failproofai 1.0.2-beta.6 → 1.0.2-beta.8

package/dist/worker.mjs

@@ -2559,7 +2559,7 @@ var init_builtin_policies = __esm(() => {
 });
 
 // package.json
-var version = "1.0.2-beta.6";
+var version = "1.0.2-beta.8";
 var init_package = () => {};
 
 // src/posthog-key.ts
@@ -8911,10 +8911,12 @@ function parsePackIdentity(value) {
   if (value.effect !== undefined && value.effect !== "enforce" && value.effect !== "observe") {
     throw new Error(`unknown effect ${JSON.stringify(value.effect)} for pack ${value.id}`);
   }
+  const commit = typeof value.commit === "string" && PACK_COMMIT_RE.test(value.commit.trim().toLowerCase()) ? value.commit.trim().toLowerCase() : undefined;
   return {
     id: value.id,
     version: value.version,
-    effect: value.effect ?? "enforce"
+    effect: value.effect ?? "enforce",
+    ...commit ? { commit } : {}
   };
 }
 function hasInstalledPacks() {
@@ -9077,7 +9079,7 @@ function safeDeclared(raw) {
 function errText(err) {
   return err instanceof Error ? err.message : String(err);
 }
-var ACCEPTED_PACK_SCHEMA_VERSIONS, SHA256_RE2, PACK_ID_RE, PACK_VERSION_RE, PACK_POLICY_NAME_RE;
+var ACCEPTED_PACK_SCHEMA_VERSIONS, SHA256_RE2, PACK_ID_RE, PACK_VERSION_RE, PACK_COMMIT_RE, PACK_POLICY_NAME_RE;
 var init_pack_manifest = __esm(() => {
   init_fp_home();
   init_cloud_managed_policies();
@@ -9085,6 +9087,7 @@ var init_pack_manifest = __esm(() => {
   SHA256_RE2 = /^[a-f0-9]{64}$/;
   PACK_ID_RE = /^[A-Za-z0-9._-]{1,64}\/[A-Za-z0-9._-]{1,64}$/;
   PACK_VERSION_RE = /^[A-Za-z0-9][A-Za-z0-9._+-]{0,63}$/;
+  PACK_COMMIT_RE = /^[0-9a-f]{7,40}$/;
   PACK_POLICY_NAME_RE = /^[A-Za-z0-9._-]{1,128}$/;
 });
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "failproofai",
-  "version": "1.0.2-beta.6",
+  "version": "1.0.2-beta.8",
   "description": "Observability and enforcement for AI agent harnesses. 39 built-in policies hooked into 12 of them — Claude Code, Codex, Cursor, Hermes, OpenClaw and more — blocking the tool call before it runs. Local dashboard included, no account needed.",
   "bin": {
     "failproofai": "./dist/cli.mjs",
@@ -120,15 +120,15 @@
     "sharp": "0.35.0"
   },
   "optionalDependencies": {
-    "@failproofai/failproofaid-linux-x64": "1.0.2-beta.6",
-    "@failproofai/failproofaid-linux-arm64": "1.0.2-beta.6",
-    "@failproofai/failproofaid-darwin-x64": "1.0.2-beta.6",
-    "@failproofai/failproofaid-darwin-arm64": "1.0.2-beta.6"
+    "@failproofai/failproofaid-linux-x64": "1.0.2-beta.8",
+    "@failproofai/failproofaid-linux-arm64": "1.0.2-beta.8",
+    "@failproofai/failproofaid-darwin-x64": "1.0.2-beta.8",
+    "@failproofai/failproofaid-darwin-arm64": "1.0.2-beta.8"
   },
   "failproofaidBinaries": {
-    "linux-x64": "1e883d50ea40dad46394a137fab9b8ecddb7b37064312af9ddf89cb3de5eb7b8",
-    "linux-arm64": "47a51a75a01c021417a4d67fb7eb5caa8fa9c46abca5ec85d23e8ddead1ebfdd",
-    "darwin-x64": "bbc4e714c1e961d53d7dd6c65b84dcc74b4e24439349ebdef3f7d8681ece1776",
-    "darwin-arm64": "ca6f6e688070a2d2a63fd333f7c3ac7c7d2bd991ca499cfced23b249e7ca684b"
+    "linux-x64": "7b49023fd9351ccdddc066f9560d998e6b582b763ab4ad4253831a2548e99ae1",
+    "linux-arm64": "b43af87cb0ca7e83bfbc053051ef4627ce9594cb7b6a520492689f750302adc1",
+    "darwin-x64": "c03d157deddf78d1d7928aa6d33909e1ff585eace77d5d25090c56c7eb2a9983",
+    "darwin-arm64": "a2489beaf7e580a3e012a45d346c8df5764f426f460c0c6fb9bd7b405ac65366"
   }
 }

package/scripts/build-policy-pack.mjs

@@ -37,6 +37,9 @@ import { createHash } from "node:crypto";
 import { mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
+// The one place the pack's id is decided. Imported rather than restated — see
+// PACK_ID below for what restating it cost.
+import { CORE_SOURCE } from "../src/hooks/pack-store.ts";
 
 const ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "..");
 // `--out <dir>` lets the conformance test generate into a temp directory rather
@@ -47,10 +50,17 @@ const outArg = process.argv.indexOf("--out");
 const OUT_DIR = outArg !== -1 && process.argv[outArg + 1]
   ? resolve(process.argv[outArg + 1])
   : join(ROOT, "policy-pack");
-// Not `failproofai/builtins`. These stop being builtins the moment they ship as
-// a pack, and an id is the most durable place a retired word can hide — it ends
-// up in every machine's installed.json and in the listing every user reads.
-const PACK_ID = "failproofai/core";
+// Not restated. The id is the most durable place a retired word can hide — it
+// ends up in every machine's installed.json and in the listing every user reads
+// — and restating it here is how it hid twice: `failproofai/builtins` shipped
+// first, was corrected to `failproofai/core` HERE and nowhere else, and then
+// `core` was retired in pack-store while this line went on saying it. The one
+// published release still declares `failproofai/builtins`, so a machine that
+// installed it cannot be addressed by either name anybody would type.
+//
+// Read from the layer that owns the set, so the next rename reaches this file
+// whether or not somebody remembers it exists.
+const PACK_ID = CORE_SOURCE;
 const ENTRY_ASSET = "failproofai-pack.mjs";
 const MANIFEST_ASSET = "failproofai-pack.json";
 const CHECKSUMS_ASSET = "SHA256SUMS";
@@ -60,6 +70,17 @@ const version = JSON.parse(readFileSync(join(ROOT, "package.json"), "utf8")).ver
 // A generated entry that registers every non-alwaysOn builtin through the public
 // policy API — the same API a third-party pack uses. `failproofai` stays external
 // so the loader's shim resolves it, exactly as it does for any other pack.
+//
+// It registers `category` and `defaultEnabled` as well as name/description/
+// match/fn, and that is not decoration. This script builds ITS manifest straight
+// from POLICY_CATALOG, so omitting them from the ENTRY looked harmless — and was
+// not: the entry IS the artifact, and anything that rebuilds a manifest from it
+// saw 38 policies filed under "General" with none on by default. `failproofai
+// publish` does exactly that, which is how a release that would have enforced
+// nothing on a default install got as far as a dry run.
+//
+// Note for whoever edits the template below: it is a template literal, so a
+// backtick inside it ends the string. Comments in there stay backtick-free.
 const entrySource = `
 import { customPolicies } from "failproofai";
 import { BUILTIN_POLICIES } from ${JSON.stringify(join(ROOT, "src/hooks/builtin-policies.ts"))};
@@ -69,6 +90,9 @@ for (const policy of BUILTIN_POLICIES) {
   customPolicies.add({
     name: policy.name,
     description: policy.description,
+    // Both fields matter here; see the note above entrySource.
+    category: policy.category,
+    defaultEnabled: policy.defaultEnabled === true,
     match: policy.match,
     fn: policy.fn,
   });

package/src/audit/cli.ts

@@ -35,7 +35,8 @@ import { getInstanceId } from "../../lib/telemetry-id";
 import { sanitizeErrorMessage } from "../../lib/telemetry-sanitize";
 import { openWhenReady } from "./open-browser";
 import { describeOutcome, reportHarm } from "./report-harm";
-import { brandAnsi, ANSI_RESET, ANSI_BOLD, ANSI_DIM } from "../hooks/tui";
+import { brandAnsi, ANSI_RESET, ANSI_BOLD, ANSI_DIM, helpScreen, helpOptsFor } from "../hooks/tui";
+import { version } from "../../package.json";
 
 /** Port the bundled dashboard binds to. Matches `scripts/launch.ts`'s default
  *  for `start` mode, which `failproofai` (bare) already uses. */
@@ -64,9 +65,6 @@ export const AUDIT_STAGES: ReadonlyArray<{ label: string; detail: string }> = [
   { label: "aggregating results", detail: "counting hits, ranking by frequency" },
 ];
 
-/** Column the description text starts at. The widest command line is 37 wide. */
-const HELP_DESC_COL = 40;
-
 /**
  * `audit --help`.
  *
@@ -82,41 +80,44 @@ const HELP_DESC_COL = 40;
  * one. It still works, and still refuses every argument it always refused.
  */
 export function helpText(): string {
-  const row = (command: string, lines: string[]): string => {
-    // Padding is measured on the RAW command — `c()` adds escape bytes that
-    // occupy no columns, so colouring first would misalign every row.
-    const pad = " ".repeat(Math.max(1, HELP_DESC_COL - 2 - command.length));
-    return lines
-      .map((line, i) =>
-        i === 0 ? `  ${c(CYAN, command)}${pad}${line}` : `${" ".repeat(HELP_DESC_COL)}${line}`,
-      )
-      .join("\n");
-  };
-
-  return [
-    `${c(BOLD, "failproofai audit")} — review your agent CLIs for risky and wasteful patterns.`,
-    c(DIM, "Everything runs on this machine; only a scheduled digest ever leaves it."),
-    "",
-    c(BOLD, "USAGE"),
-    row("failproofai audit", [
-      "Scan your session history, then open",
-      `http://localhost:${DASHBOARD_PORT}/audit`,
-    ]),
-    row("failproofai audit --schedule [days]", [
-      "Scan on a timer and email the findings.",
-      "Default 7 days, range 1-90.",
-      "Signs you in the first time; add",
-      "--email <address> to skip a prompt.",
-    ]),
-    row("failproofai audit --no-schedule", ["Stop the timer. Leaves you signed in."]),
-    row("failproofai audit --status", [
-      "Whether scheduling is on, where reports",
-      "go, the daemon's state, and when the",
-      "next scan is due.",
-    ]),
-    row("failproofai audit -h, --help", ["Show this help."]),
-    "",
-  ].join("\n");
+  // Drawn by the same renderer as `config --help` and `policies --help`, from
+  // the same kit `audit`'s output already uses for its palette. It used to
+  // build its own rows against a hand-set HELP_DESC_COL, which is how `audit`
+  // and `config` ended up with their descriptions in different columns.
+  //
+  // The `failproofai audit` prefix is dropped from the rows: the heading two
+  // lines above already carries it, and repeating it cost 17 of the 80 columns
+  // on every row — which is what forced the four-word-per-line descriptions.
+  const lines = helpScreen(
+    {
+      command: "audit",
+      version,
+      tagline: "review your agent CLIs for risky and wasteful patterns",
+      sections: [
+        {
+          label: "usage",
+          entries: [
+            ["(bare)", `Scan your session history, then open http://localhost:${DASHBOARD_PORT}/audit`],
+            ["--schedule [days]", "Scan on a timer and email the findings. Default 7 days, range 1-90. Signs you in the first time."],
+            // Its own row now, rather than a clause inside --schedule's. It
+            // does not stand alone, which is why it used to be a clause — but
+            // a clause wraps, and `--email <address>` landing with the flag at
+            // the end of one line and its placeholder at the start of the next
+            // is not a flag anybody can read or copy.
+            ["--email <address>", "With --schedule, skips the sign-in prompt."],
+            ["--no-schedule", "Stop the timer. Leaves you signed in."],
+            ["--status", "Whether scheduling is on, where reports go, the daemon's state, and when the next scan is due."],
+            ["-h, --help", "Show this help."],
+          ],
+        },
+      ],
+      footer: ["Everything runs on this machine; only a scheduled digest ever leaves it."],
+    },
+    helpOptsFor(process.stdout),
+  );
+  // The margins `printBlock` would add, spelled out because this one returns
+  // its text for a caller to write rather than writing it.
+  return ["", ...lines, ""].join("\n") + "\n";
 }
 
 // ── ANSI helpers ────────────────────────────────────────────────────────────

package/src/hooks/backfill-cli.ts

@@ -149,7 +149,7 @@ export function runBackfillCommand(opts: BackfillOptions = {}): BackfillResult {
       exitCode: 1,
       lines: [
         "This machine is not connected, so there is nowhere to send history.",
-        "Connect first: `failproofai config --connect <url> --token <key>`.",
+        "Connect first: `failproofai config --token <key>`.",
       ],
     };
   }

package/src/hooks/configure-wizard.ts

@@ -743,6 +743,16 @@ export async function runConfigureWizard(
   // reaching this function, so setup never runs off the back of some other
   // command on a headless box.
   const unattended = !stdin.isTTY || !stdout.isTTY;
+  // A key on the command line settles the whole run, not just the question it
+  // literally answers.
+  //
+  // Somebody typing `failproofai config --token <key>` has said: set this
+  // machine up, connect it, send its data. There is nothing left to confirm —
+  // so asking "Connect to Cloud?", then the key, then "Ready to apply?" made
+  // the flag look like it had not been read. The only thing still worth
+  // stopping for is the sudo password, which is a CREDENTIAL rather than a
+  // question, and no flag can supply it.
+  const preAnswered = Boolean(answers.token);
 
 
   // Running the wizard itself under sudo configures the WRONG ACCOUNT, and
@@ -1020,9 +1030,15 @@ export async function runConfigureWizard(
     // one — so an unattended run with a token skips straight past the question,
     // and one without a token stays local, which is the same "Not now" branch a
     // person picks. Neither needs a separate flag to say so.
-    const choice = unattended
-      ? (answers.token ? "key" : "local")
-      : await selectOne<"key" | "local">({
+    const choice = answers.token
+      // A key on the command line IS the answer to this question. Gating it on
+      // there being no terminal was wrong: `--token` means "use this key", not
+      // "use this key only if nobody is watching", and a run that asked anyway
+      // made the flag look broken to the person who had just typed it.
+      ? "key"
+      : unattended
+        ? "local"
+        : await selectOne<"key" | "local">({
       message: "Connect this machine to FailproofAI Cloud?",
       // The hint says what you GET; the body says what LEAVES.
       //
@@ -1186,12 +1202,10 @@ export async function runConfigureWizard(
         }
       }
 
-      if (token === null && unattended) {
-        // Supplied on the command line, so nothing is asked and nothing is
-        // echoed. Reaching here without one cannot happen — an unattended run
-        // only takes the "key" branch BECAUSE a token was given.
-        token = answers.token ?? null;
-      }
+      // Supplied on the command line, so nothing is asked and nothing is
+      // echoed — terminal or not. Prompting for a value the caller already gave
+      // is the failure this whole flag exists to avoid.
+      if (token === null) token = answers.token ?? null;
       if (token === null) {
         token = await promptText({
           // The destination is in the question now that it is no longer a
@@ -1255,7 +1269,7 @@ export async function runConfigureWizard(
   // NOT the same call as `uninstall`, which does require --yes: that one
   // REMOVES things, so silence there would destroy on a signal as weak as a
   // missing terminal. This one does exactly what its name says.
-  const decision = unattended ? "apply" : await selectOne<"apply" | "cancel">({
+  const decision = unattended || preAnswered ? "apply" : await selectOne<"apply" | "cancel">({
     message: "Ready to apply?",
     body: reviewLines({
       target,

package/src/hooks/manager.ts

@@ -15,7 +15,6 @@ import { INTEGRATION_TYPES,
   type IntegrationType,
 } from "./types";
 import { claudeCode, getIntegration, settingsPathsFor, type Integration } from "./integrations";
-import { promptPolicySelection } from "./install-prompt";
 import { configuredCustomPolicyPaths, readMergedHooksConfig, readScopedHooksConfig, writeScopedHooksConfig, syncConventionPolicies, findProjectConfigDir } from "./hooks-config";
 import type { HooksConfig, ConventionPolicyRecord } from "./policy-types";
 import { BUILTIN_POLICIES } from "./builtin-policies";
@@ -462,9 +461,25 @@ async function installHooksImpl(
       ? [...new Set(incoming)]
       : [...new Set([...previousConfig.enabledPolicies, ...incoming])];
   } else {
-    // Interactive — pre-load current config if it exists
-    const preSelected = previousConfig.enabledPolicies.length > 0 ? previousConfig.enabledPolicies : undefined;
-    selectedPolicies = await promptPolicySelection(preSelected, { includeBeta });
+    // NOT a policy picker. `--install` wires hooks; choosing what they enforce
+    // is `policies add` / `policies remove`.
+    //
+    // It used to open a second picker here, over `BUILTIN_POLICIES` — the
+    // COMPILED catalog, which is no longer how policies arrive. So it offered a
+    // list that did not match what was installed, in an older prompt engine
+    // that looks nothing like the rest, and wrote its answer to
+    // `enabledPolicies` while every pack records its selection in
+    // `installed.json`.
+    //
+    // Two independent enabled-sets, and this one silently overwrote the other:
+    // `policies remove block-env-files` followed by `policies --install` put
+    // block-env-files straight back on, because the picker pre-ticked from the
+    // legacy key and saved all of it again. A command whose job is wiring must
+    // not undo a policy decision made somewhere else.
+    //
+    // Whatever was enabled stays enabled. Explicit names still work
+    // (`--install block-sudo`) for the migration shim, which has only this key.
+    selectedPolicies = previousConfig.enabledPolicies;
   }
 
   // Preserve existing config fields when updating. New writes use the plural
@@ -556,7 +571,21 @@ async function installHooksImpl(
   // pack does not carry it and asking for it by name is a selection the pack
   // cannot satisfy. It ships compiled in and registers regardless.
   const alwaysOnNames = new Set(BUILTIN_POLICIES.filter((p) => p.alwaysOn).map((p) => p.name));
-  const fromPack = selectedPolicies.filter((name) => !alwaysOnNames.has(name));
+  // ONLY names the caller actually asked for.
+  //
+  // This used to take whatever sat in `enabledPolicies` and switch those names
+  // on in the pack. It is additive — it can turn a policy on and never off — so
+  // a stale entry in that key resurrected a policy the user had deliberately
+  // removed, on the next `policies --install`, with no mention of it.
+  // `remove block-env-files` then `--install` put it straight back.
+  //
+  // And the key goes stale by design now: nothing writes pack selections there,
+  // so anything left in it is a leftover from before packs, kept only for the
+  // migration shim. Re-applying a leftover as if it were a decision is how a
+  // machine ends up enforcing something its owner switched off.
+  const fromPack = policyNames === undefined
+    ? []
+    : selectedPolicies.filter((name) => !alwaysOnNames.has(name));
   if (fromPack.length > 0) {
     // ONLY when there is no pack yet. Fetching the core pack with
     // `only: <selection>` REPLACES whatever the machine had chosen, and
@@ -592,7 +621,13 @@ async function installHooksImpl(
       }
     }
   }
-  console.log(`\nEnabled ${selectedPolicies.length} policy(ies): ${selectedPolicies.join(", ")}\n`);
+  // Only when this run actually changed something. `--install` with no names
+  // wires hooks and touches no policy, and announcing "Enabled 0 policy(ies):"
+  // with an empty list described work it had not done — or worse, re-stated a
+  // stale key as though it were this run's decision.
+  if (policyNames !== undefined && selectedPolicies.length > 0) {
+    console.log(`\nEnabled ${selectedPolicies.length} policy(ies): ${selectedPolicies.join(", ")}\n`);
+  }
   if (removeCustomHooks) {
     console.log("Custom hooks path cleared.");
   } else if (configToWrite.customPoliciesPaths?.length || configToWrite.customPoliciesPath) {