failproofai 0.0.14-beta.2 → 0.0.15-beta.0

package/lib/openclaw-projects.ts

@@ -2,7 +2,7 @@
  * OpenClaw (openclaw gateway) session enumeration — AUDIT-ONLY.
  *
  * Surfaces the on-disk transcripts (agents/<agentId>/sessions/<uuid>.jsonl) as
- * synthetic dashboard "projects" grouped by agentId. The per-agent
+ * synthetic dashboard "projects" grouped by (agentId, channel). The per-agent
  * `sessions.json` index maps sessionKey → {sessionId, timestamps}; we read it to
  * recover the sessionKey (which encodes the channel for gateway sessions) and a
  * reliable last-activity time. Verified live against openclaw v2026.7.1.
@@ -10,7 +10,7 @@
 import { readFileSync } from "node:fs";
 import { join } from "node:path";
 import { runtimeCache } from "./runtime-cache";
-import { listOpenClawTranscripts, openclawHome } from "./openclaw-sessions";
+import { listOpenClawAgents, listOpenClawTranscripts, openclawHome } from "./openclaw-sessions";
 import type { ProjectFolder, SessionFile } from "./projects";
 import { formatDate } from "./format-date";
 
@@ -26,6 +26,8 @@ export interface OpenClawSessionRef {
    *  gateway-metadata columns. */
   chatId?: string;
   chatType?: string;
+  /** Absolute path to the `<uuid>.jsonl` transcript this ref came from. */
+  transcriptPath: string;
   mtimeMs: number;
   sizeBytes: number;
 }
@@ -100,6 +102,7 @@ export async function getOpenClawSessions(): Promise<OpenClawSessionRef[]> {
       label: meta?.label,
       chatType: meta?.chatType,
       chatId: meta?.chatId,
+      transcriptPath: t.transcriptPath,
       mtimeMs: meta?.lastMs ?? t.mtimeMs,
       sizeBytes: t.sizeBytes,
     });
@@ -112,28 +115,95 @@ export const getCachedOpenClawSessions = runtimeCache(getOpenClawSessions, 2);
 
 // ── Dashboard history browser (projects list + project-detail sessions) ──
 
+/** Encoded project name for an (agent, channel) pair. */
+export function openClawProjectName(agentId: string, channel: string): string {
+  return `openclaw-${agentId}-${channel}`;
+}
+
+/** Machine-readable grouping key, shown under the project name. */
+export function openClawProjectPath(agentId: string, channel: string): string {
+  return `openclaw:${agentId}:${channel}`;
+}
+
+export interface OpenClawNameSplit {
+  agentId: string | null;
+  channel: string;
+}
+
 /**
- * Surface OpenClaw sessions as synthetic "projects" grouped by **channel**
- * (telegram/slack/…/local) — gateway sessions run per channel, not in a host
- * repo. Mirrors Hermes's group-by-source. One ProjectFolder per channel; its
- * `name` is `openclaw-<channel>`, reversed in `getOpenClawSessionsByEncodedName`.
+ * Every way `openclaw-<agentId>-<channel>` could split, best guess first.
+ *
+ * Both an agentId and a channel may contain `-`, so the slug is never split
+ * blindly: each candidate is an agent id that actually exists on disk, tried
+ * longest-first. That alone is not sufficient — with agents `main` and
+ * `main-bot` on disk, `openclaw-main-bot-telegram` could be `main-bot`+`telegram`
+ * OR `main`+`bot-telegram`, and length alone picks the wrong one whenever the
+ * shorter agent owns it. So callers walk the candidates and take the first that
+ * matches real sessions.
+ *
+ * The last candidate is always the legacy channel-only `openclaw-<channel>`
+ * form (`agentId: null`), so links shared before agents became part of the name
+ * keep resolving — to every agent on that channel, which is what they meant.
+ */
+export function openClawProjectNameCandidates(name: string): OpenClawNameSplit[] {
+  if (!name.startsWith("openclaw-")) return [];
+  const rest = name.slice("openclaw-".length);
+  if (!rest) return [];
+
+  const out: OpenClawNameSplit[] = [];
+  const agents = listOpenClawAgents().sort((a, b) => b.length - a.length);
+  for (const agentId of agents) {
+    const prefix = `${agentId}-`;
+    if (rest.startsWith(prefix) && rest.length > prefix.length) {
+      out.push({ agentId, channel: rest.slice(prefix.length) });
+    }
+  }
+  out.push({ agentId: null, channel: rest });
+  return out;
+}
+
+/** The best-guess split for a project name — `null` if it isn't an OpenClaw one. */
+export function parseOpenClawProjectName(name: string): OpenClawNameSplit | null {
+  return openClawProjectNameCandidates(name)[0] ?? null;
+}
+
+/**
+ * Surface OpenClaw sessions as synthetic "projects" grouped by **(agent,
+ * channel)** — gateway sessions have no host repo to group by.
+ *
+ * Agent is the OUTER axis because it is the stable one: `agentId` is a
+ * directory name, whereas `channel` is derived from the LAST channel a session
+ * used. Grouping by channel alone (as this did before) also collapsed two
+ * different agents that both talk on Telegram into one row with one mixed
+ * session list — and disagreed with the audit adapter, which grouped by agent.
  */
 export async function getOpenClawProjects(): Promise<ProjectFolder[]> {
   const sessions = await getOpenClawSessions();
-  const latestByChannel = new Map<string, number>();
+  const groups = new Map<
+    string,
+    { agentId: string; channel: string; latest: number; count: number }
+  >();
   for (const s of sessions) {
-    latestByChannel.set(s.channel, Math.max(latestByChannel.get(s.channel) ?? 0, s.mtimeMs));
+    const key = JSON.stringify([s.agentId, s.channel]);
+    const prev = groups.get(key);
+    if (prev) {
+      prev.latest = Math.max(prev.latest, s.mtimeMs);
+      prev.count += 1;
+    } else {
+      groups.set(key, { agentId: s.agentId, channel: s.channel, latest: s.mtimeMs, count: 1 });
+    }
   }
   const out: ProjectFolder[] = [];
-  for (const [channel, latest] of latestByChannel) {
+  for (const { agentId, channel, latest, count } of groups.values()) {
     const lastModified = new Date(latest);
     out.push({
-      name: `openclaw-${channel}`,
-      path: `openclaw:${channel}`,
+      name: openClawProjectName(agentId, channel),
+      path: openClawProjectPath(agentId, channel),
       isDirectory: true,
       lastModified,
       lastModifiedFormatted: formatDate(lastModified),
       cli: ["openclaw"],
+      sessionCount: count,
     });
   }
   out.sort((a, b) => b.lastModified.getTime() - a.lastModified.getTime());
@@ -146,18 +216,41 @@ export interface OpenClawProjectByName {
 }
 
 /** Resolve the OpenClaw sessions for a synthetic project name
- *  (`openclaw-<channel>`), for the project-detail page. Session names use the
- *  human-readable `origin.label` (e.g. "Chetan (@chhhee10) id:…") rather than
- *  the raw session key. */
+ *  (`openclaw-<agentId>-<channel>`), for the project-detail page. Session names
+ *  use the human-readable `origin.label` (e.g. "Chetan (@chhhee10) id:…")
+ *  rather than the raw session key. */
 export async function getOpenClawSessionsByEncodedName(
   name: string,
 ): Promise<OpenClawProjectByName> {
-  if (!name.startsWith("openclaw-")) return { cwd: null, sessions: [] };
-  const channel = name.slice("openclaw-".length);
+  const candidates = openClawProjectNameCandidates(name);
+  if (candidates.length === 0) return { cwd: null, sessions: [] };
+
   const sessions = await getOpenClawSessions();
-  const matched = sessions.filter((s) => s.channel === channel);
+  const matching = (split: OpenClawNameSplit) =>
+    sessions.filter(
+      (s) => s.channel === split.channel && (split.agentId === null || s.agentId === split.agentId),
+    );
+
+  // Take the first split that actually owns sessions — length alone picks the
+  // wrong agent when one id is a hyphen-prefix of another. Falling back to the
+  // best guess keeps the page's labelling sensible when nothing matches.
+  let chosen = candidates[0];
+  let matched = matching(chosen);
+  if (matched.length === 0) {
+    for (const candidate of candidates.slice(1)) {
+      const hits = matching(candidate);
+      if (hits.length > 0) {
+        chosen = candidate;
+        matched = hits;
+        break;
+      }
+    }
+  }
+  const { agentId, channel } = chosen;
   return {
-    cwd: `openclaw:${channel}`,
+    // Legacy channel-only names keep their old cwd label, since they really do
+    // span every agent on that channel.
+    cwd: agentId === null ? `openclaw:${channel}` : openClawProjectPath(agentId, channel),
     sessions: matched.map((s) => {
       const lastModified = new Date(s.mtimeMs);
       return {

package/lib/openclaw-sessions.ts

@@ -195,6 +195,26 @@ export interface OpenClawTranscriptFile {
   sizeBytes: number;
 }
 
+/**
+ * Agent ids configured under this OpenClaw home, in name order.
+ *
+ * An agentId is just a directory name (`main`, `weather-bot`) — OpenClaw
+ * validates nothing, so neither do we. Cheap on purpose: one readdir, no
+ * statting of transcripts, because the project-name parser calls this to
+ * longest-match an agent id out of a URL slug (agent ids may contain `-`, so
+ * splitting the slug is not an option).
+ */
+export function listOpenClawAgents(): string[] {
+  try {
+    return readdirSync(join(openclawHome(), "agents"), { withFileTypes: true })
+      .filter((d) => d.isDirectory() && !d.name.startsWith("."))
+      .map((d) => d.name)
+      .sort();
+  } catch {
+    return [];
+  }
+}
+
 /** Enumerate `agents/<agentId>/sessions/<uuid>.jsonl` transcripts, skipping the
  *  heavy `.trajectory.jsonl` OTel traces and pointer files. */
 export function listOpenClawTranscripts(): OpenClawTranscriptFile[] {

package/lib/paths.ts

@@ -29,6 +29,42 @@ export function decodeFolderName(name: string): string {
   return name.replace(/-/g, "/");
 }
 
+/**
+ * Synthetic project path for gateway CLIs with no working directory —
+ * `hermes:<profile>:<source>`, `openclaw:<channel>`. Two or more leading letters
+ * so a Windows drive letter (`c:/code`) can never match.
+ */
+const SYNTHETIC_PROJECT_PATH = /^[a-z]{2,}:/;
+
+/**
+ * Whether a project `path` is a synthetic gateway path rather than a real
+ * filesystem path — `hermes:<profile>:<source>`, `openclaw:<agent>:<channel>`.
+ *
+ * These are the only projects with a meaningful segment hierarchy, so this is
+ * also what decides which rows the projects panel renders as a folder tree.
+ */
+export function isSyntheticProjectPath(path?: string): boolean {
+  return !!path && SYNTHETIC_PROJECT_PATH.test(path);
+}
+
+/** Segments of a synthetic gateway path, outermost first. `[]` for real paths. */
+export function syntheticPathSegments(path?: string): string[] {
+  return isSyntheticProjectPath(path) ? path!.split(":") : [];
+}
+
+/**
+ * Label to display for a project card.
+ *
+ * Filesystem-backed projects decode their folder name. Gateway projects must
+ * NOT: `decodeFolderName` turns every `-` into `/`, which splits a Hermes
+ * profile named `my-bot` into `my/bot`. Their `path` already carries the
+ * segments explicitly, so use it.
+ */
+export function projectDisplayName(name: string, path?: string): string {
+  if (isSyntheticProjectPath(path)) return path!.replace(/:/g, "/");
+  return decodeFolderName(name);
+}
+
 /**
  * Encodes a filesystem path into a Claude-compatible project folder name.
  * Inverse of `decodeFolderName`.

package/lib/project-tree.ts

@@ -0,0 +1,193 @@
+/**
+ * Folder tree for the projects panel.
+ *
+ * Gateway CLIs (Hermes, OpenClaw) are USER-scoped: their sessions have no
+ * working directory, so they can't sit in the cwd-based project model the other
+ * CLIs use. What they have instead is a hierarchy — which profile/agent, then
+ * which channel — and that hierarchy is already encoded in the synthetic
+ * `path` those producers emit (`hermes:work:slack`,
+ * `openclaw:weather-bot:telegram`).
+ *
+ * So this is a pure PRESENTATION transform over the flat `ProjectFolder[]` the
+ * server already returns: split those paths into nodes, leave every real
+ * filesystem project as a top-level leaf. Nothing about project `name`s
+ * changes, which is what keeps existing `/project/<name>` links, bookmarks and
+ * stored audit history resolving.
+ *
+ * Pure and dependency-free on purpose — `import type` only, so the client
+ * bundle never pulls in `lib/projects.ts`'s node:fs imports.
+ */
+import type { ProjectCli, ProjectFolder } from "./projects";
+import { syntheticPathSegments } from "./paths";
+
+export interface ProjectTreeNode {
+  /** Colon-joined segment path (`hermes:work`) — stable across renders, used as
+   *  the React key and as the collapsed-state key. */
+  key: string;
+  /** The single segment this row shows (`work`), not the whole path. */
+  label: string;
+  /** 0 for top-level rows; each level below adds 1 (drives indentation). */
+  depth: number;
+  children: ProjectTreeNode[];
+  /** The real project, on rows that map to one. Leaves always have it; a folder
+   *  row has it only if a project exists at exactly that path. Rows without one
+   *  are pure grouping and must not link anywhere. */
+  project?: ProjectFolder;
+  /** Sessions beneath this row, summed. `undefined` when nothing underneath
+   *  reported a count — rendered as nothing rather than as `0`, since the two
+   *  mean very different things. */
+  sessionCount?: number;
+  /** How many real projects this row covers (1 for a leaf). Lets the caller
+   *  paginate over top-level rows while still reporting a project range. */
+  projectCount: number;
+  /** Newest activity anywhere beneath this row. */
+  lastModified: Date;
+  lastModifiedFormatted?: string;
+  /** Union of the CLIs beneath this row, in first-seen order. */
+  cli: ProjectCli[];
+}
+
+interface Builder {
+  key: string;
+  label: string;
+  depth: number;
+  children: Map<string, Builder>;
+  project?: ProjectFolder;
+  sessionCount?: number;
+  projectCount: number;
+  lastModified: Date;
+  lastModifiedFormatted?: string;
+  cli: string[];
+}
+
+function makeBuilder(key: string, label: string, depth: number): Builder {
+  return {
+    key,
+    label,
+    depth,
+    children: new Map(),
+    projectCount: 0,
+    lastModified: new Date(0),
+    cli: [],
+  };
+}
+
+/** Fold a project's stats into a node — newest date wins, counts add, CLIs union. */
+function absorb(node: Builder, folder: ProjectFolder): void {
+  if (folder.lastModified.getTime() > node.lastModified.getTime()) {
+    node.lastModified = folder.lastModified;
+    node.lastModifiedFormatted = folder.lastModifiedFormatted;
+  }
+  if (typeof folder.sessionCount === "number") {
+    node.sessionCount = (node.sessionCount ?? 0) + folder.sessionCount;
+  }
+  node.projectCount += 1;
+  for (const c of folder.cli) if (!node.cli.includes(c)) node.cli.push(c);
+}
+
+function finalize(node: Builder): ProjectTreeNode {
+  const children = [...node.children.values()]
+    .map(finalize)
+    .sort((a, b) => b.lastModified.getTime() - a.lastModified.getTime());
+  return {
+    key: node.key,
+    label: node.label,
+    depth: node.depth,
+    children,
+    project: node.project,
+    sessionCount: node.sessionCount,
+    projectCount: node.projectCount,
+    lastModified: node.lastModified,
+    lastModifiedFormatted: node.lastModifiedFormatted,
+    cli: node.cli as ProjectCli[],
+  };
+}
+
+/**
+ * Build the render tree for a list of projects (already filtered, sorted and
+ * paginated by the caller — this adds no policy of its own).
+ *
+ * Real filesystem projects become depth-0 leaves in input order-by-recency,
+ * exactly as the flat table showed them. Gateway projects nest under one node
+ * per path segment.
+ */
+export function buildProjectTree(folders: ProjectFolder[]): ProjectTreeNode[] {
+  const roots = new Map<string, Builder>();
+
+  for (const folder of folders) {
+    const segments = syntheticPathSegments(folder.path);
+
+    if (segments.length === 0) {
+      // Real filesystem project — a top-level leaf, keyed by name so two
+      // projects with an identical path (or none) can't collide.
+      const node = makeBuilder(`project:${folder.name}`, folder.name, 0);
+      node.project = folder;
+      absorb(node, folder);
+      roots.set(node.key, node);
+      continue;
+    }
+
+    let level = roots;
+    let key = "";
+    let node: Builder | undefined;
+    for (let depth = 0; depth < segments.length; depth++) {
+      const label = segments[depth];
+      key = depth === 0 ? label : `${key}:${label}`;
+      let next = level.get(key);
+      if (!next) {
+        next = makeBuilder(key, label, depth);
+        level.set(key, next);
+      }
+      // Every ancestor rolls up the project's stats, so a collapsed folder still
+      // reports the freshest activity and total sessions underneath it.
+      absorb(next, folder);
+      node = next;
+      level = next.children;
+    }
+    // The deepest segment IS this project. Guard against two projects claiming
+    // the same path (shouldn't happen post-merge, but silently losing one would
+    // be worse than keeping the first).
+    if (node && !node.project) node.project = folder;
+  }
+
+  return [...roots.values()]
+    .map(finalize)
+    .sort((a, b) => b.lastModified.getTime() - a.lastModified.getTime());
+}
+
+/**
+ * Flatten the tree to the rows actually rendered, honouring collapsed state.
+ *
+ * We track COLLAPSED rather than expanded keys deliberately: a profile or agent
+ * that appears for the first time should be visible, not hidden behind a click
+ * the user doesn't know to make.
+ */
+export function visibleTreeRows(
+  nodes: ProjectTreeNode[],
+  isCollapsed: (key: string) => boolean,
+): ProjectTreeNode[] {
+  const out: ProjectTreeNode[] = [];
+  const walk = (list: ProjectTreeNode[]) => {
+    for (const node of list) {
+      out.push(node);
+      if (node.children.length > 0 && !isCollapsed(node.key)) walk(node.children);
+    }
+  };
+  walk(nodes);
+  return out;
+}
+
+/** Keys of every node that has children — i.e. every collapsible row. */
+export function collapsibleKeys(nodes: ProjectTreeNode[]): string[] {
+  const out: string[] = [];
+  const walk = (list: ProjectTreeNode[]) => {
+    for (const node of list) {
+      if (node.children.length > 0) {
+        out.push(node.key);
+        walk(node.children);
+      }
+    }
+  };
+  walk(nodes);
+  return out;
+}

package/lib/projects.ts

@@ -29,6 +29,20 @@ export interface ProjectFolder {
    * the same cwd has transcripts from more than one CLI; rendered as badges.
    */
   cli: ProjectCli[];
+  /**
+   * How many sessions this project holds.
+   *
+   * Only the GATEWAY producers (Hermes, OpenClaw) fill this in, because only
+   * they render as a folder tree where a collapsed row has to say how much is
+   * underneath it — and for them the count is free, since their grouping loop
+   * already visits every session. The cwd-based CLIs leave it undefined and the
+   * UI renders nothing, rather than a `0` that would read as "empty".
+   *
+   * Deliberately NOT filled for Claude: counting there needs an extra readdir
+   * per project folder, and a number that exists for some CLIs and not others
+   * would sum to a wrong-but-plausible total on a merged row.
+   */
+  sessionCount?: number;
 }
 
 export interface SessionFile {
@@ -126,6 +140,14 @@ function mergeProjectFolders(...sources: ProjectFolder[][]): ProjectFolder[] {
         cli: mergedCli,
         lastModified: newer.lastModified,
         lastModifiedFormatted: newer.lastModifiedFormatted,
+        // Spreading `existing` alone would silently keep only the FIRST source's
+        // count for a name several CLIs contribute to, so sum explicitly. Stays
+        // undefined unless at least one side reported a count — `0` would claim
+        // "no sessions" for producers that simply don't count.
+        sessionCount:
+          existing.sessionCount === undefined && f.sessionCount === undefined
+            ? undefined
+            : (existing.sessionCount ?? 0) + (f.sessionCount ?? 0),
       });
     }
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "failproofai",
-  "version": "0.0.14-beta.2",
+  "version": "0.0.15-beta.0",
   "description": "The easiest way to manage policies that keep your AI agents reliable, on-task, and running autonomously — for Claude Code & the Agents SDK",
   "bin": {
     "failproofai": "./dist/cli.mjs"
@@ -71,11 +71,11 @@
     "access": "public"
   },
   "devDependencies": {
-    "@anthropic-ai/sdk": "^0.111.0",
+    "@anthropic-ai/sdk": "^0.115.0",
     "@mdx-js/mdx": "^3.1.1",
     "@tailwindcss/postcss": "^4.3.1",
     "@tanstack/react-virtual": "^3.14.3",
-    "@testing-library/jest-dom": "^6.9.1",
+    "@testing-library/jest-dom": "^7.0.0",
     "@testing-library/react": "^16.3.2",
     "@testing-library/user-event": "^14.6.1",
     "@types/node": "26.1.1",
@@ -85,9 +85,9 @@
     "clsx": "^2.1.1",
     "eslint": "^10.5.0",
     "eslint-config-next": "^16.2.9",
-    "jsdom": "^29.1.1",
+    "jsdom": "^30.0.0",
     "lucide-react": "^1.18.0",
-    "next": "^16.2.9",
+    "next": "^16.2.11",
     "react": "^19.2.4",
     "react-dom": "^19.2.4",
     "tailwind-merge": "^3.4.0",
@@ -103,9 +103,11 @@
     "yaml": "^2.9.0"
   },
   "overrides": {
-    "postcss": "8.5.14",
+    "postcss": "8.5.23",
     "eslint-plugin-react-hooks": "7.0.1",
     "vite": "8.0.16",
-    "undici": "7.28.0"
+    "undici": "7.28.0",
+    "brace-expansion": "5.0.8",
+    "sharp": "0.35.0"
   }
 }

package/pi-extension/index.ts

@@ -347,6 +347,10 @@ export default function failproofaiBridge(pi: PiExtensionApi) {
       cwd: resolveCwd(e.cwd),
       hook_event_name: "PreToolUse",
     });
+    // `ToolCallEventResult` is `{block?, reason?}` (extensions/types.d.ts:766).
+    // agent-loop.ts branches on `beforeResult?.block`, so this is the shape that
+    // stops the tool. Do NOT put the user_bash full-replacement shape here — it
+    // has no `block` field, so the call would sail straight through.
     if (decision.block) return { block: true, reason: decision.reason };
     return undefined;
   });
@@ -361,12 +365,38 @@ export default function failproofaiBridge(pi: PiExtensionApi) {
       cwd: resolveCwd(e.cwd),
       hook_event_name: "PreToolUse",
     });
-    if (decision.block) return { block: true, reason: decision.reason };
+    // `UserBashEventResult` is `{operations?, result?: BashResult}` — there is
+    // no `block` field, so the `{block:true}` we used to return matched nothing
+    // and the command ran anyway. The supported way to stop it is a FULL
+    // REPLACEMENT result: the extension declares it handled execution, so Pi
+    // uses this instead of running the command. Verified against the installed
+    // pi-coding-agent d.ts (extensions/types.d.ts:772, core/bash-executor.d.ts:15).
+    if (decision.block) {
+      return {
+        result: {
+          output: decision.reason ?? "Blocked by failproofai",
+          exitCode: 1,
+          cancelled: false,
+          truncated: false,
+        },
+      };
+    }
     return undefined;
   });
 
-  // input → UserPromptSubmit. Honor block decisions if Pi accepts them
-  // (Pi's docs describe block on input but it's not exhaustively tested).
+  // input → UserPromptSubmit.
+  //
+  // `InputEventResult` is `{action:"continue"|"transform"|"handled"}`
+  // (extensions/types.d.ts:629) — there is NO `block` field, so the
+  // `{block:true}` we used to return matched neither branch and every prompt
+  // was submitted regardless of the verdict. `{action:"handled"}` is the only
+  // stop: it tells Pi an extension consumed the input, so nothing is sent to
+  // the model.
+  //
+  // Known UX limitation: `handled` drops the prompt silently — Pi shows the
+  // user nothing. We log the reason to stderr so it is at least recoverable
+  // from the session output. Pi has no first-class channel for explaining a
+  // refusal at this event; if one appears, prefer it over the silent drop.
   pi.on("input", (event: unknown): unknown => {
     const e = event as PiInputEvent;
     const decision = callPolicy("input", {
@@ -375,8 +405,11 @@ export default function failproofaiBridge(pi: PiExtensionApi) {
       cwd: resolveCwd(e.cwd),
       hook_event_name: "UserPromptSubmit",
     });
-    if (decision.block) return { block: true, reason: decision.reason };
-    return undefined;
+    if (decision.block) {
+      console.error(`[failproofai] prompt blocked: ${decision.reason ?? "blocked by policy"}`);
+      return { action: "handled" };
+    }
+    return { action: "continue" };
   });
 
   // session_start → SessionStart. Observe-only; we still forward so the

package/scripts/launch.ts

@@ -89,6 +89,13 @@ export function launch(mode: "dev" | "start"): void {
     stdio: filterLogs ? ["inherit", "pipe", "pipe"] : "inherit",
     env: {
       ...process.env,
+      // `.next/standalone/server.js` does `process.chdir(__dirname)` on its
+      // first line, so by the time a server action runs, `process.cwd()` is the
+      // PACKAGE directory, not the directory the user launched from. Anything
+      // resolving project-scope paths from cwd would look inside the installed
+      // package and find nothing. Capture the real cwd here, before the child
+      // starts, the same way FAILPROOFAI_PACKAGE_ROOT is threaded through.
+      FAILPROOFAI_LAUNCH_CWD: process.env.FAILPROOFAI_LAUNCH_CWD ?? process.cwd(),
       ...(filterLogs ? { FORCE_COLOR: process.env.FORCE_COLOR ?? "1" } : {}),
       ...(loggingLevel ? { FAILPROOFAI_LOG_LEVEL: loggingLevel } : {}),
       ...(disableTelemetry ? { FAILPROOFAI_TELEMETRY_DISABLED: "1" } : {}),

package/src/audit/cli-adapters/hermes.ts

@@ -8,9 +8,11 @@
  * `logEntriesToEvents` handles the rest.
  *
  * Gateway sessions have no `cwd` (Slack/Telegram runs aren't in a repo), so they
- * group by `source` (slack/telegram/cli/cron) instead of working directory.
+ * group by (profile, `source`) instead of working directory — a Hermes profile
+ * is a whole separate home dir with its own state.db (lib/hermes-profiles.ts).
  */
 import { getHermesSessions } from "../../../lib/hermes-projects";
+import { hermesProjectPath } from "../../../lib/hermes-profiles";
 import { getHermesSessionLog } from "../../../lib/hermes-sessions";
 import type { NormalizedToolEvent, TranscriptMetadata } from "../types";
 import type { ListOpts } from "./claude";
@@ -31,8 +33,9 @@ export async function listHermesTranscriptMetadata(
     if (s.messageCount <= 0 && !s.hasMessages) continue; // empty → no events (message_count can lag; trust real messages)
     out.push({
       cli: "hermes",
-      // Group by channel; gateway sessions are cwd-less.
-      projectName: s.source ? `hermes:${s.source}` : "hermes",
+      // Group by (profile, channel); gateway sessions are cwd-less, and each
+      // profile is a separate Hermes home with its own state.db.
+      projectName: s.source ? hermesProjectPath(s.profile, s.source) : `hermes:${s.profile}`,
       sessionId: s.sessionId,
       transcriptPath: `hermes://${s.sessionId}`,
       mtimeMs: s.mtimeMs,