failproofai 1.0.12-beta.1 → 1.0.12

package/.next/standalone/fp-cloud-cli/fp_cli/commands/policies_cmds.py

@@ -22,7 +22,7 @@ from .. import _click_compat as click  # the Click Typer is running; see _click_
 from ..enforcement import RefError, RefUsageError, parse_semantic, read_source, resolve_kind
 from ..policy_check import SyntaxResult, check_syntax, run_policy
 from ..errors import ApiError, NotFoundError
-from . import _write
+from . import _cloud, _write
 
 #: Every command here is session-only. These endpoints are ROOT-ONLY on the
 #: server — deliberately absent from `/v1`, because `/v1` is internet-facing and
@@ -565,4 +565,146 @@ def register(app: typer.Typer) -> None:
     policies_app.command("delete", epilog=GLOBALS_EPILOG)(policies_delete)
     policies_app.command("test", epilog=GLOBALS_EPILOG)(policies_test)
     policies_app.command("compose", epilog=GLOBALS_EPILOG)(policies_compose)
+    policies_app.command("author", epilog=GLOBALS_EPILOG)(policies_author)
+    policies_app.command("backtest", epilog=GLOBALS_EPILOG)(policies_backtest)
+    policies_app.command("candidacy", epilog=GLOBALS_EPILOG)(policies_candidacy)
     app.add_typer(policies_app, name="policies")
+
+
+def policies_author(
+    ctx: typer.Context,
+    intent: str = typer.Argument(...),
+    kind: Optional[str] = typer.Option(
+        None, "--kind",
+        help="regex | jev | both. Default: the assistant writes a regex (JavaScript) policy.",
+    ),
+) -> None:
+    """Author a vetted policy from an intent (session; does not publish).
+
+    `--kind jev` asks for Jev checks only, `--kind both` for JavaScript plus the
+    Jev checks that may clear it. Publish the result with `fp policies publish`.
+    """
+    _cloud.session_only(ctx.obj, "policies author")
+    if kind is not None and kind not in ("regex", "jev", "both"):
+        raise click.UsageError("--kind must be regex, jev or both")
+    body = {"issue": {"title": intent, "source": "manual"}}
+    if kind in ("jev", "both"):
+        # The dashboard proxy treats anything else as regex, exactly as before kinds.
+        body["kind"] = kind
+    events = list(api.cloud_stream(require_auth(ctx.obj), "/api/agent/policy-author", body))
+    for event in events:
+        if event.get("type") == "error":
+            raise ApiError(str(event.get("message") or event.get("error") or event.get("reason") or "Policy author failed"))
+    result = next((e.get("result", e) for e in reversed(events) if e.get("type") in ("result", "done")), None)
+    if result is None:
+        raise ApiError("Policy author returned no result; nothing was published")
+    _cloud.emit(ctx.obj, result, "Policy draft")
+
+
+def policies_backtest(
+    ctx: typer.Context,
+    file_or_id: Optional[str] = typer.Argument(None, metavar="FILE_OR_ID"),
+    kind: Optional[str] = typer.Option(
+        None, "--kind",
+        help="regex | jev | both. Default: a published policy's own kind; for a file, "
+             "regex, or jev/both when --semantic is given.",
+    ),
+    semantic_path: Optional[str] = typer.Option(
+        None, "--semantic", help="Jev checks JSON (the same file `policies publish --semantic` takes).",
+    ),
+    hours: Optional[float] = typer.Option(None, "--hours", help="How far back to replay (default 168 for jev/both)."),
+    agent_id: Optional[str] = typer.Option(None, "--agent-id", help="Replay only this agent's calls."),
+    env: Optional[str] = typer.Option(None, "--env", help="Replay only this environment's calls."),
+    run: bool = typer.Option(
+        False, "--run",
+        help="jev/both: actually ask Jev (spends the org's Jev allowance). Default is a free estimate.",
+    ),
+    sample: Optional[int] = typer.Option(None, "--sample", help="jev/both with --run: calls to ask Jev about (max 50)."),
+) -> None:
+    """Replay local or published policy source against stored events (session).
+
+    A regex policy (a .mjs file or a published regex id) is replayed module-only,
+    as before. A jev/both policy — a published one, or `--semantic checks.json`
+    with or without a source file — runs the every-kind backtest: an estimate
+    by default, `--run` to spend Jev allowance on up to `--sample` calls.
+    Needs policies:write and events:read.
+    """
+    from pathlib import Path
+    _cloud.session_only(ctx.obj, "policies backtest")
+    if kind is not None and kind not in ("regex", "jev", "both"):
+        raise click.UsageError("--kind must be regex, jev or both")
+    if file_or_id is None and semantic_path is None:
+        raise click.UsageError("give a policy file or published id, or --semantic checks.json")
+    if hours is not None and not hours > 0:
+        raise click.UsageError("--hours must be a positive number")
+    if sample is not None and not 1 <= sample <= 50:
+        raise click.UsageError("--sample must be between 1 and 50")
+    if file_or_id == "-" and semantic_path == "-":
+        raise click.UsageError("only one of the source and --semantic can come from stdin")
+    cctx = require_auth(ctx.obj)
+    source: Optional[str] = None
+    semantic = None
+    published_kind = None
+    if file_or_id is not None:
+        if file_or_id == "-" or file_or_id.startswith("@") or Path(file_or_id).is_file():
+            source = _write.read_text_arg(file_or_id.removeprefix("@"))
+        else:
+            data = api.cloud_request(cctx, "GET", "/api/enforcement/policies")
+            versions = [p for p in _cloud.rows(data, "policies") if p.get("id") == file_or_id]
+            if not versions:
+                raise NotFoundError(f"no policy named {file_or_id}")
+            newest = max(versions, key=lambda p: p.get("version", 0))
+            published_kind = newest.get("kind") or "regex"
+            source = newest.get("source") or None
+            if semantic_path is None and isinstance(newest.get("semantic"), list):
+                semantic = newest["semantic"]
+    if semantic_path is not None:
+        try:
+            semantic = parse_semantic(read_source(semantic_path, isatty=False))
+        except RefUsageError as exc:
+            raise click.UsageError(str(exc))
+        except RefError as exc:
+            raise ApiError(str(exc))
+    resolved = kind or published_kind or ("regex" if not semantic else ("both" if source else "jev"))
+    if resolved == "regex":
+        if semantic_path is not None:
+            raise click.UsageError("--semantic needs --kind jev or both")
+        if not isinstance(source, str) or not source.strip():
+            raise click.UsageError("Policy source is empty")
+        body = {"source": source}
+        if agent_id:
+            body["agentId"] = agent_id
+        if env:
+            body["environment"] = env
+        if hours is not None:
+            body["hours"] = hours
+        _cloud.emit(ctx.obj, api.cloud_request(cctx, "POST", "/api/agent/policy-backtest",
+            body=body), "Policy backtest")
+        return
+    if resolved == "both" and not (source or "").strip():
+        raise click.UsageError("a both backtest needs the JavaScript source too")
+    if not semantic:
+        raise click.UsageError(f"a {resolved} backtest needs Jev checks: pass --semantic checks.json")
+    body = {"kind": resolved, "semantic": semantic, "hours": hours if hours is not None else 168,
+            "mode": "run" if run else "estimate"}
+    if resolved == "both":
+        body["source"] = source
+    if agent_id:
+        body["agentId"] = agent_id
+    if env:
+        body["environment"] = env
+    if sample is not None:
+        body["sample"] = sample
+    if run and not ctx.obj.json:
+        output.warn("--run asks Jev about stored calls and spends the org's Jev allowance.")
+    _cloud.emit(ctx.obj, api.cloud_request(cctx, "POST", "/api/agent/policy-backtest-all",
+        body=body), "Policy backtest")
+
+
+def policies_candidacy(ctx: typer.Context, issue: str = typer.Option(..., "--issue")) -> None:
+    """Ask whether a policy could address an issue (session; read-only)."""
+    _cloud.session_only(ctx.obj, "policies candidacy")
+    cctx = require_auth(ctx.obj)
+    row = api.cloud_request(cctx, "GET", f"/api/issues/{issue}")
+    _cloud.emit(ctx.obj, api.cloud_request(cctx, "POST", "/api/agent/policy-candidacy",
+        body={"issue": row}), "Policy candidacy")

package/.next/standalone/fp-cloud-cli/fp_cli/commands/queries_cmds.py

@@ -17,6 +17,7 @@ from .._context import GLOBALS_EPILOG, AppState, require_auth, resolve_fields, v
 from ..errors import NotFoundError
 from ..models import SavedQuery
 from . import _write
+from . import _cloud
 
 
 def _humanize_list(items: List[str]) -> str:
@@ -375,4 +376,73 @@ def register(app: typer.Typer) -> None:
     query_app.command("delete", epilog=GLOBALS_EPILOG)(query_delete)
     query_app.command("run", epilog=GLOBALS_EPILOG)(query_run)
     query_app.command("schema", epilog=GLOBALS_EPILOG)(query_schema)
+    query_app.command("compose", epilog=GLOBALS_EPILOG)(query_compose)
+    query_app.command("export", epilog=GLOBALS_EPILOG)(query_export)
     app.add_typer(query_app, name="query")
+
+
+def query_compose(ctx: typer.Context, question: str = typer.Argument(...),
+                  run: bool = typer.Option(False, "--run")) -> None:
+    """AI-compose SQL (session only); optionally run it."""
+    _cloud.session_only(ctx.obj, "query compose")
+    cctx = require_auth(ctx.obj)
+    draft = None
+    for event in api.cloud_stream(cctx, "/api/agent/compose-sql", {"intent": question}):
+        if event.get("type") == "error":
+            from ..errors import ApiError
+            raise ApiError(str(event.get("error") or event.get("reason") or "SQL composer failed"))
+        if event.get("type") in ("result", "done"):
+            draft = event.get("result", event)
+    if not isinstance(draft, dict):
+        raise click.UsageError("Cloud did not return composed SQL")
+    sql = draft.get("sql") or draft.get("sql_text")
+    if not isinstance(sql, str) or not sql.strip():
+        raise click.UsageError("Cloud did not return composed SQL")
+    if run:
+        data = api.cloud_request(cctx, "POST", "/api/queries/run", body={"sql": sql, "params": []})
+        _cloud.emit(ctx.obj, {"sql": sql, "result": data}, "Composed query")
+    elif ctx.obj.json:
+        output.emit_json(draft)
+    else:
+        _cloud.emit(ctx.obj, {"sql": sql}, "Composed query")
+
+
+def query_export(ctx: typer.Context, id: Optional[str] = typer.Argument(None),
+                 sql: Optional[str] = typer.Option(None, "--sql"),
+                 format: str = typer.Option("csv", "--format"),
+                 out: Optional[str] = typer.Option(None, "--out")) -> None:
+    """Export a saved or ad-hoc query as CSV/JSON (all returned rows).
+
+    --json wraps CSV in {format,content} unless --out writes the file.
+    """
+    import csv
+    import io
+    import json
+    if (id is None) == (sql is None):
+        raise click.UsageError("Pass a saved query id or --sql, exactly one")
+    if format not in ("csv", "json"):
+        raise click.UsageError("--format must be csv or json")
+    data = api.cloud_request(require_auth(ctx.obj), "POST", "/api/queries/run",
+        body={"query_id": id, "sql": _read_sql(sql) if sql is not None else None, "params": []})
+    if format == "json":
+        content = json.dumps(data, indent=2, ensure_ascii=False) + "\n"
+    else:
+        buf = io.StringIO()
+        writer = csv.writer(buf)
+        writer.writerow([c.get("name", "") if isinstance(c, dict) else c for c in data.get("columns", [])])
+        # Spreadsheet-safe export of untrusted event cells.
+        writer.writerows([
+            ["'" + v if isinstance(v, str) and v.startswith(("=", "+", "-", "@", "\t", "\r")) else v for v in row]
+            for row in data.get("rows", [])
+        ])
+        content = buf.getvalue()
+    if out:
+        _cloud.write_file(out, content)
+        _cloud.emit(ctx.obj, {"out": out, "format": format}, "Query exported")
+    elif ctx.obj.json:
+        output.emit_json(data if format == "json" else {"format": format, "content": content})
+    elif format == "json":
+        from .. import cloud_output
+        cloud_output.query_result(data, "Query export")
+    else:
+        print(content, end="")

package/.next/standalone/fp-cloud-cli/fp_cli/commands/sentiment_cmds.py

@@ -0,0 +1,49 @@
+"""Conversation sentiment summary, messages and sessions."""
+
+from __future__ import annotations
+
+from typing import Optional
+
+import typer
+
+from .. import client as api
+from .._context import GLOBALS_EPILOG, require_auth, resolve_dates, validate_limit
+from . import _cloud
+
+
+def read(ctx, suffix, since=None, limit=None, session_id=None):
+    validate_limit(limit)
+    frm, to = resolve_dates(since, None, None)
+    data = api.cloud_request(require_auth(ctx.obj), "GET", f"/api/events/sentiment{suffix}",
+        params={"ts_from": frm, "ts_to": to, "limit": limit, "session_id": session_id})
+    _cloud.emit(ctx.obj, data, "Sentiment", view=suffix.strip("/") or "summary")
+
+
+def summary(ctx: typer.Context, since: Optional[str] = typer.Option(None, "--since")) -> None:
+    """Summarize conversation sentiment."""
+    read(ctx, "", since)
+
+
+def messages(ctx: typer.Context, since: Optional[str] = typer.Option(None, "--since"),
+             limit: int = typer.Option(50, "--limit"),
+             session_id: Optional[str] = typer.Option(None, "--session-id")) -> None:
+    """List sentiment-scored messages."""
+    read(ctx, "/messages", since, limit, session_id)
+
+
+def sessions(ctx: typer.Context, since: Optional[str] = typer.Option(None, "--since"),
+             limit: int = typer.Option(50, "--limit")) -> None:
+    """List sentiment-scored sessions."""
+    read(ctx, "/sessions", since, limit)
+
+
+def session(ctx: typer.Context, id: str = typer.Argument(...)) -> None:
+    """Show one session's sentiment."""
+    read(ctx, f"/sessions/{id}")
+
+
+def register(app: typer.Typer) -> None:
+    group = typer.Typer(no_args_is_help=True, help="Inspect conversation sentiment.", context_settings={"help_option_names": ["-h", "--help"]})
+    for name, fn in (("summary", summary), ("messages", messages), ("sessions", sessions), ("session", session)):
+        group.command(name, epilog=GLOBALS_EPILOG)(fn)
+    app.add_typer(group, name="sentiment")

package/.next/standalone/fp-cloud-cli/fp_cli/commands/sessions_cmds.py

@@ -18,7 +18,9 @@ from .._context import (
     validate_choice,
     validate_limit,
 )
+from .. import _click_compat as click
 from ..models import Session
+from . import _cloud, _write
 
 
 def sessions(
@@ -70,6 +72,8 @@ def sessions(
     * `fp sessions --agents` — expand each multi-agent session to its full agent roster
     * `fp --json sessions --all --fields session_id,agents | jq '.sessions'` — every session's full agent roster as JSON
     """
+    if ctx.invoked_subcommand:
+        return
     state: AppState = ctx.obj
     cctx = require_auth(state)
     validate_limit(limit)
@@ -147,5 +151,95 @@ def sessions(
         output.recheck_filters_hint(active_filters)
 
 
+def re_evaluate(ctx: typer.Context, session_id: str = typer.Argument(...)) -> None:
+    """Re-run evaluators on one session. Needs evaluations:trigger."""
+    _write.confirm(ctx.obj, f"Re-evaluate session {session_id}", assume_yes=False)
+    _cloud.emit(ctx.obj, api.cloud_request(require_auth(ctx.obj), "POST",
+        f"/api/sessions/{session_id}/re-evaluate"), "Session re-evaluation", body=session_id)
+
+
+def import_sessions(
+    ctx: typer.Context,
+    files: List[str] = typer.Argument(..., metavar="FILE...", help="Event JSONL, Claude Code transcripts or Codex rollouts (.gz ok)."),
+    format: str = typer.Option("auto", "--format", help="auto | failproofai (FailproofAI event JSONL) | claude | codex."),
+    env: Optional[str] = typer.Option(None, "--env", help="Environment for events that name none (server default: upload)."),
+    dry_run: bool = typer.Option(False, "--dry-run", help="Convert and report; store nothing."),
+) -> None:
+    """Import sessions from files, as the dashboard's Import sessions dialog does.
+
+    Each file is gzipped and sent on its own. Sessions already in the org are skipped
+    whole; secrets are redacted the way the collector redacts them live. Claude Code
+    and Codex files take the session id from the file name, so pass the original files.
+    Needs events:add. With `--json`: `{"files": [{file, result}]}`.
+    """
+    import gzip
+    import time
+    from pathlib import Path
+    validate_choice(format, ("auto", "failproofai", "agenteye", "claude", "codex"), flag="--format")
+    # The server names FailproofAI's own event JSONL `agenteye`; `failproofai` is its public name.
+    wire_format = "agenteye" if format == "failproofai" else format
+    payloads = []
+    for name in files:
+        path = Path(name)
+        try:
+            raw = path.read_bytes()
+        except OSError as exc:
+            raise click.BadParameter(f"cannot read '{name}': {exc.strerror or exc}", param_hint="FILE")
+        rel = "/".join(path.resolve().parts[-2:])
+        payloads.append((name, rel, raw if raw[:2] == b"\x1f\x8b" else gzip.compress(raw)))
+    if not dry_run:
+        _write.confirm(ctx.obj, f"Import {len(files)} file{'s' if len(files) != 1 else ''}", assume_yes=False)
+    cctx = require_auth(ctx.obj)
+    # One cutoff for the whole run, so a later file of a session this run created
+    # is not skipped as "already present".
+    before = int(time.time() * 1000)
+    results = []
+    for name, rel, data in payloads:
+        result = api.import_events_file(cctx, data, {
+            "format": wire_format, "path": rel, "environment": env,
+            "dry_run": "true" if dry_run else None, "existing_before": before,
+        })
+        results.append({"file": name, "result": result})
+    if not dry_run:
+        _write.record_action("sessions_imported", resource="events", success=True)
+    _cloud.emit(ctx.obj, {"files": results}, "Session import")
+
+
+def show(ctx: typer.Context, id: str = typer.Argument(...)) -> None:
+    """Show a session overview and its event timeline."""
+    cctx = require_auth(ctx.obj)
+    overview = api.cloud_request(cctx, "GET", "/api/sessions", params={"session_id": id, "limit": 1})
+    items = _cloud.rows(overview, "sessions")
+    if not items:
+        from ..errors import NotFoundError
+        raise NotFoundError(f"no session {id}")
+    timeline = api.cloud_request(cctx, "GET", "/api/events/summary", params={"session_id": id, "limit": 200, "order": "asc"})
+    _cloud.emit(ctx.obj, {"overview": items[0], "timeline": timeline}, "Session")
+
+
+def export(ctx: typer.Context, id: str = typer.Argument(...),
+           out: Optional[str] = typer.Option(None, "--out")) -> None:
+    """Export a full session as JSON."""
+    import json
+    data = api.cloud_request(require_auth(ctx.obj), "GET", f"/api/sessions/{id}/export")
+    if out:
+        _cloud.write_file(out, json.dumps(data, indent=2, ensure_ascii=False) + "\n")
+        _cloud.emit(ctx.obj, {"out": out}, "Session exported")
+    else:
+        _cloud.emit(ctx.obj, data, "Session")
+
+
+def history(ctx: typer.Context, id: str = typer.Argument(...)) -> None:
+    """Show a session's evaluation history."""
+    _cloud.emit(ctx.obj, api.cloud_request(require_auth(ctx.obj), "GET", f"/api/sessions/{id}/evaluation-history"), "Evaluation history")
+
+
 def register(app: typer.Typer) -> None:
-    app.command("sessions", epilog=GLOBALS_EPILOG)(sessions)
+    group = typer.Typer(invoke_without_command=True, rich_markup_mode="markdown", context_settings={"help_option_names": ["-h", "--help"]})
+    group.callback(epilog=GLOBALS_EPILOG)(sessions)
+    group.command("re-evaluate", epilog=GLOBALS_EPILOG)(re_evaluate)
+    group.command("show", epilog=GLOBALS_EPILOG)(show)
+    group.command("export", epilog=GLOBALS_EPILOG)(export)
+    group.command("history", epilog=GLOBALS_EPILOG)(history)
+    group.command("import", epilog=GLOBALS_EPILOG)(import_sessions)
+    app.add_typer(group, name="sessions")

package/.next/standalone/fp-cloud-cli/fp_cli/commands/settings_cmds.py

@@ -147,4 +147,6 @@ def register(app: typer.Typer) -> None:
     settings_app.command("list", epilog=GLOBALS_EPILOG)(settings_list)
     settings_app.command("schema", epilog=GLOBALS_EPILOG)(settings_schema)
     settings_app.command("set", epilog=GLOBALS_EPILOG)(settings_set)
+    from .account_cmds import register_context_windows
+    register_context_windows(settings_app)
     app.add_typer(settings_app, name="settings")

package/.next/standalone/fp-cloud-cli/fp_cli/commands/usage_cmds.py

@@ -23,6 +23,8 @@ def usage(ctx: typer.Context) -> None:
     * `fp usage`
     * `fp --json usage | jq '.usage.events_ingested'`
     """
+    if ctx.invoked_subcommand:
+        return
     state: AppState = ctx.obj
     data = api.get_usage(require_auth(state))
     if state.json:
@@ -32,4 +34,22 @@ def usage(ctx: typer.Context) -> None:
 
 
 def register(app: typer.Typer) -> None:
-    app.command("usage", epilog=GLOBALS_EPILOG)(usage)
+    group = typer.Typer(invoke_without_command=True, rich_markup_mode="markdown", context_settings={"help_option_names": ["-h", "--help"]})
+    group.callback(epilog=GLOBALS_EPILOG)(usage)
+    group.command("windows", epilog=GLOBALS_EPILOG)(usage_windows)
+    app.add_typer(group, name="usage")
+
+
+def usage_windows(ctx: typer.Context) -> None:
+    """List usage metering windows. API key only (the dashboard has no session route)."""
+    from .account_cmds import request
+    from ..client import AuthMode
+    from ..errors import KeyModeUnsupportedError
+    if ctx.obj.auth_mode is not AuthMode.API_KEY:
+        # GET /usage/windows is served on the versioned API only; a signed-in
+        # session would reach a dashboard 404 and print a misleading message.
+        raise KeyModeUnsupportedError(
+            "`fp usage windows` needs an API key — the dashboard has no session route for it.",
+            hint="pass --api-key (or FP_API_KEY) with a usage:read key",
+        )
+    request(ctx, "GET", "/api/usage/windows")

package/.next/standalone/fp-cloud-cli/fp_cli/commands/users_cmds.py

@@ -401,4 +401,18 @@ def register(app: typer.Typer) -> None:
     users_app.command("update", epilog=GLOBALS_EPILOG)(users_update)
     users_app.command("disable", epilog=GLOBALS_EPILOG)(users_disable)
     users_app.command("enable", epilog=GLOBALS_EPILOG)(users_enable)
+    users_app.command("delete", epilog=GLOBALS_EPILOG)(users_delete)
+    users_app.command("defaults", epilog=GLOBALS_EPILOG)(users_defaults)
     app.add_typer(users_app, name="users")
+
+
+def users_delete(ctx: typer.Context, id: str = typer.Argument(...)) -> None:
+    """Delete a member by id (not email)."""
+    from .account_cmds import request
+    request(ctx, "DELETE", f"/api/users/{id}")
+
+
+def users_defaults(ctx: typer.Context) -> None:
+    """Show defaults for new members."""
+    from .account_cmds import request
+    request(ctx, "GET", "/api/users/defaults")

package/.next/standalone/fp-cloud-cli/fp_cli/enforcement.py

@@ -43,10 +43,6 @@ VALID_EFFECTS = ("enforce", "observe")
 #: JavaScript reviewable by its own Jev checks (`both`).
 VALID_KINDS = ("regex", "jev", "both")
 
-#: The Jev modes a deployment may set. `local` stops FailproofAI Cloud
-#: overriding the machine's own mode (the server stores it as no value).
-JEV_MODES = ("off", "observe", "enforce", "local")
-
 #: The server's (and the machine's) cap on Jev declarations per policy version.
 MAX_JEV_DECLARATIONS = 24
 AGENT_INTEGRATIONS = frozenset({
@@ -120,22 +116,6 @@ class DeployPlan:
     removed: List[PolicyRef]
     changed: List[Tuple[PolicyRef, PolicyRef]]
     unchanged: List[PolicyRef]
-    #: `--jev-mode` as given (`off|observe|enforce|local`), or None when the
-    #: command said nothing about Jev — which the server reads as "keep it".
-    jev_mode: Optional[str] = None
-    #: The mode FailproofAI Cloud sets on the machine now (None = local).
-    jev_mode_before: Optional[str] = None
-
-    @property
-    def jev_mode_after(self) -> Optional[str]:
-        """What the machine's Cloud-set mode will be (None = local)."""
-        if self.jev_mode is None:
-            return self.jev_mode_before
-        return None if self.jev_mode == "local" else self.jev_mode
-
-    @property
-    def jev_mode_changes(self) -> bool:
-        return self.jev_mode is not None and self.jev_mode_after != self.jev_mode_before
 
     @property
     def set_changes(self) -> bool:
@@ -144,7 +124,7 @@ class DeployPlan:
 
     @property
     def is_noop(self) -> bool:
-        return not (self.set_changes or self.jev_mode_changes)
+        return not self.set_changes
 
     def to_dict(self) -> Dict[str, object]:
         out: Dict[str, object] = {
@@ -157,13 +137,6 @@ class DeployPlan:
             "unchanged": [p.to_dict() for p in self.unchanged],
             "noop": self.is_noop,
         }
-        if self.jev_mode is not None:
-            # `local` on both sides: the wire word, not the stored NULL.
-            out["jevMode"] = {
-                "from": self.jev_mode_before or "local",
-                "to": self.jev_mode_after or "local",
-                "changed": self.jev_mode_changes,
-            }
         return out
 
 
@@ -237,8 +210,6 @@ def plan_deploy(
     replace: Optional[Sequence[str]] = None,
     latest: Optional[Dict[str, int]] = None,
     disabled: Optional[set] = None,
-    jev_mode: Optional[str] = None,
-    current_jev_mode: Optional[str] = None,
     kinds: Optional[Dict[Tuple[str, int], str]] = None,
     targets: Sequence[str] = (),
     all_agents: Sequence[str] = (),
@@ -249,16 +220,13 @@ def plan_deploy(
     with "these as well" has no single obvious reading, and guessing one would
     be guessing about somebody's fleet.
 
-    `jev_mode` is `--jev-mode`; `current_jev_mode` what Cloud sets now (None =
-    local). `kinds` maps `(id, version)` to the version's kind, so an `observe`
-    effect on a Jev-only version — which the server refuses, because a Jev
-    rollout is observed through the Jev MODE — is refused here, before a plan is
-    drawn and confirmed for a write that cannot happen.
+    There is no Jev mode to set: FailproofAI Cloud derives a machine's Jev mode
+    from what is deployed to it (enforce while any `jev`/`both` policy is,
+    off otherwise), and a Jev rollout is observed per policy with an `observe`
+    effect like any other. `kinds` (`(id, version)` → kind) is accepted for
+    callers that already have it.
     """
-    if jev_mode is not None and jev_mode not in JEV_MODES:
-        raise RefUsageError(
-            f"--jev-mode {jev_mode!r} is not one of {', '.join(JEV_MODES)}"
-        )
+    del kinds
     latest = latest or {}
     current_list = list(current or [])
     current_map = {p.id: p for p in current_list}
@@ -314,13 +282,6 @@ def plan_deploy(
         result_map[pid] = dataclass_replace(result_map[pid], agent_targets=grouped.get(pid))
 
     result = sorted(result_map.values(), key=lambda p: p.id)
-    for ref in result:
-        if ref.effect == "observe" and (kinds or {}).get((ref.id, ref.version)) == "jev":
-            raise RefUsageError(
-                f"{ref.id}@{ref.version} is a Jev policy, and an effect does not apply to Jev "
-                "checks — deploy it as enforce and use --jev-mode observe to watch Jev without "
-                "it deciding anything"
-            )
     added, removed, changed, unchanged = [], [], [], []
     for pid, ref in sorted(result_map.items()):
         was = current_map.get(pid)
@@ -342,16 +303,9 @@ def plan_deploy(
         removed=removed,
         changed=changed,
         unchanged=unchanged,
-        jev_mode=jev_mode,
-        jev_mode_before=current_jev_mode,
     )
 
 
-def jev_mode_after(mode: str) -> Optional[str]:
-    """What a `--jev-mode`/`jev-mode` word leaves stored: `local` is None (Cloud stops overriding)."""
-    return None if mode == "local" else mode
-
-
 def version_kinds(policies: Iterable[PolicyVersion]) -> Dict[Tuple[str, int], str]:
     """`{(id, version): kind}` for every published version."""
     return {(p.id, p.version): p.kind for p in policies}

package/.next/standalone/fp-cloud-cli/fp_cli/errors.py

@@ -85,6 +85,9 @@ class NotFoundError(FpCliError):
     """The requested resource does not exist."""
 
     exit_code = 6
+    # The HTTP response may explicitly distinguish an absent endpoint from a
+    # missing record. None means callers must fall back to the request shape.
+    route_unknown: Optional[bool] = None
 
 
 class ApiError(FpCliError):