Skip to content

chore: add .failproofai config directory#94

Merged
NiveditJain merged 5 commits into
mainfrom
add-failproofai-config
Apr 14, 2026
Merged

chore: add .failproofai config directory#94
NiveditJain merged 5 commits into
mainfrom
add-failproofai-config

Conversation

@NiveditJain

@NiveditJain NiveditJain commented Apr 14, 2026

Copy link
Copy Markdown
Member

Summary

  • Adds .failproofai/ config directory with all 30 built-in policies enabled
  • Configures block-force-push hint suggesting fresh branch as alternative
  • Adds convention-based workflow policies (.failproofai/policies/workflow-policies.mjs):
    • changelog-check — reminds agent to update CHANGELOG before committing
    • docs-check — reminds agent to update docs, README, and examples if relevant
    • pr-description-check — reminds agent to update PR description after pushing
  • Tracks .claude/settings.json in git (un-gitignored)
  • Documents cross-cutting hint param in built-in policies reference
  • Fix: Accumulate all instruct messages instead of only delivering the first one
  • Fix: Rename convention policy prefix from convention/ to .failproofai-{scope}/ (.failproofai-project/, .failproofai-user/) with convention_scope in telemetry

Test plan

  • bun run test:run — 872 tests pass
  • bun run test:e2e — 204 e2e tests pass
  • failproofai p — all 3 convention policies discovered and loaded
  • Convention policies fire correctly on git commit and git push
  • No stale convention/ references in source code

🤖 Generated with Claude Code

Summary by CodeRabbit

  • New Features

    • Added repository policies for sanitizing secrets, protecting env vars, and blocking dangerous commands.
    • New workflow prompts that remind contributors to update the changelog, documentation, and PR description during git actions.
    • Project now runs configured lifecycle hooks to invoke policy checks at key events.
  • Behavior Changes

    • Multiple instruct/warning messages are now accumulated and shown together instead of only the first.
  • Documentation

    • Docs updated to show a cross-cutting hint parameter for customizing policy messages and examples for its use.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@coderabbitai

coderabbitai Bot commented Apr 14, 2026

Copy link
Copy Markdown

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 8edd9a97-939c-4cf5-ab97-2a0afc314331

📥 Commits

Reviewing files that changed from the base of the PR and between a5c44bd and dc8b3ac.

📒 Files selected for processing (11)
  • .claude/settings.json
  • .failproofai/policies/workflow-policies.mjs
  • .gitignore
  • CHANGELOG.md
  • __tests__/hooks/handler.test.ts
  • __tests__/hooks/policy-evaluator.test.ts
  • docs/configuration.mdx
  • docs/custom-policies.mdx
  • src/hooks/custom-hooks-loader.ts
  • src/hooks/handler.ts
  • src/hooks/policy-evaluator.ts

📝 Walkthrough

Walkthrough

Adds FailproofAI policy/config files and workflow convention policies that intercept PreToolUse Bash invocations (git commit/push) to prompt for changelog/docs/PR description updates; introduces scoped convention tagging, accumulates multiple instruct messages, expands policy hinting via policyParams, and updates related tests, docs, and hooks configuration.

Changes

Cohort / File(s) Summary
FailproofAI policy config
.failproofai/policies-config.json
New JSON config enabling multiple built-in security/safety policies and providing policyParams (e.g., block-force-push.hint) to append cross-cutting hint text to deny/instruct messages.
Workflow convention policies
.failproofai/policies/workflow-policies.mjs
Adds three PreToolUse convention policies (changelog-check, docs-check, pr-description-check) that inspect ctx.toolInput?.command for git commit/git push and return instruct(...) prompts when matches are found.
Hook wiring & runtime hooks
.claude/settings.json, .gitignore
Adds .claude/settings.json registering numerous event hooks invoking failproofai --hook <Event>; updates .gitignore to ignore .claude/* but keep .claude/settings.json.
Hook loader & handler logic
src/hooks/custom-hooks-loader.ts, src/hooks/handler.ts
Switches convention tagging from boolean to scoped string (__conventionScope), registers policy names with .failproofai-<scope>/ prefix, and includes convention_scope in telemetry payloads.
Policy evaluation behavior
src/hooks/policy-evaluator.ts
Accumulates all instruct results (collects multiple messages and policy names), returns combined reasons/new policyNames array while keeping policyName as first instructing policy.
Tests
__tests__/hooks/handler.test.ts, __tests__/hooks/policy-evaluator.test.ts
Updated telemetry expectations to include convention_scope: null, adjusted tests to assert accumulation of multiple instruct messages and renamed tests/policy name prefixes to scoped .failproofai-....
Documentation & changelog
CHANGELOG.md, docs/built-in-policies.mdx, docs/configuration.mdx, docs/custom-policies.mdx
Documented new convention policies, updated explanation of cross-cutting hint in policyParams (now applies to additional convention scopes), and noted instruct-message accumulation behavior.

Sequence Diagram(s)

sequenceDiagram
    participant User
    participant FailproofAI
    participant Bash
    participant Git

    User->>FailproofAI: Invoke tool (PreToolUse event)
    FailproofAI->>FailproofAI: Determine tool type
    alt tool === "Bash"
        FailproofAI->>FailproofAI: Read ctx.toolInput?.command
        alt command matches git commit
            FailproofAI->>User: instruct("Please update CHANGELOG.md / docs...") (may accumulate multiple instructs)
        else command matches git push
            FailproofAI->>User: instruct("Remember to update PR description")
        else
            FailproofAI->>Bash: allow execution
            Bash->>Git: run command
        end
    else
        FailproofAI->>Bash: allow execution
        Bash->>Git: run command
    end
Loading

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~45 minutes

Possibly related PRs

Poem

🐰 I hopped through code with careful paws,
Policies set to check your cause,
"Update the changelog!" I softly plea,
Docs and PR notes — remember me!
Hints and scopes now guide the way,
A rabbit cheers for safer play. 🥕

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 inconclusive)

Check name Status Explanation Resolution
Title check ❓ Inconclusive The title is vague and overly broad. It describes adding a directory but doesn't convey the substantial policy configuration and workflow enforcement changes included in the changeset. Improve the title to reflect the primary changes, such as: 'feat: add FailproofAI policies and changelog validation' or 'chore: add policies config with changelog-check convention'.
✅ Passed checks (2 passed)
Check name Status Explanation
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Description check ✅ Passed The pull request description is comprehensive and well-structured, covering all major changes including configuration, convention policies, fixes, and test plan.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch add-failproofai-config

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

NiveditJain and others added 3 commits April 14, 2026 11:21
…k-force-push hint

Add cross-cutting hint tip to built-in-policies.mdx so users discover the
feature from the policy reference page. Add a block-force-push hint example
inline and configure the project config with a hint suggesting a fresh branch
as an alternative to force-pushing.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Adds a convention-based instruct policy at .failproofai/policies/ that
reminds the coding agent to check and update CHANGELOG.md before committing.
Auto-discovered by failproofai — no config changes needed.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
…ack .claude/settings.json

Add convention policies to remind the agent to update documentation
(docs/*.mdx, README.md, examples/) and PR descriptions when relevant.
Un-gitignore .claude/settings.json so hook configuration is shared with
the team.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Inline comments:
In @.failproofai/policies/workflow-policies.mjs:
- Line 16: Replace the narrow regex /git\s+commit/ with a broader pattern that
allows intervening git options (e.g., -c key=value or other flags) between "git"
and "commit"; in other words, change the condition that currently tests
/git\s+commit/ so it matches "git" followed by zero or more space‑separated
tokens (including tokens starting with '-') and then "commit", and ensure you
use a word boundary so only actual commit commands match.

In `@CHANGELOG.md`:
- Around line 6-10: Update the bullets under the "## Unreleased" section (e.g.,
the lines mentioning "Add `changelog-check` convention policy" and the "Docs"
bullets about `hint` and `block-force-push`) to append the PR reference suffix
for each entry (format: " (`#123`)") so every Unreleased bullet includes its PR
number; ensure the PR id is accurate for each item and preserve existing wording
and markdown structure.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 6348d479-5f06-48b7-b87a-a83730710543

📥 Commits

Reviewing files that changed from the base of the PR and between 7a38d2b and a5c44bd.

📒 Files selected for processing (4)
  • .failproofai/policies-config.json
  • .failproofai/policies/workflow-policies.mjs
  • CHANGELOG.md
  • docs/built-in-policies.mdx

fn: async (ctx) => {
if (ctx.toolName !== "Bash") return allow();
const cmd = String(ctx.toolInput?.command ?? "");
if (/git\s+commit/.test(cmd)) {

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

Broaden commit detection to avoid missing valid git commit forms.

Current regex can miss commands like git -c key=value commit -m ..., so reminders won’t trigger consistently.

🔧 Proposed fix
-    if (/git\s+commit/.test(cmd)) {
+    const isGitCommit =
+      /^\s*(?:[A-Za-z_][A-Za-z0-9_]*=\S+\s+)*git(?:\s+-\S+)*\s+commit\b/.test(cmd);
+    if (isGitCommit) {
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
if (/git\s+commit/.test(cmd)) {
const isGitCommit =
/^\s*(?:[A-Za-z_][A-Za-z0-9_]*=\S+\s+)*git(?:\s+-\S+)*\s+commit\b/.test(cmd);
if (isGitCommit) {
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In @.failproofai/policies/workflow-policies.mjs at line 16, Replace the narrow
regex /git\s+commit/ with a broader pattern that allows intervening git options
(e.g., -c key=value or other flags) between "git" and "commit"; in other words,
change the condition that currently tests /git\s+commit/ so it matches "git"
followed by zero or more space‑separated tokens (including tokens starting with
'-') and then "commit", and ensure you use a word boundary so only actual commit
commands match.

Comment thread CHANGELOG.md Outdated
Comment on lines +6 to +10
- Add `changelog-check` convention policy to remind agent to update CHANGELOG before committing

### Docs
- Document cross-cutting `hint` param in built-in policies reference and add `block-force-push` hint example
- Add `block-force-push` hint to project config suggesting fresh branch as alternative

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

Add PR numbers to the new Unreleased bullets.

These entries should include the PR reference suffix to match the repo changelog convention.

✏️ Proposed fix
 ### Features
-- Add `changelog-check` convention policy to remind agent to update CHANGELOG before committing
+- Add `changelog-check` convention policy to remind agent to update CHANGELOG before committing (`#94`)

 ### Docs
-- Document cross-cutting `hint` param in built-in policies reference and add `block-force-push` hint example
-- Add `block-force-push` hint to project config suggesting fresh branch as alternative
+- Document cross-cutting `hint` param in built-in policies reference and add `block-force-push` hint example (`#94`)
+- Add `block-force-push` hint to project config suggesting fresh branch as alternative (`#94`)

Based on learnings: Update CHANGELOG.md in every PR under ## Unreleased, and include PR numbers per entry (e.g., (#123)).

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
- Add `changelog-check` convention policy to remind agent to update CHANGELOG before committing
### Docs
- Document cross-cutting `hint` param in built-in policies reference and add `block-force-push` hint example
- Add `block-force-push` hint to project config suggesting fresh branch as alternative
- Add `changelog-check` convention policy to remind agent to update CHANGELOG before committing (`#94`)
### Docs
- Document cross-cutting `hint` param in built-in policies reference and add `block-force-push` hint example (`#94`)
- Add `block-force-push` hint to project config suggesting fresh branch as alternative (`#94`)
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@CHANGELOG.md` around lines 6 - 10, Update the bullets under the "##
Unreleased" section (e.g., the lines mentioning "Add `changelog-check`
convention policy" and the "Docs" bullets about `hint` and `block-force-push`)
to append the PR reference suffix for each entry (format: " (`#123`)") so every
Unreleased bullet includes its PR number; ensure the PR id is accurate for each
item and preserve existing wording and markdown structure.

… .failproofai-{scope}

- Accumulate all instruct messages instead of first-wins, matching the
  existing allow accumulation pattern.
- Rename convention policy prefix from convention/ to
  .failproofai-project/ or .failproofai-user/ based on discovery scope.
- Add convention_scope field to telemetry for both policy_triggered and
  custom_hook_error events.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant