fullcourtdefense-cli 1.32.0 → 1.33.0

package/dist/actionPolicyEngine.js

@@ -1352,6 +1352,9 @@ function evaluateActionPolicies(policies, toolName, operation, context = {}, dec
     // A `block` from a policy marked `enforcement: 'hard'` — kept as a block even
     // where a human is present (see the workstation ceiling below).
     let hardBlock;
+    let requiredApproval;
+    let requiredApprovalResult;
+    const approvalObligations = [];
     for (const policy of policies) {
         // Org-scoped policies bind to attributed RUNTIME USERS — anonymous/system calls (no
         // developerName) are deliberately out of scope. Surfaced via skippedOrgPolicies so
@@ -1408,9 +1411,16 @@ function evaluateActionPolicies(policies, toolName, operation, context = {}, dec
                     reason: `${matched.reason} — recorded as a warning: this only touches a file on this machine and nothing leaves it (the same content leaving the machine still blocks; mark the policy Hard block to stop file edits too)`,
                 };
             }
+            if (matched.verdict === 'require_approval') {
+                approvalObligations.push(`${policy.id}:${matchedRule}`);
+                if (!requiredApprovalResult || rule.approval?.scope !== 'developer')
+                    requiredApprovalResult = matched;
+                const approval = resolveApprovalOptions(rule.approval);
+                requiredApproval = requiredApproval ? mergeApprovalOptions(requiredApproval, approval) : approval;
+            }
             if (rule.verdict === 'block' && policy.enforcement === 'hard' && !hardBlock)
                 hardBlock = matched;
-            if (verdictPriority[rule.verdict] > verdictPriority[worstResult.verdict]) {
+            if (verdictPriority[matched.verdict] > verdictPriority[worstResult.verdict]) {
                 worstResult = matched;
             }
             else if (rule.verdict === 'require_approval' && worstResult.verdict === 'require_approval') {
@@ -1441,12 +1451,18 @@ function evaluateActionPolicies(policies, toolName, operation, context = {}, dec
                 ...worstResult,
                 allowed: false,
                 verdict: 'require_approval',
-                approval: { ...exports.WORKSTATION_ASK_APPROVAL },
+                approval: requiredApproval ? mergeApprovalOptions(exports.WORKSTATION_ASK_APPROVAL, requiredApproval) : { ...exports.WORKSTATION_ASK_APPROVAL },
                 askedInsteadOfBlocked: true,
                 reason: `${worstResult.reason || `Action policy "${worstResult.policyName}" blocked`} — asks you on a workstation (the policy is not marked Hard block)`,
             };
         }
     }
+    if (worstResult.askedInsteadOfBlocked && requiredApproval?.scope === 'org' && requiredApprovalResult) {
+        worstResult = { ...requiredApprovalResult, approval: mergeApprovalOptions(exports.WORKSTATION_ASK_APPROVAL, requiredApproval) };
+    }
+    if (worstResult.verdict === 'require_approval' && approvalObligations.length > 1) {
+        worstResult = { ...worstResult, matchedRule: [...approvalObligations].sort().join('; ') };
+    }
     if (monitorMatches.length > 0) {
         worstResult = { ...worstResult, monitorMatches };
     }

package/dist/agentTerminal.d.ts

@@ -12,12 +12,12 @@ export declare function isAgentDrivenTerminal(env?: NodeJS.ProcessEnv): boolean;
 /** Shown (with the rule name) when an ask lands in an agent-driven terminal with no IDE answer behind it. */
 export declare const AGENT_TERMINAL_ASK_BLOCKED: string;
 /** Shown when the IDE prompt already answered for this exact command. */
-export declare const AGENT_TERMINAL_IDE_CONFIRMED = "allowed \u2014 the developer confirmed this exact command in the IDE prompt.";
+export declare const AGENT_TERMINAL_IDE_CONFIRMED = "allowed through the IDE permission gate; confirmation is recorded by the IDE post-execution hook.";
 /** Pending-marker key the IDE hook wrote for this shell command (see devConfirm.pendingKey). */
 export declare function ideShellPendingKey(command: string): string;
 /** Remembered-confirmation key for a Local Safety ask rule on the shell tool (see devConfirm rememberKey). */
 export declare function ideLocalSafetyRememberKey(ruleId: string): string;
-/** How long a pending IDE marker counts as "the developer just allowed this" (mirrors CONFIRM_PENDING_TTL_MS). */
+/** Maximum lifetime of an exact-command IDE permission handoff (not consent). */
 export declare const IDE_CONFIRMATION_WINDOW_MS: number;
 /**
  * Pure decision over a parsed dev-confirm ledger: did the IDE prompt already
@@ -25,6 +25,7 @@ export declare const IDE_CONFIRMATION_WINDOW_MS: number;
  * by the generated guard code below.
  */
 export declare function ideConfirmedFor(ledger: {
+    formatVersion?: number;
     pending?: Array<{
         key?: string;
         raisedAt?: string;
@@ -32,8 +33,10 @@ export declare function ideConfirmedFor(ledger: {
     remembered?: Array<{
         key?: string;
         expiresAt?: string;
+        remember?: string;
+        sessionId?: string;
     }>;
-} | undefined, command: string, ruleId: string, now?: number): boolean;
+} | undefined, command: string, ruleId: string, now?: number, sessionId?: string): boolean;
 /**
  * Node snippet for the cmd.exe guard and the POSIX checker. Defines
  * `agentTerminal()` and `ideConfirmed(line, ruleId)`; expects `fs`, `crypto`,

package/dist/agentTerminal.js

@@ -48,8 +48,8 @@ exports.buildAgentTerminalPs = buildAgentTerminalPs;
  * Claude Code's Bash tool, ...) the agent is the one that would type the
  * answer — so an ask there is not a control at all. Rule: in an agent-driven
  * terminal the guard never offers y/N. It honors the answer the developer
- * already gave in the IDE prompt for this exact command (the hook raised it a
- * moment ago and the IDE only runs the command after "Allow"), and otherwise
+ * gave in the IDE, or delegates an explicitly marked exact-command handoff
+ * to the IDE permission gate. Handoffs are never recorded as consent. Otherwise
  * blocks with a message that says where the question is answered.
  *
  * Pure: no I/O. The guards render these markers + keys into their generated
@@ -82,7 +82,7 @@ exports.AGENT_TERMINAL_ASK_BLOCKED = 'an AI agent is driving this terminal, so n
     'The developer answers Allow / Deny in the IDE prompt (the agent must run the command through the IDE hook), ' +
     'or runs it in their own terminal.';
 /** Shown when the IDE prompt already answered for this exact command. */
-exports.AGENT_TERMINAL_IDE_CONFIRMED = 'allowed — the developer confirmed this exact command in the IDE prompt.';
+exports.AGENT_TERMINAL_IDE_CONFIRMED = 'allowed through the IDE permission gate; confirmation is recorded by the IDE post-execution hook.';
 // ---------------------------------------------------------------------------
 // IDE-answer lookup keys. These MUST match devConfirm.ts: the hook raises a
 // pending marker keyed by sha256(`${event}|${tool}|${sha256('cmd:'+command)}`)
@@ -98,21 +98,20 @@ function ideShellPendingKey(command) {
 function ideLocalSafetyRememberKey(ruleId) {
     return sha256(`shell|local-safety:${ruleId}|${ruleId}`);
 }
-/** How long a pending IDE marker counts as "the developer just allowed this" (mirrors CONFIRM_PENDING_TTL_MS). */
+/** Maximum lifetime of an exact-command IDE permission handoff (not consent). */
 exports.IDE_CONFIRMATION_WINDOW_MS = 10 * 60_000;
 /**
  * Pure decision over a parsed dev-confirm ledger: did the IDE prompt already
  * answer for this command / rule? Used by the in-process tests and mirrored
  * by the generated guard code below.
  */
-function ideConfirmedFor(ledger, command, ruleId, now = Date.now()) {
-    if (!ledger)
+function ideConfirmedFor(ledger, command, ruleId, now = Date.now(), sessionId) {
+    if (!ledger || ledger.formatVersion !== 2)
         return false;
-    const pendingKey = ideShellPendingKey(command);
-    if ((ledger.pending || []).some(p => p?.key === pendingKey && typeof p.raisedAt === 'string' && now - Date.parse(p.raisedAt) < exports.IDE_CONFIRMATION_WINDOW_MS))
-        return true;
+    // A pending prompt is not an affirmative answer. IDE handoffs are handled
+    // separately by the generated guard, without claiming developer consent.
     const rememberKey = ideLocalSafetyRememberKey(ruleId);
-    return (ledger.remembered || []).some(r => r?.key === rememberKey && typeof r.expiresAt === 'string' && Date.parse(r.expiresAt) > now);
+    return (ledger.remembered || []).some(r => r?.key === rememberKey && typeof r.expiresAt === 'string' && Date.parse(r.expiresAt) > now && (r.remember === '1h' || (r.remember === 'session' && !!sessionId && r.sessionId === sessionId)));
 }
 // ---------------------------------------------------------------------------
 // Rendered snippets for the generated guards (single source of truth).
@@ -130,7 +129,7 @@ function buildAgentTerminalJs() {
         `function agentTerminal(){const e=process.env;return AGENT_MARKERS.some(m=>m.v!==undefined?e[m.n]===m.v:(typeof e[m.n]==='string'&&e[m.n].length>0));}`,
         `const IDE_WINDOW_MS=${exports.IDE_CONFIRMATION_WINDOW_MS};`,
         `function sha(s){return crypto.createHash('sha256').update(s).digest('hex');}`,
-        `function ideConfirmed(line,ruleId){try{const ledger=JSON.parse(fs.readFileSync(path.join(os.homedir(),'.fullcourtdefense','dev-confirm.json'),'utf8'));const now=Date.now();const pk=sha('shell|shell|'+sha('cmd:'+line.trim()));if((ledger.pending||[]).some(p=>p&&p.key===pk&&typeof p.raisedAt==='string'&&now-Date.parse(p.raisedAt)<IDE_WINDOW_MS))return true;const rk=sha('shell|local-safety:'+ruleId+'|'+ruleId);return (ledger.remembered||[]).some(r=>r&&r.key===rk&&typeof r.expiresAt==='string'&&Date.parse(r.expiresAt)>now);}catch{return false;}}`,
+        `function ideConfirmed(line,ruleId){try{const ledger=JSON.parse(fs.readFileSync(path.join(os.homedir(),'.fullcourtdefense','dev-confirm.json'),'utf8'));const now=Date.now();const pk=sha('shell|shell|'+sha('cmd:'+line.trim()));if((ledger.pending||[]).some(p=>p&&p.permissionHandoff===true&&p.key===pk&&typeof p.raisedAt==='string'&&now>=Date.parse(p.raisedAt)&&now-Date.parse(p.raisedAt)<IDE_WINDOW_MS))return true;if(ledger.formatVersion!==2)return false;const rk=sha('shell|local-safety:'+ruleId+'|'+ruleId);const session=process.env.FCD_SESSION_ID||process.env.CLAUDE_CODE_SESSION_ID||process.env.CODEX_THREAD_ID;return (ledger.remembered||[]).some(r=>r&&r.key===rk&&typeof r.expiresAt==='string'&&Date.parse(r.expiresAt)>now&&(r.remember==='1h'||(r.remember==='session'&&session&&r.sessionId===session)));}catch{return false;}}`,
         `const AGENT_ASK_BLOCKED=${JSON.stringify(exports.AGENT_TERMINAL_ASK_BLOCKED)};`,
         `const AGENT_IDE_CONFIRMED=${JSON.stringify(exports.AGENT_TERMINAL_IDE_CONFIRMED)};`,
     ].join('\n');
@@ -169,15 +168,19 @@ function buildAgentTerminalPs() {
         `    $now = [DateTimeOffset]::UtcNow`,
         `    $pk = Get-FcdSha256 ('shell|shell|' + (Get-FcdSha256 ('cmd:' + $Line.Trim())))`,
         `    foreach ($p in @($ledger.pending)) {`,
-        `      if ($null -ne $p -and $p.key -eq $pk -and $p.raisedAt) {`,
-        `        $age = $now - [DateTimeOffset]::Parse($p.raisedAt, [Globalization.CultureInfo]::InvariantCulture)`,
-        `        if ($age.TotalMilliseconds -lt ${exports.IDE_CONFIRMATION_WINDOW_MS}) { return $true }`,
+        `      if ($null -ne $p -and $p.permissionHandoff -eq $true -and $p.key -eq $pk -and $p.raisedAt) {`,
+        `        $raised = if ($p.raisedAt -is [DateTime]) { [DateTimeOffset]$p.raisedAt } else { [DateTimeOffset]::Parse([string]$p.raisedAt, [Globalization.CultureInfo]::InvariantCulture) }`,
+        `        $age = $now - $raised`,
+        `        if ($age.TotalMilliseconds -ge 0 -and $age.TotalMilliseconds -lt ${exports.IDE_CONFIRMATION_WINDOW_MS}) { return $true }`,
         `      }`,
         `    }`,
+        `    if ($ledger.formatVersion -ne 2) { return $false }`,
         `    $rk = Get-FcdSha256 ('shell|local-safety:' + $RuleId + '|' + $RuleId)`,
+        `    $session = $env:FCD_SESSION_ID; if (-not $session) { $session = $env:CLAUDE_CODE_SESSION_ID }; if (-not $session) { $session = $env:CODEX_THREAD_ID }`,
         `    foreach ($r in @($ledger.remembered)) {`,
-        `      if ($null -ne $r -and $r.key -eq $rk -and $r.expiresAt) {`,
-        `        if ([DateTimeOffset]::Parse($r.expiresAt, [Globalization.CultureInfo]::InvariantCulture) -gt $now) { return $true }`,
+        `      if ($null -ne $r -and $r.key -eq $rk -and $r.expiresAt -and ($r.remember -eq '1h' -or ($r.remember -eq 'session' -and $session -and $r.sessionId -eq $session))) {`,
+        `        $expiry = if ($r.expiresAt -is [DateTime]) { [DateTimeOffset]$r.expiresAt } else { [DateTimeOffset]::Parse([string]$r.expiresAt, [Globalization.CultureInfo]::InvariantCulture) }`,
+        `        if ($expiry -gt $now) { return $true }`,
         `      }`,
         `    }`,
         `  } catch { }`,

package/dist/commands/cmdGuard.js

@@ -160,12 +160,12 @@ function buildGuardJs(nodePath, cliEntry) {
         `// exec), $( ) substitution, or real backtick command substitution (>=2 chars; a 1-char pair is a PS escape).`,
         `function execView(line){if(/\\b(?:iex|invoke-expression|invoke-command)\\b|\\beval\\b|\\bxargs\\b|\\bbase64\\b[^\\n]*(?:-d\\b|--decode\\b)|frombase64string|-encodedcommand\\b|\\s-enc\\s|\\|\\s*&?\\s*(?:sh|bash|zsh|dash|ksh|csh|pwsh|powershell(?:\\.exe)?|cmd(?:\\.exe)?|node|python[0-9.]*|perl|ruby)\\b|\\b(?:sh|bash|zsh|dash|ksh|csh|pwsh|powershell(?:\\.exe)?|cmd(?:\\.exe)?|node|python[0-9.]*|perl|ruby)\\s+(?:-c|\\/c|-e|-command|-scriptblock)\\b|\\b(?:ssh|wsl(?:\\.exe)?|chroot)\\b|\\b(?:docker|kubectl|podman|nerdctl)(?:\\.exe)?\\s+(?:exec|run)\\b/i.test(line))return line;const K=/\\$\\(|\`[^\`]{2,}\`/;const C=/(?:(?:^|[;&|(]|\\s)(?:-c|\\/c|-e|-command|-scriptblock|-filter)[= ]\\s*|(?:^|[;&|(]\\s*)(?:\\S*[\\\\\\/])?(?:sudo\\s+|doas\\s+)?(?:ssh|wsl(?:\\.exe)?|chroot|su|screen|tmux)(?:\\s[^;&|"']*)?\\s|(?:\\S*[\\\\\\/])?(?:docker|kubectl|podman|nerdctl)(?:\\.exe)?\\s+(?:exec|run)\\b[^;&|"']*\\s)$/i;let o=line;o=o.replace(/@'[\\s\\S]*?'@/g,' fcd_inert_data ');o=o.replace(/@"[\\s\\S]*?"@/g,m=>m.includes('$(')?m:' fcd_inert_data ');o=o.replace(/<<-?\\s*'(\\w+)'[\\s\\S]*?(?:\\n\\1\\b|$)/g,' fcd_inert_data ');o=o.replace(/<<-?\\s*"?(\\w+)"?[\\s\\S]*?(?:\\n\\1\\b|$)/g,m=>K.test(m)?m:' fcd_inert_data ');const s=o;o=s.replace(/"((?:[^"\\\\]|\\\\.)*)"|'((?:[^'\\\\]|\\\\.)*)'/g,(w,dq,sq,i)=>{const b=dq!==undefined?dq:(sq||'');if(!/\\s/.test(b))return w;if(C.test(s.slice(Math.max(0,i-80),i)))return w;if(dq!==undefined&&K.test(b))return w;return ' fcd_inert_data ';});return o;}`,
         `// Precedence on one line: block outranks ask, ask outranks warn.`,
-        `function matchLine(line,rules){const n=line.replace(/\\s+/g,' ').trim();const x=execView(line);const xn=x.replace(/\\s+/g,' ').trim();let warnHit=null,askHit=null;for(const r of rules){try{const t=r.source==='custom'?line:x;const tn=r.source==='custom'?n:xn;if(r.re.test(tn)||r.re.test(t)){if(r.action==='block')return r;if(r.action==='ask'){if(!askHit)askHit=r;}else if(!warnHit)warnHit=r;}}catch{}}return askHit||warnHit;}`,
+        `function matchLine(line,rules){const n=line.replace(/\\s+/g,' ').trim();const x=execView(line);const xn=x.replace(/\\s+/g,' ').trim();let warnHit=null;const asks=[];for(const r of rules){try{const t=r.source==='custom'?line:x;const tn=r.source==='custom'?n:xn;if(r.re.test(tn)||r.re.test(t)){if(r.action==='block')return r;if(r.action==='ask'){asks.push(r);}else if(!warnHit)warnHit=r;}}catch{}}if(asks.length===1)return asks[0];if(asks.length>1){asks.sort((a,b)=>a.id<b.id?-1:a.id>b.id?1:0);return{...asks[0],id:'asks:'+asks.map(r=>encodeURIComponent(r.id)).join('+'),reason:asks.map(r=>r.reason).join('; ')}}return warnHit;}`,
         `// Flush is DETACHED (spawn+unref, matching the posix guard) — a spawnSync here`,
         `// made the user's terminal wait for a full CLI process INCLUDING the network`,
         `// flush after every finding. Monitor mode must never add synchronous latency.`,
         `// developer: '' | 'confirmed' | 'remembered' | 'declined' | 'timeout' | 'ide' | 'agent-terminal' — the "ask" outcome, reported with the same facts as an IDE prompt.`,
-        `function spoolEvent(rule,line,decision,developer){try{const ev=line.trim();const evidence=ev.length>180?ev.slice(0,180)+'...':ev;let reason='Shell guard: '+rule.reason;if(developer==='confirmed')reason='developer confirmed in terminal prompt — '+reason;else if(developer==='remembered')reason='developer confirmed earlier in this cmd window (session memory) — '+reason;else if(developer==='declined')reason='developer declined in terminal prompt — '+reason;else if(developer==='timeout')reason='developer confirmation not given (terminal prompt timed out) — '+reason;else if(developer==='ide')reason='developer confirmed in the IDE prompt (agent-driven terminal) — '+reason;else if(developer==='agent-terminal')reason='ask cannot be answered in an agent-driven terminal (no IDE confirmation) — '+reason;const event={eventId:crypto.randomUUID(),type:'verdict',decision,toolName:'cmd_terminal',operation:'shell_command',reason,ruleId:rule.id,category:rule.category,severity:rule.severity,source:rule.source,evidence,occurredAt:new Date().toISOString()};if(developer){event.approvalScope='developer';if(developer==='confirmed'||developer==='remembered'||developer==='ide')event.approvedBy='developer';}fs.appendFileSync(SPOOL_PATH,JSON.stringify(event)+'\\n',{encoding:'utf8',mode:0o600});if(fs.existsSync(NODE_PATH)&&fs.existsSync(CLI_ENTRY)){const c=spawn(NODE_PATH,[CLI_ENTRY,'flush-spool','--heartbeat','true'],{detached:true,stdio:'ignore',windowsHide:true});c.unref();}}catch{}}`,
+        `function spoolEvent(rule,line,decision,developer){try{const ev=line.trim();const evidence=ev.length>180?ev.slice(0,180)+'...':ev;let reason='Shell guard: '+rule.reason;if(developer==='confirmed')reason='developer confirmed in terminal prompt — '+reason;else if(developer==='remembered')reason='developer confirmed earlier in this cmd window (session memory) — '+reason;else if(developer==='declined')reason='developer declined in terminal prompt — '+reason;else if(developer==='timeout')reason='developer confirmation not given (terminal prompt timed out) — '+reason;else if(developer==='ide')reason='delegated to the IDE permission gate (confirmation recorded by post-hook) — '+reason;else if(developer==='agent-terminal')reason='ask cannot be answered in an agent-driven terminal (no IDE confirmation) — '+reason;const event={eventId:crypto.randomUUID(),type:'verdict',decision,toolName:'cmd_terminal',operation:'shell_command',reason,ruleId:rule.id,category:rule.category,severity:rule.severity,source:rule.source,evidence,occurredAt:new Date().toISOString()};if(developer){event.approvalScope='developer';if(developer==='confirmed'||developer==='remembered')event.approvedBy='developer';}fs.appendFileSync(SPOOL_PATH,JSON.stringify(event)+'\\n',{encoding:'utf8',mode:0o600});if(fs.existsSync(NODE_PATH)&&fs.existsSync(CLI_ENTRY)){const c=spawn(NODE_PATH,[CLI_ENTRY,'flush-spool','--heartbeat','true'],{detached:true,stdio:'ignore',windowsHide:true});c.unref();}}catch{}}`,
         `function askRemembered(ruleId){try{const m=JSON.parse(fs.readFileSync(ASK_MEMORY_PATH,'utf8'));const until=m&&m[ruleId];return typeof until==='number'&&until>Date.now();}catch{return false;}}`,
         `function rememberAsk(ruleId){try{let m={};try{m=JSON.parse(fs.readFileSync(ASK_MEMORY_PATH,'utf8'))||{};}catch{}m[ruleId]=Date.now()+ASK_REMEMBER_MS;fs.mkdirSync(path.dirname(ASK_MEMORY_PATH),{recursive:true});fs.writeFileSync(ASK_MEMORY_PATH,JSON.stringify(m),{encoding:'utf8',mode:0o600});}catch{}}`,
         (0, agentTerminal_1.buildAgentTerminalJs)(),

package/dist/commands/deterministicGuard.d.ts

@@ -134,6 +134,8 @@ export interface DeterministicScanOutcome {
      * events, shell wrappers, no human present) treats it exactly as a block.
      */
     askFinding?: DeterministicFinding;
+    /** Every matching approval obligation, retained for diagnostics and tests. */
+    askFindings?: DeterministicFinding[];
     /** warn-action findings that matched — the action proceeds; report these. */
     warnings: DeterministicFinding[];
 }

package/dist/commands/deterministicGuard.js

@@ -1259,17 +1259,30 @@ function findingAction(finding) {
  */
 function resolveDeterministicOutcome(scan, options) {
     const warnings = [];
-    let askFinding;
+    const askFindings = [];
+    const result = () => {
+        if (!askFindings.length)
+            return { warnings };
+        const ordered = [...askFindings].sort((a, b) => a.ruleId.localeCompare(b.ruleId));
+        // Bind memory to every matching rule. One dialog describes the full set.
+        const askFinding = ordered.length === 1 ? ordered[0] : {
+            ...ordered[0],
+            itemId: ordered.map(f => f.itemId).join('+'),
+            ruleId: ordered.map(f => f.ruleId).join('+'),
+            reason: ordered.map(f => `${f.itemId}: ${f.reason}`).join('; '),
+        };
+        return { askFinding, askFindings, warnings };
+    };
     let current = options;
     for (let pass = 0; pass < MAX_ACTION_PASSES; pass++) {
         const finding = scan(current);
         if (!finding)
-            return askFinding ? { askFinding, warnings } : { warnings };
+            return result();
         const action = findingAction(finding);
         if (action === 'warn')
             warnings.push(finding);
         else if (action === 'ask')
-            askFinding = askFinding || finding;
+            askFindings.push(finding);
         else
             return { blockingFinding: finding, warnings };
         current = withRuleSuppressed(current, finding);
@@ -1278,7 +1291,7 @@ function resolveDeterministicOutcome(scan, options) {
     const last = scan(current);
     if (last)
         return { blockingFinding: last, warnings };
-    return askFinding ? { askFinding, warnings } : { warnings };
+    return result();
 }
 /**
  * Resolve a TOOL RESPONSE under per-rule actions. The response is the one

package/dist/commands/hook.js

@@ -681,7 +681,7 @@ function prepareDeveloperConfirmation(event, call, payload, source) {
             offlineEnforced: true,
         });
     }
-    const remembered = (0, devConfirm_1.isConfirmationRemembered)({ toolName: call.toolName, operation, policyId: source.policyId, matchedRule: source.matchedRule }, sessId);
+    const remembered = source.remember === 'none' ? undefined : (0, devConfirm_1.isConfirmationRemembered)({ toolName: call.toolName, operation, policyId: source.policyId, matchedRule: source.matchedRule }, sessId);
     if (remembered) {
         (0, hookIo_1.dbg)({ phase: 'dev_confirm_remembered', event, tool: call.toolName, operation, remember: remembered.remember, where: source.where });
         spoolCallEvent(call, {
@@ -704,6 +704,7 @@ function prepareDeveloperConfirmation(event, call, payload, source) {
         matchedRule: source.matchedRule,
         sessionId: sessId,
         remember: source.remember,
+        permissionHandoff: event === 'shell',
     });
     (0, hookIo_1.dbg)({ phase: 'dev_confirm_ask', event, tool: call.toolName, operation, key: marker.key, remember: source.remember, where: source.where });
     spoolCallEvent(call, {
@@ -1090,7 +1091,7 @@ async function evaluateHookRequest(args, stdinRaw, config) {
         // Same contract as the process-level wrapper, including the kill-switch
         // exception: a crash during daemon-side evaluation must not unlock a
         // suspended machine.
-        const outcome = failOpenOutcome(args.event, `${message} (daemon eval)`);
+        const outcome = failOpenOutcome(args.event, `${message} (daemon eval)`, args, config);
         return { stdout: outcome.stdout, stderr: '', exitCode: outcome.exitCode };
     }
 }
@@ -1152,7 +1153,7 @@ async function hookCommandOuter(args, config, startedAt) {
     }
     catch (err) {
         const message = err instanceof Error ? err.message : String(err);
-        const outcome = failOpenOutcome(args.event, message);
+        const outcome = failOpenOutcome(args.event, message, args, config);
         try {
             process.stdout.write(outcome.stdout);
         }
@@ -1167,9 +1168,10 @@ async function hookCommandOuter(args, config, startedAt) {
  * not become a way to bypass an administrator's suspension — a crash (induced
  * or accidental) on a suspended machine would otherwise unlock every agent
  * action. So the catch handlers consult the local cache directly: suspended
- * machines still deny, everything else still fails open silently.
+ * machines still deny. An enforcing Shield with fail-closed also denies
+ * evaluation failures; Monitor and fail-open configurations continue.
  */
-function failOpenOutcome(event, message) {
+function failOpenOutcome(event, message, args, config) {
     const toolName = event || 'unknown';
     // Label the spooled event below as a crash-allow: a rising fail_open rate is
     // the fleet's earliest signal that the guard itself is broken on a machine.
@@ -1182,18 +1184,20 @@ function failOpenOutcome(event, message) {
         suspended = (0, runtimeConfig_1.isSuspendedByCache)();
     }
     catch { /* never throw */ }
+    const state = (0, runtimeConfig_1.cachedEnforcementState)(args?.shieldId || config?.shieldId || process.env.FCD_SHIELD_ID || process.env.FULLCOURTDEFENSE_SHIELD_ID);
+    const denyForError = state.mode === 'block' && (args?.failClosed !== undefined ? args.failClosed === 'true' : state.failClosed) && !(args?.shadow === 'true' && args?.fcdManaged !== 'true');
     try {
         (0, hookIo_1.dbg)({ phase: 'hook_fail_open', event, error: message, suspended });
     }
     catch { /* never throw */ }
     try {
         (0, telemetry_1.spoolEvent)({
-            decision: suspended ? 'block' : 'allow',
+            decision: suspended || denyForError ? 'block' : 'allow',
             toolName,
             operation: `${toolName}:hook_error`,
             reason: suspended
                 ? `Hook error on a SUSPENDED machine — denied (kill-switch holds): ${message.slice(0, 200)}`
-                : `Hook error failed open: ${message.slice(0, 200)}`,
+                : `${denyForError ? 'fail-closed: hook evaluation failed' : 'Hook error failed open'}: ${message.slice(0, 200)}`,
             offlineEnforced: true,
             ...(suspended ? { severity: 'critical', source: 'backend' } : {}),
         });
@@ -1211,6 +1215,12 @@ function failOpenOutcome(event, message) {
             exitCode: 0,
         };
     }
+    if (denyForError) {
+        const reason = 'FullCourtDefense could not verify this action. Your administrator enabled fail-closed. Retry after policy checking recovers.';
+        return { stdout: JSON.stringify({ continue: false, permission: 'deny', user_message: reason,
+                permissionDecision: 'deny', permissionDecisionReason: reason,
+                hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'deny', permissionDecisionReason: reason } }) + '\n', exitCode: 0 };
+    }
     // `continue` is the Cursor prompt shape, `permission` the Cursor action
     // shape; Claude-format clients ignore unknown keys and treat the absence
     // of a decision as allow.
@@ -1272,8 +1282,8 @@ async function hookCommandInner(args, config, io) {
     // machine applies it on the next poll. Cached locally (stale-while-error), so
     // this is instant when fresh and bounded (~1.5s) only when stale.
     let machineSuspended = false;
-    let modeResolved = false; // add this line
-    if (!forceMonitor && !forceEnforce && shieldId) {
+    let modeResolved = false;
+    if (shieldId) {
         try {
             const bundle = await (0, runtimeConfig_1.getRuntimeBundle)({ apiUrl, shieldId, shieldKey, developerName: developerId(), machineName: os.hostname(), hotPath: true });
             // Kill-switch holds even on a 'default' bundle: with the cache missing
@@ -1285,8 +1295,8 @@ async function hookCommandInner(args, config, io) {
                 shadow = false;
             }
             if (bundle.source !== 'default') {
-                shadow = bundle.mode !== 'block'; // 'monitor'/'shadow' => report-only
-                modeResolved = true; // add this line
+                shadow = forceMonitor || bundle.mode !== 'block'; // A known Shield Monitor mode cannot be overridden locally.
+                modeResolved = true;
                 effectivePolicyHash = bundle.policyHash || bundle.version;
                 // Cached org policies: hash-covered by the bundle ETag, evaluated
                 // locally when the policy gate is unreachable (offline enforcement).
@@ -1308,7 +1318,7 @@ async function hookCommandInner(args, config, io) {
         shadow = true;
         (0, hookIo_1.dbg)({ phase: 'mode_default_monitor_first', shadow });
     }
-    if (forceEnforce)
+    if (forceEnforce && !modeResolved)
         shadow = false;
     // Keep device liveness fresh during active use (throttled, detached — never blocks).
     if (shieldId)
@@ -1422,6 +1432,10 @@ async function hookCommandInner(args, config, io) {
             }
             else if (denied || ask) {
                 decision = {
+                    // Copilot CLI reads the top-level decision; Claude Code and VS Code
+                    // read hookSpecificOutput. Emit the same verdict in both contracts.
+                    permissionDecision: ask ? 'ask' : 'deny',
+                    permissionDecisionReason: userMsg || agentMsg || 'FullCourtDefense policy decision.',
                     hookSpecificOutput: {
                         hookEventName: 'PreToolUse',
                         permissionDecision: ask ? 'ask' : 'deny',

package/dist/commands/installAll.js

@@ -53,8 +53,8 @@ async function installAllCommand(args, config) {
         catch (error) {
             console.log(`Cursor hooks skipped: ${error instanceof Error ? error.message : String(error)}`);
         }
-        // ONE Claude-format hook file (~/.claude/settings.json) covers Claude Code,
-        // VS Code Copilot agent mode, and GitHub Copilot CLI.
+        // Claude/VS Code share Claude settings; Copilot CLI receives separate
+        // user tool hooks from the same installer.
         console.log('\n\x1b[1mInstalling Claude Code / VS Code / Copilot CLI runtime hooks…\x1b[0m');
         const claudeHookArgs = {
             shieldId: creds.shieldId,

package/dist/commands/installClaudeHook.d.ts

@@ -3,14 +3,14 @@ import { BotGuardConfig } from '../config';
  * `fullcourtdefense install-claude-hook` — Claude-format hook installer.
  *
  * Writes PreToolUse + UserPromptSubmit hooks into ~/.claude/settings.json.
- * That ONE file is read by THREE clients:
+ * That file is read by:
  *   - Claude Code (CLI + desktop)
  *   - VS Code Copilot agent mode (user-scope Claude-format hooks)
- *   - GitHub Copilot CLI
+ * Copilot CLI additionally receives user hooks in ~/.copilot/settings.json.
  *
  * The hook command is the same `fullcourtdefense hook` bridge used for Cursor —
  * it detects the Claude payload format from stdin (`hook_event_name`), so no
- * per-client configuration is needed. VS Code ignores `matcher` values (hooks
+ * payload adapter is needed for those PascalCase hooks. VS Code ignores `matcher` values (hooks
  * run on every tool), so the bridge self-filters by tool name and returns an
  * empty verdict for tools we don't police.
  */

package/dist/commands/installClaudeHook.js

@@ -189,7 +189,43 @@ function repairClaudeManagedHooks() {
         fs.mkdirSync(path.dirname(before.file), { recursive: true });
         fs.writeFileSync(before.file, JSON.stringify(settings, null, 2) + '\n', 'utf8');
     }
-    return { ...before, changed };
+    const copilotChanged = syncCopilotToolHooks(buildHookCommand({ shadow: false, failClosed: false }));
+    return { ...before, changed: changed || copilotChanged };
+}
+/** Copilot CLI user settings are separate from Claude's global settings.
+ * Use inline settings, not ~/.copilot/hooks, which VS Code also loads and
+ * would therefore execute twice alongside its Claude hook.
+ */
+function syncCopilotToolHooks(command) {
+    const root = process.env.COPILOT_HOME || path.join(os.homedir(), '.copilot');
+    const file = path.join(root, 'settings.json');
+    if (!command && !fs.existsSync(file))
+        return false;
+    // Preserve user settings: malformed existing JSON must never be overwritten.
+    const settings = fs.existsSync(file) ? JSON.parse(fs.readFileSync(file, 'utf8')) : {};
+    if (!settings || typeof settings !== 'object' || Array.isArray(settings))
+        throw new Error(`Invalid Copilot settings: ${file}`);
+    const before = JSON.stringify(settings);
+    const hooks = settings.hooks && typeof settings.hooks === 'object' ? settings.hooks : {};
+    for (const event of ['PreToolUse', 'PostToolUse']) {
+        const entries = Array.isArray(hooks[event]) ? hooks[event] : [];
+        const kept = entries.filter(entry => !isManagedCommand(entry));
+        if (command)
+            kept.push({ type: 'command', command, timeoutSec: event === 'PreToolUse' ? TOOL_HOOK_TIMEOUT_SEC : POST_TOOL_HOOK_TIMEOUT_SEC });
+        if (kept.length)
+            hooks[event] = kept;
+        else
+            delete hooks[event];
+    }
+    if (Object.keys(hooks).length)
+        settings.hooks = hooks;
+    else
+        delete settings.hooks;
+    if (before === JSON.stringify(settings))
+        return false;
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    fs.writeFileSync(file, JSON.stringify(settings, null, 2) + '\n', 'utf8');
+    return true;
 }
 // PostToolUse companion of PreToolUse: enforces nothing; it is how a developer's
 // Allow on the client's own `ask` prompt (developer-scoped approval) is learned.
@@ -290,11 +326,13 @@ async function installClaudeHookCommand(args, config) {
     }
     fs.mkdirSync(path.dirname(file), { recursive: true });
     fs.writeFileSync(file, JSON.stringify(settings, null, 2) + '\n', 'utf8');
+    if (!projectScope)
+        syncCopilotToolHooks(wantTools ? command : undefined);
     console.log('');
     console.log(`${COLOR.green}${COLOR.bold}FullCourtDefense Claude-format hook installed.${COLOR.reset}`);
     console.log(`${COLOR.gray}Scope:${COLOR.reset} ${projectScope ? 'project (.claude/settings.json)' : 'machine-wide (~/.claude/settings.json)'}`);
     console.log(`${COLOR.gray}File:${COLOR.reset}  ${file}`);
-    console.log(`${COLOR.gray}Covers:${COLOR.reset} Claude Code, VS Code Copilot agent mode, GitHub Copilot CLI (all read this file)`);
+    console.log(`${COLOR.gray}Covers:${COLOR.reset} Claude Code and VS Code Copilot; Copilot CLI tool hooks use ${projectScope ? 'this project configuration' : 'separate user settings in .copilot/settings.json'}.`);
     console.log(`${COLOR.gray}Note:${COLOR.reset} Claude Desktop's regular chat has no hook — it is protected separately by the Windows chat guard the daemon runs (advisory).`);
     const parts = [];
     if (wantTools)
@@ -318,6 +356,8 @@ async function installClaudeHookCommand(args, config) {
 }
 async function uninstallClaudeHookCommand(args) {
     const projectScope = args.project === 'true';
+    if (!projectScope)
+        syncCopilotToolHooks();
     const file = settingsPath(projectScope);
     if (!fs.existsSync(file)) {
         console.log(`${COLOR.yellow}No settings.json found at ${file}. Nothing to remove.${COLOR.reset}`);

package/dist/commands/mcpGateway.js

@@ -1109,6 +1109,8 @@ class McpGatewayServer {
         let downstreamResult;
         let downstreamAttempted = false;
         let downstreamRan = false;
+        let reportOnlyMode = true;
+        let policyWarning;
         try {
             // The runtime bundle carries the org's current Local Safety policy hash —
             // passing it as `expectedPolicyHash` makes a console policy edit take
@@ -1123,7 +1125,7 @@ class McpGatewayServer {
             let cachedPolicies;
             // Monitor unless a server/cache bundle explicitly says 'block': a machine
             // with no signal (fresh install + offline, wiped cache) must never block.
-            let reportOnlyMode = true;
+            reportOnlyMode = true;
             let machineRole;
             try {
                 const bundle = await (0, runtimeConfig_1.getRuntimeBundle)({
@@ -1183,6 +1185,10 @@ class McpGatewayServer {
                 expectedPolicyHash,
                 preferCached: reportOnlyMode,
             });
+            if (reportOnlyMode && snapshot) {
+                snapshot.itemActions = Object.fromEntries(Object.entries(snapshot.itemActions || {}).map(([id, action]) => [id, action === 'mask' ? 'warn' : action]));
+                snapshot.customBlocks = snapshot.customBlocks.map(rule => rule.action === 'mask' ? { ...rule, action: 'warn' } : rule);
+            }
             const requestOutcome = (0, deterministicGuard_1.resolveDeterministicOutcome)(opts => (0, deterministicGuard_1.scanDeterministicToolCall)(toolName, toolArgs, opts), (0, localSafetySnapshot_1.snapshotToScanOptions)(snapshot));
             for (const warning of requestOutcome.warnings) {
                 this.spoolLocalFinding(warning, toolName, operation, 'warn');
@@ -1238,7 +1244,7 @@ class McpGatewayServer {
                         localBlock = undefined;
                     }
                     else {
-                        (0, devConfirm_1.settleDeveloperConfirmation)('mcp_gateway', toolName, digest);
+                        (0, devConfirm_1.rejectDeveloperConfirmation)('mcp_gateway', toolName, digest);
                         const how = answer.answer === 'timeout' ? 'developer confirmation not given (prompt timed out)' : 'developer declined in MCP client prompt';
                         (0, telemetry_1.spoolEvent)({
                             decision: 'block', toolName, operation: rememberScope.operation,
@@ -1311,8 +1317,8 @@ class McpGatewayServer {
                 // MONITOR CONTRACT (latency half): a monitor/no-signal machine makes
                 // ZERO synchronous network calls. The verdict is always allow; the
                 // "would block" signal comes from the locally cached policy bundle,
-                // and the console report is fired without awaiting (server records the
-                // action and its own verdict; failures spool for the next flush).
+                // and the console report uses the audit spool. checkToolCall is an
+                // enforcing endpoint: even an unawaited request can open approvals.
                 const inferred = (0, actionPolicyEngine_1.inferToolContext)(toolName, toolArgs);
                 const localOperation = operation || inferred.operation;
                 if (cachedPolicies && cachedPolicies.length > 0) {
@@ -1333,22 +1339,8 @@ class McpGatewayServer {
                         process.stderr.write(`FullCourtDefense (monitor) would ${wouldWhat} ${toolName}: ${local.reason || local.verdict}\n`);
                     }
                 }
-                // PROXY RESILIENCE: while the gate is in its recently-down window
-                // (bank proxy, backend outage) don't even fire the async report —
-                // spool straight to disk; the flush child delivers it when the
-                // network returns. Zero network churn per call during an outage.
-                if ((0, policyGateHealth_1.gateRecentlyDown)()) {
-                    (0, telemetry_1.spoolEvent)({ decision: 'allow', toolName, operation: localOperation, reason: 'monitor: action recorded locally (gate recently unreachable)', offlineEnforced: true });
-                    (0, telemetry_1.triggerFlush)(false);
-                }
-                else {
-                    void this.api.checkToolCall({ toolName, operation, toolArgs }, 1_500)
-                        .then(() => (0, policyGateHealth_1.recordGateSuccess)())
-                        .catch(() => {
-                        (0, telemetry_1.spoolEvent)({ decision: 'allow', toolName, operation: localOperation, reason: 'monitor: action recorded locally (console unreachable)', offlineEnforced: true });
-                        (0, telemetry_1.triggerFlush)(false);
-                    });
-                }
+                (0, telemetry_1.spoolEvent)({ decision: 'allow', toolName, operation: localOperation, reason: 'monitor: action allowed and recorded without requesting approval' });
+                (0, telemetry_1.triggerFlush)(false);
                 preflight = { allowed: true, decision: 'allow', operation: localOperation };
             }
             else if (cachedPolicies && cachedPolicies.length > 0) {
@@ -1388,6 +1380,8 @@ class McpGatewayServer {
                     // "Warn only": the call runs, the fleet records Warned (not a silent
                     // allow). Final verdict — no gate round trip; the audit rides the spool.
                     const reason = local.reason || `${toolName}: flagged by org Action Policy`;
+                    policyWarning = reason;
+                    process.stderr.write(`FullCourtDefense warning: ${reason}\n`);
                     (0, telemetry_1.spoolEvent)({ decision: 'warn', toolName, operation: localOperation, reason: `policy warn (local-first): ${reason}`, ruleId: local.policyName ? `action-policy:${local.policyName}` : undefined, offlineEnforced: true });
                     (0, telemetry_1.triggerFlush)(false);
                     preflight = { allowed: true, decision: 'allow', operation: localOperation };
@@ -1470,9 +1464,9 @@ class McpGatewayServer {
                         process.stderr.write(`FullCourtDefense offline: policy service unreachable (${detail}); ${toolName} checked against locally cached org policies → ${blocking ? `${local.verdict} (report-only)` : 'allow'}.\n`);
                         preflight = { allowed: true, decision: 'allow', operation: localOperation };
                     }
-                    else if (this.gatewayConfig.failClosed && (!reportOnlyMode || this.gatewayConfig.failClosedExplicit)) {
+                    else if (this.gatewayConfig.failClosed && !reportOnlyMode) {
                         // Fail-closed only bites when the machine is actually in block mode
-                        // (or the operator passed --fail-closed explicitly at install time).
+                        // An explicit --fail-closed flag never overrides Shield Monitor.
                         // A monitor machine must never hard-block — not even during an
                         // outage with a bundle-supplied failClosed=true left over.
                         (0, telemetry_1.spoolEvent)({ decision: 'block', toolName, operation, reason: `fail-closed: ${detail}`, offlineEnforced: true });
@@ -1575,13 +1569,13 @@ class McpGatewayServer {
                 }
             }
             if (responseOutcome.maskFindings.length > 0) {
-                // mask-action rules: redact the matched secrets in place. Masking is
-                // monitor-compatible (a redaction is not a block), so it applies in
-                // every mode. If the result shape cannot be rewritten (secret hidden
+                // Enforcing mask-action rules redact matched secrets in place.
+                // Monitor snapshots downgrade mask to warn before evaluation.
+                // If the result shape cannot be rewritten (secret hidden
                 // in a non-text payload), fail strict and block — a mask rule must
                 // never leak what it was set to hide — except under monitor, where
                 // the contract is observe-only: record the would-block and pass the
-                // response through with whatever partial masking was possible.
+                // original response through.
                 const { masked, fullyMasked } = maskToolResult(rawResult, responseOutcome.maskFindings);
                 if (!fullyMasked) {
                     const finding = responseOutcome.maskFindings[0];
@@ -1642,10 +1636,11 @@ class McpGatewayServer {
             let finalResult = rawResult;
             if (effectiveScanResponse) {
                 try {
-                    finalResult = await this.api.scanToolResponse({ toolName, operation, toolArgs, result: rawResult });
+                    const scannedResult = await this.api.scanToolResponse({ toolName, operation, toolArgs, result: rawResult });
+                    finalResult = reportOnlyMode ? rawResult : scannedResult;
                 }
                 catch (scanErr) {
-                    if (isBlockError(scanErr))
+                    if (isBlockError(scanErr) && !reportOnlyMode)
                         throw scanErr; // Shield verdict — a real block
                     // Scan API/infra failure. On an ENFORCING machine, returning the raw
                     // response would silently skip the org's exfil scan — that is a
@@ -1656,7 +1651,7 @@ class McpGatewayServer {
                         (0, telemetry_1.triggerFlush)(true);
                         throw blockError(`FullCourtDefense could not scan the ${toolName} response (${detail}) and this machine enforces response scanning — response withheld. Retry once the scan service is reachable.`);
                     }
-                    (0, telemetry_1.spoolEvent)({ decision: 'warn', toolName, operation, reason: `[monitor] response scan unavailable: ${detail.slice(0, 200)}`, offlineEnforced: true });
+                    (0, telemetry_1.spoolEvent)({ decision: 'warn', toolName, operation, reason: `[monitor] ${isBlockError(scanErr) ? 'response would be blocked' : 'response scan unavailable'}: ${detail.slice(0, 200)}`, offlineEnforced: true });
                     (0, telemetry_1.triggerFlush)(false);
                     process.stderr.write(`FullCourtDefense (monitor): response scan unavailable for ${toolName} (${detail}) — response passed through.\n`);
                     finalResult = rawResult;
@@ -1678,6 +1673,10 @@ class McpGatewayServer {
                     (0, telemetry_1.triggerFlush)(false);
                 });
             }
+            if (policyWarning && finalResult && typeof finalResult === 'object') {
+                const result = finalResult;
+                finalResult = { ...result, content: [...(Array.isArray(result.content) ? result.content : []), { type: 'text', text: `FullCourtDefense warning: ${policyWarning}` }] };
+            }
             return finalResult;
         }
         catch (error) {
@@ -1713,6 +1712,14 @@ class McpGatewayServer {
                     content: [{ type: 'text', text: 'This machine is suspended by your security team — all AI agent actions are blocked. Contact your admin to resume it.' }],
                 };
             }
+            if (!isBlockError(error) && !downstreamAttempted && !reportOnlyMode && this.gatewayConfig.failClosed) {
+                try {
+                    (0, telemetry_1.spoolEvent)({ decision: 'block', toolName, operation, reason: `fail-closed: gateway evaluation failed: ${message.slice(0, 200)}`, offlineEnforced: true });
+                    (0, telemetry_1.triggerFlush)(true);
+                }
+                catch { /* preserve the configured decision even when telemetry fails */ }
+                return { isError: true, blocked: true, content: [{ type: 'text', text: 'FullCourtDefense could not verify this action. Your administrator enabled fail-closed. Retry after policy checking recovers.' }] };
+            }
             if (!isBlockError(error) && downstreamRan) {
                 // Post-call scan bug: the tool already succeeded — return its result.
                 try {
@@ -1807,7 +1814,7 @@ class McpGatewayServer {
         const sessionId = runtimeSessionId() || this.gatewaySessionId;
         const policyLabel = verdict.policyName ? ` (${verdict.policyName})` : '';
         const ruleId = verdict.policyName ? `action-policy:${verdict.policyName}` : undefined;
-        const remembered = (0, devConfirm_1.isConfirmationRemembered)(rememberScope, sessionId);
+        const remembered = verdict.approval?.remember === 'none' ? undefined : (0, devConfirm_1.isConfirmationRemembered)(rememberScope, sessionId);
         if (remembered) {
             (0, telemetry_1.spoolEvent)({
                 decision: 'allow', toolName, operation,
@@ -1837,11 +1844,11 @@ class McpGatewayServer {
         const answer = await this.elicitDeveloperConfirmation({
             toolName,
             reason: `${verdict.reason || `${toolName} needs your confirmation`}.${ceiling}`,
+            allowRemember: false,
             ruleLabel: verdict.policyName ? `Action Policy "${verdict.policyName}"${verdict.matchedRule ? ` — ${verdict.matchedRule}` : ''}` : 'Action Policy',
         });
         if (answer.answer === 'accept') {
-            if (answer.remember && remember === 'none')
-                (0, devConfirm_1.raiseDeveloperConfirmation)({ ...marker, remember: 'session' });
+            // Policy memory limits are authoritative; a client cannot upgrade 'none'.
             (0, devConfirm_1.settleDeveloperConfirmation)('mcp_gateway', toolName, digest);
             (0, telemetry_1.spoolEvent)({
                 decision: 'allow', toolName, operation,
@@ -1851,7 +1858,7 @@ class McpGatewayServer {
             (0, telemetry_1.triggerFlush)(false);
             return true;
         }
-        (0, devConfirm_1.settleDeveloperConfirmation)('mcp_gateway', toolName, digest);
+        (0, devConfirm_1.rejectDeveloperConfirmation)('mcp_gateway', toolName, digest);
         const how = answer.answer === 'timeout' ? 'developer confirmation not given (prompt timed out)' : 'developer declined in MCP client prompt';
         (0, telemetry_1.spoolEvent)({
             decision: 'block', toolName, operation,
@@ -1875,12 +1882,12 @@ class McpGatewayServer {
                         description: 'Yes runs the tool call once. No (or closing this dialog) does not run it.',
                         default: false,
                     },
-                    remember: {
-                        type: 'boolean',
-                        title: 'Remember for this session',
-                        description: 'Do not ask again for this tool and rule until this MCP session ends (max 12 hours).',
-                        default: false,
-                    },
+                    ...(input.allowRemember === false ? {} : { remember: {
+                            type: 'boolean',
+                            title: 'Remember for this session',
+                            description: 'Do not ask again for this tool and rule until this MCP session ends (max 12 hours).',
+                            default: false,
+                        } }),
                 },
                 required: ['confirm'],
             },
@@ -1891,7 +1898,7 @@ class McpGatewayServer {
         const result = (response.result && typeof response.result === 'object') ? response.result : undefined;
         const content = (result?.content && typeof result.content === 'object') ? result.content : undefined;
         if (result?.action === 'accept' && content?.confirm === true) {
-            return { answer: 'accept', remember: content.remember === true, latencyMs };
+            return { answer: 'accept', remember: input.allowRemember !== false && content.remember === true, latencyMs };
         }
         return { answer: 'decline', remember: false, latencyMs };
     }

package/dist/commands/posixShellGuard.js

@@ -173,10 +173,10 @@ function buildGuardJs(nodePath, cliEntry) {
         `// exec), $( ) substitution, or real backtick command substitution (>=2 chars; a 1-char pair is a PS escape).`,
         `function execView(line){if(/\\b(?:iex|invoke-expression|invoke-command)\\b|\\beval\\b|\\bxargs\\b|\\bbase64\\b[^\\n]*(?:-d\\b|--decode\\b)|frombase64string|-encodedcommand\\b|\\s-enc\\s|\\|\\s*&?\\s*(?:sh|bash|zsh|dash|ksh|csh|pwsh|powershell(?:\\.exe)?|cmd(?:\\.exe)?|node|python[0-9.]*|perl|ruby)\\b|\\b(?:sh|bash|zsh|dash|ksh|csh|pwsh|powershell(?:\\.exe)?|cmd(?:\\.exe)?|node|python[0-9.]*|perl|ruby)\\s+(?:-c|\\/c|-e|-command|-scriptblock)\\b|\\b(?:ssh|wsl(?:\\.exe)?|chroot)\\b|\\b(?:docker|kubectl|podman|nerdctl)(?:\\.exe)?\\s+(?:exec|run)\\b/i.test(line))return line;const K=/\\$\\(|\`[^\`]{2,}\`/;const C=/(?:(?:^|[;&|(]|\\s)(?:-c|\\/c|-e|-command|-scriptblock|-filter)[= ]\\s*|(?:^|[;&|(]\\s*)(?:\\S*[\\\\\\/])?(?:sudo\\s+|doas\\s+)?(?:ssh|wsl(?:\\.exe)?|chroot|su|screen|tmux)(?:\\s[^;&|"']*)?\\s|(?:\\S*[\\\\\\/])?(?:docker|kubectl|podman|nerdctl)(?:\\.exe)?\\s+(?:exec|run)\\b[^;&|"']*\\s)$/i;let o=line;o=o.replace(/@'[\\s\\S]*?'@/g,' fcd_inert_data ');o=o.replace(/@"[\\s\\S]*?"@/g,m=>m.includes('$(')?m:' fcd_inert_data ');o=o.replace(/<<-?\\s*'(\\w+)'[\\s\\S]*?(?:\\n\\1\\b|$)/g,' fcd_inert_data ');o=o.replace(/<<-?\\s*"?(\\w+)"?[\\s\\S]*?(?:\\n\\1\\b|$)/g,m=>K.test(m)?m:' fcd_inert_data ');const s=o;o=s.replace(/"((?:[^"\\\\]|\\\\.)*)"|'((?:[^'\\\\]|\\\\.)*)'/g,(w,dq,sq,i)=>{const b=dq!==undefined?dq:(sq||'');if(!/\\s/.test(b))return w;if(C.test(s.slice(Math.max(0,i-80),i)))return w;if(dq!==undefined&&K.test(b))return w;return ' fcd_inert_data ';});return o;}`,
         `// Precedence on one line: block outranks ask, ask outranks warn.`,
-        `function matchLine(line,rules){const n=line.replace(/\\s+/g,' ').trim();const x=execView(line);const xn=x.replace(/\\s+/g,' ').trim();let warnHit=null,askHit=null;for(const r of rules){try{const t=r.source==='custom'?line:x;const tn=r.source==='custom'?n:xn;if(r.re.test(tn)||r.re.test(t)){if(r.action==='block')return r;if(r.action==='ask'){if(!askHit)askHit=r;}else if(!warnHit)warnHit=r;}}catch{}}return askHit||warnHit;}`,
+        `function matchLine(line,rules){const n=line.replace(/\\s+/g,' ').trim();const x=execView(line);const xn=x.replace(/\\s+/g,' ').trim();let warnHit=null;const asks=[];for(const r of rules){try{const t=r.source==='custom'?line:x;const tn=r.source==='custom'?n:xn;if(r.re.test(tn)||r.re.test(t)){if(r.action==='block')return r;if(r.action==='ask'){asks.push(r);}else if(!warnHit)warnHit=r;}}catch{}}if(asks.length===1)return asks[0];if(asks.length>1){asks.sort((a,b)=>a.id<b.id?-1:a.id>b.id?1:0);return{...asks[0],id:'asks:'+asks.map(r=>encodeURIComponent(r.id)).join('+'),reason:asks.map(r=>r.reason).join('; ')}}return warnHit;}`,
         `function triggerFlush(){try{if(fs.existsSync(NODE_PATH)&&fs.existsSync(CLI_ENTRY)){const c=spawn(NODE_PATH,[CLI_ENTRY,'flush-spool','--heartbeat','true'],{detached:true,stdio:'ignore'});c.unref();}}catch{}}`,
         `// developer: '' | 'confirmed' | 'remembered' | 'declined' | 'timeout' | 'ide' | 'agent-terminal' — the "ask" outcome, reported with the same facts as an IDE prompt.`,
-        `function spoolEvent(rule,line,decision,developer){try{const ev=line.trim();const evidence=ev.length>180?ev.slice(0,180)+'...':ev;let reason='Shell guard: '+rule.reason;if(developer==='confirmed')reason='developer confirmed in terminal prompt — '+reason;else if(developer==='remembered')reason='developer confirmed earlier in this shell (session memory) — '+reason;else if(developer==='declined')reason='developer declined in terminal prompt — '+reason;else if(developer==='timeout')reason='developer confirmation not given (terminal prompt timed out) — '+reason;else if(developer==='ide')reason='developer confirmed in the IDE prompt (agent-driven terminal) — '+reason;else if(developer==='agent-terminal')reason='ask cannot be answered in an agent-driven terminal (no IDE confirmation) — '+reason;const event={eventId:crypto.randomUUID(),type:'verdict',decision,toolName:'shell_terminal',operation:'shell_command',reason,ruleId:rule.id,category:rule.category,severity:rule.severity,source:rule.source,evidence,occurredAt:new Date().toISOString()};if(developer){event.approvalScope='developer';if(developer==='confirmed'||developer==='remembered'||developer==='ide')event.approvedBy='developer';}fs.appendFileSync(SPOOL_PATH,JSON.stringify(event)+'\\n',{encoding:'utf8',mode:0o600});triggerFlush();}catch{}}`,
+        `function spoolEvent(rule,line,decision,developer){try{const ev=line.trim();const evidence=ev.length>180?ev.slice(0,180)+'...':ev;let reason='Shell guard: '+rule.reason;if(developer==='confirmed')reason='developer confirmed in terminal prompt — '+reason;else if(developer==='remembered')reason='developer confirmed earlier in this shell (session memory) — '+reason;else if(developer==='declined')reason='developer declined in terminal prompt — '+reason;else if(developer==='timeout')reason='developer confirmation not given (terminal prompt timed out) — '+reason;else if(developer==='ide')reason='delegated to the IDE permission gate (confirmation recorded by post-hook) — '+reason;else if(developer==='agent-terminal')reason='ask cannot be answered in an agent-driven terminal (no IDE confirmation) — '+reason;const event={eventId:crypto.randomUUID(),type:'verdict',decision,toolName:'shell_terminal',operation:'shell_command',reason,ruleId:rule.id,category:rule.category,severity:rule.severity,source:rule.source,evidence,occurredAt:new Date().toISOString()};if(developer){event.approvalScope='developer';if(developer==='confirmed'||developer==='remembered')event.approvedBy='developer';}fs.appendFileSync(SPOOL_PATH,JSON.stringify(event)+'\\n',{encoding:'utf8',mode:0o600});triggerFlush();}catch{}}`,
         (0, agentTerminal_1.buildAgentTerminalJs)(),
         `let argv=process.argv.slice(2);`,
         `// --record <confirmed|remembered|declined|timeout> <ruleId> -- <line>: the shell answered an ask prompt; report it and exit.`,

package/dist/commands/shellGuard.js

@@ -54,6 +54,9 @@ exports.installShellGuardCommand = installShellGuardCommand;
 exports.uninstallShellGuardCommand = uninstallShellGuardCommand;
 const child_process_1 = require("child_process");
 const fs = __importStar(require("fs"));
+const crypto = __importStar(require("crypto"));
+const config_1 = require("../config");
+const localSafetySnapshot_1 = require("../localSafetySnapshot");
 const os = __importStar(require("os"));
 const path = __importStar(require("path"));
 const deterministicGuard_1 = require("./deterministicGuard");
@@ -379,16 +382,48 @@ function builtinRuleCommandNames() {
 function escapeDotNetRegex(literal) {
     return literal.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
 }
-/** Cached Shield mode from the runtime bundle cache (offline read, never network). */
+/** Select the enrolled Shield and its exact identity snapshot, never merge old caches. */
+function shellEnrollment() {
+    const config = (0, config_1.loadMachineConfig)();
+    return {
+        shieldId: config.shieldId || process.env.FCD_SHIELD_ID || process.env.FULLCOURTDEFENSE_SHIELD_ID,
+        apiUrl: (config.apiUrl || process.env.FULLCOURTDEFENSE_API_URL || process.env.FCD_API_URL || 'https://api.fullcourtdefense.ai').replace(/\/$/, ''),
+    };
+}
+function cachedSnapshotFiles() {
+    try {
+        const enrollment = shellEnrollment();
+        if (enrollment.shieldId) {
+            const identity = (0, localSafetySnapshot_1.hookSnapshotIdentity)();
+            const key = crypto.createHash('sha1').update([enrollment.apiUrl, enrollment.shieldId, identity.developerName, identity.machineName].join('|')).digest('hex');
+            const name = `local-safety-${key}.json`;
+            return fs.existsSync(path.join(SNAPSHOT_CACHE_DIR, name)) ? [name] : [];
+        }
+        // Legacy standalone guards have no enrollment. Pick one coherent snapshot;
+        // never combine a disabled list from one version with actions from another.
+        return fs.readdirSync(SNAPSHOT_CACHE_DIR)
+            .filter(name => name.startsWith('local-safety-') && name.endsWith('.json'))
+            .map(name => { try {
+            return { name, at: JSON.parse(fs.readFileSync(path.join(SNAPSHOT_CACHE_DIR, name), 'utf8')).loadedAt || 0 };
+        }
+        catch {
+            return { name, at: -1 };
+        } })
+            .filter(entry => entry.at >= 0).sort((a, b) => b.at - a.at || a.name.localeCompare(b.name))
+            .slice(0, 1).map(entry => entry.name);
+    }
+    catch {
+        return [];
+    }
+}
+/** Cached Shield mode from the active enrollment (offline, never network). */
 function cachedMode() {
     try {
         const parsed = JSON.parse(fs.readFileSync(RUNTIME_CACHE_PATH, 'utf8'));
+        const { shieldId } = shellEnrollment();
         const entries = Object.values(parsed).filter(e => e && typeof e === 'object');
         entries.sort((a, b) => (b.fetchedAt || 0) - (a.fetchedAt || 0));
-        const mode = entries[0]?.mode;
-        // Enforce only on an explicit cached 'block'; missing/unknown = monitor.
-        // A machine that has never been told to enforce must not block typed
-        // commands (fresh install before the first bundle fetch, wiped cache).
+        const mode = shieldId ? parsed[shieldId]?.mode : entries[0]?.mode;
         return mode === 'block' ? 'block' : 'monitor';
     }
     catch {
@@ -404,7 +439,7 @@ function cachedDisabledItemIds() {
     const disabled = new Set();
     let snapshots = 0;
     try {
-        for (const file of fs.readdirSync(SNAPSHOT_CACHE_DIR)) {
+        for (const file of cachedSnapshotFiles()) {
             if (!file.startsWith('local-safety-') || !file.endsWith('.json'))
                 continue;
             try {
@@ -443,7 +478,7 @@ function cachedItemActions() {
     const ask = new Set();
     const blocked = new Set();
     try {
-        for (const file of fs.readdirSync(SNAPSHOT_CACHE_DIR)) {
+        for (const file of cachedSnapshotFiles()) {
             if (!file.startsWith('local-safety-') || !file.endsWith('.json'))
                 continue;
             try {
@@ -481,7 +516,7 @@ function cachedItemActions() {
 function cachedCustomRules() {
     const rules = [];
     try {
-        for (const file of fs.readdirSync(SNAPSHOT_CACHE_DIR)) {
+        for (const file of cachedSnapshotFiles()) {
             if (!file.startsWith('local-safety-') || !file.endsWith('.json'))
                 continue;
             try {
@@ -524,11 +559,12 @@ function cachedCustomRules() {
 function effectiveBuiltinRules() {
     const disabled = cachedDisabledItemIds();
     const itemActions = cachedItemActions();
+    const hasSnapshot = cachedSnapshotFiles().length > 0;
     return BUILTIN_RULES
         .filter(rule => !disabled.has(rule.id))
         .map(rule => {
         const action = itemActions.get(rule.id);
-        return action ? { ...rule, action } : rule;
+        return action ? { ...rule, action } : hasSnapshot ? rule : { ...rule, action: 'warn' };
     });
 }
 /** Write (or rewrite) the ruleset the profile guard loads at shell startup. */
@@ -707,7 +743,7 @@ function buildGuardPs1(nodePath, cliEntry) {
         `  try { $execView = Get-FcdExecView -CommandLine $CommandLine } catch { }`,
         `  $execNormalized = ($execView -replace '\\s+', ' ').Trim()`,
         `  $warnHit = $null`,
-        `  $askHit = $null`,
+        `  $askHits = @()`,
         `  foreach ($rule in $global:FcdGuardRules) {`,
         `    try {`,
         `      # Built-in rules ask "can this text ACT?" — they see the execution`,
@@ -719,12 +755,19 @@ function buildGuardPs1(nodePath, cliEntry) {
         `      if ($rule.Regex.IsMatch($targetNorm) -or $rule.Regex.IsMatch($target)) {`,
         `        # Precedence on one line: block outranks ask, ask outranks warn.`,
         `        if ($rule.Action -eq 'block') { return $rule }`,
-        `        if ($rule.Action -eq 'ask') { if ($null -eq $askHit) { $askHit = $rule } }`,
+        `        if ($rule.Action -eq 'ask') { $askHits += $rule }`,
         `        elseif ($null -eq $warnHit) { $warnHit = $rule }`,
         `      }`,
         `    } catch { }`,
         `  }`,
-        `  if ($null -ne $askHit) { return $askHit }`,
+        `  if ($askHits.Count -eq 1) { return $askHits[0] }`,
+        `  if ($askHits.Count -gt 1) {`,
+        `    $askHits = @($askHits | Sort-Object -Property Id -CaseSensitive)`,
+        `    $combined = $askHits[0].PSObject.Copy()`,
+        `    $combined.Id = 'asks:' + (($askHits | ForEach-Object { [Uri]::EscapeDataString($_.Id) }) -join '+')`,
+        `    $combined.Reason = ($askHits | ForEach-Object { $_.Reason }) -join '; '`,
+        `    return $combined`,
+        `  }`,
         `  return $warnHit`,
         `}`,
         ``,
@@ -774,7 +817,7 @@ function buildGuardPs1(nodePath, cliEntry) {
         `      'remembered' { $reason = 'developer confirmed earlier in this shell (session memory) — ' + $reason }`,
         `      'declined'   { $reason = 'developer declined in terminal prompt — ' + $reason }`,
         `      'timeout'    { $reason = 'developer confirmation not given (terminal prompt timed out) — ' + $reason }`,
-        `      'ide'        { $reason = 'developer confirmed in the IDE prompt (agent-driven terminal) — ' + $reason }`,
+        `      'ide'        { $reason = 'delegated to the IDE permission gate (confirmation recorded by post-hook) — ' + $reason }`,
         `      'agent-terminal' { $reason = 'ask cannot be answered in an agent-driven terminal (no IDE confirmation) — ' + $reason }`,
         `    }`,
         `    $event = [ordered]@{`,
@@ -793,7 +836,7 @@ function buildGuardPs1(nodePath, cliEntry) {
         `    }`,
         `    if ($Developer -ne '') {`,
         `      $event['approvalScope'] = 'developer'`,
-        `      if ($Developer -eq 'confirmed' -or $Developer -eq 'remembered' -or $Developer -eq 'ide') { $event['approvedBy'] = 'developer' }`,
+        `      if ($Developer -eq 'confirmed' -or $Developer -eq 'remembered') { $event['approvedBy'] = 'developer' }`,
         `    }`,
         `    $event = [pscustomobject]$event`,
         `    # BOM-free UTF8 append — PS5's Add-Content -Encoding utf8 writes a BOM that breaks JSONL parsing.`,

package/dist/config.d.ts

@@ -61,6 +61,8 @@ export declare function dpapiRoundtripProbe(): {
     detail: string;
 };
 export declare function getHomeConfigPath(): string;
+/** Machine enrollment only; terminal guards must not inherit a repository's Shield. */
+export declare function loadMachineConfig(): BotGuardConfig;
 export declare function loadConfig(configPath?: string): BotGuardConfig;
 export declare function getDefaultConfigPath(): string;
 export declare function saveShieldConfig(input: {

package/dist/config.js

@@ -38,6 +38,7 @@ exports.getPowershellHealth = getPowershellHealth;
 exports.capturePowershellLanguageMode = capturePowershellLanguageMode;
 exports.dpapiRoundtripProbe = dpapiRoundtripProbe;
 exports.getHomeConfigPath = getHomeConfigPath;
+exports.loadMachineConfig = loadMachineConfig;
 exports.loadConfig = loadConfig;
 exports.getDefaultConfigPath = getDefaultConfigPath;
 exports.saveShieldConfig = saveShieldConfig;
@@ -295,6 +296,10 @@ function mergeConfig(base, override) {
 function getHomeConfigPath() {
     return path.join(os.homedir(), '.fullcourtdefense.yml');
 }
+/** Machine enrollment only; terminal guards must not inherit a repository's Shield. */
+function loadMachineConfig() {
+    return readConfigFile(getHomeConfigPath());
+}
 function loadConfig(configPath) {
     const homeConfig = readConfigFile(getHomeConfigPath());
     let projectConfig = {};

package/dist/devConfirm.d.ts

@@ -13,6 +13,8 @@ export interface PendingConfirmation {
     sessionId?: string;
     remember: ConfirmRemember;
     raisedAt: string;
+    /** Exact-command handoff to the IDE permission gate; not proof of consent. */
+    permissionHandoff?: boolean;
 }
 export interface RememberedConfirmation {
     /**
@@ -65,6 +67,8 @@ export declare function settleDeveloperConfirmation(event: string, toolName: str
     marker: PendingConfirmation;
     confirmLatencyMs: number;
 } | undefined;
+/** Reject or cancel a pending request without creating approval memory. */
+export declare function rejectDeveloperConfirmation(event: string, toolName: string, argsDigest: string): void;
 /**
  * Markers older than the TTL never saw a post-execution hook: the developer denied the IDE
  * prompt, dismissed it, or the client ignored `ask`. Removed and returned so the caller can

package/dist/devConfirm.js

@@ -40,6 +40,7 @@ exports.actionDigest = actionDigest;
 exports.pendingKey = pendingKey;
 exports.raiseDeveloperConfirmation = raiseDeveloperConfirmation;
 exports.settleDeveloperConfirmation = settleDeveloperConfirmation;
+exports.rejectDeveloperConfirmation = rejectDeveloperConfirmation;
 exports.sweepExpiredConfirmations = sweepExpiredConfirmations;
 exports.isConfirmationRemembered = isConfirmationRemembered;
 /**
@@ -106,7 +107,8 @@ function readLedger() {
         const parsed = JSON.parse(fs.readFileSync(ledgerFile(), 'utf8'));
         return {
             pending: Array.isArray(parsed?.pending) ? parsed.pending.filter((p) => p && typeof p === 'object') : [],
-            remembered: Array.isArray(parsed?.remembered) ? parsed.remembered.filter((r) => r && typeof r === 'object') : [],
+            // Older ledgers could remember declines. Require fresh affirmative consent.
+            remembered: parsed?.formatVersion === 2 && Array.isArray(parsed?.remembered) ? parsed.remembered.filter((r) => r && typeof r === 'object') : [],
         };
     }
     catch {
@@ -116,7 +118,9 @@ function readLedger() {
 function writeLedger(ledger) {
     try {
         fs.mkdirSync(path.dirname(ledgerFile()), { recursive: true });
-        fs.writeFileSync(ledgerFile(), JSON.stringify(ledger), { encoding: 'utf8', mode: 0o600 });
+        const temp = `${ledgerFile()}.${process.pid}.${crypto.randomUUID()}.tmp`;
+        fs.writeFileSync(temp, JSON.stringify({ ...ledger, formatVersion: 2 }), { encoding: 'utf8', mode: 0o600 });
+        fs.renameSync(temp, ledgerFile());
     }
     catch { /* best-effort — losing a record must never change a verdict */ }
 }
@@ -185,7 +189,7 @@ function settleDeveloperConfirmation(event, toolName, argsDigest, now = new Date
     if (!marker)
         return undefined;
     ledger.pending = ledger.pending.filter(p => p.key !== key);
-    if (marker.remember !== 'none') {
+    if (marker.remember !== 'none' && Date.parse(marker.raisedAt) <= now.getTime() && now.getTime() - Date.parse(marker.raisedAt) < exports.CONFIRM_PENDING_TTL_MS) {
         const ttl = marker.remember === '1h' ? REMEMBER_1H_MS : REMEMBER_SESSION_MAX_MS;
         const remembered = {
             key: rememberKey(marker),
@@ -206,6 +210,13 @@ function settleDeveloperConfirmation(event, toolName, argsDigest, now = new Date
     writeLedger(ledger);
     return { marker, confirmLatencyMs: Math.max(0, now.getTime() - Date.parse(marker.raisedAt)) };
 }
+/** Reject or cancel a pending request without creating approval memory. */
+function rejectDeveloperConfirmation(event, toolName, argsDigest) {
+    const ledger = readLedger();
+    const key = pendingKey(event, toolName, argsDigest);
+    ledger.pending = ledger.pending.filter(p => p.key !== key);
+    writeLedger(ledger);
+}
 /**
  * Markers older than the TTL never saw a post-execution hook: the developer denied the IDE
  * prompt, dismissed it, or the client ignored `ask`. Removed and returned so the caller can
@@ -233,7 +244,7 @@ function isConfirmationRemembered(scope, sessionId, now = new Date()) {
     const hit = ledger.remembered.find(r => r.key === key);
     if (!hit)
         return undefined;
-    if (Date.parse(hit.expiresAt) <= now.getTime())
+    if (!Number.isFinite(Date.parse(hit.expiresAt)) || Date.parse(hit.expiresAt) <= now.getTime())
         return undefined;
     if (hit.remember === 'session' && (!sessionId || hit.sessionId !== sessionId))
         return undefined;

package/dist/runtimeConfig.d.ts

@@ -168,6 +168,11 @@ export declare function resetCacheOnEnrollment(): void;
  * "exception = allow" must not become a kill-switch bypass. Reads only the
  * local cache file (no network, no config parsing).
  */
+/** Failure handling reads only the requested Shield, never another enrollment. */
+export declare function cachedEnforcementState(shieldId: string | undefined): {
+    mode: ShieldMode;
+    failClosed: boolean;
+};
 export declare function isSuspendedByCache(): boolean;
 /**
  * Admin scan-folder choices from the most recent cached bundle (any shield):

package/dist/runtimeConfig.js

@@ -36,6 +36,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.getRuntimeBundle = getRuntimeBundle;
 exports.validateShieldCredentials = validateShieldCredentials;
 exports.resetCacheOnEnrollment = resetCacheOnEnrollment;
+exports.cachedEnforcementState = cachedEnforcementState;
 exports.isSuspendedByCache = isSuspendedByCache;
 exports.getCachedScanRootOverrides = getCachedScanRootOverrides;
 exports.getCachedExtraScanRoots = getCachedExtraScanRoots;
@@ -434,6 +435,11 @@ function resetCacheOnEnrollment() {
  * "exception = allow" must not become a kill-switch bypass. Reads only the
  * local cache file (no network, no config parsing).
  */
+/** Failure handling reads only the requested Shield, never another enrollment. */
+function cachedEnforcementState(shieldId) {
+    const entry = shieldId ? readCacheFile()[shieldId] : undefined;
+    return { mode: entry && isMode(entry.mode) ? entry.mode : 'monitor', failClosed: entry?.failClosed === true };
+}
 function isSuspendedByCache() {
     try {
         const cache = readCacheFile();

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.32.0"
+  "version": "1.33.0"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.32.0",
+  "version": "1.33.0",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {
@@ -13,6 +13,8 @@
     "README.md"
   ],
   "scripts": {
+    "test:endpoint-approvals": "npm run build && node scripts/audit-endpoint-mcp-shell.js",
+    "test:endpoint-clients": "npm run build && node scripts/test-endpoint-client-matrix.js && node scripts/test-copilot-hook-install.js",
     "build": "tsc && node scripts/copy-attack-corpus.js",
     "test:deterministic-guard": "npm run build && node scripts/test-deterministic-guard.js",
     "test:drive-delete-guard": "npm run build && node scripts/test-drive-delete-guard.js",