failproofai 1.0.7 → 1.0.8

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "failproofai",
-  "version": "1.0.7",
-  "description": "Observability and enforcement for AI agent harnesses. 39 built-in policies hooked into 12 of them — Claude Code, Codex, Cursor, Hermes, OpenClaw and more — blocking the tool call before it runs. Local dashboard included, no account needed.",
+  "version": "1.0.8",
+  "description": "Observability and enforcement for AI agent harnesses. 40 built-in policies hooked into 12 of them — Claude Code, Codex, Cursor, Hermes, OpenClaw and more — blocking the tool call before it runs. Local dashboard included, no account needed.",
   "bin": {
     "failproofai": "./dist/cli.mjs",
     "failproofaid": "./bin/failproofaid-shim.mjs"
@@ -122,15 +122,15 @@
     "browserslist": "4.28.8"
   },
   "optionalDependencies": {
-    "@failproofai/failproofaid-linux-x64": "1.0.7",
-    "@failproofai/failproofaid-linux-arm64": "1.0.7",
-    "@failproofai/failproofaid-darwin-x64": "1.0.7",
-    "@failproofai/failproofaid-darwin-arm64": "1.0.7"
+    "@failproofai/failproofaid-linux-x64": "1.0.8",
+    "@failproofai/failproofaid-linux-arm64": "1.0.8",
+    "@failproofai/failproofaid-darwin-x64": "1.0.8",
+    "@failproofai/failproofaid-darwin-arm64": "1.0.8"
   },
   "failproofaidBinaries": {
-    "linux-x64": "65acfcabaa4dda6d37d2958d4100c366a85f17c68d2250de6126e2717ca773e6",
-    "linux-arm64": "cece883f87d53034003be8f0f293aa89bd0e69306d6032e17b3eb91f230b3ce2",
-    "darwin-x64": "565aa3d560a05dd76e2eb843ddbad593d2d8df94c963bdeb1c7e2a8a3816d0c5",
-    "darwin-arm64": "2b41601b53e77a31439e92d8be9be6b9872e3d4ad7e8664ff89cd2be4ed6c44d"
+    "linux-x64": "35b641f60e1724513fbb760db382123dad2b5fcdd67dda6373bda80651bd36bb",
+    "linux-arm64": "a058288f5d08f99612f053793e5c7f59264d3da97f3dbe769e401b0f8536702d",
+    "darwin-x64": "b4f3dbe4aea44e77cc10839647c0dc03a1b8b797dfb27e1d89a6a96554ef27b8",
+    "darwin-arm64": "fd42f28bf92001d39117b488a215578b966f07d316214744aca64a1888f2aed2"
   }
 }

package/pi-extension/index.ts

@@ -404,6 +404,17 @@ export default function failproofaiBridge(pi: PiExtensionApi) {
       session_id: resolveSessionId(e.sessionId, resolveCwd(e.cwd)),
       cwd: resolveCwd(e.cwd),
       hook_event_name: "UserPromptSubmit",
+      // "interactive" | "rpc" | "extension": which channel the input came
+      // through, and the only mark Pi gives about who wrote the prompt. It
+      // names the channel, not the author — `pi -p "<text>"` reports
+      // `interactive` exactly as a person typing does — so the Jev evaluator
+      // uses it only in the direction it is reliable in (`piMachineTurn`,
+      // src/hooks/semantic/intent.ts): `extension`, another extension's
+      // `sendUserMessage()` whose text can be model-written or repo-derived,
+      // is refused, while `interactive`, `rpc` and an absent value are all
+      // recorded as the human's request. Policies read it too, and a later Pi
+      // build may say more here.
+      input_source: e.source,
     });
     if (decision.block) {
       console.error(`[failproofai] prompt blocked: ${decision.reason ?? "blocked by policy"}`);

package/scripts/build-policy-pack.mjs

@@ -31,6 +31,24 @@
  * that stops an agent disabling failproofai, it ships compiled in, and
  * `pack-manifest.ts` REFUSES any pack that declares `alwaysOn`. A pack containing
  * it would be rejected by our own loader — correctly.
+ *
+ * **Every policy states its authority** — whether Jev may clear its verdict —
+ * as the registry would resolve it (`manifestAuthority`), not as a copy of
+ * whatever the catalog happened to spell. A machine running this pack reads
+ * authority from the MANIFEST, so a field left off here is a policy that is
+ * silently hard everywhere it is installed. The entry passes the same fields to
+ * `customPolicies.add`, so a manifest rebuilt from the entry (`failproofai
+ * publish`) says the same thing.
+ *
+ * **It emits no `semantic` array, deliberately.** A pack that declares one
+ * REPLACES this build's compiled-in semantic set wholesale
+ * (`semantic/pack-policies.ts`), and this pack is the dress rehearsal for the
+ * regex floor leaving the package — not for Jev's question set leaving it. So
+ * the 39 builtins travel and the 16 semantic policies stay compiled in, which
+ * also keeps `manifestAuthority` below judging `reviewedBy` against the right
+ * list: the builtin reviewer names, which is what a machine installing this pack
+ * will still be running. The separate `FailproofAI/jev-policies` pack is where
+ * the semantic half ships, and it declares its own `minCliVersion`.
  */
 import { execFileSync } from "node:child_process";
 import { createHash } from "node:crypto";
@@ -40,6 +58,7 @@ import { fileURLToPath } from "node:url";
 // The one place the pack's id is decided. Imported rather than restated — see
 // PACK_ID below for what restating it cost.
 import { CORE_SOURCE } from "../src/hooks/pack-store.ts";
+import { manifestAuthority } from "../src/hooks/policy-authority.ts";
 
 const ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "..");
 // `--out <dir>` lets the conformance test generate into a temp directory rather
@@ -95,6 +114,23 @@ for (const policy of BUILTIN_POLICIES) {
     defaultEnabled: policy.defaultEnabled === true,
     match: policy.match,
     fn: policy.fn,
+    // The parameter schema. It has to be registered here as well as written
+    // into the manifest this script builds, because there are TWO manifest
+    // producers for this pack and they have to agree: this script builds one
+    // from POLICY_CATALOG, and the publish command rebuilds one by importing
+    // the entry and reading back what it registered. A field the entry does
+    // not register is a field the second producer cannot know about.
+    //
+    // params is the one that fails silently STRICTER. Registration reads a
+    // pack policy's schema from the manifest, so an absent schema means the
+    // policy sees empty params: block-sudo's allowPatterns, and block-rm-rf's
+    // and block-read-outside-cwd's allowPaths, stop applying -- taking the
+    // user's own configured values with them. No backticks in this comment:
+    // see the note above entrySource.
+    ...(policy.params !== undefined ? { params: policy.params } : {}),
+    // Whether Jev may clear it; see the note on authority at the top.
+    ...(policy.authority !== undefined ? { authority: policy.authority } : {}),
+    ...(policy.reviewedBy !== undefined ? { reviewedBy: policy.reviewedBy } : {}),
   });
 }
 `;
@@ -120,7 +156,20 @@ try {
 // validates these with the loader's own rules, so a shape the loader would
 // refuse fails this build rather than shipping.
 const { POLICY_CATALOG } = await import(join(ROOT, "src/hooks/policy-catalog.ts"));
-const policies = POLICY_CATALOG.filter((p) => !p.alwaysOn).map((p) => ({ ...p }));
+const policies = POLICY_CATALOG.filter((p) => !p.alwaysOn).map((p) => {
+  // Throws on a declaration the registry would quietly downgrade: in the
+  // catalog that is a typo or a renamed semantic policy, and publishing it
+  // would turn a reviewed decision into an unannounced hard one. The fields
+  // come from the same call, so the check cannot be skipped without the
+  // manifest losing its authority too.
+  const resolved = manifestAuthority(p);
+  // Spread first so every field keeps its catalog position; only the two
+  // authority fields are replaced by their resolved values.
+  const entry = { ...p, authority: resolved.authority };
+  if (resolved.reviewedBy) entry.reviewedBy = resolved.reviewedBy;
+  else delete entry.reviewedBy;
+  return entry;
+});
 
 const manifest = JSON.stringify(
   { id: PACK_ID, version, effect: "enforce", policies },
@@ -138,8 +187,10 @@ writeFileSync(
 );
 
 const omitted = POLICY_CATALOG.filter((p) => p.alwaysOn).map((p) => p.name);
+const reviewable = policies.filter((p) => p.authority === "reviewable").length;
 console.log(
-  `[policy-pack] ${PACK_ID}@${version} — ${policies.length} policies, ` +
+  `[policy-pack] ${PACK_ID}@${version} — ${policies.length} policies ` +
+  `(${reviewable} reviewable by Jev, ${policies.length - reviewable} hard), ` +
   `${(entryBytes.length / 1024).toFixed(1)} KB entry` +
   (omitted.length ? `; omitted alwaysOn: ${omitted.join(", ")}` : ""),
 );

package/src/audit/features.ts

@@ -69,13 +69,13 @@ export const ARCHITECT_CAUTION_SIGNALS = new Set(["reread-after-edit", "redundan
 
 /**
  * Mapping from policy/detector short-name → which archetype its hits feed,
- * and how heavily (intensity within the cluster). Every one of the 39 builtin
+ * and how heavily (intensity within the cluster). Every one of the 40 builtin
  * policies and 8 audit-only detectors maps exactly once — no overlaps, full
  * coverage. Weights express *severity within* a persona; cross-persona
  * fairness is handled later by lift normalisation, not by these numbers.
  */
 export const SIGNAL_MAP: Record<string, { archetype: ArchetypeKey; weight: number }> = {
-  // ── cowboy ── destructive / forceful / bypasses guardrails (20) ───────────
+  // ── cowboy ── destructive / forceful / bypasses guardrails (21) ───────────
   "block-rm-rf":               { archetype: "cowboy", weight: 2.0 },
   "block-failproofai-commands":{ archetype: "cowboy", weight: 2.0 },
   "block-sudo":                { archetype: "cowboy", weight: 1.5 },
@@ -88,6 +88,7 @@ export const SIGNAL_MAP: Record<string, { archetype: ArchetypeKey; weight: numbe
   "git-commit-no-verify":      { archetype: "cowboy", weight: 1.5 },
   "warn-git-amend":            { archetype: "cowboy", weight: 0.8 },
   "warn-git-stash-drop":       { archetype: "cowboy", weight: 1.0 },
+  "warn-git-clean":            { archetype: "cowboy", weight: 1.0 },
   "warn-all-files-staged":     { archetype: "cowboy", weight: 0.6 },
   "block-kubectl":             { archetype: "cowboy", weight: 1.5 },
   "block-terraform":           { archetype: "cowboy", weight: 1.5 },

package/src/hooks/builtin-policies.ts

@@ -186,6 +186,15 @@ const PUBLISH_CMD_RE = /(?:npm\s+publish|bun\s+publish|pnpm\s+publish|yarn\s+npm
 const ENV_PRINTENV_RE = /(?:^|\s|;|&&|\|\|)(?:env|printenv)(?:\s|$|;|&&|\|)/;
 const ECHO_ENV_RE = /echo\s+.*\$\{?[A-Za-z_]/;
 const EXPORT_RE = /(?:^|\s|;|&&|\|\|)export\s+\w+/;
+// The other whole-environment dumps: bare `set` / `export` / `export -p` in
+// command position (`set -e`, `export FOO=bar` are not), `declare|typeset` with
+// -x or -p (not `declare -a`), `compgen -v|-e`, and /proc/<pid>/environ.
+const ENV_DUMP_RE =
+  /(?:^|[;&|({\n`'"]|\$\()\s*(?:set|export(?:\s+-p)?)\s*(?:$|[|;&>)\n])|\b(?:declare|typeset)\s+-[A-Za-z]*[xp]|\bcompgen\s+-[A-Za-z]*[ev]|\/proc\/(?:self|thread-self|\d+|\$\$|\$BASHPID)\/environ/;
+// A script dumping the environment OBJECT, not one variable of it. Two tests,
+// both linear: an interpreter in the command, and the object used whole.
+const SCRIPT_INTERP_RE = /\b(?:python[\d.]*|node|bun|deno)\b/;
+const ENV_OBJECT_RE = /\bos\.environ(?!\s*\[|\.(?:get|setdefault|pop|update)\b)|\bprocess\.env(?![.\[\w])/;
 const PS_ENV_VAR_RE = /\$env:[A-Za-z_]/i;
 const PS_CHILDITEM_ENV_RE = /(?:Get-ChildItem|dir|gci|ls)\s+Env:/i;
 const DOTNET_GETENV_RE = /\[Environment\]::GetEnvironment/i;
@@ -623,8 +632,15 @@ const GIT_DESTRUCTIVE_SUBCOMMANDS = new Set([
  */
 const GIT_FLAGS_WITH_OPERANDS = new Set(["-C", "-c", "--git-dir", "--work-tree", "--namespace", "--exec-path"]);
 
-/** The `git` subcommand, with git's own global options walked off first. */
-function gitSubcommand(args: string[]): string | undefined {
+/**
+ * Where the `git` subcommand sits in `args`, with git's own global options
+ * walked off first, or `-1` when there is no subcommand at all.
+ *
+ * The index rather than the value, because a caller that wants to read the
+ * SUBCOMMAND's flags (`warnGitClean`) needs to know where they start, and
+ * `args.indexOf("clean")` would land on a `-C clean` operand instead.
+ */
+function gitSubcommandIndex(args: string[]): number {
   for (let i = 0; i < args.length; i++) {
     const arg = args[i];
     if (GIT_FLAGS_WITH_OPERANDS.has(arg)) {
@@ -632,9 +648,15 @@ function gitSubcommand(args: string[]): string | undefined {
       continue;
     }
     if (arg.startsWith("-")) continue;
-    return arg;
+    return i;
   }
-  return undefined;
+  return -1;
+}
+
+/** The `git` subcommand, with git's own global options walked off first. */
+function gitSubcommand(args: string[]): string | undefined {
+  const i = gitSubcommandIndex(args);
+  return i < 0 ? undefined : args[i];
 }
 
 /**
@@ -1379,6 +1401,48 @@ const GIT_AMEND_RE = /\bgit\s+commit\b.*--amend\b/;
 // warnGitStashDrop
 const GIT_STASH_DROP_RE = /\bgit\s+stash\s+(?:drop|clear)\b/;
 
+// warnGitClean
+/**
+ * `git`, however the command line spells it. Same shape as {@link RM_CMD_RE}:
+ * an absolute path to the binary does not change what it does.
+ */
+const GIT_CMD_RE = /^(?:\/\S*\/)?git$/;
+
+/** A short-flag cluster: `-f`, `-fdx`, `-xdf`. */
+const SHORT_FLAG_CLUSTER_RE = /^-[A-Za-z]+$/;
+
+/**
+ * `clean.requireForce=false`, the config that makes `git clean` delete with no
+ * `-f` at all — and settable per invocation as `git -c
+ * clean.requireForce=false clean -xd`. Reading the subcommand's flags alone
+ * would call that "no force, no warning" on the one spelling that needs none.
+ */
+const GIT_CLEAN_FORCE_WAIVED_RE = /^clean\.requireforce=(?:false|0|no|off)$/i;
+
+/**
+ * The default `destructiveFlags`, and why the condition is these three letters
+ * rather than "any `git clean`".
+ *
+ * `git clean` deletes nothing without `-f` / `--force` (or the config above),
+ * and `-n` / `--dry-run` only prints — so force is the precondition and
+ * dry-run is the exemption. What force ALONE removes is untracked files in the
+ * current directory: the narrowest spelling, and the one people mean when they
+ * tidy up. These are the letters that widen the blast radius past that:
+ *
+ * - `-x` also removes IGNORED files — `.env`, local config, editor state,
+ *   scratch work. That is the data that genuinely cannot be rebuilt by running
+ *   a command, and it is what makes `git clean -fdx` the severe spelling.
+ * - `-X` removes ONLY ignored files: the same loss, tracked tree untouched.
+ * - `-d` also removes untracked DIRECTORIES — whole new subtrees git has never
+ *   had a copy of.
+ *
+ * A bare `git clean -f` is deliberately absent. It has the smallest radius and
+ * by far the most traffic, and a guard that fires on the ordinary spelling is
+ * one people switch off — which would cost them the `-fdx` warning too. Add
+ * `"f"` to `destructiveFlags` to opt into it.
+ */
+const GIT_CLEAN_DESTRUCTIVE_FLAGS = ["d", "x", "X"];
+
 // warnAllFilesStaged
 const GIT_ADD_ALL_RE = /\bgit\s+add\s+(?:-A\b|--all\b|\.(?:\s|$|;|&&|\|\|))/;
 
@@ -1710,6 +1774,9 @@ function protectEnvVars(ctx: PolicyContext): PolicyResult {
   if (EXPORT_RE.test(cmd)) {
     return deny("Command exports environment variable");
   }
+  if (ENV_DUMP_RE.test(cmd) || (SCRIPT_INTERP_RE.test(cmd) && ENV_OBJECT_RE.test(cmd))) {
+    return deny("Command dumps environment variables");
+  }
   // PowerShell: $env:VAR
   if (PS_ENV_VAR_RE.test(cmd)) {
     return deny("Command reads environment variable via PowerShell");
@@ -2215,17 +2282,35 @@ const READ_LIKE_CMDS =
  * separator characters that appear in compound argv tokens (':' for Docker
  * volume mounts and PATH-like lists, '=' for env var assignments) so that a
  * suffix like '/dashboard.mdx' in 'docs/STAR/dashboard.mdx' or '/docs' in
- * '-v HOST_DIR:/docs' is not misread as a standalone absolute path.
+ * '-v HOST_DIR:/docs' is not misread as a standalone absolute path. '/' is in
+ * that list too, so a match cannot START on the second slash of a protocol
+ * separator: 'http://localhost:3000/x' used to yield '/localhost:3000/x'.
+ * A match that starts on the FIRST slash is untouched, so '//etc/passwd' —
+ * a real, working spelling of /etc/passwd — is still extracted and still
+ * resolves to /etc/passwd.
+ *
+ * A run of slashes with nothing else ('//', '///') that opens a line after
+ * the first is dropped: that is a line-comment marker in a heredoc body, not a
+ * directory. It used to resolve to the filesystem root, which denied a heredoc
+ * writing a TypeScript file into the project. Anywhere else a slash-run is
+ * the root, as a lone '/' is: `cd // && cat etc/shadow` reads /etc/shadow.
  */
 function extractAbsolutePaths(command: string): string[] {
   const paths: string[] = [];
-  const pathRe = /(?<![a-zA-Z0-9_.\-~\\*?:=])(?:~\/[^\s;|&"'()\[\]{}]*|~(?=\s|$|[;|&"'()\[\]{}])|\/[^\s;|&"'()\[\]{}]*)/g;
+  const pathRe = /(?<![a-zA-Z0-9_.\-~\\*?:=/])(?:~\/[^\s;|&"'()\[\]{}]*|~(?=\s|$|[;|&"'()\[\]{}])|\/[^\s;|&"'()\[\]{}]*)/g;
 
   function addPaths(s: string): void {
     pathRe.lastIndex = 0;
     let m: RegExpExecArray | null;
     while ((m = pathRe.exec(s)) !== null) {
       let p = m[0];
+      // A `//` that opens a line after the first (a heredoc body) is a comment
+      // marker. Anywhere else a slash-run is the root: `cd // && cat etc/shadow`,
+      // and `cd \<newline>//`, which bash joins into one line.
+      if (/^\/{2,}$/.test(p)) {
+        const nl = s.lastIndexOf("\n", m.index - 1);
+        if (nl !== -1 && s[nl - 1] !== "\\" && /^[ \t]*$/.test(s.slice(nl + 1, m.index))) continue;
+      }
       if (p === "~") p = homedir();
       else if (p.startsWith("~/")) p = join(homedir(), p.slice(2));
       paths.push(p);
@@ -2516,6 +2601,101 @@ function warnGitStashDrop(ctx: PolicyContext): PolicyResult {
   return allow();
 }
 
+/** What one `git clean` argument list asks for. */
+interface GitCleanFlags {
+  force: boolean;
+  dryRun: boolean;
+  /** Short-flag letters, with `--force` counted as `f` so widening works either way. */
+  letters: Set<string>;
+}
+
+/**
+ * Read `git clean`'s own options: clusters (`-fdx`) and the two long forms
+ * that matter (`--force`, `--dry-run`).
+ *
+ * Everything after `--` is a pathspec, not a flag — `git clean -n -- -fdx`
+ * asks about a file literally called `-fdx` and deletes nothing.
+ */
+function readGitCleanFlags(args: string[]): GitCleanFlags {
+  const letters = new Set<string>();
+  let force = false;
+  let dryRun = false;
+  let sawEndOfOptions = false;
+  for (const token of args) {
+    if (token === "--") {
+      sawEndOfOptions = true;
+      continue;
+    }
+    if (sawEndOfOptions) continue;
+    if (token === "--force") {
+      force = true;
+      continue;
+    }
+    if (token === "--dry-run") {
+      dryRun = true;
+      continue;
+    }
+    if (token.startsWith("--")) continue;
+    if (!SHORT_FLAG_CLUSTER_RE.test(token)) continue;
+    for (const letter of token.slice(1)) {
+      if (letter === "f") force = true;
+      if (letter === "n") dryRun = true;
+      letters.add(letter);
+    }
+  }
+  if (force) letters.add("f");
+  return { force, dryRun, letters };
+}
+
+/** True when git's own `-c key=value` options waive `clean.requireForce`. */
+function gitCleanForceWaived(globalOptions: string[]): boolean {
+  for (let i = 0; i < globalOptions.length; i++) {
+    const token = globalOptions[i];
+    const value =
+      token === "-c" ? globalOptions[i + 1] : token.startsWith("-c") ? token.slice(2) : undefined;
+    if (value !== undefined && GIT_CLEAN_FORCE_WAIVED_RE.test(value)) return true;
+  }
+  return false;
+}
+
+/**
+ * The gap this closes: `git clean -fdx` was caught by NEITHER tier — no regex
+ * builtin matched the string at all, and the semantic check that covers
+ * unrecoverable deletion cannot fire on it. See the note on the catalog entry
+ * for the measurement and for why this policy is `hard`.
+ */
+function warnGitClean(ctx: PolicyContext): PolicyResult {
+  if (ctx.toolName !== "Bash") return allow();
+  const destructiveFlags = ((ctx.params?.destructiveFlags ?? GIT_CLEAN_DESTRUCTIVE_FLAGS) as string[]);
+  if (destructiveFlags.length === 0) return allow();
+
+  for (const segment of shellSegments(getCommand(ctx))) {
+    const tokens = parseArgvTokens(segment);
+    // `findIndex`, not `tokens[0]`, so an env prefix (`GIT_DIR=x git clean …`)
+    // and an absolute binary path both still resolve to the git invocation.
+    const gitIdx = tokens.findIndex((t) => GIT_CMD_RE.test(t));
+    if (gitIdx < 0) continue;
+    const args = tokens.slice(gitIdx + 1);
+    const subIdx = gitSubcommandIndex(args);
+    if (subIdx < 0 || args[subIdx] !== "clean") continue;
+
+    const flags = readGitCleanFlags(args.slice(subIdx + 1));
+    // `-n` / `--dry-run` prints what would go and removes nothing, whatever
+    // else is on the line — the safe inspection form, never a warning.
+    if (flags.dryRun) continue;
+    if (!flags.force && !gitCleanForceWaived(args.slice(0, subIdx))) continue;
+    if (!destructiveFlags.some((f) => flags.letters.has(f))) continue;
+
+    return instruct(
+      "STOP: This command deletes untracked files from the working tree (git clean). Git has no copy of " +
+        "untracked or ignored files, so nothing it removes can be recovered: -d takes whole untracked " +
+        "directories, and -x / -X also take .gitignore'd files such as .env, local config and scratch work. " +
+        "Re-run it with --dry-run and confirm the exact paths with the user before executing.",
+    );
+  }
+  return allow();
+}
+
 function warnAllFilesStaged(ctx: PolicyContext): PolicyResult {
   if (ctx.toolName !== "Bash") return allow();
   const cmd = getCommand(ctx);
@@ -3078,7 +3258,7 @@ function requireCiGreenBeforeStop(ctx: PolicyContext): PolicyResult {
  * Each value is the identical hoisted function object, never a wrapper. Two
  * things depend on that and neither fails loudly: `audit/cache.ts` hashes
  * `fn.toString()` into the audit cache's `engineVersion`, so wrapping every
- * entry would collapse 39 distinct hashes into one and freeze the key — stale
+ * entry would collapse 40 distinct hashes into one and freeze the key — stale
  * audit results would then be served for the full 30-day TTL with no symptom;
  * and `gitBranchCache` is module-scoped, so a per-call factory would silently
  * reset it on every hook event.
@@ -3109,6 +3289,7 @@ const POLICY_IMPLEMENTATIONS: Record<string, PolicyFunction> = {
   "block-work-on-main": blockWorkOnMain,
   "warn-git-amend": warnGitAmend,
   "warn-git-stash-drop": warnGitStashDrop,
+  "warn-git-clean": warnGitClean,
   "warn-all-files-staged": warnAllFilesStaged,
   "warn-destructive-sql": warnDestructiveSql,
   "warn-schema-alteration": warnSchemaAlteration,
@@ -3178,7 +3359,13 @@ export function registerBuiltinPolicies(enabledNames: string[]): void {
     // A guard against the agent disabling failproofai that any of those can
     // switch off is not a guard.
     if (policy.alwaysOn || enabledSet.has(normalizePolicyName(policy.name))) {
-      registerPolicy(policy.name, policy.description, policy.fn, policy.match, 0, policy.params);
+      // `alwaysOn` travels with the declaration so the self-protection guard
+      // resolves to hard even if its catalog entry ever said otherwise.
+      registerPolicy(policy.name, policy.description, policy.fn, policy.match, 0, policy.params, {
+        authority: policy.authority,
+        reviewedBy: policy.reviewedBy,
+        alwaysOn: policy.alwaysOn,
+      });
     }
   }
 }