failproofai 0.0.14-beta.2 → 0.0.15-beta.0

package/lib/entry-keys.ts

@@ -0,0 +1,36 @@
+/**
+ * Stable per-entry identity for the log viewer.
+ *
+ * Deliberately standalone and dependency-free: `lib/log-entries.ts` reaches
+ * fs/promises through its project-resolution imports, so a *value* import of
+ * it from a client component drags node:fs into the browser bundle and the
+ * session page 500s. Client code may only import types from there.
+ */
+import type { LogEntry } from "./log-entries";
+
+/**
+ * Assigns every entry a unique, render-stable identity.
+ *
+ * Not every CLI writes a per-record `uuid` — Codex, Copilot, Cursor and Pi
+ * transcripts have none, so `baseEntry` leaves it "". Keying rows off
+ * `uuid || timestamp` therefore collapses to the timestamp, which those CLIs
+ * reuse freely (one 771-record Codex session: 93 timestamps shared by 2-5
+ * records each). Duplicate React keys break reconciliation, and in the
+ * virtualized log list that strands orphaned DOM nodes stacked on top of live
+ * rows — they keep their old transform and never recover (#292 follow-up).
+ *
+ * Collisions are disambiguated by occurrence order, so keys stay stable for as
+ * long as the parsed entry list is — which is what React and the virtualizer's
+ * measurement cache both require.
+ */
+export function buildEntryKeys(entries: LogEntry[]): Map<LogEntry, string> {
+  const keys = new Map<LogEntry, string>();
+  const seen = new Map<string, number>();
+  for (const entry of entries) {
+    const base = entry.uuid || `${entry._source}:${entry.timestamp}`;
+    const n = seen.get(base) ?? 0;
+    seen.set(base, n + 1);
+    keys.set(entry, n === 0 ? base : `${base}#${n}`);
+  }
+  return keys;
+}

package/lib/hermes-profiles.ts

@@ -0,0 +1,156 @@
+/**
+ * Hermes profile discovery — shared by BOTH pillars.
+ *
+ * A Hermes "profile" is not a column or a flag: it is a whole separate Hermes
+ * home directory, each with its own `config.yaml`, `.env`, `SOUL.md`, and
+ * `state.db`. The default profile lives at `~/.hermes`; every other profile at
+ * `~/.hermes/profiles/<name>/`. Selection is `hermes -p <name>`, a generated
+ * `~/.local/bin/<name>` alias that exports `HERMES_HOME`, or a sticky default
+ * recorded in `<root>/active_profile`.
+ *
+ * Upstream's own contributor guide warns that hardcoding `~/.hermes` breaks
+ * profiles — which is exactly what both pillars used to do:
+ *   • audit      → read one state.db, so non-default profiles were INVISIBLE;
+ *   • enforcement→ wrote one config.yaml, so non-default profiles ran UNHOOKED.
+ * Both now enumerate through here.
+ *
+ * Kept deliberately dependency-light (node:fs / node:os / node:path only) so
+ * `src/hooks/integrations.ts` can import it without pulling the sql.js reader
+ * into the hook hot path.
+ *
+ * Home override: set `HERMES_HOME` (Hermes's own env var — respected here so a
+ * profile-scoped shell and failproofai agree on what "all profiles" means).
+ */
+import { readdirSync } from "node:fs";
+import { homedir } from "node:os";
+import { basename, dirname, join, resolve } from "node:path";
+
+/** Directory under the Hermes root that holds non-default profiles. */
+const PROFILES_DIR = "profiles";
+
+/** Name we give the root home (`~/.hermes`), which Hermes itself leaves unnamed. */
+export const HERMES_DEFAULT_PROFILE = "default";
+
+export interface HermesProfile {
+  /** Profile name — `"default"` for the root home, else the directory name. */
+  name: string;
+  /** Absolute HERMES_HOME for this profile (holds config.yaml + state.db). */
+  home: string;
+}
+
+/**
+ * The Hermes ROOT home — the directory that owns `profiles/`.
+ *
+ * `HERMES_HOME` may point AT a profile (`<root>/profiles/<name>`), because
+ * that's what the per-profile alias wrapper exports. We climb back to `<root>`
+ * in that case so discovery still sees every sibling profile — mirroring what
+ * upstream does so `profile list` can see them all.
+ */
+export function hermesRoot(): string {
+  const env = (process.env.HERMES_HOME || "").trim();
+  if (env) {
+    const home = resolve(env);
+    const parent = dirname(home);
+    if (basename(parent) === PROFILES_DIR) return dirname(parent);
+    return home;
+  }
+  return join(homedir(), ".hermes");
+}
+
+/**
+ * Every Hermes profile on disk: the root home first (as `"default"`), then each
+ * `<root>/profiles/<name>/` in name order.
+ *
+ * Fail-open — a missing or unreadable `profiles/` dir just means "default only",
+ * which is the single-profile install everyone starts with.
+ *
+ * A profile directory literally named `default` would collide with the root's
+ * reserved name; the root wins and the directory is skipped (dedup by name keeps
+ * grouping keys unique and the outcome deterministic).
+ */
+export function listHermesProfiles(): HermesProfile[] {
+  const root = hermesRoot();
+  const out: HermesProfile[] = [{ name: HERMES_DEFAULT_PROFILE, home: root }];
+  const seen = new Set<string>([HERMES_DEFAULT_PROFILE]);
+
+  let names: string[];
+  try {
+    names = readdirSync(join(root, PROFILES_DIR), { withFileTypes: true })
+      // Symlinked profile dirs are legitimate, and `isDirectory()` is false for them.
+      .filter((e) => (e.isDirectory() || e.isSymbolicLink()) && !e.name.startsWith("."))
+      .map((e) => e.name)
+      .sort();
+  } catch {
+    return out;
+  }
+
+  for (const name of names) {
+    if (seen.has(name)) continue;
+    seen.add(name);
+    out.push({ name, home: join(root, PROFILES_DIR, name) });
+  }
+  return out;
+}
+
+// ── (profile, source) naming ────────────────────────────────────────────────
+//
+// Gateway sessions have no cwd to group by, so the dashboard and the audit
+// synthesize a project per (profile, source). Lives here — next to the profile
+// list the parser needs — so lib/hermes-sessions.ts and lib/hermes-projects.ts
+// can both use it without importing each other.
+
+/**
+ * Encoded project name for a (profile, source) pair.
+ *
+ * `decodeFolderName()` renders every `-` as `/`, so `hermes-work-slack` shows up
+ * as `hermes/work/slack` in the projects panel with no UI change.
+ */
+export function hermesProjectName(profile: string, source: string): string {
+  return `hermes-${profile}-${source}`;
+}
+
+/** Machine-readable grouping key, shown under the project name. */
+export function hermesProjectPath(profile: string, source: string): string {
+  return `hermes:${profile}:${source}`;
+}
+
+export interface HermesNameSplit {
+  profile: string;
+  source: string;
+}
+
+/**
+ * Every way `hermes-<profile>-<source>` could split, best guess first.
+ *
+ * Profile names may contain `-`, so the slug is never split blindly: each
+ * candidate is a profile that actually exists on disk, tried longest-first.
+ * Length alone is not decisive though — with profiles `work` and `work-slack`,
+ * `hermes-work-slack-dev` could be `work-slack`+`dev` or `work`+`slack-dev` —
+ * so callers walk the candidates and take the first that owns real sessions.
+ *
+ * The last candidate is always the legacy `hermes-<source>` form attributed to
+ * the default profile, keeping links made before profile support alive.
+ */
+export function hermesProjectNameCandidates(name: string): HermesNameSplit[] {
+  if (!name.startsWith("hermes-")) return [];
+  const rest = name.slice("hermes-".length);
+  if (!rest) return [];
+
+  const out: HermesNameSplit[] = [];
+  const profiles = listHermesProfiles()
+    .map((p) => p.name)
+    .sort((a, b) => b.length - a.length);
+  for (const profile of profiles) {
+    const prefix = `${profile}-`;
+    if (rest.startsWith(prefix) && rest.length > prefix.length) {
+      out.push({ profile, source: rest.slice(prefix.length) });
+    }
+  }
+  out.push({ profile: HERMES_DEFAULT_PROFILE, source: rest });
+  return out;
+}
+
+/** The best-guess split for a project name — `null` if it isn't a Hermes one. */
+export function parseHermesProjectName(name: string): HermesNameSplit | null {
+  return hermesProjectNameCandidates(name)[0] ?? null;
+}

package/lib/hermes-projects.ts

@@ -1,20 +1,32 @@
 /**
  * Hermes (hermes-agent) session enumeration — AUDIT-ONLY.
  *
- * Reads the `sessions` table directly from `~/.hermes/state.db` via the bundled
- * sql.js reader. All gateway users' sessions live in the one DB → "audit
- * everyone from one place". Because we query the table (not a text `sessions
- * list`), we get `source`/`cwd`/`message_count` up front — enough to group by
- * channel and to build a real per-transcript cache key.
+ * Reads the `sessions` table directly from every profile's `state.db` via the
+ * bundled sql.js reader. All of a profile's gateway users live in its one DB →
+ * "audit everyone from one place". Because we query the table (not a text
+ * `sessions list`), we get `source`/`cwd`/`message_count` up front — enough to
+ * group and to build a real per-transcript cache key.
+ *
+ * Sessions are grouped by (profile, source): a profile is a whole separate
+ * Hermes home (see lib/hermes-profiles.ts), so it is the outer scope, and
+ * `source` (slack/telegram/cli/cron) splits the channels within it.
  */
 import { openSqliteReadonly } from "./sqlite-reader";
-import { hermesDbPath, epochToMs } from "./hermes-sessions";
+import { hermesDbPaths, epochToMs } from "./hermes-sessions";
+import {
+  HERMES_DEFAULT_PROFILE,
+  hermesProjectName,
+  hermesProjectPath,
+  hermesProjectNameCandidates,
+} from "./hermes-profiles";
 import { runtimeCache } from "./runtime-cache";
 import type { ProjectFolder, SessionFile } from "./projects";
 import { formatDate } from "./format-date";
 
 export interface HermesSessionRef {
   sessionId: string;
+  /** Which profile's state.db this row came from (`"default"` for `~/.hermes`). */
+  profile: string;
   source?: string;
   cwd?: string;
   title?: string;
@@ -52,11 +64,24 @@ interface SessionRow {
 }
 
 /**
- * List every Hermes session (all users). Returns `[]` when the DB is missing or
- * unreadable (fail-open — the audit just skips Hermes).
+ * List every Hermes session — every user, of every profile. A missing or
+ * unreadable profile DB is skipped rather than failing the batch (fail-open:
+ * the audit degrades to the profiles it can read instead of dropping Hermes).
  */
 export async function getHermesSessions(): Promise<HermesSessionRef[]> {
-  const db = await openSqliteReadonly(hermesDbPath());
+  const out: HermesSessionRef[] = [];
+  for (const { profile, dbPath } of hermesDbPaths()) {
+    out.push(...(await readSessionsFromDb(dbPath, profile)));
+  }
+  out.sort((a, b) => b.mtimeMs - a.mtimeMs);
+  return out;
+}
+
+async function readSessionsFromDb(
+  dbPath: string,
+  profile: string,
+): Promise<HermesSessionRef[]> {
+  const db = await openSqliteReadonly(dbPath);
   if (!db) return [];
   try {
     const rows = db.query<SessionRow>(
@@ -69,6 +94,7 @@ export async function getHermesSessions(): Promise<HermesSessionRef[]> {
     );
     return rows.map((r) => ({
       sessionId: r.id,
+      profile,
       source: r.source ?? undefined,
       cwd: r.cwd ?? undefined,
       title: r.title ?? undefined,
@@ -92,29 +118,44 @@ export const getCachedHermesSessions = runtimeCache(getHermesSessions, 2);
 // ── Dashboard history browser (projects list + project-detail sessions) ──
 
 /**
- * Surface Hermes gateway sessions as synthetic "projects" grouped by `source`
- * (slack/telegram/cli/cron) — gateway sessions have no cwd to group by. One
- * ProjectFolder per source; its `name` is `hermes-<source>`, reversed in
- * `getHermesSessionsByEncodedName`.
+ * Surface Hermes gateway sessions as synthetic "projects" grouped by
+ * (profile, source) — gateway sessions have no cwd to group by. One
+ * ProjectFolder per pair, named by `hermesProjectName`.
  */
 export async function getHermesProjects(): Promise<ProjectFolder[]> {
   const sessions = await getHermesSessions();
-  const latestBySource = new Map<string, number>();
+  // key → { profile, source, latest }; keeps profile/source intact for naming
+  // (the key itself is not parseable back when a profile name contains "-").
+  const groups = new Map<
+    string,
+    { profile: string; source: string; latest: number; count: number }
+  >();
   for (const s of sessions) {
     if (s.messageCount <= 0 && !s.hasMessages) continue; // skip empty (message_count can lag; trust real messages)
-    const src = s.source ?? "unknown";
-    latestBySource.set(src, Math.max(latestBySource.get(src) ?? 0, s.mtimeMs));
+    const profile = s.profile || HERMES_DEFAULT_PROFILE;
+    const source = s.source ?? "unknown";
+    const key = JSON.stringify([profile, source]);
+    const prev = groups.get(key);
+    if (prev) {
+      prev.latest = Math.max(prev.latest, s.mtimeMs);
+      // Sessions, not messages — `messageCount` counts messages within one
+      // session and is documented as possibly lagging.
+      prev.count += 1;
+    } else {
+      groups.set(key, { profile, source, latest: s.mtimeMs, count: 1 });
+    }
   }
   const out: ProjectFolder[] = [];
-  for (const [src, latest] of latestBySource) {
+  for (const { profile, source, latest, count } of groups.values()) {
     const lastModified = new Date(latest);
     out.push({
-      name: `hermes-${src}`,
-      path: `hermes:${src}`,
+      name: hermesProjectName(profile, source),
+      path: hermesProjectPath(profile, source),
       isDirectory: true,
       lastModified,
       lastModifiedFormatted: formatDate(lastModified),
       cli: ["hermes"],
+      sessionCount: count,
     });
   }
   out.sort((a, b) => b.lastModified.getTime() - a.lastModified.getTime());
@@ -127,18 +168,43 @@ export interface HermesProjectByName {
 }
 
 /**
- * Resolve the Hermes sessions for a synthetic project name (`hermes-<source>`),
- * for the project-detail page. Non-Hermes names resolve to empty.
+ * Resolve the Hermes sessions for a synthetic project name
+ * (`hermes-<profile>-<source>`), for the project-detail page. Non-Hermes names
+ * resolve to empty.
  */
 export async function getHermesSessionsByEncodedName(
   name: string,
 ): Promise<HermesProjectByName> {
-  if (!name.startsWith("hermes-")) return { cwd: null, sessions: [] };
-  const source = name.slice("hermes-".length);
+  const candidates = hermesProjectNameCandidates(name);
+  if (candidates.length === 0) return { cwd: null, sessions: [] };
+
   const sessions = await getHermesSessions();
-  const matched = sessions.filter((s) => (s.messageCount > 0 || s.hasMessages) && (s.source ?? "unknown") === source);
+  const matching = (split: { profile: string; source: string }) =>
+    sessions.filter(
+      (s) =>
+        (s.messageCount > 0 || s.hasMessages) &&
+        (s.profile || HERMES_DEFAULT_PROFILE) === split.profile &&
+        (s.source ?? "unknown") === split.source,
+    );
+
+  // First split that actually owns sessions — longest-match alone picks the
+  // wrong profile when one name is a hyphen-prefix of another. Falling back to
+  // the best guess keeps the page labelled sensibly when nothing matches.
+  let chosen = candidates[0];
+  let matched = matching(chosen);
+  if (matched.length === 0) {
+    for (const candidate of candidates.slice(1)) {
+      const hits = matching(candidate);
+      if (hits.length > 0) {
+        chosen = candidate;
+        matched = hits;
+        break;
+      }
+    }
+  }
+  const { profile, source } = chosen;
   return {
-    cwd: `hermes:${source}`,
+    cwd: hermesProjectPath(profile, source),
     sessions: matched.map((s) => {
       const lastModified = new Date(s.mtimeMs);
       return {

package/lib/hermes-sessions.ts

@@ -12,12 +12,22 @@
  * `hermesRowsToLogEntries` pairs them (mirrors `lib/codex-sessions.ts`) and is a
  * PURE function of the message rows, so it is unit-testable without a DB.
  *
+ * PROFILES: Hermes profiles are separate home dirs, each with its OWN state.db
+ * (`~/.hermes/state.db` for the default, `~/.hermes/profiles/<name>/state.db`
+ * otherwise) — see lib/hermes-profiles.ts. So every read here fans out across
+ * profiles instead of assuming one DB.
+ *
  * DB path override: set `HERMES_DB_PATH` (used by tests and to point at a copied
- * or remote state.db).
+ * or remote state.db) — it collapses discovery to that single file. Set
+ * `HERMES_HOME` instead to audit a real multi-profile tree.
  */
-import { homedir } from "node:os";
 import { join } from "node:path";
 import { openSqliteReadonly } from "./sqlite-reader";
+import {
+  listHermesProfiles,
+  hermesProjectPath,
+  HERMES_DEFAULT_PROFILE,
+} from "./hermes-profiles";
 import { runtimeCache } from "./runtime-cache";
 import {
   baseEntry,
@@ -32,9 +42,26 @@ import {
 } from "./log-entries";
 import { formatDuration } from "./format-duration";
 
-/** Absolute path to Hermes's SQLite DB (override with HERMES_DB_PATH). */
-export function hermesDbPath(): string {
-  return process.env.HERMES_DB_PATH || join(homedir(), ".hermes", "state.db");
+/** One Hermes state.db, tagged with the profile that owns it. */
+export interface HermesDb {
+  profile: string;
+  dbPath: string;
+}
+
+/**
+ * Every Hermes state.db to read — one per profile on disk.
+ *
+ * `HERMES_DB_PATH` still wins and collapses this to a single synthetic
+ * `default` profile, so pointing at a copied/remote state.db keeps working
+ * exactly as before.
+ */
+export function hermesDbPaths(): HermesDb[] {
+  const override = process.env.HERMES_DB_PATH;
+  if (override) return [{ profile: HERMES_DEFAULT_PROFILE, dbPath: override }];
+  return listHermesProfiles().map((p) => ({
+    profile: p.name,
+    dbPath: join(p.home, "state.db"),
+  }));
 }
 
 /** Coerce a Hermes epoch value (seconds or ms) to epoch ms. Hermes stores
@@ -210,6 +237,8 @@ export interface HermesSessionLogData {
   rawLines: Record<string, unknown>[];
   cwd?: string;
   filePath: string; // synthetic — hermes keeps sessions in a DB; we use hermes://<id>
+  /** Which profile's state.db the session was found in. */
+  profile: string;
 }
 
 interface HermesMessageRow {
@@ -223,14 +252,33 @@ interface HermesMessageRow {
 }
 
 /**
- * Load one session by ID from `state.db`. Returns `null` when the DB is
- * unavailable or the session doesn't exist.
+ * Load one session by ID, searching every profile's `state.db` and returning the
+ * first hit. Returns `null` when no profile has it.
+ *
+ * Searching beats encoding the profile into the path: session ids are
+ * `YYYYMMDD_HHMMSS_<hash>`, so a cross-profile collision is vanishingly
+ * unlikely, and `hermes://<id>` therefore stays a stable identifier — no
+ * migration for transcript paths already recorded in audit history, and no
+ * change to the download route or its id validator. Profile order from
+ * `hermesDbPaths()` is deterministic, so the tie-break is too.
  */
 export async function getHermesSessionLog(
   sessionId: string,
 ): Promise<HermesSessionLogData | null> {
   if (!sessionId || !/^[A-Za-z0-9_-]+$/.test(sessionId)) return null;
-  const db = await openSqliteReadonly(hermesDbPath());
+  for (const { profile, dbPath } of hermesDbPaths()) {
+    const found = await loadFromDb(dbPath, profile, sessionId);
+    if (found) return found;
+  }
+  return null;
+}
+
+async function loadFromDb(
+  dbPath: string,
+  profile: string,
+  sessionId: string,
+): Promise<HermesSessionLogData | null> {
+  const db = await openSqliteReadonly(dbPath);
   if (!db) return null;
   try {
     const sessionRows = db.query<{ source: string | null; cwd: string | null }>(
@@ -250,14 +298,21 @@ export async function getHermesSessionLog(
       msgRows as unknown as Record<string, unknown>[],
       "session",
     );
-    // Gateway sessions have no cwd → group by source (slack/telegram/cli/cron).
+    // Gateway sessions have no cwd → fall back to the same (profile, source)
+    // key the projects panel and the audit adapter group by, so an event's cwd
+    // and its projectName agree.
     const cwd =
-      realCwd && realCwd.length > 0 ? realCwd : source ? `hermes:${source}` : undefined;
+      realCwd && realCwd.length > 0
+        ? realCwd
+        : source
+          ? hermesProjectPath(profile, source)
+          : undefined;
     return {
       entries,
       rawLines: msgRows as unknown as Record<string, unknown>[],
       cwd,
       filePath: `hermes://${sessionId}`,
+      profile,
     };
   } catch {
     return null;