failproofai 1.0.8 → 1.0.9-beta.0

package/.next/standalone/fp-cloud-cli/fp_cli/output.py

@@ -6217,6 +6217,22 @@ def render_deploy_plan(plan: Any, *, applied: bool = False) -> None:
     _stdout.print(); _stdout.print(Padding(card, (0, 0, 0, 2))); _stdout.print()
 
 
+def jev_machine_counts(summary: dict) -> tuple:
+    """``(observe, enforce)`` machines running Jev, from the summary's ``jev.machines``.
+
+    ``(0, 0)`` when the server says nothing about Jev.
+    """
+    jev = summary.get("jev") if isinstance(summary, dict) else None
+    machines = jev.get("machines") if isinstance(jev, dict) else None
+    if not isinstance(machines, dict):
+        return 0, 0
+
+    def count(v) -> int:
+        return v if isinstance(v, int) and not isinstance(v, bool) and v > 0 else 0
+
+    return count(machines.get("observe")), count(machines.get("enforce"))
+
+
 def render_guardrails(summary: dict, timeline: Optional[dict] = None) -> None:
     """``fp guardrails`` — what actually happened, as opposed to what was intended."""
     totals = summary.get("totals") or {}
@@ -6230,6 +6246,16 @@ def render_guardrails(summary: dict, timeline: Optional[dict] = None) -> None:
     stat.append(" machines enforcing", style=theme.LABEL)
     body = [stat]
 
+    observe, enforce = jev_machine_counts(summary)
+    if observe or enforce:
+        jev = Text()
+        jev.append("jev  ", style=theme.LABEL)
+        jev.append(str(observe), style="bold white")
+        jev.append(" observe   ", style=theme.LABEL)
+        jev.append(str(enforce), style="bold white")
+        jev.append(" enforce", style=theme.LABEL)
+        body.append(jev)
+
     if timeline:
         # Every source, summed — a sparkline drawn from series[0] alone sat
         # beside a headline number computed from ALL sources, so the shape and

package/.next/standalone/fp-cloud-cli/tests/test_output.py

@@ -1730,3 +1730,30 @@ def test_guardrails_sparkline_uses_every_source(capsys):
     truncated_spark = sparkline([1])
     assert merged_spark != truncated_spark, "the fixture no longer distinguishes the two paths"
     assert merged_spark in out, f"sparkline is not drawn from every source: {out!r}"
+
+
+def test_jev_machine_counts_reads_observe_and_enforce():
+    from fp_cli.output import jev_machine_counts
+
+    assert jev_machine_counts({"jev": {"machines": {"observe": 3, "enforce": 2}}}) == (3, 2)
+    assert jev_machine_counts({"jev": {"machines": {"enforce": 1}}}) == (0, 1)
+    assert jev_machine_counts({}) == (0, 0)
+    assert jev_machine_counts({"jev": None}) == (0, 0)
+    assert jev_machine_counts({"jev": {"machines": {"observe": "x", "enforce": True}}}) == (0, 0)
+
+
+def test_guardrails_shows_jev_machines_per_mode(capsys):
+    from fp_cli.output import render_guardrails
+
+    summary = {
+        "hours": 24,
+        "policies": [],
+        "totals": {"evaluated": 1, "blocked": 0, "enforcingMachines": 1, "reportingMachines": 1},
+        "jev": {"machines": {"observe": 2, "enforce": 1}},
+    }
+    render_guardrails(summary)
+    out = capsys.readouterr().out
+    assert "2 observe" in out and "1 enforce" in out
+
+    render_guardrails({**summary, "jev": {"machines": {"observe": 0, "enforce": 0}}})
+    assert "jev" not in capsys.readouterr().out

package/.next/standalone/hermes-plugin/README.md

@@ -21,11 +21,20 @@ Then run:
 failproofai policies --install --cli hermes --scope user
 ```
 
-FailproofAI copies this directory to every discovered profile at
-`<HERMES_HOME>/plugins/failproofai/` and adds `failproofai` to
-`plugins.enabled` in that profile's `config.yaml`. Reinstall replaces only a
-directory carrying `.failproofai-managed`; an unrelated plugin with the same
-directory name is never overwritten.
+The installer symlinks `<HERMES_HOME>/plugins/failproofai` in every discovered
+profile to this directory and adds `failproofai` to `plugins.enabled` in that
+profile's `config.yaml`. Hermes' plugin scan follows the link, so an npm
+upgrade updates the plugin with no reinstall. Where a symlink cannot be
+created, the files are copied instead and marked `.failproofai-managed`.
+Reinstall replaces only such a marked copy or a link into a FailproofAI
+`hermes-plugin/`; an unrelated plugin with the same name is never overwritten.
+Python may write `__pycache__/` here when the package directory is writable;
+it goes with the package on upgrade and is skipped when it cannot be written.
+
+`failproofai update` moves profiles that already use FailproofAI (legacy shell
+hooks or a copied plugin) to the link. Legacy shell hooks never ran for Hermes
+cron jobs, so `update` exits non-zero and keeps the shell hooks when the
+running daemon cannot serve the plugin.
 
 Legacy FailproofAI shell hooks are removed during migration. Operator-owned
 hooks and unrelated plugin settings are preserved. No dashboard deployment or
@@ -118,7 +127,8 @@ untrusted evaluation failures.
 ## Diagnostics and rollback
 
 `failproofai config --status` reports each existing Hermes profile as healthy,
-disabled, incomplete, or duplicated with a legacy shell hook. Hermes-side load
+disabled, incomplete, duplicated with a legacy shell hook, or still on legacy
+shell hooks alone (Hermes cron jobs are not checked). Hermes-side load
 errors are available through:
 
 ```bash
@@ -134,5 +144,5 @@ the integration with:
 failproofai policies --uninstall --cli hermes --scope user
 ```
 
-Uninstall removes the config registration and only the plugin directory marked
-as FailproofAI-managed.
+Uninstall removes the config registration and the profile's link (or marked
+copy); it never removes this package directory.

package/.next/standalone/package.json

@@ -1,6 +1,6 @@
 {
   "name": "failproofai",
-  "version": "1.0.8",
+  "version": "1.0.9-beta.0",
   "description": "Observability and enforcement for AI agent harnesses. 40 built-in policies hooked into 12 of them — Claude Code, Codex, Cursor, Hermes, OpenClaw and more — blocking the tool call before it runs. Local dashboard included, no account needed.",
   "bin": {
     "failproofai": "./dist/cli.mjs",
@@ -116,21 +116,21 @@
     "postcss": "8.5.26",
     "eslint-plugin-react-hooks": "7.0.1",
     "vite": "8.0.16",
-    "undici": "7.29.0",
+    "undici": "7.29.1",
     "brace-expansion": "5.0.9",
     "sharp": "0.35.4",
     "browserslist": "4.28.8"
   },
   "optionalDependencies": {
-    "@failproofai/failproofaid-linux-x64": "1.0.8",
-    "@failproofai/failproofaid-linux-arm64": "1.0.8",
-    "@failproofai/failproofaid-darwin-x64": "1.0.8",
-    "@failproofai/failproofaid-darwin-arm64": "1.0.8"
+    "@failproofai/failproofaid-linux-x64": "1.0.9-beta.0",
+    "@failproofai/failproofaid-linux-arm64": "1.0.9-beta.0",
+    "@failproofai/failproofaid-darwin-x64": "1.0.9-beta.0",
+    "@failproofai/failproofaid-darwin-arm64": "1.0.9-beta.0"
   },
   "failproofaidBinaries": {
-    "linux-x64": "35b641f60e1724513fbb760db382123dad2b5fcdd67dda6373bda80651bd36bb",
-    "linux-arm64": "a058288f5d08f99612f053793e5c7f59264d3da97f3dbe769e401b0f8536702d",
-    "darwin-x64": "b4f3dbe4aea44e77cc10839647c0dc03a1b8b797dfb27e1d89a6a96554ef27b8",
-    "darwin-arm64": "fd42f28bf92001d39117b488a215578b966f07d316214744aca64a1888f2aed2"
+    "linux-x64": "044b6619007227b8aa1fc1095b8c61a17bd90e11da53183ac1f5adecdcae6839",
+    "linux-arm64": "479450d7d15c52a59bd1a8cf4c7086be9210e8d31ad4f98d99b123f571e944bd",
+    "darwin-x64": "11562912ff726195bfb966ed24a774ffea38d01acc3edc1f9bfa3ea9c298977f",
+    "darwin-arm64": "5bbaee1ec89d2d8032b7f16e502fb96891fbc6aa2ee6c861f43a64a0a60e61ba"
   }
 }

package/.next/standalone/server.js

@@ -9,7 +9,7 @@ const currentPort = parseInt(process.env.PORT, 10) || 3000
 const hostname = process.env.HOSTNAME || '0.0.0.0'
 
 let keepAliveTimeout = parseInt(process.env.KEEP_ALIVE_TIMEOUT, 10)
-const nextConfig = {"env":{"NEXT_PUBLIC_APP_VERSION":"1.0.8"},"typescript":{"ignoreBuildErrors":false},"typedRoutes":false,"distDir":"./.next","cleanDistDir":true,"assetPrefix":"","cacheMaxMemorySize":52428800,"configOrigin":"next.config.ts","useFileSystemPublicRoutes":true,"generateEtags":true,"pageExtensions":["tsx","ts","jsx","js"],"instrumentationClientInject":[],"poweredByHeader":true,"compress":true,"images":{"deviceSizes":[640,750,828,1080,1200,1920,2048,3840],"imageSizes":[32,48,64,96,128,256,384],"path":"/_next/image","loader":"default","loaderFile":"","domains":[],"disableStaticImages":false,"minimumCacheTTL":14400,"formats":["image/webp"],"maximumRedirects":3,"maximumResponseBody":50000000,"dangerouslyAllowLocalIP":false,"dangerouslyAllowSVG":false,"contentSecurityPolicy":"script-src 'none'; frame-src 'none'; sandbox;","contentDispositionType":"attachment","localPatterns":[{"pathname":"**","search":""}],"remotePatterns":[],"qualities":[75],"unoptimized":true,"customCacheHandler":false},"devIndicators":{"position":"bottom-left"},"onDemandEntries":{"maxInactiveAge":60000,"pagesBufferLength":5},"basePath":"","sassOptions":{},"trailingSlash":false,"i18n":null,"productionBrowserSourceMaps":false,"excludeDefaultMomentLocales":true,"reactProductionProfiling":false,"reactStrictMode":null,"reactMaxHeadersLength":6000,"httpAgentOptions":{"keepAlive":true},"logging":{"serverFunctions":true,"browserToTerminal":"warn"},"compiler":{},"expireTime":31536000,"staticPageGenerationTimeout":60,"output":"standalone","modularizeImports":{"@mui/icons-material":{"transform":"@mui/icons-material/{{member}}"},"lodash":{"transform":"lodash/{{member}}"}},"outputFileTracingRoot":"/home/runner/work/failproofai/failproofai","enablePrerenderSourceMaps":true,"cacheComponents":false,"cacheLife":{"default":{"stale":300,"revalidate":900,"expire":4294967294},"seconds":{"stale":30,"revalidate":1,"expire":60},"minutes":{"stale":300,"revalidate":60,"expire":3600},"hours":{"stale":300,"revalidate":3600,"expire":86400},"days":{"stale":300,"revalidate":86400,"expire":604800},"weeks":{"stale":300,"revalidate":604800,"expire":2592000},"max":{"stale":300,"revalidate":2592000,"expire":31536000}},"cacheHandlers":{},"experimental":{"appNewScrollHandler":true,"coldCacheBadge":false,"devValidationWorker":true,"useSkewCookie":false,"cssChunking":true,"multiZoneDraftMode":false,"appNavFailHandling":false,"prerenderEarlyExit":true,"serverMinification":true,"linkNoTouchStart":false,"caseSensitiveRoutes":false,"cachedNavigations":false,"dynamicOnHover":false,"useOffline":false,"varyParams":true,"optimisticRouting":true,"instrumentationClientRouterTransitionEvents":false,"prefetchInlining":{"maxSize":2048,"maxBundleSize":10240},"preloadEntriesOnStart":true,"clientRouterFilter":true,"clientRouterFilterRedirects":false,"fetchCacheKeyPrefix":"","proxyPrefetch":"flexible","optimisticClientCache":true,"manualClientBasePath":false,"cpus":3,"memoryBasedWorkersCount":false,"imgOptConcurrency":null,"imgOptOperationCache":null,"imgOptTimeoutInSeconds":7,"imgOptMaxInputPixels":268402689,"imgOptSequentialRead":null,"isrFlushToDisk":true,"workerThreads":false,"optimizeCss":false,"nextScriptWorkers":false,"scrollRestoration":false,"externalDir":false,"devMemoryThresholdRestart":true,"disableOptimizedLoading":false,"gzipSize":true,"craCompat":false,"esmExternals":true,"fullySpecified":false,"swcTraceProfiling":false,"forceSwcTransforms":false,"requestInsights":false,"largePageDataBytes":128000,"typedEnv":false,"parallelServerCompiles":false,"parallelServerBuildTraces":false,"ppr":false,"authInterrupts":false,"webpackMemoryOptimizations":false,"optimizeServerReact":true,"strictRouteTypes":false,"useTypeScriptCli":true,"removeUncaughtErrorAndRejectionListeners":false,"validateRSCRequestHeaders":true,"staleTimes":{"dynamic":0,"static":300},"reactDebugChannel":true,"serverComponentsHmrCache":true,"serverComponentsHmrCancellation":false,"staticGenerationMaxConcurrency":8,"staticGenerationMinPagesPerWorker":25,"transitionIndicator":false,"gestureTransition":false,"inlineCss":false,"useCache":false,"globalNotFound":false,"browserDebugInfoInTerminal":"warn","lockDistDir":true,"proxyClientMaxBodySize":10485760,"hideLogsAfterAbort":false,"mcpServer":true,"turbopackFileSystemCacheForDev":true,"turbopackFileSystemCacheForBuild":true,"turbopackInferModuleSideEffects":true,"turbopackPluginRuntimeStrategy":"childProcesses","turbopackMemoryEvictionMode":"auto","optimizePackageImports":["lucide-react","date-fns","lodash-es","ramda","antd","react-bootstrap","ahooks","@ant-design/icons","@headlessui/react","@headlessui-float/react","@heroicons/react/20/solid","@heroicons/react/24/solid","@heroicons/react/24/outline","@visx/visx","@tremor/react","rxjs","@mui/material","@mui/icons-material","recharts","react-use","effect","@effect/schema","@effect/platform","@effect/platform-node","@effect/platform-browser","@effect/platform-bun","@effect/sql","@effect/sql-mssql","@effect/sql-mysql2","@effect/sql-pg","@effect/sql-sqlite-node","@effect/sql-sqlite-bun","@effect/sql-sqlite-wasm","@effect/sql-sqlite-react-native","@effect/rpc","@effect/rpc-http","@effect/typeclass","@effect/experimental","@effect/opentelemetry","@material-ui/core","@material-ui/icons","@tabler/icons-react","mui-core","react-icons/ai","react-icons/bi","react-icons/bs","react-icons/cg","react-icons/ci","react-icons/di","react-icons/fa","react-icons/fa6","react-icons/fc","react-icons/fi","react-icons/gi","react-icons/go","react-icons/gr","react-icons/hi","react-icons/hi2","react-icons/im","react-icons/io","react-icons/io5","react-icons/lia","react-icons/lib","react-icons/lu","react-icons/md","react-icons/pi","react-icons/ri","react-icons/rx","react-icons/si","react-icons/sl","react-icons/tb","react-icons/tfi","react-icons/ti","react-icons/vsc","react-icons/wi"],"useCacheTimeout":54,"instantInsights":{"validationLevel":"warning"},"trustHostHeader":false,"isExperimentalCompile":false},"htmlLimitedBots":"[\\w-]+-Google|Google-[\\w-]+|Chrome-Lighthouse|Slurp|DuckDuckBot|baiduspider|yandex|sogou|bitlybot|tumblr|vkShare|quora link preview|redditbot|ia_archiver|Bingbot|BingPreview|applebot|facebookexternalhit|facebookcatalog|Twitterbot|LinkedInBot|Slackbot|Discordbot|WhatsApp|SkypeUriPreview|Yeti|googleweblight","bundlePagesRouterDependencies":false,"configFileName":"next.config.ts","outputFileTracingExcludes":{"*":["node_modules/@img/**","node_modules/sharp/**"]},"turbopack":{"root":"/home/runner/work/failproofai/failproofai"},"repoRoot":"/home/runner/work/failproofai/failproofai","distDirRoot":".next"}
+const nextConfig = {"env":{"NEXT_PUBLIC_APP_VERSION":"1.0.9-beta.0"},"typescript":{"ignoreBuildErrors":false},"typedRoutes":false,"distDir":"./.next","cleanDistDir":true,"assetPrefix":"","cacheMaxMemorySize":52428800,"configOrigin":"next.config.ts","useFileSystemPublicRoutes":true,"generateEtags":true,"pageExtensions":["tsx","ts","jsx","js"],"instrumentationClientInject":[],"poweredByHeader":true,"compress":true,"images":{"deviceSizes":[640,750,828,1080,1200,1920,2048,3840],"imageSizes":[32,48,64,96,128,256,384],"path":"/_next/image","loader":"default","loaderFile":"","domains":[],"disableStaticImages":false,"minimumCacheTTL":14400,"formats":["image/webp"],"maximumRedirects":3,"maximumResponseBody":50000000,"dangerouslyAllowLocalIP":false,"dangerouslyAllowSVG":false,"contentSecurityPolicy":"script-src 'none'; frame-src 'none'; sandbox;","contentDispositionType":"attachment","localPatterns":[{"pathname":"**","search":""}],"remotePatterns":[],"qualities":[75],"unoptimized":true,"customCacheHandler":false},"devIndicators":{"position":"bottom-left"},"onDemandEntries":{"maxInactiveAge":60000,"pagesBufferLength":5},"basePath":"","sassOptions":{},"trailingSlash":false,"i18n":null,"productionBrowserSourceMaps":false,"excludeDefaultMomentLocales":true,"reactProductionProfiling":false,"reactStrictMode":null,"reactMaxHeadersLength":6000,"httpAgentOptions":{"keepAlive":true},"logging":{"serverFunctions":true,"browserToTerminal":"warn"},"compiler":{},"expireTime":31536000,"staticPageGenerationTimeout":60,"output":"standalone","modularizeImports":{"@mui/icons-material":{"transform":"@mui/icons-material/{{member}}"},"lodash":{"transform":"lodash/{{member}}"}},"outputFileTracingRoot":"/home/runner/work/failproofai/failproofai","enablePrerenderSourceMaps":true,"cacheComponents":false,"cacheLife":{"default":{"stale":300,"revalidate":900,"expire":4294967294},"seconds":{"stale":30,"revalidate":1,"expire":60},"minutes":{"stale":300,"revalidate":60,"expire":3600},"hours":{"stale":300,"revalidate":3600,"expire":86400},"days":{"stale":300,"revalidate":86400,"expire":604800},"weeks":{"stale":300,"revalidate":604800,"expire":2592000},"max":{"stale":300,"revalidate":2592000,"expire":31536000}},"cacheHandlers":{},"experimental":{"appNewScrollHandler":true,"coldCacheBadge":false,"devValidationWorker":true,"useSkewCookie":false,"cssChunking":true,"multiZoneDraftMode":false,"appNavFailHandling":false,"prerenderEarlyExit":true,"serverMinification":true,"linkNoTouchStart":false,"caseSensitiveRoutes":false,"cachedNavigations":false,"dynamicOnHover":false,"useOffline":false,"varyParams":true,"optimisticRouting":true,"instrumentationClientRouterTransitionEvents":false,"prefetchInlining":{"maxSize":2048,"maxBundleSize":10240},"preloadEntriesOnStart":true,"clientRouterFilter":true,"clientRouterFilterRedirects":false,"fetchCacheKeyPrefix":"","proxyPrefetch":"flexible","optimisticClientCache":true,"manualClientBasePath":false,"cpus":3,"memoryBasedWorkersCount":false,"imgOptConcurrency":null,"imgOptOperationCache":null,"imgOptTimeoutInSeconds":7,"imgOptMaxInputPixels":268402689,"imgOptSequentialRead":null,"isrFlushToDisk":true,"workerThreads":false,"optimizeCss":false,"nextScriptWorkers":false,"scrollRestoration":false,"externalDir":false,"devMemoryThresholdRestart":true,"disableOptimizedLoading":false,"gzipSize":true,"craCompat":false,"esmExternals":true,"fullySpecified":false,"swcTraceProfiling":false,"forceSwcTransforms":false,"requestInsights":false,"largePageDataBytes":128000,"typedEnv":false,"parallelServerCompiles":false,"parallelServerBuildTraces":false,"ppr":false,"authInterrupts":false,"webpackMemoryOptimizations":false,"optimizeServerReact":true,"strictRouteTypes":false,"useTypeScriptCli":true,"removeUncaughtErrorAndRejectionListeners":false,"validateRSCRequestHeaders":true,"staleTimes":{"dynamic":0,"static":300},"reactDebugChannel":true,"serverComponentsHmrCache":true,"serverComponentsHmrCancellation":false,"staticGenerationMaxConcurrency":8,"staticGenerationMinPagesPerWorker":25,"transitionIndicator":false,"gestureTransition":false,"inlineCss":false,"useCache":false,"globalNotFound":false,"browserDebugInfoInTerminal":"warn","lockDistDir":true,"proxyClientMaxBodySize":10485760,"hideLogsAfterAbort":false,"mcpServer":true,"turbopackFileSystemCacheForDev":true,"turbopackFileSystemCacheForBuild":true,"turbopackInferModuleSideEffects":true,"turbopackPluginRuntimeStrategy":"childProcesses","turbopackMemoryEvictionMode":"auto","optimizePackageImports":["lucide-react","date-fns","lodash-es","ramda","antd","react-bootstrap","ahooks","@ant-design/icons","@headlessui/react","@headlessui-float/react","@heroicons/react/20/solid","@heroicons/react/24/solid","@heroicons/react/24/outline","@visx/visx","@tremor/react","rxjs","@mui/material","@mui/icons-material","recharts","react-use","effect","@effect/schema","@effect/platform","@effect/platform-node","@effect/platform-browser","@effect/platform-bun","@effect/sql","@effect/sql-mssql","@effect/sql-mysql2","@effect/sql-pg","@effect/sql-sqlite-node","@effect/sql-sqlite-bun","@effect/sql-sqlite-wasm","@effect/sql-sqlite-react-native","@effect/rpc","@effect/rpc-http","@effect/typeclass","@effect/experimental","@effect/opentelemetry","@material-ui/core","@material-ui/icons","@tabler/icons-react","mui-core","react-icons/ai","react-icons/bi","react-icons/bs","react-icons/cg","react-icons/ci","react-icons/di","react-icons/fa","react-icons/fa6","react-icons/fc","react-icons/fi","react-icons/gi","react-icons/go","react-icons/gr","react-icons/hi","react-icons/hi2","react-icons/im","react-icons/io","react-icons/io5","react-icons/lia","react-icons/lib","react-icons/lu","react-icons/md","react-icons/pi","react-icons/ri","react-icons/rx","react-icons/si","react-icons/sl","react-icons/tb","react-icons/tfi","react-icons/ti","react-icons/vsc","react-icons/wi"],"useCacheTimeout":54,"instantInsights":{"validationLevel":"warning"},"trustHostHeader":false,"isExperimentalCompile":false},"htmlLimitedBots":"[\\w-]+-Google|Google-[\\w-]+|Chrome-Lighthouse|Slurp|DuckDuckBot|baiduspider|yandex|sogou|bitlybot|tumblr|vkShare|quora link preview|redditbot|ia_archiver|Bingbot|BingPreview|applebot|facebookexternalhit|facebookcatalog|Twitterbot|LinkedInBot|Slackbot|Discordbot|WhatsApp|SkypeUriPreview|Yeti|googleweblight","bundlePagesRouterDependencies":false,"configFileName":"next.config.ts","outputFileTracingExcludes":{"*":["node_modules/@img/**","node_modules/sharp/**"]},"turbopack":{"root":"/home/runner/work/failproofai/failproofai"},"repoRoot":"/home/runner/work/failproofai/failproofai","distDirRoot":".next"}
 
 process.env.__NEXT_PRIVATE_STANDALONE_CONFIG = JSON.stringify(nextConfig)
 

package/bin/failproofai.mjs

@@ -965,7 +965,7 @@ async function runCli() {
               "",
               "FailproofAI Cloud needs no setup here: `failproofai config --token",
               "<key>` with a key that carries jev:evaluate (the \"machine\" preset)",
-              "turns it on in shadow mode when there is no jev.json yet — except",
+              "turns it on in observe mode when there is no jev.json yet — except",
               "with --no-transcripts, which only stores the key; then",
               "`failproofai jev setup --provider failproofai` switches it on. Its",
               "key stays in credentials.json; no --url ever selects it.",
@@ -982,7 +982,7 @@ async function runCli() {
               ["--account-id <id>", "Cloudflare account id (32 hex characters)."],
               ["--base-url <url>", "Override the API base; `default` clears it."],
               ["--model <id>", "Override the model id; `default` clears it."],
-              ["--mode <m>", "enforce (default), shadow (log Jev, enforce regex), or off."],
+              ["--mode <m>", "enforce (default), observe (log Jev, enforce regex), or off."],
               ["--timeout-ms <n>", "Per-call budget before falling back. Default 3000."],
             ],
           },
@@ -993,7 +993,7 @@ async function runCli() {
               "  else can read — or one in a directory anyone else can WRITE, who",
               "  could replace it — is refused; a repository can never set it.",
               "• Re-running setup for the same provider keeps the key, so",
-              "  `failproofai jev setup --mode shadow` just switches the mode.",
+              "  `failproofai jev setup --mode observe` just switches the mode.",
               "• The daemon does not see your shell's environment: keep the key in",
               "  the file on a machine set up with `failproofai config`.",
               "• --token is the fast path, not the safe one: your shell history keeps",
@@ -1007,7 +1007,7 @@ async function runCli() {
               "failproofai jev --url https://openrouter.ai/api/v1 --token <token>",
               "failproofai jev setup --provider typesafe --key-stdin < ~/typesafe.key",
               "failproofai jev setup --provider cloudflare --account-id <id> --key-stdin",
-              "failproofai config --token <key>          (FailproofAI Cloud, shadow mode)",
+              "failproofai config --token <key>          (FailproofAI Cloud, observe mode)",
               "failproofai jev setup --mode enforce      (switch the configured route's mode)",
               "failproofai jev setup --mode off          (keep the config, stop asking Jev)",
               "failproofai jev test",
@@ -1180,6 +1180,9 @@ async function runCli() {
               "",
               "This does the rest of the upgrade: runs any pending layout migrations,",
               "puts the matching daemon binary in place, and restarts the service.",
+              "Hermes profiles already using failproofai are moved to the linked",
+              "native plugin (legacy shell hooks never checked Hermes cron jobs).",
+              "Exits non-zero when any half could not be brought current.",
             ],
           },
           {
@@ -1270,17 +1273,40 @@ async function runCli() {
       }
     }
 
+    // Hermes is migrated AFTER the daemon, and gated on what the daemon that is
+    // now running can do: the native plugin needs `policyEvaluation`, which
+    // ≤1.0.5 daemons lack, so when the swap above could not happen (a sudo
+    // system service with no sudo) the shell hooks stay and this fails loudly.
+    let hermesOk = true;
+    let hermesMigrated = 0;
+    try {
+      const { runHermesUpdateMigration } = await import("../src/hooks/hermes-update");
+      const svc = await import("../src/hooks/daemon-service");
+      const hermesResult = await runHermesUpdateMigration({
+        daemonSupportsPolicyEvaluation: () => svc.probeDaemonPolicyEvaluation(),
+      });
+      if (hermesResult.lines.length > 0) report.push("", ...hermesResult.lines);
+      hermesOk = hermesResult.ok;
+      hermesMigrated = hermesResult.profiles.filter((p) => p.status === "migrated").length;
+    } catch (err) {
+      report.push("", `Hermes migration failed: ${err instanceof Error ? err.message : String(err)}`);
+      hermesOk = false;
+    }
+
+    const updateOk = daemonOk && !migrationFailed && hermesOk;
     await printReport("update", report, {
-      ok: daemonOk && !migrationFailed,
+      ok: updateOk,
       meta: `v${version}`,
     });
     await track("cli_update", {
-      ok: daemonOk && !migrationFailed,
+      ok: updateOk,
       migrations: migrationsRan,
       migration_failed: migrationFailed,
+      hermes_ok: hermesOk,
+      hermes_migrated: hermesMigrated,
     });
     lastSubcommand = null;
-    await exitAfterFlush(daemonOk && !migrationFailed ? 0 : 1);
+    await exitAfterFlush(updateOk ? 0 : 1);
     return;
   }