failproofai 1.0.12-beta.0 → 1.0.12-beta.2

package/src/hooks/configure-wizard.ts

@@ -62,6 +62,7 @@ import {
 } from "./integrations";
 import { INTEGRATION_TYPES, type IntegrationType, type HookScope } from "./types";
 import { enforcingPolicyCount, installHooks, notEnforcingReason } from "./manager";
+import { installAgentSkill } from "./agent-skill";
 import {
   CODEX_UNTRUSTED_NOTICE,
   codexHookTrust,
@@ -1098,6 +1099,10 @@ export async function runConfigureWizard(
     });
   };
 
+  // Whether the saved key was refused when the CONNECT step checked it — still
+  // true at the end of the run if a login there created no key.
+  let savedRefused = false;
+
   // The interactive CONNECT step. A machine with no connection, or whose saved
   // key is refused, starts the browser login straight away — Tab or Esc there
   // opens the other options. A machine that is connected with a working key gets
@@ -1108,6 +1113,7 @@ export async function runConfigureWizard(
         ? await transient("Checking your saved key…", () => checkCloudKey(saved.url, saved.token))
         : null;
     const savedBroken = verdict !== null && !verdict.ok && verdict.refused;
+    savedRefused = savedBroken;
     const keptPlan: CloudPlan =
       verdict && verdict.ok
         ? { kind: "kept", how: "saved", verified: true }
@@ -1438,24 +1444,6 @@ export async function runConfigureWizard(
     pruneOldDaemonBinaries();
   }
 
-  const connectedAfterPlan = connecting || cloud.kind === "kept";
-  // Telemetry runs concurrently with the rest of apply (never rejects,
-  // 5s-bounded) and is awaited before returning. `cli` carries the selected
-  // agent ids, as it always has (and as hooks_installed does): a fixed list of
-  // product ids, never user content. The agents_* fields add counts only.
-  const applied = emit("configure_applied", {
-    target: "user",
-    scopes: ["user"],
-    cli: selected,
-    cli_count: selected.length,
-    policy_count: (readScopedHooksConfig("user", cwd).enabledPolicies ?? []).length,
-    connected: connecting,
-    mode: connectedAfterPlan ? "cloud" : "oss",
-    agents_selected: selected.length,
-    agents_detected: plan.detected.size,
-    agents_changed: added.length + removed.length > 0,
-  });
-
   // Hooks, at user scope, for the chosen agents. Whatever policies are enabled
   // there are carried through untouched: `replace: true` would otherwise switch
   // off policies the user had turned on, and setup must never reduce
@@ -1483,6 +1471,11 @@ export async function runConfigureWizard(
     cwd,
   );
 
+  // The failproofai skill, in every agent this machine has and any ticked
+  // without being detected — traced or not, an agent asked about FailproofAI
+  // should know it. A pointer to the skill online (see agent-skill.ts).
+  installAgentSkill(INTEGRATION_TYPES.filter((id) => plan.detected.has(id) || selected.includes(id)));
+
   // Agents traced again start fresh (see `requestFreshStart`). Only on a
   // rerun: its baseline is the selection the daemon actually filtered on. With
   // no saved list (upgrade, first) the daemon was collecting every agent, so an
@@ -1503,6 +1496,7 @@ export async function runConfigureWizard(
   let token: string | null = cloud.kind === "connect" ? cloud.token : null;
   let orgLabel: string | undefined = cloud.kind === "connect" ? cloud.org : undefined;
   let mintedName: string | undefined;
+  let claimedOrg: LoginOrg | undefined;
   if (cloud.kind === "login" && url) {
     const claimed = await transient("Creating this machine's key…", () => claimLogin(url, cloud.pollSecret));
     void emit("configure_cloud_login", { step: "claimed", ok: claimed.kind === "ok", reason: claimed.kind });
@@ -1510,6 +1504,7 @@ export async function runConfigureWizard(
       token = claimed.key;
       orgLabel = loginOrgLabel(claimed.org);
       mintedName = claimed.keyName;
+      claimedOrg = claimed.org;
     } else {
       hookLogWarn(`cloud login could not be completed: ${claimed.kind}`);
       done.push(
@@ -1536,6 +1531,8 @@ export async function runConfigureWizard(
           machineLabel,
           // Both streams unless the run said `--no-transcripts`.
           sessions: answers.noTranscripts !== true,
+          // The org the login was approved into, for when introspect can't say.
+          org: claimedOrg,
         }),
       );
       connected = outcome.anyConfigured;
@@ -1566,12 +1563,38 @@ export async function runConfigureWizard(
     updateConfig({ mode: "cloud" });
   }
 
-  // Logging in again on a connected machine, with no key at the end of it,
-  // changed nothing about the connection: the previous one is still there.
-  const keptOld = cloud.kind === "login" && !token && saved !== undefined;
-  if (keptOld) done.push("  This machine keeps its previous connection.");
-
-  await applied;
+  // Logging in again on a connected machine, with nothing connected at the end
+  // of it — no key, or a key `connectToCloud` could not use, which writes
+  // nothing — changed nothing about the connection: the previous one is still
+  // there (never removed from this step, decision D4) — but not as if it worked
+  // when its key was refused.
+  const keptOld = cloud.kind === "login" && !connected && Boolean(saved);
+  if (keptOld) {
+    done.push(
+      savedRefused
+        ? "  This machine keeps its previous connection, but its key no longer works. Run failproofai config again to log in."
+        : "  This machine keeps its previous connection.",
+    );
+  }
+  const cloudAfter = connected || cloud.kind === "kept" || keptOld;
+
+  // Sent once the connection's outcome is known — a login whose claim then
+  // failed must not count as connected. Never rejects, 5s-bounded. `cli`
+  // carries the selected agent ids, as it always has (and as hooks_installed
+  // does): a fixed list of product ids, never user content. The agents_*
+  // fields add counts only.
+  await emit("configure_applied", {
+    target: "user",
+    scopes: ["user"],
+    cli: selected,
+    cli_count: selected.length,
+    policy_count: policies.length,
+    connected,
+    mode: cloudAfter ? "cloud" : "oss",
+    agents_selected: selected.length,
+    agents_detected: plan.detected.size,
+    agents_changed: added.length + removed.length > 0,
+  });
   // Only now — a completed apply — is the launcher considered "seen", so
   // first-run onboarding stops offering itself on every command.
   markLauncherSeen();
@@ -1588,7 +1611,7 @@ export async function runConfigureWizard(
       done,
       cwd,
       agents: selected.length,
-      connected: connected || cloud.kind === "kept" || keptOld,
+      connected: cloudAfter,
       codexTrust,
     }),
   );
@@ -1601,7 +1624,7 @@ export async function runConfigureWizard(
     policies,
     daemonInstalled,
     connected,
-    mode: connected || cloud.kind === "kept" || keptOld ? "cloud" : "oss",
+    mode: cloudAfter ? "cloud" : "oss",
     agents: { selected, added, removed },
   };
 }
@@ -1717,6 +1740,11 @@ export async function checkCloudKey(
   url: string,
   key: string,
 ): Promise<{ ok: true; org?: string; note?: string } | { ok: false; refused: boolean; reason: string }> {
+  // Checked here rather than trusted: a saved address comes from a file that
+  // can be edited, and an http one to another host would carry the key in
+  // the clear. Not a verdict on the key, so not `refused`.
+  const target = validateCloudUrl(url);
+  if (!target.ok) return { ok: false, refused: false, reason: `the address ${url} can't be used: ${target.reason}` };
   const identity = await introspectKey(url, key);
   if (identity.kind === "rejected") return { ok: false, refused: true, reason: "the server did not accept it" };
   if (identity.kind === "unreachable") return { ok: false, refused: false, reason: identity.reason };

package/src/hooks/custom-hooks-loader.ts

@@ -176,7 +176,7 @@ async function importWithDeadline(fileUrl: string): Promise<void> {
  * Does NOT clear the registry — caller is responsible for that.
  */
 export interface PolicyLoadFailure {
-  type: "module_not_found" | "syntax_error" | "load_timeout" | "runtime_error" | "path_missing";
+  type: "module_not_found" | "file_not_found" | "syntax_error" | "load_timeout" | "runtime_error" | "path_missing";
   reason: string;
 }
 
@@ -250,8 +250,13 @@ async function loadSingleFile(
     return null;
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
-    const errorType = /Cannot find module|MODULE_NOT_FOUND|ENOENT/i.test(msg)
+    // An import that names no module, apart from a file the policy itself
+    // reads at load (a `readFileSync` of its data): both are ENOENT underneath,
+    // but "module not found" sent people looking for a missing package (B13).
+    const errorType = /Cannot find module|MODULE_NOT_FOUND|Cannot find package/i.test(msg)
       ? "module_not_found"
+      : /ENOENT/i.test(msg)
+        ? "file_not_found"
       : /SyntaxError|Unexpected token/i.test(msg)
         ? "syntax_error"
         : /timed out loading module/i.test(msg)
@@ -334,6 +339,13 @@ export interface LoadAllResult {
    * Only present for a path more than one pack resolved to.
    */
   packAliases: Map<string, string[]>;
+  /**
+   * Import failures of FailproofAI Cloud JS policies, keyed by Cloud policy id
+   * (every id behind a shared artifact). Fail-open like the rest of the Cloud
+   * read — nothing denies over them — but reported to Cloud in `errors.json`,
+   * so a deployment that is not actually enforcing says so.
+   */
+  cloudFailures?: Map<string, PolicyLoadFailure>;
 }
 
 export function customPolicyId(file: string, name: string): string {
@@ -456,8 +468,12 @@ export async function loadAllCustomHooks(
   // codebase exists to remove. It is also announced, so an operator can give the
   // two policies distinguishable source instead of living with the merge.
   const cloudManagedByPath = new Map<string, CloudManagedPolicyArtifact>();
+  /** Every Cloud policy id behind each artifact path, for `cloudFailures`. */
+  const cloudIdsByPath = new Map<string, string[]>();
+  const cloudFailures = new Map<string, PolicyLoadFailure>();
   for (const policy of opts?.cloudManagedPolicies ?? []) {
     const key = resolve(policy.path);
+    cloudIdsByPath.set(key, [...(cloudIdsByPath.get(key) ?? []), policy.id]);
     const existing = cloudManagedByPath.get(key);
     if (!existing) {
       cloudManagedByPath.set(key, policy);
@@ -660,6 +676,9 @@ export async function loadAllCustomHooks(
         if (failure && pack) {
           for (const id of packIdsByPath.get(absPath) ?? [pack.id]) packFailures.set(id, failure);
         }
+        if (failure && cloudManaged) {
+          for (const id of cloudIdsByPath.get(absPath) ?? [cloudManaged.id]) cloudFailures.set(id, failure);
+        }
         for (const hook of getCustomHooks().slice(hooksBefore)) {
           const tagged = hook as CustomHook & {
             __policyId?: string;
@@ -680,6 +699,10 @@ export async function loadAllCustomHooks(
       }
     } else {
       hookLogWarn(`custom policy path not found: ${absPath}`);
+      if (cloudManaged) {
+        const missing = { type: "path_missing", reason: `path missing: ${absPath}` } as const;
+        for (const id of cloudIdsByPath.get(absPath) ?? [cloudManaged.id]) cloudFailures.set(id, missing);
+      }
       if (pack) {
         const missing = { type: "path_missing", reason: `path missing: ${absPath}` } as const;
         for (const id of packIdsByPath.get(absPath) ?? [pack.id]) packFailures.set(id, missing);
@@ -830,5 +853,5 @@ export async function loadAllCustomHooks(
     const winner = packByPath.get(path);
     if (winner && ids.length > 1) packAliases.set(winner.id, ids);
   }
-  return { hooks: allHooks, conventionSources, packFailures, packAliases };
+  return { hooks: allHooks, conventionSources, packFailures, packAliases, cloudFailures };
 }

package/src/hooks/daemon-client.ts

@@ -16,7 +16,7 @@ import { existsSync } from "node:fs";
 import { daemonSocket as daemonSocketPath } from "./fp-home";
 import { readConfig } from "./fp-config";
 
-const PROTOCOL_VERSION = 1;
+const PROTOCOL_VERSION = 2;
 
 /**
  * Reaching the daemon and getting an answer out of it are two different
@@ -56,6 +56,8 @@ export interface DaemonHookRequest {
    * hazard.
    */
   cwd?: string;
+  /** Settings path of the originating agent profile, not the daemon's. */
+  agentSettingsPath?: string;
 }
 
 export interface DaemonHookResponse {
@@ -98,6 +100,7 @@ export interface DaemonPolicyEvaluationRequest {
   event: string;
   payload: Record<string, unknown>;
   cwd?: string;
+  agentSettingsPath?: string;
 }
 
 export type DaemonPolicyEvaluationAttempt =
@@ -304,6 +307,7 @@ export async function attemptDaemonHook(
       cli: req.cli,
       stdin: req.stdin,
       cwd: req.cwd,
+      agentSettingsPath: req.agentSettingsPath,
     },
     opts,
   );
@@ -338,9 +342,9 @@ function isStringArray(value: unknown): value is string[] {
 
 /**
  * Attempts the structured request used by native in-process integrations.
- * A matching protocol version is not sufficient: pre-native v1 daemons speak
- * `hook` but cannot deserialize `policyEvaluation`, so only a complete,
- * well-shaped `policyResult` proves this capability exists.
+ * A matching protocol version is not sufficient: a broken or partial daemon
+ * may speak `hook` but not `policyEvaluation`, so only a complete, well-shaped
+ * `policyResult` proves this capability exists.
  */
 export async function attemptDaemonPolicyEvaluation(
   req: DaemonPolicyEvaluationRequest,
@@ -354,6 +358,7 @@ export async function attemptDaemonPolicyEvaluation(
       event: req.event,
       payload: req.payload,
       cwd: req.cwd,
+      agentSettingsPath: req.agentSettingsPath,
     },
     opts,
   );

package/src/hooks/daemon-service.ts

@@ -7,6 +7,7 @@
  * `configure-wizard.ts` calls the functions here directly, the same
  * relationship it already has with `manager.ts`'s `installHooks()`.
  */
+import { HEALTH_PROBE_SOURCE } from "./health-probe";
 import {
   existsSync,
   mkdirSync,
@@ -1030,7 +1031,7 @@ export async function probeDaemon(): Promise<DaemonProbe> {
             cli: "claude",
             stdin: JSON.stringify({
               hook_event_name: "SessionStart",
-              source: "failproofai-health-probe",
+              source: HEALTH_PROBE_SOURCE,
             }),
           },
           { responseTimeoutMs: DAEMON_PROBE_TIMEOUT_MS },

package/src/hooks/delivery-health.ts

@@ -23,11 +23,20 @@
  * `is_auto_retryable()` excludes it from the retry pass — that is correct, and
  * re-litigating it here would burn the budget of batches that could succeed.
  * The gap was never the detection. It was that the detection was mute.
+ *
+ * A credential refusal is only evidence about the CURRENT key while nothing
+ * has been accepted since. A key regenerated on the dashboard leaves the
+ * running collector on the old secret until the daemon's next config tick, so
+ * a batch or two is refused while the new key already works. Those parked
+ * before the collector's last accepted delivery (`delivery.last_ok_ts`) are
+ * counted as `resending`, not refused: the daemon re-sends them with the key
+ * that works (`Delivery::redrive_refused`) and drops one only if that key
+ * refuses it too.
  */
-import { existsSync, readdirSync, statSync } from "node:fs";
+import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
 import { join } from "node:path";
 
-import { failedDir } from "./fp-home";
+import { collectorHealthFile, failedDir } from "./fp-home";
 import { readCredentials } from "./fp-config";
 
 /**
@@ -106,6 +115,13 @@ export interface DeliveryHealth {
   credentialRejected: number;
   /** Count per client status, e.g. `{ 401: 26 }`. */
   byStatus: Record<number, number>;
+  /**
+   * Credential refusals parked BEFORE the last delivery the server accepted.
+   * The key in use now works, so these are not counted as refused: the daemon
+   * re-sends them with that key (`Delivery::redrive_refused`, fpai-collect)
+   * and drops one only if the current key refuses it too.
+   */
+  resending: number;
   /** Age of the oldest parked batch, in ms. Undefined when none are parked. */
   oldestAgeMs?: number;
 }
@@ -115,8 +131,23 @@ const EMPTY: DeliveryHealth = {
   rejected: 0,
   credentialRejected: 0,
   byStatus: {},
+  resending: 0,
 };
 
+/**
+ * `delivery.last_ok_ts` from the collector's health file, in ms, or undefined.
+ * The last upload the server ACCEPTED (`UploadMetrics::last_ok_ts`).
+ */
+export function readLastDeliveredAt(home?: string): number | undefined {
+  try {
+    const raw = JSON.parse(readFileSync(collectorHealthFile(home), "utf8")) as { delivery?: { last_ok_ts?: unknown } };
+    const ts = raw?.delivery?.last_ok_ts;
+    return typeof ts === "number" && Number.isFinite(ts) && ts > 0 ? ts * 1000 : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
 /**
  * Summarise `failed/` without touching it.
  *
@@ -127,6 +158,7 @@ export function deliveryHealth(
   home?: string,
   now: number = Date.now(),
   connectedAt: number | undefined = home ? undefined : readCredentials().connectedAt,
+  lastDeliveredAt: number | undefined = home ? undefined : readLastDeliveredAt(),
 ): DeliveryHealth {
   const dir = failedDir(home);
   if (!existsSync(dir)) return EMPTY;
@@ -144,6 +176,7 @@ export function deliveryHealth(
   let total = 0;
   let rejected = 0;
   let credentialRejected = 0;
+  let resending = 0;
   let oldestMtime: number | undefined;
 
   for (const name of entries) {
@@ -162,6 +195,17 @@ export function deliveryHealth(
       CREDENTIAL_STATUSES.has(parsed.clientStatus) &&
       mtime < connectedAt
     ) continue;
+    // Refused with a key that has worked since: the latest delivery attempt
+    // was accepted, so the CURRENT key is not the one being refused.
+    if (
+      lastDeliveredAt !== undefined &&
+      parsed.clientStatus !== undefined &&
+      CREDENTIAL_STATUSES.has(parsed.clientStatus) &&
+      mtime <= lastDeliveredAt
+    ) {
+      resending += 1;
+      continue;
+    }
     total += 1;
     if (parsed.clientStatus !== undefined) {
       rejected += 1;
@@ -177,6 +221,7 @@ export function deliveryHealth(
     rejected,
     credentialRejected,
     byStatus,
+    resending,
     ...(oldestMtime !== undefined ? { oldestAgeMs: Math.max(0, now - oldestMtime) } : {}),
   };
 }

package/src/hooks/effective-reviewers.ts

@@ -12,6 +12,15 @@
  * never installed its checks: `jevChecksInstalled` below is the hook path's
  * gate for starting a review at all.
  *
+ * ## …and a FailproofAI Cloud `both` policy's own Cloud checks
+ *
+ * A `both` policy's JS half names its own Jev checks, which run on FailproofAI
+ * Cloud and never reach this machine (CONTRACT C10). While Cloud's Jev mode
+ * asks (`observe`/`enforce`), those names are reviewers too — but only as
+ * `cloud:<policyId>/<name>` (`cloudReviewerName`), which the Cloud review files
+ * that policy's own Cloud outcomes under. An installed pack's check of the same
+ * name is a different reviewer and can never clear it.
+ *
  * The names come from the MANIFEST, which is already where `authority` and
  * `reviewedBy` themselves are read from, so this adds no new trust and imports
  * no semantic module.
@@ -36,11 +45,16 @@
  */
 import { readInstalledPacks, type ResolvedPack } from "./pack-manifest";
 import { NO_REVIEWERS, SEMANTIC_REVIEWER_NAMES } from "./policy-authority";
+import { cloudReviewerNames, readCloudAuthorityInputs, readCloudJevMode } from "./cloud-managed-policies";
+import type { AgentIdentity } from "./agent-targets";
 
 let cached: ReadonlySet<string> | null = null;
+/** Whether the installed packs alone (not Cloud) declared any check, for the cached answer. */
+let cachedPackChecks = false;
 let cachedContested: ReadonlyMap<string, string[]> = new Map();
 /** The agent the current registration pass is for; see {@link forgetEffectiveReviewerNames}. */
 let reviewerCli: string | undefined;
+let reviewerAgent: AgentIdentity | null = null;
 
 /**
  * The packs whose Jev checks take part for `cli`, filtered the way the regex
@@ -173,13 +187,23 @@ export function effectiveReviewerNames(): ReadonlySet<string> {
   if (cached) return cached;
   let names: ReadonlySet<string> = NO_REVIEWERS;
   cachedContested = new Map();
+  cachedPackChecks = false;
   try {
     const packs = jevPacks(readInstalledPacks().packs, reviewerCli);
     names = reviewerNamesFor(packs);
+    cachedPackChecks = names.size > 0;
     cachedContested = contestedSemanticNames(packs);
   } catch {
     // See above: an unreadable manifest declares no checks.
   }
+  try {
+    // Both reads answer "nothing" for a file they cannot use; guarded anyway,
+    // because a throw here would cost the registration pass — every policy.
+    const cloud = cloudReviewerNames(readCloudAuthorityInputs(reviewerAgent), readCloudJevMode());
+    if (cloud.length > 0) names = new Set([...names, ...cloud]);
+  } catch {
+    // No Cloud reviewers: every `both` policy stays hard.
+  }
   cached = names;
   return names;
 }
@@ -204,6 +228,16 @@ export function jevChecksInstalled(): boolean {
   return effectiveReviewerNames().size > 0;
 }
 
+/**
+ * Whether an installed pack (not FailproofAI Cloud) gives Jev a check for this
+ * agent: the part of {@link jevChecksInstalled} a Cloud review needs to know
+ * when deciding whether a call has anything of the machine's own to ask.
+ */
+export function packJevChecksInstalled(): boolean {
+  effectiveReviewerNames();
+  return cachedPackChecks;
+}
+
 /**
  * The same question for a CLI command, read fresh rather than from the
  * registration cache (which only the hook path fills): any agent, packs as
@@ -244,7 +278,8 @@ export function reviewerNamesFor(
  * runs before it registers anything — so a pack installed under a long-lived
  * warm worker is picked up on the next event rather than at the next restart.
  */
-export function forgetEffectiveReviewerNames(cli?: string): void {
+export function forgetEffectiveReviewerNames(cli?: string, agent: AgentIdentity | null = null): void {
   cached = null;
   reviewerCli = cli;
+  reviewerAgent = agent;
 }

package/src/hooks/fp-config.ts

@@ -940,6 +940,25 @@ export function readCredentials(): FpCredentials {
   }
 }
 
+/**
+ * Whether FailproofAI Cloud sets this machine's Jev mode: it is connected for
+ * policies (a machine id in `credentials.json`). Cloud then runs Jev in enforce
+ * while a Jev policy is deployed here and switches it off when none is; local
+ * mode settings do not apply. Never throws.
+ */
+export function cloudManagesJevMode(): boolean {
+  try {
+    const cloud = readCredentials().cloud;
+    return Boolean(cloud?.url && cloud.machineId);
+  } catch {
+    return false;
+  }
+}
+
+/** The one line a local mode switch answers with on such a machine. */
+export const CLOUD_MANAGED_JEV_MODE =
+  "Jev mode is managed by FailproofAI Cloud on this machine: enforce while a Jev policy is deployed here, off when none is.";
+
 /**
  * Project a parsed credentials object onto {@link FpCredentials}.
  *

package/src/hooks/fp-home.ts

@@ -165,6 +165,9 @@ export const credentialsFile = (home?: string) => atHome(home, "credentials.json
  */
 export const jevConfigFile = (home?: string) => atHome(home, "jev.json");
 
+/** Owner-only inventory maintained by failproofaid. Paths stay on this machine. */
+export const agentRosterFile = (home?: string) => atHome(home, "agents", "roster.json");
+
 // ── Daemon binaries ──────────────────────────────────────────────────────────
 
 export const binDir = (home?: string) => atHome(home, "bin");
@@ -656,6 +659,9 @@ export const HOME_CLASSES: readonly { path: (home?: string) => string; class: Da
   // history the user was already told about. Kept OUT of `auditSessionFile`
   // precisely so both survive a sign-out.
   { path: auditMachineFile, class: "identity" },
+  // Profile IDs are stable across restarts and renames. A reset that deleted
+  // this file would make Cloud's exact-profile assignments match nobody.
+  { path: agentRosterFile, class: "identity" },
 
   // ── May be dropped: rebuilt on demand ──
   // NOTE: `auditDir` itself is deliberately absent. Layout 4 made it MIXED — it