fullcourtdefense-cli 1.34.1 → 1.34.4

package/dist/actionPolicyEngine.d.ts

@@ -42,6 +42,8 @@ export type ActionPolicyApprovalRemember = 'none' | 'session' | '1h';
 /** What happens when nobody answers within the approval window. */
 export type ActionPolicyApprovalOnTimeout = 'block' | 'org';
 export interface ActionPolicyApproval {
+    /** Explicit admin exception: replace approval from these policies for this constrained target only. Hard blocks still win. */
+    replacesPolicyIds?: string[];
     scope?: ActionPolicyApprovalScope;
     remember?: ActionPolicyApprovalRemember;
     onTimeout?: ActionPolicyApprovalOnTimeout;
@@ -59,6 +61,8 @@ export interface ActionPolicyRule {
     /** Approval routing for `require_approval` rules. Absent = org admin approval, no memory, block on timeout. */
     approval?: ActionPolicyApproval;
 }
+/** Reject ambiguous/broad approval exceptions at authoring time; runtime also fails closed on them. */
+export declare function approvalExceptionError(rule: ActionPolicyRule): string | undefined;
 /**
  * The three kinds of machine a fleet policy can be written for:
  *   - `workstation` — laptops / desktops a person uses (default for any machine that does not say otherwise)

package/dist/actionPolicyEngine.js

@@ -19,6 +19,7 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.DEFAULT_ACTION_POLICY_APPROVAL = exports.CONTENT_FACT_FIELDS = exports.WORKSTATION_ASK_APPROVAL = exports.MACHINE_KINDS = void 0;
+exports.approvalExceptionError = approvalExceptionError;
 exports.normalizeMachineKind = normalizeMachineKind;
 exports.policyTargetsMachineKind = policyTargetsMachineKind;
 exports.ruleNeedsContentFact = ruleNeedsContentFact;
@@ -31,6 +32,25 @@ exports.detectSecretKind = detectSecretKind;
 exports.evaluateActionPolicies = evaluateActionPolicies;
 exports.inferToolContext = inferToolContext;
 exports.inventoryToolMatchesActionPolicy = inventoryToolMatchesActionPolicy;
+/** Reject ambiguous/broad approval exceptions at authoring time; runtime also fails closed on them. */
+function approvalExceptionError(rule) {
+    const ids = rule.approval?.replacesPolicyIds;
+    if (ids === undefined)
+        return undefined;
+    if (!Array.isArray(ids) || ids.length > 50 || ids.some(id => typeof id !== 'string' || !id.trim())) {
+        return 'Approval exceptions must name at most 50 existing policy IDs.';
+    }
+    if (ids.length === 0)
+        return undefined;
+    if (rule.verdict !== 'require_approval' || rule.approval?.scope !== 'developer') {
+        return 'Only an Ask developer rule can replace organization approval.';
+    }
+    if (!['developerName', 'agentName', 'toolName'].every(field => rule.constraints?.some(c => c.field === field && (c.operator === 'equals' || (field === 'agentName' && c.operator === 'contains'))
+        && typeof c.value === 'string' && c.value.trim().length > 0))) {
+        return 'A developer-only exception must identify a developer, an agent and an exact tool.';
+    }
+    return undefined;
+}
 exports.MACHINE_KINDS = ['workstation', 'ci', 'workload'];
 /** Normalize a context value into a MachineKind; anything unknown is a workstation. */
 function normalizeMachineKind(value) {
@@ -1355,6 +1375,29 @@ function evaluateActionPolicies(policies, toolName, operation, context = {}, dec
     let requiredApproval;
     let requiredApprovalResult;
     const approvalObligations = [];
+    const policyApplies = (policy) => policy.enabled !== false
+        && !(policy.scope === 'organization' && !context.developerName) && policyTargetsCall(policy, context);
+    const ruleMatches = (rule) => candidateOperations.some(candidate => operationMatchesRule(candidate, rule.operations, matchText, toolCaps))
+        && (!rule.constraints?.length || rule.constraints.every(c => evaluateConstraint(c, context)));
+    // Exceptions are explicit, name the displaced policies, and require an
+    // attributed developer + concrete agent + exact tool. They never lower a
+    // hard block or a newly added organization approval policy not named here.
+    const replacedApprovalPolicies = new Set();
+    const appliedApprovalExceptions = new Set();
+    for (const policy of policies) {
+        if (!policyApplies(policy) || policy.stage === 'monitor')
+            continue;
+        for (const rule of policy.rules) {
+            if (rule.verdict !== 'require_approval' || rule.approval?.scope !== 'developer' || !ruleMatches(rule))
+                continue;
+            if (approvalExceptionError(rule) || !Array.isArray(rule.approval.replacesPolicyIds))
+                continue;
+            for (const id of rule.approval.replacesPolicyIds) {
+                if (typeof id === 'string' && id !== policy.id)
+                    replacedApprovalPolicies.add(id);
+            }
+        }
+    }
     for (const policy of policies) {
         // Org-scoped policies bind to attributed RUNTIME USERS — anonymous/system calls (no
         // developerName) are deliberately out of scope. Surfaced via skippedOrgPolicies so
@@ -1369,12 +1412,12 @@ function evaluateActionPolicies(policies, toolName, operation, context = {}, dec
             continue;
         const isMonitorStage = policy.stage === 'monitor';
         for (const rule of policy.rules) {
-            if (!candidateOperations.some(candidate => operationMatchesRule(candidate, rule.operations, matchText, toolCaps)))
+            if (!ruleMatches(rule))
+                continue;
+            if (!isMonitorStage && rule.verdict === 'require_approval' && rule.approval?.scope !== 'developer'
+                && policy.enforcement !== 'hard' && replacedApprovalPolicies.has(policy.id)) {
+                appliedApprovalExceptions.add(`${policy.name} (${policy.id})`);
                 continue;
-            if (rule.constraints && rule.constraints.length > 0) {
-                const allMatch = rule.constraints.every(c => evaluateConstraint(c, context));
-                if (!allMatch)
-                    continue;
             }
             const constraintDesc = rule.constraints?.map(c => `${c.field} ${c.operator} ${c.value}`).join(', ');
             const matchedRule = `${rule.operations.join('/')} → ${rule.verdict}${constraintDesc ? ` (${constraintDesc})` : ''}`;
@@ -1426,7 +1469,7 @@ function evaluateActionPolicies(policies, toolName, operation, context = {}, dec
             else if (rule.verdict === 'require_approval' && worstResult.verdict === 'require_approval') {
                 // A second approval rule matched: keep the first rule's attribution but tighten the
                 // approval routing to the most restrictive of both (a developer-scoped rule can never
-                // relax an org-scoped one that also fires).
+                // relax an org-scoped one unless explicitly replaced above).
                 worstResult = {
                     ...worstResult,
                     approval: mergeApprovalOptions(worstResult.approval || exports.DEFAULT_ACTION_POLICY_APPROVAL, resolveApprovalOptions(rule.approval)),
@@ -1463,6 +1506,9 @@ function evaluateActionPolicies(policies, toolName, operation, context = {}, dec
     if (worstResult.verdict === 'require_approval' && approvalObligations.length > 1) {
         worstResult = { ...worstResult, matchedRule: [...approvalObligations].sort().join('; ') };
     }
+    if (appliedApprovalExceptions.size > 0) {
+        worstResult = { ...worstResult, reason: `${worstResult.reason || worstResult.verdict}; explicit developer approval exception replaces: ${[...appliedApprovalExceptions].sort().join(', ')}` };
+    }
     if (monitorMatches.length > 0) {
         worstResult = { ...worstResult, monitorMatches };
     }

package/dist/codexMcpIdentity.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Name dictionary, not an effective configuration or an authorization source.
+ * Include user-owned profiles conservatively: hook payloads do not identify the
+ * selected profile. Aliases shared by different names are denied, never guessed.
+ * Never consult project files unless the user configuration trusts their root.
+ */
+export declare function codexMcpServerNames(home?: string, cwd?: string): string[];
+/** Codex exposes sanitized tool namespaces. Resolve only unique configured identities. */
+export declare function resolveCodexMcpTool(tool: string, serverNames: string[]): {
+    server: string;
+    tool: string;
+} | undefined;

package/dist/codexMcpIdentity.js

@@ -0,0 +1,119 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.codexMcpServerNames = codexMcpServerNames;
+exports.resolveCodexMcpTool = resolveCodexMcpTool;
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const toml_1 = require("@iarna/toml");
+/** Parse config without executing commands or exposing its contents in errors. */
+function readConfig(file) {
+    try {
+        return (0, toml_1.parse)(fs.readFileSync(file, 'utf8').replace(/^\uFEFF/, ''));
+    }
+    catch (err) {
+        if (err.code === 'ENOENT')
+            return {};
+        throw new Error('Cannot parse Codex configuration to resolve MCP server identity.');
+    }
+}
+/**
+ * Name dictionary, not an effective configuration or an authorization source.
+ * Include user-owned profiles conservatively: hook payloads do not identify the
+ * selected profile. Aliases shared by different names are denied, never guessed.
+ * Never consult project files unless the user configuration trusts their root.
+ */
+function codexMcpServerNames(home = process.env.CODEX_HOME || path.join(os.homedir(), '.codex'), cwd = process.cwd()) {
+    const base = readConfig(path.join(home, 'config.toml'));
+    const configs = [base];
+    const system = process.platform === 'win32'
+        ? path.join(process.env.ProgramData || 'C:\\ProgramData', 'OpenAI', 'Codex', 'config.toml')
+        : '/etc/codex/config.toml';
+    configs.push(readConfig(system));
+    let profiles = [];
+    try {
+        profiles = fs.readdirSync(home).filter(name => /^[A-Za-z0-9_-]+\.config\.toml$/.test(name));
+    }
+    catch (err) {
+        if (err.code !== 'ENOENT')
+            throw err;
+    }
+    for (const file of profiles) {
+        // An invalid, unselected profile is not active in Codex and cannot supply names.
+        // Selecting an invalid profile fails Codex startup itself.
+        try {
+            configs.push(readConfig(path.join(home, file)));
+        }
+        catch { /* inactive invalid profile */ }
+    }
+    const within = (root, dir) => {
+        const rel = path.relative(root, dir);
+        return rel === '' || (rel !== '..' && !rel.startsWith('..' + path.sep) && !path.isAbsolute(rel));
+    };
+    const roots = Object.keys(base.projects || {}).filter(root => path.isAbsolute(root) && within(root, path.resolve(cwd)))
+        .sort((a, b) => b.length - a.length);
+    const trustedRoot = roots[0];
+    if (trustedRoot && base.projects[trustedRoot]?.trust_level === 'trusted') {
+        for (let dir = path.resolve(cwd); within(trustedRoot, dir); dir = path.dirname(dir)) {
+            configs.push(readConfig(path.join(dir, '.codex', 'config.toml')));
+            if (path.dirname(dir) === dir)
+                break;
+        }
+    }
+    const names = new Set();
+    for (const config of configs) {
+        if (config.mcp_servers && typeof config.mcp_servers === 'object' && !Array.isArray(config.mcp_servers)) {
+            for (const name of Object.keys(config.mcp_servers))
+                names.add(name);
+        }
+    }
+    return [...names];
+}
+/** Codex exposes sanitized tool namespaces. Resolve only unique configured identities. */
+function resolveCodexMcpTool(tool, serverNames) {
+    if (!tool.startsWith('mcp__'))
+        return undefined;
+    const matches = [...new Set(serverNames)].flatMap(server => {
+        const aliases = new Set([server, server.replace(/[^A-Za-z0-9_]/g, '_')]);
+        return [...aliases].filter(alias => tool.startsWith(`mcp__${alias}__`))
+            .map(alias => ({ server, tool: tool.slice(`mcp__${alias}__`.length) }));
+    });
+    if (matches.length > 1)
+        throw new Error('Ambiguous Codex MCP server identity; use distinct server names.');
+    if (matches.length && !matches[0].tool)
+        throw new Error('Missing Codex MCP tool name.');
+    return matches[0];
+}

package/dist/commands/daemon.js

@@ -1220,6 +1220,7 @@ async function runDaemon(args, config) {
                 machineId: identity.machineId,
                 force: true,
                 timeoutMs: BUNDLE_FETCH_TIMEOUT_MS,
+                requireServerValidation: true,
             });
             if (typeof bundle.pollIntervalMs === 'number' && Number.isFinite(bundle.pollIntervalMs)) {
                 bundlePollBaseMs = Math.min(Math.max(bundle.pollIntervalMs, 15_000), 60 * 60_000);
@@ -1318,7 +1319,12 @@ async function runDaemon(args, config) {
             }
             catch { /* hooks fall back to their own bounded fetch */ }
         }
-        catch { /* offline — cached stance applies */ }
+        catch (error) {
+            // Local enforcement can keep using its cache, but this delivery check
+            // failed. Let the scheduler retry promptly instead of treating it as a
+            // successful poll and waiting the full (server-configurable) cadence.
+            throw error;
+        }
     };
     const heartbeat = async () => {
         (0, daemonForensics_1.touchDaemonAlive)();
@@ -1419,7 +1425,11 @@ async function runDaemon(args, config) {
     // First: if this boot IS the post-upgrade relaunch, confirm the pending
     // upgrade_cli action before anything else touches the control plane.
     await verifyPendingUpgrade();
-    await pollBundle();
+    await (0, pollLoop_1.runWithDeadline)({
+        run: pollBundle,
+        deadlineMs: BUNDLE_POLL_DEADLINE_MS,
+        onError: error => log(`Initial bundle check failed: ${error instanceof Error ? error.message : String(error)} — background polling will retry.`),
+    });
     // One protective pass at startup so a machine that drifted while the daemon
     // was down converges immediately. Runs BEFORE the first heartbeat: upgrades
     // legitimately leave stale hook/wrap paths behind, and heartbeating first
@@ -1564,7 +1574,7 @@ async function runDaemon(args, config) {
         intervalMs: () => bundlePollBaseMs,
         deadlineMs: BUNDLE_POLL_DEADLINE_MS,
         onStalled: deadlineMs => {
-            log(`Bundle poll did not finish within ${Math.round(deadlineMs / 1000)}s — abandoned; remote actions and policy updates were delayed. Next poll continues normally.`);
+            log(`Bundle check did not finish within ${Math.round(deadlineMs / 1000)}s — stopped waiting and scheduled a retry. This timeout does not confirm its cause or recovery.`);
             (0, distress_1.reportDistress)('bundle', distress_1.DISTRESS.POLL_STALLED, `bundle poll exceeded ${deadlineMs}ms`);
         },
         onError: error => log(`Bundle poll error: ${error instanceof Error ? error.message : String(error)}`),

package/dist/commands/hook.js

@@ -161,8 +161,11 @@ function mapClaudeToolPayload(payload) {
     // MCP tools arrive as `mcp__<server>__<tool>` (same in Claude Code and VS Code).
     if (toolName.startsWith('mcp__')) {
         const parts = toolName.split('__');
-        const server = parts[1] || 'mcp';
-        const shortTool = parts.slice(2).join('__') || toolName;
+        // A verified explicit server preserves names containing the separator itself.
+        const explicitServer = str(payload.mcp_server_name);
+        const server = explicitServer && toolName.startsWith(`mcp__${explicitServer}__`)
+            ? explicitServer : parts[1] || 'mcp';
+        const shortTool = toolName.slice(`mcp__${server}__`.length) || toolName;
         return {
             event: 'mcp',
             payload: { ...payload, tool_name: shortTool, mcp_server_name: server, tool_input: input },
@@ -789,7 +792,9 @@ function tryLocalPolicyEnforcement(ctx, call, detail, opts = {}) {
     }
     const { operation, context } = (0, actionPolicyEngine_1.inferToolContext)(call.toolName, call.toolArgs);
     context.toolName = call.toolName;
-    (0, machineIdentity_1.stampMachineIdentityContext)(context, developerId());
+    (0, machineIdentity_1.stampRuntimeIdentityContext)(context, {
+        developerName: developerId(), agentName: agentNameForCall(ctx.event, ctx.payload, ctx.client), agentClient: ctx.client,
+    });
     const declaredOperations = (0, actionPolicyEngine_1.deriveToolOperations)(call.toolName);
     const local = (0, actionPolicyEngine_1.evaluateActionPolicies)(policies, call.toolName, operation, context, declaredOperations);
     (0, hookIo_1.dbg)({ phase: 'policy_local_verdict', event: ctx.event, tool: call.toolName, operation, verdict: local.verdict, policyName: local.policyName, detail });
@@ -1800,7 +1805,9 @@ async function enforceActionPolicy(ctx) {
     if (ctx.localPolicies && (ctx.localPolicies.length > 0 || localAskPending)) {
         const { operation: localOp, context: localCtx } = (0, actionPolicyEngine_1.inferToolContext)(call.toolName, call.toolArgs);
         localCtx.toolName = call.toolName;
-        (0, machineIdentity_1.stampMachineIdentityContext)(localCtx, developerId());
+        (0, machineIdentity_1.stampRuntimeIdentityContext)(localCtx, {
+            developerName: developerId(), agentName: agentNameForCall(event, payload, ctx.client), agentClient: ctx.client,
+        });
         const localVerdict = (0, actionPolicyEngine_1.evaluateActionPolicies)(ctx.localPolicies, call.toolName, localOp, localCtx, (0, actionPolicyEngine_1.deriveToolOperations)(call.toolName));
         (0, hookIo_1.dbg)({ phase: 'policy_local_first', event, tool: call.toolName, operation: localOp, verdict: localVerdict.verdict, policyName: localVerdict.policyName });
         if (localVerdict.verdict === 'allow') {

package/dist/commands/mcpGateway.js

@@ -475,6 +475,7 @@ class StdioMcpClient {
     buffer = '';
     nextId = 1;
     pending = new Map();
+    closed = false;
     constructor(command, args, onClosed) {
         this.onClosed = onClosed;
         if (!command)
@@ -482,9 +483,12 @@ class StdioMcpClient {
         this.child = spawnDownstream(command, args);
         this.child.stdout.setEncoding('utf8');
         this.child.stdout.on('data', chunk => this.onData(chunk));
+        this.child.stdout.on('end', () => this.fail(new Error('Downstream MCP response stream closed.')));
+        this.child.stdout.on('error', error => this.fail(error));
+        this.child.stdin.on('error', error => this.fail(error));
         this.child.stderr.on('data', chunk => process.stderr.write(String(chunk)));
-        this.child.on('error', error => { this.rejectAll(error); this.onClosed?.(); });
-        this.child.on('exit', code => { this.rejectAll(new Error(`Downstream MCP server exited (${code ?? 'signal'}).`)); this.onClosed?.(); });
+        this.child.on('error', error => this.fail(error));
+        this.child.on('exit', code => this.fail(new Error(`Downstream MCP server exited (${code ?? 'signal'}).`)));
     }
     async initialize() {
         await this.request('initialize', {
@@ -513,31 +517,48 @@ class StdioMcpClient {
         return this.request('tools/call', { name, arguments: args });
     }
     close() {
-        this.child.kill();
+        this.fail(new Error('Downstream MCP connection closed.'));
+    }
+    fail(error) {
+        if (this.closed)
+            return;
+        this.closed = true;
+        this.rejectAll(error);
+        this.onClosed?.();
+        // A process can stay alive after its transport closes. Retire it so it
+        // cannot orphan itself; only a new client request may start a replacement.
+        try {
+            this.child.kill();
+        }
+        catch { /* already gone */ }
     }
     request(method, params) {
+        if (this.closed)
+            return Promise.reject(new Error('Downstream MCP connection is closed. Retry with a new request.'));
         const id = this.nextId++;
-        this.write({ jsonrpc: '2.0', id, method, params });
         return new Promise((resolve, reject) => {
             const timeout = setTimeout(() => {
-                this.pending.delete(String(id));
                 // A downstream that ignores a request for a full minute is hung, not
                 // slow — kill it so the exit handler rejects everything in flight and
                 // the gateway respawns a fresh downstream on the next call.
-                try {
-                    this.child.kill();
-                }
-                catch { /* already gone */ }
-                reject(new Error(`MCP request timed out: ${method} — downstream server killed; it restarts on the next call.`));
+                this.fail(new Error(`MCP request timed out: ${method} — downstream server killed; it restarts on the next call.`));
             }, 60000);
             this.pending.set(String(id), { resolve, reject, timeout });
+            this.write({ jsonrpc: '2.0', id, method, params });
         });
     }
     notify(method, params) {
         this.write({ jsonrpc: '2.0', method, params });
     }
     write(message) {
-        this.child.stdin.write(`${JSON.stringify(message)}\n`);
+        if (this.closed)
+            return;
+        try {
+            this.child.stdin.write(`${JSON.stringify(message)}\n`);
+        }
+        catch (error) {
+            this.fail(error instanceof Error ? error : new Error(String(error)));
+        }
     }
     onData(chunk) {
         this.buffer += chunk;
@@ -1001,6 +1022,12 @@ class McpGatewayServer {
             return;
         }
         try {
+            // Heartbeats belong to this transport: they must stay responsive even
+            // while the downstream is starting or a developer is deciding a call.
+            if (message.method === 'ping') {
+                this.respond(message.id, {});
+                return;
+            }
             if (message.method === 'initialize') {
                 const caps = message.params?.capabilities;
                 this.clientSupportsElicitation = Boolean(caps && typeof caps === 'object' && caps.elicitation !== undefined && caps.elicitation !== null);
@@ -1324,7 +1351,7 @@ class McpGatewayServer {
                 if (cachedPolicies && cachedPolicies.length > 0) {
                     const context = inferred.context;
                     context.toolName = toolName;
-                    (0, machineIdentity_1.stampMachineIdentityContext)(context, this.gatewayConfig.developerName);
+                    (0, machineIdentity_1.stampRuntimeIdentityContext)(context, this.gatewayConfig);
                     const local = (0, actionPolicyEngine_1.evaluateActionPolicies)(cachedPolicies, toolName, localOperation, context, (0, actionPolicyEngine_1.deriveToolOperations)(toolName));
                     if (local.verdict === 'block' || local.verdict === 'require_approval') {
                         const wouldWhat = local.verdict === 'require_approval' ? 'require approval for' : 'block';
@@ -1354,7 +1381,7 @@ class McpGatewayServer {
                 const localOperation = operation || inferred.operation;
                 const context = inferred.context;
                 context.toolName = toolName;
-                (0, machineIdentity_1.stampMachineIdentityContext)(context, this.gatewayConfig.developerName);
+                (0, machineIdentity_1.stampRuntimeIdentityContext)(context, this.gatewayConfig);
                 const local = (0, actionPolicyEngine_1.evaluateActionPolicies)(cachedPolicies, toolName, localOperation, context, (0, actionPolicyEngine_1.deriveToolOperations)(toolName));
                 if (local.verdict === 'block') {
                     const reason = local.reason || `${toolName}: blocked by org Action Policy`;
@@ -1364,14 +1391,13 @@ class McpGatewayServer {
                     throw blockError(explainGatewayPolicy('block', toolName, toolArgs, local, cachedPolicies));
                 }
                 if (local.verdict === 'require_approval'
-                    && (0, actionPolicyEngine_1.effectiveApprovalScope)(local.approval, { humanPresent: (0, devConfirm_1.isHumanPresent)() }) === 'developer'
-                    && this.clientSupportsElicitation) {
+                    && (0, actionPolicyEngine_1.effectiveApprovalScope)(local.approval, { humanPresent: (0, devConfirm_1.isHumanPresent)() }) === 'developer') {
                     // Developer-scoped approval (an explicit developer rule, or an org
                     // `block` softened by the workstation ceiling): ask the human through
                     // the MCP client — same ledger and session memory as the IDE hook.
                     // Accept → allow (recorded as the developer's decision); decline /
-                    // timeout → block. A client without elicitation falls through to the
-                    // org approval queue below — never a silent allow.
+                    // timeout → block. Missing client confirmation support must not
+                    // silently change a developer-only decision to organization approval.
                     const answered = await this.askDeveloperForPolicy(toolName, toolArgs, localOperation, local, cachedPolicies);
                     if (answered)
                         preflight = { allowed: true, decision: 'allow', operation: localOperation };
@@ -1445,7 +1471,7 @@ class McpGatewayServer {
                         const localOperation = operation || inferred.operation;
                         const context = inferred.context;
                         context.toolName = toolName;
-                        (0, machineIdentity_1.stampMachineIdentityContext)(context, this.gatewayConfig.developerName);
+                        (0, machineIdentity_1.stampRuntimeIdentityContext)(context, this.gatewayConfig);
                         const local = (0, actionPolicyEngine_1.evaluateActionPolicies)(cachedPolicies, toolName, localOperation, context, (0, actionPolicyEngine_1.deriveToolOperations)(toolName));
                         const blocking = local.verdict === 'block' || local.verdict === 'require_approval';
                         if (blocking && !reportOnlyMode) {
@@ -1810,6 +1836,12 @@ class McpGatewayServer {
      * throws the block error when the developer declines or does not answer.
      */
     async askDeveloperForPolicy(toolName, toolArgs, operation, verdict, policies) {
+        if (!this.clientSupportsElicitation) {
+            const reason = 'This rule requires developer confirmation inside the IDE, but this MCP client does not support confirmation prompts. The action was not executed. Update or reconnect the IDE integration.';
+            (0, telemetry_1.spoolEvent)({ decision: 'block', toolName, operation, reason, approvalScope: 'developer', ruleId: verdict.policyId });
+            (0, telemetry_1.triggerFlush)(true);
+            throw blockError(reason);
+        }
         const rememberScope = { toolName, operation, policyId: verdict.policyId, matchedRule: verdict.matchedRule };
         const sessionId = runtimeSessionId() || this.gatewaySessionId;
         const policyLabel = verdict.policyName ? ` (${verdict.policyName})` : '';
@@ -1872,7 +1904,7 @@ class McpGatewayServer {
         const started = Date.now();
         const evidence = input.evidence ? `\n\nEvidence: ${input.evidence.slice(0, 240)}` : '';
         const response = await this.requestClient('elicitation/create', {
-            message: `FullCourtDefense — your organization asks you to confirm this action.\n\nTool: ${input.toolName}\nRule: ${input.ruleLabel}\nWhy: ${input.reason}${evidence}\n\nAllow this tool call? Your answer is reported to your security dashboard as your decision.`,
+            message: `FullCourtDefense — your organization asks you to confirm this action.\n\nAgent: ${this.gatewayConfig.agentName}\nIDE: ${this.gatewayConfig.agentClient}\nDeveloper: ${this.gatewayConfig.developerName || 'Unknown'}\nTool: ${input.toolName}\nRule: ${input.ruleLabel}\nWhy: ${input.reason}${evidence}\n\nAllow this tool call? Your answer is reported to your security dashboard as your decision.`,
             requestedSchema: {
                 type: 'object',
                 properties: {

package/dist/machineIdentity.d.ts

@@ -45,5 +45,11 @@ export declare function resetLocalMachineKindCache(): void;
  * workload). `developerName` is only set when the caller resolved one.
  */
 export declare function stampMachineIdentityContext<T extends Record<string, string>>(context: T, developerName?: string): T;
+/** Stamp trusted runtime identity after argument inference, for every local policy path. */
+export declare function stampRuntimeIdentityContext<T extends Record<string, string>>(context: T, identity: {
+    developerName: string;
+    agentName: string;
+    agentClient: string;
+}): T;
 /** Suggested per-machine Shield name, e.g. `boazl@boaz-pc · Windows 11`. */
 export declare function suggestedShieldName(identity?: MachineIdentity): string;

package/dist/machineIdentity.js

@@ -38,6 +38,7 @@ exports.getMachineIdentity = getMachineIdentity;
 exports.localMachineKind = localMachineKind;
 exports.resetLocalMachineKindCache = resetLocalMachineKindCache;
 exports.stampMachineIdentityContext = stampMachineIdentityContext;
+exports.stampRuntimeIdentityContext = stampRuntimeIdentityContext;
 exports.suggestedShieldName = suggestedShieldName;
 const child_process_1 = require("child_process");
 const crypto = __importStar(require("crypto"));
@@ -296,6 +297,13 @@ function stampMachineIdentityContext(context, developerName) {
     context.humanPresent = (0, devConfirm_1.isHumanPresent)() ? 'true' : 'false';
     return context;
 }
+/** Stamp trusted runtime identity after argument inference, for every local policy path. */
+function stampRuntimeIdentityContext(context, identity) {
+    stampMachineIdentityContext(context, identity.developerName);
+    context.agentName = identity.agentName;
+    context.agentClient = identity.agentClient;
+    return context;
+}
 /** Suggested per-machine Shield name, e.g. `boazl@boaz-pc · Windows 11`. */
 function suggestedShieldName(identity = getMachineIdentity()) {
     return `${identity.developerName} · ${identity.osFriendly}`;

package/dist/nativeHook.d.ts

@@ -4,7 +4,7 @@ export type NativeClient = 'codex' | 'gemini_cli' | 'windsurf' | 'kiro';
 type Payload = Record<string, any>;
 export declare const NATIVE_CLIENTS: NativeClient[];
 export declare function patchToolCalls(raw: Payload): Payload[];
-export declare function normalizeNativeInput(client: NativeClient, raw: Payload): Payload;
+export declare function normalizeNativeInput(client: NativeClient, raw: Payload, codexServers?: string[]): Payload;
 export declare function nativeVerdict(client: NativeClient, denied: boolean, reason?: string): {
     stdout: string;
     stderr: string;

package/dist/nativeHook.js

@@ -15,6 +15,7 @@ const runtimeConfig_1 = require("./runtimeConfig");
 const hookIo_1 = require("./hookIo");
 const devConfirm_1 = require("./devConfirm");
 const telemetry_1 = require("./telemetry");
+const codexMcpIdentity_1 = require("./codexMcpIdentity");
 exports.NATIVE_CLIENTS = ['codex', 'gemini_cli', 'windsurf', 'kiro'];
 function patchToolCalls(raw) {
     const patch = typeof raw.tool_input === 'string' ? raw.tool_input : String(raw.tool_input?.command || raw.tool_input?.patch || '');
@@ -37,10 +38,17 @@ function patchToolCalls(raw) {
         throw new Error('Patch contains no recognized file operations');
     return calls;
 }
-function normalizeNativeInput(client, raw) {
+function normalizeNativeInput(client, raw, codexServers = []) {
     let name = String(raw.hook_event_name || '');
     let tool = String(raw.tool_name || '');
     let input = raw.tool_input || {};
+    if (client === 'codex') {
+        const identity = (0, codexMcpIdentity_1.resolveCodexMcpTool)(tool, codexServers);
+        if (identity) {
+            tool = `mcp__${identity.server}__${identity.tool}`;
+            raw = { ...raw, mcp_server_name: identity.server };
+        }
+    }
     if (client === 'windsurf') {
         const event = String(raw.agent_action_name || '');
         const info = raw.tool_info || {};
@@ -158,7 +166,7 @@ async function evaluateNativeHook(client, raw, args, config, confirm = confirmNa
     }
     let payload;
     try {
-        payload = normalizeNativeInput(client, raw);
+        payload = normalizeNativeInput(client, raw, client === 'codex' && String(raw.tool_name || '').startsWith('mcp__') ? (0, codexMcpIdentity_1.codexMcpServerNames)() : []);
     }
     catch (error) {
         return nativeErrorVerdict(client, `FullCourtDefense could not parse the hook: ${String(error)}`);

package/dist/runtimeConfig.d.ts

@@ -99,6 +99,8 @@ export interface FetchBundleInput {
      * 6 health checkpoints false-alarmed on p95 latency spikes.
      */
     timeoutMs?: number;
+    /** Background delivery checks must surface failure so their scheduler retries. */
+    requireServerValidation?: boolean;
     /**
      * Hot-path caller (hook / MCP gateway): when the cached mode is monitor or
      * shadow, accept a STALE cache without a synchronous refresh — the resident
@@ -115,7 +117,7 @@ export interface EffectiveBundle extends RuntimeBundle {
 }
 /**
  * Resolve the effective runtime bundle for a Shield, using the local cache when
- * fresh and refreshing (briefly) when stale. Never throws — falls back to cache
+ * fresh and refreshing (briefly) when stale. By default, falls back to cache
  * or a 'default' marker so the caller can apply its local fallback.
  */
 export declare function getRuntimeBundle(input: FetchBundleInput): Promise<EffectiveBundle>;

package/dist/runtimeConfig.js

@@ -212,7 +212,7 @@ function sanitizeBundlePolicies(value) {
 }
 /**
  * Resolve the effective runtime bundle for a Shield, using the local cache when
- * fresh and refreshing (briefly) when stale. Never throws — falls back to cache
+ * fresh and refreshing (briefly) when stale. By default, falls back to cache
  * or a 'default' marker so the caller can apply its local fallback.
  */
 async function getRuntimeBundle(input) {
@@ -220,7 +220,7 @@ async function getRuntimeBundle(input) {
     const cache = readCacheFile();
     const cached = cache[input.shieldId];
     const fresh = cached && Date.now() - cached.fetchedAt < ttl;
-    if (cached && fresh && !input.force) {
+    if (cached && fresh && !input.force && !input.requireServerValidation) {
         return cachedToEffective(cached);
     }
     // MONITOR CONTRACT: hot-path callers never wait on a refresh for a
@@ -231,7 +231,7 @@ async function getRuntimeBundle(input) {
     // up a kill-switch flip or a monitor->block promotion. Past the bound, ONE
     // hook per revalidate interval falls through to the bounded (≤1.5s) refresh
     // below; concurrent/subsequent hooks keep taking the stale cache.
-    if (cached && !input.force && input.hotPath && cached.mode !== 'block') {
+    if (cached && !input.force && !input.requireServerValidation && input.hotPath && cached.mode !== 'block') {
         const age = Date.now() - cached.fetchedAt;
         const sinceLastAttempt = Date.now() - (cached.revalidateAttemptAt || 0);
         if (age < HOT_PATH_MAX_STALE_MS || sinceLastAttempt < HOT_PATH_REVALIDATE_INTERVAL_MS) {
@@ -266,11 +266,12 @@ async function getRuntimeBundle(input) {
         // suspended field — a hand-edited `suspended: false` cache would otherwise
         // launder the edit through the 304. Clearing requires a full server body.
         if (resp.status === 304 && cached) {
-            cache[input.shieldId] = { ...cached, fetchedAt: Date.now() };
+            const validated = { ...cached, fetchedAt: Date.now() };
+            cache[input.shieldId] = validated;
             writeCacheFile(cache);
             if (cached.suspended === true)
                 assertSuspendMarker(input.shieldId);
-            return cachedToEffective(cached);
+            return cachedToEffective(validated);
         }
         if (resp.status === 401 || resp.status === 403) {
             // The backend REACHED us and rejected the key — a credential problem,
@@ -327,6 +328,9 @@ async function getRuntimeBundle(input) {
         (0, distress_1.reportDistress)('bundle', distress_1.DISTRESS.NETWORK_DOWN, error instanceof Error ? error.message : String(error));
         /* fall through to cache / default */
     }
+    if (input.requireServerValidation) {
+        throw new Error('Background bundle check did not receive a valid server response; cached policies remain available to local callers');
+    }
     if (cached) {
         return cachedToEffective(cached);
     }

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.34.1"
+  "version": "1.34.4"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.34.1",
+  "version": "1.34.4",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {
@@ -58,7 +58,7 @@
     "test:scan-root-compaction": "npm run build && node scripts/test-scan-root-compaction.js",
     "test:dpapi-config": "npm run build && node scripts/test-dpapi-config.js",
     "test:distress-ledger": "npm run build && node scripts/test-distress-ledger.js",
-    "test:poll-loop": "npm run build && node scripts/test-poll-loop-resilience.js",
+    "test:poll-loop": "npm run build && node scripts/test-poll-loop-resilience.js && node scripts/test-background-bundle.js",
     "test:slim-hook": "npm run build && node scripts/test-slim-hook.js",
     "test:killswitch": "npm run build && node scripts/test-killswitch-integrity.js",
     "test:restart-guarantees": "npm run build && node scripts/test-daemon-restart-guarantees.js",
@@ -118,6 +118,7 @@
     "node": ">=18.0.0"
   },
   "dependencies": {
+    "@iarna/toml": "^2.2.5",
     "@napi-rs/keyring": "^1.3.0",
     "yaml": "^2.8.4"
   }