failproofai 1.0.12-beta.2 → 1.0.13-beta.1

package/openclaw-plugin/index.js

@@ -4,230 +4,36 @@
  * Loaded in-process by the gateway (registered via `plugins.load.paths` +
  * `plugins.entries.failproofai` in ~/.openclaw/openclaw.json). It subscribes to
  * OpenClaw's typed PLUGIN hooks — the only surface that can block; OpenClaw's
- * file-based "internal hooks" are observation-only — and forwards each to the
- * failproofai binary as `failproofai --hook <event> --cli openclaw`. failproofai
- * prints a flat `{permission, reason}` verdict on stdout; this shim maps it to
- * each hook's native return shape. On before_tool_call, an `instruct` verdict
- * uses a one-shot blockReason as OpenClaw's model-visible instruction channel;
- * retries from the same session/policy are allowed for a short window.
+ * file-based "internal hooks" are observation-only — and asks failproofaid for
+ * each verdict over its Unix socket (daemon-client.js), the way the Hermes
+ * plugin does. The daemon answers with the flat `{permission, reason}` verdict
+ * `failproofai --hook <event> --cli openclaw` prints; hooks.js maps it to each
+ * hook's native return shape. On before_tool_call, an `instruct` verdict uses a
+ * one-shot blockReason as OpenClaw's model-visible instruction channel; retries
+ * from the same session/policy are allowed for a short window.
  *
  * Marker comment for failproofai's installer detection (do not remove):
  *   __failproofai_hook__: true
  *
- * Design notes (verified live against openclaw v2026.7.1):
- *  • ASYNC spawn, never spawnSync — the gateway is a long-running multi-channel
- *    process; a synchronous spawn on every hook would stall every channel.
- *    30s guard timer; fail-open on any error (never block on infra failure).
- *  • Raw forwarding — we send the raw tool name / params and a Claude-shaped
- *    stdin (params→tool_input, toolName→tool_name, transcriptPath→
- *    transcript_path, stopHookActive→stop_hook_active, sessionKey→session_id).
- *    The binary canonicalizes via OPENCLAW_* maps (single source of truth); the
- *    shim ships NO inline maps (unlike the OpenCode/Pi shims).
+ * Design notes:
+ *  • No process per hook, and no path outside this directory. OpenClaw ≥
+ *    2026.9.6 imports plugins from a copy under ~/.openclaw/tmp/plugin-captures,
+ *    so a CLI located relative to this file is not there; the shim that spawned
+ *    one allowed every call once that started. Every module here imports only
+ *    node built-ins and its siblings.
+ *  • Non-blocking — the gateway is a long-running multi-channel process, so all
+ *    I/O is async; a synchronous call on every hook would stall every channel.
  *  • No top-level `await` — OpenClaw's plugin loader rejects it; all async work
  *    happens inside register()'s handlers.
- *
- * Binary resolution mirrors pi-extension/index.ts: prefer the bundled
- * dist/cli.mjs (node-compatible), fall back to bin/failproofai.mjs with bun for
- * dev; honor FAILPROOFAI_BINARY_OVERRIDE. Paths resolve relative to this file
- * via import.meta.url (the gateway spawns plugins with an undefined cwd).
  */
 import { definePluginEntry } from "openclaw/plugin-sdk/plugin-entry";
-import { spawn } from "node:child_process";
-import { existsSync } from "node:fs";
-import { resolve, dirname } from "node:path";
-import { fileURLToPath } from "node:url";
-import { createInstructRetryGate, mapBeforeToolVerdict } from "./instruct-retry-gate.js";
-import { createWorkspaceContext } from "./workspace-context.js";
-
-const HERE = dirname(fileURLToPath(import.meta.url));
-const DIST_BIN = resolve(HERE, "..", "dist", "cli.mjs");
-const SRC_BIN = resolve(HERE, "..", "bin", "failproofai.mjs");
-const instructRetryGate = createInstructRetryGate();
-const workspaceContext = createWorkspaceContext();
-
-function resolveSpawn() {
-  if (process.env.FAILPROOFAI_BINARY_OVERRIDE) {
-    return { cmd: "node", args: [process.env.FAILPROOFAI_BINARY_OVERRIDE] };
-  }
-  if (existsSync(DIST_BIN)) {
-    return { cmd: "node", args: [DIST_BIN] };
-  }
-  return { cmd: "bun", args: [SRC_BIN] };
-}
-
-function debug(msg) {
-  if (process.env.FAILPROOFAI_OPENCLAW_DEBUG === "1") {
-    process.stderr.write(`[failproofai-openclaw-shim] ${msg}\n`);
-  }
-}
-
-/**
- * Spawn `failproofai --hook <rawEvent> --cli openclaw`, write the JSON payload
- * to stdin, and resolve the parsed flat `{permission, reason}` verdict. Async +
- * fail-open: any spawn/parse error or timeout resolves to `{permission:"allow"}`
- * so a failproofai fault never blocks the gateway.
- */
-function callPolicy(rawEvent, payload) {
-  return new Promise((done) => {
-    const { cmd, args } = resolveSpawn();
-    let child;
-    try {
-      child = spawn(cmd, [...args, "--hook", rawEvent, "--cli", "openclaw"], {
-        stdio: ["pipe", "pipe", "pipe"],
-      });
-    } catch (err) {
-      debug(`spawn threw: ${err && err.message ? err.message : String(err)}`);
-      done({ permission: "allow" });
-      return;
-    }
-    let out = "";
-    let settled = false;
-    const finish = (verdict) => {
-      if (settled) return;
-      settled = true;
-      clearTimeout(timer);
-      done(verdict);
-    };
-    const timer = setTimeout(() => {
-      debug(`timeout on ${rawEvent}; killing child`);
-      try { child.kill(); } catch { /* ignore */ }
-      finish({ permission: "allow" });
-    }, 30_000);
-    child.stdout.on("data", (d) => { out += d; });
-    child.on("error", (err) => {
-      debug(`child error: ${err && err.message ? err.message : String(err)}`);
-      finish({ permission: "allow" });
-    });
-    child.on("close", () => {
-      const stdout = out.trim();
-      if (!stdout) { finish({ permission: "allow" }); return; }
-      try {
-        finish(JSON.parse(stdout));
-      } catch (err) {
-        debug(`parse error: ${err && err.message ? err.message : String(err)}`);
-        finish({ permission: "allow" });
-      }
-    });
-    try {
-      child.stdin.end(JSON.stringify(payload));
-    } catch (err) {
-      debug(`stdin write failed: ${err && err.message ? err.message : String(err)}`);
-      finish({ permission: "allow" });
-    }
-  });
-}
-
-/** Claude-shaped stdin base. Extra keys are ignored by the binary's payload
- *  parser; they're forwarded for future use / activity attribution. */
-function baseMeta(payload, ctx, config) {
-  const p = payload || {};
-  const c = ctx || {};
-  return {
-    session_id: c.sessionId ?? p.sessionId ?? c.sessionKey ?? p.sessionKey,
-    cwd: workspaceContext.resolveWorkspace(p, c, config) ?? process.cwd(),
-    transcript_path: p.transcriptPath,
-    stop_hook_active: p.stopHookActive === true,
-    openclaw: {
-      agentId: c.agentId,
-      sessionKey: c.sessionKey ?? p.sessionKey,
-      runId: c.runId ?? p.runId,
-      provider: p.provider,
-      model: p.model,
-    },
-  };
-}
+import { registerFailproofaiHooks } from "./hooks.js";
 
 export default definePluginEntry({
   id: "failproofai",
   name: "failproofai",
   description: "Real-time policy enforcement for OpenClaw by failproofai",
   register(api) {
-    // before_tool_call → PreToolUse. Deny always blocks. Instruct blocks the
-    // first matching attempt only, using blockReason to give the model the
-    // instruction, then permits retries from that session/policy for 5 minutes.
-    api.on(
-      "before_tool_call",
-      async (payload, ctx) => {
-        const p = payload || {};
-        const verdict = await callPolicy("before_tool_call", {
-          ...baseMeta(payload, ctx, api.config),
-          tool_name: p.toolName,
-          tool_input: p.params,
-          hook_event_name: "before_tool_call",
-        });
-        return mapBeforeToolVerdict(verdict, payload, ctx, instructRetryGate);
-      },
-      { priority: 100, timeoutMs: 60_000 },
-    );
-
-    // before_agent_run → UserPromptSubmit. Deny: return {outcome:"block", reason}.
-    api.on(
-      "before_agent_run",
-      async (payload, ctx) => {
-        const p = payload || {};
-        workspaceContext.remember(payload, ctx);
-        const verdict = await callPolicy("before_agent_run", {
-          ...baseMeta(payload, ctx, api.config),
-          prompt: p.prompt,
-          hook_event_name: "before_agent_run",
-        });
-        if (verdict.permission === "deny") {
-          return { outcome: "block", reason: verdict.reason || "Blocked by failproofai" };
-        }
-        return undefined;
-      },
-      { priority: 100, timeoutMs: 60_000 },
-    );
-
-    // before_agent_finalize → Stop. The real turn-end gate: a deny becomes a
-    // revise so the agent runs another pass. The evaluator supplies the
-    // MANDATORY ACTION wording; the payload's stop_hook_active guards the
-    // require-*-before-stop builtins against infinite loops.
-    api.on(
-      "before_agent_finalize",
-      async (payload, ctx) => {
-        const verdict = await callPolicy("before_agent_finalize", {
-          ...baseMeta(payload, ctx, api.config),
-          hook_event_name: "before_agent_finalize",
-        });
-        if (verdict.permission === "deny") {
-          return { action: "revise", reason: verdict.reason || "Action required by failproofai" };
-        }
-        return undefined;
-      },
-      { priority: 100, timeoutMs: 60_000 },
-    );
-
-    // Observation hooks — await so activity ordering is stable, ignore verdict.
-    // after_tool_call → PostToolUse; session_start/end → SessionStart/End;
-    // subagent_ended → SubagentStop (obs only); before_compaction → PreCompact.
-    for (const ev of [
-      "after_tool_call",
-      "session_start",
-      "session_end",
-      "subagent_ended",
-      "before_compaction",
-    ]) {
-      api.on(
-        ev,
-        async (payload, ctx) => {
-          const p = payload || {};
-          await callPolicy(ev, {
-            ...baseMeta(payload, ctx, api.config),
-            tool_name: p.toolName,
-            tool_input: p.params,
-            tool_response: p.result,
-            reason: p.reason,
-            hook_event_name: ev,
-          });
-          if (ev === "session_end") {
-            instructRetryGate.clear(payload, ctx);
-            workspaceContext.clear(payload, ctx);
-          }
-          return undefined;
-        },
-        { priority: 100, timeoutMs: 60_000 },
-      );
-    }
+    registerFailproofaiHooks(api);
   },
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "failproofai",
-  "version": "1.0.12-beta.2",
+  "version": "1.0.13-beta.1",
   "description": "Observability and enforcement for AI agent harnesses. 40 built-in policies hooked into 12 of them — Claude Code, Codex, Cursor, Hermes, OpenClaw and more — blocking the tool call before it runs. Local dashboard included, no account needed.",
   "bin": {
     "failproofai": "./dist/cli.mjs",
@@ -81,7 +81,7 @@
     "access": "public"
   },
   "devDependencies": {
-    "@anthropic-ai/sdk": "^0.135.0",
+    "@anthropic-ai/sdk": "^1.3.0",
     "@mdx-js/mdx": "^3.1.1",
     "@tailwindcss/postcss": "^4.3.1",
     "@tanstack/react-virtual": "^3.14.10",
@@ -126,15 +126,15 @@
     "browserslist": "4.28.8"
   },
   "optionalDependencies": {
-    "@failproofai/failproofaid-linux-x64": "1.0.12-beta.2",
-    "@failproofai/failproofaid-linux-arm64": "1.0.12-beta.2",
-    "@failproofai/failproofaid-darwin-x64": "1.0.12-beta.2",
-    "@failproofai/failproofaid-darwin-arm64": "1.0.12-beta.2"
+    "@failproofai/failproofaid-linux-x64": "1.0.13-beta.1",
+    "@failproofai/failproofaid-linux-arm64": "1.0.13-beta.1",
+    "@failproofai/failproofaid-darwin-x64": "1.0.13-beta.1",
+    "@failproofai/failproofaid-darwin-arm64": "1.0.13-beta.1"
   },
   "failproofaidBinaries": {
-    "linux-x64": "4c09117fdb80d87792d1d2b77d9359cdbd0c522b5a6222ab7b927659130ddf54",
-    "linux-arm64": "dd390d76561267fc519ceb96fb90be340044e2f564bef36a44e284f227d93f29",
-    "darwin-x64": "62381f7ffe21d02289c36c4b205166b2867dbde986444d1ea185241b94fd04ef",
-    "darwin-arm64": "9ad798817d3048a5126e80dc71883538d37c1b6b6443e9c19389dc2583c8f675"
+    "linux-x64": "d257e616d9f5a7ab76ceabbc7ac918e29555034458468697929fb6d109e35f3f",
+    "linux-arm64": "583d8e0c5cdae34bb0b2083fd1c8448d06a927ad4ca9ee6978127b54eecb27a0",
+    "darwin-x64": "68943a0b03c021f693f3c5f57acfc66d096bfd8bc7be57abff9ef826508de11a",
+    "darwin-arm64": "49fa29ad396b85dccac135cf44ceaeb83efd3934471d86160f75b081fae04eae"
   }
 }

package/scripts/sync-agent-cli-harnesses-prompt.md

@@ -13,11 +13,11 @@ pull request with the fix — or, if a sync PR is already open, comment on it in
   finish the work.
 - The entrypoint has **already cut a fresh branch** named `auto/sync-cli-harnesses-<UTC>`.
   Do all your work here; do **not** switch branches or work on `main`.
-- failproofai's own Stop hooks are active in this checkout. If you make commits, you
-  will not be allowed to stop until you have **committed**, **pushed**, and **opened a
-  PR** for them. If you make **no** commits (nothing to sync, or you only commented on
-  an already-open sync PR), a clean working tree stops fine — so on those paths, do
-  **not** edit any files.
+- **You publish your own work.** If you edit files, you must **commit**, **push**, and
+  **open a PR** for them (Phase 3) before you stop — no hook does it for you, and the
+  entrypoint fails the run if you leave uncommitted changes. If you make **no**
+  commits (nothing to sync, or you only commented on an already-open sync PR), do
+  **not** edit any files, so the working tree stays clean.
 - Use ultracode / multi-agent orchestration: in Phase 1, fan out **one subagent per
   CLI** so the seven harnesses are checked in parallel.
 
@@ -48,23 +48,17 @@ For each verified CLI, compare the upstream docs to this repo across three scope
    `src/hooks/integrations.ts` (matcher-wrapper vs flat-array vs packages-array vs
    plugin registration; field names like `command` vs `bash`/`powershell`;
    `timeout` vs `timeoutSec` and its **unit** seconds-vs-ms; presence of `version`
-   / `$schema` / `matcher`; the settings-file path) **and** the committed dogfood
-   fixture on disk. The canonical worked example is git history / PR #482, which
-   dropped an invalid top-level `version` field and fixed a `60000`ms→`60`s timeout
-   unit in `.codex/hooks.json` by editing the writer, the fixture, and the tests
-   together.
+   / `$schema` / `matcher`; the settings-file path). The canonical worked example is
+   git history / PR #482, which dropped an invalid top-level `version` field and
+   fixed a `60000`ms→`60`s timeout unit in the `.codex/hooks.json` writer by editing
+   the writer and the tests together.
 
 ## Reading rules
 
-- This run relaxed two policies (`require-ci-green-before-stop`,
-  `block-read-outside-cwd`) so you can read and edit the settings fixtures. Even so,
-  when you only need to **inspect** a committed fixture, prefer
-  `git show HEAD:<path>` (e.g. `git show HEAD:.codex/hooks.json`) — it is never
-  blocked and is the reliable way to read `.claude/settings.json`, `.codex/hooks.json`,
-  `.cursor/hooks.json`, `.github/hooks/failproofai.json`,
-  `.pi/settings.json`, and `.opencode/*`.
-- Do **NOT** run `failproofai policies --install` (or any `failproofai` subcommand)
-  to regenerate a fixture — it is blocked. Edit fixtures by hand.
+- Do **NOT** run `failproofai policies --install` (or any `failproofai` subcommand):
+  it would write hook configs into this clone, and those must never land in the PR.
+  The settings-file shape lives in the writer in `src/hooks/integrations.ts` and its
+  tests — read and edit those.
 
 ## Phase 1 — Fan out one subagent per CLI
 
@@ -80,7 +74,7 @@ Spawn one subagent per CLI (seven, in parallel). Each subagent, for its CLI:
 2. Compare against this repo: the CLI's `*HOOK_EVENT_TYPES` array + paired
    `*EVENT_MAP` (scope 1); its `*_TOOL_MAP` / `*_TOOL_INPUT_MAP` and its branch in
    `src/hooks/policy-evaluator.ts` (scope 2); its literals in
-   `src/hooks/integrations.ts` + its dogfood fixture read via `git show` (scope 3).
+   `src/hooks/integrations.ts` (scope 3).
 3. Return a structured report: `{ cli, status: up-to-date | drift | unverified,
    scope1: {added, removed}, scope2: {...}, scope3: {...}, sources: [...] }`.
 
@@ -102,7 +96,7 @@ surface is documented in the package source, not a clean enumeration).
 
 Merge the subagent reports into one list of detected drift. Then, **before you edit a
 single file**, decide which path you are on — editing first would leave uncommitted
-changes that block a clean stop on the comment / no-op paths below.
+changes behind on the comment / no-op paths below, which fails the run.
 
 1. **No drift in any verified CLI** → do nothing: make no edits, open no PR, post no
    comment. Stop. (`unverified` alone is not drift — the docs may just be unreachable
@@ -124,7 +118,7 @@ changes that block a clean stop on the comment / no-op paths below.
      > (hook-sync bot — please fold these into this PR rather than opening a second sync PR.)
 
      Never push commits to another PR's branch; only comment, and leave the working
-     tree clean so this run stops cleanly.
+     tree clean.
 
    - **If no open sync PR exists → go to Phase 3** to apply the fixes and open one.
 
@@ -155,7 +149,7 @@ requires.
   an invalid field to remove, a wrong timeout unit, or a renamed tool id (the PR
   #482 class). When you do, move the whole quartet together, exactly like #482:
   the writer in `src/hooks/integrations.ts` (+ a shared helper if it dedupes
-  logic), the committed dogfood fixture, the unit test in
+  logic), the unit test in
   `__tests__/hooks/integrations.test.ts`, and the e2e test in
   `__tests__/e2e/hooks/<cli>-integration.e2e.test.ts` — plus a `types.ts` comment
   if it documents the old shape.
@@ -176,11 +170,14 @@ version's section. There is no `## Unreleased` section. Use the `### Features` (
 ### Commit, push, open the PR
 1. Stage only the files you intentionally edited (never `git add -A`):
    `src/hooks/types.ts`, `src/hooks/integrations.ts`, `src/hooks/policy-evaluator.ts`,
-   the touched `__tests__/...` files, the touched dogfood fixtures, and
-   `CHANGELOG.md` — whichever actually changed.
+   the touched `__tests__/...` files, and `CHANGELOG.md` — whichever actually
+   changed.
 2. Commit (e.g. `feat: sync agent CLI harnesses with upstream docs`), then
    `git push -u origin "$(git branch --show-current)"`.
 3. `gh pr create --base main --title "[auto] sync agent CLI harnesses with upstream docs" --body "<body>"`.
+4. Confirm before you stop: `git status --porcelain` is empty, the branch is pushed,
+   and `gh pr list --head "$(git branch --show-current)"` shows the PR. If any of
+   these fails, fix it — nothing else will.
 
 The PR **body** must contain, in order:
 
@@ -205,12 +202,10 @@ The PR **body** must contain, in order:
 - **Only edit** these paths, and only where drift requires it: `src/hooks/types.ts`,
   `src/hooks/integrations.ts`, `src/hooks/policy-evaluator.ts`,
   `__tests__/hooks/manager.test.ts`, `__tests__/hooks/integrations.test.ts`,
-  `__tests__/e2e/hooks/<cli>-integration.e2e.test.ts`, the seven dogfood fixtures
-  (`.claude/settings.json`, `.codex/hooks.json`, `.cursor/hooks.json`,
-  `.github/hooks/failproofai.json`, `.opencode/opencode.json`,
-  `.opencode/plugins/failproofai.mjs`, `.pi/settings.json`),
-  and `CHANGELOG.md`.
-- Do **NOT** edit `.failproofai/policies-config.json` (the entrypoint manages it),
+  `__tests__/e2e/hooks/<cli>-integration.e2e.test.ts`, and `CHANGELOG.md`.
+- Do **NOT** create hook configs in this clone (`.claude/settings.json`,
+  `.codex/hooks.json`, `.cursor/hooks.json`, `.github/hooks/`, `.opencode/`,
+  `.pi/settings.json`, `.failproofai/`), and do **NOT** edit
   `src/hooks/handler.ts`, `src/hooks/manager.ts`, or any other source file.
 - Do **NOT** add entries to any `*EVENT_MAP`, `*_TOOL_MAP`, or `*_TOOL_INPUT_MAP`
   for newly-added items. Removing a key when its array entry is removed IS allowed

package/src/hooks/agent-skill.ts

@@ -65,6 +65,9 @@ For focused work, read the matching skill too. Each has the same layout, with it
 - FailproofAI Cloud and the \`fp\` CLI: ${SKILLS_RAW}/fp-cloud-cli/SKILL.md
 - Adding the SDK to an agent, or running an evaluator: ${SKILLS_RAW}/failproofai-sdk/SKILL.md
 - Planning evaluations: ${SKILLS_RAW}/failproofai-eval-brainstorm/SKILL.md
+- Writing an evaluation: ${SKILLS_RAW}/failproofai-eval-author/SKILL.md
+- Writing an alert: ${SKILLS_RAW}/failproofai-alert-author/SKILL.md
+- Writing an audit: ${SKILLS_RAW}/failproofai-audit-author/SKILL.md
 `;
 
 /** An agent's own override for where it keeps its files, else the default. */

package/src/hooks/enforcement-capability.ts

@@ -182,7 +182,7 @@ export const ENFORCEMENT_CAPABILITY: Record<
 
   // ── openclaw ──────────────────────────────────────────────────────────────
   // openclaw/openclaw @f8ed8ecf (v2026.7.2) + our own shipped shim
-  // openclaw-plugin/index.js, which returns undefined for 5 of the 8 hooks.
+  // openclaw-plugin/hooks.js, which returns undefined for 5 of the 8 hooks.
   openclaw: {
     PreToolUse: "block",           // before_tool_call -> shim returns {block:true, blockReason}
     UserPromptSubmit: "block",     // before_agent_run -> shim returns {outcome:"block", reason}

package/src/hooks/fp-home.ts

@@ -410,7 +410,7 @@ export const collectorHealthFile = (home?: string) => resolve(stateDir(home), "c
 /** Per-session enforcement pauses, keyed by a hash of the session id. */
 export const sessionPauseDir = () => resolve(stateDir(), "sessions");
 /**
- * The semantic (Jev) evaluator's local state: `sessions/<id>.json` holds the
+ * The semantic (Jev) evaluator's local state: `sessions/<profile>/<id>.json` holds the
  * human prompts recorded at `UserPromptSubmit`, and `verdicts.jsonl` one row
  * per semantic evaluation. Written only when a Jev config (BYOK) is present.
  */

package/src/hooks/handler.ts

@@ -505,6 +505,8 @@ async function startTwoTier(
       permissionMode: session.permissionMode,
       sessionId: session.sessionId,
       cli,
+      // The profile the intent store is read under: the one capture used.
+      agent,
       ...(loaded.cloud ? { cloud: loaded.cloud } : {}),
       // Cloud's checks are still asked; the installed packs' are not.
       ...(activePause ? { localPaused: true } : {}),
@@ -571,6 +573,15 @@ function jevTelemetry(activity: JevActivityFields | undefined): Record<string, u
  * marks that tell a human's prompt from a subagent's or an extension's are
  * elsewhere in it. `prompt` is §7's original field, still read by the
  * contract stub; T4's implementation reads `payload` and ignores it.
+ *
+ * The prompt is stored under the agent profile (`agent`, the runtime identity
+ * Cloud's targeting matches on) and read back by `startTwoTier` under the same
+ * one, so a prompt typed into one profile is never another's stated intent.
+ * Under a Cloud mode, a profile the deployment assigns no Cloud Jev check to,
+ * with no installed pack's check to review it either, has nothing that will
+ * ever read the prompt (`startTwoTier` returns before Jev for it), so nothing
+ * is kept: FailproofAI does not hold prompt text from a profile the
+ * deployment did not target.
  */
 async function captureJevIntent(
   canonicalEventType: string,
@@ -579,13 +590,20 @@ async function captureJevIntent(
   session: SessionMetadata,
   cli: IntegrationType,
   opts: EvaluateHookEventOptions | undefined,
+  agent: AgentIdentity | null,
 ): Promise<void> {
   if (canonicalEventType !== "UserPromptSubmit" || jevForcedOff(opts)) return;
   try {
     // Same gate as `startTwoTier`: a Cloud mode that asks needs what the human
     // typed whatever the installed packs declare.
-    if (!cloudJevAsks(readCloudJevMode()) && !jevChecksInstalled()) return;
-    if (!(await readJevConfig())) return;
+    const cloudAsks = cloudJevAsks(readCloudJevMode());
+    if (!cloudAsks && !jevChecksInstalled()) return;
+    // ...but not for a profile no Cloud Jev check targets and no installed
+    // pack's check reviews: `startTwoTier`'s own skip, without the pause
+    // (a pause can end while the session goes on). An older deployment with
+    // no assignment list (`null`) captures as before.
+    if (cloudAsks && cloudJevAssignmentsFor(agent)?.length === 0 && !packJevChecksInstalled()) return;
+    if (!(await readJevConfig(agent))) return;
     if (decision === "deny") {
       const { ENFORCEMENT_CAPABILITY } = await import("./enforcement-capability");
       if (ENFORCEMENT_CAPABILITY[cli]?.UserPromptSubmit === "block") return;
@@ -599,6 +617,7 @@ async function captureJevIntent(
       cli,
       payload: parsed,
       prompt: parsed.prompt,
+      profile: { cli, agent },
     };
     captureIntent(event);
   } catch (err) {
@@ -1180,7 +1199,7 @@ export async function evaluateHookEvent(
     const durationMs = Math.round(performance.now() - startTime);
     hookLogInfo(`result=${result.decision} policy=${result.policyName ?? "none"} duration=${durationMs}ms`);
 
-    await captureJevIntent(canonicalEventType, result.decision, parsed, session, cli, opts);
+    await captureJevIntent(canonicalEventType, result.decision, parsed, session, cli, opts, runtimeAgent);
 
     // Which policies actually ran for this event, regardless of how they
     // decided. `result.policyName` names only the decider — null on a plain

package/src/hooks/integrations.ts

@@ -2277,8 +2277,10 @@ export function unhookedHermesProfiles(): string[] {
 // OpenClaw is a self-hosted assistant gateway. Enforcement is via its in-process
 // PLUGIN hooks (file-based "internal hooks" are observation-only), so failproofai
 // ships a static plugin package (`openclaw-plugin/`, like Pi's pi-extension) that
-// async-spawns the binary and maps verdicts back. Install registers the plugin in
-// every profile's `openclaw.json` (JSON):
+// asks failproofaid for each verdict over its Unix socket — like the Hermes plugin,
+// and so likewise daemon-only — and maps verdicts back. It cannot spawn the CLI:
+// OpenClaw ≥ 2026.9.6 loads plugins from a copy that holds only the plugin dir.
+// Install registers the plugin in every profile's `openclaw.json` (JSON):
 //   • plugins.load.paths[]  → the shipped openclaw-plugin dir (absolute path)
 //   • plugins.entries.failproofai = { enabled: true, hooks: { allowConversationAccess: true } }
 //     (allowConversationAccess is required for the raw-conversation hooks
@@ -2318,6 +2320,7 @@ function isFailproofaiOpenClawPath(p: unknown): boolean {
 export const openclaw: Integration = {
   id: "openclaw",
   displayName: "OpenClaw",
+  requiresHealthyDaemon: true,
   scopes: OPENCLAW_HOOK_SCOPES,
   eventTypes: OPENCLAW_HOOK_EVENT_TYPES,