fullcourtdefense-cli 1.35.8 → 1.35.9

package/dist/devConfirm.js

@@ -33,7 +33,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.GRANT_MAX_USES_LIMIT = exports.GRANT_TTL_MS = exports.CONFIRMED_ACTION_TTL_MS = exports.CONFIRM_PENDING_TTL_MS = exports.DIALOG_SCRIPT_MARKER = exports.DIALOG_BUTTON_DENY = exports.DIALOG_BUTTON_ONCE = exports.DIALOG_BUTTON_ALWAYS = exports.MIN_HUMAN_ANSWER_MS = void 0;
+exports.GRANT_MAX_USES_LIMIT = exports.GRANT_TTL_MS = exports.CONFIRMED_ACTION_TTL_MS = exports.CONFIRM_PENDING_TTL_MS = exports.DIALOG_SCRIPT_MARKER = exports.DIALOG_BUTTON_DENY = exports.DIALOG_BUTTON_ONCE = exports.DIALOG_BUTTON_ALWAYS = exports.MIN_HUMAN_ANSWER_MS = exports.isHumanPresent = exports.isCiEnvironment = void 0;
 exports.looksLikeClientAutoAnswer = looksLikeClientAutoAnswer;
 exports.confirmNativeAction = confirmNativeAction;
 exports.nativeDialogAvailable = nativeDialogAvailable;
@@ -41,8 +41,6 @@ exports.confirmNativeActionDetailed = confirmNativeActionDetailed;
 exports.resolveGrantLimits = resolveGrantLimits;
 exports.describeGrantLimits = describeGrantLimits;
 exports.grantRemainingUses = grantRemainingUses;
-exports.isCiEnvironment = isCiEnvironment;
-exports.isHumanPresent = isHumanPresent;
 exports.actionDigest = actionDigest;
 exports.actionPolicyRuleHash = actionPolicyRuleHash;
 exports.localSafetyRuleHash = localSafetyRuleHash;
@@ -55,6 +53,7 @@ exports.settleDeveloperConfirmation = settleDeveloperConfirmation;
 exports.rejectDeveloperConfirmation = rejectDeveloperConfirmation;
 exports.sweepExpiredConfirmations = sweepExpiredConfirmations;
 exports.shellPrograms = shellPrograms;
+exports.shellProgramsForRule = shellProgramsForRule;
 exports.splitLocalSafetyRuleIds = splitLocalSafetyRuleIds;
 exports.findDeveloperGrant = findDeveloperGrant;
 exports.recordDeveloperGrant = recordDeveloperGrant;
@@ -94,6 +93,10 @@ const os = __importStar(require("os"));
 const path = __importStar(require("path"));
 const approvalPrompt_1 = require("./approvalPrompt");
 const deterministicGuard_1 = require("./commands/deterministicGuard");
+const callerEnv_1 = require("./callerEnv");
+var callerEnv_2 = require("./callerEnv");
+Object.defineProperty(exports, "isCiEnvironment", { enumerable: true, get: function () { return callerEnv_2.isCiEnvironment; } });
+Object.defineProperty(exports, "isHumanPresent", { enumerable: true, get: function () { return callerEnv_2.isHumanPresent; } });
 /**
  * Fastest plausible HUMAN answer to a confirmation prompt. A person has to notice
  * the dialog, read at least the tool name and press a button; MCP clients that
@@ -126,11 +129,12 @@ exports.DIALOG_BUTTON_DENY = 'Deny';
 exports.DIALOG_SCRIPT_MARKER = 'FullCourtDefense.Dialog';
 /** True when this process can put a dialog in front of a person on this machine. */
 function nativeDialogAvailable() {
-    if (!isHumanPresent())
+    if (!(0, callerEnv_1.isHumanPresent)())
         return false;
     if (process.platform === 'win32' || process.platform === 'darwin')
         return true;
-    return Boolean(process.env.DISPLAY || process.env.WAYLAND_DISPLAY);
+    const env = (0, callerEnv_1.callerEnv)();
+    return Boolean(env.DISPLAY || env.WAYLAND_DISPLAY);
 }
 function b64(value) {
     return Buffer.from(value, 'utf8').toString('base64');
@@ -430,28 +434,6 @@ function grantExhausted(grant, limits) {
     const cap = [grant.maxUses, limits?.maxUses].filter((c) => typeof c === 'number' && c >= 1);
     return cap.length > 0 && (Number(grant.uses) || 0) >= Math.min(...cap);
 }
-/** CI / pipeline environments — no human at a keyboard. Shared by hooks and discovery. */
-function isCiEnvironment(env = process.env) {
-    return env.GITHUB_ACTIONS === 'true'
-        || env.GITLAB_CI === 'true'
-        || env.TF_BUILD === 'True' // Azure Pipelines
-        || !!env.JENKINS_URL
-        || !!env.BUILDKITE
-        || !!env.CIRCLECI
-        || env.CI === 'true';
-}
-/**
- * Whether a developer can answer an IDE permission prompt on this machine. False on CI runners
- * and on ephemeral workloads (`FCD_EPHEMERAL=1`, exported by `fcd workload-protect`) — there a
- * developer-scoped approval must go to the org queue or block, never self-resolve.
- */
-function isHumanPresent(env = process.env) {
-    if (env.FCD_EPHEMERAL === '1' || env.FCD_EPHEMERAL === 'true' || env.FULLCOURTDEFENSE_EPHEMERAL === '1')
-        return false;
-    if (env.FCD_HUMAN_PRESENT === '0' || env.FCD_HUMAN_PRESENT === 'false')
-        return false;
-    return !isCiEnvironment(env);
-}
 function ledgerFile() {
     return path.join(os.homedir(), '.fullcourtdefense', 'dev-confirm.json');
 }
@@ -832,6 +814,12 @@ const SHELL_TEXT_FILTERS = new Set([
     'grep', 'egrep', 'fgrep', 'rg', 'findstr', 'select-string', 'sls', 'awk', 'gawk', 'sed',
     'head', 'tail', 'wc', 'sort', 'uniq', 'cut', 'tr', 'jq', 'yq', 'column', 'nl', 'more', 'less', 'cat', 'tee',
 ]);
+/**
+ * PowerShell aliases of the pipeline / formatting cmdlets above (`| Select -Last 25`,
+ * `| ft`, `| measure`). Output shaping in pipeline position, like their full names.
+ * Piped-only: leading a statement `sort` / `where` are real programs.
+ */
+const SHELL_PIPELINE_ALIASES = new Set(['select', 'where', 'sort', 'group', 'measure', 'compare', 'ft', 'fl', 'fw', 'tee']);
 /**
  * Cheap quote-aware split on `; && || | \n` — the grant needs program NAMES, not
  * semantics. Separators inside `{ … }` do not split: a control statement's
@@ -944,6 +932,37 @@ function braceBodies(statement) {
         bodies.push(statement.slice(start));
     return bodies.map(body => body.trim()).filter(Boolean);
 }
+/**
+ * Programs that change only local file-system structure — they cannot send
+ * data off the machine or run other code. Dropped from a grant only when the
+ * rule declares its own programs (`gcloud_secret_access_cmd` is about `gcloud`,
+ * not the `Remove-Item $tmp` that cleans up after it). Writers that take
+ * content (`New-Item -Value`, `Set-Content`, `Copy-Item` to a share) stay.
+ */
+const SHELL_LOCAL_FILE_OPS = new Set(['remove-item', 'ri', 'rm', 'del', 'erase', 'rmdir', 'rd', 'mkdir', 'md', 'new-temporaryfile', 'mktemp']);
+/** `git` subcommands that read or change the local repository only (no remote, no pager/diff driver override). */
+const GIT_LOCAL_SUBCOMMANDS = new Set([
+    'status', 'diff', 'log', 'show', 'add', 'commit', 'rev-parse', 'ls-files', 'branch', 'stash', 'restore', 'switch', 'checkout', 'reset',
+]);
+/** git flags that run a configured command or write output elsewhere: never local-only. */
+const GIT_NONLOCAL_FLAGS = /^(?:-c|--config-env\b.*|--exec-path\b.*|--output\b.*|--ext-diff|--upload-pack\b.*|--receive-pack\b.*)$/i;
+function localOnlyUse(name, args) {
+    // A UNC path or URL operand reaches another host (`mkdir \\host\share\$v` carries $v in the name).
+    if (args.some(arg => /^["'(]*(?:\\\\|\/\/)|:\/\//.test(arg)))
+        return false;
+    if (SHELL_LOCAL_FILE_OPS.has(name))
+        return true;
+    if (name !== 'git' || args.some(arg => GIT_NONLOCAL_FLAGS.test(arg)))
+        return false;
+    let k = 0;
+    while (k < args.length && args[k].startsWith('-'))
+        k += args[k] === '-C' ? 2 : 1;
+    return GIT_LOCAL_SUBCOMMANDS.has((args[k] || '').toLowerCase());
+}
+/**
+ * `out`: program name -> true when EVERY use of it on the line is local-only
+ * (`localOnlyUse`). `git status; git push` is `git -> false`.
+ */
 function collectPrograms(command, out, depth) {
     if (depth > 6 || !command.trim())
         return;
@@ -973,7 +992,18 @@ function collectPrograms(command, out, depth) {
                 i += 2;
                 continue;
             }
-            if (/^\$[\w:.]+[+-]?=/.test(w) || /^[A-Za-z_][\w]*=/.test(w)) {
+            // PowerShell `$v=((gcloud …` glued in one token: the right-hand side can be a
+            // command, so keep reading the same token after the `=`.
+            const glued = w.match(/^\$[\w:.]+[+-]?=/);
+            if (glued) {
+                const rhs = w.slice(glued[0].length);
+                if (rhs)
+                    words[i] = rhs;
+                else
+                    i++;
+                continue;
+            }
+            if (/^[A-Za-z_][\w]*=/.test(w)) {
                 i++;
                 continue;
             }
@@ -998,7 +1028,7 @@ function collectPrograms(command, out, depth) {
         const name = programToken(lead);
         if (!name || SHELL_PIPELINE_NOISE.has(name) || SHELL_INCIDENTAL.has(name))
             continue;
-        if (piped && SHELL_TEXT_FILTERS.has(name))
+        if (piped && (SHELL_TEXT_FILTERS.has(name) || SHELL_PIPELINE_ALIASES.has(name)))
             continue;
         if (GENERIC_SHELLS.has(name)) {
             const nested = nestedShellBody(raw);
@@ -1006,7 +1036,8 @@ function collectPrograms(command, out, depth) {
                 collectPrograms(nested, out, depth + 1);
             continue;
         }
-        out.add(name);
+        const localOnly = localOnlyUse(name, words.slice(i + 1));
+        out.set(name, (out.get(name) ?? true) && localOnly);
     }
 }
 /**
@@ -1021,9 +1052,24 @@ function collectPrograms(command, out, depth) {
  * (`out-string).trim()`) is stripped. Sorted and unique.
  */
 function shellPrograms(command) {
-    const out = new Set();
+    const out = new Map();
     collectPrograms(command, out, 0);
-    return [...out].sort();
+    return [...out.keys()].sort();
+}
+/**
+ * `shellPrograms` narrowed to what a rule that declares its programs is about:
+ * the rule's programs plus every other program that could move data off the
+ * machine or run code (`curl`, `node`, `Invoke-RestMethod`, anything unknown).
+ * Only local file-structure changes and local `git` reads/commits drop out.
+ * Without declared programs, or when none of them is on the line, the full set.
+ */
+function shellProgramsForRule(command, ruleCommands) {
+    const out = new Map();
+    collectPrograms(command, out, 0);
+    const all = [...out.keys()].sort();
+    if (!ruleCommands || !ruleCommands.length || !all.some(p => ruleCommands.includes(p)))
+        return all;
+    return all.filter(p => ruleCommands.includes(p) || !out.get(p));
 }
 /** Local Safety item ids joined as `a+b` when two ask-rules fire in one dialog. */
 function splitLocalSafetyRuleIds(matchedRule) {
@@ -1057,11 +1103,9 @@ function grantRuleApplies(grant, rule) {
         return true;
     if (!namesOverlap)
         return false;
-    // Per-item grant (new) vs a combined live finding (joined hash).
-    if (grantItems.length === 1 && liveItems.length > 1) {
-        return grant.policyHash === localSafetyRuleHash({ itemId: grantItems[0], source: 'builtin', action: 'ask' });
-    }
     // Combined leftover grant (joined id + joined hash) vs a later single-rule ask.
+    // A per-item grant never covers a combined live finding on its own: the
+    // combined ask is split per item in `findDeveloperGrant`, each item needs its own.
     if (grantItems.length > 1 && liveItems.length === 1)
         return true;
     return false;
@@ -1082,8 +1126,9 @@ function grantKey(scope, policyId, matchedRule, policyHash) {
     return sha256(JSON.stringify([scope.event, scope.toolName, scope.programs || null, scope.scripts || null, scope.operation, scope.destinationDomain || null, policyId || null, matchedRule || null, policyHash]));
 }
 /**
- * Does a live grant cover this action under this rule? Combined Local Safety
- * asks (`a+b`) match a grant for `a` or `b`. Shell programs match by INCLUSION:
+ * Does a live grant cover this action under this rule? A combined Local Safety
+ * ask (`a+b`) needs a grant for `a` AND one for `b` (or one for `a+b`); a grant
+ * for `a` alone never silences `b`. Shell programs match by INCLUSION:
  * a grant for `{gh, git}` covers a line that only runs `gh`, never a line that
  * also runs `curl`. Generic shells and pipeline cmdlets are not in the set.
  * Touch counts a use.
@@ -1101,7 +1146,7 @@ function findDeveloperGrant(scope, rule, limits = { ttlMs: exports.GRANT_TTL_MS
     const ttlCap = Math.min(exports.GRANT_TTL_MS, limits.ttlMs);
     return mutateLedger(undefined, () => {
         const ledger = readLedger();
-        const hit = ledger.grants.find(g => grantRuleApplies(g, rule)
+        const covers = (g, r) => grantRuleApplies(g, r)
             && g.scope.event === scope.event
             && g.scope.toolName === scope.toolName
             && g.scope.operation === scope.operation
@@ -1115,13 +1160,23 @@ function findDeveloperGrant(scope, rule, limits = { ttlMs: exports.GRANT_TTL_MS
             && (scope.event !== 'shell'
                 || (Array.isArray(g.scope.programs) && (scope.programs || []).length > 0 && (scope.programs || []).every(p => g.scope.programs.includes(p))))
             && (!(g.scope.scripts && g.scope.scripts.length)
-                || ((scope.scripts || []).length > 0 && (scope.scripts || []).every(s => g.scope.scripts.includes(s)))));
-        if (!hit)
+                || ((scope.scripts || []).length > 0 && (scope.scripts || []).every(s => g.scope.scripts.includes(s))));
+        // A combined ask (`a+b`) is covered by a grant for exactly that combination,
+        // or by one grant per item — never by a grant for `a` alone.
+        const whole = ledger.grants.find(g => covers(g, rule));
+        const hits = whole
+            ? [whole]
+            : localSafetyItemIds(rule.matchedRule).length > 1
+                ? expandGrantRuleIdentities({ ...rule, policyHash: rule.policyHash }).map(item => ledger.grants.find(g => covers(g, item)))
+                : [];
+        if (!hits.length || hits.some(hit => !hit))
             return undefined;
-        hit.lastUsedAt = now.toISOString();
-        hit.uses = (Number(hit.uses) || 0) + 1;
+        for (const hit of hits) {
+            hit.lastUsedAt = now.toISOString();
+            hit.uses = (Number(hit.uses) || 0) + 1;
+        }
         writeLedger(ledger);
-        return hit;
+        return hits[0];
     });
 }
 /**
@@ -1175,8 +1230,17 @@ function revokeDeveloperGrants(key) {
         return before - ledger.grants.length;
     });
 }
-/** One line a person can read on the button and in the grant list: what "Always allow" covers. */
-function describeGrantScope(scope) {
+/**
+ * One line a person can read on the button and in the grant list: what "Always allow" covers.
+ * With `rule`, names the rule the grant is under (`… under rule gcloud_secret_access_cmd`).
+ */
+function describeGrantScope(scope, rule) {
+    const base = describeGrantTarget(scope);
+    const localItem = rule?.policyId?.startsWith('local-safety:') ? rule.policyId.slice('local-safety:'.length) : undefined;
+    const ruleName = localItem || (rule?.policyName ? `"${rule.policyName}"` : undefined);
+    return ruleName ? `${base} under rule ${ruleName}` : base;
+}
+function describeGrantTarget(scope) {
     const what = scope.event === 'shell'
         ? (scope.scripts && scope.scripts.length
             ? `running ${scope.scripts.map(s => `\`${s}\``).join(', ')}`
@@ -1209,7 +1273,11 @@ const DESTINATION_BOUND_CATEGORIES = new Set(['metadata_ssrf', 'secret_exfiltrat
  */
 function grantRuleFactsFor(source) {
     if (source.localFinding) {
-        return { bindsDestination: DESTINATION_BOUND_CATEGORIES.has(String(source.localFinding.category || '')) };
+        const facts = { bindsDestination: DESTINATION_BOUND_CATEGORIES.has(String(source.localFinding.category || '')) };
+        const ruleCommands = localSafetyRuleCommands(source.localFinding);
+        if (ruleCommands)
+            facts.ruleCommands = ruleCommands;
+        return facts;
     }
     const policy = source.policyId ? source.policies?.find(p => p.id === source.policyId) : undefined;
     if (!policy)
@@ -1217,13 +1285,31 @@ function grantRuleFactsFor(source) {
     const bindsDestination = (policy.rules || []).some(rule => (rule.constraints || []).some(c => typeof c.field === 'string' && c.field.startsWith('destination.')));
     return { bindsDestination };
 }
+/**
+ * The programs a built-in Local Safety item declares (`commands`). A combined
+ * finding (`a+b`) is the union, and only when every item declares programs;
+ * custom rules and items without `commands` return undefined.
+ */
+function localSafetyRuleCommands(finding) {
+    if (!finding.itemId || finding.source === 'custom')
+        return undefined;
+    const commands = new Set();
+    for (const itemId of splitLocalSafetyRuleIds(finding.itemId) || [finding.itemId]) {
+        const rule = deterministicGuard_1.CREDENTIAL_COMMAND_RULES.find(r => r.itemId === itemId);
+        if (!rule || !rule.commands.length)
+            return undefined;
+        for (const command of rule.commands)
+            commands.add(command.toLowerCase());
+    }
+    return [...commands].sort();
+}
 /** Grants made without rule facts (MCP gateway, older callers) keep the narrow, host-bound shape. */
 const DEFAULT_GRANT_RULE_FACTS = { bindsDestination: true };
 function grantScopeFor(event, toolName, toolArgs, operation, context, facts = DEFAULT_GRANT_RULE_FACTS) {
     const scope = { event, toolName, operation: String(operation || '').trim() || 'unknown' };
     if (event === 'shell') {
         const command = typeof toolArgs?.command === 'string' ? toolArgs.command : typeof toolArgs?.cmd === 'string' ? toolArgs.cmd : '';
-        scope.programs = shellPrograms(command);
+        scope.programs = shellProgramsForRule(command, facts.ruleCommands);
         const cwd = typeof toolArgs?.cwd === 'string' ? toolArgs.cwd : undefined;
         const scripts = scriptGrantKeys(command, cwd);
         if (scripts.length)

package/dist/hookSlim.d.ts

@@ -10,7 +10,7 @@
  * hour. This entry exists to make the common path (daemon up, IPC verdict)
  * load almost nothing:
  *
- *   node boot -> hookSlim.js -> hookIo.js + verdictIpcClient.js  (3 small files,
+ *   node boot -> hookSlim.js -> hookIo.js + verdictIpcClient.js + callerEnv.js  (4 small files,
  *   Node built-ins only) -> named-pipe verdict -> print -> exit.
  *
  * FALLBACK PARITY: when the daemon is unreachable, this entry lazily requires

package/dist/hookSlim.js

@@ -11,7 +11,7 @@
  * hour. This entry exists to make the common path (daemon up, IPC verdict)
  * load almost nothing:
  *
- *   node boot -> hookSlim.js -> hookIo.js + verdictIpcClient.js  (3 small files,
+ *   node boot -> hookSlim.js -> hookIo.js + verdictIpcClient.js + callerEnv.js  (4 small files,
  *   Node built-ins only) -> named-pipe verdict -> print -> exit.
  *
  * FALLBACK PARITY: when the daemon is unreachable, this entry lazily requires
@@ -82,6 +82,25 @@ async function main() {
     const startedAt = Date.now();
     const flags = (0, hookIo_1.parseHookFlags)(process.argv.slice(2));
     const args = (0, hookIo_1.mapHookFlags)(flags);
+    // An error that escapes every await (async child-process 'error', stray
+    // rejection) would otherwise exit 1 with no verdict — an allow to the IDE,
+    // even mid-approval. Once the full hook is loaded it owns the verdict.
+    let hook;
+    const onCrash = (err) => {
+        const message = err instanceof Error ? err.message : String(err);
+        if (!hook) {
+            emitFailOpen(args.event, message);
+            return;
+        }
+        const outcome = hook.crashVerdictForProcess(args.event, message);
+        try {
+            process.stdout.write(outcome.stdout);
+        }
+        catch { /* stdout gone */ }
+        process.exit(outcome.exitCode);
+    };
+    process.on('uncaughtException', onCrash);
+    process.on('unhandledRejection', onCrash);
     try {
         const raw = await (0, hookIo_1.readStdin)();
         // FAST PATH: the resident daemon computes the verdict with everything warm.
@@ -121,7 +140,8 @@ async function main() {
         // kill-switch handling), so daemon-down behavior is identical to the
         // pre-slim hook. evaluateHookRequest never rejects by contract.
         // eslint-disable-next-line @typescript-eslint/no-var-requires
-        const { evaluateHookRequest } = require('./commands/hook');
+        hook = require('./commands/hook');
+        const { evaluateHookRequest } = hook;
         // eslint-disable-next-line @typescript-eslint/no-var-requires
         const { loadConfig } = require('./config');
         // eslint-disable-next-line @typescript-eslint/no-var-requires

package/dist/nativeHook.d.ts

@@ -1,4 +1,3 @@
-/** Native hook adapters. Never emit an unsupported `ask` to an IDE. */
 import { HookArgs } from './commands/hook';
 import { BotGuardConfig } from './config';
 import { confirmNativeAction } from './devConfirm';
@@ -6,6 +5,8 @@ export type NativeClient = 'codex' | 'gemini_cli' | 'windsurf' | 'kiro';
 type Payload = Record<string, any>;
 export declare const NATIVE_CLIENTS: NativeClient[];
 export declare function patchToolCalls(raw: Payload): Payload[];
+/** Gemini `read_many_files` reads every `include` path or glob: one read per target, like a Codex patch. */
+export declare function geminiReadManyCalls(raw: Payload): Payload[] | null;
 export declare function normalizeNativeInput(client: NativeClient, raw: Payload, codexServers?: string[]): Payload;
 export declare function nativeVerdict(client: NativeClient, denied: boolean, reason?: string): {
     stdout: string;

package/dist/nativeHook.js

@@ -1,12 +1,48 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.confirmNativeAction = exports.NATIVE_CLIENTS = void 0;
 exports.patchToolCalls = patchToolCalls;
+exports.geminiReadManyCalls = geminiReadManyCalls;
 exports.normalizeNativeInput = normalizeNativeInput;
 exports.nativeVerdict = nativeVerdict;
 exports.nativeErrorVerdict = nativeErrorVerdict;
 exports.evaluateNativeHook = evaluateNativeHook;
 /** Native hook adapters. Never emit an unsupported `ask` to an IDE. */
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
 const hook_1 = require("./commands/hook");
 const config_1 = require("./config");
 const runtimeConfig_1 = require("./runtimeConfig");
@@ -16,6 +52,7 @@ Object.defineProperty(exports, "confirmNativeAction", { enumerable: true, get: f
 const askDialog_1 = require("./askDialog");
 const telemetry_1 = require("./telemetry");
 const codexMcpIdentity_1 = require("./codexMcpIdentity");
+const actionPolicyEngine_1 = require("./actionPolicyEngine");
 /** Inside the 110 s process deadline below, with room for the verdict itself. */
 const NATIVE_DIALOG_TIMEOUT_MS = 90_000;
 exports.NATIVE_CLIENTS = ['codex', 'gemini_cli', 'windsurf', 'kiro'];
@@ -42,6 +79,41 @@ function patchToolCalls(raw) {
         throw new Error('Patch contains no recognized file operations');
     return calls;
 }
+/**
+ * Gemini CLI built-ins that never run a command, touch a workspace file, reach a
+ * server or the network (packages/core/src/tools/tool-names.ts, v0.61). Without
+ * this list the unknown-tool fallback below judged them as MCP calls.
+ */
+const GEMINI_PASSIVE_TOOLS = new Set([
+    'list_directory', 'glob', 'grep_search', 'search_file_content', 'update_topic', 'write_todos', 'complete_task',
+    'ask_user', 'enter_plan_mode', 'exit_plan_mode', 'activate_skill', 'get_internal_docs',
+    'tracker_create_task', 'tracker_update_task', 'tracker_get_task', 'tracker_list_tasks', 'tracker_add_dependency', 'tracker_visualize',
+]);
+function isAbsolutePathLike(value) {
+    return /^(?:[\\/]|[A-Za-z]:[\\/]|~)/.test(value);
+}
+/** Gemini `read_many_files` reads every `include` path or glob: one read per target, like a Codex patch. */
+function geminiReadManyCalls(raw) {
+    if (raw.tool_name !== 'read_many_files' || raw.mcp_context)
+        return null;
+    const include = Array.isArray(raw.tool_input?.include) ? raw.tool_input.include.map((p) => String(p || '').trim()).filter(Boolean) : [];
+    if (!include.length)
+        return null;
+    return include.map((file_path) => ({ ...raw, tool_name: 'read_file', tool_input: { file_path } }));
+}
+function geminiBuiltinInput(tool, raw, input) {
+    if (tool === 'run_shell_command' && typeof input.dir_path === 'string' && input.dir_path && !input.cwd) {
+        const base = String(raw.cwd || '');
+        const dir = input.dir_path;
+        const cwd = isAbsolutePathLike(dir) || !base ? dir : `${base.replace(/[\\/]+$/, '')}${base.includes('/') ? '/' : '\\'}${dir}`;
+        return { tool, input: { ...input, cwd } };
+    }
+    if (tool === 'save_memory') {
+        // Pre-0.61 memory tool: appends `fact` to the global GEMINI.md context file.
+        return { tool: 'write_file', input: { file_path: path.join(os.homedir(), '.gemini', 'GEMINI.md'), content: String(input.fact || '') } };
+    }
+    return { tool, input };
+}
 function normalizeNativeInput(client, raw, codexServers = []) {
     let name = String(raw.hook_event_name || '');
     let tool = String(raw.tool_name || '');
@@ -84,6 +156,8 @@ function normalizeNativeInput(client, raw, codexServers = []) {
             tool = `mcp__${raw.mcp_context.server_name}__${raw.mcp_context.tool_name}`;
         else if (tool.startsWith('mcp_'))
             tool = `mcp__gemini__${tool}`; // retain full name when the server split is ambiguous
+        else
+            ({ tool, input } = geminiBuiltinInput(tool, raw, input));
     }
     else if (client === 'kiro') {
         name = { preToolUse: 'PreToolUse', postToolUse: 'PostToolUse', userPromptSubmit: 'UserPromptSubmit' }[name] || name;
@@ -96,7 +170,8 @@ function normalizeNativeInput(client, raw, codexServers = []) {
         throw new Error('Missing tool name');
     // Unknown function tools still need Action Policy evaluation, not silent ignore.
     let normalized = { ...raw, hook_event_name: name, tool_name: tool, tool_input: input };
-    if (name !== 'UserPromptSubmit' && (0, hook_1.normalizeClaudePayload)(normalized)?.event === 'ignore') {
+    const passiveBuiltin = client === 'gemini_cli' && GEMINI_PASSIVE_TOOLS.has(tool);
+    if (name !== 'UserPromptSubmit' && !passiveBuiltin && (0, hook_1.normalizeClaudePayload)(normalized)?.event === 'ignore') {
         normalized = { ...normalized, tool_name: `mcp__${client}-builtin__${tool}` };
     }
     return normalized;
@@ -135,6 +210,15 @@ async function evaluateNativeHook(client, raw, args, config, confirm) {
             return nativeErrorVerdict(client, `Patch validation failed: ${String(error)}`);
         }
     }
+    const readManyCalls = client === 'gemini_cli' ? geminiReadManyCalls(raw) : null;
+    if (readManyCalls) {
+        for (const call of readManyCalls) {
+            const result = await evaluateNativeHook(client, call, args, config, confirm);
+            if (result.exitCode !== 0 || JSON.parse(result.stdout || '{}').decision === 'deny')
+                return result;
+        }
+        return nativeVerdict(client, false);
+    }
     let payload;
     const resolveCodexIdentity = client === 'codex' && String(raw.tool_name || '').startsWith('mcp__');
     if (resolveCodexIdentity && !(0, codexMcpIdentity_1.loadTomlParser)()) {
@@ -147,8 +231,10 @@ async function evaluateNativeHook(client, raw, args, config, confirm) {
     catch (error) {
         return nativeErrorVerdict(client, `FullCourtDefense could not parse the hook: ${String(error)}`);
     }
-    return (0, telemetry_1.markVerdictTiming)({ startedAt: Date.now(), path: 'local', agentClient: client }, async () => {
-        const evaluated = await (0, hook_1.evaluateHookRequest)({ ...args, agentClient: client }, JSON.stringify(payload), config);
+    // `client` names the vendor output shape; policies, telemetry and the console use the product id.
+    const agentClient = (0, actionPolicyEngine_1.canonicalAgentClient)(client);
+    return (0, telemetry_1.markVerdictTiming)({ startedAt: Date.now(), path: 'local', agentClient }, async () => {
+        const evaluated = await (0, hook_1.evaluateHookRequest)({ ...args, agentClient }, JSON.stringify(payload), config);
         // The three-button FullCourtDefense dialog (askDialog.ts) — the same one Cursor
         // and Claude Code get. A test-injected `confirm` keeps the legacy yes/no shape.
         const result = await (0, askDialog_1.resolveAskWithDialog)(evaluated, {
@@ -201,9 +287,28 @@ async function main() {
         throw new Error('Unsupported native hook client');
     const config = (0, config_1.loadConfig)();
     const shieldId = (0, config_1.resolveCliCredentials)(config, { shieldId: flags['shield-id'] }, { skipDpapi: true }).shieldId;
+    // Errors that escape every await (an async child-process 'error') would exit
+    // 1 with no verdict, which these clients read as "hook failed, continue".
+    // Same stance as the deadline below. After the verdict is out, nothing is left to decide.
+    let verdictWritten = false;
+    const onCrash = (err) => {
+        if (verdictWritten)
+            return;
+        verdictWritten = true;
+        const deny = (0, runtimeConfig_1.isSuspendedByCache)() || (0, runtimeConfig_1.cachedEnforcementState)(shieldId).mode === 'block';
+        const result = deny ? nativeErrorVerdict(client, `FullCourtDefense hook failed: ${String(err)}; action not approved.`) : nativeVerdict(client, false);
+        if (result.stdout)
+            process.stdout.write(result.stdout + '\n');
+        if (result.stderr)
+            process.stderr.write(result.stderr + '\n');
+        process.exit(result.exitCode);
+    };
+    process.on('uncaughtException', onCrash);
+    process.on('unhandledRejection', onCrash);
     // Return before the vendor's 130s timeout: some clients fail open on timeout.
     // Bound the entire hook, including multiple patch files and human dialogs.
     const deadline = setTimeout(() => {
+        verdictWritten = true;
         const deny = (0, runtimeConfig_1.isSuspendedByCache)() || (0, runtimeConfig_1.cachedEnforcementState)(shieldId).mode === 'block';
         const result = deny ? nativeErrorVerdict(client, 'FullCourtDefense evaluation deadline exceeded; action not approved.') : nativeVerdict(client, false);
         if (result.stdout)
@@ -216,6 +321,7 @@ async function main() {
     const raw = JSON.parse((await (0, hookIo_1.readStdin)()).replace(/^\uFEFF/, ''));
     const result = await evaluateNativeHook(client, raw, (0, hookIo_1.mapHookFlags)(flags), config);
     clearTimeout(deadline);
+    verdictWritten = true;
     if (result.stdout)
         process.stdout.write(result.stdout + '\n');
     if (result.stderr)

package/dist/notify.js

@@ -22,6 +22,10 @@ function spawnDetached(command, args, opts) {
             windowsHide: opts?.showWindow ? false : true,
             env: opts?.env ? { ...process.env, ...opts.env } : process.env,
         });
+        // A missing binary (no notify-send on a headless box) surfaces as an
+        // ASYNC 'error' event, not a throw. Unhandled, it kills the calling hook
+        // mid-verdict — and a hook that dies without output is an allow to the IDE.
+        child.on('error', () => { });
         child.unref();
     }
     catch { /* best-effort */ }

package/dist/telemetry.d.ts

@@ -109,6 +109,8 @@ interface VerdictTiming {
 }
 /** Run one hook evaluation with timing attached to everything it spools. */
 export declare function markVerdictTiming<T>(timing: VerdictTiming, fn: () => T): T;
+/** When the developer's wait for the current evaluation began (undefined outside one). */
+export declare function verdictStartedAt(): number | undefined;
 /**
  * Re-label the current evaluation (e.g. it ended in the fail-open handler).
  * Keeps the original start time so latency still covers the full wait.

package/dist/telemetry.js

@@ -36,6 +36,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.EVIDENCE_MAX_CHARS = void 0;
 exports.evidenceFromToolArgs = evidenceFromToolArgs;
 exports.markVerdictTiming = markVerdictTiming;
+exports.verdictStartedAt = verdictStartedAt;
 exports.setVerdictPath = setVerdictPath;
 exports.setVerdictClient = setVerdictClient;
 exports.setVerdictIdentity = setVerdictIdentity;
@@ -178,6 +179,10 @@ const verdictTiming = new async_hooks_1.AsyncLocalStorage();
 function markVerdictTiming(timing, fn) {
     return verdictTiming.run(timing, fn);
 }
+/** When the developer's wait for the current evaluation began (undefined outside one). */
+function verdictStartedAt() {
+    return verdictTiming.getStore()?.startedAt;
+}
 /**
  * Re-label the current evaluation (e.g. it ended in the fail-open handler).
  * Keeps the original start time so latency still covers the full wait.
@@ -486,6 +491,7 @@ function triggerFlush(immediate = false) {
             stdio: 'ignore',
             windowsHide: true,
         });
+        child.on('error', () => { });
         child.unref();
     }
     catch { /* best-effort */ }

package/dist/verdictIpc.js

@@ -39,6 +39,7 @@ const crypto = __importStar(require("crypto"));
 const fs = __importStar(require("fs"));
 const net = __importStar(require("net"));
 const telemetry_1 = require("./telemetry");
+const callerEnv_1 = require("./callerEnv");
 const verdictIpcClient_1 = require("./verdictIpcClient");
 /**
  * Daemon verdict IPC — SERVER side (runs inside the resident daemon).
@@ -139,8 +140,10 @@ function startVerdictServer(evaluate, log) {
                     // evaluation spools, so fleet telemetry reports the wall time the
                     // developer waited. Per-request (AsyncLocalStorage), so concurrent
                     // hooks in this one daemon never borrow each other's timings.
-                    const result = await (0, telemetry_1.markVerdictTiming)({ startedAt: typeof request.t0 === 'number' ? request.t0 : Date.now(), path: 'ipc' }, () => evaluate(request.args || {}, String(request.stdin ?? '')));
-                    reply({ v: verdictIpcClient_1.VERDICT_IPC_PROTOCOL_VERSION, ...result });
+                    // Decision facts read from the environment are the CALLER's (#1466):
+                    // this process is a scheduled task, not the IDE session that asked.
+                    const result = await (0, callerEnv_1.withCallerEnv)(request.env, () => (0, telemetry_1.markVerdictTiming)({ startedAt: typeof request.t0 === 'number' ? request.t0 : Date.now(), path: 'ipc' }, () => evaluate(request.args || {}, String(request.stdin ?? ''))));
+                    reply({ v: verdictIpcClient_1.VERDICT_IPC_PROTOCOL_VERSION, ...result, ...(request.env ? { envApplied: true } : {}) });
                 }
                 catch (err) {
                     // Evaluator bug — tell the client to fall back locally (which will