failproofai 1.0.7-beta.1 → 1.0.7

package/src/hooks/policy-registry.ts

@@ -7,8 +7,6 @@
  */
 import type { HookEventType } from "./types";
 import type { PolicyFunction, PolicyMatcher, PolicyParamsSchema, RegisteredPolicy } from "./policy-types";
-import { effectiveReviewerNames, forgetEffectiveReviewerNames } from "./effective-reviewers";
-import { resolvePolicyAuthority, type AuthorityDeclaration } from "./policy-authority";
 
 const REGISTRY_KEY = "__FAILPROOFAI_POLICY_REGISTRY__";
 const INDEX_CACHE_KEY = "__FAILPROOFAI_POLICY_INDEX_CACHE__";
@@ -60,34 +58,15 @@ export function registerPolicy(
   match: PolicyMatcher,
   priority: number = 0,
   params?: PolicyParamsSchema,
-  /**
-   * The policy's authority declaration, as its source wrote it. Judged HERE,
-   * so the registry only ever holds an effective value: `reviewable` with a
-   * clean `reviewedBy`, or `hard`. See `resolvePolicyAuthority`.
-   *
-   * Absent means the caller declared nothing, and the entry then carries no
-   * authority field at all — which `effectiveAuthority` reads as hard.
-   */
-  meta?: AuthorityDeclaration,
 ): void {
   const canonical = normalizePolicyName(name);
   const registry = getRegistry();
   const idx = registry.findIndex((p) => p.name === canonical);
-  // Judged against the reviewers this MACHINE can ask, not against the ones this
-  // build compiled in. A pack that ships its own `semantic` set replaces the
-  // compiled one, so its policies name checks that exist here and nowhere in
-  // `SEMANTIC_POLICY_NAMES` — and judging them by the builtin list would
-  // downgrade the whole rewritten set to `hard` while reporting nothing but a
-  // warning. `effectiveReviewerNames` reads the manifest — already where a
-  // pack's `reviewedBy` itself comes from — once per registration pass.
-  const authority = meta ? resolvePolicyAuthority(meta, effectiveReviewerNames()) : undefined;
   const entry: RegisteredPolicy = {
     name: canonical, description, fn, match, priority,
     // Absent stays absent: `evaluatePolicies` distinguishes "declares a schema"
     // from "declares none", and a spread `params: undefined` is neither.
     ...(params ? { params } : {}),
-    ...(authority ? { authority: authority.authority } : {}),
-    ...(authority?.reviewedBy ? { reviewedBy: authority.reviewedBy } : {}),
   };
   if (idx >= 0) {
     registry[idx] = entry;
@@ -131,10 +110,6 @@ export function clearPolicies(): void {
   const g = globalThis as GlobalWithRegistry;
   g[REGISTRY_KEY] = [];
   setIndexCache(null);
-  // The reviewer set describes the policies that are about to be registered, so
-  // it is rebuilt with them. Dropping it here is also what keeps one read per
-  // evaluation instead of one per policy.
-  forgetEffectiveReviewerNames();
 }
 
 /**

package/src/hooks/policy-types.ts

@@ -43,52 +43,6 @@ export interface RegisteredPolicy {
    * the user's OWN configured `policyParams` for it, not merely the defaults.
    */
   params?: PolicyParamsSchema;
-  /** Whether Jev may clear this policy's deny/instruct; see {@link effectiveAuthority}. */
-  authority?: PolicyAuthority;
-  /**
-   * The semantic policies (`src/hooks/semantic/policies.ts`) that must all be
-   * asked, and none of which may answer `deny`, before Jev clears this policy.
-   */
-  reviewedBy?: string[];
-}
-
-/**
- * Who has the last word on a policy's deny or instruct when Jev is configured.
- *
- * - `hard`: final. Jev can never clear it.
- * - `reviewable`: Jev may clear it, but only through the semantic policies
- *   named in `reviewedBy`, and only when every one of them was actually asked
- *   and none of them answered `deny` — a `none`, `overridden` or `instruct`
- *   answer clears it (`combine.ts`, "A warning-level answer clears the deny").
- *   A named check that was NOT asked always keeps the verdict standing.
- */
-export type PolicyAuthority = "hard" | "reviewable";
-
-/**
- * The authority a policy actually has. `reviewable` only when it is declared
- * `reviewable`, names at least one semantic policy in `reviewedBy`, and is not
- * `alwaysOn`. Anything else — absent, invalid, an empty `reviewedBy`, the
- * self-protection guard — is `hard`, so an unknown custom, cloud or third-party
- * policy can never be weakened by Jev.
- *
- * This is the §7 contract every task builds against, and it is deliberately
- * the looser of two rules: one usable name is enough here. REGISTRATION is
- * stricter — `resolvePolicyAuthority` in `policy-authority.ts` makes the whole
- * declaration hard if any entry is malformed or is not a semantic policy this
- * build has, and that is what `registerPolicy` stores. So a registered policy's
- * `reviewedBy` is already clean, and the two rules agree on everything that
- * reaches the registry.
- */
-export function effectiveAuthority(p: {
-  authority?: unknown;
-  reviewedBy?: unknown;
-  alwaysOn?: boolean;
-}): PolicyAuthority {
-  if (p.alwaysOn === true) return "hard";
-  if (p.authority !== "reviewable") return "hard";
-  if (!Array.isArray(p.reviewedBy)) return "hard";
-  const named = p.reviewedBy.filter((n) => typeof n === "string" && n.length > 0);
-  return named.length > 0 ? "reviewable" : "hard";
 }
 
 export interface PolicyParamsSchema {
@@ -135,10 +89,6 @@ export interface BuiltinPolicyDefinition {
    *  secondary line in the audit report. e.g. "Could leak code from neighboring
    *  repos to the model." */
   impact?: string;
-  /** See {@link PolicyAuthority}. Absent means `hard`. */
-  authority?: PolicyAuthority;
-  /** See {@link RegisteredPolicy.reviewedBy}. */
-  reviewedBy?: string[];
 }
 
 export interface CustomHook {
@@ -148,82 +98,6 @@ export interface CustomHook {
     events?: HookEventType[];
   };
   fn: (ctx: PolicyContext) => PolicyResult | Promise<PolicyResult>;
-  /**
-   * See {@link PolicyAuthority}. Absent means `hard`.
-   *
-   * Honored for the user's own local policy files (explicit paths and
-   * `.failproofai/policies/`). For a pack policy the pack's MANIFEST decides,
-   * and for a cloud-managed one the cloud ARTIFACT record does — the same split
-   * as `params`, so the declaration a user reviewed in a listing is the one
-   * that takes effect.
-   */
-  authority?: PolicyAuthority;
-  /** See {@link RegisteredPolicy.reviewedBy}. */
-  reviewedBy?: string[];
-}
-
-/**
- * The tool classes a semantic policy may be asked about.
- *
- * A structural copy of `ToolClass` in `src/hooks/semantic/types.ts`, and
- * deliberately not an import of it. This module is the public API's type
- * surface — every custom policy file and every pack entry imports it — and the
- * semantic modules must stay off the import graph of a machine with no
- * `jev.json` (see `precondition-names.ts` for what that costs when it slips).
- * A type import would be erased, but the two lists still have to agree, so
- * `__tests__/hooks/semantic/pack-semantic-registry.test.ts` pins them.
- */
-export type SemanticToolClass = "shell" | "write" | "read" | "network" | "other";
-
-/** One yes/no question in a semantic policy, as a pack declares it. */
-export interface SemanticProbeDeclaration {
-  /** Lowercase slug, unique within the policy. The answer map is keyed `<policy>.<id>`. */
-  id: string;
-  instructions: string;
-  criteria?: { true: string; false: string };
-}
-
-/**
- * A semantic (Jev) policy as its author DECLARES it — a question set, not code.
- *
- * The compiled-in equivalent is `SemanticPolicy` in `semantic/types.ts`, and
- * the one difference is the whole reason both exist: there, `precondition` is a
- * function over the computed facts; here it is the NAME of one, because a
- * declaration has to survive a trip through a JSON manifest and because a
- * downloaded artifact must not hand this process an expression to evaluate on
- * every tool call. `semantic/preconditions.ts` binds the name to its predicate.
- *
- * There is no `fn` and no `match`: a semantic policy never executes locally and
- * is never selected by event or tool name — `appliesTo` and `precondition`
- * decide what it is asked about, and Jev answers it. That is also why it is
- * registered through `semanticPolicies`, its own namespace, rather than as a
- * variant of `customPolicies.add`.
- */
-export interface SemanticPolicyDeclaration {
-  /** Short slug. Reported as `semantic/<name>`, and what a `reviewedBy` names. */
-  name: string;
-  /** Past-tense phrase for what was caught, e.g. "Deleted something irreplaceable". */
-  title: string;
-  appliesTo: SemanticToolClass[];
-  /** `deny` blocks on strong evidence and warns on moderate; `instruct` only ever warns. */
-  mode: "deny" | "instruct";
-  /**
-   * Whether the human's own explicit request may clear this policy.
-   *
-   * Required, with no default anywhere in the stack. It is the field that
-   * decides whether a prompt injection can talk its way past the policy, and a
-   * default for it would be a security decision made by absence — the author
-   * would never learn which way it went.
-   */
-  userCanOverride: boolean;
-  /** A name from `PACK_PRECONDITION_NAMES`. Absent, or `"always"`, means no precondition. */
-  precondition?: string;
-  /** Every probe must hold for the policy to fire (conjunction). 1–6 of them. */
-  probes: SemanticProbeDeclaration[];
-  /** If this holds, the policy does not fire — the documented exceptions. */
-  exempt?: SemanticProbeDeclaration;
-  /** Shown to the agent when the policy fires. */
-  guidance: string;
 }
 
 export interface LlmConfig {

package/src/hooks/worker-server.ts

@@ -17,10 +17,7 @@
  * evaluations could have request B's `clearPolicies()` wipe request A's
  * in-flight registration. Serializing keeps the existing registry code
  * correct with zero changes; a worker_threads/process pool is a valid
- * future enhancement if this becomes a real throughput bottleneck. The one
- * exception is the network wait of a two-tier (Jev) review, which happens
- * after the registry is no longer read and so does not hold the queue (see
- * `enqueue`).
+ * future enhancement if this becomes a real throughput bottleneck.
  */
 import { createConnection, createServer, type Server, type Socket } from "node:net";
 import { existsSync, unlinkSync } from "node:fs";
@@ -100,115 +97,37 @@ const TASK_DEADLINE_MS = 60_000;
  * worker whose `try_wait()` reports it gone), which costs one cold start and
  * denies the in-flight requests — the same fail-closed outcome they were headed
  * for anyway, but recovered on the next call instead of never.
- *
- * A task may hand its place in the chain back early by calling `release`:
- * the next request starts while the task finishes on its own. Only the
- * two-tier (Jev) path does, at the point it stops reading the registry and
- * starts waiting on Jev's network answer (`EvaluateHookEventOptions.
- * releaseRegistry`). Without that, every hook on the machine — PostToolUse,
- * UserPromptSubmit, other agents' calls — would queue behind each gated call's
- * round trip, and a slow or unreachable provider would push the calls at the
- * back of the queue past the client's 30 s budget into fail-closed denies.
- * A released task no longer holds the registry, so the deadline it was running
- * under — the one that protects the QUEUE — has done its job. It gets a fresh
- * one of its own instead of none: it is still running, its connection's later
- * replies still queue behind it (see `handleConnection`), and a task that has
- * not settled a minute after handing the queue back is wedged on something
- * that is not going to finish. Its Jev wait is bounded by the configured
- * timeout, so nothing on the intended path comes close.
- *
- * Released tasks therefore run concurrently with each other and with the
- * queue: two gated calls can be waiting on Jev at once (T5's throttle shares
- * one cache and token bucket across them, and does not merge identical
- * in-flight requests). Replies on one connection still leave in request order
- * (see `handleConnection`).
  */
 const WEDGED_EXIT_CODE = 75;
-/**
- * A released task's own deadline, counted from the moment it handed the queue
- * back. Its Jev wait is bounded by the configured timeout (at most 10 s, plus
- * the review's own backstop), so only a task stuck on something else ever
- * reaches this.
- */
-const RELEASED_TASK_DEADLINE_MS = 60_000;
-
-/** What a wedged task costs: this worker, so the supervisor respawns a clean one. */
-function exitWedged(ms: number, released: boolean): void {
-  hookLogWarn(
-    `worker: a ${released ? "released " : ""}request did not settle within ${ms}ms; ` +
-      `exiting so the supervisor can respawn a clean worker`,
-  );
-  process.exit(WEDGED_EXIT_CODE);
-}
-
-export interface QueuedTaskOptions {
-  taskMs?: number;
-  releasedMs?: number;
-  onWedged?: (ms: number, released: boolean) => void;
-}
-
-/**
- * Runs one queued task under a wedge deadline, calling `settle` when the next
- * task may start — because this one finished, or because it handed its place
- * back early with the `release` it is given. A released task keeps running
- * under a deadline of its own (see `RELEASED_TASK_DEADLINE_MS`); dropping the
- * deadline at that point would have made every wedge past the release
- * invisible.
- *
- * Exported for the deadlines' own tests: they are a minute long and expiry
- * exits the process, so a test passes its own values and its own `onWedged`.
- */
-export function runQueuedTask(task: (release: () => void) => Promise<void>, settle: () => void, opts: QueuedTaskOptions = {}): void {
-  const onWedged = opts.onWedged ?? exitWedged;
-  let timer: ReturnType<typeof setTimeout> | undefined;
-  let finished = false;
-  let started = false;
-  const arm = (ms: number, released: boolean) => {
-    clearTimeout(timer);
-    timer = setTimeout(() => onWedged(ms, released), ms);
-    // Never let the deadline itself hold the event loop open.
-    timer.unref?.();
-  };
-  /** The next task starts once, whether this one released first or just finished. */
-  const startNext = () => {
-    if (started) return;
-    started = true;
-    settle();
-  };
-  const finish = () => {
-    finished = true;
-    clearTimeout(timer);
-    startNext();
-  };
-  const release = () => {
-    if (finished) return;
-    arm(opts.releasedMs ?? RELEASED_TASK_DEADLINE_MS, true);
-    startNext();
-  };
-  arm(opts.taskMs ?? TASK_DEADLINE_MS, false);
-  void task(release).then(finish, finish);
-}
 
 let processingChain: Promise<void> = Promise.resolve();
-function enqueue(task: (release: () => void) => Promise<void>): void {
-  processingChain = processingChain.then(() => new Promise<void>((settle) => runQueuedTask(task, settle))).catch(() => {});
+function enqueue(task: () => Promise<void>): void {
+  processingChain = processingChain
+    .then(
+      () =>
+        new Promise<void>((settle) => {
+          const timer = setTimeout(() => {
+            hookLogWarn(
+              `worker: a request did not settle within ${TASK_DEADLINE_MS}ms; ` +
+                `exiting so the supervisor can respawn a clean worker`,
+            );
+            process.exit(WEDGED_EXIT_CODE);
+          }, TASK_DEADLINE_MS);
+          // Never let the deadline itself hold the event loop open.
+          timer.unref?.();
+          const done = () => {
+            clearTimeout(timer);
+            settle();
+          };
+          void task().then(done, done);
+        }),
+    )
+    .catch(() => {});
 }
 
 function handleConnection(socket: Socket, shutdown: () => void): void {
   let recvBuf = Buffer.alloc(0);
   let declaredLen: number | null = null;
-  /**
-   * Hook replies leave in the order their requests arrived on this
-   * connection. The wire carries no request id, so a client that pipelines
-   * several requests on one connection can match replies only by order — which
-   * the strictly serialized queue used to guarantee by itself. A two-tier task
-   * that releases the queue early (see `enqueue`) can finish after a request
-   * that arrived behind it, so each reply waits for every earlier one on its
-   * connection. The Rust supervisor opens one connection per request, so today
-   * this never delays anything; it keeps the ordering true for any client that
-   * does pipeline.
-   */
-  let replies: Promise<void> = Promise.resolve();
 
   socket.on("data", (chunk: Buffer) => {
     recvBuf = Buffer.concat([recvBuf, chunk]);
@@ -259,27 +178,15 @@ function handleConnection(socket: Socket, shutdown: () => void): void {
       }
       const request = message;
 
-      let deliver!: (frame: Buffer) => void;
-      const reply = new Promise<Buffer>((resolveReply) => {
-        deliver = resolveReply;
-      });
-      replies = replies
-        .then(() => reply)
-        .then((frame) => {
-          socket.write(frame);
-        })
-        .catch(() => {});
-
-      enqueue(async (release) => {
+      enqueue(async () => {
         try {
           const result = await evaluateHookEvent(request.hookEvent, request.cli, request.stdin, {
             awaitTelemetryFlush: false,
             // Normalised here so no consumer has to know the wire spells
             // "absent" as null.
             fallbackCwd: request.cwd ?? undefined,
-            releaseRegistry: release,
           });
-          deliver(
+          socket.write(
             encodeFrame({
               type: "hookResult",
               exitCode: result.exitCode,
@@ -291,7 +198,7 @@ function handleConnection(socket: Socket, shutdown: () => void): void {
         } catch (err) {
           const msg = err instanceof Error ? err.message : String(err);
           hookLogWarn(`worker: evaluateHookEvent threw: ${msg}`);
-          deliver(encodeFrame({ type: "error", message: msg }));
+          socket.write(encodeFrame({ type: "error", message: msg }));
         }
       });
     }

package/src/index.ts

@@ -6,9 +6,7 @@
  */
 export {
   customPolicies,
-  semanticPolicies,
   getCustomHooks,
-  getSemanticRegistrations,
   clearCustomHooks,
 } from "./hooks/custom-hooks-registry";
 export { allow, deny, instruct } from "./hooks/policy-helpers";
@@ -18,8 +16,4 @@ export type {
   CustomHook,
   PolicyDecision,
   PolicyFunction,
-  PolicyAuthority,
-  SemanticPolicyDeclaration,
-  SemanticProbeDeclaration,
-  SemanticToolClass,
 } from "./hooks/policy-types";

package/.next/standalone/.next/server/chunks/src_hooks_01frwmb._.js

@@ -1,5 +0,0 @@
-module.exports=[97348,e=>{"use strict";var i=e.i(2157),t=e.i(50227),r=e.i(79857);let o={info:0,warn:1,error:2},n=(0,r.logsDir)(),a=!1,s="warn",l=!1,c=n;function d(e){return!function(){if(a)return;a=!0;let e=(process.env.FAILPROOFAI_LOG_LEVEL??"").toLowerCase();("info"===e||"warn"===e||"error"===e)&&(s=e);let i=(process.env.FAILPROOFAI_HOOK_LOG_FILE??"").trim();i&&(l=!0,"1"!==i&&"true"!==i&&(c=i))}(),o[e]>=o[s]}function u(e,i){process.stderr.write(`[failproofai:hook] ${e} ${i}
-`)}function y(e,r){if(l)try{(0,i.existsSync)(c)||(0,i.mkdirSync)(c,{recursive:!0});let o=(0,t.join)(c,"hooks.log");try{if((0,i.statSync)(o).size>=524288){let e=`hooks-${Date.now()}.log`;(0,i.renameSync)(o,(0,t.join)(c,e))}}catch{}let n=new Date().toISOString(),a=`[${n}] ${e} ${r}
-`;(0,i.appendFileSync)(o,a,"utf-8")}catch{}}e.s(["hookLogError",0,function(e){d("error")&&(u("ERROR",e),y("ERROR",e))},"hookLogInfo",0,function(e){d("info")&&(u("INFO",e),y("INFO",e))},"hookLogWarn",0,function(e){d("warn")&&(u("WARN",e),y("WARN",e))}])},73136,49335,e=>{"use strict";var i=e.i(2157),t=e.i(50227),r=e.i(60526),o=e.i(97348),n=e.i(79857);function a(e){if(!(0,i.existsSync)(e))return{};try{let t=(0,i.readFileSync)(e,"utf8");return JSON.parse(t)}catch(i){return(0,o.hookLogWarn)(`failed to parse config at ${e}: ${i instanceof Error?i.message:String(i)}`),{}}}e.s(["readMergedHooksConfig",0,function(e){let o=function(e){let o=(0,r.homedir)(),n=(0,t.resolve)(e);for(;n!==o;){let e=(0,t.resolve)(n,".failproofai");try{if((0,i.statSync)(e).isDirectory())return n}catch{}let r=(0,t.dirname)(n);if(r===n)break;n=r}return(0,t.resolve)(e)}(e??process.cwd()),s=(0,t.resolve)(o,".failproofai","policies-config.json"),l=(0,t.resolve)(o,".failproofai","policies-config.local.json"),c=(0,n.globalPolicyConfigFile)(),d=a(s),u=a(l),y=a(c),f=new Set([...d.enabledPolicies??[],...u.enabledPolicies??[],...y.enabledPolicies??[]]),h={};for(let e of[d,u,y])if(e.policyParams)for(let[i,t]of Object.entries(e.policyParams))i in h||(h[i]=t);let p=[d,u,y].map(e=>void 0!==e.customPoliciesPaths?e.customPoliciesPaths:void 0!==e.customPoliciesPath?[e.customPoliciesPath]:void 0).find(e=>void 0!==e),v=new Set([...d.disabledCustomPolicies??[],...u.disabledCustomPolicies??[],...y.disabledCustomPolicies??[]]),m=d.customPoliciesEnabled??u.customPoliciesEnabled??y.customPoliciesEnabled,g=d.llm??u.llm??y.llm;return{enabledPolicies:[...f],...Object.keys(h).length>0?{policyParams:h}:{},...void 0!==p?{customPoliciesPaths:p}:{},...v.size?{disabledCustomPolicies:[...v]}:{},...void 0!==m?{customPoliciesEnabled:m}:{},...void 0!==g?{llm:g}:{}}}],73136);var s=e.i(24214),l=e.i(28067),c=e.i(17694);let d=l.POSTHOG_API_KEY,u=new Set;async function y(e,i,t){let r=JSON.stringify({api_key:process.env.FAILPROOFAI_POSTHOG_KEY??d,event:i,distinct_id:e,properties:{...t,$lib:"failproofai-hooks",failproofai_version:s.version,product:l.POSTHOG_PRODUCT}});try{await fetch(process.env.FAILPROOFAI_POSTHOG_HOST?`${process.env.FAILPROOFAI_POSTHOG_HOST}/capture/`:"https://us.i.posthog.com/capture/",{method:"POST",headers:{"Content-Type":"application/json"},body:r,signal:AbortSignal.timeout(5e3)})}catch{}}async function f(e,i,t){if(!(0,c.isTelemetryEnabled)())return;let r=y(e,i,t);u.add(r),r.finally(()=>u.delete(r)),await r}e.s(["trackHookEvent",0,f],49335)},99891,e=>{"use strict";e.i(2157),e.i(79857),e.i(97348);let i=new Set(["destructive-deletion","production-infra-change","git-history-rewrite","push-to-protected-branch","commit-on-protected-branch","secret-exposure","credential-exfiltration","remote-code-execution","privilege-escalation","database-destruction","read-outside-workspace","agent-config-tampering","system-modification","env-secrets-dump","external-destructive-action","external-data-egress"]),t=e=>"string"==typeof e&&e.length>0;e.s(["SEMANTIC_REVIEWER_NAMES",0,i,"authorityFieldsOf",0,function(e){let i={};("hard"===e.authority||"reviewable"===e.authority)&&(i.authority=e.authority);let r=e.reviewedBy;return Array.isArray(r)&&r.length>0&&r.every(t)&&(i.reviewedBy=[...r]),i},"resolvePolicyAuthority",0,function(e,r=i){let o=e?.authority==="reviewable";if(!e||"hard"==(!0!==e.alwaysOn&&"reviewable"===e.authority&&Array.isArray(e.reviewedBy)&&e.reviewedBy.filter(e=>"string"==typeof e&&e.length>0).length>0?"reviewable":"hard")){var n;return o?{authority:"hard",downgraded:!0===(n=e).alwaysOn?"it is alwaysOn, and the self-protection guard is never reviewable":Array.isArray(n.reviewedBy)&&0!==n.reviewedBy.length?"reviewedBy is not a list of semantic policy names":"reviewedBy does not name any semantic policy"}:{authority:"hard"}}let a=e.reviewedBy;if(!a.every(t))return{authority:"hard",downgraded:"reviewedBy is not a list of semantic policy names"};let s=a.filter(e=>!r.has(e));return s.length>0?{authority:"hard",downgraded:`reviewedBy names ${s.map(e=>JSON.stringify(e)).join(", ")}, which ${1===s.length?"is not a semantic policy":"are not semantic policies"} in this build`}:{authority:"reviewable",reviewedBy:[...new Set(a)]}}],99891)}];
-
-//# sourceMappingURL=src_hooks_01frwmb._.js.map