failproofai 1.0.7-beta.2 → 1.0.8-beta.0

package/src/hooks/semantic/jev-review.ts

@@ -53,6 +53,7 @@ import * as intentStore from "./intent";
 import { JevError, transportForConfig, type JevTransport } from "./jev-client";
 import { DEFAULT_JEV_MODE, type JevConfig } from "./jev-config";
 import * as jevThrottle from "./jev-throttle";
+import { sessionProjectRoot } from "./session-root";
 import type { SemanticInput } from "./types";
 
 /**
@@ -177,12 +178,15 @@ export function resolveTimeout(cfg: JevConfig): number {
 }
 
 /** The semantic policy an attributable Jev verdict is filed under. */
+function jevDecider(outcome: Extract<SemanticOutcome, { status: "ok" }>) {
+  const wanted = outcome.verdict.decision === "deny" ? "deny" : "instruct";
+  return outcome.verdict.outcomes.find((o) => o.verdict === wanted);
+}
+
 function jevPolicyName(outcome: Extract<SemanticOutcome, { status: "ok" }>): string {
-  const { verdict } = outcome;
-  const wanted = verdict.decision === "deny" ? "deny" : "instruct";
-  const first = verdict.outcomes.find((o) => o.verdict === wanted);
+  const first = jevDecider(outcome);
   if (first) return `semantic/${first.policy}`;
-  return verdict.beyondTask ? "semantic/beyond-task" : "semantic/jev";
+  return outcome.verdict.beyondTask ? "semantic/beyond-task" : "semantic/jev";
 }
 
 /**
@@ -215,24 +219,30 @@ export function toReview(outcome: SemanticOutcome, cached = false): JevReview {
   // only that no request was made: v1 asks it on every call it sends, with or
   // without a recorded human message (see `compile.ts`).
   const injection = sent ? outcome.verdict.injectionSuspected : null;
+  // Fired, and no consent softened it: an `instruct` the human's own task did
+  // not downgrade from a deny (see "A check that fired without consent keeps
+  // the floor" in `combine.ts`).
+  const warned = (o: (typeof outcomes)[number]) => o.verdict === "instruct" && o.intent !== "downgraded-task-step";
   return {
     kind: "answered",
     decision: outcome.verdict.decision,
     reason: outcome.verdict.reason,
     policyName: jevPolicyName(outcome),
+    ...(jevDecider(outcome)?.origin ? { origin: jevDecider(outcome)?.origin } : {}),
     // Every selected policy's questions were in the request, and `readAnswers`
     // refuses a response missing any of them — so selected == asked, and only
     // when a request was actually made.
     asked: sent ? outcomes.map((o) => o.policy) : [],
-    // Every answer but `deny`: `none` and `overridden` found nothing to stop,
-    // and `instruct` looked at the same concern the regex policy names and
-    // judged it a warning. `combine.ts` clears a reviewable verdict on all
-    // three, and Jev's own instruct then carries the warning through the
-    // most-severe merge — see "A warning-level answer clears the deny, and
-    // leaves the warning" there. A `deny` is what keeps the block.
-    notDenied: sent ? outcomes.filter((o) => o.verdict !== "deny").map((o) => o.policy) : [],
+    // `none` found nothing, `overridden` is what the human asked for, and a
+    // deny the human's task softened to a warning is that task's consent — all
+    // three clear. A `deny`, or a warning nobody consented to, keeps the block.
+    notDenied: sent ? outcomes.filter((o) => o.verdict !== "deny" && !warned(o)).map((o) => o.policy) : [],
     injectionAsked: injection !== null,
     injected: injection !== null && injection >= DEFAULT_THRESHOLDS_V1.injection,
+    // A check that CAN deny warned without consent: nothing may be cleared on
+    // this call (see "A check that fired without consent keeps the floor" in
+    // `combine.ts`).
+    unclearableWarned: outcomes.some((o) => o.mode === "deny" && warned(o)),
     // Something did not fit — a human turn, the agent's message, or what T4's
     // store had already capped before the envelope saw it (it caps to fit the
     // envelope, so the envelope cannot see that cut; only the evaluator's
@@ -300,11 +310,15 @@ export function startJevReview(cfg: JevConfig, call: JevCallContext): TwoTierRev
     intent = { userSaid: [], agentLastMessage: null };
   }
 
+  // Never throws; null only without a cwd, and then there is nothing to pin.
+  const projectRoot = sessionProjectRoot(call.sessionId, call.cwd);
+
   const input: SemanticInput = {
     eventType: call.eventType,
     toolName: call.toolName,
     toolInput: toolInputRecord(call.toolInput),
     ...(call.cwd ? { cwd: call.cwd } : {}),
+    ...(projectRoot ? { projectRoot } : {}),
     ...(call.permissionMode ? { permissionMode: call.permissionMode } : {}),
     userSaid: intent.userSaid,
     agentLastMessage: intent.agentLastMessage,
@@ -323,6 +337,7 @@ export function startJevReview(cfg: JevConfig, call: JevCallContext): TwoTierRev
   let abandoned = false;
   const answered = evaluateSemantic(input, {
     transport,
+    cli: call.cli,
     via: route.via,
     model: route.model,
     timeoutMs,

package/src/hooks/semantic/jev-throttle.ts

@@ -37,8 +37,14 @@
  * the only evaluator on a configured machine and lives for hours, so the
  * process is the cache and the bucket is the process's upstream budget: a
  * caller may build a new wrapper per hook event and every wrapper shares both.
- * The worker also serializes `evaluateHookEvent`, so there is never more than
- * one Jev call in flight and no in-flight de-duplication is needed.
+ * The worker serializes the registry part of `evaluateHookEvent` but hands the
+ * queue back while a two-tier review waits on Jev (`worker-server.ts`
+ * `release`), so several Jev calls can be in flight at once. The cache fills
+ * only when an answer arrives: identical requests in flight together each
+ * miss, each take a token and each go upstream (and are billed).
+ * ponytail: no in-flight de-duplication; add a single-flight map keyed by the
+ * digest if duplicate spend shows up (the joiner's abort must not cancel the
+ * leader, and a leader's own abort must not fail the joiner).
  *
  * **No on-disk cache**, deliberately. It would only help the one-shot
  * in-process path, which on a configured machine does not exist (CLAUDE.md,

package/src/hooks/semantic/pack-policies.ts

@@ -3,7 +3,7 @@
  *
  * ## The replacement rule
  *
- * A pack that declares at least ONE `semantic` entry replaces
+ * A FailproofAI pack that declares at least ONE `semantic` entry replaces
  * `SEMANTIC_POLICIES` wholesale. It mirrors the rule already in force for the
  * regex builtins — installing a pack stops the compiled builtins registering —
  * and it exists for the same reason: one source of truth, so a name collision
@@ -11,6 +11,12 @@
  * arise, and `reviewedBy: ["destructive-deletion"]` in a pack manifest cannot
  * silently mean the builtin's question set instead of the pack's.
  *
+ * Anyone else's checks are ADDED to the compiled-in set instead. Their names
+ * cannot collide with it (a third party's claim to a builtin name is void:
+ * `isReservedClaim`),
+ * and replacing it would drop deny-mode checks like `credential-exfiltration`
+ * that add denies the regex tier does not have — weaker, not noisier.
+ *
  * Two packs that both declare entries CONCATENATE; a name declared by two packs
  * keeps the first and drops the later one, because the answer map is keyed by
  * policy name and the second would overwrite the first's questions in the
@@ -33,6 +39,7 @@
  * regex policies cover — a machine locked out over a typo in the half of the
  * system whose job is to let more real work through.
  */
+import { contestedSemanticNames, isFirstPartyPack, isReservedClaim, jevPacks, replacesBuiltinChecks } from "../effective-reviewers";
 import { hookLogWarn } from "../hook-logger";
 import {
   packSemantic,
@@ -88,9 +95,9 @@ const GLOBAL_QUESTION_CHARS = Math.max(
  * "somebody installed a big pack", and the flag that was supposed to be
  * unreachable from ordinary work becomes routine.
  *
- * The real sixteen use 19,787 characters at their worst, so this is not a
- * constraint on the set we ship. It is the ceiling on what a stranger's pack may
- * ask for.
+ * The real sixteen use `BUILTIN_QUESTION_CHARS` of it, so this is not a
+ * constraint on the set we ship. A stranger's pack is added to them, so what it
+ * may ask for is what they leave.
  */
 export const MAX_PACK_QUESTION_CHARS = MAX_REQUEST_CHARS - MAX_STATE_CHARS - GLOBAL_QUESTION_CHARS;
 
@@ -116,16 +123,19 @@ export function questionChars(entry: SemanticManifestEntry): number {
   return JSON.stringify(questions).length;
 }
 
+/** What the compiled-in set spends of that budget when third-party checks join it. */
+export const BUILTIN_QUESTION_CHARS = SEMANTIC_POLICIES.reduce((n, p) => n + questionChars(p as SemanticManifestEntry), 0);
+
 export interface ResolvedSemanticPolicies {
   policies: ReadonlyArray<SemanticPolicy>;
-  /** True when a pack supplied the set, so the compiled-in one is not in play. */
+  /** True when a pack supplied any of the set. */
   fromPack: boolean;
   /** One line per dropped policy. Diagnostics; nothing here changes a verdict. */
   errors: string[];
 }
 
 /** Turn one validated manifest entry into a policy the compiler can use. */
-function toSemanticPolicy(entry: SemanticManifestEntry): SemanticPolicy {
+function toSemanticPolicy(entry: SemanticManifestEntry, pack: { id: string; version?: string }): SemanticPolicy {
   // An unknown precondition name DROPS the policy (the caller catches this),
   // rather than compiling it with no gate at all. Ungating would be the wider
   // direction, not the weaker one, but it is not what the author asked for: a
@@ -151,6 +161,7 @@ function toSemanticPolicy(entry: SemanticManifestEntry): SemanticPolicy {
     // to the identical policy.
     ...(precondition ? { precondition } : {}),
     guidance: entry.guidance,
+    origin: { packId: pack.id, ...(pack.version ? { packVersion: pack.version } : {}) },
   };
 }
 
@@ -163,18 +174,50 @@ function toSemanticPolicy(entry: SemanticManifestEntry): SemanticPolicy {
  * a filesystem.
  */
 export function semanticPoliciesFromPacks(
-  packs: ReadonlyArray<Pick<ResolvedPack, "id" | "semantic">>,
+  packs: ReadonlyArray<Pick<ResolvedPack, "id" | "semantic"> & { source?: string; version?: string }>,
 ): ResolvedSemanticPolicies {
   const declared = packs.filter((p) => packSemantic(p).length > 0);
   if (declared.length === 0) return { policies: SEMANTIC_POLICIES, fromPack: false, errors: [] };
 
-  const policies: SemanticPolicy[] = [];
+  // FailproofAI's own checks replace the compiled-in set; anyone else's join it
+  // (`replacesBuiltinChecks`, which the reviewer set applies too). First-party
+  // packs spend the budget first, so install order cannot starve them.
+  const replace = replacesBuiltinChecks(declared);
+  const ordered = [...declared.filter((p) => isFirstPartyPack(p)), ...declared.filter((p) => !isFirstPartyPack(p))];
+  const policies: SemanticPolicy[] = replace ? [] : [...SEMANTIC_POLICIES];
   const errors: string[] = [];
-  const seen = new Set<string>();
-  let spent = 0;
-  for (const pack of declared) {
+  const seen = new Set<string>(policies.map((p) => p.name));
+  // A name two packs declare DIFFERENTLY is asked for nobody. Keeping the first
+  // was the escalation: the question that decides another pack's policies came
+  // from whichever pack was listed first, so installing a permissive
+  // `production-infra-change` beside a real one cleared every policy reviewable
+  // by that name. Computed by `effectiveReviewerNames`'s own function, because
+  // the name it refuses in the reviewer set and the question refused here have to
+  // be the same name — a check in the set with nobody's question, or a question
+  // nobody may name, are both worse than neither.
+  const contested = contestedSemanticNames(declared);
+  let spent = replace ? 0 : BUILTIN_QUESTION_CHARS;
+  for (const pack of ordered) {
     for (const entry of packSemantic(pack)) {
+      if (isReservedClaim(pack, entry.name)) {
+        errors.push(
+          `pack ${pack.id} declares semantic policy ${entry.name}, a name reserved for FailproofAI's own Jev checks, ` +
+            `so that pack's version of it is never asked`,
+        );
+        continue;
+      }
+      const claimants = contested.get(entry.name);
+      if (claimants) {
+        // Once per name: every claimant reaches here with the same message.
+        const message =
+          `packs ${claimants.join(" and ")} declare different semantic policies named ${entry.name}, so it is asked ` +
+          `for neither of them and no policy can be cleared by that name`;
+        if (!errors.includes(message)) errors.push(message);
+        continue;
+      }
       if (seen.has(entry.name)) {
+        // Same name, same declaration — a fork or a re-publish of one pack, where
+        // the question is identical either way. Kept once, said once.
         errors.push(`pack ${pack.id} declares semantic policy ${entry.name}, which another pack already declared`);
         continue;
       }
@@ -188,7 +231,7 @@ export function semanticPoliciesFromPacks(
         continue;
       }
       try {
-        policies.push(toSemanticPolicy(entry));
+        policies.push(toSemanticPolicy(entry, pack));
       } catch (err) {
         errors.push(`pack ${pack.id} semantic policy ${entry.name}: ${err instanceof Error ? err.message : String(err)}`);
         continue;
@@ -203,7 +246,7 @@ export function semanticPoliciesFromPacks(
   // the safe one: what a pack's regex half names in `reviewedBy` will not match
   // it, so those policies stay hard rather than being cleared by questions
   // nobody validated.
-  if (policies.length === 0) return { policies: SEMANTIC_POLICIES, fromPack: false, errors };
+  if (policies.length === (replace ? 0 : SEMANTIC_POLICIES.length)) return { policies: SEMANTIC_POLICIES, fromPack: false, errors };
   return { policies, fromPack: true, errors };
 }
 
@@ -224,7 +267,7 @@ const warned = new Set<string>();
  * fails in the safe direction: the set a pack's `reviewedBy` names is not the
  * builtin set, so nothing gets cleared by a policy nobody could read.
  */
-export function resolveSemanticPolicies(): ReadonlyArray<SemanticPolicy> {
+export function resolveSemanticPolicies(cli?: string): ReadonlyArray<SemanticPolicy> {
   let packs: ReadonlyArray<ResolvedPack> = [];
   let manifestErrors: string[] = [];
   try {
@@ -234,7 +277,7 @@ export function resolveSemanticPolicies(): ReadonlyArray<SemanticPolicy> {
   } catch {
     return SEMANTIC_POLICIES;
   }
-  const resolved = semanticPoliciesFromPacks(packs);
+  const resolved = semanticPoliciesFromPacks(jevPacks(packs, cli));
   // Once per process per message, like `warnAuthority`: this runs on every gate
   // event, and in the warm worker that is every tool call of every session.
   for (const message of [...manifestErrors, ...resolved.errors]) {

package/src/hooks/semantic/policies.ts

@@ -53,8 +53,9 @@ const OUTSIDE_PROJECT: ReadonlySet<PathFact["relation"]> = new Set<PathFact["rel
  * question has to be asked. Two tests, because the two tiers measure "the
  * project" from different roots:
  *
- * - `relation` is computed against the enclosing git repository
- *   (`facts.projectRoot`). Anything but `inside_project` / `project_root` is
+ * - `relation` is computed against `facts.projectRoot`: the git root of the
+ *   directory the session started in, pinned by `session-root.ts` so a later
+ *   `cd` cannot move it. Anything but `inside_project` / `project_root` is
  *   outside it.
  * - the partner compares against `$CLAUDE_PROJECT_DIR` or, when that is unset,
  *   the session's LIVE cwd, which drifts below the git root as the agent `cd`s.
@@ -260,7 +261,7 @@ export const SEMANTIC_POLICIES: ReadonlyArray<SemanticPolicy> = [
         },
       },
     ],
-    guidance: "This sends secrets or private files to a remote destination. It is blocked regardless of instructions.",
+    guidance: "This sends secrets or private files to a remote destination, which the user cannot approve. Do not send them.",
   },
   {
     name: "remote-code-execution",

package/src/hooks/semantic/redact.ts

@@ -2017,6 +2017,25 @@ function literalValue(
 
 /** Long runs of token characters: candidates for the high-entropy rule. Greedy, so a match is a whole run. */
 const LONG_TOKEN_RE = /[A-Za-z0-9_-]{32,}/g;
+/**
+ * The same, in standard base64: `+` and `/` split an AWS secret access key
+ * (40 characters, ~72% hold one) into runs under 32, so `LONG_TOKEN_RE` never
+ * saw it and the key went out beside its redacted `AKIA` id.
+ */
+const LONG_B64_TOKEN_RE = /[A-Za-z0-9+/_-]{32,}={0,2}/g;
+
+/**
+ * A standard-base64 run that looks generated. A path or URL is a run of `/`
+ * too, so any `+`/`/`-separated segment that is a word rejects it — the
+ * word-built run then falls through to `LONG_TOKEN_RE`, which still takes a
+ * random token sitting inside it.
+ */
+function looksRandomB64(t: string): boolean {
+  if (!/[+/]/.test(t)) return false;
+  const bare = t.replace(/=+$/, "");
+  if (bare.split(/[+/]/).some((seg) => /^[A-Z]?[a-z]{3,}$/.test(seg) || /^[A-Z]{4,}$/.test(seg))) return false;
+  return looksRandomToken(bare.replace(/[+/]/g, ""));
+}
 
 // ── Secret names ─────────────────────────────────────────────────────────────
 
@@ -2801,7 +2820,15 @@ export function redactSecretsDetailed(text: string, opts: RedactOptions = {}): R
 
   out = redactNamedSecrets(out, c);
 
-  // 8. Anything left that looks generated.
+  // 8. Anything left that looks generated: standard base64 first, whole, so
+  // no piece of it is left for the narrower pass to miss.
+  out = replaceCounting(
+    out,
+    LONG_B64_TOKEN_RE,
+    (m, _g, offset, whole) => (looksRandomB64(m) && !insideDigest(whole, offset) ? marker("high-entropy token") : null),
+    c,
+    "skip",
+  );
   out = replaceCounting(
     out,
     LONG_TOKEN_RE,

package/src/hooks/semantic/session-root.ts

@@ -0,0 +1,116 @@
+/**
+ * The project a session started in, pinned the first time the session is seen.
+ *
+ * The hook payload's `cwd` is the agent's LIVE shell directory. Claude Code
+ * keeps a `cd` across calls, so a session started in `~/work` that once ran
+ * `cd ~/work/api` reports `~/work/api` from then on — and `facts.projectRoot`,
+ * derived from that, shrank with it. Every file elsewhere in `~/work` then read
+ * as `outside_project_in_home`, and `read-outside-workspace` fired on the
+ * project the human opened.
+ *
+ * Letting the root FOLLOW the `cd` instead would be a bypass: `cd ~/.ssh` in
+ * one call and `cat id_rsa` in the next would make `~/.ssh` the project. So the
+ * root is fixed at the session's first reviewed call and never moves after.
+ * A `cd` can change how a relative path resolves (that is still the live cwd's
+ * job, in `extractPaths`) but never what counts as inside the project.
+ *
+ * Failure is never stricter or looser than before this file existed: no
+ * session id, an unreadable store, or a store someone else can write to all
+ * fall back to the live cwd's root — exactly the old behaviour. A session whose
+ * first reviewed call came after a `cd` pins that later directory; same again.
+ */
+import { mkdirSync, readdirSync, readFileSync, statSync, unlinkSync, writeFileSync } from "node:fs";
+import { isAbsolute, resolve } from "node:path";
+import { semanticDir } from "../fp-home";
+import { findProjectRoot } from "./facts";
+import { looseIntentStoreDir } from "./intent";
+
+const SESSION_ID_RE = /^[A-Za-z0-9._-]{1,128}$/;
+const ROOT_FILE_RE = /^[A-Za-z0-9._-]{1,128}\.json$/;
+/** Sessions outlive the intent store's six hours; a week covers any real one. */
+export const SESSION_ROOT_MAX_AGE_MS = 7 * 24 * 60 * 60 * 1000;
+const DIR_WRITABLE_BY_OTHERS = 0o022;
+
+const rootsDir = (): string => resolve(semanticDir(), "roots");
+const rootFile = (sessionId: string): string => resolve(rootsDir(), `${sessionId}.json`);
+
+/** A stored root is only believed when it is a plain absolute path, and never `/`. */
+function validRoot(v: unknown): v is string {
+  return typeof v === "string" && isAbsolute(v) && resolve(v) === v && v !== "/";
+}
+
+/**
+ * Whether the store may be trusted. A directory anyone else can write to lets
+ * them swap in a root of their choosing — a wider root is fewer paths outside
+ * it — so a loose one is ignored, after the same tightening the intent store
+ * applies (`looseIntentStoreDir`).
+ */
+function storeIsOurs(): boolean {
+  if (process.platform === "win32") return true;
+  if (looseIntentStoreDir() !== null) return false;
+  try {
+    const mode = statSync(rootsDir()).mode & 0o777;
+    return (mode & DIR_WRITABLE_BY_OTHERS) === 0;
+  } catch {
+    return true; // Not there yet: nothing to read out of it.
+  }
+}
+
+function readPinned(sessionId: string): string | null {
+  try {
+    const parsed = JSON.parse(readFileSync(rootFile(sessionId), "utf8")) as { root?: unknown };
+    return validRoot(parsed?.root) ? parsed.root : null;
+  } catch {
+    return null;
+  }
+}
+
+/** Delete root files older than {@link SESSION_ROOT_MAX_AGE_MS}. Best effort. */
+export function pruneSessionRoots(now: number = Date.now()): number {
+  let removed = 0;
+  try {
+    const dir = rootsDir();
+    for (const name of readdirSync(dir)) {
+      if (!ROOT_FILE_RE.test(name)) continue;
+      const path = resolve(dir, name);
+      try {
+        const st = statSync(path);
+        if (st.isFile() && now - st.mtimeMs > SESSION_ROOT_MAX_AGE_MS) {
+          unlinkSync(path);
+          removed++;
+        }
+      } catch {
+        // Raced with another writer, or already gone.
+      }
+    }
+  } catch {
+    // No directory yet.
+  }
+  return removed;
+}
+
+/**
+ * The project root to judge this call's paths against: the one pinned for the
+ * session, or — on its first reviewed call — the live cwd's root, pinned now.
+ * Null only when there is no cwd at all. Never throws.
+ */
+export function sessionProjectRoot(sessionId: string | undefined, cwd: string | undefined, now: number = Date.now()): string | null {
+  if (!cwd) return null;
+  const live = findProjectRoot(cwd);
+  if (!sessionId || !SESSION_ID_RE.test(sessionId)) return live;
+  try {
+    if (!storeIsOurs()) return live;
+    const pinned = readPinned(sessionId);
+    if (pinned !== null) return pinned;
+    if (!validRoot(live)) return live;
+    mkdirSync(rootsDir(), { recursive: true, mode: 0o700 });
+    // `wx`: the first writer wins. Two calls racing on a new session both
+    // computed a root from the same moment; whichever lands is the pin, and
+    // the loser's EEXIST just means it answers with the live root this once.
+    writeFileSync(rootFile(sessionId), JSON.stringify({ root: live, at: now }), { mode: 0o600, flag: "wx" });
+    pruneSessionRoots(now);
+  } catch {
+    // Unwritable store: the old behaviour, for this call.
+  }
+  return live;
+}

package/src/hooks/semantic/types.ts

@@ -68,6 +68,8 @@ export interface SemanticPolicy {
   precondition?: (facts: Facts) => boolean;
   /** Shown to the agent when the policy fires. */
   guidance: string;
+  /** The pack that declared it; absent for the compiled-in set. Attribution only. */
+  origin?: { packId: string; packVersion?: string };
 }
 
 export interface PathFact {
@@ -94,6 +96,11 @@ export interface SemanticInput {
   toolName: string;
   toolInput: Record<string, unknown>;
   cwd?: string;
+  /**
+   * The project root pinned for the session (`session-root.ts`), so a `cd`
+   * cannot move what counts as inside the project. Absent: derived from `cwd`.
+   */
+  projectRoot?: string;
   permissionMode?: string;
   /** What the human typed recently, oldest first. Trusted channel only. */
   userSaid: string[];
@@ -121,6 +128,10 @@ export type IntentMode = "v0" | "v1";
 export interface PolicyOutcome {
   policy: string;
   mode: "deny" | "instruct";
+  /** The policy's own `userCanOverride`: false is a check no consent can clear. */
+  userCanOverride?: boolean;
+  /** The pack that declared the check, when one did (`SemanticPolicy.origin`). */
+  origin?: { packId: string; packVersion?: string };
   /** min over probe probabilities — one weak probe spoils the evidence. */
   evidence: number;
   exempt: number | null;

package/src/hooks/tui.ts

@@ -96,6 +96,10 @@ export interface MultiSelectOptions<T> {
 
 const ESC = "\x1B";
 
+/** How every "the key was on argv" warning opens, whichever command took it (`jev setup --token`, `config --token`). */
+export const TOKEN_ON_ARGV =
+  "--token was on the command line: your shell history has it, and while this command ran any process of yours could read it from the process list.";
+
 // ── glyphs ────────────────────────────────────────────────────────────────
 // Exported so the other branded prompts (install-prompt.ts) share the exact
 // same set instead of hand-syncing copies.

package/src/hooks/worker-server.ts

@@ -77,7 +77,8 @@ const TASK_DEADLINE_MS = 60_000;
 
 /**
  * Serializes every request across every connection through one chain, so
- * `evaluateHookEvent` calls never overlap. `.catch()` on each link keeps the
+ * `evaluateHookEvent` calls never overlap while reading the registry (see
+ * `release` below). `.catch()` on each link keeps the
  * chain alive even if a handler throws unexpectedly — one bad request must
  * never wedge every request queued behind it.
  *

package/.next/standalone/.next/server/chunks/[root-of-the-server]__0cuho4x._.js

@@ -1,3 +0,0 @@
-module.exports=[24868,(e,t,r)=>{t.exports=e.x("fs/promises",()=>require("fs/promises"))},12714,(e,t,r)=>{t.exports=e.x("node:fs/promises",()=>require("node:fs/promises"))},46786,(e,t,r)=>{t.exports=e.x("os",()=>require("os"))},14747,(e,t,r)=>{t.exports=e.x("path",()=>require("path"))},71809,e=>{"use strict";async function t(e,t){let r=Array(e.length),i=0;async function n(){for(;i<e.length;){let t=i++;try{r[t]={status:"fulfilled",value:await e[t]()}}catch(e){r[t]={status:"rejected",reason:e}}}}let a=Array.from({length:Math.min(t,e.length)},()=>n());return await Promise.all(a),r}e.s(["batchAll",0,t])},28557,e=>{"use strict";e.s(["formatDate",0,function(e){return new Intl.DateTimeFormat("en-US",{month:"short",day:"numeric",year:"numeric",hour:"numeric",minute:"2-digit",hour12:!0}).format(e)}])},54214,67405,e=>{"use strict";var t=e.i(24868),r=e.i(14747),i=e.i(81580),n=e.i(56936);async function a(e,i,n,a){let o=`agent-${a}.jsonl`;for(let a of[(0,r.join)(e,i,o),(0,r.join)(e,i,n,o),(0,r.join)(e,i,n,"subagents",o)])if(!(0,r.relative)(e,a).startsWith(".."))try{return await (0,t.access)(a),a}catch(e){if("ENOENT"===e.code)continue;break}return null}var o=e.i(83534),s=e.i(71809),l=e.i(28557);function u(e){if(e<1e3)return`${e}ms`;let t=Math.round(e/100);if(t<600)return`${(t/10).toFixed(1)}s`;let r=Math.round(e/1e3);if(r<3600){let e=Math.floor(r/60);return`${e}m ${r%60}s`}let i=Math.round(e/6e4),n=Math.floor(i/60);return`${n}h ${i%60}m`}function c(e){let t=(0,l.formatDate)(e),r=e.getMilliseconds().toString().padStart(3,"0");return`${t}.${r}`}function f(e,t,r,i){return{_source:i,uuid:e.uuid||"",parentUuid:e.parentUuid??null,timestamp:t,timestampMs:r.getTime(),timestampFormatted:c(r)}}async function m(e,t){let r=e.split("\n").filter(e=>""!==e.trim()),i=new Map,n=[],a=[],o=new Set,s=!1;for(let e=0;e<r.length;e++){let l;e>0&&e%200==0&&await new Promise(e=>setImmediate(e));let u=r[e];try{l=JSON.parse(u)}catch{continue}let c={...l,_source:t};a.push(c);let m=l.type,d=l.timestamp;if(!d)continue;let p=new Date(d),g=p.getTime();if("user"===m){let e=l.message;if(Array.isArray(e?.content)){let t=e.content;if(t.some(e=>"tool_result"===e.type)){let e=l.toolUseResult,r="string"==typeof e?.agentId?e.agentId:void 0;for(let e of(r&&/^[a-f0-9]+$/.test(r)&&o.add(r),t)){if("tool_result"!==e.type)continue;let t=e.tool_use_id;if(!t)continue;let{text:n,images:a}=function(e){let t=e.content;if("string"==typeof t)return{text:t};if(Array.isArray(t)){let e=t.filter(e=>"text"===e.type).map(e=>e.text),r=t.filter(e=>"image"===e.type).map(e=>{let t=e.source;return{base64:t.data,mediaType:t.media_type}}).filter(e=>e.base64&&e.mediaType);return{text:e.length>0?e.join("\n"):void 0,images:r.length>0?r:void 0}}return{}}(e);i.set(t,{timestamp:d,timestampMs:g,content:n,images:a,agentId:r})}continue}}let r="string"==typeof e?.content?e.content:"";n.push({type:"user",...f(l,d,p,t),message:{role:"user",content:r}});continue}if("assistant"===m){let e=l.message,r=[];if(Array.isArray(e?.content)&&(r=e.content.filter(e=>["text","tool_use","thinking"].includes(e.type)).map(e=>{if("text"===e.type)return{type:"text",text:e.text};if("tool_use"===e.type){let t=e.input;return{type:"tool_use",id:e.id,name:e.name,input:e.input??{},..."Task"===e.name&&t?{subagentType:t.subagent_type,subagentDescription:t.description}:{}}}return{type:"thinking",thinking:e.thinking,signature:e.signature}})),0===r.length)continue;n.push({type:"assistant",...f(l,d,p,t),message:{role:"assistant",content:r,model:e?.model}});continue}if("file-history-snapshot"===m||"progress"===m||"system"===m){n.push({type:m,...f(l,d,p,t),raw:{...l}});continue}if("queue-operation"===m){let e=s?"Session Resumed":"Session Started";s=!0,n.push({type:"queue-operation",...f(l,d,p,t),label:e});continue}}let l=0;for(let e of n)if("assistant"===e.type)for(let t of(++l%200==0&&await new Promise(e=>setImmediate(e)),e.message.content)){if("tool_use"!==t.type)continue;let r=i.get(t.id);if(!r)continue;let n=new Date(r.timestamp),a=Math.max(0,r.timestampMs-e.timestampMs);t.result={timestamp:r.timestamp,timestampFormatted:c(n),content:r.content,images:r.images,durationMs:a,durationFormatted:u(a)},r.agentId&&(t.subagentId=r.agentId)}return n.length>500&&await new Promise(e=>setImmediate(e)),n.sort((e,t)=>e.timestampMs-t.timestampMs),{entries:n,rawLines:a,subagentIds:Array.from(o)}}async function d(e,t="session"){return(await m(e,t)).entries}async function p(e,o){let l=(0,n.resolveProjectPath)(e),u=(0,i.getClaudeProjectsPath)(),c=(0,r.join)(l,`${o}.jsonl`),f=await (0,t.readFile)(c,"utf-8"),{entries:d,rawLines:p,subagentIds:g}=await m(f,"session");if(0===g.length)return{entries:d,rawLines:p,subagentIds:[]};let h=await (0,s.batchAll)(g.map(r=>async()=>{let i=`agent-${r}`,n=await a(u,e,o,r);if(!n)return null;let s=await (0,t.readFile)(n,"utf-8"),{entries:l,rawLines:c}=await m(s,i);return{entries:l,rawLines:c}}),4),y=[...d],w=[...p];for(let e of h)"fulfilled"===e.status&&e.value&&(y.push(...e.value.entries),w.push(...e.value.rawLines));return y.length>500&&await new Promise(e=>setImmediate(e)),y.sort((e,t)=>e.timestampMs-t.timestampMs),{entries:y,rawLines:w,subagentIds:g}}e.s(["formatDuration",0,u],67405),(0,o.runtimeCache)((e,t)=>p(e,t),60,{maxSize:50}),e.s(["baseEntry",0,f,"formatTimestamp",0,c,"parseLogContent",0,d,"parseRawLines",0,function(e,t){return e.split("\n").filter(e=>""!==e.trim()).flatMap(e=>{try{let r=JSON.parse(e);return void 0!==t&&(r._source=t),[r]}catch{return[]}})}],54214)},40911,e=>{"use strict";let t={info:0,warn:1,error:2};function r(e){return t[e]>=t.warn}function i(e){return`[failproofai${new Date().toISOString()}] ${e}`}e.s(["logActivity",0,function(e,t,n){if(!r("info"))return;let a=[`user=${e}`,`action=${t}`];n&&a.push(n),console.log(i("ACTIVITY"),a.join(" "))},"logError",0,function(e,t){void 0!==t?console.error(i("ERROR"),e,t):console.error(i("ERROR"),e)},"logWarn",0,function(e,t){r("warn")&&(void 0!==t?console.warn(i("WARN"),e,t):console.warn(i("WARN"),e))}])},81580,e=>{"use strict";var t=e.i(46786),r=e.i(14747);e.s(["decodeFolderName",0,function(e){return/^[A-Za-z]--/.test(e)?e[0]+":/"+e.slice(3).replace(/-/g,"/"):e.replace(/-/g,"/")},"encodeFolderName",0,function(e){let t=/^([A-Za-z]):[\\/](.*)$/.exec(e);return t?t[1]+"--"+t[2].replace(/[\\/]/g,"-"):e.replace(/[\\/]/g,"-")},"getClaudeProjectsPath",0,function(){let e=process.env.CLAUDE_PROJECTS_PATH;return e||(0,r.join)((0,t.homedir)(),".claude","projects")}])},56936,e=>{"use strict";var t=e.i(12714),r=e.i(50227),i=e.i(81580),n=e.i(83534),a=e.i(71809),o=e.i(40911),s=e.i(28557);let l=/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/;async function u(e,r){try{return(await (0,t.stat)(e)).mtime}catch(e){return(0,o.logWarn)(`Failed to stat ${r}:`,e),new Date(0)}}async function c(e){try{if(!(await (0,t.stat)(e)).isDirectory())return null;return await (0,t.readdir)(e,{withFileTypes:!0})}catch{return null}}async function f(){try{let e=(0,i.getClaudeProjectsPath)(),t=await c(e);if(!t)return[];let n=(await (0,a.batchAll)(t.filter(e=>e.isDirectory()).map(t=>async()=>{let i=(0,r.join)(e,t.name),n=await u(i,t.name);return{name:t.name,path:i,isDirectory:!0,lastModified:n,lastModifiedFormatted:(0,s.formatDate)(n),cli:["claude"]}}),16)).filter(e=>"fulfilled"===e.status).map(e=>e.value);return n.sort((e,t)=>t.lastModified.getTime()-e.lastModified.getTime()),n}catch(e){return(0,o.logError)("Error reading Claude project folders:",e),[]}}async function m(){let[{getCodexProjects:t},{getCopilotProjects:r},{getCursorProjects:i},{getOpenCodeProjects:n},{getPiProjects:a},{getHermesProjects:s},{getOpenClawProjects:l},{getFactoryProjects:u},{getDevinProjects:c},{getAntigravityProjects:m},{getGooseProjects:d}]=await Promise.all([e.A(37352),e.A(5807),e.A(97452),e.A(82978),e.A(45093),e.A(67347),e.A(38978),e.A(62998),e.A(52400),e.A(91301),e.A(31854)]),[p,g,h,y,w,E,j,M,A,v,x,P]=await Promise.all([f(),t().catch(e=>((0,o.logError)("Error reading Codex projects:",e),[])),r().catch(e=>((0,o.logError)("Error reading Copilot projects:",e),[])),i().catch(e=>((0,o.logError)("Error reading Cursor projects:",e),[])),n().catch(e=>((0,o.logError)("Error reading OpenCode projects:",e),[])),a().catch(e=>((0,o.logError)("Error reading Pi projects:",e),[])),s().catch(e=>((0,o.logError)("Error reading Hermes projects:",e),[])),l().catch(e=>((0,o.logError)("Error reading OpenClaw projects:",e),[])),u().catch(e=>((0,o.logError)("Error reading Factory projects:",e),[])),c().catch(e=>((0,o.logError)("Error reading Devin projects:",e),[])),m().catch(e=>((0,o.logError)("Error reading Antigravity projects:",e),[])),d().catch(e=>((0,o.logError)("Error reading Goose projects:",e),[]))]);return function(...e){let t=new Map;for(let r of e)for(let e of r){let r=t.get(e.name);if(!r){t.set(e.name,{...e,cli:[...e.cli]});continue}let i=[...r.cli];for(let t of e.cli)i.includes(t)||i.push(t);let n=e.lastModified.getTime()>r.lastModified.getTime()?e:r;t.set(e.name,{...r,cli:i,lastModified:n.lastModified,lastModifiedFormatted:n.lastModifiedFormatted,sessionCount:void 0===r.sessionCount&&void 0===e.sessionCount?void 0:(r.sessionCount??0)+(e.sessionCount??0)})}let r=Array.from(t.values());return r.sort((e,t)=>t.lastModified.getTime()-e.lastModified.getTime()),r}(p,g,h,y,w,E,j,M,A,v,x,P)}function d(e){if(!e)throw RangeError("Empty project name");if(/^[/\\]/.test(e))throw RangeError("Absolute project name");let t=(0,r.resolve)((0,i.getClaudeProjectsPath)()),n=(0,r.resolve)((0,r.join)(t,e));if(!n.startsWith(t+r.sep))throw RangeError("Project path escapes root");return n}function p(e){let t=e.match(/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/i);return t?t[0]:void 0}async function g(e){try{let t=await c(e);if(!t)return[];let i=t.filter(e=>e.isFile()&&e.name.endsWith(".jsonl")&&p(e.name)),n=(await (0,a.batchAll)(i.map(t=>async()=>{let i=(0,r.join)(e,t.name),n=await u(i,t.name);return{name:t.name,path:i,lastModified:n,lastModifiedFormatted:(0,s.formatDate)(n),sessionId:p(t.name),cli:"claude"}}),16)).filter(e=>"fulfilled"===e.status).map(e=>e.value);return n.sort((e,t)=>t.lastModified.getTime()-e.lastModified.getTime()),n}catch(e){return(0,o.logError)("Error reading session files:",e),[]}}(0,n.runtimeCache)(m,30),(0,n.runtimeCache)(e=>g(e),30),e.s(["UUID_RE",0,l,"resolveProjectPath",0,d,"resolveSessionFilePath",0,function(e,t){if(!l.test(t))throw RangeError("Invalid session ID");let i=d(e);return(0,r.join)(i,`${t}.jsonl`)}])},83534,e=>{"use strict";e.s(["runtimeCache",0,function(e,t,r){let i=new Map,n=new Map,a=r?.maxSize;return async(...r)=>{let o=JSON.stringify(r),s=i.get(o);if(s&&Date.now()<s.expiry)return s.data;let l=n.get(o);if(l)return l;let u=e(...r).then(e=>{if(n.delete(o),a&&i.size>=a){let e=i.keys().next().value;i.delete(e)}return i.set(o,{data:e,expiry:Date.now()+1e3*t}),e},e=>{throw n.delete(o),e});return n.set(o,u),u}}])}];
-
-//# sourceMappingURL=%5Broot-of-the-server%5D__0cuho4x._.js.map