fullcourtdefense-cli 1.33.0 → 1.34.0

package/dist/commands/discoverPaths.js

@@ -215,6 +215,8 @@ function candidateConfigPaths(cwd, extra) {
         { path: path.join(xdg, 'Code', 'User', 'settings.json'), source: 'VS Code (user, linux)', clientKey: 'vscode' },
         { path: path.join(home, '.codeium', 'windsurf', 'mcp_config.json'), source: 'Windsurf', clientKey: 'windsurf' },
         { path: path.join(home, '.kiro', 'mcp.json'), source: 'Kiro', clientKey: 'kiro' },
+        { path: path.join(home, '.kiro', 'settings', 'mcp.json'), source: 'Kiro (settings)', clientKey: 'kiro' },
+        { path: path.join(cwd, '.kiro', 'settings', 'mcp.json'), source: 'Kiro (project settings)', clientKey: 'kiro' },
         { path: path.join(cwd, '.mcp.json'), source: 'Repo (.mcp.json)', clientKey: 'other' },
         { path: path.join(cwd, 'mcp.json'), source: 'Repo (mcp.json)', clientKey: 'other' },
     ];

package/dist/commands/hook.d.ts

@@ -20,6 +20,7 @@ import { BotGuardConfig } from '../config';
  * human approves/rejects in the FullCourtDefense console (same as the gateway).
  */
 export interface HookArgs {
+    agentClient?: string;
     event?: string;
     apiUrl?: string;
     shieldId?: string;

package/dist/commands/hook.js

@@ -191,10 +191,10 @@ function mapClaudeToolPayload(payload) {
 // a file read is `read_file { path }`. Built-ins with no enforcement surface
 // (search, task, web) are ignored. Nothing here decides anything.
 // ---------------------------------------------------------------------------
-const BUILTIN_SHELL_TOOLS = new Set(['bash', 'shell', 'runterminalcommand', 'runinterminal', 'powershell', 'terminal']);
-const BUILTIN_READ_TOOLS = new Set(['read', 'readfile', 'view']);
+const BUILTIN_SHELL_TOOLS = new Set(['bash', 'shell', 'runterminalcommand', 'runinterminal', 'powershell', 'terminal', 'runshellcommand', 'executebash', 'execcommand']);
+const BUILTIN_READ_TOOLS = new Set(['read', 'readfile', 'view', 'fsread']);
 const BUILTIN_WRITE_TOOLS = new Set([
-    'write', 'edit', 'multiedit', 'notebookedit', 'createfile', 'editfiles',
+    'write', 'edit', 'multiedit', 'notebookedit', 'createfile', 'editfiles', 'writefile', 'fswrite', 'replace',
     'replacestringinfile', 'editfile', 'applypatch', 'strreplaceeditor', 'insertedittofile', 'strreplace', 'editnotebook',
 ]);
 /**
@@ -221,11 +221,11 @@ function mapBuiltinToolPayload(toolName, input, payload) {
     if (BUILTIN_SHELL_TOOLS.has(canon)) {
         return {
             event: 'shell',
-            payload: { ...payload, command: str(input.command), cwd: str(input.cwd) || str(input.working_directory) || str(payload.cwd) || undefined },
+            payload: { ...payload, command: str(input.command) || str(input.cmd), cwd: str(input.cwd) || str(input.workdir) || str(input.working_directory) || str(payload.cwd) || undefined },
         };
     }
     if (BUILTIN_READ_TOOLS.has(canon)) {
-        return { event: 'read', payload: { ...payload, file_path: str(input.file_path) || str(input.path) || str(input.target_file) } };
+        return { event: 'read', payload: { ...payload, file_path: str(input.file_path) || str(input.filePath) || str(input.absolute_path) || str(input.path) || str(input.target_file) } };
     }
     if (BUILTIN_WRITE_TOOLS.has(canon)) {
         const filePath = str(input.file_path) || str(input.notebook_path) || str(input.path) || str(input.filePath) || str(input.target_file)
@@ -235,7 +235,7 @@ function mapBuiltinToolPayload(toolName, input, payload) {
         // `new_source`) are reduced to the lines they add. Both then drop the
         // credential-shaped words the file on disk already contains — re-stating a
         // value that is already in the file is not putting a secret into it.
-        const delta = str(input.new_string) || str(input.new_str) || str(input.new_text)
+        const delta = str(input.new_string) || str(input.newString) || str(input.newText) || str(input.new_str) || str(input.new_text)
             || (Array.isArray(input.edits)
                 ? input.edits.map((e) => str(e?.new_string) || str(e?.new_text) || str(e?.newText) || str(e?.content)).filter(Boolean).join('\n')
                 : '');
@@ -1345,7 +1345,8 @@ async function hookCommandInner(args, config, io) {
     // client that reads ~/.claude/settings.json.
     const claudeNormalized = normalizeClaudePayload(payload);
     const hookFormat = claudeNormalized ? 'claude' : 'cursor';
-    const client = claudeNormalized ? claudeFormatClient() : 'cursor';
+    const client = args.agentClient || (claudeNormalized ? claudeFormatClient() : 'cursor');
+    (0, telemetry_1.setVerdictClient)(client);
     let event;
     let ignoreEvent = false;
     if (claudeNormalized) {

package/dist/commands/installAll.js

@@ -5,6 +5,7 @@ const config_1 = require("../config");
 const discover_1 = require("./discover");
 const installCursorHook_1 = require("./installCursorHook");
 const installClaudeHook_1 = require("./installClaudeHook");
+const installNativeHooks_1 = require("./installNativeHooks");
 const discoverSchedule_1 = require("./discoverSchedule");
 const mcpGateway_1 = require("./mcpGateway");
 const autoProtect_1 = require("./autoProtect");
@@ -35,6 +36,16 @@ async function installAllCommand(args, config) {
     console.log('\x1b[2mAuto-protect MCP servers across AI clients + Cursor built-in action hooks. No --mcp-command or folder path needed.\x1b[0m\n');
     await (0, mcpGateway_1.protectAllCommand)(gatewayArgs, config);
     if (args.hooks !== 'false') {
+        try {
+            const nativeFiles = (0, installNativeHooks_1.installNativeHooks)();
+            for (const file of nativeFiles)
+                console.log(`Native action hooks configured: ${file}`);
+            if (nativeFiles.some(file => file.includes('.codex')))
+                console.log('Codex: review and trust the new hooks using /hooks before they can run.');
+        }
+        catch (error) {
+            console.error(`Native hooks incomplete: ${error instanceof Error ? error.message : String(error)}. Repair the settings and rerun install-native-hooks.`);
+        }
         console.log('\n\x1b[1mInstalling Cursor runtime hooks…\x1b[0m');
         const hookArgs = {
             shieldId: creds.shieldId,

package/dist/commands/installClaudeHook.d.ts

@@ -35,5 +35,11 @@ export interface ClaudeManagedHookRepairResult {
 export declare function inspectClaudeManagedHooks(): ClaudeManagedHookRepairResult;
 /** Repair managed commands without changing matcher/event/fail-open behavior. */
 export declare function repairClaudeManagedHooks(): ClaudeManagedHookRepairResult;
+/** Copilot CLI user settings are separate from Claude's global settings.
+ * Use inline settings, not ~/.copilot/hooks, which VS Code also loads and
+ * would therefore execute twice alongside its Claude hook.
+ */
+export declare function syncCopilotToolHooks(command?: string): boolean;
+export declare function installCopilotHookCommand(): void;
 export declare function installClaudeHookCommand(args: InstallClaudeHookArgs, config: BotGuardConfig): Promise<void>;
 export declare function uninstallClaudeHookCommand(args: InstallClaudeHookArgs): Promise<void>;

package/dist/commands/installClaudeHook.js

@@ -35,6 +35,8 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.inspectClaudeManagedHooks = inspectClaudeManagedHooks;
 exports.repairClaudeManagedHooks = repairClaudeManagedHooks;
+exports.syncCopilotToolHooks = syncCopilotToolHooks;
+exports.installCopilotHookCommand = installCopilotHookCommand;
 exports.installClaudeHookCommand = installClaudeHookCommand;
 exports.uninstallClaudeHookCommand = uninstallClaudeHookCommand;
 const fs = __importStar(require("fs"));
@@ -211,7 +213,7 @@ function syncCopilotToolHooks(command) {
         const entries = Array.isArray(hooks[event]) ? hooks[event] : [];
         const kept = entries.filter(entry => !isManagedCommand(entry));
         if (command)
-            kept.push({ type: 'command', command, timeoutSec: event === 'PreToolUse' ? TOOL_HOOK_TIMEOUT_SEC : POST_TOOL_HOOK_TIMEOUT_SEC });
+            kept.push({ type: 'command', command: `${command} --agent-client copilot`, timeoutSec: event === 'PreToolUse' ? TOOL_HOOK_TIMEOUT_SEC : POST_TOOL_HOOK_TIMEOUT_SEC });
         if (kept.length)
             hooks[event] = kept;
         else
@@ -227,6 +229,10 @@ function syncCopilotToolHooks(command) {
     fs.writeFileSync(file, JSON.stringify(settings, null, 2) + '\n', 'utf8');
     return true;
 }
+function installCopilotHookCommand() {
+    syncCopilotToolHooks(buildHookCommand({ shadow: false, failClosed: false }));
+    console.log('Copilot CLI tool hooks configured. Restart Copilot CLI to load the changes.');
+}
 // PostToolUse companion of PreToolUse: enforces nothing; it is how a developer's
 // Allow on the client's own `ask` prompt (developer-scoped approval) is learned.
 // Same command — the bridge reads `hook_event_name` from the payload.

package/dist/commands/installNativeHooks.d.ts

@@ -0,0 +1,9 @@
+import type { NativeClient } from '../nativeHook';
+export declare function nativeHookCommand(client: NativeClient): string;
+/** Preserve unrelated settings and hooks; refuse malformed files. */
+export declare function installNativeHooks(options?: {
+    home?: string;
+    project?: string;
+    clients?: NativeClient[];
+    remove?: boolean;
+}): string[];

package/dist/commands/installNativeHooks.js

@@ -0,0 +1,145 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.nativeHookCommand = nativeHookCommand;
+exports.installNativeHooks = installNativeHooks;
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const marker = '--fcd-native-managed true';
+const managed = (value) => {
+    if (typeof value?.command !== 'string')
+        return false;
+    if (value.command.includes(marker))
+        return true;
+    const encoded = /-EncodedCommand ([A-Za-z0-9+/=]+)$/.exec(value.command)?.[1];
+    return Boolean(encoded && Buffer.from(encoded, 'base64').toString('utf16le').includes(marker));
+};
+const quote = (value) => `'${value.replace(/'/g, `'"'"'`)}'`;
+function nativeHookCommand(client) {
+    if (!['codex', 'gemini_cli', 'windsurf', 'kiro'].includes(client))
+        throw new Error('Unsupported native hook client');
+    const entry = path.resolve(__dirname, '..', 'nativeHook.js');
+    const flags = `--agent-client ${client} ${marker} --fcd-managed true --local-only true`;
+    if (process.platform !== 'win32')
+        return `${quote(process.execPath)} ${quote(entry)} ${flags}`;
+    // Windows vendors use different shells. An encoded PowerShell launcher is
+    // valid in both cmd and PowerShell, preserves paths with spaces, and forwards
+    // the JSON stdin explicitly. Paths are data, never interpolated expressions.
+    const psQuote = (value) => `'${value.replace(/'/g, "''")}'`;
+    const script = `$ProgressPreference='SilentlyContinue'; $OutputEncoding=[Text.UTF8Encoding]::new($false); [Console]::InputEncoding=$OutputEncoding; [Console]::OutputEncoding=$OutputEncoding; $raw=[Console]::In.ReadToEnd(); $raw | & ${psQuote(process.execPath)} ${psQuote(entry)} ${flags}; exit $LASTEXITCODE`;
+    return `powershell.exe -NoProfile -NonInteractive -EncodedCommand ${Buffer.from(script, 'utf16le').toString('base64')}`;
+}
+/** Preserve unrelated settings and hooks; refuse malformed files. */
+function installNativeHooks(options = {}) {
+    // Validate library callers too, before any filesystem changes.
+    for (const client of options.clients || [])
+        nativeHookCommand(client);
+    const home = options.home || os.homedir();
+    const files = [];
+    const errors = [];
+    for (const client of options.clients || ['codex', 'gemini_cli', 'windsurf', 'kiro']) {
+        const root = client === 'codex' ? path.join(home, '.codex') : client === 'gemini_cli' ? path.join(home, '.gemini')
+            : client === 'windsurf' ? path.join(home, '.codeium', 'windsurf') : path.join(options.project || process.cwd(), '.kiro');
+        // Install only detected clients. Explicit client selection also supports setup before first launch.
+        if (!options.clients && !fs.existsSync(root))
+            continue;
+        const file = path.join(root, client === 'kiro' ? 'hooks/fullcourtdefense.json' : client === 'gemini_cli' ? 'settings.json' : 'hooks.json');
+        if (options.remove && !fs.existsSync(file))
+            continue;
+        try {
+            const data = fs.existsSync(file) ? JSON.parse(fs.readFileSync(file, 'utf8')) : {};
+            if (!data || typeof data !== 'object' || Array.isArray(data))
+                throw new Error(`Invalid hook settings: ${file}`);
+            const before = JSON.stringify(data);
+            const command = nativeHookCommand(client);
+            if (client === 'kiro') {
+                if (data.hooks !== undefined && !Array.isArray(data.hooks))
+                    throw new Error(`Invalid Kiro hooks: ${file}`);
+                const kept = (data.hooks || []).filter((hook) => !managed(hook.action));
+                data.version = 'v1';
+                data.hooks = options.remove ? kept : [...kept, ...['PreToolUse', 'PostToolUse', 'UserPromptSubmit'].map(trigger => ({
+                        name: `FullCourtDefense ${trigger}`, trigger, action: { type: 'command', command }, timeout: 130,
+                    }))];
+            }
+            else {
+                if (data.hooks !== undefined && (!data.hooks || typeof data.hooks !== 'object' || Array.isArray(data.hooks)))
+                    throw new Error(`Invalid hooks: ${file}`);
+                const hooks = data.hooks || {};
+                const events = client === 'windsurf'
+                    ? ['pre_run_command', 'post_run_command', 'pre_read_code', 'pre_write_code', 'post_write_code', 'pre_mcp_tool_use', 'post_mcp_tool_use', 'pre_user_prompt']
+                    : client === 'gemini_cli' ? ['BeforeTool', 'AfterTool', 'BeforeAgent'] : ['PreToolUse', 'PostToolUse', 'UserPromptSubmit'];
+                for (const event of events) {
+                    if (hooks[event] !== undefined && !Array.isArray(hooks[event]))
+                        throw new Error(`Invalid ${event} hooks: ${file}`);
+                    const entries = hooks[event] || [];
+                    const kept = client === 'windsurf' ? entries.filter((hook) => !managed(hook)) : entries.flatMap((group) => {
+                        if (!Array.isArray(group?.hooks))
+                            throw new Error(`Invalid ${event} hook group: ${file}`);
+                        const rest = group.hooks.filter((hook) => !managed(hook));
+                        return rest.length ? [{ ...group, hooks: rest }] : [];
+                    });
+                    if (!options.remove) {
+                        if (client === 'windsurf')
+                            kept.push({ command, powershell: `${command}; exit $LASTEXITCODE`, show_output: true });
+                        else
+                            kept.push({ ...(event.includes('Tool') ? { matcher: '.*' } : {}), hooks: [{ type: 'command', command,
+                                        ...(client === 'gemini_cli' ? { name: `fullcourtdefense-${event}`, timeout: 130000 } : { timeout: 130 }) }] });
+                    }
+                    if (kept.length)
+                        hooks[event] = kept;
+                    else
+                        delete hooks[event];
+                }
+                data.hooks = hooks;
+            }
+            if (JSON.stringify(data) !== before) {
+                fs.mkdirSync(path.dirname(file), { recursive: true });
+                if (fs.existsSync(file) && !fs.existsSync(`${file}.fcd-backup`))
+                    fs.copyFileSync(file, `${file}.fcd-backup`);
+                const temporary = `${file}.fcd-${process.pid}.tmp`;
+                fs.writeFileSync(temporary, JSON.stringify(data, null, 2) + '\n', { mode: 0o600 });
+                fs.renameSync(temporary, file);
+            }
+            files.push(file);
+        }
+        catch (error) {
+            errors.push(`${file}: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
+    if (errors.length)
+        throw new Error(`Native hook settings need repair: ${errors.join('; ')}`);
+    return files;
+}

package/dist/commands/mcpGateway.js

@@ -1086,7 +1086,7 @@ class McpGatewayServer {
         // waited for OUR decision (path 'gateway'). Pure in-memory context — no
         // probe, no I/O; the clock is restarted after the downstream call so the
         // tool's own runtime is never billed to FullCourtDefense.
-        return (0, telemetry_1.markVerdictTiming)({ startedAt: Date.now(), path: 'gateway' }, () => this.handleToolCallInner(params));
+        return (0, telemetry_1.markVerdictTiming)({ startedAt: Date.now(), path: 'gateway', agentClient: this.gatewayConfig.agentClient }, () => this.handleToolCallInner(params));
     }
     async handleToolCallInner(params) {
         await this.ensureDownstream();

package/dist/commands/uninstallAll.js

@@ -53,6 +53,7 @@ const mcpGateway_1 = require("./mcpGateway");
 const discoverSchedule_1 = require("./discoverSchedule");
 const installCursorHook_1 = require("./installCursorHook");
 const installClaudeHook_1 = require("./installClaudeHook");
+const installNativeHooks_1 = require("./installNativeHooks");
 const shellGuard_1 = require("./shellGuard");
 const posixShellGuard_1 = require("./posixShellGuard");
 const cmdGuard_1 = require("./cmdGuard");
@@ -246,6 +247,7 @@ async function runLocalDetach(args, config) {
         { label: 'MCP gateway wraps (restore original server commands)', run: () => (0, mcpGateway_1.unprotectAllCommand)({ ...args, clients: args.clients || 'all' }, config) },
         { label: 'Cursor runtime hooks', run: () => (0, installCursorHook_1.uninstallCursorHookCommand)({}) },
         { label: 'Claude Code / VS Code / Copilot CLI hooks', run: () => (0, installClaudeHook_1.uninstallClaudeHookCommand)({}) },
+        { label: 'Codex / Gemini / Windsurf / current Kiro project hooks', run: () => { (0, installNativeHooks_1.installNativeHooks)({ remove: true }); } },
         ...(process.platform === 'win32'
             ? [
                 { label: 'PowerShell shell guard', run: () => (0, shellGuard_1.uninstallShellGuardCommand)() },

package/dist/hookIo.js

@@ -129,6 +129,7 @@ function readStdin() {
  */
 function mapHookFlags(flags) {
     return {
+        agentClient: flags['agent-client'],
         event: flags.event,
         apiUrl: flags['api-url'],
         shieldId: flags['shield-id'],

package/dist/index.js

@@ -44,6 +44,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 // touching this file.
 const config_1 = require("./config");
 const hook_1 = require("./commands/hook");
+const installNativeHooks_1 = require("./commands/installNativeHooks");
 const hookIo_1 = require("./hookIo");
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
@@ -202,6 +203,9 @@ function printHelp() {
     uninstall-cursor-hook
                 Removes the FullCourtDefense Cursor hook entries.
     install-claude-hook
+    install-native-hooks --clients codex,gemini_cli,windsurf,kiro
+                          Native tool hooks (Kiro: current project; Codex: trust via /hooks)
+    uninstall-native-hooks
                 Installs Claude-format hooks in ~/.claude/settings.json — ONE file
                 enforces Action Policies + Local Safety rules in Claude Code,
                 VS Code Copilot agent mode, and GitHub Copilot CLI.
@@ -731,6 +735,23 @@ async function main() {
             await (0, hook_1.hookCommand)(args, config);
             break;
         }
+        case 'install-native-hooks':
+        case 'uninstall-native-hooks': {
+            const clients = flags.clients?.split(',');
+            if (clients?.some(client => !['codex', 'gemini_cli', 'windsurf', 'kiro'].includes(client)))
+                throw new Error('Supported native clients: codex,gemini_cli,windsurf,kiro');
+            const files = (0, installNativeHooks_1.installNativeHooks)({ clients, project: flags.project, remove: command === 'uninstall-native-hooks' });
+            for (const file of files)
+                console.log(file);
+            if (command === 'install-native-hooks')
+                console.log('Restart the clients to load hooks. In Codex, review and trust the new definitions using /hooks. Kiro hooks apply to the selected project.');
+            break;
+        }
+        case 'install-copilot-hook': {
+            const { installCopilotHookCommand } = await Promise.resolve().then(() => __importStar(require('./commands/installClaudeHook')));
+            installCopilotHookCommand();
+            break;
+        }
         case 'mcp-gateway': {
             const { mcpGatewayCommand } = await Promise.resolve().then(() => __importStar(require('./commands/mcpGateway')));
             await mcpGatewayCommand(buildGatewayArgs(), config);

package/dist/nativeHook.d.ts

@@ -0,0 +1,25 @@
+import { HookArgs } from './commands/hook';
+import { BotGuardConfig } from './config';
+export type NativeClient = 'codex' | 'gemini_cli' | 'windsurf' | 'kiro';
+type Payload = Record<string, any>;
+export declare const NATIVE_CLIENTS: NativeClient[];
+export declare function patchToolCalls(raw: Payload): Payload[];
+export declare function normalizeNativeInput(client: NativeClient, raw: Payload): Payload;
+export declare function nativeVerdict(client: NativeClient, denied: boolean, reason?: string): {
+    stdout: string;
+    stderr: string;
+    exitCode: number;
+};
+export declare function nativeErrorVerdict(client: NativeClient, reason: string): {
+    stdout: string;
+    stderr: string;
+    exitCode: number;
+};
+/** OS-owned dialog: an agent cannot approve by writing `yes` to hook stdin. */
+export declare function confirmNativeAction(reason: string, timeoutMs?: number): Promise<boolean>;
+export declare function evaluateNativeHook(client: NativeClient, raw: Payload, args: HookArgs, config: BotGuardConfig, confirm?: (reason: string) => Promise<boolean>): Promise<{
+    stdout: string;
+    stderr: string;
+    exitCode: number;
+}>;
+export {};

package/dist/nativeHook.js

@@ -0,0 +1,239 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NATIVE_CLIENTS = void 0;
+exports.patchToolCalls = patchToolCalls;
+exports.normalizeNativeInput = normalizeNativeInput;
+exports.nativeVerdict = nativeVerdict;
+exports.nativeErrorVerdict = nativeErrorVerdict;
+exports.confirmNativeAction = confirmNativeAction;
+exports.evaluateNativeHook = evaluateNativeHook;
+/** Native hook adapters. Never emit an unsupported `ask` to an IDE. */
+const child_process_1 = require("child_process");
+const hook_1 = require("./commands/hook");
+const config_1 = require("./config");
+const runtimeConfig_1 = require("./runtimeConfig");
+const hookIo_1 = require("./hookIo");
+const devConfirm_1 = require("./devConfirm");
+const telemetry_1 = require("./telemetry");
+exports.NATIVE_CLIENTS = ['codex', 'gemini_cli', 'windsurf', 'kiro'];
+function patchToolCalls(raw) {
+    const patch = typeof raw.tool_input === 'string' ? raw.tool_input : String(raw.tool_input?.command || raw.tool_input?.patch || '');
+    if (!patch.startsWith('*** Begin Patch') || !patch.trimEnd().endsWith('*** End Patch'))
+        throw new Error('Unrecognized apply_patch input');
+    const calls = [];
+    const blocks = patch.split(/(?=^\*\*\* (?:Add|Update|Delete) File: )/m).slice(1);
+    for (const block of blocks) {
+        const header = /^\*\*\* (Add|Update|Delete) File: (.+)\r?$/m.exec(block);
+        if (!header)
+            throw new Error('Malformed patch file header');
+        const [, operation, file] = header;
+        const moved = /^\*\*\* Move to: (.+)\r?$/m.exec(block)?.[1];
+        if (operation === 'Delete' || moved)
+            calls.push({ ...raw, tool_name: 'mcp__codex-builtin__delete_file', tool_input: { path: file.trim() } });
+        if (operation !== 'Delete')
+            calls.push({ ...raw, tool_name: 'Edit', tool_input: { path: (moved || file).trim(), new_string: block.split('\n').filter(line => line.startsWith('+')).map(line => line.slice(1)).join('\n') } });
+    }
+    if (!calls.length)
+        throw new Error('Patch contains no recognized file operations');
+    return calls;
+}
+function normalizeNativeInput(client, raw) {
+    let name = String(raw.hook_event_name || '');
+    let tool = String(raw.tool_name || '');
+    let input = raw.tool_input || {};
+    if (client === 'windsurf') {
+        const event = String(raw.agent_action_name || '');
+        const info = raw.tool_info || {};
+        name = event.startsWith('post_') ? 'PostToolUse' : 'PreToolUse';
+        if (event === 'pre_user_prompt')
+            return { ...raw, hook_event_name: 'UserPromptSubmit', prompt: info.user_prompt };
+        if (event.endsWith('run_command')) {
+            tool = 'Bash';
+            input = { command: info.command_line, cwd: info.cwd };
+        }
+        else if (event.endsWith('read_code')) {
+            tool = 'Read';
+            input = info;
+        }
+        else if (event.endsWith('write_code')) {
+            tool = 'Edit';
+            input = info;
+        }
+        else if (event.endsWith('mcp_tool_use')) {
+            tool = `mcp__${info.mcp_server_name}__${info.mcp_tool_name}`;
+            input = info.mcp_tool_arguments;
+        }
+        else
+            throw new Error(`Unsupported Windsurf event: ${event}`);
+    }
+    else if (client === 'gemini_cli') {
+        name = { BeforeTool: 'PreToolUse', AfterTool: 'PostToolUse', BeforeAgent: 'UserPromptSubmit' }[name] || name;
+        if (raw.mcp_context?.server_name && raw.mcp_context?.tool_name)
+            tool = `mcp__${raw.mcp_context.server_name}__${raw.mcp_context.tool_name}`;
+        else if (tool.startsWith('mcp_'))
+            tool = `mcp__gemini__${tool}`; // retain full name when the server split is ambiguous
+    }
+    else if (client === 'kiro') {
+        name = { preToolUse: 'PreToolUse', postToolUse: 'PostToolUse', userPromptSubmit: 'UserPromptSubmit' }[name] || name;
+        if (tool.startsWith('@') && tool.includes('/'))
+            tool = `mcp__${tool.slice(1).replace('/', '__')}`;
+    }
+    if (!['PreToolUse', 'PostToolUse', 'UserPromptSubmit'].includes(name))
+        throw new Error(`Unsupported hook event: ${name}`);
+    if (name !== 'UserPromptSubmit' && !tool)
+        throw new Error('Missing tool name');
+    // Unknown function tools still need Action Policy evaluation, not silent ignore.
+    let normalized = { ...raw, hook_event_name: name, tool_name: tool, tool_input: input };
+    if (name !== 'UserPromptSubmit' && (0, hook_1.normalizeClaudePayload)(normalized)?.event === 'ignore') {
+        normalized = { ...normalized, tool_name: `mcp__${client}-builtin__${tool}` };
+    }
+    return normalized;
+}
+function nativeVerdict(client, denied, reason = '') {
+    if (client === 'codex')
+        return { stdout: JSON.stringify(denied ? { hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'deny', permissionDecisionReason: reason } } : {}), stderr: '', exitCode: 0 };
+    if (client === 'gemini_cli')
+        return { stdout: JSON.stringify(denied ? { decision: 'deny', reason } : {}), stderr: '', exitCode: 0 };
+    return { stdout: '', stderr: denied ? reason : '', exitCode: denied ? 2 : 0 };
+}
+function nativeErrorVerdict(client, reason) {
+    // Structured blocks survive PowerShell wrappers which collapse exit 2 to 1.
+    // The legacy Codex block shape is valid for both tool and prompt hooks.
+    if (client === 'codex')
+        return { stdout: JSON.stringify({ decision: 'block', reason }), stderr: '', exitCode: 0 };
+    return nativeVerdict(client, true, reason);
+}
+/** OS-owned dialog: an agent cannot approve by writing `yes` to hook stdin. */
+async function confirmNativeAction(reason, timeoutMs = 60_000) {
+    if (!(0, devConfirm_1.isHumanPresent)())
+        return false;
+    let executable;
+    let args;
+    const message = `FullCourtDefense — developer approval\n\n${reason.slice(0, 1800)}\n\nAllow this action once?`;
+    if (process.platform === 'win32') {
+        executable = 'powershell.exe';
+        const encoded = Buffer.from(message, 'utf8').toString('base64');
+        const script = `$msg=[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('${encoded}')); $w=New-Object -ComObject WScript.Shell; $answer=$w.Popup($msg,${Math.ceil(timeoutMs / 1000)},'FullCourtDefense',292); if($answer -eq 6){exit 0}else{exit 1}`;
+        args = ['-NoProfile', '-NonInteractive', '-EncodedCommand', Buffer.from(script, 'utf16le').toString('base64')];
+    }
+    else if (process.platform === 'darwin') {
+        executable = '/usr/bin/osascript';
+        args = ['-e', 'on run argv', '-e', 'display dialog (item 1 of argv) buttons {"Deny", "Allow once"} default button "Deny" giving up after 60', '-e', 'if gave up of result or button returned of result is not "Allow once" then error number -128', '-e', 'end run', message];
+    }
+    else {
+        executable = 'zenity';
+        args = ['--question', '--default-cancel', '--title=FullCourtDefense', `--text=${message}`, '--ok-label=Allow once', '--cancel-label=Deny', `--timeout=${Math.ceil(timeoutMs / 1000)}`];
+    }
+    return new Promise(resolve => {
+        let finished = false;
+        const child = (0, child_process_1.spawn)(executable, args, { stdio: 'ignore', windowsHide: true });
+        const cancelChild = () => child.kill();
+        process.once('exit', cancelChild);
+        const done = (allowed) => { if (!finished) {
+            finished = true;
+            clearTimeout(timer);
+            process.removeListener('exit', cancelChild);
+            resolve(allowed);
+        } };
+        const timer = setTimeout(() => { child.kill(); done(false); }, timeoutMs + 1000);
+        child.on('error', () => done(false));
+        child.on('exit', code => done(code === 0));
+    });
+}
+async function evaluateNativeHook(client, raw, args, config, confirm = confirmNativeAction) {
+    if (client === 'codex' && raw.tool_name === 'apply_patch') {
+        try {
+            // Evaluate every file operation before Codex executes the atomic patch.
+            for (const call of patchToolCalls(raw)) {
+                const result = await evaluateNativeHook(client, call, args, config, confirm);
+                const verdict = JSON.parse(result.stdout || '{}');
+                if (result.exitCode !== 0 || verdict.decision === 'block' || verdict.decision === 'deny' || verdict.hookSpecificOutput?.permissionDecision === 'deny')
+                    return result;
+            }
+            return nativeVerdict(client, false);
+        }
+        catch (error) {
+            return nativeErrorVerdict(client, `Patch validation failed: ${String(error)}`);
+        }
+    }
+    let payload;
+    try {
+        payload = normalizeNativeInput(client, raw);
+    }
+    catch (error) {
+        return nativeErrorVerdict(client, `FullCourtDefense could not parse the hook: ${String(error)}`);
+    }
+    return (0, telemetry_1.markVerdictTiming)({ startedAt: Date.now(), path: 'local', agentClient: client }, async () => {
+        const result = await (0, hook_1.evaluateHookRequest)({ ...args, agentClient: client }, JSON.stringify(payload), config);
+        let decision;
+        try {
+            decision = result.stdout ? JSON.parse(result.stdout) : {};
+        }
+        catch {
+            return nativeErrorVerdict(client, 'Invalid FullCourtDefense verdict; action denied.');
+        }
+        if (!decision || typeof decision !== 'object' || Array.isArray(decision))
+            return nativeErrorVerdict(client, 'Invalid FullCourtDefense verdict shape; action denied.');
+        const permission = decision.hookSpecificOutput?.permissionDecision || decision.permissionDecision || decision.permission;
+        let denied = result.exitCode !== 0 || permission === 'deny' || decision.decision === 'block' || decision.continue === false;
+        const reason = decision.hookSpecificOutput?.permissionDecisionReason || decision.permissionDecisionReason || decision.reason || decision.user_message || result.stderr || 'FullCourtDefense policy decision.';
+        if (permission === 'ask' && !denied) {
+            const mapped = (0, hook_1.normalizeClaudePayload)(payload);
+            const call = mapped && mapped.event !== 'ignore' ? (0, hook_1.buildToolCall)(mapped.event, mapped.payload) : null;
+            // No remembered/pending handoff remains when an external dialog is used.
+            if (call && mapped)
+                (0, devConfirm_1.rejectDeveloperConfirmation)(mapped.event, call.toolName, (0, devConfirm_1.actionDigest)(call.toolArgs));
+            let allowed = false;
+            try {
+                allowed = (0, devConfirm_1.isHumanPresent)() && await confirm(`${client}: ${payload.tool_name}\n${reason}`);
+            }
+            catch { /* deny */ }
+            denied = !allowed;
+            (0, telemetry_1.spoolEvent)({ decision: allowed ? 'allow' : 'block', toolName: call?.toolName || payload.tool_name,
+                reason: allowed ? 'Developer approved once in the FullCourtDefense dialog.' : 'Developer declined, confirmation unavailable, or timed out.',
+                approvalScope: 'developer', ...(allowed ? { approvedBy: 'developer' } : {}) });
+        }
+        // Prompt blocks use the documented exit-code contract, not a PreToolUse object.
+        if (payload.hook_event_name === 'UserPromptSubmit' && denied)
+            return nativeErrorVerdict(client, reason);
+        return nativeVerdict(client, denied, reason);
+    });
+}
+async function main() {
+    const flags = (0, hookIo_1.parseHookFlags)(process.argv.slice(2));
+    const client = flags['agent-client'];
+    if (!exports.NATIVE_CLIENTS.includes(client))
+        throw new Error('Unsupported native hook client');
+    const config = (0, config_1.loadConfig)();
+    const shieldId = (0, config_1.resolveCliCredentials)(config, { shieldId: flags['shield-id'] }, { skipDpapi: true }).shieldId;
+    // Return before the vendor's 130s timeout: some clients fail open on timeout.
+    // Bound the entire hook, including multiple patch files and human dialogs.
+    const deadline = setTimeout(() => {
+        const deny = (0, runtimeConfig_1.isSuspendedByCache)() || (0, runtimeConfig_1.cachedEnforcementState)(shieldId).mode === 'block';
+        const result = deny ? nativeErrorVerdict(client, 'FullCourtDefense evaluation deadline exceeded; action not approved.') : nativeVerdict(client, false);
+        if (result.stdout)
+            process.stdout.write(result.stdout + '\n');
+        if (result.stderr)
+            process.stderr.write(result.stderr + '\n');
+        process.exit(result.exitCode);
+    }, 110_000);
+    deadline.unref();
+    const raw = JSON.parse((await (0, hookIo_1.readStdin)()).replace(/^\uFEFF/, ''));
+    const result = await evaluateNativeHook(client, raw, (0, hookIo_1.mapHookFlags)(flags), config);
+    clearTimeout(deadline);
+    if (result.stdout)
+        process.stdout.write(result.stdout + '\n');
+    if (result.stderr)
+        process.stderr.write(result.stderr + '\n');
+    process.exitCode = result.exitCode;
+}
+if (require.main === module)
+    main().catch(error => {
+        const client = (0, hookIo_1.parseHookFlags)(process.argv.slice(2))['agent-client'];
+        const result = nativeErrorVerdict(client, `FullCourtDefense hook failed: ${String(error)}`);
+        if (result.stdout)
+            process.stdout.write(result.stdout + '\n');
+        if (result.stderr)
+            process.stderr.write(result.stderr + '\n');
+        process.exitCode = result.exitCode;
+    });

package/dist/telemetry.d.ts

@@ -1,4 +1,5 @@
 export interface SpoolEvent {
+    agentClient?: string;
     eventId: string;
     type: 'verdict';
     decision: 'allow' | 'block' | 'approval' | 'warn' | 'mask';
@@ -52,6 +53,7 @@ export type VerdictPath = 'ipc' | 'local' | 'fail_open' | 'gateway';
  */
 export declare function evidenceFromToolArgs(toolArgs: Record<string, unknown> | undefined): string | undefined;
 interface VerdictTiming {
+    agentClient?: string;
     startedAt: number;
     path: VerdictPath;
     /** Tool args for this evaluation — stamps `evidence` onto every spooled event. */
@@ -64,6 +66,7 @@ export declare function markVerdictTiming<T>(timing: VerdictTiming, fn: () => T)
  * Keeps the original start time so latency still covers the full wait.
  */
 export declare function setVerdictPath(path: VerdictPath): void;
+export declare function setVerdictClient(client: string): void;
 /** Attach the current tool call's args so every spool in this evaluation carries the command. */
 export declare function setVerdictToolArgs(toolArgs: Record<string, unknown>): void;
 /**

package/dist/telemetry.js

@@ -36,6 +36,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.evidenceFromToolArgs = evidenceFromToolArgs;
 exports.markVerdictTiming = markVerdictTiming;
 exports.setVerdictPath = setVerdictPath;
+exports.setVerdictClient = setVerdictClient;
 exports.setVerdictToolArgs = setVerdictToolArgs;
 exports.restartVerdictTiming = restartVerdictTiming;
 exports.spoolEvent = spoolEvent;
@@ -156,6 +157,11 @@ function setVerdictPath(path) {
     if (store)
         store.path = path;
 }
+function setVerdictClient(client) {
+    const store = verdictTiming.getStore();
+    if (store)
+        store.agentClient = client;
+}
 /** Attach the current tool call's args so every spool in this evaluation carries the command. */
 function setVerdictToolArgs(toolArgs) {
     const store = verdictTiming.getStore();
@@ -185,6 +191,7 @@ function spoolEvent(event) {
             occurredAt: event.occurredAt || new Date().toISOString(),
             type: 'verdict',
             decision: event.decision,
+            agentClient: event.agentClient || timing?.agentClient,
             toolName: event.toolName,
             operation: event.operation,
             reason: event.reason,

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.33.0"
+  "version": "1.34.0"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.33.0",
+  "version": "1.34.0",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {
@@ -13,6 +13,7 @@
     "README.md"
   ],
   "scripts": {
+    "test:native-hooks": "npm run build && node scripts/test-native-hook-launch.js && node scripts/test-native-hook-edges.js && node scripts/test-client-telemetry.js && node scripts/test-native-hook-clients.js",
     "test:endpoint-approvals": "npm run build && node scripts/audit-endpoint-mcp-shell.js",
     "test:endpoint-clients": "npm run build && node scripts/test-endpoint-client-matrix.js && node scripts/test-copilot-hook-install.js",
     "build": "tsc && node scripts/copy-attack-corpus.js",