failproofai 1.0.12-beta.1 → 1.0.12-beta.2

package/dist/cli.mjs

@@ -29,7 +29,7 @@ var __esm = (fn, res, err) => () => {
 var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
 // package.json
-var version2 = "1.0.12-beta.1", package_default;
+var version2 = "1.0.12-beta.2", package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "failproofai",
@@ -151,23 +151,24 @@ var init_package = __esm(() => {
       postcss: "8.5.26",
       "eslint-plugin-react-hooks": "7.0.1",
       vite: "8.1.6",
-      undici: "7.29.1",
+      undici: "7.30.1",
+      zod: "4.6.6",
       "brace-expansion": "5.0.12",
       sharp: "0.35.5",
       "source-map-js": "1.2.2",
       browserslist: "4.28.8"
     },
     optionalDependencies: {
-      "@failproofai/failproofaid-linux-x64": "1.0.12-beta.1",
-      "@failproofai/failproofaid-linux-arm64": "1.0.12-beta.1",
-      "@failproofai/failproofaid-darwin-x64": "1.0.12-beta.1",
-      "@failproofai/failproofaid-darwin-arm64": "1.0.12-beta.1"
+      "@failproofai/failproofaid-linux-x64": "1.0.12-beta.2",
+      "@failproofai/failproofaid-linux-arm64": "1.0.12-beta.2",
+      "@failproofai/failproofaid-darwin-x64": "1.0.12-beta.2",
+      "@failproofai/failproofaid-darwin-arm64": "1.0.12-beta.2"
     },
     failproofaidBinaries: {
-      "linux-x64": "df15e65b60066248038c8ac6d423bffcb0e38637e8a42fa22250afa111fd46ac",
-      "linux-arm64": "59d7ae758c8981c5e0a89eb64be18ebd278213525dd4447891a51be6bb018ed9",
-      "darwin-x64": "b0d3d39abaa02ed0a14dddc68277975a7a23e200830b7edbffdedde3af81ce73",
-      "darwin-arm64": "a6d343b5926e84c0eb437af307f85b69b3128f94c6e34acbf9d0b13a7c7e9d63"
+      "linux-x64": "4c09117fdb80d87792d1d2b77d9359cdbd0c522b5a6222ab7b927659130ddf54",
+      "linux-arm64": "dd390d76561267fc519ceb96fb90be340044e2f564bef36a44e284f227d93f29",
+      "darwin-x64": "62381f7ffe21d02289c36c4b205166b2867dbde986444d1ea185241b94fd04ef",
+      "darwin-arm64": "9ad798817d3048a5126e80dc71883538d37c1b6b6443e9c19389dc2583c8f675"
     }
   };
 });
@@ -607,6 +608,14 @@ function readCredentials() {
     return {};
   }
 }
+function cloudManagesJevMode() {
+  try {
+    const cloud = readCredentials().cloud;
+    return Boolean(cloud?.url && cloud.machineId);
+  } catch {
+    return false;
+  }
+}
 function projectCredentials(parsed) {
   {
     const cloud = parsed.cloud;
@@ -816,7 +825,7 @@ function writeFileAt(path, contents) {
   mkdirSync2(dirname2(path), { recursive: true });
   writeFileSync2(path, contents, "utf8");
 }
-var DEFAULT_AUDIT_INTERVAL_DAYS = 7, MIN_AUDIT_INTERVAL_DAYS = 1, MAX_AUDIT_INTERVAL_DAYS = 90, DEFAULT_CONFIG, OWNED_CONFIG_KEYS, isPlainObject = (v) => typeof v === "object" && v !== null && !Array.isArray(v), OWNED_CREDENTIAL_KEYS, MAX_CREDENTIALS_BYTES, credentialsOpenFlags = () => fsConstants.O_RDONLY | (fsConstants.O_NONBLOCK ?? 0), DIR_WRITABLE_BY_OTHERS = 18;
+var DEFAULT_AUDIT_INTERVAL_DAYS = 7, MIN_AUDIT_INTERVAL_DAYS = 1, MAX_AUDIT_INTERVAL_DAYS = 90, DEFAULT_CONFIG, OWNED_CONFIG_KEYS, isPlainObject = (v) => typeof v === "object" && v !== null && !Array.isArray(v), OWNED_CREDENTIAL_KEYS, CLOUD_MANAGED_JEV_MODE = "Jev mode is managed by FailproofAI Cloud on this machine: enforce while a Jev policy is deployed here, off when none is.", MAX_CREDENTIALS_BYTES, credentialsOpenFlags = () => fsConstants.O_RDONLY | (fsConstants.O_NONBLOCK ?? 0), DIR_WRITABLE_BY_OTHERS = 18;
 var init_fp_config = __esm(() => {
   init_atomic_write();
   init_package();
@@ -912,6 +921,57 @@ function normalizeJevFallbackReason(raw) {
   const code = JEV_FREE_TEXT_PREFIXES.get(head) ?? head;
   return JEV_REASON_CODES.has(code) ? code : JEV_REASON_OTHER;
 }
+function sanitizeCheck(raw) {
+  if (!raw || typeof raw !== "object" || Array.isArray(raw))
+    return null;
+  const r = raw;
+  if (typeof r.check !== "string" || !JEV_CHECK_NAME_RE.test(r.check))
+    return null;
+  if (typeof r.verdict !== "string" || !CHECK_VERDICT_SET.has(r.verdict))
+    return null;
+  if (typeof r.why !== "string" || !CHECK_WHY_SET.has(r.why))
+    return null;
+  if (!isP(r.p))
+    return null;
+  const out = {
+    check: r.check,
+    verdict: r.verdict,
+    why: r.why,
+    p: round2(r.p)
+  };
+  if (typeof r.policy === "string" && isJevPolicyName(r.policy) && !/\s/.test(r.policy) && /^(?:cloud|pack)\//.test(r.policy)) {
+    out.policy = r.policy;
+  }
+  if (isP(r.exempt))
+    out.exempt = round2(r.exempt);
+  if (r.watched === true)
+    out.watched = true;
+  if (r.probes && typeof r.probes === "object" && !Array.isArray(r.probes)) {
+    const probes = {};
+    for (const [id, v] of Object.entries(r.probes)) {
+      if (Object.keys(probes).length >= JEV_CHECK_PROBES_MAX)
+        break;
+      if (JEV_PROBE_ID_RE.test(id) && isP(v))
+        probes[id] = round2(v);
+    }
+    if (Object.keys(probes).length > 0)
+      out.probes = probes;
+  }
+  return out;
+}
+function sanitizeJevChecks(raw) {
+  if (!Array.isArray(raw))
+    return;
+  const out = [];
+  for (const item of raw) {
+    if (out.length >= JEV_CHECKS_MAX)
+      break;
+    const rec = sanitizeCheck(item);
+    if (rec)
+      out.push(rec);
+  }
+  return raw.length > 0 && out.length === 0 ? undefined : out;
+}
 function sanitizeJevActivity(entry) {
   if (!JEV_ACTIVITY_KEYS.some((k) => entry[k] !== undefined))
     return entry;
@@ -950,6 +1010,11 @@ function sanitizeJevActivity(entry) {
     out.jevModel = out.jevModel.trim();
   else
     drop("jevModel");
+  const checks = out.evaluator === "jev" ? sanitizeJevChecks(out.jevChecks) : undefined;
+  if (checks === undefined)
+    drop("jevChecks");
+  else
+    out.jevChecks = checks;
   return out;
 }
 function jevOutcome(raw) {
@@ -960,6 +1025,8 @@ function outcomeOf(e) {
     return "fallback";
   if (e.evaluator !== "jev")
     return null;
+  if (Array.isArray(e.jevChecks) && e.jevChecks.length === 0)
+    return "no-request";
   if (e.jevCleared !== undefined || e.jevLatencyMs !== undefined || e.jevModel !== undefined)
     return "answered";
   if (e.jevDecision === "deny" || e.jevDecision === "instruct")
@@ -968,7 +1035,7 @@ function outcomeOf(e) {
     return "no-request";
   return "not-consulted";
 }
-var JEV_ACTIVITY_KEYS, EVALUATORS, DECISIONS, MODES, REASON_HEAD_RE, HTTP_CODE_RE, JEV_REASON_MAX_CHARS = 40, JEV_REASON_OTHER = "other", JEV_REASON_CODE_LIST, JEV_REASON_CODES, JEV_REASON_REQUEST_CUT = "request-cut", JEV_REASON_PROVIDER_REFUSED = "provider-refused", JEV_FREE_TEXT_PREFIXES, JEV_MODEL_RE, JEV_POLICY_NAME_MAX_CHARS = 200, NAME_FORBIDDEN_RE, REGISTERED_NAMESPACE_RE, JEV_CLEARED_MAX = 64, ANSWERED_BUT_NOT_APPLIED_REASONS;
+var JEV_ACTIVITY_KEYS, EVALUATORS, DECISIONS, MODES, REASON_HEAD_RE, HTTP_CODE_RE, JEV_REASON_MAX_CHARS = 40, JEV_REASON_OTHER = "other", JEV_REASON_CODE_LIST, JEV_REASON_CODES, JEV_REASON_REQUEST_CUT = "request-cut", JEV_REASON_PROVIDER_REFUSED = "provider-refused", JEV_FREE_TEXT_PREFIXES, JEV_MODEL_RE, JEV_POLICY_NAME_MAX_CHARS = 200, NAME_FORBIDDEN_RE, REGISTERED_NAMESPACE_RE, JEV_CLEARED_MAX = 64, JEV_CHECK_VERDICTS, JEV_CHECK_WHY, JEV_CHECKS_MAX = 32, JEV_CHECK_PROBES_MAX = 8, JEV_CHECK_NAME_RE, JEV_PROBE_ID_RE, CHECK_VERDICT_SET, CHECK_WHY_SET, isP = (v) => typeof v === "number" && Number.isFinite(v) && v >= 0 && v <= 1, round2 = (v) => Math.round(v * 100) / 100, ANSWERED_BUT_NOT_APPLIED_REASONS;
 var init_jev_activity = __esm(() => {
   JEV_ACTIVITY_KEYS = [
     "evaluator",
@@ -977,7 +1044,8 @@ var init_jev_activity = __esm(() => {
     "jevFallbackReason",
     "jevLatencyMs",
     "jevModel",
-    "jevMode"
+    "jevMode",
+    "jevChecks"
   ];
   EVALUATORS = new Set(["jev", "jev-fallback"]);
   DECISIONS = new Set(["allow", "instruct", "deny"]);
@@ -1024,6 +1092,22 @@ var init_jev_activity = __esm(() => {
   JEV_MODEL_RE = /^[A-Za-z0-9._:/@~+-]{1,200}$/;
   NAME_FORBIDDEN_RE = /[\u0000-\u001f\u007f-\u009f\u2028\u2029]/;
   REGISTERED_NAMESPACE_RE = /^(?:custom|pack|cloud|failproofai|\.failproofai-[A-Za-z0-9_-]{1,32})\//;
+  JEV_CHECK_VERDICTS = ["none", "deny", "instruct", "overridden"];
+  JEV_CHECK_WHY = [
+    "not-detected",
+    "exempt",
+    "fired",
+    "injection",
+    "user-asked",
+    "op-requested",
+    "task-step",
+    "downgraded",
+    "scan-incomplete"
+  ];
+  JEV_CHECK_NAME_RE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
+  JEV_PROBE_ID_RE = /^[a-z][a-z0-9_]{0,31}$/;
+  CHECK_VERDICT_SET = new Set(JEV_CHECK_VERDICTS);
+  CHECK_WHY_SET = new Set(JEV_CHECK_WHY);
   ANSWERED_BUT_NOT_APPLIED_REASONS = new Set([
     JEV_REASON_REQUEST_CUT,
     "truncated",
@@ -1625,7 +1709,13 @@ function runtimeAgentSettingsPath(cli, cwd, userHome = homedir2(), hookScope) {
     if (config?.trim())
       return resolve2(config);
     const state = process.env.OPENCLAW_STATE_DIR || process.env.OPENCLAW_HOME;
-    return resolve2(state?.trim() ? state : resolve2(userHome, ".openclaw"), "openclaw.json");
+    if (state?.trim())
+      return resolve2(state, "openclaw.json");
+    const profile = process.env.OPENCLAW_PROFILE?.trim();
+    if (profile && profile !== "default" && /^[A-Za-z0-9._-]{1,80}$/.test(profile) && !profile.startsWith(".")) {
+      return resolve2(userHome, `.openclaw-${profile}`, "openclaw.json");
+    }
+    return resolve2(userHome, ".openclaw", "openclaw.json");
   }
   const relative = USER_SETTINGS[cli];
   if (!relative)
@@ -3049,6 +3139,40 @@ function readCloudJevState() {
   const deployment = Number.isSafeInteger(active.deployment) ? active.deployment : null;
   return { jevMode, deployment, errors };
 }
+function readCloudJevAssignments() {
+  try {
+    const active = readActiveRaw();
+    if (!active || !Array.isArray(active.jevPolicies))
+      return null;
+    const schema = active.schemaVersion;
+    const out = [];
+    for (const raw of active.jevPolicies) {
+      if (!raw || typeof raw !== "object" || Array.isArray(raw))
+        return null;
+      const entry = raw;
+      if (typeof entry.id !== "string" || !POLICY_ID_RE.test(entry.id))
+        return null;
+      if (!Number.isSafeInteger(entry.version) || entry.version < 0)
+        return null;
+      if (entry.effect !== undefined && entry.effect !== "enforce" && entry.effect !== "observe")
+        return null;
+      const targets = parseAgentTargets(entry.agentTargets, schema);
+      out.push({
+        id: entry.id,
+        version: entry.version,
+        effect: entry.effect === "observe" ? "observe" : "enforce",
+        ...targets ? { agentTargets: targets } : {}
+      });
+    }
+    return out;
+  } catch {
+    return null;
+  }
+}
+function cloudJevAssignmentsFor(agent) {
+  const all = readCloudJevAssignments();
+  return all === null ? null : all.filter((a) => agentTargetsMatch(a.agentTargets, agent));
+}
 function cloudReviewerName(policyId, name) {
   return `cloud:${policyId}/${name}`;
 }
@@ -3693,9 +3817,11 @@ function effectiveReviewerNames() {
     return cached;
   let names = NO_REVIEWERS;
   cachedContested = new Map;
+  cachedPackChecks = false;
   try {
     const packs = jevPacks(readInstalledPacks().packs, reviewerCli);
     names = reviewerNamesFor(packs);
+    cachedPackChecks = names.size > 0;
     cachedContested = contestedSemanticNames(packs);
   } catch {}
   try {
@@ -3713,12 +3839,9 @@ function contestedReviewerNames() {
 function jevChecksInstalled() {
   return effectiveReviewerNames().size > 0;
 }
-function jevChecksDeclared() {
-  try {
-    return reviewerNamesFor(jevPacks(readInstalledPacks().packs)).size > 0;
-  } catch {
-    return false;
-  }
+function packJevChecksInstalled() {
+  effectiveReviewerNames();
+  return cachedPackChecks;
 }
 function reviewerNamesFor(packs) {
   const contested = contestedSemanticNames(packs);
@@ -3732,7 +3855,7 @@ function forgetEffectiveReviewerNames(cli, agent = null) {
   reviewerCli = cli;
   reviewerAgent = agent;
 }
-var cached = null, cachedContested, reviewerCli, reviewerAgent = null;
+var cached = null, cachedPackChecks = false, cachedContested, reviewerCli, reviewerAgent = null;
 var init_effective_reviewers = __esm(() => {
   init_pack_manifest();
   init_policy_authority();
@@ -14299,11 +14422,15 @@ function removeCodexSystemHooks(deps = {}) {
   }
   return { status: "removed", path, hooks };
 }
+function codexHome() {
+  const dir = process.env.CODEX_HOME?.trim();
+  return dir ? resolve9(dir) : resolve9(homedir6(), ".codex");
+}
 function codexHookTrust(deps = {}) {
   const systemPath = resolvedPath(deps);
   if (systemPath && codexSystemHooksPresent({ path: systemPath }))
     return { kind: "system", path: systemPath };
-  const hooksJsonPath = deps.hooksJsonPath ?? resolve9(homedir6(), ".codex", "hooks.json");
+  const hooksJsonPath = deps.hooksJsonPath ?? resolve9(codexHome(), "hooks.json");
   const ours = failproofaiCodexHookIdentities(hooksJsonPath);
   if (ours.length === 0)
     return { kind: "none" };
@@ -14312,7 +14439,7 @@ function codexHookTrust(deps = {}) {
     return { kind: "ungated", path: hooksJsonPath, version };
   let trustedHashes = new Map;
   try {
-    trustedHashes = parseCodexTrustedHashes(readFileSync8(deps.userConfigPath ?? resolve9(homedir6(), ".codex", "config.toml"), "utf8"));
+    trustedHashes = parseCodexTrustedHashes(readFileSync8(deps.userConfigPath ?? resolve9(codexHome(), "config.toml"), "utf8"));
   } catch {}
   const untrusted = ours.filter((hook) => trustedHashes.get(hook.key) !== hook.hash).length;
   return untrusted === 0 ? { kind: "trusted", path: hooksJsonPath } : { kind: "untrusted", path: hooksJsonPath, untrusted, total: ours.length };
@@ -14788,6 +14915,10 @@ function settingsPathsFor(integration, scope, cwd) {
   const paths = integration.getSettingsPaths?.(scope, cwd);
   return paths && paths.length > 0 ? paths : [integration.getSettingsPath(scope, cwd)];
 }
+function claudeConfigDir() {
+  const dir = process.env.CLAUDE_CONFIG_DIR?.trim();
+  return dir ? resolve12(dir) : resolve12(homedir9(), ".claude");
+}
 function codexSystemHookEntries(binaryPath) {
   return CODEX_HOOK_EVENT_TYPES.map((eventType) => {
     const entry = codex.buildHookEntry(binaryPath, eventType, "user");
@@ -15490,7 +15621,7 @@ var init_integrations = __esm(() => {
       const base = cwd ? resolve12(cwd) : process.cwd();
       switch (scope) {
         case "user":
-          return resolve12(homedir9(), ".claude", "settings.json");
+          return resolve12(claudeConfigDir(), "settings.json");
         case "project":
           return resolve12(base, ".claude", "settings.json");
         case "local":
@@ -15622,7 +15753,7 @@ var init_integrations = __esm(() => {
       const base = cwd ? resolve12(cwd) : process.cwd();
       switch (scope) {
         case "user":
-          return resolve12(homedir9(), ".codex", "hooks.json");
+          return resolve12(codexHome(), "hooks.json");
         case "project":
           return resolve12(base, ".codex", "hooks.json");
         case "local":
@@ -20503,6 +20634,204 @@ function promptCloudKey(opts) {
     });
   });
 }
+function slowedDown(interval) {
+  return Math.max(interval, Math.min(10, interval + 2));
+}
+function promptBrowserLogin(opts) {
+  const stdin = opts.stdin ?? process.stdin;
+  const stdout = opts.stdout ?? process.stdout;
+  if (!stdin.isTTY || !stdout.isTTY)
+    return Promise.resolve(null);
+  const now = opts.now ?? Date.now;
+  const c = paint(colorsEnabled(stdout));
+  const kit = screenKit({ cols: stdout.columns || 80, color: colorsEnabled(stdout) });
+  const spinnerFrames = "⠋⠙⠹⠸⠼⠴⠦⠧⠇⠏";
+  const region = { lastCount: 0 };
+  let phase = "starting";
+  let failLine = "";
+  let cautionLine = "";
+  let expiresAt = 0;
+  let interval = 2;
+  let frame = 0;
+  let settled = false;
+  let headingShown = false;
+  const above = [];
+  let pollTimer = null;
+  let spinTimer = null;
+  let attempt = 0;
+  const countdown = () => {
+    const left = Math.max(0, Math.ceil((expiresAt - now()) / 1000));
+    return `${Math.floor(left / 60)}:${String(left % 60).padStart(2, "0")}`;
+  };
+  const build = () => {
+    const spin = c.ink3(spinnerFrames[frame % spinnerFrames.length]);
+    switch (phase) {
+      case "starting":
+        return [`${INDENT}${spin} Getting a link…`];
+      case "waiting":
+        return [
+          `${INDENT}${spin} Waiting for you to authorize in the browser  ${c.ink3(`· expires in ${countdown()}`)}`,
+          ...cautionLine ? [kit.caution(cautionLine)] : [],
+          "",
+          kit.keys(["tab more options", "ctrl-c cancel"])
+        ];
+      case "expired":
+        return [kit.fail("That link expired."), "", kit.keys(["enter new link", "tab more options"])];
+      case "denied":
+        return [kit.fail("Not authorized in the browser."), "", kit.keys(["enter try again", "tab more options"])];
+      case "failed":
+        return [kit.fail(failLine), "", kit.keys(["enter try again", "tab more options"])];
+    }
+  };
+  const draw = () => {
+    if (settled)
+      return;
+    repaint(stdout, region, headingShown ? build() : [promptHeading(c, opts.message, opts.meta), ...build()]);
+  };
+  const printAbove = (lines) => {
+    const clear = region.lastCount > 0 ? `${ESC}[${region.lastCount}A${ESC}[J` : "";
+    stdout.write(`${clear}${lines.join(`
+`)}
+`);
+    region.lastCount = 0;
+    above.push(...lines);
+  };
+  const forgetAbove = () => {
+    const cols = stdout.columns || 80;
+    for (const line of above)
+      region.lastCount += Math.max(1, Math.ceil(visibleWidth(line) / cols));
+    above.length = 0;
+    headingShown = false;
+  };
+  const clearPoll = () => {
+    if (pollTimer)
+      clearTimeout(pollTimer);
+    pollTimer = null;
+  };
+  const restoreTerminal = () => showCursor(stdout);
+  return new Promise((resolve) => {
+    const wasRaw = stdin.isRaw;
+    const finish = (answer) => {
+      if (settled)
+        return;
+      clearPoll();
+      if (spinTimer)
+        clearInterval(spinTimer);
+      stdin.removeListener("keypress", onKey);
+      stdin.setRawMode?.(wasRaw ?? false);
+      stdin.pause();
+      process.removeListener("exit", restoreTerminal);
+      if (answer === BACK)
+        forgetAbove();
+      const lines = answer === null ? [c.ink3("cancelled")] : answer === BACK ? [] : opts.collapsed(answer.value);
+      repaint(stdout, region, lines, { cut: false });
+      settled = true;
+      restoreTerminal();
+      resolve(answer);
+    };
+    const schedulePoll = (forAttempt) => {
+      clearPoll();
+      pollTimer = setTimeout(() => void pollOnce(forAttempt), interval * 1000);
+    };
+    const pollOnce = async (forAttempt) => {
+      let answer;
+      try {
+        answer = await opts.poll();
+      } catch (err) {
+        answer = { state: "unreachable", line: err instanceof Error ? err.message : String(err) };
+      }
+      if (settled || forAttempt !== attempt)
+        return;
+      switch (answer.state) {
+        case "approved":
+          return finish({ value: answer.value });
+        case "denied":
+          phase = "denied";
+          return draw();
+        case "expired":
+          phase = "expired";
+          return draw();
+        case "slow_down":
+          interval = slowedDown(interval);
+          break;
+        case "unreachable":
+          cautionLine = `Can't reach the server right now (${answer.line}) — still trying.`;
+          break;
+        case "pending":
+          cautionLine = "";
+          if (answer.interval && answer.interval > 0)
+            interval = answer.interval;
+          break;
+      }
+      if (now() > expiresAt + interval * 1000) {
+        phase = "expired";
+        return draw();
+      }
+      draw();
+      schedulePoll(forAttempt);
+    };
+    const begin = async () => {
+      const mine = ++attempt;
+      clearPoll();
+      cautionLine = "";
+      phase = "starting";
+      forgetAbove();
+      draw();
+      let started;
+      try {
+        started = await opts.start();
+      } catch (err) {
+        started = { ok: false, line: err instanceof Error ? err.message : String(err), retryable: true };
+      }
+      if (settled || mine !== attempt)
+        return;
+      if (!started.ok) {
+        if (!started.retryable)
+          return finish(BACK);
+        phase = "failed";
+        failLine = started.line;
+        return draw();
+      }
+      expiresAt = now() + started.expiresIn * 1000;
+      interval = started.interval > 0 ? started.interval : 2;
+      const opened = opts.open(started.url);
+      printAbove([
+        ...headingShown ? [] : [promptHeading(c, opts.message, opts.meta)],
+        opened ? `${INDENT}Opening your browser to connect ${opts.machineLabel}. If it doesn't open, use this link:` : `${INDENT}Open this link in any browser to connect ${opts.machineLabel}:`,
+        `${INDENT}${c.bold(started.url)}`,
+        ""
+      ]);
+      headingShown = true;
+      phase = "waiting";
+      draw();
+      schedulePoll(mine);
+    };
+    function onKey(_str, key) {
+      if (!key || settled)
+        return;
+      if (key.ctrl && (key.name === "c" || key.name === "d"))
+        return finish(null);
+      if (key.name === "escape" || key.name === "tab")
+        return finish(BACK);
+      if ((key.name === "return" || key.name === "enter") && phase !== "waiting" && phase !== "starting") {
+        begin();
+      }
+    }
+    process.once("exit", restoreTerminal);
+    readline.emitKeypressEvents(stdin);
+    stdin.setRawMode?.(true);
+    stdin.resume();
+    hideCursor(stdout);
+    stdin.on("keypress", onKey);
+    spinTimer = setInterval(() => {
+      frame++;
+      if (phase === "waiting" || phase === "starting")
+        draw();
+    }, 120);
+    spinTimer.unref?.();
+    begin();
+  });
+}
 function ctx(opts) {
   return { cols: Math.max(20, opts?.cols ?? 80), c: paint(opts?.color ?? false) };
 }
@@ -21746,7 +22075,8 @@ function combineTwoTier(verdicts, review, mode) {
     ...cleared.length > 0 && RANK[enforced.final.decision] < RANK[legacy.decision] ? { jevCleared: cleared } : {},
     ...review.latencyMs !== null ? { jevLatencyMs: review.latencyMs } : {},
     ...review.model ? { jevModel: review.model } : {},
-    jevMode: mode
+    jevMode: mode,
+    ...review.checks ? { jevChecks: [...review.checks] } : {}
   };
   if (mode === "observe") {
     const observeVerdict = review.decision === "deny" || review.decision === "instruct" ? {
@@ -21847,6 +22177,12 @@ async function evaluatePolicies(eventType, payload, session, config, twoTier) {
     twoTier.releaseRegistry?.();
     review = await twoTier.review;
   }
+  if (review.kind === "answered" && review.asked.length === 0 && review.decision === "allow" && !review.observedAsked?.length) {
+    return formatVerdict(eventType, session, toolName, regexOnly(collected.verdicts));
+  }
+  if (review.kind === "not-consulted" && twoTier.cloud) {
+    return formatVerdict(eventType, session, toolName, regexOnly(collected.verdicts));
+  }
   const combined = combineTwoTier(collected.verdicts, review, twoTier.mode);
   if (combined.cleared.length > 0) {
     hookLogInfo(`jev ${twoTier.mode === "observe" ? "would clear" : "cleared"}: ${combined.cleared.join(", ")}`);
@@ -21860,7 +22196,8 @@ async function evaluatePolicies(eventType, payload, session, config, twoTier) {
       activity: combined.activity,
       decidedByJev: combined.decidedByJev,
       ...(combined.decidedByJev || combined.observeVerdict) && review.kind === "answered" && review.origin ? { jevOrigin: review.origin } : {},
-      ...combined.observeVerdict ? { observeVerdict: combined.observeVerdict } : {}
+      ...combined.observeVerdict ? { observeVerdict: combined.observeVerdict } : {},
+      ...review.kind === "answered" && review.observedCloud?.length ? { observedCloud: review.observedCloud } : {}
     }
   };
 }
@@ -22862,7 +23199,7 @@ var init_hook_activity_store = __esm(() => {
 });
 
 // src/hooks/delivery-health.ts
-import { existsSync as existsSync19, readdirSync as readdirSync6, statSync as statSync12 } from "node:fs";
+import { existsSync as existsSync19, readFileSync as readFileSync12, readdirSync as readdirSync6, statSync as statSync12 } from "node:fs";
 import { join as join8 } from "node:path";
 function parseParkedName(name) {
   const poison = name.endsWith(POISON_SUFFIX);
@@ -22889,7 +23226,16 @@ function parseParkedName(name) {
   }
   return { base, attempt, clientStatus, poison };
 }
-function deliveryHealth(home, now = Date.now(), connectedAt = home ? undefined : readCredentials().connectedAt) {
+function readLastDeliveredAt(home) {
+  try {
+    const raw = JSON.parse(readFileSync12(collectorHealthFile(home), "utf8"));
+    const ts = raw?.delivery?.last_ok_ts;
+    return typeof ts === "number" && Number.isFinite(ts) && ts > 0 ? ts * 1000 : undefined;
+  } catch {
+    return;
+  }
+}
+function deliveryHealth(home, now = Date.now(), connectedAt = home ? undefined : readCredentials().connectedAt, lastDeliveredAt = home ? undefined : readLastDeliveredAt()) {
   const dir = failedDir(home);
   if (!existsSync19(dir))
     return EMPTY;
@@ -22903,6 +23249,7 @@ function deliveryHealth(home, now = Date.now(), connectedAt = home ? undefined :
   let total = 0;
   let rejected = 0;
   let credentialRejected = 0;
+  let resending = 0;
   let oldestMtime;
   for (const name of entries) {
     if (!name.includes(".jsonl"))
@@ -22916,6 +23263,10 @@ function deliveryHealth(home, now = Date.now(), connectedAt = home ? undefined :
     }
     if (connectedAt !== undefined && parsed.clientStatus !== undefined && CREDENTIAL_STATUSES.has(parsed.clientStatus) && mtime < connectedAt)
       continue;
+    if (lastDeliveredAt !== undefined && parsed.clientStatus !== undefined && CREDENTIAL_STATUSES.has(parsed.clientStatus) && mtime <= lastDeliveredAt) {
+      resending += 1;
+      continue;
+    }
     total += 1;
     if (parsed.clientStatus !== undefined) {
       rejected += 1;
@@ -22931,6 +23282,7 @@ function deliveryHealth(home, now = Date.now(), connectedAt = home ? undefined :
     rejected,
     credentialRejected,
     byStatus,
+    resending,
     ...oldestMtime !== undefined ? { oldestAgeMs: Math.max(0, now - oldestMtime) } : {}
   };
 }
@@ -22966,7 +23318,8 @@ var init_delivery_health = __esm(() => {
     total: 0,
     rejected: 0,
     credentialRejected: 0,
-    byStatus: {}
+    byStatus: {},
+    resending: 0
   };
 });
 
@@ -23662,7 +24015,7 @@ var init_cursor_projects = __esm(() => {
 });
 
 // lib/sqlite-reader.ts
-import { existsSync as existsSync20, readFileSync as readFileSync12, statSync as statSync13 } from "node:fs";
+import { existsSync as existsSync20, readFileSync as readFileSync13, statSync as statSync13 } from "node:fs";
 import initSqlJs from "sql.js/dist/sql-asm.js";
 async function tryNodeSqlite(dbPath) {
   try {
@@ -23775,13 +24128,13 @@ function readPortableSnapshot(dbPath) {
   const walPath = `${dbPath}-wal`;
   for (let attempt = 0;attempt < 3; attempt += 1) {
     const before = fileVersion2(dbPath);
-    const main = readFileSync12(dbPath);
+    const main = readFileSync13(dbPath);
     const afterMain = fileVersion2(dbPath);
     if (!sameVersion(before, afterMain))
       continue;
     let wal = null;
     try {
-      wal = readFileSync12(walPath);
+      wal = readFileSync13(walPath);
     } catch (error) {
       if (error.code !== "ENOENT")
         throw error;
@@ -24868,7 +25221,7 @@ __export(exports_openclaw_projects, {
   getOpenClawSessions: () => getOpenClawSessions,
   openClawProjectPath: () => openClawProjectPath
 });
-import { readFileSync as readFileSync13 } from "node:fs";
+import { readFileSync as readFileSync14 } from "node:fs";
 import { join as join18 } from "node:path";
 function str2(v) {
   return typeof v === "string" && v.length > 0 ? v : undefined;
@@ -24878,7 +25231,7 @@ function readSessionsIndex(agentId) {
   const indexPath = join18(openclawHome(), "agents", agentId, "sessions", "sessions.json");
   let raw;
   try {
-    raw = JSON.parse(readFileSync13(indexPath, "utf-8"));
+    raw = JSON.parse(readFileSync14(indexPath, "utf-8"));
   } catch {
     return out;
   }
@@ -26687,7 +27040,7 @@ var init_log_entries = __esm(() => {
 });
 
 // lib/codex-sessions.ts
-import { readFileSync as readFileSync14, readdirSync as readdirSync10, existsSync as existsSync22, writeFileSync as writeFileSync9, mkdirSync as mkdirSync11, statSync as statSync17 } from "node:fs";
+import { readFileSync as readFileSync15, readdirSync as readdirSync10, existsSync as existsSync22, writeFileSync as writeFileSync9, mkdirSync as mkdirSync11, statSync as statSync17 } from "node:fs";
 import { readFile as readFile11 } from "node:fs/promises";
 import { dirname as dirname13, join as join27 } from "node:path";
 import { homedir as homedir21 } from "node:os";
@@ -26695,7 +27048,7 @@ function readCache() {
   try {
     if (!existsSync22(CACHE_PATH))
       return {};
-    return JSON.parse(readFileSync14(CACHE_PATH, "utf-8"));
+    return JSON.parse(readFileSync15(CACHE_PATH, "utf-8"));
   } catch {
     return {};
   }
@@ -26975,7 +27328,7 @@ var init_codex_sessions = __esm(() => {
 });
 
 // src/hooks/resolve-permission-mode.ts
-import { readFileSync as readFileSync15 } from "node:fs";
+import { readFileSync as readFileSync16 } from "node:fs";
 function resolvePermissionMode(integration, parsed, sessionId) {
   if (integration === "claude") {
     return parsed.permission_mode ?? "default";
@@ -26990,7 +27343,7 @@ function resolveCodexMode(sessionId) {
     const path = findCodexTranscript(sessionId);
     if (!path)
       return;
-    for (const line of readFileSync15(path, "utf-8").split(`
+    for (const line of readFileSync16(path, "utf-8").split(`
 `)) {
       if (!line.includes("turn_context"))
         continue;
@@ -27015,7 +27368,7 @@ var init_resolve_permission_mode = __esm(() => {
 });
 
 // lib/copilot-sessions.ts
-import { readFileSync as readFileSync16, readdirSync as readdirSync11, existsSync as existsSync23, statSync as statSync18 } from "node:fs";
+import { readFileSync as readFileSync17, readdirSync as readdirSync11, existsSync as existsSync23, statSync as statSync18 } from "node:fs";
 import { readFile as readFile12 } from "node:fs/promises";
 import { join as join28, resolve as resolve17, sep as sep2 } from "node:path";
 import { homedir as homedir22 } from "node:os";
@@ -27054,7 +27407,7 @@ function findCopilotWorkspace(sessionId) {
 }
 function readYamlScalar(path, key) {
   try {
-    const text = readFileSync16(path, "utf-8");
+    const text = readFileSync17(path, "utf-8");
     const re = new RegExp(`^${key}\\s*:\\s*(.+?)\\s*$`, "m");
     const m = text.match(re);
     if (!m)
@@ -27232,7 +27585,7 @@ var init_copilot_sessions = __esm(() => {
 });
 
 // lib/cursor-sessions.ts
-import { readFileSync as readFileSync17, readdirSync as readdirSync12, existsSync as existsSync24, statSync as statSync19 } from "node:fs";
+import { readFileSync as readFileSync18, readdirSync as readdirSync12, existsSync as existsSync24, statSync as statSync19 } from "node:fs";
 import { readFile as readFile13 } from "node:fs/promises";
 import { basename as basename6, join as join29, resolve as resolve18, sep as sep3 } from "node:path";
 import { homedir as homedir23 } from "node:os";
@@ -27488,7 +27841,7 @@ var init_cursor_sessions = __esm(() => {
 });
 
 // lib/pi-sessions.ts
-import { readFileSync as readFileSync18, readdirSync as readdirSync13, existsSync as existsSync25, statSync as statSync20 } from "node:fs";
+import { readFileSync as readFileSync19, readdirSync as readdirSync13, existsSync as existsSync25, statSync as statSync20 } from "node:fs";
 import { readFile as readFile14 } from "node:fs/promises";
 import { join as join30, resolve as resolve19, sep as sep4 } from "node:path";
 import { homedir as homedir24 } from "node:os";
@@ -27798,7 +28151,7 @@ var STDIN_TIMEOUT_MS2 = 1e4;
 
 // src/hooks/cloud-policy-errors.ts
 import { randomUUID as randomUUID2 } from "node:crypto";
-import { chmodSync as chmodSync6, existsSync as existsSync26, readFileSync as readFileSync19, renameSync as renameSync8, rmSync as rmSync9, writeFileSync as writeFileSync10 } from "node:fs";
+import { chmodSync as chmodSync6, existsSync as existsSync26, readFileSync as readFileSync20, renameSync as renameSync8, rmSync as rmSync9, writeFileSync as writeFileSync10 } from "node:fs";
 import { homedir as homedir25 } from "node:os";
 import { resolve as resolve20 } from "node:path";
 function isPackDropEntry(e) {
@@ -27835,7 +28188,7 @@ function cloudPolicyErrorsPath() {
 }
 function readCloudPolicyErrors() {
   try {
-    const raw = JSON.parse(readFileSync19(cloudPolicyErrorsPath(), "utf8"));
+    const raw = JSON.parse(readFileSync20(cloudPolicyErrorsPath(), "utf8"));
     if (!Array.isArray(raw.errors))
       return null;
     return raw.errors.filter((e) => !!e && typeof e === "object" && typeof e.id === "string" && typeof e.message === "string" && KINDS.has(e.kind) && (e.version === null || Number.isSafeInteger(e.version)));
@@ -27859,7 +28212,7 @@ function writeCloudPolicyErrors(errors) {
       return "unchanged";
     let current = null;
     try {
-      current = readFileSync19(path, "utf8");
+      current = readFileSync20(path, "utf8");
     } catch {
       current = null;
     }
@@ -27881,7 +28234,7 @@ function cloudLoadCheckedPath() {
 }
 function readCloudLoadChecked() {
   try {
-    const raw = JSON.parse(readFileSync19(cloudLoadCheckedPath(), "utf8"));
+    const raw = JSON.parse(readFileSync20(cloudLoadCheckedPath(), "utf8"));
     if (!Number.isSafeInteger(raw.deployment) || !Array.isArray(raw.checked))
       return null;
     return { deployment: raw.deployment, checked: raw.checked.filter((c) => typeof c === "string") };
@@ -27946,7 +28299,7 @@ function jevBudgetPath() {
 }
 function readJevBudgetRecord() {
   try {
-    const raw = JSON.parse(readFileSync19(jevBudgetPath(), "utf8"));
+    const raw = JSON.parse(readFileSync20(jevBudgetPath(), "utf8"));
     if (typeof raw.machineId !== "string" || !(raw.deployment === null || Number.isSafeInteger(raw.deployment)) || raw.jevMode !== "observe" && raw.jevMode !== "enforce" || !Array.isArray(raw.dropped)) {
       return null;
     }
@@ -27969,7 +28322,7 @@ function installedPackIds() {
     const path = resolve20(packsRoot(), "installed.json");
     if (!existsSync26(path))
       return new Set;
-    const raw = JSON.parse(readFileSync19(path, "utf8"));
+    const raw = JSON.parse(readFileSync20(path, "utf8"));
     if (!Array.isArray(raw.packs))
       return null;
     return new Set(raw.packs.map((p) => p && typeof p === "object" ? p.id : null).filter((id) => typeof id === "string"));
@@ -28164,7 +28517,7 @@ var init_pack_failclosed = __esm(() => {
 });
 
 // src/hooks/session-pause.ts
-import { existsSync as existsSync27, mkdirSync as mkdirSync12, readdirSync as readdirSync14, readFileSync as readFileSync20, rmSync as rmSync10 } from "node:fs";
+import { existsSync as existsSync27, mkdirSync as mkdirSync12, readdirSync as readdirSync14, readFileSync as readFileSync21, rmSync as rmSync10 } from "node:fs";
 import { createHash as createHash8 } from "node:crypto";
 import { join as join31, resolve as resolve21 } from "node:path";
 function pauseStateDir() {
@@ -28233,7 +28586,7 @@ function readActivePause(sessionId, now = Date.now()) {
     const path = pauseFilePath(sessionId);
     if (!existsSync27(path))
       return null;
-    const stored = parseStored(JSON.parse(readFileSync20(path, "utf8")));
+    const stored = parseStored(JSON.parse(readFileSync21(path, "utf8")));
     if (!stored)
       return null;
     if (stored.expiresAt <= now)
@@ -28286,7 +28639,7 @@ function listActivePauses(now = Date.now()) {
     if (!name.endsWith(".json"))
       continue;
     try {
-      const stored = parseStored(JSON.parse(readFileSync20(join31(dir, name), "utf8")));
+      const stored = parseStored(JSON.parse(readFileSync21(join31(dir, name), "utf8")));
       if (!stored || stored.expiresAt <= now)
         continue;
       const { schemaVersion: _ignored, ...pause } = stored;
@@ -28328,7 +28681,7 @@ import {
   copyFileSync as copyFileSync2,
   existsSync as existsSync28,
   mkdirSync as mkdirSync13,
-  readFileSync as readFileSync21,
+  readFileSync as readFileSync22,
   readdirSync as readdirSync15,
   renameSync as renameSync9,
   rmSync as rmSync11,
@@ -28455,7 +28808,7 @@ function retirePolicyConfigKeys() {
   const at = globalPolicyConfigFile();
   let parsed;
   try {
-    const raw = JSON.parse(readFileSync21(at, "utf8"));
+    const raw = JSON.parse(readFileSync22(at, "utf8"));
     if (!raw || typeof raw !== "object" || Array.isArray(raw))
       return [];
     parsed = raw;
@@ -28484,7 +28837,7 @@ function readCarriedPolicyConfig() {
     return null;
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync21(from, "utf8"));
+    parsed = JSON.parse(readFileSync22(from, "utf8"));
   } catch {
     return null;
   }
@@ -28528,7 +28881,7 @@ function writeCarriedPolicyConfig(carried) {
   const to = globalPolicyConfigFile();
   let existing = {};
   try {
-    const parsed = JSON.parse(readFileSync21(to, "utf8"));
+    const parsed = JSON.parse(readFileSync22(to, "utf8"));
     if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
       existing = parsed;
     }
@@ -28547,7 +28900,7 @@ function readCarriedTelemetryOptOut() {
   if (!existsSync28(from))
     return false;
   try {
-    const text = readFileSync21(from, "utf8");
+    const text = readFileSync22(from, "utf8");
     const start = text.search(/^\s*\[telemetry\]\s*$/m);
     if (start === -1)
       return false;
@@ -28602,7 +28955,7 @@ function readCarriedLegacyConfig() {
   if (!existsSync28(from))
     return null;
   try {
-    return projectConfig(parseLegacyToml(readFileSync21(from, "utf8")));
+    return projectConfig(parseLegacyToml(readFileSync22(from, "utf8")));
   } catch {
     return null;
   }
@@ -28611,14 +28964,14 @@ function readCarriedLegacyCredentials() {
   const toml = legacy.credentialsToml();
   if (existsSync28(toml)) {
     try {
-      const creds = projectCredentials(parseLegacyToml(readFileSync21(toml, "utf8")));
+      const creds = projectCredentials(parseLegacyToml(readFileSync22(toml, "utf8")));
       if (Object.keys(creds).length > 0)
         return creds;
     } catch {}
   }
   const readJson = (path) => {
     try {
-      const parsed = JSON.parse(readFileSync21(path, "utf8"));
+      const parsed = JSON.parse(readFileSync22(path, "utf8"));
       return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
     } catch {
       return null;
@@ -28691,7 +29044,7 @@ var init_fp_reset = __esm(() => {
 });
 
 // src/hooks/untraced-note.ts
-import { existsSync as existsSync29, readFileSync as readFileSync22 } from "node:fs";
+import { existsSync as existsSync29, readFileSync as readFileSync23 } from "node:fs";
 import { join as join32 } from "node:path";
 function untracedNotePath(home) {
   return join32(stateDir(home), "untraced-notes.json");
@@ -28704,7 +29057,7 @@ function noteUntracedAgent(cli, sessionId, config) {
     const path = untracedNotePath();
     let seen = [];
     if (existsSync29(path)) {
-      const parsed = JSON.parse(readFileSync22(path, "utf8"));
+      const parsed = JSON.parse(readFileSync23(path, "utf8"));
       if (Array.isArray(parsed))
         seen = parsed.filter((k) => typeof k === "string");
     }
@@ -28726,7 +29079,7 @@ var init_untraced_note = __esm(() => {
 });
 
 // src/hooks/agent-roster.ts
-import { lstatSync as lstatSync4, readFileSync as readFileSync23, statSync as statSync22 } from "node:fs";
+import { lstatSync as lstatSync4, readFileSync as readFileSync24, statSync as statSync22 } from "node:fs";
 import { homedir as homedir26 } from "node:os";
 import { dirname as dirname15, resolve as resolve23 } from "node:path";
 function installedHookAt2(path, cli) {
@@ -28734,7 +29087,7 @@ function installedHookAt2(path, cli) {
     const stat = statSync22(path);
     if (!stat.isFile() || stat.size > 131072)
       return false;
-    const text = readFileSync23(path, "utf8");
+    const text = readFileSync24(path, "utf8");
     if (text.includes("failproofai"))
       return true;
     if (cli !== "pi")
@@ -28762,7 +29115,13 @@ function runtimeAgentSettingsPath2(cli, cwd, userHome = homedir26(), hookScope)
     if (config?.trim())
       return resolve23(config);
     const state = process.env.OPENCLAW_STATE_DIR || process.env.OPENCLAW_HOME;
-    return resolve23(state?.trim() ? state : resolve23(userHome, ".openclaw"), "openclaw.json");
+    if (state?.trim())
+      return resolve23(state, "openclaw.json");
+    const profile = process.env.OPENCLAW_PROFILE?.trim();
+    if (profile && profile !== "default" && /^[A-Za-z0-9._-]{1,80}$/.test(profile) && !profile.startsWith(".")) {
+      return resolve23(userHome, `.openclaw-${profile}`, "openclaw.json");
+    }
+    return resolve23(userHome, ".openclaw", "openclaw.json");
   }
   const relative = USER_SETTINGS2[cli];
   if (!relative)
@@ -28802,7 +29161,7 @@ function readRuntimeAgentIdentity(cli, settingsPath) {
     const stat = lstatSync4(path);
     if (!stat.isFile() || (stat.mode & 63) !== 0 || stat.size > MAX_ROSTER_BYTES)
       return null;
-    const roster = JSON.parse(readFileSync23(path, "utf8"));
+    const roster = JSON.parse(readFileSync24(path, "utf8"));
     if (!roster || typeof roster !== "object" || Array.isArray(roster))
       return null;
     const data = roster;
@@ -28828,7 +29187,7 @@ function readRosterLabels() {
     const stat = lstatSync4(path);
     if (!stat.isFile() || (stat.mode & 63) !== 0 || stat.size > MAX_ROSTER_BYTES)
       return out;
-    const roster = JSON.parse(readFileSync23(path, "utf8"));
+    const roster = JSON.parse(readFileSync24(path, "utf8"));
     if (!roster || typeof roster !== "object" || Array.isArray(roster))
       return out;
     const data = roster;
@@ -28970,13 +29329,6 @@ function providerHostConflict(provider, url) {
     return `${host} is ${known}'s endpoint, not ${provider}'s`;
   return known === "cloudflare" ? `${host} is Cloudflare Workers AI, which provider custom cannot reach — its endpoint is per-account and its answers are wrapped, and a custom endpoint is asked in TypeSafe's own shape at <url>/systemone` : null;
 }
-function isPlainHttp(url) {
-  try {
-    return new URL(url).protocol === "http:";
-  } catch {
-    return false;
-  }
-}
 function originOf(raw) {
   try {
     const url = new URL(raw);
@@ -29114,12 +29466,6 @@ function validateJevConfig(raw, envKey, cloud) {
       return { ok: false, problem: 'mode must be "off", "observe" or "enforce"' };
     cfg.mode = mode;
   }
-  if (cfg.baseUrl !== undefined && isPlainHttp(cfg.baseUrl) && cfg.mode === "enforce") {
-    return {
-      ok: false,
-      problem: "plain http (to localhost) is accepted only with mode observe: in enforce mode Jev's answers can clear a deny, " + "and while the local proxy is down any process on this machine could take its port and answer. " + (cfg.provider === JEV_CLOUD_PROVIDER ? "Reconnect to an https FailproofAI Cloud URL (failproofai config --token <key> --url https://…), or keep mode observe" : "Use https, or mode observe")
-    };
-  }
   return { ok: true, value: cfg };
 }
 function validateLoadedJevConfig(cfg) {
@@ -29566,7 +29912,7 @@ var init_cloud_jev_health = __esm(() => {
 });
 
 // src/hooks/semantic/facts.ts
-import { existsSync as existsSync30, readFileSync as readFileSync24, statSync as statSync24 } from "node:fs";
+import { existsSync as existsSync30, readFileSync as readFileSync25, statSync as statSync24 } from "node:fs";
 import { homedir as homedir27 } from "node:os";
 import { dirname as dirname17, isAbsolute as isAbsolute4, resolve as resolve24 } from "node:path";
 function classifyTool(toolName) {
@@ -29817,13 +30163,13 @@ function readCurrentBranch(cwd) {
       return null;
     let headFile = resolve24(gitPath, "HEAD");
     if (statSync24(gitPath).isFile()) {
-      const pointer = readFileSync24(gitPath, "utf8").trim();
+      const pointer = readFileSync25(gitPath, "utf8").trim();
       const m = /^gitdir:\s*(.+)$/.exec(pointer);
       if (!m)
         return null;
       headFile = resolve24(dirname17(gitPath), m[1], "HEAD");
     }
-    const head = readFileSync24(headFile, "utf8").trim();
+    const head = readFileSync25(headFile, "utf8").trim();
     const ref = /^ref:\s*refs\/heads\/(.+)$/.exec(head);
     return ref ? ref[1] : null;
   } catch {
@@ -30216,7 +30562,7 @@ import {
   mkdirSync as mkdirSync14,
   openSync as openSync4,
   readdirSync as readdirSync16,
-  readFileSync as readFileSync25,
+  readFileSync as readFileSync26,
   readSync as readSync3,
   renameSync as renameSync10,
   statSync as statSync25,
@@ -30266,7 +30612,7 @@ function looseIntentStoreDir() {
 }
 function readIntentFile(sessionId) {
   try {
-    const parsed = JSON.parse(readFileSync25(intentFile(sessionId), "utf8"));
+    const parsed = JSON.parse(readFileSync26(intentFile(sessionId), "utf8"));
     return Array.isArray(parsed?.prompts) ? parsed : { prompts: [] };
   } catch {
     return { prompts: [] };
@@ -31589,7 +31935,11 @@ function parseOutcome(raw, i) {
   if (!origin || typeof origin !== "object" || typeof origin.cloudPolicyId !== "string" || !POLICY_ID_RE2.test(origin.cloudPolicyId) || !Number.isSafeInteger(origin.cloudVersion) || origin.cloudVersion < 0) {
     malformed(`outcome ${i} has no Cloud origin`);
   }
-  return {
+  if (o.effect !== undefined && o.effect !== "enforce" && o.effect !== "observe")
+    malformed(`outcome ${i} has an unknown effect`);
+  if (o.reason !== undefined && o.reason !== null && typeof o.reason !== "string")
+    malformed(`outcome ${i} reason is not text`);
+  const outcome = {
     policy: o.policy,
     mode: o.mode,
     ...typeof o.userCanOverride === "boolean" ? { userCanOverride: o.userCanOverride } : {},
@@ -31603,41 +31953,103 @@ function parseOutcome(raw, i) {
     ...o.intent !== undefined ? { intent: o.intent } : {},
     ...o.targetScanIncomplete === true ? { targetScanIncomplete: true } : {}
   };
+  return {
+    outcome,
+    cloudPolicyId: origin.cloudPolicyId,
+    cloudVersion: origin.cloudVersion,
+    observe: o.effect === "observe",
+    reason: typeof o.reason === "string" ? capReason(o.reason) : null
+  };
+}
+function capReason(reason) {
+  return reason.length > MAX_CLOUD_REASON_CHARS ? `${reason.slice(0, MAX_CLOUD_REASON_CHARS - 1)}…` : reason;
+}
+function observedChecks(parsed, watched = null) {
+  const firing = watched?.parsed.filter((p) => p.outcome.verdict === "deny" || p.outcome.verdict === "instruct") ?? [];
+  const watchedReason = firing.length === 1 && typeof watched?.v.reason === "string" ? capReason(watched.v.reason) : null;
+  const byPolicy = new Map;
+  for (const p of parsed) {
+    const verdict = p.outcome.verdict;
+    if (verdict !== "deny" && verdict !== "instruct")
+      continue;
+    const prev = byPolicy.get(p.cloudPolicyId);
+    if (prev && SEVERITY[prev.decision] >= SEVERITY[verdict])
+      continue;
+    byPolicy.set(p.cloudPolicyId, {
+      cloudPolicyId: p.cloudPolicyId,
+      cloudVersion: p.cloudVersion,
+      check: p.outcome.policy,
+      decision: verdict,
+      reason: p.reason ?? (firing[0] === p ? watchedReason : null) ?? `Flagged by semantic review (semantic/${p.outcome.policy})`
+    });
+  }
+  return [...byPolicy.values()];
 }
-function parseCloudReply(raw) {
-  if (!raw || typeof raw !== "object" || Array.isArray(raw))
-    malformed("no cloud block");
-  const block = raw;
-  const v = block.verdict;
+function parseVerdictBlock(rawVerdict, rawAsked, what) {
+  const v = rawVerdict;
   if (!v || typeof v !== "object" || Array.isArray(v))
-    malformed("no verdict");
+    malformed(`no ${what}`);
   if (typeof v.decision !== "string" || !DECISIONS2.has(v.decision))
-    malformed("verdict has no decision");
+    malformed(`${what} has no decision`);
   if (v.reason !== null && v.reason !== undefined && typeof v.reason !== "string")
-    malformed("verdict reason is not text");
+    malformed(`${what} reason is not text`);
   if (!Array.isArray(v.outcomes) || v.outcomes.length > MAX_LIST)
-    malformed("verdict has no outcomes list");
+    malformed(`${what} has no outcomes list`);
   if (v.beyondTask !== undefined && typeof v.beyondTask !== "boolean")
-    malformed("verdict beyondTask is not a flag");
-  const outcomes = v.outcomes.map(parseOutcome);
-  const asked = names(block.asked, "asked");
+    malformed(`${what} beyondTask is not a flag`);
+  const parsed = v.outcomes.map(parseOutcome);
+  const asked = names(rawAsked, `${what} asked`);
   const askedSet = new Set(asked);
   const seen = new Set;
-  outcomes.forEach((o, i) => {
+  parsed.forEach(({ outcome: o }, i) => {
     if (!askedSet.has(o.policy))
-      malformed(`outcome ${i} answers ${JSON.stringify(o.policy)}, which Cloud did not ask`);
+      malformed(`${what} outcome ${i} answers ${JSON.stringify(o.policy)}, which Cloud did not ask`);
     const key = `${o.origin?.packId ?? ""}\x00${o.policy}`;
     if (seen.has(key))
-      malformed(`outcome ${i} answers ${JSON.stringify(o.policy)} twice`);
+      malformed(`${what} outcome ${i} answers ${JSON.stringify(o.policy)} twice`);
     seen.add(key);
   });
-  if (outcomes.some((o) => o.verdict === "deny") && v.decision !== "deny")
+  return { v, parsed, asked };
+}
+function parseCloudReply(raw, observedPolicies = []) {
+  if (!raw || typeof raw !== "object" || Array.isArray(raw))
+    malformed("no cloud block");
+  const block = raw;
+  const { v, parsed, asked } = parseVerdictBlock(block.verdict, block.asked, "verdict");
+  let watched = null;
+  if (block.observed !== undefined && block.observed !== null) {
+    const o = block.observed;
+    if (typeof o !== "object" || Array.isArray(o))
+      malformed("observed is not an object");
+    watched = parseVerdictBlock(o.verdict, o.asked, "observed verdict");
+    if (watched.parsed.some((p) => p.outcome.verdict === "deny") && watched.v.decision !== "deny") {
+      malformed("an observed check denied but its verdict does not");
+    }
+  }
+  const observeIds = new Set(observedPolicies);
+  const isObserved = (p) => p.observe || observeIds.has(p.cloudPolicyId);
+  const enforced = parsed.filter((p) => !isObserved(p)).map((p) => p.outcome);
+  const observedHere = parsed.filter(isObserved);
+  const observed = [...observedHere, ...watched?.parsed ?? []];
+  if (enforced.some((o) => o.verdict === "deny") && v.decision !== "deny")
     malformed("a check denied but the verdict does not");
+  const cloudReason = typeof v.reason === "string" ? capReason(v.reason) : null;
+  let decision = v.decision;
+  let reason = cloudReason;
+  if (observedHere.length > 0) {
+    const own = enforced.some((o) => o.verdict === "deny") ? "deny" : enforced.some((o) => o.verdict === "instruct") || v.beyondTask === true ? "instruct" : "allow";
+    const capped = RANK2[own] <= RANK2[decision] ? own : decision;
+    if (capped !== decision)
+      reason = null;
+    decision = capped;
+  }
   return {
+    observed: observedChecks(observed, watched),
+    observedAsked: [...observedHere.map((p) => p.outcome.policy), ...watched?.asked ?? []],
     verdict: {
-      decision: v.decision,
-      reason: typeof v.reason === "string" ? v.reason.length > MAX_CLOUD_REASON_CHARS ? `${v.reason.slice(0, MAX_CLOUD_REASON_CHARS - 1)}…` : v.reason : null,
-      outcomes,
+      decision,
+      reason,
+      outcomes: enforced,
       injectionSuspected: nullableProbability(v.injectionSuspected, "injectionSuspected"),
       scopeWithinRequest: nullableProbability(v.scopeWithinRequest, "scopeWithinRequest"),
       beyondTask: v.beyondTask === true
@@ -31647,6 +32059,29 @@ function parseCloudReply(raw) {
     droppedCloud: names(block.droppedCloud, "droppedCloud")
   };
 }
+function parseObservedOutcomes(raw) {
+  try {
+    const block = raw?.observed;
+    if (!block || typeof block !== "object" || Array.isArray(block))
+      return [];
+    const asked = new Set(names(block.asked, "observed.asked"));
+    const outcomes = block.verdict?.outcomes ?? [];
+    if (!Array.isArray(outcomes) || outcomes.length > MAX_LIST)
+      return [];
+    const seen = new Set;
+    const out = [];
+    outcomes.forEach((o, i) => {
+      const parsed = parseOutcome(o, i).outcome;
+      if (!asked.has(parsed.policy) || seen.has(parsed.policy))
+        return;
+      seen.add(parsed.policy);
+      out.push(parsed);
+    });
+    return out;
+  } catch {
+    return [];
+  }
+}
 function joinLines(reasons) {
   const lines = [];
   for (const reason of reasons) {
@@ -31693,6 +32128,22 @@ function expectedQuestions(request, prepared, dropped) {
   }));
   return { ...request, questions };
 }
+function cloudCheckAnswers(response, asked) {
+  const out = {};
+  if (asked.length === 0)
+    return out;
+  const names = new Set(asked);
+  const answers = response.answers && typeof response.answers === "object" ? response.answers : {};
+  for (const [id, a] of Object.entries(answers)) {
+    const dot = id.lastIndexOf(".");
+    if (dot <= 0 || !names.has(id.slice(0, dot)) || !QUESTION_PART_RE.test(id.slice(dot + 1)))
+      continue;
+    const p = a?.noul;
+    if (isProbability(p))
+      out[id] = p;
+  }
+  return out;
+}
 function presentAnswers(response) {
   const out = {};
   const answers = response.answers && typeof response.answers === "object" ? response.answers : {};
@@ -31721,7 +32172,7 @@ async function evaluateCloudSemantic(input, opts) {
       model: opts.model ?? DEFAULT_JEV_MODEL,
       modelVerified: true,
       via: "none",
-      cloud: { asked: [], droppedLocal: [], droppedCloud: [] }
+      cloud: { asked: [], droppedLocal: [], droppedCloud: [], answers: {}, observed: [], observedAsked: [], observedOutcomes: [] }
     };
   }
   let prepared;
@@ -31762,11 +32213,13 @@ async function evaluateCloudSemantic(input, opts) {
     const timeout = AbortSignal.timeout(opts.timeoutMs ?? envNumber2("FAILPROOFAI_JEV_TIMEOUT_MS", DEFAULT_JEV_TIMEOUT_MS));
     const signal = opts.signal ? AbortSignal.any([timeout, opts.signal]) : timeout;
     const response = await transport(request, signal);
-    const reply = parseCloudReply(response.cloud);
+    const reply = parseCloudReply(response.cloud, opts.observedPolicies);
+    const observedAsked = new Set(reply.observedAsked);
+    const observedOutcomes = parseObservedOutcomes(response.cloud).filter((o) => observedAsked.has(o.policy));
     const own = new Map(prepared.selected.map((p) => [p.name, p]));
     const dropped = new Set(reply.droppedLocal.filter((name) => own.has(name)));
     const kept = prepared.selected.filter((p) => !dropped.has(p.name));
-    const shortCircuit = kept.length === 0 && reply.asked.length === 0 && reply.verdict.outcomes.length === 0;
+    const shortCircuit = kept.length === 0 && reply.asked.length === 0 && reply.verdict.outcomes.length === 0 && reply.observedAsked.length === 0;
     const answers = shortCircuit ? presentAnswers(response) : readAnswers(expectedQuestions(request, prepared, dropped), response);
     const local = prepared.intent === "v1" ? decideV1(kept, answers, input.toolInput, prepared.userSaid, prepared.agentLastMessage, {
       ...opts.v1,
@@ -31788,7 +32241,11 @@ async function evaluateCloudSemantic(input, opts) {
       cloud: {
         asked: reply.asked,
         droppedLocal: [...dropped].map((name) => ({ name, packId: own.get(name)?.origin?.packId ?? null })),
-        droppedCloud: reply.droppedCloud
+        droppedCloud: reply.droppedCloud,
+        answers: cloudCheckAnswers(response, [...reply.asked, ...reply.observedAsked]),
+        observed: reply.observed,
+        observedAsked: reply.observedAsked,
+        observedOutcomes
       }
     };
   } catch (err) {
@@ -31801,7 +32258,7 @@ async function evaluateCloudSemantic(input, opts) {
     return degraded(`error: ${err instanceof Error ? err.message : String(err)}`);
   }
 }
-var CLOUD_BLOCK_VERSION = 1, MAX_TARGET_SCAN_CHARS = 64000, MAX_CLOUD_BLOCK_BYTES = 240000, blockBytes = (block) => Buffer.byteLength(JSON.stringify(block), "utf8"), REDACTED_TARGET_WORD = "\x00redacted", MAX_SECRET_SCAN_CHARS, REDACTION_MARKER, REDACTED_SAID = "\x00", POLICY_ID_RE2, MAX_NAME_CHARS = 256, MAX_LIST = 4096, MAX_CLOUD_REASON_CHARS = 8192, isProbability = (v) => typeof v === "number" && Number.isFinite(v) && v >= 0 && v <= 1, isName2 = (v) => typeof v === "string" && v.length > 0 && v.length <= MAX_NAME_CHARS, DECISIONS2, VERDICTS, INTENTS, RANK2, EMPTY_ALLOW;
+var CLOUD_BLOCK_VERSION = 1, MAX_TARGET_SCAN_CHARS = 64000, MAX_CLOUD_BLOCK_BYTES = 240000, blockBytes = (block) => Buffer.byteLength(JSON.stringify(block), "utf8"), REDACTED_TARGET_WORD = "\x00redacted", MAX_SECRET_SCAN_CHARS, REDACTION_MARKER, REDACTED_SAID = "\x00", POLICY_ID_RE2, MAX_NAME_CHARS = 256, MAX_LIST = 4096, MAX_CLOUD_REASON_CHARS = 8192, isProbability = (v) => typeof v === "number" && Number.isFinite(v) && v >= 0 && v <= 1, isName2 = (v) => typeof v === "string" && v.length > 0 && v.length <= MAX_NAME_CHARS, DECISIONS2, VERDICTS, INTENTS, SEVERITY, RANK2, EMPTY_ALLOW, QUESTION_PART_RE;
 var init_cloud_jev = __esm(() => {
   init_compile();
   init_decide();
@@ -31817,6 +32274,7 @@ var init_cloud_jev = __esm(() => {
   DECISIONS2 = new Set(["allow", "deny", "instruct"]);
   VERDICTS = new Set(["deny", "instruct", "overridden", "none"]);
   INTENTS = new Set(["op-requested", "task-step", "downgraded-task-step"]);
+  SEVERITY = { instruct: 1, deny: 2 };
   RANK2 = { allow: 0, instruct: 1, deny: 2 };
   EMPTY_ALLOW = {
     decision: "allow",
@@ -31826,6 +32284,7 @@ var init_cloud_jev = __esm(() => {
     scopeWithinRequest: null,
     beyondTask: false
   };
+  QUESTION_PART_RE = /^[a-z][a-z0-9_]{0,31}$/;
 });
 
 // src/hooks/semantic/jev-throttle.ts
@@ -32038,7 +32497,7 @@ var init_jev_throttle = __esm(() => {
 });
 
 // src/hooks/semantic/session-root.ts
-import { mkdirSync as mkdirSync16, readdirSync as readdirSync17, readFileSync as readFileSync26, statSync as statSync27, unlinkSync as unlinkSync5, writeFileSync as writeFileSync13 } from "node:fs";
+import { mkdirSync as mkdirSync16, readdirSync as readdirSync17, readFileSync as readFileSync27, statSync as statSync27, unlinkSync as unlinkSync5, writeFileSync as writeFileSync13 } from "node:fs";
 import { isAbsolute as isAbsolute5, resolve as resolve27 } from "node:path";
 function validRoot(v) {
   return typeof v === "string" && isAbsolute5(v) && resolve27(v) === v && v !== "/";
@@ -32057,7 +32516,7 @@ function storeIsOurs() {
 }
 function readPinned(sessionId) {
   try {
-    const parsed = JSON.parse(readFileSync26(rootFile(sessionId), "utf8"));
+    const parsed = JSON.parse(readFileSync27(rootFile(sessionId), "utf8"));
     return validRoot(parsed?.root) ? parsed.root : null;
   } catch {
     return null;
@@ -32161,6 +32620,55 @@ function fallbackCode(reason) {
   const code = reason.split(":")[0].trim();
   return /^[a-z0-9][a-z0-9-]{0,63}$/.test(code) ? code : "error";
 }
+function checkWhy(o) {
+  switch (o.verdict) {
+    case "none":
+      return o.evidence < DEFAULT_THRESHOLDS_V1.fire ? "not-detected" : "exempt";
+    case "overridden":
+      return o.intent === "op-requested" ? "op-requested" : o.intent === "task-step" ? "task-step" : "user-asked";
+    case "deny":
+      return o.escalatedByInjection ? "injection" : "fired";
+    default:
+      if (o.intent === "downgraded-task-step")
+        return "downgraded";
+      return o.targetScanIncomplete ? "scan-incomplete" : "fired";
+  }
+}
+function checkPolicy(o) {
+  const packId = o.origin?.packId;
+  if (!packId)
+    return;
+  const at = o.origin?.packVersion ? `@${o.origin.packVersion}` : "";
+  return packId.startsWith("cloud:") ? `cloud/${packId.slice("cloud:".length)}${at}` : `pack/${packId}${at}`;
+}
+function checkRecords(outcomes, answers, watched = []) {
+  const all = [...outcomes.map((o) => ({ o, watched: false })), ...watched.map((o) => ({ o, watched: true }))];
+  return all.slice(0, JEV_CHECKS_MAX).map(({ o, watched: isWatched }) => {
+    const probes = {};
+    const prefix = `${o.policy}.`;
+    for (const [id, p] of Object.entries(answers)) {
+      if (Object.keys(probes).length >= JEV_CHECK_PROBES_MAX)
+        break;
+      if (!id.startsWith(prefix))
+        continue;
+      const part = id.slice(prefix.length);
+      if (part === "exempt" || part === "user_asked" || !JEV_PROBE_ID_RE.test(part))
+        continue;
+      probes[part] = round2(p);
+    }
+    const policy = checkPolicy(o);
+    return {
+      check: o.policy,
+      ...policy ? { policy } : {},
+      verdict: o.verdict,
+      why: checkWhy(o),
+      p: round2(o.evidence),
+      ...o.exempt !== null ? { exempt: round2(o.exempt) } : {},
+      ...Object.keys(probes).length > 0 ? { probes } : {},
+      ...isWatched ? { watched: true } : {}
+    };
+  });
+}
 function toReview(outcome, cached = false) {
   if (outcome.status === "degraded") {
     return { kind: "fallback", reason: fallbackCode(outcome.reason), latencyMs: outcome.latencyMs, model: null };
@@ -32169,15 +32677,19 @@ function toReview(outcome, cached = false) {
   const latencyMs = sent && !cached ? outcome.latencyMs : null;
   const model = sent ? outcome.model : null;
   const outcomes = outcome.verdict.outcomes;
-  const cloudAsked = "cloud" in outcome ? new Set(outcome.cloud.asked) : null;
+  const cloudSummary = "cloud" in outcome ? outcome.cloud : null;
+  const cloudAsked = cloudSummary ? new Set(cloudSummary.asked) : null;
   const unvouched = outcomes.some((o) => isCloudOutcome(o) && !(cloudAsked?.has(o.policy) ?? false));
   if (unvouched)
     return { kind: "fallback", reason: "malformed", latencyMs, model: null };
   const injection = sent ? outcome.verdict.injectionSuspected : null;
   const warned = (o) => o.verdict === "instruct" && o.intent !== "downgraded-task-step";
+  const cloudAnswers = cloudSummary?.answers ?? {};
+  const watched = cloudSummary?.observedOutcomes ?? [];
   return {
     kind: "answered",
     decision: outcome.verdict.decision,
+    checks: sent ? checkRecords(outcomes, { ...outcome.answers, ...cloudAnswers }, watched) : [],
     reason: outcome.verdict.reason,
     policyName: jevPolicyName(outcome),
     ...jevDecider(outcome)?.origin ? { origin: jevDecider(outcome)?.origin } : {},
@@ -32189,7 +32701,16 @@ function toReview(outcome, cached = false) {
     truncated: outcome.truncated && sent,
     requestCut: outcome.requestCut && sent,
     latencyMs,
-    model
+    model,
+    ...sent && cloudSummary?.observedAsked?.length ? { observedAsked: cloudSummary.observedAsked } : {},
+    ...cloudSummary?.observed?.length ? {
+      observedCloud: cloudSummary.observed.map((o) => ({
+        cloudPolicyId: o.cloudPolicyId,
+        cloudVersion: o.cloudVersion,
+        decision: o.decision,
+        reason: o.reason
+      }))
+    } : {}
   };
 }
 function toolInputRecord(raw) {
@@ -32208,7 +32729,8 @@ function startJevReview(cfg, call) {
       if (!settled)
         controller.abort();
     },
-    authorityOf
+    authorityOf,
+    ...call.cloud ? { cloud: true } : {}
   });
   let route;
   let throttled;
@@ -32270,6 +32792,7 @@ function startJevReview(cfg, call) {
     ...options,
     machineId: cloud.machineId,
     agent: cloud.agent,
+    observedPolicies: cloud.observedPolicies ?? [],
     ...call.localPaused ? { policies: [] } : {}
   }) : evaluateSemantic(input, options);
   const answered = evaluated.then((outcome) => {
@@ -32331,6 +32854,7 @@ var init_jev_review = __esm(() => {
   init_jev_config();
   init_jev_throttle();
   init_session_root();
+  init_jev_activity();
   throttle = exports_jev_throttle;
   intentReader = exports_intent;
   ALWAYS_ON = new Set(BUILTIN_POLICIES.filter((p) => p.alwaysOn).map((p) => normalizePolicyName(p.name)));
@@ -32544,7 +33068,13 @@ async function readJevConfig(agent) {
       return {
         config: resolved.config,
         defaultMode: DEFAULT_JEV_MODE,
-        cloud: { machineId: resolved.machineId, deployment: cloud.deployment, mode: cloud.jevMode, agent: agent ?? null }
+        cloud: {
+          machineId: resolved.machineId,
+          deployment: cloud.deployment,
+          mode: cloud.jevMode,
+          agent: agent ?? null,
+          observedPolicies: (cloudJevAssignmentsFor(agent ?? null) ?? []).filter((a) => a.effect === "observe").map((a) => a.id)
+        }
       };
     }
     if (!existsSync31(jevConfigFile()))
@@ -32618,6 +33148,8 @@ async function startTwoTier(canonicalEventType, parsed, session, cli, opts, acti
     return null;
   if (!cloudAsks && !jevChecksInstalled())
     return null;
+  if (cloudAsks && cloudJevAssignmentsFor(agent)?.length === 0 && (activePause || !packJevChecksInstalled()))
+    return null;
   const loaded = await readJevConfig(agent);
   if (!loaded)
     return null;
@@ -32941,6 +33473,9 @@ async function evaluateHookEvent(eventType, cli = "claude", stdinPayload, opts)
         reason: observeVerdict.reason
       });
     }
+    for (const o of result.twoTier?.observedCloud ?? []) {
+      observedResults.push({ policyId: o.cloudPolicyId, version: o.cloudVersion, decision: o.decision, reason: o.reason });
+    }
     const durationMs = Math.round(performance.now() - startTime);
     hookLogInfo(`result=${result.decision} policy=${result.policyName ?? "none"} duration=${durationMs}ms`);
     await captureJevIntent(canonicalEventType, result.decision, parsed, session, cli, opts);
@@ -34070,7 +34605,7 @@ import {
   copyFileSync as copyFileSync3,
   existsSync as existsSync33,
   mkdirSync as mkdirSync18,
-  readFileSync as readFileSync27,
+  readFileSync as readFileSync28,
   renameSync as renameSync12,
   rmSync as rmSync12,
   writeFileSync as writeFileSync15
@@ -34140,7 +34675,7 @@ function planMigration(from, registry = MIGRATIONS) {
 }
 function readLedger() {
   try {
-    const parsed = JSON.parse(readFileSync27(migrationLedgerFile(), "utf8"));
+    const parsed = JSON.parse(readFileSync28(migrationLedgerFile(), "utf8"));
     return Array.isArray(parsed) ? parsed : [];
   } catch {
     return [];
@@ -34449,7 +34984,7 @@ var init_fp_reset2 = __esm(() => {
 // scripts/install-telemetry.mjs
 import { createHmac, randomUUID as randomUUID3 } from "node:crypto";
 import { execSync as execSync6 } from "node:child_process";
-import { readFileSync as readFileSync28, writeFileSync as writeFileSync16, mkdirSync as mkdirSync19 } from "node:fs";
+import { readFileSync as readFileSync29, writeFileSync as writeFileSync16, mkdirSync as mkdirSync19 } from "node:fs";
 import { homedir as homedir28, platform, arch, hostname, cpus } from "node:os";
 import { join as join35 } from "node:path";
 function hashToId3(raw) {
@@ -34459,7 +34994,7 @@ function getInstanceId3() {
   const idDir = join35(homedir28(), ".failproofai");
   const idFile = join35(idDir, "instance-id");
   try {
-    const existing = readFileSync28(idFile, "utf-8").trim();
+    const existing = readFileSync29(idFile, "utf-8").trim();
     if (existing)
       return existing;
   } catch {}
@@ -34468,7 +35003,7 @@ function getInstanceId3() {
     if (p === "linux") {
       for (const machineIdPath of ["/etc/machine-id", "/var/lib/dbus/machine-id"]) {
         try {
-          const id = readFileSync28(machineIdPath, "utf-8").trim();
+          const id = readFileSync29(machineIdPath, "utf-8").trim();
           if (id)
             return hashToId3(id);
         } catch {}
@@ -34533,7 +35068,7 @@ var NAMESPACE3 = "failproofai-telemetry-v1", API_KEY3 = "phc_Ac1Ww1GqKc0z1SyrRWb
 var init_install_telemetry = () => {};
 
 // lib/install-check.ts
-import { existsSync as existsSync34, readFileSync as readFileSync29, writeFileSync as writeFileSync17, mkdirSync as mkdirSync20 } from "node:fs";
+import { existsSync as existsSync34, readFileSync as readFileSync30, writeFileSync as writeFileSync17, mkdirSync as mkdirSync20 } from "node:fs";
 import { dirname as dirname21, resolve as resolve29 } from "node:path";
 import { platform as platform2, arch as arch2, release, homedir as homedir29, hostname as hostname2 } from "node:os";
 import { createHmac as createHmac2 } from "node:crypto";
@@ -34594,7 +35129,7 @@ function checkHooks() {
   }
   let config;
   try {
-    config = JSON.parse(readFileSync29(hooksConfigPath, "utf8"));
+    config = JSON.parse(readFileSync30(hooksConfigPath, "utf8"));
   } catch {
     return { configured: false, registered: false, policyCount: 0 };
   }
@@ -34607,7 +35142,7 @@ function checkHooks() {
     return { configured: true, registered: false, policyCount };
   let settings;
   try {
-    settings = JSON.parse(readFileSync29(settingsPath, "utf8"));
+    settings = JSON.parse(readFileSync30(settingsPath, "utf8"));
   } catch {
     return { configured: true, registered: false, policyCount };
   }
@@ -34632,7 +35167,7 @@ async function maybeReportInstall(version) {
     let previousVersion = null;
     try {
       if (existsSync34(versionFile)) {
-        previousVersion = readFileSync29(versionFile, "utf8").trim() || null;
+        previousVersion = readFileSync30(versionFile, "utf8").trim() || null;
       }
     } catch {}
     if (previousVersion === version)
@@ -34705,6 +35240,196 @@ var init_first_run_gate = __esm(() => {
   ];
 });
 
+// src/hooks/cloud-login.ts
+async function postJson2(origin, path, body, fetchImpl) {
+  const controller = new AbortController;
+  const timer = setTimeout(() => controller.abort(), TIMEOUT_MS);
+  try {
+    const res = await fetchImpl(`${origin.replace(/\/+$/, "")}${path}`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(body),
+      redirect: "manual",
+      signal: controller.signal
+    });
+    let json = null;
+    try {
+      const parsed = await res.json();
+      json = parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
+    } catch {
+      json = null;
+    }
+    return { status: res.status, json };
+  } catch (err) {
+    return { error: err instanceof Error ? err.name === "AbortError" ? "timed out" : err.message : String(err) };
+  } finally {
+    clearTimeout(timer);
+  }
+}
+function displayText(v, max = 200) {
+  if (typeof v !== "string")
+    return;
+  const t = v.replace(INVISIBLE, "").trim().slice(0, max);
+  return t.length > 0 ? t : undefined;
+}
+function org(v) {
+  const o = v && typeof v === "object" ? v : {};
+  return { id: str3(o.id), slug: displayText(o.slug), name: displayText(o.name) };
+}
+function permissions(v) {
+  return Array.isArray(v) ? v.map((p) => displayText(p, 64)).filter((p) => p !== undefined) : [];
+}
+function isOpenableUrl(raw) {
+  try {
+    const u = new URL(raw);
+    return u.protocol === "https:" || u.protocol === "http:";
+  } catch {
+    return false;
+  }
+}
+function machineOs(platform = process.platform) {
+  return platform === "darwin" ? "macOS" : platform === "win32" ? "windows" : platform;
+}
+async function startLogin(origin, machine, fetchImpl = fetch) {
+  const r = await postJson2(origin, LOGIN_START_PATH, { machine_label: machine.label, machine_os: machine.os, cli_version: machine.cliVersion }, fetchImpl);
+  if ("error" in r)
+    return { kind: "unreachable", reason: r.error };
+  if (r.status === 404 || r.status >= 300 && r.status < 400 || r.status === 200 && !r.json) {
+    return { kind: "unsupported" };
+  }
+  if (r.status === 429)
+    return { kind: "refused", reason: "too many login attempts from here — wait a minute" };
+  if (r.status !== 201 || !r.json) {
+    return r.status >= 500 ? { kind: "unreachable", reason: `the server answered ${r.status}` } : { kind: "refused", reason: displayText(r.json?.error, 120) ?? `the server answered ${r.status}` };
+  }
+  const verificationUrl = str3(r.json.verification_url);
+  const pollSecret = str3(r.json.poll_secret);
+  if (!verificationUrl || !pollSecret || !isOpenableUrl(verificationUrl)) {
+    return { kind: "unsupported" };
+  }
+  return {
+    kind: "ok",
+    verificationUrl: new URL(verificationUrl).href,
+    pollSecret,
+    expiresIn: within(r.json.expires_in, 30, 3600, 600),
+    interval: within(r.json.interval, 1, 30, 2)
+  };
+}
+async function pollLogin(origin, pollSecret, fetchImpl = fetch) {
+  const r = await postJson2(origin, LOGIN_POLL_PATH, { poll_secret: pollSecret }, fetchImpl);
+  if ("error" in r)
+    return { kind: "unreachable", reason: r.error };
+  if (r.status === 404)
+    return { kind: "unknown" };
+  if (r.status !== 200 || !r.json)
+    return { kind: "unreachable", reason: `the server answered ${r.status}` };
+  const j = r.json;
+  switch (j.status) {
+    case "pending":
+      return { kind: "pending", interval: typeof j.interval === "number" ? within(j.interval, 1, 30, 2) : undefined };
+    case "slow_down":
+      return { kind: "slow_down" };
+    case "approved":
+      return {
+        kind: "approved",
+        org: org(j.org),
+        approvedBy: displayText(j.approved_by),
+        keyName: displayText(j.key_name),
+        permissions: permissions(j.permissions)
+      };
+    case "denied":
+      return { kind: "denied" };
+    case "expired":
+      return { kind: "expired" };
+    case "claimed":
+      return { kind: "claimed" };
+    default:
+      return { kind: "unknown" };
+  }
+}
+async function claimLogin(origin, pollSecret, fetchImpl = fetch) {
+  const r = await postJson2(origin, LOGIN_CLAIM_PATH, { poll_secret: pollSecret }, fetchImpl);
+  if ("error" in r)
+    return { kind: "unreachable", reason: r.error };
+  const j = r.json ?? {};
+  if (r.status === 201) {
+    const key = str3(j.api_key);
+    if (!key)
+      return { kind: "refused", reason: "the server answered without a key" };
+    return {
+      kind: "ok",
+      key,
+      keyId: str3(j.key_id),
+      keyName: displayText(j.key_name),
+      org: org(j.org),
+      permissions: permissions(j.permissions),
+      approvedBy: displayText(j.approved_by)
+    };
+  }
+  if (r.status === 410)
+    return { kind: "expired" };
+  if (r.status === 403 && j.error === "approval_revoked")
+    return { kind: "revoked" };
+  if (r.status >= 500)
+    return { kind: "unreachable", reason: `the server answered ${r.status}` };
+  return {
+    kind: "refused",
+    reason: displayText(j.status, 40) ? `the login request is ${displayText(j.status, 40)}` : `the server answered ${r.status}`
+  };
+}
+var LOGIN_START_PATH = "/api/auth/cli/start", LOGIN_POLL_PATH = "/api/auth/cli/poll", LOGIN_CLAIM_PATH = "/api/auth/cli/claim", TIMEOUT_MS = 1e4, str3 = (v) => typeof v === "string" && v.length > 0 ? v : undefined, INVISIBLE, within = (v, lo, hi, fallback) => typeof v === "number" && Number.isFinite(v) && v > 0 ? Math.min(hi, Math.max(lo, v)) : fallback;
+var init_cloud_login = __esm(() => {
+  INVISIBLE = /[\u0000-\u001f\u007f-\u009f\u061c\u180e\u200b-\u200f\u202a-\u202e\u2060-\u2069\ufeff]/g;
+});
+
+// src/audit/open-browser.ts
+import { spawn } from "node:child_process";
+function canOpenBrowser(env = process.env, platform = process.platform) {
+  if (env.SSH_CONNECTION || env.SSH_CLIENT || env.SSH_TTY)
+    return false;
+  if (platform === "linux" && !env.DISPLAY && !env.WAYLAND_DISPLAY)
+    return false;
+  return true;
+}
+function openUrl(url, platform = process.platform) {
+  let cmd;
+  let args;
+  if (platform === "darwin") {
+    cmd = "open";
+    args = [url];
+  } else if (platform === "win32") {
+    cmd = "rundll32.exe";
+    args = ["url.dll,FileProtocolHandler", url];
+  } else {
+    cmd = "xdg-open";
+    args = [url];
+  }
+  try {
+    const child = spawn(cmd, args, { stdio: "ignore", detached: true });
+    child.on("error", () => {});
+    child.unref();
+  } catch {}
+}
+function openWhenReady(port, path) {
+  const base = `http://localhost:${port}`;
+  const target = `${base}${path}`;
+  (async () => {
+    const deadline = Date.now() + POLL_TIMEOUT_MS;
+    while (Date.now() < deadline) {
+      try {
+        await fetch(base, { method: "GET", redirect: "manual" });
+        openUrl(target);
+        return;
+      } catch {
+        await new Promise((r) => setTimeout(r, POLL_INTERVAL_MS));
+      }
+    }
+    openUrl(target);
+  })();
+}
+var POLL_INTERVAL_MS = 150, POLL_TIMEOUT_MS = 30000;
+var init_open_browser = () => {};
+
 // src/cli-error.ts
 var CliError;
 var init_cli_error = __esm(() => {
@@ -34719,7 +35444,7 @@ var init_cli_error = __esm(() => {
 });
 
 // src/hooks/backfill-request.ts
-import { existsSync as existsSync35, readFileSync as readFileSync30 } from "node:fs";
+import { existsSync as existsSync35, readFileSync as readFileSync31 } from "node:fs";
 import { join as join36 } from "node:path";
 function backfillRequestPath(home) {
   return join36(failproofaiHome(home), "state", "backfill-request.json");
@@ -34771,7 +35496,7 @@ function writeBackfillRequest(next, home) {
   let pending = null;
   if (existsSync35(path)) {
     try {
-      pending = readPendingRequest(JSON.parse(readFileSync30(path, "utf8")), next.requestedAtMs);
+      pending = readPendingRequest(JSON.parse(readFileSync31(path, "utf8")), next.requestedAtMs);
     } catch {
       pending = null;
     }
@@ -35033,6 +35758,34 @@ function integrationsInstalledAt(scope, cwd) {
     }
   });
 }
+function cloudPolicyStatus() {
+  let count = 0;
+  let observing = false;
+  const jsIds = new Set;
+  try {
+    for (const artifact of listActiveCloudManagedPolicies()) {
+      jsIds.add(artifact.id);
+      if (artifact.effect === "observe")
+        observing = true;
+      else
+        count++;
+    }
+  } catch {}
+  try {
+    const { jevMode } = readCloudJevState();
+    if (jevMode === "enforce" || jevMode === "observe") {
+      for (const assignment of readCloudJevAssignments() ?? []) {
+        if (jsIds.has(assignment.id))
+          continue;
+        if (jevMode === "observe" || assignment.effect === "observe")
+          observing = true;
+        else
+          count++;
+      }
+    }
+  } catch {}
+  return { count, observing };
+}
 function notEnforcingReason(cwd) {
   const wired = deduplicateScopes(HOOK_SCOPES, cwd).some((scope) => hooksInstalledInSettings(scope, cwd));
   if (!wired)
@@ -35055,14 +35808,10 @@ function notEnforcingReason(cwd) {
         return null;
     }
   } catch {}
-  try {
-    for (const artifact of listActiveCloudManagedPolicies()) {
-      if (artifact.effect === "observe")
-        observing = true;
-      else
-        return null;
-    }
-  } catch {}
+  const cloud = cloudPolicyStatus();
+  if (cloud.count > 0)
+    return null;
+  observing ||= cloud.observing;
   if (configuredCustomPolicyPaths(config).length > 0)
     return null;
   const projectDir = resolve30(findProjectConfigDir(cwd ?? process.cwd()), ".failproofai", "policies");
@@ -35085,12 +35834,7 @@ function enforcingPolicyCount(cwd) {
       count += taken.filter((name) => !disabled.has(`pack:${pack.id}@${pack.version}:${name}`)).length;
     }
   } catch {}
-  try {
-    for (const artifact of listActiveCloudManagedPolicies()) {
-      if (artifact.effect !== "observe")
-        count++;
-    }
-  } catch {}
+  count += cloudPolicyStatus().count;
   if (!hasInstalledRegexPacks())
     count += config.enabledPolicies.length;
   const projectDir = resolve30(findProjectConfigDir(cwd ?? process.cwd()), ".failproofai", "policies");
@@ -35569,6 +36313,136 @@ var init_manager = __esm(() => {
   VALID_POLICY_NAMES = new Set(BUILTIN_POLICIES.map((p) => p.name));
 });
 
+// src/hooks/agent-skill.ts
+import { existsSync as existsSync38, mkdirSync as mkdirSync21, rmdirSync as rmdirSync2, rmSync as rmSync13 } from "node:fs";
+import { homedir as homedir30 } from "node:os";
+import { join as join37, resolve as resolve31 } from "node:path";
+function envDir(name, fallback) {
+  const value = (process.env[name] ?? "").trim();
+  return value ? resolve31(value) : fallback;
+}
+function agentSkillRoots(id) {
+  const home = homedir30();
+  const config = envDir("XDG_CONFIG_HOME", join37(home, ".config"));
+  switch (id) {
+    case "claude":
+      return [join37(envDir("CLAUDE_CONFIG_DIR", join37(home, ".claude")), "skills")];
+    case "codex":
+      return [join37(envDir("CODEX_HOME", join37(home, ".codex")), "skills")];
+    case "copilot":
+      return [join37(envDir("COPILOT_HOME", join37(home, ".copilot")), "skills")];
+    case "cursor":
+      return [join37(home, ".cursor", "skills")];
+    case "opencode":
+      return [join37(config, "opencode", "skills")];
+    case "pi":
+      return [join37(envDir("PI_CODING_AGENT_DIR", join37(home, ".pi", "agent")), "skills")];
+    case "hermes":
+      return listHermesProfiles().map((p) => join37(p.home, "skills"));
+    case "openclaw":
+      return listOpenClawProfiles().map((p) => join37(p.home, "skills"));
+    case "factory":
+      return [join37(envDir("FACTORY_HOME_OVERRIDE", home), ".factory", "skills")];
+    case "devin":
+      return [join37(config, "devin", "skills")];
+    case "antigravity":
+      return [join37(home, ".gemini", "config", "skills")];
+    case "goose": {
+      const root = (process.env.GOOSE_PATH_ROOT ?? "").trim();
+      return [root ? join37(resolve31(root), "config", "skills") : join37(config, "goose", "skills")];
+    }
+  }
+}
+function listedTwice(id) {
+  return id === "codex" && existsSync38(join37(homedir30(), ".agents", "skills", AGENT_SKILL_NAME, "SKILL.md"));
+}
+function installAgentSkill(ids) {
+  const installed = [];
+  for (const id of ids) {
+    let wrote = false;
+    const covered = listedTwice(id);
+    for (const root of agentSkillRoots(id)) {
+      const dir = join37(root, AGENT_SKILL_NAME);
+      const ours = existsSync38(join37(dir, AGENT_SKILL_MARKER));
+      if (covered) {
+        if (ours)
+          removeSkillDir(dir);
+        continue;
+      }
+      if (existsSync38(dir) && !ours)
+        continue;
+      let created = false;
+      let marked = false;
+      try {
+        mkdirSync21(root, { recursive: true });
+        if (!existsSync38(dir)) {
+          mkdirSync21(dir);
+          created = true;
+        }
+        writeConfigFileAtomic(join37(dir, AGENT_SKILL_MARKER), "", { backup: false, symlinks: "replace" });
+        marked = true;
+        writeConfigFileAtomic(join37(dir, "SKILL.md"), AGENT_SKILL_MD, { backup: false, symlinks: "replace" });
+        wrote = true;
+      } catch (err) {
+        if (created && !marked) {
+          try {
+            rmdirSync2(dir);
+          } catch {}
+        }
+        hookLogWarn(`the failproofai skill was not written to ${dir}: ${err instanceof Error ? err.message : String(err)}`);
+      }
+    }
+    if (wrote)
+      installed.push(id);
+  }
+  return installed;
+}
+function installedAgentSkillDirs() {
+  const dirs = INTEGRATION_TYPES.flatMap((id) => agentSkillRoots(id).map((root) => join37(root, AGENT_SKILL_NAME)));
+  return [...new Set(dirs)].filter((dir) => existsSync38(join37(dir, AGENT_SKILL_MARKER)));
+}
+function removeSkillDir(dir) {
+  try {
+    rmSync13(dir, { recursive: true, force: true });
+    return true;
+  } catch (err) {
+    hookLogWarn(`the failproofai skill was not removed from ${dir}: ${err instanceof Error ? err.message : String(err)}`);
+    return false;
+  }
+}
+function removeAgentSkill() {
+  return installedAgentSkillDirs().filter(removeSkillDir);
+}
+var AGENT_SKILL_NAME = "failproofai", AGENT_SKILL_MARKER = ".failproofai-managed", SKILLS_RAW = "https://raw.githubusercontent.com/FailproofAI/skills/main/skills", AGENT_SKILL_MD;
+var init_agent_skill = __esm(() => {
+  init_hermes_profiles();
+  init_openclaw_profiles();
+  init_hook_logger();
+  init_safe_config_write();
+  init_types();
+  AGENT_SKILL_MD = `---
+name: ${AGENT_SKILL_NAME}
+description: FailproofAI hooks, policies, daemon, Cloud, the fp CLI and the SDK. Use for any question about setting up, running or fixing FailproofAI.
+---
+
+# FailproofAI
+
+This skill is a pointer. Before acting on anything FailproofAI, read the full skill, which is kept current online (use your web fetch tool, or \`curl -fsSL <url>\`):
+
+${SKILLS_RAW}/${AGENT_SKILL_NAME}/SKILL.md
+
+Files it names by a relative path, such as \`references/cli.md\`, are in that same folder: ${SKILLS_RAW}/${AGENT_SKILL_NAME}/<path>
+
+For focused work, read the matching skill too. Each has the same layout, with its own \`references/\` beside it.
+
+- Writing or testing a policy: ${SKILLS_RAW}/failproofai-policy-author/SKILL.md
+- Publishing a policy pack: ${SKILLS_RAW}/failproofai-policy-publish/SKILL.md
+- FailproofAI Cloud and the \`fp\` CLI: ${SKILLS_RAW}/fp-cloud-cli/SKILL.md
+- Adding the SDK to an agent, or running an evaluator: ${SKILLS_RAW}/failproofai-sdk/SKILL.md
+- Planning evaluations: ${SKILLS_RAW}/failproofai-eval-brainstorm/SKILL.md
+`;
+});
+
 // lib/fetch-with-timeout.ts
 function fetchWithTimeout(input, init = {}, timeoutMs = DEFAULT_FETCH_TIMEOUT_MS) {
   const timeoutSignal = AbortSignal.timeout(timeoutMs);
@@ -35585,7 +36459,7 @@ var DEFAULT_FETCH_TIMEOUT_MS = 15000;
 
 // src/hooks/cloud-enrollment.ts
 import { randomUUID as randomUUID4 } from "node:crypto";
-import { existsSync as existsSync38, readFileSync as readFileSync31, rmSync as rmSync13 } from "node:fs";
+import { existsSync as existsSync39, readFileSync as readFileSync32, rmSync as rmSync14 } from "node:fs";
 import { hostname as hostname4 } from "node:os";
 function cloudCredentialPath() {
   return process.env.FAILPROOFAI_CLOUD_CREDENTIALS ?? credentialsFile();
@@ -35624,10 +36498,10 @@ function readCloudCredentials() {
   if (!usingJsonOverride())
     return readCredentials().cloud ?? null;
   const path = cloudCredentialPath();
-  if (!existsSync38(path))
+  if (!existsSync39(path))
     return null;
   try {
-    const raw = JSON.parse(readFileSync31(path, "utf8"));
+    const raw = JSON.parse(readFileSync32(path, "utf8"));
     if (raw.schemaVersion !== SCHEMA_VERSION2)
       return null;
     if (typeof raw.url !== "string" || typeof raw.machineId !== "string" || typeof raw.token !== "string") {
@@ -35666,10 +36540,10 @@ function resolveMachineLabel(explicit) {
 function clearCloudCredentials() {
   if (usingJsonOverride()) {
     const path = cloudCredentialPath();
-    if (!existsSync38(path))
+    if (!existsSync39(path))
       return false;
     try {
-      rmSync13(path);
+      rmSync14(path);
       return true;
     } catch {
       return false;
@@ -35771,8 +36645,8 @@ async function introspectKey(origin, token, fetchImpl = fetch, timeoutMs = 1e4)
     identity: {
       keyId: typeof b.key_id === "string" ? b.key_id : undefined,
       orgId: typeof b.org_id === "string" ? b.org_id : undefined,
-      orgSlug: typeof b.org_slug === "string" ? b.org_slug : undefined,
-      orgName: typeof b.org_name === "string" ? b.org_name : undefined,
+      orgSlug: displayText(b.org_slug),
+      orgName: displayText(b.org_name),
       permissions: b.permissions.filter((p) => typeof p === "string"),
       expiresAt: typeof b.expires_at === "string" ? b.expires_at : null,
       otelIngest: typeof b.otel_ingest === "boolean" ? b.otel_ingest : undefined
@@ -35788,30 +36662,33 @@ function describeOrg(identity) {
   return identity.orgName ?? identity.orgSlug ?? identity.orgId ?? "an unknown organisation";
 }
 var INTROSPECT_PATH = "/v1/auth/introspect", PERMISSION_EVENTS = "events:add", PERMISSION_POLICIES = "policies:pull", PERMISSION_JEV = "jev:evaluate";
+var init_cloud_introspect = __esm(() => {
+  init_cloud_login();
+});
 
 // src/hooks/credential-recovery.ts
 import { createHash as createHash11 } from "node:crypto";
-import { existsSync as existsSync39, mkdirSync as mkdirSync21, readdirSync as readdirSync19, renameSync as renameSync13 } from "node:fs";
-import { join as join37 } from "node:path";
+import { existsSync as existsSync40, mkdirSync as mkdirSync22, readdirSync as readdirSync19, renameSync as renameSync13 } from "node:fs";
+import { join as join38 } from "node:path";
 function previousOrgDirectory(id) {
   const safe = id && /^[A-Za-z0-9_-]{1,128}$/.test(id) ? id : id ? createHash11("sha256").update(id).digest("hex") : "unknown";
-  return join37(stateDir(), "previous-org", safe);
+  return join38(stateDir(), "previous-org", safe);
 }
 function recoverCredentialRefusals(sameOrg, oldOrgId) {
   const dir = failedDir();
-  if (!existsSync39(dir))
+  if (!existsSync40(dir))
     return 0;
   let recovered = 0;
   for (const name of readdirSync19(dir)) {
     if (!/\.c(401|403)\.jsonl$/.test(name) || name.startsWith("."))
       continue;
-    const targetDir = sameOrg ? dir : join37(previousOrgDirectory(oldOrgId), "failed");
-    mkdirSync21(targetDir, { recursive: true, mode: 448 });
+    const targetDir = sameOrg ? dir : join38(previousOrgDirectory(oldOrgId), "failed");
+    mkdirSync22(targetDir, { recursive: true, mode: 448 });
     const targetName = sameOrg ? name.replace(/\.c(401|403)(?=\.jsonl$)/, "") : name;
-    const target = join37(targetDir, targetName);
-    if (existsSync39(target))
+    const target = join38(targetDir, targetName);
+    if (existsSync40(target))
       continue;
-    renameSync13(join37(dir, name), target);
+    renameSync13(join38(dir, name), target);
     recovered++;
   }
   if (sameOrg && recovered > 0)
@@ -35829,16 +36706,16 @@ import {
   chmodSync as chmodSync9,
   closeSync as closeSync5,
   constants as fsConstants5,
-  existsSync as existsSync40,
+  existsSync as existsSync41,
   fstatSync as fstatSync3,
   linkSync,
   lstatSync as lstatSync5,
-  mkdirSync as mkdirSync22,
+  mkdirSync as mkdirSync23,
   openSync as openSync5,
-  readFileSync as readFileSync32,
+  readFileSync as readFileSync33,
   readSync as readSync4,
   renameSync as renameSync14,
-  rmSync as rmSync14,
+  rmSync as rmSync15,
   statSync as statSync29,
   unlinkSync as unlinkSync6,
   writeFileSync as writeFileSync18
@@ -35876,7 +36753,7 @@ function repointCloudJevConfig(cloudBase, found) {
   }
   let raw = null;
   try {
-    const parsed = JSON.parse(readFileSync32(aside, "utf8"));
+    const parsed = JSON.parse(readFileSync33(aside, "utf8"));
     if (parsed && typeof parsed === "object" && !Array.isArray(parsed))
       raw = parsed;
   } catch {
@@ -35898,7 +36775,7 @@ function repointCloudJevConfig(cloudBase, found) {
     return found;
   } finally {
     try {
-      rmSync14(tmp, { force: true });
+      rmSync15(tmp, { force: true });
     } catch {}
   }
   try {
@@ -35920,15 +36797,15 @@ function writeCloudJevConfigIfAbsent(cloudBase) {
   } catch {
     return { status: "error", path, problem: "the FailproofAI Cloud URL is not a URL" };
   }
-  if (existsSync40(path))
+  if (existsSync41(path))
     return kept(path, cloudBase);
   const body = `${JSON.stringify({ provider: JEV_CLOUD_PROVIDER, baseUrl, mode: CLOUD_JEV_INITIAL_MODE }, null, 2)}
 `;
   const dir = dirname22(path);
   const tmp = `${path}.${process.pid}.${randomBytes3(6).toString("hex")}.tmp`;
   try {
-    if (!existsSync40(dir))
-      mkdirSync22(dir, { recursive: true, mode: 448 });
+    if (!existsSync41(dir))
+      mkdirSync23(dir, { recursive: true, mode: 448 });
     writeFileSync18(tmp, body, { mode: 384, flag: "wx" });
     chmodSync9(tmp, 384);
     try {
@@ -35942,7 +36819,7 @@ function writeCloudJevConfigIfAbsent(cloudBase) {
     return { status: "error", path, problem: `could not write ${path} (${err.code ?? "error"})` };
   } finally {
     try {
-      rmSync14(tmp, { force: true });
+      rmSync15(tmp, { force: true });
     } catch {}
   }
   tightenDir(dir);
@@ -35950,7 +36827,7 @@ function writeCloudJevConfigIfAbsent(cloudBase) {
 }
 function existingJevConfig(cloudBase) {
   const path = jevConfigPath();
-  return existsSync40(path) ? kept(path, cloudBase) : null;
+  return existsSync41(path) ? kept(path, cloudBase) : null;
 }
 function cloudJevRunningMode() {
   try {
@@ -36049,7 +36926,7 @@ function putBack(aside, path, mode) {
   }
   let created = false;
   try {
-    const bytes = readFileSync32(aside);
+    const bytes = readFileSync33(aside);
     const fd = openSync5(path, "wx", mode);
     created = true;
     try {
@@ -36122,7 +36999,7 @@ var init_jev_cloud_connection = __esm(() => {
 });
 
 // src/hooks/cloud-connection.ts
-import { rmSync as rmSync15 } from "node:fs";
+import { rmSync as rmSync16 } from "node:fs";
 function ingestUrlFor(baseUrl) {
   return `${baseUrl.replace(/\/$/, "")}${INGEST_PATH}`;
 }
@@ -36164,6 +37041,7 @@ async function connectToCloud(input) {
     };
   }
   const known = identity.kind === "ok" ? identity.identity : null;
+  const org = known ? { id: known.orgId, slug: known.orgSlug, name: known.orgName } : input.org;
   const canIngest = known ? hasPermission(known, PERMISSION_EVENTS) : true;
   const canPolicy = known ? hasPermission(known, PERMISSION_POLICIES) : true;
   const missing = (permission) => `that key does not carry \`${permission}\`` + (known ? ` (it is valid for ${describeOrg(known)})` : "");
@@ -36175,7 +37053,7 @@ async function connectToCloud(input) {
     policy: policyResult.ok ? { ok: true, policyCount: policyResult.policyCount, deployment: policyResult.deployment } : { ok: false, reason: policyResult.reason },
     ingest: ingestResult.ok ? { ok: true } : { ok: false, reason: ingestResult.reason },
     anyConfigured: false,
-    org: known ? { id: known.orgId, slug: known.orgSlug, name: known.orgName } : undefined
+    org
   };
   outcome.anyConfigured = policyResult.ok || ingestResult.ok;
   if (!outcome.anyConfigured)
@@ -36197,13 +37075,13 @@ async function connectToCloud(input) {
     prev.ingest ? { token: prev.ingest.key, url: prev.ingest.url } : undefined,
     prev.jev ? { token: prev.jev.key, url: prev.jev.url } : undefined
   ].some((slot) => slot && (slot.token !== input.token || !sameOrigin(slot.url)));
-  const sameKnownOrg = Boolean(prev.org?.id && known?.orgId && prev.org.id === known.orgId);
-  const orgSwitch = hadConnection && !sameKnownOrg && (prev.org?.id && known?.orgId && prev.org.id !== known.orgId || (!prev.org?.id || !known?.orgId) && keyChanged || previousPolicy && !sameOrigin(previousPolicy.url) || prev.ingest && !sameOrigin(prev.ingest.url));
+  const sameKnownOrg = Boolean(prev.org?.id && org?.id && prev.org.id === org.id);
+  const orgSwitch = hadConnection && !sameKnownOrg && (prev.org?.id && org?.id && prev.org.id !== org.id || (!prev.org?.id || !org?.id) && keyChanged || previousPolicy && !sameOrigin(previousPolicy.url) || prev.ingest && !sameOrigin(prev.ingest.url));
   const boundary = orgSwitch ? next.connectedAt : prev.org?.since;
   if (orgSwitch) {
-    rmSync15(backfillRequestPath(), { force: true });
+    rmSync16(backfillRequestPath(), { force: true });
     const oldOrg = prev.org?.name ?? prev.org?.slug ?? prev.org?.id ?? "the previous org";
-    const newOrg = known?.orgName ?? known?.orgSlug ?? known?.orgId ?? "the new org";
+    const newOrg = org?.name ?? org?.slug ?? org?.id ?? "the new org";
     changes.push(`Switched from ${oldOrg} to ${newOrg}. Nothing recorded before now will be sent to ${newOrg}; ${oldOrg}'s cloud policies stop within ~30 s.`);
     clearActiveCloudManagedPolicies();
   }
@@ -36231,15 +37109,15 @@ async function connectToCloud(input) {
       changes.push(`Removed the previous Jev key ${maskToken(prev.jev.key)}: this key's ${PERMISSION_JEV} permission was not verified.`);
   }
   const since = boundary === undefined ? {} : { since: boundary };
-  if (known) {
-    next.org = { id: known.orgId, slug: known.orgSlug, name: known.orgName, ...since };
+  if (org) {
+    next.org = { ...org, ...since };
   } else {
     const { since: _drop, ...kept } = orgSwitch ? {} : prev.org ?? {};
     next.org = { ...kept, ...since };
   }
   writeCredentials(next);
   if (ingestResult.ok && prev.ingest && prev.ingest.key !== input.token) {
-    recoverCredentialRefusals(Boolean(prev.org?.id && prev.org.id === known?.orgId && sameOrigin(prev.ingest.url)), prev.org?.id);
+    recoverCredentialRefusals(Boolean(prev.org?.id && prev.org.id === org?.id && sameOrigin(prev.ingest.url)), prev.org?.id);
   }
   if (process.env.FAILPROOFAI_CLOUD_CREDENTIALS) {
     if (policyResult.ok)
@@ -36328,47 +37206,23 @@ function jevLines(outcome) {
   }
   const config = jev.config;
   if (!config || config.status === "written" || config.status === "repointed") {
-    const plainHttp = config !== undefined && new URL(config.baseUrl).protocol === "http:";
-    const httpLine = "            Over plain http Jev runs only in observe mode: enforce (set here or by FailproofAI Cloud) turns it off on this machine. For enforce, reconnect with `failproofai config --token <key> --url https://…`.";
     const lead = config?.status === "repointed" ? [`  Jev       ${config.path} now points here instead of ${config.from}.`] : [];
     const indent = lead.length > 0 ? "            " : "  Jev       ";
     const cloudJev = safeCloudJev();
-    if (cloudJev.jevMode !== null) {
-      if (cloudJev.jevMode === "off")
-        return [...lead, `${indent}off on this machine: FailproofAI Cloud set its Jev mode to off.`];
-      if (plainHttp && cloudJev.jevMode === "enforce") {
-        return [
-          ...lead,
-          `${indent}off on this machine: FailproofAI Cloud set enforce, and over plain http Jev runs only in observe mode. For enforce, reconnect with \`failproofai config --token <key> --url https://…\`.`
-        ];
-      }
-      return [
-        ...lead,
-        `${indent}on through FailproofAI Cloud, mode ${cloudJev.jevMode} (set by FailproofAI Cloud); the Jev checks it deployed here run on FailproofAI Cloud.`
-      ];
-    }
-    const localMode = config?.status === "repointed" ? config.mode : "observe";
-    if (localMode === "off") {
-      return [...lead, `${indent}switched off in ${config?.path ?? "jev.json"} (mode off). FailproofAI Cloud's Jev mode, if it sets one, arrives with its first deployment. To turn it on: \`failproofai jev setup --mode observe\`.`];
-    }
-    return [
-      ...lead,
-      `${indent}configured through FailproofAI Cloud; waiting for FailproofAI Cloud's Jev mode, which arrives with this machine's first deployment (within ~30 s) and decides. Until then, and if Cloud sets none: ${localMode} (${config?.path ?? "jev.json"}). Check with \`failproofai jev status\`.`,
-      ...jevChecksDeclared() ? [] : ["            No Jev checks are installed on this machine; checks FailproofAI Cloud deploys here run on Cloud. To add local ones: `failproofai policies add FailproofAI/jev-policies`."],
-      ...plainHttp ? [httpLine] : []
-    ];
+    const state = cloudJev.jevMode === null ? "waiting for its first deployment" : cloudJev.jevMode === "off" ? "off — no Jev policy deployed" : cloudJev.jevMode;
+    return [...lead, `${indent}managed by FailproofAI Cloud · ${state}`];
   }
   if (config.status === "kept") {
     const lines = [`  Jev       key stored; ${config.path} already exists and was left as configured.`];
     if (config.otherOrigin) {
-      lines.push(config.jevOff?.why === "off" ? `            It points at ${config.otherOrigin} and has Jev switched off (mode off), so Jev is off. To point it here and turn it on: \`failproofai jev setup --provider failproofai --mode observe\`.` : `            It points at ${config.otherOrigin}, so Jev stays off until you run \`failproofai jev setup --provider failproofai\`.`);
+      lines.push(config.jevOff?.why === "off" ? `            It points at ${config.otherOrigin} and has Jev switched off (mode off), so Jev is off. To point it here: \`failproofai jev setup --provider failproofai\`.` : `            It points at ${config.otherOrigin}, so Jev stays off until you run \`failproofai jev setup --provider failproofai\`.`);
     } else if (config.jevOff?.why === "refused") {
       lines.push(`            It was refused (${config.jevOff.problem}), so Jev is off. ${config.jevOff.fix ? `Fix: \`${config.jevOff.fix}\`.` : "Write a valid one: `failproofai jev setup --provider failproofai`."}`);
     } else if (config.jevOff?.why === "off") {
-      lines.push("            It has Jev switched off (mode off), so Jev is off. To turn it on: `failproofai jev setup --mode observe`.");
+      lines.push("            It has Jev switched off (mode off) until FailproofAI Cloud's Jev mode arrives with this machine's first deployment; from then on FailproofAI Cloud decides.");
     }
     if (jev.stillOn) {
-      lines.push(`            Jev is still on through FailproofAI Cloud (${jev.stillOn} mode): it sends each checked tool call and the recent prompt to FailproofAI Cloud. To switch it off: \`failproofai jev setup --mode off\`.`);
+      lines.push(`            Jev is still on through FailproofAI Cloud (${jev.stillOn} mode): it sends each checked tool call and the recent prompt to FailproofAI Cloud. FailproofAI Cloud sets its mode: off when no Jev policy is deployed here.`);
     }
     return lines;
   }
@@ -36427,7 +37281,7 @@ var init_cloud_connection = __esm(() => {
   init_cloud_enrollment();
   init_fp_home();
   init_fp_config();
-  init_effective_reviewers();
+  init_cloud_introspect();
   init_collector_config();
   init_credential_recovery();
   init_cloud_managed_policies();
@@ -36435,14 +37289,14 @@ var init_cloud_connection = __esm(() => {
 });
 
 // src/hooks/setup-state.ts
-import { existsSync as existsSync41, realpathSync as realpathSync4, statSync as statSync30 } from "node:fs";
-import { dirname as dirname23, resolve as resolve31 } from "node:path";
-import { homedir as homedir30 } from "node:os";
-function globalConfigPath(home = homedir30()) {
+import { existsSync as existsSync42, realpathSync as realpathSync4, statSync as statSync30 } from "node:fs";
+import { dirname as dirname23, resolve as resolve32 } from "node:path";
+import { homedir as homedir31 } from "node:os";
+function globalConfigPath(home = homedir31()) {
   return globalPolicyConfigFile(home);
 }
 function projectConfigPath(projectRoot) {
-  return resolve31(projectRoot, ".failproofai", "policies-config.json");
+  return resolve32(projectRoot, ".failproofai", "policies-config.json");
 }
 function legacyMarkerPath(home) {
   return launcherMarker(home);
@@ -36454,18 +37308,18 @@ function isDir(path) {
     return false;
   }
 }
-function findProjectRoot2(start, home = homedir30()) {
+function findProjectRoot2(start, home = homedir31()) {
   const resolvedHome = realResolve(home);
   let dir = realResolve(start);
   while (dir !== resolvedHome) {
-    if (isDir(resolve31(dir, ".failproofai")))
+    if (isDir(resolve32(dir, ".failproofai")))
       return dir;
     const parent = dirname23(dir);
     if (parent === dir)
       break;
     dir = parent;
   }
-  return resolve31(start);
+  return resolve32(start);
 }
 function hasGlobalHooksInstalled() {
   for (const id of INTEGRATION_TYPES) {
@@ -36477,14 +37331,14 @@ function hasGlobalHooksInstalled() {
   return false;
 }
 function realResolve(path) {
-  const lexical = resolve31(path);
+  const lexical = resolve32(path);
   try {
     return realpathSync4(lexical);
   } catch {
     return lexical;
   }
 }
-function detectSetupState(cwd = process.cwd(), home = homedir30()) {
+function detectSetupState(cwd = process.cwd(), home = homedir31()) {
   const resolvedCwd = realResolve(cwd);
   const resolvedHome = realResolve(home);
   const projectRoot = findProjectRoot2(resolvedCwd, resolvedHome);
@@ -36492,10 +37346,10 @@ function detectSetupState(cwd = process.cwd(), home = homedir30()) {
     cwd: resolvedCwd,
     home: resolvedHome,
     projectRoot,
-    hasGlobalConfig: existsSync41(globalConfigPath(resolvedHome)),
-    hasProjectConfig: projectRoot !== resolvedHome && existsSync41(projectConfigPath(projectRoot)),
+    hasGlobalConfig: existsSync42(globalConfigPath(resolvedHome)),
+    hasProjectConfig: projectRoot !== resolvedHome && existsSync42(projectConfigPath(projectRoot)),
     hasGlobalHooks: hasGlobalHooksInstalled(),
-    hasLegacyMarker: existsSync41(legacyMarkerPath(resolvedHome)),
+    hasLegacyMarker: existsSync42(legacyMarkerPath(resolvedHome)),
     inHomeDir: resolvedCwd === resolvedHome
   };
 }
@@ -36509,14 +37363,14 @@ var init_setup_state = __esm(() => {
 });
 
 // src/hooks/onboarding-attempt.ts
-import { existsSync as existsSync42, mkdirSync as mkdirSync23, readFileSync as readFileSync33, rmSync as rmSync16, writeFileSync as writeFileSync19 } from "node:fs";
+import { existsSync as existsSync43, mkdirSync as mkdirSync24, readFileSync as readFileSync34, rmSync as rmSync17, writeFileSync as writeFileSync19 } from "node:fs";
 import { dirname as dirname24 } from "node:path";
 function readOnboardingAttempt() {
   const path = onboardingAttemptFile();
-  if (!existsSync42(path))
+  if (!existsSync43(path))
     return null;
   try {
-    const raw = JSON.parse(readFileSync33(path, "utf8"));
+    const raw = JSON.parse(readFileSync34(path, "utf8"));
     if (raw.schemaVersion !== SCHEMA_VERSION3)
       return null;
     if (typeof raw.reason !== "string" || typeof raw.cliVersion !== "string")
@@ -36535,7 +37389,7 @@ function readOnboardingAttempt() {
 function recordOnboardingAttempt(reason, cliVersion, daemonStatus, now = Date.now()) {
   try {
     const path = onboardingAttemptFile();
-    mkdirSync23(dirname24(path), { recursive: true });
+    mkdirSync24(dirname24(path), { recursive: true });
     const record = {
       schemaVersion: SCHEMA_VERSION3,
       reason,
@@ -36548,7 +37402,7 @@ function recordOnboardingAttempt(reason, cliVersion, daemonStatus, now = Date.no
 }
 function clearOnboardingAttempt() {
   try {
-    rmSync16(onboardingAttemptFile(), { force: true });
+    rmSync17(onboardingAttemptFile(), { force: true });
   } catch {}
 }
 function blockerCleared(attempt, probe) {
@@ -36587,9 +37441,9 @@ var init_onboarding_attempt = __esm(() => {
 });
 
 // src/hooks/onboarding-lock.ts
-import { mkdirSync as mkdirSync24, readFileSync as readFileSync34, rmSync as rmSync17, writeFileSync as writeFileSync20 } from "node:fs";
-import { homedir as homedir31 } from "node:os";
-function onboardingLockPath(home = homedir31()) {
+import { mkdirSync as mkdirSync25, readFileSync as readFileSync35, rmSync as rmSync18, writeFileSync as writeFileSync20 } from "node:fs";
+import { homedir as homedir32 } from "node:os";
+function onboardingLockPath(home = homedir32()) {
   return onboardingLockFile(home);
 }
 function processAlive(pid) {
@@ -36604,7 +37458,7 @@ function processAlive(pid) {
 }
 function readLock(path) {
   try {
-    const parsed = JSON.parse(readFileSync34(path, "utf8"));
+    const parsed = JSON.parse(readFileSync35(path, "utf8"));
     if (typeof parsed.pid !== "number")
       return null;
     return { pid: parsed.pid, startedAt: Number(parsed.startedAt) || 0 };
@@ -36612,13 +37466,13 @@ function readLock(path) {
     return null;
   }
 }
-function acquireOnboardingLock(home = homedir31()) {
+function acquireOnboardingLock(home = homedir32()) {
   const path = onboardingLockPath(home);
   try {
     const held = readLock(path);
     if (held && held.pid !== process.pid && processAlive(held.pid))
       return null;
-    mkdirSync24(stateDir(home), { recursive: true });
+    mkdirSync25(stateDir(home), { recursive: true });
     const body = { pid: process.pid, startedAt: Date.now() };
     writeFileSync20(path, JSON.stringify(body), "utf8");
     let released = false;
@@ -36630,7 +37484,7 @@ function acquireOnboardingLock(home = homedir31()) {
         try {
           const current = readLock(path);
           if (!current || current.pid === process.pid)
-            rmSync17(path, { force: true });
+            rmSync18(path, { force: true });
         } catch {}
       }
     };
@@ -36643,8 +37497,8 @@ var init_onboarding_lock = __esm(() => {
 });
 
 // lib/claude-sessions.ts
-import { readdirSync as readdirSync20, statSync as statSync31, existsSync as existsSync43 } from "node:fs";
-import { join as join38, basename as basename9 } from "node:path";
+import { readdirSync as readdirSync20, statSync as statSync31, existsSync as existsSync44 } from "node:fs";
+import { join as join39, basename as basename9 } from "node:path";
 function getClaudeProjectsRoot() {
   return getClaudeProjectsPath();
 }
@@ -36659,7 +37513,7 @@ function listClaudeProjects() {
   return entries.filter((e) => e.isDirectory()).map((e) => ({
     name: e.name,
     cwd: decodeFolderName(e.name),
-    path: join38(root, e.name)
+    path: join39(root, e.name)
   }));
 }
 function listClaudeTranscripts(project) {
@@ -36675,7 +37529,7 @@ function listClaudeTranscripts(project) {
       const sessionId = entry.name.slice(0, -".jsonl".length);
       if (!UUID_RE2.test(sessionId))
         continue;
-      const transcriptPath = join38(project.path, entry.name);
+      const transcriptPath = join39(project.path, entry.name);
       try {
         const s = statSync31(transcriptPath);
         out.push({
@@ -36689,8 +37543,8 @@ function listClaudeTranscripts(project) {
         });
       } catch {}
     } else if (entry.isDirectory() && UUID_RE2.test(entry.name)) {
-      const subDir = join38(project.path, entry.name, "subagents");
-      if (!existsSync43(subDir))
+      const subDir = join39(project.path, entry.name, "subagents");
+      if (!existsSync44(subDir))
         continue;
       let subEntries;
       try {
@@ -36702,7 +37556,7 @@ function listClaudeTranscripts(project) {
         if (!sub.isFile() || !sub.name.endsWith(".jsonl"))
           continue;
         const agentId = sub.name.slice(0, -".jsonl".length);
-        const transcriptPath = join38(subDir, sub.name);
+        const transcriptPath = join39(subDir, sub.name);
         try {
           const s = statSync31(transcriptPath);
           out.push({
@@ -38039,8 +38893,8 @@ var init_features = __esm(() => {
 
 // src/audit/cache.ts
 import { createHash as createHash12 } from "node:crypto";
-import { existsSync as existsSync44, mkdirSync as mkdirSync25, readFileSync as readFileSync35, writeFileSync as writeFileSync21, chmodSync as chmodSync10, openSync as openSync6, readSync as readSync5, closeSync as closeSync6 } from "node:fs";
-import { join as join39 } from "node:path";
+import { existsSync as existsSync45, mkdirSync as mkdirSync26, readFileSync as readFileSync36, writeFileSync as writeFileSync21, chmodSync as chmodSync10, openSync as openSync6, readSync as readSync5, closeSync as closeSync6 } from "node:fs";
+import { join as join40 } from "node:path";
 function getEngineVersion() {
   if (cachedEngineVersion)
     return cachedEngineVersion;
@@ -38060,7 +38914,7 @@ function getDetectorVersion() {
 function getCachePathFor(transcriptPath) {
   const root = auditCacheDir();
   const key = createHash12("sha1").update(transcriptPath).digest("hex");
-  return join39(root, `${key}.json`);
+  return join40(root, `${key}.json`);
 }
 function encodeDetectorState(state) {
   return JSON.stringify(state, (_k, v) => v instanceof Map ? { __map: [...v.entries()] } : v);
@@ -38100,10 +38954,10 @@ function readCachedTranscript(transcriptPath, mtimeMs, sizeBytes) {
   if (sizeBytes === 0)
     return null;
   const cachePath = getCachePathFor(transcriptPath);
-  if (!existsSync44(cachePath))
+  if (!existsSync45(cachePath))
     return null;
   try {
-    const raw = readFileSync35(cachePath, "utf-8");
+    const raw = readFileSync36(cachePath, "utf-8");
     const entry = JSON.parse(raw);
     if (entry.schemaVersion !== CACHE_SCHEMA_VERSION)
       return null;
@@ -38142,7 +38996,7 @@ function writeCachedTranscriptResult(transcriptPath, mtimeMs, sizeBytes, result,
     return;
   const cachePath = getCachePathFor(transcriptPath);
   try {
-    mkdirSync25(auditCacheDir(), { recursive: true });
+    mkdirSync26(auditCacheDir(), { recursive: true });
     const entry = {
       schemaVersion: CACHE_SCHEMA_VERSION,
       cachedAt: Date.now(),
@@ -38627,9 +39481,9 @@ var init_audit = __esm(() => {
 import {
   closeSync as closeSync7,
   linkSync as linkSync2,
-  mkdirSync as mkdirSync26,
+  mkdirSync as mkdirSync27,
   openSync as openSync7,
-  readFileSync as readFileSync36,
+  readFileSync as readFileSync37,
   unlinkSync as unlinkSync7,
   writeFileSync as writeFileSync22,
   writeSync as writeSync2
@@ -38690,7 +39544,7 @@ function handleFor(path, info) {
 }
 function readLock2(path) {
   try {
-    const parsed = JSON.parse(readFileSync36(path, "utf8"));
+    const parsed = JSON.parse(readFileSync37(path, "utf8"));
     if (typeof parsed?.pid !== "number" || typeof parsed?.startedAt !== "number")
       return null;
     return {
@@ -38740,8 +39594,8 @@ function createThenWrite(path, body) {
   }
 }
 function ensureRunDir() {
-  mkdirSync26(failproofaiHome(), { recursive: true });
-  mkdirSync26(runDir(), { recursive: true, mode: 448 });
+  mkdirSync27(failproofaiHome(), { recursive: true });
+  mkdirSync27(runDir(), { recursive: true, mode: 448 });
 }
 var AUDIT_LOCK_MAX_AGE_MS;
 var init_audit_lock = __esm(() => {
@@ -38750,7 +39604,7 @@ var init_audit_lock = __esm(() => {
 });
 
 // src/audit/dashboard-cache.ts
-import { existsSync as existsSync45, readFileSync as readFileSync37 } from "node:fs";
+import { existsSync as existsSync46, readFileSync as readFileSync38 } from "node:fs";
 function getCachePath() {
   return auditDashboardFile();
 }
@@ -38770,10 +39624,10 @@ function writeDashboardCache(params, result) {
 }
 function readDashboardCacheMeta() {
   const cachePath = getCachePath();
-  if (!existsSync45(cachePath))
+  if (!existsSync46(cachePath))
     return null;
   try {
-    const raw = readFileSync37(cachePath, "utf-8");
+    const raw = readFileSync38(cachePath, "utf-8");
     const entry = JSON.parse(raw);
     if (!entry || entry.schemaVersion !== DASHBOARD_CACHE_SCHEMA_VERSION || typeof entry.cachedAt !== "string" || Number.isNaN(new Date(entry.cachedAt).getTime()))
       return null;
@@ -38822,47 +39676,6 @@ function sanitizeErrorMessage(err) {
 var MAX_ERROR_MESSAGE_LEN = 300;
 var init_telemetry_sanitize = () => {};
 
-// src/audit/open-browser.ts
-import { spawn } from "node:child_process";
-function openUrl(url) {
-  let cmd;
-  let args;
-  if (process.platform === "darwin") {
-    cmd = "open";
-    args = [url];
-  } else if (process.platform === "win32") {
-    cmd = "cmd";
-    args = ["/c", "start", "", url];
-  } else {
-    cmd = "xdg-open";
-    args = [url];
-  }
-  try {
-    const child = spawn(cmd, args, { stdio: "ignore", detached: true });
-    child.on("error", () => {});
-    child.unref();
-  } catch {}
-}
-function openWhenReady(port, path) {
-  const base = `http://localhost:${port}`;
-  const target = `${base}${path}`;
-  (async () => {
-    const deadline = Date.now() + POLL_TIMEOUT_MS;
-    while (Date.now() < deadline) {
-      try {
-        await fetch(base, { method: "GET", redirect: "manual" });
-        openUrl(target);
-        return;
-      } catch {
-        await new Promise((r) => setTimeout(r, POLL_INTERVAL_MS));
-      }
-    }
-    openUrl(target);
-  })();
-}
-var POLL_INTERVAL_MS = 150, POLL_TIMEOUT_MS = 30000;
-var init_open_browser = () => {};
-
 // lib/telemetry.ts
 function trackEvent(name, properties) {
   if (!isTelemetryEnabled())
@@ -38950,7 +39763,7 @@ async function fetchWithTimeout2(url, init) {
     throw err;
   }
 }
-async function postJson2(path, body, init) {
+async function postJson3(path, body, init) {
   const headers = { "content-type": "application/json" };
   if (init?.accessToken)
     headers["authorization"] = `Bearer ${init.accessToken}`;
@@ -38966,18 +39779,18 @@ async function postJson2(path, body, init) {
   return await res.json();
 }
 async function requestLoginCode(email) {
-  return postJson2("/v0/auth/login/request", { email });
+  return postJson3("/v0/auth/login/request", { email });
 }
 async function verifyLoginCode(email, code) {
-  return postJson2("/v0/auth/login/verify", { email, code });
+  return postJson3("/v0/auth/login/verify", { email, code });
 }
 async function refreshAccessToken(refreshToken) {
-  return postJson2("/v0/auth/token/refresh", {
+  return postJson3("/v0/auth/token/refresh", {
     refresh_token: refreshToken
   });
 }
 async function submitAuditReport(accessToken, body) {
-  return postJson2("/v0/audit-reports", body, { accessToken });
+  return postJson3("/v0/audit-reports", body, { accessToken });
 }
 var DEFAULT_API_BASE = "https://api.befailproof.ai", AuthApiError, REQUEST_TIMEOUT_MS = 1e4;
 var init_api_server_client = __esm(() => {
@@ -38997,18 +39810,18 @@ var init_api_server_client = __esm(() => {
 });
 
 // lib/auth/auth-store.ts
-import { existsSync as existsSync46, readFileSync as readFileSync38, readdirSync as readdirSync21, rmSync as rmSync18 } from "node:fs";
-import { join as join40, resolve as resolve32 } from "node:path";
+import { existsSync as existsSync47, readFileSync as readFileSync39, readdirSync as readdirSync21, rmSync as rmSync19 } from "node:fs";
+import { join as join41, resolve as resolve33 } from "node:path";
 function getAuthFilePath() {
   const override = process.env.FAILPROOFAI_AUTH_DIR;
-  return override ? join40(override, "session.json") : auditSessionFile();
+  return override ? join41(override, "session.json") : auditSessionFile();
 }
 function readAuth() {
   const p = getAuthFilePath();
-  if (!existsSync46(p))
+  if (!existsSync47(p))
     return null;
   try {
-    const raw = readFileSync38(p, "utf-8");
+    const raw = readFileSync39(p, "utf-8");
     const parsed = JSON.parse(raw);
     if (typeof parsed.access_token !== "string" || typeof parsed.refresh_token !== "string" || typeof parsed.access_expires_at !== "number" || typeof parsed.user !== "object" || !parsed.user || typeof parsed.user.id !== "string" || typeof parsed.user.email !== "string") {
       return null;
@@ -39032,18 +39845,18 @@ function writeAuth(auth) {
 }
 function deleteAuth() {
   const p = getAuthFilePath();
-  if (existsSync46(p))
-    rmSync18(p, { force: true });
+  if (existsSync47(p))
+    rmSync19(p, { force: true });
   try {
     const root = migrationsDir();
-    if (!existsSync46(root))
+    if (!existsSync47(root))
       return;
     for (const entry of readdirSync21(root)) {
       if (!entry.startsWith("backup-layout"))
         continue;
-      const copy = resolve32(root, entry, "auth.json");
-      if (existsSync46(copy))
-        rmSync18(copy, { force: true });
+      const copy = resolve33(root, entry, "auth.json");
+      if (existsSync47(copy))
+        rmSync19(copy, { force: true });
     }
   } catch {}
 }
@@ -39104,7 +39917,7 @@ var init_auth_store = __esm(() => {
 });
 
 // src/audit/redact-example.ts
-import { homedir as homedir32 } from "node:os";
+import { homedir as homedir33 } from "node:os";
 function maskTruncatedSecret(input) {
   for (const [pattern, label] of SECRET_PREFIXES) {
     if (pattern.test(input)) {
@@ -39139,7 +39952,7 @@ function maskSecrets(input) {
   }
   return out;
 }
-function shortenPaths(input, home = homedir32()) {
+function shortenPaths(input, home = homedir33()) {
   const homeRoot = home.replace(/\/+$/, "");
   return input.replace(ABSOLUTE_PATH_RE, (match, offset, whole) => {
     if (PUBLIC_PATH_ROOTS.some((root) => match.startsWith(root)))
@@ -39170,7 +39983,7 @@ function shortenPaths(input, home = homedir32()) {
     return `${root}${middle}/${tail}${trailingSlash ? "/" : ""}`;
   });
 }
-function redactExample(input, home = homedir32()) {
+function redactExample(input, home = homedir33()) {
   const masked = maskAssignedSecrets(maskTruncatedSecret(maskSecrets(input)));
   const shortened = shortenPaths(masked, home);
   const collapsed = shortened.replace(/\s+/g, " ").trim();
@@ -39293,15 +40106,15 @@ var init_harm_report = __esm(() => {
 });
 
 // src/audit/machine-store.ts
-import { existsSync as existsSync47, readFileSync as readFileSync39, rmSync as rmSync19 } from "node:fs";
+import { existsSync as existsSync48, readFileSync as readFileSync40, rmSync as rmSync20 } from "node:fs";
 import { hostname as hostname5 } from "node:os";
 import { randomUUID as randomUUID5 } from "node:crypto";
 function readMachineIdentity(home) {
   const path = auditMachineFile(home);
-  if (!existsSync47(path))
+  if (!existsSync48(path))
     return null;
   try {
-    const parsed = JSON.parse(readFileSync39(path, "utf8"));
+    const parsed = JSON.parse(readFileSync40(path, "utf8"));
     if (typeof parsed.machine_id !== "string" || !parsed.machine_id)
       return null;
     return {
@@ -39631,16 +40444,16 @@ var init_cli = __esm(() => {
 });
 
 // src/hooks/configure-wizard.ts
-import { existsSync as existsSync48, mkdirSync as mkdirSync27, writeFileSync as writeFileSync23, readFileSync as readFileSync40 } from "node:fs";
-import { homedir as homedir33 } from "node:os";
-import { dirname as dirname25, resolve as resolve33, sep as sep5 } from "node:path";
+import { existsSync as existsSync49, mkdirSync as mkdirSync28, writeFileSync as writeFileSync23, readFileSync as readFileSync41 } from "node:fs";
+import { homedir as homedir34 } from "node:os";
+import { dirname as dirname25, resolve as resolve34, sep as sep5 } from "node:path";
 async function emit(event, props) {
   try {
     await trackHookEvent2(getInstanceId2(), event, props);
   } catch {}
 }
 function homeify(p) {
-  const home = homedir33();
+  const home = homedir34();
   if (p === home)
     return "~";
   if (p.startsWith(home + sep5))
@@ -39763,7 +40576,7 @@ function removeUserScopeHooks(clis, cwd) {
       }
     }
     for (const settingsPath of settingsPathsFor(integration, "user", cwd)) {
-      if (id !== "hermes" && !existsSync48(settingsPath))
+      if (id !== "hermes" && !existsSync49(settingsPath))
         continue;
       try {
         removed += integration.removeHooksFromFile(settingsPath);
@@ -39801,7 +40614,7 @@ function describeCustomPolicies(cwd) {
   const scopes = [];
   let fileCount = 0;
   const dirs = [
-    { dir: resolve33(cwd, ".failproofai", "policies"), label: "project" },
+    { dir: resolve34(cwd, ".failproofai", "policies"), label: "project" },
     { dir: customPoliciesDir(), label: "global" }
   ];
   for (const { dir, label } of dirs) {
@@ -39812,7 +40625,7 @@ function describeCustomPolicies(cwd) {
       fileCount += found.length;
     }
     for (const name of findSkippedPolicyFiles(dir)) {
-      warnings.push(`! ${homeify(resolve33(dir, name))} is NOT loaded — rename to ` + `${name.replace(/\.(js|mjs|ts)$/, "-policies.$1")}`);
+      warnings.push(`! ${homeify(resolve34(dir, name))} is NOT loaded — rename to ` + `${name.replace(/\.(js|mjs|ts)$/, "-policies.$1")}`);
     }
   }
   return { active, warnings, fileCount, scopes };
@@ -39822,7 +40635,7 @@ function firstRunMarkerPath() {
 }
 function markLauncherSeen() {
   try {
-    mkdirSync27(dirname25(firstRunMarkerPath()), { recursive: true });
+    mkdirSync28(dirname25(firstRunMarkerPath()), { recursive: true });
     writeFileSync23(firstRunMarkerPath(), "1", "utf8");
   } catch {}
 }
@@ -40057,6 +40870,158 @@ ${process.platform} service target.
     stdin,
     stdout
   });
+  const askKey = () => promptCloudKey({
+    message: "Connect to cloud",
+    meta: source ? `${host}  ·  from ${source}` : host,
+    tabHint: "go back",
+    emptyError: "Paste a key, or press tab to go back.",
+    check: async (key) => {
+      if (!url)
+        return { ok: false, line: badUrl ?? "No usable endpoint." };
+      const r = await checkCloudKey(url, key);
+      if (r.ok) {
+        typedOrg = r.org;
+        return { ok: true, line: r.note };
+      }
+      return { ok: false, line: r.refused ? `That key was refused: ${r.reason}.` : `Couldn't check the key: ${r.reason}.` };
+    },
+    collapsed: (answer) => answer === OPEN_SOURCE ? [] : [...cloudLines(planFor(answer)), ""],
+    stdin,
+    stdout
+  });
+  let loginUnsupported = false;
+  const askLogin = (endpoint) => {
+    let pollSecret = "";
+    return promptBrowserLogin({
+      message: "Connect to cloud",
+      meta: source ? `${host}  ·  from ${source}` : host,
+      machineLabel,
+      start: async () => {
+        const r = await startLogin(endpoint, { label: machineLabel, os: machineOs(), cliVersion: version2 });
+        if (r.kind === "ok") {
+          pollSecret = r.pollSecret;
+          emit("configure_cloud_login", { step: "started" });
+          return { ok: true, url: r.verificationUrl, expiresIn: r.expiresIn, interval: r.interval };
+        }
+        if (r.kind === "unsupported") {
+          emit("configure_cloud_login", { step: "unsupported" });
+          loginUnsupported = true;
+          return { ok: false, retryable: false, line: `${host} doesn't support logging in from here yet.` };
+        }
+        return {
+          ok: false,
+          retryable: true,
+          line: r.kind === "refused" ? `Couldn't start the login: ${r.reason}.` : `Couldn't reach ${host}: ${r.reason}.`
+        };
+      },
+      poll: async () => {
+        const p = await pollLogin(endpoint, pollSecret);
+        switch (p.kind) {
+          case "approved":
+            emit("configure_cloud_login", { step: "approved" });
+            return {
+              state: "approved",
+              value: {
+                kind: "login",
+                pollSecret,
+                org: p.org,
+                approvedBy: p.approvedBy,
+                keyName: p.keyName,
+                permissions: p.permissions
+              }
+            };
+          case "pending":
+            return { state: "pending", interval: p.interval };
+          case "slow_down":
+            return { state: "slow_down" };
+          case "denied":
+            emit("configure_cloud_login", { step: "denied" });
+            return { state: "denied" };
+          case "unreachable":
+            return { state: "unreachable", line: p.reason };
+          default:
+            return { state: "expired" };
+        }
+      },
+      open: (link) => {
+        if (!canOpenBrowser())
+          return false;
+        openUrl(link);
+        return true;
+      },
+      collapsed: (plan) => [...cloudLines(plan), ""],
+      stdin,
+      stdout
+    });
+  };
+  let savedRefused = false;
+  const chooseConnection = async () => {
+    const verdict = saved && !saved.splitKeys ? await transient("Checking your saved key…", () => checkCloudKey(saved.url, saved.token)) : null;
+    const savedBroken = verdict !== null && !verdict.ok && verdict.refused;
+    savedRefused = savedBroken;
+    const keptPlan = verdict && verdict.ok ? { kind: "kept", how: "saved", verified: true } : verdict && !verdict.refused ? { kind: "kept", how: "saved", verified: false } : { kind: "kept", how: "skip", verified: false };
+    const keepHint = !saved ? "" : saved.splitKeys ? "leave both keys as they are" : verdict?.ok ? `${verdict.org ?? saved.org ?? hostOf(saved.url)} · key ${maskToken(saved.token)}` : savedBroken ? "its key no longer works" : "its key couldn't be checked just now";
+    const login = {
+      label: saved ? "Log in again" : "Log in to FailproofAI Cloud",
+      value: "login",
+      hint: savedBroken ? "recommended · your saved key no longer works" : saved ? "opens your browser and makes a new key" : "recommended · opens your browser"
+    };
+    const key = { label: "Paste an API key", value: "key", hint: "one you already have" };
+    const oss = { label: "Use open source", value: "oss", hint: "skip the cloud" };
+    const keep = { label: "Keep current connection", value: "keep", hint: keepHint };
+    const choices = !saved ? [login, key, oss] : savedBroken ? [login, key, keep] : [keep, login, key];
+    const leftLogin = (result) => {
+      if (result === null || result === BACK) {
+        if (result === BACK && loginUnsupported) {
+          write([kit.caution(`${host} doesn't support logging in from here yet. Paste an API key instead.`), ""]);
+        }
+        return result;
+      }
+      return result.value;
+    };
+    if (url && (!saved || savedBroken)) {
+      if (savedBroken && verdict && !verdict.ok) {
+        write([kit.caution(`Your saved key no longer works: ${verdict.reason}. Logging in again.`)]);
+      }
+      emit("configure_cloud_choice", { choice: "login", connected: Boolean(saved), auto: true });
+      const first = leftLogin(await askLogin(url));
+      if (first !== BACK)
+        return first;
+    }
+    for (;; ) {
+      const pick = await selectOne({
+        message: "Connect to cloud",
+        meta: source ? `${host}  ·  from ${source}` : host,
+        choices: loginUnsupported ? choices.filter((c) => c.value !== "login") : choices,
+        collapsed: (p) => p === "keep" ? [...cloudLines(keptPlan), ""] : p === "oss" ? [...cloudLines({ kind: "oss" }), ""] : [],
+        stdin,
+        stdout
+      });
+      if (pick === null)
+        return null;
+      emit("configure_cloud_choice", { choice: pick, connected: Boolean(saved) });
+      if (pick === "keep")
+        return keptPlan;
+      if (pick === "oss")
+        return { kind: "oss" };
+      if (pick === "key") {
+        const answer = await askKey();
+        if (answer === null)
+          return null;
+        if (answer === OPEN_SOURCE)
+          continue;
+        return planFor(answer);
+      }
+      if (!url) {
+        write([kit.fail(badUrl ?? "No usable endpoint."), ""]);
+        continue;
+      }
+      const result = leftLogin(await askLogin(url));
+      if (result === BACK)
+        continue;
+      return result;
+    }
+  };
   let cloud;
   if (answers.oss) {
     cloud = saved ? { kind: "kept", how: "skip", verified: false } : { kind: "oss" };
@@ -40088,16 +41053,17 @@ ${process.platform} service target.
   } else {
     if (badUrl)
       write([kit.fail(badUrl)]);
-    const answer = await askCloud();
-    if (answer === null)
+    const chosen = await chooseConnection();
+    if (chosen === null)
       return cancel();
-    cloud = planFor(answer);
+    cloud = chosen;
   }
   const fp = readConfig();
   const hookedNow = INTEGRATION_TYPES.filter((id) => hookedAtUserScope(id, cwd));
   const plan = planAgents({ detected: detectInstalledClis(), saved: fp.agents, hooked: hookedNow });
-  const collectingAfter = cloud.kind === "connect" || readIngestCredential() !== null;
-  const sessionsOn = cloud.kind === "connect" ? answers.noTranscripts !== true : fp.collector.sessions === true;
+  const connecting = cloud.kind === "connect" || cloud.kind === "login";
+  const collectingAfter = connecting || readIngestCredential() !== null;
+  const sessionsOn = connecting ? answers.noTranscripts !== true : fp.collector.sessions === true;
   let selected;
   if (answers.agents && answers.agents.length > 0) {
     const named = new Set(answers.agents);
@@ -40129,6 +41095,27 @@ ${process.platform} service target.
   const { added, removed } = agentChanges(plan, selected);
   const done = [];
   let daemonInstalled = daemonAlreadyRunning;
+  if ((daemonWanted || daemonUnitStale) && !unattended) {
+    let stillRoot = false;
+    try {
+      stillRoot = canElevate();
+    } catch {
+      stillRoot = false;
+    }
+    if (!stillRoot && daemonWanted) {
+      if (!elevate("Your sudo session expired while you were away. Installing failproofaid needs root again.")) {
+        write([
+          kit.fail("Couldn't get root, so setup stopped before changing anything."),
+          `  Re-run once you can use sudo:  ${kit.cmd("failproofai config")}`
+        ]);
+        emit("configure_aborted", { reason: "needs_root" });
+        return { applied: false, abort: "needs_root" };
+      }
+    } else if (!stillRoot && !elevate("Your sudo session expired while you were away. Refreshing failproofaid's service definition needs root again.")) {
+      done.push(kit.caution("No root, so its service definition stays as it is. Scheduled audits stay off until it is refreshed."));
+      daemonUnitStale = false;
+    }
+  }
   if (daemonWanted) {
     if (daemonBroken) {
       await transient("Removing the failproofaid service that can't start…", async () => {
@@ -40195,39 +41182,47 @@ ${process.platform} service target.
     setDaemonConfigured(true, version2);
     pruneOldDaemonBinaries();
   }
-  const connectedAfterPlan = cloud.kind === "connect" || cloud.kind === "kept";
-  const applied = emit("configure_applied", {
-    target: "user",
-    scopes: ["user"],
-    cli: selected,
-    cli_count: selected.length,
-    policy_count: (readScopedHooksConfig("user", cwd).enabledPolicies ?? []).length,
-    connected: cloud.kind === "connect",
-    mode: connectedAfterPlan ? "cloud" : "oss",
-    agents_selected: selected.length,
-    agents_detected: plan.detected.size,
-    agents_changed: added.length + removed.length > 0
-  });
   const policies = readScopedHooksConfig("user", cwd).enabledPolicies ?? [];
   if (selected.length > 0)
     await transient("Installing hooks…", () => installHooks(policies, "user", cwd, false, "configure-wizard", undefined, false, selected, { replace: true, quiet: true }));
   removeUserScopeHooks(INTEGRATION_TYPES.filter((id) => !selected.includes(id) && (plan.baseline.has(id) || hookedNow.includes(id))), cwd);
+  installAgentSkill(INTEGRATION_TYPES.filter((id) => plan.detected.has(id) || selected.includes(id)));
   requestFreshStart(plan.mode === "rerun" ? added : [], collectingAfter && sessionsOn);
   updateConfig({ agents: { selected, seen: plan.seen } });
   let connected = false;
-  if (cloud.kind === "connect" && url) {
-    const token = cloud.token;
+  let token = cloud.kind === "connect" ? cloud.token : null;
+  let orgLabel = cloud.kind === "connect" ? cloud.org : undefined;
+  let mintedName;
+  let claimedOrg;
+  if (cloud.kind === "login" && url) {
+    const claimed = await transient("Creating this machine's key…", () => claimLogin(url, cloud.pollSecret));
+    emit("configure_cloud_login", { step: "claimed", ok: claimed.kind === "ok", reason: claimed.kind });
+    if (claimed.kind === "ok") {
+      token = claimed.key;
+      orgLabel = loginOrgLabel(claimed.org);
+      mintedName = claimed.keyName;
+      claimedOrg = claimed.org;
+    } else {
+      hookLogWarn(`cloud login could not be completed: ${claimed.kind}`);
+      done.push(kit.caution(claimed.kind === "expired" ? "The login took too long to finish, so no key was created. Everything else was applied." : claimed.kind === "revoked" ? "Whoever approved the login can no longer create keys in that org, so no key was created." : claimed.kind === "unreachable" ? `Couldn't reach ${host} to create the key (${claimed.reason}); everything else was applied.` : `The key couldn't be created: ${claimed.reason}. Everything else was applied.`, "failproofai config"));
+    }
+  }
+  if (token && url) {
     try {
       const outcome = await transient("Connecting…", () => connectToCloud({
         url,
         token,
         machineId,
         machineLabel,
-        sessions: answers.noTranscripts !== true
+        sessions: answers.noTranscripts !== true,
+        org: claimedOrg
       }));
       connected = outcome.anyConfigured;
       done.push(...outcome.changes ?? []);
-      done.push(...connectDoneLines(kit, outcome, host, cloud.org));
+      done.push(...connectDoneLines(kit, outcome, host, orgLabel));
+      if (cloud.kind === "login" && saved && connected) {
+        done.push(`  Your previous key for this machine still works until you revoke it on ${host}'s keys page.`);
+      }
       if (outcome.ingest.ok && answers.noTranscripts === true) {
         done.push("  Decisions only: session transcripts are not sent (--no-transcripts).");
       }
@@ -40236,10 +41231,29 @@ ${process.platform} service target.
       hookLogWarn(`cloud connection was not written: ${err instanceof Error ? err.message : String(err)}`);
       done.push(kit.caution("Couldn't connect; everything else was applied.", "failproofai config"));
     }
+    if (cloud.kind === "login" && !connected) {
+      done.push(`  The key ${mintedName ? `"${mintedName}" ` : ""}was created but isn't in use here; revoke it on ${host}'s keys page.`);
+    }
   } else if (cloud.kind === "kept" && cloud.how === "saved" && fp.mode !== "cloud") {
     updateConfig({ mode: "cloud" });
   }
-  await applied;
+  const keptOld = cloud.kind === "login" && !connected && Boolean(saved);
+  if (keptOld) {
+    done.push(savedRefused ? "  This machine keeps its previous connection, but its key no longer works. Run failproofai config again to log in." : "  This machine keeps its previous connection.");
+  }
+  const cloudAfter = connected || cloud.kind === "kept" || keptOld;
+  await emit("configure_applied", {
+    target: "user",
+    scopes: ["user"],
+    cli: selected,
+    cli_count: selected.length,
+    policy_count: policies.length,
+    connected,
+    mode: cloudAfter ? "cloud" : "oss",
+    agents_selected: selected.length,
+    agents_detected: plan.detected.size,
+    agents_changed: added.length + removed.length > 0
+  });
   markLauncherSeen();
   clearOnboardingAttempt();
   const codexTrust = selected.includes("codex") ? codexHookTrust() : undefined;
@@ -40248,7 +41262,7 @@ ${process.platform} service target.
     done,
     cwd,
     agents: selected.length,
-    connected: connected || cloud.kind === "kept",
+    connected: cloudAfter,
     codexTrust
   }));
   return {
@@ -40259,10 +41273,15 @@ ${process.platform} service target.
     policies,
     daemonInstalled,
     connected,
-    mode: connected || cloud.kind === "kept" ? "cloud" : "oss",
+    mode: cloudAfter ? "cloud" : "oss",
     agents: { selected, added, removed }
   };
 }
+function loginOrgLabel(org) {
+  if (org.name && org.slug)
+    return `${org.name} (${org.slug})`;
+  return org.name ?? org.slug ?? "your org";
+}
 function savedConnection() {
   const cloud = readCloudCredentials();
   const ingest = readIngestCredential();
@@ -40289,8 +41308,12 @@ function resolveCloudUrl(flag, existing) {
   const env = process.env.FAILPROOFAI_CLOUD_URL?.trim();
   const fromFlag = flag?.trim();
   const override = fromFlag || env;
-  if (!override)
-    return { ok: true, url: existing ?? cloudBaseFor2(DEFAULT_INGEST_URL) };
+  if (!override) {
+    if (!existing)
+      return { ok: true, url: cloudBaseFor2(DEFAULT_INGEST_URL) };
+    const saved = validateCloudUrl(existing);
+    return saved.ok ? { ok: true, url: existing } : { ok: false, message: `the saved cloud address "${existing}" cannot be used: ${saved.reason}` };
+  }
   const source = fromFlag && fromFlag !== env ? "--url" : "FAILPROOFAI_CLOUD_URL";
   const validated = validateCloudUrl(cloudBaseFor2(override));
   if (!validated.ok) {
@@ -40309,6 +41332,9 @@ function hostOf(url) {
   }
 }
 async function checkCloudKey(url, key) {
+  const target = validateCloudUrl(url);
+  if (!target.ok)
+    return { ok: false, refused: false, reason: `the address ${url} can't be used: ${target.reason}` };
   const identity = await introspectKey(url, key);
   if (identity.kind === "rejected")
     return { ok: false, refused: true, reason: "the server did not accept it" };
@@ -40345,6 +41371,11 @@ function cloudCollapsedLines(kit, plan, at) {
         kit.ok(plan.org ? `Key accepted for ${plan.org} on ${at.host}` : `Key accepted by ${at.host}`),
         ...plan.note ? [kit.caution(plan.note)] : []
       ];
+    case "login":
+      return [
+        head,
+        kit.ok(`Logged in${plan.approvedBy ? ` as ${plan.approvedBy}` : ""} · ${loginOrgLabel(plan.org)} on ${at.host}`)
+      ];
   }
 }
 function connectDoneLines(kit, outcome, host, org) {
@@ -40401,10 +41432,13 @@ function doneLines(kit, state) {
 var init_configure_wizard = __esm(() => {
   init_pack_store();
   init_tui();
+  init_cloud_login();
+  init_open_browser();
   init_collector_config();
   init_integrations();
   init_types();
   init_manager();
+  init_agent_skill();
   init_codex_system_hooks();
   init_pack_manifest();
   init_hooks_config();
@@ -40415,6 +41449,7 @@ var init_configure_wizard = __esm(() => {
   init_hook_logger();
   init_cloud_enrollment();
   init_cloud_connection();
+  init_cloud_introspect();
   init_fp_config();
   init_backfill_request();
   init_agent_selection();
@@ -40427,18 +41462,18 @@ var init_configure_wizard = __esm(() => {
 });
 
 // src/hooks/flush-cli.ts
-import { existsSync as existsSync49, mkdirSync as mkdirSync28, writeFileSync as writeFileSync24, readdirSync as readdirSync22, statSync as statSync36 } from "node:fs";
-import { dirname as dirname26, join as join41 } from "node:path";
+import { existsSync as existsSync50, mkdirSync as mkdirSync29, writeFileSync as writeFileSync24, readdirSync as readdirSync22, statSync as statSync36 } from "node:fs";
+import { dirname as dirname26, join as join42 } from "node:path";
 function flushRequestPath2(home) {
-  return join41(failproofaiHome(home), "state", "flush-request.json");
+  return join42(failproofaiHome(home), "state", "flush-request.json");
 }
 function spoolDirs2(home) {
   const root = spoolDir(home);
   const dirs = [root, customAgentsEventsDir(home)];
-  if (!existsSync49(root))
+  if (!existsSync50(root))
     return dirs;
   try {
-    return dirs.concat(readdirSync22(root, { withFileTypes: true }).filter((e) => e.isDirectory() && e.name !== "failed").map((e) => join41(root, e.name)));
+    return dirs.concat(readdirSync22(root, { withFileTypes: true }).filter((e) => e.isDirectory() && e.name !== "failed").map((e) => join42(root, e.name)));
   } catch {
     return dirs;
   }
@@ -40469,7 +41504,7 @@ function spoolBacklog2(home, now = Date.now()) {
     count += names.length;
     for (const name of names) {
       try {
-        const mtime = statSync36(join41(dir, name)).mtimeMs;
+        const mtime = statSync36(join42(dir, name)).mtimeMs;
         if (oldest === undefined || mtime < oldest)
           oldest = mtime;
       } catch {}
@@ -40531,7 +41566,7 @@ async function runFlushCommand2(opts = {}) {
     return { exitCode: 0, pending: 0, lines: nothing };
   }
   const path = flushRequestPath2(home);
-  mkdirSync28(dirname26(path), { recursive: true });
+  mkdirSync29(dirname26(path), { recursive: true });
   writeFileSync24(path, `${JSON.stringify({ requestedAtMs: Date.now() }, null, 2)}
 `, {
     mode: 384
@@ -40565,7 +41600,7 @@ var init_flush_cli2 = __esm(() => {
 });
 
 // src/hooks/backfill-cli.ts
-import { existsSync as existsSync50 } from "node:fs";
+import { existsSync as existsSync51 } from "node:fs";
 async function adapterSessionCount(cli, sinceMs) {
   try {
     return (await getAdapter(cli).listTranscripts({ sinceMs })).length;
@@ -40583,7 +41618,7 @@ async function runBackfillCommand(opts = {}) {
   const sinceLabel = new Date(sinceMs).toISOString().slice(0, 10);
   const home = failproofaiHome();
   const fail = (text, ...fix) => ({ exitCode: 1, lines: [kit.fail(text), ...fix] });
-  if (!existsSync50(home)) {
+  if (!existsSync51(home)) {
     return fail(`There is no failproofai home at ${home}.`, `  Set this machine up first:  ${kit.cmd("failproofai config")}`);
   }
   if (!readIngestCredential()) {
@@ -43058,20 +44093,20 @@ var init_main = __esm(() => {
 });
 
 // src/hooks/otel-writers.ts
-import { homedir as homedir34 } from "node:os";
-import { resolve as resolve34 } from "node:path";
+import { homedir as homedir35 } from "node:os";
+import { resolve as resolve35 } from "node:path";
 import { accessSync as accessSync2, constants, readdirSync as readdirSync23, statSync as statSync37 } from "node:fs";
-function vscodeSettingsPath(home = homedir34(), platform = process.platform) {
+function vscodeSettingsPath(home = homedir35(), platform = process.platform) {
   if (platform === "darwin")
-    return resolve34(home, "Library/Application Support/Code/User/settings.json");
+    return resolve35(home, "Library/Application Support/Code/User/settings.json");
   if (platform === "win32")
-    return resolve34(process.env.APPDATA ?? resolve34(home, "AppData/Roaming"), "Code/User/settings.json");
-  return resolve34(process.env.XDG_CONFIG_HOME ?? resolve34(home, ".config"), "Code/User/settings.json");
+    return resolve35(process.env.APPDATA ?? resolve35(home, "AppData/Roaming"), "Code/User/settings.json");
+  return resolve35(process.env.XDG_CONFIG_HOME ?? resolve35(home, ".config"), "Code/User/settings.json");
 }
-function agentConfigPath(agent, home = homedir34()) {
-  return agent === "copilot" ? vscodeSettingsPath(home) : resolve34(home, `.${agent}`, agent === "codex" ? "config.toml" : "settings.json");
+function agentConfigPath(agent, home = homedir35()) {
+  return agent === "copilot" ? vscodeSettingsPath(home) : resolve35(home, `.${agent}`, agent === "codex" ? "config.toml" : "settings.json");
 }
-function vscodeInstalled(home = homedir34(), platform = process.platform) {
+function vscodeInstalled(home = homedir35(), platform = process.platform) {
   const executable = (path) => {
     try {
       accessSync2(path, platform === "win32" ? constants.F_OK : constants.X_OK);
@@ -43081,13 +44116,13 @@ function vscodeInstalled(home = homedir34(), platform = process.platform) {
     }
   };
   const names = platform === "win32" ? ["code.cmd", "code-insiders.cmd", "Code.exe", "Code - Insiders.exe"] : ["code", "code-insiders"];
-  if ((process.env.PATH ?? "").split(platform === "win32" ? ";" : ":").some((dir) => names.some((name) => executable(resolve34(dir, name)))))
+  if ((process.env.PATH ?? "").split(platform === "win32" ? ";" : ":").some((dir) => names.some((name) => executable(resolve35(dir, name)))))
     return true;
   if (vscodeProbe.appPaths(home, platform).some(executable))
     return true;
   return [".vscode", ".vscode-insiders"].some((folder) => {
     try {
-      return readdirSync23(resolve34(home, folder, "extensions"), { withFileTypes: true }).some((entry) => entry.isDirectory() && /^github\.copilot(?:-chat)?-\d/i.test(entry.name));
+      return readdirSync23(resolve35(home, folder, "extensions"), { withFileTypes: true }).some((entry) => entry.isDirectory() && /^github\.copilot(?:-chat)?-\d/i.test(entry.name));
     } catch {
       return false;
     }
@@ -43295,10 +44330,10 @@ var init_otel_writers = __esm(() => {
       return platform === "darwin" ? [
         "/Applications/Visual Studio Code.app/Contents/MacOS/Electron",
         "/Applications/Visual Studio Code - Insiders.app/Contents/MacOS/Electron",
-        resolve34(home, "Applications/Visual Studio Code.app/Contents/MacOS/Electron")
+        resolve35(home, "Applications/Visual Studio Code.app/Contents/MacOS/Electron")
       ] : platform === "win32" ? [
-        resolve34(process.env.LOCALAPPDATA ?? resolve34(home, "AppData/Local"), "Programs/Microsoft VS Code/Code.exe"),
-        resolve34(process.env.ProgramFiles ?? "C:/Program Files", "Microsoft VS Code/Code.exe")
+        resolve35(process.env.LOCALAPPDATA ?? resolve35(home, "AppData/Local"), "Programs/Microsoft VS Code/Code.exe"),
+        resolve35(process.env.ProgramFiles ?? "C:/Program Files", "Microsoft VS Code/Code.exe")
       ] : ["/usr/share/code/code", "/opt/visual-studio-code/code"];
     }
   };
@@ -43307,16 +44342,16 @@ var init_otel_writers = __esm(() => {
 // src/hooks/otel-cli.ts
 import {
   chmodSync as chmodSync11,
-  existsSync as existsSync51,
-  mkdirSync as mkdirSync29,
-  readFileSync as readFileSync41,
+  existsSync as existsSync52,
+  mkdirSync as mkdirSync30,
+  readFileSync as readFileSync42,
   statSync as statSync38,
   unlinkSync as unlinkSync8,
   writeFileSync as writeFileSync25
 } from "node:fs";
 import { dirname as dirname27 } from "node:path";
 import { createHash as createHash13, randomUUID as randomUUID6 } from "node:crypto";
-import { homedir as homedir35 } from "node:os";
+import { homedir as homedir36 } from "node:os";
 import { connect } from "node:net";
 function rawConfig() {
   return readJsonFile(configFile());
@@ -43346,7 +44381,7 @@ async function waitForCollectorConfig(generation, timeoutMs) {
   const deadline = Date.now() + timeoutMs;
   do {
     try {
-      const health = JSON.parse(readFileSync41(collectorHealthFile(), "utf8"));
+      const health = JSON.parse(readFileSync42(collectorHealthFile(), "utf8"));
       if (health.config_generation === generation && typeof health.ts === "number" && Date.now() - health.ts * 1000 < 35000)
         return true;
     } catch {}
@@ -43355,7 +44390,7 @@ async function waitForCollectorConfig(generation, timeoutMs) {
   return false;
 }
 function privateState(agent) {
-  return JSON.parse(readFileSync41(otelAgentStateFile(agent), "utf8"));
+  return JSON.parse(readFileSync42(otelAgentStateFile(agent), "utf8"));
 }
 function credential() {
   const ingest = readCredentials().ingest;
@@ -43372,15 +44407,15 @@ function credential() {
   return { key, origin: url.origin };
 }
 function backupOnce(path, original) {
-  if (existsSync51(`${path}.failproofai-bak`))
+  if (existsSync52(`${path}.failproofai-bak`))
     return;
-  mkdirSync29(dirname27(path), { recursive: true });
+  mkdirSync30(dirname27(path), { recursive: true });
   writeFileSync25(`${path}.failproofai-bak`, original ?? "", { flag: "wx", mode: 384 });
   chmodSync11(`${path}.failproofai-bak`, 384);
 }
 function savePrivate(agent, state) {
   const path = otelAgentStateFile(agent);
-  mkdirSync29(dirname27(path), { recursive: true, mode: 448 });
+  mkdirSync30(dirname27(path), { recursive: true, mode: 448 });
   writeConfigFileAtomic(path, JSON.stringify(state), { backup: false, mode: 384 });
   chmodSync11(path, 384);
 }
@@ -43419,8 +44454,8 @@ function restoreAgent(agent, raw) {
   if (!record)
     return;
   const state = privateState(agent);
-  if (existsSync51(record.file)) {
-    const current = readFileSync41(record.file, "utf8");
+  if (existsSync52(record.file)) {
+    const current = readFileSync42(record.file, "utf8");
     if (digest(current) === state.writtenHash) {
       if (state.original === null)
         unlinkSync8(record.file);
@@ -43459,8 +44494,8 @@ async function enableAgent(agent, yes, localFlag, content, options) {
   const { key, origin } = credential();
   const raw = rawConfig();
   const previousConfig = structuredClone(raw);
-  const file = agentConfigPath(agent, options.home ?? homedir35());
-  if (agent === "copilot" && !vscodeInstalled(options.home ?? homedir35())) {
+  const file = agentConfigPath(agent, options.home ?? homedir36());
+  if (agent === "copilot" && !vscodeInstalled(options.home ?? homedir36())) {
     return { lines: ["VS Code not found — skipping copilot"], exitCode: 0 };
   }
   const existing = records(raw)[agent];
@@ -43475,7 +44510,7 @@ async function enableAgent(agent, yes, localFlag, content, options) {
   if (!Number.isInteger(port) || port < 1 || port > 65535)
     throw new Error("collector.otlp.port must be between 1 and 65535.");
   const destination = otlpDestination(origin, local, port);
-  const original = existsSync51(file) ? readFileSync41(file, "utf8") : null;
+  const original = existsSync52(file) ? readFileSync42(file, "utf8") : null;
   const parsed = parseAgentConfig(original ?? "", agent);
   const oldState = existing ? privateState(agent) : null;
   const privacyConfig = oldState && original !== null && digest(original) === oldState.writtenHash ? parseAgentConfig(oldState.original ?? "", agent) : parsed;
@@ -43537,7 +44572,7 @@ async function enableAgent(agent, yes, localFlag, content, options) {
   } catch (err) {
     if (original !== null)
       writeConfigFileAtomic(file, original, { backup: false, mode: state.originalMode });
-    else if (existsSync51(file))
+    else if (existsSync52(file))
       unlinkSync8(file);
     saveConfig(previousConfig);
     throw err;
@@ -43580,9 +44615,9 @@ async function status(options) {
     let parsed = {};
     let unreadable = false;
     try {
-      const file = record?.file ?? agentConfigPath(agent, options.home ?? homedir35());
-      if (existsSync51(file))
-        parsed = parseAgentConfig(readFileSync41(file, "utf8"), agent);
+      const file = record?.file ?? agentConfigPath(agent, options.home ?? homedir36());
+      if (existsSync52(file))
+        parsed = parseAgentConfig(readFileSync42(file, "utf8"), agent);
     } catch {
       unreadable = true;
     }
@@ -43604,7 +44639,7 @@ async function status(options) {
   }
   let health = {};
   try {
-    health = JSON.parse(readFileSync41(otlpHealthFile(), "utf8"));
+    health = JSON.parse(readFileSync42(otlpHealthFile(), "utf8"));
   } catch {}
   const requested = readConfig().collector.otlp?.enabled === true;
   const live = requested && health.relay === "listening" && await relayListening(readConfig().collector.otlp?.port ?? 4318);
@@ -43691,6 +44726,7 @@ var init_otel_cli = __esm(() => {
   init_fp_home();
   init_safe_config_write();
   init_collector_config();
+  init_cloud_introspect();
   init_cloud_enrollment();
   init_integrations();
   init_tui();
@@ -43704,6 +44740,7 @@ var init_otel_cli2 = __esm(() => {
   init_fp_home();
   init_safe_config_write();
   init_collector_config();
+  init_cloud_introspect();
   init_cloud_enrollment();
   init_integrations();
   init_tui();
@@ -43741,8 +44778,8 @@ var init_otel_output = __esm(() => {
 });
 
 // src/hooks/harness-cli.ts
-import { homedir as homedir36 } from "node:os";
-import { resolve as resolve35 } from "node:path";
+import { homedir as homedir37 } from "node:os";
+import { resolve as resolve36 } from "node:path";
 function unknownHarness(name) {
   const kit = kitFor();
   return fail([kit.fail(`Unknown harness: ${name}.`), `  Known: ${HARNESS_KEYS.join(", ")}`]);
@@ -43789,8 +44826,8 @@ function comparableLabel(raw) {
   return raw.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
 }
 function comparablePath(raw) {
-  const home = homedir36();
-  const expanded = raw === "~" ? home : raw.startsWith("~/") ? resolve35(home, raw.slice(2)) : raw;
+  const home = homedir37();
+  const expanded = raw === "~" ? home : raw.startsWith("~/") ? resolve36(home, raw.slice(2)) : raw;
   return expanded.replace(/\/+$/, "");
 }
 function effectiveLabel(entry) {
@@ -43948,7 +44985,7 @@ var init_harness_cli = __esm(() => {
 });
 
 // src/hooks/policy-reviewability.ts
-import { resolve as resolve36 } from "node:path";
+import { resolve as resolve37 } from "node:path";
 function countReviewable(policies, knownReviewers) {
   let enabled = 0;
   let reviewable = 0;
@@ -43986,7 +45023,7 @@ function surveyReviewableCoverage(cwd) {
   }
   try {
     const mode = readCloudJevMode();
-    const assignments = readActiveCloudManagedPolicies();
+    const assignments = listActiveCloudManagedPolicies();
     const cloudReviewers = cloudReviewerNames(assignments, mode);
     if (cloudReviewers.length > 0)
       reviewers = new Set([...reviewers ?? [], ...cloudReviewers]);
@@ -43996,9 +45033,9 @@ function surveyReviewableCoverage(cwd) {
   let customFiles = 0;
   try {
     const projectRoot = findProjectConfigDir(cwd ?? process.cwd());
-    const files = new Set(configuredCustomPolicyPaths(config).map((p) => resolve36(projectRoot, p)));
+    const files = new Set(configuredCustomPolicyPaths(config).map((p) => resolve37(projectRoot, p)));
     if (config.customPoliciesEnabled !== false) {
-      const projectDir = resolve36(projectRoot, ".failproofai", "policies");
+      const projectDir = resolve37(projectRoot, ".failproofai", "policies");
       for (const dir of [projectDir, customPoliciesDir()])
         for (const f of discoverPolicyFiles(dir))
           files.add(f);
@@ -44161,7 +45198,7 @@ var init_jev_stats = __esm(() => {
 });
 
 // src/hooks/jev-cli.ts
-import { chmodSync as chmodSync12, existsSync as existsSync52, statSync as statSync39, unlinkSync as unlinkSync9 } from "node:fs";
+import { chmodSync as chmodSync12, existsSync as existsSync53, statSync as statSync39, unlinkSync as unlinkSync9 } from "node:fs";
 import { dirname as dirname28 } from "node:path";
 function jevHeader(name, meta, opts) {
   return [screenKit(opts).header(meta ? `${name}  ·  ${meta}` : name)];
@@ -44264,7 +45301,7 @@ function cloudKeyRow() {
 function octal(mode) {
   return mode === null ? null : mode.toString(8).padStart(4, "0");
 }
-function permissions(mode) {
+function permissions2(mode) {
   if (mode === null)
     return "unknown";
   return (mode & 63) === 0 ? `${octal(mode)} (owner-only)` : `${octal(mode)} (too open)`;
@@ -44476,6 +45513,8 @@ async function setupRun(argv, deps, opts) {
   if (parsed.positionals.length > 0)
     return fail2([STRAY_ARGUMENT, "", ...JEV_USAGE]);
   const { values, bools } = parsed;
+  if (values.has("--mode") && cloudManagesJevMode())
+    return fail2(CLOUD_MANAGED_MODE_LINES);
   if (bools.has("--key-stdin") && bools.has("--key-from-env"))
     return fail2(["Use one of --key-stdin and --key-from-env, not both."]);
   if (values.has("--token") && (bools.has("--key-stdin") || bools.has("--key-from-env"))) {
@@ -44765,7 +45804,7 @@ async function setupRun(argv, deps, opts) {
     ["timeout", `${cfg.timeoutMs} ms`],
     ["key", keyNote],
     ["config", path],
-    ["permissions", permissions(fileMode)]
+    ["permissions", permissions2(fileMode)]
   ], opts), offBase ? jevWarn([
     `Saved as given, but ${provider}'s API is at ${offBase.api}, and this URL sends requests to ${offBase.endpoint} instead.`,
     `Unless something of yours answers Jev requests at that path, every evaluation will fail there and hooks will fall back to regex — \`failproofai jev test\` says which it is in one request. To send requests back to ${provider}'s own API: failproofai jev setup --base-url default`
@@ -44890,7 +45929,7 @@ async function cloudSetup(values, bools, opts) {
     ["timeout", `${cfg.timeoutMs} ms`],
     ["key", keySource ? CLOUD_KEY_SOURCE : cloudKeyRow()],
     ["config", path],
-    ["permissions", permissions(fileMode)]
+    ["permissions", permissions2(fileMode)]
   ], opts), jevNote("Hooks read this file on every tool call — no restart. Calls are charged to your FailproofAI Cloud org's plan.", opts), shownMode === "off" ? null : keySource ? jevNext("failproofai jev test", "Check it with one live request:", opts) : jevNext("failproofai config --token <key>", `Jev stays off until this machine is connected with a key that carries jev:evaluate (the "machine" preset on the dashboard's Keys page):`, opts)));
 }
 function routeForRouting(routing) {
@@ -44954,12 +45993,6 @@ function cloudProblemAdvice(problem) {
       "To use FailproofAI Cloud's Jev checks, reconnect without --no-transcripts (failproofai config --token <key>)."
     ];
   }
-  if (/plain http/.test(problem)) {
-    return [
-      "Jev does not run here: FailproofAI Cloud set enforce, and this machine is connected over plain http, where Jev runs only in observe mode.",
-      "Reconnect to an https FailproofAI Cloud URL (failproofai config --token <key> --url https://…), or set the machine's Jev mode to observe from FailproofAI Cloud."
-    ];
-  }
   return [
     `Jev cannot run here: ${problem}.`,
     "Connect with a key that carries jev:evaluate (failproofai config --token <key>). A local jev.json is not used while FailproofAI Cloud sets the mode."
@@ -45158,7 +46191,7 @@ The daemon does not see this shell's environment.`) : [];
       ...route ? [["endpoint", displayEndpoint(route.endpoint)]] : [],
       ["mode", modeLine(inspection.routing.mode ?? DEFAULT_JEV_MODE)],
       ["key", `from ${JEV_API_KEY_ENV}, not set in this shell; the daemon never sees a shell's environment`],
-      ["config", `${inspection.path}${kit.sep}${permissions(inspection.mode)}`]
+      ["config", `${inspection.path}${kit.sep}${permissions2(inspection.mode)}`]
     ], [legacyNote], [step(`Set ${JEV_API_KEY_ENV} for this shell, or store the key in the file:`, "failproofai jev setup --key-stdin < key-file")]));
   }
   if (inspection.status === "off") {
@@ -45225,7 +46258,7 @@ The daemon does not see this shell's environment.`) : [];
       "key",
       inspection.keySource === "cloud" ? CLOUD_KEY_SOURCE : inspection.keySource === "file" ? "set in the config file" : `from ${JEV_API_KEY_ENV} (this shell only; the daemon does not see it)`
     ],
-    ["config", `${inspection.path}${kit.sep}${permissions(inspection.mode)}`],
+    ["config", `${inspection.path}${kit.sep}${permissions2(inspection.mode)}`],
     ...coverage ? [["reviewable", reviewableSummary(coverage)]] : []
   ], [coverageProblem ? kit.notice("caution", coverageProblem) : [], legacyNote], []));
 }
@@ -45434,7 +46467,7 @@ function remove(argv, opts) {
   if (parsed.positionals.length > 0)
     return fail2([STRAY_ARGUMENT, "", ...JEV_USAGE]);
   const path = jevConfigPath();
-  if (!existsSync52(path)) {
+  if (!existsSync53(path)) {
     return ok2(stack(jevHeader("Jev remove", "nothing to do", opts), jevNote(`There is no ${path}; Jev is already off.`, opts)));
   }
   try {
@@ -45470,7 +46503,7 @@ async function runJevCommand(argv, deps = {}) {
     }
   }
 }
-var liveModelListReader = (url, apiKey) => readJevModelList(url, apiKey, AbortSignal.timeout(JEV_MODEL_LIST_TIMEOUT_MS)), ok2 = (lines, json) => ({ lines, exitCode: 0, ...json !== undefined ? { json } : {} }), fail2 = (lines, json) => ({ lines, exitCode: 1, ...json !== undefined ? { json } : {} }), JEV_USAGE, JEV_TEST_QUESTION_ID = "jev_test", DEFAULT_TEST_TIMEOUT_MS = 15000, ENV_KEY_STAND_IN = "env-key-stand-in", STRAY_ARGUMENT = "Unexpected argument (not repeated here, in case it is a key). The key goes on stdin: --key-stdin.", SUBCOMMAND_SHAPE, VALUE_FLAGS2, BOOL_FLAGS, OPTION_SHAPE, CLOUD_KEY_SOURCE = "FailproofAI Cloud connection", KEY_LACKS_JEV_TITLE = "off — no Jev key is stored for this machine's FailproofAI Cloud connection", MAX_SHOWN_MODELS = 20, TOKEN_HISTORY_WARNING, CLOUD_CREDENTIAL_REFUSED = "the FailproofAI Cloud credential was refused", MODE_SET_BY_CLOUD = "mode set by FailproofAI Cloud";
+var liveModelListReader = (url, apiKey) => readJevModelList(url, apiKey, AbortSignal.timeout(JEV_MODEL_LIST_TIMEOUT_MS)), ok2 = (lines, json) => ({ lines, exitCode: 0, ...json !== undefined ? { json } : {} }), fail2 = (lines, json) => ({ lines, exitCode: 1, ...json !== undefined ? { json } : {} }), JEV_USAGE, JEV_TEST_QUESTION_ID = "jev_test", DEFAULT_TEST_TIMEOUT_MS = 15000, ENV_KEY_STAND_IN = "env-key-stand-in", STRAY_ARGUMENT = "Unexpected argument (not repeated here, in case it is a key). The key goes on stdin: --key-stdin.", SUBCOMMAND_SHAPE, VALUE_FLAGS2, BOOL_FLAGS, OPTION_SHAPE, CLOUD_KEY_SOURCE = "FailproofAI Cloud connection", CLOUD_MANAGED_MODE_LINES, KEY_LACKS_JEV_TITLE = "off — no Jev key is stored for this machine's FailproofAI Cloud connection", MAX_SHOWN_MODELS = 20, TOKEN_HISTORY_WARNING, CLOUD_CREDENTIAL_REFUSED = "the FailproofAI Cloud credential was refused", MODE_SET_BY_CLOUD = "mode set by FailproofAI Cloud";
 var init_jev_cli = __esm(() => {
   init_atomic_write();
   init_jev_config();
@@ -45494,6 +46527,7 @@ var init_jev_cli = __esm(() => {
   VALUE_FLAGS2 = new Set(["--provider", "--url", "--token", "--base-url", "--account-id", "--model", "--timeout-ms", "--mode"]);
   BOOL_FLAGS = new Set(["--key-stdin", "--key-from-env", "--json"]);
   OPTION_SHAPE = /^--?[a-z][a-z0-9-]{0,30}$/;
+  CLOUD_MANAGED_MODE_LINES = [CLOUD_MANAGED_JEV_MODE, "Deploy or remove Jev policies in FailproofAI Cloud to change it. Nothing was written."];
   TOKEN_HISTORY_WARNING = [
     TOKEN_ON_ARGV,
     "Prefer piping the key in — `failproofai jev --url <url> --key-stdin < key-file` — and rotate this one if it matters."
@@ -45505,11 +46539,11 @@ import {
   chmodSync as chmodSync13,
   closeSync as closeSync8,
   constants as fsConstants6,
-  existsSync as existsSync53,
+  existsSync as existsSync54,
   fstatSync as fstatSync4,
-  mkdirSync as mkdirSync30,
+  mkdirSync as mkdirSync31,
   openSync as openSync8,
-  readFileSync as readFileSync42,
+  readFileSync as readFileSync43,
   readSync as readSync6,
   statSync as statSync40,
   writeFileSync as writeFileSync26
@@ -45521,17 +46555,17 @@ function detectLayout2() {
       return { kind: "current", version: raw };
     return raw.layout > LAYOUT_VERSION ? { kind: "future", found: raw.layout } : { kind: "stale", found: raw.layout };
   }
-  if (existsSync53(configFile())) {
+  if (existsSync54(configFile())) {
     const layoutThreePositions = [
       legacy.authJson(),
       legacy.nextAudit(),
       legacy.auditSchedule()
     ];
-    if (layoutThreePositions.some((p) => existsSync53(p)))
+    if (layoutThreePositions.some((p) => existsSync54(p)))
       return { kind: "stale", found: 3 };
     return { kind: "current", version: { layout: LAYOUT_VERSION, cli: "" }, inferred: true };
   }
-  if (existsSync53(legacy.configToml()))
+  if (existsSync54(legacy.configToml()))
     return { kind: "stale", found: 2 };
   const layoutOneMarkers = [
     legacy.policyConfig(),
@@ -45542,7 +46576,7 @@ function detectLayout2() {
     legacy.ingestCredentials(),
     legacy.auditDashboard()
   ];
-  return layoutOneMarkers.some((p) => existsSync53(p)) ? { kind: "stale", found: 1 } : { kind: "absent" };
+  return layoutOneMarkers.some((p) => existsSync54(p)) ? { kind: "stale", found: 1 } : { kind: "absent" };
 }
 function readLegacyTomlVersion2(text) {
   const layout = Number(/^\s*layout\s*=\s*(\d+)\s*$/m.exec(text)?.[1]);
@@ -45554,7 +46588,7 @@ function readLegacyTomlVersion2(text) {
 function readVersionFile2() {
   let text;
   try {
-    text = readFileSync42(versionFile(), "utf8");
+    text = readFileSync43(versionFile(), "utf8");
   } catch {
     return null;
   }
@@ -45588,14 +46622,14 @@ var init_fp_home2 = () => {};
 import {
   chmodSync as chmodSync14,
   copyFileSync as copyFileSync4,
-  existsSync as existsSync54,
-  mkdirSync as mkdirSync31,
-  readFileSync as readFileSync43,
+  existsSync as existsSync55,
+  mkdirSync as mkdirSync32,
+  readFileSync as readFileSync44,
   renameSync as renameSync15,
-  rmSync as rmSync20,
+  rmSync as rmSync21,
   writeFileSync as writeFileSync27
 } from "node:fs";
-import { basename as basename10, dirname as dirname29, join as join42, resolve as resolve37 } from "node:path";
+import { basename as basename10, dirname as dirname29, join as join43, resolve as resolve38 } from "node:path";
 function migrateToLayout42() {
   const moves = [
     { from: legacy.authJson(), to: auditSessionFile() },
@@ -45604,20 +46638,20 @@ function migrateToLayout42() {
   ];
   const authDirOverride = process.env.FAILPROOFAI_AUTH_DIR;
   if (authDirOverride) {
-    moves.push({ from: join42(authDirOverride, "auth.json"), to: join42(authDirOverride, "session.json") }, {
-      from: join42(authDirOverride, "next-audit.json"),
-      to: join42(authDirOverride, "reminder.json")
+    moves.push({ from: join43(authDirOverride, "auth.json"), to: join43(authDirOverride, "session.json") }, {
+      from: join43(authDirOverride, "next-audit.json"),
+      to: join43(authDirOverride, "reminder.json")
     });
   }
   const migrated = [];
   for (const { from, to } of moves) {
-    if (!existsSync54(from))
+    if (!existsSync55(from))
       continue;
-    if (existsSync54(to)) {
-      rmSync20(from, { force: true });
+    if (existsSync55(to)) {
+      rmSync21(from, { force: true });
       continue;
     }
-    mkdirSync31(dirname29(to), { recursive: true });
+    mkdirSync32(dirname29(to), { recursive: true });
     try {
       renameSync15(from, to);
     } catch {
@@ -45625,16 +46659,16 @@ function migrateToLayout42() {
         copyFileSync4(from, to);
       } catch (err) {
         try {
-          rmSync20(to, { force: true });
+          rmSync21(to, { force: true });
         } catch {}
         throw err;
       }
-      rmSync20(from, { force: true });
+      rmSync21(from, { force: true });
     }
     migrated.push(`${basename10(from)} → audit/${basename10(to)}`);
   }
   for (const secret of [auditSessionFile()]) {
-    if (!existsSync54(secret))
+    if (!existsSync55(secret))
       continue;
     try {
       chmodSync14(secret, 384);
@@ -45660,7 +46694,7 @@ function planMigration2(from, registry = MIGRATIONS2) {
 }
 function readLedger2() {
   try {
-    const parsed = JSON.parse(readFileSync43(migrationLedgerFile(), "utf8"));
+    const parsed = JSON.parse(readFileSync44(migrationLedgerFile(), "utf8"));
     return Array.isArray(parsed) ? parsed : [];
   } catch {
     return [];
@@ -45668,7 +46702,7 @@ function readLedger2() {
 }
 function appendLedger2(entry) {
   try {
-    mkdirSync31(migrationsDir(), { recursive: true });
+    mkdirSync32(migrationsDir(), { recursive: true });
     const all = [...readLedger2(), entry];
     writeFileSync27(migrationLedgerFile(), `${JSON.stringify(all, null, 2)}
 `, "utf8");
@@ -45682,12 +46716,12 @@ function pruneMigratedCredentials2(from) {
   for (let layout = from;layout < LAYOUT_VERSION; layout++) {
     for (const { as, landsAt } of PRUNED_AFTER_SUCCESS2) {
       try {
-        if (!existsSync54(landsAt()))
+        if (!existsSync55(landsAt()))
           continue;
-        const copy = resolve37(migrationBackupDir(layout), as);
-        if (!existsSync54(copy))
+        const copy = resolve38(migrationBackupDir(layout), as);
+        if (!existsSync55(copy))
           continue;
-        rmSync20(copy, { force: true });
+        rmSync21(copy, { force: true });
         pruned.push(as);
       } catch {}
     }
@@ -45698,7 +46732,7 @@ function filesToBackUp2() {
   const seen = new Map;
   for (const f of [...BACKED_UP2, ...BACKED_UP_LEGACY2]) {
     const path = f.at();
-    if (existsSync54(path))
+    if (existsSync55(path))
       seen.set(path, backupNameOf2(f));
   }
   return [...seen].map(([path, as]) => ({ path, as }));
@@ -45707,14 +46741,14 @@ function backupBeforeMigrating2(from) {
   const dir = migrationBackupDir(from);
   const saved = [];
   try {
-    rmSync20(dir, { recursive: true, force: true });
-    mkdirSync31(dir, { recursive: true });
+    rmSync21(dir, { recursive: true, force: true });
+    mkdirSync32(dir, { recursive: true });
   } catch {
     return [];
   }
   for (const { path: source, as } of filesToBackUp2()) {
     try {
-      copyFileSync4(source, resolve37(dir, as));
+      copyFileSync4(source, resolve38(dir, as));
       saved.push(as);
     } catch {}
   }
@@ -45852,16 +46886,16 @@ var init_migrations2 = __esm(() => {
 
 // src/hooks/daemon-service.ts
 import {
-  existsSync as existsSync55,
-  mkdirSync as mkdirSync32,
+  existsSync as existsSync56,
+  mkdirSync as mkdirSync33,
   mkdtempSync as mkdtempSync2,
-  readFileSync as readFileSync44,
+  readFileSync as readFileSync45,
   writeFileSync as writeFileSync28,
   unlinkSync as unlinkSync10,
-  rmSync as rmSync21
+  rmSync as rmSync22
 } from "node:fs";
-import { homedir as homedir37, tmpdir as tmpdir3, userInfo as userInfo2 } from "node:os";
-import { resolve as resolve38 } from "node:path";
+import { homedir as homedir38, tmpdir as tmpdir3, userInfo as userInfo2 } from "node:os";
+import { resolve as resolve39 } from "node:path";
 import { execFileSync as execFileSync3 } from "node:child_process";
 function isDaemonSupportedPlatform2() {
   return process.platform === "linux" || process.platform === "darwin";
@@ -45877,13 +46911,13 @@ function resolveFailproofaidBinaryPath2() {
   if (process.env.FAILPROOFAI_DAEMON_BINARY)
     return process.env.FAILPROOFAI_DAEMON_BINARY;
   const downloaded = installedBinaryPath();
-  if (existsSync55(downloaded))
+  if (existsSync56(downloaded))
     return downloaded;
   const packageRoot = process.env.FAILPROOFAI_PACKAGE_ROOT;
   if (packageRoot) {
     for (const profile of ["release", "debug"]) {
-      const candidate = resolve38(packageRoot, "target", profile, "failproofaid");
-      if (existsSync55(candidate))
+      const candidate = resolve39(packageRoot, "target", profile, "failproofaid");
+      if (existsSync56(candidate))
         return candidate;
     }
   }
@@ -45913,8 +46947,8 @@ function resolveWorkerCommand2() {
   const packageRoot = process.env.FAILPROOFAI_PACKAGE_ROOT;
   if (!packageRoot)
     return null;
-  const workerScript = resolve38(packageRoot, "dist", "worker.mjs");
-  if (!existsSync55(workerScript))
+  const workerScript = resolve39(packageRoot, "dist", "worker.mjs");
+  if (!existsSync56(workerScript))
     return null;
   return `${shellQuote2(process.execPath)} ${shellQuote2(workerScript)}`;
 }
@@ -45924,8 +46958,8 @@ function resolveCliCommand2() {
   const packageRoot = process.env.FAILPROOFAI_PACKAGE_ROOT;
   if (!packageRoot)
     return null;
-  const cliScript = resolve38(packageRoot, "dist", "cli.mjs");
-  if (!existsSync55(cliScript))
+  const cliScript = resolve39(packageRoot, "dist", "cli.mjs");
+  if (!existsSync56(cliScript))
     return null;
   return `${shellQuote2(process.execPath)} ${shellQuote2(cliScript)}`;
 }
@@ -45938,8 +46972,8 @@ function workerScriptPath2() {
   const packageRoot = process.env.FAILPROOFAI_PACKAGE_ROOT;
   if (!packageRoot)
     return null;
-  const workerScript = resolve38(packageRoot, "dist", "worker.mjs");
-  return existsSync55(workerScript) ? workerScript : null;
+  const workerScript = resolve39(packageRoot, "dist", "worker.mjs");
+  return existsSync56(workerScript) ? workerScript : null;
 }
 function assertUnitSafe2(value, field) {
   if (UNIT_UNSAFE_RE2.test(value)) {
@@ -45965,10 +46999,10 @@ function systemdUnitDir2() {
   return process.env.FAILPROOFAI_SYSTEMD_DIR || "/etc/systemd/system";
 }
 function systemdUnitPath2(user = serviceUser2()) {
-  return resolve38(systemdUnitDir2(), systemdUnitName2(user));
+  return resolve39(systemdUnitDir2(), systemdUnitName2(user));
 }
 function legacySystemdUserUnitPath2() {
-  return resolve38(homedir37(), ".config", "systemd", "user", "failproofaid.service");
+  return resolve39(homedir38(), ".config", "systemd", "user", "failproofaid.service");
 }
 function launchdLabel2(user = serviceUser2()) {
   return `ai.failproof.failproofaid.${user}`;
@@ -45977,7 +47011,7 @@ function launchdPlistPath2(user = serviceUser2()) {
   return `/Library/LaunchDaemons/${launchdLabel2(user)}.plist`;
 }
 function legacyLaunchAgentPlistPath2() {
-  return resolve38(homedir37(), "Library", "LaunchAgents", "ai.failproof.failproofaid.plist");
+  return resolve39(homedir38(), "Library", "LaunchAgents", "ai.failproof.failproofaid.plist");
 }
 function legacySharedLaunchDaemonPath2() {
   return "/Library/LaunchDaemons/ai.failproof.failproofaid.plist";
@@ -46015,20 +47049,20 @@ function runPrivileged2(command, args) {
   execFileSync3(cmd, argv, { stdio: "ignore", timeout: SERVICE_CMD_TIMEOUT_MS2 });
 }
 function writePrivilegedFile2(destination, contents, mode = "0644") {
-  const stagingDir = mkdtempSync2(resolve38(tmpdir3(), "failproofaid-stage-"));
-  const staging = resolve38(stagingDir, "service-definition");
+  const stagingDir = mkdtempSync2(resolve39(tmpdir3(), "failproofaid-stage-"));
+  const staging = resolve39(stagingDir, "service-definition");
   try {
     writeFileSync28(staging, contents, "utf8");
     runPrivileged2("install", ["-m", mode, staging, destination]);
   } finally {
-    rmSync21(stagingDir, { recursive: true, force: true });
+    rmSync22(stagingDir, { recursive: true, force: true });
   }
 }
 function removeLegacyUserService2() {
   try {
     if (process.platform === "linux") {
       const legacy = legacySystemdUserUnitPath2();
-      if (!existsSync55(legacy))
+      if (!existsSync56(legacy))
         return;
       try {
         execFileSync3("systemctl", ["--user", "disable", "--now", "failproofaid.service"], {
@@ -46045,7 +47079,7 @@ function removeLegacyUserService2() {
       } catch {}
     } else {
       const legacyAgent = legacyLaunchAgentPlistPath2();
-      if (existsSync55(legacyAgent)) {
+      if (existsSync56(legacyAgent)) {
         try {
           execFileSync3("launchctl", ["unload", "-w", legacyAgent], {
             stdio: "ignore",
@@ -46055,7 +47089,7 @@ function removeLegacyUserService2() {
         unlinkSync10(legacyAgent);
       }
       const legacyDaemon = legacySharedLaunchDaemonPath2();
-      if (existsSync55(legacyDaemon)) {
+      if (existsSync56(legacyDaemon)) {
         try {
           runPrivileged2("launchctl", ["unload", "-w", legacyDaemon]);
         } catch {}
@@ -46071,8 +47105,8 @@ function systemdUnitContents2(binaryPath, workerCmd, cliCmd = null) {
 `).join("");
   const user = assertUnitSafe2(serviceUser2(), "User");
   assertUnitSafe2(binaryPath, "ExecStart");
-  assertUnitSafe2(homedir37(), "HOME");
-  const conditionPaths = [binaryPath, workerScriptPath2()].filter((p) => typeof p === "string" && existsSync55(p));
+  assertUnitSafe2(homedir38(), "HOME");
+  const conditionPaths = [binaryPath, workerScriptPath2()].filter((p) => typeof p === "string" && existsSync56(p));
   const conditionLines = conditionPaths.map((p) => `ConditionPathExists=${assertUnitSafe2(p, "ConditionPathExists")}
 `).join("");
   return `[Unit]
@@ -46085,7 +47119,7 @@ User=${user}
 # Set explicitly rather than relying on systemd deriving it from User=:
 # failproofaid stores per-user state and refuses to start without HOME, so this
 # required variable is not left to a version-dependent default.
-Environment="HOME=${homedir37()}"
+Environment="HOME=${homedir38()}"
 ${envLines}ExecStart=${binaryPath}
 Restart=on-failure
 RestartSec=2
@@ -46130,9 +47164,9 @@ ${env.map(([key, value]) => `        <key>${key}</key>
     <key>UserName</key>
     <string>${escapeXml2(serviceUser2())}</string>
 ${envBlock}    <key>StandardOutPath</key>
-    <string>${escapeXml2(resolve38(logDir, "failproofaid.log"))}</string>
+    <string>${escapeXml2(resolve39(logDir, "failproofaid.log"))}</string>
     <key>StandardErrorPath</key>
-    <string>${escapeXml2(resolve38(logDir, "failproofaid.err.log"))}</string>
+    <string>${escapeXml2(resolve39(logDir, "failproofaid.err.log"))}</string>
 </dict>
 </plist>
 `;
@@ -46178,7 +47212,7 @@ async function installDaemonService2() {
     } else {
       const plistPath = launchdPlistPath2();
       const logDir = logsDir();
-      mkdirSync32(logDir, { recursive: true });
+      mkdirSync33(logDir, { recursive: true });
       try {
         runPrivileged2("launchctl", ["unload", plistPath]);
       } catch {}
@@ -46294,7 +47328,7 @@ async function refreshDaemonToCliVersion(deps = {}) {
     return { ok: true, lines: ["No failproofaid service on this machine; nothing to update."] };
   }
   const recorded = readVersionFile()?.daemon;
-  if (current === "running" && recorded === version2 && existsSync55(installedBinaryPath(version2))) {
+  if (current === "running" && recorded === version2 && existsSync56(installedBinaryPath(version2))) {
     return { ok: true, lines: [`failproofaid ${version2} is already installed and running; nothing to update.`] };
   }
   if (interactive())
@@ -46333,7 +47367,7 @@ function daemonServiceStatus2() {
   if (!isDaemonSupportedPlatform2())
     return "unsupported-platform";
   if (process.platform === "linux") {
-    if (!existsSync55(systemdUnitPath2()))
+    if (!existsSync56(systemdUnitPath2()))
       return "not-installed";
     try {
       const out = execFileSync3("systemctl", ["is-active", systemdUnitName2()], {
@@ -46346,7 +47380,7 @@ function daemonServiceStatus2() {
     }
   }
   const plistPath = launchdPlistPath2();
-  if (!existsSync55(plistPath))
+  if (!existsSync56(plistPath))
     return "not-installed";
   try {
     const root = typeof process.getuid === "function" && process.getuid() === 0;
@@ -46414,7 +47448,7 @@ var init_hermes_update = __esm(() => {
 });
 
 // src/hooks/uninstall-cli.ts
-import { existsSync as existsSync56, rmSync as rmSync22 } from "node:fs";
+import { existsSync as existsSync57, rmSync as rmSync23 } from "node:fs";
 function survey(cwd) {
   const clis = [];
   for (const id of listInstallableIds()) {
@@ -46434,11 +47468,12 @@ function survey(cwd) {
   const servicePath = isDaemonSupportedPlatform() ? daemonServiceFilePath() : null;
   return {
     clis,
+    skillDirs: installedAgentSkillDirs(),
     codexSystemPath: codexSystemHooksPresent() ? codexSystemConfigPath() : null,
     servicePath,
-    serviceInstalled: !!servicePath && existsSync56(servicePath),
+    serviceInstalled: !!servicePath && existsSync57(servicePath),
     daemonConfigured,
-    homeExists: existsSync56(failproofaiHome())
+    homeExists: existsSync57(failproofaiHome())
   };
 }
 async function runUninstallCommand(opts = {}) {
@@ -46448,7 +47483,7 @@ async function runUninstallCommand(opts = {}) {
   const many = (n, one) => `${n} ${one}${n === 1 ? "" : "s"}`;
   const errText = (err) => err instanceof Error ? err.message : String(err);
   const lines = [];
-  const nothingToDo = found.clis.length === 0 && !found.serviceInstalled && !found.daemonConfigured && !(opts.purge && found.homeExists);
+  const nothingToDo = found.clis.length === 0 && found.skillDirs.length === 0 && !found.serviceInstalled && !found.daemonConfigured && !(opts.purge && found.homeExists);
   if (nothingToDo) {
     return {
       exitCode: 0,
@@ -46462,6 +47497,8 @@ ${home} still holds settings and history. Delete it with  \`failproofai uninstal
   const removals = [];
   if (found.clis.length > 0)
     removals.push(`failproofai's hooks from ${many(found.clis.length, "agent")}`);
+  if (found.skillDirs.length > 0)
+    removals.push(`the failproofai skill from ${many(found.skillDirs.length, "agent folder")}`);
   if (found.serviceInstalled)
     removals.push("the failproofaid service (needs sudo)");
   if (purging)
@@ -46548,6 +47585,15 @@ ${home} still holds settings and history. Delete it with  \`failproofai uninstal
 ` + "Finish with  `failproofai policies --uninstall --scope all`");
     }
   }
+  if (found.skillDirs.length > 0) {
+    const left = found.skillDirs.length - removeAgentSkill().length;
+    if (left === 0)
+      lines.push(kit.ok(`Removed the failproofai skill from ${many(found.skillDirs.length, "agent folder")}.`));
+    else
+      failures.push(`Could not remove the failproofai skill from ${many(left, "agent folder")}:
+${installedAgentSkillDirs().join(`
+`)}`);
+  }
   if (found.serviceInstalled) {
     elevateOnce();
     const byHand = (servicePath) => `
@@ -46557,18 +47603,18 @@ Remove it as root:
 Check it with  \`${daemonStatusCommand()}\`` : "");
     try {
       await uninstallDaemonService();
-      if (found.servicePath && existsSync56(found.servicePath)) {
+      if (found.servicePath && existsSync57(found.servicePath)) {
         failures.push("The failproofaid service is still there, most often because sudo was not available." + byHand(found.servicePath));
       } else {
         lines.push(kit.ok("Stopped and removed the failproofaid service."));
       }
     } catch (err) {
-      failures.push(`Could not remove the failproofaid service: ${errText(err)}` + (found.servicePath && existsSync56(found.servicePath) ? byHand(found.servicePath) : ""));
+      failures.push(`Could not remove the failproofaid service: ${errText(err)}` + (found.servicePath && existsSync57(found.servicePath) ? byHand(found.servicePath) : ""));
     }
   }
   if (purging) {
     try {
-      rmSync22(home, { recursive: true, force: true });
+      rmSync23(home, { recursive: true, force: true });
       purged = true;
       lines.push(kit.ok(`Deleted ${home}.`));
     } catch (err) {
@@ -46603,16 +47649,17 @@ var init_uninstall_cli = __esm(() => {
   init_daemon_service();
   init_integrations();
   init_manager();
+  init_agent_skill();
   init_codex_system_hooks();
   init_tui();
 });
 
 // src/hooks/pack-cli.ts
 import { execFileSync as execFileSync4 } from "node:child_process";
-import { homedir as homedir38, tmpdir as tmpdir4 } from "node:os";
+import { homedir as homedir39, tmpdir as tmpdir4 } from "node:os";
 import { createHash as createHash14 } from "node:crypto";
-import { copyFileSync as copyFileSync5, existsSync as existsSync57, mkdirSync as mkdirSync33, mkdtempSync as mkdtempSync3, readFileSync as readFileSync45, readdirSync as readdirSync24, realpathSync as realpathSync5, rmSync as rmSync23, statSync as statSync41, writeFileSync as writeFileSync29 } from "node:fs";
-import { basename as basename11, dirname as dirname30, isAbsolute as isAbsolute6, join as join43, relative as relative5, resolve as resolve39, sep as sep6 } from "node:path";
+import { copyFileSync as copyFileSync5, existsSync as existsSync58, mkdirSync as mkdirSync34, mkdtempSync as mkdtempSync3, readFileSync as readFileSync46, readdirSync as readdirSync24, realpathSync as realpathSync5, rmSync as rmSync24, statSync as statSync41, writeFileSync as writeFileSync29 } from "node:fs";
+import { basename as basename11, dirname as dirname30, isAbsolute as isAbsolute6, join as join44, relative as relative5, resolve as resolve40, sep as sep6 } from "node:path";
 function parseList(rest, ...flags) {
   let found = false;
   const out = [];
@@ -46727,7 +47774,7 @@ async function build(rest) {
   const commit = flag("commit");
   const effect = flag("effect") ?? "enforce";
   const minCliVersion = flag("min-cli-version");
-  const outDir = resolve39(flag("out") ?? "dist-pack");
+  const outDir = resolve40(flag("out") ?? "dist-pack");
   const repo = flag("repo");
   if (!entry || !id || !version) {
     return fail3([
@@ -46747,10 +47794,10 @@ async function build(rest) {
   } catch (err) {
     return fail3([err instanceof Error ? err.message : String(err)]);
   }
-  const entryPath = resolve39(entry);
-  if (!existsSync57(entryPath))
+  const entryPath = resolve40(entry);
+  if (!existsSync58(entryPath))
     return fail3([`No such file: ${entryPath}`]);
-  const source = readFileSync45(entryPath, "utf8");
+  const source = readFileSync46(entryPath, "utf8");
   const localImport = firstRelativeSpecifier(source);
   if (localImport) {
     return fail3([
@@ -46869,14 +47916,14 @@ async function build(rest) {
     ...semantic.length > 0 ? { semantic } : {}
   }, null, 2) + `
 `;
-  mkdirSync33(outDir, { recursive: true });
-  const manifestPath = resolve39(outDir, PACK_MANIFEST_ASSET);
-  const entryOut = resolve39(outDir, PACK_ENTRY_ASSET);
+  mkdirSync34(outDir, { recursive: true });
+  const manifestPath = resolve40(outDir, PACK_MANIFEST_ASSET);
+  const entryOut = resolve40(outDir, PACK_ENTRY_ASSET);
   writeFileSync29(manifestPath, manifest, "utf8");
   copyFileSync5(entryPath, entryOut);
   const sha = (bytes) => createHash14("sha256").update(bytes).digest("hex");
-  writeFileSync29(resolve39(outDir, PACK_CHECKSUMS_ASSET), `${sha(manifest)}  ${PACK_MANIFEST_ASSET}
-${sha(readFileSync45(entryOut))}  ${PACK_ENTRY_ASSET}
+  writeFileSync29(resolve40(outDir, PACK_CHECKSUMS_ASSET), `${sha(manifest)}  ${PACK_MANIFEST_ASSET}
+${sha(readFileSync46(entryOut))}  ${PACK_ENTRY_ASSET}
 `, "utf8");
   const on = policies.filter((p) => p.defaultEnabled).length;
   const semanticOnly = policies.length === 0 && semantic.length > 0;
@@ -47017,11 +48064,11 @@ async function scaffold(target) {
       return ok3(["Nothing written."]);
     chosen = answer.trim();
   }
-  const path = resolve39(withPolicyExtension(chosen ?? "my-policies"));
-  if (existsSync57(path)) {
+  const path = resolve40(withPolicyExtension(chosen ?? "my-policies"));
+  if (existsSync58(path)) {
     return fail3([`${path} already exists — name a different file, or edit that one.`]);
   }
-  mkdirSync33(resolve39(path, ".."), { recursive: true });
+  mkdirSync34(resolve40(path, ".."), { recursive: true });
   writeFileSync29(path, `import { customPolicies, allow, deny } from "failproofai";
 
 // One file, no relative imports: only this entry is digest-pinned, so a pack
@@ -47059,7 +48106,7 @@ customPolicies.add({
 function inferRepo(entryPath) {
   try {
     const url = execFileSync4("git", ["remote", "get-url", "origin"], {
-      cwd: resolve39(entryPath, ".."),
+      cwd: resolve40(entryPath, ".."),
       encoding: "utf8",
       stdio: ["ignore", "pipe", "ignore"],
       timeout: 5000
@@ -47071,7 +48118,7 @@ function inferRepo(entryPath) {
   }
 }
 function inferCommit(entryPath, outDir, sources) {
-  const cwd = resolve39(entryPath, "..");
+  const cwd = resolve40(entryPath, "..");
   const raw = (args) => {
     try {
       return execFileSync4("git", args, {
@@ -47126,9 +48173,9 @@ function realOrSelf(path) {
   }
 }
 function sourcesInHead(git, raw, sources) {
-  const paths = sources.map((f) => realOrSelf(resolve39(f)));
+  const paths = sources.map((f) => realOrSelf(resolve40(f)));
   const shown = git(["rev-parse", "--show-toplevel"]);
-  const top = shown === null ? null : realOrSelf(resolve39(shown));
+  const top = shown === null ? null : realOrSelf(resolve40(shown));
   const missing = [];
   for (const path of paths) {
     const rel = top ? relative5(top, path) : null;
@@ -47152,7 +48199,7 @@ function sourcesInHead(git, raw, sources) {
   ]);
   if (status === null)
     return { ok: false, offending: paths, why: "modified" };
-  const dirty = porcelainEntries(status).flatMap((entry) => [entry.path, entry.from].filter(Boolean).map((path) => resolve39(top ?? ".", path)));
+  const dirty = porcelainEntries(status).flatMap((entry) => [entry.path, entry.from].filter(Boolean).map((path) => resolve40(top ?? ".", path)));
   if (dirty.length > 0)
     return { ok: false, offending: dirty, why: "modified" };
   return { ok: true };
@@ -47160,19 +48207,19 @@ function sourcesInHead(git, raw, sources) {
 function skipOutDir(git, entryPath, outDir) {
   if (!outDir)
     return [];
-  const out = resolve39(outDir);
-  if (resolve39(entryPath).startsWith(out + sep6))
+  const out = resolve40(outDir);
+  if (resolve40(entryPath).startsWith(out + sep6))
     return [];
   const top = git(["rev-parse", "--show-toplevel"]);
   if (!top)
     return [];
-  const rel = relative5(resolve39(top), out);
+  const rel = relative5(resolve40(top), out);
   if (!rel || rel.startsWith("..") || isAbsolute6(rel))
     return [];
   return ["--", ":(top)", `:(exclude,literal,top)${rel.split(sep6).join("/")}`];
 }
 function inferTaggedVersion(entryPath, sources) {
-  const cwd = resolve39(entryPath, "..");
+  const cwd = resolve40(entryPath, "..");
   const raw = (args) => {
     try {
       return execFileSync4("git", args, {
@@ -47210,11 +48257,11 @@ function findEntry(dir) {
   for (const name of names) {
     if (!/\.(mjs|js|ts)$/.test(name))
       continue;
-    const full = resolve39(dir, name);
+    const full = resolve40(dir, name);
     try {
       if (statSync41(full).size > 512 * 1024)
         continue;
-      const text = readFileSync45(full, "utf8");
+      const text = readFileSync46(full, "utf8");
       if (/from\s+["']failproofai["']/.test(text) && /(?:customPolicies|semanticPolicies)\s*\.\s*add\s*\(/.test(text)) {
         found.push(full);
       }
@@ -47225,7 +48272,7 @@ function findEntry(dir) {
   return found.sort();
 }
 function withLocalImports(sources) {
-  const seen = new Set(sources.map((f) => resolve39(f)));
+  const seen = new Set(sources.map((f) => resolve40(f)));
   const queue = [...seen];
   while (queue.length > 0 && seen.size < 500) {
     const file = queue.shift();
@@ -47233,13 +48280,13 @@ function withLocalImports(sources) {
     try {
       if (statSync41(file).size > 512 * 1024)
         continue;
-      text = readFileSync45(file, "utf8");
+      text = readFileSync46(file, "utf8");
     } catch {
       continue;
     }
     for (const re of LOCAL_IMPORT_RES) {
       for (const match of text.matchAll(re)) {
-        const base = resolve39(dirname30(file), match[1]);
+        const base = resolve40(dirname30(file), match[1]);
         for (const ext of LOCAL_IMPORT_EXTENSIONS) {
           const candidate = base + ext;
           if (seen.has(candidate))
@@ -47260,7 +48307,7 @@ function withLocalImports(sources) {
   return [...seen];
 }
 function settleGitState(entryPath, provenance, packFiles, id, outDir) {
-  const cwd = resolve39(entryPath, "..");
+  const cwd = resolve40(entryPath, "..");
   const raw = (args) => {
     try {
       return execFileSync4("git", args, {
@@ -47335,11 +48382,11 @@ function settleGitState(entryPath, provenance, packFiles, id, outDir) {
   if (root === null || status === null)
     return null;
   const entries = porcelainEntries(status);
-  const dirty = entries.map((entry) => resolve39(root, entry.path));
-  const renamedFrom = entries.filter((entry) => entry.from).map((entry) => resolve39(root, entry.from));
+  const dirty = entries.map((entry) => resolve40(root, entry.path));
+  const renamedFrom = entries.filter((entry) => entry.from).map((entry) => resolve40(root, entry.from));
   if (dirty.length === 0)
     return null;
-  const mine = new Set(packFiles.map((f) => resolve39(f)));
+  const mine = new Set(packFiles.map((f) => resolve40(f)));
   const foreign = dirty.filter((path) => !mine.has(path));
   const toStage = [...dirty, ...renamedFrom];
   if (foreign.length > 0) {
@@ -47470,7 +48517,7 @@ function pushExistingHistory(dir, owner, name, token) {
   const branch = git(["rev-parse", "--abbrev-ref", "HEAD"]);
   if (!branch || branch === "HEAD" || !git(["rev-parse", "--verify", "HEAD"]))
     return false;
-  const askpass = join43(mkdtempSync3(join43(tmpdir4(), "fpai-askpass-")), "askpass.sh");
+  const askpass = join44(mkdtempSync3(join44(tmpdir4(), "fpai-askpass-")), "askpass.sh");
   try {
     writeFileSync29(askpass, `#!/bin/sh
 case "$1" in
@@ -47492,7 +48539,7 @@ esac
     return true;
   } finally {
     try {
-      rmSync23(dirname30(askpass), { recursive: true, force: true });
+      rmSync24(dirname30(askpass), { recursive: true, force: true });
     } catch {}
   }
 }
@@ -47516,8 +48563,8 @@ failproofai policies add ${owner}/${name}
 function findBun() {
   const candidates = [
     "bun",
-    process.env.BUN_INSTALL ? resolve39(process.env.BUN_INSTALL, "bin", "bun") : null,
-    resolve39(homedir38(), ".bun", "bin", "bun"),
+    process.env.BUN_INSTALL ? resolve40(process.env.BUN_INSTALL, "bin", "bun") : null,
+    resolve40(homedir39(), ".bun", "bin", "bun"),
     "/opt/homebrew/bin/bun",
     "/usr/local/bin/bun"
   ].filter((c) => c !== null);
@@ -47543,12 +48590,12 @@ function bundleEntry(sources, outDir) {
       ]
     };
   }
-  mkdirSync33(outDir, { recursive: true });
-  const entry = resolve39(outDir, ".entry.generated.mjs");
-  writeFileSync29(entry, sources.map((f) => `import ${JSON.stringify(f.startsWith("/") ? f : resolve39(f))};`).join(`
+  mkdirSync34(outDir, { recursive: true });
+  const entry = resolve40(outDir, ".entry.generated.mjs");
+  writeFileSync29(entry, sources.map((f) => `import ${JSON.stringify(f.startsWith("/") ? f : resolve40(f))};`).join(`
 `) + `
 `, "utf8");
-  const bundled = resolve39(outDir, ".bundled.mjs");
+  const bundled = resolve40(outDir, ".bundled.mjs");
   try {
     execFileSync4(bun, [
       "build",
@@ -47680,7 +48727,7 @@ async function publish(rest) {
 `);
     const token = githubToken();
     const login = token ? await credentialLogin(token) : null;
-    const folder = basename11(resolve39(entry, ".."));
+    const folder = basename11(resolve40(entry, ".."));
     const answered = await askWhereToPublish(`${login ?? "your-account"}/${folder}`, { stdin: process.stdin, stdout: process.stdout });
     if (answered === null)
       return ok3(["Nothing was published."]);
@@ -47690,7 +48737,7 @@ async function publish(rest) {
   let version = flag("version") ?? (entry ? inferTaggedVersion(entry, bundledSources) : null) ?? undefined;
   const dryRun = rest.includes("--dry-run") || !repo;
   const allowPrivate = rest.includes("--allow-private");
-  const id = flag("id") ?? repo ?? (dryRun && entry ? `local/${basename11(resolve39(entry, ".."))}` : undefined);
+  const id = flag("id") ?? repo ?? (dryRun && entry ? `local/${basename11(resolve40(entry, ".."))}` : undefined);
   const [owner, name] = (repo ?? "/").split("/");
   if (repo && (!owner || !name || repo.split("/").length !== 2)) {
     return fail3([`--repo must be <owner>/<repo>, got ${JSON.stringify(repo)}`]);
@@ -47709,7 +48756,7 @@ async function publish(rest) {
       "With no --repo it writes the three release assets and stops."
     ]);
   }
-  const outDirEarly = resolve39(flag("out") ?? "dist-pack");
+  const outDirEarly = resolve40(flag("out") ?? "dist-pack");
   let provenance = entry ? inferCommit(entry, outDirEarly, bundledSources) : null;
   const gitLines = [];
   if (!version && entry && interactive) {
@@ -47748,7 +48795,7 @@ async function publish(rest) {
         "It needs write access to releases on that repository, and nothing else."
       ]);
     }
-    const ensured = await ensureRepo(owner, name, id, token, resolve39(entry, ".."));
+    const ensured = await ensureRepo(owner, name, id, token, resolve40(entry, ".."));
     if ("error" in ensured)
       return fail3(ensured.error);
     created = ensured.created;
@@ -47761,7 +48808,7 @@ async function publish(rest) {
   }
   const tag = flag("tag") ?? version;
   let entryToBuild = entry;
-  const needsBundle = discovered.length > 1 || firstRelativeSpecifier(readFileSync45(entry, "utf8")) !== null;
+  const needsBundle = discovered.length > 1 || firstRelativeSpecifier(readFileSync46(entry, "utf8")) !== null;
   if (needsBundle) {
     const sources = discovered.length > 1 ? discovered : [entry];
     const bundled = bundleEntry(sources, outDirEarly);
@@ -47842,7 +48889,7 @@ async function publish(rest) {
     if (prior) {
       await gh(`${GITHUB_API2}/repos/${owner}/${name}/releases/assets/${prior.id}`, auth, { method: "DELETE" });
     }
-    const bytes = readFileSync45(resolve39(outDir, asset));
+    const bytes = readFileSync46(resolve40(outDir, asset));
     const upload = await gh(`${GITHUB_UPLOADS2}/repos/${owner}/${name}/releases/${releaseId}/assets?name=${encodeURIComponent(asset)}`, auth, {
       method: "POST",
       contentType: asset.endsWith(".json") ? "application/json" : "application/octet-stream",
@@ -48569,8 +49616,8 @@ var init_install_prompt = __esm(() => {
 
 // src/hooks/manager.ts
 import { execSync as execSync8 } from "node:child_process";
-import { existsSync as existsSync58 } from "node:fs";
-import { resolve as resolve40, basename as basename12 } from "node:path";
+import { existsSync as existsSync59 } from "node:fs";
+import { resolve as resolve41, basename as basename12 } from "node:path";
 import { platform as platform4, arch as arch4, release as release3, hostname as hostname6 } from "node:os";
 function getSettingsPath2(scope, cwd) {
   return claudeCode.getSettingsPath(scope, cwd);
@@ -48713,6 +49760,34 @@ function integrationsInstalledAt2(scope, cwd) {
     }
   });
 }
+function cloudPolicyStatus2() {
+  let count = 0;
+  let observing = false;
+  const jsIds = new Set;
+  try {
+    for (const artifact of listActiveCloudManagedPolicies()) {
+      jsIds.add(artifact.id);
+      if (artifact.effect === "observe")
+        observing = true;
+      else
+        count++;
+    }
+  } catch {}
+  try {
+    const { jevMode } = readCloudJevState();
+    if (jevMode === "enforce" || jevMode === "observe") {
+      for (const assignment of readCloudJevAssignments() ?? []) {
+        if (jsIds.has(assignment.id))
+          continue;
+        if (jevMode === "observe" || assignment.effect === "observe")
+          observing = true;
+        else
+          count++;
+      }
+    }
+  } catch {}
+  return { count, observing };
+}
 function notEnforcingReason2(cwd) {
   const wired = deduplicateScopes2(HOOK_SCOPES, cwd).some((scope) => hooksInstalledInSettings2(scope, cwd));
   if (!wired)
@@ -48735,17 +49810,13 @@ function notEnforcingReason2(cwd) {
         return null;
     }
   } catch {}
-  try {
-    for (const artifact of listActiveCloudManagedPolicies()) {
-      if (artifact.effect === "observe")
-        observing = true;
-      else
-        return null;
-    }
-  } catch {}
+  const cloud = cloudPolicyStatus2();
+  if (cloud.count > 0)
+    return null;
+  observing ||= cloud.observing;
   if (configuredCustomPolicyPaths(config).length > 0)
     return null;
-  const projectDir = resolve40(findProjectConfigDir(cwd ?? process.cwd()), ".failproofai", "policies");
+  const projectDir = resolve41(findProjectConfigDir(cwd ?? process.cwd()), ".failproofai", "policies");
   if (discoverPolicyFiles(projectDir).length > 0 || discoverPolicyFiles(customPoliciesDir()).length > 0) {
     return null;
   }
@@ -48841,9 +49912,9 @@ async function installHooksImpl2(policyNames, scope = "user", cwd, includeBeta =
     delete configToWrite.customPoliciesPath;
     delete configToWrite.customPoliciesPaths;
   } else if (customPoliciesPath && (typeof customPoliciesPath === "string" || customPoliciesPath.length > 0)) {
-    const incoming = (typeof customPoliciesPath === "string" ? [customPoliciesPath] : customPoliciesPath).map((path) => resolve40(path));
-    const carried = (previousConfig.customPoliciesPaths ?? (previousConfig.customPoliciesPath ? [previousConfig.customPoliciesPath] : [])).map((path) => resolve40(path)).filter((path) => {
-      if (existsSync58(path))
+    const incoming = (typeof customPoliciesPath === "string" ? [customPoliciesPath] : customPoliciesPath).map((path) => resolve41(path));
+    const carried = (previousConfig.customPoliciesPaths ?? (previousConfig.customPoliciesPath ? [previousConfig.customPoliciesPath] : [])).map((path) => resolve41(path)).filter((path) => {
+      if (existsSync59(path))
         return true;
       console.log(`Dropping custom policies path (file no longer exists): ${path}`);
       return false;
@@ -48928,7 +49999,7 @@ Validated ${validatedHooks.length} custom hook(s) from ${path}: ${validatedHooks
       const placed = installCodexSystemHooks(codexSystemHookEntries(binaryPath));
       if (placed.ok) {
         const userPath = integration.getSettingsPath("user", cwd);
-        if (existsSync58(userPath))
+        if (existsSync59(userPath))
           integration.removeHooksFromFile(userPath);
         writtenSettingsPaths.push({ cli: cliId, path: placed.path });
         continue;
@@ -49125,7 +50196,7 @@ async function removeHooks2(policyNames, scope = "user", cwd, opts) {
         }
       }
       const settingsPaths = settingsPathsFor(integration, s, cwd);
-      const existing = cliId === "hermes" ? settingsPaths : settingsPaths.filter((p) => existsSync58(p));
+      const existing = cliId === "hermes" ? settingsPaths : settingsPaths.filter((p) => existsSync59(p));
       if (existing.length === 0) {
         totalRemoved += removedFromSystem;
         if (removedFromSystem > 0)
@@ -49282,7 +50353,9 @@ function renderPoliciesScreen(screen, opts = {}) {
       out.push(`${INDENT}Jev mode: off, set by FailproofAI Cloud (overrides jev.json).`);
     } else if (jevMode) {
       out.push(`${INDENT}Jev mode: ${jevMode}, set by FailproofAI Cloud. Jev checks run on FailproofAI Cloud; nothing of them is installed here.`);
-      out.push(`${INDENT}Jev-only Cloud policies are not listed here; see them with ${kit.cmd("fp fleet show")} or on the dashboard.`);
+      if (!screen.cloud.jevListed) {
+        out.push(`${INDENT}Jev-only Cloud policies are not listed here; see them with ${kit.cmd("fp fleet show")} or on the dashboard.`);
+      }
     }
     for (const problem of problems ?? [])
       out.push(kit.caution(problem));
@@ -49332,8 +50405,8 @@ async function listHooks(cwd, { all = false } = {}) {
   const custom = [];
   let customProblem = null;
   for (const path of configuredCustomPolicyPaths(config)) {
-    const absPath = resolve40(findProjectConfigDir(cwd ?? process.cwd()), path);
-    if (!existsSync58(absPath)) {
+    const absPath = resolve41(findProjectConfigDir(cwd ?? process.cwd()), path);
+    if (!existsSync59(absPath)) {
       custom.push({ state: "failed", name: absPath, description: "not found" });
       customProblem ??= "A custom policy file was not found, so its policies are not running.";
       continue;
@@ -49353,7 +50426,7 @@ async function listHooks(cwd, { all = false } = {}) {
     }
   }
   const base = findProjectConfigDir(cwd ?? process.cwd());
-  const projectDir = resolve40(base, ".failproofai", "policies");
+  const projectDir = resolve41(base, ".failproofai", "policies");
   const userDir = customPoliciesDir();
   const sameDir = userDir === projectDir;
   const conventionDirs = [
@@ -49441,19 +50514,27 @@ async function listHooks(cwd, { all = false } = {}) {
           loadErrors.set(e.id, e.message);
       }
     } catch {}
-    let loadChecked = null;
+    let jevAssignments = null;
     try {
-      const record = readCloudLoadChecked();
-      loadChecked = new Set(record && record.deployment === active[0]?.deployment ? record.checked : []);
-    } catch {
-      loadChecked = new Set;
-    }
-    const labels = active.some((a) => a.agentTargets?.some((tg) => tg.instanceId)) ? readRosterLabels() : new Map;
+      jevAssignments = readCloudJevAssignments();
+    } catch {}
+    const jsIds = new Set(active.map((a) => a.id));
+    const jevOnly = (jevAssignments ?? []).filter((a) => !jsIds.has(a.id));
+    const labels = [...active, ...jevOnly].some((a) => a.agentTargets?.some((tg) => tg.instanceId)) ? readRosterLabels() : new Map;
     const targetText = (targets) => `for ${targets.map((tg) => tg.instanceId ? `${tg.integration} / ${labels.get(tg.instanceId) ?? tg.instanceId}` : tg.integration).join(", ")}`;
-    if (active.length > 0 || jev.jevMode !== null) {
+    if (active.length > 0 || jevOnly.length > 0 || jev.jevMode !== null) {
+      const jevRows = jevOnly.map((a) => {
+        const tags = [
+          ...a.effect === "observe" ? ["observe"] : [],
+          "jev",
+          ...a.agentTargets?.length ? [targetText(a.agentTargets)] : []
+        ];
+        return { state: "on", name: a.id, description: `v${a.version}`, tag: tags.join(" · ") };
+      });
       cloud = {
         deployment: active[0]?.deployment ?? jev.deployment ?? null,
-        rows: active.map((artifact) => {
+        jevListed: jevAssignments !== null,
+        rows: [...active.map((artifact) => {
           const both = artifact.authority === "reviewable" && (artifact.reviewedBy?.length ?? 0) > 0;
           const checks = both ? (artifact.reviewedBy ?? []).join(", ") : "";
           const tags = [
@@ -49471,21 +50552,13 @@ async function listHooks(cwd, { all = false } = {}) {
               tag: [...tags, `not loaded: ${failed}`].join(" · ")
             };
           }
-          if (!loadChecked?.has(`${artifact.id}@${artifact.version}`)) {
-            return {
-              state: "off",
-              name: artifact.id,
-              description: `v${artifact.version}`,
-              tag: [...tags, "not loaded yet: it loads at the next agent tool call"].join(" · ")
-            };
-          }
           return {
             state: "on",
             name: artifact.id,
             description: `v${artifact.version}`,
             ...tags.length > 0 ? { tag: tags.join(" · ") } : {}
           };
-        }),
+        }), ...jevRows],
         jevMode: jev.jevMode,
         problems: [
           ...jsProblem !== null ? [`The Cloud JavaScript policies could not be read, so none of them is enforcing: ${jsProblem}`] : [],
@@ -49558,11 +50631,11 @@ var init_manager2 = __esm(() => {
 });
 
 // src/audit/audit-schedule.ts
-import { readFileSync as readFileSync46 } from "node:fs";
+import { readFileSync as readFileSync47 } from "node:fs";
 function readAuditSchedule(home) {
   let raw;
   try {
-    raw = readFileSync46(auditScheduleFile(home), "utf8");
+    raw = readFileSync47(auditScheduleFile(home), "utf8");
   } catch {
     return null;
   }
@@ -49914,14 +50987,14 @@ var init_schedule_cli = __esm(() => {
 });
 
 // scripts/parse-script-args.ts
-import { resolve as resolve41 } from "path";
+import { resolve as resolve42 } from "path";
 function parseStringFlag(flagName, errorLabel, inlineValue, args, index, options) {
   const raw = inlineValue ?? args[index + 1];
   if (raw === undefined || inlineValue === null && raw.startsWith("-")) {
     console.error(`Error: ${flagName} requires ${errorLabel}`);
     process.exit(1);
   }
-  const value = options?.resolve ? resolve41(raw) : raw;
+  const value = options?.resolve ? resolve42(raw) : raw;
   return { value, spliceCount: inlineValue !== null ? 1 : 2 };
 }
 function parseScriptArgs(argv) {
@@ -49977,21 +51050,21 @@ function parseScriptArgs(argv) {
 var init_parse_script_args = () => {};
 
 // scripts/install-diagnosis.mjs
-import { existsSync as existsSync59, readFileSync as readFileSync47, realpathSync as realpathSync6 } from "node:fs";
-import { dirname as dirname31, resolve as resolve42 } from "node:path";
-import { homedir as homedir39, platform as platform5 } from "node:os";
+import { existsSync as existsSync60, readFileSync as readFileSync48, realpathSync as realpathSync6 } from "node:fs";
+import { dirname as dirname31, resolve as resolve43 } from "node:path";
+import { homedir as homedir40, platform as platform5 } from "node:os";
 import { spawnSync } from "node:child_process";
 function findPackageRoot(start) {
   try {
     let dir = realpathSync6(start);
-    if (existsSync59(dir) && !existsSync59(resolve42(dir, "package.json"))) {
+    if (existsSync60(dir) && !existsSync60(resolve43(dir, "package.json"))) {
       dir = dirname31(dir);
     }
     while (true) {
-      const pkgPath = resolve42(dir, "package.json");
-      if (existsSync59(pkgPath)) {
+      const pkgPath = resolve43(dir, "package.json");
+      if (existsSync60(pkgPath)) {
         try {
-          const pkg = JSON.parse(readFileSync47(pkgPath, "utf8"));
+          const pkg = JSON.parse(readFileSync48(pkgPath, "utf8"));
           if (pkg.name === PKG_NAME)
             return dir;
         } catch {}
@@ -50009,7 +51082,7 @@ function readPackageVersion(packageRoot) {
   if (!packageRoot)
     return null;
   try {
-    const pkg = JSON.parse(readFileSync47(resolve42(packageRoot, "package.json"), "utf8"));
+    const pkg = JSON.parse(readFileSync48(resolve43(packageRoot, "package.json"), "utf8"));
     return typeof pkg.version === "string" ? pkg.version : null;
   } catch {
     return null;
@@ -50035,16 +51108,16 @@ function locateNpmGlobal() {
     const root = (res.stdout || "").trim();
     if (!root)
       return null;
-    const candidate = resolve42(root, PKG_NAME);
-    return existsSync59(resolve42(candidate, "package.json")) ? candidate : null;
+    const candidate = resolve43(root, PKG_NAME);
+    return existsSync60(resolve43(candidate, "package.json")) ? candidate : null;
   } catch {
     return null;
   }
 }
 function locateBunGlobal() {
   try {
-    const candidate = resolve42(homedir39(), ".bun", "install", "global", "node_modules", PKG_NAME);
-    return existsSync59(resolve42(candidate, "package.json")) ? candidate : null;
+    const candidate = resolve43(homedir40(), ".bun", "install", "global", "node_modules", PKG_NAME);
+    return existsSync60(resolve43(candidate, "package.json")) ? candidate : null;
   } catch {
     return null;
   }
@@ -50052,8 +51125,8 @@ function locateBunGlobal() {
 function buildRecommendation(pathFirstBin) {
   if (!pathFirstBin)
     return null;
-  const bunBinPrefix = resolve42(homedir39(), ".bun", "bin") + "/";
-  const bunGlobalPrefix = resolve42(homedir39(), ".bun", "install", "global") + "/";
+  const bunBinPrefix = resolve43(homedir40(), ".bun", "bin") + "/";
+  const bunGlobalPrefix = resolve43(homedir40(), ".bun", "install", "global") + "/";
   const isBun = pathFirstBin.startsWith(bunBinPrefix) || pathFirstBin.startsWith(bunGlobalPrefix);
   if (isBun) {
     return `rm -f ~/.bun/bin/${PKG_NAME} && rm -rf ~/.bun/install/global/node_modules/${PKG_NAME}`;
@@ -50526,8 +51599,8 @@ var init_launch_ready = () => {};
 
 // scripts/launch.ts
 import { spawn as spawn2 } from "child_process";
-import { realpathSync as realpathSync7, existsSync as existsSync60 } from "node:fs";
-import { resolve as resolve43, dirname as dirname32 } from "node:path";
+import { realpathSync as realpathSync7, existsSync as existsSync61 } from "node:fs";
+import { resolve as resolve44, dirname as dirname32 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 function launch(mode, options = {}) {
   const { loggingLevel, disableTelemetry, allowedDevOrigins, host, remainingArgs } = parseScriptArgs(process.argv.slice(2));
@@ -50563,9 +51636,9 @@ ${k.caution(exposedBindWarning(exposed.host))}
     process.env.PORT = port;
     process.env.HOSTNAME = bindHost;
     cmd = "node";
-    const packageRoot = process.env.FAILPROOFAI_PACKAGE_ROOT ?? resolve43(dirname32(realpathSync7(fileURLToPath2(import.meta.url))), "..");
-    const serverJsPath = resolve43(packageRoot, ".next/standalone/server.js");
-    if (!existsSync60(serverJsPath)) {
+    const packageRoot = process.env.FAILPROOFAI_PACKAGE_ROOT ?? resolve44(dirname32(realpathSync7(fileURLToPath2(import.meta.url))), "..");
+    const serverJsPath = resolve44(packageRoot, ".next/standalone/server.js");
+    if (!existsSync61(serverJsPath)) {
       let shadowMessage = null;
       try {
         const diag = diagnoseShadow({ selfPackageRoot: packageRoot, selfVersion: version2 });
@@ -51272,12 +52345,12 @@ var init_session_pause_cli = __esm(() => {
 });
 
 // src/hooks/config-status.ts
-import { readFileSync as readFileSync48 } from "node:fs";
-import { resolve as resolve44 } from "node:path";
+import { readFileSync as readFileSync49 } from "node:fs";
+import { resolve as resolve45 } from "node:path";
 function readCollectorHealth(file = collectorHealthFile()) {
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync48(file, "utf8"));
+    parsed = JSON.parse(readFileSync49(file, "utf8"));
   } catch {
     return null;
   }
@@ -51347,14 +52420,14 @@ function summarizePolicySources(cwd) {
     summary.morePacks = Math.max(0, enforcing - 1);
   } catch {}
   try {
-    for (const artifact of readActiveCloudManagedPolicies()) {
+    for (const artifact of listActiveCloudManagedPolicies()) {
       if (artifact.effect === "observe")
         summary.observing++;
       else
         summary.cloudOn++;
     }
   } catch {}
-  const projectDir = resolve44(findProjectConfigDir(cwd ?? process.cwd()), ".failproofai", "policies");
+  const projectDir = resolve45(findProjectConfigDir(cwd ?? process.cwd()), ".failproofai", "policies");
   const conventionFiles = new Set([...discoverPolicyFiles(projectDir), ...discoverPolicyFiles(customPoliciesDir())]);
   summary.customFiles = configuredCustomPolicyPaths(config).length + conventionFiles.size;
   if (config.enabledPolicies.length > 0 && !hasInstalledRegexPacks())
@@ -51555,7 +52628,8 @@ function renderStatusScreen(facts, opts = {}) {
     }
     if (!health.delivering)
       return `${kit.off} Not delivering, failproofaid has no key`;
-    const backlog = queued === 0 ? "nothing queued" : `${many(queued, "batch", "batches")} queued`;
+    const pending = queued + (refused.resending ?? 0);
+    const backlog = pending === 0 ? "nothing queued" : `${many(pending, "batch", "batches")} queued`;
     const stuck = queued > 0 && (oldestQueuedMs ?? 0) > STATUS_QUEUE_STUCK_MS && (health.lastOkAt === undefined || now - health.lastOkAt > STATUS_QUEUE_STUCK_MS);
     if (stuck) {
       const last = health.lastOkAt !== undefined ? `last delivered ${ago(health.lastOkAt)}` : "nothing delivered since failproofaid started";
@@ -51790,8 +52864,8 @@ var init_session_pause_cli2 = __esm(() => {
 
 // scripts/launch.ts
 import { spawn as spawn3 } from "child_process";
-import { realpathSync as realpathSync8, existsSync as existsSync61 } from "node:fs";
-import { resolve as resolve45, dirname as dirname33 } from "node:path";
+import { realpathSync as realpathSync8, existsSync as existsSync62 } from "node:fs";
+import { resolve as resolve46, dirname as dirname33 } from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 function launch2(mode, options = {}) {
   const { loggingLevel, disableTelemetry, allowedDevOrigins, host, remainingArgs } = parseScriptArgs(process.argv.slice(2));
@@ -51827,9 +52901,9 @@ ${k.caution(exposedBindWarning(exposed.host))}
     process.env.PORT = port;
     process.env.HOSTNAME = bindHost;
     cmd = "node";
-    const packageRoot = process.env.FAILPROOFAI_PACKAGE_ROOT ?? resolve45(dirname33(realpathSync8(fileURLToPath3(import.meta.url))), "..");
-    const serverJsPath = resolve45(packageRoot, ".next/standalone/server.js");
-    if (!existsSync61(serverJsPath)) {
+    const packageRoot = process.env.FAILPROOFAI_PACKAGE_ROOT ?? resolve46(dirname33(realpathSync8(fileURLToPath3(import.meta.url))), "..");
+    const serverJsPath = resolve46(packageRoot, ".next/standalone/server.js");
+    if (!existsSync62(serverJsPath)) {
       let shadowMessage = null;
       try {
         const diag = diagnoseShadow({ selfPackageRoot: packageRoot, selfVersion: version2 });
@@ -51949,17 +53023,17 @@ var init_cli_error2 = __esm(() => {
 
 // bin/failproofai.mjs
 import { realpathSync as realpathSync9 } from "fs";
-import { dirname as dirname34, resolve as resolve46 } from "path";
+import { dirname as dirname34, resolve as resolve47 } from "path";
 import { fileURLToPath as fileURLToPath4 } from "url";
 // package.json
-var version = "1.0.12-beta.1";
+var version = "1.0.12-beta.2";
 
 // bin/failproofai.mjs
 if (!process.env.FAILPROOFAI_PACKAGE_ROOT) {
-  process.env.FAILPROOFAI_PACKAGE_ROOT = resolve46(dirname34(realpathSync9(fileURLToPath4(import.meta.url))), "..");
+  process.env.FAILPROOFAI_PACKAGE_ROOT = resolve47(dirname34(realpathSync9(fileURLToPath4(import.meta.url))), "..");
 }
 if (!process.env.FAILPROOFAI_DIST_PATH) {
-  process.env.FAILPROOFAI_DIST_PATH = resolve46(dirname34(realpathSync9(fileURLToPath4(import.meta.url))), "..", "dist");
+  process.env.FAILPROOFAI_DIST_PATH = resolve47(dirname34(realpathSync9(fileURLToPath4(import.meta.url))), "..", "dist");
 }
 var args = process.argv.slice(2);
 if (args[0] === "p" || args[0] === "policy")