failproofai 1.0.8 → 1.0.9-beta.1

package/src/hooks/semantic/pack-policies.ts

@@ -1,26 +1,26 @@
 /**
- * Which semantic policy set this machine runs: a pack's, or the compiled-in one.
+ * Which Jev checks this machine asks: the ones its installed packs declare, and
+ * nothing else.
  *
- * ## The replacement rule
+ * ## No pack, no questions
  *
- * A FailproofAI pack that declares at least ONE `semantic` entry replaces
- * `SEMANTIC_POLICIES` wholesale. It mirrors the rule already in force for the
- * regex builtins — installing a pack stops the compiled builtins registering —
- * and it exists for the same reason: one source of truth, so a name collision
- * between a pack's `destructive-deletion` and the builtin of that name cannot
- * arise, and `reviewedBy: ["destructive-deletion"]` in a pack manifest cannot
- * silently mean the builtin's question set instead of the pack's.
+ * The npm package ships NO Jev checks. The sixteen FailproofAI writes are
+ * published as the `FailproofAI/jev-policies` pack, and a machine asks them only
+ * after `failproofai policies add FailproofAI/jev-policies`. With no installed
+ * pack declaring a `semantic` entry the set is EMPTY: nothing is asked, no
+ * request is sent (the hook path does not even start a review —
+ * `jevChecksInstalled` in `effective-reviewers.ts`), and no regex verdict can be
+ * cleared, because the reviewer names come from the same packs and there are
+ * none. That holds whether or not the machine is Jev-configured or connected to
+ * FailproofAI Cloud: configuring a provider says where to ask, a pack says what.
  *
- * Anyone else's checks are ADDED to the compiled-in set instead. Their names
- * cannot collide with it (a third party's claim to a builtin name is void:
- * `isReservedClaim`),
- * and replacing it would drop deny-mode checks like `credential-exfiltration`
- * that add denies the regex tier does not have — weaker, not noisier.
- *
- * Two packs that both declare entries CONCATENATE; a name declared by two packs
- * keeps the first and drops the later one, because the answer map is keyed by
- * policy name and the second would overwrite the first's questions in the
- * compiled request.
+ * Several declaring packs CONCATENATE, FailproofAI's first. A name declared by
+ * two packs keeps the first and drops the later one, because the answer map is
+ * keyed by policy name and the second would overwrite the first's questions in
+ * the compiled request. The sixteen FailproofAI names are reserved: a pack not
+ * installed from a FailproofAI repository that declares one is ignored for that
+ * name (`isReservedClaim`), so it cannot become the question that clears the
+ * core pack's policies.
  *
  * ## Where the manifest ends and this begins
  *
@@ -39,7 +39,7 @@
  * regex policies cover — a machine locked out over a typo in the half of the
  * system whose job is to let more real work through.
  */
-import { contestedSemanticNames, isFirstPartyPack, isReservedClaim, jevPacks, replacesBuiltinChecks } from "../effective-reviewers";
+import { contestedSemanticNames, isFirstPartyPack, isReservedClaim, jevPacks } from "../effective-reviewers";
 import { hookLogWarn } from "../hook-logger";
 import {
   packSemantic,
@@ -50,7 +50,7 @@ import {
 } from "../pack-manifest";
 import { MAX_REQUEST_CHARS, userAskedQuestion } from "./compile";
 import { MAX_STATE_CHARS } from "./envelope";
-import { INJECTION_PROBE, SCOPE_PROBE, SEMANTIC_POLICIES, TASK_PROBES } from "./policies";
+import { INJECTION_PROBE, SCOPE_PROBE, TASK_PROBES } from "./policies";
 import { preconditionFor } from "./preconditions";
 import { isPackPreconditionName } from "./precondition-names";
 import type { NoulQuestion, SemanticPolicy } from "./types";
@@ -95,9 +95,9 @@ const GLOBAL_QUESTION_CHARS = Math.max(
  * "somebody installed a big pack", and the flag that was supposed to be
  * unreachable from ordinary work becomes routine.
  *
- * The real sixteen use `BUILTIN_QUESTION_CHARS` of it, so this is not a
- * constraint on the set we ship. A stranger's pack is added to them, so what it
- * may ask for is what they leave.
+ * `FailproofAI/jev-policies` uses `JEV_POLICIES_QUESTION_CHARS` of it, so this
+ * is not a constraint on the set we ship. FailproofAI's packs spend the budget
+ * first, so a stranger's pack installed beside that one gets what it leaves.
  */
 export const MAX_PACK_QUESTION_CHARS = MAX_REQUEST_CHARS - MAX_STATE_CHARS - GLOBAL_QUESTION_CHARS;
 
@@ -123,8 +123,15 @@ export function questionChars(entry: SemanticManifestEntry): number {
   return JSON.stringify(questions).length;
 }
 
-/** What the compiled-in set spends of that budget when third-party checks join it. */
-export const BUILTIN_QUESTION_CHARS = SEMANTIC_POLICIES.reduce((n, p) => n + questionChars(p as SemanticManifestEntry), 0);
+/**
+ * What `FailproofAI/jev-policies`' sixteen checks spend of that budget, which a
+ * pack from anyone else shares with them on a machine that has both installed.
+ * Measured, not chosen: `pack-semantic-registry.test.ts` pins it to the
+ * reference copy in `__tests__/fixtures/jev-policies.ts`. Only `publish` reads
+ * it, to warn an author before release; the machine measures what is actually
+ * installed.
+ */
+export const JEV_POLICIES_QUESTION_CHARS = 18490;
 
 export interface ResolvedSemanticPolicies {
   policies: ReadonlyArray<SemanticPolicy>;
@@ -166,8 +173,7 @@ function toSemanticPolicy(entry: SemanticManifestEntry, pack: { id: string; vers
 }
 
 /**
- * The semantic set these packs declare, or the compiled-in set when none of them
- * declares any.
+ * The semantic set these packs declare — empty when none of them declares any.
  *
  * Pure: it takes the packs rather than reading them, so the caller that already
  * has them does not read `installed.json` a second time and a test does not need
@@ -177,16 +183,13 @@ export function semanticPoliciesFromPacks(
   packs: ReadonlyArray<Pick<ResolvedPack, "id" | "semantic"> & { source?: string; version?: string }>,
 ): ResolvedSemanticPolicies {
   const declared = packs.filter((p) => packSemantic(p).length > 0);
-  if (declared.length === 0) return { policies: SEMANTIC_POLICIES, fromPack: false, errors: [] };
+  if (declared.length === 0) return { policies: [], fromPack: false, errors: [] };
 
-  // FailproofAI's own checks replace the compiled-in set; anyone else's join it
-  // (`replacesBuiltinChecks`, which the reviewer set applies too). First-party
-  // packs spend the budget first, so install order cannot starve them.
-  const replace = replacesBuiltinChecks(declared);
+  // First-party packs spend the budget first, so install order cannot starve them.
   const ordered = [...declared.filter((p) => isFirstPartyPack(p)), ...declared.filter((p) => !isFirstPartyPack(p))];
-  const policies: SemanticPolicy[] = replace ? [] : [...SEMANTIC_POLICIES];
+  const policies: SemanticPolicy[] = [];
   const errors: string[] = [];
-  const seen = new Set<string>(policies.map((p) => p.name));
+  const seen = new Set<string>();
   // A name two packs declare DIFFERENTLY is asked for nobody. Keeping the first
   // was the escalation: the question that decides another pack's policies came
   // from whichever pack was listed first, so installing a permissive
@@ -196,7 +199,7 @@ export function semanticPoliciesFromPacks(
   // be the same name — a check in the set with nobody's question, or a question
   // nobody may name, are both worse than neither.
   const contested = contestedSemanticNames(declared);
-  let spent = replace ? 0 : BUILTIN_QUESTION_CHARS;
+  let spent = 0;
   for (const pack of ordered) {
     for (const entry of packSemantic(pack)) {
       if (isReservedClaim(pack, entry.name)) {
@@ -241,13 +244,11 @@ export function semanticPoliciesFromPacks(
     }
   }
 
-  // Every entry a declaring pack shipped was unusable. The compiled-in set is
-  // the honest answer — it is what the machine ran yesterday — and it is also
-  // the safe one: what a pack's regex half names in `reviewedBy` will not match
-  // it, so those policies stay hard rather than being cleared by questions
-  // nobody validated.
-  if (policies.length === (replace ? 0 : SEMANTIC_POLICIES.length)) return { policies: SEMANTIC_POLICIES, fromPack: false, errors };
-  return { policies, fromPack: true, errors };
+  // Every entry a declaring pack shipped was unusable: nothing is asked, and
+  // `fromPack` says no pack supplied anything. There is no compiled-in set to
+  // fall back to, and that is the safe direction — nothing is asked, so nothing
+  // a `reviewedBy` names is ever answered, and those policies stay hard.
+  return { policies, fromPack: policies.length > 0, errors };
 }
 
 const warned = new Set<string>();
@@ -262,10 +263,9 @@ const warned = new Set<string>();
  * exactly that reason. The read costs one digest per pack against a call that is
  * about to spend up to three seconds on the network.
  *
- * Never throws. An unreadable manifest yields the compiled-in set, which is the
- * same fail-open posture every other reader of that file takes, and here it also
- * fails in the safe direction: the set a pack's `reviewedBy` names is not the
- * builtin set, so nothing gets cleared by a policy nobody could read.
+ * Never throws. An unreadable manifest yields NO checks: nothing is asked and
+ * nothing is cleared, so every regex verdict stands. There is deliberately no
+ * compiled-in set to fall back to — the package ships none.
  */
 export function resolveSemanticPolicies(cli?: string): ReadonlyArray<SemanticPolicy> {
   let packs: ReadonlyArray<ResolvedPack> = [];
@@ -275,7 +275,7 @@ export function resolveSemanticPolicies(cli?: string): ReadonlyArray<SemanticPol
     packs = read.packs;
     manifestErrors = read.warnings ?? [];
   } catch {
-    return SEMANTIC_POLICIES;
+    return [];
   }
   const resolved = semanticPoliciesFromPacks(jevPacks(packs, cli));
   // Once per process per message, like `warnAuthority`: this runs on every gate

package/src/hooks/semantic/policies.ts

@@ -1,8 +1,17 @@
 /**
- * The semantic policy set: what the regex builtins try to catch, written as
- * the behaviour itself rather than as a pattern over one spelling of it.
+ * The probes every Jev request carries (scope, injection, the task probes) and
+ * the path and branch helpers the pack preconditions compile to.
  *
- * Authoring rules, learned from TypeSafe's docs and from measuring the regex
+ * ## No checks live here
+ *
+ * The npm package ships NO Jev checks. The sixteen that used to be compiled in
+ * as `SEMANTIC_POLICIES` are published as the `FailproofAI/jev-policies` pack,
+ * and reach a machine only through `failproofai policies add
+ * FailproofAI/jev-policies`. With no installed pack declaring a `semantic`
+ * entry, Jev asks nothing and is never called (`pack-policies.ts`). Tests keep
+ * a reference copy in `__tests__/fixtures/jev-policies.ts`.
+ *
+ * Authoring rules for a check (in a pack), learned from TypeSafe's docs and from measuring the regex
  * engine against real traffic:
  *
  * - One dimension per probe. A single "is this dangerous" question scored
@@ -17,7 +26,7 @@
  * - Refer to state by its field names (`agent_request`, `facts.paths`,
  *   `user_said`) so every question is anchored to the same labelled envelope.
  */
-import type { Facts, PathFact, SemanticPolicy } from "./types";
+import type { Facts, PathFact } from "./types";
 
 /**
  * The branch names `commit-on-protected-branch` guards.
@@ -71,427 +80,6 @@ export function outsideProject(facts: Facts, p: PathFact): boolean {
   return p.resolved !== cwd && !p.resolved.startsWith(cwd.endsWith("/") ? cwd : cwd + "/");
 }
 
-export const SEMANTIC_POLICIES: ReadonlyArray<SemanticPolicy> = [
-  {
-    name: "destructive-deletion",
-    title: "Tried to permanently delete data that cannot be regenerated",
-    appliesTo: ["shell", "write"],
-    mode: "deny",
-    userCanOverride: true,
-    probes: [
-      {
-        id: "destroys",
-        instructions:
-          "The tool call in `agent_request` permanently deletes, wipes, truncates or overwrites existing files, " +
-          "directories or disks — for example `rm -r`, `find -delete`, `shred`, `dd of=`, `mkfs`, `truncate`, " +
-          "`rsync --delete`, `git clean -fdx`, or redirecting output over an existing file.",
-        criteria: {
-          true: "Existing data would be destroyed or irreversibly overwritten.",
-          false: "Nothing existing is destroyed: it reads, lists, creates new files, or moves data somewhere recoverable.",
-        },
-      },
-      {
-        id: "irreplaceable",
-        instructions:
-          "What would be destroyed is outside the project, is the whole project, is the user's home directory, " +
-          "is the filesystem root, or is data that cannot simply be regenerated (source code, documents, databases, " +
-          "keys). Use `facts.paths[].relation` to see where each target sits relative to the project.",
-        criteria: {
-          true: "The destroyed data matters and could not be rebuilt by running a command.",
-          false:
-            "Only regenerable data inside the project is affected: build output, dist/, caches, node_modules, " +
-            "virtualenvs, coverage reports, temp files, or files the agent itself just created.",
-        },
-      },
-    ],
-    guidance: "This permanently deletes data that cannot be rebuilt. Confirm the exact paths with the user first.",
-  },
-  {
-    name: "production-infra-change",
-    title: "Tried to change live infrastructure",
-    appliesTo: ["shell"],
-    mode: "deny",
-    userCanOverride: true,
-    probes: [
-      {
-        id: "mutates",
-        instructions:
-          "The command in `agent_request` changes the state of cloud or cluster infrastructure: it creates, " +
-          "updates, deletes, applies, scales, restarts, rolls out, deploys or destroys resources in a cloud " +
-          "account, Kubernetes cluster, managed database, DNS, CDN or hosting platform (any CLI: kubectl, helm, " +
-          "terraform, tofu, pulumi, aws, gcloud, az, doctl, flyctl, vercel, wrangler, railway, and so on — " +
-          "however the binary is spelled or pathed).",
-        criteria: {
-          true: "It mutates infrastructure.",
-          false:
-            "It only reads or plans: get, list, describe, logs, status, plan, diff, validate, whoami, or --dry-run.",
-        },
-      },
-      {
-        id: "not_local",
-        instructions:
-          "The target of that change is a shared or production environment, or its environment cannot be told " +
-          "from the command.",
-        criteria: {
-          true: "Production, shared, or unknown environment.",
-          false:
-            "Clearly a local or throwaway environment: localhost, kind, minikube, docker-desktop, k3d, or a " +
-            "context, workspace or profile whose name says dev, test, staging, sandbox or local.",
-        },
-      },
-    ],
-    guidance: "This changes live infrastructure. Run it against a non-production target, or hand the command to a human.",
-  },
-  {
-    name: "git-history-rewrite",
-    title: "Tried to rewrite or discard shared git history",
-    appliesTo: ["shell"],
-    mode: "deny",
-    userCanOverride: true,
-    probes: [
-      {
-        id: "rewrites_remote",
-        instructions:
-          "The command in `agent_request` force-pushes or otherwise overwrites history on a git remote: " +
-          "`git push --force`, `--force-with-lease`, `-f`, a `+refspec` such as `+HEAD:main`, or deleting a " +
-          "remote branch. Git's global options before the subcommand (`git -C dir`, `git -c key=val`) and an " +
-          "absolute path to the git binary do not change what the command does.",
-        criteria: {
-          true: "Remote history would be overwritten or a remote branch deleted.",
-          false: "A normal push that only adds commits, or no push at all.",
-        },
-      },
-    ],
-    guidance: "Force-pushing rewrites history other people may have pulled. Confirm with the user first.",
-  },
-  {
-    name: "push-to-protected-branch",
-    title: "Tried to push directly to a protected branch",
-    appliesTo: ["shell"],
-    mode: "instruct",
-    userCanOverride: true,
-    probes: [
-      {
-        id: "pushes_protected",
-        instructions:
-          "The command in `agent_request` pushes commits to a remote branch named main, master, production, " +
-          "release or trunk — either named explicitly or implied because `facts.current_git_branch` is one of " +
-          "those and the push names no other branch.",
-        criteria: {
-          true: "Commits land directly on a protected remote branch.",
-          false:
-            "It pushes a feature branch whose name merely contains a word like main (e.g. feature/main-menu), " +
-            "or it does not push.",
-        },
-      },
-    ],
-    guidance: "Pushing straight to a protected branch skips review. Push a branch and open a PR unless the user asked for this.",
-  },
-  {
-    name: "commit-on-protected-branch",
-    title: "Tried to commit directly on a protected branch",
-    appliesTo: ["shell"],
-    mode: "instruct",
-    userCanOverride: true,
-    precondition: (facts) => facts.currentGitBranch !== null && PROTECTED_BRANCHES.has(facts.currentGitBranch),
-    probes: [
-      {
-        id: "creates_commit",
-        instructions:
-          "The command in `agent_request` creates or amends a git commit, merge, rebase or cherry-pick in the " +
-          "repository (including `git -C dir commit` and `git commit -a`).",
-        criteria: {
-          true: "A new commit is written to the current branch.",
-          false: "It only inspects history (log, show, diff, status) or mentions `commit` in a message or search.",
-        },
-      },
-    ],
-    guidance: "You are on a protected branch. Create a feature branch before committing unless the user asked otherwise.",
-  },
-  {
-    name: "secret-exposure",
-    title: "Tried to read or copy credentials",
-    appliesTo: ["shell", "read", "write"],
-    mode: "deny",
-    userCanOverride: true,
-    probes: [
-      {
-        id: "touches_secrets",
-        instructions:
-          "The tool call in `agent_request` reads, prints, copies, or writes credential material: SSH private " +
-          "keys (~/.ssh/id_*), authorized_keys, cloud credentials (~/.aws, ~/.config/gcloud, ~/.azure, " +
-          "~/.kube/config), .env files containing real secret values, API tokens, password stores, keychains, " +
-          "or browser cookie databases.",
-        criteria: {
-          true: "Actual secret values would be read, displayed, copied or written.",
-          false:
-            "It only references the concept: source code that reads process.env, a variable name, an .env.example " +
-            "template, a test fixture, documentation about credentials, or a grep for the word.",
-        },
-      },
-    ],
-    guidance: "This exposes real credentials. Ask the user before reading or copying secret material.",
-  },
-  {
-    name: "credential-exfiltration",
-    title: "Tried to send secrets or private files off the machine",
-    appliesTo: ["shell", "network"],
-    mode: "deny",
-    userCanOverride: false,
-    probes: [
-      {
-        id: "sends_out",
-        instructions:
-          "The tool call in `agent_request` sends data to a network destination: an HTTP POST or PUT (curl -d, " +
-          "curl -F, curl -T, wget --post-data), scp, sftp, rsync or rclone to a remote, nc or socat, an upload to " +
-          "a paste site, bucket or webhook, or a DNS lookup carrying encoded data.",
-        criteria: {
-          true: "Data leaves this machine.",
-          false: "It only downloads, or only talks to localhost.",
-        },
-      },
-      {
-        id: "sensitive_payload",
-        instructions:
-          "The data being sent includes credentials, keys, tokens, environment variables, or the contents of files " +
-          "from outside the project (see `facts.paths`).",
-        criteria: {
-          true: "Secrets or private files are in what is sent.",
-          false: "What is sent is ordinary project data the user would expect to share, like a test request body.",
-        },
-      },
-    ],
-    guidance: "This sends secrets or private files to a remote destination, which the user cannot approve. Do not send them.",
-  },
-  {
-    name: "remote-code-execution",
-    title: "Tried to run code downloaded from the internet",
-    appliesTo: ["shell"],
-    mode: "deny",
-    userCanOverride: true,
-    probes: [
-      {
-        /**
-         * The `…` in the `wget` example is load-bearing, not decoration.
-         *
-         * A code span in a question whose first token is `curl` or `wget` and
-         * whose second token is a bare short option (`-O x.sh`, `-s`, `-fsSL`)
-         * is refused by the Cloudflare route — HTTP 402, code 2021, "Model
-         * execution failed (Payment error)" — deterministically, on any state.
-         * `curl … | sh` and `bash <(curl …)` below are accepted because their
-         * second token is the placeholder, and `wget … -O x.sh` is accepted for
-         * the same reason. The client reads 402 as `out-of-credits`, so the
-         * refusal used to degrade every call that selected this policy to
-         * regex and blame the operator's billing for it.
-         *
-         * So: keep a placeholder (or a URL) between `wget`/`curl` and its first
-         * short option in any example written inside backticks here.
-         */
-        id: "download_and_run",
-        instructions:
-          "The command in `agent_request` downloads code or a script from the internet and executes it: " +
-          "`curl … | sh`, `bash <(curl …)`, `wget … -O x.sh && bash x.sh`, `python3 -c \"$(curl …)\"`, piping into " +
-          "any interpreter (sh, bash, zsh, python, node, perl, ruby), or eval of a fetched string.",
-        criteria: {
-          true: "Fetched code is executed.",
-          false:
-            "It only downloads without running, runs a local file, or merely searches for or quotes such a command " +
-            "(for example grep over a README).",
-        },
-      },
-    ],
-    exempt: {
-      id: "official_installer",
-      instructions:
-        "The URL being executed is the documented official installer of a widely used developer tool, served from " +
-        "that tool's own domain (for example bun.sh, sh.rustup.rs, get.docker.com, deb.nodesource.com, " +
-        "raw.githubusercontent.com/nvm-sh/nvm, astral.sh/uv).",
-    },
-    guidance: "This executes code fetched from the internet. Download it, show it to the user, then run it.",
-  },
-  {
-    name: "privilege-escalation",
-    title: "Tried to run with elevated privileges",
-    appliesTo: ["shell"],
-    mode: "deny",
-    userCanOverride: true,
-    probes: [
-      {
-        id: "elevates",
-        instructions:
-          "The command in `agent_request` runs something as root or another user: sudo, doas, su, pkexec, run0, " +
-          "`sudo -i`, `sudo -s`, including when the binary is written as an absolute path or reached through a " +
-          "variable or wrapper.",
-        criteria: {
-          true: "Privileges are elevated.",
-          false: "It runs as the current user, or only mentions sudo in text, a comment, or a search pattern.",
-        },
-      },
-    ],
-    guidance: "This runs with elevated privileges. Ask the user to run it themselves.",
-  },
-  {
-    name: "database-destruction",
-    title: "Tried to destroy or mass-modify database data",
-    appliesTo: ["shell"],
-    mode: "deny",
-    userCanOverride: true,
-    probes: [
-      {
-        id: "destructive_sql",
-        instructions:
-          "The command in `agent_request` executes SQL or a database command that drops or truncates a table, " +
-          "schema or database, or deletes or updates rows without a condition that narrows them to specific " +
-          "records. A condition that is always true (`WHERE 1=1`, `WHERE true`, `WHERE id > 0`) does not narrow " +
-          "anything. Also counts: `redis-cli FLUSHALL`, `dropdb`, `mongo … dropDatabase()`.",
-        criteria: {
-          true: "Many rows, a table, or a whole database would be removed or overwritten.",
-          false: "It reads, inserts, or changes a specific identified record, or runs a migration file by name.",
-        },
-      },
-      {
-        id: "real_database",
-        instructions: "The database it targets holds real data rather than being a disposable test database.",
-        criteria: {
-          true: "A real or shared database, or one whose purpose cannot be told.",
-          false: "Clearly an in-memory, test, fixture or throwaway local database (sqlite :memory:, a test_ database).",
-        },
-      },
-    ],
-    guidance: "This destroys database data. Confirm the target and scope with the user first.",
-  },
-  {
-    name: "read-outside-workspace",
-    title: "Read files outside the project",
-    appliesTo: ["shell", "read"],
-    mode: "instruct",
-    userCanOverride: true,
-    precondition: (facts) => facts.paths.some((p) => outsideProject(facts, p)),
-    probes: [
-      {
-        id: "reads_outside",
-        instructions:
-          "The tool call in `agent_request` reads the contents of files that `facts.paths` marks as outside the " +
-          "project, in the user's home directory (for example another repository, Documents, or dotfiles).",
-        criteria: {
-          true: "It reads file contents from outside the project.",
-          false:
-            "It only changes directory, lists names, checks existence, or touches the agent's own tool caches.",
-        },
-      },
-    ],
-    guidance: "This reads files outside the current project. Mention why before continuing.",
-  },
-  {
-    name: "agent-config-tampering",
-    title: "Tried to change the agent's own safety configuration",
-    appliesTo: ["shell", "write"],
-    mode: "deny",
-    userCanOverride: false,
-    probes: [
-      {
-        id: "edits_agent_config",
-        instructions:
-          "The tool call in `agent_request` modifies or deletes an AI agent's own configuration, hooks, " +
-          "permissions or guardrails: .claude/settings.json, .claude/settings.local.json, ~/.claude/, .codex/, " +
-          ".cursor/hooks.json, .gemini/, .factory/, failproofai configuration or policies, or permission and " +
-          "safety sections of AGENTS.md or CLAUDE.md.",
-        criteria: {
-          true: "The agent's hooks, permissions or safety settings would change.",
-          false: "It only reads those files, or edits ordinary project documentation.",
-        },
-      },
-    ],
-    guidance: "An agent must not change its own guardrails. Ask the user to make this change.",
-  },
-  {
-    name: "system-modification",
-    title: "Tried to change the system outside the project",
-    appliesTo: ["shell"],
-    mode: "instruct",
-    userCanOverride: true,
-    probes: [
-      {
-        id: "modifies_system",
-        instructions:
-          "The command in `agent_request` installs or removes software system-wide or changes machine " +
-          "configuration: apt, dnf, pacman, brew install, `npm install -g`, `pip install` outside a virtualenv, " +
-          "editing files under /etc, systemctl enable or disable, crontab, or changing shell startup files.",
-        criteria: {
-          true: "The machine changes outside the project directory.",
-          false: "It installs project dependencies locally (npm install, bun install, pip install in a venv).",
-        },
-      },
-    ],
-    guidance: "This changes the machine outside the project. Mention it to the user.",
-  },
-  {
-    name: "env-secrets-dump",
-    title: "Tried to print environment secrets",
-    appliesTo: ["shell"],
-    mode: "instruct",
-    userCanOverride: true,
-    probes: [
-      {
-        id: "dumps_env",
-        instructions:
-          "The command in `agent_request` prints environment variable VALUES that may be secret: `env`, " +
-          "`printenv`, `set`, `export -p`, or `echo` of a variable whose name suggests a key, token, password " +
-          "or secret.",
-        criteria: {
-          true: "Secret-looking environment values would be printed.",
-          false:
-            "It echoes a literal string, prints a non-secret variable like PATH or HOME, creates a virtualenv " +
-            "named env, or searches code for the word export.",
-        },
-      },
-    ],
-    guidance: "This prints environment values that may be secrets into the transcript.",
-  },
-  {
-    name: "external-destructive-action",
-    title: "Tried an irreversible action through an external tool",
-    appliesTo: ["other"],
-    mode: "deny",
-    userCanOverride: true,
-    probes: [
-      {
-        id: "irreversible_external",
-        instructions:
-          "The tool call in `agent_request` (an MCP or integration tool, see `facts.tool_name`) performs an " +
-          "irreversible or externally visible action: deleting records, repositories, files or accounts; " +
-          "sending email, chat or social messages on the user's behalf; making payments or purchases; merging or " +
-          "closing pull requests; changing permissions, access or billing; or writing to a production system.",
-        criteria: {
-          true: "Something outside this machine changes in a way that cannot be quietly undone.",
-          false: "It reads, searches, lists, fetches, or creates a draft that nobody else sees yet.",
-        },
-      },
-    ],
-    guidance: "This takes an irreversible action in an external system. Confirm with the user first.",
-  },
-  {
-    name: "external-data-egress",
-    title: "Sent private data to an external tool",
-    appliesTo: ["other"],
-    mode: "instruct",
-    userCanOverride: true,
-    probes: [
-      {
-        id: "egresses_private",
-        instructions:
-          "The arguments in `agent_request` send private data to an external service: source code, file " +
-          "contents, credentials, customer data, or personal information.",
-        criteria: {
-          true: "Private data is being shared with a third party.",
-          false: "Only a query, identifier or public information is sent.",
-        },
-      },
-    ],
-    guidance: "This shares private data with an external service. Mention what is being sent.",
-  },
-];
-
 /**
  * Asked once per call, alongside the injection probe, whenever a user override
  * is possible. "Did the user ask for this?" alone was cleared by requests that

package/src/hooks/semantic/precondition-names.ts

@@ -9,7 +9,7 @@
  * deciding, per tool call, what this process computes. A precondition gates
  * every hook event, so it is the last place to accept publisher-authored code.
  * So the manifest names one of a fixed, compiled-in set and
- * `preconditions.ts` owns the bodies. Only 2 of the 16 builtin semantic
+ * `preconditions.ts` owns the bodies. Only 2 of the 16 FailproofAI semantic
  * policies use a precondition at all, so the closed set costs nothing real.
  *
  * ## Why this file exists apart from `preconditions.ts`

package/src/hooks/semantic/preconditions.ts

@@ -7,7 +7,7 @@
  * VALIDATES a name imports `precondition-names.ts` instead, and the header
  * there says why that separation is load-bearing.
  *
- * Every body reuses the helper the builtin semantic policies use rather than
+ * Every body reuses the helper FailproofAI's own checks were written with rather than
  * restating the rule. A pack's `paths_outside_project` and the builtin
  * `read-outside-workspace` have to mean the same thing: the whole point of the
  * precondition is to decide whether the paired regex deny gets a question at