From 71a7b2269d86571623ea866f26fa523e62507eea Mon Sep 17 00:00:00 2001 From: chhhee10 Date: Mon, 2 Nov 2026 16:16:09 +0530 Subject: [PATCH 1/3] feat(fp-cli): policies:read|write are now fixes:read|write; docs for code fixes Pairs with feat/fix-loop in the AgentEye repo, which must merge first. The CLI still accepts the old names and sends the new ones. Public docs: the new scope names, and a page on code fixes. Co-Authored-By: Claude Opus 5.5 --- docs/admin/keys-and-permissions.mdx | 2 +- docs/ar/admin/keys-and-permissions.mdx | 2 +- docs/ar/policies/editor.mdx | 2 +- docs/ar/policies/rollback.mdx | 2 +- docs/ar/reference/cloud-cli.mdx | 2 +- docs/audits/code-fixes.mdx | 25 +++++++++++++++++++ docs/de/admin/keys-and-permissions.mdx | 2 +- docs/de/policies/editor.mdx | 2 +- docs/de/policies/rollback.mdx | 2 +- docs/de/reference/cloud-cli.mdx | 2 +- docs/docs.json | 3 ++- docs/es/admin/keys-and-permissions.mdx | 2 +- docs/es/policies/editor.mdx | 2 +- docs/es/policies/rollback.mdx | 2 +- docs/es/reference/cloud-cli.mdx | 2 +- docs/fr/admin/keys-and-permissions.mdx | 2 +- docs/fr/policies/editor.mdx | 2 +- docs/fr/policies/rollback.mdx | 2 +- docs/fr/reference/cloud-cli.mdx | 2 +- docs/he/admin/keys-and-permissions.mdx | 2 +- docs/he/policies/editor.mdx | 2 +- docs/he/policies/rollback.mdx | 2 +- docs/he/reference/cloud-cli.mdx | 2 +- docs/hi/admin/keys-and-permissions.mdx | 2 +- docs/hi/policies/editor.mdx | 2 +- docs/hi/policies/rollback.mdx | 2 +- docs/hi/reference/cloud-cli.mdx | 2 +- docs/it/admin/keys-and-permissions.mdx | 2 +- docs/it/policies/editor.mdx | 2 +- docs/it/policies/rollback.mdx | 2 +- docs/it/reference/cloud-cli.mdx | 2 +- docs/ja/admin/keys-and-permissions.mdx | 2 +- docs/ja/policies/editor.mdx | 2 +- docs/ja/policies/rollback.mdx | 2 +- docs/ja/reference/cloud-cli.mdx | 2 +- docs/ko/admin/keys-and-permissions.mdx | 2 +- docs/ko/policies/editor.mdx | 2 +- docs/ko/policies/rollback.mdx | 2 +- docs/ko/reference/cloud-cli.mdx | 2 +- docs/policies/editor.mdx | 2 +- docs/policies/rollback.mdx | 2 +- docs/pt-br/admin/keys-and-permissions.mdx | 2 +- docs/pt-br/policies/editor.mdx | 2 +- docs/pt-br/policies/rollback.mdx | 2 +- docs/pt-br/reference/cloud-cli.mdx | 2 +- docs/reference/cloud-cli.mdx | 2 +- docs/ru/admin/keys-and-permissions.mdx | 2 +- docs/ru/policies/editor.mdx | 2 +- docs/ru/policies/rollback.mdx | 2 +- docs/ru/reference/cloud-cli.mdx | 2 +- docs/tr/admin/keys-and-permissions.mdx | 2 +- docs/tr/policies/editor.mdx | 2 +- docs/tr/policies/rollback.mdx | 2 +- docs/tr/reference/cloud-cli.mdx | 2 +- docs/vi/admin/keys-and-permissions.mdx | 2 +- docs/vi/policies/editor.mdx | 2 +- docs/vi/policies/rollback.mdx | 2 +- docs/vi/reference/cloud-cli.mdx | 2 +- docs/zh/admin/keys-and-permissions.mdx | 2 +- docs/zh/policies/editor.mdx | 2 +- docs/zh/policies/rollback.mdx | 2 +- docs/zh/reference/cloud-cli.mdx | 2 +- fp-cloud-cli/fp_cli/client.py | 2 +- fp-cloud-cli/fp_cli/commands/fleet_cmds.py | 16 ++++++------ .../fp_cli/commands/guardrails_cmds.py | 4 +-- fp-cloud-cli/fp_cli/commands/policies_cmds.py | 22 ++++++++-------- fp-cloud-cli/fp_cli/permissions.py | 7 ++++-- fp-cloud-cli/skill/references/commands.md | 8 +++--- fp-cloud-cli/tests/test_cloud_human_views.py | 2 +- fp-cloud-cli/tests/test_keys_queries.py | 8 +++--- 70 files changed, 123 insertions(+), 94 deletions(-) create mode 100644 docs/audits/code-fixes.mdx diff --git a/docs/admin/keys-and-permissions.mdx b/docs/admin/keys-and-permissions.mdx index df4475245..be590263e 100644 --- a/docs/admin/keys-and-permissions.mdx +++ b/docs/admin/keys-and-permissions.mdx @@ -64,7 +64,7 @@ Key secrets are shown when created or regenerated. Store them in a secret manage | Alerts | `alerts:read`, `alerts:write` | | Issues | `issues:read`, `issues:create`, `issues:close` | | Audits | `audits:read`, `audits:write` | -| Policies | `policies:read`, `policies:write`, `policies:pull` | +| Policies | `fixes:read`, `fixes:write`, `policies:pull` | | Usage | `usage:read` | | Jev | `jev:evaluate` (requires `events:add` and `policies:pull`) | diff --git a/docs/ar/admin/keys-and-permissions.mdx b/docs/ar/admin/keys-and-permissions.mdx index 43a40efc3..ebc8db889 100644 --- a/docs/ar/admin/keys-and-permissions.mdx +++ b/docs/ar/admin/keys-and-permissions.mdx @@ -62,7 +62,7 @@ icon: "key-round" | التنبيهات | `alerts:read`, `alerts:write` | | المشاكل | `issues:read`, `issues:create`, `issues:close` | | عمليات التدقيق | `audits:read`, `audits:write` | -| السياسات | `policies:read`, `policies:write`, `policies:pull` | +| السياسات | `fixes:read`, `fixes:write`, `policies:pull` | | الاستخدام | `usage:read` | `orgs:admin` محجوز لمشغل المثيل ولا يمكن منحه لمفتاح تنظيمي أو عضو عادي. يتم قبول الرموز المتقاعدة `incidents:*` و `alerts:ack` للتوافق وتطبيعها على أذونات `issues:*` الحالية. diff --git a/docs/ar/policies/editor.mdx b/docs/ar/policies/editor.mdx index e0e244339..ba2f8d750 100644 --- a/docs/ar/policies/editor.mdx +++ b/docs/ar/policies/editor.mdx @@ -33,7 +33,7 @@ icon: "file-pen-line" fp policies compose "Block git push --force on release branches" ``` - يتطلب `compose` جلسة موقعة (`fp login`) دورها لديه `policies:write`؛ يرفض مفاتيح API. + يتطلب `compose` جلسة موقعة (`fp login`) دورها لديه `fixes:write`؛ يرفض مفاتيح API. diff --git a/docs/ar/policies/rollback.mdx b/docs/ar/policies/rollback.mdx index c8bcfa146..f3c43c12f 100644 --- a/docs/ar/policies/rollback.mdx +++ b/docs/ar/policies/rollback.mdx @@ -37,7 +37,7 @@ icon: "rotate-ccw" fp fleet rollback ``` - `rollback` ينشئ جيلاً جديداً يحمل المجموعة القديمة بدلاً من إعادة تعيين العداد، لذا يبقى السجل إضافياً فقط، ويرفض جيلاً يسمي سياسة تم تعطيلها أو حذفها. يحتاج إلى جلسة موقعة بـ `policies:write`. `fp fleet diff ` يعرض ما كان مقصوداً مقابل ما طبقه الجهاز — يقرأ كـ `behind` حتى يستفسر الجهاز مرة أخرى — وعلى الجهاز نفسه، `failproofai policies` يعرج النشر الذي يعمل عليه. + `rollback` ينشئ جيلاً جديداً يحمل المجموعة القديمة بدلاً من إعادة تعيين العداد، لذا يبقى السجل إضافياً فقط، ويرفض جيلاً يسمي سياسة تم تعطيلها أو حذفها. يحتاج إلى جلسة موقعة بـ `fixes:write`. `fp fleet diff ` يعرض ما كان مقصوداً مقابل ما طبقه الجهاز — يقرأ كـ `behind` حتى يستفسر الجهاز مرة أخرى — وعلى الجهاز نفسه، `failproofai policies` يعرج النشر الذي يعمل عليه. diff --git a/docs/ar/reference/cloud-cli.mdx b/docs/ar/reference/cloud-cli.mdx index 4ca626e3a..addae288a 100644 --- a/docs/ar/reference/cloud-cli.mdx +++ b/docs/ar/reference/cloud-cli.mdx @@ -329,7 +329,7 @@ fp audits create checkout-reliability \ | `fp policies disable POLICY_ID` | أزلها من كل نشر تحملها، نقيب جيل جديد على كل واحد. | `--yes`, `-y` | | `fp policies delete POLICY_ID` | حذف إصدار سياسة. | `--yes`, `-y` | | `fp policies test PATH` | شغّل سياسة محلياً مقابل سياق تركيبي. تطبق تصفية `match` لكل سياسة، لذلك التي لا تغطي الحدث/الأداة المحددة يتم الإبلاغ عنها `skipped` بدلاً من التشغيل. | `--event`; `--tool`; `--command`; `--file`; `--expect` | -| `fp policies compose PROMPT` | صيغ سياسة مع المساعد. يحتاج `policies:write`. | — | +| `fp policies compose PROMPT` | صيغ سياسة مع المساعد. يحتاج `fixes:write`. | — | ### الأسطول diff --git a/docs/audits/code-fixes.mdx b/docs/audits/code-fixes.mdx new file mode 100644 index 000000000..20e7439a8 --- /dev/null +++ b/docs/audits/code-fixes.mdx @@ -0,0 +1,25 @@ +--- +title: "Code fixes" +description: "Turn an insight into a GitHub issue or a pull request, from the insight itself." +icon: "git-pull-request" +--- + +A policy stops an agent doing the wrong thing. Sometimes the problem is how the agent is built, and the fix belongs in its code. Code fixes finish that loop from the same place you found the problem. + +## From insight to pull request + +When an audit reads the cause of an insight in your agent's code, the insight says a code change can fix it, and why. From **what to do** on any insight, you can: + +- **Create a pull request.** Codex works on a copy of your repository, makes the change and runs what tests it can, then opens a draft pull request for your team to review. +- **Raise a GitHub issue.** The insight's findings go to your repository's issues, for someone on your team to pick up. + +## You review first + +Both start with a draft built from the insight: what went wrong, the likely cause, the rule it breaks and the code involved. You can edit it and add what only you know. Nothing reaches GitHub, and no model runs, until you approve it. + +A pull request is always yours to review, and nothing merges by itself. Follow every fix under **fix › code fixes**. + +## What it needs + +- GitHub connected, with the agent linked to the folder that runs it. +- The `fixes:write` permission to draft and approve, and `fixes:read` to see fixes. These permissions also cover cloud policies. diff --git a/docs/de/admin/keys-and-permissions.mdx b/docs/de/admin/keys-and-permissions.mdx index 99ed8d814..0946f4bc4 100644 --- a/docs/de/admin/keys-and-permissions.mdx +++ b/docs/de/admin/keys-and-permissions.mdx @@ -62,7 +62,7 @@ Schlüssel-Secrets werden bei der Erstellung oder Regenerierung angezeigt. Speic | Alerts | `alerts:read`, `alerts:write` | | Issues | `issues:read`, `issues:create`, `issues:close` | | Audits | `audits:read`, `audits:write` | -| Policies | `policies:read`, `policies:write`, `policies:pull` | +| Policies | `fixes:read`, `fixes:write`, `policies:pull` | | Usage | `usage:read` | `orgs:admin` ist dem Instanz-Operator vorbehalten und kann weder einem Organisations-Schlüssel noch einem gewöhnlichen Mitglied gewährt werden. Veraltete `incidents:*`- und `alerts:ack`-Token werden aus Kompatibilitätsgründen akzeptiert und auf die aktuellen `issues:*`-Berechtigungen normalisiert. diff --git a/docs/de/policies/editor.mdx b/docs/de/policies/editor.mdx index e14bf1d09..0432133a5 100644 --- a/docs/de/policies/editor.mdx +++ b/docs/de/policies/editor.mdx @@ -33,7 +33,7 @@ Führe einen [Audit](/de/audits/run) über die Sitzungen durch, in denen der Feh fp policies compose "Block git push --force on release branches" ``` - `compose` benötigt eine angemeldete Sitzung (`fp login`), deren Rolle `policies:write` besitzt; API-Keys werden abgelehnt. + `compose` benötigt eine angemeldete Sitzung (`fp login`), deren Rolle `fixes:write` besitzt; API-Keys werden abgelehnt. diff --git a/docs/de/policies/rollback.mdx b/docs/de/policies/rollback.mdx index 5be42ad00..9da579536 100644 --- a/docs/de/policies/rollback.mdx +++ b/docs/de/policies/rollback.mdx @@ -37,7 +37,7 @@ Eine veröffentlichte Richtlinienversion ändert sich nie. Das Bearbeiten einer fp fleet rollback ``` - `rollback` erstellt eine neue Generation mit dem alten Satz, anstatt den Zähler zurückzusetzen, sodass der Verlauf nur erweiterbar bleibt. Es lehnt eine Generation ab, die eine inzwischen deaktivierte oder gelöschte Richtlinie benennt. Der Befehl benötigt eine angemeldete Sitzung mit `policies:write`. `fp fleet diff ` zeigt den Unterschied zwischen dem Beabsichtigten und dem, was die Maschine tatsächlich angewendet hat — der Status erscheint als `behind`, bis die Maschine das nächste Mal abfragt. Auf der Maschine selbst listet `failproofai policies` das aktuell laufende Deployment auf. + `rollback` erstellt eine neue Generation mit dem alten Satz, anstatt den Zähler zurückzusetzen, sodass der Verlauf nur erweiterbar bleibt. Es lehnt eine Generation ab, die eine inzwischen deaktivierte oder gelöschte Richtlinie benennt. Der Befehl benötigt eine angemeldete Sitzung mit `fixes:write`. `fp fleet diff ` zeigt den Unterschied zwischen dem Beabsichtigten und dem, was die Maschine tatsächlich angewendet hat — der Status erscheint als `behind`, bis die Maschine das nächste Mal abfragt. Auf der Maschine selbst listet `failproofai policies` das aktuell laufende Deployment auf. diff --git a/docs/de/reference/cloud-cli.mdx b/docs/de/reference/cloud-cli.mdx index 07de74d08..72f578f26 100644 --- a/docs/de/reference/cloud-cli.mdx +++ b/docs/de/reference/cloud-cli.mdx @@ -329,7 +329,7 @@ Cloud-verwaltete Richtlinienversionen. **Nur Sitzung** — jeder Befehl hier bee | `fp policies disable POLICY_ID` | Aus jedem Deployment entfernen, das sie enthält, und dabei jeweils eine neue Generation erstellen. | `--yes`, `-y` | | `fp policies delete POLICY_ID` | Eine Richtlinienversion löschen. | `--yes`, `-y` | | `fp policies test PATH` | Eine Richtlinie lokal gegen einen synthetischen Kontext testen. Wendet den `match`-Filter jeder Richtlinie an; eine Richtlinie, die das angegebene Event/Tool nicht abdeckt, wird als `skipped` gemeldet statt ausgeführt. | `--event`; `--tool`; `--command`; `--file`; `--expect` | -| `fp policies compose PROMPT` | Eine Richtlinie mit dem Assistenten entwerfen. Erfordert `policies:write`. | — | +| `fp policies compose PROMPT` | Eine Richtlinie mit dem Assistenten entwerfen. Erfordert `fixes:write`. | — | ### Fleet diff --git a/docs/docs.json b/docs/docs.json index 50ddf63e7..c9c7f81be 100644 --- a/docs/docs.json +++ b/docs/docs.json @@ -160,7 +160,8 @@ "audits/cadence", "audits/findings-and-issues", "audits/alerts", - "audits/recipes" + "audits/recipes", + "audits/code-fixes" ] } ] diff --git a/docs/es/admin/keys-and-permissions.mdx b/docs/es/admin/keys-and-permissions.mdx index c49df1938..bef4a2e67 100644 --- a/docs/es/admin/keys-and-permissions.mdx +++ b/docs/es/admin/keys-and-permissions.mdx @@ -62,7 +62,7 @@ Los secretos de las claves se muestran al crearlas o regenerarlas. Guárdalos en | Alertas | `alerts:read`, `alerts:write` | | Incidencias | `issues:read`, `issues:create`, `issues:close` | | Auditorías | `audits:read`, `audits:write` | -| Políticas | `policies:read`, `policies:write`, `policies:pull` | +| Políticas | `fixes:read`, `fixes:write`, `policies:pull` | | Uso | `usage:read` | `orgs:admin` está reservado para el operador de la instancia y no puede concederse a una clave de organización ni a un miembro ordinario. Los tokens retirados `incidents:*` y `alerts:ack` se aceptan por compatibilidad y se normalizan a los permisos actuales `issues:*`. diff --git a/docs/es/policies/editor.mdx b/docs/es/policies/editor.mdx index 07b02f375..5cdfb6587 100644 --- a/docs/es/policies/editor.mdx +++ b/docs/es/policies/editor.mdx @@ -33,7 +33,7 @@ Una auditoría detecta un fallo; una política evita que vuelva a ocurrir. Failp fp policies compose "Block git push --force on release branches" ``` - `compose` requiere una sesión con sesión iniciada (`fp login`) cuyo rol tenga `policies:write`; rechaza las claves de API. + `compose` requiere una sesión con sesión iniciada (`fp login`) cuyo rol tenga `fixes:write`; rechaza las claves de API. diff --git a/docs/es/policies/rollback.mdx b/docs/es/policies/rollback.mdx index 0a0021622..2f149cf83 100644 --- a/docs/es/policies/rollback.mdx +++ b/docs/es/policies/rollback.mdx @@ -37,7 +37,7 @@ Una versión de política publicada nunca cambia. Editar una política y volver fp fleet rollback ``` - `rollback` genera una nueva generación que contiene el conjunto anterior en lugar de retroceder el contador, por lo que el historial permanece solo de adición, y rechaza una generación que nombre una política desactivada o eliminada. Requiere una sesión iniciada con `policies:write`. `fp fleet diff ` muestra lo que se pretendía aplicar frente a lo que la máquina efectivamente aplicó — aparece como `behind` hasta que la máquina vuelva a sondear — y en la propia máquina, `failproofai policies` lista el despliegue que está ejecutando. + `rollback` genera una nueva generación que contiene el conjunto anterior en lugar de retroceder el contador, por lo que el historial permanece solo de adición, y rechaza una generación que nombre una política desactivada o eliminada. Requiere una sesión iniciada con `fixes:write`. `fp fleet diff ` muestra lo que se pretendía aplicar frente a lo que la máquina efectivamente aplicó — aparece como `behind` hasta que la máquina vuelva a sondear — y en la propia máquina, `failproofai policies` lista el despliegue que está ejecutando. diff --git a/docs/es/reference/cloud-cli.mdx b/docs/es/reference/cloud-cli.mdx index 0da00cbc4..9b4198e39 100644 --- a/docs/es/reference/cloud-cli.mdx +++ b/docs/es/reference/cloud-cli.mdx @@ -329,7 +329,7 @@ Versiones de políticas administradas en la nube. **Solo de sesión** — cada c | `fp policies disable POLICY_ID` | La elimina de cada despliegue que la contiene, creando una nueva generación en cada uno. | `--yes`, `-y` | | `fp policies delete POLICY_ID` | Elimina una versión de política. | `--yes`, `-y` | | `fp policies test PATH` | Ejecuta una política localmente contra un contexto sintético. Aplica el filtro `match` de cada política, por lo que una que no cubra el evento/herramienta dado se reporta como `skipped` en lugar de ejecutarse. | `--event`; `--tool`; `--command`; `--file`; `--expect` | -| `fp policies compose PROMPT` | Redacta una política con el asistente. Requiere `policies:write`. | — | +| `fp policies compose PROMPT` | Redacta una política con el asistente. Requiere `fixes:write`. | — | ### Flota diff --git a/docs/fr/admin/keys-and-permissions.mdx b/docs/fr/admin/keys-and-permissions.mdx index 7deb35218..80042777e 100644 --- a/docs/fr/admin/keys-and-permissions.mdx +++ b/docs/fr/admin/keys-and-permissions.mdx @@ -62,7 +62,7 @@ Les secrets de clé sont affichés lors de leur création ou régénération. St | Alertes | `alerts:read`, `alerts:write` | | Problèmes | `issues:read`, `issues:create`, `issues:close` | | Audits | `audits:read`, `audits:write` | -| Politiques | `policies:read`, `policies:write`, `policies:pull` | +| Politiques | `fixes:read`, `fixes:write`, `policies:pull` | | Utilisation | `usage:read` | `orgs:admin` est réservé à l'opérateur de l'instance et ne peut pas être accordé à une clé d'organisation ou à un membre ordinaire. Les jetons `incidents:*` et `alerts:ack` retirés sont acceptés pour des raisons de compatibilité et sont normalisés vers les permissions `issues:*` actuelles. diff --git a/docs/fr/policies/editor.mdx b/docs/fr/policies/editor.mdx index 7da36da50..cdfc77662 100644 --- a/docs/fr/policies/editor.mdx +++ b/docs/fr/policies/editor.mdx @@ -33,7 +33,7 @@ Un audit détecte une défaillance ; une politique empêche qu'elle se reproduis fp policies compose "Block git push --force on release branches" ``` - `compose` nécessite une session connectée (`fp login`) dont le rôle dispose de `policies:write` ; il refuse les clés API. + `compose` nécessite une session connectée (`fp login`) dont le rôle dispose de `fixes:write` ; il refuse les clés API. diff --git a/docs/fr/policies/rollback.mdx b/docs/fr/policies/rollback.mdx index 6c7f43f45..e37cd11b3 100644 --- a/docs/fr/policies/rollback.mdx +++ b/docs/fr/policies/rollback.mdx @@ -37,7 +37,7 @@ Une version de politique publiée ne change jamais. Modifier une politique et la fp fleet rollback ``` - `rollback` crée une nouvelle génération portant l'ancien ensemble plutôt que de rembobiner le compteur, de sorte que l'historique reste en ajout uniquement. Cette commande refuse une génération faisant référence à une politique désactivée ou supprimée. Elle nécessite une session connectée avec `policies:write`. `fp fleet diff ` montre ce qui était prévu par rapport à ce que la machine a appliqué — il s'affiche comme `behind` jusqu'au prochain sondage de la machine — et sur la machine elle-même, `failproofai policies` liste le déploiement en cours d'exécution. + `rollback` crée une nouvelle génération portant l'ancien ensemble plutôt que de rembobiner le compteur, de sorte que l'historique reste en ajout uniquement. Cette commande refuse une génération faisant référence à une politique désactivée ou supprimée. Elle nécessite une session connectée avec `fixes:write`. `fp fleet diff ` montre ce qui était prévu par rapport à ce que la machine a appliqué — il s'affiche comme `behind` jusqu'au prochain sondage de la machine — et sur la machine elle-même, `failproofai policies` liste le déploiement en cours d'exécution. diff --git a/docs/fr/reference/cloud-cli.mdx b/docs/fr/reference/cloud-cli.mdx index ede81d78a..2d6982b74 100644 --- a/docs/fr/reference/cloud-cli.mdx +++ b/docs/fr/reference/cloud-cli.mdx @@ -329,7 +329,7 @@ Versions de politiques gérées depuis le cloud. **Session uniquement** — chaq | `fp policies disable POLICY_ID` | La retirer de chaque déploiement qui la porte, en créant une nouvelle génération sur chacun. | `--yes`, `-y` | | `fp policies delete POLICY_ID` | Supprimer une version de politique. | `--yes`, `-y` | | `fp policies test PATH` | Exécuter une politique localement contre un contexte synthétique. Applique le filtre `match` de chaque politique, donc une politique qui ne couvre pas l'événement/outil donné est signalée comme `skipped` plutôt qu'exécutée. | `--event` ; `--tool` ; `--command` ; `--file` ; `--expect` | -| `fp policies compose PROMPT` | Rédiger une politique avec l'assistant. Nécessite `policies:write`. | — | +| `fp policies compose PROMPT` | Rédiger une politique avec l'assistant. Nécessite `fixes:write`. | — | ### Flotte diff --git a/docs/he/admin/keys-and-permissions.mdx b/docs/he/admin/keys-and-permissions.mdx index 8c2064a7e..54cd17703 100644 --- a/docs/he/admin/keys-and-permissions.mdx +++ b/docs/he/admin/keys-and-permissions.mdx @@ -62,7 +62,7 @@ icon: "key-round" | Alerts | `alerts:read`, `alerts:write` | | Issues | `issues:read`, `issues:create`, `issues:close` | | Audits | `audits:read`, `audits:write` | -| Policies | `policies:read`, `policies:write`, `policies:pull` | +| Policies | `fixes:read`, `fixes:write`, `policies:pull` | | Usage | `usage:read` | `orgs:admin` שמור למפעיל המופע ולא ניתן להעניק למפתח ארגוני או לחבר רגיל. אסימונים `incidents:*` ו-`alerts:ack` מיושנים מתקבלים לתאימות ומנורמלים להרשאות `issues:*` עדכניות. diff --git a/docs/he/policies/editor.mdx b/docs/he/policies/editor.mdx index 83688055e..c93ddf601 100644 --- a/docs/he/policies/editor.mdx +++ b/docs/he/policies/editor.mdx @@ -33,7 +33,7 @@ icon: "file-pen-line" fp policies compose "Block git push --force on release branches" ``` - `compose` דורש session מחובר (`fp login`) שלתפקיד שלו יש הרשאת `policies:write`; מפתחות API נדחים. + `compose` דורש session מחובר (`fp login`) שלתפקיד שלו יש הרשאת `fixes:write`; מפתחות API נדחים. diff --git a/docs/he/policies/rollback.mdx b/docs/he/policies/rollback.mdx index 765544d1a..aa9e987d9 100644 --- a/docs/he/policies/rollback.mdx +++ b/docs/he/policies/rollback.mdx @@ -37,7 +37,7 @@ icon: "rotate-ccw" fp fleet rollback ``` - `rollback` יוצר דור חדש שנושא את הקבוצה הישנה במקום להחזיר את המונה, כך שהיסטוריה נשארת append-only, והוא מסרב לדור שקוראים לו מדיניות מכיוון שהושבתה או נמחקה. זה דורש סשן עם כניסה חתום עם `policies:write`. `fp fleet diff ` מראה מה היה מעוצב לעומת מה שהמכונה יישמה — זה נקרא `behind` עד שהמכונה תסקור בפעם הבאה — ובמכונה עצמה, `failproofai policies` מפרטת את ההצבה שהיא מפעילה. + `rollback` יוצר דור חדש שנושא את הקבוצה הישנה במקום להחזיר את המונה, כך שהיסטוריה נשארת append-only, והוא מסרב לדור שקוראים לו מדיניות מכיוון שהושבתה או נמחקה. זה דורש סשן עם כניסה חתום עם `fixes:write`. `fp fleet diff ` מראה מה היה מעוצב לעומת מה שהמכונה יישמה — זה נקרא `behind` עד שהמכונה תסקור בפעם הבאה — ובמכונה עצמה, `failproofai policies` מפרטת את ההצבה שהיא מפעילה. diff --git a/docs/he/reference/cloud-cli.mdx b/docs/he/reference/cloud-cli.mdx index 06b6d673c..34d718964 100644 --- a/docs/he/reference/cloud-cli.mdx +++ b/docs/he/reference/cloud-cli.mdx @@ -329,7 +329,7 @@ fp audits create checkout-reliability \ | `fp policies disable POLICY_ID` | הסר אותה מכל פריסה שנושאת אותה, הנפקת דור חדש בכל אחד. | `--yes`, `-y` | | `fp policies delete POLICY_ID` | מחיקת גרסת מדיניות. | `--yes`, `-y` | | `fp policies test PATH` | הרצת מדיניות מקומית מול הקשר סינתטי. חל כל מסנן `match` של המדיניות, אז אחד שלא מכסה את האירוע/הכלי הנתון מדווח `skipped` ולא הרץ. | `--event`; `--tool`; `--command`; `--file`; `--expect` | -| `fp policies compose PROMPT` | טיוטת מדיניות עם ה-assistant. צורך `policies:write`. | — | +| `fp policies compose PROMPT` | טיוטת מדיניות עם ה-assistant. צורך `fixes:write`. | — | ### Fleet diff --git a/docs/hi/admin/keys-and-permissions.mdx b/docs/hi/admin/keys-and-permissions.mdx index c1d1bfea3..7aac7fe60 100644 --- a/docs/hi/admin/keys-and-permissions.mdx +++ b/docs/hi/admin/keys-and-permissions.mdx @@ -62,7 +62,7 @@ API कुंजियाँ किसी संगठन से संबंध | Alerts | `alerts:read`, `alerts:write` | | Issues | `issues:read`, `issues:create`, `issues:close` | | Audits | `audits:read`, `audits:write` | -| Policies | `policies:read`, `policies:write`, `policies:pull` | +| Policies | `fixes:read`, `fixes:write`, `policies:pull` | | Usage | `usage:read` | `orgs:admin` इंस्टेंस ऑपरेटर के लिए आरक्षित है और किसी संगठन कुंजी या साधारण सदस्य को प्रदान नहीं किया जा सकता है। सेवानिवृत्त `incidents:*` और `alerts:ack` टोकन अनुकूलता के लिए स्वीकार किए जाते हैं और वर्तमान `issues:*` अनुमतियों को सामान्य करते हैं। diff --git a/docs/hi/policies/editor.mdx b/docs/hi/policies/editor.mdx index 203ad9e3b..e5e4a8874 100644 --- a/docs/hi/policies/editor.mdx +++ b/docs/hi/policies/editor.mdx @@ -33,7 +33,7 @@ icon: "file-pen-line" fp policies compose "Block git push --force on release branches" ``` - `compose` को एक साइन-इन सत्र (`fp login`) की आवश्यकता है जिसकी भूमिका में `policies:write` है; यह API कुंजियों को अस्वीकार करता है। + `compose` को एक साइन-इन सत्र (`fp login`) की आवश्यकता है जिसकी भूमिका में `fixes:write` है; यह API कुंजियों को अस्वीकार करता है। diff --git a/docs/hi/policies/rollback.mdx b/docs/hi/policies/rollback.mdx index 56062420b..db3d86afa 100644 --- a/docs/hi/policies/rollback.mdx +++ b/docs/hi/policies/rollback.mdx @@ -37,7 +37,7 @@ icon: "rotate-ccw" fp fleet rollback ``` - `rollback` काउंटर को वापस न लपेटने के बजाय पुराने सेट को ले जाने वाली एक नई जनरेशन बनाता है, इसलिए इतिहास केवल-जोड़ रहता है, और यह एक जनरेशन से इनकार करता है जो एक ऐसी नीति का नाम देता है जो अक्षम या हटाई गई है। इसे `policies:write` के साथ एक हस्ताक्षरित-में सत्र की आवश्यकता है। `fp fleet diff ` दिखाता है कि क्या लक्षित था मशीन ने जो लागू किया उसके विरुद्ध — यह `behind` के रूप में पढ़ता है जब तक मशीन अगली बार पोल नहीं करती — और मशीन पर ही, `failproofai policies` जनरेशन सूचीबद्ध करता है जो यह चला रहा है। + `rollback` काउंटर को वापस न लपेटने के बजाय पुराने सेट को ले जाने वाली एक नई जनरेशन बनाता है, इसलिए इतिहास केवल-जोड़ रहता है, और यह एक जनरेशन से इनकार करता है जो एक ऐसी नीति का नाम देता है जो अक्षम या हटाई गई है। इसे `fixes:write` के साथ एक हस्ताक्षरित-में सत्र की आवश्यकता है। `fp fleet diff ` दिखाता है कि क्या लक्षित था मशीन ने जो लागू किया उसके विरुद्ध — यह `behind` के रूप में पढ़ता है जब तक मशीन अगली बार पोल नहीं करती — और मशीन पर ही, `failproofai policies` जनरेशन सूचीबद्ध करता है जो यह चला रहा है। diff --git a/docs/hi/reference/cloud-cli.mdx b/docs/hi/reference/cloud-cli.mdx index 067e884f9..0bb407cb3 100644 --- a/docs/hi/reference/cloud-cli.mdx +++ b/docs/hi/reference/cloud-cli.mdx @@ -329,7 +329,7 @@ Cloud-managed policy versions। **Session-only** — यहां हर comman | `fp policies disable POLICY_ID` | इसे हर deployment से remove करें जो इसे carry कर रहा है, हर एक पर एक नई generation को mint करते हुए। | `--yes`, `-y` | | `fp policies delete POLICY_ID` | एक policy version को delete करें। | `--yes`, `-y` | | `fp policies test PATH` | एक synthetic context के against एक policy को locally run करें। हर policy के `match` filter को apply करता है, तो एक जो given event/tool को cover नहीं करता है `skipped` के रूप में rather than run किया जाता है। | `--event`; `--tool`; `--command`; `--file`; `--expect` | -| `fp policies compose PROMPT` | Assistant के साथ एक policy को draft करें। `policies:write` की जरूरत है। | — | +| `fp policies compose PROMPT` | Assistant के साथ एक policy को draft करें। `fixes:write` की जरूरत है। | — | ### Fleet diff --git a/docs/it/admin/keys-and-permissions.mdx b/docs/it/admin/keys-and-permissions.mdx index 9a13ad6cd..25683326b 100644 --- a/docs/it/admin/keys-and-permissions.mdx +++ b/docs/it/admin/keys-and-permissions.mdx @@ -62,7 +62,7 @@ I segreti delle chiavi vengono mostrati quando creati o rigenerati. Archiviali i | Alerts | `alerts:read`, `alerts:write` | | Issues | `issues:read`, `issues:create`, `issues:close` | | Audits | `audits:read`, `audits:write` | -| Policies | `policies:read`, `policies:write`, `policies:pull` | +| Policies | `fixes:read`, `fixes:write`, `policies:pull` | | Usage | `usage:read` | `orgs:admin` è riservato all'operatore dell'istanza e non può essere concesso a una chiave dell'organizzazione o a un membro ordinario. I token ritirati `incidents:*` e `alerts:ack` sono accettati per compatibilità e si normalizzano ai permessi `issues:*` attuali. diff --git a/docs/it/policies/editor.mdx b/docs/it/policies/editor.mdx index 95876cd94..673d331b6 100644 --- a/docs/it/policies/editor.mdx +++ b/docs/it/policies/editor.mdx @@ -33,7 +33,7 @@ Un audit trova un errore; una policy lo impedisce che accada di nuovo. Failproof fp policies compose "Block git push --force on release branches" ``` - `compose` richiede una sessione autenticata (`fp login`) il cui ruolo ha `policies:write`; rifiuta le chiavi API. + `compose` richiede una sessione autenticata (`fp login`) il cui ruolo ha `fixes:write`; rifiuta le chiavi API. diff --git a/docs/it/policies/rollback.mdx b/docs/it/policies/rollback.mdx index b61224863..850c97ed4 100644 --- a/docs/it/policies/rollback.mdx +++ b/docs/it/policies/rollback.mdx @@ -37,7 +37,7 @@ Una versione di policy pubblicata non cambia mai. La modifica di una policy e un fp fleet rollback ``` - `rollback` crea una nuova generazione con il vecchio set anziché riavvolgere il contatore, quindi la cronologia rimane append-only e rifiuta una generazione che nomina una policy successivamente disabilitata o eliminata. Richiede una sessione autenticata con `policies:write`. `fp fleet diff ` mostra cosa era previsto rispetto a ciò che il computer ha applicato — viene letto come `behind` finché il computer non fa il prossimo polling — e sulla macchina stessa, `failproofai policies` elenca la distribuzione che sta eseguendo. + `rollback` crea una nuova generazione con il vecchio set anziché riavvolgere il contatore, quindi la cronologia rimane append-only e rifiuta una generazione che nomina una policy successivamente disabilitata o eliminata. Richiede una sessione autenticata con `fixes:write`. `fp fleet diff ` mostra cosa era previsto rispetto a ciò che il computer ha applicato — viene letto come `behind` finché il computer non fa il prossimo polling — e sulla macchina stessa, `failproofai policies` elenca la distribuzione che sta eseguendo. diff --git a/docs/it/reference/cloud-cli.mdx b/docs/it/reference/cloud-cli.mdx index 036c8ce19..dae8979ab 100644 --- a/docs/it/reference/cloud-cli.mdx +++ b/docs/it/reference/cloud-cli.mdx @@ -329,7 +329,7 @@ Versioni di politica gestite dal cloud. **Solo sessione** — ogni comando qui e | `fp policies disable POLICY_ID` | Rimuovila da ogni distribuzione che la contiene, creando una nuova generazione su ciascuna. | `--yes`, `-y` | | `fp policies delete POLICY_ID` | Elimina una versione di politica. | `--yes`, `-y` | | `fp policies test PATH` | Esegui una politica localmente contro un contesto sintetico. Applica il filtro `match` di ogni politica, quindi una che non copre l'evento/tool dato è segnalata come `skipped` piuttosto che eseguita. | `--event`; `--tool`; `--command`; `--file`; `--expect` | -| `fp policies compose PROMPT` | Bozza una politica con l'assistente. Richiede `policies:write`. | — | +| `fp policies compose PROMPT` | Bozza una politica con l'assistente. Richiede `fixes:write`. | — | ### Flotta diff --git a/docs/ja/admin/keys-and-permissions.mdx b/docs/ja/admin/keys-and-permissions.mdx index 4e6c572ce..86a6813a4 100644 --- a/docs/ja/admin/keys-and-permissions.mdx +++ b/docs/ja/admin/keys-and-permissions.mdx @@ -62,7 +62,7 @@ APIキーは組織に属し、明示的な権限を持ちます。エージェ | アラート | `alerts:read`, `alerts:write` | | イシュー | `issues:read`, `issues:create`, `issues:close` | | 監査 | `audits:read`, `audits:write` | -| ポリシー | `policies:read`, `policies:write`, `policies:pull` | +| ポリシー | `fixes:read`, `fixes:write`, `policies:pull` | | 使用量 | `usage:read` | `orgs:admin` はインスタンスオペレーター専用に予約されており、組織キーや一般メンバーには付与できません。廃止された `incidents:*` および `alerts:ack` トークンは互換性のために受け付けられ、現在の `issues:*` 権限に正規化されます。 diff --git a/docs/ja/policies/editor.mdx b/docs/ja/policies/editor.mdx index 615532907..0559eadd0 100644 --- a/docs/ja/policies/editor.mdx +++ b/docs/ja/policies/editor.mdx @@ -33,7 +33,7 @@ icon: "file-pen-line" fp policies compose "Block git push --force on release branches" ``` - `compose` を使用するには、`policies:write` ロールを持つセッションでサインインしている必要があります（`fp login`）。API キーは使用できません。 + `compose` を使用するには、`fixes:write` ロールを持つセッションでサインインしている必要があります（`fp login`）。API キーは使用できません。 diff --git a/docs/ja/policies/rollback.mdx b/docs/ja/policies/rollback.mdx index 186648225..9d6ac15f0 100644 --- a/docs/ja/policies/rollback.mdx +++ b/docs/ja/policies/rollback.mdx @@ -37,7 +37,7 @@ icon: "rotate-ccw" fp fleet rollback ``` - `rollback` はカウンターを巻き戻すのではなく、古いセットを持つ新しいジェネレーションを作成するため、履歴は追記専用のまま維持されます。また、無効化または削除されたポリシーを参照するジェネレーションへのロールバックは拒否されます。実行には `policies:write` 権限を持つサインイン済みセッションが必要です。`fp fleet diff ` は意図されたものとマシンが実際に適用したものとの差異を表示します。マシンが次回ポーリングするまでは `behind` と表示されます。マシン上では `failproofai policies` を実行すると、現在実行中のデプロイが一覧表示されます。 + `rollback` はカウンターを巻き戻すのではなく、古いセットを持つ新しいジェネレーションを作成するため、履歴は追記専用のまま維持されます。また、無効化または削除されたポリシーを参照するジェネレーションへのロールバックは拒否されます。実行には `fixes:write` 権限を持つサインイン済みセッションが必要です。`fp fleet diff ` は意図されたものとマシンが実際に適用したものとの差異を表示します。マシンが次回ポーリングするまでは `behind` と表示されます。マシン上では `failproofai policies` を実行すると、現在実行中のデプロイが一覧表示されます。 diff --git a/docs/ja/reference/cloud-cli.mdx b/docs/ja/reference/cloud-cli.mdx index 3475c08cc..edc3d6765 100644 --- a/docs/ja/reference/cloud-cli.mdx +++ b/docs/ja/reference/cloud-cli.mdx @@ -329,7 +329,7 @@ fp audits create checkout-reliability \ | `fp policies disable POLICY_ID` | それを含むすべてのデプロイメントから削除し、各デプロイメントで新しいジェネレーションを作成します。 | `--yes`, `-y` | | `fp policies delete POLICY_ID` | ポリシーバージョンを削除します。 | `--yes`, `-y` | | `fp policies test PATH` | 合成コンテキストに対してポリシーをローカルで実行します。各ポリシーの `match` フィルターを適用するため、指定されたイベント/ツールをカバーしないポリシーは実行されずに `skipped` と報告されます。 | `--event`; `--tool`; `--command`; `--file`; `--expect` | -| `fp policies compose PROMPT` | アシスタントでポリシーを下書きします。`policies:write` が必要です。 | — | +| `fp policies compose PROMPT` | アシスタントでポリシーを下書きします。`fixes:write` が必要です。 | — | ### フリート diff --git a/docs/ko/admin/keys-and-permissions.mdx b/docs/ko/admin/keys-and-permissions.mdx index 79f95cc41..0b74e805d 100644 --- a/docs/ko/admin/keys-and-permissions.mdx +++ b/docs/ko/admin/keys-and-permissions.mdx @@ -62,7 +62,7 @@ API 키는 조직에 귀속되며 명시적인 권한을 가집니다. 에이전 | Alerts | `alerts:read`, `alerts:write` | | Issues | `issues:read`, `issues:create`, `issues:close` | | Audits | `audits:read`, `audits:write` | -| Policies | `policies:read`, `policies:write`, `policies:pull` | +| Policies | `fixes:read`, `fixes:write`, `policies:pull` | | Usage | `usage:read` | `orgs:admin`은 인스턴스 운영자 전용으로 예약되어 있으며, 조직 키나 일반 멤버에게 부여할 수 없습니다. 폐기된 `incidents:*` 및 `alerts:ack` 토큰은 호환성을 위해 허용되며 현재 `issues:*` 권한으로 정규화됩니다. diff --git a/docs/ko/policies/editor.mdx b/docs/ko/policies/editor.mdx index bdc75997f..2c124e457 100644 --- a/docs/ko/policies/editor.mdx +++ b/docs/ko/policies/editor.mdx @@ -33,7 +33,7 @@ icon: "file-pen-line" fp policies compose "Block git push --force on release branches" ``` - `compose`는 `policies:write` 역할이 있는 로그인 세션(`fp login`)이 필요하며, API 키는 허용되지 않습니다. + `compose`는 `fixes:write` 역할이 있는 로그인 세션(`fp login`)이 필요하며, API 키는 허용되지 않습니다. diff --git a/docs/ko/policies/rollback.mdx b/docs/ko/policies/rollback.mdx index 2749e0a62..96b0feae5 100644 --- a/docs/ko/policies/rollback.mdx +++ b/docs/ko/policies/rollback.mdx @@ -37,7 +37,7 @@ icon: "rotate-ccw" fp fleet rollback ``` - `rollback`은 카운터를 되감는 것이 아니라 이전 정책 세트를 담은 새로운 세대를 생성하므로, 기록은 항상 추가 전용(append-only)으로 유지됩니다. 비활성화되거나 삭제된 정책을 참조하는 세대로의 롤백은 거부됩니다. `policies:write` 권한이 있는 로그인 세션이 필요합니다. `fp fleet diff `는 의도된 배포와 머신이 실제로 적용한 배포의 차이를 보여주며, 머신이 다음 번에 폴링할 때까지는 `behind`로 표시됩니다. 머신 자체에서는 `failproofai policies`를 실행하면 현재 실행 중인 배포를 확인할 수 있습니다. + `rollback`은 카운터를 되감는 것이 아니라 이전 정책 세트를 담은 새로운 세대를 생성하므로, 기록은 항상 추가 전용(append-only)으로 유지됩니다. 비활성화되거나 삭제된 정책을 참조하는 세대로의 롤백은 거부됩니다. `fixes:write` 권한이 있는 로그인 세션이 필요합니다. `fp fleet diff `는 의도된 배포와 머신이 실제로 적용한 배포의 차이를 보여주며, 머신이 다음 번에 폴링할 때까지는 `behind`로 표시됩니다. 머신 자체에서는 `failproofai policies`를 실행하면 현재 실행 중인 배포를 확인할 수 있습니다. diff --git a/docs/ko/reference/cloud-cli.mdx b/docs/ko/reference/cloud-cli.mdx index 24ab60386..ab9fa31ed 100644 --- a/docs/ko/reference/cloud-cli.mdx +++ b/docs/ko/reference/cloud-cli.mdx @@ -329,7 +329,7 @@ fp audits create checkout-reliability \ | `fp policies disable POLICY_ID` | 이를 포함하는 모든 배포에서 제거하고, 각 배포에서 새 세대를 생성합니다. | `--yes`, `-y` | | `fp policies delete POLICY_ID` | 정책 버전을 삭제합니다. | `--yes`, `-y` | | `fp policies test PATH` | 합성 컨텍스트에 대해 로컬에서 정책을 실행합니다. 각 정책의 `match` 필터를 적용하므로, 주어진 이벤트/도구를 다루지 않는 정책은 실행되지 않고 `skipped`로 보고됩니다. | `--event`; `--tool`; `--command`; `--file`; `--expect` | -| `fp policies compose PROMPT` | 어시스턴트로 정책 초안을 작성합니다. `policies:write`가 필요합니다. | — | +| `fp policies compose PROMPT` | 어시스턴트로 정책 초안을 작성합니다. `fixes:write`가 필요합니다. | — | ### 플릿 diff --git a/docs/policies/editor.mdx b/docs/policies/editor.mdx index 0363bee7c..0dc0b9dd1 100644 --- a/docs/policies/editor.mdx +++ b/docs/policies/editor.mdx @@ -33,7 +33,7 @@ An audit finds a failure; a policy stops it happening again. Failproof AI drafts fp policies compose "Block git push --force on release branches" ``` - `compose` needs a signed-in session (`fp login`) whose role has `policies:write`; it refuses API keys. + `compose` needs a signed-in session (`fp login`) whose role has `fixes:write`; it refuses API keys. diff --git a/docs/policies/rollback.mdx b/docs/policies/rollback.mdx index 9601d4098..219649726 100644 --- a/docs/policies/rollback.mdx +++ b/docs/policies/rollback.mdx @@ -37,7 +37,7 @@ A published policy version never changes. Editing a policy and publishing again fp fleet rollback ``` - `rollback` mints a new generation carrying the old set rather than rewinding the counter, so history stays append-only, and it refuses a generation that names a policy since disabled or deleted. It needs a signed-in session with `policies:write`. `fp fleet diff ` shows what was intended against what the machine applied — it reads as `behind` until the machine next polls — and on the machine itself, `failproofai policies` lists the deployment it is running. + `rollback` mints a new generation carrying the old set rather than rewinding the counter, so history stays append-only, and it refuses a generation that names a policy since disabled or deleted. It needs a signed-in session with `fixes:write`. `fp fleet diff ` shows what was intended against what the machine applied — it reads as `behind` until the machine next polls — and on the machine itself, `failproofai policies` lists the deployment it is running. diff --git a/docs/pt-br/admin/keys-and-permissions.mdx b/docs/pt-br/admin/keys-and-permissions.mdx index 62aaf47ad..dc069f9e9 100644 --- a/docs/pt-br/admin/keys-and-permissions.mdx +++ b/docs/pt-br/admin/keys-and-permissions.mdx @@ -62,7 +62,7 @@ Os segredos das chaves são exibidos quando criados ou regenerados. Armazene-os | Alerts | `alerts:read`, `alerts:write` | | Issues | `issues:read`, `issues:create`, `issues:close` | | Audits | `audits:read`, `audits:write` | -| Policies | `policies:read`, `policies:write`, `policies:pull` | +| Policies | `fixes:read`, `fixes:write`, `policies:pull` | | Usage | `usage:read` | `orgs:admin` é reservado para o operador da instância e não pode ser concedido a uma chave de organização ou a um membro comum. Tokens `incidents:*` e `alerts:ack` descontinuados são aceitos por compatibilidade e são normalizados para as permissões `issues:*` atuais. diff --git a/docs/pt-br/policies/editor.mdx b/docs/pt-br/policies/editor.mdx index 7767bb203..529702f1b 100644 --- a/docs/pt-br/policies/editor.mdx +++ b/docs/pt-br/policies/editor.mdx @@ -33,7 +33,7 @@ Uma auditoria encontra uma falha; uma política impede que ela aconteça novamen fp policies compose "Block git push --force on release branches" ``` - `compose` requer uma sessão autenticada (`fp login`) cuja função tenha `policies:write`; ele rejeita chaves de API. + `compose` requer uma sessão autenticada (`fp login`) cuja função tenha `fixes:write`; ele rejeita chaves de API. diff --git a/docs/pt-br/policies/rollback.mdx b/docs/pt-br/policies/rollback.mdx index 8c23a3bc8..5c57430a2 100644 --- a/docs/pt-br/policies/rollback.mdx +++ b/docs/pt-br/policies/rollback.mdx @@ -37,7 +37,7 @@ Uma versão de política publicada nunca muda. Editar uma política e publicar n fp fleet rollback ``` - O `rollback` cria uma nova geração carregando o conjunto antigo em vez de retroceder o contador, então o histórico permanece apenas-apenso. Ele recusa uma geração que referencia uma política desativada ou excluída. Requer uma sessão autenticada com `policies:write`. O `fp fleet diff ` mostra o que foi planejado versus o que a máquina aplicou — aparece como `behind` até a próxima vez que a máquina fizer polling — e na própria máquina, `failproofai policies` lista a implantação em execução. + O `rollback` cria uma nova geração carregando o conjunto antigo em vez de retroceder o contador, então o histórico permanece apenas-apenso. Ele recusa uma geração que referencia uma política desativada ou excluída. Requer uma sessão autenticada com `fixes:write`. O `fp fleet diff ` mostra o que foi planejado versus o que a máquina aplicou — aparece como `behind` até a próxima vez que a máquina fizer polling — e na própria máquina, `failproofai policies` lista a implantação em execução. diff --git a/docs/pt-br/reference/cloud-cli.mdx b/docs/pt-br/reference/cloud-cli.mdx index 71f01f2cc..2b0485abd 100644 --- a/docs/pt-br/reference/cloud-cli.mdx +++ b/docs/pt-br/reference/cloud-cli.mdx @@ -332,7 +332,7 @@ Versões de políticas gerenciadas pela nuvem. **Somente sessão** — cada coma | `fp policies disable POLICY_ID` | Removê-la de cada implantação que a carrega, criando uma nova geração em cada uma. | `--yes`, `-y` | | `fp policies delete POLICY_ID` | Excluir uma versão de política. | `--yes`, `-y` | | `fp policies test PATH` | Executar uma política localmente contra um contexto sintético. Aplica o filtro `match` de cada política, portanto uma que não cubra o evento/ferramenta fornecido é reportada como `skipped` em vez de executada. | `--event`; `--tool`; `--command`; `--file`; `--expect` | -| `fp policies compose PROMPT` | Rascunhar uma política com o assistente. Requer `policies:write`. | — | +| `fp policies compose PROMPT` | Rascunhar uma política com o assistente. Requer `fixes:write`. | — | ### Frota diff --git a/docs/reference/cloud-cli.mdx b/docs/reference/cloud-cli.mdx index dd9fafcb5..2b8b143c9 100644 --- a/docs/reference/cloud-cli.mdx +++ b/docs/reference/cloud-cli.mdx @@ -462,7 +462,7 @@ Cloud-managed policy versions. **Session-only** — every command here exits `2` | `fp policies disable POLICY_ID` | Remove it from every deployment carrying it, minting a new generation on each. | `--yes`, `-y` | | `fp policies delete POLICY_ID` | Delete a policy version. | `--yes`, `-y` | | `fp policies test PATH` | Run a policy locally against a synthetic context. Applies each policy's `match` filter, so one that does not cover the given event/tool is reported `skipped` rather than run. | `--event`; `--tool`; `--command`; `--file`; `--expect` | -| `fp policies compose PROMPT` | Draft a policy with the assistant. Needs `policies:write`. | — | +| `fp policies compose PROMPT` | Draft a policy with the assistant. Needs `fixes:write`. | — | ### Fleet diff --git a/docs/ru/admin/keys-and-permissions.mdx b/docs/ru/admin/keys-and-permissions.mdx index 0b0e4ba55..27d712d40 100644 --- a/docs/ru/admin/keys-and-permissions.mdx +++ b/docs/ru/admin/keys-and-permissions.mdx @@ -62,7 +62,7 @@ API-ключи принадлежат организации и содержат | Alerts | `alerts:read`, `alerts:write` | | Issues | `issues:read`, `issues:create`, `issues:close` | | Audits | `audits:read`, `audits:write` | -| Policies | `policies:read`, `policies:write`, `policies:pull` | +| Policies | `fixes:read`, `fixes:write`, `policies:pull` | | Usage | `usage:read` | `orgs:admin` зарезервировано для оператора экземпляра и не может быть предоставлено ключу организации или обычному члену. Устаревшие токены `incidents:*` и `alerts:ack` принимаются для совместимости и нормализуются к текущим разрешениям `issues:*`. diff --git a/docs/ru/policies/editor.mdx b/docs/ru/policies/editor.mdx index e0d4c778f..7d232d2b5 100644 --- a/docs/ru/policies/editor.mdx +++ b/docs/ru/policies/editor.mdx @@ -33,7 +33,7 @@ icon: "file-pen-line" fp policies compose "Block git push --force on release branches" ``` - `compose` требует аутентифицированного сеанса (`fp login`), роль которого имеет `policies:write`; он отклоняет API-ключи. + `compose` требует аутентифицированного сеанса (`fp login`), роль которого имеет `fixes:write`; он отклоняет API-ключи. diff --git a/docs/ru/policies/rollback.mdx b/docs/ru/policies/rollback.mdx index 0f409f7dd..fe9073efa 100644 --- a/docs/ru/policies/rollback.mdx +++ b/docs/ru/policies/rollback.mdx @@ -37,7 +37,7 @@ icon: "rotate-ccw" fp fleet rollback ``` - `rollback` создает новое поколение со старым набором, а не перематывает счетчик, поэтому история остается добавочной. Команда отказывает, если указать поколение с отключенной или удаленной политикой. Требуется сеанс с авторизацией и правами `policies:write`. `fp fleet diff ` показывает, что было предусмотрено в сравнении с тем, что машина применила — это отображается как `behind`, пока машина не проведет следующий опрос — а на самой машине `failproofai policies` перечисляет развертывание, которое она запускает. + `rollback` создает новое поколение со старым набором, а не перематывает счетчик, поэтому история остается добавочной. Команда отказывает, если указать поколение с отключенной или удаленной политикой. Требуется сеанс с авторизацией и правами `fixes:write`. `fp fleet diff ` показывает, что было предусмотрено в сравнении с тем, что машина применила — это отображается как `behind`, пока машина не проведет следующий опрос — а на самой машине `failproofai policies` перечисляет развертывание, которое она запускает. diff --git a/docs/ru/reference/cloud-cli.mdx b/docs/ru/reference/cloud-cli.mdx index 8ec1bda20..e9fd28803 100644 --- a/docs/ru/reference/cloud-cli.mdx +++ b/docs/ru/reference/cloud-cli.mdx @@ -329,7 +329,7 @@ fp audits create checkout-reliability \ | `fp policies disable POLICY_ID` | Удалить из каждого развертывания, которое ее содержит, создав новое поколение в каждом. | `--yes`, `-y` | | `fp policies delete POLICY_ID` | Удалить версию политики. | `--yes`, `-y` | | `fp policies test PATH` | Запустить политику локально против синтетического контекста. Применяет фильтр `match` каждой политики, поэтому та, которая не охватывает данное событие/инструмент, сообщается как `skipped` вместо запуска. | `--event`; `--tool`; `--command`; `--file`; `--expect` | -| `fp policies compose PROMPT` | Разработать политику с помощью помощника. Требует `policies:write`. | — | +| `fp policies compose PROMPT` | Разработать политику с помощью помощника. Требует `fixes:write`. | — | ### Флот diff --git a/docs/tr/admin/keys-and-permissions.mdx b/docs/tr/admin/keys-and-permissions.mdx index 855cf61c3..04b31a211 100644 --- a/docs/tr/admin/keys-and-permissions.mdx +++ b/docs/tr/admin/keys-and-permissions.mdx @@ -62,7 +62,7 @@ Anahtar sırları oluşturulduğunda veya yeniden oluşturulduğunda gösterilir | Uyarılar | `alerts:read`, `alerts:write` | | Sorunlar | `issues:read`, `issues:create`, `issues:close` | | Denetimler | `audits:read`, `audits:write` | -| Politikalar | `policies:read`, `policies:write`, `policies:pull` | +| Politikalar | `fixes:read`, `fixes:write`, `policies:pull` | | Kullanım | `usage:read` | `orgs:admin` örnek operatörü için ayrılmıştır ve bir organizasyon anahtarına veya sıradan üyeye verilemez. Emekli `incidents:*` ve `alerts:ack` belirteçleri uyumluluk için kabul edilir ve geçerli `issues:*` izinlerine normalleştirilir. diff --git a/docs/tr/policies/editor.mdx b/docs/tr/policies/editor.mdx index 85ad77e0c..c603273da 100644 --- a/docs/tr/policies/editor.mdx +++ b/docs/tr/policies/editor.mdx @@ -33,7 +33,7 @@ Hatanın meydana geldiği oturumlar üzerinde [denetim çalıştırın](/tr/audi fp policies compose "Block git push --force on release branches" ``` - `compose` imzalanmış bir oturuma ihtiyaç duyar (`fp login`) ki rolü `policies:write` yetkisine sahip olsun; API anahtarlarını reddeder. + `compose` imzalanmış bir oturuma ihtiyaç duyar (`fp login`) ki rolü `fixes:write` yetkisine sahip olsun; API anahtarlarını reddeder. diff --git a/docs/tr/policies/rollback.mdx b/docs/tr/policies/rollback.mdx index 7c4319c80..56304c8e3 100644 --- a/docs/tr/policies/rollback.mdx +++ b/docs/tr/policies/rollback.mdx @@ -37,7 +37,7 @@ Yayınlanan bir policy sürümü asla değişmez. Bir policy düzenlemesi ve yen fp fleet rollback ``` - `rollback` sayacı geri sarmak yerine eski seti taşıyan yeni bir generasyon oluşturur, bu nedenle geçmiş sadece eklenmeye devam eder ve devre dışı bırakılan veya silinen bir policy'yi adlandıran generasyonu reddeder. `policies:write` izni olan oturum açmış bir oturuma ihtiyaç duyar. `fp fleet diff ` makine uygulanırken amaçlanan şeyi gösterir — makine bir sonraki kez anket yapana kadar `behind` olarak okunur — ve makinenin kendisinde `failproofai policies` çalıştırılan dağıtımı listeler. + `rollback` sayacı geri sarmak yerine eski seti taşıyan yeni bir generasyon oluşturur, bu nedenle geçmiş sadece eklenmeye devam eder ve devre dışı bırakılan veya silinen bir policy'yi adlandıran generasyonu reddeder. `fixes:write` izni olan oturum açmış bir oturuma ihtiyaç duyar. `fp fleet diff ` makine uygulanırken amaçlanan şeyi gösterir — makine bir sonraki kez anket yapana kadar `behind` olarak okunur — ve makinenin kendisinde `failproofai policies` çalıştırılan dağıtımı listeler. diff --git a/docs/tr/reference/cloud-cli.mdx b/docs/tr/reference/cloud-cli.mdx index b1b759dd6..b03db0970 100644 --- a/docs/tr/reference/cloud-cli.mdx +++ b/docs/tr/reference/cloud-cli.mdx @@ -329,7 +329,7 @@ Bulut tarafından yönetilen ilke sürümleri. **Yalnızca oturum** — buradaki | `fp policies disable POLICY_ID` | Taşıdığı her dağıtımdan kaldırın, her biri üzerinde yeni bir nesil oluşturun. | `--yes`, `-y` | | `fp policies delete POLICY_ID` | İlke sürümünü silin. | `--yes`, `-y` | | `fp policies test PATH` | Sentetik bir bağlama karşı yerel olarak bir ilkeyi çalıştırın. Her ilkenin `match` filtresini uygular, bu nedenle verilen etkinlik/aracı kapsamayan bir `skipped` yerine çalıştırılır. | `--event`; `--tool`; `--command`; `--file`; `--expect` | -| `fp policies compose PROMPT` | Asistan ile bir ilke taslağı yapın. `policies:write` gerektirir. | — | +| `fp policies compose PROMPT` | Asistan ile bir ilke taslağı yapın. `fixes:write` gerektirir. | — | ### Filo diff --git a/docs/vi/admin/keys-and-permissions.mdx b/docs/vi/admin/keys-and-permissions.mdx index b0a3a1d76..0d565f680 100644 --- a/docs/vi/admin/keys-and-permissions.mdx +++ b/docs/vi/admin/keys-and-permissions.mdx @@ -62,7 +62,7 @@ Bí mật khóa được hiển thị khi được tạo hoặc tạo lại. Lư | Cảnh báo | `alerts:read`, `alerts:write` | | Vấn đề | `issues:read`, `issues:create`, `issues:close` | | Kiểm toán | `audits:read`, `audits:write` | -| Chính sách | `policies:read`, `policies:write`, `policies:pull` | +| Chính sách | `fixes:read`, `fixes:write`, `policies:pull` | | Sử dụng | `usage:read` | `orgs:admin` được dành riêng cho nhà điều hành thực thể và không thể được cấp cho khóa tổ chức hoặc thành viên thường. Các mã thông báo `incidents:*` và `alerts:ack` đã loại bỏ được chấp nhận để tương thích và chuẩn hóa thành quyền hạn `issues:*` hiện tại. diff --git a/docs/vi/policies/editor.mdx b/docs/vi/policies/editor.mdx index ca267c3c2..3a9e919d0 100644 --- a/docs/vi/policies/editor.mdx +++ b/docs/vi/policies/editor.mdx @@ -33,7 +33,7 @@ Một cuộc kiểm tra phát hiện một lỗi; một chính sách ngăn chặ fp policies compose "Block git push --force on release branches" ``` - `compose` cần một phiên đã đăng nhập (`fp login`) có vai trò `policies:write`; nó từ chối các khóa API. + `compose` cần một phiên đã đăng nhập (`fp login`) có vai trò `fixes:write`; nó từ chối các khóa API. diff --git a/docs/vi/policies/rollback.mdx b/docs/vi/policies/rollback.mdx index cdddc1858..ddb37a249 100644 --- a/docs/vi/policies/rollback.mdx +++ b/docs/vi/policies/rollback.mdx @@ -37,7 +37,7 @@ Một phiên bản chính sách đã công bố không bao giờ thay đổi. Ch fp fleet rollback ``` - `rollback` tạo một thế hệ mới mang bộ cũ thay vì đặt lại bộ đếm, vì vậy lịch sử luôn chỉ được nối thêm, và nó từ chối một thế hệ đặt tên cho chính sách vì đã bị vô hiệu hóa hoặc xóa. Nó cần một phiên đăng nhập với `policies:write`. `fp fleet diff ` hiển thị những gì được dự định so với những gì máy áp dụng — nó được đọc là `behind` cho đến khi máy thăm dò tiếp theo — và trên chính máy đó, `failproofai policies` liệt kê triển khai mà nó đang chạy. + `rollback` tạo một thế hệ mới mang bộ cũ thay vì đặt lại bộ đếm, vì vậy lịch sử luôn chỉ được nối thêm, và nó từ chối một thế hệ đặt tên cho chính sách vì đã bị vô hiệu hóa hoặc xóa. Nó cần một phiên đăng nhập với `fixes:write`. `fp fleet diff ` hiển thị những gì được dự định so với những gì máy áp dụng — nó được đọc là `behind` cho đến khi máy thăm dò tiếp theo — và trên chính máy đó, `failproofai policies` liệt kê triển khai mà nó đang chạy. diff --git a/docs/vi/reference/cloud-cli.mdx b/docs/vi/reference/cloud-cli.mdx index 9ac4edcd9..f5fcd9d49 100644 --- a/docs/vi/reference/cloud-cli.mdx +++ b/docs/vi/reference/cloud-cli.mdx @@ -329,7 +329,7 @@ Phiên bản policy được quản lý bởi cloud. **Session-only** — mỗi | `fp policies disable POLICY_ID` | Loại bỏ nó khỏi mỗi deployment mang nó, tạo ra một thế hệ mới trên mỗi cái. | `--yes`, `-y` | | `fp policies delete POLICY_ID` | Xóa một phiên bản policy. | `--yes`, `-y` | | `fp policies test PATH` | Chạy một policy cục bộ chống lại bối cảnh tổng hợp. Áp dụng bộ lọc `match` của mỗi policy, vì vậy bộ không bao gồm sự kiện/tool được cung cấp sẽ được báo cáo `skipped` thay vì được chạy. | `--event`; `--tool`; `--command`; `--file`; `--expect` | -| `fp policies compose PROMPT` | Dự thảo một policy với assistant. Cần `policies:write`. | — | +| `fp policies compose PROMPT` | Dự thảo một policy với assistant. Cần `fixes:write`. | — | ### Fleet diff --git a/docs/zh/admin/keys-and-permissions.mdx b/docs/zh/admin/keys-and-permissions.mdx index a1d686bd7..600892cd9 100644 --- a/docs/zh/admin/keys-and-permissions.mdx +++ b/docs/zh/admin/keys-and-permissions.mdx @@ -62,7 +62,7 @@ API 密钥归属于某个组织，并携带明确的权限配置。请为 Agent | 告警 | `alerts:read`、`alerts:write` | | 问题 | `issues:read`、`issues:create`、`issues:close` | | 审计 | `audits:read`、`audits:write` | -| 策略 | `policies:read`、`policies:write`、`policies:pull` | +| 策略 | `fixes:read`、`fixes:write`、`policies:pull` | | 用量 | `usage:read` | `orgs:admin` 为实例运营方专属权限，不能授予组织密钥或普通成员。已停用的 `incidents:*` 和 `alerts:ack` 令牌出于兼容性仍可接受，并将规范化为当前的 `issues:*` 权限。 diff --git a/docs/zh/policies/editor.mdx b/docs/zh/policies/editor.mdx index 8dbd1bf3d..63f48e845 100644 --- a/docs/zh/policies/editor.mdx +++ b/docs/zh/policies/editor.mdx @@ -33,7 +33,7 @@ icon: "file-pen-line" fp policies compose "Block git push --force on release branches" ``` - `compose` 需要一个已登录的会话（`fp login`），且其角色须具有 `policies:write` 权限；它不接受 API 密钥。 + `compose` 需要一个已登录的会话（`fp login`），且其角色须具有 `fixes:write` 权限；它不接受 API 密钥。 diff --git a/docs/zh/policies/rollback.mdx b/docs/zh/policies/rollback.mdx index 0e4f6a68c..2a873b8a8 100644 --- a/docs/zh/policies/rollback.mdx +++ b/docs/zh/policies/rollback.mdx @@ -37,7 +37,7 @@ icon: "rotate-ccw" fp fleet rollback ``` - `rollback` 会以旧配置集生成一个新代次，而非回退计数器，因此历史记录保持只追加模式。若指定的代次所引用的策略已被禁用或删除，该命令将拒绝执行。执行此命令需要已登录且拥有 `policies:write` 权限的会话。`fp fleet diff ` 会对比预期配置与机器实际应用的配置——在机器下次轮询之前，状态显示为 `behind`；在机器本身上，`failproofai policies` 会列出当前运行的部署。 + `rollback` 会以旧配置集生成一个新代次，而非回退计数器，因此历史记录保持只追加模式。若指定的代次所引用的策略已被禁用或删除，该命令将拒绝执行。执行此命令需要已登录且拥有 `fixes:write` 权限的会话。`fp fleet diff ` 会对比预期配置与机器实际应用的配置——在机器下次轮询之前，状态显示为 `behind`；在机器本身上，`failproofai policies` 会列出当前运行的部署。 diff --git a/docs/zh/reference/cloud-cli.mdx b/docs/zh/reference/cloud-cli.mdx index e74d5e4fa..8e7be2e05 100644 --- a/docs/zh/reference/cloud-cli.mdx +++ b/docs/zh/reference/cloud-cli.mdx @@ -329,7 +329,7 @@ fp audits create checkout-reliability \ | `fp policies disable POLICY_ID` | 从所有携带它的部署中移除，并在每个部署上生成新的代次。 | `--yes`, `-y` | | `fp policies delete POLICY_ID` | 删除一个策略版本。 | `--yes`, `-y` | | `fp policies test PATH` | 在本地针对合成上下文运行策略。对每个策略的 `match` 过滤器逐一应用，不覆盖给定事件/工具的策略会被报告为 `skipped` 而非运行。 | `--event`；`--tool`；`--command`；`--file`；`--expect` | -| `fp policies compose PROMPT` | 使用助手起草策略。需要 `policies:write` 权限。 | — | +| `fp policies compose PROMPT` | 使用助手起草策略。需要 `fixes:write` 权限。 | — | ### 机群 diff --git a/fp-cloud-cli/fp_cli/client.py b/fp-cloud-cli/fp_cli/client.py index a65938931..031ade00f 100644 --- a/fp-cloud-cli/fp_cli/client.py +++ b/fp-cloud-cli/fp_cli/client.py @@ -176,7 +176,7 @@ class ClientContext: ), # ROOT-ONLY on the server, and deliberately so: `/v1` is published on the # dashboard host by the ingress, and publish/deploy/rollback are operator - # writes gated on `policies:write`. Exposing them there would put fleet + # writes gated on `fixes:write`. Exposing them there would put fleet # mutation on the open internet. See the ROOT-ONLY block in # `server/src/routes/mod.rs`. "enforcement": ( diff --git a/fp-cloud-cli/fp_cli/commands/fleet_cmds.py b/fp-cloud-cli/fp_cli/commands/fleet_cmds.py index 3f525e6f4..349536a14 100644 --- a/fp-cloud-cli/fp_cli/commands/fleet_cmds.py +++ b/fp-cloud-cli/fp_cli/commands/fleet_cmds.py @@ -69,7 +69,7 @@ def fleet_list(ctx: typer.Context) -> None: A machine appears from its very first check-in, including the poll that finds nothing deployed — that is exactly the machine you are usually looking - for. Needs `policies:read`. With `--json`: `{machines, deployments}`, where + for. Needs `fixes:read`. With `--json`: `{machines, deployments}`, where each machine carries raw timestamps plus the computed `drifted`. Example: @@ -116,7 +116,7 @@ def fleet_show( because an organization Cloud check has its name (`jev_name_clash`). Anything listed there is not enforcing, whatever the deployment says. - Needs `policies:read`. With `--json`: `{machine, deployment}` — the machine + Needs `fixes:read`. With `--json`: `{machine, deployment}` — the machine record (including `appliedDeployment`, `drifted`, `lastSeen`, both label fields, `jevMode` and `policyErrors`/`policyErrorsAt` when reported, with raw timestamps) and the deployment, or `deployment: null` when nothing is @@ -196,7 +196,7 @@ def fleet_deploy( **Concurrency.** The write is a full replace with no server-side lock, so the CLI records the generation it read and refuses if the result is not exactly one higher: that means somebody else deployed in between and a replace does - not merge. Needs `policies:write`. With `--json`: the plan plus the resulting + not merge. Needs `fixes:write`. With `--json`: the plan plus the resulting deployment. Examples: @@ -265,7 +265,7 @@ def fleet_deploy( # * `applied: false` in --json is the only way to tell "I changed it" from # "it already matched" — the exit code is 0 either way, on purpose. # * the short-circuit happens BEFORE the write, so a reader without - # `policies:write` also gets 0 here. They have not gained anything (the + # `fixes:write` also gets 0 here. They have not gained anything (the # state already held and nothing was written), but the exit code alone # is not proof of write access. if plan.is_noop: @@ -311,7 +311,7 @@ def fleet_diff( The gap is the interesting part: a machine that has not collected its latest deployment is not enforcing what the dashboard says it is, and nothing else - surfaces that as a single number. Needs `policies:read`. With `--json`: + surfaces that as a single number. Needs `fixes:read`. With `--json`: `{machines:[{machineId, intended, delivered, drifted}]}` — `drifted` is the field the CLI computes, so a harness need not derive it. @@ -355,7 +355,7 @@ def fleet_history( — appears as an ordinary entry, and so does a Jev mode change. Each generation shows the Jev mode FailproofAI Cloud set with it (`local` when it set none), which is the mode a rollback to it restores. Needs - `policies:read`. With `--json`: `{machineId, history:[{deployment, policies, + `fixes:read`. With `--json`: `{machineId, history:[{deployment, policies, updatedAt, jevMode}]}`. Example: @@ -389,7 +389,7 @@ def fleet_rollback( It restores that generation's Jev mode too, `local` included: the prompt and the result say `jev mode → ` when that changes it. - Needs `policies:write`. With `--json`: the resulting deployment plus + Needs `fixes:write`. With `--json`: the resulting deployment plus `jevModeBefore` (the mode it replaced), or `{"cancelled": true}` if you decline. @@ -443,7 +443,7 @@ def fleet_rename( ) -> None: """Give a machine a human label. The id itself never changes. - Needs `policies:write`. With `--json`: `{machineId, labelOverride}` — the + Needs `fixes:write`. With `--json`: `{machineId, labelOverride}` — the server stores the label as an override beside the machine's self-asserted one rather than replacing it. diff --git a/fp-cloud-cli/fp_cli/commands/guardrails_cmds.py b/fp-cloud-cli/fp_cli/commands/guardrails_cmds.py index 2ee683d0c..4b70b7b23 100644 --- a/fp-cloud-cli/fp_cli/commands/guardrails_cmds.py +++ b/fp-cloud-cli/fp_cli/commands/guardrails_cmds.py @@ -78,7 +78,7 @@ def guardrails_summary( no policy objected to, and the row keeps the denominator on screen — "14 blocked" means little without the 933 it came from. - Needs `policies:read`. With `--json`: the server summary plus the timeline. + Needs `fixes:read`. With `--json`: the server summary plus the timeline. Examples: @@ -113,7 +113,7 @@ def guardrails_timeline( Times are UTC, and the label follows the bucket size the server chose — a clock for hourly buckets, a date for daily ones. - Needs `policies:read`. With `--json`: the server's timeline verbatim. + Needs `fixes:read`. With `--json`: the server's timeline verbatim. Example: diff --git a/fp-cloud-cli/fp_cli/commands/policies_cmds.py b/fp-cloud-cli/fp_cli/commands/policies_cmds.py index 3b959b5ba..630137def 100644 --- a/fp-cloud-cli/fp_cli/commands/policies_cmds.py +++ b/fp-cloud-cli/fp_cli/commands/policies_cmds.py @@ -48,7 +48,7 @@ def policies_list(ctx: typer.Context) -> None: `state` is active, disabled (kept but not enforced) or archived (deleted; machines already carrying it keep it until redeployed). Needs - `policies:read`. With `--json`: the server's policy list verbatim — also + `fixes:read`. With `--json`: the server's policy list verbatim — also every version, so deduplicate on `id` if you want one row per policy. Example: @@ -71,7 +71,7 @@ def policies_show( ) -> None: """Show one policy, including its full source and its Jev checks. - Needs `policies:read`. With `--json`: the policy object with `source`, + Needs `fixes:read`. With `--json`: the policy object with `source`, `kind`, and for `jev`/`both` its `semantic` declarations, `semanticSha256` and the server-derived `authority`/`reviewedBy`. @@ -161,7 +161,7 @@ def policies_publish( when you give none and stdin is a terminal. **Publishing deploys nothing.** A new version sits unused until - `fp fleet deploy` puts it on a machine. Needs `policies:write`. + `fp fleet deploy` puts it on a machine. Needs `fixes:write`. With `--json`: the created version plus `carriers` — a map of machine id to the version of this policy it currently runs, so a harness can tell what a publish left behind without a second call. @@ -271,7 +271,7 @@ def policies_enable( deployment it was removed from, advancing each machine's generation again. Nothing needs redeploying by hand. - Needs `policies:write`. With `--json`: `{id, disabled, archived, + Needs `fixes:write`. With `--json`: `{id, disabled, archived, machinesUpdated}` — `machinesUpdated` counts the deployments rewritten, and matches the count the preceding `disable` reported. @@ -323,7 +323,7 @@ def policies_disable( `policies enable` is the exact inverse: it puts the policy back into every deployment it was removed from, so nothing needs redeploying by hand. - Needs `policies:write`. With `--json`: `{id, disabled, archived, + Needs `fixes:write`. With `--json`: `{id, disabled, archived, machinesUpdated}` — `machinesUpdated` is how many deployments were rewritten to drop it, and is the number to check if you expected this to be a no-op. @@ -363,7 +363,7 @@ def policies_delete( machine already carrying it keeps enforcing it until something redeploys — deleting is not a way to stop enforcement everywhere, and `disable` is. - Needs `policies:write`. With `--json`: `{id, disabled, archived, + Needs `fixes:write`. With `--json`: `{id, disabled, archived, machinesUpdated}`, or `{"cancelled": true}` if you decline. Example: @@ -487,12 +487,12 @@ def policies_compose( deploys itself is a generated policy nobody read. `--out` saves it; `--publish ` publishes it, still syntax-checked first. - Needs `policies:write` — for the draft as well as the publish. The route is + Needs `fixes:write` — for the draft as well as the publish. The route is `POST /api/agent/compose-policy`, which the dashboard exports as - `withAuth("policies:write", …)`; `agent:use` gates the assistant's other + `withAuth("fixes:write", …)`; `agent:use` gates the assistant's other routes (chat, answer, conversations) and is NOT checked on this one. So a role holding only `agent:use` is refused here, and one holding - `policies:write` without it works. Session-only. + `fixes:write` without it works. Session-only. With `--json`: `{prompt, source, syntax, published}`. @@ -517,7 +517,7 @@ def policies_compose( syn = check_syntax(source) # Saved BEFORE anything that can fail. `--out` used to run after the - # publish, so a publish that was refused — bad syntax, no `policies:write`, + # publish, so a publish that was refused — bad syntax, no `fixes:write`, # a network blip — threw away the draft the user had just paid an assistant # to write, with no way to get that same text back. if out: @@ -627,7 +627,7 @@ def policies_backtest( as before. A jev/both policy — a published one, or `--semantic checks.json` with or without a source file — runs the every-kind backtest: an estimate by default, `--run` to spend Jev allowance on up to `--sample` calls. - Needs policies:write and events:read. + Needs fixes:write and events:read. """ from pathlib import Path _cloud.session_only(ctx.obj, "policies backtest") diff --git a/fp-cloud-cli/fp_cli/permissions.py b/fp-cloud-cli/fp_cli/permissions.py index 27a5a25e2..9d5c08782 100644 --- a/fp-cloud-cli/fp_cli/permissions.py +++ b/fp-cloud-cli/fp_cli/permissions.py @@ -44,8 +44,8 @@ "issues:close", "audits:read", "audits:write", - "policies:read", - "policies:write", + "fixes:read", + "fixes:write", "policies:pull", "usage:read", # Jev through FailproofAI Cloud, charged to the org's plan. The built-in @@ -71,6 +71,9 @@ "incidents:write": ["issues:create"], "incidents:ack": ["issues:read", "issues:create", "issues:close"], "alerts:ack": ["issues:read", "issues:create", "issues:close"], + # Renamed when these came to cover every kind of fix, not only policies. + "policies:read": ["fixes:read"], + "policies:write": ["fixes:write"], } diff --git a/fp-cloud-cli/skill/references/commands.md b/fp-cloud-cli/skill/references/commands.md index 9bbf6ee9b..04959249e 100644 --- a/fp-cloud-cli/skill/references/commands.md +++ b/fp-cloud-cli/skill/references/commands.md @@ -249,7 +249,7 @@ Built-in assistant. Chats referenced by a **short chat-id** (first 8 hex; prefix ## policies · fleet · guardrails **Session-only, all three groups** — every subcommand exits 2 under a key, with no request made. These routes are absent from the versioned API an API key authenticates against; they are an operator surface. -Cloud-managed enforcement, split the way the dashboard splits it: `policies` writes a version, `fleet` decides which machines run it, `guardrails` reports what it blocked. Needs `policies:read` to read, `policies:write` to change anything. +Cloud-managed enforcement, split the way the dashboard splits it: `policies` writes a version, `fleet` decides which machines run it, `guardrails` reports what it blocked. Needs `fixes:read` to read, `fixes:write` to change anything. ### policies - `policies list` — one row per published VERSION (versions are immutable and all stay addressable), newest of each policy first; the title counts distinct policies and captions the version total. `kind` is `regex` / `jev` / `both`, and a `jev`/`both` row names its Jev checks before the description. `state` is active / disabled / archived. JSON `{policies:[…]}` — also every version, so deduplicate on `id` for one row per policy; each carries `kind`, and for `jev`/`both` `semantic`, `semanticSha256`, and the server-derived `authority`/`reviewedBy`. @@ -263,9 +263,9 @@ Cloud-managed enforcement, split the way the dashboard splits it: `policies` wri - `policies enable [-y]` · `policies disable [-y]` — **disable REMOVES the policy from every deployment carrying it**, reissuing each affected machine at a new generation (visible in `fleet history`). `enable` is the exact inverse — it puts the policy back into every deployment it was removed from, reissuing those machines again. Nothing needs redeploying by hand, and `machinesUpdated` in the JSON reports the count for both directions. - `policies test [SOURCE] [--tool Bash] [--command "…"] [--file PATH] [--event PreToolUse] [--expect allow|deny|instruct]` — run a policy LOCALLY and print what it decides. Makes no request, so unlike the rest of `policies` it also works with an API key. Executes the real file (bare `import { deny } from "failproofai"` and all) against a synthetic context; nothing is published, nothing installed. Needs `node`. `--expect` asserts the decision and exits 1 when it differs — a correct `deny` is a PASSING test, so the decision alone never sets the exit code. JSON `{ok, decision, policies:[{name,decision,reason}], expected, met}`; `decision` is the strictest any registered policy returned. - `policies author "" [--kind regex|jev|both]` — the assistant authors a vetted policy grounded on your org's events (with coverage). Draft only — nothing is published. `--kind jev` asks for Jev checks, `--kind both` for JavaScript plus its checks; default regex. -- `policies backtest [FILE_OR_ID] [--kind regex|jev|both] [--semantic checks.json] [--hours N] [--agent-id A] [--env E] [--run] [--sample N]` — replay a policy against calls your agents already made. A local `.mjs` (or `@path`, `-`) or a published **regex** id is replayed module-only, as always. A published `jev`/`both` id, or `--semantic` (alone = `jev`, with a source file = `both`), runs the every-kind backtest: by default a free **estimate**; `--run` actually asks Jev about up to `--sample` (≤50) stored calls and **spends the org's Jev allowance** — confirm with the user first. `--hours` defaults to 168 for jev/both. Needs `policies:write` and `events:read`. +- `policies backtest [FILE_OR_ID] [--kind regex|jev|both] [--semantic checks.json] [--hours N] [--agent-id A] [--env E] [--run] [--sample N]` — replay a policy against calls your agents already made. A local `.mjs` (or `@path`, `-`) or a published **regex** id is replayed module-only, as always. A published `jev`/`both` id, or `--semantic` (alone = `jev`, with a source file = `both`), runs the every-kind backtest: by default a free **estimate**; `--run` actually asks Jev about up to `--sample` (≤50) stored calls and **spends the org's Jev allowance** — confirm with the user first. `--hours` defaults to 168 for jev/both. Needs `fixes:write` and `events:read`. - `policies candidacy --issue ` — "could a policy prevent this issue?"; read-only verdict with a suggested intent. -- `policies compose "" [--out FILE] [--publish ID]` — the assistant drafts policy source from plain English. Prints it and stops by default: a generated policy that deploys itself is one nobody read. `--publish` still syntax-checks first. Needs `policies:write` for BOTH the draft and the publish — `POST /api/agent/compose-policy` is `withAuth("policies:write")`; `agent:use` gates the assistant's other routes and is not checked on this one. The composer has a **30s server-side limit** — a long or vague description simply does not finish, and raising `--timeout` does not help because the cut is not client-side. Retry with something shorter and more specific. +- `policies compose "" [--out FILE] [--publish ID]` — the assistant drafts policy source from plain English. Prints it and stops by default: a generated policy that deploys itself is one nobody read. `--publish` still syntax-checks first. Needs `fixes:write` for BOTH the draft and the publish — `POST /api/agent/compose-policy` is `withAuth("fixes:write")`; `agent:use` gates the assistant's other routes and is not checked on this one. The composer has a **30s server-side limit** — a long or vague description simply does not finish, and raising `--timeout` does not help because the cut is not client-side. Retry with something shorter and more specific. - `policies delete [-y]` — archives. **A machine already carrying the policy keeps enforcing it** until redeployed; `disable` is what stops enforcement everywhere. ### fleet @@ -285,7 +285,7 @@ Cloud-managed enforcement, split the way the dashboard splits it: `policies` wri **Races.** No server-side lock. The CLI records the generation it read and exits non-zero if the write does not land at exactly one higher — somebody else deployed, and a replace does not merge. Re-read with `fleet show` and retry. - **Idempotent.** Re-running the same deploy is a no-op that exits 0 without writing — desired-state semantics, so a retrying harness succeeds rather than errors. `applied` in the JSON is the only way to tell "changed it" from "already matched"; the exit code is 0 for both. The no-op short-circuits before the write, so a reader without `policies:write` also gets 0 there — exit 0 from a no-op is not proof of write access. + **Idempotent.** Re-running the same deploy is a no-op that exits 0 without writing — desired-state semantics, so a retrying harness succeeds rather than errors. `applied` in the JSON is the only way to tell "changed it" from "already matched"; the exit code is 0 for both. The no-op short-circuits before the write, so a reader without `fixes:write` also gets 0 there — exit 0 from a no-op is not proof of write access. **Exit codes.** A malformed ref (`bad ref!!`, `id:banana`, empty), or `--set` combined with `--add`/`--remove`, is a usage error → **exit 2**, like every other bad flag value. A ref that parses but names something that does not exist (`--add ghost-policy`, an unpublished `@version`) is **exit 1**; an unknown machine is **exit 6**. Branch on these rather than on the message. diff --git a/fp-cloud-cli/tests/test_cloud_human_views.py b/fp-cloud-cli/tests/test_cloud_human_views.py index 32014ab78..e717a89c2 100644 --- a/fp-cloud-cli/tests/test_cloud_human_views.py +++ b/fp-cloud-cli/tests/test_cloud_human_views.py @@ -284,4 +284,4 @@ def test_roles_permissions_wrap_as_readable_text(logged_in, runner, monkeypatch, assert result.exit_code == 0 assert "permissions" in result.stdout assert "[" not in result.stdout - assert "events:read" in result.stdout and "policies:write" in result.stdout + assert "events:read" in result.stdout and "fixes:write" in result.stdout diff --git a/fp-cloud-cli/tests/test_keys_queries.py b/fp-cloud-cli/tests/test_keys_queries.py index 573e07541..9274f9c62 100644 --- a/fp-cloud-cli/tests/test_keys_queries.py +++ b/fp-cloud-cli/tests/test_keys_queries.py @@ -27,11 +27,11 @@ def test_audit_permissions_are_assignable_and_in_presets(): def test_policy_permissions_are_assignable_and_in_presets(): from fp_cli.permissions import ALL_PERMISSIONS, PRESETS - assert "policies:read" in ALL_PERMISSIONS - assert "policies:write" in ALL_PERMISSIONS + assert "fixes:read" in ALL_PERMISSIONS + assert "fixes:write" in ALL_PERMISSIONS assert "policies:pull" in ALL_PERMISSIONS - assert "policies:read" in PRESETS["read-only"] - assert "policies:read" in PRESETS["standard"] + assert "fixes:read" in PRESETS["read-only"] + assert "fixes:read" in PRESETS["standard"] assert "policies:pull" in PRESETS["admin"] From 364e79b18d4276961f17ea97518e1cafc7020a04 Mon Sep 17 00:00:00 2001 From: chhhee10 Date: Mon, 2 Nov 2026 19:35:58 +0530 Subject: [PATCH 2/3] docs(code-fixes): fixing an issue from Slack and MCP Pairs with feat/fix-loop in the AgentEye repo. Co-Authored-By: Claude Opus 5.5 --- docs/audits/code-fixes.mdx | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/docs/audits/code-fixes.mdx b/docs/audits/code-fixes.mdx index 20e7439a8..ff53a9aed 100644 --- a/docs/audits/code-fixes.mdx +++ b/docs/audits/code-fixes.mdx @@ -19,6 +19,13 @@ Both start with a draft built from the insight: what went wrong, the likely caus A pull request is always yours to review, and nothing merges by itself. Follow every fix under **fix › code fixes**. +## From Slack and your AI tools + +You don't have to open the dashboard. Ask in Slack, or through FailproofAI's MCP server in an AI tool like Claude or Cursor, and the assistant tells you what can fix an issue. + +- **In Slack:** the assistant lays out the options, drafts the fix and takes anything you want to add. You approve it in the thread. Codex runs in FailproofAI Cloud, and the thread hears when the pull request opens. +- **In your AI tool:** you have two choices. Submit the job to run in FailproofAI Cloud, the same as from Slack. Or get the full context of the issue, including the rules the agent must keep, and have your own agent make the change and raise the pull request itself. + ## What it needs - GitHub connected, with the agent linked to the folder that runs it. From 4520a80d2dda66385409c2d7276e4a09246510f5 Mon Sep 17 00:00:00 2001 From: chhhee10 Date: Thu, 5 Nov 2026 15:23:16 +0530 Subject: [PATCH 3/3] fix(fp-cli): code fixes have their own code_fixes permissions; policies keep theirs The server split these on 2026-11-04: `policies:*` stayed for policies, and code fixes got `code_fixes:*`. This branch still renamed `policies:*` to `fixes:*`, which the server now reads as policies, so a key made with it would get the wrong access. Puts every policies name back, adds `code_fixes:read` and `code_fixes:write`, and rewrites the code fixes page for the one-click flow. Co-Authored-By: Claude Opus 5.5 --- docs/admin/keys-and-permissions.mdx | 3 ++- docs/ar/admin/keys-and-permissions.mdx | 2 +- docs/ar/policies/editor.mdx | 2 +- docs/ar/policies/rollback.mdx | 2 +- docs/ar/reference/cloud-cli.mdx | 2 +- docs/audits/code-fixes.mdx | 16 +++++++------- docs/de/admin/keys-and-permissions.mdx | 2 +- docs/de/policies/editor.mdx | 2 +- docs/de/policies/rollback.mdx | 2 +- docs/de/reference/cloud-cli.mdx | 2 +- docs/es/admin/keys-and-permissions.mdx | 2 +- docs/es/policies/editor.mdx | 2 +- docs/es/policies/rollback.mdx | 2 +- docs/es/reference/cloud-cli.mdx | 2 +- docs/fr/admin/keys-and-permissions.mdx | 2 +- docs/fr/policies/editor.mdx | 2 +- docs/fr/policies/rollback.mdx | 2 +- docs/fr/reference/cloud-cli.mdx | 2 +- docs/he/admin/keys-and-permissions.mdx | 2 +- docs/he/policies/editor.mdx | 2 +- docs/he/policies/rollback.mdx | 2 +- docs/he/reference/cloud-cli.mdx | 2 +- docs/hi/admin/keys-and-permissions.mdx | 2 +- docs/hi/policies/editor.mdx | 2 +- docs/hi/policies/rollback.mdx | 2 +- docs/hi/reference/cloud-cli.mdx | 2 +- docs/it/admin/keys-and-permissions.mdx | 2 +- docs/it/policies/editor.mdx | 2 +- docs/it/policies/rollback.mdx | 2 +- docs/it/reference/cloud-cli.mdx | 2 +- docs/ja/admin/keys-and-permissions.mdx | 2 +- docs/ja/policies/editor.mdx | 2 +- docs/ja/policies/rollback.mdx | 2 +- docs/ja/reference/cloud-cli.mdx | 2 +- docs/ko/admin/keys-and-permissions.mdx | 2 +- docs/ko/policies/editor.mdx | 2 +- docs/ko/policies/rollback.mdx | 2 +- docs/ko/reference/cloud-cli.mdx | 2 +- docs/policies/editor.mdx | 2 +- docs/policies/rollback.mdx | 2 +- docs/pt-br/admin/keys-and-permissions.mdx | 2 +- docs/pt-br/policies/editor.mdx | 2 +- docs/pt-br/policies/rollback.mdx | 2 +- docs/pt-br/reference/cloud-cli.mdx | 2 +- docs/reference/cloud-cli.mdx | 2 +- docs/ru/admin/keys-and-permissions.mdx | 2 +- docs/ru/policies/editor.mdx | 2 +- docs/ru/policies/rollback.mdx | 2 +- docs/ru/reference/cloud-cli.mdx | 2 +- docs/tr/admin/keys-and-permissions.mdx | 2 +- docs/tr/policies/editor.mdx | 2 +- docs/tr/policies/rollback.mdx | 2 +- docs/tr/reference/cloud-cli.mdx | 2 +- docs/vi/admin/keys-and-permissions.mdx | 2 +- docs/vi/policies/editor.mdx | 2 +- docs/vi/policies/rollback.mdx | 2 +- docs/vi/reference/cloud-cli.mdx | 2 +- docs/zh/admin/keys-and-permissions.mdx | 2 +- docs/zh/policies/editor.mdx | 2 +- docs/zh/policies/rollback.mdx | 2 +- docs/zh/reference/cloud-cli.mdx | 2 +- fp-cloud-cli/fp_cli/client.py | 2 +- fp-cloud-cli/fp_cli/commands/fleet_cmds.py | 16 +++++++------- .../fp_cli/commands/guardrails_cmds.py | 4 ++-- fp-cloud-cli/fp_cli/commands/policies_cmds.py | 22 +++++++++---------- fp-cloud-cli/fp_cli/permissions.py | 9 ++++---- fp-cloud-cli/skill/references/commands.md | 8 +++---- fp-cloud-cli/tests/test_cloud_human_views.py | 2 +- fp-cloud-cli/tests/test_keys_queries.py | 8 +++---- 69 files changed, 104 insertions(+), 104 deletions(-) diff --git a/docs/admin/keys-and-permissions.mdx b/docs/admin/keys-and-permissions.mdx index be590263e..ec233d87f 100644 --- a/docs/admin/keys-and-permissions.mdx +++ b/docs/admin/keys-and-permissions.mdx @@ -64,7 +64,8 @@ Key secrets are shown when created or regenerated. Store them in a secret manage | Alerts | `alerts:read`, `alerts:write` | | Issues | `issues:read`, `issues:create`, `issues:close` | | Audits | `audits:read`, `audits:write` | -| Policies | `fixes:read`, `fixes:write`, `policies:pull` | +| Policies | `policies:read`, `policies:write`, `policies:pull` | +| Code fixes | `code_fixes:read`, `code_fixes:write` | | Usage | `usage:read` | | Jev | `jev:evaluate` (requires `events:add` and `policies:pull`) | diff --git a/docs/ar/admin/keys-and-permissions.mdx b/docs/ar/admin/keys-and-permissions.mdx index ebc8db889..43a40efc3 100644 --- a/docs/ar/admin/keys-and-permissions.mdx +++ b/docs/ar/admin/keys-and-permissions.mdx @@ -62,7 +62,7 @@ icon: "key-round" | التنبيهات | `alerts:read`, `alerts:write` | | المشاكل | `issues:read`, `issues:create`, `issues:close` | | عمليات التدقيق | `audits:read`, `audits:write` | -| السياسات | `fixes:read`, `fixes:write`, `policies:pull` | +| السياسات | `policies:read`, `policies:write`, `policies:pull` | | الاستخدام | `usage:read` | `orgs:admin` محجوز لمشغل المثيل ولا يمكن منحه لمفتاح تنظيمي أو عضو عادي. يتم قبول الرموز المتقاعدة `incidents:*` و `alerts:ack` للتوافق وتطبيعها على أذونات `issues:*` الحالية. diff --git a/docs/ar/policies/editor.mdx b/docs/ar/policies/editor.mdx index ba2f8d750..e0e244339 100644 --- a/docs/ar/policies/editor.mdx +++ b/docs/ar/policies/editor.mdx @@ -33,7 +33,7 @@ icon: "file-pen-line" fp policies compose "Block git push --force on release branches" ``` - يتطلب `compose` جلسة موقعة (`fp login`) دورها لديه `fixes:write`؛ يرفض مفاتيح API. + يتطلب `compose` جلسة موقعة (`fp login`) دورها لديه `policies:write`؛ يرفض مفاتيح API. diff --git a/docs/ar/policies/rollback.mdx b/docs/ar/policies/rollback.mdx index f3c43c12f..c8bcfa146 100644 --- a/docs/ar/policies/rollback.mdx +++ b/docs/ar/policies/rollback.mdx @@ -37,7 +37,7 @@ icon: "rotate-ccw" fp fleet rollback ``` - `rollback` ينشئ جيلاً جديداً يحمل المجموعة القديمة بدلاً من إعادة تعيين العداد، لذا يبقى السجل إضافياً فقط، ويرفض جيلاً يسمي سياسة تم تعطيلها أو حذفها. يحتاج إلى جلسة موقعة بـ `fixes:write`. `fp fleet diff ` يعرض ما كان مقصوداً مقابل ما طبقه الجهاز — يقرأ كـ `behind` حتى يستفسر الجهاز مرة أخرى — وعلى الجهاز نفسه، `failproofai policies` يعرج النشر الذي يعمل عليه. + `rollback` ينشئ جيلاً جديداً يحمل المجموعة القديمة بدلاً من إعادة تعيين العداد، لذا يبقى السجل إضافياً فقط، ويرفض جيلاً يسمي سياسة تم تعطيلها أو حذفها. يحتاج إلى جلسة موقعة بـ `policies:write`. `fp fleet diff ` يعرض ما كان مقصوداً مقابل ما طبقه الجهاز — يقرأ كـ `behind` حتى يستفسر الجهاز مرة أخرى — وعلى الجهاز نفسه، `failproofai policies` يعرج النشر الذي يعمل عليه. diff --git a/docs/ar/reference/cloud-cli.mdx b/docs/ar/reference/cloud-cli.mdx index addae288a..4ca626e3a 100644 --- a/docs/ar/reference/cloud-cli.mdx +++ b/docs/ar/reference/cloud-cli.mdx @@ -329,7 +329,7 @@ fp audits create checkout-reliability \ | `fp policies disable POLICY_ID` | أزلها من كل نشر تحملها، نقيب جيل جديد على كل واحد. | `--yes`, `-y` | | `fp policies delete POLICY_ID` | حذف إصدار سياسة. | `--yes`, `-y` | | `fp policies test PATH` | شغّل سياسة محلياً مقابل سياق تركيبي. تطبق تصفية `match` لكل سياسة، لذلك التي لا تغطي الحدث/الأداة المحددة يتم الإبلاغ عنها `skipped` بدلاً من التشغيل. | `--event`; `--tool`; `--command`; `--file`; `--expect` | -| `fp policies compose PROMPT` | صيغ سياسة مع المساعد. يحتاج `fixes:write`. | — | +| `fp policies compose PROMPT` | صيغ سياسة مع المساعد. يحتاج `policies:write`. | — | ### الأسطول diff --git a/docs/audits/code-fixes.mdx b/docs/audits/code-fixes.mdx index ff53a9aed..0a9c7fca6 100644 --- a/docs/audits/code-fixes.mdx +++ b/docs/audits/code-fixes.mdx @@ -8,25 +8,25 @@ A policy stops an agent doing the wrong thing. Sometimes the problem is how the ## From insight to pull request -When an audit reads the cause of an insight in your agent's code, the insight says a code change can fix it, and why. From **what to do** on any insight, you can: +Policies come first. When a policy can't stop the problem and the agent's code can, the insight offers two things, and one click does either: -- **Create a pull request.** Codex works on a copy of your repository, makes the change and runs what tests it can, then opens a draft pull request for your team to review. +- **Create a pull request.** Codex works on a copy of your repository, makes the change and runs what tests it can, then opens a draft pull request for your team to review. You get an email when it opens. - **Raise a GitHub issue.** The insight's findings go to your repository's issues, for someone on your team to pick up. -## You review first +The click is the go-ahead, recorded against the person who made it. The insight says who asked, links to the result, and says when the pull request is merged or closed. -Both start with a draft built from the insight: what went wrong, the likely cause, the rule it breaks and the code involved. You can edit it and add what only you know. Nothing reaches GitHub, and no model runs, until you approve it. - -A pull request is always yours to review, and nothing merges by itself. Follow every fix under **fix › code fixes**. +A pull request is always yours to review, and nothing merges by itself. ## From Slack and your AI tools You don't have to open the dashboard. Ask in Slack, or through FailproofAI's MCP server in an AI tool like Claude or Cursor, and the assistant tells you what can fix an issue. -- **In Slack:** the assistant lays out the options, drafts the fix and takes anything you want to add. You approve it in the thread. Codex runs in FailproofAI Cloud, and the thread hears when the pull request opens. +- **In Slack:** the assistant suggests what fits, policies first. Pick one and answer yes. Codex runs in FailproofAI Cloud, and the thread hears when the pull request opens. - **In your AI tool:** you have two choices. Submit the job to run in FailproofAI Cloud, the same as from Slack. Or get the full context of the issue, including the rules the agent must keep, and have your own agent make the change and raise the pull request itself. ## What it needs - GitHub connected, with the agent linked to the folder that runs it. -- The `fixes:write` permission to draft and approve, and `fixes:read` to see fixes. These permissions also cover cloud policies. +- The `code_fixes:write` permission to raise a fix or stop one, and `code_fixes:read` to see them. These are separate from `policies:read` and `policies:write`. + +GitHub connects the same way everywhere, with no app to create and no key to set. Your code goes between GitHub and your deployment directly. diff --git a/docs/de/admin/keys-and-permissions.mdx b/docs/de/admin/keys-and-permissions.mdx index 0946f4bc4..99ed8d814 100644 --- a/docs/de/admin/keys-and-permissions.mdx +++ b/docs/de/admin/keys-and-permissions.mdx @@ -62,7 +62,7 @@ Schlüssel-Secrets werden bei der Erstellung oder Regenerierung angezeigt. Speic | Alerts | `alerts:read`, `alerts:write` | | Issues | `issues:read`, `issues:create`, `issues:close` | | Audits | `audits:read`, `audits:write` | -| Policies | `fixes:read`, `fixes:write`, `policies:pull` | +| Policies | `policies:read`, `policies:write`, `policies:pull` | | Usage | `usage:read` | `orgs:admin` ist dem Instanz-Operator vorbehalten und kann weder einem Organisations-Schlüssel noch einem gewöhnlichen Mitglied gewährt werden. Veraltete `incidents:*`- und `alerts:ack`-Token werden aus Kompatibilitätsgründen akzeptiert und auf die aktuellen `issues:*`-Berechtigungen normalisiert. diff --git a/docs/de/policies/editor.mdx b/docs/de/policies/editor.mdx index 0432133a5..e14bf1d09 100644 --- a/docs/de/policies/editor.mdx +++ b/docs/de/policies/editor.mdx @@ -33,7 +33,7 @@ Führe einen [Audit](/de/audits/run) über die Sitzungen durch, in denen der Feh fp policies compose "Block git push --force on release branches" ``` - `compose` benötigt eine angemeldete Sitzung (`fp login`), deren Rolle `fixes:write` besitzt; API-Keys werden abgelehnt. + `compose` benötigt eine angemeldete Sitzung (`fp login`), deren Rolle `policies:write` besitzt; API-Keys werden abgelehnt. diff --git a/docs/de/policies/rollback.mdx b/docs/de/policies/rollback.mdx index 9da579536..5be42ad00 100644 --- a/docs/de/policies/rollback.mdx +++ b/docs/de/policies/rollback.mdx @@ -37,7 +37,7 @@ Eine veröffentlichte Richtlinienversion ändert sich nie. Das Bearbeiten einer fp fleet rollback ``` - `rollback` erstellt eine neue Generation mit dem alten Satz, anstatt den Zähler zurückzusetzen, sodass der Verlauf nur erweiterbar bleibt. Es lehnt eine Generation ab, die eine inzwischen deaktivierte oder gelöschte Richtlinie benennt. Der Befehl benötigt eine angemeldete Sitzung mit `fixes:write`. `fp fleet diff ` zeigt den Unterschied zwischen dem Beabsichtigten und dem, was die Maschine tatsächlich angewendet hat — der Status erscheint als `behind`, bis die Maschine das nächste Mal abfragt. Auf der Maschine selbst listet `failproofai policies` das aktuell laufende Deployment auf. + `rollback` erstellt eine neue Generation mit dem alten Satz, anstatt den Zähler zurückzusetzen, sodass der Verlauf nur erweiterbar bleibt. Es lehnt eine Generation ab, die eine inzwischen deaktivierte oder gelöschte Richtlinie benennt. Der Befehl benötigt eine angemeldete Sitzung mit `policies:write`. `fp fleet diff ` zeigt den Unterschied zwischen dem Beabsichtigten und dem, was die Maschine tatsächlich angewendet hat — der Status erscheint als `behind`, bis die Maschine das nächste Mal abfragt. Auf der Maschine selbst listet `failproofai policies` das aktuell laufende Deployment auf. diff --git a/docs/de/reference/cloud-cli.mdx b/docs/de/reference/cloud-cli.mdx index 72f578f26..07de74d08 100644 --- a/docs/de/reference/cloud-cli.mdx +++ b/docs/de/reference/cloud-cli.mdx @@ -329,7 +329,7 @@ Cloud-verwaltete Richtlinienversionen. **Nur Sitzung** — jeder Befehl hier bee | `fp policies disable POLICY_ID` | Aus jedem Deployment entfernen, das sie enthält, und dabei jeweils eine neue Generation erstellen. | `--yes`, `-y` | | `fp policies delete POLICY_ID` | Eine Richtlinienversion löschen. | `--yes`, `-y` | | `fp policies test PATH` | Eine Richtlinie lokal gegen einen synthetischen Kontext testen. Wendet den `match`-Filter jeder Richtlinie an; eine Richtlinie, die das angegebene Event/Tool nicht abdeckt, wird als `skipped` gemeldet statt ausgeführt. | `--event`; `--tool`; `--command`; `--file`; `--expect` | -| `fp policies compose PROMPT` | Eine Richtlinie mit dem Assistenten entwerfen. Erfordert `fixes:write`. | — | +| `fp policies compose PROMPT` | Eine Richtlinie mit dem Assistenten entwerfen. Erfordert `policies:write`. | — | ### Fleet diff --git a/docs/es/admin/keys-and-permissions.mdx b/docs/es/admin/keys-and-permissions.mdx index bef4a2e67..c49df1938 100644 --- a/docs/es/admin/keys-and-permissions.mdx +++ b/docs/es/admin/keys-and-permissions.mdx @@ -62,7 +62,7 @@ Los secretos de las claves se muestran al crearlas o regenerarlas. Guárdalos en | Alertas | `alerts:read`, `alerts:write` | | Incidencias | `issues:read`, `issues:create`, `issues:close` | | Auditorías | `audits:read`, `audits:write` | -| Políticas | `fixes:read`, `fixes:write`, `policies:pull` | +| Políticas | `policies:read`, `policies:write`, `policies:pull` | | Uso | `usage:read` | `orgs:admin` está reservado para el operador de la instancia y no puede concederse a una clave de organización ni a un miembro ordinario. Los tokens retirados `incidents:*` y `alerts:ack` se aceptan por compatibilidad y se normalizan a los permisos actuales `issues:*`. diff --git a/docs/es/policies/editor.mdx b/docs/es/policies/editor.mdx index 5cdfb6587..07b02f375 100644 --- a/docs/es/policies/editor.mdx +++ b/docs/es/policies/editor.mdx @@ -33,7 +33,7 @@ Una auditoría detecta un fallo; una política evita que vuelva a ocurrir. Failp fp policies compose "Block git push --force on release branches" ``` - `compose` requiere una sesión con sesión iniciada (`fp login`) cuyo rol tenga `fixes:write`; rechaza las claves de API. + `compose` requiere una sesión con sesión iniciada (`fp login`) cuyo rol tenga `policies:write`; rechaza las claves de API. diff --git a/docs/es/policies/rollback.mdx b/docs/es/policies/rollback.mdx index 2f149cf83..0a0021622 100644 --- a/docs/es/policies/rollback.mdx +++ b/docs/es/policies/rollback.mdx @@ -37,7 +37,7 @@ Una versión de política publicada nunca cambia. Editar una política y volver fp fleet rollback ``` - `rollback` genera una nueva generación que contiene el conjunto anterior en lugar de retroceder el contador, por lo que el historial permanece solo de adición, y rechaza una generación que nombre una política desactivada o eliminada. Requiere una sesión iniciada con `fixes:write`. `fp fleet diff ` muestra lo que se pretendía aplicar frente a lo que la máquina efectivamente aplicó — aparece como `behind` hasta que la máquina vuelva a sondear — y en la propia máquina, `failproofai policies` lista el despliegue que está ejecutando. + `rollback` genera una nueva generación que contiene el conjunto anterior en lugar de retroceder el contador, por lo que el historial permanece solo de adición, y rechaza una generación que nombre una política desactivada o eliminada. Requiere una sesión iniciada con `policies:write`. `fp fleet diff ` muestra lo que se pretendía aplicar frente a lo que la máquina efectivamente aplicó — aparece como `behind` hasta que la máquina vuelva a sondear — y en la propia máquina, `failproofai policies` lista el despliegue que está ejecutando. diff --git a/docs/es/reference/cloud-cli.mdx b/docs/es/reference/cloud-cli.mdx index 9b4198e39..0da00cbc4 100644 --- a/docs/es/reference/cloud-cli.mdx +++ b/docs/es/reference/cloud-cli.mdx @@ -329,7 +329,7 @@ Versiones de políticas administradas en la nube. **Solo de sesión** — cada c | `fp policies disable POLICY_ID` | La elimina de cada despliegue que la contiene, creando una nueva generación en cada uno. | `--yes`, `-y` | | `fp policies delete POLICY_ID` | Elimina una versión de política. | `--yes`, `-y` | | `fp policies test PATH` | Ejecuta una política localmente contra un contexto sintético. Aplica el filtro `match` de cada política, por lo que una que no cubra el evento/herramienta dado se reporta como `skipped` en lugar de ejecutarse. | `--event`; `--tool`; `--command`; `--file`; `--expect` | -| `fp policies compose PROMPT` | Redacta una política con el asistente. Requiere `fixes:write`. | — | +| `fp policies compose PROMPT` | Redacta una política con el asistente. Requiere `policies:write`. | — | ### Flota diff --git a/docs/fr/admin/keys-and-permissions.mdx b/docs/fr/admin/keys-and-permissions.mdx index 80042777e..7deb35218 100644 --- a/docs/fr/admin/keys-and-permissions.mdx +++ b/docs/fr/admin/keys-and-permissions.mdx @@ -62,7 +62,7 @@ Les secrets de clé sont affichés lors de leur création ou régénération. St | Alertes | `alerts:read`, `alerts:write` | | Problèmes | `issues:read`, `issues:create`, `issues:close` | | Audits | `audits:read`, `audits:write` | -| Politiques | `fixes:read`, `fixes:write`, `policies:pull` | +| Politiques | `policies:read`, `policies:write`, `policies:pull` | | Utilisation | `usage:read` | `orgs:admin` est réservé à l'opérateur de l'instance et ne peut pas être accordé à une clé d'organisation ou à un membre ordinaire. Les jetons `incidents:*` et `alerts:ack` retirés sont acceptés pour des raisons de compatibilité et sont normalisés vers les permissions `issues:*` actuelles. diff --git a/docs/fr/policies/editor.mdx b/docs/fr/policies/editor.mdx index cdfc77662..7da36da50 100644 --- a/docs/fr/policies/editor.mdx +++ b/docs/fr/policies/editor.mdx @@ -33,7 +33,7 @@ Un audit détecte une défaillance ; une politique empêche qu'elle se reproduis fp policies compose "Block git push --force on release branches" ``` - `compose` nécessite une session connectée (`fp login`) dont le rôle dispose de `fixes:write` ; il refuse les clés API. + `compose` nécessite une session connectée (`fp login`) dont le rôle dispose de `policies:write` ; il refuse les clés API. diff --git a/docs/fr/policies/rollback.mdx b/docs/fr/policies/rollback.mdx index e37cd11b3..6c7f43f45 100644 --- a/docs/fr/policies/rollback.mdx +++ b/docs/fr/policies/rollback.mdx @@ -37,7 +37,7 @@ Une version de politique publiée ne change jamais. Modifier une politique et la fp fleet rollback ``` - `rollback` crée une nouvelle génération portant l'ancien ensemble plutôt que de rembobiner le compteur, de sorte que l'historique reste en ajout uniquement. Cette commande refuse une génération faisant référence à une politique désactivée ou supprimée. Elle nécessite une session connectée avec `fixes:write`. `fp fleet diff ` montre ce qui était prévu par rapport à ce que la machine a appliqué — il s'affiche comme `behind` jusqu'au prochain sondage de la machine — et sur la machine elle-même, `failproofai policies` liste le déploiement en cours d'exécution. + `rollback` crée une nouvelle génération portant l'ancien ensemble plutôt que de rembobiner le compteur, de sorte que l'historique reste en ajout uniquement. Cette commande refuse une génération faisant référence à une politique désactivée ou supprimée. Elle nécessite une session connectée avec `policies:write`. `fp fleet diff ` montre ce qui était prévu par rapport à ce que la machine a appliqué — il s'affiche comme `behind` jusqu'au prochain sondage de la machine — et sur la machine elle-même, `failproofai policies` liste le déploiement en cours d'exécution. diff --git a/docs/fr/reference/cloud-cli.mdx b/docs/fr/reference/cloud-cli.mdx index 2d6982b74..ede81d78a 100644 --- a/docs/fr/reference/cloud-cli.mdx +++ b/docs/fr/reference/cloud-cli.mdx @@ -329,7 +329,7 @@ Versions de politiques gérées depuis le cloud. **Session uniquement** — chaq | `fp policies disable POLICY_ID` | La retirer de chaque déploiement qui la porte, en créant une nouvelle génération sur chacun. | `--yes`, `-y` | | `fp policies delete POLICY_ID` | Supprimer une version de politique. | `--yes`, `-y` | | `fp policies test PATH` | Exécuter une politique localement contre un contexte synthétique. Applique le filtre `match` de chaque politique, donc une politique qui ne couvre pas l'événement/outil donné est signalée comme `skipped` plutôt qu'exécutée. | `--event` ; `--tool` ; `--command` ; `--file` ; `--expect` | -| `fp policies compose PROMPT` | Rédiger une politique avec l'assistant. Nécessite `fixes:write`. | — | +| `fp policies compose PROMPT` | Rédiger une politique avec l'assistant. Nécessite `policies:write`. | — | ### Flotte diff --git a/docs/he/admin/keys-and-permissions.mdx b/docs/he/admin/keys-and-permissions.mdx index 54cd17703..8c2064a7e 100644 --- a/docs/he/admin/keys-and-permissions.mdx +++ b/docs/he/admin/keys-and-permissions.mdx @@ -62,7 +62,7 @@ icon: "key-round" | Alerts | `alerts:read`, `alerts:write` | | Issues | `issues:read`, `issues:create`, `issues:close` | | Audits | `audits:read`, `audits:write` | -| Policies | `fixes:read`, `fixes:write`, `policies:pull` | +| Policies | `policies:read`, `policies:write`, `policies:pull` | | Usage | `usage:read` | `orgs:admin` שמור למפעיל המופע ולא ניתן להעניק למפתח ארגוני או לחבר רגיל. אסימונים `incidents:*` ו-`alerts:ack` מיושנים מתקבלים לתאימות ומנורמלים להרשאות `issues:*` עדכניות. diff --git a/docs/he/policies/editor.mdx b/docs/he/policies/editor.mdx index c93ddf601..83688055e 100644 --- a/docs/he/policies/editor.mdx +++ b/docs/he/policies/editor.mdx @@ -33,7 +33,7 @@ icon: "file-pen-line" fp policies compose "Block git push --force on release branches" ``` - `compose` דורש session מחובר (`fp login`) שלתפקיד שלו יש הרשאת `fixes:write`; מפתחות API נדחים. + `compose` דורש session מחובר (`fp login`) שלתפקיד שלו יש הרשאת `policies:write`; מפתחות API נדחים. diff --git a/docs/he/policies/rollback.mdx b/docs/he/policies/rollback.mdx index aa9e987d9..765544d1a 100644 --- a/docs/he/policies/rollback.mdx +++ b/docs/he/policies/rollback.mdx @@ -37,7 +37,7 @@ icon: "rotate-ccw" fp fleet rollback ``` - `rollback` יוצר דור חדש שנושא את הקבוצה הישנה במקום להחזיר את המונה, כך שהיסטוריה נשארת append-only, והוא מסרב לדור שקוראים לו מדיניות מכיוון שהושבתה או נמחקה. זה דורש סשן עם כניסה חתום עם `fixes:write`. `fp fleet diff ` מראה מה היה מעוצב לעומת מה שהמכונה יישמה — זה נקרא `behind` עד שהמכונה תסקור בפעם הבאה — ובמכונה עצמה, `failproofai policies` מפרטת את ההצבה שהיא מפעילה. + `rollback` יוצר דור חדש שנושא את הקבוצה הישנה במקום להחזיר את המונה, כך שהיסטוריה נשארת append-only, והוא מסרב לדור שקוראים לו מדיניות מכיוון שהושבתה או נמחקה. זה דורש סשן עם כניסה חתום עם `policies:write`. `fp fleet diff ` מראה מה היה מעוצב לעומת מה שהמכונה יישמה — זה נקרא `behind` עד שהמכונה תסקור בפעם הבאה — ובמכונה עצמה, `failproofai policies` מפרטת את ההצבה שהיא מפעילה. diff --git a/docs/he/reference/cloud-cli.mdx b/docs/he/reference/cloud-cli.mdx index 34d718964..06b6d673c 100644 --- a/docs/he/reference/cloud-cli.mdx +++ b/docs/he/reference/cloud-cli.mdx @@ -329,7 +329,7 @@ fp audits create checkout-reliability \ | `fp policies disable POLICY_ID` | הסר אותה מכל פריסה שנושאת אותה, הנפקת דור חדש בכל אחד. | `--yes`, `-y` | | `fp policies delete POLICY_ID` | מחיקת גרסת מדיניות. | `--yes`, `-y` | | `fp policies test PATH` | הרצת מדיניות מקומית מול הקשר סינתטי. חל כל מסנן `match` של המדיניות, אז אחד שלא מכסה את האירוע/הכלי הנתון מדווח `skipped` ולא הרץ. | `--event`; `--tool`; `--command`; `--file`; `--expect` | -| `fp policies compose PROMPT` | טיוטת מדיניות עם ה-assistant. צורך `fixes:write`. | — | +| `fp policies compose PROMPT` | טיוטת מדיניות עם ה-assistant. צורך `policies:write`. | — | ### Fleet diff --git a/docs/hi/admin/keys-and-permissions.mdx b/docs/hi/admin/keys-and-permissions.mdx index 7aac7fe60..c1d1bfea3 100644 --- a/docs/hi/admin/keys-and-permissions.mdx +++ b/docs/hi/admin/keys-and-permissions.mdx @@ -62,7 +62,7 @@ API कुंजियाँ किसी संगठन से संबंध | Alerts | `alerts:read`, `alerts:write` | | Issues | `issues:read`, `issues:create`, `issues:close` | | Audits | `audits:read`, `audits:write` | -| Policies | `fixes:read`, `fixes:write`, `policies:pull` | +| Policies | `policies:read`, `policies:write`, `policies:pull` | | Usage | `usage:read` | `orgs:admin` इंस्टेंस ऑपरेटर के लिए आरक्षित है और किसी संगठन कुंजी या साधारण सदस्य को प्रदान नहीं किया जा सकता है। सेवानिवृत्त `incidents:*` और `alerts:ack` टोकन अनुकूलता के लिए स्वीकार किए जाते हैं और वर्तमान `issues:*` अनुमतियों को सामान्य करते हैं। diff --git a/docs/hi/policies/editor.mdx b/docs/hi/policies/editor.mdx index e5e4a8874..203ad9e3b 100644 --- a/docs/hi/policies/editor.mdx +++ b/docs/hi/policies/editor.mdx @@ -33,7 +33,7 @@ icon: "file-pen-line" fp policies compose "Block git push --force on release branches" ``` - `compose` को एक साइन-इन सत्र (`fp login`) की आवश्यकता है जिसकी भूमिका में `fixes:write` है; यह API कुंजियों को अस्वीकार करता है। + `compose` को एक साइन-इन सत्र (`fp login`) की आवश्यकता है जिसकी भूमिका में `policies:write` है; यह API कुंजियों को अस्वीकार करता है। diff --git a/docs/hi/policies/rollback.mdx b/docs/hi/policies/rollback.mdx index db3d86afa..56062420b 100644 --- a/docs/hi/policies/rollback.mdx +++ b/docs/hi/policies/rollback.mdx @@ -37,7 +37,7 @@ icon: "rotate-ccw" fp fleet rollback ``` - `rollback` काउंटर को वापस न लपेटने के बजाय पुराने सेट को ले जाने वाली एक नई जनरेशन बनाता है, इसलिए इतिहास केवल-जोड़ रहता है, और यह एक जनरेशन से इनकार करता है जो एक ऐसी नीति का नाम देता है जो अक्षम या हटाई गई है। इसे `fixes:write` के साथ एक हस्ताक्षरित-में सत्र की आवश्यकता है। `fp fleet diff ` दिखाता है कि क्या लक्षित था मशीन ने जो लागू किया उसके विरुद्ध — यह `behind` के रूप में पढ़ता है जब तक मशीन अगली बार पोल नहीं करती — और मशीन पर ही, `failproofai policies` जनरेशन सूचीबद्ध करता है जो यह चला रहा है। + `rollback` काउंटर को वापस न लपेटने के बजाय पुराने सेट को ले जाने वाली एक नई जनरेशन बनाता है, इसलिए इतिहास केवल-जोड़ रहता है, और यह एक जनरेशन से इनकार करता है जो एक ऐसी नीति का नाम देता है जो अक्षम या हटाई गई है। इसे `policies:write` के साथ एक हस्ताक्षरित-में सत्र की आवश्यकता है। `fp fleet diff ` दिखाता है कि क्या लक्षित था मशीन ने जो लागू किया उसके विरुद्ध — यह `behind` के रूप में पढ़ता है जब तक मशीन अगली बार पोल नहीं करती — और मशीन पर ही, `failproofai policies` जनरेशन सूचीबद्ध करता है जो यह चला रहा है। diff --git a/docs/hi/reference/cloud-cli.mdx b/docs/hi/reference/cloud-cli.mdx index 0bb407cb3..067e884f9 100644 --- a/docs/hi/reference/cloud-cli.mdx +++ b/docs/hi/reference/cloud-cli.mdx @@ -329,7 +329,7 @@ Cloud-managed policy versions। **Session-only** — यहां हर comman | `fp policies disable POLICY_ID` | इसे हर deployment से remove करें जो इसे carry कर रहा है, हर एक पर एक नई generation को mint करते हुए। | `--yes`, `-y` | | `fp policies delete POLICY_ID` | एक policy version को delete करें। | `--yes`, `-y` | | `fp policies test PATH` | एक synthetic context के against एक policy को locally run करें। हर policy के `match` filter को apply करता है, तो एक जो given event/tool को cover नहीं करता है `skipped` के रूप में rather than run किया जाता है। | `--event`; `--tool`; `--command`; `--file`; `--expect` | -| `fp policies compose PROMPT` | Assistant के साथ एक policy को draft करें। `fixes:write` की जरूरत है। | — | +| `fp policies compose PROMPT` | Assistant के साथ एक policy को draft करें। `policies:write` की जरूरत है। | — | ### Fleet diff --git a/docs/it/admin/keys-and-permissions.mdx b/docs/it/admin/keys-and-permissions.mdx index 25683326b..9a13ad6cd 100644 --- a/docs/it/admin/keys-and-permissions.mdx +++ b/docs/it/admin/keys-and-permissions.mdx @@ -62,7 +62,7 @@ I segreti delle chiavi vengono mostrati quando creati o rigenerati. Archiviali i | Alerts | `alerts:read`, `alerts:write` | | Issues | `issues:read`, `issues:create`, `issues:close` | | Audits | `audits:read`, `audits:write` | -| Policies | `fixes:read`, `fixes:write`, `policies:pull` | +| Policies | `policies:read`, `policies:write`, `policies:pull` | | Usage | `usage:read` | `orgs:admin` è riservato all'operatore dell'istanza e non può essere concesso a una chiave dell'organizzazione o a un membro ordinario. I token ritirati `incidents:*` e `alerts:ack` sono accettati per compatibilità e si normalizzano ai permessi `issues:*` attuali. diff --git a/docs/it/policies/editor.mdx b/docs/it/policies/editor.mdx index 673d331b6..95876cd94 100644 --- a/docs/it/policies/editor.mdx +++ b/docs/it/policies/editor.mdx @@ -33,7 +33,7 @@ Un audit trova un errore; una policy lo impedisce che accada di nuovo. Failproof fp policies compose "Block git push --force on release branches" ``` - `compose` richiede una sessione autenticata (`fp login`) il cui ruolo ha `fixes:write`; rifiuta le chiavi API. + `compose` richiede una sessione autenticata (`fp login`) il cui ruolo ha `policies:write`; rifiuta le chiavi API. diff --git a/docs/it/policies/rollback.mdx b/docs/it/policies/rollback.mdx index 850c97ed4..b61224863 100644 --- a/docs/it/policies/rollback.mdx +++ b/docs/it/policies/rollback.mdx @@ -37,7 +37,7 @@ Una versione di policy pubblicata non cambia mai. La modifica di una policy e un fp fleet rollback ``` - `rollback` crea una nuova generazione con il vecchio set anziché riavvolgere il contatore, quindi la cronologia rimane append-only e rifiuta una generazione che nomina una policy successivamente disabilitata o eliminata. Richiede una sessione autenticata con `fixes:write`. `fp fleet diff ` mostra cosa era previsto rispetto a ciò che il computer ha applicato — viene letto come `behind` finché il computer non fa il prossimo polling — e sulla macchina stessa, `failproofai policies` elenca la distribuzione che sta eseguendo. + `rollback` crea una nuova generazione con il vecchio set anziché riavvolgere il contatore, quindi la cronologia rimane append-only e rifiuta una generazione che nomina una policy successivamente disabilitata o eliminata. Richiede una sessione autenticata con `policies:write`. `fp fleet diff ` mostra cosa era previsto rispetto a ciò che il computer ha applicato — viene letto come `behind` finché il computer non fa il prossimo polling — e sulla macchina stessa, `failproofai policies` elenca la distribuzione che sta eseguendo. diff --git a/docs/it/reference/cloud-cli.mdx b/docs/it/reference/cloud-cli.mdx index dae8979ab..036c8ce19 100644 --- a/docs/it/reference/cloud-cli.mdx +++ b/docs/it/reference/cloud-cli.mdx @@ -329,7 +329,7 @@ Versioni di politica gestite dal cloud. **Solo sessione** — ogni comando qui e | `fp policies disable POLICY_ID` | Rimuovila da ogni distribuzione che la contiene, creando una nuova generazione su ciascuna. | `--yes`, `-y` | | `fp policies delete POLICY_ID` | Elimina una versione di politica. | `--yes`, `-y` | | `fp policies test PATH` | Esegui una politica localmente contro un contesto sintetico. Applica il filtro `match` di ogni politica, quindi una che non copre l'evento/tool dato è segnalata come `skipped` piuttosto che eseguita. | `--event`; `--tool`; `--command`; `--file`; `--expect` | -| `fp policies compose PROMPT` | Bozza una politica con l'assistente. Richiede `fixes:write`. | — | +| `fp policies compose PROMPT` | Bozza una politica con l'assistente. Richiede `policies:write`. | — | ### Flotta diff --git a/docs/ja/admin/keys-and-permissions.mdx b/docs/ja/admin/keys-and-permissions.mdx index 86a6813a4..4e6c572ce 100644 --- a/docs/ja/admin/keys-and-permissions.mdx +++ b/docs/ja/admin/keys-and-permissions.mdx @@ -62,7 +62,7 @@ APIキーは組織に属し、明示的な権限を持ちます。エージェ | アラート | `alerts:read`, `alerts:write` | | イシュー | `issues:read`, `issues:create`, `issues:close` | | 監査 | `audits:read`, `audits:write` | -| ポリシー | `fixes:read`, `fixes:write`, `policies:pull` | +| ポリシー | `policies:read`, `policies:write`, `policies:pull` | | 使用量 | `usage:read` | `orgs:admin` はインスタンスオペレーター専用に予約されており、組織キーや一般メンバーには付与できません。廃止された `incidents:*` および `alerts:ack` トークンは互換性のために受け付けられ、現在の `issues:*` 権限に正規化されます。 diff --git a/docs/ja/policies/editor.mdx b/docs/ja/policies/editor.mdx index 0559eadd0..615532907 100644 --- a/docs/ja/policies/editor.mdx +++ b/docs/ja/policies/editor.mdx @@ -33,7 +33,7 @@ icon: "file-pen-line" fp policies compose "Block git push --force on release branches" ``` - `compose` を使用するには、`fixes:write` ロールを持つセッションでサインインしている必要があります（`fp login`）。API キーは使用できません。 + `compose` を使用するには、`policies:write` ロールを持つセッションでサインインしている必要があります（`fp login`）。API キーは使用できません。 diff --git a/docs/ja/policies/rollback.mdx b/docs/ja/policies/rollback.mdx index 9d6ac15f0..186648225 100644 --- a/docs/ja/policies/rollback.mdx +++ b/docs/ja/policies/rollback.mdx @@ -37,7 +37,7 @@ icon: "rotate-ccw" fp fleet rollback ``` - `rollback` はカウンターを巻き戻すのではなく、古いセットを持つ新しいジェネレーションを作成するため、履歴は追記専用のまま維持されます。また、無効化または削除されたポリシーを参照するジェネレーションへのロールバックは拒否されます。実行には `fixes:write` 権限を持つサインイン済みセッションが必要です。`fp fleet diff ` は意図されたものとマシンが実際に適用したものとの差異を表示します。マシンが次回ポーリングするまでは `behind` と表示されます。マシン上では `failproofai policies` を実行すると、現在実行中のデプロイが一覧表示されます。 + `rollback` はカウンターを巻き戻すのではなく、古いセットを持つ新しいジェネレーションを作成するため、履歴は追記専用のまま維持されます。また、無効化または削除されたポリシーを参照するジェネレーションへのロールバックは拒否されます。実行には `policies:write` 権限を持つサインイン済みセッションが必要です。`fp fleet diff ` は意図されたものとマシンが実際に適用したものとの差異を表示します。マシンが次回ポーリングするまでは `behind` と表示されます。マシン上では `failproofai policies` を実行すると、現在実行中のデプロイが一覧表示されます。 diff --git a/docs/ja/reference/cloud-cli.mdx b/docs/ja/reference/cloud-cli.mdx index edc3d6765..3475c08cc 100644 --- a/docs/ja/reference/cloud-cli.mdx +++ b/docs/ja/reference/cloud-cli.mdx @@ -329,7 +329,7 @@ fp audits create checkout-reliability \ | `fp policies disable POLICY_ID` | それを含むすべてのデプロイメントから削除し、各デプロイメントで新しいジェネレーションを作成します。 | `--yes`, `-y` | | `fp policies delete POLICY_ID` | ポリシーバージョンを削除します。 | `--yes`, `-y` | | `fp policies test PATH` | 合成コンテキストに対してポリシーをローカルで実行します。各ポリシーの `match` フィルターを適用するため、指定されたイベント/ツールをカバーしないポリシーは実行されずに `skipped` と報告されます。 | `--event`; `--tool`; `--command`; `--file`; `--expect` | -| `fp policies compose PROMPT` | アシスタントでポリシーを下書きします。`fixes:write` が必要です。 | — | +| `fp policies compose PROMPT` | アシスタントでポリシーを下書きします。`policies:write` が必要です。 | — | ### フリート diff --git a/docs/ko/admin/keys-and-permissions.mdx b/docs/ko/admin/keys-and-permissions.mdx index 0b74e805d..79f95cc41 100644 --- a/docs/ko/admin/keys-and-permissions.mdx +++ b/docs/ko/admin/keys-and-permissions.mdx @@ -62,7 +62,7 @@ API 키는 조직에 귀속되며 명시적인 권한을 가집니다. 에이전 | Alerts | `alerts:read`, `alerts:write` | | Issues | `issues:read`, `issues:create`, `issues:close` | | Audits | `audits:read`, `audits:write` | -| Policies | `fixes:read`, `fixes:write`, `policies:pull` | +| Policies | `policies:read`, `policies:write`, `policies:pull` | | Usage | `usage:read` | `orgs:admin`은 인스턴스 운영자 전용으로 예약되어 있으며, 조직 키나 일반 멤버에게 부여할 수 없습니다. 폐기된 `incidents:*` 및 `alerts:ack` 토큰은 호환성을 위해 허용되며 현재 `issues:*` 권한으로 정규화됩니다. diff --git a/docs/ko/policies/editor.mdx b/docs/ko/policies/editor.mdx index 2c124e457..bdc75997f 100644 --- a/docs/ko/policies/editor.mdx +++ b/docs/ko/policies/editor.mdx @@ -33,7 +33,7 @@ icon: "file-pen-line" fp policies compose "Block git push --force on release branches" ``` - `compose`는 `fixes:write` 역할이 있는 로그인 세션(`fp login`)이 필요하며, API 키는 허용되지 않습니다. + `compose`는 `policies:write` 역할이 있는 로그인 세션(`fp login`)이 필요하며, API 키는 허용되지 않습니다. diff --git a/docs/ko/policies/rollback.mdx b/docs/ko/policies/rollback.mdx index 96b0feae5..2749e0a62 100644 --- a/docs/ko/policies/rollback.mdx +++ b/docs/ko/policies/rollback.mdx @@ -37,7 +37,7 @@ icon: "rotate-ccw" fp fleet rollback ``` - `rollback`은 카운터를 되감는 것이 아니라 이전 정책 세트를 담은 새로운 세대를 생성하므로, 기록은 항상 추가 전용(append-only)으로 유지됩니다. 비활성화되거나 삭제된 정책을 참조하는 세대로의 롤백은 거부됩니다. `fixes:write` 권한이 있는 로그인 세션이 필요합니다. `fp fleet diff `는 의도된 배포와 머신이 실제로 적용한 배포의 차이를 보여주며, 머신이 다음 번에 폴링할 때까지는 `behind`로 표시됩니다. 머신 자체에서는 `failproofai policies`를 실행하면 현재 실행 중인 배포를 확인할 수 있습니다. + `rollback`은 카운터를 되감는 것이 아니라 이전 정책 세트를 담은 새로운 세대를 생성하므로, 기록은 항상 추가 전용(append-only)으로 유지됩니다. 비활성화되거나 삭제된 정책을 참조하는 세대로의 롤백은 거부됩니다. `policies:write` 권한이 있는 로그인 세션이 필요합니다. `fp fleet diff `는 의도된 배포와 머신이 실제로 적용한 배포의 차이를 보여주며, 머신이 다음 번에 폴링할 때까지는 `behind`로 표시됩니다. 머신 자체에서는 `failproofai policies`를 실행하면 현재 실행 중인 배포를 확인할 수 있습니다. diff --git a/docs/ko/reference/cloud-cli.mdx b/docs/ko/reference/cloud-cli.mdx index ab9fa31ed..24ab60386 100644 --- a/docs/ko/reference/cloud-cli.mdx +++ b/docs/ko/reference/cloud-cli.mdx @@ -329,7 +329,7 @@ fp audits create checkout-reliability \ | `fp policies disable POLICY_ID` | 이를 포함하는 모든 배포에서 제거하고, 각 배포에서 새 세대를 생성합니다. | `--yes`, `-y` | | `fp policies delete POLICY_ID` | 정책 버전을 삭제합니다. | `--yes`, `-y` | | `fp policies test PATH` | 합성 컨텍스트에 대해 로컬에서 정책을 실행합니다. 각 정책의 `match` 필터를 적용하므로, 주어진 이벤트/도구를 다루지 않는 정책은 실행되지 않고 `skipped`로 보고됩니다. | `--event`; `--tool`; `--command`; `--file`; `--expect` | -| `fp policies compose PROMPT` | 어시스턴트로 정책 초안을 작성합니다. `fixes:write`가 필요합니다. | — | +| `fp policies compose PROMPT` | 어시스턴트로 정책 초안을 작성합니다. `policies:write`가 필요합니다. | — | ### 플릿 diff --git a/docs/policies/editor.mdx b/docs/policies/editor.mdx index 0dc0b9dd1..0363bee7c 100644 --- a/docs/policies/editor.mdx +++ b/docs/policies/editor.mdx @@ -33,7 +33,7 @@ An audit finds a failure; a policy stops it happening again. Failproof AI drafts fp policies compose "Block git push --force on release branches" ``` - `compose` needs a signed-in session (`fp login`) whose role has `fixes:write`; it refuses API keys. + `compose` needs a signed-in session (`fp login`) whose role has `policies:write`; it refuses API keys. diff --git a/docs/policies/rollback.mdx b/docs/policies/rollback.mdx index 219649726..9601d4098 100644 --- a/docs/policies/rollback.mdx +++ b/docs/policies/rollback.mdx @@ -37,7 +37,7 @@ A published policy version never changes. Editing a policy and publishing again fp fleet rollback ``` - `rollback` mints a new generation carrying the old set rather than rewinding the counter, so history stays append-only, and it refuses a generation that names a policy since disabled or deleted. It needs a signed-in session with `fixes:write`. `fp fleet diff ` shows what was intended against what the machine applied — it reads as `behind` until the machine next polls — and on the machine itself, `failproofai policies` lists the deployment it is running. + `rollback` mints a new generation carrying the old set rather than rewinding the counter, so history stays append-only, and it refuses a generation that names a policy since disabled or deleted. It needs a signed-in session with `policies:write`. `fp fleet diff ` shows what was intended against what the machine applied — it reads as `behind` until the machine next polls — and on the machine itself, `failproofai policies` lists the deployment it is running. diff --git a/docs/pt-br/admin/keys-and-permissions.mdx b/docs/pt-br/admin/keys-and-permissions.mdx index dc069f9e9..62aaf47ad 100644 --- a/docs/pt-br/admin/keys-and-permissions.mdx +++ b/docs/pt-br/admin/keys-and-permissions.mdx @@ -62,7 +62,7 @@ Os segredos das chaves são exibidos quando criados ou regenerados. Armazene-os | Alerts | `alerts:read`, `alerts:write` | | Issues | `issues:read`, `issues:create`, `issues:close` | | Audits | `audits:read`, `audits:write` | -| Policies | `fixes:read`, `fixes:write`, `policies:pull` | +| Policies | `policies:read`, `policies:write`, `policies:pull` | | Usage | `usage:read` | `orgs:admin` é reservado para o operador da instância e não pode ser concedido a uma chave de organização ou a um membro comum. Tokens `incidents:*` e `alerts:ack` descontinuados são aceitos por compatibilidade e são normalizados para as permissões `issues:*` atuais. diff --git a/docs/pt-br/policies/editor.mdx b/docs/pt-br/policies/editor.mdx index 529702f1b..7767bb203 100644 --- a/docs/pt-br/policies/editor.mdx +++ b/docs/pt-br/policies/editor.mdx @@ -33,7 +33,7 @@ Uma auditoria encontra uma falha; uma política impede que ela aconteça novamen fp policies compose "Block git push --force on release branches" ``` - `compose` requer uma sessão autenticada (`fp login`) cuja função tenha `fixes:write`; ele rejeita chaves de API. + `compose` requer uma sessão autenticada (`fp login`) cuja função tenha `policies:write`; ele rejeita chaves de API. diff --git a/docs/pt-br/policies/rollback.mdx b/docs/pt-br/policies/rollback.mdx index 5c57430a2..8c23a3bc8 100644 --- a/docs/pt-br/policies/rollback.mdx +++ b/docs/pt-br/policies/rollback.mdx @@ -37,7 +37,7 @@ Uma versão de política publicada nunca muda. Editar uma política e publicar n fp fleet rollback ``` - O `rollback` cria uma nova geração carregando o conjunto antigo em vez de retroceder o contador, então o histórico permanece apenas-apenso. Ele recusa uma geração que referencia uma política desativada ou excluída. Requer uma sessão autenticada com `fixes:write`. O `fp fleet diff ` mostra o que foi planejado versus o que a máquina aplicou — aparece como `behind` até a próxima vez que a máquina fizer polling — e na própria máquina, `failproofai policies` lista a implantação em execução. + O `rollback` cria uma nova geração carregando o conjunto antigo em vez de retroceder o contador, então o histórico permanece apenas-apenso. Ele recusa uma geração que referencia uma política desativada ou excluída. Requer uma sessão autenticada com `policies:write`. O `fp fleet diff ` mostra o que foi planejado versus o que a máquina aplicou — aparece como `behind` até a próxima vez que a máquina fizer polling — e na própria máquina, `failproofai policies` lista a implantação em execução. diff --git a/docs/pt-br/reference/cloud-cli.mdx b/docs/pt-br/reference/cloud-cli.mdx index 2b0485abd..71f01f2cc 100644 --- a/docs/pt-br/reference/cloud-cli.mdx +++ b/docs/pt-br/reference/cloud-cli.mdx @@ -332,7 +332,7 @@ Versões de políticas gerenciadas pela nuvem. **Somente sessão** — cada coma | `fp policies disable POLICY_ID` | Removê-la de cada implantação que a carrega, criando uma nova geração em cada uma. | `--yes`, `-y` | | `fp policies delete POLICY_ID` | Excluir uma versão de política. | `--yes`, `-y` | | `fp policies test PATH` | Executar uma política localmente contra um contexto sintético. Aplica o filtro `match` de cada política, portanto uma que não cubra o evento/ferramenta fornecido é reportada como `skipped` em vez de executada. | `--event`; `--tool`; `--command`; `--file`; `--expect` | -| `fp policies compose PROMPT` | Rascunhar uma política com o assistente. Requer `fixes:write`. | — | +| `fp policies compose PROMPT` | Rascunhar uma política com o assistente. Requer `policies:write`. | — | ### Frota diff --git a/docs/reference/cloud-cli.mdx b/docs/reference/cloud-cli.mdx index 2b8b143c9..dd9fafcb5 100644 --- a/docs/reference/cloud-cli.mdx +++ b/docs/reference/cloud-cli.mdx @@ -462,7 +462,7 @@ Cloud-managed policy versions. **Session-only** — every command here exits `2` | `fp policies disable POLICY_ID` | Remove it from every deployment carrying it, minting a new generation on each. | `--yes`, `-y` | | `fp policies delete POLICY_ID` | Delete a policy version. | `--yes`, `-y` | | `fp policies test PATH` | Run a policy locally against a synthetic context. Applies each policy's `match` filter, so one that does not cover the given event/tool is reported `skipped` rather than run. | `--event`; `--tool`; `--command`; `--file`; `--expect` | -| `fp policies compose PROMPT` | Draft a policy with the assistant. Needs `fixes:write`. | — | +| `fp policies compose PROMPT` | Draft a policy with the assistant. Needs `policies:write`. | — | ### Fleet diff --git a/docs/ru/admin/keys-and-permissions.mdx b/docs/ru/admin/keys-and-permissions.mdx index 27d712d40..0b0e4ba55 100644 --- a/docs/ru/admin/keys-and-permissions.mdx +++ b/docs/ru/admin/keys-and-permissions.mdx @@ -62,7 +62,7 @@ API-ключи принадлежат организации и содержат | Alerts | `alerts:read`, `alerts:write` | | Issues | `issues:read`, `issues:create`, `issues:close` | | Audits | `audits:read`, `audits:write` | -| Policies | `fixes:read`, `fixes:write`, `policies:pull` | +| Policies | `policies:read`, `policies:write`, `policies:pull` | | Usage | `usage:read` | `orgs:admin` зарезервировано для оператора экземпляра и не может быть предоставлено ключу организации или обычному члену. Устаревшие токены `incidents:*` и `alerts:ack` принимаются для совместимости и нормализуются к текущим разрешениям `issues:*`. diff --git a/docs/ru/policies/editor.mdx b/docs/ru/policies/editor.mdx index 7d232d2b5..e0d4c778f 100644 --- a/docs/ru/policies/editor.mdx +++ b/docs/ru/policies/editor.mdx @@ -33,7 +33,7 @@ icon: "file-pen-line" fp policies compose "Block git push --force on release branches" ``` - `compose` требует аутентифицированного сеанса (`fp login`), роль которого имеет `fixes:write`; он отклоняет API-ключи. + `compose` требует аутентифицированного сеанса (`fp login`), роль которого имеет `policies:write`; он отклоняет API-ключи. diff --git a/docs/ru/policies/rollback.mdx b/docs/ru/policies/rollback.mdx index fe9073efa..0f409f7dd 100644 --- a/docs/ru/policies/rollback.mdx +++ b/docs/ru/policies/rollback.mdx @@ -37,7 +37,7 @@ icon: "rotate-ccw" fp fleet rollback ``` - `rollback` создает новое поколение со старым набором, а не перематывает счетчик, поэтому история остается добавочной. Команда отказывает, если указать поколение с отключенной или удаленной политикой. Требуется сеанс с авторизацией и правами `fixes:write`. `fp fleet diff ` показывает, что было предусмотрено в сравнении с тем, что машина применила — это отображается как `behind`, пока машина не проведет следующий опрос — а на самой машине `failproofai policies` перечисляет развертывание, которое она запускает. + `rollback` создает новое поколение со старым набором, а не перематывает счетчик, поэтому история остается добавочной. Команда отказывает, если указать поколение с отключенной или удаленной политикой. Требуется сеанс с авторизацией и правами `policies:write`. `fp fleet diff ` показывает, что было предусмотрено в сравнении с тем, что машина применила — это отображается как `behind`, пока машина не проведет следующий опрос — а на самой машине `failproofai policies` перечисляет развертывание, которое она запускает. diff --git a/docs/ru/reference/cloud-cli.mdx b/docs/ru/reference/cloud-cli.mdx index e9fd28803..8ec1bda20 100644 --- a/docs/ru/reference/cloud-cli.mdx +++ b/docs/ru/reference/cloud-cli.mdx @@ -329,7 +329,7 @@ fp audits create checkout-reliability \ | `fp policies disable POLICY_ID` | Удалить из каждого развертывания, которое ее содержит, создав новое поколение в каждом. | `--yes`, `-y` | | `fp policies delete POLICY_ID` | Удалить версию политики. | `--yes`, `-y` | | `fp policies test PATH` | Запустить политику локально против синтетического контекста. Применяет фильтр `match` каждой политики, поэтому та, которая не охватывает данное событие/инструмент, сообщается как `skipped` вместо запуска. | `--event`; `--tool`; `--command`; `--file`; `--expect` | -| `fp policies compose PROMPT` | Разработать политику с помощью помощника. Требует `fixes:write`. | — | +| `fp policies compose PROMPT` | Разработать политику с помощью помощника. Требует `policies:write`. | — | ### Флот diff --git a/docs/tr/admin/keys-and-permissions.mdx b/docs/tr/admin/keys-and-permissions.mdx index 04b31a211..855cf61c3 100644 --- a/docs/tr/admin/keys-and-permissions.mdx +++ b/docs/tr/admin/keys-and-permissions.mdx @@ -62,7 +62,7 @@ Anahtar sırları oluşturulduğunda veya yeniden oluşturulduğunda gösterilir | Uyarılar | `alerts:read`, `alerts:write` | | Sorunlar | `issues:read`, `issues:create`, `issues:close` | | Denetimler | `audits:read`, `audits:write` | -| Politikalar | `fixes:read`, `fixes:write`, `policies:pull` | +| Politikalar | `policies:read`, `policies:write`, `policies:pull` | | Kullanım | `usage:read` | `orgs:admin` örnek operatörü için ayrılmıştır ve bir organizasyon anahtarına veya sıradan üyeye verilemez. Emekli `incidents:*` ve `alerts:ack` belirteçleri uyumluluk için kabul edilir ve geçerli `issues:*` izinlerine normalleştirilir. diff --git a/docs/tr/policies/editor.mdx b/docs/tr/policies/editor.mdx index c603273da..85ad77e0c 100644 --- a/docs/tr/policies/editor.mdx +++ b/docs/tr/policies/editor.mdx @@ -33,7 +33,7 @@ Hatanın meydana geldiği oturumlar üzerinde [denetim çalıştırın](/tr/audi fp policies compose "Block git push --force on release branches" ``` - `compose` imzalanmış bir oturuma ihtiyaç duyar (`fp login`) ki rolü `fixes:write` yetkisine sahip olsun; API anahtarlarını reddeder. + `compose` imzalanmış bir oturuma ihtiyaç duyar (`fp login`) ki rolü `policies:write` yetkisine sahip olsun; API anahtarlarını reddeder. diff --git a/docs/tr/policies/rollback.mdx b/docs/tr/policies/rollback.mdx index 56304c8e3..7c4319c80 100644 --- a/docs/tr/policies/rollback.mdx +++ b/docs/tr/policies/rollback.mdx @@ -37,7 +37,7 @@ Yayınlanan bir policy sürümü asla değişmez. Bir policy düzenlemesi ve yen fp fleet rollback ``` - `rollback` sayacı geri sarmak yerine eski seti taşıyan yeni bir generasyon oluşturur, bu nedenle geçmiş sadece eklenmeye devam eder ve devre dışı bırakılan veya silinen bir policy'yi adlandıran generasyonu reddeder. `fixes:write` izni olan oturum açmış bir oturuma ihtiyaç duyar. `fp fleet diff ` makine uygulanırken amaçlanan şeyi gösterir — makine bir sonraki kez anket yapana kadar `behind` olarak okunur — ve makinenin kendisinde `failproofai policies` çalıştırılan dağıtımı listeler. + `rollback` sayacı geri sarmak yerine eski seti taşıyan yeni bir generasyon oluşturur, bu nedenle geçmiş sadece eklenmeye devam eder ve devre dışı bırakılan veya silinen bir policy'yi adlandıran generasyonu reddeder. `policies:write` izni olan oturum açmış bir oturuma ihtiyaç duyar. `fp fleet diff ` makine uygulanırken amaçlanan şeyi gösterir — makine bir sonraki kez anket yapana kadar `behind` olarak okunur — ve makinenin kendisinde `failproofai policies` çalıştırılan dağıtımı listeler. diff --git a/docs/tr/reference/cloud-cli.mdx b/docs/tr/reference/cloud-cli.mdx index b03db0970..b1b759dd6 100644 --- a/docs/tr/reference/cloud-cli.mdx +++ b/docs/tr/reference/cloud-cli.mdx @@ -329,7 +329,7 @@ Bulut tarafından yönetilen ilke sürümleri. **Yalnızca oturum** — buradaki | `fp policies disable POLICY_ID` | Taşıdığı her dağıtımdan kaldırın, her biri üzerinde yeni bir nesil oluşturun. | `--yes`, `-y` | | `fp policies delete POLICY_ID` | İlke sürümünü silin. | `--yes`, `-y` | | `fp policies test PATH` | Sentetik bir bağlama karşı yerel olarak bir ilkeyi çalıştırın. Her ilkenin `match` filtresini uygular, bu nedenle verilen etkinlik/aracı kapsamayan bir `skipped` yerine çalıştırılır. | `--event`; `--tool`; `--command`; `--file`; `--expect` | -| `fp policies compose PROMPT` | Asistan ile bir ilke taslağı yapın. `fixes:write` gerektirir. | — | +| `fp policies compose PROMPT` | Asistan ile bir ilke taslağı yapın. `policies:write` gerektirir. | — | ### Filo diff --git a/docs/vi/admin/keys-and-permissions.mdx b/docs/vi/admin/keys-and-permissions.mdx index 0d565f680..b0a3a1d76 100644 --- a/docs/vi/admin/keys-and-permissions.mdx +++ b/docs/vi/admin/keys-and-permissions.mdx @@ -62,7 +62,7 @@ Bí mật khóa được hiển thị khi được tạo hoặc tạo lại. Lư | Cảnh báo | `alerts:read`, `alerts:write` | | Vấn đề | `issues:read`, `issues:create`, `issues:close` | | Kiểm toán | `audits:read`, `audits:write` | -| Chính sách | `fixes:read`, `fixes:write`, `policies:pull` | +| Chính sách | `policies:read`, `policies:write`, `policies:pull` | | Sử dụng | `usage:read` | `orgs:admin` được dành riêng cho nhà điều hành thực thể và không thể được cấp cho khóa tổ chức hoặc thành viên thường. Các mã thông báo `incidents:*` và `alerts:ack` đã loại bỏ được chấp nhận để tương thích và chuẩn hóa thành quyền hạn `issues:*` hiện tại. diff --git a/docs/vi/policies/editor.mdx b/docs/vi/policies/editor.mdx index 3a9e919d0..ca267c3c2 100644 --- a/docs/vi/policies/editor.mdx +++ b/docs/vi/policies/editor.mdx @@ -33,7 +33,7 @@ Một cuộc kiểm tra phát hiện một lỗi; một chính sách ngăn chặ fp policies compose "Block git push --force on release branches" ``` - `compose` cần một phiên đã đăng nhập (`fp login`) có vai trò `fixes:write`; nó từ chối các khóa API. + `compose` cần một phiên đã đăng nhập (`fp login`) có vai trò `policies:write`; nó từ chối các khóa API. diff --git a/docs/vi/policies/rollback.mdx b/docs/vi/policies/rollback.mdx index ddb37a249..cdddc1858 100644 --- a/docs/vi/policies/rollback.mdx +++ b/docs/vi/policies/rollback.mdx @@ -37,7 +37,7 @@ Một phiên bản chính sách đã công bố không bao giờ thay đổi. Ch fp fleet rollback ``` - `rollback` tạo một thế hệ mới mang bộ cũ thay vì đặt lại bộ đếm, vì vậy lịch sử luôn chỉ được nối thêm, và nó từ chối một thế hệ đặt tên cho chính sách vì đã bị vô hiệu hóa hoặc xóa. Nó cần một phiên đăng nhập với `fixes:write`. `fp fleet diff ` hiển thị những gì được dự định so với những gì máy áp dụng — nó được đọc là `behind` cho đến khi máy thăm dò tiếp theo — và trên chính máy đó, `failproofai policies` liệt kê triển khai mà nó đang chạy. + `rollback` tạo một thế hệ mới mang bộ cũ thay vì đặt lại bộ đếm, vì vậy lịch sử luôn chỉ được nối thêm, và nó từ chối một thế hệ đặt tên cho chính sách vì đã bị vô hiệu hóa hoặc xóa. Nó cần một phiên đăng nhập với `policies:write`. `fp fleet diff ` hiển thị những gì được dự định so với những gì máy áp dụng — nó được đọc là `behind` cho đến khi máy thăm dò tiếp theo — và trên chính máy đó, `failproofai policies` liệt kê triển khai mà nó đang chạy. diff --git a/docs/vi/reference/cloud-cli.mdx b/docs/vi/reference/cloud-cli.mdx index f5fcd9d49..9ac4edcd9 100644 --- a/docs/vi/reference/cloud-cli.mdx +++ b/docs/vi/reference/cloud-cli.mdx @@ -329,7 +329,7 @@ Phiên bản policy được quản lý bởi cloud. **Session-only** — mỗi | `fp policies disable POLICY_ID` | Loại bỏ nó khỏi mỗi deployment mang nó, tạo ra một thế hệ mới trên mỗi cái. | `--yes`, `-y` | | `fp policies delete POLICY_ID` | Xóa một phiên bản policy. | `--yes`, `-y` | | `fp policies test PATH` | Chạy một policy cục bộ chống lại bối cảnh tổng hợp. Áp dụng bộ lọc `match` của mỗi policy, vì vậy bộ không bao gồm sự kiện/tool được cung cấp sẽ được báo cáo `skipped` thay vì được chạy. | `--event`; `--tool`; `--command`; `--file`; `--expect` | -| `fp policies compose PROMPT` | Dự thảo một policy với assistant. Cần `fixes:write`. | — | +| `fp policies compose PROMPT` | Dự thảo một policy với assistant. Cần `policies:write`. | — | ### Fleet diff --git a/docs/zh/admin/keys-and-permissions.mdx b/docs/zh/admin/keys-and-permissions.mdx index 600892cd9..a1d686bd7 100644 --- a/docs/zh/admin/keys-and-permissions.mdx +++ b/docs/zh/admin/keys-and-permissions.mdx @@ -62,7 +62,7 @@ API 密钥归属于某个组织，并携带明确的权限配置。请为 Agent | 告警 | `alerts:read`、`alerts:write` | | 问题 | `issues:read`、`issues:create`、`issues:close` | | 审计 | `audits:read`、`audits:write` | -| 策略 | `fixes:read`、`fixes:write`、`policies:pull` | +| 策略 | `policies:read`、`policies:write`、`policies:pull` | | 用量 | `usage:read` | `orgs:admin` 为实例运营方专属权限，不能授予组织密钥或普通成员。已停用的 `incidents:*` 和 `alerts:ack` 令牌出于兼容性仍可接受，并将规范化为当前的 `issues:*` 权限。 diff --git a/docs/zh/policies/editor.mdx b/docs/zh/policies/editor.mdx index 63f48e845..8dbd1bf3d 100644 --- a/docs/zh/policies/editor.mdx +++ b/docs/zh/policies/editor.mdx @@ -33,7 +33,7 @@ icon: "file-pen-line" fp policies compose "Block git push --force on release branches" ``` - `compose` 需要一个已登录的会话（`fp login`），且其角色须具有 `fixes:write` 权限；它不接受 API 密钥。 + `compose` 需要一个已登录的会话（`fp login`），且其角色须具有 `policies:write` 权限；它不接受 API 密钥。 diff --git a/docs/zh/policies/rollback.mdx b/docs/zh/policies/rollback.mdx index 2a873b8a8..0e4f6a68c 100644 --- a/docs/zh/policies/rollback.mdx +++ b/docs/zh/policies/rollback.mdx @@ -37,7 +37,7 @@ icon: "rotate-ccw" fp fleet rollback ``` - `rollback` 会以旧配置集生成一个新代次，而非回退计数器，因此历史记录保持只追加模式。若指定的代次所引用的策略已被禁用或删除，该命令将拒绝执行。执行此命令需要已登录且拥有 `fixes:write` 权限的会话。`fp fleet diff ` 会对比预期配置与机器实际应用的配置——在机器下次轮询之前，状态显示为 `behind`；在机器本身上，`failproofai policies` 会列出当前运行的部署。 + `rollback` 会以旧配置集生成一个新代次，而非回退计数器，因此历史记录保持只追加模式。若指定的代次所引用的策略已被禁用或删除，该命令将拒绝执行。执行此命令需要已登录且拥有 `policies:write` 权限的会话。`fp fleet diff ` 会对比预期配置与机器实际应用的配置——在机器下次轮询之前，状态显示为 `behind`；在机器本身上，`failproofai policies` 会列出当前运行的部署。 diff --git a/docs/zh/reference/cloud-cli.mdx b/docs/zh/reference/cloud-cli.mdx index 8e7be2e05..e74d5e4fa 100644 --- a/docs/zh/reference/cloud-cli.mdx +++ b/docs/zh/reference/cloud-cli.mdx @@ -329,7 +329,7 @@ fp audits create checkout-reliability \ | `fp policies disable POLICY_ID` | 从所有携带它的部署中移除，并在每个部署上生成新的代次。 | `--yes`, `-y` | | `fp policies delete POLICY_ID` | 删除一个策略版本。 | `--yes`, `-y` | | `fp policies test PATH` | 在本地针对合成上下文运行策略。对每个策略的 `match` 过滤器逐一应用，不覆盖给定事件/工具的策略会被报告为 `skipped` 而非运行。 | `--event`；`--tool`；`--command`；`--file`；`--expect` | -| `fp policies compose PROMPT` | 使用助手起草策略。需要 `fixes:write` 权限。 | — | +| `fp policies compose PROMPT` | 使用助手起草策略。需要 `policies:write` 权限。 | — | ### 机群 diff --git a/fp-cloud-cli/fp_cli/client.py b/fp-cloud-cli/fp_cli/client.py index 031ade00f..a65938931 100644 --- a/fp-cloud-cli/fp_cli/client.py +++ b/fp-cloud-cli/fp_cli/client.py @@ -176,7 +176,7 @@ class ClientContext: ), # ROOT-ONLY on the server, and deliberately so: `/v1` is published on the # dashboard host by the ingress, and publish/deploy/rollback are operator - # writes gated on `fixes:write`. Exposing them there would put fleet + # writes gated on `policies:write`. Exposing them there would put fleet # mutation on the open internet. See the ROOT-ONLY block in # `server/src/routes/mod.rs`. "enforcement": ( diff --git a/fp-cloud-cli/fp_cli/commands/fleet_cmds.py b/fp-cloud-cli/fp_cli/commands/fleet_cmds.py index 349536a14..3f525e6f4 100644 --- a/fp-cloud-cli/fp_cli/commands/fleet_cmds.py +++ b/fp-cloud-cli/fp_cli/commands/fleet_cmds.py @@ -69,7 +69,7 @@ def fleet_list(ctx: typer.Context) -> None: A machine appears from its very first check-in, including the poll that finds nothing deployed — that is exactly the machine you are usually looking - for. Needs `fixes:read`. With `--json`: `{machines, deployments}`, where + for. Needs `policies:read`. With `--json`: `{machines, deployments}`, where each machine carries raw timestamps plus the computed `drifted`. Example: @@ -116,7 +116,7 @@ def fleet_show( because an organization Cloud check has its name (`jev_name_clash`). Anything listed there is not enforcing, whatever the deployment says. - Needs `fixes:read`. With `--json`: `{machine, deployment}` — the machine + Needs `policies:read`. With `--json`: `{machine, deployment}` — the machine record (including `appliedDeployment`, `drifted`, `lastSeen`, both label fields, `jevMode` and `policyErrors`/`policyErrorsAt` when reported, with raw timestamps) and the deployment, or `deployment: null` when nothing is @@ -196,7 +196,7 @@ def fleet_deploy( **Concurrency.** The write is a full replace with no server-side lock, so the CLI records the generation it read and refuses if the result is not exactly one higher: that means somebody else deployed in between and a replace does - not merge. Needs `fixes:write`. With `--json`: the plan plus the resulting + not merge. Needs `policies:write`. With `--json`: the plan plus the resulting deployment. Examples: @@ -265,7 +265,7 @@ def fleet_deploy( # * `applied: false` in --json is the only way to tell "I changed it" from # "it already matched" — the exit code is 0 either way, on purpose. # * the short-circuit happens BEFORE the write, so a reader without - # `fixes:write` also gets 0 here. They have not gained anything (the + # `policies:write` also gets 0 here. They have not gained anything (the # state already held and nothing was written), but the exit code alone # is not proof of write access. if plan.is_noop: @@ -311,7 +311,7 @@ def fleet_diff( The gap is the interesting part: a machine that has not collected its latest deployment is not enforcing what the dashboard says it is, and nothing else - surfaces that as a single number. Needs `fixes:read`. With `--json`: + surfaces that as a single number. Needs `policies:read`. With `--json`: `{machines:[{machineId, intended, delivered, drifted}]}` — `drifted` is the field the CLI computes, so a harness need not derive it. @@ -355,7 +355,7 @@ def fleet_history( — appears as an ordinary entry, and so does a Jev mode change. Each generation shows the Jev mode FailproofAI Cloud set with it (`local` when it set none), which is the mode a rollback to it restores. Needs - `fixes:read`. With `--json`: `{machineId, history:[{deployment, policies, + `policies:read`. With `--json`: `{machineId, history:[{deployment, policies, updatedAt, jevMode}]}`. Example: @@ -389,7 +389,7 @@ def fleet_rollback( It restores that generation's Jev mode too, `local` included: the prompt and the result say `jev mode → ` when that changes it. - Needs `fixes:write`. With `--json`: the resulting deployment plus + Needs `policies:write`. With `--json`: the resulting deployment plus `jevModeBefore` (the mode it replaced), or `{"cancelled": true}` if you decline. @@ -443,7 +443,7 @@ def fleet_rename( ) -> None: """Give a machine a human label. The id itself never changes. - Needs `fixes:write`. With `--json`: `{machineId, labelOverride}` — the + Needs `policies:write`. With `--json`: `{machineId, labelOverride}` — the server stores the label as an override beside the machine's self-asserted one rather than replacing it. diff --git a/fp-cloud-cli/fp_cli/commands/guardrails_cmds.py b/fp-cloud-cli/fp_cli/commands/guardrails_cmds.py index 4b70b7b23..2ee683d0c 100644 --- a/fp-cloud-cli/fp_cli/commands/guardrails_cmds.py +++ b/fp-cloud-cli/fp_cli/commands/guardrails_cmds.py @@ -78,7 +78,7 @@ def guardrails_summary( no policy objected to, and the row keeps the denominator on screen — "14 blocked" means little without the 933 it came from. - Needs `fixes:read`. With `--json`: the server summary plus the timeline. + Needs `policies:read`. With `--json`: the server summary plus the timeline. Examples: @@ -113,7 +113,7 @@ def guardrails_timeline( Times are UTC, and the label follows the bucket size the server chose — a clock for hourly buckets, a date for daily ones. - Needs `fixes:read`. With `--json`: the server's timeline verbatim. + Needs `policies:read`. With `--json`: the server's timeline verbatim. Example: diff --git a/fp-cloud-cli/fp_cli/commands/policies_cmds.py b/fp-cloud-cli/fp_cli/commands/policies_cmds.py index 630137def..3b959b5ba 100644 --- a/fp-cloud-cli/fp_cli/commands/policies_cmds.py +++ b/fp-cloud-cli/fp_cli/commands/policies_cmds.py @@ -48,7 +48,7 @@ def policies_list(ctx: typer.Context) -> None: `state` is active, disabled (kept but not enforced) or archived (deleted; machines already carrying it keep it until redeployed). Needs - `fixes:read`. With `--json`: the server's policy list verbatim — also + `policies:read`. With `--json`: the server's policy list verbatim — also every version, so deduplicate on `id` if you want one row per policy. Example: @@ -71,7 +71,7 @@ def policies_show( ) -> None: """Show one policy, including its full source and its Jev checks. - Needs `fixes:read`. With `--json`: the policy object with `source`, + Needs `policies:read`. With `--json`: the policy object with `source`, `kind`, and for `jev`/`both` its `semantic` declarations, `semanticSha256` and the server-derived `authority`/`reviewedBy`. @@ -161,7 +161,7 @@ def policies_publish( when you give none and stdin is a terminal. **Publishing deploys nothing.** A new version sits unused until - `fp fleet deploy` puts it on a machine. Needs `fixes:write`. + `fp fleet deploy` puts it on a machine. Needs `policies:write`. With `--json`: the created version plus `carriers` — a map of machine id to the version of this policy it currently runs, so a harness can tell what a publish left behind without a second call. @@ -271,7 +271,7 @@ def policies_enable( deployment it was removed from, advancing each machine's generation again. Nothing needs redeploying by hand. - Needs `fixes:write`. With `--json`: `{id, disabled, archived, + Needs `policies:write`. With `--json`: `{id, disabled, archived, machinesUpdated}` — `machinesUpdated` counts the deployments rewritten, and matches the count the preceding `disable` reported. @@ -323,7 +323,7 @@ def policies_disable( `policies enable` is the exact inverse: it puts the policy back into every deployment it was removed from, so nothing needs redeploying by hand. - Needs `fixes:write`. With `--json`: `{id, disabled, archived, + Needs `policies:write`. With `--json`: `{id, disabled, archived, machinesUpdated}` — `machinesUpdated` is how many deployments were rewritten to drop it, and is the number to check if you expected this to be a no-op. @@ -363,7 +363,7 @@ def policies_delete( machine already carrying it keeps enforcing it until something redeploys — deleting is not a way to stop enforcement everywhere, and `disable` is. - Needs `fixes:write`. With `--json`: `{id, disabled, archived, + Needs `policies:write`. With `--json`: `{id, disabled, archived, machinesUpdated}`, or `{"cancelled": true}` if you decline. Example: @@ -487,12 +487,12 @@ def policies_compose( deploys itself is a generated policy nobody read. `--out` saves it; `--publish ` publishes it, still syntax-checked first. - Needs `fixes:write` — for the draft as well as the publish. The route is + Needs `policies:write` — for the draft as well as the publish. The route is `POST /api/agent/compose-policy`, which the dashboard exports as - `withAuth("fixes:write", …)`; `agent:use` gates the assistant's other + `withAuth("policies:write", …)`; `agent:use` gates the assistant's other routes (chat, answer, conversations) and is NOT checked on this one. So a role holding only `agent:use` is refused here, and one holding - `fixes:write` without it works. Session-only. + `policies:write` without it works. Session-only. With `--json`: `{prompt, source, syntax, published}`. @@ -517,7 +517,7 @@ def policies_compose( syn = check_syntax(source) # Saved BEFORE anything that can fail. `--out` used to run after the - # publish, so a publish that was refused — bad syntax, no `fixes:write`, + # publish, so a publish that was refused — bad syntax, no `policies:write`, # a network blip — threw away the draft the user had just paid an assistant # to write, with no way to get that same text back. if out: @@ -627,7 +627,7 @@ def policies_backtest( as before. A jev/both policy — a published one, or `--semantic checks.json` with or without a source file — runs the every-kind backtest: an estimate by default, `--run` to spend Jev allowance on up to `--sample` calls. - Needs fixes:write and events:read. + Needs policies:write and events:read. """ from pathlib import Path _cloud.session_only(ctx.obj, "policies backtest") diff --git a/fp-cloud-cli/fp_cli/permissions.py b/fp-cloud-cli/fp_cli/permissions.py index 9d5c08782..445e6920e 100644 --- a/fp-cloud-cli/fp_cli/permissions.py +++ b/fp-cloud-cli/fp_cli/permissions.py @@ -44,9 +44,11 @@ "issues:close", "audits:read", "audits:write", - "fixes:read", - "fixes:write", + "policies:read", + "policies:write", "policies:pull", + "code_fixes:read", + "code_fixes:write", "usage:read", # Jev through FailproofAI Cloud, charged to the org's plan. The built-in # admin set carries it, so PRESETS["admin"] below does too. The server @@ -71,9 +73,6 @@ "incidents:write": ["issues:create"], "incidents:ack": ["issues:read", "issues:create", "issues:close"], "alerts:ack": ["issues:read", "issues:create", "issues:close"], - # Renamed when these came to cover every kind of fix, not only policies. - "policies:read": ["fixes:read"], - "policies:write": ["fixes:write"], } diff --git a/fp-cloud-cli/skill/references/commands.md b/fp-cloud-cli/skill/references/commands.md index 04959249e..9bbf6ee9b 100644 --- a/fp-cloud-cli/skill/references/commands.md +++ b/fp-cloud-cli/skill/references/commands.md @@ -249,7 +249,7 @@ Built-in assistant. Chats referenced by a **short chat-id** (first 8 hex; prefix ## policies · fleet · guardrails **Session-only, all three groups** — every subcommand exits 2 under a key, with no request made. These routes are absent from the versioned API an API key authenticates against; they are an operator surface. -Cloud-managed enforcement, split the way the dashboard splits it: `policies` writes a version, `fleet` decides which machines run it, `guardrails` reports what it blocked. Needs `fixes:read` to read, `fixes:write` to change anything. +Cloud-managed enforcement, split the way the dashboard splits it: `policies` writes a version, `fleet` decides which machines run it, `guardrails` reports what it blocked. Needs `policies:read` to read, `policies:write` to change anything. ### policies - `policies list` — one row per published VERSION (versions are immutable and all stay addressable), newest of each policy first; the title counts distinct policies and captions the version total. `kind` is `regex` / `jev` / `both`, and a `jev`/`both` row names its Jev checks before the description. `state` is active / disabled / archived. JSON `{policies:[…]}` — also every version, so deduplicate on `id` for one row per policy; each carries `kind`, and for `jev`/`both` `semantic`, `semanticSha256`, and the server-derived `authority`/`reviewedBy`. @@ -263,9 +263,9 @@ Cloud-managed enforcement, split the way the dashboard splits it: `policies` wri - `policies enable [-y]` · `policies disable [-y]` — **disable REMOVES the policy from every deployment carrying it**, reissuing each affected machine at a new generation (visible in `fleet history`). `enable` is the exact inverse — it puts the policy back into every deployment it was removed from, reissuing those machines again. Nothing needs redeploying by hand, and `machinesUpdated` in the JSON reports the count for both directions. - `policies test [SOURCE] [--tool Bash] [--command "…"] [--file PATH] [--event PreToolUse] [--expect allow|deny|instruct]` — run a policy LOCALLY and print what it decides. Makes no request, so unlike the rest of `policies` it also works with an API key. Executes the real file (bare `import { deny } from "failproofai"` and all) against a synthetic context; nothing is published, nothing installed. Needs `node`. `--expect` asserts the decision and exits 1 when it differs — a correct `deny` is a PASSING test, so the decision alone never sets the exit code. JSON `{ok, decision, policies:[{name,decision,reason}], expected, met}`; `decision` is the strictest any registered policy returned. - `policies author "" [--kind regex|jev|both]` — the assistant authors a vetted policy grounded on your org's events (with coverage). Draft only — nothing is published. `--kind jev` asks for Jev checks, `--kind both` for JavaScript plus its checks; default regex. -- `policies backtest [FILE_OR_ID] [--kind regex|jev|both] [--semantic checks.json] [--hours N] [--agent-id A] [--env E] [--run] [--sample N]` — replay a policy against calls your agents already made. A local `.mjs` (or `@path`, `-`) or a published **regex** id is replayed module-only, as always. A published `jev`/`both` id, or `--semantic` (alone = `jev`, with a source file = `both`), runs the every-kind backtest: by default a free **estimate**; `--run` actually asks Jev about up to `--sample` (≤50) stored calls and **spends the org's Jev allowance** — confirm with the user first. `--hours` defaults to 168 for jev/both. Needs `fixes:write` and `events:read`. +- `policies backtest [FILE_OR_ID] [--kind regex|jev|both] [--semantic checks.json] [--hours N] [--agent-id A] [--env E] [--run] [--sample N]` — replay a policy against calls your agents already made. A local `.mjs` (or `@path`, `-`) or a published **regex** id is replayed module-only, as always. A published `jev`/`both` id, or `--semantic` (alone = `jev`, with a source file = `both`), runs the every-kind backtest: by default a free **estimate**; `--run` actually asks Jev about up to `--sample` (≤50) stored calls and **spends the org's Jev allowance** — confirm with the user first. `--hours` defaults to 168 for jev/both. Needs `policies:write` and `events:read`. - `policies candidacy --issue ` — "could a policy prevent this issue?"; read-only verdict with a suggested intent. -- `policies compose "" [--out FILE] [--publish ID]` — the assistant drafts policy source from plain English. Prints it and stops by default: a generated policy that deploys itself is one nobody read. `--publish` still syntax-checks first. Needs `fixes:write` for BOTH the draft and the publish — `POST /api/agent/compose-policy` is `withAuth("fixes:write")`; `agent:use` gates the assistant's other routes and is not checked on this one. The composer has a **30s server-side limit** — a long or vague description simply does not finish, and raising `--timeout` does not help because the cut is not client-side. Retry with something shorter and more specific. +- `policies compose "" [--out FILE] [--publish ID]` — the assistant drafts policy source from plain English. Prints it and stops by default: a generated policy that deploys itself is one nobody read. `--publish` still syntax-checks first. Needs `policies:write` for BOTH the draft and the publish — `POST /api/agent/compose-policy` is `withAuth("policies:write")`; `agent:use` gates the assistant's other routes and is not checked on this one. The composer has a **30s server-side limit** — a long or vague description simply does not finish, and raising `--timeout` does not help because the cut is not client-side. Retry with something shorter and more specific. - `policies delete [-y]` — archives. **A machine already carrying the policy keeps enforcing it** until redeployed; `disable` is what stops enforcement everywhere. ### fleet @@ -285,7 +285,7 @@ Cloud-managed enforcement, split the way the dashboard splits it: `policies` wri **Races.** No server-side lock. The CLI records the generation it read and exits non-zero if the write does not land at exactly one higher — somebody else deployed, and a replace does not merge. Re-read with `fleet show` and retry. - **Idempotent.** Re-running the same deploy is a no-op that exits 0 without writing — desired-state semantics, so a retrying harness succeeds rather than errors. `applied` in the JSON is the only way to tell "changed it" from "already matched"; the exit code is 0 for both. The no-op short-circuits before the write, so a reader without `fixes:write` also gets 0 there — exit 0 from a no-op is not proof of write access. + **Idempotent.** Re-running the same deploy is a no-op that exits 0 without writing — desired-state semantics, so a retrying harness succeeds rather than errors. `applied` in the JSON is the only way to tell "changed it" from "already matched"; the exit code is 0 for both. The no-op short-circuits before the write, so a reader without `policies:write` also gets 0 there — exit 0 from a no-op is not proof of write access. **Exit codes.** A malformed ref (`bad ref!!`, `id:banana`, empty), or `--set` combined with `--add`/`--remove`, is a usage error → **exit 2**, like every other bad flag value. A ref that parses but names something that does not exist (`--add ghost-policy`, an unpublished `@version`) is **exit 1**; an unknown machine is **exit 6**. Branch on these rather than on the message. diff --git a/fp-cloud-cli/tests/test_cloud_human_views.py b/fp-cloud-cli/tests/test_cloud_human_views.py index e717a89c2..32014ab78 100644 --- a/fp-cloud-cli/tests/test_cloud_human_views.py +++ b/fp-cloud-cli/tests/test_cloud_human_views.py @@ -284,4 +284,4 @@ def test_roles_permissions_wrap_as_readable_text(logged_in, runner, monkeypatch, assert result.exit_code == 0 assert "permissions" in result.stdout assert "[" not in result.stdout - assert "events:read" in result.stdout and "fixes:write" in result.stdout + assert "events:read" in result.stdout and "policies:write" in result.stdout diff --git a/fp-cloud-cli/tests/test_keys_queries.py b/fp-cloud-cli/tests/test_keys_queries.py index 9274f9c62..573e07541 100644 --- a/fp-cloud-cli/tests/test_keys_queries.py +++ b/fp-cloud-cli/tests/test_keys_queries.py @@ -27,11 +27,11 @@ def test_audit_permissions_are_assignable_and_in_presets(): def test_policy_permissions_are_assignable_and_in_presets(): from fp_cli.permissions import ALL_PERMISSIONS, PRESETS - assert "fixes:read" in ALL_PERMISSIONS - assert "fixes:write" in ALL_PERMISSIONS + assert "policies:read" in ALL_PERMISSIONS + assert "policies:write" in ALL_PERMISSIONS assert "policies:pull" in ALL_PERMISSIONS - assert "fixes:read" in PRESETS["read-only"] - assert "fixes:read" in PRESETS["standard"] + assert "policies:read" in PRESETS["read-only"] + assert "policies:read" in PRESETS["standard"] assert "policies:pull" in PRESETS["admin"]