fullcourtdefense-cli 1.35.7 → 1.35.9

package/dist/commands/hook.js

@@ -33,6 +33,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.DaemonDeclined = void 0;
 exports.normalizeClaudePayload = normalizeClaudePayload;
 exports.canonicalBuiltinToolName = canonicalBuiltinToolName;
 exports.mapBuiltinToolPayload = mapBuiltinToolPayload;
@@ -44,13 +45,17 @@ exports.buildToolCall = buildToolCall;
 exports.classifyGateHttpFailure = classifyGateHttpFailure;
 exports.gateHttpFailureDetail = gateHttpFailureDetail;
 exports.readBackendError = readBackendError;
+exports.humanWaitDeadline = humanWaitDeadline;
+exports.crashVerdictForProcess = crashVerdictForProcess;
 exports.evaluateHookRequest = evaluateHookRequest;
 exports.hookCommand = hookCommand;
+exports.installHookCrashHandlers = installHookCrashHandlers;
 const os = __importStar(require("os"));
 const config_1 = require("../config");
 const runtimeConfig_1 = require("../runtimeConfig");
 const telemetry_1 = require("../telemetry");
 const actionIdentity_1 = require("../actionIdentity");
+const callerEnv_1 = require("../callerEnv");
 const deterministicGuard_1 = require("./deterministicGuard");
 const localSafetySnapshot_1 = require("../localSafetySnapshot");
 const taintLedger_1 = require("./taintLedger");
@@ -69,6 +74,7 @@ const askDialog_1 = require("../askDialog");
 const hookIo_1 = require("../hookIo");
 const fileWriteCanon_1 = require("../fileWriteCanon");
 const discoverProxy_1 = require("./discoverProxy");
+const shellAstLoader_1 = require("../shellAstLoader");
 function inferEvent(explicit, payload) {
     const e = (explicit || '').toLowerCase();
     if (e) {
@@ -176,10 +182,17 @@ function mapClaudeToolPayload(payload) {
             payload: { ...payload, tool_name: shortTool, mcp_server_name: server, tool_input: input },
         };
     }
-    // Glob/Grep/Task/WebFetch/etc. — no enforcement surface; let the client's own
+    // Built-in web readers (Claude `WebFetch`, Copilot `fetch_webpage` / `web_fetch`,
+    // Hermes `web_extract`) are an HTTP GET judged by host — the same MCP-shaped call
+    // Cursor already sends, so destination rules and Local Safety network rules apply.
+    if (BUILTIN_WEB_READ_TOOLS.has(canonicalBuiltinToolName(toolName))) {
+        return { event: 'mcp', payload: { ...payload, tool_name: toolName, tool_input: input } };
+    }
+    // Glob/Grep/Task/WebSearch/etc. — no enforcement surface; let the client's own
     // permission flow handle them.
     return mapBuiltinToolPayload(toolName, input, payload) ?? { event: 'ignore', payload };
 }
+const BUILTIN_WEB_READ_TOOLS = new Set(['webfetch', 'fetchwebpage', 'webextract']);
 // ---------------------------------------------------------------------------
 // Built-in IDE tools — ONE taxonomy for every client.
 //
@@ -402,9 +415,10 @@ function isGatewayWrappedMcpServer(payload, client, cwd = process.cwd()) {
  * VS Code Copilot runs hooks inside the VS Code process environment.
  */
 function claudeFormatClient() {
-    if (process.env.CLAUDECODE || process.env.CLAUDE_PROJECT_DIR)
+    const env = (0, callerEnv_1.callerEnv)();
+    if (env.CLAUDECODE || env.CLAUDE_PROJECT_DIR)
         return 'claude-code';
-    if (process.env.VSCODE_PID || process.env.TERM_PROGRAM === 'vscode')
+    if (env.VSCODE_PID || env.TERM_PROGRAM === 'vscode')
         return 'vscode';
     return 'claude-code';
 }
@@ -552,6 +566,7 @@ function spoolCallEvent(call, rest) {
         toolName: call.toolName,
         operation: rest.operation || operation,
         evidence: rest.evidence || (0, telemetry_1.evidenceFromToolArgs)(call.toolArgs),
+        shellAst: rest.shellAst || (0, shellAstLoader_1.collectShellAstFacts)(),
     });
 }
 /**
@@ -826,7 +841,7 @@ function prepareDeveloperConfirmation(event, call, payload, source) {
     const grantLimits = (0, devConfirm_1.resolveGrantLimits)(source.grantCaps, (0, runtimeConfig_1.getCachedDeveloperGrantPolicy)());
     const grant = source.remember === 'none' ? undefined : (0, devConfirm_1.findDeveloperGrant)(grantScope, { policyId: source.policyId, matchedRule: source.matchedRule, policyHash: memoryHash }, grantLimits);
     if (grant) {
-        const covers = (0, devConfirm_1.describeGrantScope)(grant.scope);
+        const covers = (0, devConfirm_1.describeGrantScope)(grant.scope, grant);
         (0, hookIo_1.dbg)({ phase: 'dev_confirm_granted', event, tool: call.toolName, operation, grant: grant.key, where: source.where });
         spoolCallEvent(call, {
             decision: 'allow',
@@ -838,7 +853,7 @@ function prepareDeveloperConfirmation(event, call, payload, source) {
             offlineEnforced,
         });
         (0, telemetry_1.triggerFlush)(false);
-        return { outcome: 'allow', agentMsg: `FullCourtDefense: the developer has a standing "Always allow" for ${covers} under this rule.` };
+        return { outcome: 'allow', agentMsg: `FullCourtDefense: the developer has a standing "Always allow" for ${covers}.` };
     }
     const marker = (0, devConfirm_1.raiseDeveloperConfirmation)({
         event,
@@ -964,18 +979,25 @@ function tryLocalPolicyEnforcement(ctx, call, detail, opts = {}) {
     });
     const declaredOperations = (0, actionPolicyEngine_1.deriveToolOperations)(call.toolName);
     const local = (0, actionPolicyEngine_1.evaluateActionPolicies)(policies, call.toolName, operation, context, declaredOperations);
-    (0, hookIo_1.dbg)({ phase: 'policy_local_verdict', event: ctx.event, tool: call.toolName, operation, verdict: local.verdict, policyName: local.policyName, detail });
+    (0, hookIo_1.dbg)({ phase: 'policy_local_verdict', event: ctx.event, tool: call.toolName, operation, verdict: local.verdict, policyName: local.policyName, detail, astMode: (0, actionPolicyEngine_1.getShellAstMode)() });
     // Developer-scoped approvals need no backend at all — the IDE prompt IS the approver.
     if (tryDeveloperConfirmation(ctx, call, local, ctx.payload, 'offline'))
         return true;
+    // Monitor machines land here by design (zero synchronous network calls), not
+    // because anything is down — never tell the developer the service is
+    // unreachable when it is simply not consulted.
+    const monitorPath = opts.countAsGateFailure === false;
     if (local.verdict === 'block' || local.verdict === 'require_approval') {
         const reason = local.reason || `${call.toolName}: local policy ${local.verdict}`;
         if (ctx.shadow) {
             // Truth-in-reporting: the action RAN — 'warn' (advisory), never 'allow'
             // (which hides the would-block from the console) and never 'block'.
-            spoolCallEvent(call, { decision: 'warn', ruleId: local.policyId, policyHash: ctx.effectivePolicyHash, reason: `[monitor] local policy would ${local.verdict} (offline): ${reason}`, offlineEnforced: true });
+            const would = local.verdict === 'block' ? 'block' : 'require approval for';
+            spoolCallEvent(call, { decision: 'warn', ruleId: local.policyId, policyHash: ctx.effectivePolicyHash, reason: `[monitor] local policy would ${local.verdict}${monitorPath ? '' : ' (offline)'}: ${reason}`, offlineEnforced: true });
             (0, telemetry_1.triggerFlush)(false);
-            ctx.respond(false, undefined, `[FullCourtDefense shadow] would ${local.verdict === 'block' ? 'block' : 'require approval for'} ${call.toolName} (offline, locally cached policy): ${reason}`);
+            ctx.respond(false, undefined, monitorPath
+                ? `[FullCourtDefense shadow] would ${would} ${call.toolName}${local.policyName ? ` (${local.policyName})` : ''}: ${reason} — this machine is in Monitor mode, so nothing was blocked.`
+                : `[FullCourtDefense shadow] would ${would} ${call.toolName} (offline, locally cached policy): ${reason}`);
         }
         const approvalNote = local.verdict === 'require_approval'
             ? ' This action requires human approval, which is not possible while the policy service is unreachable.'
@@ -985,10 +1007,6 @@ function tryLocalPolicyEnforcement(ctx, call, detail, opts = {}) {
         const explained = explainPolicyStop('block', ctx.event, call, local, policies, `Enforced from the locally cached policy while the policy service is unreachable (${detail}).${approvalNote}`);
         ctx.respond(true, explained.userMessage, `${explained.agentMessage} Do not retry until the connection is restored or the policy allows it.`);
     }
-    // Monitor machines land here by design (zero synchronous network calls), not
-    // because anything is down — never tell the developer the service is
-    // unreachable when it is simply not consulted.
-    const monitorPath = opts.countAsGateFailure === false;
     if (local.verdict === 'log') {
         // Warn-only rule, offline: still a real warning + Warned in the fleet.
         const warning = warnByPolicy(call, local, ctx.event, ctx.exitsProcess, 'local-first');
@@ -1094,7 +1112,7 @@ function machineMetadata(client = 'cursor') {
         os: `${os.platform()} ${os.release()}`,
         username,
         cwd: process.cwd(),
-        workspacePath: process.env.WORKSPACE_PATH || process.env.CLAUDE_PROJECT_DIR || process.cwd(),
+        workspacePath: (0, callerEnv_1.callerEnv)().WORKSPACE_PATH || (0, callerEnv_1.callerEnv)().CLAUDE_PROJECT_DIR || process.cwd(),
         agentClient: client,
     };
 }
@@ -1219,6 +1237,40 @@ class HookExitSignal {
         this.code = code;
     }
 }
+/**
+ * The daemon declines a request whose verdict is a human wait (org approval,
+ * taint approve-once). The thin client stops listening after ~2.5s and
+ * re-evaluates locally, so a daemon-side wait only opened a second approval
+ * request nobody would ever read. Declining sends the client to its local
+ * evaluation at once, where the one wait runs in the developer's own process.
+ */
+class DaemonDeclined extends Error {
+}
+exports.DaemonDeclined = DaemonDeclined;
+/**
+ * The shortest pre-tool hook timeout any installer writes for an
+ * approval-capable event (Claude Code / Copilot / VS Code and Cursor: 90s; the
+ * native adapter's own process deadline is 110s). When a client kills a hook on
+ * timeout it runs the action — so every human wait must END, with a deny,
+ * before this. FCD_HOOK_IDE_TIMEOUT_MS narrows it for drills.
+ */
+const IDE_HOOK_TIMEOUT_MS = 90_000;
+const IDE_TIMEOUT_MARGIN_MS = 15_000;
+/** Absolute time a human wait must end by: its own cap, and never past the IDE's timeout. */
+function humanWaitDeadline(waitMs, now = Date.now(), startedAt = (0, telemetry_1.verdictStartedAt)() ?? now, ideTimeoutMs = Number((0, callerEnv_1.callerEnv)().FCD_HOOK_IDE_TIMEOUT_MS) > 0 ? Number((0, callerEnv_1.callerEnv)().FCD_HOOK_IDE_TIMEOUT_MS) : IDE_HOOK_TIMEOUT_MS) {
+    return Math.min(now + waitMs, startedAt + ideTimeoutMs - Math.min(IDE_TIMEOUT_MARGIN_MS, ideTimeoutMs / 4));
+}
+/**
+ * Per-event hook process only (full, slim and native entries): set once the
+ * verdict is a stop (approval pending). A crash after this point must deny —
+ * the fail-open wrapper would otherwise turn a pending approval into an allow.
+ * Never set in the daemon, which evaluates many requests in one process.
+ */
+let processPendingStop;
+/** Verdict for an unexpected error that escaped the evaluation (process-level handlers). */
+function crashVerdictForProcess(event, message) {
+    return failOpenOutcome(event, message, undefined, undefined, processPendingStop);
+}
 function processIo(stdin, stdinErr) {
     return {
         stdin,
@@ -1238,8 +1290,11 @@ function processIo(stdin, stdinErr) {
  * Mirrors hookCommand's fail-open contract: any unexpected exception yields
  * an allow verdict, never an error the thin client would surface.
  */
-async function evaluateHookRequest(args, stdinRaw, config) {
-    return evaluateBuffered(args, stdinRaw, '', config, { isTTY: false, exitsProcess: false });
+async function evaluateHookRequest(args, stdinRaw, config, opts = {}) {
+    // Structural shell facts (shadow by default). A missing/slow parser means
+    // "no facts" and the regex floor decides alone — never a wait, never fail-open.
+    await (0, shellAstLoader_1.ensureShellAst)();
+    return evaluateBuffered(args, stdinRaw, '', config, { isTTY: false, exitsProcess: false, viaDaemon: opts.viaDaemon });
 }
 /**
  * Run the hook against a buffered io and return the verdict instead of writing
@@ -1258,6 +1313,7 @@ async function evaluateBuffered(args, stdinRaw, stdinErr, config, mode) {
         writeErr: (text) => { errOut += text; },
         exit: (code) => { throw new HookExitSignal(code); },
         exitsProcess: mode.exitsProcess,
+        viaDaemon: mode.viaDaemon,
     };
     try {
         await hookCommandInner(args, config, io);
@@ -1269,11 +1325,13 @@ async function evaluateBuffered(args, stdinRaw, stdinErr, config, mode) {
         if (err instanceof HookExitSignal) {
             return { stdout: out, stderr: errOut, exitCode: err.code };
         }
+        if (err instanceof DaemonDeclined)
+            throw err;
         const message = err instanceof Error ? err.message : String(err);
         // Same contract as the process-level wrapper, including the kill-switch
         // exception: a crash during daemon-side evaluation must not unlock a
         // suspended machine.
-        const outcome = failOpenOutcome(args.event, `${message} (daemon eval)`, args, config);
+        const outcome = failOpenOutcome(args.event, `${message} (daemon eval)`, args, config, io.pendingStop);
         return { stdout: outcome.stdout, stderr: '', exitCode: outcome.exitCode };
     }
 }
@@ -1293,7 +1351,27 @@ async function hookCommand(args, config) {
     const startedAt = Date.now();
     return (0, telemetry_1.markVerdictTiming)({ startedAt, path: 'local' }, () => hookCommandOuter(args, config, startedAt));
 }
+/**
+ * Errors that escape every await (an async 'error' event from a child process,
+ * a stray rejection) never reach the try/catch around the evaluation. Without
+ * these handlers Node prints a stack and exits 1 with NO verdict, which every
+ * client reads as a non-blocking hook error — the action runs. Route them
+ * through the same contract as a caught crash instead.
+ */
+function installHookCrashHandlers(verdict) {
+    const onCrash = (err) => {
+        const outcome = verdict(err instanceof Error ? err.message : String(err));
+        try {
+            process.stdout.write(outcome.stdout);
+        }
+        catch { /* stdout gone */ }
+        process.exit(outcome.exitCode);
+    };
+    process.on('uncaughtException', onCrash);
+    process.on('unhandledRejection', onCrash);
+}
 async function hookCommandOuter(args, config, startedAt) {
+    installHookCrashHandlers((message) => crashVerdictForProcess(args.event, message));
     try {
         let raw = '';
         let stdinErr = '';
@@ -1319,6 +1397,11 @@ async function hookCommandOuter(args, config, startedAt) {
             // machine that silently stopped using the fast path is diagnosable.
             (0, hookIo_1.dbg)({ phase: 'ipc_unavailable', event: args.event, detail: ipc.detail });
         }
+        // Structural shell facts for the local evaluation (shadow by default; the
+        // daemon path above initialises its own copy once). Bounded: a slow or
+        // missing parser resolves to "no facts" and the regex floor decides alone.
+        const astReady = await (0, shellAstLoader_1.ensureShellAst)();
+        (0, hookIo_1.dbg)({ phase: 'shell_ast', ready: astReady, status: (0, shellAstLoader_1.shellAstStatus)() });
         // Buffered so an `ask` can be put to the developer in OUR dialog before the
         // IDE reads the verdict; exitsProcess stays true — this process ends right after.
         const result = await evaluateBuffered(args, raw, stdinErr, config, { isTTY: !!process.stdin.isTTY, exitsProcess: true });
@@ -1326,7 +1409,7 @@ async function hookCommandOuter(args, config, startedAt) {
     }
     catch (err) {
         const message = err instanceof Error ? err.message : String(err);
-        const outcome = failOpenOutcome(args.event, message, args, config);
+        const outcome = failOpenOutcome(args.event, message, args, config, processPendingStop);
         try {
             process.stdout.write(outcome.stdout);
         }
@@ -1344,8 +1427,29 @@ async function hookCommandOuter(args, config, startedAt) {
  * machines still deny. An enforcing Shield with fail-closed also denies
  * evaluation failures; Monitor and fail-open configurations continue.
  */
-function failOpenOutcome(event, message, args, config) {
+function failOpenOutcome(event, message, args, config, pendingStop) {
     const toolName = event || 'unknown';
+    if (pendingStop) {
+        // The verdict was already a stop (approval requested, not granted) when the
+        // error hit — it stays a stop. The request remains pending in the console.
+        try {
+            (0, telemetry_1.setVerdictPath)('fail_open');
+        }
+        catch { /* never throw */ }
+        try {
+            (0, hookIo_1.dbg)({ phase: 'hook_error_pending_stop', event, error: message });
+        }
+        catch { /* never throw */ }
+        try {
+            (0, telemetry_1.spoolEvent)({ decision: 'block', toolName, operation: `${toolName}:hook_error`, reason: `Hook error while ${pendingStop} — denied: ${message.slice(0, 200)}`, offlineEnforced: true });
+            (0, telemetry_1.triggerFlush)(true);
+        }
+        catch { /* never throw */ }
+        const reason = `FullCourtDefense stopped this action: ${pendingStop}, and it was not approved before the check ended. The request stays pending in the console; re-run the action after it is approved.`;
+        return { stdout: JSON.stringify({ continue: false, permission: 'deny', user_message: reason, agent_message: `${reason} Do not retry until a human approves it.`,
+                permissionDecision: 'deny', permissionDecisionReason: reason,
+                hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'deny', permissionDecisionReason: reason } }) + '\n', exitCode: 0 };
+    }
     // Label the spooled event below as a crash-allow: a rising fail_open rate is
     // the fleet's earliest signal that the guard itself is broken on a machine.
     try {
@@ -1456,9 +1560,11 @@ async function hookCommandInner(args, config, io) {
     // this is instant when fresh and bounded (~1.5s) only when stale.
     let machineSuspended = false;
     let modeResolved = false;
+    let runtimeBundleFlags = {};
     if (shieldId) {
         try {
             const bundle = await (0, runtimeConfig_1.getRuntimeBundle)({ apiUrl, shieldId, shieldKey, developerName: developerId(), machineName: os.hostname(), hotPath: true });
+            runtimeBundleFlags = bundle;
             // Kill-switch holds even on a 'default' bundle: with the cache missing
             // but a signed last-known-suspended marker standing, getRuntimeBundle
             // stamps suspended on the default — deleting the cache file must not
@@ -1486,6 +1592,10 @@ async function hookCommandInner(args, config, io) {
         }
         catch { /* keep the local default */ }
     }
+    // Shell AST mode: FCD_SHELL_AST_MODE env, else the bundle's `shellAstMode`
+    // (server-controlled rollout), else shadow — facts recorded, verdicts unchanged.
+    (0, shellAstLoader_1.applyShellAstMode)((0, shellAstLoader_1.resolveShellAstMode)(process.env.FCD_SHELL_AST_MODE, runtimeBundleFlags.shellAstMode));
+    (0, hookIo_1.dbg)({ phase: 'shell_ast_mode', mode: (0, actionPolicyEngine_1.getShellAstMode)(), fromEnv: process.env.FCD_SHELL_AST_MODE, fromBundle: runtimeBundleFlags.shellAstMode });
     // Monitor-first: no authoritative bundle (fresh/uncached/fetch failed) => report-only.
     if (!modeResolved && !forceEnforce) {
         shadow = true;
@@ -1539,7 +1649,7 @@ async function hookCommandInner(args, config, io) {
         payload = cursor.payload;
         ignoreEvent = cursor.ignore;
     }
-    (0, hookIo_1.dbg)({ phase: 'invoke', event, argEvent: args.event, format: hookFormat, client, pid: process.pid,
+    (0, hookIo_1.dbg)({ phase: 'invoke', event, argEvent: args.event, format: hookFormat, client, pid: process.pid, viaDaemon: Boolean(io.viaDaemon),
         isTTY, rawLen: raw.length, ...(hookIo_1.HOOK_DEBUG_VERBOSE ? { rawPreview: raw.slice(0, 300) } : {}), stdinErr, parseErr,
         argv: process.argv.slice(2), payloadKeys: Object.keys(payload) });
     // Emit the verdict in the shape THIS client expects, then exit.
@@ -1577,7 +1687,7 @@ async function hookCommandInner(args, config, io) {
     const hasPendingLocalAsk = () => Boolean(pendingLocalAsk);
     const respond = (blocked, userMsg, agentMsg, askEnvelope) => {
         let ask = blocked === 'ask' && event !== 'prompt';
-        const denied = blocked === true;
+        let denied = blocked === true;
         if (!denied && !ask && pendingLocalAsk && event !== 'prompt') {
             const { finding, call, ruleHash } = pendingLocalAsk;
             pendingLocalAsk = undefined;
@@ -1598,6 +1708,22 @@ async function hookCommandInner(args, config, io) {
             }
             agentMsg = [prepared.agentMsg, agentMsg].filter(Boolean).join(' ');
         }
+        if (ask && !(0, devConfirm_1.isHumanPresent)()) {
+            // Nobody can answer an IDE ask here, and an agent in an auto-approve mode
+            // (Claude Code bypass, Gemini CLI yolo) runs the action on an ask.
+            (0, hookIo_1.dbg)({ phase: 'ask_without_human_denied', event, policyId: askEnvelope?.policyId });
+            (0, telemetry_1.spoolEvent)({
+                decision: 'block', toolName: askEnvelope?.toolName || event, operation: askEnvelope?.operation || event,
+                reason: `Confirmation required and no human is present — denied${askEnvelope?.policyName ? ` (${askEnvelope.policyName})` : ''}`,
+                ruleId: askEnvelope?.policyId, policyHash: askEnvelope?.policyHash, offlineEnforced: true,
+            });
+            (0, telemetry_1.triggerFlush)(true);
+            ask = false;
+            denied = true;
+            askEnvelope = undefined;
+            userMsg = `FullCourtDefense stopped this ${event}: a rule asks a person to confirm it, and no one is present on this machine (CI, ephemeral workload or FCD_HUMAN_PRESENT=0), so it was not run.`;
+            agentMsg = `${userMsg} Do not retry or work around it.`;
+        }
         if (!denied && pendingLocalWarnings.length > 0) {
             spoolLocalWarnings(pendingLocalWarnings.map(w => w.finding), pendingLocalWarnings[0].toolName, pendingLocalWarnings[0].operation);
         }
@@ -1691,7 +1817,12 @@ async function hookCommandInner(args, config, io) {
         await enforceActionPolicy({
             event, payload, apiUrl: apiUrl, shieldId: shieldId, shieldKey,
             shadow, failClosed, timeoutMs, approvalMode, approvalTimeoutMs, approvalPollMs, respond, deferLocalWarnings, deferLocalAsk, hasPendingLocalAsk,
-            effectivePolicyHash, localPolicies, client, exitsProcess: io.exitsProcess,
+            effectivePolicyHash, localPolicies, client, exitsProcess: io.exitsProcess, viaDaemon: Boolean(io.viaDaemon),
+            notePendingStop: (what) => {
+                io.pendingStop = what;
+                if (!io.viaDaemon)
+                    processPendingStop = what;
+            },
         });
         return;
     }
@@ -1749,6 +1880,13 @@ async function hookCommandInner(args, config, io) {
     // Unknown event → nothing to enforce.
     respond(false);
 }
+/** A human wait belongs in the developer's hook process, never in the daemon. */
+function declineInDaemon(ctx, what) {
+    if (!ctx.viaDaemon)
+        return;
+    (0, hookIo_1.dbg)({ phase: 'daemon_declined', what });
+    throw new DaemonDeclined(`${what}: runs in the hook process`);
+}
 /**
  * Approve-once for a taint-guard block: hold the action, alert the human at
  * the keyboard, and poll for their one-time decision from their OWN terminal
@@ -1770,11 +1908,17 @@ async function runTaintApproveOnce(ctx, event, call, sessId, taintFinding) {
         respond(true, explained.userMessage, `FullCourtDefense blocked this ${event} locally (${taintFinding.ruleId}): ${taintFinding.reason} Do not retry. ${explained.agentMessage}`);
         return false;
     };
-    const approveOnceEnabled = process.env.FCD_TAINT_APPROVE_ONCE_DISABLED !== 'true'
-        && process.env.FCD_TAINT_APPROVE_ONCE_DISABLED !== '1'
+    const env = (0, callerEnv_1.callerEnv)();
+    const approveOnceEnabled = env.FCD_TAINT_APPROVE_ONCE_DISABLED !== 'true'
+        && env.FCD_TAINT_APPROVE_ONCE_DISABLED !== '1'
         && ctx.approvalMode !== 'block';
     if (!approveOnceEnabled)
         return hardBlock();
+    // Approve-once is answered from the developer's own terminal: with nobody
+    // there, the wait could only end in the IDE's timeout.
+    if (!(0, devConfirm_1.isHumanPresent)())
+        return hardBlock();
+    declineInDaemon(ctx, 'taint approve-once');
     const approval = (0, taintLedger_1.createTaintApproval)({
         sessionId: sessId,
         event,
@@ -1785,8 +1929,8 @@ async function runTaintApproveOnce(ctx, event, call, sessId, taintFinding) {
     });
     if (!approval)
         return hardBlock();
-    const timeoutMs = Number(process.env.FCD_TAINT_APPROVAL_TIMEOUT_MS) > 0
-        ? Number(process.env.FCD_TAINT_APPROVAL_TIMEOUT_MS)
+    const timeoutMs = Number(env.FCD_TAINT_APPROVAL_TIMEOUT_MS) > 0
+        ? Number(env.FCD_TAINT_APPROVAL_TIMEOUT_MS)
         : 120000; // local developer decision — short window, they are at the keyboard
     const targetText = taintFinding.sink.targets.join(', ') || 'an external destination';
     // forceWindow: a toast can be swallowed by Focus Assist; this decision must be seen.
@@ -1799,10 +1943,13 @@ async function runTaintApproveOnce(ctx, event, call, sessId, taintFinding) {
             + `Deny:        fullcourtdefense approve ${approval.id} --deny\n`
             + `(run "fullcourtdefense approve" to list; expires in ${Math.round(timeoutMs / 60000)} min)`,
     });
-    (0, hookIo_1.dbg)({ phase: 'taint_approve_once_wait', event, tool: call.toolName, approvalId: approval.id, timeoutMs });
-    const outcome = await (0, taintLedger_1.waitForTaintApproval)(approval.id, timeoutMs, Math.max(750, Math.min(ctx.approvalPollMs, 2000)));
+    const waitMs = Math.max(0, humanWaitDeadline(timeoutMs) - Date.now());
+    (0, hookIo_1.dbg)({ phase: 'taint_approve_once_wait', event, tool: call.toolName, approvalId: approval.id, timeoutMs, waitMs });
+    ctx.notePendingStop('the action is held for a one-time developer approval');
+    const outcome = await (0, taintLedger_1.waitForTaintApproval)(approval.id, waitMs, Math.max(750, Math.min(ctx.approvalPollMs, 2000)));
     (0, hookIo_1.dbg)({ phase: 'taint_approve_once_outcome', approvalId: approval.id, outcome });
     if (outcome === 'approved') {
+        ctx.notePendingStop('');
         spoolCallEvent(call, {
             decision: 'allow',
             reason: `Developer approved once after taint-guard hold (${taintFinding.ruleId}): ${taintFinding.reason}`,
@@ -2050,6 +2197,9 @@ async function enforceActionPolicy(ctx) {
         if (tryDeveloperConfirmation({ event, respond, shadow, effectivePolicyHash, localPolicies: ctx.localPolicies }, call, localVerdict, payload, 'local-first'))
             return;
         // require_approval (org scope) → synchronous gate below creates the approval action.
+        if (localVerdict.verdict === 'require_approval' && ctx.approvalMode === 'wait' && !shadow) {
+            declineInDaemon(ctx, 'org approval');
+        }
     }
     // PROXY RESILIENCE (fast probe): when the gate failed within the last 60s
     // (bank proxy without the api hostname allowlisted, backend outage), skip
@@ -2160,6 +2310,11 @@ async function enforceActionPolicy(ctx) {
             respond(true, explained.userMessage, `This ${event} requires human approval per Action Policy. Stop and ask the developer to approve it in the FullCourtDefense console: ${queueUrl}. ${explained.agentMessage}`);
             return;
         }
+        // No cached policies, so the daemon only learned it from the gate: the
+        // client re-asks the gate, which answers with this same pending request
+        // (one request per action — see approvalRequestKey), and waits on it.
+        declineInDaemon(ctx, 'org approval');
+        ctx.notePendingStop('it needs human approval');
         // Make the wait visible on the machine: the hook process has no UI and its
         // stderr is invisible inside IDEs, so a native toast is the only reliable
         // signal that a human needs to act NOW (the approval window is minutes).
@@ -2170,9 +2325,10 @@ async function enforceActionPolicy(ctx) {
         });
         const outcome = await waitForApproval({
             apiUrl, shieldId, shieldKey, actionId: result.approvalActionId,
-            timeoutMs: ctx.approvalTimeoutMs, pollMs: ctx.approvalPollMs,
+            deadline: humanWaitDeadline(ctx.approvalTimeoutMs), pollMs: ctx.approvalPollMs,
         });
         if (outcome.status === 'approved') {
+            ctx.notePendingStop('');
             (0, notify_1.notifyOs)({ title: 'FullCourtDefense — approved', message: `${call.toolName} was approved and will continue.` });
             respond(false, undefined, `FullCourtDefense: human approved this ${event}.`);
             return;
@@ -2202,11 +2358,12 @@ async function waitForApproval(input) {
     if (input.shieldKey)
         headers['x-shield-key'] = input.shieldKey;
     const url = `${input.apiUrl}/api/agent-security/runtime/approvals/${encodeURIComponent(input.actionId)}?shieldId=${encodeURIComponent(input.shieldId)}`;
-    const deadline = Date.now() + input.timeoutMs;
-    (0, hookIo_1.dbg)({ phase: 'approval_wait_start', actionId: input.actionId, timeoutMs: input.timeoutMs });
+    const { deadline } = input;
+    (0, hookIo_1.dbg)({ phase: 'approval_wait_start', actionId: input.actionId, timeoutMs: Math.max(0, deadline - Date.now()) });
     while (Date.now() <= deadline) {
         try {
-            const resp = await fetch(url, { method: 'GET', headers, signal: AbortSignal.timeout(15000) });
+            // A poll never outlives the deadline — the deadline is what keeps the verdict inside the IDE's timeout.
+            const resp = await fetch(url, { method: 'GET', headers, signal: AbortSignal.timeout(Math.max(1000, Math.min(15000, deadline - Date.now()))) });
             if (resp.ok) {
                 const body = await resp.json().catch(() => ({}));
                 const approval = body.data?.approval;

package/dist/commands/mcpGateway.js

@@ -74,6 +74,7 @@ const policyGateHealth_1 = require("../policyGateHealth");
 const actionPolicyEngine_1 = require("../actionPolicyEngine");
 const machineIdentity_1 = require("../machineIdentity");
 const backupManifest_1 = require("../backupManifest");
+const shellAstLoader_1 = require("../shellAstLoader");
 const devConfirm_1 = require("../devConfirm");
 const DEFAULT_API_URL = 'https://api.fullcourtdefense.ai';
 const MANAGED_SERVER_NAME = 'agentguard-gateway';
@@ -2148,6 +2149,7 @@ class McpGatewayServer {
     }
 }
 async function mcpGatewayCommand(args, config) {
+    await (0, shellAstLoader_1.ensureShellAstReady)(); // resident process: load the parser once, before the first tool call (shadow by default)
     // The gateway is a resident proxy in front of the IDE's MCP servers — if it
     // crashes, EVERY protected tool goes down at once. Any escaped exception
     // (detached flush, timer, transport edge case) logs one line and the proxy

package/dist/commands/taintLedger.js

@@ -53,6 +53,7 @@ const os = __importStar(require("os"));
 const path = __importStar(require("path"));
 const actionPolicyEngine_1 = require("../actionPolicyEngine");
 const deterministicGuard_1 = require("./deterministicGuard");
+const callerEnv_1 = require("../callerEnv");
 /**
  * Deterministic taint tracking for local IDE coding agents.
  *
@@ -240,7 +241,8 @@ function isLocalHost(host) {
         || host.endsWith('.local');
 }
 function workspaceRoot(workspacePath) {
-    return workspacePath || process.env.WORKSPACE_PATH || process.env.CLAUDE_PROJECT_DIR || process.cwd();
+    const env = (0, callerEnv_1.callerEnv)();
+    return workspacePath || env.WORKSPACE_PATH || env.CLAUDE_PROJECT_DIR || process.cwd();
 }
 function isExternalFile(filePath, workspacePath) {
     try {

package/dist/commands/workloadProtect.js

@@ -66,7 +66,7 @@ function assertWorkloadSubstrate(kind, rt, options = {}) {
         + 'or pass --force true if this really is a disposable workload host.');
 }
 /** Connections the console has a section for; anything else is the generic snippet. */
-const ENROLLED_VIA_VALUES = new Set(['heroku', 'kubernetes', 'aws', 'gcp', 'snippet']);
+const ENROLLED_VIA_VALUES = new Set(['heroku', 'kubernetes', 'aws', 'gcp', 'azure', 'snippet']);
 function resolveEnrolledVia(explicit, env, detected) {
     for (const candidate of [explicit, env.FCD_ENROLLED_VIA, detected]) {
         const clean = (candidate || '').trim().toLowerCase();
@@ -105,7 +105,11 @@ function detectWorkloadContext(env = process.env, fsProbe = fs) {
     }
     if (env.FUNCTIONS_WORKER_RUNTIME && env.WEBSITE_SITE_NAME) {
         // Azure Functions
-        return { kind: 'serverless', name: explicitName || env.WEBSITE_SITE_NAME, environment, instanceId: env.WEBSITE_INSTANCE_ID, image };
+        return { kind: 'serverless', name: explicitName || env.WEBSITE_SITE_NAME, environment, instanceId: env.WEBSITE_INSTANCE_ID, image, enrolledVia: 'azure' };
+    }
+    if (env.CONTAINER_APP_NAME && env.CONTAINER_APP_REVISION) {
+        // Azure Container Apps: the app name is the stable identity, the replica the instance.
+        return { kind: 'container', name: explicitName || env.CONTAINER_APP_NAME, environment, instanceId: env.CONTAINER_APP_REPLICA_NAME || env.HOSTNAME, image, enrolledVia: 'azure' };
     }
     if (env.ECS_CONTAINER_METADATA_URI_V4 || env.ECS_CONTAINER_METADATA_URI) {
         // ECS / Fargate task: the service name comes from the task definition env.

package/dist/devConfirm.d.ts

@@ -1,3 +1,4 @@
+export { isCiEnvironment, isHumanPresent } from './callerEnv';
 export type ConfirmRemember = 'none' | 'session' | '1h';
 /**
  * Fastest plausible HUMAN answer to a confirmation prompt. A person has to notice
@@ -191,14 +192,6 @@ export declare function resolveGrantLimits(rule?: RuleGrantLimits | null, org?:
 export declare function describeGrantLimits(limits: GrantLimits): string;
 /** Uses left on a grant, or undefined when it is only time-limited. */
 export declare function grantRemainingUses(grant: Pick<DeveloperGrant, 'uses' | 'maxUses'>): number | undefined;
-/** CI / pipeline environments — no human at a keyboard. Shared by hooks and discovery. */
-export declare function isCiEnvironment(env?: NodeJS.ProcessEnv): boolean;
-/**
- * Whether a developer can answer an IDE permission prompt on this machine. False on CI runners
- * and on ephemeral workloads (`FCD_EPHEMERAL=1`, exported by `fcd workload-protect`) — there a
- * developer-scoped approval must go to the org queue or block, never self-resolve.
- */
-export declare function isHumanPresent(env?: NodeJS.ProcessEnv): boolean;
 /** Canonical JSON action, including cwd and every argument. Invalid inputs cannot reuse consent. */
 export declare function actionDigest(toolArgs: Record<string, unknown>): string;
 /**
@@ -299,11 +292,20 @@ export declare function sweepExpiredConfirmations(now?: Date, ttlMs?: number): P
  * (`out-string).trim()`) is stripped. Sorted and unique.
  */
 export declare function shellPrograms(command: string): string[];
+/**
+ * `shellPrograms` narrowed to what a rule that declares its programs is about:
+ * the rule's programs plus every other program that could move data off the
+ * machine or run code (`curl`, `node`, `Invoke-RestMethod`, anything unknown).
+ * Only local file-structure changes and local `git` reads/commits drop out.
+ * Without declared programs, or when none of them is on the line, the full set.
+ */
+export declare function shellProgramsForRule(command: string, ruleCommands?: readonly string[]): string[];
 /** Local Safety item ids joined as `a+b` when two ask-rules fire in one dialog. */
 export declare function splitLocalSafetyRuleIds(matchedRule?: string): string[] | undefined;
 /**
- * Does a live grant cover this action under this rule? Combined Local Safety
- * asks (`a+b`) match a grant for `a` or `b`. Shell programs match by INCLUSION:
+ * Does a live grant cover this action under this rule? A combined Local Safety
+ * ask (`a+b`) needs a grant for `a` AND one for `b` (or one for `a+b`); a grant
+ * for `a` alone never silences `b`. Shell programs match by INCLUSION:
  * a grant for `{gh, git}` covers a line that only runs `gh`, never a line that
  * also runs `curl`. Generic shells and pipeline cmdlets are not in the set.
  * Touch counts a use.
@@ -332,8 +334,14 @@ export declare function recordDeveloperGrant(scope: GrantScope, rule: {
 export declare function listDeveloperGrants(now?: Date): DeveloperGrant[];
 /** Remove one grant by key, or every grant when `key` is omitted. Returns how many were removed. */
 export declare function revokeDeveloperGrants(key?: string): number;
-/** One line a person can read on the button and in the grant list: what "Always allow" covers. */
-export declare function describeGrantScope(scope: GrantScope): string;
+/**
+ * One line a person can read on the button and in the grant list: what "Always allow" covers.
+ * With `rule`, names the rule the grant is under (`… under rule gcloud_secret_access_cmd`).
+ */
+export declare function describeGrantScope(scope: GrantScope, rule?: {
+    policyId?: string;
+    policyName?: string;
+}): string;
 /**
  * Which line-level facts the RULE that asked actually depends on. A grant binds
  * the facts the rule fired on and nothing else: `gcloud_access_token_cmd` fired
@@ -346,6 +354,12 @@ export declare function describeGrantScope(scope: GrantScope): string;
  */
 export interface GrantRuleFacts {
     bindsDestination: boolean;
+    /**
+     * Programs the rule itself is about (a Local Safety item's `commands`). When
+     * set, local-only helpers on the line do not partition the grant
+     * (`shellProgramsForRule`). Absent = every program on the line.
+     */
+    ruleCommands?: string[];
 }
 /**
  * Derive `GrantRuleFacts` from the source of the ask. Unknown = bound (the
@@ -354,6 +368,8 @@ export interface GrantRuleFacts {
 export declare function grantRuleFactsFor(source: {
     localFinding?: {
         category?: string;
+        itemId?: string;
+        source?: string;
     };
     policyId?: string;
     policies?: Array<{