failproofai 1.0.6-beta.1 → 1.0.6

package/dist/cli.mjs

@@ -29,7 +29,7 @@ var __esm = (fn, res, err) => () => {
 var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
 // package.json
-var version2 = "1.0.6-beta.1", package_default;
+var version2 = "1.0.6", package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "failproofai",
@@ -155,16 +155,16 @@ var init_package = __esm(() => {
       browserslist: "4.28.8"
     },
     optionalDependencies: {
-      "@failproofai/failproofaid-linux-x64": "1.0.6-beta.1",
-      "@failproofai/failproofaid-linux-arm64": "1.0.6-beta.1",
-      "@failproofai/failproofaid-darwin-x64": "1.0.6-beta.1",
-      "@failproofai/failproofaid-darwin-arm64": "1.0.6-beta.1"
+      "@failproofai/failproofaid-linux-x64": "1.0.6",
+      "@failproofai/failproofaid-linux-arm64": "1.0.6",
+      "@failproofai/failproofaid-darwin-x64": "1.0.6",
+      "@failproofai/failproofaid-darwin-arm64": "1.0.6"
     },
     failproofaidBinaries: {
-      "linux-x64": "b6f877cd407c3322ff8ad2f98a096b6ea15b0bd1d63de6276c689368345c1cd2",
-      "linux-arm64": "0da90a816b9dc707efe9b82176923cbf0f00026179c816e34eaad362ce2c0fa4",
-      "darwin-x64": "bcbec488353fa04a1953a87cad15054e4796117cac4fd60b17fb1c87d62b7b1e",
-      "darwin-arm64": "6830989a91a27642cdcc63fcfad529c69c0deb3f3abcf5ad40fd3516289b451d"
+      "linux-x64": "e075f24a3a0950b631979d9370b665da2c3e2920decfb917ff0831d1f17c9740",
+      "linux-arm64": "b90ce8c642f2685719f4915695615219860daf3155a9c07344cf1e10395028c3",
+      "darwin-x64": "51dd95e9b85226e4f1888c7edaa56ec4464e91eb645d39c5cb7cede16d2da2f1",
+      "darwin-arm64": "f6a1b9d63363e8805e0d72b4fa168fde661bdbbd4125b54047f7de8948ea0f39"
     }
   };
 });
@@ -809,7 +809,7 @@ function encodeFrame(value) {
   header.writeUInt32BE(body.length, 0);
   return Buffer.concat([header, body]);
 }
-async function attemptDaemonHook(req, opts) {
+async function attemptDaemonRequest(request, opts) {
   if (process.platform === "win32")
     return { ok: false, failure: "unreachable" };
   const responseBudget = opts?.responseTimeoutMs ?? DAEMON_RESPONSE_TIMEOUT_MS;
@@ -837,14 +837,7 @@ async function attemptDaemonHook(req, opts) {
     let declaredLen = null;
     socket.on("connect", () => {
       arm(responseBudget);
-      socket.write(encodeFrame({
-        type: "hook",
-        protocolVersion: PROTOCOL_VERSION,
-        hookEvent: req.hookEvent,
-        cli: req.cli,
-        stdin: req.stdin,
-        cwd: req.cwd
-      }));
+      socket.write(encodeFrame(request));
     });
     socket.on("data", (chunk) => {
       recvBuf = Buffer.concat([recvBuf, chunk]);
@@ -861,34 +854,52 @@ async function attemptDaemonHook(req, opts) {
       if (recvBuf.length < declaredLen)
         return;
       const body = recvBuf.subarray(0, declaredLen);
-      let message;
+      let parsed;
       try {
-        message = JSON.parse(body.toString("utf8"));
+        parsed = JSON.parse(body.toString("utf8"));
       } catch {
         fail("unreachable");
         return;
       }
-      if (message.protocolVersion !== PROTOCOL_VERSION) {
-        fail("protocol-mismatch");
+      if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+        fail("unreachable");
         return;
       }
-      if (message.type === "hookResult" && typeof message.exitCode === "number" && typeof message.stdout === "string" && typeof message.stderr === "string") {
-        finish({
-          ok: true,
-          response: {
-            exitCode: message.exitCode,
-            stdout: message.stdout,
-            stderr: message.stderr
-          }
-        });
+      const message = parsed;
+      if (message.protocolVersion !== PROTOCOL_VERSION) {
+        fail("protocol-mismatch");
         return;
       }
-      fail("unreachable");
+      finish({ ok: true, message });
     });
     socket.on("error", () => fail("unreachable"));
     socket.on("close", () => fail("unreachable"));
   });
 }
+async function attemptDaemonHook(req, opts) {
+  const attempt = await attemptDaemonRequest({
+    type: "hook",
+    protocolVersion: PROTOCOL_VERSION,
+    hookEvent: req.hookEvent,
+    cli: req.cli,
+    stdin: req.stdin,
+    cwd: req.cwd
+  }, opts);
+  if (!attempt.ok)
+    return attempt;
+  const message = attempt.message;
+  if (message.type === "hookResult" && typeof message.exitCode === "number" && typeof message.stdout === "string" && typeof message.stderr === "string") {
+    return {
+      ok: true,
+      response: {
+        exitCode: message.exitCode,
+        stdout: message.stdout,
+        stderr: message.stderr
+      }
+    };
+  }
+  return { ok: false, failure: "unreachable" };
+}
 var PROTOCOL_VERSION = 1, DAEMON_CONNECT_TIMEOUT_MS = 150, DAEMON_RESPONSE_TIMEOUT_MS = 30000, MAX_FRAME_LEN;
 var init_daemon_client = __esm(() => {
   init_fp_home();
@@ -21996,7 +22007,7 @@ function encodeFrame2(value) {
   header.writeUInt32BE(body.length, 0);
   return Buffer.concat([header, body]);
 }
-async function attemptDaemonHook2(req, opts) {
+async function attemptDaemonRequest2(request, opts) {
   if (process.platform === "win32")
     return { ok: false, failure: "unreachable" };
   const responseBudget = opts?.responseTimeoutMs ?? DAEMON_RESPONSE_TIMEOUT_MS2;
@@ -22024,14 +22035,7 @@ async function attemptDaemonHook2(req, opts) {
     let declaredLen = null;
     socket.on("connect", () => {
       arm(responseBudget);
-      socket.write(encodeFrame2({
-        type: "hook",
-        protocolVersion: PROTOCOL_VERSION2,
-        hookEvent: req.hookEvent,
-        cli: req.cli,
-        stdin: req.stdin,
-        cwd: req.cwd
-      }));
+      socket.write(encodeFrame2(request));
     });
     socket.on("data", (chunk) => {
       recvBuf = Buffer.concat([recvBuf, chunk]);
@@ -22048,34 +22052,73 @@ async function attemptDaemonHook2(req, opts) {
       if (recvBuf.length < declaredLen)
         return;
       const body = recvBuf.subarray(0, declaredLen);
-      let message;
+      let parsed;
       try {
-        message = JSON.parse(body.toString("utf8"));
+        parsed = JSON.parse(body.toString("utf8"));
       } catch {
         fail("unreachable");
         return;
       }
-      if (message.protocolVersion !== PROTOCOL_VERSION2) {
-        fail("protocol-mismatch");
+      if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+        fail("unreachable");
         return;
       }
-      if (message.type === "hookResult" && typeof message.exitCode === "number" && typeof message.stdout === "string" && typeof message.stderr === "string") {
-        finish({
-          ok: true,
-          response: {
-            exitCode: message.exitCode,
-            stdout: message.stdout,
-            stderr: message.stderr
-          }
-        });
+      const message = parsed;
+      if (message.protocolVersion !== PROTOCOL_VERSION2) {
+        fail("protocol-mismatch");
         return;
       }
-      fail("unreachable");
+      finish({ ok: true, message });
     });
     socket.on("error", () => fail("unreachable"));
     socket.on("close", () => fail("unreachable"));
   });
 }
+async function attemptDaemonHook2(req, opts) {
+  const attempt = await attemptDaemonRequest2({
+    type: "hook",
+    protocolVersion: PROTOCOL_VERSION2,
+    hookEvent: req.hookEvent,
+    cli: req.cli,
+    stdin: req.stdin,
+    cwd: req.cwd
+  }, opts);
+  if (!attempt.ok)
+    return attempt;
+  const message = attempt.message;
+  if (message.type === "hookResult" && typeof message.exitCode === "number" && typeof message.stdout === "string" && typeof message.stderr === "string") {
+    return {
+      ok: true,
+      response: {
+        exitCode: message.exitCode,
+        stdout: message.stdout,
+        stderr: message.stderr
+      }
+    };
+  }
+  return { ok: false, failure: "unreachable" };
+}
+function isStringArray(value) {
+  return Array.isArray(value) && value.every((item) => typeof item === "string");
+}
+async function attemptDaemonPolicyEvaluation(req, opts) {
+  const attempt = await attemptDaemonRequest2({
+    type: "policyEvaluation",
+    protocolVersion: PROTOCOL_VERSION2,
+    integration: req.integration,
+    event: req.event,
+    payload: req.payload,
+    cwd: req.cwd
+  }, opts);
+  if (!attempt.ok)
+    return attempt;
+  const message = attempt.message;
+  const validOptionalString = (value) => value === null || value === undefined || typeof value === "string";
+  if (message.type === "policyResult" && (message.decision === "allow" || message.decision === "deny" || message.decision === "instruct") && isStringArray(message.policyNames) && validOptionalString(message.reason) && isStringArray(message.matchedPolicies) && typeof message.durationMs === "number" && Number.isInteger(message.durationMs) && message.durationMs >= 0 && validOptionalString(message.toolName)) {
+    return { ok: true };
+  }
+  return { ok: false, failure: "unreachable" };
+}
 var PROTOCOL_VERSION2 = 1, DAEMON_CONNECT_TIMEOUT_MS2 = 150, DAEMON_RESPONSE_TIMEOUT_MS2 = 30000, MAX_FRAME_LEN2;
 var init_daemon_client2 = __esm(() => {
   init_fp_home();
@@ -22488,6 +22531,24 @@ async function daemonAcceptsConnectionsQuietly() {
 async function probeDaemonEndToEnd() {
   return (await probeDaemon()).ok;
 }
+async function probeDaemonPolicyEvaluation() {
+  if (!await probeDaemonEndToEnd())
+    return false;
+  try {
+    await Promise.resolve().then(() => init_daemon_client2());
+    const attempt = await attemptDaemonPolicyEvaluation({
+      integration: "hermes",
+      event: "on_session_start",
+      payload: {
+        hook_event_name: "on_session_start",
+        source: "failproofai-native-policy-health-probe"
+      }
+    }, { responseTimeoutMs: DAEMON_PROBE_TIMEOUT_MS });
+    return attempt.ok;
+  } catch {
+    return false;
+  }
+}
 async function waitForDaemonRunning(deps = {}) {
   const status = deps.status ?? daemonServiceStatus;
   const accepts = deps.accepts ?? daemonAcceptsConnectionsQuietly;
@@ -25156,11 +25217,11 @@ async function installHooksImpl(policyNames, scope = "user", cwd, includeBeta =
     }
   }
   const daemonRequiredBy = selectedIntegrations.map(({ integration }) => integration).filter((integration) => integration.requiresHealthyDaemon);
-  if (daemonRequiredBy.length > 0 && !await probeDaemonEndToEnd()) {
+  if (daemonRequiredBy.length > 0 && !await probeDaemonPolicyEvaluation()) {
     const names = daemonRequiredBy.map((integration) => integration.displayName).join(", ");
     const verb = daemonRequiredBy.length === 1 ? "requires" : "require";
-    throw new CliError(`${names} ${verb} a healthy failproofaid daemon before FailproofAI enforcement can be enabled.
-` + "Run `failproofai config` to install and configure the daemon, then retry.");
+    throw new CliError(`${names} ${verb} a compatible failproofaid daemon with native policy evaluation before FailproofAI enforcement can be enabled.
+` + "Run `failproofai config` to install or update the daemon, then retry.");
   }
   const binaryPath = resolveFailproofaiBinary();
   const previousConfig = readScopedHooksConfig(scope, cwd);
@@ -33148,11 +33209,11 @@ async function installHooksImpl2(policyNames, scope = "user", cwd, includeBeta =
     }
   }
   const daemonRequiredBy = selectedIntegrations.map(({ integration }) => integration).filter((integration) => integration.requiresHealthyDaemon);
-  if (daemonRequiredBy.length > 0 && !await probeDaemonEndToEnd()) {
+  if (daemonRequiredBy.length > 0 && !await probeDaemonPolicyEvaluation()) {
     const names = daemonRequiredBy.map((integration) => integration.displayName).join(", ");
     const verb = daemonRequiredBy.length === 1 ? "requires" : "require";
-    throw new CliError(`${names} ${verb} a healthy failproofaid daemon before FailproofAI enforcement can be enabled.
-` + "Run `failproofai config` to install and configure the daemon, then retry.");
+    throw new CliError(`${names} ${verb} a compatible failproofaid daemon with native policy evaluation before FailproofAI enforcement can be enabled.
+` + "Run `failproofai config` to install or update the daemon, then retry.");
   }
   const binaryPath = resolveFailproofaiBinary2();
   const previousConfig = readScopedHooksConfig(scope, cwd);
@@ -35290,7 +35351,7 @@ import { realpathSync as realpathSync7 } from "fs";
 import { dirname as dirname26, resolve as resolve36 } from "path";
 import { fileURLToPath as fileURLToPath4 } from "url";
 // package.json
-var version = "1.0.6-beta.1";
+var version = "1.0.6";
 
 // bin/failproofai.mjs
 if (!process.env.FAILPROOFAI_PACKAGE_ROOT) {

package/dist/worker.mjs

@@ -3483,7 +3483,7 @@ function parsePackPolicyName(canonicalName) {
 }
 
 // package.json
-var version = "1.0.6-beta.1";
+var version = "1.0.6";
 var init_package = () => {};
 
 // src/posthog-key.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "failproofai",
-  "version": "1.0.6-beta.1",
+  "version": "1.0.6",
   "description": "Observability and enforcement for AI agent harnesses. 39 built-in policies hooked into 12 of them — Claude Code, Codex, Cursor, Hermes, OpenClaw and more — blocking the tool call before it runs. Local dashboard included, no account needed.",
   "bin": {
     "failproofai": "./dist/cli.mjs",
@@ -122,15 +122,15 @@
     "browserslist": "4.28.8"
   },
   "optionalDependencies": {
-    "@failproofai/failproofaid-linux-x64": "1.0.6-beta.1",
-    "@failproofai/failproofaid-linux-arm64": "1.0.6-beta.1",
-    "@failproofai/failproofaid-darwin-x64": "1.0.6-beta.1",
-    "@failproofai/failproofaid-darwin-arm64": "1.0.6-beta.1"
+    "@failproofai/failproofaid-linux-x64": "1.0.6",
+    "@failproofai/failproofaid-linux-arm64": "1.0.6",
+    "@failproofai/failproofaid-darwin-x64": "1.0.6",
+    "@failproofai/failproofaid-darwin-arm64": "1.0.6"
   },
   "failproofaidBinaries": {
-    "linux-x64": "b6f877cd407c3322ff8ad2f98a096b6ea15b0bd1d63de6276c689368345c1cd2",
-    "linux-arm64": "0da90a816b9dc707efe9b82176923cbf0f00026179c816e34eaad362ce2c0fa4",
-    "darwin-x64": "bcbec488353fa04a1953a87cad15054e4796117cac4fd60b17fb1c87d62b7b1e",
-    "darwin-arm64": "6830989a91a27642cdcc63fcfad529c69c0deb3f3abcf5ad40fd3516289b451d"
+    "linux-x64": "e075f24a3a0950b631979d9370b665da2c3e2920decfb917ff0831d1f17c9740",
+    "linux-arm64": "b90ce8c642f2685719f4915695615219860daf3155a9c07344cf1e10395028c3",
+    "darwin-x64": "51dd95e9b85226e4f1888c7edaa56ec4464e91eb645d39c5cb7cede16d2da2f1",
+    "darwin-arm64": "f6a1b9d63363e8805e0d72b4fa168fde661bdbbd4125b54047f7de8948ea0f39"
   }
 }

package/src/hooks/daemon-client.ts

@@ -93,6 +93,26 @@ export type DaemonAttempt =
   | { ok: true; response: DaemonHookResponse }
   | { ok: false; failure: DaemonFailure };
 
+export interface DaemonPolicyEvaluationRequest {
+  integration: IntegrationType;
+  event: string;
+  payload: Record<string, unknown>;
+  cwd?: string;
+}
+
+export type DaemonPolicyEvaluationAttempt =
+  | { ok: true }
+  | { ok: false; failure: DaemonFailure };
+
+interface DaemonRequestOptions {
+  /** Override the response budget; the connect budget is never relaxed. */
+  responseTimeoutMs?: number;
+}
+
+type DaemonWireAttempt =
+  | { ok: true; message: Record<string, unknown> }
+  | { ok: false; failure: DaemonFailure };
+
 /**
  * Whether a daemon is listening, regardless of how it was started.
  *
@@ -176,29 +196,22 @@ function encodeFrame(value: unknown): Buffer {
   return Buffer.concat([header, body]);
 }
 
-/** Attempts a daemon evaluation while preserving the failure category. */
-export async function attemptDaemonHook(
-  req: DaemonHookRequest,
-  opts?: {
-    /**
-     * Override the RESPONSE budget only — the connect budget is never
-     * relaxed. Used by the health probe (`probeDaemonEndToEnd`), which runs
-     * from an interactive command rather than a hook and must not make a
-     * person wait out the full 30s hook budget to be told their daemon is
-     * broken. Never set this on the hook path: 30s is matched to the
-     * daemon's own read timeout so this side never gives up on a request the
-     * daemon is still honestly working on.
-     */
-    responseTimeoutMs?: number;
-  },
-): Promise<DaemonAttempt> {
+/**
+ * Sends one framed daemon request while preserving the failure category.
+ * Shape validation belongs to the typed caller: both shell hooks and native
+ * integrations share the transport, but require different response variants.
+ */
+async function attemptDaemonRequest(
+  request: Record<string, unknown>,
+  opts?: DaemonRequestOptions,
+): Promise<DaemonWireAttempt> {
   // Windows never has a daemon in this phase (see the plan's platform
   // scope) — skip the attempt outright rather than depending on however
   // Node happens to behave when handed a POSIX socket path on Windows.
   if (process.platform === "win32") return { ok: false, failure: "unreachable" };
   const responseBudget = opts?.responseTimeoutMs ?? DAEMON_RESPONSE_TIMEOUT_MS;
 
-  return new Promise<DaemonAttempt>((resolvePromise) => {
+  return new Promise<DaemonWireAttempt>((resolvePromise) => {
     let settled = false;
     let timer: ReturnType<typeof setTimeout>;
     const arm = (ms: number) => {
@@ -210,7 +223,7 @@ export async function attemptDaemonHook(
       // process lingers if something upstream forgets to await us.
       timer.unref?.();
     };
-    const finish = (result: DaemonAttempt) => {
+    const finish = (result: DaemonWireAttempt) => {
       if (settled) return;
       settled = true;
       clearTimeout(timer);
@@ -230,16 +243,7 @@ export async function attemptDaemonHook(
       // Connected: the daemon is demonstrably reachable, so the question is
       // no longer "is it there" but "how long does this evaluation take".
       arm(responseBudget);
-      socket.write(
-        encodeFrame({
-          type: "hook",
-          protocolVersion: PROTOCOL_VERSION,
-          hookEvent: req.hookEvent,
-          cli: req.cli,
-          stdin: req.stdin,
-          cwd: req.cwd,
-        }),
-      );
+      socket.write(encodeFrame(request));
     });
 
     socket.on("data", (chunk: Buffer) => {
@@ -258,13 +262,18 @@ export async function attemptDaemonHook(
       if (recvBuf.length < declaredLen) return;
 
       const body = recvBuf.subarray(0, declaredLen);
-      let message: Record<string, unknown>;
+      let parsed: unknown;
       try {
-        message = JSON.parse(body.toString("utf8")) as Record<string, unknown>;
+        parsed = JSON.parse(body.toString("utf8"));
       } catch {
         fail("unreachable");
         return;
       }
+      if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+        fail("unreachable");
+        return;
+      }
+      const message = parsed as Record<string, unknown>;
 
       if (message.protocolVersion !== PROTOCOL_VERSION) {
         // Catches BOTH directions. A newer CLI sends v2 and the daemon replies
@@ -274,29 +283,98 @@ export async function attemptDaemonHook(
         fail("protocol-mismatch");
         return;
       }
-      if (
-        message.type === "hookResult" &&
-        typeof message.exitCode === "number" &&
-        typeof message.stdout === "string" &&
-        typeof message.stderr === "string"
-      ) {
-        finish({
-          ok: true,
-          response: {
-            exitCode: message.exitCode,
-            stdout: message.stdout,
-            stderr: message.stderr,
-          },
-        });
-        return;
-      }
-      // Anything else — an explicit `error` message at a MATCHING protocol
-      // version, a `pong` (protocol confusion), or a well-formed-but-wrong-shape
-      // body — is treated identically to a connection failure: no partial trust.
-      fail("unreachable");
+      finish({ ok: true, message });
     });
 
     socket.on("error", () => fail("unreachable"));
     socket.on("close", () => fail("unreachable"));
   });
 }
+
+/** Attempts a shell-hook daemon evaluation while preserving the failure category. */
+export async function attemptDaemonHook(
+  req: DaemonHookRequest,
+  opts?: DaemonRequestOptions,
+): Promise<DaemonAttempt> {
+  const attempt = await attemptDaemonRequest(
+    {
+      type: "hook",
+      protocolVersion: PROTOCOL_VERSION,
+      hookEvent: req.hookEvent,
+      cli: req.cli,
+      stdin: req.stdin,
+      cwd: req.cwd,
+    },
+    opts,
+  );
+  if (!attempt.ok) return attempt;
+
+  const message = attempt.message;
+  if (
+    message.type === "hookResult" &&
+    typeof message.exitCode === "number" &&
+    typeof message.stdout === "string" &&
+    typeof message.stderr === "string"
+  ) {
+    return {
+      ok: true,
+      response: {
+        exitCode: message.exitCode,
+        stdout: message.stdout,
+        stderr: message.stderr,
+      },
+    };
+  }
+
+  // An explicit matching-version error, pong, or malformed hook result is not
+  // an evaluation. Never grant partial trust to a daemon that answered the
+  // connection but not the request we sent.
+  return { ok: false, failure: "unreachable" };
+}
+
+function isStringArray(value: unknown): value is string[] {
+  return Array.isArray(value) && value.every((item) => typeof item === "string");
+}
+
+/**
+ * Attempts the structured request used by native in-process integrations.
+ * A matching protocol version is not sufficient: pre-native v1 daemons speak
+ * `hook` but cannot deserialize `policyEvaluation`, so only a complete,
+ * well-shaped `policyResult` proves this capability exists.
+ */
+export async function attemptDaemonPolicyEvaluation(
+  req: DaemonPolicyEvaluationRequest,
+  opts?: DaemonRequestOptions,
+): Promise<DaemonPolicyEvaluationAttempt> {
+  const attempt = await attemptDaemonRequest(
+    {
+      type: "policyEvaluation",
+      protocolVersion: PROTOCOL_VERSION,
+      integration: req.integration,
+      event: req.event,
+      payload: req.payload,
+      cwd: req.cwd,
+    },
+    opts,
+  );
+  if (!attempt.ok) return attempt;
+
+  const message = attempt.message;
+  const validOptionalString = (value: unknown) =>
+    value === null || value === undefined || typeof value === "string";
+  if (
+    message.type === "policyResult" &&
+    (message.decision === "allow" || message.decision === "deny" || message.decision === "instruct") &&
+    isStringArray(message.policyNames) &&
+    validOptionalString(message.reason) &&
+    isStringArray(message.matchedPolicies) &&
+    typeof message.durationMs === "number" &&
+    Number.isInteger(message.durationMs) &&
+    message.durationMs >= 0 &&
+    validOptionalString(message.toolName)
+  ) {
+    return { ok: true };
+  }
+
+  return { ok: false, failure: "unreachable" };
+}

package/src/hooks/daemon-service.ts

@@ -1070,6 +1070,36 @@ export async function probeDaemonEndToEnd(): Promise<boolean> {
   return (await probeDaemon()).ok;
 }
 
+/**
+ * Proves that the daemon supports the structured request native plugins use.
+ *
+ * This deliberately follows the ordinary end-to-end hook probe. Besides
+ * retaining its startup-race retry, that makes the failure meaningful: an old
+ * daemon can be fully healthy for shell hooks while still lacking the
+ * `policyEvaluation` variant added for Hermes. Protocol v1 predates that
+ * variant, so version equality alone cannot establish the capability.
+ */
+export async function probeDaemonPolicyEvaluation(): Promise<boolean> {
+  if (!(await probeDaemonEndToEnd())) return false;
+  try {
+    const { attemptDaemonPolicyEvaluation } = await import("./daemon-client");
+    const attempt = await attemptDaemonPolicyEvaluation(
+      {
+        integration: "hermes",
+        event: "on_session_start",
+        payload: {
+          hook_event_name: "on_session_start",
+          source: "failproofai-native-policy-health-probe",
+        },
+      },
+      { responseTimeoutMs: DAEMON_PROBE_TIMEOUT_MS },
+    );
+    return attempt.ok;
+  } catch {
+    return false;
+  }
+}
+
 /**
  * Waits for the service to report running and to HOLD it — a `Type=simple` unit
  * is active the moment it forks, so one optimistic reading passes a daemon that

package/src/hooks/integrations.ts

@@ -124,8 +124,9 @@ export interface Integration {
   displayName: string;
   /**
    * This integration has no in-process/CLI fallback and cannot evaluate policy
-   * unless failproofaid answers an end-to-end probe. Installation must stop
-   * before writing any hook or plugin when the daemon is unavailable.
+   * unless failproofaid answers the structured native-policy probe. Installation
+   * must stop before writing any hook or plugin when the daemon is unavailable
+   * or predates the `policyEvaluation` capability.
    */
   requiresHealthyDaemon?: boolean;
   /** Settings scopes this integration supports (e.g. claude: user/project/local; codex: user/project). */

package/src/hooks/manager.ts

@@ -29,7 +29,7 @@ import { CORE_SOURCE, addPack, setPackPolicyEnabled } from "./pack-store";
 import type { ResolvedPack } from "./pack-manifest";
 import { hasInstalledPacks, readInstalledPacks } from "./pack-manifest";
 import { packPolicyParamKey } from "./policy-evaluator";
-import { probeDaemonEndToEnd } from "./daemon-service";
+import { probeDaemonPolicyEvaluation } from "./daemon-service";
 import {
   chip,
   note,
@@ -477,12 +477,12 @@ async function installHooksImpl(
   const daemonRequiredBy = selectedIntegrations
     .map(({ integration }) => integration)
     .filter((integration) => integration.requiresHealthyDaemon);
-  if (daemonRequiredBy.length > 0 && !(await probeDaemonEndToEnd())) {
+  if (daemonRequiredBy.length > 0 && !(await probeDaemonPolicyEvaluation())) {
     const names = daemonRequiredBy.map((integration) => integration.displayName).join(", ");
     const verb = daemonRequiredBy.length === 1 ? "requires" : "require";
     throw new CliError(
-      `${names} ${verb} a healthy failproofaid daemon before FailproofAI enforcement can be enabled.\n` +
-        "Run `failproofai config` to install and configure the daemon, then retry.",
+      `${names} ${verb} a compatible failproofaid daemon with native policy evaluation before FailproofAI enforcement can be enabled.\n` +
+        "Run `failproofai config` to install or update the daemon, then retry.",
     );
   }