fullcourtdefense-cli 1.34.21 → 1.34.25

package/dist/commands/deterministicGuard.js

@@ -168,7 +168,11 @@ const METADATA_ENDPOINTS = [
     { itemId: 'alibaba_metadata_ip', value: '100.100.100.200', label: 'Alibaba cloud metadata endpoint' },
 ];
 const OUTBOUND_TOOL_HINT = /(?:http|fetch|request|curl|wget|webhook|upload|send|email|mail|slack|discord|teams|post|put|publish|notify)/i;
-const COMMAND_TOOL_HINT = /(?:shell|bash|command|cmd|powershell|terminal|exec|subprocess|run|script)/i;
+const WEB_LOOKUP_TOOL_HINT = /(?:^|__)web(?:[_.-]*run)$/i;
+// Match execution words, not substrings: webrun and describe_subscription do
+// not execute their text. The web lookup contract also distinguishes web.run
+// from generic run tools. Explicit command fields remain actionable everywhere.
+const COMMAND_TOOL_HINT = /\b(?:shell|bash|command|cmd|powershell|pwsh|terminal|exec|execute|subprocess|run|script|repl)\b/i;
 const SQL_TOOL_HINT = /(?:sql|query|database|postgres|mysql|sqlite|snowflake|bigquery|db)/i;
 const COMMAND_KEYS = new Set([
     'command',
@@ -802,7 +806,9 @@ function isLocalFileEditor(toolName, candidates) {
     });
 }
 function isOutboundContext(toolName, candidates) {
-    if (OUTBOUND_TOOL_HINT.test(toolName))
+    // Web lookup arguments leave the machine, but query text is neither a shell
+    // command nor the destination URL. Keep secret egress separate from execution.
+    if (OUTBOUND_TOOL_HINT.test(toolName) || WEB_LOOKUP_TOOL_HINT.test(toolName))
         return true;
     if (isLocalFileEditor(toolName, candidates))
         return false;
@@ -810,12 +816,17 @@ function isOutboundContext(toolName, candidates) {
 }
 function isCommandContext(toolName, candidate) {
     const lastKey = candidate.keyPath.split('.').pop() || '';
-    return COMMAND_TOOL_HINT.test(toolName) || COMMAND_KEYS.has(lastKey) || COMMAND_KEYS.has(candidate.keyPath);
+    const nameWords = toolName.replace(/([a-z0-9])([A-Z])/g, '$1 $2').replace(/[_\-.]+/g, ' ');
+    return (!WEB_LOOKUP_TOOL_HINT.test(toolName) && COMMAND_TOOL_HINT.test(nameWords))
+        || COMMAND_KEYS.has(lastKey) || COMMAND_KEYS.has(candidate.keyPath);
 }
 function isSqlContext(toolName, candidate) {
     const lastKey = candidate.keyPath.split('.').pop() || '';
     return SQL_TOOL_HINT.test(toolName) || SQL_KEYS.has(lastKey) || SQL_KEYS.has(candidate.keyPath);
 }
+function isWebLookupTarget(toolName, candidate) {
+    return WEB_LOOKUP_TOOL_HINT.test(toolName) && candidate.keyPath.split('.').pop() === 'ref_id';
+}
 /**
  * Metadata SSRF only matters where the string can actually BECOME a request: a shell
  * command, an outbound/HTTP tool, or a URL-typed argument. Source code or file contents
@@ -825,6 +836,8 @@ function isSqlContext(toolName, candidate) {
 function isMetadataRequestContext(toolName, candidate) {
     if (isCommandContext(toolName, candidate))
         return true;
+    if (isWebLookupTarget(toolName, candidate))
+        return true;
     if (OUTBOUND_TOOL_HINT.test(toolName))
         return true;
     const lastKey = candidate.keyPath.split('.').pop() || '';
@@ -838,6 +851,8 @@ function isMetadataRequestContext(toolName, candidate) {
 function isSensitivePathContext(toolName, candidate) {
     if (isCommandContext(toolName, candidate))
         return true;
+    if (isWebLookupTarget(toolName, candidate))
+        return true;
     if (/(?:read|open|cat|copy|download|upload|access|stat|list|glob|search|find|grep)/i.test(toolName))
         return true;
     const lastKey = candidate.keyPath.split('.').pop() || '';
@@ -873,7 +888,8 @@ const DATA_TO_INTERPRETER = /\b(?:iex|invoke-expression|invoke-command)\b|\beval
 // a shell command line. `node -e "console.log('rm -rf /')"` prints a string;
 // `python -c "print('DROP TABLE')"` prints a string. That code only reaches the
 // shell through a process-spawning API — then (and only then) the whole line is
-// kept, exactly like `bash -c`. Structural: API names, not vocabulary.
+// kept, exactly like `bash -c`. Direct file arguments have a separate sensitive
+// path view below, so a reader does not turn its other string data into shell code.
 const LANG_INTERPRETER_CODE_BEFORE = /\b(?:node|nodejs|deno|bun|python[0-9.]*|py|perl|ruby|php|lua|tsx|ts-node)(?:\.exe)?\s+(?:-c|-e|-r|eval)[= ]\s*$/i;
 const CODE_SPAWNS_PROCESS = /\b(?:child_process|execSync|execFileSync|spawnSync|spawn|execFile|exec|fork|os\.system|os\.popen|os\.exec[lvpe]*|subprocess|Popen|system|passthru|shell_exec|proc_open|popen|Process\.Start|Deno\.run|Deno\.Command|Bun\.spawn)\b/;
 const BACKTICK_SHELL_INTERPRETER = /\b(?:perl|ruby)(?:\.exe)?\s+(?:-c|-e)[= ]\s*$/i;
@@ -882,6 +898,38 @@ function interpreterCodeSpawnsProcess(before, code) {
         return true;
     return BACKTICK_SHELL_INTERPRETER.test(before) && /`[^`]*`|%x[\[{(]/.test(code);
 }
+/** First path argument of direct file APIs in inline language code, not printed examples. */
+function interpreterFileArguments(text) {
+    if (text.length > 32_000)
+        return '';
+    const paths = [];
+    let calls = 0;
+    text.replace(/"((?:[^"\\]|\\.)*)"|'((?:[^'\\]|\\.)*)'/g, (whole, dq, sq, offset) => {
+        if (!LANG_INTERPRETER_CODE_BEFORE.test(text.slice(Math.max(0, offset - 80), offset)))
+            return whole;
+        const code = dq !== undefined ? dq : (sq || '');
+        // Preserve offsets while masking string contents: a call printed inside a
+        // string is not an invocation; a sensitive path in another argument is data.
+        const instructions = code.replace(/"(?:[^"\\]|\\.)*"|'(?:[^'\\]|\\.)*'/g, literal => ' '.repeat(literal.length));
+        for (const call of instructions.matchAll(/\b(?:open|fopen|readFile(?:Sync)?|createReadStream|ReadAllText|ReadAllBytes)\s*\(/g)) {
+            if (++calls > 48)
+                break;
+            const start = (call.index || 0) + call[0].length;
+            let depth = 1;
+            for (let end = start; end < instructions.length; end++) {
+                const ch = instructions[end];
+                if ((ch === ')' && --depth === 0) || (ch === ',' && depth === 1)) {
+                    paths.push(code.slice(start, end));
+                    break;
+                }
+                if (ch === '(')
+                    depth++;
+            }
+        }
+        return whole;
+    });
+    return paths.join('\n');
+}
 // $( … ) always executes; backtick pairs only with ≥2 chars of content
 // (PowerShell escapes like `n / `t are single-char and inert).
 const INTERPOLATES = /\$\(|`[^`]{2,}`/;
@@ -918,7 +966,104 @@ function stripInertDataSegments(text) {
     });
     return out;
 }
-function scanTextValue(toolName, rawValue, options) {
+const FILE_METADATA_PROPERTIES = new Set([
+    'name', 'fullname', 'basename', 'extension', 'length', 'attributes', 'exists',
+    'creationtime', 'creationtimeutc', 'lastaccesstime', 'lastaccesstimeutc',
+    'lastwritetime', 'lastwritetimeutc', 'directoryname', 'psiscontainer',
+]);
+/** Prove a whole pipeline returns only file metadata, never a file reader/handle consumer. */
+function isFileMetadataQuery(statement) {
+    // Expressions, substitutions, redirections and script blocks are unproven.
+    if (/[@`{}()[\]<>;&\r\n]/.test(statement))
+        return false;
+    const tokens = statement.trim().match(/"[^"\r\n]*"|'(?:[^'\r\n]|'')*'|[|,]|[^\s"'|,]+/g) || [];
+    if (!/^(?:get-item|gi)$/i.test(tokens[0] || ''))
+        return false;
+    const pipe = tokens.indexOf('|');
+    const args = tokens.slice(1, pipe < 0 ? undefined : pipe);
+    let paths = 0;
+    for (let i = 0; i < args.length; i++) {
+        const arg = args[i];
+        if (/^-(?:literalpath|path|force)$/i.test(arg) || arg === ',')
+            continue;
+        if (/^-(?:erroraction|ea)$/i.test(arg)) {
+            if (!/^(?:silentlycontinue|stop|continue|ignore)$/i.test(args[++i] || ''))
+                return false;
+            continue;
+        }
+        // Output variables can retain FileInfo objects for a later content read.
+        if (arg.startsWith('-'))
+            return false;
+        paths++;
+    }
+    if (!paths)
+        return false;
+    if (pipe < 0)
+        return true; // Default Get-Item formatting contains metadata only.
+    if (!/^(?:select-object|select)$/i.test(tokens[pipe + 1] || ''))
+        return false;
+    const properties = tokens.slice(pipe + 2);
+    if (/^-property$/i.test(properties[0] || ''))
+        properties.shift();
+    const names = properties.filter(token => token !== ',');
+    return names.length > 0 && names.every(token => FILE_METADATA_PROPERTIES.has(token.replace(/^['"]|['"]$/g, '').toLowerCase()));
+}
+/**
+ * Sensitive-path view of a shell command. Omit only proven metadata queries;
+ * preserve all other statements and their consumers. Quotes and nested scopes
+ * keep separators inside data/code from creating fictitious cmdlet invocations.
+ * Unknown execution/rebinding forms retain the original conservative scan.
+ */
+function credentialAccessCommandText(text) {
+    if (text.length > 32_000)
+        return text;
+    // PowerShell 7 permits a pipeline to continue on a line starting with `|`,
+    // even across comment lines. A trailing comma also continues an argument list.
+    // Keep these forms intact so a later consumer cannot lose its source path.
+    const allowMetadata = !(/(?:^|[\r\n])[ \t]*\||,[ \t]*(?:#[^\r\n]*)?[\r\n]/.test(text)
+        || /`|(?:^|[^&])&(?:[^&]|$)|@['"]|(?:^|[;&|\r\n])\s*\.\s|\b(?:iex|invoke-expression|invoke-command|eval|function|filter|set-alias|new-alias|sal|nal|set-item|new-item|update-typedata|add-type|import-module|ipmo|PSDefaultParameterValues)\b/i.test(text));
+    const statements = [];
+    let current = '', quote = '', depth = 0;
+    for (let i = 0; i < text.length; i++) {
+        const ch = text[i];
+        if (quote) {
+            current += ch;
+            if (ch === quote) {
+                if (quote === "'" && text[i + 1] === "'")
+                    current += text[++i];
+                else
+                    quote = '';
+            }
+            continue;
+        }
+        if (ch === '"' || ch === "'") {
+            quote = ch;
+            current += ch;
+            continue;
+        }
+        if (ch === '(' || ch === '{' || ch === '[')
+            depth++;
+        if (ch === ')' || ch === '}' || ch === ']') {
+            if (--depth < 0)
+                return text;
+        }
+        const conditional = (ch === '&' || ch === '|') && text[i + 1] === ch;
+        if (depth === 0 && (conditional || ch === ';' || ch === '\r' || ch === '\n')) {
+            if (conditional)
+                i++;
+            statements.push(current);
+            current = '';
+            continue;
+        }
+        current += ch === '|' || ch === '&' || ch === ';' ? ` ${ch} ` : ch;
+    }
+    if (quote || depth)
+        return text;
+    statements.push(current);
+    // A real shell separator is a boundary of the preceding path, even without spaces.
+    return statements.map(statement => allowMetadata && isFileMetadataQuery(statement) ? 'fcd_file_metadata' : statement).join('\n');
+}
+function scanTextValue(toolName, rawValue, options, commandContext = false) {
     // Honeypot decoys and org custom patterns scan the RAW value: a decoy path
     // even inside message data is exfiltration staging, and custom rules define
     // their own scope.
@@ -937,7 +1082,8 @@ function scanTextValue(toolName, rawValue, options) {
     // NOTE: a disabled item must FALL THROUGH to the later rules, not end the
     // scan — otherwise turning off (or gating) a path rule would mask a real
     // reverse shell / destructive command in the same value.
-    const sensitivePath = containsSensitiveCredentialPath(value);
+    const sensitivePath = containsSensitiveCredentialPath(commandContext
+        ? `${credentialAccessCommandText(value)}\n${interpreterFileArguments(rawValue)}` : value);
     if (sensitivePath) {
         const finding = builtIn(sensitivePath.itemId, 'sensitive_files', 'sensitive_file', 'local-sensitive-credential-path', `Blocked local agent access to ${sensitivePath.label}.`, value, sensitivePath.label, options);
         if (finding)
@@ -985,6 +1131,12 @@ function isActionableContext(toolName, candidate) {
         || OUTBOUND_TOOL_HINT.test(toolName);
 }
 function scanDeterministicToolCall(toolName, toolArgs, options) {
+    // MCP adapters keep the server separately from its method. Restore that
+    // identity for the known web lookup contract; keep other method matching
+    // unchanged so a server's name cannot turn its documentation into a command.
+    const qualifiedName = options?.mcpServerName ? `mcp__${options.mcpServerName}__${toolName}` : toolName;
+    if (WEB_LOOKUP_TOOL_HINT.test(qualifiedName))
+        toolName = qualifiedName;
     const candidates = collectStrings(toolArgs);
     const outbound = isOutboundContext(toolName, candidates);
     for (const candidate of candidates) {
@@ -998,7 +1150,7 @@ function scanDeterministicToolCall(toolName, toolArgs, options) {
             return custom;
     }
     for (const candidate of candidates) {
-        const finding = scanTextValue(toolName, candidate.value, options);
+        const finding = scanTextValue(toolName, candidate.value, options, isCommandContext(toolName, candidate));
         if (!finding)
             continue;
         // Context gates: a pattern is only dangerous where it can act — a command, a request
@@ -1210,13 +1362,13 @@ function scanReferencedScript(command, cwd, options) {
         // string mentions and rescan so command-shaped rules (reverse shell, destructive
         // delete...) in the SAME file still surface.
         let scanOptions = options;
-        let finding = scanTextValue('script_file', content, scanOptions);
+        let finding = scanTextValue('script_file', content, scanOptions, true);
         while (finding
             && (finding.category === 'sensitive_file' || finding.category === 'metadata_ssrf')
             && !scriptActsOnFinding(content, finding.category)) {
             const baseDisabled = scanOptions?.disabledBuiltInItemIds || Array.from(exports.DEFAULT_DISABLED_BUILT_INS);
             scanOptions = { ...(scanOptions || {}), disabledBuiltInItemIds: [...baseDisabled, finding.itemId] };
-            finding = scanTextValue('script_file', content, scanOptions);
+            finding = scanTextValue('script_file', content, scanOptions, true);
         }
         if (!finding)
             continue;

package/dist/commands/hook.js

@@ -63,6 +63,7 @@ const verdictIpc_1 = require("../verdictIpc");
 const machineIdentity_1 = require("../machineIdentity");
 const actionPolicyEngine_1 = require("../actionPolicyEngine");
 const devConfirm_1 = require("../devConfirm");
+const askDialog_1 = require("../askDialog");
 // Shared with the slim hook entry (hookSlim.ts) so both entries log to the
 // same rotated hook.log and read stdin identically.
 const hookIo_1 = require("../hookIo");
@@ -480,7 +481,7 @@ function buildToolCall(event, p) {
                 || str(nested?.command) || str(nested?.cmd);
             if (!command)
                 return null;
-            return { toolName: 'shell', toolArgs: { command, cwd: str(p.cwd) || str(nested?.cwd) || undefined } };
+            return { toolName: 'shell', toolArgs: { command, cwd: str(p.cwd) || str(nested?.cwd) || process.cwd() } };
         }
         case 'mcp': {
             const toolName = str(p.tool_name) || str(p.toolName) || str(p.name) || 'mcp';
@@ -757,6 +758,7 @@ function tryDeveloperConfirmation(ctx, call, verdict, payload, where) {
     if (ctx.shadow)
         return false; // monitor machines never prompt — the caller records would-approve
     const prepared = prepareDeveloperConfirmation(ctx.event, call, payload, {
+        policyHash: ctx.effectivePolicyHash,
         policyId: verdict.policyId,
         policyName: verdict.policyName,
         matchedRule: verdict.matchedRule,
@@ -768,7 +770,7 @@ function tryDeveloperConfirmation(ctx, call, verdict, payload, where) {
     });
     if (prepared.outcome === 'allow')
         ctx.respond(false, undefined, prepared.agentMsg);
-    ctx.respond('ask', prepared.userMsg, prepared.agentMsg);
+    ctx.respond('ask', prepared.userMsg, prepared.agentMsg, prepared.envelope);
 }
 /**
  * The developer-confirmation core, independent of WHAT asked for it: an Action
@@ -779,10 +781,11 @@ function tryDeveloperConfirmation(ctx, call, verdict, payload, where) {
  * Returns what to answer; the caller emits it (respond() ends the process).
  */
 function prepareDeveloperConfirmation(event, call, payload, source) {
-    const { operation } = (0, actionPolicyEngine_1.inferToolContext)(call.toolName, call.toolArgs);
+    const { operation, context } = (0, actionPolicyEngine_1.inferToolContext)(call.toolName, call.toolArgs);
     const sessId = sessionId(payload);
     const policyLabel = source.policyName ? ` (${source.policyName})` : '';
     const offlineEnforced = source.where !== 'local-first';
+    const policyHash = source.policyHash || source.localFinding?.policyHash;
     // Sweep first: markers the human never answered are recorded as not approved.
     for (const expired of (0, devConfirm_1.sweepExpiredConfirmations)()) {
         (0, telemetry_1.spoolEvent)({
@@ -794,12 +797,14 @@ function prepareDeveloperConfirmation(event, call, payload, source) {
             offlineEnforced: true,
         });
     }
-    const remembered = source.remember === 'none' ? undefined : (0, devConfirm_1.isConfirmationRemembered)({ toolName: call.toolName, operation, policyId: source.policyId, matchedRule: source.matchedRule }, sessId);
+    const remembered = source.remember === 'none' ? undefined : (0, devConfirm_1.isConfirmationRemembered)({ toolName: call.toolName, operation, argsDigest: (0, devConfirm_1.actionDigest)(call.toolArgs), policyId: source.policyId, matchedRule: source.matchedRule, policyHash: source.policyHash || source.localFinding?.policyHash }, sessId);
     if (remembered) {
         (0, hookIo_1.dbg)({ phase: 'dev_confirm_remembered', event, tool: call.toolName, operation, remember: remembered.remember, where: source.where });
         spoolCallEvent(call, {
             decision: 'allow',
             reason: `developer confirmed earlier (${remembered.remember} memory)${policyLabel}`,
+            ruleId: source.policyId || source.localFinding?.ruleId,
+            policyHash: source.policyHash || source.localFinding?.policyHash,
             approvalScope: 'developer',
             approvedBy: 'developer',
             offlineEnforced,
@@ -807,6 +812,25 @@ function prepareDeveloperConfirmation(event, call, payload, source) {
         (0, telemetry_1.triggerFlush)(false);
         return { outcome: 'allow', agentMsg: `FullCourtDefense: ${call.toolName} was already confirmed by the developer in this ${remembered.remember === '1h' ? 'hour' : 'session'}.` };
     }
+    // A standing "Always allow" the developer gave in our dialog for this scope under
+    // this exact rule (same policy hash). Rules that forbid memory never reach here.
+    const grantScope = (0, devConfirm_1.grantScopeFor)(event, call.toolName, call.toolArgs, operation, context);
+    const grant = source.remember === 'none' ? undefined : (0, devConfirm_1.findDeveloperGrant)(grantScope, { policyId: source.policyId, matchedRule: source.matchedRule, policyHash });
+    if (grant) {
+        const covers = (0, devConfirm_1.describeGrantScope)(grant.scope);
+        (0, hookIo_1.dbg)({ phase: 'dev_confirm_granted', event, tool: call.toolName, operation, grant: grant.key, where: source.where });
+        spoolCallEvent(call, {
+            decision: 'allow',
+            reason: `developer granted Always allow for ${covers}${policyLabel}`,
+            ruleId: source.policyId || source.localFinding?.ruleId,
+            policyHash,
+            approvalScope: 'developer',
+            approvedBy: 'developer',
+            offlineEnforced,
+        });
+        (0, telemetry_1.triggerFlush)(false);
+        return { outcome: 'allow', agentMsg: `FullCourtDefense: the developer has a standing "Always allow" for ${covers} under this rule.` };
+    }
     const marker = (0, devConfirm_1.raiseDeveloperConfirmation)({
         event,
         toolName: call.toolName,
@@ -814,6 +838,7 @@ function prepareDeveloperConfirmation(event, call, payload, source) {
         argsDigest: (0, devConfirm_1.actionDigest)(call.toolArgs),
         policyId: source.policyId,
         policyName: source.policyName,
+        policyHash: source.policyHash || source.localFinding?.policyHash,
         matchedRule: source.matchedRule,
         sessionId: sessId,
         remember: source.remember,
@@ -822,6 +847,8 @@ function prepareDeveloperConfirmation(event, call, payload, source) {
     (0, hookIo_1.dbg)({ phase: 'dev_confirm_ask', event, tool: call.toolName, operation, key: marker.key, remember: source.remember, where: source.where });
     spoolCallEvent(call, {
         decision: 'approval',
+        ruleId: source.policyId || source.localFinding?.ruleId,
+        policyHash: source.policyHash || source.localFinding?.policyHash,
         reason: `developer confirmation requested via IDE prompt${policyLabel}${source.reason ? `: ${source.reason}` : ''}`,
         approvalScope: 'developer',
         offlineEnforced,
@@ -840,6 +867,24 @@ function prepareDeveloperConfirmation(event, call, payload, source) {
         outcome: 'ask',
         userMsg: `${explained.userMessage}\nAllow this ${event}?`,
         agentMsg: `FullCourtDefense paused this ${event} for the developer's confirmation${policyLabel}: ${reason}. Wait for the developer's answer in the IDE prompt — do not retry or work around it. ${explained.agentMessage}`,
+        // For the per-event hook process in the developer's session: everything the
+        // three-button dialog needs. Stays on this machine (IPC / stdout of our own
+        // process) and is stripped before the IDE reads the verdict; the grant it
+        // may create stores only the scope and a digest, never the command text.
+        envelope: {
+            v: 1,
+            event,
+            toolName: call.toolName,
+            argsDigest: marker.argsDigest,
+            operation,
+            scope: grantScope,
+            policyId: source.policyId,
+            policyName: source.policyName,
+            policyHash,
+            matchedRule: source.matchedRule,
+            remember: source.remember,
+            reason: explained.userMessage,
+        },
     };
 }
 /**
@@ -916,14 +961,14 @@ function tryLocalPolicyEnforcement(ctx, call, detail, opts = {}) {
         if (ctx.shadow) {
             // Truth-in-reporting: the action RAN — 'warn' (advisory), never 'allow'
             // (which hides the would-block from the console) and never 'block'.
-            spoolCallEvent(call, { decision: 'warn', reason: `[monitor] local policy would ${local.verdict} (offline): ${reason}`, offlineEnforced: true });
+            spoolCallEvent(call, { decision: 'warn', ruleId: local.policyId, policyHash: ctx.effectivePolicyHash, reason: `[monitor] local policy would ${local.verdict} (offline): ${reason}`, offlineEnforced: true });
             (0, telemetry_1.triggerFlush)(false);
             ctx.respond(false, undefined, `[FullCourtDefense shadow] would ${local.verdict === 'block' ? 'block' : 'require approval for'} ${call.toolName} (offline, locally cached policy): ${reason}`);
         }
         const approvalNote = local.verdict === 'require_approval'
             ? ' This action requires human approval, which is not possible while the policy service is unreachable.'
             : '';
-        spoolCallEvent(call, { decision: 'block', reason: `local policy (offline): ${reason}`, offlineEnforced: true });
+        spoolCallEvent(call, { decision: 'block', ruleId: local.policyId, policyHash: ctx.effectivePolicyHash, reason: `local policy (offline): ${reason}`, offlineEnforced: true });
         (0, telemetry_1.triggerFlush)(true);
         const explained = explainPolicyStop('block', ctx.event, call, local, policies, `Enforced from the locally cached policy while the policy service is unreachable (${detail}).${approvalNote}`);
         ctx.respond(true, explained.userMessage, `${explained.agentMessage} Do not retry until the connection is restored or the policy allows it.`);
@@ -939,7 +984,7 @@ function tryLocalPolicyEnforcement(ctx, call, detail, opts = {}) {
             ? warning.agentMsg
             : `${warning.agentMsg} (policy service unreachable — evaluated from the locally cached org policies).`);
     }
-    spoolCallEvent(call, { decision: 'allow', reason: `local policy allow (${monitorPath ? 'monitor' : 'offline'}): ${detail}`, offlineEnforced: true });
+    spoolCallEvent(call, { decision: 'allow', ruleId: local.policyId, policyHash: ctx.effectivePolicyHash, reason: `local policy allow (${monitorPath ? 'monitor' : 'offline'}): ${detail}`, offlineEnforced: true });
     (0, telemetry_1.triggerFlush)(false);
     ctx.respond(false, undefined, monitorPath
         ? undefined
@@ -1182,15 +1227,25 @@ function processIo(stdin, stdinErr) {
  * an allow verdict, never an error the thin client would surface.
  */
 async function evaluateHookRequest(args, stdinRaw, config) {
+    return evaluateBuffered(args, stdinRaw, '', config, { isTTY: false, exitsProcess: false });
+}
+/**
+ * Run the hook against a buffered io and return the verdict instead of writing
+ * it. `exitsProcess: true` keeps the standalone hook's delivery contract (spool +
+ * detached flusher) while still letting the caller post-process the verdict —
+ * the per-event process needs that to open the developer's dialog on an `ask`.
+ */
+async function evaluateBuffered(args, stdinRaw, stdinErr, config, mode) {
     let out = '';
     let errOut = '';
     const io = {
         stdin: stdinRaw,
-        isTTY: false,
+        stdinErr: stdinErr || undefined,
+        isTTY: mode.isTTY,
         write: (text) => { out += text; },
         writeErr: (text) => { errOut += text; },
         exit: (code) => { throw new HookExitSignal(code); },
-        exitsProcess: false,
+        exitsProcess: mode.exitsProcess,
     };
     try {
         await hookCommandInner(args, config, io);
@@ -1246,25 +1301,16 @@ async function hookCommandOuter(args, config, startedAt) {
             const ipc = await (0, verdictIpc_1.requestDaemonVerdict)(args, raw, undefined, startedAt);
             if (ipc.outcome === 'verdict') {
                 (0, hookIo_1.dbg)({ phase: 'ipc_verdict', event: args.event, exitCode: ipc.exitCode });
-                if (ipc.stderr) {
-                    try {
-                        process.stderr.write(ipc.stderr);
-                    }
-                    catch { /* stderr gone */ }
-                }
-                if (ipc.stdout) {
-                    try {
-                        process.stdout.write(ipc.stdout);
-                    }
-                    catch { /* stdout gone */ }
-                }
-                process.exit(ipc.exitCode ?? 0);
+                await (0, askDialog_1.emitVerdictForIde)(args, { stdout: ipc.stdout || '', stderr: ipc.stderr || '', exitCode: ipc.exitCode ?? 0 }, 'ipc');
             }
             // Daemon down / busy / refused — evaluate locally as always. Logged so a
             // machine that silently stopped using the fast path is diagnosable.
             (0, hookIo_1.dbg)({ phase: 'ipc_unavailable', event: args.event, detail: ipc.detail });
         }
-        await hookCommandInner(args, config, processIo(raw, stdinErr));
+        // Buffered so an `ask` can be put to the developer in OUR dialog before the
+        // IDE reads the verdict; exitsProcess stays true — this process ends right after.
+        const result = await evaluateBuffered(args, raw, stdinErr, config, { isTTY: !!process.stdin.isTTY, exitsProcess: true });
+        await (0, askDialog_1.emitVerdictForIde)(args, result, 'local');
     }
     catch (err) {
         const message = err instanceof Error ? err.message : String(err);
@@ -1517,7 +1563,7 @@ async function hookCommandInner(args, config, io) {
         pendingLocalAsk = pendingLocalAsk || { finding, call };
     };
     const hasPendingLocalAsk = () => Boolean(pendingLocalAsk);
-    const respond = (blocked, userMsg, agentMsg) => {
+    const respond = (blocked, userMsg, agentMsg, askEnvelope) => {
         let ask = blocked === 'ask' && event !== 'prompt';
         const denied = blocked === true;
         if (!denied && !ask && pendingLocalAsk && event !== 'prompt') {
@@ -1535,6 +1581,7 @@ async function hookCommandInner(args, config, io) {
             if (prepared.outcome === 'ask') {
                 ask = true;
                 userMsg = prepared.userMsg;
+                askEnvelope = prepared.envelope;
             }
             agentMsg = [prepared.agentMsg, agentMsg].filter(Boolean).join(' ');
         }
@@ -1575,7 +1622,11 @@ async function hookCommandInner(args, config, io) {
             if (agentMsg)
                 decision.agent_message = agentMsg;
         }
-        (0, hookIo_1.dbg)({ phase: 'verdict', event, format: hookFormat, blocked, decision });
+        // An ask carries the dialog envelope for the per-event hook process in the
+        // developer's session (askDialog.ts); it is removed before the IDE reads the verdict.
+        if (ask && askEnvelope)
+            decision = (0, askDialog_1.attachAskEnvelope)(decision, askEnvelope);
+        (0, hookIo_1.dbg)({ phase: 'verdict', event, format: hookFormat, blocked, decision: ask && askEnvelope ? { ...decision, [askDialog_1.ASK_ENVELOPE_FIELD]: '(envelope)' } : decision });
         if (hookFormat === 'claude' && event === 'prompt' && denied) {
             // Claude Desktop/Code variants do not all honor the structured
             // UserPromptSubmit decision consistently. Exit 2 is the documented hard
@@ -1783,6 +1834,7 @@ async function enforceActionPolicy(ctx) {
     const toolOutcome = (0, deterministicGuard_1.resolveDeterministicOutcome)(opts => (0, deterministicGuard_1.scanDeterministicToolCall)(call.toolName, call.toolArgs, opts), (0, localSafetySnapshot_1.snapshotToScanOptions)(snapshot, {
         cwd: typeof call.toolArgs.cwd === 'string' ? call.toolArgs.cwd : process.cwd(),
         inspectScripts: event === 'shell',
+        mcpServerName: event === 'mcp' ? mcpServerName(payload) : undefined,
     }));
     deferLocalWarnings(toolOutcome.warnings, call.toolName, event);
     const localBlock = toolOutcome.blockingFinding;
@@ -1947,7 +1999,7 @@ async function enforceActionPolicy(ctx) {
                 // read "N blocked of N recent" with every allow missing. Same delivery
                 // as a block: spool (sync file append) + detached flusher that outlives
                 // this process. The IDE is not kept waiting on the network.
-                spoolCallEvent(call, { decision: 'allow', reason: 'local policy allow (block mode, local-first)' });
+                spoolCallEvent(call, { decision: 'allow', policyHash: effectivePolicyHash, ruleId: localVerdict.policyId, reason: 'local policy allow (block mode, local-first)' });
                 (0, telemetry_1.triggerFlush)(true);
                 respond(false);
                 return;
@@ -1958,7 +2010,7 @@ async function enforceActionPolicy(ctx) {
             void fetch(gateUrl, { method: 'POST', headers, body: gateBody, signal: AbortSignal.timeout(4000) })
                 .then(() => (0, policyGateHealth_1.recordGateSuccess)())
                 .catch(() => {
-                spoolCallEvent(call, { decision: 'allow', reason: 'local policy allow (block mode, local-first); gate report failed — spooled', offlineEnforced: true });
+                spoolCallEvent(call, { decision: 'allow', policyHash: effectivePolicyHash, ruleId: localVerdict.policyId, reason: 'local policy allow (block mode, local-first); gate report failed — spooled', offlineEnforced: true });
                 (0, telemetry_1.triggerFlush)(false);
             });
             respond(false);
@@ -1966,7 +2018,7 @@ async function enforceActionPolicy(ctx) {
         }
         if (localVerdict.verdict === 'block') {
             const reason = localVerdict.reason || `${call.toolName}: blocked by org Action Policy`;
-            spoolCallEvent(call, { decision: 'block', reason: `local policy (block mode, local-first): ${reason}`, offlineEnforced: true });
+            spoolCallEvent(call, { decision: 'block', policyHash: effectivePolicyHash, ruleId: localVerdict.policyId, reason: `local policy (block mode, local-first): ${reason}`, offlineEnforced: true });
             (0, telemetry_1.triggerFlush)(true);
             const explained = explainPolicyStop('block', event, call, localVerdict, ctx.localPolicies);
             respond(true, explained.userMessage, explained.agentMessage);
@@ -1980,7 +2032,7 @@ async function enforceActionPolicy(ctx) {
             return;
         }
         // require_approval, developer scope + human present → IDE-native ask (no org queue).
-        if (tryDeveloperConfirmation({ event, respond, shadow, localPolicies: ctx.localPolicies }, call, localVerdict, payload, 'local-first'))
+        if (tryDeveloperConfirmation({ event, respond, shadow, effectivePolicyHash, localPolicies: ctx.localPolicies }, call, localVerdict, payload, 'local-first'))
             return;
         // require_approval (org scope) → synchronous gate below creates the approval action.
     }

package/dist/commands/installClaudeHook.js

@@ -44,6 +44,7 @@ const os = __importStar(require("os"));
 const path = __importStar(require("path"));
 const config_1 = require("../config");
 const hookIo_1 = require("../hookIo");
+const gatewayRuntime_1 = require("../gatewayRuntime");
 const restartNotice_1 = require("./restartNotice");
 const COLOR = {
     reset: '\x1b[0m', bold: '\x1b[1m', dim: '\x1b[2m',
@@ -94,15 +95,16 @@ function hookScriptPath() {
         || (0, hookIo_1.slimHookEntryPath)(path.join(__dirname, '..', 'index.js'))
         || cliScript;
 }
-function hookInvocationPrefix() {
+function hookInvocationPrefix(existingCommand) {
     const q = (s) => (/\s/.test(s) ? `"${s}"` : s);
-    return `${q(process.execPath)} ${q(hookScriptPath())}`;
+    const runtime = (0, gatewayRuntime_1.resolveHookRuntime)({ executable: process.execPath, entry: hookScriptPath() }, existingCommand);
+    return `${q(runtime.executable)} ${q(runtime.entry)}`;
 }
 function repairManagedCommandPath(command) {
     const marker = command.indexOf(' hook ');
     if (marker < 0)
         return { command, stale: true };
-    const expected = `${hookInvocationPrefix()}${command.slice(marker)}`;
+    const expected = `${hookInvocationPrefix(command)}${command.slice(marker)}`;
     return { command: expected, stale: expected !== command };
 }
 function managedCommands(settings) {
@@ -212,8 +214,12 @@ function syncCopilotToolHooks(command) {
     for (const event of ['PreToolUse', 'PostToolUse']) {
         const entries = Array.isArray(hooks[event]) ? hooks[event] : [];
         const kept = entries.filter(entry => !isManagedCommand(entry));
-        if (command)
-            kept.push({ type: 'command', command: `${command} --agent-client copilot`, timeoutSec: event === 'PreToolUse' ? TOOL_HOOK_TIMEOUT_SEC : POST_TOOL_HOOK_TIMEOUT_SEC });
+        if (command) {
+            const existing = entries.find(isManagedCommand)?.command;
+            const marker = command.indexOf(' hook ');
+            const ownedCommand = existing && marker >= 0 ? `${hookInvocationPrefix(existing)}${command.slice(marker)}` : command;
+            kept.push({ type: 'command', command: `${ownedCommand} --agent-client copilot`, timeoutSec: event === 'PreToolUse' ? TOOL_HOOK_TIMEOUT_SEC : POST_TOOL_HOOK_TIMEOUT_SEC });
+        }
         if (kept.length)
             hooks[event] = kept;
         else

package/dist/commands/installCursorHook.js

@@ -42,6 +42,7 @@ const os = __importStar(require("os"));
 const path = __importStar(require("path"));
 const config_1 = require("../config");
 const hookIo_1 = require("../hookIo");
+const gatewayRuntime_1 = require("../gatewayRuntime");
 const restartNotice_1 = require("./restartNotice");
 const COLOR = {
     reset: '\x1b[0m', bold: '\x1b[1m', dim: '\x1b[2m',
@@ -153,19 +154,19 @@ function isManaged(entry) {
     return typeof entry?.command === 'string'
         && (entry.command.includes(MANAGED_MARKER) || entry.command.includes(MANAGED_TAG));
 }
-function hookInvocationPrefix() {
-    const nodeExe = process.execPath;
+function hookInvocationPrefix(existingCommand) {
+    const runtime = (0, gatewayRuntime_1.resolveHookRuntime)({ executable: process.execPath, entry: hookScriptPath() }, existingCommand);
     const q = (s) => (/\s/.test(s) ? `"${s}"` : s);
     // Repair rewrites stale managed entries to the slim entry too — this is how
     // an already-enrolled fleet migrates to the slim hook on upgrade, without a
     // reinstall (protection repair runs from the daemon after every update).
-    return `${q(nodeExe)} ${q(hookScriptPath())}`;
+    return `${q(runtime.executable)} ${q(runtime.entry)}`;
 }
 function repairManagedCommandPath(command) {
     const marker = command.indexOf(' hook ');
     if (marker < 0)
         return { command, stale: true };
-    const expected = `${hookInvocationPrefix()}${command.slice(marker)}`;
+    const expected = `${hookInvocationPrefix(command)}${command.slice(marker)}`;
     return { command: expected, stale: expected !== command };
 }
 /** A managed command mutated to weaken enforcement (`--shadow true` injected). */

package/dist/commands/mcpGateway.d.ts

@@ -3,6 +3,8 @@ import { BotGuardConfig } from '../config';
 export type GatewayClient = 'cursor' | 'claude-code' | 'claude-desktop' | 'codex' | 'gemini-cli' | 'windsurf' | 'vscode';
 export declare const ALL_GATEWAY_CLIENTS: GatewayClient[];
 export interface McpGatewayArgs {
+    /** Original MCP configuration key; independent of the display agent name. */
+    mcpServerName?: string;
     mcpCommand?: string;
     mcpArgs?: string;
     /** Remote MCP server URL (Streamable HTTP / SSE) — alternative to --mcp-command. */