failproofai 1.0.2-beta.5 → 1.0.2-beta.7

package/dist/worker.mjs

@@ -2559,7 +2559,7 @@ var init_builtin_policies = __esm(() => {
 });
 
 // package.json
-var version = "1.0.2-beta.5";
+var version = "1.0.2-beta.7";
 var init_package = () => {};
 
 // src/posthog-key.ts
@@ -9408,7 +9408,7 @@ async function evaluateHookEvent(eventType, cli = "claude", stdinPayload, opts)
       const legacyNames = activePause || packsInstalledHere ? [] : config.enabledPolicies;
       registerBuiltinPolicies(activePause ? [] : legacyNames);
       if (legacyNames.length > 0) {
-        hookLogWarn(`enforcing ${legacyNames.length} policies from this build because no pack is installed — ` + `run \`failproofai policies add core\` to move them into a real pack`);
+        hookLogWarn(`enforcing ${legacyNames.length} policies from this build because no pack is installed — ` + `run \`failproofai policies add FailproofAI/policies\` to move them into a real pack`);
       }
       const enabledBuiltinNames = new Set(legacyNames);
       let cloudManagedPolicies = [];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "failproofai",
-  "version": "1.0.2-beta.5",
+  "version": "1.0.2-beta.7",
   "description": "Observability and enforcement for AI agent harnesses. 39 built-in policies hooked into 12 of them — Claude Code, Codex, Cursor, Hermes, OpenClaw and more — blocking the tool call before it runs. Local dashboard included, no account needed.",
   "bin": {
     "failproofai": "./dist/cli.mjs",
@@ -120,15 +120,15 @@
     "sharp": "0.35.0"
   },
   "optionalDependencies": {
-    "@failproofai/failproofaid-linux-x64": "1.0.2-beta.5",
-    "@failproofai/failproofaid-linux-arm64": "1.0.2-beta.5",
-    "@failproofai/failproofaid-darwin-x64": "1.0.2-beta.5",
-    "@failproofai/failproofaid-darwin-arm64": "1.0.2-beta.5"
+    "@failproofai/failproofaid-linux-x64": "1.0.2-beta.7",
+    "@failproofai/failproofaid-linux-arm64": "1.0.2-beta.7",
+    "@failproofai/failproofaid-darwin-x64": "1.0.2-beta.7",
+    "@failproofai/failproofaid-darwin-arm64": "1.0.2-beta.7"
   },
   "failproofaidBinaries": {
-    "linux-x64": "e19a1cf9a254df830f205fac024b8a229c162c93ae73851b985d2794e09da035",
-    "linux-arm64": "fafcff01e4cce00809b5cd9ff2822705d7373acbab79444e0384cb058b6da921",
-    "darwin-x64": "d7bd609387e13f5e75287674d948c69d739bac8d6963aa731b93111d1bdd2ea2",
-    "darwin-arm64": "9a57c8eb0f23ed25328e0f7b06638a6ab7f51e1deebf479bac2c779bf9912941"
+    "linux-x64": "75a8e231e057986f2b357e1fcb596641afd82a4b58f9271bb4b342951a364c2d",
+    "linux-arm64": "47d2933d06e70faefa78fe06fdd4e06bc03e94a319d13a8837145d192cd84d8c",
+    "darwin-x64": "6eae79c75746efe6922ca84e7dd899d01a50e651879abc8f90de69cd51c403f3",
+    "darwin-arm64": "ddca616decc3d2415ce6a58ae5fe15786bd2cfa5a5319803f4207a01d40e4a0a"
   }
 }

package/src/audit/cli.ts

@@ -25,6 +25,8 @@
  * an exit code. See `runScheduledAudit`.
  */
 import { runAudit } from "./index";
+import { hasInstalledPacks } from "../hooks/pack-manifest";
+import { CORE_SOURCE } from "../hooks/pack-store";
 import { acquireAuditLock, type AuditLockInfo } from "./audit-lock";
 import { writeDashboardCache } from "./dashboard-cache";
 import type { AuditResult, RunAuditOptions } from "./types";
@@ -33,7 +35,8 @@ import { getInstanceId } from "../../lib/telemetry-id";
 import { sanitizeErrorMessage } from "../../lib/telemetry-sanitize";
 import { openWhenReady } from "./open-browser";
 import { describeOutcome, reportHarm } from "./report-harm";
-import { brandAnsi, ANSI_RESET, ANSI_BOLD, ANSI_DIM } from "../hooks/tui";
+import { brandAnsi, ANSI_RESET, ANSI_BOLD, ANSI_DIM, helpScreen, helpOptsFor } from "../hooks/tui";
+import { version } from "../../package.json";
 
 /** Port the bundled dashboard binds to. Matches `scripts/launch.ts`'s default
  *  for `start` mode, which `failproofai` (bare) already uses. */
@@ -62,9 +65,6 @@ export const AUDIT_STAGES: ReadonlyArray<{ label: string; detail: string }> = [
   { label: "aggregating results", detail: "counting hits, ranking by frequency" },
 ];
 
-/** Column the description text starts at. The widest command line is 37 wide. */
-const HELP_DESC_COL = 40;
-
 /**
  * `audit --help`.
  *
@@ -80,41 +80,44 @@ const HELP_DESC_COL = 40;
  * one. It still works, and still refuses every argument it always refused.
  */
 export function helpText(): string {
-  const row = (command: string, lines: string[]): string => {
-    // Padding is measured on the RAW command — `c()` adds escape bytes that
-    // occupy no columns, so colouring first would misalign every row.
-    const pad = " ".repeat(Math.max(1, HELP_DESC_COL - 2 - command.length));
-    return lines
-      .map((line, i) =>
-        i === 0 ? `  ${c(CYAN, command)}${pad}${line}` : `${" ".repeat(HELP_DESC_COL)}${line}`,
-      )
-      .join("\n");
-  };
-
-  return [
-    `${c(BOLD, "failproofai audit")} — review your agent CLIs for risky and wasteful patterns.`,
-    c(DIM, "Everything runs on this machine; only a scheduled digest ever leaves it."),
-    "",
-    c(BOLD, "USAGE"),
-    row("failproofai audit", [
-      "Scan your session history, then open",
-      `http://localhost:${DASHBOARD_PORT}/audit`,
-    ]),
-    row("failproofai audit --schedule [days]", [
-      "Scan on a timer and email the findings.",
-      "Default 7 days, range 1-90.",
-      "Signs you in the first time; add",
-      "--email <address> to skip a prompt.",
-    ]),
-    row("failproofai audit --no-schedule", ["Stop the timer. Leaves you signed in."]),
-    row("failproofai audit --status", [
-      "Whether scheduling is on, where reports",
-      "go, the daemon's state, and when the",
-      "next scan is due.",
-    ]),
-    row("failproofai audit -h, --help", ["Show this help."]),
-    "",
-  ].join("\n");
+  // Drawn by the same renderer as `config --help` and `policies --help`, from
+  // the same kit `audit`'s output already uses for its palette. It used to
+  // build its own rows against a hand-set HELP_DESC_COL, which is how `audit`
+  // and `config` ended up with their descriptions in different columns.
+  //
+  // The `failproofai audit` prefix is dropped from the rows: the heading two
+  // lines above already carries it, and repeating it cost 17 of the 80 columns
+  // on every row — which is what forced the four-word-per-line descriptions.
+  const lines = helpScreen(
+    {
+      command: "audit",
+      version,
+      tagline: "review your agent CLIs for risky and wasteful patterns",
+      sections: [
+        {
+          label: "usage",
+          entries: [
+            ["(bare)", `Scan your session history, then open http://localhost:${DASHBOARD_PORT}/audit`],
+            ["--schedule [days]", "Scan on a timer and email the findings. Default 7 days, range 1-90. Signs you in the first time."],
+            // Its own row now, rather than a clause inside --schedule's. It
+            // does not stand alone, which is why it used to be a clause — but
+            // a clause wraps, and `--email <address>` landing with the flag at
+            // the end of one line and its placeholder at the start of the next
+            // is not a flag anybody can read or copy.
+            ["--email <address>", "With --schedule, skips the sign-in prompt."],
+            ["--no-schedule", "Stop the timer. Leaves you signed in."],
+            ["--status", "Whether scheduling is on, where reports go, the daemon's state, and when the next scan is due."],
+            ["-h, --help", "Show this help."],
+          ],
+        },
+      ],
+      footer: ["Everything runs on this machine; only a scheduled digest ever leaves it."],
+    },
+    helpOptsFor(process.stdout),
+  );
+  // The margins `printBlock` would add, spelled out because this one returns
+  // its text for a caller to write rather than writing it.
+  return ["", ...lines, ""].join("\n") + "\n";
 }
 
 // ── ANSI helpers ────────────────────────────────────────────────────────────
@@ -504,6 +507,16 @@ export async function runPostSetupAudit(): Promise<void> {
     writeDashboardCache({}, result);
     printSummary(result);
     process.stdout.write("\n");
+    // The audit says what ALREADY happened; nothing here says how to stop it
+    // happening again. This is the first thing a new machine runs, and setup
+    // installs no policies by design, so without this the whole first session
+    // ends on a count of findings and no way to act on it.
+    if (!hasInstalledPacks()) {
+      process.stdout.write(
+        `  ${c(DIM, "none of this is being enforced yet. take ours, or anyone's:")}\n` +
+          `    ${c(CYAN, `failproofai policies add ${CORE_SOURCE}`)}\n\n`,
+      );
+    }
   } finally {
     attempt.lock.release();
   }

package/src/audit/index.ts

@@ -10,6 +10,7 @@
 import { batchAll } from "../../lib/concurrency";
 import { BUILTIN_POLICIES } from "../hooks/builtin-policies";
 import { readMergedHooksConfig } from "../hooks/hooks-config";
+import { readInstalledPacks } from "../hooks/pack-manifest";
 import { normalizePolicyName } from "../hooks/policy-registry";
 import { INTEGRATION_TYPES, type IntegrationType } from "../hooks/types";
 import { ADAPTERS } from "./cli-adapters";
@@ -379,12 +380,42 @@ async function runAuditInner(opts: RunAuditOptions, startedAt: number): Promise<
   const clis = (opts.clis ?? Array.from(INTEGRATION_TYPES)) as IntegrationType[];
   const sinceMs = parseSinceOpt(opts.since);
 
-  // Snapshot which builtin policies the user currently has enabled — drives
-  // the "already protected" vs "slipping through" split in the report.
+  // What the user actually has switched on — drives the "already protected"
+  // vs "slipping through" split.
+  //
+  // Read from BOTH places it can live, because it moved and this only followed
+  // it half way. `enabledPolicies` is the pre-packs key, still written by
+  // `policies add <name>` and still true on a machine running the migration
+  // shim. Everything installed as a PACK records its selection in
+  // `installed.json` instead, and `pack-store` never writes `enabledPolicies`
+  // at all — so reading that key alone meant installing a pack could not move
+  // this split. Every policy read as slipping through no matter what was
+  // enforcing, and the number the audit leads with never changed however many
+  // policies you installed. Verified: same 302 hits, same 17 findings, before
+  // and after installing all 38.
+  //
+  // The split, not the REPLAY. What gets replayed stays the compiled builtins
+  // on purpose — see `initReplay`: an audit is a fixed yardstick, and one that
+  // changed shape with whatever pack a machine happened to have could not be
+  // compared against its own history. A pack policy sharing a builtin's name
+  // marks that builtin protected, which is exactly right: the same rule is
+  // enforcing, whichever artifact carries it.
   const userConfig = readMergedHooksConfig();
   const enabledBuiltins = new Set(
     (userConfig.enabledPolicies ?? []).map((n) => normalizePolicyName(n)),
   );
+  try {
+    for (const pack of readInstalledPacks().packs) {
+      // `enabled: null` means the whole pack was taken, so every policy in its
+      // catalog counts — the field records a SELECTION, and its absence is not
+      // an empty one.
+      const taken = pack.enabled ?? pack.policies.map((entry) => entry.name);
+      for (const name of taken) enabledBuiltins.add(normalizePolicyName(name));
+    }
+  } catch {
+    // An unreadable manifest must not fail the audit. It costs the split its
+    // pack half, which is the same answer this gave for every machine before.
+  }
 
   // 1. Discover transcripts across all selected CLIs.
   const allTranscripts: TranscriptMetadata[] = [];

package/src/hooks/backfill-cli.ts

@@ -149,7 +149,7 @@ export function runBackfillCommand(opts: BackfillOptions = {}): BackfillResult {
       exitCode: 1,
       lines: [
         "This machine is not connected, so there is nowhere to send history.",
-        "Connect first: `failproofai config --connect <url> --token <key>`.",
+        "Connect first: `failproofai config --token <key>`.",
       ],
     };
   }

package/src/hooks/configure-wizard.ts

@@ -30,6 +30,8 @@ import { existsSync, mkdirSync, writeFileSync, readFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { dirname, resolve, sep } from "node:path";
 
+import { CORE_SOURCE } from "./pack-store";
+
 import {
   selectOne,
   promptText,
@@ -109,6 +111,31 @@ export interface WizardIO {
   stdout?: TTYOut;
 }
 
+/**
+ * Answers supplied up front, so the run needs nobody at the keyboard.
+ *
+ * This is the whole of headless setup, and it is small for a reason nobody
+ * planned: the wizard stopped DECIDING most of what it used to. Scope, agents,
+ * policies and the custom-policy toggle are all hardcoded now (see the
+ * constants further down), so there is no decision surface left to expose —
+ * only the three questions that remain, and each has one sensible unattended
+ * answer.
+ *
+ * None of this skips sudo. Installing a system service needs root and nothing
+ * here changes that: elevation goes through `sudo -n`, which never prompts, and
+ * a machine that cannot elevate is told exactly what to run as root.
+ */
+export interface WizardAnswers {
+  /** Cloud API key. Its presence IS the request to connect. */
+  token?: string;
+  /** Where to connect. Defaults to the same URL the wizard infers. */
+  url?: string;
+  machineId?: string;
+  machineLabel?: string;
+  /** Record decisions only, no session transcripts. */
+  noTranscripts?: boolean;
+}
+
 /**
  * Why a wizard run ended without applying. Distinguished so the caller can
  * pick an exit code — a user who pressed Esc did nothing wrong (exit 0), a
@@ -120,8 +147,9 @@ export type WizardAbort =
   | "needs_root"
   | "daemon_failed"
   | "unsupported_platform"
-  | "not_a_tty"
-  | "running_as_sudo";
+  | "running_as_sudo"
+  /** A cloud key was supplied and the server refused it. Unattended only. */
+  | "cloud_unverified";
 
 export interface WizardResult {
   applied: boolean;
@@ -695,19 +723,37 @@ export async function maybeFirstRunConfigure(
 
 // ── The wizard ───────────────────────────────────────────────────────────────
 
-export async function runConfigureWizard(io: WizardIO = {}): Promise<WizardResult> {
+export async function runConfigureWizard(
+  io: WizardIO = {},
+  answers: WizardAnswers = {},
+): Promise<WizardResult> {
   const stdin: TTYIn = io.stdin ?? process.stdin;
   const stdout: TTYOut = io.stdout ?? process.stdout;
   const cwd = process.cwd();
+  // No terminal means no questions — not a refusal.
+  //
+  // `failproofai config` IS the authorisation: somebody typed the command whose
+  // entire job is to configure this machine. Requiring a flag on top of that to
+  // permit what the command already means is asking the same question twice,
+  // and this used to refuse outright — so a CI job, a container or an agent
+  // could not set a machine up at all, which is the gap this closes.
+  //
+  // Safe to do here because the IMPLICIT path is guarded separately:
+  // `maybeFirstRunConfigure` has its own TTY check and returns before ever
+  // reaching this function, so setup never runs off the back of some other
+  // command on a headless box.
+  const unattended = !stdin.isTTY || !stdout.isTTY;
+  // A key on the command line settles the whole run, not just the question it
+  // literally answers.
+  //
+  // Somebody typing `failproofai config --token <key>` has said: set this
+  // machine up, connect it, send its data. There is nothing left to confirm —
+  // so asking "Connect to Cloud?", then the key, then "Ready to apply?" made
+  // the flag look like it had not been read. The only thing still worth
+  // stopping for is the sudo password, which is a CREDENTIAL rather than a
+  // question, and no flag can supply it.
+  const preAnswered = Boolean(answers.token);
 
-  if (!stdin.isTTY || !stdout.isTTY) {
-    stdout.write(
-      "failproofai config needs an interactive terminal.\n" +
-        "Use the flag form instead, e.g.:\n" +
-        "  failproofai policies --install --scope user --cli claude\n",
-    );
-    return { applied: false };
-  }
 
   // Running the wizard itself under sudo configures the WRONG ACCOUNT, and
   // does it silently: homedir() becomes /root, so the hooks land in root's
@@ -724,7 +770,10 @@ export async function runConfigureWizard(io: WizardIO = {}): Promise<WizardResul
         "The one step that needs root (installing the service) asks for your password\n" +
         "on its own.\n",
     );
-    return { applied: false };
+    // Same reason as above: this configured nothing, and it is not a
+    // cancellation. `running_as_sudo` has been in `WizardAbort` since it was
+    // written and was never once assigned.
+    return { applied: false, abort: "running_as_sudo" };
   }
 
   // Fire-and-forget: never block the wizard's first paint on telemetry.
@@ -847,7 +896,13 @@ export async function runConfigureWizard(io: WizardIO = {}): Promise<WizardResul
         ? "failproofaid can't evaluate — every tool call is denied. Rebuilding needs sudo.\n\n"
         : "Installing failproofaid — needs sudo once.\n\n",
     );
-    if (!primeElevation()) {
+    // `primeElevation` runs `sudo -v`, which PROMPTS. An unattended run has
+    // nobody to type a password, so it goes straight to the `sudo -n` that
+    // `runPrivileged` uses anyway — exactly what `failproofai update` already
+    // does — and a machine that cannot elevate gets the commands below instead
+    // of a hung terminal. This is the same answer for both: sudo cannot be
+    // conjured away, only asked for at a moment somebody can answer.
+    if (!(unattended ? canElevate() : primeElevation())) {
       // Required means required: write nothing at all, so a machine that could
       // not be set up is left exactly as it was found rather than carrying
       // half a configuration. The commands are printed so an admin can do the
@@ -866,7 +921,7 @@ export async function runConfigureWizard(io: WizardIO = {}): Promise<WizardResul
       "failproofaid is running, but from a service definition written by an older\n" +
         "version — it cannot start a scheduled audit. Refreshing it needs root once.\n\n",
     );
-    if (!primeElevation()) {
+    if (!(unattended ? canElevate() : primeElevation())) {
       // NOT an abort, unlike the install branch above. There is a working
       // daemon here and hooks are enforcing; only the scheduled audit is out
       // of reach. Stopping setup over that would make an upgrade the thing
@@ -914,7 +969,7 @@ export async function runConfigureWizard(io: WizardIO = {}): Promise<WizardResul
   //
   // Setup no longer asks which policies to enable, and that is deliberate.
   // failproofai ships no policies of its own any more: they arrive as packs —
-  // from inside this package (`pack add core`) or from anyone's GitHub release.
+  // from inside this package (`policies add FailproofAI/policies`) or from anyone's GitHub release.
   // A wizard that pre-ticks OUR list makes a product decision on behalf of
   // somebody who has not seen the list yet, and not everyone wants the set we
   // would have chosen. So setup wires the hooks, and choosing what they
@@ -971,7 +1026,19 @@ export async function runConfigureWizard(io: WizardIO = {}): Promise<WizardResul
   let connect: { url: string; token: string; machineId: string; machineLabel: string } | null = null;
 
   {
-    const choice = await selectOne<"key" | "local">({
+    // Supplying a key IS asking to connect — there is no other reason to pass
+    // one — so an unattended run with a token skips straight past the question,
+    // and one without a token stays local, which is the same "Not now" branch a
+    // person picks. Neither needs a separate flag to say so.
+    const choice = answers.token
+      // A key on the command line IS the answer to this question. Gating it on
+      // there being no terminal was wrong: `--token` means "use this key", not
+      // "use this key only if nobody is watching", and a run that asked anyway
+      // made the flag look broken to the person who had just typed it.
+      ? "key"
+      : unattended
+        ? "local"
+        : await selectOne<"key" | "local">({
       message: "Connect this machine to FailproofAI Cloud?",
       // The hint says what you GET; the body says what LEAVES.
       //
@@ -1054,7 +1121,16 @@ export async function runConfigureWizard(io: WizardIO = {}): Promise<WizardResul
       let machineId = resolveMachineId();
       let machineLabel = existing?.machineLabel ?? resolveMachineLabel();
 
-      if (existing) {
+      if (existing && unattended && !answers.url) {
+        // Already enrolled, and this run did not name a different place to
+        // enrol. Reusing is what the person picks here too, and re-verifying a
+        // working credential is the one thing an unattended re-run must not
+        // turn into a failure.
+        url = existing.url;
+        token = answers.token ?? existing.token;
+        machineId = answers.machineId ?? existing.machineId;
+        machineLabel = answers.machineLabel ?? existing.machineLabel ?? machineLabel;
+      } else if (existing && !unattended) {
         const reuse = await selectOne<"reuse" | "other">({
           message: `Use this machine's existing connection to ${existing.url}?`,
           choices: [
@@ -1126,6 +1202,10 @@ export async function runConfigureWizard(io: WizardIO = {}): Promise<WizardResul
         }
       }
 
+      // Supplied on the command line, so nothing is asked and nothing is
+      // echoed — terminal or not. Prompting for a value the caller already gave
+      // is the failure this whole flag exists to avoid.
+      if (token === null) token = answers.token ?? null;
       if (token === null) {
         token = await promptText({
           // The destination is in the question now that it is no longer a
@@ -1149,6 +1229,14 @@ export async function runConfigureWizard(io: WizardIO = {}): Promise<WizardResul
       // persisted here.
       stdout.write("\nChecking the key… ");
       const probe = await validateIngestKey({ url: ingestUrlFor(url), key: token });
+      if (!probe.ok && unattended) {
+        // A key that does not work is a FAILED setup, not a prompt. The
+        // interactive path offers "save it anyway" because a person can weigh
+        // an outage against their own impatience; a script cannot, and one that
+        // exited 0 here would leave a fleet believing it was reporting.
+        stdout.write(`\nThat key did not work: ${probe.reason}\n`);
+        return { applied: false, abort: "cloud_unverified" };
+      }
       if (!probe.ok) {
         stdout.write(`\nThat did not work: ${probe.reason}\n`);
         const retry = await selectOne<"skip" | "anyway">({
@@ -1173,7 +1261,15 @@ export async function runConfigureWizard(io: WizardIO = {}): Promise<WizardResul
     }
   }
   // 5 — Review & apply
-  const decision = await selectOne<"apply" | "cancel">({
+  //
+  // The last question, and the only one a headless run skips outright rather
+  // than answering from a flag. There is nothing to confirm when nobody is
+  // watching, and the command itself was the confirmation.
+  //
+  // NOT the same call as `uninstall`, which does require --yes: that one
+  // REMOVES things, so silence there would destroy on a signal as weak as a
+  // missing terminal. This one does exactly what its name says.
+  const decision = unattended || preAnswered ? "apply" : await selectOne<"apply" | "cancel">({
     message: "Ready to apply?",
     body: reviewLines({
       target,
@@ -1463,6 +1559,18 @@ export async function runConfigureWizard(io: WizardIO = {}): Promise<WizardResul
     { ok: true },
     stdout,
   );
+  // Setup wires the hooks and deliberately chooses NO policies, so a machine
+  // that has just finished it enforces almost nothing — and the summary line
+  // says "0 policies" without saying what to do about it. Anyone else's pack is
+  // typed the same way, which is the point: ours is named in full rather than
+  // by a short name only we could use.
+  if (policies.length === 0) {
+    stdout.write(
+      `\n  Nothing is enforcing yet. Take ours, or anyone's:\n` +
+        `    failproofai policies add ${CORE_SOURCE}\n` +
+        `    failproofai policies show <owner>/<repo>   (look first)\n\n`,
+    );
+  }
   return {
     applied: true,
     target,

package/src/hooks/fp-reset.ts

@@ -973,7 +973,7 @@ export function resetHome(from: number, to: number = LAYOUT_VERSION): ResetOutco
   //
   // Nothing needs carrying either: `enabledPolicies` is left exactly where it
   // is, and the no-pack fallback reads it, so a machine mid-upgrade keeps
-  // enforcing precisely what it enforced before. `failproofai policies add core`
+  // enforcing precisely what it enforced before. `failproofai policies add FailproofAI/policies`
   // turns those names into a real pack, carrying the same selection into it.
   // The step's OWN target, not LAYOUT_VERSION.
   //

package/src/hooks/handler.ts

@@ -323,7 +323,7 @@ export async function evaluateHookEvent(
       if (legacyNames.length > 0) {
         hookLogWarn(
           `enforcing ${legacyNames.length} policies from this build because no pack is installed — ` +
-            `run \`failproofai policies add core\` to move them into a real pack`,
+            `run \`failproofai policies add FailproofAI/policies\` to move them into a real pack`,
         );
       }
       // What actually registered, for the pack-duplicate check below. A paused
@@ -786,6 +786,18 @@ export async function handleHookEvent(eventType: string, cli: IntegrationType =
       error_type: "oversized",
     });
   }
+  if (stdinRead.timedOut) {
+    // Reported distinctly from a read error because the remedy is different and
+    // the cause is upstream: the agent spawned the hook and did not close its
+    // stdin. Before this was bounded it was not reported at all — the process
+    // simply never returned, and the tool call it was gating never resolved.
+    hookLogWarn(`stdin never closed for ${eventType}; evaluated nothing`);
+    void trackHookEvent(getInstanceId(), "hook_stdin_error", {
+      event_type: eventType,
+      cli,
+      error_type: "timeout",
+    });
+  }
 
   const result = await evaluateHookEvent(eventType, cli, stdinRead.payload);
 

package/src/hooks/manager.ts

@@ -15,7 +15,6 @@ import { INTEGRATION_TYPES,
   type IntegrationType,
 } from "./types";
 import { claudeCode, getIntegration, settingsPathsFor, type Integration } from "./integrations";
-import { promptPolicySelection } from "./install-prompt";
 import { configuredCustomPolicyPaths, readMergedHooksConfig, readScopedHooksConfig, writeScopedHooksConfig, syncConventionPolicies, findProjectConfigDir } from "./hooks-config";
 import type { HooksConfig, ConventionPolicyRecord } from "./policy-types";
 import { BUILTIN_POLICIES } from "./builtin-policies";
@@ -462,9 +461,25 @@ async function installHooksImpl(
       ? [...new Set(incoming)]
       : [...new Set([...previousConfig.enabledPolicies, ...incoming])];
   } else {
-    // Interactive — pre-load current config if it exists
-    const preSelected = previousConfig.enabledPolicies.length > 0 ? previousConfig.enabledPolicies : undefined;
-    selectedPolicies = await promptPolicySelection(preSelected, { includeBeta });
+    // NOT a policy picker. `--install` wires hooks; choosing what they enforce
+    // is `policies add` / `policies remove`.
+    //
+    // It used to open a second picker here, over `BUILTIN_POLICIES` — the
+    // COMPILED catalog, which is no longer how policies arrive. So it offered a
+    // list that did not match what was installed, in an older prompt engine
+    // that looks nothing like the rest, and wrote its answer to
+    // `enabledPolicies` while every pack records its selection in
+    // `installed.json`.
+    //
+    // Two independent enabled-sets, and this one silently overwrote the other:
+    // `policies remove block-env-files` followed by `policies --install` put
+    // block-env-files straight back on, because the picker pre-ticked from the
+    // legacy key and saved all of it again. A command whose job is wiring must
+    // not undo a policy decision made somewhere else.
+    //
+    // Whatever was enabled stays enabled. Explicit names still work
+    // (`--install block-sudo`) for the migration shim, which has only this key.
+    selectedPolicies = previousConfig.enabledPolicies;
   }
 
   // Preserve existing config fields when updating. New writes use the plural
@@ -556,7 +571,21 @@ async function installHooksImpl(
   // pack does not carry it and asking for it by name is a selection the pack
   // cannot satisfy. It ships compiled in and registers regardless.
   const alwaysOnNames = new Set(BUILTIN_POLICIES.filter((p) => p.alwaysOn).map((p) => p.name));
-  const fromPack = selectedPolicies.filter((name) => !alwaysOnNames.has(name));
+  // ONLY names the caller actually asked for.
+  //
+  // This used to take whatever sat in `enabledPolicies` and switch those names
+  // on in the pack. It is additive — it can turn a policy on and never off — so
+  // a stale entry in that key resurrected a policy the user had deliberately
+  // removed, on the next `policies --install`, with no mention of it.
+  // `remove block-env-files` then `--install` put it straight back.
+  //
+  // And the key goes stale by design now: nothing writes pack selections there,
+  // so anything left in it is a leftover from before packs, kept only for the
+  // migration shim. Re-applying a leftover as if it were a decision is how a
+  // machine ends up enforcing something its owner switched off.
+  const fromPack = policyNames === undefined
+    ? []
+    : selectedPolicies.filter((name) => !alwaysOnNames.has(name));
   if (fromPack.length > 0) {
     // ONLY when there is no pack yet. Fetching the core pack with
     // `only: <selection>` REPLACES whatever the machine had chosen, and
@@ -578,7 +607,7 @@ async function installHooksImpl(
       } catch (err) {
         console.log(
           `\nWarning: could not fetch the policy pack (${err instanceof Error ? err.message : String(err)}).\n` +
-            `Run \`failproofai policies add core\` once you are online.`,
+            `Run \`failproofai policies add FailproofAI/policies\` once you are online.`,
         );
       }
     } else {
@@ -592,7 +621,13 @@ async function installHooksImpl(
       }
     }
   }
-  console.log(`\nEnabled ${selectedPolicies.length} policy(ies): ${selectedPolicies.join(", ")}\n`);
+  // Only when this run actually changed something. `--install` with no names
+  // wires hooks and touches no policy, and announcing "Enabled 0 policy(ies):"
+  // with an empty list described work it had not done — or worse, re-stated a
+  // stale key as though it were this run's decision.
+  if (policyNames !== undefined && selectedPolicies.length > 0) {
+    console.log(`\nEnabled ${selectedPolicies.length} policy(ies): ${selectedPolicies.join(", ")}\n`);
+  }
   if (removeCustomHooks) {
     console.log("Custom hooks path cleared.");
   } else if (configToWrite.customPoliciesPaths?.length || configToWrite.customPoliciesPath) {
@@ -991,6 +1026,24 @@ export async function listHooks(cwd?: string): Promise<void> {
   // a reader scrolling back from their prompt actually sees.
   const footer: Array<string[] | null> = [note(`Config: ${globalPolicyConfigFile()}`, opts)];
 
+  // A machine with hooks wired and no policies to run is the normal state right
+  // after setup — setup installs the hooks and deliberately chooses nothing —
+  // and this listing said NOTHING about how to leave it. A reader who had just
+  // finished `failproofai config` saw a header, a config path, and no next
+  // step. Ours is named in full, the same way anyone else's pack is typed,
+  // because it IS one.
+  if (packCount === 0) {
+    footer.unshift(
+      nextStep(
+        `failproofai policies add ${CORE_SOURCE}`,
+        "Nothing is enforcing yet. Take ours, or anyone's:",
+        opts,
+      ),
+      note("Someone else's:  failproofai policies add <owner>/<repo>", opts),
+      note("Look first:      failproofai policies show <owner>/<repo>", opts),
+    );
+  }
+
   if (installedScopes.length > 1) {
     footer.push(
       warning(