failproofai 0.0.14 → 0.0.15-beta.0

package/lib/paths.ts

@@ -29,6 +29,42 @@ export function decodeFolderName(name: string): string {
   return name.replace(/-/g, "/");
 }
 
+/**
+ * Synthetic project path for gateway CLIs with no working directory —
+ * `hermes:<profile>:<source>`, `openclaw:<channel>`. Two or more leading letters
+ * so a Windows drive letter (`c:/code`) can never match.
+ */
+const SYNTHETIC_PROJECT_PATH = /^[a-z]{2,}:/;
+
+/**
+ * Whether a project `path` is a synthetic gateway path rather than a real
+ * filesystem path — `hermes:<profile>:<source>`, `openclaw:<agent>:<channel>`.
+ *
+ * These are the only projects with a meaningful segment hierarchy, so this is
+ * also what decides which rows the projects panel renders as a folder tree.
+ */
+export function isSyntheticProjectPath(path?: string): boolean {
+  return !!path && SYNTHETIC_PROJECT_PATH.test(path);
+}
+
+/** Segments of a synthetic gateway path, outermost first. `[]` for real paths. */
+export function syntheticPathSegments(path?: string): string[] {
+  return isSyntheticProjectPath(path) ? path!.split(":") : [];
+}
+
+/**
+ * Label to display for a project card.
+ *
+ * Filesystem-backed projects decode their folder name. Gateway projects must
+ * NOT: `decodeFolderName` turns every `-` into `/`, which splits a Hermes
+ * profile named `my-bot` into `my/bot`. Their `path` already carries the
+ * segments explicitly, so use it.
+ */
+export function projectDisplayName(name: string, path?: string): string {
+  if (isSyntheticProjectPath(path)) return path!.replace(/:/g, "/");
+  return decodeFolderName(name);
+}
+
 /**
  * Encodes a filesystem path into a Claude-compatible project folder name.
  * Inverse of `decodeFolderName`.

package/lib/project-tree.ts

@@ -0,0 +1,193 @@
+/**
+ * Folder tree for the projects panel.
+ *
+ * Gateway CLIs (Hermes, OpenClaw) are USER-scoped: their sessions have no
+ * working directory, so they can't sit in the cwd-based project model the other
+ * CLIs use. What they have instead is a hierarchy — which profile/agent, then
+ * which channel — and that hierarchy is already encoded in the synthetic
+ * `path` those producers emit (`hermes:work:slack`,
+ * `openclaw:weather-bot:telegram`).
+ *
+ * So this is a pure PRESENTATION transform over the flat `ProjectFolder[]` the
+ * server already returns: split those paths into nodes, leave every real
+ * filesystem project as a top-level leaf. Nothing about project `name`s
+ * changes, which is what keeps existing `/project/<name>` links, bookmarks and
+ * stored audit history resolving.
+ *
+ * Pure and dependency-free on purpose — `import type` only, so the client
+ * bundle never pulls in `lib/projects.ts`'s node:fs imports.
+ */
+import type { ProjectCli, ProjectFolder } from "./projects";
+import { syntheticPathSegments } from "./paths";
+
+export interface ProjectTreeNode {
+  /** Colon-joined segment path (`hermes:work`) — stable across renders, used as
+   *  the React key and as the collapsed-state key. */
+  key: string;
+  /** The single segment this row shows (`work`), not the whole path. */
+  label: string;
+  /** 0 for top-level rows; each level below adds 1 (drives indentation). */
+  depth: number;
+  children: ProjectTreeNode[];
+  /** The real project, on rows that map to one. Leaves always have it; a folder
+   *  row has it only if a project exists at exactly that path. Rows without one
+   *  are pure grouping and must not link anywhere. */
+  project?: ProjectFolder;
+  /** Sessions beneath this row, summed. `undefined` when nothing underneath
+   *  reported a count — rendered as nothing rather than as `0`, since the two
+   *  mean very different things. */
+  sessionCount?: number;
+  /** How many real projects this row covers (1 for a leaf). Lets the caller
+   *  paginate over top-level rows while still reporting a project range. */
+  projectCount: number;
+  /** Newest activity anywhere beneath this row. */
+  lastModified: Date;
+  lastModifiedFormatted?: string;
+  /** Union of the CLIs beneath this row, in first-seen order. */
+  cli: ProjectCli[];
+}
+
+interface Builder {
+  key: string;
+  label: string;
+  depth: number;
+  children: Map<string, Builder>;
+  project?: ProjectFolder;
+  sessionCount?: number;
+  projectCount: number;
+  lastModified: Date;
+  lastModifiedFormatted?: string;
+  cli: string[];
+}
+
+function makeBuilder(key: string, label: string, depth: number): Builder {
+  return {
+    key,
+    label,
+    depth,
+    children: new Map(),
+    projectCount: 0,
+    lastModified: new Date(0),
+    cli: [],
+  };
+}
+
+/** Fold a project's stats into a node — newest date wins, counts add, CLIs union. */
+function absorb(node: Builder, folder: ProjectFolder): void {
+  if (folder.lastModified.getTime() > node.lastModified.getTime()) {
+    node.lastModified = folder.lastModified;
+    node.lastModifiedFormatted = folder.lastModifiedFormatted;
+  }
+  if (typeof folder.sessionCount === "number") {
+    node.sessionCount = (node.sessionCount ?? 0) + folder.sessionCount;
+  }
+  node.projectCount += 1;
+  for (const c of folder.cli) if (!node.cli.includes(c)) node.cli.push(c);
+}
+
+function finalize(node: Builder): ProjectTreeNode {
+  const children = [...node.children.values()]
+    .map(finalize)
+    .sort((a, b) => b.lastModified.getTime() - a.lastModified.getTime());
+  return {
+    key: node.key,
+    label: node.label,
+    depth: node.depth,
+    children,
+    project: node.project,
+    sessionCount: node.sessionCount,
+    projectCount: node.projectCount,
+    lastModified: node.lastModified,
+    lastModifiedFormatted: node.lastModifiedFormatted,
+    cli: node.cli as ProjectCli[],
+  };
+}
+
+/**
+ * Build the render tree for a list of projects (already filtered, sorted and
+ * paginated by the caller — this adds no policy of its own).
+ *
+ * Real filesystem projects become depth-0 leaves in input order-by-recency,
+ * exactly as the flat table showed them. Gateway projects nest under one node
+ * per path segment.
+ */
+export function buildProjectTree(folders: ProjectFolder[]): ProjectTreeNode[] {
+  const roots = new Map<string, Builder>();
+
+  for (const folder of folders) {
+    const segments = syntheticPathSegments(folder.path);
+
+    if (segments.length === 0) {
+      // Real filesystem project — a top-level leaf, keyed by name so two
+      // projects with an identical path (or none) can't collide.
+      const node = makeBuilder(`project:${folder.name}`, folder.name, 0);
+      node.project = folder;
+      absorb(node, folder);
+      roots.set(node.key, node);
+      continue;
+    }
+
+    let level = roots;
+    let key = "";
+    let node: Builder | undefined;
+    for (let depth = 0; depth < segments.length; depth++) {
+      const label = segments[depth];
+      key = depth === 0 ? label : `${key}:${label}`;
+      let next = level.get(key);
+      if (!next) {
+        next = makeBuilder(key, label, depth);
+        level.set(key, next);
+      }
+      // Every ancestor rolls up the project's stats, so a collapsed folder still
+      // reports the freshest activity and total sessions underneath it.
+      absorb(next, folder);
+      node = next;
+      level = next.children;
+    }
+    // The deepest segment IS this project. Guard against two projects claiming
+    // the same path (shouldn't happen post-merge, but silently losing one would
+    // be worse than keeping the first).
+    if (node && !node.project) node.project = folder;
+  }
+
+  return [...roots.values()]
+    .map(finalize)
+    .sort((a, b) => b.lastModified.getTime() - a.lastModified.getTime());
+}
+
+/**
+ * Flatten the tree to the rows actually rendered, honouring collapsed state.
+ *
+ * We track COLLAPSED rather than expanded keys deliberately: a profile or agent
+ * that appears for the first time should be visible, not hidden behind a click
+ * the user doesn't know to make.
+ */
+export function visibleTreeRows(
+  nodes: ProjectTreeNode[],
+  isCollapsed: (key: string) => boolean,
+): ProjectTreeNode[] {
+  const out: ProjectTreeNode[] = [];
+  const walk = (list: ProjectTreeNode[]) => {
+    for (const node of list) {
+      out.push(node);
+      if (node.children.length > 0 && !isCollapsed(node.key)) walk(node.children);
+    }
+  };
+  walk(nodes);
+  return out;
+}
+
+/** Keys of every node that has children — i.e. every collapsible row. */
+export function collapsibleKeys(nodes: ProjectTreeNode[]): string[] {
+  const out: string[] = [];
+  const walk = (list: ProjectTreeNode[]) => {
+    for (const node of list) {
+      if (node.children.length > 0) {
+        out.push(node.key);
+        walk(node.children);
+      }
+    }
+  };
+  walk(nodes);
+  return out;
+}

package/lib/projects.ts

@@ -29,6 +29,20 @@ export interface ProjectFolder {
    * the same cwd has transcripts from more than one CLI; rendered as badges.
    */
   cli: ProjectCli[];
+  /**
+   * How many sessions this project holds.
+   *
+   * Only the GATEWAY producers (Hermes, OpenClaw) fill this in, because only
+   * they render as a folder tree where a collapsed row has to say how much is
+   * underneath it — and for them the count is free, since their grouping loop
+   * already visits every session. The cwd-based CLIs leave it undefined and the
+   * UI renders nothing, rather than a `0` that would read as "empty".
+   *
+   * Deliberately NOT filled for Claude: counting there needs an extra readdir
+   * per project folder, and a number that exists for some CLIs and not others
+   * would sum to a wrong-but-plausible total on a merged row.
+   */
+  sessionCount?: number;
 }
 
 export interface SessionFile {
@@ -126,6 +140,14 @@ function mergeProjectFolders(...sources: ProjectFolder[][]): ProjectFolder[] {
         cli: mergedCli,
         lastModified: newer.lastModified,
         lastModifiedFormatted: newer.lastModifiedFormatted,
+        // Spreading `existing` alone would silently keep only the FIRST source's
+        // count for a name several CLIs contribute to, so sum explicitly. Stays
+        // undefined unless at least one side reported a count — `0` would claim
+        // "no sessions" for producers that simply don't count.
+        sessionCount:
+          existing.sessionCount === undefined && f.sessionCount === undefined
+            ? undefined
+            : (existing.sessionCount ?? 0) + (f.sessionCount ?? 0),
       });
     }
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "failproofai",
-  "version": "0.0.14",
+  "version": "0.0.15-beta.0",
   "description": "The easiest way to manage policies that keep your AI agents reliable, on-task, and running autonomously — for Claude Code & the Agents SDK",
   "bin": {
     "failproofai": "./dist/cli.mjs"
@@ -71,7 +71,7 @@
     "access": "public"
   },
   "devDependencies": {
-    "@anthropic-ai/sdk": "^0.112.4",
+    "@anthropic-ai/sdk": "^0.115.0",
     "@mdx-js/mdx": "^3.1.1",
     "@tailwindcss/postcss": "^4.3.1",
     "@tanstack/react-virtual": "^3.14.3",
@@ -85,9 +85,9 @@
     "clsx": "^2.1.1",
     "eslint": "^10.5.0",
     "eslint-config-next": "^16.2.9",
-    "jsdom": "^29.1.1",
+    "jsdom": "^30.0.0",
     "lucide-react": "^1.18.0",
-    "next": "^16.2.9",
+    "next": "^16.2.11",
     "react": "^19.2.4",
     "react-dom": "^19.2.4",
     "tailwind-merge": "^3.4.0",
@@ -103,10 +103,11 @@
     "yaml": "^2.9.0"
   },
   "overrides": {
-    "postcss": "8.5.14",
+    "postcss": "8.5.23",
     "eslint-plugin-react-hooks": "7.0.1",
     "vite": "8.0.16",
     "undici": "7.28.0",
-    "brace-expansion": "5.0.7"
+    "brace-expansion": "5.0.8",
+    "sharp": "0.35.0"
   }
 }

package/pi-extension/index.ts

@@ -347,6 +347,10 @@ export default function failproofaiBridge(pi: PiExtensionApi) {
       cwd: resolveCwd(e.cwd),
       hook_event_name: "PreToolUse",
     });
+    // `ToolCallEventResult` is `{block?, reason?}` (extensions/types.d.ts:766).
+    // agent-loop.ts branches on `beforeResult?.block`, so this is the shape that
+    // stops the tool. Do NOT put the user_bash full-replacement shape here — it
+    // has no `block` field, so the call would sail straight through.
     if (decision.block) return { block: true, reason: decision.reason };
     return undefined;
   });
@@ -361,12 +365,38 @@ export default function failproofaiBridge(pi: PiExtensionApi) {
       cwd: resolveCwd(e.cwd),
       hook_event_name: "PreToolUse",
     });
-    if (decision.block) return { block: true, reason: decision.reason };
+    // `UserBashEventResult` is `{operations?, result?: BashResult}` — there is
+    // no `block` field, so the `{block:true}` we used to return matched nothing
+    // and the command ran anyway. The supported way to stop it is a FULL
+    // REPLACEMENT result: the extension declares it handled execution, so Pi
+    // uses this instead of running the command. Verified against the installed
+    // pi-coding-agent d.ts (extensions/types.d.ts:772, core/bash-executor.d.ts:15).
+    if (decision.block) {
+      return {
+        result: {
+          output: decision.reason ?? "Blocked by failproofai",
+          exitCode: 1,
+          cancelled: false,
+          truncated: false,
+        },
+      };
+    }
     return undefined;
   });
 
-  // input → UserPromptSubmit. Honor block decisions if Pi accepts them
-  // (Pi's docs describe block on input but it's not exhaustively tested).
+  // input → UserPromptSubmit.
+  //
+  // `InputEventResult` is `{action:"continue"|"transform"|"handled"}`
+  // (extensions/types.d.ts:629) — there is NO `block` field, so the
+  // `{block:true}` we used to return matched neither branch and every prompt
+  // was submitted regardless of the verdict. `{action:"handled"}` is the only
+  // stop: it tells Pi an extension consumed the input, so nothing is sent to
+  // the model.
+  //
+  // Known UX limitation: `handled` drops the prompt silently — Pi shows the
+  // user nothing. We log the reason to stderr so it is at least recoverable
+  // from the session output. Pi has no first-class channel for explaining a
+  // refusal at this event; if one appears, prefer it over the silent drop.
   pi.on("input", (event: unknown): unknown => {
     const e = event as PiInputEvent;
     const decision = callPolicy("input", {
@@ -375,8 +405,11 @@ export default function failproofaiBridge(pi: PiExtensionApi) {
       cwd: resolveCwd(e.cwd),
       hook_event_name: "UserPromptSubmit",
     });
-    if (decision.block) return { block: true, reason: decision.reason };
-    return undefined;
+    if (decision.block) {
+      console.error(`[failproofai] prompt blocked: ${decision.reason ?? "blocked by policy"}`);
+      return { action: "handled" };
+    }
+    return { action: "continue" };
   });
 
   // session_start → SessionStart. Observe-only; we still forward so the

package/scripts/launch.ts

@@ -89,6 +89,13 @@ export function launch(mode: "dev" | "start"): void {
     stdio: filterLogs ? ["inherit", "pipe", "pipe"] : "inherit",
     env: {
       ...process.env,
+      // `.next/standalone/server.js` does `process.chdir(__dirname)` on its
+      // first line, so by the time a server action runs, `process.cwd()` is the
+      // PACKAGE directory, not the directory the user launched from. Anything
+      // resolving project-scope paths from cwd would look inside the installed
+      // package and find nothing. Capture the real cwd here, before the child
+      // starts, the same way FAILPROOFAI_PACKAGE_ROOT is threaded through.
+      FAILPROOFAI_LAUNCH_CWD: process.env.FAILPROOFAI_LAUNCH_CWD ?? process.cwd(),
       ...(filterLogs ? { FORCE_COLOR: process.env.FORCE_COLOR ?? "1" } : {}),
       ...(loggingLevel ? { FAILPROOFAI_LOG_LEVEL: loggingLevel } : {}),
       ...(disableTelemetry ? { FAILPROOFAI_TELEMETRY_DISABLED: "1" } : {}),

package/src/audit/cli-adapters/hermes.ts

@@ -8,9 +8,11 @@
  * `logEntriesToEvents` handles the rest.
  *
  * Gateway sessions have no `cwd` (Slack/Telegram runs aren't in a repo), so they
- * group by `source` (slack/telegram/cli/cron) instead of working directory.
+ * group by (profile, `source`) instead of working directory — a Hermes profile
+ * is a whole separate home dir with its own state.db (lib/hermes-profiles.ts).
  */
 import { getHermesSessions } from "../../../lib/hermes-projects";
+import { hermesProjectPath } from "../../../lib/hermes-profiles";
 import { getHermesSessionLog } from "../../../lib/hermes-sessions";
 import type { NormalizedToolEvent, TranscriptMetadata } from "../types";
 import type { ListOpts } from "./claude";
@@ -31,8 +33,9 @@ export async function listHermesTranscriptMetadata(
     if (s.messageCount <= 0 && !s.hasMessages) continue; // empty → no events (message_count can lag; trust real messages)
     out.push({
       cli: "hermes",
-      // Group by channel; gateway sessions are cwd-less.
-      projectName: s.source ? `hermes:${s.source}` : "hermes",
+      // Group by (profile, channel); gateway sessions are cwd-less, and each
+      // profile is a separate Hermes home with its own state.db.
+      projectName: s.source ? hermesProjectPath(s.profile, s.source) : `hermes:${s.profile}`,
       sessionId: s.sessionId,
       transcriptPath: `hermes://${s.sessionId}`,
       mtimeMs: s.mtimeMs,

package/src/audit/cli-adapters/openclaw.ts

@@ -7,13 +7,13 @@
  * shared LogEntry[] shape, so `logEntriesToEvents` handles the rest.
  *
  * Gateway sessions run in the container workspace, not a host repo, so they
- * group by agentId (`openclaw:<agentId>`) and contribute nothing to a
- * cwd-scoped audit.
+ * group by (agentId, channel) — `openclaw:<agentId>:<channel>` — and contribute
+ * nothing to a cwd-scoped audit. That is the SAME key the dashboard groups by;
+ * the two used to disagree (adapter by agent, panel by channel), so a report and
+ * the projects panel sliced identical data on different axes.
  */
-import {
-  listOpenClawTranscripts,
-  getOpenClawSessionLog,
-} from "../../../lib/openclaw-sessions";
+import { getOpenClawSessions, openClawProjectPath } from "../../../lib/openclaw-projects";
+import { getOpenClawSessionLog } from "../../../lib/openclaw-sessions";
 import type { NormalizedToolEvent, TranscriptMetadata } from "../types";
 import type { ListOpts } from "./claude";
 import { logEntriesToEvents } from "./shared";
@@ -28,15 +28,19 @@ export async function listOpenClawTranscriptMetadata(
 
   const sinceMs = opts.sinceMs ?? 0;
   const out: TranscriptMetadata[] = [];
-  for (const t of listOpenClawTranscripts()) {
-    if (t.mtimeMs < sinceMs) continue;
+  // getOpenClawSessions layers the per-agent sessions.json index over the same
+  // transcript walk, which is what carries `channel`. It reads one small index
+  // file per AGENT (not per session) and is memoized, so grouping by channel
+  // costs no meaningful extra IO on the audit path.
+  for (const s of await getOpenClawSessions()) {
+    if (s.mtimeMs < sinceMs) continue;
     out.push({
       cli: "openclaw",
-      projectName: `openclaw:${t.agentId}`,
-      sessionId: t.sessionId,
-      transcriptPath: t.transcriptPath,
-      mtimeMs: t.mtimeMs,
-      sizeBytes: t.sizeBytes,
+      projectName: openClawProjectPath(s.agentId, s.channel),
+      sessionId: s.sessionId,
+      transcriptPath: s.transcriptPath,
+      mtimeMs: s.mtimeMs,
+      sizeBytes: s.sizeBytes,
     });
   }
   return out;

package/src/hooks/configure-wizard.ts

@@ -29,6 +29,8 @@ import {
 import {
   detectInstalledClis,
   getIntegration,
+  settingsPathsFor,
+  unhookedHermesProfiles,
 } from "./integrations";
 import { INTEGRATION_TYPES, type IntegrationType, type HookScope } from "./types";
 import { installHooks } from "./manager";
@@ -126,12 +128,28 @@ export function buildAgentChoices(scope: HookScope, cwd: string): MultiChoice<In
     } catch {
       installedHere = false;
     }
+    // Hermes reports installed only when EVERY profile is hooked, so a profile
+    // added after install flips it to false. Say which ones, otherwise a mostly
+    // configured gateway just reads as "not configured".
+    let partialHint: string | undefined;
+    if (id === "hermes" && !installedHere) {
+      try {
+        const unhooked = unhookedHermesProfiles();
+        if (unhooked.length > 0) {
+          partialHint = `${unhooked.length} unhooked profile(s): ${unhooked.join(", ")}`;
+        }
+      } catch {
+        // Profile discovery is best-effort — never block the wizard.
+      }
+    }
     return {
       label: integration.displayName,
       value: id,
       checked: isDetected || installedHere,
       section: isDetected ? "Detected" : "Not installed · set up ahead of time",
-      hint: installedHere ? "already configured" : isDetected ? undefined : "not on PATH",
+      hint: installedHere
+        ? "already configured"
+        : (partialHint ?? (isDetected ? undefined : "not on PATH")),
     };
   });
 }
@@ -322,7 +340,11 @@ export function reviewLines(state: {
   lines.push("  This will update:");
   for (const cli of clis) {
     const integration = getIntegration(cli);
-    lines.push(`    ${homeify(integration.getSettingsPath(scope, cwd))}   ${integration.displayName} hooks`);
+    // Usually one path; Hermes lists one per profile so the operator sees every
+    // home dir that is about to be written.
+    for (const p of settingsPathsFor(integration, scope, cwd)) {
+      lines.push(`    ${homeify(p)}   ${integration.displayName} hooks`);
+    }
   }
   lines.push(`    ${homeify(getConfigPathForScope(scope, cwd))}   ${policies.length} policies`);
   return lines;

package/src/hooks/custom-hooks-loader.ts

@@ -27,6 +27,14 @@ const LOADING_KEY = "__FAILPROOFAI_LOADING_HOOKS__";
 /** Regex matching convention policy filenames: *policies.{js,mjs,ts} */
 const CONVENTION_FILE_RE = /policies\.(js|mjs|ts)$/;
 
+/**
+ * Monotonic counter used to cache-bust each dynamic import. Loading N files
+ * creates N module instances rather than reusing one; every caller here is
+ * either a one-shot CLI command or a short-lived hook process, so the
+ * lifetime cost is bounded by the process, not by uptime.
+ */
+let loadSequence = 0;
+
 /** Script extensions we could load, used to spot near-miss filenames. */
 const LOADABLE_EXT_RE = /\.(js|mjs|ts)$/;
 
@@ -96,7 +104,19 @@ async function loadSingleFile(
     tmpFiles = await rewriteFileTree(absPath, distUrl, distIndex);
 
     const entryTmp = absPath + TMP_SUFFIX;
-    const fileUrl = pathToFileURL(entryTmp).href;
+    // Cache-bust the specifier. NOTE this works under Node but NOT under Bun,
+    // which caches by resolved path and ignores the query — and the shipped
+    // binary runs under Bun. It is kept because it makes repeat loads behave
+    // the same on both runtimes where it can, but nothing may DEPEND on a
+    // repeat load re-executing; callers dedupe paths instead (see above).
+    // The temp path is deterministic, so a second
+    // load of the same file inside one process hit the ESM module cache, the
+    // module body never re-ran, no `customPolicies.add` fired, and the caller
+    // saw zero hooks — indistinguishable from a broken policy file. That is
+    // exactly what `failproofai policies` rendered as "failed to load" for
+    // every file when it walked a shared project/user directory twice.
+    // A distinct query string makes it a distinct module to the loader.
+    const fileUrl = `${pathToFileURL(entryTmp).href}?v=${++loadSequence}`;
     await import(/* webpackIgnore: true */ fileUrl);
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
@@ -201,12 +221,20 @@ export async function loadAllCustomHooks(
   // purpose, so switching off *discovery* shouldn't silently drop it too.
   const conventionEnabled = opts?.customPoliciesEnabled !== false;
 
+  // Every file already imported this call, by resolved absolute path. Loading
+  // one twice is never right: `customPolicies.add` is an unconditional push, so
+  // the second import registers every hook a second time and the policy runs
+  // twice per event. Seeded by the explicit path below and consulted by both
+  // convention passes.
+  const loadedPaths = new Set<string>();
+
   // 1. Explicit customPoliciesPath (existing behavior)
   if (customPoliciesPath) {
     const absPath = isAbsolute(customPoliciesPath)
       ? customPoliciesPath
       : resolve(projectRoot, customPoliciesPath);
     if (existsSync(absPath)) {
+      loadedPaths.add(absPath);
       await loadSingleFile(absPath);
     } else {
       hookLogWarn(`customPoliciesPath not found: ${absPath}`);
@@ -216,10 +244,19 @@ export async function loadAllCustomHooks(
   const hooksBeforeConvention = getCustomHooks().length;
 
   // 2. Project convention: {projectRoot}/.failproofai/policies/*policies.{js,mjs,ts}
+  //
+  // A `customPoliciesPath` pointing INTO this directory at a file whose name
+  // also matches the convention (`*policies.{js,mjs,ts}`) is an ordinary setup —
+  // `failproofai policies -i -c .failproofai/policies/my-policies.mjs` produces
+  // exactly that — and it is discovered here as well. Skip what step 1 loaded,
+  // or the file is imported twice and every hook in it fires twice per event.
   const projectDir = resolve(projectRoot, ".failproofai", "policies");
   if (conventionEnabled) warnSkippedPolicyFiles(projectDir, "project");
-  const projectFiles = conventionEnabled ? discoverPolicyFiles(projectDir) : [];
+  const projectFiles = conventionEnabled
+    ? discoverPolicyFiles(projectDir).filter((f) => !loadedPaths.has(f))
+    : [];
   for (const file of projectFiles) {
+    loadedPaths.add(file);
     const hooksBefore = getCustomHooks().length;
     await loadSingleFile(file, { conventionScope: "project" });
     const newHooks = getCustomHooks().slice(hooksBefore);
@@ -233,10 +270,27 @@ export async function loadAllCustomHooks(
   }
 
   // 3. User convention: ~/.failproofai/policies/*policies.{js,mjs,ts}
+  //
+  // Skipped entirely when it resolves to the directory already loaded above —
+  // which happens whenever the project root IS the home directory, a normal
+  // setup for a gateway. Without this, every file is loaded a second time and
+  // `customPolicies.add` (an unconditional push) registers each hook twice, so
+  // every policy fires twice per event. For a counting policy that means the
+  // count doubles and its ceiling trips at half the real number.
+  //
+  // Today that is masked by the runtime rather than prevented: Bun caches
+  // dynamic imports by resolved path and IGNORES the `?v=` cache-buster below,
+  // so the second import is a no-op — but Node honours the query and would
+  // double-register. The binary runs under Bun and the tests under Node, so the
+  // bug is invisible from both sides. Do not rely on that; dedupe the paths.
   const userDir = resolve(homedir(), ".failproofai", "policies");
-  if (conventionEnabled) warnSkippedPolicyFiles(userDir, "user");
-  const userFiles = conventionEnabled ? discoverPolicyFiles(userDir) : [];
+  if (conventionEnabled && userDir !== projectDir) warnSkippedPolicyFiles(userDir, "user");
+  const userFiles =
+    conventionEnabled && userDir !== projectDir
+      ? discoverPolicyFiles(userDir).filter((f) => !loadedPaths.has(f))
+      : [];
   for (const file of userFiles) {
+    loadedPaths.add(file);
     const hooksBefore = getCustomHooks().length;
     await loadSingleFile(file, { conventionScope: "user" });
     const newHooks = getCustomHooks().slice(hooksBefore);