failproofai 1.0.7 → 1.0.8

package/src/hooks/semantic/session-root.ts

@@ -0,0 +1,116 @@
+/**
+ * The project a session started in, pinned the first time the session is seen.
+ *
+ * The hook payload's `cwd` is the agent's LIVE shell directory. Claude Code
+ * keeps a `cd` across calls, so a session started in `~/work` that once ran
+ * `cd ~/work/api` reports `~/work/api` from then on — and `facts.projectRoot`,
+ * derived from that, shrank with it. Every file elsewhere in `~/work` then read
+ * as `outside_project_in_home`, and `read-outside-workspace` fired on the
+ * project the human opened.
+ *
+ * Letting the root FOLLOW the `cd` instead would be a bypass: `cd ~/.ssh` in
+ * one call and `cat id_rsa` in the next would make `~/.ssh` the project. So the
+ * root is fixed at the session's first reviewed call and never moves after.
+ * A `cd` can change how a relative path resolves (that is still the live cwd's
+ * job, in `extractPaths`) but never what counts as inside the project.
+ *
+ * Failure is never stricter or looser than before this file existed: no
+ * session id, an unreadable store, or a store someone else can write to all
+ * fall back to the live cwd's root — exactly the old behaviour. A session whose
+ * first reviewed call came after a `cd` pins that later directory; same again.
+ */
+import { mkdirSync, readdirSync, readFileSync, statSync, unlinkSync, writeFileSync } from "node:fs";
+import { isAbsolute, resolve } from "node:path";
+import { semanticDir } from "../fp-home";
+import { findProjectRoot } from "./facts";
+import { looseIntentStoreDir } from "./intent";
+
+const SESSION_ID_RE = /^[A-Za-z0-9._-]{1,128}$/;
+const ROOT_FILE_RE = /^[A-Za-z0-9._-]{1,128}\.json$/;
+/** Sessions outlive the intent store's six hours; a week covers any real one. */
+export const SESSION_ROOT_MAX_AGE_MS = 7 * 24 * 60 * 60 * 1000;
+const DIR_WRITABLE_BY_OTHERS = 0o022;
+
+const rootsDir = (): string => resolve(semanticDir(), "roots");
+const rootFile = (sessionId: string): string => resolve(rootsDir(), `${sessionId}.json`);
+
+/** A stored root is only believed when it is a plain absolute path, and never `/`. */
+function validRoot(v: unknown): v is string {
+  return typeof v === "string" && isAbsolute(v) && resolve(v) === v && v !== "/";
+}
+
+/**
+ * Whether the store may be trusted. A directory anyone else can write to lets
+ * them swap in a root of their choosing — a wider root is fewer paths outside
+ * it — so a loose one is ignored, after the same tightening the intent store
+ * applies (`looseIntentStoreDir`).
+ */
+function storeIsOurs(): boolean {
+  if (process.platform === "win32") return true;
+  if (looseIntentStoreDir() !== null) return false;
+  try {
+    const mode = statSync(rootsDir()).mode & 0o777;
+    return (mode & DIR_WRITABLE_BY_OTHERS) === 0;
+  } catch {
+    return true; // Not there yet: nothing to read out of it.
+  }
+}
+
+function readPinned(sessionId: string): string | null {
+  try {
+    const parsed = JSON.parse(readFileSync(rootFile(sessionId), "utf8")) as { root?: unknown };
+    return validRoot(parsed?.root) ? parsed.root : null;
+  } catch {
+    return null;
+  }
+}
+
+/** Delete root files older than {@link SESSION_ROOT_MAX_AGE_MS}. Best effort. */
+export function pruneSessionRoots(now: number = Date.now()): number {
+  let removed = 0;
+  try {
+    const dir = rootsDir();
+    for (const name of readdirSync(dir)) {
+      if (!ROOT_FILE_RE.test(name)) continue;
+      const path = resolve(dir, name);
+      try {
+        const st = statSync(path);
+        if (st.isFile() && now - st.mtimeMs > SESSION_ROOT_MAX_AGE_MS) {
+          unlinkSync(path);
+          removed++;
+        }
+      } catch {
+        // Raced with another writer, or already gone.
+      }
+    }
+  } catch {
+    // No directory yet.
+  }
+  return removed;
+}
+
+/**
+ * The project root to judge this call's paths against: the one pinned for the
+ * session, or — on its first reviewed call — the live cwd's root, pinned now.
+ * Null only when there is no cwd at all. Never throws.
+ */
+export function sessionProjectRoot(sessionId: string | undefined, cwd: string | undefined, now: number = Date.now()): string | null {
+  if (!cwd) return null;
+  const live = findProjectRoot(cwd);
+  if (!sessionId || !SESSION_ID_RE.test(sessionId)) return live;
+  try {
+    if (!storeIsOurs()) return live;
+    const pinned = readPinned(sessionId);
+    if (pinned !== null) return pinned;
+    if (!validRoot(live)) return live;
+    mkdirSync(rootsDir(), { recursive: true, mode: 0o700 });
+    // `wx`: the first writer wins. Two calls racing on a new session both
+    // computed a root from the same moment; whichever lands is the pin, and
+    // the loser's EEXIST just means it answers with the live root this once.
+    writeFileSync(rootFile(sessionId), JSON.stringify({ root: live, at: now }), { mode: 0o600, flag: "wx" });
+    pruneSessionRoots(now);
+  } catch {
+    // Unwritable store: the old behaviour, for this call.
+  }
+  return live;
+}

package/src/hooks/semantic/types.ts

@@ -0,0 +1,162 @@
+/**
+ * Types for the semantic (Jev-backed) evaluator.
+ *
+ * The regex engine answers "does this string match"; this one asks TypeSafe's
+ * Jev a set of typed yes/no questions about the tool call and decides from the
+ * probabilities. Everything here is plain data so the decision can be replayed
+ * offline from a recorded response — see `decide.ts`.
+ */
+
+/** Coarse class of a tool, derived deterministically from its canonical name. */
+export type ToolClass = "shell" | "write" | "read" | "network" | "other";
+
+/** A single yes/no question sent to Jev (the `noul` primitive). */
+export interface NoulQuestion {
+  type: "noul";
+  instructions: string;
+  criteria?: { true: string; false: string };
+}
+
+export interface JevRequest {
+  model: string;
+  state: Record<string, unknown>;
+  questions: Record<string, NoulQuestion>;
+}
+
+export interface JevNoulAnswer {
+  type?: "noul";
+  noul: number;
+}
+
+export interface JevResponse {
+  model: string;
+  answers: Record<string, JevNoulAnswer>;
+  usage?: { input_tokens?: number; output_tokens?: number };
+  /** Set when the provider did not report which Jev version answered (Cloudflare's unversioned alias). */
+  modelUnverified?: boolean;
+}
+
+/** A yes/no probe. A policy fires only when every one of its probes holds. */
+export interface Probe {
+  id: string;
+  instructions: string;
+  criteria?: { true: string; false: string };
+}
+
+export interface SemanticPolicy {
+  /** Short slug; registered as `semantic/<name>` in reasons and logs. */
+  name: string;
+  /** Past-tense, human-readable description of what was caught. */
+  title: string;
+  /** Tool classes this policy is asked about. Unknown/MCP tools get every policy. */
+  appliesTo: ReadonlyArray<ToolClass>;
+  /**
+   * `deny` policies block when the evidence is strong and instruct when it is
+   * moderate; `instruct` policies only ever warn.
+   */
+  mode: "deny" | "instruct";
+  /**
+   * Whether the user's own explicit request may clear this policy. False for
+   * the few things a prompt injection most wants to be approved for.
+   */
+  userCanOverride: boolean;
+  /** Every probe must hold for the policy to fire (conjunction). */
+  probes: ReadonlyArray<Probe>;
+  /** If this holds, the policy does not fire — the documented exceptions. */
+  exempt?: Probe;
+  /** Deterministic precondition over the facts; when false nothing is asked. */
+  precondition?: (facts: Facts) => boolean;
+  /** Shown to the agent when the policy fires. */
+  guidance: string;
+  /** The pack that declared it; absent for the compiled-in set. Attribution only. */
+  origin?: { packId: string; packVersion?: string };
+}
+
+export interface PathFact {
+  asWritten: string;
+  resolved: string;
+  relation: "inside_project" | "project_root" | "outside_project_in_home" | "home_root" | "system" | "root";
+}
+
+/** Deterministic facts computed locally, so Jev never has to count or resolve. */
+export interface Facts {
+  toolName: string;
+  toolClass: ToolClass;
+  /** False for tools no canonical map recognised — MCP tools, skills, etc. */
+  toolIsKnown: boolean;
+  cwd: string | null;
+  projectRoot: string | null;
+  currentGitBranch: string | null;
+  paths: PathFact[];
+  permissionMode: string | null;
+}
+
+export interface SemanticInput {
+  eventType: string;
+  toolName: string;
+  toolInput: Record<string, unknown>;
+  cwd?: string;
+  /**
+   * The project root pinned for the session (`session-root.ts`), so a `cd`
+   * cannot move what counts as inside the project. Absent: derived from `cwd`.
+   */
+  projectRoot?: string;
+  permissionMode?: string;
+  /** What the human typed recently, oldest first. Trusted channel only. */
+  userSaid: string[];
+  /**
+   * The agent's last visible message before the human's latest one — what a
+   * reply like "yes" or "do it" refers to. Agent-written, so it may only ever
+   * explain a human reply; it is never consent on its own.
+   */
+  agentLastMessage?: string | null;
+}
+
+/**
+ * How "did the human ask for this?" is put to Jev.
+ *
+ * - `v0`: one `user_asked` question per policy, phrased as the policy's harm,
+ *   plus a global `scope` question. Measured to clear a policy 6 times in
+ *   1,332 cases.
+ * - `v1`: three task-level questions asked once per call — is this a step
+ *   toward the human's task, did they ask for this exact operation, does it
+ *   reach beyond what they asked — judged only against the human's own words
+ *   with harness-written text removed.
+ */
+export type IntentMode = "v0" | "v1";
+
+export interface PolicyOutcome {
+  policy: string;
+  mode: "deny" | "instruct";
+  /** The policy's own `userCanOverride`: false is a check no consent can clear. */
+  userCanOverride?: boolean;
+  /** The pack that declared the check, when one did (`SemanticPolicy.origin`). */
+  origin?: { packId: string; packVersion?: string };
+  /** min over probe probabilities — one weak probe spoils the evidence. */
+  evidence: number;
+  exempt: number | null;
+  userAsked: number | null;
+  targetNamedByUser: boolean;
+  /** Fired, and the request also addressed the reviewer — so it was blocked outright. */
+  escalatedByInjection: boolean;
+  verdict: "deny" | "instruct" | "overridden" | "none";
+  /** v1 only: why an override applied, or that a deny was softened to instruct. */
+  intent?: "op-requested" | "task-step" | "downgraded-task-step";
+  /**
+   * Set when a clear was withheld because the shell scan may have missed part
+   * of the command (`ScannedCommand.complete` false): what the call touches is
+   * not known locally, so no intent answer may clear or soften it.
+   */
+  targetScanIncomplete?: true;
+}
+
+export interface SemanticVerdict {
+  decision: "allow" | "deny" | "instruct";
+  reason: string | null;
+  outcomes: PolicyOutcome[];
+  injectionSuspected: number | null;
+  /** The `scope` answer: does the request stay within what the user asked? null when not asked. */
+  scopeWithinRequest: number | null;
+  /** v1 only: set when the call was flagged for reaching beyond the human's task. */
+  beyondTask?: boolean;
+}

package/src/hooks/semver-precedence.ts

@@ -0,0 +1,128 @@
+/**
+ * Semver PRECEDENCE — ordering two version strings — for the one question a
+ * pack manifest asks: is the CLI about to run this pack at least the version
+ * the pack says it needs?
+ *
+ * ## Why this is written out rather than reused
+ *
+ * Nothing in this repo orders two versions. `daemonVersionSkew()` compares them
+ * for EQUALITY, which is the right test there — the CLI and the daemon ship
+ * from one commit, so anything but identical is skew — and it yields no
+ * ordering at all. There is no semver dependency either: this module runs on
+ * the hook path, and the loader's rule is that nothing there may pull in a
+ * package.
+ *
+ * ## Why the obvious implementation is wrong here
+ *
+ * Splitting on dots and comparing numbers gets the release triple right and the
+ * PRERELEASE exactly backwards. This package's version is `1.0.7-beta.0`, and
+ * the beta cut from that line is the first build that understands
+ * `minCliVersion` at all — so it is the build a pack's minimum is aimed at. On
+ * numbers alone `1.0.7-beta.0` satisfies a minimum of `1.0.7`, which reads the
+ * beta as the newer build when it is the older one, and the pack installs on a
+ * CLI that may be missing the feature the minimum exists to require.
+ *
+ * So precedence follows semver §11 for real:
+ *
+ *     1.0.6 < 1.0.7-beta.0 < 1.0.7-beta.1 < 1.0.7 < 1.0.8
+ *
+ * - the release triple is compared numerically, field by field;
+ * - a version WITH a prerelease is lower than the same triple without one;
+ * - prerelease identifiers are compared left to right, numeric ones
+ *   numerically and always below alphanumeric ones, and a longer identifier
+ *   list wins when every shared identifier is equal;
+ * - build metadata (`+2026.09.24`) is ignored, because it carries no precedence.
+ *
+ * Anything this cannot order is reported as unorderable rather than guessed at.
+ * A caller comparing versions to decide whether to REFUSE something needs to
+ * know the difference between "older" and "I cannot tell".
+ */
+
+/** A version decomposed far enough to be ordered. Build metadata is dropped. */
+export interface SemVer {
+  major: number;
+  minor: number;
+  patch: number;
+  /** Dot-separated prerelease identifiers, numeric ones as numbers. Empty for a release. */
+  prerelease: ReadonlyArray<string | number>;
+}
+
+/**
+ * Strict semver, and strict on purpose. `v1.0.0`, `1.0`, `01.2.3` and
+ * `1.0.7-beta.0.` are all things people write and none of them has one
+ * unambiguous ordering, so they are refused rather than normalised — a
+ * `minCliVersion` nobody can order is a requirement nobody can check.
+ */
+const SEMVER_RE =
+  /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-((?:0|[1-9]\d*|\d*[A-Za-z-][0-9A-Za-z-]*)(?:\.(?:0|[1-9]\d*|\d*[A-Za-z-][0-9A-Za-z-]*))*))?(?:\+([0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*))?$/;
+
+const NUMERIC_ID = /^(?:0|[1-9]\d*)$/;
+
+/** Decompose a version, or `null` when it is not one this can order. */
+export function parseSemver(value: unknown): SemVer | null {
+  if (typeof value !== "string") return null;
+  const m = SEMVER_RE.exec(value);
+  if (!m) return null;
+  return {
+    major: Number(m[1]),
+    minor: Number(m[2]),
+    patch: Number(m[3]),
+    prerelease: m[4] === undefined ? [] : m[4].split(".").map((id) => (NUMERIC_ID.test(id) ? Number(id) : id)),
+  };
+}
+
+const cmp = (a: number, b: number): number => (a < b ? -1 : a > b ? 1 : 0);
+
+/**
+ * Compare two prerelease identifier lists. An EMPTY list is a release, and a
+ * release outranks every prerelease of the same triple — the rule the naive
+ * implementation loses, and the one that decides this release's own case.
+ */
+function comparePrerelease(a: ReadonlyArray<string | number>, b: ReadonlyArray<string | number>): number {
+  if (a.length === 0 && b.length === 0) return 0;
+  if (a.length === 0) return 1;
+  if (b.length === 0) return -1;
+  for (let i = 0; i < Math.min(a.length, b.length); i++) {
+    const x = a[i];
+    const y = b[i];
+    if (x === y) continue;
+    const xNum = typeof x === "number";
+    const yNum = typeof y === "number";
+    // "Numeric identifiers always have lower precedence than non-numeric
+    // ones" (semver §11.4.3): `1.0.0-1` is below `1.0.0-alpha`, so an `rc.1`
+    // line and a `1` line never interleave by accident.
+    if (xNum !== yNum) return xNum ? -1 : 1;
+    if (xNum && yNum) return cmp(x as number, y as number);
+    return (x as string) < (y as string) ? -1 : 1;
+  }
+  // Every shared identifier is equal, so the longer list is the later build:
+  // `1.0.0-beta` < `1.0.0-beta.1`.
+  return cmp(a.length, b.length);
+}
+
+/** `-1`, `0` or `1` by semver precedence. */
+export function compareSemver(a: SemVer, b: SemVer): number {
+  return cmp(a.major, b.major) || cmp(a.minor, b.minor) || cmp(a.patch, b.patch) || comparePrerelease(a.prerelease, b.prerelease);
+}
+
+/**
+ * `-1` / `0` / `1` for two version STRINGS, or `null` when either one cannot be
+ * ordered. Null is deliberately not 0: a caller that treats "unorderable" as
+ * "equal" silently accepts the requirement it could not check.
+ *
+ * There is deliberately NO `meetsMinimum(current, minimum): boolean | null` here.
+ * It existed, and it collapsed two situations that need opposite treatment into
+ * one value: an ABSENT minimum (every pack published before today has none, so it
+ * must satisfy) and a MALFORMED one. A call site reading `=== false` would then
+ * ignore a typo'd requirement, and one reading `!== true` would refuse every
+ * pre-existing pack — and on an `enforce` pack that means denying every tool call
+ * the pack covers. Neither mistake shows up until a user hits it, so the decision
+ * is encoded once, where the field lives: `checkPackMinCliVersion` in
+ * `pack-manifest.ts`.
+ */
+export function compareVersions(a: unknown, b: unknown): number | null {
+  const left = parseSemver(a);
+  const right = parseSemver(b);
+  if (!left || !right) return null;
+  return compareSemver(left, right);
+}

package/src/hooks/tui.ts

@@ -96,6 +96,10 @@ export interface MultiSelectOptions<T> {
 
 const ESC = "\x1B";
 
+/** How every "the key was on argv" warning opens, whichever command took it (`jev setup --token`, `config --token`). */
+export const TOKEN_ON_ARGV =
+  "--token was on the command line: your shell history has it, and while this command ran any process of yours could read it from the process list.";
+
 // ── glyphs ────────────────────────────────────────────────────────────────
 // Exported so the other branded prompts (install-prompt.ts) share the exact
 // same set instead of hand-syncing copies.

package/src/hooks/types.ts

@@ -1059,7 +1059,7 @@ export type HookEventType = (typeof HOOK_EVENT_TYPES)[number];
  *
  * It stays in `HOOK_EVENT_TYPES` because that list is the canonical set a
  * policy may subscribe to; this one governs what we write into settings.json.
- * No builtin matches it (all 39 match only PreToolUse / PostToolUse /
+ * No builtin matches it (all 40 match only PreToolUse / PostToolUse /
  * PermissionRequest / Stop), so nothing is lost by not registering.
  */
 export const CLAUDE_INSTALL_EVENT_TYPES = HOOK_EVENT_TYPES.filter(

package/src/hooks/worker-server.ts

@@ -17,7 +17,10 @@
  * evaluations could have request B's `clearPolicies()` wipe request A's
  * in-flight registration. Serializing keeps the existing registry code
  * correct with zero changes; a worker_threads/process pool is a valid
- * future enhancement if this becomes a real throughput bottleneck.
+ * future enhancement if this becomes a real throughput bottleneck. The one
+ * exception is the network wait of a two-tier (Jev) review, which happens
+ * after the registry is no longer read and so does not hold the queue (see
+ * `enqueue`).
  */
 import { createConnection, createServer, type Server, type Socket } from "node:net";
 import { existsSync, unlinkSync } from "node:fs";
@@ -74,7 +77,8 @@ const TASK_DEADLINE_MS = 60_000;
 
 /**
  * Serializes every request across every connection through one chain, so
- * `evaluateHookEvent` calls never overlap. `.catch()` on each link keeps the
+ * `evaluateHookEvent` calls never overlap while reading the registry (see
+ * `release` below). `.catch()` on each link keeps the
  * chain alive even if a handler throws unexpectedly — one bad request must
  * never wedge every request queued behind it.
  *
@@ -97,37 +101,115 @@ const TASK_DEADLINE_MS = 60_000;
  * worker whose `try_wait()` reports it gone), which costs one cold start and
  * denies the in-flight requests — the same fail-closed outcome they were headed
  * for anyway, but recovered on the next call instead of never.
+ *
+ * A task may hand its place in the chain back early by calling `release`:
+ * the next request starts while the task finishes on its own. Only the
+ * two-tier (Jev) path does, at the point it stops reading the registry and
+ * starts waiting on Jev's network answer (`EvaluateHookEventOptions.
+ * releaseRegistry`). Without that, every hook on the machine — PostToolUse,
+ * UserPromptSubmit, other agents' calls — would queue behind each gated call's
+ * round trip, and a slow or unreachable provider would push the calls at the
+ * back of the queue past the client's 30 s budget into fail-closed denies.
+ * A released task no longer holds the registry, so the deadline it was running
+ * under — the one that protects the QUEUE — has done its job. It gets a fresh
+ * one of its own instead of none: it is still running, its connection's later
+ * replies still queue behind it (see `handleConnection`), and a task that has
+ * not settled a minute after handing the queue back is wedged on something
+ * that is not going to finish. Its Jev wait is bounded by the configured
+ * timeout, so nothing on the intended path comes close.
+ *
+ * Released tasks therefore run concurrently with each other and with the
+ * queue: two gated calls can be waiting on Jev at once (T5's throttle shares
+ * one cache and token bucket across them, and does not merge identical
+ * in-flight requests). Replies on one connection still leave in request order
+ * (see `handleConnection`).
  */
 const WEDGED_EXIT_CODE = 75;
+/**
+ * A released task's own deadline, counted from the moment it handed the queue
+ * back. Its Jev wait is bounded by the configured timeout (at most 10 s, plus
+ * the review's own backstop), so only a task stuck on something else ever
+ * reaches this.
+ */
+const RELEASED_TASK_DEADLINE_MS = 60_000;
+
+/** What a wedged task costs: this worker, so the supervisor respawns a clean one. */
+function exitWedged(ms: number, released: boolean): void {
+  hookLogWarn(
+    `worker: a ${released ? "released " : ""}request did not settle within ${ms}ms; ` +
+      `exiting so the supervisor can respawn a clean worker`,
+  );
+  process.exit(WEDGED_EXIT_CODE);
+}
+
+export interface QueuedTaskOptions {
+  taskMs?: number;
+  releasedMs?: number;
+  onWedged?: (ms: number, released: boolean) => void;
+}
+
+/**
+ * Runs one queued task under a wedge deadline, calling `settle` when the next
+ * task may start — because this one finished, or because it handed its place
+ * back early with the `release` it is given. A released task keeps running
+ * under a deadline of its own (see `RELEASED_TASK_DEADLINE_MS`); dropping the
+ * deadline at that point would have made every wedge past the release
+ * invisible.
+ *
+ * Exported for the deadlines' own tests: they are a minute long and expiry
+ * exits the process, so a test passes its own values and its own `onWedged`.
+ */
+export function runQueuedTask(task: (release: () => void) => Promise<void>, settle: () => void, opts: QueuedTaskOptions = {}): void {
+  const onWedged = opts.onWedged ?? exitWedged;
+  let timer: ReturnType<typeof setTimeout> | undefined;
+  let finished = false;
+  let started = false;
+  const arm = (ms: number, released: boolean) => {
+    clearTimeout(timer);
+    timer = setTimeout(() => onWedged(ms, released), ms);
+    // Never let the deadline itself hold the event loop open.
+    timer.unref?.();
+  };
+  /** The next task starts once, whether this one released first or just finished. */
+  const startNext = () => {
+    if (started) return;
+    started = true;
+    settle();
+  };
+  const finish = () => {
+    finished = true;
+    clearTimeout(timer);
+    startNext();
+  };
+  const release = () => {
+    if (finished) return;
+    arm(opts.releasedMs ?? RELEASED_TASK_DEADLINE_MS, true);
+    startNext();
+  };
+  arm(opts.taskMs ?? TASK_DEADLINE_MS, false);
+  void task(release).then(finish, finish);
+}
 
 let processingChain: Promise<void> = Promise.resolve();
-function enqueue(task: () => Promise<void>): void {
-  processingChain = processingChain
-    .then(
-      () =>
-        new Promise<void>((settle) => {
-          const timer = setTimeout(() => {
-            hookLogWarn(
-              `worker: a request did not settle within ${TASK_DEADLINE_MS}ms; ` +
-                `exiting so the supervisor can respawn a clean worker`,
-            );
-            process.exit(WEDGED_EXIT_CODE);
-          }, TASK_DEADLINE_MS);
-          // Never let the deadline itself hold the event loop open.
-          timer.unref?.();
-          const done = () => {
-            clearTimeout(timer);
-            settle();
-          };
-          void task().then(done, done);
-        }),
-    )
-    .catch(() => {});
+function enqueue(task: (release: () => void) => Promise<void>): void {
+  processingChain = processingChain.then(() => new Promise<void>((settle) => runQueuedTask(task, settle))).catch(() => {});
 }
 
 function handleConnection(socket: Socket, shutdown: () => void): void {
   let recvBuf = Buffer.alloc(0);
   let declaredLen: number | null = null;
+  /**
+   * Hook replies leave in the order their requests arrived on this
+   * connection. The wire carries no request id, so a client that pipelines
+   * several requests on one connection can match replies only by order — which
+   * the strictly serialized queue used to guarantee by itself. A two-tier task
+   * that releases the queue early (see `enqueue`) can finish after a request
+   * that arrived behind it, so each reply waits for every earlier one on its
+   * connection. The Rust supervisor opens one connection per request, so today
+   * this never delays anything; it keeps the ordering true for any client that
+   * does pipeline.
+   */
+  let replies: Promise<void> = Promise.resolve();
 
   socket.on("data", (chunk: Buffer) => {
     recvBuf = Buffer.concat([recvBuf, chunk]);
@@ -178,15 +260,27 @@ function handleConnection(socket: Socket, shutdown: () => void): void {
       }
       const request = message;
 
-      enqueue(async () => {
+      let deliver!: (frame: Buffer) => void;
+      const reply = new Promise<Buffer>((resolveReply) => {
+        deliver = resolveReply;
+      });
+      replies = replies
+        .then(() => reply)
+        .then((frame) => {
+          socket.write(frame);
+        })
+        .catch(() => {});
+
+      enqueue(async (release) => {
         try {
           const result = await evaluateHookEvent(request.hookEvent, request.cli, request.stdin, {
             awaitTelemetryFlush: false,
             // Normalised here so no consumer has to know the wire spells
             // "absent" as null.
             fallbackCwd: request.cwd ?? undefined,
+            releaseRegistry: release,
           });
-          socket.write(
+          deliver(
             encodeFrame({
               type: "hookResult",
               exitCode: result.exitCode,
@@ -198,7 +292,7 @@ function handleConnection(socket: Socket, shutdown: () => void): void {
         } catch (err) {
           const msg = err instanceof Error ? err.message : String(err);
           hookLogWarn(`worker: evaluateHookEvent threw: ${msg}`);
-          socket.write(encodeFrame({ type: "error", message: msg }));
+          deliver(encodeFrame({ type: "error", message: msg }));
         }
       });
     }

package/src/index.ts

@@ -6,7 +6,9 @@
  */
 export {
   customPolicies,
+  semanticPolicies,
   getCustomHooks,
+  getSemanticRegistrations,
   clearCustomHooks,
 } from "./hooks/custom-hooks-registry";
 export { allow, deny, instruct } from "./hooks/policy-helpers";
@@ -16,4 +18,8 @@ export type {
   CustomHook,
   PolicyDecision,
   PolicyFunction,
+  PolicyAuthority,
+  SemanticPolicyDeclaration,
+  SemanticProbeDeclaration,
+  SemanticToolClass,
 } from "./hooks/policy-types";

package/.next/standalone/.next/server/chunks/[root-of-the-server]__0cuho4x._.js

@@ -1,3 +0,0 @@
-module.exports=[24868,(e,t,r)=>{t.exports=e.x("fs/promises",()=>require("fs/promises"))},12714,(e,t,r)=>{t.exports=e.x("node:fs/promises",()=>require("node:fs/promises"))},46786,(e,t,r)=>{t.exports=e.x("os",()=>require("os"))},14747,(e,t,r)=>{t.exports=e.x("path",()=>require("path"))},71809,e=>{"use strict";async function t(e,t){let r=Array(e.length),i=0;async function n(){for(;i<e.length;){let t=i++;try{r[t]={status:"fulfilled",value:await e[t]()}}catch(e){r[t]={status:"rejected",reason:e}}}}let a=Array.from({length:Math.min(t,e.length)},()=>n());return await Promise.all(a),r}e.s(["batchAll",0,t])},28557,e=>{"use strict";e.s(["formatDate",0,function(e){return new Intl.DateTimeFormat("en-US",{month:"short",day:"numeric",year:"numeric",hour:"numeric",minute:"2-digit",hour12:!0}).format(e)}])},54214,67405,e=>{"use strict";var t=e.i(24868),r=e.i(14747),i=e.i(81580),n=e.i(56936);async function a(e,i,n,a){let o=`agent-${a}.jsonl`;for(let a of[(0,r.join)(e,i,o),(0,r.join)(e,i,n,o),(0,r.join)(e,i,n,"subagents",o)])if(!(0,r.relative)(e,a).startsWith(".."))try{return await (0,t.access)(a),a}catch(e){if("ENOENT"===e.code)continue;break}return null}var o=e.i(83534),s=e.i(71809),l=e.i(28557);function u(e){if(e<1e3)return`${e}ms`;let t=Math.round(e/100);if(t<600)return`${(t/10).toFixed(1)}s`;let r=Math.round(e/1e3);if(r<3600){let e=Math.floor(r/60);return`${e}m ${r%60}s`}let i=Math.round(e/6e4),n=Math.floor(i/60);return`${n}h ${i%60}m`}function c(e){let t=(0,l.formatDate)(e),r=e.getMilliseconds().toString().padStart(3,"0");return`${t}.${r}`}function f(e,t,r,i){return{_source:i,uuid:e.uuid||"",parentUuid:e.parentUuid??null,timestamp:t,timestampMs:r.getTime(),timestampFormatted:c(r)}}async function m(e,t){let r=e.split("\n").filter(e=>""!==e.trim()),i=new Map,n=[],a=[],o=new Set,s=!1;for(let e=0;e<r.length;e++){let l;e>0&&e%200==0&&await new Promise(e=>setImmediate(e));let u=r[e];try{l=JSON.parse(u)}catch{continue}let c={...l,_source:t};a.push(c);let m=l.type,d=l.timestamp;if(!d)continue;let p=new Date(d),g=p.getTime();if("user"===m){let e=l.message;if(Array.isArray(e?.content)){let t=e.content;if(t.some(e=>"tool_result"===e.type)){let e=l.toolUseResult,r="string"==typeof e?.agentId?e.agentId:void 0;for(let e of(r&&/^[a-f0-9]+$/.test(r)&&o.add(r),t)){if("tool_result"!==e.type)continue;let t=e.tool_use_id;if(!t)continue;let{text:n,images:a}=function(e){let t=e.content;if("string"==typeof t)return{text:t};if(Array.isArray(t)){let e=t.filter(e=>"text"===e.type).map(e=>e.text),r=t.filter(e=>"image"===e.type).map(e=>{let t=e.source;return{base64:t.data,mediaType:t.media_type}}).filter(e=>e.base64&&e.mediaType);return{text:e.length>0?e.join("\n"):void 0,images:r.length>0?r:void 0}}return{}}(e);i.set(t,{timestamp:d,timestampMs:g,content:n,images:a,agentId:r})}continue}}let r="string"==typeof e?.content?e.content:"";n.push({type:"user",...f(l,d,p,t),message:{role:"user",content:r}});continue}if("assistant"===m){let e=l.message,r=[];if(Array.isArray(e?.content)&&(r=e.content.filter(e=>["text","tool_use","thinking"].includes(e.type)).map(e=>{if("text"===e.type)return{type:"text",text:e.text};if("tool_use"===e.type){let t=e.input;return{type:"tool_use",id:e.id,name:e.name,input:e.input??{},..."Task"===e.name&&t?{subagentType:t.subagent_type,subagentDescription:t.description}:{}}}return{type:"thinking",thinking:e.thinking,signature:e.signature}})),0===r.length)continue;n.push({type:"assistant",...f(l,d,p,t),message:{role:"assistant",content:r,model:e?.model}});continue}if("file-history-snapshot"===m||"progress"===m||"system"===m){n.push({type:m,...f(l,d,p,t),raw:{...l}});continue}if("queue-operation"===m){let e=s?"Session Resumed":"Session Started";s=!0,n.push({type:"queue-operation",...f(l,d,p,t),label:e});continue}}let l=0;for(let e of n)if("assistant"===e.type)for(let t of(++l%200==0&&await new Promise(e=>setImmediate(e)),e.message.content)){if("tool_use"!==t.type)continue;let r=i.get(t.id);if(!r)continue;let n=new Date(r.timestamp),a=Math.max(0,r.timestampMs-e.timestampMs);t.result={timestamp:r.timestamp,timestampFormatted:c(n),content:r.content,images:r.images,durationMs:a,durationFormatted:u(a)},r.agentId&&(t.subagentId=r.agentId)}return n.length>500&&await new Promise(e=>setImmediate(e)),n.sort((e,t)=>e.timestampMs-t.timestampMs),{entries:n,rawLines:a,subagentIds:Array.from(o)}}async function d(e,t="session"){return(await m(e,t)).entries}async function p(e,o){let l=(0,n.resolveProjectPath)(e),u=(0,i.getClaudeProjectsPath)(),c=(0,r.join)(l,`${o}.jsonl`),f=await (0,t.readFile)(c,"utf-8"),{entries:d,rawLines:p,subagentIds:g}=await m(f,"session");if(0===g.length)return{entries:d,rawLines:p,subagentIds:[]};let h=await (0,s.batchAll)(g.map(r=>async()=>{let i=`agent-${r}`,n=await a(u,e,o,r);if(!n)return null;let s=await (0,t.readFile)(n,"utf-8"),{entries:l,rawLines:c}=await m(s,i);return{entries:l,rawLines:c}}),4),y=[...d],w=[...p];for(let e of h)"fulfilled"===e.status&&e.value&&(y.push(...e.value.entries),w.push(...e.value.rawLines));return y.length>500&&await new Promise(e=>setImmediate(e)),y.sort((e,t)=>e.timestampMs-t.timestampMs),{entries:y,rawLines:w,subagentIds:g}}e.s(["formatDuration",0,u],67405),(0,o.runtimeCache)((e,t)=>p(e,t),60,{maxSize:50}),e.s(["baseEntry",0,f,"formatTimestamp",0,c,"parseLogContent",0,d,"parseRawLines",0,function(e,t){return e.split("\n").filter(e=>""!==e.trim()).flatMap(e=>{try{let r=JSON.parse(e);return void 0!==t&&(r._source=t),[r]}catch{return[]}})}],54214)},40911,e=>{"use strict";let t={info:0,warn:1,error:2};function r(e){return t[e]>=t.warn}function i(e){return`[failproofai${new Date().toISOString()}] ${e}`}e.s(["logActivity",0,function(e,t,n){if(!r("info"))return;let a=[`user=${e}`,`action=${t}`];n&&a.push(n),console.log(i("ACTIVITY"),a.join(" "))},"logError",0,function(e,t){void 0!==t?console.error(i("ERROR"),e,t):console.error(i("ERROR"),e)},"logWarn",0,function(e,t){r("warn")&&(void 0!==t?console.warn(i("WARN"),e,t):console.warn(i("WARN"),e))}])},81580,e=>{"use strict";var t=e.i(46786),r=e.i(14747);e.s(["decodeFolderName",0,function(e){return/^[A-Za-z]--/.test(e)?e[0]+":/"+e.slice(3).replace(/-/g,"/"):e.replace(/-/g,"/")},"encodeFolderName",0,function(e){let t=/^([A-Za-z]):[\\/](.*)$/.exec(e);return t?t[1]+"--"+t[2].replace(/[\\/]/g,"-"):e.replace(/[\\/]/g,"-")},"getClaudeProjectsPath",0,function(){let e=process.env.CLAUDE_PROJECTS_PATH;return e||(0,r.join)((0,t.homedir)(),".claude","projects")}])},56936,e=>{"use strict";var t=e.i(12714),r=e.i(50227),i=e.i(81580),n=e.i(83534),a=e.i(71809),o=e.i(40911),s=e.i(28557);let l=/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/;async function u(e,r){try{return(await (0,t.stat)(e)).mtime}catch(e){return(0,o.logWarn)(`Failed to stat ${r}:`,e),new Date(0)}}async function c(e){try{if(!(await (0,t.stat)(e)).isDirectory())return null;return await (0,t.readdir)(e,{withFileTypes:!0})}catch{return null}}async function f(){try{let e=(0,i.getClaudeProjectsPath)(),t=await c(e);if(!t)return[];let n=(await (0,a.batchAll)(t.filter(e=>e.isDirectory()).map(t=>async()=>{let i=(0,r.join)(e,t.name),n=await u(i,t.name);return{name:t.name,path:i,isDirectory:!0,lastModified:n,lastModifiedFormatted:(0,s.formatDate)(n),cli:["claude"]}}),16)).filter(e=>"fulfilled"===e.status).map(e=>e.value);return n.sort((e,t)=>t.lastModified.getTime()-e.lastModified.getTime()),n}catch(e){return(0,o.logError)("Error reading Claude project folders:",e),[]}}async function m(){let[{getCodexProjects:t},{getCopilotProjects:r},{getCursorProjects:i},{getOpenCodeProjects:n},{getPiProjects:a},{getHermesProjects:s},{getOpenClawProjects:l},{getFactoryProjects:u},{getDevinProjects:c},{getAntigravityProjects:m},{getGooseProjects:d}]=await Promise.all([e.A(37352),e.A(5807),e.A(97452),e.A(82978),e.A(45093),e.A(67347),e.A(38978),e.A(62998),e.A(52400),e.A(91301),e.A(31854)]),[p,g,h,y,w,E,j,M,A,v,x,P]=await Promise.all([f(),t().catch(e=>((0,o.logError)("Error reading Codex projects:",e),[])),r().catch(e=>((0,o.logError)("Error reading Copilot projects:",e),[])),i().catch(e=>((0,o.logError)("Error reading Cursor projects:",e),[])),n().catch(e=>((0,o.logError)("Error reading OpenCode projects:",e),[])),a().catch(e=>((0,o.logError)("Error reading Pi projects:",e),[])),s().catch(e=>((0,o.logError)("Error reading Hermes projects:",e),[])),l().catch(e=>((0,o.logError)("Error reading OpenClaw projects:",e),[])),u().catch(e=>((0,o.logError)("Error reading Factory projects:",e),[])),c().catch(e=>((0,o.logError)("Error reading Devin projects:",e),[])),m().catch(e=>((0,o.logError)("Error reading Antigravity projects:",e),[])),d().catch(e=>((0,o.logError)("Error reading Goose projects:",e),[]))]);return function(...e){let t=new Map;for(let r of e)for(let e of r){let r=t.get(e.name);if(!r){t.set(e.name,{...e,cli:[...e.cli]});continue}let i=[...r.cli];for(let t of e.cli)i.includes(t)||i.push(t);let n=e.lastModified.getTime()>r.lastModified.getTime()?e:r;t.set(e.name,{...r,cli:i,lastModified:n.lastModified,lastModifiedFormatted:n.lastModifiedFormatted,sessionCount:void 0===r.sessionCount&&void 0===e.sessionCount?void 0:(r.sessionCount??0)+(e.sessionCount??0)})}let r=Array.from(t.values());return r.sort((e,t)=>t.lastModified.getTime()-e.lastModified.getTime()),r}(p,g,h,y,w,E,j,M,A,v,x,P)}function d(e){if(!e)throw RangeError("Empty project name");if(/^[/\\]/.test(e))throw RangeError("Absolute project name");let t=(0,r.resolve)((0,i.getClaudeProjectsPath)()),n=(0,r.resolve)((0,r.join)(t,e));if(!n.startsWith(t+r.sep))throw RangeError("Project path escapes root");return n}function p(e){let t=e.match(/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/i);return t?t[0]:void 0}async function g(e){try{let t=await c(e);if(!t)return[];let i=t.filter(e=>e.isFile()&&e.name.endsWith(".jsonl")&&p(e.name)),n=(await (0,a.batchAll)(i.map(t=>async()=>{let i=(0,r.join)(e,t.name),n=await u(i,t.name);return{name:t.name,path:i,lastModified:n,lastModifiedFormatted:(0,s.formatDate)(n),sessionId:p(t.name),cli:"claude"}}),16)).filter(e=>"fulfilled"===e.status).map(e=>e.value);return n.sort((e,t)=>t.lastModified.getTime()-e.lastModified.getTime()),n}catch(e){return(0,o.logError)("Error reading session files:",e),[]}}(0,n.runtimeCache)(m,30),(0,n.runtimeCache)(e=>g(e),30),e.s(["UUID_RE",0,l,"resolveProjectPath",0,d,"resolveSessionFilePath",0,function(e,t){if(!l.test(t))throw RangeError("Invalid session ID");let i=d(e);return(0,r.join)(i,`${t}.jsonl`)}])},83534,e=>{"use strict";e.s(["runtimeCache",0,function(e,t,r){let i=new Map,n=new Map,a=r?.maxSize;return async(...r)=>{let o=JSON.stringify(r),s=i.get(o);if(s&&Date.now()<s.expiry)return s.data;let l=n.get(o);if(l)return l;let u=e(...r).then(e=>{if(n.delete(o),a&&i.size>=a){let e=i.keys().next().value;i.delete(e)}return i.set(o,{data:e,expiry:Date.now()+1e3*t}),e},e=>{throw n.delete(o),e});return n.set(o,u),u}}])}];
-
-//# sourceMappingURL=%5Broot-of-the-server%5D__0cuho4x._.js.map