failproofai 1.0.7-beta.2 → 1.0.8-beta.0

package/.next/standalone/app/settings/jev-panel.tsx

@@ -47,6 +47,21 @@
  * Client-side validation here is a convenience only. Every rule — the URL
  * scheme, plain http being refused outside shadow mode, cloudflare's account id
  * — is enforced server-side by the same `validateJevConfig` the loader runs.
+ *
+ * ## FailproofAI Cloud
+ *
+ * When `jev.json` names the FailproofAI Cloud provider, the endpoint and the
+ * key are not this page's to edit: both come from the machine's connection
+ * (`config --token`). So the form is replaced by the two controls that are
+ * the owner's — an on/off switch and shadow/enforce — both through
+ * `setJevModeAction`, which rewrites `mode` and nothing else. "Off" there keeps
+ * the file (`mode: "off"`): deleting it would leave nothing on this page to
+ * switch back on — the only way to get the file back would be re-running
+ * `config --token` with the key.
+ *
+ * The connection itself — org, and whether the key carries Jev — is one row,
+ * read from `credentials.json` by the server with no network call; the key is
+ * never part of what this component receives.
  */
 
 import { useCallback, useEffect, useRef, useState, type ReactNode } from "react";
@@ -58,6 +73,7 @@ import {
 import {
   removeJevConfigAction,
   saveJevConfigAction,
+  setJevModeAction,
 } from "@/app/actions/update-jev-config";
 import { toast } from "@/app/components/toast";
 
@@ -72,8 +88,32 @@ const PROVIDERS = [
 const MODES = [
   { value: "enforce", label: "enforce — jev's verdict counts" },
   { value: "shadow", label: "shadow — log only, regex decides" },
+  { value: "off", label: "off — keep this config, don't ask jev" },
 ] as const;
 
+/** The provider whose endpoint and key come from the FailproofAI Cloud connection. */
+const CLOUD_PROVIDER = "failproofai";
+
+/** What a provider is called on this page. */
+function providerName(provider: string | null): string {
+  return provider === CLOUD_PROVIDER ? "FailproofAI Cloud" : (provider ?? "");
+}
+
+/** The connection row: org, and whether the key carries Jev. No key, ever. */
+function fmtConnection(cloud: JevSettingsView["cloud"] | undefined): string {
+  if (!cloud || !cloud.connected) {
+    return cloud?.jev === "yes" ? "a jev key is stored, but no connection is" : "not connected";
+  }
+  const where = cloud.org ?? cloud.host ?? "connected";
+  const jev =
+    cloud.jev === "yes"
+      ? "key carries jev"
+      : cloud.jev === "refused"
+        ? "jev key refused — credentials.json is not owner-only"
+        : "no jev key stored";
+  return `connected to ${where} · ${jev}`;
+}
+
 /** "24h" / "7d" / "30m", for the stats window. */
 function fmtWindow(ms: number): string {
   const h = ms / 3_600_000;
@@ -113,7 +153,8 @@ interface FormState {
 
 function formFrom(view: JevSettingsView): FormState {
   return {
-    provider: view.provider ?? "typesafe",
+    // The form is the BYOK form: the Cloud provider is never one of its values.
+    provider: view.provider && view.provider !== CLOUD_PROVIDER ? view.provider : "typesafe",
     baseUrl: view.baseUrl,
     accountId: view.accountId,
     mode: view.mode,
@@ -237,6 +278,30 @@ export default function JevPanel({ initial }: { initial: JevSettingsView | null
     }
   }, [form, token]);
 
+  /**
+   * The FailproofAI Cloud switch: `off`, `shadow` or `enforce`, and nothing
+   * else about the file changes (see `setJevModeAction`).
+   */
+  const onMode = useCallback(async (mode: "off" | "shadow" | "enforce") => {
+    setBusy(true);
+    setProblem(null);
+    try {
+      const res = await setJevModeAction(mode);
+      if (!res.ok) {
+        setProblem(res.problem);
+        return;
+      }
+      dirty.current = false;
+      setView(res.view);
+      setForm(formFrom(res.view));
+      toast(mode === "off" ? "jev is off. hooks run the regex policies." : `jev is on, in ${mode} mode.`);
+    } catch {
+      setProblem("could not switch that.");
+    } finally {
+      setBusy(false);
+    }
+  }, []);
+
   const onRemove = useCallback(async () => {
     setBusy(true);
     setProblem(null);
@@ -260,11 +325,14 @@ export default function JevPanel({ initial }: { initial: JevSettingsView | null
   }, []);
 
   const configured = view !== null && view.status !== "absent";
+  const cloudRoute = view?.provider === CLOUD_PROVIDER;
   const stored = view?.token;
   const tokenHint = needsToken
     ? "needed for this save — type the token for this endpoint"
     : stored
-      ? stored.source === "env"
+      ? stored.source === "cloud"
+        ? "from this machine's FailproofAI Cloud connection"
+        : stored.source === "env"
         ? "configured, read from the environment — leave blank to keep it"
         : // Presence and the keep rule, which is everything this field's reader
           // has to decide. Naming the last four characters of the stored key
@@ -289,15 +357,27 @@ export default function JevPanel({ initial }: { initial: JevSettingsView | null
             {view === null
               ? "reading…"
               : view.on
-                ? `on. every judged command is also asked of ${view.provider}.`
-                : "off. hooks run the regex policies exactly as before."}
+                ? `on. every judged command is also asked of ${providerName(view.provider)}.`
+                : view.status === "off"
+                  ? "off — switched off. hooks run the regex policies exactly as before."
+                  : view.status === "not-connected"
+                    ? "off — this machine is not connected to FailproofAI Cloud. hooks run the regex policies."
+                    : view.status === "key-lacks-jev"
+                      ? "off — no jev key is stored for this machine's FailproofAI Cloud connection. hooks run the regex policies."
+                      : view.status === "key-missing"
+                        ? // The CLI's "off in this shell": the key is read by whatever
+                          // runs the hook, and this server's environment is not that.
+                          "off for this dashboard — FAILPROOFAI_JEV_API_KEY is not set in its environment. hooks run the regex policies wherever it is unset, including under the daemon; a session that sets it still consults jev."
+                        : "off. hooks run the regex policies exactly as before."}
           </span>
           <span className="set-dim">
             {view?.on
               ? view.mode === "shadow"
                 ? "shadow: jev's answers are logged, the regex result is what gets enforced."
                 : "enforce: jev's answers can clear a reviewable deny."
-              : "a second opinion on the commands the regex policies flag. needs your own endpoint and token."}
+              : cloudRoute
+                ? "through FailproofAI Cloud, on your org's plan — no endpoint or token of your own."
+                : "a second opinion on the commands the regex policies flag. needs your own endpoint and token."}
           </span>
         </div>
       </div>
@@ -308,8 +388,28 @@ export default function JevPanel({ initial }: { initial: JevSettingsView | null
           same per-account address, and the account id inside it, a second time
           on one screen. The path of the config file and its mode were here too;
           nobody acts on either from a browser. */}
+      {/* The FailproofAI Cloud connection, on every state: whether this
+          machine could run Jev through the Cloud is worth knowing before it
+          does. Org and a yes/no, never a key. */}
+      {view && (
+        <dl className="set-how-list set-jev-cloud">
+          <div className="set-how-row">
+            <dt className="set-how-label">FailproofAI Cloud connection</dt>
+            <dd className="set-how-body">{fmtConnection(view.cloud)}</dd>
+          </div>
+        </dl>
+      )}
+
       {view && configured && (
         <dl className="set-how-list">
+          {cloudRoute && (
+            <div className="set-how-row">
+              <dt className="set-how-label">provider</dt>
+              <dd className="set-how-body">
+                {view.cloud?.host ? `FailproofAI Cloud · ${view.cloud.host}` : "FailproofAI Cloud"}
+              </dd>
+            </div>
+          )}
           <div className="set-how-row">
             <dt className="set-how-label">model</dt>
             <dd className="set-how-body">{fmtModel(view.model)}</dd>
@@ -322,10 +422,16 @@ export default function JevPanel({ initial }: { initial: JevSettingsView | null
             <dt className="set-how-label">token</dt>
             <dd className="set-how-body">
               {stored
-                ? stored.source === "env"
-                  ? "from FAILPROOFAI_JEV_API_KEY"
-                  : "configured"
-                : "none stored"}
+                ? stored.source === "cloud"
+                  ? "FailproofAI Cloud connection"
+                  : stored.source === "env"
+                    ? "from FAILPROOFAI_JEV_API_KEY"
+                    : "configured"
+                : cloudRoute
+                  ? view.cloud?.connected
+                    ? "none stored for this connection"
+                    : "none — this machine is not connected"
+                  : "none stored"}
             </dd>
           </div>
           {view.reviewable && (
@@ -366,6 +472,45 @@ export default function JevPanel({ initial }: { initial: JevSettingsView | null
 
       <div className="set-rule" />
 
+      {cloudRoute ? (
+        <>
+          <div className="set-jev-fields">
+            <Field
+              id="jev-cloud-mode"
+              label="mode"
+              hint="the endpoint and key come from this machine's FailproofAI Cloud connection"
+            >
+              <select
+                id="jev-cloud-mode"
+                className="set-select"
+                value={view?.mode === "enforce" ? "enforce" : "shadow"}
+                disabled={busy || view?.mode === "off"}
+                onChange={(e) => void onMode(e.target.value === "enforce" ? "enforce" : "shadow")}
+              >
+                {MODES.filter((m) => m.value !== "off").map((m) => (
+                  <option key={m.value} value={m.value}>
+                    {m.label}
+                  </option>
+                ))}
+              </select>
+            </Field>
+          </div>
+
+          {problem && <p className="set-warn">{problem}</p>}
+
+          <div className="set-actions set-jev-actions">
+            <button
+              type="button"
+              className="btn btn-press"
+              disabled={busy}
+              onClick={() => void onMode(view?.mode === "off" ? "shadow" : "off")}
+            >
+              {busy ? "[ switching… ]" : view?.mode === "off" ? "[ turn jev on ]" : "[ turn jev off ]"}
+            </button>
+          </div>
+        </>
+      ) : (
+      <>
       <div className="set-jev-fields">
         <Field id="jev-provider" label="provider">
           <select
@@ -386,11 +531,21 @@ export default function JevPanel({ initial }: { initial: JevSettingsView | null
         <Field
           id="jev-url"
           label="endpoint url"
-          hint={
+          hint={[
             form.provider === "custom"
               ? "required — https, or http to localhost in shadow mode"
-              : "leave blank for the provider's own api"
-          }
+              : "leave blank for the provider's own api",
+            // The stored query string is not sent to this page (see
+            // `baseUrlView` in `get-jev-config.ts`), so the field holds the URL
+            // without it. Said out loud, because the alternative is a field that
+            // silently disagrees with the file and a save that looks like it
+            // kept something the person was never shown.
+            view?.baseUrlQueryWithheld
+              ? "the stored url's query string is not shown here — leave the url as it is to keep it"
+              : null,
+          ]
+            .filter(Boolean)
+            .join(" · ")}
         >
           <input
             id="jev-url"
@@ -468,6 +623,8 @@ export default function JevPanel({ initial }: { initial: JevSettingsView | null
           </button>
         )}
       </div>
+      </>
+      )}
     </div>
   );
 }

package/.next/standalone/fp-cloud-cli/CHANGELOG.md

@@ -2,10 +2,28 @@
 
 ## 0.0.2b0 — 2026-09-22
 
-Open for the next release. `0.0.1` published on 2026-09-22 and the `bump` job
-moved the version here automatically; nothing has landed against `0.0.2b0` yet.
-Add entries as changes merge — this section becomes the GitHub Release body when
-it ships.
+### Added
+
+- `jev:evaluate` is a known permission — Jev through FailproofAI Cloud, charged to the
+  org's plan — so `fp keys` and `fp users` accept it instead of refusing it as unknown,
+  and the `admin` preset carries it, as the server's built-in admin set now does. The
+  server refuses a KEY carrying it without both `events:add` and `policies:pull` (422,
+  naming what to add in `missing_permissions`); the `admin` preset has both. (#833)
+- `fp keys create/update --permission-set machine`: the dashboard's key-only preset
+  (`events:add` + `policies:pull` + `jev:evaluate`), for an enrolled machine using Jev through
+  FailproofAI Cloud. `fp keys` also refuses `jev:evaluate` without both prerequisites itself
+  (exit 2, naming what is missing) instead of sending the key for the server's 422. (#833)
+
+### Changed
+
+- `fp policies publish` (and `policies compose --publish`) refuses a source carrying Jev
+  fields a cloud policy never reads — a `semanticPolicies.add(...)` call, or a registration
+  declaring `authority: "reviewable"` — before anything is sent (exit 1, `--no-verify` does
+  not skip it). Both were published as versions that read Jev-aware and are not: semantic
+  checks load only from a pack, and a cloud policy's authority comes from its deployment, so
+  it stays hard. Ship Jev checks in a pack with `failproofai publish`. Same rule, and the
+  same comment-aware detection, as the dashboard's publish form; the server does not read
+  the source, so nothing else refuses it for `fp`. (#833)
 
 ## 0.0.1 — 2026-09-22
 

package/.next/standalone/fp-cloud-cli/fp_cli/client.py

@@ -34,6 +34,7 @@ from .errors import (
     NetworkError,
     NotFoundError,
 )
+from .policy_check import cloud_publish_problem
 from .models import (
     AgentEvent,
     Alert,
@@ -1601,7 +1602,19 @@ def list_policies(ctx: ClientContext) -> List[PolicyVersion]:
 def publish_policy(
     ctx: ClientContext, policy_id: str, source: str, description: str = ""
 ) -> PolicyVersion:
-    """POST /api/enforcement/policies — mints a NEW VERSION; never edits in place."""
+    """POST /api/enforcement/policies — mints a NEW VERSION; never edits in place.
+
+    Refuses Jev fields a cloud policy never reads before anything is sent, here
+    because `policies publish` and `policies compose --publish` both route through
+    it — and regardless of `--no-verify`, which only skips the syntax check.
+    """
+    problem = cloud_publish_problem(source)
+    if problem:
+        raise ApiError(
+            f"{policy_id} cannot be published as a cloud policy: {problem}",
+            hint=("Jev checks ship in a failproofai pack — `failproofai publish` — where "
+                  "semanticPolicies.add and authority: \"reviewable\" take effect"),
+        )
     body = {"id": policy_id, "source": source, "description": description}
     return PolicyVersion.from_dict(_post_json(ctx, "/api/enforcement/policies", body) or {})
 

package/.next/standalone/fp-cloud-cli/fp_cli/commands/keys_cmds.py

@@ -77,12 +77,24 @@ def _expand_key_set_or_exit(state: AppState, cctx, set_name: str) -> List[str]:
         return permissions.key_assignable_only(sets[set_name])
     if set_name in permissions.PRESETS:
         return permissions.key_assignable_only(permissions.PRESETS[set_name])
-    available = sorted(set(sets) | (set(permissions.PRESETS) - {"clear"}))
+    if set_name in permissions.KEY_PRESETS:
+        return list(permissions.KEY_PRESETS[set_name])
+    available = sorted(set(sets) | (set(permissions.PRESETS) - {"clear"}) | set(permissions.KEY_PRESETS))
     raise click.UsageError(
         f'unknown permission set "{set_name}". available: {", ".join(available)}'
     )
 
 
+def _check_jev_or_exit(perms) -> None:
+    """The server's 422 for jev:evaluate without its prerequisites, as a usage error (exit 2)
+    before anything is sent."""
+    missing = permissions.jev_requirements_missing(perms)
+    if missing:
+        raise click.UsageError(
+            f"jev:evaluate also requires events:add and policies:pull; missing: {', '.join(missing)}"
+        )
+
+
 def keys_list(
     ctx: typer.Context,
     show_id: bool = typer.Option(False, "--show-id", help="Prepend a short key-id column (the full id is always in --json)."),
@@ -142,7 +154,7 @@ def keys_show(
 def keys_create(
     ctx: typer.Context,
     name: str = typer.Argument(..., help="Human-readable key name (unique within the org)."),
-    permission_set: Optional[str] = typer.Option(None, "--permission-set", help="Role to seed the key from — a permission set: `read-only`, `standard`, `admin`, or a custom set your org defines in the dashboard. The set is expanded into the key's grants (human-only perms are dropped). Omit for no base role."),
+    permission_set: Optional[str] = typer.Option(None, "--permission-set", help="Role to seed the key from — a permission set: `read-only`, `standard`, `admin`, `machine` (events:add + policies:pull + jev:evaluate), or a custom set your org defines in the dashboard. The set is expanded into the key's grants (human-only perms are dropped). Omit for no base role."),
     add: Optional[List[str]] = typer.Option(None, "--add", help="Grant extra permissions on top of the set, as `slug:action.action` tokens (dotted actions expand: `events:read.add` → `events:read`, `events:add`). Several via comma, repeated flag, or a quoted group: `--add events:read,keys:read` · `--add a --add b` · `--add \"a b\"`."),
     remove: Optional[List[str]] = typer.Option(None, "--remove", help="Drop permissions from the set, same `slug:action.action` token format as --add (comma / repeated / quoted)."),
 ) -> None:
@@ -179,6 +191,7 @@ def keys_create(
         raise click.UsageError(f'a key named "{name}" already exists')
     base = _expand_key_set_or_exit(state, cctx, permission_set) if permission_set else []
     flat = sorted((set(base) | set(parsed_add)) - set(parsed_remove))
+    _check_jev_or_exit(flat)
     secret = secrets.token_hex(32)  # 64 hex chars, mirrors the dashboard's generateToken()
     result = api.create_key(cctx, name=name, key=secret, permissions=flat)
     _write.record_action("api_key_created", resource="key", success=True, permission_count=len(flat))
@@ -198,7 +211,7 @@ def keys_create(
 def keys_update(
     ctx: typer.Context,
     name: str = typer.Argument(..., help="Key name to update (unique within the org)."),
-    permission_set: Optional[str] = typer.Option(None, "--permission-set", help="Reseed the key from a permission set: `read-only`, `standard`, `admin`, or a custom org set. REPLACES the key's grants with the set (then applies any --add/--remove). Human-only perms are dropped."),
+    permission_set: Optional[str] = typer.Option(None, "--permission-set", help="Reseed the key from a permission set: `read-only`, `standard`, `admin`, `machine`, or a custom org set. REPLACES the key's grants with the set (then applies any --add/--remove). Human-only perms are dropped."),
     add: Optional[List[str]] = typer.Option(None, "--add", help="Grant permissions, same `slug:action.action` token format as `keys create` (dotted actions expand; comma / repeated flag / quoted compose). Incremental — merged into the key's CURRENT grants, unless --permission-set is also given."),
     remove: Optional[List[str]] = typer.Option(None, "--remove", help="Revoke permissions, same `slug:action.action` token format as --add. Incremental — applied to the key's CURRENT grants, unless --permission-set is also given."),
     yes: bool = typer.Option(False, "--yes", "-y", help="Skip the confirmation prompt. The prompt only appears on an interactive terminal: under --json, or with stdin redirected, this command proceeds without asking."),
@@ -267,6 +280,7 @@ def keys_update(
         else:
             output.key_no_change()
         return
+    _check_jev_or_exit(after_set)
 
     proceed = (not _write.should_prompt(state, yes)) or output.confirm_key_update(
         key.name, len(added), len(removed))

package/.next/standalone/fp-cloud-cli/fp_cli/commands/policies_cmds.py

@@ -116,6 +116,9 @@ def policies_publish(
     does this: the server validates the id and a size ceiling, and a broken
     policy otherwise fails on the machine at enforcement time. `--no-verify`
     skips it; a host without node publishes with a warning rather than a block.
+    Jev fields a cloud policy never reads (`semanticPolicies.add`, `authority:
+    "reviewable"`) are refused regardless — ship those in a pack with
+    `failproofai publish`.
 
     Source can come from a path, `@path`, a pipe, `-`, or an interactive paste
     when you give none and stdin is a terminal.

package/.next/standalone/fp-cloud-cli/fp_cli/permissions.py

@@ -48,6 +48,12 @@ ALL_PERMISSIONS: List[str] = [
     "policies:write",
     "policies:pull",
     "usage:read",
+    # Jev through FailproofAI Cloud, charged to the org's plan. The built-in
+    # admin set carries it, so PRESETS["admin"] below does too. The server
+    # refuses a KEY that carries it without both events:add and policies:pull
+    # (422, naming what to add in `missing_permissions`): a Jev key is always a
+    # machine's whole connection, never a Jev-only one.
+    "jev:evaluate",
     "orgs:admin",
 ]
 
@@ -103,6 +109,22 @@ PRESETS = {
     "clear": [],
 }
 
+# Key-only presets (dashboard/lib/keyPresets.ts). `machine` is an enrolled machine's whole
+# connection: events out, policy in, and Jev through FailproofAI Cloud (charged per call).
+KEY_PRESETS = {"machine": ["events:add", "policies:pull", "jev:evaluate"]}
+
+# What a key carrying jev:evaluate must also carry: the server refuses it otherwise (422,
+# `JEV_REQUIRES` in server/src/auth.rs), on create and on an update that drops one.
+JEV_REQUIRES = ["events:add", "policies:pull"]
+
+
+def jev_requirements_missing(perms) -> List[str]:
+    """The Jev prerequisites a key's grant list lacks (empty when it has no jev:evaluate)."""
+    if "jev:evaluate" not in perms:
+        return []
+    return [p for p in JEV_REQUIRES if p not in perms]
+
+
 _ASSIGNABLE_SET = frozenset(ASSIGNABLE_PERMISSIONS)
 
 # Permissions that parse + are user-assignable but must NEVER sit on an API key — the server's

package/.next/standalone/fp-cloud-cli/fp_cli/policy_check.py

@@ -288,3 +288,172 @@ def run_policy(
                    "at import time"),
         )
     return PolicyRun(ok=True, results=results)
+
+
+# ── Jev fields a cloud policy never reads ────────────────────────────────────
+#
+# A port of agenteye's `cloudPublishProblem` (dashboard/lib/policies/policyMeta.ts),
+# kept to the same rule and the same words so the dashboard and this CLI refuse the
+# same sources. The server never reads the source (its 422 is for body fields such
+# as `authority`, which the CLI does not send), so for `fp` this is the only guard.
+# Static by design: this reads source it must never run. Keep the two in step — a
+# change to one is a change to both.
+
+_MAX_SCAN = 200_000
+_ADD = "customPolicies.add("
+_ADD_CALL = re.compile(re.escape(_ADD))
+#: The whitespace JavaScript allows around `.` and `(`.
+_SEMANTIC_CALL = re.compile(r"semanticPolicies\s*\.\s*add\s*\(")
+#: After one of these, `/` is division, not the start of a regex literal.
+_VALUE_END = re.compile(r"[A-Za-z0-9_$)\]]")
+_KEY = re.compile(r"([A-Za-z_$][A-Za-z0-9_$]*)[ \t]*:")
+
+
+def _skip_trivia(s: str, i: int) -> int:
+    """Index of the next character that is code: past whitespace and comments."""
+    while True:
+        while i < len(s) and s[i].isspace():
+            i += 1
+        if s.startswith("//", i):
+            nl = s.find("\n", i)
+            if nl == -1:
+                return len(s)
+            i = nl + 1
+        elif s.startswith("/*", i):
+            end = s.find("*/", i + 2)
+            if end == -1:
+                return len(s)
+            i = end + 2
+        else:
+            return i
+
+
+def _end_of_regex(s: str, i: int, prev: str) -> int:
+    """Index past the regex literal at `i`, or -1 if none starts (or closes) there."""
+    if s[i] != "/" or _VALUE_END.match(prev):
+        return -1
+    j, in_class = i + 1, False
+    while j < len(s):
+        c = s[j]
+        if c == "\\":
+            j += 2
+            continue
+        if c == "\n":
+            return -1
+        if c == "[":
+            in_class = True
+        elif c == "]":
+            in_class = False
+        elif c == "/" and not in_class:
+            j += 1
+            while j < len(s) and "a" <= s[j] <= "z":
+                j += 1
+            return j
+        j += 1
+    return -1
+
+
+def _end_of_string(s: str, i: int) -> int:
+    """Index past the string literal at `i`, or -1 if it never closes."""
+    q, j = s[i], i + 1
+    while j < len(s):
+        if s[j] == "\\":
+            j += 2
+            continue
+        if s[j] == q:
+            return j + 1
+        j += 1
+    return -1
+
+
+def _find_call(s: str, call: "re.Pattern[str]", start: int = 0) -> int:
+    """Index of the first `call` that is code — not in a comment, string or regex."""
+    i, prev = start, ("(" if start > 0 else "")
+    for _ in range(_MAX_SCAN):
+        i = _skip_trivia(s, i)
+        if i >= len(s):
+            return -1
+        if call.match(s, i):
+            return i
+        end = _end_of_regex(s, i, prev)
+        if end != -1:
+            i, prev = end, "/"
+            continue
+        if s[i] in "\"'`":
+            end = _end_of_string(s, i)
+            if end == -1:
+                return -1  # unterminated: nothing after it is readable
+            i, prev = end, '"'
+            continue
+        prev = s[i]
+        i += 1
+    return -1
+
+
+def _direct_props(s: str, at: int) -> Dict[str, str]:
+    """The static string properties of the object passed to the `customPolicies.add(`
+    at `at` — direct ones only, never a key in `match`, `params` or the fn body.
+    Fails closed: anything unbalanced or unterminated reads as nothing."""
+    out: Dict[str, str] = {}
+    i = _skip_trivia(s, at + len(_ADD))
+    if i >= len(s) or s[i] != "{":
+        return out
+    i, depth, prev = i + 1, 1, "{"
+    while i < len(s) and depth > 0:
+        i = _skip_trivia(s, i)
+        if i >= len(s):
+            break
+        c = s[i]
+        end = _end_of_regex(s, i, prev)
+        if end != -1:
+            i, prev = end, "/"
+            continue
+        if c in "\"'`":
+            end = _end_of_string(s, i)
+            if end == -1:
+                return {}
+            i, prev = end, '"'
+            continue
+        if c in "{[(" or c in "}])":
+            depth += 1 if c in "{[(" else -1
+            i, prev = i + 1, c
+            continue
+        if depth == 1 and prev in ("{", ","):
+            m = _KEY.match(s, i, i + 64)
+            if m:
+                i = _skip_trivia(s, m.end())
+                q = s[i] if i < len(s) else ""
+                end = _end_of_string(s, i) if q in ("\"", "'", "`") else -1
+                raw = s[i + 1:end - 1] if end != -1 else ""
+                # Escapes and interpolation are not knowable statically: absent.
+                if raw.strip() and "\\" not in raw and not (q == "`" and "${" in raw):
+                    out.setdefault(m.group(1), raw.strip())  # first wins
+                prev = ":"
+                continue
+        prev = c
+        i += 1
+    return out if depth == 0 else {}
+
+
+def cloud_publish_problem(source: str) -> Optional[str]:
+    """Why this source cannot be published as a cloud policy as written, or None.
+
+    Both halves of Jev are inert in a cloud policy and neither says so on the
+    machine: `semanticPolicies.add` is read only from an installed pack, and a
+    cloud policy's authority comes from its deployment, which never sets it. A
+    commented-out example does not count.
+    """
+    if not source or len(source) > _MAX_SCAN:
+        return None
+    if _find_call(source, _SEMANTIC_CALL) != -1:
+        return ("semanticPolicies.add does nothing in a cloud policy: Jev reads semantic checks only "
+                "from a failproofai pack. Remove it to publish the rest, or ship the file with "
+                "`failproofai publish`.")
+    # Every registration: any of them can carry a reviewable declaration.
+    at = _find_call(source, _ADD_CALL)
+    while at != -1:
+        if _direct_props(source, at).get("authority") == "reviewable":
+            return ("a cloud policy is always hard, so Jev never clears it and authority/reviewedBy "
+                    "are ignored. Remove them to publish it as a hard policy.")
+        at = _find_call(source, _ADD_CALL, at + len(_ADD))
+    return None

package/.next/standalone/fp-cloud-cli/skill/references/commands.md

@@ -222,7 +222,7 @@ Cloud-managed enforcement, split the way the dashboard splits it: `policies` wri
 ### policies
 - `policies list` — one row per published VERSION (versions are immutable and all stay addressable), newest of each policy first; the title counts distinct policies and captions the version total. `state` is active / disabled / archived. JSON `{policies:[…]}` — also every version, so deduplicate on `id` for one row per policy.
 - `policies show <id>` — the NEWEST version, including the full `source`.
-- `policies publish <id> [SOURCE] [--description "…"] [--no-verify]` — mints a **new version**; never edits one. SOURCE is a path, `@path`, `-`, a pipe, or omitted to paste on a TTY (Ctrl-D ends). The source is **parse-checked with node** before it is sent; nothing downstream does this, and a broken policy otherwise fails on the machine at enforcement time. `--no-verify` skips it, and a host without node publishes with a warning rather than a block. **Publishing deploys nothing** — the version is unused until `fleet deploy` puts it on a machine.
+- `policies publish <id> [SOURCE] [--description "…"] [--no-verify]` — mints a **new version**; never edits one. SOURCE is a path, `@path`, `-`, a pipe, or omitted to paste on a TTY (Ctrl-D ends). The source is **parse-checked with node** before it is sent; nothing downstream does this, and a broken policy otherwise fails on the machine at enforcement time. `--no-verify` skips it, and a host without node publishes with a warning rather than a block. A source with Jev fields a cloud policy never reads — `semanticPolicies.add(...)`, or `authority: "reviewable"` on a registration — is refused before sending (**exit 1**, not skipped by `--no-verify`; commented-out code does not count): Jev checks ship in a pack via `failproofai publish`. **Publishing deploys nothing** — the version is unused until `fleet deploy` puts it on a machine.
 - `policies enable <id>` · `policies disable <id> [-y]` — **disable REMOVES the policy from every deployment carrying it**, reissuing each affected machine at a new generation (visible in `fleet history`). `enable` is the exact inverse — it puts the policy back into every deployment it was removed from, reissuing those machines again. Nothing needs redeploying by hand, and `machinesUpdated` in the JSON reports the count for both directions.
 - `policies test [SOURCE] [--tool Bash] [--command "…"] [--file PATH] [--event PreToolUse] [--expect allow|deny|instruct]` — run a policy LOCALLY and print what it decides. Executes the real file (bare `import { deny } from "failproofai"` and all) against a synthetic context; nothing is published, nothing installed. Needs `node`. `--expect` asserts the decision and exits 1 when it differs — a correct `deny` is a PASSING test, so the decision alone never sets the exit code. JSON `{ok, decision, policies:[{name,decision,reason}], expected, met}`; `decision` is the strictest any registered policy returned.
 - `policies compose "<description>" [--out FILE] [--publish ID]` — the assistant drafts policy source from plain English. Prints it and stops by default: a generated policy that deploys itself is one nobody read. `--publish` still syntax-checks first. Needs `policies:write` for BOTH the draft and the publish — `POST /api/agent/compose-policy` is `withAuth("policies:write")`; `agent:use` gates the assistant's other routes and is not checked on this one. The composer has a **30s server-side limit** — a long or vague description simply does not finish, and raising `--timeout` does not help because the cut is not client-side. Retry with something shorter and more specific.