failproofai 1.0.6-beta.0 → 1.0.6

package/dist/cli.mjs

@@ -29,7 +29,7 @@ var __esm = (fn, res, err) => () => {
 var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
 // package.json
-var version2 = "1.0.6-beta.0", package_default;
+var version2 = "1.0.6", package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "failproofai",
@@ -155,16 +155,16 @@ var init_package = __esm(() => {
       browserslist: "4.28.8"
     },
     optionalDependencies: {
-      "@failproofai/failproofaid-linux-x64": "1.0.6-beta.0",
-      "@failproofai/failproofaid-linux-arm64": "1.0.6-beta.0",
-      "@failproofai/failproofaid-darwin-x64": "1.0.6-beta.0",
-      "@failproofai/failproofaid-darwin-arm64": "1.0.6-beta.0"
+      "@failproofai/failproofaid-linux-x64": "1.0.6",
+      "@failproofai/failproofaid-linux-arm64": "1.0.6",
+      "@failproofai/failproofaid-darwin-x64": "1.0.6",
+      "@failproofai/failproofaid-darwin-arm64": "1.0.6"
     },
     failproofaidBinaries: {
-      "linux-x64": "38637a91db9a0e5683bbfbfffbba3d65e421960c3135510f23541df5f9d60478",
-      "linux-arm64": "b9a2d9126fb9816b7743ec5b068d36d6515fa3a93fc2e3801fbe3a7a1b2143bf",
-      "darwin-x64": "a06675cd28b3d2f54d45a28f527643841a69006dd68f989dad654806b190948b",
-      "darwin-arm64": "6ef65b956ebff944c38cf2d65b6dc1066384aba7952d7d19c4805c1f1ba593ba"
+      "linux-x64": "e075f24a3a0950b631979d9370b665da2c3e2920decfb917ff0831d1f17c9740",
+      "linux-arm64": "b90ce8c642f2685719f4915695615219860daf3155a9c07344cf1e10395028c3",
+      "darwin-x64": "51dd95e9b85226e4f1888c7edaa56ec4464e91eb645d39c5cb7cede16d2da2f1",
+      "darwin-arm64": "f6a1b9d63363e8805e0d72b4fa168fde661bdbbd4125b54047f7de8948ea0f39"
     }
   };
 });
@@ -809,7 +809,7 @@ function encodeFrame(value) {
   header.writeUInt32BE(body.length, 0);
   return Buffer.concat([header, body]);
 }
-async function attemptDaemonHook(req, opts) {
+async function attemptDaemonRequest(request, opts) {
   if (process.platform === "win32")
     return { ok: false, failure: "unreachable" };
   const responseBudget = opts?.responseTimeoutMs ?? DAEMON_RESPONSE_TIMEOUT_MS;
@@ -837,14 +837,7 @@ async function attemptDaemonHook(req, opts) {
     let declaredLen = null;
     socket.on("connect", () => {
       arm(responseBudget);
-      socket.write(encodeFrame({
-        type: "hook",
-        protocolVersion: PROTOCOL_VERSION,
-        hookEvent: req.hookEvent,
-        cli: req.cli,
-        stdin: req.stdin,
-        cwd: req.cwd
-      }));
+      socket.write(encodeFrame(request));
     });
     socket.on("data", (chunk) => {
       recvBuf = Buffer.concat([recvBuf, chunk]);
@@ -861,34 +854,52 @@ async function attemptDaemonHook(req, opts) {
       if (recvBuf.length < declaredLen)
         return;
       const body = recvBuf.subarray(0, declaredLen);
-      let message;
+      let parsed;
       try {
-        message = JSON.parse(body.toString("utf8"));
+        parsed = JSON.parse(body.toString("utf8"));
       } catch {
         fail("unreachable");
         return;
       }
-      if (message.protocolVersion !== PROTOCOL_VERSION) {
-        fail("protocol-mismatch");
+      if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+        fail("unreachable");
         return;
       }
-      if (message.type === "hookResult" && typeof message.exitCode === "number" && typeof message.stdout === "string" && typeof message.stderr === "string") {
-        finish({
-          ok: true,
-          response: {
-            exitCode: message.exitCode,
-            stdout: message.stdout,
-            stderr: message.stderr
-          }
-        });
+      const message = parsed;
+      if (message.protocolVersion !== PROTOCOL_VERSION) {
+        fail("protocol-mismatch");
         return;
       }
-      fail("unreachable");
+      finish({ ok: true, message });
     });
     socket.on("error", () => fail("unreachable"));
     socket.on("close", () => fail("unreachable"));
   });
 }
+async function attemptDaemonHook(req, opts) {
+  const attempt = await attemptDaemonRequest({
+    type: "hook",
+    protocolVersion: PROTOCOL_VERSION,
+    hookEvent: req.hookEvent,
+    cli: req.cli,
+    stdin: req.stdin,
+    cwd: req.cwd
+  }, opts);
+  if (!attempt.ok)
+    return attempt;
+  const message = attempt.message;
+  if (message.type === "hookResult" && typeof message.exitCode === "number" && typeof message.stdout === "string" && typeof message.stderr === "string") {
+    return {
+      ok: true,
+      response: {
+        exitCode: message.exitCode,
+        stdout: message.stdout,
+        stderr: message.stderr
+      }
+    };
+  }
+  return { ok: false, failure: "unreachable" };
+}
 var PROTOCOL_VERSION = 1, DAEMON_CONNECT_TIMEOUT_MS = 150, DAEMON_RESPONSE_TIMEOUT_MS = 30000, MAX_FRAME_LEN;
 var init_daemon_client = __esm(() => {
   init_fp_home();
@@ -11518,36 +11529,66 @@ var init_dist = __esm(() => {
 });
 
 // lib/hermes-profiles.ts
-import { readdirSync } from "node:fs";
+import { existsSync as existsSync6, readdirSync } from "node:fs";
 import { homedir as homedir4 } from "node:os";
 import { basename, dirname as dirname3, join as join3, resolve as resolve6 } from "node:path";
 function hermesRoot() {
   const env = (process.env.HERMES_HOME || "").trim();
   if (env) {
-    const home = resolve6(env);
+    let home = resolve6(env);
     const parent = dirname3(home);
     if (basename(parent) === PROFILES_DIR)
-      return dirname3(parent);
+      home = dirname3(parent);
+    const base = basename(home);
+    if (base === STANDARD_HOME || base.startsWith(SIBLING_HOME_PREFIX)) {
+      return join3(dirname3(home), STANDARD_HOME);
+    }
     return home;
   }
-  return join3(homedir4(), ".hermes");
+  return join3(homedir4(), STANDARD_HOME);
+}
+function uniqueProfileName(preferred, seen) {
+  if (!seen.has(preferred))
+    return preferred;
+  const base = `${preferred}-home`;
+  if (!seen.has(base))
+    return base;
+  let suffix = 2;
+  while (seen.has(`${base}-${suffix}`))
+    suffix += 1;
+  return `${base}-${suffix}`;
 }
 function listHermesProfiles() {
   const root = hermesRoot();
   const out = [{ name: HERMES_DEFAULT_PROFILE, home: root }];
   const seen = new Set([HERMES_DEFAULT_PROFILE]);
-  let names;
+  let names = [];
   try {
     names = readdirSync(join3(root, PROFILES_DIR), { withFileTypes: true }).filter((e) => (e.isDirectory() || e.isSymbolicLink()) && !e.name.startsWith(".")).map((e) => e.name).sort();
-  } catch {
-    return out;
-  }
+  } catch {}
   for (const name of names) {
     if (seen.has(name))
       continue;
     seen.add(name);
     out.push({ name, home: join3(root, PROFILES_DIR, name) });
   }
+  if (basename(root) !== STANDARD_HOME)
+    return out;
+  let siblings = [];
+  const parent = dirname3(root);
+  try {
+    siblings = readdirSync(parent, { withFileTypes: true }).filter((entry) => (entry.isDirectory() || entry.isSymbolicLink()) && entry.name.startsWith(SIBLING_HOME_PREFIX) && entry.name.length > SIBLING_HOME_PREFIX.length && existsSync6(join3(parent, entry.name, "config.yaml"))).map((entry) => ({
+      name: entry.name.slice(SIBLING_HOME_PREFIX.length),
+      home: join3(parent, entry.name)
+    })).sort((a, b) => a.name.localeCompare(b.name));
+  } catch {
+    return out;
+  }
+  for (const sibling of siblings) {
+    const name = uniqueProfileName(sibling.name, seen);
+    seen.add(name);
+    out.push({ name, home: sibling.home });
+  }
   return out;
 }
 function hermesProjectName(profile, source) {
@@ -11573,11 +11614,11 @@ function hermesProjectNameCandidates(name) {
   out.push({ profile: HERMES_DEFAULT_PROFILE, source: rest });
   return out;
 }
-var PROFILES_DIR = "profiles", HERMES_DEFAULT_PROFILE = "default";
+var PROFILES_DIR = "profiles", STANDARD_HOME = ".hermes", SIBLING_HOME_PREFIX = ".hermes-", HERMES_DEFAULT_PROFILE = "default";
 var init_hermes_profiles = () => {};
 
 // lib/openclaw-profiles.ts
-import { existsSync as existsSync6, readdirSync as readdirSync2 } from "node:fs";
+import { existsSync as existsSync7, readdirSync as readdirSync2 } from "node:fs";
 import { homedir as homedir5 } from "node:os";
 import { basename as basename2, dirname as dirname4, join as join4, resolve as resolve7 } from "node:path";
 function openclawProfileHome() {
@@ -11609,7 +11650,7 @@ function listOpenClawProfiles() {
   } catch {
     return out;
   }
-  const named = entries.filter((entry) => (entry.isDirectory() || entry.isSymbolicLink()) && entry.name.startsWith(".openclaw-") && entry.name.length > ".openclaw-".length && existsSync6(join4(parent, entry.name, "openclaw.json"))).map((entry) => ({
+  const named = entries.filter((entry) => (entry.isDirectory() || entry.isSymbolicLink()) && entry.name.startsWith(".openclaw-") && entry.name.length > ".openclaw-".length && existsSync7(join4(parent, entry.name, "openclaw.json"))).map((entry) => ({
     name: entry.name.slice(".openclaw-".length),
     home: join4(parent, entry.name)
   })).sort((a, b) => a.name.localeCompare(b.name));
@@ -11625,7 +11666,7 @@ import {
   cpSync,
   readFileSync as readFileSync5,
   writeFileSync as writeFileSync3,
-  existsSync as existsSync7,
+  existsSync as existsSync8,
   lstatSync,
   mkdirSync as mkdirSync4,
   renameSync as renameSync2,
@@ -11636,7 +11677,7 @@ import { resolve as resolve8, dirname as dirname5 } from "node:path";
 import { fileURLToPath } from "node:url";
 import { homedir as homedir6 } from "node:os";
 function readJsonFile(path) {
-  if (!existsSync7(path))
+  if (!existsSync8(path))
     return {};
   const raw = readFileSync5(path, "utf8");
   return JSON.parse(raw);
@@ -11648,7 +11689,7 @@ function writeJsonFile(path, data) {
 }
 function readYamlDoc(path) {
   try {
-    return existsSync7(path) ? $parseDocument(readFileSync5(path, "utf8")) : $parseDocument("");
+    return existsSync8(path) ? $parseDocument(readFileSync5(path, "utf8")) : $parseDocument("");
   } catch {
     return $parseDocument("");
   }
@@ -11947,9 +11988,9 @@ function hasManagedHermesPlugin(settingsPath) {
   try {
     if (lstatSync(pluginPath).isSymbolicLink())
       return false;
-    if (!existsSync7(resolve8(pluginPath, HERMES_PLUGIN_MARKER)))
+    if (!existsSync8(resolve8(pluginPath, HERMES_PLUGIN_MARKER)))
       return false;
-    return HERMES_PLUGIN_FILES.every((file) => existsSync7(resolve8(pluginPath, file)));
+    return HERMES_PLUGIN_FILES.every((file) => existsSync8(resolve8(pluginPath, file)));
   } catch {
     return false;
   }
@@ -11957,7 +11998,7 @@ function hasManagedHermesPlugin(settingsPath) {
 function hasHermesPluginMarker(settingsPath) {
   const pluginPath = hermesPluginPathForSettings(settingsPath);
   try {
-    return !lstatSync(pluginPath).isSymbolicLink() && existsSync7(resolve8(pluginPath, HERMES_PLUGIN_MARKER));
+    return !lstatSync(pluginPath).isSymbolicLink() && existsSync8(resolve8(pluginPath, HERMES_PLUGIN_MARKER));
   } catch {
     return false;
   }
@@ -11965,13 +12006,13 @@ function hasHermesPluginMarker(settingsPath) {
 function installHermesPlugin(settingsPath) {
   const source = getHermesPluginSourcePath();
   for (const file of HERMES_PLUGIN_FILES) {
-    if (!existsSync7(resolve8(source, file))) {
+    if (!existsSync8(resolve8(source, file))) {
       throw new Error(`Hermes plugin asset is missing from the failproofai package: ${file}`);
     }
   }
   const destination = hermesPluginPathForSettings(settingsPath);
-  if (existsSync7(destination)) {
-    if (lstatSync(destination).isSymbolicLink() || !existsSync7(resolve8(destination, HERMES_PLUGIN_MARKER))) {
+  if (existsSync8(destination)) {
+    if (lstatSync(destination).isSymbolicLink() || !existsSync8(resolve8(destination, HERMES_PLUGIN_MARKER))) {
       throw new Error(`Refusing to overwrite an unmanaged Hermes plugin at ${destination}. ` + `Move it aside or install FailproofAI under a different Hermes profile.`);
     }
   }
@@ -11986,7 +12027,7 @@ function installHermesPlugin(settingsPath) {
       cpSync(resolve8(source, file), resolve8(temporary, file));
     }
     writeFileSync3(resolve8(temporary, HERMES_PLUGIN_MARKER), "Managed by failproofai. Remove with `failproofai policies --uninstall --cli hermes`.\n", { encoding: "utf8", mode: 384 });
-    if (existsSync7(destination)) {
+    if (existsSync8(destination)) {
       renameSync2(destination, backup);
       movedExisting = true;
     }
@@ -11995,7 +12036,7 @@ function installHermesPlugin(settingsPath) {
       rmSync2(backup, { recursive: true, force: true });
   } catch (err) {
     rmSync2(temporary, { recursive: true, force: true });
-    if (movedExisting && !existsSync7(destination) && existsSync7(backup)) {
+    if (movedExisting && !existsSync8(destination) && existsSync8(backup)) {
       renameSync2(backup, destination);
     }
     throw err;
@@ -12036,7 +12077,7 @@ function removeLegacyHermesHooks(doc) {
   return removed;
 }
 function hermesConfigState(settingsPath) {
-  if (!existsSync7(settingsPath)) {
+  if (!existsSync8(settingsPath)) {
     return { pluginEnabled: false, legacyShellHookPresent: false };
   }
   const doc = readYamlDoc(settingsPath);
@@ -12200,7 +12241,7 @@ var init_integrations = __esm(() => {
     },
     hooksInstalledInSettings(scope, cwd) {
       const settingsPath = this.getSettingsPath(scope, cwd);
-      if (!existsSync7(settingsPath))
+      if (!existsSync8(settingsPath))
         return false;
       try {
         const settings = this.readSettings(settingsPath);
@@ -12316,7 +12357,7 @@ var init_integrations = __esm(() => {
     },
     hooksInstalledInSettings(scope, cwd) {
       const settingsPath = this.getSettingsPath(scope, cwd);
-      if (!existsSync7(settingsPath))
+      if (!existsSync8(settingsPath))
         return false;
       try {
         const settings = this.readSettings(settingsPath);
@@ -12430,7 +12471,7 @@ var init_integrations = __esm(() => {
     },
     hooksInstalledInSettings(scope, cwd) {
       const settingsPath = this.getSettingsPath(scope, cwd);
-      if (!existsSync7(settingsPath))
+      if (!existsSync8(settingsPath))
         return false;
       try {
         const settings = this.readSettings(settingsPath);
@@ -12533,7 +12574,7 @@ var init_integrations = __esm(() => {
     },
     hooksInstalledInSettings(scope, cwd) {
       const settingsPath = this.getSettingsPath(scope, cwd);
-      if (!existsSync7(settingsPath))
+      if (!existsSync8(settingsPath))
         return false;
       try {
         const settings = this.readSettings(settingsPath);
@@ -12617,7 +12658,7 @@ var init_integrations = __esm(() => {
       }
       this.writeSettings(settingsPath, settings);
       const pluginPath = opencodePluginFilePath(settingsPath);
-      if (existsSync7(pluginPath)) {
+      if (existsSync8(pluginPath)) {
         try {
           const content = readFileSync5(pluginPath, "utf8");
           if (content.includes(FAILPROOFAI_HOOK_MARKER)) {
@@ -12631,7 +12672,7 @@ var init_integrations = __esm(() => {
     },
     hooksInstalledInSettings(scope, cwd) {
       const settingsPath = this.getSettingsPath(scope, cwd);
-      if (!existsSync7(settingsPath))
+      if (!existsSync8(settingsPath))
         return false;
       try {
         const settings = this.readSettings(settingsPath);
@@ -12641,7 +12682,7 @@ var init_integrations = __esm(() => {
         if (!hasEntry)
           return false;
         const pluginPath = opencodePluginFilePath(settingsPath);
-        if (!existsSync7(pluginPath))
+        if (!existsSync8(pluginPath))
           return false;
         const content = readFileSync5(pluginPath, "utf8");
         return content.includes(FAILPROOFAI_HOOK_MARKER);
@@ -12708,7 +12749,7 @@ var init_integrations = __esm(() => {
       }
     },
     removeHooksFromFile(settingsPath) {
-      if (!existsSync7(settingsPath))
+      if (!existsSync8(settingsPath))
         return 0;
       const settings = this.readSettings(settingsPath);
       if (!Array.isArray(settings.packages))
@@ -12723,7 +12764,7 @@ var init_integrations = __esm(() => {
     },
     hooksInstalledInSettings(scope, cwd) {
       const settingsPath = this.getSettingsPath(scope, cwd);
-      if (!existsSync7(settingsPath))
+      if (!existsSync8(settingsPath))
         return false;
       try {
         const settings = this.readSettings(settingsPath);
@@ -12742,6 +12783,7 @@ var init_integrations = __esm(() => {
   hermes = {
     id: "hermes",
     displayName: "Hermes",
+    requiresHealthyDaemon: true,
     scopes: HERMES_HOOK_SCOPES,
     eventTypes: HERMES_HOOK_EVENT_TYPES,
     getSettingsPath() {
@@ -12876,7 +12918,7 @@ var init_integrations = __esm(() => {
       hooks.allowConversationAccess = true;
     },
     removeHooksFromFile(settingsPath) {
-      if (!existsSync7(settingsPath))
+      if (!existsSync8(settingsPath))
         return 0;
       const settings = this.readSettings(settingsPath);
       const plugins = settings.plugins;
@@ -12906,7 +12948,7 @@ var init_integrations = __esm(() => {
     hooksInstalledInSettings(scope, cwd) {
       const settingsPaths = settingsPathsFor(this, scope, cwd);
       return settingsPaths.length > 0 && settingsPaths.every((settingsPath) => {
-        if (!existsSync7(settingsPath))
+        if (!existsSync8(settingsPath))
           return false;
         try {
           const settings = this.readSettings(settingsPath);
@@ -13004,7 +13046,7 @@ var init_integrations = __esm(() => {
     },
     hooksInstalledInSettings(scope, cwd) {
       const settingsPath = this.getSettingsPath(scope, cwd);
-      if (!existsSync7(settingsPath))
+      if (!existsSync8(settingsPath))
         return false;
       try {
         const settings = this.readSettings(settingsPath);
@@ -13110,7 +13152,7 @@ var init_integrations = __esm(() => {
     },
     hooksInstalledInSettings(scope, cwd) {
       const settingsPath = this.getSettingsPath(scope, cwd);
-      if (!existsSync7(settingsPath))
+      if (!existsSync8(settingsPath))
         return false;
       try {
         const settings = this.readSettings(settingsPath);
@@ -13249,7 +13291,7 @@ var init_integrations = __esm(() => {
     },
     hooksInstalledInSettings(scope, cwd) {
       const settingsPath = this.getSettingsPath(scope, cwd);
-      if (!existsSync7(settingsPath))
+      if (!existsSync8(settingsPath))
         return false;
       try {
         const settings = this.readSettings(settingsPath);
@@ -13355,7 +13397,7 @@ var init_integrations = __esm(() => {
     },
     hooksInstalledInSettings(scope, cwd) {
       const settingsPath = this.getSettingsPath(scope, cwd);
-      if (!existsSync7(settingsPath))
+      if (!existsSync8(settingsPath))
         return false;
       try {
         const settings = this.readSettings(settingsPath);
@@ -13746,12 +13788,12 @@ var init_telemetry_id2 = __esm(() => {
 // src/hooks/custom-hooks-loader.ts
 import { resolve as resolve10, isAbsolute as isAbsolute2, basename as basename3 } from "node:path";
 import { randomUUID } from "crypto";
-import { existsSync as existsSync8, readdirSync as readdirSync3 } from "node:fs";
+import { existsSync as existsSync9, readdirSync as readdirSync3 } from "node:fs";
 import { readFile as readFile3 } from "node:fs/promises";
 import { pathToFileURL as pathToFileURL2 } from "node:url";
 import { createHash as createHash4 } from "node:crypto";
 function discoverPolicyFiles(dir) {
-  if (!existsSync8(dir))
+  if (!existsSync9(dir))
     return [];
   try {
     const entries = readdirSync3(dir, { withFileTypes: true });
@@ -13761,7 +13803,7 @@ function discoverPolicyFiles(dir) {
   }
 }
 function findSkippedPolicyFiles(dir) {
-  if (!existsSync8(dir))
+  if (!existsSync9(dir))
     return [];
   try {
     return readdirSync3(dir, { withFileTypes: true }).filter((e) => e.isFile() && LOADABLE_EXT_RE.test(e.name) && !CONVENTION_FILE_RE.test(e.name) && !e.name.endsWith(".d.ts") && !isTmpArtifact(e.name)).map((e) => e.name).sort((a, b) => a.localeCompare(b));
@@ -13848,7 +13890,7 @@ async function loadCustomHooks(customPoliciesPath, opts) {
   if (!customPoliciesPath)
     return [];
   const absPath = isAbsolute2(customPoliciesPath) ? customPoliciesPath : resolve10(opts?.sessionCwd ?? process.cwd(), customPoliciesPath);
-  if (!existsSync8(absPath)) {
+  if (!existsSync9(absPath)) {
     if (opts?.strict)
       throw new Error(`Custom hooks file not found: ${absPath}`);
     hookLogWarn(`customPoliciesPath not found: ${absPath}`);
@@ -13934,7 +13976,7 @@ async function loadAllCustomHooks(customPoliciesPaths, opts) {
     const absPath = resolve10(projectRoot, customPoliciesPath);
     const cloudManaged = cloudManagedByPath.get(absPath);
     const pack = packByPath.get(absPath);
-    if (existsSync8(absPath)) {
+    if (existsSync9(absPath)) {
       if (!loadedPaths.has(absPath)) {
         loadedPaths.add(absPath);
         const hooksBefore = getCustomHooks().length;
@@ -15002,7 +15044,7 @@ var init_pack_cli = __esm(() => {
 
 // src/hooks/pack-store.ts
 import { createHash as createHash5 } from "node:crypto";
-import { existsSync as existsSync9, mkdirSync as mkdirSync5, readFileSync as readFileSync6, renameSync as renameSync3, rmSync as rmSync3, writeFileSync as writeFileSync4 } from "node:fs";
+import { existsSync as existsSync10, mkdirSync as mkdirSync5, readFileSync as readFileSync6, renameSync as renameSync3, rmSync as rmSync3, writeFileSync as writeFileSync4 } from "node:fs";
 import { dirname as dirname7, resolve as resolve11 } from "node:path";
 function baseUrl() {
   return (process.env.FAILPROOFAI_PACK_BASE_URL || DEFAULT_BASE_URL).replace(/\/+$/, "");
@@ -15352,7 +15394,7 @@ async function addPack(source, opts) {
   const root = packsRoot();
   const artifactRel = `artifacts/${fetched.artifactDigest}.mjs`;
   const artifactAbs = resolve11(root, artifactRel);
-  if (!existsSync9(artifactAbs))
+  if (!existsSync10(artifactAbs))
     writeAtomic(artifactAbs, fetched.artifact);
   try {
     await verifyArtifactRegisters(artifactAbs, available);
@@ -15395,7 +15437,7 @@ async function addPack(source, opts) {
 }
 function setPackPolicyEnabled(packId, name, on) {
   const manifestPath = resolve11(packsRoot(), "installed.json");
-  if (!existsSync9(manifestPath))
+  if (!existsSync10(manifestPath))
     return { ok: false, reason: "no packs are installed" };
   let raw;
   try {
@@ -15429,7 +15471,7 @@ function bareId(value) {
 }
 function removePack(id) {
   const manifestPath = resolve11(packsRoot(), "installed.json");
-  if (!existsSync9(manifestPath))
+  if (!existsSync10(manifestPath))
     return null;
   let raw;
   try {
@@ -15454,7 +15496,7 @@ function removePack(id) {
 function upsertInstalled(record, carryAbsorbedSelection = true) {
   const manifestPath = resolve11(packsRoot(), "installed.json");
   let packs = [];
-  if (existsSync9(manifestPath)) {
+  if (existsSync10(manifestPath)) {
     try {
       const raw = JSON.parse(readFileSync6(manifestPath, "utf8"));
       if (Array.isArray(raw.packs))
@@ -16300,13 +16342,13 @@ import {
   renameSync as renameSync4,
   readdirSync as readdirSync4,
   mkdirSync as mkdirSync6,
-  existsSync as existsSync10,
+  existsSync as existsSync11,
   statSync as statSync5,
   unlinkSync as unlinkSync2
 } from "node:fs";
 import { join as join6 } from "node:path";
 function ensureDir() {
-  if (!existsSync10(storeDirValue())) {
+  if (!existsSync11(storeDirValue())) {
     mkdirSync6(storeDirValue(), { recursive: true });
   }
 }
@@ -16429,7 +16471,7 @@ function rebuildHookActivityStats() {
   let sawAny = false;
   for (const file of files) {
     const path = join6(storeDirValue(), file);
-    if (!existsSync10(path))
+    if (!existsSync11(path))
       continue;
     sawAny = true;
     for (const entry of readJsonlFile(path))
@@ -16498,7 +16540,7 @@ var init_hook_activity_store = __esm(() => {
 });
 
 // src/hooks/delivery-health.ts
-import { existsSync as existsSync11, readdirSync as readdirSync5, statSync as statSync6 } from "node:fs";
+import { existsSync as existsSync12, readdirSync as readdirSync5, statSync as statSync6 } from "node:fs";
 import { join as join7 } from "node:path";
 function parseParkedName(name) {
   const poison = name.endsWith(POISON_SUFFIX);
@@ -16527,7 +16569,7 @@ function parseParkedName(name) {
 }
 function deliveryHealth(home, now = Date.now()) {
   const dir = failedDir(home);
-  if (!existsSync11(dir))
+  if (!existsSync12(dir))
     return EMPTY;
   let entries;
   try {
@@ -17292,7 +17334,7 @@ var init_cursor_projects = __esm(() => {
 });
 
 // lib/sqlite-reader.ts
-import { existsSync as existsSync12, readFileSync as readFileSync8, statSync as statSync7 } from "node:fs";
+import { existsSync as existsSync13, readFileSync as readFileSync8, statSync as statSync7 } from "node:fs";
 import initSqlJs from "sql.js/dist/sql-asm.js";
 async function tryNodeSqlite(dbPath) {
   try {
@@ -17450,7 +17492,7 @@ async function trySqlJs(dbPath) {
   }
 }
 async function openSqliteReadonly(dbPath, options = {}) {
-  if (!existsSync12(dbPath))
+  if (!existsSync13(dbPath))
     return null;
   if (!options.forcePortable) {
     const native = await tryNodeSqlite(dbPath);
@@ -18111,7 +18153,7 @@ var init_hermes_projects = __esm(() => {
 });
 
 // lib/openclaw-db.ts
-import { existsSync as existsSync13 } from "node:fs";
+import { existsSync as existsSync14 } from "node:fs";
 import { join as join15 } from "node:path";
 function str(value) {
   return typeof value === "string" && value.length > 0 ? value : undefined;
@@ -18131,7 +18173,7 @@ function listOpenClawDatabases(home, agentIds) {
   const out = [];
   for (const agentId of agentIds) {
     const dbPath = join15(home, "agents", agentId, "agent", DB_NAME);
-    if (existsSync13(dbPath))
+    if (existsSync14(dbPath))
       out.push({ agentId, dbPath });
   }
   return out;
@@ -20317,13 +20359,13 @@ var init_log_entries = __esm(() => {
 });
 
 // lib/codex-sessions.ts
-import { readFileSync as readFileSync10, readdirSync as readdirSync9, existsSync as existsSync14, writeFileSync as writeFileSync6, mkdirSync as mkdirSync7, statSync as statSync11 } from "node:fs";
+import { readFileSync as readFileSync10, readdirSync as readdirSync9, existsSync as existsSync15, writeFileSync as writeFileSync6, mkdirSync as mkdirSync7, statSync as statSync11 } from "node:fs";
 import { readFile as readFile11 } from "node:fs/promises";
 import { dirname as dirname8, join as join26 } from "node:path";
 import { homedir as homedir18 } from "node:os";
 function readCache() {
   try {
-    if (!existsSync14(CACHE_PATH))
+    if (!existsSync15(CACHE_PATH))
       return {};
     return JSON.parse(readFileSync10(CACHE_PATH, "utf-8"));
   } catch {
@@ -20351,7 +20393,7 @@ function dirSearch(dir, sessionId) {
 function findCodexTranscript(sessionId) {
   const cache = readCache();
   const cached = cache[sessionId];
-  if (cached && existsSync14(cached))
+  if (cached && existsSync15(cached))
     return cached;
   const root = join26(homedir18(), ".codex", "sessions");
   const today = new Date;
@@ -20645,7 +20687,7 @@ var init_resolve_permission_mode = __esm(() => {
 });
 
 // lib/copilot-sessions.ts
-import { readFileSync as readFileSync12, readdirSync as readdirSync10, existsSync as existsSync15, statSync as statSync12 } from "node:fs";
+import { readFileSync as readFileSync12, readdirSync as readdirSync10, existsSync as existsSync16, statSync as statSync12 } from "node:fs";
 import { readFile as readFile12 } from "node:fs/promises";
 import { join as join27, resolve as resolve13, sep as sep2 } from "node:path";
 import { homedir as homedir19 } from "node:os";
@@ -20674,13 +20716,13 @@ function findCopilotTranscript(sessionId) {
   const candidate = resolveSessionFile(sessionId, "events.jsonl");
   if (!candidate)
     return null;
-  return existsSync15(candidate) ? candidate : null;
+  return existsSync16(candidate) ? candidate : null;
 }
 function findCopilotWorkspace(sessionId) {
   const candidate = resolveSessionFile(sessionId, "workspace.yaml");
   if (!candidate)
     return null;
-  return existsSync15(candidate) ? candidate : null;
+  return existsSync16(candidate) ? candidate : null;
 }
 function readYamlScalar(path, key) {
   try {
@@ -20862,7 +20904,7 @@ var init_copilot_sessions = __esm(() => {
 });
 
 // lib/cursor-sessions.ts
-import { readFileSync as readFileSync13, readdirSync as readdirSync11, existsSync as existsSync16, statSync as statSync13 } from "node:fs";
+import { readFileSync as readFileSync13, readdirSync as readdirSync11, existsSync as existsSync17, statSync as statSync13 } from "node:fs";
 import { readFile as readFile13 } from "node:fs/promises";
 import { basename as basename4, join as join28, resolve as resolve14, sep as sep3 } from "node:path";
 import { homedir as homedir20 } from "node:os";
@@ -20885,7 +20927,7 @@ function getCursorSessionDir(sessionId) {
     const transcriptRoot = resolve14(projectsRoot, entry.name, NEW_AGENT_TRANSCRIPTS_DIR2);
     if (candidate === transcriptRoot || !candidate.startsWith(`${transcriptRoot}${sep3}`))
       continue;
-    if (existsSync16(candidate))
+    if (existsSync17(candidate))
       return candidate;
   }
   for (const sub of LEGACY_SESSION_ROOT_CANDIDATES2) {
@@ -20893,7 +20935,7 @@ function getCursorSessionDir(sessionId) {
     const candidate = resolve14(root, sessionId);
     if (candidate === root || !candidate.startsWith(`${root}${sep3}`))
       continue;
-    if (existsSync16(candidate))
+    if (existsSync17(candidate))
       return candidate;
   }
   return null;
@@ -20903,11 +20945,11 @@ function findCursorTranscript(sessionId) {
   if (!dir)
     return null;
   const newCandidate = join28(dir, `${basename4(dir)}.jsonl`);
-  if (existsSync16(newCandidate))
+  if (existsSync17(newCandidate))
     return newCandidate;
   for (const name of LEGACY_TRANSCRIPT_FILE_CANDIDATES2) {
     const candidate = join28(dir, name);
-    if (existsSync16(candidate))
+    if (existsSync17(candidate))
       return candidate;
   }
   return null;
@@ -21118,7 +21160,7 @@ var init_cursor_sessions = __esm(() => {
 });
 
 // lib/pi-sessions.ts
-import { readFileSync as readFileSync14, readdirSync as readdirSync12, existsSync as existsSync17, statSync as statSync14 } from "node:fs";
+import { readFileSync as readFileSync14, readdirSync as readdirSync12, existsSync as existsSync18, statSync as statSync14 } from "node:fs";
 import { readFile as readFile14 } from "node:fs/promises";
 import { join as join29, resolve as resolve15, sep as sep4 } from "node:path";
 import { homedir as homedir21 } from "node:os";
@@ -21155,7 +21197,7 @@ function findPiTranscript(sessionId) {
       const candidate = resolve15(cwdPath, f);
       if (!candidate.startsWith(`${cwdPath}${sep4}`))
         continue;
-      if (existsSync17(candidate))
+      if (existsSync18(candidate))
         return candidate;
     }
   }
@@ -21561,7 +21603,7 @@ var init_pack_failclosed = __esm(() => {
 // lib/atomic-write.ts
 import {
   chmodSync as chmodSync2,
-  existsSync as existsSync18,
+  existsSync as existsSync19,
   mkdirSync as mkdirSync8,
   renameSync as renameSync5,
   rmSync as rmSync4,
@@ -21574,7 +21616,7 @@ function writeJsonAtomically(filePath, value, opts = {}) {
   const mode = opts.mode ?? 384;
   const dirMode = opts.dirMode ?? 448;
   const dir = dirname9(filePath);
-  if (!existsSync18(dir))
+  if (!existsSync19(dir))
     mkdirSync8(dir, { recursive: true, mode: dirMode });
   const tmp = `${filePath}.${process.pid}.${randomBytes(6).toString("hex")}.tmp`;
   try {
@@ -21598,7 +21640,7 @@ function writeJsonAtomically(filePath, value, opts = {}) {
 var init_atomic_write = () => {};
 
 // src/hooks/session-pause.ts
-import { existsSync as existsSync19, mkdirSync as mkdirSync9, readdirSync as readdirSync13, readFileSync as readFileSync15, rmSync as rmSync5 } from "node:fs";
+import { existsSync as existsSync20, mkdirSync as mkdirSync9, readdirSync as readdirSync13, readFileSync as readFileSync15, rmSync as rmSync5 } from "node:fs";
 import { createHash as createHash6 } from "node:crypto";
 import { join as join30, resolve as resolve16 } from "node:path";
 function pauseStateDir() {
@@ -21665,7 +21707,7 @@ function readActivePause(sessionId, now = Date.now()) {
     return null;
   try {
     const path = pauseFilePath(sessionId);
-    if (!existsSync19(path))
+    if (!existsSync20(path))
       return null;
     const stored = parseStored(JSON.parse(readFileSync15(path, "utf8")));
     if (!stored)
@@ -21696,7 +21738,7 @@ function writePause(opts) {
 }
 function clearPause(sessionId) {
   const path = pauseFilePath(sessionId);
-  if (!existsSync19(path))
+  if (!existsSync20(path))
     return false;
   try {
     rmSync5(path);
@@ -21707,7 +21749,7 @@ function clearPause(sessionId) {
 }
 function listActivePauses(now = Date.now()) {
   const dir = pauseStateDir();
-  if (!existsSync19(dir))
+  if (!existsSync20(dir))
     return [];
   const out = [];
   let names;
@@ -21761,7 +21803,7 @@ var init_session_pause = __esm(() => {
 import { createHash as createHash7 } from "node:crypto";
 import {
   chmodSync as chmodSync3,
-  existsSync as existsSync20,
+  existsSync as existsSync21,
   mkdirSync as mkdirSync10,
   readdirSync as readdirSync14,
   readFileSync as readFileSync16,
@@ -21813,7 +21855,7 @@ function platformPackageBinary(dir) {
     return null;
   }
   const candidate = resolve17(dir, "bin", "failproofaid");
-  return existsSync20(candidate) ? candidate : null;
+  return existsSync21(candidate) ? candidate : null;
 }
 function pruneOldDaemonBinaries(keep = 2) {
   const removed = [];
@@ -21891,7 +21933,7 @@ function digestFor2(manifest, assetName) {
 }
 async function downloadFailproofaidBinary(key) {
   const target = installedBinaryPath();
-  if (existsSync20(target))
+  if (existsSync21(target))
     return { path: target };
   if (process.env.FAILPROOFAI_NO_DOWNLOAD) {
     return { error: "daemon downloads are disabled (FAILPROOFAI_NO_DOWNLOAD)" };
@@ -21925,10 +21967,10 @@ var init_daemon_download = __esm(() => {
 
 // src/hooks/daemon-client.ts
 import { createConnection as createConnection2 } from "node:net";
-import { existsSync as existsSync21 } from "node:fs";
+import { existsSync as existsSync22 } from "node:fs";
 function daemonSocketPresent() {
   try {
-    return existsSync21(socketPath2());
+    return existsSync22(socketPath2());
   } catch {
     return false;
   }
@@ -21965,7 +22007,7 @@ function encodeFrame2(value) {
   header.writeUInt32BE(body.length, 0);
   return Buffer.concat([header, body]);
 }
-async function attemptDaemonHook2(req, opts) {
+async function attemptDaemonRequest2(request, opts) {
   if (process.platform === "win32")
     return { ok: false, failure: "unreachable" };
   const responseBudget = opts?.responseTimeoutMs ?? DAEMON_RESPONSE_TIMEOUT_MS2;
@@ -21993,14 +22035,7 @@ async function attemptDaemonHook2(req, opts) {
     let declaredLen = null;
     socket.on("connect", () => {
       arm(responseBudget);
-      socket.write(encodeFrame2({
-        type: "hook",
-        protocolVersion: PROTOCOL_VERSION2,
-        hookEvent: req.hookEvent,
-        cli: req.cli,
-        stdin: req.stdin,
-        cwd: req.cwd
-      }));
+      socket.write(encodeFrame2(request));
     });
     socket.on("data", (chunk) => {
       recvBuf = Buffer.concat([recvBuf, chunk]);
@@ -22017,34 +22052,73 @@ async function attemptDaemonHook2(req, opts) {
       if (recvBuf.length < declaredLen)
         return;
       const body = recvBuf.subarray(0, declaredLen);
-      let message;
+      let parsed;
       try {
-        message = JSON.parse(body.toString("utf8"));
+        parsed = JSON.parse(body.toString("utf8"));
       } catch {
         fail("unreachable");
         return;
       }
-      if (message.protocolVersion !== PROTOCOL_VERSION2) {
-        fail("protocol-mismatch");
+      if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+        fail("unreachable");
         return;
       }
-      if (message.type === "hookResult" && typeof message.exitCode === "number" && typeof message.stdout === "string" && typeof message.stderr === "string") {
-        finish({
-          ok: true,
-          response: {
-            exitCode: message.exitCode,
-            stdout: message.stdout,
-            stderr: message.stderr
-          }
-        });
+      const message = parsed;
+      if (message.protocolVersion !== PROTOCOL_VERSION2) {
+        fail("protocol-mismatch");
         return;
       }
-      fail("unreachable");
+      finish({ ok: true, message });
     });
     socket.on("error", () => fail("unreachable"));
     socket.on("close", () => fail("unreachable"));
   });
 }
+async function attemptDaemonHook2(req, opts) {
+  const attempt = await attemptDaemonRequest2({
+    type: "hook",
+    protocolVersion: PROTOCOL_VERSION2,
+    hookEvent: req.hookEvent,
+    cli: req.cli,
+    stdin: req.stdin,
+    cwd: req.cwd
+  }, opts);
+  if (!attempt.ok)
+    return attempt;
+  const message = attempt.message;
+  if (message.type === "hookResult" && typeof message.exitCode === "number" && typeof message.stdout === "string" && typeof message.stderr === "string") {
+    return {
+      ok: true,
+      response: {
+        exitCode: message.exitCode,
+        stdout: message.stdout,
+        stderr: message.stderr
+      }
+    };
+  }
+  return { ok: false, failure: "unreachable" };
+}
+function isStringArray(value) {
+  return Array.isArray(value) && value.every((item) => typeof item === "string");
+}
+async function attemptDaemonPolicyEvaluation(req, opts) {
+  const attempt = await attemptDaemonRequest2({
+    type: "policyEvaluation",
+    protocolVersion: PROTOCOL_VERSION2,
+    integration: req.integration,
+    event: req.event,
+    payload: req.payload,
+    cwd: req.cwd
+  }, opts);
+  if (!attempt.ok)
+    return attempt;
+  const message = attempt.message;
+  const validOptionalString = (value) => value === null || value === undefined || typeof value === "string";
+  if (message.type === "policyResult" && (message.decision === "allow" || message.decision === "deny" || message.decision === "instruct") && isStringArray(message.policyNames) && validOptionalString(message.reason) && isStringArray(message.matchedPolicies) && typeof message.durationMs === "number" && Number.isInteger(message.durationMs) && message.durationMs >= 0 && validOptionalString(message.toolName)) {
+    return { ok: true };
+  }
+  return { ok: false, failure: "unreachable" };
+}
 var PROTOCOL_VERSION2 = 1, DAEMON_CONNECT_TIMEOUT_MS2 = 150, DAEMON_RESPONSE_TIMEOUT_MS2 = 30000, MAX_FRAME_LEN2;
 var init_daemon_client2 = __esm(() => {
   init_fp_home();
@@ -22054,7 +22128,7 @@ var init_daemon_client2 = __esm(() => {
 
 // src/hooks/daemon-service.ts
 import {
-  existsSync as existsSync22,
+  existsSync as existsSync23,
   mkdirSync as mkdirSync11,
   mkdtempSync,
   readFileSync as readFileSync17,
@@ -22085,13 +22159,13 @@ function resolveFailproofaidBinaryPath() {
   if (process.env.FAILPROOFAI_DAEMON_BINARY)
     return process.env.FAILPROOFAI_DAEMON_BINARY;
   const downloaded = installedBinaryPath();
-  if (existsSync22(downloaded))
+  if (existsSync23(downloaded))
     return downloaded;
   const packageRoot = process.env.FAILPROOFAI_PACKAGE_ROOT;
   if (packageRoot) {
     for (const profile of ["release", "debug"]) {
       const candidate = resolve18(packageRoot, "target", profile, "failproofaid");
-      if (existsSync22(candidate))
+      if (existsSync23(candidate))
         return candidate;
     }
   }
@@ -22122,7 +22196,7 @@ function resolveWorkerCommand() {
   if (!packageRoot)
     return null;
   const workerScript = resolve18(packageRoot, "dist", "worker.mjs");
-  if (!existsSync22(workerScript))
+  if (!existsSync23(workerScript))
     return null;
   return `${shellQuote(process.execPath)} ${shellQuote(workerScript)}`;
 }
@@ -22133,7 +22207,7 @@ function resolveCliCommand() {
   if (!packageRoot)
     return null;
   const cliScript = resolve18(packageRoot, "dist", "cli.mjs");
-  if (!existsSync22(cliScript))
+  if (!existsSync23(cliScript))
     return null;
   return `${shellQuote(process.execPath)} ${shellQuote(cliScript)}`;
 }
@@ -22147,7 +22221,7 @@ function workerScriptPath() {
   if (!packageRoot)
     return null;
   const workerScript = resolve18(packageRoot, "dist", "worker.mjs");
-  return existsSync22(workerScript) ? workerScript : null;
+  return existsSync23(workerScript) ? workerScript : null;
 }
 function assertUnitSafe(value, field) {
   if (UNIT_UNSAFE_RE.test(value)) {
@@ -22246,7 +22320,7 @@ function removeLegacyUserService() {
   try {
     if (process.platform === "linux") {
       const legacy = legacySystemdUserUnitPath();
-      if (!existsSync22(legacy))
+      if (!existsSync23(legacy))
         return;
       try {
         execFileSync2("systemctl", ["--user", "disable", "--now", "failproofaid.service"], {
@@ -22263,7 +22337,7 @@ function removeLegacyUserService() {
       } catch {}
     } else {
       const legacyAgent = legacyLaunchAgentPlistPath();
-      if (existsSync22(legacyAgent)) {
+      if (existsSync23(legacyAgent)) {
         try {
           execFileSync2("launchctl", ["unload", "-w", legacyAgent], {
             stdio: "ignore",
@@ -22273,7 +22347,7 @@ function removeLegacyUserService() {
         unlinkSync3(legacyAgent);
       }
       const legacyDaemon = legacySharedLaunchDaemonPath();
-      if (existsSync22(legacyDaemon)) {
+      if (existsSync23(legacyDaemon)) {
         try {
           runPrivileged("launchctl", ["unload", "-w", legacyDaemon]);
         } catch {}
@@ -22290,7 +22364,7 @@ function systemdUnitContents(binaryPath, workerCmd, cliCmd = null) {
   const user = assertUnitSafe(serviceUser(), "User");
   assertUnitSafe(binaryPath, "ExecStart");
   assertUnitSafe(homedir22(), "HOME");
-  const conditionPaths = [binaryPath, workerScriptPath()].filter((p) => typeof p === "string" && existsSync22(p));
+  const conditionPaths = [binaryPath, workerScriptPath()].filter((p) => typeof p === "string" && existsSync23(p));
   const conditionLines = conditionPaths.map((p) => `ConditionPathExists=${assertUnitSafe(p, "ConditionPathExists")}
 `).join("");
   return `[Unit]
@@ -22457,6 +22531,24 @@ async function daemonAcceptsConnectionsQuietly() {
 async function probeDaemonEndToEnd() {
   return (await probeDaemon()).ok;
 }
+async function probeDaemonPolicyEvaluation() {
+  if (!await probeDaemonEndToEnd())
+    return false;
+  try {
+    await Promise.resolve().then(() => init_daemon_client2());
+    const attempt = await attemptDaemonPolicyEvaluation({
+      integration: "hermes",
+      event: "on_session_start",
+      payload: {
+        hook_event_name: "on_session_start",
+        source: "failproofai-native-policy-health-probe"
+      }
+    }, { responseTimeoutMs: DAEMON_PROBE_TIMEOUT_MS });
+    return attempt.ok;
+  } catch {
+    return false;
+  }
+}
 async function waitForDaemonRunning(deps = {}) {
   const status = deps.status ?? daemonServiceStatus;
   const accepts = deps.accepts ?? daemonAcceptsConnectionsQuietly;
@@ -22485,7 +22577,7 @@ function readInstalledServiceDefinition() {
   if (!isDaemonSupportedPlatform())
     return null;
   const path = daemonServiceFilePath();
-  if (!path || !existsSync22(path))
+  if (!path || !existsSync23(path))
     return null;
   try {
     return readFileSync17(path, "utf8");
@@ -22621,7 +22713,7 @@ async function uninstallDaemonService() {
   try {
     if (process.platform === "linux") {
       const unitPath = systemdUnitPath();
-      if (!existsSync22(unitPath))
+      if (!existsSync23(unitPath))
         return;
       try {
         runPrivileged("systemctl", ["disable", "--now", systemdUnitName()]);
@@ -22632,7 +22724,7 @@ async function uninstallDaemonService() {
       } catch {}
     } else {
       const plistPath = launchdPlistPath();
-      if (!existsSync22(plistPath))
+      if (!existsSync23(plistPath))
         return;
       try {
         runPrivileged("launchctl", ["unload", "-w", plistPath]);
@@ -22649,7 +22741,7 @@ function daemonVersionSkew() {
   const recorded = readVersionFile()?.daemon;
   if (!recorded)
     return null;
-  if (!existsSync22(installedBinaryPath(recorded)))
+  if (!existsSync23(installedBinaryPath(recorded)))
     return null;
   return recorded === version2 ? null : { installed: recorded, expected: version2 };
 }
@@ -22667,7 +22759,7 @@ function daemonServiceStatus() {
   if (!isDaemonSupportedPlatform())
     return "unsupported-platform";
   if (process.platform === "linux") {
-    if (!existsSync22(systemdUnitPath()))
+    if (!existsSync23(systemdUnitPath()))
       return "not-installed";
     try {
       const out = execFileSync2("systemctl", ["is-active", systemdUnitName()], {
@@ -22680,7 +22772,7 @@ function daemonServiceStatus() {
     }
   }
   const plistPath = launchdPlistPath();
-  if (!existsSync22(plistPath))
+  if (!existsSync23(plistPath))
     return "not-installed";
   try {
     const root = typeof process.getuid === "function" && process.getuid() === 0;
@@ -22712,7 +22804,7 @@ var init_daemon_service = __esm(() => {
 // src/hooks/fp-reset.ts
 import {
   copyFileSync,
-  existsSync as existsSync23,
+  existsSync as existsSync24,
   mkdirSync as mkdirSync12,
   readFileSync as readFileSync18,
   readdirSync as readdirSync15,
@@ -22725,7 +22817,7 @@ import {
 import { dirname as dirname11, isAbsolute as isAbsolute3, relative as relative4, resolve as resolve19 } from "node:path";
 function migrateConventionPolicies() {
   const from = legacy.customPoliciesDir();
-  if (!existsSync23(from))
+  if (!existsSync24(from))
     return [];
   const moved = [];
   const mergeInto = (dir, dest, prefix) => {
@@ -22746,7 +22838,7 @@ function migrateConventionPolicies() {
       const source = resolve19(dir, entry.name);
       const target = resolve19(dest, entry.name);
       const name = `${prefix}${entry.name}`;
-      if (!existsSync23(target)) {
+      if (!existsSync24(target)) {
         try {
           renameSync7(source, target);
           moved.push(name);
@@ -22773,7 +22865,7 @@ function migrateLegacySpool() {
     [legacy.spoolDir(), spoolDir()],
     [legacy.failedDir(), failedDir()]
   ]) {
-    if (!existsSync23(from))
+    if (!existsSync24(from))
       continue;
     try {
       mkdirSync12(to, { recursive: true });
@@ -22782,7 +22874,7 @@ function migrateLegacySpool() {
           continue;
         let name = entry.name;
         let n = 0;
-        while (existsSync23(resolve19(to, name)))
+        while (existsSync24(resolve19(to, name)))
           name = `legacy-${n++}-${entry.name}`;
         try {
           renameSync7(resolve19(from, entry.name), resolve19(to, name));
@@ -22800,7 +22892,7 @@ function migrateLegacySpool() {
 }
 function migrateHookActivity() {
   const from = legacy.hookActivityDir();
-  if (!existsSync23(from))
+  if (!existsSync24(from))
     return [];
   const moved = [];
   try {
@@ -22815,7 +22907,7 @@ function migrateHookActivity() {
       const source = resolve19(from, entry.name);
       let name = entry.name === "current.jsonl" ? `page-${stamp}-${seq++}.jsonl` : entry.name;
       let target = resolve19(to, name);
-      while (existsSync23(target)) {
+      while (existsSync24(target)) {
         name = `page-${stamp}-${seq++}.jsonl`;
         target = resolve19(to, name);
       }
@@ -22866,7 +22958,7 @@ function retirePolicyConfigKeys() {
 }
 function readCarriedPolicyConfig() {
   const from = resolve19(legacy.localPoliciesDir(), "policies-config.json");
-  if (!existsSync23(from))
+  if (!existsSync24(from))
     return null;
   let parsed;
   try {
@@ -22930,7 +23022,7 @@ function writeCarriedPolicyConfig(carried) {
 }
 function readCarriedTelemetryOptOut() {
   const from = legacy.configToml();
-  if (!existsSync23(from))
+  if (!existsSync24(from))
     return false;
   try {
     const text = readFileSync18(from, "utf8");
@@ -22985,7 +23077,7 @@ function parseLegacyToml(text) {
 }
 function readCarriedLegacyConfig() {
   const from = legacy.configToml();
-  if (!existsSync23(from))
+  if (!existsSync24(from))
     return null;
   try {
     return projectConfig(parseLegacyToml(readFileSync18(from, "utf8")));
@@ -22995,7 +23087,7 @@ function readCarriedLegacyConfig() {
 }
 function readCarriedLegacyCredentials() {
   const toml = legacy.credentialsToml();
-  if (existsSync23(toml)) {
+  if (existsSync24(toml)) {
     try {
       const creds = projectCredentials(parseLegacyToml(readFileSync18(toml, "utf8")));
       if (Object.keys(creds).length > 0)
@@ -23038,7 +23130,7 @@ function resetHome(from, to = LAYOUT_VERSION) {
   const spooled = migrateLegacySpool();
   const removed = [];
   for (const path of resettablePaths()) {
-    if (!existsSync23(path))
+    if (!existsSync24(path))
       continue;
     try {
       rmSync8(path, { recursive: true, force: true });
@@ -23063,7 +23155,7 @@ function layoutWarningForHook() {
   if (state.kind === "future") {
     return `[failproofai] this directory was written by a newer version (layout ${state.found} vs ${LAYOUT_VERSION}) — policies are NOT being enforced. ` + `Upgrade failproofai.`;
   }
-  if (existsSync23(globalPolicyConfigFile()))
+  if (existsSync24(globalPolicyConfigFile()))
     return null;
   return `[failproofai] setup predates this version — global policies are NOT being enforced. ` + `Run \`failproofai config\` to re-create it.`;
 }
@@ -24124,14 +24216,14 @@ var init_collector_config = __esm(() => {
 });
 
 // src/hooks/flush-cli.ts
-import { existsSync as existsSync24, mkdirSync as mkdirSync13, writeFileSync as writeFileSync11, readdirSync as readdirSync16 } from "node:fs";
+import { existsSync as existsSync25, mkdirSync as mkdirSync13, writeFileSync as writeFileSync11, readdirSync as readdirSync16 } from "node:fs";
 import { dirname as dirname12, join as join31 } from "node:path";
 function flushRequestPath(home) {
   return join31(failproofaiHome(home), "state", "flush-request.json");
 }
 function spoolDirs(home) {
   const root = spoolDir(home);
-  if (!existsSync24(root))
+  if (!existsSync25(root))
     return [];
   try {
     return readdirSync16(root, { withFileTypes: true }).filter((e) => e.isDirectory() && e.name !== "failed").map((e) => join31(root, e.name));
@@ -24235,7 +24327,7 @@ var init_flush_cli = __esm(() => {
 import {
   chmodSync as chmodSync4,
   copyFileSync as copyFileSync2,
-  existsSync as existsSync25,
+  existsSync as existsSync26,
   mkdirSync as mkdirSync14,
   readFileSync as readFileSync19,
   renameSync as renameSync8,
@@ -24258,9 +24350,9 @@ function migrateToLayout4() {
   }
   const migrated = [];
   for (const { from, to } of moves) {
-    if (!existsSync25(from))
+    if (!existsSync26(from))
       continue;
-    if (existsSync25(to)) {
+    if (existsSync26(to)) {
       rmSync9(from, { force: true });
       continue;
     }
@@ -24281,7 +24373,7 @@ function migrateToLayout4() {
     migrated.push(`${basename5(from)} → audit/${basename5(to)}`);
   }
   for (const secret of [auditSessionFile()]) {
-    if (!existsSync25(secret))
+    if (!existsSync26(secret))
       continue;
     try {
       chmodSync4(secret, 384);
@@ -24329,10 +24421,10 @@ function pruneMigratedCredentials(from) {
   for (let layout = from;layout < LAYOUT_VERSION; layout++) {
     for (const { as, landsAt } of PRUNED_AFTER_SUCCESS) {
       try {
-        if (!existsSync25(landsAt()))
+        if (!existsSync26(landsAt()))
           continue;
         const copy = resolve20(migrationBackupDir(layout), as);
-        if (!existsSync25(copy))
+        if (!existsSync26(copy))
           continue;
         rmSync9(copy, { force: true });
         pruned.push(as);
@@ -24345,7 +24437,7 @@ function filesToBackUp() {
   const seen = new Map;
   for (const f of [...BACKED_UP, ...BACKED_UP_LEGACY]) {
     const path = f.at();
-    if (existsSync25(path))
+    if (existsSync26(path))
       seen.set(path, backupNameOf(f));
   }
   return [...seen].map(([path, as]) => ({ path, as }));
@@ -24735,7 +24827,7 @@ var NAMESPACE3 = "failproofai-telemetry-v1", API_KEY3 = "phc_Ac1Ww1GqKc0z1SyrRWb
 var init_install_telemetry = () => {};
 
 // lib/install-check.ts
-import { existsSync as existsSync26, readFileSync as readFileSync21, writeFileSync as writeFileSync14, mkdirSync as mkdirSync16 } from "node:fs";
+import { existsSync as existsSync27, readFileSync as readFileSync21, writeFileSync as writeFileSync14, mkdirSync as mkdirSync16 } from "node:fs";
 import { dirname as dirname14, resolve as resolve21 } from "node:path";
 import { platform as platform2, arch as arch2, release, homedir as homedir24, hostname as hostname2 } from "node:os";
 import { createHmac as createHmac2 } from "node:crypto";
@@ -24791,7 +24883,7 @@ function compareSemver(a, b) {
 }
 function checkHooks() {
   const hooksConfigPath = globalPolicyConfigFile();
-  if (!existsSync26(hooksConfigPath)) {
+  if (!existsSync27(hooksConfigPath)) {
     return { configured: false, registered: false, policyCount: 0 };
   }
   let config;
@@ -24805,7 +24897,7 @@ function checkHooks() {
   }
   const policyCount = config.enabledPolicies.length;
   const settingsPath = resolve21(homedir24(), ".claude", "settings.json");
-  if (!existsSync26(settingsPath))
+  if (!existsSync27(settingsPath))
     return { configured: true, registered: false, policyCount };
   let settings;
   try {
@@ -24833,7 +24925,7 @@ async function maybeReportInstall(version) {
     const versionFile = lastVersionPath();
     let previousVersion = null;
     try {
-      if (existsSync26(versionFile)) {
+      if (existsSync27(versionFile)) {
         previousVersion = readFileSync21(versionFile, "utf8").trim() || null;
       }
     } catch {}
@@ -24921,7 +25013,7 @@ var init_cli_error = __esm(() => {
 
 // src/hooks/manager.ts
 import { execSync as execSync6 } from "node:child_process";
-import { existsSync as existsSync27 } from "node:fs";
+import { existsSync as existsSync28 } from "node:fs";
 import { resolve as resolve22, basename as basename6 } from "node:path";
 import { platform as platform3, arch as arch3, release as release2, hostname as hostname3 } from "node:os";
 function getSettingsPath(scope, cwd) {
@@ -25108,8 +25200,11 @@ async function installHooksImpl(policyNames, scope = "user", cwd, includeBeta =
     }
   }
   const selectedClis = cli && cli.length > 0 ? [...new Set(cli)] : ["claude"];
-  for (const cliId of selectedClis) {
-    const integration = getIntegration(cliId);
+  const selectedIntegrations = selectedClis.map((cliId) => ({
+    cliId,
+    integration: getIntegration(cliId)
+  }));
+  for (const { cliId, integration } of selectedIntegrations) {
     if (!integration.scopes.includes(scope)) {
       try {
         await trackHookEvent2(getInstanceId2(), "scope_validation_failed", {
@@ -25121,6 +25216,13 @@ async function installHooksImpl(policyNames, scope = "user", cwd, includeBeta =
       throw new CliError(`Scope "${scope}" is not supported by ${integration.displayName}. ` + `Valid scopes: ${integration.scopes.join(", ")}`);
     }
   }
+  const daemonRequiredBy = selectedIntegrations.map(({ integration }) => integration).filter((integration) => integration.requiresHealthyDaemon);
+  if (daemonRequiredBy.length > 0 && !await probeDaemonPolicyEvaluation()) {
+    const names = daemonRequiredBy.map((integration) => integration.displayName).join(", ");
+    const verb = daemonRequiredBy.length === 1 ? "requires" : "require";
+    throw new CliError(`${names} ${verb} a compatible failproofaid daemon with native policy evaluation before FailproofAI enforcement can be enabled.
+` + "Run `failproofai config` to install or update the daemon, then retry.");
+  }
   const binaryPath = resolveFailproofaiBinary();
   const previousConfig = readScopedHooksConfig(scope, cwd);
   const previousEnabled = new Set(previousConfig.enabledPolicies);
@@ -25143,7 +25245,7 @@ async function installHooksImpl(policyNames, scope = "user", cwd, includeBeta =
   } else if (customPoliciesPath && (typeof customPoliciesPath === "string" || customPoliciesPath.length > 0)) {
     const incoming = (typeof customPoliciesPath === "string" ? [customPoliciesPath] : customPoliciesPath).map((path) => resolve22(path));
     const carried = (previousConfig.customPoliciesPaths ?? (previousConfig.customPoliciesPath ? [previousConfig.customPoliciesPath] : [])).map((path) => resolve22(path)).filter((path) => {
-      if (existsSync27(path))
+      if (existsSync28(path))
         return true;
       console.log(`Dropping custom policies path (file no longer exists): ${path}`);
       return false;
@@ -25371,7 +25473,7 @@ async function removeHooks(policyNames, scope = "user", cwd, opts) {
     const scopesToRemove = scope === "all" ? [...integration.scopes] : integration.scopes.includes(scope) ? [scope] : [];
     for (const s of scopesToRemove) {
       const settingsPaths = settingsPathsFor(integration, s, cwd);
-      const existing = cliId === "hermes" ? settingsPaths : settingsPaths.filter((p) => existsSync27(p));
+      const existing = cliId === "hermes" ? settingsPaths : settingsPaths.filter((p) => existsSync28(p));
       if (existing.length === 0) {
         if (scope !== "all" && selectedClis.length === 1) {
           console.log("No settings file found. Nothing to remove.");
@@ -25454,6 +25556,7 @@ var init_manager = __esm(() => {
   init_pack_store();
   init_pack_manifest();
   init_policy_evaluator();
+  init_daemon_service();
   init_tui();
   VALID_POLICY_NAMES = new Set(BUILTIN_POLICIES.map((p) => p.name));
 });
@@ -25474,7 +25577,7 @@ var DEFAULT_FETCH_TIMEOUT_MS = 15000;
 
 // src/hooks/cloud-enrollment.ts
 import { randomUUID as randomUUID3 } from "node:crypto";
-import { existsSync as existsSync28, readFileSync as readFileSync22, rmSync as rmSync10 } from "node:fs";
+import { existsSync as existsSync29, readFileSync as readFileSync22, rmSync as rmSync10 } from "node:fs";
 import { hostname as hostname4 } from "node:os";
 function cloudCredentialPath() {
   return process.env.FAILPROOFAI_CLOUD_CREDENTIALS ?? credentialsFile();
@@ -25513,7 +25616,7 @@ function readCloudCredentials() {
   if (!usingJsonOverride())
     return readCredentials().cloud ?? null;
   const path = cloudCredentialPath();
-  if (!existsSync28(path))
+  if (!existsSync29(path))
     return null;
   try {
     const raw = JSON.parse(readFileSync22(path, "utf8"));
@@ -25555,7 +25658,7 @@ function resolveMachineLabel(explicit) {
 function clearCloudCredentials() {
   if (usingJsonOverride()) {
     const path = cloudCredentialPath();
-    if (!existsSync28(path))
+    if (!existsSync29(path))
       return false;
     try {
       rmSync10(path);
@@ -25806,7 +25909,7 @@ var init_cloud_connection = __esm(() => {
 });
 
 // src/hooks/setup-state.ts
-import { existsSync as existsSync29, realpathSync as realpathSync2, statSync as statSync18 } from "node:fs";
+import { existsSync as existsSync30, realpathSync as realpathSync2, statSync as statSync18 } from "node:fs";
 import { dirname as dirname15, resolve as resolve23 } from "node:path";
 import { homedir as homedir25 } from "node:os";
 function globalConfigPath(home = homedir25()) {
@@ -25863,10 +25966,10 @@ function detectSetupState(cwd = process.cwd(), home = homedir25()) {
     cwd: resolvedCwd,
     home: resolvedHome,
     projectRoot,
-    hasGlobalConfig: existsSync29(globalConfigPath(resolvedHome)),
-    hasProjectConfig: projectRoot !== resolvedHome && existsSync29(projectConfigPath(projectRoot)),
+    hasGlobalConfig: existsSync30(globalConfigPath(resolvedHome)),
+    hasProjectConfig: projectRoot !== resolvedHome && existsSync30(projectConfigPath(projectRoot)),
     hasGlobalHooks: hasGlobalHooksInstalled(),
-    hasLegacyMarker: existsSync29(legacyMarkerPath(resolvedHome)),
+    hasLegacyMarker: existsSync30(legacyMarkerPath(resolvedHome)),
     inHomeDir: resolvedCwd === resolvedHome
   };
 }
@@ -25883,11 +25986,11 @@ var init_setup_state = __esm(() => {
 });
 
 // src/hooks/onboarding-attempt.ts
-import { existsSync as existsSync30, mkdirSync as mkdirSync17, readFileSync as readFileSync23, rmSync as rmSync11, writeFileSync as writeFileSync15 } from "node:fs";
+import { existsSync as existsSync31, mkdirSync as mkdirSync17, readFileSync as readFileSync23, rmSync as rmSync11, writeFileSync as writeFileSync15 } from "node:fs";
 import { dirname as dirname16 } from "node:path";
 function readOnboardingAttempt() {
   const path = onboardingAttemptFile();
-  if (!existsSync30(path))
+  if (!existsSync31(path))
     return null;
   try {
     const raw = JSON.parse(readFileSync23(path, "utf8"));
@@ -26020,7 +26123,7 @@ var init_onboarding_lock = __esm(() => {
 });
 
 // lib/claude-sessions.ts
-import { readdirSync as readdirSync17, statSync as statSync19, existsSync as existsSync31 } from "node:fs";
+import { readdirSync as readdirSync17, statSync as statSync19, existsSync as existsSync32 } from "node:fs";
 import { join as join34, basename as basename7 } from "node:path";
 function getClaudeProjectsRoot() {
   return getClaudeProjectsPath();
@@ -26067,7 +26170,7 @@ function listClaudeTranscripts(project) {
       } catch {}
     } else if (entry.isDirectory() && UUID_RE2.test(entry.name)) {
       const subDir = join34(project.path, entry.name, "subagents");
-      if (!existsSync31(subDir))
+      if (!existsSync32(subDir))
         continue;
       let subEntries;
       try {
@@ -27410,7 +27513,7 @@ var init_features = __esm(() => {
 
 // src/audit/cache.ts
 import { createHash as createHash8 } from "node:crypto";
-import { existsSync as existsSync32, mkdirSync as mkdirSync19, readFileSync as readFileSync25, writeFileSync as writeFileSync17, chmodSync as chmodSync5, openSync, readSync, closeSync } from "node:fs";
+import { existsSync as existsSync33, mkdirSync as mkdirSync19, readFileSync as readFileSync25, writeFileSync as writeFileSync17, chmodSync as chmodSync5, openSync, readSync, closeSync } from "node:fs";
 import { join as join35 } from "node:path";
 function getEngineVersion() {
   if (cachedEngineVersion)
@@ -27471,7 +27574,7 @@ function readCachedTranscript(transcriptPath, mtimeMs, sizeBytes) {
   if (sizeBytes === 0)
     return null;
   const cachePath = getCachePathFor(transcriptPath);
-  if (!existsSync32(cachePath))
+  if (!existsSync33(cachePath))
     return null;
   try {
     const raw = readFileSync25(cachePath, "utf-8");
@@ -28091,7 +28194,7 @@ var init_audit_lock = __esm(() => {
 });
 
 // src/audit/dashboard-cache.ts
-import { existsSync as existsSync33, readFileSync as readFileSync27 } from "node:fs";
+import { existsSync as existsSync34, readFileSync as readFileSync27 } from "node:fs";
 function getCachePath() {
   return auditDashboardFile();
 }
@@ -28111,7 +28214,7 @@ function writeDashboardCache(params, result) {
 }
 function readDashboardCacheMeta() {
   const cachePath = getCachePath();
-  if (!existsSync33(cachePath))
+  if (!existsSync34(cachePath))
     return null;
   try {
     const raw = readFileSync27(cachePath, "utf-8");
@@ -28338,7 +28441,7 @@ var init_api_server_client = __esm(() => {
 });
 
 // lib/auth/auth-store.ts
-import { existsSync as existsSync34, readFileSync as readFileSync28, readdirSync as readdirSync18, rmSync as rmSync13 } from "node:fs";
+import { existsSync as existsSync35, readFileSync as readFileSync28, readdirSync as readdirSync18, rmSync as rmSync13 } from "node:fs";
 import { join as join36, resolve as resolve24 } from "node:path";
 function getAuthFilePath() {
   const override = process.env.FAILPROOFAI_AUTH_DIR;
@@ -28346,7 +28449,7 @@ function getAuthFilePath() {
 }
 function readAuth() {
   const p = getAuthFilePath();
-  if (!existsSync34(p))
+  if (!existsSync35(p))
     return null;
   try {
     const raw = readFileSync28(p, "utf-8");
@@ -28373,17 +28476,17 @@ function writeAuth(auth) {
 }
 function deleteAuth() {
   const p = getAuthFilePath();
-  if (existsSync34(p))
+  if (existsSync35(p))
     rmSync13(p, { force: true });
   try {
     const root = migrationsDir();
-    if (!existsSync34(root))
+    if (!existsSync35(root))
       return;
     for (const entry of readdirSync18(root)) {
       if (!entry.startsWith("backup-layout"))
         continue;
       const copy = resolve24(root, entry, "auth.json");
-      if (existsSync34(copy))
+      if (existsSync35(copy))
         rmSync13(copy, { force: true });
     }
   } catch {}
@@ -28634,12 +28737,12 @@ var init_harm_report = __esm(() => {
 });
 
 // src/audit/machine-store.ts
-import { existsSync as existsSync35, readFileSync as readFileSync29, rmSync as rmSync14 } from "node:fs";
+import { existsSync as existsSync36, readFileSync as readFileSync29, rmSync as rmSync14 } from "node:fs";
 import { hostname as hostname5 } from "node:os";
 import { randomUUID as randomUUID4 } from "node:crypto";
 function readMachineIdentity(home) {
   const path = auditMachineFile(home);
-  if (!existsSync35(path))
+  if (!existsSync36(path))
     return null;
   try {
     const parsed = JSON.parse(readFileSync29(path, "utf8"));
@@ -28964,7 +29067,7 @@ var init_cli = __esm(() => {
 });
 
 // src/hooks/configure-wizard.ts
-import { existsSync as existsSync36, mkdirSync as mkdirSync21, writeFileSync as writeFileSync19, readFileSync as readFileSync30 } from "node:fs";
+import { existsSync as existsSync37, mkdirSync as mkdirSync21, writeFileSync as writeFileSync19, readFileSync as readFileSync30 } from "node:fs";
 import { homedir as homedir28 } from "node:os";
 import { dirname as dirname17, resolve as resolve25, sep as sep5 } from "node:path";
 async function emit(event, props) {
@@ -28989,7 +29092,7 @@ function setCustomPoliciesEnabled(scope, cwd, enabled) {
   const path = getConfigPathForScope(scope, cwd);
   let config = {};
   try {
-    if (existsSync36(path))
+    if (existsSync37(path))
       config = JSON.parse(readFileSync30(path, "utf8"));
   } catch {
     return;
@@ -29626,14 +29729,14 @@ var init_configure_wizard = __esm(() => {
 });
 
 // src/hooks/flush-cli.ts
-import { existsSync as existsSync37, mkdirSync as mkdirSync22, writeFileSync as writeFileSync20, readdirSync as readdirSync19 } from "node:fs";
+import { existsSync as existsSync38, mkdirSync as mkdirSync22, writeFileSync as writeFileSync20, readdirSync as readdirSync19 } from "node:fs";
 import { dirname as dirname18, join as join37 } from "node:path";
 function flushRequestPath2(home) {
   return join37(failproofaiHome(home), "state", "flush-request.json");
 }
 function spoolDirs2(home) {
   const root = spoolDir(home);
-  if (!existsSync37(root))
+  if (!existsSync38(root))
     return [];
   try {
     return readdirSync19(root, { withFileTypes: true }).filter((e) => e.isDirectory() && e.name !== "failed").map((e) => join37(root, e.name));
@@ -29734,7 +29837,7 @@ var init_flush_cli2 = __esm(() => {
 });
 
 // src/hooks/backfill-cli.ts
-import { existsSync as existsSync38, mkdirSync as mkdirSync23, writeFileSync as writeFileSync21, readdirSync as readdirSync20, statSync as statSync24 } from "node:fs";
+import { existsSync as existsSync39, mkdirSync as mkdirSync23, writeFileSync as writeFileSync21, readdirSync as readdirSync20, statSync as statSync24 } from "node:fs";
 import { dirname as dirname19, join as join38 } from "node:path";
 function backfillRequestPath(home) {
   return join38(failproofaiHome(home), "state", "backfill-request.json");
@@ -29743,7 +29846,7 @@ function surveySessions(sinceMs, homeDir) {
   const out = [];
   for (const { cli, dir } of SESSION_DIRS) {
     const root = join38(homeDir, dir);
-    if (!existsSync38(root))
+    if (!existsSync39(root))
       continue;
     let files = 0;
     let newest = 0;
@@ -29781,7 +29884,7 @@ function runBackfillCommand(opts = {}) {
   const now = opts.now ?? Date.now();
   const sinceMs = opts.sinceMs ?? now - DEFAULT_BACKFILL_DAYS * 24 * 60 * 60 * 1000;
   const home = failproofaiHome();
-  if (!existsSync38(home)) {
+  if (!existsSync39(home)) {
     return {
       exitCode: 1,
       lines: [`No failproofai home at ${home}. Run \`failproofai config\` first.`]
@@ -30112,7 +30215,7 @@ var init_harness_cli = __esm(() => {
 });
 
 // src/hooks/fp-config.ts
-import { chmodSync as chmodSync6, existsSync as existsSync39, mkdirSync as mkdirSync24, readFileSync as readFileSync31, statSync as statSync25, writeFileSync as writeFileSync22 } from "node:fs";
+import { chmodSync as chmodSync6, existsSync as existsSync40, mkdirSync as mkdirSync24, readFileSync as readFileSync31, statSync as statSync25, writeFileSync as writeFileSync22 } from "node:fs";
 function detectLayout2() {
   const raw = readVersionFile2();
   if (raw) {
@@ -30120,17 +30223,17 @@ function detectLayout2() {
       return { kind: "current", version: raw };
     return raw.layout > LAYOUT_VERSION ? { kind: "future", found: raw.layout } : { kind: "stale", found: raw.layout };
   }
-  if (existsSync39(configFile())) {
+  if (existsSync40(configFile())) {
     const layoutThreePositions = [
       legacy.authJson(),
       legacy.nextAudit(),
       legacy.auditSchedule()
     ];
-    if (layoutThreePositions.some((p) => existsSync39(p)))
+    if (layoutThreePositions.some((p) => existsSync40(p)))
       return { kind: "stale", found: 3 };
     return { kind: "current", version: { layout: LAYOUT_VERSION, cli: "" }, inferred: true };
   }
-  if (existsSync39(legacy.configToml()))
+  if (existsSync40(legacy.configToml()))
     return { kind: "stale", found: 2 };
   const layoutOneMarkers = [
     legacy.policyConfig(),
@@ -30141,7 +30244,7 @@ function detectLayout2() {
     legacy.ingestCredentials(),
     legacy.auditDashboard()
   ];
-  return layoutOneMarkers.some((p) => existsSync39(p)) ? { kind: "stale", found: 1 } : { kind: "absent" };
+  return layoutOneMarkers.some((p) => existsSync40(p)) ? { kind: "stale", found: 1 } : { kind: "absent" };
 }
 function readLegacyTomlVersion2(text) {
   const layout = Number(/^\s*layout\s*=\s*(\d+)\s*$/m.exec(text)?.[1]);
@@ -30184,7 +30287,7 @@ var init_fp_home2 = () => {};
 import {
   chmodSync as chmodSync7,
   copyFileSync as copyFileSync3,
-  existsSync as existsSync40,
+  existsSync as existsSync41,
   mkdirSync as mkdirSync25,
   readFileSync as readFileSync32,
   renameSync as renameSync9,
@@ -30207,9 +30310,9 @@ function migrateToLayout42() {
   }
   const migrated = [];
   for (const { from, to } of moves) {
-    if (!existsSync40(from))
+    if (!existsSync41(from))
       continue;
-    if (existsSync40(to)) {
+    if (existsSync41(to)) {
       rmSync15(from, { force: true });
       continue;
     }
@@ -30230,7 +30333,7 @@ function migrateToLayout42() {
     migrated.push(`${basename8(from)} → audit/${basename8(to)}`);
   }
   for (const secret of [auditSessionFile()]) {
-    if (!existsSync40(secret))
+    if (!existsSync41(secret))
       continue;
     try {
       chmodSync7(secret, 384);
@@ -30278,10 +30381,10 @@ function pruneMigratedCredentials2(from) {
   for (let layout = from;layout < LAYOUT_VERSION; layout++) {
     for (const { as, landsAt } of PRUNED_AFTER_SUCCESS2) {
       try {
-        if (!existsSync40(landsAt()))
+        if (!existsSync41(landsAt()))
           continue;
         const copy = resolve27(migrationBackupDir(layout), as);
-        if (!existsSync40(copy))
+        if (!existsSync41(copy))
           continue;
         rmSync15(copy, { force: true });
         pruned.push(as);
@@ -30294,7 +30397,7 @@ function filesToBackUp2() {
   const seen = new Map;
   for (const f of [...BACKED_UP2, ...BACKED_UP_LEGACY2]) {
     const path = f.at();
-    if (existsSync40(path))
+    if (existsSync41(path))
       seen.set(path, backupNameOf2(f));
   }
   return [...seen].map(([path, as]) => ({ path, as }));
@@ -30448,7 +30551,7 @@ var init_migrations2 = __esm(() => {
 
 // src/hooks/daemon-service.ts
 import {
-  existsSync as existsSync41,
+  existsSync as existsSync42,
   mkdirSync as mkdirSync26,
   mkdtempSync as mkdtempSync2,
   readFileSync as readFileSync33,
@@ -30473,13 +30576,13 @@ function resolveFailproofaidBinaryPath2() {
   if (process.env.FAILPROOFAI_DAEMON_BINARY)
     return process.env.FAILPROOFAI_DAEMON_BINARY;
   const downloaded = installedBinaryPath();
-  if (existsSync41(downloaded))
+  if (existsSync42(downloaded))
     return downloaded;
   const packageRoot = process.env.FAILPROOFAI_PACKAGE_ROOT;
   if (packageRoot) {
     for (const profile of ["release", "debug"]) {
       const candidate = resolve28(packageRoot, "target", profile, "failproofaid");
-      if (existsSync41(candidate))
+      if (existsSync42(candidate))
         return candidate;
     }
   }
@@ -30510,7 +30613,7 @@ function resolveWorkerCommand2() {
   if (!packageRoot)
     return null;
   const workerScript = resolve28(packageRoot, "dist", "worker.mjs");
-  if (!existsSync41(workerScript))
+  if (!existsSync42(workerScript))
     return null;
   return `${shellQuote2(process.execPath)} ${shellQuote2(workerScript)}`;
 }
@@ -30521,7 +30624,7 @@ function resolveCliCommand2() {
   if (!packageRoot)
     return null;
   const cliScript = resolve28(packageRoot, "dist", "cli.mjs");
-  if (!existsSync41(cliScript))
+  if (!existsSync42(cliScript))
     return null;
   return `${shellQuote2(process.execPath)} ${shellQuote2(cliScript)}`;
 }
@@ -30535,7 +30638,7 @@ function workerScriptPath2() {
   if (!packageRoot)
     return null;
   const workerScript = resolve28(packageRoot, "dist", "worker.mjs");
-  return existsSync41(workerScript) ? workerScript : null;
+  return existsSync42(workerScript) ? workerScript : null;
 }
 function assertUnitSafe2(value, field) {
   if (UNIT_UNSAFE_RE2.test(value)) {
@@ -30624,7 +30727,7 @@ function removeLegacyUserService2() {
   try {
     if (process.platform === "linux") {
       const legacy = legacySystemdUserUnitPath2();
-      if (!existsSync41(legacy))
+      if (!existsSync42(legacy))
         return;
       try {
         execFileSync3("systemctl", ["--user", "disable", "--now", "failproofaid.service"], {
@@ -30641,7 +30744,7 @@ function removeLegacyUserService2() {
       } catch {}
     } else {
       const legacyAgent = legacyLaunchAgentPlistPath2();
-      if (existsSync41(legacyAgent)) {
+      if (existsSync42(legacyAgent)) {
         try {
           execFileSync3("launchctl", ["unload", "-w", legacyAgent], {
             stdio: "ignore",
@@ -30651,7 +30754,7 @@ function removeLegacyUserService2() {
         unlinkSync5(legacyAgent);
       }
       const legacyDaemon = legacySharedLaunchDaemonPath2();
-      if (existsSync41(legacyDaemon)) {
+      if (existsSync42(legacyDaemon)) {
         try {
           runPrivileged2("launchctl", ["unload", "-w", legacyDaemon]);
         } catch {}
@@ -30668,7 +30771,7 @@ function systemdUnitContents2(binaryPath, workerCmd, cliCmd = null) {
   const user = assertUnitSafe2(serviceUser2(), "User");
   assertUnitSafe2(binaryPath, "ExecStart");
   assertUnitSafe2(homedir30(), "HOME");
-  const conditionPaths = [binaryPath, workerScriptPath2()].filter((p) => typeof p === "string" && existsSync41(p));
+  const conditionPaths = [binaryPath, workerScriptPath2()].filter((p) => typeof p === "string" && existsSync42(p));
   const conditionLines = conditionPaths.map((p) => `ConditionPathExists=${assertUnitSafe2(p, "ConditionPathExists")}
 `).join("");
   return `[Unit]
@@ -30873,7 +30976,7 @@ function daemonServiceStatus2() {
   if (!isDaemonSupportedPlatform2())
     return "unsupported-platform";
   if (process.platform === "linux") {
-    if (!existsSync41(systemdUnitPath2()))
+    if (!existsSync42(systemdUnitPath2()))
       return "not-installed";
     try {
       const out = execFileSync3("systemctl", ["is-active", systemdUnitName2()], {
@@ -30886,7 +30989,7 @@ function daemonServiceStatus2() {
     }
   }
   const plistPath = launchdPlistPath2();
-  if (!existsSync41(plistPath))
+  if (!existsSync42(plistPath))
     return "not-installed";
   try {
     const root = typeof process.getuid === "function" && process.getuid() === 0;
@@ -30916,7 +31019,7 @@ var init_daemon_service2 = __esm(() => {
 });
 
 // src/hooks/uninstall-cli.ts
-import { existsSync as existsSync42, rmSync as rmSync17 } from "node:fs";
+import { existsSync as existsSync43, rmSync as rmSync17 } from "node:fs";
 function survey(cwd) {
   const clis = [];
   for (const id of listInstallableIds()) {
@@ -30937,9 +31040,9 @@ function survey(cwd) {
   return {
     clis,
     servicePath,
-    serviceInstalled: !!servicePath && existsSync42(servicePath),
+    serviceInstalled: !!servicePath && existsSync43(servicePath),
     daemonConfigured,
-    homeExists: existsSync42(failproofaiHome())
+    homeExists: existsSync43(failproofaiHome())
   };
 }
 async function runUninstallCommand(opts = {}) {
@@ -31037,7 +31140,7 @@ async function runUninstallCommand(opts = {}) {
       } catch {}
       try {
         await uninstallDaemonService();
-        if (found.servicePath && existsSync42(found.servicePath)) {
+        if (found.servicePath && existsSync43(found.servicePath)) {
           failures.push(`the service at ${found.servicePath} is still there (most often: no sudo). ` + `Remove it with the commands below.`);
         } else {
           lines.push(`✓ stopped and removed the daemon service`);
@@ -31060,7 +31163,7 @@ async function runUninstallCommand(opts = {}) {
     lines.push(``, `Not everything could be removed:`);
     for (const f of failures)
       lines.push(`  ✗ ${f}`);
-    if (found.servicePath && existsSync42(found.servicePath)) {
+    if (found.servicePath && existsSync43(found.servicePath)) {
       lines.push(``, `To remove the service by hand:`, ...manualServiceRemoval(found.servicePath), ``, `(\`${daemonStatusCommand()}\` shows its current state.)`);
     }
     return { exitCode: 1, lines, planLines, purged };
@@ -31094,7 +31197,7 @@ var init_uninstall_cli = __esm(() => {
 import { execFileSync as execFileSync4 } from "node:child_process";
 import { homedir as homedir31, tmpdir as tmpdir4 } from "node:os";
 import { createHash as createHash9 } from "node:crypto";
-import { copyFileSync as copyFileSync4, existsSync as existsSync43, mkdirSync as mkdirSync27, mkdtempSync as mkdtempSync3, readFileSync as readFileSync34, readdirSync as readdirSync21, realpathSync as realpathSync3, rmSync as rmSync18, statSync as statSync26, writeFileSync as writeFileSync25 } from "node:fs";
+import { copyFileSync as copyFileSync4, existsSync as existsSync44, mkdirSync as mkdirSync27, mkdtempSync as mkdtempSync3, readFileSync as readFileSync34, readdirSync as readdirSync21, realpathSync as realpathSync3, rmSync as rmSync18, statSync as statSync26, writeFileSync as writeFileSync25 } from "node:fs";
 import { basename as basename9, dirname as dirname21, isAbsolute as isAbsolute4, join as join40, relative as relative5, resolve as resolve29, sep as sep6 } from "node:path";
 function parseList(rest, flag) {
   const idx = rest.findIndex((a) => a === flag || a.startsWith(`${flag}=`));
@@ -31209,7 +31312,7 @@ async function build(rest) {
     return fail2([err instanceof Error ? err.message : String(err)]);
   }
   const entryPath = resolve29(entry);
-  if (!existsSync43(entryPath))
+  if (!existsSync44(entryPath))
     return fail2([`No such file: ${entryPath}`]);
   const source = readFileSync34(entryPath, "utf8");
   const localImport = /(?:^|\n)\s*(?:import|export)[^;\n]*from\s+["'](\.[^"']*)["']/.exec(source);
@@ -31404,7 +31507,7 @@ async function scaffold(target) {
     chosen = answer.trim();
   }
   const path = resolve29(withPolicyExtension(chosen ?? "my-policies"));
-  if (existsSync43(path)) {
+  if (existsSync44(path)) {
     return fail2([`${path} already exists — name a different file, or edit that one.`]);
   }
   mkdirSync27(resolve29(path, ".."), { recursive: true });
@@ -32902,7 +33005,7 @@ var init_install_prompt = __esm(() => {
 
 // src/hooks/manager.ts
 import { execSync as execSync7 } from "node:child_process";
-import { existsSync as existsSync44 } from "node:fs";
+import { existsSync as existsSync45 } from "node:fs";
 import { resolve as resolve30, basename as basename10 } from "node:path";
 import { platform as platform4, arch as arch4, release as release3, hostname as hostname6 } from "node:os";
 function getSettingsPath2(scope, cwd) {
@@ -33089,8 +33192,11 @@ async function installHooksImpl2(policyNames, scope = "user", cwd, includeBeta =
     }
   }
   const selectedClis = cli && cli.length > 0 ? [...new Set(cli)] : ["claude"];
-  for (const cliId of selectedClis) {
-    const integration = getIntegration(cliId);
+  const selectedIntegrations = selectedClis.map((cliId) => ({
+    cliId,
+    integration: getIntegration(cliId)
+  }));
+  for (const { cliId, integration } of selectedIntegrations) {
     if (!integration.scopes.includes(scope)) {
       try {
         await trackHookEvent2(getInstanceId2(), "scope_validation_failed", {
@@ -33102,6 +33208,13 @@ async function installHooksImpl2(policyNames, scope = "user", cwd, includeBeta =
       throw new CliError(`Scope "${scope}" is not supported by ${integration.displayName}. ` + `Valid scopes: ${integration.scopes.join(", ")}`);
     }
   }
+  const daemonRequiredBy = selectedIntegrations.map(({ integration }) => integration).filter((integration) => integration.requiresHealthyDaemon);
+  if (daemonRequiredBy.length > 0 && !await probeDaemonPolicyEvaluation()) {
+    const names = daemonRequiredBy.map((integration) => integration.displayName).join(", ");
+    const verb = daemonRequiredBy.length === 1 ? "requires" : "require";
+    throw new CliError(`${names} ${verb} a compatible failproofaid daemon with native policy evaluation before FailproofAI enforcement can be enabled.
+` + "Run `failproofai config` to install or update the daemon, then retry.");
+  }
   const binaryPath = resolveFailproofaiBinary2();
   const previousConfig = readScopedHooksConfig(scope, cwd);
   const previousEnabled = new Set(previousConfig.enabledPolicies);
@@ -33124,7 +33237,7 @@ async function installHooksImpl2(policyNames, scope = "user", cwd, includeBeta =
   } else if (customPoliciesPath && (typeof customPoliciesPath === "string" || customPoliciesPath.length > 0)) {
     const incoming = (typeof customPoliciesPath === "string" ? [customPoliciesPath] : customPoliciesPath).map((path) => resolve30(path));
     const carried = (previousConfig.customPoliciesPaths ?? (previousConfig.customPoliciesPath ? [previousConfig.customPoliciesPath] : [])).map((path) => resolve30(path)).filter((path) => {
-      if (existsSync44(path))
+      if (existsSync45(path))
         return true;
       console.log(`Dropping custom policies path (file no longer exists): ${path}`);
       return false;
@@ -33352,7 +33465,7 @@ async function removeHooks2(policyNames, scope = "user", cwd, opts) {
     const scopesToRemove = scope === "all" ? [...integration.scopes] : integration.scopes.includes(scope) ? [scope] : [];
     for (const s of scopesToRemove) {
       const settingsPaths = settingsPathsFor(integration, s, cwd);
-      const existing = cliId === "hermes" ? settingsPaths : settingsPaths.filter((p) => existsSync44(p));
+      const existing = cliId === "hermes" ? settingsPaths : settingsPaths.filter((p) => existsSync45(p));
       if (existing.length === 0) {
         if (scope !== "all" && selectedClis.length === 1) {
           console.log("No settings file found. Nothing to remove.");
@@ -33498,7 +33611,7 @@ async function listHooks(cwd) {
     for (const path of explicitPaths) {
       const absPath = resolve30(findProjectConfigDir(cwd ?? process.cwd()), path);
       groups.push(note(absPath, opts));
-      if (!existsSync44(absPath)) {
+      if (!existsSync45(absPath)) {
         groups.push(warning([`file not found: ${absPath}`], opts));
         continue;
       }
@@ -33625,6 +33738,7 @@ var init_manager2 = __esm(() => {
   init_pack_store();
   init_pack_manifest();
   init_policy_evaluator();
+  init_daemon_service();
   init_tui();
   VALID_POLICY_NAMES2 = new Set(BUILTIN_POLICIES.map((p) => p.name));
 });
@@ -34060,19 +34174,19 @@ function parseScriptArgs(argv) {
 var init_parse_script_args = () => {};
 
 // scripts/install-diagnosis.mjs
-import { existsSync as existsSync45, readFileSync as readFileSync36, realpathSync as realpathSync4 } from "node:fs";
+import { existsSync as existsSync46, readFileSync as readFileSync36, realpathSync as realpathSync4 } from "node:fs";
 import { dirname as dirname22, resolve as resolve32 } from "node:path";
 import { homedir as homedir32, platform as platform5 } from "node:os";
 import { spawnSync } from "node:child_process";
 function findPackageRoot(start) {
   try {
     let dir = realpathSync4(start);
-    if (existsSync45(dir) && !existsSync45(resolve32(dir, "package.json"))) {
+    if (existsSync46(dir) && !existsSync46(resolve32(dir, "package.json"))) {
       dir = dirname22(dir);
     }
     while (true) {
       const pkgPath = resolve32(dir, "package.json");
-      if (existsSync45(pkgPath)) {
+      if (existsSync46(pkgPath)) {
         try {
           const pkg = JSON.parse(readFileSync36(pkgPath, "utf8"));
           if (pkg.name === PKG_NAME)
@@ -34119,7 +34233,7 @@ function locateNpmGlobal() {
     if (!root)
       return null;
     const candidate = resolve32(root, PKG_NAME);
-    return existsSync45(resolve32(candidate, "package.json")) ? candidate : null;
+    return existsSync46(resolve32(candidate, "package.json")) ? candidate : null;
   } catch {
     return null;
   }
@@ -34127,7 +34241,7 @@ function locateNpmGlobal() {
 function locateBunGlobal() {
   try {
     const candidate = resolve32(homedir32(), ".bun", "install", "global", "node_modules", PKG_NAME);
-    return existsSync45(resolve32(candidate, "package.json")) ? candidate : null;
+    return existsSync46(resolve32(candidate, "package.json")) ? candidate : null;
   } catch {
     return null;
   }
@@ -34230,7 +34344,7 @@ var init_dashboard_host = __esm(() => {
 
 // scripts/launch.ts
 import { spawn as spawn2 } from "child_process";
-import { realpathSync as realpathSync5, existsSync as existsSync46 } from "node:fs";
+import { realpathSync as realpathSync5, existsSync as existsSync47 } from "node:fs";
 import { resolve as resolve33, dirname as dirname23 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 import { createInterface } from "node:readline";
@@ -34257,7 +34371,7 @@ function launch(mode) {
     cmd = "node";
     const packageRoot = process.env.FAILPROOFAI_PACKAGE_ROOT ?? resolve33(dirname23(realpathSync5(fileURLToPath2(import.meta.url))), "..");
     const serverJsPath = resolve33(packageRoot, ".next/standalone/server.js");
-    if (!existsSync46(serverJsPath)) {
+    if (!existsSync47(serverJsPath)) {
       let shadowMessage = null;
       try {
         const diag = diagnoseShadow({ selfPackageRoot: packageRoot, selfVersion: version2 });
@@ -35015,7 +35129,7 @@ import {
   cpSync as cpSync2,
   readFileSync as readFileSync37,
   writeFileSync as writeFileSync26,
-  existsSync as existsSync47,
+  existsSync as existsSync48,
   lstatSync as lstatSync2,
   mkdirSync as mkdirSync28,
   renameSync as renameSync10,
@@ -35025,7 +35139,7 @@ import {
 import { resolve as resolve34, dirname as dirname24 } from "node:path";
 function readYamlDoc2(path) {
   try {
-    return existsSync47(path) ? $parseDocument(readFileSync37(path, "utf8")) : $parseDocument("");
+    return existsSync48(path) ? $parseDocument(readFileSync37(path, "utf8")) : $parseDocument("");
   } catch {
     return $parseDocument("");
   }
@@ -35047,15 +35161,15 @@ function hasManagedHermesPlugin2(settingsPath) {
   try {
     if (lstatSync2(pluginPath).isSymbolicLink())
       return false;
-    if (!existsSync47(resolve34(pluginPath, HERMES_PLUGIN_MARKER2)))
+    if (!existsSync48(resolve34(pluginPath, HERMES_PLUGIN_MARKER2)))
       return false;
-    return HERMES_PLUGIN_FILES2.every((file) => existsSync47(resolve34(pluginPath, file)));
+    return HERMES_PLUGIN_FILES2.every((file) => existsSync48(resolve34(pluginPath, file)));
   } catch {
     return false;
   }
 }
 function hermesConfigState2(settingsPath) {
-  if (!existsSync47(settingsPath)) {
+  if (!existsSync48(settingsPath)) {
     return { pluginEnabled: false, legacyShellHookPresent: false };
   }
   const doc = readYamlDoc2(settingsPath);
@@ -35084,7 +35198,7 @@ function hermesProfileHealth() {
   });
 }
 function hermesProfileStatusRows() {
-  return hermesProfileHealth().filter((profile) => existsSync47(profile.home)).map((profile) => {
+  return hermesProfileHealth().filter((profile) => existsSync48(profile.home)).map((profile) => {
     const problems = [];
     if (!profile.pluginInstalled)
       problems.push("plugin files missing or incomplete");
@@ -35110,7 +35224,7 @@ var init_integrations2 = __esm(() => {
 
 // scripts/launch.ts
 import { spawn as spawn3 } from "child_process";
-import { realpathSync as realpathSync6, existsSync as existsSync48 } from "node:fs";
+import { realpathSync as realpathSync6, existsSync as existsSync49 } from "node:fs";
 import { resolve as resolve35, dirname as dirname25 } from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 import { createInterface as createInterface2 } from "node:readline";
@@ -35137,7 +35251,7 @@ function launch2(mode) {
     cmd = "node";
     const packageRoot = process.env.FAILPROOFAI_PACKAGE_ROOT ?? resolve35(dirname25(realpathSync6(fileURLToPath3(import.meta.url))), "..");
     const serverJsPath = resolve35(packageRoot, ".next/standalone/server.js");
-    if (!existsSync48(serverJsPath)) {
+    if (!existsSync49(serverJsPath)) {
       let shadowMessage = null;
       try {
         const diag = diagnoseShadow({ selfPackageRoot: packageRoot, selfVersion: version2 });
@@ -35237,7 +35351,7 @@ import { realpathSync as realpathSync7 } from "fs";
 import { dirname as dirname26, resolve as resolve36 } from "path";
 import { fileURLToPath as fileURLToPath4 } from "url";
 // package.json
-var version = "1.0.6-beta.0";
+var version = "1.0.6";
 
 // bin/failproofai.mjs
 if (!process.env.FAILPROOFAI_PACKAGE_ROOT) {