failproofai 1.0.2-beta.4 → 1.0.2-beta.6

package/bin/failproofai.mjs

@@ -725,10 +725,10 @@ OPTIONS
 failproofai pack — install policy packs published as GitHub releases
 
 Usage:
-  failproofai pack add core                     the Failproof AI policies
-  failproofai pack add core --policy <a,b>      just these
-  failproofai pack add core --category <x,y>    whole categories
-  failproofai pack add core --all               everything in it
+  failproofai policies add FailproofAI/policies                     the Failproof AI policies
+  failproofai policies add FailproofAI/policies --policy <a,b>      just these
+  failproofai policies add FailproofAI/policies --category <x,y>    whole categories
+  failproofai policies add FailproofAI/policies --all               everything in it
   failproofai pack list                         packs installed here
   failproofai pack list <source>                what a pack out there contains
   failproofai pack add <source> [--policy <a,b>] [--category <x,y>] [--all]
@@ -739,7 +739,7 @@ A pack is one entry artifact plus a manifest, verified against the release's
 SHA256SUMS at install time. The digest is recorded, and re-verified before every
 import — so a pack cannot change under this machine after you installed it.
 
-<source> is core for the Failproof AI policies, or any of these:
+<source> is any GitHub repo publishing a pack — ours included:
   acme/support-agent                 newest release, pinned to its exact tag
   acme/support-agent@v2.1.0          that release
   github:acme/support-agent@v2.1.0   same, explicit
@@ -761,7 +761,7 @@ rest back on.
 
 Examples:
   failproofai pack add FailproofAI/policies
-  failproofai pack add core --category sanitize,git
+  failproofai policies add FailproofAI/policies --category sanitize,git
   failproofai pack add github:acme/support-agent@v2.1.0 --only block-refunds
   failproofai pack remove acme/support-agent
 
@@ -1220,7 +1220,12 @@ WHY THIS EXISTS
   // ever ship a pack. `pack build` is canonicalized into this above.
   if (args[0] === "publish") {
     const subArgs = args.slice(1);
-    if (subArgs.includes("--help") || subArgs.includes("-h") || subArgs.length === 0) {
+    // NOT `subArgs.length === 0`. A bare `failproofai publish` is the headline
+    // of the help this used to print instead — "TWO COMMANDS, FROM NOTHING:
+    // --init to start, publish to ship it" — and every argument it needs is
+    // worked out from the directory and the git remote. Printing help there
+    // made the one documented command the only one that did nothing.
+    if (subArgs.includes("--help") || subArgs.includes("-h")) {
       console.log(`
 failproofai publish — ship your policies as a pack anyone can install
 
@@ -1229,8 +1234,13 @@ TWO COMMANDS, FROM NOTHING
   failproofai publish --init      write a policy to start from
   failproofai publish             ship it
 
-  Everything else is optional. Every flag below overrides something that is
-  otherwise worked out for you.
+  Write your policies in a git repo, run publish, answer one question, done.
+  It asks WHERE only when nothing tells it — no remote to read — and works
+  the rest out: which files hold policies, what version is next, who you are.
+
+  Every flag below overrides something it would otherwise decide for you.
+  None of them is required, and on a pipe or in CI the flags are all there
+  is: nothing prompts where nobody can answer.
 
 WHAT --init DOES
   Asks what the pack is called, writes <name>.mjs, and stops. No network, no
@@ -1289,11 +1299,16 @@ THE REPO MUST BE PUBLIC
   Only the release matters. Installs read releases/download/<tag>/<asset> and
   never touch your git tree — pushing the source is for humans reading it.
 
-YOUR ENTRY FILE
-  One file, no relative imports: only the entry is digest-pinned, so a pack
-  importing siblings could not honestly claim to be verified. Bundle first
-  (esbuild, bun build, rollup) if yours is split. Each policy may carry
-  category and defaultEnabled alongside the usual fields.
+YOUR POLICY FILES
+  Write as many as you like — one per category reads well. Every file here
+  that registers policies is found and bundled into the single artifact a
+  pack has to be, because only the entry is digest-pinned and a pack
+  importing siblings could not honestly claim to be verified. Bundling needs
+  bun; without it, name one self-contained file.
+
+  Each policy may carry category and defaultEnabled alongside the usual
+  fields. category is what --category selects on; defaultEnabled is what a
+  bare 'policies add' switches on, and it defaults to false.
 
 OPTIONS
   --init [file]           Write a starter policy and stop.
@@ -1356,7 +1371,7 @@ USAGE
   failproofai policies add                 Pick from what is installed here
   failproofai policies add <name>          Turn one policy on
   failproofai policies add <owner>/<repo>  Install someone's pack
-  failproofai policies add core            Our pack, from this package, offline
+  failproofai policies add FailproofAI/policies            Our pack, fetched like any other
   failproofai policies remove <name>       Turn one policy off
   failproofai policies remove <pack-id>    Uninstall a pack
   failproofai policies show <owner>/<repo> What a pack contains, before you take it
@@ -1389,7 +1404,7 @@ EXAMPLES
   failproofai policies add
   failproofai policies add block-sudo
   failproofai policies add sanitize-api-keys --scope project
-  failproofai policies add core --category sanitize,git
+  failproofai policies add FailproofAI/policies --category sanitize,git
   failproofai policies add acme/deploy-guard --policy block-prod-deploy
   failproofai policies show acme/deploy-guard
   failproofai policies remove block-sudo
@@ -1409,18 +1424,41 @@ keep enforcing. FAILPROOFAI_PACK_BASE_URL points it all at a mirror.
     // without a slash that is still a source — it is the short spelling of our
     // own pack, and is checked by the pack lane itself rather than duplicated
     // here.
-    const firstPositional = rest.find((a) => !a.startsWith("-"));
+    // The first positional that is NOT some flag's value.
+    //
+    // A plain `rest.find(a => !a.startsWith("-"))` reads the first VALUE it
+    // meets instead: `policies add --cli claude codex acme/x` picked "claude",
+    // decided that was not a source because it has no slash, and sent the whole
+    // command down the policy lane — where it died on "Unknown flag: --policy".
+    // The same shape works, and misroutes, for --scope and --custom.
+    //
+    // `--cli` takes SEVERAL values, bounded the way pack-cli.ts bounds them: a
+    // pack source always carries a slash and an agent name never does, which
+    // separates the list from what follows it exactly.
+    const VALUE_TAKING = new Set(["--scope", "--policy", "--category", "--only", "--custom", "-c"]);
+    const skip = new Set();
+    for (let i = 0; i < rest.length; i += 1) {
+      if (VALUE_TAKING.has(rest[i])) skip.add(i + 1);
+      if (rest[i] !== "--cli") continue;
+      for (let j = i + 1; j < rest.length && !rest[j].startsWith("-") && !rest[j].includes("/"); j += 1) {
+        skip.add(j);
+      }
+    }
+    const firstPositional = rest.find((a, i) => !a.startsWith("-") && !skip.has(i));
     let looksLikeSource =
       !!firstPositional &&
       (firstPositional.includes("/") || firstPositional.startsWith("github:"));
     if (!looksLikeSource && firstPositional) {
-      // `core` is the one sourcey word with no slash in it. Read the alias set
-      // from the layer that OWNS it rather than restating it here, where the
-      // copy would drift the first time an alias is added — that exact drift
-      // already shipped once, when the dashboard could not resolve a name the
-      // CLI could.
-      const { CORE_ALIASES } = await import("../src/hooks/pack-store");
-      looksLikeSource = CORE_ALIASES.has(firstPositional.toLowerCase());
+      // A retired spelling of our own pack — `core` and friends — is still
+      // routed to the pack lane, which is the only layer that can say what to
+      // type instead. Sent anywhere else it reads as an unknown POLICY name and
+      // the reply lists 38 names, none of which is the answer.
+      //
+      // Read from the layer that owns the set rather than restated here, where
+      // the copy would drift. That exact drift already shipped once, when the
+      // dashboard could not resolve a name the CLI could.
+      const { RETIRED_CORE_ALIASES } = await import("../src/hooks/pack-store");
+      looksLikeSource = RETIRED_CORE_ALIASES.has(firstPositional.toLowerCase());
     }
 
     if (action === "show" || looksLikeSource) {
@@ -1650,8 +1688,8 @@ EXAMPLES
   failproofai policies --uninstall --cli pi
   failproofai policies -u
   failproofai policies --uninstall --custom
-  failproofai pack add core
-  failproofai pack add core --category git,database
+  failproofai policies add FailproofAI/policies
+  failproofai policies add FailproofAI/policies --category git,database
   failproofai pack list acme/support-agent
   failproofai pack build ./my-policies.mjs --id acme/support --version 1.0.0
 `.trimStart());
@@ -1877,19 +1915,38 @@ EXAMPLES
   if (args[0] === "config") {
     if (args.includes("--help") || args.includes("-h")) {
       console.log(`
-failproofai config — interactive setup
+failproofai config — set this machine up
 
 USAGE
-  failproofai config             Guided setup: choose scope, agents, and policies
+  failproofai config             Guided setup
   failproofai configure          Alias for config
   failproofai setup              Alias for config
 
 WHAT IT DOES
-  Walks you through 4 quick steps and writes everything for you:
-    1. Where      — global (all projects) or just this project
-    2. Harnesses  — which agent CLIs to protect (Claude, Codex, ...)
-    3. Policies   — presets (combine any), Everything, or a custom pick
-    4. Review     — confirms the exact files it will change, then applies
+  Installs the failproofaid service (needs root once), wires hooks into every
+  agent CLI it supports, and optionally connects this machine to Cloud. It
+  chooses NO policies — take some with 'failproofai policies add <owner>/<repo>'.
+
+WITH NO TERMINAL (CI, containers, an agent driving it)
+  It just runs. There is nothing to confirm when nobody is watching, so it
+  applies rather than asking — no flag needed.
+
+  failproofai config                          set up, stay local
+  failproofai config --token <key>            set up and connect to Cloud
+    --url <url>                     somewhere other than app.befailproof.ai
+    --machine-id <id>               defaults to a stable per-machine key
+    --machine-label <name>          defaults to this host's name
+    --no-transcripts                decisions only, no session transcripts
+
+  The key can come from FAILPROOFAI_CLOUD_TOKEN instead of the command line,
+  and the url from FAILPROOFAI_CLOUD_URL — the same variable the daemon reads.
+  Prefer the environment: an argument is readable from 'ps' by every user on
+  the box, and lands in shell history and CI logs.
+
+  Exit 1 if anything it was asked to do did not happen — including a key the
+  server refused, and a machine that could not reach root. 'sudo' is never
+  prompted for here; it either works without a password or you are told the
+  exact commands to run.
 
 FAILPROOF CLOUD
   failproofai config --connect <url> --token <key> [--machine-id <id>]
@@ -2078,8 +2135,33 @@ PAUSING ENFORCEMENT (one session, always time-boxed)
       return;
     }
 
+    // Headless setup. `--token` IS the request to connect — there is no other
+    // reason to pass a key — so there is no separate --connect to remember, and
+    // the URL keeps the default the wizard already infers rather than being a
+    // question the flag path alone asks.
+    //
+    // The key is taken from the environment when the flag is absent, because a
+    // secret on argv is readable from `ps` by every user on the box and lands
+    // in shell history and CI logs. FAILPROOFAI_CLOUD_TOKEN is the name the
+    // Rust daemon already reads, so this unifies rather than invents.
+    const valueFor = (flag) => {
+      const i = args.indexOf(flag);
+      if (i < 0) return undefined;
+      const v = args[i + 1];
+      if (!v || v.startsWith("-")) throw new CliError(`Missing value after ${flag}.`);
+      return v;
+    };
     const { runConfigureWizard } = await import("../src/hooks/configure-wizard");
-    const result = await runConfigureWizard();
+    const result = await runConfigureWizard(
+      {},
+      {
+        token: valueFor("--token") ?? process.env.FAILPROOFAI_CLOUD_TOKEN,
+        url: valueFor("--url") ?? process.env.FAILPROOFAI_CLOUD_URL,
+        machineId: valueFor("--machine-id"),
+        machineLabel: valueFor("--machine-label"),
+        noTranscripts: args.includes("--no-transcripts"),
+      },
+    );
     await track("cli_configure_invoked", {
       applied: result.applied,
       // `target` and `scopes`, not `scope`: the wizard rework replaced that