failproofai 1.0.12-beta.0 → 1.0.12-beta.2

package/src/hooks/semantic/jev-review.ts

@@ -7,6 +7,13 @@
  * `jev.json` never loads the semantic evaluator at all, and its hook path is
  * exactly what it was before two tiers existed.
  *
+ * Or once FailproofAI Cloud sets this machine's Jev mode to `observe` or
+ * `enforce` (CONTRACT C10): then the call goes to FailproofAI Cloud on the
+ * Cloud Jev credential (`JevCallContext.cloud`), Cloud decides the checks it
+ * deployed here, and `evaluateCloudSemantic` merges that verdict with the
+ * machine's own. Cloud's outcomes are filed as their policy's OWN reviewers
+ * (`reviewerKey`), so a `both` policy is cleared by its Cloud checks alone.
+ *
  * Everything the request needs comes through the §7 contracts:
  * `transportForConfig` (T1) for the provider, `throttleTransport` (T5) for the
  * cache and rate limit (scoped to the config's provider, endpoint and model;
@@ -44,17 +51,29 @@
  * it distinguishes, which is what `toReview` below does.
  */
 import { BUILTIN_POLICIES } from "../builtin-policies";
+import { cloudReviewerName } from "../cloud-managed-policies";
+import type { AgentIdentity } from "../agent-targets";
+import { recordJevBudgetDrops } from "../cloud-policy-errors";
 import { normalizePolicyName } from "../policy-registry";
 import { effectiveAuthority, type PolicyAuthority, type RegisteredPolicy } from "../policy-types";
 import type { JevMode, JevReview, TwoTierReview } from "./combine";
 import { DEFAULT_THRESHOLDS_V1 } from "./decide";
+import { evaluateCloudSemantic, type CloudSemanticOutcome } from "./cloud-jev";
+import {
+  BREAKER_SKIP_REASON,
+  classifyCloudJevReview,
+  cloudJevGate,
+  recordCloudJevResult,
+  reportCloudJevHealth,
+} from "./cloud-jev-health";
 import { DEFAULT_JEV_TIMEOUT_MS, appendVerdictLog, evaluateSemantic, verdictLogRow, type SemanticOutcome } from "./evaluator";
 import * as intentStore from "./intent";
 import { JevError, transportForConfig, type JevTransport } from "./jev-client";
 import { DEFAULT_JEV_MODE, type JevConfig } from "./jev-config";
 import * as jevThrottle from "./jev-throttle";
 import { sessionProjectRoot } from "./session-root";
-import type { SemanticInput } from "./types";
+import type { PolicyOutcome, SemanticInput } from "./types";
+import { JEV_CHECKS_MAX, JEV_CHECK_PROBES_MAX, JEV_PROBE_ID_RE, round2, type JevCheckRecord } from "../jev-activity";
 
 /**
  * T5's throttle as this file calls it. §7 declares only
@@ -149,6 +168,25 @@ export interface JevCallContext {
   permissionMode?: string;
   sessionId?: string;
   cli: string;
+  /**
+   * Set when FailproofAI Cloud's Jev mode asks (CONTRACT C10.2): the call goes
+   * to Cloud with this machine's id, and the deployment it was made under
+   * scopes the answer cache (a new deployment can change Cloud's checks).
+   */
+  cloud?: {
+    machineId: string;
+    deployment: number | null;
+    mode: "observe" | "enforce";
+    agent?: AgentIdentity | null;
+    /** Cloud policies whose Jev assignment here is `observe`: recorded, never applied. */
+    observedPolicies?: ReadonlyArray<string>;
+  };
+  /**
+   * A session pause is active. It suspends local policy, so no installed
+   * pack's check is asked; FailproofAI Cloud's checks are exempt from a pause
+   * (as Cloud JS assignments are) and still are. Only meaningful with `cloud`.
+   */
+  localPaused?: boolean;
 }
 
 export function resolveMode(cfg: JevConfig): JevMode {
@@ -177,6 +215,24 @@ export function resolveTimeout(cfg: JevConfig): number {
   return Math.min(MAX_JEV_TIMEOUT_MS, Math.max(MIN_JEV_TIMEOUT_MS, t));
 }
 
+/**
+ * The reviewer an outcome answers for: a FailproofAI Cloud check's is
+ * `cloud:<policyId>/<name>` (its outcome's own `origin.cloudPolicyId`, carried
+ * pack-shaped as `cloud:<id>`), which is what a Cloud `both` policy registers
+ * its `reviewedBy` as — so only that policy's own Cloud outcomes can clear it,
+ * and a Cloud outcome never clears an installed pack's policy (CONTRACT C10.5).
+ * An installed pack's check is its plain name, as it always was.
+ */
+export function reviewerKey(o: Pick<PolicyOutcome, "policy" | "origin">): string {
+  const packId = o.origin?.packId;
+  return packId !== undefined && packId.startsWith("cloud:") ? cloudReviewerName(packId.slice("cloud:".length), o.policy) : o.policy;
+}
+
+/** Whether an outcome came from FailproofAI Cloud (its `cloud:<id>` origin; see `parseCloudReply`). */
+function isCloudOutcome(o: Pick<PolicyOutcome, "origin">): boolean {
+  return o.origin?.packId?.startsWith("cloud:") === true;
+}
+
 /** The semantic policy an attributable Jev verdict is filed under. */
 function jevDecider(outcome: Extract<SemanticOutcome, { status: "ok" }>) {
   const wanted = outcome.verdict.decision === "deny" ? "deny" : "instruct";
@@ -200,6 +256,66 @@ export function fallbackCode(reason: string): string {
   return /^[a-z0-9][a-z0-9-]{0,63}$/.test(code) ? code : "error";
 }
 
+/** Why an outcome ended where it did (`JevCheckRecord.why`), from its own fields. */
+function checkWhy(o: PolicyOutcome): JevCheckRecord["why"] {
+  switch (o.verdict) {
+    case "none":
+      // Both deciders: under `fire` nothing fired; at or over it only the exemption stops it.
+      return o.evidence < DEFAULT_THRESHOLDS_V1.fire ? "not-detected" : "exempt";
+    case "overridden":
+      return o.intent === "op-requested" ? "op-requested" : o.intent === "task-step" ? "task-step" : "user-asked";
+    case "deny":
+      return o.escalatedByInjection ? "injection" : "fired";
+    default:
+      if (o.intent === "downgraded-task-step") return "downgraded";
+      return o.targetScanIncomplete ? "scan-incomplete" : "fired";
+  }
+}
+
+/** Who declared a check, as a registered-name prefix: `cloud/<id>@<v>` or `pack/<id>@<v>`. */
+function checkPolicy(o: PolicyOutcome): string | undefined {
+  const packId = o.origin?.packId;
+  if (!packId) return undefined;
+  const at = o.origin?.packVersion ? `@${o.origin.packVersion}` : "";
+  return packId.startsWith("cloud:") ? `cloud/${packId.slice("cloud:".length)}${at}` : `pack/${packId}${at}`;
+}
+
+/**
+ * Every asked check's answer, for the activity row (`jevChecks`): verdict,
+ * why, evidence, exempt and each probe's probability. `answers` holds the
+ * machine's own answers and Cloud's for its checks (`<check>.<probe>`).
+ */
+export function checkRecords(
+  outcomes: ReadonlyArray<PolicyOutcome>,
+  answers: Readonly<Record<string, number>>,
+  watched: ReadonlyArray<PolicyOutcome> = [],
+): JevCheckRecord[] {
+  const all = [...outcomes.map((o) => ({ o, watched: false })), ...watched.map((o) => ({ o, watched: true }))];
+  return all.slice(0, JEV_CHECKS_MAX).map(({ o, watched: isWatched }) => {
+    const probes: Record<string, number> = {};
+    const prefix = `${o.policy}.`;
+    for (const [id, p] of Object.entries(answers)) {
+      if (Object.keys(probes).length >= JEV_CHECK_PROBES_MAX) break;
+      if (!id.startsWith(prefix)) continue;
+      const part = id.slice(prefix.length);
+      // `exempt` has its own field; `user_asked` (v0) is a consent question, not a probe.
+      if (part === "exempt" || part === "user_asked" || !JEV_PROBE_ID_RE.test(part)) continue;
+      probes[part] = round2(p);
+    }
+    const policy = checkPolicy(o);
+    return {
+      check: o.policy,
+      ...(policy ? { policy } : {}),
+      verdict: o.verdict,
+      why: checkWhy(o),
+      p: round2(o.evidence),
+      ...(o.exempt !== null ? { exempt: round2(o.exempt) } : {}),
+      ...(Object.keys(probes).length > 0 ? { probes } : {}),
+      ...(isWatched ? { watched: true as const } : {}),
+    };
+  });
+}
+
 /**
  * @param cached - the answer came from T5's cache, not the provider: it is
  *   applied like any other, but its ~0 ms is not a latency (`latencyMs`
@@ -215,6 +331,16 @@ export function toReview(outcome: SemanticOutcome, cached = false): JevReview {
   const latencyMs = sent && !cached ? outcome.latencyMs : null;
   const model = sent ? outcome.model : null;
   const outcomes = outcome.verdict.outcomes;
+  // A FailproofAI Cloud outcome is trusted only for a check the reply's own
+  // `asked` names. `parseCloudReply` already refuses a reply that contradicts
+  // itself; this keeps the review from relying on that alone, because a Cloud
+  // outcome is what clears a `both` policy's regex half. One it cannot vouch
+  // for — or a Cloud-origin outcome with no Cloud reply at all — means the
+  // picture is not one to clear anything on: the regex decides alone.
+  const cloudSummary = "cloud" in outcome ? (outcome as CloudSemanticOutcome & { status: "ok" }).cloud : null;
+  const cloudAsked = cloudSummary ? new Set(cloudSummary.asked) : null;
+  const unvouched = outcomes.some((o) => isCloudOutcome(o) && !(cloudAsked?.has(o.policy) ?? false));
+  if (unvouched) return { kind: "fallback", reason: "malformed", latencyMs, model: null };
   // `null` when the injection probe was not in the request, which now means
   // only that no request was made: v1 asks it on every call it sends, with or
   // without a recorded human message (see `compile.ts`).
@@ -223,20 +349,25 @@ export function toReview(outcome: SemanticOutcome, cached = false): JevReview {
   // not downgrade from a deny (see "A check that fired without consent keeps
   // the floor" in `combine.ts`).
   const warned = (o: (typeof outcomes)[number]) => o.verdict === "instruct" && o.intent !== "downgraded-task-step";
+  const cloudAnswers = cloudSummary?.answers ?? {};
+  const watched = cloudSummary?.observedOutcomes ?? [];
   return {
     kind: "answered",
     decision: outcome.verdict.decision,
+    // What each asked check concluded, for the activity row. `[]` when the
+    // request carried no check (globals only, or Cloud's short-circuit).
+    checks: sent ? checkRecords(outcomes, { ...outcome.answers, ...cloudAnswers }, watched) : [],
     reason: outcome.verdict.reason,
     policyName: jevPolicyName(outcome),
     ...(jevDecider(outcome)?.origin ? { origin: jevDecider(outcome)?.origin } : {}),
     // Every selected policy's questions were in the request, and `readAnswers`
     // refuses a response missing any of them — so selected == asked, and only
     // when a request was actually made.
-    asked: sent ? outcomes.map((o) => o.policy) : [],
+    asked: sent ? outcomes.map(reviewerKey) : [],
     // `none` found nothing, `overridden` is what the human asked for, and a
     // deny the human's task softened to a warning is that task's consent — all
     // three clear. A `deny`, or a warning nobody consented to, keeps the block.
-    notDenied: sent ? outcomes.filter((o) => o.verdict !== "deny" && !warned(o)).map((o) => o.policy) : [],
+    notDenied: sent ? outcomes.filter((o) => o.verdict !== "deny" && !warned(o)).map(reviewerKey) : [],
     injectionAsked: injection !== null,
     injected: injection !== null && injection >= DEFAULT_THRESHOLDS_V1.injection,
     // A check that CAN deny warned without consent: nothing may be cleared on
@@ -267,6 +398,18 @@ export function toReview(outcome: SemanticOutcome, cached = false): JevReview {
     requestCut: outcome.requestCut && sent,
     latencyMs,
     model,
+    // An `observe` Cloud assignment's checks: asked, recorded, never applied.
+    ...(sent && cloudSummary?.observedAsked?.length ? { observedAsked: cloudSummary.observedAsked } : {}),
+    ...(cloudSummary?.observed?.length
+      ? {
+          observedCloud: cloudSummary.observed.map((o) => ({
+            cloudPolicyId: o.cloudPolicyId,
+            cloudVersion: o.cloudVersion,
+            decision: o.decision,
+            reason: o.reason,
+          })),
+        }
+      : {}),
   };
 }
 
@@ -291,18 +434,37 @@ export function startJevReview(cfg: JevConfig, call: JevCallContext): TwoTierRev
       if (!settled) controller.abort();
     },
     authorityOf,
+    ...(call.cloud ? { cloud: true } : {}),
   });
 
   let route: ReturnType<typeof transportForConfig>;
   let throttled: JevTransport;
   try {
     route = transportForConfig(cfg);
-    throttled = throttle.throttleTransport(route.transport, { scope: throttleScope(cfg, route) });
+    // A Cloud answer also depends on what Cloud deployed to this machine, which
+    // the request does not show: a new deployment is a new cache scope.
+    const scope = call.cloud
+      ? `${throttleScope(cfg, route)}\u0000cloud\u0000${call.cloud.machineId}\u0000${call.cloud.deployment ?? "-"}`
+      : throttleScope(cfg, route);
+    throttled = throttle.throttleTransport(route.transport, { scope });
   } catch (err) {
     const reason = err instanceof JevError ? err.code : "config";
     return handle(Promise.resolve({ kind: "fallback", reason, latencyMs: null, model: null }));
   }
 
+  // FailproofAI Cloud Jev that keeps failing is skipped for a while, so every
+  // tool call does not wait out its timeout (`cloud-jev-health.ts`).
+  const cloud = call.cloud;
+  const healthScope = cloud ? JSON.stringify([cfg.baseUrl ?? null, cloud.machineId]) : "";
+  let probe = false;
+  if (cloud) {
+    const gate = cloudJevGate(healthScope);
+    if (!gate.ask) {
+      return handle(Promise.resolve({ kind: "fallback", reason: BREAKER_SKIP_REASON, latencyMs: null, model: null }));
+    }
+    probe = gate.probe;
+  }
+
   let intent: ReturnType<IntentStore["readIntent"]>;
   try {
     intent = intentReader.readIntent(call.sessionId);
@@ -326,6 +488,8 @@ export function startJevReview(cfg: JevConfig, call: JevCallContext): TwoTierRev
 
   /** Set when the answer came from T5's cache (a hit carries the original `usage` and no real latency). */
   let cached = false;
+  /** A local inert allow or a cached reply cannot prove Cloud is healthy now. */
+  let reachedCloud = false;
   const transport: JevTransport = async (request, signal) => {
     const response = await throttled(request, signal);
     cached = servedFromCache(response);
@@ -335,21 +499,52 @@ export function startJevReview(cfg: JevConfig, call: JevCallContext): TwoTierRev
   const timeoutMs = resolveTimeout(cfg);
   /** Set once the backstop below gave up on the answer: a late one is logged, never applied. */
   let abandoned = false;
-  const answered = evaluateSemantic(input, {
+  const options = {
     transport,
     cli: call.cli,
     via: route.via,
     model: route.model,
     timeoutMs,
-    intent: "v1",
+    intent: "v1" as const,
     v1: { thresholds: DEFAULT_THRESHOLDS_V1 },
     signal: controller.signal,
     // No `contextTruncated`: nothing reports a store cut out of band, so the
     // evaluator's own (narrower) guess stands. See `IntentStore` above.
-  })
+  };
+  const evaluated: Promise<SemanticOutcome | CloudSemanticOutcome> = cloud
+    ? evaluateCloudSemantic(input, {
+        ...options,
+        machineId: cloud.machineId,
+        agent: cloud.agent,
+        observedPolicies: cloud.observedPolicies ?? [],
+        // Paused: no installed pack's check is sent, only the globals, and
+        // Cloud's own checks are selected and decided on Cloud as ever.
+        ...(call.localPaused ? { policies: [] } : {}),
+      })
+    : evaluateSemantic(input, options);
+  const answered = evaluated
     .then((outcome): JevReview => {
       const hit = cached && outcome.status === "ok";
+      reachedCloud = outcome.status === "ok" && !hit && outcome.via !== "none";
       const review = toReview(outcome, hit);
+      // The machine's own pack checks Cloud dropped from this request
+      // (CONTRACT C10.5), reported for the deployment it happened under. Only
+      // from an answer that arrived in time: one the backstop abandoned is not
+      // applied, and neither is anything it said. A group dropped because a
+      // Cloud check of the same name was selected (Cloud wins the name, D-S-2)
+      // is told apart from a budget drop: that Cloud check is in `asked`, or in
+      // `droppedCloud` when the budget then dropped it too.
+      if (cloud && !abandoned && outcome.status === "ok" && "cloud" in outcome && outcome.cloud.droppedLocal.length > 0) {
+        const cloudNames = new Set([...outcome.cloud.asked, ...outcome.cloud.droppedCloud]);
+        recordJevBudgetDrops(
+          { machineId: cloud.machineId, deployment: cloud.deployment, jevMode: cloud.mode },
+          outcome.cloud.droppedLocal.map((d) => ({
+            packId: d.packId ?? "unknown",
+            name: d.name,
+            ...(cloudNames.has(d.name) ? { clash: true } : {}),
+          })),
+        );
+      }
       // An aborted request has nothing worth replaying; everything else goes
       // to the local verdict log (never shipped), so any verdict can be
       // re-derived offline from its recorded probabilities. A cache hit is
@@ -361,7 +556,8 @@ export function startJevReview(cfg: JevConfig, call: JevCallContext): TwoTierRev
           eventType: call.eventType,
           applied: abandoned || review.kind !== "answered" ? "legacy-fallback" : mode === "observe" ? "observe" : "two-tier",
         });
-        appendVerdictLog(hit ? { ...row, cached: true } : row);
+        const withCloud = outcome.status === "ok" && "cloud" in outcome ? { ...row, cloud: outcome.cloud } : row;
+        appendVerdictLog(hit ? { ...withCloud, cached: true } : withCloud);
       }
       return review;
     })
@@ -381,9 +577,20 @@ export function startJevReview(cfg: JevConfig, call: JevCallContext): TwoTierRev
       resolve({ kind: "fallback", reason: "timeout", latencyMs: timeoutMs + JEV_DEADLINE_GRACE_MS, model: null });
     }, timeoutMs + JEV_DEADLINE_GRACE_MS);
   });
+  const raced = Promise.race([answered, expired]).finally(() => {
+    if (deadline !== undefined) clearTimeout(deadline);
+  });
+  if (!cloud) return handle(raced);
   return handle(
-    Promise.race([answered, expired]).finally(() => {
-      if (deadline !== undefined) clearTimeout(deadline);
+    raced.then((review) => {
+      recordCloudJevResult(
+        healthScope,
+        classifyCloudJevReview(review, { reachedCloud }),
+        review.kind === "fallback" ? review.reason : null,
+        probe,
+      );
+      reportCloudJevHealth();
+      return review;
     }),
   );
 }

package/src/hooks/semantic/pack-policies.ts

@@ -142,7 +142,8 @@ export interface ResolvedSemanticPolicies {
 }
 
 /** Turn one validated manifest entry into a policy the compiler can use. */
-function toSemanticPolicy(entry: SemanticManifestEntry, pack: { id: string; version?: string }): SemanticPolicy {
+/** Exported for the FailproofAI Cloud Jev parity replay (`__tests__/hooks/cloud-jev-parity.test.ts`). */
+export function toSemanticPolicy(entry: SemanticManifestEntry, pack: { id: string; version?: string }): SemanticPolicy {
   // An unknown precondition name DROPS the policy (the caller catches this),
   // rather than compiling it with no gate at all. Ungating would be the wider
   // direction, not the weaker one, but it is not what the author asked for: a

package/src/hooks/semantic/types.ts

@@ -21,6 +21,12 @@ export interface JevRequest {
   model: string;
   state: Record<string, unknown>;
   questions: Record<string, NoulQuestion>;
+  /**
+   * FailproofAI Cloud only: the tool-call metadata Cloud decides this
+   * machine's deployed Jev checks on (CONTRACT C10.3, `cloud-jev.ts`). Cloud
+   * strips it before anything reaches TypeSafe.
+   */
+  cloud?: Record<string, unknown>;
 }
 
 export interface JevNoulAnswer {
@@ -34,6 +40,8 @@ export interface JevResponse {
   usage?: { input_tokens?: number; output_tokens?: number };
   /** Set when the provider did not report which Jev version answered (Cloudflare's unversioned alias). */
   modelUnverified?: boolean;
+  /** FailproofAI Cloud only: its verdict for this machine's Cloud checks, unvalidated (`parseCloudReply`). */
+  cloud?: unknown;
 }
 
 /** A yes/no probe. A policy fires only when every one of its probes holds. */

package/src/hooks/session-pause-cli.ts

@@ -195,7 +195,7 @@ export function runPauseCommand(opts: PauseCommandOptions): PauseCommandResult {
       ...(capped
         ? [`${INDENT}Capped at ${pauseDurationWords(PAUSE_CEILING_MS)} from when this pause began.`]
         : []),
-      `${INDENT}Cloud-managed policies keep enforcing.`,
+      `${INDENT}Cloud-managed policies, and FailproofAI Cloud's Jev checks, keep enforcing.`,
       `${INDENT}Resume early:  ${kit.cmd(resume)}`,
     ],
     affected: 1,

package/src/hooks/tui.ts

@@ -1481,6 +1481,15 @@ export function promptBrowserLogin<T>(opts: BrowserLoginOptions<T>): Promise<{ v
     above.push(...lines);
   };
 
+  /** Fold what was printed above into the region, so the next repaint erases
+   *  it too — the heading goes with it and returns to the region. */
+  const forgetAbove = (): void => {
+    const cols = stdout.columns || 80;
+    for (const line of above) region.lastCount += Math.max(1, Math.ceil(visibleWidth(line) / cols));
+    above.length = 0;
+    headingShown = false;
+  };
+
   const clearPoll = (): void => {
     if (pollTimer) clearTimeout(pollTimer);
     pollTimer = null;
@@ -1500,10 +1509,7 @@ export function promptBrowserLogin<T>(opts: BrowserLoginOptions<T>): Promise<{ v
       stdin.pause();
       process.removeListener("exit", restoreTerminal);
       // Leaving for the menu takes the printed link with it.
-      if (answer === BACK) {
-        const cols = stdout.columns || 80;
-        for (const line of above) region.lastCount += Math.max(1, Math.ceil(visibleWidth(line) / cols));
-      }
+      if (answer === BACK) forgetAbove();
       const lines =
         answer === null
           ? [c.ink3("cancelled")]
@@ -1564,6 +1570,9 @@ export function promptBrowserLogin<T>(opts: BrowserLoginOptions<T>): Promise<{ v
       clearPoll();
       cautionLine = "";
       phase = "starting";
+      // A retry: the expired or refused link is dead, so it leaves the screen
+      // rather than sit above the new one, where it could still be opened.
+      forgetAbove();
       draw();
       let started: BrowserLoginStart;
       try {

package/src/hooks/uninstall-cli.ts

@@ -47,6 +47,7 @@ import {
 import { listInstallableIds, getIntegration } from "./integrations";
 import type { IntegrationType } from "./types";
 import { removeHooks } from "./manager";
+import { installedAgentSkillDirs, removeAgentSkill } from "./agent-skill";
 import { CODEX_MANAGED_BEGIN, CODEX_MANAGED_END, codexSystemConfigPath, codexSystemHooksPresent } from "./codex-system-hooks";
 import { optsFor, screenKit, type RenderOpts } from "./tui";
 
@@ -110,6 +111,8 @@ export interface UninstallResult {
 /** Everything this machine has that uninstalling would remove. */
 interface Leftovers {
   clis: IntegrationType[];
+  /** The failproofai skill folders `config` wrote into agents. */
+  skillDirs: string[];
   /** failproofai's block in Codex's system config, which only root can remove. */
   codexSystemPath: string | null;
   servicePath: string | null;
@@ -149,6 +152,7 @@ function survey(cwd?: string): Leftovers {
   const servicePath = isDaemonSupportedPlatform() ? daemonServiceFilePath() : null;
   return {
     clis,
+    skillDirs: installedAgentSkillDirs(),
     codexSystemPath: codexSystemHooksPresent() ? codexSystemConfigPath() : null,
     servicePath,
     serviceInstalled: !!servicePath && existsSync(servicePath),
@@ -166,7 +170,7 @@ export async function runUninstallCommand(opts: UninstallOptions = {}): Promise<
   const lines: string[] = [];
 
   const nothingToDo =
-    found.clis.length === 0 && !found.serviceInstalled && !found.daemonConfigured &&
+    found.clis.length === 0 && found.skillDirs.length === 0 && !found.serviceInstalled && !found.daemonConfigured &&
     !(opts.purge && found.homeExists);
   if (nothingToDo) {
     return {
@@ -191,6 +195,7 @@ export async function runUninstallCommand(opts: UninstallOptions = {}): Promise<
   const purging = Boolean(opts.purge && found.homeExists);
   const removals: string[] = [];
   if (found.clis.length > 0) removals.push(`failproofai's hooks from ${many(found.clis.length, "agent")}`);
+  if (found.skillDirs.length > 0) removals.push(`the failproofai skill from ${many(found.skillDirs.length, "agent folder")}`);
   if (found.serviceInstalled) removals.push("the failproofaid service (needs sudo)");
   if (purging) removals.push(home);
   const releasesDaemon = found.daemonConfigured && !found.serviceInstalled;
@@ -321,6 +326,12 @@ export async function runUninstallCommand(opts: UninstallOptions = {}): Promise<
     }
   }
 
+  if (found.skillDirs.length > 0) {
+    const left = found.skillDirs.length - removeAgentSkill().length;
+    if (left === 0) lines.push(kit.ok(`Removed the failproofai skill from ${many(found.skillDirs.length, "agent folder")}.`));
+    else failures.push(`Could not remove the failproofai skill from ${many(left, "agent folder")}:\n${installedAgentSkillDirs().join("\n")}`);
+  }
+
   if (found.serviceInstalled) {
     // Every run that gets here agreed to the whole plan, and the plan names the
     // service: `--yes` is yes to the plan, an interactive yes is the same answer

package/src/hooks/worker-server.ts

@@ -36,6 +36,7 @@ interface WorkerHookRequest {
   cli: IntegrationType;
   stdin: string;
   cwd?: string;
+  agentSettingsPath?: string;
 }
 
 function isWorkerHookRequest(msg: unknown): msg is WorkerHookRequest {
@@ -54,7 +55,9 @@ function isWorkerHookRequest(msg: unknown): msg is WorkerHookRequest {
     // `failproofai config` aborted with "its worker process could not be run"
     // against a daemon and worker that were both perfectly healthy. On a
     // daemonConfigured machine the same mismatch denies the tool call.
-    (m.cwd === undefined || m.cwd === null || typeof m.cwd === "string")
+    (m.cwd === undefined || m.cwd === null || typeof m.cwd === "string") &&
+    (m.agentSettingsPath === undefined || m.agentSettingsPath === null ||
+      typeof m.agentSettingsPath === "string")
   );
 }
 
@@ -278,6 +281,7 @@ function handleConnection(socket: Socket, shutdown: () => void): void {
             // Normalised here so no consumer has to know the wire spells
             // "absent" as null.
             fallbackCwd: request.cwd ?? undefined,
+            agentSettingsPath: request.agentSettingsPath ?? undefined,
             releaseRegistry: release,
           });
           deliver(

package/.next/standalone/.next/server/chunks/src_hooks_1aveq0uhs2t1b._.js

@@ -1,5 +0,0 @@
-(()=>{"use strict";module.exports=[16774,99891,98901,52306,e=>{let r;var t=e.i(66680),i=e.i(2157),o=e.i(50227),n=e.i(24214),a=e.i(79857);e.i(97348);let s=new Set(["destructive-deletion","production-infra-change","git-history-rewrite","push-to-protected-branch","commit-on-protected-branch","secret-exposure","credential-exfiltration","remote-code-execution","privilege-escalation","database-destruction","read-outside-workspace","agent-config-tampering","system-modification","env-secrets-dump","external-destructive-action","external-data-egress"]),c=new Set,l=e=>"string"==typeof e&&e.length>0;function f(e){let r={};("hard"===e.authority||"reviewable"===e.authority)&&(r.authority=e.authority);let t=e.reviewedBy;return Array.isArray(t)&&t.length>0&&t.every(l)&&(r.reviewedBy=[...t]),r}e.s(["_",0,c,"g",0,s,"i",0,f,"d",0,function(e,r=c,t){let i=e?.authority==="reviewable";if(!e||"hard"==(!0!==e.alwaysOn&&"reviewable"===e.authority&&Array.isArray(e.reviewedBy)&&e.reviewedBy.filter(e=>"string"==typeof e&&e.length>0).length>0?"reviewable":"hard")){var o;return i?{authority:"hard",downgraded:!0===(o=e).alwaysOn?"it is alwaysOn, and the self-protection guard is never reviewable":Array.isArray(o.reviewedBy)&&0!==o.reviewedBy.length?"reviewedBy is not a list of semantic policy names":"reviewedBy does not name any semantic policy"}:{authority:"hard"}}let n=e.reviewedBy;if(!n.every(l))return{authority:"hard",downgraded:"reviewedBy is not a list of semantic policy names"};let a=n.filter(e=>!r.has(e));return 0!==r.size||a.some(e=>t?.has(e))?a.length>0?{authority:"hard",downgraded:`reviewedBy names ${a.map(e=>(function(e,r,t){let i=JSON.stringify(e),o=t?.get(e);if(o)return`${i}, which packs ${o.join(" and ")} declare differently, so it is asked for neither`;if(r===s)return`${i}, which is not a semantic policy in this build`;let n=[...r].sort(),a=n.length>6?`${n.slice(0,6).join(", ")} and ${n.length-6} more`:n.join(", ");return`${i}, which is not among the Jev checks it is judged against (${a})`})(e,r,t)).join("; ")}`}:{authority:"reviewable",reviewedBy:[...new Set(n)]}:{authority:"hard"}}],99891);let d=/^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-((?:0|[1-9]\d*|\d*[A-Za-z-][0-9A-Za-z-]*)(?:\.(?:0|[1-9]\d*|\d*[A-Za-z-][0-9A-Za-z-]*))*))?(?:\+([0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*))?$/,p=/^(?:0|[1-9]\d*)$/;function h(e){if("string"!=typeof e)return null;let r=d.exec(e);return r?{major:Number(r[1]),minor:Number(r[2]),patch:Number(r[3]),prerelease:void 0===r[4]?[]:r[4].split(".").map(e=>p.test(e)?Number(e):e)}:null}let u=(e,r)=>e<r?-1:+(e>r),y=["always","protected_branch","in_git_repo","has_paths","paths_outside_project","system_or_root_paths"];function m(e){return"string"==typeof e&&y.includes(e)}e.s(["B",0,y,"M",0,m],98901);let g=[1],w=/^[a-f0-9]{64}$/,$=/^[A-Za-z0-9._-]{1,64}\/[A-Za-z0-9._-]{1,64}$/,v=/^[A-Za-z0-9][A-Za-z0-9._+-]{0,63}$/,b=/^[0-9a-f]{7,40}$/,A=/^[A-Za-z0-9._-]{1,128}$/,O=/^[a-z][a-z0-9_]{0,31}$/,S=new Set(["exempt","user_asked"]),k=new Set(["shell","write","read","network","other"]),E=new Set(["string","number","boolean","string[]","pattern[]"]);function j(e,r,t,i){if("string"!=typeof t||0===t.length)throw Error(`${e} is missing ${r}`);if(t.length>i)throw Error(`${e} has a ${r} of ${t.length} characters, over the ${i}-character cap`);return t}function P(e,r,t){let i;if(!r||"object"!=typeof r||Array.isArray(r))throw Error(`${e} is not an object`);if(null!==t)i=t;else{if("string"!=typeof r.id||!O.test(r.id))throw Error(`${e} has an unsafe id ${JSON.stringify(r.id)}`);if(S.has(r.id))throw Error(`${e} uses the reserved probe id ${JSON.stringify(r.id)}`);i=r.id}let o=j(e,"instructions",r.instructions,600);if(void 0===r.criteria)return{id:i,instructions:o};if(!r.criteria||"object"!=typeof r.criteria||Array.isArray(r.criteria))throw Error(`${e} has criteria that is not an object`);let n=r.criteria;return{id:i,instructions:o,criteria:{true:j(e,"criteria.true",n.true,300),false:j(e,"criteria.false",n.false,300)}}}function _(){let e,r=process.env.FAILPROOFAI_PACK_DIR?(0,o.resolve)(process.env.FAILPROOFAI_PACK_DIR,"installed.json"):(0,a.v)();if(!(0,i.existsSync)(r))return{packs:[],errors:[]};try{e=JSON.parse((0,i.readFileSync)(r,"utf8"))}catch(e){return{packs:[],errors:[{id:null,reason:`unreadable pack manifest: ${N(e)}`}]}}if(!e||"object"!=typeof e)return{packs:[],errors:[{id:null,reason:"pack manifest is not an object"}]};let s=e;if(!g.includes(s.schemaVersion))return{packs:[],errors:[{id:null,reason:`unsupported pack manifest schema ${String(s.schemaVersion)} (supported: ${g.join(", ")})`}]};if(!Array.isArray(s.packs))return{packs:[],errors:[{id:null,reason:"pack manifest packs is not an array"}]};let c=process.env.FAILPROOFAI_PACK_DIR??(0,a.n)(),l=[],d=[],p=[],O=new Set;for(let e of s.packs){let r=e&&"object"==typeof e&&"string"==typeof e.id?e.id:null,a=[];try{let r=function(e,r,a){if(!r||"object"!=typeof r)throw Error("pack entry is not an object");let s=function(e){if("string"!=typeof e.id||!$.test(e.id))throw Error(`unsafe pack id ${JSON.stringify(e.id)}`);if("string"!=typeof e.version||!v.test(e.version))throw Error(`invalid version for pack ${e.id}`);if(void 0!==e.effect&&"enforce"!==e.effect&&"observe"!==e.effect)throw Error(`unknown effect ${JSON.stringify(e.effect)} for pack ${e.id}`);let r="string"==typeof e.commit&&b.test(e.commit.trim().toLowerCase())?e.commit.trim().toLowerCase():void 0;return{id:e.id,version:e.version,effect:e.effect??"enforce",...r?{commit:r}:{}}}(r);if("string"!=typeof r.source||0===r.source.length)throw Error(`pack ${r.id} has no source`);if("string"!=typeof r.sha256||!w.test(r.sha256))throw Error(`invalid SHA-256 for pack ${r.id}`);let c=s.effect,l=function(e,r,t=n.version){if(void 0===r)return{kind:"satisfied"};let i=function(e,r){let t=h(e),i=h(r);return t&&i?u(t.major,i.major)||u(t.minor,i.minor)||u(t.patch,i.patch)||function(e,r){if(0===e.length&&0===r.length)return 0;if(0===e.length)return 1;if(0===r.length)return -1;for(let t=0;t<Math.min(e.length,r.length);t++){let i=e[t],o=r[t];if(i===o)continue;let n="number"==typeof i,a="number"==typeof o;if(n!==a)return n?-1:1;if(n&&a)return u(i,o);return i<o?-1:1}return u(e.length,r.length)}(t.prerelease,i.prerelease):null}(t,r);return null===i?{kind:"unreadable",reason:`pack ${e} declares minCliVersion ${JSON.stringify(r)}, which is not a version this CLI can compare against its own (${t}) — the requirement was ignored`}:i<0?{kind:"too-old",reason:`pack ${e} needs failproofai ${String(r)} or newer and this is ${t} — run \`npm i -g "failproofai@>=${String(r)}" && failproofai update\``}:{kind:"satisfied",declared:r}}(s.id,r.minCliVersion);if("too-old"===l.kind)throw Error(l.reason);"unreadable"===l.kind&&a.push(l.reason);let d=function(e,r){if(!r||(0,o.isAbsolute)(r))throw Error(`unsafe managed policy path ${JSON.stringify(r)}`);let t=(0,o.resolve)(e,r),n=(0,o.relative)(e,t);if(n.startsWith("..")||(0,o.isAbsolute)(n))throw Error(`managed policy path escapes its root: ${JSON.stringify(r)}`);let a=(0,i.realpathSync)(e),s=(0,i.realpathSync)(t),c=(0,o.relative)(a,s);if(c.startsWith("..")||(0,o.isAbsolute)(c))throw Error(`managed policy symlink escapes its root: ${JSON.stringify(r)}`);return s}(e,r.entry),p=(0,t.createHash)("sha256").update((0,i.readFileSync)(d)).digest("hex");if(p!==r.sha256)throw Error(`pack ${r.id} failed integrity verification: expected ${r.sha256}, got ${p}`);if(!Array.isArray(r.policies))throw Error(`pack ${r.id} policies is not an array`);let g=r.policies.map((e,t)=>(function(e,r,t,i){let o=`${e} policy #${t}`;if(!r||"object"!=typeof r)throw Error(`${o} is not an object`);let n=r.name;if("string"!=typeof n||!A.test(n))throw Error(`${o} has an unsafe name ${JSON.stringify(n)}`);if("alwaysOn"in r)throw Error(`${o} declares alwaysOn, which packs may not set`);if("string"!=typeof r.description||0===r.description.length)throw Error(`${o} is missing a description`);if("string"!=typeof r.category||0===r.category.length)throw Error(`${o} is missing a category`);if("boolean"!=typeof r.defaultEnabled)throw Error(`${o} is missing defaultEnabled`);if(!r.match||"object"!=typeof r.match)throw Error(`${o} is missing a match`);let a=r.match;for(let e of["events","toolNames"]){let r=a[e];if(void 0!==r&&(!Array.isArray(r)||r.some(e=>"string"!=typeof e||0===e.length)))throw Error(`${o} has a match.${e} that is not a list of names`)}let s=f(r),c=["authority","reviewedBy"].filter(e=>e in r&&!(e in s));if("params"in r){let e=function(e){if(!e||"object"!=typeof e||Array.isArray(e))return"params is not an object";for(let[r,t]of Object.entries(e)){if(0===r.length)return"params has an empty parameter name";if(!t||"object"!=typeof t||Array.isArray(t))return`params.${r} is not an object`;if("string"!=typeof t.type||!E.has(t.type))return`params.${r} has type ${JSON.stringify(t.type)}, which is not one of ${[...E].join(", ")}`;if("string"!=typeof t.description||0===t.description.length)return`params.${r} is missing a description`;if(!("default"in t))return`params.${r} is missing a default`}}(r.params);e&&(i?.push(`${o} declares a params schema that was dropped: ${e}`),c.push("params"))}return c.length>0?Object.fromEntries(Object.entries(r).filter(([e])=>!c.includes(e))):r})(r.id,e,t,a)),O=new Set;for(let e of g){if(O.has(e.name))throw Error(`pack ${r.id} declares ${e.name} twice`);O.add(e.name)}let S=null;if(void 0!==r.enabled){if(!Array.isArray(r.enabled)||r.enabled.some(e=>"string"!=typeof e))throw Error(`pack ${r.id} enabled is not an array of names`);S=r.enabled.filter(e=>O.has(e))}let _=null;if(void 0!==r.clis){if(!Array.isArray(r.clis)||r.clis.some(e=>"string"!=typeof e))throw Error(`pack ${r.id} clis is not an array of agent names`);_=r.clis}return{clis:_,id:s.id,version:s.version,source:r.source,path:d,sha256:r.sha256,effect:c,policies:g,semantic:function(e,r,t){if(void 0===r)return[];if(!Array.isArray(r))return t.push(`pack ${e} semantic is not an array, so none of it was loaded`),[];let i=[],o=new Set;for(let[n,a]of r.entries()){if(i.length>=24){t.push(`pack ${e} declares more than 24 semantic policies; the ${r.length-24} past that cap were dropped`);break}try{let r=function(e,r,t){let i=`${e} semantic policy #${t}`;if(!r||"object"!=typeof r||Array.isArray(r))throw Error(`${i} is not an object`);let o=r.name;if("string"!=typeof o||!A.test(o))throw Error(`${i} has an unsafe name ${JSON.stringify(o)}`);if("alwaysOn"in r)throw Error(`${i} declares alwaysOn, which packs may not set`);let n=j(`${e} semantic policy ${o}`,"title",r.title,120),a=`${e} semantic policy ${o}`;if(!Array.isArray(r.appliesTo)||0===r.appliesTo.length)throw Error(`${a} has no appliesTo tool classes`);let s=r.appliesTo.find(e=>"string"!=typeof e||!k.has(e));if(void 0!==s)throw Error(`${a} applies to ${JSON.stringify(s)}, which is not a tool class (${[...k].join(", ")})`);if("deny"!==r.mode&&"instruct"!==r.mode)throw Error(`${a} has mode ${JSON.stringify(r.mode)}, which must be "deny" or "instruct"`);if("boolean"!=typeof r.userCanOverride)throw Error(`${a} is missing userCanOverride, which has no default`);if(!Array.isArray(r.probes)||0===r.probes.length)throw Error(`${a} declares no probes`);if(r.probes.length>6)throw Error(`${a} declares ${r.probes.length} probes, over the cap of 6`);let c=r.probes.map((e,r)=>P(`${a} probe #${r}`,e,null)),l=new Set;for(let e of c){if(l.has(e.id))throw Error(`${a} declares probe ${e.id} twice`);l.add(e.id)}let f=void 0===r.exempt?void 0:P(`${a} exempt`,r.exempt,"exempt");if(void 0!==r.precondition&&!m(r.precondition))throw Error(`${a} names precondition ${JSON.stringify(r.precondition)}, which this build does not have (${y.join(", ")})`);let d=j(a,"guidance",r.guidance,600);return{name:o,title:n,appliesTo:r.appliesTo,mode:r.mode,userCanOverride:r.userCanOverride,probes:c,...f?{exempt:f}:{},...void 0!==r.precondition?{precondition:r.precondition}:{},guidance:d}}(e,a,n);if(o.has(r.name))throw Error(`pack ${e} declares semantic policy ${r.name} twice`);o.add(r.name),i.push(r)}catch(e){t.push(N(e))}}return i}(s.id,r.semantic,a),..."satisfied"===l.kind&&l.declared?{minCliVersion:l.declared}:{},enabled:S}}(c,e,a);if(O.has(r.id))throw Error(`duplicate pack id ${r.id}`);O.add(r.id),l.push(r),p.push(...a)}catch(i){let t=e&&("observe"===e.effect||"enforce"===e.effect)?e.effect:"enforce";d.push({id:r,reason:N(i),effect:t,...Array.isArray(e?.policies)?{declared:function(e){let r=[];for(let t of e)t&&"object"==typeof t&&"string"==typeof t.name&&t.match&&"object"==typeof t.match&&r.push(t);return r}(e.policies)}:{},...Array.isArray(e?.policies)&&0===e.policies.length?{semanticOnly:!0}:{},...Array.isArray(e?.clis)&&e.clis.every(e=>"string"==typeof e)?{clis:e.clis}:{}})}}return{packs:l,errors:d,...p.length>0?{warnings:p}:{}}}function N(e){return e instanceof Error?e.message:String(e)}e.s(["f",0,_],52306);let F=null;function I(e){let r=new Map,t=new Map;for(let i of e)for(let e of i.semantic??[]){if(J(i,e.name))continue;let o=function e(r){if(Array.isArray(r))return`[${r.map(e).join(",")}]`;if(null!==r&&"object"==typeof r){let t=Object.entries(r).filter(([,e])=>void 0!==e).sort(([e],[r])=>e<r?-1:+(e>r));return`{${t.map(([r,t])=>`${JSON.stringify(r)}:${e(t)}`).join(",")}}`}return JSON.stringify(r)??"null"}(e),n=r.get(e.name);if(void 0===n){r.set(e.name,{form:o,ids:[i.id]});continue}n.ids.push(i.id),n.form!==o&&t.set(e.name,n.ids)}return t}function J(e,r){return s.has(r)&&!/^github:FailproofAI\//i.test(e.source??"")}e.s(["j",0,function(){if(F)return F;let e=c;try{var t,i,o;let n,a,s=(t=_().packs,i=r,t.filter(e=>"observe"!==e.effect&&!(i&&Array.isArray(e.clis)&&e.clis.length>0&&!e.clis.includes(i))));o=s,n=I(o),a=o.flatMap(e=>(e.semantic??[]).filter(r=>!J(e,r.name)).map(e=>e.name)).filter(e=>!n.has(e)),e=0===a.length?c:new Set(a),I(s)}catch{}return F=e,e},"Z",0,function(e){F=null,r=e}],16774)},97348,e=>{var r=e.i(2157),t=e.i(50227),i=e.i(79857);let o={info:0,warn:1,error:2},n=(0,i.A)(),a=!1,s="warn",c=!1,l=n;function f(e){return!function(){if(a)return;a=!0;let e=(process.env.FAILPROOFAI_LOG_LEVEL??"").toLowerCase();("info"===e||"warn"===e||"error"===e)&&(s=e);let r=(process.env.FAILPROOFAI_HOOK_LOG_FILE??"").trim();r&&(c=!0,"1"!==r&&"true"!==r&&(l=r))}(),o[e]>=o[s]}function d(e,r){process.stderr.write(`[failproofai:hook] ${e} ${r}
-`)}function p(e,i){if(c)try{(0,r.existsSync)(l)||(0,r.mkdirSync)(l,{recursive:!0});let o=(0,t.join)(l,"hooks.log");try{if((0,r.statSync)(o).size>=524288){let e=`hooks-${Date.now()}.log`;(0,r.renameSync)(o,(0,t.join)(l,e))}}catch{}let n=new Date().toISOString(),a=`[${n}] ${e} ${i}
-`;(0,r.appendFileSync)(o,a,"utf-8")}catch{}}e.s(["F",0,function(e){f("error")&&(d("ERROR",e),p("ERROR",e))},"Q",0,function(e){f("info")&&(d("INFO",e),p("INFO",e))},"g",0,function(e){f("warn")&&(d("WARN",e),p("WARN",e))}])},73136,49335,e=>{var r=e.i(2157),t=e.i(50227),i=e.i(60526),o=e.i(97348),n=e.i(79857);function a(e){if(!(0,r.existsSync)(e))return{};try{let t=(0,r.readFileSync)(e,"utf8");return JSON.parse(t)}catch(r){return(0,o.g)(`failed to parse config at ${e}: ${r instanceof Error?r.message:String(r)}`),{}}}e.s(["f",0,function(e){let o=function(e){let o=(0,i.homedir)(),n=(0,t.resolve)(e);for(;n!==o;){let e=(0,t.resolve)(n,".failproofai");try{if((0,r.statSync)(e).isDirectory())return n}catch{}let i=(0,t.dirname)(n);if(i===n)break;n=i}return(0,t.resolve)(e)}(e??process.cwd()),s=(0,t.resolve)(o,".failproofai","policies-config.json"),c=(0,t.resolve)(o,".failproofai","policies-config.local.json"),l=(0,n.O)(),f=a(s),d=a(c),p=a(l),h=new Set([...f.enabledPolicies??[],...d.enabledPolicies??[],...p.enabledPolicies??[]]),u={};for(let e of[f,d,p])if(e.policyParams)for(let[r,t]of Object.entries(e.policyParams))r in u||(u[r]=t);let y=[f,d,p].map(e=>void 0!==e.customPoliciesPaths?e.customPoliciesPaths:void 0!==e.customPoliciesPath?[e.customPoliciesPath]:void 0).find(e=>void 0!==e),m=new Set([...f.disabledCustomPolicies??[],...d.disabledCustomPolicies??[],...p.disabledCustomPolicies??[]]),g=f.customPoliciesEnabled??d.customPoliciesEnabled??p.customPoliciesEnabled,w=f.llm??d.llm??p.llm;return{enabledPolicies:[...h],...Object.keys(u).length>0?{policyParams:u}:{},...void 0!==y?{customPoliciesPaths:y}:{},...m.size?{disabledCustomPolicies:[...m]}:{},...void 0!==g?{customPoliciesEnabled:g}:{},...void 0!==w?{llm:w}:{}}}],73136);var s=e.i(24214),c=e.i(28067),l=e.i(17694);let f=c._,d=new Set;async function p(e,r,t){let i=JSON.stringify({api_key:process.env.FAILPROOFAI_POSTHOG_KEY??f,event:r,distinct_id:e,properties:{...t,$lib:"failproofai-hooks",failproofai_version:s.version,product:c.W}});try{await fetch(process.env.FAILPROOFAI_POSTHOG_HOST?`${process.env.FAILPROOFAI_POSTHOG_HOST}/capture/`:"https://us.i.posthog.com/capture/",{method:"POST",headers:{"Content-Type":"application/json"},body:i,signal:AbortSignal.timeout(5e3)})}catch{}}async function h(e,r,t){if(!(0,l.f)())return;let i=p(e,r,t);d.add(i),i.finally(()=>d.delete(i)),await i}e.s(["f",0,h],49335)}]})();
-
-//# sourceMappingURL=src_hooks_1aveq0uhs2t1b._.js.map