fullcourtdefense-cli 1.26.7 → 1.26.9

package/dist/commands/hook.js

@@ -233,10 +233,14 @@ function extractPromptText(p) {
 function buildToolCall(event, p) {
     switch (event) {
         case 'shell': {
-            const command = str(p.command) || str(p.cmd);
+            const nested = (p.tool_input && typeof p.tool_input === 'object')
+                ? p.tool_input
+                : undefined;
+            const command = str(p.command) || str(p.cmd) || str(p.commandLine)
+                || str(nested?.command) || str(nested?.cmd);
             if (!command)
                 return null;
-            return { toolName: 'shell', toolArgs: { command, cwd: str(p.cwd) || undefined } };
+            return { toolName: 'shell', toolArgs: { command, cwd: str(p.cwd) || str(nested?.cwd) || undefined } };
         }
         case 'mcp': {
             const toolName = str(p.tool_name) || str(p.toolName) || str(p.name) || 'mcp';
@@ -288,6 +292,15 @@ function summarizeToolCall(toolName, toolArgs) {
     }
     return parts.join(' ').slice(0, 500);
 }
+function spoolCallEvent(call, rest) {
+    const { operation } = (0, actionPolicyEngine_1.inferToolContext)(call.toolName, call.toolArgs);
+    (0, telemetry_1.spoolEvent)({
+        ...rest,
+        toolName: call.toolName,
+        operation: rest.operation || operation,
+        evidence: rest.evidence || (0, telemetry_1.evidenceFromToolArgs)(call.toolArgs),
+    });
+}
 function safeJson(v) {
     try {
         return JSON.stringify(v);
@@ -409,18 +422,18 @@ function tryLocalPolicyEnforcement(ctx, call, detail, opts = {}) {
         if (ctx.shadow) {
             // Truth-in-reporting: the action RAN — 'warn' (advisory), never 'allow'
             // (which hides the would-block from the console) and never 'block'.
-            (0, telemetry_1.spoolEvent)({ decision: 'warn', toolName: call.toolName, reason: `[monitor] local policy would ${local.verdict} (offline): ${reason}`, offlineEnforced: true });
+            spoolCallEvent(call, { decision: 'warn', reason: `[monitor] local policy would ${local.verdict} (offline): ${reason}`, offlineEnforced: true });
             (0, telemetry_1.triggerFlush)(false);
             ctx.respond(false, undefined, `[FullCourtDefense shadow] would ${local.verdict === 'block' ? 'block' : 'require approval for'} ${call.toolName} (offline, locally cached policy): ${reason}`);
         }
         const approvalNote = local.verdict === 'require_approval'
             ? ' This action requires human approval, which is not possible while the policy service is unreachable.'
             : '';
-        (0, telemetry_1.spoolEvent)({ decision: 'block', toolName: call.toolName, reason: `local policy (offline): ${reason}`, offlineEnforced: true });
+        spoolCallEvent(call, { decision: 'block', reason: `local policy (offline): ${reason}`, offlineEnforced: true });
         (0, telemetry_1.triggerFlush)(true);
         ctx.respond(true, `Blocked by FullCourtDefense${local.policyName ? ` (${local.policyName})` : ''} — enforced locally while the policy service is unreachable.${approvalNote}`, `FullCourtDefense blocked this ${ctx.event} using the locally cached org policy${local.policyName ? ` "${local.policyName}"` : ''} (${detail}).${approvalNote} Do not retry until the connection is restored or the policy allows it.`);
     }
-    (0, telemetry_1.spoolEvent)({ decision: 'allow', toolName: call.toolName, reason: `local policy allow (offline): ${detail}`, offlineEnforced: true });
+    spoolCallEvent(call, { decision: 'allow', reason: `local policy allow (offline): ${detail}`, offlineEnforced: true });
     (0, telemetry_1.triggerFlush)(false);
     ctx.respond(false, undefined, `FullCourtDefense: policy service unreachable — this ${ctx.event} was checked against the locally cached org policies and allowed.`);
 }
@@ -1017,7 +1030,7 @@ async function hookCommandInner(args, config, io) {
 async function runTaintApproveOnce(ctx, event, call, sessId, taintFinding) {
     const { respond } = ctx;
     const hardBlock = () => {
-        (0, telemetry_1.spoolEvent)({ decision: 'block', toolName: call.toolName, reason: taintFinding.reason, ruleId: taintFinding.ruleId, offlineEnforced: true });
+        spoolCallEvent(call, { decision: 'block', reason: taintFinding.reason, ruleId: taintFinding.ruleId, offlineEnforced: true });
         (0, telemetry_1.triggerFlush)(true);
         respond(true, `Blocked by FullCourtDefense taint guard — ${taintFinding.reason}`, `FullCourtDefense blocked this ${event} locally (${taintFinding.ruleId}): ${taintFinding.reason} Do not retry.`);
         return false;
@@ -1055,9 +1068,8 @@ async function runTaintApproveOnce(ctx, event, call, sessId, taintFinding) {
     const outcome = await (0, taintLedger_1.waitForTaintApproval)(approval.id, timeoutMs, Math.max(750, Math.min(ctx.approvalPollMs, 2000)));
     (0, hookIo_1.dbg)({ phase: 'taint_approve_once_outcome', approvalId: approval.id, outcome });
     if (outcome === 'approved') {
-        (0, telemetry_1.spoolEvent)({
+        spoolCallEvent(call, {
             decision: 'allow',
-            toolName: call.toolName,
             reason: `Developer approved once after taint-guard hold (${taintFinding.ruleId}): ${taintFinding.reason}`,
             ruleId: taintFinding.ruleId,
             offlineEnforced: true,
@@ -1066,9 +1078,8 @@ async function runTaintApproveOnce(ctx, event, call, sessId, taintFinding) {
         (0, notify_1.notifyOs)({ title: 'FullCourtDefense — approved once', message: `${call.toolName} -> ${targetText} will continue.` });
         return true;
     }
-    (0, telemetry_1.spoolEvent)({
+    spoolCallEvent(call, {
         decision: 'block',
-        toolName: call.toolName,
         reason: `${taintFinding.reason} Developer ${outcome === 'denied' ? 'denied the approve-once request' : 'did not respond to the approve-once request'}.`,
         ruleId: taintFinding.ruleId,
         offlineEnforced: true,
@@ -1087,6 +1098,7 @@ async function enforceActionPolicy(ctx) {
         respond(false);
         return;
     }
+    (0, telemetry_1.setVerdictToolArgs)(call.toolArgs);
     const snapshot = await (0, localSafetySnapshot_1.loadLocalSafetySnapshot)({
         apiUrl,
         shieldId,
@@ -1124,7 +1136,7 @@ async function enforceActionPolicy(ctx) {
             respond(false, undefined, `[FullCourtDefense shadow] would block ${call.toolName}: ${selfApproval.reason}`);
             return;
         }
-        (0, telemetry_1.spoolEvent)({ decision: 'block', toolName: call.toolName, reason: selfApproval.reason, ruleId: 'local-taint-self-approval', offlineEnforced: true });
+        spoolCallEvent(call, { decision: 'block', reason: selfApproval.reason, ruleId: 'local-taint-self-approval', offlineEnforced: true });
         (0, telemetry_1.triggerFlush)(true);
         respond(true, `Blocked by FullCourtDefense self-protection — ${selfApproval.reason}`, `FullCourtDefense blocked this ${event} locally (local-taint-self-approval): ${selfApproval.reason} Do not retry.`);
         return;
@@ -1164,7 +1176,7 @@ async function enforceActionPolicy(ctx) {
         (0, hookIo_1.dbg)({ phase: 'policy_skip_monitor', event, tool: call.toolName });
         const detail = 'monitor mode — synchronous policy check skipped by design.';
         if (!tryLocalPolicyEnforcement(ctx, call, detail, { countAsGateFailure: false })) {
-            (0, telemetry_1.spoolEvent)({ decision: 'allow', toolName: call.toolName, reason: `monitor: ${detail}`, offlineEnforced: true });
+            spoolCallEvent(call, { decision: 'allow', reason: `monitor: ${detail}`, offlineEnforced: true });
             (0, telemetry_1.triggerFlush)(false);
             respond(false);
         }
@@ -1210,7 +1222,7 @@ async function enforceActionPolicy(ctx) {
             void fetch(gateUrl, { method: 'POST', headers, body: gateBody, signal: AbortSignal.timeout(4000) })
                 .then(() => (0, policyGateHealth_1.recordGateSuccess)())
                 .catch(() => {
-                (0, telemetry_1.spoolEvent)({ decision: 'allow', toolName: call.toolName, reason: 'local policy allow (block mode, local-first); gate report failed — spooled', offlineEnforced: true });
+                spoolCallEvent(call, { decision: 'allow', reason: 'local policy allow (block mode, local-first); gate report failed — spooled', offlineEnforced: true });
                 (0, telemetry_1.triggerFlush)(false);
             });
             respond(false);
@@ -1218,7 +1230,7 @@ async function enforceActionPolicy(ctx) {
         }
         if (localVerdict.verdict === 'block') {
             const reason = localVerdict.reason || `${call.toolName}: blocked by org Action Policy`;
-            (0, telemetry_1.spoolEvent)({ decision: 'block', toolName: call.toolName, reason: `local policy (block mode, local-first): ${reason}`, offlineEnforced: true });
+            spoolCallEvent(call, { decision: 'block', reason: `local policy (block mode, local-first): ${reason}`, offlineEnforced: true });
             (0, telemetry_1.triggerFlush)(true);
             respond(true, `Blocked by FullCourtDefense${localVerdict.policyName ? ` (${localVerdict.policyName})` : ''} — ${reason}`, `FullCourtDefense blocked this ${event} by org Action Policy${localVerdict.policyName ? ` "${localVerdict.policyName}"` : ''}: ${reason}. This is a policy decision, not an error — do not retry.`);
             return;

package/dist/commands/mcpGateway.js

@@ -1009,6 +1009,7 @@ class McpGatewayServer {
         if (!toolName)
             throw new Error('Missing MCP tool name.');
         const toolArgs = params.arguments && typeof params.arguments === 'object' ? params.arguments : {};
+        (0, telemetry_1.setVerdictToolArgs)(toolArgs);
         let approvalActionId;
         let operation = typeof params.operation === 'string' && params.operation.trim() ? params.operation.trim() : undefined;
         // Tracks the downstream call state so the top-level catch can fail open

package/dist/telemetry.d.ts

@@ -36,9 +36,20 @@ export interface SpoolEvent {
  *  - `fail_open`  the hook crashed and allowed by contract
  */
 export type VerdictPath = 'ipc' | 'local' | 'fail_open' | 'gateway';
+/**
+ * Compact JSON of the command/path/query/args the agent attempted. The console
+ * Details column renders this as labeled Command / Query / URL / File / Args
+ * rows. Truncated to 500 chars so it survives backend sanitize().
+ *
+ * Known keys are preferred. Other primitive args (action, selector, prompt, …)
+ * are included so MCP tools that are not a shell/file still show what ran.
+ */
+export declare function evidenceFromToolArgs(toolArgs: Record<string, unknown> | undefined): string | undefined;
 interface VerdictTiming {
     startedAt: number;
     path: VerdictPath;
+    /** Tool args for this evaluation — stamps `evidence` onto every spooled event. */
+    toolArgs?: Record<string, unknown>;
 }
 /** Run one hook evaluation with timing attached to everything it spools. */
 export declare function markVerdictTiming<T>(timing: VerdictTiming, fn: () => T): T;
@@ -47,6 +58,8 @@ export declare function markVerdictTiming<T>(timing: VerdictTiming, fn: () => T)
  * Keeps the original start time so latency still covers the full wait.
  */
 export declare function setVerdictPath(path: VerdictPath): void;
+/** Attach the current tool call's args so every spool in this evaluation carries the command. */
+export declare function setVerdictToolArgs(toolArgs: Record<string, unknown>): void;
 /**
  * Restart the current evaluation's clock. Used by the MCP gateway right after
  * the downstream tool returns: everything spooled from then on (response

package/dist/telemetry.js

@@ -33,8 +33,10 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.evidenceFromToolArgs = evidenceFromToolArgs;
 exports.markVerdictTiming = markVerdictTiming;
 exports.setVerdictPath = setVerdictPath;
+exports.setVerdictToolArgs = setVerdictToolArgs;
 exports.restartVerdictTiming = restartVerdictTiming;
 exports.spoolEvent = spoolEvent;
 exports.flushSpool = flushSpool;
@@ -67,6 +69,67 @@ const MAX_BATCH = 200;
 const MAX_SPOOL_EVENTS = 2_000;
 /** Cheap pre-check: skip the trim parse entirely until the file is plausibly over cap. */
 const SPOOL_TRIM_BYTES = 2 * 1024 * 1024;
+/** Args keys that carry the action a human wants to see in the console. */
+const ACTION_EVIDENCE_KEYS = [
+    'command', 'cmd', 'commandLine', 'script', 'query', 'sql', 'url',
+    'path', 'file_path', 'filePath', 'file', 'target',
+    'pattern', 'glob', 'search', 'q',
+];
+/** Noise / secrets — never stamp these as activity evidence. */
+const EVIDENCE_SKIP_KEYS = /^(cwd|pwd|env|environment|headers|cookie|cookies|authorization|password|passwd|secret|token|api[_-]?key|private[_-]?key|session|retryCount|timeoutMs|timeout)$/i;
+function stringifyEvidenceValue(value) {
+    if (typeof value === 'string' && value.trim())
+        return value.trim().slice(0, 480);
+    if (typeof value === 'number' && Number.isFinite(value))
+        return String(value);
+    if (typeof value === 'boolean')
+        return value ? 'true' : 'false';
+    if (Array.isArray(value) || (value && typeof value === 'object')) {
+        try {
+            const json = JSON.stringify(value);
+            return json && json !== '{}' && json !== '[]' ? json.slice(0, 240) : undefined;
+        }
+        catch {
+            return undefined;
+        }
+    }
+    return undefined;
+}
+/**
+ * Compact JSON of the command/path/query/args the agent attempted. The console
+ * Details column renders this as labeled Command / Query / URL / File / Args
+ * rows. Truncated to 500 chars so it survives backend sanitize().
+ *
+ * Known keys are preferred. Other primitive args (action, selector, prompt, …)
+ * are included so MCP tools that are not a shell/file still show what ran.
+ */
+function evidenceFromToolArgs(toolArgs) {
+    if (!toolArgs)
+        return undefined;
+    const picked = {};
+    for (const key of ACTION_EVIDENCE_KEYS) {
+        const text = stringifyEvidenceValue(toolArgs[key]);
+        if (text)
+            picked[key] = text;
+    }
+    for (const [key, value] of Object.entries(toolArgs)) {
+        if (picked[key] || EVIDENCE_SKIP_KEYS.test(key))
+            continue;
+        if (Object.keys(picked).length >= 8)
+            break;
+        const text = stringifyEvidenceValue(value);
+        if (text)
+            picked[key] = text;
+    }
+    if (Object.keys(picked).length === 0)
+        return undefined;
+    try {
+        return JSON.stringify(picked).slice(0, 500);
+    }
+    catch {
+        return Object.values(picked)[0]?.slice(0, 500);
+    }
+}
 /**
  * Per-evaluation timing context.
  *
@@ -93,6 +156,12 @@ function setVerdictPath(path) {
     if (store)
         store.path = path;
 }
+/** Attach the current tool call's args so every spool in this evaluation carries the command. */
+function setVerdictToolArgs(toolArgs) {
+    const store = verdictTiming.getStore();
+    if (store)
+        store.toolArgs = toolArgs;
+}
 /**
  * Restart the current evaluation's clock. Used by the MCP gateway right after
  * the downstream tool returns: everything spooled from then on (response
@@ -125,7 +194,7 @@ function spoolEvent(event) {
             itemId: event.itemId,
             severity: event.severity,
             source: event.source,
-            evidence: event.evidence,
+            evidence: event.evidence || evidenceFromToolArgs(timing?.toolArgs),
             explanation: event.explanation,
             policyHash: event.policyHash,
             offlineEnforced: event.offlineEnforced,

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.26.7"
+  "version": "1.26.9"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.26.7",
+  "version": "1.26.9",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {