failproofai 1.0.2-beta.4 → 1.0.2-beta.6

package/src/hooks/pack-cli.ts

@@ -6,10 +6,10 @@
  * This layer decides nothing; it formats.
  */
 import { execFileSync } from "node:child_process";
-import { homedir } from "node:os";
+import { homedir, tmpdir } from "node:os";
 import { createHash } from "node:crypto";
-import { copyFileSync, existsSync, mkdirSync, readFileSync, readdirSync, statSync, writeFileSync } from "node:fs";
-import { resolve } from "node:path";
+import { copyFileSync, existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { basename, dirname, join, resolve } from "node:path";
 import { INTEGRATION_TYPES } from "./types";
 import { PACK_VERSION_RE } from "./pack-manifest";
 import { detectInstalledClis } from "./integrations";
@@ -20,9 +20,7 @@ import {
   PACK_MANIFEST_ASSET,
   addPack,
   checkPackArtifact,
-  CORE_ALIASES,
   fetchPackPreview,
-  CORE_SOURCE,
   packTagMatchesVersion,
   removePack,
   setPackPolicyEnabled,
@@ -63,34 +61,153 @@ function parseList(rest: string[], flag: string): string[] | undefined {
   return raw.split(",").map((s) => s.trim()).filter(Boolean);
 }
 
-/** Flags that take a separate value, so it is never mistaken for the source. */
-const VALUE_FLAGS = new Set(["--only", "--policy", "--category", "--cli"]);
+/**
+ * Flags that take a separate value, so it is never mistaken for the source.
+ *
+ * Must list every flag that can REACH this lane, not just the ones this lane
+ * acts on. `--scope` and `--custom` are handled by the caller and passed
+ * through untouched — and their values were being read as the pack to install,
+ * so `policies add --scope project acme/x` tried to fetch a pack called
+ * "project". A flag this file ignores still has a value this file must skip.
+ */
+const VALUE_FLAGS = new Set([
+  "--only",
+  "--policy",
+  "--category",
+  "--cli",
+  "--scope",
+  "--custom",
+  "-c",
+]);
+
+/**
+ * Every index `--cli` claims, so the source is not found among its values.
+ *
+ * `--cli` is the one flag that takes MORE than one token, because the other
+ * lane spells it `--cli claude codex` and somebody typing that here should not
+ * be quietly given a different answer. Shared with `packAddSource` so the two
+ * agree by construction: a token consumed as a CLI name is never also read as
+ * the pack to install.
+ */
+/**
+ * Could this token be an agent name rather than the pack to install?
+ *
+ * `--cli` consumes several tokens, so it has to know where its own list ends,
+ * and "not a flag" is not enough: `--cli claude codex acme/x` would swallow the
+ * SOURCE and leave the command with nothing to install. A pack source always
+ * carries a slash — `parsePackSource` accepts nothing else — and no agent name
+ * has one, which separates them exactly.
+ *
+ * Deliberately NOT "is it a known agent". An unknown name has to be consumed to
+ * be REJECTED: stopping at `claud` would hand it to the source parser instead,
+ * and the reply would be about pack syntax rather than about the typo.
+ */
+function looksLikeCliName(token: string): boolean {
+  return !token.startsWith("-") && !token.includes("/");
+}
+
+function cliValueIndices(rest: string[]): Set<number> {
+  const taken = new Set<number>();
+  for (let i = 0; i < rest.length; i += 1) {
+    if (rest[i] !== "--cli" && !rest[i].startsWith("--cli=")) continue;
+    if (rest[i].startsWith("--cli=")) continue; // its value is in the same token
+    for (let j = i + 1; j < rest.length && looksLikeCliName(rest[j]); j += 1) {
+      taken.add(j);
+    }
+  }
+  return taken;
+}
 
 /** Find the positional source without mistaking a flag's separate value for it. */
 export function packAddSource(rest: string[]): string | undefined {
-  const consumed = new Set<number>();
+  const consumed = cliValueIndices(rest);
   for (let i = 0; i < rest.length; i += 1) {
     if (VALUE_FLAGS.has(rest[i])) consumed.add(i + 1);
   }
-  return rest.find((arg, index) => !arg.startsWith("--") && !consumed.has(index));
+  // ONE dash, not two. `-c` passed a `startsWith("--")` filter and was returned
+  // as the pack to install — and no GitHub owner or repo may begin with a
+  // hyphen, so nothing legitimate is excluded by widening it.
+  return rest.find((arg, index) => !arg.startsWith("-") && !consumed.has(index));
+}
+
+/**
+ * The agent CLIs named by `--cli`, in either spelling, all of them validated.
+ *
+ * Two separate silent failures lived here, and both reported success:
+ *
+ *  - An unknown name was accepted. `--cli claud` installed the pack, printed
+ *    "Installed", exited 0, and guarded NOTHING — the misspelling matched no
+ *    agent, so the pack applied to none of them.
+ *  - A space-separated list was truncated to its first entry.
+ *    `--cli claude codex` recorded `["claude"]` and dropped codex on the floor,
+ *    because this lane split on commas while the other split on spaces.
+ *
+ * Both now take either spelling and refuse a name that is not an agent. The set
+ * comes from `INTEGRATION_TYPES` rather than a list written out here, because
+ * the copy in `bin/failproofai.mjs` is already a second hand-maintained one and
+ * a third would be the one that drifts.
+ */
+function parseCliList(rest: string[]): { clis?: string[] } | { error: string[] } {
+  const idx = rest.findIndex((a) => a === "--cli" || a.startsWith("--cli="));
+  if (idx === -1) return {};
+  const values: string[] = [];
+  if (rest[idx].startsWith("--cli=")) {
+    values.push(...rest[idx].slice("--cli=".length).split(","));
+  } else {
+    for (let j = idx + 1; j < rest.length && looksLikeCliName(rest[j]); j += 1) {
+      values.push(...rest[j].split(","));
+    }
+  }
+  const names = values.map((v) => v.trim()).filter(Boolean);
+  if (names.length === 0) return { clis: [] };
+
+  const known = new Set<string>(INTEGRATION_TYPES);
+  const unknown = names.filter((n) => !known.has(n));
+  if (unknown.length > 0) {
+    // Thrown, not warned. A pack scoped to an agent that does not exist is
+    // enforcing on nothing, and saying so afterwards is no use to the script
+    // that already read exit 0 and moved on.
+    const near = (bad: string) =>
+      INTEGRATION_TYPES.find((k) => k.startsWith(bad.slice(0, 3)) || bad.startsWith(k.slice(0, 3)));
+    const hint = unknown.map((u) => (near(u) ? `${u} (did you mean ${near(u)}?)` : u)).join(", ");
+    return {
+      error: [
+        `Not an agent: ${hint}`,
+        `--cli takes any of: ${INTEGRATION_TYPES.join(", ")}`,
+      ],
+    };
+  }
+  return { clis: names };
 }
 
 /** Names taken by our own policies, so a selection can be checked before install. */
+/**
+ * Exported for tests: the parse is where both `--cli` bugs lived, and asserting
+ * it through a real `add` would need a release server for a question that is
+ * purely about argument shapes.
+ */
+export function selectionFromForTest(rest: string[]) {
+  return selectionFrom(rest);
+}
+
 function selectionFrom(rest: string[]): {
   only?: string[];
   categories?: string[];
   all?: boolean;
   clis?: string[];
+  /** Present when the selection itself is unusable — see `parseCliList`. */
+  error?: string[];
 } {
   // `--policy` reads right for one ("give me this policy"), `--only` for a set.
   // They are the same switch; taking both means neither is the wrong guess.
   const only = parseList(rest, "--policy") ?? parseList(rest, "--only");
   const categories = parseList(rest, "--category");
-  const clis = parseList(rest, "--cli");
+  const parsedClis = parseCliList(rest);
+  if ("error" in parsedClis) return { error: parsedClis.error };
   return {
     ...(only ? { only } : {}),
     ...(categories ? { categories } : {}),
-    ...(clis ? { clis } : {}),
+    ...(parsedClis.clis ? { clis: parsedClis.clis } : {}),
     ...(rest.includes("--all") ? { all: true } : {}),
   };
 }
@@ -175,6 +292,29 @@ async function build(rest: string[]): Promise<PackCliResult> {
     ]);
   }
 
+  // Two policies cannot share a name, and this is where that has to be caught.
+  //
+  // Nothing downstream can resolve the ambiguity: a name is what `--policy`
+  // selects, what the picker toggles, and what the enabled list stores — so a
+  // duplicate makes one of the two unreachable and the other's on/off state
+  // decide for both. Bundling several files makes it easy to reach by accident:
+  // a starter written by `publish --init` into a folder that already had a
+  // policy of the same name published as exactly this, twice over, with no
+  // complaint at build time.
+  const byName = new Map<string, number>();
+  for (const hook of hooks) byName.set(hook.name, (byName.get(hook.name) ?? 0) + 1);
+  const duplicates = [...byName.entries()].filter(([, n]) => n > 1).map(([name]) => name);
+  if (duplicates.length > 0) {
+    return fail([
+      duplicates.length === 1
+        ? `Two policies are called ${JSON.stringify(duplicates[0])}.`
+        : `${duplicates.length} names are used by more than one policy: ${duplicates.join(", ")}.`,
+      "A name is what --policy selects and what the picker toggles, so a pack",
+      "cannot carry the same one twice — one of them would be unreachable.",
+      "Rename or delete one of each pair.",
+    ]);
+  }
+
   const policies: unknown[] = [];
   for (const [index, hook] of hooks.entries()) {
     // `category` and `defaultEnabled` are pack-manifest fields a plain custom
@@ -274,7 +414,7 @@ export async function runPolicyPicker(
           {
             what: "No policies are installed yet.",
             hint: "Take ours, or anyone's:",
-            cmd: "failproofai policies add core",
+            cmd: "failproofai policies add FailproofAI/policies",
           },
           opts,
         ),
@@ -354,6 +494,15 @@ export async function runPolicyPicker(
  * policy that already RUNS and already blocks something real, so the first
  * action is editing a working thing rather than authoring an empty one.
  */
+/**
+ * A policy filename, whatever spelling it arrived in. Discovery takes
+ * `.mjs`/`.js`/`.ts` and nothing else, so a name with no extension has to gain
+ * one or the file it names can never be found.
+ */
+function withPolicyExtension(name: string): string {
+  return /\.(mjs|js|ts)$/.test(name) ? name : `${name}.mjs`;
+}
+
 async function scaffold(target: string | null): Promise<PackCliResult> {
   // Ask what the pack is called when nothing was named and there is somebody to
   // ask. The answer becomes the FILENAME and the header, so what lands on disk
@@ -374,9 +523,14 @@ async function scaffold(target: string | null): Promise<PackCliResult> {
       stdout: process.stdout,
     });
     if (answer === null) return ok(["Nothing written."]);
-    chosen = `./${answer.trim().replace(/\.(mjs|js|ts)$/, "")}.mjs`;
+    chosen = answer.trim();
   }
-  const path = resolve(chosen ?? "./my-policies.mjs");
+  // Both paths land here, because only one of them used to. A name typed at
+  // the prompt got `.mjs`; the same name passed as `--init myguards` was taken
+  // literally and wrote a file called `myguards` — which discovery skips (it
+  // takes .mjs/.js/.ts) and which no ESM loader will import. The starter file
+  // was unreachable by every command meant to pick it up.
+  const path = resolve(withPolicyExtension(chosen ?? "my-policies"));
   if (existsSync(path)) {
     return fail([`${path} already exists — name a different file, or edit that one.`]);
   }
@@ -416,7 +570,7 @@ customPolicies.add({
     "  then ask your agent to force-push — it gets refused",
     "",
     "Then publish it:",
-    `  failproofai publish ${path} --repo <you>/<repo> --version 1.0.0`,
+    "  failproofai publish --repo <you>/<repo>",
   ]);
 }
 
@@ -582,6 +736,7 @@ async function ensureRepo(
   name: string,
   id: string,
   token: string,
+  sourceDir?: string,
 ): Promise<{ info: Awaited<ReturnType<typeof gh>>; created: boolean } | { error: string[] }> {
   let info = await gh(`${GITHUB_API}/repos/${owner}/${name}`, token);
   let created = false;
@@ -601,7 +756,15 @@ async function ensureRepo(
         name,
         private: false,
         description: `failproofai policy pack — ${id}`,
-        auto_init: true,
+        // NOT auto_init. The author already has the commit that holds these
+        // policies; a repository seeded with its own "Initial commit" shares
+        // no history with it, so the `git push` that every publish is followed
+        // by is rejected as unrelated — and the way out (`pull --allow-
+        // unrelated-histories`, or a force-push over the seed) is a worse
+        // first five minutes than an empty repository, which accepts the push
+        // as-is. Releases do not need a commit to hang from: the tag is
+        // created against whatever the release API is given.
+        auto_init: false,
       }),
     });
     if (made.status >= 400) {
@@ -617,6 +780,14 @@ async function ensureRepo(
       };
     }
     created = true;
+    // A repository created with no commits has no default branch, and the
+    // release API tags the default branch — so something has to land on it
+    // before the release is cut. Pushing the author's own history is the
+    // version that leaves a usable repository behind; seeding is the fallback
+    // for a pack that is not in a git checkout at all.
+    if (!(sourceDir && pushExistingHistory(sourceDir, owner, name, token))) {
+      await seedDefaultBranch(owner, name, id, token);
+    }
     info = await gh(`${GITHUB_API}/repos/${owner}/${name}`, token);
   }
   if (info.status >= 400) {
@@ -625,6 +796,102 @@ async function ensureRepo(
   return { info, created };
 }
 
+/**
+ * Push the checkout the policies live in to the repository just created for
+ * them, and report whether it landed.
+ *
+ * Why publish pushes at all: it created the repository, so it owns the one
+ * moment when pushing cannot conflict with anything. The repository used to be
+ * created with `auto_init`, which meant GitHub wrote an "Initial commit" the
+ * author did not have — so the `git push` that every publish is followed by was
+ * rejected as unrelated history, every time, for everybody. Seeding it and
+ * pushing it are the same job; doing only the first left the author to
+ * reconcile two histories by hand.
+ *
+ * It also makes the tag mean something. The release tags the default branch, so
+ * against a seeded repository `1.0.0` named a README commit that did not
+ * contain a single one of the policies it shipped.
+ *
+ * The token goes in through GIT_ASKPASS, never in the URL or the argv: a remote
+ * with a credential in it is written into `.git/config` in plaintext, and one on
+ * a command line is readable from `ps` by every user on the box.
+ */
+export const __pushExistingHistoryForTest = (
+  dir: string,
+  owner: string,
+  name: string,
+  token: string,
+): boolean => pushExistingHistory(dir, owner, name, token);
+
+function pushExistingHistory(dir: string, owner: string, name: string, token: string): boolean {
+  const git = (args: string[], env?: Record<string, string>): string | null => {
+    try {
+      return execFileSync("git", args, {
+        cwd: dir,
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "ignore"],
+        timeout: 60_000,
+        env: env ? { ...process.env, ...env } : process.env,
+      }).trim();
+    } catch {
+      return null;
+    }
+  };
+  const branch = git(["rev-parse", "--abbrev-ref", "HEAD"]);
+  // No commits yet (`HEAD` unborn) means there is nothing to push and nothing
+  // to conflict with later either.
+  if (!branch || branch === "HEAD" || !git(["rev-parse", "--verify", "HEAD"])) return false;
+
+  const askpass = join(mkdtempSync(join(tmpdir(), "fpai-askpass-")), "askpass.sh");
+  try {
+    writeFileSync(askpass, `#!/bin/sh\ncase "$1" in\n*Username*) echo x-access-token ;;\n*) echo "$FPAI_GH_TOKEN" ;;\nesac\n`, { mode: 0o700 });
+    const env = { GIT_ASKPASS: askpass, FPAI_GH_TOKEN: token, GIT_TERMINAL_PROMPT: "0" };
+    const url = `${GITHUB_GIT}/${owner}/${name}.git`;
+    // Name the remote FIRST when there is not one, so the push can be `-u` and
+    // leave the branch tracking it. Pushing to a bare URL and setting the
+    // upstream afterwards cannot work: `--set-upstream-to` needs a
+    // remote-tracking ref, and a URL push writes none.
+    const adopt = !git(["remote", "get-url", "origin"]);
+    if (adopt) git(["remote", "add", "origin", url]);
+    // An author who already has an `origin` keeps it, and the push goes to the
+    // URL directly rather than quietly redirecting their remote.
+    const pushed = adopt
+      ? git(["push", "-u", "origin", `${branch}:${branch}`], env)
+      : git(["push", url, `${branch}:${branch}`], env);
+    if (pushed === null) {
+      // Leave nothing behind that was not there before.
+      if (adopt) git(["remote", "remove", "origin"]);
+      return false;
+    }
+    return true;
+  } finally {
+    try {
+      rmSync(dirname(askpass), { recursive: true, force: true });
+    } catch {
+      /* a leftover temp dir is not worth failing a publish over */
+    }
+  }
+}
+
+/**
+ * The minimum that gives a repository a default branch: one commit, made
+ * through the API. Only for a pack published from somewhere that is not a git
+ * checkout — otherwise the author's own history does this job better.
+ */
+async function seedDefaultBranch(owner: string, name: string, id: string, token: string): Promise<void> {
+  await gh(`${GITHUB_API}/repos/${owner}/${name}/contents/README.md`, token, {
+    method: "PUT",
+    contentType: "application/json",
+    body: JSON.stringify({
+      message: `${id}: create pack repository`,
+      content: Buffer.from(
+        `# ${name}\n\nA [failproofai](https://github.com/failproofai/failproofai) policy pack.\n\n\`\`\`bash\nfailproofai policies add ${owner}/${name}\n\`\`\`\n`,
+        "utf8",
+      ).toString("base64"),
+    }),
+  });
+}
+
 /**
  * Where `bun` is, if it is anywhere.
  *
@@ -736,6 +1003,9 @@ function publishEntryArg(rest: string[]): string | undefined {
 
 const GITHUB_API = process.env.FAILPROOFAI_GITHUB_API ?? "https://api.github.com";
 const GITHUB_UPLOADS = process.env.FAILPROOFAI_GITHUB_UPLOADS ?? "https://uploads.github.com";
+/** Where the git remote lives, so the push path can be tested against a real
+ *  local bare repository rather than only reasoned about. */
+const GITHUB_GIT = process.env.FAILPROOFAI_GITHUB_GIT ?? "https://github.com";
 
 /**
  * The credential, from the places a developer already keeps one.
@@ -822,6 +1092,60 @@ function ghError(res: { status: number; json: Record<string, unknown> | null; te
  *   - a private repository, which publishes to nobody, because installs are
  *     anonymous HTTPS with no credential to offer.
  */
+/**
+ * The two things `publish` cannot work out on its own, asked instead of
+ * demanded as flags.
+ *
+ * Everything else it already derives: the policy files by content, the version
+ * by counting the repository's own releases, the id from the repository, the
+ * credential from the environment. What is left is genuinely a question —
+ * WHERE this should live, when the folder has no git remote naming somewhere —
+ * and a confirmation, because publishing is public and a version number can
+ * never be reused.
+ *
+ * Only ever on a TTY. A pipe, a CI job or a test gets the old behaviour: flags
+ * decide, and a missing `--repo` still means "build the assets and stop"
+ * rather than a prompt nobody can answer.
+ */
+async function askWhereToPublish(
+  suggestion: string,
+  io: { stdin: TTYIn; stdout: TTYOut },
+): Promise<string | null> {
+  const answer = await promptText({
+    // The suggestion goes in the HINT, not just in `defaultValue`: the hint is
+    // what renders as the placeholder, while `defaultValue` is only applied on
+    // an empty submit and is never shown. Passing it as the default alone left
+    // the one keystroke that finishes this prompt — return — invisible.
+    message: "Where should this publish?",
+    hint: `${suggestion}  ·  created if it does not exist`,
+    defaultValue: suggestion,
+    validate: (v) => {
+      const t = v.trim();
+      if (!/^[A-Za-z0-9][\w.-]*\/[A-Za-z0-9][\w.-]*$/.test(t)) return "owner/repo";
+      return null;
+    },
+    stdin: io.stdin,
+    stdout: io.stdout,
+  });
+  return answer === null ? null : answer.trim();
+}
+
+/**
+ * The account the credential belongs to, for the default answer above.
+ *
+ * Best-effort: a failure here costs a nicer default and nothing else, so it
+ * never blocks or reports. The prompt still has the folder name to fall back
+ * on, which is what the repository would most likely be called anyway.
+ */
+async function credentialLogin(token: string): Promise<string | null> {
+  try {
+    const me = await gh(`${GITHUB_API}/user`, token);
+    return typeof me.json?.login === "string" ? me.json.login : null;
+  } catch {
+    return null;
+  }
+}
+
 async function publish(rest: string[]): Promise<PackCliResult> {
   const flag = (name: string): string | undefined => {
     const i = rest.findIndex((a) => a === `--${name}` || a.startsWith(`--${name}=`));
@@ -838,7 +1162,32 @@ async function publish(rest: string[]): Promise<PackCliResult> {
   // it is that file and only that file.
   const discovered = entry ? [] : findEntry(process.cwd());
   if (!entry && discovered.length > 0) entry = discovered[0];
-  const repo = flag("repo") ?? (entry ? inferRepo(entry) : null) ?? undefined;
+  let repo = flag("repo") ?? (entry ? inferRepo(entry) : null) ?? undefined;
+  // Nothing names a destination and there is somebody to ask. This is the
+  // whole of "just run `failproofai publish`": the folder is a git repo full
+  // of policies, and the one thing it cannot know is where they should go.
+  const interactive = Boolean(process.stdin.isTTY && process.stdout.isTTY);
+  const askingWhere = interactive && !repo && entry && !rest.includes("--dry-run");
+  if (askingWhere) {
+    // What is about to be published, before being asked where to put it. The
+    // question is answerable without it — but "publish" with no arguments
+    // otherwise gives no sign of WHICH files it found, and finding the wrong
+    // ones is the mistake that matters here.
+    const found = discovered.length > 0 ? discovered : [entry!];
+    process.stdout.write(
+      `\n  ${found.length} policy ${found.length === 1 ? "file" : "files"}: ` +
+        `${found.map((f) => basename(f)).join(", ")}\n\n`,
+    );
+    const token = githubToken();
+    const login = token ? await credentialLogin(token) : null;
+    const folder = basename(resolve(entry!, ".."));
+    const answered = await askWhereToPublish(
+      `${login ?? "your-account"}/${folder}`,
+      { stdin: process.stdin as unknown as TTYIn, stdout: process.stdout as unknown as TTYOut },
+    );
+    if (answered === null) return ok(["Nothing was published."]);
+    repo = answered;
+  }
   // A tag on HEAD is somebody SAYING what this release is, so it wins over a
   // counted one. Everything else is decided after the repository is known,
   // because the count comes from what that repository has already published.
@@ -846,8 +1195,19 @@ async function publish(rest: string[]): Promise<PackCliResult> {
   let versionCounted = false;
   // The id and the repo are usually the same words, and requiring both is asking
   // the same question twice. Either one alone answers for the other.
-  const id = flag("id") ?? repo;
   const dryRun = rest.includes("--dry-run") || !repo;
+  // A dry run publishes nothing, so the id only has to name the artifact it
+  // writes — and refusing to build one because the folder has no git remote
+  // yet blocked the exact thing a dry run is for: looking at the pack BEFORE
+  // committing to a repository for it. The folder name is what the repository
+  // would be called anyway, and `--id` or `--repo` overrides it the moment
+  // either is known.
+  //
+  // `local/` rather than a guessed account: the owner is genuinely not known
+  // yet, and a plausible-looking one would be baked into a manifest somebody
+  // could upload by hand.
+  const id =
+    flag("id") ?? repo ?? (dryRun && entry ? `local/${basename(resolve(entry, ".."))}` : undefined);
   const [owner, name] = (repo ?? "/").split("/");
   if (repo && (!owner || !name || repo.split("/").length !== 2)) {
     return fail([`--repo must be <owner>/<repo>, got ${JSON.stringify(repo)}`]);
@@ -899,7 +1259,7 @@ async function publish(rest: string[]): Promise<PackCliResult> {
         "It needs write access to releases on that repository, and nothing else.",
       ]);
     }
-      const ensured = await ensureRepo(owner, name, id, token);
+      const ensured = await ensureRepo(owner, name, id, token, resolve(entry, ".."));
     if ("error" in ensured) return fail(ensured.error);
     created = ensured.created;
     repoInfo = ensured.info;
@@ -953,7 +1313,13 @@ async function publish(rest: string[]): Promise<PackCliResult> {
         ? ["Dry run — nothing was published.", `Drop --dry-run to release it on ${repo}.`]
         : [
             "Nothing was published: name a repository to release it on.",
-            `  failproofai publish ${entry} --repo <owner>/<repo> --version ${version}`,
+            // Just the repository. It used to spell out the entry file and the
+            // version too — naming ONE of the files it had that moment finished
+            // bundling, and pinning a version it works out by counting the
+            // repository's own releases. Both were wrong the moment they were
+            // printed, and both taught the reader that publishing needs flags
+            // it does not need.
+            "  failproofai publish --repo <owner>/<repo>",
           ]),
     ]);
   }
@@ -1157,18 +1523,19 @@ async function pickFromSource(
 async function add(rest: string[]): Promise<PackCliResult> {
   const source = packAddSource(rest);
   const selection = selectionFrom(rest);
-
-  // Our own pack, by the short name. `core` is a SPELLING of a GitHub source,
-  // not a second delivery path: it resolves to CORE_SOURCE and is fetched,
-  // verified and pinned exactly like anybody else's.
-  //
-  // The package used to carry a copy so this worked with no network. It no
-  // longer does, on purpose. A pack that ships inside the binary is a policy set
-  // we picked for you and wrote to your disk before you asked for it, and it
-  // gave our own policies a route no third-party pack could use — which is the
-  // opposite of the thing this whole lane exists to make possible.
-  const resolvedSource =
-    source && CORE_ALIASES.has(source.toLowerCase()) ? CORE_SOURCE : source;
+  // Refused before anything is fetched or written: a pack scoped to an agent
+  // that does not exist enforces on nothing, and saying so afterwards is no use
+  // to the script that already read exit 0 and moved on.
+  if (selection.error) return fail(selection.error);
+
+  // No short name for our own pack any more. `core` resolved to CORE_SOURCE and
+  // was fetched, verified and pinned like anybody else's — but a spelling only
+  // WE get to use still made our policies read as part of the tool rather than
+  // as one pack among others, which is the distinction this lane exists to
+  // erase. Ours is typed the same way yours is: `FailproofAI/policies`.
+  // `parsePackSource` still recognises the retired spellings, so typing one
+  // gets told what to type instead.
+  const resolvedSource = source;
 
   if (!resolvedSource) {
     return fail(["Usage: failproofai policies add <source> [--policy a,b] [--category x,y] [--all]"]);

package/src/hooks/pack-store.ts

@@ -91,6 +91,15 @@ function baseUrl(): string {
 const OWNER_RE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/;
 const TAG_RE = /^[A-Za-z0-9][A-Za-z0-9._/-]{0,127}$/;
 
+export const CORE_SOURCE = "FailproofAI/policies";
+
+/**
+ * Spellings that USED to resolve to our own pack, kept only so typing one gets
+ * an answer rather than a parse error. They are not resolved any more — see the
+ * throw in `parsePackSource`.
+ */
+export const RETIRED_CORE_ALIASES = new Set(["core", "failproofai", "official"]);
+
 /**
  * Parse a pack source into owner, repo and an optional tag.
  *
@@ -136,6 +145,17 @@ export function parsePackSpec(source: string): PackSpec {
   const tag = at > 0 ? withoutScheme.slice(at + 1) : null;
   const slash = repoPart.indexOf("/");
   if (slash <= 0 || slash === repoPart.length - 1) {
+    // `core` / `failproofai` / `official` used to be spellings of our own pack.
+    // They are gone on purpose: a short name only WE get to use makes our
+    // policies look like part of the tool rather than a pack like any other,
+    // which is exactly the distinction this whole surface exists to remove.
+    // Named explicitly here so the spelling that used to work says what to type
+    // instead of failing as an unparseable source.
+    if (RETIRED_CORE_ALIASES.has(repoPart.trim().toLowerCase())) {
+      throw new Error(
+        `${JSON.stringify(source)} is no longer a pack name — ours is a pack like anyone else's now. Use ${CORE_SOURCE} instead.`,
+      );
+    }
     throw new Error(
       `pack source must be owner/repo, owner/repo@tag, or a github.com URL — got ${JSON.stringify(source)}`,
     );
@@ -325,8 +345,6 @@ interface FetchedPack {
  * gives our own policies a delivery path nobody else's pack can use. One lane,
  * the same for everyone — ours are just the pack whose short name we spell.
  */
-export const CORE_SOURCE = "FailproofAI/policies";
-export const CORE_ALIASES = new Set(["core", "failproofai", "official"]);
 
 export interface PackAddOptions {
   only?: string[];
@@ -358,12 +376,7 @@ export async function addPackFromSource(
   source: string,
   opts: PackAddOptions = {},
 ): Promise<AddedPack> {
-  // `core` is a spelling of CORE_SOURCE, not a second delivery path. Resolved
-  // HERE rather than in the CLI so the dashboard and the CLI cannot disagree
-  // about what the short name means — they did once, and a name the CLI could
-  // resolve failed in the browser.
-  const resolved = CORE_ALIASES.has(source.trim().toLowerCase()) ? CORE_SOURCE : source;
-  const result = await addPack(resolved, opts);
+  const result = await addPack(source, opts);
   return {
     id: result.id,
     version: result.version,