chhhee10 · Sep 29, 2026 · Sep 29, 2026 · Sep 29, 2026 · Sep 29, 2026 · Sep 29, 2026
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -21,16 +21,44 @@ Action needed if you use `instruct` policies with Hermes: an `instruct` no longe
 
 ### Features
 
+- Cloud-managed assignments can target integrations or individual agent profiles. The daemon keeps an owner-only, stable profile roster and reports it to FailproofAI Cloud; scoped schema-3 deployments filter JavaScript before import and send agent identity for Cloud Jev selection. `fp fleet deploy --target POLICY=INTEGRATION[/agt_ID]` narrows a machine assignment; `--all-agents POLICY` clears its scope.
+- A machine's agent roster holds up to 256 profiles (previously 64). When it is full, a newly hooked profile takes the slot of an unhooked profile that FailproofAI Cloud confirms no assignment names and it would not accept as a target. A profile an exact target uses keeps its ID, Jev-only assignments count, and a hook sighting waits in memory until it gets a slot. (#873)
+- The CLI, daemon and native Hermes plugin now use local daemon protocol v2 for agent-profile identity. After upgrading the CLI, reinstall/restart the daemon with `failproofai config` before resuming hook evaluation; an older daemon's response is rejected rather than silently losing the selected profile.
+- Newly installed shell hooks and OpenCode shims identify the user, project or local settings scope that launched them. When a legacy or package-level hook cannot prove its source, a scoped Cloud assignment is withheld and `agent_scope_unresolved` is reported rather than using the daemon worker's own environment as the agent's identity.
 - Uploads, `fp` calls and evaluator calls carry a request id; the daemon also sends batch and machine ids, and `fp` errors show a `ref` (#872)
-
-### Fixes
+- **Jev policies deploy from FailproofAI Cloud, individually, and run there.** A Cloud policy has a kind — `regex` (JavaScript, as before), `jev` (Jev checks only) or `both` (JavaScript reviewable by its own checks). Jev checks run on FailproofAI Cloud; nothing is installed on the machine: the daemon receives a `both` policy's JavaScript (with the server-derived `authority`/`reviewedBy`) and the machine's Jev mode, and nothing else Jev-related. `failproofai policies` lists `both` policies with the Cloud checks that review them.
+- **FailproofAI Cloud can set a machine's Jev mode.** `off` switches Jev off whatever `jev.json` says. `observe`/`enforce` send every gated tool call to FailproofAI Cloud on the machine's Cloud Jev credential (`jev.json` is not used): the machine's own questions — the global intent questions always, plus its installed packs' checks — and a `cloud` block of tool-call metadata; Cloud asks its checks for that machine in the same request and returns their verdict, which the machine merges with its packs' (Cloud first, most severe wins) before the regex combine. A `both` policy is cleared only by its own Cloud checks' outcomes, never by a pack's check of the same name. Cloud gets 5 s to answer (a local `jev.json` keeps its own timeout); a Cloud failure or timeout is today's fallback: the regex decides alone. A session pause does not stop Cloud's checks, as it never stopped Cloud JS policies: a paused session's calls still go to FailproofAI Cloud, with no installed pack's check in them. `failproofai jev status` says "Jev checks run on FailproofAI Cloud (mode: …)" and names each `both` policy's Cloud reviewers.
+- **Machines report the Cloud policies they could not apply.** A Cloud JS policy that fails to load, a Cloud Jev mode the machine cannot act on (`jev_unconfigured`: no Cloud Jev credential; `transcripts_disabled`: connected with `--no-transcripts`, which never asks), and an installed pack's check FailproofAI Cloud left out of a request for the question budget (`jev_budget: dropped <name>`, kept for the deployment it happened under in `cloud-policies/jev-budget.json`) are written to `cloud-policies/errors.json` and sent on the daemon's next poll (`policyErrors`), so the fleet page and `fp fleet show` list them. `config --disconnect` clears the reports with the deployment.
+- `fp policies publish --kind regex|jev|both [--source] [--semantic]`, `fp fleet deploy --jev-mode off|observe|enforce|local`, and `fp fleet jev-mode <machine…|--all> <mode>`, which changes only the mode; `fp policies list/show` print the kind and Jev check names, `fp fleet list/show` the machine's Jev mode and reported policy errors, `fp fleet history` each generation's Jev mode, and `fp fleet rollback` the Jev mode it restores.
+
+### Fixes
+
+- A cached policy repair now rechecks Cloud enrolment before writing state. A disconnect landing after the daemon read its desired-state snapshot cannot restore that organization's active deployment during post-poll repair.
+- Locally decided inert Jev calls and cached answers no longer count as fresh Cloud health successes. They cannot clear an outage streak or close the Cloud Jev circuit breaker without a successful Cloud response.
+- `failproofai config --disconnect` now sticks: the daemon's snapshot (`desired-state.json`) goes with `active.json`, the daemon no longer rebuilds `active.json` on a machine that is not enrolled, a poll in flight during the disconnect is discarded, and a machine put back on OSS has any leftover Cloud deployment removed. Before, the old org's policies and Jev mode came back within one maintenance interval. That cleanup runs only in the default cloud policy directory, never in one `FAILPROOFAI_CLOUD_POLICY_DIR` names.
+- An observed `both` policy, whose Jev half FailproofAI Cloud does not ask, registers hard, and `jev status` does not count it reviewable.
+- On-machine delivery of Cloud Jev checks, from earlier builds of this release, is gone: a `semanticPolicies` list from a server is ignored and never fetched, and one left in an `active.json` is dropped on read, so the machine keeps enforcing.
+- Policy error reports carry no local paths: the home directory becomes `~` and other absolute paths their last segment, on the CLI and again in the daemon, including a path after `:` such as `file:///tmp/x.mjs` (a URL's `//host` is left alone).
+- An artifact fetch that never got an HTTP answer no longer shows as a policy error for a poll or two.
+- A FailproofAI Cloud-side fix shows on the fleet page at the daemon's next poll, not the machine's next tool call: `policyErrors` leaves out `errors.json` entries about a policy no longer deployed (or deployed at another version), and a `jev_unconfigured`, `transcripts_disabled` or pack budget drop once Cloud's Jev mode no longer asks.
+- The hook path reads `active.json` and the Cloud Jev credential once per change of those files, not several times per tool call.
+- `failproofai policies` still lists the Cloud section when the Cloud JavaScript could not be read but a Jev mode is set; a machine whose deployment carries only a Jev mode records its Cloud deployment on activity rows.
+- **A failing or rate-limited FailproofAI Cloud Jev is no longer silent, and no longer slows every tool call.** After 3 Cloud Jev failures in a row (timeout, no connection, a 5xx, an unusable reply) the machine skips Cloud Jev for 60 s, deciding by the regex alone, then lets one call through; an answer closes it again. A 429 is not a failure (its Retry-After is honoured as before). `errors.json` reports `jev_unavailable: …` while the breaker is open and `jev_rate_limited: <n> calls fell back to regex in the last 10 min` while FailproofAI Cloud refuses calls for the organization's Jev rate limit; both clear once a call is answered, and the daemon stops sending them once Cloud's mode no longer asks.
+- An installed pack's check FailproofAI Cloud dropped because an organization Cloud check has its name is reported as `jev_name_clash: <name> (the FailproofAI Cloud check is used)`, not as a budget drop.
+- A pack check's `jev_budget` / `jev_name_clash` report clears at the daemon's next poll once Cloud redeploys the machine, changes its Jev mode, or the pack is uninstalled, instead of at the machine's next tool call.
+- `config --pause` says FailproofAI Cloud's Jev checks keep running during a pause, as Cloud-managed policies do. A known inert tool (TodoWrite, Task) under a Cloud Jev mode is answered from its name before any envelope is built; an overlong reason in FailproofAI Cloud's reply is cut, not refused; and the daemon removes the Jev check files an earlier build of this release left in `cloud-policies/artifacts/` at the next activation.
+- `config --connect … --no-transcripts` (and `config --token … --no-transcripts`) removes a `jev.json` that runs Jev through FailproofAI Cloud, by the rule `config --disconnect` uses (a BYOK file, or a Cloud one switched off, stays), and says in one line that Jev via FailproofAI Cloud stays off on this machine. Before, a file left by an earlier connection with transcripts on kept sending each checked tool call to FailproofAI Cloud.
+- A change to the CLI's Jev selection, questions or decision now fails a test until FailproofAI Cloud's port of them is updated with it: the parity fixtures Cloud is pinned by (`__tests__/fixtures/cloud-jev/`, with their generator) are replayed through the current code.
+- **Redacting secrets from the `cloud` block can no longer make FailproofAI Cloud clear a check the machine would not.** Cloud's target checks compare the call's targets with the human's words by substring, and a redaction marker could name a target (`<redacted:assigned secret>` named `./secret`) or hide one the human did name. The machine now runs those checks on both the redacted block and the unredacted call and, where they differ, sends the scan incomplete, which clears nothing; the human's redacted words carry a letter-free placeholder, and a block cut for size keeps a sign that a human spoke.
 
 - The daemon logs each failed upload attempt at warning level with its request id and batch id, so every attempt of a batch can be found; before, only the last one was visible (#872)
 - Parking a failed batch works when the spool and state directories are on different filesystems (e.g. separate Docker volumes); before, the batch stayed in the spool and was re-sent on every sweep. The move is crash-safe: the original is deleted only after the copy's directory entry is on disk (#872)
 
 ### Docs
 
 - Troubleshooting, HTTP API and Cloud CLI pages explain the `ref` / `request_id` to quote to support, and where the daemon logs them (#872)
+- `crates/CLOUD_POLICIES.md` documents the Jev mode and `both` fields of desired-state and `active.json`, how the machine calls FailproofAI Cloud Jev, and the `policyErrors` report, and its stale `cloud-managed/`, `deployments/` and `cloud.json` names are fixed; the Cloud CLI reference, the deploy guide and the FailproofAI Cloud Jev page cover Jev policies, which run on FailproofAI Cloud, and the Cloud-set Jev mode.
+- The FailproofAI Cloud Jev docs (`crates/CLOUD_POLICIES.md`, the Cloud Jev page, the deploy guide) give the 5 s Cloud wait, say a session pause does not stop FailproofAI Cloud's Jev checks, describe the circuit breaker, and list `jev_rate_limited`, `jev_unavailable` and `jev_name_clash`.
 
 ### Dependencies
 

diff --git a/__tests__/e2e/helpers/hook-runner.ts b/__tests__/e2e/helpers/hook-runner.ts
@@ -40,7 +40,12 @@ export interface HookRunResult {
 export function runHook(
   event: string,
   payload: Record<string, unknown>,
-  opts?: { homeDir?: string; cli?: "claude" | "codex" | "copilot" | "cursor" | "opencode" | "pi" | "hermes" | "openclaw" | "factory" | "devin" | "antigravity" | "goose" },
+  opts?: {
+    homeDir?: string;
+    cwd?: string;
+    agentScope?: "user" | "project" | "local";
+    cli?: "claude" | "codex" | "copilot" | "cursor" | "opencode" | "pi" | "hermes" | "openclaw" | "factory" | "devin" | "antigravity" | "goose";
+  },
 ): HookRunResult {
   const binaryPath = getBinaryPath();
 
@@ -57,9 +62,11 @@ export function runHook(
 
   const args = [binaryPath, "--hook", event];
   if (opts?.cli) args.push("--cli", opts.cli);
+  if (opts?.agentScope) args.push("--agent-scope", opts.agentScope);
   const result = spawnSync("bun", args, {
     input: JSON.stringify(payload),
     env,
+    cwd: opts?.cwd,
     encoding: "utf8",
     timeout: 15_000,
   });

diff --git a/__tests__/e2e/hooks/agent-scoped-policies.e2e.test.ts b/__tests__/e2e/hooks/agent-scoped-policies.e2e.test.ts
@@ -0,0 +1,78 @@
+// @vitest-environment node
+import { describe, expect, it } from "vitest";
+import { createHash } from "node:crypto";
+import { chmodSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { createFixtureEnv } from "../helpers/fixture-env";
+import { assertAllow, assertPreToolUseDeny, runHook } from "../helpers/hook-runner";
+
+describe("real CLI hook distinguishes simultaneous project and user profiles", () => {
+  it("applies targeted Cloud JS only when the installed hook carries its actual settings scope", () => {
+    const fixture = createFixtureEnv();
+    const projectSettings = join(fixture.cwd, ".claude", "settings.json");
+    const userSettings = join(fixture.home, ".claude", "settings.json");
+    mkdirSync(join(fixture.cwd, ".claude"), { recursive: true });
+    mkdirSync(join(fixture.home, ".claude"), { recursive: true });
+    writeFileSync(projectSettings, '{"hooks":"failproofai --hook PreToolUse --agent-scope project"}');
+    writeFileSync(userSettings, '{"hooks":"failproofai --hook PreToolUse --agent-scope user"}');
+
+    const fpHome = join(fixture.home, ".failproofai");
+    const rosterDir = join(fpHome, "agents");
+    mkdirSync(rosterDir, { recursive: true });
+    const projectId = "agt_1234567890abcdef";
+    const userId = "agt_abcdef1234567890";
+    const roster = join(rosterDir, "roster.json");
+    writeFileSync(roster, JSON.stringify({
+      schemaVersion: 1, generation: 2,
+      agents: [
+        { integration: "claude", instanceId: projectId, settingsPath: projectSettings,
+          profileLabel: "project", scope: "project", hookInstalled: true },
+        { integration: "claude", instanceId: userId, settingsPath: userSettings,
+          profileLabel: "user", scope: "user", hookInstalled: true },
+      ],
+    }), { mode: 0o600 });
+    chmodSync(roster, 0o600);
+
+    const cloudDir = join(fpHome, "policies", "cloud-policies");
+    mkdirSync(join(cloudDir, "artifacts"), { recursive: true });
+    const source = `import { customPolicies, deny } from "failproofai";
+customPolicies.add({
+  name: "only-project", description: "Only this installation",
+  match: { events: ["PreToolUse"] },
+  fn: async () => deny("project agent"),
+});`;
+    const digest = createHash("sha256").update(source).digest("hex");
+    const artifact = `artifacts/${digest}.mjs`;
+    writeFileSync(join(cloudDir, artifact), source);
+    writeFileSync(join(cloudDir, "active.json"), JSON.stringify({
+      schemaVersion: 3, deployment: 1,
+      policies: [{
+        id: "scope-check", version: 1, sha256: digest, path: artifact, effect: "enforce",
+        agentTargets: [{ integration: "claude", instanceId: projectId }],
+      }],
+    }));
+
+    const payload = {
+      session_id: "scope-test", hook_event_name: "PreToolUse",
+      tool_name: "Bash", tool_input: { command: "ls" }, cwd: fixture.cwd,
+    };
+    const project = runHook("PreToolUse", payload, {
+      homeDir: fixture.home, cwd: fixture.cwd, agentScope: "project",
+    });
+    assertPreToolUseDeny(project);
+
+    const user = runHook("PreToolUse", payload, {
+      homeDir: fixture.home, cwd: fixture.cwd, agentScope: "user",
+    });
+    assertAllow(user);
+
+    const legacyAmbiguous = runHook("PreToolUse", payload, {
+      homeDir: fixture.home, cwd: fixture.cwd,
+    });
+    assertAllow(legacyAmbiguous);
+    const report = JSON.parse(readFileSync(join(cloudDir, "errors.json"), "utf8"));
+    expect(report.errors).toContainEqual(expect.objectContaining({
+      id: "agentScope", message: expect.stringContaining("agent_scope_unresolved"),
+    }));
+  });
+});
diff --git a/__tests__/fixtures/agent-targets.json b/__tests__/fixtures/agent-targets.json
@@ -0,0 +1,18 @@
+{
+  "cases": [
+    {"name":"unscoped", "schemaVersion":2, "targets":null, "agent":null, "valid":true, "matches":true},
+    {"name":"integration-all-profiles", "schemaVersion":3, "targets":[{"integration":"claude"}], "agent":{"integration":"claude","instanceId":"agt_1111111111111111"}, "valid":true, "matches":true},
+    {"name":"integration-other-agent", "schemaVersion":3, "targets":[{"integration":"claude"}], "agent":{"integration":"codex","instanceId":"agt_1111111111111111"}, "valid":true, "matches":false},
+    {"name":"profile-exact", "schemaVersion":3, "targets":[{"integration":"hermes","instanceId":"agt_2222222222222222"}], "agent":{"integration":"hermes","instanceId":"agt_2222222222222222"}, "valid":true, "matches":true},
+    {"name":"profile-other-instance", "schemaVersion":3, "targets":[{"integration":"hermes","instanceId":"agt_2222222222222222"}], "agent":{"integration":"hermes","instanceId":"agt_3333333333333333"}, "valid":true, "matches":false},
+    {"name":"profile-other-integration", "schemaVersion":3, "targets":[{"integration":"hermes","instanceId":"agt_2222222222222222"}], "agent":{"integration":"codex","instanceId":"agt_2222222222222222"}, "valid":true, "matches":false},
+    {"name":"scope-unresolved", "schemaVersion":3, "targets":[{"integration":"codex"}], "agent":null, "valid":true, "matches":false},
+    {"name":"or-combination", "schemaVersion":3, "targets":[{"integration":"claude"},{"integration":"hermes","instanceId":"agt_2222222222222222"}], "agent":{"integration":"hermes","instanceId":"agt_2222222222222222"}, "valid":true, "matches":true},
+    {"name":"both-halves-same-scope", "schemaVersion":3, "targets":[{"integration":"codex"}], "agent":{"integration":"codex","instanceId":"agt_4444444444444444"}, "valid":true, "matches":true},
+    {"name":"empty-array", "schemaVersion":3, "targets":[], "agent":null, "valid":false},
+    {"name":"duplicate-selector", "schemaVersion":3, "targets":[{"integration":"codex"},{"integration":"codex"}], "agent":null, "valid":false},
+    {"name":"unknown-integration", "schemaVersion":3, "targets":[{"integration":"invented"}], "agent":null, "valid":false},
+    {"name":"invalid-profile-id", "schemaVersion":3, "targets":[{"integration":"hermes","instanceId":"bad"}], "agent":null, "valid":false},
+    {"name":"scoped-in-schema-two", "schemaVersion":2, "targets":[{"integration":"claude"}], "agent":null, "valid":false}
+  ]
+}
diff --git a/__tests__/fixtures/cloud-jev/README.md b/__tests__/fixtures/cloud-jev/README.md
@@ -0,0 +1,39 @@
+# FailproofAI Cloud Jev fixtures
+
+Shared with the FailproofAI Cloud server (agenteye `server/tests/fixtures/cloud_jev/`).
+**The copies in both repos must be byte-identical.** Nothing in either CI can compare
+them across repos, so each repo pins their sha256 in a test (here
+`__tests__/hooks/cloud-jev-parity.test.ts`, there `server/src/jev_select.rs`
+`fixture_copies_match_the_cli_repo`), and the two pins must match.
+
+| file | what it pins |
+|---|---|
+| `semantic-valid.json`, `semantic-invalid.json` | Cloud's publish validation of a Jev declaration mirrors `parsePackSemanticPolicy` |
+| `semantic-valid-chars.json` | Cloud's budget count mirrors `questionChars` |
+| `decide-parity.json` | Cloud's port of `scanTargets` + `decide` (v0) / `decideV1` (v1): 2,200 cases |
+| `compile-parity.json` | Cloud's port of `compileRequest`'s per-policy questions and `questionChars` |
+| `select-parity.json` | Cloud's port of `selectPolicies` and the preconditions |
+| `target-scan-cases.json` | the machine's `cloud` block `targetScan` (this repo only) |
+
+The three `*-parity.json` files are generated by RUNNING this repo's TypeScript:
+`generators/run.sh` (bun; a throwaway `HOME`; deterministic). They are replayed
+through the current code by `__tests__/hooks/cloud-jev-parity.test.ts`, so a
+behaviour change to that path fails a test here. When the change is intended, in
+the same change:
+
+1. run `generators/run.sh`;
+2. copy the three files byte for byte into agenteye `server/tests/fixtures/cloud_jev/`;
+3. update the sha256 pins in both repos;
+4. port the change to agenteye `server/src/jev_select.rs`, `jev_decide.rs` and `jev_cloud.rs`.
+
+Current sha256:
+
+```
+1b38d72111e8861ee7c8ff0963b32936c57bcd3505ff0ec46722920dba1c0140  decide-parity.json
+a3cf1194ae5b09c8a4ffbbc4515b1a7f4bd27ef317921ff7b788602c0e20c998  compile-parity.json
+4231c78e435959d989181e2272a3c447af4f4264e31e45a537b9a45a3525a933  select-parity.json
+```
+
+Each file's `source` records the commit and source hashes it was generated from.
+A later comment-only change to those sources does not require regenerating: the
+replay test is the check, not the hashes.