fullcourtdefense-cli 1.27.1 → 1.27.2

package/dist/commands/hook.js

@@ -338,6 +338,32 @@ function spoolCallEvent(call, rest) {
         evidence: rest.evidence || (0, telemetry_1.evidenceFromToolArgs)(call.toolArgs),
     });
 }
+/**
+ * A `log` verdict ("Warn only" in the console) is a real warning, not a silent
+ * allow: the action runs, the developer sees why it was flagged, and the fleet
+ * records it as Warned. Same delivery as a block — spool synchronously and let
+ * the detached flusher outlive a standalone hook process — so the warning is
+ * never lost on CI runners / containers where respond() ends the process.
+ */
+function warnByPolicy(call, verdict, event, exitsProcess, source) {
+    const reason = verdict.reason || `${call.toolName}: flagged by org Action Policy`;
+    const named = verdict.policyName ? ` (${verdict.policyName})` : '';
+    if (source === 'local-first') {
+        // The gate path is recorded as Warned by the server itself (it saw the
+        // call); only the local verdict has nobody else to write the audit.
+        spoolCallEvent(call, {
+            decision: 'warn',
+            reason: `policy warn (local-first): ${reason}`,
+            ruleId: verdict.policyName ? `action-policy:${verdict.policyName}` : undefined,
+            offlineEnforced: true,
+        });
+        (0, telemetry_1.triggerFlush)(exitsProcess);
+    }
+    return {
+        userMsg: `FullCourtDefense warning${named} — ${reason}. The ${event} was allowed and recorded as Warned.`,
+        agentMsg: `FullCourtDefense warning${named}: ${reason}. This ${event} was allowed by a warn-only Action Policy and recorded as Warned — proceed, but mention the warning to the developer.`,
+    };
+}
 function safeJson(v) {
     try {
         return JSON.stringify(v);
@@ -631,6 +657,11 @@ function tryLocalPolicyEnforcement(ctx, call, detail, opts = {}) {
         (0, telemetry_1.triggerFlush)(true);
         ctx.respond(true, `Blocked by FullCourtDefense${local.policyName ? ` (${local.policyName})` : ''} — enforced locally while the policy service is unreachable.${approvalNote}`, `FullCourtDefense blocked this ${ctx.event} using the locally cached org policy${local.policyName ? ` "${local.policyName}"` : ''} (${detail}).${approvalNote} Do not retry until the connection is restored or the policy allows it.`);
     }
+    if (local.verdict === 'log') {
+        // Warn-only rule, offline: still a real warning + Warned in the fleet.
+        const warning = warnByPolicy(call, local, ctx.event, ctx.exitsProcess, 'local-first');
+        ctx.respond(false, warning.userMsg, `${warning.agentMsg} (policy service unreachable — evaluated from the locally cached org policies).`);
+    }
     spoolCallEvent(call, { decision: 'allow', reason: `local policy allow (offline): ${detail}`, offlineEnforced: true });
     (0, telemetry_1.triggerFlush)(false);
     ctx.respond(false, undefined, `FullCourtDefense: policy service unreachable — this ${ctx.event} was checked against the locally cached org policies and allowed.`);
@@ -1483,6 +1514,13 @@ async function enforceActionPolicy(ctx) {
             respond(true, `Blocked by FullCourtDefense${localVerdict.policyName ? ` (${localVerdict.policyName})` : ''} — ${reason}`, `FullCourtDefense blocked this ${event} by org Action Policy${localVerdict.policyName ? ` "${localVerdict.policyName}"` : ''}: ${reason}. This is a policy decision, not an error — do not retry.`);
             return;
         }
+        if (localVerdict.verdict === 'log') {
+            // "Warn only": runs, developer told why, fleet records Warned. No gate
+            // round trip — the verdict is final and the audit rides the spool.
+            const warning = warnByPolicy(call, localVerdict, event, ctx.exitsProcess, 'local-first');
+            respond(false, warning.userMsg, warning.agentMsg);
+            return;
+        }
         // require_approval, developer scope + human present → IDE-native ask (no org queue).
         if (tryDeveloperConfirmation({ event, respond, shadow }, call, localVerdict, payload, 'local-first'))
             return;
@@ -1564,6 +1602,13 @@ async function enforceActionPolicy(ctx) {
     const policyName = result.actionPolicy?.policyName;
     (0, hookIo_1.dbg)({ phase: 'policy_verdict', event, tool: call.toolName, decision: result.decision, allowed: result.allowed, policyName });
     if (result.allowed && result.decision === 'allow') {
+        if (result.actionPolicy?.verdict === 'log') {
+            // The server allowed it under a warn-only rule; surface the warning and
+            // record Warned (the server only records blocks/approvals itself).
+            const warning = warnByPolicy(call, result.actionPolicy, event, ctx.exitsProcess, 'gate');
+            respond(false, warning.userMsg, warning.agentMsg);
+            return;
+        }
         respond(false);
         return;
     }

package/dist/commands/mcpGateway.js

@@ -1213,7 +1213,15 @@ class McpGatewayServer {
                     (0, notify_1.notifyOs)({ title: 'FullCourtDefense — blocked by policy', message: `${toolName} blocked${local.policyName ? ` (${local.policyName})` : ''}.` });
                     throw blockError(`FullCourtDefense blocked ${toolName} by org Action Policy${local.policyName ? ` "${local.policyName}"` : ''}: ${reason}. This is a policy decision, not an error — do not retry.`);
                 }
-                if (local.verdict !== 'require_approval') {
+                if (local.verdict === 'log') {
+                    // "Warn only": the call runs, the fleet records Warned (not a silent
+                    // allow). Final verdict — no gate round trip; the audit rides the spool.
+                    const reason = local.reason || `${toolName}: flagged by org Action Policy`;
+                    (0, telemetry_1.spoolEvent)({ decision: 'warn', toolName, operation: localOperation, reason: `policy warn (local-first): ${reason}`, ruleId: local.policyName ? `action-policy:${local.policyName}` : undefined, offlineEnforced: true });
+                    (0, telemetry_1.triggerFlush)(false);
+                    preflight = { allowed: true, decision: 'allow', operation: localOperation };
+                }
+                else if (local.verdict !== 'require_approval') {
                     // Local allow: the server still records the action asynchronously; a
                     // failed report spools (idempotent on eventId) for the next flush.
                     // During a recently-down gate window, spool directly (no per-call

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.27.1"
+  "version": "1.27.2"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.27.1",
+  "version": "1.27.2",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {