failproofai 1.0.8-beta.0 → 1.0.9-beta.0

package/src/hooks/semantic/combine.ts

@@ -22,7 +22,7 @@
  * | Jev answered                                  | reviewable denies/instructs Jev covered are cleared; final =|
  * |                                               | the most severe of {remaining regex results, Jev's verdict} |
  *
- * `shadow` mode computes and records all of it, and still returns the regex
+ * `observe` mode computes and records all of it, and still returns the regex
  * result.
  *
  * ## Where this departs from plan §4
@@ -232,14 +232,14 @@ import type { PolicyAuthority } from "../policy-types";
 // The only value imports, and deliberately from the activity vocabulary rather
 // than local literals: the fallback reason this module writes itself has to
 // be a code the activity store's closed list names, or it is stored and
-// shipped as `other`, and a shadow verdict's model id has to pass the same
+// shipped as `other`, and an observe-mode verdict's model id has to pass the same
 // shape check the row's own `jevModel` does. Importing them makes a rename a
 // compile error here. `jev-activity.ts` is pure (no node imports, no semantic
 // modules), so this costs the hook path nothing.
 import { JEV_MODEL_RE, JEV_REASON_REQUEST_CUT } from "../jev-activity";
 
 export type Decision = "allow" | "deny" | "instruct";
-export type JevMode = "shadow" | "enforce";
+export type JevMode = "observe" | "enforce";
 
 /** One regex policy's verdict, in evaluation order. */
 export interface RegexVerdict {
@@ -383,13 +383,13 @@ export interface JevActivityFields {
 }
 
 /**
- * Jev's own deny or instruct in SHADOW mode — the verdict enforce mode would
+ * Jev's own deny or instruct in OBSERVE mode — the verdict enforce mode would
  * have applied, recorded rather than applied. The handler files it in the
  * activity row's `observed` list, the "would have" record observe-mode cloud
  * and pack policies already use, so FailproofAI Cloud's policy page counts it
  * with no change on its side.
  */
-export interface ShadowVerdict {
+export interface ObserveVerdict {
   /** `semantic/<check>` — the name enforce mode would have attributed it to. */
   policyName: string;
   decision: "deny" | "instruct";
@@ -401,7 +401,7 @@ export interface ShadowVerdict {
 
 export interface CombineOutcome {
   final: FinalVerdict;
-  /** Reviewable regex policies Jev cleared (in shadow: would have cleared). */
+  /** Reviewable regex policies Jev cleared (in observe mode: would have cleared). */
   cleared: string[];
   /**
    * True when the first entry of `final` came from THIS TIER rather than from
@@ -414,11 +414,11 @@ export interface CombineOutcome {
   decidedByJev: boolean;
   activity: JevActivityFields;
   /**
-   * Shadow mode only, and only when Jev's own verdict was deny or instruct.
+   * Observe mode only, and only when Jev's own verdict was deny or instruct.
    * Absent otherwise — including every enforce outcome, where the verdict was
    * APPLIED and `decidedByJev` / the final entries already say so.
    */
-  shadowVerdict?: ShadowVerdict;
+  observeVerdict?: ObserveVerdict;
 }
 
 /**
@@ -495,7 +495,7 @@ export function combineTwoTier(
   const notDenied = new Set(review.notDenied);
   const cleared = wholePicture && !review.unclearableWarned ? verdicts.filter((v) => clears(v, asked, notDenied)).map((v) => v.policyName) : [];
 
-  // Built once, for both modes: enforce applies it, shadow records it, and the
+  // Built once, for both modes: enforce applies it, observe records it, and the
   // two must never disagree about what the verdict WAS.
   const jevEntry = { policyName: review.policyName, reason: review.reason ?? `Flagged by semantic review (${review.policyName})` };
   const enforced = resolveEnforce(verdicts, cleared, review.decision, jevEntry);
@@ -510,7 +510,7 @@ export function combineTwoTier(
     evaluator: review.requestCut ? "jev-fallback" : "jev",
     ...(review.requestCut ? { jevFallbackReason: JEV_REASON_REQUEST_CUT } : {}),
     jevDecision: review.decision,
-    // Only a clear that SOFTENED the call (in shadow: would have). One that
+    // Only a clear that SOFTENED the call (in observe mode: would have). One that
     // Jev's own deny, or another regex deny, still decided over changed
     // nothing — and `jev status` and the policy page's "Cleared by Jev" both
     // read `jevCleared` as calls Jev let through.
@@ -520,11 +520,11 @@ export function combineTwoTier(
     jevMode: mode,
   };
 
-  if (mode === "shadow") {
+  if (mode === "observe") {
     // Jev's own deny or instruct, exactly as enforce mode would have applied it
     // (upward only: a cut or injected call keeps it, as the enforce branch
     // below does). A clear is recorded in `jevCleared`, not here.
-    const shadowVerdict: ShadowVerdict | undefined =
+    const observeVerdict: ObserveVerdict | undefined =
       review.decision === "deny" || review.decision === "instruct"
         ? {
             policyName: jevEntry.policyName,
@@ -535,7 +535,7 @@ export function combineTwoTier(
             version: review.model && JEV_MODEL_RE.test(review.model) ? review.model : "jev",
           }
         : undefined;
-    return { final: legacy, cleared, decidedByJev: false, activity, ...(shadowVerdict ? { shadowVerdict } : {}) };
+    return { final: legacy, cleared, decidedByJev: false, activity, ...(observeVerdict ? { observeVerdict } : {}) };
   }
 
   return { ...enforced, cleared, activity };

package/src/hooks/semantic/decide.ts

@@ -13,9 +13,13 @@
  * - A `deny` policy blocks only on strong evidence; moderate evidence warns.
  * - The user may clear a policy only if (a) they explicitly asked for this
  *   action, (b) everything the call affects stays inside what they asked for
- *   (the `scope` probe), (c) when the call names identifiable targets, one of
- *   them appears in what they typed — checked here, in code, not by the model
- *   — and (d) the request does not look like it is talking to the reviewer.
+ *   (the `scope` probe), (c) when the call names identifiable targets, EVERY
+ *   one of them appears in what they typed — checked here, in code, not by the
+ *   model — and (d) the request does not look like it is talking to the
+ *   reviewer. When the local shell scan may have missed part of the command
+ *   (`$'…'`, a heredoc, `$(…)`, …), (c) cannot be checked and nothing is
+ *   cleared: the scan can see an innocent first target and stop before the
+ *   destructive one.
  *   A call that names no target is never cleared by default: the scope answer
  *   has to carry it.
  * - The injection probe withdraws any override, and turns a policy that has
@@ -68,44 +72,117 @@ function tokensOf(text: string): string[] {
     .filter((t) => t.length >= 3 && !GENERIC_TOKENS.has(t) && !/^\d+$/.test(t));
 }
 
+/**
+ * What a tool call acts on, as the local target check sees it.
+ *
+ * `groups` holds one entry per identifiable target — a non-flag argument of a
+ * shell command (path components and all), or, for any other tool, the whole
+ * of its argument values taken together — and each entry is the set of words
+ * that name it. `targets` is every word of every group.
+ *
+ * `complete` is false when the shell scan may have missed a word bash would
+ * run (`ScannedCommand.complete`). The groups are then a lower bound, and no
+ * clear may rest on them: see {@link everyTargetNamed}'s callers.
+ */
+export interface TargetScan {
+  targets: Set<string>;
+  groups: Set<string>[];
+  complete: boolean;
+}
+
 /**
  * The words that identify WHAT a tool call acts on: its non-flag arguments
  * (path components included), file paths, URL hosts, MCP argument values.
  * The verb is left to Jev's `user_asked` question; this only checks the noun.
  */
-export function targetTokens(toolInput: Record<string, unknown>): Set<string> {
-  const out = new Set<string>();
+export function scanTargets(toolInput: Record<string, unknown>): TargetScan {
+  const groups: Set<string>[] = [];
+  const addGroup = (tok: string) => {
+    const words = tokensOf(tok);
+    if (words.length > 0) groups.push(new Set(words));
+  };
   const command = typeof toolInput.command === "string" ? toolInput.command : null;
   if (command) {
-    for (const seg of scanCommand(command).segments) {
+    const scanned = scanCommand(command);
+    for (const seg of scanned.segments) {
       for (const tok of seg.slice(1)) {
-        if (tok.startsWith("-")) continue;
-        for (const t of tokensOf(tok)) out.add(t);
+        if (!tok.startsWith("-")) addGroup(tok);
       }
     }
     // Empty reads as "names no target", and lets consent rest on Jev's answers
     // alone. But the scanner is not bash — a `#` inside `$'…'`, `${x:- # }` or
     // backticks ends its view early, and it reads only MAX_SCAN_CHARS — so an
     // empty scan may just have stopped before the target. Then judge the words
-    // as written. Only ever stricter: an empty set already passed.
-    if (out.size === 0) {
+    // as written. Only ever stricter: an empty set already passed. (Such a scan
+    // is also reported incomplete, which withholds the clear on its own; this
+    // keeps the recorded targets honest.)
+    if (groups.length === 0) {
       for (const piece of command.split(/[;&|\n]+/)) {
         for (const tok of piece.trim().split(/\s+/).slice(1)) {
-          if (!tok.startsWith("-")) for (const t of tokensOf(tok)) out.add(t);
+          if (!tok.startsWith("-")) addGroup(tok);
         }
       }
     }
-    return out;
+    return { targets: new Set(groups.flatMap((g) => [...g])), groups, complete: scanned.complete };
   }
+  const all = new Set<string>();
   for (const [key, value] of Object.entries(toolInput)) {
     if (typeof value !== "string" || value.length > 300) continue;
     if (/content|old_string|new_string|body|text|prompt/i.test(key)) continue;
-    for (const t of tokensOf(value)) out.add(t);
+    for (const t of tokensOf(value)) all.add(t);
+  }
+  // A non-shell tool's fields qualify one another (`owner`, `repo`, `branch`)
+  // rather than naming separate targets, so they are ONE target: naming any of
+  // them names it.
+  return { targets: all, groups: all.size > 0 ? [all] : [], complete: true };
+}
+
+/** Every word of {@link scanTargets}, flattened. */
+export function targetTokens(toolInput: Record<string, unknown>): Set<string> {
+  return scanTargets(toolInput).targets;
+}
+
+/**
+ * True when the user's own words name EVERY target the call acts on — each
+ * group through at least one of its words.
+ *
+ * Not "any one": `rm -rf build/ ~/important` after "clean the build" names
+ * `build` and not `important`, and a clear on the first would carry the
+ * second, which nobody asked for.
+ */
+export function everyTargetNamed(scan: TargetScan, userSaid: ReadonlyArray<string>): boolean {
+  if (userSaid.length === 0 || scan.groups.length === 0) return false;
+  const said = userSaid.join("\n").toLowerCase();
+  return scan.groups.every((g) => {
+    for (const t of g) if (said.includes(t)) return true;
+    return false;
+  });
+}
+
+/**
+ * True when the user's words name SOME of the call's targets but not all:
+ * they drew a line and the call reaches past it. Naming none is not this — a
+ * goal ("fix the failing tests") names no path at all.
+ */
+export function partlyNamed(scan: TargetScan, userSaid: ReadonlyArray<string>): boolean {
+  if (userSaid.length === 0 || scan.groups.length < 2) return false;
+  const said = userSaid.join("\n").toLowerCase();
+  let named = 0;
+  for (const g of scan.groups) {
+    for (const t of g) {
+      if (said.includes(t)) {
+        named++;
+        break;
+      }
+    }
   }
-  return out;
+  return named > 0 && named < scan.groups.length;
 }
 
-/** True when the user's own words name at least one thing the call acts on. */
+/**
+ * True when the user's own words name at least one of `targets`. The deciders
+ * do not use this any-one check — see {@link everyTargetNamed}.
+ */
 export function targetNamedByUser(targets: Set<string>, userSaid: ReadonlyArray<string>): boolean {
   if (userSaid.length === 0) return false;
   // Nothing identifiable to check is not a match. This used to return true,
@@ -136,7 +213,7 @@ export function decide(
   const injected = injection !== null && injection >= thresholds.injection;
   const scope = typeof answers.scope === "number" ? answers.scope : null;
   const withinScope = scope !== null && scope >= thresholds.scope;
-  let targets: Set<string> | null = null;
+  let scan: TargetScan | null = null;
 
   const outcomes: PolicyOutcome[] = selected.map((p) => {
     const evidence = Math.min(...p.probes.map((probe) => answers[`${p.name}.${probe.id}`] ?? 0));
@@ -161,13 +238,18 @@ export function decide(
 
     const fired: PolicyOutcome["verdict"] = p.mode === "deny" && evidence >= thresholds.deny ? "deny" : "instruct";
     if (p.userCanOverride && userAsked !== null && userAsked >= thresholds.userAsked && withinScope) {
-      targets ??= targetTokens(toolInput);
+      scan ??= scanTargets(toolInput);
+      // A shell scan that may have missed a word cannot say what the call
+      // touches, so it cannot say the user named it: no clear. Not rescued by
+      // `userSaidCut` — that gap is in what the human typed, this one is in
+      // the call.
+      if (!scan.complete) return { ...base, verdict: fired, targetScanIncomplete: true };
       // No identifiable target: the scope answer (already required) carries it.
-      // Otherwise one of the targets must also appear in the user's own words —
+      // Otherwise EVERY target must also appear in the user's own words —
       // unless the words we hold were cut, when "absent" is not something this
       // check knows (see {@link DecideV1Options.userSaidCut}).
-      const named = targets.size > 0 && targetNamedByUser(targets, userSaid);
-      if (targets.size === 0 || named || userSaidCut) return { ...base, targetNamedByUser: named, verdict: "overridden" };
+      const named = scan.groups.length > 0 && everyTargetNamed(scan, userSaid);
+      if (scan.groups.length === 0 || named || userSaidCut) return { ...base, targetNamedByUser: named, verdict: "overridden" };
     }
     return { ...base, verdict: fired };
   });
@@ -293,12 +375,16 @@ export interface DecideV1Options {
  * - A policy fires exactly as in v0 (every probe holds, no exemption).
  * - Injection withdraws every clear and turns a fired policy into a block.
  * - The human asked for THIS operation on THIS target (`op_requested`), the
- *   call reaches no further (`beyond_task`), and — when the call names a
- *   target — that target appears in what the human typed or in the agent
- *   proposal they replied to: the policy is cleared.
+ *   call reaches no further (`beyond_task`), and — when the call names
+ *   targets — every one of them appears in what the human typed or in the
+ *   agent proposal they replied to: the policy is cleared.
+ * - A shell command the local scan could not read whole is cleared and
+ *   softened by neither route: see `ScannedCommand.complete` in `facts.ts`.
  * - Otherwise, the call is a step toward the human's task (`task_step`) and
  *   reaches no further: a warn-level outcome is cleared and a block is
- *   softened to a warning. A goal never licenses a block on its own.
+ *   softened to a warning. A goal never licenses a block on its own. On a
+ *   shell command whose targets the human named only in part, this route
+ *   does not apply either.
  * - Policies with `userCanOverride: false` are never cleared or softened.
  * - Nothing fired, but the call reaches beyond the task, is not a step toward
  *   it, and some "does it do X" probe is at least half-raised: warn.
@@ -321,11 +407,13 @@ export function decideV1(
   const task = num("task_step");
   const op = num("op_requested");
   const beyond = num("beyond_task");
-  let targets: Set<string> | null = null;
+  let scan: TargetScan | null = null;
+  const targetScan = (): TargetScan => (scan ??= scanTargets(toolInput));
+  const evidenceSaid = agentLastMessage ? [...userSaid, agentLastMessage] : userSaid;
   const targetOk = (): { ok: boolean; named: boolean } => {
-    targets ??= targetTokens(toolInput);
-    if (targets.size === 0) return { ok: true, named: false };
-    const named = targetNamedByUser(targets, agentLastMessage ? [...userSaid, agentLastMessage] : userSaid);
+    const s = targetScan();
+    if (s.groups.length === 0) return { ok: true, named: false };
+    const named = everyTargetNamed(s, evidenceSaid);
     return { ok: named || userSaidCut, named };
   };
 
@@ -349,12 +437,29 @@ export function decideV1(
 
     const fired: PolicyOutcome["verdict"] = p.mode === "deny" && evidence >= t.deny ? "deny" : "instruct";
     if (!p.userCanOverride) return { ...base, verdict: fired };
+    // The shell scan may have missed a word bash would run (`$'…'`, a heredoc,
+    // `$(…)`, …): what the call touches is not known here, so neither intent
+    // route may clear or soften it. Jev's own deny or instruct stands.
+    if (!targetScan().complete) return { ...base, verdict: fired, targetScanIncomplete: true };
 
     if (op !== null && op >= t.opRequested && beyond !== null && beyond < t.opBeyondMax) {
       const target = targetOk();
       if (target.ok) return { ...base, targetNamedByUser: target.named, verdict: "overridden", intent: "op-requested" };
     }
-    if (taskClears && task !== null && task >= t.taskStep && beyond !== null && beyond < t.taskBeyondMax) {
+    // The task-step route reaches `combine.ts` as a clear too — a warning it
+    // leaves behind clears a reviewable regex deny. It is consent by GOAL, so
+    // a shell command whose targets the human never named still rides on it
+    // ("fix the failing tests" → `rm -rf node_modules`). But once the human
+    // HAS named targets, they drew the line: a call reaching past it is not
+    // softened. After "clean the build", `rm -rf build/ ~/important` is not.
+    if (
+      taskClears &&
+      task !== null &&
+      task >= t.taskStep &&
+      beyond !== null &&
+      beyond < t.taskBeyondMax &&
+      !(typeof toolInput.command === "string" && !userSaidCut && partlyNamed(targetScan(), evidenceSaid))
+    ) {
       if (fired === "instruct") return { ...base, verdict: "overridden", intent: "task-step" };
       return { ...base, verdict: "instruct", intent: "downgraded-task-step" };
     }

package/src/hooks/semantic/evaluator.ts

@@ -98,7 +98,7 @@ export interface SemanticOptions {
    */
   signal?: AbortSignal;
   model?: string;
-  /** Overrides the resolved set (an installed pack's, else the compiled-in one). */
+  /** Overrides the resolved set (the installed packs' checks; empty with none). */
   policies?: ReadonlyArray<SemanticPolicy>;
   /** The agent the call is for: a pack scoped to other agents contributes no checks. */
   cli?: string;
@@ -306,8 +306,8 @@ export function prepareSemantic(input: SemanticInput, opts: SemanticOptions = {}
     scanned,
     input.projectRoot ?? null,
   );
-  // The set an installed pack declared, or the compiled-in one when no pack
-  // declares any — see `pack-policies.ts` for the replacement rule. Resolved
+  // The checks the installed packs declare — none when no pack declares any,
+  // and then nothing is asked (see `pack-policies.ts`). Resolved
   // here rather than by the caller because this is the one place the policy set
   // is read, and a second resolution site is a second answer to "what does this
   // machine ask Jev". A caller that supplies `policies` (a replay, an ablation,
@@ -496,7 +496,7 @@ export interface VerdictLogMeta {
   eventType: string;
   /**
    * What the handler did with the outcome: combined it with the regex results
-   * (`two-tier`), logged it while enforcing the regex result (`shadow`), or
+   * (`two-tier`), logged it while enforcing the regex result (`observe`), or
    * kept the regex result because Jev never answered (`legacy-fallback`).
    *
    * A TRUNCATED call is `two-tier`, not `legacy-fallback`: its clears were
@@ -504,7 +504,7 @@ export interface VerdictLogMeta {
    * `combine.ts`). `truncated` on the same row is what says the clearing half
    * was off for it; the activity row records `jev-fallback` / `truncated`.
    */
-  applied: "two-tier" | "shadow" | "legacy-fallback";
+  applied: "two-tier" | "observe" | "legacy-fallback";
 }
 
 export function verdictLogRow(input: SemanticInput, outcome: SemanticOutcome, meta: VerdictLogMeta): Record<string, unknown> {

package/src/hooks/semantic/facts.ts

@@ -49,6 +49,39 @@ export interface ScannedCommand {
   commentsRemoved: boolean;
   /** The removed comment text, so the injection probe can still see it. */
   comments: string[];
+  /**
+   * False when the scan may not have seen every word bash would run: the
+   * command was longer than `MAX_SCAN_CHARS`, or it uses syntax this scanner
+   * does not model (see {@link scanCommand}). Then `segments` is a GUESS — a
+   * `#` it read as a comment may not be one, and a word it never reached may be
+   * a target — and a caller must not rest a clear on what the segments omit.
+   */
+  complete: boolean;
+}
+
+/** Shells whose `-c` argument is a second command line this scan does not parse. */
+const NESTED_SHELLS = new Set(["sh", "bash", "zsh", "dash", "ksh", "ash", "fish"]);
+
+/**
+ * A `$` followed by this starts an expansion bash performs outside single
+ * quotes: `$NAME`, `$1`, `$@ $* $# $? $$ $! $-`, `${…}`, `$(…)` and `$((…))`.
+ * The scan does not resolve any of them — `DANGER=/critical; rm -rf $DANGER`
+ * names `/critical` only through the variable — so each makes it incomplete.
+ * A `$` before anything else (a space, `/`, the end) is a literal dollar.
+ */
+const EXPANSION_START = /[A-Za-z_0-9@*#?$!\-({]/;
+
+/** A segment that hands a string to a shell to parse again: `eval …`, `bash -c …`, `sudo sh -lc …`. */
+function runsNestedShell(tokens: string[]): boolean {
+  // One pass, so a segment of ten thousand `sh` words stays linear.
+  let shellSeen = false;
+  for (const tok of tokens) {
+    if (shellSeen && /^-[a-z]*c[a-z]*$/i.test(tok)) return true;
+    const base = tok.slice(tok.lastIndexOf("/") + 1);
+    if (base === "eval") return true;
+    if (NESTED_SHELLS.has(base)) shellSeen = true;
+  }
+  return false;
 }
 
 /**
@@ -56,6 +89,17 @@ export interface ScannedCommand {
  * operator splitting and comment removal. It is deliberately not a full shell
  * parser — it only needs to find words, segment boundaries and comments, and
  * it must stay linear no matter what the agent sends.
+ *
+ * Because it is not bash, it says when it may be wrong: `complete` is false on
+ * any construct whose quoting or word boundaries it does not follow — `$'…'`
+ * and `$"…"`, any parameter expansion (`$NAME`, `$1`, `$@`, `${…}`, `$((…))`),
+ * `$(…)` and backticks, unquoted brace expansion (`{a,b}`, `{1..3}`) and
+ * globs (`*`, `?`, `[…]`), `<(…)` / `>(…)`, heredocs and
+ * here-strings (`<<`), a backslash-newline, a quote left open at the end,
+ * `eval` or a shell's `-c` string, and a command cut at `MAX_SCAN_CHARS`.
+ * Each of those can put a `#` where the scan sees a comment and bash does not
+ * (`echo $'x\' # '; rm -rf /critical` scans as `echo x`), or put a command
+ * where the scan sees one word. The flag costs one comparison per character.
  */
 export function scanCommand(command: string): ScannedCommand {
   const text = command.length > MAX_SCAN_CHARS ? command.slice(0, MAX_SCAN_CHARS) : command;
@@ -67,15 +111,27 @@ export function scanCommand(command: string): ScannedCommand {
   let out = "";
   let commentsRemoved = false;
   const comments: string[] = [];
+  let complete = command.length <= MAX_SCAN_CHARS;
+  // Per-word, unquoted: an open `{` not yet closed, whether a `,` or `..`
+  // followed it, and an open `[`. Enough to spot brace expansion and globs.
+  let braceDepth = 0;
+  let braceSep = false;
+  let bracketOpen = false;
 
   const endWord = () => {
     if (inWord) tokens.push(word);
     word = "";
     inWord = false;
+    braceDepth = 0;
+    braceSep = false;
+    bracketOpen = false;
   };
   const endSegment = () => {
     endWord();
-    if (tokens.length > 0) segments.push(tokens);
+    if (tokens.length > 0) {
+      if (complete && runsNestedShell(tokens)) complete = false;
+      segments.push(tokens);
+    }
     tokens = [];
   };
 
@@ -83,6 +139,11 @@ export function scanCommand(command: string): ScannedCommand {
     const c = text[i];
     if (quote) {
       out += c;
+      // Inside "…", bash still expands `$NAME`, `$(…)`, `${…}` and backticks,
+      // and a backslash-newline is a continuation: none of that is followed here.
+      if (quote === '"' && (c === "`" || (c === "$" && EXPANSION_START.test(text[i + 1] ?? "")) || (c === "\\" && text[i + 1] === "\n"))) {
+        complete = false;
+      }
       if (c === quote) {
         quote = null;
       } else if (c === "\\" && quote === '"' && i + 1 < text.length) {
@@ -93,6 +154,16 @@ export function scanCommand(command: string): ScannedCommand {
       }
       continue;
     }
+    // Unquoted constructs whose contents the scan does not parse as bash does.
+    if (
+      c === "`" ||
+      (c === "$" && (text[i + 1] === "'" || text[i + 1] === '"' || EXPANSION_START.test(text[i + 1] ?? ""))) ||
+      ((c === "<" || c === ">") && text[i + 1] === "(") ||
+      (c === "<" && text[i + 1] === "<") ||
+      (c === "\\" && text[i + 1] === "\n")
+    ) {
+      complete = false;
+    }
     if (c === "'" || c === '"') {
       quote = c;
       inWord = true;
@@ -131,12 +202,30 @@ export function scanCommand(command: string): ScannedCommand {
       out += c;
       continue;
     }
+    // Brace expansion and globs, unquoted: bash turns `{build,/critical}` and
+    // `/crit*` into words this scan never sees. A `{` or `}` word on its own
+    // (`{ ls; }`, `-exec rm {} \;`) and `{}` are not expansions.
+    if (c === "{") {
+      braceDepth++;
+    } else if (braceDepth > 0 && (c === "," || (c === "." && text[i + 1] === "."))) {
+      braceSep = true;
+    } else if (c === "}" && braceDepth > 0) {
+      braceDepth--;
+      if (braceSep) complete = false;
+    } else if (c === "*" || c === "?") {
+      complete = false;
+    } else if (c === "[") {
+      bracketOpen = true;
+    } else if (c === "]" && bracketOpen) {
+      complete = false;
+    }
     word += c;
     inWord = true;
     out += c;
   }
   endSegment();
-  return { segments, withoutComments: out.trimEnd(), commentsRemoved, comments };
+  if (quote) complete = false;
+  return { segments, withoutComments: out.trimEnd(), commentsRemoved, comments, complete };
 }
 
 const PATH_LIKE = /^(?:\/|~|\.\.?(?:\/|$)|[^:]*\/)/;

package/src/hooks/semantic/jev-client.ts

@@ -469,7 +469,7 @@ async function postJson(url: string, bearer: string, body: unknown, signal: Abor
       body: JSON.stringify(body),
       signal,
       // Never followed. The configured URL is the one `validateBaseUrl` checked
-      // (https, or loopback http in shadow mode only); a redirect would hand the
+      // (https, or loopback http in observe mode only); a redirect would hand the
       // answer — the thing that can clear a deny — to an origin nobody checked,
       // plain http included. No provider redirects this POST.
       redirect: "manual",

package/src/hooks/semantic/jev-config.ts

@@ -55,7 +55,7 @@
  * The one provider whose key is NOT in this file. `failproofai config --token`
  * with a key carrying `jev:evaluate` stores that key in the `jev` slot of
  * `credentials.json` and, when there is no `jev.json` yet, writes one naming
- * this provider, the Cloud origin + `/enforcement/v1/jev` and `mode: "shadow"`.
+ * this provider, the Cloud origin + `/enforcement/v1/jev` and `mode: "observe"`.
  * So for this provider:
  *
  * - the key comes from `credentials.json` (`readJevCloudCredential`), read with
@@ -80,7 +80,7 @@
  *
  * # `mode: "off"`
  *
- * Every provider accepts `off | shadow | enforce`. `off` keeps the file — the
+ * Every provider accepts `off | observe | enforce`. `off` keeps the file — the
  * endpoint, and for BYOK the key — while Jev does not run at all:
  * `loadJevConfig` returns null exactly as for an absent file. It exists so the
  * dashboard can switch the Cloud route off without deleting the file that
@@ -96,8 +96,16 @@ export type { JevCloudCredential } from "../fp-config";
 
 export type JevProviderKind = "typesafe" | "openrouter" | "vercel" | "cloudflare" | "custom" | "failproofai";
 
-/** `off` does not run Jev at all; `shadow` logs Jev and enforces regex; `enforce` applies the combine rules. */
-export type JevConfigMode = "off" | "shadow" | "enforce";
+/** `off` does not run Jev at all; `observe` logs Jev and enforces regex; `enforce` applies the combine rules. */
+export type JevConfigMode = "off" | "observe" | "enforce";
+
+/**
+ * A mode as read from a file, a flag or a request: `off`, `observe` or
+ * `enforce`. Null for anything else.
+ */
+export function parseJevMode(raw: unknown): JevConfigMode | null {
+  return raw === "off" || raw === "observe" || raw === "enforce" ? raw : null;
+}
 
 export interface JevConfig {
   provider: JevProviderKind;
@@ -130,7 +138,7 @@ export interface JevConfig {
   credentialOrigin?: string;
 }
 
-export const DEFAULT_JEV_MODE: "shadow" | "enforce" = "enforce";
+export const DEFAULT_JEV_MODE: "observe" | "enforce" = "enforce";
 
 export const JEV_PROVIDER_KINDS: readonly JevProviderKind[] = ["typesafe", "openrouter", "vercel", "cloudflare", "custom", "failproofai"];
 
@@ -311,7 +319,7 @@ function credentialQueryProblem(url: URL): string | null {
  * No credentials in the URL — not as userinfo, not as a query parameter — and no
  * fragment, because a key belongs in the key field, where it is sent as a bearer
  * and never printed. `validateJevConfig` further accepts the loopback http form
- * only in shadow mode.
+ * only in observe mode.
  */
 export function validateBaseUrl(raw: unknown): ValidationResult<string> {
   if (typeof raw !== "string" || raw.trim() === "") return { ok: false, problem: "baseUrl must be a non-empty string" };
@@ -667,25 +675,26 @@ export function validateJevConfig(
   }
 
   if (o.mode !== undefined) {
-    if (o.mode !== "off" && o.mode !== "shadow" && o.mode !== "enforce") return { ok: false, problem: 'mode must be "off", "shadow" or "enforce"' };
-    cfg.mode = o.mode;
+    const mode = parseJevMode(o.mode);
+    if (mode === null) return { ok: false, problem: 'mode must be "off", "observe" or "enforce"' };
+    cfg.mode = mode;
   }
 
   // Plain http reaches only a loopback host (`validateBaseUrl`), and nothing
   // authenticates the server there: while the local proxy is down, any process
   // of this user — the agent being judged included — can bind its port and
   // answer "none" to every question. In enforce mode that answer clears
-  // reviewable denies; in shadow mode it changes nothing, and `off` sends
+  // reviewable denies; in observe mode it changes nothing, and `off` sends
   // nothing at all, so enforce is the one mode it is refused in.
   if (cfg.baseUrl !== undefined && isPlainHttp(cfg.baseUrl) && cfg.mode === "enforce") {
     return {
       ok: false,
       problem:
-        "plain http (to localhost) is accepted only with mode shadow: in enforce mode Jev's answers can clear a deny, " +
+        "plain http (to localhost) is accepted only with mode observe: in enforce mode Jev's answers can clear a deny, " +
         "and while the local proxy is down any process on this machine could take its port and answer. " +
         (cfg.provider === JEV_CLOUD_PROVIDER
-          ? "Reconnect to an https FailproofAI Cloud URL (failproofai config --token <key> --url https://…), or keep mode shadow"
-          : "Use https, or mode shadow"),
+          ? "Reconnect to an https FailproofAI Cloud URL (failproofai config --token <key> --url https://…), or keep mode observe"
+          : "Use https, or mode observe"),
     };
   }