failproofai 1.0.2-beta.2 → 1.0.2-beta.4

package/dist/worker.mjs

@@ -2559,7 +2559,7 @@ var init_builtin_policies = __esm(() => {
 });
 
 // package.json
-var version = "1.0.2-beta.2";
+var version = "1.0.2-beta.4";
 var init_package = () => {};
 
 // src/posthog-key.ts
@@ -8972,7 +8972,15 @@ function parsePack(root, value) {
     }
     enabled = raw.enabled.filter((n) => names.has(n));
   }
+  let clis = null;
+  if (raw.clis !== undefined) {
+    if (!Array.isArray(raw.clis) || raw.clis.some((c) => typeof c !== "string")) {
+      throw new Error(`pack ${raw.id} clis is not an array of agent names`);
+    }
+    clis = raw.clis;
+  }
   return {
+    clis,
     id: identity.id,
     version: identity.version,
     source: raw.source,
@@ -9435,6 +9443,8 @@ async function evaluateHookEvent(eventType, cli = "claude", stdinPayload, opts)
           continue;
         if (!cloudManaged && activePause)
           continue;
+        if (pack?.clis && !pack.clis.includes(cli))
+          continue;
         if (pack?.enabled && !pack.enabled.includes(hook.name))
           continue;
         if (pack && enabledBuiltinNames.has(hook.name))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "failproofai",
-  "version": "1.0.2-beta.2",
+  "version": "1.0.2-beta.4",
   "description": "Observability and enforcement for AI agent harnesses. 39 built-in policies hooked into 12 of them — Claude Code, Codex, Cursor, Hermes, OpenClaw and more — blocking the tool call before it runs. Local dashboard included, no account needed.",
   "bin": {
     "failproofai": "./dist/cli.mjs",
@@ -80,33 +80,33 @@
     "access": "public"
   },
   "devDependencies": {
-    "@anthropic-ai/sdk": "^0.117.1",
+    "@anthropic-ai/sdk": "^0.120.0",
     "@mdx-js/mdx": "^3.1.1",
     "@tailwindcss/postcss": "^4.3.1",
-    "@tanstack/react-virtual": "^3.14.9",
+    "@tanstack/react-virtual": "^3.14.10",
     "@testing-library/jest-dom": "^7.0.0",
     "@testing-library/react": "^16.3.2",
-    "@testing-library/user-event": "^14.6.1",
+    "@testing-library/user-event": "^14.6.5",
     "@types/node": "26.2.0",
     "@types/react": "19.2.18",
     "@types/react-dom": "^19.2.3",
-    "@vitejs/plugin-react": "^6.0.5",
+    "@vitejs/plugin-react": "^6.1.0",
     "clsx": "^2.1.1",
-    "eslint": "^10.5.0",
-    "eslint-config-next": "^16.2.9",
+    "eslint": "^10.9.0",
+    "eslint-config-next": "^16.3.2",
     "jsdom": "^30.0.1",
-    "lucide-react": "^1.28.0",
-    "next": "^16.2.11",
+    "lucide-react": "^1.33.0",
+    "next": "^16.3.2",
     "react": "^19.2.4",
     "react-dom": "^19.2.4",
     "tailwind-merge": "^3.4.0",
     "tailwindcss": "^4.3.1",
     "typescript": "6.0.3",
-    "vitest": "^4.1.9"
+    "vitest": "^4.1.11"
   },
   "dependencies": {
     "html-to-image": "^1.11.13",
-    "posthog-node": "^5.47.7",
+    "posthog-node": "^5.50.0",
     "sql.js": "^1.14.1",
     "yaml": "^2.9.0"
   },
@@ -120,15 +120,15 @@
     "sharp": "0.35.0"
   },
   "optionalDependencies": {
-    "@failproofai/failproofaid-linux-x64": "1.0.2-beta.2",
-    "@failproofai/failproofaid-linux-arm64": "1.0.2-beta.2",
-    "@failproofai/failproofaid-darwin-x64": "1.0.2-beta.2",
-    "@failproofai/failproofaid-darwin-arm64": "1.0.2-beta.2"
+    "@failproofai/failproofaid-linux-x64": "1.0.2-beta.4",
+    "@failproofai/failproofaid-linux-arm64": "1.0.2-beta.4",
+    "@failproofai/failproofaid-darwin-x64": "1.0.2-beta.4",
+    "@failproofai/failproofaid-darwin-arm64": "1.0.2-beta.4"
   },
   "failproofaidBinaries": {
-    "linux-x64": "fcfa5ae234e66eb6b57ec28445900c5f5a231f5f3a1fb0aeaca281d81f74c81e",
-    "linux-arm64": "a2bb9894d311a86740170128a706a9503fecc15ac5cbbc4587243151175a671c",
-    "darwin-x64": "97c1054b6229824ff7a9cbee67f3c1e2608db9e0b38a0dfc1adb21bf772a9666",
-    "darwin-arm64": "eb60b5fd3c1727f0d5406961367e2ea9b6c7fbc0b975247e7db664d502863f13"
+    "linux-x64": "08bc00a7f8d7c80bf898471ce59c57f4e96c1420080009cc933b2ddeb4f23750",
+    "linux-arm64": "1167d809628cff04c38efbc0eaa83ca26ab8de2878bed0ef59ca43054173eea7",
+    "darwin-x64": "6ed32db21af6869c4475e753e524ad8e128436674209ad778421b240a4bd5c53",
+    "darwin-arm64": "3843de034c9d6b11f77c1f423e6201ad6a77b7eff3b3d4460ba324c5aeb62021"
   }
 }

package/src/audit/cache.ts

@@ -13,7 +13,6 @@ import { createHash } from "node:crypto";
 import { existsSync, mkdirSync, readFileSync, writeFileSync, chmodSync } from "node:fs";
 import { join } from "node:path";
 import { BUILTIN_POLICIES } from "../hooks/builtin-policies";
-import { readInstalledPacks } from "../hooks/pack-manifest";
 import { AUDIT_DETECTORS } from "./detectors";
 import type { TranscriptAuditResult } from "./types";
 import { auditCacheDir } from "../hooks/fp-home";
@@ -22,23 +21,27 @@ let cachedEngineVersion: string | null = null;
 let cachedDetectorVersion: string | null = null;
 
 /**
- * Hash of every builtin policy's name + function body, PLUS the identity of every
- * installed pack. Changes when policy code changes, invalidating downstream
- * caches.
+ * Hash of every builtin policy's name and function body. Changes when policy
+ * code changes, invalidating downstream caches.
  *
- * Packs belong in this key because they change what a machine would have caught,
- * which is exactly what a cached audit result claims to know. They are folded in
- * by `id|version|sha256` rather than by source text: the pack's bytes are already
- * digest-pinned, and hashing the loaded source instead would drag in the
- * per-load temporary filename the loader rewrites into every import specifier —
- * which changes on every single run and would cold-rescan the whole history each
- * time.
+ * Nothing else is in it, and specifically not installed packs. The audit
+ * evaluates the implementations compiled into this build and only those —
+ * `replay.ts` iterates `BUILTIN_POLICIES` and never reads the installed packs —
+ * so a pack cannot move an audit result, and keying on one meant every install
+ * or removal cold-rescanned the entire history to reproduce the answers it
+ * already had. The key it replaced folded packs in by `id|version|sha256`; the
+ * rationale was that packs "change what a machine would have caught", which is
+ * true of enforcement and was never true of this replay.
  *
- * **A machine with no packs must hash byte-identically to a build with no pack
- * support at all.** Otherwise merely shipping this feature invalidates every
- * user's audit cache and forces a ~104-second cold rescan on upgrade, for a
- * capability they are not using. Hence the empty pack set contributes nothing —
- * not an empty line, not a separator.
+ * **A machine with no packs hashes byte-identically to the old key**, because
+ * that one contributed nothing for an empty pack set — not an empty line, not a
+ * separator. So this change costs a rescan only to machines that had a pack
+ * installed, and costs it exactly once.
+ *
+ * It is deliberately NOT the source text of anything loaded at runtime: the
+ * loader rewrites a per-load temporary filename into every import specifier, so
+ * hashing loaded source would change on every single run and cold-rescan the
+ * whole history each time.
  */
 function getEngineVersion(): string {
   if (cachedEngineVersion) return cachedEngineVersion;
@@ -46,19 +49,21 @@ function getEngineVersion(): string {
     .map((p) => `${p.name}|${p.fn.toString()}`)
     .sort()
     .join("\n");
-  // Never throws by contract, but this runs inside the audit's own try/catch-free
-  // path and a cache key is not worth taking the run down for.
-  let packBlob = "";
-  try {
-    packBlob = readInstalledPacks()
-      .packs.map((pack) => `${pack.id}|${pack.version}|${pack.sha256}`)
-      .sort()
-      .join("\n");
-  } catch {
-    packBlob = "";
-  }
-  const blob = packBlob ? `${builtinBlob}\n${packBlob}` : builtinBlob;
-  cachedEngineVersion = createHash("sha1").update(blob).digest("hex").slice(0, 16);
+  // Packs are NOT in this key, and that is the whole point of the audit's design
+  // rather than an omission.
+  //
+  // `replay.ts` evaluates `BUILTIN_POLICIES` and nothing else — it never reads
+  // `readInstalledPacks()`, and third-party pack policies are never replayed. So
+  // an installed pack cannot change an audit result, and folding its identity in
+  // here invalidated every cached transcript on a change that provably produces
+  // the same answers: a full rescan of thousands of transcripts to arrive back
+  // where it started. That was survivable while packs were rare; policies ARE
+  // packs now, so installing or removing one is routine.
+  //
+  // If audit is ever extended to evaluate what a pack would actually have
+  // caught, this key has to carry pack identity again — and that change belongs
+  // in the same commit as the one that makes it true.
+  cachedEngineVersion = createHash("sha1").update(builtinBlob).digest("hex").slice(0, 16);
   return cachedEngineVersion;
 }
 

package/src/audit/replay.ts

@@ -13,19 +13,13 @@
  * execSync against live git, so they never fire on PreToolUse/PostToolUse
  * replay — no explicit skip needed.
  */
-import { resolve } from "node:path";
-import { existsSync } from "node:fs";
 import type { EvaluationResult } from "../hooks/policy-evaluator";
 import { evaluatePolicies } from "../hooks/policy-evaluator";
 import { BUILTIN_POLICIES, registerBuiltinPolicies } from "../hooks/builtin-policies";
-import { PACK_ENTRY_ASSET, bundledPackDir } from "../hooks/pack-store";
-import { loadCustomHooks } from "../hooks/custom-hooks-loader";
-import { clearCustomHooks } from "../hooks/custom-hooks-registry";
 import {
   clearPolicies,
   getAllPolicies,
   normalizePolicyName,
-  registerPolicy,
   setAllPolicies,
 } from "../hooks/policy-registry";
 import type { RegisteredPolicy } from "../hooks/policy-types";
@@ -46,10 +40,20 @@ let initialized = false;
  *  (e.g. the Next.js dashboard) doesn't wipe any prior policy registrations. */
 let savedSnapshot: RegisteredPolicy[] | null = null;
 
-/** Register every builtin policy (regardless of user config) so the replay
- *  shows what *could* be caught, not just what's currently enabled. Called
- *  once per `runAudit` invocation. Snapshots the existing registry so it can
- *  be restored by `restoreReplay()` once the audit is done. */
+/**
+ * Register every builtin policy (regardless of user config) so the replay shows
+ * what *could* be caught, not just what is currently enabled. Called once per
+ * `runAudit` invocation. Snapshots the existing registry so `restoreReplay()`
+ * can put it back.
+ *
+ * The implementations compiled into this build, and ONLY those. The audit used
+ * to prefer a vendored `policy-pack/` copy where one existed, which was
+ * meaningful while the package shipped that directory; it no longer ships it, so
+ * that branch could not fire in any published build and existed only to be
+ * misread as "the audit scores against installed packs". It does not, and must
+ * not: an audit is a fixed yardstick, and one that changed shape with whatever
+ * pack a machine happened to have could not be compared against its own history.
+ */
 export async function initReplay(): Promise<void> {
   if (initialized) return;
   savedSnapshot = getAllPolicies();
@@ -57,90 +61,10 @@ export async function initReplay(): Promise<void> {
   const enabled = BUILTIN_POLICIES
     .map((p) => p.name)
     .filter((n) => !SKIP_POLICIES.has(normalizePolicyName(n)));
-  if (!(await registerFromVendoredPack(enabled))) registerBuiltinPolicies(enabled);
+  registerBuiltinPolicies(enabled);
   initialized = true;
 }
 
-/**
- * Register the audit's policies from the pack that ships inside the package,
- * rather than from implementations compiled into this build.
- *
- * The audit scores by RUNNING the policies — three of its four penalty buckets
- * are replay hits — so the day the builtins stop being compiled in, this is
- * what keeps `failproofai audit` reporting the same findings and the same score
- * for the same transcripts. The pack carries the identical functions:
- * `builtin-pack-conformance.test.ts` replays a corpus through both and asserts
- * the verdicts do not diverge.
- *
- * Two things it must get right, or the audit quietly changes:
- *
- * - The pack cannot carry `block-failproofai-commands`, because `alwaysOn` is
- *   refused by the pack loader by design — a downloaded file that no local
- *   command can switch off. It is registered from the compiled side, so the
- *   replayed set is the same 39 either way.
- * - The skip list still applies. `warn-repeated-tool-calls` writes a per-session
- *   sidecar into the user's real transcript directory on every evaluation.
- *
- * Returns false when there is no vendored pack to read — a source checkout that
- * has not run `build:pack`, or a tarball packed without it — and the caller
- * falls back to the compiled implementations. An audit that silently scored on
- * fewer policies would be worse than either.
- */
-async function registerFromVendoredPack(enabled: string[]): Promise<boolean> {
-  const dir = bundledPackDir();
-  if (!dir) return false;
-  const entry = resolve(dir, PACK_ENTRY_ASSET);
-  if (!existsSync(entry)) return false;
-
-  const wanted = new Set(enabled);
-  let hooks;
-  try {
-    clearCustomHooks();
-    hooks = await loadCustomHooks(entry, { strict: true });
-  } catch {
-    return false;
-  } finally {
-    clearCustomHooks();
-  }
-  if (hooks.length === 0) return false;
-  const fromPack = new Map(hooks.map((hook) => [hook.name, hook]));
-
-  // Registered in CATALOG ORDER, taking the pack's function where it has one and
-  // the compiled one for the guard the pack may not carry.
-  //
-  // Order is not cosmetic here. `getPoliciesForEvent` sorts by priority only and
-  // V8's sort is stable, so registration order decides EVALUATION order, and
-  // `evaluatePolicies` stops at the first deny — which means the order decides
-  // which policy is CREDITED for a hit. Appending the always-on guard after the
-  // pack instead of at its catalog position moved it from index 11 to last, and
-  // re-attributed 3 events in a 23,477-event corpus: 456 -> 453 for the guard,
-  // with the denies it used to shadow surfacing as block-force-push and
-  // block-gh-pipeline. The audit's per-policy counts are what a user reads, so
-  // that is a changed audit, not a changed internal.
-  let registered = 0;
-  for (const policy of BUILTIN_POLICIES) {
-    if (!wanted.has(policy.name)) continue;
-    const packHook = fromPack.get(policy.name);
-    if (policy.alwaysOn || !packHook) {
-      registerPolicy(policy.name, policy.description, policy.fn, policy.match, 0, policy.params);
-      continue;
-    }
-    registerPolicy(
-      packHook.name,
-      packHook.description ?? policy.description,
-      packHook.fn,
-      packHook.match ?? policy.match,
-      0,
-      policy.params,
-    );
-    registered += 1;
-  }
-  // Nothing came from the pack: it loaded but carried none of the names the
-  // audit replays. Falling back is more honest than scoring on the compiled set
-  // while claiming the pack lane ran.
-  return registered > 0;
-}
-
 /** Restore the registry to whatever was there before `initReplay()`. Safe to
  *  call when not initialized (no-op). Always paired with `initReplay()` in a
  *  try/finally inside `runAudit()`. */

package/src/hooks/configure-wizard.ts

@@ -32,7 +32,6 @@ import { dirname, resolve, sep } from "node:path";
 
 import {
   selectOne,
-  multiSelect,
   promptText,
   intro,
   outro,
@@ -223,7 +222,6 @@ export function buildAgentChoices(scope: HookScope, cwd: string): MultiChoice<In
   });
 }
 
-const ALL_CLIS = "__all_clis__";
 
 const DIM_NOTE = "(auto-loaded)";
 
@@ -938,54 +936,24 @@ export async function runConfigureWizard(io: WizardIO = {}): Promise<WizardResul
   // An "Everything available" row protects every supported CLI (detected +
   // set-up-ahead); when ticked it wins over the individual boxes.
   //
-  // Always asked, never inferred. This is the one decision setup genuinely
-  // cannot make for you: which agents on this machine should be guarded. The
-  // detected ones are pre-ticked, so the common answer is a single keypress.
+  // Every supported agent, detected or not — setup asks nothing about this.
   //
-  // No `allowBack`: with the policy step and the scope fork both gone, there is
-  // nothing inside setup to return to.
-  let clisSel: string[];
-  {
-    const picked = await multiSelect<string>({
-      message: "Which harnesses should it protect?",
-      choices: [
-        {
-          label: "Everything available",
-          value: ALL_CLIS,
-          // Counts only what this scope can actually take — expanding to all 12
-          // under project scope is what crashed the apply on Hermes.
-          hint: `protect all ${clisSupportingScope(primaryScope).length} CLIs configurable here`,
-          // A selector, not a harness. Counting it gave "13 harnesses" for
-          // the 12 supported CLIs, and listed "Everything available" among them.
-          summaryExclude: true,
-        },
-        ...buildAgentChoices(primaryScope, cwd),
-      ],
-      minSelected: 1,
-      summaryNoun: "harnesses",
-      hint: "detected CLIs are pre-selected · space toggles · ctrl+a all · ↵ confirm",
-      stdin,
-      stdout,
-    });
-    if (picked === null) return cancel();
-    clisSel = picked;
-  }
-  // Filter to what the chosen scopes support in BOTH branches: "Everything
-  // available" must not expand to CLIs that cannot take any selected scope,
-  // and a locked row can't be ticked but belt-and-braces keeps the invariant
-  // local to the one place `clis` is built.
+  // It used to be the one question left, on the reasoning that which agents to
+  // guard is a real choice. It stopped being one when this package stopped
+  // shipping policies: hooks alone enforce nothing, so wiring them everywhere
+  // costs a config entry and changes no behaviour until a pack arrives. What it
+  // buys is that an agent installed NEXT WEEK is guarded from its first tool
+  // call, instead of running unguarded until somebody remembers to re-run setup
+  // — and nobody remembers, because nothing tells them to.
+  //
+  // ALL twelve, not the detected ones, for exactly that reason. The cost is
+  // honest and worth naming: hook config appears under `~/.cursor/`,
+  // `~/.factory/` and the rest for agents that may never be installed.
   //
-  // The union across scopes, not the intersection: under "Both", a user-scope-
-  // only gateway like Hermes is still installable via the user half, and
-  // dropping it because project scope cannot take it would silently protect
-  // less than the user asked for. `installHooks` is called per scope below and
-  // skips what a given scope cannot take.
-  const supported = new Set(scopes.flatMap((s) => clisSupportingScope(s)));
-  const clis: IntegrationType[] = (
-    clisSel.includes(ALL_CLIS)
-      ? [...INTEGRATION_TYPES]
-      : (clisSel.filter((v) => v !== ALL_CLIS) as IntegrationType[])
-  ).filter((id) => supported.has(id));
+  // Which policies run, and on which of these agents, is chosen at
+  // `failproofai policies add` — where the user is looking at a real list
+  // instead of answering in the abstract.
+  const clis: IntegrationType[] = [...clisSupportingScope(primaryScope)];
 
   // 4 — Connect this machine? Last, because by this point the user has decided
   // what to protect, so "would you like to see it in a dashboard?" follows

package/src/hooks/handler.ts

@@ -425,9 +425,16 @@ export async function evaluateHookEvent(
         if (!cloudManaged && policyId && disabledCustomPolicies.has(policyId)) continue;
         // Same rule for a session pause — it suspends local policy, never cloud.
         if (!cloudManaged && activePause) continue;
+        // A pack narrowed to particular agents does not fire on the others.
+        // Setup wires hooks into every supported CLI — hooks alone enforce
+        // nothing — so the choice of which agents a pack guards is made when the
+        // pack is installed, and this is where it takes effect. `clis: null`
+        // means every agent, which is what an install with no narrowing writes
+        // and what every pack installed before this field existed reads as.
+        if (pack?.clis && !pack.clis.includes(cli)) continue;
         // A pack's artifact registers everything it contains; the user may have
         // taken only some of it. `enabled: null` means the whole pack, which is
-        // what `pack add` writes when no selection was made.
+        // what `policies add` writes when no selection was made.
         if (pack?.enabled && !pack.enabled.includes(hook.name)) continue;
         // A pack policy whose name is an ENABLED BUILTIN is the same guard
         // twice. The two register under different keys — `failproofai/block-sudo`

package/src/hooks/manager.ts

@@ -9,7 +9,7 @@ import { execSync } from "node:child_process";
 import { existsSync } from "node:fs";
 import { resolve, basename } from "node:path";
 import { platform, arch, release, hostname } from "node:os";
-import {
+import { INTEGRATION_TYPES,
   HOOK_SCOPES,
   type HookScope,
   type IntegrationType,
@@ -256,8 +256,30 @@ function deduplicateScopes(scopes: readonly HookScope[], cwd?: string): HookScop
   });
 }
 
+/**
+ * Is ANY agent CLI wired to call failproofai at this scope?
+ *
+ * Asked Claude Code and only Claude Code, which made it wrong for every machine
+ * guarded through one of the other eleven. A user with hooks in `~/.codex/` was
+ * told nothing was installed — quietly, while this only tinted a subtitle, and
+ * loudly once the listing started warning that every policy shown was inert.
+ * Reported from a real machine set up for codex.
+ *
+ * Any one integration answering yes is enough: the question is whether
+ * enforcement can reach this machine at all, not whether a particular agent is
+ * covered. Which agents specifically is a different question, and the per-CLI
+ * rows of the listing already answer it.
+ */
 export function hooksInstalledInSettings(scope: HookScope, cwd?: string): boolean {
-  return claudeCode.hooksInstalledInSettings(scope, cwd);
+  return INTEGRATION_TYPES.some((id) => {
+    try {
+      return getIntegration(id).hooksInstalledInSettings(scope, cwd);
+    } catch {
+      // An integration whose settings file is unreadable is not evidence that
+      // nothing is installed — keep asking the rest.
+      return false;
+    }
+  });
 }
 
 export interface InstallHooksOptions {