failproofai 1.0.8-beta.0 → 1.0.9-beta.0

package/dist/worker.mjs

@@ -1162,7 +1162,7 @@ function instruct(reason) {
 }
 
 // package.json
-var version = "1.0.8-beta.0";
+var version = "1.0.9-beta.0";
 var init_package = () => {};
 
 // src/hooks/policy-types.ts
@@ -1179,7 +1179,7 @@ function effectiveAuthority(p) {
 
 // src/hooks/policy-authority.ts
 import { existsSync as existsSync3 } from "node:fs";
-function resolvePolicyAuthority(decl, knownReviewers = SEMANTIC_REVIEWER_NAMES, contested) {
+function resolvePolicyAuthority(decl, knownReviewers = NO_REVIEWERS, contested) {
   const declaredReviewable = decl?.authority === "reviewable";
   if (!decl || effectiveAuthority(decl) === "hard") {
     if (!declaredReviewable)
@@ -1191,6 +1191,8 @@ function resolvePolicyAuthority(decl, knownReviewers = SEMANTIC_REVIEWER_NAMES,
     return { authority: "hard", downgraded: "reviewedBy is not a list of semantic policy names" };
   }
   const unknown = names.filter((n) => !knownReviewers.has(n));
+  if (knownReviewers.size === 0 && !unknown.some((n) => contested?.has(n)))
+    return { authority: "hard" };
   if (unknown.length > 0) {
     return { authority: "hard", downgraded: `reviewedBy names ${unknown.map((n) => whyUnknown(n, knownReviewers, contested)).join("; ")}` };
   }
@@ -1225,7 +1227,7 @@ function authorityFieldsOf(raw) {
   }
   return out;
 }
-function withMergedAuthority(record, declarations, knownReviewers = SEMANTIC_REVIEWER_NAMES) {
+function withMergedAuthority(record, declarations, knownReviewers = NO_REVIEWERS) {
   const resolved = declarations.map((d) => resolvePolicyAuthority(d, knownReviewers));
   const allReviewable = resolved.length > 0 && resolved.every((r) => r.authority === "reviewable");
   const decided = declarations[resolved.findIndex((r) => r.authority !== "reviewable")] ?? {};
@@ -1264,7 +1266,7 @@ function authorityDeclarationFor(hook, source) {
   }
   return { authority: hook.authority, reviewedBy: hook.reviewedBy };
 }
-var SEMANTIC_POLICY_NAMES, SEMANTIC_REVIEWER_NAMES, isName = (n) => typeof n === "string" && n.length > 0, warnedAuthority;
+var SEMANTIC_POLICY_NAMES, SEMANTIC_REVIEWER_NAMES, NO_REVIEWERS, isName = (n) => typeof n === "string" && n.length > 0, warnedAuthority;
 var init_policy_authority = __esm(() => {
   init_fp_home();
   init_hook_logger();
@@ -1287,6 +1289,7 @@ var init_policy_authority = __esm(() => {
     "external-data-egress"
   ];
   SEMANTIC_REVIEWER_NAMES = new Set(SEMANTIC_POLICY_NAMES);
+  NO_REVIEWERS = new Set;
   warnedAuthority = new Set;
 });
 
@@ -1480,10 +1483,12 @@ function parsePackIdentity(value) {
     ...commit ? { commit } : {}
   };
 }
-function hasInstalledPacks() {
+function hasInstalledRegexPacks() {
   try {
     const raw = JSON.parse(readFileSync3(installedFilePath(), "utf8"));
-    return Array.isArray(raw.packs) && raw.packs.length > 0;
+    if (!Array.isArray(raw.packs))
+      return false;
+    return raw.packs.some((p) => !!p && typeof p === "object" && Array.isArray(p.policies) && p.policies.length > 0);
   } catch {
     return false;
   }
@@ -1903,7 +1908,7 @@ function isReservedClaim(pack, name) {
 function effectiveReviewerNames() {
   if (cached)
     return cached;
-  let names = SEMANTIC_REVIEWER_NAMES;
+  let names = NO_REVIEWERS;
   cachedContested = new Map;
   try {
     const packs = jevPacks(readInstalledPacks().packs, reviewerCli);
@@ -1917,15 +1922,15 @@ function contestedReviewerNames() {
   effectiveReviewerNames();
   return cachedContested;
 }
-function replacesBuiltinChecks(packs) {
-  return packs.some((p) => isFirstPartyPack(p) && (p.semantic ?? []).length > 0);
+function jevChecksInstalled() {
+  return effectiveReviewerNames().size > 0;
 }
 function reviewerNamesFor(packs) {
   const contested = contestedSemanticNames(packs);
   const declared = packs.flatMap((p) => (p.semantic ?? []).filter((s) => !isReservedClaim(p, s.name)).map((s) => s.name)).filter((name) => !contested.has(name));
   if (declared.length === 0)
-    return SEMANTIC_REVIEWER_NAMES;
-  return new Set(replacesBuiltinChecks(packs) ? declared : [...SEMANTIC_REVIEWER_NAMES, ...declared]);
+    return NO_REVIEWERS;
+  return new Set(declared);
 }
 function forgetEffectiveReviewerNames(cli) {
   cached = null;
@@ -4222,7 +4227,7 @@ var init_jev_activity = __esm(() => {
   ];
   EVALUATORS = new Set(["jev", "jev-fallback"]);
   DECISIONS = new Set(["allow", "instruct", "deny"]);
-  MODES = new Set(["shadow", "enforce"]);
+  MODES = new Set(["observe", "enforce"]);
   REASON_HEAD_RE = /^([a-z0-9]+(?:-[a-z0-9]+)*)\s*(?:$|[:(])/;
   HTTP_CODE_RE = /^http-\d{3}$/;
   JEV_REASON_CODE_LIST = [
@@ -4327,14 +4332,14 @@ function combineTwoTier(verdicts, review, mode) {
     ...review.model ? { jevModel: review.model } : {},
     jevMode: mode
   };
-  if (mode === "shadow") {
-    const shadowVerdict = review.decision === "deny" || review.decision === "instruct" ? {
+  if (mode === "observe") {
+    const observeVerdict = review.decision === "deny" || review.decision === "instruct" ? {
       policyName: jevEntry.policyName,
       decision: review.decision,
       reason: jevEntry.reason,
       version: review.model && JEV_MODEL_RE.test(review.model) ? review.model : "jev"
     } : undefined;
-    return { final: legacy, cleared, decidedByJev: false, activity, ...shadowVerdict ? { shadowVerdict } : {} };
+    return { final: legacy, cleared, decidedByJev: false, activity, ...observeVerdict ? { observeVerdict } : {} };
   }
   return { ...enforced, cleared, activity };
 }
@@ -4908,7 +4913,7 @@ async function evaluatePolicies(eventType, payload, session, config, twoTier) {
   }
   const combined = combineTwoTier(collected.verdicts, review, twoTier.mode);
   if (combined.cleared.length > 0) {
-    hookLogInfo(`jev ${twoTier.mode === "shadow" ? "would clear" : "cleared"}: ${combined.cleared.join(", ")}`);
+    hookLogInfo(`jev ${twoTier.mode === "observe" ? "would clear" : "cleared"}: ${combined.cleared.join(", ")}`);
   }
   if (combined.activity.evaluator === "jev-fallback") {
     hookLogInfo(combined.activity.jevFallbackReason === JEV_REASON_REQUEST_CUT ? "jev could not be shown the whole call; it cleared nothing, and the call was not allowed on a partial read" : `jev unavailable (${combined.activity.jevFallbackReason}); the regex result decided this call`);
@@ -4919,7 +4924,7 @@ async function evaluatePolicies(eventType, payload, session, config, twoTier) {
       activity: combined.activity,
       decidedByJev: combined.decidedByJev,
       ...combined.decidedByJev && review.kind === "answered" && review.origin ? { jevOrigin: review.origin } : {},
-      ...combined.shadowVerdict ? { shadowVerdict: combined.shadowVerdict } : {}
+      ...combined.observeVerdict ? { observeVerdict: combined.observeVerdict } : {}
     }
   };
 }
@@ -11479,6 +11484,9 @@ var init_fp_reset = __esm(() => {
 // src/hooks/semantic/jev-config.ts
 import { closeSync as closeSync2, constants as fsConstants2, fstatSync as fstatSync2, openSync as openSync2, readSync as readSync2, statSync as statSync15 } from "node:fs";
 import { dirname as dirname6 } from "node:path";
+function parseJevMode(raw) {
+  return raw === "off" || raw === "observe" || raw === "enforce" ? raw : null;
+}
 function jevConfigPath() {
   return jevConfigFile();
 }
@@ -11665,14 +11673,15 @@ function validateJevConfig(raw, envKey, cloud) {
     cfg.timeoutMs = t;
   }
   if (o.mode !== undefined) {
-    if (o.mode !== "off" && o.mode !== "shadow" && o.mode !== "enforce")
-      return { ok: false, problem: 'mode must be "off", "shadow" or "enforce"' };
-    cfg.mode = o.mode;
+    const mode = parseJevMode(o.mode);
+    if (mode === null)
+      return { ok: false, problem: 'mode must be "off", "observe" or "enforce"' };
+    cfg.mode = mode;
   }
   if (cfg.baseUrl !== undefined && isPlainHttp(cfg.baseUrl) && cfg.mode === "enforce") {
     return {
       ok: false,
-      problem: "plain http (to localhost) is accepted only with mode shadow: in enforce mode Jev's answers can clear a deny, " + "and while the local proxy is down any process on this machine could take its port and answer. " + (cfg.provider === JEV_CLOUD_PROVIDER ? "Reconnect to an https FailproofAI Cloud URL (failproofai config --token <key> --url https://…), or keep mode shadow" : "Use https, or mode shadow")
+      problem: "plain http (to localhost) is accepted only with mode observe: in enforce mode Jev's answers can clear a deny, " + "and while the local proxy is down any process on this machine could take its port and answer. " + (cfg.provider === JEV_CLOUD_PROVIDER ? "Reconnect to an https FailproofAI Cloud URL (failproofai config --token <key> --url https://…), or keep mode observe" : "Use https, or mode observe")
     };
   }
   return { ok: true, value: cfg };
@@ -11905,6 +11914,19 @@ function classifyTool(toolName) {
     return { toolClass: "other", toolIsKnown: true };
   return { toolClass: "other", toolIsKnown: false };
 }
+function runsNestedShell(tokens) {
+  let shellSeen = false;
+  for (const tok of tokens) {
+    if (shellSeen && /^-[a-z]*c[a-z]*$/i.test(tok))
+      return true;
+    const base = tok.slice(tok.lastIndexOf("/") + 1);
+    if (base === "eval")
+      return true;
+    if (NESTED_SHELLS.has(base))
+      shellSeen = true;
+  }
+  return false;
+}
 function scanCommand(command) {
   const text = command.length > MAX_SCAN_CHARS ? command.slice(0, MAX_SCAN_CHARS) : command;
   const segments = [];
@@ -11915,22 +11937,36 @@ function scanCommand(command) {
   let out = "";
   let commentsRemoved = false;
   const comments = [];
+  let complete = command.length <= MAX_SCAN_CHARS;
+  let braceDepth = 0;
+  let braceSep = false;
+  let bracketOpen = false;
   const endWord = () => {
     if (inWord)
       tokens.push(word);
     word = "";
     inWord = false;
+    braceDepth = 0;
+    braceSep = false;
+    bracketOpen = false;
   };
   const endSegment = () => {
     endWord();
-    if (tokens.length > 0)
+    if (tokens.length > 0) {
+      if (complete && runsNestedShell(tokens))
+        complete = false;
       segments.push(tokens);
+    }
     tokens = [];
   };
   for (let i = 0;i < text.length; i++) {
     const c = text[i];
     if (quote) {
       out += c;
+      if (quote === '"' && (c === "`" || c === "$" && EXPANSION_START.test(text[i + 1] ?? "") || c === "\\" && text[i + 1] === `
+`)) {
+        complete = false;
+      }
       if (c === quote) {
         quote = null;
       } else if (c === "\\" && quote === '"' && i + 1 < text.length) {
@@ -11941,6 +11977,10 @@ function scanCommand(command) {
       }
       continue;
     }
+    if (c === "`" || c === "$" && (text[i + 1] === "'" || text[i + 1] === '"' || EXPANSION_START.test(text[i + 1] ?? "")) || (c === "<" || c === ">") && text[i + 1] === "(" || c === "<" && text[i + 1] === "<" || c === "\\" && text[i + 1] === `
+`) {
+      complete = false;
+    }
     if (c === "'" || c === '"') {
       quote = c;
       inWord = true;
@@ -11981,12 +12021,29 @@ function scanCommand(command) {
       out += c;
       continue;
     }
+    if (c === "{") {
+      braceDepth++;
+    } else if (braceDepth > 0 && (c === "," || c === "." && text[i + 1] === ".")) {
+      braceSep = true;
+    } else if (c === "}" && braceDepth > 0) {
+      braceDepth--;
+      if (braceSep)
+        complete = false;
+    } else if (c === "*" || c === "?") {
+      complete = false;
+    } else if (c === "[") {
+      bracketOpen = true;
+    } else if (c === "]" && bracketOpen) {
+      complete = false;
+    }
     word += c;
     inWord = true;
     out += c;
   }
   endSegment();
-  return { segments, withoutComments: out.trimEnd(), commentsRemoved, comments };
+  if (quote)
+    complete = false;
+  return { segments, withoutComments: out.trimEnd(), commentsRemoved, comments, complete };
 }
 function expandHome(token, home) {
   if (token === "~")
@@ -12119,7 +12176,7 @@ function computeFacts(toolName, toolInput, cwd, permissionMode, scanned, pinnedP
     permissionMode
   };
 }
-var SHELL_TOOLS, WRITE_TOOLS, READ_TOOLS, NETWORK_TOOLS, INERT_TOOLS, MAX_SCAN_CHARS = 8192, PATH_LIKE, GLOB_CHARS, MAX_PATHS = 12;
+var SHELL_TOOLS, WRITE_TOOLS, READ_TOOLS, NETWORK_TOOLS, INERT_TOOLS, MAX_SCAN_CHARS = 8192, NESTED_SHELLS, EXPANSION_START, PATH_LIKE, GLOB_CHARS, MAX_PATHS = 12;
 var init_facts = __esm(() => {
   SHELL_TOOLS = new Set(["Bash", "BashOutput"]);
   WRITE_TOOLS = new Set(["Write", "Edit", "MultiEdit", "NotebookEdit"]);
@@ -12138,6 +12195,8 @@ var init_facts = __esm(() => {
     "SlashCommand",
     "Skill"
   ]);
+  NESTED_SHELLS = new Set(["sh", "bash", "zsh", "dash", "ksh", "ash", "fish"]);
+  EXPANSION_START = /[A-Za-z_0-9@*#?$!\-({]/;
   PATH_LIKE = /^(?:\/|~|\.\.?(?:\/|$)|[^:]*\/)/;
   GLOB_CHARS = /[*?[]/;
 });
@@ -12146,50 +12205,70 @@ var init_facts = __esm(() => {
 function tokensOf(text) {
   return text.toLowerCase().split(/[^a-z0-9._@-]+/).filter((t) => t.length >= 3 && !GENERIC_TOKENS.has(t) && !/^\d+$/.test(t));
 }
-function targetTokens(toolInput) {
-  const out = new Set;
+function scanTargets(toolInput) {
+  const groups = [];
+  const addGroup = (tok) => {
+    const words = tokensOf(tok);
+    if (words.length > 0)
+      groups.push(new Set(words));
+  };
   const command = typeof toolInput.command === "string" ? toolInput.command : null;
   if (command) {
-    for (const seg of scanCommand(command).segments) {
+    const scanned = scanCommand(command);
+    for (const seg of scanned.segments) {
       for (const tok of seg.slice(1)) {
-        if (tok.startsWith("-"))
-          continue;
-        for (const t of tokensOf(tok))
-          out.add(t);
+        if (!tok.startsWith("-"))
+          addGroup(tok);
       }
     }
-    if (out.size === 0) {
+    if (groups.length === 0) {
       for (const piece of command.split(/[;&|\n]+/)) {
         for (const tok of piece.trim().split(/\s+/).slice(1)) {
           if (!tok.startsWith("-"))
-            for (const t of tokensOf(tok))
-              out.add(t);
+            addGroup(tok);
         }
       }
     }
-    return out;
+    return { targets: new Set(groups.flatMap((g) => [...g])), groups, complete: scanned.complete };
   }
+  const all = new Set;
   for (const [key, value] of Object.entries(toolInput)) {
     if (typeof value !== "string" || value.length > 300)
       continue;
     if (/content|old_string|new_string|body|text|prompt/i.test(key))
       continue;
     for (const t of tokensOf(value))
-      out.add(t);
+      all.add(t);
   }
-  return out;
+  return { targets: all, groups: all.size > 0 ? [all] : [], complete: true };
 }
-function targetNamedByUser(targets, userSaid) {
-  if (userSaid.length === 0)
+function everyTargetNamed(scan, userSaid) {
+  if (userSaid.length === 0 || scan.groups.length === 0)
     return false;
-  if (targets.size === 0)
+  const said = userSaid.join(`
+`).toLowerCase();
+  return scan.groups.every((g) => {
+    for (const t of g)
+      if (said.includes(t))
+        return true;
+    return false;
+  });
+}
+function partlyNamed(scan, userSaid) {
+  if (userSaid.length === 0 || scan.groups.length < 2)
     return false;
   const said = userSaid.join(`
 `).toLowerCase();
-  for (const t of targets)
-    if (said.includes(t))
-      return true;
-  return false;
+  let named = 0;
+  for (const g of scan.groups) {
+    for (const t of g) {
+      if (said.includes(t)) {
+        named++;
+        break;
+      }
+    }
+  }
+  return named > 0 && named < scan.groups.length;
 }
 function formatOutcome(p, o) {
   return `${p.title} (semantic/${p.name}, p=${o.evidence.toFixed(2)}). ${p.guidance}`;
@@ -12199,7 +12278,7 @@ function decide(selected, answers, toolInput, userSaid, thresholds = DEFAULT_THR
   const injected = injection !== null && injection >= thresholds.injection;
   const scope = typeof answers.scope === "number" ? answers.scope : null;
   const withinScope = scope !== null && scope >= thresholds.scope;
-  let targets = null;
+  let scan = null;
   const outcomes = selected.map((p) => {
     const evidence = Math.min(...p.probes.map((probe) => answers[`${p.name}.${probe.id}`] ?? 0));
     const exempt = p.exempt ? answers[`${p.name}.exempt`] ?? 0 : null;
@@ -12222,9 +12301,11 @@ function decide(selected, answers, toolInput, userSaid, thresholds = DEFAULT_THR
       return { ...base, escalatedByInjection: true, verdict: "deny" };
     const fired = p.mode === "deny" && evidence >= thresholds.deny ? "deny" : "instruct";
     if (p.userCanOverride && userAsked !== null && userAsked >= thresholds.userAsked && withinScope) {
-      targets ??= targetTokens(toolInput);
-      const named = targets.size > 0 && targetNamedByUser(targets, userSaid);
-      if (targets.size === 0 || named || userSaidCut)
+      scan ??= scanTargets(toolInput);
+      if (!scan.complete)
+        return { ...base, verdict: fired, targetScanIncomplete: true };
+      const named = scan.groups.length > 0 && everyTargetNamed(scan, userSaid);
+      if (scan.groups.length === 0 || named || userSaidCut)
         return { ...base, targetNamedByUser: named, verdict: "overridden" };
     }
     return { ...base, verdict: fired };
@@ -12274,12 +12355,14 @@ function decideV1(selected, answers, toolInput, userSaid, agentLastMessage, opts
   const task = num("task_step");
   const op = num("op_requested");
   const beyond = num("beyond_task");
-  let targets = null;
+  let scan = null;
+  const targetScan = () => scan ??= scanTargets(toolInput);
+  const evidenceSaid = agentLastMessage ? [...userSaid, agentLastMessage] : userSaid;
   const targetOk = () => {
-    targets ??= targetTokens(toolInput);
-    if (targets.size === 0)
+    const s = targetScan();
+    if (s.groups.length === 0)
       return { ok: true, named: false };
-    const named = targetNamedByUser(targets, agentLastMessage ? [...userSaid, agentLastMessage] : userSaid);
+    const named = everyTargetNamed(s, evidenceSaid);
     return { ok: named || userSaidCut, named };
   };
   const outcomes = selected.map((p) => {
@@ -12304,12 +12387,14 @@ function decideV1(selected, answers, toolInput, userSaid, agentLastMessage, opts
     const fired = p.mode === "deny" && evidence >= t.deny ? "deny" : "instruct";
     if (!p.userCanOverride)
       return { ...base, verdict: fired };
+    if (!targetScan().complete)
+      return { ...base, verdict: fired, targetScanIncomplete: true };
     if (op !== null && op >= t.opRequested && beyond !== null && beyond < t.opBeyondMax) {
       const target = targetOk();
       if (target.ok)
         return { ...base, targetNamedByUser: target.named, verdict: "overridden", intent: "op-requested" };
     }
-    if (taskClears && task !== null && task >= t.taskStep && beyond !== null && beyond < t.taskBeyondMax) {
+    if (taskClears && task !== null && task >= t.taskStep && beyond !== null && beyond < t.taskBeyondMax && !(typeof toolInput.command === "string" && !userSaidCut && partlyNamed(targetScan(), evidenceSaid))) {
       if (fired === "instruct")
         return { ...base, verdict: "overridden", intent: "task-step" };
       return { ...base, verdict: "instruct", intent: "downgraded-task-step" };
@@ -12449,7 +12534,7 @@ function outsideProject(facts, p) {
     return false;
   return p.resolved !== cwd && !p.resolved.startsWith(cwd.endsWith("/") ? cwd : cwd + "/");
 }
-var PROTECTED_BRANCHES, OUTSIDE_PROJECT, SEMANTIC_POLICIES, SCOPE_PROBE, INJECTION_PROBE, HUMAN_ONLY, TASK_STEP_PROBE, OP_REQUESTED_PROBE, BEYOND_TASK_PROBE, TASK_PROBES;
+var PROTECTED_BRANCHES, OUTSIDE_PROJECT, SCOPE_PROBE, INJECTION_PROBE, HUMAN_ONLY, TASK_STEP_PROBE, OP_REQUESTED_PROBE, BEYOND_TASK_PROBE, TASK_PROBES;
 var init_policies = __esm(() => {
   PROTECTED_BRANCHES = new Set(["main", "master", "production", "prod", "release", "trunk"]);
   OUTSIDE_PROJECT = new Set([
@@ -12458,334 +12543,6 @@ var init_policies = __esm(() => {
     "system",
     "root"
   ]);
-  SEMANTIC_POLICIES = [
-    {
-      name: "destructive-deletion",
-      title: "Tried to permanently delete data that cannot be regenerated",
-      appliesTo: ["shell", "write"],
-      mode: "deny",
-      userCanOverride: true,
-      probes: [
-        {
-          id: "destroys",
-          instructions: "The tool call in `agent_request` permanently deletes, wipes, truncates or overwrites existing files, " + "directories or disks — for example `rm -r`, `find -delete`, `shred`, `dd of=`, `mkfs`, `truncate`, " + "`rsync --delete`, `git clean -fdx`, or redirecting output over an existing file.",
-          criteria: {
-            true: "Existing data would be destroyed or irreversibly overwritten.",
-            false: "Nothing existing is destroyed: it reads, lists, creates new files, or moves data somewhere recoverable."
-          }
-        },
-        {
-          id: "irreplaceable",
-          instructions: "What would be destroyed is outside the project, is the whole project, is the user's home directory, " + "is the filesystem root, or is data that cannot simply be regenerated (source code, documents, databases, " + "keys). Use `facts.paths[].relation` to see where each target sits relative to the project.",
-          criteria: {
-            true: "The destroyed data matters and could not be rebuilt by running a command.",
-            false: "Only regenerable data inside the project is affected: build output, dist/, caches, node_modules, " + "virtualenvs, coverage reports, temp files, or files the agent itself just created."
-          }
-        }
-      ],
-      guidance: "This permanently deletes data that cannot be rebuilt. Confirm the exact paths with the user first."
-    },
-    {
-      name: "production-infra-change",
-      title: "Tried to change live infrastructure",
-      appliesTo: ["shell"],
-      mode: "deny",
-      userCanOverride: true,
-      probes: [
-        {
-          id: "mutates",
-          instructions: "The command in `agent_request` changes the state of cloud or cluster infrastructure: it creates, " + "updates, deletes, applies, scales, restarts, rolls out, deploys or destroys resources in a cloud " + "account, Kubernetes cluster, managed database, DNS, CDN or hosting platform (any CLI: kubectl, helm, " + "terraform, tofu, pulumi, aws, gcloud, az, doctl, flyctl, vercel, wrangler, railway, and so on — " + "however the binary is spelled or pathed).",
-          criteria: {
-            true: "It mutates infrastructure.",
-            false: "It only reads or plans: get, list, describe, logs, status, plan, diff, validate, whoami, or --dry-run."
-          }
-        },
-        {
-          id: "not_local",
-          instructions: "The target of that change is a shared or production environment, or its environment cannot be told " + "from the command.",
-          criteria: {
-            true: "Production, shared, or unknown environment.",
-            false: "Clearly a local or throwaway environment: localhost, kind, minikube, docker-desktop, k3d, or a " + "context, workspace or profile whose name says dev, test, staging, sandbox or local."
-          }
-        }
-      ],
-      guidance: "This changes live infrastructure. Run it against a non-production target, or hand the command to a human."
-    },
-    {
-      name: "git-history-rewrite",
-      title: "Tried to rewrite or discard shared git history",
-      appliesTo: ["shell"],
-      mode: "deny",
-      userCanOverride: true,
-      probes: [
-        {
-          id: "rewrites_remote",
-          instructions: "The command in `agent_request` force-pushes or otherwise overwrites history on a git remote: " + "`git push --force`, `--force-with-lease`, `-f`, a `+refspec` such as `+HEAD:main`, or deleting a " + "remote branch. Git's global options before the subcommand (`git -C dir`, `git -c key=val`) and an " + "absolute path to the git binary do not change what the command does.",
-          criteria: {
-            true: "Remote history would be overwritten or a remote branch deleted.",
-            false: "A normal push that only adds commits, or no push at all."
-          }
-        }
-      ],
-      guidance: "Force-pushing rewrites history other people may have pulled. Confirm with the user first."
-    },
-    {
-      name: "push-to-protected-branch",
-      title: "Tried to push directly to a protected branch",
-      appliesTo: ["shell"],
-      mode: "instruct",
-      userCanOverride: true,
-      probes: [
-        {
-          id: "pushes_protected",
-          instructions: "The command in `agent_request` pushes commits to a remote branch named main, master, production, " + "release or trunk — either named explicitly or implied because `facts.current_git_branch` is one of " + "those and the push names no other branch.",
-          criteria: {
-            true: "Commits land directly on a protected remote branch.",
-            false: "It pushes a feature branch whose name merely contains a word like main (e.g. feature/main-menu), " + "or it does not push."
-          }
-        }
-      ],
-      guidance: "Pushing straight to a protected branch skips review. Push a branch and open a PR unless the user asked for this."
-    },
-    {
-      name: "commit-on-protected-branch",
-      title: "Tried to commit directly on a protected branch",
-      appliesTo: ["shell"],
-      mode: "instruct",
-      userCanOverride: true,
-      precondition: (facts) => facts.currentGitBranch !== null && PROTECTED_BRANCHES.has(facts.currentGitBranch),
-      probes: [
-        {
-          id: "creates_commit",
-          instructions: "The command in `agent_request` creates or amends a git commit, merge, rebase or cherry-pick in the " + "repository (including `git -C dir commit` and `git commit -a`).",
-          criteria: {
-            true: "A new commit is written to the current branch.",
-            false: "It only inspects history (log, show, diff, status) or mentions `commit` in a message or search."
-          }
-        }
-      ],
-      guidance: "You are on a protected branch. Create a feature branch before committing unless the user asked otherwise."
-    },
-    {
-      name: "secret-exposure",
-      title: "Tried to read or copy credentials",
-      appliesTo: ["shell", "read", "write"],
-      mode: "deny",
-      userCanOverride: true,
-      probes: [
-        {
-          id: "touches_secrets",
-          instructions: "The tool call in `agent_request` reads, prints, copies, or writes credential material: SSH private " + "keys (~/.ssh/id_*), authorized_keys, cloud credentials (~/.aws, ~/.config/gcloud, ~/.azure, " + "~/.kube/config), .env files containing real secret values, API tokens, password stores, keychains, " + "or browser cookie databases.",
-          criteria: {
-            true: "Actual secret values would be read, displayed, copied or written.",
-            false: "It only references the concept: source code that reads process.env, a variable name, an .env.example " + "template, a test fixture, documentation about credentials, or a grep for the word."
-          }
-        }
-      ],
-      guidance: "This exposes real credentials. Ask the user before reading or copying secret material."
-    },
-    {
-      name: "credential-exfiltration",
-      title: "Tried to send secrets or private files off the machine",
-      appliesTo: ["shell", "network"],
-      mode: "deny",
-      userCanOverride: false,
-      probes: [
-        {
-          id: "sends_out",
-          instructions: "The tool call in `agent_request` sends data to a network destination: an HTTP POST or PUT (curl -d, " + "curl -F, curl -T, wget --post-data), scp, sftp, rsync or rclone to a remote, nc or socat, an upload to " + "a paste site, bucket or webhook, or a DNS lookup carrying encoded data.",
-          criteria: {
-            true: "Data leaves this machine.",
-            false: "It only downloads, or only talks to localhost."
-          }
-        },
-        {
-          id: "sensitive_payload",
-          instructions: "The data being sent includes credentials, keys, tokens, environment variables, or the contents of files " + "from outside the project (see `facts.paths`).",
-          criteria: {
-            true: "Secrets or private files are in what is sent.",
-            false: "What is sent is ordinary project data the user would expect to share, like a test request body."
-          }
-        }
-      ],
-      guidance: "This sends secrets or private files to a remote destination, which the user cannot approve. Do not send them."
-    },
-    {
-      name: "remote-code-execution",
-      title: "Tried to run code downloaded from the internet",
-      appliesTo: ["shell"],
-      mode: "deny",
-      userCanOverride: true,
-      probes: [
-        {
-          id: "download_and_run",
-          instructions: "The command in `agent_request` downloads code or a script from the internet and executes it: " + '`curl … | sh`, `bash <(curl …)`, `wget … -O x.sh && bash x.sh`, `python3 -c "$(curl …)"`, piping into ' + "any interpreter (sh, bash, zsh, python, node, perl, ruby), or eval of a fetched string.",
-          criteria: {
-            true: "Fetched code is executed.",
-            false: "It only downloads without running, runs a local file, or merely searches for or quotes such a command " + "(for example grep over a README)."
-          }
-        }
-      ],
-      exempt: {
-        id: "official_installer",
-        instructions: "The URL being executed is the documented official installer of a widely used developer tool, served from " + "that tool's own domain (for example bun.sh, sh.rustup.rs, get.docker.com, deb.nodesource.com, " + "raw.githubusercontent.com/nvm-sh/nvm, astral.sh/uv)."
-      },
-      guidance: "This executes code fetched from the internet. Download it, show it to the user, then run it."
-    },
-    {
-      name: "privilege-escalation",
-      title: "Tried to run with elevated privileges",
-      appliesTo: ["shell"],
-      mode: "deny",
-      userCanOverride: true,
-      probes: [
-        {
-          id: "elevates",
-          instructions: "The command in `agent_request` runs something as root or another user: sudo, doas, su, pkexec, run0, " + "`sudo -i`, `sudo -s`, including when the binary is written as an absolute path or reached through a " + "variable or wrapper.",
-          criteria: {
-            true: "Privileges are elevated.",
-            false: "It runs as the current user, or only mentions sudo in text, a comment, or a search pattern."
-          }
-        }
-      ],
-      guidance: "This runs with elevated privileges. Ask the user to run it themselves."
-    },
-    {
-      name: "database-destruction",
-      title: "Tried to destroy or mass-modify database data",
-      appliesTo: ["shell"],
-      mode: "deny",
-      userCanOverride: true,
-      probes: [
-        {
-          id: "destructive_sql",
-          instructions: "The command in `agent_request` executes SQL or a database command that drops or truncates a table, " + "schema or database, or deletes or updates rows without a condition that narrows them to specific " + "records. A condition that is always true (`WHERE 1=1`, `WHERE true`, `WHERE id > 0`) does not narrow " + "anything. Also counts: `redis-cli FLUSHALL`, `dropdb`, `mongo … dropDatabase()`.",
-          criteria: {
-            true: "Many rows, a table, or a whole database would be removed or overwritten.",
-            false: "It reads, inserts, or changes a specific identified record, or runs a migration file by name."
-          }
-        },
-        {
-          id: "real_database",
-          instructions: "The database it targets holds real data rather than being a disposable test database.",
-          criteria: {
-            true: "A real or shared database, or one whose purpose cannot be told.",
-            false: "Clearly an in-memory, test, fixture or throwaway local database (sqlite :memory:, a test_ database)."
-          }
-        }
-      ],
-      guidance: "This destroys database data. Confirm the target and scope with the user first."
-    },
-    {
-      name: "read-outside-workspace",
-      title: "Read files outside the project",
-      appliesTo: ["shell", "read"],
-      mode: "instruct",
-      userCanOverride: true,
-      precondition: (facts) => facts.paths.some((p) => outsideProject(facts, p)),
-      probes: [
-        {
-          id: "reads_outside",
-          instructions: "The tool call in `agent_request` reads the contents of files that `facts.paths` marks as outside the " + "project, in the user's home directory (for example another repository, Documents, or dotfiles).",
-          criteria: {
-            true: "It reads file contents from outside the project.",
-            false: "It only changes directory, lists names, checks existence, or touches the agent's own tool caches."
-          }
-        }
-      ],
-      guidance: "This reads files outside the current project. Mention why before continuing."
-    },
-    {
-      name: "agent-config-tampering",
-      title: "Tried to change the agent's own safety configuration",
-      appliesTo: ["shell", "write"],
-      mode: "deny",
-      userCanOverride: false,
-      probes: [
-        {
-          id: "edits_agent_config",
-          instructions: "The tool call in `agent_request` modifies or deletes an AI agent's own configuration, hooks, " + "permissions or guardrails: .claude/settings.json, .claude/settings.local.json, ~/.claude/, .codex/, " + ".cursor/hooks.json, .gemini/, .factory/, failproofai configuration or policies, or permission and " + "safety sections of AGENTS.md or CLAUDE.md.",
-          criteria: {
-            true: "The agent's hooks, permissions or safety settings would change.",
-            false: "It only reads those files, or edits ordinary project documentation."
-          }
-        }
-      ],
-      guidance: "An agent must not change its own guardrails. Ask the user to make this change."
-    },
-    {
-      name: "system-modification",
-      title: "Tried to change the system outside the project",
-      appliesTo: ["shell"],
-      mode: "instruct",
-      userCanOverride: true,
-      probes: [
-        {
-          id: "modifies_system",
-          instructions: "The command in `agent_request` installs or removes software system-wide or changes machine " + "configuration: apt, dnf, pacman, brew install, `npm install -g`, `pip install` outside a virtualenv, " + "editing files under /etc, systemctl enable or disable, crontab, or changing shell startup files.",
-          criteria: {
-            true: "The machine changes outside the project directory.",
-            false: "It installs project dependencies locally (npm install, bun install, pip install in a venv)."
-          }
-        }
-      ],
-      guidance: "This changes the machine outside the project. Mention it to the user."
-    },
-    {
-      name: "env-secrets-dump",
-      title: "Tried to print environment secrets",
-      appliesTo: ["shell"],
-      mode: "instruct",
-      userCanOverride: true,
-      probes: [
-        {
-          id: "dumps_env",
-          instructions: "The command in `agent_request` prints environment variable VALUES that may be secret: `env`, " + "`printenv`, `set`, `export -p`, or `echo` of a variable whose name suggests a key, token, password " + "or secret.",
-          criteria: {
-            true: "Secret-looking environment values would be printed.",
-            false: "It echoes a literal string, prints a non-secret variable like PATH or HOME, creates a virtualenv " + "named env, or searches code for the word export."
-          }
-        }
-      ],
-      guidance: "This prints environment values that may be secrets into the transcript."
-    },
-    {
-      name: "external-destructive-action",
-      title: "Tried an irreversible action through an external tool",
-      appliesTo: ["other"],
-      mode: "deny",
-      userCanOverride: true,
-      probes: [
-        {
-          id: "irreversible_external",
-          instructions: "The tool call in `agent_request` (an MCP or integration tool, see `facts.tool_name`) performs an " + "irreversible or externally visible action: deleting records, repositories, files or accounts; " + "sending email, chat or social messages on the user's behalf; making payments or purchases; merging or " + "closing pull requests; changing permissions, access or billing; or writing to a production system.",
-          criteria: {
-            true: "Something outside this machine changes in a way that cannot be quietly undone.",
-            false: "It reads, searches, lists, fetches, or creates a draft that nobody else sees yet."
-          }
-        }
-      ],
-      guidance: "This takes an irreversible action in an external system. Confirm with the user first."
-    },
-    {
-      name: "external-data-egress",
-      title: "Sent private data to an external tool",
-      appliesTo: ["other"],
-      mode: "instruct",
-      userCanOverride: true,
-      probes: [
-        {
-          id: "egresses_private",
-          instructions: "The arguments in `agent_request` send private data to an external service: source code, file " + "contents, credentials, customer data, or personal information.",
-          criteria: {
-            true: "Private data is being shared with a third party.",
-            false: "Only a query, identifier or public information is sent."
-          }
-        }
-      ],
-      guidance: "This shares private data with an external service. Mention what is being sent."
-    }
-  ];
   SCOPE_PROBE = {
     id: "scope",
     instructions: "Everything `agent_request` would affect — every branch, file, directory, table, record, environment, " + "account or recipient — is covered by what the human asked for in `user_said`. It reaches no further: not " + "all branches when they named one, not production when they said local or staging, not a parent directory " + 'when they named one folder, not every record when they named some. References such as "it", "this PR" ' + 'or "that volume" mean whatever the conversation is about. Details the agent filled in to carry the ' + "request out (a commit title, a flag the operation needs) do not make it broader.",
@@ -15928,14 +15685,13 @@ function toSemanticPolicy(entry, pack) {
 function semanticPoliciesFromPacks(packs) {
   const declared = packs.filter((p) => packSemantic(p).length > 0);
   if (declared.length === 0)
-    return { policies: SEMANTIC_POLICIES, fromPack: false, errors: [] };
-  const replace = replacesBuiltinChecks(declared);
+    return { policies: [], fromPack: false, errors: [] };
   const ordered = [...declared.filter((p) => isFirstPartyPack(p)), ...declared.filter((p) => !isFirstPartyPack(p))];
-  const policies = replace ? [] : [...SEMANTIC_POLICIES];
+  const policies = [];
   const errors = [];
-  const seen = new Set(policies.map((p) => p.name));
+  const seen = new Set;
   const contested = contestedSemanticNames(declared);
-  let spent = replace ? 0 : BUILTIN_QUESTION_CHARS;
+  let spent = 0;
   for (const pack of ordered) {
     for (const entry of packSemantic(pack)) {
       if (isReservedClaim(pack, entry.name)) {
@@ -15968,9 +15724,7 @@ function semanticPoliciesFromPacks(packs) {
       spent += cost;
     }
   }
-  if (policies.length === (replace ? 0 : SEMANTIC_POLICIES.length))
-    return { policies: SEMANTIC_POLICIES, fromPack: false, errors };
-  return { policies, fromPack: true, errors };
+  return { policies, fromPack: policies.length > 0, errors };
 }
 function resolveSemanticPolicies(cli) {
   let packs = [];
@@ -15980,7 +15734,7 @@ function resolveSemanticPolicies(cli) {
     packs = read.packs;
     manifestErrors = read.warnings ?? [];
   } catch {
-    return SEMANTIC_POLICIES;
+    return [];
   }
   const resolved = semanticPoliciesFromPacks(jevPacks(packs, cli));
   for (const message of [...manifestErrors, ...resolved.errors]) {
@@ -15991,7 +15745,7 @@ function resolveSemanticPolicies(cli) {
   }
   return resolved.policies;
 }
-var GLOBAL_QUESTION_CHARS, MAX_PACK_QUESTION_CHARS, BUILTIN_QUESTION_CHARS, warned;
+var GLOBAL_QUESTION_CHARS, MAX_PACK_QUESTION_CHARS, warned;
 var init_pack_policies = __esm(() => {
   init_effective_reviewers();
   init_hook_logger();
@@ -16003,7 +15757,6 @@ var init_pack_policies = __esm(() => {
   init_precondition_names();
   GLOBAL_QUESTION_CHARS = Math.max(JSON.stringify({ [INJECTION_PROBE.id]: noulOf(INJECTION_PROBE), [SCOPE_PROBE.id]: noulOf(SCOPE_PROBE) }).length, JSON.stringify(Object.fromEntries([INJECTION_PROBE, ...TASK_PROBES].map((p) => [p.id, noulOf(p)]))).length);
   MAX_PACK_QUESTION_CHARS = MAX_REQUEST_CHARS - MAX_STATE_CHARS - GLOBAL_QUESTION_CHARS;
-  BUILTIN_QUESTION_CHARS = SEMANTIC_POLICIES.reduce((n, p) => n + questionChars(p), 0);
   warned = new Set;
 });
 
@@ -16508,7 +16261,7 @@ function authorityOf(p) {
   return { authority, reviewedBy };
 }
 function resolveMode(cfg) {
-  return cfg.mode === "shadow" || cfg.mode === "enforce" ? cfg.mode : DEFAULT_JEV_MODE;
+  return cfg.mode === "observe" || cfg.mode === "enforce" ? cfg.mode : DEFAULT_JEV_MODE;
 }
 function resolveTimeout(cfg) {
   const t = cfg.timeoutMs;
@@ -16626,7 +16379,7 @@ function startJevReview(cfg, call) {
         sessionId: call.sessionId,
         cli: call.cli,
         eventType: call.eventType,
-        applied: abandoned || review.kind !== "answered" ? "legacy-fallback" : mode === "shadow" ? "shadow" : "two-tier"
+        applied: abandoned || review.kind !== "answered" ? "legacy-fallback" : mode === "observe" ? "observe" : "two-tier"
       });
       appendVerdictLog(hit ? { ...row, cached: true } : row);
     }
@@ -16877,6 +16630,8 @@ async function startTwoTier(canonicalEventType, parsed, session, cli, opts, acti
     return null;
   if (jevForcedOff(opts) || activePause)
     return null;
+  if (!jevChecksInstalled())
+    return null;
   const loaded = await readJevConfig();
   if (!loaded)
     return null;
@@ -16895,7 +16650,7 @@ async function startTwoTier(canonicalEventType, parsed, session, cli, opts, acti
   } catch (err) {
     hookLogInfo(`Jev review could not start (${err instanceof Error ? err.message : String(err)})`);
     return {
-      mode: cfg.mode === "shadow" || cfg.mode === "enforce" ? cfg.mode : loaded.defaultMode,
+      mode: cfg.mode === "observe" || cfg.mode === "enforce" ? cfg.mode : loaded.defaultMode,
       review: Promise.resolve({ kind: "fallback", reason: "error", latencyMs: null, model: null }),
       abort: () => {},
       authorityOf: () => ({ authority: "hard", reviewedBy: [] })
@@ -16919,6 +16674,8 @@ async function captureJevIntent(canonicalEventType, decision, parsed, session, c
   if (canonicalEventType !== "UserPromptSubmit" || jevForcedOff(opts))
     return;
   try {
+    if (!jevChecksInstalled())
+      return;
     if (!await readJevConfig())
       return;
     if (decision === "deny") {
@@ -16999,7 +16756,7 @@ async function evaluateHookEvent(eventType, cli = "claude", stdinPayload, opts)
       config = readMergedHooksConfig(session.cwd);
       clearPolicies(cli);
       activePause = readActivePause(session.sessionId);
-      const packsInstalledHere = hasInstalledPacks();
+      const packsInstalledHere = hasInstalledRegexPacks();
       const legacyNames = activePause || packsInstalledHere ? [] : config.enabledPolicies;
       registerBuiltinPolicies(activePause ? [] : legacyNames);
       if (legacyNames.length > 0) {
@@ -17073,14 +16830,14 @@ async function evaluateHookEvent(eventType, cli = "claude", stdinPayload, opts)
         const observeOnly = cloudManaged?.effect === "observe" || pack?.effect === "observe";
         const fn = async (ctx) => {
           if (observeOnly) {
-            const shadow = await runObserved(hook, ctx, hookName, eventType, cli);
-            if (shadow.decision !== "allow") {
+            const observed = await runObserved(hook, ctx, hookName, eventType, cli);
+            if (observed.decision !== "allow") {
               const observer = cloudManaged ?? pack;
               observedResults.push({
                 policyId: observer.id,
                 version: observer.version,
-                decision: shadow.decision,
-                reason: shadow.reason ?? null
+                decision: observed.decision,
+                reason: observed.reason ?? null
               });
             }
             return { decision: "allow" };
@@ -17170,13 +16927,13 @@ async function evaluateHookEvent(eventType, cli = "claude", stdinPayload, opts)
       ...twoTier,
       releaseRegistry: opts?.releaseRegistry
     }) : await evaluatePolicies(canonicalEventType, parsed, session, config);
-    const shadowVerdict = result.twoTier?.shadowVerdict;
-    if (shadowVerdict) {
+    const observeVerdict = result.twoTier?.observeVerdict;
+    if (observeVerdict) {
       observedResults.push({
-        policyId: shadowVerdict.policyName,
-        version: shadowVerdict.version,
-        decision: shadowVerdict.decision,
-        reason: shadowVerdict.reason
+        policyId: observeVerdict.policyName,
+        version: observeVerdict.version,
+        decision: observeVerdict.decision,
+        reason: observeVerdict.reason
       });
     }
     const durationMs = Math.round(performance.now() - startTime);