failproofai 1.0.4-beta.1 → 1.0.4-beta.4

package/lib/auth/api-server-client.ts

@@ -253,6 +253,34 @@ export interface AuditReportBody {
     last_seen?: string;
     examples: string[];
   }[];
+  /**
+   * Credentials this machine found in its own transcripts.
+   *
+   * Optional on the wire, so a CLI newer than the api-server sends a field the
+   * server ignores rather than failing the whole digest — the harmful counts
+   * are the older half of the contract and must keep arriving either way.
+   *
+   * Every field here is a mask, a label, a length or a location. There is no
+   * shape of this object that carries a secret, because the record it is built
+   * from never stores one: `recordLeaks` fingerprints at detection time and
+   * keeps only the masked rendering.
+   */
+  leaks?: {
+    id: string;
+    display: string;
+    label: string;
+    length: number;
+    attributed: boolean;
+    name: string | null;
+    confidence: string;
+    first_seen: string;
+    last_seen: string;
+    occurrences: number;
+    cli: string;
+    project: string;
+    mechanism: string;
+    direction: "input" | "result";
+  }[];
 }
 
 export interface AuditReportResult {

package/lib/claude-sessions.ts

@@ -4,8 +4,14 @@
  * Claude stores transcripts at:
  *   <CLAUDE_PROJECTS_PATH>/<encoded-cwd>/<sessionId>.jsonl
  *
- * Subagent transcripts (when a session spawned subagents) live alongside:
+ * Subagent transcripts (when a session spawned subagents) live alongside, in two
+ * shapes — a direct child, and one nested per workflow run:
  *   <CLAUDE_PROJECTS_PATH>/<encoded-cwd>/<sessionId>/subagents/<agentId>.jsonl
+ *   <CLAUDE_PROJECTS_PATH>/<encoded-cwd>/<sessionId>/subagents/workflows/<runId>/<agentId>.jsonl
+ *
+ * Everything below `subagents/` is walked to a bounded depth rather than one
+ * level, because the second shape arrived after this module was written and the
+ * miss was most of the corpus. See `collectSubagentTranscripts`.
  *
  * The parser for these files lives in `lib/log-entries.ts` (`parseLogContent`,
  * `parseSessionLog`). This module exposes discovery only — the audit pipeline
@@ -70,6 +76,99 @@ export function listClaudeProjects(): ClaudeProjectFolder[] {
 /** Lists every JSONL transcript under one Claude project folder, including
  *  subagent transcripts under `<sessionId>/subagents/`. Returns [] on missing
  *  or unreadable paths. */
+/**
+ * Depth of nesting allowed below `subagents/`.
+ *
+ * The two shapes that exist today need 0 and 2 (`<agent>.jsonl` and
+ * `workflows/<runId>/<agent>.jsonl`). The cap is here so an unexpected layout —
+ * or a symlink cycle a future Claude build introduces — costs a bounded walk
+ * rather than an audit that never returns, and it is deliberately loose enough
+ * that a third shape lands inside it without another release.
+ */
+const MAX_SUBAGENT_DEPTH = 5;
+
+/**
+ * Collect every `.jsonl` beneath a session's `subagents/` directory.
+ *
+ * This used to read only the DIRECT children of `subagents/`, which was correct
+ * for the layout Claude shipped when it was written and silently wrong the day
+ * workflow runs started nesting their agents one level further down. On a
+ * machine that uses them the miss is most of the corpus: 1,839 transcripts on
+ * disk, 1,741 under `subagents/`, and 1,679 of those inside
+ * `subagents/workflows/<runId>/` — so the audit was walking 160 files, 8.7% of
+ * the evidence, and reporting the result as though it had read everything.
+ *
+ * ## Session ids come from the relative path, not the basename
+ *
+ * Every workflow run writes a `journal.jsonl` beside its agents, so basenames
+ * are NOT unique below this directory — 1,741 files share 1,613 distinct names
+ * on the machine this was found on. A basename id would collide those 128 files
+ * onto ~one row each, and `sessionId` is what the cache, the per-session
+ * detector state and the example attribution are keyed by, so the collision
+ * would silently merge unrelated sessions rather than fail.
+ *
+ * Nor is the path below `subagents/` unique on its own. A workflow run id is
+ * reused when its session is resumed, so `wf_3d609e92-a38/journal.jsonl` exists
+ * under two different parent sessions in the same project — found by asserting
+ * uniqueness over the real corpus, not by reasoning about it.
+ *
+ * The id is therefore the PARENT SESSION id followed by the path relative to
+ * `subagents/`, minus the extension, joined with `__`:
+ * `<parentUuid>__workflows__wf_123__agent-abc`. That is a filesystem path
+ * within the project, so it is unique by construction rather than by argument,
+ * and it names the session the subagent belongs to. `__` is safe as the joiner
+ * because no id Claude generates contains one — verified against 1,741 real
+ * files, zero hits. Top-level session ids are untouched.
+ *
+ * Symlinks are not followed. Nothing in the layout uses them, and following one
+ * is how a directory walk turns into an infinite loop.
+ */
+function collectSubagentTranscripts(
+  dir: string,
+  relPrefix: string,
+  project: ClaudeProjectFolder,
+  out: ClaudeTranscriptFile[],
+  depth: number,
+): void {
+  if (depth > MAX_SUBAGENT_DEPTH) return;
+  let entries: import("node:fs").Dirent[];
+  try {
+    entries = readdirSync(dir, { withFileTypes: true });
+  } catch {
+    return;
+  }
+  for (const entry of entries) {
+    if (entry.isSymbolicLink()) continue;
+    if (entry.isDirectory()) {
+      collectSubagentTranscripts(
+        join(dir, entry.name),
+        relPrefix ? `${relPrefix}__${entry.name}` : entry.name,
+        project,
+        out,
+        depth + 1,
+      );
+      continue;
+    }
+    if (!entry.isFile() || !entry.name.endsWith(".jsonl")) continue;
+    const stem = entry.name.slice(0, -".jsonl".length);
+    const transcriptPath = join(dir, entry.name);
+    try {
+      const s = statSync(transcriptPath);
+      out.push({
+        projectName: project.name,
+        cwd: project.cwd,
+        sessionId: relPrefix ? `${relPrefix}__${stem}` : stem,
+        transcriptPath,
+        mtimeMs: s.mtimeMs,
+        sizeBytes: s.size,
+        isSubagent: true,
+      });
+    } catch {
+      // unreadable — skip
+    }
+  }
+}
+
 export function listClaudeTranscripts(project: ClaudeProjectFolder): ClaudeTranscriptFile[] {
   const out: ClaudeTranscriptFile[] = [];
   let entries: import("node:fs").Dirent[];
@@ -99,34 +198,9 @@ export function listClaudeTranscripts(project: ClaudeProjectFolder): ClaudeTrans
         // unreadable — skip
       }
     } else if (entry.isDirectory() && UUID_RE.test(entry.name)) {
-      // Subagent transcripts at <sessionId>/subagents/<agentId>.jsonl
       const subDir = join(project.path, entry.name, "subagents");
       if (!existsSync(subDir)) continue;
-      let subEntries: import("node:fs").Dirent[];
-      try {
-        subEntries = readdirSync(subDir, { withFileTypes: true });
-      } catch {
-        continue;
-      }
-      for (const sub of subEntries) {
-        if (!sub.isFile() || !sub.name.endsWith(".jsonl")) continue;
-        const agentId = sub.name.slice(0, -".jsonl".length);
-        const transcriptPath = join(subDir, sub.name);
-        try {
-          const s = statSync(transcriptPath);
-          out.push({
-            projectName: project.name,
-            cwd: project.cwd,
-            sessionId: agentId,
-            transcriptPath,
-            mtimeMs: s.mtimeMs,
-            sizeBytes: s.size,
-            isSubagent: true,
-          });
-        } catch {
-          // unreadable — skip
-        }
-      }
+      collectSubagentTranscripts(subDir, entry.name, project, out, 0);
     }
   }
 

package/lib/cli-registry.ts

@@ -27,7 +27,7 @@
 import type { IntegrationType } from "@/src/hooks/types";
 
 /** Canonical CLI ids the registry knows about. Mirrors `INTEGRATION_TYPES`. */
-export const KNOWN_CLI_IDS = ["claude", "codex", "copilot", "cursor", "opencode", "pi", "hermes", "openclaw", "factory", "devin", "antigravity", "goose", "grok", "qwen", "ori", "cline"] as const satisfies readonly IntegrationType[];
+export const KNOWN_CLI_IDS = ["claude", "codex", "copilot", "cursor", "opencode", "pi", "hermes", "openclaw", "factory", "devin", "antigravity", "goose"] as const satisfies readonly IntegrationType[];
 export type CliId = (typeof KNOWN_CLI_IDS)[number];
 
 /** Per-CLI metadata consumed by the dashboard. */
@@ -99,38 +99,6 @@ const CLI_ENTRIES: Record<CliId, CliEntry> = {
     label: "Goose",
     badgeClasses: "bg-lime-500/10 text-lime-400 border-lime-500/20",
   },
-  grok: {
-    id: "grok",
-    label: "grok CLI",
-    // Neutral zinc, matching the design system's `--color-default`. Deliberately
-    // NOT a status hue: green/amber/red carry health meaning in this dashboard
-    // and must never be spent on identity. Neutral also happens to suit xAI's
-    // monochrome brand, and it is maximally far from qwen's magenta — the two
-    // were previously indistinguishable.
-    badgeClasses: "bg-zinc-500/10 text-zinc-200 border-zinc-500/20",
-  },
-  qwen: {
-    id: "qwen",
-    label: "Qwen Code",
-    // Magenta — the opposite pole from grok's neutral, and outside the
-    // status set (success/amber/orange/error) so it reads as identity.
-    badgeClasses: "bg-fuchsia-500/10 text-fuchsia-400 border-fuchsia-500/20",
-  },
-  ori: {
-    id: "ori",
-    label: "Ori",
-    // Sky — the badge set must be UNIQUE per CLI (a test asserts it), and
-    // violet/teal were already taken. Still outside the status set
-    // (success/amber/orange/error) so it reads as identity, not state.
-    badgeClasses: "bg-sky-500/10 text-sky-400 border-sky-500/20",
-  },
-  cline: {
-    id: "cline",
-    label: "Cline",
-    // Stone — the remaining neutral that is not zinc (grok's) and not a status
-    // colour.
-    badgeClasses: "bg-stone-500/10 text-stone-300 border-stone-500/20",
-  },
 };
 
 export function getCliEntry(id: string): CliEntry | undefined {

package/lib/download-session.ts

@@ -125,21 +125,6 @@ export async function resolveDownloadSource(
     return path ? { kind: "file", path } : null;
   }
 
-  if (cli === "grok") {
-    // grok writes a real chat_history.jsonl per session directory — stream it
-    // verbatim (no synthesis, like Factory).
-    const { findGrokTranscript } = await import("./grok-sessions");
-    const path = findGrokTranscript(sessionId);
-    return path ? { kind: "file", path } : null;
-  }
-
-  if (cli === "qwen") {
-    // qwen writes a real JSONL transcript per session — stream it verbatim.
-    const { findQwenTranscript } = await import("./qwen-sessions");
-    const path = findQwenTranscript(sessionId);
-    return path ? { kind: "file", path } : null;
-  }
-
   if (cli === "devin") {
     // Devin keeps sessions in SQLite (~/.local/share/devin/cli/sessions.db).
     // Synthesize a JSONL export of the session's raw chat_message rows.
@@ -167,28 +152,6 @@ export async function resolveDownloadSource(
     return { kind: "synthesized", body, contentType: "application/x-ndjson", extension: "jsonl" };
   }
 
-  if (cli === "ori") {
-    // Ori keeps the whole conversation in one SQLite column
-    // (ori_agent_loop_history.prompt). Synthesize a JSONL export from the
-    // parsed entries — there is no per-session file to stream.
-    const { getOriSessionLog } = await import("./ori-sessions");
-    const result = await getOriSessionLog(sessionId);
-    if (!result) return null;
-    const body = result.entries.map((e) => JSON.stringify(e)).join("\n") + "\n";
-    return { kind: "synthesized", body, contentType: "application/x-ndjson", extension: "jsonl" };
-  }
-
-  if (cli === "cline") {
-    // Cline stores a real per-session messages file, but it is a single JSON
-    // document rather than JSONL, so stream the parsed entries as JSONL for
-    // consistency with every other synthesized export.
-    const { getClineSessionLog } = await import("./cline-sessions");
-    const result = await getClineSessionLog(sessionId);
-    if (!result) return null;
-    const body = result.entries.map((e) => JSON.stringify(e)).join("\n") + "\n";
-    return { kind: "synthesized", body, contentType: "application/x-ndjson", extension: "jsonl" };
-  }
-
   // Exhaustive — but TypeScript can't always see CliId is exhausted across the
   // if-chain above, so guard with a runtime fallback.
   const _exhaustive: never = cli;

package/lib/projects.ts

@@ -16,7 +16,7 @@ import { formatDate } from "./format-date";
 export const UUID_RE = /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/;
 export const PATH_TRAVERSAL_RE = /(^|[\\/])\.\.($|[\\/])/;
 
-export type ProjectCli = "claude" | "codex" | "copilot" | "cursor" | "opencode" | "pi" | "hermes" | "openclaw" | "factory" | "devin" | "antigravity" | "goose" | "grok" | "qwen" | "ori" | "cline";
+export type ProjectCli = "claude" | "codex" | "copilot" | "cursor" | "opencode" | "pi" | "hermes" | "openclaw" | "factory" | "devin" | "antigravity" | "goose";
 
 export interface ProjectFolder {
   name: string;
@@ -171,10 +171,6 @@ export async function getProjectFolders(): Promise<ProjectFolder[]> {
     { getDevinProjects },
     { getAntigravityProjects },
     { getGooseProjects },
-    { getGrokProjects },
-    { getQwenProjects },
-    { getOriProjects },
-    { getClineProjects },
   ] = await Promise.all([
     import("./codex-projects"),
     import("./copilot-projects"),
@@ -187,12 +183,8 @@ export async function getProjectFolders(): Promise<ProjectFolder[]> {
     import("./devin-projects"),
     import("./antigravity-projects"),
     import("./goose-projects"),
-    import("./grok-projects"),
-    import("./qwen-projects"),
-    import("./ori-projects"),
-    import("./cline-projects"),
   ]);
-  const [claude, codex, copilot, cursor, opencode, pi, hermes, openclaw, factory, devin, antigravity, goose, grok, qwen, ori, cline] = await Promise.all([
+  const [claude, codex, copilot, cursor, opencode, pi, hermes, openclaw, factory, devin, antigravity, goose] = await Promise.all([
     getClaudeProjectFolders(),
     getCodexProjects().catch((error) => {
       logError("Error reading Codex projects:", error);
@@ -238,24 +230,8 @@ export async function getProjectFolders(): Promise<ProjectFolder[]> {
       logError("Error reading Goose projects:", error);
       return [] as ProjectFolder[];
     }),
-    getGrokProjects().catch((error) => {
-      logError("Error reading grok projects:", error);
-      return [] as ProjectFolder[];
-    }),
-    getQwenProjects().catch((error) => {
-      logError("Error reading Qwen projects:", error);
-      return [] as ProjectFolder[];
-    }),
-    getOriProjects().catch((error) => {
-      logError("Error reading Ori projects:", error);
-      return [] as ProjectFolder[];
-    }),
-    getClineProjects().catch((error) => {
-      logError("Error reading Cline projects:", error);
-      return [] as ProjectFolder[];
-    }),
   ]);
-  return mergeProjectFolders(claude, codex, copilot, cursor, opencode, pi, hermes, openclaw, factory, devin, antigravity, goose, grok, qwen, ori, cline);
+  return mergeProjectFolders(claude, codex, copilot, cursor, opencode, pi, hermes, openclaw, factory, devin, antigravity, goose);
 }
 
 /**

package/lib/sqlite-reader.ts

@@ -39,8 +39,42 @@ interface NodeSqliteModule {
   DatabaseSync: new (path: string, options?: { readOnly?: boolean }) => NodeSqliteDb;
 }
 
+/**
+ * Swallow Node's "SQLite is an experimental feature" warning, once.
+ *
+ * It is not information the user can act on — we chose `node:sqlite`
+ * deliberately, and the alternative tier is a WASM build that leaks. But it is
+ * emitted on first use, which lands it in the MIDDLE of whatever is on screen,
+ * and the audit's progress display redraws itself by moving the cursor up a
+ * fixed number of lines. Two unexpected lines of stderr push the cursor down
+ * two rows, so the next redraw repaints the block two rows lower and strands
+ * the top of the previous frame above it. The user sees every stage twice and
+ * reasonably concludes the audit ran twice.
+ *
+ * Filtered by message rather than silenced wholesale: `process.emitWarning` is
+ * how deprecations and real problems surface too, and a blanket
+ * `NODE_NO_WARNINGS` in a tool that installs into other people's machines would
+ * hide those as well.
+ */
+let warningPatched = false;
+function silenceSqliteExperimentalWarning(): void {
+  if (warningPatched) return;
+  warningPatched = true;
+  const original = process.emitWarning.bind(process);
+  // The overloads differ across Node versions; the shape we care about is the
+  // first argument, and everything else is passed straight through.
+  process.emitWarning = ((warning: unknown, ...rest: unknown[]) => {
+    const text = typeof warning === "string" ? warning : String((warning as Error)?.message ?? "");
+    if (text.includes("SQLite is an experimental feature")) return;
+    return (original as (...a: unknown[]) => void)(warning, ...rest);
+  }) as typeof process.emitWarning;
+}
+
 async function tryNodeSqlite(dbPath: string): Promise<SqliteReader | null> {
   try {
+    // Before the import, not after: the warning fires on first use of the
+    // module, which is this line.
+    silenceSqliteExperimentalWarning();
     // Dynamic import: on Node < 22.5 this rejects and we fall through to sql.js.
     const mod = (await import("node:sqlite")) as unknown as NodeSqliteModule;
     const db = new mod.DatabaseSync(dbPath, { readOnly: true });
@@ -66,10 +100,53 @@ function loadSqlJs(): Promise<SqlJsStatic> {
   return sqlPromise;
 }
 
+const SQLITE_MAGIC = "SQLite format 3\0";
+
+/**
+ * Clear the WAL flag on OUR OWN in-memory copy of the database image.
+ *
+ * Header bytes 18 and 19 are the file-format write and read versions; `2`
+ * means WAL. sql.js never sees the `-wal` sidecar — it is handed the main
+ * file's bytes and nothing else, which is exactly the snapshot caveat this
+ * module already documents — so the flag buys us nothing, and it costs a great
+ * deal: opening a WAL-flagged image makes SQLite build a wal-index
+ * shared-memory region that sql.js's MEMFS-backed VFS never reclaims on
+ * `close()` (close unlinks only the db file it created).
+ *
+ * The asm.js build's heap is a FIXED 22,151,168-byte ArrayBuffer with
+ * ALLOW_MEMORY_GROWTH off, so `emscripten_resize_heap` is compiled to
+ * `abort("OOM")`. Measured: the 128th WAL-mode open exhausts it — the same
+ * threshold for a 319 KB database and a 10 MB one, because the leaked region
+ * is a fixed per-connection allocation rather than data.
+ *
+ * And the abort is not confined to that open. `initSqlJs` memoizes one
+ * process-wide module, so once it aborts every later `openSqliteReadonly`
+ * silently returns null. A full audit opens ~150 databases — devin, goose and
+ * opencode each open theirs once per SESSION — so it crossed 128 and then
+ * dropped whatever it had not yet read, with no error anywhere. The
+ * `Aborted(OOM)` lines on stderr were the only symptom, and they read as
+ * harmless because the run still completed.
+ *
+ * Only under bun and Node < 22.5: tier 1 is `node:sqlite`, which bun does not
+ * provide, and `engines.node` allows 20.9. Both fall through to here.
+ */
+function clearWalFlag(bytes: Buffer): Buffer {
+  // Too short to carry a header, or not a SQLite image at all — hand it back
+  // untouched and let sql.js produce its own error.
+  if (bytes.length < 20) return bytes;
+  if (bytes.toString("latin1", 0, 16) !== SQLITE_MAGIC) return bytes;
+  if (bytes[18] === 1 && bytes[19] === 1) return bytes; // already rollback-journal
+  bytes[18] = 1;
+  bytes[19] = 1;
+  return bytes;
+}
+
 async function trySqlJs(dbPath: string): Promise<SqliteReader | null> {
   try {
     const SQL = await loadSqlJs();
-    const db = new SQL.Database(readFileSync(dbPath));
+    // `readFileSync` already returns a private copy, so mutating the two header
+    // bytes cannot touch the file on disk.
+    const db = new SQL.Database(clearWalFlag(readFileSync(dbPath)));
     return {
       query<T = Record<string, unknown>>(sql: string, params?: unknown[]): T[] {
         const stmt = db.prepare(sql);

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "failproofai",
-  "version": "1.0.4-beta.1",
-  "description": "Observability and enforcement for AI agent harnesses. 39 built-in policies hooked into 16 of them — Claude Code, Codex, Cursor, Hermes, OpenClaw and more — blocking the tool call before it runs. Local dashboard included, no account needed.",
+  "version": "1.0.4-beta.4",
+  "description": "Observability and enforcement for AI agent harnesses. 39 built-in policies hooked into 12 of them — Claude Code, Codex, Cursor, Hermes, OpenClaw and more — blocking the tool call before it runs. Local dashboard included, no account needed.",
   "bin": {
     "failproofai": "./dist/cli.mjs",
     "failproofaid": "./bin/failproofaid-shim.mjs"
@@ -80,14 +80,14 @@
     "access": "public"
   },
   "devDependencies": {
-    "@anthropic-ai/sdk": "^0.120.0",
+    "@anthropic-ai/sdk": "^0.123.0",
     "@mdx-js/mdx": "^3.1.1",
     "@tailwindcss/postcss": "^4.3.1",
     "@tanstack/react-virtual": "^3.14.10",
     "@testing-library/jest-dom": "^7.0.0",
     "@testing-library/react": "^16.3.2",
     "@testing-library/user-event": "^14.6.5",
-    "@types/node": "26.4.0",
+    "@types/node": "26.4.1",
     "@types/react": "19.2.18",
     "@types/react-dom": "^19.2.3",
     "@vitejs/plugin-react": "^6.1.0",
@@ -102,7 +102,7 @@
     "tailwind-merge": "^3.4.0",
     "tailwindcss": "^4.3.1",
     "typescript": "6.0.3",
-    "vitest": "^4.1.11"
+    "vitest": "^5.0.0"
   },
   "dependencies": {
     "html-to-image": "^1.11.13",
@@ -117,18 +117,19 @@
     "vite": "8.0.16",
     "undici": "7.29.0",
     "brace-expansion": "5.0.9",
-    "sharp": "0.35.0"
+    "sharp": "0.35.4",
+    "browserslist": "4.28.8"
   },
   "optionalDependencies": {
-    "@failproofai/failproofaid-linux-x64": "1.0.4-beta.1",
-    "@failproofai/failproofaid-linux-arm64": "1.0.4-beta.1",
-    "@failproofai/failproofaid-darwin-x64": "1.0.4-beta.1",
-    "@failproofai/failproofaid-darwin-arm64": "1.0.4-beta.1"
+    "@failproofai/failproofaid-linux-x64": "1.0.4-beta.4",
+    "@failproofai/failproofaid-linux-arm64": "1.0.4-beta.4",
+    "@failproofai/failproofaid-darwin-x64": "1.0.4-beta.4",
+    "@failproofai/failproofaid-darwin-arm64": "1.0.4-beta.4"
   },
   "failproofaidBinaries": {
-    "linux-x64": "bda0aa2ff38779c247161c8928a6b5ca7dd846ae3ce5c6a6efd8b9509f67fca7",
-    "linux-arm64": "557699a24bec7a970839b952ee139b679e2feb0a505f5652a0e770e295ae148a",
-    "darwin-x64": "f23ff6e57f45ac51c0f3c7f5b876041100c119d7a3b81105a0df00018a2e2cc1",
-    "darwin-arm64": "7bc433a08d26fc148c21bc5471679440bf50300e47f1a2af505465476ca3352e"
+    "linux-x64": "4487790ed9b881da2914b5985a23b5adca1f20e226d71c635d8170064e6b2340",
+    "linux-arm64": "c903c5e201198213ccd8295fdab741c7d08d22c8dd5c276e52aa766595bedcc2",
+    "darwin-x64": "f0933584abbf0f9ff95cd153f8c6c704e467af1d6ffc8f42f9c426bd44b1142a",
+    "darwin-arm64": "387a3acbf13f667a557c8ac632fe67dee350cda078e3266e71edfcfacb9ecae6"
   }
 }

package/pi-extension/index.ts

@@ -25,7 +25,7 @@
  * spawns extensions with an undefined cwd contract, so paths are resolved
  * relative to this file via `import.meta.url`, NOT process.cwd().
  */
-import { spawnSync } from "node:child_process";
+import { spawn, spawnSync } from "node:child_process";
 import { resolve, dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 import { existsSync, readdirSync, statSync } from "node:fs";
@@ -49,6 +49,7 @@ function resolveSpawn(): { cmd: string; args: string[] } {
 interface PolicyDecision {
   permission?: "allow" | "deny";
   reason?: string;
+  failproofaiNotice?: string;
 }
 
 /**
@@ -64,7 +65,45 @@ function debug(msg: string): void {
   }
 }
 
-function callPolicy(eventName: string, payload: unknown): { block: boolean; reason: string } {
+/**
+ * Forward an event whose VERDICT NOBODY READS, without blocking Pi.
+ *
+ * `callPolicy` is `spawnSync`, and Pi awaits its handlers serially on the
+ * startup path — so a `session_start` forward froze the whole TUI for as long
+ * as the subprocess took (measured floor 1.0-1.6s just to boot the binary,
+ * ceiling the full 60s timeout) and then threw the answer away. Three call
+ * sites are like that by design: `session_start`, `tool_result` and
+ * `session_shutdown` forward for the activity feed and for session-id
+ * continuity, and Pi cannot act on their return in any case
+ * (`ToolResultEventResult` has no `block`; the other two have no Result type
+ * at all).
+ *
+ * So they get a detached `spawn` instead. The event still reaches failproofai,
+ * the policies still run and still log, and Pi keeps rendering. Deliberately
+ * NOT used for `tool_call`, `user_bash`, `input` or `agent_end`: those four
+ * consume the decision, and blocking is what enforcement means.
+ */
+function forwardPolicy(eventName: string, payload: unknown): void {
+  const { cmd, args } = resolveSpawn();
+  debug(`forwardPolicy (detached) event=${eventName} cmd=${cmd}`);
+  try {
+    const child = spawn(cmd, [...args, "--hook", eventName, "--cli", "pi"], {
+      stdio: ["pipe", "ignore", "ignore"],
+      detached: false,
+    });
+    // A child that outlives its parent's interest must not keep the event loop
+    // alive, or Pi cannot exit until the subprocess does.
+    child.unref();
+    // EPIPE if the child died before stdin was consumed — fail-open, silently.
+    child.on("error", (err) => debug(`forward error ${err.message}`));
+    child.stdin.on("error", () => {});
+    child.stdin.end(JSON.stringify(payload));
+  } catch (err) {
+    debug(`FORWARD EXCEPTION ${err instanceof Error ? err.message : String(err)}`);
+  }
+}
+
+function callPolicy(eventName: string, payload: unknown): { block: boolean; reason: string; notice?: string } {
   const { cmd, args } = resolveSpawn();
   debug(`callPolicy event=${eventName} cmd=${cmd}`);
   try {
@@ -83,8 +122,13 @@ function callPolicy(eventName: string, payload: unknown): { block: boolean; reas
     const parsed = JSON.parse(stdout) as PolicyDecision;
     if (parsed.permission === "deny") {
       debug(`DENY reason=${parsed.reason}`);
-      return { block: true, reason: parsed.reason ?? "Blocked by failproofai" };
+      return {
+        block: true,
+        reason: parsed.reason ?? "Blocked by failproofai",
+        notice: parsed.failproofaiNotice,
+      };
     }
+    return { block: false, reason: "", notice: parsed.failproofaiNotice };
   } catch (err) {
     debug(`EXCEPTION ${err instanceof Error ? err.message : String(err)}`);
     // Fail-open: never block tool execution because of an infra failure.
@@ -332,7 +376,13 @@ interface PiBeforeAgentStartEvent {
 }
 
 interface PiExtensionApi {
-  on(event: string, handler: (event: unknown) => unknown): void;
+  on(event: string, handler: (event: unknown, ctx?: PiExtensionContext) => unknown): void;
+}
+
+interface PiExtensionContext {
+  ui?: {
+    notify(message: string, type?: "info" | "warning" | "error"): void;
+  };
 }
 
 export default function failproofaiBridge(pi: PiExtensionApi) {
@@ -417,7 +467,7 @@ export default function failproofaiBridge(pi: PiExtensionApi) {
   // need session_id continuity see the metadata.
   pi.on("session_start", (event: unknown): unknown => {
     const e = event as PiSessionStartEvent;
-    callPolicy("session_start", {
+    forwardPolicy("session_start", {
       session_id: resolveSessionId(e.sessionId, resolveCwd(e.cwd)),
       cwd: resolveCwd(e.cwd),
       reason: e.reason,
@@ -435,7 +485,7 @@ export default function failproofaiBridge(pi: PiExtensionApi) {
   pi.on("tool_result", (event: unknown): unknown => {
     const e = event as PiToolResultEvent;
     const canonicalTool = canonicalizeToolName(e.toolName);
-    callPolicy("tool_result", {
+    forwardPolicy("tool_result", {
       tool_name: canonicalTool,
       tool_input: canonicalizeToolInput(canonicalTool, e.input) ?? {},
       tool_response: { content: e.content, isError: e.isError },
@@ -453,7 +503,7 @@ export default function failproofaiBridge(pi: PiExtensionApi) {
   // The 5 require-*-before-stop builtins thus enforce by gating the NEXT
   // user turn's system prompt rather than by retrying the same loop. If the
   // user kills Pi between turns, the gate is missed — same bound Claude has.
-  pi.on("agent_end", (event: unknown): unknown => {
+  pi.on("agent_end", (event: unknown, ctx?: PiExtensionContext): unknown => {
     const e = event as PiAgentEndEvent;
     const cwd = resolveCwd(e.cwd);
     const sessionId = resolveSessionId(e.sessionId, cwd);
@@ -466,6 +516,9 @@ export default function failproofaiBridge(pi: PiExtensionApi) {
       pendingStopBlockBySession.set(sessionId, decision.reason);
       debug(`agent_end deny stored for session=${sessionId}`);
     }
+    if (decision.notice) {
+      try { ctx?.ui?.notify(decision.notice, "warning"); } catch { /* fail-open */ }
+    }
     return undefined;
   });
 
@@ -500,7 +553,7 @@ export default function failproofaiBridge(pi: PiExtensionApi) {
   pi.on("session_shutdown", (event: unknown): unknown => {
     const e = event as PiSessionShutdownEvent;
     const cwd = resolveCwd(e.cwd);
-    callPolicy("session_shutdown", {
+    forwardPolicy("session_shutdown", {
       session_id: resolveSessionId(e.sessionId, cwd),
       cwd,
       reason: e.reason,