failproofai 1.0.7-beta.2 → 1.0.8-beta.0

package/src/hooks/pack-cli.ts

@@ -21,12 +21,12 @@ import {
   readInstalledPacks,
   type SemanticManifestEntry,
 } from "./pack-manifest";
-import { parseSemver } from "./semver-precedence";
+import { compareVersions, parseSemver } from "./semver-precedence";
 // The build step measures a pack's question set against the envelope's own
 // budget, which means reaching the semantic side. This is a CLI module — loaded
 // by `failproofai publish`, never by a hook — so the rule that keeps those
 // modules off an unconfigured machine's hook path does not apply here.
-import { MAX_PACK_QUESTION_CHARS, questionChars } from "./semantic/pack-policies";
+import { BUILTIN_QUESTION_CHARS, MAX_PACK_QUESTION_CHARS, questionChars, semanticPoliciesFromPacks } from "./semantic/pack-policies";
 import {
   AmbiguousPackId,
   PACK_CHECKSUMS_ASSET,
@@ -40,10 +40,12 @@ import {
   removePack,
   setPackPolicyEnabled,
   slugifyCategory,
+  type PackPreview,
 } from "./pack-store";
 import type { PolicyEffect } from "./cloud-managed-policies";
 import { loadCustomHooks } from "./custom-hooks-loader";
 import { getSemanticRegistrations } from "./custom-hooks-registry";
+import { isFirstPartyPack, isReservedClaim, jevPacks } from "./effective-reviewers";
 import { authorityFieldsOf, authorityProblem, resolvePolicyAuthority } from "./policy-authority";
 import type { PolicyCatalogEntry, SemanticPolicyDeclaration } from "./policy-types";
 import type { MultiChoice, RenderOpts, TTYIn, TTYOut } from "./tui";
@@ -80,8 +82,20 @@ export interface PackBuildMeta {
   policies: number;
   defaultOn: number;
   commit?: string;
+  /** Jev checks and no regex half: `publish` repeats {@link JEV_ONLY_ROLLBACK_REMINDER}. */
+  semanticOnly?: boolean;
 }
 
+/**
+ * A build from before `semanticOnly` refuses such a pack as blanket-deny, so its
+ * author has to tell users. Shared by build's lines and publish's success
+ * message, which is the only one an author actually reads.
+ */
+const JEV_ONLY_ROLLBACK_REMINDER = [
+  "  Jev checks alone: tell users to remove it before rolling a machine back to an older failproofai,",
+  "  which can deny every tool call over a pack it will not load (see the publish-a-pack docs).",
+];
+
 const ok = (lines: string[], meta?: PackBuildMeta): PackCliResult => ({
   lines,
   exitCode: 0,
@@ -89,12 +103,30 @@ const ok = (lines: string[], meta?: PackBuildMeta): PackCliResult => ({
 });
 const fail = (lines: string[]): PackCliResult => ({ lines, exitCode: 1 });
 
-function parseList(rest: string[], flag: string): string[] | undefined {
-  const idx = rest.findIndex((a) => a === flag || a.startsWith(`${flag}=`));
-  if (idx === -1) return undefined;
-  const raw = rest[idx].includes("=") ? rest[idx].split("=").slice(1).join("=") : rest[idx + 1];
-  if (!raw || raw.startsWith("--")) return [];
-  return raw.split(",").map((s) => s.trim()).filter(Boolean);
+/**
+ * The first failproofai that runs a pack's Jev checks as published: 1.0.7
+ * ignores `semantic` (and `minCliVersion`), and 1.0.7-beta.x replaces the
+ * built-in checks with a pack's. A pack with checks is held to at least this.
+ */
+const JEV_PACK_MIN_CLI = "1.0.8-beta.0";
+
+/**
+ * Every occurrence of any of `flags`, comma-split and de-duplicated: a repeated
+ * flag adds to the list rather than being silently dropped. `[]` when any
+ * occurrence has no value (callers refuse that), undefined when none appears.
+ */
+function parseList(rest: string[], ...flags: string[]): string[] | undefined {
+  let found = false;
+  const out: string[] = [];
+  for (let i = 0; i < rest.length; i += 1) {
+    const flag = flags.find((f) => rest[i] === f || rest[i].startsWith(`${f}=`));
+    if (!flag) continue;
+    found = true;
+    const raw = rest[i] === flag ? rest[i + 1] : rest[i].slice(flag.length + 1);
+    if (!raw || raw.startsWith("--")) return [];
+    out.push(...raw.split(",").map((s) => s.trim()).filter(Boolean));
+  }
+  return found ? [...new Set(out)] : undefined;
 }
 
 /**
@@ -184,17 +216,25 @@ export function packAddSource(rest: string[]): string | undefined {
  * a third would be the one that drifts.
  */
 function parseCliList(rest: string[]): { clis?: string[] } | { error: string[] } {
-  const idx = rest.findIndex((a) => a === "--cli" || a.startsWith("--cli="));
-  if (idx === -1) return {};
+  // Every `--cli`, not just the first: a repeat adds agents. One that names
+  // none still refuses the whole selection, below.
   const values: string[] = [];
-  if (rest[idx].startsWith("--cli=")) {
-    values.push(...rest[idx].slice("--cli=".length).split(","));
-  } else {
-    for (let j = idx + 1; j < rest.length && looksLikeCliName(rest[j]); j += 1) {
-      values.push(...rest[j].split(","));
-    }
+  let found = false;
+  let emptyOccurrence = false;
+  for (let i = 0; i < rest.length; i += 1) {
+    const before = values.length;
+    if (rest[i].startsWith("--cli=")) {
+      values.push(...rest[i].slice("--cli=".length).split(",").filter((v) => v.trim()));
+    } else if (rest[i] === "--cli") {
+      for (let j = i + 1; j < rest.length && looksLikeCliName(rest[j]); j += 1) {
+        values.push(...rest[j].split(",").filter((v) => v.trim()));
+      }
+    } else continue;
+    found = true;
+    if (values.length === before) emptyOccurrence = true;
   }
-  const names = values.map((v) => v.trim()).filter(Boolean);
+  if (!found) return {};
+  const names = emptyOccurrence ? [] : [...new Set(values.map((v) => v.trim()))];
   // `--cli` with nothing after it is a typo, not a scope.
   //
   // It used to become `clis: []`, which `installed.json` stores verbatim and
@@ -254,7 +294,7 @@ function selectionFrom(rest: string[]): {
 } {
   // `--policy` reads right for one ("give me this policy"), `--only` for a set.
   // They are the same switch; taking both means neither is the wrong guess.
-  const only = parseList(rest, "--policy") ?? parseList(rest, "--only");
+  const only = parseList(rest, "--policy", "--only");
   const categories = parseList(rest, "--category");
   const parsedClis = parseCliList(rest);
   if ("error" in parsedClis) return { error: parsedClis.error };
@@ -312,6 +352,10 @@ async function build(rest: string[]): Promise<PackCliResult> {
   const effect = flag("effect") ?? "enforce";
   const minCliVersion = flag("min-cli-version");
   const outDir = resolve(flag("out") ?? "dist-pack");
+  // Where it will be installed from, which is what a machine judges a pack by
+  // (`isFirstPartyPack` reads `source`, never the id). `publish` passes its
+  // repository; `pack build` has only the id to go on.
+  const repo = flag("repo");
 
   if (!entry || !id || !version) {
     return fail([
@@ -400,6 +444,7 @@ async function build(rest: string[]): Promise<PackCliResult> {
   // same deal `parsePackPolicy` gets above, so a semantic policy that could
   // never load fails here, where the author can fix it.
   const semantic: SemanticManifestEntry[] = [];
+  const packSource = { source: `github:${repo ?? identity.id}` };
   for (const [index, declaration] of semanticDeclarations.entries()) {
     try {
       const parsed = parsePackSemanticPolicy(identity.id, declaration, index);
@@ -409,21 +454,49 @@ async function build(rest: string[]): Promise<PackCliResult> {
       if (semantic.some((s) => s.name === parsed.name)) {
         throw new Error(`two semantic policies are called ${JSON.stringify(parsed.name)}`);
       }
+      // The loader's own rule: a built-in check name from anyone but FailproofAI
+      // is void on every machine, never asked and never a reviewer.
+      if (isReservedClaim(packSource, parsed.name)) {
+        throw new Error(
+          `${JSON.stringify(parsed.name)} is a name reserved for FailproofAI's own Jev checks, so a pack from ` +
+            `${repo ?? identity.id} would never have it asked. Pick a name of your own.`,
+        );
+      }
       semantic.push(parsed);
     } catch (err) {
       return fail([err instanceof Error ? err.message : String(err)]);
     }
   }
 
+  // A pack with Jev checks needs a build that runs them, so its minimum is at
+  // least the first one — written when the author gave none, refused when lower.
+  if (semantic.length > 0 && minCliVersion !== undefined && (compareVersions(minCliVersion, JEV_PACK_MIN_CLI) ?? 0) < 0) {
+    return fail([
+      `--min-cli-version ${minCliVersion} is older than the first failproofai that runs a pack's Jev checks (${JEV_PACK_MIN_CLI}):`,
+      "1.0.7 ignores them, and 1.0.7-beta.x replaces the built-in checks with them.",
+      `Pass --min-cli-version ${JEV_PACK_MIN_CLI} or newer, or leave it out and ${JEV_PACK_MIN_CLI} is written.`,
+    ]);
+  }
+  const requiredCli = semantic.length > 0 ? (minCliVersion ?? JEV_PACK_MIN_CLI) : minCliVersion;
+
   // The question budget, checked against what one Jev request can carry. A pack
   // over it installs and then has its overflow policies dropped one by one on
   // the user's machine, in manifest order — a pack that enforces less than it
   // says, which is the failure this whole lane is built to avoid.
+  //
+  // A pack from outside FailproofAI is ADDED to the built-in checks, which every
+  // machine spends the budget on first (`semanticPoliciesFromPacks`), so it gets
+  // only what they leave.
   const questionCost = semantic.reduce((total, entry) => total + questionChars(entry), 0);
-  if (questionCost > MAX_PACK_QUESTION_CHARS) {
+  const firstParty = isFirstPartyPack(packSource);
+  const questionBudget = MAX_PACK_QUESTION_CHARS - (firstParty ? 0 : BUILTIN_QUESTION_CHARS);
+  if (questionCost > questionBudget) {
     return fail([
       `This pack's ${semantic.length} semantic policies compile to ${questionCost} characters of questions, ` +
-        `over the ${MAX_PACK_QUESTION_CHARS} one Jev request has room for.`,
+        (firstParty
+          ? `over the ${MAX_PACK_QUESTION_CHARS} one Jev request has room for.`
+          : `over the ${questionBudget} a machine leaves a pack from outside FailproofAI: one Jev request has room ` +
+            `for ${MAX_PACK_QUESTION_CHARS}, and the 16 built-in checks every machine asks take ${BUILTIN_QUESTION_CHARS} of it first.`),
       "Shorten the probe instructions and criteria, or ship fewer policies per pack.",
     ]);
   }
@@ -452,6 +525,9 @@ async function build(rest: string[]): Promise<PackCliResult> {
         ? "One policy declares an authority this build cannot publish:"
         : `${authorityProblems.length} policies declare an authority this build cannot publish:`,
       ...authorityProblems,
+      ...(reviewers
+        ? ["This pack declares Jev checks of its own, so reviewedBy may name only those."]
+        : []),
       'Fix the declaration, or leave authority out and the policy is "hard". See https://docs.befailproof.ai/policies/authority',
     ]);
   }
@@ -464,7 +540,9 @@ async function build(rest: string[]): Promise<PackCliResult> {
     // FALSE: a pack's declared defaults are what `pack add` switches on with no
     // flags, and switching on a stranger's every policy unattended is the
     // installer opinion this lane already refused once.
-    const extra = hook as unknown as { category?: unknown; defaultEnabled?: unknown; params?: unknown };
+    const extra = hook as unknown as {
+      category?: unknown; defaultEnabled?: unknown; params?: unknown; alwaysOn?: unknown;
+    };
     // `params` is read off the registration for the same reason, and leaving it
     // out was not cosmetic: `registerPolicy` takes a pack policy's schema from the
     // MANIFEST by name, so a pack published without it evaluates every one of its
@@ -489,6 +567,9 @@ async function build(rest: string[]): Promise<PackCliResult> {
       defaultEnabled: extra.defaultEnabled === true,
       match: hook.match ?? {},
       ...(extra.params !== undefined ? { params: extra.params } : {}),
+      // Carried so parsePackPolicy refuses it as the loader would; left off, an
+      // alwaysOn registration published as an ordinary (even reviewable) policy.
+      ...("alwaysOn" in extra ? { alwaysOn: extra.alwaysOn } : {}),
       // Whether Jev may clear this policy's verdict. A pack's MANIFEST is what
       // a machine reads it from, so a declaration left on the registration
       // alone would be published as nothing — silently hard. Checked above, so
@@ -516,7 +597,7 @@ async function build(rest: string[]): Promise<PackCliResult> {
       {
         id: identity.id,
         version: identity.version,
-        ...(minCliVersion ? { minCliVersion } : {}),
+        ...(requiredCli ? { minCliVersion: requiredCli } : {}),
         effect: identity.effect,
         ...(identity.commit ? { commit: identity.commit } : {}),
         policies,
@@ -538,25 +619,35 @@ async function build(rest: string[]): Promise<PackCliResult> {
   );
 
   const on = policies.filter((p) => (p as { defaultEnabled?: boolean }).defaultEnabled).length;
+  const semanticOnly = policies.length === 0 && semantic.length > 0;
   return ok([
     `Built ${identity.id}@${identity.version} — ${policies.length} policies, ${on} on by default.`,
-    // Said separately, and said at all, because this half replaces the compiled-in
-    // semantic set on every machine that installs the pack. An author who did not
-    // mean to ship it should find that out here.
+    // Said separately, and said at all, because this half changes what Jev asks
+    // on every machine that installs the pack. An author who did not mean to
+    // ship it should find that out here.
     ...(semantic.length > 0
       ? [
           `  ${semantic.length} semantic ${semantic.length === 1 ? "policy" : "policies"} for Jev ` +
-            `(${questionCost} characters of questions), replacing this build's own set where it installs.`,
+            `(${questionCost} characters of questions), ` +
+            (identity.effect === "observe"
+              ? "not asked where it installs: Jev asks only the checks of packs that enforce."
+              : `${firstParty ? "replacing" : "added to"} the built-in checks where it installs.`),
         ]
       : []),
-    ...(minCliVersion ? [`  Requires failproofai ${minCliVersion} or newer.`] : []),
+    ...(requiredCli ? [`  Requires failproofai ${requiredCli} or newer.`] : []),
+    ...(semanticOnly ? JEV_ONLY_ROLLBACK_REMINDER : []),
     `  ${outDir}/${PACK_MANIFEST_ASSET}`,
     `  ${outDir}/${PACK_ENTRY_ASSET}`,
     `  ${outDir}/${PACK_CHECKSUMS_ASSET}`,
     "",
     `Publish: attach all three to a GitHub release tagged ${identity.version}, then anyone runs:`,
     `  failproofai policies add <owner>/<repo>`,
-  ], { policies: policies.length, defaultOn: on, ...(identity.commit ? { commit: identity.commit } : {}) });
+  ], {
+    policies: policies.length,
+    defaultOn: on,
+    ...(identity.commit ? { commit: identity.commit } : {}),
+    ...(semanticOnly ? { semanticOnly } : {}),
+  });
 }
 
 /**
@@ -2304,6 +2395,7 @@ async function publish(rest: string[]): Promise<PackCliResult> {
   const built = await build([
     entryToBuild,
     "--id", id,
+    ...(repo ? ["--repo", repo] : []),
     "--version", version,
     // NOT when the tree is dirty, even though `--version` let the publish
     // through. `commit` claims these bytes came from that commit, and on a
@@ -2328,7 +2420,9 @@ async function publish(rest: string[]): Promise<PackCliResult> {
       ...gitLines,
       ...(gitLines.length ? [""] : []),
       ...bundleNote,
-      ...built.lines.slice(0, 4),
+      // Everything above build's blank line: a fixed count cut the rollback
+      // reminder mid-sentence and dropped the asset paths.
+      ...built.lines.slice(0, built.lines.indexOf("")),
       "",
       ...(repo
         ? ["Dry run — nothing was published.", `Drop --dry-run to release it on ${repo}.`]
@@ -2444,6 +2538,7 @@ async function publish(rest: string[]): Promise<PackCliResult> {
     `Published ${id}@${version} to ${repo} at tag ${tag}.` +
       (versionFromSha ? " That names the commit it was built from." : ""),
     `  ${assets.length} assets attached`,
+    ...(built.meta?.semanticOnly ? JEV_ONLY_ROLLBACK_REMINDER : []),
     "",
     // The install lines are the whole point of the success message, and on a
     // private repository they are a lie — `policies add` 404s there. Print the
@@ -2555,6 +2650,36 @@ function semanticPhrase(count: number): string {
   return `${count} Jev ${count === 1 ? "check" : "checks"}`;
 }
 
+/**
+ * How a pack's Jev checks sit beside this build's, for add, show and the
+ * picker alike: a FailproofAI pack's replace them, anyone else's are added
+ * (`replacesBuiltinChecks`), and only where `jevPacks` lets the pack take part —
+ * never for an observe pack, only for its agents when scoped. One phrase, so
+ * the three cannot drift apart again.
+ */
+function besideBuiltinChecks(pack: { source?: string; effect?: PolicyEffect; clis?: string[] | null }): string {
+  if (jevPacks([{ effect: pack.effect ?? "enforce", clis: null }]).length === 0) {
+    return "not asked: this pack only observes, and Jev asks only the checks of packs that enforce";
+  }
+  const how = isFirstPartyPack(pack) ? "replacing this build's own set" : "added to this build's own checks";
+  return pack.clis && pack.clis.length > 0 ? `${how}, for ${pack.clis.join(", ")} only` : how;
+}
+
+/**
+ * Which of a pack's checks the resolver would leave out beside what is
+ * installed (the shared budget, a reserved or contested name). `preview` is a
+ * pack not installed yet, judged as if it were. A diagnostic: never throws.
+ */
+function jevCheckWarnings(id: string, preview?: PackPreview): string[] {
+  try {
+    const installed = readInstalledPacks().packs.filter((p) => p.id !== preview?.id);
+    const packs = preview ? [...installed, { ...preview, clis: null }] : installed;
+    return semanticPoliciesFromPacks(jevPacks(packs)).errors.filter((e) => e.includes(id));
+  } catch {
+    return [];
+  }
+}
+
 async function pickFromSource(
   source: string,
   io: { stdin: TTYIn; stdout: TTYOut },
@@ -2586,12 +2711,12 @@ async function pickFromSource(
   }
   const on = preview.policies.filter((p) => p.defaultEnabled).length;
   // Said BEFORE the list, because the list cannot say it: a pack's Jev checks are
-  // not rows here, they arrive whole, and they replace the ones this build ships.
-  // Somebody ticking boxes should know that is part of what they are agreeing to.
+  // not rows here, and they arrive whole. Somebody ticking boxes should know
+  // that is part of what they are agreeing to.
   if (preview.semantic.length > 0) {
     io.stdout.write(
-      `\n  This pack also brings ${semanticPhrase(preview.semantic.length)}, which are not selectable —\n` +
-        `  they replace the ones this build ships with. See: failproofai policies show ${source}\n\n`,
+      `\n  This pack also brings ${semanticPhrase(preview.semantic.length)} (not selectable), ` +
+        `${besideBuiltinChecks(preview)}.\n  See: failproofai policies show ${source}\n\n`,
     );
   }
   const picked = await multiSelect<string>({
@@ -2719,16 +2844,25 @@ async function add(rest: string[]): Promise<PackCliResult> {
         : `  enabled (${result.enabled.length}/${result.available.length}, ${why}): ${summarise(result.enabled)}`,
     );
     // Counted separately, and without an on/off ratio, because there is none:
-    // a pack's Jev checks arrive whole and REPLACE the ones this build ships.
+    // a pack's Jev checks arrive whole, and a FailproofAI pack's REPLACE the ones
+    // this build ships (anyone else's are added to them).
     // Silence here was the shape of the original bug — the manifest's semantic
     // half was fetched, verified and then never written to `installed.json`, so
     // the half somebody installed did nothing and nothing said so.
     if (result.semantic > 0) {
       lines.push(
-        `  ${semanticPhrase(result.semantic)} for Jev, replacing this build's own set. ` +
+        `  ${semanticPhrase(result.semantic)}, ${besideBuiltinChecks(result)}. ` +
           "They apply only where you configured Jev (`failproofai jev status`).",
       );
     }
+    // Nothing after this screen says it: the record keeps no unreadable minimum.
+    if (result.minCliVersionNote) lines.push(`  ${result.minCliVersionNote}`);
+    // Which of its checks the resolver will leave out beside what is already
+    // installed (the shared question budget, a reserved or contested name).
+    // Otherwise said only in the hook log, on the first call that asks Jev.
+    if (result.semantic > 0) {
+      for (const e of jevCheckWarnings(result.id)) lines.push(`  ▲ ${e}`);
+    }
 
     if (skipped.length > 0) {
       lines.push(`  not enabled (${skipped.length}): ${summarise(skipped)}`);
@@ -3077,6 +3211,8 @@ export function jevChecksSection(
   pack: {
     policies: ReadonlyArray<PolicyCatalogEntry>;
     semantic: ReadonlyArray<SemanticManifestEntry>;
+    /** Where it is (or would be) installed from, which decides replace or add. */
+    source?: string;
   },
   opts?: RenderOpts,
 ): string[] | null {
@@ -3110,8 +3246,8 @@ export function jevChecksSection(
     ...table({ head: ["", "", ""], rows, protect: [0, 1] }, opts),
     "",
     ...note(
-      "Nothing toggles them: `--policy` cannot name one, `failproofai policies` never lists them, " +
-        "and a pack's checks replace the ones this build ships with.",
+      "Nothing toggles them: `--policy` cannot name one and `failproofai policies` never lists them. " +
+        `They arrive whole, ${besideBuiltinChecks(pack)}.`,
       opts,
     ),
     ...note(
@@ -3171,12 +3307,14 @@ async function listRemote(source: string): Promise<PackCliResult> {
         opts,
       ),
       preview.minCliVersion ? note(`Requires failproofai ${preview.minCliVersion} or newer.`, opts) : null,
+      preview.minCliVersionNote ? note(preview.minCliVersionNote, opts) : null,
       preview.resolvedFromLatest ? note(`Newest release: ${preview.source}`, opts) : null,
       table({ head: ["", "", ""], rows }, opts),
       // The half the table above cannot hold: its own section, under the
       // policies rather than above them, because a check is read against the
       // policies it can clear and those are the rows just passed.
       jevChecksSection(preview, opts),
+      preview.semantic.length > 0 ? jevCheckWarnings(preview.id, preview).flatMap((e) => warning([e], opts)) : null,
       nextStep(`failproofai policies add ${source}`, "Install the defaults with:", opts),
       note("Or take part of it: --policy <a,b>, --category <x,y>, --all", opts),
     ),

package/src/hooks/pack-failclosed.ts

@@ -151,6 +151,9 @@ export function missingGuards(input: {
     // loaded, would have allowed.
     if (err.effect === "observe") continue;
     if (outOfScope(err.clis, input.cli)) continue;
+    // Jev checks only: nothing in the regex tier is missing. The refusal is
+    // still reported (hook log, `failproofai policies`); it just denies nothing.
+    if (err.semanticOnly) continue;
     const declared = err.declared ?? [];
     out.push({
       packId: err.id ?? "(unnamed pack)",

package/src/hooks/pack-manifest.ts

@@ -253,6 +253,13 @@ export interface PackError {
    * deny on their behalf locks an agent out over enforcement it never had.
    */
   clis?: string[] | null;
+  /**
+   * The record's regex `policies` list was readable and empty: a Jev-checks-only
+   * pack. It guards nothing in the regex tier, so its refusal has nothing to
+   * fail closed on. Read from the RAW list, never from `declared`: a list whose
+   * entries are all malformed also filters to nothing, and that must widen.
+   */
+  semanticOnly?: true;
 }
 
 export interface PackReadResult {
@@ -532,7 +539,9 @@ export function checkPackMinCliVersion(
       kind: "too-old",
       reason:
         `pack ${packId} needs failproofai ${String(declared)} or newer and this is ${current} — ` +
-        "run `npm i -g failproofai && failproofai update`",
+        // As a range: the bare name installs `latest`, which can sit below a
+        // prerelease minimum. `declared` compared above, so it is plain semver.
+        `run \`npm i -g "failproofai@>=${String(declared)}" && failproofai update\``,
     };
   }
   return { kind: "satisfied", declared: declared as string };
@@ -883,6 +892,7 @@ export function readInstalledPacks(): PackReadResult {
         // Best effort: an entry too malformed to list policies yields nothing
         // here, and a deny built from it is unavoidably blanket.
         ...(Array.isArray(rec?.policies) ? { declared: safeDeclared(rec.policies) } : {}),
+        ...(Array.isArray(rec?.policies) && rec.policies.length === 0 ? { semanticOnly: true as const } : {}),
         // A list of names, or nothing. Anything else is unreadable scope, and
         // unreadable scope has to mean "every agent" — the same reasoning that
         // widens an unreadable `match`: a narrowing nobody can parse says

package/src/hooks/pack-store.ts

@@ -45,6 +45,7 @@ import {
   parsePackSemanticPolicy,
   readInstalledPacks,
 } from "./pack-manifest";
+import { isFirstPartyPack } from "./effective-reviewers";
 import type { ResolvedPack, SemanticManifestEntry } from "./pack-manifest";
 import type { InstalledPackRecord } from "./pack-manifest";
 import type { PolicyCatalogEntry } from "./policy-types";
@@ -102,6 +103,11 @@ export interface AddPackResult {
    * reporting "the pack is installed and enforcing nothing".
    */
   semantic: number;
+  /** Why the pack's minCliVersion was ignored, when this build could not compare it. */
+  minCliVersionNote?: string;
+  /** As recorded, so the CLI can say where its Jev checks are asked (`jevPacks`). */
+  effect?: PolicyEffect;
+  clis?: string[];
   artifact: string;
 }
 
@@ -474,6 +480,8 @@ interface FetchedPack {
   semantic: SemanticManifestEntry[];
   /** The minimum CLI it claims, once this one has been checked against it. */
   minCliVersion?: string;
+  /** Why a minimum this build cannot compare was ignored, to be said out loud. */
+  minCliVersionNote?: string;
   effect?: PolicyEffect;
   /** The git commit the publisher built this from, when they had one. */
   commit?: string;
@@ -530,15 +538,22 @@ function parseManifestSemantic(packId: string, value: unknown): SemanticManifest
  * until somebody works out why. Catching it at install turns the same fact into
  * one line at the moment of choosing.
  *
- * A minimum this build cannot compare is IGNORED, exactly as the loader ignores
+ * A minimum this build cannot compare is ignored, exactly as the loader ignores
  * it: a publisher's typo in a version string must not be able to stop anyone
- * installing a pack. `failproofai publish` refuses to write one, so this is
- * only reachable from a pack built by some other tool.
+ * installing a pack. But the reason comes back as a note for the preview and
+ * the install to print, since the record keeps no unreadable value and the
+ * loader's own warning never reaches a CLI screen. `failproofai publish`
+ * refuses to write one, so this is only reachable from a pack built by some
+ * other tool.
  */
-function assertMinCliVersion(packId: string, declared: unknown): string | undefined {
+function assertMinCliVersion(
+  packId: string,
+  declared: unknown,
+): { minCliVersion?: string; minCliVersionNote?: string } {
   const verdict = checkPackMinCliVersion(packId, declared);
   if (verdict.kind === "too-old") throw new Error(verdict.reason);
-  return verdict.kind === "satisfied" ? verdict.declared : undefined;
+  if (verdict.kind === "unreadable") return { minCliVersionNote: verdict.reason };
+  return verdict.declared ? { minCliVersion: verdict.declared } : {};
 }
 
 /** Fetch and fully validate a pack, without writing anything. */
@@ -636,6 +651,8 @@ export interface PackPreview {
   semantic: SemanticManifestEntry[];
   /** The minimum CLI this pack declares, when it declares one this build can read. */
   minCliVersion?: string;
+  /** Why a declared minimum this build cannot read was ignored. */
+  minCliVersionNote?: string;
   /** The exact source the preview was read from, tag resolved and pinned. */
   source: string;
   /** True when the tag was resolved rather than typed. */
@@ -685,7 +702,7 @@ export async function fetchPackPreview(source: string): Promise<PackPreview> {
     semantic?: unknown; minCliVersion?: unknown;
   };
   const identity = parsePackIdentity(value);
-  const minCliVersion = assertMinCliVersion(identity.id, value.minCliVersion);
+  const minCli = assertMinCliVersion(identity.id, value.minCliVersion);
   const semantic = parseManifestSemantic(identity.id, value.semantic);
   const policies = parseManifestPolicies(identity.id, value.policies);
   assertDeclaresSomething(policies, semantic);
@@ -696,7 +713,7 @@ export async function fetchPackPreview(source: string): Promise<PackPreview> {
     ...(identity.commit ? { commit: identity.commit } : {}),
     policies,
     semantic,
-    ...(minCliVersion ? { minCliVersion } : {}),
+    ...minCli,
     source: formatPackSpec(spec),
     resolvedFromLatest,
   };
@@ -710,7 +727,14 @@ export async function fetchPackPreview(source: string): Promise<PackPreview> {
 function parseManifestPolicies(packId: string, value: unknown): PolicyCatalogEntry[] {
   if (value === undefined) return [];
   if (!Array.isArray(value)) throw new Error(`pack ${packId} policies is not an array`);
-  return value.map((policy, i) => parsePackPolicy(packId, policy, i));
+  const policies = value.map((policy, i) => parsePackPolicy(packId, policy, i));
+  // The loader's rule: it refuses the whole record over a repeated name.
+  const names = new Set<string>();
+  for (const p of policies) {
+    if (names.has(p.name)) throw new Error(`pack ${packId} declares ${p.name} twice`);
+    names.add(p.name);
+  }
+  return policies;
 }
 
 /**
@@ -776,7 +800,7 @@ async function fetchPack(spec: PinnedPackSpec): Promise<FetchedPack> {
   // Before the shape checks below, because being too old for the pack is not a
   // complaint about the pack: the message to give is "update the CLI", and a
   // manifest field this build cannot read yet must not be reported as malformed.
-  const minCliVersion = assertMinCliVersion(identity.id, raw.minCliVersion);
+  const minCli = assertMinCliVersion(identity.id, raw.minCliVersion);
   // Validated with the SAME rules the loader applies, so a pack that could never
   // load is refused here — while nothing has been written — rather than
   // installing cleanly and failing silently on the next tool call.
@@ -789,7 +813,7 @@ async function fetchPack(spec: PinnedPackSpec): Promise<FetchedPack> {
     version: identity.version,
     policies,
     semantic,
-    ...(minCliVersion ? { minCliVersion } : {}),
+    ...minCli,
     ...(raw.effect !== undefined ? { effect: identity.effect } : {}),
     ...(identity.commit ? { commit: identity.commit } : {}),
     artifact,
@@ -995,6 +1019,16 @@ export async function addPack(
           : `Name the tag whose manifest says ${fetched.version}, or fix the pack: ${fix}.`),
     );
   }
+  // The id is self-declared, so without this any release could install as a
+  // FailproofAI pack: labelled FailproofAI's own wherever verdicts are shown,
+  // and squatting the id the real pack then cannot take. Owner only — an id may
+  // otherwise differ from its repository (`publish --id`).
+  if (/^failproofai\//i.test(fetched.id) && !isFirstPartyPack({ source: formatPackSpec(spec) })) {
+    throw new Error(
+      `${fetched.id} was not installed: the FailproofAI/ namespace is reserved for releases from ` +
+        `github.com/FailproofAI, and this one came from ${spec.owner}/${spec.repo}.`,
+    );
+  }
   const available = fetched.policies.map((p) => p.name);
 
   const prior = priorRecordFor(fetched.id, fetched.artifactDigest);
@@ -1124,6 +1158,9 @@ export async function addPack(
     selection: reason,
     categories: [...new Set(fetched.policies.map((p) => slugifyCategory(p.category)))],
     semantic: fetched.semantic.length,
+    ...(fetched.minCliVersionNote ? { minCliVersionNote: fetched.minCliVersionNote } : {}),
+    ...(fetched.effect ? { effect: fetched.effect } : {}),
+    ...(record.clis ? { clis: record.clis } : {}),
     artifact: artifactAbs,
   };
 }