FailproofAI 1.0.12

FailproofAI 1.0.12

Log in to FailproofAI Cloud from your browser, and run Jev policies on FailproofAI Cloud, scoped to the agents you choose.

New

• Log in from failproofai config. On a machine that isn't connected, config opens a browser login straight away. Sign up or sign in, pick or create an organization, and authorize the machine; the terminal notices by itself and shows who approved it and for which organization.

  • Over SSH or with no display, it prints the link to open on any device.
  • The machine's key is created only when setup finishes, so an abandoned run leaves no key behind.
  • A machine that's already connected gets a menu with "keep" first, so running setup again never opens a browser on its own.
  • Prefer a key? Press Tab to paste an API key, or to use open source.

• Every agent on the machine knows FailproofAI. config adds a small failproofai skill to each agent it finds: Claude Code, Codex, Copilot, Cursor, OpenCode, Pi, every Hermes and OpenClaw profile, droid, Devin, Antigravity and Goose. It points the agent at the FailproofAI skills on GitHub, so what it reads is always current. A failproofai skill you installed yourself is left alone, and failproofai uninstall removes only the ones config wrote.

• Jev policies from FailproofAI Cloud. A Cloud policy now has a kind:

  • regex: JavaScript, as before;
  • jev: Jev checks only;
  • both: JavaScript that its own Jev checks can review.

  Jev checks run on FailproofAI Cloud, so nothing Jev-related is installed on the machine. FailproofAI Cloud sets each machine's Jev mode: enforce while a Jev policy is deployed, off when none is. A policy you set to watch (observe) records what it would have done and never blocks.

• Policies scoped to agents. Deploy a Cloud policy to one integration or to a single agent profile instead of the whole machine. The daemon keeps a roster of the agent profiles it has seen (up to 256) and reports it to FailproofAI Cloud.

• Machines report the Cloud policies they couldn't apply. A policy that failed to load, a Jev mode the machine can't act on, or a pack check dropped for the question budget shows up on the fleet page and in fp fleet show.

• fp, for Cloud policies:

  • fp policies publish --kind regex|jev|both;
  • per-assignment block / watch;
  • fp fleet deploy --target POLICY=INTEGRATION[/agent] and --all-agents POLICY;
  • fp fleet history and fp fleet rollback include each deployment's Jev mode.

Fixed

• A FailproofAI Cloud Jev reply that contradicts itself can't clear a both policy's regex denial. A malformed reply is ignored, and the regex decides alone.
• Redacting secrets can't make FailproofAI Cloud clear a check the machine wouldn't. Where redaction changes what a check sees, the machine marks the scan incomplete, which clears nothing.
• A failing or rate-limited FailproofAI Cloud Jev is no longer silent and no longer slows every tool call. After 3 failures in a row, the machine decides by regex alone for 60 seconds, then tries again. Outages and rate limits are reported on the fleet page.
• config --disconnect sticks. Before, the old organization's policies and Jev mode could come back within minutes.
• Reconnecting the same organization on a new address is a reconnect, not an organization switch. One example is moving from http to https with the same key.
• Keys refused earlier are retried with the current key without stalling new uploads, and nothing in a refused batch is lost.
• Browser login handles the edge cases:
  • an approved login whose key couldn't be claimed;
  • a saved key that stopped working;
  • an expired link, which is taken off the screen when a new one prints;
  • a FailproofAI Cloud without browser login, where you paste a key instead.
• config asks for your sudo password again before installing the daemon if the first one expired while you were answering.
• Profile-aware hooks. policies --install for Claude Code and Codex writes to the profile in CLAUDE_CONFIG_DIR / CODEX_HOME, the same place the hook reads.
• Policy error reports carry no local paths.

Good to know

• Restart the daemon after upgrading. The CLI, daemon and Hermes plugin use a new local protocol to carry agent identity. Run failproofai config once, which reinstalls and restarts the daemon, before your agents resume. An older daemon's answers are refused rather than silently losing the agent profile.
• Jev and agent-scoped policies need 1.0.12 on the machine. On 1.0.11 a jev-only policy silently does nothing. Upgrade every machine you deploy them to.
• Cloud features need an up-to-date FailproofAI Cloud. Browser login, Cloud Jev policies and agent scoping work with FailproofAI Cloud as of this release. An older self-hosted Cloud says browser login is unavailable, and pasting a key still works.
• Plain http is accepted only for a loopback address (localhost, 127.0.0.1, ::1), for testing against a local FailproofAI Cloud.

FailproofAI Cloud

• Cloud-managed Jev and hybrid policies. Write regex, jev or both policies in the policy editor (or let the assistant draft and backtest them), publish them, and deploy them per machine and per agent. Activity shows each check Jev asked, with its verdict and why.
• Authorize a machine in the browser. The config login link opens FailproofAI Cloud, where you sign in, pick or create an organization, and approve the machine. The key it creates is labelled as a CLI login.

Dependencies

• Security updates across the lockfiles: undici, zod, vite, vitest, rustls-webpki, webpki-roots, certifi, aiohttp, mcp, uv, pillow, setuptools and filelock.
• fpai-collect builds without SQLite when its default features are off. The daemon's default build is unchanged.

---