failproofai 1.0.12-beta.1 → 1.0.12-beta.2

package/.next/standalone/app/actions/update-jev-config.ts

@@ -10,7 +10,7 @@
  * `writeJsonAtomically` the CLI's `jev setup` calls, with the same
  * `{ mode: 0o600, dirMode: 0o700 }`, after the same `validateJevConfig` the
  * loader itself runs. Nothing here re-states a rule that lives in
- * `jev-config.ts`: not the URL scheme, not "plain http only in observe mode",
+ * `jev-config.ts`: not the URL scheme, not "plain http to loopback only",
  * not "cloudflare needs an account id". A second copy of those rules is how the
  * dashboard ends up writing a file the hooks then refuse — the exact failure
  * mode this module exists to avoid.
@@ -101,6 +101,7 @@ import { chmodSync, existsSync, statSync, unlinkSync } from "node:fs";
 import { dirname } from "node:path";
 import { headers } from "next/headers";
 import { writeJsonAtomically } from "@/lib/atomic-write";
+import { CLOUD_MANAGED_JEV_MODE, cloudManagesJevMode } from "@/src/hooks/fp-config";
 import {
   hostnameFromHostHeader,
   isLoopbackHostname,
@@ -475,8 +476,8 @@ export async function saveJevConfigAction(input: JevConfigInput): Promise<JevWri
  * endpoint and the provider are exactly what they were. It is written the way
  * every other write here is (`writeJsonAtomically`, 0600, owner-only
  * directory), after the loader's own validator has checked the result with
- * stand-ins in the key slots, so `enforce` is refused where the loader would
- * refuse it (plain http to localhost) rather than written and then ignored.
+ * stand-ins in the key slots, so a mode the loader would refuse is refused
+ * here rather than written and then ignored.
  *
  * Refused for a file the loader calls too open: someone else may have written
  * the endpoint it names, and re-saving it at 0600 would start trusting that
@@ -489,6 +490,7 @@ export async function setJevModeAction(requested: string): Promise<JevWriteResul
   if (mode === null) {
     return { ok: false, problem: 'mode must be "off", "observe" or "enforce".' };
   }
+  if (cloudManagesJevMode()) return { ok: false, problem: CLOUD_MANAGED_JEV_MODE };
 
   const existingFile = readJevConfigFileForUpdate();
   if (existingFile === null) {

package/.next/standalone/app/settings/jev-panel.tsx

@@ -45,7 +45,7 @@
  * and a save leaves whatever is stored alone.
  *
  * Client-side validation here is a convenience only. Every rule — the URL
- * scheme, plain http being refused outside observe mode, cloudflare's account id
+ * scheme (plain http to loopback only), cloudflare's account id
  * — is enforced server-side by the same `validateJevConfig` the loader runs.
  *
  * ## FailproofAI Cloud

package/.next/standalone/fp-cloud-cli/CHANGELOG.md

@@ -10,24 +10,15 @@
   `both` (JavaScript reviewable by exactly its own checks; the server derives the authority).
   The kind follows from what is given when `--kind` is omitted, and a kind that contradicts its
   inputs is exit 2 before anything is sent. The positional source still works.
-- `fp fleet deploy … --jev-mode off|observe|enforce|local` sets the machine's Jev mode from
-  FailproofAI Cloud (overriding the machine's own; `local` hands it back). Omitted, the request
-  carries no `jevMode` and the mode is unchanged; `--jev-mode` alone is a valid deploy. An
-  `observe` effect on a `jev` policy is refused (exit 2) — Jev is observed through the mode.
-- `fp fleet jev-mode <machine…|--all> <mode>` changes only the Jev mode, through its own
-  route (`PUT /api/enforcement/deployments/{id}/jev-mode`), never the policy set — and
-  `fp fleet deploy --jev-mode` with no change to the set now uses it too. A deploy is a full
-  replace of the set the CLI read, which leaves out disabled policies' assignments, so a
-  mode change sent as a deploy deleted them and reverted concurrent edits.
-- `fp fleet rollback` says which Jev mode it restores (`jev mode <now> → <then>`, and
-  `jevModeBefore` in `--json`); `fp fleet history` shows each generation's Jev mode and marks a
-  mode-only generation as a change.
-- The `--jev-mode` and `fleet jev-mode` help says what `enforce` does: Jev's checks block calls
-  as well as clearing what they review, machine-wide (installed packs' checks included); an
-  `observe` effect on a `both` policy withholds its Jev checks.
-- The `fleet deploy`, `fleet jev-mode` and `policies publish` help says Jev checks run on
-  FailproofAI Cloud and nothing is installed on the machine, and `fleet show`/`fleet jev-mode`
-  name the reasons a machine with a mode cannot ask (`jev_unconfigured`, `transcripts_disabled`)
+- No Jev mode is set by hand: FailproofAI Cloud derives a machine's Jev mode from what is
+  deployed to it (on while a `jev`/`both` policy is, off otherwise), so `fp fleet deploy` has
+  no `--jev-mode` and there is no `fp fleet jev-mode`. An `observe` effect applies to `jev`
+  and `both` policies like any other: their checks are recorded and decide nothing.
+- `fp fleet rollback` says when the Jev mode differs (`jev mode <now> → <then>`, and
+  `jevModeBefore` in `--json`); `fp fleet history` shows each generation's Jev mode.
+- The `fleet deploy` and `policies publish` help says Jev checks run on
+  FailproofAI Cloud and nothing is installed on the machine, and `fleet show`
+  names the reasons a machine with a mode cannot ask (`jev_unconfigured`, `transcripts_disabled`)
   and the `jev_budget` report.
 - `fp policies list/show` print each version's kind and Jev check names (`show` also the
   declarations); `fp fleet list/show` print the machine's Jev mode and the policy errors it

package/.next/standalone/fp-cloud-cli/README.md

@@ -144,19 +144,17 @@ earlier version is), `jev` (Jev checks only, from a JSON file of declarations
 each exactly a failproofai pack manifest's semantic entry), or `both`
 (JavaScript whose verdict its own Jev checks may clear, deployed as one).
 Jev checks run on FailproofAI Cloud; nothing is installed on the machine.
-`--jev-mode` sets a machine's Jev mode from FailproofAI Cloud, overriding the
-machine's own; omit it and the mode is left alone. Under `observe` or `enforce`
-the machine sends each checked tool call to FailproofAI Cloud, which asks the
-checks deployed to it. The mode is the machine's, so it covers installed packs'
-checks too, and in `enforce` Jev's checks **block** calls as well as clearing
-the regex verdicts they review. `fp fleet jev-mode` changes only the mode, and
-never rewrites a machine's policy set.
+While a `jev` or `both` policy is deployed to a machine, FailproofAI Cloud
+turns Jev on there and the machine sends each checked tool call to it; with
+none, Jev is off. There is no Jev mode to set: trial a policy with `:observe`
+(its checks are recorded, never applied), then deploy it as `enforce`, where
+Jev's checks **block** calls as well as clearing the regex verdicts they
+review.
 
 ```bash
 fp policies publish prod-db-intent --kind jev --semantic ./checks.json
 fp policies publish no-prod-db --kind both --source ./rule.mjs --semantic ./checks.json
-fp fleet deploy ci-runner-01 --add prod-db-intent --jev-mode observe
-fp fleet jev-mode --all enforce   # the mode alone, every machine with a deployment
+fp fleet deploy ci-runner-01 --add prod-db-intent:observe
 fp fleet show ci-runner-01    # its Jev mode, and any policy errors it reported
 ```
 

package/.next/standalone/fp-cloud-cli/fp_cli/client.py

@@ -1785,42 +1785,16 @@ def deploy_policies(
     ctx: ClientContext,
     machine_id: str,
     policies: Sequence[PolicyRef],
-    jev_mode: Optional[str] = None,
 ) -> Deployment:
     """PUT /api/enforcement/deployments/{id} — REPLACES the machine's whole set.
 
-    ``jev_mode`` (``off|observe|enforce|local``) is sent only when given: the
-    server reads an ABSENT ``jevMode`` as "keep the machine's current one", so a
-    deploy that says nothing about Jev never changes it. ``local`` stops
-    FailproofAI Cloud overriding the machine's own mode.
+    Never carries a Jev mode: FailproofAI Cloud derives it from the set.
     """
     path = f"/api/enforcement/deployments/{machine_id}"
     body: Dict[str, Any] = {"policies": [p.to_dict() for p in policies]}
-    if jev_mode is not None:
-        body["jevMode"] = jev_mode
     return Deployment.from_dict(_request_json(ctx, "PUT", path, json_body=body) or {})
 
 
-def set_jev_mode(ctx: ClientContext, machine_id: str, jev_mode: str) -> Tuple[Deployment, bool]:
-    """PUT /api/enforcement/deployments/{id}/jev-mode — change ONLY the Jev mode.
-
-    ``jev_mode`` is ``off|observe|enforce|local`` (``local`` stops FailproofAI
-    Cloud overriding the machine's own mode). Unlike a deploy, this never
-    touches the machine's policy set: a deploy is a full replace of the set, and
-    the set a client can read leaves out disabled policies' assignments, so a
-    mode change sent as a deploy deleted them — and reverted any edit made since
-    the set was read. It still mints a new generation, which is how the machine
-    picks the mode up.
-
-    Returns the deployment and whether anything changed: setting the mode the
-    machine already has changes nothing and mints nothing (``changed: false``).
-    A machine with no deployment is a 404 — a deploy is how it gets its first.
-    """
-    path = f"/api/enforcement/deployments/{machine_id}/jev-mode"
-    data = _request_json(ctx, "PUT", path, json_body={"jevMode": jev_mode}) or {}
-    return Deployment.from_dict(data), bool(data.get("changed", True))
-
-
 def deployment_history(ctx: ClientContext, machine_id: str) -> List[Dict[str, Any]]:
     """GET /api/enforcement/deployments/{id}/history — every generation, newest first."""
     path = f"/api/enforcement/deployments/{machine_id}/history"

package/.next/standalone/fp-cloud-cli/fp_cli/commands/fleet_cmds.py

@@ -1,4 +1,4 @@
-"""The fleet: fleet list / show / deploy / jev-mode / diff / history / rollback / rename.
+"""The fleet: fleet list / show / deploy / diff / history / rollback / rename.
 
 What each machine is TOLD to enforce. Authoring the policies is `fp policies`;
 what they actually did is `fp guardrails`.
@@ -26,12 +26,10 @@ from .. import output
 from .._context import GLOBALS_EPILOG, AppState, deny_in_key_mode, require_auth
 from .. import _click_compat as click  # the Click Typer is running; see _click_compat
 from ..enforcement import (
-    JEV_MODES,
     RefError,
     RefUsageError,
     check_race,
     disabled_ids,
-    jev_mode_after,
     latest_versions,
     plan_deploy,
     version_kinds,
@@ -157,7 +155,7 @@ def fleet_deploy(
     add: Optional[List[str]] = typer.Option(
         None, "--add",
         help="Add or update a policy: `id`, `id@version`, `id:effect` or `id@version:effect`. "
-             "`observe` on a `both` policy observes its JavaScript and withholds its Jev checks.",
+             "`observe` records what the policy (its JavaScript and its Jev checks) would decide, and decides nothing.",
     ),
     remove: Optional[List[str]] = typer.Option(None, "--remove", help="Remove a policy by id."),
     replace: Optional[List[str]] = typer.Option(
@@ -176,14 +174,6 @@ def fleet_deploy(
         False, "--create",
         help="Allow deploying to a machine id that has not checked in yet (pre-staging).",
     ),
-    jev_mode: Optional[str] = typer.Option(
-        None, "--jev-mode",
-        help="Set the machine's Jev mode from FailproofAI Cloud: off, observe, enforce (Jev's "
-             "checks BLOCK calls as well as clearing what they review) — or local to stop "
-             "overriding the machine's own. Jev checks run on FailproofAI Cloud; nothing is "
-             "installed on the machine. Machine-wide: installed packs' checks too. "
-             "Omitted: unchanged.",
-    ),
     yes: bool = typer.Option(False, "--yes", "-y", help="Skip the confirmation prompt. The prompt only appears on an interactive terminal: under --json, or with stdin redirected, this command proceeds without asking."),
 ) -> None:
     """Change what a machine enforces, showing the full resulting set first.
@@ -198,20 +188,10 @@ def fleet_deploy(
     Any kind deploys the same way. Jev checks run on FailproofAI Cloud; nothing
     is installed on the machine: a `both` policy sends the machine its
     JavaScript, and the machine asks FailproofAI Cloud about each checked tool
-    call while its Jev mode is `observe` or `enforce`. An effect applies to
-    JavaScript only — an `observe` `both` policy observes its JavaScript and its
-    Jev checks are not asked — and a `jev` policy is watched through the Jev
-    MODE instead: `--jev-mode observe` asks Jev and logs what it says while the
-    regex policies decide; `enforce` lets Jev's checks BLOCK calls (every `jev`
-    policy's deny checks) as well as clear the regex verdicts they review; `off`
-    stops Jev on the machine; `local` hands the choice back to the machine. The
-    mode is the MACHINE's: it also governs the checks of any pack installed
-    there, and it overrides the machine's own mode and `jev.json`, a local
-    `off` included. Without `--jev-mode` it is left as it is.
-
-    `--jev-mode` with no change to the set changes ONLY the mode (the same as
-    `fp fleet jev-mode`): the policy set — disabled policies' assignments
-    included — is not read back and rewritten.
+    call. An `observe` effect applies to every kind: the policy's JavaScript
+    and its Jev checks are evaluated and recorded, and decide nothing. There is
+    no Jev mode to set: FailproofAI Cloud turns Jev on for a machine while any
+    `jev` or `both` policy is deployed to it, and off when none is.
 
     **Concurrency.** The write is a full replace with no server-side lock, so the
     CLI records the generation it read and refuses if the result is not exactly
@@ -224,19 +204,18 @@ def fleet_deploy(
     * `fp fleet deploy ci-runner-01 --add no-force-push`
     * `fp fleet deploy ci-runner-01 --add prod-guard@1:observe --remove old-rule`
     * `fp fleet deploy ci-runner-01 --set no-force-push --set no-secret-echo`
-    * `fp fleet deploy ci-runner-01 --add prod-db-intent --jev-mode observe`
-    * `fp fleet deploy ci-runner-01 --jev-mode local`
+    * `fp fleet deploy ci-runner-01 --add prod-db-intent:observe`
     """
     state: AppState = ctx.obj
     deny_in_key_mode(state, "fleet deploy", _KEY_MODE_REASON)
     cctx = require_auth(state)
 
-    if not add and not remove and replace is None and jev_mode is None and not targets and not all_agents:
+    if not add and not remove and replace is None and not targets and not all_agents:
         # Exit 2 for the same reason `--set` with `--add` is: no flag
         # combination was given that this command can act on. Both are the
         # caller's command line, not the server's answer.
         raise click.UsageError(
-            "nothing to do — pass --add, --remove, --set, --target, --all-agents, or --jev-mode. "
+            "nothing to do — pass --add, --remove, --set, --target, or --all-agents. "
             "`fp fleet show <machine>` prints the current set."
         )
 
@@ -268,8 +247,6 @@ def fleet_deploy(
             replace=replace,
             latest=latest,
             disabled=disabled_ids(published),
-            jev_mode=jev_mode,
-            current_jev_mode=current.jev_mode if current else None,
             kinds=version_kinds(published),
             targets=targets or (),
             all_agents=all_agents or (),
@@ -298,16 +275,6 @@ def fleet_deploy(
         output.deployment_unchanged(machine_id)
         return
 
-    # The mode alone: its own route, which never touches the policy set. A
-    # deploy is a full replace of the set the CLI read, and that set leaves out
-    # disabled policies' assignments — so a mode change sent as a deploy deleted
-    # them, and reverted anything changed since the read (CONTRACT C9.1). A
-    # machine with no deployment yet has nothing to lose and no mode to change:
-    # its first deploy, carrying the mode, is how it gets one.
-    if plan.jev_mode is not None and not plan.set_changes and current is not None:
-        _apply_jev_modes(state, cctx, [(machine_id, current.jev_mode)], plan.jev_mode, yes=yes, plan=plan)
-        return
-
     if not output.is_json():
         output.render_deploy_plan(plan)
     dropped = len(plan.removed)
@@ -323,7 +290,7 @@ def fleet_deploy(
             output.print_cancelled()
         return
 
-    result = api.deploy_policies(cctx, machine_id, plan.result, jev_mode=jev_mode)
+    result = api.deploy_policies(cctx, machine_id, plan.result)
     check_race(plan.base, result.deployment)
 
     if output.is_json():
@@ -336,176 +303,6 @@ def fleet_deploy(
     output.deployment_applied(machine_id, result.deployment, len(result.policies))
 
 
-def _jev_mode_consequence(mode: str, count: int) -> str:
-    what = f"{count} machine{'s' if count != 1 else ''}"
-    tail = {
-        "enforce": "; in enforce Jev's deny checks BLOCK calls, and it covers installed packs' checks too",
-        "observe": "; in observe Jev only records what it would have decided",
-        "off": "; Jev stops on them, a local jev.json included",
-        "local": "; each machine's own jev.json decides again",
-    }.get(mode, "")
-    return f"this sets the Jev mode to {mode} on {what} and leaves their policy sets untouched{tail}"
-
-
-def _apply_jev_modes(
-    state: AppState,
-    cctx,
-    targets: List[tuple],
-    mode: str,
-    *,
-    yes: bool,
-    plan=None,
-) -> None:
-    """Set `mode` on each `(machine_id, current_mode)`, through the mode-only route.
-
-    Shared by `fleet jev-mode` and `fleet deploy --jev-mode` with no set change.
-    A machine already on `mode` is left alone; one that fails is reported and
-    the rest still go ahead (exit 1 at the end, naming them).
-    """
-    after = jev_mode_after(mode)
-    rows = [
-        {"machineId": mid, "from": cur or "local", "to": after or "local", "changed": (cur or None) != after}
-        for mid, cur in targets
-    ]
-    todo = [r for r in rows if r["changed"]]
-    if not todo:
-        if output.is_json():
-            out = {"mode": mode, "machines": rows, "applied": False}
-            if plan is not None:
-                out = {"plan": plan.to_dict(), "deployment": None, "applied": False}
-            output.emit_json(out)
-            return
-        output.jev_mode_unchanged([r["machineId"] for r in rows], mode)
-        return
-
-    if not output.is_json():
-        output.render_jev_mode_plan(rows)
-    if not _write.confirm_destructive(
-        state, "change the Jev mode on",
-        todo[0]["machineId"] if len(todo) == 1 else f"{len(todo)} machines",
-        consequence=_jev_mode_consequence(mode, len(todo)),
-        assume_yes=yes,
-    ):
-        if output.is_json():
-            output.emit_json({"cancelled": True, "applied": False, "machines": rows})
-        else:
-            output.print_cancelled()
-        return
-
-    failed = []
-    last = None
-    for row in todo:
-        try:
-            result, changed = api.set_jev_mode(cctx, row["machineId"], mode)
-        except AuthError:
-            raise
-        except FpCliError as exc:
-            # One machine's refusal (a 404, a 403, a 422) is that machine's;
-            # the rest still go ahead, and the exit code says it was not all.
-            row["error"] = exc.format_message() if hasattr(exc, "format_message") else str(exc)
-            failed.append(row["machineId"])
-            continue
-        last = result
-        row["deployment"] = result.deployment
-        row["changed"] = changed
-
-    if output.is_json():
-        if plan is not None:
-            output.emit_json({
-                "plan": plan.to_dict(),
-                "deployment": last.to_dict() if last is not None else None,
-                "applied": last is not None,
-                "jevModeOnly": True,
-            })
-        else:
-            output.emit_json({"mode": mode, "machines": rows, "applied": not failed})
-    else:
-        output.jev_mode_applied(rows)
-    if failed:
-        raise ApiError(
-            f"the Jev mode could not be changed on {', '.join(failed)}"
-            + ("" if len(failed) == len(todo) else " — the other machines were changed"),
-        )
-
-
-def fleet_jev_mode(
-    ctx: typer.Context,
-    args: Optional[List[str]] = typer.Argument(
-        None, metavar="[MACHINE]... MODE",
-        help="The machines, then the mode: off, observe, enforce or local. With --all, just the mode.",
-    ),
-    all_machines: bool = typer.Option(
-        False, "--all", help="Every machine that has a deployment (machines with none are skipped).",
-    ),
-    yes: bool = typer.Option(False, "--yes", "-y", help="Skip the confirmation prompt. The prompt only appears on an interactive terminal: under --json, or with stdin redirected, this command proceeds without asking."),
-) -> None:
-    """Set the Jev mode FailproofAI Cloud gives machines, and nothing else.
-
-    `off`, `observe` or `enforce` override each machine's own mode and
-    `jev.json`, a local `off` included; `local` hands the choice back to the
-    machine. Jev checks run on FailproofAI Cloud; nothing is installed on the
-    machine: under `observe` or `enforce` it sends each checked tool call to
-    FailproofAI Cloud. `observe` asks Jev and records what it says while the
-    regex policies decide. `enforce` lets Jev's checks BLOCK calls — every `jev`
-    policy's deny checks — as well as clear the regex verdicts they review. The
-    mode is the machine's: it also governs the checks of every pack installed
-    there. A machine connected with `--no-transcripts` never asks, and reports
-    `transcripts_disabled`.
-
-    Only the mode changes: each machine's policy set, disabled policies'
-    assignments included, is left exactly as it is, and a machine already on
-    the mode is skipped. Each change is a new generation in `fp fleet history`.
-    A machine with no deployment has no mode to change — `fp fleet deploy
-    <machine> --jev-mode <mode>` gives it its first deployment with one.
-
-    Needs `policies:write`. With `--json`: `{mode, applied, machines:[{machineId,
-    from, to, changed, deployment?, error?}]}`.
-
-    Examples:
-
-    * `fp fleet jev-mode ci-runner-01 observe`
-    * `fp fleet jev-mode ci-runner-01 ci-runner-02 enforce`
-    * `fp fleet jev-mode --all local`
-    """
-    state: AppState = ctx.obj
-    deny_in_key_mode(state, "fleet jev-mode", _KEY_MODE_REASON)
-    words = list(args or [])
-    if not words:
-        raise click.UsageError("pass the mode: off, observe, enforce or local")
-    mode, machine_ids = words[-1], list(dict.fromkeys(words[:-1]))
-    if mode not in JEV_MODES:
-        raise click.UsageError(f"{mode!r} is not a Jev mode — one of {', '.join(JEV_MODES)}")
-    if all_machines and machine_ids:
-        raise click.UsageError("--all sets every machine; do not name machines as well")
-    if not all_machines and not machine_ids:
-        raise click.UsageError("name at least one machine, or pass --all")
-    cctx = require_auth(state)
-
-    deployments = {d.machine_id: d for d in api.list_deployments(cctx)}
-    if all_machines:
-        targets = [(mid, deployments[mid].jev_mode) for mid in sorted(deployments)]
-    else:
-        known = {m.machine_id for m in api.list_machines(cctx)} | set(deployments)
-        unknown = [mid for mid in machine_ids if mid not in known]
-        if unknown:
-            raise NotFoundError(f"no machine {', '.join(repr(u) for u in unknown)} has checked in")
-        bare = [mid for mid in machine_ids if mid not in deployments]
-        if bare:
-            raise ApiError(
-                f"{', '.join(bare)} {'has' if len(bare) == 1 else 'have'} no deployment, so there is no Jev "
-                "mode to change",
-                hint=f"`fp fleet deploy <machine> --jev-mode {mode}` gives a machine its first deployment with the mode",
-            )
-        targets = [(mid, deployments[mid].jev_mode) for mid in machine_ids]
-    if not targets:
-        if output.is_json():
-            output.emit_json({"mode": mode, "machines": [], "applied": False})
-        else:
-            output.info("no machine has a deployment yet — nothing to set")
-        return
-    _apply_jev_modes(state, cctx, targets, mode, yes=yes)
-
-
 def fleet_diff(
     ctx: typer.Context,
     machine_id: Optional[str] = typer.Argument(None, help="Machine id. Omit for the whole fleet."),
@@ -606,7 +403,7 @@ def fleet_rollback(
     _require_machine(cctx, machine_id)
     current = api.get_deployment(cctx, machine_id)
     # The mode that generation carried comes back with it, NULL (`local`)
-    # included — a rollback past an `--jev-mode off` turns enforcement back on.
+    # included, as the server reports it.
     # Read it first, so the prompt says so rather than the fleet finding out.
     target = next(
         (e for e in api.deployment_history(cctx, machine_id) if e.get("deployment") == deployment), None)
@@ -669,12 +466,11 @@ def register(app: typer.Typer) -> None:
         no_args_is_help=True,
         rich_markup_mode="markdown",
         context_settings={"help_option_names": ["-h", "--help"]},
-        help="The fleet and what each machine enforces (list / show / deploy / jev-mode / diff / history / rollback / rename).",
+        help="The fleet and what each machine enforces (list / show / deploy / diff / history / rollback / rename).",
     )
     fleet_app.command("list", epilog=GLOBALS_EPILOG)(fleet_list)
     fleet_app.command("show", epilog=GLOBALS_EPILOG)(fleet_show)
     fleet_app.command("deploy", epilog=GLOBALS_EPILOG)(fleet_deploy)
-    fleet_app.command("jev-mode", epilog=GLOBALS_EPILOG)(fleet_jev_mode)
     fleet_app.command("diff", epilog=GLOBALS_EPILOG)(fleet_diff)
     fleet_app.command("history", epilog=GLOBALS_EPILOG)(fleet_history)
     fleet_app.command("rollback", epilog=GLOBALS_EPILOG)(fleet_rollback)

package/.next/standalone/fp-cloud-cli/fp_cli/enforcement.py

@@ -43,10 +43,6 @@ VALID_EFFECTS = ("enforce", "observe")
 #: JavaScript reviewable by its own Jev checks (`both`).
 VALID_KINDS = ("regex", "jev", "both")
 
-#: The Jev modes a deployment may set. `local` stops FailproofAI Cloud
-#: overriding the machine's own mode (the server stores it as no value).
-JEV_MODES = ("off", "observe", "enforce", "local")
-
 #: The server's (and the machine's) cap on Jev declarations per policy version.
 MAX_JEV_DECLARATIONS = 24
 AGENT_INTEGRATIONS = frozenset({
@@ -120,22 +116,6 @@ class DeployPlan:
     removed: List[PolicyRef]
     changed: List[Tuple[PolicyRef, PolicyRef]]
     unchanged: List[PolicyRef]
-    #: `--jev-mode` as given (`off|observe|enforce|local`), or None when the
-    #: command said nothing about Jev — which the server reads as "keep it".
-    jev_mode: Optional[str] = None
-    #: The mode FailproofAI Cloud sets on the machine now (None = local).
-    jev_mode_before: Optional[str] = None
-
-    @property
-    def jev_mode_after(self) -> Optional[str]:
-        """What the machine's Cloud-set mode will be (None = local)."""
-        if self.jev_mode is None:
-            return self.jev_mode_before
-        return None if self.jev_mode == "local" else self.jev_mode
-
-    @property
-    def jev_mode_changes(self) -> bool:
-        return self.jev_mode is not None and self.jev_mode_after != self.jev_mode_before
 
     @property
     def set_changes(self) -> bool:
@@ -144,7 +124,7 @@ class DeployPlan:
 
     @property
     def is_noop(self) -> bool:
-        return not (self.set_changes or self.jev_mode_changes)
+        return not self.set_changes
 
     def to_dict(self) -> Dict[str, object]:
         out: Dict[str, object] = {
@@ -157,13 +137,6 @@ class DeployPlan:
             "unchanged": [p.to_dict() for p in self.unchanged],
             "noop": self.is_noop,
         }
-        if self.jev_mode is not None:
-            # `local` on both sides: the wire word, not the stored NULL.
-            out["jevMode"] = {
-                "from": self.jev_mode_before or "local",
-                "to": self.jev_mode_after or "local",
-                "changed": self.jev_mode_changes,
-            }
         return out
 
 
@@ -237,8 +210,6 @@ def plan_deploy(
     replace: Optional[Sequence[str]] = None,
     latest: Optional[Dict[str, int]] = None,
     disabled: Optional[set] = None,
-    jev_mode: Optional[str] = None,
-    current_jev_mode: Optional[str] = None,
     kinds: Optional[Dict[Tuple[str, int], str]] = None,
     targets: Sequence[str] = (),
     all_agents: Sequence[str] = (),
@@ -249,16 +220,13 @@ def plan_deploy(
     with "these as well" has no single obvious reading, and guessing one would
     be guessing about somebody's fleet.
 
-    `jev_mode` is `--jev-mode`; `current_jev_mode` what Cloud sets now (None =
-    local). `kinds` maps `(id, version)` to the version's kind, so an `observe`
-    effect on a Jev-only version — which the server refuses, because a Jev
-    rollout is observed through the Jev MODE — is refused here, before a plan is
-    drawn and confirmed for a write that cannot happen.
+    There is no Jev mode to set: FailproofAI Cloud derives a machine's Jev mode
+    from what is deployed to it (enforce while any `jev`/`both` policy is,
+    off otherwise), and a Jev rollout is observed per policy with an `observe`
+    effect like any other. `kinds` (`(id, version)` → kind) is accepted for
+    callers that already have it.
     """
-    if jev_mode is not None and jev_mode not in JEV_MODES:
-        raise RefUsageError(
-            f"--jev-mode {jev_mode!r} is not one of {', '.join(JEV_MODES)}"
-        )
+    del kinds
     latest = latest or {}
     current_list = list(current or [])
     current_map = {p.id: p for p in current_list}
@@ -314,13 +282,6 @@ def plan_deploy(
         result_map[pid] = dataclass_replace(result_map[pid], agent_targets=grouped.get(pid))
 
     result = sorted(result_map.values(), key=lambda p: p.id)
-    for ref in result:
-        if ref.effect == "observe" and (kinds or {}).get((ref.id, ref.version)) == "jev":
-            raise RefUsageError(
-                f"{ref.id}@{ref.version} is a Jev policy, and an effect does not apply to Jev "
-                "checks — deploy it as enforce and use --jev-mode observe to watch Jev without "
-                "it deciding anything"
-            )
     added, removed, changed, unchanged = [], [], [], []
     for pid, ref in sorted(result_map.items()):
         was = current_map.get(pid)
@@ -342,16 +303,9 @@ def plan_deploy(
         removed=removed,
         changed=changed,
         unchanged=unchanged,
-        jev_mode=jev_mode,
-        jev_mode_before=current_jev_mode,
     )
 
 
-def jev_mode_after(mode: str) -> Optional[str]:
-    """What a `--jev-mode`/`jev-mode` word leaves stored: `local` is None (Cloud stops overriding)."""
-    return None if mode == "local" else mode
-
-
 def version_kinds(policies: Iterable[PolicyVersion]) -> Dict[Tuple[str, int], str]:
     """`{(id, version): kind}` for every published version."""
     return {(p.id, p.version): p.kind for p in policies}