failproofai 1.0.2-beta.8 → 1.0.2

package/src/hooks/custom-hooks-loader.ts

@@ -29,7 +29,7 @@ import {
 import { findProjectConfigDir } from "./hooks-config";
 import { trackHookEvent } from "./hook-telemetry";
 import { getInstanceId } from "../../lib/telemetry-id";
-import type { CustomHook } from "./policy-types";
+import type { CustomHook, PolicyCatalogEntry } from "./policy-types";
 import type { CloudManagedPolicyArtifact } from "./cloud-managed-policies";
 import type { ResolvedPack } from "./pack-manifest";
 import { customPoliciesDir, shimsDir } from "./fp-home";
@@ -303,6 +303,18 @@ export interface LoadAllResult {
   conventionSources: ConventionSource[];
   /** Import failures keyed by pack id, including artifacts that registered no hooks. */
   packFailures: Map<string, PolicyLoadFailure>;
+  /**
+   * Every pack id that shares one artifact, keyed by the id the collapse kept.
+   *
+   * Packs with identical entry bytes load once, and every hook that comes back
+   * carries only the surviving record's id — so a registration recorded under
+   * it says nothing about the other pack. `missingGuards` skips a pack that
+   * appears in neither the failure map nor the registered map, which means an
+   * artifact that imports FINE but omits a policy only the non-winning record
+   * selected produced no guard at all: not registered, and not denied either.
+   * Only present for a path more than one pack resolved to.
+   */
+  packAliases: Map<string, string[]>;
 }
 
 export function customPolicyId(file: string, name: string): string {
@@ -448,9 +460,54 @@ export async function loadAllCustomHooks(
   // Resolved the same way and for the same reason — toward ENFORCEMENT, because
   // over-enforcing is visible to whoever hits it and under-enforcing is the
   // silent failure — and announced, so an operator can act on it.
+  /** `null` means "all of it" on both `enabled` and `clis`, so it absorbs any
+   *  list. Two lists become their union — never their intersection, which is
+   *  what dropping one of them amounted to. */
+  const unionSelection = (a: string[] | null, b: string[] | null): string[] | null =>
+    a === null || b === null ? null : [...new Set([...a, ...b])];
+
+  /**
+   * The CATALOGS have to merge for the same reason the selections do, and the
+   * union of `enabled` is what made it load-bearing: it lets the loser's policy
+   * run, and the catalog is where a pack declares that policy's PARAMS SCHEMA.
+   * `registerPolicy` reads the schema off `pack.policies` by name, so a policy
+   * present only in the loser's catalog registered with none — and a policy with
+   * no schema gets no defaults, so every value its publisher declared silently
+   * arrived as `undefined` in `ctx.params`. Enforcement running on the wrong
+   * numbers is the same silent-wrong as enforcement not running.
+   *
+   * Two packs sharing bytes is most likely a fork or a re-publish, and a fork
+   * that only re-declares a default changes no source at all — so differing
+   * catalogs behind one artifact is the EXPECTED shape here, not a corner.
+   *
+   * Winner precedence on a name both declare, because the merged record carries
+   * the winner's id and version and there is no merging two different defaults.
+   */
+  const unionCatalog = (
+    winner: PolicyCatalogEntry[],
+    other: PolicyCatalogEntry[],
+  ): PolicyCatalogEntry[] => [
+    ...winner,
+    ...other.filter((p) => !winner.some((w) => w.name === p.name)),
+  ];
+
   const packByPath = new Map<string, ResolvedPack>();
+  /**
+   * Every pack id behind each artifact path, not just the one that survived
+   * the collapse.
+   *
+   * A failure is recorded per PACK ID, and the collapse leaves one id holding
+   * the merged record — so an artifact with a syntax error marked the winner
+   * failed and said nothing about the other. `missingGuards` skips a pack that
+   * appears in neither the failure map nor the registered map, so the second
+   * pack's selected policies were absent, unguarded, and unreported: the exact
+   * silent under-enforcement the selection union was written to stop, arriving
+   * through the failure path instead.
+   */
+  const packIdsByPath = new Map<string, string[]>();
   for (const pack of opts?.packs ?? []) {
     const key = resolve(pack.path);
+    packIdsByPath.set(key, [...(packIdsByPath.get(key) ?? []), pack.id]);
     const existing = packByPath.get(key);
     if (!existing) {
       packByPath.set(key, pack);
@@ -458,11 +515,32 @@ export async function loadAllCustomHooks(
     }
     hookLogWarn(
       `packs ${existing.id} and ${pack.id} have identical source, so they share one artifact ` +
-        `and load as one pack; enforcing it if either asks to enforce`,
+        `and load as one pack; enforcing it if either asks to enforce, and taking ` +
+        `the union of what each has enabled and of the agents each guards`,
     );
-    if (existing.effect !== "enforce" && pack.effect === "enforce") {
-      packByPath.set(key, pack);
-    }
+    // The EFFECT was resolved toward enforcement here and the SELECTIONS were
+    // not, which made the collapse silently subtractive.
+    //
+    // Only the winner's `enabled` reached the tag, and `handler.ts` gates every
+    // hook on that one list — so two packs sharing bytes, one having taken
+    // `foo` and the other `bar`, registered whichever list won and dropped the
+    // other's policy entirely. `pack-failclosed.ts` ignores a pack absent from
+    // the registered map, so nothing reported it: a policy the user had
+    // installed and enabled simply never ran. `clis` had the same shape — a
+    // pack scoped to one agent decided the scope for both.
+    //
+    // Unioned, for the reason the effect is resolved toward enforcement: over-
+    // enforcing is visible to whoever hits it, under-enforcing is silent. `null`
+    // means "everything" on both fields, so it absorbs any list rather than
+    // being intersected away.
+    const winner = existing.effect !== "enforce" && pack.effect === "enforce" ? pack : existing;
+    const other = winner === existing ? pack : existing;
+    packByPath.set(key, {
+      ...winner,
+      policies: unionCatalog(winner.policies, other.policies),
+      enabled: unionSelection(winner.enabled, other.enabled),
+      clis: unionSelection(winner.clis, other.clis),
+    });
   }
 
   // 1. Explicit custom policy paths. Accept a string for callers/configs using
@@ -489,7 +567,11 @@ export async function loadAllCustomHooks(
           verifyEntrySha:
             cloudManaged?.sha256 ?? pack?.sha256,
         });
-        if (failure && pack) packFailures.set(pack.id, failure);
+        // Every id behind these bytes. One artifact, one import, one failure —
+        // but as many fail-closed guards as there are packs depending on it.
+        if (failure && pack) {
+          for (const id of packIdsByPath.get(absPath) ?? [pack.id]) packFailures.set(id, failure);
+        }
         for (const hook of getCustomHooks().slice(hooksBefore)) {
           const tagged = hook as CustomHook & {
             __policyId?: string;
@@ -510,7 +592,10 @@ export async function loadAllCustomHooks(
       }
     } else {
       hookLogWarn(`custom policy path not found: ${absPath}`);
-      if (pack) packFailures.set(pack.id, { type: "path_missing", reason: `path missing: ${absPath}` });
+      if (pack) {
+        const missing = { type: "path_missing", reason: `path missing: ${absPath}` } as const;
+        for (const id of packIdsByPath.get(absPath) ?? [pack.id]) packFailures.set(id, missing);
+      }
     }
   }
 
@@ -652,5 +737,10 @@ export async function loadAllCustomHooks(
     }
   }
 
-  return { hooks: allHooks, conventionSources, packFailures };
+  const packAliases = new Map<string, string[]>();
+  for (const [path, ids] of packIdsByPath) {
+    const winner = packByPath.get(path);
+    if (winner && ids.length > 1) packAliases.set(winner.id, ids);
+  }
+  return { hooks: allHooks, conventionSources, packFailures, packAliases };
 }

package/src/hooks/handler.ts

@@ -44,7 +44,7 @@ import { hookLogInfo, hookLogWarn } from "./hook-logger";
 import { readStdinPayload } from "./read-stdin";
 import { readActiveCloudManagedPolicies, type CloudManagedPolicyArtifact } from "./cloud-managed-policies";
 import { hasInstalledPacks, readInstalledPacks, type PackError, type ResolvedPack } from "./pack-manifest";
-import { missingGuards, packFailureReason } from "./pack-failclosed";
+import { missingGuards, packFailureReason, combinedGuardMatch, guardsCover } from "./pack-failclosed";
 import { readActivePause, type ActivePause } from "./session-pause";
 import { layoutWarningForHook } from "./fp-reset";
 
@@ -455,9 +455,18 @@ export async function evaluateHookEvent(
         // a pack too; once the shim stops, nothing else registers by name.
         if (pack && enabledBuiltinNames.has(hook.name)) continue;
         if (pack) {
-          const seen = registeredByPack.get(pack.id) ?? new Set<string>();
-          seen.add(hook.name);
-          registeredByPack.set(pack.id, seen);
+          // Recorded against EVERY pack behind these bytes, not just the id the
+          // collapse kept. A shared artifact loads once and every hook carries
+          // the surviving record's id, so registering under it alone left the
+          // other pack in neither map — and `missingGuards` skips a pack in
+          // neither map, so an artifact that imported fine while omitting a
+          // policy only that pack had selected produced no guard: not
+          // registered, and not denied either.
+          for (const id of loadResult.packAliases?.get(pack.id) ?? [pack.id]) {
+            const seen = registeredByPack.get(id) ?? new Set<string>();
+            seen.add(hook.name);
+            registeredByPack.set(id, seen);
+          }
         }
         const hookName = hook.name;
         const conventionScope = (hook as CustomHook & { __conventionScope?: string }).__conventionScope;
@@ -570,16 +579,11 @@ export async function evaluateHookEvent(
           registered: registeredByPack,
           failed: loadResult.packFailures,
           disabled: disabledCustomPolicies,
+          cli,
         });
         if (guards.length > 0) {
           const reason = packFailureReason(guards);
-          const match = guards.length === 1
-            ? guards[0].match
-            : {
-                events: guards.every((g) => g.match.events)
-                  ? [...new Set(guards.flatMap((g) => g.match.events ?? []))]
-                  : undefined,
-              };
+          const match = combinedGuardMatch(guards);
           const name = "pack/failproofai-pack-unavailable";
           policyAttribution.set(name, {
             source: "pack",
@@ -589,13 +593,21 @@ export async function evaluateHookEvent(
           registerPolicy(
             name,
             "A policy pack this machine enforces could not be loaded",
-            async (): Promise<PolicyResult> =>
+            async (ctx): Promise<PolicyResult> => {
+              // The matcher is a union of both axes and the registry ANDs them,
+              // so being CALLED is not proof any guard covered this pair. Two
+              // packs scoped to (PreToolUse, Bash) and (PostToolUse, Write)
+              // produce a matcher that also catches (PreToolUse, Write) —
+              // neither pack's business. The pairing is decided here, where the
+              // real event and tool are known.
+              if (!guardsCover(guards, canonicalEventType, ctx.toolName)) return { decision: "allow" };
               // UserPromptSubmit instructs rather than denies, whatever the
               // missing policies declared: a deny there locks the user out of
               // their own agent, which is the one thing that stops them fixing it.
-              canonicalEventType === "UserPromptSubmit"
+              return canonicalEventType === "UserPromptSubmit"
                 ? { decision: "instruct", reason }
-                : { decision: "deny", reason },
+                : { decision: "deny", reason };
+            },
             match,
             // Above builtins (0) and custom (-1), so the short-circuit attributes
             // the deny to the missing pack rather than to whichever surviving

package/src/hooks/manager.ts

@@ -28,6 +28,7 @@ import { readActiveCloudManagedPolicies } from "./cloud-managed-policies";
 import { CORE_SOURCE, addPack, setPackPolicyEnabled } from "./pack-store";
 import type { ResolvedPack } from "./pack-manifest";
 import { hasInstalledPacks, readInstalledPacks } from "./pack-manifest";
+import { packPolicyParamKey } from "./policy-evaluator";
 import {
   chip,
   note,
@@ -951,10 +952,21 @@ export async function listHooks(cwd?: string): Promise<void> {
   // Names a `policyParams` key may legitimately use: every policy an installed
   // pack carries. Previously the compiled catalog, which no longer describes
   // what runs.
+  //
+  // BOTH spellings, because both are read at runtime. The dashboard writes the
+  // pack-qualified `packPolicyParamKey` and the evaluator prefers it; the bare
+  // name is the legacy key still honoured for our own pack. Knowing only the
+  // bare one made this command call every parameter saved through the UI a
+  // "possible typo" — and fire a `policy_params_validation_warning` for it —
+  // the moment the dashboard started qualifying its keys. Built with the shared
+  // helper rather than a third copy of the `pack/<id>/<name>` format.
   const knownPolicyNames = new Set<string>();
   try {
     for (const pack of readInstalledPacks().packs) {
-      for (const policy of pack.policies) knownPolicyNames.add(policy.name);
+      for (const policy of pack.policies) {
+        knownPolicyNames.add(policy.name);
+        knownPolicyNames.add(packPolicyParamKey(pack.id, policy.name));
+      }
     }
   } catch {
     // Unreadable manifest: skip the typo warning rather than invent one.
@@ -1032,7 +1044,20 @@ export async function listHooks(cwd?: string): Promise<void> {
   // finished `failproofai config` saw a header, a config path, and no next
   // step. Ours is named in full, the same way anyone else's pack is typed,
   // because it IS one.
-  if (packCount === 0) {
+  // `packCount` counts ENABLED policies, so a pack installed with everything
+  // switched off reaches zero the same way an empty machine does — and the
+  // advice for the two could not be more different. Telling somebody who has
+  // just unticked all 38 to `policies add FailproofAI/policies` sends them to
+  // install what they already have, and doing it would change nothing: the
+  // selection is what is empty, not the shelf.
+  const packsInstalled = (() => {
+    try {
+      return readInstalledPacks().packs.length;
+    } catch {
+      return 0;
+    }
+  })();
+  if (packCount === 0 && packsInstalled === 0) {
     footer.unshift(
       nextStep(
         `failproofai policies add ${CORE_SOURCE}`,
@@ -1042,6 +1067,15 @@ export async function listHooks(cwd?: string): Promise<void> {
       note("Someone else's:  failproofai policies add <owner>/<repo>", opts),
       note("Look first:      failproofai policies show <owner>/<repo>", opts),
     );
+  } else if (packCount === 0) {
+    footer.unshift(
+      nextStep(
+        "failproofai policies add",
+        `Nothing is enforcing: ${packsInstalled === 1 ? "the pack above is" : "the packs above are"} installed with everything switched off. Pick what should be on:`,
+        opts,
+      ),
+      note("Or by name:  failproofai policies add <policy>", opts),
+    );
   }
 
   if (installedScopes.length > 1) {