failproofai 1.0.7 → 1.0.8

package/.next/standalone/app/settings/settings-client.tsx

@@ -206,7 +206,24 @@ const HOW_IT_WORKS: ReadonlyArray<{ label: string; body: string }> = [
   },
 ];
 
-export default function SettingsClient({ initial }: { initial: ScheduledAuditView | null }) {
+export default function SettingsClient({
+  initial,
+  jevPanel,
+}: {
+  initial: ScheduledAuditView | null;
+  /**
+   * The Jev panel, rendered by the server page and handed in as an element
+   * rather than imported here.
+   *
+   * It is its own feature with its own file, its own actions and its own
+   * refresh — nothing on this page reads or writes what it does. Composing it
+   * in keeps that true in the code as well as in the design: this component
+   * does not import the Jev actions, so a test of the scheduled-audit panel
+   * neither renders nor touches Jev, and vice versa. Optional so the existing
+   * callers that only care about the audit panel keep working unchanged.
+   */
+  jevPanel?: ReactNode;
+}) {
   // Seeded from the server render, so the first paint already tells the truth
   // about whether scheduled audits are on. See the note in `page.tsx`.
   const [view, setView] = useState<ScheduledAuditView | null>(initial);
@@ -507,6 +524,10 @@ export default function SettingsClient({ initial }: { initial: ScheduledAuditVie
                 dashboard can reach <code>~/.failproofai/config.json</code>.
               </p>
             </div>
+            {/* A different file. An unreadable `config.json` says nothing about
+                `jev.json`, and hiding the panel that can turn a second
+                evaluator off would be the worst moment to hide it. */}
+            {jevPanel}
           </div>
         ) : (
           <div className="set-console">
@@ -653,6 +674,11 @@ export default function SettingsClient({ initial }: { initial: ScheduledAuditVie
                 </dl>
               </div>
             </div>
+
+            {/* Full width, below the two panels: Jev is a second evaluator for
+                the whole machine, not a property of the scheduled scan, and its
+                endpoint would not fit a half-width column anyway. */}
+            {jevPanel}
           </div>
         )}
 

package/.next/standalone/app/settings/settings.css

@@ -151,6 +151,51 @@
   margin: 0;
 }
 
+/* ── jev ──────────────────────────────────────────────────────────────────── */
+
+/* A full-width cell in the same console, below the two panels. The gap above it
+ * is the console's own 1px grid — this rule adds no border of its own. */
+.set-jev {
+  display: flex;
+  flex-direction: column;
+  gap: 16px;
+}
+
+/* Two columns at desktop: a provider or a mode needs about half the width an
+ * endpoint does, and stacking five controls in one column turns a short form
+ * into a scroll. */
+.set-jev-fields {
+  display: grid;
+  grid-template-columns: repeat(2, minmax(0, 1fr));
+  gap: 16px 20px;
+}
+
+.set-field {
+  display: flex;
+  flex-direction: column;
+  gap: 6px;
+  min-width: 0;
+}
+.set-field-label {
+  font-family: var(--font-mono);
+  font-size: 9.5px;
+  font-weight: 500;
+  letter-spacing: 0.18em;
+  text-transform: uppercase;
+  color: var(--dim);
+}
+
+.set-jev-actions {
+  display: flex;
+  align-items: center;
+  gap: 16px;
+  flex-wrap: wrap;
+}
+
+@media (max-width: 640px) {
+  .set-jev-fields { grid-template-columns: 1fr; }
+}
+
 /* ── masthead ─────────────────────────────────────────────────────────────── */
 
 .set-mast {
@@ -228,6 +273,40 @@
   outline-offset: 1px;
 }
 
+/* `.set-num`'s box, stretched. Same background, same hairline, same square
+ * corners and the same pink focus ring — a second field style would read as a
+ * second form on one page. */
+.set-text,
+.set-select {
+  font-family: var(--font-mono);
+  font-size: 13px;
+  width: 100%;
+  padding: 6px 10px;
+  background: var(--bg);
+  border: 1px solid var(--line-2);
+  color: var(--ink);
+  border-radius: 0;
+}
+.set-text:focus-visible,
+.set-select:focus-visible {
+  outline: 2px solid var(--accent-pink);
+  outline-offset: 1px;
+}
+.set-text:disabled,
+.set-select:disabled {
+  opacity: 0.5;
+  cursor: not-allowed;
+}
+.set-text::placeholder {
+  color: var(--dim);
+}
+/* The native arrow is drawn by the platform and cannot be tokenised; leaving
+ * the control's own appearance in place is the one honest option, so the box
+ * around it is what carries the page's style. */
+.set-select {
+  cursor: pointer;
+}
+
 .set-link {
   font-family: var(--font-mono);
   font-size: 12px;

package/.next/standalone/fp-cloud-cli/CHANGELOG.md

@@ -2,10 +2,28 @@
 
 ## 0.0.2b0 — 2026-09-22
 
-Open for the next release. `0.0.1` published on 2026-09-22 and the `bump` job
-moved the version here automatically; nothing has landed against `0.0.2b0` yet.
-Add entries as changes merge — this section becomes the GitHub Release body when
-it ships.
+### Added
+
+- `jev:evaluate` is a known permission — Jev through FailproofAI Cloud, charged to the
+  org's plan — so `fp keys` and `fp users` accept it instead of refusing it as unknown,
+  and the `admin` preset carries it, as the server's built-in admin set now does. The
+  server refuses a KEY carrying it without both `events:add` and `policies:pull` (422,
+  naming what to add in `missing_permissions`); the `admin` preset has both. (#833)
+- `fp keys create/update --permission-set machine`: the dashboard's key-only preset
+  (`events:add` + `policies:pull` + `jev:evaluate`), for an enrolled machine using Jev through
+  FailproofAI Cloud. `fp keys` also refuses `jev:evaluate` without both prerequisites itself
+  (exit 2, naming what is missing) instead of sending the key for the server's 422. (#833)
+
+### Changed
+
+- `fp policies publish` (and `policies compose --publish`) refuses a source carrying Jev
+  fields a cloud policy never reads — a `semanticPolicies.add(...)` call, or a registration
+  declaring `authority: "reviewable"` — before anything is sent (exit 1, `--no-verify` does
+  not skip it). Both were published as versions that read Jev-aware and are not: semantic
+  checks load only from a pack, and a cloud policy's authority comes from its deployment, so
+  it stays hard. Ship Jev checks in a pack with `failproofai publish`. Same rule, and the
+  same comment-aware detection, as the dashboard's publish form; the server does not read
+  the source, so nothing else refuses it for `fp`. (#833)
 
 ## 0.0.1 — 2026-09-22
 

package/.next/standalone/fp-cloud-cli/fp_cli/client.py

@@ -34,6 +34,7 @@ from .errors import (
     NetworkError,
     NotFoundError,
 )
+from .policy_check import cloud_publish_problem
 from .models import (
     AgentEvent,
     Alert,
@@ -1601,7 +1602,19 @@ def list_policies(ctx: ClientContext) -> List[PolicyVersion]:
 def publish_policy(
     ctx: ClientContext, policy_id: str, source: str, description: str = ""
 ) -> PolicyVersion:
-    """POST /api/enforcement/policies — mints a NEW VERSION; never edits in place."""
+    """POST /api/enforcement/policies — mints a NEW VERSION; never edits in place.
+
+    Refuses Jev fields a cloud policy never reads before anything is sent, here
+    because `policies publish` and `policies compose --publish` both route through
+    it — and regardless of `--no-verify`, which only skips the syntax check.
+    """
+    problem = cloud_publish_problem(source)
+    if problem:
+        raise ApiError(
+            f"{policy_id} cannot be published as a cloud policy: {problem}",
+            hint=("Jev checks ship in a failproofai pack — `failproofai publish` — where "
+                  "semanticPolicies.add and authority: \"reviewable\" take effect"),
+        )
     body = {"id": policy_id, "source": source, "description": description}
     return PolicyVersion.from_dict(_post_json(ctx, "/api/enforcement/policies", body) or {})
 

package/.next/standalone/fp-cloud-cli/fp_cli/commands/keys_cmds.py

@@ -77,12 +77,24 @@ def _expand_key_set_or_exit(state: AppState, cctx, set_name: str) -> List[str]:
         return permissions.key_assignable_only(sets[set_name])
     if set_name in permissions.PRESETS:
         return permissions.key_assignable_only(permissions.PRESETS[set_name])
-    available = sorted(set(sets) | (set(permissions.PRESETS) - {"clear"}))
+    if set_name in permissions.KEY_PRESETS:
+        return list(permissions.KEY_PRESETS[set_name])
+    available = sorted(set(sets) | (set(permissions.PRESETS) - {"clear"}) | set(permissions.KEY_PRESETS))
     raise click.UsageError(
         f'unknown permission set "{set_name}". available: {", ".join(available)}'
     )
 
 
+def _check_jev_or_exit(perms) -> None:
+    """The server's 422 for jev:evaluate without its prerequisites, as a usage error (exit 2)
+    before anything is sent."""
+    missing = permissions.jev_requirements_missing(perms)
+    if missing:
+        raise click.UsageError(
+            f"jev:evaluate also requires events:add and policies:pull; missing: {', '.join(missing)}"
+        )
+
+
 def keys_list(
     ctx: typer.Context,
     show_id: bool = typer.Option(False, "--show-id", help="Prepend a short key-id column (the full id is always in --json)."),
@@ -142,7 +154,7 @@ def keys_show(
 def keys_create(
     ctx: typer.Context,
     name: str = typer.Argument(..., help="Human-readable key name (unique within the org)."),
-    permission_set: Optional[str] = typer.Option(None, "--permission-set", help="Role to seed the key from — a permission set: `read-only`, `standard`, `admin`, or a custom set your org defines in the dashboard. The set is expanded into the key's grants (human-only perms are dropped). Omit for no base role."),
+    permission_set: Optional[str] = typer.Option(None, "--permission-set", help="Role to seed the key from — a permission set: `read-only`, `standard`, `admin`, `machine` (events:add + policies:pull + jev:evaluate), or a custom set your org defines in the dashboard. The set is expanded into the key's grants (human-only perms are dropped). Omit for no base role."),
     add: Optional[List[str]] = typer.Option(None, "--add", help="Grant extra permissions on top of the set, as `slug:action.action` tokens (dotted actions expand: `events:read.add` → `events:read`, `events:add`). Several via comma, repeated flag, or a quoted group: `--add events:read,keys:read` · `--add a --add b` · `--add \"a b\"`."),
     remove: Optional[List[str]] = typer.Option(None, "--remove", help="Drop permissions from the set, same `slug:action.action` token format as --add (comma / repeated / quoted)."),
 ) -> None:
@@ -179,6 +191,7 @@ def keys_create(
         raise click.UsageError(f'a key named "{name}" already exists')
     base = _expand_key_set_or_exit(state, cctx, permission_set) if permission_set else []
     flat = sorted((set(base) | set(parsed_add)) - set(parsed_remove))
+    _check_jev_or_exit(flat)
     secret = secrets.token_hex(32)  # 64 hex chars, mirrors the dashboard's generateToken()
     result = api.create_key(cctx, name=name, key=secret, permissions=flat)
     _write.record_action("api_key_created", resource="key", success=True, permission_count=len(flat))
@@ -198,7 +211,7 @@ def keys_create(
 def keys_update(
     ctx: typer.Context,
     name: str = typer.Argument(..., help="Key name to update (unique within the org)."),
-    permission_set: Optional[str] = typer.Option(None, "--permission-set", help="Reseed the key from a permission set: `read-only`, `standard`, `admin`, or a custom org set. REPLACES the key's grants with the set (then applies any --add/--remove). Human-only perms are dropped."),
+    permission_set: Optional[str] = typer.Option(None, "--permission-set", help="Reseed the key from a permission set: `read-only`, `standard`, `admin`, `machine`, or a custom org set. REPLACES the key's grants with the set (then applies any --add/--remove). Human-only perms are dropped."),
     add: Optional[List[str]] = typer.Option(None, "--add", help="Grant permissions, same `slug:action.action` token format as `keys create` (dotted actions expand; comma / repeated flag / quoted compose). Incremental — merged into the key's CURRENT grants, unless --permission-set is also given."),
     remove: Optional[List[str]] = typer.Option(None, "--remove", help="Revoke permissions, same `slug:action.action` token format as --add. Incremental — applied to the key's CURRENT grants, unless --permission-set is also given."),
     yes: bool = typer.Option(False, "--yes", "-y", help="Skip the confirmation prompt. The prompt only appears on an interactive terminal: under --json, or with stdin redirected, this command proceeds without asking."),
@@ -267,6 +280,7 @@ def keys_update(
         else:
             output.key_no_change()
         return
+    _check_jev_or_exit(after_set)
 
     proceed = (not _write.should_prompt(state, yes)) or output.confirm_key_update(
         key.name, len(added), len(removed))

package/.next/standalone/fp-cloud-cli/fp_cli/commands/policies_cmds.py

@@ -116,6 +116,9 @@ def policies_publish(
     does this: the server validates the id and a size ceiling, and a broken
     policy otherwise fails on the machine at enforcement time. `--no-verify`
     skips it; a host without node publishes with a warning rather than a block.
+    Jev fields a cloud policy never reads (`semanticPolicies.add`, `authority:
+    "reviewable"`) are refused regardless — ship those in a pack with
+    `failproofai publish`.
 
     Source can come from a path, `@path`, a pipe, `-`, or an interactive paste
     when you give none and stdin is a terminal.

package/.next/standalone/fp-cloud-cli/fp_cli/permissions.py

@@ -48,6 +48,12 @@ ALL_PERMISSIONS: List[str] = [
     "policies:write",
     "policies:pull",
     "usage:read",
+    # Jev through FailproofAI Cloud, charged to the org's plan. The built-in
+    # admin set carries it, so PRESETS["admin"] below does too. The server
+    # refuses a KEY that carries it without both events:add and policies:pull
+    # (422, naming what to add in `missing_permissions`): a Jev key is always a
+    # machine's whole connection, never a Jev-only one.
+    "jev:evaluate",
     "orgs:admin",
 ]
 
@@ -103,6 +109,22 @@ PRESETS = {
     "clear": [],
 }
 
+# Key-only presets (dashboard/lib/keyPresets.ts). `machine` is an enrolled machine's whole
+# connection: events out, policy in, and Jev through FailproofAI Cloud (charged per call).
+KEY_PRESETS = {"machine": ["events:add", "policies:pull", "jev:evaluate"]}
+
+# What a key carrying jev:evaluate must also carry: the server refuses it otherwise (422,
+# `JEV_REQUIRES` in server/src/auth.rs), on create and on an update that drops one.
+JEV_REQUIRES = ["events:add", "policies:pull"]
+
+
+def jev_requirements_missing(perms) -> List[str]:
+    """The Jev prerequisites a key's grant list lacks (empty when it has no jev:evaluate)."""
+    if "jev:evaluate" not in perms:
+        return []
+    return [p for p in JEV_REQUIRES if p not in perms]
+
+
 _ASSIGNABLE_SET = frozenset(ASSIGNABLE_PERMISSIONS)
 
 # Permissions that parse + are user-assignable but must NEVER sit on an API key — the server's

package/.next/standalone/fp-cloud-cli/fp_cli/policy_check.py

@@ -288,3 +288,172 @@ def run_policy(
                    "at import time"),
         )
     return PolicyRun(ok=True, results=results)
+
+
+# ── Jev fields a cloud policy never reads ────────────────────────────────────
+#
+# A port of agenteye's `cloudPublishProblem` (dashboard/lib/policies/policyMeta.ts),
+# kept to the same rule and the same words so the dashboard and this CLI refuse the
+# same sources. The server never reads the source (its 422 is for body fields such
+# as `authority`, which the CLI does not send), so for `fp` this is the only guard.
+# Static by design: this reads source it must never run. Keep the two in step — a
+# change to one is a change to both.
+
+_MAX_SCAN = 200_000
+_ADD = "customPolicies.add("
+_ADD_CALL = re.compile(re.escape(_ADD))
+#: The whitespace JavaScript allows around `.` and `(`.
+_SEMANTIC_CALL = re.compile(r"semanticPolicies\s*\.\s*add\s*\(")
+#: After one of these, `/` is division, not the start of a regex literal.
+_VALUE_END = re.compile(r"[A-Za-z0-9_$)\]]")
+_KEY = re.compile(r"([A-Za-z_$][A-Za-z0-9_$]*)[ \t]*:")
+
+
+def _skip_trivia(s: str, i: int) -> int:
+    """Index of the next character that is code: past whitespace and comments."""
+    while True:
+        while i < len(s) and s[i].isspace():
+            i += 1
+        if s.startswith("//", i):
+            nl = s.find("\n", i)
+            if nl == -1:
+                return len(s)
+            i = nl + 1
+        elif s.startswith("/*", i):
+            end = s.find("*/", i + 2)
+            if end == -1:
+                return len(s)
+            i = end + 2
+        else:
+            return i
+
+
+def _end_of_regex(s: str, i: int, prev: str) -> int:
+    """Index past the regex literal at `i`, or -1 if none starts (or closes) there."""
+    if s[i] != "/" or _VALUE_END.match(prev):
+        return -1
+    j, in_class = i + 1, False
+    while j < len(s):
+        c = s[j]
+        if c == "\\":
+            j += 2
+            continue
+        if c == "\n":
+            return -1
+        if c == "[":
+            in_class = True
+        elif c == "]":
+            in_class = False
+        elif c == "/" and not in_class:
+            j += 1
+            while j < len(s) and "a" <= s[j] <= "z":
+                j += 1
+            return j
+        j += 1
+    return -1
+
+
+def _end_of_string(s: str, i: int) -> int:
+    """Index past the string literal at `i`, or -1 if it never closes."""
+    q, j = s[i], i + 1
+    while j < len(s):
+        if s[j] == "\\":
+            j += 2
+            continue
+        if s[j] == q:
+            return j + 1
+        j += 1
+    return -1
+
+
+def _find_call(s: str, call: "re.Pattern[str]", start: int = 0) -> int:
+    """Index of the first `call` that is code — not in a comment, string or regex."""
+    i, prev = start, ("(" if start > 0 else "")
+    for _ in range(_MAX_SCAN):
+        i = _skip_trivia(s, i)
+        if i >= len(s):
+            return -1
+        if call.match(s, i):
+            return i
+        end = _end_of_regex(s, i, prev)
+        if end != -1:
+            i, prev = end, "/"
+            continue
+        if s[i] in "\"'`":
+            end = _end_of_string(s, i)
+            if end == -1:
+                return -1  # unterminated: nothing after it is readable
+            i, prev = end, '"'
+            continue
+        prev = s[i]
+        i += 1
+    return -1
+
+
+def _direct_props(s: str, at: int) -> Dict[str, str]:
+    """The static string properties of the object passed to the `customPolicies.add(`
+    at `at` — direct ones only, never a key in `match`, `params` or the fn body.
+    Fails closed: anything unbalanced or unterminated reads as nothing."""
+    out: Dict[str, str] = {}
+    i = _skip_trivia(s, at + len(_ADD))
+    if i >= len(s) or s[i] != "{":
+        return out
+    i, depth, prev = i + 1, 1, "{"
+    while i < len(s) and depth > 0:
+        i = _skip_trivia(s, i)
+        if i >= len(s):
+            break
+        c = s[i]
+        end = _end_of_regex(s, i, prev)
+        if end != -1:
+            i, prev = end, "/"
+            continue
+        if c in "\"'`":
+            end = _end_of_string(s, i)
+            if end == -1:
+                return {}
+            i, prev = end, '"'
+            continue
+        if c in "{[(" or c in "}])":
+            depth += 1 if c in "{[(" else -1
+            i, prev = i + 1, c
+            continue
+        if depth == 1 and prev in ("{", ","):
+            m = _KEY.match(s, i, i + 64)
+            if m:
+                i = _skip_trivia(s, m.end())
+                q = s[i] if i < len(s) else ""
+                end = _end_of_string(s, i) if q in ("\"", "'", "`") else -1
+                raw = s[i + 1:end - 1] if end != -1 else ""
+                # Escapes and interpolation are not knowable statically: absent.
+                if raw.strip() and "\\" not in raw and not (q == "`" and "${" in raw):
+                    out.setdefault(m.group(1), raw.strip())  # first wins
+                prev = ":"
+                continue
+        prev = c
+        i += 1
+    return out if depth == 0 else {}
+
+
+def cloud_publish_problem(source: str) -> Optional[str]:
+    """Why this source cannot be published as a cloud policy as written, or None.
+
+    Both halves of Jev are inert in a cloud policy and neither says so on the
+    machine: `semanticPolicies.add` is read only from an installed pack, and a
+    cloud policy's authority comes from its deployment, which never sets it. A
+    commented-out example does not count.
+    """
+    if not source or len(source) > _MAX_SCAN:
+        return None
+    if _find_call(source, _SEMANTIC_CALL) != -1:
+        return ("semanticPolicies.add does nothing in a cloud policy: Jev reads semantic checks only "
+                "from a failproofai pack. Remove it to publish the rest, or ship the file with "
+                "`failproofai publish`.")
+    # Every registration: any of them can carry a reviewable declaration.
+    at = _find_call(source, _ADD_CALL)
+    while at != -1:
+        if _direct_props(source, at).get("authority") == "reviewable":
+            return ("a cloud policy is always hard, so Jev never clears it and authority/reviewedBy "
+                    "are ignored. Remove them to publish it as a hard policy.")
+        at = _find_call(source, _ADD_CALL, at + len(_ADD))
+    return None

package/.next/standalone/fp-cloud-cli/skill/references/commands.md

@@ -222,7 +222,7 @@ Cloud-managed enforcement, split the way the dashboard splits it: `policies` wri
 ### policies
 - `policies list` — one row per published VERSION (versions are immutable and all stay addressable), newest of each policy first; the title counts distinct policies and captions the version total. `state` is active / disabled / archived. JSON `{policies:[…]}` — also every version, so deduplicate on `id` for one row per policy.
 - `policies show <id>` — the NEWEST version, including the full `source`.
-- `policies publish <id> [SOURCE] [--description "…"] [--no-verify]` — mints a **new version**; never edits one. SOURCE is a path, `@path`, `-`, a pipe, or omitted to paste on a TTY (Ctrl-D ends). The source is **parse-checked with node** before it is sent; nothing downstream does this, and a broken policy otherwise fails on the machine at enforcement time. `--no-verify` skips it, and a host without node publishes with a warning rather than a block. **Publishing deploys nothing** — the version is unused until `fleet deploy` puts it on a machine.
+- `policies publish <id> [SOURCE] [--description "…"] [--no-verify]` — mints a **new version**; never edits one. SOURCE is a path, `@path`, `-`, a pipe, or omitted to paste on a TTY (Ctrl-D ends). The source is **parse-checked with node** before it is sent; nothing downstream does this, and a broken policy otherwise fails on the machine at enforcement time. `--no-verify` skips it, and a host without node publishes with a warning rather than a block. A source with Jev fields a cloud policy never reads — `semanticPolicies.add(...)`, or `authority: "reviewable"` on a registration — is refused before sending (**exit 1**, not skipped by `--no-verify`; commented-out code does not count): Jev checks ship in a pack via `failproofai publish`. **Publishing deploys nothing** — the version is unused until `fleet deploy` puts it on a machine.
 - `policies enable <id>` · `policies disable <id> [-y]` — **disable REMOVES the policy from every deployment carrying it**, reissuing each affected machine at a new generation (visible in `fleet history`). `enable` is the exact inverse — it puts the policy back into every deployment it was removed from, reissuing those machines again. Nothing needs redeploying by hand, and `machinesUpdated` in the JSON reports the count for both directions.
 - `policies test [SOURCE] [--tool Bash] [--command "…"] [--file PATH] [--event PreToolUse] [--expect allow|deny|instruct]` — run a policy LOCALLY and print what it decides. Executes the real file (bare `import { deny } from "failproofai"` and all) against a synthetic context; nothing is published, nothing installed. Needs `node`. `--expect` asserts the decision and exits 1 when it differs — a correct `deny` is a PASSING test, so the decision alone never sets the exit code. JSON `{ok, decision, policies:[{name,decision,reason}], expected, met}`; `decision` is the strictest any registered policy returned.
 - `policies compose "<description>" [--out FILE] [--publish ID]` — the assistant drafts policy source from plain English. Prints it and stops by default: a generated policy that deploys itself is one nobody read. `--publish` still syntax-checks first. Needs `policies:write` for BOTH the draft and the publish — `POST /api/agent/compose-policy` is `withAuth("policies:write")`; `agent:use` gates the assistant's other routes and is not checked on this one. The composer has a **30s server-side limit** — a long or vague description simply does not finish, and raising `--timeout` does not help because the cut is not client-side. Retry with something shorter and more specific.

package/.next/standalone/fp-cloud-cli/tests/test_keys_queries.py

@@ -34,6 +34,35 @@ def test_policy_permissions_are_assignable_and_in_presets():
     assert "policies:read" in PRESETS["standard"]
     assert "policies:pull" in PRESETS["admin"]
 
+
+def test_jev_permission_is_assignable_and_in_the_admin_preset_only():
+    from fp_cli.permissions import (
+        ALL_PERMISSIONS,
+        ASSIGNABLE_PERMISSIONS,
+        KEY_ASSIGNABLE_PERMISSIONS,
+        PRESETS,
+    )
+
+    assert "jev:evaluate" in ALL_PERMISSIONS
+    # In the server's declared order: after usage:read, and orgs:admin stays last.
+    assert ALL_PERMISSIONS.index("jev:evaluate") == ALL_PERMISSIONS.index("usage:read") + 1
+    assert ALL_PERMISSIONS[-1] == "orgs:admin"
+    # A machine key carries it, so it is grantable to a key as well as a member.
+    assert "jev:evaluate" in ASSIGNABLE_PERMISSIONS
+    assert "jev:evaluate" in KEY_ASSIGNABLE_PERMISSIONS
+    # The server's built-in admin set carries it; nothing narrower does.
+    assert "jev:evaluate" in PRESETS["admin"]
+    assert "jev:evaluate" not in PRESETS["read-only"]
+    assert "jev:evaluate" not in PRESETS["standard"]
+    # And the admin preset can be granted to a key: it carries both permissions
+    # the server requires beside jev:evaluate.
+    assert {"events:add", "policies:pull"} <= set(PRESETS["admin"])
+
+
+def test_parse_permissions_accepts_jev_evaluate():
+    assert _parse_permissions(["events:add policies:pull jev:evaluate"]) == [
+        "events:add", "policies:pull", "jev:evaluate"]
+
 BASE = "http://dash.test"
 
 
@@ -111,6 +140,42 @@ def test_keys_create_rejects_malformed_token(logged_in, runner):
     assert runner.invoke(app, ["keys", "create", "k", "--add", "events:"]).exit_code == 2
 
 
+@respx.mock
+def test_keys_create_machine_preset(logged_in, runner):
+    # The dashboard's key-only `machine` preset: collect, pull policy, Jev.
+    respx.get(f"{BASE}/api/keys").mock(return_value=httpx.Response(200, json=[]))
+    respx.get(f"{BASE}/api/permission-sets").mock(return_value=httpx.Response(200, json=[]))
+    route = respx.post(f"{BASE}/api/keys").mock(
+        return_value=httpx.Response(201, json={"id": "k9", "name": "m", "permissions": [], "created_at": "t"})
+    )
+    result = runner.invoke(app, ["--json", "keys", "create", "m", "--permission-set", "machine"])
+    assert result.exit_code == 0, result.output
+    assert json.loads(route.calls.last.request.content)["permissions"] == ["events:add", "jev:evaluate", "policies:pull"]
+
+
+@respx.mock
+def test_keys_create_refuses_jev_without_its_prerequisites(logged_in, runner):
+    # The server's 422 (JEV_REQUIRES), said before anything is sent.
+    respx.get(f"{BASE}/api/keys").mock(return_value=httpx.Response(200, json=[]))
+    route = respx.post(f"{BASE}/api/keys").mock(return_value=httpx.Response(201, json={}))
+    result = runner.invoke(app, ["--json", "keys", "create", "k", "--add", "jev:evaluate,events:add"])
+    assert result.exit_code == 2, result.output
+    assert "missing: policies:pull" in json.loads(result.stdout)["error"]
+    assert not route.called
+
+
+@respx.mock
+def test_keys_update_refuses_dropping_a_jev_prerequisite(logged_in, runner):
+    respx.get(f"{BASE}/api/keys").mock(return_value=httpx.Response(200, json=[
+        {"id": "k1", "name": "m", "permissions": ["events:add", "jev:evaluate", "policies:pull"],
+         "created_at": "t", "revoked_at": None}]))
+    route = respx.patch(f"{BASE}/api/keys/k1").mock(return_value=httpx.Response(200, json={}))
+    result = runner.invoke(app, ["--json", "keys", "update", "m", "--remove", "events:add", "--yes"])
+    assert result.exit_code == 2, result.output
+    assert "missing: events:add" in json.loads(result.stdout)["error"]
+    assert not route.called
+
+
 @respx.mock
 def test_keys_create_name_collision(logged_in, runner):
     respx.get(f"{BASE}/api/keys").mock(return_value=httpx.Response(200, json=[

package/.next/standalone/fp-cloud-cli/tests/test_policy_check.py

@@ -189,3 +189,64 @@ def test_parsing_and_executing_have_separate_budgets():
 
     assert policy_check._TIMEOUT_SECS == 5
     assert policy_check._SYNTAX_TIMEOUT_SECS > policy_check._TIMEOUT_SECS
+
+
+# ── Jev fields a cloud policy never reads ────────────────────────────────────
+#
+# `semanticPolicies.add` is read only from a pack built by `failproofai publish`,
+# and a cloud policy's authority comes from its deployment record, which never
+# sets it — so both publish as a version that reads Jev-aware and is not. The
+# dashboard refuses them (agenteye `dashboard/lib/policies/policyMeta.ts`,
+# `cloudPublishProblem`); the server never reads the source. These cases are the
+# dashboard's own, so the two surfaces agree on what counts.
+
+JEV_BASE = '''import { customPolicies, allow } from "failproofai";
+
+customPolicies.add({
+  name: "block-wrong-jira-project",
+  description: "Deny Jira writes outside the configured project",
+  match: { events: ["PreToolUse"] },
+  fn: async (ctx) => allow(),
+});
+'''
+_SECOND = JEV_BASE.split("\n", 1)[1].replace("match:", 'authority: "reviewable",\n  match:')
+
+
+@pytest.mark.parametrize("src,needle", [
+    (JEV_BASE, None),
+    (JEV_BASE + '\nsemanticPolicies.add({ name: "db-migration-on-production" });\n', "failproofai pack"),
+    (JEV_BASE.replace("match:", 'authority: "reviewable", reviewedBy: ["destructive-deletion"],\n  match:'),
+     "always hard"),
+    ('// semanticPolicies.add({ name: "later" })\n' + JEV_BASE, None),
+    ('/* customPolicies.add({ authority: "reviewable" }) */\n' + JEV_BASE, None),
+    ('const s = "semanticPolicies.add(";\n' + JEV_BASE, None),
+    (JEV_BASE.replace("allow()", 'allow("authority: reviewable")'), None),
+    (JEV_BASE + '\nsemanticPolicies\n  .add ({ name: "db-migration-on-production" });\n', "failproofai pack"),
+    (JEV_BASE + "\n" + _SECOND, "always hard"),
+], ids=["plain", "semantic", "reviewable", "commented-semantic", "commented-reviewable",
+        "string-literal", "nested-text", "split-spelling", "later-registration"])
+def test_jev_fields_are_refused_the_way_the_dashboard_refuses_them(src, needle):
+    from fp_cli.policy_check import cloud_publish_problem
+
+    problem = cloud_publish_problem(src)
+    if needle is None:
+        assert problem is None
+    else:
+        assert problem and needle in problem
+
+
+def test_publish_refuses_jev_fields_before_anything_is_sent(monkeypatch):
+    """Both `policies publish` and `policies compose --publish` route through
+    `client.publish_policy`, so the refusal lives there — and must fire before
+    the POST, whatever `--no-verify` said about the syntax check."""
+    from fp_cli import client
+    from fp_cli.errors import ApiError
+
+    def _no_post(*a, **kw):
+        raise AssertionError("a refused source reached the server")
+
+    monkeypatch.setattr(client, "_post_json", _no_post)
+    src = JEV_BASE + '\nsemanticPolicies.add({ name: "db-migration-on-production" });\n'
+    with pytest.raises(ApiError) as exc:
+        client.publish_policy(None, "p", src)
+    assert "failproofai publish" in str(exc.value) + (exc.value.hint or "")