failproofai 1.0.12-beta.1 → 1.0.12-beta.2

package/hermes-plugin/__init__.py

@@ -104,6 +104,17 @@ def _profile_name() -> str:
 
 def _profile_settings_path(profile: str) -> str | None:
     """Evidence of the profile running this plugin, not a transcript guess."""
+    try:
+        # The host's own resolver first: it honours a per-task profile
+        # override as well as HERMES_HOME, so each profile of a multi-profile
+        # gateway reports its own config (and roster identity), not the
+        # process-wide one.
+        from hermes_constants import get_hermes_home
+
+        hosted = Path(get_hermes_home()).expanduser() / "config.yaml"
+        return str(hosted.absolute()) if hosted.is_file() else None
+    except Exception:
+        pass
     configured = os.environ.get("HERMES_HOME", "").strip()
     if configured:
         selected = Path(configured).expanduser() / "config.yaml"

package/hermes-plugin/plugin.yaml

@@ -1,5 +1,5 @@
 name: failproofai
-version: 1.0.12-beta.1
+version: 1.0.12-beta.2
 description: Real-time FailproofAI policy enforcement for Hermes
 manifest_version: 2
 api_version: 1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "failproofai",
-  "version": "1.0.12-beta.1",
+  "version": "1.0.12-beta.2",
   "description": "Observability and enforcement for AI agent harnesses. 40 built-in policies hooked into 12 of them — Claude Code, Codex, Cursor, Hermes, OpenClaw and more — blocking the tool call before it runs. Local dashboard included, no account needed.",
   "bin": {
     "failproofai": "./dist/cli.mjs",
@@ -118,22 +118,23 @@
     "postcss": "8.5.26",
     "eslint-plugin-react-hooks": "7.0.1",
     "vite": "8.1.6",
-    "undici": "7.29.1",
+    "undici": "7.30.1",
+    "zod": "4.6.6",
     "brace-expansion": "5.0.12",
     "sharp": "0.35.5",
     "source-map-js": "1.2.2",
     "browserslist": "4.28.8"
   },
   "optionalDependencies": {
-    "@failproofai/failproofaid-linux-x64": "1.0.12-beta.1",
-    "@failproofai/failproofaid-linux-arm64": "1.0.12-beta.1",
-    "@failproofai/failproofaid-darwin-x64": "1.0.12-beta.1",
-    "@failproofai/failproofaid-darwin-arm64": "1.0.12-beta.1"
+    "@failproofai/failproofaid-linux-x64": "1.0.12-beta.2",
+    "@failproofai/failproofaid-linux-arm64": "1.0.12-beta.2",
+    "@failproofai/failproofaid-darwin-x64": "1.0.12-beta.2",
+    "@failproofai/failproofaid-darwin-arm64": "1.0.12-beta.2"
   },
   "failproofaidBinaries": {
-    "linux-x64": "df15e65b60066248038c8ac6d423bffcb0e38637e8a42fa22250afa111fd46ac",
-    "linux-arm64": "59d7ae758c8981c5e0a89eb64be18ebd278213525dd4447891a51be6bb018ed9",
-    "darwin-x64": "b0d3d39abaa02ed0a14dddc68277975a7a23e200830b7edbffdedde3af81ce73",
-    "darwin-arm64": "a6d343b5926e84c0eb437af307f85b69b3128f94c6e34acbf9d0b13a7c7e9d63"
+    "linux-x64": "4c09117fdb80d87792d1d2b77d9359cdbd0c522b5a6222ab7b927659130ddf54",
+    "linux-arm64": "dd390d76561267fc519ceb96fb90be340044e2f564bef36a44e284f227d93f29",
+    "darwin-x64": "62381f7ffe21d02289c36c4b205166b2867dbde986444d1ea185241b94fd04ef",
+    "darwin-arm64": "9ad798817d3048a5126e80dc71883538d37c1b6b6443e9c19389dc2583c8f675"
   }
 }

package/src/audit/open-browser.ts

@@ -13,18 +13,35 @@ import { spawn } from "node:child_process";
 const POLL_INTERVAL_MS = 150;
 const POLL_TIMEOUT_MS = 30_000;
 
+/**
+ * Whether opening a browser here can put a page in front of the person.
+ *
+ * False over SSH — `xdg-open` would start a browser on the REMOTE machine, or
+ * fail, while the person is looking at their own screen — and on a Linux box
+ * with no display at all (a container, a server). Callers then print the link,
+ * which works from any device. A guess, not a promise: a false positive costs a
+ * browser that does not appear next to a link that is printed anyway.
+ */
+export function canOpenBrowser(
+  env: NodeJS.ProcessEnv = process.env,
+  platform: NodeJS.Platform = process.platform,
+): boolean {
+  if (env.SSH_CONNECTION || env.SSH_CLIENT || env.SSH_TTY) return false;
+  if (platform === "linux" && !env.DISPLAY && !env.WAYLAND_DISPLAY) return false;
+  return true;
+}
+
 /** Open a URL with the platform's default handler. Never throws. */
-function openUrl(url: string): void {
+export function openUrl(url: string, platform: NodeJS.Platform = process.platform): void {
   let cmd: string;
   let args: string[];
-  if (process.platform === "darwin") {
+  if (platform === "darwin") {
     cmd = "open";
     args = [url];
-  } else if (process.platform === "win32") {
-    // `start` is a cmd builtin; the empty "" is the (required) window-title arg
-    // so a URL containing `&` or spaces isn't mis-parsed as the title.
-    cmd = "cmd";
-    args = ["/c", "start", "", url];
+  } else if (platform === "win32") {
+    // ShellExecute via rundll32 avoids interpreting URL characters as cmd.exe syntax.
+    cmd = "rundll32.exe";
+    args = ["url.dll,FileProtocolHandler", url];
   } else {
     cmd = "xdg-open";
     args = [url];

package/src/hooks/agent-roster.ts

@@ -78,7 +78,15 @@ export function runtimeAgentSettingsPath(
     const config = process.env.OPENCLAW_CONFIG_PATH;
     if (config?.trim()) return resolve(config);
     const state = process.env.OPENCLAW_STATE_DIR || process.env.OPENCLAW_HOME;
-    return resolve(state?.trim() ? state : resolve(userHome, ".openclaw"), "openclaw.json");
+    if (state?.trim()) return resolve(state, "openclaw.json");
+    // `openclaw --profile <name>` runs from `~/.openclaw-<name>`; a gateway
+    // that exports only the profile name must still resolve to that profile's
+    // config, not the default one (each profile has its own roster identity).
+    const profile = process.env.OPENCLAW_PROFILE?.trim();
+    if (profile && profile !== "default" && /^[A-Za-z0-9._-]{1,80}$/.test(profile) && !profile.startsWith(".")) {
+      return resolve(userHome, `.openclaw-${profile}`, "openclaw.json");
+    }
+    return resolve(userHome, ".openclaw", "openclaw.json");
   }
   const relative = USER_SETTINGS[cli];
   if (!relative) return null;

package/src/hooks/agent-skill.ts

@@ -0,0 +1,203 @@
+/**
+ * The `failproofai` skill: one small SKILL.md that `failproofai config` puts in
+ * every agent this machine has, in that agent's own user-scope skills folder.
+ *
+ * It carries no instructions of its own. It points the agent at the umbrella
+ * skill in the public FailproofAI/skills repository, which the agent reads when
+ * a FailproofAI task comes up, along with whichever focused sibling skill and
+ * `references/*.md` file the task needs. So the content is never stale on
+ * disk: changing that repository changes what every machine reads next, with
+ * no release and no re-run of setup.
+ *
+ * Every folder below was verified on 2026-10-23 against the real CLI (versions
+ * in each comment), by planting a probe skill in each candidate folder and
+ * reading what the CLI listed, or what it sent to a mock model server.
+ *
+ * Never `~/.agents/skills`, although many agents read it: Claude Code does not
+ * read it at all, Codex lists a skill found there and in `~/.codex/skills`
+ * twice, Copilot stops reading it once `COPILOT_HOME` is set, and in OpenClaw it
+ * outranks OpenClaw's own folder. Each agent's own folder works on its own.
+ *
+ * The frontmatter is shaped by the strictest of them: `name` equals the folder
+ * name (Claude Code, Cursor and Devin go by the folder, the rest by `name`, and
+ * Antigravity shows a skill without one as "SKILL"); Copilot drops a skill whose
+ * description is over 1024 characters, droid shows the model the first 200, and
+ * Hermes the first 57 — so the description is short and leads with what it is
+ * for.
+ */
+import { existsSync, mkdirSync, rmdirSync, rmSync } from "node:fs";
+import { homedir } from "node:os";
+import { join, resolve } from "node:path";
+import { listHermesProfiles } from "../../lib/hermes-profiles";
+import { listOpenClawProfiles } from "../../lib/openclaw-profiles";
+import { hookLogWarn } from "./hook-logger";
+import { writeConfigFileAtomic } from "./safe-config-write";
+import { INTEGRATION_TYPES, type IntegrationType } from "./types";
+
+export const AGENT_SKILL_NAME = "failproofai";
+
+/**
+ * Sits beside SKILL.md in a folder failproofai wrote. A `failproofai` folder
+ * without it belongs to someone else — most often the full skill installed with
+ * `npx skills add FailproofAI/skills` — and is never overwritten or removed.
+ */
+export const AGENT_SKILL_MARKER = ".failproofai-managed";
+
+const SKILLS_RAW = "https://raw.githubusercontent.com/FailproofAI/skills/main/skills";
+
+export const AGENT_SKILL_MD = `---
+name: ${AGENT_SKILL_NAME}
+description: FailproofAI hooks, policies, daemon, Cloud, the fp CLI and the SDK. Use for any question about setting up, running or fixing FailproofAI.
+---
+
+# FailproofAI
+
+This skill is a pointer. Before acting on anything FailproofAI, read the full skill, which is kept current online (use your web fetch tool, or \`curl -fsSL <url>\`):
+
+${SKILLS_RAW}/${AGENT_SKILL_NAME}/SKILL.md
+
+Files it names by a relative path, such as \`references/cli.md\`, are in that same folder: ${SKILLS_RAW}/${AGENT_SKILL_NAME}/<path>
+
+For focused work, read the matching skill too. Each has the same layout, with its own \`references/\` beside it.
+
+- Writing or testing a policy: ${SKILLS_RAW}/failproofai-policy-author/SKILL.md
+- Publishing a policy pack: ${SKILLS_RAW}/failproofai-policy-publish/SKILL.md
+- FailproofAI Cloud and the \`fp\` CLI: ${SKILLS_RAW}/fp-cloud-cli/SKILL.md
+- Adding the SDK to an agent, or running an evaluator: ${SKILLS_RAW}/failproofai-sdk/SKILL.md
+- Planning evaluations: ${SKILLS_RAW}/failproofai-eval-brainstorm/SKILL.md
+`;
+
+/** An agent's own override for where it keeps its files, else the default. */
+function envDir(name: string, fallback: string): string {
+  const value = (process.env[name] ?? "").trim();
+  return value ? resolve(value) : fallback;
+}
+
+/**
+ * The skills folders `id` reads at user scope — one, except for Hermes and
+ * OpenClaw, where every profile reads only its own.
+ */
+export function agentSkillRoots(id: IntegrationType): string[] {
+  const home = homedir();
+  const config = envDir("XDG_CONFIG_HOME", join(home, ".config"));
+  switch (id) {
+    // 2.1.309. CLAUDE_CONFIG_DIR replaces ~/.claude rather than adding to it.
+    case "claude":
+      return [join(envDir("CLAUDE_CONFIG_DIR", join(home, ".claude")), "skills")];
+    // 0.164.0. Its own skill installer writes here too.
+    case "codex":
+      return [join(envDir("CODEX_HOME", join(home, ".codex")), "skills")];
+    // 1.0.103.
+    case "copilot":
+      return [join(envDir("COPILOT_HOME", join(home, ".copilot")), "skills")];
+    // 2026.10.22. Always under HOME: CURSOR_CONFIG_DIR does not move it.
+    case "cursor":
+      return [join(home, ".cursor", "skills")];
+    // 1.19.4.
+    case "opencode":
+      return [join(config, "opencode", "skills")];
+    // 1.4.0 and 0.73.1. Not the pi-extension package: a `skills/` folder there
+    // makes Pi stop loading the package's index.ts, and with it enforcement.
+    case "pi":
+      return [join(envDir("PI_CODING_AGENT_DIR", join(home, ".pi", "agent")), "skills")];
+    // 0.21.3. A profile reads its own skills/ and no other profile's.
+    case "hermes":
+      return listHermesProfiles().map((p) => join(p.home, "skills"));
+    // 2026.9.2. The same profile homes its hooks are installed into.
+    case "openclaw":
+      return listOpenClawProfiles().map((p) => join(p.home, "skills"));
+    // 0.248.0. FACTORY_HOME_OVERRIDE stands in for HOME.
+    case "factory":
+      return [join(envDir("FACTORY_HOME_OVERRIDE", home), ".factory", "skills")];
+    // 3000.11.205.
+    case "devin":
+      return [join(config, "devin", "skills")];
+    // 1.4.6. The documented user folder, beside the hooks.json we write; not
+    // ~/.gemini/antigravity/skills, which it does not read.
+    case "antigravity":
+      return [join(home, ".gemini", "config", "skills")];
+    // 1.55.0. GOOSE_PATH_ROOT moves Goose's whole config tree.
+    case "goose": {
+      const root = (process.env.GOOSE_PATH_ROOT ?? "").trim();
+      return [root ? join(resolve(root), "config", "skills") : join(config, "goose", "skills")];
+    }
+  }
+}
+
+/**
+ * Whether `id` already has a `failproofai` skill from a folder it also reads,
+ * and would list ours beside it rather than pick one. Only Codex: it reads
+ * `~/.agents/skills` (always under HOME, whatever CODEX_HOME says) as well as
+ * its own folder and lists a name found in both twice (0.164.0) — and that is
+ * where `npx skills add FailproofAI/skills -g` puts the full skill for it.
+ */
+function listedTwice(id: IntegrationType): boolean {
+  return id === "codex" && existsSync(join(homedir(), ".agents", "skills", AGENT_SKILL_NAME, "SKILL.md"));
+}
+
+/**
+ * Write the skill for each agent in `ids`. Never fails setup: an agent whose
+ * folder cannot be written is logged and skipped. Returns the agents it was
+ * written for.
+ */
+export function installAgentSkill(ids: readonly IntegrationType[]): IntegrationType[] {
+  const installed: IntegrationType[] = [];
+  for (const id of ids) {
+    let wrote = false;
+    const covered = listedTwice(id);
+    for (const root of agentSkillRoots(id)) {
+      const dir = join(root, AGENT_SKILL_NAME);
+      const ours = existsSync(join(dir, AGENT_SKILL_MARKER));
+      // Covered already: a copy of ours from an earlier run is now the duplicate.
+      if (covered) {
+        if (ours) removeSkillDir(dir);
+        continue;
+      }
+      if (existsSync(dir) && !ours) continue;
+      let created = false;
+      let marked = false;
+      try {
+        // Marker first: a run interrupted before it would leave a folder every
+        // later run takes for someone else's and skips.
+        mkdirSync(root, { recursive: true });
+        if (!existsSync(dir)) {
+          mkdirSync(dir);
+          created = true;
+        }
+        writeConfigFileAtomic(join(dir, AGENT_SKILL_MARKER), "", { backup: false, symlinks: "replace" });
+        marked = true;
+        writeConfigFileAtomic(join(dir, "SKILL.md"), AGENT_SKILL_MD, { backup: false, symlinks: "replace" });
+        wrote = true;
+      } catch (err) {
+        if (created && !marked) {
+          try { rmdirSync(dir); } catch { /* Preserve a directory that is no longer empty. */ }
+        }
+        hookLogWarn(`the failproofai skill was not written to ${dir}: ${err instanceof Error ? err.message : String(err)}`);
+      }
+    }
+    if (wrote) installed.push(id);
+  }
+  return installed;
+}
+
+/** Every skill folder failproofai wrote, for any agent. */
+export function installedAgentSkillDirs(): string[] {
+  const dirs = INTEGRATION_TYPES.flatMap((id) => agentSkillRoots(id).map((root) => join(root, AGENT_SKILL_NAME)));
+  return [...new Set(dirs)].filter((dir) => existsSync(join(dir, AGENT_SKILL_MARKER)));
+}
+
+/** Remove one skill folder; never throws, so neither setup nor uninstall stops on it. */
+function removeSkillDir(dir: string): boolean {
+  try {
+    rmSync(dir, { recursive: true, force: true });
+    return true;
+  } catch (err) {
+    hookLogWarn(`the failproofai skill was not removed from ${dir}: ${err instanceof Error ? err.message : String(err)}`);
+    return false;
+  }
+}
+
+/** Remove every skill folder failproofai wrote. Returns the folders removed. */
+export function removeAgentSkill(): string[] {
+  return installedAgentSkillDirs().filter(removeSkillDir);
+}

package/src/hooks/cloud-connection.ts

@@ -55,7 +55,6 @@ import {
   PERMISSION_POLICIES,
 } from "./cloud-introspect";
 import type { CloudJevConfigWrite } from "./jev-cloud-connection";
-import { jevChecksDeclared } from "./effective-reviewers";
 import {
   ingestPath,
   validateIngestKey,
@@ -141,6 +140,10 @@ export interface ConnectInput {
    */
   sessions?: boolean;
   environment?: string;
+  /** The org the key is already known to report into — a browser login's
+   *  claim names it. Used only when introspect gives no answer (unreachable
+   *  just then, or an older server), so the saved org is not left stale. */
+  org?: { id?: string; slug?: string; name?: string };
   /** Injected by tests so nothing reaches the network. */
   verifyPolicy?: typeof verifyCloudCredentials;
   verifyIngest?: typeof validateIngestKey;
@@ -162,7 +165,8 @@ export interface ConnectOutcome {
    * server has no introspect endpoint to say whether the key carries it.
    */
   jev?: JevConnectOutcome;
-  /** Which organisation the key belongs to. Absent on a pre-introspect server. */
+  /** Which organisation the key belongs to. Absent when neither introspect nor
+   *  the caller (`ConnectInput.org`) named one. */
   org?: { id?: string; slug?: string; name?: string };
   /** True when at least one capability was configured. */
   anyConfigured: boolean;
@@ -271,6 +275,7 @@ export async function connectToCloud(input: ConnectInput): Promise<ConnectOutcom
   // CLI ships independently of whatever server a customer runs, so a good key
   // on an older deployment must still connect.
   const known = identity.kind === "ok" ? identity.identity : null;
+  const org = known ? { id: known.orgId, slug: known.orgSlug, name: known.orgName } : input.org;
 
   // Skip a probe the key provably cannot pass. This is not an optimisation: a
   // permission failure surfaces from `/events` as a 403 whose message reads
@@ -301,9 +306,7 @@ export async function connectToCloud(input: ConnectInput): Promise<ConnectOutcom
       : { ok: false, reason: policyResult.reason },
     ingest: ingestResult.ok ? { ok: true } : { ok: false, reason: ingestResult.reason },
     anyConfigured: false,
-    org: known
-      ? { id: known.orgId, slug: known.orgSlug, name: known.orgName }
-      : undefined,
+    org,
   };
 
   outcome.anyConfigured = policyResult.ok || ingestResult.ok;
@@ -327,10 +330,10 @@ export async function connectToCloud(input: ConnectInput): Promise<ConnectOutcom
   // a new URL (http → https, a new host for the same Cloud) is a reconnect,
   // not a switch — clearing its deployment would drop enforcement until the
   // next poll, and "Switched from X to X" says nothing true.
-  const sameKnownOrg = Boolean(prev.org?.id && known?.orgId && prev.org.id === known.orgId);
+  const sameKnownOrg = Boolean(prev.org?.id && org?.id && prev.org.id === org.id);
   const orgSwitch = hadConnection && !sameKnownOrg && (
-    (prev.org?.id && known?.orgId && prev.org.id !== known.orgId) ||
-    ((!prev.org?.id || !known?.orgId) && keyChanged) ||
+    (prev.org?.id && org?.id && prev.org.id !== org.id) ||
+    ((!prev.org?.id || !org?.id) && keyChanged) ||
     (previousPolicy && !sameOrigin(previousPolicy.url)) ||
     (prev.ingest && !sameOrigin(prev.ingest.url))
   );
@@ -341,7 +344,7 @@ export async function connectToCloud(input: ConnectInput): Promise<ConnectOutcom
   if (orgSwitch) {
     rmSync(backfillRequestPath(), { force: true });
     const oldOrg = prev.org?.name ?? prev.org?.slug ?? prev.org?.id ?? "the previous org";
-    const newOrg = known?.orgName ?? known?.orgSlug ?? known?.orgId ?? "the new org";
+    const newOrg = org?.name ?? org?.slug ?? org?.id ?? "the new org";
     changes.push(`Switched from ${oldOrg} to ${newOrg}. Nothing recorded before now will be sent to ${newOrg}; ${oldOrg}'s cloud policies stop within ~30 s.`);
     // Remove local references, not the daemon's policy-floor state (#899).
     clearActiveCloudManagedPolicies();
@@ -374,8 +377,8 @@ export async function connectToCloud(input: ConnectInput): Promise<ConnectOutcom
     if (prev.jev) changes.push(`Removed the previous Jev key ${maskToken(prev.jev.key)}: this key's ${PERMISSION_JEV} permission was not verified.`);
   }
   const since = boundary === undefined ? {} : { since: boundary };
-  if (known) {
-    next.org = { id: known.orgId, slug: known.orgSlug, name: known.orgName, ...since };
+  if (org) {
+    next.org = { ...org, ...since };
   } else {
     const { since: _drop, ...kept } = orgSwitch ? {} : (prev.org ?? {});
     next.org = { ...kept, ...since };
@@ -385,7 +388,7 @@ export async function connectToCloud(input: ConnectInput): Promise<ConnectOutcom
   // a flush served before the daemon sees the new key retries these batches
   // with the key that was refused, re-parking them as definitive refusals.
   if (ingestResult.ok && prev.ingest && prev.ingest.key !== input.token) {
-    recoverCredentialRefusals(Boolean(prev.org?.id && prev.org.id === known?.orgId && sameOrigin(prev.ingest.url)), prev.org?.id);
+    recoverCredentialRefusals(Boolean(prev.org?.id && prev.org.id === org?.id && sameOrigin(prev.ingest.url)), prev.org?.id);
   }
   // Legacy JSON override remains supported; the consolidated file above is
   // published once, never as a mixture of previous and replacement slots.
@@ -551,11 +554,6 @@ export function jevLines(outcome: ConnectOutcome): string[] {
   }
   const config = jev.config;
   if (!config || config.status === "written" || config.status === "repointed") {
-    // Plain http (loopback only) is accepted in observe mode and nowhere else:
-    // in enforce mode — set here, or by FailproofAI Cloud — Jev is OFF on this
-    // machine rather than enforcing, by the CLI and the dashboard alike.
-    const plainHttp = config !== undefined && new URL(config.baseUrl).protocol === "http:";
-    const httpLine = "            Over plain http Jev runs only in observe mode: enforce (set here or by FailproofAI Cloud) turns it off on this machine. For enforce, reconnect with `failproofai config --token <key> --url https://…`.";
     // What happened to jev.json, said first on a re-point; the mode lines
     // below are the same for both (N1).
     const lead =
@@ -565,44 +563,22 @@ export function jevLines(outcome: ConnectOutcome): string[] {
     // deployment that arrived first): that mode and Cloud's own checks decide,
     // not the local jev.json or the packs installed here.
     const cloudJev = safeCloudJev();
-    if (cloudJev.jevMode !== null) {
-      if (cloudJev.jevMode === "off") return [...lead, `${indent}off on this machine: FailproofAI Cloud set its Jev mode to off.`];
-      if (plainHttp && cloudJev.jevMode === "enforce") {
-        return [
-          ...lead,
-          `${indent}off on this machine: FailproofAI Cloud set enforce, and over plain http Jev runs only in observe mode. For enforce, reconnect with \`failproofai config --token <key> --url https://…\`.`,
-        ];
-      }
-      return [
-        ...lead,
-        `${indent}on through FailproofAI Cloud, mode ${cloudJev.jevMode} (set by FailproofAI Cloud); the Jev checks it deployed here run on FailproofAI Cloud.`,
-      ];
-    }
-    // No Cloud deployment has been read on this machine yet (a first connect,
-    // or the first after a disconnect): FailproofAI Cloud's Jev mode, when it
-    // sets one, arrives with that deployment and overrides jev.json — so the
-    // local mode is said as the fallback it is, not as a promise (N3).
-    const localMode = config?.status === "repointed" ? config.mode : "observe";
-    if (localMode === "off") {
-      return [...lead, `${indent}switched off in ${config?.path ?? "jev.json"} (mode off). FailproofAI Cloud's Jev mode, if it sets one, arrives with its first deployment. To turn it on: \`failproofai jev setup --mode observe\`.`];
-    }
-    return [
-      ...lead,
-      `${indent}configured through FailproofAI Cloud; waiting for FailproofAI Cloud's Jev mode, which arrives with this machine's first deployment (within ~30 s) and decides. Until then, and if Cloud sets none: ${localMode} (${config?.path ?? "jev.json"}). Check with \`failproofai jev status\`.`,
-      // The package ships no Jev checks, so local "on" asks nothing until a
-      // pack gives it some. Checks FailproofAI Cloud deploys run on Cloud.
-      ...(jevChecksDeclared()
-        ? []
-        : ["            No Jev checks are installed on this machine; checks FailproofAI Cloud deploys here run on Cloud. To add local ones: `failproofai policies add FailproofAI/jev-policies`."]),
-      ...(plainHttp ? [httpLine] : []),
-    ];
+    // One line: FailproofAI Cloud decides the mode, whatever jev.json says, so
+    // the local fallback and the packs installed here are not worth a line.
+    const state =
+      cloudJev.jevMode === null
+        ? "waiting for its first deployment"
+        : cloudJev.jevMode === "off"
+          ? "off — no Jev policy deployed"
+          : cloudJev.jevMode;
+    return [...lead, `${indent}managed by FailproofAI Cloud · ${state}`];
   }
   if (config.status === "kept") {
     const lines = [`  Jev       key stored; ${config.path} already exists and was left as configured.`];
     if (config.otherOrigin) {
       lines.push(
         config.jevOff?.why === "off"
-          ? `            It points at ${config.otherOrigin} and has Jev switched off (mode off), so Jev is off. To point it here and turn it on: \`failproofai jev setup --provider failproofai --mode observe\`.`
+          ? `            It points at ${config.otherOrigin} and has Jev switched off (mode off), so Jev is off. To point it here: \`failproofai jev setup --provider failproofai\`.`
           : `            It points at ${config.otherOrigin}, so Jev stays off until you run \`failproofai jev setup --provider failproofai\`.`,
       );
     } else if (config.jevOff?.why === "refused") {
@@ -610,11 +586,11 @@ export function jevLines(outcome: ConnectOutcome): string[] {
         `            It was refused (${config.jevOff.problem}), so Jev is off. ${config.jevOff.fix ? `Fix: \`${config.jevOff.fix}\`.` : "Write a valid one: `failproofai jev setup --provider failproofai`."}`,
       );
     } else if (config.jevOff?.why === "off") {
-      lines.push("            It has Jev switched off (mode off), so Jev is off. To turn it on: `failproofai jev setup --mode observe`.");
+      lines.push("            It has Jev switched off (mode off) until FailproofAI Cloud's Jev mode arrives with this machine's first deployment; from then on FailproofAI Cloud decides.");
     }
     if (jev.stillOn) {
       lines.push(
-        `            Jev is still on through FailproofAI Cloud (${jev.stillOn} mode): it sends each checked tool call and the recent prompt to FailproofAI Cloud. To switch it off: \`failproofai jev setup --mode off\`.`,
+        `            Jev is still on through FailproofAI Cloud (${jev.stillOn} mode): it sends each checked tool call and the recent prompt to FailproofAI Cloud. FailproofAI Cloud sets its mode: off when no Jev policy is deployed here.`,
       );
     }
     return lines;

package/src/hooks/cloud-introspect.ts

@@ -33,6 +33,8 @@
  * second.
  */
 
+import { displayText } from "./cloud-login";
+
 /** The path introspect is served on, appended to the cloud origin. */
 export const INTROSPECT_PATH = "/v1/auth/introspect";
 
@@ -126,8 +128,9 @@ export async function introspectKey(
     identity: {
       keyId: typeof b.key_id === "string" ? b.key_id : undefined,
       orgId: typeof b.org_id === "string" ? b.org_id : undefined,
-      orgSlug: typeof b.org_slug === "string" ? b.org_slug : undefined,
-      orgName: typeof b.org_name === "string" ? b.org_name : undefined,
+      // Printed in "Connected as …": text only, never terminal controls.
+      orgSlug: displayText(b.org_slug),
+      orgName: displayText(b.org_name),
       permissions: b.permissions.filter((p): p is string => typeof p === "string"),
       expiresAt: typeof b.expires_at === "string" ? b.expires_at : null,
       otelIngest: typeof b.otel_ingest === "boolean" ? b.otel_ingest : undefined,