stacktrace-cli 0.6.1__py3-none-any.whl → 0.7.0__py3-none-any.whl

stacktrace_cli/__init__.py

@@ -2,7 +2,7 @@
 
 import logging as _logging
 
-__version__ = "0.6.1"
+__version__ = "0.7.0"
 
 # Only the daemon attaches a handler (ADR-0048). Without this one, a WARNING
 # logged in any other process would reach Python's last-resort handler and

stacktrace_cli/daemon/webhook.py

@@ -483,8 +483,9 @@ def _slack_payload(payload: dict[str, object]) -> dict[str, object]:
     if isinstance(kinds, list) and kinds:
         joined = ", ".join(_mrkdwn(kind) for kind in kinds)
         fields.append({"type": "mrkdwn", "text": f"*Evidence*\n{joined}"})
+    # Severity only (ADR-0088). Confidence is nearly always `high`, so in a
+    # channel it is a field that says nothing; the JSON format still carries it.
     fields.append({"type": "mrkdwn", "text": f"*Severity*\n{_mrkdwn(severity)}"})
-    fields.append({"type": "mrkdwn", "text": f"*Confidence*\n{_mrkdwn(payload['confidence'])}"})
 
     blocks: list[dict[str, object]] = [
         {"type": "section", "text": {"type": "mrkdwn", "text": f"*{title}*"}},

stacktrace_cli/detector/deterministic.py

@@ -38,11 +38,13 @@ import os
 import re
 import shlex
 from collections.abc import Sequence
+from urllib.parse import urlsplit
 
 from stacktrace_cli.correlate.composition import Advisory, Component, Composition
 from stacktrace_cli.correlate.join import Resolution
 from stacktrace_cli.correlate.observed import (
     _MAX_SHELL_DEPTH,
+    _segment_capabilities,
     capabilities,
     command_segments,
     command_segments_with_ops,
@@ -90,6 +92,7 @@ def _credential_egress(call: ToolCallLike, ref: SessionRef) -> Detection | None:
     if not matches:
         return None
     kinds = sorted({m.kind for m in matches})
+    target = _outside_target(call)
     return Detection(
         rule_id="stacktrace-credential-egress",
         severity="high",
@@ -109,10 +112,13 @@ def _credential_egress(call: ToolCallLike, ref: SessionRef) -> Detection | None:
                 # arguments object, and a key is chosen by whoever wrote the
                 # call: an MCP server's schema, or a literal like
                 # `{"/private/customer/path": "sk-..."}` in a body the agent
-                # was handed. Offset is the descriptor ADR-0006 names, locates
-                # the match just as well for the responder who has the session,
-                # and cannot carry anything the other side wrote.
-                detail=f"at offset {match.offset} in the arguments of {tool_name_for(call)}",
+                # was handed. The offset is withheld too: a reader of an alert
+                # cannot use a character position, and the span already
+                # locates the call. Where it went is what they act on
+                # (ADR-0086).
+                detail=f"sent to {target}"
+                if target
+                else f"in the arguments of {tool_name_for(call)}",
             )
             for match in matches
         ),
@@ -131,6 +137,122 @@ def _command(call: ToolCallLike) -> str | None:
     return command if isinstance(command, str) and command else None
 
 
+#: Vendor CLIs that talk to one service, and the name a reader knows it by.
+#: A CLI that reaches whatever it is pointed at -- `curl`, `git`, `npm` -- is
+#: absent, because its name says nothing about who answered; the URL it was
+#: given does (`_shell_target`).
+_SERVICE_CLIS: dict[str, str] = {
+    "gh": "GitHub",
+    "glab": "GitLab",
+    "aws": "AWS",
+    "gcloud": "Google Cloud",
+    "az": "Azure",
+    "kubectl": "Kubernetes",
+    "vercel": "Vercel",
+    "netlify": "Netlify",
+    "railway": "Railway",
+    "flyctl": "Fly",
+    "heroku": "Heroku",
+    "wrangler": "Cloudflare",
+    "stripe": "Stripe",
+    "supabase": "Supabase",
+    "firebase": "Firebase",
+    "doctl": "DigitalOcean",
+}
+
+
+#: An MCP server or tool name that may be named: identifier characters only,
+#: so never a sentence (no spaces) and never a path (no slashes) (ADR-0086).
+_NAMEABLE = re.compile(r"[A-Za-z0-9][A-Za-z0-9_.:-]{0,63}")
+
+#: A host as `urlsplit` returns it: lowercase letters, digits, dots, hyphens.
+_HOSTNAME = re.compile(r"[a-z0-9](?:[a-z0-9.-]{0,251}[a-z0-9])?")
+
+
+def _host(value: object) -> str | None:
+    """The host of an `http(s)://` URL, and nothing else of it.
+
+    Scheme, userinfo, port, path and query all stay behind: they are where
+    tokens and customer identifiers sit, and the host is what answered.
+    """
+    if not isinstance(value, str) or not value.lower().startswith(("http://", "https://")):
+        return None
+    try:
+        parts = urlsplit(value)
+        host = parts.hostname
+    except ValueError:
+        return None
+    if not host or not _HOSTNAME.fullmatch(host):
+        return None
+    # `hostname` is lowercased, which hides a case-sensitive credential shape
+    # (`AKIA…`) from `find_secrets`, so the host is scanned as it was written.
+    if find_secrets(parts.netloc.rpartition("@")[2]):
+        return None
+    return host
+
+
+def _shell_target(command: str) -> str | None:
+    """The one service or host a shell command reached, or None.
+
+    A vendor CLI names its service (`GitHub (gh)`). Any other segment that
+    reaches the network must name exactly one URL host. A command that reached
+    two places (`gh … && curl …`), or a network segment with no URL (`git
+    push origin`), names nothing: the record does not say which one answered,
+    and naming the wrong one sends the reader to the wrong service.
+
+    Reads `command_segments`, the one shell parser, and asks it only which
+    programs ran, whether each reached the network, and its URL arguments.
+    """
+    targets: set[str] = set()
+    for program, arguments in command_segments(command):
+        if program in _SERVICE_CLIS:
+            targets.add(f"{_SERVICE_CLIS[program]} ({program})")
+            continue
+        if not any(
+            name == "network_egress" for name, _ in _segment_capabilities(program, arguments)
+        ):
+            continue
+        hosts = {host for argument in arguments if (host := _host(argument))}
+        if len(hosts) != 1:
+            return None
+        targets |= hosts
+    return targets.pop() if len(targets) == 1 else None
+
+
+def _outside_target(call: ToolCallLike) -> str | None:
+    """Who answered this call, where the record names one (ADR-0086).
+
+    `linear MCP · search_issues` for an MCP call, the URL's host for WebFetch,
+    and `_shell_target` for a shell command. The server and tool names are the
+    session's and the server's own words, so they are named only when shaped
+    like identifiers, and nothing secret-shaped is named at all.
+
+    The one place a finding names the tool an MCP server chose, and only for
+    the citations ADR-0086 lists. Everywhere else `tool_name_for` holds.
+    """
+    # A denied call reached nothing, so nothing answered it, whatever its
+    # error text says.
+    if denied(call):
+        return None
+    target: str | None
+    if call.mcp_server:
+        if not _NAMEABLE.fullmatch(call.mcp_server):
+            return None
+        # `customer-support-mcp` already says what it is.
+        server = call.mcp_server
+        target = server if server.lower().endswith("mcp") else f"{server} MCP"
+        if _NAMEABLE.fullmatch(call.tool_name):
+            target += f" · {call.tool_name}"
+    elif call.tool_name == "WebFetch":
+        target = _host((call.arguments or {}).get("url"))
+    else:
+        command = _command(call)
+        target = _shell_target(command) if command else None
+    if target is None or find_secrets(target):
+        return None
+    return target
+
+
 def _block_body(call: ToolCallLike) -> str | None:
     """The body `_agent_blocked` classifies a block from.
 
@@ -298,9 +420,18 @@ def _blocked_remediation(
 
 def _block_span(session: SessionLike, turn: TurnLike) -> str:
     """A turn-level span: the same session and turn key a call span is built
-    from, without a call index, because there is no call. It cannot collide
-    with one -- a call span always carries the index."""
-    return f"{session.session_id}:{turn.key}"
+    from, with index 0.
+
+    The index is there because the span grammar requires one: the upload
+    contract and Fleet both refuse a span that does not end in `:<n>`, so a
+    block reported in a reply never reached Fleet. It cannot collide with a
+    call span, because this is only ever built for a turn with no calls.
+
+    Accepted: a reply-only block that rang under the retired
+    `stacktrace-agent-blocked` rule (before 0.6.0) is matched by that rule's
+    old anchor, which had no index, so it can ring once more on a machine
+    that upgrades from before 0.6.0 straight to this version."""
+    return f"{session.session_id}:{turn.key}:0"
 
 
 def block_spans_by_turn(session: SessionLike) -> dict[str, TurnLike]:
@@ -439,12 +570,16 @@ def _agent_blocked(session: SessionLike, ref: SessionRef) -> tuple[Detection, ..
                 if not denied(call):
                     worked_at.append((turn.position, index))
                 continue
+            # Who refused, where a service did. A spend limit or a safety
+            # check is the client refusing, and naming the host the call was
+            # aimed at would blame it instead.
+            target = _outside_target(call) if reason.attribution == "upstream" else None
             found.setdefault(reason.code, []).append(
                 Evidence(
                     span=call.span,
                     kind=reason.code,
                     detail=_blocked_detail(
-                        tool_name_for(call),
+                        target or tool_name_for(call),
                         reason.specific(_block_body(call)),
                     ),
                 )
@@ -1581,7 +1716,7 @@ def _credential_persisted(session: SessionLike, ref: SessionRef) -> tuple[Detect
                         Evidence(
                             span=call.span,
                             kind=match.kind,
-                            detail=f"{match.kind} at offset {match.offset}",
+                            detail=f"written to a file by {tool_name_for(call)}",
                         )
                         for match in matches
                     ),
@@ -1773,6 +1908,8 @@ def _tool_retry_storm(session: SessionLike, ref: SessionRef) -> tuple[Detection,
             last_key = key
 
             if counters.get(key, 0) >= _RETRY_THRESHOLD:
+                # What the agent kept calling, not the tool it called it with.
+                target = _outside_target(call) or tool_name_for(call)
                 det = Detection(
                     rule_id="stacktrace-tool-retry-storm",
                     severity="low",
@@ -1783,7 +1920,7 @@ def _tool_retry_storm(session: SessionLike, ref: SessionRef) -> tuple[Detection,
                         Evidence(
                             span=span,
                             kind="identical_retry",
-                            detail=f"{tool_name_for(call)} called with identical parameters",
+                            detail=f"{target} called with identical parameters",
                         )
                         for span in storm_spans
                     ),

stacktrace_cli/detector/finding.py

@@ -97,6 +97,9 @@ def tool_name_for(call: ToolCallLike) -> str:
     the ADR puts it — `Detection.components` where it was placed, a
     `Participant.name` where it was not.
 
+    ADR-0086 is the one exception: `deterministic._outside_target` names the
+    server and tool in the citations of the rules it lists, and nowhere else.
+
     Lives here rather than beside one rule because both stages need it, and a
     second copy of this argument is a second chance to get it wrong — which is
     the class `test_untrusted_content_never_travels.py` exists to close.

stacktrace_cli/monitor/site/app.js

@@ -700,16 +700,22 @@ function eventsFrom(sessions) {
 
 /* Components *invoked*, by kind. The demo's strip counted what was installed;
  * this snapshot carries only what was reached, so the chip says "invoked"
- * rather than borrowing a word for a number it does not hold. */
+ * rather than borrowing a word for a number it does not hold.
+ *
+ * Every kind counted here is one `renderComposition` draws a chip for, so the
+ * chips add up to the total. A built-in sub-agent has no component type and
+ * the category `subagent`, which no chip named; anything else unnamed is
+ * "Other" rather than a number the total holds and no chip shows. */
 function compositionOf(sessions) {
   const byType = {};
   const seen = new Set();
   for (const session of sessions) {
     for (const row of session.activity || []) {
       if (unplaceable(row)) continue;
-      const type = row.component_type || row.category;
+      const raw = row.component_type || row.category;
+      const type = raw === "subagent" ? "agent" : COMPONENT_KINDS[raw] ? raw : "other";
       const key = type + "\n" + (row.component_identity || row.component_name || row.tool_name);
-      if (!type || seen.has(key)) continue;
+      if (!raw || seen.has(key)) continue;
       seen.add(key);
       byType[type] = (byType[type] || 0) + 1;
     }
@@ -779,7 +785,7 @@ let lastPolicies = [];
 let lastComplete = false;
 let lastSessionCount = 0;
 
-/* Whether the reader opened or closed the list with "What we check", or
+/* Whether the reader opened or closed the list with "Scanned Policies", or
  * `null` while they have not and the list follows the view: open while a
  * range loads or a pass checks, and when a finished pass found nothing;
  * folded only once a finished pass has findings, so the cards lead.
@@ -838,8 +844,8 @@ const POLICY_WORD = { checking: "checking", clear: "clear", idle: "" };
  * the pass has finished -- the false silence ADR-0004 rules out.
  *
  * Finished, a clean window keeps the list, every policy ticked clear, and a
- * window with findings folds it to its one line so the cards lead. "What we
- * check" opens or folds the list for the view on screen (`policyListOpen`). */
+ * window with findings folds it to its one line so the cards lead. "Scanned
+ * Policies" opens or folds the list for the view on screen (`policyListOpen`). */
 function renderPolicyCheck(view) {
   lastPolicyView = view;
   const node = el("policy-check");
@@ -892,7 +898,7 @@ function renderPolicyCheck(view) {
   const open = policyListOpen === null ? !findings : policyListOpen;
   lastPolicyOpen = open;
   const toggle = '<button type="button" class="pc-toggle" aria-expanded="' + open + '">' +
-    "What we check " + (open ? "▴" : "▾") + "</button>";
+    "Scanned Policies " + (open ? "▴" : "▾") + "</button>";
   const found = {};
   for (const alert of alerts) found[alert.rule_id] = (found[alert.rule_id] || 0) + 1;
   const rows = lastPolicies.map(function (policy) {
@@ -910,7 +916,7 @@ function renderPolicyCheck(view) {
     (open ? '<ul class="pc-list">' + rows + "</ul>" : ""));
 }
 
-/* "What we check": open the list if it is folded, fold it if it is open. */
+/* "Scanned Policies": open the list if it is folded, fold it if it is open. */
 function togglePolicyList() {
   policyListOpen = !lastPolicyOpen;
   renderPolicyCheck(lastPolicyView);

stacktrace_cli/monitor/site/index.html

@@ -86,12 +86,6 @@
     </div>
   </section>
 
-  <div class="panel-head panel-head-logs">
-    <span class="panel-kick">Live</span>
-    <h2>What your agents are doing</h2>
-    <span class="panel-note">read from this machine's own transcripts</span>
-  </div>
-
   <div class="logs">
     <section class="logcol">
       <header class="logcol-head">

stacktrace_cli/monitor/site/inventory.js

@@ -39,9 +39,10 @@ function typeLabel(type, many) {
   return titled(type);
 }
 
-/* The scanner's labels, in tile order. A label outside these gets a tile of
- * its own rather than being folded into one: the page never re-grades. */
-const INV_SEVERITIES = ["CRITICAL", "HIGH", "MEDIUM", "LOW", "UNKNOWN"];
+/* The scanner's labels, in tile order. A label outside these -- UNKNOWN among
+ * them -- gets a tile of its own only when a vulnerability carries it, rather
+ * than being folded into one: the page never re-grades. */
+const INV_SEVERITIES = ["CRITICAL", "HIGH", "MEDIUM", "LOW"];
 
 /* Full class names rather than built by concatenation, so the check that every
  * class the page emits is styled can see each one. */
@@ -72,7 +73,7 @@ function checkCell(row) {
     case "not_checked":
       return { text: "Not checked", cls: "inv-check inv-check-warn" };
     case "no_package":
-      return { text: "No package", cls: "inv-check inv-check-dim" };
+      return { text: "None", cls: "inv-check inv-check-dim" };
     default:
       return { text: "Checking…", cls: "inv-check inv-check-dim" };
   }
@@ -95,6 +96,10 @@ const invOpen = new Set();
 
 /* --- the URL -------------------------------------------------------------- */
 
+/* The Vulnerabilities tab's views. A bookmarked one no longer listed reads
+ * as the default rather than as a view with no chip pressed. */
+const INV_VIEWS = ["vulnerabilities", "posture"];
+
 /* Which filters each tab writes to the hash. */
 const INV_HASH_KEYS = {
   inventory: ["agent", "type", "show", "inactive"],
@@ -109,6 +114,7 @@ function readHash(hash) {
   const filter = Object.assign({}, INV_DEFAULTS);
   for (const key of INV_HASH_KEYS[tab] || []) {
     if (!params.has(key)) continue;
+    if (key === "view" && !INV_VIEWS.includes(params.get(key))) continue;
     filter[key] = key === "inactive" ? params.get(key) === "1" : params.get(key);
   }
   return { tab: INV_TABS.includes(tab) ? tab : "live", filter: filter };
@@ -188,14 +194,17 @@ const instances = (issues) =>
   issues.reduce((sum, issue) => sum + issue.affected.length + issue.subjects.length, 0);
 
 /* The Vulnerabilities tab's tiles. Distinct vulnerabilities by label, then
- * posture issues and observations as instances: two trusted directories are
- * two posture issues on one row. */
+ * posture issues as instances: two trusted directories are two posture issues
+ * on one row. */
 function severityTiles(doc, filter) {
   const scope = Object.assign({}, filter, { severity: "" });
   const counts = new Map(INV_SEVERITIES.map((s) => [s, 0]));
   for (const v of vulnerabilityRows(doc, scope)) {
     counts.set(label(v.severity), (counts.get(label(v.severity)) || 0) + 1);
   }
+  /* The selected label keeps its tile, at 0 if nothing in scope carries it,
+   * so a filter that is on always has a tile to show it and to clear it. */
+  if (filter.severity && !counts.has(filter.severity)) counts.set(filter.severity, 0);
   const checked = doc.checked === "done";
   const tiles = Array.from(counts.entries()).map(([severity, count]) => ({
     key: "severity", value: severity, label: titled(severity.toLowerCase()),
@@ -205,10 +214,6 @@ function severityTiles(doc, filter) {
     key: "view", value: "posture", label: "Posture issues",
     count: instances(issueRows(doc.posture, doc, scope)),
   });
-  tiles.push({
-    key: "view", value: "observations", label: "Observations",
-    count: instances(issueRows(doc.observations, doc, scope)),
-  });
   return tiles;
 }
 
@@ -405,7 +410,7 @@ function renderVulnerabilitiesTab(doc) {
   html += '<p class="inv-summary">' + esc(vulnerabilitiesLine(doc, invFilter)) + "</p>";
   html += '<div class="inv-filters"><span class="inv-group">' +
     chip("view", "vulnerabilities", "Vulnerabilities") + chip("view", "posture", "Posture issues") +
-    chip("view", "observations", "Observations") + "</span>" + agentSelect("vul-agent", doc) +
+    "</span>" + agentSelect("vul-agent", doc) +
     "</div>";
 
   if (invFilter.view === "vulnerabilities") {
@@ -428,9 +433,8 @@ function renderVulnerabilitiesTab(doc) {
     return html + table(["Vulnerability", "Severity", "Fixed in", "Affects"], body);
   }
 
-  const posture = invFilter.view === "posture";
-  const issues = issueRows(posture ? doc.posture : doc.observations, doc, invFilter);
-  if (!issues.length) return html + emptyBody(posture ? "No posture issues." : "No observations.");
+  const issues = issueRows(doc.posture, doc, invFilter);
+  if (!issues.length) return html + emptyBody("No posture issues.");
   const body = issues.map((issue) =>
     '<tr class="inv-row"><td>' + esc(issue.summary) +
     (issue.sent_to_fleet ? "" : ' <span class="inv-marker">Not sent to Fleet</span>') +
@@ -439,7 +443,7 @@ function renderVulnerabilitiesTab(doc) {
     "</td><td>" + esc(fmt(issue.affected.length + issue.subjects.length)) + "</td></tr>" +
     '<tr class="inv-under"><td colspan="4">' + componentLines(issue.affected) +
     subjectLines(issue.subjects) + "</td></tr>").join("");
-  return html + table([posture ? "Posture issue" : "Observation", "Severity", "Fix", "Affects"], body);
+  return html + table(["Posture issue", "Severity", "Fix", "Affects"], body);
 }
 
 /* The one note these tabs draw above themselves: that they describe this

stacktrace_cli/monitor/site/styles.css

@@ -299,7 +299,7 @@ body.watch-mode .hero, body.watch-mode .band, body.watch-mode .status, body.watc
    ran; an alert is a sentence, a citation list and a remediation, and it was
    the one being wrapped. Order in the markup is trace-then-alerts, so the
    ratio reads 2:3. */
-.logs { display:grid; grid-template-columns:minmax(0,2fr) minmax(0,3fr); gap:1.2rem; align-items:start; }
+.logs { display:grid; grid-template-columns:minmax(0,2fr) minmax(0,3fr); gap:1.2rem; align-items:start; margin-top:1.6rem; }
 @media (max-width:860px){ .logs { grid-template-columns:1fr; } }
 
 /* Each feed is a panel with a real edge. Unbordered columns read as loose text
@@ -539,10 +539,8 @@ body.watch-mode .hero, body.watch-mode .band, body.watch-mode .status, body.watc
 /* ---------- overview section: two trend tables ---------- */
 .overview { margin:0 0 0.4rem; }
 /* ---------- section headers ----------
-   One treatment for both readings, so Overview and the live feeds read as two
-   halves of the same page rather than two widgets. The mono eyebrow and its
-   coral dot are stacktrace-site's `.eyebrow`; the rule under the title is what
-   gives the section its weight against the run bar above it. */
+   The rule under the title is what gives the section its weight against the
+   run bar above it. */
 .panel-head {
   display:flex; align-items:baseline; gap:0.7rem; flex-wrap:wrap;
   margin:0 0 0.9rem; padding-bottom:0.5rem;
@@ -551,13 +549,6 @@ body.watch-mode .hero, body.watch-mode .band, body.watch-mode .status, body.watc
 .panel-head h2 {
   margin:0; font-size:1.35rem; font-weight:700; letter-spacing:-0.03em; color:var(--ink);
 }
-.panel-kick {
-  display:inline-flex; align-items:center; gap:0.45em;
-  font-family:var(--mono); font-size:0.62rem; font-weight:500;
-  letter-spacing:0.14em; text-transform:uppercase; color:var(--ink-dim);
-}
-.panel-kick::before { content:""; width:7px; height:7px; border-radius:50%; background:var(--coral); }
-.panel-note { margin-left:auto; font-family:var(--mono); font-size:0.68rem; color:var(--ink-faint); }
 /* The window reads at nearly the heading's weight, because every number under
    it is "in this window" and a range mistaken for the default is a page
    misread rather than a detail missed. */
@@ -578,7 +569,6 @@ body.watch-mode .hero, body.watch-mode .band, body.watch-mode .status, body.watc
 .range-btn[aria-pressed="true"] {
   color:var(--paper); background:var(--ink); border-color:var(--ink);
 }
-.panel-head-logs { margin-top:2rem; }
 
 .ov-win { font-family:var(--mono); font-size:0.66rem; font-weight:400; color:var(--ink-faint); font-style:italic; }
 .ov-grid { display:grid; grid-template-columns:1fr 1fr; gap:1.1rem; }

stacktrace_cli/remote/cli.py

@@ -37,6 +37,11 @@ from stacktrace_cli.remote.config import (
     save_remote_config,
 )
 from stacktrace_cli.remote.policy import compile_remote_policy
+from stacktrace_cli.remote.policy_service import (
+    ApplyResult,
+    PolicyServiceError,
+    default_policy_service,
+)
 from stacktrace_cli.remote.spool import clear_pending_uploads
 from stacktrace_cli.remote.sync import (
     NOT_CONFIGURED,
@@ -195,6 +200,88 @@ def policy_compile(
     )
 
 
+@policy.command("apply")
+def policy_apply() -> None:
+    """Run one privileged Fleet policy reconciliation."""
+    try:
+        result = default_policy_service().apply()
+    except PolicyServiceError as exc:
+        raise click.ClickException(exc.code) from exc
+    click.echo(_policy_apply_message(result))
+
+
+@policy.command("install-service")
+@click.option("--user", required=True, help="Developer account whose Claude configuration is read.")
+@click.option("--api-url", required=True, help="Administrator-confirmed Fleet API origin.")
+def policy_install_service(user: str, api_url: str) -> None:
+    """Enroll and install automatic privileged policy reconciliation."""
+    try:
+        result = default_policy_service().install(
+            user=user,
+            expected_api_url=api_url,
+        )
+    except PolicyServiceError as exc:
+        raise click.ClickException(exc.code) from exc
+    if result.action == "no_policy":
+        click.echo("Installed policy service; Fleet has no published policy")
+    elif result.action == "coalesced":
+        click.echo("Installed policy service; policy reconciliation already running")
+    else:
+        click.echo(f"Installed service and policy revision {result.revision}")
+
+
+@policy.command("uninstall-service")
+def policy_uninstall_service() -> None:
+    """Remove automatic reconciliation while retaining the installed policy."""
+    try:
+        default_policy_service().uninstall()
+    except PolicyServiceError as exc:
+        raise click.ClickException(exc.code) from exc
+    click.echo("Uninstalled policy service; managed policy and enrollment were retained")
+
+
+@policy.command("status")
+def policy_status() -> None:
+    """Show content-free local policy deployment status."""
+    try:
+        status = default_policy_service().status()
+    except PolicyServiceError as exc:
+        raise click.ClickException(exc.code) from exc
+    click.echo(f"Service: {'installed' if status.service_installed else 'not installed'}")
+    click.echo(f"User: {status.user}")
+    last_seen_revision = (
+        str(status.last_seen_revision) if status.last_seen_revision is not None else "none"
+    )
+    installed_revision = (
+        str(status.installed_revision) if status.installed_revision is not None else "none"
+    )
+    click.echo(f"Last seen revision: {last_seen_revision}")
+    click.echo(f"Installed revision: {installed_revision}")
+    click.echo(f"Artifact: {'verified' if status.artifact_verified else 'not verified'}")
+    last_checked = status.last_checked_at.isoformat() if status.last_checked_at else "never"
+    click.echo(f"Last checked: {last_checked}")
+    last_compile = (
+        status.last_successful_compile_at.isoformat()
+        if status.last_successful_compile_at
+        else "never"
+    )
+    click.echo(f"Last successful compile: {last_compile}")
+    if status.last_error_code is not None:
+        last_error_at = status.last_error_at.isoformat() if status.last_error_at else "unknown"
+        click.echo(f"Last error: {status.last_error_code} at {last_error_at}")
+    click.echo("Effective: not verified; use Claude /status or claude doctor")
+
+
+def _policy_apply_message(result: ApplyResult) -> str:
+    if result.action == "coalesced":
+        return "Policy reconciliation already running"
+    if result.action == "no_policy":
+        return "Fleet has no published policy; existing managed policy was retained"
+    if result.revision is None:
+        return f"Policy reconciliation {result.action}"
+    return f"{result.action.capitalize()} policy revision {result.revision}"
+
+
 @sync.command()
 @click.option(
     "--kind",

stacktrace_cli/remote/client.py

@@ -136,6 +136,12 @@ class MeResult:
     token: TokenResult
 
 
+@dataclass(frozen=True)
+class PolicyEnvelope:
+    document: JsonObject | None
+    revision: int
+
+
 @dataclass(frozen=True)
 class AgentStatusResult:
     """One agent kind composed on an asset.
@@ -245,12 +251,23 @@ class RemoteClient:
             ),
         )
 
-    def get_policy_document(self) -> JsonObject | None:
+    def get_policy_envelope(self) -> PolicyEnvelope:
         data = self._request("GET", "/api/v1/policy")
-        document = data.get("document")
+        if "document" not in data:
+            raise RemoteClientError("remote backend response has invalid document field")
+        document = data["document"]
         if document is not None and not isinstance(document, dict):
             raise RemoteClientError("remote backend response has invalid document field")
-        return document
+        revision = data.get("revision")
+        if isinstance(revision, bool) or not isinstance(revision, int) or revision < 0:
+            raise RemoteClientError("remote backend response has invalid revision field")
+        if (document is None) != (revision == 0):
+            raise RemoteClientError("remote backend response has invalid document field")
+        return PolicyEnvelope(document=document, revision=revision)
+
+    def get_policy_document(self) -> JsonObject | None:
+        """Compatibility surface for the manual one-shot compiler."""
+        return self.get_policy_envelope().document
 
     def get_asset(self, asset_id: str) -> AssetStatusResult:
         data = self._request("GET", f"/api/v1/assets/{asset_id}")
@@ -341,7 +358,7 @@ def _required_object(data: JsonObject, key: str) -> JsonObject:
 
 def _required_str(data: JsonObject, key: str) -> str:
     value = data.get(key)
-    if not isinstance(value, str):
+    if not isinstance(value, str) or not value:
         raise RemoteClientError(f"remote backend response missing string field: {key}")
     return value