fullcourtdefense-cli 1.32.0 → 1.34.0

package/dist/actionPolicyEngine.js

@@ -1352,6 +1352,9 @@ function evaluateActionPolicies(policies, toolName, operation, context = {}, dec
     // A `block` from a policy marked `enforcement: 'hard'` — kept as a block even
     // where a human is present (see the workstation ceiling below).
     let hardBlock;
+    let requiredApproval;
+    let requiredApprovalResult;
+    const approvalObligations = [];
     for (const policy of policies) {
         // Org-scoped policies bind to attributed RUNTIME USERS — anonymous/system calls (no
         // developerName) are deliberately out of scope. Surfaced via skippedOrgPolicies so
@@ -1408,9 +1411,16 @@ function evaluateActionPolicies(policies, toolName, operation, context = {}, dec
                     reason: `${matched.reason} — recorded as a warning: this only touches a file on this machine and nothing leaves it (the same content leaving the machine still blocks; mark the policy Hard block to stop file edits too)`,
                 };
             }
+            if (matched.verdict === 'require_approval') {
+                approvalObligations.push(`${policy.id}:${matchedRule}`);
+                if (!requiredApprovalResult || rule.approval?.scope !== 'developer')
+                    requiredApprovalResult = matched;
+                const approval = resolveApprovalOptions(rule.approval);
+                requiredApproval = requiredApproval ? mergeApprovalOptions(requiredApproval, approval) : approval;
+            }
             if (rule.verdict === 'block' && policy.enforcement === 'hard' && !hardBlock)
                 hardBlock = matched;
-            if (verdictPriority[rule.verdict] > verdictPriority[worstResult.verdict]) {
+            if (verdictPriority[matched.verdict] > verdictPriority[worstResult.verdict]) {
                 worstResult = matched;
             }
             else if (rule.verdict === 'require_approval' && worstResult.verdict === 'require_approval') {
@@ -1441,12 +1451,18 @@ function evaluateActionPolicies(policies, toolName, operation, context = {}, dec
                 ...worstResult,
                 allowed: false,
                 verdict: 'require_approval',
-                approval: { ...exports.WORKSTATION_ASK_APPROVAL },
+                approval: requiredApproval ? mergeApprovalOptions(exports.WORKSTATION_ASK_APPROVAL, requiredApproval) : { ...exports.WORKSTATION_ASK_APPROVAL },
                 askedInsteadOfBlocked: true,
                 reason: `${worstResult.reason || `Action policy "${worstResult.policyName}" blocked`} — asks you on a workstation (the policy is not marked Hard block)`,
             };
         }
     }
+    if (worstResult.askedInsteadOfBlocked && requiredApproval?.scope === 'org' && requiredApprovalResult) {
+        worstResult = { ...requiredApprovalResult, approval: mergeApprovalOptions(exports.WORKSTATION_ASK_APPROVAL, requiredApproval) };
+    }
+    if (worstResult.verdict === 'require_approval' && approvalObligations.length > 1) {
+        worstResult = { ...worstResult, matchedRule: [...approvalObligations].sort().join('; ') };
+    }
     if (monitorMatches.length > 0) {
         worstResult = { ...worstResult, monitorMatches };
     }

package/dist/agentTerminal.d.ts

@@ -12,12 +12,12 @@ export declare function isAgentDrivenTerminal(env?: NodeJS.ProcessEnv): boolean;
 /** Shown (with the rule name) when an ask lands in an agent-driven terminal with no IDE answer behind it. */
 export declare const AGENT_TERMINAL_ASK_BLOCKED: string;
 /** Shown when the IDE prompt already answered for this exact command. */
-export declare const AGENT_TERMINAL_IDE_CONFIRMED = "allowed \u2014 the developer confirmed this exact command in the IDE prompt.";
+export declare const AGENT_TERMINAL_IDE_CONFIRMED = "allowed through the IDE permission gate; confirmation is recorded by the IDE post-execution hook.";
 /** Pending-marker key the IDE hook wrote for this shell command (see devConfirm.pendingKey). */
 export declare function ideShellPendingKey(command: string): string;
 /** Remembered-confirmation key for a Local Safety ask rule on the shell tool (see devConfirm rememberKey). */
 export declare function ideLocalSafetyRememberKey(ruleId: string): string;
-/** How long a pending IDE marker counts as "the developer just allowed this" (mirrors CONFIRM_PENDING_TTL_MS). */
+/** Maximum lifetime of an exact-command IDE permission handoff (not consent). */
 export declare const IDE_CONFIRMATION_WINDOW_MS: number;
 /**
  * Pure decision over a parsed dev-confirm ledger: did the IDE prompt already
@@ -25,6 +25,7 @@ export declare const IDE_CONFIRMATION_WINDOW_MS: number;
  * by the generated guard code below.
  */
 export declare function ideConfirmedFor(ledger: {
+    formatVersion?: number;
     pending?: Array<{
         key?: string;
         raisedAt?: string;
@@ -32,8 +33,10 @@ export declare function ideConfirmedFor(ledger: {
     remembered?: Array<{
         key?: string;
         expiresAt?: string;
+        remember?: string;
+        sessionId?: string;
     }>;
-} | undefined, command: string, ruleId: string, now?: number): boolean;
+} | undefined, command: string, ruleId: string, now?: number, sessionId?: string): boolean;
 /**
  * Node snippet for the cmd.exe guard and the POSIX checker. Defines
  * `agentTerminal()` and `ideConfirmed(line, ruleId)`; expects `fs`, `crypto`,

package/dist/agentTerminal.js

@@ -48,8 +48,8 @@ exports.buildAgentTerminalPs = buildAgentTerminalPs;
  * Claude Code's Bash tool, ...) the agent is the one that would type the
  * answer — so an ask there is not a control at all. Rule: in an agent-driven
  * terminal the guard never offers y/N. It honors the answer the developer
- * already gave in the IDE prompt for this exact command (the hook raised it a
- * moment ago and the IDE only runs the command after "Allow"), and otherwise
+ * gave in the IDE, or delegates an explicitly marked exact-command handoff
+ * to the IDE permission gate. Handoffs are never recorded as consent. Otherwise
  * blocks with a message that says where the question is answered.
  *
  * Pure: no I/O. The guards render these markers + keys into their generated
@@ -82,7 +82,7 @@ exports.AGENT_TERMINAL_ASK_BLOCKED = 'an AI agent is driving this terminal, so n
     'The developer answers Allow / Deny in the IDE prompt (the agent must run the command through the IDE hook), ' +
     'or runs it in their own terminal.';
 /** Shown when the IDE prompt already answered for this exact command. */
-exports.AGENT_TERMINAL_IDE_CONFIRMED = 'allowed — the developer confirmed this exact command in the IDE prompt.';
+exports.AGENT_TERMINAL_IDE_CONFIRMED = 'allowed through the IDE permission gate; confirmation is recorded by the IDE post-execution hook.';
 // ---------------------------------------------------------------------------
 // IDE-answer lookup keys. These MUST match devConfirm.ts: the hook raises a
 // pending marker keyed by sha256(`${event}|${tool}|${sha256('cmd:'+command)}`)
@@ -98,21 +98,20 @@ function ideShellPendingKey(command) {
 function ideLocalSafetyRememberKey(ruleId) {
     return sha256(`shell|local-safety:${ruleId}|${ruleId}`);
 }
-/** How long a pending IDE marker counts as "the developer just allowed this" (mirrors CONFIRM_PENDING_TTL_MS). */
+/** Maximum lifetime of an exact-command IDE permission handoff (not consent). */
 exports.IDE_CONFIRMATION_WINDOW_MS = 10 * 60_000;
 /**
  * Pure decision over a parsed dev-confirm ledger: did the IDE prompt already
  * answer for this command / rule? Used by the in-process tests and mirrored
  * by the generated guard code below.
  */
-function ideConfirmedFor(ledger, command, ruleId, now = Date.now()) {
-    if (!ledger)
+function ideConfirmedFor(ledger, command, ruleId, now = Date.now(), sessionId) {
+    if (!ledger || ledger.formatVersion !== 2)
         return false;
-    const pendingKey = ideShellPendingKey(command);
-    if ((ledger.pending || []).some(p => p?.key === pendingKey && typeof p.raisedAt === 'string' && now - Date.parse(p.raisedAt) < exports.IDE_CONFIRMATION_WINDOW_MS))
-        return true;
+    // A pending prompt is not an affirmative answer. IDE handoffs are handled
+    // separately by the generated guard, without claiming developer consent.
     const rememberKey = ideLocalSafetyRememberKey(ruleId);
-    return (ledger.remembered || []).some(r => r?.key === rememberKey && typeof r.expiresAt === 'string' && Date.parse(r.expiresAt) > now);
+    return (ledger.remembered || []).some(r => r?.key === rememberKey && typeof r.expiresAt === 'string' && Date.parse(r.expiresAt) > now && (r.remember === '1h' || (r.remember === 'session' && !!sessionId && r.sessionId === sessionId)));
 }
 // ---------------------------------------------------------------------------
 // Rendered snippets for the generated guards (single source of truth).
@@ -130,7 +129,7 @@ function buildAgentTerminalJs() {
         `function agentTerminal(){const e=process.env;return AGENT_MARKERS.some(m=>m.v!==undefined?e[m.n]===m.v:(typeof e[m.n]==='string'&&e[m.n].length>0));}`,
         `const IDE_WINDOW_MS=${exports.IDE_CONFIRMATION_WINDOW_MS};`,
         `function sha(s){return crypto.createHash('sha256').update(s).digest('hex');}`,
-        `function ideConfirmed(line,ruleId){try{const ledger=JSON.parse(fs.readFileSync(path.join(os.homedir(),'.fullcourtdefense','dev-confirm.json'),'utf8'));const now=Date.now();const pk=sha('shell|shell|'+sha('cmd:'+line.trim()));if((ledger.pending||[]).some(p=>p&&p.key===pk&&typeof p.raisedAt==='string'&&now-Date.parse(p.raisedAt)<IDE_WINDOW_MS))return true;const rk=sha('shell|local-safety:'+ruleId+'|'+ruleId);return (ledger.remembered||[]).some(r=>r&&r.key===rk&&typeof r.expiresAt==='string'&&Date.parse(r.expiresAt)>now);}catch{return false;}}`,
+        `function ideConfirmed(line,ruleId){try{const ledger=JSON.parse(fs.readFileSync(path.join(os.homedir(),'.fullcourtdefense','dev-confirm.json'),'utf8'));const now=Date.now();const pk=sha('shell|shell|'+sha('cmd:'+line.trim()));if((ledger.pending||[]).some(p=>p&&p.permissionHandoff===true&&p.key===pk&&typeof p.raisedAt==='string'&&now>=Date.parse(p.raisedAt)&&now-Date.parse(p.raisedAt)<IDE_WINDOW_MS))return true;if(ledger.formatVersion!==2)return false;const rk=sha('shell|local-safety:'+ruleId+'|'+ruleId);const session=process.env.FCD_SESSION_ID||process.env.CLAUDE_CODE_SESSION_ID||process.env.CODEX_THREAD_ID;return (ledger.remembered||[]).some(r=>r&&r.key===rk&&typeof r.expiresAt==='string'&&Date.parse(r.expiresAt)>now&&(r.remember==='1h'||(r.remember==='session'&&session&&r.sessionId===session)));}catch{return false;}}`,
         `const AGENT_ASK_BLOCKED=${JSON.stringify(exports.AGENT_TERMINAL_ASK_BLOCKED)};`,
         `const AGENT_IDE_CONFIRMED=${JSON.stringify(exports.AGENT_TERMINAL_IDE_CONFIRMED)};`,
     ].join('\n');
@@ -169,15 +168,19 @@ function buildAgentTerminalPs() {
         `    $now = [DateTimeOffset]::UtcNow`,
         `    $pk = Get-FcdSha256 ('shell|shell|' + (Get-FcdSha256 ('cmd:' + $Line.Trim())))`,
         `    foreach ($p in @($ledger.pending)) {`,
-        `      if ($null -ne $p -and $p.key -eq $pk -and $p.raisedAt) {`,
-        `        $age = $now - [DateTimeOffset]::Parse($p.raisedAt, [Globalization.CultureInfo]::InvariantCulture)`,
-        `        if ($age.TotalMilliseconds -lt ${exports.IDE_CONFIRMATION_WINDOW_MS}) { return $true }`,
+        `      if ($null -ne $p -and $p.permissionHandoff -eq $true -and $p.key -eq $pk -and $p.raisedAt) {`,
+        `        $raised = if ($p.raisedAt -is [DateTime]) { [DateTimeOffset]$p.raisedAt } else { [DateTimeOffset]::Parse([string]$p.raisedAt, [Globalization.CultureInfo]::InvariantCulture) }`,
+        `        $age = $now - $raised`,
+        `        if ($age.TotalMilliseconds -ge 0 -and $age.TotalMilliseconds -lt ${exports.IDE_CONFIRMATION_WINDOW_MS}) { return $true }`,
         `      }`,
         `    }`,
+        `    if ($ledger.formatVersion -ne 2) { return $false }`,
         `    $rk = Get-FcdSha256 ('shell|local-safety:' + $RuleId + '|' + $RuleId)`,
+        `    $session = $env:FCD_SESSION_ID; if (-not $session) { $session = $env:CLAUDE_CODE_SESSION_ID }; if (-not $session) { $session = $env:CODEX_THREAD_ID }`,
         `    foreach ($r in @($ledger.remembered)) {`,
-        `      if ($null -ne $r -and $r.key -eq $rk -and $r.expiresAt) {`,
-        `        if ([DateTimeOffset]::Parse($r.expiresAt, [Globalization.CultureInfo]::InvariantCulture) -gt $now) { return $true }`,
+        `      if ($null -ne $r -and $r.key -eq $rk -and $r.expiresAt -and ($r.remember -eq '1h' -or ($r.remember -eq 'session' -and $session -and $r.sessionId -eq $session))) {`,
+        `        $expiry = if ($r.expiresAt -is [DateTime]) { [DateTimeOffset]$r.expiresAt } else { [DateTimeOffset]::Parse([string]$r.expiresAt, [Globalization.CultureInfo]::InvariantCulture) }`,
+        `        if ($expiry -gt $now) { return $true }`,
         `      }`,
         `    }`,
         `  } catch { }`,

package/dist/commands/cmdGuard.js

@@ -160,12 +160,12 @@ function buildGuardJs(nodePath, cliEntry) {
         `// exec), $( ) substitution, or real backtick command substitution (>=2 chars; a 1-char pair is a PS escape).`,
         `function execView(line){if(/\\b(?:iex|invoke-expression|invoke-command)\\b|\\beval\\b|\\bxargs\\b|\\bbase64\\b[^\\n]*(?:-d\\b|--decode\\b)|frombase64string|-encodedcommand\\b|\\s-enc\\s|\\|\\s*&?\\s*(?:sh|bash|zsh|dash|ksh|csh|pwsh|powershell(?:\\.exe)?|cmd(?:\\.exe)?|node|python[0-9.]*|perl|ruby)\\b|\\b(?:sh|bash|zsh|dash|ksh|csh|pwsh|powershell(?:\\.exe)?|cmd(?:\\.exe)?|node|python[0-9.]*|perl|ruby)\\s+(?:-c|\\/c|-e|-command|-scriptblock)\\b|\\b(?:ssh|wsl(?:\\.exe)?|chroot)\\b|\\b(?:docker|kubectl|podman|nerdctl)(?:\\.exe)?\\s+(?:exec|run)\\b/i.test(line))return line;const K=/\\$\\(|\`[^\`]{2,}\`/;const C=/(?:(?:^|[;&|(]|\\s)(?:-c|\\/c|-e|-command|-scriptblock|-filter)[= ]\\s*|(?:^|[;&|(]\\s*)(?:\\S*[\\\\\\/])?(?:sudo\\s+|doas\\s+)?(?:ssh|wsl(?:\\.exe)?|chroot|su|screen|tmux)(?:\\s[^;&|"']*)?\\s|(?:\\S*[\\\\\\/])?(?:docker|kubectl|podman|nerdctl)(?:\\.exe)?\\s+(?:exec|run)\\b[^;&|"']*\\s)$/i;let o=line;o=o.replace(/@'[\\s\\S]*?'@/g,' fcd_inert_data ');o=o.replace(/@"[\\s\\S]*?"@/g,m=>m.includes('$(')?m:' fcd_inert_data ');o=o.replace(/<<-?\\s*'(\\w+)'[\\s\\S]*?(?:\\n\\1\\b|$)/g,' fcd_inert_data ');o=o.replace(/<<-?\\s*"?(\\w+)"?[\\s\\S]*?(?:\\n\\1\\b|$)/g,m=>K.test(m)?m:' fcd_inert_data ');const s=o;o=s.replace(/"((?:[^"\\\\]|\\\\.)*)"|'((?:[^'\\\\]|\\\\.)*)'/g,(w,dq,sq,i)=>{const b=dq!==undefined?dq:(sq||'');if(!/\\s/.test(b))return w;if(C.test(s.slice(Math.max(0,i-80),i)))return w;if(dq!==undefined&&K.test(b))return w;return ' fcd_inert_data ';});return o;}`,
         `// Precedence on one line: block outranks ask, ask outranks warn.`,
-        `function matchLine(line,rules){const n=line.replace(/\\s+/g,' ').trim();const x=execView(line);const xn=x.replace(/\\s+/g,' ').trim();let warnHit=null,askHit=null;for(const r of rules){try{const t=r.source==='custom'?line:x;const tn=r.source==='custom'?n:xn;if(r.re.test(tn)||r.re.test(t)){if(r.action==='block')return r;if(r.action==='ask'){if(!askHit)askHit=r;}else if(!warnHit)warnHit=r;}}catch{}}return askHit||warnHit;}`,
+        `function matchLine(line,rules){const n=line.replace(/\\s+/g,' ').trim();const x=execView(line);const xn=x.replace(/\\s+/g,' ').trim();let warnHit=null;const asks=[];for(const r of rules){try{const t=r.source==='custom'?line:x;const tn=r.source==='custom'?n:xn;if(r.re.test(tn)||r.re.test(t)){if(r.action==='block')return r;if(r.action==='ask'){asks.push(r);}else if(!warnHit)warnHit=r;}}catch{}}if(asks.length===1)return asks[0];if(asks.length>1){asks.sort((a,b)=>a.id<b.id?-1:a.id>b.id?1:0);return{...asks[0],id:'asks:'+asks.map(r=>encodeURIComponent(r.id)).join('+'),reason:asks.map(r=>r.reason).join('; ')}}return warnHit;}`,
         `// Flush is DETACHED (spawn+unref, matching the posix guard) — a spawnSync here`,
         `// made the user's terminal wait for a full CLI process INCLUDING the network`,
         `// flush after every finding. Monitor mode must never add synchronous latency.`,
         `// developer: '' | 'confirmed' | 'remembered' | 'declined' | 'timeout' | 'ide' | 'agent-terminal' — the "ask" outcome, reported with the same facts as an IDE prompt.`,
-        `function spoolEvent(rule,line,decision,developer){try{const ev=line.trim();const evidence=ev.length>180?ev.slice(0,180)+'...':ev;let reason='Shell guard: '+rule.reason;if(developer==='confirmed')reason='developer confirmed in terminal prompt — '+reason;else if(developer==='remembered')reason='developer confirmed earlier in this cmd window (session memory) — '+reason;else if(developer==='declined')reason='developer declined in terminal prompt — '+reason;else if(developer==='timeout')reason='developer confirmation not given (terminal prompt timed out) — '+reason;else if(developer==='ide')reason='developer confirmed in the IDE prompt (agent-driven terminal) — '+reason;else if(developer==='agent-terminal')reason='ask cannot be answered in an agent-driven terminal (no IDE confirmation) — '+reason;const event={eventId:crypto.randomUUID(),type:'verdict',decision,toolName:'cmd_terminal',operation:'shell_command',reason,ruleId:rule.id,category:rule.category,severity:rule.severity,source:rule.source,evidence,occurredAt:new Date().toISOString()};if(developer){event.approvalScope='developer';if(developer==='confirmed'||developer==='remembered'||developer==='ide')event.approvedBy='developer';}fs.appendFileSync(SPOOL_PATH,JSON.stringify(event)+'\\n',{encoding:'utf8',mode:0o600});if(fs.existsSync(NODE_PATH)&&fs.existsSync(CLI_ENTRY)){const c=spawn(NODE_PATH,[CLI_ENTRY,'flush-spool','--heartbeat','true'],{detached:true,stdio:'ignore',windowsHide:true});c.unref();}}catch{}}`,
+        `function spoolEvent(rule,line,decision,developer){try{const ev=line.trim();const evidence=ev.length>180?ev.slice(0,180)+'...':ev;let reason='Shell guard: '+rule.reason;if(developer==='confirmed')reason='developer confirmed in terminal prompt — '+reason;else if(developer==='remembered')reason='developer confirmed earlier in this cmd window (session memory) — '+reason;else if(developer==='declined')reason='developer declined in terminal prompt — '+reason;else if(developer==='timeout')reason='developer confirmation not given (terminal prompt timed out) — '+reason;else if(developer==='ide')reason='delegated to the IDE permission gate (confirmation recorded by post-hook) — '+reason;else if(developer==='agent-terminal')reason='ask cannot be answered in an agent-driven terminal (no IDE confirmation) — '+reason;const event={eventId:crypto.randomUUID(),type:'verdict',decision,toolName:'cmd_terminal',operation:'shell_command',reason,ruleId:rule.id,category:rule.category,severity:rule.severity,source:rule.source,evidence,occurredAt:new Date().toISOString()};if(developer){event.approvalScope='developer';if(developer==='confirmed'||developer==='remembered')event.approvedBy='developer';}fs.appendFileSync(SPOOL_PATH,JSON.stringify(event)+'\\n',{encoding:'utf8',mode:0o600});if(fs.existsSync(NODE_PATH)&&fs.existsSync(CLI_ENTRY)){const c=spawn(NODE_PATH,[CLI_ENTRY,'flush-spool','--heartbeat','true'],{detached:true,stdio:'ignore',windowsHide:true});c.unref();}}catch{}}`,
         `function askRemembered(ruleId){try{const m=JSON.parse(fs.readFileSync(ASK_MEMORY_PATH,'utf8'));const until=m&&m[ruleId];return typeof until==='number'&&until>Date.now();}catch{return false;}}`,
         `function rememberAsk(ruleId){try{let m={};try{m=JSON.parse(fs.readFileSync(ASK_MEMORY_PATH,'utf8'))||{};}catch{}m[ruleId]=Date.now()+ASK_REMEMBER_MS;fs.mkdirSync(path.dirname(ASK_MEMORY_PATH),{recursive:true});fs.writeFileSync(ASK_MEMORY_PATH,JSON.stringify(m),{encoding:'utf8',mode:0o600});}catch{}}`,
         (0, agentTerminal_1.buildAgentTerminalJs)(),

package/dist/commands/deterministicGuard.d.ts

@@ -134,6 +134,8 @@ export interface DeterministicScanOutcome {
      * events, shell wrappers, no human present) treats it exactly as a block.
      */
     askFinding?: DeterministicFinding;
+    /** Every matching approval obligation, retained for diagnostics and tests. */
+    askFindings?: DeterministicFinding[];
     /** warn-action findings that matched — the action proceeds; report these. */
     warnings: DeterministicFinding[];
 }

package/dist/commands/deterministicGuard.js

@@ -1259,17 +1259,30 @@ function findingAction(finding) {
  */
 function resolveDeterministicOutcome(scan, options) {
     const warnings = [];
-    let askFinding;
+    const askFindings = [];
+    const result = () => {
+        if (!askFindings.length)
+            return { warnings };
+        const ordered = [...askFindings].sort((a, b) => a.ruleId.localeCompare(b.ruleId));
+        // Bind memory to every matching rule. One dialog describes the full set.
+        const askFinding = ordered.length === 1 ? ordered[0] : {
+            ...ordered[0],
+            itemId: ordered.map(f => f.itemId).join('+'),
+            ruleId: ordered.map(f => f.ruleId).join('+'),
+            reason: ordered.map(f => `${f.itemId}: ${f.reason}`).join('; '),
+        };
+        return { askFinding, askFindings, warnings };
+    };
     let current = options;
     for (let pass = 0; pass < MAX_ACTION_PASSES; pass++) {
         const finding = scan(current);
         if (!finding)
-            return askFinding ? { askFinding, warnings } : { warnings };
+            return result();
         const action = findingAction(finding);
         if (action === 'warn')
             warnings.push(finding);
         else if (action === 'ask')
-            askFinding = askFinding || finding;
+            askFindings.push(finding);
         else
             return { blockingFinding: finding, warnings };
         current = withRuleSuppressed(current, finding);
@@ -1278,7 +1291,7 @@ function resolveDeterministicOutcome(scan, options) {
     const last = scan(current);
     if (last)
         return { blockingFinding: last, warnings };
-    return askFinding ? { askFinding, warnings } : { warnings };
+    return result();
 }
 /**
  * Resolve a TOOL RESPONSE under per-rule actions. The response is the one

package/dist/commands/discoverPaths.js

@@ -215,6 +215,8 @@ function candidateConfigPaths(cwd, extra) {
         { path: path.join(xdg, 'Code', 'User', 'settings.json'), source: 'VS Code (user, linux)', clientKey: 'vscode' },
         { path: path.join(home, '.codeium', 'windsurf', 'mcp_config.json'), source: 'Windsurf', clientKey: 'windsurf' },
         { path: path.join(home, '.kiro', 'mcp.json'), source: 'Kiro', clientKey: 'kiro' },
+        { path: path.join(home, '.kiro', 'settings', 'mcp.json'), source: 'Kiro (settings)', clientKey: 'kiro' },
+        { path: path.join(cwd, '.kiro', 'settings', 'mcp.json'), source: 'Kiro (project settings)', clientKey: 'kiro' },
         { path: path.join(cwd, '.mcp.json'), source: 'Repo (.mcp.json)', clientKey: 'other' },
         { path: path.join(cwd, 'mcp.json'), source: 'Repo (mcp.json)', clientKey: 'other' },
     ];

package/dist/commands/hook.d.ts

@@ -20,6 +20,7 @@ import { BotGuardConfig } from '../config';
  * human approves/rejects in the FullCourtDefense console (same as the gateway).
  */
 export interface HookArgs {
+    agentClient?: string;
     event?: string;
     apiUrl?: string;
     shieldId?: string;

package/dist/commands/hook.js

@@ -191,10 +191,10 @@ function mapClaudeToolPayload(payload) {
 // a file read is `read_file { path }`. Built-ins with no enforcement surface
 // (search, task, web) are ignored. Nothing here decides anything.
 // ---------------------------------------------------------------------------
-const BUILTIN_SHELL_TOOLS = new Set(['bash', 'shell', 'runterminalcommand', 'runinterminal', 'powershell', 'terminal']);
-const BUILTIN_READ_TOOLS = new Set(['read', 'readfile', 'view']);
+const BUILTIN_SHELL_TOOLS = new Set(['bash', 'shell', 'runterminalcommand', 'runinterminal', 'powershell', 'terminal', 'runshellcommand', 'executebash', 'execcommand']);
+const BUILTIN_READ_TOOLS = new Set(['read', 'readfile', 'view', 'fsread']);
 const BUILTIN_WRITE_TOOLS = new Set([
-    'write', 'edit', 'multiedit', 'notebookedit', 'createfile', 'editfiles',
+    'write', 'edit', 'multiedit', 'notebookedit', 'createfile', 'editfiles', 'writefile', 'fswrite', 'replace',
     'replacestringinfile', 'editfile', 'applypatch', 'strreplaceeditor', 'insertedittofile', 'strreplace', 'editnotebook',
 ]);
 /**
@@ -221,11 +221,11 @@ function mapBuiltinToolPayload(toolName, input, payload) {
     if (BUILTIN_SHELL_TOOLS.has(canon)) {
         return {
             event: 'shell',
-            payload: { ...payload, command: str(input.command), cwd: str(input.cwd) || str(input.working_directory) || str(payload.cwd) || undefined },
+            payload: { ...payload, command: str(input.command) || str(input.cmd), cwd: str(input.cwd) || str(input.workdir) || str(input.working_directory) || str(payload.cwd) || undefined },
         };
     }
     if (BUILTIN_READ_TOOLS.has(canon)) {
-        return { event: 'read', payload: { ...payload, file_path: str(input.file_path) || str(input.path) || str(input.target_file) } };
+        return { event: 'read', payload: { ...payload, file_path: str(input.file_path) || str(input.filePath) || str(input.absolute_path) || str(input.path) || str(input.target_file) } };
     }
     if (BUILTIN_WRITE_TOOLS.has(canon)) {
         const filePath = str(input.file_path) || str(input.notebook_path) || str(input.path) || str(input.filePath) || str(input.target_file)
@@ -235,7 +235,7 @@ function mapBuiltinToolPayload(toolName, input, payload) {
         // `new_source`) are reduced to the lines they add. Both then drop the
         // credential-shaped words the file on disk already contains — re-stating a
         // value that is already in the file is not putting a secret into it.
-        const delta = str(input.new_string) || str(input.new_str) || str(input.new_text)
+        const delta = str(input.new_string) || str(input.newString) || str(input.newText) || str(input.new_str) || str(input.new_text)
             || (Array.isArray(input.edits)
                 ? input.edits.map((e) => str(e?.new_string) || str(e?.new_text) || str(e?.newText) || str(e?.content)).filter(Boolean).join('\n')
                 : '');
@@ -681,7 +681,7 @@ function prepareDeveloperConfirmation(event, call, payload, source) {
             offlineEnforced: true,
         });
     }
-    const remembered = (0, devConfirm_1.isConfirmationRemembered)({ toolName: call.toolName, operation, policyId: source.policyId, matchedRule: source.matchedRule }, sessId);
+    const remembered = source.remember === 'none' ? undefined : (0, devConfirm_1.isConfirmationRemembered)({ toolName: call.toolName, operation, policyId: source.policyId, matchedRule: source.matchedRule }, sessId);
     if (remembered) {
         (0, hookIo_1.dbg)({ phase: 'dev_confirm_remembered', event, tool: call.toolName, operation, remember: remembered.remember, where: source.where });
         spoolCallEvent(call, {
@@ -704,6 +704,7 @@ function prepareDeveloperConfirmation(event, call, payload, source) {
         matchedRule: source.matchedRule,
         sessionId: sessId,
         remember: source.remember,
+        permissionHandoff: event === 'shell',
     });
     (0, hookIo_1.dbg)({ phase: 'dev_confirm_ask', event, tool: call.toolName, operation, key: marker.key, remember: source.remember, where: source.where });
     spoolCallEvent(call, {
@@ -1090,7 +1091,7 @@ async function evaluateHookRequest(args, stdinRaw, config) {
         // Same contract as the process-level wrapper, including the kill-switch
         // exception: a crash during daemon-side evaluation must not unlock a
         // suspended machine.
-        const outcome = failOpenOutcome(args.event, `${message} (daemon eval)`);
+        const outcome = failOpenOutcome(args.event, `${message} (daemon eval)`, args, config);
         return { stdout: outcome.stdout, stderr: '', exitCode: outcome.exitCode };
     }
 }
@@ -1152,7 +1153,7 @@ async function hookCommandOuter(args, config, startedAt) {
     }
     catch (err) {
         const message = err instanceof Error ? err.message : String(err);
-        const outcome = failOpenOutcome(args.event, message);
+        const outcome = failOpenOutcome(args.event, message, args, config);
         try {
             process.stdout.write(outcome.stdout);
         }
@@ -1167,9 +1168,10 @@ async function hookCommandOuter(args, config, startedAt) {
  * not become a way to bypass an administrator's suspension — a crash (induced
  * or accidental) on a suspended machine would otherwise unlock every agent
  * action. So the catch handlers consult the local cache directly: suspended
- * machines still deny, everything else still fails open silently.
+ * machines still deny. An enforcing Shield with fail-closed also denies
+ * evaluation failures; Monitor and fail-open configurations continue.
  */
-function failOpenOutcome(event, message) {
+function failOpenOutcome(event, message, args, config) {
     const toolName = event || 'unknown';
     // Label the spooled event below as a crash-allow: a rising fail_open rate is
     // the fleet's earliest signal that the guard itself is broken on a machine.
@@ -1182,18 +1184,20 @@ function failOpenOutcome(event, message) {
         suspended = (0, runtimeConfig_1.isSuspendedByCache)();
     }
     catch { /* never throw */ }
+    const state = (0, runtimeConfig_1.cachedEnforcementState)(args?.shieldId || config?.shieldId || process.env.FCD_SHIELD_ID || process.env.FULLCOURTDEFENSE_SHIELD_ID);
+    const denyForError = state.mode === 'block' && (args?.failClosed !== undefined ? args.failClosed === 'true' : state.failClosed) && !(args?.shadow === 'true' && args?.fcdManaged !== 'true');
     try {
         (0, hookIo_1.dbg)({ phase: 'hook_fail_open', event, error: message, suspended });
     }
     catch { /* never throw */ }
     try {
         (0, telemetry_1.spoolEvent)({
-            decision: suspended ? 'block' : 'allow',
+            decision: suspended || denyForError ? 'block' : 'allow',
             toolName,
             operation: `${toolName}:hook_error`,
             reason: suspended
                 ? `Hook error on a SUSPENDED machine — denied (kill-switch holds): ${message.slice(0, 200)}`
-                : `Hook error failed open: ${message.slice(0, 200)}`,
+                : `${denyForError ? 'fail-closed: hook evaluation failed' : 'Hook error failed open'}: ${message.slice(0, 200)}`,
             offlineEnforced: true,
             ...(suspended ? { severity: 'critical', source: 'backend' } : {}),
         });
@@ -1211,6 +1215,12 @@ function failOpenOutcome(event, message) {
             exitCode: 0,
         };
     }
+    if (denyForError) {
+        const reason = 'FullCourtDefense could not verify this action. Your administrator enabled fail-closed. Retry after policy checking recovers.';
+        return { stdout: JSON.stringify({ continue: false, permission: 'deny', user_message: reason,
+                permissionDecision: 'deny', permissionDecisionReason: reason,
+                hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'deny', permissionDecisionReason: reason } }) + '\n', exitCode: 0 };
+    }
     // `continue` is the Cursor prompt shape, `permission` the Cursor action
     // shape; Claude-format clients ignore unknown keys and treat the absence
     // of a decision as allow.
@@ -1272,8 +1282,8 @@ async function hookCommandInner(args, config, io) {
     // machine applies it on the next poll. Cached locally (stale-while-error), so
     // this is instant when fresh and bounded (~1.5s) only when stale.
     let machineSuspended = false;
-    let modeResolved = false; // add this line
-    if (!forceMonitor && !forceEnforce && shieldId) {
+    let modeResolved = false;
+    if (shieldId) {
         try {
             const bundle = await (0, runtimeConfig_1.getRuntimeBundle)({ apiUrl, shieldId, shieldKey, developerName: developerId(), machineName: os.hostname(), hotPath: true });
             // Kill-switch holds even on a 'default' bundle: with the cache missing
@@ -1285,8 +1295,8 @@ async function hookCommandInner(args, config, io) {
                 shadow = false;
             }
             if (bundle.source !== 'default') {
-                shadow = bundle.mode !== 'block'; // 'monitor'/'shadow' => report-only
-                modeResolved = true; // add this line
+                shadow = forceMonitor || bundle.mode !== 'block'; // A known Shield Monitor mode cannot be overridden locally.
+                modeResolved = true;
                 effectivePolicyHash = bundle.policyHash || bundle.version;
                 // Cached org policies: hash-covered by the bundle ETag, evaluated
                 // locally when the policy gate is unreachable (offline enforcement).
@@ -1308,7 +1318,7 @@ async function hookCommandInner(args, config, io) {
         shadow = true;
         (0, hookIo_1.dbg)({ phase: 'mode_default_monitor_first', shadow });
     }
-    if (forceEnforce)
+    if (forceEnforce && !modeResolved)
         shadow = false;
     // Keep device liveness fresh during active use (throttled, detached — never blocks).
     if (shieldId)
@@ -1335,7 +1345,8 @@ async function hookCommandInner(args, config, io) {
     // client that reads ~/.claude/settings.json.
     const claudeNormalized = normalizeClaudePayload(payload);
     const hookFormat = claudeNormalized ? 'claude' : 'cursor';
-    const client = claudeNormalized ? claudeFormatClient() : 'cursor';
+    const client = args.agentClient || (claudeNormalized ? claudeFormatClient() : 'cursor');
+    (0, telemetry_1.setVerdictClient)(client);
     let event;
     let ignoreEvent = false;
     if (claudeNormalized) {
@@ -1422,6 +1433,10 @@ async function hookCommandInner(args, config, io) {
             }
             else if (denied || ask) {
                 decision = {
+                    // Copilot CLI reads the top-level decision; Claude Code and VS Code
+                    // read hookSpecificOutput. Emit the same verdict in both contracts.
+                    permissionDecision: ask ? 'ask' : 'deny',
+                    permissionDecisionReason: userMsg || agentMsg || 'FullCourtDefense policy decision.',
                     hookSpecificOutput: {
                         hookEventName: 'PreToolUse',
                         permissionDecision: ask ? 'ask' : 'deny',

package/dist/commands/installAll.js

@@ -5,6 +5,7 @@ const config_1 = require("../config");
 const discover_1 = require("./discover");
 const installCursorHook_1 = require("./installCursorHook");
 const installClaudeHook_1 = require("./installClaudeHook");
+const installNativeHooks_1 = require("./installNativeHooks");
 const discoverSchedule_1 = require("./discoverSchedule");
 const mcpGateway_1 = require("./mcpGateway");
 const autoProtect_1 = require("./autoProtect");
@@ -35,6 +36,16 @@ async function installAllCommand(args, config) {
     console.log('\x1b[2mAuto-protect MCP servers across AI clients + Cursor built-in action hooks. No --mcp-command or folder path needed.\x1b[0m\n');
     await (0, mcpGateway_1.protectAllCommand)(gatewayArgs, config);
     if (args.hooks !== 'false') {
+        try {
+            const nativeFiles = (0, installNativeHooks_1.installNativeHooks)();
+            for (const file of nativeFiles)
+                console.log(`Native action hooks configured: ${file}`);
+            if (nativeFiles.some(file => file.includes('.codex')))
+                console.log('Codex: review and trust the new hooks using /hooks before they can run.');
+        }
+        catch (error) {
+            console.error(`Native hooks incomplete: ${error instanceof Error ? error.message : String(error)}. Repair the settings and rerun install-native-hooks.`);
+        }
         console.log('\n\x1b[1mInstalling Cursor runtime hooks…\x1b[0m');
         const hookArgs = {
             shieldId: creds.shieldId,
@@ -53,8 +64,8 @@ async function installAllCommand(args, config) {
         catch (error) {
             console.log(`Cursor hooks skipped: ${error instanceof Error ? error.message : String(error)}`);
         }
-        // ONE Claude-format hook file (~/.claude/settings.json) covers Claude Code,
-        // VS Code Copilot agent mode, and GitHub Copilot CLI.
+        // Claude/VS Code share Claude settings; Copilot CLI receives separate
+        // user tool hooks from the same installer.
         console.log('\n\x1b[1mInstalling Claude Code / VS Code / Copilot CLI runtime hooks…\x1b[0m');
         const claudeHookArgs = {
             shieldId: creds.shieldId,

package/dist/commands/installClaudeHook.d.ts

@@ -3,14 +3,14 @@ import { BotGuardConfig } from '../config';
  * `fullcourtdefense install-claude-hook` — Claude-format hook installer.
  *
  * Writes PreToolUse + UserPromptSubmit hooks into ~/.claude/settings.json.
- * That ONE file is read by THREE clients:
+ * That file is read by:
  *   - Claude Code (CLI + desktop)
  *   - VS Code Copilot agent mode (user-scope Claude-format hooks)
- *   - GitHub Copilot CLI
+ * Copilot CLI additionally receives user hooks in ~/.copilot/settings.json.
  *
  * The hook command is the same `fullcourtdefense hook` bridge used for Cursor —
  * it detects the Claude payload format from stdin (`hook_event_name`), so no
- * per-client configuration is needed. VS Code ignores `matcher` values (hooks
+ * payload adapter is needed for those PascalCase hooks. VS Code ignores `matcher` values (hooks
  * run on every tool), so the bridge self-filters by tool name and returns an
  * empty verdict for tools we don't police.
  */
@@ -35,5 +35,11 @@ export interface ClaudeManagedHookRepairResult {
 export declare function inspectClaudeManagedHooks(): ClaudeManagedHookRepairResult;
 /** Repair managed commands without changing matcher/event/fail-open behavior. */
 export declare function repairClaudeManagedHooks(): ClaudeManagedHookRepairResult;
+/** Copilot CLI user settings are separate from Claude's global settings.
+ * Use inline settings, not ~/.copilot/hooks, which VS Code also loads and
+ * would therefore execute twice alongside its Claude hook.
+ */
+export declare function syncCopilotToolHooks(command?: string): boolean;
+export declare function installCopilotHookCommand(): void;
 export declare function installClaudeHookCommand(args: InstallClaudeHookArgs, config: BotGuardConfig): Promise<void>;
 export declare function uninstallClaudeHookCommand(args: InstallClaudeHookArgs): Promise<void>;

package/dist/commands/installClaudeHook.js

@@ -35,6 +35,8 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.inspectClaudeManagedHooks = inspectClaudeManagedHooks;
 exports.repairClaudeManagedHooks = repairClaudeManagedHooks;
+exports.syncCopilotToolHooks = syncCopilotToolHooks;
+exports.installCopilotHookCommand = installCopilotHookCommand;
 exports.installClaudeHookCommand = installClaudeHookCommand;
 exports.uninstallClaudeHookCommand = uninstallClaudeHookCommand;
 const fs = __importStar(require("fs"));
@@ -189,7 +191,47 @@ function repairClaudeManagedHooks() {
         fs.mkdirSync(path.dirname(before.file), { recursive: true });
         fs.writeFileSync(before.file, JSON.stringify(settings, null, 2) + '\n', 'utf8');
     }
-    return { ...before, changed };
+    const copilotChanged = syncCopilotToolHooks(buildHookCommand({ shadow: false, failClosed: false }));
+    return { ...before, changed: changed || copilotChanged };
+}
+/** Copilot CLI user settings are separate from Claude's global settings.
+ * Use inline settings, not ~/.copilot/hooks, which VS Code also loads and
+ * would therefore execute twice alongside its Claude hook.
+ */
+function syncCopilotToolHooks(command) {
+    const root = process.env.COPILOT_HOME || path.join(os.homedir(), '.copilot');
+    const file = path.join(root, 'settings.json');
+    if (!command && !fs.existsSync(file))
+        return false;
+    // Preserve user settings: malformed existing JSON must never be overwritten.
+    const settings = fs.existsSync(file) ? JSON.parse(fs.readFileSync(file, 'utf8')) : {};
+    if (!settings || typeof settings !== 'object' || Array.isArray(settings))
+        throw new Error(`Invalid Copilot settings: ${file}`);
+    const before = JSON.stringify(settings);
+    const hooks = settings.hooks && typeof settings.hooks === 'object' ? settings.hooks : {};
+    for (const event of ['PreToolUse', 'PostToolUse']) {
+        const entries = Array.isArray(hooks[event]) ? hooks[event] : [];
+        const kept = entries.filter(entry => !isManagedCommand(entry));
+        if (command)
+            kept.push({ type: 'command', command: `${command} --agent-client copilot`, timeoutSec: event === 'PreToolUse' ? TOOL_HOOK_TIMEOUT_SEC : POST_TOOL_HOOK_TIMEOUT_SEC });
+        if (kept.length)
+            hooks[event] = kept;
+        else
+            delete hooks[event];
+    }
+    if (Object.keys(hooks).length)
+        settings.hooks = hooks;
+    else
+        delete settings.hooks;
+    if (before === JSON.stringify(settings))
+        return false;
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    fs.writeFileSync(file, JSON.stringify(settings, null, 2) + '\n', 'utf8');
+    return true;
+}
+function installCopilotHookCommand() {
+    syncCopilotToolHooks(buildHookCommand({ shadow: false, failClosed: false }));
+    console.log('Copilot CLI tool hooks configured. Restart Copilot CLI to load the changes.');
 }
 // PostToolUse companion of PreToolUse: enforces nothing; it is how a developer's
 // Allow on the client's own `ask` prompt (developer-scoped approval) is learned.
@@ -290,11 +332,13 @@ async function installClaudeHookCommand(args, config) {
     }
     fs.mkdirSync(path.dirname(file), { recursive: true });
     fs.writeFileSync(file, JSON.stringify(settings, null, 2) + '\n', 'utf8');
+    if (!projectScope)
+        syncCopilotToolHooks(wantTools ? command : undefined);
     console.log('');
     console.log(`${COLOR.green}${COLOR.bold}FullCourtDefense Claude-format hook installed.${COLOR.reset}`);
     console.log(`${COLOR.gray}Scope:${COLOR.reset} ${projectScope ? 'project (.claude/settings.json)' : 'machine-wide (~/.claude/settings.json)'}`);
     console.log(`${COLOR.gray}File:${COLOR.reset}  ${file}`);
-    console.log(`${COLOR.gray}Covers:${COLOR.reset} Claude Code, VS Code Copilot agent mode, GitHub Copilot CLI (all read this file)`);
+    console.log(`${COLOR.gray}Covers:${COLOR.reset} Claude Code and VS Code Copilot; Copilot CLI tool hooks use ${projectScope ? 'this project configuration' : 'separate user settings in .copilot/settings.json'}.`);
     console.log(`${COLOR.gray}Note:${COLOR.reset} Claude Desktop's regular chat has no hook — it is protected separately by the Windows chat guard the daemon runs (advisory).`);
     const parts = [];
     if (wantTools)
@@ -318,6 +362,8 @@ async function installClaudeHookCommand(args, config) {
 }
 async function uninstallClaudeHookCommand(args) {
     const projectScope = args.project === 'true';
+    if (!projectScope)
+        syncCopilotToolHooks();
     const file = settingsPath(projectScope);
     if (!fs.existsSync(file)) {
         console.log(`${COLOR.yellow}No settings.json found at ${file}. Nothing to remove.${COLOR.reset}`);

package/dist/commands/installNativeHooks.d.ts

@@ -0,0 +1,9 @@
+import type { NativeClient } from '../nativeHook';
+export declare function nativeHookCommand(client: NativeClient): string;
+/** Preserve unrelated settings and hooks; refuse malformed files. */
+export declare function installNativeHooks(options?: {
+    home?: string;
+    project?: string;
+    clients?: NativeClient[];
+    remove?: boolean;
+}): string[];