@passioncode-ai/fabric-agent-adapter 0.35.0 → 0.35.2

package/CHANGELOG.md

@@ -1,5 +1,43 @@
 # Changelog
 
+## 0.35.2 - 2026-10-18
+
+### Added
+
+- **`creating-fabric-agents` → resilience and autonomy, second pass**: retries moved at most once and only before the
+  first byte, a persisted `Retry-After`; deciding for a waiting peer and releasing a lease with its commit; live-only,
+  exactly-once hand-overs; protocols ported from shared vectors; bytecode cleared before mutation runs; blocking work
+  off request workers and interruptible socket waits; bounded recursive parsing, content-addressed revocation, no
+  refresh of a person's own credentials. From the same retrospective's later answers (2026-10-17/18).
+
+## 0.35.1 - 2026-10-17
+
+### Added
+
+- **`creating-fabric-agents` → `references/resilience-and-autonomy.md`**: the rules that kept about twenty production
+  agents working through limits, model errors and restarts, from their retrospectives of 2026-10-17 — limits as
+  pauses and resume-first workers, an acceptance parser per model call, cross-vendor fallbacks and checkers, spend as
+  a persisted ledger with idempotency keys, decisions recorded instead of asked, tests watched failing, run ownership,
+  owner-tagged resources and secrets kept out of every child's environment. The skill reads it before the first
+  stage that calls a model or spends money and reports its checklist.
+
+### Fixed
+
+- **The Hermes native adapter dropped a helper's answer** (FAA-51): a helper that exits without reading its input broke
+  the pipe while the payload was written, and the broken pipe discarded the helper's output. It no longer does.
+- **`test/validate.py` validated other checkouts as this tree** (FAA-50): its walks entered `.worktrees/` (git
+  worktrees of this repository, git-ignored), so the main checkout failed the pin check — 442 errors — whenever a
+  worktree of another branch sat beside it. Every walk now skips `.git` and `.worktrees`.
+- **The tests left directories behind** (FAA-50): the Node tests made their temporary directories with `mkdtempSync`
+  and removed none, and five Python tests used `mkdtemp` without a cleanup, so every run left about 40 directories in
+  the system's temp folder. The Node tests take theirs from `test/temp-dir.mjs`, removed when the process exits; the
+  Python tests register `addCleanup`. A full run now leaves none.
+- **The session hooks' spool grew without bound** (FAA-50): a session folder was removed only when its worker delivered
+  the session's end, so a failed delivery or a session that ended without SessionEnd left its folder forever. The next
+  spooling hook now removes folders untouched for 7 days, never its own.
+- **`install-host-hooks --host codex --remove`** names the SessionStart hook groups after ours that it moves: Codex
+  keys a hook's trust by its position, and asks the person to approve those again in `/hooks` (FAA-49).
+
 ## 0.35.0 - 2026-10-16
 
 ### Fixed

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@passioncode-ai/fabric-agent-adapter",
-  "version": "0.35.0",
+  "version": "0.35.2",
   "description": "Create Fabric-compatible agents, run them as always-alive local services with dashboards (fabric-service/0.1), and adapt existing projects to the Fabric Agent Contract. This package is the installer CLI.",
   "scripts": {
     "test": "python3 test/validate.py && python3 -m unittest discover -s test -q && node --test 'test/*.test.mjs'"

package/plugins/fabric-agent-adapter/.claude-plugin/plugin.json

@@ -3,7 +3,7 @@
   "name": "fabric-agent-adapter",
   "displayName": "Fabric Agent Adapter",
   "description": "Create new Fabric-compatible agents, build them as always-alive local services with dashboards (fabric-service/0.1), and adapt existing projects to the Fabric Agent Contract through evidence-backed MCP, A2A, or local-runner provider bundles; and teach a coding agent to work in a project through Fabric (fabric-mcp, fabric_whoami, claim and release), with Claude Code session hooks.",
-  "version": "0.35.0",
+  "version": "0.35.2",
   "author": {
     "name": "PassionCode.ai",
     "url": "https://passioncode.ai/"

package/plugins/fabric-agent-adapter/skills/adapting-projects-to-fabric/SKILL.md

@@ -5,7 +5,7 @@ license: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 compatibility: Requires filesystem access and Python 3.9+. Exact schema checks additionally need git, Node.js, pnpm, and the pinned fabric-agent-contract checkout (a public repository). Works without those tools in an explicitly degraded structural-check mode.
 metadata:
   author: PassionCode.ai
-  version: "0.35.0"
+  version: "0.35.2"
   contract-version: "0.1.0"
   contract-commit: "d8146cfb0a1c74fc6432284c4356bb0c864b37b5"
 ---

package/plugins/fabric-agent-adapter/skills/building-fabric-services/SKILL.md

@@ -18,7 +18,7 @@ license: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 compatibility: Python 3.9+ or Node.js 20+ for the kits; the probe needs Python 3.9+. launchd steps are macOS-only; Linux services install a systemd user unit and Windows ones a per-user Scheduled Task with the kits' writers. Dashboard handoff optionally uses Fabric Dashboards MCP link/host_status/open; without it, report unresolved host capability. The contract checkout is optional.
 metadata:
   author: PassionCode.ai
-  version: "0.35.0"
+  version: "0.35.2"
   contract-version: "0.1.0"
   extension: "fabric-service/0.1"
   extension-commit: "d8146cfb0a1c74fc6432284c4356bb0c864b37b5"

package/plugins/fabric-agent-adapter/skills/creating-fabric-agents/SKILL.md

@@ -5,7 +5,7 @@ license: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 compatibility: Requires filesystem access and Python 3.9+. Exact schema checks additionally need git, Node.js, pnpm, and the pinned fabric-agent-contract checkout (a public repository). Works without those tools in an explicitly degraded structural-check mode. Ships in one plugin with adapting-projects-to-fabric, whose scripts it reuses.
 metadata:
   author: PassionCode.ai
-  version: "0.35.0"
+  version: "0.35.2"
   contract-version: "0.1.0"
   contract-commit: "d8146cfb0a1c74fc6432284c4356bb0c864b37b5"
 ---
@@ -201,6 +201,15 @@ the pinned `schemas/operator-channel-status.schema.json`; the channel's runtime
 probe rule here yet, so report them `NOT_RUN`. An agent with neither stops nor notify
 events skips this step.
 
+## Resilience and autonomy
+
+Before the first stage that calls a model or spends money, read
+[resilience and autonomy](references/resilience-and-autonomy.md) and design its answers in:
+a limit pauses and resumes, every model answer passes the call site's own acceptance, fallbacks
+and checkers cross vendors, spend is a persisted ledger with idempotency keys, open questions
+become recorded decisions, and every fix has a test seen failing. Report its checklist with a
+file and a test per line, or `NOT_RUN` where the agent has no such stage.
+
 ## Completion format
 
 Report: capability, consumer, profile with the step-0 grill answers; the knowledge pack

package/plugins/fabric-agent-adapter/skills/creating-fabric-agents/references/resilience-and-autonomy.md

@@ -0,0 +1,230 @@
+# Resilience and autonomy — what kept agents working
+
+Read when designing an agent's loop, its model calls, its spend and its stops — before the first
+stage that calls a model or spends money. These rules come from a retrospective of about twenty
+production agents (2026-10-17): each rule names the failure that taught it, generalized, and the
+mechanism that held after the fix. Every rule is cheaper to build in than to retrofit.
+
+## Contents
+
+- Limits are pauses
+- Model answers are untrusted until accepted
+- Money is a ledger
+- Autonomy: decide, record, continue
+- Verification you can believe
+- Operations that survive restarts
+- Secrets and confinement
+- Checklist
+
+## Limits are pauses
+
+1. **A provider or subscription limit pauses the job; it never fails it.** Store a typed pause
+   (`quota_exhausted`, `retryable: true`, the reset time when known) and resume from the same
+   stage. Failing it cost callers whole jobs and resubmits.
+2. **Resume first.** Every worker reads its own state — checkpoint, worktree, branches, open
+   pull requests, notes — before it acts, and continues from there. Relaunching from scratch
+   after a limit recreated work over committed work and re-issued credentials already held.
+3. **A silent worker is a limit until proven otherwise.** A watcher that sees no progress for N
+   minutes, or limit text in the last output, resumes the run with the *same* run id.
+4. **Keep prompt cache keys stable across a resume.** One changed argument that every prompt
+   carries (today's date) re-keyed a finished stage and paid for it again.
+5. **Count only the job's own failures toward its retry limit.** A lost lease, a busy lock or a
+   provider outage is bounded by a time budget instead; five infrastructure stops a day ended a
+   healthy phase as FAILED.
+6. **Match concurrency to the account's rate, and cool down after a 429** per provider door: ten
+   parallel workers met a 429 about hourly and each lost a whole batch; three to five heavy ones,
+   resumed in batches, did not. A "busy" or "still starting" dependency is retried a bounded number
+   of times with spacing (a handful, seconds apart, only on refusals classified as transient) —
+   never once, never forever.
+7. **Inside a fallback chain, do not retry a provider that answered 429 or timed out** — move to
+   the next one. Retries there stalled a waiting user. Stagger many resumes; bound each worker's
+   working set (a narrow time window, a prefix), so one stop does not become a burst.
+
+8. **Move a refused request to another account at most once, and only before any byte reached the
+   client** — a replay after streaming began duplicated output. Persist a provider's `Retry-After`
+   across restarts; a check inside the hold answers the stored observation instead of probing.
+
+## Model answers are untrusted until accepted
+
+1. **"Answered" is not "usable".** Each call site has its own `accept(text)` — the parser the
+   result must pass. Empty content, a refusal, a truncation (`finish_reason: length`) or an
+   unparseable answer is a failure, and only an accepted answer may be cached. A cached
+   unreadable answer once served "0 labelled" for hours.
+2. **Fallbacks cross vendors.** A chain is an ordered list of models from different vendors; a
+   same-vendor fallback refuses the same inputs. Build the chain where a test can refuse a lane
+   with no other-vendor route, and act on a new fallback only after measuring it.
+3. **The checker is never the drafter's vendor.** Choose it per turn from the model that
+   *actually* drafted (a fallback may have), in the router, not in configuration. No checker
+   left, or a checker outage, means hold or stay silent — never ship unchecked.
+4. **Size the output budget for the answer, not the input.** Reasoning tokens eat `max_tokens`:
+   a judge capped at 800 tokens returned no JSON in 8 of 14 calls. Give judges room or turn
+   reasoning off for that route; on `length`, retry once with a larger cap.
+5. **Run code checks before model checks**, and degrade to a fixed safe reply with a reason code.
+6. **A model's word verifies nothing.** A fact is verified by stored source text (or two truly
+   independent sources); an effect by the system of record it lands in — never by the page, a
+   flag the model set, or its "done".
+7. **A coding agent runs only on a model it knows.** One CLI agent on an unfamiliar vendor's model
+   read its instructions and ended its turn with nothing written; measure each (agent, model)
+   pair live before making it a default.
+8. **Pin what the agent says about itself.** A short block of true facts (what it can see, its
+   pipeline, its limits) lives in code; a test fails when a fact drifts. Forbid promises the
+   pipeline cannot keep.
+
+## Money is a ledger
+
+1. **Unknown is unknown, never zero** — in cost, in verdicts, in health — and nothing acts on it.
+   A missing price is a high estimate, a missing field is `NOT_RUN`, never a pass; a probe that
+   timed out is "unreadable", not "credential rejected"; a cooldown that could not be read is not
+   "never sent". An owner's refusal inside a successful response (`ok: false` over a 200) is a
+   refusal, never an empty result.
+2. **Persist the attempt before dispatch** — its route and a hash of its prompt — and finalize it
+   in `finally`; spend is Σ actual + Σ estimate for attempts without an actual. In-memory counters
+   reset on every resume. A call that broke before the provider answered is reconciled against
+   the provider's own history by that route and hash, never guessed; one provider request id
+   belongs to exactly one ledger row.
+3. **Check the cap before every HTTP attempt, retries included**, with one stop rule; record the
+   provider's own reported cost per call; count reserved or held tokens as spent.
+4. **A resend of an unknown outcome reuses its idempotency key — or does not happen.** Derive
+   keys from the intent (action and entity, or run and step), never from a clock or a random
+   value, and make them unique in storage: time-and-random keys let redelivered requests charge
+   again. A write whose effect is uncertain stops as `outcome_unknown`; a new key there pays twice.
+5. **A client error at submit is a rejection, not a lost task.** Settle it with known usage (zero
+   if none), release the reserved money in the same transaction, and never resend the identical
+   request; a 4xx while polling is still a lost task.
+6. **A failed outer job cancels the paid work it started**, and a cancel is a row the worker reads
+   at every claim and checkpoint — never an in-memory flag that a restart forgets.
+7. **Reuse what was paid for.** A restarted stage looks up the job's successful call with the
+   same route, prompt version and inputs before calling again (one restart made 117 paid calls
+   where 49 sufficed). Cache keys are content plus definition, never an identity alone.
+8. **Deny spending tools by enumerated name, and test the list** — a provider's newer tools were
+   missing from a deny list while older ones were denied.
+
+## Autonomy: decide, record, continue
+
+1. **An open question is a decision to make.** Decide from the recorded decisions, then the
+   goal, then the safest reversible option; write the decision and its source where the work
+   lives; batch the questions only a person can answer (sign-in, consent, payment, a typed
+   secret) and keep working around them.
+2. **Nothing in a user's path waits for a human approval.** Send now or not at all; when unsure,
+   say so, open a recorded question, and answer again automatically when the knowledge changes.
+   Drafts awaiting approval waited for days.
+3. **Every wait lives in durable storage**, rebuilt on start from a "debt" query — timers in
+   process memory died with every restart. A wait that must outlive a session (a credential that
+   has not landed yet) is an operating-system job, not a session's background task.
+4. **Stop at the third round.** Tuning wording or patching one heuristic a third time means
+   splitting the change or replacing the mechanism with one invariant and a property test.
+   Write a review's exit criterion before its rounds start, and block only on what breaks a
+   documented promise; the rest becomes a board row with its evidence.
+5. **Find the real cause before telling a person what to do** — a full disk once read as "the
+   service stopped" while the service was healthy; check free space and the service's own health
+   first.
+6. **Background chores never hold a finished command open**, unattended runs skip them, and an
+   unattended `--yes` never reverses a "no" a person saved.
+
+7. **When a peer waits on your decision, make it**, mark it reversible, record it where the work
+   lives and reply naming the record; a platform once built nothing for days waiting on a
+   definition. Release a coordination lease in the same step as the commit that used it, the
+   failure path included.
+8. **Hand work over only while it is alive**, and claim each hand-over exactly once by an exclusive
+   create; a forgotten workflow was handed over twice.
+
+## Verification you can believe
+
+1. **A test counts once it was watched failing against a planted defect** (clear bytecode caches
+   first — stale bytecode reported mutants killed); a mutation battery
+   asserts its own reach ("no tests ran" is not "all plants survived"). Exercise every guard
+   with a must-catch and a must-pass case.
+2. **Write expectations out; never compute them from the code under test**, and run a reference
+   function and its schema on the same inputs in one test — the most common defect a first reading
+   found was a function returning what its own schema refuses. A wall-clock bound sits far above a
+   loaded machine and far below the defect it guards.
+3. **Test against the real deployed instance behind its platform**, not a sample the same run
+   wrote: a probe passed the shipped sample and failed the first real service behind a router.
+4. **After each wave, three blind readings** — the changed units, everything that reaches them,
+   and the documented behaviour — then one fix round. Green suites hid six to ten real breaks.
+5. **Read a gate's exit code directly**, never through a pipe in the same command (`| tail` hid a
+   failed gate as success): write the output to a file, take the status, then read the file.
+6. **"Could not measure" is its own outcome.** An overloaded machine makes a gate refuse, and a
+   timeout under load is unmeasured, not failed or passed.
+7. **Measure noise before calling a regression**; release a retrieval change only with zero new
+   confident wrong answers against the previous version.
+8. **Compute a status from the whole group**, never incrementally; verify a release by the
+   commit it serves, from a fresh checkout of that commit.
+9. **Probe live after every deploy on every consumer channel**, not the default one; read the
+   nightly full-suite result first when resuming work, and release from a full local run, not a
+   selected subset.
+10. **Port a protocol from the contract's shared vectors, never its prose** — vendored with a hash
+   per file and run case by case; a prose port accepted a year-0000 date the vectors refused.
+11. **Read an external contract from its raw documentation or a recorded live snapshot**, never
+   from a summarising fetch; fail closed on a field nobody documented.
+
+## Operations that survive restarts
+
+1. **One owner per run, named.** Only the holder of the run's lock changes its lifecycle, and each
+   concurrent worker has its own identity; a refused claim names the run that holds the task, never
+   a guessed race against a lease that lapsed long ago; a copy that a
+   supervisor started backs off on a held lock instead of exiting into a respawn loop. A failed
+   lease renewal is not a lost lease — stop only when the remaining margin runs out.
+2. **Health treats "never finished" as a fault.** Age each phase from its last completion; a
+   phase that only ever yielded looked healthy for fifteen days.
+3. **Everything a run creates carries its owner** (run id, pid); the next start sweeps what a dead
+   owner left — markers, test databases, temp roots, container volumes. Nothing a long job needs
+   lives in a temp directory; a cleaner removed a test database mid-deploy.
+4. **Check disk and load before heavy work**, and serialize heavy suites behind a lock held for
+   the whole run. A disk cleanup never deletes files version control tracks.
+5. **State that must survive a restart or a second instance lives in the shared store**, never in
+   process memory or on one instance's disk; a per-process cache is a cache with a TTL.
+6. **Every scheduled job leaves a trace when it dies, stalls or never starts**: a heartbeat at the
+   start of each tick, a queryable error row, re-arming in `finally`, an alert when quiet for two
+   intervals. Serialize every use of a connection threads share, reads included.
+7. **Bound every wait on a shared lock and survive a lost connection.** A lock timeout (a few
+   seconds) answers a retryable "busy", never a crash or a deadlock; every pooled connection has
+   an error listener, and readiness reports the store while liveness reports the process, so a
+   database blip takes the instance out of traffic instead of restarting it.
+8. **Every accumulating output has a cap in the code that writes it** — logs, receipts, caches —
+   with both bounds tested.
+9. **Name the account and context on every cloud CLI call** and verify the account before a write;
+   a saved default context once pointed a correct token at another team.
+10. **Log by error name and code**, never a driver's raw message, which can carry connection
+   details. A failed command logs its cause — deadline, signal, exit code, missing program — never a
+   bare "command failed"; a watched dependency logs once when it fails and once when it recovers,
+   never on every poll.
+11. **Admit work only when the machine can carry it** — free disk, swap, a cap on concurrent
+   sessions — and say why when you defer.
+
+12. **Keep blocking work off the workers that answer requests**, never let a read wait behind a long
+   transaction, and log a transaction held long with the step that held it. Every blocking network
+   wait is interruptible from outside, with its deadline on the socket, not between frames.
+
+## Secrets and confinement
+
+1. **A secret never enters an environment, argv, URL or log a child can read.** Hand it over a
+   pipe or file descriptor, or through a vault runner per command; never print a configuration
+   dump, and never filter one yourself.
+2. **Confine what an agent runs by the operating system**, per run (filesystem, network, ports),
+   and treat prompt rules and command guards as tripwires, not boundaries.
+3. **Fail closed.** When a reduced view or a scope cannot be built, answer an error, never the
+   wider view; a new matching rule fires only when every neighbouring input is on its allow-list.
+4. **Run the private-name gate chained before every public push** (`<gate> && git push`), not only
+   before merge: a `;` once let a private path reach a public branch.
+5. **Freeze every input at acceptance**, nested references included: copy it by hash and work on
+   the copy, so a file swapped between acceptance and use is never read.
+6. **Treat what a run wrote as untrusted** before the service copies, reads or renders it: a
+   regular file whose real path is inside the run's own tree.
+7. **An artefact missing a secret refuses to start**, never runs unauthenticated: validation rejects
+   placeholder-shaped values, and a test renders the configuration without the value and expects
+   an error.
+8. **Widen an access configuration first, code second**, so nothing is over-scoped even briefly.
+
+9. **Bound every recursive parse of untrusted input** (a depth limit, tested at the limit and one
+   above). Revoke or retire by a content-addressed reference, never a reusable name: a re-keyed
+   machine keeps its key id. Never refresh a person's own credentials as a side effect; renew only
+   what you own.
+
+## Checklist
+
+Before the first release, answer each with a file and a test: where a limit pauses and resumes;
+what `accept` each model call has; which vendors its fallback and checker use; where the attempt
+ledger and idempotency keys live; what happens to an unknown outcome; which waits are durable;
+who owns the run lock; what the next start sweeps; how a cancel reaches paid inner work; which
+outputs are capped; how a secret reaches a child; which test was seen failing for each fix.

package/plugins/fabric-agent-adapter/skills/working-with-fabric/SKILL.md

@@ -19,7 +19,7 @@ compatibility: >-
   this plugin; Codex/Kimi use command hooks; Hermes/OpenCode/OpenClaw/Pi use native context plugins after opt-in.
 metadata:
   author: PassionCode.ai
-  version: "0.35.0"
+  version: "0.35.2"
 ---
 
 # Working with Fabric

package/plugins/fabric-agent-adapter/skills/working-with-fabric/references/session-hooks.md

@@ -43,7 +43,9 @@ would add — never a value already in the file — and the `--apply --expect-sh
 backs the file up (`<file>.<UTC stamp>.bak`, never overwriting an earlier backup), keeps the file's mode, refuses a
 file whose shape is not `{"hooks": {"<Event>": [{"hooks": [...]}]}}` (Codex) or an array of `[[hooks]]` tables
 (Kimi Code, read back with `tomllib`: Python 3.11+), and refuses one that changed since the dry run. `--remove` takes
-the entry out again. Codex may ask the person to trust a new hook (`/hooks`) before it runs. The hook runs the
+the entry out again. Codex may ask the person to trust a new hook (`/hooks`) before it runs. Codex keys that trust by event, group and index, so
+`--remove` names the SessionStart groups after the removed one that it moves, which Codex asks the person to approve
+again. The hook runs the
 `fabric_session.py` of the skills install (`~/.agents/skills/working-with-fabric/`) when there is one, else this
 script's own path; a plugin cache path changes with each update, so pass `--script <a stable path>` there.
 
@@ -93,7 +95,9 @@ only variable names are looked at, never a value (two of them carry the session'
 One line per event that did something, never content: `~/Library/Caches/ai.passioncode.fabric-agent-adapter/hooks.log`
 (macOS), `$XDG_CACHE_HOME/fabric-agent-adapter/hooks.log` (Linux, default `~/.cache`),
 `%LOCALAPPDATA%\fabric-agent-adapter\hooks.log` (Windows). Mode 0600, rotated at 1 MB to `hooks.log.1`. The
-per-session spool is `sessions/<session id>/` beside it (turn entries capped at 50, `board.json`, `board.shown`),
+per-session spool is `sessions/<session id>/` beside it (turn entries capped at 50, `board.json`, `board.shown`; a
+folder untouched for 7 days, whose worker failed or whose session ended without SessionEnd, is removed by the next
+spooling hook),
 removed at the session's end.
 
 Turn them off with Claude Code's own switch (`/hooks`, or `"disableAllHooks": true` in settings), or remove the

package/plugins/fabric-agent-adapter/skills/working-with-fabric/scripts/fabric_session.py

@@ -53,6 +53,9 @@ PS_TIMEOUT_S = 0.5
 LOG_CAP_BYTES = 1_000_000
 SPOOL_CAP = 50
 LOCK_STALE_S = 30.0
+#: A session folder untouched this long belongs to a session that will not spool again: its worker failed, or the
+#: session ended without SessionEnd. Nothing retries it, so the next spooling hook removes it (FAA-50).
+SESSION_STALE_S = 7 * 86400
 READ_CAP = 64 * 1024
 CONFIG_CAP = 32 * 1024 * 1024
 WATCH_MIN_INTERVAL_S = 10
@@ -60,7 +63,7 @@ WATCH_MAX_BACKOFF_S = 900
 SESSION_ID = re.compile(r"[A-Za-z0-9._:-]{1,128}")
 LOOPBACK_ORIGIN = re.compile(r"http://127\.0\.0\.1:(\d{1,5})")
 LOCAL_ORIGIN = re.compile(r'"origin": "http://(?:127\.0\.0\.1|localhost)')
-VERSION = "0.35.0"
+VERSION = "0.35.2"
 HOSTS = {"claude": "Claude Code", "codex": "Codex", "kimi": "Kimi Code",
          "hermes": "Hermes", "opencode": "OpenCode", "openclaw": "OpenClaw", "pi": "Pi"}
 NATIVE_PLUGIN_HOSTS = frozenset(("hermes", "opencode", "openclaw", "pi"))
@@ -413,6 +416,30 @@ def spool(directory: Path, entry: Dict[str, Any]) -> Path:
     return path
 
 
+def prune_stale_sessions(env: Optional[Dict[str, str]] = None, now: Optional[float] = None,
+                         keep: Optional[str] = None) -> int:
+    """Remove session folders whose newest file is older than SESSION_STALE_S (a running worker's lock is a fresh file,
+    so its folder is never stale); never the folder of the session `keep`. Returns how many were removed. Never
+    raises."""
+    now = time.time() if now is None else now
+    removed = 0
+    try:
+        folders = list((state_root(env=env) / "sessions").iterdir())
+    except OSError:
+        return 0
+    for folder in folders:
+        try:
+            if folder.name == keep or not SESSION_ID.fullmatch(folder.name) or not folder.is_dir():
+                continue
+            newest = max([folder.stat().st_mtime] + [f.stat().st_mtime for f in folder.iterdir()])
+            if now - newest > SESSION_STALE_S:
+                _remove_tree(folder)
+                removed += 1
+        except OSError:
+            continue
+    return removed
+
+
 def lock_held(directory: Path) -> bool:
     lock = directory / "worker.lock"
     try:
@@ -528,6 +555,7 @@ def hook_spool(payload: Dict[str, Any], event: str, env: Optional[Dict[str, str]
         return "skipped: launched by Fabric"
     entry = {"event": event, "runtimeSessionId": session_id, "cwd": str(cwd),
              "observedAt": time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime())}
+    prune_stale_sessions(env, keep=session_id)
     if event == "end" and isinstance(payload.get("reason"), str):
         entry["reason"] = payload["reason"][:64]
     spool(directory, entry)
@@ -1105,6 +1133,7 @@ def install_host_hooks_cli(argv: Sequence[str], env: Optional[Dict[str, str]] =
     else:
         path = _home(env) / ".kimi-code" / "config.toml"
     command = hook_command(str(args.script or default_hook_script(env)), args.host)
+    shifted = 0  # Codex hook groups after ours, whose position a removal moves
     try:
         data = _read_bytes(path)
         digest = _digest(data)
@@ -1118,11 +1147,15 @@ def install_host_hooks_cli(argv: Sequence[str], env: Optional[Dict[str, str]] =
                 if not present:
                     out("install-host-hooks: no Fabric preamble hook in %s; nothing to change" % path)
                     return 0
-                groups = []
-                for group in doc["hooks"]["SessionStart"]:
+                groups, dropped = [], None
+                for index, group in enumerate(doc["hooks"]["SessionStart"]):
                     kept = [h for h in group.get("hooks", []) if not _is_ours(h.get("command"), args.host)]
                     if kept or not group.get("hooks"):
                         groups.append(dict(group, hooks=kept) if kept != group.get("hooks") else group)
+                    elif dropped is None:
+                        dropped = index  # a group that held only our hook goes; the groups after it move up
+                if dropped is not None:
+                    shifted = len(doc["hooks"]["SessionStart"]) - dropped - 1
                 if groups:
                     doc["hooks"]["SessionStart"] = groups
                 else:
@@ -1187,6 +1220,11 @@ def install_host_hooks_cli(argv: Sequence[str], env: Optional[Dict[str, str]] =
                                               else "added the Fabric preamble hook to", path,
                                               "(backup: %s)" % backup if backup else "(new file)"))
         out("Undo: fabric_session.py install-host-hooks --host %s %s" % (args.host, "--apply" if args.remove else "--remove"))
+        if shifted:
+            # Codex keys a hook's trust by its event, group and index: the groups after ours moved up one, so Codex asks
+            # the person to trust them again in /hooks before they run.
+            out("Codex trusts a hook by its position: %d SessionStart hook group(s) after the removed one moved, and "
+                "Codex will ask you to approve them again in /hooks." % shifted)
         return 0
     except Refused as exc:
         err("install-host-hooks: refused — %s" % exc)

package/plugins/fabric-agent-adapter/skills/working-with-fabric/scripts/hosts/hermes/__init__.py

@@ -53,8 +53,11 @@ def _capture(command, payload):
     reader = threading.Thread(target=read_output, daemon=True)
     reader.start()
     try:
-        process.stdin.write(payload)
-        process.stdin.close()
+        try:
+            process.stdin.write(payload)
+            process.stdin.close()
+        except BrokenPipeError:
+            pass  # FAA-51: a helper may exit without reading its input; its output still counts
         process.wait(timeout=max(0.001, deadline - time.monotonic()))
         reader.join(timeout=max(0, deadline - time.monotonic()))
         if reader.is_alive() or invalid.is_set() or process.returncode != 0:
@@ -69,7 +72,10 @@ def _capture(command, payload):
         reader.join(timeout=0.2)
         if not reader.is_alive():
             process.stdout.close()
-        process.stdin.close()
+        try:
+            process.stdin.close()
+        except BrokenPipeError:
+            pass
 
 
 def fabric_registered(config=None):