failproofai 1.0.2-beta.3 → 1.0.2-beta.5

package/src/hooks/pack-cli.ts

@@ -6,9 +6,13 @@
  * This layer decides nothing; it formats.
  */
 import { execFileSync } from "node:child_process";
+import { homedir, tmpdir } from "node:os";
 import { createHash } from "node:crypto";
-import { copyFileSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import { resolve } from "node:path";
+import { copyFileSync, existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { basename, dirname, join, resolve } from "node:path";
+import { INTEGRATION_TYPES } from "./types";
+import { PACK_VERSION_RE } from "./pack-manifest";
+import { detectInstalledClis } from "./integrations";
 import { parsePackIdentity, parsePackPolicy, readInstalledPacks } from "./pack-manifest";
 import {
   PACK_CHECKSUMS_ASSET,
@@ -31,6 +35,7 @@ import {
   chip,
   emptyState,
   multiSelect,
+  promptText,
   note,
   nextStep,
   optsFor,
@@ -59,7 +64,7 @@ function parseList(rest: string[], flag: string): string[] | undefined {
 }
 
 /** Flags that take a separate value, so it is never mistaken for the source. */
-const VALUE_FLAGS = new Set(["--only", "--policy", "--category"]);
+const VALUE_FLAGS = new Set(["--only", "--policy", "--category", "--cli"]);
 
 /** Find the positional source without mistaking a flag's separate value for it. */
 export function packAddSource(rest: string[]): string | undefined {
@@ -71,14 +76,21 @@ export function packAddSource(rest: string[]): string | undefined {
 }
 
 /** Names taken by our own policies, so a selection can be checked before install. */
-function selectionFrom(rest: string[]): { only?: string[]; categories?: string[]; all?: boolean } {
+function selectionFrom(rest: string[]): {
+  only?: string[];
+  categories?: string[];
+  all?: boolean;
+  clis?: string[];
+} {
   // `--policy` reads right for one ("give me this policy"), `--only` for a set.
   // They are the same switch; taking both means neither is the wrong guess.
   const only = parseList(rest, "--policy") ?? parseList(rest, "--only");
   const categories = parseList(rest, "--category");
+  const clis = parseList(rest, "--cli");
   return {
     ...(only ? { only } : {}),
     ...(categories ? { categories } : {}),
+    ...(clis ? { clis } : {}),
     ...(rest.includes("--all") ? { all: true } : {}),
   };
 }
@@ -333,10 +345,527 @@ export async function runPolicyPicker(
 }
 
 
+/**
+ * Write a working starter policy, because the blank file is the hardest step.
+ *
+ * `publish --help` described the shape in prose, which leaves a newcomer to
+ * hand-write their first `customPolicies.add({...})` from a description and
+ * find out whether they got it right at publish time. What lands here is a
+ * policy that already RUNS and already blocks something real, so the first
+ * action is editing a working thing rather than authoring an empty one.
+ */
+/**
+ * A policy filename, whatever spelling it arrived in. Discovery takes
+ * `.mjs`/`.js`/`.ts` and nothing else, so a name with no extension has to gain
+ * one or the file it names can never be found.
+ */
+function withPolicyExtension(name: string): string {
+  return /\.(mjs|js|ts)$/.test(name) ? name : `${name}.mjs`;
+}
+
+async function scaffold(target: string | null): Promise<PackCliResult> {
+  // Ask what the pack is called when nothing was named and there is somebody to
+  // ask. The answer becomes the FILENAME and the header, so what lands on disk
+  // is already theirs rather than a file called `my-policies.mjs` that everybody
+  // then has to remember to rename. Skipped entirely for an explicit path or a
+  // non-TTY, where there is no question to ask and no one to answer it.
+  let chosen = target;
+  if (!chosen && process.stdin.isTTY && process.stdout.isTTY) {
+    const answer = await promptText({
+      message: "What is this pack called?",
+      hint: "used for the filename — letters, numbers, dashes",
+      defaultValue: "my-policies",
+      validate: (v) =>
+        /^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(v.trim())
+          ? null
+          : "letters, numbers, dots, dashes and underscores",
+      stdin: process.stdin,
+      stdout: process.stdout,
+    });
+    if (answer === null) return ok(["Nothing written."]);
+    chosen = answer.trim();
+  }
+  // Both paths land here, because only one of them used to. A name typed at
+  // the prompt got `.mjs`; the same name passed as `--init myguards` was taken
+  // literally and wrote a file called `myguards` — which discovery skips (it
+  // takes .mjs/.js/.ts) and which no ESM loader will import. The starter file
+  // was unreachable by every command meant to pick it up.
+  const path = resolve(withPolicyExtension(chosen ?? "my-policies"));
+  if (existsSync(path)) {
+    return fail([`${path} already exists — name a different file, or edit that one.`]);
+  }
+  mkdirSync(resolve(path, ".."), { recursive: true });
+  writeFileSync(
+    path,
+    `import { customPolicies, allow, deny } from "failproofai";
+
+// One file, no relative imports: only this entry is digest-pinned, so a pack
+// that imported siblings could not honestly claim to be verified.
+
+customPolicies.add({
+  name: "block-force-push",
+  description: "Block git push --force on any branch",
+  // Groups it in the picker, and is what --category selects on.
+  category: "Git",
+  // Whether it is ON for somebody who installs with no flags. Defaults to false.
+  defaultEnabled: true,
+  match: { events: ["PreToolUse"] },
+  fn: async (ctx) => {
+    if (ctx.toolName !== "Bash") return allow();
+    const cmd = String(ctx.toolInput?.command ?? "");
+    if (/\\bgit\\s+push\\b[^|;&]*\\s(-f|--force)\\b/.test(cmd)) {
+      return deny("Force-push rewrites history someone else may have pulled.");
+    }
+    return allow();
+  },
+});
+`,
+    "utf8",
+  );
+  return ok([
+    `Wrote ${path} — one policy, already working.`,
+    "",
+    "Try it on this machine before anyone else sees it:",
+    `  failproofai policies -i -c ${path}`,
+    "  then ask your agent to force-push — it gets refused",
+    "",
+    "Then publish it:",
+    "  failproofai publish --repo <you>/<repo>",
+  ]);
+}
+
+/**
+ * The GitHub repository this file lives in, from its own git remote.
+ *
+ * Typing `--repo you/guards` from inside the checkout of `you/guards` is asking
+ * somebody to restate what the directory already knows. Read from the ENTRY
+ * FILE's directory rather than the process cwd: publishing a policy that lives
+ * in another checkout is normal, and the answer must describe the file, not
+ * wherever the shell happens to be.
+ */
+function inferRepo(entryPath: string): string | null {
+  try {
+    const url = execFileSync("git", ["remote", "get-url", "origin"], {
+      cwd: resolve(entryPath, ".."),
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout: 5_000,
+    }).trim();
+    // Both spellings git hands out: scp-style and https.
+    const m = url.match(/github\.com[:/]([^/]+)\/(.+?)(?:\.git)?$/i);
+    return m ? `${m[1]}/${m[2]}` : null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * A tag on HEAD, when there is one and the file is clean.
+ *
+ * Somebody who tagged `v1.2.0` has SAID what this release is, which a counted
+ * number cannot. Absent a tag there is nothing here to infer — the version is
+ * counted from what the repository has already published instead.
+ */
+function inferTaggedVersion(entryPath: string): string | null {
+  const cwd = resolve(entryPath, "..");
+  const git = (args: string[]): string | null => {
+    try {
+      return execFileSync("git", args, {
+        cwd,
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "ignore"],
+        timeout: 5_000,
+      }).trim();
+    } catch {
+      return null;
+    }
+  };
+  const tag = git(["describe", "--tags", "--exact-match", "HEAD"]);
+  if (!tag || !PACK_VERSION_RE.test(tag)) return null;
+  // A tag NAMES a commit, so shipping edited bytes under it publishes something
+  // that commit does not contain — and two artifacts would claim one version,
+  // which `id|version|sha256` compares in both the audit key and the pack
+  // upsert. A counted version names no commit and has no such problem, so this
+  // refusal belongs to the tagged path alone.
+  if (git(["status", "--porcelain", "--", entryPath])) return null;
+  return tag;
+}
+
+/**
+ * The policy file in this directory, when there is exactly one.
+ *
+ * Naming the path is restating something the directory already answers: a
+ * checkout with one policy file in it has no ambiguity to resolve. So the
+ * common case is `failproofai publish`, and the argument stays for the cases
+ * that genuinely need it.
+ *
+ * Identified by CONTENT, not by filename. A name convention would either miss
+ * `guards.mjs` or match an unrelated `policies.mjs` that configures something
+ * else entirely; a file that imports `failproofai` and calls
+ * `customPolicies.add` is a policy file whatever it is called.
+ *
+ * Returns ALL of them. Splitting policies across files is the normal thing to
+ * do past about three, and they are one pack — so several files is an answer,
+ * not an ambiguity, and they get bundled into the single artifact a pack must
+ * be. Naming a path explicitly still publishes exactly that file.
+ *
+ * Non-recursive on purpose. Walking the tree finds fixtures, examples and
+ * anything vendored, and publishing those is the failure this avoids.
+ */
+function findEntry(dir: string): string[] {
+  let names: string[];
+  try {
+    names = readdirSync(dir);
+  } catch {
+    return [];
+  }
+  const found: string[] = [];
+  for (const name of names) {
+    if (!/\.(mjs|js|ts)$/.test(name)) continue;
+    const full = resolve(dir, name);
+    try {
+      // Policy entries are small; anything large is not one, and reading it
+      // would be the expensive half of this scan.
+      if (statSync(full).size > 512 * 1024) continue;
+      const text = readFileSync(full, "utf8");
+      if (/from\s+["']failproofai["']/.test(text) && /customPolicies\s*\.\s*add\s*\(/.test(text)) {
+        found.push(full);
+      }
+    } catch {
+      continue;
+    }
+  }
+  return found.sort();
+}
+
+/**
+ * The version after whatever this repository has already published.
+ *
+ * A commit SHA names exactly where bytes came from and tells a reader nothing
+ * else: it does not order, so `a1b2c3d` and `f9e8d7c` give no clue which came
+ * first, and nobody can say "I am on the older one". Counting instead — 1.0.0,
+ * then 1.0.1 — costs one API call and answers both.
+ *
+ * Reads the repository's own releases rather than anything local, because the
+ * releases ARE the published record: a machine that has never published from
+ * this checkout still computes the right next number, and two people publishing
+ * from different clones cannot both mint 1.0.1 without one of them seeing the
+ * other's release first.
+ *
+ * Non-semver tags are ignored rather than parsed heroically — a repo whose
+ * releases are named `nightly` has no sequence to continue, and starting a
+ * fresh count is more honest than inventing one.
+ */
+async function nextVersion(owner: string, name: string, token: string): Promise<string> {
+  const res = await gh(`${GITHUB_API}/repos/${owner}/${name}/releases?per_page=100`, token);
+  const tags = Array.isArray(res.json)
+    ? (res.json as unknown as Array<{ tag_name?: unknown }>)
+        .map((r) => (typeof r.tag_name === "string" ? r.tag_name : ""))
+        .filter(Boolean)
+    : [];
+  let best: [number, number, number] | null = null;
+  for (const tag of tags) {
+    const m = /^v?(\d+)\.(\d+)\.(\d+)$/.exec(tag.trim());
+    if (!m) continue;
+    const parsed: [number, number, number] = [Number(m[1]), Number(m[2]), Number(m[3])];
+    if (
+      !best ||
+      parsed[0] > best[0] ||
+      (parsed[0] === best[0] && parsed[1] > best[1]) ||
+      (parsed[0] === best[0] && parsed[1] === best[1] && parsed[2] > best[2])
+    ) {
+      best = parsed;
+    }
+  }
+  return best ? `${best[0]}.${best[1]}.${best[2] + 1}` : "1.0.0";
+}
+
+/**
+ * The repository, created if it is not there.
+ *
+ * Creating it was the only step `publish` did not do, and the one that made
+ * "one command" untrue — it sent the publisher to a different tool and back.
+ *
+ * PUBLIC, always. A private repository publishes to nobody, because installs
+ * are anonymous HTTPS with no credential to offer, so creating one here would
+ * manufacture the exact dead end the caller then warns about. Somebody who
+ * wants a private pack makes it themselves and knows why.
+ */
+async function ensureRepo(
+  owner: string,
+  name: string,
+  id: string,
+  token: string,
+  sourceDir?: string,
+): Promise<{ info: Awaited<ReturnType<typeof gh>>; created: boolean } | { error: string[] }> {
+  let info = await gh(`${GITHUB_API}/repos/${owner}/${name}`, token);
+  let created = false;
+  if (info.status === 404) {
+    // Personal and organisation repositories are different endpoints, and the
+    // only way to tell which applies is to ask who the token belongs to.
+    const me = await gh(`${GITHUB_API}/user`, token);
+    const login = typeof me.json?.login === "string" ? me.json.login : null;
+    const endpoint =
+      login && login.toLowerCase() === owner.toLowerCase()
+        ? `${GITHUB_API}/user/repos`
+        : `${GITHUB_API}/orgs/${owner}/repos`;
+    const made = await gh(endpoint, token, {
+      method: "POST",
+      contentType: "application/json",
+      body: JSON.stringify({
+        name,
+        private: false,
+        description: `failproofai policy pack — ${id}`,
+        // NOT auto_init. The author already has the commit that holds these
+        // policies; a repository seeded with its own "Initial commit" shares
+        // no history with it, so the `git push` that every publish is followed
+        // by is rejected as unrelated — and the way out (`pull --allow-
+        // unrelated-histories`, or a force-push over the seed) is a worse
+        // first five minutes than an empty repository, which accepts the push
+        // as-is. Releases do not need a commit to hang from: the tag is
+        // created against whatever the release API is given.
+        auto_init: false,
+      }),
+    });
+    if (made.status >= 400) {
+      return {
+        error: [
+          `${owner}/${name} does not exist and could not be created: ${ghError(made)}`,
+          login
+            ? `The credential belongs to ${login}. Creating under a different owner needs`
+            : "The credential could not be identified. Creating a repository needs",
+          "  rights to that account or organisation — or make it by hand:",
+          `  gh repo create ${owner}/${name} --public`,
+        ],
+      };
+    }
+    created = true;
+    // A repository created with no commits has no default branch, and the
+    // release API tags the default branch — so something has to land on it
+    // before the release is cut. Pushing the author's own history is the
+    // version that leaves a usable repository behind; seeding is the fallback
+    // for a pack that is not in a git checkout at all.
+    if (!(sourceDir && pushExistingHistory(sourceDir, owner, name, token))) {
+      await seedDefaultBranch(owner, name, id, token);
+    }
+    info = await gh(`${GITHUB_API}/repos/${owner}/${name}`, token);
+  }
+  if (info.status >= 400) {
+    return { error: [`Could not read ${owner}/${name}: ${ghError(info)}`] };
+  }
+  return { info, created };
+}
+
+/**
+ * Push the checkout the policies live in to the repository just created for
+ * them, and report whether it landed.
+ *
+ * Why publish pushes at all: it created the repository, so it owns the one
+ * moment when pushing cannot conflict with anything. The repository used to be
+ * created with `auto_init`, which meant GitHub wrote an "Initial commit" the
+ * author did not have — so the `git push` that every publish is followed by was
+ * rejected as unrelated history, every time, for everybody. Seeding it and
+ * pushing it are the same job; doing only the first left the author to
+ * reconcile two histories by hand.
+ *
+ * It also makes the tag mean something. The release tags the default branch, so
+ * against a seeded repository `1.0.0` named a README commit that did not
+ * contain a single one of the policies it shipped.
+ *
+ * The token goes in through GIT_ASKPASS, never in the URL or the argv: a remote
+ * with a credential in it is written into `.git/config` in plaintext, and one on
+ * a command line is readable from `ps` by every user on the box.
+ */
+export const __pushExistingHistoryForTest = (
+  dir: string,
+  owner: string,
+  name: string,
+  token: string,
+): boolean => pushExistingHistory(dir, owner, name, token);
+
+function pushExistingHistory(dir: string, owner: string, name: string, token: string): boolean {
+  const git = (args: string[], env?: Record<string, string>): string | null => {
+    try {
+      return execFileSync("git", args, {
+        cwd: dir,
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "ignore"],
+        timeout: 60_000,
+        env: env ? { ...process.env, ...env } : process.env,
+      }).trim();
+    } catch {
+      return null;
+    }
+  };
+  const branch = git(["rev-parse", "--abbrev-ref", "HEAD"]);
+  // No commits yet (`HEAD` unborn) means there is nothing to push and nothing
+  // to conflict with later either.
+  if (!branch || branch === "HEAD" || !git(["rev-parse", "--verify", "HEAD"])) return false;
+
+  const askpass = join(mkdtempSync(join(tmpdir(), "fpai-askpass-")), "askpass.sh");
+  try {
+    writeFileSync(askpass, `#!/bin/sh\ncase "$1" in\n*Username*) echo x-access-token ;;\n*) echo "$FPAI_GH_TOKEN" ;;\nesac\n`, { mode: 0o700 });
+    const env = { GIT_ASKPASS: askpass, FPAI_GH_TOKEN: token, GIT_TERMINAL_PROMPT: "0" };
+    const url = `${GITHUB_GIT}/${owner}/${name}.git`;
+    // Name the remote FIRST when there is not one, so the push can be `-u` and
+    // leave the branch tracking it. Pushing to a bare URL and setting the
+    // upstream afterwards cannot work: `--set-upstream-to` needs a
+    // remote-tracking ref, and a URL push writes none.
+    const adopt = !git(["remote", "get-url", "origin"]);
+    if (adopt) git(["remote", "add", "origin", url]);
+    // An author who already has an `origin` keeps it, and the push goes to the
+    // URL directly rather than quietly redirecting their remote.
+    const pushed = adopt
+      ? git(["push", "-u", "origin", `${branch}:${branch}`], env)
+      : git(["push", url, `${branch}:${branch}`], env);
+    if (pushed === null) {
+      // Leave nothing behind that was not there before.
+      if (adopt) git(["remote", "remove", "origin"]);
+      return false;
+    }
+    return true;
+  } finally {
+    try {
+      rmSync(dirname(askpass), { recursive: true, force: true });
+    } catch {
+      /* a leftover temp dir is not worth failing a publish over */
+    }
+  }
+}
+
+/**
+ * The minimum that gives a repository a default branch: one commit, made
+ * through the API. Only for a pack published from somewhere that is not a git
+ * checkout — otherwise the author's own history does this job better.
+ */
+async function seedDefaultBranch(owner: string, name: string, id: string, token: string): Promise<void> {
+  await gh(`${GITHUB_API}/repos/${owner}/${name}/contents/README.md`, token, {
+    method: "PUT",
+    contentType: "application/json",
+    body: JSON.stringify({
+      message: `${id}: create pack repository`,
+      content: Buffer.from(
+        `# ${name}\n\nA [failproofai](https://github.com/failproofai/failproofai) policy pack.\n\n\`\`\`bash\nfailproofai policies add ${owner}/${name}\n\`\`\`\n`,
+        "utf8",
+      ).toString("base64"),
+    }),
+  });
+}
+
+/**
+ * Where `bun` is, if it is anywhere.
+ *
+ * Bundling needs it, and a CLI installed from npm runs under node — so bun is
+ * likely present (it is in `engines`) but never guaranteed. Checked in the
+ * places it actually installs to, because `npm i -g bun` puts it in ONE nvm
+ * version's bin dir and `nvm use` then drops it off PATH.
+ */
+function findBun(): string | null {
+  const candidates = [
+    "bun",
+    process.env.BUN_INSTALL ? resolve(process.env.BUN_INSTALL, "bin", "bun") : null,
+    resolve(homedir(), ".bun", "bin", "bun"),
+    "/opt/homebrew/bin/bun",
+    "/usr/local/bin/bun",
+  ].filter((c): c is string => c !== null);
+  for (const candidate of candidates) {
+    try {
+      execFileSync(candidate, ["--version"], { stdio: "ignore", timeout: 5_000 });
+      return candidate;
+    } catch {
+      continue;
+    }
+  }
+  return null;
+}
+
+/**
+ * Collapse several policy files, or one that imports its neighbours, into the
+ * single artifact a pack has to be.
+ *
+ * One entry file is a real constraint — only the entry is content-addressed, so
+ * a multi-file pack could not honestly claim to be digest-pinned — but that is a
+ * constraint on what gets PUBLISHED, not on how anybody writes. Splitting
+ * policies across files is the normal thing to do past about three of them, and
+ * telling someone to go and configure a bundler first is the tool refusing to do
+ * the one mechanical step it already does for its own pack.
+ *
+ * `--external failproofai` because the loader supplies it: bundling our own
+ * module into the artifact would ship a second copy of the registry, and
+ * policies would register into an object nothing reads.
+ */
+function bundleEntry(
+  sources: string[],
+  outDir: string,
+): { path: string } | { error: string[] } {
+  const bun = findBun();
+  if (!bun) {
+    return {
+      error: [
+        sources.length > 1
+          ? `${sources.length} policy files here, and bundling them needs bun, which is not installed.`
+          : `${sources[0]} imports other files, and bundling needs bun, which is not installed.`,
+        "Either install bun (https://bun.sh), bundle it yourself first —",
+        "  esbuild <entry> --bundle --format=esm --external:failproofai --outfile=pack.mjs",
+        "then publish the bundle — or name a single self-contained file.",
+      ],
+    };
+  }
+  mkdirSync(outDir, { recursive: true });
+  // A generated entry that imports each file for its SIDE EFFECT: every policy
+  // file registers by calling `customPolicies.add` at module scope, so importing
+  // it is what puts the policies in the registry. Same shape as the generated
+  // entry this repo builds its own pack from.
+  const entry = resolve(outDir, ".entry.generated.mjs");
+  writeFileSync(
+    entry,
+    sources.map((f) => `import ${JSON.stringify(f.startsWith("/") ? f : resolve(f))};`).join("\n") + "\n",
+    "utf8",
+  );
+  const bundled = resolve(outDir, ".bundled.mjs");
+  try {
+    execFileSync(
+      bun,
+      ["build", "--target=node", "--format=esm", "--external", "failproofai",
+       "--outfile", bundled, entry],
+      { stdio: ["ignore", "pipe", "pipe"], timeout: 120_000 },
+    );
+  } catch (err) {
+    const detail = err instanceof Error && "stderr" in err
+      ? String((err as { stderr?: Buffer }).stderr ?? "").trim().split("\n").slice(0, 6)
+      : [];
+    return { error: [`Could not bundle those files:`, ...detail.map((l) => `  ${l}`)] };
+  }
+  return { path: bundled };
+}
+
+/**
+ * The entry path among publish's arguments, and nothing that merely follows a
+ * flag.
+ *
+ * `packAddSource` knows the flags `policies add` takes, not the ones `publish`
+ * takes — so `publish --id me/x --version 1.0.0` read `me/x` as the file to
+ * publish and failed on ENOENT. It only ever worked because every example wrote
+ * the path first.
+ */
+const PUBLISH_VALUE_FLAGS = new Set([
+  "--repo", "--version", "--id", "--tag", "--notes", "--out", "--effect", "--entry", "--init",
+]);
+function publishEntryArg(rest: string[]): string | undefined {
+  const consumed = new Set<number>();
+  for (let i = 0; i < rest.length; i += 1) {
+    if (PUBLISH_VALUE_FLAGS.has(rest[i])) consumed.add(i + 1);
+  }
+  return rest.find((a, i) => !a.startsWith("--") && !consumed.has(i));
+}
+
 // ── publish ───────────────────────────────────────────────────────────────
 
 const GITHUB_API = process.env.FAILPROOFAI_GITHUB_API ?? "https://api.github.com";
 const GITHUB_UPLOADS = process.env.FAILPROOFAI_GITHUB_UPLOADS ?? "https://uploads.github.com";
+/** Where the git remote lives, so the push path can be tested against a real
+ *  local bare repository rather than only reasoned about. */
+const GITHUB_GIT = process.env.FAILPROOFAI_GITHUB_GIT ?? "https://github.com";
 
 /**
  * The credential, from the places a developer already keeps one.
@@ -423,6 +952,60 @@ function ghError(res: { status: number; json: Record<string, unknown> | null; te
  *   - a private repository, which publishes to nobody, because installs are
  *     anonymous HTTPS with no credential to offer.
  */
+/**
+ * The two things `publish` cannot work out on its own, asked instead of
+ * demanded as flags.
+ *
+ * Everything else it already derives: the policy files by content, the version
+ * by counting the repository's own releases, the id from the repository, the
+ * credential from the environment. What is left is genuinely a question —
+ * WHERE this should live, when the folder has no git remote naming somewhere —
+ * and a confirmation, because publishing is public and a version number can
+ * never be reused.
+ *
+ * Only ever on a TTY. A pipe, a CI job or a test gets the old behaviour: flags
+ * decide, and a missing `--repo` still means "build the assets and stop"
+ * rather than a prompt nobody can answer.
+ */
+async function askWhereToPublish(
+  suggestion: string,
+  io: { stdin: TTYIn; stdout: TTYOut },
+): Promise<string | null> {
+  const answer = await promptText({
+    // The suggestion goes in the HINT, not just in `defaultValue`: the hint is
+    // what renders as the placeholder, while `defaultValue` is only applied on
+    // an empty submit and is never shown. Passing it as the default alone left
+    // the one keystroke that finishes this prompt — return — invisible.
+    message: "Where should this publish?",
+    hint: `${suggestion}  ·  created if it does not exist`,
+    defaultValue: suggestion,
+    validate: (v) => {
+      const t = v.trim();
+      if (!/^[A-Za-z0-9][\w.-]*\/[A-Za-z0-9][\w.-]*$/.test(t)) return "owner/repo";
+      return null;
+    },
+    stdin: io.stdin,
+    stdout: io.stdout,
+  });
+  return answer === null ? null : answer.trim();
+}
+
+/**
+ * The account the credential belongs to, for the default answer above.
+ *
+ * Best-effort: a failure here costs a nicer default and nothing else, so it
+ * never blocks or reports. The prompt still has the folder name to fall back
+ * on, which is what the repository would most likely be called anyway.
+ */
+async function credentialLogin(token: string): Promise<string | null> {
+  try {
+    const me = await gh(`${GITHUB_API}/user`, token);
+    return typeof me.json?.login === "string" ? me.json.login : null;
+  } catch {
+    return null;
+  }
+}
+
 async function publish(rest: string[]): Promise<PackCliResult> {
   const flag = (name: string): string | undefined => {
     const i = rest.findIndex((a) => a === `--${name}` || a.startsWith(`--${name}=`));
@@ -430,18 +1013,73 @@ async function publish(rest: string[]): Promise<PackCliResult> {
     return rest[i].includes("=") ? rest[i].split("=").slice(1).join("=") : rest[i + 1];
   };
 
-  const repo = flag("repo");
-  const version = flag("version");
-  const entry = packAddSource(rest.filter((a) => a !== "--dry-run")) ?? flag("entry");
+  if (rest.includes("--init")) {
+    return scaffold(flag("init") ?? publishEntryArg(rest) ?? null);
+  }
+
+  let entry = publishEntryArg(rest.filter((a) => a !== "--dry-run")) ?? flag("entry");
+  // Every policy file here, bundled into one artifact below. Named explicitly,
+  // it is that file and only that file.
+  const discovered = entry ? [] : findEntry(process.cwd());
+  if (!entry && discovered.length > 0) entry = discovered[0];
+  let repo = flag("repo") ?? (entry ? inferRepo(entry) : null) ?? undefined;
+  // Nothing names a destination and there is somebody to ask. This is the
+  // whole of "just run `failproofai publish`": the folder is a git repo full
+  // of policies, and the one thing it cannot know is where they should go.
+  const interactive = Boolean(process.stdin.isTTY && process.stdout.isTTY);
+  const askingWhere = interactive && !repo && entry && !rest.includes("--dry-run");
+  if (askingWhere) {
+    // What is about to be published, before being asked where to put it. The
+    // question is answerable without it — but "publish" with no arguments
+    // otherwise gives no sign of WHICH files it found, and finding the wrong
+    // ones is the mistake that matters here.
+    const found = discovered.length > 0 ? discovered : [entry!];
+    process.stdout.write(
+      `\n  ${found.length} policy ${found.length === 1 ? "file" : "files"}: ` +
+        `${found.map((f) => basename(f)).join(", ")}\n\n`,
+    );
+    const token = githubToken();
+    const login = token ? await credentialLogin(token) : null;
+    const folder = basename(resolve(entry!, ".."));
+    const answered = await askWhereToPublish(
+      `${login ?? "your-account"}/${folder}`,
+      { stdin: process.stdin as unknown as TTYIn, stdout: process.stdout as unknown as TTYOut },
+    );
+    if (answered === null) return ok(["Nothing was published."]);
+    repo = answered;
+  }
+  // A tag on HEAD is somebody SAYING what this release is, so it wins over a
+  // counted one. Everything else is decided after the repository is known,
+  // because the count comes from what that repository has already published.
+  let version = flag("version") ?? (entry ? inferTaggedVersion(entry) : null) ?? undefined;
+  let versionCounted = false;
   // The id and the repo are usually the same words, and requiring both is asking
   // the same question twice. Either one alone answers for the other.
-  const id = flag("id") ?? repo;
-  const tag = flag("tag") ?? version;
   const dryRun = rest.includes("--dry-run") || !repo;
+  // A dry run publishes nothing, so the id only has to name the artifact it
+  // writes — and refusing to build one because the folder has no git remote
+  // yet blocked the exact thing a dry run is for: looking at the pack BEFORE
+  // committing to a repository for it. The folder name is what the repository
+  // would be called anyway, and `--id` or `--repo` overrides it the moment
+  // either is known.
+  //
+  // `local/` rather than a guessed account: the owner is genuinely not known
+  // yet, and a plausible-looking one would be baked into a manifest somebody
+  // could upload by hand.
+  const id =
+    flag("id") ?? repo ?? (dryRun && entry ? `local/${basename(resolve(entry, ".."))}` : undefined);
+  const [owner, name] = (repo ?? "/").split("/");
+  if (repo && (!owner || !name || repo.split("/").length !== 2)) {
+    return fail([`--repo must be <owner>/<repo>, got ${JSON.stringify(repo)}`]);
+  }
 
-  if (!entry || !version || !id) {
+  if (!entry || !id) {
     return fail([
-      "Usage: failproofai publish <entry.mjs> --repo <owner>/<repo> --version <version>",
+      "Usage: failproofai publish <entry.mjs> [--repo <owner>/<repo>] [--version <v>]",
+      "",
+      "Inside a git checkout with a github remote, both are inferred — the repo",
+      "from the remote, the version from a tag on HEAD or the short commit SHA.",
+      "Outside one, name them:",
       "       [--id <publisher/name>] [--tag <tag>] [--notes <text>]",
       "       [--out <dir>] [--effect enforce|observe] [--dry-run]",
       "",
@@ -449,26 +1087,108 @@ async function publish(rest: string[]): Promise<PackCliResult> {
     ]);
   }
 
-  // Build first, always. There is no point authenticating against GitHub to
-  // discover the pack does not load.
-  const built = await build([entry, "--id", id, "--version", version, ...outFlagFrom(rest), ...effectFlagFrom(rest)]);
+  // Check an EXPLICIT tag against an explicit version before anything reaches
+  // the network. When the version is counted the tag simply follows it and can
+  // never disagree — but a tag the user typed can, and refusing it here is what
+  // stops a doomed publish from first creating a repository for itself.
+  const explicitTag = flag("tag");
+  if (explicitTag && version && !packTagMatchesVersion(explicitTag, version)) {
+    return fail([
+      `Tag ${explicitTag} does not describe version ${version}, so nobody could install it.`,
+      `A pack is fetched from releases/download/${explicitTag}/… and then reports`,
+      `${version} — which names no release. Use --tag ${version} (a leading v is`,
+      "fine), or build the pack at the version the tag says.",
+    ]);
+  }
+
+  // The version may still be unknown here: with nothing explicit and no tag, it
+  // is one past whatever the repository has already published, which cannot be
+  // known without asking it. So the credential and the repository come first —
+  // the reverse of the old order, where building first avoided authenticating
+  // for a pack that does not load. That trade is still paid: the build runs
+  // immediately after, before anything is created or uploaded.
+  let token: string | null = null;
+  let created = false;
+  let repoInfo: Awaited<ReturnType<typeof gh>> | null = null;
+  if (!dryRun) {
+    token = githubToken();
+    if (!token) {
+      return fail([
+        "No GitHub credential found.",
+        "Set GITHUB_TOKEN (or GH_TOKEN), or sign in once with `gh auth login`.",
+        "It needs write access to releases on that repository, and nothing else.",
+      ]);
+    }
+      const ensured = await ensureRepo(owner, name, id, token, resolve(entry, ".."));
+    if ("error" in ensured) return fail(ensured.error);
+    created = ensured.created;
+    repoInfo = ensured.info;
+    if (!version) {
+      version = await nextVersion(owner, name, token);
+      versionCounted = true;
+    }
+  }
+  // A dry run has nothing to count against, so it reports the first version. It
+  // says so rather than implying the number is settled.
+  if (!version) {
+    version = "1.0.0";
+    versionCounted = true;
+  }
+
+  const tag = flag("tag") ?? version;
+
+  // One artifact, however many files it was written across. `build` refuses an
+  // entry with relative imports because only the entry is digest-pinned — so
+  // the fix is to make it ONE file here, not to send the author away to set up
+  // a bundler for a step this tool already performs for its own pack.
+  const outDirEarly = resolve(flag("out") ?? "dist-pack");
+  let entryToBuild = entry;
+  const needsBundle =
+    discovered.length > 1 ||
+    /(?:^|\n)\s*(?:import|export)[^;\n]*from\s+["']\.[^"']*["']/.test(
+      readFileSync(entry, "utf8"),
+    );
+  if (needsBundle) {
+    const sources = discovered.length > 1 ? discovered : [entry];
+    const bundled = bundleEntry(sources, outDirEarly);
+    if ("error" in bundled) return fail(bundled.error);
+    entryToBuild = bundled.path;
+  }
+
+  const built = await build([entryToBuild, "--id", id, "--version", version, ...outFlagFrom(rest), ...effectFlagFrom(rest)]);
   if (built.exitCode !== 0) return built;
 
-  const outDir = resolve(flag("out") ?? "dist-pack");
+  const outDir = outDirEarly;
+  const bundleNote =
+    discovered.length > 1
+      ? [`Bundled ${discovered.length} files into one artifact:`,
+         ...discovered.map((f) => `  ${f.replace(process.cwd() + "/", "")}`), ""]
+      : [];
   if (dryRun) {
     return ok([
+      ...bundleNote,
       ...built.lines.slice(0, 4),
       "",
       ...(repo
         ? ["Dry run — nothing was published.", `Drop --dry-run to release it on ${repo}.`]
         : [
             "Nothing was published: name a repository to release it on.",
-            `  failproofai publish ${entry} --repo <owner>/<repo> --version ${version}`,
+            // Just the repository. It used to spell out the entry file and the
+            // version too — naming ONE of the files it had that moment finished
+            // bundling, and pinning a version it works out by counting the
+            // repository's own releases. Both were wrong the moment they were
+            // printed, and both taught the reader that publishing needs flags
+            // it does not need.
+            "  failproofai publish --repo <owner>/<repo>",
           ]),
     ]);
   }
 
-  if (!packTagMatchesVersion(tag!, version)) {
+  // Narrowed once: every path reaching here passed through the `!dryRun` branch
+  // above, which returns when there is no credential.
+  const auth = token as string;
+
+  if (!packTagMatchesVersion(tag, version)) {
     return fail([
       `Tag ${tag} does not describe version ${version}, so nobody could install it.`,
       `A pack is fetched from releases/download/${tag}/… and then reports ${version} —`,
@@ -477,41 +1197,20 @@ async function publish(rest: string[]): Promise<PackCliResult> {
     ]);
   }
 
-  const [owner, name] = repo!.split("/");
-  if (!owner || !name || repo!.split("/").length !== 2) {
-    return fail([`--repo must be <owner>/<repo>, got ${JSON.stringify(repo)}`]);
-  }
 
-  const token = githubToken();
-  if (!token) {
-    return fail([
-      "No GitHub credential found.",
-      "Set GITHUB_TOKEN (or GH_TOKEN), or sign in once with `gh auth login`.",
-      "It needs write access to releases on that repository, and nothing else.",
-    ]);
-  }
-
-  const repoInfo = await gh(`${GITHUB_API}/repos/${owner}/${name}`, token);
-  if (repoInfo.status === 404) {
-    return fail([
-      `${repo} does not exist, or that credential cannot see it.`,
-      `Create it first:  gh repo create ${repo} --public`,
-    ]);
-  }
-  if (repoInfo.status >= 400) return fail([`Could not read ${repo}: ${ghError(repoInfo)}`]);
   // A private repo is not a smaller audience, it is no audience: `pack add`
   // sends no Authorization header at all, by design, so every install 404s.
-  const isPrivate = repoInfo.json?.private === true;
+  const isPrivate = repoInfo?.json?.private === true;
 
   // Reuse a release on this tag rather than failing on it. Re-publishing a
   // corrected artifact under an existing tag is a normal thing to need, and the
   // digest change is visible to anyone who reinstalls.
   let releaseId: number | null = null;
-  const existing = await gh(`${GITHUB_API}/repos/${owner}/${name}/releases/tags/${encodeURIComponent(tag!)}`, token);
+  const existing = await gh(`${GITHUB_API}/repos/${owner}/${name}/releases/tags/${encodeURIComponent(tag)}`, auth);
   if (existing.status === 200 && typeof existing.json?.id === "number") {
     releaseId = existing.json.id;
   } else {
-    const created = await gh(`${GITHUB_API}/repos/${owner}/${name}/releases`, token, {
+    const created = await gh(`${GITHUB_API}/repos/${owner}/${name}/releases`, auth, {
       method: "POST",
       contentType: "application/json",
       body: JSON.stringify({
@@ -533,7 +1232,7 @@ async function publish(rest: string[]): Promise<PackCliResult> {
 
   const assets = [PACK_MANIFEST_ASSET, PACK_ENTRY_ASSET, PACK_CHECKSUMS_ASSET];
   const uploaded: string[] = [];
-  const listed = await gh(`${GITHUB_API}/repos/${owner}/${name}/releases/${releaseId}/assets?per_page=100`, token);
+  const listed = await gh(`${GITHUB_API}/repos/${owner}/${name}/releases/${releaseId}/assets?per_page=100`, auth);
   const already = Array.isArray(listed.json)
     ? (listed.json as unknown as Array<{ id: number; name: string }>)
     : [];
@@ -543,12 +1242,12 @@ async function publish(rest: string[]): Promise<PackCliResult> {
     // append.
     const prior = already.find((a) => a.name === asset);
     if (prior) {
-      await gh(`${GITHUB_API}/repos/${owner}/${name}/releases/assets/${prior.id}`, token, { method: "DELETE" });
+      await gh(`${GITHUB_API}/repos/${owner}/${name}/releases/assets/${prior.id}`, auth, { method: "DELETE" });
     }
     const bytes = readFileSync(resolve(outDir, asset));
     const upload = await gh(
       `${GITHUB_UPLOADS}/repos/${owner}/${name}/releases/${releaseId}/assets?name=${encodeURIComponent(asset)}`,
-      token,
+      auth,
       {
         method: "POST",
         contentType: asset.endsWith(".json") ? "application/json" : "application/octet-stream",
@@ -566,7 +1265,10 @@ async function publish(rest: string[]): Promise<PackCliResult> {
   }
 
   const lines = [
-    `Published ${id}@${version} to ${repo} at tag ${tag}.`,
+    ...bundleNote,
+    ...(created ? [`Created ${repo} (public).`] : []),
+    `Published ${id}@${version} to ${repo} at tag ${tag}.` +
+      (versionCounted ? " Next publish will be one past it." : ""),
     `  ${assets.length} assets attached`,
     "",
     "Anyone can now install it:",
@@ -601,6 +1303,43 @@ export async function runPublishCommand(rest: string[]): Promise<PackCliResult>
   return publish(rest);
 }
 
+/**
+ * Which agents should this pack guard?
+ *
+ * Asked BEFORE the policy list, because it is the coarser question and the
+ * answer changes what the second screen is for. Setup no longer asks it: hooks
+ * go into every supported agent, since hooks alone enforce nothing, so the
+ * decision moved here — where the user is looking at a concrete pack instead of
+ * answering in the abstract before anything is installed.
+ *
+ * Every supported agent is offered and all are pre-ticked. Detected ones are
+ * marked, but an undetected agent is NOT excluded: installing one next week is
+ * exactly the case setup's install-everywhere behaviour exists to cover, and a
+ * pack that silently skipped it would undo that.
+ *
+ * Returns null when cancelled — distinct from picking every agent.
+ */
+async function pickClis(
+  io: { stdin: TTYIn; stdout: TTYOut },
+): Promise<string[] | null> {
+  const detected = new Set(detectInstalledClis());
+  const choices: MultiChoice<string>[] = INTEGRATION_TYPES.map((id) => ({
+    label: id,
+    value: id,
+    checked: true,
+    hint: detected.has(id) ? "installed here" : "",
+  }));
+  return multiSelect<string>({
+    message: "Which agents should this pack guard?",
+    choices,
+    minSelected: 1,
+    summaryNoun: "agents",
+    hint: `space toggles · ctrl+a all · ↵ confirm · ${detected.size} detected on this machine`,
+    stdin: io.stdin,
+    stdout: io.stdout,
+  });
+}
+
 /**
  * The pack's own list, defaults pre-ticked, before anything is installed.
  *
@@ -683,6 +1422,15 @@ async function add(rest: string[]): Promise<PackCliResult> {
   const io = { stdin: process.stdin as TTYIn, stdout: process.stdout as TTYOut };
   const chose = !selection.only && !selection.categories && !selection.all;
   if (chose && io.stdin.isTTY && io.stdout.isTTY) {
+    // Agents first, then policies. Coarse before fine, and the coarse answer is
+    // the one somebody can give without reading thirty-eight descriptions.
+    if (!selection.clis) {
+      const agents = await pickClis(io);
+      if (agents === null) return ok(["Nothing installed."]);
+      // Every agent ticked is the same as not narrowing at all, and writing the
+      // full list would freeze this pack out of any CLI supported later.
+      if (agents.length < INTEGRATION_TYPES.length) selection.clis = agents;
+    }
     const picked = await pickFromSource(resolvedSource!, io);
     if (picked === null) return ok(["Nothing installed."]);
     selection.only = picked;