fullcourtdefense-cli 1.27.0 → 1.27.2

package/dist/commands/hook.d.ts

@@ -114,6 +114,14 @@ export interface HookIo {
     write(text: string): void;
     writeErr(text: string): void;
     exit(code: number): never;
+    /**
+     * True when `exit` really ends the process (standalone hook: CI runners,
+     * containers, a workstation whose daemon is down). Fire-and-forget network
+     * work started before `respond()` dies with the process, so audit reports
+     * must go through the spool + detached flusher instead. False in daemon
+     * mode, where `exit` only unwinds the evaluation and the process lives on.
+     */
+    exitsProcess: boolean;
 }
 /**
  * Daemon-side entry: evaluate one hook request in-process and return the

package/dist/commands/hook.js

@@ -338,6 +338,32 @@ function spoolCallEvent(call, rest) {
         evidence: rest.evidence || (0, telemetry_1.evidenceFromToolArgs)(call.toolArgs),
     });
 }
+/**
+ * A `log` verdict ("Warn only" in the console) is a real warning, not a silent
+ * allow: the action runs, the developer sees why it was flagged, and the fleet
+ * records it as Warned. Same delivery as a block — spool synchronously and let
+ * the detached flusher outlive a standalone hook process — so the warning is
+ * never lost on CI runners / containers where respond() ends the process.
+ */
+function warnByPolicy(call, verdict, event, exitsProcess, source) {
+    const reason = verdict.reason || `${call.toolName}: flagged by org Action Policy`;
+    const named = verdict.policyName ? ` (${verdict.policyName})` : '';
+    if (source === 'local-first') {
+        // The gate path is recorded as Warned by the server itself (it saw the
+        // call); only the local verdict has nobody else to write the audit.
+        spoolCallEvent(call, {
+            decision: 'warn',
+            reason: `policy warn (local-first): ${reason}`,
+            ruleId: verdict.policyName ? `action-policy:${verdict.policyName}` : undefined,
+            offlineEnforced: true,
+        });
+        (0, telemetry_1.triggerFlush)(exitsProcess);
+    }
+    return {
+        userMsg: `FullCourtDefense warning${named} — ${reason}. The ${event} was allowed and recorded as Warned.`,
+        agentMsg: `FullCourtDefense warning${named}: ${reason}. This ${event} was allowed by a warn-only Action Policy and recorded as Warned — proceed, but mention the warning to the developer.`,
+    };
+}
 function safeJson(v) {
     try {
         return JSON.stringify(v);
@@ -631,6 +657,11 @@ function tryLocalPolicyEnforcement(ctx, call, detail, opts = {}) {
         (0, telemetry_1.triggerFlush)(true);
         ctx.respond(true, `Blocked by FullCourtDefense${local.policyName ? ` (${local.policyName})` : ''} — enforced locally while the policy service is unreachable.${approvalNote}`, `FullCourtDefense blocked this ${ctx.event} using the locally cached org policy${local.policyName ? ` "${local.policyName}"` : ''} (${detail}).${approvalNote} Do not retry until the connection is restored or the policy allows it.`);
     }
+    if (local.verdict === 'log') {
+        // Warn-only rule, offline: still a real warning + Warned in the fleet.
+        const warning = warnByPolicy(call, local, ctx.event, ctx.exitsProcess, 'local-first');
+        ctx.respond(false, warning.userMsg, `${warning.agentMsg} (policy service unreachable — evaluated from the locally cached org policies).`);
+    }
     spoolCallEvent(call, { decision: 'allow', reason: `local policy allow (offline): ${detail}`, offlineEnforced: true });
     (0, telemetry_1.triggerFlush)(false);
     ctx.respond(false, undefined, `FullCourtDefense: policy service unreachable — this ${ctx.event} was checked against the locally cached org policies and allowed.`);
@@ -785,6 +816,7 @@ function processIo(stdin, stdinErr) {
         write: (text) => { process.stdout.write(text); },
         writeErr: (text) => { process.stderr.write(text); },
         exit: (code) => process.exit(code),
+        exitsProcess: true,
     };
 }
 /**
@@ -804,6 +836,7 @@ async function evaluateHookRequest(args, stdinRaw, config) {
         write: (text) => { out += text; },
         writeErr: (text) => { errOut += text; },
         exit: (code) => { throw new HookExitSignal(code); },
+        exitsProcess: false,
     };
     try {
         await hookCommandInner(args, config, io);
@@ -1195,7 +1228,7 @@ async function hookCommandInner(args, config, io) {
         await enforceActionPolicy({
             event, payload, apiUrl: apiUrl, shieldId: shieldId, shieldKey,
             shadow, failClosed, timeoutMs, approvalMode, approvalTimeoutMs, approvalPollMs, respond, deferLocalWarnings,
-            effectivePolicyHash, localPolicies, client,
+            effectivePolicyHash, localPolicies, client, exitsProcess: io.exitsProcess,
         });
         return;
     }
@@ -1450,8 +1483,21 @@ async function enforceActionPolicy(ctx) {
         const localVerdict = (0, actionPolicyEngine_1.evaluateActionPolicies)(ctx.localPolicies, call.toolName, localOp, localCtx, (0, actionPolicyEngine_1.deriveToolOperations)(call.toolName));
         (0, hookIo_1.dbg)({ phase: 'policy_local_first', event, tool: call.toolName, operation: localOp, verdict: localVerdict.verdict, policyName: localVerdict.policyName });
         if (localVerdict.verdict === 'allow') {
-            // Audit rides async: server records the action + its own verdict; if it
-            // is unreachable the spool keeps the trail (idempotent on eventId).
+            if (ctx.exitsProcess) {
+                // Standalone hook (CI runner, container, daemon down): respond() ends
+                // the process, so a fire-and-forget gate report would die in flight and
+                // the allowed action would never reach the fleet — the machine would
+                // read "N blocked of N recent" with every allow missing. Same delivery
+                // as a block: spool (sync file append) + detached flusher that outlives
+                // this process. The IDE is not kept waiting on the network.
+                spoolCallEvent(call, { decision: 'allow', reason: 'local policy allow (block mode, local-first)' });
+                (0, telemetry_1.triggerFlush)(true);
+                respond(false);
+                return;
+            }
+            // Daemon-evaluated: the process lives on, so the audit rides async — the
+            // server records the action + its own verdict; if it is unreachable the
+            // spool keeps the trail (idempotent on eventId).
             void fetch(gateUrl, { method: 'POST', headers, body: gateBody, signal: AbortSignal.timeout(4000) })
                 .then(() => (0, policyGateHealth_1.recordGateSuccess)())
                 .catch(() => {
@@ -1468,6 +1514,13 @@ async function enforceActionPolicy(ctx) {
             respond(true, `Blocked by FullCourtDefense${localVerdict.policyName ? ` (${localVerdict.policyName})` : ''} — ${reason}`, `FullCourtDefense blocked this ${event} by org Action Policy${localVerdict.policyName ? ` "${localVerdict.policyName}"` : ''}: ${reason}. This is a policy decision, not an error — do not retry.`);
             return;
         }
+        if (localVerdict.verdict === 'log') {
+            // "Warn only": runs, developer told why, fleet records Warned. No gate
+            // round trip — the verdict is final and the audit rides the spool.
+            const warning = warnByPolicy(call, localVerdict, event, ctx.exitsProcess, 'local-first');
+            respond(false, warning.userMsg, warning.agentMsg);
+            return;
+        }
         // require_approval, developer scope + human present → IDE-native ask (no org queue).
         if (tryDeveloperConfirmation({ event, respond, shadow }, call, localVerdict, payload, 'local-first'))
             return;
@@ -1549,6 +1602,13 @@ async function enforceActionPolicy(ctx) {
     const policyName = result.actionPolicy?.policyName;
     (0, hookIo_1.dbg)({ phase: 'policy_verdict', event, tool: call.toolName, decision: result.decision, allowed: result.allowed, policyName });
     if (result.allowed && result.decision === 'allow') {
+        if (result.actionPolicy?.verdict === 'log') {
+            // The server allowed it under a warn-only rule; surface the warning and
+            // record Warned (the server only records blocks/approvals itself).
+            const warning = warnByPolicy(call, result.actionPolicy, event, ctx.exitsProcess, 'gate');
+            respond(false, warning.userMsg, warning.agentMsg);
+            return;
+        }
         respond(false);
         return;
     }

package/dist/commands/mcpGateway.js

@@ -1213,7 +1213,15 @@ class McpGatewayServer {
                     (0, notify_1.notifyOs)({ title: 'FullCourtDefense — blocked by policy', message: `${toolName} blocked${local.policyName ? ` (${local.policyName})` : ''}.` });
                     throw blockError(`FullCourtDefense blocked ${toolName} by org Action Policy${local.policyName ? ` "${local.policyName}"` : ''}: ${reason}. This is a policy decision, not an error — do not retry.`);
                 }
-                if (local.verdict !== 'require_approval') {
+                if (local.verdict === 'log') {
+                    // "Warn only": the call runs, the fleet records Warned (not a silent
+                    // allow). Final verdict — no gate round trip; the audit rides the spool.
+                    const reason = local.reason || `${toolName}: flagged by org Action Policy`;
+                    (0, telemetry_1.spoolEvent)({ decision: 'warn', toolName, operation: localOperation, reason: `policy warn (local-first): ${reason}`, ruleId: local.policyName ? `action-policy:${local.policyName}` : undefined, offlineEnforced: true });
+                    (0, telemetry_1.triggerFlush)(false);
+                    preflight = { allowed: true, decision: 'allow', operation: localOperation };
+                }
+                else if (local.verdict !== 'require_approval') {
                     // Local allow: the server still records the action asynchronously; a
                     // failed report spools (idempotent on eventId) for the next flush.
                     // During a recently-down gate window, spool directly (no per-call

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.27.0"
+  "version": "1.27.2"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.27.0",
+  "version": "1.27.2",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {