failproofai 1.0.13-beta.1 → 1.0.13-beta.2

package/dist/worker.mjs

@@ -1166,7 +1166,7 @@ function instruct(reason) {
 }
 
 // package.json
-var version = "1.0.13-beta.1";
+var version = "1.0.13-beta.2";
 var init_package = () => {};
 
 // src/hooks/agent-targets.ts

package/hermes-plugin/plugin.yaml

@@ -1,5 +1,5 @@
 name: failproofai
-version: 1.0.13-beta.1
+version: 1.0.13-beta.2
 description: Real-time FailproofAI policy enforcement for Hermes
 manifest_version: 2
 api_version: 1

package/openclaw-plugin/index.js

@@ -4,36 +4,230 @@
  * Loaded in-process by the gateway (registered via `plugins.load.paths` +
  * `plugins.entries.failproofai` in ~/.openclaw/openclaw.json). It subscribes to
  * OpenClaw's typed PLUGIN hooks — the only surface that can block; OpenClaw's
- * file-based "internal hooks" are observation-only — and asks failproofaid for
- * each verdict over its Unix socket (daemon-client.js), the way the Hermes
- * plugin does. The daemon answers with the flat `{permission, reason}` verdict
- * `failproofai --hook <event> --cli openclaw` prints; hooks.js maps it to each
- * hook's native return shape. On before_tool_call, an `instruct` verdict uses a
- * one-shot blockReason as OpenClaw's model-visible instruction channel; retries
- * from the same session/policy are allowed for a short window.
+ * file-based "internal hooks" are observation-only — and forwards each to the
+ * failproofai binary as `failproofai --hook <event> --cli openclaw`. failproofai
+ * prints a flat `{permission, reason}` verdict on stdout; this shim maps it to
+ * each hook's native return shape. On before_tool_call, an `instruct` verdict
+ * uses a one-shot blockReason as OpenClaw's model-visible instruction channel;
+ * retries from the same session/policy are allowed for a short window.
  *
  * Marker comment for failproofai's installer detection (do not remove):
  *   __failproofai_hook__: true
  *
- * Design notes:
- *  • No process per hook, and no path outside this directory. OpenClaw ≥
- *    2026.9.6 imports plugins from a copy under ~/.openclaw/tmp/plugin-captures,
- *    so a CLI located relative to this file is not there; the shim that spawned
- *    one allowed every call once that started. Every module here imports only
- *    node built-ins and its siblings.
- *  • Non-blocking — the gateway is a long-running multi-channel process, so all
- *    I/O is async; a synchronous call on every hook would stall every channel.
+ * Design notes (verified live against openclaw v2026.7.1):
+ *  • ASYNC spawn, never spawnSync — the gateway is a long-running multi-channel
+ *    process; a synchronous spawn on every hook would stall every channel.
+ *    30s guard timer; fail-open on any error (never block on infra failure).
+ *  • Raw forwarding — we send the raw tool name / params and a Claude-shaped
+ *    stdin (params→tool_input, toolName→tool_name, transcriptPath→
+ *    transcript_path, stopHookActive→stop_hook_active, sessionKey→session_id).
+ *    The binary canonicalizes via OPENCLAW_* maps (single source of truth); the
+ *    shim ships NO inline maps (unlike the OpenCode/Pi shims).
  *  • No top-level `await` — OpenClaw's plugin loader rejects it; all async work
  *    happens inside register()'s handlers.
+ *
+ * Binary resolution mirrors pi-extension/index.ts: prefer the bundled
+ * dist/cli.mjs (node-compatible), fall back to bin/failproofai.mjs with bun for
+ * dev; honor FAILPROOFAI_BINARY_OVERRIDE. Paths resolve relative to this file
+ * via import.meta.url (the gateway spawns plugins with an undefined cwd).
  */
 import { definePluginEntry } from "openclaw/plugin-sdk/plugin-entry";
-import { registerFailproofaiHooks } from "./hooks.js";
+import { spawn } from "node:child_process";
+import { existsSync } from "node:fs";
+import { resolve, dirname } from "node:path";
+import { fileURLToPath } from "node:url";
+import { createInstructRetryGate, mapBeforeToolVerdict } from "./instruct-retry-gate.js";
+import { createWorkspaceContext } from "./workspace-context.js";
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+const DIST_BIN = resolve(HERE, "..", "dist", "cli.mjs");
+const SRC_BIN = resolve(HERE, "..", "bin", "failproofai.mjs");
+const instructRetryGate = createInstructRetryGate();
+const workspaceContext = createWorkspaceContext();
+
+function resolveSpawn() {
+  if (process.env.FAILPROOFAI_BINARY_OVERRIDE) {
+    return { cmd: "node", args: [process.env.FAILPROOFAI_BINARY_OVERRIDE] };
+  }
+  if (existsSync(DIST_BIN)) {
+    return { cmd: "node", args: [DIST_BIN] };
+  }
+  return { cmd: "bun", args: [SRC_BIN] };
+}
+
+function debug(msg) {
+  if (process.env.FAILPROOFAI_OPENCLAW_DEBUG === "1") {
+    process.stderr.write(`[failproofai-openclaw-shim] ${msg}\n`);
+  }
+}
+
+/**
+ * Spawn `failproofai --hook <rawEvent> --cli openclaw`, write the JSON payload
+ * to stdin, and resolve the parsed flat `{permission, reason}` verdict. Async +
+ * fail-open: any spawn/parse error or timeout resolves to `{permission:"allow"}`
+ * so a failproofai fault never blocks the gateway.
+ */
+function callPolicy(rawEvent, payload) {
+  return new Promise((done) => {
+    const { cmd, args } = resolveSpawn();
+    let child;
+    try {
+      child = spawn(cmd, [...args, "--hook", rawEvent, "--cli", "openclaw"], {
+        stdio: ["pipe", "pipe", "pipe"],
+      });
+    } catch (err) {
+      debug(`spawn threw: ${err && err.message ? err.message : String(err)}`);
+      done({ permission: "allow" });
+      return;
+    }
+    let out = "";
+    let settled = false;
+    const finish = (verdict) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      done(verdict);
+    };
+    const timer = setTimeout(() => {
+      debug(`timeout on ${rawEvent}; killing child`);
+      try { child.kill(); } catch { /* ignore */ }
+      finish({ permission: "allow" });
+    }, 30_000);
+    child.stdout.on("data", (d) => { out += d; });
+    child.on("error", (err) => {
+      debug(`child error: ${err && err.message ? err.message : String(err)}`);
+      finish({ permission: "allow" });
+    });
+    child.on("close", () => {
+      const stdout = out.trim();
+      if (!stdout) { finish({ permission: "allow" }); return; }
+      try {
+        finish(JSON.parse(stdout));
+      } catch (err) {
+        debug(`parse error: ${err && err.message ? err.message : String(err)}`);
+        finish({ permission: "allow" });
+      }
+    });
+    try {
+      child.stdin.end(JSON.stringify(payload));
+    } catch (err) {
+      debug(`stdin write failed: ${err && err.message ? err.message : String(err)}`);
+      finish({ permission: "allow" });
+    }
+  });
+}
+
+/** Claude-shaped stdin base. Extra keys are ignored by the binary's payload
+ *  parser; they're forwarded for future use / activity attribution. */
+function baseMeta(payload, ctx, config) {
+  const p = payload || {};
+  const c = ctx || {};
+  return {
+    session_id: c.sessionId ?? p.sessionId ?? c.sessionKey ?? p.sessionKey,
+    cwd: workspaceContext.resolveWorkspace(p, c, config) ?? process.cwd(),
+    transcript_path: p.transcriptPath,
+    stop_hook_active: p.stopHookActive === true,
+    openclaw: {
+      agentId: c.agentId,
+      sessionKey: c.sessionKey ?? p.sessionKey,
+      runId: c.runId ?? p.runId,
+      provider: p.provider,
+      model: p.model,
+    },
+  };
+}
 
 export default definePluginEntry({
   id: "failproofai",
   name: "failproofai",
   description: "Real-time policy enforcement for OpenClaw by failproofai",
   register(api) {
-    registerFailproofaiHooks(api);
+    // before_tool_call → PreToolUse. Deny always blocks. Instruct blocks the
+    // first matching attempt only, using blockReason to give the model the
+    // instruction, then permits retries from that session/policy for 5 minutes.
+    api.on(
+      "before_tool_call",
+      async (payload, ctx) => {
+        const p = payload || {};
+        const verdict = await callPolicy("before_tool_call", {
+          ...baseMeta(payload, ctx, api.config),
+          tool_name: p.toolName,
+          tool_input: p.params,
+          hook_event_name: "before_tool_call",
+        });
+        return mapBeforeToolVerdict(verdict, payload, ctx, instructRetryGate);
+      },
+      { priority: 100, timeoutMs: 60_000 },
+    );
+
+    // before_agent_run → UserPromptSubmit. Deny: return {outcome:"block", reason}.
+    api.on(
+      "before_agent_run",
+      async (payload, ctx) => {
+        const p = payload || {};
+        workspaceContext.remember(payload, ctx);
+        const verdict = await callPolicy("before_agent_run", {
+          ...baseMeta(payload, ctx, api.config),
+          prompt: p.prompt,
+          hook_event_name: "before_agent_run",
+        });
+        if (verdict.permission === "deny") {
+          return { outcome: "block", reason: verdict.reason || "Blocked by failproofai" };
+        }
+        return undefined;
+      },
+      { priority: 100, timeoutMs: 60_000 },
+    );
+
+    // before_agent_finalize → Stop. The real turn-end gate: a deny becomes a
+    // revise so the agent runs another pass. The evaluator supplies the
+    // MANDATORY ACTION wording; the payload's stop_hook_active guards the
+    // require-*-before-stop builtins against infinite loops.
+    api.on(
+      "before_agent_finalize",
+      async (payload, ctx) => {
+        const verdict = await callPolicy("before_agent_finalize", {
+          ...baseMeta(payload, ctx, api.config),
+          hook_event_name: "before_agent_finalize",
+        });
+        if (verdict.permission === "deny") {
+          return { action: "revise", reason: verdict.reason || "Action required by failproofai" };
+        }
+        return undefined;
+      },
+      { priority: 100, timeoutMs: 60_000 },
+    );
+
+    // Observation hooks — await so activity ordering is stable, ignore verdict.
+    // after_tool_call → PostToolUse; session_start/end → SessionStart/End;
+    // subagent_ended → SubagentStop (obs only); before_compaction → PreCompact.
+    for (const ev of [
+      "after_tool_call",
+      "session_start",
+      "session_end",
+      "subagent_ended",
+      "before_compaction",
+    ]) {
+      api.on(
+        ev,
+        async (payload, ctx) => {
+          const p = payload || {};
+          await callPolicy(ev, {
+            ...baseMeta(payload, ctx, api.config),
+            tool_name: p.toolName,
+            tool_input: p.params,
+            tool_response: p.result,
+            reason: p.reason,
+            hook_event_name: ev,
+          });
+          if (ev === "session_end") {
+            instructRetryGate.clear(payload, ctx);
+            workspaceContext.clear(payload, ctx);
+          }
+          return undefined;
+        },
+        { priority: 100, timeoutMs: 60_000 },
+      );
+    }
   },
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "failproofai",
-  "version": "1.0.13-beta.1",
+  "version": "1.0.13-beta.2",
   "description": "Observability and enforcement for AI agent harnesses. 40 built-in policies hooked into 12 of them — Claude Code, Codex, Cursor, Hermes, OpenClaw and more — blocking the tool call before it runs. Local dashboard included, no account needed.",
   "bin": {
     "failproofai": "./dist/cli.mjs",
@@ -126,15 +126,15 @@
     "browserslist": "4.28.8"
   },
   "optionalDependencies": {
-    "@failproofai/failproofaid-linux-x64": "1.0.13-beta.1",
-    "@failproofai/failproofaid-linux-arm64": "1.0.13-beta.1",
-    "@failproofai/failproofaid-darwin-x64": "1.0.13-beta.1",
-    "@failproofai/failproofaid-darwin-arm64": "1.0.13-beta.1"
+    "@failproofai/failproofaid-linux-x64": "1.0.13-beta.2",
+    "@failproofai/failproofaid-linux-arm64": "1.0.13-beta.2",
+    "@failproofai/failproofaid-darwin-x64": "1.0.13-beta.2",
+    "@failproofai/failproofaid-darwin-arm64": "1.0.13-beta.2"
   },
   "failproofaidBinaries": {
-    "linux-x64": "d257e616d9f5a7ab76ceabbc7ac918e29555034458468697929fb6d109e35f3f",
-    "linux-arm64": "583d8e0c5cdae34bb0b2083fd1c8448d06a927ad4ca9ee6978127b54eecb27a0",
-    "darwin-x64": "68943a0b03c021f693f3c5f57acfc66d096bfd8bc7be57abff9ef826508de11a",
-    "darwin-arm64": "49fa29ad396b85dccac135cf44ceaeb83efd3934471d86160f75b081fae04eae"
+    "linux-x64": "8301567948ddf752b6db30ed5998e62139df4c7e1669b280159a83a9b951b94c",
+    "linux-arm64": "ad53ec24d7c09b2dbc07b792c0739dc1e5f443fdb9a795174d3a40453f90bbcf",
+    "darwin-x64": "e4e65a1071a5793bafb73625dc49d211ff19d7e0d8c03c804959d1357aebea1e",
+    "darwin-arm64": "78aa90272e2ace07ac3648a419b961f8d8bfe56c7fd3a0193d3579085d77e9cb"
   }
 }

package/src/hooks/daemon-service.ts

@@ -13,12 +13,14 @@ import {
   mkdirSync,
   mkdtempSync,
   readFileSync,
+  readdirSync,
+  statSync,
   writeFileSync,
   unlinkSync,
   rmSync,
 } from "node:fs";
 import { homedir, tmpdir, userInfo } from "node:os";
-import { resolve } from "node:path";
+import { dirname, resolve } from "node:path";
 import { execFileSync } from "node:child_process";
 import { hookLogWarn } from "./hook-logger";
 import { downloadFailproofaidBinary, installFromNpmPackage, installedBinaryPath } from "./daemon-download";
@@ -413,6 +415,142 @@ function systemdUnitPath(user: string = serviceUser()): string {
   return resolve(systemdUnitDir(), systemdUnitName(user));
 }
 
+/**
+ * Where a Linux install puts the copy of the daemon that systemd actually runs:
+ * `/opt/failproofai/<user>/bin/failproofaid-<version>`, root-owned.
+ *
+ * The binary is downloaded into `~/.failproofai/bin`, and a unit whose
+ * `ExecStart` points there works on Debian, Ubuntu and Mint — and on Fedora,
+ * RHEL, Rocky and Alma it never starts. Those ship SELinux enforcing, a file
+ * under a home directory is labelled `user_home_t`, and the targeted policy
+ * gives systemd (`init_t`) no execute permission on that type at all. The unit
+ * fails `203/EXEC Permission denied`, `waitForDaemonRunning()` times out, and
+ * `failproofai config` aborts at its very last step.
+ *
+ * The policy's generic `/opt/(.*\/)?bin(/.*)?` rule labels this path `bin_t`,
+ * which systemd may execute, and executing it moves the daemon into
+ * `unconfined_service_t` — the domain that may in turn run the worker's node
+ * from `~/.nvm` (also `user_home_t`) and accept hooks on the socket. So only
+ * the daemon binary moves; the worker command, the socket and the state under
+ * `~/.failproofai` stay where they are. Not `/usr/local/libexec`: both
+ * policies label that `usr_t`, which starts the daemon only through a
+ * secondary `init_t usr_t → unconfined_service_t` rule, where `bin_t` is the
+ * type the policy means for programs. Not `/usr/libexec` either: `/usr` is the
+ * package manager's, and read-only on Silverblue and CoreOS. All checked
+ * against the shipped policy on Fedora 41 and Rocky 9 with `matchpathcon` and
+ * `sesearch`.
+ *
+ * Per user for the same reason the unit name is: two people on one box may run
+ * different versions, and one's uninstall must not delete the other's binary.
+ * The `~/.failproofai/bin` copy is kept — `daemonVersionSkew()` and
+ * `refreshDaemonToCliVersion()` read the installed version from it.
+ *
+ * Redirectable for tests ONLY, like the unit directory.
+ */
+function systemBinaryRoot(user: string = serviceUser()): string {
+  return resolve(process.env.FAILPROOFAI_SYSTEM_BIN_DIR || "/opt/failproofai", user);
+}
+
+function systemBinaryDir(): string {
+  return resolve(systemBinaryRoot(), "bin");
+}
+
+/** The system binary directory on Linux, for the manual-removal instructions. */
+export function daemonSystemBinaryDir(): string | null {
+  return process.platform === "linux" ? systemBinaryRoot() : null;
+}
+
+/**
+ * The path systemd should start for `binaryPath`, or null when it should start
+ * `binaryPath` itself.
+ *
+ * Only a real file is copied. `FAILPROOFAI_DAEMON_BINARY` is "someone named a
+ * binary explicitly" and may be a command with arguments (this repo's own
+ * systemd tests use `/usr/bin/sleep infinity`), so it is started as given.
+ */
+export function systemBinaryTarget(binaryPath: string): string | null {
+  if (process.platform !== "linux" || process.env.FAILPROOFAI_DAEMON_BINARY) return null;
+  try {
+    if (!statSync(binaryPath).isFile()) return null;
+  } catch {
+    return null;
+  }
+  return resolve(systemBinaryDir(), `failproofaid-${version}`);
+}
+
+/**
+ * Whether this kernel has SELinux enabled. `/sys/fs/selinux` is mounted only
+ * when it is, enforcing or permissive.
+ */
+function selinuxEnabled(): boolean {
+  return existsSync("/sys/fs/selinux/enforce");
+}
+
+/**
+ * Copies the daemon binary into the system directory and returns the path the
+ * unit should start. Privileged; throws when the copy fails, which the caller
+ * reports as a failed install before any unit is written.
+ *
+ * Staged under a temp name and renamed into place, so a reinstall of the same
+ * version never writes into the file a running daemon was started from.
+ *
+ * `restorecon` afterwards, because a new file inherits the label of the
+ * directory it is created in, not the one the policy assigns to its path: the
+ * directories `install -d` creates under `/opt` (`usr_t`) come out `usr_t`
+ * too, never the `bin_t` the policy names for them.
+ */
+function stageSystemBinary(binaryPath: string): string {
+  const target = systemBinaryTarget(binaryPath);
+  if (!target) return binaryPath;
+  const dir = systemBinaryDir();
+  const staging = `${target}.${process.pid}.tmp`;
+  runPrivileged("install", ["-d", "-m", "0755", dir]);
+  try {
+    runPrivileged("install", ["-m", "0755", binaryPath, staging]);
+    runPrivileged("mv", ["-f", staging, target]);
+  } catch (err) {
+    try {
+      runPrivileged("rm", ["-f", staging]);
+    } catch {
+      /* best-effort */
+    }
+    throw err;
+  }
+  if (selinuxEnabled()) {
+    const root = systemBinaryRoot();
+    try {
+      runPrivileged("restorecon", ["-R", root]);
+    } catch (err) {
+      // Not fatal here: a wrong label still surfaces as the daemon not
+      // reaching a running state, which fails the install with its status.
+      hookLogWarn(`restorecon on ${root} failed: ${err instanceof Error ? err.message : String(err)}`);
+    }
+  }
+  return target;
+}
+
+/**
+ * Removes system copies other than `current` and the most recent one before
+ * it — the same keep-one-for-rollback rule `pruneOldDaemonBinaries()` applies
+ * to `~/.failproofai/bin`. Best-effort; only called once the service runs
+ * `current`.
+ */
+function pruneSystemBinaries(current: string): void {
+  try {
+    const dir = systemBinaryDir();
+    const stale = readdirSync(dir)
+      .filter((f) => f.startsWith("failproofaid-"))
+      .map((f) => resolve(dir, f))
+      .filter((p) => p !== current)
+      .map((p) => ({ p, mtime: statSync(p).mtimeMs }))
+      .sort((a, b) => b.mtime - a.mtime)
+      .slice(1);
+    for (const { p } of stale) runPrivileged("rm", ["-f", p]);
+  } catch {
+    // Nothing to prune, or no elevation left — leaving a file costs disk only.
+  }
+}
+
 /**
  * The pre-1.0.0-beta.1 user-scope unit. Still removed on install and
  * uninstall: it holds the same flock the new service needs, so leaving one
@@ -792,8 +930,18 @@ function daemonInstallCommands(
   cliCmd: string | null,
 ): string[] {
   if (process.platform === "linux") {
+    const target = systemBinaryTarget(binaryPath);
+    const dir = systemBinaryDir();
+    const stage = target
+      ? [
+          `sudo install -d -m 0755 ${dir}`,
+          `sudo install -m 0755 ${binaryPath} ${target}`,
+          `{ sudo restorecon -R ${systemBinaryRoot()} 2>/dev/null || true; }`,
+        ]
+      : [];
     return [
-      `sudo tee ${systemdUnitPath()} <<'EOF'\n${systemdUnitContents(binaryPath, workerCmd, cliCmd)}EOF`,
+      ...stage,
+      `sudo tee ${systemdUnitPath()} <<'EOF'\n${systemdUnitContents(target ?? binaryPath, workerCmd, cliCmd)}EOF`,
       "sudo systemctl daemon-reload",
       `sudo systemctl enable ${systemdUnitName()}`,
       // `restart`, not `enable --now`, for the reason the install path gives:
@@ -865,9 +1013,13 @@ export async function installDaemonService(): Promise<DaemonInstallResult> {
   // never came up. Clear it first, every time.
   removeLegacyUserService();
 
+  let execPath = binaryPath;
   try {
     if (process.platform === "linux") {
-      writePrivilegedFile(systemdUnitPath(), systemdUnitContents(binaryPath, workerCmd, cliCmd));
+      // Before the unit is written, so a copy that fails leaves the previous
+      // unit and the daemon it runs untouched. See `systemBinaryDir()`.
+      execPath = stageSystemBinary(binaryPath);
+      writePrivilegedFile(systemdUnitPath(), systemdUnitContents(execPath, workerCmd, cliCmd));
       runPrivileged("systemctl", ["daemon-reload"]);
       // `enable` for boot persistence, then `restart` — NOT `enable --now`.
       //
@@ -927,6 +1079,7 @@ export async function installDaemonService(): Promise<DaemonInstallResult> {
     hookLogWarn(`daemon service install failed: ${reason}`);
     return { installed: false, reason };
   }
+  if (execPath !== binaryPath) pruneSystemBinaries(execPath);
 
   // NOTE: this reports that the SERVICE is installed and running, which is all
   // it can honestly claim. Whether the daemon can actually evaluate a hook is a
@@ -1683,6 +1836,18 @@ export async function uninstallDaemonService(): Promise<void> {
       } catch {
         // Best-effort.
       }
+      // The copy systemd ran. After the unit is gone, so nothing enabled is
+      // left pointing at a deleted file. The shared parent goes only if no
+      // other user's directory is in it.
+      const binRoot = systemBinaryRoot();
+      if (existsSync(binRoot)) {
+        runPrivileged("rm", ["-rf", binRoot]);
+        try {
+          runPrivileged("rmdir", [dirname(binRoot)]);
+        } catch {
+          // Not empty — another user's daemon lives there.
+        }
+      }
     } else {
       const plistPath = launchdPlistPath();
       if (!existsSync(plistPath)) return;

package/src/hooks/enforcement-capability.ts

@@ -182,7 +182,7 @@ export const ENFORCEMENT_CAPABILITY: Record<
 
   // ── openclaw ──────────────────────────────────────────────────────────────
   // openclaw/openclaw @f8ed8ecf (v2026.7.2) + our own shipped shim
-  // openclaw-plugin/hooks.js, which returns undefined for 5 of the 8 hooks.
+  // openclaw-plugin/index.js, which returns undefined for 5 of the 8 hooks.
   openclaw: {
     PreToolUse: "block",           // before_tool_call -> shim returns {block:true, blockReason}
     UserPromptSubmit: "block",     // before_agent_run -> shim returns {outcome:"block", reason}

package/src/hooks/integrations.ts

@@ -2277,10 +2277,8 @@ export function unhookedHermesProfiles(): string[] {
 // OpenClaw is a self-hosted assistant gateway. Enforcement is via its in-process
 // PLUGIN hooks (file-based "internal hooks" are observation-only), so failproofai
 // ships a static plugin package (`openclaw-plugin/`, like Pi's pi-extension) that
-// asks failproofaid for each verdict over its Unix socket — like the Hermes plugin,
-// and so likewise daemon-only — and maps verdicts back. It cannot spawn the CLI:
-// OpenClaw ≥ 2026.9.6 loads plugins from a copy that holds only the plugin dir.
-// Install registers the plugin in every profile's `openclaw.json` (JSON):
+// async-spawns the binary and maps verdicts back. Install registers the plugin in
+// every profile's `openclaw.json` (JSON):
 //   • plugins.load.paths[]  → the shipped openclaw-plugin dir (absolute path)
 //   • plugins.entries.failproofai = { enabled: true, hooks: { allowConversationAccess: true } }
 //     (allowConversationAccess is required for the raw-conversation hooks
@@ -2320,7 +2318,6 @@ function isFailproofaiOpenClawPath(p: unknown): boolean {
 export const openclaw: Integration = {
   id: "openclaw",
   displayName: "OpenClaw",
-  requiresHealthyDaemon: true,
   scopes: OPENCLAW_HOOK_SCOPES,
   eventTypes: OPENCLAW_HOOK_EVENT_TYPES,
 

package/src/hooks/uninstall-cli.ts

@@ -39,6 +39,7 @@ import {
   daemonServiceFilePath,
   daemonServiceStatus,
   daemonStatusCommand,
+  daemonSystemBinaryDir,
   isDaemonSupportedPlatform,
   primeElevation,
   setDaemonConfigured,
@@ -417,10 +418,12 @@ function manualServiceRemoval(servicePath: string): string[] {
     return [`sudo launchctl unload -w ${servicePath}`, `sudo rm -f ${servicePath}`];
   }
   const unit = servicePath.split("/").pop() ?? servicePath;
+  const binDir = daemonSystemBinaryDir();
   return [
     `sudo systemctl disable --now ${unit}`,
     `sudo rm -f ${servicePath}`,
     `sudo systemctl daemon-reload`,
+    ...(binDir ? [`sudo rm -rf ${binDir}`] : []),
   ];
 }