failproofai 1.0.2-beta.7 → 1.0.2-beta.9

package/src/hooks/pack-store.ts

@@ -17,11 +17,16 @@
  *
  * Asset URLs are CONSTRUCTED from an owner, repo and concrete tag. When the
  * user omits a tag, one `releases/latest` redirect resolves it before any asset
- * is fetched or written. There is no API lookup or rate-limit dependency, and
- * the installed record always names the pinned result — which has to AGREE with
- * the version that pack's manifest declares, or nothing is installed at all
+ * is fetched or written. There is no index to poison, and the installed record
+ * always names the pinned result — which has to AGREE with the version that
+ * pack's manifest declares, or nothing is installed at all
  * (`packTagMatchesVersion`).
  *
+ * `resolveTagForCommit` is the ONE exception, and it is opt-in: typing
+ * `owner/repo@a1b2c3d` asks a question no URL can answer, so that path — and no
+ * other — reads the releases API. It chooses WHICH release; every verification
+ * below runs on the result exactly as it would on a typed tag.
+ *
  * ## Never on the hook path
  *
  * Everything here touches the network. A hook must never wait on it. This module
@@ -30,7 +35,7 @@
 import { createHash } from "node:crypto";
 import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { dirname, resolve } from "node:path";
-import { packsRoot, parsePackIdentity, parsePackPolicy, readInstalledPacks } from "./pack-manifest";
+import { PACK_COMMIT_RE, packsRoot, parsePackIdentity, parsePackPolicy, readInstalledPacks } from "./pack-manifest";
 import type { ResolvedPack } from "./pack-manifest";
 import type { InstalledPackRecord } from "./pack-manifest";
 import type { PolicyCatalogEntry } from "./policy-types";
@@ -210,6 +215,132 @@ export async function resolveLatestTag(spec: PackSpec): Promise<string> {
   return tag;
 }
 
+/**
+ * The GitHub API, for the ONE lookup on this whole path that needs one.
+ *
+ * Read per call rather than captured at import, the way `baseUrl()` above is:
+ * the value has to be settable by a test that points it at a local server, and
+ * a module-level const would freeze whatever the environment happened to hold
+ * when this file was first imported.
+ */
+function githubApiBase(): string {
+  return (process.env.FAILPROOFAI_GITHUB_API ?? "https://api.github.com").replace(/\/+$/, "");
+}
+
+/**
+ * The release tag published from a given git commit, or null when no release
+ * claims it.
+ *
+ * ## Why this is the only API call in the install path
+ *
+ * Everything else here CONSTRUCTS its URLs from owner, repo and tag and
+ * discovers nothing — that is what leaves no index to poison, and it must stay
+ * true for everybody who did not opt in. A commit is the one spelling that
+ * cannot be turned into a URL, because the mapping from commit to tag exists
+ * only on the server. So this runs when, and only when, the user typed a hex
+ * string after the `@` themselves.
+ *
+ * ## What the answer is allowed to decide
+ *
+ * WHICH release, and nothing else. The release body is publisher-controlled
+ * text on somebody else's repository and can say anything, so it selects a tag
+ * and then every downstream check — SHA256SUMS, the digest pin recorded in
+ * `installed.json`, `packTagMatchesVersion` — runs exactly as it would for a
+ * typed tag. A body that lies picks the wrong release; it cannot make an
+ * unverified artifact install.
+ *
+ * ## Ambiguity is a refusal, not a guess
+ *
+ * A 7-character prefix colliding across two releases is precisely why git
+ * itself refuses to resolve one, and picking either would install code the user
+ * did not ask for while reporting success. The matching tags and their full
+ * commits go in the message so the next command can be typed from it.
+ */
+export async function resolveTagForCommit(spec: PackSpec, commit: string): Promise<string | null> {
+  const prefix = commit.toLowerCase();
+  const url = `${githubApiBase()}/repos/${spec.owner}/${spec.repo}/releases?per_page=100`;
+  let payload: unknown;
+  try {
+    // No credential is required — a pack has to be public to install at all,
+    // since installs are anonymous HTTPS. A token is taken when one happens to
+    // be in the environment purely for the rate limit (60/hour → 5000).
+    const token = (process.env.GITHUB_TOKEN || process.env.GH_TOKEN || "").trim();
+    const response = await fetch(url, {
+      headers: {
+        ...(token ? { Authorization: `Bearer ${token}` } : {}),
+        Accept: "application/vnd.github+json",
+        "X-GitHub-Api-Version": "2022-11-28",
+        "User-Agent": "failproofai",
+      },
+      signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
+      redirect: "follow",
+    });
+    if (!response.ok) throw new Error(`GET ${url} returned ${response.status}`);
+    payload = await response.json();
+  } catch (err) {
+    // Deliberately NOT a fall-through to "treat it as a literal tag". A lookup
+    // that could not run has established nothing — the fall-through would then
+    // 404 on an asset URL built from a commit, and report a missing SHA256SUMS
+    // for a release nobody ever claimed existed. Name the thing that failed.
+    throw new Error(
+      `could not resolve commit ${commit} in ${spec.owner}/${spec.repo}: ${errText(err)}. ` +
+        `Name the release tag instead if you know it.`,
+    );
+  }
+
+  // Imported here rather than at the top of the file: `pack-cli` imports this
+  // module, so a static import would close a cycle for the sake of one format
+  // reader. The reader has to be the SAME one `publish` writes with, or the two
+  // drift silently and a listing and an install disagree about the same body.
+  const { parseReleaseBody } = await import("./pack-cli");
+  const releases = Array.isArray(payload)
+    ? (payload as Array<{ tag_name?: unknown; body?: unknown }>)
+    : [];
+  const matches: Array<{ tag: string; commit: string }> = [];
+  for (const release of releases) {
+    const tag = typeof release.tag_name === "string" ? release.tag_name : "";
+    // A tag from the API becomes part of an asset URL, so it passes the same
+    // check a typed one does rather than being trusted for having come back
+    // over HTTPS.
+    if (!tag || !TAG_RE.test(tag)) continue;
+    const facts = parseReleaseBody(typeof release.body === "string" ? release.body : "");
+    // The typed string is a PREFIX of the recorded commit, which is the
+    // direction git works in and therefore the one a person copying out of
+    // `git log` will have.
+    if (facts.commit && facts.commit.startsWith(prefix)) matches.push({ tag, commit: facts.commit });
+  }
+
+  if (matches.length > 1) {
+    throw new Error(
+      `commit ${commit} matches ${matches.length} releases of ${spec.owner}/${spec.repo}: ` +
+        matches.map((m) => `${m.tag} (${m.commit})`).join(", ") +
+        `. Name one of those tags, or type more of the commit.`,
+    );
+  }
+  return matches.length === 1 ? matches[0].tag : null;
+}
+
+/**
+ * The concrete tag to install, from whatever the user typed after the `@`.
+ *
+ * Three shapes, in the order they are tried:
+ *
+ *  - nothing — resolved from `releases/latest`, as it always was;
+ *  - a hex string — looked up as a COMMIT first, because typing one is how a
+ *    person asks for that; and
+ *  - anything else — taken literally.
+ *
+ * A hex string that matches no release falls back to being a literal tag. A
+ * repository may genuinely have a tag named `abc1234`, and refusing to install
+ * a tag that exists because it also looks like a commit would be a regression
+ * for somebody who never asked for commit resolution at all.
+ */
+export async function resolveSpecTag(parsed: PackSpec): Promise<string> {
+  if (parsed.tag === null) return resolveLatestTag(parsed);
+  if (!PACK_COMMIT_RE.test(parsed.tag)) return parsed.tag;
+  return (await resolveTagForCommit(parsed, parsed.tag)) ?? parsed.tag;
+}
+
 /**
  * The canonical spelling recorded in `installed.json`.
  *
@@ -324,6 +455,8 @@ interface FetchedPack {
   version: string;
   policies: PolicyCatalogEntry[];
   effect?: PolicyEffect;
+  /** The git commit the publisher built this from, when they had one. */
+  commit?: string;
   artifact: Buffer;
   artifactDigest: string;
 }
@@ -350,6 +483,18 @@ export interface PackAddOptions {
   only?: string[];
   categories?: string[];
   all?: boolean;
+  /**
+   * Add to what is already on, rather than replacing it.
+   *
+   * Set by the CLI FLAGS (`--policy`, `--category`) and deliberately NOT by the
+   * interactive picker: the picker's list is the complete answer — unticking
+   * everything means enable none — while a flag on an already-installed pack
+   * means "also turn these on". Without the distinction, following the pack
+   * README's own path (take the defaults, then add a category) silently
+   * switched the defaults off. No effect on a first install, where there is
+   * nothing to merge with.
+   */
+  merge?: boolean;
   /** Agent CLIs this pack should guard. Omitted means all of them. */
   clis?: string[];
 }
@@ -395,6 +540,8 @@ export interface PackPreview {
   id: string;
   version: string;
   effect: PolicyEffect;
+  /** The git commit the publisher built this from, when they had one. */
+  commit?: string;
   policies: PolicyCatalogEntry[];
   /** The exact source the preview was read from, tag resolved and pinned. */
   source: string;
@@ -421,10 +568,7 @@ export async function fetchPackPreview(source: string): Promise<PackPreview> {
   }
   const parsed = parsePackSpec(source);
   const resolvedFromLatest = parsed.tag === null;
-  const spec: PinnedPackSpec =
-    parsed.tag !== null
-      ? { ...parsed, tag: parsed.tag }
-      : { ...parsed, tag: await resolveLatestTag(parsed) };
+  const spec: PinnedPackSpec = { ...parsed, tag: await resolveSpecTag(parsed) };
 
   const checksums = (await fetchBytes(packAssetUrl(spec, PACK_CHECKSUMS_ASSET))).toString("utf8");
   const manifestBytes = await fetchBytes(packAssetUrl(spec, PACK_MANIFEST_ASSET));
@@ -443,7 +587,9 @@ export async function fetchPackPreview(source: string): Promise<PackPreview> {
     throw new Error(`${PACK_MANIFEST_ASSET} is not valid JSON: ${errText(err)}`);
   }
   if (!raw || typeof raw !== "object") throw new Error(`${PACK_MANIFEST_ASSET} is not an object`);
-  const value = raw as { id?: unknown; version?: unknown; policies?: unknown; effect?: unknown };
+  const value = raw as {
+    id?: unknown; version?: unknown; policies?: unknown; effect?: unknown; commit?: unknown;
+  };
   const identity = parsePackIdentity(value);
   if (!Array.isArray(value.policies) || value.policies.length === 0) {
     throw new Error("pack manifest declares no policies");
@@ -452,6 +598,7 @@ export async function fetchPackPreview(source: string): Promise<PackPreview> {
     id: identity.id,
     version: identity.version,
     effect: identity.effect,
+    ...(identity.commit ? { commit: identity.commit } : {}),
     policies: value.policies.map((policy, i) => parsePackPolicy(identity.id, policy, i)),
     source: formatPackSpec(spec),
     resolvedFromLatest,
@@ -498,7 +645,9 @@ async function fetchPack(spec: PinnedPackSpec): Promise<FetchedPack> {
     throw new Error(`${PACK_MANIFEST_ASSET} is not valid JSON: ${errText(err)}`);
   }
   if (!parsed || typeof parsed !== "object") throw new Error(`${PACK_MANIFEST_ASSET} is not an object`);
-  const raw = parsed as { id?: unknown; version?: unknown; policies?: unknown; effect?: unknown };
+  const raw = parsed as {
+    id?: unknown; version?: unknown; policies?: unknown; effect?: unknown; commit?: unknown;
+  };
   const identity = parsePackIdentity(raw);
   if (!Array.isArray(raw.policies) || raw.policies.length === 0) {
     throw new Error("pack manifest declares no policies");
@@ -513,6 +662,7 @@ async function fetchPack(spec: PinnedPackSpec): Promise<FetchedPack> {
     version: identity.version,
     policies,
     ...(raw.effect !== undefined ? { effect: identity.effect } : {}),
+    ...(identity.commit ? { commit: identity.commit } : {}),
     artifact,
     artifactDigest,
   };
@@ -542,7 +692,9 @@ export function slugifyCategory(category: string): string {
  */
 function resolveSelection(
   policies: PolicyCatalogEntry[],
-  opts: { only?: string[]; categories?: string[]; all?: boolean } | undefined,
+  opts:
+    | { only?: string[]; categories?: string[]; all?: boolean; merge?: boolean }
+    | undefined,
   previous: string[] | null | undefined,
   previouslyInstalled: boolean,
 ): { enabled: string[] | null; reason: SelectionReason } {
@@ -578,8 +730,29 @@ function resolveSelection(
   // opposite of what was chosen, reported as "the pack's defaults". Presence of
   // the key is the signal, not its length.
   if (opts?.only !== undefined || opts?.categories?.length) {
+    // `merge` separates the two callers that both arrive here with a list.
+    //
+    // The PICKER's list is the complete answer: what is ticked is what should
+    // be on, and unticking everything means enable none — which is why an
+    // expressed selection replaces at all, and must keep replacing.
+    //
+    // A FLAG is an addition. `policies add <pack> --category Git` on a pack
+    // that is already installed means "also turn Git on", and replacing there
+    // switched off everything the user had. Following the pack README's own
+    // path — take the defaults, then add a category — left them with SIX
+    // policies on where they had started with ten, silently, from a command
+    // whose first word is `add`.
+    //
     // Kept in the pack's declared order, which is the order everything else
     // presents them in.
+    if (opts.merge && previouslyInstalled) {
+      // Already the whole catalog. Adding to everything is everything, and
+      // `null` is how "the whole pack" is recorded — materialising it into a
+      // list here would freeze out any policy a later version adds.
+      if (previous === null) return { enabled: null, reason: "carried" };
+      for (const name of previous ?? []) picked.add(name);
+      return { enabled: available.filter((n) => picked.has(n)), reason: "added" };
+    }
     return { enabled: available.filter((n) => picked.has(n)), reason: "selected" };
   }
 
@@ -592,7 +765,7 @@ function resolveSelection(
   return { enabled: policies.filter((p) => p.defaultEnabled).map((p) => p.name), reason: "defaults" };
 }
 
-export type SelectionReason = "all" | "selected" | "carried" | "defaults";
+export type SelectionReason = "all" | "selected" | "carried" | "defaults" | "added";
 
 /**
  * Import the artifact and check it registers what the manifest promised.
@@ -669,9 +842,7 @@ export async function addPack(
   // Resolve BEFORE anything is written, and pin the concrete result. A tagless
   // source is a convenience for the person typing; what the machine records must
   // always name one release.
-  const spec: PinnedPackSpec = parsed.tag
-    ? { ...parsed, tag: parsed.tag }
-    : { ...parsed, tag: await resolveLatestTag(parsed) };
+  const spec: PinnedPackSpec = { ...parsed, tag: await resolveSpecTag(parsed) };
   const resolvedFromLatest = parsed.tag === null;
   const fetched = await fetchPack(spec);
   // Checked here, before a byte is written and before the artifact is imported,
@@ -735,8 +906,15 @@ export async function addPack(
     const at = source.lastIndexOf("@");
     return at > source.indexOf(":") ? source.slice(0, at) : source;
   };
+  // Only when it is the SAME id. This binds an id to the origin it first came
+  // from, and `priorRecordFor` also answers with a same-DIGEST record under a
+  // different id — for which the check is not just unnecessary but wrong: a
+  // second pack that happens to ship identical bytes from another repository is
+  // not the installed one being hijacked, and refusing it said `pack id X is
+  // already installed from Y` while naming an id the user never asked for.
   if (
     prior &&
+    prior.id === fetched.id &&
     !prior.source.startsWith("bundled:") &&
     repoOf(prior.source) !== repoOf(formatPackSpec(spec))
   ) {
@@ -753,16 +931,42 @@ export async function addPack(
     entry: artifactRel,
     sha256: fetched.artifactDigest,
     policies: fetched.policies,
+    // Provenance, carried through from the manifest so `policies` and the
+    // dashboard can say which source produced what is installed. NOT part of
+    // verification — `sha256` above is the pin, and this is a label beside it.
+    ...(fetched.commit ? { commit: fetched.commit } : {}),
     ...(fetched.effect ? { effect: fetched.effect } : {}),
     ...(enabled ? { enabled } : {}),
     // Omitted, not written as the full list, when the user did not narrow it.
     // An absent `clis` means "every agent", and it keeps meaning that when a
     // thirteenth CLI is supported — whereas a materialised list of twelve would
     // silently exclude the new one from every pack installed before it existed.
-    ...(opts?.clis ? { clis: opts.clis } : {}),
+    //
+    // A prior narrowing is CARRIED when this caller named none, for the same
+    // reason `enabled` is: `upsertInstalled` replaces the row wholesale, so
+    // writing nothing here threw the user's scope away. A pack scoped to Claude
+    // silently started guarding all eleven agents on the next `policies add` —
+    // the same shape as the bug `merge` fixes, in the widening direction, which
+    // is the worse one: it over-enforces, on agents nobody chose.
+    //
+    // `merge === false` is the ONE caller this must not do it for. The picker
+    // says "every agent" by leaving `clis` absent (pack-cli.ts, where a full
+    // tick deliberately writes nothing) — so for it, absent is an ANSWER, and
+    // carrying a prior narrowing would make widening back to all impossible.
+    // Everywhere else absent means no opinion was expressed.
+    ...(opts?.clis
+      ? { clis: opts.clis }
+      : opts?.merge !== false && prior?.clis
+        ? { clis: prior.clis }
+        : {}),
   };
 
-  const absorbed = upsertInstalled(record);
+  // `--all` is an ANSWER, not a silence. `upsertInstalled` carries an absorbed
+  // row's narrower selection onto a record that names none — which is right for
+  // a rename nobody expressed an opinion about, and wrong for a caller who just
+  // said "everything". Left ungated, `policies add <renamed pack> --all`
+  // reported the whole catalog and wrote the old id's one-policy list.
+  const absorbed = upsertInstalled(record, reason !== "all");
   return {
     replaced: absorbed,
     id: fetched.id,
@@ -816,23 +1020,93 @@ export function setPackPolicyEnabled(
   return { ok: true };
 }
 
-export function removePack(id: string): boolean {
+/**
+ * The spellings of a pack id that `remove` accepts.
+ *
+ * Exactly one used to work — the stored id, byte for byte — and it was a form
+ * shown nowhere on its own, so every spelling a user could SEE or had TYPED
+ * failed:
+ *
+ *   add    failproofai/policies                stores `FailproofAI/policies`
+ *   remove failproofai/policies                no installed pack with id …
+ *   remove FailproofAI/policies@06b802b63f4f   no installed pack with id …
+ *
+ * The first is what they installed it with — GitHub is case-insensitive, so
+ * `add` accepts any case and then records the CANONICAL id off the manifest.
+ * The second is the listing's own heading, copied. Both are refused, and the
+ * one that works appears only as half of that heading. A pack whose owner
+ * happens to be lowercase (`chhhee10/deploy-guard`) removes on the first try,
+ * which is what makes this look like the core pack being unremovable rather
+ * than a name-matching bug.
+ *
+ * So: case-insensitive, and an `@<version>` suffix is dropped. A pack id cannot
+ * contain `@` — `PACK_ID_RE` forbids it — so splitting at the last one is
+ * unambiguous. The version is not checked against what is installed: there is
+ * only ever one row per id, and refusing `pack@1.0.0` because 1.0.1 is
+ * installed would be the same unhelpfulness in a new hat.
+ */
+function packIdMatches(stored: string, typed: string): boolean {
+  return bareId(stored).toLowerCase() === bareId(typed).toLowerCase();
+}
+
+/** The id with any `@<version>` suffix and surrounding space removed, CASE
+ *  INTACT — the exact-match pass needs the original spelling. */
+function bareId(value: string): string {
+  const trimmed = value.trim();
+  const at = trimmed.lastIndexOf("@");
+  return (at > 0 ? trimmed.slice(0, at) : trimmed).trim();
+}
+
+/** Two installed packs answer to one loosely-typed name. Thrown rather than
+ *  guessed at: the caller prints the canonical ids so the user can say which. */
+export class AmbiguousPackId extends Error {
+  constructor(readonly candidates: string[], typed: string) {
+    super(
+      `${typed} matches ${candidates.length} installed packs: ${candidates.join(", ")}. ` +
+        `Name one of them exactly.`,
+    );
+    this.name = "AmbiguousPackId";
+  }
+}
+
+/** The id actually removed — the CANONICAL one, not the spelling that was
+ *  typed — or null when nothing matched. Callers report it back so a user who
+ *  typed a different case learns the name the machine holds. */
+export function removePack(id: string): string | null {
   const manifestPath = resolve(packsRoot(), "installed.json");
-  if (!existsSync(manifestPath)) return false;
+  if (!existsSync(manifestPath)) return null;
   let raw: { schemaVersion?: number; packs?: InstalledPackRecord[] };
   try {
     raw = JSON.parse(readFileSync(manifestPath, "utf8"));
   } catch {
-    return false;
+    return null;
   }
   const packs = Array.isArray(raw.packs) ? raw.packs : [];
-  const remaining = packs.filter((p) => p?.id !== id);
-  if (remaining.length === packs.length) return false;
+  // EXACT first, and a loose match only when it is the only one.
+  //
+  // Ids are stored and upserted with `===`, so `Acme/guard` and `acme/guard`
+  // are two rows on one machine — and a `find()` over the loose matcher then
+  // removed whichever happened to sit first, which is not the pack that was
+  // named. A convenience for typing a name is not worth uninstalling something
+  // else, so an ambiguous name is REFUSED and the candidates are printed:
+  // asking again with the exact id is a keystroke, and the alternative is
+  // silently deactivating a pack the user still wanted enforcing.
+  const exact = packs.find((p) => p?.id === bareId(id));
+  const loose = packs.filter((p) => p?.id && packIdMatches(p.id, id));
+  if (!exact && loose.length > 1) {
+    throw new AmbiguousPackId(
+      loose.map((p) => p.id).filter((v): v is string => typeof v === "string"),
+      id,
+    );
+  }
+  const removed = exact ?? loose[0];
+  const remaining = packs.filter((p) => p !== removed);
+  if (!removed || remaining.length === packs.length) return null;
   // The artifact is left on disk deliberately: it is content-addressed and inert
   // once nothing points at it, so keeping it makes a re-add offline-safe. Same
   // choice the cloud reconciler makes.
   writeAtomic(manifestPath, JSON.stringify({ schemaVersion: 1, packs: remaining }, null, 2) + "\n");
-  return true;
+  return removed.id;
 }
 
 /**
@@ -855,7 +1129,17 @@ export function removePack(id: string): boolean {
  * say so — an earlier version deleted the old row silently, taking the user's
  * selection and the enforcement it gave them with it.
  */
-function upsertInstalled(record: InstalledPackRecord): string[] {
+function upsertInstalled(
+  record: InstalledPackRecord,
+  /**
+   * False when the record's absent `enabled` is an EXPRESSED "everything"
+   * (`--all`) rather than an unexpressed one. Carrying there overrides the
+   * user's own answer with a set they left behind under the old id, and the
+   * returned `AddedPack` still reports the whole catalog — installed says
+   * three, disk enforces one.
+   */
+  carryAbsorbedSelection = true,
+): string[] {
   const manifestPath = resolve(packsRoot(), "installed.json");
   let packs: InstalledPackRecord[] = [];
   if (existsSync(manifestPath)) {
@@ -876,7 +1160,7 @@ function upsertInstalled(record: InstalledPackRecord): string[] {
     .map((p) => p.id);
   // The selection the user had under the old id is theirs — carry it, rather
   // than resetting them to defaults because a publisher renamed something.
-  if (!record.enabled) {
+  if (carryAbsorbedSelection && !record.enabled) {
     const prior = packs.find((p) => absorbed.includes(p?.id));
     const carried = prior?.enabled?.filter((n) =>
       (record.policies as Array<{ name?: unknown }> | undefined)?.some((rp) => rp?.name === n),

package/src/hooks/policy-catalog.ts

@@ -169,7 +169,15 @@ export const POLICY_CATALOG: PolicyCatalogEntry[] = [
     // PermissionRequest is carried over from the merged-in `block-self-pause`.
     // It is a real enforcement point on Copilot and Devin, and dropping it would
     // have left this guard blind on both.
-    match: { events: ["PreToolUse", "PermissionRequest"], toolNames: ["Bash"] },
+    // Write/Edit are here because the Bash-only surface left the shortest way
+    // through this guard unguarded: the agent never needs a shell to overwrite
+    // `~/.failproofai/policies-config.json` with `{"enabledPolicies":[]}` — it
+    // just writes the file. Every CLI canonicalizes its own file tool's path
+    // key to `file_path`, so one branch covers all of them.
+    match: {
+      events: ["PreToolUse", "PermissionRequest"],
+      toolNames: ["Bash", "Write", "Edit", "NotebookEdit"],
+    },
     defaultEnabled: true,
     alwaysOn: true,
     category: "Dangerous Commands",

package/src/hooks/policy-evaluator.ts

@@ -4,6 +4,16 @@
  */
 import type { HookEventType, SessionMetadata } from "./types";
 import type { PolicyContext, HooksConfig } from "./policy-types";
+// Read from the layer that owns it rather than restated here — restating a
+// pack id is exactly how `failproofai/builtins` and `failproofai/core` both
+// outlived their rename. This is on the hook path, so the cost was measured
+// rather than assumed: bundling policy-evaluator with this import is 38,627
+// bytes against 37,491 without it, because only the constant survives
+// tree-shaking. 1.1 KB is not worth a second copy of a name that has already
+// drifted twice.
+import { CORE_SOURCE } from "./pack-store";
+import { packPolicyParamKey, parsePackPolicyName } from "./pack-param-key";
+export { packPolicyParamKey } from "./pack-param-key";
 import { DEFAULT_POLICY_NAMESPACE, getPoliciesForEvent } from "./policy-registry";
 import { hookLogInfo, hookLogWarn } from "./hook-logger";
 import { trackHookEvent } from "./hook-telemetry";
@@ -28,6 +38,61 @@ export interface EvaluationResult {
 }
 
 
+/**
+ * The config key a PACK policy's parameters are stored under.
+ *
+ * Version-less on purpose. A pack policy registers as
+ * `pack/<id>@<version>/<name>`, so a key carrying the version would be orphaned
+ * by every republish — the parameters would read as unset the moment the pack
+ * was upgraded, which is the same failure `enabled` avoids by outliving the
+ * version it was chosen against.
+ *
+ * Exported because the DASHBOARD writes this key and the evaluator reads it.
+ * They disagreed before — the dashboard wrote the bare policy name while the
+ * evaluator looked up the fully qualified one and fell back to bare only inside
+ * the `failproofai/` namespace — so a parameter saved through the UI was
+ * displayed as saved and ignored at runtime, on every pack including our own.
+ * One function so the two cannot drift again.
+ */
+
+/**
+ * The parameters a PACK policy actually runs with, resolved out of a config's
+ * `policyParams` map: the stable qualified key first, then the BARE name for
+ * our own pack alone.
+ *
+ * The bare read is the migration. Every `policyParams["block-sudo"]` already on
+ * disk — written by a build that predates packs, or by the dashboard before it
+ * qualified its keys — means the builtin under the name it always had.
+ *
+ * It is scoped to our pack because a policy name is unique only WITHIN a pack:
+ * two installed packs may each declare a `block-sudo`, and a bare key cannot
+ * say which was meant. Handing a stranger's pack our pack's configuration runs
+ * a third party's code on parameters chosen for ours.
+ *
+ * Exported because the DASHBOARD's read side resolves the same lookup, and it
+ * resolved it differently — an UNSCOPED bare fallback — so a stranger's pack
+ * declaring `block-sudo` was SHOWN our saved parameters while this function
+ * handed that policy the schema defaults. The config modal seeds its inputs
+ * from what was shown and Save writes them back under the stranger's own key,
+ * which is the point a display lie turns into configuration that really runs.
+ * One function so the two cannot diverge again.
+ */
+export function readPackPolicyParams(
+  policyParams: Record<string, Record<string, unknown>> | undefined,
+  packId: string,
+  policyName: string,
+): Record<string, unknown> | undefined {
+  if (!policyParams) return undefined;
+  const qualified = policyParams[packPolicyParamKey(packId, policyName)];
+  if (qualified) return qualified;
+  // Case-insensitively: the id reaches here from a manifest and from a source
+  // somebody typed, and GitHub treats `failproofai/policies` and
+  // `FailproofAI/policies` as one repository.
+  if (packId.toLowerCase() === CORE_SOURCE.toLowerCase()) return policyParams[policyName];
+  return undefined;
+}
+
+
 /**
  * Look up policy params for a canonical policy name in the user config,
  * tolerating either flat ("block-force-push") or qualified
@@ -35,7 +100,9 @@ export interface EvaluationResult {
  *
  * The flat-key fallback is intentionally limited to the default namespace
  * so namespace isolation is preserved: `policyParams.foo` only matches
- * `failproofai/foo`, never `myorg/foo` or `custom/foo`.
+ * `failproofai/foo`, never `myorg/foo` or `custom/foo`. A `pack/...` name gets
+ * the same isolation from `readPackPolicyParams` and returns before reaching
+ * that branch, so the two fallbacks never both apply to one name.
  */
 function getConfigParamsFor(
   config: HooksConfig | undefined,
@@ -44,6 +111,15 @@ function getConfigParamsFor(
   if (!config?.policyParams) return undefined;
   const canonicalParams = config.policyParams[canonicalName];
   if (canonicalParams) return canonicalParams;
+
+  // A pack policy: qualified key, then the bare name for our pack only. Shared
+  // with the dashboard's read side rather than restated, so what is displayed
+  // stays what runs.
+  const packPolicy = parsePackPolicyName(canonicalName);
+  if (packPolicy) {
+    return readPackPolicyParams(config.policyParams, packPolicy.packId, packPolicy.name);
+  }
+
   const defaultPrefix = `${DEFAULT_POLICY_NAMESPACE}/`;
   if (!canonicalName.startsWith(defaultPrefix)) return undefined;
   return config.policyParams[canonicalName.slice(defaultPrefix.length)];

package/src/hooks/tui.ts

@@ -108,6 +108,8 @@ const RADIO_OFF = "○";
 export const CHECK_ON = "◼";
 export const CHECK_OFF = "◻";
 export const CARET = "❯";
+/** The return key, as the multi-select hints already spell it. */
+export const CARET_RETURN = "↵";
 const MARK = "\u25AE\u25AE"; // ▮▮ — the brand mark, per the design system
 
 // ── color ─────────────────────────────────────────────────────────────────
@@ -933,6 +935,24 @@ export function promptText(opts: PromptTextOptions): Promise<string | null> {
     });
   }
 
+  // A default nobody can see is a default nobody uses.
+  //
+  // `defaultValue` is applied on an empty submit and is otherwise INVISIBLE, so
+  // every prompt carrying one had to remember to spell it into its own hint —
+  // and the one where it mattered most, "Where should this publish?", spelled
+  // out the value while never saying that return was the key that took it.
+  // Somebody looking at a prefilled-looking placeholder types the whole thing
+  // out again. Owned here so a prompt cannot be added without it.
+  //
+  // Never for a masked prompt: those hold credentials, and the entire reason
+  // the characters are hidden is that the screen is being shared or recorded.
+  const hintText = [
+    opts.defaultValue && !opts.mask ? `${CARET_RETURN} ${opts.defaultValue}` : "",
+    opts.hint ?? "",
+  ]
+    .filter(Boolean)
+    .join("  ·  ");
+
   return new Promise((resolve) => {
     let value = "";
     const draw = (error?: string) => {
@@ -942,7 +962,7 @@ export function promptText(opts: PromptTextOptions): Promise<string | null> {
       // steps aside as soon as there is a real answer to look at. Keeping both
       // on one line put the example and the input side by side, which is the
       // arrangement most likely to make somebody wonder which one is theirs.
-      const hint = opts.hint && value.length === 0 ? `  ${c.dim(opts.hint)}` : "";
+      const hint = hintText && value.length === 0 ? `  ${c.dim(hintText)}` : "";
       // Truncate to ONE physical row. `\r\x1b[2K` erases the row the cursor is
       // on and nothing above it — so a line wider than the terminal wraps, the
       // erase reaches only its last row, and every keystroke leaves the earlier