failproofai 0.0.14 → 0.0.15-beta.0

package/.next/standalone/lib/hermes-projects.ts

@@ -1,20 +1,32 @@
 /**
  * Hermes (hermes-agent) session enumeration — AUDIT-ONLY.
  *
- * Reads the `sessions` table directly from `~/.hermes/state.db` via the bundled
- * sql.js reader. All gateway users' sessions live in the one DB → "audit
- * everyone from one place". Because we query the table (not a text `sessions
- * list`), we get `source`/`cwd`/`message_count` up front — enough to group by
- * channel and to build a real per-transcript cache key.
+ * Reads the `sessions` table directly from every profile's `state.db` via the
+ * bundled sql.js reader. All of a profile's gateway users live in its one DB →
+ * "audit everyone from one place". Because we query the table (not a text
+ * `sessions list`), we get `source`/`cwd`/`message_count` up front — enough to
+ * group and to build a real per-transcript cache key.
+ *
+ * Sessions are grouped by (profile, source): a profile is a whole separate
+ * Hermes home (see lib/hermes-profiles.ts), so it is the outer scope, and
+ * `source` (slack/telegram/cli/cron) splits the channels within it.
  */
 import { openSqliteReadonly } from "./sqlite-reader";
-import { hermesDbPath, epochToMs } from "./hermes-sessions";
+import { hermesDbPaths, epochToMs } from "./hermes-sessions";
+import {
+  HERMES_DEFAULT_PROFILE,
+  hermesProjectName,
+  hermesProjectPath,
+  hermesProjectNameCandidates,
+} from "./hermes-profiles";
 import { runtimeCache } from "./runtime-cache";
 import type { ProjectFolder, SessionFile } from "./projects";
 import { formatDate } from "./format-date";
 
 export interface HermesSessionRef {
   sessionId: string;
+  /** Which profile's state.db this row came from (`"default"` for `~/.hermes`). */
+  profile: string;
   source?: string;
   cwd?: string;
   title?: string;
@@ -52,11 +64,24 @@ interface SessionRow {
 }
 
 /**
- * List every Hermes session (all users). Returns `[]` when the DB is missing or
- * unreadable (fail-open — the audit just skips Hermes).
+ * List every Hermes session — every user, of every profile. A missing or
+ * unreadable profile DB is skipped rather than failing the batch (fail-open:
+ * the audit degrades to the profiles it can read instead of dropping Hermes).
  */
 export async function getHermesSessions(): Promise<HermesSessionRef[]> {
-  const db = await openSqliteReadonly(hermesDbPath());
+  const out: HermesSessionRef[] = [];
+  for (const { profile, dbPath } of hermesDbPaths()) {
+    out.push(...(await readSessionsFromDb(dbPath, profile)));
+  }
+  out.sort((a, b) => b.mtimeMs - a.mtimeMs);
+  return out;
+}
+
+async function readSessionsFromDb(
+  dbPath: string,
+  profile: string,
+): Promise<HermesSessionRef[]> {
+  const db = await openSqliteReadonly(dbPath);
   if (!db) return [];
   try {
     const rows = db.query<SessionRow>(
@@ -69,6 +94,7 @@ export async function getHermesSessions(): Promise<HermesSessionRef[]> {
     );
     return rows.map((r) => ({
       sessionId: r.id,
+      profile,
       source: r.source ?? undefined,
       cwd: r.cwd ?? undefined,
       title: r.title ?? undefined,
@@ -92,29 +118,44 @@ export const getCachedHermesSessions = runtimeCache(getHermesSessions, 2);
 // ── Dashboard history browser (projects list + project-detail sessions) ──
 
 /**
- * Surface Hermes gateway sessions as synthetic "projects" grouped by `source`
- * (slack/telegram/cli/cron) — gateway sessions have no cwd to group by. One
- * ProjectFolder per source; its `name` is `hermes-<source>`, reversed in
- * `getHermesSessionsByEncodedName`.
+ * Surface Hermes gateway sessions as synthetic "projects" grouped by
+ * (profile, source) — gateway sessions have no cwd to group by. One
+ * ProjectFolder per pair, named by `hermesProjectName`.
  */
 export async function getHermesProjects(): Promise<ProjectFolder[]> {
   const sessions = await getHermesSessions();
-  const latestBySource = new Map<string, number>();
+  // key → { profile, source, latest }; keeps profile/source intact for naming
+  // (the key itself is not parseable back when a profile name contains "-").
+  const groups = new Map<
+    string,
+    { profile: string; source: string; latest: number; count: number }
+  >();
   for (const s of sessions) {
     if (s.messageCount <= 0 && !s.hasMessages) continue; // skip empty (message_count can lag; trust real messages)
-    const src = s.source ?? "unknown";
-    latestBySource.set(src, Math.max(latestBySource.get(src) ?? 0, s.mtimeMs));
+    const profile = s.profile || HERMES_DEFAULT_PROFILE;
+    const source = s.source ?? "unknown";
+    const key = JSON.stringify([profile, source]);
+    const prev = groups.get(key);
+    if (prev) {
+      prev.latest = Math.max(prev.latest, s.mtimeMs);
+      // Sessions, not messages — `messageCount` counts messages within one
+      // session and is documented as possibly lagging.
+      prev.count += 1;
+    } else {
+      groups.set(key, { profile, source, latest: s.mtimeMs, count: 1 });
+    }
   }
   const out: ProjectFolder[] = [];
-  for (const [src, latest] of latestBySource) {
+  for (const { profile, source, latest, count } of groups.values()) {
     const lastModified = new Date(latest);
     out.push({
-      name: `hermes-${src}`,
-      path: `hermes:${src}`,
+      name: hermesProjectName(profile, source),
+      path: hermesProjectPath(profile, source),
       isDirectory: true,
       lastModified,
       lastModifiedFormatted: formatDate(lastModified),
       cli: ["hermes"],
+      sessionCount: count,
     });
   }
   out.sort((a, b) => b.lastModified.getTime() - a.lastModified.getTime());
@@ -127,18 +168,43 @@ export interface HermesProjectByName {
 }
 
 /**
- * Resolve the Hermes sessions for a synthetic project name (`hermes-<source>`),
- * for the project-detail page. Non-Hermes names resolve to empty.
+ * Resolve the Hermes sessions for a synthetic project name
+ * (`hermes-<profile>-<source>`), for the project-detail page. Non-Hermes names
+ * resolve to empty.
  */
 export async function getHermesSessionsByEncodedName(
   name: string,
 ): Promise<HermesProjectByName> {
-  if (!name.startsWith("hermes-")) return { cwd: null, sessions: [] };
-  const source = name.slice("hermes-".length);
+  const candidates = hermesProjectNameCandidates(name);
+  if (candidates.length === 0) return { cwd: null, sessions: [] };
+
   const sessions = await getHermesSessions();
-  const matched = sessions.filter((s) => (s.messageCount > 0 || s.hasMessages) && (s.source ?? "unknown") === source);
+  const matching = (split: { profile: string; source: string }) =>
+    sessions.filter(
+      (s) =>
+        (s.messageCount > 0 || s.hasMessages) &&
+        (s.profile || HERMES_DEFAULT_PROFILE) === split.profile &&
+        (s.source ?? "unknown") === split.source,
+    );
+
+  // First split that actually owns sessions — longest-match alone picks the
+  // wrong profile when one name is a hyphen-prefix of another. Falling back to
+  // the best guess keeps the page labelled sensibly when nothing matches.
+  let chosen = candidates[0];
+  let matched = matching(chosen);
+  if (matched.length === 0) {
+    for (const candidate of candidates.slice(1)) {
+      const hits = matching(candidate);
+      if (hits.length > 0) {
+        chosen = candidate;
+        matched = hits;
+        break;
+      }
+    }
+  }
+  const { profile, source } = chosen;
   return {
-    cwd: `hermes:${source}`,
+    cwd: hermesProjectPath(profile, source),
     sessions: matched.map((s) => {
       const lastModified = new Date(s.mtimeMs);
       return {

package/.next/standalone/lib/hermes-sessions.ts

@@ -12,12 +12,22 @@
  * `hermesRowsToLogEntries` pairs them (mirrors `lib/codex-sessions.ts`) and is a
  * PURE function of the message rows, so it is unit-testable without a DB.
  *
+ * PROFILES: Hermes profiles are separate home dirs, each with its OWN state.db
+ * (`~/.hermes/state.db` for the default, `~/.hermes/profiles/<name>/state.db`
+ * otherwise) — see lib/hermes-profiles.ts. So every read here fans out across
+ * profiles instead of assuming one DB.
+ *
  * DB path override: set `HERMES_DB_PATH` (used by tests and to point at a copied
- * or remote state.db).
+ * or remote state.db) — it collapses discovery to that single file. Set
+ * `HERMES_HOME` instead to audit a real multi-profile tree.
  */
-import { homedir } from "node:os";
 import { join } from "node:path";
 import { openSqliteReadonly } from "./sqlite-reader";
+import {
+  listHermesProfiles,
+  hermesProjectPath,
+  HERMES_DEFAULT_PROFILE,
+} from "./hermes-profiles";
 import { runtimeCache } from "./runtime-cache";
 import {
   baseEntry,
@@ -32,9 +42,26 @@ import {
 } from "./log-entries";
 import { formatDuration } from "./format-duration";
 
-/** Absolute path to Hermes's SQLite DB (override with HERMES_DB_PATH). */
-export function hermesDbPath(): string {
-  return process.env.HERMES_DB_PATH || join(homedir(), ".hermes", "state.db");
+/** One Hermes state.db, tagged with the profile that owns it. */
+export interface HermesDb {
+  profile: string;
+  dbPath: string;
+}
+
+/**
+ * Every Hermes state.db to read — one per profile on disk.
+ *
+ * `HERMES_DB_PATH` still wins and collapses this to a single synthetic
+ * `default` profile, so pointing at a copied/remote state.db keeps working
+ * exactly as before.
+ */
+export function hermesDbPaths(): HermesDb[] {
+  const override = process.env.HERMES_DB_PATH;
+  if (override) return [{ profile: HERMES_DEFAULT_PROFILE, dbPath: override }];
+  return listHermesProfiles().map((p) => ({
+    profile: p.name,
+    dbPath: join(p.home, "state.db"),
+  }));
 }
 
 /** Coerce a Hermes epoch value (seconds or ms) to epoch ms. Hermes stores
@@ -210,6 +237,8 @@ export interface HermesSessionLogData {
   rawLines: Record<string, unknown>[];
   cwd?: string;
   filePath: string; // synthetic — hermes keeps sessions in a DB; we use hermes://<id>
+  /** Which profile's state.db the session was found in. */
+  profile: string;
 }
 
 interface HermesMessageRow {
@@ -223,14 +252,33 @@ interface HermesMessageRow {
 }
 
 /**
- * Load one session by ID from `state.db`. Returns `null` when the DB is
- * unavailable or the session doesn't exist.
+ * Load one session by ID, searching every profile's `state.db` and returning the
+ * first hit. Returns `null` when no profile has it.
+ *
+ * Searching beats encoding the profile into the path: session ids are
+ * `YYYYMMDD_HHMMSS_<hash>`, so a cross-profile collision is vanishingly
+ * unlikely, and `hermes://<id>` therefore stays a stable identifier — no
+ * migration for transcript paths already recorded in audit history, and no
+ * change to the download route or its id validator. Profile order from
+ * `hermesDbPaths()` is deterministic, so the tie-break is too.
  */
 export async function getHermesSessionLog(
   sessionId: string,
 ): Promise<HermesSessionLogData | null> {
   if (!sessionId || !/^[A-Za-z0-9_-]+$/.test(sessionId)) return null;
-  const db = await openSqliteReadonly(hermesDbPath());
+  for (const { profile, dbPath } of hermesDbPaths()) {
+    const found = await loadFromDb(dbPath, profile, sessionId);
+    if (found) return found;
+  }
+  return null;
+}
+
+async function loadFromDb(
+  dbPath: string,
+  profile: string,
+  sessionId: string,
+): Promise<HermesSessionLogData | null> {
+  const db = await openSqliteReadonly(dbPath);
   if (!db) return null;
   try {
     const sessionRows = db.query<{ source: string | null; cwd: string | null }>(
@@ -250,14 +298,21 @@ export async function getHermesSessionLog(
       msgRows as unknown as Record<string, unknown>[],
       "session",
     );
-    // Gateway sessions have no cwd → group by source (slack/telegram/cli/cron).
+    // Gateway sessions have no cwd → fall back to the same (profile, source)
+    // key the projects panel and the audit adapter group by, so an event's cwd
+    // and its projectName agree.
     const cwd =
-      realCwd && realCwd.length > 0 ? realCwd : source ? `hermes:${source}` : undefined;
+      realCwd && realCwd.length > 0
+        ? realCwd
+        : source
+          ? hermesProjectPath(profile, source)
+          : undefined;
     return {
       entries,
       rawLines: msgRows as unknown as Record<string, unknown>[],
       cwd,
       filePath: `hermes://${sessionId}`,
+      profile,
     };
   } catch {
     return null;

package/.next/standalone/lib/openclaw-projects.ts

@@ -2,7 +2,7 @@
  * OpenClaw (openclaw gateway) session enumeration — AUDIT-ONLY.
  *
  * Surfaces the on-disk transcripts (agents/<agentId>/sessions/<uuid>.jsonl) as
- * synthetic dashboard "projects" grouped by agentId. The per-agent
+ * synthetic dashboard "projects" grouped by (agentId, channel). The per-agent
  * `sessions.json` index maps sessionKey → {sessionId, timestamps}; we read it to
  * recover the sessionKey (which encodes the channel for gateway sessions) and a
  * reliable last-activity time. Verified live against openclaw v2026.7.1.
@@ -10,7 +10,7 @@
 import { readFileSync } from "node:fs";
 import { join } from "node:path";
 import { runtimeCache } from "./runtime-cache";
-import { listOpenClawTranscripts, openclawHome } from "./openclaw-sessions";
+import { listOpenClawAgents, listOpenClawTranscripts, openclawHome } from "./openclaw-sessions";
 import type { ProjectFolder, SessionFile } from "./projects";
 import { formatDate } from "./format-date";
 
@@ -26,6 +26,8 @@ export interface OpenClawSessionRef {
    *  gateway-metadata columns. */
   chatId?: string;
   chatType?: string;
+  /** Absolute path to the `<uuid>.jsonl` transcript this ref came from. */
+  transcriptPath: string;
   mtimeMs: number;
   sizeBytes: number;
 }
@@ -100,6 +102,7 @@ export async function getOpenClawSessions(): Promise<OpenClawSessionRef[]> {
       label: meta?.label,
       chatType: meta?.chatType,
       chatId: meta?.chatId,
+      transcriptPath: t.transcriptPath,
       mtimeMs: meta?.lastMs ?? t.mtimeMs,
       sizeBytes: t.sizeBytes,
     });
@@ -112,28 +115,95 @@ export const getCachedOpenClawSessions = runtimeCache(getOpenClawSessions, 2);
 
 // ── Dashboard history browser (projects list + project-detail sessions) ──
 
+/** Encoded project name for an (agent, channel) pair. */
+export function openClawProjectName(agentId: string, channel: string): string {
+  return `openclaw-${agentId}-${channel}`;
+}
+
+/** Machine-readable grouping key, shown under the project name. */
+export function openClawProjectPath(agentId: string, channel: string): string {
+  return `openclaw:${agentId}:${channel}`;
+}
+
+export interface OpenClawNameSplit {
+  agentId: string | null;
+  channel: string;
+}
+
 /**
- * Surface OpenClaw sessions as synthetic "projects" grouped by **channel**
- * (telegram/slack/…/local) — gateway sessions run per channel, not in a host
- * repo. Mirrors Hermes's group-by-source. One ProjectFolder per channel; its
- * `name` is `openclaw-<channel>`, reversed in `getOpenClawSessionsByEncodedName`.
+ * Every way `openclaw-<agentId>-<channel>` could split, best guess first.
+ *
+ * Both an agentId and a channel may contain `-`, so the slug is never split
+ * blindly: each candidate is an agent id that actually exists on disk, tried
+ * longest-first. That alone is not sufficient — with agents `main` and
+ * `main-bot` on disk, `openclaw-main-bot-telegram` could be `main-bot`+`telegram`
+ * OR `main`+`bot-telegram`, and length alone picks the wrong one whenever the
+ * shorter agent owns it. So callers walk the candidates and take the first that
+ * matches real sessions.
+ *
+ * The last candidate is always the legacy channel-only `openclaw-<channel>`
+ * form (`agentId: null`), so links shared before agents became part of the name
+ * keep resolving — to every agent on that channel, which is what they meant.
+ */
+export function openClawProjectNameCandidates(name: string): OpenClawNameSplit[] {
+  if (!name.startsWith("openclaw-")) return [];
+  const rest = name.slice("openclaw-".length);
+  if (!rest) return [];
+
+  const out: OpenClawNameSplit[] = [];
+  const agents = listOpenClawAgents().sort((a, b) => b.length - a.length);
+  for (const agentId of agents) {
+    const prefix = `${agentId}-`;
+    if (rest.startsWith(prefix) && rest.length > prefix.length) {
+      out.push({ agentId, channel: rest.slice(prefix.length) });
+    }
+  }
+  out.push({ agentId: null, channel: rest });
+  return out;
+}
+
+/** The best-guess split for a project name — `null` if it isn't an OpenClaw one. */
+export function parseOpenClawProjectName(name: string): OpenClawNameSplit | null {
+  return openClawProjectNameCandidates(name)[0] ?? null;
+}
+
+/**
+ * Surface OpenClaw sessions as synthetic "projects" grouped by **(agent,
+ * channel)** — gateway sessions have no host repo to group by.
+ *
+ * Agent is the OUTER axis because it is the stable one: `agentId` is a
+ * directory name, whereas `channel` is derived from the LAST channel a session
+ * used. Grouping by channel alone (as this did before) also collapsed two
+ * different agents that both talk on Telegram into one row with one mixed
+ * session list — and disagreed with the audit adapter, which grouped by agent.
  */
 export async function getOpenClawProjects(): Promise<ProjectFolder[]> {
   const sessions = await getOpenClawSessions();
-  const latestByChannel = new Map<string, number>();
+  const groups = new Map<
+    string,
+    { agentId: string; channel: string; latest: number; count: number }
+  >();
   for (const s of sessions) {
-    latestByChannel.set(s.channel, Math.max(latestByChannel.get(s.channel) ?? 0, s.mtimeMs));
+    const key = JSON.stringify([s.agentId, s.channel]);
+    const prev = groups.get(key);
+    if (prev) {
+      prev.latest = Math.max(prev.latest, s.mtimeMs);
+      prev.count += 1;
+    } else {
+      groups.set(key, { agentId: s.agentId, channel: s.channel, latest: s.mtimeMs, count: 1 });
+    }
   }
   const out: ProjectFolder[] = [];
-  for (const [channel, latest] of latestByChannel) {
+  for (const { agentId, channel, latest, count } of groups.values()) {
     const lastModified = new Date(latest);
     out.push({
-      name: `openclaw-${channel}`,
-      path: `openclaw:${channel}`,
+      name: openClawProjectName(agentId, channel),
+      path: openClawProjectPath(agentId, channel),
       isDirectory: true,
       lastModified,
       lastModifiedFormatted: formatDate(lastModified),
       cli: ["openclaw"],
+      sessionCount: count,
     });
   }
   out.sort((a, b) => b.lastModified.getTime() - a.lastModified.getTime());
@@ -146,18 +216,41 @@ export interface OpenClawProjectByName {
 }
 
 /** Resolve the OpenClaw sessions for a synthetic project name
- *  (`openclaw-<channel>`), for the project-detail page. Session names use the
- *  human-readable `origin.label` (e.g. "Chetan (@chhhee10) id:…") rather than
- *  the raw session key. */
+ *  (`openclaw-<agentId>-<channel>`), for the project-detail page. Session names
+ *  use the human-readable `origin.label` (e.g. "Chetan (@chhhee10) id:…")
+ *  rather than the raw session key. */
 export async function getOpenClawSessionsByEncodedName(
   name: string,
 ): Promise<OpenClawProjectByName> {
-  if (!name.startsWith("openclaw-")) return { cwd: null, sessions: [] };
-  const channel = name.slice("openclaw-".length);
+  const candidates = openClawProjectNameCandidates(name);
+  if (candidates.length === 0) return { cwd: null, sessions: [] };
+
   const sessions = await getOpenClawSessions();
-  const matched = sessions.filter((s) => s.channel === channel);
+  const matching = (split: OpenClawNameSplit) =>
+    sessions.filter(
+      (s) => s.channel === split.channel && (split.agentId === null || s.agentId === split.agentId),
+    );
+
+  // Take the first split that actually owns sessions — length alone picks the
+  // wrong agent when one id is a hyphen-prefix of another. Falling back to the
+  // best guess keeps the page's labelling sensible when nothing matches.
+  let chosen = candidates[0];
+  let matched = matching(chosen);
+  if (matched.length === 0) {
+    for (const candidate of candidates.slice(1)) {
+      const hits = matching(candidate);
+      if (hits.length > 0) {
+        chosen = candidate;
+        matched = hits;
+        break;
+      }
+    }
+  }
+  const { agentId, channel } = chosen;
   return {
-    cwd: `openclaw:${channel}`,
+    // Legacy channel-only names keep their old cwd label, since they really do
+    // span every agent on that channel.
+    cwd: agentId === null ? `openclaw:${channel}` : openClawProjectPath(agentId, channel),
     sessions: matched.map((s) => {
       const lastModified = new Date(s.mtimeMs);
       return {

package/.next/standalone/lib/openclaw-sessions.ts

@@ -195,6 +195,26 @@ export interface OpenClawTranscriptFile {
   sizeBytes: number;
 }
 
+/**
+ * Agent ids configured under this OpenClaw home, in name order.
+ *
+ * An agentId is just a directory name (`main`, `weather-bot`) — OpenClaw
+ * validates nothing, so neither do we. Cheap on purpose: one readdir, no
+ * statting of transcripts, because the project-name parser calls this to
+ * longest-match an agent id out of a URL slug (agent ids may contain `-`, so
+ * splitting the slug is not an option).
+ */
+export function listOpenClawAgents(): string[] {
+  try {
+    return readdirSync(join(openclawHome(), "agents"), { withFileTypes: true })
+      .filter((d) => d.isDirectory() && !d.name.startsWith("."))
+      .map((d) => d.name)
+      .sort();
+  } catch {
+    return [];
+  }
+}
+
 /** Enumerate `agents/<agentId>/sessions/<uuid>.jsonl` transcripts, skipping the
  *  heavy `.trajectory.jsonl` OTel traces and pointer files. */
 export function listOpenClawTranscripts(): OpenClawTranscriptFile[] {

package/.next/standalone/lib/paths.ts

@@ -29,6 +29,42 @@ export function decodeFolderName(name: string): string {
   return name.replace(/-/g, "/");
 }
 
+/**
+ * Synthetic project path for gateway CLIs with no working directory —
+ * `hermes:<profile>:<source>`, `openclaw:<channel>`. Two or more leading letters
+ * so a Windows drive letter (`c:/code`) can never match.
+ */
+const SYNTHETIC_PROJECT_PATH = /^[a-z]{2,}:/;
+
+/**
+ * Whether a project `path` is a synthetic gateway path rather than a real
+ * filesystem path — `hermes:<profile>:<source>`, `openclaw:<agent>:<channel>`.
+ *
+ * These are the only projects with a meaningful segment hierarchy, so this is
+ * also what decides which rows the projects panel renders as a folder tree.
+ */
+export function isSyntheticProjectPath(path?: string): boolean {
+  return !!path && SYNTHETIC_PROJECT_PATH.test(path);
+}
+
+/** Segments of a synthetic gateway path, outermost first. `[]` for real paths. */
+export function syntheticPathSegments(path?: string): string[] {
+  return isSyntheticProjectPath(path) ? path!.split(":") : [];
+}
+
+/**
+ * Label to display for a project card.
+ *
+ * Filesystem-backed projects decode their folder name. Gateway projects must
+ * NOT: `decodeFolderName` turns every `-` into `/`, which splits a Hermes
+ * profile named `my-bot` into `my/bot`. Their `path` already carries the
+ * segments explicitly, so use it.
+ */
+export function projectDisplayName(name: string, path?: string): string {
+  if (isSyntheticProjectPath(path)) return path!.replace(/:/g, "/");
+  return decodeFolderName(name);
+}
+
 /**
  * Encodes a filesystem path into a Claude-compatible project folder name.
  * Inverse of `decodeFolderName`.