fullcourtdefense-cli 1.27.1 → 1.27.3

package/dist/commands/deterministicGuard.d.ts

@@ -8,8 +8,14 @@ export type DeterministicCategory = 'sensitive_file' | 'metadata_ssrf' | 'creden
  *  - 'warn'  — let the action proceed; surface + report the finding as a warning.
  *  - 'mask'  — redact the matched secret where the surface can rewrite content
  *    (MCP tool responses); surfaces that cannot rewrite treat it as block.
+ *  - 'ask'   — the developer's IDE shows its Allow / Deny prompt (the same
+ *    self-confirmation flow as an Action Policy "Ask the developer"). Where
+ *    nobody can answer — CI / ephemeral machines, the MCP gateway, prompt
+ *    events, shell wrappers — it is block. Never a silent allow.
  */
-export type LocalSafetyRuleAction = 'block' | 'warn' | 'mask';
+export type LocalSafetyRuleAction = 'block' | 'warn' | 'mask' | 'ask';
+/** Whitelist for values that arrive from a snapshot; anything else is unknown → caller defaults to block. */
+export declare function toLocalSafetyRuleAction(value: unknown): LocalSafetyRuleAction | undefined;
 export interface DeterministicFinding {
     blocked: true;
     ruleId: string;
@@ -70,6 +76,13 @@ export declare function scanDeterministicPrompt(text: string, options?: LocalSaf
 export interface DeterministicScanOutcome {
     /** The finding that stops the action, if any. */
     blockingFinding?: DeterministicFinding;
+    /**
+     * The first ask-action finding, when NO block rule also matched. The surface
+     * decides what "ask" means for it: the IDE hook raises the developer's own
+     * Allow / Deny prompt; every surface that cannot ask (MCP gateway, prompt
+     * events, shell wrappers, no human present) treats it exactly as a block.
+     */
+    askFinding?: DeterministicFinding;
     /** warn-action findings that matched — the action proceeds; report these. */
     warnings: DeterministicFinding[];
 }
@@ -89,6 +102,10 @@ export interface DeterministicTextResponseOutcome extends DeterministicScanOutco
  *
  * 'mask' degrades to block here: these surfaces (tool calls, prompts, shell
  * commands) cannot rewrite content, so mask can only fail strict.
+ *
+ * 'ask' is likewise suppressed and re-scanned, so a block rule hiding behind
+ * an ask rule still wins; only when nothing blocks is the first ask finding
+ * returned for the surface to raise (IDE) or fail strict (everything else).
  */
 export declare function resolveDeterministicOutcome(scan: (options?: LocalSafetyScanOptions) => DeterministicFinding | undefined, options?: LocalSafetyScanOptions): DeterministicScanOutcome;
 /**

package/dist/commands/deterministicGuard.js

@@ -33,6 +33,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.toLocalSafetyRuleAction = toLocalSafetyRuleAction;
 exports.stripInertDataSegments = stripInertDataSegments;
 exports.scanDeterministicToolCall = scanDeterministicToolCall;
 exports.scanDeterministicTextResponse = scanDeterministicTextResponse;
@@ -42,6 +43,10 @@ exports.resolveDeterministicTextResponse = resolveDeterministicTextResponse;
 const fs = __importStar(require("fs"));
 const os = __importStar(require("os"));
 const path = __importStar(require("path"));
+/** Whitelist for values that arrive from a snapshot; anything else is unknown → caller defaults to block. */
+function toLocalSafetyRuleAction(value) {
+    return value === 'block' || value === 'warn' || value === 'mask' || value === 'ask' ? value : undefined;
+}
 const SECRET_PATTERNS = [
     { itemId: 'private_key_material', label: 'private key material', re: /-----BEGIN (?:RSA |EC |OPENSSH |DSA )?PRIVATE KEY-----/i },
     { itemId: 'aws_access_key', label: 'AWS access key', re: /\bAKIA[0-9A-Z]{16}\b/ },
@@ -421,8 +426,8 @@ function isEnabled(itemId, options) {
  */
 const DEFAULT_WARN_BUILT_INS = new Set(['env_workspace']);
 function actionFor(itemId, options) {
-    const action = options?.itemActions?.[itemId];
-    if (action === 'warn' || action === 'mask' || action === 'block')
+    const action = toLocalSafetyRuleAction(options?.itemActions?.[itemId]);
+    if (action)
         return action;
     // No snapshot resolved at all: never hard-block on the catalog default —
     // an unarmed / offline machine mirrors the server's warn-first gate rather
@@ -510,7 +515,7 @@ function customBlock(value, options) {
             evidence: evidence(value),
             explanation: block.explanation,
             policyHash: options?.policyHash,
-            action: block.action === 'warn' || block.action === 'mask' ? block.action : 'block',
+            action: toLocalSafetyRuleAction(block.action) || 'block',
         };
     }
     return undefined;
@@ -1211,7 +1216,7 @@ function withRuleSuppressed(options, finding) {
     return { ...(options || {}), disabledBuiltInItemIds: [...baseDisabled, finding.itemId] };
 }
 function findingAction(finding) {
-    return finding.action === 'warn' || finding.action === 'mask' ? finding.action : 'block';
+    return toLocalSafetyRuleAction(finding.action) || 'block';
 }
 /**
  * Resolve a scan under per-rule actions WITHOUT letting a warn rule shadow a
@@ -1223,22 +1228,33 @@ function findingAction(finding) {
  *
  * 'mask' degrades to block here: these surfaces (tool calls, prompts, shell
  * commands) cannot rewrite content, so mask can only fail strict.
+ *
+ * 'ask' is likewise suppressed and re-scanned, so a block rule hiding behind
+ * an ask rule still wins; only when nothing blocks is the first ask finding
+ * returned for the surface to raise (IDE) or fail strict (everything else).
  */
 function resolveDeterministicOutcome(scan, options) {
     const warnings = [];
+    let askFinding;
     let current = options;
     for (let pass = 0; pass < MAX_ACTION_PASSES; pass++) {
         const finding = scan(current);
         if (!finding)
-            return { warnings };
-        if (findingAction(finding) !== 'warn')
+            return askFinding ? { askFinding, warnings } : { warnings };
+        const action = findingAction(finding);
+        if (action === 'warn')
+            warnings.push(finding);
+        else if (action === 'ask')
+            askFinding = askFinding || finding;
+        else
             return { blockingFinding: finding, warnings };
-        warnings.push(finding);
         current = withRuleSuppressed(current, finding);
     }
     // Pass budget exhausted with matches still appearing — fail strict.
     const last = scan(current);
-    return last ? { blockingFinding: last, warnings } : { warnings };
+    if (last)
+        return { blockingFinding: last, warnings };
+    return askFinding ? { askFinding, warnings } : { warnings };
 }
 /**
  * Resolve a TOOL RESPONSE under per-rule actions. The response is the one
@@ -1258,7 +1274,8 @@ function resolveDeterministicTextResponse(text, options) {
         if (!finding)
             return { warnings, maskFindings, maskedText: currentText };
         const action = findingAction(finding);
-        if (action === 'block')
+        // A tool response has no developer to ask — 'ask' fails strict here.
+        if (action === 'block' || action === 'ask')
             return { blockingFinding: finding, warnings, maskFindings, maskedText: currentText };
         if (action === 'mask') {
             if (!finding.matchedSecret || !currentText.includes(finding.matchedSecret)) {

package/dist/commands/hook.js

@@ -338,6 +338,32 @@ function spoolCallEvent(call, rest) {
         evidence: rest.evidence || (0, telemetry_1.evidenceFromToolArgs)(call.toolArgs),
     });
 }
+/**
+ * A `log` verdict ("Warn only" in the console) is a real warning, not a silent
+ * allow: the action runs, the developer sees why it was flagged, and the fleet
+ * records it as Warned. Same delivery as a block — spool synchronously and let
+ * the detached flusher outlive a standalone hook process — so the warning is
+ * never lost on CI runners / containers where respond() ends the process.
+ */
+function warnByPolicy(call, verdict, event, exitsProcess, source) {
+    const reason = verdict.reason || `${call.toolName}: flagged by org Action Policy`;
+    const named = verdict.policyName ? ` (${verdict.policyName})` : '';
+    if (source === 'local-first') {
+        // The gate path is recorded as Warned by the server itself (it saw the
+        // call); only the local verdict has nobody else to write the audit.
+        spoolCallEvent(call, {
+            decision: 'warn',
+            reason: `policy warn (local-first): ${reason}`,
+            ruleId: verdict.policyName ? `action-policy:${verdict.policyName}` : undefined,
+            offlineEnforced: true,
+        });
+        (0, telemetry_1.triggerFlush)(exitsProcess);
+    }
+    return {
+        userMsg: `FullCourtDefense warning${named} — ${reason}. The ${event} was allowed and recorded as Warned.`,
+        agentMsg: `FullCourtDefense warning${named}: ${reason}. This ${event} was allowed by a warn-only Action Policy and recorded as Warned — proceed, but mention the warning to the developer.`,
+    };
+}
 function safeJson(v) {
     try {
         return JSON.stringify(v);
@@ -498,10 +524,31 @@ function tryDeveloperConfirmation(ctx, call, verdict, payload, where) {
     }
     if (ctx.shadow)
         return false; // monitor machines never prompt — the caller records would-approve
+    const prepared = prepareDeveloperConfirmation(ctx.event, call, payload, {
+        policyId: verdict.policyId,
+        policyName: verdict.policyName,
+        matchedRule: verdict.matchedRule,
+        remember: verdict.approval?.remember ?? 'none',
+        reason: verdict.reason,
+        where,
+    });
+    if (prepared.outcome === 'allow')
+        ctx.respond(false, undefined, prepared.agentMsg);
+    ctx.respond('ask', prepared.userMsg, prepared.agentMsg);
+}
+/**
+ * The developer-confirmation core, independent of WHAT asked for it: an Action
+ * Policy rule routed to the developer, or a Local Safety rule set to "Ask".
+ * Sweeps unanswered markers (recorded as not approved), honours a remembered
+ * answer (→ allow, recorded as developer-approved), otherwise raises the
+ * marker the post-execution hook settles and records the pending approval.
+ * Returns what to answer; the caller emits it (respond() ends the process).
+ */
+function prepareDeveloperConfirmation(event, call, payload, source) {
     const { operation } = (0, actionPolicyEngine_1.inferToolContext)(call.toolName, call.toolArgs);
     const sessId = sessionId(payload);
-    const remember = verdict.approval?.remember ?? 'none';
-    const policyLabel = verdict.policyName ? ` (${verdict.policyName})` : '';
+    const policyLabel = source.policyName ? ` (${source.policyName})` : '';
+    const offlineEnforced = source.where !== 'local-first';
     // Sweep first: markers the human never answered are recorded as not approved.
     for (const expired of (0, devConfirm_1.sweepExpiredConfirmations)()) {
         (0, telemetry_1.spoolEvent)({
@@ -513,40 +560,44 @@ function tryDeveloperConfirmation(ctx, call, verdict, payload, where) {
             offlineEnforced: true,
         });
     }
-    const remembered = (0, devConfirm_1.isConfirmationRemembered)({ toolName: call.toolName, operation, policyId: verdict.policyId, matchedRule: verdict.matchedRule }, sessId);
+    const remembered = (0, devConfirm_1.isConfirmationRemembered)({ toolName: call.toolName, operation, policyId: source.policyId, matchedRule: source.matchedRule }, sessId);
     if (remembered) {
-        (0, hookIo_1.dbg)({ phase: 'dev_confirm_remembered', event: ctx.event, tool: call.toolName, operation, remember: remembered.remember, where });
+        (0, hookIo_1.dbg)({ phase: 'dev_confirm_remembered', event, tool: call.toolName, operation, remember: remembered.remember, where: source.where });
         spoolCallEvent(call, {
             decision: 'allow',
             reason: `developer confirmed earlier (${remembered.remember} memory)${policyLabel}`,
             approvalScope: 'developer',
             approvedBy: 'developer',
-            offlineEnforced: where === 'offline',
+            offlineEnforced,
         });
         (0, telemetry_1.triggerFlush)(false);
-        ctx.respond(false, undefined, `FullCourtDefense: ${call.toolName} was already confirmed by the developer in this ${remembered.remember === '1h' ? 'hour' : 'session'}.`);
+        return { outcome: 'allow', agentMsg: `FullCourtDefense: ${call.toolName} was already confirmed by the developer in this ${remembered.remember === '1h' ? 'hour' : 'session'}.` };
     }
     const marker = (0, devConfirm_1.raiseDeveloperConfirmation)({
-        event: ctx.event,
+        event,
         toolName: call.toolName,
         operation,
         argsDigest: (0, devConfirm_1.actionDigest)(call.toolArgs),
-        policyId: verdict.policyId,
-        policyName: verdict.policyName,
-        matchedRule: verdict.matchedRule,
+        policyId: source.policyId,
+        policyName: source.policyName,
+        matchedRule: source.matchedRule,
         sessionId: sessId,
-        remember,
+        remember: source.remember,
     });
-    (0, hookIo_1.dbg)({ phase: 'dev_confirm_ask', event: ctx.event, tool: call.toolName, operation, key: marker.key, remember, where });
+    (0, hookIo_1.dbg)({ phase: 'dev_confirm_ask', event, tool: call.toolName, operation, key: marker.key, remember: source.remember, where: source.where });
     spoolCallEvent(call, {
         decision: 'approval',
-        reason: `developer confirmation requested via IDE prompt${policyLabel}${verdict.reason ? `: ${verdict.reason}` : ''}`,
+        reason: `developer confirmation requested via IDE prompt${policyLabel}${source.reason ? `: ${source.reason}` : ''}`,
         approvalScope: 'developer',
-        offlineEnforced: where === 'offline',
+        offlineEnforced,
     });
     (0, telemetry_1.triggerFlush)(false);
-    const reason = verdict.reason || `${call.toolName} needs your confirmation`;
-    ctx.respond('ask', `FullCourtDefense${policyLabel}: ${reason}. Allow this ${ctx.event}?`, `FullCourtDefense paused this ${ctx.event} for the developer's confirmation${policyLabel}: ${reason}. Wait for the developer's answer in the IDE prompt — do not retry or work around it.`);
+    const reason = source.reason || `${call.toolName} needs your confirmation`;
+    return {
+        outcome: 'ask',
+        userMsg: `FullCourtDefense${policyLabel}: ${reason}. Allow this ${event}?`,
+        agentMsg: `FullCourtDefense paused this ${event} for the developer's confirmation${policyLabel}: ${reason}. Wait for the developer's answer in the IDE prompt — do not retry or work around it.`,
+    };
 }
 /**
  * Post-execution hook: the action ran, so if we asked the developer about exactly this
@@ -631,6 +682,11 @@ function tryLocalPolicyEnforcement(ctx, call, detail, opts = {}) {
         (0, telemetry_1.triggerFlush)(true);
         ctx.respond(true, `Blocked by FullCourtDefense${local.policyName ? ` (${local.policyName})` : ''} — enforced locally while the policy service is unreachable.${approvalNote}`, `FullCourtDefense blocked this ${ctx.event} using the locally cached org policy${local.policyName ? ` "${local.policyName}"` : ''} (${detail}).${approvalNote} Do not retry until the connection is restored or the policy allows it.`);
     }
+    if (local.verdict === 'log') {
+        // Warn-only rule, offline: still a real warning + Warned in the fleet.
+        const warning = warnByPolicy(call, local, ctx.event, ctx.exitsProcess, 'local-first');
+        ctx.respond(false, warning.userMsg, `${warning.agentMsg} (policy service unreachable — evaluated from the locally cached org policies).`);
+    }
     spoolCallEvent(call, { decision: 'allow', reason: `local policy allow (offline): ${detail}`, offlineEnforced: true });
     (0, telemetry_1.triggerFlush)(false);
     ctx.respond(false, undefined, `FullCourtDefense: policy service unreachable — this ${ctx.event} was checked against the locally cached org policies and allowed.`);
@@ -1109,9 +1165,35 @@ async function hookCommandInner(args, config, io) {
             pendingLocalWarnings.push({ finding, toolName, operation });
         }
     };
+    // A Local Safety rule set to "Ask" is held the same way: the IDE prompt is
+    // raised only if the action is not blocked by anything evaluated later
+    // (taint, org Action Policies) — a block always wins over an ask, and the
+    // developer is never asked about an action that would be denied anyway.
+    let pendingLocalAsk;
+    const deferLocalAsk = (finding, call) => {
+        pendingLocalAsk = pendingLocalAsk || { finding, call };
+    };
+    const hasPendingLocalAsk = () => Boolean(pendingLocalAsk);
     const respond = (blocked, userMsg, agentMsg) => {
-        const ask = blocked === 'ask' && event !== 'prompt';
+        let ask = blocked === 'ask' && event !== 'prompt';
         const denied = blocked === true;
+        if (!denied && !ask && pendingLocalAsk && event !== 'prompt') {
+            const { finding, call } = pendingLocalAsk;
+            pendingLocalAsk = undefined;
+            const prepared = prepareDeveloperConfirmation(event, call, payload, {
+                policyId: `local-safety:${finding.itemId}`,
+                policyName: `Local Safety · ${finding.itemId}`,
+                matchedRule: finding.itemId,
+                remember: 'session',
+                reason: finding.reason.replace(/[.\s]+$/, ''),
+                where: 'local-safety',
+            });
+            if (prepared.outcome === 'ask') {
+                ask = true;
+                userMsg = prepared.userMsg;
+            }
+            agentMsg = [prepared.agentMsg, agentMsg].filter(Boolean).join(' ');
+        }
         if (!denied && pendingLocalWarnings.length > 0) {
             spoolLocalWarnings(pendingLocalWarnings.map(w => w.finding), pendingLocalWarnings[0].toolName, pendingLocalWarnings[0].operation);
         }
@@ -1196,7 +1278,7 @@ async function hookCommandInner(args, config, io) {
     if (event === 'shell' || event === 'mcp' || event === 'file' || event === 'read') {
         await enforceActionPolicy({
             event, payload, apiUrl: apiUrl, shieldId: shieldId, shieldKey,
-            shadow, failClosed, timeoutMs, approvalMode, approvalTimeoutMs, approvalPollMs, respond, deferLocalWarnings,
+            shadow, failClosed, timeoutMs, approvalMode, approvalTimeoutMs, approvalPollMs, respond, deferLocalWarnings, deferLocalAsk, hasPendingLocalAsk,
             effectivePolicyHash, localPolicies, client, exitsProcess: io.exitsProcess,
         });
         return;
@@ -1221,7 +1303,9 @@ async function hookCommandInner(args, config, io) {
         });
         const promptOutcome = (0, deterministicGuard_1.resolveDeterministicOutcome)(opts => (0, deterministicGuard_1.scanDeterministicPrompt)(text, opts), (0, localSafetySnapshot_1.snapshotToScanOptions)(snapshot));
         deferLocalWarnings(promptOutcome.warnings, 'prompt', 'prompt');
-        const localBlock = promptOutcome.blockingFinding;
+        // Prompt events have no IDE permission prompt to hand an "ask" to — an
+        // ask-action rule fails strict here (block), never silently allows.
+        const localBlock = promptOutcome.blockingFinding || promptOutcome.askFinding;
         if (localBlock) {
             (0, hookIo_1.dbg)({ phase: 'local_deterministic_prompt_block', event, ruleId: localBlock.ruleId, category: localBlock.category });
             if (shadow) {
@@ -1325,7 +1409,7 @@ async function runTaintApproveOnce(ctx, event, call, sessId, taintFinding) {
     return false;
 }
 async function enforceActionPolicy(ctx) {
-    const { event, payload, apiUrl, shieldId, shieldKey, shadow, timeoutMs, respond, deferLocalWarnings, effectivePolicyHash } = ctx;
+    const { event, payload, apiUrl, shieldId, shieldKey, shadow, timeoutMs, respond, deferLocalWarnings, deferLocalAsk, hasPendingLocalAsk, effectivePolicyHash } = ctx;
     const call = buildToolCall(event, payload);
     if (!call) {
         respond(false);
@@ -1359,6 +1443,26 @@ async function enforceActionPolicy(ctx) {
         respond(true, localBlockUserMessage(localBlock), `FullCourtDefense blocked this ${event} locally (${localBlock.ruleId}). Do not retry.`);
         return;
     }
+    // Local Safety rule set to "Ask the developer" (no block rule matched).
+    //   human at the keyboard -> held until the verdict; the IDE's own Allow / Deny
+    //                            prompt is raised unless something later blocks.
+    //   monitor / shadow      -> recorded as a would-ask warning, the action runs.
+    //   no human (CI, ephemeral, FCD_HUMAN_PRESENT=0) -> block, never a silent allow.
+    const localAsk = toolOutcome.askFinding;
+    if (localAsk) {
+        (0, hookIo_1.dbg)({ phase: 'local_deterministic_ask', event, tool: call.toolName, ruleId: localAsk.ruleId, humanPresent: (0, devConfirm_1.isHumanPresent)(), shadow });
+        if (shadow) {
+            spoolLocalFinding({ finding: localAsk, toolName: call.toolName, operation: event, decision: 'warn' });
+        }
+        else if (!(0, devConfirm_1.isHumanPresent)()) {
+            spoolLocalFinding({ finding: localAsk, toolName: call.toolName, operation: event });
+            respond(true, `${localBlockUserMessage(localAsk)} This rule asks the developer to confirm, but no developer is present on this machine (CI / ephemeral), so it is blocked.`, `FullCourtDefense blocked this ${event} locally (${localAsk.ruleId}): the rule requires the developer's confirmation and no human is present here. Do not retry.`);
+            return;
+        }
+        else {
+            deferLocalAsk?.(localAsk, call);
+        }
+    }
     // --- Taint-guard self-protection (always enforced before anything taint) ---
     // The agent must never resolve approve-once requests or touch the taint
     // state directory; otherwise a compromised agent could approve itself.
@@ -1445,13 +1549,26 @@ async function enforceActionPolicy(ctx) {
     //             (a human must resolve it in the console) — falls through to
     //             the synchronous gate call below.
     // No cached policies (fresh install, bundle fetch failed) also falls through.
-    if (ctx.localPolicies && ctx.localPolicies.length > 0) {
+    // A pending Local Safety "Ask the developer" also resolves here when the
+    // bundle is present but the org has no Action Policies yet: the cached
+    // (hash-covered) policy set is the same one the gate would evaluate, so
+    // "nothing matched" is final and the IDE prompt is raised without a gate
+    // round trip — the same trust the local-first allow below already extends.
+    const localAskPending = Boolean(hasPendingLocalAsk?.());
+    if (ctx.localPolicies && (ctx.localPolicies.length > 0 || localAskPending)) {
         const { operation: localOp, context: localCtx } = (0, actionPolicyEngine_1.inferToolContext)(call.toolName, call.toolArgs);
         localCtx.toolName = call.toolName;
         (0, machineIdentity_1.stampMachineIdentityContext)(localCtx, developerId());
         const localVerdict = (0, actionPolicyEngine_1.evaluateActionPolicies)(ctx.localPolicies, call.toolName, localOp, localCtx, (0, actionPolicyEngine_1.deriveToolOperations)(call.toolName));
         (0, hookIo_1.dbg)({ phase: 'policy_local_first', event, tool: call.toolName, operation: localOp, verdict: localVerdict.verdict, policyName: localVerdict.policyName });
         if (localVerdict.verdict === 'allow') {
+            if (localAskPending) {
+                // No "Allowed" row for an action that has not run yet: respond() turns
+                // this into the IDE ask and records the pending developer approval; the
+                // post-execution hook records the Allow, the sweep records a Deny.
+                respond(false);
+                return;
+            }
             if (ctx.exitsProcess) {
                 // Standalone hook (CI runner, container, daemon down): respond() ends
                 // the process, so a fire-and-forget gate report would die in flight and
@@ -1483,6 +1600,13 @@ async function enforceActionPolicy(ctx) {
             respond(true, `Blocked by FullCourtDefense${localVerdict.policyName ? ` (${localVerdict.policyName})` : ''} — ${reason}`, `FullCourtDefense blocked this ${event} by org Action Policy${localVerdict.policyName ? ` "${localVerdict.policyName}"` : ''}: ${reason}. This is a policy decision, not an error — do not retry.`);
             return;
         }
+        if (localVerdict.verdict === 'log') {
+            // "Warn only": runs, developer told why, fleet records Warned. No gate
+            // round trip — the verdict is final and the audit rides the spool.
+            const warning = warnByPolicy(call, localVerdict, event, ctx.exitsProcess, 'local-first');
+            respond(false, warning.userMsg, warning.agentMsg);
+            return;
+        }
         // require_approval, developer scope + human present → IDE-native ask (no org queue).
         if (tryDeveloperConfirmation({ event, respond, shadow }, call, localVerdict, payload, 'local-first'))
             return;
@@ -1564,6 +1688,13 @@ async function enforceActionPolicy(ctx) {
     const policyName = result.actionPolicy?.policyName;
     (0, hookIo_1.dbg)({ phase: 'policy_verdict', event, tool: call.toolName, decision: result.decision, allowed: result.allowed, policyName });
     if (result.allowed && result.decision === 'allow') {
+        if (result.actionPolicy?.verdict === 'log') {
+            // The server allowed it under a warn-only rule; surface the warning and
+            // record Warned (the server only records blocks/approvals itself).
+            const warning = warnByPolicy(call, result.actionPolicy, event, ctx.exitsProcess, 'gate');
+            respond(false, warning.userMsg, warning.agentMsg);
+            return;
+        }
         respond(false);
         return;
     }

package/dist/commands/mcpGateway.js

@@ -1099,9 +1099,12 @@ class McpGatewayServer {
                 this.spoolLocalFinding(warning, toolName, operation, 'warn');
                 process.stderr.write(`FullCourtDefense warning (${warning.itemId}): ${warning.reason}\n`);
             }
-            const localBlock = requestOutcome.blockingFinding;
+            // The gateway is a stdio proxy with no developer prompt of its own — an
+            // "Ask the developer" rule fails strict here (block), never a silent allow.
+            const localBlock = requestOutcome.blockingFinding || requestOutcome.askFinding;
             if (localBlock) {
                 const origin = localBlock.source === 'custom' ? 'org custom rule' : 'built-in Local Safety rule';
+                const askNote = !requestOutcome.blockingFinding ? ' This rule asks the developer to confirm; the MCP gateway cannot prompt, so it blocks here (the IDE hook can ask).' : '';
                 if (reportOnlyMode) {
                     // MONITOR CONTRACT: a monitor/shadow machine (or one with no bundle
                     // signal at all) must NEVER hard-block. Online, the server already
@@ -1114,7 +1117,7 @@ class McpGatewayServer {
                 }
                 else {
                     this.spoolLocalFinding(localBlock, toolName, operation);
-                    throw blockError(`${localBlock.reason} (${origin} "${localBlock.itemId}", ${localBlock.ruleId}: ${localBlock.evidence}) — logged to your org's console; admins manage rules under Shield → Local Safety. This is a security policy decision, not a transient error — do not retry.`);
+                    throw blockError(`${localBlock.reason} (${origin} "${localBlock.itemId}", ${localBlock.ruleId}: ${localBlock.evidence}) — logged to your org's console; admins manage rules under Shield → Local Safety.${askNote} This is a security policy decision, not a transient error — do not retry.`);
                 }
             }
             // --- Machine-role session amount limits (pre-call: operation counts) ---
@@ -1213,7 +1216,15 @@ class McpGatewayServer {
                     (0, notify_1.notifyOs)({ title: 'FullCourtDefense — blocked by policy', message: `${toolName} blocked${local.policyName ? ` (${local.policyName})` : ''}.` });
                     throw blockError(`FullCourtDefense blocked ${toolName} by org Action Policy${local.policyName ? ` "${local.policyName}"` : ''}: ${reason}. This is a policy decision, not an error — do not retry.`);
                 }
-                if (local.verdict !== 'require_approval') {
+                if (local.verdict === 'log') {
+                    // "Warn only": the call runs, the fleet records Warned (not a silent
+                    // allow). Final verdict — no gate round trip; the audit rides the spool.
+                    const reason = local.reason || `${toolName}: flagged by org Action Policy`;
+                    (0, telemetry_1.spoolEvent)({ decision: 'warn', toolName, operation: localOperation, reason: `policy warn (local-first): ${reason}`, ruleId: local.policyName ? `action-policy:${local.policyName}` : undefined, offlineEnforced: true });
+                    (0, telemetry_1.triggerFlush)(false);
+                    preflight = { allowed: true, decision: 'allow', operation: localOperation };
+                }
+                else if (local.verdict !== 'require_approval') {
                     // Local allow: the server still records the action asynchronously; a
                     // failed report spools (idempotent on eventId) for the next flush.
                     // During a recently-down gate window, spool directly (no per-call

package/dist/localSafetySnapshot.js

@@ -42,6 +42,7 @@ const crypto = __importStar(require("crypto"));
 const fs = __importStar(require("fs"));
 const os = __importStar(require("os"));
 const path = __importStar(require("path"));
+const deterministicGuard_1 = require("./commands/deterministicGuard");
 const honeypot_1 = require("./honeypot");
 const CACHE_TTL_MS = 60_000;
 const CACHE_DIR = path.join(os.homedir(), '.fullcourtdefense');
@@ -103,7 +104,7 @@ function toRuleAction(value) {
     // Explicit 'block' is preserved (not treated as absent): warn-by-default
     // items (e.g. env_workspace) need an org's explicit block override to
     // survive parsing, otherwise the CLI's catalog default would resurrect warn.
-    return value === 'warn' || value === 'mask' || value === 'block' ? value : undefined;
+    return (0, deterministicGuard_1.toLocalSafetyRuleAction)(value);
 }
 function toSnapshot(data) {
     if (!data || typeof data !== 'object')

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.27.1"
+  "version": "1.27.3"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.27.1",
+  "version": "1.27.3",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {
@@ -77,6 +77,7 @@
     "test:enroll-cache-reset": "npm run build && node scripts/test-enroll-cache-reset.js",
     "test:offline-policy": "npm run build && node scripts/test-offline-policy-enforcement.js",
     "test:developer-confirmation": "npm run build && node scripts/test-developer-confirmation.js",
+    "test:local-safety-ask": "npm run build && node scripts/test-local-safety-ask.js",
     "test:demo-actions": "npm run build && node scripts/test-demo-actions.js",
     "test:real-scenario": "npm run build && node scripts/test-real-scenario-drill.js",
     "test:blocking-approval": "npm run build && node scripts/test-blocking-approval-drill.js",