failproofai 1.0.2-beta.0 → 1.0.2-beta.2

package/src/hooks/pack-store.ts

@@ -18,7 +18,9 @@
  * Asset URLs are CONSTRUCTED from an owner, repo and concrete tag. When the
  * user omits a tag, one `releases/latest` redirect resolves it before any asset
  * is fetched or written. There is no API lookup or rate-limit dependency, and
- * the installed record always names the pinned result.
+ * the installed record always names the pinned result — which has to AGREE with
+ * the version that pack's manifest declares, or nothing is installed at all
+ * (`packTagMatchesVersion`).
  *
  * ## Never on the hook path
  *
@@ -157,6 +159,14 @@ function validated(owner: string, repo: string, tag: string | null): PackSpec {
  * unauthenticated rate limit, and stays pointed at whatever
  * `FAILPROOFAI_PACK_BASE_URL` names — which is how a mirror, and the tests,
  * work at all.
+ *
+ * The price of that, and it is a real one: the redirect is issued only for a
+ * PUBLISHED, non-prerelease release. A repository whose newest release is a
+ * prerelease or a draft therefore either redirects to an OLDER stable tag —
+ * pinning something the publisher has already superseded — or issues no
+ * redirect at all. Only the second is detectable from here, so the error names
+ * the prerelease case explicitly; the first is why naming a tag is the answer
+ * whenever a publisher's newest release is not their newest stable one.
  */
 export async function resolveLatestTag(spec: PackSpec): Promise<string> {
   const url = `${baseUrl()}/${spec.owner}/${spec.repo}/releases/latest`;
@@ -168,7 +178,9 @@ export async function resolveLatestTag(spec: PackSpec): Promise<string> {
   if (!location) {
     throw new Error(
       `could not resolve the newest release of ${spec.owner}/${spec.repo} ` +
-        `(GET ${url} returned ${response.status} with no redirect). Name a tag explicitly.`,
+        `(GET ${url} returned ${response.status} with no redirect). That redirect is issued only ` +
+        `for a published, non-prerelease release, so either the repository has no releases at all ` +
+        `or every release it has is a prerelease or a draft. Name a tag explicitly.`,
     );
   }
   const match = location.match(/\/releases\/tag\/(.+)$/);
@@ -193,6 +205,33 @@ export function packAssetUrl(spec: PinnedPackSpec, asset: string): string {
   return `${baseUrl()}/${spec.owner}/${spec.repo}/releases/download/${spec.tag}/${asset}`;
 }
 
+/**
+ * Does a release tag describe the version the pack's own manifest declares?
+ *
+ * These are two independently-typed strings that everything downstream treats as
+ * one fact: the TAG builds every asset URL and is what `installed.json` records
+ * as the source, while the VERSION is read out of the manifest and is what
+ * `pack list` prints and `pack:<id>@<version>:<name>` keys are built from. Left
+ * uncompared, a pack tagged `v2` whose manifest still said `1.0.0` installed
+ * cleanly and recorded a version no release of that repository answers to.
+ *
+ * A leading `v` is accepted because both spellings are in live use for the same
+ * release — `pack build` tells publishers to tag `<version>` while this repo's
+ * own releases are tagged `v<version>` — and refusing that would break packs
+ * that are perfectly coherent.
+ *
+ * Compared on the tag's LAST `/`-delimited segment, so the monorepo shape
+ * `parsePackSpec` deliberately supports (`release/2.1`) still installs:
+ * `PACK_VERSION_RE` forbids `/`, so such a tag could never equal a version and a
+ * whole-string comparison would make the shape uninstallable rather than merely
+ * unusual. Everything else is a genuine disagreement — the release was tagged
+ * without rebuilding the manifest, or the wrong tag was typed.
+ */
+export function packTagMatchesVersion(tag: string, version: string): boolean {
+  const tail = tag.slice(tag.lastIndexOf("/") + 1);
+  return tail === version || tail === `v${version}`;
+}
+
 async function fetchBytes(url: string): Promise<Buffer> {
   const response = await fetch(url, {
     signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
@@ -277,6 +316,16 @@ interface FetchedPack {
  * and has to resolve it the same way — `core` worked in the terminal and failed
  * in the browser for exactly as long as this list sat in `pack-cli.ts`.
  */
+/**
+ * Where our own policies actually live.
+ *
+ * They are a GitHub release like anybody else's, and the package carries no
+ * copy of them. That is the point: a pack that ships inside the binary is a
+ * policy set we chose for you and put on your disk before you asked, and it
+ * gives our own policies a delivery path nobody else's pack can use. One lane,
+ * the same for everyone — ours are just the pack whose short name we spell.
+ */
+export const CORE_SOURCE = "FailproofAI/policies";
 export const CORE_ALIASES = new Set(["core", "failproofai", "official"]);
 
 export interface PackAddOptions {
@@ -307,18 +356,12 @@ export async function addPackFromSource(
   source: string,
   opts: PackAddOptions = {},
 ): Promise<AddedPack> {
-  if (CORE_ALIASES.has(source.trim().toLowerCase())) {
-    const result = installBundledPack(opts);
-    if (!result.installed) throw new Error(result.reason ?? "could not install");
-    return {
-      id: result.id!,
-      version: result.version!,
-      enabled: result.enabled ?? result.available ?? [],
-      available: result.available ?? [],
-      bundled: true,
-    };
-  }
-  const result = await addPack(source, opts);
+  // `core` is a spelling of CORE_SOURCE, not a second delivery path. Resolved
+  // HERE rather than in the CLI so the dashboard and the CLI cannot disagree
+  // about what the short name means — they did once, and a name the CLI could
+  // resolve failed in the browser.
+  const resolved = CORE_ALIASES.has(source.trim().toLowerCase()) ? CORE_SOURCE : source;
+  const result = await addPack(resolved, opts);
   return {
     id: result.id,
     version: result.version,
@@ -607,6 +650,27 @@ export async function addPack(
     : { ...parsed, tag: await resolveLatestTag(parsed) };
   const resolvedFromLatest = parsed.tag === null;
   const fetched = await fetchPack(spec);
+  // Checked here, before a byte is written and before the artifact is imported,
+  // so a refusal leaves the machine exactly as it was — and on the RESOLVED tag
+  // as well as a typed one, because a tagless add pins whatever
+  // `releases/latest` pointed at and lands the same incoherent pair in
+  // `installed.json` with nobody having typed it. Deliberately NOT in
+  // `fetchPackPreview`: looking at a pack has to stay possible precisely so a
+  // publisher can SEE the two values disagree.
+  if (!packTagMatchesVersion(spec.tag, fetched.version)) {
+    const fromTag = spec.tag.slice(spec.tag.lastIndexOf("/") + 1).replace(/^v/, "");
+    const fix =
+      `re-tag the release ${fetched.version} (a leading v is fine), or rebuild the pack with ` +
+      `--version ${fromTag}`;
+    throw new Error(
+      `${fetched.id} was not installed: release tag ${spec.tag} does not match the version its ` +
+        `manifest declares (${fetched.version}). ` +
+        (resolvedFromLatest
+          ? `That is the newest release of ${spec.owner}/${spec.repo}, so the release and the pack ` +
+            `disagree at the source — ask the publisher to ${fix}.`
+          : `Name the tag whose manifest says ${fetched.version}, or fix the pack: ${fix}.`),
+    );
+  }
   const available = fetched.policies.map((p) => p.name);
 
   const prior = priorRecordFor(fetched.id, fetched.artifactDigest);
@@ -686,25 +750,21 @@ export async function addPack(
 }
 
 /**
- * Install the pack that ships inside the npm package, from disk.
+ * The vendored pack directory, when a working tree happens to have one.
  *
- * This is what makes removing the builtins from the bundle survivable. The
- * tarball carries `policy-pack/` — the builtins as a real, digest-verified pack —
- * so a machine that has just installed failproofai already HAS them and setup
- * can enable them with no network at all. Without this, a fresh install with no
- * connectivity would be a machine enforcing nothing.
+ * The published package does NOT carry `policy-pack/` and there is no install
+ * path through here. Our policies are fetched from their GitHub release like
+ * anybody else's — a pack that ships inside the binary is a policy set chosen
+ * for the user and written to their disk before they asked, and it gave our own
+ * policies a delivery route no third-party pack could use.
+ *
+ * The one remaining caller is `audit/replay.ts`, which prefers the pack's own
+ * functions when a dev tree has run `build:pack` and falls back to the compiled
+ * implementations when it returns null. Both produce identical text, so the two
+ * paths score the same; the fallback is the normal case now.
  *
  * Anchored at `FAILPROOFAI_PACKAGE_ROOT` for the reason `npmPlatformBinaryPath`
  * documents: `import.meta.url` does not survive the CJS bundle.
- *
- * The bytes are COPIED into `packsDir()` rather than loaded where they lie. A
- * `sudo npm i -g` package directory is root-owned, and the loader writes its
- * rewritten module tree BESIDE the source it loads — so loading in place gives a
- * non-root hook EACCES, the pack never loads, and the hook exits 0. Copying is
- * what avoids that, and it is the same trap CHANGELOG #694 fixed for the shim.
- *
- * Idempotent, and never throws: a package without the directory returns null,
- * which is a normal state for a dev checkout that has not run `build:pack`.
  */
 export function bundledPackDir(): string | null {
   const root = process.env.FAILPROOFAI_PACKAGE_ROOT;
@@ -713,105 +773,6 @@ export function bundledPackDir(): string | null {
   return existsSync(resolve(dir, PACK_MANIFEST_ASSET)) ? dir : null;
 }
 
-export interface BundledPackResult {
-  installed: boolean;
-  id?: string;
-  version?: string;
-  enabled?: string[];
-  available?: string[];
-  /** Ids this install absorbed — the same pack, previously under another name. */
-  replaced?: string[];
-  reason?: string;
-}
-
-export function installBundledPack(opts?: { only?: string[]; categories?: string[]; all?: boolean }): BundledPackResult {
-  const dir = bundledPackDir();
-  if (!dir) return { installed: false, reason: "this build ships no bundled pack" };
-
-  try {
-    const checksums = readFileSync(resolve(dir, PACK_CHECKSUMS_ASSET), "utf8");
-    const manifestBytes = readFileSync(resolve(dir, PACK_MANIFEST_ASSET));
-    const artifact = readFileSync(resolve(dir, PACK_ENTRY_ASSET));
-
-    // Verified even though it never crossed a network. The digest is what the
-    // hook path re-checks before every import, so it has to describe the bytes
-    // actually installed — and a tarball can be corrupted on disk like anything
-    // else.
-    const manifestDigest = digestFor(checksums, PACK_MANIFEST_ASSET);
-    const entryDigest = digestFor(checksums, PACK_ENTRY_ASSET);
-    const artifactDigest = sha256(artifact);
-    if (!manifestDigest || sha256(manifestBytes) !== manifestDigest) {
-      return { installed: false, reason: `${PACK_MANIFEST_ASSET} failed integrity verification` };
-    }
-    if (!entryDigest || artifactDigest !== entryDigest) {
-      return { installed: false, reason: `${PACK_ENTRY_ASSET} failed integrity verification` };
-    }
-
-    const parsed = JSON.parse(manifestBytes.toString("utf8")) as {
-      id?: unknown; version?: unknown; policies?: unknown; effect?: unknown;
-    };
-    if (!Array.isArray(parsed.policies)) {
-      return { installed: false, reason: "bundled pack manifest is malformed" };
-    }
-    const identity = parsePackIdentity(parsed);
-    // Same rules the loader applies, so a bundled pack that could never load
-    // fails the install rather than looking fine until the next tool call.
-    const policies = parsed.policies.map((pol, i) => parsePackPolicy(identity.id, pol, i));
-
-    const root = packsRoot();
-    const artifactRel = `artifacts/${artifactDigest}.mjs`;
-    const artifactAbs = resolve(root, artifactRel);
-    if (!existsSync(artifactAbs)) writeAtomic(artifactAbs, artifact);
-
-    const prior = priorRecordFor(identity.id, artifactDigest);
-    const available = policies.map((pol) => pol.name);
-    const { enabled } = resolveSelection(
-      policies,
-      opts,
-      prior?.enabled ? prior.enabled.filter((n) => available.includes(n)) : prior?.enabled,
-      Boolean(prior),
-    );
-
-    const absorbed = upsertInstalled({
-      id: identity.id,
-      version: identity.version,
-      // Recorded as `bundled:` rather than a github: source, because it did not
-      // come from one — and `pack add` on this id would otherwise look like a
-      // re-fetch of something that was never fetched.
-      source: `bundled:${identity.id}@${identity.version}`,
-      entry: artifactRel,
-      sha256: artifactDigest,
-      policies,
-      ...(parsed.effect !== undefined ? { effect: identity.effect } : {}),
-      ...(enabled ? { enabled } : {}),
-    });
-
-    return {
-      installed: true,
-      id: identity.id,
-      version: identity.version,
-      enabled: enabled ?? available,
-      available,
-      ...(absorbed.length > 0 ? { replaced: absorbed } : {}),
-    };
-  } catch (err) {
-    return { installed: false, reason: errText(err) };
-  }
-}
-
-/** Remove a pack from the activation pointer. Returns false if it was not installed. */
-/**
- * Turn ONE policy of an installed pack on or off.
- *
- * The selection in `installed.json` is the lever, not a `disabledCustomPolicies`
- * entry: those are keyed by `pack:<id>@<version>:<name>`, so an upgrade stops
- * matching them and silently switches back on everything the user had turned
- * off. The selection is version-stable and is carried forward by `pack add`.
- *
- * Enabling also clears any matching disabled key, or a policy switched off from
- * the dashboard could not be switched back on from the CLI — the two mechanisms
- * would disagree and the more obscure one would win.
- */
 export function setPackPolicyEnabled(
   packId: string,
   name: string,

package/src/hooks/tui.ts

@@ -14,8 +14,8 @@
  * repaint) and, on resolve, collapses that region to a one-line summary that
  * stays on screen — so the next prompt simply appends below, building the log.
  * No external dependencies. Honors NO_COLOR and non-TTY (returns the default
- * without drawing), and uses 24-bit color where COLORTERM advertises it,
- * falling back to the nearest basic ANSI hue otherwise.
+ * without drawing), and paints at the deepest tier the terminal admits to —
+ * 24-bit, the xterm-256 cube, or the 16 basic ANSI hues.
  */
 import * as readline from "node:readline";
 
@@ -108,7 +108,7 @@ const RADIO_OFF = "○";
 export const CHECK_ON = "◼";
 export const CHECK_OFF = "◻";
 export const CARET = "❯";
-const FLOWER = "❋";
+const MARK = "\u25AE\u25AE"; // ▮▮ — the brand mark, per the design system
 
 // ── color ─────────────────────────────────────────────────────────────────
 // The single source of truth for the brand palette — exported (via `paint`)
@@ -116,13 +116,32 @@ const FLOWER = "❋";
 // re-deriving their own copies.
 interface Hue {
   rgb: [number, number, number];
+  /**
+   * xterm-256 index for the middle tier, verified as the nearest cube entry by
+   * Euclidean distance rather than eyeballed.
+   *
+   * Optional because `dim` has no honest answer: its `basic` is SGR 2, an
+   * ATTRIBUTE that steps down whatever foreground the user's theme is already
+   * using, and the cube's nearest grey (243, #767676) is a fixed colour that
+   * fights every theme that is not ours. So dim keeps the attribute at all
+   * three tiers and this stays undefined.
+   */
+  c256?: number;
   basic: string;
 }
+/**
+ * TWO accent hues and no third — the brand system states that as a rule, and
+ * this table used to break it: `pink` was #ff2e88, a hot pink that appears in
+ * no brand token, sitting beside `logoPink` #e4587d which was the real one. The
+ * mark and the prompts were therefore two different pinks, and neither surface
+ * could be recoloured without the other drifting. There is now one pink.
+ * Everything past the two accents is a state — amber for warn, an attribute for
+ * dim — never identity.
+ */
 const HUES = {
-  guide: { rgb: [102, 209, 181], basic: "36" }, // teal — the policy flower / step spine
-  pink: { rgb: [255, 46, 136], basic: "95" }, // hot pink — selection, enabled, the brand
-  logoPink: { rgb: [228, 88, 124], basic: "95" }, // the softer artwork pink of the logomark
-  warn: { rgb: [227, 179, 65], basic: "33" },
+  guide: { rgb: [102, 209, 181], c256: 79, basic: "36" }, // #66d1b5 mint — the policy flower / step spine
+  pink: { rgb: [228, 88, 125], c256: 168, basic: "95" }, // #e4587d — selection, enabled, the mark, the brand
+  warn: { rgb: [227, 179, 65], c256: 179, basic: "33" },
   dim: { rgb: [107, 118, 132], basic: "2" },
 } satisfies Record<string, Hue>;
 
@@ -137,32 +156,68 @@ export function colorsEnabled(out: TTYOut): boolean {
  * blue that appear nowhere in the brand — so `audit` looked like a different
  * product from `config`. Routing it here
  * keeps HUES the single source of truth: change a hue once and every surface
- * follows. Emits truecolor where the terminal advertises it, basic ANSI
- * otherwise; the caller still decides *whether* to colour at all.
+ * follows. Paints at the deepest tier the terminal admits to; the caller still
+ * decides *whether* to colour at all.
  */
 export function brandAnsi(role: keyof typeof HUES): string {
-  const h = HUES[role];
-  const code = truecolorEnabled() ? `38;2;${h.rgb.join(";")}` : h.basic;
-  return `${ESC}[${code}m`;
+  return `${ESC}[${fg(HUES[role], colorTier())}m`;
 }
 
 export const ANSI_RESET = `${ESC}[0m`;
 export const ANSI_BOLD = `${ESC}[1m`;
 export const ANSI_DIM = `${ESC}[2m`;
-function truecolorEnabled(): boolean {
-  return /truecolor|24bit/i.test(process.env.COLORTERM || "");
-}
 
-/** Brand painter: role-named color functions, truecolor where advertised,
- * basic-ANSI fallback otherwise, identity when `on` is false. */
+/** How much colour this terminal will actually render. */
+type ColorTier = "truecolor" | "ansi256" | "basic";
+
+/**
+ * Three tiers, because the two-way gate skipped the one most terminals are in.
+ *
+ * COLORTERM-or-nothing sent every terminal that renders 256 colours but does
+ * not advertise 24-bit — tmux and screen, ssh into a stock xterm, most CI
+ * runners — all the way down to the 16 basic hues, where the brand pink lands
+ * on generic bright magenta and the mint on generic cyan. TERM naming its own
+ * depth is the signal those terminals do set, and it costs one regex.
+ *
+ * Deliberately no `FORCE_COLOR` / `-256color`-less allowlist: over-claiming a
+ * depth prints raw escape bytes into the user's scrollback, which is worse than
+ * an approximate hue. Under-claiming only costs fidelity.
+ */
+function colorTier(): ColorTier {
+  if (/truecolor|24bit/i.test(process.env.COLORTERM || "")) return "truecolor";
+  if (/256color/i.test(process.env.TERM || "")) return "ansi256";
+  return "basic";
+}
+
+/** SGR foreground parameters for a hue at a tier. The ONE place a hue turns
+ *  into bytes, so a new tier is added here and nowhere else. */
+function fg(h: Hue, tier: ColorTier): string {
+  if (tier === "truecolor") return `38;2;${h.rgb[0]};${h.rgb[1]};${h.rgb[2]}`;
+  if (tier === "ansi256" && h.c256 !== undefined) return `38;5;${h.c256}`;
+  return h.basic;
+}
+
+/** The same as a background — only the logomark needs one, for a half-block
+ *  cell whose two pixels are different hues. The current grid has no such cell
+ *  (the flower and the cross never share a column), so this is here for the
+ *  next grid edit, which the rules above LOGO_GRID actively invite. Never
+ *  called at the basic tier: the mark draws monochrome there rather than
+ *  approximate two brand hues with ANSI 5 and 6. */
+function bg(h: Hue, tier: ColorTier): string {
+  return tier === "ansi256" && h.c256 !== undefined
+    ? `48;5;${h.c256}`
+    : `48;2;${h.rgb[0]};${h.rgb[1]};${h.rgb[2]}`;
+}
+
+/** Brand painter: role-named color functions at the terminal's best tier,
+ * identity when `on` is false. */
 export function paint(on: boolean) {
-  const tc = on && truecolorEnabled();
+  const tier: ColorTier = on ? colorTier() : "basic";
   const mk =
     (h: Hue, bold = false) =>
     (s: string): string => {
       if (!on) return s;
-      const code = tc ? `38;2;${h.rgb[0]};${h.rgb[1]};${h.rgb[2]}` : h.basic;
-      return `${ESC}[${bold ? "1;" : ""}${code}m${s}${ESC}[0m`;
+      return `${ESC}[${bold ? "1;" : ""}${fg(h, tier)}m${s}${ESC}[0m`;
     };
   return {
     bold: (s: string) => (on ? `${ESC}[1m${s}${ESC}[0m` : s),
@@ -170,7 +225,11 @@ export function paint(on: boolean) {
     guide: mk(HUES.guide),
     pink: mk(HUES.pink),
     pinkBold: mk(HUES.pink, true),
-    softPink: mk(HUES.logoPink),
+    // An ALIAS of `pink`, not a hue. The logomark's softer artwork tint
+    // collapsed into the one brand pink, so this name survives only for its
+    // single caller — install-prompt.ts's "beta" pill — and should be renamed
+    // to `pink` there, at which point it is deleted.
+    softPink: mk(HUES.pink),
     warn: mk(HUES.warn),
   };
 }
@@ -224,37 +283,40 @@ const LOGO_GRID = [
   "..ppppppppppp",
   "..ppppppppppp",
 ];
-// Derived from the shared HUES table so a palette tweak needs one edit.
-const LOGO_TEAL: [number, number, number] = HUES.guide.rgb;
-const LOGO_PINK: [number, number, number] = HUES.logoPink.rgb;
-
-/** Render the logomark as half-block art. When `colorize` is false (no truecolor
- * / NO_COLOR) the shape still prints, just monochrome. */
-function renderLogo(colorize: boolean): string[] {
+// Derived from the shared HUES table so a palette tweak needs one edit. The
+// mark is painted from the SAME two accents as the prompts — it used to carry
+// its own pink, which is how the two drifted apart.
+const LOGO_TEAL: Hue = HUES.guide;
+const LOGO_PINK: Hue = HUES.pink;
+
+/** Render the logomark as half-block art. At the `basic` tier (16 colours, or
+ * NO_COLOR) the shape still prints, just monochrome — approximating two brand
+ * hues with generic magenta and cyan reads as a different mark, and the shape
+ * alone already carries it. */
+function renderLogo(tier: ColorTier): string[] {
   const pad = ".".repeat(LOGO_GRID[0]?.length ?? 0);
-  const rgb = (ch: string): [number, number, number] | null =>
-    ch === "t" ? LOGO_TEAL : ch === "p" ? LOGO_PINK : null;
+  const hue = (ch: string): Hue | null => (ch === "t" ? LOGO_TEAL : ch === "p" ? LOGO_PINK : null);
   const lines: string[] = [];
   for (let r = 0; r < LOGO_GRID.length; r += 2) {
     const top = LOGO_GRID[r];
     const bot = LOGO_GRID[r + 1] ?? pad;
     let line = "";
     for (let x = 0; x < top.length; x++) {
-      const t = rgb(top[x]);
-      const b = rgb(bot[x]);
+      const t = hue(top[x]);
+      const b = hue(bot[x]);
       if (!t && !b) {
         line += " ";
-      } else if (!colorize) {
+      } else if (tier === "basic") {
         line += t && b ? "█" : t ? "▀" : "▄";
       } else if (t && b) {
         line +=
           t === b
-            ? `${ESC}[38;2;${t.join(";")}m█${ESC}[0m`
-            : `${ESC}[38;2;${t.join(";")};48;2;${b.join(";")}m▀${ESC}[0m`;
+            ? `${ESC}[${fg(t, tier)}m█${ESC}[0m`
+            : `${ESC}[${fg(t, tier)};${bg(b, tier)}m▀${ESC}[0m`;
       } else if (t) {
-        line += `${ESC}[38;2;${t.join(";")}m▀${ESC}[0m`;
+        line += `${ESC}[${fg(t, tier)}m▀${ESC}[0m`;
       } else {
-        line += `${ESC}[38;2;${b!.join(";")}m▄${ESC}[0m`;
+        line += `${ESC}[${fg(b!, tier)}m▄${ESC}[0m`;
       }
     }
     lines.push(line);
@@ -318,10 +380,12 @@ export function renderBrandLogo(stdout: TTYOut = process.stdout): string[] {
   const c = paint(colorsEnabled(stdout));
   const cols = stdout.columns || 80;
   if (cols < LOGO_MIN_COLS) {
-    return [`${c.guide(FLOWER)} fa${c.pink("il")}proof ai  ${c.dim("· " + TAGLINE)}`];
+    return [`${c.pink(MARK)} fa${c.pink("il")}proof ai  ${c.dim("· " + TAGLINE)}`];
   }
-  const tc = colorsEnabled(stdout) && truecolorEnabled();
-  const lines = renderLogo(tc).map((l) => `  ${l}`);
+  // NO_COLOR / non-TTY forces `basic`, which renderLogo draws monochrome — so
+  // the mark never emits an escape byte on a stream that asked for none.
+  const tier: ColorTier = colorsEnabled(stdout) ? colorTier() : "basic";
+  const lines = renderLogo(tier).map((l) => `  ${l}`);
   lines.push("");
   lines.push(`  fa${c.pink("il")}proof ai`);
   lines.push(`  ${c.dim(TAGLINE)}`);
@@ -427,9 +491,25 @@ type Region = { lastCount: number };
 
 const WINDOW = 8; // visible rows before the checklist scrolls
 
+/**
+ * Redraw the region as ONE atomic frame.
+ *
+ * Two things make it atomic, and both are needed. The cursor-up-and-clear used
+ * to be its own `write()`, so a terminal could render the CLEARED state before
+ * the new lines arrived — a blank flash on every keystroke, invisible locally
+ * and obvious over SSH or inside tmux, where the two writes cross a network or
+ * a multiplexer between frames. They are one string now.
+ *
+ * And that string is wrapped in synchronized output (DECSET 2026), which tells
+ * the terminal to hold what it has until the reset rather than painting each
+ * chunk as it lands. Terminals that do not implement it ignore an unknown
+ * private mode, so it costs nothing where it does not help.
+ */
 function repaint(out: TTYOut, region: Region, lines: string[]): void {
-  if (region.lastCount > 0) out.write(`${ESC}[${region.lastCount}A${ESC}[J`);
-  writeLines(out, lines);
+  const cols = out.columns || 80;
+  const body = lines.map((l) => (l === "" ? l : truncate(l, cols))).join("\n") + "\n";
+  const clear = region.lastCount > 0 ? `${ESC}[${region.lastCount}A${ESC}[J` : "";
+  out.write(`${ESC}[?2026h${clear}${body}${ESC}[?2026l`);
   region.lastCount = lines.length;
 }
 
@@ -445,6 +525,24 @@ function nameWidth(labels: string[]): number {
   return Math.min(24, Math.max(6, ...labels.map((l) => l.length)));
 }
 
+/**
+ * The hint budget for one row, after a label that outgrew its column.
+ *
+ * `nameWidth` caps the name column at 24 so that one long name cannot squeeze
+ * every description on screen — but `padEnd` pads, it does not TRUNCATE, so a
+ * longer name renders at its true width while the description was sized against
+ * the cap. The row then overruns the terminal by the difference and the
+ * description is cut by the terminal instead of by `ellipsize`, with no `…` to
+ * show it happened.
+ *
+ * Names are deliberately not truncated: a policy name is the thing you type
+ * next, and half of one is useless. The description gives up the space, because
+ * it is prose and shortening prose costs nothing.
+ */
+function hintBudget(label: string, nameCol: number, budget: number): number {
+  return Math.max(6, budget - Math.max(0, label.length - nameCol));
+}
+
 type DisplayRow = { kind: "header"; text: string } | { kind: "item"; index: number };
 
 /** Flatten choices into section-header + item display rows. */
@@ -651,7 +749,9 @@ export function selectOne<T>(opts: SelectOneOptions<T>): Promise<T | Back | null
       const dot = active ? c.pink(RADIO_ON) : c.dim(RADIO_OFF);
       const rawLabel = choice.label.padEnd(nameCol);
       const label = active ? c.pinkBold(rawLabel) : rawLabel;
-      const hint = choice.hint ? `  ${c.dim(ellipsize(choice.hint, budget))}` : "";
+      const hint = choice.hint
+        ? `  ${c.dim(ellipsize(choice.hint, hintBudget(choice.label, nameCol, budget)))}`
+        : "";
       return `${dot} ${label}${hint}`;
     },
     allowBack: opts.allowBack,
@@ -709,7 +809,9 @@ export function multiSelect<T>(opts: MultiSelectOptions<T>): Promise<T[] | null
           : c.dim(CHECK_OFF);
       const rawLabel = choice.label.padEnd(nameCol);
       const label = active ? c.pinkBold(rawLabel) : checked[index] ? rawLabel : c.dim(rawLabel);
-      const hint = choice.hint ? `  ${c.dim(ellipsize(choice.hint, budget))}` : "";
+      const hint = choice.hint
+        ? `  ${c.dim(ellipsize(choice.hint, hintBudget(choice.label, nameCol, budget)))}`
+        : "";
       return `${caret} ${box} ${label}${hint}`;
     },
     warnLine: () => (warn ? c.warn(`Select at least ${minSelected}.`) : null),
@@ -1152,9 +1254,9 @@ export function rule(label?: string, opts?: RenderOpts): string[] {
   const { cols, c } = ctx(opts);
   const width = Math.max(4, cols - INDENT.length * 2);
   if (!label) return [`${INDENT}${c.dim("─".repeat(width))}`];
-  const head = `── ${label} `;
+  const head = `━━ ${label} `;
   const tail = Math.max(3, width - head.length);
-  return [`${INDENT}${c.dim(head + "─".repeat(tail))}`];
+  return [`${INDENT}${c.dim(head + "━".repeat(tail))}`];
 }
 
 export interface Row {
@@ -1329,7 +1431,7 @@ const CHIP_LABELS: Record<ChipState, string> = {
   locked: "✓ LOCK",
   cloud: "✓ CLOUD",
   pack: "✓ PACK",
-  failed: "⚠ FAIL",
+  failed: "\u25B2 FAIL",
   observe: "◉ OBS",
 };
 
@@ -1400,7 +1502,7 @@ function gutterBlock(symbol: string, lines: string[], opts?: RenderOpts): string
  *  scopes or six about the daemon. */
 export function warning(lines: string[], opts?: RenderOpts): string[] {
   const { c } = ctx(opts);
-  return gutterBlock(c.warn("⚠"), lines, opts);
+  return gutterBlock(c.warn("\u25B2"), lines, opts);
 }
 
 /** The same, for the ones that destroy something. */

package/.next/standalone/.next/server/chunks/ssr/[root-of-the-server]__0zig5sv._.js

@@ -1,3 +0,0 @@
-module.exports=[18622,(a,b,c)=>{b.exports=a.x("next/dist/compiled/next-server/app-page-turbo.runtime.prod.js",()=>require("next/dist/compiled/next-server/app-page-turbo.runtime.prod.js"))},20635,(a,b,c)=>{b.exports=a.x("next/dist/server/app-render/action-async-storage.external.js",()=>require("next/dist/server/app-render/action-async-storage.external.js"))},24725,(a,b,c)=>{b.exports=a.x("next/dist/server/app-render/after-task-async-storage.external.js",()=>require("next/dist/server/app-render/after-task-async-storage.external.js"))},43285,(a,b,c)=>{b.exports=a.x("next/dist/server/app-render/dynamic-access-async-storage.external.js",()=>require("next/dist/server/app-render/dynamic-access-async-storage.external.js"))},56704,(a,b,c)=>{b.exports=a.x("next/dist/server/app-render/work-async-storage.external.js",()=>require("next/dist/server/app-render/work-async-storage.external.js"))},32319,(a,b,c)=>{b.exports=a.x("next/dist/server/app-render/work-unit-async-storage.external.js",()=>require("next/dist/server/app-render/work-unit-async-storage.external.js"))},59043,(a,b,c)=>{b.exports=a.x("next/dist/server/runtime-reacts.external.js",()=>require("next/dist/server/runtime-reacts.external.js"))},77580,a=>{"use strict";var b=a.i(5050);let c=(0,b.createServerReference)("00b801c035726aaa9d297e34f35258369a37177149",b.callServer,void 0,b.findSourceMapURL,"getTelemetryConfig");a.s(["getTelemetryConfig",0,c])},3171,a=>{"use strict";var b=a.i(87924),c=a.i(72131),d=a.i(77580),e=a.i(66036);a.s(["default",0,function({error:a,reset:f}){return(0,c.useEffect)(()=>{(0,d.getTelemetryConfig)().then(b=>{(0,e.setClientTelemetryConfig)(b),(0,e.captureClientEvent)("client_error",{error_message:a.message,error_name:a.name,error_digest:a.digest,boundary:"global"})}).catch(()=>{})},[a]),(0,b.jsx)("html",{children:(0,b.jsx)("body",{children:(0,b.jsx)("main",{style:{minHeight:"100vh",display:"flex",alignItems:"center",justifyContent:"center",background:"#031035",color:"#f8fafc",fontFamily:"system-ui, sans-serif"},children:(0,b.jsxs)("div",{style:{textAlign:"center",padding:"2rem",border:"1px solid rgba(239,68,68,0.4)",borderRadius:"0.5rem",maxWidth:"500px"},children:[(0,b.jsx)("h2",{style:{color:"#ef4444",marginBottom:"0.5rem",fontSize:"1.25rem"},children:"Something went wrong"}),(0,b.jsx)("p",{style:{color:"#94a3b8",marginBottom:"1.5rem"},children:a.message||"An unexpected error occurred."}),(0,b.jsx)("button",{onClick:f,style:{padding:"0.5rem 1.25rem",background:"#3b82f6",color:"white",border:"none",borderRadius:"0.375rem",cursor:"pointer",fontSize:"0.875rem"},children:"Try again"})]})})})})}])},66036,a=>{"use strict";a.s(["captureClientEvent",0,function(a,b){},"setClientTelemetryConfig",0,function(a){}])},46058,(a,b,c)=>{"use strict";function d(a){if("function"!=typeof WeakMap)return null;var b=new WeakMap,c=new WeakMap;return(d=function(a){return a?c:b})(a)}c._=function(a,b){if(!b&&a&&a.__esModule)return a;if(null===a||"object"!=typeof a&&"function"!=typeof a)return{default:a};var c=d(b);if(c&&c.has(a))return c.get(a);var e={__proto__:null},f=Object.defineProperty&&Object.getOwnPropertyDescriptor;for(var g in a)if("default"!==g&&Object.prototype.hasOwnProperty.call(a,g)){var h=f?Object.getOwnPropertyDescriptor(a,g):null;h&&(h.get||h.set)?Object.defineProperty(e,g,h):e[g]=a[g]}return e.default=a,c&&c.set(a,e),e}},5050,(a,b,c)=>{"use strict";Object.defineProperty(c,"__esModule",{value:!0});var d={callServer:function(){return f.callServer},createServerReference:function(){return h.createServerReference},findSourceMapURL:function(){return g.findSourceMapURL}};for(var e in d)Object.defineProperty(c,e,{enumerable:!0,get:d[e]});let f=a.r(20611),g=a.r(1722),h=a.r(38783)},20611,(a,b,c)=>{"use strict";Object.defineProperty(c,"__esModule",{value:!0}),Object.defineProperty(c,"callServer",{enumerable:!0,get:function(){return g}});let d=a.r(72131),e=a.r(88347),f=a.r(90841);async function g(a,b){return new Promise((c,g)=>{(0,d.startTransition)(()=>{(0,f.dispatchAppRouterAction)({type:e.ACTION_SERVER_ACTION,actionId:a,actionArgs:b,resolve:c,reject:g})})})}("function"==typeof c.default||"object"==typeof c.default&&null!==c.default)&&void 0===c.default.__esModule&&(Object.defineProperty(c.default,"__esModule",{value:!0}),Object.assign(c.default,c),b.exports=c.default)},1722,(a,b,c)=>{"use strict";let d;Object.defineProperty(c,"__esModule",{value:!0}),Object.defineProperty(c,"findSourceMapURL",{enumerable:!0,get:function(){return d}});("function"==typeof c.default||"object"==typeof c.default&&null!==c.default)&&void 0===c.default.__esModule&&(Object.defineProperty(c.default,"__esModule",{value:!0}),Object.assign(c.default,c),b.exports=c.default)},88347,(a,b,c)=>{"use strict";Object.defineProperty(c,"__esModule",{value:!0});var d,e,f={ACTION_HMR_REFRESH:function(){return l},ACTION_NAVIGATE:function(){return i},ACTION_REFRESH:function(){return h},ACTION_RESTORE:function(){return j},ACTION_SERVER_ACTION:function(){return m},ACTION_SERVER_PATCH:function(){return k},PrefetchKind:function(){return n},ScrollBehavior:function(){return o}};for(var g in f)Object.defineProperty(c,g,{enumerable:!0,get:f[g]});let h="refresh",i="navigate",j="restore",k="server-patch",l="hmr-refresh",m="server-action";var n=((d={}).AUTO="auto",d.FULL="full",d),o=((e={})[e.Default=0]="Default",e[e.NoScroll=1]="NoScroll",e);("function"==typeof c.default||"object"==typeof c.default&&null!==c.default)&&void 0===c.default.__esModule&&(Object.defineProperty(c.default,"__esModule",{value:!0}),Object.assign(c.default,c),b.exports=c.default)},90841,(a,b,c)=>{"use strict";Object.defineProperty(c,"__esModule",{value:!0});var d={dispatchAppRouterAction:function(){return i},dispatchGestureState:function(){return j},refreshOnInstantNavigationUnlock:function(){return h},useActionQueue:function(){return k}};for(var e in d)Object.defineProperty(c,e,{enumerable:!0,get:d[e]});let f=a.r(46058)._(a.r(72131)),g=a.r(67009);a.r(88347);function h(){}function i(a){!0;throw Object.defineProperty(Error("Internal Next.js error: Router action dispatched before initialization."),"__NEXT_ERROR_CODE",{value:"E668",enumerable:!1,configurable:!0})}function j(a){!0;throw Object.defineProperty(Error("Internal Next.js error: Router action dispatched before initialization."),"__NEXT_ERROR_CODE",{value:"E668",enumerable:!1,configurable:!0})}function k(a){let[b,c]=f.default.useState(a.state),[d,e]=(0,f.useOptimistic)(b),h=(0,f.useMemo)(()=>d,[d]);return(0,g.isThenable)(h)?(0,f.use)(h):h}("function"==typeof c.default||"object"==typeof c.default&&null!==c.default)&&void 0===c.default.__esModule&&(Object.defineProperty(c.default,"__esModule",{value:!0}),Object.assign(c.default,c),b.exports=c.default)},42602,(a,b,c)=>{"use strict";b.exports=a.r(18622)},9270,(a,b,c)=>{"use strict";b.exports=a.r(42602).vendored.contexts.AppRouterContext},36313,(a,b,c)=>{"use strict";b.exports=a.r(42602).vendored.contexts.HooksClientContext},18341,(a,b,c)=>{"use strict";b.exports=a.r(42602).vendored.contexts.ServerInsertedHtml},35112,(a,b,c)=>{"use strict";b.exports=a.r(42602).vendored["react-ssr"].ReactDOM},87924,(a,b,c)=>{"use strict";b.exports=a.r(42602).vendored["react-ssr"].ReactJsxRuntime},38783,(a,b,c)=>{"use strict";b.exports=a.r(42602).vendored["react-ssr"].ReactServerDOMTurbopackClient},72131,(a,b,c)=>{"use strict";b.exports=a.r(42602).vendored["react-ssr"].React},67009,(a,b,c)=>{"use strict";function d(a){return null!==a&&"object"==typeof a&&"then"in a&&"function"==typeof a.then}Object.defineProperty(c,"__esModule",{value:!0}),Object.defineProperty(c,"isThenable",{enumerable:!0,get:function(){return d}})}];
-
-//# sourceMappingURL=%5Broot-of-the-server%5D__0zig5sv._.js.map