failproofai policy packs

Policy packs for failproofai.

failproofai pack add FailproofAI/policies

That resolves the newest release, pins the exact tag, verifies both assets against SHA256SUMS, and installs. The digest is recorded locally and re-verified before every import, so a pack cannot change under a machine after it was installed.

Take only part of a pack:

failproofai pack add FailproofAI/policies --only block-sudo,block-env-files

Re-adding at a newer version keeps that selection rather than switching the rest back on.

What a release contains

Asset	What it is
failproofai-pack.json	The manifest: pack id, version, and every policy's metadata
failproofai-pack.mjs	One bundled entry artifact — every policy's implementation
SHA256SUMS	Digests for both, checked at install time

One entry file is a requirement, not a convenience: only the entry is content-addressed, so a multi-file pack could not honestly claim to be digest-pinned.

failproofai/builtins

The policies that ship compiled into the failproofai npm package, published here as a pack so they travel the same path any third-party pack does.

block-failproofai-commands is deliberately not included. It is the guard that stops an agent disabling failproofai, it is alwaysOn, and the pack loader refuses any pack declaring alwaysOn — so shipping it here would produce a pack failproofai itself rejects.

Publishing your own

A pack is a GitHub release carrying those three assets. The pack id in your manifest should be <publisher>/<name>, and policy names may not contain / — that namespace belongs to the builtins, and the loader refuses a pack that reaches into it.

failproofai pack add github:your-org/your-pack@v1.0.0

Generated by bun run build:pack in the failproofai repo.