failproofai 1.0.11-beta.1 → 1.0.11-beta.2

package/src/hooks/cloud-connection.ts

@@ -29,9 +29,12 @@
  * exact confusion this module removes.
  */
 import {
+  clearCloudCredentials,
   cloudCredentialPath,
   validateCloudUrl,
   verifyCloudCredentials,
+  maskToken,
+  readCloudCredentials,
   writeCloudCredentials,
   type CloudCredentials,
 } from "./cloud-enrollment";
@@ -57,9 +60,12 @@ import {
   ingestPath,
   validateIngestKey,
   writeCollectorSettings,
-  writeIngestCredential,
   type CollectorSettings,
 } from "./collector-config";
+import { recoverCredentialRefusals } from "./credential-recovery";
+import { clearActiveCloudManagedPolicies } from "./cloud-managed-policies";
+import { rmSync } from "node:fs";
+import { backfillRequestPath } from "./backfill-request";
 
 /**
  * The path ingest is served on, appended to the cloud base URL.
@@ -147,6 +153,8 @@ export interface CapabilityOutcome {
 }
 
 export interface ConnectOutcome {
+  /** Reconciliation changes, already masked and safe to print. */
+  changes?: string[];
   policy: CapabilityOutcome & { policyCount?: number; deployment?: number };
   ingest: CapabilityOutcome;
   /**
@@ -201,6 +209,8 @@ export interface JevConnectOutcome {
  * connection the machine does not have.
  */
 export async function connectToCloud(input: ConnectInput): Promise<ConnectOutcome> {
+  const prev = readCredentials();
+  const previousPolicy = readCloudCredentials();
   // Checked HERE, not only at the call sites. `ConnectInput.url` is documented
   // as "already validated by `validateCloudUrl`", and that was true of exactly
   // one of the two callers: `--connect` validated, and the interactive wizard —
@@ -289,10 +299,81 @@ export async function connectToCloud(input: ConnectInput): Promise<ConnectOutcom
       : undefined,
   };
 
+  outcome.anyConfigured = policyResult.ok || ingestResult.ok;
+  if (!outcome.anyConfigured) return outcome;
+
+  const origin = new URL(input.url).origin;
+  const sameOrigin = (url: string) => {
+    try { return new URL(url).origin === origin; } catch { return false; }
+  };
+  const unknown = (result: { ok: true } | { ok: false; status?: number }) =>
+    !result.ok && (result.status === undefined || result.status >= 500);
+  const next = { ...prev, connectedAt: Date.now() };
+  const changes: string[] = [];
+  const hadConnection = Boolean(previousPolicy || prev.ingest || prev.jev || prev.org);
+  const keyChanged = [
+    previousPolicy ? { token: previousPolicy.token, url: previousPolicy.url } : undefined,
+    prev.ingest ? { token: prev.ingest.key, url: prev.ingest.url } : undefined,
+    prev.jev ? { token: prev.jev.key, url: prev.jev.url } : undefined,
+  ].some((slot) => slot && (slot.token !== input.token || !sameOrigin(slot.url)));
+  const orgSwitch = hadConnection && (
+    (prev.org?.id && known?.orgId && prev.org.id !== known.orgId) ||
+    ((!prev.org?.id || !known?.orgId) && keyChanged) ||
+    (previousPolicy && !sameOrigin(previousPolicy.url)) ||
+    (prev.ingest && !sameOrigin(prev.ingest.url))
+  );
+  const boundary = orgSwitch || prev.org?.since === undefined ? next.connectedAt : prev.org.since;
+  if (orgSwitch) {
+    rmSync(backfillRequestPath(), { force: true });
+    const oldOrg = prev.org?.name ?? prev.org?.slug ?? prev.org?.id ?? "the previous org";
+    const newOrg = known?.orgName ?? known?.orgSlug ?? known?.orgId ?? "the new org";
+    changes.push(`Switched from ${oldOrg} to ${newOrg}. Nothing recorded before now will be sent to ${newOrg}; ${oldOrg}'s cloud policies stop within ~30 s.`);
+    // Remove local references, not the daemon's policy-floor state (#899).
+    clearActiveCloudManagedPolicies();
+  }
   if (policyResult.ok) {
-writeCloudCredentials(creds);
-    outcome.anyConfigured = true;
+    next.cloud = creds;
+  } else if (
+    !canPolicy || !unknown(policyResult) ||
+    previousPolicy?.token !== input.token || !sameOrigin(previousPolicy.url)
+  ) {
+    delete next.cloud;
+    if (previousPolicy) {
+      changes.push(`Removed the previous policy key ${maskToken(previousPolicy.token)}: this key can't pull policies (${PERMISSION_POLICIES}).`);
+      clearActiveCloudManagedPolicies();
+    }
+  }
+  if (ingestResult.ok) {
+    next.ingest = { url: ingestUrl, key: input.token };
+  } else if (
+    !canIngest || !unknown(ingestResult) ||
+    prev.ingest?.key !== input.token || !sameOrigin(prev.ingest.url)
+  ) {
+    delete next.ingest;
+    if (prev.ingest) changes.push(`Removed the previous ingest key ${maskToken(prev.ingest.key)}: this key can't send events (${PERMISSION_EVENTS}).`);
   }
+  if (known && hasPermission(known, PERMISSION_JEV)) {
+    next.jev = { url: origin, key: input.token };
+  } else if (known || prev.jev?.key !== input.token || !sameOrigin(prev.jev.url)) {
+    delete next.jev;
+    if (prev.jev) changes.push(`Removed the previous Jev key ${maskToken(prev.jev.key)}: this key's ${PERMISSION_JEV} permission was not verified.`);
+  }
+  if (known) {
+    next.org = { id: known.orgId, slug: known.orgSlug, name: known.orgName, since: boundary };
+  } else {
+    next.org = { ...(orgSwitch ? {} : prev.org), since: boundary };
+  }
+  if (ingestResult.ok && prev.ingest && prev.ingest.key !== input.token) {
+    recoverCredentialRefusals(Boolean(prev.org?.id && prev.org.id === known?.orgId && sameOrigin(prev.ingest.url)), prev.org?.id);
+  }
+  writeCredentials(next);
+  // Legacy JSON override remains supported; the consolidated file above is
+  // published once, never as a mixture of previous and replacement slots.
+  if (process.env.FAILPROOFAI_CLOUD_CREDENTIALS) {
+    if (policyResult.ok) writeCloudCredentials(creds);
+    else if (!next.cloud) clearCloudCredentials();
+  }
+  outcome.changes = changes;
 
   // Mode is the hard gate, set only once a capability actually verified.
   // "cloud" is never inferred from a token merely being present: a machine
@@ -302,7 +383,6 @@ writeCloudCredentials(creds);
   }
 
   if (ingestResult.ok) {
-    writeIngestCredential({ url: ingestUrl, key: input.token });
     const settings: CollectorSettings = {
       // Hook activity is what makes the dashboard show anything at all, and it
       // carries decisions and tool names — never file contents.
@@ -319,17 +399,6 @@ writeCloudCredentials(creds);
     outcome.anyConfigured = true;
   }
 
-  // Last, and only once something actually configured: recording an org for a
-  // machine that connected to nothing would be a claim about where data goes
-  // from a machine that sends none. Merged into whatever the two writers above
-  // just wrote, so it cannot race them.
-  if (outcome.anyConfigured && known && (known.orgId || known.orgSlug || known.orgName)) {
-    writeCredentials({
-      ...readCredentials(),
-      org: { id: known.orgId, slug: known.orgSlug, name: known.orgName },
-    });
-  }
-
   // ── Jev, last ─────────────────────────────────────────────────────────────
   //
   // Only from introspect's answer. `jev:evaluate` spends the org's budget on
@@ -394,7 +463,7 @@ writeCloudCredentials(creds);
       // there can only fall back with `http-404` — never spend — and clearing
       // it would turn Jev off on no evidence. It gets no line when there was
       // no slot, because on such a server there is nothing to say about Jev.
-      const previous = readCredentials().jev;
+      const previous = prev.jev;
       if (!previous) {
         if (identity.kind === "unreachable") outcome.jev = { ok: false, unconfirmed: "none" };
       } else if (previous.key === input.token && previous.url === new URL(input.url).origin) {
@@ -483,7 +552,7 @@ export function jevLines(outcome: ConnectOutcome): string[] {
  * without a cause is the message that sends people to support.
  */
 export function describeOutcome(outcome: ConnectOutcome, machineId: string, url: string): string[] {
-  const lines: string[] = [];
+  const lines: string[] = [...(outcome.changes ?? [])];
 
   // Named on every branch that connected, including the partial ones. A key
   // pasted from the wrong organisation authenticates perfectly and reports into

package/src/hooks/cloud-enrollment.ts

@@ -224,7 +224,7 @@ export function clearCloudCredentials(): boolean {
 
 export type VerifyResult =
   | { ok: true; policyCount: number; deployment: number }
-  | { ok: false; reason: string };
+  | { ok: false; reason: string; status?: number };
 
 /**
  * Prove the credentials work before reporting success.
@@ -256,16 +256,17 @@ export async function verifyCloudCredentials(creds: CloudCredentials): Promise<V
   }
 
   if (response.status === 401) {
-    return { ok: false, reason: "The server rejected this token (401). Check the key was copied whole." };
+    return { ok: false, status: 401, reason: "The server rejected this token (401). Check the key was copied whole." };
   }
   if (response.status === 403) {
     return {
       ok: false,
+      status: 403,
       reason: "This key is valid but lacks the `policies:pull` permission (403). Create a machine key with that permission.",
     };
   }
   if (!response.ok) {
-    return { ok: false, reason: `The server answered ${response.status} ${response.statusText}.` };
+    return { ok: false, status: response.status, reason: `The server answered ${response.status} ${response.statusText}.` };
   }
 
   try {

package/src/hooks/cloud-managed-policies.ts

@@ -148,8 +148,9 @@ export function resolveManagedPath(root: string, candidate: string): string {
 /**
  * Stop enforcing cloud-managed policies on this machine.
  *
- * Removes `active.json` only — the manifest that says which deployment is
- * live. The deployment directories and content-addressed artifacts are left
+ * Removes `active.json` and the cached `desired-state.json`: a stopped daemon
+ * must not rebuild a deployment after the machine disconnects. The deployment
+ * directories and content-addressed artifacts are left
  * alone: they are large, hash-verified on use, and inert once nothing points
  * at them, so keeping them makes a reconnect cheap and offline-safe.
  *
@@ -163,16 +164,19 @@ export function resolveManagedPath(root: string, candidate: string): string {
  * Returns true when a manifest was actually removed.
  */
 export function clearActiveCloudManagedPolicies(): boolean {
-  const activePath = resolve(cloudManagedPolicyRoot(), "active.json");
-  if (!existsSync(activePath)) return false;
-  try {
-    rmSync(activePath, { force: true });
-    return true;
-  } catch {
-    // Best-effort: `--disconnect` still clears the credentials, and reporting
-    // a failure to remove one file would obscure that the rest succeeded.
-    return false;
+  let removed = false;
+  for (const name of ["active.json", "desired-state.json"]) {
+    const path = resolve(cloudManagedPolicyRoot(), name);
+    if (!existsSync(path)) continue;
+    try {
+      rmSync(path, { force: true });
+      removed = true;
+    } catch {
+      // Try both independently: a failure removing one must not leave the
+      // other referenced merely because it came later in the list.
+    }
   }
+  return removed;
 }
 
 export function readActiveCloudManagedPolicies(): CloudManagedPolicyArtifact[] {