failproofai 1.0.11 → 1.0.12-beta.1

package/hermes-plugin/README.md

@@ -165,23 +165,25 @@ decision, because otherwise corrupted retry state could block a turn forever.
 ## Local protocol
 
 Requests and responses use the existing length-prefixed failproofaid Unix
-socket protocol, version 1.
+socket protocol, version 2. A v1 daemon must be upgraded before it can safely
+evaluate agent/profile-scoped policies.
 
 ```json
 {
   "type": "policyEvaluation",
-  "protocolVersion": 1,
+  "protocolVersion": 2,
   "integration": "hermes",
   "event": "pre_tool_call",
   "payload": {},
-  "cwd": "/workspace/project"
+  "cwd": "/workspace/project",
+  "agentSettingsPath": "/path/to/the/hermes/profile"
 }
 ```
 
 ```json
 {
   "type": "policyResult",
-  "protocolVersion": 1,
+  "protocolVersion": 2,
   "decision": "instruct",
   "policyNames": ["custom/approved-write-route"],
   "reason": "Use the approved write route.",

package/hermes-plugin/__init__.py

@@ -102,6 +102,21 @@ def _profile_name() -> str:
     return "default"
 
 
+def _profile_settings_path(profile: str) -> str | None:
+    """Evidence of the profile running this plugin, not a transcript guess."""
+    configured = os.environ.get("HERMES_HOME", "").strip()
+    if configured:
+        selected = Path(configured).expanduser() / "config.yaml"
+    elif profile == "default":
+        selected = Path.home() / ".hermes" / "config.yaml"
+    elif re.fullmatch(r"[A-Za-z0-9._-]{1,80}", profile):
+        selected = Path.home() / ".hermes" / "profiles" / profile / "config.yaml"
+    else:
+        return None
+    # An unresolvable profile does not acquire some other profile's ID.
+    return str(selected.absolute()) if selected.is_file() else None
+
+
 def _string(value: object) -> str:
     return value if isinstance(value, str) else ""
 
@@ -660,6 +675,7 @@ class FailproofAIPlugin:
             event=event,
             payload=payload,
             cwd=cwd,
+            agent_settings_path=_profile_settings_path(self.profile),
             connect_timeout_ms=self.connect_timeout_ms,
             evaluation_timeout_ms=timeout_ms or self.evaluation_timeout_ms,
         )

package/hermes-plugin/client.py

@@ -11,7 +11,7 @@ from dataclasses import dataclass
 from pathlib import Path
 from typing import Any, Mapping, Sequence
 
-PROTOCOL_VERSION = 1
+PROTOCOL_VERSION = 2
 MAX_FRAME_BYTES = 16 * 1024 * 1024
 MAX_REQUEST_BYTES = 1024 * 1024
 
@@ -75,6 +75,7 @@ def evaluate_policy(
     event: str,
     payload: Mapping[str, Any],
     cwd: str | None,
+    agent_settings_path: str | None = None,
     connect_timeout_ms: int = 250,
     evaluation_timeout_ms: int = 12_000,
 ) -> PolicyVerdict:
@@ -85,6 +86,9 @@ def evaluate_policy(
         "event": event,
         "payload": dict(payload),
         "cwd": cwd,
+        # An unknown profile is explicit. Omitting this field would let a new
+        # daemon's warm worker attribute the call to its own Hermes home.
+        "agentSettingsPath": agent_settings_path or "",
     }
     try:
         body = json.dumps(

package/hermes-plugin/plugin.yaml

@@ -1,5 +1,5 @@
 name: failproofai
-version: 1.0.11
+version: 1.0.12-beta.1
 description: Real-time FailproofAI policy enforcement for Hermes
 manifest_version: 2
 api_version: 1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "failproofai",
-  "version": "1.0.11",
+  "version": "1.0.12-beta.1",
   "description": "Observability and enforcement for AI agent harnesses. 40 built-in policies hooked into 12 of them — Claude Code, Codex, Cursor, Hermes, OpenClaw and more — blocking the tool call before it runs. Local dashboard included, no account needed.",
   "bin": {
     "failproofai": "./dist/cli.mjs",
@@ -81,7 +81,7 @@
     "access": "public"
   },
   "devDependencies": {
-    "@anthropic-ai/sdk": "^0.133.0",
+    "@anthropic-ai/sdk": "^0.135.0",
     "@mdx-js/mdx": "^3.1.1",
     "@tailwindcss/postcss": "^4.3.1",
     "@tanstack/react-virtual": "^3.14.10",
@@ -117,7 +117,7 @@
     "nanoid": "3.3.18",
     "postcss": "8.5.26",
     "eslint-plugin-react-hooks": "7.0.1",
-    "vite": "8.0.16",
+    "vite": "8.1.6",
     "undici": "7.29.1",
     "brace-expansion": "5.0.12",
     "sharp": "0.35.5",
@@ -125,15 +125,15 @@
     "browserslist": "4.28.8"
   },
   "optionalDependencies": {
-    "@failproofai/failproofaid-linux-x64": "1.0.11",
-    "@failproofai/failproofaid-linux-arm64": "1.0.11",
-    "@failproofai/failproofaid-darwin-x64": "1.0.11",
-    "@failproofai/failproofaid-darwin-arm64": "1.0.11"
+    "@failproofai/failproofaid-linux-x64": "1.0.12-beta.1",
+    "@failproofai/failproofaid-linux-arm64": "1.0.12-beta.1",
+    "@failproofai/failproofaid-darwin-x64": "1.0.12-beta.1",
+    "@failproofai/failproofaid-darwin-arm64": "1.0.12-beta.1"
   },
   "failproofaidBinaries": {
-    "linux-x64": "49b11d95dafeb2dfecc3b92d7e18243e6b93706ebc2baf44fee9d8875ee1f90a",
-    "linux-arm64": "720702120b1a2427e8ccf2d53f2e782f1f549c4b2da8880832af5b468eeefab6",
-    "darwin-x64": "8861a67d2155831fa6a3699c59ebcfe7eeabf6c6234ef57b2165b52b78e7e3ca",
-    "darwin-arm64": "4acf268dd92bc928d29feb90a3ca7162bf7505af781ae51f56e7b3899420327a"
+    "linux-x64": "df15e65b60066248038c8ac6d423bffcb0e38637e8a42fa22250afa111fd46ac",
+    "linux-arm64": "59d7ae758c8981c5e0a89eb64be18ebd278213525dd4447891a51be6bb018ed9",
+    "darwin-x64": "b0d3d39abaa02ed0a14dddc68277975a7a23e200830b7edbffdedde3af81ce73",
+    "darwin-arm64": "a6d343b5926e84c0eb437af307f85b69b3128f94c6e34acbf9d0b13a7c7e9d63"
   }
 }

package/src/hooks/agent-roster.ts

@@ -0,0 +1,172 @@
+/**
+ * Read the daemon-owned profile roster. The telemetry agent_id and transcript
+ * path are not profile evidence. A scoped Cloud assignment is withheld unless
+ * this invocation resolves to one of the daemon's recorded config paths.
+ */
+import { lstatSync, readFileSync, statSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, resolve } from "node:path";
+import { agentRosterFile } from "./fp-home";
+import { validAgentIdentity, type AgentIdentity } from "./agent-targets";
+import type { HookScope, IntegrationType } from "./types";
+
+/** `MAX_AGENTS` / `MAX_ROSTER_BYTES` in the daemon's `agent_roster.rs`. */
+export const MAX_ROSTER_AGENTS = 256;
+export const MAX_ROSTER_BYTES = 4_000_000;
+
+const USER_SETTINGS: Partial<Record<IntegrationType, string>> = {
+  claude: ".claude/settings.json",
+  codex: ".codex/hooks.json",
+  copilot: ".copilot/hooks/failproofai.json",
+  cursor: ".cursor/hooks.json",
+  opencode: ".config/opencode/opencode.json",
+  pi: ".pi/agent/settings.json",
+  factory: ".factory/hooks.json",
+  devin: ".config/devin/config.json",
+  antigravity: ".gemini/config/hooks.json",
+  goose: ".agents/plugins/failproofai/hooks/hooks.json",
+};
+
+const PROJECT_SETTINGS: Partial<Record<IntegrationType, string[]>> = {
+  claude: [".claude/settings.local.json", ".claude/settings.json"],
+  codex: [".codex/hooks.json"],
+  copilot: [".github/hooks/failproofai.json"],
+  cursor: [".cursor/hooks.json"],
+  opencode: [".opencode/opencode.json"],
+  pi: [".pi/settings.json"],
+  factory: [".factory/hooks.json"],
+  devin: [".devin/config.json"],
+  antigravity: [".agents/hooks.json"],
+  goose: [".agents/plugins/failproofai/hooks/hooks.json"],
+};
+
+function installedHookAt(path: string, cli: IntegrationType): boolean {
+  try {
+    const stat = statSync(path);
+    if (!stat.isFile() || stat.size > 131_072) return false;
+    const text = readFileSync(path, "utf8");
+    if (text.includes("failproofai")) return true;
+    // Pi's project entry is portable and relative to `.pi/settings.json`:
+    // `../pi-extension` contains no product name. Missing it here let a
+    // simultaneously installed user hook masquerade as this project's Pi.
+    if (cli !== "pi") return false;
+    const config: unknown = JSON.parse(text);
+    if (!config || typeof config !== "object" || Array.isArray(config)) return false;
+    const packages = (config as { packages?: unknown }).packages;
+    return Array.isArray(packages) && packages.some(
+      (entry) => typeof entry === "string" && /(?:^|\/)pi-extension\/?$/.test(entry),
+    );
+  } catch {
+    return false;
+  }
+}
+
+/** Called in the originating hook process; the worker's env may be different. */
+export function runtimeAgentSettingsPath(
+  cli: IntegrationType,
+  cwd?: string,
+  userHome = homedir(),
+  hookScope?: HookScope,
+): string | null {
+  if (cli === "hermes") {
+    if (hookScope && hookScope !== "user") return null;
+    const home = process.env.HERMES_HOME;
+    return resolve(home?.trim() ? home : resolve(userHome, ".hermes"), "config.yaml");
+  }
+  if (cli === "openclaw") {
+    if (hookScope && hookScope !== "user") return null;
+    const config = process.env.OPENCLAW_CONFIG_PATH;
+    if (config?.trim()) return resolve(config);
+    const state = process.env.OPENCLAW_STATE_DIR || process.env.OPENCLAW_HOME;
+    return resolve(state?.trim() ? state : resolve(userHome, ".openclaw"), "openclaw.json");
+  }
+  const relative = USER_SETTINGS[cli];
+  if (!relative) return null;
+  const override = cli === "codex" ? process.env.CODEX_HOME
+    : cli === "claude" ? process.env.CLAUDE_CONFIG_DIR : undefined;
+  const user = resolve(override?.trim() ? override : userHome, override?.trim()
+    ? cli === "codex" ? "hooks.json" : "settings.json"
+    : relative);
+  if (hookScope === "user") return user;
+
+  const scopeFiles = hookScope === "local"
+    ? cli === "claude" ? [".claude/settings.local.json"] : []
+    : hookScope === "project"
+      ? (PROJECT_SETTINGS[cli] ?? []).filter((name) => name !== ".claude/settings.local.json")
+      : PROJECT_SETTINGS[cli] ?? [];
+  const matches = new Set<string>();
+  if (hookScope === undefined && installedHookAt(user, cli)) matches.add(user);
+  let dir = resolve(cwd ?? process.cwd());
+  const userRoot = resolve(userHome);
+  for (let depth = 0; depth < 16 && dir !== userRoot; depth++) {
+    for (const candidate of scopeFiles) {
+      const path = resolve(dir, candidate);
+      if (installedHookAt(path, cli)) matches.add(path);
+    }
+    const parent = dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  // No source hint can tell WHICH installed hook fired if both user and
+  // project/local scopes contain us. A guessed profile would let an exact
+  // assignment match another installation: withhold it instead.
+  if (matches.size > 1) return null;
+  if (hookScope === "project" || hookScope === "local") return matches.values().next().value ?? null;
+  return matches.values().next().value ?? user;
+}
+
+export function readRuntimeAgentIdentity(cli: IntegrationType, settingsPath: string | null): AgentIdentity | null {
+  if (!settingsPath) return null;
+  try {
+    const path = agentRosterFile();
+    const stat = lstatSync(path);
+    if (!stat.isFile() || (stat.mode & 0o077) !== 0 || stat.size > MAX_ROSTER_BYTES) return null;
+    const roster: unknown = JSON.parse(readFileSync(path, "utf8"));
+    if (!roster || typeof roster !== "object" || Array.isArray(roster)) return null;
+    const data = roster as Record<string, unknown>;
+    if (data.schemaVersion !== 1 || !Array.isArray(data.agents) || data.agents.length > MAX_ROSTER_AGENTS) return null;
+    const absolute = resolve(settingsPath);
+    const agent = data.agents.find((entry: unknown) => {
+      if (!entry || typeof entry !== "object" || Array.isArray(entry)) return false;
+      const record = entry as Record<string, unknown>;
+      return record.integration === cli && record.settingsPath === absolute &&
+        validAgentIdentity({ integration: record.integration, instanceId: record.instanceId });
+    });
+    const instanceId = (agent as Record<string, unknown> | undefined)?.instanceId;
+    return validAgentIdentity({ integration: cli, instanceId })
+      ? { integration: cli, instanceId: instanceId as string }
+      : null;
+  } catch {
+    // Unavailable, malformed or old roster: never infer a profile from cwd,
+    // transcript, or the display name and widen a scoped deployment.
+    return null;
+  }
+}
+
+/**
+ * Display labels from the daemon's roster, by `agt_` id (`claude / .claude-work`
+ * style: integration, then the profile label). For listings only; never an
+ * identity — `readRuntimeAgentIdentity` is the only thing that decides which
+ * profile a hook is. Empty when the roster cannot be read.
+ */
+export function readRosterLabels(): Map<string, string> {
+  const out = new Map<string, string>();
+  try {
+    const path = agentRosterFile();
+    const stat = lstatSync(path);
+    if (!stat.isFile() || (stat.mode & 0o077) !== 0 || stat.size > MAX_ROSTER_BYTES) return out;
+    const roster: unknown = JSON.parse(readFileSync(path, "utf8"));
+    if (!roster || typeof roster !== "object" || Array.isArray(roster)) return out;
+    const data = roster as Record<string, unknown>;
+    if (data.schemaVersion !== 1 || !Array.isArray(data.agents) || data.agents.length > MAX_ROSTER_AGENTS) return out;
+    for (const entry of data.agents) {
+      if (!entry || typeof entry !== "object" || Array.isArray(entry)) continue;
+      const record = entry as Record<string, unknown>;
+      if (typeof record.instanceId !== "string" || typeof record.profileLabel !== "string" || record.profileLabel === "") continue;
+      out.set(record.instanceId, record.profileLabel.slice(0, 80));
+    }
+  } catch {
+    // No roster: the bare ids are shown.
+  }
+  return out;
+}

package/src/hooks/agent-targets.ts

@@ -0,0 +1,60 @@
+/** Agent identity for enforcement, separate from the project-derived telemetry agent_id. */
+import { INTEGRATION_TYPES, type IntegrationType } from "./types";
+
+export interface AgentIdentity {
+  integration: IntegrationType;
+  instanceId: string;
+}
+
+export interface AgentTarget {
+  integration: IntegrationType;
+  instanceId?: string;
+}
+
+const INSTANCE_ID_RE = /^agt_[0-9a-f]{16,32}$/;
+const integrations = new Set<string>(INTEGRATION_TYPES);
+
+export function validAgentIdentity(value: unknown): value is AgentIdentity {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+  const agent = value as Record<string, unknown>;
+  return Object.keys(agent).every((key) => key === "integration" || key === "instanceId") &&
+    typeof agent.integration === "string" && integrations.has(agent.integration) &&
+    typeof agent.instanceId === "string" && INSTANCE_ID_RE.test(agent.instanceId);
+}
+
+/** Null/absent means all; a malformed selector is never silently treated as all. */
+export function parseAgentTargets(value: unknown, schemaVersion: number): AgentTarget[] | undefined {
+  if (value === undefined || value === null) return undefined;
+  if (schemaVersion < 3 || !Array.isArray(value) || value.length < 1 || value.length > 32) {
+    throw new Error("invalid agentTargets in cloud-managed active manifest");
+  }
+  const seen = new Set<string>();
+  return value.map((raw) => {
+    if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+      throw new Error("invalid agentTargets in cloud-managed active manifest");
+    }
+    const entry = raw as Record<string, unknown>;
+    if (Object.keys(entry).some((key) => key !== "integration" && key !== "instanceId") ||
+        typeof entry.integration !== "string" || !integrations.has(entry.integration) ||
+        (entry.instanceId !== undefined &&
+          (typeof entry.instanceId !== "string" || !INSTANCE_ID_RE.test(entry.instanceId)))) {
+      throw new Error("invalid agentTargets in cloud-managed active manifest");
+    }
+    const key = `${entry.integration}\0${entry.instanceId ?? ""}`;
+    if (seen.has(key)) throw new Error("duplicate agentTargets in cloud-managed active manifest");
+    seen.add(key);
+    return {
+      integration: entry.integration as IntegrationType,
+      ...(entry.instanceId !== undefined ? { instanceId: entry.instanceId as string } : {}),
+    };
+  });
+}
+
+/** An unknown runtime identity cannot widen any scoped assignment. */
+export function agentTargetsMatch(targets: readonly AgentTarget[] | undefined, agent: AgentIdentity | null): boolean {
+  if (targets === undefined) return true;
+  if (!validAgentIdentity(agent)) return false;
+  return targets.some((target) =>
+    target.integration === agent.integration &&
+    (target.instanceId === undefined || target.instanceId === agent.instanceId));
+}

package/src/hooks/cloud-connection.ts

@@ -63,7 +63,7 @@ import {
   type CollectorSettings,
 } from "./collector-config";
 import { recoverCredentialRefusals } from "./credential-recovery";
-import { clearActiveCloudManagedPolicies } from "./cloud-managed-policies";
+import { clearActiveCloudManagedPolicies, readCloudJevState } from "./cloud-managed-policies";
 import { rmSync } from "node:fs";
 import { backfillRequestPath } from "./backfill-request";
 
@@ -180,11 +180,18 @@ export interface JevConnectOutcome {
    * is stored; `jev setup --provider failproofai` switches Jev on.
    */
   optIn?: true;
+  /**
+   * A `--no-transcripts` connection removed this `jev.json`: it named the
+   * FailproofAI Cloud provider and was not switched off (the rule `config
+   * --disconnect` uses), so Jev through FailproofAI Cloud stays off here.
+   * Set with `optIn`.
+   */
+  removedCloudConfig?: string;
   /**
    * A `--no-transcripts` connection found a `jev.json` already in place that
-   * keeps Jev running through FailproofAI Cloud, in this mode. It is left
-   * alone like any existing file (never overwritten), but a connection that
-   * asked for decisions only is told that Jev still sends more than that.
+   * keeps Jev running through FailproofAI Cloud, in this mode, and could not
+   * remove it (see `removedCloudConfig`). A connection that asked for
+   * decisions only is told that Jev still sends more than that.
    */
   stillOn?: "observe" | "enforce";
   /**
@@ -316,7 +323,12 @@ export async function connectToCloud(input: ConnectInput): Promise<ConnectOutcom
     prev.ingest ? { token: prev.ingest.key, url: prev.ingest.url } : undefined,
     prev.jev ? { token: prev.jev.key, url: prev.jev.url } : undefined,
   ].some((slot) => slot && (slot.token !== input.token || !sameOrigin(slot.url)));
-  const orgSwitch = hadConnection && (
+  // Both sides name their organisation: that alone decides. The same org on
+  // a new URL (http → https, a new host for the same Cloud) is a reconnect,
+  // not a switch — clearing its deployment would drop enforcement until the
+  // next poll, and "Switched from X to X" says nothing true.
+  const sameKnownOrg = Boolean(prev.org?.id && known?.orgId && prev.org.id === known.orgId);
+  const orgSwitch = hadConnection && !sameKnownOrg && (
     (prev.org?.id && known?.orgId && prev.org.id !== known.orgId) ||
     ((!prev.org?.id || !known?.orgId) && keyChanged) ||
     (previousPolicy && !sameOrigin(previousPolicy.url)) ||
@@ -425,23 +437,37 @@ export async function connectToCloud(input: ConnectInput): Promise<ConnectOutcom
       writeJevCloudCredential({ url: new URL(input.url).origin, key: input.token });
       // Loaded here and nowhere earlier: a connect whose key does not carry Jev
       // pulls in none of the Jev modules.
-      const { cloudJevRunningMode, existingJevConfig, writeCloudJevConfigIfAbsent } = await import("./jev-cloud-connection");
+      const { cloudJevRunningMode, existingJevConfig, removeCloudJevConfig, writeCloudJevConfig } = await import(
+        "./jev-cloud-connection"
+      );
       if (input.sessions === true) {
-        outcome.jev = { ok: true, config: writeCloudJevConfigIfAbsent(input.url) };
+        outcome.jev = { ok: true, config: writeCloudJevConfig(input.url) };
       } else {
         // `--no-transcripts` never switches Jev on (the user's decision). Jev
         // sends each checked tool call and the recent prompt to FailproofAI
         // Cloud, and someone who just asked for decisions only has not asked
         // for that. The key is stored all the same, so opting in later is one
-        // command with no key to paste; jev.json is not written. One that is
-        // already there is somebody's decision and is reported as ever — and
-        // when it keeps Jev on through FailproofAI Cloud, that is said too, or
-        // "Decisions only." would be the last word while Jev keeps sending.
-        const existing = existingJevConfig(input.url);
-        const stillOn = existing ? cloudJevRunningMode() : null;
-        outcome.jev = existing
-          ? { ok: true, config: existing, ...(stillOn ? { stillOn } : {}) }
-          : { ok: true, optIn: true };
+        // command with no key to paste; jev.json is not written.
+        //
+        // And a jev.json naming the FailproofAI Cloud provider — left by an
+        // earlier connect with transcripts on — is removed, by exactly the rule
+        // `config --disconnect` uses (`removeCloudJevConfig`: the Cloud's file,
+        // not switched off). Kept, it went on sending this machine's tool calls
+        // to FailproofAI Cloud with no Cloud mode set (e2e-c10 O2, user
+        // decision). A BYOK file is its owner's and stays, reported as ever; so
+        // does a Cloud file switched off, the owner's opt-out.
+        const removal = removeCloudJevConfig();
+        if (removal.status === "removed") {
+          outcome.jev = { ok: true, optIn: true, removedCloudConfig: removal.path };
+        } else {
+          const existing = existingJevConfig(input.url);
+          // Still sending (the removal failed): said, or "Decisions only."
+          // would be the last word while Jev keeps sending.
+          const stillOn = existing ? cloudJevRunningMode() : null;
+          outcome.jev = existing
+            ? { ok: true, config: existing, ...(stillOn ? { stillOn } : {}) }
+            : { ok: true, optIn: true };
+        }
       }
     } else if (known) {
       // Introspect ANSWERED, and the key does not carry Jev. This connection
@@ -491,6 +517,14 @@ export async function connectToCloud(input: ConnectInput): Promise<ConnectOutcom
  * this machine now, and — the one case worth a second line — why an existing
  * `jev.json` was not touched.
  */
+function safeCloudJev(): ReturnType<typeof readCloudJevState> {
+  try {
+    return readCloudJevState();
+  } catch {
+    return { jevMode: null, deployment: null, errors: [] };
+  }
+}
+
 export function jevLines(outcome: ConnectOutcome): string[] {
   const jev = outcome.jev;
   if (!jev) return [];
@@ -503,6 +537,11 @@ export function jevLines(outcome: ConnectOutcome): string[] {
   if (!jev.ok) {
     return [`  Jev       not through FailproofAI Cloud: ${jev.reason ?? `that key does not carry \`${PERMISSION_JEV}\``}.`];
   }
+  if (jev.optIn && jev.removedCloudConfig) {
+    return [
+      `  Jev       removed ${jev.removedCloudConfig}, which sent each checked tool call and the recent prompt to FailproofAI Cloud: Jev via FailproofAI Cloud stays off on this machine (--no-transcripts). To switch it on: \`failproofai jev setup --provider failproofai\`.`,
+    ];
+  }
   if (jev.optIn) {
     // One line, and nothing that reads as "on": this connection asked for
     // decisions only, and Jev would send more than that.
@@ -511,20 +550,51 @@ export function jevLines(outcome: ConnectOutcome): string[] {
     ];
   }
   const config = jev.config;
-  if (!config || config.status === "written") {
-    // Plain http (loopback only) is accepted in observe mode and nowhere else, so
-    // the enforce command would be refused there, by the CLI and the dashboard.
-    const plainHttp = config?.status === "written" && new URL(config.baseUrl).protocol === "http:";
+  if (!config || config.status === "written" || config.status === "repointed") {
+    // Plain http (loopback only) is accepted in observe mode and nowhere else:
+    // in enforce mode — set here, or by FailproofAI Cloud — Jev is OFF on this
+    // machine rather than enforcing, by the CLI and the dashboard alike.
+    const plainHttp = config !== undefined && new URL(config.baseUrl).protocol === "http:";
+    const httpLine = "            Over plain http Jev runs only in observe mode: enforce (set here or by FailproofAI Cloud) turns it off on this machine. For enforce, reconnect with `failproofai config --token <key> --url https://…`.";
+    // What happened to jev.json, said first on a re-point; the mode lines
+    // below are the same for both (N1).
+    const lead =
+      config?.status === "repointed" ? [`  Jev       ${config.path} now points here instead of ${config.from}.`] : [];
+    const indent = lead.length > 0 ? "            " : "  Jev       ";
+    // FailproofAI Cloud already set this machine's Jev mode (a reconnect, or a
+    // deployment that arrived first): that mode and Cloud's own checks decide,
+    // not the local jev.json or the packs installed here.
+    const cloudJev = safeCloudJev();
+    if (cloudJev.jevMode !== null) {
+      if (cloudJev.jevMode === "off") return [...lead, `${indent}off on this machine: FailproofAI Cloud set its Jev mode to off.`];
+      if (plainHttp && cloudJev.jevMode === "enforce") {
+        return [
+          ...lead,
+          `${indent}off on this machine: FailproofAI Cloud set enforce, and over plain http Jev runs only in observe mode. For enforce, reconnect with \`failproofai config --token <key> --url https://…\`.`,
+        ];
+      }
+      return [
+        ...lead,
+        `${indent}on through FailproofAI Cloud, mode ${cloudJev.jevMode} (set by FailproofAI Cloud); the Jev checks it deployed here run on FailproofAI Cloud.`,
+      ];
+    }
+    // No Cloud deployment has been read on this machine yet (a first connect,
+    // or the first after a disconnect): FailproofAI Cloud's Jev mode, when it
+    // sets one, arrives with that deployment and overrides jev.json — so the
+    // local mode is said as the fallback it is, not as a promise (N3).
+    const localMode = config?.status === "repointed" ? config.mode : "observe";
+    if (localMode === "off") {
+      return [...lead, `${indent}switched off in ${config?.path ?? "jev.json"} (mode off). FailproofAI Cloud's Jev mode, if it sets one, arrives with its first deployment. To turn it on: \`failproofai jev setup --mode observe\`.`];
+    }
     return [
-      `  Jev       on through FailproofAI Cloud, in observe mode: logged, not enforced (${config?.path ?? "jev.json"}).`,
-      // The package ships no Jev checks, so "on" asks nothing until a pack
-      // gives it some — said here, where the user just turned it on.
+      ...lead,
+      `${indent}configured through FailproofAI Cloud; waiting for FailproofAI Cloud's Jev mode, which arrives with this machine's first deployment (within ~30 s) and decides. Until then, and if Cloud sets none: ${localMode} (${config?.path ?? "jev.json"}). Check with \`failproofai jev status\`.`,
+      // The package ships no Jev checks, so local "on" asks nothing until a
+      // pack gives it some. Checks FailproofAI Cloud deploys run on Cloud.
       ...(jevChecksDeclared()
         ? []
-        : ["            It has no checks installed yet, so it asks nothing. To enable it: `failproofai policies add FailproofAI/jev-policies`."]),
-      plainHttp
-        ? "            Enforce needs an https FailproofAI Cloud URL: reconnect with `failproofai config --token <key> --url https://…`. Over plain http Jev stays in observe mode."
-        : "            Enforce it with `failproofai jev setup --mode enforce`, or from the dashboard.",
+        : ["            No Jev checks are installed on this machine; checks FailproofAI Cloud deploys here run on Cloud. To add local ones: `failproofai policies add FailproofAI/jev-policies`."]),
+      ...(plainHttp ? [httpLine] : []),
     ];
   }
   if (config.status === "kept") {

package/src/hooks/cloud-enrollment-cli.ts

@@ -409,12 +409,13 @@ export function runDisconnectCommand(): CommandResult {
   // machine that had deliberately left its organisation went on being governed
   // by whatever deployment was current when it left, indefinitely, while
   // `--status` reported it as unconnected.
-  const stoppedManaged = clearActiveCloudManagedPolicies();
   // Back to OSS. Leaving mode = "cloud" with no credentials would describe a
   // machine that does not exist, and every cloud code path keys off this flag
   // rather than off "is a token lying around" precisely so that a disconnected
   // machine is provably silent instead of silent-by-happenstance.
   updateConfig({ mode: "oss" });
+  const sharedPolicyRoot = process.env.FAILPROOFAI_CLOUD_POLICY_DIR !== undefined;
+  const stoppedManaged = clearActiveCloudManagedPolicies();
 
   const jevLines =
     jevConfig.status === "removed"
@@ -450,10 +451,12 @@ export function runDisconnectCommand(): CommandResult {
   const lines = [
     "Disconnected from FailproofAI Cloud.",
     "",
-    stoppedManaged
-      ? "  Cloud-managed policies stop being enforced and stop being refreshed.\n" +
+    stoppedManaged || (sharedPolicyRoot && !!existing)
+      ? "  Cloud-managed policies stop being enforced and stop being refreshed, and any Jev mode\n" +
+        "  FailproofAI Cloud set goes with them (its Jev checks never ran on this machine).\n" +
         "  Local builtin, custom and convention policies are unaffected."
       : "  Local builtin, custom and convention policies are unaffected.",
+    ...(sharedPolicyRoot ? ["  An overridden Cloud policy directory was left untouched; OSS mode ignores its old deployment."] : []),
     ...jevLines,
   ];
   if (removedIngest) {
@@ -589,4 +592,4 @@ export function connectionStatusLines(daemonStatus = daemonServiceStatus): strin
     kitRows(report.rows, opts),
     report.warnings.length > 0 ? warning(report.warnings, opts) : null,
   );
-}
+}