failproofai 1.0.12-beta.2 → 1.0.12

package/dist/worker.mjs

@@ -1166,7 +1166,7 @@ function instruct(reason) {
 }
 
 // package.json
-var version = "1.0.12-beta.2";
+var version = "1.0.12";
 var init_package = () => {};
 
 // src/hooks/agent-targets.ts
@@ -15706,6 +15706,7 @@ __export(exports_intent, {
   cleanHumanTurn: () => cleanHumanTurn,
   cleanUserSaid: () => cleanUserSaid,
   humanMessageText: () => humanMessageText,
+  intentProfileKey: () => intentProfileKey,
   lastAgentMessage: () => lastAgentMessage,
   looseIntentStoreDir: () => looseIntentStoreDir,
   pruneExpiredSessions: () => pruneExpiredSessions,
@@ -15725,13 +15726,27 @@ import {
   writeFileSync as writeFileSync8
 } from "node:fs";
 import { dirname as dirname10, resolve as resolve17 } from "node:path";
+function intentProfileKey(profile) {
+  if (validAgentIdentity(profile.agent))
+    return `${profile.agent.integration}.${profile.agent.instanceId}`;
+  return isKnownCli(profile.cli) ? profile.cli : null;
+}
+function storeSlot(sessionId, profile) {
+  if (profile === undefined)
+    return { dir: sessionsDir(), file: resolve17(sessionsDir(), `${sessionId}.json`) };
+  const key = intentProfileKey(profile);
+  if (key === null || !PROFILE_DIR_RE.test(key))
+    return null;
+  const dir = resolve17(sessionsDir(), key);
+  return { dir, file: resolve17(dir, `${sessionId}.json`) };
+}
 function modesAreMeaningful2() {
   return process.platform !== "win32";
 }
-function storeDirChain() {
+function storeDirChain(innermost = sessionsDir()) {
   const home = resolve17(failproofaiHome());
   const chain = [];
-  let dir = sessionsDir();
+  let dir = innermost;
   for (let i = 0;i < 8; i++) {
     chain.push(dir);
     if (dir === home)
@@ -15743,10 +15758,10 @@ function storeDirChain() {
   }
   return chain;
 }
-function looseIntentStoreDir() {
+function looseIntentStoreDir(innermost) {
   if (!modesAreMeaningful2())
     return null;
-  for (const dir of storeDirChain()) {
+  for (const dir of storeDirChain(innermost)) {
     let mode;
     try {
       mode = statSync20(dir).mode & 511;
@@ -15765,23 +15780,22 @@ function looseIntentStoreDir() {
   }
   return null;
 }
-function readIntentFile(sessionId) {
+function readIntentFile(slot) {
   try {
-    const parsed = JSON.parse(readFileSync19(intentFile(sessionId), "utf8"));
+    const parsed = JSON.parse(readFileSync19(slot.file, "utf8"));
     return Array.isArray(parsed?.prompts) ? parsed : { prompts: [] };
   } catch {
     return { prompts: [] };
   }
 }
-function appendPrompt(sessionId, entry) {
+function appendPrompt(slot, entry) {
   try {
-    const file = readIntentFile(sessionId);
+    const file = readIntentFile(slot);
     const last = file.prompts[file.prompts.length - 1];
     const kept = last && last.text === entry.text ? file.prompts.slice(0, -1) : file.prompts;
     file.prompts = [...kept, entry].slice(-MAX_RECORDED_PROMPTS);
-    const dir = sessionsDir();
-    mkdirSync9(dir, { recursive: true, mode: 448 });
-    const target = intentFile(sessionId);
+    mkdirSync9(slot.dir, { recursive: true, mode: 448 });
+    const target = slot.file;
     const isNew = !fileExists2(target);
     const tmp = `${target}.${process.pid}.tmp`;
     writeFileSync8(tmp, JSON.stringify(file), { mode: 384 });
@@ -15802,9 +15816,24 @@ function fileExists2(path) {
   }
 }
 function pruneExpiredSessions(now = Date.now()) {
+  const root = sessionsDir();
+  let removed = pruneDir(root, now);
+  try {
+    for (const name of readdirSync13(root)) {
+      if (!PROFILE_DIR_RE.test(name))
+        continue;
+      const dir = resolve17(root, name);
+      try {
+        if (statSync20(dir).isDirectory())
+          removed += pruneDir(dir, now);
+      } catch {}
+    }
+  } catch {}
+  return removed;
+}
+function pruneDir(dir, now) {
   let removed = 0;
   try {
-    const dir = sessionsDir();
     for (const name of readdirSync13(dir)) {
       if (!SESSION_FILE_RE3.test(name))
         continue;
@@ -15820,23 +15849,29 @@ function pruneExpiredSessions(now = Date.now()) {
   } catch {}
   return removed;
 }
-function recordPrompt(sessionId, prompt, agent, now) {
+function recordPrompt(sessionId, profile, prompt, agent, now) {
   if (!SESSION_ID_RE2.test(sessionId))
     return false;
   if (prompt.trim().length === 0)
     return false;
+  const slot = storeSlot(sessionId, profile);
+  if (!slot)
+    return false;
   try {
-    return appendPrompt(sessionId, { at: now, text: storable(prompt.trim()), agent: agent === null ? null : storable(agent) });
+    return appendPrompt(slot, { at: now, text: storable(prompt.trim()), agent: agent === null ? null : storable(agent) });
   } catch {
     return false;
   }
 }
-function livePrompts(sessionId, now) {
+function livePrompts(sessionId, now, profile) {
   if (!sessionId || !SESSION_ID_RE2.test(sessionId))
     return [];
-  if (looseIntentStoreDir() !== null)
+  const slot = storeSlot(sessionId, profile);
+  if (!slot)
     return [];
-  return readIntentFile(sessionId).prompts.filter((p) => typeof p?.text === "string" && typeof p.at === "number" && now - p.at <= INTENT_MAX_AGE_MS && p.at - now <= MAX_CLOCK_SKEW_MS);
+  if (looseIntentStoreDir(slot.dir) !== null)
+    return [];
+  return readIntentFile(slot).prompts.filter((p) => typeof p?.text === "string" && typeof p.at === "number" && now - p.at <= INTENT_MAX_AGE_MS && p.at - now <= MAX_CLOCK_SKEW_MS);
 }
 function replaceTagBlocks(text, tag, replace, attributes = false) {
   const open = attributes ? `<${tag}` : `<${tag}>`;
@@ -16183,16 +16218,16 @@ function captureIntent(ev, now = Date.now()) {
     const cleaned = cleanHumanTurn(raw);
     if (cleaned === null)
       return;
-    recordPrompt(sessionId, cleaned, lastAgentMessage(ev.transcriptPath), now);
+    recordPrompt(sessionId, ev.profile, cleaned, lastAgentMessage(ev.transcriptPath), now);
   } catch {}
 }
-function readIntent(sessionId, now = Date.now()) {
-  const prompts = livePrompts(sessionId, now);
+function readIntent(sessionId, now = Date.now(), profile) {
+  const prompts = livePrompts(sessionId, now, profile);
   const latest = prompts[prompts.length - 1];
   const agent = latest && typeof latest.agent === "string" && latest.agent.length > 0 ? latest.agent : null;
   return { userSaid: prompts.map((p) => p.text), agentLastMessage: agent };
 }
-var MAX_RECORDED_PROMPTS = 5, INTENT_MAX_AGE_MS, MAX_CLOCK_SKEW_MS, SESSION_ID_RE2, sessionsDir = () => resolve17(semanticDir(), "sessions"), intentFile = (sessionId) => resolve17(sessionsDir(), `${sessionId}.json`), DIR_WRITABLE_BY_OTHERS3 = 18, SESSION_FILE_RE3, NON_HUMAN_PREFIXES, CONTINUATION_PREFIX = "This session is being continued from a previous conversation", IDE_MACHINE_OPENERS, IDE_AMBIGUOUS_OPENERS, IDE_REQUEST_HEADINGS, obj = (v) => v && typeof v === "object" && !Array.isArray(v) ? v : undefined, CLAUDE_MACHINE_SOURCES, claudeMachineTurn = (payload) => typeof payload.source === "string" && CLAUDE_MACHINE_SOURCES.has(payload.source), piMachineTurn = (payload) => payload.input_source === "extension" || payload.source === "extension", openclawMachineRun = (payload) => {
+var MAX_RECORDED_PROMPTS = 5, INTENT_MAX_AGE_MS, MAX_CLOCK_SKEW_MS, SESSION_ID_RE2, sessionsDir = () => resolve17(semanticDir(), "sessions"), PROFILE_DIR_RE, DIR_WRITABLE_BY_OTHERS3 = 18, SESSION_FILE_RE3, NON_HUMAN_PREFIXES, CONTINUATION_PREFIX = "This session is being continued from a previous conversation", IDE_MACHINE_OPENERS, IDE_AMBIGUOUS_OPENERS, IDE_REQUEST_HEADINGS, obj = (v) => v && typeof v === "object" && !Array.isArray(v) ? v : undefined, CLAUDE_MACHINE_SOURCES, claudeMachineTurn = (payload) => typeof payload.source === "string" && CLAUDE_MACHINE_SOURCES.has(payload.source), piMachineTurn = (payload) => payload.input_source === "extension" || payload.source === "extension", openclawMachineRun = (payload) => {
   const meta = obj(payload.openclaw);
   if (!meta)
     return false;
@@ -16208,9 +16243,11 @@ var MAX_RECORDED_PROMPTS = 5, INTENT_MAX_AGE_MS, MAX_CLOCK_SKEW_MS, SESSION_ID_R
 var init_intent = __esm(() => {
   init_fp_home();
   init_envelope();
+  init_agent_targets();
   INTENT_MAX_AGE_MS = 6 * 60 * 60 * 1000;
   MAX_CLOCK_SKEW_MS = 5 * 60 * 1000;
   SESSION_ID_RE2 = /^[A-Za-z0-9._-]{1,128}$/;
+  PROFILE_DIR_RE = /^[a-z]+(?:\.agt_[0-9a-f]{16,32})?$/;
   SESSION_FILE_RE3 = /^[A-Za-z0-9._-]{1,128}\.json(?:\.\d+\.tmp)?$/;
   NON_HUMAN_PREFIXES = [
     "<local-command-caveat>",
@@ -17939,7 +17976,10 @@ function startJevReview(cfg, call) {
   }
   let intent;
   try {
-    intent = intentReader.readIntent(call.sessionId);
+    intent = intentReader.readIntent(call.sessionId, undefined, {
+      cli: call.cli,
+      agent: call.agent !== undefined ? call.agent : call.cloud?.agent ?? null
+    });
   } catch {
     intent = { userSaid: [], agentLastMessage: null };
   }
@@ -18351,6 +18391,7 @@ async function startTwoTier(canonicalEventType, parsed, session, cli, opts, acti
       permissionMode: session.permissionMode,
       sessionId: session.sessionId,
       cli,
+      agent,
       ...loaded.cloud ? { cloud: loaded.cloud } : {},
       ...activePause ? { localPaused: true } : {}
     });
@@ -18377,13 +18418,16 @@ function jevTelemetry(activity) {
     return {};
   }
 }
-async function captureJevIntent(canonicalEventType, decision, parsed, session, cli, opts) {
+async function captureJevIntent(canonicalEventType, decision, parsed, session, cli, opts, agent) {
   if (canonicalEventType !== "UserPromptSubmit" || jevForcedOff(opts))
     return;
   try {
-    if (!cloudJevAsks(readCloudJevMode()) && !jevChecksInstalled())
+    const cloudAsks = cloudJevAsks(readCloudJevMode());
+    if (!cloudAsks && !jevChecksInstalled())
+      return;
+    if (cloudAsks && cloudJevAssignmentsFor(agent)?.length === 0 && !packJevChecksInstalled())
       return;
-    if (!await readJevConfig())
+    if (!await readJevConfig(agent))
       return;
     if (decision === "deny") {
       await Promise.resolve().then(() => init_enforcement_capability());
@@ -18397,7 +18441,8 @@ async function captureJevIntent(canonicalEventType, decision, parsed, session, c
       transcriptPath: session.transcriptPath,
       cli,
       payload: parsed,
-      prompt: parsed.prompt
+      prompt: parsed.prompt,
+      profile: { cli, agent }
     };
     captureIntent(event);
   } catch (err) {
@@ -18663,7 +18708,7 @@ async function evaluateHookEvent(eventType, cli = "claude", stdinPayload, opts)
     }
     const durationMs = Math.round(performance.now() - startTime);
     hookLogInfo(`result=${result.decision} policy=${result.policyName ?? "none"} duration=${durationMs}ms`);
-    await captureJevIntent(canonicalEventType, result.decision, parsed, session, cli, opts);
+    await captureJevIntent(canonicalEventType, result.decision, parsed, session, cli, opts, runtimeAgent);
     const matchedPolicies = matchedBeforeRelease ?? getPoliciesForEvent(canonicalEventType, parsed.tool_name).map((p) => p.name);
     const jevOrigin = result.policyName && result.twoTier?.decidedByJev ? result.twoTier.jevOrigin : undefined;
     const activityEntry = {

package/hermes-plugin/plugin.yaml

@@ -1,5 +1,5 @@
 name: failproofai
-version: 1.0.12-beta.2
+version: 1.0.12
 description: Real-time FailproofAI policy enforcement for Hermes
 manifest_version: 2
 api_version: 1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "failproofai",
-  "version": "1.0.12-beta.2",
+  "version": "1.0.12",
   "description": "Observability and enforcement for AI agent harnesses. 40 built-in policies hooked into 12 of them — Claude Code, Codex, Cursor, Hermes, OpenClaw and more — blocking the tool call before it runs. Local dashboard included, no account needed.",
   "bin": {
     "failproofai": "./dist/cli.mjs",
@@ -126,15 +126,15 @@
     "browserslist": "4.28.8"
   },
   "optionalDependencies": {
-    "@failproofai/failproofaid-linux-x64": "1.0.12-beta.2",
-    "@failproofai/failproofaid-linux-arm64": "1.0.12-beta.2",
-    "@failproofai/failproofaid-darwin-x64": "1.0.12-beta.2",
-    "@failproofai/failproofaid-darwin-arm64": "1.0.12-beta.2"
+    "@failproofai/failproofaid-linux-x64": "1.0.12",
+    "@failproofai/failproofaid-linux-arm64": "1.0.12",
+    "@failproofai/failproofaid-darwin-x64": "1.0.12",
+    "@failproofai/failproofaid-darwin-arm64": "1.0.12"
   },
   "failproofaidBinaries": {
-    "linux-x64": "4c09117fdb80d87792d1d2b77d9359cdbd0c522b5a6222ab7b927659130ddf54",
-    "linux-arm64": "dd390d76561267fc519ceb96fb90be340044e2f564bef36a44e284f227d93f29",
-    "darwin-x64": "62381f7ffe21d02289c36c4b205166b2867dbde986444d1ea185241b94fd04ef",
-    "darwin-arm64": "9ad798817d3048a5126e80dc71883538d37c1b6b6443e9c19389dc2583c8f675"
+    "linux-x64": "3b379ce2b03dd8a74393daed2c3120309f591fe6433e0c939d70c7b20da55be7",
+    "linux-arm64": "bd77d7fee68dc2723fb57cc9c7fcf957b7e939c797e61b099c412263880aa16e",
+    "darwin-x64": "fce3faab9406b1c2267955f0e07d04ef7a2b7a0b007e12ecd144fcfef563ebc8",
+    "darwin-arm64": "765732f8f64aa3d3dbd98e93b1aba71fc02956f65baeb73b08447b37fac3a17b"
   }
 }

package/src/hooks/agent-skill.ts

@@ -65,6 +65,9 @@ For focused work, read the matching skill too. Each has the same layout, with it
 - FailproofAI Cloud and the \`fp\` CLI: ${SKILLS_RAW}/fp-cloud-cli/SKILL.md
 - Adding the SDK to an agent, or running an evaluator: ${SKILLS_RAW}/failproofai-sdk/SKILL.md
 - Planning evaluations: ${SKILLS_RAW}/failproofai-eval-brainstorm/SKILL.md
+- Writing an evaluation: ${SKILLS_RAW}/failproofai-eval-author/SKILL.md
+- Writing an alert: ${SKILLS_RAW}/failproofai-alert-author/SKILL.md
+- Writing an audit: ${SKILLS_RAW}/failproofai-audit-author/SKILL.md
 `;
 
 /** An agent's own override for where it keeps its files, else the default. */

package/src/hooks/fp-home.ts

@@ -410,7 +410,7 @@ export const collectorHealthFile = (home?: string) => resolve(stateDir(home), "c
 /** Per-session enforcement pauses, keyed by a hash of the session id. */
 export const sessionPauseDir = () => resolve(stateDir(), "sessions");
 /**
- * The semantic (Jev) evaluator's local state: `sessions/<id>.json` holds the
+ * The semantic (Jev) evaluator's local state: `sessions/<profile>/<id>.json` holds the
  * human prompts recorded at `UserPromptSubmit`, and `verdicts.jsonl` one row
  * per semantic evaluation. Written only when a Jev config (BYOK) is present.
  */

package/src/hooks/handler.ts

@@ -505,6 +505,8 @@ async function startTwoTier(
       permissionMode: session.permissionMode,
       sessionId: session.sessionId,
       cli,
+      // The profile the intent store is read under: the one capture used.
+      agent,
       ...(loaded.cloud ? { cloud: loaded.cloud } : {}),
       // Cloud's checks are still asked; the installed packs' are not.
       ...(activePause ? { localPaused: true } : {}),
@@ -571,6 +573,15 @@ function jevTelemetry(activity: JevActivityFields | undefined): Record<string, u
  * marks that tell a human's prompt from a subagent's or an extension's are
  * elsewhere in it. `prompt` is §7's original field, still read by the
  * contract stub; T4's implementation reads `payload` and ignores it.
+ *
+ * The prompt is stored under the agent profile (`agent`, the runtime identity
+ * Cloud's targeting matches on) and read back by `startTwoTier` under the same
+ * one, so a prompt typed into one profile is never another's stated intent.
+ * Under a Cloud mode, a profile the deployment assigns no Cloud Jev check to,
+ * with no installed pack's check to review it either, has nothing that will
+ * ever read the prompt (`startTwoTier` returns before Jev for it), so nothing
+ * is kept: FailproofAI does not hold prompt text from a profile the
+ * deployment did not target.
  */
 async function captureJevIntent(
   canonicalEventType: string,
@@ -579,13 +590,20 @@ async function captureJevIntent(
   session: SessionMetadata,
   cli: IntegrationType,
   opts: EvaluateHookEventOptions | undefined,
+  agent: AgentIdentity | null,
 ): Promise<void> {
   if (canonicalEventType !== "UserPromptSubmit" || jevForcedOff(opts)) return;
   try {
     // Same gate as `startTwoTier`: a Cloud mode that asks needs what the human
     // typed whatever the installed packs declare.
-    if (!cloudJevAsks(readCloudJevMode()) && !jevChecksInstalled()) return;
-    if (!(await readJevConfig())) return;
+    const cloudAsks = cloudJevAsks(readCloudJevMode());
+    if (!cloudAsks && !jevChecksInstalled()) return;
+    // ...but not for a profile no Cloud Jev check targets and no installed
+    // pack's check reviews: `startTwoTier`'s own skip, without the pause
+    // (a pause can end while the session goes on). An older deployment with
+    // no assignment list (`null`) captures as before.
+    if (cloudAsks && cloudJevAssignmentsFor(agent)?.length === 0 && !packJevChecksInstalled()) return;
+    if (!(await readJevConfig(agent))) return;
     if (decision === "deny") {
       const { ENFORCEMENT_CAPABILITY } = await import("./enforcement-capability");
       if (ENFORCEMENT_CAPABILITY[cli]?.UserPromptSubmit === "block") return;
@@ -599,6 +617,7 @@ async function captureJevIntent(
       cli,
       payload: parsed,
       prompt: parsed.prompt,
+      profile: { cli, agent },
     };
     captureIntent(event);
   } catch (err) {
@@ -1180,7 +1199,7 @@ export async function evaluateHookEvent(
     const durationMs = Math.round(performance.now() - startTime);
     hookLogInfo(`result=${result.decision} policy=${result.policyName ?? "none"} duration=${durationMs}ms`);
 
-    await captureJevIntent(canonicalEventType, result.decision, parsed, session, cli, opts);
+    await captureJevIntent(canonicalEventType, result.decision, parsed, session, cli, opts, runtimeAgent);
 
     // Which policies actually ran for this event, regardless of how they
     // decided. `result.policyName` names only the decider — null on a plain

package/src/hooks/semantic/intent.ts

@@ -81,6 +81,26 @@
  * Known limits.)
  *
  * Text inside a tool call claiming "the user approved this" is never consulted.
+ *
+ * WHOSE SESSION IT IS. Prompts are stored per AGENT PROFILE and session id
+ * (`sessions/<profile>/<sessionId>.json`), the profile being the runtime agent
+ * identity FailproofAI Cloud's agent targeting uses (`AgentIdentity`, read by
+ * the handler from the daemon's roster) — `<integration>.<instanceId>`, or the
+ * bare integration name when the profile has no rostered identity. Session ids
+ * are chosen by the harness, not by us, so two profiles can submit the same
+ * one; keyed by session id alone, a prompt typed into a profile a Cloud Jev
+ * deployment does NOT target could be read back as the stated intent of one it
+ * does, and clear a reviewable deny there. The hook path always names the
+ * profile on both sides (`captureIntent`'s `profile`, `readIntent`'s), so a
+ * prompt is only ever read by the profile it was typed into.
+ *
+ * The flat `sessions/<sessionId>.json` layout that came before is the store a
+ * caller that names NO profile still reads and writes (library and test use).
+ * The hook path never reads it: such a file cannot say which profile wrote it,
+ * so a pre-upgrade entry is ignored rather than guessed at, and expires under
+ * the six-hour sweep like any other. The cost is bounded and fail-closed: a
+ * session in flight across the upgrade judges with no stated intent until its
+ * next prompt is recorded.
  */
 import {
   chmodSync,
@@ -99,6 +119,7 @@ import { dirname, resolve } from "node:path";
 import { failproofaiHome, semanticDir } from "../fp-home";
 import type { IntegrationType } from "../types";
 import { MAX_USER_MESSAGE_CHARS, redactSecrets } from "./envelope";
+import { validAgentIdentity, type AgentIdentity } from "../agent-targets";
 
 export const MAX_RECORDED_PROMPTS = 5;
 /** Older than this and a prompt no longer describes what the agent is doing. */
@@ -109,7 +130,51 @@ const MAX_CLOCK_SKEW_MS = 5 * 60 * 1000;
 const SESSION_ID_RE = /^[A-Za-z0-9._-]{1,128}$/;
 
 const sessionsDir = (): string => resolve(semanticDir(), "sessions");
-const intentFile = (sessionId: string): string => resolve(sessionsDir(), `${sessionId}.json`);
+
+/**
+ * The agent profile a prompt belongs to: the harness, and the runtime agent
+ * identity the handler resolved for it (`readRuntimeAgentIdentity`) — the same
+ * identity Cloud Jev's agent targeting matches on. `agent` null or absent is a
+ * profile with no rostered identity, which targeting treats as "unknown" and
+ * which is kept apart from every rostered one.
+ */
+export interface IntentProfile {
+  cli: string;
+  agent?: AgentIdentity | null;
+}
+
+/** A profile directory's name: `<integration>` or `<integration>.agt_<hex>`. */
+const PROFILE_DIR_RE = /^[a-z]+(?:\.agt_[0-9a-f]{16,32})?$/;
+
+/**
+ * The directory name a profile's prompts live under, or null when the profile
+ * cannot be named (an unknown harness): nothing is then recorded or read.
+ * Injective: integration names are lowercase letters and instance ids carry
+ * their own `agt_` prefix, so no two profiles share a directory.
+ */
+export function intentProfileKey(profile: IntentProfile): string | null {
+  if (validAgentIdentity(profile.agent)) return `${profile.agent.integration}.${profile.agent.instanceId}`;
+  return isKnownCli(profile.cli) ? profile.cli : null;
+}
+
+/** Where one session's prompts are kept: the directory and the file in it. */
+interface StoreSlot {
+  dir: string;
+  file: string;
+}
+
+/**
+ * The slot for `sessionId` under `profile`. No profile at all (`undefined`) is
+ * the flat, pre-profile layout — never used by the hook path (see the header).
+ * A profile that cannot be named has no slot.
+ */
+function storeSlot(sessionId: string, profile: IntentProfile | undefined): StoreSlot | null {
+  if (profile === undefined) return { dir: sessionsDir(), file: resolve(sessionsDir(), `${sessionId}.json`) };
+  const key = intentProfileKey(profile);
+  if (key === null || !PROFILE_DIR_RE.test(key)) return null;
+  const dir = resolve(sessionsDir(), key);
+  return { dir, file: resolve(dir, `${sessionId}.json`) };
+}
 
 /**
  * Group- or world-WRITE bits on a directory the store sits under. Anyone who
@@ -140,11 +205,11 @@ function modesAreMeaningful(): boolean {
  * (`fpai-collect`'s `create_dir_all`) and arrives at the umask, which on a
  * umask-002 box is 0775.
  */
-function storeDirChain(): string[] {
+function storeDirChain(innermost: string = sessionsDir()): string[] {
   const home = resolve(failproofaiHome());
   const chain: string[] = [];
-  let dir = sessionsDir();
-  // Bounded: the chain is four deep, and a home that is not an ancestor (a
+  let dir = innermost;
+  // Bounded: the chain is five deep, and a home that is not an ancestor (a
   // layout change, a symlink) must not walk to the filesystem root.
   for (let i = 0; i < 8; i++) {
     chain.push(dir);
@@ -172,11 +237,12 @@ function storeDirChain(): string[] {
  * human's and could clear the four reviewable BLOCKING policies.
  *
  * Exported so `failproofai jev status` can report it the way it reports a
- * refused config.
+ * refused config. `innermost` is a profile's directory when the read is for
+ * one, so that directory is held to the same rule.
  */
-export function looseIntentStoreDir(): string | null {
+export function looseIntentStoreDir(innermost?: string): string | null {
   if (!modesAreMeaningful()) return null;
-  for (const dir of storeDirChain()) {
+  for (const dir of storeDirChain(innermost)) {
     let mode: number;
     try {
       mode = statSync(dir).mode & 0o777;
@@ -207,9 +273,9 @@ interface IntentFile {
   prompts: RecordedPrompt[];
 }
 
-function readIntentFile(sessionId: string): IntentFile {
+function readIntentFile(slot: StoreSlot): IntentFile {
   try {
-    const parsed = JSON.parse(readFileSync(intentFile(sessionId), "utf8")) as IntentFile;
+    const parsed = JSON.parse(readFileSync(slot.file, "utf8")) as IntentFile;
     return Array.isArray(parsed?.prompts) ? parsed : { prompts: [] };
   } catch {
     return { prompts: [] };
@@ -228,15 +294,14 @@ function readIntentFile(sessionId: string): IntentFile {
  * copies of one line. The replacement carries the new timestamp and the new
  * agent snapshot, so the entry stays the latest thing the human said.
  */
-function appendPrompt(sessionId: string, entry: RecordedPrompt): boolean {
+function appendPrompt(slot: StoreSlot, entry: RecordedPrompt): boolean {
   try {
-    const file = readIntentFile(sessionId);
+    const file = readIntentFile(slot);
     const last = file.prompts[file.prompts.length - 1];
     const kept = last && last.text === entry.text ? file.prompts.slice(0, -1) : file.prompts;
     file.prompts = [...kept, entry].slice(-MAX_RECORDED_PROMPTS);
-    const dir = sessionsDir();
-    mkdirSync(dir, { recursive: true, mode: 0o700 });
-    const target = intentFile(sessionId);
+    mkdirSync(slot.dir, { recursive: true, mode: 0o700 });
+    const target = slot.file;
     const isNew = !fileExists(target);
     const tmp = `${target}.${process.pid}.tmp`;
     writeFileSync(tmp, JSON.stringify(file), { mode: 0o600 });
@@ -265,12 +330,31 @@ const SESSION_FILE_RE = /^[A-Za-z0-9._-]{1,128}\.json(?:\.\d+\.tmp)?$/;
  * file's mtime is its newest recorded prompt's, so every prompt in such a
  * file is already outside the window every read filters by and can never be
  * read again. Removing it loses nothing and keeps one-file-per-session from
- * growing without bound.
+ * growing without bound. Swept: the flat layout's files (pre-profile entries
+ * among them) and every profile directory's, one level down.
  */
 export function pruneExpiredSessions(now: number = Date.now()): number {
+  const root = sessionsDir();
+  let removed = pruneDir(root, now);
+  try {
+    for (const name of readdirSync(root)) {
+      if (!PROFILE_DIR_RE.test(name)) continue;
+      const dir = resolve(root, name);
+      try {
+        if (statSync(dir).isDirectory()) removed += pruneDir(dir, now);
+      } catch {
+        // Raced with something else: nothing to do.
+      }
+    }
+  } catch {
+    // No directory yet.
+  }
+  return removed;
+}
+
+function pruneDir(dir: string, now: number): number {
   let removed = 0;
   try {
-    const dir = sessionsDir();
     for (const name of readdirSync(dir)) {
       if (!SESSION_FILE_RE.test(name)) continue;
       const path = resolve(dir, name);
@@ -301,11 +385,19 @@ export function pruneExpiredSessions(now: number = Date.now()): number {
  * leave half a secret the patterns no longer match. Never throws: losing intent
  * only means no override.
  */
-function recordPrompt(sessionId: string, prompt: string, agent: string | null, now: number): boolean {
+function recordPrompt(
+  sessionId: string,
+  profile: IntentProfile | undefined,
+  prompt: string,
+  agent: string | null,
+  now: number,
+): boolean {
   if (!SESSION_ID_RE.test(sessionId)) return false;
   if (prompt.trim().length === 0) return false;
+  const slot = storeSlot(sessionId, profile);
+  if (!slot) return false;
   try {
-    return appendPrompt(sessionId, { at: now, text: storable(prompt.trim()), agent: agent === null ? null : storable(agent) });
+    return appendPrompt(slot, { at: now, text: storable(prompt.trim()), agent: agent === null ? null : storable(agent) });
   } catch {
     return false;
   }
@@ -319,10 +411,12 @@ function recordPrompt(sessionId: string, prompt: string, agent: string | null, n
  * still asked, and judges with no stated intent, so no reviewable deny is
  * cleared on a prompt we cannot say is the owner's.
  */
-function livePrompts(sessionId: string | undefined, now: number): RecordedPrompt[] {
+function livePrompts(sessionId: string | undefined, now: number, profile: IntentProfile | undefined): RecordedPrompt[] {
   if (!sessionId || !SESSION_ID_RE.test(sessionId)) return [];
-  if (looseIntentStoreDir() !== null) return [];
-  return readIntentFile(sessionId).prompts.filter(
+  const slot = storeSlot(sessionId, profile);
+  if (!slot) return [];
+  if (looseIntentStoreDir(slot.dir) !== null) return [];
+  return readIntentFile(slot).prompts.filter(
     (p) =>
       typeof p?.text === "string" &&
       typeof p.at === "number" &&
@@ -839,6 +933,13 @@ export interface CaptureEvent {
   cli: string;
   /** The stdin payload after `normalizeCliPayload`: the handler's `parsed`. */
   payload: Record<string, unknown>;
+  /**
+   * The agent profile the prompt was typed into. The hook path always sets it
+   * (the agent null when the profile has no rostered identity), and the prompt
+   * is then readable only under that same profile. Absent is the flat layout
+   * (see the header).
+   */
+  profile?: IntentProfile;
 }
 
 function isKnownCli(cli: string): cli is IntegrationType {
@@ -1167,7 +1268,7 @@ export function captureIntent(ev: CaptureEvent, now: number = Date.now()): void
     if (raw === null) return;
     const cleaned = cleanHumanTurn(raw);
     if (cleaned === null) return;
-    recordPrompt(sessionId, cleaned, lastAgentMessage(ev.transcriptPath), now);
+    recordPrompt(sessionId, ev.profile, cleaned, lastAgentMessage(ev.transcriptPath), now);
   } catch {
     // Losing intent only means Jev judges without it.
   }
@@ -1177,13 +1278,15 @@ export function captureIntent(ev: CaptureEvent, now: number = Date.now()): void
  * What the human asked for recently (oldest first, at most
  * `MAX_RECORDED_PROMPTS`, none older than `INTENT_MAX_AGE_MS`) and the agent
  * message their latest prompt replied to — null when that prompt had none or
- * nothing is recorded.
+ * nothing is recorded. Read under `profile`, the one the prompts were captured
+ * under; the hook path always passes it (see the header).
  */
 export function readIntent(
   sessionId?: string,
   now: number = Date.now(),
+  profile?: IntentProfile,
 ): { userSaid: string[]; agentLastMessage: string | null } {
-  const prompts = livePrompts(sessionId, now);
+  const prompts = livePrompts(sessionId, now, profile);
   const latest = prompts[prompts.length - 1];
   const agent = latest && typeof latest.agent === "string" && latest.agent.length > 0 ? latest.agent : null;
   return { userSaid: prompts.map((p) => p.text), agentLastMessage: agent };