failproofai 1.0.12-beta.0 → 1.0.12-beta.2

package/src/hooks/jev-activity.ts

@@ -41,7 +41,7 @@ import type { HookActivityEntry } from "./hook-activity-store";
 
 export type JevActivityFields = Pick<
   HookActivityEntry,
-  "evaluator" | "jevDecision" | "jevCleared" | "jevFallbackReason" | "jevLatencyMs" | "jevModel" | "jevMode"
+  "evaluator" | "jevDecision" | "jevCleared" | "jevFallbackReason" | "jevLatencyMs" | "jevModel" | "jevMode" | "jevChecks"
 >;
 
 /** Every Jev key on an activity row, in the order they are documented. */
@@ -53,6 +53,7 @@ export const JEV_ACTIVITY_KEYS = [
   "jevLatencyMs",
   "jevModel",
   "jevMode",
+  "jevChecks",
 ] as const satisfies ReadonlyArray<keyof JevActivityFields>;
 
 const EVALUATORS = new Set(["jev", "jev-fallback"]);
@@ -219,6 +220,113 @@ export function normalizeJevFallbackReason(raw: unknown): string | undefined {
   return JEV_REASON_CODES.has(code) ? code : JEV_REASON_OTHER;
 }
 
+// ── Per-check answers ────────────────────────────────────────────────────────
+
+/** What one asked Jev check concluded. */
+export const JEV_CHECK_VERDICTS = ["none", "deny", "instruct", "overridden"] as const;
+
+/**
+ * Why a check ended where it did, as a closed code (read off its outcome,
+ * never text from the call):
+ * - `not-detected`: its probes did not hold (evidence under the fire threshold);
+ * - `exempt`: it fired, and its `exempt` question held;
+ * - `fired`: it fired and nothing softened it;
+ * - `injection`: it fired and the request also argued for its own approval;
+ * - `user-asked` (v0), `op-requested`, `task-step` (v1): the human's consent cleared it;
+ * - `downgraded`: a deny the human's task softened to a warning;
+ * - `scan-incomplete`: a clear withheld because the command scan may have missed a target.
+ */
+export const JEV_CHECK_WHY = [
+  "not-detected",
+  "exempt",
+  "fired",
+  "injection",
+  "user-asked",
+  "op-requested",
+  "task-step",
+  "downgraded",
+  "scan-incomplete",
+] as const;
+
+/**
+ * One Jev check that was asked on this call, and its answer: names, closed
+ * codes and probabilities only — never question text, the command or the
+ * human's words. Jev answers yes/no probabilities, not reasons, so `why` is
+ * the decider's own reading of them.
+ */
+export interface JevCheckRecord {
+  /** The check's name (`semantic/<check>` without the prefix). */
+  check: string;
+  /** Who declared it: `cloud/<policyId>@<version>` or `pack/<packId>@<version>`. Absent for a caller-supplied set. */
+  policy?: string;
+  verdict: (typeof JEV_CHECK_VERDICTS)[number];
+  why: (typeof JEV_CHECK_WHY)[number];
+  /** Evidence: the minimum over its probes, 2 decimals. */
+  p: number;
+  /** Its `exempt` answer, when it declares one. */
+  exempt?: number;
+  /** Each probe's answer by probe id, when the answers came back. */
+  probes?: Record<string, number>;
+  /** A check of a watched (observe) Cloud policy: recorded, never enforced. */
+  watched?: true;
+}
+
+export const JEV_CHECKS_MAX = 32;
+export const JEV_CHECK_PROBES_MAX = 8;
+/** A check name: a slug, `.` allowed (a Cloud check name may carry one). */
+export const JEV_CHECK_NAME_RE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
+/** A probe id, as declarations allow it. */
+export const JEV_PROBE_ID_RE = /^[a-z][a-z0-9_]{0,31}$/;
+const CHECK_VERDICT_SET: ReadonlySet<string> = new Set(JEV_CHECK_VERDICTS);
+const CHECK_WHY_SET: ReadonlySet<string> = new Set(JEV_CHECK_WHY);
+
+const isP = (v: unknown): v is number => typeof v === "number" && Number.isFinite(v) && v >= 0 && v <= 1;
+/** A probability at 2 decimals — what the reason strings print. */
+export const round2 = (v: number): number => Math.round(v * 100) / 100;
+
+/** One record, rebuilt field by field, or null when it is not one. */
+function sanitizeCheck(raw: unknown): JevCheckRecord | null {
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return null;
+  const r = raw as Record<string, unknown>;
+  if (typeof r.check !== "string" || !JEV_CHECK_NAME_RE.test(r.check)) return null;
+  if (typeof r.verdict !== "string" || !CHECK_VERDICT_SET.has(r.verdict)) return null;
+  if (typeof r.why !== "string" || !CHECK_WHY_SET.has(r.why)) return null;
+  if (!isP(r.p)) return null;
+  const out: JevCheckRecord = {
+    check: r.check,
+    verdict: r.verdict as JevCheckRecord["verdict"],
+    why: r.why as JevCheckRecord["why"],
+    p: round2(r.p),
+  };
+  if (typeof r.policy === "string" && isJevPolicyName(r.policy) && !/\s/.test(r.policy) && /^(?:cloud|pack)\//.test(r.policy)) {
+    out.policy = r.policy;
+  }
+  if (isP(r.exempt)) out.exempt = round2(r.exempt);
+  if (r.watched === true) out.watched = true;
+  if (r.probes && typeof r.probes === "object" && !Array.isArray(r.probes)) {
+    const probes: Record<string, number> = {};
+    for (const [id, v] of Object.entries(r.probes as Record<string, unknown>)) {
+      if (Object.keys(probes).length >= JEV_CHECK_PROBES_MAX) break;
+      if (JEV_PROBE_ID_RE.test(id) && isP(v)) probes[id] = round2(v);
+    }
+    if (Object.keys(probes).length > 0) out.probes = probes;
+  }
+  return out;
+}
+
+/** A row's `jevChecks`, valid records only (at most {@link JEV_CHECKS_MAX}), or undefined when it is not a list. */
+export function sanitizeJevChecks(raw: unknown): JevCheckRecord[] | undefined {
+  if (!Array.isArray(raw)) return undefined;
+  const out: JevCheckRecord[] = [];
+  for (const item of raw) {
+    if (out.length >= JEV_CHECKS_MAX) break;
+    const rec = sanitizeCheck(item);
+    if (rec) out.push(rec);
+  }
+  // Every entry invalid: not "nothing asked" — the list is unreadable, so it goes.
+  return raw.length > 0 && out.length === 0 ? undefined : out;
+}
+
 /**
  * The Jev fields of `entry`, each one valid or absent. Non-Jev keys pass
  * through untouched, and an entry with no Jev keys comes back as the same
@@ -265,6 +373,11 @@ export function sanitizeJevActivity<T extends JevActivityFields>(entry: T): T {
   if (typeof out.jevModel === "string" && JEV_MODEL_RE.test(out.jevModel.trim())) out.jevModel = out.jevModel.trim();
   else drop("jevModel");
 
+  // Only on an answered call: a fallback or an unconsulted call asked nothing.
+  const checks = out.evaluator === "jev" ? sanitizeJevChecks(out.jevChecks) : undefined;
+  if (checks === undefined) drop("jevChecks");
+  else out.jevChecks = checks;
+
   return out;
 }
 
@@ -307,6 +420,9 @@ export function jevOutcome(raw: JevActivityFields): JevOutcome | null {
 function outcomeOf(e: JevActivityFields): JevOutcome | null {
   if (e.evaluator === "jev-fallback") return "fallback";
   if (e.evaluator !== "jev") return null;
+  // A request that carried no check (only the global intent questions, or a
+  // FailproofAI Cloud short-circuit) decided nothing: Jev had nothing to ask.
+  if (Array.isArray(e.jevChecks) && e.jevChecks.length === 0) return "no-request";
   if (e.jevCleared !== undefined || e.jevLatencyMs !== undefined || e.jevModel !== undefined) return "answered";
   if (e.jevDecision === "deny" || e.jevDecision === "instruct") return "answered";
   if (e.jevDecision === "allow") return "no-request";

package/src/hooks/jev-cli.ts

@@ -108,6 +108,8 @@ import {
   inspectJevConfig,
   jevCloudBaseUrl,
   jevConfigPath,
+  loadJevConfigForCloudMode,
+  TRANSCRIPTS_DISABLED_PROBLEM,
   providerForUrl,
   providerHostConflict,
   readJevConfigFileForUpdate,
@@ -144,7 +146,8 @@ import {
   type ReviewableCoverage,
 } from "./policy-reviewability";
 import { jevStats, type JevStats } from "./semantic/jev-stats";
-import { readCredentials, readJevCloudCredential, type JevCloudCredential } from "./fp-config";
+import { listActiveCloudManagedPolicies, readCloudJevState, type CloudJevState } from "./cloud-managed-policies";
+import { CLOUD_MANAGED_JEV_MODE, cloudManagesJevMode, readCredentials, readJevCloudCredential, type JevCloudCredential } from "./fp-config";
 import type { JevRequest } from "./semantic/types";
 import { TOKEN_ON_ARGV, optsFor, paint, screenKit, stack, wrap, type RenderOpts } from "./tui";
 
@@ -364,6 +367,9 @@ function cloudConnection(): { cloudConnected: boolean; keyCarriesJev: boolean }
   }
 }
 
+/** What `jev setup --mode` says on a machine whose Jev mode FailproofAI Cloud sets. */
+const CLOUD_MANAGED_MODE_LINES = [CLOUD_MANAGED_JEV_MODE, "Deploy or remove Jev policies in FailproofAI Cloud to change it. Nothing was written."];
+
 /** The one line `status` titles a connected machine whose key has no Jev with. */
 const KEY_LACKS_JEV_TITLE = "off — no Jev key is stored for this machine's FailproofAI Cloud connection";
 
@@ -686,6 +692,9 @@ async function setupRun(argv: string[], deps: JevCliDeps, opts: RenderOpts): Pro
   if (typeof parsed === "string") return fail([parsed, "", ...JEV_USAGE]);
   if (parsed.positionals.length > 0) return fail([STRAY_ARGUMENT, "", ...JEV_USAGE]);
   const { values, bools } = parsed;
+  // A machine connected for policies has its Jev mode set by FailproofAI Cloud
+  // alone: enforce while a Jev policy is deployed to it, off when none is.
+  if (values.has("--mode") && cloudManagesJevMode()) return fail(CLOUD_MANAGED_MODE_LINES);
   if (bools.has("--key-stdin") && bools.has("--key-from-env")) return fail(["Use one of --key-stdin and --key-from-env, not both."]);
   // One source for the key, so no run has to decide which of two the person
   // meant. The message names the recommended one first.
@@ -1418,7 +1427,193 @@ function safeCoverage(): ReviewableCoverage | null {
   }
 }
 
+// ── status: FailproofAI Cloud ────────────────────────────────────────────────
+//
+// FailproofAI Cloud can SET this machine's Jev mode (`active.json` `jevMode`).
+// With `observe`/`enforce` the Jev checks Cloud deployed here run ON Cloud —
+// nothing of them is on this machine (CONTRACT C10) — every gated tool call
+// goes there on the Cloud Jev credential, and `jev.json` is not used. With
+// `off`, Jev is off whatever `jev.json` says. So `status` answers from Cloud
+// first; without a Cloud mode the local answer stands.
+//
+// What it can show about Cloud's checks is only what the machine knows: the
+// mode, and the `reviewedBy` names of the deployment's `both` policies — the
+// Cloud checks that may clear their regex half. Never a check's contents: the
+// machine does not have them.
+
+/** Label for everything Cloud decided here. Customer-facing: never "AgentEye". */
+const MODE_SET_BY_CLOUD = "mode set by FailproofAI Cloud";
+
+/** The one sentence the contract fixes for `jev status` under a Cloud mode (C10.5). */
+export function jevRunsOnCloudLine(mode: string): string {
+  return `Jev checks run on FailproofAI Cloud (mode: ${mode})`;
+}
+
+function safeCloudJev(): CloudJevState {
+  try {
+    return readCloudJevState();
+  } catch {
+    return { jevMode: null, deployment: null, errors: [] };
+  }
+}
+
+/** A `both` policy's Cloud reviewers, as the deployment names them. */
+interface CloudReviewers {
+  policy: string;
+  version: number;
+  effect: "enforce" | "observe";
+  reviewedBy: string[];
+}
+
+/** Every Cloud JS policy that names Cloud checks in `reviewedBy` — a `both` policy. Never throws. */
+function cloudReviewers(): CloudReviewers[] {
+  try {
+    // Every assignment, agent-scoped ones included: this describes the machine.
+    return listActiveCloudManagedPolicies()
+      .filter((p) => p.authority === "reviewable" && (p.reviewedBy?.length ?? 0) > 0)
+      .map((p) => ({ policy: p.id, version: p.version, effect: p.effect, reviewedBy: [...(p.reviewedBy ?? [])] }));
+  } catch {
+    return [];
+  }
+}
+
+/** What to do about a Cloud mode this machine cannot act on. */
+function cloudProblemAdvice(problem: string): string[] {
+  if (problem === TRANSCRIPTS_DISABLED_PROBLEM) {
+    return [
+      "Jev does not run here: this machine was connected for decisions only (--no-transcripts), and a Jev call sends each checked tool call and the recent prompt to FailproofAI Cloud.",
+      "To use FailproofAI Cloud's Jev checks, reconnect without --no-transcripts (failproofai config --token <key>).",
+    ];
+  }
+  return [
+    `Jev cannot run here: ${problem}.`,
+    "Connect with a key that carries jev:evaluate (failproofai config --token <key>). A local jev.json is not used while FailproofAI Cloud sets the mode.",
+  ];
+}
+
 async function status(argv: string[], opts: RenderOpts): Promise<JevCliResult> {
+  const cloud = safeCloudJev();
+  if (cloud.jevMode === null && cloud.errors.length === 0) return localStatus(argv, opts);
+  const parsed = parseFlags(argv, new Set(["--json"]));
+  if (typeof parsed === "string" || parsed.positionals.length > 0) return localStatus(argv, opts);
+  const asJson = parsed.bools.has("--json");
+
+  if (cloud.jevMode === null) {
+    // A mode this build cannot read is no mode: jev.json decides. Said beside it.
+    const local = await localStatus(argv, opts);
+    if (asJson && local.json !== undefined) {
+      const body = JSON.parse(local.json) as Record<string, unknown>;
+      body.cloud = { jevMode: null, modeSetBy: null, errors: cloud.errors };
+      return { ...local, json: JSON.stringify(body, null, 2) };
+    }
+    return { ...local, lines: [...local.lines, ...jevWarn(cloud.errors.map((e) => `${e.id}: ${e.message}`), opts)] };
+  }
+
+  const mode = cloud.jevMode;
+  const resolved = loadJevConfigForCloudMode(mode);
+  const reviewers = cloudReviewers();
+  let stats: JevStats | null = null;
+  try {
+    stats = await jevStats();
+  } catch {
+    stats = null;
+  }
+  const cfg = resolved.config;
+  const coverage = cfg ? safeCoverage() : null;
+  const route = cfg ? jevRoute(cfg) : null;
+  const running = cfg !== null;
+
+  if (asJson) {
+    const body: Record<string, unknown> = {
+      path: jevConfigPath(),
+      status: running ? "ok" : mode === "off" ? "off" : "unconfigured",
+      mode,
+      modeSetBy: "FailproofAI Cloud",
+      ...(mode !== "off" ? { runsOn: "FailproofAI Cloud" } : {}),
+      ...(cfg && route
+        ? {
+            provider: cfg.provider,
+            providerLabel: providerLabel(cfg.provider),
+            endpoint: shownEndpoint(cfg.provider, route.endpoint),
+            model: route.model,
+            modelIsDefault: route.modelIsDefault,
+            timeoutMs: cfg.timeoutMs,
+          }
+        : {}),
+      ...(resolved.problem ? { problem: resolved.problem } : {}),
+      cloud: { jevMode: mode, modeSetBy: "FailproofAI Cloud", reviewers, errors: cloud.errors },
+      ...(coverage
+        ? {
+            reviewablePolicies: {
+              enabled: coverage.enabled,
+              reviewable: coverage.reviewable,
+              customPolicyFiles: coverage.customFiles,
+              // The checks THIS machine's packs give; Cloud's are asked on Cloud.
+              jevChecks: coverage.jevChecks,
+              // "No checks installed" is not a problem here: FailproofAI Cloud's
+              // checks are asked whatever this machine has installed.
+              problem: coverage.jevChecks === 0 ? null : reviewableProblem(coverage),
+            },
+          }
+        : {}),
+      stats,
+    };
+    return ok([], JSON.stringify(body, null, 2));
+  }
+
+  const head =
+    mode === "off"
+      ? jevHeader("Jev status", `off — ${MODE_SET_BY_CLOUD}`, opts)
+      : running
+        ? jevHeader("Jev status", `on · ${mode} — ${jevRunsOnCloudLine(mode)}`, opts)
+        : jevHeader("Jev status", `off — FailproofAI Cloud set ${mode}, and this machine cannot run it`, opts);
+  const reviewerRows = reviewers.map((r): [string, string] => [
+    `${r.policy} v${r.version}`,
+    `${r.reviewedBy.join(", ")}${r.effect === "observe" ? " (not asked while observed)" : ""}`,
+  ]);
+  return ok(
+    stack(
+      head,
+      mode === "off"
+        ? jevNote(
+            `FailproofAI Cloud switched Jev off on this machine. That overrides ${jevConfigPath()} for as long as this machine is connected.`,
+            opts,
+          )
+        : jevNote(
+            `${jevRunsOnCloudLine(mode)}. Every checked tool call goes to FailproofAI Cloud, which asks the Jev checks it ` +
+              "deployed to this machine and this machine's installed packs' checks in one request; nothing of Cloud's checks is " +
+              `installed here. ${jevConfigPath()} is not used while FailproofAI Cloud sets the mode. In enforce, Jev's own deny ` +
+              "checks block calls as well as clearing the regex policies they review. Jev-only Cloud policies are not on this machine, so they are " +
+              "not listed here; fp fleet show and the dashboard list them.",
+            opts,
+          ),
+      cfg && route
+        ? jevRows(
+            [
+              ["runs on", "FailproofAI Cloud"],
+              ["endpoint", shownEndpoint(cfg.provider, route.endpoint)],
+              ["model", route.modelIsDefault ? `${route.model} (provider default)` : route.model],
+              ["mode", `${modeLine(mode)} (${MODE_SET_BY_CLOUD})`],
+              ["timeout", `${cfg.timeoutMs} ms`],
+            ],
+            opts,
+          )
+        : jevRows([["mode", mode === "off" ? `${modeLine("off")} (${MODE_SET_BY_CLOUD})` : `${mode} (${MODE_SET_BY_CLOUD}) — not running`]], opts),
+      resolved.problem ? jevWarn(cloudProblemAdvice(resolved.problem), opts) : null,
+      reviewerRows.length > 0
+        ? stack(
+            [screenKit(opts).head("Cloud reviewers", "FailproofAI Cloud policies reviewed by their Cloud Jev checks")],
+            jevRows(reviewerRows, opts),
+          )
+        : [],
+      cloud.errors.length > 0 ? jevWarn(cloud.errors.map((e) => `${e.id}: ${e.message}`), opts) : null,
+      coverage ? jevNote(reviewableSummary(coverage), opts) : null,
+      jevStatsLines(stats, opts),
+    ),
+  );
+}
+
+async function localStatus(argv: string[], opts: RenderOpts): Promise<JevCliResult> {
   const parsed = parseFlags(argv, new Set(["--json"]));
   if (typeof parsed === "string") return fail([parsed, "", ...JEV_USAGE]);
   if (parsed.positionals.length > 0) return fail([STRAY_ARGUMENT, "", ...JEV_USAGE]);

package/src/hooks/jev-cloud-connection.ts

@@ -86,8 +86,100 @@ export type CloudJevConfigWrite =
       /** Set when the kept file leaves Jev off here: refused, or switched off. */
       jevOff?: { why: "refused"; problem: string; fix?: string } | { why: "off" };
     }
+  /**
+   * The Cloud's own `jev.json` (provider `failproofai`, as `config` writes it)
+   * named another FailproofAI Cloud origin, and was pointed at this one: same
+   * mode, same everything else. A BYOK file is never touched.
+   */
+  | { status: "repointed"; path: string; from: string; baseUrl: string; mode: string }
   | { status: "error"; path: string; problem: string };
 
+/**
+ * Create `jev.json` for the Cloud provider unless one exists. Never throws and
+ * never replaces a file — except the Cloud's own file pointing at another
+ * FailproofAI Cloud origin, which is re-pointed here (`repointCloudJevConfig`):
+ * a reconnect on a new URL (http → https) otherwise left Jev off, refused for
+ * naming an origin the key was not issued for.
+ */
+export function writeCloudJevConfig(cloudBase: string): CloudJevConfigWrite {
+  const first = writeCloudJevConfigIfAbsent(cloudBase);
+  if (first.status === "kept" && first.provider === JEV_CLOUD_PROVIDER && first.otherOrigin) {
+    return repointCloudJevConfig(cloudBase, first);
+  }
+  return first;
+}
+
+/**
+ * Point the Cloud's `jev.json` at `cloudBase`, keeping every other field. The
+ * file is moved aside first and judged there (as `removeCloudJevConfig` does),
+ * so a BYOK file renamed into place meanwhile is never the one rewritten, and
+ * the new file is linked in no-clobber.
+ */
+function repointCloudJevConfig(cloudBase: string, found: Extract<CloudJevConfigWrite, { status: "kept" }>): CloudJevConfigWrite {
+  const path = jevConfigPath();
+  let baseUrl: string;
+  try {
+    baseUrl = jevCloudBaseUrl(cloudBase);
+  } catch {
+    return found;
+  }
+  let st: Stats;
+  try {
+    st = lstatSync(path);
+  } catch {
+    return found;
+  }
+  if (!st.isFile()) return found;
+  const aside = `${path}.${process.pid}.${randomBytes(6).toString("hex")}.repointing`;
+  try {
+    renameSync(path, aside);
+  } catch {
+    return found;
+  }
+  let raw: Record<string, unknown> | null = null;
+  try {
+    const parsed: unknown = JSON.parse(readFileSync(aside, "utf8"));
+    if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) raw = parsed as Record<string, unknown>;
+  } catch {
+    raw = null;
+  }
+  if (!raw || raw.provider !== JEV_CLOUD_PROVIDER) {
+    // Not the Cloud's after all: back exactly as it was.
+    putBack(aside, path, st.mode & 0o777);
+    return found;
+  }
+  const body = `${JSON.stringify({ ...raw, baseUrl }, null, 2)}\n`;
+  const tmp = `${path}.${process.pid}.${randomBytes(6).toString("hex")}.tmp`;
+  try {
+    writeFileSync(tmp, body, { mode: 0o600, flag: "wx" });
+    chmodSync(tmp, 0o600);
+    linkSync(tmp, path);
+  } catch {
+    // Something landed at the path meanwhile, or the write failed: the old
+    // file goes back (never over the new one) and nothing was re-pointed.
+    putBack(aside, path, st.mode & 0o777);
+    return found;
+  } finally {
+    try {
+      rmSync(tmp, { force: true });
+    } catch {
+      // A stray temp file holds no key.
+    }
+  }
+  try {
+    unlinkSync(aside);
+  } catch {
+    // The aside copy is the old URL only; harmless if it lingers.
+  }
+  return {
+    status: "repointed",
+    path,
+    from: found.otherOrigin ?? "",
+    baseUrl,
+    mode: typeof raw.mode === "string" ? raw.mode : DEFAULT_JEV_MODE,
+  };
+}
+
 /**
  * Create `jev.json` for the Cloud provider unless one exists. Never throws and
  * never replaces a file.