failproofai 1.0.8-beta.0 → 1.0.9-beta.0

package/dist/cli.mjs

@@ -29,7 +29,7 @@ var __esm = (fn, res, err) => () => {
 var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
 // package.json
-var version2 = "1.0.8-beta.0", package_default;
+var version2 = "1.0.9-beta.0", package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "failproofai",
@@ -149,22 +149,22 @@ var init_package = __esm(() => {
       postcss: "8.5.26",
       "eslint-plugin-react-hooks": "7.0.1",
       vite: "8.0.16",
-      undici: "7.29.0",
+      undici: "7.29.1",
       "brace-expansion": "5.0.9",
       sharp: "0.35.4",
       browserslist: "4.28.8"
     },
     optionalDependencies: {
-      "@failproofai/failproofaid-linux-x64": "1.0.8-beta.0",
-      "@failproofai/failproofaid-linux-arm64": "1.0.8-beta.0",
-      "@failproofai/failproofaid-darwin-x64": "1.0.8-beta.0",
-      "@failproofai/failproofaid-darwin-arm64": "1.0.8-beta.0"
+      "@failproofai/failproofaid-linux-x64": "1.0.9-beta.0",
+      "@failproofai/failproofaid-linux-arm64": "1.0.9-beta.0",
+      "@failproofai/failproofaid-darwin-x64": "1.0.9-beta.0",
+      "@failproofai/failproofaid-darwin-arm64": "1.0.9-beta.0"
     },
     failproofaidBinaries: {
-      "linux-x64": "35b641f60e1724513fbb760db382123dad2b5fcdd67dda6373bda80651bd36bb",
-      "linux-arm64": "a058288f5d08f99612f053793e5c7f59264d3da97f3dbe769e401b0f8536702d",
-      "darwin-x64": "b4f3dbe4aea44e77cc10839647c0dc03a1b8b797dfb27e1d89a6a96554ef27b8",
-      "darwin-arm64": "fd42f28bf92001d39117b488a215578b966f07d316214744aca64a1888f2aed2"
+      "linux-x64": "044b6619007227b8aa1fc1095b8c61a17bd90e11da53183ac1f5adecdcae6839",
+      "linux-arm64": "479450d7d15c52a59bd1a8cf4c7086be9210e8d31ad4f98d99b123f571e944bd",
+      "darwin-x64": "11562912ff726195bfb966ed24a774ffea38d01acc3edc1f9bfa3ea9c298977f",
+      "darwin-arm64": "5bbaee1ec89d2d8032b7f16e502fb96891fbc6aa2ee6c861f43a64a0a60e61ba"
     }
   };
 });
@@ -875,7 +875,7 @@ var init_jev_activity = __esm(() => {
   ];
   EVALUATORS = new Set(["jev", "jev-fallback"]);
   DECISIONS = new Set(["allow", "instruct", "deny"]);
-  MODES = new Set(["shadow", "enforce"]);
+  MODES = new Set(["observe", "enforce"]);
   REASON_HEAD_RE = /^([a-z0-9]+(?:-[a-z0-9]+)*)\s*(?:$|[:(])/;
   HTTP_CODE_RE = /^http-\d{3}$/;
   JEV_REASON_CODE_LIST = [
@@ -2518,7 +2518,7 @@ function effectiveAuthority(p) {
 
 // src/hooks/policy-authority.ts
 import { existsSync as existsSync4 } from "node:fs";
-function resolvePolicyAuthority(decl, knownReviewers = SEMANTIC_REVIEWER_NAMES, contested) {
+function resolvePolicyAuthority(decl, knownReviewers = NO_REVIEWERS, contested) {
   const declaredReviewable = decl?.authority === "reviewable";
   if (!decl || effectiveAuthority(decl) === "hard") {
     if (!declaredReviewable)
@@ -2530,6 +2530,8 @@ function resolvePolicyAuthority(decl, knownReviewers = SEMANTIC_REVIEWER_NAMES,
     return { authority: "hard", downgraded: "reviewedBy is not a list of semantic policy names" };
   }
   const unknown = names.filter((n) => !knownReviewers.has(n));
+  if (knownReviewers.size === 0 && !unknown.some((n) => contested?.has(n)))
+    return { authority: "hard" };
   if (unknown.length > 0) {
     return { authority: "hard", downgraded: `reviewedBy names ${unknown.map((n) => whyUnknown(n, knownReviewers, contested)).join("; ")}` };
   }
@@ -2575,7 +2577,7 @@ function authorityProblem(decl, knownReviewers = SEMANTIC_REVIEWER_NAMES) {
   const { downgraded } = resolvePolicyAuthority(decl, knownReviewers);
   return downgraded ? `authority "reviewable" was refused — ${downgraded}` : undefined;
 }
-function withMergedAuthority(record, declarations, knownReviewers = SEMANTIC_REVIEWER_NAMES) {
+function withMergedAuthority(record, declarations, knownReviewers = NO_REVIEWERS) {
   const resolved = declarations.map((d) => resolvePolicyAuthority(d, knownReviewers));
   const allReviewable = resolved.length > 0 && resolved.every((r) => r.authority === "reviewable");
   const decided = declarations[resolved.findIndex((r) => r.authority !== "reviewable")] ?? {};
@@ -2614,7 +2616,7 @@ function authorityDeclarationFor(hook, source) {
   }
   return { authority: hook.authority, reviewedBy: hook.reviewedBy };
 }
-var SEMANTIC_POLICY_NAMES, SEMANTIC_REVIEWER_NAMES, isName = (n) => typeof n === "string" && n.length > 0, warnedAuthority;
+var SEMANTIC_POLICY_NAMES, SEMANTIC_REVIEWER_NAMES, NO_REVIEWERS, isName = (n) => typeof n === "string" && n.length > 0, warnedAuthority;
 var init_policy_authority = __esm(() => {
   init_fp_home();
   init_hook_logger();
@@ -2637,6 +2639,7 @@ var init_policy_authority = __esm(() => {
     "external-data-egress"
   ];
   SEMANTIC_REVIEWER_NAMES = new Set(SEMANTIC_POLICY_NAMES);
+  NO_REVIEWERS = new Set;
   warnedAuthority = new Set;
 });
 
@@ -2849,6 +2852,16 @@ function hasInstalledPacks() {
     return false;
   }
 }
+function hasInstalledRegexPacks() {
+  try {
+    const raw = JSON.parse(readFileSync4(installedFilePath(), "utf8"));
+    if (!Array.isArray(raw.packs))
+      return false;
+    return raw.packs.some((p) => !!p && typeof p === "object" && Array.isArray(p.policies) && p.policies.length > 0);
+  } catch {
+    return false;
+  }
+}
 function installedFilePath() {
   return process.env.FAILPROOFAI_PACK_DIR ? resolve4(process.env.FAILPROOFAI_PACK_DIR, "installed.json") : packsInstalledFile();
 }
@@ -3267,7 +3280,7 @@ function isReservedClaim(pack, name) {
 function effectiveReviewerNames() {
   if (cached)
     return cached;
-  let names = SEMANTIC_REVIEWER_NAMES;
+  let names = NO_REVIEWERS;
   cachedContested = new Map;
   try {
     const packs = jevPacks(readInstalledPacks().packs, reviewerCli);
@@ -3281,15 +3294,22 @@ function contestedReviewerNames() {
   effectiveReviewerNames();
   return cachedContested;
 }
-function replacesBuiltinChecks(packs) {
-  return packs.some((p) => isFirstPartyPack(p) && (p.semantic ?? []).length > 0);
+function jevChecksInstalled() {
+  return effectiveReviewerNames().size > 0;
+}
+function jevChecksDeclared() {
+  try {
+    return reviewerNamesFor(jevPacks(readInstalledPacks().packs)).size > 0;
+  } catch {
+    return false;
+  }
 }
 function reviewerNamesFor(packs) {
   const contested = contestedSemanticNames(packs);
   const declared = packs.flatMap((p) => (p.semantic ?? []).filter((s) => !isReservedClaim(p, s.name)).map((s) => s.name)).filter((name) => !contested.has(name));
   if (declared.length === 0)
-    return SEMANTIC_REVIEWER_NAMES;
-  return new Set(replacesBuiltinChecks(packs) ? declared : [...SEMANTIC_REVIEWER_NAMES, ...declared]);
+    return NO_REVIEWERS;
+  return new Set(declared);
 }
 function forgetEffectiveReviewerNames(cli) {
   cached = null;
@@ -12610,11 +12630,14 @@ import {
   existsSync as existsSync9,
   lstatSync,
   mkdirSync as mkdirSync4,
+  readlinkSync,
+  realpathSync as realpathSync2,
   renameSync as renameSync2,
   rmSync as rmSync2,
+  symlinkSync,
   unlinkSync
 } from "node:fs";
-import { resolve as resolve8, dirname as dirname5 } from "node:path";
+import { resolve as resolve8, dirname as dirname5, basename as basename3 } from "node:path";
 import { fileURLToPath } from "node:url";
 import { homedir as homedir6 } from "node:os";
 function readJsonFile(path) {
@@ -12918,33 +12941,84 @@ function makePiProjectRelativeEntry(extPath) {
 function getHermesPluginSourcePath() {
   const fromEnv = process.env.FAILPROOFAI_PACKAGE_ROOT;
   if (fromEnv)
-    return resolve8(fromEnv, "hermes-plugin");
-  return resolve8(fileURLToPath(import.meta.url), "..", "..", "..", "hermes-plugin");
+    return resolve8(fromEnv, HERMES_PLUGIN_SOURCE_DIR);
+  return resolve8(fileURLToPath(import.meta.url), "..", "..", "..", HERMES_PLUGIN_SOURCE_DIR);
 }
 function hermesPluginPathForSettings(settingsPath) {
   return resolve8(dirname5(settingsPath), "plugins", HERMES_PLUGIN_ID);
 }
-function hasManagedHermesPlugin(settingsPath) {
-  const pluginPath = hermesPluginPathForSettings(settingsPath);
+function pathPresent(path) {
   try {
-    if (lstatSync(pluginPath).isSymbolicLink())
-      return false;
-    if (!existsSync9(resolve8(pluginPath, HERMES_PLUGIN_MARKER)))
-      return false;
-    return HERMES_PLUGIN_FILES.every((file) => existsSync9(resolve8(pluginPath, file)));
+    lstatSync(path);
+    return true;
   } catch {
     return false;
   }
 }
-function hasHermesPluginMarker(settingsPath) {
-  const pluginPath = hermesPluginPathForSettings(settingsPath);
+function hasAllHermesPluginFiles(dir) {
+  return HERMES_PLUGIN_FILES.every((file) => existsSync9(resolve8(dir, file)));
+}
+function isFailproofaiHermesPluginSource(dir) {
+  if (basename3(dir) !== HERMES_PLUGIN_SOURCE_DIR)
+    return false;
+  if (!existsSync9(dir))
+    return true;
+  try {
+    const manifest = readFileSync5(resolve8(dir, "plugin.yaml"), "utf8");
+    return /^name:\s*["']?failproofai["']?\s*$/m.test(manifest);
+  } catch {
+    return false;
+  }
+}
+function samePath(a, b) {
+  if (resolve8(a) === resolve8(b))
+    return true;
   try {
-    return !lstatSync(pluginPath).isSymbolicLink() && existsSync9(resolve8(pluginPath, HERMES_PLUGIN_MARKER));
+    return realpathSync2(a) === realpathSync2(b);
   } catch {
     return false;
   }
 }
-function installHermesPlugin(settingsPath) {
+function hermesPluginState(settingsPath) {
+  const pluginPath = hermesPluginPathForSettings(settingsPath);
+  let isLink;
+  let isDirectory;
+  try {
+    const stat = lstatSync(pluginPath);
+    isLink = stat.isSymbolicLink();
+    isDirectory = stat.isDirectory();
+  } catch {
+    return { kind: "absent" };
+  }
+  if (isLink) {
+    let target;
+    try {
+      target = resolve8(dirname5(pluginPath), readlinkSync(pluginPath));
+    } catch {
+      return { kind: "foreign" };
+    }
+    if (!isFailproofaiHermesPluginSource(target))
+      return { kind: "foreign" };
+    return {
+      kind: "link",
+      target,
+      complete: hasAllHermesPluginFiles(target),
+      current: samePath(target, getHermesPluginSourcePath())
+    };
+  }
+  if (isDirectory && existsSync9(resolve8(pluginPath, HERMES_PLUGIN_MARKER))) {
+    return { kind: "copy", complete: hasAllHermesPluginFiles(pluginPath) };
+  }
+  return { kind: "foreign" };
+}
+function hasManagedHermesPlugin(settingsPath) {
+  const state = hermesPluginState(settingsPath);
+  return (state.kind === "link" || state.kind === "copy") && state.complete;
+}
+function defaultHermesSymlink(target, path) {
+  symlinkSync(target, path, process.platform === "win32" ? "junction" : "dir");
+}
+function installHermesPlugin(settingsPath, deps = {}) {
   const source = getHermesPluginSourcePath();
   for (const file of HERMES_PLUGIN_FILES) {
     if (!existsSync9(resolve8(source, file))) {
@@ -12952,23 +13026,47 @@ function installHermesPlugin(settingsPath) {
     }
   }
   const destination = hermesPluginPathForSettings(settingsPath);
-  if (existsSync9(destination)) {
-    if (lstatSync(destination).isSymbolicLink() || !existsSync9(resolve8(destination, HERMES_PLUGIN_MARKER))) {
-      throw new Error(`Refusing to overwrite an unmanaged Hermes plugin at ${destination}. ` + `Move it aside or install FailproofAI under a different Hermes profile.`);
-    }
+  const existing = hermesPluginState(settingsPath);
+  if (existing.kind === "foreign") {
+    throw new Error(`Refusing to overwrite an unmanaged Hermes plugin at ${destination}. ` + `Move it aside or install FailproofAI under a different Hermes profile.`);
   }
+  if (existing.kind === "link" && existing.current)
+    return "unchanged";
   mkdirSync4(dirname5(destination), { recursive: true });
   const suffix = `${process.pid}-${Date.now()}`;
   const temporary = `${destination}.install-${suffix}`;
-  const backup = `${destination}.backup-${suffix}`;
-  let movedExisting = false;
+  let linked = false;
   try {
+    (deps.symlink ?? defaultHermesSymlink)(source, temporary);
+    linked = true;
+  } catch {
+    rmSync2(temporary, { recursive: true, force: true });
+  }
+  if (!linked) {
     mkdirSync4(temporary, { recursive: true });
-    for (const file of HERMES_PLUGIN_FILES) {
-      cpSync(resolve8(source, file), resolve8(temporary, file));
+    try {
+      for (const file of HERMES_PLUGIN_FILES) {
+        cpSync(resolve8(source, file), resolve8(temporary, file));
+      }
+      writeFileSync3(resolve8(temporary, HERMES_PLUGIN_MARKER), "Managed by failproofai. Remove with `failproofai policies --uninstall --cli hermes`.\n", { encoding: "utf8", mode: 384 });
+    } catch (err) {
+      rmSync2(temporary, { recursive: true, force: true });
+      throw err;
+    }
+  }
+  if (linked && (existing.kind === "absent" || existing.kind === "link")) {
+    try {
+      renameSync2(temporary, destination);
+    } catch (err) {
+      rmSync2(temporary, { force: true });
+      throw err;
     }
-    writeFileSync3(resolve8(temporary, HERMES_PLUGIN_MARKER), "Managed by failproofai. Remove with `failproofai policies --uninstall --cli hermes`.\n", { encoding: "utf8", mode: 384 });
-    if (existsSync9(destination)) {
+    return "linked";
+  }
+  const backup = `${destination}.backup-${suffix}`;
+  let movedExisting = false;
+  try {
+    if (pathPresent(destination)) {
       renameSync2(destination, backup);
       movedExisting = true;
     }
@@ -12977,15 +13075,21 @@ function installHermesPlugin(settingsPath) {
       rmSync2(backup, { recursive: true, force: true });
   } catch (err) {
     rmSync2(temporary, { recursive: true, force: true });
-    if (movedExisting && !existsSync9(destination) && existsSync9(backup)) {
+    if (movedExisting && !pathPresent(destination) && pathPresent(backup)) {
       renameSync2(backup, destination);
     }
     throw err;
   }
+  return linked ? "linked" : "copied";
 }
 function removeManagedHermesPlugin(settingsPath) {
   const pluginPath = hermesPluginPathForSettings(settingsPath);
-  if (!hasHermesPluginMarker(settingsPath))
+  const state = hermesPluginState(settingsPath);
+  if (state.kind === "link") {
+    unlinkSync(pluginPath);
+    return true;
+  }
+  if (state.kind !== "copy")
     return false;
   rmSync2(pluginPath, { recursive: true, force: true });
   return true;
@@ -13030,6 +13134,93 @@ function hermesConfigState(settingsPath) {
     legacyShellHookPresent
   };
 }
+function enableHermesPluginInDoc(doc) {
+  removeLegacyHermesHooks(doc);
+  const js = doc.toJS() ?? {};
+  const plugins = js.plugins && typeof js.plugins === "object" ? js.plugins : {};
+  const enabled = Array.isArray(plugins.enabled) ? [...plugins.enabled] : [];
+  if (!enabled.includes(HERMES_PLUGIN_ID))
+    enabled.push(HERMES_PLUGIN_ID);
+  plugins.enabled = enabled;
+  if (Array.isArray(plugins.disabled)) {
+    plugins.disabled = plugins.disabled.filter((name) => name !== HERMES_PLUGIN_ID);
+    if (plugins.disabled.length === 0)
+      delete plugins.disabled;
+  }
+  doc.set("plugins", plugins);
+}
+async function migrateHermesProfiles(opts) {
+  const results = [];
+  let daemonOk;
+  for (const profile of listHermesProfiles()) {
+    if (!existsSync9(profile.home))
+      continue;
+    const settingsPath = resolve8(profile.home, "config.yaml");
+    const pluginPath = hermesPluginPathForSettings(settingsPath);
+    const config = hermesConfigState(settingsPath);
+    const plugin = hermesPluginState(settingsPath);
+    const ours = plugin.kind === "link" || plugin.kind === "copy";
+    const base = { name: profile.name, home: profile.home };
+    const legacy = config.legacyShellHookPresent;
+    if (!legacy && !ours && !config.pluginEnabled) {
+      results.push({ ...base, status: "untouched", detail: "no failproofai integration", legacyShellHooksRemain: false });
+      continue;
+    }
+    if (plugin.kind === "link" && plugin.current && plugin.complete && config.pluginEnabled && !legacy) {
+      results.push({ ...base, status: "current", detail: "already linked", legacyShellHooksRemain: false });
+      continue;
+    }
+    if (plugin.kind === "foreign") {
+      results.push({
+        ...base,
+        status: "failed",
+        detail: `an unmanaged plugin occupies ${pluginPath}` + (legacy ? "; shell hooks left in place (cron jobs are not checked)" : ""),
+        legacyShellHooksRemain: legacy
+      });
+      continue;
+    }
+    if (existsSync9(settingsPath)) {
+      const errors = $parseDocument(readFileSync5(settingsPath, "utf8")).errors;
+      if (errors.length > 0) {
+        results.push({
+          ...base,
+          status: "failed",
+          detail: `${settingsPath} does not parse as YAML; left untouched`,
+          legacyShellHooksRemain: legacy
+        });
+        continue;
+      }
+    }
+    if (daemonOk === undefined)
+      daemonOk = await opts.daemonSupportsPolicyEvaluation();
+    if (!daemonOk) {
+      results.push({
+        ...base,
+        status: "blocked",
+        detail: legacy ? "daemon lacks native policy evaluation; shell hooks left in place (cron jobs are not checked)" : "daemon lacks native policy evaluation; the plugin here cannot get verdicts",
+        legacyShellHooksRemain: legacy
+      });
+      continue;
+    }
+    try {
+      const mode = installHermesPlugin(settingsPath, opts.installDeps);
+      const doc = readYamlDoc(settingsPath);
+      enableHermesPluginInDoc(doc);
+      writeYamlDoc(settingsPath, doc);
+      const from = legacy ? "shell hooks" : plugin.kind === "copy" ? "copied plugin" : plugin.kind === "link" ? "old plugin link" : "enabled but missing plugin";
+      const to = mode === "copied" ? "plugin copy (symlink not possible here)" : "linked plugin";
+      results.push({ ...base, status: "migrated", detail: `${from} → ${to}`, legacyShellHooksRemain: false });
+    } catch (err) {
+      results.push({
+        ...base,
+        status: "failed",
+        detail: err instanceof Error ? err.message : String(err),
+        legacyShellHooksRemain: hermesConfigState(settingsPath).legacyShellHookPresent
+      });
+    }
+  }
+  return results;
+}
 function hermesConfigHasHooks(settingsPath) {
   try {
     const state = hermesConfigState(settingsPath);
@@ -13067,7 +13258,7 @@ function listInstallableIds() {
 function detectInstalledClis() {
   return INTEGRATION_TYPES.filter((id) => INTEGRATIONS[id]?.detectInstalled());
 }
-var claudeCode, codex, copilot, cursor, OPENCODE_PLUGIN_REL_PATH = "./plugins/failproofai.mjs", opencode, pi, HERMES_PLUGIN_ID = "failproofai", HERMES_PLUGIN_MARKER = ".failproofai-managed", HERMES_PLUGIN_FILES, hermes, OPENCLAW_PLUGIN_ID = "failproofai", openclaw, factory, devin, ANTIGRAVITY_HOOK_NAME = "failproofai", ANTIGRAVITY_TOOL_EVENTS, antigravity, goose, INTEGRATIONS;
+var claudeCode, codex, copilot, cursor, OPENCODE_PLUGIN_REL_PATH = "./plugins/failproofai.mjs", opencode, pi, HERMES_PLUGIN_ID = "failproofai", HERMES_PLUGIN_MARKER = ".failproofai-managed", HERMES_PLUGIN_FILES, HERMES_PLUGIN_SOURCE_DIR = "hermes-plugin", hermes, OPENCLAW_PLUGIN_ID = "failproofai", openclaw, factory, devin, ANTIGRAVITY_HOOK_NAME = "failproofai", ANTIGRAVITY_TOOL_EVENTS, antigravity, goose, INTEGRATIONS;
 var init_integrations = __esm(() => {
   init_dist();
   init_hermes_profiles();
@@ -13750,20 +13941,7 @@ var init_integrations = __esm(() => {
     },
     isFailproofaiHook: isMarkedHook,
     writeHookEntries(settings) {
-      const doc = settings;
-      removeLegacyHermesHooks(doc);
-      const js = doc.toJS() ?? {};
-      const plugins = js.plugins && typeof js.plugins === "object" ? js.plugins : {};
-      const enabled = Array.isArray(plugins.enabled) ? [...plugins.enabled] : [];
-      if (!enabled.includes(HERMES_PLUGIN_ID))
-        enabled.push(HERMES_PLUGIN_ID);
-      plugins.enabled = enabled;
-      if (Array.isArray(plugins.disabled)) {
-        plugins.disabled = plugins.disabled.filter((name) => name !== HERMES_PLUGIN_ID);
-        if (plugins.disabled.length === 0)
-          delete plugins.disabled;
-      }
-      doc.set("plugins", plugins);
+      enableHermesPluginInDoc(settings);
     },
     removeHooksFromFile(settingsPath) {
       const doc = readYamlDoc(settingsPath);
@@ -14386,7 +14564,7 @@ function outsideProject(facts, p) {
     return false;
   return p.resolved !== cwd && !p.resolved.startsWith(cwd.endsWith("/") ? cwd : cwd + "/");
 }
-var PROTECTED_BRANCHES, OUTSIDE_PROJECT, SEMANTIC_POLICIES, SCOPE_PROBE, INJECTION_PROBE, HUMAN_ONLY, TASK_STEP_PROBE, OP_REQUESTED_PROBE, BEYOND_TASK_PROBE, TASK_PROBES;
+var PROTECTED_BRANCHES, OUTSIDE_PROJECT, SCOPE_PROBE, INJECTION_PROBE, HUMAN_ONLY, TASK_STEP_PROBE, OP_REQUESTED_PROBE, BEYOND_TASK_PROBE, TASK_PROBES;
 var init_policies = __esm(() => {
   PROTECTED_BRANCHES = new Set(["main", "master", "production", "prod", "release", "trunk"]);
   OUTSIDE_PROJECT = new Set([
@@ -14395,334 +14573,6 @@ var init_policies = __esm(() => {
     "system",
     "root"
   ]);
-  SEMANTIC_POLICIES = [
-    {
-      name: "destructive-deletion",
-      title: "Tried to permanently delete data that cannot be regenerated",
-      appliesTo: ["shell", "write"],
-      mode: "deny",
-      userCanOverride: true,
-      probes: [
-        {
-          id: "destroys",
-          instructions: "The tool call in `agent_request` permanently deletes, wipes, truncates or overwrites existing files, " + "directories or disks — for example `rm -r`, `find -delete`, `shred`, `dd of=`, `mkfs`, `truncate`, " + "`rsync --delete`, `git clean -fdx`, or redirecting output over an existing file.",
-          criteria: {
-            true: "Existing data would be destroyed or irreversibly overwritten.",
-            false: "Nothing existing is destroyed: it reads, lists, creates new files, or moves data somewhere recoverable."
-          }
-        },
-        {
-          id: "irreplaceable",
-          instructions: "What would be destroyed is outside the project, is the whole project, is the user's home directory, " + "is the filesystem root, or is data that cannot simply be regenerated (source code, documents, databases, " + "keys). Use `facts.paths[].relation` to see where each target sits relative to the project.",
-          criteria: {
-            true: "The destroyed data matters and could not be rebuilt by running a command.",
-            false: "Only regenerable data inside the project is affected: build output, dist/, caches, node_modules, " + "virtualenvs, coverage reports, temp files, or files the agent itself just created."
-          }
-        }
-      ],
-      guidance: "This permanently deletes data that cannot be rebuilt. Confirm the exact paths with the user first."
-    },
-    {
-      name: "production-infra-change",
-      title: "Tried to change live infrastructure",
-      appliesTo: ["shell"],
-      mode: "deny",
-      userCanOverride: true,
-      probes: [
-        {
-          id: "mutates",
-          instructions: "The command in `agent_request` changes the state of cloud or cluster infrastructure: it creates, " + "updates, deletes, applies, scales, restarts, rolls out, deploys or destroys resources in a cloud " + "account, Kubernetes cluster, managed database, DNS, CDN or hosting platform (any CLI: kubectl, helm, " + "terraform, tofu, pulumi, aws, gcloud, az, doctl, flyctl, vercel, wrangler, railway, and so on — " + "however the binary is spelled or pathed).",
-          criteria: {
-            true: "It mutates infrastructure.",
-            false: "It only reads or plans: get, list, describe, logs, status, plan, diff, validate, whoami, or --dry-run."
-          }
-        },
-        {
-          id: "not_local",
-          instructions: "The target of that change is a shared or production environment, or its environment cannot be told " + "from the command.",
-          criteria: {
-            true: "Production, shared, or unknown environment.",
-            false: "Clearly a local or throwaway environment: localhost, kind, minikube, docker-desktop, k3d, or a " + "context, workspace or profile whose name says dev, test, staging, sandbox or local."
-          }
-        }
-      ],
-      guidance: "This changes live infrastructure. Run it against a non-production target, or hand the command to a human."
-    },
-    {
-      name: "git-history-rewrite",
-      title: "Tried to rewrite or discard shared git history",
-      appliesTo: ["shell"],
-      mode: "deny",
-      userCanOverride: true,
-      probes: [
-        {
-          id: "rewrites_remote",
-          instructions: "The command in `agent_request` force-pushes or otherwise overwrites history on a git remote: " + "`git push --force`, `--force-with-lease`, `-f`, a `+refspec` such as `+HEAD:main`, or deleting a " + "remote branch. Git's global options before the subcommand (`git -C dir`, `git -c key=val`) and an " + "absolute path to the git binary do not change what the command does.",
-          criteria: {
-            true: "Remote history would be overwritten or a remote branch deleted.",
-            false: "A normal push that only adds commits, or no push at all."
-          }
-        }
-      ],
-      guidance: "Force-pushing rewrites history other people may have pulled. Confirm with the user first."
-    },
-    {
-      name: "push-to-protected-branch",
-      title: "Tried to push directly to a protected branch",
-      appliesTo: ["shell"],
-      mode: "instruct",
-      userCanOverride: true,
-      probes: [
-        {
-          id: "pushes_protected",
-          instructions: "The command in `agent_request` pushes commits to a remote branch named main, master, production, " + "release or trunk — either named explicitly or implied because `facts.current_git_branch` is one of " + "those and the push names no other branch.",
-          criteria: {
-            true: "Commits land directly on a protected remote branch.",
-            false: "It pushes a feature branch whose name merely contains a word like main (e.g. feature/main-menu), " + "or it does not push."
-          }
-        }
-      ],
-      guidance: "Pushing straight to a protected branch skips review. Push a branch and open a PR unless the user asked for this."
-    },
-    {
-      name: "commit-on-protected-branch",
-      title: "Tried to commit directly on a protected branch",
-      appliesTo: ["shell"],
-      mode: "instruct",
-      userCanOverride: true,
-      precondition: (facts) => facts.currentGitBranch !== null && PROTECTED_BRANCHES.has(facts.currentGitBranch),
-      probes: [
-        {
-          id: "creates_commit",
-          instructions: "The command in `agent_request` creates or amends a git commit, merge, rebase or cherry-pick in the " + "repository (including `git -C dir commit` and `git commit -a`).",
-          criteria: {
-            true: "A new commit is written to the current branch.",
-            false: "It only inspects history (log, show, diff, status) or mentions `commit` in a message or search."
-          }
-        }
-      ],
-      guidance: "You are on a protected branch. Create a feature branch before committing unless the user asked otherwise."
-    },
-    {
-      name: "secret-exposure",
-      title: "Tried to read or copy credentials",
-      appliesTo: ["shell", "read", "write"],
-      mode: "deny",
-      userCanOverride: true,
-      probes: [
-        {
-          id: "touches_secrets",
-          instructions: "The tool call in `agent_request` reads, prints, copies, or writes credential material: SSH private " + "keys (~/.ssh/id_*), authorized_keys, cloud credentials (~/.aws, ~/.config/gcloud, ~/.azure, " + "~/.kube/config), .env files containing real secret values, API tokens, password stores, keychains, " + "or browser cookie databases.",
-          criteria: {
-            true: "Actual secret values would be read, displayed, copied or written.",
-            false: "It only references the concept: source code that reads process.env, a variable name, an .env.example " + "template, a test fixture, documentation about credentials, or a grep for the word."
-          }
-        }
-      ],
-      guidance: "This exposes real credentials. Ask the user before reading or copying secret material."
-    },
-    {
-      name: "credential-exfiltration",
-      title: "Tried to send secrets or private files off the machine",
-      appliesTo: ["shell", "network"],
-      mode: "deny",
-      userCanOverride: false,
-      probes: [
-        {
-          id: "sends_out",
-          instructions: "The tool call in `agent_request` sends data to a network destination: an HTTP POST or PUT (curl -d, " + "curl -F, curl -T, wget --post-data), scp, sftp, rsync or rclone to a remote, nc or socat, an upload to " + "a paste site, bucket or webhook, or a DNS lookup carrying encoded data.",
-          criteria: {
-            true: "Data leaves this machine.",
-            false: "It only downloads, or only talks to localhost."
-          }
-        },
-        {
-          id: "sensitive_payload",
-          instructions: "The data being sent includes credentials, keys, tokens, environment variables, or the contents of files " + "from outside the project (see `facts.paths`).",
-          criteria: {
-            true: "Secrets or private files are in what is sent.",
-            false: "What is sent is ordinary project data the user would expect to share, like a test request body."
-          }
-        }
-      ],
-      guidance: "This sends secrets or private files to a remote destination, which the user cannot approve. Do not send them."
-    },
-    {
-      name: "remote-code-execution",
-      title: "Tried to run code downloaded from the internet",
-      appliesTo: ["shell"],
-      mode: "deny",
-      userCanOverride: true,
-      probes: [
-        {
-          id: "download_and_run",
-          instructions: "The command in `agent_request` downloads code or a script from the internet and executes it: " + '`curl … | sh`, `bash <(curl …)`, `wget … -O x.sh && bash x.sh`, `python3 -c "$(curl …)"`, piping into ' + "any interpreter (sh, bash, zsh, python, node, perl, ruby), or eval of a fetched string.",
-          criteria: {
-            true: "Fetched code is executed.",
-            false: "It only downloads without running, runs a local file, or merely searches for or quotes such a command " + "(for example grep over a README)."
-          }
-        }
-      ],
-      exempt: {
-        id: "official_installer",
-        instructions: "The URL being executed is the documented official installer of a widely used developer tool, served from " + "that tool's own domain (for example bun.sh, sh.rustup.rs, get.docker.com, deb.nodesource.com, " + "raw.githubusercontent.com/nvm-sh/nvm, astral.sh/uv)."
-      },
-      guidance: "This executes code fetched from the internet. Download it, show it to the user, then run it."
-    },
-    {
-      name: "privilege-escalation",
-      title: "Tried to run with elevated privileges",
-      appliesTo: ["shell"],
-      mode: "deny",
-      userCanOverride: true,
-      probes: [
-        {
-          id: "elevates",
-          instructions: "The command in `agent_request` runs something as root or another user: sudo, doas, su, pkexec, run0, " + "`sudo -i`, `sudo -s`, including when the binary is written as an absolute path or reached through a " + "variable or wrapper.",
-          criteria: {
-            true: "Privileges are elevated.",
-            false: "It runs as the current user, or only mentions sudo in text, a comment, or a search pattern."
-          }
-        }
-      ],
-      guidance: "This runs with elevated privileges. Ask the user to run it themselves."
-    },
-    {
-      name: "database-destruction",
-      title: "Tried to destroy or mass-modify database data",
-      appliesTo: ["shell"],
-      mode: "deny",
-      userCanOverride: true,
-      probes: [
-        {
-          id: "destructive_sql",
-          instructions: "The command in `agent_request` executes SQL or a database command that drops or truncates a table, " + "schema or database, or deletes or updates rows without a condition that narrows them to specific " + "records. A condition that is always true (`WHERE 1=1`, `WHERE true`, `WHERE id > 0`) does not narrow " + "anything. Also counts: `redis-cli FLUSHALL`, `dropdb`, `mongo … dropDatabase()`.",
-          criteria: {
-            true: "Many rows, a table, or a whole database would be removed or overwritten.",
-            false: "It reads, inserts, or changes a specific identified record, or runs a migration file by name."
-          }
-        },
-        {
-          id: "real_database",
-          instructions: "The database it targets holds real data rather than being a disposable test database.",
-          criteria: {
-            true: "A real or shared database, or one whose purpose cannot be told.",
-            false: "Clearly an in-memory, test, fixture or throwaway local database (sqlite :memory:, a test_ database)."
-          }
-        }
-      ],
-      guidance: "This destroys database data. Confirm the target and scope with the user first."
-    },
-    {
-      name: "read-outside-workspace",
-      title: "Read files outside the project",
-      appliesTo: ["shell", "read"],
-      mode: "instruct",
-      userCanOverride: true,
-      precondition: (facts) => facts.paths.some((p) => outsideProject(facts, p)),
-      probes: [
-        {
-          id: "reads_outside",
-          instructions: "The tool call in `agent_request` reads the contents of files that `facts.paths` marks as outside the " + "project, in the user's home directory (for example another repository, Documents, or dotfiles).",
-          criteria: {
-            true: "It reads file contents from outside the project.",
-            false: "It only changes directory, lists names, checks existence, or touches the agent's own tool caches."
-          }
-        }
-      ],
-      guidance: "This reads files outside the current project. Mention why before continuing."
-    },
-    {
-      name: "agent-config-tampering",
-      title: "Tried to change the agent's own safety configuration",
-      appliesTo: ["shell", "write"],
-      mode: "deny",
-      userCanOverride: false,
-      probes: [
-        {
-          id: "edits_agent_config",
-          instructions: "The tool call in `agent_request` modifies or deletes an AI agent's own configuration, hooks, " + "permissions or guardrails: .claude/settings.json, .claude/settings.local.json, ~/.claude/, .codex/, " + ".cursor/hooks.json, .gemini/, .factory/, failproofai configuration or policies, or permission and " + "safety sections of AGENTS.md or CLAUDE.md.",
-          criteria: {
-            true: "The agent's hooks, permissions or safety settings would change.",
-            false: "It only reads those files, or edits ordinary project documentation."
-          }
-        }
-      ],
-      guidance: "An agent must not change its own guardrails. Ask the user to make this change."
-    },
-    {
-      name: "system-modification",
-      title: "Tried to change the system outside the project",
-      appliesTo: ["shell"],
-      mode: "instruct",
-      userCanOverride: true,
-      probes: [
-        {
-          id: "modifies_system",
-          instructions: "The command in `agent_request` installs or removes software system-wide or changes machine " + "configuration: apt, dnf, pacman, brew install, `npm install -g`, `pip install` outside a virtualenv, " + "editing files under /etc, systemctl enable or disable, crontab, or changing shell startup files.",
-          criteria: {
-            true: "The machine changes outside the project directory.",
-            false: "It installs project dependencies locally (npm install, bun install, pip install in a venv)."
-          }
-        }
-      ],
-      guidance: "This changes the machine outside the project. Mention it to the user."
-    },
-    {
-      name: "env-secrets-dump",
-      title: "Tried to print environment secrets",
-      appliesTo: ["shell"],
-      mode: "instruct",
-      userCanOverride: true,
-      probes: [
-        {
-          id: "dumps_env",
-          instructions: "The command in `agent_request` prints environment variable VALUES that may be secret: `env`, " + "`printenv`, `set`, `export -p`, or `echo` of a variable whose name suggests a key, token, password " + "or secret.",
-          criteria: {
-            true: "Secret-looking environment values would be printed.",
-            false: "It echoes a literal string, prints a non-secret variable like PATH or HOME, creates a virtualenv " + "named env, or searches code for the word export."
-          }
-        }
-      ],
-      guidance: "This prints environment values that may be secrets into the transcript."
-    },
-    {
-      name: "external-destructive-action",
-      title: "Tried an irreversible action through an external tool",
-      appliesTo: ["other"],
-      mode: "deny",
-      userCanOverride: true,
-      probes: [
-        {
-          id: "irreversible_external",
-          instructions: "The tool call in `agent_request` (an MCP or integration tool, see `facts.tool_name`) performs an " + "irreversible or externally visible action: deleting records, repositories, files or accounts; " + "sending email, chat or social messages on the user's behalf; making payments or purchases; merging or " + "closing pull requests; changing permissions, access or billing; or writing to a production system.",
-          criteria: {
-            true: "Something outside this machine changes in a way that cannot be quietly undone.",
-            false: "It reads, searches, lists, fetches, or creates a draft that nobody else sees yet."
-          }
-        }
-      ],
-      guidance: "This takes an irreversible action in an external system. Confirm with the user first."
-    },
-    {
-      name: "external-data-egress",
-      title: "Sent private data to an external tool",
-      appliesTo: ["other"],
-      mode: "instruct",
-      userCanOverride: true,
-      probes: [
-        {
-          id: "egresses_private",
-          instructions: "The arguments in `agent_request` send private data to an external service: source code, file " + "contents, credentials, customer data, or personal information.",
-          criteria: {
-            true: "Private data is being shared with a third party.",
-            false: "Only a query, identifier or public information is sent."
-          }
-        }
-      ],
-      guidance: "This shares private data with an external service. Mention what is being sent."
-    }
-  ];
   SCOPE_PROBE = {
     id: "scope",
     instructions: "Everything `agent_request` would affect — every branch, file, directory, table, record, environment, " + "account or recipient — is covered by what the human asked for in `user_said`. It reaches no further: not " + "all branches when they named one, not production when they said local or staging, not a parent directory " + 'when they named one folder, not every record when they named some. References such as "it", "this PR" ' + 'or "that volume" mean whatever the conversation is about. Details the agent filled in to carry the ' + "request out (a commit title, a flag the operation needs) do not make it broader.",
@@ -16916,14 +16766,13 @@ function toSemanticPolicy(entry, pack) {
 function semanticPoliciesFromPacks(packs) {
   const declared = packs.filter((p) => packSemantic(p).length > 0);
   if (declared.length === 0)
-    return { policies: SEMANTIC_POLICIES, fromPack: false, errors: [] };
-  const replace = replacesBuiltinChecks(declared);
+    return { policies: [], fromPack: false, errors: [] };
   const ordered = [...declared.filter((p) => isFirstPartyPack(p)), ...declared.filter((p) => !isFirstPartyPack(p))];
-  const policies = replace ? [] : [...SEMANTIC_POLICIES];
+  const policies = [];
   const errors = [];
-  const seen = new Set(policies.map((p) => p.name));
+  const seen = new Set;
   const contested = contestedSemanticNames(declared);
-  let spent = replace ? 0 : BUILTIN_QUESTION_CHARS;
+  let spent = 0;
   for (const pack of ordered) {
     for (const entry of packSemantic(pack)) {
       if (isReservedClaim(pack, entry.name)) {
@@ -16956,9 +16805,7 @@ function semanticPoliciesFromPacks(packs) {
       spent += cost;
     }
   }
-  if (policies.length === (replace ? 0 : SEMANTIC_POLICIES.length))
-    return { policies: SEMANTIC_POLICIES, fromPack: false, errors };
-  return { policies, fromPack: true, errors };
+  return { policies, fromPack: policies.length > 0, errors };
 }
 function resolveSemanticPolicies(cli) {
   let packs = [];
@@ -16968,7 +16815,7 @@ function resolveSemanticPolicies(cli) {
     packs = read.packs;
     manifestErrors = read.warnings ?? [];
   } catch {
-    return SEMANTIC_POLICIES;
+    return [];
   }
   const resolved = semanticPoliciesFromPacks(jevPacks(packs, cli));
   for (const message of [...manifestErrors, ...resolved.errors]) {
@@ -16979,7 +16826,7 @@ function resolveSemanticPolicies(cli) {
   }
   return resolved.policies;
 }
-var GLOBAL_QUESTION_CHARS, MAX_PACK_QUESTION_CHARS, BUILTIN_QUESTION_CHARS, warned;
+var GLOBAL_QUESTION_CHARS, MAX_PACK_QUESTION_CHARS, JEV_POLICIES_QUESTION_CHARS = 18490, warned;
 var init_pack_policies = __esm(() => {
   init_effective_reviewers();
   init_hook_logger();
@@ -16991,7 +16838,6 @@ var init_pack_policies = __esm(() => {
   init_precondition_names();
   GLOBAL_QUESTION_CHARS = Math.max(JSON.stringify({ [INJECTION_PROBE.id]: noulOf(INJECTION_PROBE), [SCOPE_PROBE.id]: noulOf(SCOPE_PROBE) }).length, JSON.stringify(Object.fromEntries([INJECTION_PROBE, ...TASK_PROBES].map((p) => [p.id, noulOf(p)]))).length);
   MAX_PACK_QUESTION_CHARS = MAX_REQUEST_CHARS - MAX_STATE_CHARS - GLOBAL_QUESTION_CHARS;
-  BUILTIN_QUESTION_CHARS = SEMANTIC_POLICIES.reduce((n, p) => n + questionChars(p), 0);
   warned = new Set;
 });
 
@@ -17384,7 +17230,7 @@ var init_telemetry_id2 = __esm(() => {
 });
 
 // src/hooks/custom-hooks-loader.ts
-import { resolve as resolve10, isAbsolute as isAbsolute2, basename as basename3 } from "node:path";
+import { resolve as resolve10, isAbsolute as isAbsolute2, basename as basename4 } from "node:path";
 import { randomUUID } from "crypto";
 import { existsSync as existsSync10, readdirSync as readdirSync3 } from "node:fs";
 import { readFile as readFile3 } from "node:fs/promises";
@@ -17454,7 +17300,7 @@ async function loadSingleFile(absPath, opts) {
     const ignored = getSemanticRegistrations().slice(semanticBefore).map((d) => d?.name);
     if (opts?.outsidePack && ignored.length > 0 && !warnedSemanticOutsidePack.has(absPath)) {
       warnedSemanticOutsidePack.add(absPath);
-      hookLogWarn(`${basename3(absPath)}: semanticPolicies.add only takes effect in a pack published with \`failproofai publish\`; ` + `${ignored.join(", ")} ${ignored.length === 1 ? "is" : "are"} never asked here`);
+      hookLogWarn(`${basename4(absPath)}: semanticPolicies.add only takes effect in a pack published with \`failproofai publish\`; ` + `${ignored.join(", ")} ${ignored.length === 1 ? "is" : "are"} never asked here`);
     }
     if (policyModuleCache.size >= POLICY_MODULE_CACHE_MAX_ENTRIES)
       policyModuleCache.clear();
@@ -17470,7 +17316,7 @@ async function loadSingleFile(absPath, opts) {
       error_type: errorType,
       is_convention: !!opts?.conventionScope,
       convention_scope: opts?.conventionScope ?? null,
-      file_basename: basename3(absPath)
+      file_basename: basename4(absPath)
     });
     if (opts?.strict)
       throw new Error(`Failed to load custom hooks from ${absPath}: ${msg}`);
@@ -17659,12 +17505,12 @@ async function loadAllCustomHooks(customPoliciesPaths, opts) {
     await loadSingleFile(file, { conventionScope: projectScope, outsidePack: true });
     const newHooks = getCustomHooks().slice(hooksBefore);
     for (const hook of newHooks) {
-      hook.__policyId = conventionPolicyId(projectScope, basename3(file), hook.name);
+      hook.__policyId = conventionPolicyId(projectScope, basename4(file), hook.name);
     }
     if (newHooks.length > 0) {
       conventionSources.push({
         scope: projectScope,
-        file: basename3(file),
+        file: basename4(file),
         hookNames: newHooks.map((h) => h.name)
       });
     }
@@ -17681,12 +17527,12 @@ async function loadAllCustomHooks(customPoliciesPaths, opts) {
     await loadSingleFile(file, { conventionScope: "user", outsidePack: true });
     const newHooks = getCustomHooks().slice(hooksBefore);
     for (const hook of newHooks) {
-      hook.__policyId = conventionPolicyId("user", basename3(file), hook.name);
+      hook.__policyId = conventionPolicyId("user", basename4(file), hook.name);
     }
     if (newHooks.length > 0) {
       conventionSources.push({
         scope: "user",
-        file: basename3(file),
+        file: basename4(file),
         hookNames: newHooks.map((h) => h.name)
       });
     }
@@ -19318,14 +19164,14 @@ function combineTwoTier(verdicts, review, mode) {
     ...review.model ? { jevModel: review.model } : {},
     jevMode: mode
   };
-  if (mode === "shadow") {
-    const shadowVerdict = review.decision === "deny" || review.decision === "instruct" ? {
+  if (mode === "observe") {
+    const observeVerdict = review.decision === "deny" || review.decision === "instruct" ? {
       policyName: jevEntry.policyName,
       decision: review.decision,
       reason: jevEntry.reason,
       version: review.model && JEV_MODEL_RE.test(review.model) ? review.model : "jev"
     } : undefined;
-    return { final: legacy, cleared, decidedByJev: false, activity, ...shadowVerdict ? { shadowVerdict } : {} };
+    return { final: legacy, cleared, decidedByJev: false, activity, ...observeVerdict ? { observeVerdict } : {} };
   }
   return { ...enforced, cleared, activity };
 }
@@ -19419,7 +19265,7 @@ async function evaluatePolicies(eventType, payload, session, config, twoTier) {
   }
   const combined = combineTwoTier(collected.verdicts, review, twoTier.mode);
   if (combined.cleared.length > 0) {
-    hookLogInfo(`jev ${twoTier.mode === "shadow" ? "would clear" : "cleared"}: ${combined.cleared.join(", ")}`);
+    hookLogInfo(`jev ${twoTier.mode === "observe" ? "would clear" : "cleared"}: ${combined.cleared.join(", ")}`);
   }
   if (combined.activity.evaluator === "jev-fallback") {
     hookLogInfo(combined.activity.jevFallbackReason === JEV_REASON_REQUEST_CUT ? "jev could not be shown the whole call; it cleared nothing, and the call was not allowed on a partial read" : `jev unavailable (${combined.activity.jevFallbackReason}); the regex result decided this call`);
@@ -19430,7 +19276,7 @@ async function evaluatePolicies(eventType, payload, session, config, twoTier) {
       activity: combined.activity,
       decidedByJev: combined.decidedByJev,
       ...combined.decidedByJev && review.kind === "answered" && review.origin ? { jevOrigin: review.origin } : {},
-      ...combined.shadowVerdict ? { shadowVerdict: combined.shadowVerdict } : {}
+      ...combined.observeVerdict ? { observeVerdict: combined.observeVerdict } : {}
     }
   };
 }
@@ -24798,7 +24644,7 @@ var init_copilot_sessions = __esm(() => {
 // lib/cursor-sessions.ts
 import { readFileSync as readFileSync13, readdirSync as readdirSync11, existsSync as existsSync18, statSync as statSync13 } from "node:fs";
 import { readFile as readFile13 } from "node:fs/promises";
-import { basename as basename4, join as join28, resolve as resolve14, sep as sep3 } from "node:path";
+import { basename as basename5, join as join28, resolve as resolve14, sep as sep3 } from "node:path";
 import { homedir as homedir20 } from "node:os";
 function getCursorHome2() {
   return process.env.CURSOR_HOME || join28(homedir20(), ".cursor");
@@ -24836,7 +24682,7 @@ function findCursorTranscript(sessionId) {
   const dir = getCursorSessionDir(sessionId);
   if (!dir)
     return null;
-  const newCandidate = join28(dir, `${basename4(dir)}.jsonl`);
+  const newCandidate = join28(dir, `${basename5(dir)}.jsonl`);
   if (existsSync18(newCandidate))
     return newCandidate;
   for (const name of LEGACY_TRANSCRIPT_FILE_CANDIDATES2) {
@@ -27065,6 +26911,9 @@ var init_fp_reset = __esm(() => {
 // src/hooks/semantic/jev-config.ts
 import { closeSync as closeSync2, constants as fsConstants2, fstatSync as fstatSync2, openSync as openSync2, readSync as readSync2, statSync as statSync18 } from "node:fs";
 import { dirname as dirname12 } from "node:path";
+function parseJevMode(raw) {
+  return raw === "off" || raw === "observe" || raw === "enforce" ? raw : null;
+}
 function jevCloudBaseUrl(cloudBase) {
   const url = new URL(cloudBase);
   return `${url.origin}${url.pathname.replace(/\/+$/, "")}${JEV_CLOUD_BASE_PATH}`;
@@ -27288,14 +27137,15 @@ function validateJevConfig(raw, envKey, cloud) {
     cfg.timeoutMs = t;
   }
   if (o.mode !== undefined) {
-    if (o.mode !== "off" && o.mode !== "shadow" && o.mode !== "enforce")
-      return { ok: false, problem: 'mode must be "off", "shadow" or "enforce"' };
-    cfg.mode = o.mode;
+    const mode = parseJevMode(o.mode);
+    if (mode === null)
+      return { ok: false, problem: 'mode must be "off", "observe" or "enforce"' };
+    cfg.mode = mode;
   }
   if (cfg.baseUrl !== undefined && isPlainHttp(cfg.baseUrl) && cfg.mode === "enforce") {
     return {
       ok: false,
-      problem: "plain http (to localhost) is accepted only with mode shadow: in enforce mode Jev's answers can clear a deny, " + "and while the local proxy is down any process on this machine could take its port and answer. " + (cfg.provider === JEV_CLOUD_PROVIDER ? "Reconnect to an https FailproofAI Cloud URL (failproofai config --token <key> --url https://…), or keep mode shadow" : "Use https, or mode shadow")
+      problem: "plain http (to localhost) is accepted only with mode observe: in enforce mode Jev's answers can clear a deny, " + "and while the local proxy is down any process on this machine could take its port and answer. " + (cfg.provider === JEV_CLOUD_PROVIDER ? "Reconnect to an https FailproofAI Cloud URL (failproofai config --token <key> --url https://…), or keep mode observe" : "Use https, or mode observe")
     };
   }
   return { ok: true, value: cfg };
@@ -27570,6 +27420,19 @@ function classifyTool(toolName) {
     return { toolClass: "other", toolIsKnown: true };
   return { toolClass: "other", toolIsKnown: false };
 }
+function runsNestedShell(tokens) {
+  let shellSeen = false;
+  for (const tok of tokens) {
+    if (shellSeen && /^-[a-z]*c[a-z]*$/i.test(tok))
+      return true;
+    const base = tok.slice(tok.lastIndexOf("/") + 1);
+    if (base === "eval")
+      return true;
+    if (NESTED_SHELLS.has(base))
+      shellSeen = true;
+  }
+  return false;
+}
 function scanCommand(command) {
   const text = command.length > MAX_SCAN_CHARS ? command.slice(0, MAX_SCAN_CHARS) : command;
   const segments = [];
@@ -27580,22 +27443,36 @@ function scanCommand(command) {
   let out = "";
   let commentsRemoved = false;
   const comments = [];
+  let complete = command.length <= MAX_SCAN_CHARS;
+  let braceDepth = 0;
+  let braceSep = false;
+  let bracketOpen = false;
   const endWord = () => {
     if (inWord)
       tokens.push(word);
     word = "";
     inWord = false;
+    braceDepth = 0;
+    braceSep = false;
+    bracketOpen = false;
   };
   const endSegment = () => {
     endWord();
-    if (tokens.length > 0)
+    if (tokens.length > 0) {
+      if (complete && runsNestedShell(tokens))
+        complete = false;
       segments.push(tokens);
+    }
     tokens = [];
   };
   for (let i = 0;i < text.length; i++) {
     const c = text[i];
     if (quote) {
       out += c;
+      if (quote === '"' && (c === "`" || c === "$" && EXPANSION_START.test(text[i + 1] ?? "") || c === "\\" && text[i + 1] === `
+`)) {
+        complete = false;
+      }
       if (c === quote) {
         quote = null;
       } else if (c === "\\" && quote === '"' && i + 1 < text.length) {
@@ -27606,6 +27483,10 @@ function scanCommand(command) {
       }
       continue;
     }
+    if (c === "`" || c === "$" && (text[i + 1] === "'" || text[i + 1] === '"' || EXPANSION_START.test(text[i + 1] ?? "")) || (c === "<" || c === ">") && text[i + 1] === "(" || c === "<" && text[i + 1] === "<" || c === "\\" && text[i + 1] === `
+`) {
+      complete = false;
+    }
     if (c === "'" || c === '"') {
       quote = c;
       inWord = true;
@@ -27646,12 +27527,29 @@ function scanCommand(command) {
       out += c;
       continue;
     }
+    if (c === "{") {
+      braceDepth++;
+    } else if (braceDepth > 0 && (c === "," || c === "." && text[i + 1] === ".")) {
+      braceSep = true;
+    } else if (c === "}" && braceDepth > 0) {
+      braceDepth--;
+      if (braceSep)
+        complete = false;
+    } else if (c === "*" || c === "?") {
+      complete = false;
+    } else if (c === "[") {
+      bracketOpen = true;
+    } else if (c === "]" && bracketOpen) {
+      complete = false;
+    }
     word += c;
     inWord = true;
     out += c;
   }
   endSegment();
-  return { segments, withoutComments: out.trimEnd(), commentsRemoved, comments };
+  if (quote)
+    complete = false;
+  return { segments, withoutComments: out.trimEnd(), commentsRemoved, comments, complete };
 }
 function expandHome(token, home) {
   if (token === "~")
@@ -27784,7 +27682,7 @@ function computeFacts(toolName, toolInput, cwd, permissionMode, scanned, pinnedP
     permissionMode
   };
 }
-var SHELL_TOOLS, WRITE_TOOLS, READ_TOOLS, NETWORK_TOOLS, INERT_TOOLS, MAX_SCAN_CHARS = 8192, PATH_LIKE, GLOB_CHARS, MAX_PATHS = 12;
+var SHELL_TOOLS, WRITE_TOOLS, READ_TOOLS, NETWORK_TOOLS, INERT_TOOLS, MAX_SCAN_CHARS = 8192, NESTED_SHELLS, EXPANSION_START, PATH_LIKE, GLOB_CHARS, MAX_PATHS = 12;
 var init_facts = __esm(() => {
   SHELL_TOOLS = new Set(["Bash", "BashOutput"]);
   WRITE_TOOLS = new Set(["Write", "Edit", "MultiEdit", "NotebookEdit"]);
@@ -27803,6 +27701,8 @@ var init_facts = __esm(() => {
     "SlashCommand",
     "Skill"
   ]);
+  NESTED_SHELLS = new Set(["sh", "bash", "zsh", "dash", "ksh", "ash", "fish"]);
+  EXPANSION_START = /[A-Za-z_0-9@*#?$!\-({]/;
   PATH_LIKE = /^(?:\/|~|\.\.?(?:\/|$)|[^:]*\/)/;
   GLOB_CHARS = /[*?[]/;
 });
@@ -27811,50 +27711,70 @@ var init_facts = __esm(() => {
 function tokensOf(text) {
   return text.toLowerCase().split(/[^a-z0-9._@-]+/).filter((t) => t.length >= 3 && !GENERIC_TOKENS.has(t) && !/^\d+$/.test(t));
 }
-function targetTokens(toolInput) {
-  const out = new Set;
+function scanTargets(toolInput) {
+  const groups = [];
+  const addGroup = (tok) => {
+    const words = tokensOf(tok);
+    if (words.length > 0)
+      groups.push(new Set(words));
+  };
   const command = typeof toolInput.command === "string" ? toolInput.command : null;
   if (command) {
-    for (const seg of scanCommand(command).segments) {
+    const scanned = scanCommand(command);
+    for (const seg of scanned.segments) {
       for (const tok of seg.slice(1)) {
-        if (tok.startsWith("-"))
-          continue;
-        for (const t of tokensOf(tok))
-          out.add(t);
+        if (!tok.startsWith("-"))
+          addGroup(tok);
       }
     }
-    if (out.size === 0) {
+    if (groups.length === 0) {
       for (const piece of command.split(/[;&|\n]+/)) {
         for (const tok of piece.trim().split(/\s+/).slice(1)) {
           if (!tok.startsWith("-"))
-            for (const t of tokensOf(tok))
-              out.add(t);
+            addGroup(tok);
         }
       }
     }
-    return out;
+    return { targets: new Set(groups.flatMap((g) => [...g])), groups, complete: scanned.complete };
   }
+  const all = new Set;
   for (const [key, value] of Object.entries(toolInput)) {
     if (typeof value !== "string" || value.length > 300)
       continue;
     if (/content|old_string|new_string|body|text|prompt/i.test(key))
       continue;
     for (const t of tokensOf(value))
-      out.add(t);
+      all.add(t);
   }
-  return out;
+  return { targets: all, groups: all.size > 0 ? [all] : [], complete: true };
 }
-function targetNamedByUser(targets, userSaid) {
-  if (userSaid.length === 0)
+function everyTargetNamed(scan, userSaid) {
+  if (userSaid.length === 0 || scan.groups.length === 0)
     return false;
-  if (targets.size === 0)
+  const said = userSaid.join(`
+`).toLowerCase();
+  return scan.groups.every((g) => {
+    for (const t of g)
+      if (said.includes(t))
+        return true;
+    return false;
+  });
+}
+function partlyNamed(scan, userSaid) {
+  if (userSaid.length === 0 || scan.groups.length < 2)
     return false;
   const said = userSaid.join(`
 `).toLowerCase();
-  for (const t of targets)
-    if (said.includes(t))
-      return true;
-  return false;
+  let named = 0;
+  for (const g of scan.groups) {
+    for (const t of g) {
+      if (said.includes(t)) {
+        named++;
+        break;
+      }
+    }
+  }
+  return named > 0 && named < scan.groups.length;
 }
 function formatOutcome(p, o) {
   return `${p.title} (semantic/${p.name}, p=${o.evidence.toFixed(2)}). ${p.guidance}`;
@@ -27864,7 +27784,7 @@ function decide(selected, answers, toolInput, userSaid, thresholds = DEFAULT_THR
   const injected = injection !== null && injection >= thresholds.injection;
   const scope = typeof answers.scope === "number" ? answers.scope : null;
   const withinScope = scope !== null && scope >= thresholds.scope;
-  let targets = null;
+  let scan = null;
   const outcomes = selected.map((p) => {
     const evidence = Math.min(...p.probes.map((probe) => answers[`${p.name}.${probe.id}`] ?? 0));
     const exempt = p.exempt ? answers[`${p.name}.exempt`] ?? 0 : null;
@@ -27887,9 +27807,11 @@ function decide(selected, answers, toolInput, userSaid, thresholds = DEFAULT_THR
       return { ...base, escalatedByInjection: true, verdict: "deny" };
     const fired = p.mode === "deny" && evidence >= thresholds.deny ? "deny" : "instruct";
     if (p.userCanOverride && userAsked !== null && userAsked >= thresholds.userAsked && withinScope) {
-      targets ??= targetTokens(toolInput);
-      const named = targets.size > 0 && targetNamedByUser(targets, userSaid);
-      if (targets.size === 0 || named || userSaidCut)
+      scan ??= scanTargets(toolInput);
+      if (!scan.complete)
+        return { ...base, verdict: fired, targetScanIncomplete: true };
+      const named = scan.groups.length > 0 && everyTargetNamed(scan, userSaid);
+      if (scan.groups.length === 0 || named || userSaidCut)
         return { ...base, targetNamedByUser: named, verdict: "overridden" };
     }
     return { ...base, verdict: fired };
@@ -27939,12 +27861,14 @@ function decideV1(selected, answers, toolInput, userSaid, agentLastMessage, opts
   const task = num("task_step");
   const op = num("op_requested");
   const beyond = num("beyond_task");
-  let targets = null;
+  let scan = null;
+  const targetScan = () => scan ??= scanTargets(toolInput);
+  const evidenceSaid = agentLastMessage ? [...userSaid, agentLastMessage] : userSaid;
   const targetOk = () => {
-    targets ??= targetTokens(toolInput);
-    if (targets.size === 0)
+    const s = targetScan();
+    if (s.groups.length === 0)
       return { ok: true, named: false };
-    const named = targetNamedByUser(targets, agentLastMessage ? [...userSaid, agentLastMessage] : userSaid);
+    const named = everyTargetNamed(s, evidenceSaid);
     return { ok: named || userSaidCut, named };
   };
   const outcomes = selected.map((p) => {
@@ -27969,12 +27893,14 @@ function decideV1(selected, answers, toolInput, userSaid, agentLastMessage, opts
     const fired = p.mode === "deny" && evidence >= t.deny ? "deny" : "instruct";
     if (!p.userCanOverride)
       return { ...base, verdict: fired };
+    if (!targetScan().complete)
+      return { ...base, verdict: fired, targetScanIncomplete: true };
     if (op !== null && op >= t.opRequested && beyond !== null && beyond < t.opBeyondMax) {
       const target = targetOk();
       if (target.ok)
         return { ...base, targetNamedByUser: target.named, verdict: "overridden", intent: "op-requested" };
     }
-    if (taskClears && task !== null && task >= t.taskStep && beyond !== null && beyond < t.taskBeyondMax) {
+    if (taskClears && task !== null && task >= t.taskStep && beyond !== null && beyond < t.taskBeyondMax && !(typeof toolInput.command === "string" && !userSaidCut && partlyNamed(targetScan(), evidenceSaid))) {
       if (fired === "instruct")
         return { ...base, verdict: "overridden", intent: "task-step" };
       return { ...base, verdict: "instruct", intent: "downgraded-task-step" };
@@ -29657,7 +29583,7 @@ function authorityOf(p) {
   return { authority, reviewedBy };
 }
 function resolveMode(cfg) {
-  return cfg.mode === "shadow" || cfg.mode === "enforce" ? cfg.mode : DEFAULT_JEV_MODE;
+  return cfg.mode === "observe" || cfg.mode === "enforce" ? cfg.mode : DEFAULT_JEV_MODE;
 }
 function resolveTimeout(cfg) {
   const t = cfg.timeoutMs;
@@ -29775,7 +29701,7 @@ function startJevReview(cfg, call) {
         sessionId: call.sessionId,
         cli: call.cli,
         eventType: call.eventType,
-        applied: abandoned || review.kind !== "answered" ? "legacy-fallback" : mode === "shadow" ? "shadow" : "two-tier"
+        applied: abandoned || review.kind !== "answered" ? "legacy-fallback" : mode === "observe" ? "observe" : "two-tier"
       });
       appendVerdictLog(hit ? { ...row, cached: true } : row);
     }
@@ -30026,6 +29952,8 @@ async function startTwoTier(canonicalEventType, parsed, session, cli, opts, acti
     return null;
   if (jevForcedOff(opts) || activePause)
     return null;
+  if (!jevChecksInstalled())
+    return null;
   const loaded = await readJevConfig();
   if (!loaded)
     return null;
@@ -30044,7 +29972,7 @@ async function startTwoTier(canonicalEventType, parsed, session, cli, opts, acti
   } catch (err) {
     hookLogInfo(`Jev review could not start (${err instanceof Error ? err.message : String(err)})`);
     return {
-      mode: cfg.mode === "shadow" || cfg.mode === "enforce" ? cfg.mode : loaded.defaultMode,
+      mode: cfg.mode === "observe" || cfg.mode === "enforce" ? cfg.mode : loaded.defaultMode,
       review: Promise.resolve({ kind: "fallback", reason: "error", latencyMs: null, model: null }),
       abort: () => {},
       authorityOf: () => ({ authority: "hard", reviewedBy: [] })
@@ -30068,6 +29996,8 @@ async function captureJevIntent(canonicalEventType, decision, parsed, session, c
   if (canonicalEventType !== "UserPromptSubmit" || jevForcedOff(opts))
     return;
   try {
+    if (!jevChecksInstalled())
+      return;
     if (!await readJevConfig())
       return;
     if (decision === "deny") {
@@ -30148,7 +30078,7 @@ async function evaluateHookEvent(eventType, cli = "claude", stdinPayload, opts)
       config = readMergedHooksConfig(session.cwd);
       clearPolicies(cli);
       activePause = readActivePause(session.sessionId);
-      const packsInstalledHere = hasInstalledPacks();
+      const packsInstalledHere = hasInstalledRegexPacks();
       const legacyNames = activePause || packsInstalledHere ? [] : config.enabledPolicies;
       registerBuiltinPolicies(activePause ? [] : legacyNames);
       if (legacyNames.length > 0) {
@@ -30222,14 +30152,14 @@ async function evaluateHookEvent(eventType, cli = "claude", stdinPayload, opts)
         const observeOnly = cloudManaged?.effect === "observe" || pack?.effect === "observe";
         const fn = async (ctx) => {
           if (observeOnly) {
-            const shadow = await runObserved(hook, ctx, hookName, eventType, cli);
-            if (shadow.decision !== "allow") {
+            const observed = await runObserved(hook, ctx, hookName, eventType, cli);
+            if (observed.decision !== "allow") {
               const observer = cloudManaged ?? pack;
               observedResults.push({
                 policyId: observer.id,
                 version: observer.version,
-                decision: shadow.decision,
-                reason: shadow.reason ?? null
+                decision: observed.decision,
+                reason: observed.reason ?? null
               });
             }
             return { decision: "allow" };
@@ -30319,13 +30249,13 @@ async function evaluateHookEvent(eventType, cli = "claude", stdinPayload, opts)
       ...twoTier,
       releaseRegistry: opts?.releaseRegistry
     }) : await evaluatePolicies(canonicalEventType, parsed, session, config);
-    const shadowVerdict = result.twoTier?.shadowVerdict;
-    if (shadowVerdict) {
+    const observeVerdict = result.twoTier?.observeVerdict;
+    if (observeVerdict) {
       observedResults.push({
-        policyId: shadowVerdict.policyName,
-        version: shadowVerdict.version,
-        decision: shadowVerdict.decision,
-        reason: shadowVerdict.reason
+        policyId: observeVerdict.policyName,
+        version: observeVerdict.version,
+        decision: observeVerdict.decision,
+        reason: observeVerdict.reason
       });
     }
     const durationMs = Math.round(performance.now() - startTime);
@@ -31248,7 +31178,7 @@ import {
   rmSync as rmSync9,
   writeFileSync as writeFileSync14
 } from "node:fs";
-import { basename as basename5, dirname as dirname16, join as join32, resolve as resolve24 } from "node:path";
+import { basename as basename6, dirname as dirname16, join as join32, resolve as resolve24 } from "node:path";
 function migrateToLayout4() {
   const moves = [
     { from: legacy.authJson(), to: auditSessionFile() },
@@ -31284,7 +31214,7 @@ function migrateToLayout4() {
       }
       rmSync9(from, { force: true });
     }
-    migrated.push(`${basename5(from)} → audit/${basename5(to)}`);
+    migrated.push(`${basename6(from)} → audit/${basename6(to)}`);
   }
   for (const secret of [auditSessionFile()]) {
     if (!existsSync29(secret))
@@ -31328,7 +31258,7 @@ function appendLedger(entry) {
   } catch {}
 }
 function backupNameOf(f) {
-  return f.as ?? basename5(f.at());
+  return f.as ?? basename6(f.at());
 }
 function pruneMigratedCredentials(from) {
   const pruned = [];
@@ -31477,7 +31407,7 @@ var init_migrations = __esm(() => {
     { at: legacy.auditSchedule }
   ];
   PRUNED_AFTER_SUCCESS = [
-    { as: basename5(legacy.authJson()), landsAt: auditSessionFile }
+    { as: basename6(legacy.authJson()), landsAt: auditSessionFile }
   ];
 });
 
@@ -31929,7 +31859,7 @@ var init_cli_error = __esm(() => {
 // src/hooks/manager.ts
 import { execSync as execSync6 } from "node:child_process";
 import { existsSync as existsSync31 } from "node:fs";
-import { resolve as resolve26, basename as basename6 } from "node:path";
+import { resolve as resolve26, basename as basename7 } from "node:path";
 import { platform as platform3, arch as arch3, release as release2, hostname as hostname3 } from "node:os";
 function getSettingsPath(scope, cwd) {
   return claudeCode.getSettingsPath(scope, cwd);
@@ -32204,7 +32134,7 @@ Validated ${validatedHooks.length} custom hook(s) from ${path}: ${validatedHooks
   const alwaysOnNames = new Set(BUILTIN_POLICIES.filter((p) => p.alwaysOn).map((p) => p.name));
   const fromPack = policyNames === undefined ? [] : selectedPolicies.filter((name) => !alwaysOnNames.has(name));
   if (fromPack.length > 0) {
-    if (!hasInstalledPacks()) {
+    if (!hasInstalledRegexPacks()) {
       try {
         await addPack(CORE_SOURCE, { only: fromPack });
       } catch (err) {
@@ -32923,7 +32853,7 @@ function fieldsOf(file) {
     } catch {}
   }
 }
-var CLOUD_JEV_INITIAL_MODE = "shadow", MAX_JEV_CONFIG_BYTES;
+var CLOUD_JEV_INITIAL_MODE = "observe", MAX_JEV_CONFIG_BYTES;
 var init_jev_cloud_connection = __esm(() => {
   init_jev_config();
   MAX_JEV_CONFIG_BYTES = 64 * 1024;
@@ -33058,18 +32988,19 @@ function jevLines(outcome) {
   if (!config || config.status === "written") {
     const plainHttp = config?.status === "written" && new URL(config.baseUrl).protocol === "http:";
     return [
-      `  Jev       on through FailproofAI Cloud, in shadow mode: logged, not enforced (${config?.path ?? "jev.json"}).`,
-      plainHttp ? "            Enforce needs an https FailproofAI Cloud URL: reconnect with `failproofai config --token <key> --url https://…`. Over plain http Jev stays in shadow mode." : "            Enforce it with `failproofai jev setup --mode enforce`, or from the dashboard."
+      `  Jev       on through FailproofAI Cloud, in observe mode: logged, not enforced (${config?.path ?? "jev.json"}).`,
+      ...jevChecksDeclared() ? [] : ["            It has no checks installed yet, so it asks nothing. To enable it: `failproofai policies add FailproofAI/jev-policies`."],
+      plainHttp ? "            Enforce needs an https FailproofAI Cloud URL: reconnect with `failproofai config --token <key> --url https://…`. Over plain http Jev stays in observe mode." : "            Enforce it with `failproofai jev setup --mode enforce`, or from the dashboard."
     ];
   }
   if (config.status === "kept") {
     const lines = [`  Jev       key stored; ${config.path} already exists and was left as configured.`];
     if (config.otherOrigin) {
-      lines.push(config.jevOff?.why === "off" ? `            It points at ${config.otherOrigin} and has Jev switched off (mode off), so Jev is off. To point it here and turn it on: \`failproofai jev setup --provider failproofai --mode shadow\`.` : `            It points at ${config.otherOrigin}, so Jev stays off until you run \`failproofai jev setup --provider failproofai\`.`);
+      lines.push(config.jevOff?.why === "off" ? `            It points at ${config.otherOrigin} and has Jev switched off (mode off), so Jev is off. To point it here and turn it on: \`failproofai jev setup --provider failproofai --mode observe\`.` : `            It points at ${config.otherOrigin}, so Jev stays off until you run \`failproofai jev setup --provider failproofai\`.`);
     } else if (config.jevOff?.why === "refused") {
       lines.push(`            It was refused (${config.jevOff.problem}), so Jev is off. ${config.jevOff.fix ? `Fix: \`${config.jevOff.fix}\`.` : "Write a valid one: `failproofai jev setup --provider failproofai`."}`);
     } else if (config.jevOff?.why === "off") {
-      lines.push("            It has Jev switched off (mode off), so Jev is off. To turn it on: `failproofai jev setup --mode shadow`.");
+      lines.push("            It has Jev switched off (mode off), so Jev is off. To turn it on: `failproofai jev setup --mode observe`.");
     }
     if (jev.stillOn) {
       lines.push(`            Jev is still on through FailproofAI Cloud (${jev.stillOn} mode): it sends each checked tool call and the recent prompt to FailproofAI Cloud. To switch it off: \`failproofai jev setup --mode off\`.`);
@@ -33131,11 +33062,12 @@ var init_cloud_connection = __esm(() => {
   init_cloud_enrollment();
   init_fp_home();
   init_fp_config();
+  init_effective_reviewers();
   init_collector_config();
 });
 
 // src/hooks/setup-state.ts
-import { existsSync as existsSync34, realpathSync as realpathSync2, statSync as statSync24 } from "node:fs";
+import { existsSync as existsSync34, realpathSync as realpathSync3, statSync as statSync24 } from "node:fs";
 import { dirname as dirname19, resolve as resolve27 } from "node:path";
 import { homedir as homedir26 } from "node:os";
 function globalConfigPath(home = homedir26()) {
@@ -33179,7 +33111,7 @@ function hasGlobalHooksInstalled() {
 function realResolve(path) {
   const lexical = resolve27(path);
   try {
-    return realpathSync2(lexical);
+    return realpathSync3(lexical);
   } catch {
     return lexical;
   }
@@ -33350,7 +33282,7 @@ var init_onboarding_lock = __esm(() => {
 
 // lib/claude-sessions.ts
 import { readdirSync as readdirSync19, statSync as statSync25, existsSync as existsSync36 } from "node:fs";
-import { join as join34, basename as basename7 } from "node:path";
+import { join as join34, basename as basename8 } from "node:path";
 function getClaudeProjectsRoot() {
   return getClaudeProjectsPath();
 }
@@ -37488,7 +37420,7 @@ function surveyReviewableCoverage(cwd) {
       records.push(...selected ? pack.policies.filter((p) => selected.includes(p.name)) : pack.policies);
     }
     const asked = semanticPoliciesFromPacks(jevPacks(packs));
-    reviewers = asked.fromPack ? new Set(asked.policies.map((p) => p.name)) : SEMANTIC_REVIEWER_NAMES;
+    reviewers = new Set(asked.policies.map((p) => p.name));
   } catch {}
   let config;
   try {
@@ -37520,7 +37452,7 @@ function surveyReviewableCoverage(cwd) {
   } catch {
     customFiles = 0;
   }
-  return { ...countReviewable(records, reviewers), customFiles };
+  return { ...countReviewable(records, reviewers), customFiles, jevChecks: reviewers?.size ?? 0 };
 }
 function reviewableSummary(coverage) {
   const { enabled, reviewable } = coverage;
@@ -37533,11 +37465,13 @@ function reviewableSummary(coverage) {
   return `${reviewable} of ${noun} reviewable: Jev may clear a deny or an instruction from those, and from no others${tail}.`;
 }
 function reviewableProblem(coverage) {
+  if (coverage.jevChecks === 0)
+    return NO_JEV_CHECKS_PROBLEM;
   if (coverage.enabled === 0 || coverage.reviewable > 0 || coverage.customFiles > 0)
     return null;
   return "Jev can add a deny or an instruction on this machine, but it can never clear one. " + "No enabled policy is marked reviewable — a policy pack published before this release carries no such marks — " + `so re-take the pack (\`${RETAKE_PACK_COMMAND}\`) to get a marked copy, ` + "or enforce this build's builtin policies, which carry them.";
 }
-var RETAKE_PACK_COMMAND = "failproofai policies add FailproofAI/policies";
+var RETAKE_PACK_COMMAND = "failproofai policies add FailproofAI/policies", JEV_POLICIES_ADD_COMMAND = "failproofai policies add FailproofAI/jev-policies", NO_JEV_CHECKS_PROBLEM;
 var init_policy_reviewability = __esm(() => {
   init_cloud_managed_policies();
   init_effective_reviewers();
@@ -37549,6 +37483,7 @@ var init_policy_reviewability = __esm(() => {
   init_policy_catalog();
   init_policy_registry();
   init_pack_policies();
+  NO_JEV_CHECKS_PROBLEM = `Jev has no checks installed, so it asks nothing and clears nothing. To enable it: \`${JEV_POLICIES_ADD_COMMAND}\`.`;
 });
 
 // src/hooks/semantic/jev-stats.ts
@@ -37594,14 +37529,14 @@ function computeJevStats(entries, opts = {}) {
     notConsulted: 0,
     noRequest: 0,
     decisions: { allow: 0, instruct: 0, deny: 0 },
-    modes: { shadow: 0, enforce: 0 },
-    shadowClearsByPolicy: {},
+    modes: { observe: 0, enforce: 0 },
+    observeClearsByPolicy: {},
     models: {}
   };
   const latencies = [];
   const fallbackReasons = new Counter;
   const clearsByPolicy = new Counter;
-  const shadowClearsByPolicy = new Counter;
+  const observeClearsByPolicy = new Counter;
   const models = new Counter;
   for (const raw of entries) {
     if (typeof raw.timestamp !== "number" || raw.timestamp < since || raw.timestamp > now)
@@ -37633,13 +37568,13 @@ function computeJevStats(entries, opts = {}) {
       latencies.push(e.jevLatencyMs);
     if (e.jevModel)
       models.bump(e.jevModel);
-    const clears = e.jevMode === "shadow" ? shadowClearsByPolicy : clearsByPolicy;
+    const clears = e.jevMode === "observe" ? observeClearsByPolicy : clearsByPolicy;
     for (const name of e.jevCleared ?? [])
       clears.bump(name);
   }
   stats.fallbackReasons = fallbackReasons.toRecord();
   stats.clearsByPolicy = clearsByPolicy.toRecord();
-  stats.shadowClearsByPolicy = shadowClearsByPolicy.toRecord();
+  stats.observeClearsByPolicy = observeClearsByPolicy.toRecord();
   stats.models = models.toRecord();
   stats.fallbackRate = stats.total > 0 ? stats.fallbacks / stats.total : 0;
   latencies.sort((a, b) => a - b);
@@ -37705,7 +37640,7 @@ function parseFlags(argv, allowed) {
 function modeLine(mode) {
   if (mode === "off")
     return "off — Jev is not asked at all; the regex policies decide alone";
-  return mode === "enforce" ? "enforce — Jev's verdicts apply: it may clear a reviewable policy's deny and add its own" : "shadow — Jev is asked and logged; the regex result is what is enforced";
+  return mode === "enforce" ? "enforce — Jev's verdicts apply: it may clear a reviewable policy's deny and add its own" : "observe — Jev is asked and logged; the regex result is what is enforced";
 }
 function providerLabel(provider) {
   return provider === JEV_CLOUD_PROVIDER ? "FailproofAI Cloud" : provider;
@@ -37836,14 +37771,14 @@ function jevStatsLines(stats, opts = {}) {
   const reasons = Object.entries(stats.fallbackReasons).sort((a, b) => b[1] - a[1]).map(([r, n]) => `${r} ×${n}`).join(", ");
   const byPolicy = (counts) => Object.entries(counts ?? {}).sort((a, b) => b[1] - a[1]).map(([p, n]) => `${p} ×${n}`).join(", ");
   const clears = byPolicy(stats.clearsByPolicy);
-  const shadowClears = byPolicy(stats.shadowClearsByPolicy);
+  const observeClears = byPolicy(stats.observeClearsByPolicy);
   const ms = (v) => v === null ? "—" : `${Math.round(v)} ms`;
   return stack(heading, rows([
     ["evaluations", String(stats.total)],
     ["fell back to regex", `${pct(stats.fallbackRate)}${reasons ? ` (${reasons})` : ""}`],
     ["latency", `p50 ${ms(stats.latencyP50Ms)} · p95 ${ms(stats.latencyP95Ms)}`],
     ["cleared", clears || "nothing"],
-    ...shadowClears ? [["would have cleared (shadow)", shadowClears]] : []
+    ...observeClears ? [["would have cleared (observe)", observeClears]] : []
   ], opts));
 }
 function originOf2(provider, baseUrl) {
@@ -38295,8 +38230,7 @@ async function cloudSetup(values, bools, opts) {
   delete next.accountId;
   if (!sameProvider && existing?.raw.timeoutMs !== undefined)
     next.timeoutMs = existing.raw.timeoutMs;
-  const mode = values.get("--mode") ?? (sameProvider && typeof next.mode === "string" ? next.mode : "shadow");
-  next.mode = mode;
+  next.mode = values.get("--mode") ?? (sameProvider && typeof next.mode === "string" ? next.mode : "observe");
   if (values.has("--timeout-ms")) {
     const rawTimeout = values.get("--timeout-ms");
     const n = Number(rawTimeout);
@@ -38325,7 +38259,7 @@ async function cloudSetup(values, bools, opts) {
         `Reconnect with this machine's key to re-check what it carries (an older failproofai connected without storing its Jev key; a key without jev:evaluate needs the "machine" preset on the dashboard's Keys page):`
       ] : [
         "Not saved: this machine is not connected to FailproofAI Cloud with a key that carries jev:evaluate.",
-        'Connect it with one that does (the "machine" preset) — that also turns Jev on, in shadow mode, when there is no jev.json yet:'
+        'Connect it with one that does (the "machine" preset) — that also turns Jev on, in observe mode, when there is no jev.json yet:'
       ],
       "  failproofai config --token <key>",
       "",
@@ -38392,7 +38326,7 @@ function displayOnlyCloudOrigin(routing) {
 function namedEndpoint(raw) {
   if (!raw || typeof raw.provider !== "string" || !JEV_PROVIDER_KINDS.includes(raw.provider))
     return null;
-  const routing = { provider: raw.provider, apiKey: ENV_KEY_STAND_IN, mode: "shadow", ...displayOnlyCloudOrigin(raw) };
+  const routing = { provider: raw.provider, apiKey: ENV_KEY_STAND_IN, mode: "observe", ...displayOnlyCloudOrigin(raw) };
   if (raw.baseUrl !== undefined)
     routing.baseUrl = raw.baseUrl;
   if (raw.accountId !== undefined)
@@ -38501,6 +38435,7 @@ async function status(argv, opts) {
             enabled: coverage.enabled,
             reviewable: coverage.reviewable,
             customPolicyFiles: coverage.customFiles,
+            jevChecks: coverage.jevChecks,
             problem: coverageProblem
           }
         } : {}
@@ -38543,7 +38478,7 @@ async function status(argv, opts) {
       ["mode", modeLine("off")],
       ["config", inspection.path],
       ...r.provider === JEV_CLOUD_PROVIDER ? [["key", cloudKeyRow()]] : []
-    ], opts), nextStep("failproofai jev setup --mode shadow", "Switch it back on (shadow logs Jev and keeps enforcing regex; enforce lets it clear), here or from the dashboard:", opts), legacyNote, jevStatsLines(stats, opts)));
+    ], opts), nextStep("failproofai jev setup --mode observe", "Switch it back on (observe logs Jev and keeps enforcing regex; enforce lets it clear), here or from the dashboard:", opts), legacyNote, jevStatsLines(stats, opts)));
   }
   if (inspection.status === "not-connected") {
     const r = inspection.routing;
@@ -38615,7 +38550,7 @@ async function test(argv, deps, opts) {
     const why = inspection.status === "absent" ? `There is no ${inspection.path}; nothing to test.` : inspection.status === "key-missing" ? `${inspection.path} takes its key from ${JEV_API_KEY_ENV}, which is not set in this shell, so there is no key to test with.` : inspection.status === "off" ? `Jev is switched off in ${inspection.path} (mode off), so nothing is sent.` : inspection.status === "not-connected" ? `${inspection.path} sends Jev requests through FailproofAI Cloud, and this machine is not connected to it with a key that carries jev:evaluate.` : inspection.status === "key-lacks-jev" ? `${inspection.path} sends Jev requests through FailproofAI Cloud, and no Jev key is stored for this machine's connection.` : `${inspection.path} was refused — ${inspection.problem}.`;
     const code = inspection.status === "absent" ? "not-configured" : inspection.status === "key-missing" ? "no-env-key" : inspection.status === "off" ? "switched-off" : inspection.status === "not-connected" || inspection.status === "key-lacks-jev" ? inspection.status : "config";
     const refusedNext = inspection.status === "refused" ? refusedNextStep(inspection, cloudRoute(readJevConfigFileForUpdate()?.raw)) : inspection.status === "absent" && cloudCredentialPresent() ? { cmd: "failproofai jev setup --provider failproofai", lead: "This machine's FailproofAI Cloud key already carries jev:evaluate. Turn it on:" } : null;
-    const fixCmd = refusedNext ? refusedNext.cmd : inspection.status === "key-missing" ? "failproofai jev setup --key-stdin < key-file" : inspection.status === "off" ? "failproofai jev setup --mode shadow" : inspection.status === "not-connected" || inspection.status === "key-lacks-jev" ? "failproofai config --token <key>" : "failproofai jev setup --provider <kind> --key-stdin";
+    const fixCmd = refusedNext ? refusedNext.cmd : inspection.status === "key-missing" ? "failproofai jev setup --key-stdin < key-file" : inspection.status === "off" ? "failproofai jev setup --mode observe" : inspection.status === "not-connected" || inspection.status === "key-lacks-jev" ? "failproofai config --token <key>" : "failproofai jev setup --provider <kind> --key-stdin";
     const fixLead = refusedNext ? refusedNext.lead : inspection.status === "key-missing" ? `Set ${JEV_API_KEY_ENV} for this shell, or store the key in the file:` : inspection.status === "off" ? "Switch it back on:" : inspection.status === "not-connected" ? "Connect with a key that carries jev:evaluate:" : inspection.status === "key-lacks-jev" ? `Reconnect with this machine's key to re-check what it carries (a key without jev:evaluate needs the "machine" preset on the dashboard's Keys page):` : undefined;
     const json = asJson ? JSON.stringify({ ok: false, error: { code, message: why } }, null, 2) : undefined;
     return fail2(stack(title("failproofai jev test", "not run", opts), note(why, opts), nextStep(fixCmd, fixLead, opts)), json);
@@ -38844,7 +38779,7 @@ var init_jev_cli = __esm(() => {
     "Usage:",
     "  failproofai jev --url <url> [--key-stdin | --token <token>] [options]",
     "  failproofai jev setup --provider <kind> [--key-stdin | --key-from-env] [options]",
-    "  failproofai jev setup --provider failproofai [--mode off|shadow|enforce]   (FailproofAI Cloud: no key, no URL)",
+    "  failproofai jev setup --provider failproofai [--mode off|observe|enforce]   (FailproofAI Cloud: no key, no URL)",
     "  failproofai jev status [--json]",
     "  failproofai jev test [--json]",
     "  failproofai jev models [--provider <kind>] [--url <base>] [--json]",
@@ -38954,7 +38889,7 @@ import {
   rmSync as rmSync16,
   writeFileSync as writeFileSync26
 } from "node:fs";
-import { basename as basename8, dirname as dirname25, join as join39, resolve as resolve32 } from "node:path";
+import { basename as basename9, dirname as dirname25, join as join39, resolve as resolve32 } from "node:path";
 function migrateToLayout42() {
   const moves = [
     { from: legacy.authJson(), to: auditSessionFile() },
@@ -38990,7 +38925,7 @@ function migrateToLayout42() {
       }
       rmSync16(from, { force: true });
     }
-    migrated.push(`${basename8(from)} → audit/${basename8(to)}`);
+    migrated.push(`${basename9(from)} → audit/${basename9(to)}`);
   }
   for (const secret of [auditSessionFile()]) {
     if (!existsSync46(secret))
@@ -39034,7 +38969,7 @@ function appendLedger2(entry) {
   } catch {}
 }
 function backupNameOf2(f) {
-  return f.as ?? basename8(f.at());
+  return f.as ?? basename9(f.at());
 }
 function pruneMigratedCredentials2(from) {
   const pruned = [];
@@ -39205,7 +39140,7 @@ var init_migrations2 = __esm(() => {
     { at: legacy.auditSchedule }
   ];
   PRUNED_AFTER_SUCCESS2 = [
-    { as: basename8(legacy.authJson()), landsAt: auditSessionFile }
+    { as: basename9(legacy.authJson()), landsAt: auditSessionFile }
   ];
 });
 
@@ -39556,6 +39491,34 @@ async function installDaemonService2() {
   }
   return { installed: true };
 }
+async function probeDaemon2() {
+  try {
+    await Promise.resolve().then(() => init_daemon_client2());
+    const deadline = Date.now() + DAEMON_PROBE_READY_TIMEOUT_MS2;
+    let everConnected = false;
+    for (;; ) {
+      if (await daemonAcceptsConnections()) {
+        everConnected = true;
+        const attempt = await attemptDaemonHook2({
+          hookEvent: "SessionStart",
+          cli: "claude",
+          stdin: JSON.stringify({
+            hook_event_name: "SessionStart",
+            source: "failproofai-health-probe"
+          })
+        }, { responseTimeoutMs: DAEMON_PROBE_TIMEOUT_MS2 });
+        if (attempt.ok || attempt.failure === "protocol-mismatch")
+          return { ok: true };
+      }
+      if (Date.now() >= deadline)
+        break;
+      await new Promise((r) => setTimeout(r, DAEMON_PROBE_RETRY_MS2));
+    }
+    return { ok: false, reason: everConnected ? "worker" : "unreachable" };
+  } catch {
+    return { ok: false, reason: "unreachable" };
+  }
+}
 async function daemonAcceptsConnectionsQuietly2() {
   try {
     await Promise.resolve().then(() => init_daemon_client2());
@@ -39564,6 +39527,27 @@ async function daemonAcceptsConnectionsQuietly2() {
     return false;
   }
 }
+async function probeDaemonEndToEnd2() {
+  return (await probeDaemon2()).ok;
+}
+async function probeDaemonPolicyEvaluation2() {
+  if (!await probeDaemonEndToEnd2())
+    return false;
+  try {
+    await Promise.resolve().then(() => init_daemon_client2());
+    const attempt = await attemptDaemonPolicyEvaluation({
+      integration: "hermes",
+      event: "on_session_start",
+      payload: {
+        hook_event_name: "on_session_start",
+        source: "failproofai-native-policy-health-probe"
+      }
+    }, { responseTimeoutMs: DAEMON_PROBE_TIMEOUT_MS2 });
+    return attempt.ok;
+  } catch {
+    return false;
+  }
+}
 async function waitForDaemonRunning2(deps = {}) {
   const status = deps.status ?? daemonServiceStatus2;
   const accepts = deps.accepts ?? daemonAcceptsConnectionsQuietly2;
@@ -39668,7 +39652,7 @@ function daemonServiceStatus2() {
     return "stopped";
   }
 }
-var SERVICE_CMD_TIMEOUT_MS2 = 1e4, SERVICE_START_TIMEOUT_MS2 = 5000, SERVICE_START_POLL_MS2 = 100, SERVICE_SETTLE_MS2 = 750, SUDO_PROMPT_TIMEOUT_MS2 = 120000, UNIT_UNSAFE_RE2;
+var SERVICE_CMD_TIMEOUT_MS2 = 1e4, SERVICE_START_TIMEOUT_MS2 = 5000, SERVICE_START_POLL_MS2 = 100, SERVICE_SETTLE_MS2 = 750, SUDO_PROMPT_TIMEOUT_MS2 = 120000, UNIT_UNSAFE_RE2, DAEMON_PROBE_TIMEOUT_MS2 = 5000, DAEMON_PROBE_READY_TIMEOUT_MS2 = 1e4, DAEMON_PROBE_RETRY_MS2 = 150;
 var init_daemon_service2 = __esm(() => {
   init_hook_logger();
   init_daemon_download();
@@ -39678,6 +39662,44 @@ var init_daemon_service2 = __esm(() => {
   UNIT_UNSAFE_RE2 = /["\\\r\n]/;
 });
 
+// src/hooks/hermes-update.ts
+async function runHermesUpdateMigration(deps) {
+  const profiles = await migrateHermesProfiles(deps);
+  const relevant = profiles.filter((p) => p.status !== "untouched");
+  if (relevant.length === 0)
+    return { ok: true, lines: [], profiles };
+  const width = Math.max(...profiles.map((p) => ("hermes/" + p.name).length));
+  const lines = ["Hermes:"];
+  for (const p of profiles) {
+    const label = ("hermes/" + p.name).padEnd(width);
+    const detail = p.status === "current" ? "" : ` — ${p.detail}`;
+    lines.push(`  ${label}  ${STATUS_LABEL[p.status]}${detail}`);
+  }
+  const blocked = profiles.filter((p) => p.status === "blocked");
+  const failed = profiles.filter((p) => p.status === "failed");
+  if (profiles.some((p) => p.status === "migrated")) {
+    lines.push("  Cron jobs load the plugin on their next run; restart running Hermes gateways and sessions to load it there.");
+  }
+  if (blocked.length > 0) {
+    lines.push("", `Hermes is NOT migrated (${blocked.map((p) => p.name).join(", ")}): the running failproofaid cannot`, "answer the native plugin (no policyEvaluation), so nothing was changed. Profiles still on", "shell hooks do NOT check Hermes cron jobs. Run `failproofai config` (it asks for sudo to", "replace the daemon), then `failproofai update` again.");
+  }
+  if (failed.length > 0) {
+    lines.push("", `Hermes could not be migrated for: ${failed.map((p) => p.name).join(", ")}. Fix the reason above,`, "then run `failproofai update` again.");
+  }
+  return { ok: blocked.length === 0 && failed.length === 0, lines, profiles };
+}
+var STATUS_LABEL;
+var init_hermes_update = __esm(() => {
+  init_integrations();
+  STATUS_LABEL = {
+    migrated: "migrated",
+    current: "already current",
+    untouched: "skipped",
+    blocked: "NOT migrated",
+    failed: "FAILED"
+  };
+});
+
 // src/hooks/uninstall-cli.ts
 import { existsSync as existsSync48, rmSync as rmSync18 } from "node:fs";
 function survey(cwd) {
@@ -39857,8 +39879,8 @@ var init_uninstall_cli = __esm(() => {
 import { execFileSync as execFileSync4 } from "node:child_process";
 import { homedir as homedir32, tmpdir as tmpdir4 } from "node:os";
 import { createHash as createHash11 } from "node:crypto";
-import { copyFileSync as copyFileSync4, existsSync as existsSync49, mkdirSync as mkdirSync31, mkdtempSync as mkdtempSync3, readFileSync as readFileSync38, readdirSync as readdirSync23, realpathSync as realpathSync3, rmSync as rmSync19, statSync as statSync33, writeFileSync as writeFileSync28 } from "node:fs";
-import { basename as basename9, dirname as dirname26, isAbsolute as isAbsolute6, join as join40, relative as relative5, resolve as resolve34, sep as sep6 } from "node:path";
+import { copyFileSync as copyFileSync4, existsSync as existsSync49, mkdirSync as mkdirSync31, mkdtempSync as mkdtempSync3, readFileSync as readFileSync38, readdirSync as readdirSync23, realpathSync as realpathSync4, rmSync as rmSync19, statSync as statSync33, writeFileSync as writeFileSync28 } from "node:fs";
+import { basename as basename10, dirname as dirname26, isAbsolute as isAbsolute6, join as join40, relative as relative5, resolve as resolve34, sep as sep6 } from "node:path";
 function parseList(rest, ...flags) {
   let found = false;
   const out = [];
@@ -40058,10 +40080,10 @@ async function build(rest) {
   const requiredCli = semantic.length > 0 ? minCliVersion ?? JEV_PACK_MIN_CLI : minCliVersion;
   const questionCost = semantic.reduce((total, entry) => total + questionChars(entry), 0);
   const firstParty = isFirstPartyPack(packSource);
-  const questionBudget = MAX_PACK_QUESTION_CHARS - (firstParty ? 0 : BUILTIN_QUESTION_CHARS);
+  const questionBudget = MAX_PACK_QUESTION_CHARS - (firstParty ? 0 : JEV_POLICIES_QUESTION_CHARS);
   if (questionCost > questionBudget) {
     return fail3([
-      `This pack's ${semantic.length} semantic policies compile to ${questionCost} characters of questions, ` + (firstParty ? `over the ${MAX_PACK_QUESTION_CHARS} one Jev request has room for.` : `over the ${questionBudget} a machine leaves a pack from outside FailproofAI: one Jev request has room ` + `for ${MAX_PACK_QUESTION_CHARS}, and the 16 built-in checks every machine asks take ${BUILTIN_QUESTION_CHARS} of it first.`),
+      `This pack's ${semantic.length} semantic policies compile to ${questionCost} characters of questions, ` + (firstParty ? `over the ${MAX_PACK_QUESTION_CHARS} one Jev request has room for.` : `over the ${questionBudget} a machine leaves a pack from outside FailproofAI: one Jev request has room ` + `for ${MAX_PACK_QUESTION_CHARS}, and FailproofAI/jev-policies' 16 checks take ${JEV_POLICIES_QUESTION_CHARS} of it first ` + `where both are installed.`),
       "Shorten the probe instructions and criteria, or ship fewer policies per pack."
     ]);
   }
@@ -40129,7 +40151,7 @@ ${sha(readFileSync38(entryOut))}  ${PACK_ENTRY_ASSET}
   return ok3([
     `Built ${identity.id}@${identity.version} — ${policies.length} policies, ${on} on by default.`,
     ...semantic.length > 0 ? [
-      `  ${semantic.length} semantic ${semantic.length === 1 ? "policy" : "policies"} for Jev ` + `(${questionCost} characters of questions), ` + (identity.effect === "observe" ? "not asked where it installs: Jev asks only the checks of packs that enforce." : `${firstParty ? "replacing" : "added to"} the built-in checks where it installs.`)
+      `  ${semantic.length} semantic ${semantic.length === 1 ? "policy" : "policies"} for Jev ` + `(${questionCost} characters of questions), ` + (identity.effect === "observe" ? "not asked where it installs: Jev asks only the checks of packs that enforce." : "asked by Jev wherever it installs.")
     ] : [],
     ...requiredCli ? [`  Requires failproofai ${requiredCli} or newer.`] : [],
     ...semanticOnly ? JEV_ONLY_ROLLBACK_REMINDER : [],
@@ -40365,7 +40387,7 @@ function porcelainEntries(status) {
 }
 function realOrSelf(path) {
   try {
-    return realpathSync3(path);
+    return realpathSync4(path);
   } catch {
     return path;
   }
@@ -40920,12 +40942,12 @@ async function publish(rest) {
   if (askingWhere) {
     const found = discovered.length > 0 ? discovered : [entry];
     process.stdout.write(`
-  ${found.length} policy ${found.length === 1 ? "file" : "files"}: ` + `${found.map((f) => basename9(f)).join(", ")}
+  ${found.length} policy ${found.length === 1 ? "file" : "files"}: ` + `${found.map((f) => basename10(f)).join(", ")}
 
 `);
     const token = githubToken();
     const login = token ? await credentialLogin(token) : null;
-    const folder = basename9(resolve34(entry, ".."));
+    const folder = basename10(resolve34(entry, ".."));
     const answered = await askWhereToPublish(`${login ?? "your-account"}/${folder}`, { stdin: process.stdin, stdout: process.stdout });
     if (answered === null)
       return ok3(["Nothing was published."]);
@@ -40936,7 +40958,7 @@ async function publish(rest) {
   let versionFromSha = false;
   const dryRun = rest.includes("--dry-run") || !repo;
   const allowPrivate = rest.includes("--allow-private");
-  const id = flag("id") ?? repo ?? (dryRun && entry ? `local/${basename9(resolve34(entry, ".."))}` : undefined);
+  const id = flag("id") ?? repo ?? (dryRun && entry ? `local/${basename10(resolve34(entry, ".."))}` : undefined);
   const [owner, name] = (repo ?? "/").split("/");
   if (repo && (!owner || !name || repo.split("/").length !== 2)) {
     return fail3([`--repo must be <owner>/<repo>, got ${JSON.stringify(repo)}`]);
@@ -41176,11 +41198,11 @@ async function pickClis(io) {
 function semanticPhrase(count) {
   return `${count} Jev ${count === 1 ? "check" : "checks"}`;
 }
-function besideBuiltinChecks(pack) {
+function howJevAsksChecks(pack) {
   if (jevPacks([{ effect: pack.effect ?? "enforce", clis: null }]).length === 0) {
     return "not asked: this pack only observes, and Jev asks only the checks of packs that enforce";
   }
-  const how = isFirstPartyPack(pack) ? "replacing this build's own set" : "added to this build's own checks";
+  const how = "asked by Jev on every tool call they apply to";
   return pack.clis && pack.clis.length > 0 ? `${how}, for ${pack.clis.join(", ")} only` : how;
 }
 function jevCheckWarnings(id, preview) {
@@ -41217,7 +41239,7 @@ async function pickFromSource(source, io) {
   const on = preview.policies.filter((p) => p.defaultEnabled).length;
   if (preview.semantic.length > 0) {
     io.stdout.write(`
-  This pack also brings ${semanticPhrase(preview.semantic.length)} (not selectable), ` + `${besideBuiltinChecks(preview)}.
+  This pack also brings ${semanticPhrase(preview.semantic.length)} (not selectable), ` + `${howJevAsksChecks(preview)}.
   See: failproofai policies show ${source}
 
 `);
@@ -41284,7 +41306,7 @@ async function add(rest) {
     }[result.selection];
     lines.push(result.enabled.length === 0 ? `  enabled (0/${result.available.length}, ${why}): none` + (result.semantic > 0 ? "" : " — the pack is installed and enforcing nothing") : `  enabled (${result.enabled.length}/${result.available.length}, ${why}): ${summarise(result.enabled)}`);
     if (result.semantic > 0) {
-      lines.push(`  ${semanticPhrase(result.semantic)}, ${besideBuiltinChecks(result)}. ` + "They apply only where you configured Jev (`failproofai jev status`).");
+      lines.push(`  ${semanticPhrase(result.semantic)}, ${howJevAsksChecks(result)}. ` + "They apply only where you configured Jev (`failproofai jev status`).");
     }
     if (result.minCliVersionNote)
       lines.push(`  ${result.minCliVersionNote}`);
@@ -41475,7 +41497,7 @@ function jevChecksSection(pack, opts) {
     ...rule(`Jev checks — ${pack.semantic.length} · not selectable · only where Jev is configured`, opts),
     ...table({ head: ["", "", ""], rows, protect: [0, 1] }, opts),
     "",
-    ...note("Nothing toggles them: `--policy` cannot name one and `failproofai policies` never lists them. " + `They arrive whole, ${besideBuiltinChecks(pack)}.`, opts),
+    ...note("Nothing toggles them: `--policy` cannot name one and `failproofai policies` never lists them. " + `They arrive whole, ${howJevAsksChecks(pack)}.`, opts),
     ...note(pack.policies.length === 0 ? "This pack ships no regex policies, so none of these checks clears anything here: a deny " + "check can only ADD a deny, and an instruct check only ever warns." : `\`reviews\` is which of this pack's own ${pack.policies.length} policies each check can clear. ` + "A deny check that reviews nothing can only ever ADD a deny; an instruct check never answers " + "deny, so nothing pairs with one.", opts)
   ];
 }
@@ -41884,7 +41906,7 @@ var init_install_prompt = __esm(() => {
 // src/hooks/manager.ts
 import { execSync as execSync7 } from "node:child_process";
 import { existsSync as existsSync50 } from "node:fs";
-import { resolve as resolve35, basename as basename10 } from "node:path";
+import { resolve as resolve35, basename as basename11 } from "node:path";
 import { platform as platform4, arch as arch4, release as release3, hostname as hostname6 } from "node:os";
 function getSettingsPath2(scope, cwd) {
   return claudeCode.getSettingsPath(scope, cwd);
@@ -42159,7 +42181,7 @@ Validated ${validatedHooks.length} custom hook(s) from ${path}: ${validatedHooks
   const alwaysOnNames = new Set(BUILTIN_POLICIES.filter((p) => p.alwaysOn).map((p) => p.name));
   const fromPack = policyNames === undefined ? [] : selectedPolicies.filter((name) => !alwaysOnNames.has(name));
   if (fromPack.length > 0) {
-    if (!hasInstalledPacks()) {
+    if (!hasInstalledRegexPacks()) {
       try {
         await addPack(CORE_SOURCE, { only: fromPack });
       } catch (err) {
@@ -42545,7 +42567,7 @@ async function listHooks(cwd) {
     groups.push(note(dir, opts));
     const rows = [];
     for (const file of files) {
-      const filename = basename10(file);
+      const filename = basename11(file);
       try {
         const hooks = await loadCustomHooks(file);
         record(filename, hooks.map((h) => h.name));
@@ -43069,13 +43091,13 @@ function parseScriptArgs(argv) {
 var init_parse_script_args = () => {};
 
 // scripts/install-diagnosis.mjs
-import { existsSync as existsSync51, readFileSync as readFileSync40, realpathSync as realpathSync4 } from "node:fs";
+import { existsSync as existsSync51, readFileSync as readFileSync40, realpathSync as realpathSync5 } from "node:fs";
 import { dirname as dirname27, resolve as resolve37 } from "node:path";
 import { homedir as homedir33, platform as platform5 } from "node:os";
 import { spawnSync } from "node:child_process";
 function findPackageRoot(start) {
   try {
-    let dir = realpathSync4(start);
+    let dir = realpathSync5(start);
     if (existsSync51(dir) && !existsSync51(resolve37(dir, "package.json"))) {
       dir = dirname27(dir);
     }
@@ -43155,7 +43177,7 @@ function buildRecommendation(pathFirstBin) {
 function diagnoseShadow(self) {
   const selfPackageRoot = (() => {
     try {
-      return self?.selfPackageRoot ? realpathSync4(self.selfPackageRoot) : null;
+      return self?.selfPackageRoot ? realpathSync5(self.selfPackageRoot) : null;
     } catch {
       return self?.selfPackageRoot ?? null;
     }
@@ -43239,7 +43261,7 @@ var init_dashboard_host = __esm(() => {
 
 // scripts/launch.ts
 import { spawn as spawn2 } from "child_process";
-import { realpathSync as realpathSync5, existsSync as existsSync52 } from "node:fs";
+import { realpathSync as realpathSync6, existsSync as existsSync52 } from "node:fs";
 import { resolve as resolve38, dirname as dirname28 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 import { createInterface } from "node:readline";
@@ -43264,7 +43286,7 @@ function launch(mode) {
     process.env.PORT = port;
     process.env.HOSTNAME = bindHost;
     cmd = "node";
-    const packageRoot = process.env.FAILPROOFAI_PACKAGE_ROOT ?? resolve38(dirname28(realpathSync5(fileURLToPath2(import.meta.url))), "..");
+    const packageRoot = process.env.FAILPROOFAI_PACKAGE_ROOT ?? resolve38(dirname28(realpathSync6(fileURLToPath2(import.meta.url))), "..");
     const serverJsPath = resolve38(packageRoot, ".next/standalone/server.js");
     if (!existsSync52(serverJsPath)) {
       let shadowMessage = null;
@@ -44044,11 +44066,15 @@ import {
   existsSync as existsSync53,
   lstatSync as lstatSync3,
   mkdirSync as mkdirSync32,
+  readlinkSync as readlinkSync2,
+  realpathSync as realpathSync7,
   renameSync as renameSync13,
   rmSync as rmSync20,
+  symlinkSync as symlinkSync2,
   unlinkSync as unlinkSync10
 } from "node:fs";
-import { resolve as resolve39, dirname as dirname29 } from "node:path";
+import { resolve as resolve39, dirname as dirname29, basename as basename12 } from "node:path";
+import { fileURLToPath as fileURLToPath3 } from "node:url";
 function readYamlDoc2(path) {
   try {
     return existsSync53(path) ? $parseDocument(readFileSync41(path, "utf8")) : $parseDocument("");
@@ -44065,21 +44091,71 @@ function isMarkedHook2(hook) {
   const cmd = typeof h.command === "string" ? h.command : "";
   return cmd.includes("failproofai") && cmd.includes("--hook");
 }
+function getHermesPluginSourcePath2() {
+  const fromEnv = process.env.FAILPROOFAI_PACKAGE_ROOT;
+  if (fromEnv)
+    return resolve39(fromEnv, HERMES_PLUGIN_SOURCE_DIR2);
+  return resolve39(fileURLToPath3(import.meta.url), "..", "..", "..", HERMES_PLUGIN_SOURCE_DIR2);
+}
 function hermesPluginPathForSettings2(settingsPath) {
   return resolve39(dirname29(settingsPath), "plugins", HERMES_PLUGIN_ID2);
 }
-function hasManagedHermesPlugin2(settingsPath) {
-  const pluginPath = hermesPluginPathForSettings2(settingsPath);
+function hasAllHermesPluginFiles2(dir) {
+  return HERMES_PLUGIN_FILES2.every((file) => existsSync53(resolve39(dir, file)));
+}
+function isFailproofaiHermesPluginSource2(dir) {
+  if (basename12(dir) !== HERMES_PLUGIN_SOURCE_DIR2)
+    return false;
+  if (!existsSync53(dir))
+    return true;
   try {
-    if (lstatSync3(pluginPath).isSymbolicLink())
-      return false;
-    if (!existsSync53(resolve39(pluginPath, HERMES_PLUGIN_MARKER2)))
-      return false;
-    return HERMES_PLUGIN_FILES2.every((file) => existsSync53(resolve39(pluginPath, file)));
+    const manifest = readFileSync41(resolve39(dir, "plugin.yaml"), "utf8");
+    return /^name:\s*["']?failproofai["']?\s*$/m.test(manifest);
+  } catch {
+    return false;
+  }
+}
+function samePath2(a, b) {
+  if (resolve39(a) === resolve39(b))
+    return true;
+  try {
+    return realpathSync7(a) === realpathSync7(b);
   } catch {
     return false;
   }
 }
+function hermesPluginState2(settingsPath) {
+  const pluginPath = hermesPluginPathForSettings2(settingsPath);
+  let isLink;
+  let isDirectory;
+  try {
+    const stat = lstatSync3(pluginPath);
+    isLink = stat.isSymbolicLink();
+    isDirectory = stat.isDirectory();
+  } catch {
+    return { kind: "absent" };
+  }
+  if (isLink) {
+    let target;
+    try {
+      target = resolve39(dirname29(pluginPath), readlinkSync2(pluginPath));
+    } catch {
+      return { kind: "foreign" };
+    }
+    if (!isFailproofaiHermesPluginSource2(target))
+      return { kind: "foreign" };
+    return {
+      kind: "link",
+      target,
+      complete: hasAllHermesPluginFiles2(target),
+      current: samePath2(target, getHermesPluginSourcePath2())
+    };
+  }
+  if (isDirectory && existsSync53(resolve39(pluginPath, HERMES_PLUGIN_MARKER2))) {
+    return { kind: "copy", complete: hasAllHermesPluginFiles2(pluginPath) };
+  }
+  return { kind: "foreign" };
+}
 function hermesConfigState2(settingsPath) {
   if (!existsSync53(settingsPath)) {
     return { pluginEnabled: false, legacyShellHookPresent: false };
@@ -44097,20 +44173,31 @@ function hermesProfileHealth() {
   return listHermesProfiles().map((profile) => {
     const settingsPath = resolve39(profile.home, "config.yaml");
     const config = hermesConfigState2(settingsPath);
-    const pluginInstalled = hasManagedHermesPlugin2(settingsPath);
+    const plugin = hermesPluginState2(settingsPath);
+    const pluginInstalled = (plugin.kind === "link" || plugin.kind === "copy") && plugin.complete;
+    const pluginWorks = pluginInstalled && config.pluginEnabled;
     return {
       name: profile.name,
       home: profile.home,
       settingsPath,
       pluginInstalled,
+      pluginMode: plugin.kind === "link" || plugin.kind === "copy" ? plugin.kind : null,
       pluginEnabled: config.pluginEnabled,
       legacyShellHookPresent: config.legacyShellHookPresent,
-      healthy: pluginInstalled && config.pluginEnabled && !config.legacyShellHookPresent
+      cronUnchecked: config.legacyShellHookPresent && !pluginWorks,
+      healthy: pluginWorks && !config.legacyShellHookPresent
     };
   });
 }
 function hermesProfileStatusRows() {
   return hermesProfileHealth().filter((profile) => existsSync53(profile.home)).map((profile) => {
+    const label = "hermes/" + profile.name;
+    if (profile.cronUnchecked) {
+      return [
+        label,
+        "UNHEALTHY — legacy shell hooks: Hermes cron jobs are not checked. Run `failproofai update`"
+      ];
+    }
     const problems = [];
     if (!profile.pluginInstalled)
       problems.push("plugin files missing or incomplete");
@@ -44118,13 +44205,15 @@ function hermesProfileStatusRows() {
       problems.push("plugin not enabled");
     if (profile.legacyShellHookPresent)
       problems.push("legacy shell hook also present");
+    if (problems.length > 0)
+      return [label, "UNHEALTHY — " + problems.join("; ")];
     return [
-      "hermes/" + profile.name,
-      problems.length === 0 ? "native plugin enabled" : "UNHEALTHY — " + problems.join("; ")
+      label,
+      profile.pluginMode === "copy" ? "native plugin enabled (copied — `failproofai update` links it so upgrades apply)" : "native plugin enabled"
     ];
   });
 }
-var HERMES_PLUGIN_ID2 = "failproofai", HERMES_PLUGIN_MARKER2 = ".failproofai-managed", HERMES_PLUGIN_FILES2, ANTIGRAVITY_TOOL_EVENTS2;
+var HERMES_PLUGIN_ID2 = "failproofai", HERMES_PLUGIN_MARKER2 = ".failproofai-managed", HERMES_PLUGIN_FILES2, HERMES_PLUGIN_SOURCE_DIR2 = "hermes-plugin", ANTIGRAVITY_TOOL_EVENTS2;
 var init_integrations2 = __esm(() => {
   init_dist();
   init_hermes_profiles();
@@ -44136,9 +44225,9 @@ var init_integrations2 = __esm(() => {
 
 // scripts/launch.ts
 import { spawn as spawn3 } from "child_process";
-import { realpathSync as realpathSync6, existsSync as existsSync54 } from "node:fs";
+import { realpathSync as realpathSync8, existsSync as existsSync54 } from "node:fs";
 import { resolve as resolve40, dirname as dirname30 } from "node:path";
-import { fileURLToPath as fileURLToPath3 } from "node:url";
+import { fileURLToPath as fileURLToPath4 } from "node:url";
 import { createInterface as createInterface2 } from "node:readline";
 function launch2(mode) {
   const { loggingLevel, disableTelemetry, allowedDevOrigins, host, remainingArgs } = parseScriptArgs(process.argv.slice(2));
@@ -44161,7 +44250,7 @@ function launch2(mode) {
     process.env.PORT = port;
     process.env.HOSTNAME = bindHost;
     cmd = "node";
-    const packageRoot = process.env.FAILPROOFAI_PACKAGE_ROOT ?? resolve40(dirname30(realpathSync6(fileURLToPath3(import.meta.url))), "..");
+    const packageRoot = process.env.FAILPROOFAI_PACKAGE_ROOT ?? resolve40(dirname30(realpathSync8(fileURLToPath4(import.meta.url))), "..");
     const serverJsPath = resolve40(packageRoot, ".next/standalone/server.js");
     if (!existsSync54(serverJsPath)) {
       let shadowMessage = null;
@@ -44259,18 +44348,18 @@ var init_cli_error2 = __esm(() => {
 });
 
 // bin/failproofai.mjs
-import { realpathSync as realpathSync7 } from "fs";
+import { realpathSync as realpathSync9 } from "fs";
 import { dirname as dirname31, resolve as resolve41 } from "path";
-import { fileURLToPath as fileURLToPath4 } from "url";
+import { fileURLToPath as fileURLToPath5 } from "url";
 // package.json
-var version = "1.0.8-beta.0";
+var version = "1.0.9-beta.0";
 
 // bin/failproofai.mjs
 if (!process.env.FAILPROOFAI_PACKAGE_ROOT) {
-  process.env.FAILPROOFAI_PACKAGE_ROOT = resolve41(dirname31(realpathSync7(fileURLToPath4(import.meta.url))), "..");
+  process.env.FAILPROOFAI_PACKAGE_ROOT = resolve41(dirname31(realpathSync9(fileURLToPath5(import.meta.url))), "..");
 }
 if (!process.env.FAILPROOFAI_DIST_PATH) {
-  process.env.FAILPROOFAI_DIST_PATH = resolve41(dirname31(realpathSync7(fileURLToPath4(import.meta.url))), "..", "dist");
+  process.env.FAILPROOFAI_DIST_PATH = resolve41(dirname31(realpathSync9(fileURLToPath5(import.meta.url))), "..", "dist");
 }
 var args = process.argv.slice(2);
 if (args[0] === "p" || args[0] === "policy")
@@ -44844,7 +44933,7 @@ Run \`failproofai backfill --help\` for usage.`);
               "",
               "FailproofAI Cloud needs no setup here: `failproofai config --token",
               '<key>` with a key that carries jev:evaluate (the "machine" preset)',
-              "turns it on in shadow mode when there is no jev.json yet \u2014 except",
+              "turns it on in observe mode when there is no jev.json yet \u2014 except",
               "with --no-transcripts, which only stores the key; then",
               "`failproofai jev setup --provider failproofai` switches it on. Its",
               "key stays in credentials.json; no --url ever selects it."
@@ -44861,7 +44950,7 @@ Run \`failproofai backfill --help\` for usage.`);
               ["--account-id <id>", "Cloudflare account id (32 hex characters)."],
               ["--base-url <url>", "Override the API base; `default` clears it."],
               ["--model <id>", "Override the model id; `default` clears it."],
-              ["--mode <m>", "enforce (default), shadow (log Jev, enforce regex), or off."],
+              ["--mode <m>", "enforce (default), observe (log Jev, enforce regex), or off."],
               ["--timeout-ms <n>", "Per-call budget before falling back. Default 3000."]
             ]
           },
@@ -44872,7 +44961,7 @@ Run \`failproofai backfill --help\` for usage.`);
               "  else can read \u2014 or one in a directory anyone else can WRITE, who",
               "  could replace it \u2014 is refused; a repository can never set it.",
               "\u2022 Re-running setup for the same provider keeps the key, so",
-              "  `failproofai jev setup --mode shadow` just switches the mode.",
+              "  `failproofai jev setup --mode observe` just switches the mode.",
               "\u2022 The daemon does not see your shell's environment: keep the key in",
               "  the file on a machine set up with `failproofai config`.",
               "\u2022 --token is the fast path, not the safe one: your shell history keeps",
@@ -44886,7 +44975,7 @@ Run \`failproofai backfill --help\` for usage.`);
               "failproofai jev --url https://openrouter.ai/api/v1 --token <token>",
               "failproofai jev setup --provider typesafe --key-stdin < ~/typesafe.key",
               "failproofai jev setup --provider cloudflare --account-id <id> --key-stdin",
-              "failproofai config --token <key>          (FailproofAI Cloud, shadow mode)",
+              "failproofai config --token <key>          (FailproofAI Cloud, observe mode)",
               "failproofai jev setup --mode enforce      (switch the configured route's mode)",
               "failproofai jev setup --mode off          (keep the config, stop asking Jev)",
               "failproofai jev test",
@@ -45031,7 +45120,10 @@ Run \`failproofai migrate --help\` for usage.`);
               "is the loud version of that problem rather than the silent one.",
               "",
               "This does the rest of the upgrade: runs any pending layout migrations,",
-              "puts the matching daemon binary in place, and restarts the service."
+              "puts the matching daemon binary in place, and restarts the service.",
+              "Hermes profiles already using failproofai are moved to the linked",
+              "native plugin (legacy shell hooks never checked Hermes cron jobs).",
+              "Exits non-zero when any half could not be brought current."
             ]
           },
           {
@@ -45097,17 +45189,36 @@ Run \`failproofai update --help\` for usage.`);
         daemonOk = result.ok;
       }
     }
+    let hermesOk = true;
+    let hermesMigrated = 0;
+    try {
+      await Promise.resolve().then(() => init_hermes_update());
+      const svc = await Promise.resolve().then(() => (init_daemon_service2(), {}));
+      const hermesResult = await runHermesUpdateMigration({
+        daemonSupportsPolicyEvaluation: () => probeDaemonPolicyEvaluation2()
+      });
+      if (hermesResult.lines.length > 0)
+        report.push("", ...hermesResult.lines);
+      hermesOk = hermesResult.ok;
+      hermesMigrated = hermesResult.profiles.filter((p) => p.status === "migrated").length;
+    } catch (err) {
+      report.push("", `Hermes migration failed: ${err instanceof Error ? err.message : String(err)}`);
+      hermesOk = false;
+    }
+    const updateOk = daemonOk && !migrationFailed && hermesOk;
     await printReport("update", report, {
-      ok: daemonOk && !migrationFailed,
+      ok: updateOk,
       meta: `v${version}`
     });
     await track("cli_update", {
-      ok: daemonOk && !migrationFailed,
+      ok: updateOk,
       migrations: migrationsRan,
-      migration_failed: migrationFailed
+      migration_failed: migrationFailed,
+      hermes_ok: hermesOk,
+      hermes_migrated: hermesMigrated
     });
     lastSubcommand = null;
-    await exitAfterFlush(daemonOk && !migrationFailed ? 0 : 1);
+    await exitAfterFlush(updateOk ? 0 : 1);
     return;
   }
   if (args[0] === "uninstall") {