failproofai 0.0.13-beta.0 → 0.0.13-beta.2

package/.next/standalone/lib/hermes-sessions.ts

@@ -0,0 +1,273 @@
+/**
+ * Hermes (hermes-agent) session transcript loader + parser.
+ *
+ * AUDIT-ONLY (Pillar 2). Hermes stores every gateway user's sessions in one
+ * SQLite DB (`~/.hermes/state.db`). We read it DIRECTLY via the bundled sql.js
+ * driver (lib/sqlite-reader.ts) — a reusable path for SQLite-backed agents.
+ * (opencode and the already-shipped CLIs keep their CLI shell-out unchanged.)
+ *
+ * Message shape is OpenAI Chat-Completions style (verified live): assistant tool
+ * calls are `tool_calls[].function.{name, arguments}` (stored as a JSON string
+ * column) and results are separate `role:"tool"` rows keyed by `tool_call_id`.
+ * `hermesRowsToLogEntries` pairs them (mirrors `lib/codex-sessions.ts`) and is a
+ * PURE function of the message rows, so it is unit-testable without a DB.
+ *
+ * DB path override: set `HERMES_DB_PATH` (used by tests and to point at a copied
+ * or remote state.db).
+ */
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { openSqliteReadonly } from "./sqlite-reader";
+import { runtimeCache } from "./runtime-cache";
+import {
+  baseEntry,
+  formatTimestamp,
+  type LogEntry,
+  type UserEntry,
+  type AssistantEntry,
+  type GenericEntry,
+  type ContentBlock,
+  type ToolUseBlock,
+  type LogSource,
+} from "./log-entries";
+import { formatDuration } from "./format-duration";
+
+/** Absolute path to Hermes's SQLite DB (override with HERMES_DB_PATH). */
+export function hermesDbPath(): string {
+  return process.env.HERMES_DB_PATH || join(homedir(), ".hermes", "state.db");
+}
+
+/** Coerce a Hermes epoch value (seconds or ms) to epoch ms. Hermes stores
+ *  `started_at`/`ended_at`/`timestamp` as REAL epoch seconds. */
+export function epochToMs(value: unknown): number {
+  if (typeof value === "number" && Number.isFinite(value)) {
+    if (value > 1e12) return value; // already ms
+    if (value > 1e9) return value * 1000; // seconds
+  }
+  return Date.now();
+}
+
+// ── Parsing helpers ──
+
+function safeJsonParse(s: unknown): unknown {
+  if (typeof s !== "string" || s.length === 0) return undefined;
+  try {
+    return JSON.parse(s);
+  } catch {
+    return undefined;
+  }
+}
+
+function isPlainObject(v: unknown): v is Record<string, unknown> {
+  return !!v && typeof v === "object" && !Array.isArray(v);
+}
+
+/** Text from a `content` field that may be a string or an array of
+ *  `{ type:"text", text }` blocks. */
+function extractText(content: unknown): string {
+  if (typeof content === "string") return content;
+  if (Array.isArray(content)) {
+    return content
+      .map((c) => (isPlainObject(c) && typeof c.text === "string" ? (c.text as string) : ""))
+      .filter(Boolean)
+      .join("\n");
+  }
+  return "";
+}
+
+function toDate(value: unknown, fallbackMs: number): Date {
+  if (typeof value === "number" && Number.isFinite(value)) {
+    if (value > 1e12) return new Date(value);
+    if (value > 1e9) return new Date(value * 1000);
+  }
+  if (typeof value === "string") {
+    const ms = Date.parse(value);
+    if (!Number.isNaN(ms)) return new Date(ms);
+  }
+  return new Date(fallbackMs);
+}
+
+interface NormalizedToolCall {
+  id: string;
+  name: string;
+  input: Record<string, unknown>;
+}
+
+/** Normalize `tool_calls` (array, or the JSON-string column Hermes stores) into
+ *  `{ id, name, input }[]`. OpenAI shape: `{ id|call_id, function:{ name,
+ *  arguments } }` where `arguments` is itself a JSON string. */
+function normalizeToolCalls(raw: unknown): NormalizedToolCall[] {
+  const arr = Array.isArray(raw) ? raw : safeJsonParse(raw);
+  if (!Array.isArray(arr)) return [];
+  const out: NormalizedToolCall[] = [];
+  for (const tc of arr) {
+    if (!isPlainObject(tc)) continue;
+    const fn = isPlainObject(tc.function) ? tc.function : {};
+    const name =
+      typeof fn.name === "string"
+        ? fn.name
+        : typeof tc.name === "string"
+          ? (tc.name as string)
+          : "tool";
+    const id =
+      (typeof tc.id === "string" && tc.id) ||
+      (typeof tc.call_id === "string" && tc.call_id) ||
+      `${name}-${out.length}`;
+    const parsedArgs = isPlainObject(fn.arguments) ? fn.arguments : safeJsonParse(fn.arguments);
+    out.push({ id, name, input: isPlainObject(parsedArgs) ? parsedArgs : {} });
+  }
+  return out;
+}
+
+// ── Pure parser: message rows → LogEntry[] ──
+
+/**
+ * Convert `messages`-table rows (ordered by timestamp) into `LogEntry[]`.
+ * Pairs each assistant `tool_calls` entry with its later `role:"tool"` result
+ * by `tool_call_id`. Roles other than user/assistant/tool (e.g. Hermes's
+ * `session_meta`) become generic system entries so nothing is dropped. Pure —
+ * unit-testable with plain row objects.
+ */
+export function hermesRowsToLogEntries(
+  rows: Record<string, unknown>[],
+  source: LogSource = "session",
+): LogEntry[] {
+  const entries: LogEntry[] = [];
+  const toolUseById = new Map<string, ToolUseBlock>();
+  const toolUseStartMs = new Map<string, number>();
+  const baseMs = Date.now();
+
+  for (let i = 0; i < rows.length; i++) {
+    const m = rows[i];
+    if (!isPlainObject(m)) continue;
+
+    const role = typeof m.role === "string" ? m.role : "system";
+    const date = toDate(m.timestamp ?? m.time_created, baseMs + i);
+    const timestamp = date.toISOString();
+    const raw: Record<string, unknown> = {
+      uuid: m.id != null ? String(m.id) : `hermes-${i}`,
+      parentUuid: null,
+    };
+    const base = baseEntry(raw, timestamp, date, source);
+
+    if (role === "user") {
+      entries.push({
+        type: "user",
+        ...base,
+        message: { role: "user", content: extractText(m.content) },
+      } satisfies UserEntry);
+      continue;
+    }
+
+    if (role === "assistant") {
+      const blocks: ContentBlock[] = [];
+      const text = extractText(m.content);
+      if (text) blocks.push({ type: "text", text });
+      for (const tc of normalizeToolCalls(m.tool_calls)) {
+        const block: ToolUseBlock = { type: "tool_use", id: tc.id, name: tc.name, input: tc.input };
+        blocks.push(block);
+        toolUseById.set(tc.id, block);
+        toolUseStartMs.set(tc.id, date.getTime());
+      }
+      if (blocks.length === 0) continue; // empty assistant turn
+      entries.push({
+        type: "assistant",
+        ...base,
+        message: { role: "assistant", content: blocks },
+      } satisfies AssistantEntry);
+      continue;
+    }
+
+    if (role === "tool") {
+      const callId = typeof m.tool_call_id === "string" ? m.tool_call_id : undefined;
+      const block = callId ? toolUseById.get(callId) : undefined;
+      if (block) {
+        const startMs = (callId && toolUseStartMs.get(callId)) || date.getTime();
+        const durationMs = Math.max(0, date.getTime() - startMs);
+        block.result = {
+          timestamp,
+          timestampFormatted: formatTimestamp(date),
+          content: extractText(m.content),
+          durationMs,
+          durationFormatted: formatDuration(durationMs),
+        };
+        continue;
+      }
+      // Orphan tool result — fall through to a system entry.
+    }
+
+    entries.push({ type: "system", ...base, raw } satisfies GenericEntry);
+  }
+
+  entries.sort((a, b) => a.timestampMs - b.timestampMs);
+  return entries;
+}
+
+// ── DB loader ──
+
+export interface HermesSessionLogData {
+  entries: LogEntry[];
+  rawLines: Record<string, unknown>[];
+  cwd?: string;
+  filePath: string; // synthetic — hermes keeps sessions in a DB; we use hermes://<id>
+}
+
+interface HermesMessageRow {
+  id: number | null;
+  role: string | null;
+  content: string | null;
+  tool_call_id: string | null;
+  tool_calls: string | null;
+  tool_name: string | null;
+  timestamp: number | null;
+}
+
+/**
+ * Load one session by ID from `state.db`. Returns `null` when the DB is
+ * unavailable or the session doesn't exist.
+ */
+export async function getHermesSessionLog(
+  sessionId: string,
+): Promise<HermesSessionLogData | null> {
+  if (!sessionId || !/^[A-Za-z0-9_-]+$/.test(sessionId)) return null;
+  const db = await openSqliteReadonly(hermesDbPath());
+  if (!db) return null;
+  try {
+    const sessionRows = db.query<{ source: string | null; cwd: string | null }>(
+      "SELECT source, cwd FROM sessions WHERE id = ?",
+      [sessionId],
+    );
+    if (sessionRows.length === 0) return null;
+    const { source, cwd: realCwd } = sessionRows[0];
+
+    const msgRows = db.query<HermesMessageRow>(
+      "SELECT id, role, content, tool_call_id, tool_calls, tool_name, timestamp " +
+        "FROM messages WHERE session_id = ? ORDER BY timestamp ASC",
+      [sessionId],
+    );
+
+    const entries = hermesRowsToLogEntries(
+      msgRows as unknown as Record<string, unknown>[],
+      "session",
+    );
+    // Gateway sessions have no cwd → group by source (slack/telegram/cli/cron).
+    const cwd =
+      realCwd && realCwd.length > 0 ? realCwd : source ? `hermes:${source}` : undefined;
+    return {
+      entries,
+      rawLines: msgRows as unknown as Record<string, unknown>[],
+      cwd,
+      filePath: `hermes://${sessionId}`,
+    };
+  } catch {
+    return null;
+  } finally {
+    db.close();
+  }
+}
+
+export const getCachedHermesSessionLog = runtimeCache(
+  (sessionId: string) => getHermesSessionLog(sessionId),
+  2,
+  { maxSize: 50 },
+);

package/.next/standalone/lib/projects.ts

@@ -16,7 +16,7 @@ import { formatDate } from "./format-date";
 export const UUID_RE = /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/;
 export const PATH_TRAVERSAL_RE = /(^|[\\/])\.\.($|[\\/])/;
 
-export type ProjectCli = "claude" | "codex" | "copilot" | "cursor" | "opencode" | "pi" | "gemini";
+export type ProjectCli = "claude" | "codex" | "copilot" | "cursor" | "opencode" | "pi" | "gemini" | "hermes";
 
 export interface ProjectFolder {
   name: string;
@@ -40,6 +40,11 @@ export interface SessionFile {
   /** Originating agent CLI. Set when the session list mixes sources from more
    *  than one CLI, so the table can render a per-row CLI badge. */
   cli?: ProjectCli;
+  /** Gateway session metadata (Hermes only today): who drove it and where.
+   *  Other CLIs leave these undefined; the list renders them only when present. */
+  userId?: string;
+  channelId?: string;
+  channelType?: string; // e.g. "group" | "dm"
 }
 
 /** Stats a path and returns mtime. Falls back to epoch (1970-01-01) on error
@@ -139,6 +144,7 @@ export async function getProjectFolders(): Promise<ProjectFolder[]> {
     { getOpenCodeProjects },
     { getPiProjects },
     { getGeminiProjects },
+    { getHermesProjects },
   ] = await Promise.all([
     import("./codex-projects"),
     import("./copilot-projects"),
@@ -146,8 +152,9 @@ export async function getProjectFolders(): Promise<ProjectFolder[]> {
     import("./opencode-projects"),
     import("./pi-projects"),
     import("./gemini-projects"),
+    import("./hermes-projects"),
   ]);
-  const [claude, codex, copilot, cursor, opencode, pi, gemini] = await Promise.all([
+  const [claude, codex, copilot, cursor, opencode, pi, gemini, hermes] = await Promise.all([
     getClaudeProjectFolders(),
     getCodexProjects().catch((error) => {
       logError("Error reading Codex projects:", error);
@@ -173,8 +180,12 @@ export async function getProjectFolders(): Promise<ProjectFolder[]> {
       logError("Error reading Gemini projects:", error);
       return [] as ProjectFolder[];
     }),
+    getHermesProjects().catch((error) => {
+      logError("Error reading Hermes projects:", error);
+      return [] as ProjectFolder[];
+    }),
   ]);
-  return mergeProjectFolders(claude, codex, copilot, cursor, opencode, pi, gemini);
+  return mergeProjectFolders(claude, codex, copilot, cursor, opencode, pi, gemini, hermes);
 }
 
 /**

package/.next/standalone/lib/sqlite-reader.ts

@@ -0,0 +1,102 @@
+/**
+ * Reusable read-only SQLite access for audit adapters of SQLite-backed agents.
+ *
+ * Tiered so we read LIVE data (including the write-ahead log) wherever possible,
+ * and still run anywhere:
+ *   1. `node:sqlite` — a real connection that reads main DB + WAL together, so
+ *      brand-new rows are visible immediately. Built into Node ≥ 22.5 (no native
+ *      module, no flag on recent 22.x). Preferred.
+ *   2. `sql.js` (pure-JS/asm) — portable fallback for older Node. Reads the main
+ *      DB file's bytes only, so it reflects a snapshot up to the last WAL
+ *      checkpoint (very recent rows may lag). No native module — survives
+ *      `npm install --ignore-scripts`.
+ *
+ * Either way: read-only, and `null` on any failure (fail-open, so an absent or
+ * locked DB makes the audit skip that agent rather than crash).
+ *
+ * NOTE: opencode and every CLI that already ships keep their existing CLI
+ * shell-out — this layer is only for new SQLite integrations.
+ */
+import { existsSync, readFileSync } from "node:fs";
+import initSqlJs, { type SqlJsStatic } from "sql.js/dist/sql-asm.js";
+
+export interface SqliteReader {
+  /** Run a parameterized read-only query; returns rows as plain objects. */
+  query<T = Record<string, unknown>>(sql: string, params?: unknown[]): T[];
+  close(): void;
+}
+
+// ── Tier 1: node:sqlite (WAL-aware, Node ≥ 22.5) ──
+
+interface NodeSqliteStmt {
+  all(...params: unknown[]): Record<string, unknown>[];
+}
+interface NodeSqliteDb {
+  prepare(sql: string): NodeSqliteStmt;
+  close(): void;
+}
+interface NodeSqliteModule {
+  DatabaseSync: new (path: string, options?: { readOnly?: boolean }) => NodeSqliteDb;
+}
+
+async function tryNodeSqlite(dbPath: string): Promise<SqliteReader | null> {
+  try {
+    // Dynamic import: on Node < 22.5 this rejects and we fall through to sql.js.
+    const mod = (await import("node:sqlite")) as unknown as NodeSqliteModule;
+    const db = new mod.DatabaseSync(dbPath, { readOnly: true });
+    return {
+      query<T = Record<string, unknown>>(sql: string, params: unknown[] = []): T[] {
+        const stmt = db.prepare(sql);
+        return (params.length ? stmt.all(...params) : stmt.all()) as T[];
+      },
+      close() {
+        db.close();
+      },
+    };
+  } catch {
+    return null;
+  }
+}
+
+// ── Tier 2: sql.js (portable snapshot) ──
+
+let sqlPromise: Promise<SqlJsStatic> | null = null;
+function loadSqlJs(): Promise<SqlJsStatic> {
+  if (!sqlPromise) sqlPromise = initSqlJs();
+  return sqlPromise;
+}
+
+async function trySqlJs(dbPath: string): Promise<SqliteReader | null> {
+  try {
+    const SQL = await loadSqlJs();
+    const db = new SQL.Database(readFileSync(dbPath));
+    return {
+      query<T = Record<string, unknown>>(sql: string, params?: unknown[]): T[] {
+        const stmt = db.prepare(sql);
+        try {
+          if (params && params.length) stmt.bind(params);
+          const rows: T[] = [];
+          while (stmt.step()) rows.push(stmt.getAsObject() as T);
+          return rows;
+        } finally {
+          stmt.free();
+        }
+      },
+      close() {
+        db.close();
+      },
+    };
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Open a SQLite database file READ-ONLY. Prefers a WAL-aware `node:sqlite`
+ * connection (live data), falls back to a `sql.js` snapshot. Returns `null` on
+ * any failure. Always `close()` the reader when done.
+ */
+export async function openSqliteReadonly(dbPath: string): Promise<SqliteReader | null> {
+  if (!existsSync(dbPath)) return null;
+  return (await tryNodeSqlite(dbPath)) ?? (await trySqlJs(dbPath));
+}

package/.next/standalone/package.json

@@ -1,6 +1,6 @@
 {
   "name": "failproofai",
-  "version": "0.0.13-beta.0",
+  "version": "0.0.13-beta.2",
   "description": "The easiest way to manage policies that keep your AI agents reliable, on-task, and running autonomously — for Claude Code & the Agents SDK",
   "bin": {
     "failproofai": "./dist/cli.mjs"
@@ -22,7 +22,7 @@
   "scripts": {
     "predev": "bun run build:cli && bun link",
     "dev": "FAILPROOFAI_TELEMETRY_DISABLED=1 bun scripts/dev.ts --port 8020",
-    "build:cli": "bun build --target=node --format=esm --outfile=dist/cli.mjs bin/failproofai.mjs --external posthog-node && node -e \"const fs=require('fs');const c=fs.readFileSync('dist/cli.mjs','utf8');fs.writeFileSync('dist/cli.mjs',c.replace('#!/usr/bin/env bun','#!/usr/bin/env node').replace('// @bun\\n',''))\"",
+    "build:cli": "bun build --target=node --format=esm --outfile=dist/cli.mjs bin/failproofai.mjs --external posthog-node --external sql.js && node -e \"const fs=require('fs');const c=fs.readFileSync('dist/cli.mjs','utf8');fs.writeFileSync('dist/cli.mjs',c.replace('#!/usr/bin/env bun','#!/usr/bin/env node').replace('// @bun\\n',''))\"",
     "build": "bun build --target=node --format=cjs --outfile=dist/index.js src/index.ts && bun run build:cli && bun --bun next build && node -e \"const {cpSync}=require('fs');cpSync('.next/static','.next/standalone/.next/static',{recursive:true});\" && node scripts/prune-standalone.mjs",
     "prestart": "bun run build:cli && bun link",
     "start": "FAILPROOFAI_TELEMETRY_DISABLED=1 bun scripts/start.ts",
@@ -99,7 +99,9 @@
   "dependencies": {
     "html-to-image": "^1.11.13",
     "html2canvas": "^1.4.1",
-    "posthog-node": "^5.37.1"
+    "posthog-node": "^5.37.1",
+    "sql.js": "^1.14.1",
+    "yaml": "^2.9.0"
   },
   "overrides": {
     "postcss": "8.5.14",

package/.next/standalone/server.js

@@ -9,7 +9,7 @@ const currentPort = parseInt(process.env.PORT, 10) || 3000
 const hostname = process.env.HOSTNAME || '0.0.0.0'
 
 let keepAliveTimeout = parseInt(process.env.KEEP_ALIVE_TIMEOUT, 10)
-const nextConfig = {"env":{"NEXT_PUBLIC_APP_VERSION":"0.0.13-beta.0"},"typescript":{"ignoreBuildErrors":false},"typedRoutes":false,"distDir":"./.next","cleanDistDir":true,"assetPrefix":"","cacheMaxMemorySize":52428800,"configOrigin":"next.config.ts","useFileSystemPublicRoutes":true,"generateEtags":true,"pageExtensions":["tsx","ts","jsx","js"],"poweredByHeader":true,"compress":true,"images":{"deviceSizes":[640,750,828,1080,1200,1920,2048,3840],"imageSizes":[32,48,64,96,128,256,384],"path":"/_next/image","loader":"default","loaderFile":"","domains":[],"disableStaticImages":false,"minimumCacheTTL":14400,"formats":["image/webp"],"maximumRedirects":3,"maximumResponseBody":50000000,"dangerouslyAllowLocalIP":false,"dangerouslyAllowSVG":false,"contentSecurityPolicy":"script-src 'none'; frame-src 'none'; sandbox;","contentDispositionType":"attachment","localPatterns":[{"pathname":"**","search":""}],"remotePatterns":[],"qualities":[75],"unoptimized":true,"customCacheHandler":false},"devIndicators":{"position":"bottom-left"},"onDemandEntries":{"maxInactiveAge":60000,"pagesBufferLength":5},"basePath":"","sassOptions":{},"trailingSlash":false,"i18n":null,"productionBrowserSourceMaps":false,"excludeDefaultMomentLocales":true,"reactProductionProfiling":false,"reactStrictMode":null,"reactMaxHeadersLength":6000,"httpAgentOptions":{"keepAlive":true},"logging":{"serverFunctions":true,"browserToTerminal":"warn"},"compiler":{},"expireTime":31536000,"staticPageGenerationTimeout":60,"output":"standalone","modularizeImports":{"@mui/icons-material":{"transform":"@mui/icons-material/{{member}}"},"lodash":{"transform":"lodash/{{member}}"}},"outputFileTracingRoot":"/home/runner/work/failproofai/failproofai","cacheComponents":false,"cacheLife":{"default":{"stale":300,"revalidate":900,"expire":4294967294},"seconds":{"stale":30,"revalidate":1,"expire":60},"minutes":{"stale":300,"revalidate":60,"expire":3600},"hours":{"stale":300,"revalidate":3600,"expire":86400},"days":{"stale":300,"revalidate":86400,"expire":604800},"weeks":{"stale":300,"revalidate":604800,"expire":2592000},"max":{"stale":300,"revalidate":2592000,"expire":31536000}},"cacheHandlers":{},"experimental":{"appNewScrollHandler":false,"useSkewCookie":false,"cssChunking":true,"multiZoneDraftMode":false,"appNavFailHandling":false,"prerenderEarlyExit":true,"serverMinification":true,"linkNoTouchStart":false,"caseSensitiveRoutes":false,"cachedNavigations":false,"partialFallbacks":false,"dynamicOnHover":false,"varyParams":false,"prefetchInlining":false,"preloadEntriesOnStart":true,"clientRouterFilter":true,"clientRouterFilterRedirects":false,"fetchCacheKeyPrefix":"","proxyPrefetch":"flexible","optimisticClientCache":true,"manualClientBasePath":false,"cpus":3,"memoryBasedWorkersCount":false,"imgOptConcurrency":null,"imgOptTimeoutInSeconds":7,"imgOptMaxInputPixels":268402689,"imgOptSequentialRead":null,"imgOptSkipMetadata":null,"isrFlushToDisk":true,"workerThreads":false,"optimizeCss":false,"nextScriptWorkers":false,"scrollRestoration":false,"externalDir":false,"disableOptimizedLoading":false,"gzipSize":true,"craCompat":false,"esmExternals":true,"fullySpecified":false,"swcTraceProfiling":false,"forceSwcTransforms":false,"largePageDataBytes":128000,"typedEnv":false,"parallelServerCompiles":false,"parallelServerBuildTraces":false,"ppr":false,"authInterrupts":false,"webpackMemoryOptimizations":false,"optimizeServerReact":true,"strictRouteTypes":false,"viewTransition":false,"removeUncaughtErrorAndRejectionListeners":false,"validateRSCRequestHeaders":false,"staleTimes":{"dynamic":0,"static":300},"reactDebugChannel":true,"serverComponentsHmrCache":true,"staticGenerationMaxConcurrency":8,"staticGenerationMinPagesPerWorker":25,"transitionIndicator":false,"gestureTransition":false,"inlineCss":false,"useCache":false,"globalNotFound":false,"browserDebugInfoInTerminal":"warn","lockDistDir":true,"proxyClientMaxBodySize":10485760,"hideLogsAfterAbort":false,"mcpServer":true,"turbopackFileSystemCacheForDev":true,"turbopackFileSystemCacheForBuild":false,"turbopackInferModuleSideEffects":true,"turbopackPluginRuntimeStrategy":"childProcesses","optimizePackageImports":["lucide-react","date-fns","lodash-es","ramda","antd","react-bootstrap","ahooks","@ant-design/icons","@headlessui/react","@headlessui-float/react","@heroicons/react/20/solid","@heroicons/react/24/solid","@heroicons/react/24/outline","@visx/visx","@tremor/react","rxjs","@mui/material","@mui/icons-material","recharts","react-use","effect","@effect/schema","@effect/platform","@effect/platform-node","@effect/platform-browser","@effect/platform-bun","@effect/sql","@effect/sql-mssql","@effect/sql-mysql2","@effect/sql-pg","@effect/sql-sqlite-node","@effect/sql-sqlite-bun","@effect/sql-sqlite-wasm","@effect/sql-sqlite-react-native","@effect/rpc","@effect/rpc-http","@effect/typeclass","@effect/experimental","@effect/opentelemetry","@material-ui/core","@material-ui/icons","@tabler/icons-react","mui-core","react-icons/ai","react-icons/bi","react-icons/bs","react-icons/cg","react-icons/ci","react-icons/di","react-icons/fa","react-icons/fa6","react-icons/fc","react-icons/fi","react-icons/gi","react-icons/go","react-icons/gr","react-icons/hi","react-icons/hi2","react-icons/im","react-icons/io","react-icons/io5","react-icons/lia","react-icons/lib","react-icons/lu","react-icons/md","react-icons/pi","react-icons/ri","react-icons/rx","react-icons/si","react-icons/sl","react-icons/tb","react-icons/tfi","react-icons/ti","react-icons/vsc","react-icons/wi"],"trustHostHeader":false,"isExperimentalCompile":false},"htmlLimitedBots":"[\\w-]+-Google|Google-[\\w-]+|Chrome-Lighthouse|Slurp|DuckDuckBot|baiduspider|yandex|sogou|bitlybot|tumblr|vkShare|quora link preview|redditbot|ia_archiver|Bingbot|BingPreview|applebot|facebookexternalhit|facebookcatalog|Twitterbot|LinkedInBot|Slackbot|Discordbot|WhatsApp|SkypeUriPreview|Yeti|googleweblight","bundlePagesRouterDependencies":false,"configFileName":"next.config.ts","outputFileTracingExcludes":{"*":["node_modules/@img/**","node_modules/sharp/**"]},"turbopack":{"root":"/home/runner/work/failproofai/failproofai"},"distDirRoot":".next"}
+const nextConfig = {"env":{"NEXT_PUBLIC_APP_VERSION":"0.0.13-beta.2"},"typescript":{"ignoreBuildErrors":false},"typedRoutes":false,"distDir":"./.next","cleanDistDir":true,"assetPrefix":"","cacheMaxMemorySize":52428800,"configOrigin":"next.config.ts","useFileSystemPublicRoutes":true,"generateEtags":true,"pageExtensions":["tsx","ts","jsx","js"],"poweredByHeader":true,"compress":true,"images":{"deviceSizes":[640,750,828,1080,1200,1920,2048,3840],"imageSizes":[32,48,64,96,128,256,384],"path":"/_next/image","loader":"default","loaderFile":"","domains":[],"disableStaticImages":false,"minimumCacheTTL":14400,"formats":["image/webp"],"maximumRedirects":3,"maximumResponseBody":50000000,"dangerouslyAllowLocalIP":false,"dangerouslyAllowSVG":false,"contentSecurityPolicy":"script-src 'none'; frame-src 'none'; sandbox;","contentDispositionType":"attachment","localPatterns":[{"pathname":"**","search":""}],"remotePatterns":[],"qualities":[75],"unoptimized":true,"customCacheHandler":false},"devIndicators":{"position":"bottom-left"},"onDemandEntries":{"maxInactiveAge":60000,"pagesBufferLength":5},"basePath":"","sassOptions":{},"trailingSlash":false,"i18n":null,"productionBrowserSourceMaps":false,"excludeDefaultMomentLocales":true,"reactProductionProfiling":false,"reactStrictMode":null,"reactMaxHeadersLength":6000,"httpAgentOptions":{"keepAlive":true},"logging":{"serverFunctions":true,"browserToTerminal":"warn"},"compiler":{},"expireTime":31536000,"staticPageGenerationTimeout":60,"output":"standalone","modularizeImports":{"@mui/icons-material":{"transform":"@mui/icons-material/{{member}}"},"lodash":{"transform":"lodash/{{member}}"}},"outputFileTracingRoot":"/home/runner/work/failproofai/failproofai","cacheComponents":false,"cacheLife":{"default":{"stale":300,"revalidate":900,"expire":4294967294},"seconds":{"stale":30,"revalidate":1,"expire":60},"minutes":{"stale":300,"revalidate":60,"expire":3600},"hours":{"stale":300,"revalidate":3600,"expire":86400},"days":{"stale":300,"revalidate":86400,"expire":604800},"weeks":{"stale":300,"revalidate":604800,"expire":2592000},"max":{"stale":300,"revalidate":2592000,"expire":31536000}},"cacheHandlers":{},"experimental":{"appNewScrollHandler":false,"useSkewCookie":false,"cssChunking":true,"multiZoneDraftMode":false,"appNavFailHandling":false,"prerenderEarlyExit":true,"serverMinification":true,"linkNoTouchStart":false,"caseSensitiveRoutes":false,"cachedNavigations":false,"partialFallbacks":false,"dynamicOnHover":false,"varyParams":false,"prefetchInlining":false,"preloadEntriesOnStart":true,"clientRouterFilter":true,"clientRouterFilterRedirects":false,"fetchCacheKeyPrefix":"","proxyPrefetch":"flexible","optimisticClientCache":true,"manualClientBasePath":false,"cpus":3,"memoryBasedWorkersCount":false,"imgOptConcurrency":null,"imgOptTimeoutInSeconds":7,"imgOptMaxInputPixels":268402689,"imgOptSequentialRead":null,"imgOptSkipMetadata":null,"isrFlushToDisk":true,"workerThreads":false,"optimizeCss":false,"nextScriptWorkers":false,"scrollRestoration":false,"externalDir":false,"disableOptimizedLoading":false,"gzipSize":true,"craCompat":false,"esmExternals":true,"fullySpecified":false,"swcTraceProfiling":false,"forceSwcTransforms":false,"largePageDataBytes":128000,"typedEnv":false,"parallelServerCompiles":false,"parallelServerBuildTraces":false,"ppr":false,"authInterrupts":false,"webpackMemoryOptimizations":false,"optimizeServerReact":true,"strictRouteTypes":false,"viewTransition":false,"removeUncaughtErrorAndRejectionListeners":false,"validateRSCRequestHeaders":false,"staleTimes":{"dynamic":0,"static":300},"reactDebugChannel":true,"serverComponentsHmrCache":true,"staticGenerationMaxConcurrency":8,"staticGenerationMinPagesPerWorker":25,"transitionIndicator":false,"gestureTransition":false,"inlineCss":false,"useCache":false,"globalNotFound":false,"browserDebugInfoInTerminal":"warn","lockDistDir":true,"proxyClientMaxBodySize":10485760,"hideLogsAfterAbort":false,"mcpServer":true,"turbopackFileSystemCacheForDev":true,"turbopackFileSystemCacheForBuild":false,"turbopackInferModuleSideEffects":true,"turbopackPluginRuntimeStrategy":"childProcesses","optimizePackageImports":["lucide-react","date-fns","lodash-es","ramda","antd","react-bootstrap","ahooks","@ant-design/icons","@headlessui/react","@headlessui-float/react","@heroicons/react/20/solid","@heroicons/react/24/solid","@heroicons/react/24/outline","@visx/visx","@tremor/react","rxjs","@mui/material","@mui/icons-material","recharts","react-use","effect","@effect/schema","@effect/platform","@effect/platform-node","@effect/platform-browser","@effect/platform-bun","@effect/sql","@effect/sql-mssql","@effect/sql-mysql2","@effect/sql-pg","@effect/sql-sqlite-node","@effect/sql-sqlite-bun","@effect/sql-sqlite-wasm","@effect/sql-sqlite-react-native","@effect/rpc","@effect/rpc-http","@effect/typeclass","@effect/experimental","@effect/opentelemetry","@material-ui/core","@material-ui/icons","@tabler/icons-react","mui-core","react-icons/ai","react-icons/bi","react-icons/bs","react-icons/cg","react-icons/ci","react-icons/di","react-icons/fa","react-icons/fa6","react-icons/fc","react-icons/fi","react-icons/gi","react-icons/go","react-icons/gr","react-icons/hi","react-icons/hi2","react-icons/im","react-icons/io","react-icons/io5","react-icons/lia","react-icons/lib","react-icons/lu","react-icons/md","react-icons/pi","react-icons/ri","react-icons/rx","react-icons/si","react-icons/sl","react-icons/tb","react-icons/tfi","react-icons/ti","react-icons/vsc","react-icons/wi"],"trustHostHeader":false,"isExperimentalCompile":false},"htmlLimitedBots":"[\\w-]+-Google|Google-[\\w-]+|Chrome-Lighthouse|Slurp|DuckDuckBot|baiduspider|yandex|sogou|bitlybot|tumblr|vkShare|quora link preview|redditbot|ia_archiver|Bingbot|BingPreview|applebot|facebookexternalhit|facebookcatalog|Twitterbot|LinkedInBot|Slackbot|Discordbot|WhatsApp|SkypeUriPreview|Yeti|googleweblight","bundlePagesRouterDependencies":false,"configFileName":"next.config.ts","outputFileTracingExcludes":{"*":["node_modules/@img/**","node_modules/sharp/**"]},"turbopack":{"root":"/home/runner/work/failproofai/failproofai"},"distDirRoot":".next"}
 
 process.env.__NEXT_PRIVATE_STANDALONE_CONFIG = JSON.stringify(nextConfig)
 

package/README.md

@@ -72,9 +72,18 @@ before they become incidents. Zero latency. Runs locally.
       <img src="assets/logos/gemini-light.svg" alt="Gemini CLI" width="64" height="64" />
     </picture>
   </a>
+  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
+  <a href="https://github.com/FailproofAI/failproofai/blob/main/docs/configuration.mdx" title="Hermes (hermes-agent)">
+    <picture>
+      <source media="(prefers-color-scheme: dark)" srcset="assets/logos/hermes-dark.svg" />
+      <img src="assets/logos/hermes-light.svg" alt="Hermes" width="64" height="64" />
+    </picture>
+  </a>
 </p>
 
-> Install hooks for one or any combination: `failproofai policies --install --cli opencode pi gemini` (or `--cli claude codex copilot cursor opencode pi gemini`). Omit `--cli` to auto-detect installed CLIs and prompt.
+> Install hooks for one or any combination: `failproofai policies --install --cli opencode pi gemini` (or `--cli claude codex copilot cursor opencode pi gemini hermes`). Omit `--cli` to auto-detect installed CLIs and prompt.
+>
+> **Hermes** (hermes-agent, a Slack/Telegram gateway) is supported for both **live-hook enforcement** (`--cli hermes` — one install intercepts tool calls from every platform and subagent) and offline **audit** replay of its gateway sessions from the single `~/.hermes/state.db`.
 
 ---
 

package/bin/failproofai.mjs

@@ -65,7 +65,7 @@ const hookIdx = args.indexOf("--hook");
 if (hookIdx >= 0) {
   if (!args[hookIdx + 1]) {
     console.error("Error: Missing event type after --hook");
-    console.error("Usage: failproofai --hook <event> [--cli <claude|codex|copilot|cursor|opencode|pi|gemini>]");
+    console.error("Usage: failproofai --hook <event> [--cli <claude|codex|copilot|cursor|opencode|pi|gemini|hermes>]");
     process.exit(1);
   }
   const eventType = args[hookIdx + 1];
@@ -82,6 +82,7 @@ if (hookIdx >= 0) {
       || cliArg === "opencode"
       || cliArg === "pi"
       || cliArg === "gemini"
+      || cliArg === "hermes"
     )
       ? cliArg
       : "claude";
@@ -129,9 +130,9 @@ COMMANDS
   policies, p                    List all available policies and their status
   policies --install, -i         Enable policies in agent CLI settings
     [names...]                     Specific policy names to enable
-    --cli claude|codex|copilot|cursor|opencode|pi|gemini
+    --cli claude|codex|copilot|cursor|opencode|pi|gemini|hermes
                                    Agent CLI(s) to install for; space-separated
-                                   (e.g. --cli claude codex copilot cursor opencode pi gemini) or repeated.
+                                   (e.g. --cli claude codex copilot cursor opencode pi gemini hermes) or repeated.
                                    Default: detect installed CLIs and prompt.
     --scope user|project|local     Config scope to write to (default: user)
                                    (Codex / Copilot / Cursor / OpenCode / Pi / Gemini support user|project only)
@@ -140,7 +141,7 @@ COMMANDS
 
   policies --uninstall, -u       Disable policies or remove hooks
     [names...]                     Specific policy names to disable
-    --cli claude|codex|copilot|cursor|opencode|pi|gemini
+    --cli claude|codex|copilot|cursor|opencode|pi|gemini|hermes
                                    Agent CLI(s) to uninstall from
     --scope user|project|local|all Config scope to remove from (default: user)
     --beta                         Remove only beta policies
@@ -176,7 +177,7 @@ EXAMPLES
   failproofai policies --install --cli opencode --scope project
   failproofai policies --install --cli pi --scope project
   failproofai policies --install --cli gemini --scope project
-  failproofai policies --install --cli claude codex copilot cursor opencode pi gemini
+  failproofai policies --install --cli claude codex copilot cursor opencode pi gemini hermes
   failproofai policies --install --custom ./my-policies.js
   failproofai policies -i -c ./my-policies.js
   failproofai policies --uninstall block-sudo
@@ -225,9 +226,9 @@ USAGE
 
 OPTIONS (install)
   [names...]                     Specific policy names to enable (omit for interactive)
-  --cli claude|codex|copilot|cursor|opencode|pi|gemini
+  --cli claude|codex|copilot|cursor|opencode|pi|gemini|hermes
                                  Agent CLI(s) to install for; space-separated
-                                 (e.g. --cli claude codex copilot cursor opencode pi gemini) or repeated.
+                                 (e.g. --cli claude codex copilot cursor opencode pi gemini hermes) or repeated.
                                  Omit to detect installed CLIs and prompt (or
                                  auto-pick if only one is found).
   --scope user|project|local     Config scope to write to (default: user)
@@ -238,7 +239,7 @@ OPTIONS (install)
 
 OPTIONS (uninstall)
   [names...]                     Specific policy names to disable (omit to remove hooks)
-  --cli claude|codex|copilot|cursor|opencode|pi|gemini
+  --cli claude|codex|copilot|cursor|opencode|pi|gemini|hermes
                                  Agent CLI(s) to uninstall from
   --scope user|project|local|all Config scope to remove from (default: user)
   --beta                         Remove only beta policies
@@ -254,7 +255,7 @@ EXAMPLES
   failproofai policies --install --cli opencode --scope project
   failproofai policies --install --cli pi --scope project
   failproofai policies --install --cli gemini --scope project
-  failproofai policies --install --cli claude codex copilot cursor opencode pi gemini
+  failproofai policies --install --cli claude codex copilot cursor opencode pi gemini hermes
   failproofai policies --install --custom ./my-policies.js
   failproofai policies -i -c ./my-policies.js
   failproofai policies --uninstall block-sudo
@@ -295,7 +296,7 @@ EXAMPLES
       //   --cli claude codex copilot
       //   --cli claude --cli codex
       // Values are consumed greedily until the next flag or end of argv.
-      const VALID_CLIS = new Set(["claude", "codex", "copilot", "cursor", "opencode", "pi", "gemini"]);
+      const VALID_CLIS = new Set(["claude", "codex", "copilot", "cursor", "opencode", "pi", "gemini", "hermes"]);
       const cliFlagValues = [];
       const cliConsumedIdxs = new Set();
       const cliFlagIdxs = subArgs.map((a, i) => (a === "--cli" ? i : -1)).filter((i) => i >= 0);
@@ -312,7 +313,7 @@ EXAMPLES
           consumed++;
         }
         if (consumed === 0) {
-          throw new CliError("Missing value(s) for --cli. Usage: --cli claude codex copilot cursor opencode pi gemini (or any subset)");
+          throw new CliError("Missing value(s) for --cli. Usage: --cli claude codex copilot cursor opencode pi gemini hermes (or any subset)");
         }
       }
 
@@ -384,7 +385,7 @@ EXAMPLES
       }
 
       // --cli accepts one or more space-separated values; same parser as install.
-      const VALID_CLIS = new Set(["claude", "codex", "copilot", "cursor", "opencode", "pi", "gemini"]);
+      const VALID_CLIS = new Set(["claude", "codex", "copilot", "cursor", "opencode", "pi", "gemini", "hermes"]);
       const cliFlagValues = [];
       const cliConsumedIdxs = new Set();
       const cliFlagIdxs = subArgs.map((a, i) => (a === "--cli" ? i : -1)).filter((i) => i >= 0);
@@ -401,7 +402,7 @@ EXAMPLES
           consumed++;
         }
         if (consumed === 0) {
-          throw new CliError("Missing value(s) for --cli. Usage: --cli claude codex copilot cursor opencode pi gemini (or any subset)");
+          throw new CliError("Missing value(s) for --cli. Usage: --cli claude codex copilot cursor opencode pi gemini hermes (or any subset)");
         }
       }
 
@@ -510,7 +511,7 @@ USAGE
   failproofai policy remove <name>   Disable one policy
 
 OPTIONS
-  --cli claude|codex|copilot|cursor|opencode|pi|gemini
+  --cli claude|codex|copilot|cursor|opencode|pi|gemini|hermes
                                      Agent CLI(s) to apply to; space-separated or repeated.
                                      Omit to detect installed CLIs and prompt.
   --scope user|project|local         Config scope (default: user)
@@ -548,7 +549,7 @@ EXAMPLES
     }
 
     // --cli accepts one or more space-separated values, optionally repeated.
-    const VALID_CLIS = new Set(["claude", "codex", "copilot", "cursor", "opencode", "pi", "gemini"]);
+    const VALID_CLIS = new Set(["claude", "codex", "copilot", "cursor", "opencode", "pi", "gemini", "hermes"]);
     const cliFlagValues = [];
     const cliConsumedIdxs = new Set();
     const cliFlagIdxs = rest.map((a, i) => (a === "--cli" ? i : -1)).filter((i) => i >= 0);
@@ -563,7 +564,7 @@ EXAMPLES
         consumed++;
       }
       if (consumed === 0) {
-        throw new CliError("Missing value(s) for --cli. Usage: --cli claude codex copilot cursor opencode pi gemini (or any subset)");
+        throw new CliError("Missing value(s) for --cli. Usage: --cli claude codex copilot cursor opencode pi gemini hermes (or any subset)");
       }
     }