fullcourtdefense-cli 1.34.4 → 1.34.6

package/dist/actionPolicyEngine.js

@@ -686,7 +686,7 @@ const PLACEHOLDER_WORD_RE = /example|sample|placeholder|redacted|dummy|changeme|
  * ~ 1 in 62^6 per position. Structural — no vocabulary.
  */
 const REPEATED_CHUNK_RE = /(.{3,})\1{2,}/;
-function isHighEntropySecretToken(token) {
+function isHighEntropySecretToken(token, allowWordSlug = false) {
     if (token.length < 24 || token.length > 512)
         return false;
     // `NAME=value` / `--flag=value` is an assignment expression, not a value: the
@@ -695,7 +695,7 @@ function isHighEntropySecretToken(token) {
     // is a reference; `GITHUB_TOKEN=<40 random chars>` is still a secret).
     const assignment = /^-{0,2}[A-Za-z_][\w.-]*=(.+)$/.exec(token);
     if (assignment)
-        return isHighEntropySecretToken(assignment[1]);
+        return isHighEntropySecretToken(assignment[1], allowWordSlug);
     // Any URI (postgres://, redis://, amqp://, https://…) is configuration; only
     // the password inside its userinfo can be a secret — judged as a value.
     if (/^[a-z][a-z0-9+.-]*:\/\//i.test(token))
@@ -723,6 +723,12 @@ function isHighEntropySecretToken(token) {
         return false; // url / path
     if (/^[a-z]+(?:[A-Z][a-z0-9]+)+$/.test(token) || /^[a-z]+(?:_[a-z0-9]+)+$/.test(token))
         return false; // camelCase / snake_case identifiers
+    // Lowercase word slugs with a numeric suffix are identifiers (for example
+    // a dated customer/run ID). Separators and the suffix alone do not turn
+    // those words into random credential material. Known credential formats
+    // and explicitly named secret assignments are checked before this fallback.
+    if (allowWordSlug && /^[a-z]+(?:-[a-z]+)+(?:-\d+)?$/.test(token))
+        return false;
     let classes = 0;
     if (/[a-z]/.test(token))
         classes++;
@@ -847,7 +853,7 @@ function detectSecretKind(raw) {
         re.lastIndex = 0;
         let m;
         while ((m = re.exec(value)) !== null) {
-            if (isHighEntropySecretToken(m[1].replace(/[\\"'`]+$/, '')))
+            if (isHighEntropySecretToken(m[1].replace(/[\\"'`]+$/, ''), re === GENERIC_VALUE_RE))
                 return 'high_entropy';
         }
     }

package/dist/codexMcpIdentity.d.ts

@@ -1,3 +1,16 @@
+type TomlParse = (text: string) => Record<string, any>;
+/**
+ * Load the TOML parser lazily. The native hook (`nativeHook.js`) is a
+ * fail-open surface in Codex: a hook process that crashes before printing a
+ * verdict is treated by Codex as "no opinion" and the tool call proceeds. A
+ * top-level `import` of a package that is missing from the install (the MSI
+ * ships an explicit node_modules allowlist) therefore disabled EVERY native
+ * hook event. Resolve the parser at first use instead so a missing module
+ * degrades to "no configured server names" while policies still evaluate.
+ */
+export declare function loadTomlParser(): TomlParse | null;
+/** Test seam: force the "parser unavailable" path without uninstalling the package. */
+export declare function __setTomlParserForTests(parser: TomlParse | null | undefined): void;
 /**
  * Name dictionary, not an effective configuration or an authorization source.
  * Include user-owned profiles conservatively: hook payloads do not identify the
@@ -10,3 +23,4 @@ export declare function resolveCodexMcpTool(tool: string, serverNames: string[])
     server: string;
     tool: string;
 } | undefined;
+export {};

package/dist/codexMcpIdentity.js

@@ -33,16 +33,46 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.loadTomlParser = loadTomlParser;
+exports.__setTomlParserForTests = __setTomlParserForTests;
 exports.codexMcpServerNames = codexMcpServerNames;
 exports.resolveCodexMcpTool = resolveCodexMcpTool;
 const fs = __importStar(require("fs"));
 const os = __importStar(require("os"));
 const path = __importStar(require("path"));
-const toml_1 = require("@iarna/toml");
+let tomlParser;
+/**
+ * Load the TOML parser lazily. The native hook (`nativeHook.js`) is a
+ * fail-open surface in Codex: a hook process that crashes before printing a
+ * verdict is treated by Codex as "no opinion" and the tool call proceeds. A
+ * top-level `import` of a package that is missing from the install (the MSI
+ * ships an explicit node_modules allowlist) therefore disabled EVERY native
+ * hook event. Resolve the parser at first use instead so a missing module
+ * degrades to "no configured server names" while policies still evaluate.
+ */
+function loadTomlParser() {
+    if (tomlParser !== undefined)
+        return tomlParser;
+    try {
+        // eslint-disable-next-line @typescript-eslint/no-var-requires
+        tomlParser = require('@iarna/toml').parse;
+    }
+    catch {
+        tomlParser = null;
+    }
+    return tomlParser;
+}
+/** Test seam: force the "parser unavailable" path without uninstalling the package. */
+function __setTomlParserForTests(parser) {
+    tomlParser = parser;
+}
 /** Parse config without executing commands or exposing its contents in errors. */
 function readConfig(file) {
+    const parse = loadTomlParser();
+    if (!parse)
+        return {};
     try {
-        return (0, toml_1.parse)(fs.readFileSync(file, 'utf8').replace(/^\uFEFF/, ''));
+        return parse(fs.readFileSync(file, 'utf8').replace(/^\uFEFF/, ''));
     }
     catch (err) {
         if (err.code === 'ENOENT')

package/dist/commands/mcpGateway.js

@@ -948,6 +948,32 @@ function isBlockError(err) {
 }
 /** How long an MCP elicitation ("Ask the developer" dialog in the client) waits before it counts as declined. */
 const ELICITATION_TIMEOUT_MS = 5 * 60_000;
+/**
+ * The OS dialog is the fallback channel. Same bound as the IDE hook's dialog and
+ * inside every known client's MCP tool-call timeout (Codex `tool_timeout_sec`
+ * defaults to 60s) — a click after the client gave up would be wasted.
+ */
+const OS_DIALOG_TIMEOUT_MS = 60_000;
+/** Human-readable channel label for audit reasons and block explanations. */
+function confirmChannelLabel(answer) {
+    if (answer.channel === 'hook_dialog')
+        return 'FullCourtDefense dialog (IDE hook, same call — not asked twice)';
+    return answer.channel === 'os_dialog' ? 'FullCourtDefense dialog' : 'MCP client prompt';
+}
+function describeDeveloperNo(answer) {
+    const via = confirmChannelLabel(answer);
+    const autoNote = answer.clientAutoAnswered ? ' (the MCP client auto-declined the in-client prompt; the developer was asked in the FullCourtDefense dialog)' : '';
+    if (answer.answer === 'timeout') {
+        return {
+            reason: `developer confirmation not given (${via} timed out)${autoNote}`,
+            explanation: 'You did not answer the confirmation prompt in time',
+        };
+    }
+    return {
+        reason: `developer declined in ${via}${autoNote}`,
+        explanation: 'You declined the confirmation prompt',
+    };
+}
 class McpGatewayServer {
     gatewayConfig;
     downstreamSpec;
@@ -1222,10 +1248,11 @@ class McpGatewayServer {
                 process.stderr.write(`FullCourtDefense warning (${warning.itemId}): ${warning.reason}\n`);
             }
             // "Ask the developer" rule with no hard block on the same call: ask the
-            // human through the MCP client (elicitation) when the client can show a
-            // dialog and a human is present. Session memory reuses the IDE hook's
-            // ledger (same tool + rule => remembered). Decline, cancel, timeout, a
-            // client without elicitation, or no human => block, never a silent allow.
+            // human — through the MCP client (elicitation) when it can show a dialog,
+            // otherwise (or when the client answers for the user) through the OS
+            // dialog — whenever a human is present. Session memory reuses the IDE
+            // hook's ledger (same tool + rule => remembered). Decline, cancel, timeout
+            // or no human => block, never a silent allow.
             let localBlock = requestOutcome.blockingFinding || requestOutcome.askFinding;
             let askNote = '';
             if (!requestOutcome.blockingFinding && requestOutcome.askFinding && !reportOnlyMode) {
@@ -1245,7 +1272,7 @@ class McpGatewayServer {
                     (0, telemetry_1.triggerFlush)(false);
                     localBlock = undefined;
                 }
-                else if (this.clientSupportsElicitation && (0, devConfirm_1.isHumanPresent)()) {
+                else if ((0, devConfirm_1.isHumanPresent)()) {
                     const digest = (0, devConfirm_1.actionDigest)(toolArgs);
                     const marker = (0, devConfirm_1.raiseDeveloperConfirmation)({
                         event: 'mcp_gateway', toolName, operation: rememberScope.operation, argsDigest: digest,
@@ -1253,7 +1280,7 @@ class McpGatewayServer {
                         sessionId, remember: 'none',
                     });
                     process.stderr.write(`FullCourtDefense asking the developer to confirm ${toolName}: ${ask.reason} (${origin} "${ask.itemId}", ${ask.ruleId})\n`);
-                    const answer = await this.elicitDeveloperConfirmation({ toolName, reason: ask.reason, ruleLabel: `${origin} "${ask.itemId}" (${ask.ruleId})`, evidence: ask.evidence });
+                    const answer = await this.confirmWithDeveloper({ toolName, reason: ask.reason, ruleLabel: `${origin} "${ask.itemId}" (${ask.ruleId})`, evidence: ask.evidence, argsDigest: digest });
                     if (answer.answer === 'accept') {
                         // Settle through the shared ledger so "remember for this session" is
                         // recorded exactly like an IDE approval would be.
@@ -1262,7 +1289,7 @@ class McpGatewayServer {
                         (0, devConfirm_1.settleDeveloperConfirmation)('mcp_gateway', toolName, digest);
                         (0, telemetry_1.spoolEvent)({
                             decision: 'allow', toolName, operation: rememberScope.operation,
-                            reason: `developer confirmed in MCP client prompt${answer.remember ? ' (remembered for this session)' : ''} — ${ask.reason}`,
+                            reason: `developer confirmed in ${confirmChannelLabel(answer)}${answer.remember ? ' (remembered for this session)' : ''}${answer.clientAutoAnswered ? ' (the MCP client auto-declined the in-client prompt)' : ''} — ${ask.reason}`,
                             ruleId: ask.ruleId, category: ask.category, categoryId: ask.categoryId, itemId: ask.itemId, source: ask.source,
                             evidence: ask.evidence, policyHash: ask.policyHash, offlineEnforced: true,
                             approvalScope: 'developer', approvedBy: 'developer', confirmLatencyMs: answer.latencyMs,
@@ -1272,22 +1299,20 @@ class McpGatewayServer {
                     }
                     else {
                         (0, devConfirm_1.rejectDeveloperConfirmation)('mcp_gateway', toolName, digest);
-                        const how = answer.answer === 'timeout' ? 'developer confirmation not given (prompt timed out)' : 'developer declined in MCP client prompt';
+                        const no = describeDeveloperNo(answer);
                         (0, telemetry_1.spoolEvent)({
                             decision: 'block', toolName, operation: rememberScope.operation,
-                            reason: `${how} — ${ask.reason}`,
+                            reason: `${no.reason} — ${ask.reason}`,
                             ruleId: ask.ruleId, category: ask.category, categoryId: ask.categoryId, itemId: ask.itemId, source: ask.source,
                             evidence: ask.evidence, policyHash: ask.policyHash, offlineEnforced: true,
                             approvalScope: 'developer', confirmLatencyMs: answer.latencyMs,
                         });
                         (0, telemetry_1.triggerFlush)(true);
-                        throw blockError(explainGatewayLocalSafety('block', toolName, toolArgs, ask, `${answer.answer === 'timeout' ? 'You did not answer the confirmation prompt in time' : 'You declined the confirmation prompt'}, so this tool call was not executed.`));
+                        throw blockError(explainGatewayLocalSafety('block', toolName, toolArgs, ask, `${no.explanation}, so this tool call was not executed.`));
                     }
                 }
                 else {
-                    askNote = this.clientSupportsElicitation
-                        ? ' This rule asks the developer to confirm, but no human is present on this machine (CI / ephemeral workload), so it blocks here.'
-                        : ' This rule asks the developer to confirm; this MCP client cannot show a confirmation dialog (no elicitation support), so it blocks here (the IDE hook can ask).';
+                    askNote = ' This rule asks the developer to confirm, but no human is present on this machine (CI / ephemeral workload), so it blocks here.';
                 }
             }
             if (localBlock) {
@@ -1836,8 +1861,10 @@ class McpGatewayServer {
      * throws the block error when the developer declines or does not answer.
      */
     async askDeveloperForPolicy(toolName, toolArgs, operation, verdict, policies) {
-        if (!this.clientSupportsElicitation) {
-            const reason = 'This rule requires developer confirmation inside the IDE, but this MCP client does not support confirmation prompts. The action was not executed. Update or reconnect the IDE integration.';
+        if (!(0, devConfirm_1.isHumanPresent)()) {
+            // The engine normally degrades developer scope to org where no human exists;
+            // this is the belt for a rule that still reached us with developer scope.
+            const reason = 'This rule requires developer confirmation, but no human is present on this machine (CI / ephemeral workload). The action was not executed.';
             (0, telemetry_1.spoolEvent)({ decision: 'block', toolName, operation, reason, approvalScope: 'developer', ruleId: verdict.policyId });
             (0, telemetry_1.triggerFlush)(true);
             throw blockError(reason);
@@ -1865,7 +1892,7 @@ class McpGatewayServer {
         });
         (0, telemetry_1.spoolEvent)({
             decision: 'approval', toolName, operation,
-            reason: `developer confirmation requested via MCP client prompt${policyLabel}${verdict.reason ? `: ${verdict.reason}` : ''}`,
+            reason: `developer confirmation requested via ${this.clientSupportsElicitation ? 'MCP client prompt' : 'FullCourtDefense dialog'}${policyLabel}${verdict.reason ? `: ${verdict.reason}` : ''}`,
             ruleId, offlineEnforced: true, approvalScope: 'developer',
         });
         (0, telemetry_1.triggerFlush)(false);
@@ -1873,32 +1900,70 @@ class McpGatewayServer {
             ? ' This policy is set to Block; on a developer workstation it asks you instead. An admin can mark it "Hard block" in the console to stop this without asking.'
             : '';
         process.stderr.write(`FullCourtDefense asking the developer to confirm ${toolName}${policyLabel}: ${verdict.reason || verdict.matchedRule || 'action policy'}\n`);
-        const answer = await this.elicitDeveloperConfirmation({
+        const answer = await this.confirmWithDeveloper({
             toolName,
             reason: `${verdict.reason || `${toolName} needs your confirmation`}.${ceiling}`,
             allowRemember: false,
             ruleLabel: verdict.policyName ? `Action Policy "${verdict.policyName}"${verdict.matchedRule ? ` — ${verdict.matchedRule}` : ''}` : 'Action Policy',
+            argsDigest: digest,
         });
         if (answer.answer === 'accept') {
             // Policy memory limits are authoritative; a client cannot upgrade 'none'.
             (0, devConfirm_1.settleDeveloperConfirmation)('mcp_gateway', toolName, digest);
             (0, telemetry_1.spoolEvent)({
                 decision: 'allow', toolName, operation,
-                reason: `developer confirmed in MCP client prompt${answer.remember ? ' (remembered for this session)' : ''}${policyLabel}`,
+                reason: `developer confirmed in ${confirmChannelLabel(answer)}${answer.remember ? ' (remembered for this session)' : ''}${answer.clientAutoAnswered ? ' (the MCP client auto-declined the in-client prompt)' : ''}${policyLabel}`,
                 ruleId, offlineEnforced: true, approvalScope: 'developer', approvedBy: 'developer', confirmLatencyMs: answer.latencyMs,
             });
             (0, telemetry_1.triggerFlush)(false);
             return true;
         }
         (0, devConfirm_1.rejectDeveloperConfirmation)('mcp_gateway', toolName, digest);
-        const how = answer.answer === 'timeout' ? 'developer confirmation not given (prompt timed out)' : 'developer declined in MCP client prompt';
+        const no = describeDeveloperNo(answer);
         (0, telemetry_1.spoolEvent)({
             decision: 'block', toolName, operation,
-            reason: `${how}${policyLabel}`,
+            reason: `${no.reason}${policyLabel}`,
             ruleId, offlineEnforced: true, approvalScope: 'developer', confirmLatencyMs: answer.latencyMs,
         });
         (0, telemetry_1.triggerFlush)(true);
-        throw blockError(explainGatewayPolicy('block', toolName, toolArgs, verdict, policies, `${answer.answer === 'timeout' ? 'You did not answer the confirmation prompt in time' : 'You declined the confirmation prompt'}, so this tool call was not executed.`));
+        throw blockError(explainGatewayPolicy('block', toolName, toolArgs, verdict, policies, `${no.explanation}, so this tool call was not executed.`));
+    }
+    /**
+     * "Ask the developer" that works in every MCP client. Order:
+     *   1. no human on this machine            => unavailable (caller blocks)
+     *   2. client advertises elicitation       => in-client prompt
+     *        accept / human-speed decline / timeout => that IS the developer's answer
+     *        decline faster than a human can read (the client answered for the
+     *        user — Codex Desktop "Full access" declines every elicitation without
+     *        showing it) or an error response => fall through to 3
+     *   3. OS-owned dialog (PowerShell popup / osascript / zenity)
+     * Every path that is not an explicit "yes" from a human ends in a block.
+     */
+    async confirmWithDeveloper(input) {
+        if (!(0, devConfirm_1.isHumanPresent)())
+            return { answer: 'unavailable', remember: false, latencyMs: 0, clientAutoAnswered: false };
+        // 0. The IDE hook already showed the OS dialog for THIS call (same tool, same
+        //    args) and the developer clicked "Allow once" moments ago.
+        const handoff = input.argsDigest ? (0, devConfirm_1.consumeConfirmedAction)(input.toolName, input.argsDigest) : undefined;
+        if (handoff) {
+            return { answer: 'accept', remember: false, latencyMs: Math.max(0, Date.now() - Date.parse(handoff.confirmedAt)), channel: 'hook_dialog', clientAutoAnswered: false };
+        }
+        let clientAutoAnswered = false;
+        if (this.clientSupportsElicitation) {
+            const viaClient = await this.elicitDeveloperConfirmation(input);
+            const automated = viaClient.clientError || (0, devConfirm_1.looksLikeClientAutoAnswer)(viaClient.answer, viaClient.latencyMs);
+            if (!automated)
+                return { ...viaClient, channel: 'mcp_client', clientAutoAnswered: false };
+            clientAutoAnswered = true;
+            process.stderr.write(`FullCourtDefense: the MCP client answered the confirmation prompt for ${input.toolName} by itself in ${viaClient.latencyMs}ms (no dialog reached the developer — e.g. Codex "Full access"); asking in the FullCourtDefense dialog instead.\n`);
+        }
+        const started = Date.now();
+        const evidence = input.evidence ? `\nEvidence: ${input.evidence.slice(0, 240)}` : '';
+        const allowed = await (0, devConfirm_1.confirmNativeAction)(`Agent: ${this.gatewayConfig.agentName}\nIDE: ${this.gatewayConfig.agentClient}\nDeveloper: ${this.gatewayConfig.developerName || 'Unknown'}\nTool: ${input.toolName}\nRule: ${input.ruleLabel}\nWhy: ${input.reason}${evidence}\n\nYour answer is reported to your security dashboard as your decision.`, OS_DIALOG_TIMEOUT_MS);
+        const latencyMs = Date.now() - started;
+        // The dialog cannot tell "Deny" from "closed / timed out" — both are a no.
+        const timedOut = !allowed && latencyMs >= OS_DIALOG_TIMEOUT_MS - 500;
+        return { answer: allowed ? 'accept' : timedOut ? 'timeout' : 'decline', remember: false, latencyMs, channel: 'os_dialog', clientAutoAnswered };
     }
     async elicitDeveloperConfirmation(input) {
         const started = Date.now();
@@ -1927,6 +1992,10 @@ class McpGatewayServer {
         const latencyMs = Date.now() - started;
         if (!response)
             return { answer: 'timeout', remember: false, latencyMs };
+        // A JSON-RPC error ("method not found", "not supported in this mode") means no
+        // dialog was shown: the client could not ask, it did not get a "no".
+        if (response.error)
+            return { answer: 'decline', remember: false, latencyMs, clientError: true };
         const result = (response.result && typeof response.result === 'object') ? response.result : undefined;
         const content = (result?.content && typeof result.content === 'object') ? result.content : undefined;
         if (result?.action === 'accept' && content?.confirm === true) {

package/dist/devConfirm.d.ts

@@ -1,4 +1,24 @@
 export type ConfirmRemember = 'none' | 'session' | '1h';
+/**
+ * Fastest plausible HUMAN answer to a confirmation prompt. A person has to notice
+ * the dialog, read at least the tool name and press a button; MCP clients that
+ * answer an `elicitation/create` for the user (Codex Desktop in "Full access" —
+ * `approval_policy = never` — declines every elicitation without rendering it)
+ * respond in tens of milliseconds. A decline below this bound is treated as the
+ * CLIENT's answer, not the developer's, and the question is re-asked through the
+ * OS dialog. Accepts are never re-asked; a fast accept only ever costs a prompt.
+ */
+export declare const MIN_HUMAN_ANSWER_MS = 1000;
+/** True when a negative elicitation answer arrived faster than a human can read the prompt. */
+export declare function looksLikeClientAutoAnswer(answer: 'accept' | 'decline' | 'timeout', latencyMs: number): boolean;
+/**
+ * OS-owned confirmation dialog — the IDE-independent fallback for "Ask the developer".
+ * PowerShell `WScript.Shell.Popup` on Windows, `osascript` on macOS, `zenity` elsewhere.
+ * The agent cannot answer it: it is not connected to hook stdin, the MCP stream or the
+ * agent's terminal. Resolves `true` only for an explicit "Allow once"; decline, close,
+ * timeout, a missing dialog binary or no human present all resolve `false`.
+ */
+export declare function confirmNativeAction(reason: string, timeoutMs?: number): Promise<boolean>;
 export interface PendingConfirmation {
     /** Stable key: sha256(event|toolName|argsDigest). */
     key: string;
@@ -32,8 +52,23 @@ export interface RememberedConfirmation {
     confirmedAt: string;
     expiresAt: string;
 }
+/**
+ * An explicit "Allow once" a human clicked in the OS dialog raised by the IDE hook for one
+ * exact action (tool + args digest). The MCP gateway that receives the same call a moment
+ * later consumes it instead of asking a second time. Single-use, short-lived, exact-match.
+ */
+export interface ConfirmedAction {
+    /** sha256(bareToolName|argsDigest). */
+    key: string;
+    toolName: string;
+    argsDigest: string;
+    confirmedAt: string;
+    expiresAt: string;
+}
 /** A raised confirmation that received no post-execution signal in time counts as not approved. */
 export declare const CONFIRM_PENDING_TTL_MS: number;
+/** The hook's dialog answer only carries over to the gateway call it was given for. */
+export declare const CONFIRMED_ACTION_TTL_MS: number;
 /** CI / pipeline environments — no human at a keyboard. Shared by hooks and discovery. */
 export declare function isCiEnvironment(env?: NodeJS.ProcessEnv): boolean;
 /**
@@ -49,6 +84,19 @@ export declare function isHumanPresent(env?: NodeJS.ProcessEnv): boolean;
  */
 export declare function actionDigest(toolArgs: Record<string, unknown>): string;
 export declare function pendingKey(event: string, toolName: string, argsDigest: string): string;
+/**
+ * The tool name as the MCP server sees it. The IDE hook names an MCP call
+ * `mcp__<server>__<tool>` (Codex/Claude) or `<server>/<tool>`; the gateway sees `<tool>`.
+ */
+export declare function bareToolName(toolName: string): string;
+/** The IDE hook's OS dialog got an explicit "Allow once" for this exact action. */
+export declare function recordConfirmedAction(toolName: string, argsDigest: string, now?: Date): ConfirmedAction;
+/**
+ * Take (and remove) a still-valid hook-dialog approval for this exact action, so the
+ * gateway does not ask the human twice for one tool call. Never matches a different
+ * tool, different arguments, an expired entry, or the same entry twice.
+ */
+export declare function consumeConfirmedAction(toolName: string, argsDigest: string, now?: Date): ConfirmedAction | undefined;
 export interface RememberScope {
     toolName: string;
     operation: string;

package/dist/devConfirm.js

@@ -33,11 +33,16 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.CONFIRM_PENDING_TTL_MS = void 0;
+exports.CONFIRMED_ACTION_TTL_MS = exports.CONFIRM_PENDING_TTL_MS = exports.MIN_HUMAN_ANSWER_MS = void 0;
+exports.looksLikeClientAutoAnswer = looksLikeClientAutoAnswer;
+exports.confirmNativeAction = confirmNativeAction;
 exports.isCiEnvironment = isCiEnvironment;
 exports.isHumanPresent = isHumanPresent;
 exports.actionDigest = actionDigest;
 exports.pendingKey = pendingKey;
+exports.bareToolName = bareToolName;
+exports.recordConfirmedAction = recordConfirmedAction;
+exports.consumeConfirmedAction = consumeConfirmedAction;
 exports.raiseDeveloperConfirmation = raiseDeveloperConfirmation;
 exports.settleDeveloperConfirmation = settleDeveloperConfirmation;
 exports.rejectDeveloperConfirmation = rejectDeveloperConfirmation;
@@ -66,10 +71,72 @@ exports.isConfirmationRemembered = isConfirmationRemembered;
  * containers and cloud coding agents set CI-style env vars or FCD_EPHEMERAL; there the engine's
  * `effectiveApprovalScope` degrades to `org` and none of this runs.
  */
+const child_process_1 = require("child_process");
 const crypto = __importStar(require("crypto"));
 const fs = __importStar(require("fs"));
 const os = __importStar(require("os"));
 const path = __importStar(require("path"));
+/**
+ * Fastest plausible HUMAN answer to a confirmation prompt. A person has to notice
+ * the dialog, read at least the tool name and press a button; MCP clients that
+ * answer an `elicitation/create` for the user (Codex Desktop in "Full access" —
+ * `approval_policy = never` — declines every elicitation without rendering it)
+ * respond in tens of milliseconds. A decline below this bound is treated as the
+ * CLIENT's answer, not the developer's, and the question is re-asked through the
+ * OS dialog. Accepts are never re-asked; a fast accept only ever costs a prompt.
+ */
+exports.MIN_HUMAN_ANSWER_MS = 1000;
+/** True when a negative elicitation answer arrived faster than a human can read the prompt. */
+function looksLikeClientAutoAnswer(answer, latencyMs) {
+    return answer === 'decline' && latencyMs < exports.MIN_HUMAN_ANSWER_MS;
+}
+/**
+ * OS-owned confirmation dialog — the IDE-independent fallback for "Ask the developer".
+ * PowerShell `WScript.Shell.Popup` on Windows, `osascript` on macOS, `zenity` elsewhere.
+ * The agent cannot answer it: it is not connected to hook stdin, the MCP stream or the
+ * agent's terminal. Resolves `true` only for an explicit "Allow once"; decline, close,
+ * timeout, a missing dialog binary or no human present all resolve `false`.
+ */
+async function confirmNativeAction(reason, timeoutMs = 60_000) {
+    if (!isHumanPresent())
+        return false;
+    let executable;
+    let args;
+    const message = `FullCourtDefense — developer approval\n\n${reason.slice(0, 1800)}\n\nAllow this action once?`;
+    const timeoutSeconds = Math.max(1, Math.ceil(timeoutMs / 1000));
+    if (process.platform === 'win32') {
+        executable = 'powershell.exe';
+        const encoded = Buffer.from(message, 'utf8').toString('base64');
+        // 292 = Yes/No + question icon + "No" default; +4096 (MB_SYSTEMMODAL) keeps the
+        // popup above the IDE window that triggered it, so a fallback ask is never
+        // hidden behind Codex/Cursor and silently timed out.
+        const script = `$msg=[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('${encoded}')); $w=New-Object -ComObject WScript.Shell; $answer=$w.Popup($msg,${timeoutSeconds},'FullCourtDefense',4388); if($answer -eq 6){exit 0}else{exit 1}`;
+        args = ['-NoProfile', '-NonInteractive', '-EncodedCommand', Buffer.from(script, 'utf16le').toString('base64')];
+    }
+    else if (process.platform === 'darwin') {
+        executable = '/usr/bin/osascript';
+        args = ['-e', 'on run argv', '-e', `display dialog (item 1 of argv) buttons {"Deny", "Allow once"} default button "Deny" giving up after ${timeoutSeconds}`, '-e', 'if gave up of result or button returned of result is not "Allow once" then error number -128', '-e', 'end run', message];
+    }
+    else {
+        executable = 'zenity';
+        args = ['--question', '--default-cancel', '--title=FullCourtDefense', `--text=${message}`, '--ok-label=Allow once', '--cancel-label=Deny', `--timeout=${timeoutSeconds}`];
+    }
+    return new Promise(resolve => {
+        let finished = false;
+        const child = (0, child_process_1.spawn)(executable, args, { stdio: 'ignore', windowsHide: true });
+        const cancelChild = () => child.kill();
+        process.once('exit', cancelChild);
+        const done = (allowed) => { if (!finished) {
+            finished = true;
+            clearTimeout(timer);
+            process.removeListener('exit', cancelChild);
+            resolve(allowed);
+        } };
+        const timer = setTimeout(() => { child.kill(); done(false); }, timeoutMs + 1000);
+        child.on('error', () => done(false));
+        child.on('exit', code => done(code === 0));
+    });
+}
 /** A raised confirmation that received no post-execution signal in time counts as not approved. */
 exports.CONFIRM_PENDING_TTL_MS = 10 * 60_000;
 const REMEMBER_1H_MS = 60 * 60_000;
@@ -77,6 +144,9 @@ const REMEMBER_1H_MS = 60 * 60_000;
 const REMEMBER_SESSION_MAX_MS = 12 * 60 * 60_000;
 const MAX_PENDING = 50;
 const MAX_REMEMBERED = 200;
+/** The hook's dialog answer only carries over to the gateway call it was given for. */
+exports.CONFIRMED_ACTION_TTL_MS = 2 * 60_000;
+const MAX_CONFIRMED_ACTIONS = 50;
 /** CI / pipeline environments — no human at a keyboard. Shared by hooks and discovery. */
 function isCiEnvironment(env = process.env) {
     return env.GITHUB_ACTIONS === 'true'
@@ -109,10 +179,11 @@ function readLedger() {
             pending: Array.isArray(parsed?.pending) ? parsed.pending.filter((p) => p && typeof p === 'object') : [],
             // Older ledgers could remember declines. Require fresh affirmative consent.
             remembered: parsed?.formatVersion === 2 && Array.isArray(parsed?.remembered) ? parsed.remembered.filter((r) => r && typeof r === 'object') : [],
+            confirmedActions: Array.isArray(parsed?.confirmedActions) ? parsed.confirmedActions.filter((c) => c && typeof c === 'object') : [],
         };
     }
     catch {
-        return { pending: [], remembered: [] };
+        return { pending: [], remembered: [], confirmedActions: [] };
     }
 }
 function writeLedger(ledger) {
@@ -157,6 +228,60 @@ function actionDigest(toolArgs) {
 function pendingKey(event, toolName, argsDigest) {
     return sha256(`${event}|${toolName.toLowerCase()}|${argsDigest}`);
 }
+/**
+ * The tool name as the MCP server sees it. The IDE hook names an MCP call
+ * `mcp__<server>__<tool>` (Codex/Claude) or `<server>/<tool>`; the gateway sees `<tool>`.
+ */
+function bareToolName(toolName) {
+    let name = toolName.trim();
+    if (name.startsWith('mcp__')) {
+        const rest = name.slice('mcp__'.length);
+        const idx = rest.indexOf('__');
+        name = idx >= 0 ? rest.slice(idx + 2) : rest;
+    }
+    else if (name.includes('/')) {
+        name = name.slice(name.lastIndexOf('/') + 1);
+    }
+    return name.toLowerCase();
+}
+function confirmedActionKey(toolName, argsDigest) {
+    return sha256(`confirmed|${bareToolName(toolName)}|${argsDigest}`);
+}
+/** The IDE hook's OS dialog got an explicit "Allow once" for this exact action. */
+function recordConfirmedAction(toolName, argsDigest, now = new Date()) {
+    const entry = {
+        key: confirmedActionKey(toolName, argsDigest),
+        toolName: bareToolName(toolName),
+        argsDigest,
+        confirmedAt: now.toISOString(),
+        expiresAt: new Date(now.getTime() + exports.CONFIRMED_ACTION_TTL_MS).toISOString(),
+    };
+    const ledger = readLedger();
+    ledger.confirmedActions = ledger.confirmedActions.filter(c => c.key !== entry.key && Date.parse(c.expiresAt) > now.getTime());
+    ledger.confirmedActions.push(entry);
+    if (ledger.confirmedActions.length > MAX_CONFIRMED_ACTIONS)
+        ledger.confirmedActions = ledger.confirmedActions.slice(-MAX_CONFIRMED_ACTIONS);
+    writeLedger(ledger);
+    return entry;
+}
+/**
+ * Take (and remove) a still-valid hook-dialog approval for this exact action, so the
+ * gateway does not ask the human twice for one tool call. Never matches a different
+ * tool, different arguments, an expired entry, or the same entry twice.
+ */
+function consumeConfirmedAction(toolName, argsDigest, now = new Date()) {
+    const ledger = readLedger();
+    const key = confirmedActionKey(toolName, argsDigest);
+    const hit = ledger.confirmedActions.find(c => c.key === key);
+    const live = ledger.confirmedActions.filter(c => Number.isFinite(Date.parse(c.expiresAt)) && Date.parse(c.expiresAt) > now.getTime());
+    const valid = hit && live.includes(hit) ? hit : undefined;
+    const next = live.filter(c => c !== valid);
+    if (next.length !== ledger.confirmedActions.length) {
+        ledger.confirmedActions = next;
+        writeLedger(ledger);
+    }
+    return valid;
+}
 function rememberKey(scope) {
     const rule = scope.policyId ? `${scope.policyId}|${scope.matchedRule || ''}` : `op:${scope.operation.toLowerCase()}`;
     return sha256(`${scope.toolName.toLowerCase()}|${rule}`);
@@ -227,9 +352,11 @@ function sweepExpiredConfirmations(now = new Date(), ttlMs = exports.CONFIRM_PEN
     const cutoff = now.getTime() - ttlMs;
     const expired = ledger.pending.filter(p => Date.parse(p.raisedAt) < cutoff);
     const remembered = ledger.remembered.filter(r => Date.parse(r.expiresAt) > now.getTime());
-    if (expired.length > 0 || remembered.length !== ledger.remembered.length) {
+    const confirmedActions = ledger.confirmedActions.filter(c => Date.parse(c.expiresAt) > now.getTime());
+    if (expired.length > 0 || remembered.length !== ledger.remembered.length || confirmedActions.length !== ledger.confirmedActions.length) {
         ledger.pending = ledger.pending.filter(p => Date.parse(p.raisedAt) >= cutoff);
         ledger.remembered = remembered;
+        ledger.confirmedActions = confirmedActions;
         writeLedger(ledger);
     }
     return expired;

package/dist/nativeHook.d.ts

@@ -1,5 +1,7 @@
+/** Native hook adapters. Never emit an unsupported `ask` to an IDE. */
 import { HookArgs } from './commands/hook';
 import { BotGuardConfig } from './config';
+import { confirmNativeAction } from './devConfirm';
 export type NativeClient = 'codex' | 'gemini_cli' | 'windsurf' | 'kiro';
 type Payload = Record<string, any>;
 export declare const NATIVE_CLIENTS: NativeClient[];
@@ -15,11 +17,13 @@ export declare function nativeErrorVerdict(client: NativeClient, reason: string)
     stderr: string;
     exitCode: number;
 };
-/** OS-owned dialog: an agent cannot approve by writing `yes` to hook stdin. */
-export declare function confirmNativeAction(reason: string, timeoutMs?: number): Promise<boolean>;
+/**
+ * OS-owned dialog (shared with the MCP gateway; lives in devConfirm.ts): an agent
+ * cannot approve by writing `yes` to hook stdin. Re-exported for existing callers.
+ */
+export { confirmNativeAction };
 export declare function evaluateNativeHook(client: NativeClient, raw: Payload, args: HookArgs, config: BotGuardConfig, confirm?: (reason: string) => Promise<boolean>): Promise<{
     stdout: string;
     stderr: string;
     exitCode: number;
 }>;
-export {};

package/dist/nativeHook.js

@@ -1,19 +1,18 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.NATIVE_CLIENTS = void 0;
+exports.confirmNativeAction = exports.NATIVE_CLIENTS = void 0;
 exports.patchToolCalls = patchToolCalls;
 exports.normalizeNativeInput = normalizeNativeInput;
 exports.nativeVerdict = nativeVerdict;
 exports.nativeErrorVerdict = nativeErrorVerdict;
-exports.confirmNativeAction = confirmNativeAction;
 exports.evaluateNativeHook = evaluateNativeHook;
 /** Native hook adapters. Never emit an unsupported `ask` to an IDE. */
-const child_process_1 = require("child_process");
 const hook_1 = require("./commands/hook");
 const config_1 = require("./config");
 const runtimeConfig_1 = require("./runtimeConfig");
 const hookIo_1 = require("./hookIo");
 const devConfirm_1 = require("./devConfirm");
+Object.defineProperty(exports, "confirmNativeAction", { enumerable: true, get: function () { return devConfirm_1.confirmNativeAction; } });
 const telemetry_1 = require("./telemetry");
 const codexMcpIdentity_1 = require("./codexMcpIdentity");
 exports.NATIVE_CLIENTS = ['codex', 'gemini_cli', 'windsurf', 'kiro'];
@@ -111,44 +110,7 @@ function nativeErrorVerdict(client, reason) {
         return { stdout: JSON.stringify({ decision: 'block', reason }), stderr: '', exitCode: 0 };
     return nativeVerdict(client, true, reason);
 }
-/** OS-owned dialog: an agent cannot approve by writing `yes` to hook stdin. */
-async function confirmNativeAction(reason, timeoutMs = 60_000) {
-    if (!(0, devConfirm_1.isHumanPresent)())
-        return false;
-    let executable;
-    let args;
-    const message = `FullCourtDefense — developer approval\n\n${reason.slice(0, 1800)}\n\nAllow this action once?`;
-    if (process.platform === 'win32') {
-        executable = 'powershell.exe';
-        const encoded = Buffer.from(message, 'utf8').toString('base64');
-        const script = `$msg=[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('${encoded}')); $w=New-Object -ComObject WScript.Shell; $answer=$w.Popup($msg,${Math.ceil(timeoutMs / 1000)},'FullCourtDefense',292); if($answer -eq 6){exit 0}else{exit 1}`;
-        args = ['-NoProfile', '-NonInteractive', '-EncodedCommand', Buffer.from(script, 'utf16le').toString('base64')];
-    }
-    else if (process.platform === 'darwin') {
-        executable = '/usr/bin/osascript';
-        args = ['-e', 'on run argv', '-e', 'display dialog (item 1 of argv) buttons {"Deny", "Allow once"} default button "Deny" giving up after 60', '-e', 'if gave up of result or button returned of result is not "Allow once" then error number -128', '-e', 'end run', message];
-    }
-    else {
-        executable = 'zenity';
-        args = ['--question', '--default-cancel', '--title=FullCourtDefense', `--text=${message}`, '--ok-label=Allow once', '--cancel-label=Deny', `--timeout=${Math.ceil(timeoutMs / 1000)}`];
-    }
-    return new Promise(resolve => {
-        let finished = false;
-        const child = (0, child_process_1.spawn)(executable, args, { stdio: 'ignore', windowsHide: true });
-        const cancelChild = () => child.kill();
-        process.once('exit', cancelChild);
-        const done = (allowed) => { if (!finished) {
-            finished = true;
-            clearTimeout(timer);
-            process.removeListener('exit', cancelChild);
-            resolve(allowed);
-        } };
-        const timer = setTimeout(() => { child.kill(); done(false); }, timeoutMs + 1000);
-        child.on('error', () => done(false));
-        child.on('exit', code => done(code === 0));
-    });
-}
-async function evaluateNativeHook(client, raw, args, config, confirm = confirmNativeAction) {
+async function evaluateNativeHook(client, raw, args, config, confirm = devConfirm_1.confirmNativeAction) {
     if (client === 'codex' && raw.tool_name === 'apply_patch') {
         try {
             // Evaluate every file operation before Codex executes the atomic patch.
@@ -165,8 +127,13 @@ async function evaluateNativeHook(client, raw, args, config, confirm = confirmNa
         }
     }
     let payload;
+    const resolveCodexIdentity = client === 'codex' && String(raw.tool_name || '').startsWith('mcp__');
+    if (resolveCodexIdentity && !(0, codexMcpIdentity_1.loadTomlParser)()) {
+        // Degraded, never dead: policies still evaluate on the sanitized tool name.
+        process.stderr.write('FullCourtDefense: TOML parser unavailable in this install; Codex MCP server identity falls back to the sanitized tool name.\n');
+    }
     try {
-        payload = normalizeNativeInput(client, raw, client === 'codex' && String(raw.tool_name || '').startsWith('mcp__') ? (0, codexMcpIdentity_1.codexMcpServerNames)() : []);
+        payload = normalizeNativeInput(client, raw, resolveCodexIdentity ? (0, codexMcpIdentity_1.codexMcpServerNames)() : []);
     }
     catch (error) {
         return nativeErrorVerdict(client, `FullCourtDefense could not parse the hook: ${String(error)}`);
@@ -197,6 +164,10 @@ async function evaluateNativeHook(client, raw, args, config, confirm = confirmNa
             }
             catch { /* deny */ }
             denied = !allowed;
+            // Hand the click to the MCP gateway that will see this exact call next, so the
+            // developer is not asked twice for one action (single-use, 2-minute, exact digest).
+            if (allowed && call && mapped?.event === 'mcp')
+                (0, devConfirm_1.recordConfirmedAction)(call.toolName, (0, devConfirm_1.actionDigest)(call.toolArgs));
             (0, telemetry_1.spoolEvent)({ decision: allowed ? 'allow' : 'block', toolName: call?.toolName || payload.tool_name,
                 reason: allowed ? 'Developer approved once in the FullCourtDefense dialog.' : 'Developer declined, confirmation unavailable, or timed out.',
                 approvalScope: 'developer', ...(allowed ? { approvedBy: 'developer' } : {}) });

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.34.4"
+  "version": "1.34.6"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.34.4",
+  "version": "1.34.6",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {
@@ -94,8 +94,9 @@
     "test:agent-ci-gate": "npm run build && node scripts/test-agent-ci-gate.js",
     "test:ide-fp-corpus": "npm run build && node scripts/test-ide-fp-corpus.js",
     "test:ide-fp-corpus:hook": "npm run build && node scripts/test-ide-fp-corpus.js --hook",
+    "test:msi-payload-deps": "npm run build && node scripts/test-msi-payload-deps.js",
     "build:msi": "powershell -NoProfile -ExecutionPolicy Bypass -File installer/windows/Build-Msi.ps1",
-    "prepublishOnly": "npm run build && node scripts/test-shell-parity.js && node scripts/test-terminal-mcp-ask.js"
+    "prepublishOnly": "npm run build && node scripts/test-msi-payload-deps.js && node scripts/test-shell-parity.js && node scripts/test-terminal-mcp-ask.js"
   },
   "keywords": [
     "llm",