fullcourtdefense-cli 1.34.21 → 1.34.25

package/dist/commands/mcpGateway.js

@@ -49,8 +49,11 @@ exports.installGeminiMcpGatewayCommand = installGeminiMcpGatewayCommand;
 exports.installWindsurfMcpGatewayCommand = installWindsurfMcpGatewayCommand;
 exports.installVscodeMcpGatewayCommand = installVscodeMcpGatewayCommand;
 const fs = __importStar(require("fs"));
+const mcpToolTrust_1 = require("../mcpToolTrust");
+const mcpToolReview_1 = require("../mcpToolReview");
 const os = __importStar(require("os"));
 const path = __importStar(require("path"));
+const gatewayRuntime_1 = require("../gatewayRuntime");
 const child_process_1 = require("child_process");
 const config_1 = require("../config");
 const discoverPaths_1 = require("./discoverPaths");
@@ -222,6 +225,7 @@ function resolveGatewayConfig(args, config, defaults = {}) {
     const agentClient = normalizeAgentClient(args.agentClient || process.env.FCD_AGENT_CLIENT || detectRuntimeAgentClient(), defaults.agentClient || 'cursor');
     const developerName = detectedDeveloperName(args);
     return {
+        mcpServerName: args.mcpServerName,
         shieldId: creds.shieldId,
         shieldKey: creds.shieldKey,
         apiUrl: creds.apiUrl,
@@ -500,19 +504,7 @@ class StdioMcpClient {
         this.notify('notifications/initialized', {});
     }
     async listTools() {
-        const result = await this.request('tools/list', {});
-        const tools = result?.tools;
-        if (!Array.isArray(tools))
-            return [];
-        return tools
-            .filter(tool => typeof tool.name === 'string')
-            .map(tool => ({
-            name: String(tool.name),
-            description: typeof tool.description === 'string'
-                ? String(tool.description)
-                : undefined,
-            inputSchema: tool.inputSchema,
-        }));
+        return (0, mcpToolReview_1.readCompleteToolCatalog)(params => this.request('tools/list', params));
     }
     async callTool(name, args) {
         return this.request('tools/call', { name, arguments: args });
@@ -661,19 +653,7 @@ class HttpMcpClient {
         throw lastError || new Error(`Could not initialize remote MCP server at ${this.url}`);
     }
     async listTools() {
-        const response = await this.request('tools/list', {});
-        const tools = response?.tools;
-        if (!Array.isArray(tools))
-            return [];
-        return tools
-            .filter(tool => typeof tool.name === 'string')
-            .map(tool => ({
-            name: String(tool.name),
-            description: typeof tool.description === 'string'
-                ? String(tool.description)
-                : undefined,
-            inputSchema: tool.inputSchema,
-        }));
+        return (0, mcpToolReview_1.readCompleteToolCatalog)(params => this.request('tools/list', params));
     }
     async callTool(name, args) {
         return this.request('tools/call', { name, arguments: args });
@@ -986,6 +966,8 @@ function describeDeveloperNo(answer) {
 class McpGatewayServer {
     gatewayConfig;
     downstreamSpec;
+    toolTrust;
+    reportedCatalog = '';
     downstream;
     downstreamReady;
     buffer = '';
@@ -1082,6 +1064,7 @@ class McpGatewayServer {
             if (message.method === 'tools/list') {
                 await this.ensureDownstream();
                 const tools = await this.downstream.listTools();
+                this.reportCatalog(this.catalog(tools));
                 this.respond(message.id, {
                     tools: tools.map(tool => ({
                         ...tool,
@@ -1117,6 +1100,51 @@ class McpGatewayServer {
         }
         await this.downstreamReady;
     }
+    catalog(tools) {
+        const downstream = this.downstreamSpec.kind === 'http' ? { ...this.downstreamSpec, headers: this.downstreamSpec.headers || {} } : this.downstreamSpec;
+        return (0, mcpToolTrust_1.parseToolCatalog)({ serverId: (0, mcpToolTrust_1.toolDigest)({ server: this.gatewayConfig.mcpServerName || this.gatewayConfig.agentName || 'MCP server', downstream, cwd: process.cwd(), client: this.gatewayConfig.agentClient || '' }), serverName: this.gatewayConfig.mcpServerName || this.gatewayConfig.agentName || 'MCP server', tools });
+    }
+    reportCatalog(catalog) {
+        if (this.reportedCatalog === catalog.catalogHash)
+            return;
+        this.reportedCatalog = catalog.catalogHash;
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), 2000);
+        void fetch(`${this.gatewayConfig.apiUrl.replace(/\/$/, '')}/api/cli/tool-catalog`, {
+            method: 'POST', headers: { 'content-type': 'application/json', 'x-shield-id': this.gatewayConfig.shieldId, 'x-shield-key': this.gatewayConfig.shieldKey || '' },
+            body: JSON.stringify({ machineId: (0, machineIdentity_1.getMachineIdentity)().machineId, catalog }), signal: controller.signal,
+        }).then(response => { if (!response.ok)
+            this.reportedCatalog = ''; }).catch(() => { this.reportedCatalog = ''; }).finally(() => clearTimeout(timer));
+    }
+    async checkToolReview(toolName, expectedCatalogHash) {
+        const machineId = (0, machineIdentity_1.getMachineIdentity)().machineId;
+        const bundle = await (0, runtimeConfig_1.getRuntimeBundle)({ apiUrl: this.gatewayConfig.apiUrl, shieldId: this.gatewayConfig.shieldId, shieldKey: this.gatewayConfig.shieldKey, machineId, hotPath: true });
+        try {
+            this.toolTrust ||= new mcpToolReview_1.ToolReviewLease(machineId, this.gatewayConfig.shieldId, this.gatewayConfig.apiUrl);
+            const settings = this.toolTrust.settings(bundle.mcpToolTrust);
+            if (!settings?.enabled)
+                return; // Legacy/unconfigured is not claimed as verified.
+            const catalog = this.catalog(await this.downstream.listTools());
+            this.reportCatalog(catalog);
+            if (expectedCatalogHash && expectedCatalogHash !== catalog.catalogHash)
+                throw new Error('MCP tool definitions changed during this action. Retry so the current version and action are reviewed together.');
+            if (!(0, mcpToolTrust_1.toolCatalogAllowed)(settings, catalog, toolName))
+                throw new Error('This MCP server has new or changed tool definitions. Review this exact version in Action Protection before calling it.');
+            return catalog.catalogHash;
+        }
+        catch (error) {
+            const reason = error instanceof Error ? error.message : 'Tool review is unavailable.';
+            const monitoring = (bundle.source === 'server' || bundle.source === 'cache') && (bundle.mode === 'monitor' || bundle.mode === 'shadow');
+            try {
+                (0, telemetry_1.spoolEvent)({ decision: monitoring ? 'warn' : 'block', toolName, operation: 'mcp:tool-review', reason: monitoring ? `[monitor] ${reason}` : reason, ruleId: 'mcp-tool-review', offlineEnforced: true });
+                (0, telemetry_1.triggerFlush)(!monitoring);
+            }
+            catch { /* Evidence failures cannot change the review decision. */ }
+            if (monitoring)
+                return;
+            throw blockError(reason);
+        }
+    }
     /** Forget a dead/failed downstream so the next call respawns it. */
     resetDownstream(client) {
         if (this.downstream === client) {
@@ -1155,6 +1183,9 @@ class McpGatewayServer {
         const toolName = String(params.name || '');
         if (!toolName)
             throw new Error('Missing MCP tool name.');
+        // Outside the legacy policy-service fail-open recovery: review failures
+        // must never forward a call. Matching metadata still runs every policy.
+        const reviewedCatalogHash = await this.checkToolReview(toolName);
         // What the server receives is untouched (`forwardArgs`). What the policy
         // decision sees is the canonical action: a whole-file write is reduced to
         // the lines it adds so a secret already sitting in the file never blocks
@@ -1196,6 +1227,7 @@ class McpGatewayServer {
                     shieldKey: this.gatewayConfig.shieldKey,
                     developerName: this.gatewayConfig.developerName,
                     machineName: os.hostname(),
+                    machineId: (0, machineIdentity_1.getMachineIdentity)().machineId,
                     hotPath: true,
                 });
                 // Admin kill-switch: a suspended machine denies every tool call. This
@@ -1251,7 +1283,7 @@ class McpGatewayServer {
                 snapshot.itemActions = Object.fromEntries(Object.entries(snapshot.itemActions || {}).map(([id, action]) => [id, action === 'mask' ? 'warn' : action]));
                 snapshot.customBlocks = snapshot.customBlocks.map(rule => rule.action === 'mask' ? { ...rule, action: 'warn' } : rule);
             }
-            const requestOutcome = (0, deterministicGuard_1.resolveDeterministicOutcome)(opts => (0, deterministicGuard_1.scanDeterministicToolCall)(toolName, toolArgs, opts), (0, localSafetySnapshot_1.snapshotToScanOptions)(snapshot));
+            const requestOutcome = (0, deterministicGuard_1.resolveDeterministicOutcome)(opts => (0, deterministicGuard_1.scanDeterministicToolCall)(toolName, toolArgs, opts), (0, localSafetySnapshot_1.snapshotToScanOptions)(snapshot, { mcpServerName: this.gatewayConfig.mcpServerName }));
             for (const warning of requestOutcome.warnings) {
                 this.spoolLocalFinding(warning, toolName, operation, 'warn');
                 process.stderr.write(`FullCourtDefense warning (${warning.itemId}): ${warning.reason}\n`);
@@ -1260,17 +1292,41 @@ class McpGatewayServer {
             // human — through the MCP client (elicitation) when it can show a dialog,
             // otherwise (or when the client answers for the user) through the OS
             // dialog — whenever a human is present. Session memory reuses the IDE
-            // hook's ledger (same tool + rule => remembered). Decline, cancel, timeout
+            // hook's ledger (same action + policy + server + session => remembered). Decline, cancel, timeout
             // or no human => block, never a silent allow.
             let localBlock = requestOutcome.blockingFinding || requestOutcome.askFinding;
             let askNote = '';
             if (!requestOutcome.blockingFinding && requestOutcome.askFinding && !reportOnlyMode) {
                 const ask = requestOutcome.askFinding;
                 const origin = ask.source === 'custom' ? 'org custom rule' : 'built-in Local Safety rule';
-                const rememberScope = { toolName, operation: operation || (0, actionPolicyEngine_1.inferToolContext)(toolName, toolArgs).operation, policyId: `local-safety:${ask.itemId}`, matchedRule: ask.ruleId };
+                const rememberScope = {
+                    toolName, argsDigest: (0, devConfirm_1.actionDigest)(toolArgs),
+                    policyHash: ask.policyHash,
+                    authorizationContext: (0, devConfirm_1.actionDigest)({ server: this.gatewayConfig.mcpServerName, downstream: this.downstreamSpec, cwd: process.cwd(), shieldId: this.gatewayConfig.shieldId, client: this.gatewayConfig.agentClient, catalog: reviewedCatalogHash || 'unreviewed' }),
+                    operation: operation || (0, actionPolicyEngine_1.inferToolContext)(toolName, toolArgs).operation,
+                    policyId: `local-safety:${ask.itemId}`, matchedRule: ask.ruleId,
+                };
                 const sessionId = runtimeSessionId() || this.gatewaySessionId;
+                const confirmationEvent = `mcp_gateway:${rememberScope.authorizationContext}:${rememberScope.policyHash}`;
                 const remembered = (0, devConfirm_1.isConfirmationRemembered)(rememberScope, sessionId);
-                if (remembered) {
+                // Same grant identity the IDE hook uses for this Local Safety item, so one
+                // "Always allow" covers both surfaces.
+                const grantToolName = this.gatewayConfig.mcpServerName ? `mcp__${this.gatewayConfig.mcpServerName}__${toolName}` : toolName;
+                const grantScope = (0, devConfirm_1.grantScopeFor)('mcp', grantToolName, toolArgs, rememberScope.operation, (0, actionPolicyEngine_1.inferToolContext)(toolName, toolArgs).context);
+                const grantRule = { policyId: rememberScope.policyId, policyName: `Local Safety: ${ask.itemId}`, matchedRule: ask.itemId, policyHash: ask.policyHash };
+                const grant = remembered ? undefined : (0, devConfirm_1.findDeveloperGrant)(grantScope, grantRule);
+                if (grant) {
+                    (0, telemetry_1.spoolEvent)({
+                        decision: 'allow', toolName, operation: rememberScope.operation,
+                        reason: `developer granted Always allow for ${(0, devConfirm_1.describeGrantScope)(grant.scope)} — ${ask.reason}`,
+                        ruleId: ask.ruleId, category: ask.category, categoryId: ask.categoryId, itemId: ask.itemId, source: ask.source,
+                        evidence: ask.evidence, policyHash: ask.policyHash, offlineEnforced: true,
+                        approvalScope: 'developer', approvedBy: 'developer',
+                    });
+                    (0, telemetry_1.triggerFlush)(false);
+                    localBlock = undefined;
+                }
+                else if (remembered) {
                     (0, telemetry_1.spoolEvent)({
                         decision: 'allow', toolName, operation: rememberScope.operation,
                         reason: `developer confirmed earlier this session (session memory) — ${ask.reason}`,
@@ -1284,21 +1340,25 @@ class McpGatewayServer {
                 else if ((0, devConfirm_1.isHumanPresent)()) {
                     const digest = (0, devConfirm_1.actionDigest)(toolArgs);
                     const marker = (0, devConfirm_1.raiseDeveloperConfirmation)({
-                        event: 'mcp_gateway', toolName, operation: rememberScope.operation, argsDigest: digest,
+                        event: confirmationEvent, ...rememberScope, argsDigest: digest,
                         policyId: rememberScope.policyId, policyName: `Local Safety: ${ask.itemId}`, matchedRule: ask.ruleId,
                         sessionId, remember: 'none',
                     });
                     process.stderr.write(`FullCourtDefense asking the developer to confirm ${toolName}: ${ask.reason} (${origin} "${ask.itemId}", ${ask.ruleId})\n`);
-                    const answer = await this.confirmWithDeveloper({ toolName, reason: ask.reason, ruleLabel: `${origin} "${ask.itemId}" (${ask.ruleId})`, evidence: ask.evidence, argsDigest: digest });
+                    const alwaysScopeLabel = (0, devConfirm_1.describeGrantScope)(grantScope);
+                    const answer = await this.confirmWithDeveloper({ toolName, reason: ask.reason, ruleLabel: `${origin} "${ask.itemId}" (${ask.ruleId})`, evidence: ask.evidence, argsDigest: digest, allowAlways: true, alwaysScopeLabel });
                     if (answer.answer === 'accept') {
                         // Settle through the shared ledger so "remember for this session" is
                         // recorded exactly like an IDE approval would be.
                         if (answer.remember)
                             (0, devConfirm_1.raiseDeveloperConfirmation)({ ...marker, remember: 'session' });
-                        (0, devConfirm_1.settleDeveloperConfirmation)('mcp_gateway', toolName, digest);
+                        (0, devConfirm_1.settleDeveloperConfirmation)(confirmationEvent, toolName, digest);
+                        const granted = answer.always && ask.policyHash ? (0, devConfirm_1.recordDeveloperGrant)(grantScope, { ...grantRule, policyHash: ask.policyHash }) : undefined;
                         (0, telemetry_1.spoolEvent)({
                             decision: 'allow', toolName, operation: rememberScope.operation,
-                            reason: `developer confirmed in ${confirmChannelLabel(answer)}${answer.remember ? ' (remembered for this session)' : ''}${answer.clientAutoAnswered ? ' (the MCP client auto-declined the in-client prompt)' : ''} — ${ask.reason}`,
+                            reason: granted
+                                ? `developer chose Always allow in ${confirmChannelLabel(answer)} — ${alwaysScopeLabel} (30 days, this rule) — ${ask.reason}`
+                                : `developer confirmed in ${confirmChannelLabel(answer)}${answer.remember ? ' (remembered for this session)' : ''}${answer.clientAutoAnswered ? ' (the MCP client auto-declined the in-client prompt)' : ''} — ${ask.reason}`,
                             ruleId: ask.ruleId, category: ask.category, categoryId: ask.categoryId, itemId: ask.itemId, source: ask.source,
                             evidence: ask.evidence, policyHash: ask.policyHash, offlineEnforced: true,
                             approvalScope: 'developer', approvedBy: 'developer', confirmLatencyMs: answer.latencyMs,
@@ -1307,7 +1367,7 @@ class McpGatewayServer {
                         localBlock = undefined;
                     }
                     else {
-                        (0, devConfirm_1.rejectDeveloperConfirmation)('mcp_gateway', toolName, digest);
+                        (0, devConfirm_1.rejectDeveloperConfirmation)(confirmationEvent, toolName, digest);
                         const no = describeDeveloperNo(answer);
                         (0, telemetry_1.spoolEvent)({
                             decision: 'block', toolName, operation: rememberScope.operation,
@@ -1601,6 +1661,7 @@ class McpGatewayServer {
                 }
             }
             downstreamAttempted = true;
+            await this.checkToolReview(toolName, reviewedCatalogHash);
             let rawResult = await this.downstream.callTool(toolName, forwardArgs);
             downstreamRan = true;
             downstreamResult = rawResult;
@@ -1793,6 +1854,7 @@ class McpGatewayServer {
             if (!isBlockError(error) && !downstreamAttempted) {
                 // Pre-call bug: forward the tool call now (exactly once).
                 try {
+                    await this.checkToolReview(toolName, reviewedCatalogHash);
                     const recovered = await this.downstream.callTool(toolName, forwardArgs);
                     try {
                         (0, telemetry_1.spoolEvent)({ decision: 'allow', toolName, operation, reason: `gateway error failed open (pre-call): ${message.slice(0, 200)}`, offlineEnforced: true });
@@ -1878,8 +1940,13 @@ class McpGatewayServer {
             (0, telemetry_1.triggerFlush)(true);
             throw blockError(reason);
         }
-        const rememberScope = { toolName, operation, policyId: verdict.policyId, matchedRule: verdict.matchedRule };
+        const rememberScope = {
+            toolName, operation, argsDigest: (0, devConfirm_1.actionDigest)(toolArgs),
+            policyId: verdict.policyId, matchedRule: verdict.matchedRule, policyHash: (0, devConfirm_1.actionDigest)({ policies }),
+            authorizationContext: (0, devConfirm_1.actionDigest)({ server: this.gatewayConfig.mcpServerName, downstream: this.downstreamSpec, cwd: process.cwd(), shieldId: this.gatewayConfig.shieldId, client: this.gatewayConfig.agentClient }),
+        };
         const sessionId = runtimeSessionId() || this.gatewaySessionId;
+        const confirmationEvent = `mcp_gateway:${rememberScope.authorizationContext}:${rememberScope.policyHash}`;
         const policyLabel = verdict.policyName ? ` (${verdict.policyName})` : '';
         const ruleId = verdict.policyName ? `action-policy:${verdict.policyName}` : undefined;
         const remembered = verdict.approval?.remember === 'none' ? undefined : (0, devConfirm_1.isConfirmationRemembered)(rememberScope, sessionId);
@@ -1894,8 +1961,24 @@ class McpGatewayServer {
         }
         const digest = (0, devConfirm_1.actionDigest)(toolArgs);
         const remember = verdict.approval?.remember ?? 'none';
+        // A standing "Always allow" from the FullCourtDefense dialog for this server + tool
+        // + operation (+ destination) under this exact rule. Rules with `remember: none`
+        // never offer it and never honour one.
+        const grantToolName = this.gatewayConfig.mcpServerName ? `mcp__${this.gatewayConfig.mcpServerName}__${toolName}` : toolName;
+        const grantScope = (0, devConfirm_1.grantScopeFor)('mcp', grantToolName, toolArgs, operation, (0, actionPolicyEngine_1.inferToolContext)(toolName, toolArgs).context);
+        const grantRule = { policyId: verdict.policyId, policyName: verdict.policyName, matchedRule: verdict.matchedRule, policyHash: rememberScope.policyHash };
+        const grant = remember === 'none' ? undefined : (0, devConfirm_1.findDeveloperGrant)(grantScope, grantRule);
+        if (grant) {
+            (0, telemetry_1.spoolEvent)({
+                decision: 'allow', toolName, operation,
+                reason: `developer granted Always allow for ${(0, devConfirm_1.describeGrantScope)(grant.scope)}${policyLabel}`,
+                ruleId, offlineEnforced: true, approvalScope: 'developer', approvedBy: 'developer',
+            });
+            (0, telemetry_1.triggerFlush)(false);
+            return true;
+        }
         const marker = (0, devConfirm_1.raiseDeveloperConfirmation)({
-            event: 'mcp_gateway', toolName, operation, argsDigest: digest,
+            event: confirmationEvent, ...rememberScope, argsDigest: digest,
             policyId: verdict.policyId, policyName: verdict.policyName, matchedRule: verdict.matchedRule,
             sessionId, remember,
         });
@@ -1909,25 +1992,31 @@ class McpGatewayServer {
             ? ' This policy is set to Block; on a developer workstation it asks you instead. An admin can mark it "Hard block" in the console to stop this without asking.'
             : '';
         process.stderr.write(`FullCourtDefense asking the developer to confirm ${toolName}${policyLabel}: ${verdict.reason || verdict.matchedRule || 'action policy'}\n`);
+        const alwaysScopeLabel = (0, devConfirm_1.describeGrantScope)(grantScope);
         const answer = await this.confirmWithDeveloper({
             toolName,
             reason: `${verdict.reason || `${toolName} needs your confirmation`}.${ceiling}`,
             allowRemember: false,
             ruleLabel: verdict.policyName ? `Action Policy "${verdict.policyName}"${verdict.matchedRule ? ` — ${verdict.matchedRule}` : ''}` : 'Action Policy',
             argsDigest: digest,
+            allowAlways: remember !== 'none',
+            alwaysScopeLabel,
         });
         if (answer.answer === 'accept') {
             // Policy memory limits are authoritative; a client cannot upgrade 'none'.
-            (0, devConfirm_1.settleDeveloperConfirmation)('mcp_gateway', toolName, digest);
+            (0, devConfirm_1.settleDeveloperConfirmation)(confirmationEvent, toolName, digest);
+            const granted = answer.always && remember !== 'none' ? (0, devConfirm_1.recordDeveloperGrant)(grantScope, grantRule) : undefined;
             (0, telemetry_1.spoolEvent)({
                 decision: 'allow', toolName, operation,
-                reason: `developer confirmed in ${confirmChannelLabel(answer)}${answer.remember ? ' (remembered for this session)' : ''}${answer.clientAutoAnswered ? ' (the MCP client auto-declined the in-client prompt)' : ''}${policyLabel}`,
+                reason: granted
+                    ? `developer chose Always allow in ${confirmChannelLabel(answer)} — ${alwaysScopeLabel} (30 days, this rule)${policyLabel}`
+                    : `developer confirmed in ${confirmChannelLabel(answer)}${answer.remember ? ' (remembered for this session)' : ''}${answer.clientAutoAnswered ? ' (the MCP client auto-declined the in-client prompt)' : ''}${policyLabel}`,
                 ruleId, offlineEnforced: true, approvalScope: 'developer', approvedBy: 'developer', confirmLatencyMs: answer.latencyMs,
             });
             (0, telemetry_1.triggerFlush)(false);
             return true;
         }
-        (0, devConfirm_1.rejectDeveloperConfirmation)('mcp_gateway', toolName, digest);
+        (0, devConfirm_1.rejectDeveloperConfirmation)(confirmationEvent, toolName, digest);
         const no = describeDeveloperNo(answer);
         (0, telemetry_1.spoolEvent)({
             decision: 'block', toolName, operation,
@@ -1961,7 +2050,8 @@ class McpGatewayServer {
     async confirmWithDeveloper(input) {
         if (!(0, devConfirm_1.isHumanPresent)())
             return { answer: 'unavailable', remember: false, latencyMs: 0, clientAutoAnswered: false };
-        const handoff = input.argsDigest ? (0, devConfirm_1.consumeConfirmedAction)(input.toolName, input.argsDigest) : undefined;
+        const handoff = input.argsDigest && this.gatewayConfig.mcpServerName
+            ? (0, devConfirm_1.consumeConfirmedAction)(`mcp__${this.gatewayConfig.mcpServerName}__${input.toolName}`, input.argsDigest) : undefined;
         if (handoff) {
             return { answer: 'accept', remember: false, latencyMs: Math.max(0, Date.now() - Date.parse(handoff.confirmedAt)), channel: 'hook_dialog', clientAutoAnswered: false };
         }
@@ -1988,10 +2078,10 @@ class McpGatewayServer {
     }
     async askInOsDialog(input, clientAutoAnswered) {
         const evidence = input.evidence ? `\nEvidence: ${input.evidence.slice(0, 240)}` : '';
-        const dialog = await (0, devConfirm_1.confirmNativeActionDetailed)(`Agent: ${this.gatewayConfig.agentName}\nIDE: ${this.gatewayConfig.agentClient}\nDeveloper: ${this.gatewayConfig.developerName || 'Unknown'}\nTool: ${input.toolName}\nRule: ${input.ruleLabel}\nWhy: ${input.reason}${evidence}\n\nYour answer is reported to your security dashboard as your decision.`, OS_DIALOG_TIMEOUT_MS);
+        const dialog = await (0, devConfirm_1.confirmNativeActionDetailed)(`Agent: ${this.gatewayConfig.agentName}\nIDE: ${this.gatewayConfig.agentClient}\nDeveloper: ${this.gatewayConfig.developerName || 'Unknown'}\nTool: ${input.toolName}\nRule: ${input.ruleLabel}\nWhy: ${input.reason}${evidence}\n\nYour answer is reported to your security dashboard as your decision.`, OS_DIALOG_TIMEOUT_MS, { allowAlways: input.allowAlways === true, alwaysScopeLabel: input.alwaysScopeLabel });
         process.stderr.write(`FullCourtDefense: dialog for ${input.toolName} ended with "${dialog.outcome}" after ${dialog.latencyMs}ms.\n`);
-        const answer = dialog.outcome === 'allow' ? 'accept' : dialog.outcome === 'deny' ? 'decline' : dialog.outcome;
-        return { answer, remember: false, latencyMs: dialog.latencyMs, channel: 'os_dialog', clientAutoAnswered };
+        const answer = dialog.outcome === 'allow' || dialog.outcome === 'allow_always' ? 'accept' : dialog.outcome === 'deny' ? 'decline' : dialog.outcome;
+        return { answer, remember: false, always: dialog.outcome === 'allow_always', latencyMs: dialog.latencyMs, channel: 'os_dialog', clientAutoAnswered };
     }
     async elicitDeveloperConfirmation(input) {
         const started = Date.now();
@@ -2010,7 +2100,7 @@ class McpGatewayServer {
                     ...(input.allowRemember === false ? {} : { remember: {
                             type: 'boolean',
                             title: 'Remember for this session',
-                            description: 'Do not ask again for this tool and rule until this MCP session ends (max 12 hours).',
+                            description: 'Remember this exact action in this session (max 12 hours). Changed arguments, server or policy require a new approval.',
                             default: false,
                         } }),
                 },
@@ -2083,6 +2173,9 @@ function readJson(file) {
 function gatewayScriptPath() {
     return path.resolve(process.argv[1] || path.join(__dirname, '..', 'index.js'));
 }
+function gatewayRuntime(entry) {
+    return (0, gatewayRuntime_1.resolveGatewayRuntime)({ executable: process.execPath, entry: gatewayScriptPath() }, entry);
+}
 /**
  * Resolve which real MCP server an installer should protect: a local stdio
  * command (--mcp-command/--mcp-args) or a remote HTTP/SSE URL (--mcp-url,
@@ -2115,6 +2208,7 @@ function buildGatewayCommandArgs(gatewayConfig, downstream, options = {}) {
         gatewayScriptPath(),
         'mcp-gateway',
         ...downstreamFlags,
+        ...(gatewayConfig.mcpServerName ? ['--mcp-server-name', gatewayConfig.mcpServerName] : []),
         '--agent-name', gatewayConfig.agentName,
         '--agent-client', gatewayConfig.agentClient,
         '--developer-name', gatewayConfig.developerName,
@@ -2477,9 +2571,10 @@ function isGatewayWrappedEntry(entry) {
 function wrappedEntryNeedsHeal(entry) {
     const args = Array.isArray(entry?.args) ? entry.args.map(String) : [];
     const credentialPairStale = args.includes('--shield-id') && !args.includes('--shield-key');
-    const runtimePathStale = (0, discoverPaths_1.normalizedPath)(String(entry?.command || '')) !== (0, discoverPaths_1.normalizedPath)(process.execPath)
+    const runtime = gatewayRuntime(entry);
+    const runtimePathStale = (0, discoverPaths_1.normalizedPath)(String(entry?.command || '')) !== (0, discoverPaths_1.normalizedPath)(runtime.executable)
         || !args[0]
-        || (0, discoverPaths_1.normalizedPath)(args[0]) !== (0, discoverPaths_1.normalizedPath)(gatewayScriptPath());
+        || (0, discoverPaths_1.normalizedPath)(args[0]) !== (0, discoverPaths_1.normalizedPath)(runtime.entry);
     return credentialPairStale || runtimePathStale;
 }
 /** Recover the original downstream server (stdio command or remote URL) from a wrapped entry's args. */
@@ -2745,6 +2840,7 @@ function healCodexTomlAgentIdentities(file, dryRun) {
  * entry reported `boazl-claude-desktop`. An explicit --agent-name / FCD_AGENT_NAME still wins.
  */
 function applyPerServerAgentName(gatewayConfig, args, serverName) {
+    gatewayConfig = { ...gatewayConfig, mcpServerName: serverName };
     if (args.agentName || process.env.FCD_AGENT_NAME)
         return gatewayConfig;
     if (!serverName || serverName === MANAGED_SERVER_NAME)
@@ -2766,6 +2862,7 @@ function perServerGatewayConfig(gatewayConfig, agentClient, serverName) {
     return {
         ...gatewayConfig,
         agentClient,
+        mcpServerName: serverName,
         agentName: perServerAgentName(gatewayConfig.developerName, agentClient, serverName),
         userObjective: gatewayConfig.userObjectiveExplicit ? gatewayConfig.userObjective : defaultUserObjective(agentClient),
     };
@@ -2801,12 +2898,14 @@ function wrapJsonConfigFile(file, gatewayConfig, agentClient, dryRun) {
                     const downstream = credentialPairStale ? extractFullyUnwrappedDownstream(entry) : null;
                     if (!credentialPairStale || downstream) {
                         const perServer = perServerGatewayConfig(gatewayConfig, agentClient, name);
-                        entry.command = nodeExe;
+                        const runtime = gatewayRuntime(entry);
+                        entry.command = runtime.executable;
                         // Path-only upgrades preserve every downstream/config flag exactly.
                         // The credential-pair bug requires a safe rebuild from downstream.
-                        entry.args = credentialPairStale
+                        const repairedArgs = credentialPairStale
                             ? buildGatewayCommandArgs(perServer, downstream, INSTALL_GATEWAY_ARGS)
-                            : [gatewayScriptPath(), ...existingArgs.slice(1)];
+                            : existingArgs;
+                        entry.args = [runtime.entry, ...repairedArgs.slice(1)];
                         stats.healed.push(name);
                         changed = true;
                         continue;
@@ -3010,13 +3109,21 @@ function transformCodexToml(file, mode, gatewayConfig, dryRun) {
             }
             if (wrappedAlready) {
                 const existingArgs = section.args || [];
-                const pathStale = (0, discoverPaths_1.normalizedPath)(section.command) !== (0, discoverPaths_1.normalizedPath)(nodeExe)
-                    || !existingArgs[0]
-                    || (0, discoverPaths_1.normalizedPath)(existingArgs[0]) !== (0, discoverPaths_1.normalizedPath)(gatewayScriptPath());
-                if (pathStale) {
+                const entry = { command: section.command, args: existingArgs };
+                const runtime = gatewayRuntime(entry);
+                const credentialPairStale = existingArgs.includes('--shield-id') && !existingArgs.includes('--shield-key');
+                if (wrappedEntryNeedsHeal(entry)) {
+                    const downstream = credentialPairStale ? extractFullyUnwrappedDownstream(entry) : null;
+                    // An invalid wrapper cannot be reconstructed without its downstream.
+                    // Leave it visible as unhealthy instead of manufacturing a success.
+                    if (credentialPairStale && !downstream)
+                        continue;
                     const indent = lines[section.cmdLine].match(/^\s*/)?.[0] || '';
-                    lines[section.cmdLine] = `${indent}command = ${JSON.stringify(nodeExe)}`;
-                    const repairedArgs = [gatewayScriptPath(), ...existingArgs.slice(1)];
+                    lines[section.cmdLine] = `${indent}command = ${JSON.stringify(runtime.executable)}`;
+                    const args = credentialPairStale
+                        ? buildGatewayCommandArgs(perServerGatewayConfig(gatewayConfig, 'codex', section.name), downstream, INSTALL_GATEWAY_ARGS)
+                        : existingArgs;
+                    const repairedArgs = [runtime.entry, ...args.slice(1)];
                     const argsLineText = `${indent}args = ${tomlStringArrayLiteral(repairedArgs)}`;
                     if (section.argsLine !== -1)
                         lines[section.argsLine] = argsLineText;

package/dist/commands/onboard.js

@@ -35,6 +35,7 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.onboardCommand = onboardCommand;
 const child_process_1 = require("child_process");
+const onboardingSummary_1 = require("./onboardingSummary");
 const fs = __importStar(require("fs"));
 const os = __importStar(require("os"));
 const path = __importStar(require("path"));
@@ -669,15 +670,15 @@ async function onboardCommand(args, config) {
         // already open still run their OLD (unwrapped) configuration until they
         // restart. Never print an unconditional green "protected" before that.
         const runningClients = dryRun ? [] : detectRunningAiClients();
-        console.log(`${GREEN}${BOLD}Protection is installed and verified.${RESET} This machine reports to your org's AI Fleet in monitor mode — actions are recorded and analyzed while the fleet baselines this machine. An admin can promote it to blocking mode from the console.`);
-        if (runningClients.length > 0) {
+        console.log(`${GREEN}${BOLD}${(0, onboardingSummary_1.onboardingVerificationSummary)({ dryRun, firstHeartbeatOk })}${RESET}`);
+        if (!dryRun && runningClients.length > 0) {
             console.log('');
             console.log(`${YELLOW}${BOLD}  ! ACTION REQUIRED — restart ${runningClients.join(', ')}.${RESET}`);
-            console.log(`${YELLOW}    ${runningClients.length === 1 ? 'This app is' : 'These apps are'} running with the configuration from before onboarding — agent actions inside ${runningClients.length === 1 ? 'it are' : 'them are'} NOT protected until restarted. Anything launched from now on is protected automatically.${RESET}`);
+            console.log(`${YELLOW}    Restart to load the installed integrations, then check reported coverage and a test action in the console.${RESET}`);
         }
-        else {
+        else if (!dryRun) {
             console.log('');
-            console.log(`${YELLOW}${BOLD}  ! One step left:${RESET} ${YELLOW}restart any AI apps that were open during onboarding (Cursor, Claude, VS Code, …) so they load the protected configuration. Apps launched from now on are protected automatically.${RESET}`);
+            console.log(`${YELLOW}${BOLD}  ! One step left:${RESET} ${YELLOW}restart AI apps that were open during onboarding so they load the installed integrations. Check reported coverage and a test action in the console.${RESET}`);
         }
         console.log('');
         console.log(`${DIM}Fleet view: ${dashboard}${RESET}`);

package/dist/commands/onboardingSummary.d.ts

@@ -0,0 +1,5 @@
+/** Describe only the installation and delivery evidence collected by onboard. */
+export declare function onboardingVerificationSummary(input: {
+    dryRun: boolean;
+    firstHeartbeatOk: boolean;
+}): string;

package/dist/commands/onboardingSummary.js

@@ -0,0 +1,11 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.onboardingVerificationSummary = onboardingVerificationSummary;
+/** Describe only the installation and delivery evidence collected by onboard. */
+function onboardingVerificationSummary(input) {
+    if (input.dryRun)
+        return 'Dry-run checks passed. Installation and reporting were not verified.';
+    return 'Installation checks passed. ' + (input.firstHeartbeatOk
+        ? 'The console received the first machine report. Check Policies for this machine’s current enforcement mode.'
+        : 'The first machine report was not delivered. Check the connection and retry; console visibility is not yet confirmed.');
+}

package/dist/commands/protectedRun.d.ts

@@ -0,0 +1,14 @@
+import { BotGuardConfig } from '../config';
+import { VerifiableMachineAction } from '../machineActionVerify';
+import { ProtectionProfile } from '../protectionProfile';
+export declare function verifiedProtectionProfile(envelope: VerifiableMachineAction | null | undefined, machineId: string, shieldId: string): ProtectionProfile;
+export declare function protectedRunCommand(config: BotGuardConfig, command: string | undefined, inspect?: boolean): Promise<void>;
+/** Existing machine Activity receives minimized launch outcome evidence. */
+export declare class ContainedLaunchFailure extends Error {
+    readonly executionStarted: boolean;
+    constructor(message: string, executionStarted: boolean);
+}
+export declare function runProtectedLaunch(profile: ProtectionProfile, command: string, revision: string, launch?: typeof runContainedCommand): Promise<number>;
+export declare function containedExecutionEnvironment(source: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
+/** Runtime adapter, shared with real-process OS acceptance tests. */
+export declare function runContainedCommand(value: ProtectionProfile, command: string): Promise<number>;