failproofai 1.0.6-beta.1 → 1.0.7-beta.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "failproofai",
-  "version": "1.0.6-beta.1",
+  "version": "1.0.7-beta.0",
   "description": "Observability and enforcement for AI agent harnesses. 39 built-in policies hooked into 12 of them — Claude Code, Codex, Cursor, Hermes, OpenClaw and more — blocking the tool call before it runs. Local dashboard included, no account needed.",
   "bin": {
     "failproofai": "./dist/cli.mjs",
@@ -81,14 +81,14 @@
     "access": "public"
   },
   "devDependencies": {
-    "@anthropic-ai/sdk": "^0.125.0",
+    "@anthropic-ai/sdk": "^0.127.0",
     "@mdx-js/mdx": "^3.1.1",
     "@tailwindcss/postcss": "^4.3.1",
     "@tanstack/react-virtual": "^3.14.10",
     "@testing-library/jest-dom": "^7.0.0",
     "@testing-library/react": "^16.3.2",
     "@testing-library/user-event": "^14.6.5",
-    "@types/node": "26.5.1",
+    "@types/node": "26.6.1",
     "@types/react": "19.3.0",
     "@types/react-dom": "^19.2.3",
     "@vitejs/plugin-react": "^6.1.0",
@@ -122,15 +122,15 @@
     "browserslist": "4.28.8"
   },
   "optionalDependencies": {
-    "@failproofai/failproofaid-linux-x64": "1.0.6-beta.1",
-    "@failproofai/failproofaid-linux-arm64": "1.0.6-beta.1",
-    "@failproofai/failproofaid-darwin-x64": "1.0.6-beta.1",
-    "@failproofai/failproofaid-darwin-arm64": "1.0.6-beta.1"
+    "@failproofai/failproofaid-linux-x64": "1.0.7-beta.0",
+    "@failproofai/failproofaid-linux-arm64": "1.0.7-beta.0",
+    "@failproofai/failproofaid-darwin-x64": "1.0.7-beta.0",
+    "@failproofai/failproofaid-darwin-arm64": "1.0.7-beta.0"
   },
   "failproofaidBinaries": {
-    "linux-x64": "b6f877cd407c3322ff8ad2f98a096b6ea15b0bd1d63de6276c689368345c1cd2",
-    "linux-arm64": "0da90a816b9dc707efe9b82176923cbf0f00026179c816e34eaad362ce2c0fa4",
-    "darwin-x64": "bcbec488353fa04a1953a87cad15054e4796117cac4fd60b17fb1c87d62b7b1e",
-    "darwin-arm64": "6830989a91a27642cdcc63fcfad529c69c0deb3f3abcf5ad40fd3516289b451d"
+    "linux-x64": "3ac234868fe9149179c32981da9ae1209371e98df7ffb09c6a4947664a3d6857",
+    "linux-arm64": "3603faac5741c321a63ba5a963e0cb4bb38c84663a63b53f764faae020116f90",
+    "darwin-x64": "c8a5b32a1e97b5a7f76ce4e42c78f0d566d108be65fdca3c6cd59c405f39b946",
+    "darwin-arm64": "255ac741c3ee3069591b1eb8bbf397baa0722ef240b83a8540b73f3f1b35722c"
   }
 }

package/pi-extension/index.ts

@@ -404,6 +404,17 @@ export default function failproofaiBridge(pi: PiExtensionApi) {
       session_id: resolveSessionId(e.sessionId, resolveCwd(e.cwd)),
       cwd: resolveCwd(e.cwd),
       hook_event_name: "UserPromptSubmit",
+      // "interactive" | "rpc" | "extension": which channel the input came
+      // through, and the only mark Pi gives about who wrote the prompt. It
+      // names the channel, not the author — `pi -p "<text>"` reports
+      // `interactive` exactly as a person typing does — so the Jev evaluator
+      // uses it only in the direction it is reliable in (`piMachineTurn`,
+      // src/hooks/semantic/intent.ts): `extension`, another extension's
+      // `sendUserMessage()` whose text can be model-written or repo-derived,
+      // is refused, while `interactive`, `rpc` and an absent value are all
+      // recorded as the human's request. Policies read it too, and a later Pi
+      // build may say more here.
+      input_source: e.source,
     });
     if (decision.block) {
       console.error(`[failproofai] prompt blocked: ${decision.reason ?? "blocked by policy"}`);

package/scripts/build-policy-pack.mjs

@@ -31,6 +31,24 @@
  * that stops an agent disabling failproofai, it ships compiled in, and
  * `pack-manifest.ts` REFUSES any pack that declares `alwaysOn`. A pack containing
  * it would be rejected by our own loader — correctly.
+ *
+ * **Every policy states its authority** — whether Jev may clear its verdict —
+ * as the registry would resolve it (`manifestAuthority`), not as a copy of
+ * whatever the catalog happened to spell. A machine running this pack reads
+ * authority from the MANIFEST, so a field left off here is a policy that is
+ * silently hard everywhere it is installed. The entry passes the same fields to
+ * `customPolicies.add`, so a manifest rebuilt from the entry (`failproofai
+ * publish`) says the same thing.
+ *
+ * **It emits no `semantic` array, deliberately.** A pack that declares one
+ * REPLACES this build's compiled-in semantic set wholesale
+ * (`semantic/pack-policies.ts`), and this pack is the dress rehearsal for the
+ * regex floor leaving the package — not for Jev's question set leaving it. So
+ * the 39 builtins travel and the 16 semantic policies stay compiled in, which
+ * also keeps `manifestAuthority` below judging `reviewedBy` against the right
+ * list: the builtin reviewer names, which is what a machine installing this pack
+ * will still be running. The separate `FailproofAI/jev-policies` pack is where
+ * the semantic half ships, and it declares its own `minCliVersion`.
  */
 import { execFileSync } from "node:child_process";
 import { createHash } from "node:crypto";
@@ -40,6 +58,7 @@ import { fileURLToPath } from "node:url";
 // The one place the pack's id is decided. Imported rather than restated — see
 // PACK_ID below for what restating it cost.
 import { CORE_SOURCE } from "../src/hooks/pack-store.ts";
+import { manifestAuthority } from "../src/hooks/policy-authority.ts";
 
 const ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "..");
 // `--out <dir>` lets the conformance test generate into a temp directory rather
@@ -95,6 +114,9 @@ for (const policy of BUILTIN_POLICIES) {
     defaultEnabled: policy.defaultEnabled === true,
     match: policy.match,
     fn: policy.fn,
+    // Whether Jev may clear it; see the note on authority at the top.
+    ...(policy.authority !== undefined ? { authority: policy.authority } : {}),
+    ...(policy.reviewedBy !== undefined ? { reviewedBy: policy.reviewedBy } : {}),
   });
 }
 `;
@@ -120,7 +142,20 @@ try {
 // validates these with the loader's own rules, so a shape the loader would
 // refuse fails this build rather than shipping.
 const { POLICY_CATALOG } = await import(join(ROOT, "src/hooks/policy-catalog.ts"));
-const policies = POLICY_CATALOG.filter((p) => !p.alwaysOn).map((p) => ({ ...p }));
+const policies = POLICY_CATALOG.filter((p) => !p.alwaysOn).map((p) => {
+  // Throws on a declaration the registry would quietly downgrade: in the
+  // catalog that is a typo or a renamed semantic policy, and publishing it
+  // would turn a reviewed decision into an unannounced hard one. The fields
+  // come from the same call, so the check cannot be skipped without the
+  // manifest losing its authority too.
+  const resolved = manifestAuthority(p);
+  // Spread first so every field keeps its catalog position; only the two
+  // authority fields are replaced by their resolved values.
+  const entry = { ...p, authority: resolved.authority };
+  if (resolved.reviewedBy) entry.reviewedBy = resolved.reviewedBy;
+  else delete entry.reviewedBy;
+  return entry;
+});
 
 const manifest = JSON.stringify(
   { id: PACK_ID, version, effect: "enforce", policies },
@@ -138,8 +173,10 @@ writeFileSync(
 );
 
 const omitted = POLICY_CATALOG.filter((p) => p.alwaysOn).map((p) => p.name);
+const reviewable = policies.filter((p) => p.authority === "reviewable").length;
 console.log(
-  `[policy-pack] ${PACK_ID}@${version} — ${policies.length} policies, ` +
+  `[policy-pack] ${PACK_ID}@${version} — ${policies.length} policies ` +
+  `(${reviewable} reviewable by Jev, ${policies.length - reviewable} hard), ` +
   `${(entryBytes.length / 1024).toFixed(1)} KB entry` +
   (omitted.length ? `; omitted alwaysOn: ${omitted.join(", ")}` : ""),
 );

package/src/hooks/builtin-policies.ts

@@ -2215,17 +2215,29 @@ const READ_LIKE_CMDS =
  * separator characters that appear in compound argv tokens (':' for Docker
  * volume mounts and PATH-like lists, '=' for env var assignments) so that a
  * suffix like '/dashboard.mdx' in 'docs/STAR/dashboard.mdx' or '/docs' in
- * '-v HOST_DIR:/docs' is not misread as a standalone absolute path.
+ * '-v HOST_DIR:/docs' is not misread as a standalone absolute path. '/' is in
+ * that list too, so a match cannot START on the second slash of a protocol
+ * separator: 'http://localhost:3000/x' used to yield '/localhost:3000/x'.
+ * A match that starts on the FIRST slash is untouched, so '//etc/passwd' —
+ * a real, working spelling of /etc/passwd — is still extracted and still
+ * resolves to /etc/passwd.
+ *
+ * Runs of slashes with nothing else ('//', '///') are dropped: those are a
+ * line-comment marker, not a directory. They used to resolve to the filesystem
+ * root, which denied any read-like command carrying a '// …' comment — a
+ * heredoc writing a TypeScript file into the project, say. A lone '/' is the
+ * root and is kept.
  */
 function extractAbsolutePaths(command: string): string[] {
   const paths: string[] = [];
-  const pathRe = /(?<![a-zA-Z0-9_.\-~\\*?:=])(?:~\/[^\s;|&"'()\[\]{}]*|~(?=\s|$|[;|&"'()\[\]{}])|\/[^\s;|&"'()\[\]{}]*)/g;
+  const pathRe = /(?<![a-zA-Z0-9_.\-~\\*?:=/])(?:~\/[^\s;|&"'()\[\]{}]*|~(?=\s|$|[;|&"'()\[\]{}])|\/[^\s;|&"'()\[\]{}]*)/g;
 
   function addPaths(s: string): void {
     pathRe.lastIndex = 0;
     let m: RegExpExecArray | null;
     while ((m = pathRe.exec(s)) !== null) {
       let p = m[0];
+      if (/^\/{2,}$/.test(p)) continue; // a `//` comment marker, not the root
       if (p === "~") p = homedir();
       else if (p.startsWith("~/")) p = join(homedir(), p.slice(2));
       paths.push(p);
@@ -3178,7 +3190,13 @@ export function registerBuiltinPolicies(enabledNames: string[]): void {
     // A guard against the agent disabling failproofai that any of those can
     // switch off is not a guard.
     if (policy.alwaysOn || enabledSet.has(normalizePolicyName(policy.name))) {
-      registerPolicy(policy.name, policy.description, policy.fn, policy.match, 0, policy.params);
+      // `alwaysOn` travels with the declaration so the self-protection guard
+      // resolves to hard even if its catalog entry ever said otherwise.
+      registerPolicy(policy.name, policy.description, policy.fn, policy.match, 0, policy.params, {
+        authority: policy.authority,
+        reviewedBy: policy.reviewedBy,
+        alwaysOn: policy.alwaysOn,
+      });
     }
   }
 }

package/src/hooks/cloud-enrollment-cli.ts

@@ -377,7 +377,7 @@ export function versionStatusLines(): string[] {
   const daemon = recorded?.daemon ?? "not installed";
   return [
     `CLI ${cliVersion} · daemon ${daemon}${skew ? " (STALE)" : ""} · layout ${recorded?.layout ?? "-"}`,
-    ...(skew ? ["  Run `failproofai config` to update the daemon."] : []),
+    ...(skew ? ["  Run `failproofai update` to update the daemon."] : []),
   ];
 }
 

package/src/hooks/cloud-managed-policies.ts

@@ -8,6 +8,8 @@ import { createHash } from "node:crypto";
 import { existsSync, readFileSync, realpathSync, rmSync } from "node:fs";
 import { isAbsolute, relative, resolve } from "node:path";
 import { cloudPoliciesDir } from "./fp-home";
+import { authorityFieldsOf } from "./policy-authority";
+import type { PolicyAuthority } from "./policy-types";
 
 /**
  * Active-manifest schema versions this reader accepts.
@@ -44,6 +46,19 @@ export interface CloudManagedPolicyArtifact {
   sha256: string;
   path: string;
   deployment: number;
+  /**
+   * Whether Jev may clear this policy's verdict once it is configured, as the
+   * ASSIGNMENT declares it — code inside the artifact cannot grant itself this.
+   * Absent means `hard`, which is what keeps Jev from weakening central
+   * enforcement by default: a cloud policy is only ever reviewable because
+   * whoever deployed it said so. Applies to every hook the artifact registers.
+   *
+   * Read and validated here; the daemon has to carry it into `active.json`
+   * (`ActivePolicy` in `cloud_policies.rs`) before a deployment can set it.
+   */
+  authority?: PolicyAuthority;
+  /** The semantic policies that must all be asked and none answer `deny`; see `authority`. */
+  reviewedBy?: string[];
 }
 
 interface ActiveManifest {
@@ -55,6 +70,8 @@ interface ActiveManifest {
     effect?: string;
     sha256: string;
     path: string;
+    authority?: unknown;
+    reviewedBy?: unknown;
   }>;
 }
 
@@ -206,6 +223,11 @@ export function readActiveCloudManagedPolicies(): CloudManagedPolicyArtifact[] {
       sha256: policy.sha256,
       path,
       deployment: manifest.deployment,
+      // Unlike `effect`, a malformed authority is dropped rather than refused:
+      // dropping it makes this policy `hard`, the default that keeps enforcing,
+      // while refusing would take the whole deployment down over an optional
+      // field. Absent stays absent.
+      ...authorityFieldsOf(policy as unknown as Record<string, unknown>),
     };
   });
 }

package/src/hooks/custom-hooks-loader.ts

@@ -33,6 +33,7 @@ import type { CustomHook, PolicyCatalogEntry } from "./policy-types";
 import type { CloudManagedPolicyArtifact } from "./cloud-managed-policies";
 import type { ResolvedPack } from "./pack-manifest";
 import { customPoliciesDir, shimsDir } from "./fp-home";
+import { warnAuthority, withMergedAuthority } from "./policy-authority";
 
 const LOADING_KEY = "__FAILPROOFAI_LOADING_HOOKS__";
 
@@ -448,9 +449,19 @@ export async function loadAllCustomHooks(
       `cloud-managed policies ${existing.id} and ${policy.id} have identical source, so they share ` +
         `one artifact and load as one policy; enforcing it if either asks to enforce`,
     );
-    if (existing.effect !== "enforce" && policy.effect === "enforce") {
-      cloudManagedByPath.set(key, policy);
+    // Authority resolves toward HARD, for the same reason: reviewable only if
+    // every assignment behind these bytes says so. Keeping one record's
+    // declaration let the order of active.json decide, so a team's reviewable
+    // assignment could clear what an org-wide hard one enforces.
+    const winner = existing.effect !== "enforce" && policy.effect === "enforce" ? policy : existing;
+    const { merged, overruled } = withMergedAuthority(winner, [existing, policy]);
+    if (overruled) {
+      warnAuthority(
+        `cloud-managed policies ${existing.id} and ${policy.id} share one artifact and do not all declare it ` +
+          `reviewable, so it stays hard`,
+      );
     }
+    cloudManagedByPath.set(key, merged);
   }
 
   // Installed packs, keyed by artifact path — the same content-addressing, and
@@ -482,14 +493,34 @@ export async function loadAllCustomHooks(
    *
    * Winner precedence on a name both declare, because the merged record carries
    * the winner's id and version and there is no merging two different defaults.
+   *
+   * Except AUTHORITY, which resolves toward hard like the effect resolves toward
+   * enforce (`withMergedAuthority`): a name is reviewable only if every pack
+   * behind the artifact declares it reviewable. A pack whose manifest does not
+   * list the name at all counts as hard — its copy of the artifact registers
+   * the policy all the same, undeclared, and an undeclared pack policy is hard.
+   * Winner precedence here would let one pack's manifest make another pack's
+   * policy reviewable, which is the one thing a manifest may never do.
    */
   const unionCatalog = (
     winner: PolicyCatalogEntry[],
     other: PolicyCatalogEntry[],
-  ): PolicyCatalogEntry[] => [
-    ...winner,
-    ...other.filter((p) => !winner.some((w) => w.name === p.name)),
-  ];
+  ): { policies: PolicyCatalogEntry[]; overruled: string[] } => {
+    /** Names a pack asked to be reviewable and did not get, for the warning. */
+    const overruled: string[] = [];
+    const harden = (entry: PolicyCatalogEntry, peer: PolicyCatalogEntry | undefined) => {
+      const r = withMergedAuthority(entry, [entry, peer ?? {}]);
+      if (r.overruled) overruled.push(entry.name);
+      return r.merged;
+    };
+    return {
+      policies: [
+        ...winner.map((w) => harden(w, other.find((p) => p.name === w.name))),
+        ...other.filter((p) => !winner.some((w) => w.name === p.name)).map((p) => harden(p, undefined)),
+      ],
+      overruled,
+    };
+  };
 
   const packByPath = new Map<string, ResolvedPack>();
   /**
@@ -535,12 +566,19 @@ export async function loadAllCustomHooks(
     // being intersected away.
     const winner = existing.effect !== "enforce" && pack.effect === "enforce" ? pack : existing;
     const other = winner === existing ? pack : existing;
+    const catalog = unionCatalog(winner.policies, other.policies);
     packByPath.set(key, {
       ...winner,
-      policies: unionCatalog(winner.policies, other.policies),
+      policies: catalog.policies,
       enabled: unionSelection(winner.enabled, other.enabled),
       clis: unionSelection(winner.clis, other.clis),
     });
+    if (catalog.overruled.length > 0) {
+      warnAuthority(
+        `packs ${existing.id} and ${pack.id} share one artifact and do not all declare ` +
+          `${catalog.overruled.join(", ")} reviewable, so ${catalog.overruled.length === 1 ? "it stays" : "they stay"} hard`,
+      );
+    }
   }
 
   // 1. Explicit custom policy paths. Accept a string for callers/configs using

package/src/hooks/custom-hooks-registry.ts

@@ -4,9 +4,14 @@
  * from 'failproofai') and the hook handler (which reads from this file) share the
  * same in-process state when running within the same Node.js process.
  */
-import type { CustomHook } from "./policy-types";
+import type { CustomHook, SemanticPolicyDeclaration } from "./policy-types";
 
 const REGISTRY_KEY = "__failproofai_custom_hooks__";
+/**
+ * Beside the hook registry, on the same key namespace and cleared by the same
+ * call — the two are one registration pass and a build step reads both.
+ */
+const SEMANTIC_KEY = "__failproofai_semantic_policies__";
 
 function getRegistry(): CustomHook[] {
   const g = globalThis as Record<string, unknown>;
@@ -14,17 +19,56 @@ function getRegistry(): CustomHook[] {
   return g[REGISTRY_KEY] as CustomHook[];
 }
 
+function getSemanticRegistry(): SemanticPolicyDeclaration[] {
+  const g = globalThis as Record<string, unknown>;
+  if (!Array.isArray(g[SEMANTIC_KEY])) g[SEMANTIC_KEY] = [];
+  return g[SEMANTIC_KEY] as SemanticPolicyDeclaration[];
+}
+
 export const customPolicies = {
   add(hook: CustomHook): void {
     getRegistry().push(hook);
   },
 };
 
+/**
+ * Register a semantic (Jev) policy — a question set for the classifier, read by
+ * `failproofai publish` and emitted as the pack manifest's `semantic` array.
+ *
+ * A SEPARATE namespace from `customPolicies`, deliberately, rather than a
+ * `customPolicies.addSemantic`. A semantic policy has no `fn` and no `match`,
+ * and nothing about it ever executes on a user's machine: what installs is the
+ * declaration in the manifest, and the artifact's call here matters only at
+ * build time. Putting it behind the object whose entries return
+ * `allow()`/`deny()` invites exactly the shape confusion the manifest parser
+ * would then have to catch — a function on a semantic entry, a probe list on a
+ * regex one — and both mistakes would be silent until somebody read a manifest.
+ *
+ * Nothing is validated here. `parsePackSemanticPolicy` in `pack-manifest.ts`
+ * owns every rule, and it is applied at BUILD time (where the author can still
+ * fix it) and again at load time (where the bytes may have come from anywhere).
+ * Validating a third time in the setter would be a third copy of the rules.
+ */
+export const semanticPolicies = {
+  add(policy: SemanticPolicyDeclaration): void {
+    getSemanticRegistry().push(policy);
+  },
+};
+
 export function getCustomHooks(): CustomHook[] {
   return getRegistry();
 }
 
+export function getSemanticRegistrations(): SemanticPolicyDeclaration[] {
+  return getSemanticRegistry();
+}
+
 export function clearCustomHooks(): void {
   const g = globalThis as Record<string, unknown>;
   g[REGISTRY_KEY] = [];
+  // Both maps, on one call. A loader that cleared only the hooks would carry
+  // one entry file's semantic policies into the next file's build — and since
+  // the semantic half is read after the load rather than during it, the extras
+  // would be published under the wrong pack with nothing to notice.
+  g[SEMANTIC_KEY] = [];
 }

package/src/hooks/daemon-client.ts

@@ -93,6 +93,26 @@ export type DaemonAttempt =
   | { ok: true; response: DaemonHookResponse }
   | { ok: false; failure: DaemonFailure };
 
+export interface DaemonPolicyEvaluationRequest {
+  integration: IntegrationType;
+  event: string;
+  payload: Record<string, unknown>;
+  cwd?: string;
+}
+
+export type DaemonPolicyEvaluationAttempt =
+  | { ok: true }
+  | { ok: false; failure: DaemonFailure };
+
+interface DaemonRequestOptions {
+  /** Override the response budget; the connect budget is never relaxed. */
+  responseTimeoutMs?: number;
+}
+
+type DaemonWireAttempt =
+  | { ok: true; message: Record<string, unknown> }
+  | { ok: false; failure: DaemonFailure };
+
 /**
  * Whether a daemon is listening, regardless of how it was started.
  *
@@ -176,29 +196,22 @@ function encodeFrame(value: unknown): Buffer {
   return Buffer.concat([header, body]);
 }
 
-/** Attempts a daemon evaluation while preserving the failure category. */
-export async function attemptDaemonHook(
-  req: DaemonHookRequest,
-  opts?: {
-    /**
-     * Override the RESPONSE budget only — the connect budget is never
-     * relaxed. Used by the health probe (`probeDaemonEndToEnd`), which runs
-     * from an interactive command rather than a hook and must not make a
-     * person wait out the full 30s hook budget to be told their daemon is
-     * broken. Never set this on the hook path: 30s is matched to the
-     * daemon's own read timeout so this side never gives up on a request the
-     * daemon is still honestly working on.
-     */
-    responseTimeoutMs?: number;
-  },
-): Promise<DaemonAttempt> {
+/**
+ * Sends one framed daemon request while preserving the failure category.
+ * Shape validation belongs to the typed caller: both shell hooks and native
+ * integrations share the transport, but require different response variants.
+ */
+async function attemptDaemonRequest(
+  request: Record<string, unknown>,
+  opts?: DaemonRequestOptions,
+): Promise<DaemonWireAttempt> {
   // Windows never has a daemon in this phase (see the plan's platform
   // scope) — skip the attempt outright rather than depending on however
   // Node happens to behave when handed a POSIX socket path on Windows.
   if (process.platform === "win32") return { ok: false, failure: "unreachable" };
   const responseBudget = opts?.responseTimeoutMs ?? DAEMON_RESPONSE_TIMEOUT_MS;
 
-  return new Promise<DaemonAttempt>((resolvePromise) => {
+  return new Promise<DaemonWireAttempt>((resolvePromise) => {
     let settled = false;
     let timer: ReturnType<typeof setTimeout>;
     const arm = (ms: number) => {
@@ -210,7 +223,7 @@ export async function attemptDaemonHook(
       // process lingers if something upstream forgets to await us.
       timer.unref?.();
     };
-    const finish = (result: DaemonAttempt) => {
+    const finish = (result: DaemonWireAttempt) => {
       if (settled) return;
       settled = true;
       clearTimeout(timer);
@@ -230,16 +243,7 @@ export async function attemptDaemonHook(
       // Connected: the daemon is demonstrably reachable, so the question is
       // no longer "is it there" but "how long does this evaluation take".
       arm(responseBudget);
-      socket.write(
-        encodeFrame({
-          type: "hook",
-          protocolVersion: PROTOCOL_VERSION,
-          hookEvent: req.hookEvent,
-          cli: req.cli,
-          stdin: req.stdin,
-          cwd: req.cwd,
-        }),
-      );
+      socket.write(encodeFrame(request));
     });
 
     socket.on("data", (chunk: Buffer) => {
@@ -258,13 +262,18 @@ export async function attemptDaemonHook(
       if (recvBuf.length < declaredLen) return;
 
       const body = recvBuf.subarray(0, declaredLen);
-      let message: Record<string, unknown>;
+      let parsed: unknown;
       try {
-        message = JSON.parse(body.toString("utf8")) as Record<string, unknown>;
+        parsed = JSON.parse(body.toString("utf8"));
       } catch {
         fail("unreachable");
         return;
       }
+      if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+        fail("unreachable");
+        return;
+      }
+      const message = parsed as Record<string, unknown>;
 
       if (message.protocolVersion !== PROTOCOL_VERSION) {
         // Catches BOTH directions. A newer CLI sends v2 and the daemon replies
@@ -274,29 +283,98 @@ export async function attemptDaemonHook(
         fail("protocol-mismatch");
         return;
       }
-      if (
-        message.type === "hookResult" &&
-        typeof message.exitCode === "number" &&
-        typeof message.stdout === "string" &&
-        typeof message.stderr === "string"
-      ) {
-        finish({
-          ok: true,
-          response: {
-            exitCode: message.exitCode,
-            stdout: message.stdout,
-            stderr: message.stderr,
-          },
-        });
-        return;
-      }
-      // Anything else — an explicit `error` message at a MATCHING protocol
-      // version, a `pong` (protocol confusion), or a well-formed-but-wrong-shape
-      // body — is treated identically to a connection failure: no partial trust.
-      fail("unreachable");
+      finish({ ok: true, message });
     });
 
     socket.on("error", () => fail("unreachable"));
     socket.on("close", () => fail("unreachable"));
   });
 }
+
+/** Attempts a shell-hook daemon evaluation while preserving the failure category. */
+export async function attemptDaemonHook(
+  req: DaemonHookRequest,
+  opts?: DaemonRequestOptions,
+): Promise<DaemonAttempt> {
+  const attempt = await attemptDaemonRequest(
+    {
+      type: "hook",
+      protocolVersion: PROTOCOL_VERSION,
+      hookEvent: req.hookEvent,
+      cli: req.cli,
+      stdin: req.stdin,
+      cwd: req.cwd,
+    },
+    opts,
+  );
+  if (!attempt.ok) return attempt;
+
+  const message = attempt.message;
+  if (
+    message.type === "hookResult" &&
+    typeof message.exitCode === "number" &&
+    typeof message.stdout === "string" &&
+    typeof message.stderr === "string"
+  ) {
+    return {
+      ok: true,
+      response: {
+        exitCode: message.exitCode,
+        stdout: message.stdout,
+        stderr: message.stderr,
+      },
+    };
+  }
+
+  // An explicit matching-version error, pong, or malformed hook result is not
+  // an evaluation. Never grant partial trust to a daemon that answered the
+  // connection but not the request we sent.
+  return { ok: false, failure: "unreachable" };
+}
+
+function isStringArray(value: unknown): value is string[] {
+  return Array.isArray(value) && value.every((item) => typeof item === "string");
+}
+
+/**
+ * Attempts the structured request used by native in-process integrations.
+ * A matching protocol version is not sufficient: pre-native v1 daemons speak
+ * `hook` but cannot deserialize `policyEvaluation`, so only a complete,
+ * well-shaped `policyResult` proves this capability exists.
+ */
+export async function attemptDaemonPolicyEvaluation(
+  req: DaemonPolicyEvaluationRequest,
+  opts?: DaemonRequestOptions,
+): Promise<DaemonPolicyEvaluationAttempt> {
+  const attempt = await attemptDaemonRequest(
+    {
+      type: "policyEvaluation",
+      protocolVersion: PROTOCOL_VERSION,
+      integration: req.integration,
+      event: req.event,
+      payload: req.payload,
+      cwd: req.cwd,
+    },
+    opts,
+  );
+  if (!attempt.ok) return attempt;
+
+  const message = attempt.message;
+  const validOptionalString = (value: unknown) =>
+    value === null || value === undefined || typeof value === "string";
+  if (
+    message.type === "policyResult" &&
+    (message.decision === "allow" || message.decision === "deny" || message.decision === "instruct") &&
+    isStringArray(message.policyNames) &&
+    validOptionalString(message.reason) &&
+    isStringArray(message.matchedPolicies) &&
+    typeof message.durationMs === "number" &&
+    Number.isInteger(message.durationMs) &&
+    message.durationMs >= 0 &&
+    validOptionalString(message.toolName)
+  ) {
+    return { ok: true };
+  }
+
+  return { ok: false, failure: "unreachable" };
+}