failproofai 1.0.11 → 1.0.12-beta.0

package/dist/worker.mjs

@@ -1165,7 +1165,7 @@ function instruct(reason) {
 }
 
 // package.json
-var version = "1.0.11";
+var version = "1.0.12-beta.0";
 var init_package = () => {};
 
 // src/hooks/policy-types.ts

package/hermes-plugin/plugin.yaml

@@ -1,5 +1,5 @@
 name: failproofai
-version: 1.0.11
+version: 1.0.12-beta.0
 description: Real-time FailproofAI policy enforcement for Hermes
 manifest_version: 2
 api_version: 1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "failproofai",
-  "version": "1.0.11",
+  "version": "1.0.12-beta.0",
   "description": "Observability and enforcement for AI agent harnesses. 40 built-in policies hooked into 12 of them — Claude Code, Codex, Cursor, Hermes, OpenClaw and more — blocking the tool call before it runs. Local dashboard included, no account needed.",
   "bin": {
     "failproofai": "./dist/cli.mjs",
@@ -81,7 +81,7 @@
     "access": "public"
   },
   "devDependencies": {
-    "@anthropic-ai/sdk": "^0.133.0",
+    "@anthropic-ai/sdk": "^0.135.0",
     "@mdx-js/mdx": "^3.1.1",
     "@tailwindcss/postcss": "^4.3.1",
     "@tanstack/react-virtual": "^3.14.10",
@@ -117,7 +117,7 @@
     "nanoid": "3.3.18",
     "postcss": "8.5.26",
     "eslint-plugin-react-hooks": "7.0.1",
-    "vite": "8.0.16",
+    "vite": "8.1.6",
     "undici": "7.29.1",
     "brace-expansion": "5.0.12",
     "sharp": "0.35.5",
@@ -125,15 +125,15 @@
     "browserslist": "4.28.8"
   },
   "optionalDependencies": {
-    "@failproofai/failproofaid-linux-x64": "1.0.11",
-    "@failproofai/failproofaid-linux-arm64": "1.0.11",
-    "@failproofai/failproofaid-darwin-x64": "1.0.11",
-    "@failproofai/failproofaid-darwin-arm64": "1.0.11"
+    "@failproofai/failproofaid-linux-x64": "1.0.12-beta.0",
+    "@failproofai/failproofaid-linux-arm64": "1.0.12-beta.0",
+    "@failproofai/failproofaid-darwin-x64": "1.0.12-beta.0",
+    "@failproofai/failproofaid-darwin-arm64": "1.0.12-beta.0"
   },
   "failproofaidBinaries": {
-    "linux-x64": "49b11d95dafeb2dfecc3b92d7e18243e6b93706ebc2baf44fee9d8875ee1f90a",
-    "linux-arm64": "720702120b1a2427e8ccf2d53f2e782f1f549c4b2da8880832af5b468eeefab6",
-    "darwin-x64": "8861a67d2155831fa6a3699c59ebcfe7eeabf6c6234ef57b2165b52b78e7e3ca",
-    "darwin-arm64": "4acf268dd92bc928d29feb90a3ca7162bf7505af781ae51f56e7b3899420327a"
+    "linux-x64": "61710dd6261ff0deb1116e390c366c26809bf04bb2e2c16f279b7d79e1819049",
+    "linux-arm64": "5e9501522d35b32790664b4f3b1b90aa1728629f5013df94e72c2e2a11842bd2",
+    "darwin-x64": "e9d195cf30b6bc2427b7cbe89e354cc8dab7ae02e7c45a7e44a941eda84c2674",
+    "darwin-arm64": "d70ae3a3b8073ace0852a20671dba3d32f380b97ed4a01f5791a13d2fa12e63b"
   }
 }

package/src/audit/open-browser.ts

@@ -13,8 +13,26 @@ import { spawn } from "node:child_process";
 const POLL_INTERVAL_MS = 150;
 const POLL_TIMEOUT_MS = 30_000;
 
+/**
+ * Whether opening a browser here can put a page in front of the person.
+ *
+ * False over SSH — `xdg-open` would start a browser on the REMOTE machine, or
+ * fail, while the person is looking at their own screen — and on a Linux box
+ * with no display at all (a container, a server). Callers then print the link,
+ * which works from any device. A guess, not a promise: a false positive costs a
+ * browser that does not appear next to a link that is printed anyway.
+ */
+export function canOpenBrowser(
+  env: NodeJS.ProcessEnv = process.env,
+  platform: NodeJS.Platform = process.platform,
+): boolean {
+  if (env.SSH_CONNECTION || env.SSH_CLIENT || env.SSH_TTY) return false;
+  if (platform === "linux" && !env.DISPLAY && !env.WAYLAND_DISPLAY) return false;
+  return true;
+}
+
 /** Open a URL with the platform's default handler. Never throws. */
-function openUrl(url: string): void {
+export function openUrl(url: string): void {
   let cmd: string;
   let args: string[];
   if (process.platform === "darwin") {

package/src/hooks/cloud-introspect.ts

@@ -33,6 +33,8 @@
  * second.
  */
 
+import { displayText } from "./cloud-login";
+
 /** The path introspect is served on, appended to the cloud origin. */
 export const INTROSPECT_PATH = "/v1/auth/introspect";
 
@@ -126,8 +128,9 @@ export async function introspectKey(
     identity: {
       keyId: typeof b.key_id === "string" ? b.key_id : undefined,
       orgId: typeof b.org_id === "string" ? b.org_id : undefined,
-      orgSlug: typeof b.org_slug === "string" ? b.org_slug : undefined,
-      orgName: typeof b.org_name === "string" ? b.org_name : undefined,
+      // Printed in "Connected as …": text only, never terminal controls.
+      orgSlug: displayText(b.org_slug),
+      orgName: displayText(b.org_name),
       permissions: b.permissions.filter((p): p is string => typeof p === "string"),
       expiresAt: typeof b.expires_at === "string" ? b.expires_at : null,
       otelIngest: typeof b.otel_ingest === "boolean" ? b.otel_ingest : undefined,

package/src/hooks/cloud-login.ts

@@ -0,0 +1,245 @@
+/**
+ * The CLI half of "Log in to FailproofAI Cloud" — `failproofai config`'s
+ * browser login.
+ *
+ * The CLI asks the dashboard for a link, a person approves it in a browser
+ * (signing up, signing in, picking or creating an org on the way), and the CLI
+ * — polling with a secret only it holds — sees the approval and, once setup has
+ * finished, claims a freshly minted machine key. The server side is
+ * `server/src/routes/cli_login.rs` in AgentEye; the relay is the dashboard's
+ * `/api/auth/cli/*`.
+ *
+ * Three calls, each with an injectable `fetch` so tests never reach the network:
+ *   start → { verificationUrl, pollSecret, expiresIn, interval }
+ *   poll  → pending / slow_down / approved (org + who) / denied / expired / …
+ *   claim → the key, exactly once. Called at APPLY, after the daemon installs:
+ *           an approval that is never claimed leaves no key behind.
+ *
+ * Every call refuses to follow a redirect, for the reason `introspectKey` gives:
+ * a dashboard that does not know a path can answer with a login page, and a 200
+ * from that must never read as success.
+ */
+
+export const LOGIN_START_PATH = "/api/auth/cli/start";
+export const LOGIN_POLL_PATH = "/api/auth/cli/poll";
+export const LOGIN_CLAIM_PATH = "/api/auth/cli/claim";
+
+const TIMEOUT_MS = 10_000;
+
+export interface LoginOrg {
+  id?: string;
+  slug?: string;
+  name?: string;
+}
+
+export type StartResult =
+  | { kind: "ok"; verificationUrl: string; pollSecret: string; expiresIn: number; interval: number }
+  /** This cloud predates browser login. Pasting a key still works. */
+  | { kind: "unsupported" }
+  | { kind: "refused"; reason: string }
+  | { kind: "unreachable"; reason: string };
+
+export type PollResult =
+  | { kind: "pending"; interval?: number }
+  | { kind: "slow_down" }
+  | { kind: "approved"; org: LoginOrg; approvedBy?: string; keyName?: string; permissions: string[] }
+  | { kind: "denied" }
+  | { kind: "expired" }
+  | { kind: "claimed" }
+  /** The server no longer knows this request (swept, or never existed). */
+  | { kind: "unknown" }
+  | { kind: "unreachable"; reason: string };
+
+export type ClaimResult =
+  | {
+      kind: "ok";
+      key: string;
+      keyId?: string;
+      keyName?: string;
+      org: LoginOrg;
+      permissions: string[];
+      approvedBy?: string;
+    }
+  | { kind: "expired" }
+  /** The person who approved can no longer grant this key. */
+  | { kind: "revoked" }
+  | { kind: "refused"; reason: string }
+  | { kind: "unreachable"; reason: string };
+
+type Fetch = typeof fetch;
+
+async function postJson(
+  origin: string,
+  path: string,
+  body: unknown,
+  fetchImpl: Fetch,
+): Promise<{ status: number; json: Record<string, unknown> | null } | { error: string }> {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), TIMEOUT_MS);
+  try {
+    const res = await fetchImpl(`${origin.replace(/\/+$/, "")}${path}`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(body),
+      redirect: "manual",
+      signal: controller.signal,
+    });
+    let json: Record<string, unknown> | null = null;
+    try {
+      const parsed: unknown = await res.json();
+      json = parsed && typeof parsed === "object" && !Array.isArray(parsed) ? (parsed as Record<string, unknown>) : null;
+    } catch {
+      json = null;
+    }
+    return { status: res.status, json };
+  } catch (err) {
+    // Deliberately not the URL: setup is often run while screen-sharing.
+    return { error: err instanceof Error ? (err.name === "AbortError" ? "timed out" : err.message) : String(err) };
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+const str = (v: unknown): string | undefined => (typeof v === "string" && v.length > 0 ? v : undefined);
+
+// Controls (a terminal executes them: clear the screen, retitle the window,
+// write the clipboard), bidi overrides and isolates, and zero-width formatting.
+const INVISIBLE = /[\u0000-\u001f\u007f-\u009f\u061c\u180e\u200b-\u200f\u202a-\u202e\u2060-\u2069\ufeff]/g;
+
+/**
+ * A server-supplied string made safe to print. Org names are chosen by whoever
+ * created the org and the CLI prints the one it was approved into — the line
+ * that is meant to show who approved what — so none of it may reach the
+ * terminal as anything but text.
+ */
+export function displayText(v: unknown, max = 200): string | undefined {
+  if (typeof v !== "string") return undefined;
+  const t = v.replace(INVISIBLE, "").trim().slice(0, max);
+  return t.length > 0 ? t : undefined;
+}
+
+function org(v: unknown): LoginOrg {
+  const o = v && typeof v === "object" ? (v as Record<string, unknown>) : {};
+  return { id: str(o.id), slug: displayText(o.slug), name: displayText(o.name) };
+}
+
+function permissions(v: unknown): string[] {
+  return Array.isArray(v) ? v.map((p) => displayText(p, 64)).filter((p): p is string => p !== undefined) : [];
+}
+
+/** A server's number, kept to a range this client can live with: a huge poll
+ *  interval overflows `setTimeout` into a 1 ms storm, a tiny one polls flat out. */
+const within = (v: unknown, lo: number, hi: number, fallback: number): number =>
+  typeof v === "number" && Number.isFinite(v) && v > 0 ? Math.min(hi, Math.max(lo, v)) : fallback;
+
+/**
+ * Only an http(s) link is ever handed to the browser opener. The URL comes from
+ * the server, and `xdg-open` / `open` will happily act on any scheme they know.
+ */
+export function isOpenableUrl(raw: string): boolean {
+  try {
+    const u = new URL(raw);
+    return u.protocol === "https:" || u.protocol === "http:";
+  } catch {
+    return false;
+  }
+}
+
+/** What the browser page should call this machine and its OS. */
+export function machineOs(platform: NodeJS.Platform = process.platform): string {
+  return platform === "darwin" ? "macOS" : platform === "win32" ? "windows" : platform;
+}
+
+export async function startLogin(
+  origin: string,
+  machine: { label: string; os: string; cliVersion: string },
+  fetchImpl: Fetch = fetch,
+): Promise<StartResult> {
+  const r = await postJson(
+    origin,
+    LOGIN_START_PATH,
+    { machine_label: machine.label, machine_os: machine.os, cli_version: machine.cliVersion },
+    fetchImpl,
+  );
+  if ("error" in r) return { kind: "unreachable", reason: r.error };
+  // No such route, or the web app redirecting an unknown path: a cloud from
+  // before this feature. Not an error — the key prompt still connects it.
+  if (r.status === 404 || (r.status >= 300 && r.status < 400)) return { kind: "unsupported" };
+  if (r.status === 429) return { kind: "refused", reason: "too many login attempts from here — wait a minute" };
+  if (r.status !== 201 || !r.json) {
+    return r.status >= 500
+      ? { kind: "unreachable", reason: `the server answered ${r.status}` }
+      : { kind: "refused", reason: displayText(r.json?.error, 120) ?? `the server answered ${r.status}` };
+  }
+  const verificationUrl = str(r.json.verification_url);
+  const pollSecret = str(r.json.poll_secret);
+  if (!verificationUrl || !pollSecret || !isOpenableUrl(verificationUrl)) {
+    // A 201 without the fields is something other than this API.
+    return { kind: "unsupported" };
+  }
+  return {
+    kind: "ok",
+    // Re-serialised, never the raw string: it is printed, and the parser
+    // percent-encodes every control and non-ASCII character in it.
+    verificationUrl: new URL(verificationUrl).href,
+    pollSecret,
+    expiresIn: within(r.json.expires_in, 30, 3600, 600),
+    interval: within(r.json.interval, 1, 30, 2),
+  };
+}
+
+export async function pollLogin(origin: string, pollSecret: string, fetchImpl: Fetch = fetch): Promise<PollResult> {
+  const r = await postJson(origin, LOGIN_POLL_PATH, { poll_secret: pollSecret }, fetchImpl);
+  if ("error" in r) return { kind: "unreachable", reason: r.error };
+  if (r.status === 404) return { kind: "unknown" };
+  if (r.status !== 200 || !r.json) return { kind: "unreachable", reason: `the server answered ${r.status}` };
+  const j = r.json;
+  switch (j.status) {
+    case "pending":
+      return { kind: "pending", interval: typeof j.interval === "number" ? within(j.interval, 1, 30, 2) : undefined };
+    case "slow_down":
+      return { kind: "slow_down" };
+    case "approved":
+      return {
+        kind: "approved",
+        org: org(j.org),
+        approvedBy: displayText(j.approved_by),
+        keyName: displayText(j.key_name),
+        permissions: permissions(j.permissions),
+      };
+    case "denied":
+      return { kind: "denied" };
+    case "expired":
+      return { kind: "expired" };
+    case "claimed":
+      return { kind: "claimed" };
+    default:
+      return { kind: "unknown" };
+  }
+}
+
+export async function claimLogin(origin: string, pollSecret: string, fetchImpl: Fetch = fetch): Promise<ClaimResult> {
+  const r = await postJson(origin, LOGIN_CLAIM_PATH, { poll_secret: pollSecret }, fetchImpl);
+  if ("error" in r) return { kind: "unreachable", reason: r.error };
+  const j = r.json ?? {};
+  if (r.status === 201) {
+    const key = str(j.api_key);
+    if (!key) return { kind: "refused", reason: "the server answered without a key" };
+    return {
+      kind: "ok",
+      key,
+      keyId: str(j.key_id),
+      keyName: displayText(j.key_name),
+      org: org(j.org),
+      permissions: permissions(j.permissions),
+      approvedBy: displayText(j.approved_by),
+    };
+  }
+  if (r.status === 410) return { kind: "expired" };
+  if (r.status === 403 && j.error === "approval_revoked") return { kind: "revoked" };
+  if (r.status >= 500) return { kind: "unreachable", reason: `the server answered ${r.status}` };
+  return {
+    kind: "refused",
+    reason: displayText(j.status, 40) ? `the login request is ${displayText(j.status, 40)}` : `the server answered ${r.status}`,
+  };
+}