fullcourtdefense-cli 1.34.21 → 1.34.25

package/dist/agentTerminal.js

@@ -36,7 +36,6 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.IDE_CONFIRMATION_WINDOW_MS = exports.AGENT_TERMINAL_IDE_CONFIRMED = exports.AGENT_TERMINAL_ASK_BLOCKED = exports.AGENT_TERMINAL_MARKERS = void 0;
 exports.isAgentDrivenTerminal = isAgentDrivenTerminal;
 exports.ideShellPendingKey = ideShellPendingKey;
-exports.ideLocalSafetyRememberKey = ideLocalSafetyRememberKey;
 exports.ideConfirmedFor = ideConfirmedFor;
 exports.buildAgentTerminalJs = buildAgentTerminalJs;
 exports.buildAgentTerminalPs = buildAgentTerminalPs;
@@ -84,19 +83,13 @@ exports.AGENT_TERMINAL_ASK_BLOCKED = 'an AI agent is driving this terminal, so n
 /** Shown when the IDE prompt already answered for this exact command. */
 exports.AGENT_TERMINAL_IDE_CONFIRMED = 'allowed through the IDE permission gate; confirmation is recorded by the IDE post-execution hook.';
 // ---------------------------------------------------------------------------
-// IDE-answer lookup keys. These MUST match devConfirm.ts: the hook raises a
-// pending marker keyed by sha256(`${event}|${tool}|${sha256('cmd:'+command)}`)
-// with event 'shell' and tool 'shell', and a remembered entry keyed by
-// sha256(`shell|local-safety:${ruleId}|${ruleId}`) for Local Safety ask rules.
+// Exact command + working directory handoff keys match devConfirm v3.
+// A handoff delegates to the IDE permission gate; it is never consent.
 // ---------------------------------------------------------------------------
 const sha256 = (value) => crypto.createHash('sha256').update(value).digest('hex');
 /** Pending-marker key the IDE hook wrote for this shell command (see devConfirm.pendingKey). */
-function ideShellPendingKey(command) {
-    return sha256(`shell|shell|${sha256(`cmd:${command.trim()}`)}`);
-}
-/** Remembered-confirmation key for a Local Safety ask rule on the shell tool (see devConfirm rememberKey). */
-function ideLocalSafetyRememberKey(ruleId) {
-    return sha256(`shell|local-safety:${ruleId}|${ruleId}`);
+function ideShellPendingKey(command, cwd = process.cwd()) {
+    return sha256(JSON.stringify(['shell', 'shell', sha256(`args-v3:${JSON.stringify({ command, cwd })}`)]));
 }
 /** Maximum lifetime of an exact-command IDE permission handoff (not consent). */
 exports.IDE_CONFIRMATION_WINDOW_MS = 10 * 60_000;
@@ -106,12 +99,9 @@ exports.IDE_CONFIRMATION_WINDOW_MS = 10 * 60_000;
  * by the generated guard code below.
  */
 function ideConfirmedFor(ledger, command, ruleId, now = Date.now(), sessionId) {
-    if (!ledger || ledger.formatVersion !== 2)
-        return false;
-    // A pending prompt is not an affirmative answer. IDE handoffs are handled
-    // separately by the generated guard, without claiming developer consent.
-    const rememberKey = ideLocalSafetyRememberKey(ruleId);
-    return (ledger.remembered || []).some(r => r?.key === rememberKey && typeof r.expiresAt === 'string' && Date.parse(r.expiresAt) > now && (r.remember === '1h' || (r.remember === 'session' && !!sessionId && r.sessionId === sessionId)));
+    // Terminal guards lack the hook's complete policy/context snapshot. They
+    // cannot reconstruct a scoped approval and must never infer one from a rule.
+    return false;
 }
 // ---------------------------------------------------------------------------
 // Rendered snippets for the generated guards (single source of truth).
@@ -129,7 +119,7 @@ function buildAgentTerminalJs() {
         `function agentTerminal(){const e=process.env;return AGENT_MARKERS.some(m=>m.v!==undefined?e[m.n]===m.v:(typeof e[m.n]==='string'&&e[m.n].length>0));}`,
         `const IDE_WINDOW_MS=${exports.IDE_CONFIRMATION_WINDOW_MS};`,
         `function sha(s){return crypto.createHash('sha256').update(s).digest('hex');}`,
-        `function ideConfirmed(line,ruleId){try{const ledger=JSON.parse(fs.readFileSync(path.join(os.homedir(),'.fullcourtdefense','dev-confirm.json'),'utf8'));const now=Date.now();const pk=sha('shell|shell|'+sha('cmd:'+line.trim()));if((ledger.pending||[]).some(p=>p&&p.permissionHandoff===true&&p.key===pk&&typeof p.raisedAt==='string'&&now>=Date.parse(p.raisedAt)&&now-Date.parse(p.raisedAt)<IDE_WINDOW_MS))return true;if(ledger.formatVersion!==2)return false;const rk=sha('shell|local-safety:'+ruleId+'|'+ruleId);const session=process.env.FCD_SESSION_ID||process.env.CLAUDE_CODE_SESSION_ID||process.env.CODEX_THREAD_ID;return (ledger.remembered||[]).some(r=>r&&r.key===rk&&typeof r.expiresAt==='string'&&Date.parse(r.expiresAt)>now&&(r.remember==='1h'||(r.remember==='session'&&session&&r.sessionId===session)));}catch{return false;}}`,
+        `function ideConfirmed(line,ruleId){try{const ledger=JSON.parse(fs.readFileSync(path.join(os.homedir(),'.fullcourtdefense','dev-confirm.json'),'utf8'));if(ledger.formatVersion!==3)return false;const now=Date.now();const pk=sha(JSON.stringify(['shell','shell',sha('args-v3:'+JSON.stringify({command:line,cwd:process.cwd()}))]));const session=process.env.FCD_SESSION_ID||process.env.CLAUDE_CODE_SESSION_ID||process.env.CODEX_THREAD_ID;if(!session)return false;return (ledger.pending||[]).some(p=>p&&p.permissionHandoff===true&&p.sessionId===session&&p.key===pk&&typeof p.raisedAt==='string'&&now>=Date.parse(p.raisedAt)&&now-Date.parse(p.raisedAt)<IDE_WINDOW_MS);}catch{return false;}}`,
         `const AGENT_ASK_BLOCKED=${JSON.stringify(exports.AGENT_TERMINAL_ASK_BLOCKED)};`,
         `const AGENT_IDE_CONFIRMED=${JSON.stringify(exports.AGENT_TERMINAL_IDE_CONFIRMED)};`,
     ].join('\n');
@@ -165,24 +155,19 @@ function buildAgentTerminalPs() {
         `    $ledgerPath = Join-Path $HOME '.fullcourtdefense\\dev-confirm.json'`,
         `    if (-not (Test-Path -LiteralPath $ledgerPath)) { return $false }`,
         `    $ledger = Get-Content -LiteralPath $ledgerPath -Raw | ConvertFrom-Json`,
+        `    if ($ledger.formatVersion -ne 3) { return $false }`,
+        `    $session = $env:FCD_SESSION_ID; if (-not $session) { $session = $env:CLAUDE_CODE_SESSION_ID }; if (-not $session) { $session = $env:CODEX_THREAD_ID }; if (-not $session) { return $false }`,
         `    $now = [DateTimeOffset]::UtcNow`,
-        `    $pk = Get-FcdSha256 ('shell|shell|' + (Get-FcdSha256 ('cmd:' + $Line.Trim())))`,
+        `    $argsJson = ConvertTo-Json -Compress -InputObject ([ordered]@{command=$Line;cwd=(Get-Location).ProviderPath})`,
+        `    $digest = Get-FcdSha256 ('args-v3:' + $argsJson)`,
+        `    $pk = Get-FcdSha256 (ConvertTo-Json -Compress -InputObject @('shell','shell',$digest))`,
         `    foreach ($p in @($ledger.pending)) {`,
-        `      if ($null -ne $p -and $p.permissionHandoff -eq $true -and $p.key -eq $pk -and $p.raisedAt) {`,
+        `      if ($null -ne $p -and $p.permissionHandoff -eq $true -and $p.sessionId -ceq $session -and $p.key -ceq $pk -and $p.raisedAt) {`,
         `        $raised = if ($p.raisedAt -is [DateTime]) { [DateTimeOffset]$p.raisedAt } else { [DateTimeOffset]::Parse([string]$p.raisedAt, [Globalization.CultureInfo]::InvariantCulture) }`,
         `        $age = $now - $raised`,
         `        if ($age.TotalMilliseconds -ge 0 -and $age.TotalMilliseconds -lt ${exports.IDE_CONFIRMATION_WINDOW_MS}) { return $true }`,
         `      }`,
         `    }`,
-        `    if ($ledger.formatVersion -ne 2) { return $false }`,
-        `    $rk = Get-FcdSha256 ('shell|local-safety:' + $RuleId + '|' + $RuleId)`,
-        `    $session = $env:FCD_SESSION_ID; if (-not $session) { $session = $env:CLAUDE_CODE_SESSION_ID }; if (-not $session) { $session = $env:CODEX_THREAD_ID }`,
-        `    foreach ($r in @($ledger.remembered)) {`,
-        `      if ($null -ne $r -and $r.key -eq $rk -and $r.expiresAt -and ($r.remember -eq '1h' -or ($r.remember -eq 'session' -and $session -and $r.sessionId -eq $session))) {`,
-        `        $expiry = if ($r.expiresAt -is [DateTime]) { [DateTimeOffset]$r.expiresAt } else { [DateTimeOffset]::Parse([string]$r.expiresAt, [Globalization.CultureInfo]::InvariantCulture) }`,
-        `        if ($expiry -gt $now) { return $true }`,
-        `      }`,
-        `    }`,
         `  } catch { }`,
         `  return $false`,
         `}`,

package/dist/approvalPrompt.d.ts

@@ -0,0 +1,7 @@
+export interface ApprovalMessageOptions {
+    /** The dialog offers "Always allow"; the footer must say what that covers. */
+    allowAlways?: boolean;
+    /** Human wording of the grant scope, e.g. "`gh` commands (write) to github.com". */
+    alwaysScopeLabel?: string;
+}
+export declare function nativeApprovalMessage(reason: string, options?: ApprovalMessageOptions): string;

package/dist/approvalPrompt.js

@@ -0,0 +1,46 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.nativeApprovalMessage = nativeApprovalMessage;
+/** Compact OS prompt. The complete decision remains in the IDE response and audit. */
+function line(value, limit) {
+    const text = value.replace(/\s+/g, ' ').trim();
+    if (text.length <= limit)
+        return text;
+    // Keep the command tail: a destination or destructive operand often comes last.
+    const head = Math.ceil((limit - 3) * 0.6);
+    return `${text.slice(0, head)} … ${text.slice(-(limit - head - 3))}`;
+}
+function nativeApprovalMessage(reason, options = {}) {
+    const rows = reason.split(/\r?\n/).map(row => row.trim()).filter(Boolean);
+    const field = (name) => rows.find(row => row.startsWith(`${name}:`))?.slice(name.length + 1).trim();
+    const what = field('What');
+    const tool = field('Tool');
+    const evidence = field('Evidence');
+    const rule = field('Rule');
+    const why = field('Why');
+    const agent = field('Agent')
+        || (/^[a-z_ -]+:\s*\S+/i.test(rows[0] || '') && !/^(What|Rule|Why|Tool|Evidence|IDE|Developer):/.test(rows[0]) ? rows[0] : undefined);
+    const details = what || tool || rule || why ? [
+        agent ? `Agent: ${line(agent, 80)}` : '',
+        field('IDE') ? `IDE: ${line(field('IDE'), 40)}` : '',
+        what ? `Action: ${line(what, 230)}` : '',
+        tool ? `Tool: ${line([tool, evidence].filter(Boolean).join(' · '), 230)}` : '',
+        rule ? `Rule: ${line(rule, 200)}` : '',
+        why ? `Reason: ${line(why, 320)}` : '',
+    ].filter(Boolean) : [line(reason, 650)];
+    if (!options.allowAlways) {
+        return [
+            'Allow this action once?',
+            '', ...details, '',
+            'Full details: the IDE message or this machine’s Activity in FullCourtDefense.',
+            'Allow once permits only this action. Deny or closing keeps it stopped.',
+        ].join('\n');
+    }
+    return [
+        'Allow this action?',
+        '', ...details, '',
+        ...(options.alwaysScopeLabel ? [`Always allow covers: ${line(options.alwaysScopeLabel, 200)} — for 30 days on this machine, under this rule as it is written today.`, ''] : []),
+        'Allow once permits only this action. Deny or closing keeps it stopped.',
+        'Full details: the IDE message or this machine’s Activity in FullCourtDefense.',
+    ].join('\n');
+}

package/dist/askDialog.d.ts

@@ -0,0 +1,87 @@
+/**
+ * The developer's question, answered in OUR dialog — one flow for every IDE.
+ *
+ * The hook core (`commands/hook.ts`, possibly running inside the resident daemon,
+ * which has a 2.5 s budget and no desktop of its own) never opens a window. When a
+ * rule asks the developer it answers the IDE's native `ask` verdict and attaches a
+ * machine-readable envelope (`fcdAsk`) describing the action and the rule. The
+ * thin per-event hook process — the one running in the developer's session —
+ * takes the envelope off the verdict and, when a dialog can be shown, asks the
+ * person with three buttons:
+ *
+ *   Always allow  -> scoped grant (devConfirm.recordDeveloperGrant) + allow now
+ *   Allow once    -> allow now (+ the rule's own session / 1h memory)
+ *   Deny / close  -> deny now
+ *
+ * and answers the IDE `allow` or `deny`. The IDE's own card is the fallback only
+ * where no dialog is possible (no display, dialog binary missing) or where the
+ * org chose it (`FCD_ASK_CHANNEL=ide`). The envelope never reaches the IDE.
+ *
+ * Deterministic all the way: the rule that asked is named in the envelope, the
+ * grant is bound to that rule's hash, and nothing here re-evaluates the action.
+ */
+import { ConfirmRemember, GrantScope, NativeDialogOptions, NativeDialogOutcome } from './devConfirm';
+/** Field on the verdict JSON that carries the envelope. Stripped before the IDE sees the verdict. */
+export declare const ASK_ENVELOPE_FIELD = "fcdAsk";
+/** Default wait for the person. Cursor's hook window is 90 s, Claude's 60 s by default; stay inside both. */
+export declare const ASK_DIALOG_TIMEOUT_MS = 55000;
+export interface AskEnvelope {
+    v: 1;
+    /** Hook event the marker was raised under (shell | mcp | file | read). */
+    event: string;
+    toolName: string;
+    argsDigest: string;
+    operation: string;
+    /** What "Always allow" would cover — built by the core from engine facts. */
+    scope: GrantScope;
+    policyId?: string;
+    policyName?: string;
+    policyHash?: string;
+    matchedRule?: string;
+    remember: ConfirmRemember;
+    /** Text for the dialog (the same explanation the IDE card shows). */
+    reason: string;
+}
+export type AskResolution = 'allow' | 'allow_always' | 'deny' | 'timeout' | 'ide';
+export interface HookVerdict {
+    stdout: string;
+    stderr: string;
+    exitCode: number;
+}
+export type DialogFn = (reason: string, timeoutMs: number, options: NativeDialogOptions) => Promise<{
+    outcome: NativeDialogOutcome;
+    latencyMs: number;
+}>;
+/** Which channel asks the developer. `dialog` (default) = our OS dialog, `ide` = the IDE's own card. */
+export declare function askChannel(): 'dialog' | 'ide';
+/** Attach the envelope to a decision object (core side). */
+export declare function attachAskEnvelope(decision: Record<string, unknown>, envelope: AskEnvelope | undefined): Record<string, unknown>;
+/** Split a verdict's stdout into the IDE-facing decision and our envelope, if any. */
+export declare function takeAskEnvelope(stdout: string): {
+    decision?: Record<string, unknown>;
+    envelope?: AskEnvelope;
+    stdout: string;
+};
+/**
+ * Last step of the per-event hook process (full and slim entries alike): an `ask`
+ * verdict is put to the developer in the FullCourtDefense dialog and becomes the
+ * IDE's allow / deny; anything else — and an ask where no dialog is possible — is
+ * written as-is with the envelope removed. Then the process exits.
+ */
+export declare function emitVerdictForIde(args: {
+    event?: string;
+    agentClient?: string;
+}, result: HookVerdict, entry: 'ipc' | 'local' | 'slim-ipc' | 'slim-local'): Promise<never>;
+/**
+ * Resolve an `ask` verdict with the developer. Returns the verdict to hand to the
+ * IDE (envelope removed) and how it was resolved. Any verdict without an envelope,
+ * or that does not ask, passes through untouched.
+ */
+export declare function resolveAskWithDialog(verdict: HookVerdict, options?: {
+    clientLabel?: string;
+    timeoutMs?: number;
+    dialog?: DialogFn;
+}): Promise<HookVerdict & {
+    resolution?: AskResolution;
+    envelope?: AskEnvelope;
+}>;

package/dist/askDialog.js

@@ -0,0 +1,209 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ASK_DIALOG_TIMEOUT_MS = exports.ASK_ENVELOPE_FIELD = void 0;
+exports.askChannel = askChannel;
+exports.attachAskEnvelope = attachAskEnvelope;
+exports.takeAskEnvelope = takeAskEnvelope;
+exports.emitVerdictForIde = emitVerdictForIde;
+exports.resolveAskWithDialog = resolveAskWithDialog;
+/**
+ * The developer's question, answered in OUR dialog — one flow for every IDE.
+ *
+ * The hook core (`commands/hook.ts`, possibly running inside the resident daemon,
+ * which has a 2.5 s budget and no desktop of its own) never opens a window. When a
+ * rule asks the developer it answers the IDE's native `ask` verdict and attaches a
+ * machine-readable envelope (`fcdAsk`) describing the action and the rule. The
+ * thin per-event hook process — the one running in the developer's session —
+ * takes the envelope off the verdict and, when a dialog can be shown, asks the
+ * person with three buttons:
+ *
+ *   Always allow  -> scoped grant (devConfirm.recordDeveloperGrant) + allow now
+ *   Allow once    -> allow now (+ the rule's own session / 1h memory)
+ *   Deny / close  -> deny now
+ *
+ * and answers the IDE `allow` or `deny`. The IDE's own card is the fallback only
+ * where no dialog is possible (no display, dialog binary missing) or where the
+ * org chose it (`FCD_ASK_CHANNEL=ide`). The envelope never reaches the IDE.
+ *
+ * Deterministic all the way: the rule that asked is named in the envelope, the
+ * grant is bound to that rule's hash, and nothing here re-evaluates the action.
+ */
+const devConfirm_1 = require("./devConfirm");
+const telemetry_1 = require("./telemetry");
+const hookIo_1 = require("./hookIo");
+/** Field on the verdict JSON that carries the envelope. Stripped before the IDE sees the verdict. */
+exports.ASK_ENVELOPE_FIELD = 'fcdAsk';
+/** Default wait for the person. Cursor's hook window is 90 s, Claude's 60 s by default; stay inside both. */
+exports.ASK_DIALOG_TIMEOUT_MS = 55_000;
+/** Which channel asks the developer. `dialog` (default) = our OS dialog, `ide` = the IDE's own card. */
+function askChannel() {
+    return (process.env.FCD_ASK_CHANNEL || '').trim().toLowerCase() === 'ide' ? 'ide' : 'dialog';
+}
+/** Attach the envelope to a decision object (core side). */
+function attachAskEnvelope(decision, envelope) {
+    if (!envelope)
+        return decision;
+    return { ...decision, [exports.ASK_ENVELOPE_FIELD]: envelope };
+}
+/** Split a verdict's stdout into the IDE-facing decision and our envelope, if any. */
+function takeAskEnvelope(stdout) {
+    const trimmed = stdout.trim();
+    if (!trimmed.startsWith('{') || !trimmed.includes(`"${exports.ASK_ENVELOPE_FIELD}"`))
+        return { stdout };
+    try {
+        const decision = JSON.parse(trimmed);
+        const raw = decision[exports.ASK_ENVELOPE_FIELD];
+        delete decision[exports.ASK_ENVELOPE_FIELD];
+        const envelope = isAskEnvelope(raw) ? raw : undefined;
+        return { decision, envelope, stdout: JSON.stringify(decision) };
+    }
+    catch {
+        return { stdout };
+    }
+}
+function isAskEnvelope(value) {
+    if (!value || typeof value !== 'object')
+        return false;
+    const e = value;
+    return e.v === 1 && typeof e.event === 'string' && typeof e.toolName === 'string' && typeof e.argsDigest === 'string'
+        && typeof e.operation === 'string' && typeof e.reason === 'string' && !!e.scope && typeof e.scope === 'object'
+        && (e.remember === 'none' || e.remember === 'session' || e.remember === '1h');
+}
+function decisionAsks(decision) {
+    const hso = decision.hookSpecificOutput;
+    return decision.permission === 'ask' || decision.permissionDecision === 'ask' || hso?.permissionDecision === 'ask';
+}
+/** Rewrite an `ask` decision into the IDE's allow / deny shape, in the format the core used. */
+function rewriteDecision(decision, allowed, userMsg, agentMsg) {
+    const claude = 'hookSpecificOutput' in decision || 'permissionDecision' in decision;
+    if (claude) {
+        if (allowed)
+            return { systemMessage: agentMsg };
+        return {
+            permissionDecision: 'deny',
+            permissionDecisionReason: userMsg,
+            hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'deny', permissionDecisionReason: userMsg },
+        };
+    }
+    return allowed
+        ? { permission: 'allow', agent_message: agentMsg }
+        : { permission: 'deny', user_message: userMsg, agent_message: agentMsg };
+}
+/**
+ * Last step of the per-event hook process (full and slim entries alike): an `ask`
+ * verdict is put to the developer in the FullCourtDefense dialog and becomes the
+ * IDE's allow / deny; anything else — and an ask where no dialog is possible — is
+ * written as-is with the envelope removed. Then the process exits.
+ */
+async function emitVerdictForIde(args, result, entry) {
+    let final = result;
+    try {
+        const resolved = await resolveAskWithDialog(result, { clientLabel: args.agentClient });
+        if (resolved.resolution)
+            (0, hookIo_1.dbg)({ phase: 'ask_dialog', event: args.event, entry, resolution: resolved.resolution, tool: resolved.envelope?.toolName });
+        final = resolved;
+    }
+    catch (err) {
+        // The dialog step must never break the verdict: fall back to the IDE ask (envelope stripped).
+        (0, hookIo_1.dbg)({ phase: 'ask_dialog_error', event: args.event, entry, error: err instanceof Error ? err.message : String(err) });
+        final = { ...result, stdout: takeAskEnvelope(result.stdout).stdout };
+    }
+    if (final.stderr) {
+        try {
+            process.stderr.write(final.stderr);
+        }
+        catch { /* stderr gone */ }
+    }
+    if (final.stdout) {
+        try {
+            process.stdout.write(final.stdout);
+        }
+        catch { /* stdout gone */ }
+    }
+    return process.exit(final.exitCode);
+}
+/**
+ * Resolve an `ask` verdict with the developer. Returns the verdict to hand to the
+ * IDE (envelope removed) and how it was resolved. Any verdict without an envelope,
+ * or that does not ask, passes through untouched.
+ */
+async function resolveAskWithDialog(verdict, options = {}) {
+    const taken = takeAskEnvelope(verdict.stdout);
+    if (!taken.decision || !taken.envelope || !decisionAsks(taken.decision))
+        return { ...verdict, stdout: taken.stdout };
+    const envelope = taken.envelope;
+    const decision = taken.decision;
+    const clean = { ...verdict, stdout: taken.stdout, envelope };
+    // An injected dialog (tests, embedding hosts) only needs a person; the OS dialog also needs a display.
+    const canAsk = options.dialog ? (0, devConfirm_1.isHumanPresent)() : (0, devConfirm_1.nativeDialogAvailable)();
+    if (askChannel() === 'ide' || !canAsk)
+        return { ...clean, resolution: 'ide' };
+    const allowAlways = envelope.remember !== 'none' && Boolean(envelope.policyHash)
+        && (envelope.scope.event !== 'shell' || (envelope.scope.programs || []).length > 0);
+    const scopeLabel = allowAlways ? (0, devConfirm_1.describeGrantScope)(envelope.scope) : undefined;
+    const dialog = options.dialog || devConfirm_1.confirmNativeActionDetailed;
+    const reason = options.clientLabel ? `IDE: ${options.clientLabel}\n${envelope.reason}` : envelope.reason;
+    let outcome = 'unavailable';
+    let latencyMs = 0;
+    try {
+        ({ outcome, latencyMs } = await dialog(reason, options.timeoutMs ?? exports.ASK_DIALOG_TIMEOUT_MS, { allowAlways, alwaysScopeLabel: scopeLabel }));
+    }
+    catch {
+        outcome = 'unavailable';
+    }
+    if (outcome === 'unavailable')
+        return { ...clean, resolution: 'ide' };
+    const policyLabel = envelope.policyName ? ` (${envelope.policyName})` : '';
+    const rule = { policyId: envelope.policyId, policyName: envelope.policyName, matchedRule: envelope.matchedRule, policyHash: envelope.policyHash };
+    if (outcome === 'allow' || outcome === 'allow_always') {
+        // Same bookkeeping the post-execution hook would have done for an IDE Allow.
+        (0, devConfirm_1.settleDeveloperConfirmation)(envelope.event, envelope.toolName, envelope.argsDigest);
+        let granted = false;
+        if (outcome === 'allow_always' && allowAlways && envelope.policyHash) {
+            granted = Boolean((0, devConfirm_1.recordDeveloperGrant)(envelope.scope, { ...rule, policyHash: envelope.policyHash }));
+        }
+        // The MCP gateway sees this exact call next; do not ask the person twice.
+        if (envelope.event === 'mcp')
+            (0, devConfirm_1.recordConfirmedAction)(envelope.toolName, envelope.argsDigest);
+        (0, telemetry_1.spoolEvent)({
+            decision: 'allow',
+            toolName: envelope.toolName,
+            operation: envelope.operation,
+            reason: granted
+                ? `developer chose Always allow in the FullCourtDefense dialog — ${scopeLabel} (30 days, this rule)${policyLabel}`
+                : `developer confirmed in the FullCourtDefense dialog${policyLabel}`,
+            ruleId: envelope.policyId,
+            policyHash: envelope.policyHash,
+            approvalScope: 'developer',
+            approvedBy: 'developer',
+            confirmLatencyMs: latencyMs,
+        });
+        (0, telemetry_1.triggerFlush)(false);
+        const agentMsg = granted
+            ? `FullCourtDefense: the developer allowed this ${envelope.event} and chose "Always allow" for ${scopeLabel} under this rule.`
+            : `FullCourtDefense: the developer allowed this ${envelope.event} once in the FullCourtDefense dialog.`;
+        return { ...clean, stdout: JSON.stringify(rewriteDecision(decision, true, '', agentMsg)), exitCode: 0, resolution: outcome };
+    }
+    (0, devConfirm_1.rejectDeveloperConfirmation)(envelope.event, envelope.toolName, envelope.argsDigest);
+    const timedOut = outcome === 'timeout';
+    (0, telemetry_1.spoolEvent)({
+        decision: 'block',
+        toolName: envelope.toolName,
+        operation: envelope.operation,
+        reason: timedOut
+            ? `developer did not answer the FullCourtDefense dialog in time${policyLabel}`
+            : `developer denied in the FullCourtDefense dialog${policyLabel}`,
+        ruleId: envelope.policyId,
+        policyHash: envelope.policyHash,
+        approvalScope: 'developer',
+        confirmLatencyMs: latencyMs,
+    });
+    (0, telemetry_1.triggerFlush)(true);
+    const userMsg = timedOut
+        ? `FullCourtDefense: no answer in the confirmation dialog, so this ${envelope.event} was not run${policyLabel}. Run it again to be asked again.`
+        : `FullCourtDefense: you denied this ${envelope.event} in the confirmation dialog${policyLabel}.`;
+    const agentMsg = timedOut
+        ? `FullCourtDefense: the developer did not answer the confirmation dialog in time; this ${envelope.event} was not executed. Do not retry or work around it — ask the developer.`
+        : `FullCourtDefense: the developer denied this ${envelope.event} in the confirmation dialog. Do not retry or work around it.`;
+    return { ...clean, stdout: JSON.stringify(rewriteDecision(decision, false, userMsg, agentMsg)), exitCode: 0, resolution: outcome };
+}

package/dist/blockExplanation.js

@@ -56,7 +56,7 @@ function headlineFor(outcome, noun) {
 }
 /** The step list title — a pause is lifted by an answer, a block by a rule change. */
 function stepsTitle(outcome) {
-    return outcome === 'block' ? 'To remove this block:' : outcome === 'mask' ? 'To change this rule:' : 'To remove this block (or to stop being asked):';
+    return outcome === 'block' ? 'To remove this block:' : outcome === 'mask' ? 'To change this rule:' : 'To review this rule:';
 }
 function eventNoun(event) {
     switch (event) {
@@ -84,7 +84,10 @@ const FACT_WORDS = [
             ? `a secret-shaped value was found in the arguments${f['toolArgs.secretKind'] && f['toolArgs.secretKind'] !== 'none' ? ` (${f['toolArgs.secretKind'].replace(/_/g, ' ')})` : ''}`
             : undefined],
     ['toolArgs.containsPii', v => v === 'true' ? 'personal data (PII) was found in the arguments' : undefined],
-    ['destination.type', (v, f) => v === 'external' ? `the destination ${f['destination.domain'] ? `"${f['destination.domain']}" ` : ''}is classified as external; this does not establish whether your organisation trusts it` : undefined],
+    ['destination.type', (v, f) => v !== 'external' ? undefined
+            : f['action.kind'] === 'shell' && /^(shell|execute|unknown)$/i.test(f.operation || '')
+                ? `the script references ${f['destination.domain'] ? `"${f['destination.domain']}"` : 'an external host'}; this rule restricts possible outbound actions. This is not evidence of an upload or of an untrusted host`
+                : `the destination ${f['destination.domain'] ? `"${f['destination.domain']}" ` : ''}is classified as external; this does not establish whether your organisation trusts it`],
     ['destination.domain', (v, f) => f['destination.type'] === 'external' ? undefined : `destination host: ${v}`],
     ['url.risk', v => v && v !== 'none' && v !== 'low' ? `the URL was rated ${v} risk` : undefined],
     ['path.sensitive', v => v === 'true' ? 'the path is a sensitive location' : undefined],
@@ -141,7 +144,7 @@ function buildBlockExplanation(input) {
         const name = src.policyName || 'an Action Policy';
         consoleLink = policiesLink(consoleUrl, src.policyId);
         rule = `Action Policy "${name}" (${scopeWords(src.scope, input.developerName)})${src.matchedRule ? ` — rule: ${src.matchedRule}` : ''}`;
-        const facts = relevantFacts(src.matchedRule, src.facts || {}, src.operation);
+        const facts = relevantFacts(src.matchedRule, { ...src.facts, operation: src.facts?.operation || src.operation }, src.operation);
         const extraReason = informativeReason(src.reason, name);
         if (extraReason)
             facts.push(extraReason);
@@ -163,12 +166,18 @@ function buildBlockExplanation(input) {
         rule = src.source === 'custom'
             ? `org custom rule "${label}" in Local Safety${detail ? ` (${detail})` : ''}`
             : `built-in Local Safety rule "${label}"${detail ? ` (${detail})` : ''}`;
-        why = src.explanation ? `${src.reason} — ${src.explanation}` : src.reason;
+        // Findings describe a match before the configured action is applied. A built-in
+        // "Blocked ..." reason must not turn a pending approval into a final denial.
+        const reason = src.source === 'builtin' && (input.outcome === 'ask' || input.outcome === 'approval')
+            ? src.reason.replace(/^Blocked\b/, 'Matched') : src.reason;
+        why = src.explanation ? `${reason} — ${src.explanation}` : reason;
         unblock = [
             `Open the rule in the console: ${consoleLink}`,
             `An admin can set "${label}" to Ask the developer, Warn only, or Off — for everyone or only for ${input.developerName || 'this machine'}.`,
             ...(machine ? [`See this decision, with the rule name, on your machine timeline: ${machine}`] : []),
-            'Wrong block? Tell your admin the rule name above — every decision is recorded, nothing was sent anywhere.',
+            input.outcome === 'ask' || input.outcome === 'approval'
+                ? 'If this approval request looks wrong, tell your admin the rule name above.'
+                : 'Wrong block? Tell your admin the rule name above — every decision is recorded, nothing was sent anywhere.',
         ];
     }
     else {
@@ -228,7 +237,10 @@ function buildBlockExplanation(input) {
     const agentVerb = input.outcome === 'block' || input.outcome === 'mask'
         ? 'This is a policy decision, not an error — do not retry, rephrase, or work around it.'
         : 'Wait for the developer\'s answer — do not retry or work around it.';
-    const agentMessage = `${headline} Rule: ${rule}. Why: ${why}. ${agentVerb} Tell the developer exactly this: the block came from ${rule}; to remove it: ${unblock[0]}`;
+    const resolution = input.outcome === 'ask' || input.outcome === 'approval'
+        ? `this approval request came from ${rule}; to review the rule: ${unblock[0]}`
+        : `the block came from ${rule}; to remove it: ${unblock[0]}`;
+    const agentMessage = `${headline} Rule: ${rule}. Why: ${why}. ${agentVerb} Tell the developer exactly this: ${resolution}`;
     return { headline, what, rule, why, unblock, consoleLink, userMessage, agentMessage };
 }
 /**

package/dist/boundaryVerification.d.ts

@@ -0,0 +1,20 @@
+export interface BoundaryVerification {
+    version: 1;
+    ranAt: string;
+    basis: 'isolated_hook_fixture';
+    runtimeDigest: string;
+    checks: Array<{
+        boundary: 'shell' | 'files' | 'mcp' | 'network';
+        status: 'passed' | 'failed' | 'unavailable';
+        allowed: number;
+        denied: number;
+        durationMs: number;
+    }>;
+}
+/** Fingerprint the packaged JavaScript; shared by checker evidence and benchmarks. */
+export declare function computeRuntimeDigest(): string;
+/** Exercises the installed hook executable, never the commands in its stdin.
+ * A private HOME, cache and IPC address isolate the probe from customer state.
+ * This is checker proof, not proof that an IDE invokes the hook or obeys it.
+ */
+export declare function runBoundaryVerification(): Promise<BoundaryVerification>;