fullcourtdefense-cli 1.21.22 → 1.21.24

package/dist/commands/mcpGateway.js

@@ -876,8 +876,19 @@ class McpGatewayServer {
                     }
                 }
                 else {
-                    const reason = preflight.actionPolicy?.reason || preflight.intentEvaluation?.reasons?.[0] || `Tool call ${preflight.decision}.`;
-                    throw new Error(reason);
+                    // Detailed, self-explanatory block message: WHICH policy fired, WHAT rule matched,
+                    // and where to review it — so the developer (and the AI agent relaying the error)
+                    // can tell exactly why the call was refused instead of guessing.
+                    const policy = preflight.actionPolicy;
+                    const parts = [];
+                    parts.push(policy?.reason || preflight.intentEvaluation?.reasons?.[0] || `Tool call ${preflight.decision} by FullCourtDefense.`);
+                    if (policy?.policyName)
+                        parts.push(`Policy: "${policy.policyName}"`);
+                    if (policy?.matchedRule)
+                        parts.push(`Matched rule: ${policy.matchedRule}`);
+                    parts.push(`Tool: ${toolName}${operation && operation !== toolName ? ` (operation: ${operation})` : ''}`);
+                    parts.push(`Review or change this policy in the FullCourtDefense console → Agent Security → Policies.`);
+                    throw new Error(parts.join(' | '));
                 }
             }
             const rawResult = await this.downstream.callTool(toolName, toolArgs);

package/dist/commands/onboard.js

@@ -180,8 +180,13 @@ function checkMcpGateways() {
 function checkTerminalGuards() {
     const checks = [];
     if (process.platform === 'win32') {
-        checks.push({ label: 'PowerShell shell guard', ok: (0, shellGuard_1.isShellGuardInstalled)(), detail: (0, shellGuard_1.isShellGuardInstalled)() ? undefined : 'run install-shell-guard' });
-        checks.push({ label: 'cmd.exe shell guard', ok: (0, cmdGuard_1.isCmdGuardInstalled)(), detail: (0, cmdGuard_1.isCmdGuardInstalled)() ? undefined : 'run install-cmd-guard' });
+        // Warnings, not failures: managed/bank machines commonly block PowerShell
+        // profile and AutoRun registry writes (EDR persistence rules, redirected
+        // Documents folders). Hooks + MCP gateways + daemon still protect the
+        // machine; failing onboarding here makes the MSI roll back a protected
+        // install (seen on the first customer deployment).
+        checks.push({ label: 'PowerShell shell guard', ok: (0, shellGuard_1.isShellGuardInstalled)(), optional: true, detail: (0, shellGuard_1.isShellGuardInstalled)() ? undefined : 'run install-shell-guard' });
+        checks.push({ label: 'cmd.exe shell guard', ok: (0, cmdGuard_1.isCmdGuardInstalled)(), optional: true, detail: (0, cmdGuard_1.isCmdGuardInstalled)() ? undefined : 'run install-cmd-guard' });
         const audit = (0, windowsAudit_1.getWindowsAuditStatus)();
         const auditOk = audit.scriptBlockLogging && audit.transcription;
         checks.push({
@@ -415,8 +420,16 @@ async function onboardCommand(args, config) {
         checkMcpGateways(),
         ...checkTerminalGuards(),
         {
+            // Warning, not a failure: on hardened/managed machines (bank laptops,
+            // EDR blocking HKCU Run-key writes, standard users denied schtasks)
+            // autostart registration can be denied even though hooks, enrollment,
+            // and the in-session daemon are all healthy. Failing onboarding here
+            // makes the MSI roll back a genuinely protected install — instead we
+            // finish, and the fleet console nudges "run daemon --install" until
+            // the daemon reports (real gap seen on the first customer install).
             label: 'Resident daemon autostart',
             ok: (0, daemon_1.isDaemonAutostartInstalled)(),
+            optional: true,
             detail: (0, daemon_1.isDaemonAutostartInstalled)() ? undefined : 'run fullcourtdefense daemon --install true from an elevated terminal',
         },
         {

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.21.22"
+  "version": "1.21.24"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.21.22",
+  "version": "1.21.24",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {