failproofai 1.0.5 → 1.0.6-beta.1

package/.next/standalone/hermes-plugin/client.py

@@ -0,0 +1,150 @@
+"""Versioned Unix-socket client for failproofaid policy evaluation."""
+
+from __future__ import annotations
+
+import json
+import os
+import socket
+import struct
+import time
+from dataclasses import dataclass
+from pathlib import Path
+from typing import Any, Mapping, Sequence
+
+PROTOCOL_VERSION = 1
+MAX_FRAME_BYTES = 16 * 1024 * 1024
+MAX_REQUEST_BYTES = 1024 * 1024
+
+
+class EvaluationError(RuntimeError):
+    """The daemon could not return a trustworthy policy verdict."""
+
+
+@dataclass(frozen=True)
+class PolicyVerdict:
+    decision: str
+    policy_names: tuple[str, ...]
+    reason: str | None
+    matched_policies: tuple[str, ...]
+    duration_ms: int
+    tool_name: str | None
+
+
+def daemon_socket_path() -> Path:
+    override = os.environ.get("FAILPROOFAI_DAEMON_SOCKET", "").strip()
+    if override:
+        return Path(override).expanduser()
+    root = os.environ.get("FAILPROOFAI_HOME", "").strip()
+    home = Path(root).expanduser() if root else Path.home() / ".failproofai"
+    return home / "run" / "failproofaid.sock"
+
+
+def _remaining_timeout(deadline: float) -> float:
+    remaining = deadline - time.monotonic()
+    if remaining <= 0:
+        raise EvaluationError("failproofaid evaluation timed out")
+    return remaining
+
+
+def _read_exact(sock: socket.socket, length: int, deadline: float) -> bytes:
+    chunks: list[bytes] = []
+    remaining = length
+    while remaining:
+        sock.settimeout(_remaining_timeout(deadline))
+        try:
+            chunk = sock.recv(remaining)
+        except TimeoutError as exc:
+            raise EvaluationError("failproofaid evaluation timed out") from exc
+        if not chunk:
+            raise EvaluationError("failproofaid closed the connection before returning a verdict")
+        chunks.append(chunk)
+        remaining -= len(chunk)
+    return b"".join(chunks)
+
+
+def _string_list(value: object, field: str) -> tuple[str, ...]:
+    if not isinstance(value, Sequence) or isinstance(value, (str, bytes, bytearray)):
+        raise EvaluationError(f"failproofaid returned an invalid {field}")
+    if not all(isinstance(item, str) for item in value):
+        raise EvaluationError(f"failproofaid returned an invalid {field}")
+    return tuple(value)
+
+
+def evaluate_policy(
+    *,
+    event: str,
+    payload: Mapping[str, Any],
+    cwd: str | None,
+    connect_timeout_ms: int = 250,
+    evaluation_timeout_ms: int = 12_000,
+) -> PolicyVerdict:
+    request = {
+        "type": "policyEvaluation",
+        "protocolVersion": PROTOCOL_VERSION,
+        "integration": "hermes",
+        "event": event,
+        "payload": dict(payload),
+        "cwd": cwd,
+    }
+    try:
+        body = json.dumps(
+            request,
+            ensure_ascii=False,
+            separators=(",", ":"),
+            default=lambda value: repr(value),
+        ).encode("utf-8")
+    except (TypeError, ValueError) as exc:
+        raise EvaluationError(f"could not encode policy request: {exc}") from exc
+    if len(body) > MAX_REQUEST_BYTES:
+        raise EvaluationError("policy request exceeds the 1 MiB limit")
+
+    try:
+        with socket.socket(socket.AF_UNIX, socket.SOCK_STREAM) as sock:
+            sock.settimeout(max(connect_timeout_ms, 1) / 1000)
+            sock.connect(str(daemon_socket_path()))
+            deadline = time.monotonic() + max(evaluation_timeout_ms, 1) / 1000
+            sock.settimeout(_remaining_timeout(deadline))
+            try:
+                sock.sendall(struct.pack(">I", len(body)) + body)
+            except TimeoutError as exc:
+                raise EvaluationError("failproofaid evaluation timed out") from exc
+            declared_length = struct.unpack(">I", _read_exact(sock, 4, deadline))[0]
+            if declared_length > MAX_FRAME_BYTES:
+                raise EvaluationError("failproofaid response exceeds the 16 MiB limit")
+            response = json.loads(_read_exact(sock, declared_length, deadline).decode("utf-8"))
+    except EvaluationError:
+        raise
+    except (OSError, UnicodeError, ValueError, struct.error) as exc:
+        raise EvaluationError(f"failproofaid evaluation failed: {exc}") from exc
+
+    if not isinstance(response, dict):
+        raise EvaluationError("failproofaid returned a non-object response")
+    if response.get("protocolVersion") != PROTOCOL_VERSION:
+        raise EvaluationError("failproofaid protocol version mismatch")
+    if response.get("type") == "error":
+        message = response.get("message")
+        raise EvaluationError(str(message or "failproofaid could not evaluate the policy"))
+    if response.get("type") != "policyResult":
+        raise EvaluationError("failproofaid does not support native policy evaluation")
+
+    decision = response.get("decision")
+    if decision not in {"allow", "deny", "instruct"}:
+        raise EvaluationError("failproofaid returned an invalid policy decision")
+    reason = response.get("reason")
+    if reason is not None and not isinstance(reason, str):
+        raise EvaluationError("failproofaid returned an invalid policy reason")
+    duration_ms = response.get("durationMs", 0)
+    if not isinstance(duration_ms, int) or duration_ms < 0:
+        raise EvaluationError("failproofaid returned an invalid evaluation duration")
+    tool_name = response.get("toolName")
+    if tool_name is not None and not isinstance(tool_name, str):
+        raise EvaluationError("failproofaid returned an invalid tool name")
+
+    return PolicyVerdict(
+        decision=decision,
+        policy_names=_string_list(response.get("policyNames", []), "policyNames"),
+        reason=reason,
+        matched_policies=_string_list(response.get("matchedPolicies", []), "matchedPolicies"),
+        duration_ms=duration_ms,
+        tool_name=tool_name,
+    )

package/.next/standalone/hermes-plugin/ledger.py

@@ -0,0 +1,187 @@
+"""Persistent, bounded delivery state for FailproofAI instruct decisions."""
+
+from __future__ import annotations
+
+import hashlib
+import json
+import sqlite3
+import threading
+import time
+from dataclasses import dataclass
+from pathlib import Path
+from typing import Sequence
+
+
+class LedgerError(RuntimeError):
+    """Instruction state could not be read or updated safely."""
+
+
+@dataclass(frozen=True)
+class InstructionAction:
+    block: bool
+    status: str
+
+
+class InstructionLedger:
+    def __init__(self, path: Path, *, ttl_seconds: int = 3600, max_rounds: int = 2) -> None:
+        self.path = path
+        self.ttl_seconds = max(60, int(ttl_seconds))
+        self.max_rounds = max(0, int(max_rounds))
+        self._init_lock = threading.Lock()
+        self._initialized = False
+
+    def _connect(self) -> sqlite3.Connection:
+        self.path.parent.mkdir(parents=True, exist_ok=True)
+        connection = sqlite3.connect(self.path, timeout=0.25, isolation_level=None)
+        connection.execute("PRAGMA busy_timeout = 250")
+        connection.execute("PRAGMA journal_mode = WAL")
+        connection.execute("PRAGMA synchronous = NORMAL")
+        return connection
+
+    def _ensure_schema(self) -> None:
+        if self._initialized:
+            return
+        with self._init_lock:
+            if self._initialized:
+                return
+            try:
+                with self._connect() as connection:
+                    connection.execute(
+                        """
+                        CREATE TABLE IF NOT EXISTS instruction_deliveries (
+                          delivery_key TEXT PRIMARY KEY,
+                          profile TEXT NOT NULL,
+                          session_id TEXT NOT NULL,
+                          task_id TEXT NOT NULL,
+                          turn_id TEXT NOT NULL,
+                          policy_fingerprint TEXT NOT NULL,
+                          scope_key TEXT NOT NULL,
+                          blocked_api_request_id TEXT NOT NULL,
+                          acknowledged_api_request_id TEXT,
+                          state TEXT NOT NULL,
+                          created_at_ms INTEGER NOT NULL,
+                          expires_at_ms INTEGER NOT NULL
+                        )
+                        """
+                    )
+                    connection.execute(
+                        """
+                        CREATE INDEX IF NOT EXISTS instruction_deliveries_turn
+                        ON instruction_deliveries(profile, session_id, task_id, turn_id, expires_at_ms)
+                        """
+                    )
+            except sqlite3.Error as exc:
+                raise LedgerError(f"could not initialize instruction state: {exc}") from exc
+            self._initialized = True
+
+    @staticmethod
+    def _digest(parts: Sequence[str]) -> str:
+        encoded = json.dumps(list(parts), ensure_ascii=False, separators=(",", ":")).encode("utf-8")
+        return hashlib.sha256(encoded).hexdigest()
+
+    def decide(
+        self,
+        *,
+        profile: str,
+        session_id: str,
+        task_id: str,
+        turn_id: str,
+        api_request_id: str,
+        policy_names: Sequence[str],
+        reason: str,
+        scope_key: str,
+        now_ms: int | None = None,
+    ) -> InstructionAction:
+        if not session_id or not turn_id or not api_request_id:
+            return InstructionAction(False, "missing-correlation-id")
+
+        self._ensure_schema()
+        now = int(time.time() * 1000) if now_ms is None else int(now_ms)
+        expires_at = now + self.ttl_seconds * 1000
+        task = task_id or "root"
+        policy_fingerprint = self._digest([*sorted(policy_names), reason])
+        delivery_key = self._digest(
+            [profile, session_id, task, turn_id, policy_fingerprint, scope_key]
+        )
+
+        try:
+            with self._connect() as connection:
+                connection.execute("BEGIN IMMEDIATE")
+                connection.execute(
+                    "DELETE FROM instruction_deliveries WHERE expires_at_ms <= ?", (now,)
+                )
+                row = connection.execute(
+                    """
+                    SELECT blocked_api_request_id, state
+                    FROM instruction_deliveries
+                    WHERE delivery_key = ?
+                    """,
+                    (delivery_key,),
+                ).fetchone()
+                if row is not None:
+                    blocked_request, state = row
+                    if state == "issued" and blocked_request == api_request_id:
+                        connection.commit()
+                        return InstructionAction(True, "same-api-request")
+                    if state == "issued":
+                        connection.execute(
+                            """
+                            UPDATE instruction_deliveries
+                            SET state = 'acknowledged', acknowledged_api_request_id = ?
+                            WHERE delivery_key = ?
+                            """,
+                            (api_request_id, delivery_key),
+                        )
+                    connection.commit()
+                    return InstructionAction(False, "acknowledged")
+
+                rounds = connection.execute(
+                    """
+                    SELECT COUNT(*)
+                    FROM instruction_deliveries
+                    WHERE profile = ? AND session_id = ? AND task_id = ? AND turn_id = ?
+                      AND expires_at_ms > ?
+                    """,
+                    (profile, session_id, task, turn_id, now),
+                ).fetchone()[0]
+                if rounds >= self.max_rounds:
+                    connection.commit()
+                    return InstructionAction(False, "turn-cap")
+
+                connection.execute(
+                    """
+                    INSERT INTO instruction_deliveries (
+                      delivery_key, profile, session_id, task_id, turn_id,
+                      policy_fingerprint, scope_key, blocked_api_request_id,
+                      acknowledged_api_request_id, state, created_at_ms, expires_at_ms
+                    ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, NULL, 'issued', ?, ?)
+                    """,
+                    (
+                        delivery_key,
+                        profile,
+                        session_id,
+                        task,
+                        turn_id,
+                        policy_fingerprint,
+                        scope_key,
+                        api_request_id,
+                        now,
+                        expires_at,
+                    ),
+                )
+                connection.commit()
+                return InstructionAction(True, "issued")
+        except (sqlite3.Error, OSError) as exc:
+            raise LedgerError(f"could not update instruction state: {exc}") from exc
+
+    def clear_session(self, session_id: str) -> None:
+        if not session_id:
+            return
+        self._ensure_schema()
+        try:
+            with self._connect() as connection:
+                connection.execute(
+                    "DELETE FROM instruction_deliveries WHERE session_id = ?", (session_id,)
+                )
+        except (sqlite3.Error, OSError) as exc:
+            raise LedgerError(f"could not clear instruction state: {exc}") from exc

package/.next/standalone/hermes-plugin/plugin.yaml

@@ -0,0 +1,37 @@
+name: failproofai
+version: 1.0.6-beta.0
+description: Real-time FailproofAI policy enforcement for Hermes
+manifest_version: 2
+api_version: 1
+homepage: https://github.com/FailproofAI/failproofai
+tags: [security, policy, observability]
+provides_hooks:
+  - pre_tool_call
+  - post_tool_call
+  - pre_llm_call
+  - on_session_start
+  - on_session_end
+  - on_session_reset
+  - on_session_finalize
+  - subagent_stop
+config_schema:
+  failure_mode:
+    type: str
+    default: deny
+    description: Block or allow when the local FailproofAI evaluator is unavailable.
+  connect_timeout_ms:
+    type: int
+    default: 250
+    description: Maximum time to connect to the local FailproofAI daemon.
+  evaluation_timeout_ms:
+    type: int
+    default: 12000
+    description: Maximum total time allowed for one policy evaluation.
+  instruction_ttl_seconds:
+    type: int
+    default: 3600
+    description: Maximum lifetime of an instruction-delivery record.
+  max_instruction_rounds:
+    type: int
+    default: 2
+    description: Maximum distinct instruction interruptions in one Hermes turn.

package/.next/standalone/lib/hermes-profiles.ts

@@ -3,10 +3,11 @@
  *
  * A Hermes "profile" is not a column or a flag: it is a whole separate Hermes
  * home directory, each with its own `config.yaml`, `.env`, `SOUL.md`, and
- * `state.db`. The default profile lives at `~/.hermes`; every other profile at
- * `~/.hermes/profiles/<name>/`. Selection is `hermes -p <name>`, a generated
- * `~/.local/bin/<name>` alias that exports `HERMES_HOME`, or a sticky default
- * recorded in `<root>/active_profile`.
+ * `state.db`. The default profile lives at `~/.hermes`; upstream named profiles
+ * live at `~/.hermes/profiles/<name>/`, while older/custom multi-install setups
+ * may use sibling homes such as `~/.hermes-work`. Selection is `hermes -p
+ * <name>`, a generated `~/.local/bin/<name>` alias that exports `HERMES_HOME`,
+ * or a sticky default recorded in `<root>/active_profile`.
  *
  * Upstream's own contributor guide warns that hardcoding `~/.hermes` breaks
  * profiles — which is exactly what both pillars used to do:
@@ -21,12 +22,14 @@
  * Home override: set `HERMES_HOME` (Hermes's own env var — respected here so a
  * profile-scoped shell and failproofai agree on what "all profiles" means).
  */
-import { readdirSync } from "node:fs";
+import { existsSync, readdirSync } from "node:fs";
 import { homedir } from "node:os";
 import { basename, dirname, join, resolve } from "node:path";
 
 /** Directory under the Hermes root that holds non-default profiles. */
 const PROFILES_DIR = "profiles";
+const STANDARD_HOME = ".hermes";
+const SIBLING_HOME_PREFIX = ".hermes-";
 
 /** Name we give the root home (`~/.hermes`), which Hermes itself leaves unnamed. */
 export const HERMES_DEFAULT_PROFILE = "default";
@@ -41,28 +44,45 @@ export interface HermesProfile {
 /**
  * The Hermes ROOT home — the directory that owns `profiles/`.
  *
- * `HERMES_HOME` may point AT a profile (`<root>/profiles/<name>`), because
- * that's what the per-profile alias wrapper exports. We climb back to `<root>`
- * in that case so discovery still sees every sibling profile — mirroring what
- * upstream does so `profile list` can see them all.
+ * `HERMES_HOME` may point AT an upstream profile (`<root>/profiles/<name>`) or
+ * at a sibling installation (`~/.hermes-<name>`). We normalize either standard
+ * layout back to `~/.hermes` so discovery covers every installation. A custom
+ * non-standard path remains authoritative; scanning arbitrary sibling paths
+ * would risk treating backups and unrelated directories as live agents.
  */
 export function hermesRoot(): string {
   const env = (process.env.HERMES_HOME || "").trim();
   if (env) {
-    const home = resolve(env);
+    let home = resolve(env);
     const parent = dirname(home);
-    if (basename(parent) === PROFILES_DIR) return dirname(parent);
+    if (basename(parent) === PROFILES_DIR) home = dirname(parent);
+    const base = basename(home);
+    if (base === STANDARD_HOME || base.startsWith(SIBLING_HOME_PREFIX)) {
+      return join(dirname(home), STANDARD_HOME);
+    }
     return home;
   }
-  return join(homedir(), ".hermes");
+  return join(homedir(), STANDARD_HOME);
+}
+
+function uniqueProfileName(preferred: string, seen: Set<string>): string {
+  if (!seen.has(preferred)) return preferred;
+  const base = `${preferred}-home`;
+  if (!seen.has(base)) return base;
+  let suffix = 2;
+  while (seen.has(`${base}-${suffix}`)) suffix += 1;
+  return `${base}-${suffix}`;
 }
 
 /**
  * Every Hermes profile on disk: the root home first (as `"default"`), then each
- * `<root>/profiles/<name>/` in name order.
+ * `<root>/profiles/<name>/`, then valid `~/.hermes-<name>` sibling homes, in
+ * name order within each layout.
  *
- * Fail-open — a missing or unreadable `profiles/` dir just means "default only",
- * which is the single-profile install everyone starts with.
+ * A sibling home counts only when it contains `config.yaml`, matching OpenClaw
+ * discovery and avoiding arbitrary `.hermes-*` backup directories. Upstream
+ * `profiles/` directories are authoritative and remain discoverable before
+ * their config is first written.
  *
  * A profile directory literally named `default` would collide with the root's
  * reserved name; the root wins and the directory is skipped (dedup by name keeps
@@ -73,22 +93,50 @@ export function listHermesProfiles(): HermesProfile[] {
   const out: HermesProfile[] = [{ name: HERMES_DEFAULT_PROFILE, home: root }];
   const seen = new Set<string>([HERMES_DEFAULT_PROFILE]);
 
-  let names: string[];
+  let names: string[] = [];
   try {
     names = readdirSync(join(root, PROFILES_DIR), { withFileTypes: true })
       // Symlinked profile dirs are legitimate, and `isDirectory()` is false for them.
       .filter((e) => (e.isDirectory() || e.isSymbolicLink()) && !e.name.startsWith("."))
       .map((e) => e.name)
       .sort();
-  } catch {
-    return out;
-  }
+  } catch {}
 
   for (const name of names) {
     if (seen.has(name)) continue;
     seen.add(name);
     out.push({ name, home: join(root, PROFILES_DIR, name) });
   }
+
+  // Only the standard ~/.hermes layout defines `.hermes-*` sibling homes.
+  // A custom HERMES_HOME is intentionally not used as a prefix convention.
+  if (basename(root) !== STANDARD_HOME) return out;
+
+  let siblings: HermesProfile[] = [];
+  const parent = dirname(root);
+  try {
+    siblings = readdirSync(parent, { withFileTypes: true })
+      .filter(
+        (entry) =>
+          (entry.isDirectory() || entry.isSymbolicLink()) &&
+          entry.name.startsWith(SIBLING_HOME_PREFIX) &&
+          entry.name.length > SIBLING_HOME_PREFIX.length &&
+          existsSync(join(parent, entry.name, "config.yaml")),
+      )
+      .map((entry) => ({
+        name: entry.name.slice(SIBLING_HOME_PREFIX.length),
+        home: join(parent, entry.name),
+      }))
+      .sort((a, b) => a.name.localeCompare(b.name));
+  } catch {
+    return out;
+  }
+
+  for (const sibling of siblings) {
+    const name = uniqueProfileName(sibling.name, seen);
+    seen.add(name);
+    out.push({ name, home: sibling.home });
+  }
   return out;
 }
 

package/.next/standalone/lib/hermes-sessions.ts

@@ -14,8 +14,9 @@
  *
  * PROFILES: Hermes profiles are separate home dirs, each with its OWN state.db
  * (`~/.hermes/state.db` for the default, `~/.hermes/profiles/<name>/state.db`
- * otherwise) — see lib/hermes-profiles.ts. So every read here fans out across
- * profiles instead of assuming one DB.
+ * for upstream profiles, and `~/.hermes-<name>/state.db` for sibling homes) —
+ * see lib/hermes-profiles.ts. So every read here fans out across profiles
+ * instead of assuming one DB.
  *
  * DB path override: set `HERMES_DB_PATH` (used by tests and to point at a copied
  * or remote state.db) — it collapses discovery to that single file. Set

package/.next/standalone/node_modules/@next/env/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@next/env",
-  "version": "16.3.4",
+  "version": "16.3.5",
   "keywords": [
     "react",
     "next",

package/.next/standalone/node_modules/next/dist/build/swc/index.js

@@ -139,7 +139,7 @@ var HmrTarget = /*#__PURE__*/ function(HmrTarget) {
     HmrTarget["Server"] = "server";
     return HmrTarget;
 }({});
-const nextVersion = "16.3.4";
+const nextVersion = "16.3.5";
 const ArchName = (0, _os.arch)();
 const PlatformName = (0, _os.platform)();
 function infoLog(...args) {