fullcourtdefense-cli 1.32.0 → 1.34.0

package/dist/commands/installNativeHooks.js

@@ -0,0 +1,145 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.nativeHookCommand = nativeHookCommand;
+exports.installNativeHooks = installNativeHooks;
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const marker = '--fcd-native-managed true';
+const managed = (value) => {
+    if (typeof value?.command !== 'string')
+        return false;
+    if (value.command.includes(marker))
+        return true;
+    const encoded = /-EncodedCommand ([A-Za-z0-9+/=]+)$/.exec(value.command)?.[1];
+    return Boolean(encoded && Buffer.from(encoded, 'base64').toString('utf16le').includes(marker));
+};
+const quote = (value) => `'${value.replace(/'/g, `'"'"'`)}'`;
+function nativeHookCommand(client) {
+    if (!['codex', 'gemini_cli', 'windsurf', 'kiro'].includes(client))
+        throw new Error('Unsupported native hook client');
+    const entry = path.resolve(__dirname, '..', 'nativeHook.js');
+    const flags = `--agent-client ${client} ${marker} --fcd-managed true --local-only true`;
+    if (process.platform !== 'win32')
+        return `${quote(process.execPath)} ${quote(entry)} ${flags}`;
+    // Windows vendors use different shells. An encoded PowerShell launcher is
+    // valid in both cmd and PowerShell, preserves paths with spaces, and forwards
+    // the JSON stdin explicitly. Paths are data, never interpolated expressions.
+    const psQuote = (value) => `'${value.replace(/'/g, "''")}'`;
+    const script = `$ProgressPreference='SilentlyContinue'; $OutputEncoding=[Text.UTF8Encoding]::new($false); [Console]::InputEncoding=$OutputEncoding; [Console]::OutputEncoding=$OutputEncoding; $raw=[Console]::In.ReadToEnd(); $raw | & ${psQuote(process.execPath)} ${psQuote(entry)} ${flags}; exit $LASTEXITCODE`;
+    return `powershell.exe -NoProfile -NonInteractive -EncodedCommand ${Buffer.from(script, 'utf16le').toString('base64')}`;
+}
+/** Preserve unrelated settings and hooks; refuse malformed files. */
+function installNativeHooks(options = {}) {
+    // Validate library callers too, before any filesystem changes.
+    for (const client of options.clients || [])
+        nativeHookCommand(client);
+    const home = options.home || os.homedir();
+    const files = [];
+    const errors = [];
+    for (const client of options.clients || ['codex', 'gemini_cli', 'windsurf', 'kiro']) {
+        const root = client === 'codex' ? path.join(home, '.codex') : client === 'gemini_cli' ? path.join(home, '.gemini')
+            : client === 'windsurf' ? path.join(home, '.codeium', 'windsurf') : path.join(options.project || process.cwd(), '.kiro');
+        // Install only detected clients. Explicit client selection also supports setup before first launch.
+        if (!options.clients && !fs.existsSync(root))
+            continue;
+        const file = path.join(root, client === 'kiro' ? 'hooks/fullcourtdefense.json' : client === 'gemini_cli' ? 'settings.json' : 'hooks.json');
+        if (options.remove && !fs.existsSync(file))
+            continue;
+        try {
+            const data = fs.existsSync(file) ? JSON.parse(fs.readFileSync(file, 'utf8')) : {};
+            if (!data || typeof data !== 'object' || Array.isArray(data))
+                throw new Error(`Invalid hook settings: ${file}`);
+            const before = JSON.stringify(data);
+            const command = nativeHookCommand(client);
+            if (client === 'kiro') {
+                if (data.hooks !== undefined && !Array.isArray(data.hooks))
+                    throw new Error(`Invalid Kiro hooks: ${file}`);
+                const kept = (data.hooks || []).filter((hook) => !managed(hook.action));
+                data.version = 'v1';
+                data.hooks = options.remove ? kept : [...kept, ...['PreToolUse', 'PostToolUse', 'UserPromptSubmit'].map(trigger => ({
+                        name: `FullCourtDefense ${trigger}`, trigger, action: { type: 'command', command }, timeout: 130,
+                    }))];
+            }
+            else {
+                if (data.hooks !== undefined && (!data.hooks || typeof data.hooks !== 'object' || Array.isArray(data.hooks)))
+                    throw new Error(`Invalid hooks: ${file}`);
+                const hooks = data.hooks || {};
+                const events = client === 'windsurf'
+                    ? ['pre_run_command', 'post_run_command', 'pre_read_code', 'pre_write_code', 'post_write_code', 'pre_mcp_tool_use', 'post_mcp_tool_use', 'pre_user_prompt']
+                    : client === 'gemini_cli' ? ['BeforeTool', 'AfterTool', 'BeforeAgent'] : ['PreToolUse', 'PostToolUse', 'UserPromptSubmit'];
+                for (const event of events) {
+                    if (hooks[event] !== undefined && !Array.isArray(hooks[event]))
+                        throw new Error(`Invalid ${event} hooks: ${file}`);
+                    const entries = hooks[event] || [];
+                    const kept = client === 'windsurf' ? entries.filter((hook) => !managed(hook)) : entries.flatMap((group) => {
+                        if (!Array.isArray(group?.hooks))
+                            throw new Error(`Invalid ${event} hook group: ${file}`);
+                        const rest = group.hooks.filter((hook) => !managed(hook));
+                        return rest.length ? [{ ...group, hooks: rest }] : [];
+                    });
+                    if (!options.remove) {
+                        if (client === 'windsurf')
+                            kept.push({ command, powershell: `${command}; exit $LASTEXITCODE`, show_output: true });
+                        else
+                            kept.push({ ...(event.includes('Tool') ? { matcher: '.*' } : {}), hooks: [{ type: 'command', command,
+                                        ...(client === 'gemini_cli' ? { name: `fullcourtdefense-${event}`, timeout: 130000 } : { timeout: 130 }) }] });
+                    }
+                    if (kept.length)
+                        hooks[event] = kept;
+                    else
+                        delete hooks[event];
+                }
+                data.hooks = hooks;
+            }
+            if (JSON.stringify(data) !== before) {
+                fs.mkdirSync(path.dirname(file), { recursive: true });
+                if (fs.existsSync(file) && !fs.existsSync(`${file}.fcd-backup`))
+                    fs.copyFileSync(file, `${file}.fcd-backup`);
+                const temporary = `${file}.fcd-${process.pid}.tmp`;
+                fs.writeFileSync(temporary, JSON.stringify(data, null, 2) + '\n', { mode: 0o600 });
+                fs.renameSync(temporary, file);
+            }
+            files.push(file);
+        }
+        catch (error) {
+            errors.push(`${file}: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
+    if (errors.length)
+        throw new Error(`Native hook settings need repair: ${errors.join('; ')}`);
+    return files;
+}

package/dist/commands/mcpGateway.js

@@ -1086,7 +1086,7 @@ class McpGatewayServer {
         // waited for OUR decision (path 'gateway'). Pure in-memory context — no
         // probe, no I/O; the clock is restarted after the downstream call so the
         // tool's own runtime is never billed to FullCourtDefense.
-        return (0, telemetry_1.markVerdictTiming)({ startedAt: Date.now(), path: 'gateway' }, () => this.handleToolCallInner(params));
+        return (0, telemetry_1.markVerdictTiming)({ startedAt: Date.now(), path: 'gateway', agentClient: this.gatewayConfig.agentClient }, () => this.handleToolCallInner(params));
     }
     async handleToolCallInner(params) {
         await this.ensureDownstream();
@@ -1109,6 +1109,8 @@ class McpGatewayServer {
         let downstreamResult;
         let downstreamAttempted = false;
         let downstreamRan = false;
+        let reportOnlyMode = true;
+        let policyWarning;
         try {
             // The runtime bundle carries the org's current Local Safety policy hash —
             // passing it as `expectedPolicyHash` makes a console policy edit take
@@ -1123,7 +1125,7 @@ class McpGatewayServer {
             let cachedPolicies;
             // Monitor unless a server/cache bundle explicitly says 'block': a machine
             // with no signal (fresh install + offline, wiped cache) must never block.
-            let reportOnlyMode = true;
+            reportOnlyMode = true;
             let machineRole;
             try {
                 const bundle = await (0, runtimeConfig_1.getRuntimeBundle)({
@@ -1183,6 +1185,10 @@ class McpGatewayServer {
                 expectedPolicyHash,
                 preferCached: reportOnlyMode,
             });
+            if (reportOnlyMode && snapshot) {
+                snapshot.itemActions = Object.fromEntries(Object.entries(snapshot.itemActions || {}).map(([id, action]) => [id, action === 'mask' ? 'warn' : action]));
+                snapshot.customBlocks = snapshot.customBlocks.map(rule => rule.action === 'mask' ? { ...rule, action: 'warn' } : rule);
+            }
             const requestOutcome = (0, deterministicGuard_1.resolveDeterministicOutcome)(opts => (0, deterministicGuard_1.scanDeterministicToolCall)(toolName, toolArgs, opts), (0, localSafetySnapshot_1.snapshotToScanOptions)(snapshot));
             for (const warning of requestOutcome.warnings) {
                 this.spoolLocalFinding(warning, toolName, operation, 'warn');
@@ -1238,7 +1244,7 @@ class McpGatewayServer {
                         localBlock = undefined;
                     }
                     else {
-                        (0, devConfirm_1.settleDeveloperConfirmation)('mcp_gateway', toolName, digest);
+                        (0, devConfirm_1.rejectDeveloperConfirmation)('mcp_gateway', toolName, digest);
                         const how = answer.answer === 'timeout' ? 'developer confirmation not given (prompt timed out)' : 'developer declined in MCP client prompt';
                         (0, telemetry_1.spoolEvent)({
                             decision: 'block', toolName, operation: rememberScope.operation,
@@ -1311,8 +1317,8 @@ class McpGatewayServer {
                 // MONITOR CONTRACT (latency half): a monitor/no-signal machine makes
                 // ZERO synchronous network calls. The verdict is always allow; the
                 // "would block" signal comes from the locally cached policy bundle,
-                // and the console report is fired without awaiting (server records the
-                // action and its own verdict; failures spool for the next flush).
+                // and the console report uses the audit spool. checkToolCall is an
+                // enforcing endpoint: even an unawaited request can open approvals.
                 const inferred = (0, actionPolicyEngine_1.inferToolContext)(toolName, toolArgs);
                 const localOperation = operation || inferred.operation;
                 if (cachedPolicies && cachedPolicies.length > 0) {
@@ -1333,22 +1339,8 @@ class McpGatewayServer {
                         process.stderr.write(`FullCourtDefense (monitor) would ${wouldWhat} ${toolName}: ${local.reason || local.verdict}\n`);
                     }
                 }
-                // PROXY RESILIENCE: while the gate is in its recently-down window
-                // (bank proxy, backend outage) don't even fire the async report —
-                // spool straight to disk; the flush child delivers it when the
-                // network returns. Zero network churn per call during an outage.
-                if ((0, policyGateHealth_1.gateRecentlyDown)()) {
-                    (0, telemetry_1.spoolEvent)({ decision: 'allow', toolName, operation: localOperation, reason: 'monitor: action recorded locally (gate recently unreachable)', offlineEnforced: true });
-                    (0, telemetry_1.triggerFlush)(false);
-                }
-                else {
-                    void this.api.checkToolCall({ toolName, operation, toolArgs }, 1_500)
-                        .then(() => (0, policyGateHealth_1.recordGateSuccess)())
-                        .catch(() => {
-                        (0, telemetry_1.spoolEvent)({ decision: 'allow', toolName, operation: localOperation, reason: 'monitor: action recorded locally (console unreachable)', offlineEnforced: true });
-                        (0, telemetry_1.triggerFlush)(false);
-                    });
-                }
+                (0, telemetry_1.spoolEvent)({ decision: 'allow', toolName, operation: localOperation, reason: 'monitor: action allowed and recorded without requesting approval' });
+                (0, telemetry_1.triggerFlush)(false);
                 preflight = { allowed: true, decision: 'allow', operation: localOperation };
             }
             else if (cachedPolicies && cachedPolicies.length > 0) {
@@ -1388,6 +1380,8 @@ class McpGatewayServer {
                     // "Warn only": the call runs, the fleet records Warned (not a silent
                     // allow). Final verdict — no gate round trip; the audit rides the spool.
                     const reason = local.reason || `${toolName}: flagged by org Action Policy`;
+                    policyWarning = reason;
+                    process.stderr.write(`FullCourtDefense warning: ${reason}\n`);
                     (0, telemetry_1.spoolEvent)({ decision: 'warn', toolName, operation: localOperation, reason: `policy warn (local-first): ${reason}`, ruleId: local.policyName ? `action-policy:${local.policyName}` : undefined, offlineEnforced: true });
                     (0, telemetry_1.triggerFlush)(false);
                     preflight = { allowed: true, decision: 'allow', operation: localOperation };
@@ -1470,9 +1464,9 @@ class McpGatewayServer {
                         process.stderr.write(`FullCourtDefense offline: policy service unreachable (${detail}); ${toolName} checked against locally cached org policies → ${blocking ? `${local.verdict} (report-only)` : 'allow'}.\n`);
                         preflight = { allowed: true, decision: 'allow', operation: localOperation };
                     }
-                    else if (this.gatewayConfig.failClosed && (!reportOnlyMode || this.gatewayConfig.failClosedExplicit)) {
+                    else if (this.gatewayConfig.failClosed && !reportOnlyMode) {
                         // Fail-closed only bites when the machine is actually in block mode
-                        // (or the operator passed --fail-closed explicitly at install time).
+                        // An explicit --fail-closed flag never overrides Shield Monitor.
                         // A monitor machine must never hard-block — not even during an
                         // outage with a bundle-supplied failClosed=true left over.
                         (0, telemetry_1.spoolEvent)({ decision: 'block', toolName, operation, reason: `fail-closed: ${detail}`, offlineEnforced: true });
@@ -1575,13 +1569,13 @@ class McpGatewayServer {
                 }
             }
             if (responseOutcome.maskFindings.length > 0) {
-                // mask-action rules: redact the matched secrets in place. Masking is
-                // monitor-compatible (a redaction is not a block), so it applies in
-                // every mode. If the result shape cannot be rewritten (secret hidden
+                // Enforcing mask-action rules redact matched secrets in place.
+                // Monitor snapshots downgrade mask to warn before evaluation.
+                // If the result shape cannot be rewritten (secret hidden
                 // in a non-text payload), fail strict and block — a mask rule must
                 // never leak what it was set to hide — except under monitor, where
                 // the contract is observe-only: record the would-block and pass the
-                // response through with whatever partial masking was possible.
+                // original response through.
                 const { masked, fullyMasked } = maskToolResult(rawResult, responseOutcome.maskFindings);
                 if (!fullyMasked) {
                     const finding = responseOutcome.maskFindings[0];
@@ -1642,10 +1636,11 @@ class McpGatewayServer {
             let finalResult = rawResult;
             if (effectiveScanResponse) {
                 try {
-                    finalResult = await this.api.scanToolResponse({ toolName, operation, toolArgs, result: rawResult });
+                    const scannedResult = await this.api.scanToolResponse({ toolName, operation, toolArgs, result: rawResult });
+                    finalResult = reportOnlyMode ? rawResult : scannedResult;
                 }
                 catch (scanErr) {
-                    if (isBlockError(scanErr))
+                    if (isBlockError(scanErr) && !reportOnlyMode)
                         throw scanErr; // Shield verdict — a real block
                     // Scan API/infra failure. On an ENFORCING machine, returning the raw
                     // response would silently skip the org's exfil scan — that is a
@@ -1656,7 +1651,7 @@ class McpGatewayServer {
                         (0, telemetry_1.triggerFlush)(true);
                         throw blockError(`FullCourtDefense could not scan the ${toolName} response (${detail}) and this machine enforces response scanning — response withheld. Retry once the scan service is reachable.`);
                     }
-                    (0, telemetry_1.spoolEvent)({ decision: 'warn', toolName, operation, reason: `[monitor] response scan unavailable: ${detail.slice(0, 200)}`, offlineEnforced: true });
+                    (0, telemetry_1.spoolEvent)({ decision: 'warn', toolName, operation, reason: `[monitor] ${isBlockError(scanErr) ? 'response would be blocked' : 'response scan unavailable'}: ${detail.slice(0, 200)}`, offlineEnforced: true });
                     (0, telemetry_1.triggerFlush)(false);
                     process.stderr.write(`FullCourtDefense (monitor): response scan unavailable for ${toolName} (${detail}) — response passed through.\n`);
                     finalResult = rawResult;
@@ -1678,6 +1673,10 @@ class McpGatewayServer {
                     (0, telemetry_1.triggerFlush)(false);
                 });
             }
+            if (policyWarning && finalResult && typeof finalResult === 'object') {
+                const result = finalResult;
+                finalResult = { ...result, content: [...(Array.isArray(result.content) ? result.content : []), { type: 'text', text: `FullCourtDefense warning: ${policyWarning}` }] };
+            }
             return finalResult;
         }
         catch (error) {
@@ -1713,6 +1712,14 @@ class McpGatewayServer {
                     content: [{ type: 'text', text: 'This machine is suspended by your security team — all AI agent actions are blocked. Contact your admin to resume it.' }],
                 };
             }
+            if (!isBlockError(error) && !downstreamAttempted && !reportOnlyMode && this.gatewayConfig.failClosed) {
+                try {
+                    (0, telemetry_1.spoolEvent)({ decision: 'block', toolName, operation, reason: `fail-closed: gateway evaluation failed: ${message.slice(0, 200)}`, offlineEnforced: true });
+                    (0, telemetry_1.triggerFlush)(true);
+                }
+                catch { /* preserve the configured decision even when telemetry fails */ }
+                return { isError: true, blocked: true, content: [{ type: 'text', text: 'FullCourtDefense could not verify this action. Your administrator enabled fail-closed. Retry after policy checking recovers.' }] };
+            }
             if (!isBlockError(error) && downstreamRan) {
                 // Post-call scan bug: the tool already succeeded — return its result.
                 try {
@@ -1807,7 +1814,7 @@ class McpGatewayServer {
         const sessionId = runtimeSessionId() || this.gatewaySessionId;
         const policyLabel = verdict.policyName ? ` (${verdict.policyName})` : '';
         const ruleId = verdict.policyName ? `action-policy:${verdict.policyName}` : undefined;
-        const remembered = (0, devConfirm_1.isConfirmationRemembered)(rememberScope, sessionId);
+        const remembered = verdict.approval?.remember === 'none' ? undefined : (0, devConfirm_1.isConfirmationRemembered)(rememberScope, sessionId);
         if (remembered) {
             (0, telemetry_1.spoolEvent)({
                 decision: 'allow', toolName, operation,
@@ -1837,11 +1844,11 @@ class McpGatewayServer {
         const answer = await this.elicitDeveloperConfirmation({
             toolName,
             reason: `${verdict.reason || `${toolName} needs your confirmation`}.${ceiling}`,
+            allowRemember: false,
             ruleLabel: verdict.policyName ? `Action Policy "${verdict.policyName}"${verdict.matchedRule ? ` — ${verdict.matchedRule}` : ''}` : 'Action Policy',
         });
         if (answer.answer === 'accept') {
-            if (answer.remember && remember === 'none')
-                (0, devConfirm_1.raiseDeveloperConfirmation)({ ...marker, remember: 'session' });
+            // Policy memory limits are authoritative; a client cannot upgrade 'none'.
             (0, devConfirm_1.settleDeveloperConfirmation)('mcp_gateway', toolName, digest);
             (0, telemetry_1.spoolEvent)({
                 decision: 'allow', toolName, operation,
@@ -1851,7 +1858,7 @@ class McpGatewayServer {
             (0, telemetry_1.triggerFlush)(false);
             return true;
         }
-        (0, devConfirm_1.settleDeveloperConfirmation)('mcp_gateway', toolName, digest);
+        (0, devConfirm_1.rejectDeveloperConfirmation)('mcp_gateway', toolName, digest);
         const how = answer.answer === 'timeout' ? 'developer confirmation not given (prompt timed out)' : 'developer declined in MCP client prompt';
         (0, telemetry_1.spoolEvent)({
             decision: 'block', toolName, operation,
@@ -1875,12 +1882,12 @@ class McpGatewayServer {
                         description: 'Yes runs the tool call once. No (or closing this dialog) does not run it.',
                         default: false,
                     },
-                    remember: {
-                        type: 'boolean',
-                        title: 'Remember for this session',
-                        description: 'Do not ask again for this tool and rule until this MCP session ends (max 12 hours).',
-                        default: false,
-                    },
+                    ...(input.allowRemember === false ? {} : { remember: {
+                            type: 'boolean',
+                            title: 'Remember for this session',
+                            description: 'Do not ask again for this tool and rule until this MCP session ends (max 12 hours).',
+                            default: false,
+                        } }),
                 },
                 required: ['confirm'],
             },
@@ -1891,7 +1898,7 @@ class McpGatewayServer {
         const result = (response.result && typeof response.result === 'object') ? response.result : undefined;
         const content = (result?.content && typeof result.content === 'object') ? result.content : undefined;
         if (result?.action === 'accept' && content?.confirm === true) {
-            return { answer: 'accept', remember: content.remember === true, latencyMs };
+            return { answer: 'accept', remember: input.allowRemember !== false && content.remember === true, latencyMs };
         }
         return { answer: 'decline', remember: false, latencyMs };
     }

package/dist/commands/posixShellGuard.js

@@ -173,10 +173,10 @@ function buildGuardJs(nodePath, cliEntry) {
         `// exec), $( ) substitution, or real backtick command substitution (>=2 chars; a 1-char pair is a PS escape).`,
         `function execView(line){if(/\\b(?:iex|invoke-expression|invoke-command)\\b|\\beval\\b|\\bxargs\\b|\\bbase64\\b[^\\n]*(?:-d\\b|--decode\\b)|frombase64string|-encodedcommand\\b|\\s-enc\\s|\\|\\s*&?\\s*(?:sh|bash|zsh|dash|ksh|csh|pwsh|powershell(?:\\.exe)?|cmd(?:\\.exe)?|node|python[0-9.]*|perl|ruby)\\b|\\b(?:sh|bash|zsh|dash|ksh|csh|pwsh|powershell(?:\\.exe)?|cmd(?:\\.exe)?|node|python[0-9.]*|perl|ruby)\\s+(?:-c|\\/c|-e|-command|-scriptblock)\\b|\\b(?:ssh|wsl(?:\\.exe)?|chroot)\\b|\\b(?:docker|kubectl|podman|nerdctl)(?:\\.exe)?\\s+(?:exec|run)\\b/i.test(line))return line;const K=/\\$\\(|\`[^\`]{2,}\`/;const C=/(?:(?:^|[;&|(]|\\s)(?:-c|\\/c|-e|-command|-scriptblock|-filter)[= ]\\s*|(?:^|[;&|(]\\s*)(?:\\S*[\\\\\\/])?(?:sudo\\s+|doas\\s+)?(?:ssh|wsl(?:\\.exe)?|chroot|su|screen|tmux)(?:\\s[^;&|"']*)?\\s|(?:\\S*[\\\\\\/])?(?:docker|kubectl|podman|nerdctl)(?:\\.exe)?\\s+(?:exec|run)\\b[^;&|"']*\\s)$/i;let o=line;o=o.replace(/@'[\\s\\S]*?'@/g,' fcd_inert_data ');o=o.replace(/@"[\\s\\S]*?"@/g,m=>m.includes('$(')?m:' fcd_inert_data ');o=o.replace(/<<-?\\s*'(\\w+)'[\\s\\S]*?(?:\\n\\1\\b|$)/g,' fcd_inert_data ');o=o.replace(/<<-?\\s*"?(\\w+)"?[\\s\\S]*?(?:\\n\\1\\b|$)/g,m=>K.test(m)?m:' fcd_inert_data ');const s=o;o=s.replace(/"((?:[^"\\\\]|\\\\.)*)"|'((?:[^'\\\\]|\\\\.)*)'/g,(w,dq,sq,i)=>{const b=dq!==undefined?dq:(sq||'');if(!/\\s/.test(b))return w;if(C.test(s.slice(Math.max(0,i-80),i)))return w;if(dq!==undefined&&K.test(b))return w;return ' fcd_inert_data ';});return o;}`,
         `// Precedence on one line: block outranks ask, ask outranks warn.`,
-        `function matchLine(line,rules){const n=line.replace(/\\s+/g,' ').trim();const x=execView(line);const xn=x.replace(/\\s+/g,' ').trim();let warnHit=null,askHit=null;for(const r of rules){try{const t=r.source==='custom'?line:x;const tn=r.source==='custom'?n:xn;if(r.re.test(tn)||r.re.test(t)){if(r.action==='block')return r;if(r.action==='ask'){if(!askHit)askHit=r;}else if(!warnHit)warnHit=r;}}catch{}}return askHit||warnHit;}`,
+        `function matchLine(line,rules){const n=line.replace(/\\s+/g,' ').trim();const x=execView(line);const xn=x.replace(/\\s+/g,' ').trim();let warnHit=null;const asks=[];for(const r of rules){try{const t=r.source==='custom'?line:x;const tn=r.source==='custom'?n:xn;if(r.re.test(tn)||r.re.test(t)){if(r.action==='block')return r;if(r.action==='ask'){asks.push(r);}else if(!warnHit)warnHit=r;}}catch{}}if(asks.length===1)return asks[0];if(asks.length>1){asks.sort((a,b)=>a.id<b.id?-1:a.id>b.id?1:0);return{...asks[0],id:'asks:'+asks.map(r=>encodeURIComponent(r.id)).join('+'),reason:asks.map(r=>r.reason).join('; ')}}return warnHit;}`,
         `function triggerFlush(){try{if(fs.existsSync(NODE_PATH)&&fs.existsSync(CLI_ENTRY)){const c=spawn(NODE_PATH,[CLI_ENTRY,'flush-spool','--heartbeat','true'],{detached:true,stdio:'ignore'});c.unref();}}catch{}}`,
         `// developer: '' | 'confirmed' | 'remembered' | 'declined' | 'timeout' | 'ide' | 'agent-terminal' — the "ask" outcome, reported with the same facts as an IDE prompt.`,
-        `function spoolEvent(rule,line,decision,developer){try{const ev=line.trim();const evidence=ev.length>180?ev.slice(0,180)+'...':ev;let reason='Shell guard: '+rule.reason;if(developer==='confirmed')reason='developer confirmed in terminal prompt — '+reason;else if(developer==='remembered')reason='developer confirmed earlier in this shell (session memory) — '+reason;else if(developer==='declined')reason='developer declined in terminal prompt — '+reason;else if(developer==='timeout')reason='developer confirmation not given (terminal prompt timed out) — '+reason;else if(developer==='ide')reason='developer confirmed in the IDE prompt (agent-driven terminal) — '+reason;else if(developer==='agent-terminal')reason='ask cannot be answered in an agent-driven terminal (no IDE confirmation) — '+reason;const event={eventId:crypto.randomUUID(),type:'verdict',decision,toolName:'shell_terminal',operation:'shell_command',reason,ruleId:rule.id,category:rule.category,severity:rule.severity,source:rule.source,evidence,occurredAt:new Date().toISOString()};if(developer){event.approvalScope='developer';if(developer==='confirmed'||developer==='remembered'||developer==='ide')event.approvedBy='developer';}fs.appendFileSync(SPOOL_PATH,JSON.stringify(event)+'\\n',{encoding:'utf8',mode:0o600});triggerFlush();}catch{}}`,
+        `function spoolEvent(rule,line,decision,developer){try{const ev=line.trim();const evidence=ev.length>180?ev.slice(0,180)+'...':ev;let reason='Shell guard: '+rule.reason;if(developer==='confirmed')reason='developer confirmed in terminal prompt — '+reason;else if(developer==='remembered')reason='developer confirmed earlier in this shell (session memory) — '+reason;else if(developer==='declined')reason='developer declined in terminal prompt — '+reason;else if(developer==='timeout')reason='developer confirmation not given (terminal prompt timed out) — '+reason;else if(developer==='ide')reason='delegated to the IDE permission gate (confirmation recorded by post-hook) — '+reason;else if(developer==='agent-terminal')reason='ask cannot be answered in an agent-driven terminal (no IDE confirmation) — '+reason;const event={eventId:crypto.randomUUID(),type:'verdict',decision,toolName:'shell_terminal',operation:'shell_command',reason,ruleId:rule.id,category:rule.category,severity:rule.severity,source:rule.source,evidence,occurredAt:new Date().toISOString()};if(developer){event.approvalScope='developer';if(developer==='confirmed'||developer==='remembered')event.approvedBy='developer';}fs.appendFileSync(SPOOL_PATH,JSON.stringify(event)+'\\n',{encoding:'utf8',mode:0o600});triggerFlush();}catch{}}`,
         (0, agentTerminal_1.buildAgentTerminalJs)(),
         `let argv=process.argv.slice(2);`,
         `// --record <confirmed|remembered|declined|timeout> <ruleId> -- <line>: the shell answered an ask prompt; report it and exit.`,

package/dist/commands/shellGuard.js

@@ -54,6 +54,9 @@ exports.installShellGuardCommand = installShellGuardCommand;
 exports.uninstallShellGuardCommand = uninstallShellGuardCommand;
 const child_process_1 = require("child_process");
 const fs = __importStar(require("fs"));
+const crypto = __importStar(require("crypto"));
+const config_1 = require("../config");
+const localSafetySnapshot_1 = require("../localSafetySnapshot");
 const os = __importStar(require("os"));
 const path = __importStar(require("path"));
 const deterministicGuard_1 = require("./deterministicGuard");
@@ -379,16 +382,48 @@ function builtinRuleCommandNames() {
 function escapeDotNetRegex(literal) {
     return literal.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
 }
-/** Cached Shield mode from the runtime bundle cache (offline read, never network). */
+/** Select the enrolled Shield and its exact identity snapshot, never merge old caches. */
+function shellEnrollment() {
+    const config = (0, config_1.loadMachineConfig)();
+    return {
+        shieldId: config.shieldId || process.env.FCD_SHIELD_ID || process.env.FULLCOURTDEFENSE_SHIELD_ID,
+        apiUrl: (config.apiUrl || process.env.FULLCOURTDEFENSE_API_URL || process.env.FCD_API_URL || 'https://api.fullcourtdefense.ai').replace(/\/$/, ''),
+    };
+}
+function cachedSnapshotFiles() {
+    try {
+        const enrollment = shellEnrollment();
+        if (enrollment.shieldId) {
+            const identity = (0, localSafetySnapshot_1.hookSnapshotIdentity)();
+            const key = crypto.createHash('sha1').update([enrollment.apiUrl, enrollment.shieldId, identity.developerName, identity.machineName].join('|')).digest('hex');
+            const name = `local-safety-${key}.json`;
+            return fs.existsSync(path.join(SNAPSHOT_CACHE_DIR, name)) ? [name] : [];
+        }
+        // Legacy standalone guards have no enrollment. Pick one coherent snapshot;
+        // never combine a disabled list from one version with actions from another.
+        return fs.readdirSync(SNAPSHOT_CACHE_DIR)
+            .filter(name => name.startsWith('local-safety-') && name.endsWith('.json'))
+            .map(name => { try {
+            return { name, at: JSON.parse(fs.readFileSync(path.join(SNAPSHOT_CACHE_DIR, name), 'utf8')).loadedAt || 0 };
+        }
+        catch {
+            return { name, at: -1 };
+        } })
+            .filter(entry => entry.at >= 0).sort((a, b) => b.at - a.at || a.name.localeCompare(b.name))
+            .slice(0, 1).map(entry => entry.name);
+    }
+    catch {
+        return [];
+    }
+}
+/** Cached Shield mode from the active enrollment (offline, never network). */
 function cachedMode() {
     try {
         const parsed = JSON.parse(fs.readFileSync(RUNTIME_CACHE_PATH, 'utf8'));
+        const { shieldId } = shellEnrollment();
         const entries = Object.values(parsed).filter(e => e && typeof e === 'object');
         entries.sort((a, b) => (b.fetchedAt || 0) - (a.fetchedAt || 0));
-        const mode = entries[0]?.mode;
-        // Enforce only on an explicit cached 'block'; missing/unknown = monitor.
-        // A machine that has never been told to enforce must not block typed
-        // commands (fresh install before the first bundle fetch, wiped cache).
+        const mode = shieldId ? parsed[shieldId]?.mode : entries[0]?.mode;
         return mode === 'block' ? 'block' : 'monitor';
     }
     catch {
@@ -404,7 +439,7 @@ function cachedDisabledItemIds() {
     const disabled = new Set();
     let snapshots = 0;
     try {
-        for (const file of fs.readdirSync(SNAPSHOT_CACHE_DIR)) {
+        for (const file of cachedSnapshotFiles()) {
             if (!file.startsWith('local-safety-') || !file.endsWith('.json'))
                 continue;
             try {
@@ -443,7 +478,7 @@ function cachedItemActions() {
     const ask = new Set();
     const blocked = new Set();
     try {
-        for (const file of fs.readdirSync(SNAPSHOT_CACHE_DIR)) {
+        for (const file of cachedSnapshotFiles()) {
             if (!file.startsWith('local-safety-') || !file.endsWith('.json'))
                 continue;
             try {
@@ -481,7 +516,7 @@ function cachedItemActions() {
 function cachedCustomRules() {
     const rules = [];
     try {
-        for (const file of fs.readdirSync(SNAPSHOT_CACHE_DIR)) {
+        for (const file of cachedSnapshotFiles()) {
             if (!file.startsWith('local-safety-') || !file.endsWith('.json'))
                 continue;
             try {
@@ -524,11 +559,12 @@ function cachedCustomRules() {
 function effectiveBuiltinRules() {
     const disabled = cachedDisabledItemIds();
     const itemActions = cachedItemActions();
+    const hasSnapshot = cachedSnapshotFiles().length > 0;
     return BUILTIN_RULES
         .filter(rule => !disabled.has(rule.id))
         .map(rule => {
         const action = itemActions.get(rule.id);
-        return action ? { ...rule, action } : rule;
+        return action ? { ...rule, action } : hasSnapshot ? rule : { ...rule, action: 'warn' };
     });
 }
 /** Write (or rewrite) the ruleset the profile guard loads at shell startup. */
@@ -707,7 +743,7 @@ function buildGuardPs1(nodePath, cliEntry) {
         `  try { $execView = Get-FcdExecView -CommandLine $CommandLine } catch { }`,
         `  $execNormalized = ($execView -replace '\\s+', ' ').Trim()`,
         `  $warnHit = $null`,
-        `  $askHit = $null`,
+        `  $askHits = @()`,
         `  foreach ($rule in $global:FcdGuardRules) {`,
         `    try {`,
         `      # Built-in rules ask "can this text ACT?" — they see the execution`,
@@ -719,12 +755,19 @@ function buildGuardPs1(nodePath, cliEntry) {
         `      if ($rule.Regex.IsMatch($targetNorm) -or $rule.Regex.IsMatch($target)) {`,
         `        # Precedence on one line: block outranks ask, ask outranks warn.`,
         `        if ($rule.Action -eq 'block') { return $rule }`,
-        `        if ($rule.Action -eq 'ask') { if ($null -eq $askHit) { $askHit = $rule } }`,
+        `        if ($rule.Action -eq 'ask') { $askHits += $rule }`,
         `        elseif ($null -eq $warnHit) { $warnHit = $rule }`,
         `      }`,
         `    } catch { }`,
         `  }`,
-        `  if ($null -ne $askHit) { return $askHit }`,
+        `  if ($askHits.Count -eq 1) { return $askHits[0] }`,
+        `  if ($askHits.Count -gt 1) {`,
+        `    $askHits = @($askHits | Sort-Object -Property Id -CaseSensitive)`,
+        `    $combined = $askHits[0].PSObject.Copy()`,
+        `    $combined.Id = 'asks:' + (($askHits | ForEach-Object { [Uri]::EscapeDataString($_.Id) }) -join '+')`,
+        `    $combined.Reason = ($askHits | ForEach-Object { $_.Reason }) -join '; '`,
+        `    return $combined`,
+        `  }`,
         `  return $warnHit`,
         `}`,
         ``,
@@ -774,7 +817,7 @@ function buildGuardPs1(nodePath, cliEntry) {
         `      'remembered' { $reason = 'developer confirmed earlier in this shell (session memory) — ' + $reason }`,
         `      'declined'   { $reason = 'developer declined in terminal prompt — ' + $reason }`,
         `      'timeout'    { $reason = 'developer confirmation not given (terminal prompt timed out) — ' + $reason }`,
-        `      'ide'        { $reason = 'developer confirmed in the IDE prompt (agent-driven terminal) — ' + $reason }`,
+        `      'ide'        { $reason = 'delegated to the IDE permission gate (confirmation recorded by post-hook) — ' + $reason }`,
         `      'agent-terminal' { $reason = 'ask cannot be answered in an agent-driven terminal (no IDE confirmation) — ' + $reason }`,
         `    }`,
         `    $event = [ordered]@{`,
@@ -793,7 +836,7 @@ function buildGuardPs1(nodePath, cliEntry) {
         `    }`,
         `    if ($Developer -ne '') {`,
         `      $event['approvalScope'] = 'developer'`,
-        `      if ($Developer -eq 'confirmed' -or $Developer -eq 'remembered' -or $Developer -eq 'ide') { $event['approvedBy'] = 'developer' }`,
+        `      if ($Developer -eq 'confirmed' -or $Developer -eq 'remembered') { $event['approvedBy'] = 'developer' }`,
         `    }`,
         `    $event = [pscustomobject]$event`,
         `    # BOM-free UTF8 append — PS5's Add-Content -Encoding utf8 writes a BOM that breaks JSONL parsing.`,

package/dist/commands/uninstallAll.js

@@ -53,6 +53,7 @@ const mcpGateway_1 = require("./mcpGateway");
 const discoverSchedule_1 = require("./discoverSchedule");
 const installCursorHook_1 = require("./installCursorHook");
 const installClaudeHook_1 = require("./installClaudeHook");
+const installNativeHooks_1 = require("./installNativeHooks");
 const shellGuard_1 = require("./shellGuard");
 const posixShellGuard_1 = require("./posixShellGuard");
 const cmdGuard_1 = require("./cmdGuard");
@@ -246,6 +247,7 @@ async function runLocalDetach(args, config) {
         { label: 'MCP gateway wraps (restore original server commands)', run: () => (0, mcpGateway_1.unprotectAllCommand)({ ...args, clients: args.clients || 'all' }, config) },
         { label: 'Cursor runtime hooks', run: () => (0, installCursorHook_1.uninstallCursorHookCommand)({}) },
         { label: 'Claude Code / VS Code / Copilot CLI hooks', run: () => (0, installClaudeHook_1.uninstallClaudeHookCommand)({}) },
+        { label: 'Codex / Gemini / Windsurf / current Kiro project hooks', run: () => { (0, installNativeHooks_1.installNativeHooks)({ remove: true }); } },
         ...(process.platform === 'win32'
             ? [
                 { label: 'PowerShell shell guard', run: () => (0, shellGuard_1.uninstallShellGuardCommand)() },

package/dist/config.d.ts

@@ -61,6 +61,8 @@ export declare function dpapiRoundtripProbe(): {
     detail: string;
 };
 export declare function getHomeConfigPath(): string;
+/** Machine enrollment only; terminal guards must not inherit a repository's Shield. */
+export declare function loadMachineConfig(): BotGuardConfig;
 export declare function loadConfig(configPath?: string): BotGuardConfig;
 export declare function getDefaultConfigPath(): string;
 export declare function saveShieldConfig(input: {

package/dist/config.js

@@ -38,6 +38,7 @@ exports.getPowershellHealth = getPowershellHealth;
 exports.capturePowershellLanguageMode = capturePowershellLanguageMode;
 exports.dpapiRoundtripProbe = dpapiRoundtripProbe;
 exports.getHomeConfigPath = getHomeConfigPath;
+exports.loadMachineConfig = loadMachineConfig;
 exports.loadConfig = loadConfig;
 exports.getDefaultConfigPath = getDefaultConfigPath;
 exports.saveShieldConfig = saveShieldConfig;
@@ -295,6 +296,10 @@ function mergeConfig(base, override) {
 function getHomeConfigPath() {
     return path.join(os.homedir(), '.fullcourtdefense.yml');
 }
+/** Machine enrollment only; terminal guards must not inherit a repository's Shield. */
+function loadMachineConfig() {
+    return readConfigFile(getHomeConfigPath());
+}
 function loadConfig(configPath) {
     const homeConfig = readConfigFile(getHomeConfigPath());
     let projectConfig = {};

package/dist/devConfirm.d.ts

@@ -13,6 +13,8 @@ export interface PendingConfirmation {
     sessionId?: string;
     remember: ConfirmRemember;
     raisedAt: string;
+    /** Exact-command handoff to the IDE permission gate; not proof of consent. */
+    permissionHandoff?: boolean;
 }
 export interface RememberedConfirmation {
     /**
@@ -65,6 +67,8 @@ export declare function settleDeveloperConfirmation(event: string, toolName: str
     marker: PendingConfirmation;
     confirmLatencyMs: number;
 } | undefined;
+/** Reject or cancel a pending request without creating approval memory. */
+export declare function rejectDeveloperConfirmation(event: string, toolName: string, argsDigest: string): void;
 /**
  * Markers older than the TTL never saw a post-execution hook: the developer denied the IDE
  * prompt, dismissed it, or the client ignored `ask`. Removed and returned so the caller can