failproofai 1.0.5 → 1.0.6-beta.1

package/dist/cli.mjs

@@ -29,7 +29,7 @@ var __esm = (fn, res, err) => () => {
 var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
 // package.json
-var version2 = "1.0.5", package_default;
+var version2 = "1.0.6-beta.1", package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "failproofai",
@@ -45,6 +45,7 @@ var init_package = __esm(() => {
       "scripts/",
       "lib/",
       "pi-extension/",
+      "hermes-plugin/",
       "openclaw-plugin/",
       ".next/standalone/",
       "dist/",
@@ -113,15 +114,15 @@ var init_package = __esm(() => {
       access: "public"
     },
     devDependencies: {
-      "@anthropic-ai/sdk": "^0.123.0",
+      "@anthropic-ai/sdk": "^0.125.0",
       "@mdx-js/mdx": "^3.1.1",
       "@tailwindcss/postcss": "^4.3.1",
       "@tanstack/react-virtual": "^3.14.10",
       "@testing-library/jest-dom": "^7.0.0",
       "@testing-library/react": "^16.3.2",
       "@testing-library/user-event": "^14.6.5",
-      "@types/node": "26.4.1",
-      "@types/react": "19.2.18",
+      "@types/node": "26.5.1",
+      "@types/react": "19.3.0",
       "@types/react-dom": "^19.2.3",
       "@vitejs/plugin-react": "^6.1.0",
       clsx: "^2.1.1",
@@ -154,16 +155,16 @@ var init_package = __esm(() => {
       browserslist: "4.28.8"
     },
     optionalDependencies: {
-      "@failproofai/failproofaid-linux-x64": "1.0.5",
-      "@failproofai/failproofaid-linux-arm64": "1.0.5",
-      "@failproofai/failproofaid-darwin-x64": "1.0.5",
-      "@failproofai/failproofaid-darwin-arm64": "1.0.5"
+      "@failproofai/failproofaid-linux-x64": "1.0.6-beta.1",
+      "@failproofai/failproofaid-linux-arm64": "1.0.6-beta.1",
+      "@failproofai/failproofaid-darwin-x64": "1.0.6-beta.1",
+      "@failproofai/failproofaid-darwin-arm64": "1.0.6-beta.1"
     },
     failproofaidBinaries: {
-      "linux-x64": "5fb4c8a993af9279e46306803c68d6650ea57290bbd7ec92795a7f7b696bb506",
-      "linux-arm64": "21c502073649d9c12710fc2707b9dee08b7ac1528b8544b85a755017c8fdff0e",
-      "darwin-x64": "5e02c2f4887793c64f5553d8d00fd21507f88dce1a6869ca1aca2f6468129373",
-      "darwin-arm64": "65be288a3485ca86869580a036e6c7e9b7b5660a6589143b375586b6c28b5c84"
+      "linux-x64": "b6f877cd407c3322ff8ad2f98a096b6ea15b0bd1d63de6276c689368345c1cd2",
+      "linux-arm64": "0da90a816b9dc707efe9b82176923cbf0f00026179c816e34eaad362ce2c0fa4",
+      "darwin-x64": "bcbec488353fa04a1953a87cad15054e4796117cac4fd60b17fb1c87d62b7b1e",
+      "darwin-arm64": "6830989a91a27642cdcc63fcfad529c69c0deb3f3abcf5ad40fd3516289b451d"
     }
   };
 });
@@ -5101,36 +5102,38 @@ var require_Alias = __commonJS(function(exports) {
         if (node.anchor === this.source)
           found = node;
       }
+      if (found && ctx) {
+        const { anchors, doc, maxAliasCount } = ctx;
+        let data = anchors.get(found);
+        if (!data) {
+          toJS.toJS(found, null, ctx);
+          data = anchors.get(found);
+        }
+        if (data?.res === undefined) {
+          const msg = "This should not happen: Alias anchor was not resolved?";
+          throw new ReferenceError(msg);
+        }
+        if (maxAliasCount >= 0) {
+          data.count += 1;
+          if (data.aliasCount === 0)
+            data.aliasCount = getAliasCount(doc, found, anchors);
+          if (data.count * data.aliasCount > maxAliasCount) {
+            const msg = "Excessive alias count indicates a resource exhaustion attack";
+            throw new ReferenceError(msg);
+          }
+        }
+      }
       return found;
     }
     toJSON(_arg, ctx) {
       if (!ctx)
         return { source: this.source };
-      const { anchors, doc, maxAliasCount } = ctx;
-      const source = this.resolve(doc, ctx);
+      const source = this.resolve(ctx.doc, ctx);
       if (!source) {
         const msg = `Unresolved alias (the anchor must be set before the alias): ${this.source}`;
         throw new ReferenceError(msg);
       }
-      let data = anchors.get(source);
-      if (!data) {
-        toJS.toJS(source, null, ctx);
-        data = anchors.get(source);
-      }
-      if (data?.res === undefined) {
-        const msg = "This should not happen: Alias anchor was not resolved?";
-        throw new ReferenceError(msg);
-      }
-      if (maxAliasCount >= 0) {
-        data.count += 1;
-        if (data.aliasCount === 0)
-          data.aliasCount = getAliasCount(doc, source, anchors);
-        if (data.count * data.aliasCount > maxAliasCount) {
-          const msg = "Excessive alias count indicates a resource exhaustion attack";
-          throw new ReferenceError(msg);
-        }
-      }
-      return data.res;
+      return ctx.anchors.get(source).res;
     }
     toString(ctx, _onComment, _onChompKeep) {
       const src = `*${this.source}`;
@@ -8892,33 +8895,32 @@ var require_resolve_flow_scalar = __commonJS(function(exports) {
     }
     if (badChar)
       onError(0, "BAD_SCALAR_START", `Plain value cannot start with ${badChar}`);
-    return foldLines(source);
+    return unfoldLines(source);
   }
   function singleQuotedValue(source, onError) {
     if (source[source.length - 1] !== "'" || source.length === 1)
       onError(source.length, "MISSING_CHAR", "Missing closing 'quote");
-    return foldLines(source.slice(1, -1)).replace(/''/g, "'");
+    return unfoldLines(source.slice(1, -1)).replace(/''/g, "'");
   }
-  function foldLines(source) {
-    let first, line;
+  function unfoldLines(source) {
+    const line = /(.*?)\r?\n/sy;
+    let match = line.exec(source);
+    if (!match)
+      return source;
+    let trimEnd, trimBoth;
     try {
-      first = new RegExp(`(.*?)(?<![ 	])[ 	]*\r?
-`, "sy");
-      line = new RegExp(`[ 	]*(.*?)(?:(?<![ 	])[ 	]*)?\r?
-`, "sy");
+      trimEnd = new RegExp("(?<![ \t])[ \t]+$");
+      trimBoth = new RegExp("^[ \t]+|(?<![ \t])[ \t]+$", "g");
     } catch {
-      first = /(.*?)[ \t]*\r?\n/sy;
-      line = /[ \t]*(.*?)[ \t]*\r?\n/sy;
+      trimEnd = /[ \t]+$/;
+      trimBoth = /^[ \t]+|[ \t]+$/g;
     }
-    let match = first.exec(source);
-    if (!match)
-      return source;
-    let res = match[1];
+    let res = match[1].replace(trimEnd, "");
     let sep = " ";
-    let pos = first.lastIndex;
-    line.lastIndex = pos;
+    let pos = line.lastIndex;
     while (match = line.exec(source)) {
-      if (match[1] === "") {
+      const lm = match[1].replace(trimBoth, "");
+      if (lm === "") {
         if (sep === `
 `)
           res += sep;
@@ -8926,7 +8928,7 @@ var require_resolve_flow_scalar = __commonJS(function(exports) {
           sep = `
 `;
       } else {
-        res += sep + match[1];
+        res += sep + lm;
         sep = " ";
       }
       pos = line.lastIndex;
@@ -11516,36 +11518,66 @@ var init_dist = __esm(() => {
 });
 
 // lib/hermes-profiles.ts
-import { readdirSync } from "node:fs";
+import { existsSync as existsSync6, readdirSync } from "node:fs";
 import { homedir as homedir4 } from "node:os";
 import { basename, dirname as dirname3, join as join3, resolve as resolve6 } from "node:path";
 function hermesRoot() {
   const env = (process.env.HERMES_HOME || "").trim();
   if (env) {
-    const home = resolve6(env);
+    let home = resolve6(env);
     const parent = dirname3(home);
     if (basename(parent) === PROFILES_DIR)
-      return dirname3(parent);
+      home = dirname3(parent);
+    const base = basename(home);
+    if (base === STANDARD_HOME || base.startsWith(SIBLING_HOME_PREFIX)) {
+      return join3(dirname3(home), STANDARD_HOME);
+    }
     return home;
   }
-  return join3(homedir4(), ".hermes");
+  return join3(homedir4(), STANDARD_HOME);
+}
+function uniqueProfileName(preferred, seen) {
+  if (!seen.has(preferred))
+    return preferred;
+  const base = `${preferred}-home`;
+  if (!seen.has(base))
+    return base;
+  let suffix = 2;
+  while (seen.has(`${base}-${suffix}`))
+    suffix += 1;
+  return `${base}-${suffix}`;
 }
 function listHermesProfiles() {
   const root = hermesRoot();
   const out = [{ name: HERMES_DEFAULT_PROFILE, home: root }];
   const seen = new Set([HERMES_DEFAULT_PROFILE]);
-  let names;
+  let names = [];
   try {
     names = readdirSync(join3(root, PROFILES_DIR), { withFileTypes: true }).filter((e) => (e.isDirectory() || e.isSymbolicLink()) && !e.name.startsWith(".")).map((e) => e.name).sort();
-  } catch {
-    return out;
-  }
+  } catch {}
   for (const name of names) {
     if (seen.has(name))
       continue;
     seen.add(name);
     out.push({ name, home: join3(root, PROFILES_DIR, name) });
   }
+  if (basename(root) !== STANDARD_HOME)
+    return out;
+  let siblings = [];
+  const parent = dirname3(root);
+  try {
+    siblings = readdirSync(parent, { withFileTypes: true }).filter((entry) => (entry.isDirectory() || entry.isSymbolicLink()) && entry.name.startsWith(SIBLING_HOME_PREFIX) && entry.name.length > SIBLING_HOME_PREFIX.length && existsSync6(join3(parent, entry.name, "config.yaml"))).map((entry) => ({
+      name: entry.name.slice(SIBLING_HOME_PREFIX.length),
+      home: join3(parent, entry.name)
+    })).sort((a, b) => a.name.localeCompare(b.name));
+  } catch {
+    return out;
+  }
+  for (const sibling of siblings) {
+    const name = uniqueProfileName(sibling.name, seen);
+    seen.add(name);
+    out.push({ name, home: sibling.home });
+  }
   return out;
 }
 function hermesProjectName(profile, source) {
@@ -11571,11 +11603,11 @@ function hermesProjectNameCandidates(name) {
   out.push({ profile: HERMES_DEFAULT_PROFILE, source: rest });
   return out;
 }
-var PROFILES_DIR = "profiles", HERMES_DEFAULT_PROFILE = "default";
+var PROFILES_DIR = "profiles", STANDARD_HOME = ".hermes", SIBLING_HOME_PREFIX = ".hermes-", HERMES_DEFAULT_PROFILE = "default";
 var init_hermes_profiles = () => {};
 
 // lib/openclaw-profiles.ts
-import { existsSync as existsSync6, readdirSync as readdirSync2 } from "node:fs";
+import { existsSync as existsSync7, readdirSync as readdirSync2 } from "node:fs";
 import { homedir as homedir5 } from "node:os";
 import { basename as basename2, dirname as dirname4, join as join4, resolve as resolve7 } from "node:path";
 function openclawProfileHome() {
@@ -11607,7 +11639,7 @@ function listOpenClawProfiles() {
   } catch {
     return out;
   }
-  const named = entries.filter((entry) => (entry.isDirectory() || entry.isSymbolicLink()) && entry.name.startsWith(".openclaw-") && entry.name.length > ".openclaw-".length && existsSync6(join4(parent, entry.name, "openclaw.json"))).map((entry) => ({
+  const named = entries.filter((entry) => (entry.isDirectory() || entry.isSymbolicLink()) && entry.name.startsWith(".openclaw-") && entry.name.length > ".openclaw-".length && existsSync7(join4(parent, entry.name, "openclaw.json"))).map((entry) => ({
     name: entry.name.slice(".openclaw-".length),
     home: join4(parent, entry.name)
   })).sort((a, b) => a.name.localeCompare(b.name));
@@ -11619,12 +11651,22 @@ var init_openclaw_profiles = () => {};
 
 // src/hooks/integrations.ts
 import { execSync as execSync3 } from "node:child_process";
-import { readFileSync as readFileSync5, writeFileSync as writeFileSync3, existsSync as existsSync7, mkdirSync as mkdirSync4, unlinkSync } from "node:fs";
+import {
+  cpSync,
+  readFileSync as readFileSync5,
+  writeFileSync as writeFileSync3,
+  existsSync as existsSync8,
+  lstatSync,
+  mkdirSync as mkdirSync4,
+  renameSync as renameSync2,
+  rmSync as rmSync2,
+  unlinkSync
+} from "node:fs";
 import { resolve as resolve8, dirname as dirname5 } from "node:path";
 import { fileURLToPath } from "node:url";
 import { homedir as homedir6 } from "node:os";
 function readJsonFile(path) {
-  if (!existsSync7(path))
+  if (!existsSync8(path))
     return {};
   const raw = readFileSync5(path, "utf8");
   return JSON.parse(raw);
@@ -11636,7 +11678,7 @@ function writeJsonFile(path, data) {
 }
 function readYamlDoc(path) {
   try {
-    return existsSync7(path) ? $parseDocument(readFileSync5(path, "utf8")) : $parseDocument("");
+    return existsSync8(path) ? $parseDocument(readFileSync5(path, "utf8")) : $parseDocument("");
   } catch {
     return $parseDocument("");
   }
@@ -11921,19 +11963,125 @@ function makePiProjectRelativeEntry(extPath) {
   }
   return extResolved;
 }
-function hermesConfigHasHooks(settingsPath) {
-  if (!existsSync7(settingsPath))
-    return false;
+function getHermesPluginSourcePath() {
+  const fromEnv = process.env.FAILPROOFAI_PACKAGE_ROOT;
+  if (fromEnv)
+    return resolve8(fromEnv, "hermes-plugin");
+  return resolve8(fileURLToPath(import.meta.url), "..", "..", "..", "hermes-plugin");
+}
+function hermesPluginPathForSettings(settingsPath) {
+  return resolve8(dirname5(settingsPath), "plugins", HERMES_PLUGIN_ID);
+}
+function hasManagedHermesPlugin(settingsPath) {
+  const pluginPath = hermesPluginPathForSettings(settingsPath);
   try {
-    const doc = readYamlDoc(settingsPath);
-    const js = doc.toJS() ?? {};
-    const hooks = js.hooks;
-    if (!hooks || typeof hooks !== "object")
+    if (lstatSync(pluginPath).isSymbolicLink())
       return false;
-    for (const entries of Object.values(hooks)) {
-      if (Array.isArray(entries) && entries.some((h) => isMarkedHook(h)))
-        return true;
+    if (!existsSync8(resolve8(pluginPath, HERMES_PLUGIN_MARKER)))
+      return false;
+    return HERMES_PLUGIN_FILES.every((file) => existsSync8(resolve8(pluginPath, file)));
+  } catch {
+    return false;
+  }
+}
+function hasHermesPluginMarker(settingsPath) {
+  const pluginPath = hermesPluginPathForSettings(settingsPath);
+  try {
+    return !lstatSync(pluginPath).isSymbolicLink() && existsSync8(resolve8(pluginPath, HERMES_PLUGIN_MARKER));
+  } catch {
+    return false;
+  }
+}
+function installHermesPlugin(settingsPath) {
+  const source = getHermesPluginSourcePath();
+  for (const file of HERMES_PLUGIN_FILES) {
+    if (!existsSync8(resolve8(source, file))) {
+      throw new Error(`Hermes plugin asset is missing from the failproofai package: ${file}`);
+    }
+  }
+  const destination = hermesPluginPathForSettings(settingsPath);
+  if (existsSync8(destination)) {
+    if (lstatSync(destination).isSymbolicLink() || !existsSync8(resolve8(destination, HERMES_PLUGIN_MARKER))) {
+      throw new Error(`Refusing to overwrite an unmanaged Hermes plugin at ${destination}. ` + `Move it aside or install FailproofAI under a different Hermes profile.`);
+    }
+  }
+  mkdirSync4(dirname5(destination), { recursive: true });
+  const suffix = `${process.pid}-${Date.now()}`;
+  const temporary = `${destination}.install-${suffix}`;
+  const backup = `${destination}.backup-${suffix}`;
+  let movedExisting = false;
+  try {
+    mkdirSync4(temporary, { recursive: true });
+    for (const file of HERMES_PLUGIN_FILES) {
+      cpSync(resolve8(source, file), resolve8(temporary, file));
+    }
+    writeFileSync3(resolve8(temporary, HERMES_PLUGIN_MARKER), "Managed by failproofai. Remove with `failproofai policies --uninstall --cli hermes`.\n", { encoding: "utf8", mode: 384 });
+    if (existsSync8(destination)) {
+      renameSync2(destination, backup);
+      movedExisting = true;
+    }
+    renameSync2(temporary, destination);
+    if (movedExisting)
+      rmSync2(backup, { recursive: true, force: true });
+  } catch (err) {
+    rmSync2(temporary, { recursive: true, force: true });
+    if (movedExisting && !existsSync8(destination) && existsSync8(backup)) {
+      renameSync2(backup, destination);
+    }
+    throw err;
+  }
+}
+function removeManagedHermesPlugin(settingsPath) {
+  const pluginPath = hermesPluginPathForSettings(settingsPath);
+  if (!hasHermesPluginMarker(settingsPath))
+    return false;
+  rmSync2(pluginPath, { recursive: true, force: true });
+  return true;
+}
+function removeLegacyHermesHooks(doc) {
+  const js = doc.toJS() ?? {};
+  const hooks = js.hooks;
+  let removed = 0;
+  if (hooks && typeof hooks === "object") {
+    for (const eventType of Object.keys(hooks)) {
+      const entries = hooks[eventType];
+      if (!Array.isArray(entries))
+        continue;
+      const before = entries.length;
+      const filtered = entries.filter((hook) => !isMarkedHook(hook));
+      removed += before - filtered.length;
+      if (filtered.length === 0)
+        delete hooks[eventType];
+      else
+        hooks[eventType] = filtered;
+    }
+    if (Object.keys(hooks).length === 0) {
+      doc.delete("hooks");
+      if (removed > 0)
+        doc.delete("hooks_auto_accept");
+    } else {
+      doc.set("hooks", hooks);
     }
+  }
+  return removed;
+}
+function hermesConfigState(settingsPath) {
+  if (!existsSync8(settingsPath)) {
+    return { pluginEnabled: false, legacyShellHookPresent: false };
+  }
+  const doc = readYamlDoc(settingsPath);
+  const js = doc.toJS() ?? {};
+  const enabled = js.plugins?.enabled;
+  const legacyShellHookPresent = !!js.hooks && typeof js.hooks === "object" && Object.values(js.hooks).some((entries) => Array.isArray(entries) && entries.some((entry) => isMarkedHook(entry)));
+  return {
+    pluginEnabled: Array.isArray(enabled) && enabled.includes(HERMES_PLUGIN_ID),
+    legacyShellHookPresent
+  };
+}
+function hermesConfigHasHooks(settingsPath) {
+  try {
+    const state = hermesConfigState(settingsPath);
+    return state.pluginEnabled && hasManagedHermesPlugin(settingsPath) && !state.legacyShellHookPresent;
   } catch {}
   return false;
 }
@@ -11967,7 +12115,7 @@ function listInstallableIds() {
 function detectInstalledClis() {
   return INTEGRATION_TYPES.filter((id) => INTEGRATIONS[id]?.detectInstalled());
 }
-var claudeCode, codex, copilot, cursor, OPENCODE_PLUGIN_REL_PATH = "./plugins/failproofai.mjs", opencode, pi, hermes, OPENCLAW_PLUGIN_ID = "failproofai", openclaw, factory, devin, ANTIGRAVITY_HOOK_NAME = "failproofai", ANTIGRAVITY_TOOL_EVENTS, antigravity, goose, INTEGRATIONS;
+var claudeCode, codex, copilot, cursor, OPENCODE_PLUGIN_REL_PATH = "./plugins/failproofai.mjs", opencode, pi, HERMES_PLUGIN_ID = "failproofai", HERMES_PLUGIN_MARKER = ".failproofai-managed", HERMES_PLUGIN_FILES, hermes, OPENCLAW_PLUGIN_ID = "failproofai", openclaw, factory, devin, ANTIGRAVITY_HOOK_NAME = "failproofai", ANTIGRAVITY_TOOL_EVENTS, antigravity, goose, INTEGRATIONS;
 var init_integrations = __esm(() => {
   init_dist();
   init_hermes_profiles();
@@ -12082,7 +12230,7 @@ var init_integrations = __esm(() => {
     },
     hooksInstalledInSettings(scope, cwd) {
       const settingsPath = this.getSettingsPath(scope, cwd);
-      if (!existsSync7(settingsPath))
+      if (!existsSync8(settingsPath))
         return false;
       try {
         const settings = this.readSettings(settingsPath);
@@ -12198,7 +12346,7 @@ var init_integrations = __esm(() => {
     },
     hooksInstalledInSettings(scope, cwd) {
       const settingsPath = this.getSettingsPath(scope, cwd);
-      if (!existsSync7(settingsPath))
+      if (!existsSync8(settingsPath))
         return false;
       try {
         const settings = this.readSettings(settingsPath);
@@ -12312,7 +12460,7 @@ var init_integrations = __esm(() => {
     },
     hooksInstalledInSettings(scope, cwd) {
       const settingsPath = this.getSettingsPath(scope, cwd);
-      if (!existsSync7(settingsPath))
+      if (!existsSync8(settingsPath))
         return false;
       try {
         const settings = this.readSettings(settingsPath);
@@ -12415,7 +12563,7 @@ var init_integrations = __esm(() => {
     },
     hooksInstalledInSettings(scope, cwd) {
       const settingsPath = this.getSettingsPath(scope, cwd);
-      if (!existsSync7(settingsPath))
+      if (!existsSync8(settingsPath))
         return false;
       try {
         const settings = this.readSettings(settingsPath);
@@ -12499,7 +12647,7 @@ var init_integrations = __esm(() => {
       }
       this.writeSettings(settingsPath, settings);
       const pluginPath = opencodePluginFilePath(settingsPath);
-      if (existsSync7(pluginPath)) {
+      if (existsSync8(pluginPath)) {
         try {
           const content = readFileSync5(pluginPath, "utf8");
           if (content.includes(FAILPROOFAI_HOOK_MARKER)) {
@@ -12513,7 +12661,7 @@ var init_integrations = __esm(() => {
     },
     hooksInstalledInSettings(scope, cwd) {
       const settingsPath = this.getSettingsPath(scope, cwd);
-      if (!existsSync7(settingsPath))
+      if (!existsSync8(settingsPath))
         return false;
       try {
         const settings = this.readSettings(settingsPath);
@@ -12523,7 +12671,7 @@ var init_integrations = __esm(() => {
         if (!hasEntry)
           return false;
         const pluginPath = opencodePluginFilePath(settingsPath);
-        if (!existsSync7(pluginPath))
+        if (!existsSync8(pluginPath))
           return false;
         const content = readFileSync5(pluginPath, "utf8");
         return content.includes(FAILPROOFAI_HOOK_MARKER);
@@ -12590,7 +12738,7 @@ var init_integrations = __esm(() => {
       }
     },
     removeHooksFromFile(settingsPath) {
-      if (!existsSync7(settingsPath))
+      if (!existsSync8(settingsPath))
         return 0;
       const settings = this.readSettings(settingsPath);
       if (!Array.isArray(settings.packages))
@@ -12605,7 +12753,7 @@ var init_integrations = __esm(() => {
     },
     hooksInstalledInSettings(scope, cwd) {
       const settingsPath = this.getSettingsPath(scope, cwd);
-      if (!existsSync7(settingsPath))
+      if (!existsSync8(settingsPath))
         return false;
       try {
         const settings = this.readSettings(settingsPath);
@@ -12620,9 +12768,11 @@ var init_integrations = __esm(() => {
       return binaryExists("pi");
     }
   };
+  HERMES_PLUGIN_FILES = ["plugin.yaml", "__init__.py", "client.py", "ledger.py"];
   hermes = {
     id: "hermes",
     displayName: "Hermes",
+    requiresHealthyDaemon: true,
     scopes: HERMES_HOOK_SCOPES,
     eventTypes: HERMES_HOOK_EVENT_TYPES,
     getSettingsPath() {
@@ -12637,62 +12787,62 @@ var init_integrations = __esm(() => {
     writeSettings(settingsPath, settings) {
       writeYamlDoc(settingsPath, settings);
     },
-    buildHookEntry(binaryPath, eventType, scope) {
-      const command = scope === "project" ? `npx -y failproofai --hook ${eventType} --cli hermes` : `"${binaryPath}" --hook ${eventType} --cli hermes`;
+    prepareInstall(settingsPath) {
+      installHermesPlugin(settingsPath);
+    },
+    buildHookEntry(_binaryPath, _eventType, _scope) {
       return {
-        command,
-        timeout: 30,
-        [FAILPROOFAI_HOOK_MARKER]: true
+        [FAILPROOFAI_HOOK_MARKER]: true,
+        _hermesPluginPath: getHermesPluginSourcePath()
       };
     },
     isFailproofaiHook: isMarkedHook,
-    writeHookEntries(settings, binaryPath, scope) {
+    writeHookEntries(settings) {
       const doc = settings;
+      removeLegacyHermesHooks(doc);
       const js = doc.toJS() ?? {};
-      const hooks = js.hooks && typeof js.hooks === "object" ? js.hooks : {};
-      for (const eventType of HERMES_HOOK_EVENT_TYPES) {
-        const entry = this.buildHookEntry(binaryPath, eventType, scope);
-        const arr = Array.isArray(hooks[eventType]) ? hooks[eventType] : [];
-        const idx = arr.findIndex((h) => isMarkedHook(h));
-        if (idx >= 0)
-          arr[idx] = entry;
-        else
-          arr.push(entry);
-        hooks[eventType] = arr;
-      }
-      doc.set("hooks", hooks);
-      doc.set("hooks_auto_accept", true);
+      const plugins = js.plugins && typeof js.plugins === "object" ? js.plugins : {};
+      const enabled = Array.isArray(plugins.enabled) ? [...plugins.enabled] : [];
+      if (!enabled.includes(HERMES_PLUGIN_ID))
+        enabled.push(HERMES_PLUGIN_ID);
+      plugins.enabled = enabled;
+      if (Array.isArray(plugins.disabled)) {
+        plugins.disabled = plugins.disabled.filter((name) => name !== HERMES_PLUGIN_ID);
+        if (plugins.disabled.length === 0)
+          delete plugins.disabled;
+      }
+      doc.set("plugins", plugins);
     },
     removeHooksFromFile(settingsPath) {
-      if (!existsSync7(settingsPath))
-        return 0;
       const doc = readYamlDoc(settingsPath);
+      let removed = removeLegacyHermesHooks(doc);
       const js = doc.toJS() ?? {};
-      const hooks = js.hooks;
-      let removed = 0;
-      if (hooks && typeof hooks === "object") {
-        for (const eventType of Object.keys(hooks)) {
-          const entries = hooks[eventType];
-          if (!Array.isArray(entries))
-            continue;
-          const before = entries.length;
-          const filtered = entries.filter((h) => !isMarkedHook(h));
-          removed += before - filtered.length;
-          if (filtered.length === 0)
-            delete hooks[eventType];
-          else
-            hooks[eventType] = filtered;
+      const plugins = js.plugins;
+      let configChanged = removed > 0;
+      if (plugins && typeof plugins === "object") {
+        if (Array.isArray(plugins.enabled)) {
+          const before = plugins.enabled.length;
+          plugins.enabled = plugins.enabled.filter((name) => name !== HERMES_PLUGIN_ID);
+          if (plugins.enabled.length !== before) {
+            removed += 1;
+            configChanged = true;
+          }
+          if (plugins.enabled.length === 0)
+            delete plugins.enabled;
         }
-        if (removed > 0) {
-          if (Object.keys(hooks).length === 0)
-            doc.delete("hooks");
-          else
-            doc.set("hooks", hooks);
+        if (plugins.entries && HERMES_PLUGIN_ID in plugins.entries) {
+          delete plugins.entries[HERMES_PLUGIN_ID];
+          configChanged = true;
         }
+        if (Object.keys(plugins).length === 0)
+          doc.delete("plugins");
+        else
+          doc.set("plugins", plugins);
       }
-      const droppedAutoAccept = doc.delete("hooks_auto_accept");
-      if (removed > 0 || droppedAutoAccept)
+      if (configChanged)
         writeYamlDoc(settingsPath, doc);
+      if (removeManagedHermesPlugin(settingsPath))
+        removed += 1;
       return removed;
     },
     hooksInstalledInSettings(scope, cwd) {
@@ -12757,7 +12907,7 @@ var init_integrations = __esm(() => {
       hooks.allowConversationAccess = true;
     },
     removeHooksFromFile(settingsPath) {
-      if (!existsSync7(settingsPath))
+      if (!existsSync8(settingsPath))
         return 0;
       const settings = this.readSettings(settingsPath);
       const plugins = settings.plugins;
@@ -12787,7 +12937,7 @@ var init_integrations = __esm(() => {
     hooksInstalledInSettings(scope, cwd) {
       const settingsPaths = settingsPathsFor(this, scope, cwd);
       return settingsPaths.length > 0 && settingsPaths.every((settingsPath) => {
-        if (!existsSync7(settingsPath))
+        if (!existsSync8(settingsPath))
           return false;
         try {
           const settings = this.readSettings(settingsPath);
@@ -12885,7 +13035,7 @@ var init_integrations = __esm(() => {
     },
     hooksInstalledInSettings(scope, cwd) {
       const settingsPath = this.getSettingsPath(scope, cwd);
-      if (!existsSync7(settingsPath))
+      if (!existsSync8(settingsPath))
         return false;
       try {
         const settings = this.readSettings(settingsPath);
@@ -12991,7 +13141,7 @@ var init_integrations = __esm(() => {
     },
     hooksInstalledInSettings(scope, cwd) {
       const settingsPath = this.getSettingsPath(scope, cwd);
-      if (!existsSync7(settingsPath))
+      if (!existsSync8(settingsPath))
         return false;
       try {
         const settings = this.readSettings(settingsPath);
@@ -13130,7 +13280,7 @@ var init_integrations = __esm(() => {
     },
     hooksInstalledInSettings(scope, cwd) {
       const settingsPath = this.getSettingsPath(scope, cwd);
-      if (!existsSync7(settingsPath))
+      if (!existsSync8(settingsPath))
         return false;
       try {
         const settings = this.readSettings(settingsPath);
@@ -13236,7 +13386,7 @@ var init_integrations = __esm(() => {
     },
     hooksInstalledInSettings(scope, cwd) {
       const settingsPath = this.getSettingsPath(scope, cwd);
-      if (!existsSync7(settingsPath))
+      if (!existsSync8(settingsPath))
         return false;
       try {
         const settings = this.readSettings(settingsPath);
@@ -13627,12 +13777,12 @@ var init_telemetry_id2 = __esm(() => {
 // src/hooks/custom-hooks-loader.ts
 import { resolve as resolve10, isAbsolute as isAbsolute2, basename as basename3 } from "node:path";
 import { randomUUID } from "crypto";
-import { existsSync as existsSync8, readdirSync as readdirSync3 } from "node:fs";
+import { existsSync as existsSync9, readdirSync as readdirSync3 } from "node:fs";
 import { readFile as readFile3 } from "node:fs/promises";
 import { pathToFileURL as pathToFileURL2 } from "node:url";
 import { createHash as createHash4 } from "node:crypto";
 function discoverPolicyFiles(dir) {
-  if (!existsSync8(dir))
+  if (!existsSync9(dir))
     return [];
   try {
     const entries = readdirSync3(dir, { withFileTypes: true });
@@ -13642,7 +13792,7 @@ function discoverPolicyFiles(dir) {
   }
 }
 function findSkippedPolicyFiles(dir) {
-  if (!existsSync8(dir))
+  if (!existsSync9(dir))
     return [];
   try {
     return readdirSync3(dir, { withFileTypes: true }).filter((e) => e.isFile() && LOADABLE_EXT_RE.test(e.name) && !CONVENTION_FILE_RE.test(e.name) && !e.name.endsWith(".d.ts") && !isTmpArtifact(e.name)).map((e) => e.name).sort((a, b) => a.localeCompare(b));
@@ -13729,7 +13879,7 @@ async function loadCustomHooks(customPoliciesPath, opts) {
   if (!customPoliciesPath)
     return [];
   const absPath = isAbsolute2(customPoliciesPath) ? customPoliciesPath : resolve10(opts?.sessionCwd ?? process.cwd(), customPoliciesPath);
-  if (!existsSync8(absPath)) {
+  if (!existsSync9(absPath)) {
     if (opts?.strict)
       throw new Error(`Custom hooks file not found: ${absPath}`);
     hookLogWarn(`customPoliciesPath not found: ${absPath}`);
@@ -13815,7 +13965,7 @@ async function loadAllCustomHooks(customPoliciesPaths, opts) {
     const absPath = resolve10(projectRoot, customPoliciesPath);
     const cloudManaged = cloudManagedByPath.get(absPath);
     const pack = packByPath.get(absPath);
-    if (existsSync8(absPath)) {
+    if (existsSync9(absPath)) {
       if (!loadedPaths.has(absPath)) {
         loadedPaths.add(absPath);
         const hooksBefore = getCustomHooks().length;
@@ -14883,7 +15033,7 @@ var init_pack_cli = __esm(() => {
 
 // src/hooks/pack-store.ts
 import { createHash as createHash5 } from "node:crypto";
-import { existsSync as existsSync9, mkdirSync as mkdirSync5, readFileSync as readFileSync6, renameSync as renameSync2, rmSync as rmSync2, writeFileSync as writeFileSync4 } from "node:fs";
+import { existsSync as existsSync10, mkdirSync as mkdirSync5, readFileSync as readFileSync6, renameSync as renameSync3, rmSync as rmSync3, writeFileSync as writeFileSync4 } from "node:fs";
 import { dirname as dirname7, resolve as resolve11 } from "node:path";
 function baseUrl() {
   return (process.env.FAILPROOFAI_PACK_BASE_URL || DEFAULT_BASE_URL).replace(/\/+$/, "");
@@ -15057,9 +15207,9 @@ function writeAtomic(target, bytes) {
   try {
     mkdirSync5(dirname7(target), { recursive: true });
     writeFileSync4(tempPath, bytes);
-    renameSync2(tempPath, target);
+    renameSync3(tempPath, target);
   } catch (err) {
-    rmSync2(tempPath, { force: true });
+    rmSync3(tempPath, { force: true });
     throw err;
   }
 }
@@ -15233,7 +15383,7 @@ async function addPack(source, opts) {
   const root = packsRoot();
   const artifactRel = `artifacts/${fetched.artifactDigest}.mjs`;
   const artifactAbs = resolve11(root, artifactRel);
-  if (!existsSync9(artifactAbs))
+  if (!existsSync10(artifactAbs))
     writeAtomic(artifactAbs, fetched.artifact);
   try {
     await verifyArtifactRegisters(artifactAbs, available);
@@ -15276,7 +15426,7 @@ async function addPack(source, opts) {
 }
 function setPackPolicyEnabled(packId, name, on) {
   const manifestPath = resolve11(packsRoot(), "installed.json");
-  if (!existsSync9(manifestPath))
+  if (!existsSync10(manifestPath))
     return { ok: false, reason: "no packs are installed" };
   let raw;
   try {
@@ -15310,7 +15460,7 @@ function bareId(value) {
 }
 function removePack(id) {
   const manifestPath = resolve11(packsRoot(), "installed.json");
-  if (!existsSync9(manifestPath))
+  if (!existsSync10(manifestPath))
     return null;
   let raw;
   try {
@@ -15335,7 +15485,7 @@ function removePack(id) {
 function upsertInstalled(record, carryAbsorbedSelection = true) {
   const manifestPath = resolve11(packsRoot(), "installed.json");
   let packs = [];
-  if (existsSync9(manifestPath)) {
+  if (existsSync10(manifestPath)) {
     try {
       const raw = JSON.parse(readFileSync6(manifestPath, "utf8"));
       if (Array.isArray(raw.packs))
@@ -16178,16 +16328,16 @@ import {
   readFileSync as readFileSync7,
   writeFileSync as writeFileSync5,
   appendFileSync as appendFileSync2,
-  renameSync as renameSync3,
+  renameSync as renameSync4,
   readdirSync as readdirSync4,
   mkdirSync as mkdirSync6,
-  existsSync as existsSync10,
+  existsSync as existsSync11,
   statSync as statSync5,
   unlinkSync as unlinkSync2
 } from "node:fs";
 import { join as join6 } from "node:path";
 function ensureDir() {
-  if (!existsSync10(storeDirValue())) {
+  if (!existsSync11(storeDirValue())) {
     mkdirSync6(storeDirValue(), { recursive: true });
   }
 }
@@ -16243,7 +16393,7 @@ function persistHookActivity(entry) {
 function rotate(currentPath, countPath) {
   const archiveName = `page-${Date.now()}-${rotateSeq++}.jsonl`;
   const archivePath = join6(storeDirValue(), archiveName);
-  renameSync3(currentPath, archivePath);
+  renameSync4(currentPath, archivePath);
   writeCount(countPath, 0);
 }
 function readCount(countPath) {
@@ -16289,7 +16439,7 @@ function writeStoredStats(s) {
   const tmpPath = join6(storeDirValue(), `stats.json.${process.pid}.tmp`);
   try {
     writeFileSync5(tmpPath, JSON.stringify(s), "utf-8");
-    renameSync3(tmpPath, join6(storeDirValue(), STATS_FILE));
+    renameSync4(tmpPath, join6(storeDirValue(), STATS_FILE));
     return true;
   } catch {
     try {
@@ -16310,7 +16460,7 @@ function rebuildHookActivityStats() {
   let sawAny = false;
   for (const file of files) {
     const path = join6(storeDirValue(), file);
-    if (!existsSync10(path))
+    if (!existsSync11(path))
       continue;
     sawAny = true;
     for (const entry of readJsonlFile(path))
@@ -16379,7 +16529,7 @@ var init_hook_activity_store = __esm(() => {
 });
 
 // src/hooks/delivery-health.ts
-import { existsSync as existsSync11, readdirSync as readdirSync5, statSync as statSync6 } from "node:fs";
+import { existsSync as existsSync12, readdirSync as readdirSync5, statSync as statSync6 } from "node:fs";
 import { join as join7 } from "node:path";
 function parseParkedName(name) {
   const poison = name.endsWith(POISON_SUFFIX);
@@ -16408,7 +16558,7 @@ function parseParkedName(name) {
 }
 function deliveryHealth(home, now = Date.now()) {
   const dir = failedDir(home);
-  if (!existsSync11(dir))
+  if (!existsSync12(dir))
     return EMPTY;
   let entries;
   try {
@@ -17173,7 +17323,7 @@ var init_cursor_projects = __esm(() => {
 });
 
 // lib/sqlite-reader.ts
-import { existsSync as existsSync12, readFileSync as readFileSync8, statSync as statSync7 } from "node:fs";
+import { existsSync as existsSync13, readFileSync as readFileSync8, statSync as statSync7 } from "node:fs";
 import initSqlJs from "sql.js/dist/sql-asm.js";
 async function tryNodeSqlite(dbPath) {
   try {
@@ -17331,7 +17481,7 @@ async function trySqlJs(dbPath) {
   }
 }
 async function openSqliteReadonly(dbPath, options = {}) {
-  if (!existsSync12(dbPath))
+  if (!existsSync13(dbPath))
     return null;
   if (!options.forcePortable) {
     const native = await tryNodeSqlite(dbPath);
@@ -17992,7 +18142,7 @@ var init_hermes_projects = __esm(() => {
 });
 
 // lib/openclaw-db.ts
-import { existsSync as existsSync13 } from "node:fs";
+import { existsSync as existsSync14 } from "node:fs";
 import { join as join15 } from "node:path";
 function str(value) {
   return typeof value === "string" && value.length > 0 ? value : undefined;
@@ -18012,7 +18162,7 @@ function listOpenClawDatabases(home, agentIds) {
   const out = [];
   for (const agentId of agentIds) {
     const dbPath = join15(home, "agents", agentId, "agent", DB_NAME);
-    if (existsSync13(dbPath))
+    if (existsSync14(dbPath))
       out.push({ agentId, dbPath });
   }
   return out;
@@ -20198,13 +20348,13 @@ var init_log_entries = __esm(() => {
 });
 
 // lib/codex-sessions.ts
-import { readFileSync as readFileSync10, readdirSync as readdirSync9, existsSync as existsSync14, writeFileSync as writeFileSync6, mkdirSync as mkdirSync7, statSync as statSync11 } from "node:fs";
+import { readFileSync as readFileSync10, readdirSync as readdirSync9, existsSync as existsSync15, writeFileSync as writeFileSync6, mkdirSync as mkdirSync7, statSync as statSync11 } from "node:fs";
 import { readFile as readFile11 } from "node:fs/promises";
 import { dirname as dirname8, join as join26 } from "node:path";
 import { homedir as homedir18 } from "node:os";
 function readCache() {
   try {
-    if (!existsSync14(CACHE_PATH))
+    if (!existsSync15(CACHE_PATH))
       return {};
     return JSON.parse(readFileSync10(CACHE_PATH, "utf-8"));
   } catch {
@@ -20232,7 +20382,7 @@ function dirSearch(dir, sessionId) {
 function findCodexTranscript(sessionId) {
   const cache = readCache();
   const cached = cache[sessionId];
-  if (cached && existsSync14(cached))
+  if (cached && existsSync15(cached))
     return cached;
   const root = join26(homedir18(), ".codex", "sessions");
   const today = new Date;
@@ -20526,7 +20676,7 @@ var init_resolve_permission_mode = __esm(() => {
 });
 
 // lib/copilot-sessions.ts
-import { readFileSync as readFileSync12, readdirSync as readdirSync10, existsSync as existsSync15, statSync as statSync12 } from "node:fs";
+import { readFileSync as readFileSync12, readdirSync as readdirSync10, existsSync as existsSync16, statSync as statSync12 } from "node:fs";
 import { readFile as readFile12 } from "node:fs/promises";
 import { join as join27, resolve as resolve13, sep as sep2 } from "node:path";
 import { homedir as homedir19 } from "node:os";
@@ -20555,13 +20705,13 @@ function findCopilotTranscript(sessionId) {
   const candidate = resolveSessionFile(sessionId, "events.jsonl");
   if (!candidate)
     return null;
-  return existsSync15(candidate) ? candidate : null;
+  return existsSync16(candidate) ? candidate : null;
 }
 function findCopilotWorkspace(sessionId) {
   const candidate = resolveSessionFile(sessionId, "workspace.yaml");
   if (!candidate)
     return null;
-  return existsSync15(candidate) ? candidate : null;
+  return existsSync16(candidate) ? candidate : null;
 }
 function readYamlScalar(path, key) {
   try {
@@ -20743,7 +20893,7 @@ var init_copilot_sessions = __esm(() => {
 });
 
 // lib/cursor-sessions.ts
-import { readFileSync as readFileSync13, readdirSync as readdirSync11, existsSync as existsSync16, statSync as statSync13 } from "node:fs";
+import { readFileSync as readFileSync13, readdirSync as readdirSync11, existsSync as existsSync17, statSync as statSync13 } from "node:fs";
 import { readFile as readFile13 } from "node:fs/promises";
 import { basename as basename4, join as join28, resolve as resolve14, sep as sep3 } from "node:path";
 import { homedir as homedir20 } from "node:os";
@@ -20766,7 +20916,7 @@ function getCursorSessionDir(sessionId) {
     const transcriptRoot = resolve14(projectsRoot, entry.name, NEW_AGENT_TRANSCRIPTS_DIR2);
     if (candidate === transcriptRoot || !candidate.startsWith(`${transcriptRoot}${sep3}`))
       continue;
-    if (existsSync16(candidate))
+    if (existsSync17(candidate))
       return candidate;
   }
   for (const sub of LEGACY_SESSION_ROOT_CANDIDATES2) {
@@ -20774,7 +20924,7 @@ function getCursorSessionDir(sessionId) {
     const candidate = resolve14(root, sessionId);
     if (candidate === root || !candidate.startsWith(`${root}${sep3}`))
       continue;
-    if (existsSync16(candidate))
+    if (existsSync17(candidate))
       return candidate;
   }
   return null;
@@ -20784,11 +20934,11 @@ function findCursorTranscript(sessionId) {
   if (!dir)
     return null;
   const newCandidate = join28(dir, `${basename4(dir)}.jsonl`);
-  if (existsSync16(newCandidate))
+  if (existsSync17(newCandidate))
     return newCandidate;
   for (const name of LEGACY_TRANSCRIPT_FILE_CANDIDATES2) {
     const candidate = join28(dir, name);
-    if (existsSync16(candidate))
+    if (existsSync17(candidate))
       return candidate;
   }
   return null;
@@ -20999,7 +21149,7 @@ var init_cursor_sessions = __esm(() => {
 });
 
 // lib/pi-sessions.ts
-import { readFileSync as readFileSync14, readdirSync as readdirSync12, existsSync as existsSync17, statSync as statSync14 } from "node:fs";
+import { readFileSync as readFileSync14, readdirSync as readdirSync12, existsSync as existsSync18, statSync as statSync14 } from "node:fs";
 import { readFile as readFile14 } from "node:fs/promises";
 import { join as join29, resolve as resolve15, sep as sep4 } from "node:path";
 import { homedir as homedir21 } from "node:os";
@@ -21036,7 +21186,7 @@ function findPiTranscript(sessionId) {
       const candidate = resolve15(cwdPath, f);
       if (!candidate.startsWith(`${cwdPath}${sep4}`))
         continue;
-      if (existsSync17(candidate))
+      if (existsSync18(candidate))
         return candidate;
     }
   }
@@ -21442,10 +21592,10 @@ var init_pack_failclosed = __esm(() => {
 // lib/atomic-write.ts
 import {
   chmodSync as chmodSync2,
-  existsSync as existsSync18,
+  existsSync as existsSync19,
   mkdirSync as mkdirSync8,
-  renameSync as renameSync4,
-  rmSync as rmSync3,
+  renameSync as renameSync5,
+  rmSync as rmSync4,
   statSync as statSync15,
   writeFileSync as writeFileSync7
 } from "node:fs";
@@ -21455,7 +21605,7 @@ function writeJsonAtomically(filePath, value, opts = {}) {
   const mode = opts.mode ?? 384;
   const dirMode = opts.dirMode ?? 448;
   const dir = dirname9(filePath);
-  if (!existsSync18(dir))
+  if (!existsSync19(dir))
     mkdirSync8(dir, { recursive: true, mode: dirMode });
   const tmp = `${filePath}.${process.pid}.${randomBytes(6).toString("hex")}.tmp`;
   try {
@@ -21464,14 +21614,14 @@ function writeJsonAtomically(filePath, value, opts = {}) {
       if ((statSync15(tmp).mode & 63) !== 0)
         chmodSync2(tmp, mode);
     } catch {}
-    renameSync4(tmp, filePath);
+    renameSync5(tmp, filePath);
     try {
       if ((statSync15(filePath).mode & 63) !== 0)
         chmodSync2(filePath, mode);
     } catch {}
   } catch (err) {
     try {
-      rmSync3(tmp, { force: true });
+      rmSync4(tmp, { force: true });
     } catch {}
     throw err;
   }
@@ -21479,7 +21629,7 @@ function writeJsonAtomically(filePath, value, opts = {}) {
 var init_atomic_write = () => {};
 
 // src/hooks/session-pause.ts
-import { existsSync as existsSync19, mkdirSync as mkdirSync9, readdirSync as readdirSync13, readFileSync as readFileSync15, rmSync as rmSync4 } from "node:fs";
+import { existsSync as existsSync20, mkdirSync as mkdirSync9, readdirSync as readdirSync13, readFileSync as readFileSync15, rmSync as rmSync5 } from "node:fs";
 import { createHash as createHash6 } from "node:crypto";
 import { join as join30, resolve as resolve16 } from "node:path";
 function pauseStateDir() {
@@ -21546,7 +21696,7 @@ function readActivePause(sessionId, now = Date.now()) {
     return null;
   try {
     const path = pauseFilePath(sessionId);
-    if (!existsSync19(path))
+    if (!existsSync20(path))
       return null;
     const stored = parseStored(JSON.parse(readFileSync15(path, "utf8")));
     if (!stored)
@@ -21577,10 +21727,10 @@ function writePause(opts) {
 }
 function clearPause(sessionId) {
   const path = pauseFilePath(sessionId);
-  if (!existsSync19(path))
+  if (!existsSync20(path))
     return false;
   try {
-    rmSync4(path);
+    rmSync5(path);
     return true;
   } catch {
     return false;
@@ -21588,7 +21738,7 @@ function clearPause(sessionId) {
 }
 function listActivePauses(now = Date.now()) {
   const dir = pauseStateDir();
-  if (!existsSync19(dir))
+  if (!existsSync20(dir))
     return [];
   const out = [];
   let names;
@@ -21642,12 +21792,12 @@ var init_session_pause = __esm(() => {
 import { createHash as createHash7 } from "node:crypto";
 import {
   chmodSync as chmodSync3,
-  existsSync as existsSync20,
+  existsSync as existsSync21,
   mkdirSync as mkdirSync10,
   readdirSync as readdirSync14,
   readFileSync as readFileSync16,
-  renameSync as renameSync5,
-  rmSync as rmSync5,
+  renameSync as renameSync6,
+  rmSync as rmSync6,
   statSync as statSync16,
   writeFileSync as writeFileSync8
 } from "node:fs";
@@ -21694,7 +21844,7 @@ function platformPackageBinary(dir) {
     return null;
   }
   const candidate = resolve17(dir, "bin", "failproofaid");
-  return existsSync20(candidate) ? candidate : null;
+  return existsSync21(candidate) ? candidate : null;
 }
 function pruneOldDaemonBinaries(keep = 2) {
   const removed = [];
@@ -21706,7 +21856,7 @@ function pruneOldDaemonBinaries(keep = 2) {
     }).sort((a, b) => b.mtime - a.mtime);
     for (const stale of entries.slice(keep)) {
       try {
-        rmSync5(stale.full, { force: true });
+        rmSync6(stale.full, { force: true });
         removed.push(stale.full);
       } catch {}
     }
@@ -21720,10 +21870,10 @@ function installBinaryBytes(binary) {
     mkdirSync10(daemonBinaryDir(), { recursive: true });
     writeFileSync8(tempPath, binary);
     chmodSync3(tempPath, 493);
-    renameSync5(tempPath, target);
+    renameSync6(tempPath, target);
     return target;
   } catch (err) {
-    rmSync5(tempPath, { force: true });
+    rmSync6(tempPath, { force: true });
     throw err;
   }
 }
@@ -21772,7 +21922,7 @@ function digestFor2(manifest, assetName) {
 }
 async function downloadFailproofaidBinary(key) {
   const target = installedBinaryPath();
-  if (existsSync20(target))
+  if (existsSync21(target))
     return { path: target };
   if (process.env.FAILPROOFAI_NO_DOWNLOAD) {
     return { error: "daemon downloads are disabled (FAILPROOFAI_NO_DOWNLOAD)" };
@@ -21806,10 +21956,10 @@ var init_daemon_download = __esm(() => {
 
 // src/hooks/daemon-client.ts
 import { createConnection as createConnection2 } from "node:net";
-import { existsSync as existsSync21 } from "node:fs";
+import { existsSync as existsSync22 } from "node:fs";
 function daemonSocketPresent() {
   try {
-    return existsSync21(socketPath2());
+    return existsSync22(socketPath2());
   } catch {
     return false;
   }
@@ -21935,13 +22085,13 @@ var init_daemon_client2 = __esm(() => {
 
 // src/hooks/daemon-service.ts
 import {
-  existsSync as existsSync22,
+  existsSync as existsSync23,
   mkdirSync as mkdirSync11,
   mkdtempSync,
   readFileSync as readFileSync17,
   writeFileSync as writeFileSync9,
   unlinkSync as unlinkSync3,
-  rmSync as rmSync6
+  rmSync as rmSync7
 } from "node:fs";
 import { homedir as homedir22, tmpdir as tmpdir2, userInfo } from "node:os";
 import { resolve as resolve18 } from "node:path";
@@ -21966,13 +22116,13 @@ function resolveFailproofaidBinaryPath() {
   if (process.env.FAILPROOFAI_DAEMON_BINARY)
     return process.env.FAILPROOFAI_DAEMON_BINARY;
   const downloaded = installedBinaryPath();
-  if (existsSync22(downloaded))
+  if (existsSync23(downloaded))
     return downloaded;
   const packageRoot = process.env.FAILPROOFAI_PACKAGE_ROOT;
   if (packageRoot) {
     for (const profile of ["release", "debug"]) {
       const candidate = resolve18(packageRoot, "target", profile, "failproofaid");
-      if (existsSync22(candidate))
+      if (existsSync23(candidate))
         return candidate;
     }
   }
@@ -22003,7 +22153,7 @@ function resolveWorkerCommand() {
   if (!packageRoot)
     return null;
   const workerScript = resolve18(packageRoot, "dist", "worker.mjs");
-  if (!existsSync22(workerScript))
+  if (!existsSync23(workerScript))
     return null;
   return `${shellQuote(process.execPath)} ${shellQuote(workerScript)}`;
 }
@@ -22014,7 +22164,7 @@ function resolveCliCommand() {
   if (!packageRoot)
     return null;
   const cliScript = resolve18(packageRoot, "dist", "cli.mjs");
-  if (!existsSync22(cliScript))
+  if (!existsSync23(cliScript))
     return null;
   return `${shellQuote(process.execPath)} ${shellQuote(cliScript)}`;
 }
@@ -22028,7 +22178,7 @@ function workerScriptPath() {
   if (!packageRoot)
     return null;
   const workerScript = resolve18(packageRoot, "dist", "worker.mjs");
-  return existsSync22(workerScript) ? workerScript : null;
+  return existsSync23(workerScript) ? workerScript : null;
 }
 function assertUnitSafe(value, field) {
   if (UNIT_UNSAFE_RE.test(value)) {
@@ -22120,14 +22270,14 @@ function writePrivilegedFile(destination, contents, mode = "0644") {
     writeFileSync9(staging, contents, "utf8");
     runPrivileged("install", ["-m", mode, staging, destination]);
   } finally {
-    rmSync6(stagingDir, { recursive: true, force: true });
+    rmSync7(stagingDir, { recursive: true, force: true });
   }
 }
 function removeLegacyUserService() {
   try {
     if (process.platform === "linux") {
       const legacy = legacySystemdUserUnitPath();
-      if (!existsSync22(legacy))
+      if (!existsSync23(legacy))
         return;
       try {
         execFileSync2("systemctl", ["--user", "disable", "--now", "failproofaid.service"], {
@@ -22144,7 +22294,7 @@ function removeLegacyUserService() {
       } catch {}
     } else {
       const legacyAgent = legacyLaunchAgentPlistPath();
-      if (existsSync22(legacyAgent)) {
+      if (existsSync23(legacyAgent)) {
         try {
           execFileSync2("launchctl", ["unload", "-w", legacyAgent], {
             stdio: "ignore",
@@ -22154,7 +22304,7 @@ function removeLegacyUserService() {
         unlinkSync3(legacyAgent);
       }
       const legacyDaemon = legacySharedLaunchDaemonPath();
-      if (existsSync22(legacyDaemon)) {
+      if (existsSync23(legacyDaemon)) {
         try {
           runPrivileged("launchctl", ["unload", "-w", legacyDaemon]);
         } catch {}
@@ -22171,7 +22321,7 @@ function systemdUnitContents(binaryPath, workerCmd, cliCmd = null) {
   const user = assertUnitSafe(serviceUser(), "User");
   assertUnitSafe(binaryPath, "ExecStart");
   assertUnitSafe(homedir22(), "HOME");
-  const conditionPaths = [binaryPath, workerScriptPath()].filter((p) => typeof p === "string" && existsSync22(p));
+  const conditionPaths = [binaryPath, workerScriptPath()].filter((p) => typeof p === "string" && existsSync23(p));
   const conditionLines = conditionPaths.map((p) => `ConditionPathExists=${assertUnitSafe(p, "ConditionPathExists")}
 `).join("");
   return `[Unit]
@@ -22366,7 +22516,7 @@ function readInstalledServiceDefinition() {
   if (!isDaemonSupportedPlatform())
     return null;
   const path = daemonServiceFilePath();
-  if (!path || !existsSync22(path))
+  if (!path || !existsSync23(path))
     return null;
   try {
     return readFileSync17(path, "utf8");
@@ -22502,7 +22652,7 @@ async function uninstallDaemonService() {
   try {
     if (process.platform === "linux") {
       const unitPath = systemdUnitPath();
-      if (!existsSync22(unitPath))
+      if (!existsSync23(unitPath))
         return;
       try {
         runPrivileged("systemctl", ["disable", "--now", systemdUnitName()]);
@@ -22513,7 +22663,7 @@ async function uninstallDaemonService() {
       } catch {}
     } else {
       const plistPath = launchdPlistPath();
-      if (!existsSync22(plistPath))
+      if (!existsSync23(plistPath))
         return;
       try {
         runPrivileged("launchctl", ["unload", "-w", plistPath]);
@@ -22530,7 +22680,7 @@ function daemonVersionSkew() {
   const recorded = readVersionFile()?.daemon;
   if (!recorded)
     return null;
-  if (!existsSync22(installedBinaryPath(recorded)))
+  if (!existsSync23(installedBinaryPath(recorded)))
     return null;
   return recorded === version2 ? null : { installed: recorded, expected: version2 };
 }
@@ -22548,7 +22698,7 @@ function daemonServiceStatus() {
   if (!isDaemonSupportedPlatform())
     return "unsupported-platform";
   if (process.platform === "linux") {
-    if (!existsSync22(systemdUnitPath()))
+    if (!existsSync23(systemdUnitPath()))
       return "not-installed";
     try {
       const out = execFileSync2("systemctl", ["is-active", systemdUnitName()], {
@@ -22561,7 +22711,7 @@ function daemonServiceStatus() {
     }
   }
   const plistPath = launchdPlistPath();
-  if (!existsSync22(plistPath))
+  if (!existsSync23(plistPath))
     return "not-installed";
   try {
     const root = typeof process.getuid === "function" && process.getuid() === 0;
@@ -22593,12 +22743,12 @@ var init_daemon_service = __esm(() => {
 // src/hooks/fp-reset.ts
 import {
   copyFileSync,
-  existsSync as existsSync23,
+  existsSync as existsSync24,
   mkdirSync as mkdirSync12,
   readFileSync as readFileSync18,
   readdirSync as readdirSync15,
-  renameSync as renameSync6,
-  rmSync as rmSync7,
+  renameSync as renameSync7,
+  rmSync as rmSync8,
   rmdirSync,
   statSync as statSync17,
   writeFileSync as writeFileSync10
@@ -22606,7 +22756,7 @@ import {
 import { dirname as dirname11, isAbsolute as isAbsolute3, relative as relative4, resolve as resolve19 } from "node:path";
 function migrateConventionPolicies() {
   const from = legacy.customPoliciesDir();
-  if (!existsSync23(from))
+  if (!existsSync24(from))
     return [];
   const moved = [];
   const mergeInto = (dir, dest, prefix) => {
@@ -22627,9 +22777,9 @@ function migrateConventionPolicies() {
       const source = resolve19(dir, entry.name);
       const target = resolve19(dest, entry.name);
       const name = `${prefix}${entry.name}`;
-      if (!existsSync23(target)) {
+      if (!existsSync24(target)) {
         try {
-          renameSync6(source, target);
+          renameSync7(source, target);
           moved.push(name);
         } catch {}
         continue;
@@ -22654,7 +22804,7 @@ function migrateLegacySpool() {
     [legacy.spoolDir(), spoolDir()],
     [legacy.failedDir(), failedDir()]
   ]) {
-    if (!existsSync23(from))
+    if (!existsSync24(from))
       continue;
     try {
       mkdirSync12(to, { recursive: true });
@@ -22663,10 +22813,10 @@ function migrateLegacySpool() {
           continue;
         let name = entry.name;
         let n = 0;
-        while (existsSync23(resolve19(to, name)))
+        while (existsSync24(resolve19(to, name)))
           name = `legacy-${n++}-${entry.name}`;
         try {
-          renameSync6(resolve19(from, entry.name), resolve19(to, name));
+          renameSync7(resolve19(from, entry.name), resolve19(to, name));
           moved.push(name);
         } catch {
           try {
@@ -22681,7 +22831,7 @@ function migrateLegacySpool() {
 }
 function migrateHookActivity() {
   const from = legacy.hookActivityDir();
-  if (!existsSync23(from))
+  if (!existsSync24(from))
     return [];
   const moved = [];
   try {
@@ -22696,12 +22846,12 @@ function migrateHookActivity() {
       const source = resolve19(from, entry.name);
       let name = entry.name === "current.jsonl" ? `page-${stamp}-${seq++}.jsonl` : entry.name;
       let target = resolve19(to, name);
-      while (existsSync23(target)) {
+      while (existsSync24(target)) {
         name = `page-${stamp}-${seq++}.jsonl`;
         target = resolve19(to, name);
       }
       try {
-        renameSync6(source, target);
+        renameSync7(source, target);
         moved.push(name);
       } catch {
         try {
@@ -22736,7 +22886,7 @@ function retirePolicyConfigKeys() {
     delete parsed[key];
   try {
     if (Object.keys(parsed).length === 0)
-      rmSync7(at, { force: true });
+      rmSync8(at, { force: true });
     else
       writeFileSync10(at, JSON.stringify(parsed, null, 2) + `
 `, "utf8");
@@ -22747,7 +22897,7 @@ function retirePolicyConfigKeys() {
 }
 function readCarriedPolicyConfig() {
   const from = resolve19(legacy.localPoliciesDir(), "policies-config.json");
-  if (!existsSync23(from))
+  if (!existsSync24(from))
     return null;
   let parsed;
   try {
@@ -22811,7 +22961,7 @@ function writeCarriedPolicyConfig(carried) {
 }
 function readCarriedTelemetryOptOut() {
   const from = legacy.configToml();
-  if (!existsSync23(from))
+  if (!existsSync24(from))
     return false;
   try {
     const text = readFileSync18(from, "utf8");
@@ -22866,7 +23016,7 @@ function parseLegacyToml(text) {
 }
 function readCarriedLegacyConfig() {
   const from = legacy.configToml();
-  if (!existsSync23(from))
+  if (!existsSync24(from))
     return null;
   try {
     return projectConfig(parseLegacyToml(readFileSync18(from, "utf8")));
@@ -22876,7 +23026,7 @@ function readCarriedLegacyConfig() {
 }
 function readCarriedLegacyCredentials() {
   const toml = legacy.credentialsToml();
-  if (existsSync23(toml)) {
+  if (existsSync24(toml)) {
     try {
       const creds = projectCredentials(parseLegacyToml(readFileSync18(toml, "utf8")));
       if (Object.keys(creds).length > 0)
@@ -22919,10 +23069,10 @@ function resetHome(from, to = LAYOUT_VERSION) {
   const spooled = migrateLegacySpool();
   const removed = [];
   for (const path of resettablePaths()) {
-    if (!existsSync23(path))
+    if (!existsSync24(path))
       continue;
     try {
-      rmSync7(path, { recursive: true, force: true });
+      rmSync8(path, { recursive: true, force: true });
       removed.push(path);
     } catch {}
   }
@@ -22944,7 +23094,7 @@ function layoutWarningForHook() {
   if (state.kind === "future") {
     return `[failproofai] this directory was written by a newer version (layout ${state.found} vs ${LAYOUT_VERSION}) — policies are NOT being enforced. ` + `Upgrade failproofai.`;
   }
-  if (existsSync23(globalPolicyConfigFile()))
+  if (existsSync24(globalPolicyConfigFile()))
     return null;
   return `[failproofai] setup predates this version — global policies are NOT being enforced. ` + `Run \`failproofai config\` to re-create it.`;
 }
@@ -23293,7 +23443,20 @@ async function evaluateHookEvent(eventType, cli = "claude", stdinPayload, opts)
         }
       } catch {}
     }
-    return { exitCode: result.exitCode, stdout: result.stdout, stderr: result.stderr };
+    return {
+      exitCode: result.exitCode,
+      stdout: result.stdout,
+      stderr: result.stderr,
+      evaluation: {
+        decision: result.decision,
+        policyName: result.policyName,
+        policyNames: result.policyNames ?? (result.policyName ? [result.policyName] : []),
+        reason: result.reason,
+        matchedPolicies,
+        durationMs,
+        toolName: parsed.tool_name ?? null
+      }
+    };
   } finally {
     if (opts?.awaitTelemetryFlush ?? true) {
       await flushHookTelemetry2();
@@ -23992,14 +24155,14 @@ var init_collector_config = __esm(() => {
 });
 
 // src/hooks/flush-cli.ts
-import { existsSync as existsSync24, mkdirSync as mkdirSync13, writeFileSync as writeFileSync11, readdirSync as readdirSync16 } from "node:fs";
+import { existsSync as existsSync25, mkdirSync as mkdirSync13, writeFileSync as writeFileSync11, readdirSync as readdirSync16 } from "node:fs";
 import { dirname as dirname12, join as join31 } from "node:path";
 function flushRequestPath(home) {
   return join31(failproofaiHome(home), "state", "flush-request.json");
 }
 function spoolDirs(home) {
   const root = spoolDir(home);
-  if (!existsSync24(root))
+  if (!existsSync25(root))
     return [];
   try {
     return readdirSync16(root, { withFileTypes: true }).filter((e) => e.isDirectory() && e.name !== "failed").map((e) => join31(root, e.name));
@@ -24103,11 +24266,11 @@ var init_flush_cli = __esm(() => {
 import {
   chmodSync as chmodSync4,
   copyFileSync as copyFileSync2,
-  existsSync as existsSync25,
+  existsSync as existsSync26,
   mkdirSync as mkdirSync14,
   readFileSync as readFileSync19,
-  renameSync as renameSync7,
-  rmSync as rmSync8,
+  renameSync as renameSync8,
+  rmSync as rmSync9,
   writeFileSync as writeFileSync12
 } from "node:fs";
 import { basename as basename5, dirname as dirname13, join as join32, resolve as resolve20 } from "node:path";
@@ -24126,30 +24289,30 @@ function migrateToLayout4() {
   }
   const migrated = [];
   for (const { from, to } of moves) {
-    if (!existsSync25(from))
+    if (!existsSync26(from))
       continue;
-    if (existsSync25(to)) {
-      rmSync8(from, { force: true });
+    if (existsSync26(to)) {
+      rmSync9(from, { force: true });
       continue;
     }
     mkdirSync14(dirname13(to), { recursive: true });
     try {
-      renameSync7(from, to);
+      renameSync8(from, to);
     } catch {
       try {
         copyFileSync2(from, to);
       } catch (err) {
         try {
-          rmSync8(to, { force: true });
+          rmSync9(to, { force: true });
         } catch {}
         throw err;
       }
-      rmSync8(from, { force: true });
+      rmSync9(from, { force: true });
     }
     migrated.push(`${basename5(from)} → audit/${basename5(to)}`);
   }
   for (const secret of [auditSessionFile()]) {
-    if (!existsSync25(secret))
+    if (!existsSync26(secret))
       continue;
     try {
       chmodSync4(secret, 384);
@@ -24197,12 +24360,12 @@ function pruneMigratedCredentials(from) {
   for (let layout = from;layout < LAYOUT_VERSION; layout++) {
     for (const { as, landsAt } of PRUNED_AFTER_SUCCESS) {
       try {
-        if (!existsSync25(landsAt()))
+        if (!existsSync26(landsAt()))
           continue;
         const copy = resolve20(migrationBackupDir(layout), as);
-        if (!existsSync25(copy))
+        if (!existsSync26(copy))
           continue;
-        rmSync8(copy, { force: true });
+        rmSync9(copy, { force: true });
         pruned.push(as);
       } catch {}
     }
@@ -24213,7 +24376,7 @@ function filesToBackUp() {
   const seen = new Map;
   for (const f of [...BACKED_UP, ...BACKED_UP_LEGACY]) {
     const path = f.at();
-    if (existsSync25(path))
+    if (existsSync26(path))
       seen.set(path, backupNameOf(f));
   }
   return [...seen].map(([path, as]) => ({ path, as }));
@@ -24222,7 +24385,7 @@ function backupBeforeMigrating(from) {
   const dir = migrationBackupDir(from);
   const saved = [];
   try {
-    rmSync8(dir, { recursive: true, force: true });
+    rmSync9(dir, { recursive: true, force: true });
     mkdirSync14(dir, { recursive: true });
   } catch {
     return [];
@@ -24603,7 +24766,7 @@ var NAMESPACE3 = "failproofai-telemetry-v1", API_KEY3 = "phc_Ac1Ww1GqKc0z1SyrRWb
 var init_install_telemetry = () => {};
 
 // lib/install-check.ts
-import { existsSync as existsSync26, readFileSync as readFileSync21, writeFileSync as writeFileSync14, mkdirSync as mkdirSync16 } from "node:fs";
+import { existsSync as existsSync27, readFileSync as readFileSync21, writeFileSync as writeFileSync14, mkdirSync as mkdirSync16 } from "node:fs";
 import { dirname as dirname14, resolve as resolve21 } from "node:path";
 import { platform as platform2, arch as arch2, release, homedir as homedir24, hostname as hostname2 } from "node:os";
 import { createHmac as createHmac2 } from "node:crypto";
@@ -24659,7 +24822,7 @@ function compareSemver(a, b) {
 }
 function checkHooks() {
   const hooksConfigPath = globalPolicyConfigFile();
-  if (!existsSync26(hooksConfigPath)) {
+  if (!existsSync27(hooksConfigPath)) {
     return { configured: false, registered: false, policyCount: 0 };
   }
   let config;
@@ -24673,7 +24836,7 @@ function checkHooks() {
   }
   const policyCount = config.enabledPolicies.length;
   const settingsPath = resolve21(homedir24(), ".claude", "settings.json");
-  if (!existsSync26(settingsPath))
+  if (!existsSync27(settingsPath))
     return { configured: true, registered: false, policyCount };
   let settings;
   try {
@@ -24701,7 +24864,7 @@ async function maybeReportInstall(version) {
     const versionFile = lastVersionPath();
     let previousVersion = null;
     try {
-      if (existsSync26(versionFile)) {
+      if (existsSync27(versionFile)) {
         previousVersion = readFileSync21(versionFile, "utf8").trim() || null;
       }
     } catch {}
@@ -24789,7 +24952,7 @@ var init_cli_error = __esm(() => {
 
 // src/hooks/manager.ts
 import { execSync as execSync6 } from "node:child_process";
-import { existsSync as existsSync27 } from "node:fs";
+import { existsSync as existsSync28 } from "node:fs";
 import { resolve as resolve22, basename as basename6 } from "node:path";
 import { platform as platform3, arch as arch3, release as release2, hostname as hostname3 } from "node:os";
 function getSettingsPath(scope, cwd) {
@@ -24976,8 +25139,11 @@ async function installHooksImpl(policyNames, scope = "user", cwd, includeBeta =
     }
   }
   const selectedClis = cli && cli.length > 0 ? [...new Set(cli)] : ["claude"];
-  for (const cliId of selectedClis) {
-    const integration = getIntegration(cliId);
+  const selectedIntegrations = selectedClis.map((cliId) => ({
+    cliId,
+    integration: getIntegration(cliId)
+  }));
+  for (const { cliId, integration } of selectedIntegrations) {
     if (!integration.scopes.includes(scope)) {
       try {
         await trackHookEvent2(getInstanceId2(), "scope_validation_failed", {
@@ -24989,6 +25155,13 @@ async function installHooksImpl(policyNames, scope = "user", cwd, includeBeta =
       throw new CliError(`Scope "${scope}" is not supported by ${integration.displayName}. ` + `Valid scopes: ${integration.scopes.join(", ")}`);
     }
   }
+  const daemonRequiredBy = selectedIntegrations.map(({ integration }) => integration).filter((integration) => integration.requiresHealthyDaemon);
+  if (daemonRequiredBy.length > 0 && !await probeDaemonEndToEnd()) {
+    const names = daemonRequiredBy.map((integration) => integration.displayName).join(", ");
+    const verb = daemonRequiredBy.length === 1 ? "requires" : "require";
+    throw new CliError(`${names} ${verb} a healthy failproofaid daemon before FailproofAI enforcement can be enabled.
+` + "Run `failproofai config` to install and configure the daemon, then retry.");
+  }
   const binaryPath = resolveFailproofaiBinary();
   const previousConfig = readScopedHooksConfig(scope, cwd);
   const previousEnabled = new Set(previousConfig.enabledPolicies);
@@ -25011,7 +25184,7 @@ async function installHooksImpl(policyNames, scope = "user", cwd, includeBeta =
   } else if (customPoliciesPath && (typeof customPoliciesPath === "string" || customPoliciesPath.length > 0)) {
     const incoming = (typeof customPoliciesPath === "string" ? [customPoliciesPath] : customPoliciesPath).map((path) => resolve22(path));
     const carried = (previousConfig.customPoliciesPaths ?? (previousConfig.customPoliciesPath ? [previousConfig.customPoliciesPath] : [])).map((path) => resolve22(path)).filter((path) => {
-      if (existsSync27(path))
+      if (existsSync28(path))
         return true;
       console.log(`Dropping custom policies path (file no longer exists): ${path}`);
       return false;
@@ -25087,6 +25260,7 @@ Enabled ${selectedPolicies.length} policy(ies): ${selectedPolicies.join(", ")}
     const settingsPaths = settingsPathsFor(integration, scope, cwd);
     try {
       for (const settingsPath of settingsPaths) {
+        integration.prepareInstall?.(settingsPath);
         const settings = integration.readSettings(settingsPath);
         integration.writeHookEntries(settings, binaryPath, scope);
         integration.writeSettings(settingsPath, settings);
@@ -25143,7 +25317,11 @@ Enabled ${selectedPolicies.length} policy(ies): ${selectedPolicies.join(", ")}
   } catch {}
   for (const { cli: cliId, path } of writtenSettingsPaths) {
     const integration = getIntegration(cliId);
-    console.log(`Failproof AI hooks installed for ${integration.displayName} ` + `(${integration.eventTypes.length} event types, scope: ${scope}).`);
+    if (cliId === "hermes") {
+      console.log(`Failproof AI native plugin installed for ${integration.displayName} ` + `(8 registered hooks, scope: ${scope}).`);
+    } else {
+      console.log(`Failproof AI hooks installed for ${integration.displayName} ` + `(${integration.eventTypes.length} event types, scope: ${scope}).`);
+    }
     console.log(`Settings: ${path}`);
   }
   if (scope === "project") {
@@ -25234,7 +25412,7 @@ async function removeHooks(policyNames, scope = "user", cwd, opts) {
     const scopesToRemove = scope === "all" ? [...integration.scopes] : integration.scopes.includes(scope) ? [scope] : [];
     for (const s of scopesToRemove) {
       const settingsPaths = settingsPathsFor(integration, s, cwd);
-      const existing = settingsPaths.filter((p) => existsSync27(p));
+      const existing = cliId === "hermes" ? settingsPaths : settingsPaths.filter((p) => existsSync28(p));
       if (existing.length === 0) {
         if (scope !== "all" && selectedClis.length === 1) {
           console.log("No settings file found. Nothing to remove.");
@@ -25317,6 +25495,7 @@ var init_manager = __esm(() => {
   init_pack_store();
   init_pack_manifest();
   init_policy_evaluator();
+  init_daemon_service();
   init_tui();
   VALID_POLICY_NAMES = new Set(BUILTIN_POLICIES.map((p) => p.name));
 });
@@ -25337,7 +25516,7 @@ var DEFAULT_FETCH_TIMEOUT_MS = 15000;
 
 // src/hooks/cloud-enrollment.ts
 import { randomUUID as randomUUID3 } from "node:crypto";
-import { existsSync as existsSync28, readFileSync as readFileSync22, rmSync as rmSync9 } from "node:fs";
+import { existsSync as existsSync29, readFileSync as readFileSync22, rmSync as rmSync10 } from "node:fs";
 import { hostname as hostname4 } from "node:os";
 function cloudCredentialPath() {
   return process.env.FAILPROOFAI_CLOUD_CREDENTIALS ?? credentialsFile();
@@ -25376,7 +25555,7 @@ function readCloudCredentials() {
   if (!usingJsonOverride())
     return readCredentials().cloud ?? null;
   const path = cloudCredentialPath();
-  if (!existsSync28(path))
+  if (!existsSync29(path))
     return null;
   try {
     const raw = JSON.parse(readFileSync22(path, "utf8"));
@@ -25418,10 +25597,10 @@ function resolveMachineLabel(explicit) {
 function clearCloudCredentials() {
   if (usingJsonOverride()) {
     const path = cloudCredentialPath();
-    if (!existsSync28(path))
+    if (!existsSync29(path))
       return false;
     try {
-      rmSync9(path);
+      rmSync10(path);
       return true;
     } catch {
       return false;
@@ -25669,7 +25848,7 @@ var init_cloud_connection = __esm(() => {
 });
 
 // src/hooks/setup-state.ts
-import { existsSync as existsSync29, realpathSync as realpathSync2, statSync as statSync18 } from "node:fs";
+import { existsSync as existsSync30, realpathSync as realpathSync2, statSync as statSync18 } from "node:fs";
 import { dirname as dirname15, resolve as resolve23 } from "node:path";
 import { homedir as homedir25 } from "node:os";
 function globalConfigPath(home = homedir25()) {
@@ -25726,10 +25905,10 @@ function detectSetupState(cwd = process.cwd(), home = homedir25()) {
     cwd: resolvedCwd,
     home: resolvedHome,
     projectRoot,
-    hasGlobalConfig: existsSync29(globalConfigPath(resolvedHome)),
-    hasProjectConfig: projectRoot !== resolvedHome && existsSync29(projectConfigPath(projectRoot)),
+    hasGlobalConfig: existsSync30(globalConfigPath(resolvedHome)),
+    hasProjectConfig: projectRoot !== resolvedHome && existsSync30(projectConfigPath(projectRoot)),
     hasGlobalHooks: hasGlobalHooksInstalled(),
-    hasLegacyMarker: existsSync29(legacyMarkerPath(resolvedHome)),
+    hasLegacyMarker: existsSync30(legacyMarkerPath(resolvedHome)),
     inHomeDir: resolvedCwd === resolvedHome
   };
 }
@@ -25746,11 +25925,11 @@ var init_setup_state = __esm(() => {
 });
 
 // src/hooks/onboarding-attempt.ts
-import { existsSync as existsSync30, mkdirSync as mkdirSync17, readFileSync as readFileSync23, rmSync as rmSync10, writeFileSync as writeFileSync15 } from "node:fs";
+import { existsSync as existsSync31, mkdirSync as mkdirSync17, readFileSync as readFileSync23, rmSync as rmSync11, writeFileSync as writeFileSync15 } from "node:fs";
 import { dirname as dirname16 } from "node:path";
 function readOnboardingAttempt() {
   const path = onboardingAttemptFile();
-  if (!existsSync30(path))
+  if (!existsSync31(path))
     return null;
   try {
     const raw = JSON.parse(readFileSync23(path, "utf8"));
@@ -25785,7 +25964,7 @@ function recordOnboardingAttempt(reason, cliVersion, daemonStatus, now = Date.no
 }
 function clearOnboardingAttempt() {
   try {
-    rmSync10(onboardingAttemptFile(), { force: true });
+    rmSync11(onboardingAttemptFile(), { force: true });
   } catch {}
 }
 function blockerCleared(attempt, probe) {
@@ -25827,7 +26006,7 @@ var init_onboarding_attempt = __esm(() => {
 });
 
 // src/hooks/onboarding-lock.ts
-import { mkdirSync as mkdirSync18, readFileSync as readFileSync24, rmSync as rmSync11, writeFileSync as writeFileSync16 } from "node:fs";
+import { mkdirSync as mkdirSync18, readFileSync as readFileSync24, rmSync as rmSync12, writeFileSync as writeFileSync16 } from "node:fs";
 import { homedir as homedir26 } from "node:os";
 function onboardingLockPath(home = homedir26()) {
   return onboardingLockFile(home);
@@ -25870,7 +26049,7 @@ function acquireOnboardingLock(home = homedir26()) {
         try {
           const current = readLock(path);
           if (!current || current.pid === process.pid)
-            rmSync11(path, { force: true });
+            rmSync12(path, { force: true });
         } catch {}
       }
     };
@@ -25883,7 +26062,7 @@ var init_onboarding_lock = __esm(() => {
 });
 
 // lib/claude-sessions.ts
-import { readdirSync as readdirSync17, statSync as statSync19, existsSync as existsSync31 } from "node:fs";
+import { readdirSync as readdirSync17, statSync as statSync19, existsSync as existsSync32 } from "node:fs";
 import { join as join34, basename as basename7 } from "node:path";
 function getClaudeProjectsRoot() {
   return getClaudeProjectsPath();
@@ -25930,7 +26109,7 @@ function listClaudeTranscripts(project) {
       } catch {}
     } else if (entry.isDirectory() && UUID_RE2.test(entry.name)) {
       const subDir = join34(project.path, entry.name, "subagents");
-      if (!existsSync31(subDir))
+      if (!existsSync32(subDir))
         continue;
       let subEntries;
       try {
@@ -27273,7 +27452,7 @@ var init_features = __esm(() => {
 
 // src/audit/cache.ts
 import { createHash as createHash8 } from "node:crypto";
-import { existsSync as existsSync32, mkdirSync as mkdirSync19, readFileSync as readFileSync25, writeFileSync as writeFileSync17, chmodSync as chmodSync5, openSync, readSync, closeSync } from "node:fs";
+import { existsSync as existsSync33, mkdirSync as mkdirSync19, readFileSync as readFileSync25, writeFileSync as writeFileSync17, chmodSync as chmodSync5, openSync, readSync, closeSync } from "node:fs";
 import { join as join35 } from "node:path";
 function getEngineVersion() {
   if (cachedEngineVersion)
@@ -27334,7 +27513,7 @@ function readCachedTranscript(transcriptPath, mtimeMs, sizeBytes) {
   if (sizeBytes === 0)
     return null;
   const cachePath = getCachePathFor(transcriptPath);
-  if (!existsSync32(cachePath))
+  if (!existsSync33(cachePath))
     return null;
   try {
     const raw = readFileSync25(cachePath, "utf-8");
@@ -27954,7 +28133,7 @@ var init_audit_lock = __esm(() => {
 });
 
 // src/audit/dashboard-cache.ts
-import { existsSync as existsSync33, readFileSync as readFileSync27 } from "node:fs";
+import { existsSync as existsSync34, readFileSync as readFileSync27 } from "node:fs";
 function getCachePath() {
   return auditDashboardFile();
 }
@@ -27974,7 +28153,7 @@ function writeDashboardCache(params, result) {
 }
 function readDashboardCacheMeta() {
   const cachePath = getCachePath();
-  if (!existsSync33(cachePath))
+  if (!existsSync34(cachePath))
     return null;
   try {
     const raw = readFileSync27(cachePath, "utf-8");
@@ -28201,7 +28380,7 @@ var init_api_server_client = __esm(() => {
 });
 
 // lib/auth/auth-store.ts
-import { existsSync as existsSync34, readFileSync as readFileSync28, readdirSync as readdirSync18, rmSync as rmSync12 } from "node:fs";
+import { existsSync as existsSync35, readFileSync as readFileSync28, readdirSync as readdirSync18, rmSync as rmSync13 } from "node:fs";
 import { join as join36, resolve as resolve24 } from "node:path";
 function getAuthFilePath() {
   const override = process.env.FAILPROOFAI_AUTH_DIR;
@@ -28209,7 +28388,7 @@ function getAuthFilePath() {
 }
 function readAuth() {
   const p = getAuthFilePath();
-  if (!existsSync34(p))
+  if (!existsSync35(p))
     return null;
   try {
     const raw = readFileSync28(p, "utf-8");
@@ -28236,18 +28415,18 @@ function writeAuth(auth) {
 }
 function deleteAuth() {
   const p = getAuthFilePath();
-  if (existsSync34(p))
-    rmSync12(p, { force: true });
+  if (existsSync35(p))
+    rmSync13(p, { force: true });
   try {
     const root = migrationsDir();
-    if (!existsSync34(root))
+    if (!existsSync35(root))
       return;
     for (const entry of readdirSync18(root)) {
       if (!entry.startsWith("backup-layout"))
         continue;
       const copy = resolve24(root, entry, "auth.json");
-      if (existsSync34(copy))
-        rmSync12(copy, { force: true });
+      if (existsSync35(copy))
+        rmSync13(copy, { force: true });
     }
   } catch {}
 }
@@ -28497,12 +28676,12 @@ var init_harm_report = __esm(() => {
 });
 
 // src/audit/machine-store.ts
-import { existsSync as existsSync35, readFileSync as readFileSync29, rmSync as rmSync13 } from "node:fs";
+import { existsSync as existsSync36, readFileSync as readFileSync29, rmSync as rmSync14 } from "node:fs";
 import { hostname as hostname5 } from "node:os";
 import { randomUUID as randomUUID4 } from "node:crypto";
 function readMachineIdentity(home) {
   const path = auditMachineFile(home);
-  if (!existsSync35(path))
+  if (!existsSync36(path))
     return null;
   try {
     const parsed = JSON.parse(readFileSync29(path, "utf8"));
@@ -28827,7 +29006,7 @@ var init_cli = __esm(() => {
 });
 
 // src/hooks/configure-wizard.ts
-import { existsSync as existsSync36, mkdirSync as mkdirSync21, writeFileSync as writeFileSync19, readFileSync as readFileSync30 } from "node:fs";
+import { existsSync as existsSync37, mkdirSync as mkdirSync21, writeFileSync as writeFileSync19, readFileSync as readFileSync30 } from "node:fs";
 import { homedir as homedir28 } from "node:os";
 import { dirname as dirname17, resolve as resolve25, sep as sep5 } from "node:path";
 async function emit(event, props) {
@@ -28852,7 +29031,7 @@ function setCustomPoliciesEnabled(scope, cwd, enabled) {
   const path = getConfigPathForScope(scope, cwd);
   let config = {};
   try {
-    if (existsSync36(path))
+    if (existsSync37(path))
       config = JSON.parse(readFileSync30(path, "utf8"));
   } catch {
     return;
@@ -29489,14 +29668,14 @@ var init_configure_wizard = __esm(() => {
 });
 
 // src/hooks/flush-cli.ts
-import { existsSync as existsSync37, mkdirSync as mkdirSync22, writeFileSync as writeFileSync20, readdirSync as readdirSync19 } from "node:fs";
+import { existsSync as existsSync38, mkdirSync as mkdirSync22, writeFileSync as writeFileSync20, readdirSync as readdirSync19 } from "node:fs";
 import { dirname as dirname18, join as join37 } from "node:path";
 function flushRequestPath2(home) {
   return join37(failproofaiHome(home), "state", "flush-request.json");
 }
 function spoolDirs2(home) {
   const root = spoolDir(home);
-  if (!existsSync37(root))
+  if (!existsSync38(root))
     return [];
   try {
     return readdirSync19(root, { withFileTypes: true }).filter((e) => e.isDirectory() && e.name !== "failed").map((e) => join37(root, e.name));
@@ -29597,7 +29776,7 @@ var init_flush_cli2 = __esm(() => {
 });
 
 // src/hooks/backfill-cli.ts
-import { existsSync as existsSync38, mkdirSync as mkdirSync23, writeFileSync as writeFileSync21, readdirSync as readdirSync20, statSync as statSync24 } from "node:fs";
+import { existsSync as existsSync39, mkdirSync as mkdirSync23, writeFileSync as writeFileSync21, readdirSync as readdirSync20, statSync as statSync24 } from "node:fs";
 import { dirname as dirname19, join as join38 } from "node:path";
 function backfillRequestPath(home) {
   return join38(failproofaiHome(home), "state", "backfill-request.json");
@@ -29606,7 +29785,7 @@ function surveySessions(sinceMs, homeDir) {
   const out = [];
   for (const { cli, dir } of SESSION_DIRS) {
     const root = join38(homeDir, dir);
-    if (!existsSync38(root))
+    if (!existsSync39(root))
       continue;
     let files = 0;
     let newest = 0;
@@ -29644,7 +29823,7 @@ function runBackfillCommand(opts = {}) {
   const now = opts.now ?? Date.now();
   const sinceMs = opts.sinceMs ?? now - DEFAULT_BACKFILL_DAYS * 24 * 60 * 60 * 1000;
   const home = failproofaiHome();
-  if (!existsSync38(home)) {
+  if (!existsSync39(home)) {
     return {
       exitCode: 1,
       lines: [`No failproofai home at ${home}. Run \`failproofai config\` first.`]
@@ -29975,7 +30154,7 @@ var init_harness_cli = __esm(() => {
 });
 
 // src/hooks/fp-config.ts
-import { chmodSync as chmodSync6, existsSync as existsSync39, mkdirSync as mkdirSync24, readFileSync as readFileSync31, statSync as statSync25, writeFileSync as writeFileSync22 } from "node:fs";
+import { chmodSync as chmodSync6, existsSync as existsSync40, mkdirSync as mkdirSync24, readFileSync as readFileSync31, statSync as statSync25, writeFileSync as writeFileSync22 } from "node:fs";
 function detectLayout2() {
   const raw = readVersionFile2();
   if (raw) {
@@ -29983,17 +30162,17 @@ function detectLayout2() {
       return { kind: "current", version: raw };
     return raw.layout > LAYOUT_VERSION ? { kind: "future", found: raw.layout } : { kind: "stale", found: raw.layout };
   }
-  if (existsSync39(configFile())) {
+  if (existsSync40(configFile())) {
     const layoutThreePositions = [
       legacy.authJson(),
       legacy.nextAudit(),
       legacy.auditSchedule()
     ];
-    if (layoutThreePositions.some((p) => existsSync39(p)))
+    if (layoutThreePositions.some((p) => existsSync40(p)))
       return { kind: "stale", found: 3 };
     return { kind: "current", version: { layout: LAYOUT_VERSION, cli: "" }, inferred: true };
   }
-  if (existsSync39(legacy.configToml()))
+  if (existsSync40(legacy.configToml()))
     return { kind: "stale", found: 2 };
   const layoutOneMarkers = [
     legacy.policyConfig(),
@@ -30004,7 +30183,7 @@ function detectLayout2() {
     legacy.ingestCredentials(),
     legacy.auditDashboard()
   ];
-  return layoutOneMarkers.some((p) => existsSync39(p)) ? { kind: "stale", found: 1 } : { kind: "absent" };
+  return layoutOneMarkers.some((p) => existsSync40(p)) ? { kind: "stale", found: 1 } : { kind: "absent" };
 }
 function readLegacyTomlVersion2(text) {
   const layout = Number(/^\s*layout\s*=\s*(\d+)\s*$/m.exec(text)?.[1]);
@@ -30047,11 +30226,11 @@ var init_fp_home2 = () => {};
 import {
   chmodSync as chmodSync7,
   copyFileSync as copyFileSync3,
-  existsSync as existsSync40,
+  existsSync as existsSync41,
   mkdirSync as mkdirSync25,
   readFileSync as readFileSync32,
-  renameSync as renameSync8,
-  rmSync as rmSync14,
+  renameSync as renameSync9,
+  rmSync as rmSync15,
   writeFileSync as writeFileSync23
 } from "node:fs";
 import { basename as basename8, dirname as dirname20, join as join39, resolve as resolve27 } from "node:path";
@@ -30070,30 +30249,30 @@ function migrateToLayout42() {
   }
   const migrated = [];
   for (const { from, to } of moves) {
-    if (!existsSync40(from))
+    if (!existsSync41(from))
       continue;
-    if (existsSync40(to)) {
-      rmSync14(from, { force: true });
+    if (existsSync41(to)) {
+      rmSync15(from, { force: true });
       continue;
     }
     mkdirSync25(dirname20(to), { recursive: true });
     try {
-      renameSync8(from, to);
+      renameSync9(from, to);
     } catch {
       try {
         copyFileSync3(from, to);
       } catch (err) {
         try {
-          rmSync14(to, { force: true });
+          rmSync15(to, { force: true });
         } catch {}
         throw err;
       }
-      rmSync14(from, { force: true });
+      rmSync15(from, { force: true });
     }
     migrated.push(`${basename8(from)} → audit/${basename8(to)}`);
   }
   for (const secret of [auditSessionFile()]) {
-    if (!existsSync40(secret))
+    if (!existsSync41(secret))
       continue;
     try {
       chmodSync7(secret, 384);
@@ -30141,12 +30320,12 @@ function pruneMigratedCredentials2(from) {
   for (let layout = from;layout < LAYOUT_VERSION; layout++) {
     for (const { as, landsAt } of PRUNED_AFTER_SUCCESS2) {
       try {
-        if (!existsSync40(landsAt()))
+        if (!existsSync41(landsAt()))
           continue;
         const copy = resolve27(migrationBackupDir(layout), as);
-        if (!existsSync40(copy))
+        if (!existsSync41(copy))
           continue;
-        rmSync14(copy, { force: true });
+        rmSync15(copy, { force: true });
         pruned.push(as);
       } catch {}
     }
@@ -30157,7 +30336,7 @@ function filesToBackUp2() {
   const seen = new Map;
   for (const f of [...BACKED_UP2, ...BACKED_UP_LEGACY2]) {
     const path = f.at();
-    if (existsSync40(path))
+    if (existsSync41(path))
       seen.set(path, backupNameOf2(f));
   }
   return [...seen].map(([path, as]) => ({ path, as }));
@@ -30166,7 +30345,7 @@ function backupBeforeMigrating2(from) {
   const dir = migrationBackupDir(from);
   const saved = [];
   try {
-    rmSync14(dir, { recursive: true, force: true });
+    rmSync15(dir, { recursive: true, force: true });
     mkdirSync25(dir, { recursive: true });
   } catch {
     return [];
@@ -30311,13 +30490,13 @@ var init_migrations2 = __esm(() => {
 
 // src/hooks/daemon-service.ts
 import {
-  existsSync as existsSync41,
+  existsSync as existsSync42,
   mkdirSync as mkdirSync26,
   mkdtempSync as mkdtempSync2,
   readFileSync as readFileSync33,
   writeFileSync as writeFileSync24,
   unlinkSync as unlinkSync5,
-  rmSync as rmSync15
+  rmSync as rmSync16
 } from "node:fs";
 import { homedir as homedir30, tmpdir as tmpdir3, userInfo as userInfo2 } from "node:os";
 import { resolve as resolve28 } from "node:path";
@@ -30336,13 +30515,13 @@ function resolveFailproofaidBinaryPath2() {
   if (process.env.FAILPROOFAI_DAEMON_BINARY)
     return process.env.FAILPROOFAI_DAEMON_BINARY;
   const downloaded = installedBinaryPath();
-  if (existsSync41(downloaded))
+  if (existsSync42(downloaded))
     return downloaded;
   const packageRoot = process.env.FAILPROOFAI_PACKAGE_ROOT;
   if (packageRoot) {
     for (const profile of ["release", "debug"]) {
       const candidate = resolve28(packageRoot, "target", profile, "failproofaid");
-      if (existsSync41(candidate))
+      if (existsSync42(candidate))
         return candidate;
     }
   }
@@ -30373,7 +30552,7 @@ function resolveWorkerCommand2() {
   if (!packageRoot)
     return null;
   const workerScript = resolve28(packageRoot, "dist", "worker.mjs");
-  if (!existsSync41(workerScript))
+  if (!existsSync42(workerScript))
     return null;
   return `${shellQuote2(process.execPath)} ${shellQuote2(workerScript)}`;
 }
@@ -30384,7 +30563,7 @@ function resolveCliCommand2() {
   if (!packageRoot)
     return null;
   const cliScript = resolve28(packageRoot, "dist", "cli.mjs");
-  if (!existsSync41(cliScript))
+  if (!existsSync42(cliScript))
     return null;
   return `${shellQuote2(process.execPath)} ${shellQuote2(cliScript)}`;
 }
@@ -30398,7 +30577,7 @@ function workerScriptPath2() {
   if (!packageRoot)
     return null;
   const workerScript = resolve28(packageRoot, "dist", "worker.mjs");
-  return existsSync41(workerScript) ? workerScript : null;
+  return existsSync42(workerScript) ? workerScript : null;
 }
 function assertUnitSafe2(value, field) {
   if (UNIT_UNSAFE_RE2.test(value)) {
@@ -30480,14 +30659,14 @@ function writePrivilegedFile2(destination, contents, mode = "0644") {
     writeFileSync24(staging, contents, "utf8");
     runPrivileged2("install", ["-m", mode, staging, destination]);
   } finally {
-    rmSync15(stagingDir, { recursive: true, force: true });
+    rmSync16(stagingDir, { recursive: true, force: true });
   }
 }
 function removeLegacyUserService2() {
   try {
     if (process.platform === "linux") {
       const legacy = legacySystemdUserUnitPath2();
-      if (!existsSync41(legacy))
+      if (!existsSync42(legacy))
         return;
       try {
         execFileSync3("systemctl", ["--user", "disable", "--now", "failproofaid.service"], {
@@ -30504,7 +30683,7 @@ function removeLegacyUserService2() {
       } catch {}
     } else {
       const legacyAgent = legacyLaunchAgentPlistPath2();
-      if (existsSync41(legacyAgent)) {
+      if (existsSync42(legacyAgent)) {
         try {
           execFileSync3("launchctl", ["unload", "-w", legacyAgent], {
             stdio: "ignore",
@@ -30514,7 +30693,7 @@ function removeLegacyUserService2() {
         unlinkSync5(legacyAgent);
       }
       const legacyDaemon = legacySharedLaunchDaemonPath2();
-      if (existsSync41(legacyDaemon)) {
+      if (existsSync42(legacyDaemon)) {
         try {
           runPrivileged2("launchctl", ["unload", "-w", legacyDaemon]);
         } catch {}
@@ -30531,7 +30710,7 @@ function systemdUnitContents2(binaryPath, workerCmd, cliCmd = null) {
   const user = assertUnitSafe2(serviceUser2(), "User");
   assertUnitSafe2(binaryPath, "ExecStart");
   assertUnitSafe2(homedir30(), "HOME");
-  const conditionPaths = [binaryPath, workerScriptPath2()].filter((p) => typeof p === "string" && existsSync41(p));
+  const conditionPaths = [binaryPath, workerScriptPath2()].filter((p) => typeof p === "string" && existsSync42(p));
   const conditionLines = conditionPaths.map((p) => `ConditionPathExists=${assertUnitSafe2(p, "ConditionPathExists")}
 `).join("");
   return `[Unit]
@@ -30736,7 +30915,7 @@ function daemonServiceStatus2() {
   if (!isDaemonSupportedPlatform2())
     return "unsupported-platform";
   if (process.platform === "linux") {
-    if (!existsSync41(systemdUnitPath2()))
+    if (!existsSync42(systemdUnitPath2()))
       return "not-installed";
     try {
       const out = execFileSync3("systemctl", ["is-active", systemdUnitName2()], {
@@ -30749,7 +30928,7 @@ function daemonServiceStatus2() {
     }
   }
   const plistPath = launchdPlistPath2();
-  if (!existsSync41(plistPath))
+  if (!existsSync42(plistPath))
     return "not-installed";
   try {
     const root = typeof process.getuid === "function" && process.getuid() === 0;
@@ -30779,7 +30958,7 @@ var init_daemon_service2 = __esm(() => {
 });
 
 // src/hooks/uninstall-cli.ts
-import { existsSync as existsSync42, rmSync as rmSync16 } from "node:fs";
+import { existsSync as existsSync43, rmSync as rmSync17 } from "node:fs";
 function survey(cwd) {
   const clis = [];
   for (const id of listInstallableIds()) {
@@ -30800,9 +30979,9 @@ function survey(cwd) {
   return {
     clis,
     servicePath,
-    serviceInstalled: !!servicePath && existsSync42(servicePath),
+    serviceInstalled: !!servicePath && existsSync43(servicePath),
     daemonConfigured,
-    homeExists: existsSync42(failproofaiHome())
+    homeExists: existsSync43(failproofaiHome())
   };
 }
 async function runUninstallCommand(opts = {}) {
@@ -30900,7 +31079,7 @@ async function runUninstallCommand(opts = {}) {
       } catch {}
       try {
         await uninstallDaemonService();
-        if (found.servicePath && existsSync42(found.servicePath)) {
+        if (found.servicePath && existsSync43(found.servicePath)) {
           failures.push(`the service at ${found.servicePath} is still there (most often: no sudo). ` + `Remove it with the commands below.`);
         } else {
           lines.push(`✓ stopped and removed the daemon service`);
@@ -30912,7 +31091,7 @@ async function runUninstallCommand(opts = {}) {
   }
   if (opts.purge && found.homeExists) {
     try {
-      rmSync16(failproofaiHome(), { recursive: true, force: true });
+      rmSync17(failproofaiHome(), { recursive: true, force: true });
       purged = true;
       lines.push(`✓ deleted ${failproofaiHome()}`);
     } catch (err) {
@@ -30923,7 +31102,7 @@ async function runUninstallCommand(opts = {}) {
     lines.push(``, `Not everything could be removed:`);
     for (const f of failures)
       lines.push(`  ✗ ${f}`);
-    if (found.servicePath && existsSync42(found.servicePath)) {
+    if (found.servicePath && existsSync43(found.servicePath)) {
       lines.push(``, `To remove the service by hand:`, ...manualServiceRemoval(found.servicePath), ``, `(\`${daemonStatusCommand()}\` shows its current state.)`);
     }
     return { exitCode: 1, lines, planLines, purged };
@@ -30957,7 +31136,7 @@ var init_uninstall_cli = __esm(() => {
 import { execFileSync as execFileSync4 } from "node:child_process";
 import { homedir as homedir31, tmpdir as tmpdir4 } from "node:os";
 import { createHash as createHash9 } from "node:crypto";
-import { copyFileSync as copyFileSync4, existsSync as existsSync43, mkdirSync as mkdirSync27, mkdtempSync as mkdtempSync3, readFileSync as readFileSync34, readdirSync as readdirSync21, realpathSync as realpathSync3, rmSync as rmSync17, statSync as statSync26, writeFileSync as writeFileSync25 } from "node:fs";
+import { copyFileSync as copyFileSync4, existsSync as existsSync44, mkdirSync as mkdirSync27, mkdtempSync as mkdtempSync3, readFileSync as readFileSync34, readdirSync as readdirSync21, realpathSync as realpathSync3, rmSync as rmSync18, statSync as statSync26, writeFileSync as writeFileSync25 } from "node:fs";
 import { basename as basename9, dirname as dirname21, isAbsolute as isAbsolute4, join as join40, relative as relative5, resolve as resolve29, sep as sep6 } from "node:path";
 function parseList(rest, flag) {
   const idx = rest.findIndex((a) => a === flag || a.startsWith(`${flag}=`));
@@ -31072,7 +31251,7 @@ async function build(rest) {
     return fail2([err instanceof Error ? err.message : String(err)]);
   }
   const entryPath = resolve29(entry);
-  if (!existsSync43(entryPath))
+  if (!existsSync44(entryPath))
     return fail2([`No such file: ${entryPath}`]);
   const source = readFileSync34(entryPath, "utf8");
   const localImport = /(?:^|\n)\s*(?:import|export)[^;\n]*from\s+["'](\.[^"']*)["']/.exec(source);
@@ -31267,7 +31446,7 @@ async function scaffold(target) {
     chosen = answer.trim();
   }
   const path = resolve29(withPolicyExtension(chosen ?? "my-policies"));
-  if (existsSync43(path)) {
+  if (existsSync44(path)) {
     return fail2([`${path} already exists — name a different file, or edit that one.`]);
   }
   mkdirSync27(resolve29(path, ".."), { recursive: true });
@@ -31741,7 +31920,7 @@ esac
     return true;
   } finally {
     try {
-      rmSync17(dirname21(askpass), { recursive: true, force: true });
+      rmSync18(dirname21(askpass), { recursive: true, force: true });
     } catch {}
   }
 }
@@ -32765,7 +32944,7 @@ var init_install_prompt = __esm(() => {
 
 // src/hooks/manager.ts
 import { execSync as execSync7 } from "node:child_process";
-import { existsSync as existsSync44 } from "node:fs";
+import { existsSync as existsSync45 } from "node:fs";
 import { resolve as resolve30, basename as basename10 } from "node:path";
 import { platform as platform4, arch as arch4, release as release3, hostname as hostname6 } from "node:os";
 function getSettingsPath2(scope, cwd) {
@@ -32952,8 +33131,11 @@ async function installHooksImpl2(policyNames, scope = "user", cwd, includeBeta =
     }
   }
   const selectedClis = cli && cli.length > 0 ? [...new Set(cli)] : ["claude"];
-  for (const cliId of selectedClis) {
-    const integration = getIntegration(cliId);
+  const selectedIntegrations = selectedClis.map((cliId) => ({
+    cliId,
+    integration: getIntegration(cliId)
+  }));
+  for (const { cliId, integration } of selectedIntegrations) {
     if (!integration.scopes.includes(scope)) {
       try {
         await trackHookEvent2(getInstanceId2(), "scope_validation_failed", {
@@ -32965,6 +33147,13 @@ async function installHooksImpl2(policyNames, scope = "user", cwd, includeBeta =
       throw new CliError(`Scope "${scope}" is not supported by ${integration.displayName}. ` + `Valid scopes: ${integration.scopes.join(", ")}`);
     }
   }
+  const daemonRequiredBy = selectedIntegrations.map(({ integration }) => integration).filter((integration) => integration.requiresHealthyDaemon);
+  if (daemonRequiredBy.length > 0 && !await probeDaemonEndToEnd()) {
+    const names = daemonRequiredBy.map((integration) => integration.displayName).join(", ");
+    const verb = daemonRequiredBy.length === 1 ? "requires" : "require";
+    throw new CliError(`${names} ${verb} a healthy failproofaid daemon before FailproofAI enforcement can be enabled.
+` + "Run `failproofai config` to install and configure the daemon, then retry.");
+  }
   const binaryPath = resolveFailproofaiBinary2();
   const previousConfig = readScopedHooksConfig(scope, cwd);
   const previousEnabled = new Set(previousConfig.enabledPolicies);
@@ -32987,7 +33176,7 @@ async function installHooksImpl2(policyNames, scope = "user", cwd, includeBeta =
   } else if (customPoliciesPath && (typeof customPoliciesPath === "string" || customPoliciesPath.length > 0)) {
     const incoming = (typeof customPoliciesPath === "string" ? [customPoliciesPath] : customPoliciesPath).map((path) => resolve30(path));
     const carried = (previousConfig.customPoliciesPaths ?? (previousConfig.customPoliciesPath ? [previousConfig.customPoliciesPath] : [])).map((path) => resolve30(path)).filter((path) => {
-      if (existsSync44(path))
+      if (existsSync45(path))
         return true;
       console.log(`Dropping custom policies path (file no longer exists): ${path}`);
       return false;
@@ -33063,6 +33252,7 @@ Enabled ${selectedPolicies.length} policy(ies): ${selectedPolicies.join(", ")}
     const settingsPaths = settingsPathsFor(integration, scope, cwd);
     try {
       for (const settingsPath of settingsPaths) {
+        integration.prepareInstall?.(settingsPath);
         const settings = integration.readSettings(settingsPath);
         integration.writeHookEntries(settings, binaryPath, scope);
         integration.writeSettings(settingsPath, settings);
@@ -33119,7 +33309,11 @@ Enabled ${selectedPolicies.length} policy(ies): ${selectedPolicies.join(", ")}
   } catch {}
   for (const { cli: cliId, path } of writtenSettingsPaths) {
     const integration = getIntegration(cliId);
-    console.log(`Failproof AI hooks installed for ${integration.displayName} ` + `(${integration.eventTypes.length} event types, scope: ${scope}).`);
+    if (cliId === "hermes") {
+      console.log(`Failproof AI native plugin installed for ${integration.displayName} ` + `(8 registered hooks, scope: ${scope}).`);
+    } else {
+      console.log(`Failproof AI hooks installed for ${integration.displayName} ` + `(${integration.eventTypes.length} event types, scope: ${scope}).`);
+    }
     console.log(`Settings: ${path}`);
   }
   if (scope === "project") {
@@ -33210,7 +33404,7 @@ async function removeHooks2(policyNames, scope = "user", cwd, opts) {
     const scopesToRemove = scope === "all" ? [...integration.scopes] : integration.scopes.includes(scope) ? [scope] : [];
     for (const s of scopesToRemove) {
       const settingsPaths = settingsPathsFor(integration, s, cwd);
-      const existing = settingsPaths.filter((p) => existsSync44(p));
+      const existing = cliId === "hermes" ? settingsPaths : settingsPaths.filter((p) => existsSync45(p));
       if (existing.length === 0) {
         if (scope !== "all" && selectedClis.length === 1) {
           console.log("No settings file found. Nothing to remove.");
@@ -33356,7 +33550,7 @@ async function listHooks(cwd) {
     for (const path of explicitPaths) {
       const absPath = resolve30(findProjectConfigDir(cwd ?? process.cwd()), path);
       groups.push(note(absPath, opts));
-      if (!existsSync44(absPath)) {
+      if (!existsSync45(absPath)) {
         groups.push(warning([`file not found: ${absPath}`], opts));
         continue;
       }
@@ -33483,6 +33677,7 @@ var init_manager2 = __esm(() => {
   init_pack_store();
   init_pack_manifest();
   init_policy_evaluator();
+  init_daemon_service();
   init_tui();
   VALID_POLICY_NAMES2 = new Set(BUILTIN_POLICIES.map((p) => p.name));
 });
@@ -33918,19 +34113,19 @@ function parseScriptArgs(argv) {
 var init_parse_script_args = () => {};
 
 // scripts/install-diagnosis.mjs
-import { existsSync as existsSync45, readFileSync as readFileSync36, realpathSync as realpathSync4 } from "node:fs";
+import { existsSync as existsSync46, readFileSync as readFileSync36, realpathSync as realpathSync4 } from "node:fs";
 import { dirname as dirname22, resolve as resolve32 } from "node:path";
 import { homedir as homedir32, platform as platform5 } from "node:os";
 import { spawnSync } from "node:child_process";
 function findPackageRoot(start) {
   try {
     let dir = realpathSync4(start);
-    if (existsSync45(dir) && !existsSync45(resolve32(dir, "package.json"))) {
+    if (existsSync46(dir) && !existsSync46(resolve32(dir, "package.json"))) {
       dir = dirname22(dir);
     }
     while (true) {
       const pkgPath = resolve32(dir, "package.json");
-      if (existsSync45(pkgPath)) {
+      if (existsSync46(pkgPath)) {
         try {
           const pkg = JSON.parse(readFileSync36(pkgPath, "utf8"));
           if (pkg.name === PKG_NAME)
@@ -33977,7 +34172,7 @@ function locateNpmGlobal() {
     if (!root)
       return null;
     const candidate = resolve32(root, PKG_NAME);
-    return existsSync45(resolve32(candidate, "package.json")) ? candidate : null;
+    return existsSync46(resolve32(candidate, "package.json")) ? candidate : null;
   } catch {
     return null;
   }
@@ -33985,7 +34180,7 @@ function locateNpmGlobal() {
 function locateBunGlobal() {
   try {
     const candidate = resolve32(homedir32(), ".bun", "install", "global", "node_modules", PKG_NAME);
-    return existsSync45(resolve32(candidate, "package.json")) ? candidate : null;
+    return existsSync46(resolve32(candidate, "package.json")) ? candidate : null;
   } catch {
     return null;
   }
@@ -34088,7 +34283,7 @@ var init_dashboard_host = __esm(() => {
 
 // scripts/launch.ts
 import { spawn as spawn2 } from "child_process";
-import { realpathSync as realpathSync5, existsSync as existsSync46 } from "node:fs";
+import { realpathSync as realpathSync5, existsSync as existsSync47 } from "node:fs";
 import { resolve as resolve33, dirname as dirname23 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 import { createInterface } from "node:readline";
@@ -34115,7 +34310,7 @@ function launch(mode) {
     cmd = "node";
     const packageRoot = process.env.FAILPROOFAI_PACKAGE_ROOT ?? resolve33(dirname23(realpathSync5(fileURLToPath2(import.meta.url))), "..");
     const serverJsPath = resolve33(packageRoot, ".next/standalone/server.js");
-    if (!existsSync46(serverJsPath)) {
+    if (!existsSync47(serverJsPath)) {
       let shadowMessage = null;
       try {
         const diag = diagnoseShadow({ selfPackageRoot: packageRoot, selfVersion: version2 });
@@ -34868,10 +35063,108 @@ var init_session_pause_cli = __esm(() => {
   init_tui();
 });
 
+// src/hooks/integrations.ts
+import {
+  cpSync as cpSync2,
+  readFileSync as readFileSync37,
+  writeFileSync as writeFileSync26,
+  existsSync as existsSync48,
+  lstatSync as lstatSync2,
+  mkdirSync as mkdirSync28,
+  renameSync as renameSync10,
+  rmSync as rmSync19,
+  unlinkSync as unlinkSync6
+} from "node:fs";
+import { resolve as resolve34, dirname as dirname24 } from "node:path";
+function readYamlDoc2(path) {
+  try {
+    return existsSync48(path) ? $parseDocument(readFileSync37(path, "utf8")) : $parseDocument("");
+  } catch {
+    return $parseDocument("");
+  }
+}
+function isMarkedHook2(hook) {
+  if (!hook || typeof hook !== "object")
+    return false;
+  const h = hook;
+  if (h[FAILPROOFAI_HOOK_MARKER] === true)
+    return true;
+  const cmd = typeof h.command === "string" ? h.command : "";
+  return cmd.includes("failproofai") && cmd.includes("--hook");
+}
+function hermesPluginPathForSettings2(settingsPath) {
+  return resolve34(dirname24(settingsPath), "plugins", HERMES_PLUGIN_ID2);
+}
+function hasManagedHermesPlugin2(settingsPath) {
+  const pluginPath = hermesPluginPathForSettings2(settingsPath);
+  try {
+    if (lstatSync2(pluginPath).isSymbolicLink())
+      return false;
+    if (!existsSync48(resolve34(pluginPath, HERMES_PLUGIN_MARKER2)))
+      return false;
+    return HERMES_PLUGIN_FILES2.every((file) => existsSync48(resolve34(pluginPath, file)));
+  } catch {
+    return false;
+  }
+}
+function hermesConfigState2(settingsPath) {
+  if (!existsSync48(settingsPath)) {
+    return { pluginEnabled: false, legacyShellHookPresent: false };
+  }
+  const doc = readYamlDoc2(settingsPath);
+  const js = doc.toJS() ?? {};
+  const enabled = js.plugins?.enabled;
+  const legacyShellHookPresent = !!js.hooks && typeof js.hooks === "object" && Object.values(js.hooks).some((entries) => Array.isArray(entries) && entries.some((entry) => isMarkedHook2(entry)));
+  return {
+    pluginEnabled: Array.isArray(enabled) && enabled.includes(HERMES_PLUGIN_ID2),
+    legacyShellHookPresent
+  };
+}
+function hermesProfileHealth() {
+  return listHermesProfiles().map((profile) => {
+    const settingsPath = resolve34(profile.home, "config.yaml");
+    const config = hermesConfigState2(settingsPath);
+    const pluginInstalled = hasManagedHermesPlugin2(settingsPath);
+    return {
+      name: profile.name,
+      home: profile.home,
+      settingsPath,
+      pluginInstalled,
+      pluginEnabled: config.pluginEnabled,
+      legacyShellHookPresent: config.legacyShellHookPresent,
+      healthy: pluginInstalled && config.pluginEnabled && !config.legacyShellHookPresent
+    };
+  });
+}
+function hermesProfileStatusRows() {
+  return hermesProfileHealth().filter((profile) => existsSync48(profile.home)).map((profile) => {
+    const problems = [];
+    if (!profile.pluginInstalled)
+      problems.push("plugin files missing or incomplete");
+    if (!profile.pluginEnabled)
+      problems.push("plugin not enabled");
+    if (profile.legacyShellHookPresent)
+      problems.push("legacy shell hook also present");
+    return [
+      "hermes/" + profile.name,
+      problems.length === 0 ? "native plugin enabled" : "UNHEALTHY — " + problems.join("; ")
+    ];
+  });
+}
+var HERMES_PLUGIN_ID2 = "failproofai", HERMES_PLUGIN_MARKER2 = ".failproofai-managed", HERMES_PLUGIN_FILES2, ANTIGRAVITY_TOOL_EVENTS2;
+var init_integrations2 = __esm(() => {
+  init_dist();
+  init_hermes_profiles();
+  init_openclaw_profiles();
+  init_types();
+  HERMES_PLUGIN_FILES2 = ["plugin.yaml", "__init__.py", "client.py", "ledger.py"];
+  ANTIGRAVITY_TOOL_EVENTS2 = new Set(["PreToolUse", "PostToolUse"]);
+});
+
 // scripts/launch.ts
 import { spawn as spawn3 } from "child_process";
-import { realpathSync as realpathSync6, existsSync as existsSync47 } from "node:fs";
-import { resolve as resolve34, dirname as dirname24 } from "node:path";
+import { realpathSync as realpathSync6, existsSync as existsSync49 } from "node:fs";
+import { resolve as resolve35, dirname as dirname25 } from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 import { createInterface as createInterface2 } from "node:readline";
 function launch2(mode) {
@@ -34895,9 +35188,9 @@ function launch2(mode) {
     process.env.PORT = port;
     process.env.HOSTNAME = bindHost;
     cmd = "node";
-    const packageRoot = process.env.FAILPROOFAI_PACKAGE_ROOT ?? resolve34(dirname24(realpathSync6(fileURLToPath3(import.meta.url))), "..");
-    const serverJsPath = resolve34(packageRoot, ".next/standalone/server.js");
-    if (!existsSync47(serverJsPath)) {
+    const packageRoot = process.env.FAILPROOFAI_PACKAGE_ROOT ?? resolve35(dirname25(realpathSync6(fileURLToPath3(import.meta.url))), "..");
+    const serverJsPath = resolve35(packageRoot, ".next/standalone/server.js");
+    if (!existsSync49(serverJsPath)) {
       let shadowMessage = null;
       try {
         const diag = diagnoseShadow({ selfPackageRoot: packageRoot, selfVersion: version2 });
@@ -34994,17 +35287,17 @@ var init_cli_error2 = __esm(() => {
 
 // bin/failproofai.mjs
 import { realpathSync as realpathSync7 } from "fs";
-import { dirname as dirname25, resolve as resolve35 } from "path";
+import { dirname as dirname26, resolve as resolve36 } from "path";
 import { fileURLToPath as fileURLToPath4 } from "url";
 // package.json
-var version = "1.0.5";
+var version = "1.0.6-beta.1";
 
 // bin/failproofai.mjs
 if (!process.env.FAILPROOFAI_PACKAGE_ROOT) {
-  process.env.FAILPROOFAI_PACKAGE_ROOT = resolve35(dirname25(realpathSync7(fileURLToPath4(import.meta.url))), "..");
+  process.env.FAILPROOFAI_PACKAGE_ROOT = resolve36(dirname26(realpathSync7(fileURLToPath4(import.meta.url))), "..");
 }
 if (!process.env.FAILPROOFAI_DIST_PATH) {
-  process.env.FAILPROOFAI_DIST_PATH = resolve35(dirname25(realpathSync7(fileURLToPath4(import.meta.url))), "..", "dist");
+  process.env.FAILPROOFAI_DIST_PATH = resolve36(dirname26(realpathSync7(fileURLToPath4(import.meta.url))), "..", "dist");
 }
 var args = process.argv.slice(2);
 if (args[0] === "p" || args[0] === "policy")
@@ -36580,7 +36873,9 @@ Run \`failproofai policies --help\` for usage.`);
         await Promise.resolve().then(() => init_tui2());
         const opts = optsFor2(process.stdout);
         const report = connectionStatusReport();
-        printBlock2(process.stdout, stack2(title2("failproofai config", versionStatusLines()[0], opts), rows2([...report.rows, ...result.rows ?? []], opts), report.warnings.length > 0 ? warning2(report.warnings, opts) : null, result.rows ? result.trailer ?? null : result.lines));
+        await Promise.resolve().then(() => init_integrations2());
+        const hermesRows = hermesProfileStatusRows();
+        printBlock2(process.stdout, stack2(title2("failproofai config", versionStatusLines()[0], opts), rows2([...report.rows, ...hermesRows, ...result.rows ?? []], opts), report.warnings.length > 0 ? warning2(report.warnings, opts) : null, result.rows ? result.trailer ?? null : result.lines));
       } else {
         await printLines(result.lines, result.exitCode === 0);
       }