Track local agent profiles and enforce scoped Cloud deployments

CHANGELOG.md

@@ -4,6 +4,10 @@
 
 ### Features
 
+- Cloud-managed assignments can target integrations or individual agent profiles. The daemon keeps an owner-only, stable profile roster and reports it to FailproofAI Cloud; scoped schema-3 deployments filter JavaScript before import and send agent identity for Cloud Jev selection. `fp fleet deploy --target POLICY=INTEGRATION[/agt_ID]` narrows a machine assignment; `--all-agents POLICY` clears its scope.
+- A machine's agent roster holds up to 256 profiles (previously 64). When it is full, a newly hooked profile takes the slot of an unhooked profile that FailproofAI Cloud confirms no assignment names and it would not accept as a target. A profile an exact target uses keeps its ID, Jev-only assignments count, and a hook sighting waits in memory until it gets a slot. (#873)
+- The CLI, daemon and native Hermes plugin now use local daemon protocol v2 for agent-profile identity. After upgrading the CLI, reinstall/restart the daemon with `failproofai config` before resuming hook evaluation; an older daemon's response is rejected rather than silently losing the selected profile.
+- Newly installed shell hooks and OpenCode shims identify the user, project or local settings scope that launched them. When a legacy or package-level hook cannot prove its source, a scoped Cloud assignment is withheld and `agent_scope_unresolved` is reported rather than using the daemon worker's own environment as the agent's identity.
 - Uploads, `fp` calls and evaluator calls carry a request id; the daemon also sends batch and machine ids, and `fp` errors show a `ref` (#872)
 - **Jev policies deploy from FailproofAI Cloud, individually, and run there.** A Cloud policy has a kind — `regex` (JavaScript, as before), `jev` (Jev checks only) or `both` (JavaScript reviewable by its own checks). Jev checks run on FailproofAI Cloud; nothing is installed on the machine: the daemon receives a `both` policy's JavaScript (with the server-derived `authority`/`reviewedBy`) and the machine's Jev mode, and nothing else Jev-related. `failproofai policies` lists `both` policies with the Cloud checks that review them.
 - **FailproofAI Cloud can set a machine's Jev mode.** `off` switches Jev off whatever `jev.json` says. `observe`/`enforce` send every gated tool call to FailproofAI Cloud on the machine's Cloud Jev credential (`jev.json` is not used): the machine's own questions — the global intent questions always, plus its installed packs' checks — and a `cloud` block of tool-call metadata; Cloud asks its checks for that machine in the same request and returns their verdict, which the machine merges with its packs' (Cloud first, most severe wins) before the regex combine. A `both` policy is cleared only by its own Cloud checks' outcomes, never by a pack's check of the same name. Cloud gets 5 s to answer (a local `jev.json` keeps its own timeout); a Cloud failure or timeout is today's fallback: the regex decides alone. A session pause does not stop Cloud's checks, as it never stopped Cloud JS policies: a paused session's calls still go to FailproofAI Cloud, with no installed pack's check in them. `failproofai jev status` says "Jev checks run on FailproofAI Cloud (mode: …)" and names each `both` policy's Cloud reviewers.

__tests__/e2e/helpers/hook-runner.ts

@@ -40,7 +40,12 @@ export interface HookRunResult {
 export function runHook(
   event: string,
   payload: Record<string, unknown>,
-  opts?: { homeDir?: string; cli?: "claude" | "codex" | "copilot" | "cursor" | "opencode" | "pi" | "hermes" | "openclaw" | "factory" | "devin" | "antigravity" | "goose" },
+  opts?: {
+    homeDir?: string;
+    cwd?: string;
+    agentScope?: "user" | "project" | "local";
+    cli?: "claude" | "codex" | "copilot" | "cursor" | "opencode" | "pi" | "hermes" | "openclaw" | "factory" | "devin" | "antigravity" | "goose";
+  },
 ): HookRunResult {
   const binaryPath = getBinaryPath();
 
@@ -57,9 +62,11 @@ export function runHook(
 
   const args = [binaryPath, "--hook", event];
   if (opts?.cli) args.push("--cli", opts.cli);
+  if (opts?.agentScope) args.push("--agent-scope", opts.agentScope);
   const result = spawnSync("bun", args, {
     input: JSON.stringify(payload),
     env,
+    cwd: opts?.cwd,
     encoding: "utf8",
     timeout: 15_000,
   });

__tests__/e2e/hooks/agent-scoped-policies.e2e.test.ts

@@ -0,0 +1,78 @@
+// @vitest-environment node
+import { describe, expect, it } from "vitest";
+import { createHash } from "node:crypto";
+import { chmodSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { createFixtureEnv } from "../helpers/fixture-env";
+import { assertAllow, assertPreToolUseDeny, runHook } from "../helpers/hook-runner";
+
+describe("real CLI hook distinguishes simultaneous project and user profiles", () => {
+  it("applies targeted Cloud JS only when the installed hook carries its actual settings scope", () => {
+    const fixture = createFixtureEnv();
+    const projectSettings = join(fixture.cwd, ".claude", "settings.json");
+    const userSettings = join(fixture.home, ".claude", "settings.json");
+    mkdirSync(join(fixture.cwd, ".claude"), { recursive: true });
+    mkdirSync(join(fixture.home, ".claude"), { recursive: true });
+    writeFileSync(projectSettings, '{"hooks":"failproofai --hook PreToolUse --agent-scope project"}');
+    writeFileSync(userSettings, '{"hooks":"failproofai --hook PreToolUse --agent-scope user"}');
+
+    const fpHome = join(fixture.home, ".failproofai");
+    const rosterDir = join(fpHome, "agents");
+    mkdirSync(rosterDir, { recursive: true });
+    const projectId = "agt_1234567890abcdef";
+    const userId = "agt_abcdef1234567890";
+    const roster = join(rosterDir, "roster.json");
+    writeFileSync(roster, JSON.stringify({
+      schemaVersion: 1, generation: 2,
+      agents: [
+        { integration: "claude", instanceId: projectId, settingsPath: projectSettings,
+          profileLabel: "project", scope: "project", hookInstalled: true },
+        { integration: "claude", instanceId: userId, settingsPath: userSettings,
+          profileLabel: "user", scope: "user", hookInstalled: true },
+      ],
+    }), { mode: 0o600 });
+    chmodSync(roster, 0o600);
+
+    const cloudDir = join(fpHome, "policies", "cloud-policies");
+    mkdirSync(join(cloudDir, "artifacts"), { recursive: true });
+    const source = `import { customPolicies, deny } from "failproofai";
+customPolicies.add({
+  name: "only-project", description: "Only this installation",
+  match: { events: ["PreToolUse"] },
+  fn: async () => deny("project agent"),
+});`;
+    const digest = createHash("sha256").update(source).digest("hex");
+    const artifact = `artifacts/${digest}.mjs`;
+    writeFileSync(join(cloudDir, artifact), source);
+    writeFileSync(join(cloudDir, "active.json"), JSON.stringify({
+      schemaVersion: 3, deployment: 1,
+      policies: [{
+        id: "scope-check", version: 1, sha256: digest, path: artifact, effect: "enforce",
+        agentTargets: [{ integration: "claude", instanceId: projectId }],
+      }],
+    }));
+
+    const payload = {
+      session_id: "scope-test", hook_event_name: "PreToolUse",
+      tool_name: "Bash", tool_input: { command: "ls" }, cwd: fixture.cwd,
+    };
+    const project = runHook("PreToolUse", payload, {
+      homeDir: fixture.home, cwd: fixture.cwd, agentScope: "project",
+    });
+    assertPreToolUseDeny(project);
+
+    const user = runHook("PreToolUse", payload, {
+      homeDir: fixture.home, cwd: fixture.cwd, agentScope: "user",
+    });
+    assertAllow(user);
+
+    const legacyAmbiguous = runHook("PreToolUse", payload, {
+      homeDir: fixture.home, cwd: fixture.cwd,
+    });
+    assertAllow(legacyAmbiguous);
+    const report = JSON.parse(readFileSync(join(cloudDir, "errors.json"), "utf8"));
+    expect(report.errors).toContainEqual(expect.objectContaining({
+      id: "agentScope", message: expect.stringContaining("agent_scope_unresolved"),
+    }));
+  });
+});

__tests__/fixtures/agent-targets.json

@@ -0,0 +1,18 @@
+{
+  "cases": [
+    {"name":"unscoped", "schemaVersion":2, "targets":null, "agent":null, "valid":true, "matches":true},
+    {"name":"integration-all-profiles", "schemaVersion":3, "targets":[{"integration":"claude"}], "agent":{"integration":"claude","instanceId":"agt_1111111111111111"}, "valid":true, "matches":true},
+    {"name":"integration-other-agent", "schemaVersion":3, "targets":[{"integration":"claude"}], "agent":{"integration":"codex","instanceId":"agt_1111111111111111"}, "valid":true, "matches":false},
+    {"name":"profile-exact", "schemaVersion":3, "targets":[{"integration":"hermes","instanceId":"agt_2222222222222222"}], "agent":{"integration":"hermes","instanceId":"agt_2222222222222222"}, "valid":true, "matches":true},
+    {"name":"profile-other-instance", "schemaVersion":3, "targets":[{"integration":"hermes","instanceId":"agt_2222222222222222"}], "agent":{"integration":"hermes","instanceId":"agt_3333333333333333"}, "valid":true, "matches":false},
+    {"name":"profile-other-integration", "schemaVersion":3, "targets":[{"integration":"hermes","instanceId":"agt_2222222222222222"}], "agent":{"integration":"codex","instanceId":"agt_2222222222222222"}, "valid":true, "matches":false},
+    {"name":"scope-unresolved", "schemaVersion":3, "targets":[{"integration":"codex"}], "agent":null, "valid":true, "matches":false},
+    {"name":"or-combination", "schemaVersion":3, "targets":[{"integration":"claude"},{"integration":"hermes","instanceId":"agt_2222222222222222"}], "agent":{"integration":"hermes","instanceId":"agt_2222222222222222"}, "valid":true, "matches":true},
+    {"name":"both-halves-same-scope", "schemaVersion":3, "targets":[{"integration":"codex"}], "agent":{"integration":"codex","instanceId":"agt_4444444444444444"}, "valid":true, "matches":true},
+    {"name":"empty-array", "schemaVersion":3, "targets":[], "agent":null, "valid":false},
+    {"name":"duplicate-selector", "schemaVersion":3, "targets":[{"integration":"codex"},{"integration":"codex"}], "agent":null, "valid":false},
+    {"name":"unknown-integration", "schemaVersion":3, "targets":[{"integration":"invented"}], "agent":null, "valid":false},
+    {"name":"invalid-profile-id", "schemaVersion":3, "targets":[{"integration":"hermes","instanceId":"bad"}], "agent":null, "valid":false},
+    {"name":"scoped-in-schema-two", "schemaVersion":2, "targets":[{"integration":"claude"}], "agent":null, "valid":false}
+  ]
+}

__tests__/fixtures/hermes-native-plugin-check.py

@@ -431,7 +431,7 @@ def server() -> None:
                         body = json.dumps(
                             {
                                 "type": "policyResult",
-                                "protocolVersion": 1,
+                                "protocolVersion": 2,
                                 "decision": "instruct",
                                 "policyNames": ["custom/write-route"],
                                 "reason": "Use the approved route.",
@@ -451,14 +451,16 @@ def server() -> None:
                     event="pre_tool_call",
                     payload={"tool_name": "write_file", "tool_input": {"path": "/tmp/a"}},
                     cwd="/tmp",
+                    agent_settings_path="/tmp/hermes-work/config.yaml",
                 )
             thread.join(timeout=2)
             self.assertEqual(received["type"], "policyEvaluation")
             self.assertEqual(received["integration"], "hermes")
+            self.assertEqual(received["agentSettingsPath"], "/tmp/hermes-work/config.yaml")
             self.assertEqual(verdict.decision, "instruct")
             self.assertEqual(verdict.tool_name, "Write")
 
-    def test_client_rejects_protocol_mismatch(self) -> None:
+    def test_client_rejects_a_v1_daemon_result(self) -> None:
         with tempfile.TemporaryDirectory() as tmp:
             socket_path = Path(tmp) / "daemon.sock"
             ready = threading.Event()
@@ -476,7 +478,7 @@ def server() -> None:
                         body = json.dumps(
                             {
                                 "type": "policyResult",
-                                "protocolVersion": 99,
+                                "protocolVersion": 1,
                                 "decision": "allow",
                                 "policyNames": [],
                                 "matchedPolicies": [],