failproofai 1.0.12-beta.1 → 1.0.12

package/src/hooks/semantic/intent.ts

@@ -81,6 +81,26 @@
  * Known limits.)
  *
  * Text inside a tool call claiming "the user approved this" is never consulted.
+ *
+ * WHOSE SESSION IT IS. Prompts are stored per AGENT PROFILE and session id
+ * (`sessions/<profile>/<sessionId>.json`), the profile being the runtime agent
+ * identity FailproofAI Cloud's agent targeting uses (`AgentIdentity`, read by
+ * the handler from the daemon's roster) — `<integration>.<instanceId>`, or the
+ * bare integration name when the profile has no rostered identity. Session ids
+ * are chosen by the harness, not by us, so two profiles can submit the same
+ * one; keyed by session id alone, a prompt typed into a profile a Cloud Jev
+ * deployment does NOT target could be read back as the stated intent of one it
+ * does, and clear a reviewable deny there. The hook path always names the
+ * profile on both sides (`captureIntent`'s `profile`, `readIntent`'s), so a
+ * prompt is only ever read by the profile it was typed into.
+ *
+ * The flat `sessions/<sessionId>.json` layout that came before is the store a
+ * caller that names NO profile still reads and writes (library and test use).
+ * The hook path never reads it: such a file cannot say which profile wrote it,
+ * so a pre-upgrade entry is ignored rather than guessed at, and expires under
+ * the six-hour sweep like any other. The cost is bounded and fail-closed: a
+ * session in flight across the upgrade judges with no stated intent until its
+ * next prompt is recorded.
  */
 import {
   chmodSync,
@@ -99,6 +119,7 @@ import { dirname, resolve } from "node:path";
 import { failproofaiHome, semanticDir } from "../fp-home";
 import type { IntegrationType } from "../types";
 import { MAX_USER_MESSAGE_CHARS, redactSecrets } from "./envelope";
+import { validAgentIdentity, type AgentIdentity } from "../agent-targets";
 
 export const MAX_RECORDED_PROMPTS = 5;
 /** Older than this and a prompt no longer describes what the agent is doing. */
@@ -109,7 +130,51 @@ const MAX_CLOCK_SKEW_MS = 5 * 60 * 1000;
 const SESSION_ID_RE = /^[A-Za-z0-9._-]{1,128}$/;
 
 const sessionsDir = (): string => resolve(semanticDir(), "sessions");
-const intentFile = (sessionId: string): string => resolve(sessionsDir(), `${sessionId}.json`);
+
+/**
+ * The agent profile a prompt belongs to: the harness, and the runtime agent
+ * identity the handler resolved for it (`readRuntimeAgentIdentity`) — the same
+ * identity Cloud Jev's agent targeting matches on. `agent` null or absent is a
+ * profile with no rostered identity, which targeting treats as "unknown" and
+ * which is kept apart from every rostered one.
+ */
+export interface IntentProfile {
+  cli: string;
+  agent?: AgentIdentity | null;
+}
+
+/** A profile directory's name: `<integration>` or `<integration>.agt_<hex>`. */
+const PROFILE_DIR_RE = /^[a-z]+(?:\.agt_[0-9a-f]{16,32})?$/;
+
+/**
+ * The directory name a profile's prompts live under, or null when the profile
+ * cannot be named (an unknown harness): nothing is then recorded or read.
+ * Injective: integration names are lowercase letters and instance ids carry
+ * their own `agt_` prefix, so no two profiles share a directory.
+ */
+export function intentProfileKey(profile: IntentProfile): string | null {
+  if (validAgentIdentity(profile.agent)) return `${profile.agent.integration}.${profile.agent.instanceId}`;
+  return isKnownCli(profile.cli) ? profile.cli : null;
+}
+
+/** Where one session's prompts are kept: the directory and the file in it. */
+interface StoreSlot {
+  dir: string;
+  file: string;
+}
+
+/**
+ * The slot for `sessionId` under `profile`. No profile at all (`undefined`) is
+ * the flat, pre-profile layout — never used by the hook path (see the header).
+ * A profile that cannot be named has no slot.
+ */
+function storeSlot(sessionId: string, profile: IntentProfile | undefined): StoreSlot | null {
+  if (profile === undefined) return { dir: sessionsDir(), file: resolve(sessionsDir(), `${sessionId}.json`) };
+  const key = intentProfileKey(profile);
+  if (key === null || !PROFILE_DIR_RE.test(key)) return null;
+  const dir = resolve(sessionsDir(), key);
+  return { dir, file: resolve(dir, `${sessionId}.json`) };
+}
 
 /**
  * Group- or world-WRITE bits on a directory the store sits under. Anyone who
@@ -140,11 +205,11 @@ function modesAreMeaningful(): boolean {
  * (`fpai-collect`'s `create_dir_all`) and arrives at the umask, which on a
  * umask-002 box is 0775.
  */
-function storeDirChain(): string[] {
+function storeDirChain(innermost: string = sessionsDir()): string[] {
   const home = resolve(failproofaiHome());
   const chain: string[] = [];
-  let dir = sessionsDir();
-  // Bounded: the chain is four deep, and a home that is not an ancestor (a
+  let dir = innermost;
+  // Bounded: the chain is five deep, and a home that is not an ancestor (a
   // layout change, a symlink) must not walk to the filesystem root.
   for (let i = 0; i < 8; i++) {
     chain.push(dir);
@@ -172,11 +237,12 @@ function storeDirChain(): string[] {
  * human's and could clear the four reviewable BLOCKING policies.
  *
  * Exported so `failproofai jev status` can report it the way it reports a
- * refused config.
+ * refused config. `innermost` is a profile's directory when the read is for
+ * one, so that directory is held to the same rule.
  */
-export function looseIntentStoreDir(): string | null {
+export function looseIntentStoreDir(innermost?: string): string | null {
   if (!modesAreMeaningful()) return null;
-  for (const dir of storeDirChain()) {
+  for (const dir of storeDirChain(innermost)) {
     let mode: number;
     try {
       mode = statSync(dir).mode & 0o777;
@@ -207,9 +273,9 @@ interface IntentFile {
   prompts: RecordedPrompt[];
 }
 
-function readIntentFile(sessionId: string): IntentFile {
+function readIntentFile(slot: StoreSlot): IntentFile {
   try {
-    const parsed = JSON.parse(readFileSync(intentFile(sessionId), "utf8")) as IntentFile;
+    const parsed = JSON.parse(readFileSync(slot.file, "utf8")) as IntentFile;
     return Array.isArray(parsed?.prompts) ? parsed : { prompts: [] };
   } catch {
     return { prompts: [] };
@@ -228,15 +294,14 @@ function readIntentFile(sessionId: string): IntentFile {
  * copies of one line. The replacement carries the new timestamp and the new
  * agent snapshot, so the entry stays the latest thing the human said.
  */
-function appendPrompt(sessionId: string, entry: RecordedPrompt): boolean {
+function appendPrompt(slot: StoreSlot, entry: RecordedPrompt): boolean {
   try {
-    const file = readIntentFile(sessionId);
+    const file = readIntentFile(slot);
     const last = file.prompts[file.prompts.length - 1];
     const kept = last && last.text === entry.text ? file.prompts.slice(0, -1) : file.prompts;
     file.prompts = [...kept, entry].slice(-MAX_RECORDED_PROMPTS);
-    const dir = sessionsDir();
-    mkdirSync(dir, { recursive: true, mode: 0o700 });
-    const target = intentFile(sessionId);
+    mkdirSync(slot.dir, { recursive: true, mode: 0o700 });
+    const target = slot.file;
     const isNew = !fileExists(target);
     const tmp = `${target}.${process.pid}.tmp`;
     writeFileSync(tmp, JSON.stringify(file), { mode: 0o600 });
@@ -265,12 +330,31 @@ const SESSION_FILE_RE = /^[A-Za-z0-9._-]{1,128}\.json(?:\.\d+\.tmp)?$/;
  * file's mtime is its newest recorded prompt's, so every prompt in such a
  * file is already outside the window every read filters by and can never be
  * read again. Removing it loses nothing and keeps one-file-per-session from
- * growing without bound.
+ * growing without bound. Swept: the flat layout's files (pre-profile entries
+ * among them) and every profile directory's, one level down.
  */
 export function pruneExpiredSessions(now: number = Date.now()): number {
+  const root = sessionsDir();
+  let removed = pruneDir(root, now);
+  try {
+    for (const name of readdirSync(root)) {
+      if (!PROFILE_DIR_RE.test(name)) continue;
+      const dir = resolve(root, name);
+      try {
+        if (statSync(dir).isDirectory()) removed += pruneDir(dir, now);
+      } catch {
+        // Raced with something else: nothing to do.
+      }
+    }
+  } catch {
+    // No directory yet.
+  }
+  return removed;
+}
+
+function pruneDir(dir: string, now: number): number {
   let removed = 0;
   try {
-    const dir = sessionsDir();
     for (const name of readdirSync(dir)) {
       if (!SESSION_FILE_RE.test(name)) continue;
       const path = resolve(dir, name);
@@ -301,11 +385,19 @@ export function pruneExpiredSessions(now: number = Date.now()): number {
  * leave half a secret the patterns no longer match. Never throws: losing intent
  * only means no override.
  */
-function recordPrompt(sessionId: string, prompt: string, agent: string | null, now: number): boolean {
+function recordPrompt(
+  sessionId: string,
+  profile: IntentProfile | undefined,
+  prompt: string,
+  agent: string | null,
+  now: number,
+): boolean {
   if (!SESSION_ID_RE.test(sessionId)) return false;
   if (prompt.trim().length === 0) return false;
+  const slot = storeSlot(sessionId, profile);
+  if (!slot) return false;
   try {
-    return appendPrompt(sessionId, { at: now, text: storable(prompt.trim()), agent: agent === null ? null : storable(agent) });
+    return appendPrompt(slot, { at: now, text: storable(prompt.trim()), agent: agent === null ? null : storable(agent) });
   } catch {
     return false;
   }
@@ -319,10 +411,12 @@ function recordPrompt(sessionId: string, prompt: string, agent: string | null, n
  * still asked, and judges with no stated intent, so no reviewable deny is
  * cleared on a prompt we cannot say is the owner's.
  */
-function livePrompts(sessionId: string | undefined, now: number): RecordedPrompt[] {
+function livePrompts(sessionId: string | undefined, now: number, profile: IntentProfile | undefined): RecordedPrompt[] {
   if (!sessionId || !SESSION_ID_RE.test(sessionId)) return [];
-  if (looseIntentStoreDir() !== null) return [];
-  return readIntentFile(sessionId).prompts.filter(
+  const slot = storeSlot(sessionId, profile);
+  if (!slot) return [];
+  if (looseIntentStoreDir(slot.dir) !== null) return [];
+  return readIntentFile(slot).prompts.filter(
     (p) =>
       typeof p?.text === "string" &&
       typeof p.at === "number" &&
@@ -839,6 +933,13 @@ export interface CaptureEvent {
   cli: string;
   /** The stdin payload after `normalizeCliPayload`: the handler's `parsed`. */
   payload: Record<string, unknown>;
+  /**
+   * The agent profile the prompt was typed into. The hook path always sets it
+   * (the agent null when the profile has no rostered identity), and the prompt
+   * is then readable only under that same profile. Absent is the flat layout
+   * (see the header).
+   */
+  profile?: IntentProfile;
 }
 
 function isKnownCli(cli: string): cli is IntegrationType {
@@ -1167,7 +1268,7 @@ export function captureIntent(ev: CaptureEvent, now: number = Date.now()): void
     if (raw === null) return;
     const cleaned = cleanHumanTurn(raw);
     if (cleaned === null) return;
-    recordPrompt(sessionId, cleaned, lastAgentMessage(ev.transcriptPath), now);
+    recordPrompt(sessionId, ev.profile, cleaned, lastAgentMessage(ev.transcriptPath), now);
   } catch {
     // Losing intent only means Jev judges without it.
   }
@@ -1177,13 +1278,15 @@ export function captureIntent(ev: CaptureEvent, now: number = Date.now()): void
  * What the human asked for recently (oldest first, at most
  * `MAX_RECORDED_PROMPTS`, none older than `INTENT_MAX_AGE_MS`) and the agent
  * message their latest prompt replied to — null when that prompt had none or
- * nothing is recorded.
+ * nothing is recorded. Read under `profile`, the one the prompts were captured
+ * under; the hook path always passes it (see the header).
  */
 export function readIntent(
   sessionId?: string,
   now: number = Date.now(),
+  profile?: IntentProfile,
 ): { userSaid: string[]; agentLastMessage: string | null } {
-  const prompts = livePrompts(sessionId, now);
+  const prompts = livePrompts(sessionId, now, profile);
   const latest = prompts[prompts.length - 1];
   const agent = latest && typeof latest.agent === "string" && latest.agent.length > 0 ? latest.agent : null;
   return { userSaid: prompts.map((p) => p.text), agentLastMessage: agent };

package/src/hooks/semantic/jev-client.ts

@@ -469,7 +469,7 @@ async function postJson(url: string, bearer: string, body: unknown, signal: Abor
       body: JSON.stringify(body),
       signal,
       // Never followed. The configured URL is the one `validateBaseUrl` checked
-      // (https, or loopback http in observe mode only); a redirect would hand the
+      // (https, or loopback http); a redirect would hand the
       // answer — the thing that can clear a deny — to an origin nobody checked,
       // plain http included. No provider redirects this POST.
       redirect: "manual",

package/src/hooks/semantic/jev-config.ts

@@ -327,8 +327,7 @@ function credentialQueryProblem(url: URL): string | null {
  * An endpoint base URL: https, or http to a loopback host only (a local proxy).
  * No credentials in the URL — not as userinfo, not as a query parameter — and no
  * fragment, because a key belongs in the key field, where it is sent as a bearer
- * and never printed. `validateJevConfig` further accepts the loopback http form
- * only in observe mode.
+ * and never printed. Loopback http is accepted in every mode.
  */
 export function validateBaseUrl(raw: unknown): ValidationResult<string> {
   if (typeof raw !== "string" || raw.trim() === "") return { ok: false, problem: "baseUrl must be a non-empty string" };
@@ -483,14 +482,6 @@ export function providerHostConflict(provider: string, url: string): string | nu
     : null;
 }
 
-function isPlainHttp(url: string): boolean {
-  try {
-    return new URL(url).protocol === "http:";
-  } catch {
-    return false;
-  }
-}
-
 /**
  * The origin a bearer token would be sent to: https, or http to a loopback host
  * — the same schemes `validateBaseUrl` admits. Null for anything else, so a
@@ -697,23 +688,11 @@ export function validateJevConfig(
     cfg.mode = mode;
   }
 
-  // Plain http reaches only a loopback host (`validateBaseUrl`), and nothing
-  // authenticates the server there: while the local proxy is down, any process
-  // of this user — the agent being judged included — can bind its port and
-  // answer "none" to every question. In enforce mode that answer clears
-  // reviewable denies; in observe mode it changes nothing, and `off` sends
-  // nothing at all, so enforce is the one mode it is refused in.
-  if (cfg.baseUrl !== undefined && isPlainHttp(cfg.baseUrl) && cfg.mode === "enforce") {
-    return {
-      ok: false,
-      problem:
-        "plain http (to localhost) is accepted only with mode observe: in enforce mode Jev's answers can clear a deny, " +
-        "and while the local proxy is down any process on this machine could take its port and answer. " +
-        (cfg.provider === JEV_CLOUD_PROVIDER
-          ? "Reconnect to an https FailproofAI Cloud URL (failproofai config --token <key> --url https://…), or keep mode observe"
-          : "Use https, or mode observe"),
-    };
-  }
+  // Plain http reaches only a loopback host (`validateBaseUrl`) and is
+  // accepted in every mode, enforce included, so a local stack can be tested
+  // as it runs in production. Risk: nothing authenticates a loopback server,
+  // so while it is down any process of this user could bind its port and
+  // answer; use https wherever that matters.
 
   return { ok: true, value: cfg };
 }

package/src/hooks/semantic/jev-review.ts

@@ -73,6 +73,7 @@ import { DEFAULT_JEV_MODE, type JevConfig } from "./jev-config";
 import * as jevThrottle from "./jev-throttle";
 import { sessionProjectRoot } from "./session-root";
 import type { PolicyOutcome, SemanticInput } from "./types";
+import { JEV_CHECKS_MAX, JEV_CHECK_PROBES_MAX, JEV_PROBE_ID_RE, round2, type JevCheckRecord } from "../jev-activity";
 
 /**
  * T5's throttle as this file calls it. §7 declares only
@@ -110,7 +111,16 @@ const throttle: JevThrottle = jevThrottle;
  * for a call.
  */
 interface IntentStore {
-  readIntent(sessionId?: string): { userSaid: string[]; agentLastMessage: string | null };
+  /**
+   * `profile` is required here, unlike in `intent.ts`: the hook path always
+   * reads under the agent profile the prompt was captured under, never the
+   * flat store, so one profile's prompt can never be another's intent.
+   */
+  readIntent(
+    sessionId: string | undefined,
+    now: number | undefined,
+    profile: intentStore.IntentProfile,
+  ): { userSaid: string[]; agentLastMessage: string | null };
 }
 const intentReader: IntentStore = intentStore;
 
@@ -167,12 +177,26 @@ export interface JevCallContext {
   permissionMode?: string;
   sessionId?: string;
   cli: string;
+  /**
+   * The runtime agent identity of the profile making the call (the handler's
+   * `readRuntimeAgentIdentity`; null when it has none). With `cli`, it names
+   * the intent store slot the human's prompts are read from, so they are the
+   * prompts typed into this profile and no other. Absent is read as null.
+   */
+  agent?: AgentIdentity | null;
   /**
    * Set when FailproofAI Cloud's Jev mode asks (CONTRACT C10.2): the call goes
    * to Cloud with this machine's id, and the deployment it was made under
    * scopes the answer cache (a new deployment can change Cloud's checks).
    */
-  cloud?: { machineId: string; deployment: number | null; mode: "observe" | "enforce"; agent?: AgentIdentity | null };
+  cloud?: {
+    machineId: string;
+    deployment: number | null;
+    mode: "observe" | "enforce";
+    agent?: AgentIdentity | null;
+    /** Cloud policies whose Jev assignment here is `observe`: recorded, never applied. */
+    observedPolicies?: ReadonlyArray<string>;
+  };
   /**
    * A session pause is active. It suspends local policy, so no installed
    * pack's check is asked; FailproofAI Cloud's checks are exempt from a pause
@@ -248,6 +272,66 @@ export function fallbackCode(reason: string): string {
   return /^[a-z0-9][a-z0-9-]{0,63}$/.test(code) ? code : "error";
 }
 
+/** Why an outcome ended where it did (`JevCheckRecord.why`), from its own fields. */
+function checkWhy(o: PolicyOutcome): JevCheckRecord["why"] {
+  switch (o.verdict) {
+    case "none":
+      // Both deciders: under `fire` nothing fired; at or over it only the exemption stops it.
+      return o.evidence < DEFAULT_THRESHOLDS_V1.fire ? "not-detected" : "exempt";
+    case "overridden":
+      return o.intent === "op-requested" ? "op-requested" : o.intent === "task-step" ? "task-step" : "user-asked";
+    case "deny":
+      return o.escalatedByInjection ? "injection" : "fired";
+    default:
+      if (o.intent === "downgraded-task-step") return "downgraded";
+      return o.targetScanIncomplete ? "scan-incomplete" : "fired";
+  }
+}
+
+/** Who declared a check, as a registered-name prefix: `cloud/<id>@<v>` or `pack/<id>@<v>`. */
+function checkPolicy(o: PolicyOutcome): string | undefined {
+  const packId = o.origin?.packId;
+  if (!packId) return undefined;
+  const at = o.origin?.packVersion ? `@${o.origin.packVersion}` : "";
+  return packId.startsWith("cloud:") ? `cloud/${packId.slice("cloud:".length)}${at}` : `pack/${packId}${at}`;
+}
+
+/**
+ * Every asked check's answer, for the activity row (`jevChecks`): verdict,
+ * why, evidence, exempt and each probe's probability. `answers` holds the
+ * machine's own answers and Cloud's for its checks (`<check>.<probe>`).
+ */
+export function checkRecords(
+  outcomes: ReadonlyArray<PolicyOutcome>,
+  answers: Readonly<Record<string, number>>,
+  watched: ReadonlyArray<PolicyOutcome> = [],
+): JevCheckRecord[] {
+  const all = [...outcomes.map((o) => ({ o, watched: false })), ...watched.map((o) => ({ o, watched: true }))];
+  return all.slice(0, JEV_CHECKS_MAX).map(({ o, watched: isWatched }) => {
+    const probes: Record<string, number> = {};
+    const prefix = `${o.policy}.`;
+    for (const [id, p] of Object.entries(answers)) {
+      if (Object.keys(probes).length >= JEV_CHECK_PROBES_MAX) break;
+      if (!id.startsWith(prefix)) continue;
+      const part = id.slice(prefix.length);
+      // `exempt` has its own field; `user_asked` (v0) is a consent question, not a probe.
+      if (part === "exempt" || part === "user_asked" || !JEV_PROBE_ID_RE.test(part)) continue;
+      probes[part] = round2(p);
+    }
+    const policy = checkPolicy(o);
+    return {
+      check: o.policy,
+      ...(policy ? { policy } : {}),
+      verdict: o.verdict,
+      why: checkWhy(o),
+      p: round2(o.evidence),
+      ...(o.exempt !== null ? { exempt: round2(o.exempt) } : {}),
+      ...(Object.keys(probes).length > 0 ? { probes } : {}),
+      ...(isWatched ? { watched: true as const } : {}),
+    };
+  });
+}
+
 /**
  * @param cached - the answer came from T5's cache, not the provider: it is
  *   applied like any other, but its ~0 ms is not a latency (`latencyMs`
@@ -269,7 +353,8 @@ export function toReview(outcome: SemanticOutcome, cached = false): JevReview {
   // outcome is what clears a `both` policy's regex half. One it cannot vouch
   // for — or a Cloud-origin outcome with no Cloud reply at all — means the
   // picture is not one to clear anything on: the regex decides alone.
-  const cloudAsked = "cloud" in outcome ? new Set((outcome as CloudSemanticOutcome & { status: "ok" }).cloud.asked) : null;
+  const cloudSummary = "cloud" in outcome ? (outcome as CloudSemanticOutcome & { status: "ok" }).cloud : null;
+  const cloudAsked = cloudSummary ? new Set(cloudSummary.asked) : null;
   const unvouched = outcomes.some((o) => isCloudOutcome(o) && !(cloudAsked?.has(o.policy) ?? false));
   if (unvouched) return { kind: "fallback", reason: "malformed", latencyMs, model: null };
   // `null` when the injection probe was not in the request, which now means
@@ -280,9 +365,14 @@ export function toReview(outcome: SemanticOutcome, cached = false): JevReview {
   // not downgrade from a deny (see "A check that fired without consent keeps
   // the floor" in `combine.ts`).
   const warned = (o: (typeof outcomes)[number]) => o.verdict === "instruct" && o.intent !== "downgraded-task-step";
+  const cloudAnswers = cloudSummary?.answers ?? {};
+  const watched = cloudSummary?.observedOutcomes ?? [];
   return {
     kind: "answered",
     decision: outcome.verdict.decision,
+    // What each asked check concluded, for the activity row. `[]` when the
+    // request carried no check (globals only, or Cloud's short-circuit).
+    checks: sent ? checkRecords(outcomes, { ...outcome.answers, ...cloudAnswers }, watched) : [],
     reason: outcome.verdict.reason,
     policyName: jevPolicyName(outcome),
     ...(jevDecider(outcome)?.origin ? { origin: jevDecider(outcome)?.origin } : {}),
@@ -324,6 +414,18 @@ export function toReview(outcome: SemanticOutcome, cached = false): JevReview {
     requestCut: outcome.requestCut && sent,
     latencyMs,
     model,
+    // An `observe` Cloud assignment's checks: asked, recorded, never applied.
+    ...(sent && cloudSummary?.observedAsked?.length ? { observedAsked: cloudSummary.observedAsked } : {}),
+    ...(cloudSummary?.observed?.length
+      ? {
+          observedCloud: cloudSummary.observed.map((o) => ({
+            cloudPolicyId: o.cloudPolicyId,
+            cloudVersion: o.cloudVersion,
+            decision: o.decision,
+            reason: o.reason,
+          })),
+        }
+      : {}),
   };
 }
 
@@ -348,6 +450,7 @@ export function startJevReview(cfg: JevConfig, call: JevCallContext): TwoTierRev
       if (!settled) controller.abort();
     },
     authorityOf,
+    ...(call.cloud ? { cloud: true } : {}),
   });
 
   let route: ReturnType<typeof transportForConfig>;
@@ -380,7 +483,10 @@ export function startJevReview(cfg: JevConfig, call: JevCallContext): TwoTierRev
 
   let intent: ReturnType<IntentStore["readIntent"]>;
   try {
-    intent = intentReader.readIntent(call.sessionId);
+    intent = intentReader.readIntent(call.sessionId, undefined, {
+      cli: call.cli,
+      agent: call.agent !== undefined ? call.agent : (call.cloud?.agent ?? null),
+    });
   } catch {
     intent = { userSaid: [], agentLastMessage: null };
   }
@@ -429,6 +535,7 @@ export function startJevReview(cfg: JevConfig, call: JevCallContext): TwoTierRev
         ...options,
         machineId: cloud.machineId,
         agent: cloud.agent,
+        observedPolicies: cloud.observedPolicies ?? [],
         // Paused: no installed pack's check is sent, only the globals, and
         // Cloud's own checks are selected and decided on Cloud as ever.
         ...(call.localPaused ? { policies: [] } : {}),