failproofai 1.0.12-beta.1 → 1.0.12

package/.next/standalone/fp-cloud-cli/tests/test_cloud_jev.py

@@ -1,8 +1,8 @@
 """FailproofAI Cloud Jev / regex / both policies in `fp` (CONTRACT C4, C6).
 
 `fp policies publish --kind regex|jev|both [--source] [--semantic]`, list/show
-carrying the kind and the Jev check names, `fp fleet deploy --jev-mode`, and
-machines showing the policy errors they report.
+carrying the kind and the Jev check names, deploys (no Jev mode: Cloud derives
+it), and machines showing the policy errors they report.
 """
 from __future__ import annotations
 
@@ -144,7 +144,7 @@ def test_semantic_refuses_what_is_not_a_declaration_list(text, needle):
         parse_semantic(text)
 
 
-# ── deploy plan: --jev-mode ───────────────────────────────────────────────────
+# ── deploy plan: no Jev mode ──────────────────────────────────────────────────
 
 
 def _plan(**kw):
@@ -153,38 +153,16 @@ def _plan(**kw):
     return plan_deploy("m1", **base)
 
 
-def test_jev_mode_alone_is_a_change_and_is_carried_in_the_plan():
-    plan = _plan(jev_mode="observe")
-    assert not plan.is_noop and plan.jev_mode_changes
-    assert plan.to_dict()["jevMode"] == {"from": "local", "to": "observe", "changed": True}
-
-
-def test_the_same_jev_mode_again_is_a_noop():
-    assert _plan(jev_mode="observe", current_jev_mode="observe").is_noop
-    assert _plan(jev_mode="local").is_noop  # already local
-
-
-def test_local_hands_the_mode_back_to_the_machine():
-    plan = _plan(jev_mode="local", current_jev_mode="enforce")
-    assert plan.jev_mode_changes and plan.jev_mode_after is None
-    assert plan.to_dict()["jevMode"] == {"from": "enforce", "to": "local", "changed": True}
-
-
-def test_no_jev_mode_says_nothing_and_changes_nothing():
-    plan = _plan(add=["a"], current_jev_mode="enforce")
+def test_a_plan_never_carries_a_jev_mode():
+    with pytest.raises(TypeError):
+        _plan(jev_mode="observe")
+    plan = _plan(add=["a"])
     assert plan.is_noop and "jevMode" not in plan.to_dict()
 
 
-def test_an_unknown_jev_mode_is_a_usage_error():
-    with pytest.raises(RefUsageError, match="not one of off, observe, enforce, local"):
-        _plan(jev_mode="shadow")
-
-
-def test_observe_on_a_jev_policy_is_refused_with_the_mode_that_does_it():
+def test_observe_applies_to_a_jev_policy_like_any_other():
     kinds = version_kinds([PolicyVersion.from_dict(dict(SERVER_JEV, id="j", version=2))])
-    with pytest.raises(RefUsageError, match="use --jev-mode observe"):
-        _plan(add=["j:observe"], kinds=kinds)
-    # enforce is fine, and so is observe on a `both` policy (it applies to the JS half).
+    assert _plan(add=["j:observe"], kinds=kinds).added[0].effect == "observe"
     assert _plan(add=["j"], kinds=kinds).added[0].effect == "enforce"
     both = version_kinds([PolicyVersion.from_dict(dict(SERVER_BOTH, id="j", version=2))])
     assert _plan(add=["j:observe"], kinds=both).added[0].effect == "observe"
@@ -213,14 +191,13 @@ def test_publish_still_refuses_jev_fields_in_the_javascript(monkeypatch):
     assert "--kind both --semantic" in (exc.value.hint or "")
 
 
-def test_deploy_sends_jev_mode_only_when_given(monkeypatch):
+def test_deploy_never_sends_a_jev_mode(monkeypatch):
     bodies = []
     monkeypatch.setattr(client, "_request_json",
                         lambda ctx, method, path, json_body=None: bodies.append(json_body) or {})
     client.deploy_policies(None, "m1", [PolicyRef("a", 1)])
-    client.deploy_policies(None, "m1", [PolicyRef("a", 1)], jev_mode="local")
     assert "jevMode" not in bodies[0]
-    assert bodies[1]["jevMode"] == "local"
+    assert not hasattr(client, "set_jev_mode")
 
 
 # ── the commands, over HTTP ───────────────────────────────────────────────────
@@ -365,25 +342,7 @@ def _fleet_routes(current_policies, jev_mode=None, errors=None):
 
 
 @respx.mock
-def test_fleet_deploy_jev_mode_alone_changes_only_the_mode_through_its_own_route(logged_in, runner):
-    # CONTRACT C9.1: a mode change sent as a deploy rewrote the set the CLI had
-    # read — which leaves out disabled policies' assignments, so they were lost.
-    _fleet_routes([{"id": "no-force-push", "version": 2, "effect": "enforce"}])
-    deploy = respx.put(f"{BASE}/api/enforcement/deployments/m1")
-    mode = respx.put(f"{BASE}/api/enforcement/deployments/m1/jev-mode").mock(return_value=httpx.Response(
-        200, json={"machineId": "m1", "deployment": 6, "jevMode": "observe", "changed": True,
-                   "policies": [{"id": "no-force-push", "version": 2, "effect": "enforce"}]}))
-    result = runner.invoke(app, ["--json", "fleet", "deploy", "m1", "--jev-mode", "observe", "--yes"])
-    assert result.exit_code == 0, result.output
-    assert not deploy.called
-    assert json.loads(mode.calls.last.request.content) == {"jevMode": "observe"}
-    out = json.loads(result.stdout)
-    assert out["applied"] is True and out["jevModeOnly"] is True
-    assert out["plan"]["jevMode"]["to"] == "observe" and out["deployment"]["deployment"] == 6
-
-
-@respx.mock
-def test_fleet_deploy_adds_a_jev_policy_and_leaves_the_mode_alone_without_the_flag(logged_in, runner):
+def test_fleet_deploy_adds_a_jev_policy_and_sends_no_mode(logged_in, runner):
     _fleet_routes([], jev_mode="enforce")
     put = respx.put(f"{BASE}/api/enforcement/deployments/m1").mock(return_value=httpx.Response(
         200, json={"machineId": "m1", "deployment": 6, "jevMode": "enforce",
@@ -395,13 +354,26 @@ def test_fleet_deploy_adds_a_jev_policy_and_leaves_the_mode_alone_without_the_fl
 
 
 @respx.mock
-def test_fleet_deploy_refuses_observe_on_a_jev_policy_before_writing(logged_in, runner):
+def test_fleet_deploy_observes_a_jev_policy(logged_in, runner):
     _fleet_routes([])
-    put = respx.put(f"{BASE}/api/enforcement/deployments/m1")
+    put = respx.put(f"{BASE}/api/enforcement/deployments/m1").mock(return_value=httpx.Response(
+        200, json={"machineId": "m1", "deployment": 6,
+                   "policies": [{"id": "secrets", "version": 1, "effect": "observe"}]}))
     result = runner.invoke(app, ["fleet", "deploy", "m1", "--add", "secrets:observe", "--yes"])
-    assert result.exit_code == 2
-    assert "--jev-mode observe" in result.output + (result.stderr or "")
-    assert not put.called
+    assert result.exit_code == 0, result.output
+    assert json.loads(put.calls.last.request.content) == {
+        "policies": [{"id": "secrets", "version": 1, "effect": "observe"}]}
+
+
+@pytest.mark.parametrize("argv", [
+    ["fleet", "jev-mode", "m1", "observe"],
+    ["fleet", "deploy", "m1", "--jev-mode", "observe"],
+])
+def test_the_jev_mode_cannot_be_set_by_hand(logged_in, runner, argv):
+    with respx.mock(assert_all_called=False) as mock:
+        result = runner.invoke(app, argv)
+        assert result.exit_code == 2, result.output
+        assert not mock.calls
 
 
 @respx.mock
@@ -424,7 +396,7 @@ def test_fleet_show_and_list_show_the_jev_mode_and_the_reported_errors(logged_in
     assert js["deployment"]["jevMode"] == "observe"
 
 
-# ── Review fixes: the Jev mode route (C9.1), rollback and history (m6), help (m7) ──
+# ── Rollback and history show the mode Cloud derived (m6) ────────────────────
 
 
 def _fleet_many(deployments, machines=None):
@@ -443,133 +415,6 @@ def _fleet_many(deployments, machines=None):
         return_value=httpx.Response(200, json=[SERVER_BOTH, SERVER_JEV, SERVER_REGEX_OLD]))
 
 
-def _mode_route(machine_id, mode, deployment=6, status=200):
-    body = ({"machineId": machine_id, "deployment": deployment, "jevMode": None if mode == "local" else mode,
-             "changed": True, "policies": []} if status == 200
-            else {"error": f"machine {machine_id} has no deployment", "code": "no_deployment"})
-    return respx.put(f"{BASE}/api/enforcement/deployments/{machine_id}/jev-mode").mock(
-        return_value=httpx.Response(status, json=body))
-
-
-def test_set_jev_mode_sends_only_the_mode(monkeypatch):
-    seen = {}
-
-    def fake(ctx, method, path, json_body=None, **kw):
-        seen.update(method=method, path=path, body=json_body)
-        return {"machineId": "m1", "deployment": 9, "jevMode": "enforce", "changed": False, "policies": []}
-
-    monkeypatch.setattr(client, "_request_json", fake)
-    dep, changed = client.set_jev_mode(object(), "m1", "enforce")
-    assert seen == {"method": "PUT", "path": "/api/enforcement/deployments/m1/jev-mode", "body": {"jevMode": "enforce"}}
-    assert (dep.deployment, dep.jev_mode, changed) == (9, "enforce", False)
-
-
-@respx.mock
-def test_fleet_deploy_jev_mode_on_a_machine_with_no_deployment_deploys_its_first(logged_in, runner):
-    respx.get(f"{BASE}/api/enforcement/machines").mock(return_value=httpx.Response(
-        200, json=[{"machineId": "m1", "deployment": None, "deployed": False}]))
-    respx.get(f"{BASE}/api/enforcement/deployments").mock(return_value=httpx.Response(200, json=[]))
-    respx.get(f"{BASE}/api/enforcement/policies").mock(return_value=httpx.Response(200, json=[SERVER_JEV]))
-    mode = respx.put(f"{BASE}/api/enforcement/deployments/m1/jev-mode")
-    deploy = respx.put(f"{BASE}/api/enforcement/deployments/m1").mock(return_value=httpx.Response(
-        200, json={"machineId": "m1", "deployment": 1, "jevMode": "observe", "policies": []}))
-    result = runner.invoke(app, ["--json", "fleet", "deploy", "m1", "--jev-mode", "observe", "--yes"])
-    assert result.exit_code == 0, result.output
-    assert not mode.called
-    assert json.loads(deploy.calls.last.request.content) == {"policies": [], "jevMode": "observe"}
-
-
-@respx.mock
-def test_fleet_deploy_with_a_set_change_and_a_mode_still_deploys_both_together(logged_in, runner):
-    _fleet_routes([{"id": "no-force-push", "version": 2, "effect": "enforce"}])
-    mode = respx.put(f"{BASE}/api/enforcement/deployments/m1/jev-mode")
-    deploy = respx.put(f"{BASE}/api/enforcement/deployments/m1").mock(return_value=httpx.Response(
-        200, json={"machineId": "m1", "deployment": 6, "jevMode": "enforce", "policies": []}))
-    result = runner.invoke(app, ["fleet", "deploy", "m1", "--add", "secrets", "--jev-mode", "enforce", "--yes"])
-    assert result.exit_code == 0, result.output
-    assert not mode.called
-    assert json.loads(deploy.calls.last.request.content)["jevMode"] == "enforce"
-
-
-@respx.mock
-def test_fleet_jev_mode_sets_named_machines_and_skips_one_already_there(logged_in, runner):
-    _fleet_many({"m1": None, "m2": "enforce", "m3": "observe"})
-    r1, r2, r3 = _mode_route("m1", "enforce"), _mode_route("m2", "enforce"), _mode_route("m3", "enforce", 7)
-    deploy = respx.put(f"{BASE}/api/enforcement/deployments/m1")
-    result = runner.invoke(app, ["--json", "fleet", "jev-mode", "m1", "m2", "m3", "enforce"])
-    assert result.exit_code == 0, result.output
-    assert r1.called and r3.called and not r2.called and not deploy.called
-    assert json.loads(r1.calls.last.request.content) == {"jevMode": "enforce"}
-    out = json.loads(result.stdout)
-    assert out["mode"] == "enforce" and out["applied"] is True
-    rows = {r["machineId"]: r for r in out["machines"]}
-    assert rows["m1"]["from"] == "local" and rows["m1"]["to"] == "enforce" and rows["m1"]["deployment"] == 6
-    assert rows["m2"]["changed"] is False
-    assert rows["m3"]["from"] == "observe" and rows["m3"]["deployment"] == 7
-
-
-@respx.mock
-def test_fleet_jev_mode_all_covers_every_machine_with_a_deployment_only(logged_in, runner):
-    _fleet_many({"m1": "enforce", "m2": "off"}, machines=["m1", "m2", "m-new"])
-    r1, r2 = _mode_route("m1", "local"), _mode_route("m2", "local")
-    fresh = respx.put(f"{BASE}/api/enforcement/deployments/m-new/jev-mode")
-    result = runner.invoke(app, ["fleet", "jev-mode", "--all", "local"])
-    assert result.exit_code == 0, result.output
-    assert r1.called and r2.called and not fresh.called
-    assert json.loads(r1.calls.last.request.content) == {"jevMode": "local"}
-    assert "enforce → local" in result.stdout and "off → local" in result.stdout
-
-
-@respx.mock
-def test_fleet_jev_mode_when_nothing_changes_writes_nothing(logged_in, runner):
-    _fleet_many({"m1": "observe"})
-    route = _mode_route("m1", "observe")
-    result = runner.invoke(app, ["fleet", "jev-mode", "m1", "observe"])
-    assert result.exit_code == 0, result.output
-    assert not route.called
-    assert "already has jev mode observe" in result.output + (result.stderr or "")
-
-
-@pytest.mark.parametrize("argv, needle", [
-    (["fleet", "jev-mode"], "pass the mode"),
-    (["fleet", "jev-mode", "m1", "shadow"], "is not a Jev mode"),
-    (["fleet", "jev-mode", "observe"], "name at least one machine"),
-    (["fleet", "jev-mode", "--all", "m1", "observe"], "do not name machines"),
-])
-def test_fleet_jev_mode_usage_errors_exit_2_before_any_request(logged_in, runner, argv, needle):
-    with respx.mock(assert_all_called=False) as mock:
-        result = runner.invoke(app, argv)
-        assert result.exit_code == 2, result.output
-        assert needle in result.output + (result.stderr or "")
-        assert not mock.calls
-
-
-@respx.mock
-def test_fleet_jev_mode_refuses_a_named_machine_with_no_deployment_before_writing(logged_in, runner):
-    _fleet_many({"m1": None}, machines=["m1", "m2"])
-    r1 = _mode_route("m1", "observe")
-    result = runner.invoke(app, ["fleet", "jev-mode", "m1", "m2", "observe"])
-    assert result.exit_code == 1, result.output
-    text = result.output + (result.stderr or "")
-    assert "m2 has no deployment" in text and "fp fleet deploy <machine> --jev-mode observe" in text
-    assert not r1.called
-
-
-@respx.mock
-def test_fleet_jev_mode_goes_on_past_a_machine_that_fails_and_names_it(logged_in, runner):
-    _fleet_many({"m1": None, "m2": None})
-    _mode_route("m1", "observe", status=404)
-    r2 = _mode_route("m2", "observe")
-    result = runner.invoke(app, ["--json", "fleet", "jev-mode", "m1", "m2", "observe"])
-    assert result.exit_code == 1, result.output
-    assert r2.called
-    # The result document, then the error document the exit code comes with.
-    out, end = json.JSONDecoder().raw_decode(result.stdout)
-    rows = {r["machineId"]: r for r in out["machines"]}
-    assert "error" in rows["m1"] and rows["m2"]["deployment"] == 6 and out["applied"] is False
-    assert "could not be changed on m1" in result.stdout[end:] + (result.stderr or "")
-
-
 @respx.mock
 def test_fleet_rollback_says_which_jev_mode_it_restores(logged_in, runner):
     _fleet_many({"m1": "off"})
@@ -607,15 +452,6 @@ def test_fleet_history_shows_each_generations_jev_mode_and_a_mode_only_change(lo
     assert any("local" in ln for ln in lines if "#5" in ln)
 
 
-def test_the_help_says_enforce_blocks_and_that_the_mode_is_machine_wide(runner):
-    for argv in (["fleet", "deploy", "--help"], ["fleet", "jev-mode", "--help"]):
-        result = runner.invoke(app, argv)
-        assert result.exit_code == 0, result.output
-        flat = " ".join(result.stdout.split())
-        assert "BLOCK" in flat, argv
-        assert "installed" in flat and "pack" in flat, argv
-
-
 # ── CONTRACT C10.6: Jev checks run on FailproofAI Cloud (help text only) ──────
 
 
@@ -623,7 +459,6 @@ def test_the_help_says_enforce_blocks_and_that_the_mode_is_machine_wide(runner):
     "argv",
     [
         ["fleet", "deploy", "--help"],
-        ["fleet", "jev-mode", "--help"],
         ["policies", "publish", "--help"],
     ],
 )
@@ -637,7 +472,7 @@ def test_the_help_says_jev_checks_run_on_cloud_and_nothing_is_installed(runner,
     assert "AgentEye" not in flat, argv
 
 
-@pytest.mark.parametrize("argv", [["fleet", "show", "--help"], ["fleet", "jev-mode", "--help"]])
+@pytest.mark.parametrize("argv", [["fleet", "show", "--help"]])
 def test_the_help_names_the_reasons_a_machine_cannot_ask(runner, argv):
     flat = " ".join(runner.invoke(app, argv).stdout.split())
     assert "transcripts_disabled" in flat, argv

package/.next/standalone/fp-cloud-cli/tests/test_cloud_observability.py

@@ -0,0 +1,116 @@
+import json
+
+import pytest
+import respx
+
+from fp_cli.app import app
+
+BASE = "http://dash.test"
+DASHBOARD = {"name": "Quality", "description": "Keep", "definition": {"filters": {"env": "prod"}}}
+TILE = {"id": "t1", "query_id": "q1", "title": "Before", "chart_type": "table",
+        "chart_config": {}, "param_bindings": {}, "pos_x": 0, "pos_y": 0, "pos_w": 6, "pos_h": 4}
+RESULT = {"columns": [{"name": "agent", "type": "String"}, {"name": "n", "type": "Int64"}],
+          "rows": [["agent-001", 42]], "truncated": False, "elapsed_ms": 1}
+CASES = [
+    (["dashboards", "list"], "GET", "/dashboards", {"dashboards": []}),
+    (["dashboards", "show", "d1"], "GET", "/dashboards/d1", {"dashboard": DASHBOARD, "tiles": []}),
+    (["dashboards", "create", "--name", "Quality"], "POST", "/dashboards", {"id": "d1"}),
+    (["dashboards", "update", "d1", "--name", "New"], "PUT", "/dashboards/d1", {"id": "d1"}),
+    (["dashboards", "delete", "d1"], "DELETE", "/dashboards/d1", {"deleted": True}),
+    (["dashboards", "tiles", "d1", "list"], "GET", "/dashboards/d1/tiles", {"tiles": [TILE]}),
+    (["dashboards", "tiles", "d1", "add", "--query", "q1", "--chart", "bar"], "POST", "/dashboards/d1/tiles", {"id": "t1"}),
+    (["dashboards", "tiles", "d1", "update", "t1", "--title", "After"], "PUT", "/dashboards/d1/tiles/t1", {"id": "t1"}),
+    (["dashboards", "tiles", "d1", "remove", "t1"], "DELETE", "/dashboards/d1/tiles/t1", {"deleted": True}),
+    (["dashboards", "tiles", "d1", "layout", "--file", "{layout}"], "PUT", "/dashboards/d1/tiles/layout", {"updated": 1}),
+    (["sessions", "show", "s1"], "GET", "/events/summary", {"events": [], "next_cursor": None}),
+    (["sessions", "export", "s1"], "GET", "/sessions/s1/export", {"session_id": "s1", "events": []}),
+    (["sessions", "history", "s1"], "GET", "/sessions/s1/evaluation-history", []),
+    (["events", "latency"], "GET", "/events/latency_aggregate", {"p95": 42}),
+    (["sentiment", "summary"], "GET", "/events/sentiment", {"positive": 1}),
+    (["sentiment", "messages"], "GET", "/events/sentiment/messages", []),
+    (["sentiment", "sessions"], "GET", "/events/sentiment/sessions", []),
+    (["sentiment", "session", "s1"], "GET", "/events/sentiment/sessions/s1", {}),
+    (["query", "export", "q1", "--format", "json"], "POST", "/queries/run", RESULT),
+    (["query", "export", "--sql", "SELECT 1", "--format", "csv"], "POST", "/queries/run", RESULT),
+]
+
+
+@pytest.fixture
+def files(tmp_path):
+    path = tmp_path / "layout.json"
+    path.write_text(json.dumps({"tiles": [{k: v for k, v in TILE.items() if k in ("id", "pos_x", "pos_y", "pos_w", "pos_h")}]}))
+    return {"layout": str(path)}
+
+
+@pytest.mark.parametrize("key_mode", [False, True])
+@pytest.mark.parametrize("argv,method,path,response", CASES, ids=lambda v: " ".join(v) if isinstance(v, list) else str(v))
+def test_observability_commands(logged_in, runner, files, key_mode, argv, method, path, response):
+    prefix = "/v1" if key_mode else "/api"
+    with respx.mock(assert_all_called=False) as mock:
+        mock.get(f"{BASE}{prefix}/dashboards/d1").respond(200, json={"dashboard": DASHBOARD, "tiles": []})
+        mock.get(f"{BASE}{prefix}/dashboards/d1/tiles").respond(200, json={"tiles": [TILE]})
+        mock.get(f"{BASE}{prefix}/sessions").respond(200, json={"sessions": [{"session_id": "s1"}]})
+        route = mock.request(method, f"{BASE}{prefix}{path}").respond(200, json=response)
+        result = runner.invoke(app, ["--json", *(["--api-key", "key"] if key_mode else []), *[v.format(**files) for v in argv]])
+    assert result.exit_code == 0, result.output
+    assert route.called
+    json.loads(result.stdout)
+    if argv[:2] == ["dashboards", "create"]:
+        assert json.loads(route.calls[0].request.content) == {"name": "Quality", "description": "", "definition": {}}
+    if argv[:2] == ["dashboards", "update"]:
+        assert json.loads(route.calls[0].request.content) == {**DASHBOARD, "name": "New"}
+    if argv[:4] == ["dashboards", "tiles", "d1", "update"]:
+        assert json.loads(route.calls[0].request.content) == {k: ("After" if k == "title" else v) for k, v in TILE.items() if k != "id"}
+
+
+@pytest.mark.parametrize("argv,method,path,response", CASES)
+@pytest.mark.parametrize("key_mode", [False, True])
+def test_observability_404(logged_in, runner, files, key_mode, argv, method, path, response):
+    with respx.mock as mock:
+        mock.route().respond(404, json={"error": "unknown route"})
+        result = runner.invoke(app, ["--json", *(["--api-key", "key"] if key_mode else []), *[v.format(**files) for v in argv]])
+    assert result.exit_code == 6, result.output
+    assert "not available on this FailproofAI Cloud yet" in result.stdout
+
+
+def test_query_compose(logged_in, runner):
+    stream = 'data: {"type":"done","sql":"SELECT 1"}\n\n'
+    with respx.mock as mock:
+        draft = mock.post(f"{BASE}/api/agent/compose-sql").respond(200, text=stream, headers={"content-type": "text/event-stream"})
+        run = mock.post(f"{BASE}/api/queries/run").respond(200, json=RESULT)
+        result = runner.invoke(app, ["--json", "query", "compose", "Count events", "--run"])
+    assert result.exit_code == 0, result.output
+    assert json.loads(draft.calls[0].request.content) == {"intent": "Count events"}
+    assert json.loads(run.calls[0].request.content) == {"sql": "SELECT 1", "params": []}
+
+
+def test_query_compose_key_denial(logged_in, runner):
+    with respx.mock as mock:
+        result = runner.invoke(app, ["--json", "--api-key", "key", "query", "compose", "Count events"])
+        assert not mock.calls
+    assert result.exit_code == 2
+    assert "fp login" in result.stdout
+
+
+def test_exports_write_files(logged_in, runner, tmp_path):
+    path = tmp_path / "data.csv"
+    with respx.mock as mock:
+        mock.post(f"{BASE}/api/queries/run").respond(200, json=RESULT)
+        result = runner.invoke(app, ["--json", "query", "export", "--sql", "SELECT 1", "--out", str(path)])
+    assert result.exit_code == 0
+    assert path.read_text().splitlines() == ["agent,n", "agent-001,42"]
+
+
+@pytest.mark.parametrize("argv", [
+    ["dashboards", "create", "--name", ""],
+    ["dashboards", "update", "d1"],
+    ["dashboards", "tiles", "d1", "add", "--query", "q1", "--chart", "invalid"],
+    ["sentiment", "messages", "--limit", "0"],
+    ["query", "export", "--sql", "SELECT 1", "--format", "xml"],
+    ["query", "export", "q1", "--sql", "SELECT 1"],
+])
+def test_validation(logged_in, runner, argv):
+    with respx.mock as mock:
+        result = runner.invoke(app, ["--json", *argv])
+        assert not mock.calls
+    assert result.exit_code == 2, result.output

package/.next/standalone/fp-cloud-cli/tests/test_cloud_transport.py

@@ -0,0 +1,141 @@
+import pytest
+import respx
+
+from fp_cli import client
+from fp_cli.errors import NotFoundError
+
+
+@pytest.mark.parametrize("family", [
+    "evaluator-definitions", "evaluator-instances", "evaluator-schema-profile",
+    "evaluation-jobs", "dashboards", "otel", "offers", "team-trial",
+])
+def test_added_v1_families(family):
+    assert client._v1_path(f"/api/{family}") == f"/v1/{family}"
+
+
+@pytest.mark.parametrize("method", ["GET", "POST", "PATCH", "DELETE"])
+@pytest.mark.parametrize("key_mode", [False, True])
+def test_cloud_request_degrades(method, key_mode):
+    ctx = client.ClientContext(
+        "http://dash.test", token=None if key_mode else "tok",
+        api_key="key" if key_mode else None,
+        auth_mode=client.AuthMode.API_KEY if key_mode else client.AuthMode.SESSION,
+    )
+    prefix = "v1" if key_mode else "api"
+    with respx.mock:
+        route = respx.request(method, f"http://dash.test/{prefix}/dashboards").respond(404, json={})
+        with pytest.raises(NotFoundError, match="not available on this FailproofAI Cloud yet") as exc:
+            client.cloud_request(ctx, method, "/api/dashboards")
+    assert exc.value.exit_code == 6
+    headers = route.calls[0].request.headers
+    assert ("authorization" in headers) is key_mode
+    assert ("cookie" in headers) is not key_mode
+
+
+def test_new_capability_html_404_degrades():
+    ctx = client.ClientContext("http://dash.test", api_key="key", auth_mode=client.AuthMode.API_KEY)
+    with respx.mock as mock:
+        mock.get("http://dash.test/v1/dashboards").respond(404, text="<html>old Cloud</html>", headers={"content-type": "text/html"})
+        with pytest.raises(NotFoundError, match="not available on this FailproofAI Cloud yet") as exc:
+            client.cloud_request(ctx, "GET", "/api/dashboards")
+    assert exc.value.exit_code == 6
+
+
+@pytest.mark.parametrize("key_mode", [False, True])
+@pytest.mark.parametrize("method,path,body,params", [
+    ("PATCH", "/api/evaluator-definitions/stale-id", {"enabled": False}, None),
+    ("GET", "/api/sessions/missing/export", None, None),
+    ("POST", "/api/sessions/missing/re-evaluate", None, None),
+    ("GET", "/api/dashboards/missing/tiles", None, None),
+    ("DELETE", "/api/dashboards/board/tiles/stale-tile", None, None),
+    ("GET", "/api/events/sentiment/sessions/missing", None, None),
+    ("GET", "/api/audits/contracts/stale-id", None, None),
+    ("POST", "/api/queries/run", {"query_id": "missing"}, None),
+    ("POST", "/api/agent/answer", {"callId": "missing", "decision": "reject"}, None),
+    ("DELETE", "/api/settings/model-context-windows", None, {"model": "missing"}),
+])
+def test_record_404_is_not_route_unavailable(key_mode, method, path, body, params):
+    ctx = client.ClientContext(
+        "http://dash.test", token=None if key_mode else "tok",
+        api_key="key" if key_mode else None,
+        auth_mode=client.AuthMode.API_KEY if key_mode else client.AuthMode.SESSION,
+    )
+    if key_mode and path.startswith("/api/agent/"):
+        pytest.skip("the agent has no key route; tested via session-only command guards")
+    wire_path = client._v1_path(path) if key_mode else path
+    with respx.mock as mock:
+        mock.request(method, f"http://dash.test{wire_path}").respond(404, json={})
+        with pytest.raises(NotFoundError) as exc:
+            client.cloud_request(ctx, method, path, body=body, params=params)
+    assert exc.value.exit_code == 6
+    assert "Record not found" in exc.value.message
+    assert "not available on this FailproofAI Cloud yet" not in exc.value.message
+
+
+@pytest.mark.parametrize("response,route_unknown", [
+    ({"code": "route_not_found"}, True),
+    ({"error": {"code": "route_not_found"}}, True),
+    ({"error": "unknown endpoint"}, True),
+    ({"message": "Cannot PATCH /evaluator-definitions/stale-id"}, True),
+    ({"error": "route does not exist"}, True),
+    ({"error": "old Cloud route absent"}, True),
+    ({"error": "evaluator definition not found"}, False),
+    ({"error": "session not found"}, False),
+    ({"error": "query not found"}, False),
+    ({"error": "not available in demo"}, False),
+])
+def test_404_response_overrides_request_shape(response, route_unknown):
+    ctx = client.ClientContext("http://dash.test", token="tok")
+    with respx.mock as mock:
+        mock.patch("http://dash.test/api/evaluator-definitions/stale-id").respond(404, json=response)
+        with pytest.raises(NotFoundError) as exc:
+            client.cloud_request(ctx, "PATCH", "/api/evaluator-definitions/stale-id", body={"enabled": False})
+    assert exc.value.exit_code == 6
+    if route_unknown:
+        assert exc.value.message == "not available on this FailproofAI Cloud yet"
+    else:
+        assert exc.value.message == response.get("error", response.get("message"))
+
+
+@pytest.mark.parametrize("body", [{"code": "record_not_found"}, {"error": "resource_not_found"}])
+def test_record_error_code_on_collection_is_not_unavailable(body):
+    ctx = client.ClientContext("http://dash.test", token="tok")
+    with respx.mock as mock:
+        mock.post("http://dash.test/api/queries/run").respond(404, json=body)
+        with pytest.raises(NotFoundError, match="Record not found") as exc:
+            client.cloud_request(ctx, "POST", "/api/queries/run", body={"sql": "SELECT 1"})
+    assert "not available" not in exc.value.message
+
+
+def test_collection_with_missing_saved_query_preserves_server_error():
+    ctx = client.ClientContext("http://dash.test", token="tok")
+    with respx.mock as mock:
+        mock.post("http://dash.test/api/queries/run").respond(404, json={"error": "saved query not found"})
+        with pytest.raises(NotFoundError, match="saved query not found"):
+            client.cloud_request(ctx, "POST", "/api/queries/run", body={"query_id": "stale"})
+
+
+def test_stream_404_distinguishes_route_and_record():
+    ctx = client.ClientContext("http://dash.test", token="tok")
+    for error, expected in [
+        ({"code": "unknown_route"}, "not available on this FailproofAI Cloud yet"),
+        ({"error": "conversation not found"}, "conversation not found"),
+    ]:
+        with respx.mock as mock:
+            mock.post("http://dash.test/api/agent/chat").respond(404, json=error)
+            with pytest.raises(NotFoundError, match=expected):
+                list(client.cloud_stream(ctx, "/api/agent/chat", {"conversationId": "missing"}))
+
+
+@pytest.mark.parametrize("path", [
+    "/api/agent/conversations/stale",
+    "/api/offers/stale",
+    "/api/integrations/slack/stale",
+])
+def test_named_endpoint_families_do_not_hide_record_404s(path):
+    ctx = client.ClientContext("http://dash.test", token="tok")
+    with respx.mock as mock:
+        mock.get(f"http://dash.test{path}").respond(404, json={})
+        with pytest.raises(NotFoundError, match="Record not found") as exc:
+            client.cloud_request(ctx, "GET", path)
+    assert "not available" not in exc.value.message

package/.next/standalone/fp-cloud-cli/tests/test_commands.py

@@ -522,7 +522,7 @@ def test_sessions_table(logged_in, runner):
     )
     result = runner.invoke(app, ["sessions"])
     assert result.exit_code == 0, result.output
-    assert "sessions" in result.stdout  # the boxed panel title
+    assert "SESSIONS" in result.stdout
     assert "done" in result.stdout  # status flattened up from latest_evaluation
 
 
@@ -679,7 +679,7 @@ def test_help_command(home, runner):
     result = runner.invoke(app, ["help"])
     assert result.exit_code == 0
     out = result.stdout
-    assert "Commands" in out  # the grouped top-level panel
+    assert "COMMANDS" in out
     # the four purpose groups, in order
     for g in ("ESSENTIALS", "OBSERVE", "MANAGE", "TOOLS"):
         assert g in out
@@ -744,7 +744,7 @@ def test_fields_unknown_is_usage_error(logged_in, runner):
 def test_dash_h_alias_shows_help(home, runner):
     result = runner.invoke(app, ["-h"])
     assert result.exit_code == 0
-    assert "Commands" in result.stdout and "sessions" in result.stdout
+    assert "COMMANDS" in result.stdout and "sessions" in result.stdout
     assert "ESSENTIALS" in result.stdout  # the grouped top-level help, via the rich_format_help override
 
 

package/.next/standalone/fp-cloud-cli/tests/test_dashboards_agent.py

@@ -171,7 +171,7 @@ def test_agent_health_renders_configured_card(logged_in, runner):
     result = runner.invoke(app, ["agent", "health"])
     assert result.exit_code == 0, result.output
     out = result.stdout
-    assert "assistant" in out and "configured" in out and "claude-x" in out
+    assert "ASSISTANT" in out and "configured" in out and "claude-x" in out
 
 
 @respx.mock
@@ -192,7 +192,7 @@ def test_agent_models_renders_default_marker(logged_in, runner):
     result = runner.invoke(app, ["agent", "models"])
     assert result.exit_code == 0, result.output
     out = result.stdout
-    assert "models" in out and "m-default" in out and "m-fast" in out and "default" in out
+    assert "MODELS" in out and "m-default" in out and "m-fast" in out and "default" in out
 
 
 @respx.mock
@@ -213,7 +213,7 @@ def test_agent_chats_renders_table(logged_in, runner):
     )
     result = runner.invoke(app, ["agent", "chats"])
     assert result.exit_code == 0, result.output
-    assert "chats" in result.stdout and "perf review" in result.stdout
+    assert "CHATS" in result.stdout and "perf review" in result.stdout
     assert "chat-id" in result.stdout and "c1" in result.stdout  # full chat-id column by default
     assert "open one with" not in (result.stderr or "")           # footer removed