failproofai 1.0.7-beta.1 → 1.0.7

package/.next/standalone/.next/static/chunks/2vkvu9-opa_1z.js

@@ -1 +0,0 @@
-(globalThis.TURBOPACK||(globalThis.TURBOPACK=[])).push(["object"==typeof document?document.currentScript:void 0,5441,e=>{"use strict";var t=e.i(95187);let a=(0,t.createServerReference)("60e4a768f8321675d8a9a26cffd85a357b6c7ca850",t.callServer,void 0,t.findSourceMapURL,"searchHookActivityAction");e.s(["searchHookActivityAction",0,a])},73520,e=>{"use strict";var t=e.i(43476),a=e.i(24071),r=e.i(67927);e.s(["default",0,function({currentPage:e,totalPages:l,onPageChange:o}){if(l<=1)return null;let s=e=>`px-3 py-2 text-sm rounded-md transition-colors flex items-center gap-1 bg-muted text-muted-foreground ${e?"opacity-50 cursor-not-allowed":"hover:bg-muted/80"}`;return(0,t.jsxs)("div",{className:"flex items-center justify-center gap-2 py-4",children:[(0,t.jsxs)("button",{onClick:()=>o(e-1),disabled:1===e,className:s(1===e),"aria-label":"Previous page",children:[(0,t.jsx)(a.ChevronLeft,{className:"w-4 h-4"}),(0,t.jsx)("span",{className:"hidden sm:inline",children:"Previous"})]}),(0,t.jsx)("div",{className:"flex items-center gap-1",children:(()=>{if(l<=7)return Array.from({length:l},(e,t)=>t+1);let t=[1],a=Math.max(2,e-1),r=Math.min(l-1,e+1);e<=3&&(r=Math.min(5,l-1)),e>=l-2&&(a=Math.max(2,l-4)),a>2&&t.push("ellipsis-start");for(let e=a;e<=r;e++)t.push(e);return r<l-1&&t.push("ellipsis-end"),t.push(l),t})().map(a=>"string"==typeof a?(0,t.jsx)("span",{className:"px-2 text-muted-foreground",children:"..."},a):(0,t.jsx)("button",{onClick:()=>o(a),className:`min-w-[2.5rem] px-3 py-2 text-sm rounded-md transition-colors ${e===a?"bg-primary text-primary-foreground":"bg-muted text-muted-foreground hover:bg-muted/80"}`,"aria-label":`Page ${a}`,"aria-current":e===a?"page":void 0,children:a},a))}),(0,t.jsxs)("button",{onClick:()=>o(e+1),disabled:e===l,className:s(e===l),"aria-label":"Next page",children:[(0,t.jsx)("span",{className:"hidden sm:inline",children:"Next"}),(0,t.jsx)(r.ChevronRight,{className:"w-4 h-4"})]})]})}])},24578,e=>{"use strict";let t={claude:{id:"claude",label:"Claude Code",badgeClasses:"bg-orange-500/10 text-orange-400 border-orange-500/20"},codex:{id:"codex",label:"OpenAI Codex",badgeClasses:"bg-purple-500/10 text-purple-400 border-purple-500/20"},copilot:{id:"copilot",label:"GitHub Copilot",badgeClasses:"bg-blue-500/10 text-blue-400 border-blue-500/20"},cursor:{id:"cursor",label:"Cursor Agent",badgeClasses:"bg-emerald-500/10 text-emerald-400 border-emerald-500/20"},opencode:{id:"opencode",label:"OpenCode",badgeClasses:"bg-amber-500/10 text-amber-400 border-amber-500/20"},pi:{id:"pi",label:"Pi",badgeClasses:"bg-pink-500/10 text-pink-400 border-pink-500/20"},hermes:{id:"hermes",label:"Hermes",badgeClasses:"bg-indigo-500/10 text-indigo-400 border-indigo-500/20"},openclaw:{id:"openclaw",label:"OpenClaw",badgeClasses:"bg-teal-500/10 text-teal-400 border-teal-500/20"},factory:{id:"factory",label:"Factory Droid",badgeClasses:"bg-rose-500/10 text-rose-400 border-rose-500/20"},devin:{id:"devin",label:"Devin CLI",badgeClasses:"bg-violet-500/10 text-violet-400 border-violet-500/20"},antigravity:{id:"antigravity",label:"Antigravity CLI",badgeClasses:"bg-cyan-500/10 text-cyan-400 border-cyan-500/20"},goose:{id:"goose",label:"Goose",badgeClasses:"bg-lime-500/10 text-lime-400 border-lime-500/20"}};e.s(["KNOWN_CLI_IDS",0,["claude","codex","copilot","cursor","opencode","pi","hermes","openclaw","factory","devin","antigravity","goose"],"getCliBadgeClasses",0,function(e){return t[e]?.badgeClasses??t.claude.badgeClasses},"getCliLabel",0,function(e){return t[e]?.label??e},"isKnownCli",0,function(e){return"string"==typeof e&&Object.prototype.hasOwnProperty.call(t,e)}])},34713,e=>{"use strict";e.s(["formatDuration",0,function(e){if(e<1e3)return`${e}ms`;let t=Math.round(e/100);if(t<600)return`${(t/10).toFixed(1)}s`;let a=Math.round(e/1e3);if(a<3600){let e=Math.floor(a/60);return`${e}m ${a%60}s`}let r=Math.round(e/6e4),l=Math.floor(r/60);return`${l}h ${r%60}m`},"formatRelativeTime",0,function(e){let t=Date.now()-e;return t<6e4?`${Math.max(1,Math.floor(t/1e3))}s ago`:t<36e5?`${Math.floor(t/6e4)}m ago`:t<864e5?`${Math.floor(t/36e5)}h ago`:`${Math.floor(t/864e5)}d ago`}])},80060,2711,e=>{"use strict";var t=e.i(18566),a=e.i(71645);function r(e){let t=e.getFullYear(),a=String(e.getMonth()+1).padStart(2,"0"),r=String(e.getDate()).padStart(2,"0");return`${t}-${a}-${r}`}function l(e){var t;if(!e||(t=e,!/^\d{4}-\d{2}-\d{2}$/.test(t)||isNaN(Date.parse(t))))return null;let[a,r,l]=e.split("-").map(Number);return new Date(a,r-1,l,12,0,0)}e.s(["useUrlParams",0,function(){let e=(0,t.useSearchParams)(),r=(0,t.useRouter)(),l=(0,t.usePathname)(),o=(0,a.useRef)(null),s=(0,a.useCallback)(t=>e.get(t),[e]),i=(0,a.useCallback)(()=>new URLSearchParams(e.toString()),[e]),n=(0,a.useCallback)(t=>{o.current&&clearTimeout(o.current),o.current=setTimeout(()=>{let a=new URLSearchParams(e.toString());for(let[e,r]of Object.entries(t))void 0===r||""===r?a.delete(e):a.set(e,r);let o=a.toString(),s=o?`${l}?${o}`:l;r.replace(s,{scroll:!1})},150)},[e,l,r]);return(0,a.useEffect)(()=>()=>{o.current&&clearTimeout(o.current)},[]),{get:s,getAll:i,setAll:n}}],80060),e.s(["dateRangeToParams",0,function(e){let t={};return e.from&&(t.from=r(e.from)),e.to&&(t.to=r(e.to)),t},"keywordsToParam",0,function(e){if(0!==e.length)return e.map(e=>encodeURIComponent(e)).join(",")},"pageToParam",0,function(e){return e<=1?void 0:String(e)},"paramToKeywords",0,function(e){return e?e.split(",").map(e=>decodeURIComponent(e.trim())).filter(e=>e.length>0):[]},"paramToPage",0,function(e){if(!e)return 1;let t=parseInt(e,10);return Number.isFinite(t)&&t>=1?t:1},"paramToPreset",0,function(e){return e&&["all","last-hour","today","last-7-days","last-30-days","custom"].includes(e)?e:"all"},"paramsToDateRange",0,function(e,t){return{from:l(e),to:l(t)}},"presetToParam",0,function(e){return"all"===e?void 0:e}],2711)},89664,e=>{"use strict";var t=e.i(56420);let a={name:"check",size:24,node:[["path",{d:"M20 6 9 17l-5-5",key:"1gmf2c"}]]};a.node;let r=(0,t.default)(a);e.s(["Check",0,r],89664)},24071,e=>{"use strict";var t=e.i(56420);let a={name:"chevron-left",size:24,node:[["path",{d:"m15 18-6-6 6-6",key:"1wnfg3"}]]};a.node;let r=(0,t.default)(a);e.s(["ChevronLeft",0,r],24071)},67927,e=>{"use strict";var t=e.i(56420);let a={name:"chevron-right",size:24,node:[["path",{d:"m9 18 6-6-6-6",key:"mthhwq"}]]};a.node;let r=(0,t.default)(a);e.s(["ChevronRight",0,r],67927)},8734,e=>{"use strict";var t=e.i(56420);let a={name:"copy",size:24,node:[["rect",{width:"14",height:"14",x:"8",y:"8",rx:"2",ry:"2",key:"17jyea"}],["path",{d:"M4 16c-1.1 0-2-.9-2-2V4c0-1.1.9-2 2-2h10c1.1 0 2 .9 2 2",key:"zix9uf"}]]};a.node;let r=(0,t.default)(a);e.s(["Copy",0,r],8734)},16306,e=>{"use strict";var t=e.i(56420);let a={name:"shield-alert",size:24,node:[["path",{d:"M20 13c0 5-3.5 7.5-7.66 8.95a1 1 0 0 1-.67-.01C7.5 20.5 4 18 4 13V6a1 1 0 0 1 1-1c2 0 4.5-1.2 6.24-2.72a1.17 1.17 0 0 1 1.52 0C14.51 3.81 17 5 19 5a1 1 0 0 1 1 1z",key:"oel41y"}],["path",{d:"M12 8v4",key:"1got3b"}],["path",{d:"M12 16h.01",key:"1drbdi"}]]};a.node;let r=(0,t.default)(a);e.s(["ShieldAlert",0,r],16306)},84026,29407,e=>{"use strict";var t=e.i(56420);let a={name:"shield-check",size:24,node:[["path",{d:"M20 13c0 5-3.5 7.5-7.66 8.95a1 1 0 0 1-.67-.01C7.5 20.5 4 18 4 13V6a1 1 0 0 1 1-1c2 0 4.5-1.2 6.24-2.72a1.17 1.17 0 0 1 1.52 0C14.51 3.81 17 5 19 5a1 1 0 0 1 1 1z",key:"oel41y"}],["path",{d:"m9 12 2 2 4-4",key:"dzmm74"}]]};a.node;let r=(0,t.default)(a);e.s(["ShieldCheck",0,r],84026);let l={name:"shield-x",size:24,node:[["path",{d:"M20 13c0 5-3.5 7.5-7.66 8.95a1 1 0 0 1-.67-.01C7.5 20.5 4 18 4 13V6a1 1 0 0 1 1-1c2 0 4.5-1.2 6.24-2.72a1.17 1.17 0 0 1 1.52 0C14.51 3.81 17 5 19 5a1 1 0 0 1 1 1z",key:"oel41y"}],["path",{d:"m14.5 9.5-5 5",key:"17q4r4"}],["path",{d:"m9.5 9.5 5 5",key:"18nt4w"}]],aliases:["shield-close"]};l.node;let o=(0,t.default)(l);e.s(["ShieldX",0,o],29407)},82954,e=>{"use strict";var t=e.i(56420);let a={name:"shield",size:24,node:[["path",{d:"M20 13c0 5-3.5 7.5-7.66 8.95a1 1 0 0 1-.67-.01C7.5 20.5 4 18 4 13V6a1 1 0 0 1 1-1c2 0 4.5-1.2 6.24-2.72a1.17 1.17 0 0 1 1.52 0C14.51 3.81 17 5 19 5a1 1 0 0 1 1 1z",key:"oel41y"}]]};a.node;let r=(0,t.default)(a);e.s(["Shield",0,r],82954)},63676,e=>{"use strict";var t=e.i(56420);let a={name:"x",size:24,node:[["path",{d:"M18 6 6 18",key:"1bl5f8"}],["path",{d:"m6 6 12 12",key:"d8bk6v"}]]};a.node;let r=(0,t.default)(a);e.s(["X",0,r],63676)}]);

package/.next/standalone/.next/static/chunks/37lhv7wa3ywt6.js

@@ -1 +0,0 @@
-(globalThis.TURBOPACK||(globalThis.TURBOPACK=[])).push(["object"==typeof document?document.currentScript:void 0,64237,e=>{"use strict";var t=e.i(43476),a=e.i(71645),s=e.i(12344),n=e.i(29054);let l=/^[^\s@]+@[^\s@]+\.[^\s@]+$/;function i(e){if((0,n.isAbortError)(e))return"request timed out. check your network and try again.";let t=e instanceof Error?e.message:String(e);return`network error: ${t}`}e.s(["AuthDialog",0,function({open:e,headline:r="where to route the reminder?",subhead:o="we'll send a one-time code to confirm.",onClose:c,onAuthed:d,source:u="unknown"}){let{capture:h}=(0,s.usePostHog)(),[m,f]=(0,a.useState)({kind:"email",error:null}),[v,b]=(0,a.useState)(!1),p=(0,a.useRef)(!1),x=(0,a.useRef)(null),w=(0,a.useRef)(null);(0,a.useEffect)(()=>{e&&(f({kind:"email",error:null}),b(!1),p.current=!1,h("audit_auth_dialog_opened",{source:u}))},[h,e,u]);let j=(0,a.useRef)(!1);(0,a.useEffect)(()=>{if(e){j.current=!0;return}j.current&&!p.current&&h("audit_auth_dialog_dismissed",{source:u,step:m.kind}),j.current=!1},[h,e,u,m.kind]),(0,a.useEffect)(()=>{if(!e)return;let t=setTimeout(()=>{"email"===m.kind?x.current?.focus():"code"===m.kind&&w.current?.focus()},50);return()=>clearTimeout(t)},[e,m.kind]),(0,a.useEffect)(()=>{if(!e)return;let t=e=>{"Escape"!==e.key||v||c()};return window.addEventListener("keydown",t),()=>window.removeEventListener("keydown",t)},[e,v,c]);let g="code"===m.kind&&m.resendIn>0;(0,a.useEffect)(()=>{if(!g)return;let e=setInterval(()=>{f(e=>"code"===e.kind?{...e,resendIn:Math.max(0,e.resendIn-1)}:e)},1e3);return()=>clearInterval(e)},[g]);let y=(0,a.useCallback)(async(e,t={})=>{let{isResend:a=!1}=t,s=e=>{a?f(t=>"code"===t.kind?{...t,error:e}:t):f({kind:"email",error:e})};b(!0);try{let t=await (0,n.fetchWithTimeout)("/api/auth/login-request",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({email:e})}),a=await t.json().catch(()=>({}));if(!t.ok){let e=a.message??"could not send code.";"rate_limited"===a.code&&void 0!==a.retry_after_secs?e=`too many tries. wait ${a.retry_after_secs}s and try again.`:"upstream_unreachable"===a.code&&(e="api-server unreachable. check your network."),s(e);return}f({kind:"code",email:e,error:null,expiresIn:a.expires_in??600,resendIn:a.resend_available_in??30})}catch(e){s(i(e))}finally{b(!1)}},[]),k=(0,a.useCallback)(async(e,t)=>{b(!0);try{let a=await (0,n.fetchWithTimeout)("/api/auth/login-verify",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({email:e,code:t})}),s=await a.json().catch(()=>({}));if(!a.ok||!s.authenticated||!s.user){let e=s.message??"invalid code.";"invalid_code"===s.code&&(e="wrong code, or it expired. try again."),f(t=>"code"===t.kind?{...t,error:e}:t);return}p.current=!0,h("audit_auth_dialog_succeeded",{source:u}),f({kind:"done",user:s.user}),d(s.user)}catch(t){let e=i(t);f(t=>"code"===t.kind?{...t,error:e}:t)}finally{b(!1)}},[h,d,u]),N=(0,a.useCallback)(async e=>{if(e.preventDefault(),v||"email"!==m.kind)return;let t=String(new FormData(e.currentTarget).get("email")??"").trim().toLowerCase();l.test(t)?await y(t):f({kind:"email",error:"that doesn't look like an email."})},[v,m,y]),S=(0,a.useCallback)(async e=>{if(e.preventDefault(),v||"code"!==m.kind)return;let t=String(new FormData(e.currentTarget).get("code")??"").trim();t.length<4||t.length>12?f(e=>"code"===e.kind?{...e,error:"code is 4–12 characters."}:e):await k(m.email,t)},[v,m,k]),C=(0,a.useCallback)(async()=>{"code"!==m.kind||m.resendIn>0||v||await y(m.email,{isResend:!0})},[m,v,y]);return e?(0,t.jsx)("div",{className:"auth-dialog-backdrop",role:"dialog","aria-modal":"true","aria-labelledby":"auth-dialog-title",onClick:e=>{v||e.target!==e.currentTarget||c()},children:(0,t.jsxs)("div",{className:"auth-dialog",children:[(0,t.jsx)("button",{type:"button",className:"auth-close",onClick:c,disabled:v,"aria-label":"close",children:"×"}),(0,t.jsx)("h2",{id:"auth-dialog-title",className:"auth-headline",children:r}),"email"===m.kind&&(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)("p",{className:"auth-sub",children:o}),(0,t.jsxs)("form",{onSubmit:N,className:"auth-form",children:[(0,t.jsx)("input",{ref:x,id:"auth-dialog-email",name:"email",type:"email",autoComplete:"email",inputMode:"email",spellCheck:!1,placeholder:"you@yourdomain.com",disabled:v,className:"auth-input",required:!0}),m.error&&(0,t.jsx)("div",{className:"auth-error",children:m.error}),(0,t.jsxs)("div",{className:"auth-actions",children:[(0,t.jsx)("button",{type:"submit",className:"auth-btn primary",disabled:v,children:v?"sending…":"send code"}),(0,t.jsx)("button",{type:"button",className:"auth-btn",onClick:c,disabled:v,children:"cancel"})]})]})]}),"code"===m.kind&&(0,t.jsxs)(t.Fragment,{children:[(0,t.jsxs)("p",{className:"auth-sub",children:["code sent to ",(0,t.jsx)("span",{className:"auth-email",children:m.email}),". expires in ",Math.ceil(m.expiresIn/60)," min."]}),(0,t.jsxs)("form",{onSubmit:S,className:"auth-form",children:[(0,t.jsx)("input",{ref:w,id:"auth-dialog-code",name:"code",type:"text",inputMode:"numeric",autoComplete:"one-time-code",spellCheck:!1,placeholder:"123456",disabled:v,className:"auth-input auth-input-code",maxLength:12,required:!0}),m.error&&(0,t.jsx)("div",{className:"auth-error",children:m.error}),(0,t.jsxs)("div",{className:"auth-actions",children:[(0,t.jsx)("button",{type:"submit",className:"auth-btn primary",disabled:v,children:v?"verifying…":"verify"}),(0,t.jsx)("button",{type:"button",className:"auth-btn",onClick:C,disabled:v||m.resendIn>0,children:m.resendIn>0?`resend in ${m.resendIn}s`:"resend code"})]}),(0,t.jsx)("button",{type:"button",className:"auth-back",onClick:()=>f({kind:"email",error:null}),disabled:v,children:"← use a different email"})]})]}),"done"===m.kind&&(0,t.jsxs)(t.Fragment,{children:[(0,t.jsxs)("p",{className:"auth-sub",children:[(0,t.jsx)("span",{className:"auth-ok",children:"✓"})," signed in as"," ",(0,t.jsx)("span",{className:"auth-email",children:m.user.email}),"."]}),(0,t.jsx)("div",{className:"auth-actions",children:(0,t.jsx)("button",{type:"button",className:"auth-btn primary",onClick:c,children:"continue"})})]})]})}):null}])},86616,e=>{"use strict";var t=e.i(29054);class a extends Error{kind;constructor(e,t){super(t),this.kind=e,this.name="RerunError"}}async function s(e){try{let s=await (0,t.fetchWithTimeout)("/api/audit/run",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({cli:e.cli.length>0?e.cli:void 0,since:"all"===e.since?void 0:e.since,noCache:!!e.noCache||void 0})});if(!s.ok&&409!==s.status){let e=await s.text().catch(()=>"");throw console.error("audit run failed:",s.status,e),new a("post_failed",`audit run failed (${s.status})`)}}catch(e){if(e instanceof a)throw e;throw console.error("audit run request failed:",e),new a((0,t.isAbortError)(e)?"timeout":"network","audit run request failed")}let s=0;for(;;){await new Promise(e=>setTimeout(e,1e3));let e=null;try{let a=await (0,t.fetchWithTimeout)("/api/audit/status",{cache:"no-store"});a.ok&&(e=await a.json())}catch{}if(null===e){if(++s>=10)throw new a("network","audit status poll lost the server");continue}if(s=0,!e.running){if(e.error)throw new a("post_failed",e.error);return}}}e.s(["RerunError",0,a,"triggerRun",0,s])},2917,e=>{"use strict";var t=e.i(43476),a=e.i(71645),s=e.i(95187);let n=(0,s.createServerReference)("003cf8cf6fa84a66423a2f59b779aa93edfbd80bd4",s.callServer,void 0,s.findSourceMapURL,"getJevSettingsAction"),l=(0,s.createServerReference)("00dd0def23d79715a77049f83bd44d3e571a3f9e35",s.callServer,void 0,s.findSourceMapURL,"removeJevConfigAction"),i=(0,s.createServerReference)("403e29806edfbe288ff52c6c81371bd44545e988aa",s.callServer,void 0,s.findSourceMapURL,"saveJevConfigAction");var r=e.i(55574);let o=[{value:"typesafe",label:"typesafe"},{value:"openrouter",label:"openrouter"},{value:"vercel",label:"vercel ai gateway"},{value:"cloudflare",label:"cloudflare workers ai"},{value:"custom",label:"custom endpoint"}],c=[{value:"enforce",label:"enforce — jev's verdict counts"},{value:"shadow",label:"shadow — log only, regex decides"}];function d(e){return{provider:e.provider??"typesafe",baseUrl:e.baseUrl,accountId:e.accountId,mode:e.mode}}function u({id:e,label:a,hint:s,children:n}){return(0,t.jsxs)("div",{className:"set-field",children:[(0,t.jsx)("label",{className:"set-field-label",htmlFor:e,children:a}),n,s?(0,t.jsx)("span",{className:"set-hint",children:s}):null]})}e.s(["default",0,function({initial:e}){var s,h;let m,[f,v]=(0,a.useState)(e),[b,p]=(0,a.useState)(e?d(e):{provider:"typesafe",baseUrl:"",accountId:"",mode:"enforce"}),[x,w]=(0,a.useState)(""),[j,g]=(0,a.useState)(!1),[y,k]=(0,a.useState)(null),[N,S]=(0,a.useState)(!1),C=(0,a.useRef)(!0),M=(0,a.useRef)(!1),$=(0,a.useCallback)(async()=>{try{let e=await n();if(!C.current)return;v(e),M.current||p(d(e))}catch{}},[]);(0,a.useEffect)(()=>(C.current=!0,$(),()=>{C.current=!1}),[$]),(0,a.useEffect)(()=>{let e=()=>void $();return window.addEventListener("focus",e),document.addEventListener("visibilitychange",e),()=>{window.removeEventListener("focus",e),document.removeEventListener("visibilitychange",e)}},[$]);let E=(0,a.useCallback)((e,t)=>{M.current=!0,p(a=>({...a,[e]:t}))},[]),A=(0,a.useCallback)(async()=>{g(!0),k(null);try{let e=await i({provider:b.provider,baseUrl:b.baseUrl,accountId:b.accountId,mode:b.mode,token:x});if(!e.ok){k(e.problem),S(!0===e.needsToken);return}M.current=!1,S(!1),w(""),v(e.view),p(d(e.view)),(0,r.toast)(e.view.on?"jev is on.":"saved.")}catch{k("could not save that.")}finally{g(!1)}},[b,x]),R=(0,a.useCallback)(async()=>{g(!0),k(null),S(!1);try{let e=await l();if(!e.ok)return void k(e.problem);M.current=!1,w(""),v(e.view),p(d(e.view)),(0,r.toast)("jev is off. hooks run the regex policies.")}catch{k("could not turn that off.")}finally{g(!1)}},[]),D=null!==f&&"absent"!==f.status,_=f?.token,I=N?"needed for this save — type the token for this endpoint":_?"env"===_.source?"configured, read from the environment — leave blank to keep it":_.hint?`configured, ending ${_.hint} — leave blank to keep it`:"configured — leave blank to keep it":f?.status==="key-missing"?"read from the environment, which is not set in this shell — leave blank to keep it that way":"sent as a bearer token; stored owner-only at 0600";return(0,t.jsxs)("div",{className:"set-cell set-jev",children:[(0,t.jsx)("h2",{className:"set-cell-title",children:"jev · semantic evaluation"}),(0,t.jsx)("div",{className:"set-row set-row-main",children:(0,t.jsxs)("div",{className:"set-row-copy",children:[(0,t.jsx)("span",{className:f?.on?"set-strong":"set-dim",children:null===f?"reading…":f.on?`on. every judged command is also asked of ${f.provider}.`:"off. hooks run the regex policies exactly as before."}),(0,t.jsx)("span",{className:"set-dim",children:f?.on?"shadow"===f.mode?"shadow: jev's answers are logged, the regex result is what gets enforced.":"enforce: jev's answers can clear a reviewable deny.":"a second opinion on the commands the regex policies flag. needs your own endpoint and token."})]})}),f&&D&&(0,t.jsxs)("dl",{className:"set-how-list",children:[f.endpoint&&(0,t.jsxs)("div",{className:"set-how-row",children:[(0,t.jsx)("dt",{className:"set-how-label",children:"endpoint"}),(0,t.jsx)("dd",{className:"set-how-body",children:f.endpoint})]}),(0,t.jsxs)("div",{className:"set-how-row",children:[(0,t.jsx)("dt",{className:"set-how-label",children:"model"}),(0,t.jsx)("dd",{className:"set-how-body",children:function(e){switch(e.kind){case"id":return e.id;case"withheld":return"set to something that is not a model id — not shown here, in case it is a key";default:return"the provider's default"}}(f.model)})]}),(0,t.jsxs)("div",{className:"set-how-row",children:[(0,t.jsx)("dt",{className:"set-how-label",children:"token"}),(0,t.jsx)("dd",{className:"set-how-body",children:_?"env"===_.source?"from FAILPROOFAI_JEV_API_KEY":_.hint?`configured, ending ${_.hint}`:"configured":"none stored"})]}),f.permissions&&(0,t.jsxs)("div",{className:"set-how-row",children:[(0,t.jsx)("dt",{className:"set-how-label",children:"file"}),(0,t.jsx)("dd",{className:"set-how-body",children:`${f.path} \xb7 ${f.permissions}`})]}),f.reviewable&&(0,t.jsxs)("div",{className:"set-how-row",children:[(0,t.jsx)("dt",{className:"set-how-label",children:"reviewable"}),(0,t.jsx)("dd",{className:"set-how-body",children:f.reviewable.summary})]}),f.stats&&f.stats.total>0&&(0,t.jsxs)("div",{className:"set-how-row",children:[(0,t.jsx)("dt",{className:"set-how-label",children:"fallbacks"}),(0,t.jsx)("dd",{className:"set-how-body",children:`${(s=f.stats.fallbackRate,`${Math.round(100*s)}%`)} of ${f.stats.total} calls in the last ${Number.isInteger(m=(h=f.stats.windowMs)/36e5)&&m>=1?m%24==0?`${m/24}d`:`${m}h`:`${Math.max(1,Math.round(h/6e4))}m`} fell back to the regex engine.`})]})]}),f?.problem&&(0,t.jsxs)("p",{className:"set-warn",children:[f.problem,f.fix?` — ${f.fix}`:""]}),f?.reviewable?.problem&&(0,t.jsx)("p",{className:"set-warn",children:f.reviewable.problem}),(0,t.jsx)("div",{className:"set-rule"}),(0,t.jsxs)("div",{className:"set-jev-fields",children:[(0,t.jsx)(u,{id:"jev-provider",label:"provider",children:(0,t.jsx)("select",{id:"jev-provider",className:"set-select",value:b.provider,disabled:j,onChange:e=>E("provider",e.target.value),children:o.map(e=>(0,t.jsx)("option",{value:e.value,children:e.label},e.value))})}),(0,t.jsx)(u,{id:"jev-url",label:"endpoint url",hint:"custom"===b.provider?"required — https, or http to localhost in shadow mode":"leave blank for the provider's own api",children:(0,t.jsx)("input",{id:"jev-url",type:"text",className:"set-text",inputMode:"url",autoComplete:"off",spellCheck:!1,placeholder:"custom"===b.provider?"https://…":"the provider's own api",value:b.baseUrl,disabled:j,onChange:e=>E("baseUrl",e.target.value)})}),"cloudflare"===b.provider&&(0,t.jsx)(u,{id:"jev-account",label:"account id",hint:"32 lowercase hex characters",children:(0,t.jsx)("input",{id:"jev-account",type:"text",className:"set-text",autoComplete:"off",spellCheck:!1,value:b.accountId,disabled:j,onChange:e=>E("accountId",e.target.value)})}),(0,t.jsx)(u,{id:"jev-token",label:"token",hint:I,children:(0,t.jsx)("input",{id:"jev-token",type:"password",className:"set-text",autoComplete:"off",spellCheck:!1,placeholder:_?"•••• kept":"",value:x,disabled:j,"aria-invalid":N||void 0,onChange:e=>{M.current=!0,w(e.target.value)}})}),(0,t.jsx)(u,{id:"jev-mode",label:"mode",children:(0,t.jsx)("select",{id:"jev-mode",className:"set-select",value:b.mode,disabled:j,onChange:e=>E("mode",e.target.value),children:c.map(e=>(0,t.jsx)("option",{value:e.value,children:e.label},e.value))})})]}),y&&(0,t.jsx)("p",{className:"set-warn",children:y}),(0,t.jsxs)("div",{className:"set-actions set-jev-actions",children:[(0,t.jsx)("button",{type:"button",className:"btn btn-press",disabled:j,onClick:()=>void A(),children:j?"[ saving… ]":D?"[ save changes ]":"[ turn jev on ]"}),D&&(0,t.jsx)("button",{type:"button",className:"set-link",disabled:j,onClick:()=>void R(),children:"turn jev off"})]})]})}],2917)},93237,e=>{"use strict";var t=e.i(43476),a=e.i(71645),s=e.i(95187);let n=(0,s.createServerReference)("002eb5166525ca4405347da654e6c3feb16e203ec5",s.callServer,void 0,s.findSourceMapURL,"getScheduledAuditAction"),l=(0,s.createServerReference)("4077a262ce50f7cbcf3025517e5801a9e3c7ec0a44",s.callServer,void 0,s.findSourceMapURL,"setAutoAuditAction"),i=(0,s.createServerReference)("401bab636c01ff92a891caacddd8f29f62aa73ddec",s.callServer,void 0,s.findSourceMapURL,"setAuditIntervalAction");var r=e.i(86616),o=e.i(64237),c=e.i(55574),d=e.i(34713);function u(e){return new Date(e).toLocaleString(void 0,{month:"short",day:"numeric",hour:"2-digit",minute:"2-digit"})}function h(e,t){let a=e-t;if(a<=0)return"now";let s=Math.floor(a/864e5),n=Math.floor(a%864e5/36e5);return s>0?n>0?`${s}d ${n}h`:`${s}d`:n>0?`${n}h`:`${Math.max(1,Math.floor(a/6e4))}m`}function m(e){return e.toLocaleString("en-US")}function f({label:e,value:a,sub:s,tone:n}){return(0,t.jsxs)("div",{className:"set-stat",children:[(0,t.jsx)("div",{className:"set-stat-label",children:e}),(0,t.jsx)("div",{className:`set-stat-value${n?` ${n}`:""}`,children:a}),(0,t.jsx)("div",{className:"set-stat-sub",children:s??" "})]})}function v({lastRunAtMs:e,nextDueAtMs:a,now:s}){if(null==e||null==a||a<=e)return null;let n=Math.min(100,Math.max(0,(s-e)/(a-e)*100));return(0,t.jsxs)("div",{className:"tape","aria-hidden":"true",children:[(0,t.jsxs)("div",{className:"tape-rail",children:[(0,t.jsx)("div",{className:"tape-fill",style:{width:`${n}%`}}),(0,t.jsx)("div",{className:"tape-now",style:{left:`${n}%`}})]}),(0,t.jsxs)("div",{className:"tape-ends",children:[(0,t.jsxs)("span",{children:["last scan · ",u(e)]}),(0,t.jsxs)("span",{className:"tape-next",children:["next · ",h(a,s)]})]})]})}function b({enabled:e,onChange:a,disabled:s,label:n}){return(0,t.jsx)("button",{type:"button",role:"switch","aria-checked":e,"aria-label":n,disabled:s,onClick:a,className:"sw","data-on":e?"true":"false",children:(0,t.jsx)("span",{className:"sw-knob"})})}let p=[{label:"reads",body:"every session transcript on disk — your prompts, the files your agents read and wrote, and command output."},{label:"runs",body:"entirely on this machine. the transcripts never leave it."},{label:"sends",body:"counts, redacted examples, and this machine's name — and only when a scan finds something harmful."}];e.s(["default",0,function({initial:e,jevPanel:s}){let[x,w]=(0,a.useState)(e),[j,g]=(0,a.useState)(e?.auto??!1),[y,k]=(0,a.useState)(e?.intervalDays??7),[N,S]=(0,a.useState)(!1),[C,M]=(0,a.useState)(!1),[$,E]=(0,a.useState)(!1),[A,R]=(0,a.useState)(null===e),[D,_]=(0,a.useState)(0),I=(0,a.useRef)(!0),T=(0,a.useRef)(null!==e),L=(0,a.useCallback)(async()=>{try{let e=await n();if(!I.current)return;w(e),T.current=!0,g(e.auto),k(e.intervalDays),_(Date.now()),R(!1)}catch{I.current&&!T.current&&R(!0)}},[]);(0,a.useEffect)(()=>(I.current=!0,L(),()=>{I.current=!1}),[L]),(0,a.useEffect)(()=>{let e=()=>void L();return window.addEventListener("focus",e),document.addEventListener("visibilitychange",e),()=>{window.removeEventListener("focus",e),document.removeEventListener("visibilitychange",e)}},[L]);let U=x?.signedInAs??null,F=x?.daemon==="running",O=x?.daemon==="unsupported-platform",P=x?.schedule??null,q=x?.lastScan??null,J=P?.lastExitCode!=null&&0!==P.lastExitCode&&75!==P.lastExitCode,W=(0,a.useCallback)(async()=>{S(!0);try{let e=await l(!0);if(!e.ok){if(g(!1),"unreachable"===e.reason)return void(0,c.toast)("could not reach the server. check your connection and try again.");await L(),E(!0),(0,c.toast)("that sign-in expired. one more code and it's on.");return}g(e.auto),(0,c.toast)("scheduled audits on."),await L()}catch{g(!1),(0,c.toast)("could not turn that on.")}finally{S(!1)}},[L]),B=(0,a.useCallback)(async()=>{if(j){S(!0);try{let e=await l(!1);e.ok&&g(e.auto),(0,c.toast)("scheduled audits off."),await L()}catch{(0,c.toast)("could not turn that off.")}finally{S(!1)}return}U?await W():E(!0)},[j,W,L,U]),K=(0,a.useCallback)(async e=>{S(!0);try{let t=await i(e);k(t.intervalDays),w(e=>e?{...e,intervalDays:t.intervalDays}:e),(0,c.toast)(`scanning every ${t.intervalDays} day${1===t.intervalDays?"":"s"}.`)}catch{k(x?.intervalDays??7),(0,c.toast)("could not save that.")}finally{S(!1)}},[x?.intervalDays]),H=(0,a.useCallback)(async()=>{S(!0);try{await fetch("/api/auth/logout",{method:"POST"}),(0,c.toast)("signed out. scans continue; digests pause."),await L()}catch{(0,c.toast)("could not sign out.")}finally{S(!1)}},[L]),V=(0,a.useCallback)(async()=>{if(!C){M(!0);try{await (0,r.triggerRun)({cli:[],since:"all",noCache:!1}),(0,c.toast)("scan complete."),await L()}catch(e){(0,c.toast)(e instanceof r.RerunError&&"timeout"===e.kind?"the scan is taking a while — it will finish in the background.":"the scan could not be completed.")}finally{M(!1)}}},[L,C]),Y=(0,a.useCallback)(async e=>{E(!1),await L(),await W()},[W,L]),z=x?F?{value:"running",sub:null!=x.daemonStartedAtMs&&D>0?`up ${function(e){let t=Math.floor(e/864e5);if(t>0)return`${t}d`;let a=Math.floor(e/36e5);return a>0?`${a}h`:`${Math.max(1,Math.floor(e/6e4))}m`}(Math.max(0,D-x.daemonStartedAtMs))}`:"",tone:"ok"}:O?{value:"unavailable",sub:"not on this platform"}:"not-installed"===x.daemon?{value:"not installed",sub:"run failproofai config",tone:"warn"}:"unknown"===x.daemon?{value:"unknown",sub:"could not read it"}:{value:"stopped",sub:"run failproofai config",tone:"warn"}:{value:"…",sub:"reading"},G=j?P?.nextDueAtMs==null?{value:"pending",sub:"after the next scan"}:{value:D>0?h(P.nextDueAtMs,D):"—",sub:u(P.nextDueAtMs)}:{value:"off",sub:"nothing scheduled"},Q=q?{value:(0,d.formatRelativeTime)(Date.parse(q.finishedAt)),sub:null!=q.sessionsScanned?`${m(q.sessionsScanned)} sessions`:"scanned"}:{value:"none yet",sub:"run one below"},X=q?null==q.findings?{value:"—",sub:"unreadable"}:{value:m(q.findings),sub:"this scan",...q.findings>0?{tone:"warn"}:{}}:{value:"—",sub:"no scan yet"};return(0,t.jsxs)("main",{className:"report",children:[(0,t.jsxs)("section",{className:"section set-sec",children:[(0,t.jsxs)("div",{className:"set-mast",children:[(0,t.jsx)("h1",{className:"set-title",children:"settings"}),(0,t.jsx)("p",{className:"set-lede",children:"keeping watch, so you don't have to."})]}),A?(0,t.jsxs)("div",{className:"set-console",children:[(0,t.jsx)("div",{className:"set-cell",children:(0,t.jsxs)("p",{className:"set-warn",children:["could not read this machine's settings. check that the dashboard can reach ",(0,t.jsx)("code",{children:"~/.failproofai/config.json"}),"."]})}),s]}):(0,t.jsxs)("div",{className:"set-console",children:[(0,t.jsxs)("div",{className:"set-stats",children:[(0,t.jsx)(f,{label:"daemon",...z}),(0,t.jsx)(f,{label:"next scan",...G}),(0,t.jsx)(f,{label:"last scan",...Q}),(0,t.jsx)(f,{label:"findings",...X})]}),(0,t.jsxs)("div",{className:"set-cols",children:[(0,t.jsxs)("div",{className:"set-cell set-config",children:[(0,t.jsx)("h2",{className:"set-cell-title",children:"scheduled audit"}),(0,t.jsxs)("div",{className:"set-row set-row-main",children:[(0,t.jsx)(b,{enabled:j,disabled:N||null===x,onChange:()=>void B(),label:j?"turn off scheduled audits":"turn on scheduled audits"}),(0,t.jsxs)("div",{className:"set-row-copy",children:[(0,t.jsx)("span",{className:"set-strong",children:j?"scanning on a schedule.":"scan on a schedule."}),(0,t.jsx)("span",{className:"set-dim",children:j?"you'll get an email only when a scan finds something.":"off. nothing runs and nothing is sent."})]})]}),(0,t.jsxs)("div",{className:"set-row set-row-interval",children:[(0,t.jsx)("span",{className:"set-dim",children:"scan every"}),(0,t.jsx)("input",{type:"number",className:"set-num",min:1,max:90,value:y,disabled:N||null===x,"aria-label":"days between scheduled scans",onChange:e=>k(Number(e.target.value)),onBlur:e=>{let t=Number(e.target.value);Number.isFinite(t)?t!==x?.intervalDays&&K(t):k(x?.intervalDays??7)}}),(0,t.jsx)("span",{className:"set-dim",children:"days"}),(0,t.jsxs)("span",{className:"set-hint",children:[1,"–",90]})]}),(0,t.jsx)("div",{className:"set-rule"}),(0,t.jsx)("div",{className:"set-row set-row-identity",children:U?(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)("span",{className:"set-dim",children:"reports go to"}),(0,t.jsx)("span",{className:"set-email",children:U.email}),(0,t.jsx)("button",{type:"button",className:"set-link",disabled:N,onClick:()=>void H(),children:"sign out"})]}):j?(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)("span",{className:"set-warn",children:"signed out — scans continue, digests are paused."}),(0,t.jsx)("button",{type:"button",className:"set-link",disabled:N,onClick:()=>E(!0),children:"sign in to resume"})]}):(0,t.jsx)("span",{className:"set-dim",children:"turning this on asks for an email, so there is somewhere to send the report."})}),j&&x&&!F&&(0,t.jsx)("p",{className:"set-warn",children:O?"the background service isn't available on this platform, so scheduled scans can't run here. you can still run one now.":"not-installed"===x.daemon?"the background service isn't installed, so nothing will run on the timer. install it with `failproofai config`.":"the background service is stopped, so nothing will run until it starts. repair it with `failproofai config`."}),J&&(0,t.jsxs)("p",{className:"set-warn",children:["the last scheduled scan exited ",P?.lastExitCode,". the next one will still run."]}),(0,t.jsx)("div",{className:"set-actions",children:(0,t.jsx)("button",{type:"button",className:"btn btn-press",disabled:C,onClick:()=>void V(),children:C?"[ scanning… ]":"[ run a scan now ]"})})]}),(0,t.jsxs)("div",{className:"set-cell set-how",children:[(0,t.jsx)("h2",{className:"set-cell-title",children:"how it works"}),(0,t.jsx)("dl",{className:"set-how-list",children:p.map(e=>(0,t.jsxs)("div",{className:"set-how-row",children:[(0,t.jsx)("dt",{className:"set-how-label",children:e.label}),(0,t.jsx)("dd",{className:"set-how-body",children:e.body})]},e.label))})]})]}),s]}),j&&D>0&&(0,t.jsx)(v,{lastRunAtMs:P?.lastRunAtMs??null,nextDueAtMs:P?.nextDueAtMs??null,now:D})]}),(0,t.jsx)(o.AuthDialog,{open:$,source:"settings_scheduled_audit",headline:"where should the report go?",subhead:"we'll send a one-time code to confirm.",onClose:()=>E(!1),onAuthed:e=>void Y(e)})]})}],93237)},29054,e=>{"use strict";e.s(["fetchWithTimeout",0,function(e,t={},a=15e3){let s=AbortSignal.timeout(a),n=t.signal?AbortSignal.any([t.signal,s]):s;return fetch(e,{...t,signal:n})},"isAbortError",0,function(e){if(null===e||"object"!=typeof e)return!1;let t=e.name;return"AbortError"===t||"TimeoutError"===t}])},34713,e=>{"use strict";e.s(["formatDuration",0,function(e){if(e<1e3)return`${e}ms`;let t=Math.round(e/100);if(t<600)return`${(t/10).toFixed(1)}s`;let a=Math.round(e/1e3);if(a<3600){let e=Math.floor(a/60);return`${e}m ${a%60}s`}let s=Math.round(e/6e4),n=Math.floor(s/60);return`${n}h ${s%60}m`},"formatRelativeTime",0,function(e){let t=Date.now()-e;return t<6e4?`${Math.max(1,Math.floor(t/1e3))}s ago`:t<36e5?`${Math.floor(t/6e4)}m ago`:t<864e5?`${Math.floor(t/36e5)}h ago`:`${Math.floor(t/864e5)}d ago`}])}]);

package/.next/standalone/app/actions/get-jev-config.ts

@@ -1,409 +0,0 @@
-"use server";
-
-/**
- * Read side of the /settings "Jev" section. Writes live in
- * `update-jev-config.ts`, mirroring the get-scheduled-audit /
- * update-scheduled-audit split next door.
- *
- * ## CLI ⟷ dashboard parity
- *
- * Every field comes from the same `~/.failproofai/jev.json` the hooks read, via
- * the same `inspectJevConfig()` that backs `failproofai jev status` — so the
- * two surfaces cannot disagree about what is configured, and neither can
- * disagree with what a hook will actually do on the next tool call. There is no
- * dashboard-side copy of this state.
- *
- * ## The token never comes back
- *
- * This is the rule the whole module is built around: nothing returned here
- * carries the API key, not even from a file the loader refused. The view has a
- * `token` field, and it holds a SOURCE and at most the last four characters —
- * enough for a person to recognise which key they stored, useless to anyone who
- * did not already have it. A GET that returns the key would hand it to any page
- * that can reach this origin, and the dashboard has no authentication.
- *
- * So the routing fields of a refused file are copied out one by one
- * (`routingFromRaw`) rather than spread: a spread is how `apiKey` gets carried
- * along by accident the next time someone adds a field.
- *
- * ## …and neither does the model
- *
- * `model` is the one routing field that holds a free string a person types next
- * to their key, and `--model <key>` is one slip away from `--token <key>`. The
- * loader refuses such a file (`validateModel` knows the shape), and a refused
- * file's routing is exactly what this module hands back so the owner can see
- * and repair it — which would have carried the probable key into the browser
- * while the very same response said the key never comes back. So the model is
- * treated as the token is, rather than masked: `modelView()` returns the stored
- * string only where it cannot be a credential, and otherwise reports presence
- * alone. A mask would be worse on both counts — it still hands over a piece of
- * a key, and the last four characters of a model id tell nobody anything.
- *
- * It is a shape test, so it is not a proof: a short secret with no known prefix
- * can still look like a model id, and the honest bound is "the file the loader
- * would refuse cannot be echoed". Anything the loader ACCEPTS as a model is a
- * value `jev setup` would also have printed. See `JevModelView`.
- */
-
-import {
-  DEFAULT_JEV_MODE,
-  JEV_API_KEY_ENV,
-  JEV_PROVIDER_KINDS,
-  inspectJevConfig,
-  looksLikeCredential,
-  readJevConfigForUpdate,
-  type JevConfig,
-  type JevProviderKind,
-} from "@/src/hooks/semantic/jev-config";
-import { displayEndpoint, jevRoute } from "@/src/hooks/semantic/jev-client";
-import { jevStats } from "@/src/hooks/semantic/jev-stats";
-import {
-  reviewableProblem,
-  reviewableSummary,
-  surveyReviewableCoverage,
-} from "@/src/hooks/policy-reviewability";
-
-/** The loader's four answers, unchanged — see `JevConfigInspection`. */
-export type JevSettingsStatus = "absent" | "ok" | "key-missing" | "refused";
-
-/** What Jev has been doing lately, from `jevStats()`. Not a new pipeline. */
-export interface JevSettingsStats {
-  windowMs: number;
-  /** Gate evaluations Jev was consulted on: answered or fell back. */
-  total: number;
-  answered: number;
-  fallbacks: number;
-  /** Share of `total` that fell back to the regex engine, 0..1. */
-  fallbackRate: number;
-}
-
-/**
- * Presence of a stored key, never the key.
- *
- * `hint` is the last four characters, and only for a key long enough that four
- * characters are a negligible share of it. A short key gets no hint at all
- * rather than a proportionally large piece of itself.
- */
-export interface JevTokenPresence {
-  source: "file" | "env";
-  hint: string | null;
-}
-
-/**
- * What the panel may say about the stored model id.
- *
- *   - `default`  — nothing is stored, so the provider's own default is used.
- *   - `id`       — a stored value that is a model id, shown as itself.
- *   - `withheld` — something is stored that does not look like a model id, so it
- *                  is reported the way a token is: present, never quoted.
- *
- * The decision is `looksLikeCredential()`, the loader's own predicate for "this
- * is a key, not a model id" — the one that refuses the file in the first place,
- * not a second rule invented here. It has two deliberate carve-outs so it does
- * not refuse real ids (a `/`, which every gateway-qualified id has, and the
- * letters "jev"), and a base64 key can contain a `/`, so length is checked too:
- * every id Jev is addressed by is short — `jev-1.13.0`, `typesafe/jev-1.13`,
- * `@cf/typesafe/jev-1.13` — and nothing longer is worth showing at the risk of
- * it being a key.
- */
-export type JevModelView =
-  | { kind: "default" }
-  | { kind: "id"; id: string }
-  | { kind: "withheld" };
-
-/**
- * How much of this machine's enabled policy set Jev is allowed to CLEAR.
- *
- * The panel says whether Jev is on; this is what says whether the half of it
- * that clears a verdict can fire at all. A pack published before this release
- * declares no `authority`, every policy in it is therefore `hard`, and a
- * machine in that state looks perfect from every other field on the panel — the
- * endpoint answers, the fallback rate is fine, and no deny is ever cleared. See
- * `src/hooks/policy-reviewability.ts` for what is counted.
- *
- * The two sentences are computed there rather than here, so this panel and
- * `failproofai jev status` say the same thing in the same words — the same rule
- * the rest of this module follows for everything it reports.
- */
-export interface JevReviewabilityView {
-  /** Enabled policies whose authority could be read without running code. */
-  enabled: number;
-  /** Of those, the ones Jev may clear. */
-  reviewable: number;
-  /** The count, as one line. */
-  summary: string;
-  /** Why nothing can be cleared, and what fixes it; null when something can. */
-  problem: string | null;
-}
-
-export interface JevSettingsView {
-  status: JevSettingsStatus;
-  /** True only when a hook running right now would consult Jev. */
-  on: boolean;
-  /** `~/.failproofai/jev.json`, whether or not it exists. */
-  path: string;
-  /** The file's permission bits as `0600`, or null when it has none to show. */
-  permissions: string | null;
-  provider: JevProviderKind | null;
-  /** The stored base URL, or "" for the provider's own API. Form value. */
-  baseUrl: string;
-  /** Cloudflare only; "" otherwise. Form value. */
-  accountId: string;
-  /**
-   * The stored model, for DISPLAY only — never a form value, and never the
-   * stored string when that string could be a key. The form does not offer this
-   * field and the save path leaves it alone (see `update-jev-config.ts`), so
-   * nothing needs it back to round-trip it.
-   */
-  model: JevModelView;
-  /** Where requests actually go, query string elided. Null when unroutable. */
-  endpoint: string | null;
-  mode: NonNullable<JevConfig["mode"]>;
-  timeoutMs: number | null;
-  token: JevTokenPresence | null;
-  /** The loader's own words for why this file is refused or incomplete. */
-  problem: string | null;
-  /** The command that fixes it, when there is one. */
-  fix: string | null;
-  stats: JevSettingsStats | null;
-  /** What Jev may clear here. Null when Jev is off, or when it could not be read. */
-  reviewable: JevReviewabilityView | null;
-}
-
-const MIN_HINTABLE_KEY_LENGTH = 12;
-
-/**
- * Fills the key slot when a route is computed for DISPLAY only. The key does
- * not decide where requests go, but `jevRoute` validates the whole config
- * before answering, so a config whose key lives in the environment — or one the
- * loader refused — needs something in the field to get an endpoint out. Never
- * written, never sent.
- */
-const KEY_STAND_IN = "display-only";
-
-/** The last four characters of a key, or null when the key is too short to spare them. */
-function maskedHint(key: string): string | null {
-  return key.length >= MIN_HINTABLE_KEY_LENGTH ? key.slice(-4) : null;
-}
-
-/** Longer than any model id a Jev route knows, and well inside a pasted key's length. */
-const MAX_SHOWABLE_MODEL_LENGTH = 40;
-
-/** The stored model as the panel may see it — see `JevModelView` for the rule. */
-function modelView(stored: string): JevModelView {
-  if (!stored) return { kind: "default" };
-  if (stored.length > MAX_SHOWABLE_MODEL_LENGTH || looksLikeCredential(stored)) {
-    return { kind: "withheld" };
-  }
-  return { kind: "id", id: stored };
-}
-
-function octal(mode: number | null): string | null {
-  return mode === null ? null : mode.toString(8).padStart(4, "0");
-}
-
-function asString(v: unknown): string {
-  return typeof v === "string" ? v : "";
-}
-
-/**
- * The routing fields of a raw `jev.json`, for a file the loader refused — so
- * the panel can show what it names and the form can offer it back for repair.
- *
- * Copied field by field, deliberately. `apiKey` is the reason: a spread of the
- * parsed object would carry it into a value this module hands to the browser,
- * and it would keep doing so silently as fields are added.
- */
-function routingFromRaw(raw: Record<string, unknown> | null): {
-  provider: JevProviderKind | null;
-  baseUrl: string;
-  accountId: string;
-  model: string;
-  mode: NonNullable<JevConfig["mode"]>;
-} {
-  const providerRaw = asString(raw?.provider);
-  const provider = (JEV_PROVIDER_KINDS as readonly string[]).includes(providerRaw)
-    ? (providerRaw as JevProviderKind)
-    : null;
-  const modeRaw = raw?.mode;
-  return {
-    provider,
-    baseUrl: asString(raw?.baseUrl),
-    accountId: asString(raw?.accountId),
-    model: asString(raw?.model),
-    mode: modeRaw === "shadow" || modeRaw === "enforce" ? modeRaw : DEFAULT_JEV_MODE,
-  };
-}
-
-/** `jevRoute` for display, swallowing the throw a file that names no usable route produces. */
-function endpointFor(cfg: JevConfig): string | null {
-  try {
-    return displayEndpoint(jevRoute(cfg).endpoint);
-  } catch {
-    return null;
-  }
-}
-
-/**
- * The fallback rate and the counts behind it, for the one line on the panel
- * that says whether Jev is working. Read only when Jev is actually on: on a
- * machine with no config the numbers are all zero and the line would be noise.
- *
- * `jevStats()` never throws and derives from the activity store the activity
- * tab already reads, so this adds no pipeline and no persisted state.
- */
-async function statsOrNull(on: boolean): Promise<JevSettingsStats | null> {
-  if (!on) return null;
-  try {
-    const s = await jevStats();
-    return {
-      windowMs: s.windowMs,
-      total: s.total,
-      answered: s.answered,
-      fallbacks: s.fallbacks,
-      fallbackRate: s.fallbackRate,
-    };
-  } catch {
-    // The panel renders without the line rather than without the panel.
-    return null;
-  }
-}
-
-/**
- * The authority counts, for a machine where a clear could actually happen.
- *
- * Off means the regex policies decide whatever any policy's authority says, so
- * there is nothing to report and the panel shows no row. Never throws, for the
- * same reason `statsOrNull` does not: the panel renders without the line rather
- * than without the panel.
- */
-function reviewableOrNull(on: boolean): JevReviewabilityView | null {
-  if (!on) return null;
-  try {
-    const coverage = surveyReviewableCoverage();
-    return {
-      enabled: coverage.enabled,
-      reviewable: coverage.reviewable,
-      summary: reviewableSummary(coverage),
-      problem: reviewableProblem(coverage),
-    };
-  } catch {
-    return null;
-  }
-}
-
-/**
- * Everything /settings shows about Jev, and nothing it must not.
- *
- * Never throws: every branch of `inspectJevConfig` is a state the panel can
- * draw, and a settings page whose job is to say whether a security feature is
- * on must not be replaced by an error boundary when the answer is "badly".
- */
-export async function getJevSettingsAction(): Promise<JevSettingsView> {
-  const inspection = inspectJevConfig();
-  const base = {
-    path: inspection.path,
-    permissions: null as string | null,
-    provider: null as JevProviderKind | null,
-    baseUrl: "",
-    accountId: "",
-    model: { kind: "default" } as JevModelView,
-    endpoint: null as string | null,
-    mode: DEFAULT_JEV_MODE,
-    timeoutMs: null as number | null,
-    token: null as JevTokenPresence | null,
-    problem: null as string | null,
-    fix: null as string | null,
-    reviewable: null as JevReviewabilityView | null,
-  };
-
-  if (inspection.status === "ok") {
-    const cfg = inspection.config;
-    return {
-      ...base,
-      status: "ok",
-      on: true,
-      permissions: octal(inspection.mode),
-      provider: cfg.provider,
-      baseUrl: cfg.baseUrl ?? "",
-      accountId: cfg.accountId ?? "",
-      // A loadable config's model already passed `validateModel`, so this can
-      // only be an id — run through the same gate anyway, because the gate is
-      // what keeps that true if the loader's rules ever loosen.
-      model: modelView(cfg.model ?? ""),
-      endpoint: endpointFor(cfg),
-      mode: cfg.mode ?? DEFAULT_JEV_MODE,
-      timeoutMs: cfg.timeoutMs ?? null,
-      // The only place a key is touched on this path, and only its length and
-      // last four characters leave the function.
-      token: { source: inspection.keySource, hint: maskedHint(cfg.apiKey) },
-      stats: await statsOrNull(true),
-      reviewable: reviewableOrNull(true),
-    };
-  }
-
-  if (inspection.status === "key-missing") {
-    const r = inspection.routing;
-    return {
-      ...base,
-      status: "key-missing",
-      on: false,
-      permissions: octal(inspection.mode),
-      provider: r.provider,
-      baseUrl: r.baseUrl ?? "",
-      accountId: r.accountId ?? "",
-      model: modelView(r.model ?? ""),
-      endpoint: endpointFor({ ...r, apiKey: KEY_STAND_IN }),
-      mode: r.mode ?? DEFAULT_JEV_MODE,
-      timeoutMs: r.timeoutMs ?? null,
-      // The file names the environment as the source and the variable is not
-      // set here, so there is nothing present to hint at.
-      token: null,
-      problem: inspection.problem,
-      fix: `set ${JEV_API_KEY_ENV}, or save a token here`,
-      stats: null,
-    };
-  }
-
-  if (inspection.status === "refused") {
-    // Show what the file names so the owner can see whether the endpoint is one
-    // they chose — the same question `jev status` puts to them. Routing only.
-    const r = routingFromRaw(readJevConfigForUpdate());
-    return {
-      ...base,
-      status: "refused",
-      on: false,
-      permissions: octal(inspection.mode),
-      provider: r.provider,
-      baseUrl: r.baseUrl,
-      accountId: r.accountId,
-      // This is the branch the rule exists for: a file whose `model` slot holds
-      // a pasted key IS a refused file, and these fields are copied raw.
-      model: modelView(r.model),
-      // Shown for the same reason `jev status` shows it: the owner needs to see
-      // whether the endpoint a file they may not have written names is one they
-      // chose. Null when the routing fields do not make a usable route.
-      //
-      // The model is left out of this probe deliberately. It does not appear in
-      // any endpoint — `jevRoute` puts it in the request body, not the URL — but
-      // `jevRoute` validates the whole config first, so a refused model would
-      // hide the one field the owner is being asked to check.
-      endpoint:
-        r.provider === null
-          ? null
-          : endpointFor({
-              provider: r.provider,
-              apiKey: KEY_STAND_IN,
-              ...(r.baseUrl ? { baseUrl: r.baseUrl } : {}),
-              ...(r.accountId ? { accountId: r.accountId } : {}),
-              mode: r.mode,
-            }),
-      mode: r.mode,
-      problem: inspection.problem,
-      fix: inspection.fix ?? null,
-      stats: null,
-    };
-  }
-
-  return { ...base, status: "absent", on: false, stats: null };
-}