failproofai 1.0.12-beta.1 → 1.0.12-beta.2

package/src/hooks/configure-wizard.ts

@@ -30,20 +30,26 @@ import { dirname, resolve, sep } from "node:path";
 import { CORE_SOURCE } from "./pack-store";
 
 import {
+  BACK,
   collapseAfter,
   colorsEnabled,
   multiSelect,
   OPEN_SOURCE,
   optsFor,
   paint,
+  promptBrowserLogin,
   promptCloudKey,
   screenKit,
+  selectOne,
   type CloudKeyAnswer,
   type MultiChoice,
   type OpenSource,
+  type SelectChoice,
   type TTYIn,
   type TTYOut,
 } from "./tui";
+import { claimLogin, machineOs, pollLogin, startLogin, type LoginOrg } from "./cloud-login";
+import { canOpenBrowser, openUrl } from "../audit/open-browser";
 import {
   DEFAULT_INGEST_URL,
   readIngestCredential,
@@ -56,6 +62,7 @@ import {
 } from "./integrations";
 import { INTEGRATION_TYPES, type IntegrationType, type HookScope } from "./types";
 import { enforcingPolicyCount, installHooks, notEnforcingReason } from "./manager";
+import { installAgentSkill } from "./agent-skill";
 import {
   CODEX_UNTRUSTED_NOTICE,
   codexHookTrust,
@@ -998,6 +1005,195 @@ export async function runConfigureWizard(
       stdout,
     });
 
+  // A key typed after picking "Paste an API key" from the menu. Same field as
+  // above minus the saved key, which the menu already offered as "keep"; Tab is
+  // the way back to the menu, so it never means open source here.
+  const askKey = (): Promise<CloudKeyAnswer | OpenSource | null> =>
+    promptCloudKey({
+      message: "Connect to cloud",
+      meta: source ? `${host}  ·  from ${source}` : host,
+      tabHint: "go back",
+      emptyError: "Paste a key, or press tab to go back.",
+      check: async (key) => {
+        if (!url) return { ok: false, line: badUrl ?? "No usable endpoint." };
+        const r = await checkCloudKey(url, key);
+        if (r.ok) {
+          typedOrg = r.org;
+          return { ok: true, line: r.note };
+        }
+        return { ok: false, line: r.refused ? `That key was refused: ${r.reason}.` : `Couldn't check the key: ${r.reason}.` };
+      },
+      collapsed: (answer) => (answer === OPEN_SOURCE ? [] : [...cloudLines(planFor(answer)), ""]),
+      stdin,
+      stdout,
+    });
+
+  // The browser login. Resolves the approval, BACK for the menu of other
+  // options (Tab / Esc, or a cloud that cannot do this), or null when the person
+  // cancelled the whole run.
+  type Approval = Extract<CloudPlan, { kind: "login" }>;
+  // Set once the cloud says it has no browser login; the menu then drops it.
+  let loginUnsupported = false;
+  const askLogin = (endpoint: string): Promise<{ value: Approval } | typeof BACK | null> => {
+    let pollSecret = "";
+    return promptBrowserLogin<Approval>({
+      message: "Connect to cloud",
+      meta: source ? `${host}  ·  from ${source}` : host,
+      machineLabel,
+      start: async () => {
+        const r = await startLogin(endpoint, { label: machineLabel, os: machineOs(), cliVersion });
+        if (r.kind === "ok") {
+          pollSecret = r.pollSecret;
+          void emit("configure_cloud_login", { step: "started" });
+          return { ok: true, url: r.verificationUrl, expiresIn: r.expiresIn, interval: r.interval };
+        }
+        if (r.kind === "unsupported") {
+          void emit("configure_cloud_login", { step: "unsupported" });
+          loginUnsupported = true;
+          return { ok: false, retryable: false, line: `${host} doesn't support logging in from here yet.` };
+        }
+        return {
+          ok: false,
+          retryable: true,
+          line: r.kind === "refused" ? `Couldn't start the login: ${r.reason}.` : `Couldn't reach ${host}: ${r.reason}.`,
+        };
+      },
+      poll: async () => {
+        const p = await pollLogin(endpoint, pollSecret);
+        switch (p.kind) {
+          case "approved":
+            void emit("configure_cloud_login", { step: "approved" });
+            return {
+              state: "approved",
+              value: {
+                kind: "login",
+                pollSecret,
+                org: p.org,
+                approvedBy: p.approvedBy,
+                keyName: p.keyName,
+                permissions: p.permissions,
+              },
+            };
+          case "pending":
+            return { state: "pending", interval: p.interval };
+          case "slow_down":
+            return { state: "slow_down" };
+          case "denied":
+            void emit("configure_cloud_login", { step: "denied" });
+            return { state: "denied" };
+          case "unreachable":
+            return { state: "unreachable", line: p.reason };
+          // Expired, already claimed, or swept: in every case this link is done.
+          default:
+            return { state: "expired" };
+        }
+      },
+      open: (link) => {
+        if (!canOpenBrowser()) return false;
+        openUrl(link);
+        return true;
+      },
+      collapsed: (plan) => [...cloudLines(plan), ""],
+      stdin,
+      stdout,
+    });
+  };
+
+  // Whether the saved key was refused when the CONNECT step checked it — still
+  // true at the end of the run if a login there created no key.
+  let savedRefused = false;
+
+  // The interactive CONNECT step. A machine with no connection, or whose saved
+  // key is refused, starts the browser login straight away — Tab or Esc there
+  // opens the other options. A machine that is connected with a working key gets
+  // the menu, "keep" first, so re-running config never opens a browser by itself.
+  const chooseConnection = async (): Promise<CloudPlan | null> => {
+    const verdict =
+      saved && !saved.splitKeys
+        ? await transient("Checking your saved key…", () => checkCloudKey(saved.url, saved.token))
+        : null;
+    const savedBroken = verdict !== null && !verdict.ok && verdict.refused;
+    savedRefused = savedBroken;
+    const keptPlan: CloudPlan =
+      verdict && verdict.ok
+        ? { kind: "kept", how: "saved", verified: true }
+        : verdict && !verdict.refused
+          ? { kind: "kept", how: "saved", verified: false }
+          : { kind: "kept", how: "skip", verified: false };
+    const keepHint = !saved
+      ? ""
+      : saved.splitKeys
+        ? "leave both keys as they are"
+        : verdict?.ok
+          ? `${verdict.org ?? saved.org ?? hostOf(saved.url)} · key ${maskToken(saved.token)}`
+          : savedBroken
+            ? "its key no longer works"
+            : "its key couldn't be checked just now";
+
+    type Pick = "login" | "key" | "oss" | "keep";
+    const login: SelectChoice<Pick> = {
+      label: saved ? "Log in again" : "Log in to FailproofAI Cloud",
+      value: "login",
+      hint: savedBroken
+        ? "recommended · your saved key no longer works"
+        : saved
+          ? "opens your browser and makes a new key"
+          : "recommended · opens your browser",
+    };
+    const key: SelectChoice<Pick> = { label: "Paste an API key", value: "key", hint: "one you already have" };
+    const oss: SelectChoice<Pick> = { label: "Use open source", value: "oss", hint: "skip the cloud" };
+    const keep: SelectChoice<Pick> = { label: "Keep current connection", value: "keep", hint: keepHint };
+    // No initial-cursor option on selectOne: the default is whatever is first.
+    const choices = !saved ? [login, key, oss] : savedBroken ? [login, key, keep] : [keep, login, key];
+    const leftLogin = (result: Awaited<ReturnType<typeof askLogin>>): CloudPlan | null | typeof BACK => {
+      if (result === null || result === BACK) {
+        if (result === BACK && loginUnsupported) {
+          write([kit.caution(`${host} doesn't support logging in from here yet. Paste an API key instead.`), ""]);
+        }
+        return result;
+      }
+      return result.value;
+    };
+
+    if (url && (!saved || savedBroken)) {
+      if (savedBroken && verdict && !verdict.ok) {
+        write([kit.caution(`Your saved key no longer works: ${verdict.reason}. Logging in again.`)]);
+      }
+      void emit("configure_cloud_choice", { choice: "login", connected: Boolean(saved), auto: true });
+      const first = leftLogin(await askLogin(url));
+      if (first !== BACK) return first;
+    }
+
+    for (;;) {
+      const pick = await selectOne<Pick>({
+        message: "Connect to cloud",
+        meta: source ? `${host}  ·  from ${source}` : host,
+        choices: loginUnsupported ? choices.filter((c) => c.value !== "login") : choices,
+        collapsed: (p) =>
+          p === "keep" ? [...cloudLines(keptPlan), ""] : p === "oss" ? [...cloudLines({ kind: "oss" }), ""] : [],
+        stdin,
+        stdout,
+      });
+      if (pick === null) return null;
+      void emit("configure_cloud_choice", { choice: pick, connected: Boolean(saved) });
+      if (pick === "keep") return keptPlan;
+      if (pick === "oss") return { kind: "oss" };
+      if (pick === "key") {
+        const answer = await askKey();
+        if (answer === null) return null;
+        if (answer === OPEN_SOURCE) continue;
+        return planFor(answer);
+      }
+      if (!url) {
+        write([kit.fail(badUrl ?? "No usable endpoint."), ""]);
+        continue;
+      }
+      const result = leftLogin(await askLogin(url));
+      if (result === BACK) continue;
+      return result;
+    }
+  };
+
   let cloud: CloudPlan;
   if (answers.oss) {
     cloud = saved ? { kind: "kept", how: "skip", verified: false } : { kind: "oss" };
@@ -1032,11 +1228,12 @@ export async function runConfigureWizard(
     cloud = saved ? { kind: "kept", how: "skip", verified: false } : { kind: "oss" };
     write([...cloudLines(cloud), ""]);
   } else {
-    // Said above the field, which stays usable for Tab and a saved key.
+    // Said above the menu, which stays usable for keeping a saved key and for
+    // open source, neither of which sends anything anywhere.
     if (badUrl) write([kit.fail(badUrl)]);
-    const answer = await askCloud();
-    if (answer === null) return cancel();
-    cloud = planFor(answer);
+    const chosen = await chooseConnection();
+    if (chosen === null) return cancel();
+    cloud = chosen;
   }
 
   // ── AGENTS ──────────────────────────────────────────────────────────────────
@@ -1049,8 +1246,10 @@ export async function runConfigureWizard(
   // Whether the daemon will be collecting once this run ends: a key is already
   // on disk, or this run writes one. Removal copy and the backfill request both
   // depend on it.
-  const collectingAfter = cloud.kind === "connect" || readIngestCredential() !== null;
-  const sessionsOn = cloud.kind === "connect" ? answers.noTranscripts !== true : fp.collector.sessions === true;
+  // A browser login connects exactly like a pasted key, one step later.
+  const connecting = cloud.kind === "connect" || cloud.kind === "login";
+  const collectingAfter = connecting || readIngestCredential() !== null;
+  const sessionsOn = connecting ? answers.noTranscripts !== true : fp.collector.sessions === true;
 
   let selected: IntegrationType[];
   if (answers.agents && answers.agents.length > 0) {
@@ -1105,6 +1304,37 @@ export async function runConfigureWizard(
   //  5. The connection last.
   const done: string[] = [];
   let daemonInstalled = daemonAlreadyRunning;
+  // The `sudo -v` at the top cached root for sudo's timeout — five minutes by
+  // default on macOS, fifteen on most Linux. A browser login, or simply a slow
+  // agents screen, can outlast it, and the install below runs `sudo -n`, which
+  // would then fail AFTER the person did everything else. Ask once more instead.
+  // The stale-unit refresh runs `sudo -n` too, so it is asked for the same way —
+  // but, as at the top, losing root there costs the scheduled audit, not setup.
+  // Unattended runs never primed anything, so there is nothing to have expired.
+  if ((daemonWanted || daemonUnitStale) && !unattended) {
+    let stillRoot = false;
+    try {
+      stillRoot = canElevate();
+    } catch {
+      stillRoot = false;
+    }
+    if (!stillRoot && daemonWanted) {
+      if (!elevate("Your sudo session expired while you were away. Installing failproofaid needs root again.")) {
+        write([
+          kit.fail("Couldn't get root, so setup stopped before changing anything."),
+          `  Re-run once you can use sudo:  ${kit.cmd("failproofai config")}`,
+        ]);
+        void emit("configure_aborted", { reason: "needs_root" });
+        return { applied: false, abort: "needs_root" };
+      }
+    } else if (
+      !stillRoot &&
+      !elevate("Your sudo session expired while you were away. Refreshing failproofaid's service definition needs root again.")
+    ) {
+      done.push(kit.caution("No root, so its service definition stays as it is. Scheduled audits stay off until it is refreshed."));
+      daemonUnitStale = false;
+    }
+  }
   if (daemonWanted) {
     // A unit that is running but cannot answer is torn down before it is
     // rebuilt: it holds the singleton flock the replacement needs, so
@@ -1214,24 +1444,6 @@ export async function runConfigureWizard(
     pruneOldDaemonBinaries();
   }
 
-  const connectedAfterPlan = cloud.kind === "connect" || cloud.kind === "kept";
-  // Telemetry runs concurrently with the rest of apply (never rejects,
-  // 5s-bounded) and is awaited before returning. `cli` carries the selected
-  // agent ids, as it always has (and as hooks_installed does): a fixed list of
-  // product ids, never user content. The agents_* fields add counts only.
-  const applied = emit("configure_applied", {
-    target: "user",
-    scopes: ["user"],
-    cli: selected,
-    cli_count: selected.length,
-    policy_count: (readScopedHooksConfig("user", cwd).enabledPolicies ?? []).length,
-    connected: cloud.kind === "connect",
-    mode: connectedAfterPlan ? "cloud" : "oss",
-    agents_selected: selected.length,
-    agents_detected: plan.detected.size,
-    agents_changed: added.length + removed.length > 0,
-  });
-
   // Hooks, at user scope, for the chosen agents. Whatever policies are enabled
   // there are carried through untouched: `replace: true` would otherwise switch
   // off policies the user had turned on, and setup must never reduce
@@ -1259,6 +1471,11 @@ export async function runConfigureWizard(
     cwd,
   );
 
+  // The failproofai skill, in every agent this machine has and any ticked
+  // without being detected — traced or not, an agent asked about FailproofAI
+  // should know it. A pointer to the skill online (see agent-skill.ts).
+  installAgentSkill(INTEGRATION_TYPES.filter((id) => plan.detected.has(id) || selected.includes(id)));
+
   // Agents traced again start fresh (see `requestFreshStart`). Only on a
   // rerun: its baseline is the selection the daemon actually filtered on. With
   // no saved list (upgrade, first) the daemon was collecting every agent, so an
@@ -1273,8 +1490,38 @@ export async function runConfigureWizard(
   // a key on disk doing nothing. `connectToCloud` re-verifies each capability
   // and writes only what works.
   let connected = false;
-  if (cloud.kind === "connect" && url) {
-    const token = cloud.token;
+  // A browser login has an approval, not a key: claim it NOW, with the daemon
+  // in, so a run that stopped earlier left nothing minted anywhere. The claim
+  // is single-use — the server mints the key and hands it over exactly once.
+  let token: string | null = cloud.kind === "connect" ? cloud.token : null;
+  let orgLabel: string | undefined = cloud.kind === "connect" ? cloud.org : undefined;
+  let mintedName: string | undefined;
+  let claimedOrg: LoginOrg | undefined;
+  if (cloud.kind === "login" && url) {
+    const claimed = await transient("Creating this machine's key…", () => claimLogin(url, cloud.pollSecret));
+    void emit("configure_cloud_login", { step: "claimed", ok: claimed.kind === "ok", reason: claimed.kind });
+    if (claimed.kind === "ok") {
+      token = claimed.key;
+      orgLabel = loginOrgLabel(claimed.org);
+      mintedName = claimed.keyName;
+      claimedOrg = claimed.org;
+    } else {
+      hookLogWarn(`cloud login could not be completed: ${claimed.kind}`);
+      done.push(
+        kit.caution(
+          claimed.kind === "expired"
+            ? "The login took too long to finish, so no key was created. Everything else was applied."
+            : claimed.kind === "revoked"
+              ? "Whoever approved the login can no longer create keys in that org, so no key was created."
+              : claimed.kind === "unreachable"
+                ? `Couldn't reach ${host} to create the key (${claimed.reason}); everything else was applied.`
+                : `The key couldn't be created: ${claimed.reason}. Everything else was applied.`,
+          "failproofai config",
+        ),
+      );
+    }
+  }
+  if (token && url) {
     try {
       const outcome = await transient("Connecting…", () =>
         connectToCloud({
@@ -1284,11 +1531,18 @@ export async function runConfigureWizard(
           machineLabel,
           // Both streams unless the run said `--no-transcripts`.
           sessions: answers.noTranscripts !== true,
+          // The org the login was approved into, for when introspect can't say.
+          org: claimedOrg,
         }),
       );
       connected = outcome.anyConfigured;
       done.push(...(outcome.changes ?? []));
-      done.push(...connectDoneLines(kit, outcome, host, cloud.org));
+      done.push(...connectDoneLines(kit, outcome, host, orgLabel));
+      // Logging in again makes a NEW key; the one this machine held keeps
+      // working until someone revokes it. Said here, where it is still useful.
+      if (cloud.kind === "login" && saved && connected) {
+        done.push(`  Your previous key for this machine still works until you revoke it on ${host}'s keys page.`);
+      }
       if (outcome.ingest.ok && answers.noTranscripts === true) {
         done.push("  Decisions only: session transcripts are not sent (--no-transcripts).");
       }
@@ -1298,13 +1552,49 @@ export async function runConfigureWizard(
       hookLogWarn(`cloud connection was not written: ${err instanceof Error ? err.message : String(err)}`);
       done.push(kit.caution("Couldn't connect; everything else was applied.", "failproofai config"));
     }
+    // The claim spent the approval and the key exists, but nothing here uses
+    // it: say which one, so it can be revoked rather than left live.
+    if (cloud.kind === "login" && !connected) {
+      done.push(`  The key ${mintedName ? `"${mintedName}" ` : ""}was created but isn't in use here; revoke it on ${host}'s keys page.`);
+    }
   } else if (cloud.kind === "kept" && cloud.how === "saved" && fp.mode !== "cloud") {
     // A home migrated from layout 1 carries keys but no mode, and would read
     // as open source everywhere that asks.
     updateConfig({ mode: "cloud" });
   }
 
-  await applied;
+  // Logging in again on a connected machine, with nothing connected at the end
+  // of it — no key, or a key `connectToCloud` could not use, which writes
+  // nothing — changed nothing about the connection: the previous one is still
+  // there (never removed from this step, decision D4) — but not as if it worked
+  // when its key was refused.
+  const keptOld = cloud.kind === "login" && !connected && Boolean(saved);
+  if (keptOld) {
+    done.push(
+      savedRefused
+        ? "  This machine keeps its previous connection, but its key no longer works. Run failproofai config again to log in."
+        : "  This machine keeps its previous connection.",
+    );
+  }
+  const cloudAfter = connected || cloud.kind === "kept" || keptOld;
+
+  // Sent once the connection's outcome is known — a login whose claim then
+  // failed must not count as connected. Never rejects, 5s-bounded. `cli`
+  // carries the selected agent ids, as it always has (and as hooks_installed
+  // does): a fixed list of product ids, never user content. The agents_*
+  // fields add counts only.
+  await emit("configure_applied", {
+    target: "user",
+    scopes: ["user"],
+    cli: selected,
+    cli_count: selected.length,
+    policy_count: policies.length,
+    connected,
+    mode: cloudAfter ? "cloud" : "oss",
+    agents_selected: selected.length,
+    agents_detected: plan.detected.size,
+    agents_changed: added.length + removed.length > 0,
+  });
   // Only now — a completed apply — is the launcher considered "seen", so
   // first-run onboarding stops offering itself on every command.
   markLauncherSeen();
@@ -1321,7 +1611,7 @@ export async function runConfigureWizard(
       done,
       cwd,
       agents: selected.length,
-      connected: connected || cloud.kind === "kept",
+      connected: cloudAfter,
       codexTrust,
     }),
   );
@@ -1334,7 +1624,7 @@ export async function runConfigureWizard(
     policies,
     daemonInstalled,
     connected,
-    mode: connected || cloud.kind === "kept" ? "cloud" : "oss",
+    mode: cloudAfter ? "cloud" : "oss",
     agents: { selected, added, removed },
   };
 }
@@ -1345,7 +1635,19 @@ export async function runConfigureWizard(
 type CloudPlan =
   | { kind: "oss" }
   | { kind: "kept"; how: "skip" | "saved"; verified: boolean }
-  | { kind: "connect"; token: string; org?: string; note?: string };
+  | { kind: "connect"; token: string; org?: string; note?: string }
+  /**
+   * Approved in the browser, not yet claimed. The key does not exist until
+   * apply claims it — after the daemon is in — so a run that stops before then
+   * leaves no key behind anywhere.
+   */
+  | { kind: "login"; pollSecret: string; org: LoginOrg; approvedBy?: string; keyName?: string; permissions: string[] };
+
+/** "Acme (acme)", or whichever half the server sent. */
+function loginOrgLabel(org: LoginOrg): string {
+  if (org.name && org.slug) return `${org.name} (${org.slug})`;
+  return org.name ?? org.slug ?? "your org";
+}
 
 /**
  * The connection already on this machine, from either credential: the policy
@@ -1394,7 +1696,15 @@ export function resolveCloudUrl(
   const env = process.env.FAILPROOFAI_CLOUD_URL?.trim();
   const fromFlag = flag?.trim();
   const override = fromFlag || env;
-  if (!override) return { ok: true, url: existing ?? cloudBaseFor(DEFAULT_INGEST_URL) };
+  if (!override) {
+    if (!existing) return { ok: true, url: cloudBaseFor(DEFAULT_INGEST_URL) };
+    // Checked like a typed one: login sends its secret and receives a key here
+    // before anything else would, and the file it came from can be edited.
+    const saved = validateCloudUrl(existing);
+    return saved.ok
+      ? { ok: true, url: existing }
+      : { ok: false, message: `the saved cloud address "${existing}" cannot be used: ${saved.reason}` };
+  }
   const source = fromFlag && fromFlag !== env ? "--url" : "FAILPROOFAI_CLOUD_URL";
   const validated = validateCloudUrl(cloudBaseFor(override));
   if (!validated.ok) {
@@ -1430,6 +1740,11 @@ export async function checkCloudKey(
   url: string,
   key: string,
 ): Promise<{ ok: true; org?: string; note?: string } | { ok: false; refused: boolean; reason: string }> {
+  // Checked here rather than trusted: a saved address comes from a file that
+  // can be edited, and an http one to another host would carry the key in
+  // the clear. Not a verdict on the key, so not `refused`.
+  const target = validateCloudUrl(url);
+  if (!target.ok) return { ok: false, refused: false, reason: `the address ${url} can't be used: ${target.reason}` };
   const identity = await introspectKey(url, key);
   if (identity.kind === "rejected") return { ok: false, refused: true, reason: "the server did not accept it" };
   if (identity.kind === "unreachable") return { ok: false, refused: false, reason: identity.reason };
@@ -1477,6 +1792,15 @@ export function cloudCollapsedLines(
         kit.ok(plan.org ? `Key accepted for ${plan.org} on ${at.host}` : `Key accepted by ${at.host}`),
         ...(plan.note ? [kit.caution(plan.note)] : []),
       ];
+    case "login":
+      // Who approved it is said out loud: a link someone else approved into
+      // THEIR org would otherwise connect this machine there unnoticed.
+      return [
+        head,
+        kit.ok(
+          `Logged in${plan.approvedBy ? ` as ${plan.approvedBy}` : ""} · ${loginOrgLabel(plan.org)} on ${at.host}`,
+        ),
+      ];
   }
 }
 

package/src/hooks/delivery-health.ts

@@ -23,11 +23,20 @@
  * `is_auto_retryable()` excludes it from the retry pass — that is correct, and
  * re-litigating it here would burn the budget of batches that could succeed.
  * The gap was never the detection. It was that the detection was mute.
+ *
+ * A credential refusal is only evidence about the CURRENT key while nothing
+ * has been accepted since. A key regenerated on the dashboard leaves the
+ * running collector on the old secret until the daemon's next config tick, so
+ * a batch or two is refused while the new key already works. Those parked
+ * before the collector's last accepted delivery (`delivery.last_ok_ts`) are
+ * counted as `resending`, not refused: the daemon re-sends them with the key
+ * that works (`Delivery::redrive_refused`) and drops one only if that key
+ * refuses it too.
  */
-import { existsSync, readdirSync, statSync } from "node:fs";
+import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
 import { join } from "node:path";
 
-import { failedDir } from "./fp-home";
+import { collectorHealthFile, failedDir } from "./fp-home";
 import { readCredentials } from "./fp-config";
 
 /**
@@ -106,6 +115,13 @@ export interface DeliveryHealth {
   credentialRejected: number;
   /** Count per client status, e.g. `{ 401: 26 }`. */
   byStatus: Record<number, number>;
+  /**
+   * Credential refusals parked BEFORE the last delivery the server accepted.
+   * The key in use now works, so these are not counted as refused: the daemon
+   * re-sends them with that key (`Delivery::redrive_refused`, fpai-collect)
+   * and drops one only if the current key refuses it too.
+   */
+  resending: number;
   /** Age of the oldest parked batch, in ms. Undefined when none are parked. */
   oldestAgeMs?: number;
 }
@@ -115,8 +131,23 @@ const EMPTY: DeliveryHealth = {
   rejected: 0,
   credentialRejected: 0,
   byStatus: {},
+  resending: 0,
 };
 
+/**
+ * `delivery.last_ok_ts` from the collector's health file, in ms, or undefined.
+ * The last upload the server ACCEPTED (`UploadMetrics::last_ok_ts`).
+ */
+export function readLastDeliveredAt(home?: string): number | undefined {
+  try {
+    const raw = JSON.parse(readFileSync(collectorHealthFile(home), "utf8")) as { delivery?: { last_ok_ts?: unknown } };
+    const ts = raw?.delivery?.last_ok_ts;
+    return typeof ts === "number" && Number.isFinite(ts) && ts > 0 ? ts * 1000 : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
 /**
  * Summarise `failed/` without touching it.
  *
@@ -127,6 +158,7 @@ export function deliveryHealth(
   home?: string,
   now: number = Date.now(),
   connectedAt: number | undefined = home ? undefined : readCredentials().connectedAt,
+  lastDeliveredAt: number | undefined = home ? undefined : readLastDeliveredAt(),
 ): DeliveryHealth {
   const dir = failedDir(home);
   if (!existsSync(dir)) return EMPTY;
@@ -144,6 +176,7 @@ export function deliveryHealth(
   let total = 0;
   let rejected = 0;
   let credentialRejected = 0;
+  let resending = 0;
   let oldestMtime: number | undefined;
 
   for (const name of entries) {
@@ -162,6 +195,17 @@ export function deliveryHealth(
       CREDENTIAL_STATUSES.has(parsed.clientStatus) &&
       mtime < connectedAt
     ) continue;
+    // Refused with a key that has worked since: the latest delivery attempt
+    // was accepted, so the CURRENT key is not the one being refused.
+    if (
+      lastDeliveredAt !== undefined &&
+      parsed.clientStatus !== undefined &&
+      CREDENTIAL_STATUSES.has(parsed.clientStatus) &&
+      mtime <= lastDeliveredAt
+    ) {
+      resending += 1;
+      continue;
+    }
     total += 1;
     if (parsed.clientStatus !== undefined) {
       rejected += 1;
@@ -177,6 +221,7 @@ export function deliveryHealth(
     rejected,
     credentialRejected,
     byStatus,
+    resending,
     ...(oldestMtime !== undefined ? { oldestAgeMs: Math.max(0, now - oldestMtime) } : {}),
   };
 }

package/src/hooks/effective-reviewers.ts

@@ -49,6 +49,8 @@ import { cloudReviewerNames, readCloudAuthorityInputs, readCloudJevMode } from "
 import type { AgentIdentity } from "./agent-targets";
 
 let cached: ReadonlySet<string> | null = null;
+/** Whether the installed packs alone (not Cloud) declared any check, for the cached answer. */
+let cachedPackChecks = false;
 let cachedContested: ReadonlyMap<string, string[]> = new Map();
 /** The agent the current registration pass is for; see {@link forgetEffectiveReviewerNames}. */
 let reviewerCli: string | undefined;
@@ -185,9 +187,11 @@ export function effectiveReviewerNames(): ReadonlySet<string> {
   if (cached) return cached;
   let names: ReadonlySet<string> = NO_REVIEWERS;
   cachedContested = new Map();
+  cachedPackChecks = false;
   try {
     const packs = jevPacks(readInstalledPacks().packs, reviewerCli);
     names = reviewerNamesFor(packs);
+    cachedPackChecks = names.size > 0;
     cachedContested = contestedSemanticNames(packs);
   } catch {
     // See above: an unreadable manifest declares no checks.
@@ -224,6 +228,16 @@ export function jevChecksInstalled(): boolean {
   return effectiveReviewerNames().size > 0;
 }
 
+/**
+ * Whether an installed pack (not FailproofAI Cloud) gives Jev a check for this
+ * agent: the part of {@link jevChecksInstalled} a Cloud review needs to know
+ * when deciding whether a call has anything of the machine's own to ask.
+ */
+export function packJevChecksInstalled(): boolean {
+  effectiveReviewerNames();
+  return cachedPackChecks;
+}
+
 /**
  * The same question for a CLI command, read fresh rather than from the
  * registration cache (which only the hook path fills): any agent, packs as