failproofai 1.0.2-beta.7 → 1.0.2-beta.9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "failproofai",
-  "version": "1.0.2-beta.7",
+  "version": "1.0.2-beta.9",
   "description": "Observability and enforcement for AI agent harnesses. 39 built-in policies hooked into 12 of them — Claude Code, Codex, Cursor, Hermes, OpenClaw and more — blocking the tool call before it runs. Local dashboard included, no account needed.",
   "bin": {
     "failproofai": "./dist/cli.mjs",
@@ -120,15 +120,15 @@
     "sharp": "0.35.0"
   },
   "optionalDependencies": {
-    "@failproofai/failproofaid-linux-x64": "1.0.2-beta.7",
-    "@failproofai/failproofaid-linux-arm64": "1.0.2-beta.7",
-    "@failproofai/failproofaid-darwin-x64": "1.0.2-beta.7",
-    "@failproofai/failproofaid-darwin-arm64": "1.0.2-beta.7"
+    "@failproofai/failproofaid-linux-x64": "1.0.2-beta.9",
+    "@failproofai/failproofaid-linux-arm64": "1.0.2-beta.9",
+    "@failproofai/failproofaid-darwin-x64": "1.0.2-beta.9",
+    "@failproofai/failproofaid-darwin-arm64": "1.0.2-beta.9"
   },
   "failproofaidBinaries": {
-    "linux-x64": "75a8e231e057986f2b357e1fcb596641afd82a4b58f9271bb4b342951a364c2d",
-    "linux-arm64": "47d2933d06e70faefa78fe06fdd4e06bc03e94a319d13a8837145d192cd84d8c",
-    "darwin-x64": "6eae79c75746efe6922ca84e7dd899d01a50e651879abc8f90de69cd51c403f3",
-    "darwin-arm64": "ddca616decc3d2415ce6a58ae5fe15786bd2cfa5a5319803f4207a01d40e4a0a"
+    "linux-x64": "906b0c8a7502ad6a0494231a2220fff65db7ff8335ad7bdf15b58079a001562f",
+    "linux-arm64": "8b40f161cedf07ec3504dd736c906666d18bf042613af0a6a38f4daae8d7c7d4",
+    "darwin-x64": "7407d02234c24932ac9ece07bca348bd40c7a4edff72e0a8db9ac230a1e28a8c",
+    "darwin-arm64": "77131a4f0c1b9d3e5611ad3f4834542e26e32a404f1311903a1cf7783fe99fee"
   }
 }

package/scripts/build-policy-pack.mjs

@@ -37,6 +37,9 @@ import { createHash } from "node:crypto";
 import { mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
+// The one place the pack's id is decided. Imported rather than restated — see
+// PACK_ID below for what restating it cost.
+import { CORE_SOURCE } from "../src/hooks/pack-store.ts";
 
 const ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "..");
 // `--out <dir>` lets the conformance test generate into a temp directory rather
@@ -47,10 +50,17 @@ const outArg = process.argv.indexOf("--out");
 const OUT_DIR = outArg !== -1 && process.argv[outArg + 1]
   ? resolve(process.argv[outArg + 1])
   : join(ROOT, "policy-pack");
-// Not `failproofai/builtins`. These stop being builtins the moment they ship as
-// a pack, and an id is the most durable place a retired word can hide — it ends
-// up in every machine's installed.json and in the listing every user reads.
-const PACK_ID = "failproofai/core";
+// Not restated. The id is the most durable place a retired word can hide — it
+// ends up in every machine's installed.json and in the listing every user reads
+// — and restating it here is how it hid twice: `failproofai/builtins` shipped
+// first, was corrected to `failproofai/core` HERE and nowhere else, and then
+// `core` was retired in pack-store while this line went on saying it. The one
+// published release still declares `failproofai/builtins`, so a machine that
+// installed it cannot be addressed by either name anybody would type.
+//
+// Read from the layer that owns the set, so the next rename reaches this file
+// whether or not somebody remembers it exists.
+const PACK_ID = CORE_SOURCE;
 const ENTRY_ASSET = "failproofai-pack.mjs";
 const MANIFEST_ASSET = "failproofai-pack.json";
 const CHECKSUMS_ASSET = "SHA256SUMS";
@@ -60,6 +70,17 @@ const version = JSON.parse(readFileSync(join(ROOT, "package.json"), "utf8")).ver
 // A generated entry that registers every non-alwaysOn builtin through the public
 // policy API — the same API a third-party pack uses. `failproofai` stays external
 // so the loader's shim resolves it, exactly as it does for any other pack.
+//
+// It registers `category` and `defaultEnabled` as well as name/description/
+// match/fn, and that is not decoration. This script builds ITS manifest straight
+// from POLICY_CATALOG, so omitting them from the ENTRY looked harmless — and was
+// not: the entry IS the artifact, and anything that rebuilds a manifest from it
+// saw 38 policies filed under "General" with none on by default. `failproofai
+// publish` does exactly that, which is how a release that would have enforced
+// nothing on a default install got as far as a dry run.
+//
+// Note for whoever edits the template below: it is a template literal, so a
+// backtick inside it ends the string. Comments in there stay backtick-free.
 const entrySource = `
 import { customPolicies } from "failproofai";
 import { BUILTIN_POLICIES } from ${JSON.stringify(join(ROOT, "src/hooks/builtin-policies.ts"))};
@@ -69,6 +90,9 @@ for (const policy of BUILTIN_POLICIES) {
   customPolicies.add({
     name: policy.name,
     description: policy.description,
+    // Both fields matter here; see the note above entrySource.
+    category: policy.category,
+    defaultEnabled: policy.defaultEnabled === true,
     match: policy.match,
     fn: policy.fn,
   });

package/src/audit/index.ts

@@ -100,6 +100,17 @@ interface ScanOutcome {
   result: TranscriptAuditResult;
   bytesScanned: number;
   detectorState: DetectorSessionState;
+  /**
+   * Whether this result covers the TAIL only, or the whole transcript.
+   *
+   * The caller merges a cached prefix onto the result, which is right for a
+   * resumed scan and wrong for a full one — and a resume that could not be
+   * honoured falls back to a full read RIGHT HERE, several returns away from
+   * the merge. Without this the fallback merged a whole-file result onto a
+   * prefix that already contained it, and every finding before the resume point
+   * was counted twice.
+   */
+  resumed: boolean;
 }
 
 async function scanOneTranscript(
@@ -125,6 +136,7 @@ async function scanOneTranscript(
   // `errors` rather than silently returning an empty hits map.
   let events: NormalizedToolEvent[];
   let bytesScanned = 0;
+  let resumed = false;
   // A resumed scan carries the stateful detectors' state forward across the
   // boundary. Starting them empty would silently change what they find — the
   // re-read detector's countdown spans tool calls, so an edit before the offset
@@ -151,6 +163,7 @@ async function scanOneTranscript(
       events = scan.events;
       bytesScanned = scan.bytesConsumed;
       empty.cwd = scan.cwd ?? "";
+      resumed = true;
     }
   } else {
     // A source with no byte offsets to speak of — a database. Scanned whole,
@@ -160,7 +173,7 @@ async function scanOneTranscript(
   }
 
   if (events.length === 0) {
-    return { result: empty, bytesScanned, detectorState: sessionState };
+    return { result: empty, bytesScanned, detectorState: sessionState, resumed };
   }
 
   const result = empty;
@@ -201,7 +214,7 @@ async function scanOneTranscript(
     }
   }
 
-  return { result, bytesScanned, detectorState: sessionState };
+  return { result, bytesScanned, detectorState: sessionState, resumed };
 }
 
 function formatPolicyExample(_policyName: string, event: NormalizedToolEvent): string {
@@ -447,8 +460,15 @@ async function runAuditInner(opts: RunAuditOptions, startedAt: number): Promise<
     try {
       const scan = await scanOneTranscript(meta, resume);
       // A resumed scan produced hits for the TAIL only; the cached result holds
-      // everything before it. Merging is what makes the two halves one answer.
-      const fresh = cachedPrefix ? mergeIncremental(cachedPrefix, scan.result) : scan.result;
+      // everything before it. Merging is what makes the two halves one answer —
+      // and `scan.resumed`, not `cachedPrefix`, is what says there are two
+      // halves. A resume the reader could not honour (truncated, unparseable
+      // from that offset, rewritten under us) falls back to reading the WHOLE
+      // file, and merging the prefix onto that counted everything before the
+      // resume point twice.
+      const fresh = cachedPrefix && scan.resumed
+        ? mergeIncremental(cachedPrefix, scan.result)
+        : scan.result;
       if (!opts.noCache) {
         writeCachedTranscriptResult(
           meta.transcriptPath,