fullcourtdefense-cli 1.36.4 → 1.38.0

package/dist/askDialog.d.ts

@@ -56,6 +56,17 @@ export interface AskEnvelope {
     reason: string;
     /** The client the runtime event records as `agentClient` (cursor, claude-code, …): the dialog names the same agent as the console. */
     agentClient?: string;
+    /**
+     * The asking call's correlation identity (session / run / tool call id): the
+     * dialog's outcome is recorded by this process, outside that call's
+     * evaluation, and must name the same action. Older hook builds omit it.
+     */
+    identity?: {
+        sessionId?: string;
+        runId?: string;
+        instanceId?: string;
+        attemptId?: string;
+    };
 }
 export type AskResolution = 'allow' | 'allow_always' | 'deny' | 'timeout' | 'ide';
 export interface HookVerdict {
@@ -96,6 +107,7 @@ export declare function resolveAskWithDialog(verdict: HookVerdict, options?: {
     clientLabel?: string;
     timeoutMs?: number;
     dialog?: DialogFn;
+    deadlineAt?: number;
 }): Promise<HookVerdict & {
     resolution?: AskResolution;
     envelope?: AskEnvelope;

package/dist/askDialog.js

@@ -30,12 +30,15 @@ exports.resolveAskWithDialog = resolveAskWithDialog;
  */
 const devConfirm_1 = require("./devConfirm");
 const telemetry_1 = require("./telemetry");
+const actionIdentity_1 = require("./actionIdentity");
 const hookIo_1 = require("./hookIo");
 const callerEnv_1 = require("./callerEnv");
 /** Field on the verdict JSON that carries the envelope. Stripped before the IDE sees the verdict. */
 exports.ASK_ENVELOPE_FIELD = 'fcdAsk';
 /** Default wait for the person. Cursor's hook window is 90 s, Claude's 60 s by default; stay inside both. */
 exports.ASK_DIALOG_TIMEOUT_MS = 55_000;
+/** Less time than this before the IDE's cutoff is not enough to read and answer a dialog. */
+const MIN_DIALOG_TIMEOUT_MS = 5_000;
 /** Which channel asks the developer. `dialog` (default) = our OS dialog, `ide` = the IDE's own card. */
 function askChannel() {
     return ((0, callerEnv_1.callerEnv)().FCD_ASK_CHANNEL || '').trim().toLowerCase() === 'ide' ? 'ide' : 'dialog';
@@ -97,9 +100,20 @@ function rewriteDecision(decision, allowed, userMsg, agentMsg) {
  * written as-is with the envelope removed. Then the process exits.
  */
 async function emitVerdictForIde(args, result, entry) {
+    // This process ends with the verdict below: an upload the dialog's outcome
+    // asks for (allow, decline, timeout) starts after stdout, at exit — never
+    // while the IDE still waits for the answer.
+    try {
+        (0, telemetry_1.deferFlushUntilExit)();
+    }
+    catch { /* best-effort */ }
     let final = result;
     try {
-        const resolved = await resolveAskWithDialog(result, { clientLabel: args.agentClient });
+        // This is the per-event process the IDE started: its clock started with
+        // the process, so the dialog must end before the IDE's hook timeout does
+        // (a killed hook runs the action without anyone's answer).
+        const processStartedAt = Date.now() - Math.round(process.uptime() * 1000);
+        const resolved = await resolveAskWithDialog(result, { clientLabel: args.agentClient, deadlineAt: (0, callerEnv_1.ideWaitCutoff)(processStartedAt) });
         if (resolved.resolution)
             (0, hookIo_1.dbg)({ phase: 'ask_dialog', event: args.event, entry, resolution: resolved.resolution, tool: resolved.envelope?.toolName });
         final = resolved;
@@ -137,7 +151,11 @@ async function resolveAskWithDialog(verdict, options = {}) {
     const clean = { ...verdict, stdout: taken.stdout, envelope };
     // An injected dialog (tests, embedding hosts) only needs a person; the OS dialog also needs a display.
     const canAsk = options.dialog ? (0, devConfirm_1.isHumanPresent)() : (0, devConfirm_1.nativeDialogAvailable)();
-    if (askChannel() === 'ide' || !canAsk)
+    // Wait = min(configured, time left before the IDE's cutoff). Too little time
+    // left for a person to read and answer: the IDE's own ask card takes the
+    // question instead, so the hook still answers inside the IDE's window.
+    const dialogTimeoutMs = Math.min(options.timeoutMs ?? exports.ASK_DIALOG_TIMEOUT_MS, options.deadlineAt === undefined ? Number.POSITIVE_INFINITY : options.deadlineAt - Date.now());
+    if (askChannel() === 'ide' || !canAsk || dialogTimeoutMs < MIN_DIALOG_TIMEOUT_MS)
         return { ...clean, resolution: 'ide' };
     const grantHash = envelope.ruleHash || envelope.policyHash;
     const grantLimits = envelope.grantLimits === null ? undefined : (envelope.grantLimits || { ttlMs: devConfirm_1.GRANT_TTL_MS });
@@ -163,7 +181,7 @@ async function resolveAskWithDialog(verdict, options = {}) {
     let outcome = 'unavailable';
     let latencyMs = 0;
     try {
-        ({ outcome, latencyMs } = await dialog(reason, options.timeoutMs ?? exports.ASK_DIALOG_TIMEOUT_MS, { allowAlways, alwaysScopeLabel: scopeLabel, alwaysLimitsLabel: limitsLabel, alwaysCovers, alwaysNotOffered, subject }));
+        ({ outcome, latencyMs } = await dialog(reason, dialogTimeoutMs, { allowAlways, alwaysScopeLabel: scopeLabel, alwaysLimitsLabel: limitsLabel, alwaysCovers, alwaysNotOffered, subject }));
     }
     catch {
         outcome = 'unavailable';
@@ -171,6 +189,14 @@ async function resolveAskWithDialog(verdict, options = {}) {
     if (outcome === 'unavailable')
         return { ...clean, resolution: 'ide' };
     const policyLabel = envelope.policyName ? ` (${envelope.policyName})` : '';
+    // The outcome is the asking call's: its client and identity, not this process's.
+    // No latency / verdict path: the ask itself recorded the hook's wait (one health
+    // sample per call), and the person's answer time is confirmLatencyMs.
+    const outcomeFacts = (askOutcome) => ({
+        askOutcome,
+        ...(envelope.agentClient || options.clientLabel ? { agentClient: envelope.agentClient || options.clientLabel } : {}),
+        ...envelopeIdentity(envelope),
+    });
     if (outcome === 'allow' || outcome === 'allow_always') {
         // Same bookkeeping the post-execution hook would have done for an IDE Allow.
         (0, devConfirm_1.settleDeveloperConfirmation)(envelope.event, envelope.toolName, envelope.argsDigest);
@@ -193,6 +219,7 @@ async function resolveAskWithDialog(verdict, options = {}) {
             approvalScope: 'developer',
             approvedBy: 'developer',
             confirmLatencyMs: latencyMs,
+            ...outcomeFacts(granted ? 'allowed_always' : 'allowed'),
         });
         (0, telemetry_1.triggerFlush)(false);
         const agentMsg = granted
@@ -213,6 +240,9 @@ async function resolveAskWithDialog(verdict, options = {}) {
         policyHash: envelope.policyHash,
         approvalScope: 'developer',
         confirmLatencyMs: latencyMs,
+        // No answer is not a rule's block: the action did not run (the IDE gets the
+        // same deny), but nobody decided against it — recorded as an unanswered ask.
+        ...outcomeFacts(timedOut ? 'unanswered' : 'denied'),
     });
     (0, telemetry_1.triggerFlush)(true);
     const userMsg = timedOut
@@ -223,3 +253,16 @@ async function resolveAskWithDialog(verdict, options = {}) {
         : `FullCourtDefense: the developer denied this ${envelope.event} in the confirmation dialog. Do not retry or work around it.`;
     return { ...clean, stdout: JSON.stringify(rewriteDecision(decision, false, userMsg, agentMsg)), exitCode: 0, resolution: outcome };
 }
+/** The asking call's identity from the envelope: well-formed parts only. */
+function envelopeIdentity(envelope) {
+    const raw = envelope.identity;
+    if (!raw || typeof raw !== 'object')
+        return {};
+    const out = {};
+    for (const key of ['sessionId', 'runId', 'instanceId', 'attemptId']) {
+        const value = (0, actionIdentity_1.identityPart)(raw[key]);
+        if (value)
+            out[key] = value;
+    }
+    return out;
+}

package/dist/awakeClock.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Was the MACHINE asleep, or only the daemon's event loop?
+ *
+ * The daemon detects a resume from sleep by a beat that observes far more
+ * wall time than its interval. A long synchronous stretch on its own loop
+ * looks the same: 2026-10-02 06:58, a 201 s protect-all pass ended and two
+ * seconds later the daemon logged "Resume detected: 237s ... suspended",
+ * re-reported in and recorded network_down [x30] from timeouts that ran out
+ * inside the stall — while hook.log showed hooks every few seconds throughout.
+ *
+ * This clock ticks on a worker thread, which keeps running while the main
+ * loop is blocked and stops only when the whole process (the machine) does.
+ * A long main-loop gap with no long gap here was a stall, not a suspend.
+ * One thread, a 1 s timer, no process and no I/O.
+ */
+export declare const AWAKE_TICK_MS = 1000;
+/** A worker gap this short through a long main-loop gap: the machine stayed awake. */
+export declare const AWAKE_GAP_MAX_MS = 10000;
+export interface AwakeClock {
+    /** Longest gap between ticks since the previous call (including the time since the last tick). Undefined once the clock is gone. */
+    takeMaxGapMs(): number | undefined;
+    stop(): void;
+}
+export declare function startAwakeClock(tickMs?: number): AwakeClock | undefined;
+/**
+ * Pure: what a gap of `driftMs` between two beats of the daemon's loop was.
+ * Without the awake clock (it could not start) every long gap stays a suspend,
+ * as before.
+ */
+export declare function classifyClockJump(input: {
+    driftMs: number;
+    jumpMs: number;
+    awakeGapMs?: number;
+}): 'none' | 'stall' | 'suspend';

package/dist/awakeClock.js

@@ -0,0 +1,81 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AWAKE_GAP_MAX_MS = exports.AWAKE_TICK_MS = void 0;
+exports.startAwakeClock = startAwakeClock;
+exports.classifyClockJump = classifyClockJump;
+const worker_threads_1 = require("worker_threads");
+/**
+ * Was the MACHINE asleep, or only the daemon's event loop?
+ *
+ * The daemon detects a resume from sleep by a beat that observes far more
+ * wall time than its interval. A long synchronous stretch on its own loop
+ * looks the same: 2026-10-02 06:58, a 201 s protect-all pass ended and two
+ * seconds later the daemon logged "Resume detected: 237s ... suspended",
+ * re-reported in and recorded network_down [x30] from timeouts that ran out
+ * inside the stall — while hook.log showed hooks every few seconds throughout.
+ *
+ * This clock ticks on a worker thread, which keeps running while the main
+ * loop is blocked and stops only when the whole process (the machine) does.
+ * A long main-loop gap with no long gap here was a stall, not a suspend.
+ * One thread, a 1 s timer, no process and no I/O.
+ */
+exports.AWAKE_TICK_MS = 1_000;
+/** A worker gap this short through a long main-loop gap: the machine stayed awake. */
+exports.AWAKE_GAP_MAX_MS = 10_000;
+function startAwakeClock(tickMs = exports.AWAKE_TICK_MS) {
+    try {
+        // [0] last tick (wall ms), [1] longest gap between ticks since the last read.
+        const shared = new Float64Array(new SharedArrayBuffer(16));
+        shared[0] = Date.now();
+        const source = `
+      const { workerData } = require('worker_threads');
+      const clock = new Float64Array(workerData);
+      let last = Date.now();
+      setInterval(() => {
+        const now = Date.now();
+        if (now - last > clock[1]) clock[1] = now - last;
+        last = now;
+        clock[0] = now;
+      }, ${Math.max(100, Math.floor(tickMs))});
+    `;
+        const worker = new worker_threads_1.Worker(source, {
+            eval: true,
+            workerData: shared.buffer,
+            resourceLimits: { maxOldGenerationSizeMb: 16, maxYoungGenerationSizeMb: 4 },
+            stdout: true,
+            stderr: true,
+        });
+        worker.unref();
+        let alive = true;
+        worker.on('error', () => { alive = false; });
+        worker.on('exit', () => { alive = false; });
+        return {
+            takeMaxGapMs() {
+                if (!alive)
+                    return undefined;
+                const gap = Math.max(shared[1], Date.now() - shared[0]);
+                shared[1] = 0;
+                return gap;
+            },
+            stop() {
+                alive = false;
+                void worker.terminate().catch(() => { });
+            },
+        };
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Pure: what a gap of `driftMs` between two beats of the daemon's loop was.
+ * Without the awake clock (it could not start) every long gap stays a suspend,
+ * as before.
+ */
+function classifyClockJump(input) {
+    if (input.driftMs < input.jumpMs)
+        return 'none';
+    if (input.awakeGapMs !== undefined && input.awakeGapMs < exports.AWAKE_GAP_MAX_MS)
+        return 'stall';
+    return 'suspend';
+}

package/dist/backupManifest.d.ts

@@ -1,7 +1,20 @@
+/** Distinct recent versions kept per config, besides its oldest (original) copy. */
+export declare const KEEP_RECENT_BACKUPS = 3;
 export declare function backupManifestPath(): string;
 /** Every recorded backup path (absent/corrupt manifest = empty list). */
 export declare function readBackupManifest(): string[];
-/** Record one backup file path. Deduped, capped, never throws. */
+/** Record one backup file path. Deduped, never throws. */
 export declare function recordConfigBackup(backupPath: string): void;
 /** Drop entries whose backup file no longer exists (post-cleanup compaction). */
 export declare function pruneBackupManifest(): void;
+/** This config's safety copies next to it (`<name>.fcd-backup-<ms>`), oldest first. */
+export declare function listConfigBackups(file: string): string[];
+/**
+ * Back `file` up next to itself before FullCourtDefense rewrites it — once per
+ * distinct content: a version already kept (a rewrite that only flips the
+ * runtime path back and forth, a pass that writes the same content) adds no
+ * copy. Afterwards the config keeps its oldest copy (the original, before
+ * FullCourtDefense first changed it) and its KEEP_RECENT newest. Returns the
+ * new copy, or undefined when none was needed (or it failed). Never throws.
+ */
+export declare function createConfigBackup(file: string, now?: number): string | undefined;

package/dist/backupManifest.js

@@ -33,10 +33,13 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.KEEP_RECENT_BACKUPS = void 0;
 exports.backupManifestPath = backupManifestPath;
 exports.readBackupManifest = readBackupManifest;
 exports.recordConfigBackup = recordConfigBackup;
 exports.pruneBackupManifest = pruneBackupManifest;
+exports.listConfigBackups = listConfigBackups;
+exports.createConfigBackup = createConfigBackup;
 const fs = __importStar(require("fs"));
 const os = __importStar(require("os"));
 const path = __importStar(require("path"));
@@ -51,11 +54,21 @@ const path = __importStar(require("path"));
  * authoritative list at cleanup time (union-ed with the known-dir scan for
  * backups created by older CLI versions).
  *
+ * Bounded (2026-10: 5,517 copies, 9.8 MB, and a manifest silently cut at its
+ * newest 2,000 entries, so uninstall missed most of them): a config keeps the
+ * copy taken before FullCourtDefense first changed it plus its last
+ * KEEP_RECENT distinct versions (createConfigBackup), and the manifest drops
+ * only entries whose file is gone — never a live one.
+ *
  * Best-effort by design: a manifest write failure must never break a protect
  * operation, and cleanup falls back to the directory scan.
  */
 const MANIFEST_NAME = 'backup-manifest.json';
-const MAX_ENTRIES = 2000;
+/** Size guard for the manifest file itself; reached only after every missing-file entry is dropped. */
+const MAX_ENTRIES = 20_000;
+/** Distinct recent versions kept per config, besides its oldest (original) copy. */
+exports.KEEP_RECENT_BACKUPS = 3;
+const BACKUP_INFIX = '.fcd-backup-';
 function backupManifestPath() {
     return path.join(os.homedir(), '.fullcourtdefense', MANIFEST_NAME);
 }
@@ -70,23 +83,105 @@ function readBackupManifest() {
         return [];
     }
 }
-/** Record one backup file path. Deduped, capped, never throws. */
-function recordConfigBackup(backupPath) {
+function sleepSync(ms) {
+    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+/**
+ * Read-modify-write the manifest under a short lock, written atomically
+ * (temp + rename): concurrent protect passes (daemon, CLI, hooks) no longer
+ * drop each other's entries. Bounded wait; never throws.
+ */
+function updateManifest(change) {
+    const file = backupManifestPath();
+    const lock = `${file}.lock`;
+    let held = false;
     try {
-        const existing = readBackupManifest();
-        if (existing.includes(backupPath))
-            return;
-        const entries = [...existing, backupPath].slice(-MAX_ENTRIES);
-        const file = backupManifestPath();
         fs.mkdirSync(path.dirname(file), { recursive: true });
-        fs.writeFileSync(file, `${JSON.stringify({ backups: entries }, null, 2)}\n`, 'utf8');
+        // Protect passes only (daemon, housekeeping worker, CLI) — never a hook: a short wait is fine.
+        const deadline = Date.now() + 2_000;
+        for (let attempt = 0; attempt < 1_000 && !held; attempt += 1) {
+            try {
+                fs.writeFileSync(lock, String(process.pid), { flag: 'wx' });
+                held = true;
+            }
+            catch (error) {
+                // EPERM/EACCES: Windows reports a lock file being deleted that way — still contention.
+                const code = error.code;
+                if (code !== 'EEXIST' && code !== 'EPERM' && code !== 'EACCES')
+                    break;
+                try {
+                    if (Date.now() - fs.statSync(lock).mtimeMs > 10_000) {
+                        fs.unlinkSync(lock);
+                        continue;
+                    }
+                }
+                catch { /* released meanwhile */ }
+                if (Date.now() >= deadline)
+                    break;
+                sleepSync(5);
+            }
+        }
+        const before = readBackupManifest();
+        const next = change(before);
+        if (!next)
+            return;
+        const tmp = `${file}.${process.pid}.${Date.now()}.tmp`;
+        try {
+            if (next.length === 0) {
+                fs.rmSync(file, { force: true });
+                return;
+            }
+            fs.writeFileSync(tmp, `${JSON.stringify({ backups: next }, null, 2)}\n`, 'utf8');
+            for (let attempt = 0;; attempt += 1) {
+                try {
+                    fs.renameSync(tmp, file);
+                    break;
+                }
+                catch (error) {
+                    // Windows: a reader (or a scanner) holding the file open fails the rename for a moment.
+                    const code = error.code;
+                    if (attempt >= 20 || (code !== 'EPERM' && code !== 'EACCES' && code !== 'EBUSY'))
+                        throw error;
+                    sleepSync(10);
+                }
+            }
+        }
+        catch {
+            try {
+                fs.unlinkSync(tmp);
+            }
+            catch { /* not there */ }
+        }
     }
     catch { /* best effort — cleanup still has the directory scan */ }
+    finally {
+        if (held) {
+            try {
+                fs.unlinkSync(lock);
+            }
+            catch { /* gone */ }
+        }
+    }
+}
+/** Drop entries whose file is gone; only then, if still over the guard, the oldest. */
+function bounded(entries) {
+    if (entries.length <= MAX_ENTRIES)
+        return entries;
+    const live = entries.filter(entry => { try {
+        return fs.existsSync(entry);
+    }
+    catch {
+        return true;
+    } });
+    return live.length <= MAX_ENTRIES ? live : live.slice(-MAX_ENTRIES);
+}
+/** Record one backup file path. Deduped, never throws. */
+function recordConfigBackup(backupPath) {
+    updateManifest(existing => (existing.includes(backupPath) ? undefined : bounded([...existing, backupPath])));
 }
 /** Drop entries whose backup file no longer exists (post-cleanup compaction). */
 function pruneBackupManifest() {
-    try {
-        const existing = readBackupManifest();
+    updateManifest((existing) => {
         const remaining = existing.filter(entry => {
             try {
                 return fs.existsSync(entry);
@@ -95,14 +190,80 @@ function pruneBackupManifest() {
                 return true;
             }
         });
-        if (remaining.length === existing.length)
-            return;
-        const file = backupManifestPath();
-        if (remaining.length === 0) {
-            fs.rmSync(file, { force: true });
-            return;
+        return remaining.length === existing.length ? undefined : remaining;
+    });
+}
+/** This config's safety copies next to it (`<name>.fcd-backup-<ms>`), oldest first. */
+function listConfigBackups(file) {
+    const dir = path.dirname(file);
+    const prefix = `${path.basename(file)}${BACKUP_INFIX}`;
+    try {
+        return fs.readdirSync(dir)
+            .filter(name => name.startsWith(prefix) && /^\d+$/.test(name.slice(prefix.length)))
+            .sort((a, b) => Number(a.slice(prefix.length)) - Number(b.slice(prefix.length)))
+            .map(name => path.join(dir, name));
+    }
+    catch {
+        return [];
+    }
+}
+function sameContent(file, content) {
+    try {
+        return fs.statSync(file).size === content.length && fs.readFileSync(file).equals(content);
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Back `file` up next to itself before FullCourtDefense rewrites it — once per
+ * distinct content: a version already kept (a rewrite that only flips the
+ * runtime path back and forth, a pass that writes the same content) adds no
+ * copy. Afterwards the config keeps its oldest copy (the original, before
+ * FullCourtDefense first changed it) and its KEEP_RECENT newest. Returns the
+ * new copy, or undefined when none was needed (or it failed). Never throws.
+ */
+function createConfigBackup(file, now = Date.now()) {
+    try {
+        const content = fs.readFileSync(file);
+        const existing = listConfigBackups(file);
+        if (existing.some(copy => sameContent(copy, content)))
+            return undefined;
+        let stamp = now;
+        let backup = '';
+        for (let attempt = 0; attempt < 5; attempt += 1, stamp += 1) {
+            backup = `${file}${BACKUP_INFIX}${stamp}`;
+            try {
+                fs.copyFileSync(file, backup, fs.constants.COPYFILE_EXCL);
+                break;
+            }
+            catch (error) {
+                if (error.code !== 'EEXIST' || attempt === 4)
+                    throw error;
+            }
         }
-        fs.writeFileSync(file, `${JSON.stringify({ backups: remaining }, null, 2)}\n`, 'utf8');
+        // Backups can embed live credentials and land in project-local dirs no
+        // scan can enumerate — record each one so uninstall can delete them all.
+        recordConfigBackup(backup);
+        const all = [...existing, backup];
+        const keep = new Set([all[0], ...all.slice(-exports.KEEP_RECENT_BACKUPS)]);
+        const pruned = [];
+        for (const copy of all) {
+            if (keep.has(copy))
+                continue;
+            try {
+                fs.rmSync(copy, { force: true });
+                pruned.push(copy);
+            }
+            catch { /* left for uninstall */ }
+        }
+        if (pruned.length > 0) {
+            const gone = new Set(pruned);
+            updateManifest(entries => entries.filter(entry => !gone.has(entry)));
+        }
+        return backup;
+    }
+    catch {
+        return undefined;
     }
-    catch { /* best effort */ }
 }

package/dist/callerEnv.d.ts

@@ -11,10 +11,23 @@
  *
  * Node built-ins only: this leaf is on the slim hook's warm-path module graph.
  */
-export declare const CALLER_ENV_KEYS: readonly ["FCD_HUMAN_PRESENT", "FCD_EPHEMERAL", "FULLCOURTDEFENSE_EPHEMERAL", "CI", "GITHUB_ACTIONS", "GITLAB_CI", "TF_BUILD", "JENKINS_URL", "BUILDKITE", "CIRCLECI", "DISPLAY", "WAYLAND_DISPLAY", "FCD_ASK_CHANNEL", "FCD_SESSION_ID", "CLAUDE_CODE_SESSION_ID", "CODEX_THREAD_ID", "FCD_RUN_ID", "GITHUB_RUN_ID", "CI_PIPELINE_ID", "FCD_WORKLOAD_INSTANCE_ID", "CLAUDECODE", "CLAUDE_PROJECT_DIR", "VSCODE_PID", "TERM_PROGRAM", "WORKSPACE_PATH", "FCD_HOOK_IDE_TIMEOUT_MS", "FCD_TAINT_APPROVE_ONCE_DISABLED", "FCD_TAINT_APPROVAL_TIMEOUT_MS", "CLOUDSDK_CORE_PROJECT", "CLOUDSDK_ACTIVE_CONFIG_NAME", "CLOUDSDK_CONFIG", "APPDATA", "AWS_PROFILE", "AWS_DEFAULT_PROFILE", "AWS_REGION", "AWS_DEFAULT_REGION", "AWS_CONFIG_FILE", "AWS_SHARED_CREDENTIALS_FILE", "AWS_ACCESS_KEY_ID", "KUBECONFIG", "HELM_KUBECONTEXT", "HELM_NAMESPACE", "HELM_KUBEAPISERVER", "HELM_KUBETOKEN", "HELM_KUBEASUSER", "DOCKER_HOST", "DOCKER_CONTEXT", "AZURE_CONFIG_DIR", "AZURE_DEFAULTS_GROUP", "TF_WORKSPACE", "TF_DATA_DIR", "PGHOST", "PGDATABASE", "PGSERVICE", "MYSQL_HOST"];
+export declare const CALLER_ENV_KEYS: readonly ["FCD_HUMAN_PRESENT", "FCD_EPHEMERAL", "FULLCOURTDEFENSE_EPHEMERAL", "CI", "GITHUB_ACTIONS", "GITLAB_CI", "TF_BUILD", "JENKINS_URL", "BUILDKITE", "CIRCLECI", "DISPLAY", "WAYLAND_DISPLAY", "FCD_ASK_CHANNEL", "FCD_SESSION_ID", "CLAUDE_CODE_SESSION_ID", "CODEX_THREAD_ID", "FCD_RUN_ID", "GITHUB_RUN_ID", "CI_PIPELINE_ID", "FCD_WORKLOAD_INSTANCE_ID", "CLAUDECODE", "CLAUDE_PROJECT_DIR", "VSCODE_PID", "TERM_PROGRAM", "WORKSPACE_PATH", "FCD_HOOK_IDE_TIMEOUT_MS", "FCD_TAINT_APPROVE_ONCE_DISABLED", "FCD_TAINT_APPROVAL_TIMEOUT_MS", "FCD_HOOK_DEBUG", "FCD_MONITOR_HINTS", "FCD_PERF_PROBE", "CLOUDSDK_CORE_PROJECT", "CLOUDSDK_ACTIVE_CONFIG_NAME", "CLOUDSDK_CONFIG", "APPDATA", "AWS_PROFILE", "AWS_DEFAULT_PROFILE", "AWS_REGION", "AWS_DEFAULT_REGION", "AWS_CONFIG_FILE", "AWS_SHARED_CREDENTIALS_FILE", "AWS_ACCESS_KEY_ID", "KUBECONFIG", "HELM_KUBECONTEXT", "HELM_NAMESPACE", "HELM_KUBEAPISERVER", "HELM_KUBETOKEN", "HELM_KUBEASUSER", "DOCKER_HOST", "DOCKER_CONTEXT", "AZURE_CONFIG_DIR", "AZURE_DEFAULTS_GROUP", "TF_WORKSPACE", "TF_DATA_DIR", "PGHOST", "PGDATABASE", "PGSERVICE", "MYSQL_HOST"];
 export type CallerEnvSnapshot = Partial<Record<(typeof CALLER_ENV_KEYS)[number], string>>;
+/**
+ * Keys a decision reads only for WHETHER they are set (cloudGrantTools: static
+ * AWS keys beat every profile; a helm API server / token / impersonation makes
+ * the target unknown) — and some are credentials (HELM_KUBETOKEN is a bearer
+ * token). A snapshot that is written to disk keeps only that they are set.
+ */
+export declare const PRESENCE_ONLY_CALLER_ENV_KEYS: readonly (typeof CALLER_ENV_KEYS)[number][];
 /** The keys above that are set in `env` — what the thin client sends. */
 export declare function snapshotCallerEnv(env?: NodeJS.ProcessEnv): CallerEnvSnapshot;
+/**
+ * snapshotCallerEnv for a snapshot that is STORED (the monitor fast path's
+ * local queue): the same decision facts, without credential values — a
+ * presence-only key keeps '1' when set (non-blank), '' when blank.
+ */
+export declare function storableCallerEnv(env?: NodeJS.ProcessEnv): CallerEnvSnapshot;
 /** The environment decision facts are read from: the requesting caller's inside a daemon request, else this process's. */
 export declare function callerEnv(): NodeJS.ProcessEnv;
 /**
@@ -26,13 +39,47 @@ export declare function withCallerEnv<T>(snapshot: unknown, fn: () => T): T;
 /**
  * How long the IDE lets an approval-capable hook run before it kills the hook
  * (and runs the action): Claude Code / Copilot / VS Code and Cursor: 90s.
- * FCD_HOOK_IDE_TIMEOUT_MS narrows it for drills.
+ * FCD_HOOK_IDE_TIMEOUT_MS narrows it — per hook entry (applyIdeTimeoutArg) and
+ * for drills.
  */
 export declare const IDE_HOOK_TIMEOUT_MS = 90000;
 export declare const IDE_TIMEOUT_MARGIN_MS = 15000;
 export declare function ideHookTimeoutMs(env?: NodeJS.ProcessEnv): number;
+/**
+ * The installer writes each hook entry's real IDE timeout into its command
+ * (`--ide-timeout <seconds>`, the same number as the entry's `timeout`): Claude
+ * Code PostToolUse 10s, UserPromptSubmit 30s, PreToolUse 90s; Cursor per event.
+ * A hook the IDE kills runs the action, so every wait must end before THAT
+ * timeout, not before a fixed 90s. Applied, in the hook's own process only, as
+ * its FCD_HOOK_IDE_TIMEOUT_MS — a caller-env key, so the daemon evaluating the
+ * call applies it too (older daemons already honour it). It only ever narrows
+ * the 90s default: an entry configured longer keeps today's waits. An explicit
+ * FCD_HOOK_IDE_TIMEOUT_MS (drills) wins; a command line without the argument
+ * (older installs) keeps the default.
+ */
+export declare function applyIdeTimeoutArg(seconds: string | undefined, env?: NodeJS.ProcessEnv): void;
 /** Absolute time every wait inside a hook must end by, leaving the margin before the IDE's timeout. */
 export declare function ideWaitCutoff(startedAt: number, ideTimeoutMs?: number): number;
+/**
+ * One truthiness rule for FCD_* switches: `1`, `true`, `yes`, `on` (any case,
+ * surrounding spaces ignored). Unset, empty, `0`, `false`, `off` and anything
+ * else are off. New switches use it; the existing decision switches
+ * (FCD_HUMAN_PRESENT, FCD_EPHEMERAL, ...) keep their exact historical spellings,
+ * because widening them would change a verdict for the same input.
+ */
+export declare function envFlag(value: string | undefined): boolean;
+/**
+ * The test-run markers set on THIS process (names; empty for every install).
+ * scripts/lib/no-real-dialog.js sets FCD_TEST_NO_REAL_DIALOG, the sandboxed
+ * daemon harnesses FCD_TEST_SANDBOX_ROOT, scripts/lib/fake-os-dialog.js
+ * FCD_FAKE_DIALOG_PID. No install, MSI, scheduled task or IDE hook config sets
+ * one. Read from process.env, never from a caller snapshot: the guards they
+ * drive (testRunGuard.ts, devConfirm, notify) protect this process's desktop
+ * and profile.
+ */
+export declare function testRunMarkers(env?: NodeJS.ProcessEnv): string[];
+/** A test run that promised no real OS dialog or notification on this desktop (devConfirm, notify). */
+export declare function noRealUiUnderTest(env?: NodeJS.ProcessEnv): boolean;
 /** CI / pipeline environments — no human at a keyboard. Shared by hooks and discovery. */
 export declare function isCiEnvironment(env?: NodeJS.ProcessEnv): boolean;
 /**