v1.0.0: failproofaid

[NiveditJain]

v1.0.0

The first stable release. The current latest on npm is 0.0.15, so upgrading from it lands the entire 1.0.0-beta.* line at once: a background daemon, fail-closed enforcement, twelve agent CLIs, FailproofAI Cloud, and a ~/.failproofai that survives its own upgrades.

Upgrading

npm install -g failproofai@latest && failproofai update

Two commands, because npm only replaces the CLI ~/.failproofai/ and the daemon binary under ~/.failproofai/bin/ do not move with it. failproofai update runs any pending home migrations, installs the matching failproofaid binary and restarts the service. failproofai migrate --dry-run prints exactly what would happen, changing nothing.

Your cloud enrolment, ingest credential, policy selection, hand-written policies, undelivered events, telemetry identity and decision history are all carried across. The irreplaceable files are copied to ~/.failproofai/migrations/backup-layout<n>/ before the first step, and every step is recorded in migrations/applied.json.

The three things worth knowing

Enforcement runs through a background daemon, and a configured machine fails closed.
failproofai config installs failproofaid as a system service (systemd unit at /etc/systemd/system/failproofaid@<user>.service, launchd LaunchDaemon on macOS) system-scope but user-run, so it starts at boot and survives logout. From that point an unreachable daemon denies rather than quietly falling back to in-process evaluation: a guarantee you can remove by stopping a service is not one. A protocol-version mismatch
denies too, but says so in its own words, because the remedy differs. In-process evaluation still exists and is reachable only on a machine that was never set up.

A policy that cannot be honoured on your CLI is not silently pretended.
enforcement-capability.ts records, per (CLI, event) pair and with the evidence attached, whether a deny actually changes the agent's behaviour on that CLI. Absent means UNVERIFIED — never "blocked". The five require-*-before-stop gates, for example, have no turn-end event to hang off on Hermes or Goose, and that is stated rather than assumed.

Setup is two questions, not five. failproofai config opens with a Recommended path:
global scope, the CLIs actually detected on the machine, and a named 15-policy set. Customize is the previous wizard, unchanged — nothing is hidden, it just stops being the only way through. Recommended unions with what you already had enabled, so choosing the sensible default can never reduce your protection.

Twelve agent CLIs

Live-hook enforcement on Claude Code, Codex, Copilot CLI, Cursor, OpenCode, Pi, Hermes, OpenClaw, Factory (droid), Devin, Antigravity (agy) and Goose — each against that CLI's own hook contract, verified live against a named version rather than inferred from docs. VS Code's Copilot Chat agent mode is covered for free: it loads the same .github/hooks/*.json and ~/.claude/settings.json the copilot and claude installs already write.

Transcript collection and the audit pillar cover the same twelve.

FailproofAI Cloud

• failproofai config --connect <url> --token <key> enrols a machine in one step policy pull and event ingest share one credential, one URL and one prompt.
• Cloud-managed policies are content-addressed and digest-verified immediately before import, with an observe effect for the observe-before-enforce step of a rollout.
• Every decision carries its attribution: policySource, cloudPolicyId, the deployment it came from — so the dashboard can answer what centrally-managed policy actually did.
• failproofai config --disconnect really disconnects: the daemon reads mode: "oss" and goes silent, and the active manifest is cleared so nothing keeps enforcing from a deployment the machine has left.
• Delivery failures surface on their own. A revoked or expired key used to leave a byte-perfect credential file, a cheerful --status, and data that simply never arrived; --status now reports from the collector's own record of what the server said, and the same verdict is printed once per session at SessionStart.

New commands

Command	What it is for
failproofai update	The half of an upgrade npm does not do: migrations, daemon binary, service restart.
failproofai migrate [--dry-run]	Run the home migration alone, or print the plan.
failproofai uninstall [--purge]	The sanctioned way off a machine — hook entries in every CLI, the root-owned unit, optionally ~/.failproofai.
failproofai backfill [--since 30d]	Re-send history the collector has already read past, after a re-enrolment or a cleared dashboard.
failproofai harness add-path	Extra capture paths per harness, for homes and gateways that live off the default roots.
failproofai config --pause / --resume	Time-boxed suspension of enforcement for one session, with a hard 8-hour ceiling on any unbroken stretch.
failproofai audit --scheduled	Headless local scan; [audit] auto ships off, because the scan reads transcript contents.

Removed

• failproofai auth login / logout / whoami. Sign-in has not gone anywhere — the local dashboard has always had its own, and still does. This was the second front door.
• Emailed scan reports (config --email / --no-email) and the counters-only upload the scheduled scan used to POST. An audit of what is on your laptop is a local tool; the safest version of a network call it does not need to make is not making it.

Platform support

Linux and macOS. On Windows, failproofai config prints why and exits 1 before writing anything rather than completing setup with a weaker guarantee than every other configured machine has. Revisit when failproofaid gains a Windows service target.

Also in this release

• A Hermes session now keeps one agent id for its whole life. Identity comes from which database the session is in, not from cwd/source columns Hermes rewrites mid-run — a single session was arriving in the dashboard as two machines' worth of agents.
• A PostToolUse deny now actually enforces on Codex and Copilot. Both read a top-level {decision:"block", reason} at that event and neither reads the shape we emitted, so every sanitize-* deny on those two CLIs was evaluated, logged, counted — and dropped. Verified live against Codex 0.147.0 and Copilot 1.0.78.
• mode: "oss" is now honoured by the daemon, not just the CLI, so a disconnected machine is provably silent instead of silent-by-happenstance.
• The recommended set names all 15 policies explicitly, and a test asserts every default-on builtin stays in it — including block-rm-rf, block-force-push and block-secrets-write, which were off by default and should not have been. Both are precisely scoped: rm -rf node_modules is untouched, and --force-with-lease is allowed.

The full history, including all 22 beta releases, is in
CHANGELOG.md.

---

This discussion was created from the release v1.0.0: failproofaid.