failproofai 1.0.7-beta.1 → 1.0.7-beta.2

package/dist/cli.mjs

@@ -29,12 +29,12 @@ var __esm = (fn, res, err) => () => {
 var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
 // package.json
-var version2 = "1.0.7-beta.1", package_default;
+var version2 = "1.0.7-beta.2", package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "failproofai",
     version: version2,
-    description: "Observability and enforcement for AI agent harnesses. 39 built-in policies hooked into 12 of them — Claude Code, Codex, Cursor, Hermes, OpenClaw and more — blocking the tool call before it runs. Local dashboard included, no account needed.",
+    description: "Observability and enforcement for AI agent harnesses. 40 built-in policies hooked into 12 of them — Claude Code, Codex, Cursor, Hermes, OpenClaw and more — blocking the tool call before it runs. Local dashboard included, no account needed.",
     bin: {
       failproofai: "./dist/cli.mjs",
       failproofaid: "./bin/failproofaid-shim.mjs"
@@ -155,16 +155,16 @@ var init_package = __esm(() => {
       browserslist: "4.28.8"
     },
     optionalDependencies: {
-      "@failproofai/failproofaid-linux-x64": "1.0.7-beta.1",
-      "@failproofai/failproofaid-linux-arm64": "1.0.7-beta.1",
-      "@failproofai/failproofaid-darwin-x64": "1.0.7-beta.1",
-      "@failproofai/failproofaid-darwin-arm64": "1.0.7-beta.1"
+      "@failproofai/failproofaid-linux-x64": "1.0.7-beta.2",
+      "@failproofai/failproofaid-linux-arm64": "1.0.7-beta.2",
+      "@failproofai/failproofaid-darwin-x64": "1.0.7-beta.2",
+      "@failproofai/failproofaid-darwin-arm64": "1.0.7-beta.2"
     },
     failproofaidBinaries: {
-      "linux-x64": "8fc6dcf94834a332791a76b24c9906ef63371ee91b5a8dc2c764db202d5608a7",
-      "linux-arm64": "ce48b73245adc6a0d7cef2ba74e37693bd00d7cff75a8d27b6bdbd8ba0251613",
-      "darwin-x64": "27d8f9d740d409741d43e75850eea5f956ac6b578628cbf2f364d711f89621a6",
-      "darwin-arm64": "0ee02f87dd6e3f0761b18fd5d60ebbbfd5328f3e99bc3d2c909d41d540ee68a0"
+      "linux-x64": "5362ab6a4cfb23d1eee598aac67aedd9e43351e62724ee1c6b40c4fc8021c08f",
+      "linux-arm64": "f14a2548b41e14ad32b7fdd03a27ffe7160da1046e422e1f651099371b0d27e5",
+      "darwin-x64": "14189cade04f17cf5278bd8061a5ec0c2a2381aa21944ae0d05e8c35b98c2816",
+      "darwin-arm64": "4ba9f5c321894d953407efa3404f0deec07dccfd7db7bc2511bb35226816b583"
     }
   };
 });
@@ -1912,7 +1912,8 @@ var init_policy_catalog = __esm(() => {
       impact: "Catches catastrophic `rm -rf /` and Windows equivalents.",
       description: "Prevent catastrophic deletions",
       match: { events: ["PreToolUse"], toolNames: ["Bash"] },
-      authority: "hard",
+      authority: "reviewable",
+      reviewedBy: ["destructive-deletion"],
       defaultEnabled: false,
       category: "Dangerous Commands",
       params: {
@@ -1943,7 +1944,8 @@ var init_policy_catalog = __esm(() => {
       impact: "kubectl can change live cluster state — gated unless allow-listed.",
       description: "Block kubectl commands (Kubernetes cluster mutations)",
       match: { events: ["PreToolUse"], toolNames: ["Bash"] },
-      authority: "hard",
+      authority: "reviewable",
+      reviewedBy: ["production-infra-change"],
       defaultEnabled: false,
       category: "Infra Commands",
       params: {
@@ -1960,7 +1962,8 @@ var init_policy_catalog = __esm(() => {
       impact: "Terraform mutates real infrastructure — gated unless allow-listed.",
       description: "Block terraform and tofu (OpenTofu) commands",
       match: { events: ["PreToolUse"], toolNames: ["Bash"] },
-      authority: "hard",
+      authority: "reviewable",
+      reviewedBy: ["production-infra-change"],
       defaultEnabled: false,
       category: "Infra Commands",
       params: {
@@ -1977,7 +1980,8 @@ var init_policy_catalog = __esm(() => {
       impact: "AWS CLI can spend money or break prod — gated.",
       description: "Block aws CLI commands",
       match: { events: ["PreToolUse"], toolNames: ["Bash"] },
-      authority: "hard",
+      authority: "reviewable",
+      reviewedBy: ["production-infra-change"],
       defaultEnabled: false,
       category: "Infra Commands",
       params: {
@@ -1994,7 +1998,8 @@ var init_policy_catalog = __esm(() => {
       impact: "gcloud can spend money or break prod — gated.",
       description: "Block gcloud (Google Cloud) CLI commands",
       match: { events: ["PreToolUse"], toolNames: ["Bash"] },
-      authority: "hard",
+      authority: "reviewable",
+      reviewedBy: ["production-infra-change"],
       defaultEnabled: false,
       category: "Infra Commands",
       params: {
@@ -2011,7 +2016,8 @@ var init_policy_catalog = __esm(() => {
       impact: "az can spend money or break prod — gated.",
       description: "Block az (Azure) CLI commands",
       match: { events: ["PreToolUse"], toolNames: ["Bash"] },
-      authority: "hard",
+      authority: "reviewable",
+      reviewedBy: ["production-infra-change"],
       defaultEnabled: false,
       category: "Infra Commands",
       params: {
@@ -2028,7 +2034,8 @@ var init_policy_catalog = __esm(() => {
       impact: "Helm releases mutate cluster state — gated.",
       description: "Block helm commands",
       match: { events: ["PreToolUse"], toolNames: ["Bash"] },
-      authority: "hard",
+      authority: "reviewable",
+      reviewedBy: ["production-infra-change"],
       defaultEnabled: false,
       category: "Infra Commands",
       params: {
@@ -2062,7 +2069,8 @@ var init_policy_catalog = __esm(() => {
       impact: "Stops the agent from creating `.pem`, `id_rsa`, `credentials.json`, etc.",
       description: "Block writing secret key files",
       match: { events: ["PreToolUse"], toolNames: ["Write"] },
-      authority: "hard",
+      authority: "reviewable",
+      reviewedBy: ["secret-exposure"],
       defaultEnabled: false,
       category: "Dangerous Commands",
       params: {
@@ -2096,7 +2104,8 @@ var init_policy_catalog = __esm(() => {
       impact: "Force-pushes rewrite history and can clobber teammates' work.",
       description: "Prevent force-pushing to any branch",
       match: { events: ["PreToolUse"], toolNames: ["Bash"] },
-      authority: "hard",
+      authority: "reviewable",
+      reviewedBy: ["git-history-rewrite"],
       defaultEnabled: false,
       category: "Git"
     },
@@ -2138,6 +2147,23 @@ var init_policy_catalog = __esm(() => {
       defaultEnabled: false,
       category: "Git"
     },
+    {
+      name: "warn-git-clean",
+      displayTitle: "Tried to delete untracked or ignored files with git clean",
+      impact: "`git clean -fdx` takes `.env`, local config and unstaged work — git never had a copy of any of it.",
+      description: "Warns before git clean deletes untracked directories (-d) or ignored files (-x / -X)",
+      match: { events: ["PreToolUse"], toolNames: ["Bash"] },
+      authority: "hard",
+      defaultEnabled: false,
+      category: "Git",
+      params: {
+        destructiveFlags: {
+          type: "string[]",
+          description: "git clean flag letters that make it worth warning about, checked alongside --force. Narrow to ['x','X'] to allow `git clean -fd`, or widen with 'f' to warn on a bare `git clean -f`.",
+          default: ["d", "x", "X"]
+        }
+      }
+    },
     {
       name: "warn-all-files-staged",
       displayTitle: "Staged all files with git add -A / .",
@@ -3288,7 +3314,7 @@ function stripShellQuoting(command) {
   const ansiDecoded = joined.replace(/\$'((?:[^'\\]|\\.)*)'/g, (_, body) => decodeAnsiC(body));
   return ansiDecoded.replace(/\\(.)/g, "$1").replace(/['"]/g, "");
 }
-function gitSubcommand(args) {
+function gitSubcommandIndex(args) {
   for (let i = 0;i < args.length; i++) {
     const arg = args[i];
     if (GIT_FLAGS_WITH_OPERANDS.has(arg)) {
@@ -3297,9 +3323,13 @@ function gitSubcommand(args) {
     }
     if (arg.startsWith("-"))
       continue;
-    return arg;
+    return i;
   }
-  return;
+  return -1;
+}
+function gitSubcommand(args) {
+  const i = gitSubcommandIndex(args);
+  return i < 0 ? undefined : args[i];
 }
 function globCouldNameState(raw) {
   const stripped = raw.replace(/^[()]+|[()]+$/g, "");
@@ -4415,6 +4445,77 @@ function warnGitStashDrop(ctx) {
   }
   return allow();
 }
+function readGitCleanFlags(args) {
+  const letters = new Set;
+  let force = false;
+  let dryRun = false;
+  let sawEndOfOptions = false;
+  for (const token of args) {
+    if (token === "--") {
+      sawEndOfOptions = true;
+      continue;
+    }
+    if (sawEndOfOptions)
+      continue;
+    if (token === "--force") {
+      force = true;
+      continue;
+    }
+    if (token === "--dry-run") {
+      dryRun = true;
+      continue;
+    }
+    if (token.startsWith("--"))
+      continue;
+    if (!SHORT_FLAG_CLUSTER_RE.test(token))
+      continue;
+    for (const letter of token.slice(1)) {
+      if (letter === "f")
+        force = true;
+      if (letter === "n")
+        dryRun = true;
+      letters.add(letter);
+    }
+  }
+  if (force)
+    letters.add("f");
+  return { force, dryRun, letters };
+}
+function gitCleanForceWaived(globalOptions) {
+  for (let i = 0;i < globalOptions.length; i++) {
+    const token = globalOptions[i];
+    const value = token === "-c" ? globalOptions[i + 1] : token.startsWith("-c") ? token.slice(2) : undefined;
+    if (value !== undefined && GIT_CLEAN_FORCE_WAIVED_RE.test(value))
+      return true;
+  }
+  return false;
+}
+function warnGitClean(ctx) {
+  if (ctx.toolName !== "Bash")
+    return allow();
+  const destructiveFlags = ctx.params?.destructiveFlags ?? GIT_CLEAN_DESTRUCTIVE_FLAGS;
+  if (destructiveFlags.length === 0)
+    return allow();
+  for (const segment of shellSegments(getCommand(ctx))) {
+    const tokens = parseArgvTokens(segment);
+    const gitIdx = tokens.findIndex((t) => GIT_CMD_RE.test(t));
+    if (gitIdx < 0)
+      continue;
+    const args = tokens.slice(gitIdx + 1);
+    const subIdx = gitSubcommandIndex(args);
+    if (subIdx < 0 || args[subIdx] !== "clean")
+      continue;
+    const flags = readGitCleanFlags(args.slice(subIdx + 1));
+    if (flags.dryRun)
+      continue;
+    if (!flags.force && !gitCleanForceWaived(args.slice(0, subIdx)))
+      continue;
+    if (!destructiveFlags.some((f) => flags.letters.has(f)))
+      continue;
+    return instruct("STOP: This command deletes untracked files from the working tree (git clean). Git has no copy of " + "untracked or ignored files, so nothing it removes can be recovered: -d takes whole untracked " + "directories, and -x / -X also take .gitignore'd files such as .env, local config and scratch work. " + "Re-run it with --dry-run and confirm the exact paths with the user before executing.");
+  }
+  return allow();
+}
 function warnAllFilesStaged(ctx) {
   if (ctx.toolName !== "Bash")
     return allow();
@@ -4800,7 +4901,7 @@ function registerBuiltinPolicies(enabledNames) {
     }
   }
 }
-var isClaudeInternalPath, isClaudeSettingsFile, SHELL_OPERATORS, SHELL_METACHAR_RE, JWT_RE, API_KEY_PATTERNS, CONNECTION_STRING_RE, PRIVATE_KEY_RE, BEARER_TOKEN_RE, SECRET_PATTERNS, SQL_TOOL_RE, DESTRUCTIVE_SQL_RE, DELETE_NO_WHERE_RE, SQL_WHERE_RE, SCHEMA_ALTER_RE, PUBLISH_CMD_RE, ENV_PRINTENV_RE, ECHO_ENV_RE, EXPORT_RE, PS_ENV_VAR_RE, PS_CHILDITEM_ENV_RE, DOTNET_GETENV_RE, CMD_ECHO_ENV_RE, ENV_FILE_PATH_RE, ENV_CMD_RE, PS_ELEVATION_RE, RUNAS_RE, CURL_PIPE_SH_RE, SEGMENT_SEPARATORS, COMMAND_PREFIX_TOKENS, SELF_BINARY_TOKEN_RE, SELF_ENTRY_PATH_RE, CONFIG_SUBCOMMAND_RE, PAUSE_FLAG_RE, ENV_ASSIGNMENT_RE, RUNNER_OPERAND_RE, PS_WEB_PIPE_RE, SHORT_FLAG_BUNDLE_RE, SAFE_FORCE_PREFIXES, SECRET_FILE_RE, SECRET_FILE_ID_RSA_RE, SECRET_FILE_CREDENTIALS_RE, GIT_COMMIT_MERGE_RE, FAILPROOFAI_STATE_PATH_RE, STATE_READ_COMMANDS, SHELL_KEYWORD_PREFIXES, LOOP_HEADER_RE, COPY_COMMANDS, OPERAND_WRITE_COMMANDS, SECOND_OPERAND_WRITERS, OUTPUT_FLAG_COMMANDS, FIND_WRITE_ACTIONS, SAFE_EXEC_COMMANDS, GIT_DESTRUCTIVE_SUBCOMMANDS, GIT_FLAGS_WITH_OPERANDS, STATE_MENTION_COMMANDS, FIND_EXEC_ACTIONS, PIPELINE_SEPARATORS, VAR_REFERENCE_RE, STATE_GLOB_CANDIDATES, GLOB_DECOYS, BRACE_EXPANSION_LIMIT = 4096, BRACE_EXPANSION_ROUNDS = 24, GLOB_METACHAR_RE, REDIRECT_TARGET_RE, FAILPROOFAI_UNINSTALL_RE, GIT_AMEND_RE, GIT_STASH_DROP_RE, GIT_ADD_ALL_RE, NPM_GLOBAL_RE, YARN_GLOBAL_RE, PNPM_GLOBAL_RE, BUN_GLOBAL_RE, CARGO_INSTALL_RE, PIP_SYSTEM_RE, PKG_MANAGER_DETECTORS, NOHUP_RE, SCREEN_DETACH_RE, TMUX_DETACH_RE, DISOWN_RE, BACKGROUND_AMPERSAND_RE, KUBECTL_RE, TERRAFORM_RE, AWS_CLI_RE, GCLOUD_RE, AZ_CLI_RE, HELM_RE, GH_PIPELINE_RE, gitBranchCache, GIT_BRANCH_CACHE_MAX_ENTRIES = 500, EVAL_FLAG_RE, HOME_PREFIX_RE, RM_CMD_RE, FIND_CMD_RE, FIND_EXEC_RE, FIND_GLOBAL_OPT_RE, FIND_EXPR_START_RE, SCRATCH_ROOTS, CATASTROPHIC_DEPTH = 2, READ_LIKE_CMDS, TOOL_CALL_TRACKER_MAX_BYTES = 65536, SEGMENT_SPLIT_RE, POLICY_IMPLEMENTATIONS, BUILTIN_POLICIES;
+var isClaudeInternalPath, isClaudeSettingsFile, SHELL_OPERATORS, SHELL_METACHAR_RE, JWT_RE, API_KEY_PATTERNS, CONNECTION_STRING_RE, PRIVATE_KEY_RE, BEARER_TOKEN_RE, SECRET_PATTERNS, SQL_TOOL_RE, DESTRUCTIVE_SQL_RE, DELETE_NO_WHERE_RE, SQL_WHERE_RE, SCHEMA_ALTER_RE, PUBLISH_CMD_RE, ENV_PRINTENV_RE, ECHO_ENV_RE, EXPORT_RE, PS_ENV_VAR_RE, PS_CHILDITEM_ENV_RE, DOTNET_GETENV_RE, CMD_ECHO_ENV_RE, ENV_FILE_PATH_RE, ENV_CMD_RE, PS_ELEVATION_RE, RUNAS_RE, CURL_PIPE_SH_RE, SEGMENT_SEPARATORS, COMMAND_PREFIX_TOKENS, SELF_BINARY_TOKEN_RE, SELF_ENTRY_PATH_RE, CONFIG_SUBCOMMAND_RE, PAUSE_FLAG_RE, ENV_ASSIGNMENT_RE, RUNNER_OPERAND_RE, PS_WEB_PIPE_RE, SHORT_FLAG_BUNDLE_RE, SAFE_FORCE_PREFIXES, SECRET_FILE_RE, SECRET_FILE_ID_RSA_RE, SECRET_FILE_CREDENTIALS_RE, GIT_COMMIT_MERGE_RE, FAILPROOFAI_STATE_PATH_RE, STATE_READ_COMMANDS, SHELL_KEYWORD_PREFIXES, LOOP_HEADER_RE, COPY_COMMANDS, OPERAND_WRITE_COMMANDS, SECOND_OPERAND_WRITERS, OUTPUT_FLAG_COMMANDS, FIND_WRITE_ACTIONS, SAFE_EXEC_COMMANDS, GIT_DESTRUCTIVE_SUBCOMMANDS, GIT_FLAGS_WITH_OPERANDS, STATE_MENTION_COMMANDS, FIND_EXEC_ACTIONS, PIPELINE_SEPARATORS, VAR_REFERENCE_RE, STATE_GLOB_CANDIDATES, GLOB_DECOYS, BRACE_EXPANSION_LIMIT = 4096, BRACE_EXPANSION_ROUNDS = 24, GLOB_METACHAR_RE, REDIRECT_TARGET_RE, FAILPROOFAI_UNINSTALL_RE, GIT_AMEND_RE, GIT_STASH_DROP_RE, GIT_CMD_RE, SHORT_FLAG_CLUSTER_RE, GIT_CLEAN_FORCE_WAIVED_RE, GIT_CLEAN_DESTRUCTIVE_FLAGS, GIT_ADD_ALL_RE, NPM_GLOBAL_RE, YARN_GLOBAL_RE, PNPM_GLOBAL_RE, BUN_GLOBAL_RE, CARGO_INSTALL_RE, PIP_SYSTEM_RE, PKG_MANAGER_DETECTORS, NOHUP_RE, SCREEN_DETACH_RE, TMUX_DETACH_RE, DISOWN_RE, BACKGROUND_AMPERSAND_RE, KUBECTL_RE, TERRAFORM_RE, AWS_CLI_RE, GCLOUD_RE, AZ_CLI_RE, HELM_RE, GH_PIPELINE_RE, gitBranchCache, GIT_BRANCH_CACHE_MAX_ENTRIES = 500, EVAL_FLAG_RE, HOME_PREFIX_RE, RM_CMD_RE, FIND_CMD_RE, FIND_EXEC_RE, FIND_GLOBAL_OPT_RE, FIND_EXPR_START_RE, SCRATCH_ROOTS, CATASTROPHIC_DEPTH = 2, READ_LIKE_CMDS, TOOL_CALL_TRACKER_MAX_BYTES = 65536, SEGMENT_SPLIT_RE, POLICY_IMPLEMENTATIONS, BUILTIN_POLICIES;
 var init_builtin_policies = __esm(() => {
   init_policy_catalog();
   init_policy_registry();
@@ -5069,6 +5170,10 @@ var init_builtin_policies = __esm(() => {
   FAILPROOFAI_UNINSTALL_RE = /(?:npm\s+(?:uninstall|remove|un|r)\s.*failproofai|bun\s+remove\s.*failproofai|yarn\s+global\s+remove\s+failproofai|pnpm\s+(?:remove|uninstall|un)\s.*failproofai)/;
   GIT_AMEND_RE = /\bgit\s+commit\b.*--amend\b/;
   GIT_STASH_DROP_RE = /\bgit\s+stash\s+(?:drop|clear)\b/;
+  GIT_CMD_RE = /^(?:\/\S*\/)?git$/;
+  SHORT_FLAG_CLUSTER_RE = /^-[A-Za-z]+$/;
+  GIT_CLEAN_FORCE_WAIVED_RE = /^clean\.requireforce=(?:false|0|no|off)$/i;
+  GIT_CLEAN_DESTRUCTIVE_FLAGS = ["d", "x", "X"];
   GIT_ADD_ALL_RE = /\bgit\s+add\s+(?:-A\b|--all\b|\.(?:\s|$|;|&&|\|\|))/;
   NPM_GLOBAL_RE = /\bnpm\s+(?:install|i)\b(?=.*(?:\s-g\b|--global\b))/;
   YARN_GLOBAL_RE = /\byarn\s+global\s+add\b/;
@@ -5137,6 +5242,7 @@ var init_builtin_policies = __esm(() => {
     "block-work-on-main": blockWorkOnMain,
     "warn-git-amend": warnGitAmend,
     "warn-git-stash-drop": warnGitStashDrop,
+    "warn-git-clean": warnGitClean,
     "warn-all-files-staged": warnAllFilesStaged,
     "warn-destructive-sql": warnDestructiveSql,
     "warn-schema-alteration": warnSchemaAlteration,
@@ -36579,6 +36685,17 @@ function providerForUrl(url) {
     return "custom";
   }
 }
+function accountIdFromUrl(url) {
+  try {
+    const parsed = new URL(url);
+    if (PROVIDER_BY_HOST[parsed.hostname.toLowerCase()] !== "cloudflare")
+      return null;
+    const m = /\/accounts\/([0-9a-f]{32})(?:\/|$)/i.exec(parsed.pathname);
+    return m ? m[1].toLowerCase() : null;
+  } catch {
+    return null;
+  }
+}
 function isProviderDefaultUrl(kind, url) {
   const base = JEV_PROVIDER_DEFAULTS[kind].baseUrl;
   if (!base)
@@ -36668,6 +36785,22 @@ async function setup(argv, deps, opts) {
     const kind = explicit ?? urlProvider.kind;
     if (explicit === null)
       values.set("--provider", kind);
+    if (kind === "cloudflare") {
+      const fromUrl = accountIdFromUrl(normalized);
+      const given = values.get("--account-id");
+      if (fromUrl !== null && given === undefined) {
+        values.set("--account-id", fromUrl);
+      } else if (fromUrl !== null && given !== undefined && given.toLowerCase() !== fromUrl) {
+        return fail2([
+          "Not saved: --account-id and the account id in --url are different.",
+          `  --url names ${fromUrl}`,
+          `  --account-id names ${given.toLowerCase()}`,
+          "Drop one of them.",
+          "",
+          "Nothing was written."
+        ]);
+      }
+    }
     values.set("--base-url", kind !== "custom" && isProviderDefaultUrl(kind, normalized) ? "default" : normalized);
     values.delete("--url");
   }
@@ -36730,7 +36863,9 @@ async function setup(argv, deps, opts) {
   if (kind === "cloudflare" && urlProvider?.kind === "cloudflare" && typeof next.accountId !== "string") {
     return fail2([
       `Not saved: ${urlProvider.host} is Cloudflare Workers AI, whose endpoint is per-account.`,
-      "Pass the account id as well: --account-id <32 hex characters>.",
+      "Pass the account id as well: --account-id <32 hex characters>,",
+      "or give the full run URL, which already contains it:",
+      "  https://api.cloudflare.com/client/v4/accounts/<id>/ai/run",
       "",
       "Nothing was written."
     ]);
@@ -39654,6 +39789,52 @@ function relativeAge(iso) {
     return value < 10 ? "just now" : `${value} seconds ago`;
   return `${value} ${label}${value === 1 ? "" : "s"} ago`;
 }
+function reviewersByCheck(policies, semantic) {
+  const ownChecks = new Set(semantic.map((s) => s.name));
+  const byCheck = new Map(semantic.map((s) => [s.name, []]));
+  for (const policy of policies) {
+    const { authority, reviewedBy } = resolvePolicyAuthority(policy, ownChecks);
+    if (authority !== "reviewable")
+      continue;
+    for (const check of reviewedBy ?? [])
+      byCheck.get(check)?.push(policy.name);
+  }
+  return byCheck;
+}
+function reviewersCell(names) {
+  if (names.length <= REVIEWERS_LISTED)
+    return names.join(", ");
+  return `${names.slice(0, 2).join(", ")}, +${names.length - 2}`;
+}
+function unreviewedCell(mode, policies) {
+  if (mode === "instruct")
+    return "instruct-only — it can never deny";
+  if (policies === 0)
+    return "this pack has no policies to clear";
+  if (policies === 1)
+    return "the one policy here does not cover this";
+  return `nothing in the ${policies} covers this`;
+}
+function jevChecksSection(pack, opts) {
+  if (pack.semantic.length === 0)
+    return null;
+  const reviewers = reviewersByCheck(pack.policies, pack.semantic);
+  const rows = pack.semantic.map((check) => {
+    const named = reviewers.get(check.name) ?? [];
+    return [
+      check.mode,
+      check.name,
+      named.length > 0 ? `reviews  ${reviewersCell(named)}` : `—  ${unreviewedCell(check.mode, pack.policies.length)}`
+    ];
+  });
+  return [
+    ...rule(`Jev checks — ${pack.semantic.length} · not selectable · only where Jev is configured`, opts),
+    ...table({ head: ["", "", ""], rows, protect: [0, 1] }, opts),
+    "",
+    ...note("Nothing toggles them: `--policy` cannot name one, `failproofai policies` never lists them, " + "and a pack's checks replace the ones this build ships with.", opts),
+    ...note(pack.policies.length === 0 ? "This pack ships no regex policies, so none of these checks clears anything here: a deny " + "check can only ADD a deny, and an instruct check only ever warns." : `\`reviews\` is which of this pack's own ${pack.policies.length} policies each check can clear. ` + "A deny check that reviews nothing can only ever ADD a deny; an instruct check never answers " + "deny, so nothing pairs with one.", opts)
+  ];
+}
 async function listRemote(source) {
   const opts = optsFor(process.stdout);
   let preview;
@@ -39679,7 +39860,7 @@ async function listRemote(source) {
       ]);
     }
   }
-  return ok3(stack(title(`${preview.id}@${preview.version}`, `${preview.policies.length} policies · ${categories.length} categories` + (preview.semantic.length > 0 ? ` · ${semanticPhrase(preview.semantic.length)}` : ""), opts), note(`Not installed. ${defaults.length} of ${preview.policies.length} are on by default; the rest are opt-in.` + (preview.effect === "observe" ? " This pack OBSERVES — it records and blocks nothing." : ""), opts), preview.semantic.length > 0 ? note(`It also carries ${semanticPhrase(preview.semantic.length)} — ${preview.semantic.map((s) => s.name).join(", ")}. They are not selectable, they apply only where you configured Jev, and they ` + "replace the checks this build ships with.", opts) : null, preview.minCliVersion ? note(`Requires failproofai ${preview.minCliVersion} or newer.`, opts) : null, preview.resolvedFromLatest ? note(`Newest release: ${preview.source}`, opts) : null, table({ head: ["", "", ""], rows }, opts), nextStep(`failproofai policies add ${source}`, "Install the defaults with:", opts), note("Or take part of it: --policy <a,b>, --category <x,y>, --all", opts)));
+  return ok3(stack(title(`${preview.id}@${preview.version}`, `${preview.policies.length} policies · ${categories.length} categories` + (preview.semantic.length > 0 ? ` · ${semanticPhrase(preview.semantic.length)}` : ""), opts), note(`Not installed. ${defaults.length} of ${preview.policies.length} are on by default; the rest are opt-in.` + (preview.effect === "observe" ? " This pack OBSERVES — it records and blocks nothing." : ""), opts), preview.minCliVersion ? note(`Requires failproofai ${preview.minCliVersion} or newer.`, opts) : null, preview.resolvedFromLatest ? note(`Newest release: ${preview.source}`, opts) : null, table({ head: ["", "", ""], rows }, opts), jevChecksSection(preview, opts), nextStep(`failproofai policies add ${source}`, "Install the defaults with:", opts), note("Or take part of it: --policy <a,b>, --category <x,y>, --all", opts)));
 }
 async function list() {
   const { packs, errors } = readInstalledPacks();
@@ -39774,7 +39955,7 @@ var ok3 = (lines, meta) => ({
   lines,
   exitCode: 0,
   ...meta ? { meta } : {}
-}), fail3 = (lines) => ({ lines, exitCode: 1 }), VALUE_FLAGS3, LOCAL_IMPORT_RES, LOCAL_IMPORT_EXTENSIONS, VERSION_SHA_LENGTH = 12, PUBLISH_VALUE_FLAGS2, INSTALLABLE_PACK_ASSETS, GITHUB_API2, GITHUB_UPLOADS2, GITHUB_GIT2;
+}), fail3 = (lines) => ({ lines, exitCode: 1 }), VALUE_FLAGS3, LOCAL_IMPORT_RES, LOCAL_IMPORT_EXTENSIONS, VERSION_SHA_LENGTH = 12, PUBLISH_VALUE_FLAGS2, INSTALLABLE_PACK_ASSETS, GITHUB_API2, GITHUB_UPLOADS2, GITHUB_GIT2, REVIEWERS_LISTED = 3;
 var init_pack_cli2 = __esm(() => {
   init_types();
   init_pack_manifest();
@@ -42398,7 +42579,7 @@ import { realpathSync as realpathSync7 } from "fs";
 import { dirname as dirname30, resolve as resolve39 } from "path";
 import { fileURLToPath as fileURLToPath4 } from "url";
 // package.json
-var version = "1.0.7-beta.1";
+var version = "1.0.7-beta.2";
 
 // bin/failproofai.mjs
 if (!process.env.FAILPROOFAI_PACKAGE_ROOT) {

package/dist/worker.mjs

@@ -708,7 +708,8 @@ var init_policy_catalog = __esm(() => {
       impact: "Catches catastrophic `rm -rf /` and Windows equivalents.",
       description: "Prevent catastrophic deletions",
       match: { events: ["PreToolUse"], toolNames: ["Bash"] },
-      authority: "hard",
+      authority: "reviewable",
+      reviewedBy: ["destructive-deletion"],
       defaultEnabled: false,
       category: "Dangerous Commands",
       params: {
@@ -739,7 +740,8 @@ var init_policy_catalog = __esm(() => {
       impact: "kubectl can change live cluster state — gated unless allow-listed.",
       description: "Block kubectl commands (Kubernetes cluster mutations)",
       match: { events: ["PreToolUse"], toolNames: ["Bash"] },
-      authority: "hard",
+      authority: "reviewable",
+      reviewedBy: ["production-infra-change"],
       defaultEnabled: false,
       category: "Infra Commands",
       params: {
@@ -756,7 +758,8 @@ var init_policy_catalog = __esm(() => {
       impact: "Terraform mutates real infrastructure — gated unless allow-listed.",
       description: "Block terraform and tofu (OpenTofu) commands",
       match: { events: ["PreToolUse"], toolNames: ["Bash"] },
-      authority: "hard",
+      authority: "reviewable",
+      reviewedBy: ["production-infra-change"],
       defaultEnabled: false,
       category: "Infra Commands",
       params: {
@@ -773,7 +776,8 @@ var init_policy_catalog = __esm(() => {
       impact: "AWS CLI can spend money or break prod — gated.",
       description: "Block aws CLI commands",
       match: { events: ["PreToolUse"], toolNames: ["Bash"] },
-      authority: "hard",
+      authority: "reviewable",
+      reviewedBy: ["production-infra-change"],
       defaultEnabled: false,
       category: "Infra Commands",
       params: {
@@ -790,7 +794,8 @@ var init_policy_catalog = __esm(() => {
       impact: "gcloud can spend money or break prod — gated.",
       description: "Block gcloud (Google Cloud) CLI commands",
       match: { events: ["PreToolUse"], toolNames: ["Bash"] },
-      authority: "hard",
+      authority: "reviewable",
+      reviewedBy: ["production-infra-change"],
       defaultEnabled: false,
       category: "Infra Commands",
       params: {
@@ -807,7 +812,8 @@ var init_policy_catalog = __esm(() => {
       impact: "az can spend money or break prod — gated.",
       description: "Block az (Azure) CLI commands",
       match: { events: ["PreToolUse"], toolNames: ["Bash"] },
-      authority: "hard",
+      authority: "reviewable",
+      reviewedBy: ["production-infra-change"],
       defaultEnabled: false,
       category: "Infra Commands",
       params: {
@@ -824,7 +830,8 @@ var init_policy_catalog = __esm(() => {
       impact: "Helm releases mutate cluster state — gated.",
       description: "Block helm commands",
       match: { events: ["PreToolUse"], toolNames: ["Bash"] },
-      authority: "hard",
+      authority: "reviewable",
+      reviewedBy: ["production-infra-change"],
       defaultEnabled: false,
       category: "Infra Commands",
       params: {
@@ -858,7 +865,8 @@ var init_policy_catalog = __esm(() => {
       impact: "Stops the agent from creating `.pem`, `id_rsa`, `credentials.json`, etc.",
       description: "Block writing secret key files",
       match: { events: ["PreToolUse"], toolNames: ["Write"] },
-      authority: "hard",
+      authority: "reviewable",
+      reviewedBy: ["secret-exposure"],
       defaultEnabled: false,
       category: "Dangerous Commands",
       params: {
@@ -892,7 +900,8 @@ var init_policy_catalog = __esm(() => {
       impact: "Force-pushes rewrite history and can clobber teammates' work.",
       description: "Prevent force-pushing to any branch",
       match: { events: ["PreToolUse"], toolNames: ["Bash"] },
-      authority: "hard",
+      authority: "reviewable",
+      reviewedBy: ["git-history-rewrite"],
       defaultEnabled: false,
       category: "Git"
     },
@@ -934,6 +943,23 @@ var init_policy_catalog = __esm(() => {
       defaultEnabled: false,
       category: "Git"
     },
+    {
+      name: "warn-git-clean",
+      displayTitle: "Tried to delete untracked or ignored files with git clean",
+      impact: "`git clean -fdx` takes `.env`, local config and unstaged work — git never had a copy of any of it.",
+      description: "Warns before git clean deletes untracked directories (-d) or ignored files (-x / -X)",
+      match: { events: ["PreToolUse"], toolNames: ["Bash"] },
+      authority: "hard",
+      defaultEnabled: false,
+      category: "Git",
+      params: {
+        destructiveFlags: {
+          type: "string[]",
+          description: "git clean flag letters that make it worth warning about, checked alongside --force. Narrow to ['x','X'] to allow `git clean -fd`, or widen with 'f' to warn on a bare `git clean -f`.",
+          default: ["d", "x", "X"]
+        }
+      }
+    },
     {
       name: "warn-all-files-staged",
       displayTitle: "Staged all files with git add -A / .",
@@ -1136,7 +1162,7 @@ function instruct(reason) {
 }
 
 // package.json
-var version = "1.0.7-beta.1";
+var version = "1.0.7-beta.2";
 var init_package = () => {};
 
 // src/hooks/policy-types.ts
@@ -2055,7 +2081,7 @@ function stripShellQuoting(command) {
   const ansiDecoded = joined.replace(/\$'((?:[^'\\]|\\.)*)'/g, (_, body) => decodeAnsiC(body));
   return ansiDecoded.replace(/\\(.)/g, "$1").replace(/['"]/g, "");
 }
-function gitSubcommand(args) {
+function gitSubcommandIndex(args) {
   for (let i = 0;i < args.length; i++) {
     const arg = args[i];
     if (GIT_FLAGS_WITH_OPERANDS.has(arg)) {
@@ -2064,9 +2090,13 @@ function gitSubcommand(args) {
     }
     if (arg.startsWith("-"))
       continue;
-    return arg;
+    return i;
   }
-  return;
+  return -1;
+}
+function gitSubcommand(args) {
+  const i = gitSubcommandIndex(args);
+  return i < 0 ? undefined : args[i];
 }
 function globCouldNameState(raw) {
   const stripped = raw.replace(/^[()]+|[()]+$/g, "");
@@ -3182,6 +3212,77 @@ function warnGitStashDrop(ctx) {
   }
   return allow();
 }
+function readGitCleanFlags(args) {
+  const letters = new Set;
+  let force = false;
+  let dryRun = false;
+  let sawEndOfOptions = false;
+  for (const token of args) {
+    if (token === "--") {
+      sawEndOfOptions = true;
+      continue;
+    }
+    if (sawEndOfOptions)
+      continue;
+    if (token === "--force") {
+      force = true;
+      continue;
+    }
+    if (token === "--dry-run") {
+      dryRun = true;
+      continue;
+    }
+    if (token.startsWith("--"))
+      continue;
+    if (!SHORT_FLAG_CLUSTER_RE.test(token))
+      continue;
+    for (const letter of token.slice(1)) {
+      if (letter === "f")
+        force = true;
+      if (letter === "n")
+        dryRun = true;
+      letters.add(letter);
+    }
+  }
+  if (force)
+    letters.add("f");
+  return { force, dryRun, letters };
+}
+function gitCleanForceWaived(globalOptions) {
+  for (let i = 0;i < globalOptions.length; i++) {
+    const token = globalOptions[i];
+    const value = token === "-c" ? globalOptions[i + 1] : token.startsWith("-c") ? token.slice(2) : undefined;
+    if (value !== undefined && GIT_CLEAN_FORCE_WAIVED_RE.test(value))
+      return true;
+  }
+  return false;
+}
+function warnGitClean(ctx) {
+  if (ctx.toolName !== "Bash")
+    return allow();
+  const destructiveFlags = ctx.params?.destructiveFlags ?? GIT_CLEAN_DESTRUCTIVE_FLAGS;
+  if (destructiveFlags.length === 0)
+    return allow();
+  for (const segment of shellSegments(getCommand(ctx))) {
+    const tokens = parseArgvTokens(segment);
+    const gitIdx = tokens.findIndex((t) => GIT_CMD_RE.test(t));
+    if (gitIdx < 0)
+      continue;
+    const args = tokens.slice(gitIdx + 1);
+    const subIdx = gitSubcommandIndex(args);
+    if (subIdx < 0 || args[subIdx] !== "clean")
+      continue;
+    const flags = readGitCleanFlags(args.slice(subIdx + 1));
+    if (flags.dryRun)
+      continue;
+    if (!flags.force && !gitCleanForceWaived(args.slice(0, subIdx)))
+      continue;
+    if (!destructiveFlags.some((f) => flags.letters.has(f)))
+      continue;
+    return instruct("STOP: This command deletes untracked files from the working tree (git clean). Git has no copy of " + "untracked or ignored files, so nothing it removes can be recovered: -d takes whole untracked " + "directories, and -x / -X also take .gitignore'd files such as .env, local config and scratch work. " + "Re-run it with --dry-run and confirm the exact paths with the user before executing.");
+  }
+  return allow();
+}
 function warnAllFilesStaged(ctx) {
   if (ctx.toolName !== "Bash")
     return allow();
@@ -3567,7 +3668,7 @@ function registerBuiltinPolicies(enabledNames) {
     }
   }
 }
-var isClaudeInternalPath, isClaudeSettingsFile, SHELL_OPERATORS, SHELL_METACHAR_RE, JWT_RE, API_KEY_PATTERNS, CONNECTION_STRING_RE, PRIVATE_KEY_RE, BEARER_TOKEN_RE, SECRET_PATTERNS, SQL_TOOL_RE, DESTRUCTIVE_SQL_RE, DELETE_NO_WHERE_RE, SQL_WHERE_RE, SCHEMA_ALTER_RE, PUBLISH_CMD_RE, ENV_PRINTENV_RE, ECHO_ENV_RE, EXPORT_RE, PS_ENV_VAR_RE, PS_CHILDITEM_ENV_RE, DOTNET_GETENV_RE, CMD_ECHO_ENV_RE, ENV_FILE_PATH_RE, ENV_CMD_RE, PS_ELEVATION_RE, RUNAS_RE, CURL_PIPE_SH_RE, SEGMENT_SEPARATORS, COMMAND_PREFIX_TOKENS, SELF_BINARY_TOKEN_RE, SELF_ENTRY_PATH_RE, CONFIG_SUBCOMMAND_RE, PAUSE_FLAG_RE, ENV_ASSIGNMENT_RE, RUNNER_OPERAND_RE, PS_WEB_PIPE_RE, SHORT_FLAG_BUNDLE_RE, SAFE_FORCE_PREFIXES, SECRET_FILE_RE, SECRET_FILE_ID_RSA_RE, SECRET_FILE_CREDENTIALS_RE, GIT_COMMIT_MERGE_RE, FAILPROOFAI_STATE_PATH_RE, STATE_READ_COMMANDS, SHELL_KEYWORD_PREFIXES, LOOP_HEADER_RE, COPY_COMMANDS, OPERAND_WRITE_COMMANDS, SECOND_OPERAND_WRITERS, OUTPUT_FLAG_COMMANDS, FIND_WRITE_ACTIONS, SAFE_EXEC_COMMANDS, GIT_DESTRUCTIVE_SUBCOMMANDS, GIT_FLAGS_WITH_OPERANDS, STATE_MENTION_COMMANDS, FIND_EXEC_ACTIONS, PIPELINE_SEPARATORS, VAR_REFERENCE_RE, STATE_GLOB_CANDIDATES, GLOB_DECOYS, BRACE_EXPANSION_LIMIT = 4096, BRACE_EXPANSION_ROUNDS = 24, GLOB_METACHAR_RE, REDIRECT_TARGET_RE, FAILPROOFAI_UNINSTALL_RE, GIT_AMEND_RE, GIT_STASH_DROP_RE, GIT_ADD_ALL_RE, NPM_GLOBAL_RE, YARN_GLOBAL_RE, PNPM_GLOBAL_RE, BUN_GLOBAL_RE, CARGO_INSTALL_RE, PIP_SYSTEM_RE, PKG_MANAGER_DETECTORS, NOHUP_RE, SCREEN_DETACH_RE, TMUX_DETACH_RE, DISOWN_RE, BACKGROUND_AMPERSAND_RE, KUBECTL_RE, TERRAFORM_RE, AWS_CLI_RE, GCLOUD_RE, AZ_CLI_RE, HELM_RE, GH_PIPELINE_RE, gitBranchCache, GIT_BRANCH_CACHE_MAX_ENTRIES = 500, EVAL_FLAG_RE, HOME_PREFIX_RE, RM_CMD_RE, FIND_CMD_RE, FIND_EXEC_RE, FIND_GLOBAL_OPT_RE, FIND_EXPR_START_RE, SCRATCH_ROOTS, CATASTROPHIC_DEPTH = 2, READ_LIKE_CMDS, TOOL_CALL_TRACKER_MAX_BYTES = 65536, SEGMENT_SPLIT_RE, POLICY_IMPLEMENTATIONS, BUILTIN_POLICIES;
+var isClaudeInternalPath, isClaudeSettingsFile, SHELL_OPERATORS, SHELL_METACHAR_RE, JWT_RE, API_KEY_PATTERNS, CONNECTION_STRING_RE, PRIVATE_KEY_RE, BEARER_TOKEN_RE, SECRET_PATTERNS, SQL_TOOL_RE, DESTRUCTIVE_SQL_RE, DELETE_NO_WHERE_RE, SQL_WHERE_RE, SCHEMA_ALTER_RE, PUBLISH_CMD_RE, ENV_PRINTENV_RE, ECHO_ENV_RE, EXPORT_RE, PS_ENV_VAR_RE, PS_CHILDITEM_ENV_RE, DOTNET_GETENV_RE, CMD_ECHO_ENV_RE, ENV_FILE_PATH_RE, ENV_CMD_RE, PS_ELEVATION_RE, RUNAS_RE, CURL_PIPE_SH_RE, SEGMENT_SEPARATORS, COMMAND_PREFIX_TOKENS, SELF_BINARY_TOKEN_RE, SELF_ENTRY_PATH_RE, CONFIG_SUBCOMMAND_RE, PAUSE_FLAG_RE, ENV_ASSIGNMENT_RE, RUNNER_OPERAND_RE, PS_WEB_PIPE_RE, SHORT_FLAG_BUNDLE_RE, SAFE_FORCE_PREFIXES, SECRET_FILE_RE, SECRET_FILE_ID_RSA_RE, SECRET_FILE_CREDENTIALS_RE, GIT_COMMIT_MERGE_RE, FAILPROOFAI_STATE_PATH_RE, STATE_READ_COMMANDS, SHELL_KEYWORD_PREFIXES, LOOP_HEADER_RE, COPY_COMMANDS, OPERAND_WRITE_COMMANDS, SECOND_OPERAND_WRITERS, OUTPUT_FLAG_COMMANDS, FIND_WRITE_ACTIONS, SAFE_EXEC_COMMANDS, GIT_DESTRUCTIVE_SUBCOMMANDS, GIT_FLAGS_WITH_OPERANDS, STATE_MENTION_COMMANDS, FIND_EXEC_ACTIONS, PIPELINE_SEPARATORS, VAR_REFERENCE_RE, STATE_GLOB_CANDIDATES, GLOB_DECOYS, BRACE_EXPANSION_LIMIT = 4096, BRACE_EXPANSION_ROUNDS = 24, GLOB_METACHAR_RE, REDIRECT_TARGET_RE, FAILPROOFAI_UNINSTALL_RE, GIT_AMEND_RE, GIT_STASH_DROP_RE, GIT_CMD_RE, SHORT_FLAG_CLUSTER_RE, GIT_CLEAN_FORCE_WAIVED_RE, GIT_CLEAN_DESTRUCTIVE_FLAGS, GIT_ADD_ALL_RE, NPM_GLOBAL_RE, YARN_GLOBAL_RE, PNPM_GLOBAL_RE, BUN_GLOBAL_RE, CARGO_INSTALL_RE, PIP_SYSTEM_RE, PKG_MANAGER_DETECTORS, NOHUP_RE, SCREEN_DETACH_RE, TMUX_DETACH_RE, DISOWN_RE, BACKGROUND_AMPERSAND_RE, KUBECTL_RE, TERRAFORM_RE, AWS_CLI_RE, GCLOUD_RE, AZ_CLI_RE, HELM_RE, GH_PIPELINE_RE, gitBranchCache, GIT_BRANCH_CACHE_MAX_ENTRIES = 500, EVAL_FLAG_RE, HOME_PREFIX_RE, RM_CMD_RE, FIND_CMD_RE, FIND_EXEC_RE, FIND_GLOBAL_OPT_RE, FIND_EXPR_START_RE, SCRATCH_ROOTS, CATASTROPHIC_DEPTH = 2, READ_LIKE_CMDS, TOOL_CALL_TRACKER_MAX_BYTES = 65536, SEGMENT_SPLIT_RE, POLICY_IMPLEMENTATIONS, BUILTIN_POLICIES;
 var init_builtin_policies = __esm(() => {
   init_policy_catalog();
   init_policy_registry();
@@ -3836,6 +3937,10 @@ var init_builtin_policies = __esm(() => {
   FAILPROOFAI_UNINSTALL_RE = /(?:npm\s+(?:uninstall|remove|un|r)\s.*failproofai|bun\s+remove\s.*failproofai|yarn\s+global\s+remove\s+failproofai|pnpm\s+(?:remove|uninstall|un)\s.*failproofai)/;
   GIT_AMEND_RE = /\bgit\s+commit\b.*--amend\b/;
   GIT_STASH_DROP_RE = /\bgit\s+stash\s+(?:drop|clear)\b/;
+  GIT_CMD_RE = /^(?:\/\S*\/)?git$/;
+  SHORT_FLAG_CLUSTER_RE = /^-[A-Za-z]+$/;
+  GIT_CLEAN_FORCE_WAIVED_RE = /^clean\.requireforce=(?:false|0|no|off)$/i;
+  GIT_CLEAN_DESTRUCTIVE_FLAGS = ["d", "x", "X"];
   GIT_ADD_ALL_RE = /\bgit\s+add\s+(?:-A\b|--all\b|\.(?:\s|$|;|&&|\|\|))/;
   NPM_GLOBAL_RE = /\bnpm\s+(?:install|i)\b(?=.*(?:\s-g\b|--global\b))/;
   YARN_GLOBAL_RE = /\byarn\s+global\s+add\b/;
@@ -3904,6 +4009,7 @@ var init_builtin_policies = __esm(() => {
     "block-work-on-main": blockWorkOnMain,
     "warn-git-amend": warnGitAmend,
     "warn-git-stash-drop": warnGitStashDrop,
+    "warn-git-clean": warnGitClean,
     "warn-all-files-staged": warnAllFilesStaged,
     "warn-destructive-sql": warnDestructiveSql,
     "warn-schema-alteration": warnSchemaAlteration,