failproofai 1.0.12-beta.0 → 1.0.12-beta.2

package/.next/standalone/fp-cloud-cli/fp_cli/client.py

@@ -23,7 +23,7 @@ import re
 import uuid
 from dataclasses import dataclass
 from enum import Enum
-from typing import Any, Callable, Dict, Iterator, List, Optional, Sequence, Union
+from typing import Any, Callable, Dict, Iterator, List, Optional, Sequence, Tuple, Union
 
 import httpx
 
@@ -487,9 +487,39 @@ def _raise_for_status(response: httpx.Response, ctx: ClientContext) -> None:
         message or f"Request failed with status {response.status_code}.",
         status=response.status_code,
         request_id=request_id,
+        hint=_jev_budget_breakdown(response),
     )
 
 
+def _jev_budget_breakdown(response: httpx.Response) -> Optional[str]:
+    """The per-policy breakdown of a deploy's ``jev_budget_exceeded`` refusal.
+
+    The message carries only the total (``used``/``budget``); the body also lists
+    every Jev policy version the machine would carry with its question
+    characters (``policies: [{id, version, chars}]``), which is what tells an
+    operator WHICH policy to leave off. Largest first. ``None`` for any other
+    error, and for a publish refusal, which names no other policies.
+    """
+    try:
+        data = response.json()
+    except Exception:
+        return None
+    if not isinstance(data, dict) or data.get("code") != "jev_budget_exceeded":
+        return None
+    rows = [
+        (str(p.get("id", "")), p.get("version"), p["chars"])
+        for p in data.get("policies") or []
+        if isinstance(p, dict) and isinstance(p.get("chars"), int)
+    ]
+    if not rows:
+        return None
+    rows.sort(key=lambda row: -row[2])
+    parts = [f"{pid}@{version} {chars:,}" if version is not None else f"{pid} {chars:,}"
+             for pid, version, chars in rows]
+    return ("Jev question characters per policy: " + " · ".join(parts)
+            + " — deploy fewer of these Jev policies to this machine")
+
+
 def _get_json(ctx: ClientContext, path: str, params: Optional[Dict[str, Any]] = None) -> Any:
     clean = {k: v for k, v in (params or {}).items() if v is not None}
     url = _path(ctx, path)  # chokepoint 1 of 4 for the /api -> /v1 rewrite
@@ -1643,22 +1673,43 @@ def list_policies(ctx: ClientContext) -> List[PolicyVersion]:
 
 
 def publish_policy(
-    ctx: ClientContext, policy_id: str, source: str, description: str = ""
+    ctx: ClientContext,
+    policy_id: str,
+    source: Optional[str],
+    description: str = "",
+    *,
+    kind: Optional[str] = None,
+    semantic: Optional[List[Any]] = None,
 ) -> PolicyVersion:
     """POST /api/enforcement/policies — mints a NEW VERSION; never edits in place.
 
-    Refuses Jev fields a cloud policy never reads before anything is sent, here
-    because `policies publish` and `policies compose --publish` both route through
-    it — and regardless of `--no-verify`, which only skips the syntax check.
+    ``kind`` is ``regex`` (JavaScript ``source`` only — what an omitted kind
+    means to the server), ``jev`` (Jev declarations in ``semantic``, no
+    ``source``) or ``both`` (the two together: the JavaScript is reviewable by
+    exactly its own checks). ``authority``/``reviewedBy`` are derived by the
+    server from the kind and are never sent.
+
+    Refuses Jev fields in the JAVASCRIPT before anything is sent, here because
+    `policies publish` and `policies compose --publish` both route through it —
+    and regardless of `--no-verify`, which only skips the syntax check. Jev
+    checks belong in ``semantic``, where they take effect.
     """
-    problem = cloud_publish_problem(source)
+    problem = cloud_publish_problem(source or "")
     if problem:
         raise ApiError(
             f"{policy_id} cannot be published as a cloud policy: {problem}",
-            hint=("Jev checks ship in a failproofai pack — `failproofai publish` — where "
-                  "semanticPolicies.add and authority: \"reviewable\" take effect"),
+            hint=("put Jev checks in the policy's Jev declarations — `--kind both --semantic "
+                  "checks.json` — or ship them in a failproofai pack with `failproofai publish`"),
         )
-    body = {"id": policy_id, "source": source, "description": description}
+    body: Dict[str, Any] = {"id": policy_id, "description": description}
+    # `source` is omitted for a Jev-only policy: the server takes absent (or
+    # empty) as "no JavaScript", which is what a `jev` version is.
+    if source:
+        body["source"] = source
+    if kind is not None:
+        body["kind"] = kind
+    if semantic is not None:
+        body["semantic"] = semantic
     return PolicyVersion.from_dict(_post_json(ctx, "/api/enforcement/policies", body) or {})
 
 
@@ -1681,6 +1732,29 @@ def list_machines(ctx: ClientContext) -> List[Machine]:
     return [Machine.from_dict(m) for m in items]
 
 
+def machine_agents(ctx: ClientContext, machine_id: str) -> List[Dict[str, Any]]:
+    """GET /api/enforcement/machines/{id}/agents — the agent profiles the daemon
+    last reported: `[{instanceId, integration, profileLabel, scope, ...}]`."""
+    data = _get_json(ctx, f"/api/enforcement/machines/{machine_id}/agents")
+    items = data if isinstance(data, list) else (data or {}).get("agents", [])
+    return [a for a in items if isinstance(a, dict)]
+
+
+def agent_labels(ctx: ClientContext, machine_id: str) -> Dict[str, str]:
+    """`{instanceId: profileLabel}` for one machine, or `{}` when unavailable.
+
+    Best effort on purpose: it only names the `agt_…` ids an exact-profile
+    assignment carries. A server without the roster route, or a machine that
+    never reported one, falls back to the bare id rather than failing the view.
+    """
+    try:
+        agents = machine_agents(ctx, machine_id)
+    except Exception:  # noqa: BLE001 — a missing label must never fail the read
+        return {}
+    return {str(a["instanceId"]): str(a["profileLabel"])
+            for a in agents if a.get("instanceId") and a.get("profileLabel")}
+
+
 def rename_machine(ctx: ClientContext, machine_id: str, label: str) -> Dict[str, Any]:
     """PATCH /api/enforcement/machines/{id} — a human label, not the id."""
     path = f"/api/enforcement/machines/{machine_id}"
@@ -1708,11 +1782,16 @@ def get_deployment(ctx: ClientContext, machine_id: str) -> Optional[Deployment]:
 
 
 def deploy_policies(
-    ctx: ClientContext, machine_id: str, policies: Sequence[PolicyRef]
+    ctx: ClientContext,
+    machine_id: str,
+    policies: Sequence[PolicyRef],
 ) -> Deployment:
-    """PUT /api/enforcement/deployments/{id} — REPLACES the machine's whole set."""
+    """PUT /api/enforcement/deployments/{id} — REPLACES the machine's whole set.
+
+    Never carries a Jev mode: FailproofAI Cloud derives it from the set.
+    """
     path = f"/api/enforcement/deployments/{machine_id}"
-    body = {"policies": [p.to_dict() for p in policies]}
+    body: Dict[str, Any] = {"policies": [p.to_dict() for p in policies]}
     return Deployment.from_dict(_request_json(ctx, "PUT", path, json_body=body) or {})
 
 

package/.next/standalone/fp-cloud-cli/fp_cli/commands/fleet_cmds.py

@@ -32,8 +32,10 @@ from ..enforcement import (
     disabled_ids,
     latest_versions,
     plan_deploy,
+    version_kinds,
 )
-from ..errors import ApiError, NotFoundError
+from ..errors import ApiError, AuthError, FpCliError, NotFoundError
+from ..models import PolicyRef
 from . import _write
 
 _KEY_MODE_REASON = (
@@ -62,6 +64,8 @@ def fleet_list(ctx: typer.Context) -> None:
     `intended` is the generation deployed, `applied` is the one the machine last
     collected, and `seen` is when it last reported anything — a machine can be
     in sync and dead, or alive and behind, and those are different problems.
+    `state` reads `N errors` when the machine reported policies it could not
+    apply (`fp fleet show <machine>` lists them).
 
     A machine appears from its very first check-in, including the poll that
     finds nothing deployed — that is exactly the machine you are usually looking
@@ -101,10 +105,22 @@ def fleet_show(
     machine can be told to run a policy and not yet have it; the policy list
     alone cannot tell you which, and that is usually the question.
 
+    Shows the Jev mode FailproofAI Cloud sets on the machine (`local` when it
+    sets none) and the policy errors the machine last reported: a policy it
+    could not load, a Jev mode it cannot act on (`jev_unconfigured`: its key
+    does not carry Jev; `transcripts_disabled`: it was connected with
+    `--no-transcripts`), FailproofAI Cloud Jev refusing or failing its calls
+    (`jev_rate_limited`: over the organization's Jev rate limit;
+    `jev_unavailable`: it skips a failing Cloud Jev for a minute at a time), an
+    installed pack's check left out for the question budget (`jev_budget`) or
+    because an organization Cloud check has its name (`jev_name_clash`).
+    Anything listed there is not enforcing, whatever the deployment says.
+
     Needs `policies:read`. With `--json`: `{machine, deployment}` — the machine
-    record (including `appliedDeployment`, `drifted`, `lastSeen` and both label
-    fields, with raw timestamps) and the deployment, or `deployment: null` when
-    nothing is deployed.
+    record (including `appliedDeployment`, `drifted`, `lastSeen`, both label
+    fields, `jevMode` and `policyErrors`/`policyErrorsAt` when reported, with raw
+    timestamps) and the deployment, or `deployment: null` when nothing is
+    deployed.
 
     Example:
 
@@ -129,7 +145,8 @@ def fleet_show(
             "deployment": dep.to_dict() if dep else None,
         })
         return
-    output.render_machine_policies(machine_id, dep, machine)
+    output.render_machine_policies(machine_id, dep, machine,
+                                   agent_labels=api.agent_labels(cctx, machine_id))
 
 
 def fleet_deploy(
@@ -137,13 +154,22 @@ def fleet_deploy(
     machine_id: str = typer.Argument(..., help="Machine id."),
     add: Optional[List[str]] = typer.Option(
         None, "--add",
-        help="Add or update a policy: `id`, `id@version`, `id:effect` or `id@version:effect`.",
+        help="Add or update a policy: `id`, `id@version`, `id:effect` or `id@version:effect`. "
+             "`observe` records what the policy (its JavaScript and its Jev checks) would decide, and decides nothing.",
     ),
     remove: Optional[List[str]] = typer.Option(None, "--remove", help="Remove a policy by id."),
     replace: Optional[List[str]] = typer.Option(
         None, "--set",
         help="REPLACE the whole set with exactly these. Cannot be combined with --add/--remove.",
     ),
+    targets: Optional[List[str]] = typer.Option(
+        None, "--target",
+        help="Scope one assigned policy: POLICY=INTEGRATION or POLICY=INTEGRATION/agt_ID. Repeat to OR selectors.",
+    ),
+    all_agents: Optional[List[str]] = typer.Option(
+        None, "--all-agents",
+        help="Clear one policy's targeting back to every agent on this machine.",
+    ),
     create: bool = typer.Option(
         False, "--create",
         help="Allow deploying to a machine id that has not checked in yet (pre-staging).",
@@ -159,6 +185,14 @@ def fleet_deploy(
 
     `--set` replaces everything — the only way to drop policies you do not name.
 
+    Any kind deploys the same way. Jev checks run on FailproofAI Cloud; nothing
+    is installed on the machine: a `both` policy sends the machine its
+    JavaScript, and the machine asks FailproofAI Cloud about each checked tool
+    call. An `observe` effect applies to every kind: the policy's JavaScript
+    and its Jev checks are evaluated and recorded, and decide nothing. There is
+    no Jev mode to set: FailproofAI Cloud turns Jev on for a machine while any
+    `jev` or `both` policy is deployed to it, and off when none is.
+
     **Concurrency.** The write is a full replace with no server-side lock, so the
     CLI records the generation it read and refuses if the result is not exactly
     one higher: that means somebody else deployed in between and a replace does
@@ -170,17 +204,18 @@ def fleet_deploy(
     * `fp fleet deploy ci-runner-01 --add no-force-push`
     * `fp fleet deploy ci-runner-01 --add prod-guard@1:observe --remove old-rule`
     * `fp fleet deploy ci-runner-01 --set no-force-push --set no-secret-echo`
+    * `fp fleet deploy ci-runner-01 --add prod-db-intent:observe`
     """
     state: AppState = ctx.obj
     deny_in_key_mode(state, "fleet deploy", _KEY_MODE_REASON)
     cctx = require_auth(state)
 
-    if not add and not remove and replace is None:
+    if not add and not remove and replace is None and not targets and not all_agents:
         # Exit 2 for the same reason `--set` with `--add` is: no flag
         # combination was given that this command can act on. Both are the
         # caller's command line, not the server's answer.
         raise click.UsageError(
-            "nothing to do — pass --add, --remove, or --set. "
+            "nothing to do — pass --add, --remove, --set, --target, or --all-agents. "
             "`fp fleet show <machine>` prints the current set."
         )
 
@@ -212,6 +247,9 @@ def fleet_deploy(
             replace=replace,
             latest=latest,
             disabled=disabled_ids(published),
+            kinds=version_kinds(published),
+            targets=targets or (),
+            all_agents=all_agents or (),
         )
     except RefUsageError as exc:
         # Exit 2, like every other bad flag value in this CLI (`--since`,
@@ -314,8 +352,11 @@ def fleet_history(
     """List a machine's deployment generations, newest first.
 
     A reissue — the server rewriting a deployment because a policy was disabled
-    — appears as an ordinary entry. Needs `policies:read`. With `--json`:
-    `{machineId, history:[{deployment, policies, updatedAt}]}`.
+    — appears as an ordinary entry, and so does a Jev mode change. Each
+    generation shows the Jev mode FailproofAI Cloud set with it (`local` when it
+    set none), which is the mode a rollback to it restores. Needs
+    `policies:read`. With `--json`: `{machineId, history:[{deployment, policies,
+    updatedAt, jevMode}]}`.
 
     Example:
 
@@ -329,7 +370,8 @@ def fleet_history(
     if output.is_json():
         output.emit_json({"machineId": machine_id, "history": entries})
         return
-    output.render_deployment_history(machine_id, entries)
+    output.render_deployment_history(machine_id, entries,
+                                     agent_labels=api.agent_labels(cctx, machine_id))
 
 
 def fleet_rollback(
@@ -344,8 +386,12 @@ def fleet_rollback(
     counter, so history stays append-only. A generation containing a policy that
     has since been disabled or deleted cannot be reinstated; the server says so.
 
-    Needs `policies:write`. With `--json`: the resulting deployment, or
-    `{"cancelled": true}` if you decline.
+    It restores that generation's Jev mode too, `local` included: the prompt
+    and the result say `jev mode <now> → <then>` when that changes it.
+
+    Needs `policies:write`. With `--json`: the resulting deployment plus
+    `jevModeBefore` (the mode it replaced), or `{"cancelled": true}` if you
+    decline.
 
     Example:
 
@@ -356,9 +402,22 @@ def fleet_rollback(
     cctx = require_auth(state)
     _require_machine(cctx, machine_id)
     current = api.get_deployment(cctx, machine_id)
+    # The mode that generation carried comes back with it, NULL (`local`)
+    # included, as the server reports it.
+    # Read it first, so the prompt says so rather than the fleet finding out.
+    target = next(
+        (e for e in api.deployment_history(cctx, machine_id) if e.get("deployment") == deployment), None)
+    mode_before = (current.jev_mode if current else None) or "local"
+    mode_target = (target.get("jevMode") or "local") if target is not None else None
+    consequence = "this REPLACES the machine's current set with the one from that generation"
+    if target is not None:
+        refs = [PolicyRef.from_dict(ref).label for ref in (target.get("policies") or [])]
+        consequence += "; assignments: " + ("; ".join(refs) if refs else "no policies")
+    if mode_target is not None and mode_target != mode_before:
+        consequence += f", and its Jev mode: jev mode {mode_before} → {mode_target}"
     if not _write.confirm_destructive(
         state, f"reinstate deployment #{deployment} on", machine_id,
-        consequence="this REPLACES the machine's current set with the one from that generation",
+        consequence=consequence,
         assume_yes=yes,
     ):
         if output.is_json():
@@ -369,9 +428,12 @@ def fleet_rollback(
     result = api.rollback_deployment(cctx, machine_id, deployment)
     check_race(current.deployment if current else None, result.deployment)
     if output.is_json():
-        output.emit_json(result.to_dict())
+        output.emit_json({**result.to_dict(), "jevModeBefore": mode_before})
         return
-    output.deployment_rolled_back(machine_id, deployment, result.deployment)
+    output.deployment_rolled_back(
+        machine_id, deployment, result.deployment,
+        jev_from=mode_before, jev_to=result.jev_mode or "local",
+    )
 
 
 def fleet_rename(

package/.next/standalone/fp-cloud-cli/fp_cli/commands/policies_cmds.py

@@ -10,6 +10,7 @@ single most surprising thing here, so every success path says so.
 """
 from __future__ import annotations
 
+import json
 from typing import Optional
 
 import typer
@@ -18,8 +19,8 @@ from .. import client as api
 from .. import output, theme
 from .._context import GLOBALS_EPILOG, AppState, deny_in_key_mode, require_auth
 from .. import _click_compat as click  # the Click Typer is running; see _click_compat
-from ..enforcement import RefError, RefUsageError, read_source
-from ..policy_check import check_syntax, run_policy
+from ..enforcement import RefError, RefUsageError, parse_semantic, read_source, resolve_kind
+from ..policy_check import SyntaxResult, check_syntax, run_policy
 from ..errors import ApiError, NotFoundError
 from . import _write
 
@@ -36,11 +37,15 @@ _KEY_MODE_REASON = (
 def policies_list(ctx: typer.Context) -> None:
     """List every published policy version, newest of each policy first.
 
-    Shows `policy · version · state · description`, one row per VERSION —
+    Shows `policy · version · kind · state · description`, one row per VERSION —
     versions are immutable and every one stays addressable, so a policy
     published three times is three rows. The title counts distinct policies and
     captions the version total, the way the dashboard's library does.
 
+    `kind` is `regex` (JavaScript), `jev` (Jev checks only) or `both`
+    (JavaScript its own Jev checks may clear); a `jev`/`both` row names its
+    checks and the characters they take of a machine's Jev question budget.
+
     `state` is active, disabled (kept but not enforced) or archived (deleted;
     machines already carrying it keep it until redeployed). Needs
     `policies:read`. With `--json`: the server's policy list verbatim — also
@@ -64,9 +69,11 @@ def policies_show(
     ctx: typer.Context,
     policy_id: str = typer.Argument(..., help="Policy id."),
 ) -> None:
-    """Show one policy, including its full source.
+    """Show one policy, including its full source and its Jev checks.
 
-    Needs `policies:read`. With `--json`: the policy object with `source`.
+    Needs `policies:read`. With `--json`: the policy object with `source`,
+    `kind`, and for `jev`/`both` its `semantic` declarations, `semanticSha256`
+    and the server-derived `authority`/`reviewedBy`.
 
     Example:
 
@@ -96,6 +103,8 @@ def policies_show(
                                    source_bytes=len((match.source or "").encode("utf-8")))
     if match.source:
         output.info(match.source)
+    if match.semantic:
+        output.info(json.dumps(match.semantic, indent=2))
 
 
 def policies_publish(
@@ -103,7 +112,19 @@ def policies_publish(
     policy_id: str = typer.Argument(..., help="Policy id (letters, numbers, '.', '_', '-')."),
     source: Optional[str] = typer.Argument(
         None,
-        help="Path to the policy source, @path, or - for stdin. Omit to paste it.",
+        help="Path to the JavaScript source, @path, or - for stdin. Omit to paste it. Same as --source.",
+    ),
+    kind: Optional[str] = typer.Option(
+        None, "--kind",
+        help="regex (JavaScript), jev (Jev checks only) or both (JavaScript its own Jev checks may "
+             "clear). Default: follows from what you give — --semantic alone is jev, with source both.",
+    ),
+    source_opt: Optional[str] = typer.Option(
+        None, "--source", help="The JavaScript source: a path, @path, or - for stdin.",
+    ),
+    semantic_path: Optional[str] = typer.Option(
+        None, "--semantic",
+        help="A JSON file holding the Jev declarations (a JSON array): a path, @path, or - for stdin.",
     ),
     description: str = typer.Option("", "--description", help="One-line description."),
     no_verify: bool = typer.Option(
@@ -112,13 +133,29 @@ def policies_publish(
 ) -> None:
     """Publish a policy — mints a NEW VERSION; it never edits one in place.
 
-    The source is parse-checked with node before it is sent. Nothing downstream
-    does this: the server validates the id and a size ceiling, and a broken
-    policy otherwise fails on the machine at enforcement time. `--no-verify`
-    skips it; a host without node publishes with a warning rather than a block.
-    Jev fields a cloud policy never reads (`semanticPolicies.add`, `authority:
-    "reviewable"`) are refused regardless — ship those in a pack with
-    `failproofai publish`.
+    A policy has a **kind**:
+
+    * `regex` — JavaScript (`--source`, or the positional source): what publish
+      has always done, and the default.
+    * `jev` — Jev checks only (`--semantic checks.json`): a JSON array of Jev
+      declarations, each `{name, title, appliesTo, mode, userCanOverride,
+      probes:[{id, instructions, criteria:{true,false}}], guidance, ...}` —
+      exactly a failproofai pack manifest's semantic entry. No JavaScript.
+    * `both` — the two together. FailproofAI Cloud makes the JavaScript's
+      verdict reviewable by exactly its own checks, and deploys them as one.
+
+    Jev checks run on FailproofAI Cloud; nothing is installed on the machine.
+    A machine gets a `both` policy's JavaScript, and asks FailproofAI Cloud
+    about each checked tool call while its Jev mode is `observe` or `enforce`.
+
+    The JavaScript is parse-checked with node before it is sent. Nothing
+    downstream does this: the server validates the id and a size ceiling, and a
+    broken policy otherwise fails on the machine at enforcement time.
+    `--no-verify` skips it; a host without node publishes with a warning rather
+    than a block. Jev fields in the JavaScript (`semanticPolicies.add`,
+    `authority: "reviewable"`) are refused regardless — put Jev checks in
+    `--semantic`. The server checks each declaration (limits, reserved
+    FailproofAI names, names unique in the org) and says which one it refused.
 
     Source can come from a path, `@path`, a pipe, `-`, or an interactive paste
     when you give none and stdin is a terminal.
@@ -134,21 +171,42 @@ def policies_publish(
     * `fp policies publish no-force-push ./rule.mjs`
     * `cat rule.mjs | fp policies publish no-force-push`
     * `fp policies publish no-force-push -` — read stdin explicitly
+    * `fp policies publish prod-db-intent --kind jev --semantic ./checks.json`
+    * `fp policies publish no-prod-db --kind both --source ./rule.mjs --semantic ./checks.json`
     """
     state: AppState = ctx.obj
     deny_in_key_mode(state, "policies publish", _KEY_MODE_REASON)
     cctx = require_auth(state)
 
+    if source is not None and source_opt is not None:
+        raise click.UsageError("give the JavaScript source once — positionally or with --source, not both")
+    source = source if source is not None else source_opt
+    if source == "-" and semantic_path == "-":
+        raise click.UsageError("only one of the JavaScript source and --semantic can come from stdin")
+
+    # Whether JavaScript is coming is decided WITHOUT reading stdin: a Jev-only
+    # publish must not sit waiting for a paste nobody is going to give.
+    wants_source = source is not None or kind in ("regex", "both") or (kind is None and semantic_path is None)
+    try:
+        resolved_kind = resolve_kind(kind, has_source=wants_source, has_semantic=semantic_path is not None)
+    except RefUsageError as exc:
+        raise click.UsageError(str(exc))
+
     def _paste_prompt() -> None:
         output.hint("paste the policy source, then press Ctrl-D")
 
+    text: Optional[str] = None
+    semantic = None
     try:
-        text = read_source(source, prompt=_paste_prompt)
+        if semantic_path is not None:
+            semantic = parse_semantic(read_source(semantic_path, isatty=False))
+        if wants_source:
+            text = read_source(source, prompt=_paste_prompt)
     except RefUsageError as exc:
         raise click.UsageError(str(exc))
     except RefError as exc:
         raise ApiError(str(exc))
-    if not text.strip():
+    if wants_source and not (text or "").strip():
         raise ApiError("policy source is empty — nothing to publish")
 
     # Nothing downstream parses this. The server checks the id and a size
@@ -156,7 +214,9 @@ def policies_publish(
     # place for a syntax error to surface. `--no-verify` exists because a
     # machine without node should still be able to publish, not because
     # skipping is ever a good idea.
-    if not no_verify:
+    syn = SyntaxResult(ok=True, checked=False,
+                       message="not checked" if text else "no JavaScript source")
+    if text and not no_verify:
         syn = check_syntax(text)
         if not syn.ok:
             raise ApiError(
@@ -167,7 +227,13 @@ def policies_publish(
         if not syn.checked and not output.is_json():
             output.warn(syn.message)
 
-    created = api.publish_policy(cctx, policy_id, text, description)
+    created = api.publish_policy(
+        cctx, policy_id, text, description,
+        # Sent only when it says something the server's default does not, so a
+        # plain JavaScript publish is the same request it has always been.
+        kind=None if resolved_kind == "regex" and kind is None else resolved_kind,
+        semantic=semantic,
+    )
 
     # Which machines already carry this policy, and at which version. Publishing
     # deploys nothing, so this is the one thing the card must not guess at: it
@@ -191,7 +257,7 @@ def policies_publish(
         output.emit_json({**created.to_dict(), "carriers": carriers, "syntax": syn.to_dict()})
         return
     output.render_policy_published(created, carriers=carriers,
-                                   source_bytes=len(text.encode("utf-8")))
+                                   source_bytes=len((text or "").encode("utf-8")))
 
 
 def policies_enable(