failproofai 1.0.4-beta.1 → 1.0.4-beta.2

package/README.md

@@ -14,11 +14,11 @@
 
 **Translations:** [简体中文](./docs/i18n/README.zh.md) · [日本語](./docs/i18n/README.ja.md) · [한국어](./docs/i18n/README.ko.md) · [Español](./docs/i18n/README.es.md) · [Português](./docs/i18n/README.pt-br.md) · [Deutsch](./docs/i18n/README.de.md) · [Français](./docs/i18n/README.fr.md) · [Русский](./docs/i18n/README.ru.md) · [हिन्दी](./docs/i18n/README.hi.md) · [Türkçe](./docs/i18n/README.tr.md) · [Tiếng Việt](./docs/i18n/README.vi.md) · [Italiano](./docs/i18n/README.it.md) · [العربية](./docs/i18n/README.ar.md) · [עברית](./docs/i18n/README.he.md)
 
-**See what your agents do. Stop known failures before they repeat.**
-Failproof AI works wherever your agents run: coding tools like Claude Code and
-Codex, chat gateways like Hermes, self-hosted assistants like OpenClaw, and agents
-you instrument yourself. It records each run and can block dangerous tool calls
-before they execute.
+**Observability and enforcement for every harness your agents run in.**
+Wherever your agents run, we see it — and we can say no. Failproof hooks 12 agent
+harnesses — coding CLIs like Claude Code and Codex, chat gateways like Hermes,
+self-hosted assistants like OpenClaw — capturing every run and blocking dangerous
+tool calls before they execute. 39 built-in policies. Zero latency. Runs locally.
 
 </div>
 
@@ -30,18 +30,17 @@ before they execute.
 
 ## Supported harnesses
 
-Sixteen harnesses in two classes are supported: fourteen coding CLIs, plus two
-gateways: Hermes, OpenClaw. The policy API and session history are shared; which
-events can block varies by harness.
+Twelve harnesses in two classes — ten coding CLIs, and two chat and assistant
+gateways (Hermes, OpenClaw). Same events, same policies, same session history,
+whichever one your agent runs in.
 
 Agents that run in none of them report through the [Python SDK](https://docs.befailproof.ai/reference/custom-agents),
 which gives you tracing, sessions and audits. Enforcement there needs a hook in
 your own runtime — [talk to us](mailto:support@befailproof.ai) and we'll map it.
 
-<!-- A 7-column table instead of inline <img> runs: table columns never re-wrap,
-     so the grid stays 2×7 at any window width (scrolling on very narrow screens
-     instead of collapsing into ragged orphan rows). Kept at exactly two full
-     rows — 14 CLIs is 7×2, where 6 columns would leave a two-cell orphan row. -->
+<!-- A 6-column table instead of inline <img> runs: table columns never re-wrap,
+     so the grid stays 2×6 at any window width (scrolling on very narrow screens
+     instead of collapsing into ragged orphan rows). -->
 <table align="center">
   <tr>
     <td align="center" width="96">
@@ -73,8 +72,6 @@ your own runtime — [talk to us](mailto:support@befailproof.ai) and we'll map i
         </picture>
       </a>
     </td>
-  </tr>
-  <tr>
     <td align="center" width="96">
       <a href="https://opencode.ai/" title="OpenCode">
         <picture>
@@ -91,14 +88,8 @@ your own runtime — [talk to us](mailto:support@befailproof.ai) and we'll map i
         </picture>
       </a>
     </td>
-    <td align="center" width="96">
-      <a href="https://grok.com" title="grok CLI (xAI)">
-        <picture>
-          <source media="(prefers-color-scheme: dark)" srcset="assets/logos/grok-dark.svg" />
-          <img src="assets/logos/grok-light.svg" alt="grok CLI" width="56" height="56" />
-        </picture>
-      </a>
-    </td>
+  </tr>
+  <tr>
     <td align="center" width="96">
       <a href="https://hermes-agent.nousresearch.com/" title="Hermes (hermes-agent)">
         <picture>
@@ -107,8 +98,6 @@ your own runtime — [talk to us](mailto:support@befailproof.ai) and we'll map i
         </picture>
       </a>
     </td>
-  </tr>
-  <tr>
     <td align="center" width="96">
       <a href="https://openclaw.ai/" title="OpenClaw (openclaw gateway)">
         <img src="assets/logos/openclaw.svg" alt="OpenClaw" width="56" height="56" />
@@ -132,8 +121,6 @@ your own runtime — [talk to us](mailto:support@befailproof.ai) and we'll map i
         <img src="assets/logos/antigravity.svg" alt="Antigravity CLI" width="56" height="56" />
       </a>
     </td>
-  </tr>
-  <tr>
     <td align="center" width="96">
       <a href="https://goose-docs.ai/" title="Goose (codename goose)">
         <picture>
@@ -142,54 +129,18 @@ your own runtime — [talk to us](mailto:support@befailproof.ai) and we'll map i
         </picture>
       </a>
     </td>
-    <td align="center" width="96">
-      <a href="https://github.com/QwenLM/qwen-code" title="Qwen Code (qwen)">
-        <img src="assets/logos/qwen.svg" alt="Qwen Code" width="56" height="56" />
-      </a>
-    </td>
-    <td align="center" width="96">
-      <a href="https://openrouter.ai/docs/guides/ori/harness" title="Ori (OpenRouter)">
-        <picture>
-          <source media="(prefers-color-scheme: dark)" srcset="assets/logos/ori-dark.svg" />
-          <img src="assets/logos/ori-light.svg" alt="Ori" width="56" height="56" />
-        </picture>
-      </a>
-    </td>
-    <td align="center" width="96">
-      <a href="https://github.com/cline/cline" title="Cline">
-        <img src="assets/logos/cline.png" alt="Cline" width="56" height="56" />
-      </a>
-    </td>
   </tr>
 </table>
 
 ## Install
 
-Give a compatible agent the Failproof AI skill if you want it to guide setup,
-inspect the machine, and route policy, audit, session, and Cloud work correctly:
-
-```sh
-npx skills add FailproofAI/skills
-```
-
-This installs the umbrella skill and its specialist siblings. To install only the
-umbrella, add `--skill failproofai`. Skills supply operating instructions; install
-and configure the product itself with:
-
 ```sh
 npm install -g failproofai
-failproofai config
-failproofai policies add FailproofAI/policies
-failproofai                         # dashboard on localhost:8020
+failproofai policies --install   # or just run `failproofai` and accept the first-run prompt
+failproofai
 ```
 
-Setup connects supported agents and installs the background service. It chooses no
-policy pack: before you add one, only `block-failproofai-commands` runs to stop an
-agent disabling Failproof AI.
-
-Connect Cloud without prompts with `failproofai config --token <machine-key>`. On a
-shared machine or in CI, set `FAILPROOFAI_CLOUD_TOKEN` and run `failproofai config`
-so the key does not appear in command history.
+39 built-in policies activate immediately. Dashboard at `localhost:8020`. Disable the first-run prompt with `FAILPROOFAI_NO_FIRST_RUN=1`.
 
 ---
 
@@ -206,8 +157,8 @@ so the key does not appear in command history.
 | `block-rm-rf` | Recursive file deletion |
 | `block-force-push` / `block-push-master` | `git push --force`, direct pushes to `main` |
 
-These policies protect files, credentials, infrastructure, databases, and agent
-workflows. Exact enforcement support varies by harness and event.
+The first five apply to any agent that can call a tool. The last three are the
+developer favourites — coding CLIs are the harness class we cover deepest.
 
 → [All 39 built-in policies](https://docs.befailproof.ai/policies/builtin)
 
@@ -244,33 +195,6 @@ Three decisions available to every policy:
 
 ---
 
-## Policy packs
-
-A policy pack is a versioned set of policies published from a public GitHub
-repository. Inspect one before installing it:
-
-```sh
-failproofai policies show FailproofAI/policies
-failproofai policies add FailproofAI/policies
-```
-
-Anything with a slash is a pack source; anything without one is a policy name.
-You can install selected categories or policies, and pin a release when needed.
-
-```sh
-failproofai policies add FailproofAI/policies --category git,database
-failproofai policies add owner/repo@a1b2c3d4e5f6
-```
-
-Browse published packs in the [Policy Hub](https://befailproof.ai/policy-hub/), or
-run `failproofai publish --init` to start your own. Observe mode lets a pack record
-what it would have done without blocking: `failproofai publish --effect observe`.
-
-→ [Policy packs](https://docs.befailproof.ai/policies/packs) ·
-[Publish a pack](https://docs.befailproof.ai/policies/publish-a-pack)
-
----
-
 ## Observability
 
 Enforcement is one half. The other half is seeing what the agent actually did.
@@ -307,7 +231,7 @@ own cluster is available on the Enterprise plan.
 |---|---|
 | [Quickstart](https://docs.befailproof.ai/start/quickstart) | Install, connect a harness, see the first run |
 | [Concepts](https://docs.befailproof.ai/start/concepts) | How the hook system works |
-| [Supported harnesses](https://docs.befailproof.ai/reference/harnesses) | All 16, and what each one can enforce |
+| [Supported harnesses](https://docs.befailproof.ai/reference/harnesses) | All 12, and what each one can enforce |
 
 | Observe | |
 |---|---|

package/bin/failproofai.mjs

@@ -76,19 +76,6 @@ let lastSubcommand = null;
 // with the right event name. Mirrors the cli_install_failure / cli_uninstall_failure
 // pattern below for parity. Cleared back to null after the success track.
 let lastPolicyAction = null;
-/**
- * Every CLI `policies --install/--uninstall/list --cli` accepts.
- *
- * ONE list, referenced from all three flag parsers below. It used to be three
- * hardcoded copies, and they drifted: grok and qwen were added to the `--hook
- * --cli` validation and to INTEGRATION_TYPES, but not here, so a real
- * `policies --install --cli grok` was rejected outright while every unit test
- * passed. __tests__/hooks/integrations.test.ts asserts this equals
- * INTEGRATION_TYPES so the next CLI cannot repeat it.
- */
-const INSTALLABLE_CLIS = ["claude", "codex", "copilot", "cursor", "opencode", "pi", "hermes", "openclaw", "factory", "devin", "antigravity", "goose", "grok", "qwen", "ori", "cline"];
-const VALID_CLIS_USAGE = `Missing value(s) for --cli. Usage: --cli ${INSTALLABLE_CLIS.join(" ")} (or any subset)`;
-
 async function track(name, props) {
   try {
     if (!_telemetry) {
@@ -134,7 +121,7 @@ const hookIdx = args.indexOf("--hook");
 if (hookIdx >= 0) {
   if (!args[hookIdx + 1]) {
     console.error("Error: Missing event type after --hook");
-    console.error("Usage: failproofai --hook <event> [--cli <claude|codex|copilot|cursor|opencode|pi|hermes|openclaw|factory|devin|antigravity|goose|grok|qwen|ori|cline>]");
+    console.error("Usage: failproofai --hook <event> [--cli <claude|codex|copilot|cursor|opencode|pi|hermes|openclaw|factory|devin|antigravity|goose>]");
     process.exit(1);
   }
   const eventType = args[hookIdx + 1];
@@ -156,10 +143,6 @@ if (hookIdx >= 0) {
       || cliArg === "devin"
       || cliArg === "antigravity"
       || cliArg === "goose"
-      || cliArg === "grok"
-      || cliArg === "qwen"
-      || cliArg === "ori"
-      || cliArg === "cline"
     )
       ? cliArg
       : "claude";
@@ -425,7 +408,7 @@ async function runCli() {
             label: "options",
             entries: [
               ["--hook <event>", "PreToolUse, PostToolUse, UserPromptSubmit, Stop, SubagentStop, SessionStart, SessionEnd, PreCompact, Notification, PermissionRequest"],
-              ["--cli <name>", "claude, codex, copilot, cursor, opencode, pi, hermes, openclaw, factory, devin, antigravity, goose, ori. Defaults to claude. It selects which payload shape to expect: each CLI names its events and tool arguments differently, and failproofai canonicalizes them."],
+              ["--cli <name>", "claude, codex, copilot, cursor, opencode, pi, hermes, openclaw, factory, devin, antigravity, goose. Defaults to claude. It selects which payload shape to expect: each CLI names its events and tool arguments differently, and failproofai canonicalizes them."],
             ],
           },
           {
@@ -1686,7 +1669,7 @@ async function runCli() {
     }
 
     // --cli accepts one or more space-separated values, optionally repeated.
-    const VALID_CLIS = new Set(INSTALLABLE_CLIS);
+    const VALID_CLIS = new Set(["claude", "codex", "copilot", "cursor", "opencode", "pi", "hermes", "openclaw", "factory", "devin", "antigravity", "goose"]);
     const cliFlagValues = [];
     const cliConsumedIdxs = new Set();
     const cliFlagIdxs = rest.map((a, i) => (a === "--cli" ? i : -1)).filter((i) => i >= 0);
@@ -1888,7 +1871,7 @@ async function runCli() {
       //   --cli claude codex copilot
       //   --cli claude --cli codex
       // Values are consumed greedily until the next flag or end of argv.
-      const VALID_CLIS = new Set(INSTALLABLE_CLIS);
+      const VALID_CLIS = new Set(["claude", "codex", "copilot", "cursor", "opencode", "pi", "hermes", "openclaw", "factory", "devin", "antigravity", "goose"]);
       const cliFlagValues = [];
       const cliConsumedIdxs = new Set();
       const cliFlagIdxs = subArgs.map((a, i) => (a === "--cli" ? i : -1)).filter((i) => i >= 0);
@@ -1905,7 +1888,7 @@ async function runCli() {
           consumed++;
         }
         if (consumed === 0) {
-          throw new CliError(VALID_CLIS_USAGE);
+          throw new CliError("Missing value(s) for --cli. Usage: --cli claude codex copilot cursor opencode pi hermes openclaw (or any subset)");
         }
       }
 
@@ -1977,7 +1960,7 @@ async function runCli() {
       }
 
       // --cli accepts one or more space-separated values; same parser as install.
-      const VALID_CLIS = new Set(INSTALLABLE_CLIS);
+      const VALID_CLIS = new Set(["claude", "codex", "copilot", "cursor", "opencode", "pi", "hermes", "openclaw", "factory", "devin", "antigravity", "goose"]);
       const cliFlagValues = [];
       const cliConsumedIdxs = new Set();
       const cliFlagIdxs = subArgs.map((a, i) => (a === "--cli" ? i : -1)).filter((i) => i >= 0);
@@ -1994,7 +1977,7 @@ async function runCli() {
           consumed++;
         }
         if (consumed === 0) {
-          throw new CliError(VALID_CLIS_USAGE);
+          throw new CliError("Missing value(s) for --cli. Usage: --cli claude codex copilot cursor opencode pi hermes openclaw (or any subset)");
         }
       }