failproofai 1.0.5 → 1.0.6-beta.0

package/src/hooks/integrations.ts

@@ -7,7 +7,17 @@
  * is agent-agnostic — only install/uninstall plumbing varies.
  */
 import { execSync } from "node:child_process";
-import { readFileSync, writeFileSync, existsSync, mkdirSync, unlinkSync } from "node:fs";
+import {
+  cpSync,
+  readFileSync,
+  writeFileSync,
+  existsSync,
+  lstatSync,
+  mkdirSync,
+  renameSync,
+  rmSync,
+  unlinkSync,
+} from "node:fs";
 import { resolve, dirname } from "node:path";
 import { fileURLToPath } from "node:url";
 import { homedir } from "node:os";
@@ -135,6 +145,9 @@ export interface Integration {
   /** Read the raw settings/hooks file (returns {} when missing). */
   readSettings(settingsPath: string): Record<string, unknown>;
 
+  /** Install integration-owned files before enabling them in settings. */
+  prepareInstall?(settingsPath: string): void;
+
   /** Write the settings/hooks file. */
   writeSettings(settingsPath: string, settings: Record<string, unknown>): void;
 
@@ -1363,14 +1376,14 @@ function makePiProjectRelativeEntry(extPath: string): string {
   // works for the local user.
   return extResolved;
 }
-// ── Hermes (hermes-agent) — live hooks (Pillar 1) ────────────────────────────
+// ── Hermes (hermes-agent) — native plugin (Pillar 1) ────────────────────────
 //
-// External-command CLI like codex/cursor, but its config is YAML
-// (`~/.hermes/config.yaml`) under a `hooks:` map, so the I/O layer uses the yaml
-// Document API (comment-preserving). Flat per-event arrays like cursor:
-// `hooks: { pre_tool_call: [ { command, timeout, <marker> } ], … }`. Hermes
-// reads a `{"decision":"block",…}` JSON response on stdout (see
-// policy-evaluator.ts); exit codes are ignored. User-scope only.
+// Hermes loads trusted Python plugins from `<HERMES_HOME>/plugins/<name>/`.
+// The shipped plugin registers Hermes-native hooks and talks directly to the
+// local failproofaid socket, avoiding a fresh CLI process per event. Config is
+// YAML and profile-scoped; install copies the plugin into every profile and
+// adds `failproofai` to `plugins.enabled`. Legacy shell-hook entries are removed
+// during migration so one tool call is never evaluated twice.
 
 /** One hook entry as stored under a `hooks:` event key in config.yaml. */
 interface HermesHookEntry {
@@ -1379,6 +1392,200 @@ interface HermesHookEntry {
   [key: string]: unknown;
 }
 
+interface HermesPluginsConfig {
+  enabled?: unknown[];
+  disabled?: unknown[];
+  entries?: Record<string, unknown>;
+  [key: string]: unknown;
+}
+
+const HERMES_PLUGIN_ID = "failproofai";
+const HERMES_PLUGIN_MARKER = ".failproofai-managed";
+const HERMES_PLUGIN_FILES = ["plugin.yaml", "__init__.py", "client.py", "ledger.py"] as const;
+
+function getHermesPluginSourcePath(): string {
+  const fromEnv = process.env.FAILPROOFAI_PACKAGE_ROOT;
+  if (fromEnv) return resolve(fromEnv, "hermes-plugin");
+  return resolve(fileURLToPath(import.meta.url), "..", "..", "..", "hermes-plugin");
+}
+
+export function hermesPluginPathForSettings(settingsPath: string): string {
+  return resolve(dirname(settingsPath), "plugins", HERMES_PLUGIN_ID);
+}
+
+function hasManagedHermesPlugin(settingsPath: string): boolean {
+  const pluginPath = hermesPluginPathForSettings(settingsPath);
+  try {
+    if (lstatSync(pluginPath).isSymbolicLink()) return false;
+    if (!existsSync(resolve(pluginPath, HERMES_PLUGIN_MARKER))) return false;
+    return HERMES_PLUGIN_FILES.every((file) => existsSync(resolve(pluginPath, file)));
+  } catch {
+    return false;
+  }
+}
+
+function hasHermesPluginMarker(settingsPath: string): boolean {
+  const pluginPath = hermesPluginPathForSettings(settingsPath);
+  try {
+    return !lstatSync(pluginPath).isSymbolicLink() && existsSync(resolve(pluginPath, HERMES_PLUGIN_MARKER));
+  } catch {
+    return false;
+  }
+}
+
+function installHermesPlugin(settingsPath: string): void {
+  const source = getHermesPluginSourcePath();
+  for (const file of HERMES_PLUGIN_FILES) {
+    if (!existsSync(resolve(source, file))) {
+      throw new Error(`Hermes plugin asset is missing from the failproofai package: ${file}`);
+    }
+  }
+
+  const destination = hermesPluginPathForSettings(settingsPath);
+  if (existsSync(destination)) {
+    if (lstatSync(destination).isSymbolicLink() || !existsSync(resolve(destination, HERMES_PLUGIN_MARKER))) {
+      throw new Error(
+        `Refusing to overwrite an unmanaged Hermes plugin at ${destination}. ` +
+          `Move it aside or install FailproofAI under a different Hermes profile.`,
+      );
+    }
+  }
+
+  mkdirSync(dirname(destination), { recursive: true });
+  const suffix = `${process.pid}-${Date.now()}`;
+  const temporary = `${destination}.install-${suffix}`;
+  const backup = `${destination}.backup-${suffix}`;
+  let movedExisting = false;
+  try {
+    mkdirSync(temporary, { recursive: true });
+    for (const file of HERMES_PLUGIN_FILES) {
+      cpSync(resolve(source, file), resolve(temporary, file));
+    }
+    writeFileSync(
+      resolve(temporary, HERMES_PLUGIN_MARKER),
+      "Managed by failproofai. Remove with `failproofai policies --uninstall --cli hermes`.\n",
+      { encoding: "utf8", mode: 0o600 },
+    );
+    if (existsSync(destination)) {
+      renameSync(destination, backup);
+      movedExisting = true;
+    }
+    renameSync(temporary, destination);
+    if (movedExisting) rmSync(backup, { recursive: true, force: true });
+  } catch (err) {
+    rmSync(temporary, { recursive: true, force: true });
+    if (movedExisting && !existsSync(destination) && existsSync(backup)) {
+      renameSync(backup, destination);
+    }
+    throw err;
+  }
+}
+
+function removeManagedHermesPlugin(settingsPath: string): boolean {
+  const pluginPath = hermesPluginPathForSettings(settingsPath);
+  // The marker is the ownership boundary. Remove even an incomplete managed
+  // install so an interrupted copy can always be repaired or uninstalled.
+  if (!hasHermesPluginMarker(settingsPath)) return false;
+  rmSync(pluginPath, { recursive: true, force: true });
+  return true;
+}
+
+function removeLegacyHermesHooks(doc: Document): number {
+  const js = (doc.toJS() ?? {}) as { hooks?: Record<string, HermesHookEntry[]> };
+  const hooks = js.hooks;
+  let removed = 0;
+  if (hooks && typeof hooks === "object") {
+    for (const eventType of Object.keys(hooks)) {
+      const entries = hooks[eventType];
+      if (!Array.isArray(entries)) continue;
+      const before = entries.length;
+      const filtered = entries.filter((hook) => !isMarkedHook(hook));
+      removed += before - filtered.length;
+      if (filtered.length === 0) delete hooks[eventType];
+      else hooks[eventType] = filtered;
+    }
+    if (Object.keys(hooks).length === 0) {
+      doc.delete("hooks");
+      // Older FailproofAI installs set this broad Hermes switch so headless
+      // shell hooks could run. It is safe to remove only when no operator hook
+      // remains that may rely on it.
+      if (removed > 0) doc.delete("hooks_auto_accept");
+    } else {
+      doc.set("hooks", hooks);
+    }
+  }
+  return removed;
+}
+
+function hermesConfigState(settingsPath: string): {
+  pluginEnabled: boolean;
+  legacyShellHookPresent: boolean;
+} {
+  if (!existsSync(settingsPath)) {
+    return { pluginEnabled: false, legacyShellHookPresent: false };
+  }
+  const doc = readYamlDoc(settingsPath);
+  const js = (doc.toJS() ?? {}) as {
+    hooks?: Record<string, HermesHookEntry[]>;
+    plugins?: HermesPluginsConfig;
+  };
+  const enabled = js.plugins?.enabled;
+  const legacyShellHookPresent =
+    !!js.hooks &&
+    typeof js.hooks === "object" &&
+    Object.values(js.hooks).some(
+      (entries) => Array.isArray(entries) && entries.some((entry) => isMarkedHook(entry)),
+    );
+  return {
+    pluginEnabled: Array.isArray(enabled) && enabled.includes(HERMES_PLUGIN_ID),
+    legacyShellHookPresent,
+  };
+}
+
+export interface HermesProfileHealth {
+  name: string;
+  home: string;
+  settingsPath: string;
+  pluginInstalled: boolean;
+  pluginEnabled: boolean;
+  legacyShellHookPresent: boolean;
+  healthy: boolean;
+}
+
+/** Read-only, per-profile Hermes installation health for setup/status surfaces. */
+export function hermesProfileHealth(): HermesProfileHealth[] {
+  return listHermesProfiles().map((profile) => {
+    const settingsPath = resolve(profile.home, "config.yaml");
+    const config = hermesConfigState(settingsPath);
+    const pluginInstalled = hasManagedHermesPlugin(settingsPath);
+    return {
+      name: profile.name,
+      home: profile.home,
+      settingsPath,
+      pluginInstalled,
+      pluginEnabled: config.pluginEnabled,
+      legacyShellHookPresent: config.legacyShellHookPresent,
+      healthy: pluginInstalled && config.pluginEnabled && !config.legacyShellHookPresent,
+    };
+  });
+}
+
+/** Compact rows for the machine-status display; absent Hermes homes produce no noise. */
+export function hermesProfileStatusRows(): Array<[string, string]> {
+  return hermesProfileHealth()
+    .filter((profile) => existsSync(profile.home))
+    .map((profile) => {
+      const problems: string[] = [];
+      if (!profile.pluginInstalled) problems.push("plugin files missing or incomplete");
+      if (!profile.pluginEnabled) problems.push("plugin not enabled");
+      if (profile.legacyShellHookPresent) problems.push("legacy shell hook also present");
+      return [
+        "hermes/" + profile.name,
+        problems.length === 0 ? "native plugin enabled" : "UNHEALTHY — " + problems.join("; "),
+      ];
+    });
+}
+
 export const hermes: Integration = {
   id: "hermes",
   displayName: "Hermes",
@@ -1410,75 +1617,66 @@ export const hermes: Integration = {
     writeYamlDoc(settingsPath, settings as unknown as Document);
   },
 
-  buildHookEntry(binaryPath, eventType, scope) {
-    // No matcher → fires for ALL tools / all platforms (slack/telegram/cli/cron)
-    // and internal subagents. `timeout` is in seconds; Hermes runs the command
-    // via shlex.split (shell=false).
-    const command =
-      scope === "project"
-        ? `npx -y failproofai --hook ${eventType} --cli hermes`
-        : `"${binaryPath}" --hook ${eventType} --cli hermes`;
+  prepareInstall(settingsPath) {
+    installHermesPlugin(settingsPath);
+  },
+
+  buildHookEntry(_binaryPath, _eventType, _scope) {
+    // Native plugins are package-level registrations. This sentinel preserves
+    // the common Integration interface; writeHookEntries does the real work.
     return {
-      command,
-      timeout: 30,
       [FAILPROOFAI_HOOK_MARKER]: true,
+      _hermesPluginPath: getHermesPluginSourcePath(),
     };
   },
 
   isFailproofaiHook: isMarkedHook,
 
-  writeHookEntries(settings, binaryPath, scope) {
+  writeHookEntries(settings) {
     const doc = settings as unknown as Document;
-    // Read the current hooks map as plain JS, then re-set ONLY the `hooks` key —
-    // preserving comments on every other part of config.yaml.
-    const js = (doc.toJS() ?? {}) as { hooks?: Record<string, HermesHookEntry[]> };
-    const hooks: Record<string, HermesHookEntry[]> =
-      js.hooks && typeof js.hooks === "object" ? js.hooks : {};
-
-    for (const eventType of HERMES_HOOK_EVENT_TYPES) {
-      const entry = this.buildHookEntry(binaryPath, eventType, scope) as unknown as HermesHookEntry;
-      const arr = Array.isArray(hooks[eventType]) ? hooks[eventType] : [];
-      const idx = arr.findIndex((h) => isMarkedHook(h));
-      if (idx >= 0) arr[idx] = entry;
-      else arr.push(entry);
-      hooks[eventType] = arr;
+    // A native plugin and the legacy shell bridge running together would
+    // evaluate every event twice. Remove only failproofai-owned shell entries;
+    // unrelated operator hooks remain intact.
+    removeLegacyHermesHooks(doc);
+
+    const js = (doc.toJS() ?? {}) as { plugins?: HermesPluginsConfig };
+    const plugins: HermesPluginsConfig =
+      js.plugins && typeof js.plugins === "object" ? js.plugins : {};
+    const enabled = Array.isArray(plugins.enabled) ? [...plugins.enabled] : [];
+    if (!enabled.includes(HERMES_PLUGIN_ID)) enabled.push(HERMES_PLUGIN_ID);
+    plugins.enabled = enabled;
+    if (Array.isArray(plugins.disabled)) {
+      plugins.disabled = plugins.disabled.filter((name) => name !== HERMES_PLUGIN_ID);
+      if (plugins.disabled.length === 0) delete plugins.disabled;
     }
-    doc.set("hooks", hooks);
-    // The headless gateway has no TTY to answer Hermes's first-use hook-consent
-    // prompt, so auto-accept declared hooks. Tradeoff: also auto-accepts any
-    // other hook the operator adds; a targeted `shell-hooks-allowlist.json`
-    // pre-seed is a future refinement.
-    doc.set("hooks_auto_accept", true);
+    doc.set("plugins", plugins);
   },
 
   removeHooksFromFile(settingsPath) {
-    if (!existsSync(settingsPath)) return 0;
     const doc = readYamlDoc(settingsPath);
-    const js = (doc.toJS() ?? {}) as { hooks?: Record<string, HermesHookEntry[]> };
-    const hooks = js.hooks;
-
-    let removed = 0;
-    if (hooks && typeof hooks === "object") {
-      for (const eventType of Object.keys(hooks)) {
-        const entries = hooks[eventType];
-        if (!Array.isArray(entries)) continue;
-        const before = entries.length;
-        const filtered = entries.filter((h) => !isMarkedHook(h));
-        removed += before - filtered.length;
-        if (filtered.length === 0) delete hooks[eventType];
-        else hooks[eventType] = filtered;
+    let removed = removeLegacyHermesHooks(doc);
+    const js = (doc.toJS() ?? {}) as { plugins?: HermesPluginsConfig };
+    const plugins = js.plugins;
+    let configChanged = removed > 0;
+    if (plugins && typeof plugins === "object") {
+      if (Array.isArray(plugins.enabled)) {
+        const before = plugins.enabled.length;
+        plugins.enabled = plugins.enabled.filter((name) => name !== HERMES_PLUGIN_ID);
+        if (plugins.enabled.length !== before) {
+          removed += 1;
+          configChanged = true;
+        }
+        if (plugins.enabled.length === 0) delete plugins.enabled;
       }
-      if (removed > 0) {
-        if (Object.keys(hooks).length === 0) doc.delete("hooks");
-        else doc.set("hooks", hooks);
+      if (plugins.entries && HERMES_PLUGIN_ID in plugins.entries) {
+        delete plugins.entries[HERMES_PLUGIN_ID];
+        configChanged = true;
       }
+      if (Object.keys(plugins).length === 0) doc.delete("plugins");
+      else doc.set("plugins", plugins);
     }
-
-    // Always drop our headless-consent flag on uninstall — even if the hooks were
-    // already removed manually — so it can't silently auto-accept future operator
-    // hooks. `doc.delete` returns true iff the key was present.
-    const droppedAutoAccept = doc.delete("hooks_auto_accept");
-    if (removed > 0 || droppedAutoAccept) writeYamlDoc(settingsPath, doc);
+    if (configChanged) writeYamlDoc(settingsPath, doc);
+    if (removeManagedHermesPlugin(settingsPath)) removed += 1;
     return removed;
   },
 
@@ -1497,15 +1695,9 @@ export const hermes: Integration = {
 };
 
 function hermesConfigHasHooks(settingsPath: string): boolean {
-  if (!existsSync(settingsPath)) return false;
   try {
-    const doc = readYamlDoc(settingsPath);
-    const js = (doc.toJS() ?? {}) as { hooks?: Record<string, HermesHookEntry[]> };
-    const hooks = js.hooks;
-    if (!hooks || typeof hooks !== "object") return false;
-    for (const entries of Object.values(hooks)) {
-      if (Array.isArray(entries) && entries.some((h) => isMarkedHook(h))) return true;
-    }
+    const state = hermesConfigState(settingsPath);
+    return state.pluginEnabled && hasManagedHermesPlugin(settingsPath) && !state.legacyShellHookPresent;
   } catch {
     // Corrupt config — treat as not installed.
   }
@@ -1523,10 +1715,9 @@ function hermesConfigHasHooks(settingsPath: string): boolean {
  * warning.
  */
 export function unhookedHermesProfiles(): string[] {
-  return listHermesProfiles()
-    .filter((p) => existsSync(p.home))
-    .filter((p) => !hermesConfigHasHooks(resolve(p.home, "config.yaml")))
-    .map((p) => p.name);
+  return hermesProfileHealth()
+    .filter((profile) => existsSync(profile.home) && !profile.healthy)
+    .map((profile) => profile.name);
 }
 
 // ── OpenClaw integration ────────────────────────────────────────────────────

package/src/hooks/manager.ts

@@ -672,6 +672,7 @@ async function installHooksImpl(
     const settingsPaths = settingsPathsFor(integration, scope, cwd);
     try {
       for (const settingsPath of settingsPaths) {
+        integration.prepareInstall?.(settingsPath);
         const settings = integration.readSettings(settingsPath);
         integration.writeHookEntries(settings, binaryPath, scope);
         integration.writeSettings(settingsPath, settings);
@@ -738,10 +739,17 @@ async function installHooksImpl(
 
   for (const { cli: cliId, path } of writtenSettingsPaths) {
     const integration = getIntegration(cliId);
-    console.log(
-      `Failproof AI hooks installed for ${integration.displayName} ` +
-        `(${integration.eventTypes.length} event types, scope: ${scope}).`
-    );
+    if (cliId === "hermes") {
+      console.log(
+        `Failproof AI native plugin installed for ${integration.displayName} ` +
+          `(8 registered hooks, scope: ${scope}).`
+      );
+    } else {
+      console.log(
+        `Failproof AI hooks installed for ${integration.displayName} ` +
+          `(${integration.eventTypes.length} event types, scope: ${scope}).`
+      );
+    }
     console.log(`Settings: ${path}`);
   }
   if (scope === "project") {
@@ -876,7 +884,11 @@ export async function removeHooks(policyNames?: string[], scope: HookScope | "al
     for (const s of scopesToRemove) {
       // Usually one path; Hermes returns one per profile.
       const settingsPaths = settingsPathsFor(integration, s, cwd);
-      const existing = settingsPaths.filter((p) => existsSync(p));
+      // A Hermes install copies its managed plugin before updating config.yaml.
+      // If the config write is interrupted, uninstall must still call the
+      // integration so it can remove that orphaned managed directory.
+      const existing =
+        cliId === "hermes" ? settingsPaths : settingsPaths.filter((p) => existsSync(p));
 
       if (existing.length === 0) {
         if (scope !== "all" && selectedClis.length === 1) {

package/src/hooks/types.ts

@@ -113,13 +113,13 @@ export const HERMES_TOOL_INPUT_MAP: Record<string, Record<string, string>> = {
   Edit: { path: "file_path" },
 };
 
-// Hermes live-hook (Pillar 1) events + scopes. Hermes fires these snake_case
-// events with a JSON payload on stdin; the command we install runs
-// `failproofai --hook <event> --cli hermes`. Config is USER-scope only
-// (`~/.hermes/config.yaml`; Hermes has no project scope). `pre_tool_call` is the
-// core deny point — it fires for tool calls from every source
-// (slack/telegram/cli/cron) and internal subagents, so a single install
-// intercepts all platforms.
+// Hermes live-hook (Pillar 1) events + scopes. The native Python plugin sends
+// these events to failproofaid's warm worker. It also handles `pre_llm_call`,
+// `on_session_reset`, and `on_session_finalize` locally for instruction context
+// and ledger cleanup, so those do not need canonical policy-event mappings.
+// Config is USER-scope only (`~/.hermes/config.yaml`; Hermes has no project
+// scope). `pre_tool_call` is the core gate and fires for tool calls from every
+// source (Slack/Telegram/CLI/cron) and internal subagents.
 //
 // `pre_verify` IS a turn-end gate — the earlier claim here that Hermes has none
 // was wrong. We deliberately do NOT install it (product decision, 2026-07-29);
@@ -143,7 +143,7 @@ export const HERMES_TOOL_INPUT_MAP: Record<string, Record<string, string>> = {
 //   2. Capped at 3 nudges per turn (`DEFAULT_MAX_VERIFY_NUDGES`,
 //      `agent/verify_hooks.py:21`), operator-overridable; resets each turn.
 //   3. It landed upstream ~2026-06-30. Older Hermes fails the key against
-//      VALID_HOOKS and warn-and-skips it SILENTLY (`agent/shell_hooks.py:325`).
+//      VALID_HOOKS and warn-and-skips it silently.
 //
 // Until it is installed, `HERMES_EVENT_MAP` emits no `Stop` and those 5
 // builtins remain inapplicable on Hermes.

package/src/hooks/worker-server.ts

@@ -192,6 +192,7 @@ function handleConnection(socket: Socket, shutdown: () => void): void {
               exitCode: result.exitCode,
               stdout: result.stdout,
               stderr: result.stderr,
+              evaluation: result.evaluation,
             }),
           );
         } catch (err) {

package/.next/standalone/.next/server/chunks/[externals]__157pf8j._.js

@@ -1,3 +0,0 @@
-module.exports=[78500,(e,o,r)=>{o.exports=e.x("node:async_hooks",()=>require("node:async_hooks"))},2157,(e,o,r)=>{o.exports=e.x("node:fs",()=>require("node:fs"))},12714,(e,o,r)=>{o.exports=e.x("node:fs/promises",()=>require("node:fs/promises"))},50227,(e,o,r)=>{o.exports=e.x("node:path",()=>require("node:path"))},1457,(e,o,r)=>{o.exports=e.x("node:readline",()=>require("node:readline"))},12057,(e,o,r)=>{o.exports=e.x("node:util",()=>require("node:util"))},27028,(e,o,r)=>{o.exports=e.x("node:zlib",()=>require("node:zlib"))},14747,(e,o,r)=>{o.exports=e.x("path",()=>require("path"))}];
-
-//# sourceMappingURL=%5Bexternals%5D__157pf8j._.js.map