fullcourtdefense-cli 1.30.0 → 1.32.0

package/dist/commands/hook.js

@@ -34,6 +34,10 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.normalizeClaudePayload = normalizeClaudePayload;
+exports.canonicalBuiltinToolName = canonicalBuiltinToolName;
+exports.mapBuiltinToolPayload = mapBuiltinToolPayload;
+exports.normalizeCursorBuiltinTool = normalizeCursorBuiltinTool;
+exports.canonicalizeCursorPayload = canonicalizeCursorPayload;
 exports.buildToolCall = buildToolCall;
 exports.classifyGateHttpFailure = classifyGateHttpFailure;
 exports.gateHttpFailureDetail = gateHttpFailureDetail;
@@ -59,6 +63,7 @@ const devConfirm_1 = require("../devConfirm");
 // Shared with the slim hook entry (hookSlim.ts) so both entries log to the
 // same rotated hook.log and read stdin identically.
 const hookIo_1 = require("../hookIo");
+const fileWriteCanon_1 = require("../fileWriteCanon");
 function inferEvent(explicit, payload) {
     const e = (explicit || '').toLowerCase();
     if (e) {
@@ -163,36 +168,137 @@ function mapClaudeToolPayload(payload) {
             payload: { ...payload, tool_name: shortTool, mcp_server_name: server, tool_input: input },
         };
     }
-    // Claude Code, VS Code Copilot, and Copilot CLI each use their own tool names
-    // for the same operations — compare case/underscore-insensitively.
-    const canon = toolName.toLowerCase().replace(/[_-]/g, '');
-    const SHELL_TOOLS = new Set(['bash', 'shell', 'runterminalcommand', 'runinterminal', 'powershell', 'terminal']);
-    const READ_TOOLS = new Set(['read', 'readfile', 'view']);
-    const WRITE_TOOLS = new Set([
-        'write', 'edit', 'multiedit', 'notebookedit', 'createfile', 'editfiles',
-        'replacestringinfile', 'editfile', 'applypatch', 'strreplaceeditor', 'insertedittofile',
-    ]);
-    if (SHELL_TOOLS.has(canon)) {
+    // Glob/Grep/Task/WebFetch/etc. — no enforcement surface; let the client's own
+    // permission flow handle them.
+    return mapBuiltinToolPayload(toolName, input, payload) ?? { event: 'ignore', payload };
+}
+// ---------------------------------------------------------------------------
+// Built-in IDE tools — ONE taxonomy for every client.
+//
+// Cursor, Claude Code, VS Code Copilot and Copilot CLI each name the same three
+// primitive actions differently (Cursor `Write`, Claude `Edit`, VS Code
+// `replaceStringInFile`; Cursor `Shell`, Claude `Bash`, VS Code `runInTerminal`).
+// They also ship different payload shapes for a file edit: Claude sends the
+// old/new strings, Cursor's `Write` and MCP `write_file` send the WHOLE resulting
+// file. If those shapes reach the policy engine as-is, the same developer action
+// gets a different verdict per client — and a whole-file write is judged as if
+// the agent were sending the entire file somewhere, so a credential-shaped
+// literal that has sat in a test fixture for years blocks every edit of that file.
+//
+// This layer canonicalizes BEFORE the engine ("capture -> canonicalize ->
+// decide -> enforce"): a file edit is `edit_file { path, content }` where
+// `content` is only what the edit ADDS; a command is `shell { command, cwd }`;
+// a file read is `read_file { path }`. Built-ins with no enforcement surface
+// (search, task, web) are ignored. Nothing here decides anything.
+// ---------------------------------------------------------------------------
+const BUILTIN_SHELL_TOOLS = new Set(['bash', 'shell', 'runterminalcommand', 'runinterminal', 'powershell', 'terminal']);
+const BUILTIN_READ_TOOLS = new Set(['read', 'readfile', 'view']);
+const BUILTIN_WRITE_TOOLS = new Set([
+    'write', 'edit', 'multiedit', 'notebookedit', 'createfile', 'editfiles',
+    'replacestringinfile', 'editfile', 'applypatch', 'strreplaceeditor', 'insertedittofile', 'strreplace', 'editnotebook',
+]);
+/**
+ * Built-ins that never touch a file, a command, a server or the outside world —
+ * nothing to enforce. Web fetch / web search are deliberately NOT here: they
+ * are INGRESS for the taint ledger (untrusted content entering the session)
+ * and keep flowing through the MCP path exactly as before.
+ */
+const BUILTIN_PASSIVE_TOOLS = new Set([
+    'grep', 'glob', 'ls', 'listdir', 'codebasesearch', 'semanticsearch',
+    'task', 'todowrite', 'readlints', 'switchmode', 'askquestion', 'sendtouser', 'awaitshell',
+    'getdynamictools',
+]);
+function canonicalBuiltinToolName(toolName) {
+    return (0, fileWriteCanon_1.canonicalToolName)(toolName);
+}
+/**
+ * Map a built-in IDE tool (any client) onto our event taxonomy. Returns null
+ * for a tool name this layer does not recognize so the caller keeps its own
+ * default (Claude: ignore; Cursor: treat as an MCP tool).
+ */
+function mapBuiltinToolPayload(toolName, input, payload) {
+    const canon = canonicalBuiltinToolName(toolName);
+    if (BUILTIN_SHELL_TOOLS.has(canon)) {
         return {
             event: 'shell',
-            payload: { ...payload, command: str(input.command), cwd: str(input.cwd) || str(payload.cwd) || undefined },
+            payload: { ...payload, command: str(input.command), cwd: str(input.cwd) || str(input.working_directory) || str(payload.cwd) || undefined },
         };
     }
-    if (READ_TOOLS.has(canon)) {
-        return { event: 'read', payload: { ...payload, file_path: str(input.file_path) || str(input.path) } };
+    if (BUILTIN_READ_TOOLS.has(canon)) {
+        return { event: 'read', payload: { ...payload, file_path: str(input.file_path) || str(input.path) || str(input.target_file) } };
     }
-    if (WRITE_TOOLS.has(canon)) {
-        const content = str(input.content) || str(input.new_string) || str(input.new_source) || str(input.code)
+    if (BUILTIN_WRITE_TOOLS.has(canon)) {
+        const filePath = str(input.file_path) || str(input.notebook_path) || str(input.path) || str(input.filePath) || str(input.target_file)
+            || (Array.isArray(input.files) ? input.files.map((f) => str(f)).filter(Boolean).join(', ') : '');
+        // Delta shapes first (old/new strings, edit lists): they already carry only
+        // what changes. Whole-file shapes (`content`, `contents`, `code`,
+        // `new_source`) are reduced to the lines they add. Both then drop the
+        // credential-shaped words the file on disk already contains — re-stating a
+        // value that is already in the file is not putting a secret into it.
+        const delta = str(input.new_string) || str(input.new_str) || str(input.new_text)
             || (Array.isArray(input.edits)
-                ? input.edits.map((e) => str(e?.new_string) || str(e?.content)).filter(Boolean).join('\n')
+                ? input.edits.map((e) => str(e?.new_string) || str(e?.new_text) || str(e?.newText) || str(e?.content)).filter(Boolean).join('\n')
                 : '');
-        const filePath = str(input.file_path) || str(input.notebook_path) || str(input.path) || str(input.filePath)
-            || (Array.isArray(input.files) ? input.files.map((f) => str(f)).filter(Boolean).join(', ') : '');
+        const whole = str(input.content) || str(input.contents) || str(input.new_source) || str(input.code);
+        const content = (0, fileWriteCanon_1.newContentOnly)(filePath || undefined, delta || whole);
         return { event: 'file', payload: { ...payload, file_path: filePath, content } };
     }
-    // Glob/Grep/Task/WebFetch/etc. — no enforcement surface; let the client's own
-    // permission flow handle them.
-    return { event: 'ignore', payload };
+    if (BUILTIN_PASSIVE_TOOLS.has(canon))
+        return { event: 'ignore', payload };
+    return null;
+}
+/**
+ * Cursor delivers its OWN built-in tools (Shell / Read / Write / Grep / …)
+ * through the same execution hook as MCP servers, with `tool_use_id` + no
+ * server identity (`mcp_server_name` / `url` / `command` are MCP-only). Route
+ * them through the shared taxonomy so an IDE edit is a FILE action, a command
+ * is a SHELL action, and neither is ever judged as an unknown MCP tool.
+ *
+ * Shell is dropped here on purpose: Cursor also fires `beforeShellExecution`
+ * for the same command, which is the authoritative shell surface — evaluating
+ * it twice produced two (sometimes different) verdicts for one action.
+ */
+function normalizeCursorBuiltinTool(payload) {
+    const toolName = str(payload.tool_name);
+    if (!toolName)
+        return null;
+    if (str(payload.mcp_server_name) || str(payload.server_name) || str(payload.mcp_server_url) || str(payload.url) || str(payload.command))
+        return null;
+    if (toolName.startsWith('mcp__') || toolName.startsWith('MCP:'))
+        return null;
+    let toolInput = payload.tool_input;
+    if (typeof toolInput === 'string') {
+        const trimmed = toolInput.trim();
+        if (trimmed.startsWith('{') || trimmed.startsWith('[')) {
+            try {
+                toolInput = JSON.parse(trimmed);
+            }
+            catch { /* keep raw */ }
+        }
+    }
+    const input = (toolInput && typeof toolInput === 'object' ? toolInput : {});
+    const mapped = mapBuiltinToolPayload(toolName, input, payload);
+    if (!mapped)
+        return null;
+    if (mapped.event === 'shell')
+        return { event: 'ignore', payload };
+    return mapped;
+}
+/**
+ * Cursor-format entry: infer the event from the `--event` flag / payload shape,
+ * then route Cursor built-in tools through the shared taxonomy. Exported so the
+ * IDE false-positive corpus (Layer A) evaluates exactly what the hook evaluates.
+ */
+function canonicalizeCursorPayload(argEvent, payload) {
+    const event = inferEvent(argEvent, payload);
+    if (event !== 'mcp')
+        return { event, payload, ignore: false };
+    const builtin = normalizeCursorBuiltinTool(payload);
+    if (!builtin)
+        return { event, payload, ignore: false };
+    if (builtin.event === 'ignore')
+        return { event: 'unknown', payload, ignore: true };
+    return { event: builtin.event, payload: builtin.payload, ignore: false };
 }
 /**
  * Which AI client invoked a Claude-format hook. Claude Code sets CLAUDECODE=1;
@@ -298,16 +404,20 @@ function buildToolCall(event, p) {
                 }
             }
             const toolArgs = rawInput && typeof rawInput === 'object' ? rawInput : { value: rawInput };
-            return { toolName, toolArgs };
+            // MCP filesystem servers write whole files; judge only what the write adds.
+            return { toolName, toolArgs: (0, fileWriteCanon_1.canonicalizeFileWriteArgs)(toolName, toolArgs) };
         }
         case 'file': {
             const filePath = str(p.file_path) || str(p.path);
             const edits = p.edits;
-            const content = Array.isArray(edits)
+            const rawContent = Array.isArray(edits)
                 ? edits.map((e) => str(e.new_text) || str(e.text) || str(e.content)).filter(Boolean).join('\n')
                 : (str(p.content) || str(p.new_text));
-            if (!filePath && !content)
+            if (!filePath && !rawContent)
                 return null;
+            // Single choke point for every client's edit shape: judge only what is
+            // new for the file on disk (added lines, minus values it already holds).
+            const content = (0, fileWriteCanon_1.newContentOnly)(filePath || undefined, rawContent);
             return { toolName: 'edit_file', toolArgs: { path: filePath || undefined, content: content || undefined } };
         }
         case 'read': {
@@ -349,6 +459,12 @@ function spoolCallEvent(call, rest) {
 function warnByPolicy(call, verdict, event, exitsProcess, source) {
     const reason = verdict.reason || `${call.toolName}: flagged by org Action Policy`;
     const named = verdict.policyName ? ` (${verdict.policyName})` : '';
+    // Local content ceiling: the rule is set to Block, but it fired on what a
+    // file on this machine CONTAINS and nothing left the machine — recorded, not
+    // stopped. Say so, so "set to Block" in the console and "warning" here agree.
+    const ceiling = verdict.loggedInsteadOfBlocked
+        ? ' This rule is set to Block, but it matched only the CONTENT of a local file (a secret-shaped value) — content on your own disk is recorded, not blocked. The same content leaving the machine would be blocked.'
+        : '';
     if (source === 'local-first') {
         // The gate path is recorded as Warned by the server itself (it saw the
         // call); only the local verdict has nobody else to write the audit.
@@ -361,8 +477,8 @@ function warnByPolicy(call, verdict, event, exitsProcess, source) {
         (0, telemetry_1.triggerFlush)(exitsProcess);
     }
     return {
-        userMsg: `FullCourtDefense warning${named} — ${reason}. The ${event} was allowed and recorded as Warned.`,
-        agentMsg: `FullCourtDefense warning${named}: ${reason}. This ${event} was allowed by a warn-only Action Policy and recorded as Warned — proceed, but mention the warning to the developer.`,
+        userMsg: `FullCourtDefense warning${named} — ${reason}. The ${event} was allowed and recorded as Warned.${ceiling}`,
+        agentMsg: `FullCourtDefense warning${named}: ${reason}. This ${event} was allowed by a warn-only Action Policy and recorded as Warned — proceed, but mention the warning to the developer.${ceiling}`,
     };
 }
 function safeJson(v) {
@@ -535,6 +651,7 @@ function tryDeveloperConfirmation(ctx, call, verdict, payload, where) {
         reason: verdict.reason,
         where,
         policies: ctx.localPolicies,
+        askedInsteadOfBlocked: verdict.askedInsteadOfBlocked === true,
     });
     if (prepared.outcome === 'allow')
         ctx.respond(false, undefined, prepared.agentMsg);
@@ -599,9 +716,12 @@ function prepareDeveloperConfirmation(event, call, payload, source) {
     const reason = source.reason || `${call.toolName} needs your confirmation`;
     // Name the rule in the prompt itself: a developer deciding y/n must see WHICH
     // rule is asking and where to change it — same builder as every block.
+    const ceilingNote = source.askedInsteadOfBlocked
+        ? 'This policy is set to Block. On a developer workstation it asks you instead of blocking — a wrong Ask costs one click, a wrong block costs your afternoon. An admin can mark the policy "Hard block" in the console to stop this without asking.'
+        : undefined;
     const explained = source.where === 'local-safety' && source.localFinding
         ? explainLocalSafetyStop('ask', event, call, source.localFinding)
-        : explainPolicyStop('ask', event, call, source, source.policies);
+        : explainPolicyStop('ask', event, call, source, source.policies, ceilingNote);
     return {
         outcome: 'ask',
         userMsg: `${explained.userMessage}\nAllow this ${event}?`,
@@ -1229,7 +1349,10 @@ async function hookCommandInner(args, config, io) {
         }
     }
     else {
-        event = inferEvent(args.event, payload);
+        const cursor = canonicalizeCursorPayload(args.event, payload);
+        event = cursor.event;
+        payload = cursor.payload;
+        ignoreEvent = cursor.ignore;
     }
     (0, hookIo_1.dbg)({ phase: 'invoke', event, argEvent: args.event, format: hookFormat, client, pid: process.pid,
         isTTY, rawLen: raw.length, ...(hookIo_1.HOOK_DEBUG_VERBOSE ? { rawPreview: raw.slice(0, 300) } : {}), stdinErr, parseErr,
@@ -1397,9 +1520,13 @@ async function hookCommandInner(args, config, io) {
         });
         const promptOutcome = (0, deterministicGuard_1.resolveDeterministicOutcome)(opts => (0, deterministicGuard_1.scanDeterministicPrompt)(text, opts), (0, localSafetySnapshot_1.snapshotToScanOptions)(snapshot));
         deferLocalWarnings(promptOutcome.warnings, 'prompt', 'prompt');
-        // Prompt events have no IDE permission prompt to hand an "ask" to — an
-        // ask-action rule fails strict here (block), never silently allows.
+        // The prompt path only judges what is literally IN the text — a real secret
+        // value (or an org custom block). Command / path mentions are decided when
+        // the action happens, where the developer's Ask answer can be collected.
+        // A prompt has no Allow / Deny to offer, so a secret rule set to "ask"
+        // fails strict here (block) and SAYS so — never silently allows.
         const localBlock = promptOutcome.blockingFinding || promptOutcome.askFinding;
+        const askDegraded = !promptOutcome.blockingFinding && Boolean(promptOutcome.askFinding);
         if (localBlock) {
             (0, hookIo_1.dbg)({ phase: 'local_deterministic_prompt_block', event, ruleId: localBlock.ruleId, category: localBlock.category });
             if (shadow) {
@@ -1409,7 +1536,7 @@ async function hookCommandInner(args, config, io) {
                 return;
             }
             spoolLocalFinding({ finding: localBlock, toolName: 'prompt', operation: 'prompt' });
-            const explained = explainLocalSafetyStop('block', 'prompt', { toolName: 'prompt', toolArgs: {} }, localBlock);
+            const explained = explainLocalSafetyStop('block', 'prompt', { toolName: 'prompt', toolArgs: {} }, localBlock, askDegraded ? 'This rule is set to "Ask the developer", but a chat prompt has no Allow / Deny to offer, so it was stopped. Remove the secret value from the prompt and send it again.' : undefined);
             respond(true, explained.userMessage, `FullCourtDefense blocked this prompt locally (${localBlock.ruleId}). Do not retry. ${explained.agentMessage}`);
             return;
         }
@@ -1838,7 +1965,11 @@ async function enforceActionPolicy(ctx) {
             message: `${call.toolName}: ${outcome.message}`,
             url: outcome.status === 'timeout' ? queueUrl : undefined,
         });
-        respond(true, `FullCourtDefense: ${outcome.message} (${queueUrl})`, `This ${event} was not approved (${outcome.status}). Do not retry until a human approves it in the FullCourtDefense console: ${queueUrl}`);
+        // Same contract as every other stop: WHAT was paused, WHICH rule (by name),
+        // WHY, and how to change it — a developer who only reads "still waiting"
+        // cannot tell a wrong rule from a slow approver.
+        const explainedWait = explainPolicyStop('approval', event, call, { policyName, policyId: result.actionPolicy?.policyId, matchedRule: result.actionPolicy?.matchedRule, reason }, ctx.localPolicies, `Status: ${outcome.message} Approve at ${queueUrl}`);
+        respond(true, explainedWait.userMessage, `This ${event} was not approved (${outcome.status}). Do not retry until a human approves it in the FullCourtDefense console: ${queueUrl}. ${explainedWait.agentMessage}`);
         return;
     }
     // block / mask / any other not-allowed decision.

package/dist/commands/mcpGateway.js

@@ -62,6 +62,7 @@ const runtimeConfig_1 = require("../runtimeConfig");
 const sessionLimits_1 = require("../sessionLimits");
 const telemetry_1 = require("../telemetry");
 const notify_1 = require("../notify");
+const fileWriteCanon_1 = require("../fileWriteCanon");
 const blockExplanation_1 = require("../blockExplanation");
 const distress_1 = require("../distress");
 const policyGateHealth_1 = require("../policyGateHealth");
@@ -1092,7 +1093,12 @@ class McpGatewayServer {
         const toolName = String(params.name || '');
         if (!toolName)
             throw new Error('Missing MCP tool name.');
-        const toolArgs = params.arguments && typeof params.arguments === 'object' ? params.arguments : {};
+        // What the server receives is untouched (`forwardArgs`). What the policy
+        // decision sees is the canonical action: a whole-file write is reduced to
+        // the lines it adds so a secret already sitting in the file never blocks
+        // editing it (see fileWriteCanon.ts).
+        const forwardArgs = params.arguments && typeof params.arguments === 'object' ? params.arguments : {};
+        const toolArgs = (0, fileWriteCanon_1.canonicalizeFileWriteArgs)(toolName, forwardArgs);
         (0, telemetry_1.setVerdictToolArgs)(toolArgs);
         let approvalActionId;
         let operation = typeof params.operation === 'string' && params.operation.trim() ? params.operation.trim() : undefined;
@@ -1365,7 +1371,20 @@ class McpGatewayServer {
                     (0, notify_1.notifyOs)({ title: 'FullCourtDefense — blocked by policy', message: `${toolName} blocked${local.policyName ? ` (${local.policyName})` : ''}.` });
                     throw blockError(explainGatewayPolicy('block', toolName, toolArgs, local, cachedPolicies));
                 }
-                if (local.verdict === 'log') {
+                if (local.verdict === 'require_approval'
+                    && (0, actionPolicyEngine_1.effectiveApprovalScope)(local.approval, { humanPresent: (0, devConfirm_1.isHumanPresent)() }) === 'developer'
+                    && this.clientSupportsElicitation) {
+                    // Developer-scoped approval (an explicit developer rule, or an org
+                    // `block` softened by the workstation ceiling): ask the human through
+                    // the MCP client — same ledger and session memory as the IDE hook.
+                    // Accept → allow (recorded as the developer's decision); decline /
+                    // timeout → block. A client without elicitation falls through to the
+                    // org approval queue below — never a silent allow.
+                    const answered = await this.askDeveloperForPolicy(toolName, toolArgs, localOperation, local, cachedPolicies);
+                    if (answered)
+                        preflight = { allowed: true, decision: 'allow', operation: localOperation };
+                }
+                else if (local.verdict === 'log') {
                     // "Warn only": the call runs, the fleet records Warned (not a silent
                     // allow). Final verdict — no gate round trip; the audit rides the spool.
                     const reason = local.reason || `${toolName}: flagged by org Action Policy`;
@@ -1528,7 +1547,7 @@ class McpGatewayServer {
                 }
             }
             downstreamAttempted = true;
-            let rawResult = await this.downstream.callTool(toolName, toolArgs);
+            let rawResult = await this.downstream.callTool(toolName, forwardArgs);
             downstreamRan = true;
             downstreamResult = rawResult;
             // Response-side events must measure our scanning overhead, not the
@@ -1707,7 +1726,7 @@ class McpGatewayServer {
             if (!isBlockError(error) && !downstreamAttempted) {
                 // Pre-call bug: forward the tool call now (exactly once).
                 try {
-                    const recovered = await this.downstream.callTool(toolName, toolArgs);
+                    const recovered = await this.downstream.callTool(toolName, forwardArgs);
                     try {
                         (0, telemetry_1.spoolEvent)({ decision: 'allow', toolName, operation, reason: `gateway error failed open (pre-call): ${message.slice(0, 200)}`, offlineEnforced: true });
                         (0, telemetry_1.triggerFlush)(false);
@@ -1778,6 +1797,70 @@ class McpGatewayServer {
      * that is not an explicit accept (decline, cancel, timeout, malformed) is a
      * decline. The caller decides what a decline means (block).
      */
+    /**
+     * Ask the developer (MCP elicitation) to confirm a tool call an Action Policy
+     * routed to them. Returns true when the call may run (remembered or accepted);
+     * throws the block error when the developer declines or does not answer.
+     */
+    async askDeveloperForPolicy(toolName, toolArgs, operation, verdict, policies) {
+        const rememberScope = { toolName, operation, policyId: verdict.policyId, matchedRule: verdict.matchedRule };
+        const sessionId = runtimeSessionId() || this.gatewaySessionId;
+        const policyLabel = verdict.policyName ? ` (${verdict.policyName})` : '';
+        const ruleId = verdict.policyName ? `action-policy:${verdict.policyName}` : undefined;
+        const remembered = (0, devConfirm_1.isConfirmationRemembered)(rememberScope, sessionId);
+        if (remembered) {
+            (0, telemetry_1.spoolEvent)({
+                decision: 'allow', toolName, operation,
+                reason: `developer confirmed earlier (${remembered.remember} memory)${policyLabel}`,
+                ruleId, offlineEnforced: true, approvalScope: 'developer', approvedBy: 'developer',
+            });
+            (0, telemetry_1.triggerFlush)(false);
+            return true;
+        }
+        const digest = (0, devConfirm_1.actionDigest)(toolArgs);
+        const remember = verdict.approval?.remember ?? 'none';
+        const marker = (0, devConfirm_1.raiseDeveloperConfirmation)({
+            event: 'mcp_gateway', toolName, operation, argsDigest: digest,
+            policyId: verdict.policyId, policyName: verdict.policyName, matchedRule: verdict.matchedRule,
+            sessionId, remember,
+        });
+        (0, telemetry_1.spoolEvent)({
+            decision: 'approval', toolName, operation,
+            reason: `developer confirmation requested via MCP client prompt${policyLabel}${verdict.reason ? `: ${verdict.reason}` : ''}`,
+            ruleId, offlineEnforced: true, approvalScope: 'developer',
+        });
+        (0, telemetry_1.triggerFlush)(false);
+        const ceiling = verdict.askedInsteadOfBlocked
+            ? ' This policy is set to Block; on a developer workstation it asks you instead. An admin can mark it "Hard block" in the console to stop this without asking.'
+            : '';
+        process.stderr.write(`FullCourtDefense asking the developer to confirm ${toolName}${policyLabel}: ${verdict.reason || verdict.matchedRule || 'action policy'}\n`);
+        const answer = await this.elicitDeveloperConfirmation({
+            toolName,
+            reason: `${verdict.reason || `${toolName} needs your confirmation`}.${ceiling}`,
+            ruleLabel: verdict.policyName ? `Action Policy "${verdict.policyName}"${verdict.matchedRule ? ` — ${verdict.matchedRule}` : ''}` : 'Action Policy',
+        });
+        if (answer.answer === 'accept') {
+            if (answer.remember && remember === 'none')
+                (0, devConfirm_1.raiseDeveloperConfirmation)({ ...marker, remember: 'session' });
+            (0, devConfirm_1.settleDeveloperConfirmation)('mcp_gateway', toolName, digest);
+            (0, telemetry_1.spoolEvent)({
+                decision: 'allow', toolName, operation,
+                reason: `developer confirmed in MCP client prompt${answer.remember ? ' (remembered for this session)' : ''}${policyLabel}`,
+                ruleId, offlineEnforced: true, approvalScope: 'developer', approvedBy: 'developer', confirmLatencyMs: answer.latencyMs,
+            });
+            (0, telemetry_1.triggerFlush)(false);
+            return true;
+        }
+        (0, devConfirm_1.settleDeveloperConfirmation)('mcp_gateway', toolName, digest);
+        const how = answer.answer === 'timeout' ? 'developer confirmation not given (prompt timed out)' : 'developer declined in MCP client prompt';
+        (0, telemetry_1.spoolEvent)({
+            decision: 'block', toolName, operation,
+            reason: `${how}${policyLabel}`,
+            ruleId, offlineEnforced: true, approvalScope: 'developer', confirmLatencyMs: answer.latencyMs,
+        });
+        (0, telemetry_1.triggerFlush)(true);
+        throw blockError(explainGatewayPolicy('block', toolName, toolArgs, verdict, policies, `${answer.answer === 'timeout' ? 'You did not answer the confirmation prompt in time' : 'You declined the confirmation prompt'}, so this tool call was not executed.`));
+    }
     async elicitDeveloperConfirmation(input) {
         const started = Date.now();
         const evidence = input.evidence ? `\n\nEvidence: ${input.evidence.slice(0, 240)}` : '';

package/dist/commands/posixShellGuard.js

@@ -48,6 +48,7 @@ const os = __importStar(require("os"));
 const path = __importStar(require("path"));
 const shellGuard_1 = require("./shellGuard");
 const notify_1 = require("../notify");
+const agentTerminal_1 = require("../agentTerminal");
 /**
  * Interactive macOS/Linux shell guard — real-time blocking of dangerous commands
  * TYPED by a human into bash or zsh (inside or outside the IDE).
@@ -156,7 +157,7 @@ function buildGuardJs(nodePath, cliEntry) {
     return [
         `'use strict';`,
         `// ${(0, shellGuard_1.guardBuildStamp)()}`,
-        `const fs=require('fs');const crypto=require('crypto');const{spawn}=require('child_process');`,
+        `const fs=require('fs');const os=require('os');const path=require('path');const crypto=require('crypto');const{spawn}=require('child_process');`,
         `const RULES_PATH=${JSON.stringify(GUARD_RULES_PATH)};`,
         `const SPOOL_PATH=${JSON.stringify(SPOOL_PATH)};`,
         `const NODE_PATH=${JSON.stringify(nodePath)};`,
@@ -174,8 +175,9 @@ function buildGuardJs(nodePath, cliEntry) {
         `// Precedence on one line: block outranks ask, ask outranks warn.`,
         `function matchLine(line,rules){const n=line.replace(/\\s+/g,' ').trim();const x=execView(line);const xn=x.replace(/\\s+/g,' ').trim();let warnHit=null,askHit=null;for(const r of rules){try{const t=r.source==='custom'?line:x;const tn=r.source==='custom'?n:xn;if(r.re.test(tn)||r.re.test(t)){if(r.action==='block')return r;if(r.action==='ask'){if(!askHit)askHit=r;}else if(!warnHit)warnHit=r;}}catch{}}return askHit||warnHit;}`,
         `function triggerFlush(){try{if(fs.existsSync(NODE_PATH)&&fs.existsSync(CLI_ENTRY)){const c=spawn(NODE_PATH,[CLI_ENTRY,'flush-spool','--heartbeat','true'],{detached:true,stdio:'ignore'});c.unref();}}catch{}}`,
-        `// developer: '' | 'confirmed' | 'remembered' | 'declined' | 'timeout' — the terminal "ask" answer, reported with the same facts as an IDE prompt.`,
-        `function spoolEvent(rule,line,decision,developer){try{const ev=line.trim();const evidence=ev.length>180?ev.slice(0,180)+'...':ev;let reason='Shell guard: '+rule.reason;if(developer==='confirmed')reason='developer confirmed in terminal prompt — '+reason;else if(developer==='remembered')reason='developer confirmed earlier in this shell (session memory) — '+reason;else if(developer==='declined')reason='developer declined in terminal prompt — '+reason;else if(developer==='timeout')reason='developer confirmation not given (terminal prompt timed out) — '+reason;const event={eventId:crypto.randomUUID(),type:'verdict',decision,toolName:'shell_terminal',operation:'shell_command',reason,ruleId:rule.id,category:rule.category,severity:rule.severity,source:rule.source,evidence,occurredAt:new Date().toISOString()};if(developer){event.approvalScope='developer';if(developer==='confirmed'||developer==='remembered')event.approvedBy='developer';}fs.appendFileSync(SPOOL_PATH,JSON.stringify(event)+'\\n',{encoding:'utf8',mode:0o600});triggerFlush();}catch{}}`,
+        `// developer: '' | 'confirmed' | 'remembered' | 'declined' | 'timeout' | 'ide' | 'agent-terminal' — the "ask" outcome, reported with the same facts as an IDE prompt.`,
+        `function spoolEvent(rule,line,decision,developer){try{const ev=line.trim();const evidence=ev.length>180?ev.slice(0,180)+'...':ev;let reason='Shell guard: '+rule.reason;if(developer==='confirmed')reason='developer confirmed in terminal prompt — '+reason;else if(developer==='remembered')reason='developer confirmed earlier in this shell (session memory) — '+reason;else if(developer==='declined')reason='developer declined in terminal prompt — '+reason;else if(developer==='timeout')reason='developer confirmation not given (terminal prompt timed out) — '+reason;else if(developer==='ide')reason='developer confirmed in the IDE prompt (agent-driven terminal) — '+reason;else if(developer==='agent-terminal')reason='ask cannot be answered in an agent-driven terminal (no IDE confirmation) — '+reason;const event={eventId:crypto.randomUUID(),type:'verdict',decision,toolName:'shell_terminal',operation:'shell_command',reason,ruleId:rule.id,category:rule.category,severity:rule.severity,source:rule.source,evidence,occurredAt:new Date().toISOString()};if(developer){event.approvalScope='developer';if(developer==='confirmed'||developer==='remembered'||developer==='ide')event.approvedBy='developer';}fs.appendFileSync(SPOOL_PATH,JSON.stringify(event)+'\\n',{encoding:'utf8',mode:0o600});triggerFlush();}catch{}}`,
+        (0, agentTerminal_1.buildAgentTerminalJs)(),
         `let argv=process.argv.slice(2);`,
         `// --record <confirmed|remembered|declined|timeout> <ruleId> -- <line>: the shell answered an ask prompt; report it and exit.`,
         `if(argv[0]==='--record'){const kind=argv[1],ruleId=argv[2];let rest=argv.slice(3);if(rest[0]==='--')rest=rest.slice(1);const rline=rest.join(' ');try{const{rules}=loadRules();const rule=rules.find(r=>r.id===ruleId)||{id:ruleId,reason:'ask rule '+ruleId,category:'',severity:'',source:'builtin'};spoolEvent(rule,rline,(kind==='confirmed'||kind==='remembered')?'allow':'block',kind);}catch{}process.exit(0);}`,
@@ -187,6 +189,10 @@ function buildGuardJs(nodePath, cliEntry) {
         `if(mode==='monitor'){console.error('[FullCourtDefense] monitor: '+(hit.action==='ask'?'would ask you to confirm':'would block')+' ['+(hit.severity||'')+'] '+hit.reason+' (rule '+hit.id+')');spoolEvent(hit,line,'warn');process.exit(0);}`,
         `if(hit.action==='warn'){console.error('[FullCourtDefense] warning ['+(hit.severity||'')+']: '+hit.reason+' (rule '+hit.id+') — allowed by org policy, reported to your security dashboard.');spoolEvent(hit,line,'warn');process.exit(0);}`,
         `if(hit.action==='ask'){`,
+        `  if(agentTerminal()){`,
+        `    if(ideConfirmed(line,hit.id)){console.error('[FullCourtDefense] '+AGENT_IDE_CONFIRMED+' (rule '+hit.id+')');spoolEvent(hit,line,'allow','ide');process.exit(0);}`,
+        `    console.error('[FullCourtDefense] ASK ['+(hit.severity||'')+']: '+hit.reason+' (rule '+hit.id+') — '+AGENT_ASK_BLOCKED);console.error(unblockHint(hit));spoolEvent(hit,line,'block','agent-terminal');process.exit(BLOCK_CODE);`,
+        `  }`,
         `  // "s = remember for this shell": the shell exports FCD_SHELL_ASK_OK=<ruleId>,<ruleId>... — dies with the shell.`,
         `  const ok=String(process.env.FCD_SHELL_ASK_OK||'').split(',').map(s=>s.trim()).filter(Boolean);`,
         `  if(ok.includes(hit.id)){console.error('[FullCourtDefense] allowed — you confirmed rule '+hit.id+' earlier in this shell.');spoolEvent(hit,line,'allow','remembered');process.exit(0);}`,

package/dist/commands/shellGuard.js

@@ -58,6 +58,7 @@ const os = __importStar(require("os"));
 const path = __importStar(require("path"));
 const deterministicGuard_1 = require("./deterministicGuard");
 const notify_1 = require("../notify");
+const agentTerminal_1 = require("../agentTerminal");
 /**
  * Interactive PowerShell guard — real-time blocking of dangerous commands
  * TYPED by a human in a terminal (inside or outside the IDE).
@@ -637,6 +638,8 @@ function buildGuardPs1(nodePath, cliEntry) {
         `  } catch { }`,
         `}`,
         ``,
+        (0, agentTerminal_1.buildAgentTerminalPs)(),
+        ``,
         `# Rules + mode are (re)loaded whenever the rules file changes on disk, so a`,
         `# console change (rule -> Block, machine -> Protected) reaches THIS open`,
         `# window as soon as the daemon syncs it — same as cmd.exe and bash/zsh,`,
@@ -764,13 +767,15 @@ function buildGuardPs1(nodePath, cliEntry) {
         `  try {`,
         `    $evidence = $CommandLine.Trim()`,
         `    if ($evidence.Length -gt 180) { $evidence = $evidence.Substring(0, 180) + '...' }`,
-        `    # $Developer: '' (none) | 'confirmed' | 'remembered' | 'declined' | 'timeout'`,
+        `    # $Developer: '' (none) | 'confirmed' | 'remembered' | 'declined' | 'timeout' | 'ide' | 'agent-terminal'`,
         `    $reason = 'Shell guard: ' + $Rule.Reason`,
         `    switch ($Developer) {`,
         `      'confirmed'  { $reason = 'developer confirmed in terminal prompt — ' + $reason }`,
         `      'remembered' { $reason = 'developer confirmed earlier in this shell (session memory) — ' + $reason }`,
         `      'declined'   { $reason = 'developer declined in terminal prompt — ' + $reason }`,
         `      'timeout'    { $reason = 'developer confirmation not given (terminal prompt timed out) — ' + $reason }`,
+        `      'ide'        { $reason = 'developer confirmed in the IDE prompt (agent-driven terminal) — ' + $reason }`,
+        `      'agent-terminal' { $reason = 'ask cannot be answered in an agent-driven terminal (no IDE confirmation) — ' + $reason }`,
         `    }`,
         `    $event = [ordered]@{`,
         `      eventId    = [guid]::NewGuid().ToString()`,
@@ -788,7 +793,7 @@ function buildGuardPs1(nodePath, cliEntry) {
         `    }`,
         `    if ($Developer -ne '') {`,
         `      $event['approvalScope'] = 'developer'`,
-        `      if ($Developer -eq 'confirmed' -or $Developer -eq 'remembered') { $event['approvedBy'] = 'developer' }`,
+        `      if ($Developer -eq 'confirmed' -or $Developer -eq 'remembered' -or $Developer -eq 'ide') { $event['approvedBy'] = 'developer' }`,
         `    }`,
         `    $event = [pscustomobject]$event`,
         `    # BOM-free UTF8 append — PS5's Add-Content -Encoding utf8 writes a BOM that breaks JSONL parsing.`,
@@ -833,6 +838,26 @@ function buildGuardPs1(nodePath, cliEntry) {
         `      # reported to the fleet as a developer decision (same facts as the IDE`,
         `      # prompt). No answerable console => block, never a silent allow.`,
         `      if ($hit.Action -eq 'ask') {`,
+        `        if (Test-FcdAgentTerminal) {`,
+        `          # An AI agent drives this terminal: it would answer y/N itself, so nobody is asked here.`,
+        `          # Honor the developer's answer from the IDE prompt for this exact line; otherwise block.`,
+        `          if (Test-FcdIdeConfirmed -Line $line -RuleId ([string]$hit.Id)) {`,
+        `            Write-Host ''`,
+        `            Write-Host ('[FullCourtDefense] ' + $global:FcdAgentIdeConfirmed + ' (rule ' + $hit.Id + ')') -ForegroundColor DarkGray`,
+        `            try { [Microsoft.PowerShell.PSConsoleReadLine]::InvokePrompt() } catch { }`,
+        `            Write-FcdGuardEvent -Rule $hit -CommandLine $line -Decision 'allow' -Developer 'ide'`,
+        `            [Microsoft.PowerShell.PSConsoleReadLine]::AcceptLine()`,
+        `            return`,
+        `          }`,
+        `          [Microsoft.PowerShell.PSConsoleReadLine]::RevertLine()`,
+        `          Write-Host ''`,
+        `          Write-Host ('[FullCourtDefense] ASK [' + $hit.Severity + ']: ' + $hit.Reason + ' (rule ' + $hit.Id + ') — ' + $global:FcdAgentAskBlocked) -ForegroundColor Red`,
+        `          Write-FcdUnblockHint -Rule $hit`,
+        `          try { [Microsoft.PowerShell.PSConsoleReadLine]::InvokePrompt() } catch { }`,
+        `          Write-FcdGuardEvent -Rule $hit -CommandLine $line -Decision 'block' -Developer 'agent-terminal'`,
+        `          [Microsoft.PowerShell.PSConsoleReadLine]::AcceptLine()`,
+        `          return`,
+        `        }`,
         `        if (Test-FcdAskRemembered -RuleId ([string]$hit.Id)) {`,
         `          Write-Host ''`,
         `          Write-Host ('[FullCourtDefense] allowed — you confirmed rule ' + $hit.Id + ' earlier in this shell.') -ForegroundColor DarkGray`,

package/dist/fileWriteCanon.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Canonicalization of FILE WRITES before any policy decision.
+ *
+ * Clients ship a file edit in two shapes: a delta (Claude `Edit` old/new
+ * strings, Cursor `afterFileEdit` edits) or the WHOLE resulting file (Cursor's
+ * `Write`, MCP filesystem `write_file`, VS Code `createFile`). Judging the whole
+ * file as "tool arguments" means a credential-shaped literal that has sat in a
+ * test fixture for years blocks every edit of that file, in every policy that
+ * looks at `toolArgs.containsSecret` — and the verdict differs per client for
+ * the same developer action.
+ *
+ * `newContentOnly` reduces a whole-file write to the lines it ADDS relative to
+ * the file on disk, which is exactly what the delta shapes already carry. Every
+ * client then yields the identical canonical action `edit_file { path, content }`.
+ * Deterministic, reads only the target path, decides nothing.
+ */
+/** Largest on-disk file we diff against (bigger = treat all content as new). */
+export declare const DELTA_MAX_FILE_BYTES: number;
+export declare function canonicalToolName(toolName: string): string;
+/** What a re-stated word is replaced with — not credential-shaped, so no detector can fire on it. */
+export declare const UNCHANGED_TOKEN_MARK = "[unchanged]";
+/**
+ * Mask every credential-shaped word in `content` that ALREADY appears verbatim
+ * in the file being edited. An edit that re-states a value the file already
+ * holds (an existing test fixture, a documented example key, a checksum) adds
+ * no information to that file — it cannot be exfiltration into it — so the
+ * value must not become a `containsSecret` fact. A word that is NOT in the
+ * target file stays exactly as written and is judged as before. Pure.
+ */
+export declare function maskTokensAlreadyPresent(existing: string, content: string): string;
+/** Line-level delta: the lines `content` adds relative to `existing`. */
+export declare function addedLinesOnly(existing: string, content: string): string;
+/**
+ * Reduce a file write to what is NEW for the file on disk: first the lines it
+ * adds, then — inside those lines — mask credential-shaped words the file
+ * already contains. Whole-file shapes and delta shapes (old/new strings) both
+ * go through this, so every client yields the same canonical `content`.
+ */
+export declare function newContentOnly(filePath: string | undefined, content: string): string;
+/**
+ * For a whole-file write tool (MCP `write_file`, …) with `{ path, content }`
+ * arguments, replace `content` with only the added lines. Any other tool or
+ * shape is returned untouched (same object identity), so callers can apply it
+ * unconditionally.
+ */
+export declare function canonicalizeFileWriteArgs(toolName: string, args: Record<string, unknown>): Record<string, unknown>;