@@ -92,10 +92,40 @@ def _post(path: str, payload: dict) -> dict:
         raise DaemonNotFoundError(DAEMON_PORT)
 
 
-def _get(path: str) -> dict:
-    req = urllib.request.Request(f"{_DAEMON_BASE}{path}", method="GET")
+_CARD_PROTOCOL = 2
+
+
+def _internal_token() -> str | None:
+    """The daemon's per-process token from ~/.node9/daemon.pid (mode 0600,
+    readable by the user that runs the daemon). None when unreadable."""
+    pid_file = os.path.join(os.path.expanduser("~"), ".node9", "daemon.pid")
+    try:
+        with open(pid_file, encoding="utf-8") as f:
+            token = json.load(f).get("internalToken")
+        return token if isinstance(token, str) and token else None
+    except (OSError, ValueError):
+        return None
+
+
+def _wait_timeout(check_result: dict) -> float | None:
+    """How long to wait on /wait. A daemon that speaks the card protocol says
+    when the card's own timer decides it (`deadline`, epoch ms, or null for no
+    timer): wait a little longer than that. An older daemon: the fixed wait."""
+    if check_result.get("protocol") != _CARD_PROTOCOL:
+        return _WAIT_TIMEOUT
+    deadline = check_result.get("deadline")
+    if deadline is None:
+        return None  # no timer: the card waits for a person
+    if isinstance(deadline, (int, float)):
+        return max(deadline / 1000 - time.time(), 0) + 5
+    return _WAIT_TIMEOUT
+
+
+def _get(path: str, timeout: float | None = _WAIT_TIMEOUT, token: str | None = None) -> dict:
+    headers = {"X-Node9-Internal": token} if token else {}
+    req = urllib.request.Request(f"{_DAEMON_BASE}{path}", headers=headers, method="GET")
     try:
-        with urllib.request.urlopen(req, timeout=_WAIT_TIMEOUT) as resp:
+        with urllib.request.urlopen(req, timeout=timeout) as resp:
             return json.loads(resp.read())
     except (urllib.error.URLError, http.client.HTTPException):
         # URLError = timeout / connection error
@@ -327,22 +357,30 @@ def evaluate(tool_name: str, args: dict[str, Any], *, run_id: str = "") -> None:
         _offline_audit(tool_name, args, run_id=run_id)
         return
 
+    # kind "evaluate": the daemon checks this call itself, with this cwd (the
+    # SDK evaluates no policy of its own). With the daemon's token, the card is
+    # a protocol-2 card whose decision only a token holder can read.
+    token = _internal_token()
     result = _post("/check", {
         "toolName": tool_name,
         "args": args,
         "cwd": os.getcwd(),
         "agent": (_config.get()[0] or "Python SDK"),
         "policy": _config.get()[1],
         "runId": run_id,
+        "kind": "evaluate",
+        **({"protocol": _CARD_PROTOCOL} if token else {}),
     })
     request_id = result.get("id")
     if not request_id:
         raise RuntimeError(f"[Node9] Unexpected daemon response: {result}")
 
     print(f"🛡️  Node9: waiting for approval of '{tool_name}'...", file=sys.stderr, flush=True)
-    decision_result = _get(f"/wait/{request_id}")
+    decision_result = _get(f"/wait/{request_id}", timeout=_wait_timeout(result), token=token)
     decision = decision_result.get("decision", "deny")
 
     if decision != "allow":
-        reason = decision_result.get("reason", "Denied by Node9 policy")
+        record = decision_result.get("record")
+        record_reason = record.get("reason") if isinstance(record, dict) else None
+        reason = decision_result.get("reason") or record_reason or "Denied by Node9 policy"
         raise ActionDeniedException(tool_name, reason)
@@ -1,5 +1,6 @@
 """Tests for the daemon HTTP client."""
 import json
+import time
 import pytest
 from unittest.mock import patch, MagicMock
 from http.client import RemoteDisconnected
@@ -100,6 +101,79 @@ def side_effect(req, timeout):
             with pytest.raises(ActionDeniedException):
                 evaluate("deploy", {"server": "prod"})
 
+    # Approval cards (node9-proxy 2.35): the SDK asks the daemon to check the
+    # call itself ("evaluate"), reads the decision with the daemon's token, and
+    # waits as long as the card's own timer.
+    def test_check_asks_the_daemon_to_evaluate_with_the_token(self):
+        calls = []
+
+        def side_effect(req, timeout):
+            calls.append((req, timeout))
+            if req.get_method() == "POST":
+                return _make_response({"id": "req-1", "protocol": 2, "deadline": None})
+            return _make_response({"decision": "allow"})
+
+        with patch("node9._client._internal_token", return_value="tok"), \
+                patch("urllib.request.urlopen", side_effect=side_effect):
+            evaluate("write_file", {"path": "/tmp/x"})
+
+        check_body = json.loads(calls[0][0].data)
+        assert check_body["kind"] == "evaluate"
+        assert check_body["protocol"] == 2
+        wait_req, wait_timeout = calls[1]
+        assert wait_req.get_header("X-node9-internal") == "tok"
+        # deadline null: the card has no timer, so the SDK waits for a person.
+        assert wait_timeout is None
+
+    def test_wait_follows_the_card_deadline(self):
+        calls = []
+        deadline_ms = (time.time() + 120) * 1000
+
+        def side_effect(req, timeout):
+            calls.append(timeout)
+            if req.get_method() == "POST":
+                return _make_response({"id": "req-1", "protocol": 2, "deadline": deadline_ms})
+            return _make_response({"decision": "allow"})
+
+        with patch("node9._client._internal_token", return_value="tok"), \
+                patch("urllib.request.urlopen", side_effect=side_effect):
+            evaluate("write_file", {"path": "/tmp/x"})
+
+        # Before: a fixed 65 s, shorter than the daemon's default 120 s timer.
+        assert 120 < calls[1] <= 126
+
+    def test_without_the_token_the_card_is_not_protocol_2(self):
+        calls = []
+
+        def side_effect(req, timeout):
+            calls.append((req, timeout))
+            if req.get_method() == "POST":
+                return _make_response({"id": "req-1"})
+            return _make_response({"decision": "allow"})
+
+        with patch("node9._client._internal_token", return_value=None), \
+                patch("urllib.request.urlopen", side_effect=side_effect):
+            evaluate("write_file", {"path": "/tmp/x"})
+
+        check_body = json.loads(calls[0][0].data)
+        assert check_body["kind"] == "evaluate"
+        assert "protocol" not in check_body
+        assert calls[1][0].get_header("X-node9-internal") is None
+        assert calls[1][1] == 65  # an older daemon: the fixed wait
+
+    def test_deny_reason_from_the_decision_record(self):
+        check_resp = _make_response({"id": "req-1"})
+        wait_resp = _make_response({
+            "decision": "deny",
+            "record": {"decision": "deny", "decidedBy": "policy", "label": "Smart Rule: x",
+                       "reason": "the project rule blocks this"},
+        })
+        with patch("node9._client._internal_token", return_value=None), \
+                patch("urllib.request.urlopen", side_effect=[check_resp, wait_resp]):
+            with pytest.raises(ActionDeniedException) as exc:
+                evaluate("bash", {"command": "rm -rf /"})
+        assert exc.value.reason == "the project rule blocks this"
+
     def test_node9_skip_env_bypasses_daemon(self, monkeypatch):
         # _SKIP is read once at import time — patch the flag directly
         monkeypatch.setattr("node9._client._SKIP", True)