failproofai 1.0.7-beta.2 → 1.0.8-beta.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "failproofai",
-  "version": "1.0.7-beta.2",
+  "version": "1.0.8-beta.0",
   "description": "Observability and enforcement for AI agent harnesses. 40 built-in policies hooked into 12 of them — Claude Code, Codex, Cursor, Hermes, OpenClaw and more — blocking the tool call before it runs. Local dashboard included, no account needed.",
   "bin": {
     "failproofai": "./dist/cli.mjs",
@@ -122,15 +122,15 @@
     "browserslist": "4.28.8"
   },
   "optionalDependencies": {
-    "@failproofai/failproofaid-linux-x64": "1.0.7-beta.2",
-    "@failproofai/failproofaid-linux-arm64": "1.0.7-beta.2",
-    "@failproofai/failproofaid-darwin-x64": "1.0.7-beta.2",
-    "@failproofai/failproofaid-darwin-arm64": "1.0.7-beta.2"
+    "@failproofai/failproofaid-linux-x64": "1.0.8-beta.0",
+    "@failproofai/failproofaid-linux-arm64": "1.0.8-beta.0",
+    "@failproofai/failproofaid-darwin-x64": "1.0.8-beta.0",
+    "@failproofai/failproofaid-darwin-arm64": "1.0.8-beta.0"
   },
   "failproofaidBinaries": {
-    "linux-x64": "5362ab6a4cfb23d1eee598aac67aedd9e43351e62724ee1c6b40c4fc8021c08f",
-    "linux-arm64": "f14a2548b41e14ad32b7fdd03a27ffe7160da1046e422e1f651099371b0d27e5",
-    "darwin-x64": "14189cade04f17cf5278bd8061a5ec0c2a2381aa21944ae0d05e8c35b98c2816",
-    "darwin-arm64": "4ba9f5c321894d953407efa3404f0deec07dccfd7db7bc2511bb35226816b583"
+    "linux-x64": "35b641f60e1724513fbb760db382123dad2b5fcdd67dda6373bda80651bd36bb",
+    "linux-arm64": "a058288f5d08f99612f053793e5c7f59264d3da97f3dbe769e401b0f8536702d",
+    "darwin-x64": "b4f3dbe4aea44e77cc10839647c0dc03a1b8b797dfb27e1d89a6a96554ef27b8",
+    "darwin-arm64": "fd42f28bf92001d39117b488a215578b966f07d316214744aca64a1888f2aed2"
   }
 }

package/src/hooks/builtin-policies.ts

@@ -186,6 +186,15 @@ const PUBLISH_CMD_RE = /(?:npm\s+publish|bun\s+publish|pnpm\s+publish|yarn\s+npm
 const ENV_PRINTENV_RE = /(?:^|\s|;|&&|\|\|)(?:env|printenv)(?:\s|$|;|&&|\|)/;
 const ECHO_ENV_RE = /echo\s+.*\$\{?[A-Za-z_]/;
 const EXPORT_RE = /(?:^|\s|;|&&|\|\|)export\s+\w+/;
+// The other whole-environment dumps: bare `set` / `export` / `export -p` in
+// command position (`set -e`, `export FOO=bar` are not), `declare|typeset` with
+// -x or -p (not `declare -a`), `compgen -v|-e`, and /proc/<pid>/environ.
+const ENV_DUMP_RE =
+  /(?:^|[;&|({\n`'"]|\$\()\s*(?:set|export(?:\s+-p)?)\s*(?:$|[|;&>)\n])|\b(?:declare|typeset)\s+-[A-Za-z]*[xp]|\bcompgen\s+-[A-Za-z]*[ev]|\/proc\/(?:self|thread-self|\d+|\$\$|\$BASHPID)\/environ/;
+// A script dumping the environment OBJECT, not one variable of it. Two tests,
+// both linear: an interpreter in the command, and the object used whole.
+const SCRIPT_INTERP_RE = /\b(?:python[\d.]*|node|bun|deno)\b/;
+const ENV_OBJECT_RE = /\bos\.environ(?!\s*\[|\.(?:get|setdefault|pop|update)\b)|\bprocess\.env(?![.\[\w])/;
 const PS_ENV_VAR_RE = /\$env:[A-Za-z_]/i;
 const PS_CHILDITEM_ENV_RE = /(?:Get-ChildItem|dir|gci|ls)\s+Env:/i;
 const DOTNET_GETENV_RE = /\[Environment\]::GetEnvironment/i;
@@ -1765,6 +1774,9 @@ function protectEnvVars(ctx: PolicyContext): PolicyResult {
   if (EXPORT_RE.test(cmd)) {
     return deny("Command exports environment variable");
   }
+  if (ENV_DUMP_RE.test(cmd) || (SCRIPT_INTERP_RE.test(cmd) && ENV_OBJECT_RE.test(cmd))) {
+    return deny("Command dumps environment variables");
+  }
   // PowerShell: $env:VAR
   if (PS_ENV_VAR_RE.test(cmd)) {
     return deny("Command reads environment variable via PowerShell");
@@ -2277,11 +2289,11 @@ const READ_LIKE_CMDS =
  * a real, working spelling of /etc/passwd — is still extracted and still
  * resolves to /etc/passwd.
  *
- * Runs of slashes with nothing else ('//', '///') are dropped: those are a
- * line-comment marker, not a directory. They used to resolve to the filesystem
- * root, which denied any read-like command carrying a '// …' comment — a
- * heredoc writing a TypeScript file into the project, say. A lone '/' is the
- * root and is kept.
+ * A run of slashes with nothing else ('//', '///') that opens a line after
+ * the first is dropped: that is a line-comment marker in a heredoc body, not a
+ * directory. It used to resolve to the filesystem root, which denied a heredoc
+ * writing a TypeScript file into the project. Anywhere else a slash-run is
+ * the root, as a lone '/' is: `cd // && cat etc/shadow` reads /etc/shadow.
  */
 function extractAbsolutePaths(command: string): string[] {
   const paths: string[] = [];
@@ -2292,7 +2304,13 @@ function extractAbsolutePaths(command: string): string[] {
     let m: RegExpExecArray | null;
     while ((m = pathRe.exec(s)) !== null) {
       let p = m[0];
-      if (/^\/{2,}$/.test(p)) continue; // a `//` comment marker, not the root
+      // A `//` that opens a line after the first (a heredoc body) is a comment
+      // marker. Anywhere else a slash-run is the root: `cd // && cat etc/shadow`,
+      // and `cd \<newline>//`, which bash joins into one line.
+      if (/^\/{2,}$/.test(p)) {
+        const nl = s.lastIndexOf("\n", m.index - 1);
+        if (nl !== -1 && s[nl - 1] !== "\\" && /^[ \t]*$/.test(s.slice(nl + 1, m.index))) continue;
+      }
       if (p === "~") p = homedir();
       else if (p.startsWith("~/")) p = join(homedir(), p.slice(2));
       paths.push(p);

package/src/hooks/cloud-connection.ts

@@ -35,14 +35,23 @@ import {
   writeCloudCredentials,
   type CloudCredentials,
 } from "./cloud-enrollment";
-import { updateConfig, readCredentials, writeCredentials } from "./fp-config";
+import { credentialsFile } from "./fp-home";
+import {
+  clearJevCloudCredential,
+  updateConfig,
+  readCredentials,
+  writeCredentials,
+  writeJevCloudCredential,
+} from "./fp-config";
 import {
   introspectKey,
   hasPermission,
   describeOrg,
   PERMISSION_EVENTS,
+  PERMISSION_JEV,
   PERMISSION_POLICIES,
 } from "./cloud-introspect";
+import type { CloudJevConfigWrite } from "./jev-cloud-connection";
 import {
   ingestPath,
   validateIngestKey,
@@ -139,12 +148,50 @@ export interface CapabilityOutcome {
 export interface ConnectOutcome {
   policy: CapabilityOutcome & { policyCount?: number; deployment?: number };
   ingest: CapabilityOutcome;
+  /**
+   * Jev through FailproofAI Cloud. Absent when nothing connected, and when the
+   * server has no introspect endpoint to say whether the key carries it.
+   */
+  jev?: JevConnectOutcome;
   /** Which organisation the key belongs to. Absent on a pre-introspect server. */
   org?: { id?: string; slug?: string; name?: string };
   /** True when at least one capability was configured. */
   anyConfigured: boolean;
 }
 
+export interface JevConnectOutcome {
+  /** The key carries `jev:evaluate`, and it was stored for Jev. */
+  ok: boolean;
+  reason?: string;
+  /** What became of `jev.json`. Present when `ok`, unless `optIn`. */
+  config?: CloudJevConfigWrite;
+  /**
+   * `ok`, but Jev was deliberately NOT switched on: the connection opted out
+   * of transcripts (`sessions !== true`), and there is no `jev.json`. The key
+   * is stored; `jev setup --provider failproofai` switches Jev on.
+   */
+  optIn?: true;
+  /**
+   * A `--no-transcripts` connection found a `jev.json` already in place that
+   * keeps Jev running through FailproofAI Cloud, in this mode. It is left
+   * alone like any existing file (never overwritten), but a connection that
+   * asked for decisions only is told that Jev still sends more than that.
+   */
+  stillOn?: "shadow" | "enforce";
+  /**
+   * Introspect gave no answer about this key's permissions — the server could
+   * not be asked (`unreachable`) or predates the endpoint (`unsupported`) — so
+   * whether it carries `jev:evaluate` is unknown, and the Jev slot was:
+   *
+   *   - `kept`: it already held THIS key for THIS origin, and was left as it
+   *     was — the machine's connection is the same one it belongs to;
+   *   - `cleared`: it held another key or origin — the previous connection's,
+   *     possibly another org's budget — and was removed;
+   *   - `none`: there was no slot, and there still is none.
+   */
+  unconfirmed?: "kept" | "cleared" | "none";
+}
+
 /**
  * Verify both capabilities, then write only what actually works.
  *
@@ -282,9 +329,146 @@ writeCloudCredentials(creds);
     });
   }
 
+  // ── Jev, last ─────────────────────────────────────────────────────────────
+  //
+  // Only from introspect's answer. `jev:evaluate` spends the org's budget on
+  // every gated tool call, so it is never inferred from a probe succeeding the
+  // way the other two capabilities are on a server without introspect — and a
+  // machine that connected to nothing gets nothing.
+  //
+  // There is no Jev-only path: the server refuses a key that carries
+  // `jev:evaluate` without `events:add` and `policies:pull`, so a key that gets
+  // here with Jev has already configured the other two.
+  if (outcome.anyConfigured) {
+    if (known && hasPermission(known, PERMISSION_JEV)) {
+      // The ORIGIN the key was verified against. `jev-config.ts` sends the key
+      // only to a base URL on this origin, so a jev.json pointing anywhere else
+      // cannot borrow it.
+      writeJevCloudCredential({ url: new URL(input.url).origin, key: input.token });
+      // Loaded here and nowhere earlier: a connect whose key does not carry Jev
+      // pulls in none of the Jev modules.
+      const { cloudJevRunningMode, existingJevConfig, writeCloudJevConfigIfAbsent } = await import("./jev-cloud-connection");
+      if (input.sessions === true) {
+        outcome.jev = { ok: true, config: writeCloudJevConfigIfAbsent(input.url) };
+      } else {
+        // `--no-transcripts` never switches Jev on (the user's decision). Jev
+        // sends each checked tool call and the recent prompt to FailproofAI
+        // Cloud, and someone who just asked for decisions only has not asked
+        // for that. The key is stored all the same, so opting in later is one
+        // command with no key to paste; jev.json is not written. One that is
+        // already there is somebody's decision and is reported as ever — and
+        // when it keeps Jev on through FailproofAI Cloud, that is said too, or
+        // "Decisions only." would be the last word while Jev keeps sending.
+        const existing = existingJevConfig(input.url);
+        const stillOn = existing ? cloudJevRunningMode() : null;
+        outcome.jev = existing
+          ? { ok: true, config: existing, ...(stillOn ? { stillOn } : {}) }
+          : { ok: true, optIn: true };
+      }
+    } else if (known) {
+      // Introspect ANSWERED, and the key does not carry Jev. This connection
+      // replaces the last one, and the last key's Jev slot describes a
+      // connection this machine no longer has — possibly another org's budget.
+      // Dropped, so Jev never spends on a key it was not just handed. (A Cloud
+      // jev.json then reads `key-lacks-jev`: off, and said.)
+      clearJevCloudCredential();
+      outcome.jev = { ok: false, reason: missing(PERMISSION_JEV) };
+    } else {
+      // No answer about this key: a 502 or a network blip on introspect
+      // (`unreachable`), or a server with no introspect at all (`unsupported`).
+      // Neither says the key LACKS Jev, so neither is a reason to switch Jev
+      // off — a reconnect during a transient outage used to do exactly that,
+      // silently.
+      //
+      // But neither says it HAS Jev, and the slot is only ever spent against.
+      // So it is kept only when it already holds this very key for this very
+      // origin: then the connection just verified IS the one it belongs to,
+      // and keeping it changes nothing about whose budget Jev spends. A slot
+      // holding any other key or origin is the previous connection's, and the
+      // machine is not connected with that key any more — the rule above,
+      // which wins whenever the answer is not "yes".
+      //
+      // `unsupported` is decided the same way, and conservatively: a server
+      // that predates introspect predates the Jev route too, so a kept slot
+      // there can only fall back with `http-404` — never spend — and clearing
+      // it would turn Jev off on no evidence. It gets no line when there was
+      // no slot, because on such a server there is nothing to say about Jev.
+      const previous = readCredentials().jev;
+      if (!previous) {
+        if (identity.kind === "unreachable") outcome.jev = { ok: false, unconfirmed: "none" };
+      } else if (previous.key === input.token && previous.url === new URL(input.url).origin) {
+        outcome.jev = { ok: false, unconfirmed: "kept" };
+      } else {
+        clearJevCloudCredential();
+        outcome.jev = { ok: false, unconfirmed: "cleared" };
+      }
+    }
+  }
+
   return outcome;
 }
 
+/**
+ * The Jev line(s) for `describeOutcome`: whether FailproofAI Cloud runs Jev for
+ * this machine now, and — the one case worth a second line — why an existing
+ * `jev.json` was not touched.
+ */
+function jevLines(outcome: ConnectOutcome): string[] {
+  const jev = outcome.jev;
+  if (!jev) return [];
+  if (jev.unconfirmed === "cleared") {
+    return [
+      "  Jev       could not confirm this key's Jev permission, and the Jev key stored before was a different one, so it was removed: Jev through FailproofAI Cloud is off. Run `failproofai config --token <key>` again to retry.",
+    ];
+  }
+  if (jev.unconfirmed) return ["  Jev       could not confirm the key's Jev permission; left as it was."];
+  if (!jev.ok) {
+    return [`  Jev       not through FailproofAI Cloud: ${jev.reason ?? `that key does not carry \`${PERMISSION_JEV}\``}.`];
+  }
+  if (jev.optIn) {
+    // One line, and nothing that reads as "on": this connection asked for
+    // decisions only, and Jev would send more than that.
+    return [
+      "  Jev       available on this key, not switched on (--no-transcripts): it sends each checked tool call and the recent prompt to FailproofAI Cloud for evaluation. To switch it on: `failproofai jev setup --provider failproofai`.",
+    ];
+  }
+  const config = jev.config;
+  if (!config || config.status === "written") {
+    // Plain http (loopback only) is accepted in shadow mode and nowhere else, so
+    // the enforce command would be refused there, by the CLI and the dashboard.
+    const plainHttp = config?.status === "written" && new URL(config.baseUrl).protocol === "http:";
+    return [
+      `  Jev       on through FailproofAI Cloud, in shadow mode: logged, not enforced (${config?.path ?? "jev.json"}).`,
+      plainHttp
+        ? "            Enforce needs an https FailproofAI Cloud URL: reconnect with `failproofai config --token <key> --url https://…`. Over plain http Jev stays in shadow mode."
+        : "            Enforce it with `failproofai jev setup --mode enforce`, or from the dashboard.",
+    ];
+  }
+  if (config.status === "kept") {
+    const lines = [`  Jev       key stored; ${config.path} already exists and was left as configured.`];
+    if (config.otherOrigin) {
+      lines.push(
+        config.jevOff?.why === "off"
+          ? `            It points at ${config.otherOrigin} and has Jev switched off (mode off), so Jev is off. To point it here and turn it on: \`failproofai jev setup --provider failproofai --mode shadow\`.`
+          : `            It points at ${config.otherOrigin}, so Jev stays off until you run \`failproofai jev setup --provider failproofai\`.`,
+      );
+    } else if (config.jevOff?.why === "refused") {
+      lines.push(
+        `            It was refused (${config.jevOff.problem}), so Jev is off. ${config.jevOff.fix ? `Fix: \`${config.jevOff.fix}\`.` : "Write a valid one: `failproofai jev setup --provider failproofai`."}`,
+      );
+    } else if (config.jevOff?.why === "off") {
+      lines.push("            It has Jev switched off (mode off), so Jev is off. To turn it on: `failproofai jev setup --mode shadow`.");
+    }
+    if (jev.stillOn) {
+      lines.push(
+        `            Jev is still on through FailproofAI Cloud (${jev.stillOn} mode): it sends each checked tool call and the recent prompt to FailproofAI Cloud. To switch it off: \`failproofai jev setup --mode off\`.`,
+      );
+    }
+    return lines;
+  }
+  return [`  Jev       key stored, but Jev was not turned on: ${config.problem}.`];
+}
+
 /**
  * How to describe the outcome to someone at a terminal.
  *
@@ -311,6 +495,7 @@ export function describeOutcome(outcome: ConnectOutcome, machineId: string, url:
     const n = outcome.policy.policyCount ?? 0;
     lines.push(`  Policy    ${n} polic${n === 1 ? "y" : "ies"} assigned (deployment ${outcome.policy.deployment ?? 0}).`);
     lines.push(`  Dashboard hook activity will be sent to ${ingestUrlFor(url)}.`);
+    lines.push(...jevLines(outcome));
     return lines;
   }
 
@@ -322,6 +507,7 @@ export function describeOutcome(outcome: ConnectOutcome, machineId: string, url:
     lines.push("");
     lines.push("  Enforcement works. Nothing will appear in the dashboard until this");
     lines.push("  key also carries `events:add`, or you re-run --connect with one that does.");
+    lines.push(...jevLines(outcome));
     return lines;
   }
 
@@ -332,6 +518,7 @@ export function describeOutcome(outcome: ConnectOutcome, machineId: string, url:
     lines.push("");
     lines.push("  This machine keeps enforcing its LOCAL policies and will report what");
     lines.push("  they decide, but will not receive centrally-managed ones.");
+    lines.push(...jevLines(outcome));
     return lines;
   }
 
@@ -346,6 +533,8 @@ export function configuredPaths(outcome: ConnectOutcome): string[] {
   const paths: string[] = [];
   if (outcome.policy.ok) paths.push(cloudCredentialPath());
   if (outcome.ingest.ok) paths.push(ingestPath());
+  // The Jev slot is always in credentials.json, never behind the JSON override.
+  if (outcome.jev?.ok) paths.push(credentialsFile());
   // Deduplicated because layout 2 consolidated both credentials into
   // `credentials.toml`, so the two capabilities now name the SAME file and the
   // closing note read "stored in <path> and <path>" — the same path, twice.

package/src/hooks/cloud-enrollment-cli.ts

@@ -20,9 +20,13 @@ import {
   daemonVersionSkew,
 } from "./daemon-service";
 import { clearActiveCloudManagedPolicies } from "./cloud-managed-policies";
-import { optsFor, rows as kitRows, stack, warning } from "./tui";
+import { TOKEN_ON_ARGV, optsFor, rows as kitRows, stack, warning } from "./tui";
 import { deliveryHealth, deliveryHealthLine } from "./delivery-health";
-import { readVersionFile, readCredentials } from "./fp-config";
+import { clearJevCloudCredential, readVersionFile, readCredentials } from "./fp-config";
+// A CLI command's import, never the hook path's: `jev-cloud-connection` reaches
+// `semantic/jev-config`, which a machine without jev.json must not load while
+// evaluating a tool call. `config --disconnect` is not that.
+import { removeCloudJevConfig } from "./jev-cloud-connection";
 import { version as cliVersion } from "../../package.json";
 import { daemonSocketPresent } from "./daemon-client";
 import {
@@ -174,16 +178,26 @@ function daemonWarning(status: ReturnType<typeof daemonServiceStatus>): string[]
   ];
 }
 
+/**
+ * What `config --token` (and `config --connect … --token`) ends with, connected
+ * or not: every Jev remedy sends people to that spelling, and the key is in
+ * history either way. `jev setup --token` says the same first line.
+ */
+export const CONFIG_TOKEN_HISTORY_WARNING = [
+  TOKEN_ON_ARGV,
+  "Next time, run `failproofai config` with the key in FAILPROOFAI_CLOUD_TOKEN (from a secret store, or `read -rs`) instead of --token — and rotate this one if it matters.",
+];
+
 export async function runConnectCommand(opts: ConnectOptions): Promise<CommandResult> {
   if (!opts.url) return { exitCode: 1, lines: ["--connect needs a URL, e.g. --connect https://be.failproof.ai"] };
   if (!opts.token) {
     return {
       exitCode: 1,
       lines: [
-        "--connect needs a machine token: --token <key>",
+        "--connect needs this machine's key: set FAILPROOFAI_CLOUD_TOKEN (preferred), or pass --token <key>.",
         "",
-        "Create an API key carrying only the `policies:pull` permission for this",
-        "machine. Do not use an admin key.",
+        "Create it with the \"machine\" preset on the dashboard's Keys page",
+        "(events:add, policies:pull, jev:evaluate). Do not use an admin key.",
       ],
     };
   }
@@ -324,6 +338,13 @@ export function runDisconnectCommand(): CommandResult {
   // leave the machine still shipping activity to a cloud the user believes
   // they have left — the one outcome nobody expects from this command.
   const removedIngest = clearIngestCredential();
+  // And spending: the Jev key goes with the rest, so no tool call after this
+  // one is charged to an org this machine has left. The Cloud's own jev.json
+  // goes too — it names a route that now has no key — unless it is switched
+  // off, the owner's opt-out that must outlive a reconnect; a BYOK one stays,
+  // because it never depended on the Cloud and is not the Cloud's to delete.
+  const removedJevKey = clearJevCloudCredential();
+  const jevConfig = removeCloudJevConfig();
   // Stop ENFORCING them too, not merely refreshing them. Clearing the
   // credential ends the daemon's polling; every artifact already on disk stayed
   // referenced by `active.json` and kept being loaded on every tool call — so a
@@ -337,8 +358,35 @@ export function runDisconnectCommand(): CommandResult {
   // machine is provably silent instead of silent-by-happenstance.
   updateConfig({ mode: "oss" });
 
-  if (!removed && !existing && !hadIngest && !stoppedManaged) {
-    return { exitCode: 0, lines: ["This machine is not connected to FailproofAI Cloud."] };
+  const jevLines =
+    jevConfig.status === "removed"
+      ? [`  Jev through FailproofAI Cloud is off: removed ${jevConfig.path}. Hooks run the regex policies.`]
+      : jevConfig.status === "error"
+        ? [
+            removedJevKey
+              ? `  ! The FailproofAI Cloud key for Jev is gone, so Jev is off — but ${jevConfig.problem}.`
+              : `  ! ${jevConfig.problem}.`,
+            ...(jevConfig.setAside ? [`    To put it back: mv ${jevConfig.setAside} ${jevConfig.path}`] : []),
+          ]
+        : jevConfig.status === "kept-off"
+          ? [`  Jev stays switched off: ${jevConfig.path} (mode off) was kept, so connecting again leaves it off.`]
+        : jevConfig.status === "kept" && jevConfig.provider !== null
+          ? [`  ${jevConfig.path} (provider ${jevConfig.provider}) is your own Jev setup and was left in place.`]
+          : jevConfig.status === "set-aside"
+            ? [
+                `  ! ${jevConfig.path} was being checked when another jev.json was written in its place. Nothing was deleted: the new one is at ${jevConfig.path},`,
+                `    and the one that was there (provider ${jevConfig.provider ?? "unreadable"}, not FailproofAI Cloud's) is kept at ${jevConfig.setAside}.`,
+              ]
+            : removedJevKey
+            ? ["  Jev through FailproofAI Cloud is off: its key was removed."]
+            : [];
+
+  if (!removed && !existing && !hadIngest && !stoppedManaged && !removedJevKey && jevConfig.status !== "removed") {
+    // Nothing was connected — but the jev.json check ran all the same, and a
+    // file it could not put back where it was (a bring-your-own-key setup,
+    // moved aside) is not nothing: left unsaid, that Jev is simply gone.
+    const unsettled = jevConfig.status === "error" || jevConfig.status === "set-aside";
+    return { exitCode: 0, lines: ["This machine is not connected to FailproofAI Cloud.", ...(unsettled ? jevLines : [])] };
   }
 
   const lines = [
@@ -348,6 +396,7 @@ export function runDisconnectCommand(): CommandResult {
       ? "  Cloud-managed policies stop being enforced and stop being refreshed.\n" +
         "  Local builtin, custom and convention policies are unaffected."
       : "  Local builtin, custom and convention policies are unaffected.",
+    ...jevLines,
   ];
   if (removedIngest) {
     // Named honestly. The collector manager starts once for the daemon's

package/src/hooks/cloud-introspect.ts

@@ -135,6 +135,12 @@ export async function introspectKey(
 /** The permission each capability needs. Named so the messages can quote them. */
 export const PERMISSION_EVENTS = "events:add";
 export const PERMISSION_POLICIES = "policies:pull";
+/**
+ * Jev through FailproofAI Cloud, charged to the key's org. The server refuses a
+ * key that carries it without both of the above, so a key with it always
+ * connects for policy and reporting too — there is no Jev-only connection.
+ */
+export const PERMISSION_JEV = "jev:evaluate";
 
 export function hasPermission(identity: KeyIdentity, permission: string): boolean {
   return identity.permissions.includes(permission);

package/src/hooks/configure-wizard.ts

@@ -1178,7 +1178,18 @@ export async function runConfigureWizard(
         // did — it is not a trusted back door. http stays loopback-only, so a
         // bearer token still cannot be exported onto the wire in clear by
         // setting a variable.
-        const override = process.env.FAILPROOFAI_CLOUD_URL?.trim();
+        //
+        // `--url` comes first. It was read into `answers.url` and then only
+        // ever used as a CONDITION above, never as the URL, so
+        // `config --token <key> --url <X>` connected to the env value or the
+        // hosted default and ignored X — reporting a machine somewhere its
+        // operator had explicitly said not to. The CLI fills `answers.url` from
+        // `--url`, falling back to FAILPROOFAI_CLOUD_URL, so the source named
+        // on screen is whichever of the two the value actually is.
+        const envOverride = process.env.FAILPROOFAI_CLOUD_URL?.trim();
+        const flagOverride = answers.url?.trim();
+        const override = flagOverride || envOverride;
+        const source = flagOverride && flagOverride !== envOverride ? "--url" : "FAILPROOFAI_CLOUD_URL";
         if (override) {
           const validated = validateCloudUrl(cloudBaseFor(override));
           if (!validated.ok) {
@@ -1186,7 +1197,7 @@ export async function runConfigureWizard(
             // wants THAT endpoint, and quietly reporting a machine to the
             // hosted service instead is the one outcome they did not ask for.
             stdout.write(
-              `\nFAILPROOFAI_CLOUD_URL is set to "${override}", which cannot be used: ` +
+              `\n${source === "--url" ? "--url is" : "FAILPROOFAI_CLOUD_URL is set to"} "${override}", which cannot be used: ` +
                 `${validated.reason}\n`,
             );
             return cancel();
@@ -1196,7 +1207,7 @@ export async function runConfigureWizard(
           // matters and a machine reporting somewhere unexpected is exactly the
           // thing nobody notices until they go looking for data that is not
           // there.
-          stdout.write(`\nUsing ${url} (from FAILPROOFAI_CLOUD_URL).\n`);
+          stdout.write(`\nUsing ${url} (from ${source}).\n`);
         } else {
           url = cloudBaseFor(DEFAULT_INGEST_URL);
         }
@@ -1507,9 +1518,13 @@ export async function runConfigureWizard(
         token: connect.token,
         machineId: connect.machineId,
         machineLabel: connect.machineLabel,
-        // Both streams, as disclosed at the connect question. This is the one
-        // place that decision becomes a written setting.
-        sessions: true,
+        // Both streams, as disclosed at the connect question, unless the run
+        // said `--no-transcripts`. This is the one place that decision becomes
+        // a written setting — and it used to be a literal `true`, so the flag
+        // was parsed, carried here in `answers`, and silently ignored: a fleet
+        // that asked for decisions only shipped every prompt, file and command
+        // output. The separate `--connect` path always honoured it.
+        sessions: answers.noTranscripts !== true,
       });
       connected = outcome.anyConfigured;
       // Show the human label with the id in parentheses when they differ.
@@ -1520,6 +1535,11 @@ export async function runConfigureWizard(
       for (const line of describeOutcome(outcome, shownAs, connect.url)) {
         stdout.write(`${line}\n`);
       }
+      // Said when it took effect, as `--connect` says it: the default carries
+      // prompts and file contents, so the opt-out is worth confirming.
+      if (outcome.ingest.ok && answers.noTranscripts === true) {
+        stdout.write("  Session transcripts are NOT being sent (--no-transcripts). Decisions only.\n");
+      }
       // Never the key, the URL, or the count — only that it happened and which
       // capabilities the server actually granted.
       void emit("configure_connect", {