Track local agent profiles and enforce scoped Cloud deployments

CHANGELOG.md

@@ -4,6 +4,9 @@
 
 ### Features
 
+- Cloud-managed assignments can target integrations or individual agent profiles. The daemon keeps an owner-only, stable profile roster and reports it to FailproofAI Cloud; scoped schema-3 deployments filter JavaScript before import and send agent identity for Cloud Jev selection. `fp fleet deploy --target POLICY=INTEGRATION[/agt_ID]` narrows a machine assignment; `--all-agents POLICY` clears its scope.
+- The CLI, daemon and native Hermes plugin now use local daemon protocol v2 for agent-profile identity. After upgrading the CLI, reinstall/restart the daemon with `failproofai config` before resuming hook evaluation; an older daemon's response is rejected rather than silently losing the selected profile.
+- Newly installed shell hooks and OpenCode shims identify the user, project or local settings scope that launched them. When a legacy or package-level hook cannot prove its source, a scoped Cloud assignment is withheld and `agent_scope_unresolved` is reported rather than using the daemon worker's own environment as the agent's identity.
 - Uploads, `fp` calls and evaluator calls carry a request id; the daemon also sends batch and machine ids, and `fp` errors show a `ref` (#872)
 - **Jev policies deploy from FailproofAI Cloud, individually, and run there.** A Cloud policy has a kind — `regex` (JavaScript, as before), `jev` (Jev checks only) or `both` (JavaScript reviewable by its own checks). Jev checks run on FailproofAI Cloud; nothing is installed on the machine: the daemon receives a `both` policy's JavaScript (with the server-derived `authority`/`reviewedBy`) and the machine's Jev mode, and nothing else Jev-related. `failproofai policies` lists `both` policies with the Cloud checks that review them.
 - **FailproofAI Cloud can set a machine's Jev mode.** `off` switches Jev off whatever `jev.json` says. `observe`/`enforce` send every gated tool call to FailproofAI Cloud on the machine's Cloud Jev credential (`jev.json` is not used): the machine's own questions — the global intent questions always, plus its installed packs' checks — and a `cloud` block of tool-call metadata; Cloud asks its checks for that machine in the same request and returns their verdict, which the machine merges with its packs' (Cloud first, most severe wins) before the regex combine. A `both` policy is cleared only by its own Cloud checks' outcomes, never by a pack's check of the same name. Cloud gets 5 s to answer (a local `jev.json` keeps its own timeout); a Cloud failure or timeout is today's fallback: the regex decides alone. A session pause does not stop Cloud's checks, as it never stopped Cloud JS policies: a paused session's calls still go to FailproofAI Cloud, with no installed pack's check in them. `failproofai jev status` says "Jev checks run on FailproofAI Cloud (mode: …)" and names each `both` policy's Cloud reviewers.

__tests__/e2e/helpers/hook-runner.ts

@@ -40,7 +40,12 @@ export interface HookRunResult {
 export function runHook(
   event: string,
   payload: Record<string, unknown>,
-  opts?: { homeDir?: string; cli?: "claude" | "codex" | "copilot" | "cursor" | "opencode" | "pi" | "hermes" | "openclaw" | "factory" | "devin" | "antigravity" | "goose" },
+  opts?: {
+    homeDir?: string;
+    cwd?: string;
+    agentScope?: "user" | "project" | "local";
+    cli?: "claude" | "codex" | "copilot" | "cursor" | "opencode" | "pi" | "hermes" | "openclaw" | "factory" | "devin" | "antigravity" | "goose";
+  },
 ): HookRunResult {
   const binaryPath = getBinaryPath();
 
@@ -57,9 +62,11 @@ export function runHook(
 
   const args = [binaryPath, "--hook", event];
   if (opts?.cli) args.push("--cli", opts.cli);
+  if (opts?.agentScope) args.push("--agent-scope", opts.agentScope);
   const result = spawnSync("bun", args, {
     input: JSON.stringify(payload),
     env,
+    cwd: opts?.cwd,
     encoding: "utf8",
     timeout: 15_000,
   });

__tests__/e2e/hooks/agent-scoped-policies.e2e.test.ts

@@ -0,0 +1,78 @@
+// @vitest-environment node
+import { describe, expect, it } from "vitest";
+import { createHash } from "node:crypto";
+import { chmodSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { createFixtureEnv } from "../helpers/fixture-env";
+import { assertAllow, assertPreToolUseDeny, runHook } from "../helpers/hook-runner";
+
+describe("real CLI hook distinguishes simultaneous project and user profiles", () => {
+  it("applies targeted Cloud JS only when the installed hook carries its actual settings scope", () => {
+    const fixture = createFixtureEnv();
+    const projectSettings = join(fixture.cwd, ".claude", "settings.json");
+    const userSettings = join(fixture.home, ".claude", "settings.json");
+    mkdirSync(join(fixture.cwd, ".claude"), { recursive: true });
+    mkdirSync(join(fixture.home, ".claude"), { recursive: true });
+    writeFileSync(projectSettings, '{"hooks":"failproofai --hook PreToolUse --agent-scope project"}');
+    writeFileSync(userSettings, '{"hooks":"failproofai --hook PreToolUse --agent-scope user"}');
+
+    const fpHome = join(fixture.home, ".failproofai");
+    const rosterDir = join(fpHome, "agents");
+    mkdirSync(rosterDir, { recursive: true });
+    const projectId = "agt_1234567890abcdef";
+    const userId = "agt_abcdef1234567890";
+    const roster = join(rosterDir, "roster.json");
+    writeFileSync(roster, JSON.stringify({
+      schemaVersion: 1, generation: 2,
+      agents: [
+        { integration: "claude", instanceId: projectId, settingsPath: projectSettings,
+          profileLabel: "project", scope: "project", hookInstalled: true },
+        { integration: "claude", instanceId: userId, settingsPath: userSettings,
+          profileLabel: "user", scope: "user", hookInstalled: true },
+      ],
+    }), { mode: 0o600 });
+    chmodSync(roster, 0o600);
+
+    const cloudDir = join(fpHome, "policies", "cloud-policies");
+    mkdirSync(join(cloudDir, "artifacts"), { recursive: true });
+    const source = `import { customPolicies, deny } from "failproofai";
+customPolicies.add({
+  name: "only-project", description: "Only this installation",
+  match: { events: ["PreToolUse"] },
+  fn: async () => deny("project agent"),
+});`;
+    const digest = createHash("sha256").update(source).digest("hex");
+    const artifact = `artifacts/${digest}.mjs`;
+    writeFileSync(join(cloudDir, artifact), source);
+    writeFileSync(join(cloudDir, "active.json"), JSON.stringify({
+      schemaVersion: 3, deployment: 1,
+      policies: [{
+        id: "scope-check", version: 1, sha256: digest, path: artifact, effect: "enforce",
+        agentTargets: [{ integration: "claude", instanceId: projectId }],
+      }],
+    }));
+
+    const payload = {
+      session_id: "scope-test", hook_event_name: "PreToolUse",
+      tool_name: "Bash", tool_input: { command: "ls" }, cwd: fixture.cwd,
+    };
+    const project = runHook("PreToolUse", payload, {
+      homeDir: fixture.home, cwd: fixture.cwd, agentScope: "project",
+    });
+    assertPreToolUseDeny(project);
+
+    const user = runHook("PreToolUse", payload, {
+      homeDir: fixture.home, cwd: fixture.cwd, agentScope: "user",
+    });
+    assertAllow(user);
+
+    const legacyAmbiguous = runHook("PreToolUse", payload, {
+      homeDir: fixture.home, cwd: fixture.cwd,
+    });
+    assertAllow(legacyAmbiguous);
+    const report = JSON.parse(readFileSync(join(cloudDir, "errors.json"), "utf8"));
+    expect(report.errors).toContainEqual(expect.objectContaining({
+      id: "agentScope", message: expect.stringContaining("agent_scope_unresolved"),
+    }));
+  });
+});

__tests__/fixtures/agent-targets.json

@@ -0,0 +1,18 @@
+{
+  "cases": [
+    {"name":"unscoped", "schemaVersion":2, "targets":null, "agent":null, "valid":true, "matches":true},
+    {"name":"integration-all-profiles", "schemaVersion":3, "targets":[{"integration":"claude"}], "agent":{"integration":"claude","instanceId":"agt_1111111111111111"}, "valid":true, "matches":true},
+    {"name":"integration-other-agent", "schemaVersion":3, "targets":[{"integration":"claude"}], "agent":{"integration":"codex","instanceId":"agt_1111111111111111"}, "valid":true, "matches":false},
+    {"name":"profile-exact", "schemaVersion":3, "targets":[{"integration":"hermes","instanceId":"agt_2222222222222222"}], "agent":{"integration":"hermes","instanceId":"agt_2222222222222222"}, "valid":true, "matches":true},
+    {"name":"profile-other-instance", "schemaVersion":3, "targets":[{"integration":"hermes","instanceId":"agt_2222222222222222"}], "agent":{"integration":"hermes","instanceId":"agt_3333333333333333"}, "valid":true, "matches":false},
+    {"name":"profile-other-integration", "schemaVersion":3, "targets":[{"integration":"hermes","instanceId":"agt_2222222222222222"}], "agent":{"integration":"codex","instanceId":"agt_2222222222222222"}, "valid":true, "matches":false},
+    {"name":"scope-unresolved", "schemaVersion":3, "targets":[{"integration":"codex"}], "agent":null, "valid":true, "matches":false},
+    {"name":"or-combination", "schemaVersion":3, "targets":[{"integration":"claude"},{"integration":"hermes","instanceId":"agt_2222222222222222"}], "agent":{"integration":"hermes","instanceId":"agt_2222222222222222"}, "valid":true, "matches":true},
+    {"name":"both-halves-same-scope", "schemaVersion":3, "targets":[{"integration":"codex"}], "agent":{"integration":"codex","instanceId":"agt_4444444444444444"}, "valid":true, "matches":true},
+    {"name":"empty-array", "schemaVersion":3, "targets":[], "agent":null, "valid":false},
+    {"name":"duplicate-selector", "schemaVersion":3, "targets":[{"integration":"codex"},{"integration":"codex"}], "agent":null, "valid":false},
+    {"name":"unknown-integration", "schemaVersion":3, "targets":[{"integration":"invented"}], "agent":null, "valid":false},
+    {"name":"invalid-profile-id", "schemaVersion":3, "targets":[{"integration":"hermes","instanceId":"bad"}], "agent":null, "valid":false},
+    {"name":"scoped-in-schema-two", "schemaVersion":2, "targets":[{"integration":"claude"}], "agent":null, "valid":false}
+  ]
+}

__tests__/fixtures/hermes-native-plugin-check.py

@@ -431,7 +431,7 @@ def server() -> None:
                         body = json.dumps(
                             {
                                 "type": "policyResult",
-                                "protocolVersion": 1,
+                                "protocolVersion": 2,
                                 "decision": "instruct",
                                 "policyNames": ["custom/write-route"],
                                 "reason": "Use the approved route.",
@@ -451,14 +451,16 @@ def server() -> None:
                     event="pre_tool_call",
                     payload={"tool_name": "write_file", "tool_input": {"path": "/tmp/a"}},
                     cwd="/tmp",
+                    agent_settings_path="/tmp/hermes-work/config.yaml",
                 )
             thread.join(timeout=2)
             self.assertEqual(received["type"], "policyEvaluation")
             self.assertEqual(received["integration"], "hermes")
+            self.assertEqual(received["agentSettingsPath"], "/tmp/hermes-work/config.yaml")
             self.assertEqual(verdict.decision, "instruct")
             self.assertEqual(verdict.tool_name, "Write")
 
-    def test_client_rejects_protocol_mismatch(self) -> None:
+    def test_client_rejects_a_v1_daemon_result(self) -> None:
         with tempfile.TemporaryDirectory() as tmp:
             socket_path = Path(tmp) / "daemon.sock"
             ready = threading.Event()
@@ -476,7 +478,7 @@ def server() -> None:
                         body = json.dumps(
                             {
                                 "type": "policyResult",
-                                "protocolVersion": 99,
+                                "protocolVersion": 1,
                                 "decision": "allow",
                                 "policyNames": [],
                                 "matchedPolicies": [],

__tests__/hooks/agent-roster.test.ts

@@ -0,0 +1,116 @@
+// @vitest-environment node
+import { afterEach, describe, expect, it } from "vitest";
+import { chmodSync, mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { readRuntimeAgentIdentity, runtimeAgentSettingsPath } from "../../src/hooks/agent-roster";
+import { agentTargetsMatch, parseAgentTargets } from "../../src/hooks/agent-targets";
+
+const roots: string[] = [];
+const previousHome = process.env.FAILPROOFAI_HOME;
+const previousHermes = process.env.HERMES_HOME;
+const previousClaude = process.env.CLAUDE_CONFIG_DIR;
+afterEach(() => {
+  if (previousHome === undefined) delete process.env.FAILPROOFAI_HOME;
+  else process.env.FAILPROOFAI_HOME = previousHome;
+  if (previousHermes === undefined) delete process.env.HERMES_HOME;
+  else process.env.HERMES_HOME = previousHermes;
+  if (previousClaude === undefined) delete process.env.CLAUDE_CONFIG_DIR;
+  else process.env.CLAUDE_CONFIG_DIR = previousClaude;
+  for (const root of roots.splice(0)) rmSync(root, { recursive: true, force: true });
+});
+
+describe("runtime agent identity", () => {
+  it("detects a project-only hook and refuses to guess when project and user hooks both apply", () => {
+    const root = mkdtempSync(join(tmpdir(), "fpai-agent-scopes-"));
+    roots.push(root);
+    delete process.env.CLAUDE_CONFIG_DIR;
+    const user = join(root, "user");
+    const project = join(root, "repo");
+    const nested = join(project, "src");
+    const projectSettings = join(project, ".claude", "settings.json");
+    const userSettings = join(user, ".claude", "settings.json");
+    mkdirSync(nested, { recursive: true });
+    mkdirSync(join(project, ".claude"), { recursive: true });
+    mkdirSync(join(user, ".claude"), { recursive: true });
+    writeFileSync(projectSettings, '{"hooks":"failproofai --hook PreToolUse"}');
+    expect(runtimeAgentSettingsPath("claude", nested, user)).toBe(projectSettings);
+    writeFileSync(userSettings, '{"hooks":"failproofai --hook PreToolUse"}');
+    expect(runtimeAgentSettingsPath("claude", nested, user)).toBeNull();
+    expect(runtimeAgentSettingsPath("claude", nested, user, "project")).toBe(projectSettings);
+    expect(runtimeAgentSettingsPath("claude", nested, user, "user")).toBe(userSettings);
+    const localSettings = join(project, ".claude", "settings.local.json");
+    writeFileSync(localSettings, '{"hooks":"failproofai --hook PreToolUse"}');
+    expect(runtimeAgentSettingsPath("claude", nested, user, "local")).toBe(localSettings);
+    expect(runtimeAgentSettingsPath("claude", nested, user, "project")).toBe(projectSettings);
+    rmSync(projectSettings);
+    rmSync(localSettings);
+    expect(runtimeAgentSettingsPath("claude", nested, user)).toBe(userSettings);
+  });
+
+  it("counts Pi's relative project extension when deciding whether two scopes are ambiguous", () => {
+    const root = mkdtempSync(join(tmpdir(), "fpai-pi-scopes-"));
+    roots.push(root);
+    const user = join(root, "user");
+    const project = join(root, "repo");
+    const projectSettings = join(project, ".pi", "settings.json");
+    const userSettings = join(user, ".pi", "agent", "settings.json");
+    mkdirSync(join(project, ".pi"), { recursive: true });
+    mkdirSync(join(user, ".pi", "agent"), { recursive: true });
+    writeFileSync(projectSettings, '{"packages":["../pi-extension"]}');
+    expect(runtimeAgentSettingsPath("pi", project, user)).toBe(projectSettings);
+    writeFileSync(userSettings, '{"packages":["/opt/failproofai/pi-extension"]}');
+    expect(runtimeAgentSettingsPath("pi", project, user)).toBeNull();
+    // A package-level Pi extension cannot stamp which settings file loaded
+    // it. Without that proof an exact-profile assignment matches neither.
+    expect(readRuntimeAgentIdentity("pi", runtimeAgentSettingsPath("pi", project, user))).toBeNull();
+  });
+
+  it("resolves a named profile from the invoking hook's config path", () => {
+    const root = mkdtempSync(join(tmpdir(), "fpai-agent-roster-"));
+    roots.push(root);
+    process.env.FAILPROOFAI_HOME = root;
+    process.env.HERMES_HOME = join(root, "profiles", "work");
+    const path = runtimeAgentSettingsPath("hermes");
+    const rosterPath = join(root, "agents", "roster.json");
+    mkdirSync(join(root, "agents"));
+    writeFileSync(rosterPath, JSON.stringify({
+      schemaVersion: 1, generation: 5,
+      agents: [
+        { integration: "hermes", instanceId: "agt_1234567890abcdef",
+          settingsPath: path, profileLabel: "work", scope: "user", hookInstalled: true },
+        { integration: "hermes", instanceId: "agt_abcdef1234567890",
+          settingsPath: join(root, "profiles", "personal", "config.yaml"),
+          profileLabel: "personal", scope: "user", hookInstalled: true },
+      ],
+    }));
+    chmodSync(rosterPath, 0o600);
+    expect(readRuntimeAgentIdentity("hermes", path)).toEqual({
+      integration: "hermes", instanceId: "agt_1234567890abcdef",
+    });
+    expect(readRuntimeAgentIdentity("hermes", join(root, "profiles", "absent", "config.yaml"))).toBeNull();
+    expect(readRuntimeAgentIdentity("codex", path)).toBeNull();
+    const exact = parseAgentTargets([{ integration: "hermes", instanceId: "agt_1234567890abcdef" }], 3);
+    expect(agentTargetsMatch(exact, readRuntimeAgentIdentity("hermes", path))).toBe(true);
+    expect(agentTargetsMatch(exact, null)).toBe(false);
+  });
+
+  it("withholds a scoped identity if the roster is unreadable or not owner-only", () => {
+    const root = mkdtempSync(join(tmpdir(), "fpai-agent-roster-"));
+    roots.push(root);
+    process.env.FAILPROOFAI_HOME = root;
+    const path = join(root, "agent", "config.yaml");
+    const rosterPath = join(root, "agents", "roster.json");
+    mkdirSync(join(root, "agents"));
+    writeFileSync(rosterPath, JSON.stringify({
+      schemaVersion: 1, agents: [
+        { integration: "hermes", instanceId: "agt_1234567890abcdef", settingsPath: path },
+      ],
+    }));
+    chmodSync(rosterPath, 0o644);
+    expect(readRuntimeAgentIdentity("hermes", path)).toBeNull();
+    chmodSync(rosterPath, 0o600);
+    writeFileSync(rosterPath, "not JSON");
+    expect(readRuntimeAgentIdentity("hermes", path)).toBeNull();
+  });
+});

__tests__/hooks/agent-scope-hints.test.ts

@@ -0,0 +1,28 @@
+// @vitest-environment node
+import { describe, expect, it } from "vitest";
+import { getIntegration } from "../../src/hooks/integrations";
+import type { IntegrationType } from "../../src/hooks/types";
+
+const SHELL_INTEGRATIONS: IntegrationType[] = [
+  "claude", "codex", "copilot", "cursor",
+  "factory", "devin", "antigravity", "goose",
+];
+
+describe("installed shell hooks carry their originating scope", () => {
+  for (const cli of SHELL_INTEGRATIONS) {
+    it(`${cli}: user and project commands carry different scope hints`, () => {
+      const integration = getIntegration(cli);
+      for (const scope of ["user", "project"] as const) {
+        const entry = integration.buildHookEntry("/usr/local/bin/failproofai", "PreToolUse", scope);
+        const command = typeof entry.command === "string" ? entry.command : entry.bash;
+        expect(command).toContain(`--agent-scope ${scope}`);
+        if (cli === "copilot") expect(entry.powershell).toContain(`--agent-scope ${scope}`);
+      }
+    });
+  }
+
+  it("Claude's local hook identifies the local settings file", () => {
+    expect(getIntegration("claude").buildHookEntry("/bin/failproofai", "PreToolUse", "local"))
+      .toMatchObject({ command: expect.stringContaining("--agent-scope local") });
+  });
+});