failproofai 1.0.9-beta.2 → 1.0.9

package/dist/cli.mjs

@@ -29,7 +29,7 @@ var __esm = (fn, res, err) => () => {
 var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
 // package.json
-var version2 = "1.0.9-beta.2", package_default;
+var version2 = "1.0.9", package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "failproofai",
@@ -155,16 +155,16 @@ var init_package = __esm(() => {
       browserslist: "4.28.8"
     },
     optionalDependencies: {
-      "@failproofai/failproofaid-linux-x64": "1.0.9-beta.2",
-      "@failproofai/failproofaid-linux-arm64": "1.0.9-beta.2",
-      "@failproofai/failproofaid-darwin-x64": "1.0.9-beta.2",
-      "@failproofai/failproofaid-darwin-arm64": "1.0.9-beta.2"
+      "@failproofai/failproofaid-linux-x64": "1.0.9",
+      "@failproofai/failproofaid-linux-arm64": "1.0.9",
+      "@failproofai/failproofaid-darwin-x64": "1.0.9",
+      "@failproofai/failproofaid-darwin-arm64": "1.0.9"
     },
     failproofaidBinaries: {
-      "linux-x64": "cd0a7124ae94ae78753cda6ffad985ba30be80443d8bc93d617ce507ba04e211",
-      "linux-arm64": "925446186bbfa827275356a9dc80b7d5351a6dcce9d926731419bbd91c1f98ba",
-      "darwin-x64": "cd35a6549f402b6c04848772074edb110a54a242fe7488792e59f8e8a00af475",
-      "darwin-arm64": "587b045accada4947a556e1bc1d748780a846c2ef95cf8dafb973a23fdbcb173"
+      "linux-x64": "c406199fbd5682ee84eb3bdd679fe48d1f78a26e97710f05bcfe42771e33ca4a",
+      "linux-arm64": "8ec339035013aaf069bd882660b89eefde137a5fb3c66bed9c65bfbfa1afaa19",
+      "darwin-x64": "fdf77e2432131ff6081769555c0a87d709d3380c78bc33de92743694dd20a83b",
+      "darwin-arm64": "a85e7e2af98fbcc09b6dfdd7fba8289d309757eab6482770ca64d3eeb81407d5"
     }
   };
 });
@@ -12496,12 +12496,14 @@ var init_dist = __esm(() => {
 import {
   chmodSync as chmodSync2,
   closeSync as closeSync2,
+  constants as fsConstants2,
   copyFileSync,
   existsSync as existsSync7,
   fsyncSync,
   lstatSync,
   mkdirSync as mkdirSync4,
   openSync as openSync2,
+  readlinkSync,
   realpathSync as realpathSync2,
   renameSync as renameSync2,
   rmSync as rmSync2,
@@ -12511,19 +12513,50 @@ import {
 import { randomBytes } from "node:crypto";
 import { basename, dirname as dirname3, join as join3 } from "node:path";
 function resolveWriteTarget(path) {
+  let isLink = false;
   try {
-    if (lstatSync(path).isSymbolicLink())
-      return realpathSync2(path);
-  } catch {}
-  return path;
+    isLink = lstatSync(path).isSymbolicLink();
+  } catch {
+    return path;
+  }
+  if (!isLink)
+    return path;
+  try {
+    return realpathSync2(path);
+  } catch {
+    let target = "(unreadable link)";
+    try {
+      target = readlinkSync(path);
+    } catch {}
+    throw new DanglingConfigSymlinkError(path, target);
+  }
+}
+function isSymlink(path) {
+  try {
+    return lstatSync(path).isSymbolicLink();
+  } catch {
+    return false;
+  }
+}
+function writeBackup(target, dir) {
+  const backup = `${target}.failproofai-backup`;
+  const temporary = join3(dir, `.${basename(target)}.failproofai-backup-${process.pid}-${randomBytes(4).toString("hex")}.tmp`);
+  try {
+    copyFileSync(target, temporary, fsConstants2.COPYFILE_EXCL);
+    renameSync2(temporary, backup);
+  } catch (err) {
+    rmSync2(temporary, { force: true });
+    throw err;
+  }
 }
 function writeConfigFileAtomic(path, content, deps = {}) {
-  const target = resolveWriteTarget(path);
+  const replacingLink = deps.symlinks === "replace" && isSymlink(path);
+  const target = deps.symlinks === "replace" ? path : resolveWriteTarget(path);
   const dir = dirname3(target);
   mkdirSync4(dir, { recursive: true });
   let mode;
   try {
-    mode = statSync5(target).mode & 511;
+    mode = replacingLink ? undefined : statSync5(target).mode & 511;
   } catch {
     mode = undefined;
   }
@@ -12540,8 +12573,8 @@ function writeConfigFileAtomic(path, content, deps = {}) {
     fd = undefined;
     if (mode !== undefined)
       chmodSync2(temporary, mode);
-    if (existsSync7(target))
-      copyFileSync(target, `${target}.failproofai-backup`);
+    if (deps.backup !== false && !replacingLink && existsSync7(target))
+      writeBackup(target, dir);
     (deps.rename ?? renameSync2)(temporary, target);
   } catch (err) {
     if (fd !== undefined) {
@@ -12561,7 +12594,19 @@ function writeConfigFileAtomic(path, content, deps = {}) {
     }
   } catch {}
 }
-var init_safe_config_write = () => {};
+var DanglingConfigSymlinkError;
+var init_safe_config_write = __esm(() => {
+  DanglingConfigSymlinkError = class DanglingConfigSymlinkError extends Error {
+    path;
+    target;
+    constructor(path, target) {
+      super(`Refusing to write ${path}: it is a symlink to ${target}, which does not exist. ` + `Fix or remove the link, then retry — failproofai will not replace it with a regular file.`);
+      this.path = path;
+      this.target = target;
+      this.name = "DanglingConfigSymlinkError";
+    }
+  };
+});
 
 // lib/hermes-profiles.ts
 import { existsSync as existsSync8, readdirSync } from "node:fs";
@@ -12704,7 +12749,7 @@ import {
   existsSync as existsSync10,
   lstatSync as lstatSync2,
   mkdirSync as mkdirSync5,
-  readlinkSync,
+  readlinkSync as readlinkSync2,
   realpathSync as realpathSync3,
   renameSync as renameSync3,
   rmSync as rmSync3,
@@ -13076,14 +13121,38 @@ function pathPresent(path) {
 function hasAllHermesPluginFiles(dir) {
   return HERMES_PLUGIN_FILES.every((file) => existsSync10(resolve8(dir, file)));
 }
-function isFailproofaiHermesPluginSource(dir) {
-  if (basename4(dir) !== HERMES_PLUGIN_SOURCE_DIR)
-    return false;
-  if (!existsSync10(dir))
+function hermesLinkRecordPath(pluginPath) {
+  return resolve8(dirname6(pluginPath), HERMES_LINK_RECORD);
+}
+function readHermesLinkRecord(pluginPath) {
+  try {
+    const recorded = readFileSync5(hermesLinkRecordPath(pluginPath), "utf8").trim();
+    return recorded === "" ? null : resolve8(recorded);
+  } catch {
+    return null;
+  }
+}
+function writeHermesLinkRecord(pluginPath, target) {
+  writeConfigFileAtomic(hermesLinkRecordPath(pluginPath), resolve8(target) + `
+`, { backup: false, symlinks: "replace" });
+}
+function removeHermesLinkRecord(pluginPath) {
+  rmSync3(hermesLinkRecordPath(pluginPath), { force: true });
+}
+function isOwnedHermesPluginLink(pluginPath, target) {
+  const recorded = readHermesLinkRecord(pluginPath);
+  if (recorded && resolve8(target) === recorded)
     return true;
+  if (samePath(target, getHermesPluginSourcePath()))
+    return true;
+  const pkgRoot = dirname6(resolve8(target));
+  if (basename4(resolve8(target)) !== HERMES_PLUGIN_SOURCE_DIR)
+    return false;
+  if (basename4(pkgRoot) !== "failproofai" || basename4(dirname6(pkgRoot)) !== "node_modules")
+    return false;
   try {
-    const manifest = readFileSync5(resolve8(dir, "plugin.yaml"), "utf8");
-    return /^name:\s*["']?failproofai["']?\s*$/m.test(manifest);
+    const pkg = JSON.parse(readFileSync5(resolve8(pkgRoot, "package.json"), "utf8"));
+    return pkg.name === "failproofai";
   } catch {
     return false;
   }
@@ -13111,11 +13180,11 @@ function hermesPluginState(settingsPath) {
   if (isLink) {
     let target;
     try {
-      target = resolve8(dirname6(pluginPath), readlinkSync(pluginPath));
+      target = resolve8(dirname6(pluginPath), readlinkSync2(pluginPath));
     } catch {
       return { kind: "foreign" };
     }
-    if (!isFailproofaiHermesPluginSource(target))
+    if (!isOwnedHermesPluginLink(pluginPath, target))
       return { kind: "foreign" };
     return {
       kind: "link",
@@ -13148,8 +13217,14 @@ function installHermesPlugin(settingsPath, deps = {}) {
   if (existing.kind === "foreign") {
     throw new Error(`Refusing to overwrite an unmanaged Hermes plugin at ${destination}. ` + `Move it aside or install FailproofAI under a different Hermes profile.`);
   }
-  if (existing.kind === "link" && existing.current)
+  if (existing.kind === "link" && existing.current) {
+    if (readHermesLinkRecord(destination) !== resolve8(existing.target)) {
+      try {
+        writeHermesLinkRecord(destination, existing.target);
+      } catch {}
+    }
     return "unchanged";
+  }
   mkdirSync5(dirname6(destination), { recursive: true });
   const suffix = `${process.pid}-${Date.now()}`;
   const temporary = `${destination}.install-${suffix}`;
@@ -13175,6 +13250,7 @@ function installHermesPlugin(settingsPath, deps = {}) {
   if (linked && (existing.kind === "absent" || existing.kind === "link")) {
     try {
       renameSync3(temporary, destination);
+      writeHermesLinkRecord(destination, source);
       return "linked";
     } catch (err) {
       if (existing.kind !== "link") {
@@ -13193,6 +13269,10 @@ function installHermesPlugin(settingsPath, deps = {}) {
     renameSync3(temporary, destination);
     if (movedExisting)
       rmSync3(backup, { recursive: true, force: true });
+    if (linked)
+      writeHermesLinkRecord(destination, source);
+    else
+      removeHermesLinkRecord(destination);
   } catch (err) {
     rmSync3(temporary, { recursive: true, force: true });
     if (movedExisting && !pathPresent(destination) && pathPresent(backup)) {
@@ -13207,6 +13287,7 @@ function removeManagedHermesPlugin(settingsPath) {
   const state = hermesPluginState(settingsPath);
   if (state.kind === "link") {
     unlinkSync(pluginPath);
+    removeHermesLinkRecord(pluginPath);
     return true;
   }
   if (state.kind !== "copy")
@@ -13281,85 +13362,90 @@ async function migrateHermesProfiles(opts) {
   const results = [];
   let daemonOk;
   for (const profile of listHermesProfiles()) {
-    if (!existsSync10(profile.home))
-      continue;
-    const settingsPath = resolve8(profile.home, "config.yaml");
-    const pluginPath = hermesPluginPathForSettings(settingsPath);
-    const config = hermesConfigState(settingsPath);
-    const plugin = hermesPluginState(settingsPath);
-    const ours = plugin.kind === "link" || plugin.kind === "copy";
-    const base = { name: profile.name, home: profile.home };
-    const legacy = config.legacyShellHookPresent;
-    if (config.unreadable) {
-      let raw = "";
-      try {
-        raw = readFileSync5(settingsPath, "utf8");
-      } catch {
-        raw = "";
+    try {
+      if (!existsSync10(profile.home))
+        continue;
+      const settingsPath = resolve8(profile.home, "config.yaml");
+      const pluginPath = hermesPluginPathForSettings(settingsPath);
+      const config = hermesConfigState(settingsPath);
+      const plugin = hermesPluginState(settingsPath);
+      const ours = plugin.kind === "link" || plugin.kind === "copy";
+      const base = { name: profile.name, home: profile.home };
+      const legacy = config.legacyShellHookPresent;
+      if (config.unreadable) {
+        let raw = "";
+        try {
+          raw = readFileSync5(settingsPath, "utf8");
+        } catch {
+          raw = "";
+        }
+        const mentionsUs = ours || raw.includes(FAILPROOFAI_HOOK_MARKER) || /failproofai/.test(raw);
+        results.push(mentionsUs ? {
+          ...base,
+          status: "failed",
+          detail: `${settingsPath} does not parse as YAML; left untouched`,
+          legacyShellHooksRemain: /--hook\s+\S+\s+--cli\s+hermes|__failproofai_hook__/.test(raw)
+        } : { ...base, status: "untouched", detail: "no failproofai integration", legacyShellHooksRemain: false });
+        continue;
       }
-      const mentionsUs = ours || raw.includes(FAILPROOFAI_HOOK_MARKER) || /failproofai/.test(raw);
-      results.push(mentionsUs ? {
-        ...base,
-        status: "failed",
-        detail: `${settingsPath} does not parse as YAML; left untouched`,
-        legacyShellHooksRemain: /--hook\s+\S+\s+--cli\s+hermes|__failproofai_hook__/.test(raw)
-      } : { ...base, status: "untouched", detail: "no failproofai integration", legacyShellHooksRemain: false });
-      continue;
-    }
-    if (!legacy && !ours && !config.pluginListed && !config.pluginDisabled) {
-      results.push({ ...base, status: "untouched", detail: "no failproofai integration", legacyShellHooksRemain: false });
-      continue;
-    }
-    if (plugin.kind === "link" && plugin.current && plugin.complete && config.pluginEnabled && !legacy) {
-      results.push({ ...base, status: "current", detail: "already linked", legacyShellHooksRemain: false });
-      continue;
-    }
-    if (plugin.kind === "foreign") {
-      results.push({
-        ...base,
-        status: "failed",
-        detail: `an unmanaged plugin occupies ${pluginPath}` + (legacy ? "; shell hooks left in place (cron jobs are not checked)" : ""),
-        legacyShellHooksRemain: legacy
-      });
-      continue;
-    }
-    if (existsSync10(settingsPath)) {
-      const errors = $parseDocument(readFileSync5(settingsPath, "utf8")).errors;
-      if (errors.length > 0) {
+      if (!legacy && !ours && !config.pluginListed && !config.pluginDisabled) {
+        results.push({ ...base, status: "untouched", detail: "no failproofai integration", legacyShellHooksRemain: false });
+        continue;
+      }
+      if (plugin.kind === "link" && plugin.current && plugin.complete && config.pluginEnabled && !legacy) {
+        if (readHermesLinkRecord(pluginPath) !== resolve8(plugin.target)) {
+          try {
+            writeHermesLinkRecord(pluginPath, plugin.target);
+          } catch {}
+        }
+        results.push({ ...base, status: "current", detail: "already linked", legacyShellHooksRemain: false });
+        continue;
+      }
+      if (plugin.kind === "foreign") {
         results.push({
           ...base,
           status: "failed",
-          detail: `${settingsPath} does not parse as YAML; left untouched`,
+          detail: `an unmanaged plugin occupies ${pluginPath}` + (legacy ? "; shell hooks left in place (cron jobs are not checked)" : ""),
           legacyShellHooksRemain: legacy
         });
         continue;
       }
-    }
-    if (daemonOk === undefined)
-      daemonOk = await opts.daemonSupportsPolicyEvaluation();
-    if (!daemonOk) {
-      results.push({
-        ...base,
-        status: "blocked",
-        detail: legacy ? "daemon lacks native policy evaluation; shell hooks left in place (cron jobs are not checked)" : "daemon lacks native policy evaluation; the plugin here cannot get verdicts",
-        legacyShellHooksRemain: legacy
-      });
-      continue;
-    }
-    try {
-      const mode = installHermesPlugin(settingsPath, opts.installDeps);
-      const doc = readYamlDoc(settingsPath);
-      enableHermesPluginInDoc(doc);
-      writeYamlDoc(settingsPath, doc);
-      const from = legacy ? "shell hooks" : plugin.kind === "copy" ? "copied plugin" : plugin.kind === "link" ? "old plugin link" : "enabled but missing plugin";
-      const to = mode === "copied" ? "plugin copy (symlink not possible here)" : "linked plugin";
-      results.push({ ...base, status: "migrated", detail: `${from} → ${to}`, legacyShellHooksRemain: false });
+      if (daemonOk === undefined)
+        daemonOk = await opts.daemonSupportsPolicyEvaluation();
+      if (!daemonOk) {
+        results.push({
+          ...base,
+          status: "blocked",
+          detail: legacy ? "daemon lacks native policy evaluation; shell hooks left in place (cron jobs are not checked)" : "daemon lacks native policy evaluation; the plugin here cannot get verdicts",
+          legacyShellHooksRemain: legacy
+        });
+        continue;
+      }
+      try {
+        const mode = installHermesPlugin(settingsPath, opts.installDeps);
+        const doc = readYamlDoc(settingsPath);
+        enableHermesPluginInDoc(doc);
+        writeYamlDoc(settingsPath, doc);
+        const reenabledOnly = !legacy && plugin.kind === "link" && plugin.current && mode === "unchanged";
+        const from = legacy ? "shell hooks" : plugin.kind === "copy" ? "copied plugin" : plugin.kind === "link" ? "old plugin link" : "enabled but missing plugin";
+        const to = mode === "copied" ? "plugin copy (symlink not possible here)" : "linked plugin";
+        const detail = reenabledOnly ? config.pluginDisabled ? "plugin re-enabled (was listed in plugins.disabled)" : "plugin enabled in config.yaml" : `${from} → ${to}`;
+        results.push({ ...base, status: "migrated", detail, legacyShellHooksRemain: false });
+      } catch (err) {
+        results.push({
+          ...base,
+          status: "failed",
+          detail: err instanceof Error ? err.message : String(err),
+          legacyShellHooksRemain: hermesConfigState(settingsPath).legacyShellHookPresent
+        });
+      }
     } catch (err) {
       results.push({
-        ...base,
+        name: profile.name,
+        home: profile.home,
         status: "failed",
-        detail: err instanceof Error ? err.message : String(err),
-        legacyShellHooksRemain: hermesConfigState(settingsPath).legacyShellHookPresent
+        detail: `could not inspect this profile (${err instanceof Error ? err.message : String(err)}); left untouched`,
+        legacyShellHooksRemain: false
       });
     }
   }
@@ -13402,7 +13488,7 @@ function listInstallableIds() {
 function detectInstalledClis() {
   return INTEGRATION_TYPES.filter((id) => INTEGRATIONS[id]?.detectInstalled());
 }
-var UnreadableAgentConfigError, claudeCode, codex, copilot, cursor, OPENCODE_PLUGIN_REL_PATH = "./plugins/failproofai.mjs", opencode, pi, HERMES_PLUGIN_ID = "failproofai", HERMES_PLUGIN_MARKER = ".failproofai-managed", HERMES_PLUGIN_FILES, HERMES_PLUGIN_SOURCE_DIR = "hermes-plugin", hermes, OPENCLAW_PLUGIN_ID = "failproofai", openclaw, factory, devin, ANTIGRAVITY_HOOK_NAME = "failproofai", ANTIGRAVITY_TOOL_EVENTS, antigravity, goose, INTEGRATIONS;
+var UnreadableAgentConfigError, claudeCode, codex, copilot, cursor, OPENCODE_PLUGIN_REL_PATH = "./plugins/failproofai.mjs", opencode, pi, HERMES_PLUGIN_ID = "failproofai", HERMES_PLUGIN_MARKER = ".failproofai-managed", HERMES_PLUGIN_FILES, HERMES_PLUGIN_SOURCE_DIR = "hermes-plugin", HERMES_LINK_RECORD = ".failproofai-link", hermes, OPENCLAW_PLUGIN_ID = "failproofai", openclaw, factory, devin, ANTIGRAVITY_HOOK_NAME = "failproofai", ANTIGRAVITY_TOOL_EVENTS, antigravity, goose, INTEGRATIONS;
 var init_integrations = __esm(() => {
   init_dist();
   init_safe_config_write();
@@ -13920,7 +14006,7 @@ var init_integrations = __esm(() => {
       const settingsPath = effectiveScope === "user" ? resolve8(homedir6(), ".config", "opencode", "opencode.json") : resolve8(process.cwd(), ".opencode", "opencode.json");
       const pluginPath = opencodePluginFilePath(settingsPath);
       mkdirSync5(dirname6(pluginPath), { recursive: true });
-      writeConfigFileAtomic(pluginPath, buildOpenCodePluginShim(binaryPath, effectiveScope));
+      writeConfigFileAtomic(pluginPath, buildOpenCodePluginShim(binaryPath, effectiveScope), { symlinks: "replace" });
       if (!Array.isArray(s.plugin))
         s.plugin = [];
       const desired = effectiveScope === "user" ? `file://${pluginPath}` : OPENCODE_PLUGIN_REL_PATH;
@@ -27062,7 +27148,7 @@ var init_fp_reset = __esm(() => {
 });
 
 // src/hooks/semantic/jev-config.ts
-import { closeSync as closeSync3, constants as fsConstants2, fstatSync as fstatSync2, openSync as openSync3, readSync as readSync2, statSync as statSync19 } from "node:fs";
+import { closeSync as closeSync3, constants as fsConstants3, fstatSync as fstatSync2, openSync as openSync3, readSync as readSync2, statSync as statSync19 } from "node:fs";
 import { dirname as dirname13 } from "node:path";
 function parseJevMode(raw) {
   return raw === "off" || raw === "observe" || raw === "enforce" ? raw : null;
@@ -27537,7 +27623,7 @@ var init_jev_config = __esm(() => {
   JEV_PROVIDER_KINDS = ["typesafe", "openrouter", "vercel", "cloudflare", "custom", "failproofai"];
   JEV_CALIBRATED_FAMILY = { major: 1, minor: 13 };
   MAX_CONFIG_BYTES = 64 * 1024;
-  OPEN_FLAGS = fsConstants2.O_RDONLY | (fsConstants2.O_NONBLOCK ?? 0);
+  OPEN_FLAGS = fsConstants3.O_RDONLY | (fsConstants3.O_NONBLOCK ?? 0);
   VERSIONED_MODEL_RE = /^(?:(?:typesafe|typesafe-ai)\/)?jev-(\d{1,4})\.(\d{1,4})(?:\.(\d{1,6}))?(?:-(\d{8}))?$/;
   CLOUDFLARE_ACCOUNT_ID_RE = /^[0-9a-f]{32}$/;
   API_KEY_RE = /^[\x21-\x7e]{1,4096}$/;
@@ -32786,7 +32872,7 @@ var INTROSPECT_PATH = "/v1/auth/introspect", PERMISSION_EVENTS = "events:add", P
 import {
   chmodSync as chmodSync7,
   closeSync as closeSync5,
-  constants as fsConstants3,
+  constants as fsConstants4,
   existsSync as existsSync34,
   fstatSync as fstatSync3,
   linkSync,
@@ -32979,7 +33065,7 @@ function fieldsOf(file) {
   const none = { provider: null, off: false };
   let fd;
   try {
-    fd = openSync5(file, fsConstants3.O_RDONLY | (fsConstants3.O_NONBLOCK ?? 0) | (fsConstants3.O_NOFOLLOW ?? 0));
+    fd = openSync5(file, fsConstants4.O_RDONLY | (fsConstants4.O_NONBLOCK ?? 0) | (fsConstants4.O_NOFOLLOW ?? 0));
   } catch {
     return none;
   }
@@ -38952,7 +39038,7 @@ var init_jev_cli = __esm(() => {
 import {
   chmodSync as chmodSync10,
   closeSync as closeSync8,
-  constants as fsConstants4,
+  constants as fsConstants5,
   existsSync as existsSync46,
   fstatSync as fstatSync4,
   mkdirSync as mkdirSync29,
@@ -39736,9 +39822,14 @@ async function refreshDaemonToCliVersion(deps = {}) {
   const install = deps.install ?? installDaemonService2;
   const prime = deps.prime ?? primeElevation2;
   const interactive = deps.interactive ?? (() => Boolean(process.stdin.isTTY && process.stdout.isTTY));
-  if (status() === "not-installed") {
+  const current = status();
+  if (current === "not-installed") {
     return { ok: true, lines: ["No failproofaid service on this machine; nothing to update."] };
   }
+  const recorded = readVersionFile()?.daemon;
+  if (current === "running" && recorded === version2 && existsSync48(installedBinaryPath(version2))) {
+    return { ok: true, lines: [`failproofaid ${version2} is already installed and running; nothing to update.`] };
+  }
   if (interactive())
     prime();
   const result = await install();
@@ -44219,7 +44310,7 @@ import {
   existsSync as existsSync54,
   lstatSync as lstatSync4,
   mkdirSync as mkdirSync33,
-  readlinkSync as readlinkSync2,
+  readlinkSync as readlinkSync3,
   realpathSync as realpathSync8,
   renameSync as renameSync14,
   rmSync as rmSync21,
@@ -44286,14 +44377,31 @@ function hermesPluginPathForSettings2(settingsPath) {
 function hasAllHermesPluginFiles2(dir) {
   return HERMES_PLUGIN_FILES2.every((file) => existsSync54(resolve39(dir, file)));
 }
-function isFailproofaiHermesPluginSource2(dir) {
-  if (basename13(dir) !== HERMES_PLUGIN_SOURCE_DIR2)
-    return false;
-  if (!existsSync54(dir))
+function hermesLinkRecordPath2(pluginPath) {
+  return resolve39(dirname30(pluginPath), HERMES_LINK_RECORD2);
+}
+function readHermesLinkRecord2(pluginPath) {
+  try {
+    const recorded = readFileSync41(hermesLinkRecordPath2(pluginPath), "utf8").trim();
+    return recorded === "" ? null : resolve39(recorded);
+  } catch {
+    return null;
+  }
+}
+function isOwnedHermesPluginLink2(pluginPath, target) {
+  const recorded = readHermesLinkRecord2(pluginPath);
+  if (recorded && resolve39(target) === recorded)
     return true;
+  if (samePath2(target, getHermesPluginSourcePath2()))
+    return true;
+  const pkgRoot = dirname30(resolve39(target));
+  if (basename13(resolve39(target)) !== HERMES_PLUGIN_SOURCE_DIR2)
+    return false;
+  if (basename13(pkgRoot) !== "failproofai" || basename13(dirname30(pkgRoot)) !== "node_modules")
+    return false;
   try {
-    const manifest = readFileSync41(resolve39(dir, "plugin.yaml"), "utf8");
-    return /^name:\s*["']?failproofai["']?\s*$/m.test(manifest);
+    const pkg = JSON.parse(readFileSync41(resolve39(pkgRoot, "package.json"), "utf8"));
+    return pkg.name === "failproofai";
   } catch {
     return false;
   }
@@ -44321,11 +44429,11 @@ function hermesPluginState2(settingsPath) {
   if (isLink) {
     let target;
     try {
-      target = resolve39(dirname30(pluginPath), readlinkSync2(pluginPath));
+      target = resolve39(dirname30(pluginPath), readlinkSync3(pluginPath));
     } catch {
       return { kind: "foreign" };
     }
-    if (!isFailproofaiHermesPluginSource2(target))
+    if (!isOwnedHermesPluginLink2(pluginPath, target))
       return { kind: "foreign" };
     return {
       kind: "link",
@@ -44378,6 +44486,7 @@ function hermesProfileHealth() {
       legacyShellHookPresent: config.legacyShellHookPresent,
       cronUnchecked: config.legacyShellHookPresent && !pluginWorks,
       configUnreadable: config.unreadable === true,
+      pluginForeign: plugin.kind === "foreign",
       healthy: pluginWorks && !config.legacyShellHookPresent && config.unreadable !== true
     };
   });
@@ -44385,6 +44494,12 @@ function hermesProfileHealth() {
 function hermesProfileStatusRows() {
   return hermesProfileHealth().filter((profile) => existsSync54(profile.home)).map((profile) => {
     const label = "hermes/" + profile.name;
+    if (profile.pluginForeign) {
+      return [
+        label,
+        `UNHEALTHY — another plugin occupies ${resolve39(profile.home, "plugins", "failproofai")}; failproofai will not replace it. Move it aside, then run update`
+      ];
+    }
     if (profile.configUnreadable) {
       return [label, `UNHEALTHY — ${profile.settingsPath} does not parse; failproofai leaves it untouched until it is fixed`];
     }
@@ -44411,7 +44526,7 @@ function hermesProfileStatusRows() {
     ];
   });
 }
-var UnreadableAgentConfigError2, HERMES_PLUGIN_ID2 = "failproofai", HERMES_PLUGIN_MARKER2 = ".failproofai-managed", HERMES_PLUGIN_FILES2, HERMES_PLUGIN_SOURCE_DIR2 = "hermes-plugin", ANTIGRAVITY_TOOL_EVENTS2;
+var UnreadableAgentConfigError2, HERMES_PLUGIN_ID2 = "failproofai", HERMES_PLUGIN_MARKER2 = ".failproofai-managed", HERMES_PLUGIN_FILES2, HERMES_PLUGIN_SOURCE_DIR2 = "hermes-plugin", HERMES_LINK_RECORD2 = ".failproofai-link", ANTIGRAVITY_TOOL_EVENTS2;
 var init_integrations2 = __esm(() => {
   init_dist();
   init_safe_config_write();
@@ -44559,7 +44674,7 @@ import { realpathSync as realpathSync10 } from "fs";
 import { dirname as dirname32, resolve as resolve41 } from "path";
 import { fileURLToPath as fileURLToPath5 } from "url";
 // package.json
-var version = "1.0.9-beta.2";
+var version = "1.0.9";
 
 // bin/failproofai.mjs
 if (!process.env.FAILPROOFAI_PACKAGE_ROOT) {

package/dist/worker.mjs

@@ -1162,7 +1162,7 @@ function instruct(reason) {
 }
 
 // package.json
-var version = "1.0.9-beta.2";
+var version = "1.0.9";
 var init_package = () => {};
 
 // src/hooks/policy-types.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "failproofai",
-  "version": "1.0.9-beta.2",
+  "version": "1.0.9",
   "description": "Observability and enforcement for AI agent harnesses. 40 built-in policies hooked into 12 of them — Claude Code, Codex, Cursor, Hermes, OpenClaw and more — blocking the tool call before it runs. Local dashboard included, no account needed.",
   "bin": {
     "failproofai": "./dist/cli.mjs",
@@ -122,15 +122,15 @@
     "browserslist": "4.28.8"
   },
   "optionalDependencies": {
-    "@failproofai/failproofaid-linux-x64": "1.0.9-beta.2",
-    "@failproofai/failproofaid-linux-arm64": "1.0.9-beta.2",
-    "@failproofai/failproofaid-darwin-x64": "1.0.9-beta.2",
-    "@failproofai/failproofaid-darwin-arm64": "1.0.9-beta.2"
+    "@failproofai/failproofaid-linux-x64": "1.0.9",
+    "@failproofai/failproofaid-linux-arm64": "1.0.9",
+    "@failproofai/failproofaid-darwin-x64": "1.0.9",
+    "@failproofai/failproofaid-darwin-arm64": "1.0.9"
   },
   "failproofaidBinaries": {
-    "linux-x64": "cd0a7124ae94ae78753cda6ffad985ba30be80443d8bc93d617ce507ba04e211",
-    "linux-arm64": "925446186bbfa827275356a9dc80b7d5351a6dcce9d926731419bbd91c1f98ba",
-    "darwin-x64": "cd35a6549f402b6c04848772074edb110a54a242fe7488792e59f8e8a00af475",
-    "darwin-arm64": "587b045accada4947a556e1bc1d748780a846c2ef95cf8dafb973a23fdbcb173"
+    "linux-x64": "c406199fbd5682ee84eb3bdd679fe48d1f78a26e97710f05bcfe42771e33ca4a",
+    "linux-arm64": "8ec339035013aaf069bd882660b89eefde137a5fb3c66bed9c65bfbfa1afaa19",
+    "darwin-x64": "fdf77e2432131ff6081769555c0a87d709d3380c78bc33de92743694dd20a83b",
+    "darwin-arm64": "a85e7e2af98fbcc09b6dfdd7fba8289d309757eab6482770ca64d3eeb81407d5"
   }
 }

package/src/hooks/daemon-service.ts

@@ -1556,10 +1556,23 @@ export async function refreshDaemonToCliVersion(
   const prime = deps.prime ?? primeElevation;
   const interactive =
     deps.interactive ?? (() => Boolean(process.stdin.isTTY && process.stdout.isTTY));
-  if (status() === "not-installed") {
+  const current = status();
+  if (current === "not-installed") {
     return { ok: true, lines: ["No failproofaid service on this machine; nothing to update."] };
   }
 
+  // Already this version: nothing to install, so nothing to ask root for. The
+  // reinstall below is idempotent, but it needs sudo, so without this every
+  // `update` after the daemon was brought current either prompted for a password
+  // for no reason or — with no TTY to prompt on (a fleet box, CI) — failed with
+  // "root privileges are required" and exited 1 on a machine that was fine.
+  // `VERSION.daemon` is written only after an install succeeds, and the binary
+  // it names must still be on disk.
+  const recorded = readVersionFile()?.daemon;
+  if (current === "running" && recorded === version && existsSync(installedBinaryPath(version))) {
+    return { ok: true, lines: [`failproofaid ${version} is already installed and running; nothing to update.`] };
+  }
+
   // `installDaemonService()`, not a binary fetch plus a restart.
   //
   // The first version of this did the latter, and it did not work: it called