fullcourtdefense-cli 1.34.6 → 1.34.8

package/dist/actionPolicyEngine.js

@@ -96,6 +96,15 @@ exports.CONTENT_FACT_FIELDS = new Set([
 ]);
 /** Tool / operation names that mean "a file on this machine": read_file, edit_file, write_file, create_file, append_to_file, str_replace, ... */
 const LOCAL_FILE_ACTION_RE = /(?:^|_)(?:read|write|edit|create|append|save|touch|patch|replace|insert|update)(?:_(?:to|in|into))?_?(?:file|text|lines?|contents?)s?(?:$|_)|^(?:read|write|edit)$|^str_replace$/i;
+/**
+ * Tool names that remove a FILE (delete_file, remove_file, unlink, rm_file, the
+ * IDE Delete mapped to delete_file). Deliberately narrow: `delete_directory`,
+ * `kubectl_delete`, `delete_object`, or any delete-verb tool that merely carries
+ * a `path` argument is NOT the `file` kind — those keep matching typed DELETE
+ * rules exactly as before, so an argument can never talk an action out of a
+ * destructive-scope rule.
+ */
+const FILE_REMOVAL_TOOL_RE = /(?:^|_)(?:delete|remove|rm|unlink)_?(?:file|path)s?(?:$|_)|^unlink$/i;
 /** Does this rule need a content fact to fire? (A rule with no content constraint is about the ACTION, not the content.) */
 function ruleNeedsContentFact(rule) {
     return (rule.constraints || []).some(c => exports.CONTENT_FACT_FIELDS.has(c.field));
@@ -1668,6 +1677,19 @@ function inferToolContext(toolName, args) {
     if (args.amount !== undefined || args.price !== undefined || args.total !== undefined) {
         context.amount = String(args.amount ?? args.price ?? args.total);
     }
+    // WHAT KIND of action this is — the fact a typed rule means. One verb spans
+    // four kinds: DELETE is `rm -rf /` (shell destructive scope), `DELETE FROM`
+    // (SQL), `DELETE /api/x` (HTTP) and `delete_file` (one file). Policies are not
+    // filtered by resourceType (an "ANY + containsSecret" rule filed under
+    // `database` must still catch a token leaving through Slack), so a rule that
+    // means only one kind — "Block destructive SHELL commands" — constrains on
+    // this fact. Without it, cleaning up one temp file in the IDE was paused as a
+    // destructive shell command. Derived from the branches above, never guessed.
+    context['action.kind'] = isCodeExecTool || toolNameLower === 'shell' ? 'shell'
+        : context.query !== undefined && operation !== toolName && /^(SELECT|INSERT|UPDATE|DELETE|DROP|CREATE|ALTER|TRUNCATE|GRANT|REVOKE|SHOW|DESCRIBE|EXPLAIN)$/.test(operation) ? 'database'
+            : ['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'HEAD', 'OPTIONS'].includes(methodArg) ? 'http'
+                : context.path !== undefined && (operation === 'read' || operation === 'write' || LOCAL_FILE_ACTION_RE.test(toolName) || FILE_REMOVAL_TOOL_RE.test(toolName)) ? 'file'
+                    : 'tool';
     return { operation, context };
 }
 function inferInventoryToolOperations(toolName, toolActions = []) {

package/dist/commands/agentCi.js

@@ -41,6 +41,7 @@ const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const config_1 = require("../config");
 const discoverPaths_1 = require("./discoverPaths");
+const discoverProxy_1 = require("./discoverProxy");
 const discoverAgentFiles_1 = require("./discoverAgentFiles");
 const discoverSecrets_1 = require("./discoverSecrets");
 const discover_1 = require("./discover");
@@ -88,19 +89,6 @@ function parseTomlMcpServers(content) {
     }
     return servers;
 }
-function extractServerMap(parsed) {
-    if (!parsed || typeof parsed !== 'object')
-        return {};
-    if (parsed.mcpServers && typeof parsed.mcpServers === 'object')
-        return parsed.mcpServers;
-    if (parsed.servers && typeof parsed.servers === 'object')
-        return parsed.servers;
-    if (parsed.mcp?.servers && typeof parsed.mcp.servers === 'object')
-        return parsed.mcp.servers;
-    if (parsed['mcp.servers'] && typeof parsed['mcp.servers'] === 'object')
-        return parsed['mcp.servers'];
-    return {};
-}
 function riskSignalsForServer(name, server) {
     const text = [
         name,
@@ -129,7 +117,7 @@ function discoverMcpServers(cwd, extraPath) {
         const parsed = isToml
             ? parseTomlMcpServers(fs.readFileSync(candidate.path, 'utf8'))
             : parseJsonFile(candidate.path);
-        const map = extractServerMap(parsed);
+        const map = (0, discoverProxy_1.extractServerMap)(parsed);
         for (const [name, server] of Object.entries(map)) {
             const cfg = server;
             const command = typeof cfg.command === 'string' ? cfg.command : undefined;

package/dist/commands/discover.js

@@ -153,19 +153,6 @@ function deriveProjectRoots(candidates) {
     return [...roots];
 }
 /** MCP servers can be declared under several keys across clients. */
-function extractServerMap(parsed) {
-    if (!parsed || typeof parsed !== 'object')
-        return {};
-    if (parsed.mcpServers && typeof parsed.mcpServers === 'object')
-        return parsed.mcpServers;
-    if (parsed.servers && typeof parsed.servers === 'object')
-        return parsed.servers;
-    if (parsed.mcp?.servers && typeof parsed.mcp.servers === 'object')
-        return parsed.mcp.servers;
-    if (parsed['mcp.servers'] && typeof parsed['mcp.servers'] === 'object')
-        return parsed['mcp.servers'];
-    return {};
-}
 function parseTomlString(value) {
     const trimmed = value.trim().replace(/,$/, '');
     if (!trimmed)
@@ -347,7 +334,7 @@ function parseConfigFile(filePath, source) {
             return [];
     }
     const out = [];
-    for (const [name, cfgRaw] of Object.entries(extractServerMap(parsed))) {
+    for (const [name, cfgRaw] of Object.entries((0, discoverProxy_1.extractServerMap)(parsed))) {
         pushDiscoveredServer(out, name, cfgRaw, source, filePath);
     }
     // Claude Code stores MCP per-project inside ~/.claude.json

package/dist/commands/discoverProxy.d.ts

@@ -25,6 +25,29 @@ export interface ProxyClassifiableServer {
     configPath: string;
 }
 export declare function isFcdGatewayServer(server: ProxyClassifiableServer): boolean;
+/**
+ * The MCP server map of a parsed client config, whatever the client calls it:
+ * `mcpServers` (Cursor, Claude, Windsurf, Gemini), `servers` / `mcp.servers`
+ * (VS Code), `mcp_servers` (Codex TOML). Shared by discovery, agent-ci and the
+ * hook so every surface reads the same servers.
+ */
+export declare function extractServerMap(parsed: any): Record<string, any>;
+/**
+ * Every entry named `serverName` across this machine's AI-client MCP configs
+ * (Cursor, Claude Code incl. per-project maps in ~/.claude.json, Codex TOML,
+ * VS Code, Windsurf, Gemini, ...). Matches the exact name or the sanitized
+ * alias clients such as Codex expose (`patria-bank` -> `patria_bank`).
+ * Unreadable / unparsable files are skipped, never thrown.
+ */
+export declare function findClientMcpServers(serverName: string, cwd?: string, clientKey?: string): ProxyClassifiableServer[];
+/**
+ * True when every config entry for `serverName` — in the given client's configs
+ * when `clientKey` is set (`claude_code`, `vscode`, ...), else on the whole
+ * machine — runs through the FullCourtDefense MCP gateway. Unknown name, or the
+ * same name wrapped in one config and direct in another, is `false` — the caller
+ * keeps its own guard, so an action is at worst confirmed twice, never zero times.
+ */
+export declare function isServerBehindFcdGateway(serverName: string, cwd?: string, clientKey?: string): boolean;
 export declare function extractGatewayDownstream(server: ProxyClassifiableServer): {
     command?: string;
     args?: string[];

package/dist/commands/discoverProxy.js

@@ -36,6 +36,9 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.FCD_HOOK_TAG = exports.FCD_HOOK_MARKER = exports.FCD_GATEWAY_SERVER_NAMES = void 0;
 exports.isReferenceConfigSource = isReferenceConfigSource;
 exports.isFcdGatewayServer = isFcdGatewayServer;
+exports.extractServerMap = extractServerMap;
+exports.findClientMcpServers = findClientMcpServers;
+exports.isServerBehindFcdGateway = isServerBehindFcdGateway;
 exports.extractGatewayDownstream = extractGatewayDownstream;
 exports.buildGatewayWrapIndex = buildGatewayWrapIndex;
 exports.classifyProxyStatus = classifyProxyStatus;
@@ -46,6 +49,7 @@ const fs = __importStar(require("fs"));
 const os = __importStar(require("os"));
 const path = __importStar(require("path"));
 const discoverPaths_1 = require("./discoverPaths");
+const codexMcpIdentity_1 = require("../codexMcpIdentity");
 /**
  * Config sources that no AI client actually loads. A plain `mcp.json` at a
  * repo root is documentation/sample material — Cursor, Claude Code, VS Code,
@@ -76,6 +80,96 @@ function isFcdGatewayServer(server) {
     return blob.includes('mcp-gateway')
         && (blob.includes('fullcourtdefense') || blob.includes('agentguard') || blob.includes('botguard') || blob.includes('fcd-managed'));
 }
+/**
+ * The MCP server map of a parsed client config, whatever the client calls it:
+ * `mcpServers` (Cursor, Claude, Windsurf, Gemini), `servers` / `mcp.servers`
+ * (VS Code), `mcp_servers` (Codex TOML). Shared by discovery, agent-ci and the
+ * hook so every surface reads the same servers.
+ */
+function extractServerMap(parsed) {
+    if (!parsed || typeof parsed !== 'object')
+        return {};
+    if (parsed.mcpServers && typeof parsed.mcpServers === 'object')
+        return parsed.mcpServers;
+    if (parsed.mcp_servers && typeof parsed.mcp_servers === 'object')
+        return parsed.mcp_servers;
+    if (parsed.servers && typeof parsed.servers === 'object')
+        return parsed.servers;
+    if (parsed.mcp?.servers && typeof parsed.mcp.servers === 'object')
+        return parsed.mcp.servers;
+    if (parsed['mcp.servers'] && typeof parsed['mcp.servers'] === 'object')
+        return parsed['mcp.servers'];
+    return {};
+}
+function sanitizedServerAlias(name) {
+    return name.toLowerCase().replace(/[^a-z0-9_]/g, '_');
+}
+/**
+ * Every entry named `serverName` across this machine's AI-client MCP configs
+ * (Cursor, Claude Code incl. per-project maps in ~/.claude.json, Codex TOML,
+ * VS Code, Windsurf, Gemini, ...). Matches the exact name or the sanitized
+ * alias clients such as Codex expose (`patria-bank` -> `patria_bank`).
+ * Unreadable / unparsable files are skipped, never thrown.
+ */
+function findClientMcpServers(serverName, cwd = process.cwd(), clientKey) {
+    const wanted = serverName.toLowerCase();
+    const wantedAlias = sanitizedServerAlias(serverName);
+    const out = [];
+    for (const candidate of (0, discoverPaths_1.discoverScanTargets)(cwd)) {
+        if (clientKey && candidate.clientKey !== clientKey)
+            continue;
+        let parsed;
+        try {
+            const raw = fs.readFileSync(candidate.path, 'utf8').replace(/^\uFEFF/, '');
+            if (candidate.path.toLowerCase().endsWith('.toml')) {
+                const toml = (0, codexMcpIdentity_1.loadTomlParser)();
+                parsed = toml ? toml(raw) : null;
+            }
+            else {
+                parsed = JSON.parse(raw);
+            }
+        }
+        catch {
+            continue;
+        }
+        if (!parsed)
+            continue;
+        const maps = [extractServerMap(parsed)];
+        if (parsed.projects && typeof parsed.projects === 'object') {
+            for (const project of Object.values(parsed.projects))
+                maps.push(extractServerMap(project));
+        }
+        for (const map of maps) {
+            for (const [name, cfg] of Object.entries(map)) {
+                if (name.toLowerCase() !== wanted && sanitizedServerAlias(name) !== wantedAlias)
+                    continue;
+                if (!cfg || typeof cfg !== 'object')
+                    continue;
+                const entry = cfg;
+                out.push({
+                    serverName: name,
+                    command: typeof entry.command === 'string' ? entry.command : undefined,
+                    args: Array.isArray(entry.args) ? entry.args.map(String) : undefined,
+                    url: typeof entry.url === 'string' ? entry.url : typeof entry.endpoint === 'string' ? entry.endpoint : undefined,
+                    source: candidate.source,
+                    configPath: candidate.path,
+                });
+            }
+        }
+    }
+    return out;
+}
+/**
+ * True when every config entry for `serverName` — in the given client's configs
+ * when `clientKey` is set (`claude_code`, `vscode`, ...), else on the whole
+ * machine — runs through the FullCourtDefense MCP gateway. Unknown name, or the
+ * same name wrapped in one config and direct in another, is `false` — the caller
+ * keeps its own guard, so an action is at worst confirmed twice, never zero times.
+ */
+function isServerBehindFcdGateway(serverName, cwd = process.cwd(), clientKey) {
+    const matches = findClientMcpServers(serverName, cwd, clientKey);
+    return matches.length > 0 && matches.every(isFcdGatewayServer);
+}
 function extractGatewayDownstream(server) {
     const args = server.args || [];
     const urlIdx = args.indexOf('--mcp-url');

package/dist/commands/hook.d.ts

@@ -89,6 +89,41 @@ export declare function canonicalizeCursorPayload(argEvent: string | undefined,
     payload: Record<string, unknown>;
     ignore: boolean;
 };
+/**
+ * Cursor 3.19+ also fires GENERIC tool events — `preToolUse` / `postToolUse`
+ * (lower-camel `hook_event_name`, MCP tools named `MCP:<tool>`, built-ins by
+ * their tool name) — for the same action its dedicated hooks already report
+ * (`beforeMCPExecution` / `afterMCPExecution` / `beforeShellExecution` / ...).
+ * Evaluated as-is, one MCP call was judged three times: the generic pre-event
+ * (whose `MCP:` name matches no per-tool rule, so it fell through to broad
+ * company rules and raised a phantom manager approval), the dedicated
+ * pre-event, and the generic POST-event — judged as if the call were about to
+ * run, after it had already run.
+ *
+ *   preToolUse  -> ignore for MCP (beforeMCPExecution is the authoritative surface,
+ *                  same rule as Shell in normalizeCursorBuiltinTool); built-ins go
+ *                  through the shared taxonomy.
+ *   postToolUse -> a post-execution correlation signal, never enforced.
+ * Returns null for every other payload.
+ */
+export declare function canonicalizeCursorGenericToolEvent(payload: Record<string, unknown>): {
+    event: HookEvent;
+    payload: Record<string, unknown>;
+    ignore: boolean;
+} | null;
+/**
+ * The FullCourtDefense MCP gateway already sits in front of this server.
+ *  - Cursor reports the server's command line on `beforeMCPExecution`; ours is
+ *    `<node> <cli> mcp-gateway --mcp-command|--mcp-url ... --agent-name ...`
+ *    (Docker's MCP toolkit is `docker mcp gateway run` — no hyphen, no such flags).
+ *    When a command line is present it is authoritative.
+ *  - Claude Code / VS Code name the server (`mcp__<server>__<tool>`) but not its
+ *    command: the server is looked up in THAT client's MCP configs (`client` is
+ *    the hook's `--agent-client`, e.g. `claude-code` -> Claude Code's configs).
+ * Anything unknown is `false`: the hook then keeps its own guard, so an action
+ * is at worst confirmed twice, never zero times.
+ */
+export declare function isGatewayWrappedMcpServer(payload: Record<string, unknown>, client?: string, cwd?: string): boolean;
 /**
  * Map a Cursor execution-hook payload onto an Action Policy tool call.
  * Returns null when there is nothing actionable to evaluate.

package/dist/commands/hook.js

@@ -38,6 +38,8 @@ exports.canonicalBuiltinToolName = canonicalBuiltinToolName;
 exports.mapBuiltinToolPayload = mapBuiltinToolPayload;
 exports.normalizeCursorBuiltinTool = normalizeCursorBuiltinTool;
 exports.canonicalizeCursorPayload = canonicalizeCursorPayload;
+exports.canonicalizeCursorGenericToolEvent = canonicalizeCursorGenericToolEvent;
+exports.isGatewayWrappedMcpServer = isGatewayWrappedMcpServer;
 exports.buildToolCall = buildToolCall;
 exports.classifyGateHttpFailure = classifyGateHttpFailure;
 exports.gateHttpFailureDetail = gateHttpFailureDetail;
@@ -64,6 +66,7 @@ const devConfirm_1 = require("../devConfirm");
 // same rotated hook.log and read stdin identically.
 const hookIo_1 = require("../hookIo");
 const fileWriteCanon_1 = require("../fileWriteCanon");
+const discoverProxy_1 = require("./discoverProxy");
 function inferEvent(explicit, payload) {
     const e = (explicit || '').toLowerCase();
     if (e) {
@@ -200,6 +203,17 @@ const BUILTIN_WRITE_TOOLS = new Set([
     'write', 'edit', 'multiedit', 'notebookedit', 'createfile', 'editfiles', 'writefile', 'fswrite', 'replace',
     'replacestringinfile', 'editfile', 'applypatch', 'strreplaceeditor', 'insertedittofile', 'strreplace', 'editnotebook',
 ]);
+/**
+ * Built-ins that remove ONE file (Cursor `Delete`, Copilot `deleteFile`, …).
+ * Left unmapped they fell through as an unknown MCP tool named "Delete" — no
+ * path fact, operation = the tool name — and were judged as if a destructive
+ * shell command / SQL DELETE had been issued ("Block destructive shell
+ * commands" paused the clean-up of one temp file). Mapped, they are a FILE
+ * action: `delete_file {path}` → operation `delete`, `action.kind = file`,
+ * which the machine role ("Deletes pause for approval") and filesystem
+ * policies govern, and which typed DELETE rules exclude.
+ */
+const BUILTIN_DELETE_TOOLS = new Set(['delete', 'deletefile', 'removefile', 'fsdelete', 'rmfile', 'unlink', 'deletefiles']);
 /**
  * Built-ins that never touch a file, a command, a server or the outside world —
  * nothing to enforce. Web fetch / web search are deliberately NOT here: they
@@ -246,6 +260,11 @@ function mapBuiltinToolPayload(toolName, input, payload) {
         const content = (0, fileWriteCanon_1.newContentOnly)(filePath || undefined, delta || whole);
         return { event: 'file', payload: { ...payload, file_path: filePath, content } };
     }
+    if (BUILTIN_DELETE_TOOLS.has(canon)) {
+        const filePath = str(input.file_path) || str(input.path) || str(input.filePath) || str(input.target_file) || str(input.absolute_path)
+            || (Array.isArray(input.files) ? input.files.map((f) => str(f)).filter(Boolean).join(', ') : '');
+        return { event: 'file', payload: { ...payload, file_path: filePath, fcd_file_op: 'delete' } };
+    }
     if (BUILTIN_PASSIVE_TOOLS.has(canon))
         return { event: 'ignore', payload };
     return null;
@@ -293,6 +312,9 @@ function normalizeCursorBuiltinTool(payload) {
  * IDE false-positive corpus (Layer A) evaluates exactly what the hook evaluates.
  */
 function canonicalizeCursorPayload(argEvent, payload) {
+    const generic = canonicalizeCursorGenericToolEvent(payload);
+    if (generic)
+        return generic;
     const event = inferEvent(argEvent, payload);
     if (event !== 'mcp')
         return { event, payload, ignore: false };
@@ -303,6 +325,76 @@ function canonicalizeCursorPayload(argEvent, payload) {
         return { event: 'unknown', payload, ignore: true };
     return { event: builtin.event, payload: builtin.payload, ignore: false };
 }
+/** Cursor names MCP tools `MCP:<tool>` in its generic tool events. */
+const CURSOR_GENERIC_MCP_PREFIX = 'MCP:';
+/**
+ * Cursor 3.19+ also fires GENERIC tool events — `preToolUse` / `postToolUse`
+ * (lower-camel `hook_event_name`, MCP tools named `MCP:<tool>`, built-ins by
+ * their tool name) — for the same action its dedicated hooks already report
+ * (`beforeMCPExecution` / `afterMCPExecution` / `beforeShellExecution` / ...).
+ * Evaluated as-is, one MCP call was judged three times: the generic pre-event
+ * (whose `MCP:` name matches no per-tool rule, so it fell through to broad
+ * company rules and raised a phantom manager approval), the dedicated
+ * pre-event, and the generic POST-event — judged as if the call were about to
+ * run, after it had already run.
+ *
+ *   preToolUse  -> ignore for MCP (beforeMCPExecution is the authoritative surface,
+ *                  same rule as Shell in normalizeCursorBuiltinTool); built-ins go
+ *                  through the shared taxonomy.
+ *   postToolUse -> a post-execution correlation signal, never enforced.
+ * Returns null for every other payload.
+ */
+function canonicalizeCursorGenericToolEvent(payload) {
+    const hookEventName = str(payload.hook_event_name);
+    if (hookEventName !== 'preToolUse' && hookEventName !== 'postToolUse')
+        return null;
+    const toolName = str(payload.tool_name);
+    const isMcp = toolName.startsWith(CURSOR_GENERIC_MCP_PREFIX);
+    if (hookEventName === 'postToolUse') {
+        if (isMcp) {
+            return { event: 'post', payload: { ...payload, tool_name: toolName.slice(CURSOR_GENERIC_MCP_PREFIX.length), fcd_post_of: 'mcp' }, ignore: false };
+        }
+        const builtin = normalizeCursorBuiltinTool(payload);
+        if (!builtin || builtin.event === 'ignore')
+            return { event: 'unknown', payload, ignore: true };
+        return { event: 'post', payload: { ...builtin.payload, fcd_post_of: builtin.event }, ignore: false };
+    }
+    if (isMcp)
+        return { event: 'unknown', payload, ignore: true };
+    const builtin = normalizeCursorBuiltinTool(payload);
+    if (!builtin)
+        return null;
+    if (builtin.event === 'ignore')
+        return { event: 'unknown', payload, ignore: true };
+    return { event: builtin.event, payload: builtin.payload, ignore: false };
+}
+/**
+ * The FullCourtDefense MCP gateway already sits in front of this server.
+ *  - Cursor reports the server's command line on `beforeMCPExecution`; ours is
+ *    `<node> <cli> mcp-gateway --mcp-command|--mcp-url ... --agent-name ...`
+ *    (Docker's MCP toolkit is `docker mcp gateway run` — no hyphen, no such flags).
+ *    When a command line is present it is authoritative.
+ *  - Claude Code / VS Code name the server (`mcp__<server>__<tool>`) but not its
+ *    command: the server is looked up in THAT client's MCP configs (`client` is
+ *    the hook's `--agent-client`, e.g. `claude-code` -> Claude Code's configs).
+ * Anything unknown is `false`: the hook then keeps its own guard, so an action
+ * is at worst confirmed twice, never zero times.
+ */
+function isGatewayWrappedMcpServer(payload, client, cwd = process.cwd()) {
+    const command = str(payload.command);
+    if (command)
+        return /\bmcp-gateway\b/.test(command) && /--(?:mcp-command|mcp-url|mcp-args|agent-name)\b/.test(command);
+    const server = mcpServerName(payload);
+    if (!server)
+        return false;
+    const clientKey = client ? client.toLowerCase().replace(/-/g, '_') : undefined;
+    try {
+        return (0, discoverProxy_1.isServerBehindFcdGateway)(server, cwd, clientKey);
+    }
+    catch {
+        return false;
+    }
+}
 /**
  * Which AI client invoked a Claude-format hook. Claude Code sets CLAUDECODE=1;
  * VS Code Copilot runs hooks inside the VS Code process environment.
@@ -412,6 +504,14 @@ function buildToolCall(event, p) {
         }
         case 'file': {
             const filePath = str(p.file_path) || str(p.path);
+            // A built-in single-file removal (mapBuiltinToolPayload): no content to
+            // judge; the engine sees `delete_file {path}` → operation `delete`,
+            // `action.kind = file`.
+            if (str(p.fcd_file_op) === 'delete') {
+                if (!filePath)
+                    return null;
+                return { toolName: 'delete_file', toolArgs: { path: filePath } };
+            }
             const edits = p.edits;
             const rawContent = Array.isArray(edits)
                 ? edits.map((e) => str(e.new_text) || str(e.text) || str(e.content)).filter(Boolean).join('\n')
@@ -1746,6 +1846,17 @@ async function enforceActionPolicy(ctx) {
     }
     // Record untrusted ingress for this event (never blocks).
     (0, taintLedger_1.noteIngress)(sessId, event, call.toolName, call.toolArgs);
+    // ONE enforcement point per MCP call. A server the FullCourtDefense MCP gateway
+    // wraps is checked by the gateway in-line — same vendored engine, same cached
+    // policies, one developer dialog, one org approval, one audit record. Judging
+    // it here as well gave one action two prompts (IDE ask + gateway dialog) and
+    // two approval requests. Local Safety, taint and the self-protection guards
+    // above still ran; only the Action Policy step is the gateway's.
+    if (event === 'mcp' && isGatewayWrappedMcpServer(payload, ctx.client)) {
+        (0, hookIo_1.dbg)({ phase: 'policy_deferred_to_gateway', event, tool: call.toolName, server: mcpServerName(payload) });
+        respond(false);
+        return;
+    }
     const headers = { 'Content-Type': 'application/json' };
     if (shieldKey)
         headers['x-shield-key'] = shieldKey;

package/dist/commands/mcpGateway.js

@@ -969,6 +969,12 @@ function describeDeveloperNo(answer) {
             explanation: 'You did not answer the confirmation prompt in time',
         };
     }
+    if (answer.answer === 'unavailable') {
+        return {
+            reason: 'developer confirmation not possible (no dialog can be shown on this machine and the MCP client offers no prompt)',
+            explanation: 'This rule needs your confirmation, but no confirmation prompt can be shown here (no display and the client cannot ask)',
+        };
+    }
     return {
         reason: `developer declined in ${via}${autoNote}`,
         explanation: 'You declined the confirmation prompt',
@@ -983,8 +989,8 @@ class McpGatewayServer {
     api;
     /**
      * The MCP client declared `capabilities.elicitation` on initialize — it can
-     * show the user a server-initiated question. That is the only channel a stdio
-     * proxy has to "Ask the developer"; without it an ask rule fails strict.
+     * show the user a server-initiated question. Used only when no OS dialog can be
+     * shown (headless) or when `FCD_CONFIRM_CHANNEL=mcp-client` — see confirmWithDeveloper.
      */
     clientSupportsElicitation = false;
     /** Server -> client requests (elicitation) awaiting the client's response, by id. */
@@ -1892,7 +1898,7 @@ class McpGatewayServer {
         });
         (0, telemetry_1.spoolEvent)({
             decision: 'approval', toolName, operation,
-            reason: `developer confirmation requested via ${this.clientSupportsElicitation ? 'MCP client prompt' : 'FullCourtDefense dialog'}${policyLabel}${verdict.reason ? `: ${verdict.reason}` : ''}`,
+            reason: `developer confirmation requested via ${(0, devConfirm_1.nativeDialogAvailable)() ? 'FullCourtDefense dialog' : this.clientSupportsElicitation ? 'MCP client prompt' : 'FullCourtDefense dialog'}${policyLabel}${verdict.reason ? `: ${verdict.reason}` : ''}`,
             ruleId, offlineEnforced: true, approvalScope: 'developer',
         });
         (0, telemetry_1.triggerFlush)(false);
@@ -1929,41 +1935,60 @@ class McpGatewayServer {
         throw blockError(explainGatewayPolicy('block', toolName, toolArgs, verdict, policies, `${no.explanation}, so this tool call was not executed.`));
     }
     /**
-     * "Ask the developer" that works in every MCP client. Order:
-     *   1. no human on this machine            => unavailable (caller blocks)
-     *   2. client advertises elicitation       => in-client prompt
-     *        accept / human-speed decline / timeout => that IS the developer's answer
-     *        decline faster than a human can read (the client answered for the
-     *        user — Codex Desktop "Full access" declines every elicitation without
-     *        showing it) or an error response => fall through to 3
-     *   3. OS-owned dialog (PowerShell popup / osascript / zenity)
-     * Every path that is not an explicit "yes" from a human ends in a block.
+     * "Ask the developer" — ONE dialog, the same in every MCP client.
+     *
+     * The FullCourtDefense OS dialog (PowerShell popup / osascript / zenity) is the
+     * channel. It is owned by this process, not by the IDE, so the agent cannot
+     * answer it and the client cannot answer it for the user. In-client prompts
+     * (MCP elicitation) turned out to be unreliable exactly where it matters:
+     * Codex Desktop "Full access" declines every elicitation in milliseconds,
+     * Cursor 3.19 declines it after ~20s without rendering it — in both cases the
+     * developer saw nothing and the audit said "declined". Order:
+     *   1. no human on this machine                 => unavailable (caller blocks)
+     *   2. the IDE hook's dialog already confirmed  => accept (same call, not asked twice)
+     *      THIS exact call moments ago
+     *   3. OS dialog                                => the developer's answer
+     *   4. no dialog possible (headless, no display, => in-client prompt if the client
+     *      binary missing)                             supports it; a client that answers
+     *                                                  for the user is still a "no"
+     * `FCD_CONFIRM_CHANNEL=mcp-client` swaps 3 and 4 for clients whose in-chat prompt
+     * an org has verified. Every path that is not an explicit "yes" from a human
+     * ends in a block.
      */
     async confirmWithDeveloper(input) {
         if (!(0, devConfirm_1.isHumanPresent)())
             return { answer: 'unavailable', remember: false, latencyMs: 0, clientAutoAnswered: false };
-        // 0. The IDE hook already showed the OS dialog for THIS call (same tool, same
-        //    args) and the developer clicked "Allow once" moments ago.
         const handoff = input.argsDigest ? (0, devConfirm_1.consumeConfirmedAction)(input.toolName, input.argsDigest) : undefined;
         if (handoff) {
             return { answer: 'accept', remember: false, latencyMs: Math.max(0, Date.now() - Date.parse(handoff.confirmedAt)), channel: 'hook_dialog', clientAutoAnswered: false };
         }
+        const preferClient = (process.env.FCD_CONFIRM_CHANNEL || '').toLowerCase() === 'mcp-client' && this.clientSupportsElicitation;
         let clientAutoAnswered = false;
-        if (this.clientSupportsElicitation) {
+        if (preferClient) {
             const viaClient = await this.elicitDeveloperConfirmation(input);
             const automated = viaClient.clientError || (0, devConfirm_1.looksLikeClientAutoAnswer)(viaClient.answer, viaClient.latencyMs);
             if (!automated)
                 return { ...viaClient, channel: 'mcp_client', clientAutoAnswered: false };
             clientAutoAnswered = true;
-            process.stderr.write(`FullCourtDefense: the MCP client answered the confirmation prompt for ${input.toolName} by itself in ${viaClient.latencyMs}ms (no dialog reached the developer — e.g. Codex "Full access"); asking in the FullCourtDefense dialog instead.\n`);
+            process.stderr.write(`FullCourtDefense: the MCP client answered the confirmation prompt for ${input.toolName} by itself in ${viaClient.latencyMs}ms (no prompt reached the developer); asking in the FullCourtDefense dialog instead.\n`);
         }
-        const started = Date.now();
+        const dialog = await this.askInOsDialog(input, clientAutoAnswered);
+        if (dialog.answer !== 'unavailable')
+            return dialog;
+        if (!preferClient && this.clientSupportsElicitation) {
+            process.stderr.write(`FullCourtDefense: no dialog can be shown on this machine for ${input.toolName} (headless / no display); asking through the MCP client prompt instead.\n`);
+            const viaClient = await this.elicitDeveloperConfirmation(input);
+            const automated = viaClient.clientError || (0, devConfirm_1.looksLikeClientAutoAnswer)(viaClient.answer, viaClient.latencyMs);
+            return { ...viaClient, answer: automated ? 'decline' : viaClient.answer, channel: 'mcp_client', clientAutoAnswered: automated };
+        }
+        return dialog;
+    }
+    async askInOsDialog(input, clientAutoAnswered) {
         const evidence = input.evidence ? `\nEvidence: ${input.evidence.slice(0, 240)}` : '';
-        const allowed = await (0, devConfirm_1.confirmNativeAction)(`Agent: ${this.gatewayConfig.agentName}\nIDE: ${this.gatewayConfig.agentClient}\nDeveloper: ${this.gatewayConfig.developerName || 'Unknown'}\nTool: ${input.toolName}\nRule: ${input.ruleLabel}\nWhy: ${input.reason}${evidence}\n\nYour answer is reported to your security dashboard as your decision.`, OS_DIALOG_TIMEOUT_MS);
-        const latencyMs = Date.now() - started;
-        // The dialog cannot tell "Deny" from "closed / timed out" — both are a no.
-        const timedOut = !allowed && latencyMs >= OS_DIALOG_TIMEOUT_MS - 500;
-        return { answer: allowed ? 'accept' : timedOut ? 'timeout' : 'decline', remember: false, latencyMs, channel: 'os_dialog', clientAutoAnswered };
+        const dialog = await (0, devConfirm_1.confirmNativeActionDetailed)(`Agent: ${this.gatewayConfig.agentName}\nIDE: ${this.gatewayConfig.agentClient}\nDeveloper: ${this.gatewayConfig.developerName || 'Unknown'}\nTool: ${input.toolName}\nRule: ${input.ruleLabel}\nWhy: ${input.reason}${evidence}\n\nYour answer is reported to your security dashboard as your decision.`, OS_DIALOG_TIMEOUT_MS);
+        process.stderr.write(`FullCourtDefense: dialog for ${input.toolName} ended with "${dialog.outcome}" after ${dialog.latencyMs}ms.\n`);
+        const answer = dialog.outcome === 'allow' ? 'accept' : dialog.outcome === 'deny' ? 'decline' : dialog.outcome;
+        return { answer, remember: false, latencyMs: dialog.latencyMs, channel: 'os_dialog', clientAutoAnswered };
     }
     async elicitDeveloperConfirmation(input) {
         const started = Date.now();
@@ -1990,6 +2015,9 @@ class McpGatewayServer {
             },
         }, ELICITATION_TIMEOUT_MS);
         const latencyMs = Date.now() - started;
+        // One diagnostic line per answer — this is how "the developer saw no prompt but
+        // the call was blocked" gets diagnosed from the IDE's MCP log alone.
+        process.stderr.write(`FullCourtDefense: MCP client answered the confirmation prompt for ${input.toolName} in ${latencyMs}ms: ${response ? JSON.stringify(response.error ? { error: response.error } : response.result).slice(0, 300) : 'no answer (timeout)'}\n`);
         if (!response)
             return { answer: 'timeout', remember: false, latencyMs };
         // A JSON-RPC error ("method not found", "not supported in this mode") means no

package/dist/devConfirm.d.ts

@@ -19,6 +19,18 @@ export declare function looksLikeClientAutoAnswer(answer: 'accept' | 'decline' |
  * timeout, a missing dialog binary or no human present all resolve `false`.
  */
 export declare function confirmNativeAction(reason: string, timeoutMs?: number): Promise<boolean>;
+/**
+ * How the OS dialog ended. `unavailable` = no dialog could be shown at all (no human,
+ * no display, dialog binary missing / failed to start) — the caller may try another
+ * channel. `deny` covers Deny, closing the window and the dialog's own give-up.
+ */
+export type NativeDialogOutcome = 'allow' | 'deny' | 'timeout' | 'unavailable';
+/** True when this process can put a dialog in front of a person on this machine. */
+export declare function nativeDialogAvailable(): boolean;
+export declare function confirmNativeActionDetailed(reason: string, timeoutMs?: number): Promise<{
+    outcome: NativeDialogOutcome;
+    latencyMs: number;
+}>;
 export interface PendingConfirmation {
     /** Stable key: sha256(event|toolName|argsDigest). */
     key: string;

package/dist/devConfirm.js

@@ -36,6 +36,8 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.CONFIRMED_ACTION_TTL_MS = exports.CONFIRM_PENDING_TTL_MS = exports.MIN_HUMAN_ANSWER_MS = void 0;
 exports.looksLikeClientAutoAnswer = looksLikeClientAutoAnswer;
 exports.confirmNativeAction = confirmNativeAction;
+exports.nativeDialogAvailable = nativeDialogAvailable;
+exports.confirmNativeActionDetailed = confirmNativeActionDetailed;
 exports.isCiEnvironment = isCiEnvironment;
 exports.isHumanPresent = isHumanPresent;
 exports.actionDigest = actionDigest;
@@ -98,8 +100,20 @@ function looksLikeClientAutoAnswer(answer, latencyMs) {
  * timeout, a missing dialog binary or no human present all resolve `false`.
  */
 async function confirmNativeAction(reason, timeoutMs = 60_000) {
+    return (await confirmNativeActionDetailed(reason, timeoutMs)).outcome === 'allow';
+}
+/** True when this process can put a dialog in front of a person on this machine. */
+function nativeDialogAvailable() {
     if (!isHumanPresent())
         return false;
+    if (process.platform === 'win32' || process.platform === 'darwin')
+        return true;
+    return Boolean(process.env.DISPLAY || process.env.WAYLAND_DISPLAY);
+}
+async function confirmNativeActionDetailed(reason, timeoutMs = 60_000) {
+    if (!nativeDialogAvailable())
+        return { outcome: 'unavailable', latencyMs: 0 };
+    const started = Date.now();
     let executable;
     let args;
     const message = `FullCourtDefense — developer approval\n\n${reason.slice(0, 1800)}\n\nAllow this action once?`;
@@ -123,18 +137,35 @@ async function confirmNativeAction(reason, timeoutMs = 60_000) {
     }
     return new Promise(resolve => {
         let finished = false;
-        const child = (0, child_process_1.spawn)(executable, args, { stdio: 'ignore', windowsHide: true });
-        const cancelChild = () => child.kill();
-        process.once('exit', cancelChild);
-        const done = (allowed) => { if (!finished) {
+        let child;
+        const done = (outcome) => {
+            if (finished)
+                return;
             finished = true;
             clearTimeout(timer);
             process.removeListener('exit', cancelChild);
-            resolve(allowed);
-        } };
-        const timer = setTimeout(() => { child.kill(); done(false); }, timeoutMs + 1000);
-        child.on('error', () => done(false));
-        child.on('exit', code => done(code === 0));
+            resolve({ outcome, latencyMs: Date.now() - started });
+        };
+        const cancelChild = () => child?.kill();
+        const timer = setTimeout(() => { child?.kill(); done('timeout'); }, timeoutMs + 1000);
+        try {
+            child = (0, child_process_1.spawn)(executable, args, { stdio: 'ignore', windowsHide: true });
+        }
+        catch {
+            done('unavailable');
+            return;
+        }
+        process.once('exit', cancelChild);
+        // Spawn failure (binary missing, no permission) = nothing was shown. A child
+        // that ran and exited non-zero = the person (or the dialog's give-up) said no;
+        // the dialog cannot tell Deny from close from give-up, so a "no" that arrives
+        // at the deadline is reported as a timeout.
+        child.on('error', () => done('unavailable'));
+        child.on('exit', code => {
+            if (code === 0)
+                return done('allow');
+            done(Date.now() - started >= timeoutMs - 500 ? 'timeout' : 'deny');
+        });
     });
 }
 /** A raised confirmation that received no post-execution signal in time counts as not approved. */

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.34.6"
+  "version": "1.34.8"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.34.6",
+  "version": "1.34.8",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {