fullcourtdefense-cli 1.34.5 → 1.34.7

package/dist/codexMcpIdentity.d.ts

@@ -1,3 +1,16 @@
+type TomlParse = (text: string) => Record<string, any>;
+/**
+ * Load the TOML parser lazily. The native hook (`nativeHook.js`) is a
+ * fail-open surface in Codex: a hook process that crashes before printing a
+ * verdict is treated by Codex as "no opinion" and the tool call proceeds. A
+ * top-level `import` of a package that is missing from the install (the MSI
+ * ships an explicit node_modules allowlist) therefore disabled EVERY native
+ * hook event. Resolve the parser at first use instead so a missing module
+ * degrades to "no configured server names" while policies still evaluate.
+ */
+export declare function loadTomlParser(): TomlParse | null;
+/** Test seam: force the "parser unavailable" path without uninstalling the package. */
+export declare function __setTomlParserForTests(parser: TomlParse | null | undefined): void;
 /**
  * Name dictionary, not an effective configuration or an authorization source.
  * Include user-owned profiles conservatively: hook payloads do not identify the
@@ -10,3 +23,4 @@ export declare function resolveCodexMcpTool(tool: string, serverNames: string[])
     server: string;
     tool: string;
 } | undefined;
+export {};

package/dist/codexMcpIdentity.js

@@ -33,16 +33,46 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.loadTomlParser = loadTomlParser;
+exports.__setTomlParserForTests = __setTomlParserForTests;
 exports.codexMcpServerNames = codexMcpServerNames;
 exports.resolveCodexMcpTool = resolveCodexMcpTool;
 const fs = __importStar(require("fs"));
 const os = __importStar(require("os"));
 const path = __importStar(require("path"));
-const toml_1 = require("@iarna/toml");
+let tomlParser;
+/**
+ * Load the TOML parser lazily. The native hook (`nativeHook.js`) is a
+ * fail-open surface in Codex: a hook process that crashes before printing a
+ * verdict is treated by Codex as "no opinion" and the tool call proceeds. A
+ * top-level `import` of a package that is missing from the install (the MSI
+ * ships an explicit node_modules allowlist) therefore disabled EVERY native
+ * hook event. Resolve the parser at first use instead so a missing module
+ * degrades to "no configured server names" while policies still evaluate.
+ */
+function loadTomlParser() {
+    if (tomlParser !== undefined)
+        return tomlParser;
+    try {
+        // eslint-disable-next-line @typescript-eslint/no-var-requires
+        tomlParser = require('@iarna/toml').parse;
+    }
+    catch {
+        tomlParser = null;
+    }
+    return tomlParser;
+}
+/** Test seam: force the "parser unavailable" path without uninstalling the package. */
+function __setTomlParserForTests(parser) {
+    tomlParser = parser;
+}
 /** Parse config without executing commands or exposing its contents in errors. */
 function readConfig(file) {
+    const parse = loadTomlParser();
+    if (!parse)
+        return {};
     try {
-        return (0, toml_1.parse)(fs.readFileSync(file, 'utf8').replace(/^\uFEFF/, ''));
+        return parse(fs.readFileSync(file, 'utf8').replace(/^\uFEFF/, ''));
     }
     catch (err) {
         if (err.code === 'ENOENT')

package/dist/commands/agentCi.js

@@ -41,6 +41,7 @@ const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const config_1 = require("../config");
 const discoverPaths_1 = require("./discoverPaths");
+const discoverProxy_1 = require("./discoverProxy");
 const discoverAgentFiles_1 = require("./discoverAgentFiles");
 const discoverSecrets_1 = require("./discoverSecrets");
 const discover_1 = require("./discover");
@@ -88,19 +89,6 @@ function parseTomlMcpServers(content) {
     }
     return servers;
 }
-function extractServerMap(parsed) {
-    if (!parsed || typeof parsed !== 'object')
-        return {};
-    if (parsed.mcpServers && typeof parsed.mcpServers === 'object')
-        return parsed.mcpServers;
-    if (parsed.servers && typeof parsed.servers === 'object')
-        return parsed.servers;
-    if (parsed.mcp?.servers && typeof parsed.mcp.servers === 'object')
-        return parsed.mcp.servers;
-    if (parsed['mcp.servers'] && typeof parsed['mcp.servers'] === 'object')
-        return parsed['mcp.servers'];
-    return {};
-}
 function riskSignalsForServer(name, server) {
     const text = [
         name,
@@ -129,7 +117,7 @@ function discoverMcpServers(cwd, extraPath) {
         const parsed = isToml
             ? parseTomlMcpServers(fs.readFileSync(candidate.path, 'utf8'))
             : parseJsonFile(candidate.path);
-        const map = extractServerMap(parsed);
+        const map = (0, discoverProxy_1.extractServerMap)(parsed);
         for (const [name, server] of Object.entries(map)) {
             const cfg = server;
             const command = typeof cfg.command === 'string' ? cfg.command : undefined;

package/dist/commands/discover.js

@@ -153,19 +153,6 @@ function deriveProjectRoots(candidates) {
     return [...roots];
 }
 /** MCP servers can be declared under several keys across clients. */
-function extractServerMap(parsed) {
-    if (!parsed || typeof parsed !== 'object')
-        return {};
-    if (parsed.mcpServers && typeof parsed.mcpServers === 'object')
-        return parsed.mcpServers;
-    if (parsed.servers && typeof parsed.servers === 'object')
-        return parsed.servers;
-    if (parsed.mcp?.servers && typeof parsed.mcp.servers === 'object')
-        return parsed.mcp.servers;
-    if (parsed['mcp.servers'] && typeof parsed['mcp.servers'] === 'object')
-        return parsed['mcp.servers'];
-    return {};
-}
 function parseTomlString(value) {
     const trimmed = value.trim().replace(/,$/, '');
     if (!trimmed)
@@ -347,7 +334,7 @@ function parseConfigFile(filePath, source) {
             return [];
     }
     const out = [];
-    for (const [name, cfgRaw] of Object.entries(extractServerMap(parsed))) {
+    for (const [name, cfgRaw] of Object.entries((0, discoverProxy_1.extractServerMap)(parsed))) {
         pushDiscoveredServer(out, name, cfgRaw, source, filePath);
     }
     // Claude Code stores MCP per-project inside ~/.claude.json

package/dist/commands/discoverProxy.d.ts

@@ -25,6 +25,29 @@ export interface ProxyClassifiableServer {
     configPath: string;
 }
 export declare function isFcdGatewayServer(server: ProxyClassifiableServer): boolean;
+/**
+ * The MCP server map of a parsed client config, whatever the client calls it:
+ * `mcpServers` (Cursor, Claude, Windsurf, Gemini), `servers` / `mcp.servers`
+ * (VS Code), `mcp_servers` (Codex TOML). Shared by discovery, agent-ci and the
+ * hook so every surface reads the same servers.
+ */
+export declare function extractServerMap(parsed: any): Record<string, any>;
+/**
+ * Every entry named `serverName` across this machine's AI-client MCP configs
+ * (Cursor, Claude Code incl. per-project maps in ~/.claude.json, Codex TOML,
+ * VS Code, Windsurf, Gemini, ...). Matches the exact name or the sanitized
+ * alias clients such as Codex expose (`patria-bank` -> `patria_bank`).
+ * Unreadable / unparsable files are skipped, never thrown.
+ */
+export declare function findClientMcpServers(serverName: string, cwd?: string, clientKey?: string): ProxyClassifiableServer[];
+/**
+ * True when every config entry for `serverName` — in the given client's configs
+ * when `clientKey` is set (`claude_code`, `vscode`, ...), else on the whole
+ * machine — runs through the FullCourtDefense MCP gateway. Unknown name, or the
+ * same name wrapped in one config and direct in another, is `false` — the caller
+ * keeps its own guard, so an action is at worst confirmed twice, never zero times.
+ */
+export declare function isServerBehindFcdGateway(serverName: string, cwd?: string, clientKey?: string): boolean;
 export declare function extractGatewayDownstream(server: ProxyClassifiableServer): {
     command?: string;
     args?: string[];

package/dist/commands/discoverProxy.js

@@ -36,6 +36,9 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.FCD_HOOK_TAG = exports.FCD_HOOK_MARKER = exports.FCD_GATEWAY_SERVER_NAMES = void 0;
 exports.isReferenceConfigSource = isReferenceConfigSource;
 exports.isFcdGatewayServer = isFcdGatewayServer;
+exports.extractServerMap = extractServerMap;
+exports.findClientMcpServers = findClientMcpServers;
+exports.isServerBehindFcdGateway = isServerBehindFcdGateway;
 exports.extractGatewayDownstream = extractGatewayDownstream;
 exports.buildGatewayWrapIndex = buildGatewayWrapIndex;
 exports.classifyProxyStatus = classifyProxyStatus;
@@ -46,6 +49,7 @@ const fs = __importStar(require("fs"));
 const os = __importStar(require("os"));
 const path = __importStar(require("path"));
 const discoverPaths_1 = require("./discoverPaths");
+const codexMcpIdentity_1 = require("../codexMcpIdentity");
 /**
  * Config sources that no AI client actually loads. A plain `mcp.json` at a
  * repo root is documentation/sample material — Cursor, Claude Code, VS Code,
@@ -76,6 +80,96 @@ function isFcdGatewayServer(server) {
     return blob.includes('mcp-gateway')
         && (blob.includes('fullcourtdefense') || blob.includes('agentguard') || blob.includes('botguard') || blob.includes('fcd-managed'));
 }
+/**
+ * The MCP server map of a parsed client config, whatever the client calls it:
+ * `mcpServers` (Cursor, Claude, Windsurf, Gemini), `servers` / `mcp.servers`
+ * (VS Code), `mcp_servers` (Codex TOML). Shared by discovery, agent-ci and the
+ * hook so every surface reads the same servers.
+ */
+function extractServerMap(parsed) {
+    if (!parsed || typeof parsed !== 'object')
+        return {};
+    if (parsed.mcpServers && typeof parsed.mcpServers === 'object')
+        return parsed.mcpServers;
+    if (parsed.mcp_servers && typeof parsed.mcp_servers === 'object')
+        return parsed.mcp_servers;
+    if (parsed.servers && typeof parsed.servers === 'object')
+        return parsed.servers;
+    if (parsed.mcp?.servers && typeof parsed.mcp.servers === 'object')
+        return parsed.mcp.servers;
+    if (parsed['mcp.servers'] && typeof parsed['mcp.servers'] === 'object')
+        return parsed['mcp.servers'];
+    return {};
+}
+function sanitizedServerAlias(name) {
+    return name.toLowerCase().replace(/[^a-z0-9_]/g, '_');
+}
+/**
+ * Every entry named `serverName` across this machine's AI-client MCP configs
+ * (Cursor, Claude Code incl. per-project maps in ~/.claude.json, Codex TOML,
+ * VS Code, Windsurf, Gemini, ...). Matches the exact name or the sanitized
+ * alias clients such as Codex expose (`patria-bank` -> `patria_bank`).
+ * Unreadable / unparsable files are skipped, never thrown.
+ */
+function findClientMcpServers(serverName, cwd = process.cwd(), clientKey) {
+    const wanted = serverName.toLowerCase();
+    const wantedAlias = sanitizedServerAlias(serverName);
+    const out = [];
+    for (const candidate of (0, discoverPaths_1.discoverScanTargets)(cwd)) {
+        if (clientKey && candidate.clientKey !== clientKey)
+            continue;
+        let parsed;
+        try {
+            const raw = fs.readFileSync(candidate.path, 'utf8').replace(/^\uFEFF/, '');
+            if (candidate.path.toLowerCase().endsWith('.toml')) {
+                const toml = (0, codexMcpIdentity_1.loadTomlParser)();
+                parsed = toml ? toml(raw) : null;
+            }
+            else {
+                parsed = JSON.parse(raw);
+            }
+        }
+        catch {
+            continue;
+        }
+        if (!parsed)
+            continue;
+        const maps = [extractServerMap(parsed)];
+        if (parsed.projects && typeof parsed.projects === 'object') {
+            for (const project of Object.values(parsed.projects))
+                maps.push(extractServerMap(project));
+        }
+        for (const map of maps) {
+            for (const [name, cfg] of Object.entries(map)) {
+                if (name.toLowerCase() !== wanted && sanitizedServerAlias(name) !== wantedAlias)
+                    continue;
+                if (!cfg || typeof cfg !== 'object')
+                    continue;
+                const entry = cfg;
+                out.push({
+                    serverName: name,
+                    command: typeof entry.command === 'string' ? entry.command : undefined,
+                    args: Array.isArray(entry.args) ? entry.args.map(String) : undefined,
+                    url: typeof entry.url === 'string' ? entry.url : typeof entry.endpoint === 'string' ? entry.endpoint : undefined,
+                    source: candidate.source,
+                    configPath: candidate.path,
+                });
+            }
+        }
+    }
+    return out;
+}
+/**
+ * True when every config entry for `serverName` — in the given client's configs
+ * when `clientKey` is set (`claude_code`, `vscode`, ...), else on the whole
+ * machine — runs through the FullCourtDefense MCP gateway. Unknown name, or the
+ * same name wrapped in one config and direct in another, is `false` — the caller
+ * keeps its own guard, so an action is at worst confirmed twice, never zero times.
+ */
+function isServerBehindFcdGateway(serverName, cwd = process.cwd(), clientKey) {
+    const matches = findClientMcpServers(serverName, cwd, clientKey);
+    return matches.length > 0 && matches.every(isFcdGatewayServer);
+}
 function extractGatewayDownstream(server) {
     const args = server.args || [];
     const urlIdx = args.indexOf('--mcp-url');

package/dist/commands/hook.d.ts

@@ -89,6 +89,41 @@ export declare function canonicalizeCursorPayload(argEvent: string | undefined,
     payload: Record<string, unknown>;
     ignore: boolean;
 };
+/**
+ * Cursor 3.19+ also fires GENERIC tool events — `preToolUse` / `postToolUse`
+ * (lower-camel `hook_event_name`, MCP tools named `MCP:<tool>`, built-ins by
+ * their tool name) — for the same action its dedicated hooks already report
+ * (`beforeMCPExecution` / `afterMCPExecution` / `beforeShellExecution` / ...).
+ * Evaluated as-is, one MCP call was judged three times: the generic pre-event
+ * (whose `MCP:` name matches no per-tool rule, so it fell through to broad
+ * company rules and raised a phantom manager approval), the dedicated
+ * pre-event, and the generic POST-event — judged as if the call were about to
+ * run, after it had already run.
+ *
+ *   preToolUse  -> ignore for MCP (beforeMCPExecution is the authoritative surface,
+ *                  same rule as Shell in normalizeCursorBuiltinTool); built-ins go
+ *                  through the shared taxonomy.
+ *   postToolUse -> a post-execution correlation signal, never enforced.
+ * Returns null for every other payload.
+ */
+export declare function canonicalizeCursorGenericToolEvent(payload: Record<string, unknown>): {
+    event: HookEvent;
+    payload: Record<string, unknown>;
+    ignore: boolean;
+} | null;
+/**
+ * The FullCourtDefense MCP gateway already sits in front of this server.
+ *  - Cursor reports the server's command line on `beforeMCPExecution`; ours is
+ *    `<node> <cli> mcp-gateway --mcp-command|--mcp-url ... --agent-name ...`
+ *    (Docker's MCP toolkit is `docker mcp gateway run` — no hyphen, no such flags).
+ *    When a command line is present it is authoritative.
+ *  - Claude Code / VS Code name the server (`mcp__<server>__<tool>`) but not its
+ *    command: the server is looked up in THAT client's MCP configs (`client` is
+ *    the hook's `--agent-client`, e.g. `claude-code` -> Claude Code's configs).
+ * Anything unknown is `false`: the hook then keeps its own guard, so an action
+ * is at worst confirmed twice, never zero times.
+ */
+export declare function isGatewayWrappedMcpServer(payload: Record<string, unknown>, client?: string, cwd?: string): boolean;
 /**
  * Map a Cursor execution-hook payload onto an Action Policy tool call.
  * Returns null when there is nothing actionable to evaluate.

package/dist/commands/hook.js

@@ -38,6 +38,8 @@ exports.canonicalBuiltinToolName = canonicalBuiltinToolName;
 exports.mapBuiltinToolPayload = mapBuiltinToolPayload;
 exports.normalizeCursorBuiltinTool = normalizeCursorBuiltinTool;
 exports.canonicalizeCursorPayload = canonicalizeCursorPayload;
+exports.canonicalizeCursorGenericToolEvent = canonicalizeCursorGenericToolEvent;
+exports.isGatewayWrappedMcpServer = isGatewayWrappedMcpServer;
 exports.buildToolCall = buildToolCall;
 exports.classifyGateHttpFailure = classifyGateHttpFailure;
 exports.gateHttpFailureDetail = gateHttpFailureDetail;
@@ -64,6 +66,7 @@ const devConfirm_1 = require("../devConfirm");
 // same rotated hook.log and read stdin identically.
 const hookIo_1 = require("../hookIo");
 const fileWriteCanon_1 = require("../fileWriteCanon");
+const discoverProxy_1 = require("./discoverProxy");
 function inferEvent(explicit, payload) {
     const e = (explicit || '').toLowerCase();
     if (e) {
@@ -293,6 +296,9 @@ function normalizeCursorBuiltinTool(payload) {
  * IDE false-positive corpus (Layer A) evaluates exactly what the hook evaluates.
  */
 function canonicalizeCursorPayload(argEvent, payload) {
+    const generic = canonicalizeCursorGenericToolEvent(payload);
+    if (generic)
+        return generic;
     const event = inferEvent(argEvent, payload);
     if (event !== 'mcp')
         return { event, payload, ignore: false };
@@ -303,6 +309,76 @@ function canonicalizeCursorPayload(argEvent, payload) {
         return { event: 'unknown', payload, ignore: true };
     return { event: builtin.event, payload: builtin.payload, ignore: false };
 }
+/** Cursor names MCP tools `MCP:<tool>` in its generic tool events. */
+const CURSOR_GENERIC_MCP_PREFIX = 'MCP:';
+/**
+ * Cursor 3.19+ also fires GENERIC tool events — `preToolUse` / `postToolUse`
+ * (lower-camel `hook_event_name`, MCP tools named `MCP:<tool>`, built-ins by
+ * their tool name) — for the same action its dedicated hooks already report
+ * (`beforeMCPExecution` / `afterMCPExecution` / `beforeShellExecution` / ...).
+ * Evaluated as-is, one MCP call was judged three times: the generic pre-event
+ * (whose `MCP:` name matches no per-tool rule, so it fell through to broad
+ * company rules and raised a phantom manager approval), the dedicated
+ * pre-event, and the generic POST-event — judged as if the call were about to
+ * run, after it had already run.
+ *
+ *   preToolUse  -> ignore for MCP (beforeMCPExecution is the authoritative surface,
+ *                  same rule as Shell in normalizeCursorBuiltinTool); built-ins go
+ *                  through the shared taxonomy.
+ *   postToolUse -> a post-execution correlation signal, never enforced.
+ * Returns null for every other payload.
+ */
+function canonicalizeCursorGenericToolEvent(payload) {
+    const hookEventName = str(payload.hook_event_name);
+    if (hookEventName !== 'preToolUse' && hookEventName !== 'postToolUse')
+        return null;
+    const toolName = str(payload.tool_name);
+    const isMcp = toolName.startsWith(CURSOR_GENERIC_MCP_PREFIX);
+    if (hookEventName === 'postToolUse') {
+        if (isMcp) {
+            return { event: 'post', payload: { ...payload, tool_name: toolName.slice(CURSOR_GENERIC_MCP_PREFIX.length), fcd_post_of: 'mcp' }, ignore: false };
+        }
+        const builtin = normalizeCursorBuiltinTool(payload);
+        if (!builtin || builtin.event === 'ignore')
+            return { event: 'unknown', payload, ignore: true };
+        return { event: 'post', payload: { ...builtin.payload, fcd_post_of: builtin.event }, ignore: false };
+    }
+    if (isMcp)
+        return { event: 'unknown', payload, ignore: true };
+    const builtin = normalizeCursorBuiltinTool(payload);
+    if (!builtin)
+        return null;
+    if (builtin.event === 'ignore')
+        return { event: 'unknown', payload, ignore: true };
+    return { event: builtin.event, payload: builtin.payload, ignore: false };
+}
+/**
+ * The FullCourtDefense MCP gateway already sits in front of this server.
+ *  - Cursor reports the server's command line on `beforeMCPExecution`; ours is
+ *    `<node> <cli> mcp-gateway --mcp-command|--mcp-url ... --agent-name ...`
+ *    (Docker's MCP toolkit is `docker mcp gateway run` — no hyphen, no such flags).
+ *    When a command line is present it is authoritative.
+ *  - Claude Code / VS Code name the server (`mcp__<server>__<tool>`) but not its
+ *    command: the server is looked up in THAT client's MCP configs (`client` is
+ *    the hook's `--agent-client`, e.g. `claude-code` -> Claude Code's configs).
+ * Anything unknown is `false`: the hook then keeps its own guard, so an action
+ * is at worst confirmed twice, never zero times.
+ */
+function isGatewayWrappedMcpServer(payload, client, cwd = process.cwd()) {
+    const command = str(payload.command);
+    if (command)
+        return /\bmcp-gateway\b/.test(command) && /--(?:mcp-command|mcp-url|mcp-args|agent-name)\b/.test(command);
+    const server = mcpServerName(payload);
+    if (!server)
+        return false;
+    const clientKey = client ? client.toLowerCase().replace(/-/g, '_') : undefined;
+    try {
+        return (0, discoverProxy_1.isServerBehindFcdGateway)(server, cwd, clientKey);
+    }
+    catch {
+        return false;
+    }
+}
 /**
  * Which AI client invoked a Claude-format hook. Claude Code sets CLAUDECODE=1;
  * VS Code Copilot runs hooks inside the VS Code process environment.
@@ -1746,6 +1822,17 @@ async function enforceActionPolicy(ctx) {
     }
     // Record untrusted ingress for this event (never blocks).
     (0, taintLedger_1.noteIngress)(sessId, event, call.toolName, call.toolArgs);
+    // ONE enforcement point per MCP call. A server the FullCourtDefense MCP gateway
+    // wraps is checked by the gateway in-line — same vendored engine, same cached
+    // policies, one developer dialog, one org approval, one audit record. Judging
+    // it here as well gave one action two prompts (IDE ask + gateway dialog) and
+    // two approval requests. Local Safety, taint and the self-protection guards
+    // above still ran; only the Action Policy step is the gateway's.
+    if (event === 'mcp' && isGatewayWrappedMcpServer(payload, ctx.client)) {
+        (0, hookIo_1.dbg)({ phase: 'policy_deferred_to_gateway', event, tool: call.toolName, server: mcpServerName(payload) });
+        respond(false);
+        return;
+    }
     const headers = { 'Content-Type': 'application/json' };
     if (shieldKey)
         headers['x-shield-key'] = shieldKey;

package/dist/commands/mcpGateway.js

@@ -948,6 +948,38 @@ function isBlockError(err) {
 }
 /** How long an MCP elicitation ("Ask the developer" dialog in the client) waits before it counts as declined. */
 const ELICITATION_TIMEOUT_MS = 5 * 60_000;
+/**
+ * The OS dialog is the fallback channel. Same bound as the IDE hook's dialog and
+ * inside every known client's MCP tool-call timeout (Codex `tool_timeout_sec`
+ * defaults to 60s) — a click after the client gave up would be wasted.
+ */
+const OS_DIALOG_TIMEOUT_MS = 60_000;
+/** Human-readable channel label for audit reasons and block explanations. */
+function confirmChannelLabel(answer) {
+    if (answer.channel === 'hook_dialog')
+        return 'FullCourtDefense dialog (IDE hook, same call — not asked twice)';
+    return answer.channel === 'os_dialog' ? 'FullCourtDefense dialog' : 'MCP client prompt';
+}
+function describeDeveloperNo(answer) {
+    const via = confirmChannelLabel(answer);
+    const autoNote = answer.clientAutoAnswered ? ' (the MCP client auto-declined the in-client prompt; the developer was asked in the FullCourtDefense dialog)' : '';
+    if (answer.answer === 'timeout') {
+        return {
+            reason: `developer confirmation not given (${via} timed out)${autoNote}`,
+            explanation: 'You did not answer the confirmation prompt in time',
+        };
+    }
+    if (answer.answer === 'unavailable') {
+        return {
+            reason: 'developer confirmation not possible (no dialog can be shown on this machine and the MCP client offers no prompt)',
+            explanation: 'This rule needs your confirmation, but no confirmation prompt can be shown here (no display and the client cannot ask)',
+        };
+    }
+    return {
+        reason: `developer declined in ${via}${autoNote}`,
+        explanation: 'You declined the confirmation prompt',
+    };
+}
 class McpGatewayServer {
     gatewayConfig;
     downstreamSpec;
@@ -957,8 +989,8 @@ class McpGatewayServer {
     api;
     /**
      * The MCP client declared `capabilities.elicitation` on initialize — it can
-     * show the user a server-initiated question. That is the only channel a stdio
-     * proxy has to "Ask the developer"; without it an ask rule fails strict.
+     * show the user a server-initiated question. Used only when no OS dialog can be
+     * shown (headless) or when `FCD_CONFIRM_CHANNEL=mcp-client` — see confirmWithDeveloper.
      */
     clientSupportsElicitation = false;
     /** Server -> client requests (elicitation) awaiting the client's response, by id. */
@@ -1222,10 +1254,11 @@ class McpGatewayServer {
                 process.stderr.write(`FullCourtDefense warning (${warning.itemId}): ${warning.reason}\n`);
             }
             // "Ask the developer" rule with no hard block on the same call: ask the
-            // human through the MCP client (elicitation) when the client can show a
-            // dialog and a human is present. Session memory reuses the IDE hook's
-            // ledger (same tool + rule => remembered). Decline, cancel, timeout, a
-            // client without elicitation, or no human => block, never a silent allow.
+            // human — through the MCP client (elicitation) when it can show a dialog,
+            // otherwise (or when the client answers for the user) through the OS
+            // dialog — whenever a human is present. Session memory reuses the IDE
+            // hook's ledger (same tool + rule => remembered). Decline, cancel, timeout
+            // or no human => block, never a silent allow.
             let localBlock = requestOutcome.blockingFinding || requestOutcome.askFinding;
             let askNote = '';
             if (!requestOutcome.blockingFinding && requestOutcome.askFinding && !reportOnlyMode) {
@@ -1245,7 +1278,7 @@ class McpGatewayServer {
                     (0, telemetry_1.triggerFlush)(false);
                     localBlock = undefined;
                 }
-                else if (this.clientSupportsElicitation && (0, devConfirm_1.isHumanPresent)()) {
+                else if ((0, devConfirm_1.isHumanPresent)()) {
                     const digest = (0, devConfirm_1.actionDigest)(toolArgs);
                     const marker = (0, devConfirm_1.raiseDeveloperConfirmation)({
                         event: 'mcp_gateway', toolName, operation: rememberScope.operation, argsDigest: digest,
@@ -1253,7 +1286,7 @@ class McpGatewayServer {
                         sessionId, remember: 'none',
                     });
                     process.stderr.write(`FullCourtDefense asking the developer to confirm ${toolName}: ${ask.reason} (${origin} "${ask.itemId}", ${ask.ruleId})\n`);
-                    const answer = await this.elicitDeveloperConfirmation({ toolName, reason: ask.reason, ruleLabel: `${origin} "${ask.itemId}" (${ask.ruleId})`, evidence: ask.evidence });
+                    const answer = await this.confirmWithDeveloper({ toolName, reason: ask.reason, ruleLabel: `${origin} "${ask.itemId}" (${ask.ruleId})`, evidence: ask.evidence, argsDigest: digest });
                     if (answer.answer === 'accept') {
                         // Settle through the shared ledger so "remember for this session" is
                         // recorded exactly like an IDE approval would be.
@@ -1262,7 +1295,7 @@ class McpGatewayServer {
                         (0, devConfirm_1.settleDeveloperConfirmation)('mcp_gateway', toolName, digest);
                         (0, telemetry_1.spoolEvent)({
                             decision: 'allow', toolName, operation: rememberScope.operation,
-                            reason: `developer confirmed in MCP client prompt${answer.remember ? ' (remembered for this session)' : ''} — ${ask.reason}`,
+                            reason: `developer confirmed in ${confirmChannelLabel(answer)}${answer.remember ? ' (remembered for this session)' : ''}${answer.clientAutoAnswered ? ' (the MCP client auto-declined the in-client prompt)' : ''} — ${ask.reason}`,
                             ruleId: ask.ruleId, category: ask.category, categoryId: ask.categoryId, itemId: ask.itemId, source: ask.source,
                             evidence: ask.evidence, policyHash: ask.policyHash, offlineEnforced: true,
                             approvalScope: 'developer', approvedBy: 'developer', confirmLatencyMs: answer.latencyMs,
@@ -1272,22 +1305,20 @@ class McpGatewayServer {
                     }
                     else {
                         (0, devConfirm_1.rejectDeveloperConfirmation)('mcp_gateway', toolName, digest);
-                        const how = answer.answer === 'timeout' ? 'developer confirmation not given (prompt timed out)' : 'developer declined in MCP client prompt';
+                        const no = describeDeveloperNo(answer);
                         (0, telemetry_1.spoolEvent)({
                             decision: 'block', toolName, operation: rememberScope.operation,
-                            reason: `${how} — ${ask.reason}`,
+                            reason: `${no.reason} — ${ask.reason}`,
                             ruleId: ask.ruleId, category: ask.category, categoryId: ask.categoryId, itemId: ask.itemId, source: ask.source,
                             evidence: ask.evidence, policyHash: ask.policyHash, offlineEnforced: true,
                             approvalScope: 'developer', confirmLatencyMs: answer.latencyMs,
                         });
                         (0, telemetry_1.triggerFlush)(true);
-                        throw blockError(explainGatewayLocalSafety('block', toolName, toolArgs, ask, `${answer.answer === 'timeout' ? 'You did not answer the confirmation prompt in time' : 'You declined the confirmation prompt'}, so this tool call was not executed.`));
+                        throw blockError(explainGatewayLocalSafety('block', toolName, toolArgs, ask, `${no.explanation}, so this tool call was not executed.`));
                     }
                 }
                 else {
-                    askNote = this.clientSupportsElicitation
-                        ? ' This rule asks the developer to confirm, but no human is present on this machine (CI / ephemeral workload), so it blocks here.'
-                        : ' This rule asks the developer to confirm; this MCP client cannot show a confirmation dialog (no elicitation support), so it blocks here (the IDE hook can ask).';
+                    askNote = ' This rule asks the developer to confirm, but no human is present on this machine (CI / ephemeral workload), so it blocks here.';
                 }
             }
             if (localBlock) {
@@ -1836,8 +1867,10 @@ class McpGatewayServer {
      * throws the block error when the developer declines or does not answer.
      */
     async askDeveloperForPolicy(toolName, toolArgs, operation, verdict, policies) {
-        if (!this.clientSupportsElicitation) {
-            const reason = 'This rule requires developer confirmation inside the IDE, but this MCP client does not support confirmation prompts. The action was not executed. Update or reconnect the IDE integration.';
+        if (!(0, devConfirm_1.isHumanPresent)()) {
+            // The engine normally degrades developer scope to org where no human exists;
+            // this is the belt for a rule that still reached us with developer scope.
+            const reason = 'This rule requires developer confirmation, but no human is present on this machine (CI / ephemeral workload). The action was not executed.';
             (0, telemetry_1.spoolEvent)({ decision: 'block', toolName, operation, reason, approvalScope: 'developer', ruleId: verdict.policyId });
             (0, telemetry_1.triggerFlush)(true);
             throw blockError(reason);
@@ -1865,7 +1898,7 @@ class McpGatewayServer {
         });
         (0, telemetry_1.spoolEvent)({
             decision: 'approval', toolName, operation,
-            reason: `developer confirmation requested via MCP client prompt${policyLabel}${verdict.reason ? `: ${verdict.reason}` : ''}`,
+            reason: `developer confirmation requested via ${(0, devConfirm_1.nativeDialogAvailable)() ? 'FullCourtDefense dialog' : this.clientSupportsElicitation ? 'MCP client prompt' : 'FullCourtDefense dialog'}${policyLabel}${verdict.reason ? `: ${verdict.reason}` : ''}`,
             ruleId, offlineEnforced: true, approvalScope: 'developer',
         });
         (0, telemetry_1.triggerFlush)(false);
@@ -1873,32 +1906,89 @@ class McpGatewayServer {
             ? ' This policy is set to Block; on a developer workstation it asks you instead. An admin can mark it "Hard block" in the console to stop this without asking.'
             : '';
         process.stderr.write(`FullCourtDefense asking the developer to confirm ${toolName}${policyLabel}: ${verdict.reason || verdict.matchedRule || 'action policy'}\n`);
-        const answer = await this.elicitDeveloperConfirmation({
+        const answer = await this.confirmWithDeveloper({
             toolName,
             reason: `${verdict.reason || `${toolName} needs your confirmation`}.${ceiling}`,
             allowRemember: false,
             ruleLabel: verdict.policyName ? `Action Policy "${verdict.policyName}"${verdict.matchedRule ? ` — ${verdict.matchedRule}` : ''}` : 'Action Policy',
+            argsDigest: digest,
         });
         if (answer.answer === 'accept') {
             // Policy memory limits are authoritative; a client cannot upgrade 'none'.
             (0, devConfirm_1.settleDeveloperConfirmation)('mcp_gateway', toolName, digest);
             (0, telemetry_1.spoolEvent)({
                 decision: 'allow', toolName, operation,
-                reason: `developer confirmed in MCP client prompt${answer.remember ? ' (remembered for this session)' : ''}${policyLabel}`,
+                reason: `developer confirmed in ${confirmChannelLabel(answer)}${answer.remember ? ' (remembered for this session)' : ''}${answer.clientAutoAnswered ? ' (the MCP client auto-declined the in-client prompt)' : ''}${policyLabel}`,
                 ruleId, offlineEnforced: true, approvalScope: 'developer', approvedBy: 'developer', confirmLatencyMs: answer.latencyMs,
             });
             (0, telemetry_1.triggerFlush)(false);
             return true;
         }
         (0, devConfirm_1.rejectDeveloperConfirmation)('mcp_gateway', toolName, digest);
-        const how = answer.answer === 'timeout' ? 'developer confirmation not given (prompt timed out)' : 'developer declined in MCP client prompt';
+        const no = describeDeveloperNo(answer);
         (0, telemetry_1.spoolEvent)({
             decision: 'block', toolName, operation,
-            reason: `${how}${policyLabel}`,
+            reason: `${no.reason}${policyLabel}`,
             ruleId, offlineEnforced: true, approvalScope: 'developer', confirmLatencyMs: answer.latencyMs,
         });
         (0, telemetry_1.triggerFlush)(true);
-        throw blockError(explainGatewayPolicy('block', toolName, toolArgs, verdict, policies, `${answer.answer === 'timeout' ? 'You did not answer the confirmation prompt in time' : 'You declined the confirmation prompt'}, so this tool call was not executed.`));
+        throw blockError(explainGatewayPolicy('block', toolName, toolArgs, verdict, policies, `${no.explanation}, so this tool call was not executed.`));
+    }
+    /**
+     * "Ask the developer" — ONE dialog, the same in every MCP client.
+     *
+     * The FullCourtDefense OS dialog (PowerShell popup / osascript / zenity) is the
+     * channel. It is owned by this process, not by the IDE, so the agent cannot
+     * answer it and the client cannot answer it for the user. In-client prompts
+     * (MCP elicitation) turned out to be unreliable exactly where it matters:
+     * Codex Desktop "Full access" declines every elicitation in milliseconds,
+     * Cursor 3.19 declines it after ~20s without rendering it — in both cases the
+     * developer saw nothing and the audit said "declined". Order:
+     *   1. no human on this machine                 => unavailable (caller blocks)
+     *   2. the IDE hook's dialog already confirmed  => accept (same call, not asked twice)
+     *      THIS exact call moments ago
+     *   3. OS dialog                                => the developer's answer
+     *   4. no dialog possible (headless, no display, => in-client prompt if the client
+     *      binary missing)                             supports it; a client that answers
+     *                                                  for the user is still a "no"
+     * `FCD_CONFIRM_CHANNEL=mcp-client` swaps 3 and 4 for clients whose in-chat prompt
+     * an org has verified. Every path that is not an explicit "yes" from a human
+     * ends in a block.
+     */
+    async confirmWithDeveloper(input) {
+        if (!(0, devConfirm_1.isHumanPresent)())
+            return { answer: 'unavailable', remember: false, latencyMs: 0, clientAutoAnswered: false };
+        const handoff = input.argsDigest ? (0, devConfirm_1.consumeConfirmedAction)(input.toolName, input.argsDigest) : undefined;
+        if (handoff) {
+            return { answer: 'accept', remember: false, latencyMs: Math.max(0, Date.now() - Date.parse(handoff.confirmedAt)), channel: 'hook_dialog', clientAutoAnswered: false };
+        }
+        const preferClient = (process.env.FCD_CONFIRM_CHANNEL || '').toLowerCase() === 'mcp-client' && this.clientSupportsElicitation;
+        let clientAutoAnswered = false;
+        if (preferClient) {
+            const viaClient = await this.elicitDeveloperConfirmation(input);
+            const automated = viaClient.clientError || (0, devConfirm_1.looksLikeClientAutoAnswer)(viaClient.answer, viaClient.latencyMs);
+            if (!automated)
+                return { ...viaClient, channel: 'mcp_client', clientAutoAnswered: false };
+            clientAutoAnswered = true;
+            process.stderr.write(`FullCourtDefense: the MCP client answered the confirmation prompt for ${input.toolName} by itself in ${viaClient.latencyMs}ms (no prompt reached the developer); asking in the FullCourtDefense dialog instead.\n`);
+        }
+        const dialog = await this.askInOsDialog(input, clientAutoAnswered);
+        if (dialog.answer !== 'unavailable')
+            return dialog;
+        if (!preferClient && this.clientSupportsElicitation) {
+            process.stderr.write(`FullCourtDefense: no dialog can be shown on this machine for ${input.toolName} (headless / no display); asking through the MCP client prompt instead.\n`);
+            const viaClient = await this.elicitDeveloperConfirmation(input);
+            const automated = viaClient.clientError || (0, devConfirm_1.looksLikeClientAutoAnswer)(viaClient.answer, viaClient.latencyMs);
+            return { ...viaClient, answer: automated ? 'decline' : viaClient.answer, channel: 'mcp_client', clientAutoAnswered: automated };
+        }
+        return dialog;
+    }
+    async askInOsDialog(input, clientAutoAnswered) {
+        const evidence = input.evidence ? `\nEvidence: ${input.evidence.slice(0, 240)}` : '';
+        const dialog = await (0, devConfirm_1.confirmNativeActionDetailed)(`Agent: ${this.gatewayConfig.agentName}\nIDE: ${this.gatewayConfig.agentClient}\nDeveloper: ${this.gatewayConfig.developerName || 'Unknown'}\nTool: ${input.toolName}\nRule: ${input.ruleLabel}\nWhy: ${input.reason}${evidence}\n\nYour answer is reported to your security dashboard as your decision.`, OS_DIALOG_TIMEOUT_MS);
+        process.stderr.write(`FullCourtDefense: dialog for ${input.toolName} ended with "${dialog.outcome}" after ${dialog.latencyMs}ms.\n`);
+        const answer = dialog.outcome === 'allow' ? 'accept' : dialog.outcome === 'deny' ? 'decline' : dialog.outcome;
+        return { answer, remember: false, latencyMs: dialog.latencyMs, channel: 'os_dialog', clientAutoAnswered };
     }
     async elicitDeveloperConfirmation(input) {
         const started = Date.now();
@@ -1925,8 +2015,15 @@ class McpGatewayServer {
             },
         }, ELICITATION_TIMEOUT_MS);
         const latencyMs = Date.now() - started;
+        // One diagnostic line per answer — this is how "the developer saw no prompt but
+        // the call was blocked" gets diagnosed from the IDE's MCP log alone.
+        process.stderr.write(`FullCourtDefense: MCP client answered the confirmation prompt for ${input.toolName} in ${latencyMs}ms: ${response ? JSON.stringify(response.error ? { error: response.error } : response.result).slice(0, 300) : 'no answer (timeout)'}\n`);
         if (!response)
             return { answer: 'timeout', remember: false, latencyMs };
+        // A JSON-RPC error ("method not found", "not supported in this mode") means no
+        // dialog was shown: the client could not ask, it did not get a "no".
+        if (response.error)
+            return { answer: 'decline', remember: false, latencyMs, clientError: true };
         const result = (response.result && typeof response.result === 'object') ? response.result : undefined;
         const content = (result?.content && typeof result.content === 'object') ? result.content : undefined;
         if (result?.action === 'accept' && content?.confirm === true) {

package/dist/devConfirm.d.ts

@@ -1,4 +1,36 @@
 export type ConfirmRemember = 'none' | 'session' | '1h';
+/**
+ * Fastest plausible HUMAN answer to a confirmation prompt. A person has to notice
+ * the dialog, read at least the tool name and press a button; MCP clients that
+ * answer an `elicitation/create` for the user (Codex Desktop in "Full access" —
+ * `approval_policy = never` — declines every elicitation without rendering it)
+ * respond in tens of milliseconds. A decline below this bound is treated as the
+ * CLIENT's answer, not the developer's, and the question is re-asked through the
+ * OS dialog. Accepts are never re-asked; a fast accept only ever costs a prompt.
+ */
+export declare const MIN_HUMAN_ANSWER_MS = 1000;
+/** True when a negative elicitation answer arrived faster than a human can read the prompt. */
+export declare function looksLikeClientAutoAnswer(answer: 'accept' | 'decline' | 'timeout', latencyMs: number): boolean;
+/**
+ * OS-owned confirmation dialog — the IDE-independent fallback for "Ask the developer".
+ * PowerShell `WScript.Shell.Popup` on Windows, `osascript` on macOS, `zenity` elsewhere.
+ * The agent cannot answer it: it is not connected to hook stdin, the MCP stream or the
+ * agent's terminal. Resolves `true` only for an explicit "Allow once"; decline, close,
+ * timeout, a missing dialog binary or no human present all resolve `false`.
+ */
+export declare function confirmNativeAction(reason: string, timeoutMs?: number): Promise<boolean>;
+/**
+ * How the OS dialog ended. `unavailable` = no dialog could be shown at all (no human,
+ * no display, dialog binary missing / failed to start) — the caller may try another
+ * channel. `deny` covers Deny, closing the window and the dialog's own give-up.
+ */
+export type NativeDialogOutcome = 'allow' | 'deny' | 'timeout' | 'unavailable';
+/** True when this process can put a dialog in front of a person on this machine. */
+export declare function nativeDialogAvailable(): boolean;
+export declare function confirmNativeActionDetailed(reason: string, timeoutMs?: number): Promise<{
+    outcome: NativeDialogOutcome;
+    latencyMs: number;
+}>;
 export interface PendingConfirmation {
     /** Stable key: sha256(event|toolName|argsDigest). */
     key: string;
@@ -32,8 +64,23 @@ export interface RememberedConfirmation {
     confirmedAt: string;
     expiresAt: string;
 }
+/**
+ * An explicit "Allow once" a human clicked in the OS dialog raised by the IDE hook for one
+ * exact action (tool + args digest). The MCP gateway that receives the same call a moment
+ * later consumes it instead of asking a second time. Single-use, short-lived, exact-match.
+ */
+export interface ConfirmedAction {
+    /** sha256(bareToolName|argsDigest). */
+    key: string;
+    toolName: string;
+    argsDigest: string;
+    confirmedAt: string;
+    expiresAt: string;
+}
 /** A raised confirmation that received no post-execution signal in time counts as not approved. */
 export declare const CONFIRM_PENDING_TTL_MS: number;
+/** The hook's dialog answer only carries over to the gateway call it was given for. */
+export declare const CONFIRMED_ACTION_TTL_MS: number;
 /** CI / pipeline environments — no human at a keyboard. Shared by hooks and discovery. */
 export declare function isCiEnvironment(env?: NodeJS.ProcessEnv): boolean;
 /**
@@ -49,6 +96,19 @@ export declare function isHumanPresent(env?: NodeJS.ProcessEnv): boolean;
  */
 export declare function actionDigest(toolArgs: Record<string, unknown>): string;
 export declare function pendingKey(event: string, toolName: string, argsDigest: string): string;
+/**
+ * The tool name as the MCP server sees it. The IDE hook names an MCP call
+ * `mcp__<server>__<tool>` (Codex/Claude) or `<server>/<tool>`; the gateway sees `<tool>`.
+ */
+export declare function bareToolName(toolName: string): string;
+/** The IDE hook's OS dialog got an explicit "Allow once" for this exact action. */
+export declare function recordConfirmedAction(toolName: string, argsDigest: string, now?: Date): ConfirmedAction;
+/**
+ * Take (and remove) a still-valid hook-dialog approval for this exact action, so the
+ * gateway does not ask the human twice for one tool call. Never matches a different
+ * tool, different arguments, an expired entry, or the same entry twice.
+ */
+export declare function consumeConfirmedAction(toolName: string, argsDigest: string, now?: Date): ConfirmedAction | undefined;
 export interface RememberScope {
     toolName: string;
     operation: string;

package/dist/devConfirm.js

@@ -33,11 +33,18 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.CONFIRM_PENDING_TTL_MS = void 0;
+exports.CONFIRMED_ACTION_TTL_MS = exports.CONFIRM_PENDING_TTL_MS = exports.MIN_HUMAN_ANSWER_MS = void 0;
+exports.looksLikeClientAutoAnswer = looksLikeClientAutoAnswer;
+exports.confirmNativeAction = confirmNativeAction;
+exports.nativeDialogAvailable = nativeDialogAvailable;
+exports.confirmNativeActionDetailed = confirmNativeActionDetailed;
 exports.isCiEnvironment = isCiEnvironment;
 exports.isHumanPresent = isHumanPresent;
 exports.actionDigest = actionDigest;
 exports.pendingKey = pendingKey;
+exports.bareToolName = bareToolName;
+exports.recordConfirmedAction = recordConfirmedAction;
+exports.consumeConfirmedAction = consumeConfirmedAction;
 exports.raiseDeveloperConfirmation = raiseDeveloperConfirmation;
 exports.settleDeveloperConfirmation = settleDeveloperConfirmation;
 exports.rejectDeveloperConfirmation = rejectDeveloperConfirmation;
@@ -66,10 +73,101 @@ exports.isConfirmationRemembered = isConfirmationRemembered;
  * containers and cloud coding agents set CI-style env vars or FCD_EPHEMERAL; there the engine's
  * `effectiveApprovalScope` degrades to `org` and none of this runs.
  */
+const child_process_1 = require("child_process");
 const crypto = __importStar(require("crypto"));
 const fs = __importStar(require("fs"));
 const os = __importStar(require("os"));
 const path = __importStar(require("path"));
+/**
+ * Fastest plausible HUMAN answer to a confirmation prompt. A person has to notice
+ * the dialog, read at least the tool name and press a button; MCP clients that
+ * answer an `elicitation/create` for the user (Codex Desktop in "Full access" —
+ * `approval_policy = never` — declines every elicitation without rendering it)
+ * respond in tens of milliseconds. A decline below this bound is treated as the
+ * CLIENT's answer, not the developer's, and the question is re-asked through the
+ * OS dialog. Accepts are never re-asked; a fast accept only ever costs a prompt.
+ */
+exports.MIN_HUMAN_ANSWER_MS = 1000;
+/** True when a negative elicitation answer arrived faster than a human can read the prompt. */
+function looksLikeClientAutoAnswer(answer, latencyMs) {
+    return answer === 'decline' && latencyMs < exports.MIN_HUMAN_ANSWER_MS;
+}
+/**
+ * OS-owned confirmation dialog — the IDE-independent fallback for "Ask the developer".
+ * PowerShell `WScript.Shell.Popup` on Windows, `osascript` on macOS, `zenity` elsewhere.
+ * The agent cannot answer it: it is not connected to hook stdin, the MCP stream or the
+ * agent's terminal. Resolves `true` only for an explicit "Allow once"; decline, close,
+ * timeout, a missing dialog binary or no human present all resolve `false`.
+ */
+async function confirmNativeAction(reason, timeoutMs = 60_000) {
+    return (await confirmNativeActionDetailed(reason, timeoutMs)).outcome === 'allow';
+}
+/** True when this process can put a dialog in front of a person on this machine. */
+function nativeDialogAvailable() {
+    if (!isHumanPresent())
+        return false;
+    if (process.platform === 'win32' || process.platform === 'darwin')
+        return true;
+    return Boolean(process.env.DISPLAY || process.env.WAYLAND_DISPLAY);
+}
+async function confirmNativeActionDetailed(reason, timeoutMs = 60_000) {
+    if (!nativeDialogAvailable())
+        return { outcome: 'unavailable', latencyMs: 0 };
+    const started = Date.now();
+    let executable;
+    let args;
+    const message = `FullCourtDefense — developer approval\n\n${reason.slice(0, 1800)}\n\nAllow this action once?`;
+    const timeoutSeconds = Math.max(1, Math.ceil(timeoutMs / 1000));
+    if (process.platform === 'win32') {
+        executable = 'powershell.exe';
+        const encoded = Buffer.from(message, 'utf8').toString('base64');
+        // 292 = Yes/No + question icon + "No" default; +4096 (MB_SYSTEMMODAL) keeps the
+        // popup above the IDE window that triggered it, so a fallback ask is never
+        // hidden behind Codex/Cursor and silently timed out.
+        const script = `$msg=[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('${encoded}')); $w=New-Object -ComObject WScript.Shell; $answer=$w.Popup($msg,${timeoutSeconds},'FullCourtDefense',4388); if($answer -eq 6){exit 0}else{exit 1}`;
+        args = ['-NoProfile', '-NonInteractive', '-EncodedCommand', Buffer.from(script, 'utf16le').toString('base64')];
+    }
+    else if (process.platform === 'darwin') {
+        executable = '/usr/bin/osascript';
+        args = ['-e', 'on run argv', '-e', `display dialog (item 1 of argv) buttons {"Deny", "Allow once"} default button "Deny" giving up after ${timeoutSeconds}`, '-e', 'if gave up of result or button returned of result is not "Allow once" then error number -128', '-e', 'end run', message];
+    }
+    else {
+        executable = 'zenity';
+        args = ['--question', '--default-cancel', '--title=FullCourtDefense', `--text=${message}`, '--ok-label=Allow once', '--cancel-label=Deny', `--timeout=${timeoutSeconds}`];
+    }
+    return new Promise(resolve => {
+        let finished = false;
+        let child;
+        const done = (outcome) => {
+            if (finished)
+                return;
+            finished = true;
+            clearTimeout(timer);
+            process.removeListener('exit', cancelChild);
+            resolve({ outcome, latencyMs: Date.now() - started });
+        };
+        const cancelChild = () => child?.kill();
+        const timer = setTimeout(() => { child?.kill(); done('timeout'); }, timeoutMs + 1000);
+        try {
+            child = (0, child_process_1.spawn)(executable, args, { stdio: 'ignore', windowsHide: true });
+        }
+        catch {
+            done('unavailable');
+            return;
+        }
+        process.once('exit', cancelChild);
+        // Spawn failure (binary missing, no permission) = nothing was shown. A child
+        // that ran and exited non-zero = the person (or the dialog's give-up) said no;
+        // the dialog cannot tell Deny from close from give-up, so a "no" that arrives
+        // at the deadline is reported as a timeout.
+        child.on('error', () => done('unavailable'));
+        child.on('exit', code => {
+            if (code === 0)
+                return done('allow');
+            done(Date.now() - started >= timeoutMs - 500 ? 'timeout' : 'deny');
+        });
+    });
+}
 /** A raised confirmation that received no post-execution signal in time counts as not approved. */
 exports.CONFIRM_PENDING_TTL_MS = 10 * 60_000;
 const REMEMBER_1H_MS = 60 * 60_000;
@@ -77,6 +175,9 @@ const REMEMBER_1H_MS = 60 * 60_000;
 const REMEMBER_SESSION_MAX_MS = 12 * 60 * 60_000;
 const MAX_PENDING = 50;
 const MAX_REMEMBERED = 200;
+/** The hook's dialog answer only carries over to the gateway call it was given for. */
+exports.CONFIRMED_ACTION_TTL_MS = 2 * 60_000;
+const MAX_CONFIRMED_ACTIONS = 50;
 /** CI / pipeline environments — no human at a keyboard. Shared by hooks and discovery. */
 function isCiEnvironment(env = process.env) {
     return env.GITHUB_ACTIONS === 'true'
@@ -109,10 +210,11 @@ function readLedger() {
             pending: Array.isArray(parsed?.pending) ? parsed.pending.filter((p) => p && typeof p === 'object') : [],
             // Older ledgers could remember declines. Require fresh affirmative consent.
             remembered: parsed?.formatVersion === 2 && Array.isArray(parsed?.remembered) ? parsed.remembered.filter((r) => r && typeof r === 'object') : [],
+            confirmedActions: Array.isArray(parsed?.confirmedActions) ? parsed.confirmedActions.filter((c) => c && typeof c === 'object') : [],
         };
     }
     catch {
-        return { pending: [], remembered: [] };
+        return { pending: [], remembered: [], confirmedActions: [] };
     }
 }
 function writeLedger(ledger) {
@@ -157,6 +259,60 @@ function actionDigest(toolArgs) {
 function pendingKey(event, toolName, argsDigest) {
     return sha256(`${event}|${toolName.toLowerCase()}|${argsDigest}`);
 }
+/**
+ * The tool name as the MCP server sees it. The IDE hook names an MCP call
+ * `mcp__<server>__<tool>` (Codex/Claude) or `<server>/<tool>`; the gateway sees `<tool>`.
+ */
+function bareToolName(toolName) {
+    let name = toolName.trim();
+    if (name.startsWith('mcp__')) {
+        const rest = name.slice('mcp__'.length);
+        const idx = rest.indexOf('__');
+        name = idx >= 0 ? rest.slice(idx + 2) : rest;
+    }
+    else if (name.includes('/')) {
+        name = name.slice(name.lastIndexOf('/') + 1);
+    }
+    return name.toLowerCase();
+}
+function confirmedActionKey(toolName, argsDigest) {
+    return sha256(`confirmed|${bareToolName(toolName)}|${argsDigest}`);
+}
+/** The IDE hook's OS dialog got an explicit "Allow once" for this exact action. */
+function recordConfirmedAction(toolName, argsDigest, now = new Date()) {
+    const entry = {
+        key: confirmedActionKey(toolName, argsDigest),
+        toolName: bareToolName(toolName),
+        argsDigest,
+        confirmedAt: now.toISOString(),
+        expiresAt: new Date(now.getTime() + exports.CONFIRMED_ACTION_TTL_MS).toISOString(),
+    };
+    const ledger = readLedger();
+    ledger.confirmedActions = ledger.confirmedActions.filter(c => c.key !== entry.key && Date.parse(c.expiresAt) > now.getTime());
+    ledger.confirmedActions.push(entry);
+    if (ledger.confirmedActions.length > MAX_CONFIRMED_ACTIONS)
+        ledger.confirmedActions = ledger.confirmedActions.slice(-MAX_CONFIRMED_ACTIONS);
+    writeLedger(ledger);
+    return entry;
+}
+/**
+ * Take (and remove) a still-valid hook-dialog approval for this exact action, so the
+ * gateway does not ask the human twice for one tool call. Never matches a different
+ * tool, different arguments, an expired entry, or the same entry twice.
+ */
+function consumeConfirmedAction(toolName, argsDigest, now = new Date()) {
+    const ledger = readLedger();
+    const key = confirmedActionKey(toolName, argsDigest);
+    const hit = ledger.confirmedActions.find(c => c.key === key);
+    const live = ledger.confirmedActions.filter(c => Number.isFinite(Date.parse(c.expiresAt)) && Date.parse(c.expiresAt) > now.getTime());
+    const valid = hit && live.includes(hit) ? hit : undefined;
+    const next = live.filter(c => c !== valid);
+    if (next.length !== ledger.confirmedActions.length) {
+        ledger.confirmedActions = next;
+        writeLedger(ledger);
+    }
+    return valid;
+}
 function rememberKey(scope) {
     const rule = scope.policyId ? `${scope.policyId}|${scope.matchedRule || ''}` : `op:${scope.operation.toLowerCase()}`;
     return sha256(`${scope.toolName.toLowerCase()}|${rule}`);
@@ -227,9 +383,11 @@ function sweepExpiredConfirmations(now = new Date(), ttlMs = exports.CONFIRM_PEN
     const cutoff = now.getTime() - ttlMs;
     const expired = ledger.pending.filter(p => Date.parse(p.raisedAt) < cutoff);
     const remembered = ledger.remembered.filter(r => Date.parse(r.expiresAt) > now.getTime());
-    if (expired.length > 0 || remembered.length !== ledger.remembered.length) {
+    const confirmedActions = ledger.confirmedActions.filter(c => Date.parse(c.expiresAt) > now.getTime());
+    if (expired.length > 0 || remembered.length !== ledger.remembered.length || confirmedActions.length !== ledger.confirmedActions.length) {
         ledger.pending = ledger.pending.filter(p => Date.parse(p.raisedAt) >= cutoff);
         ledger.remembered = remembered;
+        ledger.confirmedActions = confirmedActions;
         writeLedger(ledger);
     }
     return expired;

package/dist/nativeHook.d.ts

@@ -1,5 +1,7 @@
+/** Native hook adapters. Never emit an unsupported `ask` to an IDE. */
 import { HookArgs } from './commands/hook';
 import { BotGuardConfig } from './config';
+import { confirmNativeAction } from './devConfirm';
 export type NativeClient = 'codex' | 'gemini_cli' | 'windsurf' | 'kiro';
 type Payload = Record<string, any>;
 export declare const NATIVE_CLIENTS: NativeClient[];
@@ -15,11 +17,13 @@ export declare function nativeErrorVerdict(client: NativeClient, reason: string)
     stderr: string;
     exitCode: number;
 };
-/** OS-owned dialog: an agent cannot approve by writing `yes` to hook stdin. */
-export declare function confirmNativeAction(reason: string, timeoutMs?: number): Promise<boolean>;
+/**
+ * OS-owned dialog (shared with the MCP gateway; lives in devConfirm.ts): an agent
+ * cannot approve by writing `yes` to hook stdin. Re-exported for existing callers.
+ */
+export { confirmNativeAction };
 export declare function evaluateNativeHook(client: NativeClient, raw: Payload, args: HookArgs, config: BotGuardConfig, confirm?: (reason: string) => Promise<boolean>): Promise<{
     stdout: string;
     stderr: string;
     exitCode: number;
 }>;
-export {};

package/dist/nativeHook.js

@@ -1,19 +1,18 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.NATIVE_CLIENTS = void 0;
+exports.confirmNativeAction = exports.NATIVE_CLIENTS = void 0;
 exports.patchToolCalls = patchToolCalls;
 exports.normalizeNativeInput = normalizeNativeInput;
 exports.nativeVerdict = nativeVerdict;
 exports.nativeErrorVerdict = nativeErrorVerdict;
-exports.confirmNativeAction = confirmNativeAction;
 exports.evaluateNativeHook = evaluateNativeHook;
 /** Native hook adapters. Never emit an unsupported `ask` to an IDE. */
-const child_process_1 = require("child_process");
 const hook_1 = require("./commands/hook");
 const config_1 = require("./config");
 const runtimeConfig_1 = require("./runtimeConfig");
 const hookIo_1 = require("./hookIo");
 const devConfirm_1 = require("./devConfirm");
+Object.defineProperty(exports, "confirmNativeAction", { enumerable: true, get: function () { return devConfirm_1.confirmNativeAction; } });
 const telemetry_1 = require("./telemetry");
 const codexMcpIdentity_1 = require("./codexMcpIdentity");
 exports.NATIVE_CLIENTS = ['codex', 'gemini_cli', 'windsurf', 'kiro'];
@@ -111,44 +110,7 @@ function nativeErrorVerdict(client, reason) {
         return { stdout: JSON.stringify({ decision: 'block', reason }), stderr: '', exitCode: 0 };
     return nativeVerdict(client, true, reason);
 }
-/** OS-owned dialog: an agent cannot approve by writing `yes` to hook stdin. */
-async function confirmNativeAction(reason, timeoutMs = 60_000) {
-    if (!(0, devConfirm_1.isHumanPresent)())
-        return false;
-    let executable;
-    let args;
-    const message = `FullCourtDefense — developer approval\n\n${reason.slice(0, 1800)}\n\nAllow this action once?`;
-    if (process.platform === 'win32') {
-        executable = 'powershell.exe';
-        const encoded = Buffer.from(message, 'utf8').toString('base64');
-        const script = `$msg=[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('${encoded}')); $w=New-Object -ComObject WScript.Shell; $answer=$w.Popup($msg,${Math.ceil(timeoutMs / 1000)},'FullCourtDefense',292); if($answer -eq 6){exit 0}else{exit 1}`;
-        args = ['-NoProfile', '-NonInteractive', '-EncodedCommand', Buffer.from(script, 'utf16le').toString('base64')];
-    }
-    else if (process.platform === 'darwin') {
-        executable = '/usr/bin/osascript';
-        args = ['-e', 'on run argv', '-e', 'display dialog (item 1 of argv) buttons {"Deny", "Allow once"} default button "Deny" giving up after 60', '-e', 'if gave up of result or button returned of result is not "Allow once" then error number -128', '-e', 'end run', message];
-    }
-    else {
-        executable = 'zenity';
-        args = ['--question', '--default-cancel', '--title=FullCourtDefense', `--text=${message}`, '--ok-label=Allow once', '--cancel-label=Deny', `--timeout=${Math.ceil(timeoutMs / 1000)}`];
-    }
-    return new Promise(resolve => {
-        let finished = false;
-        const child = (0, child_process_1.spawn)(executable, args, { stdio: 'ignore', windowsHide: true });
-        const cancelChild = () => child.kill();
-        process.once('exit', cancelChild);
-        const done = (allowed) => { if (!finished) {
-            finished = true;
-            clearTimeout(timer);
-            process.removeListener('exit', cancelChild);
-            resolve(allowed);
-        } };
-        const timer = setTimeout(() => { child.kill(); done(false); }, timeoutMs + 1000);
-        child.on('error', () => done(false));
-        child.on('exit', code => done(code === 0));
-    });
-}
-async function evaluateNativeHook(client, raw, args, config, confirm = confirmNativeAction) {
+async function evaluateNativeHook(client, raw, args, config, confirm = devConfirm_1.confirmNativeAction) {
     if (client === 'codex' && raw.tool_name === 'apply_patch') {
         try {
             // Evaluate every file operation before Codex executes the atomic patch.
@@ -165,8 +127,13 @@ async function evaluateNativeHook(client, raw, args, config, confirm = confirmNa
         }
     }
     let payload;
+    const resolveCodexIdentity = client === 'codex' && String(raw.tool_name || '').startsWith('mcp__');
+    if (resolveCodexIdentity && !(0, codexMcpIdentity_1.loadTomlParser)()) {
+        // Degraded, never dead: policies still evaluate on the sanitized tool name.
+        process.stderr.write('FullCourtDefense: TOML parser unavailable in this install; Codex MCP server identity falls back to the sanitized tool name.\n');
+    }
     try {
-        payload = normalizeNativeInput(client, raw, client === 'codex' && String(raw.tool_name || '').startsWith('mcp__') ? (0, codexMcpIdentity_1.codexMcpServerNames)() : []);
+        payload = normalizeNativeInput(client, raw, resolveCodexIdentity ? (0, codexMcpIdentity_1.codexMcpServerNames)() : []);
     }
     catch (error) {
         return nativeErrorVerdict(client, `FullCourtDefense could not parse the hook: ${String(error)}`);
@@ -197,6 +164,10 @@ async function evaluateNativeHook(client, raw, args, config, confirm = confirmNa
             }
             catch { /* deny */ }
             denied = !allowed;
+            // Hand the click to the MCP gateway that will see this exact call next, so the
+            // developer is not asked twice for one action (single-use, 2-minute, exact digest).
+            if (allowed && call && mapped?.event === 'mcp')
+                (0, devConfirm_1.recordConfirmedAction)(call.toolName, (0, devConfirm_1.actionDigest)(call.toolArgs));
             (0, telemetry_1.spoolEvent)({ decision: allowed ? 'allow' : 'block', toolName: call?.toolName || payload.tool_name,
                 reason: allowed ? 'Developer approved once in the FullCourtDefense dialog.' : 'Developer declined, confirmation unavailable, or timed out.',
                 approvalScope: 'developer', ...(allowed ? { approvedBy: 'developer' } : {}) });

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.34.5"
+  "version": "1.34.7"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.34.5",
+  "version": "1.34.7",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {
@@ -94,8 +94,9 @@
     "test:agent-ci-gate": "npm run build && node scripts/test-agent-ci-gate.js",
     "test:ide-fp-corpus": "npm run build && node scripts/test-ide-fp-corpus.js",
     "test:ide-fp-corpus:hook": "npm run build && node scripts/test-ide-fp-corpus.js --hook",
+    "test:msi-payload-deps": "npm run build && node scripts/test-msi-payload-deps.js",
     "build:msi": "powershell -NoProfile -ExecutionPolicy Bypass -File installer/windows/Build-Msi.ps1",
-    "prepublishOnly": "npm run build && node scripts/test-shell-parity.js && node scripts/test-terminal-mcp-ask.js"
+    "prepublishOnly": "npm run build && node scripts/test-msi-payload-deps.js && node scripts/test-shell-parity.js && node scripts/test-terminal-mcp-ask.js"
   },
   "keywords": [
     "llm",