failproofai 1.0.2-beta.5 → 1.0.2-beta.7

package/src/hooks/onboarding-attempt.ts

@@ -157,10 +157,11 @@ export function blockerCleared(attempt: OnboardingAttempt, probe: RetryProbe): b
       // command would just repeat the hard-fail. Only a new release is a reason
       // to ask again (it might add support for this platform).
       return probe.cliVersion !== attempt.cliVersion;
-    case "not_a_tty":
     case "running_as_sudo":
-      // Both are properties of the invocation, not of the machine, so the next
-      // one may well be fine.
+      // A property of the invocation, not of the machine, so the next one may
+      // well be fine. (`not_a_tty` used to sit here too. It is gone because
+      // there is no such refusal any more: a run with no terminal has no
+      // questions to ask, so it applies rather than declining.)
       return true;
     default:
       return true;
@@ -174,7 +175,6 @@ export function attemptHintLines(attempt: OnboardingAttempt): string[] {
     daemon_failed: "the failproofaid service could not be started",
     cancelled: "it was cancelled",
     unsupported_platform: "failproofaid does not run on this platform",
-    not_a_tty: "there was no terminal to ask in",
     running_as_sudo: "it was run under sudo",
   };
   const detail = why[attempt.reason] ?? "it did not finish";

package/src/hooks/pack-cli.ts

@@ -20,9 +20,7 @@ import {
   PACK_MANIFEST_ASSET,
   addPack,
   checkPackArtifact,
-  CORE_ALIASES,
   fetchPackPreview,
-  CORE_SOURCE,
   packTagMatchesVersion,
   removePack,
   setPackPolicyEnabled,
@@ -63,34 +61,153 @@ function parseList(rest: string[], flag: string): string[] | undefined {
   return raw.split(",").map((s) => s.trim()).filter(Boolean);
 }
 
-/** Flags that take a separate value, so it is never mistaken for the source. */
-const VALUE_FLAGS = new Set(["--only", "--policy", "--category", "--cli"]);
+/**
+ * Flags that take a separate value, so it is never mistaken for the source.
+ *
+ * Must list every flag that can REACH this lane, not just the ones this lane
+ * acts on. `--scope` and `--custom` are handled by the caller and passed
+ * through untouched — and their values were being read as the pack to install,
+ * so `policies add --scope project acme/x` tried to fetch a pack called
+ * "project". A flag this file ignores still has a value this file must skip.
+ */
+const VALUE_FLAGS = new Set([
+  "--only",
+  "--policy",
+  "--category",
+  "--cli",
+  "--scope",
+  "--custom",
+  "-c",
+]);
+
+/**
+ * Every index `--cli` claims, so the source is not found among its values.
+ *
+ * `--cli` is the one flag that takes MORE than one token, because the other
+ * lane spells it `--cli claude codex` and somebody typing that here should not
+ * be quietly given a different answer. Shared with `packAddSource` so the two
+ * agree by construction: a token consumed as a CLI name is never also read as
+ * the pack to install.
+ */
+/**
+ * Could this token be an agent name rather than the pack to install?
+ *
+ * `--cli` consumes several tokens, so it has to know where its own list ends,
+ * and "not a flag" is not enough: `--cli claude codex acme/x` would swallow the
+ * SOURCE and leave the command with nothing to install. A pack source always
+ * carries a slash — `parsePackSource` accepts nothing else — and no agent name
+ * has one, which separates them exactly.
+ *
+ * Deliberately NOT "is it a known agent". An unknown name has to be consumed to
+ * be REJECTED: stopping at `claud` would hand it to the source parser instead,
+ * and the reply would be about pack syntax rather than about the typo.
+ */
+function looksLikeCliName(token: string): boolean {
+  return !token.startsWith("-") && !token.includes("/");
+}
+
+function cliValueIndices(rest: string[]): Set<number> {
+  const taken = new Set<number>();
+  for (let i = 0; i < rest.length; i += 1) {
+    if (rest[i] !== "--cli" && !rest[i].startsWith("--cli=")) continue;
+    if (rest[i].startsWith("--cli=")) continue; // its value is in the same token
+    for (let j = i + 1; j < rest.length && looksLikeCliName(rest[j]); j += 1) {
+      taken.add(j);
+    }
+  }
+  return taken;
+}
 
 /** Find the positional source without mistaking a flag's separate value for it. */
 export function packAddSource(rest: string[]): string | undefined {
-  const consumed = new Set<number>();
+  const consumed = cliValueIndices(rest);
   for (let i = 0; i < rest.length; i += 1) {
     if (VALUE_FLAGS.has(rest[i])) consumed.add(i + 1);
   }
-  return rest.find((arg, index) => !arg.startsWith("--") && !consumed.has(index));
+  // ONE dash, not two. `-c` passed a `startsWith("--")` filter and was returned
+  // as the pack to install — and no GitHub owner or repo may begin with a
+  // hyphen, so nothing legitimate is excluded by widening it.
+  return rest.find((arg, index) => !arg.startsWith("-") && !consumed.has(index));
+}
+
+/**
+ * The agent CLIs named by `--cli`, in either spelling, all of them validated.
+ *
+ * Two separate silent failures lived here, and both reported success:
+ *
+ *  - An unknown name was accepted. `--cli claud` installed the pack, printed
+ *    "Installed", exited 0, and guarded NOTHING — the misspelling matched no
+ *    agent, so the pack applied to none of them.
+ *  - A space-separated list was truncated to its first entry.
+ *    `--cli claude codex` recorded `["claude"]` and dropped codex on the floor,
+ *    because this lane split on commas while the other split on spaces.
+ *
+ * Both now take either spelling and refuse a name that is not an agent. The set
+ * comes from `INTEGRATION_TYPES` rather than a list written out here, because
+ * the copy in `bin/failproofai.mjs` is already a second hand-maintained one and
+ * a third would be the one that drifts.
+ */
+function parseCliList(rest: string[]): { clis?: string[] } | { error: string[] } {
+  const idx = rest.findIndex((a) => a === "--cli" || a.startsWith("--cli="));
+  if (idx === -1) return {};
+  const values: string[] = [];
+  if (rest[idx].startsWith("--cli=")) {
+    values.push(...rest[idx].slice("--cli=".length).split(","));
+  } else {
+    for (let j = idx + 1; j < rest.length && looksLikeCliName(rest[j]); j += 1) {
+      values.push(...rest[j].split(","));
+    }
+  }
+  const names = values.map((v) => v.trim()).filter(Boolean);
+  if (names.length === 0) return { clis: [] };
+
+  const known = new Set<string>(INTEGRATION_TYPES);
+  const unknown = names.filter((n) => !known.has(n));
+  if (unknown.length > 0) {
+    // Thrown, not warned. A pack scoped to an agent that does not exist is
+    // enforcing on nothing, and saying so afterwards is no use to the script
+    // that already read exit 0 and moved on.
+    const near = (bad: string) =>
+      INTEGRATION_TYPES.find((k) => k.startsWith(bad.slice(0, 3)) || bad.startsWith(k.slice(0, 3)));
+    const hint = unknown.map((u) => (near(u) ? `${u} (did you mean ${near(u)}?)` : u)).join(", ");
+    return {
+      error: [
+        `Not an agent: ${hint}`,
+        `--cli takes any of: ${INTEGRATION_TYPES.join(", ")}`,
+      ],
+    };
+  }
+  return { clis: names };
 }
 
 /** Names taken by our own policies, so a selection can be checked before install. */
+/**
+ * Exported for tests: the parse is where both `--cli` bugs lived, and asserting
+ * it through a real `add` would need a release server for a question that is
+ * purely about argument shapes.
+ */
+export function selectionFromForTest(rest: string[]) {
+  return selectionFrom(rest);
+}
+
 function selectionFrom(rest: string[]): {
   only?: string[];
   categories?: string[];
   all?: boolean;
   clis?: string[];
+  /** Present when the selection itself is unusable — see `parseCliList`. */
+  error?: string[];
 } {
   // `--policy` reads right for one ("give me this policy"), `--only` for a set.
   // They are the same switch; taking both means neither is the wrong guess.
   const only = parseList(rest, "--policy") ?? parseList(rest, "--only");
   const categories = parseList(rest, "--category");
-  const clis = parseList(rest, "--cli");
+  const parsedClis = parseCliList(rest);
+  if ("error" in parsedClis) return { error: parsedClis.error };
   return {
     ...(only ? { only } : {}),
     ...(categories ? { categories } : {}),
-    ...(clis ? { clis } : {}),
+    ...(parsedClis.clis ? { clis: parsedClis.clis } : {}),
     ...(rest.includes("--all") ? { all: true } : {}),
   };
 }
@@ -175,6 +292,29 @@ async function build(rest: string[]): Promise<PackCliResult> {
     ]);
   }
 
+  // Two policies cannot share a name, and this is where that has to be caught.
+  //
+  // Nothing downstream can resolve the ambiguity: a name is what `--policy`
+  // selects, what the picker toggles, and what the enabled list stores — so a
+  // duplicate makes one of the two unreachable and the other's on/off state
+  // decide for both. Bundling several files makes it easy to reach by accident:
+  // a starter written by `publish --init` into a folder that already had a
+  // policy of the same name published as exactly this, twice over, with no
+  // complaint at build time.
+  const byName = new Map<string, number>();
+  for (const hook of hooks) byName.set(hook.name, (byName.get(hook.name) ?? 0) + 1);
+  const duplicates = [...byName.entries()].filter(([, n]) => n > 1).map(([name]) => name);
+  if (duplicates.length > 0) {
+    return fail([
+      duplicates.length === 1
+        ? `Two policies are called ${JSON.stringify(duplicates[0])}.`
+        : `${duplicates.length} names are used by more than one policy: ${duplicates.join(", ")}.`,
+      "A name is what --policy selects and what the picker toggles, so a pack",
+      "cannot carry the same one twice — one of them would be unreachable.",
+      "Rename or delete one of each pair.",
+    ]);
+  }
+
   const policies: unknown[] = [];
   for (const [index, hook] of hooks.entries()) {
     // `category` and `defaultEnabled` are pack-manifest fields a plain custom
@@ -274,7 +414,7 @@ export async function runPolicyPicker(
           {
             what: "No policies are installed yet.",
             hint: "Take ours, or anyone's:",
-            cmd: "failproofai policies add core",
+            cmd: "failproofai policies add FailproofAI/policies",
           },
           opts,
         ),
@@ -1383,18 +1523,19 @@ async function pickFromSource(
 async function add(rest: string[]): Promise<PackCliResult> {
   const source = packAddSource(rest);
   const selection = selectionFrom(rest);
-
-  // Our own pack, by the short name. `core` is a SPELLING of a GitHub source,
-  // not a second delivery path: it resolves to CORE_SOURCE and is fetched,
-  // verified and pinned exactly like anybody else's.
-  //
-  // The package used to carry a copy so this worked with no network. It no
-  // longer does, on purpose. A pack that ships inside the binary is a policy set
-  // we picked for you and wrote to your disk before you asked for it, and it
-  // gave our own policies a route no third-party pack could use — which is the
-  // opposite of the thing this whole lane exists to make possible.
-  const resolvedSource =
-    source && CORE_ALIASES.has(source.toLowerCase()) ? CORE_SOURCE : source;
+  // Refused before anything is fetched or written: a pack scoped to an agent
+  // that does not exist enforces on nothing, and saying so afterwards is no use
+  // to the script that already read exit 0 and moved on.
+  if (selection.error) return fail(selection.error);
+
+  // No short name for our own pack any more. `core` resolved to CORE_SOURCE and
+  // was fetched, verified and pinned like anybody else's — but a spelling only
+  // WE get to use still made our policies read as part of the tool rather than
+  // as one pack among others, which is the distinction this lane exists to
+  // erase. Ours is typed the same way yours is: `FailproofAI/policies`.
+  // `parsePackSource` still recognises the retired spellings, so typing one
+  // gets told what to type instead.
+  const resolvedSource = source;
 
   if (!resolvedSource) {
     return fail(["Usage: failproofai policies add <source> [--policy a,b] [--category x,y] [--all]"]);

package/src/hooks/pack-store.ts

@@ -91,6 +91,15 @@ function baseUrl(): string {
 const OWNER_RE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/;
 const TAG_RE = /^[A-Za-z0-9][A-Za-z0-9._/-]{0,127}$/;
 
+export const CORE_SOURCE = "FailproofAI/policies";
+
+/**
+ * Spellings that USED to resolve to our own pack, kept only so typing one gets
+ * an answer rather than a parse error. They are not resolved any more — see the
+ * throw in `parsePackSource`.
+ */
+export const RETIRED_CORE_ALIASES = new Set(["core", "failproofai", "official"]);
+
 /**
  * Parse a pack source into owner, repo and an optional tag.
  *
@@ -136,6 +145,17 @@ export function parsePackSpec(source: string): PackSpec {
   const tag = at > 0 ? withoutScheme.slice(at + 1) : null;
   const slash = repoPart.indexOf("/");
   if (slash <= 0 || slash === repoPart.length - 1) {
+    // `core` / `failproofai` / `official` used to be spellings of our own pack.
+    // They are gone on purpose: a short name only WE get to use makes our
+    // policies look like part of the tool rather than a pack like any other,
+    // which is exactly the distinction this whole surface exists to remove.
+    // Named explicitly here so the spelling that used to work says what to type
+    // instead of failing as an unparseable source.
+    if (RETIRED_CORE_ALIASES.has(repoPart.trim().toLowerCase())) {
+      throw new Error(
+        `${JSON.stringify(source)} is no longer a pack name — ours is a pack like anyone else's now. Use ${CORE_SOURCE} instead.`,
+      );
+    }
     throw new Error(
       `pack source must be owner/repo, owner/repo@tag, or a github.com URL — got ${JSON.stringify(source)}`,
     );
@@ -325,8 +345,6 @@ interface FetchedPack {
  * gives our own policies a delivery path nobody else's pack can use. One lane,
  * the same for everyone — ours are just the pack whose short name we spell.
  */
-export const CORE_SOURCE = "FailproofAI/policies";
-export const CORE_ALIASES = new Set(["core", "failproofai", "official"]);
 
 export interface PackAddOptions {
   only?: string[];
@@ -358,12 +376,7 @@ export async function addPackFromSource(
   source: string,
   opts: PackAddOptions = {},
 ): Promise<AddedPack> {
-  // `core` is a spelling of CORE_SOURCE, not a second delivery path. Resolved
-  // HERE rather than in the CLI so the dashboard and the CLI cannot disagree
-  // about what the short name means — they did once, and a name the CLI could
-  // resolve failed in the browser.
-  const resolved = CORE_ALIASES.has(source.trim().toLowerCase()) ? CORE_SOURCE : source;
-  const result = await addPack(resolved, opts);
+  const result = await addPack(source, opts);
   return {
     id: result.id,
     version: result.version,

package/src/hooks/read-stdin.ts

@@ -15,34 +15,104 @@ export interface StdinRead {
   oversized: boolean;
   /** `process.stdin` emitted an `error` event before `end`. */
   readError: boolean;
+  /** No `end` arrived within the budget; the payload is `""`. */
+  timedOut: boolean;
 }
 
-export async function readStdinPayload(maxBytes = 1_048_576): Promise<StdinRead> {
+/**
+ * How long to wait for the agent to finish writing the payload.
+ *
+ * Deliberately generous: the parent has the payload in hand before it spawns
+ * the hook, so a real read is milliseconds and this can only fire on a
+ * misconfiguration. It exists to bound that misconfiguration, not to police a
+ * slow write — a false timeout here would drop a real policy decision.
+ */
+const STDIN_TIMEOUT_MS = 10_000;
+
+/**
+ * Read the hook payload, and NEVER wait forever for it.
+ *
+ * This runs on the enforcement path — every tool call, on all eleven agent
+ * CLIs — and it used to have no bound at all. The only early exit was
+ * `readableEnded`, which helps only when stdin is ALREADY closed, so a parent
+ * that spawned the hook with a pipe it had not yet closed, or with an inherited
+ * terminal, left this promise unsettled forever. A hung hook is worse than
+ * either verdict: it does not fail open or closed, it freezes the agent's tool
+ * call, and nothing on our side ever gives up.
+ *
+ * Two bounds, because there are two ways in:
+ *
+ *  - A TTY on stdin means no payload is coming, ever. Nobody types a hook
+ *    payload at a keyboard, so waiting for EOF on a terminal is waiting for a
+ *    person to press ctrl-D — which is exactly what a hand-run
+ *    `failproofai --hook PreToolUse` looked like.
+ *  - An open pipe might still deliver, so it gets a clock rather than a
+ *    refusal.
+ *
+ * Both resolve empty and flag what happened. That matches how a read error has
+ * always been treated — warn, report, evaluate an empty payload — rather than
+ * inventing a third verdict for a case that is a malformed invocation, not a
+ * policy decision.
+ */
+export async function readStdinPayload(
+  maxBytes = 1_048_576,
+  timeoutMs = STDIN_TIMEOUT_MS,
+  // Injectable so a test can hand in a stream that never ends — which is the
+  // whole condition under test — WITHOUT reassigning `process.stdin`. Doing
+  // that globally takes the test runner's own stdin away and kills it.
+  stream: NodeJS.ReadableStream & {
+    isTTY?: boolean;
+    readableEnded?: boolean;
+    destroy?: () => void;
+  } = process.stdin,
+): Promise<StdinRead> {
   let payload = "";
   let oversized = false;
   let readError = false;
+  let timedOut = false;
+
+  // A terminal never ends on its own. Checked before any listener is attached,
+  // so the hand-run case costs nothing and returns immediately.
+  if (stream.isTTY) {
+    return { payload: "", oversized: false, readError: false, timedOut: false };
+  }
+
+  let timer: ReturnType<typeof setTimeout> | undefined;
   try {
     payload = await new Promise<string>((resolve, reject) => {
       const chunks: string[] = [];
       let totalBytes = 0;
-      process.stdin.setEncoding("utf8");
-      process.stdin.on("data", (chunk: string) => {
+      stream.setEncoding("utf8");
+      stream.on("data", (chunk: string) => {
         totalBytes += Buffer.byteLength(chunk);
         if (totalBytes > maxBytes) {
           oversized = true;
-          process.stdin.destroy();
+          stream.destroy?.();
           resolve("");
           return;
         }
         chunks.push(chunk);
       });
-      process.stdin.on("end", () => resolve(chunks.join("")));
-      process.stdin.on("error", reject);
+      stream.on("end", () => resolve(chunks.join("")));
+      stream.on("error", reject);
       // If stdin is already closed or not piped, resolve immediately
-      if (process.stdin.readableEnded) resolve("");
+      if (stream.readableEnded) resolve("");
+
+      timer = setTimeout(() => {
+        timedOut = true;
+        // Whatever arrived before the clock ran out is NOT used: a partial
+        // payload is not valid JSON, and half a tool call is not a thing any
+        // policy should be asked to judge.
+        stream.destroy?.();
+        resolve("");
+      }, timeoutMs);
+      // Nothing else keeps this process alive on account of the timer.
+      timer.unref?.();
     });
   } catch {
     readError = true;
+  } finally {
+    if (timer) clearTimeout(timer);
   }
-  return { payload, oversized, readError };
+  return { payload, oversized, readError, timedOut };
 }