failproofai 1.0.4 → 1.0.5-beta.1

package/.next/standalone/lib/openclaw-sessions.ts

@@ -1,11 +1,9 @@
 /**
  * OpenClaw (openclaw gateway) session transcript loader + parser.
  *
- * AUDIT-ONLY (Pillar 2). OpenClaw writes one JSONL transcript per session at
- * `~/.openclaw/agents/<agentId>/sessions/<sessionId>.jsonl` (sessionId is a
- * UUID), alongside a much larger `<sessionId>.trajectory.jsonl` OTel trace we
- * IGNORE, and a `sessions.json` index keyed by sessionKey. Verified live
- * against openclaw v2026.7.1.
+ * Legacy OpenClaw writes one JSONL transcript per session under `sessions/`;
+ * 2026.9.2+ stores the same logical records as `event_json` rows in each
+ * agent's `agent/openclaw-agent.sqlite`. SQLite is preferred when both exist.
  *
  * The transcript is type-discriminated JSONL:
  *   {type:"session", cwd, …}              — header (carries cwd)
@@ -18,8 +16,8 @@
  * `toolResult` by `toolCallId` (mirrors lib/hermes-sessions.ts) and is PURE, so
  * it is unit-testable with plain line objects.
  *
- * Home override: set `OPENCLAW_HOME` (used by tests / to point at a copied
- * gateway config dir).
+ * Home override: `OPENCLAW_STATE_DIR`, then `OPENCLAW_HOME` (used by tests /
+ * to point at a copied gateway config dir).
  */
 import { readFile } from "node:fs/promises";
 import { readdirSync, statSync } from "node:fs";
@@ -39,13 +37,18 @@ import {
   type LogSource,
 } from "./log-entries";
 import { formatDuration } from "./format-duration";
+import { readOpenClawSqliteTranscript } from "./openclaw-db";
 
 /** OpenClaw sessions are stored under UUID filenames. */
 export const OPENCLAW_SESSION_ID_RE = /^[0-9a-fA-F-]{36}$/;
 
-/** Absolute path to OpenClaw's config home (override with OPENCLAW_HOME). */
+/** Absolute path to OpenClaw's state home. */
 export function openclawHome(): string {
-  return process.env.OPENCLAW_HOME || join(homedir(), ".openclaw");
+  return (
+    process.env.OPENCLAW_STATE_DIR ||
+    process.env.OPENCLAW_HOME ||
+    join(homedir(), ".openclaw")
+  );
 }
 
 // ── Parsing helpers ──
@@ -60,7 +63,11 @@ function extractText(content: unknown): string {
   if (typeof content === "string") return content;
   if (Array.isArray(content)) {
     return content
-      .map((c) => (isPlainObject(c) && typeof c.text === "string" ? (c.text as string) : ""))
+      .map((c) =>
+        isPlainObject(c) && typeof c.text === "string"
+          ? (c.text as string)
+          : "",
+      )
       .filter(Boolean)
       .join("\n");
   }
@@ -134,7 +141,10 @@ export function openclawLinesToLogEntries(
           if (b.type === "text" && typeof b.text === "string") {
             blocks.push({ type: "text", text: b.text });
           } else if (b.type === "toolCall") {
-            const id = typeof b.id === "string" ? b.id : `${String(b.name ?? "tool")}-${blocks.length}`;
+            const id =
+              typeof b.id === "string"
+                ? b.id
+                : `${String(b.name ?? "tool")}-${blocks.length}`;
             const name = typeof b.name === "string" ? b.name : "tool";
             const input = isPlainObject(b.arguments) ? b.arguments : {};
             const block: ToolUseBlock = { type: "tool_use", id, name, input };
@@ -151,17 +161,23 @@ export function openclawLinesToLogEntries(
       entries.push({
         type: "assistant",
         ...base,
-        message: { role: "assistant", content: blocks, model: typeof m.model === "string" ? m.model : undefined },
+        message: {
+          role: "assistant",
+          content: blocks,
+          model: typeof m.model === "string" ? m.model : undefined,
+        },
       } satisfies AssistantEntry);
       continue;
     }
 
     if (role === "toolResult") {
-      const callId = typeof m.toolCallId === "string" ? m.toolCallId : undefined;
+      const callId =
+        typeof m.toolCallId === "string" ? m.toolCallId : undefined;
       const block = callId ? toolUseById.get(callId) : undefined;
       if (block) {
         const details = isPlainObject(m.details) ? m.details : undefined;
-        const startMs = (callId && toolUseStartMs.get(callId)) || date.getTime();
+        const startMs =
+          (callId && toolUseStartMs.get(callId)) || date.getTime();
         const durationMs =
           details && typeof details.durationMs === "number"
             ? details.durationMs
@@ -238,13 +254,20 @@ export function listOpenClawTranscripts(): OpenClawTranscriptFile[] {
     }
     for (const file of files) {
       // Only `<uuid>.jsonl` — not `<uuid>.trajectory.jsonl` / `.trajectory-path.json`.
-      if (!file.endsWith(".jsonl") || file.endsWith(".trajectory.jsonl")) continue;
+      if (!file.endsWith(".jsonl") || file.endsWith(".trajectory.jsonl"))
+        continue;
       const sessionId = file.slice(0, -".jsonl".length);
       if (!OPENCLAW_SESSION_ID_RE.test(sessionId)) continue;
       const transcriptPath = join(sessionsDir, file);
       try {
         const st = statSync(transcriptPath);
-        out.push({ agentId, sessionId, transcriptPath, mtimeMs: st.mtimeMs, sizeBytes: st.size });
+        out.push({
+          agentId,
+          sessionId,
+          transcriptPath,
+          mtimeMs: st.mtimeMs,
+          sizeBytes: st.size,
+        });
       } catch {
         // skip unreadable
       }
@@ -276,6 +299,36 @@ export interface OpenClawSessionLogData {
 export async function getOpenClawSessionLog(
   sessionId: string,
 ): Promise<OpenClawSessionLogData | null> {
+  if (!OPENCLAW_SESSION_ID_RE.test(sessionId)) return null;
+
+  // New OpenClaw versions keep live transcripts in SQLite. Prefer that copy
+  // when an archived JSONL with the same UUID also exists.
+  const sqlite = await readOpenClawSqliteTranscript(
+    openclawHome(),
+    listOpenClawAgents(),
+    sessionId,
+  );
+  if (sqlite) {
+    const entries = openclawLinesToLogEntries(sqlite.rawLines, "session");
+    let cwd: string | undefined;
+    for (const line of sqlite.rawLines) {
+      if (
+        line.type === "session" &&
+        typeof line.cwd === "string" &&
+        line.cwd.length > 0
+      ) {
+        cwd = line.cwd;
+        break;
+      }
+    }
+    return {
+      entries,
+      rawLines: sqlite.rawLines,
+      cwd,
+      filePath: sqlite.filePath,
+    };
+  }
+
   const filePath = findOpenClawTranscript(sessionId);
   if (!filePath) return null;
   let content: string;
@@ -289,7 +342,12 @@ export async function getOpenClawSessionLog(
   // cwd lives on the `type:"session"` header line.
   let cwd: string | undefined;
   for (const line of rawLines) {
-    if (isPlainObject(line) && line.type === "session" && typeof line.cwd === "string" && line.cwd.length > 0) {
+    if (
+      isPlainObject(line) &&
+      line.type === "session" &&
+      typeof line.cwd === "string" &&
+      line.cwd.length > 0
+    ) {
       cwd = line.cwd;
       break;
     }

package/.next/standalone/package.json

@@ -1,6 +1,6 @@
 {
   "name": "failproofai",
-  "version": "1.0.4",
+  "version": "1.0.5-beta.1",
   "description": "Observability and enforcement for AI agent harnesses. 39 built-in policies hooked into 12 of them — Claude Code, Codex, Cursor, Hermes, OpenClaw and more — blocking the tool call before it runs. Local dashboard included, no account needed.",
   "bin": {
     "failproofai": "./dist/cli.mjs",
@@ -121,15 +121,15 @@
     "browserslist": "4.28.8"
   },
   "optionalDependencies": {
-    "@failproofai/failproofaid-linux-x64": "1.0.4",
-    "@failproofai/failproofaid-linux-arm64": "1.0.4",
-    "@failproofai/failproofaid-darwin-x64": "1.0.4",
-    "@failproofai/failproofaid-darwin-arm64": "1.0.4"
+    "@failproofai/failproofaid-linux-x64": "1.0.5-beta.1",
+    "@failproofai/failproofaid-linux-arm64": "1.0.5-beta.1",
+    "@failproofai/failproofaid-darwin-x64": "1.0.5-beta.1",
+    "@failproofai/failproofaid-darwin-arm64": "1.0.5-beta.1"
   },
   "failproofaidBinaries": {
-    "linux-x64": "cca1d41ff951784ba084bf2d72cfad0fe8d988f8226e0e7a4538b1fb8d76a5bd",
-    "linux-arm64": "55e9c1e2864cbf6057fd0c27e4bc573ca8fba2cd35d480a3db3a55d398e7bec0",
-    "darwin-x64": "2a46ec77d2cac14a036f35e832f92f16895239814a5f10f02121f3c313e70574",
-    "darwin-arm64": "a0e7ccc6fe24e1017592637192ba8a26c9d05ca839c98bc72a983094c863b39b"
+    "linux-x64": "c782c8d7c8522bf8af6f776640cae80fa671affa5b92d8c09e646c8f381d7fd4",
+    "linux-arm64": "6e9717ef40872a530501ad17cc6bc9743546968e11acf45f87f35488d1563e28",
+    "darwin-x64": "b47adb286e2cf08370ec2e1293ea3ed42891c7d2a8a1bece3da8e3e2b0d72f7a",
+    "darwin-arm64": "a5095522dc3f2518fc8177e9e2a3048062540958e3b623b198b401a7d6a2ddd5"
   }
 }

package/.next/standalone/sdk/python/CHANGELOG.md

@@ -9,19 +9,49 @@ in `failproofai_sdk/_version.py` becomes that release's GitHub Release body. A
 release whose section is missing or empty is refused before anything is built —
 see `scripts/changelog-section.py`.
 
-## 0.0.1b3 — 2026-09-08
+## 0.0.1b4 — 2026-09-12
 
-Open for the next release. `0.0.1b2` published on 2026-09-08 and the `bump` job
-moved the version here automatically; nothing has landed against `0.0.1b3` yet.
+Open for the next release. `0.0.1b3` published on 2026-09-12 and the `bump` job
+moved the version here automatically; nothing has landed against `0.0.1b4` yet.
 Add entries as changes merge — this section becomes the GitHub Release body when
 it ships.
 
-## 0.0.1b2 — 2026-08-25
+## 0.0.1b3 — 2026-09-08
 
-Open for the next release. `0.0.1b1` published on 2026-08-24 and the `bump` job
-moved the version here automatically; nothing has landed against `0.0.1b2` yet.
-Add entries as changes merge — this section becomes the GitHub Release body when
-it ships.
+### Fixes
+
+- Redact common credential shapes before SDK events reach the on-disk spool.
+  The daemon already exposes `collector.redact`, but SDK-written batches could
+  contain raw API keys, bearer tokens, JWTs, or secret assignments at rest until
+  upload. The SDK now applies the same deterministic minimal rules before each
+  JSONL write, defaults safely to redaction when configuration is absent or
+  malformed, and honors `collector.redact: off` when verbatim capture is
+  explicitly required. The daemon repeats the pass before upload as defence in
+  depth for batches written by older SDK versions.
+- **`None` on a promoted column is now dropped and warned about, not refused.**
+  A promoted key left at `None` in `**fields` reached the wire as an explicit
+  JSON `null`, so `_validate_promoted_string` refused it outright. But `None` is
+  how a caller says *I have no value*, and the refusal landed inside their emit
+  helper — which swallows telemetry errors, because telemetry must not break a
+  run. The event vanished with nothing logged.
+
+  `agent_end(error_type=None)` is the shape **every successful run** produces:
+  `error_type` is populated only on a failing outcome. Found against a real
+  multi-agent app, where it silently dropped `agent_end` for every session that
+  succeeded — leaving each one with a dangling `agent_start`, no outcome, and no
+  evaluation, since the server triggers evaluation on `agent_end`.
+
+- **The same fix closes the mirror bug on promoted numerics.** `_build` omits
+  `None` only from a dataclass's named `specifics`; `extra` is merged verbatim.
+  So `duration_ms=None` was dropped when passed as a named parameter and written
+  as an explicit `null` when passed through `**fields` — the same value, two
+  outcomes, decided by which door it came through.
+
+  Both paths now agree: for a promoted column, no value means no key. Nothing
+  that worked before changes, and no explicit `null` reaches a promoted column
+  from either direction.
+
+## 0.0.1b2 — 2026-08-25
 
 - Retire the old inbound evaluator boundary and add evaluator authoring plus the
   outbound-only v2 worker runtime under the lazy `failproofai_sdk.evaluator`

package/.next/standalone/sdk/python/failproofai_sdk/_events.py

@@ -99,6 +99,11 @@ def _validate_promoted_string(name: str, value) -> None:
     own call. `_build` copies the base dict verbatim, so a `None` here reached
     the wire as an explicit JSON `null`, the row was accepted at 200 OK, and the
     column was empty for some events and not others with nothing logged anywhere.
+
+    `**fields` no longer reaches this holding a `None`: `_validate_fields` drops
+    the key and warns, so an optional column the caller simply does not have
+    costs a log line rather than the whole event. The raise below stays as the
+    backstop for any direct caller.
     """
     if value is None:
         raise ValueError(
@@ -320,6 +325,21 @@ class EventNamespace:
         bad = _RESERVED & fields.keys()
         if bad:
             raise ValueError(f"Reserved field names cannot be used as custom fields: {sorted(bad)}")
+        # `_build` omits None only from a dataclass's named `specifics`; `extra`
+        # is merged verbatim, so a promoted key left at None reaches the wire as
+        # an explicit JSON null — accepted at 200 OK, stored as NULL, invisible
+        # to every filter on that column. For a promoted column "no value" has to
+        # mean "no key", so drop it here, the one place holding the caller's own
+        # dict. Warned rather than silent: passing None is still a mistake worth
+        # hearing about, it just must not cost the event.
+        for name in (_PROMOTED_NUMERIC | _PROMOTED_STRING) & fields.keys():
+            if fields[name] is None:
+                logger.warning(
+                    "%s was passed as None and has been omitted from the event; "
+                    "pass a value, or omit the argument entirely to silence this.",
+                    name,
+                )
+                del fields[name]
         for name in _PROMOTED_NUMERIC & fields.keys():
             _validate_promoted_numeric(name, fields[name])
         for name in _PROMOTED_STRING & fields.keys():

package/.next/standalone/sdk/python/failproofai_sdk/_redact.py

@@ -0,0 +1,233 @@
+"""Deterministic credential scrubbing for SDK spool files.
+
+This mirrors the daemon's minimal redaction boundary.  The SDK applies it
+before bytes reach disk; the daemon applies it again before upload so batches
+written by older SDKs receive the same protection.
+"""
+
+import json
+import os
+from pathlib import Path
+
+_PREFIX_RULES = (
+    ("sk-ant-api", 16, "anthropic-key"),
+    ("sk-ant-", 16, "anthropic-key"),
+    ("sk-proj-", 16, "openai-key"),
+    ("sk-", 16, "api-key"),
+    ("ghp_", 20, "github-token"),
+    ("gho_", 20, "github-token"),
+    ("ghu_", 20, "github-token"),
+    ("ghs_", 20, "github-token"),
+    ("ghr_", 20, "github-token"),
+    ("github_pat_", 20, "github-token"),
+    ("sb_secret_", 16, "supabase-key"),
+    ("sbp_", 20, "supabase-key"),
+    ("xoxb-", 16, "slack-token"),
+    ("xoxp-", 16, "slack-token"),
+    ("AKIA", 16, "aws-access-key-id"),
+    ("ASIA", 16, "aws-access-key-id"),
+)
+_STRONG_SECRET_NAMES = ("secret", "password", "passwd", "credential")
+_WEAK_SECRET_NAMES = ("key", "token")
+_MIN_ASSIGNMENT_VALUE = 12
+
+
+def _is_token_char(char: str) -> bool:
+    return char.isascii() and (char.isalnum() or char in "_-")
+
+
+def _at_boundary(value: str, start: int) -> bool:
+    return start == 0 or not _is_token_char(value[start - 1])
+
+
+def _match_prefix(value: str, start: int):
+    if not _at_boundary(value, start):
+        return None
+    for prefix, minimum, label in _PREFIX_RULES:
+        if not value.startswith(prefix, start):
+            continue
+        end = start + len(prefix)
+        while end < len(value) and _is_token_char(value[end]):
+            end += 1
+        if end - start - len(prefix) >= minimum:
+            return end - start, label
+    return None
+
+
+def _match_jwt(value: str, start: int):
+    if not _at_boundary(value, start) or not value.startswith("eyJ", start):
+        return None
+    end = start
+    segments = 0
+    while segments < 3:
+        segment_start = end
+        while end < len(value):
+            char = value[end]
+            if not (char.isascii() and (char.isalnum() or char in "-_=")):
+                break
+            end += 1
+        if end == segment_start:
+            break
+        segments += 1
+        if segments < 3 and end < len(value) and value[end] == ".":
+            end += 1
+        elif segments < 3:
+            break
+    length = end - start
+    if segments == 3 and length >= 40:
+        return length, "jwt"
+    return None
+
+
+def _match_bearer(value: str, start: int):
+    if value[start : start + 7].lower() != "bearer ":
+        return None
+    end = start + 7
+    token_bytes = 0
+    while end < len(value):
+        char = value[end]
+        if char.isspace() or char in "\"'":
+            break
+        token_bytes += len(char.encode("utf-8"))
+        end += 1
+    if token_bytes >= 8:
+        return end - start, "bearer-token"
+    return None
+
+
+def _is_secret_name(name: str) -> bool:
+    raw = name.strip("-")
+    lowered = raw.lower()
+    compound = "_" in raw or "-" in raw or any(char.isupper() for char in raw[1:])
+    return any(lowered.endswith(part) for part in _STRONG_SECRET_NAMES) or (
+        compound and any(lowered.endswith(part) for part in _WEAK_SECRET_NAMES)
+    )
+
+
+def _is_literal_secret(value: str) -> bool:
+    return (
+        len(value.encode("utf-8")) >= _MIN_ASSIGNMENT_VALUE
+        and not value.startswith(("{", "$", "<", "(", "`", "[redacted:"))
+    )
+
+
+def _match_assignment(value: str, start: int):
+    if start == 0:
+        return None
+    if value[start - 1] == "=" and value[start] in "\"'":
+        return None
+
+    quote = value[start - 1] if value[start - 1] in "\"'" else None
+    equals = start - 2 if quote else start - 1
+    if equals < 0 or value[equals] != "=":
+        return None
+
+    name_start = equals
+    while name_start > 0:
+        char = value[name_start - 1]
+        if not (char.isascii() and (char.isalnum() or char in "_-")):
+            break
+        name_start -= 1
+    if name_start == equals:
+        return None
+    if not _is_secret_name(value[name_start:equals]) or value.startswith(
+        ("{", "$", "<", "(", "`"), start
+    ):
+        return None
+
+    end = start
+    value_bytes = 0
+    while end < len(value):
+        char = value[end]
+        if (quote and char == quote) or (
+            not quote and (char.isspace() or char in ";&\"'")
+        ):
+            break
+        value_bytes += len(char.encode("utf-8"))
+        end += 1
+    if value_bytes >= _MIN_ASSIGNMENT_VALUE:
+        return end - start, "secret-assignment"
+    return None
+
+
+def scrub_string(value: str) -> tuple[str, int]:
+    """Return the minimally redacted string and replacement count."""
+    out = []
+    cursor = 0
+    copied_through = 0
+    hits = 0
+    while cursor < len(value):
+        match = (
+            _match_prefix(value, cursor)
+            or _match_jwt(value, cursor)
+            or _match_bearer(value, cursor)
+            or _match_assignment(value, cursor)
+        )
+        if match is None:
+            cursor += 1
+            continue
+        length, label = match
+        out.append(value[copied_through:cursor])
+        out.append(f"[redacted:{label}]")
+        cursor += length
+        copied_through = cursor
+        hits += 1
+    if not hits:
+        return value, 0
+    out.append(value[copied_through:])
+    return "".join(out), hits
+
+
+def redaction_enabled(base_dir: Path) -> bool:
+    """Read the daemon's redaction switch, defaulting safely to minimal."""
+    configured_home = os.environ.get("FAILPROOFAI_HOME")
+    if base_dir.name == "custom-agents":
+        config_path = base_dir.parent / "config.json"
+    elif configured_home:
+        config_path = Path(configured_home) / "config.json"
+    else:
+        config_path = Path.home() / ".failproofai" / "config.json"
+    try:
+        config = json.loads(config_path.read_text(encoding="utf-8"))
+        if not isinstance(config, dict):
+            return True
+        collector = config.get("collector")
+        return not isinstance(collector, dict) or collector.get("redact") != "off"
+    except (OSError, TypeError, ValueError):
+        return True
+
+
+def redact_json_line(encoded: str) -> str:
+    """Redact credential-shaped keys and string values in a valid JSON event."""
+    event = json.loads(encoded)
+    hits = 0
+
+    def scrub(value, field_name=None):
+        nonlocal hits
+        if isinstance(value, str):
+            value, count = scrub_string(value)
+            hits += count
+            if count == 0 and isinstance(field_name, str) and _is_secret_name(field_name):
+                if _is_literal_secret(value):
+                    hits += 1
+                    return "[redacted:secret-assignment]"
+            return value
+        if isinstance(value, list):
+            # Elements are more values for the same field, so its name still applies.
+            return [scrub(item, field_name) for item in value]
+        if isinstance(value, dict):
+            result = {}
+            for key, item in value.items():
+                redacted_key, count = scrub_string(key)
+                hits += count
+                unique_key = redacted_key
+                suffix = 2
+                while unique_key in result:
+                    unique_key = f"{redacted_key}#{suffix}"
+                    suffix += 1
+                result[unique_key] = scrub(item, key)
+            return result
+        return value
+
+    redacted = scrub(event)
+    return json.dumps(redacted) if hits else encoded

package/.next/standalone/sdk/python/failproofai_sdk/_version.py

@@ -1 +1 @@
-__version__ = "0.0.1b3"
+__version__ = "0.0.1b4"

package/.next/standalone/sdk/python/failproofai_sdk/_writer.py

@@ -9,9 +9,9 @@ import threading
 import weakref
 from datetime import datetime, timezone
 
+from failproofai_sdk._redact import redact_json_line, redaction_enabled
 from failproofai_sdk._resolver import get_base_dir
 
-
 logger = logging.getLogger(__name__)
 
 #: Per-process batch counter, so two batches written inside the same millisecond
@@ -638,11 +638,14 @@ class EventWriter:
         # whole batch goes back on the queue to be retried.
         lines = []
         dropped = 0
+        redact = redaction_enabled(get_base_dir())
         for entry in entries:
             encoded = _encode_entry(entry)
             if encoded is None:
                 dropped += 1
                 continue
+            if redact:
+                encoded = redact_json_line(encoded)
             lines.append(encoded)
 
         if dropped:

package/.next/standalone/sdk/python/failproofai_sdk/integrations/llama_index.py

@@ -498,11 +498,11 @@ class _State:
         recorded, so the setting looked like it had worked.
 
         That is the switch `docs/start/integrations/llamaindex.mdx` presents as
-        the control for regulated data, and `collector.redact` explicitly does
-        not apply to SDK events — so there is no second line of defence behind
-        it. The sibling adapters route every payload through one helper
-        (LangChain's `_shrink`, Pydantic AI's `capture_content` checks); this is
-        that helper.
+        the control for regulated data. Minimal credential redaction is defence
+        in depth, not a replacement for disabling content capture: it catches
+        known secret shapes, not arbitrary regulated content. The sibling
+        adapters route every payload through one helper (LangChain's `_shrink`,
+        Pydantic AI's `capture_content` checks); this is that helper.
         """
         if not self.capture_messages:
             return None

package/.next/standalone/sdk/python/tests/integrations/test_llama_index.py

@@ -1524,8 +1524,8 @@ def test_capture_messages_off_records_no_payload_anywhere(
     answers, the arguments and the outputs did not.
 
     `docs/start/integrations/llamaindex.mdx` presents this as the control for
-    regulated data, and `collector.redact` explicitly does not apply to SDK
-    events, so there was no second line of defence behind it.
+    regulated data. Minimal credential redaction cannot replace it: arbitrary
+    prompts and completions do not necessarily look like credentials.
     """
     llm = StubLLM(script=[("add", {"a": 987654321, "b": 123456789})], final="SECRET-COMPLETION")
     run_agent(calculator(llm), "SECRET-PROMPT: add them")