failproofai 1.0.12-beta.0 → 1.0.12-beta.1

package/src/hooks/configure-wizard.ts

@@ -30,26 +30,20 @@ import { dirname, resolve, sep } from "node:path";
 import { CORE_SOURCE } from "./pack-store";
 
 import {
-  BACK,
   collapseAfter,
   colorsEnabled,
   multiSelect,
   OPEN_SOURCE,
   optsFor,
   paint,
-  promptBrowserLogin,
   promptCloudKey,
   screenKit,
-  selectOne,
   type CloudKeyAnswer,
   type MultiChoice,
   type OpenSource,
-  type SelectChoice,
   type TTYIn,
   type TTYOut,
 } from "./tui";
-import { claimLogin, machineOs, pollLogin, startLogin, type LoginOrg } from "./cloud-login";
-import { canOpenBrowser, openUrl } from "../audit/open-browser";
 import {
   DEFAULT_INGEST_URL,
   readIngestCredential,
@@ -1004,190 +998,6 @@ export async function runConfigureWizard(
       stdout,
     });
 
-  // A key typed after picking "Paste an API key" from the menu. Same field as
-  // above minus the saved key, which the menu already offered as "keep"; Tab is
-  // the way back to the menu, so it never means open source here.
-  const askKey = (): Promise<CloudKeyAnswer | OpenSource | null> =>
-    promptCloudKey({
-      message: "Connect to cloud",
-      meta: source ? `${host}  ·  from ${source}` : host,
-      tabHint: "go back",
-      emptyError: "Paste a key, or press tab to go back.",
-      check: async (key) => {
-        if (!url) return { ok: false, line: badUrl ?? "No usable endpoint." };
-        const r = await checkCloudKey(url, key);
-        if (r.ok) {
-          typedOrg = r.org;
-          return { ok: true, line: r.note };
-        }
-        return { ok: false, line: r.refused ? `That key was refused: ${r.reason}.` : `Couldn't check the key: ${r.reason}.` };
-      },
-      collapsed: (answer) => (answer === OPEN_SOURCE ? [] : [...cloudLines(planFor(answer)), ""]),
-      stdin,
-      stdout,
-    });
-
-  // The browser login. Resolves the approval, BACK for the menu of other
-  // options (Tab / Esc, or a cloud that cannot do this), or null when the person
-  // cancelled the whole run.
-  type Approval = Extract<CloudPlan, { kind: "login" }>;
-  // Set once the cloud says it has no browser login; the menu then drops it.
-  let loginUnsupported = false;
-  const askLogin = (endpoint: string): Promise<{ value: Approval } | typeof BACK | null> => {
-    let pollSecret = "";
-    return promptBrowserLogin<Approval>({
-      message: "Connect to cloud",
-      meta: source ? `${host}  ·  from ${source}` : host,
-      machineLabel,
-      start: async () => {
-        const r = await startLogin(endpoint, { label: machineLabel, os: machineOs(), cliVersion });
-        if (r.kind === "ok") {
-          pollSecret = r.pollSecret;
-          void emit("configure_cloud_login", { step: "started" });
-          return { ok: true, url: r.verificationUrl, expiresIn: r.expiresIn, interval: r.interval };
-        }
-        if (r.kind === "unsupported") {
-          void emit("configure_cloud_login", { step: "unsupported" });
-          loginUnsupported = true;
-          return { ok: false, retryable: false, line: `${host} doesn't support logging in from here yet.` };
-        }
-        return {
-          ok: false,
-          retryable: true,
-          line: r.kind === "refused" ? `Couldn't start the login: ${r.reason}.` : `Couldn't reach ${host}: ${r.reason}.`,
-        };
-      },
-      poll: async () => {
-        const p = await pollLogin(endpoint, pollSecret);
-        switch (p.kind) {
-          case "approved":
-            void emit("configure_cloud_login", { step: "approved" });
-            return {
-              state: "approved",
-              value: {
-                kind: "login",
-                pollSecret,
-                org: p.org,
-                approvedBy: p.approvedBy,
-                keyName: p.keyName,
-                permissions: p.permissions,
-              },
-            };
-          case "pending":
-            return { state: "pending", interval: p.interval };
-          case "slow_down":
-            return { state: "slow_down" };
-          case "denied":
-            void emit("configure_cloud_login", { step: "denied" });
-            return { state: "denied" };
-          case "unreachable":
-            return { state: "unreachable", line: p.reason };
-          // Expired, already claimed, or swept: in every case this link is done.
-          default:
-            return { state: "expired" };
-        }
-      },
-      open: (link) => {
-        if (!canOpenBrowser()) return false;
-        openUrl(link);
-        return true;
-      },
-      collapsed: (plan) => [...cloudLines(plan), ""],
-      stdin,
-      stdout,
-    });
-  };
-
-  // The interactive CONNECT step. A machine with no connection, or whose saved
-  // key is refused, starts the browser login straight away — Tab or Esc there
-  // opens the other options. A machine that is connected with a working key gets
-  // the menu, "keep" first, so re-running config never opens a browser by itself.
-  const chooseConnection = async (): Promise<CloudPlan | null> => {
-    const verdict =
-      saved && !saved.splitKeys
-        ? await transient("Checking your saved key…", () => checkCloudKey(saved.url, saved.token))
-        : null;
-    const savedBroken = verdict !== null && !verdict.ok && verdict.refused;
-    const keptPlan: CloudPlan =
-      verdict && verdict.ok
-        ? { kind: "kept", how: "saved", verified: true }
-        : verdict && !verdict.refused
-          ? { kind: "kept", how: "saved", verified: false }
-          : { kind: "kept", how: "skip", verified: false };
-    const keepHint = !saved
-      ? ""
-      : saved.splitKeys
-        ? "leave both keys as they are"
-        : verdict?.ok
-          ? `${verdict.org ?? saved.org ?? hostOf(saved.url)} · key ${maskToken(saved.token)}`
-          : savedBroken
-            ? "its key no longer works"
-            : "its key couldn't be checked just now";
-
-    type Pick = "login" | "key" | "oss" | "keep";
-    const login: SelectChoice<Pick> = {
-      label: saved ? "Log in again" : "Log in to FailproofAI Cloud",
-      value: "login",
-      hint: savedBroken
-        ? "recommended · your saved key no longer works"
-        : saved
-          ? "opens your browser and makes a new key"
-          : "recommended · opens your browser",
-    };
-    const key: SelectChoice<Pick> = { label: "Paste an API key", value: "key", hint: "one you already have" };
-    const oss: SelectChoice<Pick> = { label: "Use open source", value: "oss", hint: "skip the cloud" };
-    const keep: SelectChoice<Pick> = { label: "Keep current connection", value: "keep", hint: keepHint };
-    // No initial-cursor option on selectOne: the default is whatever is first.
-    const choices = !saved ? [login, key, oss] : savedBroken ? [login, key, keep] : [keep, login, key];
-    const leftLogin = (result: Awaited<ReturnType<typeof askLogin>>): CloudPlan | null | typeof BACK => {
-      if (result === null || result === BACK) {
-        if (result === BACK && loginUnsupported) {
-          write([kit.caution(`${host} doesn't support logging in from here yet. Paste an API key instead.`), ""]);
-        }
-        return result;
-      }
-      return result.value;
-    };
-
-    if (url && (!saved || savedBroken)) {
-      if (savedBroken && verdict && !verdict.ok) {
-        write([kit.caution(`Your saved key no longer works: ${verdict.reason}. Logging in again.`)]);
-      }
-      void emit("configure_cloud_choice", { choice: "login", connected: Boolean(saved), auto: true });
-      const first = leftLogin(await askLogin(url));
-      if (first !== BACK) return first;
-    }
-
-    for (;;) {
-      const pick = await selectOne<Pick>({
-        message: "Connect to cloud",
-        meta: source ? `${host}  ·  from ${source}` : host,
-        choices: loginUnsupported ? choices.filter((c) => c.value !== "login") : choices,
-        collapsed: (p) =>
-          p === "keep" ? [...cloudLines(keptPlan), ""] : p === "oss" ? [...cloudLines({ kind: "oss" }), ""] : [],
-        stdin,
-        stdout,
-      });
-      if (pick === null) return null;
-      void emit("configure_cloud_choice", { choice: pick, connected: Boolean(saved) });
-      if (pick === "keep") return keptPlan;
-      if (pick === "oss") return { kind: "oss" };
-      if (pick === "key") {
-        const answer = await askKey();
-        if (answer === null) return null;
-        if (answer === OPEN_SOURCE) continue;
-        return planFor(answer);
-      }
-      if (!url) {
-        write([kit.fail(badUrl ?? "No usable endpoint."), ""]);
-        continue;
-      }
-      const result = leftLogin(await askLogin(url));
-      if (result === BACK) continue;
-      return result;
-    }
-  };
-
   let cloud: CloudPlan;
   if (answers.oss) {
     cloud = saved ? { kind: "kept", how: "skip", verified: false } : { kind: "oss" };
@@ -1222,12 +1032,11 @@ export async function runConfigureWizard(
     cloud = saved ? { kind: "kept", how: "skip", verified: false } : { kind: "oss" };
     write([...cloudLines(cloud), ""]);
   } else {
-    // Said above the menu, which stays usable for keeping a saved key and for
-    // open source, neither of which sends anything anywhere.
+    // Said above the field, which stays usable for Tab and a saved key.
     if (badUrl) write([kit.fail(badUrl)]);
-    const chosen = await chooseConnection();
-    if (chosen === null) return cancel();
-    cloud = chosen;
+    const answer = await askCloud();
+    if (answer === null) return cancel();
+    cloud = planFor(answer);
   }
 
   // ── AGENTS ──────────────────────────────────────────────────────────────────
@@ -1240,10 +1049,8 @@ export async function runConfigureWizard(
   // Whether the daemon will be collecting once this run ends: a key is already
   // on disk, or this run writes one. Removal copy and the backfill request both
   // depend on it.
-  // A browser login connects exactly like a pasted key, one step later.
-  const connecting = cloud.kind === "connect" || cloud.kind === "login";
-  const collectingAfter = connecting || readIngestCredential() !== null;
-  const sessionsOn = connecting ? answers.noTranscripts !== true : fp.collector.sessions === true;
+  const collectingAfter = cloud.kind === "connect" || readIngestCredential() !== null;
+  const sessionsOn = cloud.kind === "connect" ? answers.noTranscripts !== true : fp.collector.sessions === true;
 
   let selected: IntegrationType[];
   if (answers.agents && answers.agents.length > 0) {
@@ -1298,37 +1105,6 @@ export async function runConfigureWizard(
   //  5. The connection last.
   const done: string[] = [];
   let daemonInstalled = daemonAlreadyRunning;
-  // The `sudo -v` at the top cached root for sudo's timeout — five minutes by
-  // default on macOS, fifteen on most Linux. A browser login, or simply a slow
-  // agents screen, can outlast it, and the install below runs `sudo -n`, which
-  // would then fail AFTER the person did everything else. Ask once more instead.
-  // The stale-unit refresh runs `sudo -n` too, so it is asked for the same way —
-  // but, as at the top, losing root there costs the scheduled audit, not setup.
-  // Unattended runs never primed anything, so there is nothing to have expired.
-  if ((daemonWanted || daemonUnitStale) && !unattended) {
-    let stillRoot = false;
-    try {
-      stillRoot = canElevate();
-    } catch {
-      stillRoot = false;
-    }
-    if (!stillRoot && daemonWanted) {
-      if (!elevate("Your sudo session expired while you were away. Installing failproofaid needs root again.")) {
-        write([
-          kit.fail("Couldn't get root, so setup stopped before changing anything."),
-          `  Re-run once you can use sudo:  ${kit.cmd("failproofai config")}`,
-        ]);
-        void emit("configure_aborted", { reason: "needs_root" });
-        return { applied: false, abort: "needs_root" };
-      }
-    } else if (
-      !stillRoot &&
-      !elevate("Your sudo session expired while you were away. Refreshing failproofaid's service definition needs root again.")
-    ) {
-      done.push(kit.caution("No root, so its service definition stays as it is. Scheduled audits stay off until it is refreshed."));
-      daemonUnitStale = false;
-    }
-  }
   if (daemonWanted) {
     // A unit that is running but cannot answer is torn down before it is
     // rebuilt: it holds the singleton flock the replacement needs, so
@@ -1438,7 +1214,7 @@ export async function runConfigureWizard(
     pruneOldDaemonBinaries();
   }
 
-  const connectedAfterPlan = connecting || cloud.kind === "kept";
+  const connectedAfterPlan = cloud.kind === "connect" || cloud.kind === "kept";
   // Telemetry runs concurrently with the rest of apply (never rejects,
   // 5s-bounded) and is awaited before returning. `cli` carries the selected
   // agent ids, as it always has (and as hooks_installed does): a fixed list of
@@ -1449,7 +1225,7 @@ export async function runConfigureWizard(
     cli: selected,
     cli_count: selected.length,
     policy_count: (readScopedHooksConfig("user", cwd).enabledPolicies ?? []).length,
-    connected: connecting,
+    connected: cloud.kind === "connect",
     mode: connectedAfterPlan ? "cloud" : "oss",
     agents_selected: selected.length,
     agents_detected: plan.detected.size,
@@ -1497,36 +1273,8 @@ export async function runConfigureWizard(
   // a key on disk doing nothing. `connectToCloud` re-verifies each capability
   // and writes only what works.
   let connected = false;
-  // A browser login has an approval, not a key: claim it NOW, with the daemon
-  // in, so a run that stopped earlier left nothing minted anywhere. The claim
-  // is single-use — the server mints the key and hands it over exactly once.
-  let token: string | null = cloud.kind === "connect" ? cloud.token : null;
-  let orgLabel: string | undefined = cloud.kind === "connect" ? cloud.org : undefined;
-  let mintedName: string | undefined;
-  if (cloud.kind === "login" && url) {
-    const claimed = await transient("Creating this machine's key…", () => claimLogin(url, cloud.pollSecret));
-    void emit("configure_cloud_login", { step: "claimed", ok: claimed.kind === "ok", reason: claimed.kind });
-    if (claimed.kind === "ok") {
-      token = claimed.key;
-      orgLabel = loginOrgLabel(claimed.org);
-      mintedName = claimed.keyName;
-    } else {
-      hookLogWarn(`cloud login could not be completed: ${claimed.kind}`);
-      done.push(
-        kit.caution(
-          claimed.kind === "expired"
-            ? "The login took too long to finish, so no key was created. Everything else was applied."
-            : claimed.kind === "revoked"
-              ? "Whoever approved the login can no longer create keys in that org, so no key was created."
-              : claimed.kind === "unreachable"
-                ? `Couldn't reach ${host} to create the key (${claimed.reason}); everything else was applied.`
-                : `The key couldn't be created: ${claimed.reason}. Everything else was applied.`,
-          "failproofai config",
-        ),
-      );
-    }
-  }
-  if (token && url) {
+  if (cloud.kind === "connect" && url) {
+    const token = cloud.token;
     try {
       const outcome = await transient("Connecting…", () =>
         connectToCloud({
@@ -1540,12 +1288,7 @@ export async function runConfigureWizard(
       );
       connected = outcome.anyConfigured;
       done.push(...(outcome.changes ?? []));
-      done.push(...connectDoneLines(kit, outcome, host, orgLabel));
-      // Logging in again makes a NEW key; the one this machine held keeps
-      // working until someone revokes it. Said here, where it is still useful.
-      if (cloud.kind === "login" && saved && connected) {
-        done.push(`  Your previous key for this machine still works until you revoke it on ${host}'s keys page.`);
-      }
+      done.push(...connectDoneLines(kit, outcome, host, cloud.org));
       if (outcome.ingest.ok && answers.noTranscripts === true) {
         done.push("  Decisions only: session transcripts are not sent (--no-transcripts).");
       }
@@ -1555,22 +1298,12 @@ export async function runConfigureWizard(
       hookLogWarn(`cloud connection was not written: ${err instanceof Error ? err.message : String(err)}`);
       done.push(kit.caution("Couldn't connect; everything else was applied.", "failproofai config"));
     }
-    // The claim spent the approval and the key exists, but nothing here uses
-    // it: say which one, so it can be revoked rather than left live.
-    if (cloud.kind === "login" && !connected) {
-      done.push(`  The key ${mintedName ? `"${mintedName}" ` : ""}was created but isn't in use here; revoke it on ${host}'s keys page.`);
-    }
   } else if (cloud.kind === "kept" && cloud.how === "saved" && fp.mode !== "cloud") {
     // A home migrated from layout 1 carries keys but no mode, and would read
     // as open source everywhere that asks.
     updateConfig({ mode: "cloud" });
   }
 
-  // Logging in again on a connected machine, with no key at the end of it,
-  // changed nothing about the connection: the previous one is still there.
-  const keptOld = cloud.kind === "login" && !token && saved !== undefined;
-  if (keptOld) done.push("  This machine keeps its previous connection.");
-
   await applied;
   // Only now — a completed apply — is the launcher considered "seen", so
   // first-run onboarding stops offering itself on every command.
@@ -1588,7 +1321,7 @@ export async function runConfigureWizard(
       done,
       cwd,
       agents: selected.length,
-      connected: connected || cloud.kind === "kept" || keptOld,
+      connected: connected || cloud.kind === "kept",
       codexTrust,
     }),
   );
@@ -1601,7 +1334,7 @@ export async function runConfigureWizard(
     policies,
     daemonInstalled,
     connected,
-    mode: connected || cloud.kind === "kept" || keptOld ? "cloud" : "oss",
+    mode: connected || cloud.kind === "kept" ? "cloud" : "oss",
     agents: { selected, added, removed },
   };
 }
@@ -1612,19 +1345,7 @@ export async function runConfigureWizard(
 type CloudPlan =
   | { kind: "oss" }
   | { kind: "kept"; how: "skip" | "saved"; verified: boolean }
-  | { kind: "connect"; token: string; org?: string; note?: string }
-  /**
-   * Approved in the browser, not yet claimed. The key does not exist until
-   * apply claims it — after the daemon is in — so a run that stops before then
-   * leaves no key behind anywhere.
-   */
-  | { kind: "login"; pollSecret: string; org: LoginOrg; approvedBy?: string; keyName?: string; permissions: string[] };
-
-/** "Acme (acme)", or whichever half the server sent. */
-function loginOrgLabel(org: LoginOrg): string {
-  if (org.name && org.slug) return `${org.name} (${org.slug})`;
-  return org.name ?? org.slug ?? "your org";
-}
+  | { kind: "connect"; token: string; org?: string; note?: string };
 
 /**
  * The connection already on this machine, from either credential: the policy
@@ -1673,15 +1394,7 @@ export function resolveCloudUrl(
   const env = process.env.FAILPROOFAI_CLOUD_URL?.trim();
   const fromFlag = flag?.trim();
   const override = fromFlag || env;
-  if (!override) {
-    if (!existing) return { ok: true, url: cloudBaseFor(DEFAULT_INGEST_URL) };
-    // Checked like a typed one: login sends its secret and receives a key here
-    // before anything else would, and the file it came from can be edited.
-    const saved = validateCloudUrl(existing);
-    return saved.ok
-      ? { ok: true, url: existing }
-      : { ok: false, message: `the saved cloud address "${existing}" cannot be used: ${saved.reason}` };
-  }
+  if (!override) return { ok: true, url: existing ?? cloudBaseFor(DEFAULT_INGEST_URL) };
   const source = fromFlag && fromFlag !== env ? "--url" : "FAILPROOFAI_CLOUD_URL";
   const validated = validateCloudUrl(cloudBaseFor(override));
   if (!validated.ok) {
@@ -1764,15 +1477,6 @@ export function cloudCollapsedLines(
         kit.ok(plan.org ? `Key accepted for ${plan.org} on ${at.host}` : `Key accepted by ${at.host}`),
         ...(plan.note ? [kit.caution(plan.note)] : []),
       ];
-    case "login":
-      // Who approved it is said out loud: a link someone else approved into
-      // THEIR org would otherwise connect this machine there unnoticed.
-      return [
-        head,
-        kit.ok(
-          `Logged in${plan.approvedBy ? ` as ${plan.approvedBy}` : ""} · ${loginOrgLabel(plan.org)} on ${at.host}`,
-        ),
-      ];
   }
 }
 

package/src/hooks/custom-hooks-loader.ts

@@ -176,7 +176,7 @@ async function importWithDeadline(fileUrl: string): Promise<void> {
  * Does NOT clear the registry — caller is responsible for that.
  */
 export interface PolicyLoadFailure {
-  type: "module_not_found" | "syntax_error" | "load_timeout" | "runtime_error" | "path_missing";
+  type: "module_not_found" | "file_not_found" | "syntax_error" | "load_timeout" | "runtime_error" | "path_missing";
   reason: string;
 }
 
@@ -250,8 +250,13 @@ async function loadSingleFile(
     return null;
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
-    const errorType = /Cannot find module|MODULE_NOT_FOUND|ENOENT/i.test(msg)
+    // An import that names no module, apart from a file the policy itself
+    // reads at load (a `readFileSync` of its data): both are ENOENT underneath,
+    // but "module not found" sent people looking for a missing package (B13).
+    const errorType = /Cannot find module|MODULE_NOT_FOUND|Cannot find package/i.test(msg)
       ? "module_not_found"
+      : /ENOENT/i.test(msg)
+        ? "file_not_found"
       : /SyntaxError|Unexpected token/i.test(msg)
         ? "syntax_error"
         : /timed out loading module/i.test(msg)
@@ -334,6 +339,13 @@ export interface LoadAllResult {
    * Only present for a path more than one pack resolved to.
    */
   packAliases: Map<string, string[]>;
+  /**
+   * Import failures of FailproofAI Cloud JS policies, keyed by Cloud policy id
+   * (every id behind a shared artifact). Fail-open like the rest of the Cloud
+   * read — nothing denies over them — but reported to Cloud in `errors.json`,
+   * so a deployment that is not actually enforcing says so.
+   */
+  cloudFailures?: Map<string, PolicyLoadFailure>;
 }
 
 export function customPolicyId(file: string, name: string): string {
@@ -456,8 +468,12 @@ export async function loadAllCustomHooks(
   // codebase exists to remove. It is also announced, so an operator can give the
   // two policies distinguishable source instead of living with the merge.
   const cloudManagedByPath = new Map<string, CloudManagedPolicyArtifact>();
+  /** Every Cloud policy id behind each artifact path, for `cloudFailures`. */
+  const cloudIdsByPath = new Map<string, string[]>();
+  const cloudFailures = new Map<string, PolicyLoadFailure>();
   for (const policy of opts?.cloudManagedPolicies ?? []) {
     const key = resolve(policy.path);
+    cloudIdsByPath.set(key, [...(cloudIdsByPath.get(key) ?? []), policy.id]);
     const existing = cloudManagedByPath.get(key);
     if (!existing) {
       cloudManagedByPath.set(key, policy);
@@ -660,6 +676,9 @@ export async function loadAllCustomHooks(
         if (failure && pack) {
           for (const id of packIdsByPath.get(absPath) ?? [pack.id]) packFailures.set(id, failure);
         }
+        if (failure && cloudManaged) {
+          for (const id of cloudIdsByPath.get(absPath) ?? [cloudManaged.id]) cloudFailures.set(id, failure);
+        }
         for (const hook of getCustomHooks().slice(hooksBefore)) {
           const tagged = hook as CustomHook & {
             __policyId?: string;
@@ -680,6 +699,10 @@ export async function loadAllCustomHooks(
       }
     } else {
       hookLogWarn(`custom policy path not found: ${absPath}`);
+      if (cloudManaged) {
+        const missing = { type: "path_missing", reason: `path missing: ${absPath}` } as const;
+        for (const id of cloudIdsByPath.get(absPath) ?? [cloudManaged.id]) cloudFailures.set(id, missing);
+      }
       if (pack) {
         const missing = { type: "path_missing", reason: `path missing: ${absPath}` } as const;
         for (const id of packIdsByPath.get(absPath) ?? [pack.id]) packFailures.set(id, missing);
@@ -830,5 +853,5 @@ export async function loadAllCustomHooks(
     const winner = packByPath.get(path);
     if (winner && ids.length > 1) packAliases.set(winner.id, ids);
   }
-  return { hooks: allHooks, conventionSources, packFailures, packAliases };
+  return { hooks: allHooks, conventionSources, packFailures, packAliases, cloudFailures };
 }

package/src/hooks/daemon-client.ts

@@ -16,7 +16,7 @@ import { existsSync } from "node:fs";
 import { daemonSocket as daemonSocketPath } from "./fp-home";
 import { readConfig } from "./fp-config";
 
-const PROTOCOL_VERSION = 1;
+const PROTOCOL_VERSION = 2;
 
 /**
  * Reaching the daemon and getting an answer out of it are two different
@@ -56,6 +56,8 @@ export interface DaemonHookRequest {
    * hazard.
    */
   cwd?: string;
+  /** Settings path of the originating agent profile, not the daemon's. */
+  agentSettingsPath?: string;
 }
 
 export interface DaemonHookResponse {
@@ -98,6 +100,7 @@ export interface DaemonPolicyEvaluationRequest {
   event: string;
   payload: Record<string, unknown>;
   cwd?: string;
+  agentSettingsPath?: string;
 }
 
 export type DaemonPolicyEvaluationAttempt =
@@ -304,6 +307,7 @@ export async function attemptDaemonHook(
       cli: req.cli,
       stdin: req.stdin,
       cwd: req.cwd,
+      agentSettingsPath: req.agentSettingsPath,
     },
     opts,
   );
@@ -338,9 +342,9 @@ function isStringArray(value: unknown): value is string[] {
 
 /**
  * Attempts the structured request used by native in-process integrations.
- * A matching protocol version is not sufficient: pre-native v1 daemons speak
- * `hook` but cannot deserialize `policyEvaluation`, so only a complete,
- * well-shaped `policyResult` proves this capability exists.
+ * A matching protocol version is not sufficient: a broken or partial daemon
+ * may speak `hook` but not `policyEvaluation`, so only a complete, well-shaped
+ * `policyResult` proves this capability exists.
  */
 export async function attemptDaemonPolicyEvaluation(
   req: DaemonPolicyEvaluationRequest,
@@ -354,6 +358,7 @@ export async function attemptDaemonPolicyEvaluation(
       event: req.event,
       payload: req.payload,
       cwd: req.cwd,
+      agentSettingsPath: req.agentSettingsPath,
     },
     opts,
   );

package/src/hooks/daemon-service.ts

@@ -7,6 +7,7 @@
  * `configure-wizard.ts` calls the functions here directly, the same
  * relationship it already has with `manager.ts`'s `installHooks()`.
  */
+import { HEALTH_PROBE_SOURCE } from "./health-probe";
 import {
   existsSync,
   mkdirSync,
@@ -1030,7 +1031,7 @@ export async function probeDaemon(): Promise<DaemonProbe> {
             cli: "claude",
             stdin: JSON.stringify({
               hook_event_name: "SessionStart",
-              source: "failproofai-health-probe",
+              source: HEALTH_PROBE_SOURCE,
             }),
           },
           { responseTimeoutMs: DAEMON_PROBE_TIMEOUT_MS },

package/src/hooks/effective-reviewers.ts

@@ -12,6 +12,15 @@
  * never installed its checks: `jevChecksInstalled` below is the hook path's
  * gate for starting a review at all.
  *
+ * ## …and a FailproofAI Cloud `both` policy's own Cloud checks
+ *
+ * A `both` policy's JS half names its own Jev checks, which run on FailproofAI
+ * Cloud and never reach this machine (CONTRACT C10). While Cloud's Jev mode
+ * asks (`observe`/`enforce`), those names are reviewers too — but only as
+ * `cloud:<policyId>/<name>` (`cloudReviewerName`), which the Cloud review files
+ * that policy's own Cloud outcomes under. An installed pack's check of the same
+ * name is a different reviewer and can never clear it.
+ *
  * The names come from the MANIFEST, which is already where `authority` and
  * `reviewedBy` themselves are read from, so this adds no new trust and imports
  * no semantic module.
@@ -36,11 +45,14 @@
  */
 import { readInstalledPacks, type ResolvedPack } from "./pack-manifest";
 import { NO_REVIEWERS, SEMANTIC_REVIEWER_NAMES } from "./policy-authority";
+import { cloudReviewerNames, readCloudAuthorityInputs, readCloudJevMode } from "./cloud-managed-policies";
+import type { AgentIdentity } from "./agent-targets";
 
 let cached: ReadonlySet<string> | null = null;
 let cachedContested: ReadonlyMap<string, string[]> = new Map();
 /** The agent the current registration pass is for; see {@link forgetEffectiveReviewerNames}. */
 let reviewerCli: string | undefined;
+let reviewerAgent: AgentIdentity | null = null;
 
 /**
  * The packs whose Jev checks take part for `cli`, filtered the way the regex
@@ -180,6 +192,14 @@ export function effectiveReviewerNames(): ReadonlySet<string> {
   } catch {
     // See above: an unreadable manifest declares no checks.
   }
+  try {
+    // Both reads answer "nothing" for a file they cannot use; guarded anyway,
+    // because a throw here would cost the registration pass — every policy.
+    const cloud = cloudReviewerNames(readCloudAuthorityInputs(reviewerAgent), readCloudJevMode());
+    if (cloud.length > 0) names = new Set([...names, ...cloud]);
+  } catch {
+    // No Cloud reviewers: every `both` policy stays hard.
+  }
   cached = names;
   return names;
 }
@@ -244,7 +264,8 @@ export function reviewerNamesFor(
  * runs before it registers anything — so a pack installed under a long-lived
  * warm worker is picked up on the next event rather than at the next restart.
  */
-export function forgetEffectiveReviewerNames(cli?: string): void {
+export function forgetEffectiveReviewerNames(cli?: string, agent: AgentIdentity | null = null): void {
   cached = null;
   reviewerCli = cli;
+  reviewerAgent = agent;
 }

package/src/hooks/fp-home.ts

@@ -165,6 +165,9 @@ export const credentialsFile = (home?: string) => atHome(home, "credentials.json
  */
 export const jevConfigFile = (home?: string) => atHome(home, "jev.json");
 
+/** Owner-only inventory maintained by failproofaid. Paths stay on this machine. */
+export const agentRosterFile = (home?: string) => atHome(home, "agents", "roster.json");
+
 // ── Daemon binaries ──────────────────────────────────────────────────────────
 
 export const binDir = (home?: string) => atHome(home, "bin");
@@ -656,6 +659,9 @@ export const HOME_CLASSES: readonly { path: (home?: string) => string; class: Da
   // history the user was already told about. Kept OUT of `auditSessionFile`
   // precisely so both survive a sign-out.
   { path: auditMachineFile, class: "identity" },
+  // Profile IDs are stable across restarts and renames. A reset that deleted
+  // this file would make Cloud's exact-profile assignments match nobody.
+  { path: agentRosterFile, class: "identity" },
 
   // ── May be dropped: rebuilt on demand ──
   // NOTE: `auditDir` itself is deliberately absent. Layout 4 made it MIXED — it