fullcourtdefense-cli 1.32.0 → 1.34.0

package/dist/devConfirm.js

@@ -40,6 +40,7 @@ exports.actionDigest = actionDigest;
 exports.pendingKey = pendingKey;
 exports.raiseDeveloperConfirmation = raiseDeveloperConfirmation;
 exports.settleDeveloperConfirmation = settleDeveloperConfirmation;
+exports.rejectDeveloperConfirmation = rejectDeveloperConfirmation;
 exports.sweepExpiredConfirmations = sweepExpiredConfirmations;
 exports.isConfirmationRemembered = isConfirmationRemembered;
 /**
@@ -106,7 +107,8 @@ function readLedger() {
         const parsed = JSON.parse(fs.readFileSync(ledgerFile(), 'utf8'));
         return {
             pending: Array.isArray(parsed?.pending) ? parsed.pending.filter((p) => p && typeof p === 'object') : [],
-            remembered: Array.isArray(parsed?.remembered) ? parsed.remembered.filter((r) => r && typeof r === 'object') : [],
+            // Older ledgers could remember declines. Require fresh affirmative consent.
+            remembered: parsed?.formatVersion === 2 && Array.isArray(parsed?.remembered) ? parsed.remembered.filter((r) => r && typeof r === 'object') : [],
         };
     }
     catch {
@@ -116,7 +118,9 @@ function readLedger() {
 function writeLedger(ledger) {
     try {
         fs.mkdirSync(path.dirname(ledgerFile()), { recursive: true });
-        fs.writeFileSync(ledgerFile(), JSON.stringify(ledger), { encoding: 'utf8', mode: 0o600 });
+        const temp = `${ledgerFile()}.${process.pid}.${crypto.randomUUID()}.tmp`;
+        fs.writeFileSync(temp, JSON.stringify({ ...ledger, formatVersion: 2 }), { encoding: 'utf8', mode: 0o600 });
+        fs.renameSync(temp, ledgerFile());
     }
     catch { /* best-effort — losing a record must never change a verdict */ }
 }
@@ -185,7 +189,7 @@ function settleDeveloperConfirmation(event, toolName, argsDigest, now = new Date
     if (!marker)
         return undefined;
     ledger.pending = ledger.pending.filter(p => p.key !== key);
-    if (marker.remember !== 'none') {
+    if (marker.remember !== 'none' && Date.parse(marker.raisedAt) <= now.getTime() && now.getTime() - Date.parse(marker.raisedAt) < exports.CONFIRM_PENDING_TTL_MS) {
         const ttl = marker.remember === '1h' ? REMEMBER_1H_MS : REMEMBER_SESSION_MAX_MS;
         const remembered = {
             key: rememberKey(marker),
@@ -206,6 +210,13 @@ function settleDeveloperConfirmation(event, toolName, argsDigest, now = new Date
     writeLedger(ledger);
     return { marker, confirmLatencyMs: Math.max(0, now.getTime() - Date.parse(marker.raisedAt)) };
 }
+/** Reject or cancel a pending request without creating approval memory. */
+function rejectDeveloperConfirmation(event, toolName, argsDigest) {
+    const ledger = readLedger();
+    const key = pendingKey(event, toolName, argsDigest);
+    ledger.pending = ledger.pending.filter(p => p.key !== key);
+    writeLedger(ledger);
+}
 /**
  * Markers older than the TTL never saw a post-execution hook: the developer denied the IDE
  * prompt, dismissed it, or the client ignored `ask`. Removed and returned so the caller can
@@ -233,7 +244,7 @@ function isConfirmationRemembered(scope, sessionId, now = new Date()) {
     const hit = ledger.remembered.find(r => r.key === key);
     if (!hit)
         return undefined;
-    if (Date.parse(hit.expiresAt) <= now.getTime())
+    if (!Number.isFinite(Date.parse(hit.expiresAt)) || Date.parse(hit.expiresAt) <= now.getTime())
         return undefined;
     if (hit.remember === 'session' && (!sessionId || hit.sessionId !== sessionId))
         return undefined;

package/dist/hookIo.js

@@ -129,6 +129,7 @@ function readStdin() {
  */
 function mapHookFlags(flags) {
     return {
+        agentClient: flags['agent-client'],
         event: flags.event,
         apiUrl: flags['api-url'],
         shieldId: flags['shield-id'],

package/dist/index.js

@@ -44,6 +44,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 // touching this file.
 const config_1 = require("./config");
 const hook_1 = require("./commands/hook");
+const installNativeHooks_1 = require("./commands/installNativeHooks");
 const hookIo_1 = require("./hookIo");
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
@@ -202,6 +203,9 @@ function printHelp() {
     uninstall-cursor-hook
                 Removes the FullCourtDefense Cursor hook entries.
     install-claude-hook
+    install-native-hooks --clients codex,gemini_cli,windsurf,kiro
+                          Native tool hooks (Kiro: current project; Codex: trust via /hooks)
+    uninstall-native-hooks
                 Installs Claude-format hooks in ~/.claude/settings.json — ONE file
                 enforces Action Policies + Local Safety rules in Claude Code,
                 VS Code Copilot agent mode, and GitHub Copilot CLI.
@@ -731,6 +735,23 @@ async function main() {
             await (0, hook_1.hookCommand)(args, config);
             break;
         }
+        case 'install-native-hooks':
+        case 'uninstall-native-hooks': {
+            const clients = flags.clients?.split(',');
+            if (clients?.some(client => !['codex', 'gemini_cli', 'windsurf', 'kiro'].includes(client)))
+                throw new Error('Supported native clients: codex,gemini_cli,windsurf,kiro');
+            const files = (0, installNativeHooks_1.installNativeHooks)({ clients, project: flags.project, remove: command === 'uninstall-native-hooks' });
+            for (const file of files)
+                console.log(file);
+            if (command === 'install-native-hooks')
+                console.log('Restart the clients to load hooks. In Codex, review and trust the new definitions using /hooks. Kiro hooks apply to the selected project.');
+            break;
+        }
+        case 'install-copilot-hook': {
+            const { installCopilotHookCommand } = await Promise.resolve().then(() => __importStar(require('./commands/installClaudeHook')));
+            installCopilotHookCommand();
+            break;
+        }
         case 'mcp-gateway': {
             const { mcpGatewayCommand } = await Promise.resolve().then(() => __importStar(require('./commands/mcpGateway')));
             await mcpGatewayCommand(buildGatewayArgs(), config);

package/dist/nativeHook.d.ts

@@ -0,0 +1,25 @@
+import { HookArgs } from './commands/hook';
+import { BotGuardConfig } from './config';
+export type NativeClient = 'codex' | 'gemini_cli' | 'windsurf' | 'kiro';
+type Payload = Record<string, any>;
+export declare const NATIVE_CLIENTS: NativeClient[];
+export declare function patchToolCalls(raw: Payload): Payload[];
+export declare function normalizeNativeInput(client: NativeClient, raw: Payload): Payload;
+export declare function nativeVerdict(client: NativeClient, denied: boolean, reason?: string): {
+    stdout: string;
+    stderr: string;
+    exitCode: number;
+};
+export declare function nativeErrorVerdict(client: NativeClient, reason: string): {
+    stdout: string;
+    stderr: string;
+    exitCode: number;
+};
+/** OS-owned dialog: an agent cannot approve by writing `yes` to hook stdin. */
+export declare function confirmNativeAction(reason: string, timeoutMs?: number): Promise<boolean>;
+export declare function evaluateNativeHook(client: NativeClient, raw: Payload, args: HookArgs, config: BotGuardConfig, confirm?: (reason: string) => Promise<boolean>): Promise<{
+    stdout: string;
+    stderr: string;
+    exitCode: number;
+}>;
+export {};

package/dist/nativeHook.js

@@ -0,0 +1,239 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NATIVE_CLIENTS = void 0;
+exports.patchToolCalls = patchToolCalls;
+exports.normalizeNativeInput = normalizeNativeInput;
+exports.nativeVerdict = nativeVerdict;
+exports.nativeErrorVerdict = nativeErrorVerdict;
+exports.confirmNativeAction = confirmNativeAction;
+exports.evaluateNativeHook = evaluateNativeHook;
+/** Native hook adapters. Never emit an unsupported `ask` to an IDE. */
+const child_process_1 = require("child_process");
+const hook_1 = require("./commands/hook");
+const config_1 = require("./config");
+const runtimeConfig_1 = require("./runtimeConfig");
+const hookIo_1 = require("./hookIo");
+const devConfirm_1 = require("./devConfirm");
+const telemetry_1 = require("./telemetry");
+exports.NATIVE_CLIENTS = ['codex', 'gemini_cli', 'windsurf', 'kiro'];
+function patchToolCalls(raw) {
+    const patch = typeof raw.tool_input === 'string' ? raw.tool_input : String(raw.tool_input?.command || raw.tool_input?.patch || '');
+    if (!patch.startsWith('*** Begin Patch') || !patch.trimEnd().endsWith('*** End Patch'))
+        throw new Error('Unrecognized apply_patch input');
+    const calls = [];
+    const blocks = patch.split(/(?=^\*\*\* (?:Add|Update|Delete) File: )/m).slice(1);
+    for (const block of blocks) {
+        const header = /^\*\*\* (Add|Update|Delete) File: (.+)\r?$/m.exec(block);
+        if (!header)
+            throw new Error('Malformed patch file header');
+        const [, operation, file] = header;
+        const moved = /^\*\*\* Move to: (.+)\r?$/m.exec(block)?.[1];
+        if (operation === 'Delete' || moved)
+            calls.push({ ...raw, tool_name: 'mcp__codex-builtin__delete_file', tool_input: { path: file.trim() } });
+        if (operation !== 'Delete')
+            calls.push({ ...raw, tool_name: 'Edit', tool_input: { path: (moved || file).trim(), new_string: block.split('\n').filter(line => line.startsWith('+')).map(line => line.slice(1)).join('\n') } });
+    }
+    if (!calls.length)
+        throw new Error('Patch contains no recognized file operations');
+    return calls;
+}
+function normalizeNativeInput(client, raw) {
+    let name = String(raw.hook_event_name || '');
+    let tool = String(raw.tool_name || '');
+    let input = raw.tool_input || {};
+    if (client === 'windsurf') {
+        const event = String(raw.agent_action_name || '');
+        const info = raw.tool_info || {};
+        name = event.startsWith('post_') ? 'PostToolUse' : 'PreToolUse';
+        if (event === 'pre_user_prompt')
+            return { ...raw, hook_event_name: 'UserPromptSubmit', prompt: info.user_prompt };
+        if (event.endsWith('run_command')) {
+            tool = 'Bash';
+            input = { command: info.command_line, cwd: info.cwd };
+        }
+        else if (event.endsWith('read_code')) {
+            tool = 'Read';
+            input = info;
+        }
+        else if (event.endsWith('write_code')) {
+            tool = 'Edit';
+            input = info;
+        }
+        else if (event.endsWith('mcp_tool_use')) {
+            tool = `mcp__${info.mcp_server_name}__${info.mcp_tool_name}`;
+            input = info.mcp_tool_arguments;
+        }
+        else
+            throw new Error(`Unsupported Windsurf event: ${event}`);
+    }
+    else if (client === 'gemini_cli') {
+        name = { BeforeTool: 'PreToolUse', AfterTool: 'PostToolUse', BeforeAgent: 'UserPromptSubmit' }[name] || name;
+        if (raw.mcp_context?.server_name && raw.mcp_context?.tool_name)
+            tool = `mcp__${raw.mcp_context.server_name}__${raw.mcp_context.tool_name}`;
+        else if (tool.startsWith('mcp_'))
+            tool = `mcp__gemini__${tool}`; // retain full name when the server split is ambiguous
+    }
+    else if (client === 'kiro') {
+        name = { preToolUse: 'PreToolUse', postToolUse: 'PostToolUse', userPromptSubmit: 'UserPromptSubmit' }[name] || name;
+        if (tool.startsWith('@') && tool.includes('/'))
+            tool = `mcp__${tool.slice(1).replace('/', '__')}`;
+    }
+    if (!['PreToolUse', 'PostToolUse', 'UserPromptSubmit'].includes(name))
+        throw new Error(`Unsupported hook event: ${name}`);
+    if (name !== 'UserPromptSubmit' && !tool)
+        throw new Error('Missing tool name');
+    // Unknown function tools still need Action Policy evaluation, not silent ignore.
+    let normalized = { ...raw, hook_event_name: name, tool_name: tool, tool_input: input };
+    if (name !== 'UserPromptSubmit' && (0, hook_1.normalizeClaudePayload)(normalized)?.event === 'ignore') {
+        normalized = { ...normalized, tool_name: `mcp__${client}-builtin__${tool}` };
+    }
+    return normalized;
+}
+function nativeVerdict(client, denied, reason = '') {
+    if (client === 'codex')
+        return { stdout: JSON.stringify(denied ? { hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'deny', permissionDecisionReason: reason } } : {}), stderr: '', exitCode: 0 };
+    if (client === 'gemini_cli')
+        return { stdout: JSON.stringify(denied ? { decision: 'deny', reason } : {}), stderr: '', exitCode: 0 };
+    return { stdout: '', stderr: denied ? reason : '', exitCode: denied ? 2 : 0 };
+}
+function nativeErrorVerdict(client, reason) {
+    // Structured blocks survive PowerShell wrappers which collapse exit 2 to 1.
+    // The legacy Codex block shape is valid for both tool and prompt hooks.
+    if (client === 'codex')
+        return { stdout: JSON.stringify({ decision: 'block', reason }), stderr: '', exitCode: 0 };
+    return nativeVerdict(client, true, reason);
+}
+/** OS-owned dialog: an agent cannot approve by writing `yes` to hook stdin. */
+async function confirmNativeAction(reason, timeoutMs = 60_000) {
+    if (!(0, devConfirm_1.isHumanPresent)())
+        return false;
+    let executable;
+    let args;
+    const message = `FullCourtDefense — developer approval\n\n${reason.slice(0, 1800)}\n\nAllow this action once?`;
+    if (process.platform === 'win32') {
+        executable = 'powershell.exe';
+        const encoded = Buffer.from(message, 'utf8').toString('base64');
+        const script = `$msg=[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('${encoded}')); $w=New-Object -ComObject WScript.Shell; $answer=$w.Popup($msg,${Math.ceil(timeoutMs / 1000)},'FullCourtDefense',292); if($answer -eq 6){exit 0}else{exit 1}`;
+        args = ['-NoProfile', '-NonInteractive', '-EncodedCommand', Buffer.from(script, 'utf16le').toString('base64')];
+    }
+    else if (process.platform === 'darwin') {
+        executable = '/usr/bin/osascript';
+        args = ['-e', 'on run argv', '-e', 'display dialog (item 1 of argv) buttons {"Deny", "Allow once"} default button "Deny" giving up after 60', '-e', 'if gave up of result or button returned of result is not "Allow once" then error number -128', '-e', 'end run', message];
+    }
+    else {
+        executable = 'zenity';
+        args = ['--question', '--default-cancel', '--title=FullCourtDefense', `--text=${message}`, '--ok-label=Allow once', '--cancel-label=Deny', `--timeout=${Math.ceil(timeoutMs / 1000)}`];
+    }
+    return new Promise(resolve => {
+        let finished = false;
+        const child = (0, child_process_1.spawn)(executable, args, { stdio: 'ignore', windowsHide: true });
+        const cancelChild = () => child.kill();
+        process.once('exit', cancelChild);
+        const done = (allowed) => { if (!finished) {
+            finished = true;
+            clearTimeout(timer);
+            process.removeListener('exit', cancelChild);
+            resolve(allowed);
+        } };
+        const timer = setTimeout(() => { child.kill(); done(false); }, timeoutMs + 1000);
+        child.on('error', () => done(false));
+        child.on('exit', code => done(code === 0));
+    });
+}
+async function evaluateNativeHook(client, raw, args, config, confirm = confirmNativeAction) {
+    if (client === 'codex' && raw.tool_name === 'apply_patch') {
+        try {
+            // Evaluate every file operation before Codex executes the atomic patch.
+            for (const call of patchToolCalls(raw)) {
+                const result = await evaluateNativeHook(client, call, args, config, confirm);
+                const verdict = JSON.parse(result.stdout || '{}');
+                if (result.exitCode !== 0 || verdict.decision === 'block' || verdict.decision === 'deny' || verdict.hookSpecificOutput?.permissionDecision === 'deny')
+                    return result;
+            }
+            return nativeVerdict(client, false);
+        }
+        catch (error) {
+            return nativeErrorVerdict(client, `Patch validation failed: ${String(error)}`);
+        }
+    }
+    let payload;
+    try {
+        payload = normalizeNativeInput(client, raw);
+    }
+    catch (error) {
+        return nativeErrorVerdict(client, `FullCourtDefense could not parse the hook: ${String(error)}`);
+    }
+    return (0, telemetry_1.markVerdictTiming)({ startedAt: Date.now(), path: 'local', agentClient: client }, async () => {
+        const result = await (0, hook_1.evaluateHookRequest)({ ...args, agentClient: client }, JSON.stringify(payload), config);
+        let decision;
+        try {
+            decision = result.stdout ? JSON.parse(result.stdout) : {};
+        }
+        catch {
+            return nativeErrorVerdict(client, 'Invalid FullCourtDefense verdict; action denied.');
+        }
+        if (!decision || typeof decision !== 'object' || Array.isArray(decision))
+            return nativeErrorVerdict(client, 'Invalid FullCourtDefense verdict shape; action denied.');
+        const permission = decision.hookSpecificOutput?.permissionDecision || decision.permissionDecision || decision.permission;
+        let denied = result.exitCode !== 0 || permission === 'deny' || decision.decision === 'block' || decision.continue === false;
+        const reason = decision.hookSpecificOutput?.permissionDecisionReason || decision.permissionDecisionReason || decision.reason || decision.user_message || result.stderr || 'FullCourtDefense policy decision.';
+        if (permission === 'ask' && !denied) {
+            const mapped = (0, hook_1.normalizeClaudePayload)(payload);
+            const call = mapped && mapped.event !== 'ignore' ? (0, hook_1.buildToolCall)(mapped.event, mapped.payload) : null;
+            // No remembered/pending handoff remains when an external dialog is used.
+            if (call && mapped)
+                (0, devConfirm_1.rejectDeveloperConfirmation)(mapped.event, call.toolName, (0, devConfirm_1.actionDigest)(call.toolArgs));
+            let allowed = false;
+            try {
+                allowed = (0, devConfirm_1.isHumanPresent)() && await confirm(`${client}: ${payload.tool_name}\n${reason}`);
+            }
+            catch { /* deny */ }
+            denied = !allowed;
+            (0, telemetry_1.spoolEvent)({ decision: allowed ? 'allow' : 'block', toolName: call?.toolName || payload.tool_name,
+                reason: allowed ? 'Developer approved once in the FullCourtDefense dialog.' : 'Developer declined, confirmation unavailable, or timed out.',
+                approvalScope: 'developer', ...(allowed ? { approvedBy: 'developer' } : {}) });
+        }
+        // Prompt blocks use the documented exit-code contract, not a PreToolUse object.
+        if (payload.hook_event_name === 'UserPromptSubmit' && denied)
+            return nativeErrorVerdict(client, reason);
+        return nativeVerdict(client, denied, reason);
+    });
+}
+async function main() {
+    const flags = (0, hookIo_1.parseHookFlags)(process.argv.slice(2));
+    const client = flags['agent-client'];
+    if (!exports.NATIVE_CLIENTS.includes(client))
+        throw new Error('Unsupported native hook client');
+    const config = (0, config_1.loadConfig)();
+    const shieldId = (0, config_1.resolveCliCredentials)(config, { shieldId: flags['shield-id'] }, { skipDpapi: true }).shieldId;
+    // Return before the vendor's 130s timeout: some clients fail open on timeout.
+    // Bound the entire hook, including multiple patch files and human dialogs.
+    const deadline = setTimeout(() => {
+        const deny = (0, runtimeConfig_1.isSuspendedByCache)() || (0, runtimeConfig_1.cachedEnforcementState)(shieldId).mode === 'block';
+        const result = deny ? nativeErrorVerdict(client, 'FullCourtDefense evaluation deadline exceeded; action not approved.') : nativeVerdict(client, false);
+        if (result.stdout)
+            process.stdout.write(result.stdout + '\n');
+        if (result.stderr)
+            process.stderr.write(result.stderr + '\n');
+        process.exit(result.exitCode);
+    }, 110_000);
+    deadline.unref();
+    const raw = JSON.parse((await (0, hookIo_1.readStdin)()).replace(/^\uFEFF/, ''));
+    const result = await evaluateNativeHook(client, raw, (0, hookIo_1.mapHookFlags)(flags), config);
+    clearTimeout(deadline);
+    if (result.stdout)
+        process.stdout.write(result.stdout + '\n');
+    if (result.stderr)
+        process.stderr.write(result.stderr + '\n');
+    process.exitCode = result.exitCode;
+}
+if (require.main === module)
+    main().catch(error => {
+        const client = (0, hookIo_1.parseHookFlags)(process.argv.slice(2))['agent-client'];
+        const result = nativeErrorVerdict(client, `FullCourtDefense hook failed: ${String(error)}`);
+        if (result.stdout)
+            process.stdout.write(result.stdout + '\n');
+        if (result.stderr)
+            process.stderr.write(result.stderr + '\n');
+        process.exitCode = result.exitCode;
+    });

package/dist/runtimeConfig.d.ts

@@ -168,6 +168,11 @@ export declare function resetCacheOnEnrollment(): void;
  * "exception = allow" must not become a kill-switch bypass. Reads only the
  * local cache file (no network, no config parsing).
  */
+/** Failure handling reads only the requested Shield, never another enrollment. */
+export declare function cachedEnforcementState(shieldId: string | undefined): {
+    mode: ShieldMode;
+    failClosed: boolean;
+};
 export declare function isSuspendedByCache(): boolean;
 /**
  * Admin scan-folder choices from the most recent cached bundle (any shield):

package/dist/runtimeConfig.js

@@ -36,6 +36,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.getRuntimeBundle = getRuntimeBundle;
 exports.validateShieldCredentials = validateShieldCredentials;
 exports.resetCacheOnEnrollment = resetCacheOnEnrollment;
+exports.cachedEnforcementState = cachedEnforcementState;
 exports.isSuspendedByCache = isSuspendedByCache;
 exports.getCachedScanRootOverrides = getCachedScanRootOverrides;
 exports.getCachedExtraScanRoots = getCachedExtraScanRoots;
@@ -434,6 +435,11 @@ function resetCacheOnEnrollment() {
  * "exception = allow" must not become a kill-switch bypass. Reads only the
  * local cache file (no network, no config parsing).
  */
+/** Failure handling reads only the requested Shield, never another enrollment. */
+function cachedEnforcementState(shieldId) {
+    const entry = shieldId ? readCacheFile()[shieldId] : undefined;
+    return { mode: entry && isMode(entry.mode) ? entry.mode : 'monitor', failClosed: entry?.failClosed === true };
+}
 function isSuspendedByCache() {
     try {
         const cache = readCacheFile();

package/dist/telemetry.d.ts

@@ -1,4 +1,5 @@
 export interface SpoolEvent {
+    agentClient?: string;
     eventId: string;
     type: 'verdict';
     decision: 'allow' | 'block' | 'approval' | 'warn' | 'mask';
@@ -52,6 +53,7 @@ export type VerdictPath = 'ipc' | 'local' | 'fail_open' | 'gateway';
  */
 export declare function evidenceFromToolArgs(toolArgs: Record<string, unknown> | undefined): string | undefined;
 interface VerdictTiming {
+    agentClient?: string;
     startedAt: number;
     path: VerdictPath;
     /** Tool args for this evaluation — stamps `evidence` onto every spooled event. */
@@ -64,6 +66,7 @@ export declare function markVerdictTiming<T>(timing: VerdictTiming, fn: () => T)
  * Keeps the original start time so latency still covers the full wait.
  */
 export declare function setVerdictPath(path: VerdictPath): void;
+export declare function setVerdictClient(client: string): void;
 /** Attach the current tool call's args so every spool in this evaluation carries the command. */
 export declare function setVerdictToolArgs(toolArgs: Record<string, unknown>): void;
 /**

package/dist/telemetry.js

@@ -36,6 +36,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.evidenceFromToolArgs = evidenceFromToolArgs;
 exports.markVerdictTiming = markVerdictTiming;
 exports.setVerdictPath = setVerdictPath;
+exports.setVerdictClient = setVerdictClient;
 exports.setVerdictToolArgs = setVerdictToolArgs;
 exports.restartVerdictTiming = restartVerdictTiming;
 exports.spoolEvent = spoolEvent;
@@ -156,6 +157,11 @@ function setVerdictPath(path) {
     if (store)
         store.path = path;
 }
+function setVerdictClient(client) {
+    const store = verdictTiming.getStore();
+    if (store)
+        store.agentClient = client;
+}
 /** Attach the current tool call's args so every spool in this evaluation carries the command. */
 function setVerdictToolArgs(toolArgs) {
     const store = verdictTiming.getStore();
@@ -185,6 +191,7 @@ function spoolEvent(event) {
             occurredAt: event.occurredAt || new Date().toISOString(),
             type: 'verdict',
             decision: event.decision,
+            agentClient: event.agentClient || timing?.agentClient,
             toolName: event.toolName,
             operation: event.operation,
             reason: event.reason,

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.32.0"
+  "version": "1.34.0"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.32.0",
+  "version": "1.34.0",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {
@@ -13,6 +13,9 @@
     "README.md"
   ],
   "scripts": {
+    "test:native-hooks": "npm run build && node scripts/test-native-hook-launch.js && node scripts/test-native-hook-edges.js && node scripts/test-client-telemetry.js && node scripts/test-native-hook-clients.js",
+    "test:endpoint-approvals": "npm run build && node scripts/audit-endpoint-mcp-shell.js",
+    "test:endpoint-clients": "npm run build && node scripts/test-endpoint-client-matrix.js && node scripts/test-copilot-hook-install.js",
     "build": "tsc && node scripts/copy-attack-corpus.js",
     "test:deterministic-guard": "npm run build && node scripts/test-deterministic-guard.js",
     "test:drive-delete-guard": "npm run build && node scripts/test-drive-delete-guard.js",