failproofai 1.0.7-beta.1 → 1.0.7

package/src/hooks/handler.ts

@@ -24,26 +24,18 @@ import {
   OPENCLAW_EVENT_MAP,
   ANTIGRAVITY_EVENT_MAP,
 } from "./types";
-import { existsSync } from "node:fs";
 import { canonicalizeToolName, canonicalizeToolInput } from "./tool-name-canonicalize";
 import { normalizeCliPayload } from "./normalize-cli-payload";
 import type { PolicyFunction, PolicyResult, HooksConfig } from "./policy-types";
 import { readMergedHooksConfig } from "./hooks-config";
 import { registerBuiltinPolicies } from "./builtin-policies";
 import { evaluatePolicies } from "./policy-evaluator";
-// Types only: the semantic (Jev) modules are loaded with a dynamic import, and
-// only once a Jev config exists, so an unconfigured machine never loads them.
-import type { TwoTierReview } from "./semantic/combine";
-import type { JevActivityFields } from "./semantic/combine";
-import type { JevConfig } from "./semantic/jev-config";
 import { clearPolicies, registerPolicy, getPoliciesForEvent } from "./policy-registry";
 import { loadAllCustomHooks } from "./custom-hooks-loader";
-import { authorityDeclarationFor, resolvePolicyAuthority, warnAuthority } from "./policy-authority";
 import type { CustomHook } from "./policy-types";
 import { persistHookActivity } from "./hook-activity-store";
 import { deliveryHealth, deliveryHealthLine } from "./delivery-health";
 import { trackHookEvent, flushHookTelemetry } from "./hook-telemetry";
-import * as hookTelemetry from "./hook-telemetry";
 import { resolveCwd } from "./resolve-cwd";
 import { resolvePermissionMode } from "./resolve-permission-mode";
 import { resolveTranscriptPath } from "./resolve-transcript-path";
@@ -54,7 +46,6 @@ import { readActiveCloudManagedPolicies, type CloudManagedPolicyArtifact } from
 import { hasInstalledPacks, readInstalledPacks, type PackError, type ResolvedPack } from "./pack-manifest";
 import { missingGuards, packFailureReason, combinedGuardMatch, guardsCover } from "./pack-failclosed";
 import { readActivePause, type ActivePause } from "./session-pause";
-import { jevConfigFile } from "./fp-home";
 import { layoutWarningForHook } from "./fp-reset";
 
 /**
@@ -162,16 +153,6 @@ export interface EvaluateHookEventOptions {
    * written for.
    */
   fallbackCwd?: string;
-  /**
-   * The warm worker's hook into its request queue. Called at most once, and
-   * only on the two-tier path, at the point this evaluation stops reading the
-   * process-global policy registry and starts waiting on Jev's network answer
-   * — so the next queued hook can run instead of every hook on the machine
-   * queueing behind that round trip. After it is called nothing in this
-   * evaluation reads the registry again. The one-shot path has no queue and
-   * leaves it unset.
-   */
-  releaseRegistry?: () => void;
 }
 
 /**
@@ -205,211 +186,6 @@ async function runObserved(
   }
 }
 
-// ── Two-tier (Jev) opt-in ────────────────────────────────────────────────────
-//
-// Jev reviews a call only when ALL of these hold, and the regex engine runs
-// alone — exactly as it did before two tiers existed — otherwise:
-//
-// - a valid BYOK config exists (`~/.failproofai/jev.json`, global only);
-// - `FAILPROOFAI_EVALUATOR` is not `legacy` (see "Turning Jev off" below);
-// - this is not the fail-closed `forceDecision` path and no session pause is
-//   active — a pause suspends local policy, and Jev must not become a way to
-//   evaluate what the pause switched off;
-// - the event is a gate (`PreToolUse` / `PermissionRequest`) for a named tool
-//   that the AGENT requested (see `isHumanAuthoredGate`).
-//
-// There is no cloud-deployment exclusion: cloud policies default to `hard`, so
-// Jev can only make a centrally managed machine stricter, never weaker.
-//
-// Turning Jev off. The switch that works everywhere is the config file itself:
-// it is read on every event, here, in whichever process evaluates — the
-// daemon's warm worker included — so `failproofai jev remove` (or a `mode:
-// "shadow"` config, which keeps enforcing the regex result) applies from the
-// next tool call, with no restart. `FAILPROOFAI_EVALUATOR=legacy` is the dev
-// escape hatch, read from the EVALUATING process's environment: it covers a
-// one-shot hook (no daemon) and a worker whose own environment sets it, but
-// not a variable exported in a shell on a daemon machine — the daemon
-// forwards a hook's event, cli, stdin and cwd to the worker, never the hook
-// process's environment. `failproofai jev status` says so when it sees the
-// variable. A per-session switch for daemon machines would be a new field in
-// the daemon protocol; there is none today.
-
-/** The two gate events Jev reviews. Everything else is regex-only. */
-const JEV_GATE_EVENTS: ReadonlySet<string> = new Set(["PreToolUse", "PermissionRequest"]);
-
-/**
- * A gate event that carries a command the HUMAN typed, not one the agent
- * requested: Pi's `user_bash` (`!cmd` at Pi's prompt) canonicalizes to
- * `PreToolUse` like an agent's `tool_call`. Jev judges an agent's request
- * against what the human asked for, and says so to the model ("A coding agent
- * has REQUESTED the tool call"); the human's own command is the human asking,
- * and never appears in `user_said`, so Jev would judge it as an unrequested
- * agent action and could block the human's own command. The regex policies
- * still run on it exactly as they always have.
- */
-function isHumanAuthoredGate(rawEventType: string | undefined, cli: IntegrationType): boolean {
-  return cli === "pi" && rawEventType === "user_bash";
-}
-
-function jevForcedOff(opts: EvaluateHookEventOptions | undefined): boolean {
-  return process.env.FAILPROOFAI_EVALUATOR === "legacy" || !!opts?.forceDecision;
-}
-
-/**
- * The BYOK config (with the build's default mode, D2), or null (Jev off). A
- * config that cannot be read is off, never a failure. Logged at info, like
- * every configured-but-broken Jev path: warn-level lines reach the hook's
- * stderr, which is the deny text itself on some CLIs (Factory's exit 2).
- * `failproofai jev status` is where a broken config is made visible.
- *
- * The file is checked for BEFORE the import, and that order is the point. With
- * no `jev.json` the answer is null however the module would have read it — so
- * the stat decides it, and a machine that never configured Jev never evaluates
- * a line of the semantic modules to be told what their absence already says.
- * The same stat-rather-than-load trade `warnAuthority` makes, for the same
- * reason. It short-circuits nothing but a null `loadJevConfig` would have
- * returned itself: that function reads this path, and an absent file, an
- * unreadable directory above it and a path that is not a file are all null
- * there too.
- */
-async function readJevConfig(): Promise<{ config: JevConfig; defaultMode: TwoTierReview["mode"] } | null> {
-  try {
-    if (!existsSync(jevConfigFile())) return null;
-    const { loadJevConfig, DEFAULT_JEV_MODE } = await import("./semantic/jev-config");
-    const config = loadJevConfig();
-    return config ? { config, defaultMode: DEFAULT_JEV_MODE } : null;
-  } catch (err) {
-    hookLogInfo(
-      `Jev config could not be read (${err instanceof Error ? err.message : String(err)}); the regex engine decides alone`,
-    );
-    return null;
-  }
-}
-
-/**
- * Start Jev's review of this call — before the regex policies run, so the two
- * proceed in parallel — or return null for the regex-only path.
- */
-async function startTwoTier(
-  canonicalEventType: string,
-  parsed: Record<string, unknown>,
-  session: SessionMetadata,
-  cli: IntegrationType,
-  opts: EvaluateHookEventOptions | undefined,
-  activePause: ActivePause | null,
-): Promise<TwoTierReview | null> {
-  if (!JEV_GATE_EVENTS.has(canonicalEventType)) return null;
-  if (isHumanAuthoredGate(session.rawHookEventName, cli)) return null;
-  if (typeof parsed.tool_name !== "string" || parsed.tool_name.length === 0) return null;
-  if (jevForcedOff(opts) || activePause) return null;
-  const loaded = await readJevConfig();
-  if (!loaded) return null;
-  const cfg = loaded.config;
-  try {
-    const { startJevReview } = await import("./semantic/jev-review");
-    return startJevReview(cfg, {
-      eventType: canonicalEventType,
-      toolName: parsed.tool_name,
-      toolInput: parsed.tool_input,
-      cwd: session.cwd,
-      permissionMode: session.permissionMode,
-      sessionId: session.sessionId,
-      cli,
-    });
-  } catch (err) {
-    // Configured but unable to start: that is a fallback, and it is recorded
-    // as one — every regex verdict hard, the regex result final. Recorded as
-    // `error`, one of the reason codes the activity store and the collector
-    // know (T8's closed list); an unknown code would ship as `other`. Logged
-    // at info, off the hook's stderr (see `readJevConfig`); the activity row
-    // carries the fallback.
-    hookLogInfo(`Jev review could not start (${err instanceof Error ? err.message : String(err)})`);
-    return {
-      mode: cfg.mode === "shadow" || cfg.mode === "enforce" ? cfg.mode : loaded.defaultMode,
-      review: Promise.resolve({ kind: "fallback", reason: "error", latencyMs: null, model: null }),
-      abort: () => {},
-      authorityOf: () => ({ authority: "hard", reviewedBy: [] }),
-    };
-  }
-}
-
-/**
- * The Jev properties for `hook_policy_triggered`, from T8's
- * `jevTelemetryProperties` (decisions, reason codes, policy and model names,
- * a latency — never command or prompt text). `{}` when the two-tier path did
- * not run, so an unconfigured machine's event is unchanged, and `{}` when the
- * helper is not in this build (it is T8's, not a §7 contract) or throws:
- * telemetry never costs a hook its answer.
- *
- * Only its `jev_`-prefixed keys are kept. These are spread into an event whose
- * core properties (`decision`, `policy_name`, `event_type`, …) are what the
- * rollout is read from, and a helper owned by another task must not be able to
- * overwrite one of them — silently, and only on two-tier machines — by
- * emitting a key of that name. The helper is treated as untrusted in every
- * other respect (absent, non-object, throwing); this is the same guard for
- * what it returns.
- */
-function jevTelemetry(activity: JevActivityFields | undefined): Record<string, unknown> {
-  if (!activity) return {};
-  try {
-    const build = (hookTelemetry as unknown as { jevTelemetryProperties?: (entry: JevActivityFields) => unknown })
-      .jevTelemetryProperties;
-    const props = typeof build === "function" ? build(activity) : null;
-    if (!props || typeof props !== "object" || Array.isArray(props)) return {};
-    return Object.fromEntries(Object.entries(props as Record<string, unknown>).filter(([key]) => key.startsWith("jev_")));
-  } catch {
-    return {};
-  }
-}
-
-/**
- * Record what the human just typed, for Jev to judge later calls against.
- * Only when Jev is configured. Every canonical `UserPromptSubmit` is passed,
- * except a prompt a policy denied on a CLI where that deny is known to hold
- * (`ENFORCEMENT_CAPABILITY` says `block`): the agent never receives that
- * prompt, so it cannot be what the agent is working on. Where a prompt deny
- * is only observed — Goose, OpenCode, Antigravity — or not verified, the
- * agent does get the prompt, and it is passed like any other. Which CLIs'
- * prompt events count as human is decided inside `captureIntent` (T4).
- * Never throws; a failure is logged at info (see `readJevConfig`).
- *
- * `captureIntent` gets the whole normalized payload (`payload`): the prompt
- * text is in a different field on some harnesses (Goose: `message`), and the
- * marks that tell a human's prompt from a subagent's or an extension's are
- * elsewhere in it. `prompt` is §7's original field, still read by the
- * contract stub; T4's implementation reads `payload` and ignores it.
- */
-async function captureJevIntent(
-  canonicalEventType: string,
-  decision: "allow" | "deny" | "instruct",
-  parsed: Record<string, unknown>,
-  session: SessionMetadata,
-  cli: IntegrationType,
-  opts: EvaluateHookEventOptions | undefined,
-): Promise<void> {
-  if (canonicalEventType !== "UserPromptSubmit" || jevForcedOff(opts)) return;
-  try {
-    if (!(await readJevConfig())) return;
-    if (decision === "deny") {
-      const { ENFORCEMENT_CAPABILITY } = await import("./enforcement-capability");
-      if (ENFORCEMENT_CAPABILITY[cli]?.UserPromptSubmit === "block") return;
-    }
-    const { captureIntent } = await import("./semantic/intent");
-    // Built first, then passed: the one object satisfies §7's shape and T4's.
-    const event = {
-      eventType: canonicalEventType,
-      sessionId: session.sessionId,
-      transcriptPath: session.transcriptPath,
-      cli,
-      payload: parsed,
-      prompt: parsed.prompt,
-    };
-    captureIntent(event);
-  } catch (err) {
-    hookLogInfo(`Jev intent capture failed: ${err instanceof Error ? err.message : String(err)}`);
-  }
-}
-
 /**
  * The core hook-evaluation logic, decoupled from process stdin/stdout so it
  * can be called repeatedly inside a long-lived process (the daemon's warm
@@ -785,14 +561,6 @@ export async function evaluateHookEvent(
           ...(cloudManaged ? { cloudPolicyId: cloudManaged.id, cloudVersion: cloudManaged.version } : {}),
           ...(pack ? { packId: pack.id, packVersion: pack.version } : {}),
         });
-        // Whether Jev may clear this policy's verdict. The cloud assignment or
-        // the pack manifest declares it for those routes, the hook itself only
-        // for the user's own files; anything unclear registers as hard. Said
-        // aloud when a `reviewable` claim is refused and Jev is configured, so
-        // an author is not left wondering why Jev never clears it.
-        const authority = authorityDeclarationFor(hook, { cloudManaged, pack });
-        const refused = resolvePolicyAuthority(authority).downgraded;
-        if (refused) warnAuthority(`${registeredName} asks to be reviewable, but ${refused} — it stays hard`);
         registerPolicy(
           registeredName,
           hook.description ?? "",
@@ -804,7 +572,6 @@ export async function evaluateHookEvent(
           // configured. Matched by the pack's own name for the policy, which is
           // the name before the `pack/<id>@<version>/` prefix is applied.
           pack?.policies.find((p) => p.name === hook.name)?.params,
-          authority,
         );
       }
 
@@ -893,40 +660,19 @@ export async function evaluateHookEvent(
       );
     }
 
-    // Two-tier: when a Jev config exists and this is a gate, Jev's request
-    // starts HERE, before any regex policy runs, and evaluatePolicies combines
-    // the two (see semantic/combine.ts). Otherwise this is null and the call
-    // below is exactly the regex-only evaluation it always was.
-    const twoTier = await startTwoTier(canonicalEventType, parsed, session, cli, opts, activePause);
-    // On the two-tier path the registry is read for the activity row BEFORE
-    // evaluating, because evaluatePolicies may hand the registry back to the
-    // warm worker's queue (`releaseRegistry`) while it waits on Jev, and the
-    // next request's clearPolicies() could then run under this one. Same
-    // cached lookup, same answer: nothing between here and there registers.
-    const matchedBeforeRelease = twoTier
-      ? getPoliciesForEvent(canonicalEventType, parsed.tool_name as string | undefined).map((p) => p.name)
-      : null;
-
     // Evaluate policies (use canonical PascalCase event type)
-    const result = twoTier
-      ? await evaluatePolicies(canonicalEventType, parsed, session, config, {
-          ...twoTier,
-          releaseRegistry: opts?.releaseRegistry,
-        })
-      : await evaluatePolicies(canonicalEventType, parsed, session, config);
+    const result = await evaluatePolicies(canonicalEventType, parsed, session, config);
     const durationMs = Math.round(performance.now() - startTime);
     hookLogInfo(`result=${result.decision} policy=${result.policyName ?? "none"} duration=${durationMs}ms`);
 
-    await captureJevIntent(canonicalEventType, result.decision, parsed, session, cli, opts);
-
     // Which policies actually ran for this event, regardless of how they
     // decided. `result.policyName` names only the decider — null on a plain
     // allow — so without this a row cannot tell "your policy ran and allowed"
     // from "no policy covers this event". The lookup is the same cached call
     // the evaluator already made, so it costs nothing.
-    const matchedPolicies =
-      matchedBeforeRelease ??
-      getPoliciesForEvent(canonicalEventType, parsed.tool_name as string | undefined).map((p) => p.name);
+    const matchedPolicies = getPoliciesForEvent(canonicalEventType, parsed.tool_name as string | undefined).map(
+      (p) => p.name,
+    );
 
     // Persist activity to disk (visible in /policies activity tab)
     const activityEntry = {
@@ -940,8 +686,6 @@ export async function evaluateHookEvent(
       decision: result.decision,
       reason: result.reason,
       durationMs,
-      // How Jev took part (§7 fields). Absent unless the two-tier path ran.
-      ...(result.twoTier ? result.twoTier.activity : {}),
       sessionId: session.sessionId,
       transcriptPath: session.transcriptPath,
       cwd: session.cwd,
@@ -949,10 +693,8 @@ export async function evaluateHookEvent(
       hookEventName: session.hookEventName,
       // Attribution. A builtin is anything registered that is not in the map,
       // so its absence is meaningful rather than missing — but only when a
-      // policy actually decided; a plain allow names nobody. When Jev's own
-      // verdict decided, no registered policy did: `evaluator` + `jevDecision`
-      // say so, and claiming "builtin" here would be false.
-      ...(result.policyName && !result.twoTier?.decidedByJev
+      // policy actually decided; a plain allow names nobody.
+      ...(result.policyName
         ? (() => {
             const attribution = policyAttribution.get(result.policyName);
             return {
@@ -1009,7 +751,6 @@ export async function evaluateHookEvent(
           convention_scope: conventionScope,
           has_custom_params: hasCustomParams,
           param_keys_overridden: paramKeysOverridden,
-          ...jevTelemetry(result.twoTier?.activity),
         });
         // Deny/instruct is exactly the response the daemon's warm worker
         // needs to return fast — a live network POST to PostHog on this path

package/src/hooks/hook-activity-store.ts

@@ -24,7 +24,6 @@ import {
 import { join } from "node:path";
 import type { IntegrationType } from "./types";
 import { hookActivityDir } from "./fp-home";
-import { sanitizeJevActivity } from "./jev-activity";
 
 export const PAGE_SIZE = 25;
 
@@ -77,36 +76,6 @@ export interface HookActivityEntry {
   matchedPolicies?: string[];
   decision: "allow" | "deny" | "instruct";
   reason: string | null;
-  /**
-   * The Jev (two-tier) fields. Present only when a Jev config (BYOK) exists and
-   * the call was a PreToolUse / PermissionRequest gate. Absent means the regex
-   * engine decided alone, exactly as before these fields existed.
-   *
-   * `evaluator`: `jev` (the two-tier path ran) or `jev-fallback` (Jev was
-   * unavailable, truncated or mismatched, so the regex result stood;
-   * `jevFallbackReason` says why). `jev` alone does NOT mean Jev answered:
-   * when a hard policy denies, Jev is aborted and the row carries
-   * `{ evaluator: "jev", jevMode }` and no other Jev field; when no semantic
-   * policy applies to the call, no request is sent and the row carries
-   * `{ evaluator: "jev", jevDecision: "allow", jevMode }`. Read a row with
-   * `jevOutcome` (`jev-activity.ts`): answered, fallback, not-consulted or
-   * no-request.
-   *
-   * Validated on write by `persistHookActivity` (see `jev-activity.ts`): an
-   * invalid value is dropped field by field, and `jevFallbackReason` is stored
-   * as a known code (`timeout`, `http-429`, `error`, …) or `other`, never free
-   * text. The collector ships these fields to FailproofAI Cloud.
-   */
-  evaluator?: "jev" | "jev-fallback";
-  /** Jev's own verdict, before combining with the regex results. */
-  jevDecision?: "allow" | "instruct" | "deny";
-  /** Reviewable policies whose deny/instruct Jev cleared. */
-  jevCleared?: string[];
-  jevFallbackReason?: string;
-  jevLatencyMs?: number;
-  jevModel?: string;
-  /** `shadow` logs Jev but enforces the regex result; `enforce` applies the combine rules. */
-  jevMode?: "shadow" | "enforce";
   durationMs: number;
   sessionId?: string;
   transcriptPath?: string;
@@ -225,13 +194,7 @@ function releaseLock(): void {
 
 // ── Writing (synchronous — hook handler is short-lived) ──
 
-export function persistHookActivity(input: HookActivityEntry): void {
-  // The Jev fields are validated here, at the one door every row passes
-  // through, rather than trusted from the caller: they are shipped off the
-  // machine by the collector, and a fallback reason is the one field that can
-  // carry free text (see jev-activity.ts). A row with no Jev fields is written
-  // exactly as given.
-  const entry = sanitizeJevActivity(input);
+export function persistHookActivity(entry: HookActivityEntry): void {
   ensureDir();
   acquireLock();
   try {
@@ -434,72 +397,6 @@ export function getAllHookActivityEntries(): HookActivityEntry[] {
   return [...currentEntries, ...archiveEntries];
 }
 
-/** See {@link getHookActivityEntriesSince}. */
-export const ROTATION_CLOCK_SLACK_MS = 10 * 60 * 1000;
-
-/**
- * Every entry stamped at or after `sinceMs`, newest first — without reading the
- * whole history.
- *
- * Pages are never pruned, so a long-lived machine has hundreds of them, and a
- * windowed question ("how did Jev do in the last day") should not pay for all
- * of them. It does not have to: an entry's timestamp is taken before it is
- * appended, and a page is only renamed to `page-<rotatedAt>-<seq>` after its
- * last append, so every entry in a page is at or before `rotatedAt`. Archives
- * are listed newest first, so once one was rotated before the window opened,
- * it and every older page lie wholly outside it and reading stops there.
- *
- * `current.jsonl` and the newest pages can still hold entries just outside the
- * window (two hook processes race to append), hence the per-entry filter.
- * The stop is taken with {@link ROTATION_CLOCK_SLACK_MS} to spare, so a clock
- * stepped back a few minutes between two writes costs one extra page read
- * rather than silently dropping rows from the window.
- *
- * No row is returned twice, although this reads without the writers' lock. A
- * hook process can rotate `current.jsonl` into a new page between this reading
- * `current.jsonl` and listing the pages, and that page then holds the rows just
- * read. So the pages are listed once before `current.jsonl` is read; a page
- * that appears only in the second listing was rotated during the read, and any
- * of its rows that were also in `current.jsonl` are skipped. (A page rotated
- * before the read holds none of them: `current.jsonl` was fresh by then.)
- */
-export function getHookActivityEntriesSince(sinceMs: number): HookActivityEntry[] {
-  ensureDir();
-  const dir = storeDirValue();
-  const inWindow = (e: HookActivityEntry) => typeof e.timestamp === "number" && e.timestamp >= sinceMs;
-  const listedBefore = new Set(getArchiveFiles());
-  sinceReadProbe?.("before-current");
-  const current = readJsonlFile(join(dir, CURRENT_FILE));
-  sinceReadProbe?.("after-current");
-  const readFromCurrent = new Map<string, number>();
-  for (const e of current) {
-    const key = JSON.stringify(e);
-    readFromCurrent.set(key, (readFromCurrent.get(key) ?? 0) + 1);
-  }
-  const notReadYet = (e: HookActivityEntry): boolean => {
-    const key = JSON.stringify(e);
-    const n = readFromCurrent.get(key) ?? 0;
-    if (n === 0) return true;
-    readFromCurrent.set(key, n - 1);
-    return false;
-  };
-  const out = current.reverse().filter(inWindow);
-  for (const file of getArchiveFiles()) {
-    const rotatedAt = parseInt(file.slice(5, -6).split("-")[0], 10);
-    if (Number.isFinite(rotatedAt) && rotatedAt < sinceMs - ROTATION_CLOCK_SLACK_MS) break;
-    let entries = readJsonlFile(join(dir, file));
-    if (!listedBefore.has(file)) entries = entries.filter(notReadYet);
-    out.push(...entries.reverse().filter(inWindow));
-  }
-  return out;
-}
-
-/** Test-only: runs between the reads of {@link getHookActivityEntriesSince}, to land a rotation exactly there. */
-let sinceReadProbe: ((phase: "before-current" | "after-current") => void) | null = null;
-export function _setSinceReadProbeForTest(probe: ((phase: "before-current" | "after-current") => void) | null): void {
-  sinceReadProbe = probe;
-}
-
 
 export function searchHookActivity(
   filters: HookActivityFilters,
@@ -622,7 +519,6 @@ function getArchiveFiles(): string[] {
 
 export function _resetForTest(testDir?: string): void {
   rotateSeq = 0;
-  sinceReadProbe = null;
   // null, not the default path: clearing the override lets the getter re-read
   // FAILPROOFAI_HOME, which a test may have changed since this module loaded.
   storeDirOverride = testDir ?? null;

package/src/hooks/hook-telemetry.ts

@@ -8,7 +8,6 @@
 import { version } from "../../package.json";
 import { POSTHOG_API_KEY, POSTHOG_PRODUCT } from "../posthog-key";
 import { isTelemetryEnabled } from "../../lib/telemetry-enabled";
-import { jevOutcome, sanitizeJevActivity, type JevActivityFields } from "./jev-activity";
 
 const API_KEY = POSTHOG_API_KEY;
 const CAPTURE_URL = "https://us.i.posthog.com/capture/";
@@ -87,43 +86,3 @@ export async function flushHookTelemetry(): Promise<void> {
     await Promise.allSettled([...pending]);
   }
 }
-
-/**
- * The Jev (two-tier evaluator) properties for a hook telemetry event, built
- * from the activity row's Jev fields — or `{}` when Jev was not involved, so
- * spreading this into an event changes nothing on an unconfigured machine.
- *
- * Same rule as every other hook property: decisions, reason codes, policy and
- * model names, and a latency — never command or prompt text. The row's fields
- * go through the same normaliser the activity store applies on write, so a
- * free-text fallback reason is reduced to its code here too.
- *
- * A call a hard policy denied before Jev's answer was read carries
- * `jev_outcome: "not-consulted"`, and a call no semantic policy applied to (no
- * request sent) `jev_outcome: "no-request"`; neither carries a Jev verdict,
- * clears, latency or model: `jev_evaluator: "jev"` alone does not mean Jev
- * answered (see `jevOutcome`).
- *
- * Meant to be spread into `hook_policy_triggered` by the handler:
- * `{ ...existingProps, ...jevTelemetryProperties(activityEntry) }`.
- */
-export function jevTelemetryProperties(entry: JevActivityFields): Record<string, unknown> {
-  const e = sanitizeJevActivity(entry);
-  const outcome = jevOutcome(e);
-  if (outcome === null) return {};
-  const props: Record<string, unknown> = { jev_evaluator: e.evaluator };
-  if (e.jevMode) props.jev_mode = e.jevMode;
-  if (outcome === "not-consulted" || outcome === "no-request") {
-    props.jev_outcome = outcome;
-    return props;
-  }
-  if (e.jevDecision) props.jev_decision = e.jevDecision;
-  if (e.jevCleared) {
-    props.jev_cleared = e.jevCleared;
-    props.jev_cleared_count = e.jevCleared.length;
-  }
-  if (e.jevFallbackReason) props.jev_fallback_reason = e.jevFallbackReason;
-  if (e.jevLatencyMs !== undefined) props.jev_latency_ms = e.jevLatencyMs;
-  if (e.jevModel) props.jev_model = e.jevModel;
-  return props;
-}

package/src/hooks/loader-utils.ts

@@ -191,13 +191,7 @@ export async function createEsmShim(
   const shimCode = [
     `import _cjs from '${distUrl}';`,
     `export const customPolicies = _cjs.customPolicies;`,
-    // Every name a policy file may import has to be listed HERE as well as in
-    // `src/index.ts`: this shim is an ESM module, so importing a name it does not
-    // declare is a link-time error, not an undefined at runtime. A pack entry
-    // calling `semanticPolicies.add` would fail to load entirely.
-    `export const semanticPolicies = _cjs.semanticPolicies;`,
     `export const getCustomHooks = _cjs.getCustomHooks;`,
-    `export const getSemanticRegistrations = _cjs.getSemanticRegistrations;`,
     `export const clearCustomHooks = _cjs.clearCustomHooks;`,
     `export const allow = _cjs.allow;`,
     `export const deny = _cjs.deny;`,