failproofai 1.0.9-beta.0 → 1.0.9-beta.1

package/dist/worker.mjs

@@ -1162,7 +1162,7 @@ function instruct(reason) {
 }
 
 // package.json
-var version = "1.0.9-beta.0";
+var version = "1.0.9-beta.1";
 var init_package = () => {};
 
 // src/hooks/policy-types.ts
@@ -4172,8 +4172,11 @@ function sanitizeJevActivity(entry) {
     drop("evaluator");
   if (!(typeof out.jevDecision === "string" && DECISIONS.has(out.jevDecision)))
     drop("jevDecision");
+  const unknownMode = out.jevMode !== undefined && !(typeof out.jevMode === "string" && MODES.has(out.jevMode));
   if (!(typeof out.jevMode === "string" && MODES.has(out.jevMode)))
     drop("jevMode");
+  if (unknownMode)
+    drop("jevCleared");
   if (Array.isArray(out.jevCleared)) {
     const names = [
       ...new Set(out.jevCleared.filter(isJevPolicyName))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "failproofai",
-  "version": "1.0.9-beta.0",
+  "version": "1.0.9-beta.1",
   "description": "Observability and enforcement for AI agent harnesses. 40 built-in policies hooked into 12 of them — Claude Code, Codex, Cursor, Hermes, OpenClaw and more — blocking the tool call before it runs. Local dashboard included, no account needed.",
   "bin": {
     "failproofai": "./dist/cli.mjs",
@@ -81,14 +81,14 @@
     "access": "public"
   },
   "devDependencies": {
-    "@anthropic-ai/sdk": "^0.127.0",
+    "@anthropic-ai/sdk": "^0.128.0",
     "@mdx-js/mdx": "^3.1.1",
     "@tailwindcss/postcss": "^4.3.1",
     "@tanstack/react-virtual": "^3.14.10",
     "@testing-library/jest-dom": "^7.0.0",
     "@testing-library/react": "^16.3.2",
     "@testing-library/user-event": "^14.6.5",
-    "@types/node": "26.6.1",
+    "@types/node": "26.6.2",
     "@types/react": "19.3.0",
     "@types/react-dom": "^19.2.3",
     "@vitejs/plugin-react": "^6.1.0",
@@ -122,15 +122,15 @@
     "browserslist": "4.28.8"
   },
   "optionalDependencies": {
-    "@failproofai/failproofaid-linux-x64": "1.0.9-beta.0",
-    "@failproofai/failproofaid-linux-arm64": "1.0.9-beta.0",
-    "@failproofai/failproofaid-darwin-x64": "1.0.9-beta.0",
-    "@failproofai/failproofaid-darwin-arm64": "1.0.9-beta.0"
+    "@failproofai/failproofaid-linux-x64": "1.0.9-beta.1",
+    "@failproofai/failproofaid-linux-arm64": "1.0.9-beta.1",
+    "@failproofai/failproofaid-darwin-x64": "1.0.9-beta.1",
+    "@failproofai/failproofaid-darwin-arm64": "1.0.9-beta.1"
   },
   "failproofaidBinaries": {
-    "linux-x64": "044b6619007227b8aa1fc1095b8c61a17bd90e11da53183ac1f5adecdcae6839",
-    "linux-arm64": "479450d7d15c52a59bd1a8cf4c7086be9210e8d31ad4f98d99b123f571e944bd",
-    "darwin-x64": "11562912ff726195bfb966ed24a774ffea38d01acc3edc1f9bfa3ea9c298977f",
-    "darwin-arm64": "5bbaee1ec89d2d8032b7f16e502fb96891fbc6aa2ee6c861f43a64a0a60e61ba"
+    "linux-x64": "a0db1ad28bc0584bb4554b1dc60b55353fad9d982354880f9cc1e1ee567e5d36",
+    "linux-arm64": "b8d2797db8d93ce0deec86707093dd22ecd2d3fe2b137944938f4851d31718f1",
+    "darwin-x64": "94dc7ea33121c884736eadafc8281b0b752824b5c7fbe1726745bd1fa2b2a577",
+    "darwin-arm64": "8da18bbede18b8c112e8c46b6f0de798e84445c163a91a80edeef6d9e21da8ad"
   }
 }

package/src/hooks/integrations.ts

@@ -25,6 +25,7 @@ import { resolve, dirname, basename } from "node:path";
 import { fileURLToPath } from "node:url";
 import { homedir } from "node:os";
 import { parseDocument, type Document } from "yaml";
+import { writeConfigFileAtomic } from "./safe-config-write";
 import { listHermesProfiles, hermesRoot } from "../../lib/hermes-profiles";
 import { listOpenClawProfiles } from "../../lib/openclaw-profiles";
 import {
@@ -65,32 +66,82 @@ import {
 
 // ── Generic helpers ─────────────────────────────────────────────────────────
 
+/**
+ * The error every config reader throws for a file it cannot read faithfully.
+ *
+ * These files belong to the user's agent. A config that exists but does not
+ * parse is never treated as empty: writing our entries into an "empty" document
+ * would replace every other setting in it, and the agent would come back without
+ * its model, keys or channels. Refusing leaves the file exactly as the user has
+ * it and says which file and why.
+ */
+export class UnreadableAgentConfigError extends Error {
+  constructor(readonly path: string, reason: string) {
+    super(
+      `Refusing to modify ${path}: ${reason}. ` +
+        `failproofai never rewrites a config it could not parse — fix or move the file, then retry.`,
+    );
+    this.name = "UnreadableAgentConfigError";
+  }
+}
+
 function readJsonFile(path: string): Record<string, unknown> {
   if (!existsSync(path)) return {};
-  const raw = readFileSync(path, "utf8");
-  return JSON.parse(raw) as Record<string, unknown>;
+  let raw: string;
+  try {
+    raw = readFileSync(path, "utf8");
+  } catch (err) {
+    throw new UnreadableAgentConfigError(path, `it could not be read (${err instanceof Error ? err.message : String(err)})`);
+  }
+  if (raw.trim() === "") return {};
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (err) {
+    throw new UnreadableAgentConfigError(path, `it is not valid JSON (${err instanceof Error ? err.message : String(err)})`);
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new UnreadableAgentConfigError(path, "its top level is not a JSON object");
+  }
+  return parsed as Record<string, unknown>;
 }
 
 function writeJsonFile(path: string, data: Record<string, unknown>): void {
-  mkdirSync(dirname(path), { recursive: true });
-  writeFileSync(path, JSON.stringify(data, null, 2) + "\n", "utf8");
+  writeConfigFileAtomic(path, JSON.stringify(data, null, 2) + "\n");
 }
 
 /** Read a YAML file as a `Document` so writes round-trip the user's other keys +
- *  comments (a plain parse→stringify would strip comments). Empty / missing /
- *  corrupt → an empty Document. Used by the Hermes integration, whose config
- *  lives in `~/.hermes/config.yaml`. */
+ *  comments (a plain parse→stringify would strip comments). Missing or empty →
+ *  an empty Document; unreadable or unparseable → {@link UnreadableAgentConfigError},
+ *  never an empty Document that the next write would put in the user's place.
+ *  Used by the Hermes integration, whose config lives in `~/.hermes/config.yaml`. */
 function readYamlDoc(path: string): Document {
+  if (!existsSync(path)) return parseDocument("");
+  let text: string;
+  try {
+    text = readFileSync(path, "utf8");
+  } catch (err) {
+    throw new UnreadableAgentConfigError(path, `it could not be read (${err instanceof Error ? err.message : String(err)})`);
+  }
+  const doc = parseDocument(text);
+  if (doc.errors.length > 0) {
+    const first = doc.errors[0]?.message.split("\n")[0] ?? "syntax error";
+    throw new UnreadableAgentConfigError(path, `it does not parse as YAML (${first})`);
+  }
+  return doc;
+}
+
+/** {@link readYamlDoc} for read-only callers (status, health): an unreadable file is `null`. */
+function inspectYamlDoc(path: string): Document | null {
   try {
-    return existsSync(path) ? parseDocument(readFileSync(path, "utf8")) : parseDocument("");
+    return readYamlDoc(path);
   } catch {
-    return parseDocument("");
+    return null;
   }
 }
 
 function writeYamlDoc(path: string, doc: Document): void {
-  mkdirSync(dirname(path), { recursive: true });
-  writeFileSync(path, doc.toString(), "utf8");
+  writeConfigFileAtomic(path, doc.toString());
 }
 
 function isMarkedHook(hook: unknown): boolean {
@@ -1127,7 +1178,7 @@ export const opencode: Integration = {
     // (a) Write the shim file. mkdirSync is recursive so the plugins/ dir
     // is created on first install.
     mkdirSync(dirname(pluginPath), { recursive: true });
-    writeFileSync(pluginPath, buildOpenCodePluginShim(binaryPath, effectiveScope), "utf8");
+    writeConfigFileAtomic(pluginPath, buildOpenCodePluginShim(binaryPath, effectiveScope));
 
     // (b) Merge our entry into the plugin array idempotently. Replace any
     // existing failproofai-marked entry; otherwise append.
@@ -1422,7 +1473,30 @@ const HERMES_PLUGIN_SOURCE_DIR = "hermes-plugin";
 function getHermesPluginSourcePath(): string {
   const fromEnv = process.env.FAILPROOFAI_PACKAGE_ROOT;
   if (fromEnv) return resolve(fromEnv, HERMES_PLUGIN_SOURCE_DIR);
-  return resolve(fileURLToPath(import.meta.url), "..", "..", "..", HERMES_PLUGIN_SOURCE_DIR);
+  return findHermesPluginSourcePath(dirname(fileURLToPath(import.meta.url)));
+}
+
+/**
+ * The package's `hermes-plugin/`, found by walking up from `startDir`.
+ *
+ * The CLI entry point sets `FAILPROOFAI_PACKAGE_ROOT`, so this is only the
+ * fallback — but a fixed number of parents is right for exactly one layout:
+ * three from `src/hooks/` is the package root, three from the bundled
+ * `dist/cli.mjs` is the package's PARENT. Walking up to the first directory
+ * that really holds the plugin's manifest works from source, from `dist/`, and
+ * from the dashboard's standalone build alike. When none is found the old
+ * answer is returned, so the install still fails loudly on a missing asset.
+ */
+export function findHermesPluginSourcePath(startDir: string): string {
+  let dir = resolve(startDir);
+  for (let i = 0; i < 8; i++) {
+    const candidate = resolve(dir, HERMES_PLUGIN_SOURCE_DIR);
+    if (existsSync(resolve(candidate, "plugin.yaml"))) return candidate;
+    const parent = dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  return resolve(startDir, "..", "..", HERMES_PLUGIN_SOURCE_DIR);
 }
 
 export function hermesPluginPathForSettings(settingsPath: string): string {
@@ -1599,11 +1673,16 @@ export function installHermesPlugin(
   if (linked && (existing.kind === "absent" || existing.kind === "link")) {
     try {
       renameSync(temporary, destination);
+      return "linked";
     } catch (err) {
-      rmSync(temporary, { force: true });
-      throw err;
+      // Windows cannot always rename a junction over another junction; the
+      // backup swap below moves the old link aside first, so try that before
+      // giving up. With nothing there to move aside, the rename is the error.
+      if (existing.kind !== "link") {
+        rmSync(temporary, { force: true });
+        throw err;
+      }
     }
-    return "linked";
   }
 
   const backup = `${destination}.backup-${suffix}`;
@@ -1671,11 +1750,13 @@ function removeLegacyHermesHooks(doc: Document): number {
 function hermesConfigState(settingsPath: string): {
   pluginEnabled: boolean;
   legacyShellHookPresent: boolean;
+  unreadable?: boolean;
 } {
   if (!existsSync(settingsPath)) {
     return { pluginEnabled: false, legacyShellHookPresent: false };
   }
-  const doc = readYamlDoc(settingsPath);
+  const doc = inspectYamlDoc(settingsPath);
+  if (!doc) return { pluginEnabled: false, legacyShellHookPresent: false, unreadable: true };
   const js = (doc.toJS() ?? {}) as {
     hooks?: Record<string, HermesHookEntry[]>;
     plugins?: HermesPluginsConfig;
@@ -1763,6 +1844,29 @@ export async function migrateHermesProfiles(opts: {
     const base = { name: profile.name, home: profile.home };
     const legacy = config.legacyShellHookPresent;
 
+    // A config.yaml that does not parse is never edited. Whether it is ours to
+    // report is read from the raw text: it cannot be parsed to find out.
+    if (config.unreadable) {
+      let raw = "";
+      try {
+        raw = readFileSync(settingsPath, "utf8");
+      } catch {
+        raw = "";
+      }
+      const mentionsUs = ours || raw.includes(FAILPROOFAI_HOOK_MARKER) || /failproofai/.test(raw);
+      results.push(
+        mentionsUs
+          ? {
+              ...base,
+              status: "failed",
+              detail: `${settingsPath} does not parse as YAML; left untouched`,
+              legacyShellHooksRemain: /--hook\s+\S+\s+--cli\s+hermes|__failproofai_hook__/.test(raw),
+            }
+          : { ...base, status: "untouched", detail: "no failproofai integration", legacyShellHooksRemain: false },
+      );
+      continue;
+    }
+
     if (!legacy && !ours && !config.pluginEnabled) {
       results.push({ ...base, status: "untouched", detail: "no failproofai integration", legacyShellHooksRemain: false });
       continue;
@@ -1850,6 +1954,8 @@ export interface HermesProfileHealth {
    * with none of those, so their tool calls go unchecked.
    */
   cronUnchecked: boolean;
+  /** config.yaml exists but does not parse; failproofai will not touch it. */
+  configUnreadable: boolean;
   healthy: boolean;
 }
 
@@ -1870,7 +1976,8 @@ export function hermesProfileHealth(): HermesProfileHealth[] {
       pluginEnabled: config.pluginEnabled,
       legacyShellHookPresent: config.legacyShellHookPresent,
       cronUnchecked: config.legacyShellHookPresent && !pluginWorks,
-      healthy: pluginWorks && !config.legacyShellHookPresent,
+      configUnreadable: config.unreadable === true,
+      healthy: pluginWorks && !config.legacyShellHookPresent && config.unreadable !== true,
     };
   });
 }
@@ -1881,6 +1988,9 @@ export function hermesProfileStatusRows(): Array<[string, string]> {
     .filter((profile) => existsSync(profile.home))
     .map((profile) => {
       const label = "hermes/" + profile.name;
+      if (profile.configUnreadable) {
+        return [label, `UNHEALTHY — ${profile.settingsPath} does not parse; failproofai leaves it untouched until it is fixed`];
+      }
       if (profile.cronUnchecked) {
         // Not a cosmetic leftover: the shell-hook integration does not reach
         // cron jobs at all, so this profile has an unenforced path.

package/src/hooks/jev-activity.ts

@@ -236,7 +236,12 @@ export function sanitizeJevActivity<T extends JevActivityFields>(entry: T): T {
 
   if (!(typeof out.evaluator === "string" && EVALUATORS.has(out.evaluator))) drop("evaluator");
   if (!(typeof out.jevDecision === "string" && DECISIONS.has(out.jevDecision))) drop("jevDecision");
+  // A mode this build does not know (a row written before the mode was named
+  // `observe`) cannot say whether its clears were enforced, so they are not
+  // counted as anything: dropping only the mode would file them as enforced.
+  const unknownMode = out.jevMode !== undefined && !(typeof out.jevMode === "string" && MODES.has(out.jevMode));
   if (!(typeof out.jevMode === "string" && MODES.has(out.jevMode))) drop("jevMode");
+  if (unknownMode) drop("jevCleared");
 
   if (Array.isArray(out.jevCleared)) {
     const names = [

package/src/hooks/policy-reviewability.ts

@@ -61,7 +61,7 @@ import { resolve } from "node:path";
 import { discoverPolicyFiles } from "./custom-hooks-loader";
 import { customPoliciesDir } from "./fp-home";
 import { configuredCustomPolicyPaths, findProjectConfigDir, readMergedHooksConfig } from "./hooks-config";
-import { hasInstalledPacks, readInstalledPacks } from "./pack-manifest";
+import { hasInstalledRegexPacks, readInstalledPacks } from "./pack-manifest";
 import { resolvePolicyAuthority } from "./policy-authority";
 import { POLICY_CATALOG } from "./policy-catalog";
 import { normalizePolicyName } from "./policy-registry";
@@ -167,7 +167,9 @@ export function surveyReviewableCoverage(cwd?: string): ReviewableCoverage {
    */
   let reviewers: ReadonlySet<string> | undefined;
   try {
-    packsInstalled = hasInstalledPacks();
+    // Only a pack with regex policies retires the shim, exactly as handler.ts
+    // decides it: a Jev-only pack (FailproofAI/jev-policies) replaces none.
+    packsInstalled = hasInstalledRegexPacks();
     const packs = readInstalledPacks().packs;
     for (const pack of packs) {
       const selected = pack.enabled;

package/src/hooks/safe-config-write.ts

@@ -0,0 +1,119 @@
+/**
+ * Crash-safe writes for configuration files that belong to someone else.
+ *
+ * Every agent integration edits a file the user's agent reads on startup:
+ * `~/.claude/settings.json`, `~/.hermes/config.yaml`, `~/.openclaw/openclaw.json`
+ * and the rest. A plain `writeFileSync` truncates that file first and fills it
+ * second, so a crash, a full disk or a killed process in between leaves the agent
+ * with a half-written config — for Hermes that is a gateway that will not start.
+ * And a later install then refuses to touch the file because it no longer parses,
+ * so nothing repairs it.
+ *
+ * So the new content never goes near the live file until it is complete and on
+ * disk:
+ *
+ *   1. write it to a uniquely named temporary file in the SAME directory (a
+ *      rename is only atomic within one filesystem),
+ *   2. fsync that file,
+ *   3. copy the current file to `<name>.failproofai-backup` — the last version
+ *      before failproofai changed it, for a person to restore by hand,
+ *   4. rename the temporary file over the live one (atomic on POSIX, and a
+ *      replacing move on Windows), then fsync the directory so the rename
+ *      itself survives a power cut.
+ *
+ * Any failure before step 4 leaves the live file exactly as it was and removes
+ * the temporary file. The file keeps its permission bits (Hermes keeps
+ * `config.yaml` at 0600), and a config that is a symlink — a dotfiles checkout —
+ * is written through to its target rather than replaced by a regular file.
+ */
+import {
+  chmodSync,
+  closeSync,
+  copyFileSync,
+  existsSync,
+  fsyncSync,
+  lstatSync,
+  mkdirSync,
+  openSync,
+  realpathSync,
+  renameSync,
+  rmSync,
+  statSync,
+  writeSync,
+} from "node:fs";
+import { randomBytes } from "node:crypto";
+import { basename, dirname, join } from "node:path";
+
+/** Where the copy of the previous version is kept, beside the file itself. */
+export function configBackupPath(path: string): string {
+  return `${resolveWriteTarget(path)}.failproofai-backup`;
+}
+
+/** Hooks for tests to simulate an interruption at the one step that matters. */
+export interface AtomicWriteDeps {
+  rename?: (from: string, to: string) => void;
+}
+
+/** A symlinked config is written through to what it points at. */
+function resolveWriteTarget(path: string): string {
+  try {
+    if (lstatSync(path).isSymbolicLink()) return realpathSync(path);
+  } catch {
+    // Absent or unreadable: write to the path as given.
+  }
+  return path;
+}
+
+export function writeConfigFileAtomic(path: string, content: string, deps: AtomicWriteDeps = {}): void {
+  const target = resolveWriteTarget(path);
+  const dir = dirname(target);
+  mkdirSync(dir, { recursive: true });
+
+  let mode: number | undefined;
+  try {
+    mode = statSync(target).mode & 0o777;
+  } catch {
+    mode = undefined; // a new file: the process umask decides, as writeFileSync would
+  }
+
+  const temporary = join(dir, `.${basename(target)}.failproofai-${process.pid}-${randomBytes(4).toString("hex")}.tmp`);
+  let fd: number | undefined;
+  try {
+    fd = openSync(temporary, "wx", mode ?? 0o666);
+    const bytes = Buffer.from(content, "utf8");
+    let written = 0;
+    while (written < bytes.length) written += writeSync(fd, bytes, written, bytes.length - written);
+    fsyncSync(fd);
+    closeSync(fd);
+    fd = undefined;
+    // `open` applies the umask; the live file's own bits are what should survive.
+    if (mode !== undefined) chmodSync(temporary, mode);
+
+    if (existsSync(target)) copyFileSync(target, `${target}.failproofai-backup`);
+
+    (deps.rename ?? renameSync)(temporary, target);
+  } catch (err) {
+    if (fd !== undefined) {
+      try {
+        closeSync(fd);
+      } catch {
+        // already closed or never opened
+      }
+    }
+    rmSync(temporary, { force: true });
+    throw err;
+  }
+
+  // Make the rename itself durable. Not supported on every platform (Windows
+  // cannot open a directory); the file content is already safe either way.
+  try {
+    const dirFd = openSync(dir, "r");
+    try {
+      fsyncSync(dirFd);
+    } finally {
+      closeSync(dirFd);
+    }
+  } catch {
+    // best effort
+  }
+}