles, findSkippedPolicyFiles } from "./custom-hooks-loader";
@@ -406,6 +410,15 @@ export function removeUserScopeHooks(clis: IntegrationType[], cwd: string): numb
   for (const id of clis) {
     const integration = getIntegration(id);
     if (!integration.scopes.includes("user")) continue;
+    if (id === "codex") {
+      // Codex's user-scope hooks may live in its system config instead; setup
+      // primed sudo, so taking them out of there needs no prompt.
+      const system = removeCodexSystemHooks();
+      if (system.status === "removed") removed += system.hooks;
+      else if (system.status === "failed") {
+        hookLogWarn(`could not remove failproofai's Codex hooks from ${system.path}: ${system.reason}`);
+      }
+    }
     for (const settingsPath of settingsPathsFor(integration, "user", cwd)) {
       // Hermes is asked even without a config file, so it can clear a plugin
       // directory left behind by an interrupted install.
@@ -709,7 +722,6 @@ export async function runConfigureWizard(
   const stdin: TTYIn = io.stdin ?? process.stdin;
   const stdout: TTYOut = io.stdout ?? process.stdout;
   const cwd = process.cwd();
-  const home = process.env.HOME || homedir();
   const started = Date.now();
   // No terminal means no questions — not a refusal.
   //
@@ -908,6 +920,9 @@ export async function runConfigureWizard(
   // — no `connectToCloud`, which would reset collector settings — after
   // checking that it still works.
   const saved = savedConnection();
+  if (saved?.splitKeys) {
+    write([kit.caution("Saved policy and ingest keys differ. Paste one replacement key to reconcile them, or Tab to leave both unchanged.")]);
+  }
   const urlChoice = resolveCloudUrl(answers.url, saved?.url);
   // An unusable --url or FAILPROOFAI_CLOUD_URL is refused loudly, never a silent
   // fall-back to the hosted service: whoever set it wants THAT endpoint, and
@@ -953,7 +968,7 @@ export async function runConfigureWizard(
       meta: source ? `${host}  ·  from ${source}` : host,
       tabHint: saved ? "skip" : "use open source instead",
       emptyError: saved ? "Paste a key, or press tab to skip." : "Paste a key, or press tab to use open source.",
-      saved: saved
+      saved: saved && !saved.splitKeys
         ? {
             masked: maskToken(saved.token),
             check: async () => {
@@ -1068,45 +1083,12 @@ export async function runConfigureWizard(
     if (picked === null) return cancel();
     selected = plan.order.filter((id) => picked.includes(id));
   }
-  // Optional OTEL choice is never implied by unattended setup or a pasted key.
-  const { chooseWizardOtel, runOtelCommand } = await import("./otel-cli");
-  let otelCancelled = false;
-  const otelWanted = !unattended && !preAnswered && cloud.kind === "connect" && await chooseWizardOtel(
-    async message => {
-      const answer = await selectOne({
-        message,
-        choices: [
-          { label: "No", value: false, hint: "keep current telemetry" },
-          { label: "Yes", value: true, hint: "choose OTEL agents" },
-        ],
-        collapsed: value => [kit.head("OpenTelemetry"), kit.ok(value ? "Opting in to OTEL." : "Keeping current telemetry."), ""],
-        stdin, stdout,
-      });
-      otelCancelled = answer === null;
-      return answer === true;
-    },
-  );
-  if (otelCancelled) return cancel();
-  let otelAgents: string[] = [];
-  if (otelWanted) {
-    const picked = await multiSelect({
-      message: "Which agents should send OpenTelemetry?",
-      choices: [
-        { label: "Gemini CLI", value: "gemini", checked: false },
-        { label: "Copilot (VS Code)", value: "copilot", checked: false },
-        { label: "Claude Code", value: "claude", checked: false },
-        { label: "Codex", value: "codex", checked: false },
-      ],
-      stdin, stdout,
-    });
-    if (picked === null) return cancel();
-    otelAgents = picked;
-  }
   const { added, removed } = agentChanges(plan, selected);
 
   // ── Apply ─────────────────────────────────────────────────────────────────
   //
-  // The agents step (or the optional OTEL choice) was the last decision.
+  // The agents step was the last decision. OpenTelemetry is not part of setup:
+  // it is opt-in, per agent, through `failproofai otel enable <agent>`.
   // ORDER MATTERS here:
   //
   //  1. The daemon first, because setup requires it: if it cannot be installed
@@ -1305,6 +1287,7 @@ export async function runConfigureWizard(
         }),
       );
       connected = outcome.anyConfigured;
+      done.push(...(outcome.changes ?? []));
       done.push(...connectDoneLines(kit, outcome, host, cloud.org));
       if (outcome.ingest.ok && answers.noTranscripts === true) {
         done.push("  Decisions only: session transcripts are not sent (--no-transcripts).");
@@ -1321,23 +1304,6 @@ export async function runConfigureWizard(
     updateConfig({ mode: "cloud" });
   }
 
-  if (otelWanted && connected) {
-    for (const agent of otelAgents) {
-      const result = await runOtelCommand(["enable", agent], {
-        home,
-        onEvent: emit,
-        confirm: async message => await selectOne({
-          message,
-          choices: [
-            { label: "No", value: false, hint: "keep transcript upload" },
-            { label: "Yes", value: true, hint: "switch to OTEL" },
-          ],
-          stdin, stdout,
-        }) === true,
-      });
-      done.push(...result.lines.map(line => result.exitCode === 0 ? kit.ok(line) : kit.fail(line)));
-    }
-  }
   await applied;
   // Only now — a completed apply — is the launcher considered "seen", so
   // first-run onboarding stops offering itself on every command.
@@ -1345,7 +1311,20 @@ export async function runConfigureWizard(
   // And any record of an earlier failure is now false: this machine got set up.
   clearOnboardingAttempt();
 
-  write(doneLines(kit, { elapsedMs: Date.now() - started, done, cwd, agents: selected.length, connected: connected || cloud.kind === "kept" }));
+  // Codex runs hooks from hooks.json only once they are trusted; from its
+  // system config always. Said here, and not counted as enforcing until it is.
+  const codexTrust = selected.includes("codex") ? codexHookTrust() : undefined;
+  if (codexTrust?.kind === "system") done.push(kit.ok(`Codex hooks are in its system config (${codexTrust.path}), which Codex runs without asking`));
+  write(
+    doneLines(kit, {
+      elapsedMs: Date.now() - started,
+      done,
+      cwd,
+      agents: selected.length,
+      connected: connected || cloud.kind === "kept",
+      codexTrust,
+    }),
+  );
 
   return {
     applied: true,
@@ -1373,11 +1352,12 @@ type CloudPlan =
  * one and the collector's ingest key. Reading only the first, as setup used to,
  * showed a collector-only machine as unconnected.
  */
-function savedConnection(): {
+export function savedConnection(): {
   url: string;
   token: string;
   org?: string;
   machineLabel?: string;
+  splitKeys?: boolean;
 } | null {
   const cloud = readCloudCredentials();
   const ingest = readIngestCredential();
@@ -1391,7 +1371,10 @@ function savedConnection(): {
   } catch {
     org = undefined;
   }
-  return { url, token, org, machineLabel: cloud?.machineLabel };
+  return {
+    url, token, org, machineLabel: cloud?.machineLabel,
+    ...(cloud && ingest && cloud.token !== ingest.key ? { splitKeys: true } : {}),
+  };
 }
 
 /**
@@ -1533,10 +1516,14 @@ function failClosedPacks(): Array<{ id: string | null }> {
  */
 export function doneLines(
   kit: ReturnType<typeof screenKit>,
-  state: { elapsedMs: number; done: string[]; cwd: string; agents: number; connected: boolean },
+  state: { elapsedMs: number; done: string[]; cwd: string; agents: number; connected: boolean; codexTrust?: CodexHookTrust },
 ): string[] {
   const lines = [kit.head("Done", `in ${(state.elapsedMs / 1000).toFixed(1)}s`), ...state.done];
-  const on = `${state.agents} ${state.agents === 1 ? "agent" : "agents"}`;
+  // Codex with untrusted hooks runs none of them: it is not an agent anything
+  // enforces on, whatever was written.
+  const codexSkips = state.codexTrust?.kind === "untrusted";
+  const agents = codexSkips ? Math.max(0, state.agents - 1) : state.agents;
+  const on = `${agents} ${agents === 1 ? "agent" : "agents"}`;
   if (notEnforcingReason(state.cwd)) {
     lines.push(
       kit.caution("Policies are not enforcing yet."),
@@ -1544,7 +1531,9 @@ export function doneLines(
     );
   } else {
     const { count, custom } = enforcingPolicyCount(state.cwd);
-    if (count > 0 || custom) {
+    // Codex was the only agent, and it runs none of the hooks: nothing enforces anywhere.
+    const nowhere = codexSkips && agents === 0;
+    if ((count > 0 || custom) && !nowhere) {
       lines.push(
         kit.ok(
           count === 0
@@ -1569,10 +1558,11 @@ export function doneLines(
           first.id ? `failproofai policies remove ${first.id}` : "failproofai policies",
         ),
       );
-    } else if (count === 0 && !custom) {
+    } else if (count === 0 && !custom && !nowhere) {
       lines.push(kit.ok(`Policies are enforcing on ${on}.`));
     }
   }
+  if (codexSkips) lines.push(...kit.notice("caution", CODEX_UNTRUSTED_NOTICE));
   if (!state.connected) lines.push(`  Connect to cloud any time:  ${kit.cmd("failproofai config")}`);
   for (const warning of describeCustomPolicies(state.cwd).warnings) {
     lines.push(kit.caution(warning.replace(/^! /, "")));

package/src/hooks/credential-recovery.ts

@@ -0,0 +1,36 @@
+/**
+ * Redrive authentication refusals only after a verified ingest-key replacement.
+ * Queues from a different (or unconfirmed) org are retained, never sent.
+ */
+import { createHash } from "node:crypto";
+import { existsSync, mkdirSync, readdirSync, renameSync } from "node:fs";
+import { join } from "node:path";
+import { writeJsonAtomically } from "../../lib/atomic-write";
+import { failedDir, stateDir } from "./fp-home";
+import { flushRequestPath } from "./flush-cli";
+
+export function previousOrgDirectory(id?: string): string {
+  const safe = id && /^[A-Za-z0-9_-]{1,128}$/.test(id)
+    ? id
+    : id ? createHash("sha256").update(id).digest("hex") : "unknown";
+  return join(stateDir(), "previous-org", safe);
+}
+
+export function recoverCredentialRefusals(sameOrg: boolean, oldOrgId?: string): number {
+  const dir = failedDir();
+  if (!existsSync(dir)) return 0;
+  let recovered = 0;
+  for (const name of readdirSync(dir)) {
+    if (!/\.c(401|403)\.jsonl$/.test(name) || name.startsWith(".")) continue;
+    const targetDir = sameOrg ? dir : join(previousOrgDirectory(oldOrgId), "failed");
+    mkdirSync(targetDir, { recursive: true, mode: 0o700 });
+    const targetName = sameOrg ? name.replace(/\.c(401|403)(?=\.jsonl$)/, "") : name;
+    const target = join(targetDir, targetName);
+    // Never overwrite the only copy of another undelivered batch.
+    if (existsSync(target)) continue;
+    renameSync(join(dir, name), target);
+    recovered++;
+  }
+  if (sameOrg && recovered > 0) writeJsonAtomically(flushRequestPath(), { requestedAtMs: Date.now() });
+  return recovered;
+}

package/src/hooks/daemon-service.ts

@@ -548,7 +548,7 @@ export function canElevate(): boolean {
  * cannot elevate silently gets a clear reason and the manual commands
  * instead — it keeps working exactly as it did, on the in-process path.
  */
-function runPrivileged(command: string, args: string[]): void {
+export function runPrivileged(command: string, args: string[]): void {
   const root = typeof process.getuid === "function" && process.getuid() === 0;
   const [cmd, argv] = root ? [command, args] : ["sudo", ["-n", command, ...args]];
   execFileSync(cmd, argv, { stdio: "ignore", timeout: SERVICE_CMD_TIMEOUT_MS });
@@ -559,7 +559,7 @@ function runPrivileged(command: string, args: string[]): void {
  * caller is not root and cannot write there directly. `install -m` sets the
  * mode in the same step, so the file is never briefly world-writable.
  */
-function writePrivilegedFile(destination: string, contents: string, mode = "0644"): void {
+export function writePrivilegedFile(destination: string, contents: string, mode = "0644"): void {
   // mkdtempSync, not a name built from pid + timestamp in the shared tmpdir.
   // That name is guessable, and `writeFileSync` follows a symlink already
   // sitting at the path — so on a multi-user box another local user could