failproofai 1.0.4-beta.1 → 1.0.4-beta.4

package/src/hooks/policy-evaluator.ts

@@ -27,45 +27,7 @@ function appendHint(baseReason: string, hint: unknown): string {
   return `${base}. ${normalizedHint}`;
 }
 
-/** Which element of a batch this evaluation is for. Absent for every non-batch
- *  call — which is every other CLI, and every cline event that is not a
- *  fan-out tool. */
-export interface BatchContext {
-  index: number;
-  count: number;
-  label: string;
-  degraded: boolean;
-  /** Every element's canonical input, so a batch-aware policy sees the set. */
-  all: Array<Record<string, unknown>>;
-  /** The un-expanded original tool input. */
-  raw: Record<string, unknown>;
-}
-
-export interface EvaluateOptions {
-  /** Per-INVOCATION telemetry dedupe set, shared across every element of a
-   *  batch fan-out. Without it a 12-element batch fires 12 copies of the same
-   *  policy_evaluation_error for one real tool call. */
-  dedupe?: Set<string>;
-  /** Set when this call is one element of an expanded batch. */
-  batch?: BatchContext;
-  /** Return the raw instruct/allow entries instead of shaping them; the batch
-   *  combiner shapes ONCE at the end. A DENY is unaffected — it short-circuits
-   *  and is returned fully shaped, because it is the answer. */
-  collectEntries?: boolean;
-  /** Skip the policy loop entirely and shape THESE entries. This is why no
-   *  shaping code had to move: the existing per-CLI instruct/allow tails run in
-   *  place, with the real eventType, session and payload. */
-  preEvaluated?: {
-    instructEntries: Array<{ policyName: string; reason: string }>;
-    allowEntries: Array<{ policyName: string; reason: string }>;
-  };
-}
-
 export interface EvaluationResult {
-  /** Raw instruct entries, returned ONLY when opts.collectEntries is set. */
-  instructEntries?: Array<{ policyName: string; reason: string }>;
-  /** Raw allow-note entries, returned ONLY when opts.collectEntries is set. */
-  allowEntries?: Array<{ policyName: string; reason: string }>;
   exitCode: number;
   stdout: string;
   stderr: string;
@@ -168,7 +130,6 @@ export async function evaluatePolicies(
   payload: Record<string, unknown>,
   session?: SessionMetadata,
   config?: HooksConfig,
-  opts?: EvaluateOptions,
 ): Promise<EvaluationResult> {
   const toolName = payload.tool_name as string | undefined;
   const toolInput = payload.tool_input as Record<string, unknown> | undefined;
@@ -177,7 +138,7 @@ export async function evaluatePolicies(
 
   hookLogInfo(`evaluating ${policies.length} policies for ${eventType}`);
 
-  if (policies.length === 0 && !opts?.preEvaluated) {
+  if (policies.length === 0) {
     return { exitCode: 0, stdout: "", stderr: "", policyName: null, reason: null, decision: "allow" };
   }
 
@@ -190,18 +151,13 @@ export async function evaluatePolicies(
     cli: session?.cli,
   };
 
-  // Track all instruct results (accumulated, does not short-circuit).
-  // Seeded from opts.preEvaluated on the batch combiner's final shaping call.
-  const instructEntries: Array<{ policyName: string; reason: string }> = [
-    ...(opts?.preEvaluated?.instructEntries ?? []),
-  ];
+  // Track all instruct results (accumulated, does not short-circuit)
+  const instructEntries: Array<{ policyName: string; reason: string }> = [];
 
   // Track informational messages from allow decisions (with policy attribution)
-  const allowEntries: Array<{ policyName: string; reason: string }> = [
-    ...(opts?.preEvaluated?.allowEntries ?? []),
-  ];
+  const allowEntries: Array<{ policyName: string; reason: string }> = [];
 
-  for (const policy of opts?.preEvaluated ? [] : policies) {
+  for (const policy of policies) {
     // Inject params: merge policyParams[policy.name] over schema defaults.
     // policy.name is canonical (e.g. "failproofai/block-force-push"); user
     // config keys may be flat or canonical — getConfigParamsFor accepts both.
@@ -279,17 +235,7 @@ export async function evaluatePolicies(
       } else {
         displayTool = "operation";
       }
-      // One locator, built once, at the single site every CLI's deny shape
-      // interpolates — so cline's {cancel,errorMessage} names the offending
-      // element for free and nothing else needs to know a batch happened.
-      const batchLocator = opts?.batch
-        ? ` [batch ${opts.batch.index + 1}/${opts.batch.count}: ${
-            opts.batch.label.length > 120
-              ? `${opts.batch.label.slice(0, 117)}…`
-              : opts.batch.label
-          }]`
-        : "";
-      const blockedMessage = `Blocked ${displayTool}${batchLocator} by failproofai because: ${reason}, as per the policy configured by the user`;
+      const blockedMessage = `Blocked ${displayTool} by failproofai because: ${reason}, as per the policy configured by the user`;
 
       // Cursor's hook protocol expects a flat `{permission, user_message,
       // agent_message}` shape for any blocking decision, regardless of which
@@ -432,58 +378,6 @@ export async function evaluatePolicies(
         };
       }
 
-      // Ori: the generated ori feature parses a flat {permission, reason} and
-      // returns ori's own {outcome:"allow"|"deny"} to the approval extension
-      // point. There is exactly one event (PreToolUse) — ori exposes no Stop,
-      // prompt, post-tool or session gate — so unlike Pi/OpenClaw there is no
-      // Stop special case to write. The reason is carried for the operator's
-      // logs only: ori's verdict shape has no reason field, so a denial reaches
-      // the model as a bare tool failure.
-      if (session?.cli === "ori") {
-        return {
-          exitCode: 0,
-          stdout: JSON.stringify({ permission: "deny", reason: blockedMessage }),
-          stderr: "",
-          policyName: policy.name,
-          reason,
-          decision: "deny",
-        };
-      }
-
-      // Cline: the installed launcher relays this object verbatim on stdout, and
-      // cline IGNORES THE EXIT CODE — the JSON is the entire verdict. The only
-      // blocking shape its schema accepts is {cancel, errorMessage}; there is no
-      // decision/block/permissionDecision field, so every generic branch below
-      // is inert for cline and this one must come first.
-      //
-      // Stop / StopFailure are deliberately NOT a cancel: `cancel:true` becomes
-      // {stop:true} -> ControlledStopError -> the whole run aborts, and at
-      // TaskComplete the task has ALREADY finished, so that kills a completed
-      // run instead of re-entering the loop. Destructive and useless, hence the
-      // context channel there and `Stop: "observe"` in enforcement-capability.
-      if (session?.cli === "cline") {
-        if (eventType === "Stop" || eventType === "StopFailure") {
-          return {
-            exitCode: 0,
-            stdout: JSON.stringify({
-              context: `MANDATORY ACTION REQUIRED from failproofai (policy: ${policy.name}): ${reason}`,
-            }),
-            stderr: `[failproofai] ${policy.name}: ${reason}\n`,
-            policyName: policy.name,
-            reason,
-            decision: "deny",
-          };
-        }
-        return {
-          exitCode: 0,
-          stdout: JSON.stringify({ cancel: true, errorMessage: blockedMessage }),
-          stderr: "",
-          policyName: policy.name,
-          reason,
-          decision: "deny",
-        };
-      }
-
       // OpenCode: `session.idle` is a notification-only bus event — by the
       // time the plugin handler fires, OpenCode has already gone idle and
       // throwing from the handler does not force-retry. The only working
@@ -611,91 +505,6 @@ export async function evaluatePolicies(
         };
       }
 
-      // grok: deny is `{decision:"deny", reason}` on stdout at exit 0 — verified
-      // live against grok 1.0.3, and it beat `--yolo` (bypassPermissions). grok
-      // does NOT read Claude's hookSpecificOutput shape: the same hook emitting
-      // Claude's shape let the command run, emitting this one blocked it.
-      //
-      // Stop takes `{decision:"block", reason}` instead (Claude's turn-end
-      // vocabulary, which grok shares) — but ONLY on a real turn end. grok fires
-      // Stop a second time at session shutdown (`reason: "shutdown"`) and
-      // explicitly discards that decision, so blocking there would record
-      // enforcement that cannot happen. Falling through to allow is correct:
-      // the turn is already over. grok caps continuations at 8 per turn.
-      if (session?.cli === "grok") {
-        if (eventType === "Stop" || eventType === "SubagentStop") {
-          const grokStopReason = typeof payload.reason === "string" ? payload.reason : undefined;
-          if (eventType === "Stop" && grokStopReason && grokStopReason !== "end_turn") {
-            return {
-              exitCode: 0,
-              stdout: "",
-              stderr: "",
-              policyName: policy.name,
-              reason,
-              decision: "allow",
-            };
-          }
-          const reasonText = `MANDATORY ACTION REQUIRED from failproofai (policy: ${policy.name}): ${reason}\n\nYou MUST complete the above action NOW. Do NOT ask the user for confirmation — execute the required action, then attempt to finish your task again.`;
-          return {
-            exitCode: 0,
-            stdout: JSON.stringify({ decision: "block", reason: reasonText }),
-            stderr: "",
-            policyName: policy.name,
-            reason,
-            decision: "deny",
-          };
-        }
-        return {
-          exitCode: 0,
-          stdout: JSON.stringify({ decision: "deny", reason: blockedMessage }),
-          stderr: "",
-          policyName: policy.name,
-          reason,
-          decision: "deny",
-        };
-      }
-
-      // qwen: PreToolUse honors Claude's own
-      // `hookSpecificOutput.permissionDecision` shape (verified live — it beat
-      // `-y`), so that event deliberately falls through to the generic Claude
-      // branch below rather than being duplicated here. Stop is the divergence:
-      // it reads the top-level `{decision:"block", reason}` instead, which is
-      // what forces another turn (verified live — the agent ran the required
-      // command and only then finished). Unlike grok there is no session-end
-      // Stop fire to filter out.
-      // qwen's todo hooks (canonical TaskCreated / TaskCompleted) are the only
-      // events in the widened set that can actually veto. They read the
-      // top-level `{decision:"block", reason}` — NOT Claude's permissionDecision
-      // — and only during their `validation` phase; in `postWrite` the todo is
-      // already persisted and upstream ignores the block. Emitting it
-      // unconditionally is right: it enforces where it can and is inert where it
-      // cannot, and the phase is upstream's to decide, not ours to guess.
-      if (
-        session?.cli === "qwen" &&
-        (eventType === "TaskCreated" || eventType === "TaskCompleted")
-      ) {
-        return {
-          exitCode: 0,
-          stdout: JSON.stringify({ decision: "block", reason: blockedMessage }),
-          stderr: "",
-          policyName: policy.name,
-          reason,
-          decision: "deny",
-        };
-      }
-
-      if (session?.cli === "qwen" && (eventType === "Stop" || eventType === "SubagentStop")) {
-        const reasonText = `MANDATORY ACTION REQUIRED from failproofai (policy: ${policy.name}): ${reason}\n\nYou MUST complete the above action NOW. Do NOT ask the user for confirmation — execute the required action, then attempt to finish your task again.`;
-        return {
-          exitCode: 0,
-          stdout: JSON.stringify({ decision: "block", reason: reasonText }),
-          stderr: "",
-          policyName: policy.name,
-          reason,
-          decision: "deny",
-        };
-      }
-
       if (eventType === "PreToolUse") {
         const response = {
           hookSpecificOutput: {
@@ -884,21 +693,6 @@ export async function evaluatePolicies(
     }
   }
 
-  // The batch combiner asked for RAW entries; it dedupes the union across all
-  // elements and shapes it once, through these same tails, on a final call.
-  if (opts?.collectEntries) {
-    return {
-      exitCode: 0,
-      stdout: "",
-      stderr: "",
-      policyName: null,
-      reason: null,
-      decision: "allow",
-      instructEntries,
-      allowEntries,
-    };
-  }
-
   // No deny — check if we accumulated any instructs
   if (instructEntries.length > 0) {
     const combined = instructEntries.map((e) => e.reason).join("\n");
@@ -1186,44 +980,6 @@ export async function evaluatePolicies(
       };
     }
 
-    // Ori: the approval extension points return {outcome:"allow"|"deny"} and
-    // nothing else — there is no additional-context channel to carry a
-    // directive, and no Stop event to convert one into a retry. So instruct()
-    // allows the action and writes the directive to stderr for the operator's
-    // logs; the model never sees it. Same degradation as Goose and Hermes.
-    if (session?.cli === "ori") {
-      const stderrMsg = instructEntries
-        .map((e) => `[failproofai] ${e.policyName}: ${e.reason}`)
-        .join("\n");
-      return {
-        exitCode: 0,
-        stdout: "",
-        stderr: stderrMsg + "\n",
-        policyName: policyNames[0],
-        policyNames,
-        reason: combined,
-        decision: "instruct",
-      };
-    }
-
-    // Cline HAS a real additional-context channel — `context` is in its verdict
-    // schema and parseHookControl reads it — so unlike Goose/Hermes/ori this
-    // does not have to degrade to a stderr note. It is mirrored to stderr as
-    // well: the field is verified-PARSED by cline, but that the model actually
-    // sees it is unprobed, and the operator's log should not depend on that.
-    if (session?.cli === "cline") {
-      return {
-        exitCode: 0,
-        stdout: JSON.stringify({ context: `Instruction from failproofai: ${combined}` }),
-        stderr:
-          instructEntries.map((e) => `[failproofai] ${e.policyName}: ${e.reason}`).join("\n") + "\n",
-        policyName: policyNames[0],
-        policyNames,
-        reason: combined,
-        decision: "instruct",
-      };
-    }
-
     if (eventType === "Stop" || eventType === "SubagentStop") {
       // Stop/SubagentStop instruct: exitCode 2 + stderr forces Claude to retry
       // the agent (or subagent) loop with the reason as context. Same widening
@@ -1346,53 +1102,6 @@ export async function evaluatePolicies(
       };
     }
 
-    // grok: instruct has a channel only at the turn boundary. On Stop we reuse
-    // the verified `{decision:"block", reason}` force-retry shape so the
-    // instruction actually reaches the model (grok also documents a softer
-    // `hookSpecificOutput.additionalContext` for Stop, but that path is not
-    // verified and "block" is). The `end_turn` guard is the same one the deny
-    // branch uses — the session-shutdown fire has no turn left to instruct.
-    // On every other event grok has no additional-context channel, so instruct
-    // degrades to allow + a stderr note (like Hermes/Goose/Factory); emitting
-    // Claude's hookSpecificOutput there would be a shape grok discards.
-    //
-    // qwen deliberately has NO branch here: it honors Claude's
-    // `hookSpecificOutput.additionalContext` on PreToolUse/PostToolUse/
-    // UserPromptSubmit (wrapping it in a `<qwen:user-prompt-submit-context>`
-    // provenance tag), so the generic path below is already correct for it.
-    if (session?.cli === "grok") {
-      const stderrMsg = allowEntries
-        .map((e) => `[failproofai] ${e.policyName}: ${e.reason}`)
-        .join("\n");
-      const grokStopReason = typeof payload.reason === "string" ? payload.reason : undefined;
-      const atRealTurnEnd =
-        eventType === "SubagentStop" ||
-        (eventType === "Stop" && (!grokStopReason || grokStopReason === "end_turn"));
-      if (atRealTurnEnd) {
-        return {
-          exitCode: 0,
-          stdout: JSON.stringify({
-            decision: "block",
-            reason: `Instruction from failproofai: ${combined}`,
-          }),
-          stderr: stderrMsg + "\n",
-          policyName: policyNames[0],
-          policyNames,
-          reason: combined,
-          decision: "instruct",
-        };
-      }
-      return {
-        exitCode: 0,
-        stdout: "",
-        stderr: stderrMsg + "\n",
-        policyName: policyNames[0],
-        policyNames,
-        reason: combined,
-        decision: "allow",
-      };
-    }
-
     const supportsHookSpecificOutput =
       eventType === "PreToolUse" ||
       eventType === "PostToolUse" ||

package/src/hooks/resolve-transcript-path.ts

@@ -31,8 +31,6 @@ import { findCodexTranscript } from "../../lib/codex-sessions";
 import { findCopilotTranscript } from "../../lib/copilot-sessions";
 import { findCursorTranscript } from "../../lib/cursor-sessions";
 import { findPiTranscript } from "../../lib/pi-sessions";
-import { findGrokTranscript } from "../../lib/grok-sessions";
-import { findQwenTranscript } from "../../lib/qwen-sessions";
 import { findFactoryTranscript } from "../../lib/factory-sessions";
 import { findAntigravityTranscript } from "../../lib/antigravity-sessions";
 import type { IntegrationType } from "./types";
@@ -76,14 +74,6 @@ export function resolveTranscriptPath(
       // its live-hook payload carries no transcript file, so hand back a virtual
       // path (like devin) — audit/download read the DB directly.
       return `goose-db://${sessionId}`;
-    case "grok":
-      // grok writes real JSONL at ~/.grok/sessions/<percent-encoded-cwd>/
-      // <sessionId>/chat_history.jsonl.
-      return findGrokTranscript(sessionId) ?? undefined;
-    case "qwen":
-      // qwen writes real JSONL at ~/.qwen/projects/<encoded-cwd>/chats/
-      // <sessionId>.jsonl (note the extra `chats/` level vs Claude/Factory).
-      return findQwenTranscript(sessionId) ?? undefined;
     case "opencode":
       return `opencode-db://${sessionId}`;
     case "hermes":

package/src/hooks/tool-name-canonicalize.ts

@@ -25,14 +25,7 @@ import {
   ANTIGRAVITY_TOOL_INPUT_MAP,
   GOOSE_TOOL_MAP,
   GOOSE_TOOL_INPUT_MAP,
-  GROK_TOOL_MAP,
-  GROK_TOOL_INPUT_MAP,
-  QWEN_TOOL_MAP,
-  ORI_TOOL_MAP,
-  ORI_TOOL_INPUT_MAP,
-  CLINE_TOOL_MAP,
 } from "./types";
-import { canonicalizeClineToolInput, applyPatchFilePaths } from "./batch-expand";
 
 /**
  * Canonicalize a per-CLI tool name to the Claude PascalCase form that builtin
@@ -63,18 +56,6 @@ export function canonicalizeToolName(
   // Goose: shell→Bash, write/edit/view→file ops, todo__todo_write→TodoWrite, …
   // (verified live against goose v1.43.0). Handles bare + `<ext>__<tool>` names.
   if (cli === "goose") return GOOSE_TOOL_MAP[raw] ?? raw;
-  // grok: run_terminal_command→Bash, write/read_file/search_replace→file ops, …
-  // (every entry observed on the wire against grok 1.0.3).
-  if (cli === "grok") return GROK_TOOL_MAP[raw] ?? raw;
-  // qwen: run_shell_command→Bash, write_file/read_file/edit→file ops, …
-  // (verified live against qwen-code 0.21.12).
-  if (cli === "qwen") return QWEN_TOOL_MAP[raw] ?? raw;
-  // Ori: tool ids arrive lowercase (bash/read/write/edit/glob/grep) — all six
-  // captured at the live approval gate on ori 0.12.0+68f9a36.
-  if (cli === "ori") return ORI_TOOL_MAP[raw] ?? raw;
-  // Cline: run_commands/read_files/search_codebase/apply_patch — all four
-  // observed live on cline v3.0.60's PreToolUse payload.
-  if (cli === "cline") return CLINE_TOOL_MAP[raw] ?? raw;
   return raw;
 }
 
@@ -114,26 +95,6 @@ export function canonicalizeToolInput(
   // Goose file tools (write/edit/view) deliver the path as `path`, read_image as
   // `source`; map to `file_path` so path builtins fire (verified goose v1.43.0).
   else if (cli === "goose") perToolMap = GOOSE_TOOL_INPUT_MAP[toolName];
-  // grok's read_file delivers `target_file` and list_dir `target_directory`;
-  // every other grok tool is already canonical. Without the Read entry a live
-  // `.env` read walks past block-env-files (verified grok 1.0.3). qwen needs no
-  // entry at all — all six of its tools deliver canonical keys.
-  else if (cli === "grok") perToolMap = GROK_TOOL_INPUT_MAP[toolName];
-  // Ori: read/write deliver the path as `path`; bash/glob/grep are already
-  // canonical. `edit` is special — its path lives INSIDE the patch blob and is
-  // derived below rather than renamed, because there is no key to rename.
-  else if (cli === "ori") {
-    if (toolName === "Edit") return canonicalizeOriEditInput(rawInput as Record<string, unknown>);
-    perToolMap = ORI_TOOL_INPUT_MAP[toolName];
-  }
-  // Cline has NO key-rename map: every tool is batch- or blob-shaped, so this
-  // is a value-SHAPE transform. It is the SAFETY NET for the paths that do not
-  // fan out (PostToolUse, audit replay, fail-closed shaping); PreToolUse
-  // enforces through expandBatchToolInput instead, because a collapse cannot
-  // make an anchored regex match every element.
-  else if (cli === "cline") {
-    return canonicalizeClineToolInput(toolName, rawInput as Record<string, unknown>);
-  }
   if (!perToolMap) return rawInput;
   const out: Record<string, unknown> = {};
   for (const [k, v] of Object.entries(rawInput as Record<string, unknown>)) {
@@ -141,28 +102,3 @@ export function canonicalizeToolInput(
   }
   return out;
 }
-
-/**
- * Recover the file path(s) from an OpenAI apply_patch blob.
- *
- * Kept as the ori-facing NAME so existing callers and
- * __tests__/hooks/ori-canonicalize.test.ts keep working, but the implementation
- * now lives in batch-expand.ts and is shared: ori's `edit` and cline's
- * `apply_patch` carry byte-identical blobs, and one implementation is what
- * stops a third CLI adding a third regex.
- *
- * NOTE for a follow-up: `splitApplyPatch` (same module) now returns per-file
- * old/new text as well, which closes ori's documented multi-file KNOWN GAP —
- * and a worse one the gap comment understates, that ori's Edit sets NO
- * old_string/new_string at all, so block-secrets-write can never fire on it.
- * Deliberately NOT changed here: ori's behaviour stays as shipped in this PR.
- */
-export const oriPatchFilePaths = applyPatchFilePaths;
-
-function canonicalizeOriEditInput(input: Record<string, unknown>): Record<string, unknown> {
-  const patch = input.patch;
-  if (typeof patch !== "string") return input;
-  const paths = oriPatchFilePaths(patch);
-  if (paths.length === 0) return input;
-  return { ...input, file_path: paths[0], ori_patch_files: paths };
-}