failproofai 1.0.7-beta.2 → 1.0.8-beta.0

package/dist/worker.mjs

@@ -378,7 +378,7 @@ function failproofaiHome(home) {
     return resolve(home, ".failproofai");
   return process.env.FAILPROOFAI_HOME || resolve(homedir(), ".failproofai");
 }
-var LAYOUT_VERSION = 4, at = (...parts) => resolve(failproofaiHome(), ...parts), atHome = (home, ...parts) => home ? resolve(failproofaiHome(home), ...parts) : at(...parts), versionFile = (home) => atHome(home, "VERSION"), configFile = (home) => atHome(home, "config.json"), jevConfigFile = (home) => atHome(home, "jev.json"), policiesDir = (home) => atHome(home, "policies"), customPoliciesDir, globalPolicyConfigFile = (home) => atHome(home, "policies-config.json"), cloudPoliciesDir = (home) => resolve(policiesDir(home), "cloud-policies"), packsDir = (home) => resolve(policiesDir(home), "packs"), packsInstalledFile = (home) => resolve(packsDir(home), "installed.json"), hookActivityDir = (home) => atHome(home, "hook-activity"), stateDir = (home) => atHome(home, "state"), shimsDir = (home) => resolve(stateDir(home), "shims"), sessionPauseDir = () => resolve(stateDir(), "sessions"), semanticDir = () => resolve(stateDir(), "semantic"), telemetryIdFile = (home) => resolve(stateDir(home), "telemetry-id"), codexSessionPathsFile = (home) => resolve(stateDir(home), "codex-session-paths.json"), logsDir = (home) => atHome(home, "logs"), legacy;
+var LAYOUT_VERSION = 4, at = (...parts) => resolve(failproofaiHome(), ...parts), atHome = (home, ...parts) => home ? resolve(failproofaiHome(home), ...parts) : at(...parts), versionFile = (home) => atHome(home, "VERSION"), configFile = (home) => atHome(home, "config.json"), credentialsFile = (home) => atHome(home, "credentials.json"), jevConfigFile = (home) => atHome(home, "jev.json"), policiesDir = (home) => atHome(home, "policies"), customPoliciesDir, globalPolicyConfigFile = (home) => atHome(home, "policies-config.json"), cloudPoliciesDir = (home) => resolve(policiesDir(home), "cloud-policies"), packsDir = (home) => resolve(policiesDir(home), "packs"), packsInstalledFile = (home) => resolve(packsDir(home), "installed.json"), hookActivityDir = (home) => atHome(home, "hook-activity"), stateDir = (home) => atHome(home, "state"), shimsDir = (home) => resolve(stateDir(home), "shims"), sessionPauseDir = () => resolve(stateDir(), "sessions"), semanticDir = () => resolve(stateDir(), "semantic"), telemetryIdFile = (home) => resolve(stateDir(home), "telemetry-id"), codexSessionPathsFile = (home) => resolve(stateDir(home), "codex-session-paths.json"), logsDir = (home) => atHome(home, "logs"), legacy;
 var init_fp_home = __esm(() => {
   customPoliciesDir = policiesDir;
   legacy = {
@@ -1162,7 +1162,7 @@ function instruct(reason) {
 }
 
 // package.json
-var version = "1.0.7-beta.2";
+var version = "1.0.8-beta.0";
 var init_package = () => {};
 
 // src/hooks/policy-types.ts
@@ -1179,7 +1179,7 @@ function effectiveAuthority(p) {
 
 // src/hooks/policy-authority.ts
 import { existsSync as existsSync3 } from "node:fs";
-function resolvePolicyAuthority(decl, knownReviewers = SEMANTIC_REVIEWER_NAMES) {
+function resolvePolicyAuthority(decl, knownReviewers = SEMANTIC_REVIEWER_NAMES, contested) {
   const declaredReviewable = decl?.authority === "reviewable";
   if (!decl || effectiveAuthority(decl) === "hard") {
     if (!declaredReviewable)
@@ -1192,13 +1192,21 @@ function resolvePolicyAuthority(decl, knownReviewers = SEMANTIC_REVIEWER_NAMES)
   }
   const unknown = names.filter((n) => !knownReviewers.has(n));
   if (unknown.length > 0) {
-    return {
-      authority: "hard",
-      downgraded: `reviewedBy names ${unknown.map((n) => JSON.stringify(n)).join(", ")}, ` + `which ${unknown.length === 1 ? "is not a semantic policy" : "are not semantic policies"} in this build`
-    };
+    return { authority: "hard", downgraded: `reviewedBy names ${unknown.map((n) => whyUnknown(n, knownReviewers, contested)).join("; ")}` };
   }
   return { authority: "reviewable", reviewedBy: [...new Set(names)] };
 }
+function whyUnknown(name, known, contested) {
+  const quoted = JSON.stringify(name);
+  const claimants = contested?.get(name);
+  if (claimants)
+    return `${quoted}, which packs ${claimants.join(" and ")} declare differently, so it is asked for neither`;
+  if (known === SEMANTIC_REVIEWER_NAMES)
+    return `${quoted}, which is not a semantic policy in this build`;
+  const sorted = [...known].sort();
+  const listed = sorted.length > 6 ? `${sorted.slice(0, 6).join(", ")} and ${sorted.length - 6} more` : sorted.join(", ");
+  return `${quoted}, which is not among the Jev checks it is judged against (${listed})`;
+}
 function whyHard(decl) {
   if (decl.alwaysOn === true)
     return "it is alwaysOn, and the self-protection guard is never reviewable";
@@ -1217,22 +1225,22 @@ function authorityFieldsOf(raw) {
   }
   return out;
 }
-function withMergedAuthority(record, declarations) {
-  const resolved = declarations.map((d) => resolvePolicyAuthority(d));
+function withMergedAuthority(record, declarations, knownReviewers = SEMANTIC_REVIEWER_NAMES) {
+  const resolved = declarations.map((d) => resolvePolicyAuthority(d, knownReviewers));
   const allReviewable = resolved.length > 0 && resolved.every((r) => r.authority === "reviewable");
-  const fields = allReviewable ? { authority: "reviewable", reviewedBy: [...new Set(resolved.flatMap((r) => r.reviewedBy ?? []))] } : fieldsOf(declarations[resolved.findIndex((r) => r.authority !== "reviewable")] ?? {});
+  const decided = declarations[resolved.findIndex((r) => r.authority !== "reviewable")] ?? {};
+  const fields = allReviewable ? { authority: "reviewable", reviewedBy: [...new Set(resolved.flatMap((r) => r.reviewedBy ?? []))] } : decided.authority === undefined ? {} : { authority: "hard" };
   const overruled = !allReviewable && resolved.some((r) => r.authority === "reviewable");
+  const refused = resolved.find((r) => r.downgraded !== undefined)?.downgraded;
+  const extra = refused === undefined ? {} : { refused };
   const same = record.authority === fields.authority && JSON.stringify(record.reviewedBy) === JSON.stringify(fields.reviewedBy);
   if (same)
-    return { merged: record, overruled };
+    return { merged: record, overruled, ...extra };
   const { authority: _a, reviewedBy: _r, ...rest } = record;
-  return { merged: { ...rest, ...fields }, overruled };
+  return { merged: { ...rest, ...fields }, overruled, ...extra };
 }
-function fieldsOf(d) {
-  return {
-    ...d.authority !== undefined ? { authority: d.authority } : {},
-    ...d.reviewedBy !== undefined ? { reviewedBy: d.reviewedBy } : {}
-  };
+function refusedAuthorityWarning(subject, reason) {
+  return `${subject} asks to be reviewable, but ${reason} — it stays hard`;
 }
 function warnAuthority(message) {
   try {
@@ -1563,7 +1571,7 @@ function checkPackMinCliVersion(packId, declared, current = version) {
   if (ordered < 0) {
     return {
       kind: "too-old",
-      reason: `pack ${packId} needs failproofai ${String(declared)} or newer and this is ${current} — ` + "run `npm i -g failproofai && failproofai update`"
+      reason: `pack ${packId} needs failproofai ${String(declared)} or newer and this is ${current} — ` + `run \`npm i -g "failproofai@>=${String(declared)}" && failproofai update\``
     };
   }
   return { kind: "satisfied", declared };
@@ -1811,6 +1819,7 @@ function readInstalledPacks() {
         reason: errText(err),
         effect: declaredEffect,
         ...Array.isArray(rec?.policies) ? { declared: safeDeclared(rec.policies) } : {},
+        ...Array.isArray(rec?.policies) && rec.policies.length === 0 ? { semanticOnly: true } : {},
         ...Array.isArray(rec?.clis) && rec.clis.every((c) => typeof c === "string") ? { clis: rec.clis } : {}
       });
     }
@@ -1853,25 +1862,80 @@ var init_pack_manifest = __esm(() => {
 });
 
 // src/hooks/effective-reviewers.ts
+function jevPacks(packs, cli) {
+  return packs.filter((p) => p.effect !== "observe" && !(cli && Array.isArray(p.clis) && p.clis.length > 0 && !p.clis.includes(cli)));
+}
+function canonical(value) {
+  if (Array.isArray(value))
+    return `[${value.map(canonical).join(",")}]`;
+  if (value !== null && typeof value === "object") {
+    const entries = Object.entries(value).filter(([, v]) => v !== undefined).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0);
+    return `{${entries.map(([k, v]) => `${JSON.stringify(k)}:${canonical(v)}`).join(",")}}`;
+  }
+  return JSON.stringify(value) ?? "null";
+}
+function contestedSemanticNames(packs) {
+  const claims = new Map;
+  const contested = new Map;
+  for (const pack of packs) {
+    for (const entry of pack.semantic ?? []) {
+      if (isReservedClaim(pack, entry.name))
+        continue;
+      const form = canonical(entry);
+      const claim = claims.get(entry.name);
+      if (claim === undefined) {
+        claims.set(entry.name, { form, ids: [pack.id] });
+        continue;
+      }
+      claim.ids.push(pack.id);
+      if (claim.form !== form)
+        contested.set(entry.name, claim.ids);
+    }
+  }
+  return contested;
+}
+function isFirstPartyPack(pack) {
+  return /^github:FailproofAI\//i.test(pack.source ?? "");
+}
+function isReservedClaim(pack, name) {
+  return SEMANTIC_REVIEWER_NAMES.has(name) && !isFirstPartyPack(pack);
+}
 function effectiveReviewerNames() {
   if (cached)
     return cached;
   let names = SEMANTIC_REVIEWER_NAMES;
+  cachedContested = new Map;
   try {
-    const declared = readInstalledPacks().packs.flatMap((p) => (p.semantic ?? []).map((s) => s.name));
-    if (declared.length > 0)
-      names = new Set(declared);
+    const packs = jevPacks(readInstalledPacks().packs, reviewerCli);
+    names = reviewerNamesFor(packs);
+    cachedContested = contestedSemanticNames(packs);
   } catch {}
   cached = names;
   return names;
 }
-function forgetEffectiveReviewerNames() {
+function contestedReviewerNames() {
+  effectiveReviewerNames();
+  return cachedContested;
+}
+function replacesBuiltinChecks(packs) {
+  return packs.some((p) => isFirstPartyPack(p) && (p.semantic ?? []).length > 0);
+}
+function reviewerNamesFor(packs) {
+  const contested = contestedSemanticNames(packs);
+  const declared = packs.flatMap((p) => (p.semantic ?? []).filter((s) => !isReservedClaim(p, s.name)).map((s) => s.name)).filter((name) => !contested.has(name));
+  if (declared.length === 0)
+    return SEMANTIC_REVIEWER_NAMES;
+  return new Set(replacesBuiltinChecks(packs) ? declared : [...SEMANTIC_REVIEWER_NAMES, ...declared]);
+}
+function forgetEffectiveReviewerNames(cli) {
   cached = null;
+  reviewerCli = cli;
 }
-var cached = null;
+var cached = null, cachedContested, reviewerCli;
 var init_effective_reviewers = __esm(() => {
   init_pack_manifest();
   init_policy_authority();
+  cachedContested = new Map;
 });
 
 // src/hooks/policy-registry.ts
@@ -1937,11 +2001,11 @@ function getPoliciesForEvent(eventType, toolName) {
   cache.set(key, result);
   return result;
 }
-function clearPolicies() {
+function clearPolicies(cli) {
   const g = globalThis;
   g[REGISTRY_KEY] = [];
   setIndexCache(null);
-  forgetEffectiveReviewerNames();
+  forgetEffectiveReviewerNames(cli);
 }
 var REGISTRY_KEY = "__FAILPROOFAI_POLICY_REGISTRY__", INDEX_CACHE_KEY = "__FAILPROOFAI_POLICY_INDEX_CACHE__", DEFAULT_POLICY_NAMESPACE = "failproofai";
 var init_policy_registry = __esm(() => {
@@ -2713,6 +2777,9 @@ function protectEnvVars(ctx) {
   if (EXPORT_RE.test(cmd)) {
     return deny("Command exports environment variable");
   }
+  if (ENV_DUMP_RE.test(cmd) || SCRIPT_INTERP_RE.test(cmd) && ENV_OBJECT_RE.test(cmd)) {
+    return deny("Command dumps environment variables");
+  }
   if (PS_ENV_VAR_RE.test(cmd)) {
     return deny("Command reads environment variable via PowerShell");
   }
@@ -3007,8 +3074,12 @@ function extractAbsolutePaths(command) {
     let m;
     while ((m = pathRe.exec(s)) !== null) {
       let p = m[0];
-      if (/^\/{2,}$/.test(p))
-        continue;
+      if (/^\/{2,}$/.test(p)) {
+        const nl = s.lastIndexOf(`
+`, m.index - 1);
+        if (nl !== -1 && s[nl - 1] !== "\\" && /^[ \t]*$/.test(s.slice(nl + 1, m.index)))
+          continue;
+      }
       if (p === "~")
         p = homedir3();
       else if (p.startsWith("~/"))
@@ -3668,7 +3739,7 @@ function registerBuiltinPolicies(enabledNames) {
     }
   }
 }
-var isClaudeInternalPath, isClaudeSettingsFile, SHELL_OPERATORS, SHELL_METACHAR_RE, JWT_RE, API_KEY_PATTERNS, CONNECTION_STRING_RE, PRIVATE_KEY_RE, BEARER_TOKEN_RE, SECRET_PATTERNS, SQL_TOOL_RE, DESTRUCTIVE_SQL_RE, DELETE_NO_WHERE_RE, SQL_WHERE_RE, SCHEMA_ALTER_RE, PUBLISH_CMD_RE, ENV_PRINTENV_RE, ECHO_ENV_RE, EXPORT_RE, PS_ENV_VAR_RE, PS_CHILDITEM_ENV_RE, DOTNET_GETENV_RE, CMD_ECHO_ENV_RE, ENV_FILE_PATH_RE, ENV_CMD_RE, PS_ELEVATION_RE, RUNAS_RE, CURL_PIPE_SH_RE, SEGMENT_SEPARATORS, COMMAND_PREFIX_TOKENS, SELF_BINARY_TOKEN_RE, SELF_ENTRY_PATH_RE, CONFIG_SUBCOMMAND_RE, PAUSE_FLAG_RE, ENV_ASSIGNMENT_RE, RUNNER_OPERAND_RE, PS_WEB_PIPE_RE, SHORT_FLAG_BUNDLE_RE, SAFE_FORCE_PREFIXES, SECRET_FILE_RE, SECRET_FILE_ID_RSA_RE, SECRET_FILE_CREDENTIALS_RE, GIT_COMMIT_MERGE_RE, FAILPROOFAI_STATE_PATH_RE, STATE_READ_COMMANDS, SHELL_KEYWORD_PREFIXES, LOOP_HEADER_RE, COPY_COMMANDS, OPERAND_WRITE_COMMANDS, SECOND_OPERAND_WRITERS, OUTPUT_FLAG_COMMANDS, FIND_WRITE_ACTIONS, SAFE_EXEC_COMMANDS, GIT_DESTRUCTIVE_SUBCOMMANDS, GIT_FLAGS_WITH_OPERANDS, STATE_MENTION_COMMANDS, FIND_EXEC_ACTIONS, PIPELINE_SEPARATORS, VAR_REFERENCE_RE, STATE_GLOB_CANDIDATES, GLOB_DECOYS, BRACE_EXPANSION_LIMIT = 4096, BRACE_EXPANSION_ROUNDS = 24, GLOB_METACHAR_RE, REDIRECT_TARGET_RE, FAILPROOFAI_UNINSTALL_RE, GIT_AMEND_RE, GIT_STASH_DROP_RE, GIT_CMD_RE, SHORT_FLAG_CLUSTER_RE, GIT_CLEAN_FORCE_WAIVED_RE, GIT_CLEAN_DESTRUCTIVE_FLAGS, GIT_ADD_ALL_RE, NPM_GLOBAL_RE, YARN_GLOBAL_RE, PNPM_GLOBAL_RE, BUN_GLOBAL_RE, CARGO_INSTALL_RE, PIP_SYSTEM_RE, PKG_MANAGER_DETECTORS, NOHUP_RE, SCREEN_DETACH_RE, TMUX_DETACH_RE, DISOWN_RE, BACKGROUND_AMPERSAND_RE, KUBECTL_RE, TERRAFORM_RE, AWS_CLI_RE, GCLOUD_RE, AZ_CLI_RE, HELM_RE, GH_PIPELINE_RE, gitBranchCache, GIT_BRANCH_CACHE_MAX_ENTRIES = 500, EVAL_FLAG_RE, HOME_PREFIX_RE, RM_CMD_RE, FIND_CMD_RE, FIND_EXEC_RE, FIND_GLOBAL_OPT_RE, FIND_EXPR_START_RE, SCRATCH_ROOTS, CATASTROPHIC_DEPTH = 2, READ_LIKE_CMDS, TOOL_CALL_TRACKER_MAX_BYTES = 65536, SEGMENT_SPLIT_RE, POLICY_IMPLEMENTATIONS, BUILTIN_POLICIES;
+var isClaudeInternalPath, isClaudeSettingsFile, SHELL_OPERATORS, SHELL_METACHAR_RE, JWT_RE, API_KEY_PATTERNS, CONNECTION_STRING_RE, PRIVATE_KEY_RE, BEARER_TOKEN_RE, SECRET_PATTERNS, SQL_TOOL_RE, DESTRUCTIVE_SQL_RE, DELETE_NO_WHERE_RE, SQL_WHERE_RE, SCHEMA_ALTER_RE, PUBLISH_CMD_RE, ENV_PRINTENV_RE, ECHO_ENV_RE, EXPORT_RE, ENV_DUMP_RE, SCRIPT_INTERP_RE, ENV_OBJECT_RE, PS_ENV_VAR_RE, PS_CHILDITEM_ENV_RE, DOTNET_GETENV_RE, CMD_ECHO_ENV_RE, ENV_FILE_PATH_RE, ENV_CMD_RE, PS_ELEVATION_RE, RUNAS_RE, CURL_PIPE_SH_RE, SEGMENT_SEPARATORS, COMMAND_PREFIX_TOKENS, SELF_BINARY_TOKEN_RE, SELF_ENTRY_PATH_RE, CONFIG_SUBCOMMAND_RE, PAUSE_FLAG_RE, ENV_ASSIGNMENT_RE, RUNNER_OPERAND_RE, PS_WEB_PIPE_RE, SHORT_FLAG_BUNDLE_RE, SAFE_FORCE_PREFIXES, SECRET_FILE_RE, SECRET_FILE_ID_RSA_RE, SECRET_FILE_CREDENTIALS_RE, GIT_COMMIT_MERGE_RE, FAILPROOFAI_STATE_PATH_RE, STATE_READ_COMMANDS, SHELL_KEYWORD_PREFIXES, LOOP_HEADER_RE, COPY_COMMANDS, OPERAND_WRITE_COMMANDS, SECOND_OPERAND_WRITERS, OUTPUT_FLAG_COMMANDS, FIND_WRITE_ACTIONS, SAFE_EXEC_COMMANDS, GIT_DESTRUCTIVE_SUBCOMMANDS, GIT_FLAGS_WITH_OPERANDS, STATE_MENTION_COMMANDS, FIND_EXEC_ACTIONS, PIPELINE_SEPARATORS, VAR_REFERENCE_RE, STATE_GLOB_CANDIDATES, GLOB_DECOYS, BRACE_EXPANSION_LIMIT = 4096, BRACE_EXPANSION_ROUNDS = 24, GLOB_METACHAR_RE, REDIRECT_TARGET_RE, FAILPROOFAI_UNINSTALL_RE, GIT_AMEND_RE, GIT_STASH_DROP_RE, GIT_CMD_RE, SHORT_FLAG_CLUSTER_RE, GIT_CLEAN_FORCE_WAIVED_RE, GIT_CLEAN_DESTRUCTIVE_FLAGS, GIT_ADD_ALL_RE, NPM_GLOBAL_RE, YARN_GLOBAL_RE, PNPM_GLOBAL_RE, BUN_GLOBAL_RE, CARGO_INSTALL_RE, PIP_SYSTEM_RE, PKG_MANAGER_DETECTORS, NOHUP_RE, SCREEN_DETACH_RE, TMUX_DETACH_RE, DISOWN_RE, BACKGROUND_AMPERSAND_RE, KUBECTL_RE, TERRAFORM_RE, AWS_CLI_RE, GCLOUD_RE, AZ_CLI_RE, HELM_RE, GH_PIPELINE_RE, gitBranchCache, GIT_BRANCH_CACHE_MAX_ENTRIES = 500, EVAL_FLAG_RE, HOME_PREFIX_RE, RM_CMD_RE, FIND_CMD_RE, FIND_EXEC_RE, FIND_GLOBAL_OPT_RE, FIND_EXPR_START_RE, SCRATCH_ROOTS, CATASTROPHIC_DEPTH = 2, READ_LIKE_CMDS, TOOL_CALL_TRACKER_MAX_BYTES = 65536, SEGMENT_SPLIT_RE, POLICY_IMPLEMENTATIONS, BUILTIN_POLICIES;
 var init_builtin_policies = __esm(() => {
   init_policy_catalog();
   init_policy_registry();
@@ -3708,6 +3779,9 @@ var init_builtin_policies = __esm(() => {
   ENV_PRINTENV_RE = /(?:^|\s|;|&&|\|\|)(?:env|printenv)(?:\s|$|;|&&|\|)/;
   ECHO_ENV_RE = /echo\s+.*\$\{?[A-Za-z_]/;
   EXPORT_RE = /(?:^|\s|;|&&|\|\|)export\s+\w+/;
+  ENV_DUMP_RE = /(?:^|[;&|({\n`'"]|\$\()\s*(?:set|export(?:\s+-p)?)\s*(?:$|[|;&>)\n])|\b(?:declare|typeset)\s+-[A-Za-z]*[xp]|\bcompgen\s+-[A-Za-z]*[ev]|\/proc\/(?:self|thread-self|\d+|\$\$|\$BASHPID)\/environ/;
+  SCRIPT_INTERP_RE = /\b(?:python[\d.]*|node|bun|deno)\b/;
+  ENV_OBJECT_RE = /\bos\.environ(?!\s*\[|\.(?:get|setdefault|pop|update)\b)|\bprocess\.env(?![.\[\w])/;
   PS_ENV_VAR_RE = /\$env:[A-Za-z_]/i;
   PS_CHILDITEM_ENV_RE = /(?:Get-ChildItem|dir|gci|ls)\s+Env:/i;
   DOTNET_GETENV_RE = /\[Environment\]::GetEnvironment/i;
@@ -4036,6 +4110,7 @@ var init_builtin_policies = __esm(() => {
 var MAX_ARTIFACT_BYTES, CORE_SOURCE = "FailproofAI/policies", RETIRED_CORE_ALIASES;
 var init_pack_store = __esm(() => {
   init_pack_manifest();
+  init_effective_reviewers();
   MAX_ARTIFACT_BYTES = 8 * 1024 * 1024;
   RETIRED_CORE_ALIASES = new Set(["core", "failproofai", "official"]);
 });
@@ -4240,55 +4315,74 @@ function combineTwoTier(verdicts, review, mode) {
   const wholePicture = review.injectionAsked && !review.injected && !review.requestCut;
   const asked = new Set(review.asked);
   const notDenied = new Set(review.notDenied);
-  const cleared = wholePicture ? verdicts.filter((v) => clears(v, asked, notDenied)).map((v) => v.policyName) : [];
+  const cleared = wholePicture && !review.unclearableWarned ? verdicts.filter((v) => clears(v, asked, notDenied)).map((v) => v.policyName) : [];
+  const jevEntry = { policyName: review.policyName, reason: review.reason ?? `Flagged by semantic review (${review.policyName})` };
+  const enforced = resolveEnforce(verdicts, cleared, review.decision, jevEntry);
   const activity = {
     evaluator: review.requestCut ? "jev-fallback" : "jev",
     ...review.requestCut ? { jevFallbackReason: JEV_REASON_REQUEST_CUT } : {},
     jevDecision: review.decision,
-    ...cleared.length > 0 ? { jevCleared: cleared } : {},
+    ...cleared.length > 0 && RANK[enforced.final.decision] < RANK[legacy.decision] ? { jevCleared: cleared } : {},
     ...review.latencyMs !== null ? { jevLatencyMs: review.latencyMs } : {},
     ...review.model ? { jevModel: review.model } : {},
     jevMode: mode
   };
-  if (mode === "shadow")
-    return { final: legacy, cleared, decidedByJev: false, activity };
+  if (mode === "shadow") {
+    const shadowVerdict = review.decision === "deny" || review.decision === "instruct" ? {
+      policyName: jevEntry.policyName,
+      decision: review.decision,
+      reason: jevEntry.reason,
+      version: review.model && JEV_MODEL_RE.test(review.model) ? review.model : "jev"
+    } : undefined;
+    return { final: legacy, cleared, decidedByJev: false, activity, ...shadowVerdict ? { shadowVerdict } : {} };
+  }
+  return { ...enforced, cleared, activity };
+}
+function resolveEnforce(verdicts, cleared, decision, jevEntry) {
   const clearedSet = new Set(cleared);
   const remaining = verdicts.filter((v) => !clearedSet.has(v.policyName));
-  const jevEntry = { policyName: review.policyName, reason: review.reason ?? `Flagged by semantic review (${review.policyName})` };
   const regexDeny = remaining.find((v) => v.decision === "deny");
   if (regexDeny) {
     return {
       final: { decision: "deny", entries: [{ policyName: regexDeny.policyName, reason: regexDeny.reason ?? "" }] },
-      cleared,
-      decidedByJev: false,
-      activity
+      decidedByJev: false
     };
   }
-  if (review.decision === "deny") {
-    return { final: { decision: "deny", entries: [jevEntry] }, cleared, decidedByJev: true, activity };
+  if (decision === "deny") {
+    return { final: { decision: "deny", entries: [jevEntry] }, decidedByJev: true };
   }
   const instructs = remaining.filter((v) => v.decision === "instruct").map((v) => ({ policyName: v.policyName, reason: v.reason ?? "" }));
-  if (review.decision === "instruct")
+  if (decision === "instruct")
     instructs.push(jevEntry);
   if (instructs.length > 0) {
-    return {
-      final: { decision: "instruct", entries: instructs },
-      cleared,
-      decidedByJev: instructs[0] === jevEntry,
-      activity
-    };
+    return { final: { decision: "instruct", entries: instructs }, decidedByJev: instructs[0] === jevEntry };
   }
-  return { final: regexOnly(remaining), cleared, decidedByJev: false, activity };
+  return { final: regexOnly(remaining), decidedByJev: false };
 }
+var RANK;
 var init_combine = __esm(() => {
   init_jev_activity();
+  RANK = { allow: 0, instruct: 1, deny: 2 };
 });
 
 // src/posthog-key.ts
 var POSTHOG_API_KEY = "phc_Ac1Ww1GqKc0z1SyrRWbmatEeQdlOQIsDEEdP8l8JRgX", POSTHOG_PRODUCT = "failproofai-oss";
 
 // src/hooks/fp-config.ts
-import { chmodSync, existsSync as existsSync6, mkdirSync as mkdirSync3, readFileSync as readFileSync4, statSync as statSync4, writeFileSync as writeFileSync2 } from "node:fs";
+import {
+  chmodSync,
+  closeSync,
+  constants as fsConstants,
+  existsSync as existsSync6,
+  fstatSync,
+  mkdirSync as mkdirSync3,
+  openSync,
+  readFileSync as readFileSync4,
+  readSync,
+  statSync as statSync4,
+  writeFileSync as writeFileSync2
+} from "node:fs";
+import { dirname as dirname2 } from "node:path";
 function detectLayout() {
   const raw = readVersionFile();
   if (raw) {
@@ -4407,7 +4501,147 @@ function projectConfig(parsed) {
     };
   }
 }
-var DEFAULT_AUDIT_INTERVAL_DAYS = 7, MIN_AUDIT_INTERVAL_DAYS = 1, MAX_AUDIT_INTERVAL_DAYS = 90, DEFAULT_CONFIG;
+function projectCredentials(parsed) {
+  {
+    const cloud = parsed.cloud;
+    const ingest = parsed.ingest;
+    const auth = parsed.auth;
+    const out = {};
+    if (cloud && typeof cloud.url === "string" && typeof cloud.machine_id === "string" && typeof cloud.token === "string" && cloud.url && cloud.token) {
+      const machineLabel = typeof cloud.machine_label === "string" && cloud.machine_label ? cloud.machine_label : undefined;
+      out.cloud = { url: cloud.url, machineId: cloud.machine_id, token: cloud.token, machineLabel };
+    }
+    const org = parsed.org;
+    if (org) {
+      const pick = (v) => typeof v === "string" && v ? v : undefined;
+      const built = { id: pick(org.id), slug: pick(org.slug), name: pick(org.name) };
+      if (built.id || built.slug || built.name)
+        out.org = built;
+    }
+    if (ingest && typeof ingest.url === "string" && typeof ingest.key === "string" && ingest.url && ingest.key) {
+      out.ingest = { url: ingest.url, key: ingest.key };
+    }
+    const jev = projectJevSlot(parsed.jev);
+    if (jev)
+      out.jev = jev;
+    if (auth) {
+      out.auth = {
+        baseUrl: typeof auth.base_url === "string" ? auth.base_url : undefined,
+        sessionToken: typeof auth.session_token === "string" ? auth.session_token : undefined,
+        expiresAt: typeof auth.expires_at === "number" ? auth.expires_at : undefined,
+        email: typeof auth.email === "string" ? auth.email : undefined
+      };
+    }
+    return out;
+  }
+}
+function projectJevSlot(raw) {
+  if (!raw || typeof raw !== "object" || Array.isArray(raw))
+    return null;
+  const { url, key } = raw;
+  return typeof url === "string" && url && typeof key === "string" && key ? { url, key } : null;
+}
+function readJevCloudCredential() {
+  const path = credentialsFile();
+  let fd;
+  try {
+    fd = openSync(path, credentialsOpenFlags());
+  } catch (err) {
+    const code = err.code;
+    if (code === "ENOENT" || code === "ENOTDIR")
+      return { status: "absent", path, connected: false };
+    return { status: "refused", path, mode: null, reason: "unreadable", problem: `cannot open ${path} (${code ?? "error"})` };
+  }
+  let text;
+  try {
+    const st = fstatSync(fd);
+    if (!st.isFile())
+      return { status: "refused", path, mode: null, reason: "unreadable", problem: `${path} is not a regular file` };
+    const meaningful = process.platform !== "win32";
+    const mode = st.mode & 511;
+    if (meaningful && (mode & 63) !== 0) {
+      return {
+        status: "refused",
+        path,
+        mode,
+        reason: "too-open",
+        problem: `${path} is ${mode.toString(8).padStart(4, "0")}; it holds the key Jev sends to FailproofAI Cloud, ` + `so it must be owner-only (chmod 600 ${path})`,
+        fix: `chmod 600 ${path}`
+      };
+    }
+    if (meaningful) {
+      let dirMode = null;
+      try {
+        const m = statSync4(dirname2(path)).mode & 511;
+        if ((m & DIR_WRITABLE_BY_OTHERS) !== 0)
+          dirMode = m;
+      } catch {}
+      if (dirMode !== null) {
+        return {
+          status: "refused",
+          path,
+          mode,
+          reason: "too-open",
+          problem: `its directory ${dirname2(path)} is ${dirMode.toString(8).padStart(4, "0")} — other users can write there, ` + `so they can put their own credentials in its place; it must be owner-only (chmod 700 ${dirname2(path)})`,
+          fix: `chmod 700 ${dirname2(path)}`
+        };
+      }
+    }
+    if (st.size > MAX_CREDENTIALS_BYTES) {
+      return { status: "refused", path, mode, reason: "too-large", problem: `${path} is larger than ${MAX_CREDENTIALS_BYTES} bytes` };
+    }
+    const buf = Buffer.alloc(st.size);
+    let off = 0;
+    while (off < buf.length) {
+      const n = readSync(fd, buf, off, buf.length - off, off);
+      if (n === 0)
+        break;
+      off += n;
+    }
+    text = buf.subarray(0, off).toString("utf8");
+  } catch (err) {
+    return { status: "refused", path, mode: null, reason: "unreadable", problem: `cannot read ${path} (${err.code ?? "error"})` };
+  } finally {
+    try {
+      closeSync(fd);
+    } catch {}
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch {
+    return { status: "refused", path, mode: null, reason: "not-json", problem: `${path} is not valid JSON` };
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    return { status: "refused", path, mode: null, reason: "not-json", problem: `${path} does not hold a JSON object` };
+  }
+  const fields = parsed;
+  const others = projectCredentials(fields);
+  const connections = [
+    others.cloud ? { origin: originOrNull(others.cloud.url), key: others.cloud.token } : null,
+    others.ingest ? { origin: originOrNull(others.ingest.url), key: others.ingest.key } : null
+  ].filter((c) => c !== null && c.origin !== null);
+  const connected = connections.length > 0;
+  const credential = projectJevSlot(fields.jev);
+  if (!credential)
+    return { status: "absent", path, connected };
+  const slotOrigin = originOrNull(credential.url);
+  const backed = slotOrigin !== null && connections.some((c) => c.origin === slotOrigin && c.key === credential.key);
+  if (!backed)
+    return { status: "absent", path, connected, orphaned: true };
+  return { status: "ok", path, credential };
+}
+function originOrNull(url) {
+  if (!url)
+    return null;
+  try {
+    const origin = new URL(url).origin;
+    return origin === "null" ? null : origin;
+  } catch {
+    return null;
+  }
+}
+var DEFAULT_AUDIT_INTERVAL_DAYS = 7, MIN_AUDIT_INTERVAL_DAYS = 1, MAX_AUDIT_INTERVAL_DAYS = 90, DEFAULT_CONFIG, MAX_CREDENTIALS_BYTES, credentialsOpenFlags = () => fsConstants.O_RDONLY | (fsConstants.O_NONBLOCK ?? 0), DIR_WRITABLE_BY_OTHERS = 18;
 var init_fp_config = __esm(() => {
   init_package();
   init_fp_home();
@@ -4424,6 +4658,7 @@ var init_fp_config = __esm(() => {
     telemetry: { enabled: true },
     audit: { auto: false, intervalDays: DEFAULT_AUDIT_INTERVAL_DAYS }
   };
+  MAX_CREDENTIALS_BYTES = 64 * 1024;
 });
 
 // lib/telemetry-enabled.ts
@@ -4679,8 +4914,13 @@ async function evaluatePolicies(eventType, payload, session, config, twoTier) {
     hookLogInfo(combined.activity.jevFallbackReason === JEV_REASON_REQUEST_CUT ? "jev could not be shown the whole call; it cleared nothing, and the call was not allowed on a partial read" : `jev unavailable (${combined.activity.jevFallbackReason}); the regex result decided this call`);
   }
   return {
-    ...formatVerdict(eventType, session, toolName, combined.final),
-    twoTier: { activity: combined.activity, decidedByJev: combined.decidedByJev }
+    ...formatVerdict(eventType, session, toolName, combined.final, combined.decidedByJev),
+    twoTier: {
+      activity: combined.activity,
+      decidedByJev: combined.decidedByJev,
+      ...combined.decidedByJev && review.kind === "answered" && review.origin ? { jevOrigin: review.origin } : {},
+      ...combined.shadowVerdict ? { shadowVerdict: combined.shadowVerdict } : {}
+    }
   };
 }
 async function collectVerdicts(eventType, payload, session, config, policies, twoTier) {
@@ -4746,10 +4986,10 @@ async function collectVerdicts(eventType, payload, session, config, policies, tw
   }
   return { verdicts, hardDenied: false };
 }
-function formatVerdict(eventType, session, toolName, final) {
+function formatVerdict(eventType, session, toolName, final, byJev = false) {
   if (final.decision === "deny") {
     const [decider] = final.entries;
-    return formatDeny(eventType, session, toolName, decider.policyName, decider.reason);
+    return formatDeny(eventType, session, toolName, decider.policyName, decider.reason, byJev);
   }
   if (final.decision === "instruct")
     return formatInstruct(eventType, session, final.entries);
@@ -4757,7 +4997,7 @@ function formatVerdict(eventType, session, toolName, final) {
     return formatAllow(eventType, session, final.entries);
   return { exitCode: 0, stdout: "", stderr: "", policyName: null, reason: null, decision: "allow" };
 }
-function formatDeny(eventType, session, toolName, policyName, reason) {
+function formatDeny(eventType, session, toolName, policyName, reason, byJev = false) {
   let displayTool;
   if (toolName) {
     displayTool = toolName;
@@ -4772,7 +5012,7 @@ function formatDeny(eventType, session, toolName, policyName, reason) {
   } else {
     displayTool = "operation";
   }
-  const blockedMessage = `Blocked ${displayTool} by failproofai because: ${reason}, as per the policy configured by the user`;
+  const blockedMessage = byJev ? `Blocked ${displayTool} by failproofai because: ${reason.replace(/[.\s]+$/, "")}, as flagged by Jev semantic review` : `Blocked ${displayTool} by failproofai because: ${reason}, as per the policy configured by the user`;
   if (session?.cli === "cursor") {
     if (eventType === "Stop" || eventType === "SubagentStop") {
       const reasonText = `MANDATORY ACTION REQUIRED from failproofai (policy: ${policyName}): ${reason}
@@ -5001,7 +5241,7 @@ You MUST complete the above action NOW. Do NOT ask the user for confirmation —
         hookEventName: eventType,
         decision: {
           behavior: "deny",
-          message: `Blocked ${displayTool} by failproofai because: ${reason}, as per the policy configured by the user`
+          message: blockedMessage
         }
       }
     };
@@ -5028,7 +5268,7 @@ You MUST complete the above action NOW. Do NOT ask the user for confirmation —
     const response = {
       hookSpecificOutput: {
         hookEventName: eventType,
-        additionalContext: `Blocked ${displayTool} by failproofai because: ${reason}, as per the policy configured by the user`
+        additionalContext: blockedMessage
       }
     };
     return {
@@ -5446,9 +5686,18 @@ function getRegistry2() {
     g[REGISTRY_KEY2] = [];
   return g[REGISTRY_KEY2];
 }
+function getSemanticRegistry() {
+  const g = globalThis;
+  if (!Array.isArray(g[SEMANTIC_KEY]))
+    g[SEMANTIC_KEY] = [];
+  return g[SEMANTIC_KEY];
+}
 function getCustomHooks() {
   return getRegistry2();
 }
+function getSemanticRegistrations() {
+  return getSemanticRegistry();
+}
 function clearCustomHooks() {
   const g = globalThis;
   g[REGISTRY_KEY2] = [];
@@ -5466,7 +5715,7 @@ var init_custom_hooks_registry = __esm(() => {
 // src/hooks/loader-utils.ts
 import { readFile as readFile2, writeFile as writeFile2, unlink, access, mkdir, lstat } from "fs/promises";
 import { tmpdir } from "os";
-import { resolve as resolve6, dirname as dirname2, relative as relative2, join as join3 } from "path";
+import { resolve as resolve6, dirname as dirname3, relative as relative2, join as join3 } from "path";
 import { pathToFileURL } from "url";
 import { createHash as createHash3 } from "crypto";
 function isTmpArtifact(name) {
@@ -5507,7 +5756,7 @@ async function findDistIndex() {
       return candidate;
   }
   const candidates = [
-    resolve6(dirname2(process.execPath), "..", "assets", "dist", "index.js"),
+    resolve6(dirname3(process.execPath), "..", "assets", "dist", "index.js"),
     resolve6(process.cwd(), "dist", "index.js"),
     resolve6(process.cwd(), "node_modules", "failproofai", "dist", "index.js")
   ];
@@ -5598,7 +5847,7 @@ async function rewriteFileTree(entryPath, distUrl, distIndex, tmpSuffix = TMP_SU
     if (distIndex) {
       code = code.replace(/require\s*\(\s*(['"])(?:claudeye|failproofai)\1\s*\)/g, `require('${distIndex.replace(/\\/g, "\\\\")}')`);
     }
-    const dir = dirname2(filePath);
+    const dir = dirname3(filePath);
     const rewrites = new Map;
     for (const re of [LOCAL_IMPORT_RE, LOCAL_REQUIRE_RE]) {
       const freshRe = new RegExp(re.source, re.flags);
@@ -5714,7 +5963,13 @@ async function loadSingleFile(absPath, opts) {
     const entryTmp = absPath + tmpSuffix;
     const fileUrl = pathToFileURL2(entryTmp).href;
     const hooksBefore = getCustomHooks().length;
+    const semanticBefore = getSemanticRegistrations().length;
     await importWithDeadline(fileUrl);
+    const ignored = getSemanticRegistrations().slice(semanticBefore).map((d) => d?.name);
+    if (opts?.outsidePack && ignored.length > 0 && !warnedSemanticOutsidePack.has(absPath)) {
+      warnedSemanticOutsidePack.add(absPath);
+      hookLogWarn(`${basename(absPath)}: semanticPolicies.add only takes effect in a pack published with \`failproofai publish\`; ` + `${ignored.join(", ")} ${ignored.length === 1 ? "is" : "are"} never asked here`);
+    }
     if (policyModuleCache.size >= POLICY_MODULE_CACHE_MAX_ENTRIES)
       policyModuleCache.clear();
     policyModuleCache.set(absPath, {
@@ -5792,20 +6047,27 @@ async function loadAllCustomHooks(customPoliciesPaths, opts) {
       continue;
     }
     hookLogWarn(`cloud-managed policies ${existing.id} and ${policy.id} have identical source, so they share ` + `one artifact and load as one policy; enforcing it if either asks to enforce`);
+    const knownReviewers = effectiveReviewerNames();
     const winner = existing.effect !== "enforce" && policy.effect === "enforce" ? policy : existing;
-    const { merged, overruled } = withMergedAuthority(winner, [existing, policy]);
+    const { merged, overruled, refused } = withMergedAuthority(winner, [existing, policy], knownReviewers);
     if (overruled) {
       warnAuthority(`cloud-managed policies ${existing.id} and ${policy.id} share one artifact and do not all declare it ` + `reviewable, so it stays hard`);
     }
+    if (refused) {
+      warnAuthority(refusedAuthorityWarning(`cloud-managed policies ${existing.id} and ${policy.id}`, refused));
+    }
     cloudManagedByPath.set(key, merged);
   }
   const unionSelection = (a, b) => a === null || b === null ? null : [...new Set([...a, ...b])];
-  const unionCatalog = (winner, other) => {
+  const unionCatalog = (winner, other, knownReviewers) => {
     const overruled = [];
+    const refused = [];
     const harden = (entry, peer) => {
-      const r = withMergedAuthority(entry, [entry, peer ?? {}]);
+      const r = withMergedAuthority(entry, [entry, peer ?? {}], knownReviewers);
       if (r.overruled)
         overruled.push(entry.name);
+      if (r.refused)
+        refused.push(refusedAuthorityWarning(entry.name, r.refused));
       return r.merged;
     };
     return {
@@ -5813,7 +6075,8 @@ async function loadAllCustomHooks(customPoliciesPaths, opts) {
         ...winner.map((w) => harden(w, other.find((p) => p.name === w.name))),
         ...other.filter((p) => !winner.some((w) => w.name === p.name)).map((p) => harden(p, undefined))
       ],
-      overruled
+      overruled,
+      refused
     };
   };
   const packByPath = new Map;
@@ -5829,7 +6092,7 @@ async function loadAllCustomHooks(customPoliciesPaths, opts) {
     hookLogWarn(`packs ${existing.id} and ${pack.id} have identical source, so they share one artifact ` + `and load as one pack; enforcing it if either asks to enforce, and taking ` + `the union of what each has enabled and of the agents each guards`);
     const winner = existing.effect !== "enforce" && pack.effect === "enforce" ? pack : existing;
     const other = winner === existing ? pack : existing;
-    const catalog = unionCatalog(winner.policies, other.policies);
+    const catalog = unionCatalog(winner.policies, other.policies, effectiveReviewerNames());
     packByPath.set(key, {
       ...winner,
       policies: catalog.policies,
@@ -5839,6 +6102,8 @@ async function loadAllCustomHooks(customPoliciesPaths, opts) {
     if (catalog.overruled.length > 0) {
       warnAuthority(`packs ${existing.id} and ${pack.id} share one artifact and do not all declare ` + `${catalog.overruled.join(", ")} reviewable, so ${catalog.overruled.length === 1 ? "it stays" : "they stay"} hard`);
     }
+    for (const message of catalog.refused)
+      warnAuthority(message);
   }
   for (const customPoliciesPath of typeof customPoliciesPaths === "string" ? [customPoliciesPaths] : customPoliciesPaths ?? []) {
     const absPath = resolve7(projectRoot, customPoliciesPath);
@@ -5849,7 +6114,8 @@ async function loadAllCustomHooks(customPoliciesPaths, opts) {
         loadedPaths.add(absPath);
         const hooksBefore = getCustomHooks().length;
         const failure = await loadSingleFile(absPath, {
-          verifyEntrySha: cloudManaged?.sha256 ?? pack?.sha256
+          verifyEntrySha: cloudManaged?.sha256 ?? pack?.sha256,
+          outsidePack: !pack
         });
         if (failure && pack) {
           for (const id of packIdsByPath.get(absPath) ?? [pack.id])
@@ -5890,7 +6156,7 @@ async function loadAllCustomHooks(customPoliciesPaths, opts) {
   for (const file of projectFiles) {
     loadedPaths.add(file);
     const hooksBefore = getCustomHooks().length;
-    await loadSingleFile(file, { conventionScope: projectScope });
+    await loadSingleFile(file, { conventionScope: projectScope, outsidePack: true });
     const newHooks = getCustomHooks().slice(hooksBefore);
     for (const hook of newHooks) {
       hook.__policyId = conventionPolicyId(projectScope, basename(file), hook.name);
@@ -5912,7 +6178,7 @@ async function loadAllCustomHooks(customPoliciesPaths, opts) {
   for (const file of userFiles) {
     loadedPaths.add(file);
     const hooksBefore = getCustomHooks().length;
-    await loadSingleFile(file, { conventionScope: "user" });
+    await loadSingleFile(file, { conventionScope: "user", outsidePack: true });
     const newHooks = getCustomHooks().slice(hooksBefore);
     for (const hook of newHooks) {
       hook.__policyId = conventionPolicyId("user", basename(file), hook.name);
@@ -5955,7 +6221,7 @@ async function loadAllCustomHooks(customPoliciesPaths, opts) {
   }
   return { hooks: allHooks, conventionSources, packFailures, packAliases };
 }
-var LOADING_KEY = "__FAILPROOFAI_LOADING_HOOKS__", CONVENTION_FILE_RE, loadSequence = 0, policyModuleCache, POLICY_MODULE_CACHE_MAX_ENTRIES = 500, LOADABLE_EXT_RE;
+var LOADING_KEY = "__FAILPROOFAI_LOADING_HOOKS__", CONVENTION_FILE_RE, loadSequence = 0, policyModuleCache, POLICY_MODULE_CACHE_MAX_ENTRIES = 500, LOADABLE_EXT_RE, warnedSemanticOutsidePack;
 var init_custom_hooks_loader = __esm(() => {
   init_hook_logger();
   init_custom_hooks_registry();
@@ -5964,10 +6230,12 @@ var init_custom_hooks_loader = __esm(() => {
   init_hook_telemetry();
   init_telemetry_id();
   init_fp_home();
+  init_effective_reviewers();
   init_policy_authority();
   CONVENTION_FILE_RE = /policies\.(js|mjs|ts)$/;
   policyModuleCache = new Map;
   LOADABLE_EXT_RE = /\.(js|mjs|ts)$/;
+  warnedSemanticOutsidePack = new Set;
 });
 
 // src/hooks/hook-activity-store.ts
@@ -7297,17 +7565,17 @@ var init_pi_projects = __esm(() => {
 // lib/hermes-profiles.ts
 import { existsSync as existsSync10, readdirSync as readdirSync3 } from "node:fs";
 import { homedir as homedir10 } from "node:os";
-import { basename as basename2, dirname as dirname3, join as join11, resolve as resolve8 } from "node:path";
+import { basename as basename2, dirname as dirname4, join as join11, resolve as resolve8 } from "node:path";
 function hermesRoot() {
   const env = (process.env.HERMES_HOME || "").trim();
   if (env) {
     let home = resolve8(env);
-    const parent = dirname3(home);
+    const parent = dirname4(home);
     if (basename2(parent) === PROFILES_DIR)
-      home = dirname3(parent);
+      home = dirname4(parent);
     const base = basename2(home);
     if (base === STANDARD_HOME || base.startsWith(SIBLING_HOME_PREFIX)) {
-      return join11(dirname3(home), STANDARD_HOME);
+      return join11(dirname4(home), STANDARD_HOME);
     }
     return home;
   }
@@ -7341,7 +7609,7 @@ function listHermesProfiles() {
   if (basename2(root) !== STANDARD_HOME)
     return out;
   let siblings = [];
-  const parent = dirname3(root);
+  const parent = dirname4(root);
   try {
     siblings = readdirSync3(parent, { withFileTypes: true }).filter((entry) => (entry.isDirectory() || entry.isSymbolicLink()) && entry.name.startsWith(SIBLING_HOME_PREFIX) && entry.name.length > SIBLING_HOME_PREFIX.length && existsSync10(join11(parent, entry.name, "config.yaml"))).map((entry) => ({
       name: entry.name.slice(SIBLING_HOME_PREFIX.length),
@@ -9901,7 +10169,7 @@ var init_log_entries = __esm(() => {
 // lib/codex-sessions.ts
 import { readFileSync as readFileSync8, readdirSync as readdirSync7, existsSync as existsSync12, writeFileSync as writeFileSync4, mkdirSync as mkdirSync5, statSync as statSync10 } from "node:fs";
 import { readFile as readFile11 } from "node:fs/promises";
-import { dirname as dirname4, join as join24 } from "node:path";
+import { dirname as dirname5, join as join24 } from "node:path";
 import { homedir as homedir16 } from "node:os";
 function readCache() {
   try {
@@ -9914,7 +10182,7 @@ function readCache() {
 }
 function writeCacheEntry(sessionId, path) {
   try {
-    mkdirSync5(dirname4(CACHE_PATH), { recursive: true });
+    mkdirSync5(dirname5(CACHE_PATH), { recursive: true });
     const cache = readCache();
     cache[sessionId] = path;
     writeFileSync4(CACHE_PATH, JSON.stringify(cache), "utf-8");
@@ -11011,6 +11279,8 @@ function missingGuards(input) {
       continue;
     if (outOfScope(err.clis, input.cli))
       continue;
+    if (err.semanticOnly)
+      continue;
     const declared = err.declared ?? [];
     out.push({
       packId: err.id ?? "(unnamed pack)",
@@ -11207,8 +11477,8 @@ var init_fp_reset = __esm(() => {
 });
 
 // src/hooks/semantic/jev-config.ts
-import { closeSync, constants as fsConstants, fstatSync, openSync, readSync, statSync as statSync15 } from "node:fs";
-import { dirname as dirname5 } from "node:path";
+import { closeSync as closeSync2, constants as fsConstants2, fstatSync as fstatSync2, openSync as openSync2, readSync as readSync2, statSync as statSync15 } from "node:fs";
+import { dirname as dirname6 } from "node:path";
 function jevConfigPath() {
   return jevConfigFile();
 }
@@ -11229,6 +11499,19 @@ function validateApiKey(key) {
     return "the API key must be one line of visible ASCII with no spaces (at most 4096 characters)";
   return null;
 }
+function credentialQueryProblem(url) {
+  for (const [name, value] of url.searchParams) {
+    const shown = QUOTABLE_PARAM_RE.test(name) ? `?${name}=` : "one of its query parameters";
+    const flat = name.toLowerCase().replace(/[^a-z0-9]/g, "");
+    if (CREDENTIAL_PARAM_PARTS.some((part) => flat.includes(part)) || CREDENTIAL_PARAM_NAMES.has(flat)) {
+      return `baseUrl must not carry a credential in its query string, and ${shown} is one; put the key in the key field`;
+    }
+    if (looksLikeCredential(value)) {
+      return `baseUrl's ${shown} value is shaped like a credential (not repeated here); put the key in the key field`;
+    }
+  }
+  return null;
+}
 function validateBaseUrl(raw) {
   if (typeof raw !== "string" || raw.trim() === "")
     return { ok: false, problem: "baseUrl must be a non-empty string" };
@@ -11245,6 +11528,9 @@ function validateBaseUrl(raw) {
     return { ok: false, problem: "baseUrl must not carry credentials; put the key in the key field" };
   if (url.hash)
     return { ok: false, problem: "baseUrl must not have a #fragment" };
+  const credentialQuery = credentialQueryProblem(url);
+  if (credentialQuery)
+    return { ok: false, problem: credentialQuery };
   url.pathname = url.pathname.replace(/\/+$/, "") || "/";
   return { ok: true, value: url.toString() };
 }
@@ -11255,6 +11541,16 @@ function isPlainHttp(url) {
     return false;
   }
 }
+function originOf(raw) {
+  try {
+    const url = new URL(raw);
+    if (url.protocol !== "https:" && !(url.protocol === "http:" && LOOPBACK_HOSTS.has(url.hostname)))
+      return null;
+    return url.origin;
+  } catch {
+    return null;
+  }
+}
 function looksLikeCredential(s) {
   if (CREDENTIAL_PREFIX_RE.test(s))
     return true;
@@ -11279,7 +11575,7 @@ function validateModel(raw) {
   }
   return { ok: true, value: raw };
 }
-function validateJevConfig(raw, envKey) {
+function validateJevConfig(raw, envKey, cloud) {
   if (!raw || typeof raw !== "object" || Array.isArray(raw))
     return { ok: false, problem: "the file must hold a JSON object" };
   const o = raw;
@@ -11289,7 +11585,25 @@ function validateJevConfig(raw, envKey) {
   }
   const kind = provider;
   let apiKey;
-  if (o.apiKey !== undefined) {
+  if (kind === JEV_CLOUD_PROVIDER) {
+    if (o.apiKey !== undefined) {
+      return {
+        ok: false,
+        problem: "provider failproofai takes its key from this machine's FailproofAI Cloud connection (credentials.json), " + "never from jev.json — remove apiKey from the file (not repeated here)"
+      };
+    }
+    if (!cloud) {
+      return {
+        ok: false,
+        problem: "this machine is not connected to FailproofAI Cloud with a key that carries jev:evaluate — " + "connect it with: failproofai config --token <key>",
+        notConnected: true
+      };
+    }
+    const bad = validateApiKey(cloud.key);
+    if (bad)
+      return { ok: false, problem: `the FailproofAI Cloud key in credentials.json is unusable: ${bad}` };
+    apiKey = cloud.key;
+  } else if (o.apiKey !== undefined) {
     const bad = validateApiKey(o.apiKey);
     if (bad)
       return { ok: false, problem: bad };
@@ -11312,8 +11626,22 @@ function validateJevConfig(raw, envKey) {
     if (!r.ok)
       return r;
     cfg.baseUrl = r.value;
-  } else if (kind === "custom") {
-    return { ok: false, problem: "provider custom needs a baseUrl" };
+  } else if (kind === "custom" || kind === JEV_CLOUD_PROVIDER) {
+    return { ok: false, problem: `provider ${kind} needs a baseUrl` };
+  }
+  if (kind === JEV_CLOUD_PROVIDER && cloud) {
+    const credentialOrigin = originOf(cloud.url);
+    const baseOrigin = originOf(cfg.baseUrl);
+    if (credentialOrigin === null) {
+      return { ok: false, problem: "the FailproofAI Cloud credential in credentials.json names no usable origin — reconnect: failproofai config --token <key>" };
+    }
+    if (baseOrigin !== credentialOrigin) {
+      return {
+        ok: false,
+        problem: `baseUrl is on ${baseOrigin ?? "an unusable origin"}, but this machine's FailproofAI Cloud key was issued for ${credentialOrigin} — ` + "the key is only ever sent to the origin it was issued for. Point jev.json back at it: failproofai jev setup --provider failproofai"
+      };
+    }
+    cfg.credentialOrigin = credentialOrigin;
   }
   if (kind === "cloudflare") {
     if (typeof o.accountId !== "string" || !CLOUDFLARE_ACCOUNT_ID_RE.test(o.accountId)) {
@@ -11337,18 +11665,38 @@ function validateJevConfig(raw, envKey) {
     cfg.timeoutMs = t;
   }
   if (o.mode !== undefined) {
-    if (o.mode !== "shadow" && o.mode !== "enforce")
-      return { ok: false, problem: 'mode must be "shadow" or "enforce"' };
+    if (o.mode !== "off" && o.mode !== "shadow" && o.mode !== "enforce")
+      return { ok: false, problem: 'mode must be "off", "shadow" or "enforce"' };
     cfg.mode = o.mode;
   }
-  if (cfg.baseUrl !== undefined && isPlainHttp(cfg.baseUrl) && cfg.mode !== "shadow") {
+  if (cfg.baseUrl !== undefined && isPlainHttp(cfg.baseUrl) && cfg.mode === "enforce") {
     return {
       ok: false,
-      problem: "plain http (to localhost) is accepted only with mode shadow: in enforce mode Jev's answers can clear a deny, " + "and while the local proxy is down any process on this machine could take its port and answer. Use https, or mode shadow"
+      problem: "plain http (to localhost) is accepted only with mode shadow: in enforce mode Jev's answers can clear a deny, " + "and while the local proxy is down any process on this machine could take its port and answer. " + (cfg.provider === JEV_CLOUD_PROVIDER ? "Reconnect to an https FailproofAI Cloud URL (failproofai config --token <key> --url https://…), or keep mode shadow" : "Use https, or mode shadow")
     };
   }
   return { ok: true, value: cfg };
 }
+function validateLoadedJevConfig(cfg) {
+  if (cfg.provider !== JEV_CLOUD_PROVIDER)
+    return validateJevConfig(cfg);
+  const { apiKey, credentialOrigin, ...rest } = cfg;
+  if (typeof credentialOrigin !== "string" || credentialOrigin === "") {
+    return {
+      ok: false,
+      problem: "this FailproofAI Cloud config names no credential origin — it did not come from the loader, so its key is not sent anywhere"
+    };
+  }
+  return validateJevConfig(rest, null, { url: credentialOrigin, key: apiKey });
+}
+function namesNoKey(text) {
+  try {
+    const o = JSON.parse(text);
+    return o !== null && typeof o === "object" && !Array.isArray(o) && o.apiKey === undefined;
+  } catch {
+    return false;
+  }
+}
 function readEnvKey() {
   const v = process.env[JEV_API_KEY_ENV];
   return v === undefined || v === "" ? null : v;
@@ -11357,8 +11705,8 @@ function looseConfigDirMode(path) {
   if (!modesAreMeaningful())
     return null;
   try {
-    const mode = statSync15(dirname5(path)).mode & 511;
-    return (mode & DIR_WRITABLE_BY_OTHERS) !== 0 ? mode : null;
+    const mode = statSync15(dirname6(path)).mode & 511;
+    return (mode & DIR_WRITABLE_BY_OTHERS2) !== 0 ? mode : null;
   } catch {
     return null;
   }
@@ -11370,7 +11718,7 @@ function inspectJevConfig() {
   const path = jevConfigPath();
   let fd;
   try {
-    fd = openSync(path, OPEN_FLAGS);
+    fd = openSync2(path, OPEN_FLAGS);
   } catch (err) {
     const code = err.code;
     if (code === "ENOENT" || code === "ENOTDIR")
@@ -11380,18 +11728,35 @@ function inspectJevConfig() {
   let text;
   let mode = null;
   try {
-    const st = fstatSync(fd);
+    const st = fstatSync2(fd);
     if (!st.isFile())
       return { status: "refused", path, mode: null, reason: "unreadable", problem: "it is not a regular file" };
     mode = st.mode & 511;
+    const readText = () => {
+      const buf = Buffer.alloc(st.size);
+      let off = 0;
+      while (off < buf.length) {
+        const n = readSync2(fd, buf, off, buf.length - off, off);
+        if (n === 0)
+          break;
+        off += n;
+      }
+      return buf.subarray(0, off).toString("utf8");
+    };
     if (modesAreMeaningful() && (mode & 63) !== 0) {
+      let keyless = false;
+      try {
+        keyless = st.size <= MAX_CONFIG_BYTES && namesNoKey(readText());
+      } catch {}
+      const perms = mode.toString(8).padStart(4, "0");
       return {
         status: "refused",
         path,
         mode,
         reason: "too-open",
-        problem: `its permissions are ${mode.toString(8).padStart(4, "0")}; it holds a key, so it must be owner-only (chmod 600 ${path})`,
-        fix: `chmod 600 ${path}`
+        problem: !keyless ? `its permissions are ${perms}; it holds a key, so it must be owner-only (chmod 600 ${path})` : (mode & 18) !== 0 ? `its permissions are ${perms}; other users could change it, and with it where Jev sends tool calls and prompts, so it must be owner-only (chmod 600 ${path})` : `its permissions are ${perms}; it must be owner-only (chmod 600 ${path})`,
+        fix: `chmod 600 ${path}`,
+        ...keyless ? { keyless: true } : {}
       };
     }
     const dirMode = looseConfigDirMode(path);
@@ -11401,26 +11766,18 @@ function inspectJevConfig() {
         path,
         mode,
         reason: "too-open",
-        problem: `its directory ${dirname5(path)} is ${dirMode.toString(8).padStart(4, "0")} — other users can write there, ` + `so they can put their own config in its place; it must be owner-only (chmod 700 ${dirname5(path)})`,
-        fix: `chmod 700 ${dirname5(path)}`
+        problem: `its directory ${dirname6(path)} is ${dirMode.toString(8).padStart(4, "0")} — other users can write there, ` + `so they can put their own config in its place; it must be owner-only (chmod 700 ${dirname6(path)})`,
+        fix: `chmod 700 ${dirname6(path)}`
       };
     }
     if (st.size > MAX_CONFIG_BYTES)
       return { status: "refused", path, mode, reason: "too-large", problem: `it is larger than ${MAX_CONFIG_BYTES} bytes` };
-    const buf = Buffer.alloc(st.size);
-    let off = 0;
-    while (off < buf.length) {
-      const n = readSync(fd, buf, off, buf.length - off, off);
-      if (n === 0)
-        break;
-      off += n;
-    }
-    text = buf.subarray(0, off).toString("utf8");
+    text = readText();
   } catch (err) {
     return { status: "refused", path, mode, reason: "unreadable", problem: `cannot read it (${err.code ?? "error"})` };
   } finally {
     try {
-      closeSync(fd);
+      closeSync2(fd);
     } catch {}
   }
   let parsed;
@@ -11429,24 +11786,52 @@ function inspectJevConfig() {
   } catch {
     return { status: "refused", path, mode, reason: "not-json", problem: "it is not valid JSON" };
   }
+  const isObject = parsed !== null && typeof parsed === "object" && !Array.isArray(parsed);
+  const fields = isObject ? parsed : null;
+  if (fields?.mode === "off") {
+    const r = validateJevConfig(parsed, KEY_STAND_IN, standInCloudCredential(fields));
+    if (!r.ok)
+      return { status: "refused", path, mode, reason: "invalid", problem: r.problem };
+    return { status: "off", path, mode, routing: routingOf(r.value) };
+  }
+  if (fields?.provider === JEV_CLOUD_PROVIDER) {
+    const credential = readJevCloudCredential();
+    if (credential.status === "refused") {
+      return {
+        status: "refused",
+        path,
+        mode,
+        reason: credential.reason === "too-open" ? "too-open" : "unreadable",
+        problem: `the FailproofAI Cloud credential was refused: ${credential.problem}`,
+        ...credential.fix ? { fix: credential.fix } : {},
+        credentialsMode: credential.mode
+      };
+    }
+    const r = validateJevConfig(parsed, null, credential.status === "ok" ? credential.credential : null);
+    if (r.ok)
+      return { status: "ok", path, mode, keySource: "cloud", config: r.value };
+    if (r.notConnected === true) {
+      const rest = validateJevConfig(parsed, null, standInCloudCredential(fields));
+      if (!rest.ok)
+        return { status: "refused", path, mode, reason: "invalid", problem: rest.problem };
+      if (credential.status === "absent" && credential.connected) {
+        return { status: "key-lacks-jev", path, mode, routing: routingOf(rest.value), problem: KEY_LACKS_JEV_PROBLEM };
+      }
+      return { status: "not-connected", path, mode, routing: routingOf(rest.value), problem: r.problem };
+    }
+    return { status: "refused", path, mode, reason: "invalid", problem: r.problem };
+  }
   const envKey = readEnvKey();
   const r = validateJevConfig(parsed, envKey);
   if (!r.ok) {
     if (r.missingKey === true) {
       const rest = validateJevConfig(parsed, KEY_STAND_IN);
       if (rest.ok) {
-        const routing = { provider: rest.value.provider, mode: rest.value.mode, timeoutMs: rest.value.timeoutMs };
-        if (rest.value.baseUrl !== undefined)
-          routing.baseUrl = rest.value.baseUrl;
-        if (rest.value.accountId !== undefined)
-          routing.accountId = rest.value.accountId;
-        if (rest.value.model !== undefined)
-          routing.model = rest.value.model;
         return {
           status: "key-missing",
           path,
           mode,
-          routing,
+          routing: routingOf(rest.value),
           problem: `it carries no apiKey, so the key comes from ${JEV_API_KEY_ENV} — which is not set in this environment`
         };
       }
@@ -11457,33 +11842,56 @@ function inspectJevConfig() {
   const keySource = parsed.apiKey !== undefined ? "file" : "env";
   return { status: "ok", path, mode, keySource, config: r.value };
 }
+function routingOf(cfg) {
+  const routing = { provider: cfg.provider, mode: cfg.mode, timeoutMs: cfg.timeoutMs };
+  if (cfg.baseUrl !== undefined)
+    routing.baseUrl = cfg.baseUrl;
+  if (cfg.accountId !== undefined)
+    routing.accountId = cfg.accountId;
+  if (cfg.model !== undefined)
+    routing.model = cfg.model;
+  return routing;
+}
+function standInCloudCredential(fields) {
+  let url = "https://stand-in.invalid";
+  if (typeof fields.baseUrl === "string") {
+    try {
+      url = new URL(fields.baseUrl.trim()).origin;
+    } catch {}
+  }
+  return { url, key: KEY_STAND_IN };
+}
 function loadJevConfig() {
   try {
     const r = inspectJevConfig();
-    return r.status === "ok" ? r.config : null;
+    return r.status === "ok" && r.config.mode !== "off" ? r.config : null;
   } catch {
     return null;
   }
 }
-var DEFAULT_JEV_MODE = "enforce", JEV_PROVIDER_KINDS, JEV_API_KEY_ENV = "FAILPROOFAI_JEV_API_KEY", JEV_CONFIG_DEFAULT_TIMEOUT_MS = 3000, MIN_JEV_TIMEOUT_MS = 100, MAX_JEV_TIMEOUT_MS = 1e4, JEV_CALIBRATED_FAMILY, MAX_CONFIG_BYTES, OPEN_FLAGS, VERSIONED_MODEL_RE, CLOUDFLARE_ACCOUNT_ID_RE, API_KEY_RE, MODEL_RE, LOOPBACK_HOSTS, CREDENTIAL_PREFIX_RE, KEY_STAND_IN = "supplied-by-the-environment", DIR_WRITABLE_BY_OTHERS = 18;
+var DEFAULT_JEV_MODE = "enforce", JEV_PROVIDER_KINDS, JEV_CLOUD_PROVIDER = "failproofai", JEV_API_KEY_ENV = "FAILPROOFAI_JEV_API_KEY", JEV_CONFIG_DEFAULT_TIMEOUT_MS = 3000, MIN_JEV_TIMEOUT_MS = 100, MAX_JEV_TIMEOUT_MS = 1e4, JEV_CALIBRATED_FAMILY, MAX_CONFIG_BYTES, OPEN_FLAGS, VERSIONED_MODEL_RE, CLOUDFLARE_ACCOUNT_ID_RE, API_KEY_RE, MODEL_RE, LOOPBACK_HOSTS, CREDENTIAL_PARAM_PARTS, CREDENTIAL_PARAM_NAMES, QUOTABLE_PARAM_RE, CREDENTIAL_PREFIX_RE, KEY_STAND_IN = "supplied-by-the-environment", DIR_WRITABLE_BY_OTHERS2 = 18, KEY_LACKS_JEV_PROBLEM = "this machine is connected to FailproofAI Cloud, but no Jev key is stored for that connection (its key lacks jev:evaluate, or the connect could not confirm it)";
 var init_jev_config = __esm(() => {
+  init_fp_config();
   init_fp_home();
-  JEV_PROVIDER_KINDS = ["typesafe", "openrouter", "vercel", "cloudflare", "custom"];
+  JEV_PROVIDER_KINDS = ["typesafe", "openrouter", "vercel", "cloudflare", "custom", "failproofai"];
   JEV_CALIBRATED_FAMILY = { major: 1, minor: 13 };
   MAX_CONFIG_BYTES = 64 * 1024;
-  OPEN_FLAGS = fsConstants.O_RDONLY | (fsConstants.O_NONBLOCK ?? 0);
+  OPEN_FLAGS = fsConstants2.O_RDONLY | (fsConstants2.O_NONBLOCK ?? 0);
   VERSIONED_MODEL_RE = /^(?:(?:typesafe|typesafe-ai)\/)?jev-(\d{1,4})\.(\d{1,4})(?:\.(\d{1,6}))?(?:-(\d{8}))?$/;
   CLOUDFLARE_ACCOUNT_ID_RE = /^[0-9a-f]{32}$/;
   API_KEY_RE = /^[\x21-\x7e]{1,4096}$/;
   MODEL_RE = /^[A-Za-z0-9._:/@~+-]{1,200}$/;
   LOOPBACK_HOSTS = new Set(["localhost", "127.0.0.1", "[::1]", "::1"]);
+  CREDENTIAL_PARAM_PARTS = ["key", "token", "secret", "password", "passwd", "credential", "auth", "signature"];
+  CREDENTIAL_PARAM_NAMES = new Set(["pw", "pass", "sig", "sid", "jwt", "bearer", "session", "code", "access"]);
+  QUOTABLE_PARAM_RE = /^[A-Za-z0-9._-]{1,40}$/;
   CREDENTIAL_PREFIX_RE = /^(?:(?:sk|rk)[-_]|gh[pousr]_|github_pat_|glpat-|xox[abprs]-|AKIA[0-9A-Z]{12}|AIza[0-9A-Za-z_-]{20}|hf_[A-Za-z0-9]{16}|vck_)/;
 });
 
 // src/hooks/semantic/facts.ts
 import { existsSync as existsSync18, readFileSync as readFileSync15, statSync as statSync16 } from "node:fs";
 import { homedir as homedir20 } from "node:os";
-import { dirname as dirname6, isAbsolute as isAbsolute3, resolve as resolve14 } from "node:path";
+import { dirname as dirname7, isAbsolute as isAbsolute3, resolve as resolve14 } from "node:path";
 function classifyTool(toolName) {
   if (SHELL_TOOLS.has(toolName))
     return { toolClass: "shell", toolIsKnown: true };
@@ -11662,7 +12070,7 @@ function findGitDir(start) {
     const candidate = resolve14(dir, ".git");
     if (existsSync18(candidate))
       return candidate;
-    const parent = dirname6(dir);
+    const parent = dirname7(dir);
     if (parent === dir)
       return null;
     dir = parent;
@@ -11673,7 +12081,7 @@ function findProjectRoot(cwd) {
   if (!cwd)
     return null;
   const gitDir = findGitDir(cwd);
-  return gitDir ? dirname6(gitDir) : cwd;
+  return gitDir ? dirname7(gitDir) : cwd;
 }
 function readCurrentBranch(cwd) {
   if (!cwd)
@@ -11688,7 +12096,7 @@ function readCurrentBranch(cwd) {
       const m = /^gitdir:\s*(.+)$/.exec(pointer);
       if (!m)
         return null;
-      headFile = resolve14(dirname6(gitPath), m[1], "HEAD");
+      headFile = resolve14(dirname7(gitPath), m[1], "HEAD");
     }
     const head = readFileSync15(headFile, "utf8").trim();
     const ref = /^ref:\s*refs\/heads\/(.+)$/.exec(head);
@@ -11697,9 +12105,9 @@ function readCurrentBranch(cwd) {
     return null;
   }
 }
-function computeFacts(toolName, toolInput, cwd, permissionMode, scanned) {
+function computeFacts(toolName, toolInput, cwd, permissionMode, scanned, pinnedProjectRoot = null) {
   const { toolClass, toolIsKnown } = classifyTool(toolName);
-  const projectRoot = findProjectRoot(cwd);
+  const projectRoot = pinnedProjectRoot ?? findProjectRoot(cwd);
   return {
     toolName,
     toolClass,
@@ -11750,6 +12158,15 @@ function targetTokens(toolInput) {
           out.add(t);
       }
     }
+    if (out.size === 0) {
+      for (const piece of command.split(/[;&|\n]+/)) {
+        for (const tok of piece.trim().split(/\s+/).slice(1)) {
+          if (!tok.startsWith("-"))
+            for (const t of tokensOf(tok))
+              out.add(t);
+        }
+      }
+    }
     return out;
   }
   for (const [key, value] of Object.entries(toolInput)) {
@@ -11790,6 +12207,8 @@ function decide(selected, answers, toolInput, userSaid, thresholds = DEFAULT_THR
     const base = {
       policy: p.name,
       mode: p.mode,
+      userCanOverride: p.userCanOverride,
+      ...p.origin ? { origin: p.origin } : {},
       evidence,
       exempt,
       userAsked,
@@ -11869,6 +12288,8 @@ function decideV1(selected, answers, toolInput, userSaid, agentLastMessage, opts
     const base = {
       policy: p.name,
       mode: p.mode,
+      userCanOverride: p.userCanOverride,
+      ...p.origin ? { origin: p.origin } : {},
       evidence,
       exempt,
       userAsked: op,
@@ -12187,7 +12608,7 @@ var init_policies = __esm(() => {
           }
         }
       ],
-      guidance: "This sends secrets or private files to a remote destination. It is blocked regardless of instructions."
+      guidance: "This sends secrets or private files to a remote destination, which the user cannot approve. Do not send them."
     },
     {
       name: "remote-code-execution",
@@ -13306,6 +13727,14 @@ function literalValue(text, at, opts) {
   }
   return opts.stop.at > at ? { quote: "", from: at, to: opts.stop.at } : null;
 }
+function looksRandomB64(t) {
+  if (!/[+/]/.test(t))
+    return false;
+  const bare = t.replace(/=+$/, "");
+  if (bare.split(/[+/]/).some((seg) => /^[A-Z]?[a-z]{3,}$/.test(seg) || /^[A-Z]{4,}$/.test(seg)))
+    return false;
+  return looksRandomToken(bare.replace(/[+/]/g, ""));
+}
 function nameComponents(name) {
   return name.replace(/([a-z0-9])([A-Z])/g, "$1_$2").toLowerCase().split(/[^a-z0-9]+/).filter(Boolean);
 }
@@ -13707,6 +14136,7 @@ function redactSecretsDetailed(text, opts = {}) {
   if (blunt)
     out = redactCredentialArguments(out, c);
   out = redactNamedSecrets(out, c);
+  out = replaceCounting(out, LONG_B64_TOKEN_RE, (m, _g, offset, whole) => looksRandomB64(m) && !insideDigest(whole, offset) ? marker("high-entropy token") : null, c, "skip");
   out = replaceCounting(out, LONG_TOKEN_RE, (m, _g, offset, whole) => looksRandomToken(m) && !insideDigest(whole, offset) ? marker("high-entropy token") : null, c, "skip");
   return { text: out, count: c.n, found: c.found, weak: c.weak };
 }
@@ -13757,7 +14187,7 @@ function redactNameValue(text, re, c, isSecret) {
   re.lastIndex = 0;
   return last === 0 ? text : out + text.slice(last);
 }
-var marker = (label) => `<redacted:${label}>`, MAX_DELIMITED_RUN = 256, NOT_MID_WORD = "(?<![A-Za-z0-9_])", NOT_MID_HYPHENATED_WORD = "(?:(?<![A-Za-z0-9_-])|(?<=(?:^|[^A-Za-z0-9_-])-))", OPEN_ENDED, SHARED_RULES, SHARED_PATTERN_EXTENDED, PEM_ARMOUR_HEAD, PEM_HEADER_RE, PEM_BODY_RUN_RE, PEM_TO_CUT, PEM_TO_CUT_RE, PEM_CUT_FRAGMENT_RE, MIN_KEY_LINE = 16, KEY_BODY_MARK, PEM_LINE_BREAK_RE, isKeyMaterialLine = (line) => line.length >= MIN_KEY_LINE && isBase64Run(line), PEM_ARMOUR_LINE_RE, PEM_FOOTER_RE, BASE64_CHAR, VENDOR_RULES, WEBHOOK_RULES, URL_CREDENTIALS_RE, URL_TOKEN_USERINFO_RE, CREDENTIAL_HEADER_NAMES, CREDENTIAL_HEADER_RE, CREDENTIAL_FIELD_RE, AUTH_MARKER_HEAD = "<redacted:", AUTH_MARKER_RE, withoutMarkers = (s) => s.replace(AUTH_MARKER_RE, ""), CONTRACTION_TAIL_RE, VALUE_CLOSED_BY, MAX_CONTINUATION_LINES = 32, NOT_CREDENTIAL_CHARS_RE, NOT_CREDENTIAL_START_RE, DOTTED_IDENTIFIER_RE, BEARER_RE, CREDENTIAL_FLAGS, GATED_CREDENTIAL_FLAGS, BASIC_AUTH_FLAGS, BASIC_AUTH_COMMANDS, COMMAND_LOOKBACK = 120, FLAG_TOKEN_RE, WORD_BEFORE_RE, WORD_AFTER_RE, GATING_WORDS, CONFIG_SET_RE, ASSIGNMENT_NAME_RE, FLAG_NAME_RE, UNQUOTED_VALUE_STOP_RE, LONG_TOKEN_RE, STRONG_LAST_WORDS, STRONG_KEY_QUALIFIERS, WEAK_LAST_WORDS, NOT_SECRET_QUALIFIERS, META_SUFFIXES, SECRET_NAME_HINTS, NON_VALUE_WORDS, TYPED_ARRAY_RE, TYPE_WORDS, REFERENCE_START_RE, envSecretSource = null, envSecretCache = null, scrubbable = (secret) => secret.length >= 16 || secret.length >= 8 && tokenLike(secret), NO_SECRETS;
+var marker = (label) => `<redacted:${label}>`, MAX_DELIMITED_RUN = 256, NOT_MID_WORD = "(?<![A-Za-z0-9_])", NOT_MID_HYPHENATED_WORD = "(?:(?<![A-Za-z0-9_-])|(?<=(?:^|[^A-Za-z0-9_-])-))", OPEN_ENDED, SHARED_RULES, SHARED_PATTERN_EXTENDED, PEM_ARMOUR_HEAD, PEM_HEADER_RE, PEM_BODY_RUN_RE, PEM_TO_CUT, PEM_TO_CUT_RE, PEM_CUT_FRAGMENT_RE, MIN_KEY_LINE = 16, KEY_BODY_MARK, PEM_LINE_BREAK_RE, isKeyMaterialLine = (line) => line.length >= MIN_KEY_LINE && isBase64Run(line), PEM_ARMOUR_LINE_RE, PEM_FOOTER_RE, BASE64_CHAR, VENDOR_RULES, WEBHOOK_RULES, URL_CREDENTIALS_RE, URL_TOKEN_USERINFO_RE, CREDENTIAL_HEADER_NAMES, CREDENTIAL_HEADER_RE, CREDENTIAL_FIELD_RE, AUTH_MARKER_HEAD = "<redacted:", AUTH_MARKER_RE, withoutMarkers = (s) => s.replace(AUTH_MARKER_RE, ""), CONTRACTION_TAIL_RE, VALUE_CLOSED_BY, MAX_CONTINUATION_LINES = 32, NOT_CREDENTIAL_CHARS_RE, NOT_CREDENTIAL_START_RE, DOTTED_IDENTIFIER_RE, BEARER_RE, CREDENTIAL_FLAGS, GATED_CREDENTIAL_FLAGS, BASIC_AUTH_FLAGS, BASIC_AUTH_COMMANDS, COMMAND_LOOKBACK = 120, FLAG_TOKEN_RE, WORD_BEFORE_RE, WORD_AFTER_RE, GATING_WORDS, CONFIG_SET_RE, ASSIGNMENT_NAME_RE, FLAG_NAME_RE, UNQUOTED_VALUE_STOP_RE, LONG_TOKEN_RE, LONG_B64_TOKEN_RE, STRONG_LAST_WORDS, STRONG_KEY_QUALIFIERS, WEAK_LAST_WORDS, NOT_SECRET_QUALIFIERS, META_SUFFIXES, SECRET_NAME_HINTS, NON_VALUE_WORDS, TYPED_ARRAY_RE, TYPE_WORDS, REFERENCE_START_RE, envSecretSource = null, envSecretCache = null, scrubbable = (secret) => secret.length >= 16 || secret.length >= 8 && tokenLike(secret), NO_SECRETS;
 var init_redact = __esm(() => {
   init_builtin_policies();
   OPEN_ENDED = /^(?:(\+)|(\*)|\{(\d+),\})/;
@@ -13874,6 +14304,7 @@ var init_redact = __esm(() => {
   FLAG_NAME_RE = /(^|\\[nrt]|[^A-Za-z0-9_.-])(--?[A-Za-z][A-Za-z0-9_-]*)([ \t]+)/g;
   UNQUOTED_VALUE_STOP_RE = /[\s"'`<>(){}[\],;&|\\]/;
   LONG_TOKEN_RE = /[A-Za-z0-9_-]{32,}/g;
+  LONG_B64_TOKEN_RE = /[A-Za-z0-9+/_-]{32,}={0,2}/g;
   STRONG_LAST_WORDS = new Set([
     "secret",
     "password",
@@ -14373,7 +14804,7 @@ function scrubDeep(value, acc, scrubber) {
   }
   return Object.fromEntries(out);
 }
-function buildEnvelope(toolInput, userSaid, facts, scanned, opts = {}) {
+function buildEnvelope(toolInput, userSaid, facts, _scanned, opts = {}) {
   const limits = opts.limits ?? DEFAULT_ENVELOPE_LIMITS;
   const acc = {
     redactions: 0,
@@ -14389,7 +14820,6 @@ function buildEnvelope(toolInput, userSaid, facts, scanned, opts = {}) {
   const turns = Array.isArray(userSaid) ? userSaid : [];
   const f = facts && typeof facts === "object" ? facts : {};
   const rawCommand = typeof input0.command === "string" ? input0.command : null;
-  const scanIncomplete = rawCommand !== null && rawCommand.length > MAX_SCAN_CHARS;
   openBudget(acc, limits.contextChars);
   enter(acc, "facts");
   const agentLastRaw = asText(opts.agentLastMessage);
@@ -14430,10 +14860,8 @@ function buildEnvelope(toolInput, userSaid, facts, scanned, opts = {}) {
   const agentLastSent = agentLast === null ? null : cleanString(agentLast, limits.messageChars, acc);
   openBudget(acc, limits.requestChars);
   enter(acc, "request");
-  const stripped = scanned && rawCommand !== null && !scanIncomplete ? asText(scanned.withoutComments) : null;
-  const judged = stripped ?? rawCommand;
   shell(acc, true);
-  const command = judged === null ? null : cleanString(judged, limits.stringChars, acc);
+  const command = rawCommand === null ? null : cleanString(rawCommand, limits.stringChars, acc);
   shell(acc, false);
   const toolForRequest = factStringIn(f.toolName, limits.factChars, acc);
   const readable = entriesOf(input0);
@@ -14442,10 +14870,6 @@ function buildEnvelope(toolInput, userSaid, facts, scanned, opts = {}) {
   const rest = (readable ?? []).filter(([k]) => !(k === "command" && command !== null));
   shell(acc, f.toolIsKnown !== true);
   const input = buildObject(rest, acc, limits, 0);
-  shell(acc, false);
-  shell(acc, true);
-  const removedComments = scanned?.commentsRemoved && !scanIncomplete ? cleanString((scanned.comments ?? []).join(`
-`), limits.stringChars, acc) : null;
   shell(acc, false);
   const state = {
     how_to_read: howToRead,
@@ -14455,8 +14879,6 @@ function buildEnvelope(toolInput, userSaid, facts, scanned, opts = {}) {
     agent_request: {
       tool: toolForRequest,
       input: command === null ? input : { command, ...input },
-      ...removedComments !== null ? { shell_comments_removed: true, removed_shell_comments: removedComments } : {},
-      ...scanIncomplete ? { shell_comments_not_removed: true } : {},
       ...acc.requestCut ? { request_was_cut: true } : {}
     }
   };
@@ -14483,7 +14905,6 @@ function buildEnvelope(toolInput, userSaid, facts, scanned, opts = {}) {
 }
 var MAX_STRING_CHARS = 128000, MAX_AGENT_REQUEST_CHARS = 128000, MAX_CONTEXT_CHARS = 32000, MAX_USER_MESSAGE_CHARS = 6000, MAX_USER_MESSAGES = 3, MAX_FACT_CHARS = 2000, MAX_KEY_CHARS = 256, MAX_DEPTH = 64, STATE_OVERHEAD = 1024, MAX_STATE_CHARS, DEFAULT_ENVELOPE_LIMITS, OMITTED = "…", TOO_DEEP = "<nested value omitted>", UNREPRESENTABLE = "<value omitted>", SHELL_METACHARACTERS, NEEDS_SANITISING, EMPTY_STRING_COST = 2, SEPARATOR_COST = 1, CONTAINER_COST = 2, CUT_STOP, CUT_SNAP_MAX = 256, isEscapeLetter = (c) => c === "n" || c === "r" || c === "t";
 var init_envelope = __esm(() => {
-  init_facts();
   init_redact();
   init_redact();
   MAX_STATE_CHARS = MAX_AGENT_REQUEST_CHARS + MAX_CONTEXT_CHARS + STATE_OVERHEAD;
@@ -14520,18 +14941,18 @@ __export(exports_intent, {
 });
 import {
   chmodSync as chmodSync2,
-  closeSync as closeSync2,
+  closeSync as closeSync3,
   mkdirSync as mkdirSync8,
-  openSync as openSync2,
+  openSync as openSync3,
   readdirSync as readdirSync13,
   readFileSync as readFileSync16,
-  readSync as readSync2,
+  readSync as readSync3,
   renameSync as renameSync4,
   statSync as statSync17,
   unlinkSync as unlinkSync2,
   writeFileSync as writeFileSync6
 } from "node:fs";
-import { dirname as dirname7, resolve as resolve15 } from "node:path";
+import { dirname as dirname8, resolve as resolve15 } from "node:path";
 function modesAreMeaningful2() {
   return process.platform !== "win32";
 }
@@ -14543,7 +14964,7 @@ function storeDirChain() {
     chain.push(dir);
     if (dir === home)
       break;
-    const parent = dirname7(dir);
+    const parent = dirname8(dir);
     if (parent === dir)
       break;
     dir = parent;
@@ -14560,11 +14981,11 @@ function looseIntentStoreDir() {
     } catch {
       continue;
     }
-    if ((mode & DIR_WRITABLE_BY_OTHERS2) === 0)
+    if ((mode & DIR_WRITABLE_BY_OTHERS3) === 0)
       continue;
     try {
-      chmodSync2(dir, mode & ~DIR_WRITABLE_BY_OTHERS2);
-      if ((statSync17(dir).mode & DIR_WRITABLE_BY_OTHERS2) !== 0)
+      chmodSync2(dir, mode & ~DIR_WRITABLE_BY_OTHERS3);
+      if ((statSync17(dir).mode & DIR_WRITABLE_BY_OTHERS3) !== 0)
         return dir;
     } catch {
       return dir;
@@ -14929,7 +15350,7 @@ function visitLinesBackwards(transcriptPath, maxBytes, visit) {
     const st = statSync17(path);
     if (!st.isFile() || st.size === 0)
       return;
-    fd = openSync2(path, "r");
+    fd = openSync3(path, "r");
     let end = st.size;
     let consumed = 0;
     let partial = Buffer.alloc(0);
@@ -14937,7 +15358,7 @@ function visitLinesBackwards(transcriptPath, maxBytes, visit) {
       const len = Math.min(TAIL_CHUNK_BYTES, end, maxBytes - consumed);
       const start = end - len;
       const chunk = Buffer.alloc(len);
-      readSync2(fd, chunk, 0, len, start);
+      readSync3(fd, chunk, 0, len, start);
       consumed += len;
       end = start;
       const buf = partial.length > 0 ? Buffer.concat([chunk, partial]) : chunk;
@@ -14958,13 +15379,13 @@ function visitLinesBackwards(transcriptPath, maxBytes, visit) {
     }
     if (end > 0 && partial.length > 0) {
       const before = Buffer.alloc(1);
-      if (readSync2(fd, before, 0, 1, end - 1) === 1 && before[0] === 10)
+      if (readSync3(fd, before, 0, 1, end - 1) === 1 && before[0] === 10)
         visit(partial);
     }
   } catch {} finally {
     if (fd !== undefined) {
       try {
-        closeSync2(fd);
+        closeSync3(fd);
       } catch {}
     }
   }
@@ -14999,7 +15420,7 @@ function readIntent(sessionId, now = Date.now()) {
   const agent = latest && typeof latest.agent === "string" && latest.agent.length > 0 ? latest.agent : null;
   return { userSaid: prompts.map((p) => p.text), agentLastMessage: agent };
 }
-var MAX_RECORDED_PROMPTS = 5, INTENT_MAX_AGE_MS, MAX_CLOCK_SKEW_MS, SESSION_ID_RE2, sessionsDir = () => resolve15(semanticDir(), "sessions"), intentFile = (sessionId) => resolve15(sessionsDir(), `${sessionId}.json`), DIR_WRITABLE_BY_OTHERS2 = 18, SESSION_FILE_RE3, NON_HUMAN_PREFIXES, CONTINUATION_PREFIX = "This session is being continued from a previous conversation", IDE_MACHINE_OPENERS, IDE_AMBIGUOUS_OPENERS, IDE_REQUEST_HEADINGS, obj = (v) => v && typeof v === "object" && !Array.isArray(v) ? v : undefined, CLAUDE_MACHINE_SOURCES, claudeMachineTurn = (payload) => typeof payload.source === "string" && CLAUDE_MACHINE_SOURCES.has(payload.source), piMachineTurn = (payload) => payload.input_source === "extension" || payload.source === "extension", openclawMachineRun = (payload) => {
+var MAX_RECORDED_PROMPTS = 5, INTENT_MAX_AGE_MS, MAX_CLOCK_SKEW_MS, SESSION_ID_RE2, sessionsDir = () => resolve15(semanticDir(), "sessions"), intentFile = (sessionId) => resolve15(sessionsDir(), `${sessionId}.json`), DIR_WRITABLE_BY_OTHERS3 = 18, SESSION_FILE_RE3, NON_HUMAN_PREFIXES, CONTINUATION_PREFIX = "This session is being continued from a previous conversation", IDE_MACHINE_OPENERS, IDE_AMBIGUOUS_OPENERS, IDE_REQUEST_HEADINGS, obj = (v) => v && typeof v === "object" && !Array.isArray(v) ? v : undefined, CLAUDE_MACHINE_SOURCES, claudeMachineTurn = (payload) => typeof payload.source === "string" && CLAUDE_MACHINE_SOURCES.has(payload.source), piMachineTurn = (payload) => payload.input_source === "extension" || payload.source === "extension", openclawMachineRun = (payload) => {
   const meta = obj(payload.openclaw);
   if (!meta)
     return false;
@@ -15082,26 +15503,37 @@ var init_intent = __esm(() => {
 });
 
 // src/hooks/semantic/jev-client.ts
-function errorDetail(body, secret) {
+function printable(s) {
+  return s.replace(/[\u0000-\u001f\u007f-\u009f]/g, " ");
+}
+function providerErrorDetail(body, secret) {
   const b = body;
   let detail = "";
   if (b && typeof b === "object") {
     if (Array.isArray(b.errors)) {
       detail = b.errors.map((e) => typeof e?.message === "string" ? e.message : "").filter(Boolean).join("; ");
     }
-    if (!detail && b.error && typeof b.error === "object") {
-      const m = b.error.message;
-      if (typeof m === "string")
-        detail = m;
+    if (!detail && typeof b.error === "string" && b.error && typeof b.message === "string" && b.message) {
+      detail = `${b.error}: ${b.message}`;
     }
-    if (!detail && typeof b.error === "string")
-      detail = b.error;
+    if (!detail)
+      detail = messageOf(b.error);
     if (!detail && typeof b.message === "string")
       detail = b.message;
-    if (!detail && typeof b.detail === "string")
-      detail = b.detail;
+    if (!detail)
+      detail = messageOf(b.detail);
+  }
+  return printable(scrubSecret(detail, secret)).slice(0, MAX_ERROR_DETAIL);
+}
+function messageOf(value) {
+  if (typeof value === "string")
+    return value;
+  if (value && typeof value === "object" && !Array.isArray(value)) {
+    const m = value.message;
+    if (typeof m === "string")
+      return m;
   }
-  return scrubSecret(detail, secret).slice(0, MAX_ERROR_DETAIL);
+  return "";
 }
 function scrubSecret(text, secret) {
   return secret.length >= 4 ? text.split(secret).join("[key]") : text;
@@ -15109,10 +15541,25 @@ function scrubSecret(text, secret) {
 function paymentRequiredCode(detail) {
   return MODEL_EXECUTION_402_RE.test(detail) ? JEV_REASON_PROVIDER_REFUSED : "out-of-credits";
 }
+function isSystemOneUrl(url) {
+  try {
+    return /\/systemone$/i.test(new URL(url).pathname);
+  } catch {
+    return false;
+  }
+}
+function httpFailureMessage(status, url, detail, derivedBase = false) {
+  if (status === 404 && derivedBase)
+    return `nothing is served at ${displayEndpoint(url)}${detail ? ` (${detail})` : ""}`;
+  if (status === 404 && isSystemOneUrl(url)) {
+    return `nothing is served at ${displayEndpoint(url)}${detail ? ` (${detail})` : ""}. ` + "`/systemone` is appended to the base URL you configured, and every Jev route serves it at the provider's version root — " + "so this is a base URL that is wrong, not a provider that is down.";
+  }
+  return detail || `HTTP ${status}`;
+}
 function isRedirect(res) {
   return res.type === "opaqueredirect" || res.status >= 300 && res.status < 400;
 }
-async function postJson(url, bearer, body, signal) {
+async function postJson(url, bearer, body, signal, derivedBase = false) {
   let res;
   try {
     res = await fetch(url, {
@@ -15134,6 +15581,7 @@ async function postJson(url, bearer, body, signal) {
     const status = res.status >= 300 && res.status < 400 ? String(res.status) : "3xx";
     throw new JevError(`http-${status}`, `HTTP ${status}: the endpoint answered with a redirect, which is never followed`);
   }
+  const retryAfter = res.status === 429 || res.status === 503 ? res.headers.get("retry-after") : null;
   let parsed;
   try {
     parsed = await res.json();
@@ -15143,15 +15591,15 @@ async function postJson(url, bearer, body, signal) {
     if (res.status === 402)
       throw new JevError("out-of-credits", "HTTP 402: the account is out of credits");
     if (!res.ok)
-      throw new JevError(`http-${res.status}`, `HTTP ${res.status}`);
+      throw new JevError(`http-${res.status}`, httpFailureMessage(res.status, url, "", derivedBase), { retryAfter });
     throw new JevError("malformed", "response body is not JSON");
   }
   if (res.status === 402) {
-    const detail = errorDetail(parsed, bearer);
+    const detail = providerErrorDetail(parsed, bearer);
     throw new JevError(paymentRequiredCode(detail), detail || "HTTP 402: the account is out of credits");
   }
   if (!res.ok) {
-    throw new JevError(`http-${res.status}`, errorDetail(parsed, bearer) || `HTTP ${res.status}`);
+    throw new JevError(`http-${res.status}`, httpFailureMessage(res.status, url, providerErrorDetail(parsed, bearer), derivedBase), { retryAfter });
   }
   return parsed;
 }
@@ -15165,7 +15613,7 @@ function normalizeNative(body, sentModel, opts) {
   if (typeof b.answers !== "object" || b.answers === null) {
     if (b.error !== undefined) {
       const code = typeof b.error === "object" && b.error !== null ? b.error.code : undefined;
-      const detail = errorDetail(body, opts.apiKey) || "the provider reported an error";
+      const detail = providerErrorDetail(body, opts.apiKey) || "the provider reported an error";
       if (code === 402 || code === "402")
         throw new JevError(paymentRequiredCode(detail), detail);
       if (typeof code === "number" && (code === 429 || code >= 500))
@@ -15196,7 +15644,7 @@ function nativeTransport(opts) {
   return async (request, signal) => {
     const model = opts.model ?? request.model;
     const body = { ...request, model, ...opts.extraBody ?? {} };
-    return normalizeNative(await postJson(opts.url, opts.apiKey, body, signal), model, opts);
+    return normalizeNative(await postJson(opts.url, opts.apiKey, body, signal, opts.derivedBase), model, opts);
   };
 }
 function cloudflareTransport(token, accountId, opts = {}) {
@@ -15271,7 +15719,7 @@ function nativeEndpoint(baseUrl) {
   return url.toString();
 }
 function validated(cfg) {
-  const v = validateJevConfig(cfg);
+  const v = validateLoadedJevConfig(cfg);
   if (!v.ok)
     throw new JevError("config", v.problem);
   return v.value;
@@ -15286,9 +15734,49 @@ function jevRoute(input) {
   }
   const base = cfg.baseUrl ?? defaults.baseUrl;
   if (!base)
-    throw new JevError("config", "provider custom needs a baseUrl");
+    throw new JevError("config", `provider ${cfg.provider} needs a baseUrl`);
   return { via: cfg.provider, endpoint: nativeEndpoint(base), model, modelIsDefault };
 }
+function displayEndpoint(endpoint) {
+  try {
+    const url = new URL(endpoint);
+    const shown = `${url.origin}${url.pathname}`;
+    return url.search ? `${shown}?…` : shown;
+  } catch {
+    return "(invalid URL)";
+  }
+}
+function retryAfterMs(header, nowEpochMs = Date.now()) {
+  const raw = header?.trim() ?? "";
+  let ms;
+  if (/^\d{1,10}$/.test(raw)) {
+    ms = Number(raw) * 1000;
+  } else if (IMF_FIXDATE_RE.test(raw) && Number.isFinite(Date.parse(raw))) {
+    ms = Date.parse(raw) - nowEpochMs;
+  } else {
+    return JEV_CLOUD_RETRY_AFTER_DEFAULT_MS;
+  }
+  return Math.min(JEV_CLOUD_RETRY_AFTER_CAP_MS, Math.max(0, ms));
+}
+function cloudRetryAfter(endpoint, transport) {
+  return async (request, signal) => {
+    const now = performance.now();
+    if (cloudCooldown.endpoint === endpoint && now < cloudCooldown.until) {
+      const seconds = Math.max(1, Math.ceil((cloudCooldown.until - now) / 1000));
+      throw new JevError(cloudCooldown.code, cloudCooldown.code === "http-503" ? `FailproofAI Cloud could not serve Jev; asking again in ${seconds}s, so this one was not sent` : `FailproofAI Cloud asked for no Jev requests for ${seconds}s more (Retry-After), so this one was not sent`);
+    }
+    try {
+      return await transport(request, signal);
+    } catch (err) {
+      if (err instanceof JevError && (err.code === "http-429" || err.code === "http-503")) {
+        cloudCooldown.endpoint = endpoint;
+        cloudCooldown.code = err.code;
+        cloudCooldown.until = performance.now() + (err.code === "http-503" && err.retryAfter === null ? JEV_CLOUD_RETRY_AFTER_CAP_MS : retryAfterMs(err.retryAfter));
+      }
+      throw err;
+    }
+  };
+}
 function transportForConfig(input) {
   const cfg = validated(input);
   const route = jevRoute(cfg);
@@ -15340,9 +15828,21 @@ function transportForConfig(input) {
         via: "custom",
         model: route.model
       };
+    case "failproofai":
+      return {
+        transport: cloudRetryAfter(route.endpoint, nativeTransport({
+          url: route.endpoint,
+          apiKey: cfg.apiKey,
+          model: route.model,
+          allowUnreported: false,
+          derivedBase: true
+        })),
+        via: "failproofai",
+        model: route.model
+      };
   }
 }
-var CLOUDFLARE_JEV_MODEL = "typesafe/jev", VERCEL_JEV_MODEL = "typesafe-ai/jev", cloudflareRunEndpoint = (accountId, apiBase = JEV_PROVIDER_DEFAULTS.cloudflare.baseUrl) => `${apiBase.replace(/\/+$/, "")}/accounts/${accountId}/ai/run`, JEV_USD_PER_INPUT_TOKEN, JEV_PROVIDER_DEFAULTS, OPENROUTER_PROVIDER_PREFS, JevError, MAX_ERROR_DETAIL = 300, MODEL_EXECUTION_402_RE;
+var CLOUDFLARE_JEV_MODEL = "typesafe/jev", VERCEL_JEV_MODEL = "typesafe-ai/jev", cloudflareRunEndpoint = (accountId, apiBase = JEV_PROVIDER_DEFAULTS.cloudflare.baseUrl) => `${apiBase.replace(/\/+$/, "")}/accounts/${accountId}/ai/run`, JEV_USD_PER_INPUT_TOKEN, JEV_PROVIDER_DEFAULTS, OPENROUTER_PROVIDER_PREFS, JevError, MAX_ERROR_DETAIL = 300, MODEL_EXECUTION_402_RE, JEV_CLOUD_RETRY_AFTER_CAP_MS = 60000, JEV_CLOUD_RETRY_AFTER_DEFAULT_MS = 5000, cloudCooldown, IMF_FIXDATE_RE;
 var init_jev_client = __esm(() => {
   init_jev_activity();
   init_jev_config();
@@ -15352,18 +15852,23 @@ var init_jev_client = __esm(() => {
     openrouter: { baseUrl: "https://openrouter.ai/api/v1", model: "typesafe/jev-1.13" },
     vercel: { baseUrl: "https://ai-gateway.vercel.sh/typesafe/v1", model: VERCEL_JEV_MODEL },
     cloudflare: { baseUrl: "https://api.cloudflare.com/client/v4", model: CLOUDFLARE_JEV_MODEL },
-    custom: { baseUrl: null, model: "jev-1.13.0" }
+    custom: { baseUrl: null, model: "jev-1.13.0" },
+    failproofai: { baseUrl: null, model: "jev-1.13.0" }
   };
   OPENROUTER_PROVIDER_PREFS = { zdr: true, data_collection: "deny", allow_fallbacks: false };
   JevError = class JevError extends Error {
     code;
-    constructor(code, message) {
-      super(message);
+    retryAfter;
+    constructor(code, message, opts = {}) {
+      super(printable(message));
       this.name = "JevError";
       this.code = code;
+      this.retryAfter = opts.retryAfter ?? null;
     }
   };
   MODEL_EXECUTION_402_RE = /model execution failed/i;
+  cloudCooldown = { endpoint: "", until: Number.NEGATIVE_INFINITY, code: "http-429" };
+  IMF_FIXDATE_RE = /^[A-Z][a-z]{2}, \d{2} [A-Z][a-z]{2} \d{4} \d{2}:\d{2}:\d{2} GMT$/;
 });
 
 // src/hooks/semantic/preconditions.ts
@@ -15401,7 +15906,7 @@ function questionChars(entry) {
   }
   return JSON.stringify(questions).length;
 }
-function toSemanticPolicy(entry) {
+function toSemanticPolicy(entry, pack) {
   const name = entry.precondition;
   if (name !== undefined && !isPackPreconditionName(name)) {
     throw new Error(`precondition ${JSON.stringify(name)} is not a name this build has`);
@@ -15416,19 +15921,34 @@ function toSemanticPolicy(entry) {
     probes: entry.probes,
     ...entry.exempt ? { exempt: entry.exempt } : {},
     ...precondition ? { precondition } : {},
-    guidance: entry.guidance
+    guidance: entry.guidance,
+    origin: { packId: pack.id, ...pack.version ? { packVersion: pack.version } : {} }
   };
 }
 function semanticPoliciesFromPacks(packs) {
   const declared = packs.filter((p) => packSemantic(p).length > 0);
   if (declared.length === 0)
     return { policies: SEMANTIC_POLICIES, fromPack: false, errors: [] };
-  const policies = [];
+  const replace = replacesBuiltinChecks(declared);
+  const ordered = [...declared.filter((p) => isFirstPartyPack(p)), ...declared.filter((p) => !isFirstPartyPack(p))];
+  const policies = replace ? [] : [...SEMANTIC_POLICIES];
   const errors = [];
-  const seen = new Set;
-  let spent = 0;
-  for (const pack of declared) {
+  const seen = new Set(policies.map((p) => p.name));
+  const contested = contestedSemanticNames(declared);
+  let spent = replace ? 0 : BUILTIN_QUESTION_CHARS;
+  for (const pack of ordered) {
     for (const entry of packSemantic(pack)) {
+      if (isReservedClaim(pack, entry.name)) {
+        errors.push(`pack ${pack.id} declares semantic policy ${entry.name}, a name reserved for FailproofAI's own Jev checks, ` + `so that pack's version of it is never asked`);
+        continue;
+      }
+      const claimants = contested.get(entry.name);
+      if (claimants) {
+        const message = `packs ${claimants.join(" and ")} declare different semantic policies named ${entry.name}, so it is asked ` + `for neither of them and no policy can be cleared by that name`;
+        if (!errors.includes(message))
+          errors.push(message);
+        continue;
+      }
       if (seen.has(entry.name)) {
         errors.push(`pack ${pack.id} declares semantic policy ${entry.name}, which another pack already declared`);
         continue;
@@ -15439,7 +15959,7 @@ function semanticPoliciesFromPacks(packs) {
         continue;
       }
       try {
-        policies.push(toSemanticPolicy(entry));
+        policies.push(toSemanticPolicy(entry, pack));
       } catch (err) {
         errors.push(`pack ${pack.id} semantic policy ${entry.name}: ${err instanceof Error ? err.message : String(err)}`);
         continue;
@@ -15448,11 +15968,11 @@ function semanticPoliciesFromPacks(packs) {
       spent += cost;
     }
   }
-  if (policies.length === 0)
+  if (policies.length === (replace ? 0 : SEMANTIC_POLICIES.length))
     return { policies: SEMANTIC_POLICIES, fromPack: false, errors };
   return { policies, fromPack: true, errors };
 }
-function resolveSemanticPolicies() {
+function resolveSemanticPolicies(cli) {
   let packs = [];
   let manifestErrors = [];
   try {
@@ -15462,7 +15982,7 @@ function resolveSemanticPolicies() {
   } catch {
     return SEMANTIC_POLICIES;
   }
-  const resolved = semanticPoliciesFromPacks(packs);
+  const resolved = semanticPoliciesFromPacks(jevPacks(packs, cli));
   for (const message of [...manifestErrors, ...resolved.errors]) {
     if (warned.has(message))
       continue;
@@ -15471,8 +15991,9 @@ function resolveSemanticPolicies() {
   }
   return resolved.policies;
 }
-var GLOBAL_QUESTION_CHARS, MAX_PACK_QUESTION_CHARS, warned;
+var GLOBAL_QUESTION_CHARS, MAX_PACK_QUESTION_CHARS, BUILTIN_QUESTION_CHARS, warned;
 var init_pack_policies = __esm(() => {
+  init_effective_reviewers();
   init_hook_logger();
   init_pack_manifest();
   init_compile();
@@ -15482,6 +16003,7 @@ var init_pack_policies = __esm(() => {
   init_precondition_names();
   GLOBAL_QUESTION_CHARS = Math.max(JSON.stringify({ [INJECTION_PROBE.id]: noulOf(INJECTION_PROBE), [SCOPE_PROBE.id]: noulOf(SCOPE_PROBE) }).length, JSON.stringify(Object.fromEntries([INJECTION_PROBE, ...TASK_PROBES].map((p) => [p.id, noulOf(p)]))).length);
   MAX_PACK_QUESTION_CHARS = MAX_REQUEST_CHARS - MAX_STATE_CHARS - GLOBAL_QUESTION_CHARS;
+  BUILTIN_QUESTION_CHARS = SEMANTIC_POLICIES.reduce((n, p) => n + questionChars(p), 0);
   warned = new Set;
 });
 
@@ -15506,8 +16028,8 @@ function envNumber(name, fallback) {
 function prepareSemantic(input, opts = {}) {
   const command = input.toolInput.command;
   const scanned = typeof command === "string" ? scanCommand(command) : null;
-  const facts = computeFacts(input.toolName, input.toolInput, input.cwd ?? null, input.permissionMode ?? null, scanned);
-  const selected = selectPolicies(opts.policies ?? resolveSemanticPolicies(), facts);
+  const facts = computeFacts(input.toolName, input.toolInput, input.cwd ?? null, input.permissionMode ?? null, scanned, input.projectRoot ?? null);
+  const selected = selectPolicies(opts.policies ?? resolveSemanticPolicies(opts.cli), facts);
   const intent = opts.intent ?? "v0";
   const cleaned = intent === "v1" && opts.cleanHarnessText !== false ? cleanUserSaid(input.userSaid) : input.userSaid;
   const agentLastMessage = intent === "v1" && opts.includeAgentLastMessage !== false && typeof input.agentLastMessage === "string" ? input.agentLastMessage : null;
@@ -15891,6 +16413,81 @@ var init_jev_throttle = __esm(() => {
   PROVIDER_WINDOW_FULL = new Set(["http-429", "rate-limited"]);
 });
 
+// src/hooks/semantic/session-root.ts
+import { mkdirSync as mkdirSync10, readdirSync as readdirSync14, readFileSync as readFileSync17, statSync as statSync19, unlinkSync as unlinkSync3, writeFileSync as writeFileSync7 } from "node:fs";
+import { isAbsolute as isAbsolute4, resolve as resolve17 } from "node:path";
+function validRoot(v) {
+  return typeof v === "string" && isAbsolute4(v) && resolve17(v) === v && v !== "/";
+}
+function storeIsOurs() {
+  if (process.platform === "win32")
+    return true;
+  if (looseIntentStoreDir() !== null)
+    return false;
+  try {
+    const mode = statSync19(rootsDir()).mode & 511;
+    return (mode & DIR_WRITABLE_BY_OTHERS4) === 0;
+  } catch {
+    return true;
+  }
+}
+function readPinned(sessionId) {
+  try {
+    const parsed = JSON.parse(readFileSync17(rootFile(sessionId), "utf8"));
+    return validRoot(parsed?.root) ? parsed.root : null;
+  } catch {
+    return null;
+  }
+}
+function pruneSessionRoots(now = Date.now()) {
+  let removed = 0;
+  try {
+    const dir = rootsDir();
+    for (const name of readdirSync14(dir)) {
+      if (!ROOT_FILE_RE.test(name))
+        continue;
+      const path = resolve17(dir, name);
+      try {
+        const st = statSync19(path);
+        if (st.isFile() && now - st.mtimeMs > SESSION_ROOT_MAX_AGE_MS) {
+          unlinkSync3(path);
+          removed++;
+        }
+      } catch {}
+    }
+  } catch {}
+  return removed;
+}
+function sessionProjectRoot(sessionId, cwd, now = Date.now()) {
+  if (!cwd)
+    return null;
+  const live = findProjectRoot(cwd);
+  if (!sessionId || !SESSION_ID_RE3.test(sessionId))
+    return live;
+  try {
+    if (!storeIsOurs())
+      return live;
+    const pinned = readPinned(sessionId);
+    if (pinned !== null)
+      return pinned;
+    if (!validRoot(live))
+      return live;
+    mkdirSync10(rootsDir(), { recursive: true, mode: 448 });
+    writeFileSync7(rootFile(sessionId), JSON.stringify({ root: live, at: now }), { mode: 384, flag: "wx" });
+    pruneSessionRoots(now);
+  } catch {}
+  return live;
+}
+var SESSION_ID_RE3, ROOT_FILE_RE, SESSION_ROOT_MAX_AGE_MS, DIR_WRITABLE_BY_OTHERS4 = 18, rootsDir = () => resolve17(semanticDir(), "roots"), rootFile = (sessionId) => resolve17(rootsDir(), `${sessionId}.json`);
+var init_session_root = __esm(() => {
+  init_fp_home();
+  init_facts();
+  init_intent();
+  SESSION_ID_RE3 = /^[A-Za-z0-9._-]{1,128}$/;
+  ROOT_FILE_RE = /^[A-Za-z0-9._-]{1,128}\.json$/;
+  SESSION_ROOT_MAX_AGE_MS = 7 * 24 * 60 * 60 * 1000;
+});
+
 // src/hooks/semantic/jev-review.ts
 function servedFromCache2(response) {
   try {
@@ -15919,13 +16516,15 @@ function resolveTimeout(cfg) {
     return DEFAULT_JEV_TIMEOUT_MS;
   return Math.min(MAX_JEV_TIMEOUT_MS2, Math.max(MIN_JEV_TIMEOUT_MS2, t));
 }
+function jevDecider(outcome) {
+  const wanted = outcome.verdict.decision === "deny" ? "deny" : "instruct";
+  return outcome.verdict.outcomes.find((o) => o.verdict === wanted);
+}
 function jevPolicyName(outcome) {
-  const { verdict } = outcome;
-  const wanted = verdict.decision === "deny" ? "deny" : "instruct";
-  const first = verdict.outcomes.find((o) => o.verdict === wanted);
+  const first = jevDecider(outcome);
   if (first)
     return `semantic/${first.policy}`;
-  return verdict.beyondTask ? "semantic/beyond-task" : "semantic/jev";
+  return outcome.verdict.beyondTask ? "semantic/beyond-task" : "semantic/jev";
 }
 function fallbackCode(reason) {
   const code = reason.split(":")[0].trim();
@@ -15940,15 +16539,18 @@ function toReview(outcome, cached = false) {
   const model = sent ? outcome.model : null;
   const outcomes = outcome.verdict.outcomes;
   const injection = sent ? outcome.verdict.injectionSuspected : null;
+  const warned = (o) => o.verdict === "instruct" && o.intent !== "downgraded-task-step";
   return {
     kind: "answered",
     decision: outcome.verdict.decision,
     reason: outcome.verdict.reason,
     policyName: jevPolicyName(outcome),
+    ...jevDecider(outcome)?.origin ? { origin: jevDecider(outcome)?.origin } : {},
     asked: sent ? outcomes.map((o) => o.policy) : [],
-    notDenied: sent ? outcomes.filter((o) => o.verdict !== "deny").map((o) => o.policy) : [],
+    notDenied: sent ? outcomes.filter((o) => o.verdict !== "deny" && !warned(o)).map((o) => o.policy) : [],
     injectionAsked: injection !== null,
     injected: injection !== null && injection >= DEFAULT_THRESHOLDS_V1.injection,
+    unclearableWarned: outcomes.some((o) => o.mode === "deny" && warned(o)),
     truncated: outcome.truncated && sent,
     requestCut: outcome.requestCut && sent,
     latencyMs,
@@ -15988,11 +16590,13 @@ function startJevReview(cfg, call) {
   } catch {
     intent = { userSaid: [], agentLastMessage: null };
   }
+  const projectRoot = sessionProjectRoot(call.sessionId, call.cwd);
   const input = {
     eventType: call.eventType,
     toolName: call.toolName,
     toolInput: toolInputRecord(call.toolInput),
     ...call.cwd ? { cwd: call.cwd } : {},
+    ...projectRoot ? { projectRoot } : {},
     ...call.permissionMode ? { permissionMode: call.permissionMode } : {},
     userSaid: intent.userSaid,
     agentLastMessage: intent.agentLastMessage
@@ -16007,6 +16611,7 @@ function startJevReview(cfg, call) {
   let abandoned = false;
   const answered = evaluateSemantic(input, {
     transport,
+    cli: call.cli,
     via: route.via,
     model: route.model,
     timeoutMs,
@@ -16050,6 +16655,7 @@ var init_jev_review = __esm(() => {
   init_jev_client();
   init_jev_config();
   init_jev_throttle();
+  init_session_root();
   throttle = exports_jev_throttle;
   intentReader = exports_intent;
   ALWAYS_ON = new Set(BUILTIN_POLICIES.filter((p) => p.alwaysOn).map((p) => normalizePolicyName(p.name)));
@@ -16256,7 +16862,7 @@ async function readJevConfig() {
       return null;
     await Promise.resolve().then(() => init_jev_config());
     const config = loadJevConfig();
-    return config ? { config, defaultMode: DEFAULT_JEV_MODE } : null;
+    return config && config.mode !== "off" ? { config, defaultMode: DEFAULT_JEV_MODE } : null;
   } catch (err) {
     hookLogInfo(`Jev config could not be read (${err instanceof Error ? err.message : String(err)}); the regex engine decides alone`);
     return null;
@@ -16391,7 +16997,7 @@ async function evaluateHookEvent(eventType, cli = "claude", stdinPayload, opts)
       registerPolicy("failproofai/daemon-unreachable", "Fail-closed: the failproofaid daemon could not be reached for this daemon-configured scope.", async () => ({ decision: decision.decision, reason: decision.reason }), {});
     } else {
       config = readMergedHooksConfig(session.cwd);
-      clearPolicies();
+      clearPolicies(cli);
       activePause = readActivePause(session.sessionId);
       const packsInstalledHere = hasInstalledPacks();
       const legacyNames = activePause || packsInstalledHere ? [] : config.enabledPolicies;
@@ -16507,9 +17113,9 @@ async function evaluateHookEvent(eventType, cli = "claude", stdinPayload, opts)
           ...pack ? { packId: pack.id, packVersion: pack.version } : {}
         });
         const authority = authorityDeclarationFor(hook, { cloudManaged, pack });
-        const refused = resolvePolicyAuthority(authority).downgraded;
+        const refused = resolvePolicyAuthority(authority, effectiveReviewerNames(), contestedReviewerNames()).downgraded;
         if (refused)
-          warnAuthority(`${registeredName} asks to be reviewable, but ${refused} — it stays hard`);
+          warnAuthority(refusedAuthorityWarning(registeredName, refused));
         registerPolicy(registeredName, hook.description ?? "", fn, hook.match ?? {}, -1, pack?.policies.find((p) => p.name === hook.name)?.params, authority);
       }
       if (!activePause) {
@@ -16564,10 +17170,20 @@ async function evaluateHookEvent(eventType, cli = "claude", stdinPayload, opts)
       ...twoTier,
       releaseRegistry: opts?.releaseRegistry
     }) : await evaluatePolicies(canonicalEventType, parsed, session, config);
+    const shadowVerdict = result.twoTier?.shadowVerdict;
+    if (shadowVerdict) {
+      observedResults.push({
+        policyId: shadowVerdict.policyName,
+        version: shadowVerdict.version,
+        decision: shadowVerdict.decision,
+        reason: shadowVerdict.reason
+      });
+    }
     const durationMs = Math.round(performance.now() - startTime);
     hookLogInfo(`result=${result.decision} policy=${result.policyName ?? "none"} duration=${durationMs}ms`);
     await captureJevIntent(canonicalEventType, result.decision, parsed, session, cli, opts);
     const matchedPolicies = matchedBeforeRelease ?? getPoliciesForEvent(canonicalEventType, parsed.tool_name).map((p) => p.name);
+    const jevOrigin = result.policyName && result.twoTier?.decidedByJev ? result.twoTier.jevOrigin : undefined;
     const activityEntry = {
       timestamp: Date.now(),
       eventType: canonicalEventType,
@@ -16585,6 +17201,7 @@ async function evaluateHookEvent(eventType, cli = "claude", stdinPayload, opts)
       cwd: session.cwd,
       permissionMode: session.permissionMode,
       hookEventName: session.hookEventName,
+      ...result.policyName && result.twoTier?.decidedByJev ? { policySource: "jev", ...jevOrigin } : {},
       ...result.policyName && !result.twoTier?.decidedByJev ? (() => {
         const attribution = policyAttribution.get(result.policyName);
         return {
@@ -16659,6 +17276,7 @@ var init_handler = __esm(() => {
   init_policy_evaluator();
   init_policy_registry();
   init_custom_hooks_loader();
+  init_effective_reviewers();
   init_policy_authority();
   init_hook_activity_store();
   init_delivery_health();
@@ -16679,7 +17297,7 @@ var init_handler = __esm(() => {
 
 // src/hooks/worker-server.ts
 import { createConnection, createServer } from "node:net";
-import { existsSync as existsSync20, unlinkSync as unlinkSync3 } from "node:fs";
+import { existsSync as existsSync20, unlinkSync as unlinkSync4 } from "node:fs";
 function isWorkerHookRequest(msg) {
   if (!msg || typeof msg !== "object")
     return false;
@@ -16847,7 +17465,7 @@ function startWorkerServer(socketPath, shutdown) {
   const listen = () => {
     if (existsSync20(socketPath)) {
       try {
-        unlinkSync3(socketPath);
+        unlinkSync4(socketPath);
       } catch {}
     }
     server.listen(socketPath);
@@ -16868,13 +17486,13 @@ var init_worker_server = __esm(() => {
 
 // bin/failproofai-worker.mjs
 import { realpathSync as realpathSync2 } from "node:fs";
-import { dirname as dirname8, resolve as resolve17 } from "node:path";
+import { dirname as dirname9, resolve as resolve18 } from "node:path";
 import { fileURLToPath } from "node:url";
 if (!process.env.FAILPROOFAI_PACKAGE_ROOT) {
-  process.env.FAILPROOFAI_PACKAGE_ROOT = resolve17(dirname8(realpathSync2(fileURLToPath(import.meta.url))), "..");
+  process.env.FAILPROOFAI_PACKAGE_ROOT = resolve18(dirname9(realpathSync2(fileURLToPath(import.meta.url))), "..");
 }
 if (!process.env.FAILPROOFAI_DIST_PATH) {
-  process.env.FAILPROOFAI_DIST_PATH = resolve17(dirname8(realpathSync2(fileURLToPath(import.meta.url))), "..", "dist");
+  process.env.FAILPROOFAI_DIST_PATH = resolve18(dirname9(realpathSync2(fileURLToPath(import.meta.url))), "..", "dist");
 }
 var socketPath = process.env.FAILPROOFAI_WORKER_SOCKET;
 if (!socketPath) {