failproofai 1.0.8-beta.0 → 1.0.9-beta.0

package/hermes-plugin/README.md

@@ -21,11 +21,20 @@ Then run:
 failproofai policies --install --cli hermes --scope user
 ```
 
-FailproofAI copies this directory to every discovered profile at
-`<HERMES_HOME>/plugins/failproofai/` and adds `failproofai` to
-`plugins.enabled` in that profile's `config.yaml`. Reinstall replaces only a
-directory carrying `.failproofai-managed`; an unrelated plugin with the same
-directory name is never overwritten.
+The installer symlinks `<HERMES_HOME>/plugins/failproofai` in every discovered
+profile to this directory and adds `failproofai` to `plugins.enabled` in that
+profile's `config.yaml`. Hermes' plugin scan follows the link, so an npm
+upgrade updates the plugin with no reinstall. Where a symlink cannot be
+created, the files are copied instead and marked `.failproofai-managed`.
+Reinstall replaces only such a marked copy or a link into a FailproofAI
+`hermes-plugin/`; an unrelated plugin with the same name is never overwritten.
+Python may write `__pycache__/` here when the package directory is writable;
+it goes with the package on upgrade and is skipped when it cannot be written.
+
+`failproofai update` moves profiles that already use FailproofAI (legacy shell
+hooks or a copied plugin) to the link. Legacy shell hooks never ran for Hermes
+cron jobs, so `update` exits non-zero and keeps the shell hooks when the
+running daemon cannot serve the plugin.
 
 Legacy FailproofAI shell hooks are removed during migration. Operator-owned
 hooks and unrelated plugin settings are preserved. No dashboard deployment or
@@ -118,7 +127,8 @@ untrusted evaluation failures.
 ## Diagnostics and rollback
 
 `failproofai config --status` reports each existing Hermes profile as healthy,
-disabled, incomplete, or duplicated with a legacy shell hook. Hermes-side load
+disabled, incomplete, duplicated with a legacy shell hook, or still on legacy
+shell hooks alone (Hermes cron jobs are not checked). Hermes-side load
 errors are available through:
 
 ```bash
@@ -134,5 +144,5 @@ the integration with:
 failproofai policies --uninstall --cli hermes --scope user
 ```
 
-Uninstall removes the config registration and only the plugin directory marked
-as FailproofAI-managed.
+Uninstall removes the config registration and the profile's link (or marked
+copy); it never removes this package directory.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "failproofai",
-  "version": "1.0.8-beta.0",
+  "version": "1.0.9-beta.0",
   "description": "Observability and enforcement for AI agent harnesses. 40 built-in policies hooked into 12 of them — Claude Code, Codex, Cursor, Hermes, OpenClaw and more — blocking the tool call before it runs. Local dashboard included, no account needed.",
   "bin": {
     "failproofai": "./dist/cli.mjs",
@@ -116,21 +116,21 @@
     "postcss": "8.5.26",
     "eslint-plugin-react-hooks": "7.0.1",
     "vite": "8.0.16",
-    "undici": "7.29.0",
+    "undici": "7.29.1",
     "brace-expansion": "5.0.9",
     "sharp": "0.35.4",
     "browserslist": "4.28.8"
   },
   "optionalDependencies": {
-    "@failproofai/failproofaid-linux-x64": "1.0.8-beta.0",
-    "@failproofai/failproofaid-linux-arm64": "1.0.8-beta.0",
-    "@failproofai/failproofaid-darwin-x64": "1.0.8-beta.0",
-    "@failproofai/failproofaid-darwin-arm64": "1.0.8-beta.0"
+    "@failproofai/failproofaid-linux-x64": "1.0.9-beta.0",
+    "@failproofai/failproofaid-linux-arm64": "1.0.9-beta.0",
+    "@failproofai/failproofaid-darwin-x64": "1.0.9-beta.0",
+    "@failproofai/failproofaid-darwin-arm64": "1.0.9-beta.0"
   },
   "failproofaidBinaries": {
-    "linux-x64": "35b641f60e1724513fbb760db382123dad2b5fcdd67dda6373bda80651bd36bb",
-    "linux-arm64": "a058288f5d08f99612f053793e5c7f59264d3da97f3dbe769e401b0f8536702d",
-    "darwin-x64": "b4f3dbe4aea44e77cc10839647c0dc03a1b8b797dfb27e1d89a6a96554ef27b8",
-    "darwin-arm64": "fd42f28bf92001d39117b488a215578b966f07d316214744aca64a1888f2aed2"
+    "linux-x64": "044b6619007227b8aa1fc1095b8c61a17bd90e11da53183ac1f5adecdcae6839",
+    "linux-arm64": "479450d7d15c52a59bd1a8cf4c7086be9210e8d31ad4f98d99b123f571e944bd",
+    "darwin-x64": "11562912ff726195bfb966ed24a774ffea38d01acc3edc1f9bfa3ea9c298977f",
+    "darwin-arm64": "5bbaee1ec89d2d8032b7f16e502fb96891fbc6aa2ee6c861f43a64a0a60e61ba"
   }
 }

package/scripts/build-policy-pack.mjs

@@ -40,15 +40,12 @@
  * `customPolicies.add`, so a manifest rebuilt from the entry (`failproofai
  * publish`) says the same thing.
  *
- * **It emits no `semantic` array, deliberately.** A pack that declares one
- * REPLACES this build's compiled-in semantic set wholesale
- * (`semantic/pack-policies.ts`), and this pack is the dress rehearsal for the
- * regex floor leaving the package — not for Jev's question set leaving it. So
- * the 39 builtins travel and the 16 semantic policies stay compiled in, which
- * also keeps `manifestAuthority` below judging `reviewedBy` against the right
- * list: the builtin reviewer names, which is what a machine installing this pack
- * will still be running. The separate `FailproofAI/jev-policies` pack is where
- * the semantic half ships, and it declares its own `minCliVersion`.
+ * **It emits no `semantic` array, deliberately.** Jev's sixteen checks ship in
+ * the separate `FailproofAI/jev-policies` pack (the npm package carries none),
+ * which declares its own `minCliVersion`. So `manifestAuthority` below judges
+ * `reviewedBy` against those sixteen NAMES (`SEMANTIC_REVIEWER_NAMES`, its
+ * default): the checks a machine asks once it installs that pack beside this
+ * one. Without it, every policy here registers hard.
  */
 import { execFileSync } from "node:child_process";
 import { createHash } from "node:crypto";

package/src/hooks/cloud-connection.ts

@@ -52,6 +52,7 @@ import {
   PERMISSION_POLICIES,
 } from "./cloud-introspect";
 import type { CloudJevConfigWrite } from "./jev-cloud-connection";
+import { jevChecksDeclared } from "./effective-reviewers";
 import {
   ingestPath,
   validateIngestKey,
@@ -177,7 +178,7 @@ export interface JevConnectOutcome {
    * alone like any existing file (never overwritten), but a connection that
    * asked for decisions only is told that Jev still sends more than that.
    */
-  stillOn?: "shadow" | "enforce";
+  stillOn?: "observe" | "enforce";
   /**
    * Introspect gave no answer about this key's permissions — the server could
    * not be asked (`unreachable`) or predates the endpoint (`unsupported`) — so
@@ -434,13 +435,18 @@ function jevLines(outcome: ConnectOutcome): string[] {
   }
   const config = jev.config;
   if (!config || config.status === "written") {
-    // Plain http (loopback only) is accepted in shadow mode and nowhere else, so
+    // Plain http (loopback only) is accepted in observe mode and nowhere else, so
     // the enforce command would be refused there, by the CLI and the dashboard.
     const plainHttp = config?.status === "written" && new URL(config.baseUrl).protocol === "http:";
     return [
-      `  Jev       on through FailproofAI Cloud, in shadow mode: logged, not enforced (${config?.path ?? "jev.json"}).`,
+      `  Jev       on through FailproofAI Cloud, in observe mode: logged, not enforced (${config?.path ?? "jev.json"}).`,
+      // The package ships no Jev checks, so "on" asks nothing until a pack
+      // gives it some — said here, where the user just turned it on.
+      ...(jevChecksDeclared()
+        ? []
+        : ["            It has no checks installed yet, so it asks nothing. To enable it: `failproofai policies add FailproofAI/jev-policies`."]),
       plainHttp
-        ? "            Enforce needs an https FailproofAI Cloud URL: reconnect with `failproofai config --token <key> --url https://…`. Over plain http Jev stays in shadow mode."
+        ? "            Enforce needs an https FailproofAI Cloud URL: reconnect with `failproofai config --token <key> --url https://…`. Over plain http Jev stays in observe mode."
         : "            Enforce it with `failproofai jev setup --mode enforce`, or from the dashboard.",
     ];
   }
@@ -449,7 +455,7 @@ function jevLines(outcome: ConnectOutcome): string[] {
     if (config.otherOrigin) {
       lines.push(
         config.jevOff?.why === "off"
-          ? `            It points at ${config.otherOrigin} and has Jev switched off (mode off), so Jev is off. To point it here and turn it on: \`failproofai jev setup --provider failproofai --mode shadow\`.`
+          ? `            It points at ${config.otherOrigin} and has Jev switched off (mode off), so Jev is off. To point it here and turn it on: \`failproofai jev setup --provider failproofai --mode observe\`.`
           : `            It points at ${config.otherOrigin}, so Jev stays off until you run \`failproofai jev setup --provider failproofai\`.`,
       );
     } else if (config.jevOff?.why === "refused") {
@@ -457,7 +463,7 @@ function jevLines(outcome: ConnectOutcome): string[] {
         `            It was refused (${config.jevOff.problem}), so Jev is off. ${config.jevOff.fix ? `Fix: \`${config.jevOff.fix}\`.` : "Write a valid one: `failproofai jev setup --provider failproofai`."}`,
       );
     } else if (config.jevOff?.why === "off") {
-      lines.push("            It has Jev switched off (mode off), so Jev is off. To turn it on: `failproofai jev setup --mode shadow`.");
+      lines.push("            It has Jev switched off (mode off), so Jev is off. To turn it on: `failproofai jev setup --mode observe`.");
     }
     if (jev.stillOn) {
       lines.push(

package/src/hooks/custom-hooks-loader.ts

@@ -535,7 +535,7 @@ export async function loadAllCustomHooks(
    * policy reviewable, which is the one thing a manifest may never do.
    *
    * `knownReviewers` is what makes that hold for a pack that ships BOTH tiers.
-   * Judged against the compiled-in set, a `reviewedBy` naming one of the pack's
+   * Judged against any other set, a `reviewedBy` naming one of the pack's
    * own checks is a name nothing here has, so the reviewable entry and its hard
    * peer resolved alike and the merge could not tell them apart — while
    * registration, which reads the manifest's own checks, honoured it. The set

package/src/hooks/effective-reviewers.ts

@@ -1,20 +1,16 @@
 /**
  * The semantic checks a `reviewedBy` may name ON THIS MACHINE.
  *
- * ## Why this is not simply `SEMANTIC_REVIEWER_NAMES`
- *
- * A pack that declares its own `semantic` entries replaces the compiled-in
- * `SEMANTIC_POLICIES` wholesale (`semantic/pack-policies.ts`). So on that
- * machine the sixteen builtin names are checks that will never be asked, and the
- * pack's own names are the only ones that will — while
- * `resolvePolicyAuthority`, judging against the builtin set, would read the
- * pack's `reviewedBy: ["its-own-check"]` as naming a check "this build does not
- * have" and downgrade the policy to `hard` with nothing but a warning in the
- * hook log. That is a rewritten policy set arriving with its reviewability
- * quietly removed: the deny half of the two-tier evaluator working exactly as
- * documented while the clearing half cannot fire once — the failure
- * `policy-reviewability.ts` was written to make audible, reintroduced one layer
- * down.
+ * ## Only what an installed pack declares
+ *
+ * The npm package ships no Jev checks, so no name is a reviewer by default. A
+ * `reviewedBy` is honoured only for checks some installed pack declares — in
+ * practice `FailproofAI/jev-policies`, which the core pack's fifteen
+ * `reviewable` policies name. With no such pack the set is EMPTY, every policy
+ * registers `hard`, and nothing Jev says can clear a regex verdict. That is the
+ * fail-safe direction, and it is also what keeps Jev inert on a machine that
+ * never installed its checks: `jevChecksInstalled` below is the hook path's
+ * gate for starting a review at all.
  *
  * The names come from the MANIFEST, which is already where `authority` and
  * `reviewedBy` themselves are read from, so this adds no new trust and imports
@@ -39,7 +35,7 @@
  * silently.
  */
 import { readInstalledPacks, type ResolvedPack } from "./pack-manifest";
-import { SEMANTIC_REVIEWER_NAMES } from "./policy-authority";
+import { NO_REVIEWERS, SEMANTIC_REVIEWER_NAMES } from "./policy-authority";
 
 let cached: ReadonlySet<string> | null = null;
 let cachedContested: ReadonlyMap<string, string[]> = new Map();
@@ -148,8 +144,9 @@ export function isFirstPartyPack(pack: { source?: string }): boolean {
 }
 
 /**
- * A builtin check name declared by a pack that is not FailproofAI's. Core and
- * user policies name those checks in `reviewedBy`, so the third party's
+ * One of FailproofAI's sixteen check names (`SEMANTIC_REVIEWER_NAMES`) declared
+ * by a pack that is not FailproofAI's. Core and user policies name those checks
+ * in `reviewedBy`, so the third party's
  * question would become the reviewer that clears them — an `instruct`-mode
  * `destructive-deletion` beside the core pack turned `block-rm-rf` into a
  * warning. The claim is void: never asked, never a reviewer, and never a
@@ -162,33 +159,26 @@ export function isReservedClaim(pack: { source?: string }, name: string): boolea
 }
 
 /**
- * The installed packs' semantic policy names when any pack declares some, and
- * this build's compiled-in set otherwise.
+ * The semantic check names the installed packs declare — the only names a
+ * `reviewedBy` is honoured for on this machine. Empty when no pack declares any.
  *
  * A name two packs claim differently is left out — see
- * {@link contestedSemanticNames}. When that leaves nothing, the compiled-in set
- * stands, which is not a softening but the same rule
- * `semanticPoliciesFromPacks` applies to the QUESTIONS: a declaring pack whose
- * every entry was unusable leaves the compiled-in semantic set live, so the
- * names honoured here are the names of the questions that will actually be
- * asked, and each of those is one of ours.
- *
- * Never throws: an unreadable manifest declares nothing, and the builtin set
- * stands. That is the same fail-open posture every other reader of the pack
- * manifest takes, and here it also fails in the safe direction — a pack's
- * `reviewedBy` will not match a builtin name, so its policies stay `hard`
- * rather than being cleared by a question nobody could read.
+ * {@link contestedSemanticNames} — and so is one of FailproofAI's names claimed
+ * by anyone else ({@link isReservedClaim}).
+ *
+ * Never throws: an unreadable manifest declares nothing, so the set is empty and
+ * every policy stays `hard`. There is no compiled-in set to fall back to.
  */
 export function effectiveReviewerNames(): ReadonlySet<string> {
   if (cached) return cached;
-  let names: ReadonlySet<string> = SEMANTIC_REVIEWER_NAMES;
+  let names: ReadonlySet<string> = NO_REVIEWERS;
   cachedContested = new Map();
   try {
     const packs = jevPacks(readInstalledPacks().packs, reviewerCli);
     names = reviewerNamesFor(packs);
     cachedContested = contestedSemanticNames(packs);
   } catch {
-    // See above: silence here is the builtin set, not an empty one.
+    // See above: an unreadable manifest declares no checks.
   }
   cached = names;
   return names;
@@ -201,17 +191,34 @@ export function contestedReviewerNames(): ReadonlyMap<string, string[]> {
 }
 
 /**
- * A first-party pack declares Jev checks, so they REPLACE the compiled-in set.
- * Anyone else's checks are ADDED to it: a stranger's one check must not switch
- * off `credential-exfiltration` and turn every core reviewable policy hard.
- * `semanticPoliciesFromPacks` applies the same rule to the questions.
+ * Whether any installed pack gives Jev something to ask. False on a machine
+ * with no pack declaring a `semantic` entry — the vanilla install — and then
+ * the hook path does not start a Jev review at all: no request, no intent
+ * capture, exactly as if Jev were unconfigured. `failproofai policies add
+ * FailproofAI/jev-policies` is what turns it true.
+ *
+ * Read off the same cached set registration just used, so it costs nothing on
+ * the hook path and cannot disagree with which policies registered reviewable.
+ */
+export function jevChecksInstalled(): boolean {
+  return effectiveReviewerNames().size > 0;
+}
+
+/**
+ * The same question for a CLI command, read fresh rather than from the
+ * registration cache (which only the hook path fills): any agent, packs as
+ * `jevPacks` narrows them. Never throws; an unreadable manifest has none.
  */
-export function replacesBuiltinChecks(packs: ReadonlyArray<Pick<ResolvedPack, "semantic"> & { source?: string }>): boolean {
-  return packs.some((p) => isFirstPartyPack(p) && (p.semantic ?? []).length > 0);
+export function jevChecksDeclared(): boolean {
+  try {
+    return reviewerNamesFor(jevPacks(readInstalledPacks().packs)).size > 0;
+  } catch {
+    return false;
+  }
 }
 
 /**
- * The reviewer set for the packs taking part: see {@link replacesBuiltinChecks}. Pure.
+ * The reviewer set for the packs taking part: every usable name they declare. Pure.
  *
  * Manifest-only: it cannot see a check `semanticPoliciesFromPacks` drops for the
  * question budget, because measuring questions means loading the semantic
@@ -226,9 +233,9 @@ export function reviewerNamesFor(
   const declared = packs
     .flatMap((p) => (p.semantic ?? []).filter((s) => !isReservedClaim(p, s.name)).map((s) => s.name))
     .filter((name) => !contested.has(name));
-  // Nothing usable declared: the compiled-in set is the one being asked.
-  if (declared.length === 0) return SEMANTIC_REVIEWER_NAMES;
-  return new Set(replacesBuiltinChecks(packs) ? declared : [...SEMANTIC_REVIEWER_NAMES, ...declared]);
+  // Nothing usable declared: nothing is asked, so nothing may clear.
+  if (declared.length === 0) return NO_REVIEWERS;
+  return new Set(declared);
 }
 
 /**

package/src/hooks/handler.ts

@@ -38,7 +38,7 @@ import type { JevActivityFields } from "./semantic/combine";
 import type { JevConfig } from "./semantic/jev-config";
 import { clearPolicies, registerPolicy, getPoliciesForEvent } from "./policy-registry";
 import { loadAllCustomHooks } from "./custom-hooks-loader";
-import { contestedReviewerNames, effectiveReviewerNames } from "./effective-reviewers";
+import { contestedReviewerNames, effectiveReviewerNames, jevChecksInstalled } from "./effective-reviewers";
 import {
   authorityDeclarationFor,
   refusedAuthorityWarning,
@@ -57,7 +57,7 @@ import { getInstanceId } from "../../lib/telemetry-id";
 import { hookLogInfo, hookLogWarn } from "./hook-logger";
 import { readStdinPayload } from "./read-stdin";
 import { readActiveCloudManagedPolicies, type CloudManagedPolicyArtifact } from "./cloud-managed-policies";
-import { hasInstalledPacks, readInstalledPacks, type PackError, type ResolvedPack } from "./pack-manifest";
+import { hasInstalledRegexPacks, readInstalledPacks, type PackError, type ResolvedPack } from "./pack-manifest";
 import { missingGuards, packFailureReason, combinedGuardMatch, guardsCover } from "./pack-failclosed";
 import { readActivePause, type ActivePause } from "./session-pause";
 import { jevConfigFile } from "./fp-home";
@@ -217,6 +217,10 @@ async function runObserved(
 // alone — exactly as it did before two tiers existed — otherwise:
 //
 // - a valid BYOK config exists (`~/.failproofai/jev.json`, global only);
+// - an installed pack gives Jev checks to ask (`jevChecksInstalled`). The npm
+//   package ships none: until `failproofai policies add FailproofAI/jev-policies`
+//   (or another pack declaring `semantic` checks) Jev is inert — no request, no
+//   intent capture — whether the config is BYOK or FailproofAI Cloud's;
 // - `FAILPROOFAI_EVALUATOR` is not `legacy` (see "Turning Jev off" below);
 // - this is not the fail-closed `forceDecision` path and no session pause is
 //   active — a pause suspends local policy, and Jev must not become a way to
@@ -230,7 +234,7 @@ async function runObserved(
 // Turning Jev off. The switch that works everywhere is the config file itself:
 // it is read on every event, here, in whichever process evaluates — the
 // daemon's warm worker included — so `failproofai jev remove` (or a `mode:
-// "shadow"` config, which keeps enforcing the regex result) applies from the
+// "observe"` config, which keeps enforcing the regex result) applies from the
 // next tool call, with no restart. `FAILPROOFAI_EVALUATOR=legacy` is the dev
 // escape hatch, read from the EVALUATING process's environment: it covers a
 // one-shot hook (no daemon) and a worker whose own environment sets it, but
@@ -311,6 +315,8 @@ async function startTwoTier(
   if (isHumanAuthoredGate(session.rawHookEventName, cli)) return null;
   if (typeof parsed.tool_name !== "string" || parsed.tool_name.length === 0) return null;
   if (jevForcedOff(opts) || activePause) return null;
+  // Read off the reviewer set registration just cached, so it is free.
+  if (!jevChecksInstalled()) return null;
   const loaded = await readJevConfig();
   if (!loaded) return null;
   const cfg = loaded.config;
@@ -334,7 +340,7 @@ async function startTwoTier(
     // carries the fallback.
     hookLogInfo(`Jev review could not start (${err instanceof Error ? err.message : String(err)})`);
     return {
-      mode: cfg.mode === "shadow" || cfg.mode === "enforce" ? cfg.mode : loaded.defaultMode,
+      mode: cfg.mode === "observe" || cfg.mode === "enforce" ? cfg.mode : loaded.defaultMode,
       review: Promise.resolve({ kind: "fallback", reason: "error", latencyMs: null, model: null }),
       abort: () => {},
       authorityOf: () => ({ authority: "hard", reviewedBy: [] }),
@@ -398,6 +404,7 @@ async function captureJevIntent(
 ): Promise<void> {
   if (canonicalEventType !== "UserPromptSubmit" || jevForcedOff(opts)) return;
   try {
+    if (!jevChecksInstalled()) return;
     if (!(await readJevConfig())) return;
     if (decision === "deny") {
       const { ENFORCEMENT_CAPABILITY } = await import("./enforcement-capability");
@@ -561,7 +568,9 @@ export async function evaluateHookEvent(
       // yet, and it must not lose enforcement in the gap before `failproofai
       // update` runs. It disappears for that machine the moment a pack is
       // installed, and never fires for a machine set up by this version.
-      const packsInstalledHere = hasInstalledPacks();
+      // Only a pack with regex policies retires the shim: a Jev-only pack
+      // (FailproofAI/jev-policies) replaces none of them.
+      const packsInstalledHere = hasInstalledRegexPacks();
       const legacyNames =
         activePause || packsInstalledHere ? [] : config.enabledPolicies;
       // `alwaysOn` policies bypass the enabled set inside `registerBuiltinPolicies`,
@@ -738,8 +747,8 @@ export async function evaluateHookEvent(
         const observeOnly = cloudManaged?.effect === "observe" || pack?.effect === "observe";
         const fn: PolicyFunction = async (ctx): Promise<PolicyResult> => {
           if (observeOnly) {
-            const shadow = await runObserved(hook, ctx, hookName, eventType, cli);
-            if (shadow.decision !== "allow") {
+            const observed = await runObserved(hook, ctx, hookName, eventType, cli);
+            if (observed.decision !== "allow") {
               // Sourced from whichever layer asked to observe. This read
               // `cloudManaged!.id` — a non-null assertion that is simply false
               // for a pack, so an observe-mode PACK threw on its first non-allow
@@ -751,8 +760,8 @@ export async function evaluateHookEvent(
               observedResults.push({
                 policyId: observer!.id,
                 version: observer!.version,
-                decision: shadow.decision,
-                reason: shadow.reason ?? null,
+                decision: observed.decision,
+                reason: observed.reason ?? null,
               });
             }
             return { decision: "allow" };
@@ -928,19 +937,19 @@ export async function evaluateHookEvent(
           releaseRegistry: opts?.releaseRegistry,
         })
       : await evaluatePolicies(canonicalEventType, parsed, session, config);
-    // Shadow mode: what Jev WOULD have done, filed where observe-mode policies
+    // Jev's observe mode: what Jev WOULD have done, filed where observe-mode policies
     // file theirs, so the "would have" view counts it with no second channel.
     // `semantic/<check>` cannot be mistaken for a cloud policy — cloud ids
     // carry no `/` (`POLICY_ID_RE` in cloud-managed-policies.ts) — and the
     // version is a Jev model id or `jev`, never a deployment number. Only on
     // the two-tier path, so an unconfigured row is untouched.
-    const shadowVerdict = result.twoTier?.shadowVerdict;
-    if (shadowVerdict) {
+    const observeVerdict = result.twoTier?.observeVerdict;
+    if (observeVerdict) {
       observedResults.push({
-        policyId: shadowVerdict.policyName,
-        version: shadowVerdict.version,
-        decision: shadowVerdict.decision,
-        reason: shadowVerdict.reason,
+        policyId: observeVerdict.policyName,
+        version: observeVerdict.version,
+        decision: observeVerdict.decision,
+        reason: observeVerdict.reason,
       });
     }
     const durationMs = Math.round(performance.now() - startTime);

package/src/hooks/hermes-update.ts

@@ -0,0 +1,74 @@
+/**
+ * The Hermes half of `failproofai update`.
+ *
+ * npm replaces the CLI and nothing else, and until this ran `update` never
+ * looked at Hermes — so a machine that installed Hermes enforcement with ≤1.0.5
+ * kept its config.yaml shell hooks through every upgrade. Those hooks never
+ * reach Hermes cron jobs (each cron fire builds its own hook scope, which only
+ * discovered plugins join), so every scheduled job on such a machine ran
+ * unchecked while everything looked configured.
+ *
+ * This migrates each profile that already uses FailproofAI to the linked native
+ * plugin, and reports per profile. It fails (ok: false → non-zero exit) whenever
+ * a profile that uses FailproofAI is left on shell hooks or otherwise could not
+ * be brought current, because a green `update` is exactly how the gap stayed
+ * invisible.
+ */
+import { migrateHermesProfiles, type HermesPluginInstallDeps, type HermesProfileMigration } from "./integrations";
+
+export interface HermesUpdateResult {
+  ok: boolean;
+  lines: string[];
+  profiles: HermesProfileMigration[];
+}
+
+const STATUS_LABEL: Record<HermesProfileMigration["status"], string> = {
+  migrated: "migrated",
+  current: "already current",
+  untouched: "skipped",
+  blocked: "NOT migrated",
+  failed: "FAILED",
+};
+
+export async function runHermesUpdateMigration(deps: {
+  daemonSupportsPolicyEvaluation: () => Promise<boolean>;
+  installDeps?: HermesPluginInstallDeps;
+}): Promise<HermesUpdateResult> {
+  const profiles = await migrateHermesProfiles(deps);
+  const relevant = profiles.filter((p) => p.status !== "untouched");
+  // A machine without FailproofAI on Hermes hears nothing about Hermes.
+  if (relevant.length === 0) return { ok: true, lines: [], profiles };
+
+  const width = Math.max(...profiles.map((p) => ("hermes/" + p.name).length));
+  const lines = ["Hermes:"];
+  for (const p of profiles) {
+    const label = ("hermes/" + p.name).padEnd(width);
+    const detail = p.status === "current" ? "" : ` — ${p.detail}`;
+    lines.push(`  ${label}  ${STATUS_LABEL[p.status]}${detail}`);
+  }
+
+  const blocked = profiles.filter((p) => p.status === "blocked");
+  const failed = profiles.filter((p) => p.status === "failed");
+  if (profiles.some((p) => p.status === "migrated")) {
+    lines.push(
+      "  Cron jobs load the plugin on their next run; restart running Hermes gateways and sessions to load it there.",
+    );
+  }
+  if (blocked.length > 0) {
+    lines.push(
+      "",
+      `Hermes is NOT migrated (${blocked.map((p) => p.name).join(", ")}): the running failproofaid cannot`,
+      "answer the native plugin (no policyEvaluation), so nothing was changed. Profiles still on",
+      "shell hooks do NOT check Hermes cron jobs. Run `failproofai config` (it asks for sudo to",
+      "replace the daemon), then `failproofai update` again.",
+    );
+  }
+  if (failed.length > 0) {
+    lines.push(
+      "",
+      `Hermes could not be migrated for: ${failed.map((p) => p.name).join(", ")}. Fix the reason above,`,
+      "then run `failproofai update` again.",
+    );
+  }
+  return { ok: blocked.length === 0 && failed.length === 0, lines, profiles };
+}

package/src/hooks/hook-activity-store.ts

@@ -105,8 +105,8 @@ export interface HookActivityEntry {
   jevFallbackReason?: string;
   jevLatencyMs?: number;
   jevModel?: string;
-  /** `shadow` logs Jev but enforces the regex result; `enforce` applies the combine rules. */
-  jevMode?: "shadow" | "enforce";
+  /** `observe` logs Jev but enforces the regex result; `enforce` applies the combine rules. */
+  jevMode?: "observe" | "enforce";
   durationMs: number;
   sessionId?: string;
   transcriptPath?: string;
@@ -159,7 +159,7 @@ export interface HookActivityEntry {
    * indistinguishable from one where the policy never matched, and the rollout
    * being trialled is unmeasurable.
    *
-   * Jev in shadow mode files its own deny/instruct here too, as
+   * Jev in observe mode files its own deny/instruct here too, as
    * `{policyId: "semantic/<check>", version: <Jev model id or "jev">}`: the
    * same question — what would this have done — for the same reader.
    */