failproofai 1.0.2-beta.0 → 1.0.2-beta.2

package/src/hooks/handler.ts

@@ -323,7 +323,7 @@ export async function evaluateHookEvent(
       if (legacyNames.length > 0) {
         hookLogWarn(
           `enforcing ${legacyNames.length} policies from this build because no pack is installed — ` +
-            `run \`failproofai update\` to move them into the pack that ships with it`,
+            `run \`failproofai policies add core\` to move them into a real pack`,
         );
       }
       // What actually registered, for the pack-duplicate check below. A paused
@@ -432,7 +432,7 @@ export async function evaluateHookEvent(
         // A pack policy whose name is an ENABLED BUILTIN is the same guard
         // twice. The two register under different keys — `failproofai/block-sudo`
         // and `pack/<id>@<version>/block-sudo` — so nothing deduped them, and
-        // the bundled pack carries the builtins under exactly these names.
+        // the core pack carries the builtins under exactly these names.
         //
         // A deny hides it (the first verdict short-circuits) but an INSTRUCT does
         // not: instructions accumulate and are joined, so the agent received the

package/src/hooks/manager.ts

@@ -26,7 +26,7 @@ import { CliError } from "../cli-error";
 import { hookLogWarn } from "./hook-logger";
 import { customPoliciesDir, globalPolicyConfigFile } from "./fp-home";
 import { readActiveCloudManagedPolicies } from "./cloud-managed-policies";
-import { installBundledPack, setPackPolicyEnabled } from "./pack-store";
+import { CORE_SOURCE, addPack, setPackPolicyEnabled } from "./pack-store";
 import type { ResolvedPack } from "./pack-manifest";
 import { hasInstalledPacks, readInstalledPacks } from "./pack-manifest";
 import {
@@ -480,7 +480,7 @@ async function installHooksImpl(
   // would leave a freshly set-up machine enforcing nothing at all — which is
   // the failure mode this whole product exists to prevent.
   //
-  // Installed from the copy vendored in the package: no network, so setup
+  // Fetched from the pack's GitHub release: there is no copy in this package,
   // cannot fail behind a proxy, and the machine is guarded the moment it is
   // configured rather than the moment it next reaches github.com.
   // The always-on guard is excluded: a pack may not declare `alwaysOn`, so the
@@ -489,7 +489,7 @@ async function installHooksImpl(
   const alwaysOnNames = new Set(BUILTIN_POLICIES.filter((p) => p.alwaysOn).map((p) => p.name));
   const fromPack = selectedPolicies.filter((name) => !alwaysOnNames.has(name));
   if (fromPack.length > 0) {
-    // ONLY when there is no pack yet. Installing the bundled pack with
+    // ONLY when there is no pack yet. Fetching the core pack with
     // `only: <selection>` REPLACES whatever the machine had chosen, and
     // `selectedPolicies` is derived from `enabledPolicies` — which is empty on a
     // machine whose pack came from `pack add core`. `policy add block-rm-rf`
@@ -499,11 +499,17 @@ async function installHooksImpl(
     // With a pack already installed the names are switched on individually
     // instead, which is additive and touches nothing else.
     if (!hasInstalledPacks()) {
-      const bundled = installBundledPack({ only: fromPack });
-      if (!bundled.installed) {
+      // Fetched, not unpacked from this package: there is no copy in here any
+      // more. That makes this the one path in `policies --install` that needs
+      // the network, so its failure is reported rather than thrown — the names
+      // are already written to config, and the no-pack fallback enforces them
+      // until a pack arrives.
+      try {
+        await addPack(CORE_SOURCE, { only: fromPack });
+      } catch (err) {
         console.log(
-          `\nWarning: could not install the policy pack (${bundled.reason}).\n` +
-            `Nothing is enforcing yet — run \`failproofai pack add core\` once that is fixed.`,
+          `\nWarning: could not fetch the policy pack (${err instanceof Error ? err.message : String(err)}).\n` +
+            `Run \`failproofai policies add core\` once you are online.`,
         );
       }
     } else {
@@ -861,25 +867,53 @@ export async function listHooks(cwd?: string): Promise<void> {
       return 0;
     }
   })();
-  groups.push(
-    title(
-      "failproofai policies",
-      installedScopes.length === 0
-        ? "not installed"
-        : `${installedScopes.join(" + ")} · ${packCount} on`,
-      opts,
-    ),
-  );
+  // `installedScopes` is about HOOKS — whether any agent CLI is wired to call
+  // us — and it says nothing about whether policies exist. Reporting it as
+  // "not installed" above a listing of an installed pack was a flat
+  // contradiction, and it hid the state that actually matters: a machine can
+  // hold thirty-eight policies and enforce none of them, because nothing is
+  // calling failproofai at all. That is the worst of the three states and it
+  // used to read like the emptiest.
+  const packsPresent = (() => {
+    try {
+      return readInstalledPacks().packs.length > 0;
+    } catch {
+      return false;
+    }
+  })();
+  const subtitle =
+    installedScopes.length > 0
+      ? `${installedScopes.join(" + ")} · ${packCount} on`
+      : packsPresent
+        ? `${packCount} on · NOT ENFORCING`
+        : "nothing installed";
+  groups.push(title("failproofai policies", subtitle, opts));
 
   if (installedScopes.length === 0) {
     groups.push(
-      nextStep(
-        "failproofai policies --install",
-        config.enabledPolicies.length > 0
-          ? "These are configured but NOT installed — no hook is running them:"
-          : "Nothing is installed yet. Get started with:",
-        opts,
-      ),
+      packsPresent
+        ? warning(
+            [
+              // ONE string, not four hand-broken ones. `warning` wraps each
+              // element to the terminal, so pre-wrapped prose keeps its author's
+              // line breaks as paragraph breaks and then wraps again inside
+              // them — which at 60 columns left the word "them." alone on a
+              // line. The command stays separate because it is not prose and
+              // must never be split across a wrap.
+              "These policies are installed but NOTHING is running them. No agent " +
+                "CLI on this machine is wired to call failproofai, so every policy " +
+                "below is inert. Wire it up with:",
+              "  failproofai config",
+            ],
+            opts,
+          )
+        : nextStep(
+            "failproofai config",
+            config.enabledPolicies.length > 0
+              ? "These are configured but NOT installed — no hook is running them:"
+              : "Nothing is set up yet. Get started with:",
+            opts,
+          ),
     );
   }
   // Held back to the end rather than printed here. Everything below this point
@@ -1034,7 +1068,7 @@ export async function listHooks(cwd?: string): Promise<void> {
   }
 
   // Installed packs. They enforce on this machine exactly like every section
-  // above, and until now the only way to see one was `failproofai pack list` —
+  // above, and until now the only way to see one was `failproofai policies` —
   // so the command that answers "what is enforcing here?" answered it with a
   // subset, for the one source a person had to go out of their way to install.
   try {