failproofai 1.0.7-beta.1 → 1.0.7-beta.2

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "failproofai",
-  "version": "1.0.7-beta.1",
-  "description": "Observability and enforcement for AI agent harnesses. 39 built-in policies hooked into 12 of them — Claude Code, Codex, Cursor, Hermes, OpenClaw and more — blocking the tool call before it runs. Local dashboard included, no account needed.",
+  "version": "1.0.7-beta.2",
+  "description": "Observability and enforcement for AI agent harnesses. 40 built-in policies hooked into 12 of them — Claude Code, Codex, Cursor, Hermes, OpenClaw and more — blocking the tool call before it runs. Local dashboard included, no account needed.",
   "bin": {
     "failproofai": "./dist/cli.mjs",
     "failproofaid": "./bin/failproofaid-shim.mjs"
@@ -122,15 +122,15 @@
     "browserslist": "4.28.8"
   },
   "optionalDependencies": {
-    "@failproofai/failproofaid-linux-x64": "1.0.7-beta.1",
-    "@failproofai/failproofaid-linux-arm64": "1.0.7-beta.1",
-    "@failproofai/failproofaid-darwin-x64": "1.0.7-beta.1",
-    "@failproofai/failproofaid-darwin-arm64": "1.0.7-beta.1"
+    "@failproofai/failproofaid-linux-x64": "1.0.7-beta.2",
+    "@failproofai/failproofaid-linux-arm64": "1.0.7-beta.2",
+    "@failproofai/failproofaid-darwin-x64": "1.0.7-beta.2",
+    "@failproofai/failproofaid-darwin-arm64": "1.0.7-beta.2"
   },
   "failproofaidBinaries": {
-    "linux-x64": "8fc6dcf94834a332791a76b24c9906ef63371ee91b5a8dc2c764db202d5608a7",
-    "linux-arm64": "ce48b73245adc6a0d7cef2ba74e37693bd00d7cff75a8d27b6bdbd8ba0251613",
-    "darwin-x64": "27d8f9d740d409741d43e75850eea5f956ac6b578628cbf2f364d711f89621a6",
-    "darwin-arm64": "0ee02f87dd6e3f0761b18fd5d60ebbbfd5328f3e99bc3d2c909d41d540ee68a0"
+    "linux-x64": "5362ab6a4cfb23d1eee598aac67aedd9e43351e62724ee1c6b40c4fc8021c08f",
+    "linux-arm64": "f14a2548b41e14ad32b7fdd03a27ffe7160da1046e422e1f651099371b0d27e5",
+    "darwin-x64": "14189cade04f17cf5278bd8061a5ec0c2a2381aa21944ae0d05e8c35b98c2816",
+    "darwin-arm64": "4ba9f5c321894d953407efa3404f0deec07dccfd7db7bc2511bb35226816b583"
   }
 }

package/scripts/build-policy-pack.mjs

@@ -114,6 +114,20 @@ for (const policy of BUILTIN_POLICIES) {
     defaultEnabled: policy.defaultEnabled === true,
     match: policy.match,
     fn: policy.fn,
+    // The parameter schema. It has to be registered here as well as written
+    // into the manifest this script builds, because there are TWO manifest
+    // producers for this pack and they have to agree: this script builds one
+    // from POLICY_CATALOG, and the publish command rebuilds one by importing
+    // the entry and reading back what it registered. A field the entry does
+    // not register is a field the second producer cannot know about.
+    //
+    // params is the one that fails silently STRICTER. Registration reads a
+    // pack policy's schema from the manifest, so an absent schema means the
+    // policy sees empty params: block-sudo's allowPatterns, and block-rm-rf's
+    // and block-read-outside-cwd's allowPaths, stop applying -- taking the
+    // user's own configured values with them. No backticks in this comment:
+    // see the note above entrySource.
+    ...(policy.params !== undefined ? { params: policy.params } : {}),
     // Whether Jev may clear it; see the note on authority at the top.
     ...(policy.authority !== undefined ? { authority: policy.authority } : {}),
     ...(policy.reviewedBy !== undefined ? { reviewedBy: policy.reviewedBy } : {}),

package/src/audit/features.ts

@@ -69,13 +69,13 @@ export const ARCHITECT_CAUTION_SIGNALS = new Set(["reread-after-edit", "redundan
 
 /**
  * Mapping from policy/detector short-name → which archetype its hits feed,
- * and how heavily (intensity within the cluster). Every one of the 39 builtin
+ * and how heavily (intensity within the cluster). Every one of the 40 builtin
  * policies and 8 audit-only detectors maps exactly once — no overlaps, full
  * coverage. Weights express *severity within* a persona; cross-persona
  * fairness is handled later by lift normalisation, not by these numbers.
  */
 export const SIGNAL_MAP: Record<string, { archetype: ArchetypeKey; weight: number }> = {
-  // ── cowboy ── destructive / forceful / bypasses guardrails (20) ───────────
+  // ── cowboy ── destructive / forceful / bypasses guardrails (21) ───────────
   "block-rm-rf":               { archetype: "cowboy", weight: 2.0 },
   "block-failproofai-commands":{ archetype: "cowboy", weight: 2.0 },
   "block-sudo":                { archetype: "cowboy", weight: 1.5 },
@@ -88,6 +88,7 @@ export const SIGNAL_MAP: Record<string, { archetype: ArchetypeKey; weight: numbe
   "git-commit-no-verify":      { archetype: "cowboy", weight: 1.5 },
   "warn-git-amend":            { archetype: "cowboy", weight: 0.8 },
   "warn-git-stash-drop":       { archetype: "cowboy", weight: 1.0 },
+  "warn-git-clean":            { archetype: "cowboy", weight: 1.0 },
   "warn-all-files-staged":     { archetype: "cowboy", weight: 0.6 },
   "block-kubectl":             { archetype: "cowboy", weight: 1.5 },
   "block-terraform":           { archetype: "cowboy", weight: 1.5 },

package/src/hooks/builtin-policies.ts

@@ -623,8 +623,15 @@ const GIT_DESTRUCTIVE_SUBCOMMANDS = new Set([
  */
 const GIT_FLAGS_WITH_OPERANDS = new Set(["-C", "-c", "--git-dir", "--work-tree", "--namespace", "--exec-path"]);
 
-/** The `git` subcommand, with git's own global options walked off first. */
-function gitSubcommand(args: string[]): string | undefined {
+/**
+ * Where the `git` subcommand sits in `args`, with git's own global options
+ * walked off first, or `-1` when there is no subcommand at all.
+ *
+ * The index rather than the value, because a caller that wants to read the
+ * SUBCOMMAND's flags (`warnGitClean`) needs to know where they start, and
+ * `args.indexOf("clean")` would land on a `-C clean` operand instead.
+ */
+function gitSubcommandIndex(args: string[]): number {
   for (let i = 0; i < args.length; i++) {
     const arg = args[i];
     if (GIT_FLAGS_WITH_OPERANDS.has(arg)) {
@@ -632,9 +639,15 @@ function gitSubcommand(args: string[]): string | undefined {
       continue;
     }
     if (arg.startsWith("-")) continue;
-    return arg;
+    return i;
   }
-  return undefined;
+  return -1;
+}
+
+/** The `git` subcommand, with git's own global options walked off first. */
+function gitSubcommand(args: string[]): string | undefined {
+  const i = gitSubcommandIndex(args);
+  return i < 0 ? undefined : args[i];
 }
 
 /**
@@ -1379,6 +1392,48 @@ const GIT_AMEND_RE = /\bgit\s+commit\b.*--amend\b/;
 // warnGitStashDrop
 const GIT_STASH_DROP_RE = /\bgit\s+stash\s+(?:drop|clear)\b/;
 
+// warnGitClean
+/**
+ * `git`, however the command line spells it. Same shape as {@link RM_CMD_RE}:
+ * an absolute path to the binary does not change what it does.
+ */
+const GIT_CMD_RE = /^(?:\/\S*\/)?git$/;
+
+/** A short-flag cluster: `-f`, `-fdx`, `-xdf`. */
+const SHORT_FLAG_CLUSTER_RE = /^-[A-Za-z]+$/;
+
+/**
+ * `clean.requireForce=false`, the config that makes `git clean` delete with no
+ * `-f` at all — and settable per invocation as `git -c
+ * clean.requireForce=false clean -xd`. Reading the subcommand's flags alone
+ * would call that "no force, no warning" on the one spelling that needs none.
+ */
+const GIT_CLEAN_FORCE_WAIVED_RE = /^clean\.requireforce=(?:false|0|no|off)$/i;
+
+/**
+ * The default `destructiveFlags`, and why the condition is these three letters
+ * rather than "any `git clean`".
+ *
+ * `git clean` deletes nothing without `-f` / `--force` (or the config above),
+ * and `-n` / `--dry-run` only prints — so force is the precondition and
+ * dry-run is the exemption. What force ALONE removes is untracked files in the
+ * current directory: the narrowest spelling, and the one people mean when they
+ * tidy up. These are the letters that widen the blast radius past that:
+ *
+ * - `-x` also removes IGNORED files — `.env`, local config, editor state,
+ *   scratch work. That is the data that genuinely cannot be rebuilt by running
+ *   a command, and it is what makes `git clean -fdx` the severe spelling.
+ * - `-X` removes ONLY ignored files: the same loss, tracked tree untouched.
+ * - `-d` also removes untracked DIRECTORIES — whole new subtrees git has never
+ *   had a copy of.
+ *
+ * A bare `git clean -f` is deliberately absent. It has the smallest radius and
+ * by far the most traffic, and a guard that fires on the ordinary spelling is
+ * one people switch off — which would cost them the `-fdx` warning too. Add
+ * `"f"` to `destructiveFlags` to opt into it.
+ */
+const GIT_CLEAN_DESTRUCTIVE_FLAGS = ["d", "x", "X"];
+
 // warnAllFilesStaged
 const GIT_ADD_ALL_RE = /\bgit\s+add\s+(?:-A\b|--all\b|\.(?:\s|$|;|&&|\|\|))/;
 
@@ -2528,6 +2583,101 @@ function warnGitStashDrop(ctx: PolicyContext): PolicyResult {
   return allow();
 }
 
+/** What one `git clean` argument list asks for. */
+interface GitCleanFlags {
+  force: boolean;
+  dryRun: boolean;
+  /** Short-flag letters, with `--force` counted as `f` so widening works either way. */
+  letters: Set<string>;
+}
+
+/**
+ * Read `git clean`'s own options: clusters (`-fdx`) and the two long forms
+ * that matter (`--force`, `--dry-run`).
+ *
+ * Everything after `--` is a pathspec, not a flag — `git clean -n -- -fdx`
+ * asks about a file literally called `-fdx` and deletes nothing.
+ */
+function readGitCleanFlags(args: string[]): GitCleanFlags {
+  const letters = new Set<string>();
+  let force = false;
+  let dryRun = false;
+  let sawEndOfOptions = false;
+  for (const token of args) {
+    if (token === "--") {
+      sawEndOfOptions = true;
+      continue;
+    }
+    if (sawEndOfOptions) continue;
+    if (token === "--force") {
+      force = true;
+      continue;
+    }
+    if (token === "--dry-run") {
+      dryRun = true;
+      continue;
+    }
+    if (token.startsWith("--")) continue;
+    if (!SHORT_FLAG_CLUSTER_RE.test(token)) continue;
+    for (const letter of token.slice(1)) {
+      if (letter === "f") force = true;
+      if (letter === "n") dryRun = true;
+      letters.add(letter);
+    }
+  }
+  if (force) letters.add("f");
+  return { force, dryRun, letters };
+}
+
+/** True when git's own `-c key=value` options waive `clean.requireForce`. */
+function gitCleanForceWaived(globalOptions: string[]): boolean {
+  for (let i = 0; i < globalOptions.length; i++) {
+    const token = globalOptions[i];
+    const value =
+      token === "-c" ? globalOptions[i + 1] : token.startsWith("-c") ? token.slice(2) : undefined;
+    if (value !== undefined && GIT_CLEAN_FORCE_WAIVED_RE.test(value)) return true;
+  }
+  return false;
+}
+
+/**
+ * The gap this closes: `git clean -fdx` was caught by NEITHER tier — no regex
+ * builtin matched the string at all, and the semantic check that covers
+ * unrecoverable deletion cannot fire on it. See the note on the catalog entry
+ * for the measurement and for why this policy is `hard`.
+ */
+function warnGitClean(ctx: PolicyContext): PolicyResult {
+  if (ctx.toolName !== "Bash") return allow();
+  const destructiveFlags = ((ctx.params?.destructiveFlags ?? GIT_CLEAN_DESTRUCTIVE_FLAGS) as string[]);
+  if (destructiveFlags.length === 0) return allow();
+
+  for (const segment of shellSegments(getCommand(ctx))) {
+    const tokens = parseArgvTokens(segment);
+    // `findIndex`, not `tokens[0]`, so an env prefix (`GIT_DIR=x git clean …`)
+    // and an absolute binary path both still resolve to the git invocation.
+    const gitIdx = tokens.findIndex((t) => GIT_CMD_RE.test(t));
+    if (gitIdx < 0) continue;
+    const args = tokens.slice(gitIdx + 1);
+    const subIdx = gitSubcommandIndex(args);
+    if (subIdx < 0 || args[subIdx] !== "clean") continue;
+
+    const flags = readGitCleanFlags(args.slice(subIdx + 1));
+    // `-n` / `--dry-run` prints what would go and removes nothing, whatever
+    // else is on the line — the safe inspection form, never a warning.
+    if (flags.dryRun) continue;
+    if (!flags.force && !gitCleanForceWaived(args.slice(0, subIdx))) continue;
+    if (!destructiveFlags.some((f) => flags.letters.has(f))) continue;
+
+    return instruct(
+      "STOP: This command deletes untracked files from the working tree (git clean). Git has no copy of " +
+        "untracked or ignored files, so nothing it removes can be recovered: -d takes whole untracked " +
+        "directories, and -x / -X also take .gitignore'd files such as .env, local config and scratch work. " +
+        "Re-run it with --dry-run and confirm the exact paths with the user before executing.",
+    );
+  }
+  return allow();
+}
+
 function warnAllFilesStaged(ctx: PolicyContext): PolicyResult {
   if (ctx.toolName !== "Bash") return allow();
   const cmd = getCommand(ctx);
@@ -3090,7 +3240,7 @@ function requireCiGreenBeforeStop(ctx: PolicyContext): PolicyResult {
  * Each value is the identical hoisted function object, never a wrapper. Two
  * things depend on that and neither fails loudly: `audit/cache.ts` hashes
  * `fn.toString()` into the audit cache's `engineVersion`, so wrapping every
- * entry would collapse 39 distinct hashes into one and freeze the key — stale
+ * entry would collapse 40 distinct hashes into one and freeze the key — stale
  * audit results would then be served for the full 30-day TTL with no symptom;
  * and `gitBranchCache` is module-scoped, so a per-call factory would silently
  * reset it on every hook event.
@@ -3121,6 +3271,7 @@ const POLICY_IMPLEMENTATIONS: Record<string, PolicyFunction> = {
   "block-work-on-main": blockWorkOnMain,
   "warn-git-amend": warnGitAmend,
   "warn-git-stash-drop": warnGitStashDrop,
+  "warn-git-clean": warnGitClean,
   "warn-all-files-staged": warnAllFilesStaged,
   "warn-destructive-sql": warnDestructiveSql,
   "warn-schema-alteration": warnSchemaAlteration,

package/src/hooks/jev-cli.ts

@@ -345,6 +345,29 @@ function providerForUrl(url: string): JevProviderKind {
   }
 }
 
+/**
+ * The account id a Cloudflare URL already carries, or null.
+ *
+ * Cloudflare's run endpoint IS per-account — `…/client/v4/accounts/<id>/ai/run`
+ * — so the id is in the canonical URL, and asking for it again as a flag asks
+ * for something the person has already typed. The first real attempt to
+ * configure Cloudflare pasted exactly that URL and was refused with "pass the
+ * account id as well", with the id visible in the string being rejected.
+ *
+ * Read from the path only, never from a query or fragment, and only on a host
+ * this build already recognises as Cloudflare's, so nothing else can inject one.
+ */
+export function accountIdFromUrl(url: string): string | null {
+  try {
+    const parsed = new URL(url);
+    if (PROVIDER_BY_HOST[parsed.hostname.toLowerCase()] !== "cloudflare") return null;
+    const m = /\/accounts\/([0-9a-f]{32})(?:\/|$)/i.exec(parsed.pathname);
+    return m ? m[1].toLowerCase() : null;
+  } catch {
+    return null;
+  }
+}
+
 /** Whether a validated URL is exactly where this provider's requests already go. */
 function isProviderDefaultUrl(kind: JevProviderKind, url: string): boolean {
   const base = JEV_PROVIDER_DEFAULTS[kind].baseUrl;
@@ -468,6 +491,34 @@ async function setup(argv: string[], deps: JevCliDeps, opts: RenderOpts): Promis
     }
     const kind = explicit ?? urlProvider.kind;
     if (explicit === null) values.set("--provider", kind);
+    // Cloudflare's endpoint IS per-account, so the run URL copied out of the
+    // dashboard already names the account. Read it from there rather than
+    // demanding a value that is sitting in the string being read — the first
+    // person to configure Cloudflare pasted exactly that URL and was told to
+    // "pass the account id as well", with the id visible in the refusal.
+    //
+    // Set into `values` here, while the URL is still in scope, because the
+    // block below deletes `--url` once it has moved the address to
+    // `--base-url`. Everything downstream then treats it as a flag that was
+    // given, including the 32-hex validation.
+    if (kind === "cloudflare") {
+      const fromUrl = accountIdFromUrl(normalized);
+      const given = values.get("--account-id");
+      if (fromUrl !== null && given === undefined) {
+        values.set("--account-id", fromUrl);
+      } else if (fromUrl !== null && given !== undefined && given.toLowerCase() !== fromUrl) {
+        // Preferring either one silently would send every request to an account
+        // the person did not name on the line they are looking at.
+        return fail([
+          "Not saved: --account-id and the account id in --url are different.",
+          `  --url names ${fromUrl}`,
+          `  --account-id names ${given.toLowerCase()}`,
+          "Drop one of them.",
+          "",
+          "Nothing was written.",
+        ]);
+      }
+    }
     // The provider's own API is where its key belongs anyway, so a URL naming
     // it clears the override instead of writing the same address into the file
     // (`custom` has no API of its own — its URL is the whole address).
@@ -546,9 +597,14 @@ async function setup(argv: string[], deps: JevCliDeps, opts: RenderOpts): Promis
   // host with another provider asked for is settled above, and nothing here
   // demands an id the file would not keep.
   if (kind === "cloudflare" && urlProvider?.kind === "cloudflare" && typeof next.accountId !== "string") {
+    // Reached only when the URL did not carry one either — a bare
+    // `/client/v4`, say. The URL form is named as well as the flag, because it
+    // is the address the dashboard hands out.
     return fail([
       `Not saved: ${urlProvider.host} is Cloudflare Workers AI, whose endpoint is per-account.`,
-      "Pass the account id as well: --account-id <32 hex characters>.",
+      "Pass the account id as well: --account-id <32 hex characters>,",
+      "or give the full run URL, which already contains it:",
+      "  https://api.cloudflare.com/client/v4/accounts/<id>/ai/run",
       "",
       "Nothing was written.",
     ]);

package/src/hooks/manager.ts

@@ -1108,7 +1108,7 @@ export async function listHooks(cwd?: string): Promise<void> {
   // `packCount` counts ENABLED policies, so a pack installed with everything
   // switched off reaches zero the same way an empty machine does — and the
   // advice for the two could not be more different. Telling somebody who has
-  // just unticked all 38 to `policies add FailproofAI/policies` sends them to
+  // just unticked all 39 to `policies add FailproofAI/policies` sends them to
   // install what they already have, and doing it would change nothing: the
   // selection is what is empty, not the shelf.
   const packsInstalled = (() => {

package/src/hooks/pack-cli.ts

@@ -44,9 +44,9 @@ import {
 import type { PolicyEffect } from "./cloud-managed-policies";
 import { loadCustomHooks } from "./custom-hooks-loader";
 import { getSemanticRegistrations } from "./custom-hooks-registry";
-import { authorityFieldsOf, authorityProblem } from "./policy-authority";
-import type { SemanticPolicyDeclaration } from "./policy-types";
-import type { MultiChoice, TTYIn, TTYOut } from "./tui";
+import { authorityFieldsOf, authorityProblem, resolvePolicyAuthority } from "./policy-authority";
+import type { PolicyCatalogEntry, SemanticPolicyDeclaration } from "./policy-types";
+import type { MultiChoice, RenderOpts, TTYIn, TTYOut } from "./tui";
 import {
   chip,
   emptyState,
@@ -469,7 +469,7 @@ async function build(rest: string[]): Promise<PackCliResult> {
     // out was not cosmetic: `registerPolicy` takes a pack policy's schema from the
     // MANIFEST by name, so a pack published without it evaluates every one of its
     // policies with `ctx.params = {}` — which discards the user's own configured
-    // values too, not just the defaults. Of the 38 builtins, 19 carry a schema:
+    // values too, not just the defaults. Of the 39 builtins, 20 carry a schema:
     // `prefer-package-manager` would have been inert, and `block-sudo`'s
     // `allowPatterns`, `block-rm-rf`'s and `block-read-outside-cwd`'s `allowPaths`
     // would all have stopped working — every one of them failing silently
@@ -2693,7 +2693,7 @@ async function add(rest: string[]): Promise<PackCliResult> {
     ];
     const skipped = result.available.filter((n) => !result.enabled.includes(n));
 
-    // Say WHY this set is on. Without it, "10 of 38 enabled" reads like
+    // Say WHY this set is on. Without it, "10 of 39 enabled" reads like
     // something went wrong rather than like the pack's own recommendation.
     const why = {
       defaults: "the pack's defaults",
@@ -2987,6 +2987,147 @@ function relativeAge(iso: string): string {
   return `${value} ${label}${value === 1 ? "" : "s"} ago`;
 }
 
+/**
+ * Which of a pack's OWN regex policies each of its Jev checks can clear, keyed
+ * by check name and empty for a check nothing names.
+ *
+ * INVERTED out of the same manifest's `reviewedBy` rather than declared beside
+ * the checks. A semantic entry says nothing about the policies that name it, so
+ * the only other way to show this column is a second list kept by hand — which
+ * is wrong the first time a publisher adds a reviewer to one policy, and wrong
+ * in the direction that overstates what Jev may clear.
+ *
+ * Judged with `resolvePolicyAuthority` against the pack's OWN check names,
+ * because that is the rule the installing machine applies: a pack declaring
+ * semantic entries replaces the compiled-in set (`effectiveReviewerNames`), so
+ * its `reviewedBy` may name only its own checks, and a declaration that names
+ * anything else — or one sitting under `authority: "hard"`, which a manifest may
+ * carry because the two fields are parsed independently — registers HARD. A
+ * policy in either state can never be cleared, so naming it under a check would
+ * promise a clear that cannot happen.
+ */
+function reviewersByCheck(
+  policies: ReadonlyArray<PolicyCatalogEntry>,
+  semantic: ReadonlyArray<SemanticManifestEntry>,
+): Map<string, string[]> {
+  const ownChecks = new Set(semantic.map((s) => s.name));
+  const byCheck = new Map<string, string[]>(semantic.map((s) => [s.name, []]));
+  for (const policy of policies) {
+    const { authority, reviewedBy } = resolvePolicyAuthority(policy, ownChecks);
+    if (authority !== "reviewable") continue;
+    for (const check of reviewedBy ?? []) byCheck.get(check)?.push(policy.name);
+  }
+  return byCheck;
+}
+
+/** Reviewers named in full. Past this the cell names two and counts the rest. */
+const REVIEWERS_LISTED = 3;
+
+/**
+ * A check's reviewers as one cell.
+ *
+ * The question a reader brings to this column is "can this check clear anything
+ * of mine", which two names and a count answer as well as ten do — and ten
+ * names in a cell push the column past the terminal, where `table` cuts one of
+ * them mid-word and the row stops being readable at all.
+ */
+function reviewersCell(names: ReadonlyArray<string>): string {
+  if (names.length <= REVIEWERS_LISTED) return names.join(", ");
+  return `${names.slice(0, 2).join(", ")}, +${names.length - 2}`;
+}
+
+/**
+ * Why a check that no policy names is in the pack at all — and the two answers
+ * are different facts, so the row has to tell them apart.
+ *
+ * A `deny` check with no reviewer is a concern the pack's regex half does not
+ * cover: it can only ever ADD a deny, never clear one, and that is a gap in the
+ * regex tier rather than a mistake in the manifest. An `instruct` check can
+ * never answer deny, so every conjunction naming it has one reachable outcome —
+ * a clear — which is why nothing names it and why nothing should (the
+ * `block-work-on-main` entry in CHANGELOG 1.0.7-beta.1 is that bug, shipped).
+ */
+function unreviewedCell(mode: SemanticManifestEntry["mode"], policies: number): string {
+  if (mode === "instruct") return "instruct-only — it can never deny";
+  // "the 38" borrows the count from the heading above, where it has just been
+  // read. The other two spellings exist because that sentence has no grammatical
+  // form at one or zero — and a pack of Jev checks alone, with no regex half at
+  // all, is a legitimate thing to publish.
+  if (policies === 0) return "this pack has no policies to clear";
+  if (policies === 1) return "the one policy here does not cover this";
+  return `nothing in the ${policies} covers this`;
+}
+
+/**
+ * A pack's Jev checks as a section of rows — the shape the category sections
+ * use, deliberately NOT their columns.
+ *
+ * It replaces a prose paragraph that listed sixteen names comma-separated above
+ * a screen where everything else was a scannable row. The rows are not policy
+ * rows and must not read as ones: there is no on/off chip, because nothing
+ * toggles a check, `--policy` cannot name one, and none of them appears in
+ * `failproofai policies`. What the columns carry instead is the pair of facts
+ * that decide what a check does on a real machine — its mode, and which of this
+ * pack's own policies it can clear.
+ *
+ * Null when the pack declares none, so a pack with no semantic half prints no
+ * section rather than an empty one.
+ */
+export function jevChecksSection(
+  pack: {
+    policies: ReadonlyArray<PolicyCatalogEntry>;
+    semantic: ReadonlyArray<SemanticManifestEntry>;
+  },
+  opts?: RenderOpts,
+): string[] | null {
+  if (pack.semantic.length === 0) return null;
+  const reviewers = reviewersByCheck(pack.policies, pack.semantic);
+  const rows = pack.semantic.map((check) => {
+    const named = reviewers.get(check.name) ?? [];
+    // `reviews` and `—` lead the same cell rather than sitting in a column of
+    // their own. A fourth column would pad every `—` out to the width of
+    // `reviews`, which costs nine characters of the only column allowed to
+    // shrink — enough to ellipsize the reason on an 80-column terminal, where
+    // this way everything fits whole.
+    return [
+      check.mode,
+      check.name,
+      named.length > 0
+        ? `reviews  ${reviewersCell(named)}`
+        : `—  ${unreviewedCell(check.mode, pack.policies.length)}`,
+    ];
+  });
+  return [
+    // The count is on the heading rather than in a row, the way every other
+    // section on this screen carries its own total.
+    ...rule(
+      `Jev checks — ${pack.semantic.length} · not selectable · only where Jev is configured`,
+      opts,
+    ),
+    // The reviewers column is the only one allowed to shrink: a mode or a check
+    // name cut in half is a fact nobody can act on, while a cut reviewer list is
+    // one that was already abbreviated.
+    ...table({ head: ["", "", ""], rows, protect: [0, 1] }, opts),
+    "",
+    ...note(
+      "Nothing toggles them: `--policy` cannot name one, `failproofai policies` never lists them, " +
+        "and a pack's checks replace the ones this build ships with.",
+      opts,
+    ),
+    ...note(
+      // A pack of Jev checks alone has no regex half for the column to be about,
+      // so the sentence says what IS true of it rather than "its own 0 policies".
+      pack.policies.length === 0
+        ? "This pack ships no regex policies, so none of these checks clears anything here: a deny " +
+            "check can only ADD a deny, and an instruct check only ever warns."
+        : `\`reviews\` is which of this pack's own ${pack.policies.length} policies each check can clear. ` +
+            "A deny check that reviews nothing can only ever ADD a deny; an instruct check never answers " +
+            "deny, so nothing pairs with one.",
+      opts,
+    ),
+  ];
+}
+
 async function listRemote(source: string): Promise<PackCliResult> {
   const opts = optsFor(process.stdout);
   let preview;
@@ -3029,22 +3170,13 @@ async function listRemote(source: string): Promise<PackCliResult> {
           (preview.effect === "observe" ? " This pack OBSERVES — it records and blocks nothing." : ""),
         opts,
       ),
-      // The half that is not in the table below, said in words. It is not
-      // selectable, so it has no rows; and it REPLACES this build's own question
-      // set rather than adding to it, which is the part worth knowing before
-      // installing rather than after.
-      preview.semantic.length > 0
-        ? note(
-            `It also carries ${semanticPhrase(preview.semantic.length)} — ${preview.semantic
-              .map((s) => s.name)
-              .join(", ")}. They are not selectable, they apply only where you configured Jev, and they ` +
-              "replace the checks this build ships with.",
-            opts,
-          )
-        : null,
       preview.minCliVersion ? note(`Requires failproofai ${preview.minCliVersion} or newer.`, opts) : null,
       preview.resolvedFromLatest ? note(`Newest release: ${preview.source}`, opts) : null,
       table({ head: ["", "", ""], rows }, opts),
+      // The half the table above cannot hold: its own section, under the
+      // policies rather than above them, because a check is read against the
+      // policies it can clear and those are the rows just passed.
+      jevChecksSection(preview, opts),
       nextStep(`failproofai policies add ${source}`, "Install the defaults with:", opts),
       note("Or take part of it: --policy <a,b>, --category <x,y>, --all", opts),
     ),

package/src/hooks/pack-store.ts

@@ -814,7 +814,7 @@ export function slugifyCategory(category: string): string {
  *
  * The default is the pack's OWN `defaultEnabled` set, not everything. A pack
  * carries an opinion about which of its policies are safe to switch on
- * unattended — for the builtins that is 10 of 38 — and installing the whole
+ * unattended — for the builtins that is 10 of 39 — and installing the whole
  * thing overrode that opinion with one nobody held. `block-kubectl`,
  * `block-terraform` and `require-ci-green-before-stop` are off by default in the
  * npm package precisely because they interrupt legitimate work.